[PATCH RFC v2 00/48] file: add and convert to FD_PREPARE()

[PATCH RFC v2 00/48] file: add and convert to FD_PREPARE()

[Christian Brauner]

Hey,

I've been playing with this to allow for moderately flexible usage of
the get_unused_fd_flags() + create file + fd_install() pattern that's
used quite extensively.

How callers allocate files is really heterogenous so it's not really
convenient to fold them into a single class. It's possibe to split them
into subclasses like for anon inodes. I think that's not necessarily
nice as well.

My take is to add a scope-based FD_PREPARE() primitive that work as
follows:

FD_PREPARE(fdprep, open_flag, file_open_handle(&path, open_flag)) {
        if (fd_prepare_failed(fdprep))
                return fd_prepare_error(fdprep);

        return fd_publish(fdprep);
}

The scope based variant not just makes the lifetime very clear and
allows allows to easily jump over the guard without issues.

That's somewhat modeled after how we use wait_event() to allow for
arbitrary things to be used as a condition in it. Here we obviously
expect a struct file that we will own once FD_PREPARE was successful.

It's centered around struct fd_prepare. FD_PREPARE() encapsulates all of
allocation and cleanup logic and must be followed by a call to
fd_publish() which associates the fd with the file and installs it into
the callers fdtable. If fd_publish() isn't called both are deallocated.

It mandates a specific order namely that first we allocate the fd and
then instantiate the file. But that shouldn't be a problem nearly
everyone I've converted uses this exact pattern anyway.

I've converted all of the easy cases over to it and it gets rid of a lot
of convoluted cleanup logic.

There's a bunch of other cases where it would be easy to convert them to
this pattern. For example, the whole sync file stuff in dma currently
retains the containing structure of the file instead of the file itself
even though it's only used to allocate files. Changing that would make
it fall into the FD_PREPARE() pattern easily. I've not done that work
yet.

There's room for extending this in a way that wed'd have subclasses for
some particularly often use patterns but as I said I'm not even sure
that's worth it.

Anyway, I'm not a macro wizard per se so maybe I missed some very
obvious bugs.

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
Changes in v2:
- Make FD_PREPARE() use a separate scope.
- Convert most easy cases.
- Link to v1: https://patch.msgid.link/20251118-work-fd-prepare-v1-0-c20504d97375@kernel.org

---
Christian Brauner (48):
      file: add FD_PREPARE()
      anon_inodes: convert __anon_inode_getfd() to FD_PREPARE()
      eventfd: convert do_eventfd() to FD_PREPARE()
      fhandle: convert do_handle_open() to FD_PREPARE()
      namespace: convert open_tree() to FD_PREPARE()
      namespace: convert open_tree_attr() to FD_PREPARE()
      namespace: convert fsmount() to FD_PREPARE()
      fanotify: convert fanotify_init() to FD_PREPARE()
      nsfs: convert open_namespace() to FD_PREPARE()
      nsfs: convert ns_ioctl() to FD_PREPARE()
      autofs: convert autofs_dev_ioctl_open_mountpoint() to FD_PREPARE()
      eventpoll: convert do_epoll_create() to FD_PREPARE()
      open: convert do_sys_openat2() to FD_PREPARE()
      signalfd: convert do_signalfd4() to FD_PREPARE()
      timerfd: convert timerfd_create() to FD_PREPARE()
      userfaultfd: convert new_userfaultfd() to FD_PREPARE()
      xfs: convert xfs_open_by_handle() to FD_PREPARE()
      drm: convert drm_mode_create_lease_ioctl() to FD_PREPARE()
      dma: convert dma_buf_fd() to FD_PREPARE()
      af_unix: convert unix_file_open() to FD_PREPARE()
      dma: convert sync_file_ioctl_merge() to FD_PREPARE()
      exec: convert begin_new_exec() to FD_PREPARE()
      ipc: convert do_mq_open() to FD_PREPARE()
      bpf: convert bpf_iter_new_fd() to FD_PREPARE()
      bpf: convert bpf_token_create() to FD_PREPARE()
      memfd: convert memfd_create() to FD_PREPARE()
      secretmem: convert memfd_secret() to FD_PREPARE()
      net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE()
      net/kcm: convert kcm_ioctl() to FD_PREPARE()
      net/sctp: convert sctp_getsockopt_peeloff_common() to FD_PREPARE()
      net/socket: convert sock_map_fd() to FD_PREPARE()
      net/socket: convert __sys_accept4_file() to FD_PREPARE()
      spufs: convert spufs_context_open() to FD_PREPARE()
      papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()
      spufs: convert spufs_gang_open() to FD_PREPARE()
      pseries: convert papr_platform_dump_create_handle() to FD_PREPARE()
      pseries: port papr_rtas_setup_file_interface() to FD_PREPARE()
      dma: port sw_sync_ioctl_create_fence() to FD_PREPARE()
      gpio: convert linehandle_create() to FD_PREPARE()
      hv: convert mshv_ioctl_create_partition() to FD_PREPARE()
      media: convert media_request_alloc() to FD_PREPARE()
      ntsync: convert ntsync_obj_get_fd() to FD_PREPARE()
      tty: convert ptm_open_peer() to FD_PREPARE()
      vfio: convert vfio_group_ioctl_get_device_fd() to FD_PREPARE()
      file: convert replace_fd() to FD_PREPARE()
      io_uring: convert io_create_mock_file() to FD_PREPARE()
      kvm: convert kvm_arch_supports_gmem_init_shared() to FD_PREPARE()
      kvm: convert kvm_vcpu_ioctl_get_stats_fd() to FD_PREPARE()

 arch/powerpc/platforms/cell/spufs/inode.c          |  40 ++----
 arch/powerpc/platforms/pseries/papr-hvpipe.c       |  58 ++++-----
 .../powerpc/platforms/pseries/papr-platform-dump.c |  46 +++----
 arch/powerpc/platforms/pseries/papr-rtas-common.c  |  30 ++---
 drivers/dma-buf/dma-buf.c                          |  13 +-
 drivers/dma-buf/sw_sync.c                          |  45 +++----
 drivers/dma-buf/sync_file.c                        |  55 +++-----
 drivers/gpio/gpiolib-cdev.c                        |  48 +++----
 drivers/gpu/drm/drm_lease.c                        |  83 +++++-------
 drivers/hv/mshv_root_main.c                        |  24 ++--
 drivers/media/mc/mc-request.c                      |  35 ++---
 drivers/misc/ntsync.c                              |  19 +--
 drivers/tty/pty.c                                  |  35 ++---
 drivers/vfio/group.c                               |  27 +---
 fs/anon_inodes.c                                   |  24 +---
 fs/autofs/dev-ioctl.c                              |  31 ++---
 fs/eventfd.c                                       |  30 ++---
 fs/eventpoll.c                                     |  34 ++---
 fs/exec.c                                          |  14 +-
 fs/fhandle.c                                       |  31 ++---
 fs/file.c                                          |  24 ++--
 fs/namespace.c                                     | 123 +++++++-----------
 fs/notify/fanotify/fanotify_user.c                 |  18 +--
 fs/nsfs.c                                          |  34 ++---
 fs/open.c                                          |  20 +--
 fs/signalfd.c                                      |  26 ++--
 fs/timerfd.c                                       |  27 ++--
 fs/userfaultfd.c                                   |  32 ++---
 fs/xfs/xfs_handle.c                                |  33 ++---
 include/linux/cleanup.h                            |  32 +++++
 include/linux/file.h                               | 141 +++++++++++++++++++++
 io_uring/mock_file.c                               |  53 +++-----
 ipc/mqueue.c                                       |  40 +++---
 kernel/bpf/bpf_iter.c                              |  32 ++---
 kernel/bpf/token.c                                 |  80 +++++-------
 mm/memfd.c                                         |  30 ++---
 mm/secretmem.c                                     |  21 +--
 net/handshake/netlink.c                            |  27 ++--
 net/kcm/kcmsock.c                                  |  24 ++--
 net/sctp/socket.c                                  |  36 ++----
 net/socket.c                                       |  35 ++---
 net/unix/af_unix.c                                 |  17 +--
 virt/kvm/guest_memfd.c                             |  81 +++++-------
 virt/kvm/kvm_main.c                                |  23 ++--
 44 files changed, 737 insertions(+), 994 deletions(-)
---
base-commit: c8e00cdc7425d5c60fd1ce6e7f71e5fb1b236991
change-id: 20251118-work-fd-prepare-f415a3bf5fda

[PATCH RFC v2 01/48] file: add FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 include/linux/cleanup.h |  32 +++++++++++
 include/linux/file.h    | 141 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 173 insertions(+)

diff --git a/include/linux/cleanup.h b/include/linux/cleanup.h
index 19c7e475d3a4..4b5b41bafd47 100644
--- a/include/linux/cleanup.h
+++ b/include/linux/cleanup.h
@@ -255,12 +255,20 @@ const volatile void * __must_check_fn(const volatile void *val)
  *	@exit is an expression using '_T' -- similar to FREE above.
  *	@init is an expression in @init_args resulting in @type
  *
+ * DEFINE_CLASS_TYPE(name, type, exit):
+ *	Like DEFINE_CLASS but without a constructor. Use with CLASS_INIT()
+ *	for classes that need custom initialization expressions per usage.
+ *
  * EXTEND_CLASS(name, ext, init, init_args...):
  *	extends class @name to @name@ext with the new constructor
  *
  * CLASS(name, var)(args...):
  *	declare the variable @var as an instance of the named class
  *
+ * CLASS_INIT(name, var, init_expr):
+ *	declare the variable @var as an instance of the named class with
+ *	custom initialization expression. Use with DEFINE_CLASS_TYPE().
+ *
  * Ex.
  *
  * DEFINE_CLASS(fdget, struct fd, fdput(_T), fdget(fd), int fd)
@@ -270,6 +278,12 @@ const volatile void * __must_check_fn(const volatile void *val)
  *		return -EBADF;
  *
  *	// use 'f' without concern
+ *
+ * DEFINE_CLASS_TYPE(fd_file, struct { int fd; struct file *file; }, ...)
+ *
+ *	CLASS_INIT(fd_file, ff, custom_init_expression);
+ *	if (ff.fd < 0)
+ *		return ff.fd;
  */
 
 #define DEFINE_CLASS(_name, _type, _exit, _init, _init_args...)		\
@@ -279,6 +293,11 @@ static inline void class_##_name##_destructor(_type *p)			\
 static inline _type class_##_name##_constructor(_init_args)		\
 { _type t = _init; return t; }
 
+#define DEFINE_CLASS_TYPE(_name, _type, _exit)				\
+typedef _type class_##_name##_t;					\
+static inline void class_##_name##_destructor(_type *p)		\
+{ _type _T = *p; _exit; }
+
 #define EXTEND_CLASS(_name, ext, _init, _init_args...)			\
 typedef class_##_name##_t class_##_name##ext##_t;			\
 static inline void class_##_name##ext##_destructor(class_##_name##_t *p)\
@@ -290,6 +309,9 @@ static inline class_##_name##_t class_##_name##ext##_constructor(_init_args) \
 	class_##_name##_t var __cleanup(class_##_name##_destructor) =	\
 		class_##_name##_constructor
 
+#define CLASS_INIT(_name, _var, _init_expr)                             \
+        class_##_name##_t _var __cleanup(class_##_name##_destructor) = (_init_expr)
+
 #define __scoped_class(_name, var, _label, args...)        \
 	for (CLASS(_name, var)(args); ; ({ goto _label; })) \
 		if (0) {                                   \
@@ -297,9 +319,19 @@ _label:                                                    \
 			break;                             \
 		} else
 
+#define __scoped_class_init(_name, var, _init_expr, _label)                \
+	for (CLASS_INIT(_name, var, _init_expr); ; ({ goto _label; })) \
+		if (0) {                                                    \
+_label:                                                                     \
+			break;                                              \
+		} else
+
 #define scoped_class(_name, var, args...) \
 	__scoped_class(_name, var, __UNIQUE_ID(label), args)
 
+#define scoped_class_init(_name, var, _init_expr) \
+	__scoped_class_init(_name, var, _init_expr, __UNIQUE_ID(label))
+
 /*
  * DEFINE_GUARD(name, type, lock, unlock):
  *	trivial wrapper around DEFINE_CLASS() above specifically
diff --git a/include/linux/file.h b/include/linux/file.h
index af1768d934a0..67dbc6b704f7 100644
--- a/include/linux/file.h
+++ b/include/linux/file.h
@@ -12,6 +12,7 @@
 #include <linux/errno.h>
 #include <linux/cleanup.h>
 #include <linux/err.h>
+#include <linux/vfsdebug.h>
 
 struct file;
 
@@ -127,4 +128,144 @@ extern void __fput_sync(struct file *);
 
 extern unsigned int sysctl_nr_open_min, sysctl_nr_open_max;
 
