Loading arch/alpha/kernel/osf_sys.c +6 −9 Original line number Diff line number Diff line Loading @@ -144,28 +144,25 @@ SYSCALL_DEFINE4(osf_getdirentries, unsigned int, fd, struct osf_dirent __user *, dirent, unsigned int, count, long __user *, basep) { int error, fput_needed; struct file *file; int error; struct fd arg = fdget(fd); struct osf_dirent_callback buf; error = -EBADF; file = fget_light(fd, &fput_needed); if (!file) goto out; if (!arg.file) return -EBADF; buf.dirent = dirent; buf.basep = basep; buf.count = count; buf.error = 0; error = vfs_readdir(file, osf_filldir, &buf); error = vfs_readdir(arg.file, osf_filldir, &buf); if (error >= 0) error = buf.error; if (count != buf.count) error = count - buf.count; fput_light(file, fput_needed); out: fdput(arg); return error; } Loading arch/ia64/kernel/perfmon.c +7 −8 Original line number Diff line number Diff line Loading @@ -4780,7 +4780,7 @@ pfm_check_task_state(pfm_context_t *ctx, int cmd, unsigned long flags) asmlinkage long sys_perfmonctl (int fd, int cmd, void __user *arg, int count) { struct file *file = NULL; struct fd f = {NULL, 0}; pfm_context_t *ctx = NULL; unsigned long flags = 0UL; void *args_k = NULL; Loading @@ -4789,7 +4789,6 @@ sys_perfmonctl (int fd, int cmd, void __user *arg, int count) int narg, completed_args = 0, call_made = 0, cmd_flags; int (*func)(pfm_context_t *ctx, void *arg, int count, struct pt_regs *regs); int (*getsize)(void *arg, size_t *sz); int fput_needed; #define PFM_MAX_ARGSIZE 4096 /* Loading Loading @@ -4878,17 +4877,17 @@ sys_perfmonctl (int fd, int cmd, void __user *arg, int count) ret = -EBADF; file = fget_light(fd, &fput_needed); if (unlikely(file == NULL)) { f = fdget(fd); if (unlikely(f.file == NULL)) { DPRINT(("invalid fd %d\n", fd)); goto error_args; } if (unlikely(PFM_IS_FILE(file) == 0)) { if (unlikely(PFM_IS_FILE(f.file) == 0)) { DPRINT(("fd %d not related to perfmon\n", fd)); goto error_args; } ctx = file->private_data; ctx = f.file->private_data; if (unlikely(ctx == NULL)) { DPRINT(("no context for fd %d\n", fd)); goto error_args; Loading Loading @@ -4918,8 +4917,8 @@ sys_perfmonctl (int fd, int cmd, void __user *arg, int count) if (call_made && PFM_CMD_RW_ARG(cmd) && copy_to_user(arg, args_k, base_sz*count)) ret = -EFAULT; error_args: if (file) fput_light(file, fput_needed); if (f.file) fdput(f); kfree(args_k); Loading arch/parisc/hpux/fs.c +8 −9 Original line number Diff line number Diff line Loading @@ -109,33 +109,32 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset, int hpux_getdents(unsigned int fd, struct hpux_dirent __user *dirent, unsigned int count) { struct file * file; struct fd arg; struct hpux_dirent __user * lastdirent; struct getdents_callback buf; int error = -EBADF, fput_needed; int error; file = fget_light(fd, &fput_needed); if (!file) goto out; arg = fdget(fd); if (!arg.file) return -EBADF; buf.current_dir = dirent; buf.previous = NULL; buf.count = count; buf.error = 0; error = vfs_readdir(file, filldir, &buf); error = vfs_readdir(arg.file, filldir, &buf); if (error >= 0) error = buf.error; lastdirent = buf.previous; if (lastdirent) { if (put_user(file->f_pos, &lastdirent->d_off)) if (put_user(arg.file->f_pos, &lastdirent->d_off)) error = -EFAULT; else error = count - buf.count; } fput_light(file, fput_needed); out: fdput(arg); return error; } Loading arch/powerpc/platforms/cell/spu_syscalls.c +9 −12 Original line number Diff line number Diff line Loading @@ -69,8 +69,6 @@ SYSCALL_DEFINE4(spu_create, const char __user *, name, unsigned int, flags, umode_t, mode, int, neighbor_fd) { long ret; struct file *neighbor; int fput_needed; struct spufs_calls *calls; calls = spufs_calls_get(); Loading @@ -78,11 +76,11 @@ SYSCALL_DEFINE4(spu_create, const char __user *, name, unsigned int, flags, return -ENOSYS; if (flags & SPU_CREATE_AFFINITY_SPU) { struct fd neighbor = fdget(neighbor_fd); ret = -EBADF; neighbor = fget_light(neighbor_fd, &fput_needed); if (neighbor) { ret = calls->create_thread(name, flags, mode, neighbor); fput_light(neighbor, fput_needed); if (neighbor.file) { ret = calls->create_thread(name, flags, mode, neighbor.file); fdput(neighbor); } } else ret = calls->create_thread(name, flags, mode, NULL); Loading @@ -94,8 +92,7 @@ SYSCALL_DEFINE4(spu_create, const char __user *, name, unsigned int, flags, asmlinkage long sys_spu_run(int fd, __u32 __user *unpc, __u32 __user *ustatus) { long ret; struct file *filp; int fput_needed; struct fd arg; struct spufs_calls *calls; calls = spufs_calls_get(); Loading @@ -103,10 +100,10 @@ asmlinkage long sys_spu_run(int fd, __u32 __user *unpc, __u32 __user *ustatus) return -ENOSYS; ret = -EBADF; filp = fget_light(fd, &fput_needed); if (filp) { ret = calls->spu_run(filp, unpc, ustatus); fput_light(filp, fput_needed); arg = fdget(fd); if (arg.file) { ret = calls->spu_run(arg.file, unpc, ustatus); fdput(arg); } spufs_calls_put(calls); Loading drivers/infiniband/core/ucma.c +6 −6 Original line number Diff line number Diff line Loading @@ -1184,20 +1184,20 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file, struct rdma_ucm_migrate_id cmd; struct rdma_ucm_migrate_resp resp; struct ucma_context *ctx; struct file *filp; struct fd f; struct ucma_file *cur_file; int ret = 0, fput_needed; int ret = 0; if (copy_from_user(&cmd, inbuf, sizeof(cmd))) return -EFAULT; /* Get current fd to protect against it being closed */ filp = fget_light(cmd.fd, &fput_needed); if (!filp) f = fdget(cmd.fd); if (!f.file) return -ENOENT; /* Validate current fd and prevent destruction of id. */ ctx = ucma_get_ctx(filp->private_data, cmd.id); ctx = ucma_get_ctx(f.file->private_data, cmd.id); if (IS_ERR(ctx)) { ret = PTR_ERR(ctx); goto file_put; Loading Loading @@ -1231,7 +1231,7 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file, ucma_put_ctx(ctx); file_put: fput_light(filp, fput_needed); fdput(f); return ret; } Loading Loading
arch/alpha/kernel/osf_sys.c +6 −9 Original line number Diff line number Diff line Loading @@ -144,28 +144,25 @@ SYSCALL_DEFINE4(osf_getdirentries, unsigned int, fd, struct osf_dirent __user *, dirent, unsigned int, count, long __user *, basep) { int error, fput_needed; struct file *file; int error; struct fd arg = fdget(fd); struct osf_dirent_callback buf; error = -EBADF; file = fget_light(fd, &fput_needed); if (!file) goto out; if (!arg.file) return -EBADF; buf.dirent = dirent; buf.basep = basep; buf.count = count; buf.error = 0; error = vfs_readdir(file, osf_filldir, &buf); error = vfs_readdir(arg.file, osf_filldir, &buf); if (error >= 0) error = buf.error; if (count != buf.count) error = count - buf.count; fput_light(file, fput_needed); out: fdput(arg); return error; } Loading
arch/ia64/kernel/perfmon.c +7 −8 Original line number Diff line number Diff line Loading @@ -4780,7 +4780,7 @@ pfm_check_task_state(pfm_context_t *ctx, int cmd, unsigned long flags) asmlinkage long sys_perfmonctl (int fd, int cmd, void __user *arg, int count) { struct file *file = NULL; struct fd f = {NULL, 0}; pfm_context_t *ctx = NULL; unsigned long flags = 0UL; void *args_k = NULL; Loading @@ -4789,7 +4789,6 @@ sys_perfmonctl (int fd, int cmd, void __user *arg, int count) int narg, completed_args = 0, call_made = 0, cmd_flags; int (*func)(pfm_context_t *ctx, void *arg, int count, struct pt_regs *regs); int (*getsize)(void *arg, size_t *sz); int fput_needed; #define PFM_MAX_ARGSIZE 4096 /* Loading Loading @@ -4878,17 +4877,17 @@ sys_perfmonctl (int fd, int cmd, void __user *arg, int count) ret = -EBADF; file = fget_light(fd, &fput_needed); if (unlikely(file == NULL)) { f = fdget(fd); if (unlikely(f.file == NULL)) { DPRINT(("invalid fd %d\n", fd)); goto error_args; } if (unlikely(PFM_IS_FILE(file) == 0)) { if (unlikely(PFM_IS_FILE(f.file) == 0)) { DPRINT(("fd %d not related to perfmon\n", fd)); goto error_args; } ctx = file->private_data; ctx = f.file->private_data; if (unlikely(ctx == NULL)) { DPRINT(("no context for fd %d\n", fd)); goto error_args; Loading Loading @@ -4918,8 +4917,8 @@ sys_perfmonctl (int fd, int cmd, void __user *arg, int count) if (call_made && PFM_CMD_RW_ARG(cmd) && copy_to_user(arg, args_k, base_sz*count)) ret = -EFAULT; error_args: if (file) fput_light(file, fput_needed); if (f.file) fdput(f); kfree(args_k); Loading
