This is a note to let you know that I've just added the patch titled file: In f_dupfd read RLIMIT_NOFILE once. to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: file-in-f_dupfd-read-rlimit_nofile-once.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit e8a8458ab206395b87d4c15d952abff7786cb84a Author: Eric W. Biederman <ebiederm@xxxxxxxxxxxx> Date: Fri Nov 20 17:14:36 2020 -0600 file: In f_dupfd read RLIMIT_NOFILE once. Simplify the code, and remove the chance of races by reading RLIMIT_NOFILE only once in f_dupfd. Pass the read value of RLIMIT_NOFILE into alloc_fd which is the other location the rlimit was read in f_dupfd. As f_dupfd is the only caller of alloc_fd this changing alloc_fd is trivially safe. Further this causes alloc_fd to take all of the same arguments as __alloc_fd except for the files_struct argument. Acked-by: Christian Brauner <christian.brauner@xxxxxxxxxx> v1: https://lkml.kernel.org/r/20200817220425.9389-15-ebiederm@xxxxxxxxxxxx Link: https://lkml.kernel.org/r/20201120231441.29911-19-ebiederm@xxxxxxxxxxxx Signed-off-by: Eric W. Biederman <ebiederm@xxxxxxxxxxxx> Signed-off-by: Chuck Lever <chuck.lever@xxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/fs/file.c b/fs/file.c index a80deabe7f7dc..9e2b171b92520 100644 --- a/fs/file.c +++ b/fs/file.c @@ -567,9 +567,9 @@ int __alloc_fd(struct files_struct *files, return error; } -static int alloc_fd(unsigned start, unsigned flags) +static int alloc_fd(unsigned start, unsigned end, unsigned flags) { - return __alloc_fd(current->files, start, rlimit(RLIMIT_NOFILE), flags); + return __alloc_fd(current->files, start, end, flags); } int __get_unused_fd_flags(unsigned flags, unsigned long nofile) @@ -1235,10 +1235,11 @@ SYSCALL_DEFINE1(dup, unsigned int, fildes) int f_dupfd(unsigned int from, struct file *file, unsigned flags) { + unsigned long nofile = rlimit(RLIMIT_NOFILE); int err; - if (from >= rlimit(RLIMIT_NOFILE)) + if (from >= nofile) return -EINVAL; - err = alloc_fd(from, flags); + err = alloc_fd(from, nofile, flags); if (err >= 0) { get_file(file); fd_install(err, file);