+/*
+ * fd_prepare class: Combined fd + file allocation with automatic cleanup.
+ *
+ * Allocates an fd and a file together. On error paths, automatically cleans
+ * up whichever resource was successfully allocated. Allows flexible file
+ * allocation with different functions per usage.
+ */
+
+struct fd_prepare {
+	struct file *file;
+	int fd;
+};
+
+/*
+ * fd_prepare_fd() - Get fd from fd_prepare structure
+ * @fd_prepare: struct fd_prepare to extract fd from
+ *
+ * Returns the file descriptor from an fd_prepare structure.
+ *
+ * Return: The file descriptor
+ */
+static inline int fd_prepare_fd(struct fd_prepare fdp)
+{
+	return fdp.fd;
+}
+
+/*
+ * fd_prepare_file() - Get file from fd_prepare structure
+ * @fd_prepare: struct fd_prepare to extract file from
+ *
+ * Returns the file pointer from an fd_prepare structure.
+ *
+ * Return: The file pointer
+ */
+static inline struct file *fd_prepare_file(struct fd_prepare fdp)
+{
+	return fdp.file;
+}
+
+/*
+ * fd_prepare_failed() - Check if fd_prepare allocation failed
+ * @fd_prepare: struct fd_prepare to check
+ *
+ * Checks whether either the fd allocation or file allocation failed.
+ *
+ * Return: true if either allocation failed, false otherwise
+ */
+static inline bool fd_prepare_failed(struct fd_prepare fdp)
+{
+	VFS_WARN_ON_ONCE(fdp.fd < 0 && IS_ERR(fdp.file));
+	return fdp.fd < 0 || IS_ERR(fdp.file);
+}
+
+/*
+ * fd_prepare_error() - Get error from failed fd_prepare
+ * @fd_prepare: struct fd_prepare to extract error from
+ *
+ * Returns the error code from the first allocation that failed.
+ * Should only be called after fd_prepare_failed() returns true.
+ *
+ * Return: Negative error code
+ */
+static inline int fd_prepare_error(struct fd_prepare fdp)
+{
+	if (fdp.fd < 0) {
+		VFS_WARN_ON_ONCE(fdp.file);
+		return fdp.fd;
+	}
+	if (!fdp.file)
+		return -ENOMEM;
+	return PTR_ERR(fdp.file);
+}
+
+static __always_inline void __fd_prepare_put(struct fd_prepare fdp)
+{
+	if (unlikely(fdp.fd >= 0))
+		put_unused_fd(fdp.fd);
+	if (unlikely(!IS_ERR_OR_NULL(fdp.file)))
+		fput(fdp.file);
+}
+
+DEFINE_CLASS_TYPE(fd_prepare, struct fd_prepare, __fd_prepare_put(_T))
+
+/*
+ * __FD_PREPARE_INIT(fd_flags, file_init_expr):
+ *     Helper to initialize fd_prepare class.
+ *     @fd_flags: flags for get_unused_fd_flags()
+ *     @file_init_expr: expression that returns struct file *
+ *
+ * Returns a struct fd_prepare with fd and file set.
+ * If fd allocation fails, file will be NULL.
+ * If fd succeeds but file_init_expr fails, fd will be cleaned up.
+ */
+#define __FD_PREPARE_INIT(_fd_flags, _file_init_owned)          \
+	({                                                      \
+		struct fd_prepare _fd_prepare = {               \
+			.fd = get_unused_fd_flags((_fd_flags)), \
+		};                                              \
+		if (likely(_fd_prepare.fd >= 0))                \
+			_fd_prepare.file = (_file_init_owned);  \
+		_fd_prepare;                                    \
+	})
+
+/*
+ * FD_PREPARE(var, fd_flags, file_init_owned):
+ *     Convenience wrapper for CLASS_INIT(fd_prepare, ...).
+ *
+ * @_var: name of struct fd_prepare variable to define
+ * @_fd_flags: flags for get_unused_fd_flags()
+ * @_file_init_owned: struct file to take ownership of (can be expression)
+ *
+ * Ex.
+ * FD_PREPARE(fdf, O_RDWR | O_CLOEXEC,
+ *                  anon_inode_getfile("[eventpoll]", &eventpoll_fops, ep, O_RDWR));
+ * if (fd_prepare_failed(fdf))
+ *     return fd_prepare_error(fdf);
+ *
+ * ep->file = fd_prepare_file(fdf);
+ * return fd_publish(fdf);
+ *
+ * Or with different file init function:
+ *
+ * FD_PREPARE(fdf, flags,
+ *                  anon_inode_getfile_fmode("[eventfd]", &eventfd_fops, ctx, flags, FMODE_NOWAIT));
+ * if (fd_prepare_failed(fdf))
+ *     return fd_prepare_error(fdf);
+ *
+ * return fd_publish(fdf);
+ */
+#define FD_PREPARE(_var, _fd_flags, _file_init_owned) \
+	scoped_class_init(fd_prepare, _var, __FD_PREPARE_INIT(_fd_flags, _file_init_owned))
+
+#define fd_publish(_fd_prepare)                          \
+	({                                               \
+		struct fd_prepare *__p = &(_fd_prepare); \
+		fd_install(__p->fd, __p->file);          \
+		retain_and_null_ptr(__p->file);          \
+		take_fd(__p->fd);                        \
+	})
+
 #endif /* __LINUX_FILE_H */

-- 
2.47.3

[PATCH RFC v2 02/48] anon_inodes: convert __anon_inode_getfd() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/anon_inodes.c | 24 +++++-------------------
 1 file changed, 5 insertions(+), 19 deletions(-)

diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c
index 180a458fc4f7..e02ce29098c5 100644
--- a/fs/anon_inodes.c
+++ b/fs/anon_inodes.c
@@ -280,27 +280,13 @@ static int __anon_inode_getfd(const char *name,
 			      const struct inode *context_inode,
 			      bool make_inode)
 {
-	int error, fd;
-	struct file *file;
-
-	error = get_unused_fd_flags(flags);
-	if (error < 0)
-		return error;
-	fd = error;
+	FD_PREPARE(fdf, flags, __anon_inode_getfile(name, fops, priv, flags,
+						    context_inode, make_inode)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	file = __anon_inode_getfile(name, fops, priv, flags, context_inode,
-				    make_inode);
-	if (IS_ERR(file)) {
-		error = PTR_ERR(file);
-		goto err_put_unused_fd;
+		return fd_publish(fdf);
 	}
-	fd_install(fd, file);
-
-	return fd;
-
-err_put_unused_fd:
-	put_unused_fd(fd);
-	return error;
 }
 
 /**

-- 
2.47.3

[PATCH RFC v2 03/48] eventfd: convert do_eventfd() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/eventfd.c | 30 +++++++++++-------------------
 1 file changed, 11 insertions(+), 19 deletions(-)

diff --git a/fs/eventfd.c b/fs/eventfd.c
index af42b2c7d235..9df390447c3b 100644
--- a/fs/eventfd.c
+++ b/fs/eventfd.c
@@ -378,9 +378,7 @@ EXPORT_SYMBOL_GPL(eventfd_ctx_fileget);
 
 static int do_eventfd(unsigned int count, int flags)
 {
-	struct eventfd_ctx *ctx;
-	struct file *file;
-	int fd;
+	struct eventfd_ctx *ctx __free(kfree) = NULL;
 
 	/* Check the EFD_* constants for consistency.  */
 	BUILD_BUG_ON(EFD_CLOEXEC != O_CLOEXEC);
@@ -398,26 +396,20 @@ static int do_eventfd(unsigned int count, int flags)
 	init_waitqueue_head(&ctx->wqh);
 	ctx->count = count;
 	ctx->flags = flags;
-	ctx->id = ida_alloc(&eventfd_ida, GFP_KERNEL);
 
 	flags &= EFD_SHARED_FCNTL_FLAGS;
 	flags |= O_RDWR;
-	fd = get_unused_fd_flags(flags);
-	if (fd < 0)
-		goto err;
-
-	file = anon_inode_getfile_fmode("[eventfd]", &eventfd_fops,
-					ctx, flags, FMODE_NOWAIT);
-	if (IS_ERR(file)) {
-		put_unused_fd(fd);
-		fd = PTR_ERR(file);
-		goto err;
+
+	FD_PREPARE(fdf, flags, anon_inode_getfile_fmode("[eventfd]", &eventfd_fops, ctx,
+							flags, FMODE_NOWAIT)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
+
+		ctx->id = ida_alloc(&eventfd_ida, GFP_KERNEL);
+		retain_and_null_ptr(ctx);
+
+		return fd_publish(fdf);
 	}
-	fd_install(fd, file);
-	return fd;
-err:
-	eventfd_free_ctx(ctx);
-	return fd;
 }
 
 SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags)

-- 
2.47.3

[PATCH RFC v2 04/48] fhandle: convert do_handle_open() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/fhandle.c | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/fs/fhandle.c b/fs/fhandle.c
index 052f9c9368fb..c31c90b6ad53 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -404,32 +404,33 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
 	return retval;
 }
 
+static struct file *file_open_handle(struct path *path, int open_flag)
+{
+	const struct export_operations *eops;
+
+	eops = path->mnt->mnt_sb->s_export_op;
+	if (eops->open)
+		return eops->open(path, open_flag);
+
+	return file_open_root(path, "", open_flag, 0);
+}
+
 static long do_handle_open(int mountdirfd, struct file_handle __user *ufh,
 			   int open_flag)
 {
 	long retval = 0;
 	struct path path __free(path_put) = {};
-	struct file *file;
-	const struct export_operations *eops;
 
 	retval = handle_to_path(mountdirfd, ufh, &path, open_flag);
 	if (retval)
 		return retval;
 
-	CLASS(get_unused_fd, fd)(open_flag);
-	if (fd < 0)
-		return fd;
-
-	eops = path.mnt->mnt_sb->s_export_op;
-	if (eops->open)
-		file = eops->open(&path, open_flag);
-	else
-		file = file_open_root(&path, "", open_flag, 0);
-	if (IS_ERR(file))
-		return PTR_ERR(file);
+	FD_PREPARE(fdf, open_flag, file_open_handle(&path, open_flag)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	fd_install(fd, file);
-	return take_fd(fd);
+		return fd_publish(fdf);
+	}
 }
 
 /**

-- 
2.47.3

[PATCH RFC v2 05/48] namespace: convert open_tree() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/namespace.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index d82910f33dc4..fbc4e4309bc8 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3103,19 +3103,12 @@ static struct file *vfs_open_tree(int dfd, const char __user *filename, unsigned
 
 SYSCALL_DEFINE3(open_tree, int, dfd, const char __user *, filename, unsigned, flags)
 {
-	int fd;
-	struct file *file __free(fput) = NULL;
-
-	file = vfs_open_tree(dfd, filename, flags);
-	if (IS_ERR(file))
-		return PTR_ERR(file);
-
-	fd = get_unused_fd_flags(flags & O_CLOEXEC);
-	if (fd < 0)
-		return fd;
+	FD_PREPARE(fdf, flags, vfs_open_tree(dfd, filename, flags)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	fd_install(fd, no_free_ptr(file));
-	return fd;
+		return fd_publish(fdf);
+	}
 }
 
 /*

-- 
2.47.3

[PATCH RFC v2 06/48] namespace: convert open_tree_attr() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/namespace.c | 46 ++++++++++++++++++++--------------------------
 1 file changed, 20 insertions(+), 26 deletions(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index fbc4e4309bc8..2be135c8de05 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5028,40 +5028,34 @@ SYSCALL_DEFINE5(open_tree_attr, int, dfd, const char __user *, filename,
 		unsigned, flags, struct mount_attr __user *, uattr,
 		size_t, usize)
 {
-	struct file __free(fput) *file = NULL;
-	int fd;
-
 	if (!uattr && usize)
 		return -EINVAL;
 
-	file = vfs_open_tree(dfd, filename, flags);
-	if (IS_ERR(file))
-		return PTR_ERR(file);
+	FD_PREPARE(fdf, flags, vfs_open_tree(dfd, filename, flags)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	if (uattr) {
-		int ret;
-		struct mount_kattr kattr = {};
+		if (uattr) {
+			int ret;
+			struct mount_kattr kattr = {};
+			struct file *file = fd_prepare_file(fdf);
 
-		if (flags & OPEN_TREE_CLONE)
-			kattr.kflags = MOUNT_KATTR_IDMAP_REPLACE;
-		if (flags & AT_RECURSIVE)
-			kattr.kflags |= MOUNT_KATTR_RECURSE;
+			if (flags & OPEN_TREE_CLONE)
+				kattr.kflags = MOUNT_KATTR_IDMAP_REPLACE;
+			if (flags & AT_RECURSIVE)
+				kattr.kflags |= MOUNT_KATTR_RECURSE;
 
-		ret = wants_mount_setattr(uattr, usize, &kattr);
-		if (ret > 0) {
-			ret = do_mount_setattr(&file->f_path, &kattr);
-			finish_mount_kattr(&kattr);
+			ret = wants_mount_setattr(uattr, usize, &kattr);
+			if (ret > 0) {
+				ret = do_mount_setattr(&file->f_path, &kattr);
+				finish_mount_kattr(&kattr);
+			}
+			if (ret)
+				return ret;
 		}
-		if (ret)
-			return ret;
-	}
 