arch/parisc/hpux/fs.c +8 −9 Original line number Diff line number Diff line Loading @@ -109,33 +109,32 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset, int hpux_getdents(unsigned int fd, struct hpux_dirent __user *dirent, unsigned int count) { struct file * file; struct fd arg; struct hpux_dirent __user * lastdirent; struct getdents_callback buf; int error = -EBADF, fput_needed; int error; file = fget_light(fd, &fput_needed); if (!file) goto out; arg = fdget(fd); if (!arg.file) return -EBADF; buf.current_dir = dirent; buf.previous = NULL; buf.count = count; buf.error = 0; error = vfs_readdir(file, filldir, &buf); error = vfs_readdir(arg.file, filldir, &buf); if (error >= 0) error = buf.error; lastdirent = buf.previous; if (lastdirent) { if (put_user(file->f_pos, &lastdirent->d_off)) if (put_user(arg.file->f_pos, &lastdirent->d_off)) error = -EFAULT; else error = count - buf.count; } fput_light(file, fput_needed); out: fdput(arg); return error; } Loading
arch/powerpc/platforms/cell/spu_syscalls.c +9 −12 Original line number Diff line number Diff line Loading @@ -69,8 +69,6 @@ SYSCALL_DEFINE4(spu_create, const char __user *, name, unsigned int, flags, umode_t, mode, int, neighbor_fd) { long ret; struct file *neighbor; int fput_needed; struct spufs_calls *calls; calls = spufs_calls_get(); Loading @@ -78,11 +76,11 @@ SYSCALL_DEFINE4(spu_create, const char __user *, name, unsigned int, flags, return -ENOSYS; if (flags & SPU_CREATE_AFFINITY_SPU) { struct fd neighbor = fdget(neighbor_fd); ret = -EBADF; neighbor = fget_light(neighbor_fd, &fput_needed); if (neighbor) { ret = calls->create_thread(name, flags, mode, neighbor); fput_light(neighbor, fput_needed); if (neighbor.file) { ret = calls->create_thread(name, flags, mode, neighbor.file); fdput(neighbor); } } else ret = calls->create_thread(name, flags, mode, NULL); Loading @@ -94,8 +92,7 @@ SYSCALL_DEFINE4(spu_create, const char __user *, name, unsigned int, flags, asmlinkage long sys_spu_run(int fd, __u32 __user *unpc, __u32 __user *ustatus) { long ret; struct file *filp; int fput_needed; struct fd arg; struct spufs_calls *calls; calls = spufs_calls_get(); Loading @@ -103,10 +100,10 @@ asmlinkage long sys_spu_run(int fd, __u32 __user *unpc, __u32 __user *ustatus) return -ENOSYS; ret = -EBADF; filp = fget_light(fd, &fput_needed); if (filp) { ret = calls->spu_run(filp, unpc, ustatus); fput_light(filp, fput_needed); arg = fdget(fd); if (arg.file) { ret = calls->spu_run(arg.file, unpc, ustatus); fdput(arg); } spufs_calls_put(calls); Loading
drivers/infiniband/core/ucma.c +6 −6 Original line number Diff line number Diff line Loading @@ -1184,20 +1184,20 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file, struct rdma_ucm_migrate_id cmd; struct rdma_ucm_migrate_resp resp; struct ucma_context *ctx; struct file *filp; struct fd f; struct ucma_file *cur_file; int ret = 0, fput_needed; int ret = 0; if (copy_from_user(&cmd, inbuf, sizeof(cmd))) return -EFAULT; /* Get current fd to protect against it being closed */ filp = fget_light(cmd.fd, &fput_needed); if (!filp) f = fdget(cmd.fd); if (!f.file) return -ENOENT; /* Validate current fd and prevent destruction of id. */ ctx = ucma_get_ctx(filp->private_data, cmd.id); ctx = ucma_get_ctx(f.file->private_data, cmd.id); if (IS_ERR(ctx)) { ret = PTR_ERR(ctx); goto file_put; Loading Loading @@ -1231,7 +1231,7 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file, ucma_put_ctx(ctx); file_put: fput_light(filp, fput_needed); fdput(f); return ret; } Loading