Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 11 May 2023 06:31:25 +0100
From:   Al Viro <viro@zeniv.linux.org.uk>
To:     ye.xingchen@zte.com.cn
Cc:     mst@redhat.com, jasowang@redhat.com, kvm@vger.kernel.org,
        virtualization@lists.linux-foundation.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] vhost_net: Use fdget() and fdput()
Message-ID: <20230511053125.GI3390869@ZenIV>
References: <202305051424047152799@zte.com.cn>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <202305051424047152799@zte.com.cn>
Sender: Al Viro <viro@ftp.linux.org.uk>
Precedence: bulk

On Fri, May 05, 2023 at 02:24:04PM +0800, ye.xingchen@zte.com.cn wrote:
> From: Ye Xingchen <ye.xingchen@zte.com.cn>
> 
> convert the fget()/fput() uses to fdget()/fdput().
> 
> Signed-off-by: Ye Xingchen <ye.xingchen@zte.com.cn>
> ---
>  drivers/vhost/net.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index ae2273196b0c..5b3fe4805182 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -1466,17 +1466,17 @@ static struct ptr_ring *get_tap_ptr_ring(struct file *file)
> 
>  static struct socket *get_tap_socket(int fd)
>  {
> -	struct file *file = fget(fd);
> +	struct fd f = fdget(fd);
>  	struct socket *sock;
> 
> -	if (!file)
> +	if (!f.file)
>  		return ERR_PTR(-EBADF);
> -	sock = tun_get_socket(file);
> +	sock = tun_get_socket(f.file);
>  	if (!IS_ERR(sock))
>  		return sock;
> -	sock = tap_get_socket(file);
> +	sock = tap_get_socket(f.file);
>  	if (IS_ERR(sock))
> -		fput(file);
> +		fdput(f);
>  	return sock;

NAK.  For the same reason why the sockfd_lookup() counterpart of that
patch is broken.  After your change there's no way for the caller
to tell whether we have bumped the refcount of file in question;
this can't possibly work.