-	fd = get_unused_fd_flags(flags & O_CLOEXEC);
-	if (fd < 0)
-		return fd;
-
-	fd_install(fd, no_free_ptr(file));
-	return fd;
+		return fd_publish(fdf);
+	}
 }
 
 int show_path(struct seq_file *m, struct dentry *root)

-- 
2.47.3

[PATCH RFC v2 07/48] namespace: convert fsmount() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/namespace.c | 60 +++++++++++++++++++++++-----------------------------------
 1 file changed, 24 insertions(+), 36 deletions(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index 2be135c8de05..03e991df1603 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -4278,8 +4278,7 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
 {
 	struct mnt_namespace *ns;
 	struct fs_context *fc;
-	struct file *file;
-	struct path newmount;
+	struct path newmount __free(path_put) = {};
 	struct mount *mnt;
 	unsigned int mnt_flags = 0;
 	long ret;
@@ -4317,33 +4316,32 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
 
 	fc = fd_file(f)->private_data;
 
-	ret = mutex_lock_interruptible(&fc->uapi_mutex);
-	if (ret < 0)
+	ACQUIRE(mutex_intr, uapi_mutex)(&fc->uapi_mutex);
+	ret = ACQUIRE_ERR(mutex_intr, &uapi_mutex);
+	if (ret)
 		return ret;
 
 	/* There must be a valid superblock or we can't mount it */
 	ret = -EINVAL;
 	if (!fc->root)
-		goto err_unlock;
+		return ret;
 
 	ret = -EPERM;
 	if (mount_too_revealing(fc->root->d_sb, &mnt_flags)) {
 		errorfcp(fc, "VFS", "Mount too revealing");
-		goto err_unlock;
+		return ret;
 	}
 
 	ret = -EBUSY;
 	if (fc->phase != FS_CONTEXT_AWAITING_MOUNT)
-		goto err_unlock;
+		return ret;
 
 	if (fc->sb_flags & SB_MANDLOCK)
 		warn_mandlock();
 
 	newmount.mnt = vfs_create_mount(fc);
-	if (IS_ERR(newmount.mnt)) {
-		ret = PTR_ERR(newmount.mnt);
-		goto err_unlock;
-	}
+	if (IS_ERR(newmount.mnt))
+		return PTR_ERR(newmount.mnt);
 	newmount.dentry = dget(fc->root);
 	newmount.mnt->mnt_flags = mnt_flags;
 
@@ -4355,38 +4353,28 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
 	vfs_clean_context(fc);
 
 	ns = alloc_mnt_ns(current->nsproxy->mnt_ns->user_ns, true);
-	if (IS_ERR(ns)) {
-		ret = PTR_ERR(ns);
-		goto err_path;
-	}
+	if (IS_ERR(ns))
+		return PTR_ERR(ns);
 	mnt = real_mount(newmount.mnt);
 	ns->root = mnt;
 	ns->nr_mounts = 1;
 	mnt_add_to_ns(ns, mnt);
 	mntget(newmount.mnt);
 
-	/* Attach to an apparent O_PATH fd with a note that we need to unmount
-	 * it, not just simply put it.
-	 */
-	file = dentry_open(&newmount, O_PATH, fc->cred);
-	if (IS_ERR(file)) {
-		dissolve_on_fput(newmount.mnt);
-		ret = PTR_ERR(file);
-		goto err_path;
-	}
-	file->f_mode |= FMODE_NEED_UNMOUNT;
-
-	ret = get_unused_fd_flags((flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0);
-	if (ret >= 0)
-		fd_install(ret, file);
-	else
-		fput(file);
+	FD_PREPARE(fdf, (flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0,
+		   dentry_open(&newmount, O_PATH, fc->cred)) {
+		if (fd_prepare_failed(fdf)) {
+			dissolve_on_fput(newmount.mnt);
+			return fd_prepare_error(fdf);
+		}
 
-err_path:
-	path_put(&newmount);
-err_unlock:
-	mutex_unlock(&fc->uapi_mutex);
-	return ret;
+		/*
+		 * Attach to an apparent O_PATH fd with a note that we
+		 * need to unmount it, not just simply put it.
+		 */
+		fd_prepare_file(fdf)->f_mode |= FMODE_NEED_UNMOUNT;
+		return fd_publish(fdf);
+	}
 }
 
 static inline int vfs_move_mount(const struct path *from_path,

-- 
2.47.3

[PATCH RFC v2 08/48] fanotify: convert fanotify_init() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/notify/fanotify/fanotify_user.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 1dadda82cae5..f1541970c2f3 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -1606,7 +1606,6 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
 	unsigned int fid_mode = flags & FANOTIFY_FID_BITS;
 	unsigned int class = flags & FANOTIFY_CLASS_BITS;
 	unsigned int internal_flags = 0;
-	struct file *file;
 
 	pr_debug("%s: flags=%x event_f_flags=%x\n",
 		 __func__, flags, event_f_flags);
@@ -1755,19 +1754,14 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
 			goto out_destroy_group;
 	}
 
-	fd = get_unused_fd_flags(f_flags);
-	if (fd < 0)
-		goto out_destroy_group;
+	FD_PREPARE(fdf, f_flags,
+		   anon_inode_getfile_fmode("[fanotify]", &fanotify_fops, group,
+					    f_flags, FMODE_NONOTIFY)) {
+		if (!fd_prepare_failed(fdf))
+			return fd_publish(fdf);
 
-	file = anon_inode_getfile_fmode("[fanotify]", &fanotify_fops, group,
-					f_flags, FMODE_NONOTIFY);
-	if (IS_ERR(file)) {
-		put_unused_fd(fd);
-		fd = PTR_ERR(file);
-		goto out_destroy_group;
+		fd = fd_prepare_error(fdf);
 	}
-	fd_install(fd, file);
-	return fd;
 
 out_destroy_group:
 	fsnotify_destroy_group(group);

-- 
2.47.3

[PATCH RFC v2 09/48] nsfs: convert open_namespace() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/nsfs.c | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/fs/nsfs.c b/fs/nsfs.c
index 79b026a36fb6..ee1b2ecddf0f 100644
--- a/fs/nsfs.c
+++ b/fs/nsfs.c
@@ -108,7 +108,6 @@ int ns_get_path(struct path *path, struct task_struct *task,
 int open_namespace(struct ns_common *ns)
 {
 	struct path path __free(path_put) = {};
-	struct file *f;
 	int err;
 
 	/* call first to consume reference */
@@ -116,16 +115,12 @@ int open_namespace(struct ns_common *ns)
 	if (err < 0)
 		return err;
 
-	CLASS(get_unused_fd, fd)(O_CLOEXEC);
-	if (fd < 0)
-		return fd;
+	FD_PREPARE(fdf, O_CLOEXEC, dentry_open(&path, O_RDONLY, current_cred())) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	f = dentry_open(&path, O_RDONLY, current_cred());
-	if (IS_ERR(f))
-		return PTR_ERR(f);
-
-	fd_install(fd, f);
-	return take_fd(fd);
+		return fd_publish(fdf);
+	}
 }
 
 int open_related_ns(struct ns_common *ns,

-- 
2.47.3

[PATCH RFC v2 10/48] nsfs: convert ns_ioctl() to FD_PREPARE()

[Christian Brauner]

Placeholder commit message.

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/nsfs.c | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/fs/nsfs.c b/fs/nsfs.c
index ee1b2ecddf0f..fae7dc328896 100644
--- a/fs/nsfs.c
+++ b/fs/nsfs.c
@@ -325,15 +325,10 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl,
 		if (ret)
 			return ret;
 
-		CLASS(get_unused_fd, fd)(O_CLOEXEC);
-		if (fd < 0)
-			return fd;
+		FD_PREPARE(fdf, O_CLOEXEC, dentry_open(&path, O_RDONLY, current_cred())) {
+			if (fd_prepare_failed(fdf))
+				return fd_prepare_error(fdf);
 
-		f = dentry_open(&path, O_RDONLY, current_cred());
-		if (IS_ERR(f))
-			return PTR_ERR(f);
-
-		if (uinfo) {
 			/*
 			 * If @uinfo is passed return all information about the
 			 * mount namespace as well.
@@ -341,12 +336,10 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl,
 			ret = copy_ns_info_to_user(to_mnt_ns(ns), uinfo, usize, &kinfo);
 			if (ret)
 				return ret;
-		}
 
-		/* Transfer reference of @f to caller's fdtable. */
-		fd_install(fd, no_free_ptr(f));
-		/* File descriptor is live so hand it off to the caller. */
-		return take_fd(fd);
+			ret = fd_publish(fdf);
+		}
+		break;
 	}
 	default:
 		ret = -ENOTTY;

-- 
2.47.3

[PATCH RFC v2 11/48] autofs: convert autofs_dev_ioctl_open_mountpoint() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/autofs/dev-ioctl.c | 31 +++++++++----------------------
 1 file changed, 9 insertions(+), 22 deletions(-)

diff --git a/fs/autofs/dev-ioctl.c b/fs/autofs/dev-ioctl.c
index d8dd150cbd74..35f1a49e5c1d 100644
--- a/fs/autofs/dev-ioctl.c
+++ b/fs/autofs/dev-ioctl.c
@@ -231,32 +231,19 @@ static int test_by_type(const struct path *path, void *p)
  */
 static int autofs_dev_ioctl_open_mountpoint(const char *name, dev_t devid)
 {
-	int err, fd;
+	struct path path __free(path_put) = {};
+	int err;
 
-	fd = get_unused_fd_flags(O_CLOEXEC);
-	if (likely(fd >= 0)) {
-		struct file *filp;
-		struct path path;
+	err = find_autofs_mount(name, &path, test_by_dev, &devid);
+	if (err)
+		return err;
 
-		err = find_autofs_mount(name, &path, test_by_dev, &devid);
-		if (err)
-			goto out;
+	FD_PREPARE(fdf, O_CLOEXEC, dentry_open(&path, O_RDONLY, current_cred())) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-		filp = dentry_open(&path, O_RDONLY, current_cred());
-		path_put(&path);
-		if (IS_ERR(filp)) {
-			err = PTR_ERR(filp);
-			goto out;
-		}
-
-		fd_install(fd, filp);
+		return fd_publish(fdf);
 	}
-
-	return fd;
-
-out:
-	put_unused_fd(fd);
-	return err;
 }
 
 /* Open a file descriptor on an autofs mount point */

-- 
2.47.3

[PATCH RFC v2 12/48] eventpoll: convert do_epoll_create() to FD_PREPARE()

[Christian Brauner]

Placeholder commit message.

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/eventpoll.c | 34 ++++++++++++----------------------
 1 file changed, 12 insertions(+), 22 deletions(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index ee7c4b683ec3..908525e5061e 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -2165,9 +2165,8 @@ static void clear_tfile_check_list(void)
  */
 static int do_epoll_create(int flags)
 {
-	int error, fd;
-	struct eventpoll *ep = NULL;
-	struct file *file;
+	int error;
+	struct eventpoll *ep;
 
 	/* Check the EPOLL_* constant for consistency.  */
 	BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);
@@ -2184,26 +2183,17 @@ static int do_epoll_create(int flags)
 	 * Creates all the items needed to setup an eventpoll file. That is,
 	 * a file structure and a free file descriptor.
 	 */
-	fd = get_unused_fd_flags(O_RDWR | (flags & O_CLOEXEC));
-	if (fd < 0) {
-		error = fd;
-		goto out_free_ep;
-	}
-	file = anon_inode_getfile("[eventpoll]", &eventpoll_fops, ep,
-				 O_RDWR | (flags & O_CLOEXEC));
-	if (IS_ERR(file)) {
-		error = PTR_ERR(file);
-		goto out_free_fd;
+	FD_PREPARE(fdf, O_RDWR | (flags & O_CLOEXEC),
+		   anon_inode_getfile("[eventpoll]", &eventpoll_fops, ep,
+				      O_RDWR | (flags & O_CLOEXEC))) {
+		if (fd_prepare_failed(fdf)) {
+			ep_clear_and_put(ep);
+			return fd_prepare_error(fdf);
+		}
+
+		ep->file = fd_prepare_file(fdf);
+		return fd_publish(fdf);
 	}
-	ep->file = file;
-	fd_install(fd, file);
-	return fd;
-
-out_free_fd:
-	put_unused_fd(fd);
-out_free_ep:
-	ep_clear_and_put(ep);
-	return error;
 }
 
 SYSCALL_DEFINE1(epoll_create1, int, flags)

-- 
2.47.3

[PATCH RFC v2 13/48] open: convert do_sys_openat2() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/open.c | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/fs/open.c b/fs/open.c
index 3d64372ecc67..867a40f1d86a 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -1421,8 +1421,8 @@ static int do_sys_openat2(int dfd, const char __user *filename,
 			  struct open_how *how)
 {
 	struct open_flags op;
-	struct filename *tmp;
-	int err, fd;
+	struct filename *tmp __free(putname);
+	int err;
 
 	err = build_open_flags(how, &op);
 	if (unlikely(err))
@@ -1432,18 +1432,12 @@ static int do_sys_openat2(int dfd, const char __user *filename,
 	if (IS_ERR(tmp))
 		return PTR_ERR(tmp);
 
-	fd = get_unused_fd_flags(how->flags);
-	if (likely(fd >= 0)) {
-		struct file *f = do_filp_open(dfd, tmp, &op);
-		if (IS_ERR(f)) {
-			put_unused_fd(fd);
-			fd = PTR_ERR(f);
-		} else {
-			fd_install(fd, f);
-		}
+	FD_PREPARE(fdf, how->flags, do_filp_open(dfd, tmp, &op)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
+
+		return fd_publish(fdf);
 	}
-	putname(tmp);
-	return fd;
 }
 
 int do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)

-- 
2.47.3

[PATCH RFC v2 14/48] signalfd: convert do_signalfd4() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/signalfd.c | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/fs/signalfd.c b/fs/signalfd.c
index d469782f97f4..1ff1cd99e5a4 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -250,8 +250,6 @@ static const struct file_operations signalfd_fops = {
 
 static int do_signalfd4(int ufd, sigset_t *mask, int flags)
 {
-	struct signalfd_ctx *ctx;
-
 	/* Check the SFD_* constants for consistency.  */
 	BUILD_BUG_ON(SFD_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(SFD_NONBLOCK != O_NONBLOCK);
@@ -263,7 +261,7 @@ static int do_signalfd4(int ufd, sigset_t *mask, int flags)
 	signotset(mask);
 
 	if (ufd == -1) {
-		struct file *file;
+		struct signalfd_ctx *ctx __free(kfree) = NULL;
 
 		ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
 		if (!ctx)
@@ -271,22 +269,18 @@ static int do_signalfd4(int ufd, sigset_t *mask, int flags)
 
 		ctx->sigmask = *mask;
 
-		ufd = get_unused_fd_flags(flags & O_CLOEXEC);
-		if (ufd < 0) {
-			kfree(ctx);
-			return ufd;
-		}
+		FD_PREPARE(fdf, flags & O_CLOEXEC,
+			   anon_inode_getfile_fmode("[signalfd]", &signalfd_fops, ctx,
+						    O_RDWR | (flags & O_NONBLOCK), FMODE_NOWAIT)) {
+			if (fd_prepare_failed(fdf))
+				return fd_prepare_error(fdf);
 
-		file = anon_inode_getfile_fmode("[signalfd]", &signalfd_fops,
-					ctx, O_RDWR | (flags & O_NONBLOCK),
-					FMODE_NOWAIT);
-		if (IS_ERR(file)) {
-			put_unused_fd(ufd);
-			kfree(ctx);
-			return PTR_ERR(file);
+			retain_and_null_ptr(ctx);
+			return fd_publish(fdf);
 		}
-		fd_install(ufd, file);
 	} else {
+		struct signalfd_ctx *ctx;
+
 		CLASS(fd, f)(ufd);
 		if (fd_empty(f))
 			return -EBADF;

-- 
2.47.3

[PATCH RFC v2 15/48] timerfd: convert timerfd_create() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/timerfd.c | 27 +++++++++------------------
 1 file changed, 9 insertions(+), 18 deletions(-)

diff --git a/fs/timerfd.c b/fs/timerfd.c
index c68f28d9c426..58424e54a51a 100644
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -393,9 +393,7 @@ static const struct file_operations timerfd_fops = {
 
 SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
 {
-	int ufd;
-	struct timerfd_ctx *ctx;
-	struct file *file;
+	struct timerfd_ctx *ctx __free(kfree) = NULL;
 
 	/* Check the TFD_* constants for consistency.  */
 	BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC);
@@ -432,23 +430,16 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
 
 	ctx->moffs = ktime_mono_to_real(0);
 
-	ufd = get_unused_fd_flags(flags & TFD_SHARED_FCNTL_FLAGS);
-	if (ufd < 0) {
-		kfree(ctx);
-		return ufd;
-	}
+	FD_PREPARE(fdf, flags & TFD_SHARED_FCNTL_FLAGS,
+		   anon_inode_getfile_fmode("[timerfd]", &timerfd_fops, ctx,
+					    O_RDWR | (flags & TFD_SHARED_FCNTL_FLAGS),
+					    FMODE_NOWAIT)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	file = anon_inode_getfile_fmode("[timerfd]", &timerfd_fops, ctx,
-			    O_RDWR | (flags & TFD_SHARED_FCNTL_FLAGS),
-			    FMODE_NOWAIT);
-	if (IS_ERR(file)) {
-		put_unused_fd(ufd);
-		kfree(ctx);
-		return PTR_ERR(file);
+		retain_and_null_ptr(ctx);
+		return fd_publish(fdf);
 	}
-
-	fd_install(ufd, file);
-	return ufd;
 }
 
 static int do_timerfd_settime(int ufd, int flags, 

-- 
2.47.3

[PATCH RFC v2 16/48] userfaultfd: convert new_userfaultfd() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/userfaultfd.c | 32 +++++++++++---------------------
 1 file changed, 11 insertions(+), 21 deletions(-)

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 54c6cc7fe9c6..14f98caeae8e 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -2111,9 +2111,7 @@ static void init_once_userfaultfd_ctx(void *mem)
 
 static int new_userfaultfd(int flags)
 {
-	struct userfaultfd_ctx *ctx;
-	struct file *file;
-	int fd;
+	struct userfaultfd_ctx *ctx __free(kfree) = NULL;
 
 	VM_WARN_ON_ONCE(!current->mm);
 
@@ -2135,26 +2133,18 @@ static int new_userfaultfd(int flags)
 	atomic_set(&ctx->mmap_changing, 0);
 	ctx->mm = current->mm;
 
-	fd = get_unused_fd_flags(flags & UFFD_SHARED_FCNTL_FLAGS);
-	if (fd < 0)
-		goto err_out;
+	FD_PREPARE(fdf, flags & UFFD_SHARED_FCNTL_FLAGS,
+		   anon_inode_create_getfile("[userfaultfd]", &userfaultfd_fops, ctx,
+					     O_RDONLY | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	/* Create a new inode so that the LSM can block the creation.  */
-	file = anon_inode_create_getfile("[userfaultfd]", &userfaultfd_fops, ctx,
-			O_RDONLY | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL);
-	if (IS_ERR(file)) {
-		put_unused_fd(fd);
-		fd = PTR_ERR(file);
-		goto err_out;
+		/* prevent the mm struct to be freed */
+		mmgrab(ctx->mm);
+		fd_prepare_file(fdf)->f_mode |= FMODE_NOWAIT;
+		retain_and_null_ptr(ctx);
+		return fd_publish(fdf);
 	}
-	/* prevent the mm struct to be freed */
-	mmgrab(ctx->mm);
-	file->f_mode |= FMODE_NOWAIT;
-	fd_install(fd, file);
-	return fd;
-err_out:
-	kmem_cache_free(userfaultfd_ctx_cachep, ctx);
-	return fd;
 }
 
 static inline bool userfaultfd_syscall_allowed(int flags)

-- 
2.47.3

[PATCH RFC v2 17/48] xfs: convert xfs_open_by_handle() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/xfs/xfs_handle.c | 33 +++++++++++++--------------------
 1 file changed, 13 insertions(+), 20 deletions(-)

diff --git a/fs/xfs/xfs_handle.c b/fs/xfs/xfs_handle.c
index f19fce557354..7a2e53560fe2 100644
--- a/fs/xfs/xfs_handle.c
+++ b/fs/xfs/xfs_handle.c
@@ -234,9 +234,7 @@ xfs_open_by_handle(
 {
 	const struct cred	*cred = current_cred();
 	int			error;
-	int			fd;
 	int			permflag;
-	struct file		*filp;
 	struct inode		*inode;
 	struct dentry		*dentry;
 	fmode_t			fmode;
@@ -279,28 +277,23 @@ xfs_open_by_handle(
 		goto out_dput;
 	}
 
-	fd = get_unused_fd_flags(0);
-	if (fd < 0) {
-		error = fd;
-		goto out_dput;
-	}
-
 	path.mnt = parfilp->f_path.mnt;
 	path.dentry = dentry;
-	filp = dentry_open(&path, hreq->oflags, cred);
-	dput(dentry);
-	if (IS_ERR(filp)) {
-		put_unused_fd(fd);
-		return PTR_ERR(filp);
-	}
 
-	if (S_ISREG(inode->i_mode)) {
-		filp->f_flags |= O_NOATIME;
-		filp->f_mode |= FMODE_NOCMTIME;
-	}
+	FD_PREPARE(fdf, 0, dentry_open(&path, hreq->oflags, cred)) {
+		dput(dentry);
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
+
+		if (S_ISREG(inode->i_mode)) {
+			struct file *filp = fd_prepare_file(fdf);
 
-	fd_install(fd, filp);
-	return fd;
+			filp->f_flags |= O_NOATIME;
+			filp->f_mode |= FMODE_NOCMTIME;
+		}
+
+		return fd_publish(fdf);
+	}
 
  out_dput:
 	dput(dentry);

-- 
2.47.3

[PATCH RFC v2 18/48] drm: convert drm_mode_create_lease_ioctl() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 drivers/gpu/drm/drm_lease.c | 83 +++++++++++++++++++--------------------------
 1 file changed, 34 insertions(+), 49 deletions(-)

diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 94375c6a5425..beee981329a5 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -514,8 +514,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 					       object_count, sizeof(__u32));
 		if (IS_ERR(object_ids)) {
 			ret = PTR_ERR(object_ids);
-			idr_destroy(&leases);
-			goto out_lessor;
+			goto out_idr;
 		}
 
 		/* fill and validate the object idr */
@@ -524,61 +523,47 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 		kfree(object_ids);
 		if (ret) {
 			drm_dbg_lease(dev, "lease object lookup failed: %i\n", ret);
-			idr_destroy(&leases);
-			goto out_lessor;
+			goto out_idr;
 		}
 	}
 
-	/* Allocate a file descriptor for the lease */
-	fd = get_unused_fd_flags(cl->flags & (O_CLOEXEC | O_NONBLOCK));
-	if (fd < 0) {
-		idr_destroy(&leases);
-		ret = fd;
-		goto out_lessor;
-	}
-
-	drm_dbg_lease(dev, "Creating lease\n");
-	/* lessee will take the ownership of leases */
-	lessee = drm_lease_create(lessor, &leases);
-
-	if (IS_ERR(lessee)) {
-		ret = PTR_ERR(lessee);
-		idr_destroy(&leases);
-		goto out_leases;
-	}
-
-	/* Clone the lessor file to create a new file for us */
 	drm_dbg_lease(dev, "Allocating lease file\n");
-	lessee_file = file_clone_open(lessor_file);
-	if (IS_ERR(lessee_file)) {
-		ret = PTR_ERR(lessee_file);
-		goto out_lessee;
-	}
-
-	lessee_priv = lessee_file->private_data;
-	/* Change the file to a master one */
-	drm_master_put(&lessee_priv->master);
-	lessee_priv->master = lessee;
-	lessee_priv->is_master = 1;
-	lessee_priv->authenticated = 1;
-
-	/* Pass fd back to userspace */
-	drm_dbg_lease(dev, "Returning fd %d id %d\n", fd, lessee->lessee_id);
-	cl->fd = fd;
-	cl->lessee_id = lessee->lessee_id;
+	FD_PREPARE(fdf, cl->flags & (O_CLOEXEC | O_NONBLOCK),
+		   file_clone_open(lessor_file)) {
+		if (fd_prepare_failed(fdf)) {
+			ret = fd_prepare_error(fdf);
+			goto out_idr;
+		}
 
-	/* Hook up the fd */
-	fd_install(fd, lessee_file);
+		lessee_file = fd_prepare_file(fdf);
 
-	drm_master_put(&lessor);
-	drm_dbg_lease(dev, "drm_mode_create_lease_ioctl succeeded\n");
-	return 0;
+		drm_dbg_lease(dev, "Creating lease\n");
+		/* lessee will take the ownership of leases */
+		lessee = drm_lease_create(lessor, &leases);
+		if (IS_ERR(lessee)) {
+			ret = PTR_ERR(lessee);
+			goto out_idr;
+		}
 
-out_lessee:
-	drm_master_put(&lessee);
+		lessee_priv = lessee_file->private_data;
+		/* Change the file to a master one */
+		drm_master_put(&lessee_priv->master);
+		lessee_priv->master = lessee;
+		lessee_priv->is_master = 1;
+		lessee_priv->authenticated = 1;
+
+		/* Pass fd back to userspace */
+		drm_dbg_lease(dev, "Returning fd %d id %d\n", fd, lessee->lessee_id);
+		cl->lessee_id = lessee->lessee_id;
+		cl->fd = fd_publish(fdf);
+
+		drm_master_put(&lessor);
+		drm_dbg_lease(dev, "drm_mode_create_lease_ioctl succeeded\n");
+		return 0;
+	}
 
-out_leases:
-	put_unused_fd(fd);
+out_idr:
+	idr_destroy(&leases);
 
 out_lessor:
 	drm_master_put(&lessor);

-- 
2.47.3

[PATCH RFC v2 19/48] dma: convert dma_buf_fd() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 drivers/dma-buf/dma-buf.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 2bcf9ceca997..800c2255df06 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -768,18 +768,15 @@ EXPORT_SYMBOL_NS_GPL(dma_buf_export, "DMA_BUF");
  */
 int dma_buf_fd(struct dma_buf *dmabuf, int flags)
 {
-	int fd;
-
 	if (!dmabuf || !dmabuf->file)
 		return -EINVAL;
 
-	fd = get_unused_fd_flags(flags);
-	if (fd < 0)
-		return fd;
+	FD_PREPARE(fdf, flags, dmabuf->file) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	fd_install(fd, dmabuf->file);
-
-	return fd;
+		return fd_publish(fdf);
+	}
 }
 EXPORT_SYMBOL_NS_GPL(dma_buf_fd, "DMA_BUF");
 

-- 
2.47.3

[PATCH RFC v2 20/48] af_unix: convert unix_file_open() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 net/unix/af_unix.c | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 68c94f49f7b5..e68d8eb558c1 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -3277,9 +3277,6 @@ EXPORT_SYMBOL_GPL(unix_outq_len);
 
 static int unix_open_file(struct sock *sk)
 {
-	struct file *f;
-	int fd;
-
 	if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
 		return -EPERM;
 
@@ -3289,18 +3286,12 @@ static int unix_open_file(struct sock *sk)
 	if (!unix_sk(sk)->path.dentry)
 		return -ENOENT;
 
-	fd = get_unused_fd_flags(O_CLOEXEC);
-	if (fd < 0)
-		return fd;
+	FD_PREPARE(fdf, O_CLOEXEC, dentry_open(&unix_sk(sk)->path, O_PATH, current_cred())) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	f = dentry_open(&unix_sk(sk)->path, O_PATH, current_cred());
-	if (IS_ERR(f)) {
-		put_unused_fd(fd);
-		return PTR_ERR(f);
+		return fd_publish(fdf);
 	}
-
-	fd_install(fd, f);
-	return fd;
 }
 
 static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)

-- 
2.47.3

[PATCH RFC v2 21/48] dma: convert sync_file_ioctl_merge() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 drivers/dma-buf/sync_file.c | 55 ++++++++++++++++-----------------------------
 1 file changed, 19 insertions(+), 36 deletions(-)

diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
index 747e377fb954..f11f67551e6d 100644
--- a/drivers/dma-buf/sync_file.c
+++ b/drivers/dma-buf/sync_file.c
@@ -213,56 +213,39 @@ static __poll_t sync_file_poll(struct file *file, poll_table *wait)
 static long sync_file_ioctl_merge(struct sync_file *sync_file,
 				  unsigned long arg)
 {
-	int fd = get_unused_fd_flags(O_CLOEXEC);
-	int err;
 	struct sync_file *fence2, *fence3;
 	struct sync_merge_data data;
 
-	if (fd < 0)
-		return fd;
-
-	if (copy_from_user(&data, (void __user *)arg, sizeof(data))) {
-		err = -EFAULT;
-		goto err_put_fd;
-	}
+	if (copy_from_user(&data, (void __user *)arg, sizeof(data)))
+		return -EFAULT;
 
-	if (data.flags || data.pad) {
-		err = -EINVAL;
-		goto err_put_fd;
-	}
+	if (data.flags || data.pad)
+		return -EINVAL;
 
 	fence2 = sync_file_fdget(data.fd2);
-	if (!fence2) {
-		err = -ENOENT;
-		goto err_put_fd;
-	}
+	if (!fence2)
+		return -ENOENT;
 
 	data.name[sizeof(data.name) - 1] = '\0';
 	fence3 = sync_file_merge(data.name, sync_file, fence2);
 	if (!fence3) {
-		err = -ENOMEM;
-		goto err_put_fence2;
-	}
-
-	data.fence = fd;
-	if (copy_to_user((void __user *)arg, &data, sizeof(data))) {
-		err = -EFAULT;
-		goto err_put_fence3;
+		fput(fence2->file);
+		return -ENOMEM;
 	}
 
-	fd_install(fd, fence3->file);
-	fput(fence2->file);
-	return 0;
-
-err_put_fence3:
-	fput(fence3->file);
+	FD_PREPARE(fdf, O_CLOEXEC, fence3->file) {
+		fput(fence2->file);
+		if (fd_prepare_failed(fdf)) {
+			fput(fence3->file);
+			return fd_prepare_error(fdf);
+		}
 
-err_put_fence2:
-	fput(fence2->file);
+		data.fence = fd_prepare_fd(fdf);
+		if (copy_to_user((void __user *)arg, &data, sizeof(data)))
+			return -EFAULT;
 
-err_put_fd:
-	put_unused_fd(fd);
-	return err;
+		return fd_publish(fdf);
+	}
 }
 
 static int sync_fill_fence_info(struct dma_fence *fence,

-- 
2.47.3

[PATCH RFC v2 22/48] exec: convert begin_new_exec() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/exec.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index 4298e7e08d5d..137d4c74c73e 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1280,12 +1280,14 @@ int begin_new_exec(struct linux_binprm * bprm)
 
 	/* Pass the opened binary to the interpreter. */
 	if (bprm->have_execfd) {
-		retval = get_unused_fd_flags(0);
-		if (retval < 0)
-			goto out_unlock;
-		fd_install(retval, bprm->executable);
-		bprm->executable = NULL;
-		bprm->execfd = retval;
+		FD_PREPARE(fdf, 0, bprm->executable) {
+			if (fd_prepare_failed(fdf)) {
+				retval = fd_prepare_error(fdf);
+				goto out_unlock;
+			}
+			bprm->executable = NULL;
+			bprm->execfd = fd_publish(fdf);
+		}
 	}
 	return 0;
 

-- 
2.47.3

[PATCH RFC v2 23/48] ipc: convert do_mq_open() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 ipc/mqueue.c | 40 +++++++++++++++++++---------------------
 1 file changed, 19 insertions(+), 21 deletions(-)

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 093551fe66a7..c17e983a2e6e 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -899,7 +899,7 @@ static int do_mq_open(const char __user *u_name, int oflag, umode_t mode,
 	struct dentry *root = mnt->mnt_root;
 	struct filename *name;
 	struct path path;
-	int fd, error;
+	int ret;
 	int ro;
 
 	audit_mq_open(oflag, mode, attr);
@@ -908,38 +908,36 @@ static int do_mq_open(const char __user *u_name, int oflag, umode_t mode,
 	if (IS_ERR(name))
 		return PTR_ERR(name);
 
-	fd = get_unused_fd_flags(O_CLOEXEC);
-	if (fd < 0)
-		goto out_putname;
-
 	ro = mnt_want_write(mnt);	/* we'll drop it in any case */
 	inode_lock(d_inode(root));
 	path.dentry = lookup_noperm(&QSTR(name->name), root);
 	if (IS_ERR(path.dentry)) {
-		error = PTR_ERR(path.dentry);
-		goto out_putfd;
+		ret = PTR_ERR(path.dentry);
+		goto out_unlock;
 	}
 	path.mnt = mntget(mnt);
-	error = prepare_open(path.dentry, oflag, ro, mode, name, attr);
-	if (!error) {
-		struct file *file = dentry_open(&path, oflag, current_cred());
-		if (!IS_ERR(file))
-			fd_install(fd, file);
-		else
-			error = PTR_ERR(file);
+	ret = prepare_open(path.dentry, oflag, ro, mode, name, attr);
+	if (ret) {
+		path_put(&path);
+		goto out_unlock;
 	}
-	path_put(&path);
-out_putfd:
-	if (error) {
-		put_unused_fd(fd);
-		fd = error;
+
+	FD_PREPARE(fdf, O_CLOEXEC, dentry_open(&path, oflag, current_cred())) {
+		path_put(&path);
+		if (fd_prepare_failed(fdf)) {
+			ret = fd_prepare_error(fdf);
+			goto out_unlock;
+		}
+		ret = fd_publish(fdf);
+		goto out_unlock;
 	}
+
+out_unlock:
 	inode_unlock(d_inode(root));
 	if (!ro)
 		mnt_drop_write(mnt);
-out_putname:
 	putname(name);
-	return fd;
+	return ret;
 }
 
 SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, umode_t, mode,

-- 
2.47.3

[PATCH RFC v2 24/48] bpf: convert bpf_iter_new_fd() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 kernel/bpf/bpf_iter.c | 32 ++++++++++----------------------
 1 file changed, 10 insertions(+), 22 deletions(-)

diff --git a/kernel/bpf/bpf_iter.c b/kernel/bpf/bpf_iter.c
index 6ac35430c573..30e737f5b287 100644
--- a/kernel/bpf/bpf_iter.c
+++ b/kernel/bpf/bpf_iter.c
@@ -634,37 +634,25 @@ static int prepare_seq_file(struct file *file, struct bpf_iter_link *link)
 int bpf_iter_new_fd(struct bpf_link *link)
 {
 	struct bpf_iter_link *iter_link;
-	struct file *file;
 	unsigned int flags;
-	int err, fd;
+	int err;
 
 	if (link->ops != &bpf_iter_link_lops)
 		return -EINVAL;
 
 	flags = O_RDONLY | O_CLOEXEC;
-	fd = get_unused_fd_flags(flags);
-	if (fd < 0)
-		return fd;
-
-	file = anon_inode_getfile("bpf_iter", &bpf_iter_fops, NULL, flags);
-	if (IS_ERR(file)) {
-		err = PTR_ERR(file);
-		goto free_fd;
-	}
 
-	iter_link = container_of(link, struct bpf_iter_link, link);
-	err = prepare_seq_file(file, iter_link);
-	if (err)
-		goto free_file;
+	FD_PREPARE(fdf, flags, anon_inode_getfile("bpf_iter", &bpf_iter_fops, NULL, flags)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	fd_install(fd, file);
-	return fd;
+		iter_link = container_of(link, struct bpf_iter_link, link);
+		err = prepare_seq_file(fd_prepare_file(fdf), iter_link);
+		if (err)
+			return err;  /* Automatic cleanup handles fput */
 
-free_file:
-	fput(file);
-free_fd:
-	put_unused_fd(fd);
-	return err;
+		return fd_publish(fdf);
+	}
 }
 
 struct bpf_prog *bpf_iter_get_info(struct bpf_iter_meta *meta, bool in_stop)

-- 
2.47.3

[PATCH RFC v2 25/48] bpf: convert bpf_token_create() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 kernel/bpf/token.c | 80 ++++++++++++++++++++++++------------------------------
 1 file changed, 35 insertions(+), 45 deletions(-)

diff --git a/kernel/bpf/token.c b/kernel/bpf/token.c
index 0bbe412f854e..fcec0f6d42fa 100644
--- a/kernel/bpf/token.c
+++ b/kernel/bpf/token.c
@@ -111,16 +111,14 @@ const struct file_operations bpf_token_fops = {
 int bpf_token_create(union bpf_attr *attr)
 {
 	struct bpf_mount_opts *mnt_opts;
-	struct bpf_token *token = NULL;
 	struct user_namespace *userns;
 	struct inode *inode;
-	struct file *file;
-	CLASS(fd, f)(attr->token_create.bpffs_fd);
 	struct path path;
 	struct super_block *sb;
 	umode_t mode;
-	int err, fd;
+	int err;
 
+	CLASS(fd, f)(attr->token_create.bpffs_fd);
 	if (fd_empty(f))
 		return -EBADF;
 
@@ -166,48 +164,40 @@ int bpf_token_create(union bpf_attr *attr)
 	inode->i_fop = &bpf_token_fops;
 	clear_nlink(inode); /* make sure it is unlinked */
 
-	file = alloc_file_pseudo(inode, path.mnt, BPF_TOKEN_INODE_NAME, O_RDWR, &bpf_token_fops);
-	if (IS_ERR(file)) {
-		iput(inode);
-		return PTR_ERR(file);
-	}
-
-	token = kzalloc(sizeof(*token), GFP_USER);
-	if (!token) {
-		err = -ENOMEM;
-		goto out_file;
+	FD_PREPARE(fdf, O_CLOEXEC,
+		   alloc_file_pseudo(inode, path.mnt, BPF_TOKEN_INODE_NAME,
+				     O_RDWR, &bpf_token_fops)) {
+		struct bpf_token *token __free(kfree) = NULL;
+
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
+
+		token = kzalloc(sizeof(*token), GFP_USER);
+		if (!token)
+			return -ENOMEM;
+
+		atomic64_set(&token->refcnt, 1);
+
+		/*
+		 * Remember bpffs owning userns for future ns_capable() checks.
+		 * Delay taking a reference until the security check succeeded.
+		 * The userns can't go away and we can just rely on automatic
+		 * cleanup this way.
+		 */
+		token->userns = userns;
+		token->allowed_cmds = mnt_opts->delegate_cmds;
+		token->allowed_maps = mnt_opts->delegate_maps;
+		token->allowed_progs = mnt_opts->delegate_progs;
+		token->allowed_attachs = mnt_opts->delegate_attachs;
+
+		err = security_bpf_token_create(token, attr, &path);
+		if (err)
+			return err;
+
+		get_user_ns(token->userns);
+		fd_prepare_file(fdf)->private_data = no_free_ptr(token);
+		return fd_publish(fdf);
 	}
-
-	atomic64_set(&token->refcnt, 1);
-
-	/* remember bpffs owning userns for future ns_capable() checks */
-	token->userns = get_user_ns(userns);
-
-	token->allowed_cmds = mnt_opts->delegate_cmds;
-	token->allowed_maps = mnt_opts->delegate_maps;
-	token->allowed_progs = mnt_opts->delegate_progs;
-	token->allowed_attachs = mnt_opts->delegate_attachs;
-
-	err = security_bpf_token_create(token, attr, &path);
-	if (err)
-		goto out_token;
-
-	fd = get_unused_fd_flags(O_CLOEXEC);
-	if (fd < 0) {
-		err = fd;
-		goto out_token;
-	}
-
-	file->private_data = token;
-	fd_install(fd, file);
-
-	return fd;
-
-out_token:
-	bpf_token_free(token);
-out_file:
-	fput(file);
-	return err;
 }
 
 int bpf_token_get_info_by_fd(struct bpf_token *token,

-- 
2.47.3

[PATCH RFC v2 26/48] memfd: convert memfd_create() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 mm/memfd.c | 30 ++++++++----------------------
 1 file changed, 8 insertions(+), 22 deletions(-)

diff --git a/mm/memfd.c b/mm/memfd.c
index 1d109c1acf21..843d34e7b1a9 100644
--- a/mm/memfd.c
+++ b/mm/memfd.c
@@ -470,9 +470,9 @@ SYSCALL_DEFINE2(memfd_create,
 		const char __user *, uname,
 		unsigned int, flags)
 {
-	struct file *file;
-	int fd, error;
-	char *name;
+	char *name __free(kfree) = NULL;
+	unsigned int fd_flags;
+	int error;
 
 	error = sanitize_flags(&flags);
 	if (error < 0)
@@ -482,25 +482,11 @@ SYSCALL_DEFINE2(memfd_create,
 	if (IS_ERR(name))
 		return PTR_ERR(name);
 
-	fd = get_unused_fd_flags((flags & MFD_CLOEXEC) ? O_CLOEXEC : 0);
-	if (fd < 0) {
-		error = fd;
-		goto err_free_name;
-	}
+	fd_flags = (flags & MFD_CLOEXEC) ? O_CLOEXEC : 0;
+	FD_PREPARE(fdf, fd_flags, alloc_file(name, flags)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	file = alloc_file(name, flags);
-	if (IS_ERR(file)) {
-		error = PTR_ERR(file);
-		goto err_free_fd;
+		return fd_publish(fdf);
 	}
-
-	fd_install(fd, file);
-	kfree(name);
-	return fd;
-
-err_free_fd:
-	put_unused_fd(fd);
-err_free_name:
-	kfree(name);
-	return error;
 }

-- 
2.47.3

[PATCH RFC v2 27/48] secretmem: convert memfd_secret() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 mm/secretmem.c | 21 ++++-----------------
 1 file changed, 4 insertions(+), 17 deletions(-)

diff --git a/mm/secretmem.c b/mm/secretmem.c
index 60137305bc20..a41e67090868 100644
--- a/mm/secretmem.c
+++ b/mm/secretmem.c
@@ -224,9 +224,6 @@ static struct file *secretmem_file_create(unsigned long flags)
 
 SYSCALL_DEFINE1(memfd_secret, unsigned int, flags)
 {
-	struct file *file;
-	int fd, err;
-
 	/* make sure local flags do not confict with global fcntl.h */
 	BUILD_BUG_ON(SECRETMEM_FLAGS_MASK & O_CLOEXEC);
 
@@ -238,22 +235,12 @@ SYSCALL_DEFINE1(memfd_secret, unsigned int, flags)
 	if (atomic_read(&secretmem_users) < 0)
 		return -ENFILE;
 
-	fd = get_unused_fd_flags(flags & O_CLOEXEC);
-	if (fd < 0)
-		return fd;
+	FD_PREPARE(fdf, flags & O_CLOEXEC, secretmem_file_create(flags)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	file = secretmem_file_create(flags);
-	if (IS_ERR(file)) {
-		err = PTR_ERR(file);
-		goto err_put_fd;
+		return fd_publish(fdf);
 	}
-
-	fd_install(fd, file);
-	return fd;
-
-err_put_fd:
-	put_unused_fd(fd);
-	return err;
 }
 
 static int secretmem_init_fs_context(struct fs_context *fc)

-- 
2.47.3

[PATCH RFC v2 28/48] net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 net/handshake/netlink.c | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/net/handshake/netlink.c b/net/handshake/netlink.c
index 7e46d130dce2..1b51952ffbb9 100644
--- a/net/handshake/netlink.c
+++ b/net/handshake/netlink.c
@@ -93,7 +93,7 @@ int handshake_nl_accept_doit(struct sk_buff *skb, struct genl_info *info)
 	struct handshake_net *hn = handshake_pernet(net);
 	struct handshake_req *req = NULL;
 	struct socket *sock;
-	int class, fd, err;
+	int class, err;
 
 	err = -EOPNOTSUPP;
 	if (!hn)
@@ -110,22 +110,21 @@ int handshake_nl_accept_doit(struct sk_buff *skb, struct genl_info *info)
 		goto out_status;
 
 	sock = req->hr_sk->sk_socket;
-	fd = get_unused_fd_flags(O_CLOEXEC);
-	if (fd < 0) {
-		err = fd;
-		goto out_complete;
-	}
 
-	err = req->hr_proto->hp_accept(req, info, fd);
-	if (err) {
-		put_unused_fd(fd);
-		goto out_complete;
-	}
+	FD_PREPARE(fdf, O_CLOEXEC, sock->file) {
+		if (fd_prepare_failed(fdf)) {
+			err = fd_prepare_error(fdf);
+			goto out_complete;
+		}
 
-	fd_install(fd, get_file(sock->file));
+		get_file(sock->file); /* FD_PREPARE() consumes a reference. */
+		err = req->hr_proto->hp_accept(req, info, fd_prepare_fd(fdf));
+		if (err)
+			goto out_complete;  /* Automatic cleanup handles fput */
 
-	trace_handshake_cmd_accept(net, req, req->hr_sk, fd);
-	return 0;
+		trace_handshake_cmd_accept(net, req, req->hr_sk, fd_prepare_fd(fdf));
+		return fd_publish(fdf);
+	}
 
 out_complete:
 	handshake_complete(req, -EIO, NULL);

-- 
2.47.3

[PATCH RFC v2 29/48] net/kcm: convert kcm_ioctl() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 net/kcm/kcmsock.c | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index b4f01cb07561..bea2cfc8b89c 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1560,25 +1560,17 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 	}
 	case SIOCKCMCLONE: {
 		struct kcm_clone info;
-		struct file *file;
 
-		info.fd = get_unused_fd_flags(0);
-		if (unlikely(info.fd < 0))
-			return info.fd;
+		FD_PREPARE(fdf, 0, kcm_clone(sock)) {
+			if (fd_prepare_failed(fdf))
+				return fd_prepare_error(fdf);
 
-		file = kcm_clone(sock);
-		if (IS_ERR(file)) {
-			put_unused_fd(info.fd);
-			return PTR_ERR(file);
-		}
-		if (copy_to_user((void __user *)arg, &info,
-				 sizeof(info))) {
-			put_unused_fd(info.fd);
-			fput(file);
-			return -EFAULT;
+			info.fd = fd_prepare_fd(fdf);
+			if (copy_to_user((void __user *)arg, &info, sizeof(info)))
+				return -EFAULT;
+
+			err = fd_publish(fdf);
 		}
-		fd_install(info.fd, file);
-		err = 0;
 		break;
 	}
 	default:

-- 
2.47.3

[PATCH RFC v2 30/48] net/sctp: convert sctp_getsockopt_peeloff_common() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 net/sctp/socket.c | 36 ++++++++++++++----------------------
 1 file changed, 14 insertions(+), 22 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index ed8293a34240..68008514501e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5672,32 +5672,24 @@ static int sctp_getsockopt_peeloff_common(struct sock *sk, sctp_peeloff_arg_t *p
 
 	retval = sctp_do_peeloff(sk, peeloff->associd, &newsock);
 	if (retval < 0)
-		goto out;
-
-	/* Map the socket to an unused fd that can be returned to the user.  */
-	retval = get_unused_fd_flags(flags & SOCK_CLOEXEC);
-	if (retval < 0) {
-		sock_release(newsock);
-		goto out;
-	}
-
-	*newfile = sock_alloc_file(newsock, 0, NULL);
-	if (IS_ERR(*newfile)) {
-		put_unused_fd(retval);
-		retval = PTR_ERR(*newfile);
-		*newfile = NULL;
 		return retval;
-	}
 
-	pr_debug("%s: sk:%p, newsk:%p, sd:%d\n", __func__, sk, newsock->sk,
-		 retval);
+	FD_PREPARE(fdf, flags & SOCK_CLOEXEC, sock_alloc_file(newsock, 0, NULL)) {
+		if (fd_prepare_failed(fdf)) {
+			sock_release(newsock);
+			return fd_prepare_error(fdf);
+		}
 
-	peeloff->sd = retval;
+		pr_debug("%s: sk:%p, newsk:%p, sd:%d\n", __func__, sk, newsock->sk,
+			 fd_prepare_fd(fdf));
 
-	if (flags & SOCK_NONBLOCK)
-		(*newfile)->f_flags |= O_NONBLOCK;
-out:
-	return retval;
+		if (flags & SOCK_NONBLOCK)
+			fd_prepare_file(fdf)->f_flags |= O_NONBLOCK;
+
+		peeloff->sd = fd_prepare_fd(fdf);
+		*newfile = fd_prepare_file(fdf);
+		return fd_publish(fdf);
+	}
 }
 
 static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval, int __user *optlen)

-- 
2.47.3

[PATCH RFC v2 31/48] net/socket: convert sock_map_fd() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 net/socket.c | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/net/socket.c b/net/socket.c
index e8892b218708..669fecc79851 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -503,21 +503,14 @@ EXPORT_SYMBOL(sock_alloc_file);
 
 static int sock_map_fd(struct socket *sock, int flags)
 {
-	struct file *newfile;
-	int fd = get_unused_fd_flags(flags);
-	if (unlikely(fd < 0)) {
-		sock_release(sock);
-		return fd;
-	}
+	FD_PREPARE(fdf, flags, sock_alloc_file(sock, flags, NULL)) {
+		if (fd_prepare_failed(fdf)) {
+			sock_release(sock);
+			return fd_prepare_error(fdf);
+		}
 
-	newfile = sock_alloc_file(sock, flags, NULL);
-	if (!IS_ERR(newfile)) {
-		fd_install(fd, newfile);
-		return fd;
+		return fd_publish(fdf);
 	}
-
-	put_unused_fd(fd);
-	return PTR_ERR(newfile);
 }
 
 /**

-- 
2.47.3

[PATCH RFC v2 32/48] net/socket: convert __sys_accept4_file() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 net/socket.c | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/net/socket.c b/net/socket.c
index 669fecc79851..04ae71111235 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2005,8 +2005,6 @@ static int __sys_accept4_file(struct file *file, struct sockaddr __user *upeer_s
 			      int __user *upeer_addrlen, int flags)
 {
 	struct proto_accept_arg arg = { };
-	struct file *newfile;
-	int newfd;
 
 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
 		return -EINVAL;
@@ -2014,18 +2012,12 @@ static int __sys_accept4_file(struct file *file, struct sockaddr __user *upeer_s
 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
 
-	newfd = get_unused_fd_flags(flags);
-	if (unlikely(newfd < 0))
-		return newfd;
+	FD_PREPARE(fdf, flags, do_accept(file, &arg, upeer_sockaddr, upeer_addrlen, flags)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	newfile = do_accept(file, &arg, upeer_sockaddr, upeer_addrlen,
-			    flags);
-	if (IS_ERR(newfile)) {
-		put_unused_fd(newfd);
-		return PTR_ERR(newfile);
+		return fd_publish(fdf);
 	}
-	fd_install(newfd, newfile);
-	return newfd;
 }
 
 /*

-- 
2.47.3

[PATCH RFC v2 33/48] spufs: convert spufs_context_open() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 arch/powerpc/platforms/cell/spufs/inode.c | 19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
index 7ec60290abe6..856f62aba854 100644
--- a/arch/powerpc/platforms/cell/spufs/inode.c
+++ b/arch/powerpc/platforms/cell/spufs/inode.c
@@ -267,22 +267,13 @@ spufs_mkdir(struct inode *dir, struct dentry *dentry, unsigned int flags,
 
 static int spufs_context_open(const struct path *path)
 {
-	int ret;
-	struct file *filp;
+	FD_PREPARE(fdf, 0, dentry_open(path, O_RDONLY, current_cred())) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	ret = get_unused_fd_flags(0);
-	if (ret < 0)
-		return ret;
-
-	filp = dentry_open(path, O_RDONLY, current_cred());
-	if (IS_ERR(filp)) {
-		put_unused_fd(ret);
-		return PTR_ERR(filp);
+		fd_prepare_file(fdf)->f_op = &spufs_context_fops;
+		return fd_publish(fdf);
 	}
-
-	filp->f_op = &spufs_context_fops;
-	fd_install(ret, filp);
-	return ret;
 }
 
 static struct spu_context *

-- 
2.47.3

[PATCH RFC v2 34/48] papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()

[Christian Brauner]

Fixes a UAF for src_info as well.

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 arch/powerpc/platforms/pseries/papr-hvpipe.c | 58 +++++++++++-----------------
 1 file changed, 22 insertions(+), 36 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/papr-hvpipe.c b/arch/powerpc/platforms/pseries/papr-hvpipe.c
index 21a2f447c43f..84106bc75235 100644
--- a/arch/powerpc/platforms/pseries/papr-hvpipe.c
+++ b/arch/powerpc/platforms/pseries/papr-hvpipe.c
@@ -479,10 +479,8 @@ static const struct file_operations papr_hvpipe_handle_ops = {
 
 static int papr_hvpipe_dev_create_handle(u32 srcID)
 {
-	struct hvpipe_source_info *src_info;
-	struct file *file;
+	struct hvpipe_source_info *src_info __free(kfree) = NULL;
 	long err;
-	int fd;
 
 	spin_lock(&hvpipe_src_list_lock);
 	/*
@@ -506,43 +504,31 @@ static int papr_hvpipe_dev_create_handle(u32 srcID)
 	src_info->tsk = current;
 	init_waitqueue_head(&src_info->recv_wqh);
 
-	fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
-	if (fd < 0) {
-		err = fd;
-		goto free_buf;
-	}
-
-	file = anon_inode_getfile("[papr-hvpipe]",
-			&papr_hvpipe_handle_ops, (void *)src_info,
-			O_RDWR);
-	if (IS_ERR(file)) {
-		err = PTR_ERR(file);
-		goto free_fd;
-	}
+	FD_PREPARE(fdf, O_RDONLY | O_CLOEXEC,
+		   anon_inode_getfile("[papr-hvpipe]", &papr_hvpipe_handle_ops,
+				      (void *)src_info, O_RDWR)) {
+		if (fd_prepare_failed(fdf)) {
+			err = fd_prepare_error(fdf);
+			goto free_buf;
+		}
 
-	spin_lock(&hvpipe_src_list_lock);
-	/*
-	 * If two processes are executing ioctl() for the same
-	 * source ID concurrently, prevent the second process to
-	 * acquire FD.
-	 */
-	if (hvpipe_find_source(srcID)) {
+		retain_and_null_ptr(src_info);
+		spin_lock(&hvpipe_src_list_lock);
+		/*
+		 * If two processes are executing ioctl() for the same
+		 * source ID concurrently, prevent the second process to
+		 * acquire FD.
+		 */
+		if (hvpipe_find_source(srcID)) {
+			spin_unlock(&hvpipe_src_list_lock);
+			return -EALREADY;
+		}
+		list_add(&src_info->list, &hvpipe_src_list);
 		spin_unlock(&hvpipe_src_list_lock);
-		err = -EALREADY;
-		goto free_file;
-	}
-	list_add(&src_info->list, &hvpipe_src_list);
-	spin_unlock(&hvpipe_src_list_lock);
 
-	fd_install(fd, file);
-	return fd;
+		return fd_publish(fdf);
+	}
 
-free_file:
-	fput(file);
-free_fd:
-	put_unused_fd(fd);
-free_buf:
-	kfree(src_info);
 	return err;
 }
 

-- 
2.47.3

[PATCH RFC v2 35/48] spufs: convert spufs_gang_open() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 arch/powerpc/platforms/cell/spufs/inode.c | 21 ++++++---------------
 1 file changed, 6 insertions(+), 15 deletions(-)

diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
index 856f62aba854..5c3bb53820cb 100644
--- a/arch/powerpc/platforms/cell/spufs/inode.c
+++ b/arch/powerpc/platforms/cell/spufs/inode.c
@@ -499,26 +499,17 @@ static const struct file_operations spufs_gang_fops = {
 
 static int spufs_gang_open(const struct path *path)
 {
-	int ret;
-	struct file *filp;
-
-	ret = get_unused_fd_flags(0);
-	if (ret < 0)
-		return ret;
-
 	/*
 	 * get references for dget and mntget, will be released
 	 * in error path of *_open().
 	 */
-	filp = dentry_open(path, O_RDONLY, current_cred());
-	if (IS_ERR(filp)) {
-		put_unused_fd(ret);
-		return PTR_ERR(filp);
-	}
+	FD_PREPARE(fdf, 0, dentry_open(path, O_RDONLY, current_cred())) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	filp->f_op = &spufs_gang_fops;
-	fd_install(ret, filp);
-	return ret;
+		fd_prepare_file(fdf)->f_op = &spufs_gang_fops;
+		return fd_publish(fdf);
+	}
 }
 
 static int spufs_create_gang(struct inode *inode,

-- 
2.47.3

[PATCH RFC v2 36/48] pseries: convert papr_platform_dump_create_handle() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 .../powerpc/platforms/pseries/papr-platform-dump.c | 46 ++++++++--------------
 1 file changed, 16 insertions(+), 30 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/papr-platform-dump.c b/arch/powerpc/platforms/pseries/papr-platform-dump.c
index f8d55eccdb6b..c6020d7bdfa3 100644
--- a/arch/powerpc/platforms/pseries/papr-platform-dump.c
+++ b/arch/powerpc/platforms/pseries/papr-platform-dump.c
@@ -301,11 +301,8 @@ static const struct file_operations papr_platform_dump_handle_ops = {
  */
 static long papr_platform_dump_create_handle(u64 dump_tag)
 {
-	struct ibm_platform_dump_params *params;
+	struct ibm_platform_dump_params *params, *tmp;
 	u64 param_dump_tag;
-	struct file *file;
-	long err;
-	int fd;
 
 	/*
 	 * Return failure if the user space is already opened FD for
@@ -334,34 +331,23 @@ static long papr_platform_dump_create_handle(u64 dump_tag)
 	params->dump_tag_lo = (u32)(dump_tag & 0x00000000ffffffffULL);
 	params->status = RTAS_IBM_PLATFORM_DUMP_START;
 
-	fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
-	if (fd < 0) {
-		err = fd;
-		goto free_area;
-	}
-
-	file = anon_inode_getfile_fmode("[papr-platform-dump]",
-				&papr_platform_dump_handle_ops,
-				(void *)params, O_RDONLY,
-				FMODE_LSEEK | FMODE_PREAD);
-	if (IS_ERR(file)) {
-		err = PTR_ERR(file);
-		goto put_fd;
-	}
-
-	fd_install(fd, file);
+	FD_PREPARE(fdf, O_RDONLY | O_CLOEXEC,
+		   anon_inode_getfile_fmode("[papr-platform-dump]",
+					    &papr_platform_dump_handle_ops,
+					    (void *)params, O_RDONLY,
+					    FMODE_LSEEK | FMODE_PREAD)) {
+		if (fd_prepare_failed(fdf)) {
+			rtas_work_area_free(params->work_area);
+			kfree(params);
+			return fd_prepare_error(fdf);
+		}
 
-	list_add(&params->list, &platform_dump_list);
+		list_add(&params->list, &platform_dump_list);
 
-	pr_info("%s (%d) initiated platform dump for dump tag %llu\n",
-		current->comm, current->pid, dump_tag);
-	return fd;
-put_fd:
-	put_unused_fd(fd);
-free_area:
-	rtas_work_area_free(params->work_area);
-	kfree(params);
-	return err;
+		pr_info("%s (%d) initiated platform dump for dump tag %llu\n",
+			current->comm, current->pid, dump_tag);
+		return fd_publish(fdf);
+	}
 }
 
 /*

-- 
2.47.3

[PATCH RFC v2 37/48] pseries: port papr_rtas_setup_file_interface() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 arch/powerpc/platforms/pseries/papr-rtas-common.c | 30 ++++++-----------------
 1 file changed, 8 insertions(+), 22 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/papr-rtas-common.c b/arch/powerpc/platforms/pseries/papr-rtas-common.c
index 33c606e3378a..8d697b9db4f5 100644
--- a/arch/powerpc/platforms/pseries/papr-rtas-common.c
+++ b/arch/powerpc/platforms/pseries/papr-rtas-common.c
@@ -205,35 +205,21 @@ long papr_rtas_setup_file_interface(struct papr_rtas_sequence *seq,
 				char *name)
 {
 	const struct papr_rtas_blob *blob;
-	struct file *file;
-	long ret;
-	int fd;
 
 	blob = papr_rtas_retrieve(seq);
 	if (IS_ERR(blob))
 		return PTR_ERR(blob);
 
-	fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
-	if (fd < 0) {
-		ret = fd;
-		goto free_blob;
-	}
+	FD_PREPARE(fdf, O_RDONLY | O_CLOEXEC,
+		   anon_inode_getfile_fmode(name, fops, (void *)blob,
+					    O_RDONLY, FMODE_LSEEK | FMODE_PREAD)) {
+		if (fd_prepare_failed(fdf)) {
+			papr_rtas_blob_free(blob);
+			return fd_prepare_error(fdf);
+		}
 
-	file = anon_inode_getfile_fmode(name, fops, (void *)blob,
-			O_RDONLY, FMODE_LSEEK | FMODE_PREAD);
-	if (IS_ERR(file)) {
-		ret = PTR_ERR(file);
-		goto put_fd;
+		return fd_publish(fdf);
 	}
-
-	fd_install(fd, file);
-	return fd;
-
-put_fd:
-	put_unused_fd(fd);
-free_blob:
-	papr_rtas_blob_free(blob);
-	return ret;
 }
 
 /*

-- 
2.47.3

[PATCH RFC v2 38/48] dma: port sw_sync_ioctl_create_fence() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 drivers/dma-buf/sw_sync.c | 45 ++++++++++++++++-----------------------------
 1 file changed, 16 insertions(+), 29 deletions(-)

diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
index 3c20f1d31cf5..271bfa0c7d1f 100644
--- a/drivers/dma-buf/sw_sync.c
+++ b/drivers/dma-buf/sw_sync.c
@@ -343,47 +343,34 @@ static int sw_sync_debugfs_release(struct inode *inode, struct file *file)
 static long sw_sync_ioctl_create_fence(struct sync_timeline *obj,
 				       unsigned long arg)
 {
-	int fd = get_unused_fd_flags(O_CLOEXEC);
-	int err;
 	struct sync_pt *pt;
 	struct sync_file *sync_file;
 	struct sw_sync_create_fence_data data;
 
-	if (fd < 0)
-		return fd;
-
-	if (copy_from_user(&data, (void __user *)arg, sizeof(data))) {
-		err = -EFAULT;
-		goto err;
-	}
+	if (copy_from_user(&data, (void __user *)arg, sizeof(data)))
+		return -EFAULT;
 
 	pt = sync_pt_create(obj, data.value);
-	if (!pt) {
-		err = -ENOMEM;
-		goto err;
-	}
+	if (!pt)
+		return -ENOMEM;
 
 	sync_file = sync_file_create(&pt->base);
 	dma_fence_put(&pt->base);
-	if (!sync_file) {
-		err = -ENOMEM;
-		goto err;
-	}
-
-	data.fence = fd;
-	if (copy_to_user((void __user *)arg, &data, sizeof(data))) {
-		fput(sync_file->file);
-		err = -EFAULT;
-		goto err;
-	}
+	if (!sync_file)
+		return -ENOMEM;
 
-	fd_install(fd, sync_file->file);
+	FD_PREPARE(fdf, O_CLOEXEC, sync_file->file) {
+		if (fd_prepare_failed(fdf)) {
+			fput(sync_file->file);
+			return fd_prepare_error(fdf);
+		}
 
-	return 0;
+		data.fence = fd_prepare_fd(fdf);
+		if (copy_to_user((void __user *)arg, &data, sizeof(data)))
+			return -EFAULT;
 
-err:
-	put_unused_fd(fd);
-	return err;
+		return fd_publish(fdf);
+	}
 }
 
 static long sw_sync_ioctl_inc(struct sync_timeline *obj, unsigned long arg)

-- 
2.47.3

[PATCH RFC v2 39/48] gpio: convert linehandle_create() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 drivers/gpio/gpiolib-cdev.c | 48 ++++++++++++++-------------------------------
 1 file changed, 15 insertions(+), 33 deletions(-)

diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
index 175836467f21..18503927f0d3 100644
--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -302,8 +302,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
 {
 	struct gpiohandle_request handlereq;
 	struct linehandle_state *lh;
-	struct file *file;
-	int fd, i, ret;
+	int i, ret;
 	u32 lflags;
 
 	if (copy_from_user(&handlereq, ip, sizeof(handlereq)))
@@ -377,41 +376,24 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
 			offset);
 	}
 
-	fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
-	if (fd < 0) {
-		ret = fd;
-		goto out_free_lh;
-	}
-
-	file = anon_inode_getfile("gpio-linehandle",
-				  &linehandle_fileops,
-				  lh,
-				  O_RDONLY | O_CLOEXEC);
-	if (IS_ERR(file)) {
-		ret = PTR_ERR(file);
-		goto out_put_unused_fd;
-	}
-
-	handlereq.fd = fd;
-	if (copy_to_user(ip, &handlereq, sizeof(handlereq))) {
-		/*
-		 * fput() will trigger the release() callback, so do not go onto
-		 * the regular error cleanup path here.
-		 */
-		fput(file);
-		put_unused_fd(fd);
-		return -EFAULT;
-	}
+	FD_PREPARE(fdf, O_RDONLY | O_CLOEXEC,
+		   anon_inode_getfile("gpio-linehandle", &linehandle_fileops,
+				      lh, O_RDONLY | O_CLOEXEC)) {
+		if (fd_prepare_failed(fdf)) {
+			ret = fd_prepare_error(fdf);
+			goto out_free_lh;
+		}
 
-	fd_install(fd, file);
+		handlereq.fd = fd_prepare_fd(fdf);
+		if (copy_to_user(ip, &handlereq, sizeof(handlereq)))
+			return -EFAULT;
 
-	dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",
-		lh->num_descs);
+		dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",
+			lh->num_descs);
 
-	return 0;
+		return fd_publish(fdf);
+	}
 
-out_put_unused_fd:
-	put_unused_fd(fd);
 out_free_lh:
 	linehandle_free(lh);
 	return ret;

-- 
2.47.3

[PATCH RFC v2 40/48] hv: convert mshv_ioctl_create_partition() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 drivers/hv/mshv_root_main.c | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c
index e3b2bd417c46..2c962af8a3d1 100644
--- a/drivers/hv/mshv_root_main.c
+++ b/drivers/hv/mshv_root_main.c
@@ -1941,25 +1941,17 @@ mshv_ioctl_create_partition(void __user *user_arg, struct device *module_dev)
 	if (ret)
 		goto remove_partition;
 
-	fd = get_unused_fd_flags(O_CLOEXEC);
-	if (fd < 0) {
-		ret = fd;
-		goto remove_partition;
-	}
+	FD_PREPARE(fdf, O_CLOEXEC,
+		   anon_inode_getfile("mshv_partition", &mshv_partition_fops,
+				      partition, O_RDWR)) {
+		if (fd_prepare_failed(fdf)) {
+			ret = fd_prepare_error(fdf);
+			goto remove_partition;
+		}
 
-	file = anon_inode_getfile("mshv_partition", &mshv_partition_fops,
-				  partition, O_RDWR);
-	if (IS_ERR(file)) {
-		ret = PTR_ERR(file);
-		goto put_fd;
+		return fd_publish(fdf);
 	}
 
-	fd_install(fd, file);
-
-	return fd;
-
-put_fd:
-	put_unused_fd(fd);
 remove_partition:
 	remove_partition(partition);
 delete_partition:

-- 
2.47.3

[PATCH RFC v2 41/48] media: convert media_request_alloc() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 drivers/media/mc/mc-request.c | 35 ++++++++++++-----------------------
 1 file changed, 12 insertions(+), 23 deletions(-)

diff --git a/drivers/media/mc/mc-request.c b/drivers/media/mc/mc-request.c
index f66f728b1b43..2fa3bd9e5078 100644
--- a/drivers/media/mc/mc-request.c
+++ b/drivers/media/mc/mc-request.c
@@ -282,8 +282,6 @@ EXPORT_SYMBOL_GPL(media_request_get_by_fd);
 int media_request_alloc(struct media_device *mdev, int *alloc_fd)
 {
 	struct media_request *req;
-	struct file *filp;
-	int fd;
 	int ret;
 
 	/* Either both are NULL or both are non-NULL */
@@ -297,19 +295,6 @@ int media_request_alloc(struct media_device *mdev, int *alloc_fd)
 	if (!req)
 		return -ENOMEM;
 
-	fd = get_unused_fd_flags(O_CLOEXEC);
-	if (fd < 0) {
-		ret = fd;
-		goto err_free_req;
-	}
-
-	filp = anon_inode_getfile("request", &request_fops, NULL, O_CLOEXEC);
-	if (IS_ERR(filp)) {
-		ret = PTR_ERR(filp);
-		goto err_put_fd;
-	}
-
-	filp->private_data = req;
 	req->mdev = mdev;
 	req->state = MEDIA_REQUEST_STATE_IDLE;
 	req->num_incomplete_objects = 0;
@@ -320,18 +305,22 @@ int media_request_alloc(struct media_device *mdev, int *alloc_fd)
 	req->updating_count = 0;
 	req->access_count = 0;
 
-	*alloc_fd = fd;
+	FD_PREPARE(fdf, O_CLOEXEC, anon_inode_getfile("request", &request_fops, NULL, O_CLOEXEC)) {
+		if (fd_prepare_failed(fdf)) {
+			ret = fd_prepare_error(fdf);
+			goto err_free_req;
+		}
 
-	snprintf(req->debug_str, sizeof(req->debug_str), "%u:%d",
-		 atomic_inc_return(&mdev->request_id), fd);
-	dev_dbg(mdev->dev, "request: allocated %s\n", req->debug_str);
+		fd_prepare_file(fdf)->private_data = req;
 
-	fd_install(fd, filp);
+		*alloc_fd = fd_publish(fdf);
 
-	return 0;
+		snprintf(req->debug_str, sizeof(req->debug_str), "%u:%d",
+			 atomic_inc_return(&mdev->request_id), *alloc_fd);
+		dev_dbg(mdev->dev, "request: allocated %s\n", req->debug_str);
 
-err_put_fd:
-	put_unused_fd(fd);
+		return 0;
+	}
 
 err_free_req:
 	if (mdev->ops->req_free)

-- 
2.47.3

[PATCH RFC v2 42/48] ntsync: convert ntsync_obj_get_fd() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 drivers/misc/ntsync.c | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/drivers/misc/ntsync.c b/drivers/misc/ntsync.c
index 999026a1ae04..db13e6f39b70 100644
--- a/drivers/misc/ntsync.c
+++ b/drivers/misc/ntsync.c
@@ -721,21 +721,14 @@ static struct ntsync_obj *ntsync_alloc_obj(struct ntsync_device *dev,
 
 static int ntsync_obj_get_fd(struct ntsync_obj *obj)
 {
-	struct file *file;
-	int fd;
+	FD_PREPARE(fdf, O_CLOEXEC,
+		   anon_inode_getfile("ntsync", &ntsync_obj_fops, obj, O_RDWR)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	fd = get_unused_fd_flags(O_CLOEXEC);
-	if (fd < 0)
-		return fd;
-	file = anon_inode_getfile("ntsync", &ntsync_obj_fops, obj, O_RDWR);
-	if (IS_ERR(file)) {
-		put_unused_fd(fd);
-		return PTR_ERR(file);
+		obj->file = fd_prepare_file(fdf);
+		return fd_publish(fdf);
 	}
-	obj->file = file;
-	fd_install(fd, file);
-
-	return fd;
 }
 
 static int ntsync_create_sem(struct ntsync_device *dev, void __user *argp)

-- 
2.47.3

[PATCH RFC v2 43/48] tty: convert ptm_open_peer() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 drivers/tty/pty.c | 35 +++++++++--------------------------
 1 file changed, 9 insertions(+), 26 deletions(-)

diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 8bb1a01fef2a..87a794c4a9de 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -601,42 +601,25 @@ static struct cdev ptmx_cdev;
  */
 int ptm_open_peer(struct file *master, struct tty_struct *tty, int flags)
 {
-	int fd;
-	struct file *filp;
-	int retval = -EINVAL;
 	struct path path;
 
 	if (tty->driver != ptm_driver)
 		return -EIO;
 
-	fd = get_unused_fd_flags(flags);
-	if (fd < 0) {
-		retval = fd;
-		goto err;
-	}
-
 	/* Compute the slave's path */
 	path.mnt = devpts_mntget(master, tty->driver_data);
-	if (IS_ERR(path.mnt)) {
-		retval = PTR_ERR(path.mnt);
-		goto err_put;
-	}
+	if (IS_ERR(path.mnt))
+		return PTR_ERR(path.mnt);
 	path.dentry = tty->link->driver_data;
 
-	filp = dentry_open(&path, flags, current_cred());
-	mntput(path.mnt);
-	if (IS_ERR(filp)) {
-		retval = PTR_ERR(filp);
-		goto err_put;
-	}
-
-	fd_install(fd, filp);
-	return fd;
+	FD_PREPARE(fdf, flags, dentry_open(&path, flags, current_cred())) {
+		if (fd_prepare_failed(fdf)) {
+			mntput(path.mnt);
+			return fd_prepare_error(fdf);
+		}
 
-err_put:
-	put_unused_fd(fd);
-err:
-	return retval;
+		return fd_publish(fdf);
+	}
 }
 
 static int pty_unix98_ioctl(struct tty_struct *tty,

-- 
2.47.3

[PATCH RFC v2 44/48] vfio: convert vfio_group_ioctl_get_device_fd() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 drivers/vfio/group.c | 27 ++++++---------------------
 1 file changed, 6 insertions(+), 21 deletions(-)

diff --git a/drivers/vfio/group.c b/drivers/vfio/group.c
index c376a6279de0..24edf9b3de15 100644
--- a/drivers/vfio/group.c
+++ b/drivers/vfio/group.c
@@ -299,10 +299,7 @@ static int vfio_group_ioctl_get_device_fd(struct vfio_group *group,
 					  char __user *arg)
 {
 	struct vfio_device *device;
-	struct file *filep;
 	char *buf;
-	int fdno;
-	int ret;
 
 	buf = strndup_user(arg, PAGE_SIZE);
 	if (IS_ERR(buf))
@@ -313,26 +310,14 @@ static int vfio_group_ioctl_get_device_fd(struct vfio_group *group,
 	if (IS_ERR(device))
 		return PTR_ERR(device);
 
-	fdno = get_unused_fd_flags(O_CLOEXEC);
-	if (fdno < 0) {
-		ret = fdno;
-		goto err_put_device;
-	}
+	FD_PREPARE(fdf, O_CLOEXEC, vfio_device_open_file(device)) {
+		if (fd_prepare_failed(fdf)) {
+			vfio_device_put_registration(device);
+			return fd_prepare_error(fdf);
+		}
 
-	filep = vfio_device_open_file(device);
-	if (IS_ERR(filep)) {
-		ret = PTR_ERR(filep);
-		goto err_put_fdno;
+		return fd_publish(fdf);
 	}
-
-	fd_install(fdno, filep);
-	return fdno;
-
-err_put_fdno:
-	put_unused_fd(fdno);
-err_put_device:
-	vfio_device_put_registration(device);
-	return ret;
 }
 
 static int vfio_group_ioctl_get_status(struct vfio_group *group,

-- 
2.47.3

[PATCH RFC v2 45/48] file: convert replace_fd() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/file.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/fs/file.c b/fs/file.c
index 28743b742e3c..6c1af2d87eca 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -1357,28 +1357,26 @@ int replace_fd(unsigned fd, struct file *file, unsigned flags)
  */
 int receive_fd(struct file *file, int __user *ufd, unsigned int o_flags)
 {
-	int new_fd;
 	int error;
 
 	error = security_file_receive(file);
 	if (error)
 		return error;
 
-	new_fd = get_unused_fd_flags(o_flags);
-	if (new_fd < 0)
-		return new_fd;
+	FD_PREPARE(fdf, o_flags, file) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
+		get_file(file);
 
-	if (ufd) {
-		error = put_user(new_fd, ufd);
-		if (error) {
-			put_unused_fd(new_fd);
-			return error;
+		if (ufd) {
+			error = put_user(fd_prepare_fd(fdf), ufd);
+			if (error)
+				return error;
 		}
-	}
 
-	fd_install(new_fd, get_file(file));
-	__receive_sock(file);
-	return new_fd;
+		__receive_sock(fd_prepare_file(fdf));
+		return fd_publish(fdf);
+	}
 }
 EXPORT_SYMBOL_GPL(receive_fd);
 

-- 
2.47.3

[PATCH RFC v2 46/48] io_uring: convert io_create_mock_file() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 io_uring/mock_file.c | 53 +++++++++++++++++++++-------------------------------
 1 file changed, 21 insertions(+), 32 deletions(-)

diff --git a/io_uring/mock_file.c b/io_uring/mock_file.c
index 45d3735b2708..f3d2823824d9 100644
--- a/io_uring/mock_file.c
+++ b/io_uring/mock_file.c
@@ -211,10 +211,8 @@ static int io_create_mock_file(struct io_uring_cmd *cmd, unsigned int issue_flag
 	const struct file_operations *fops = &io_mock_fops;
 	const struct io_uring_sqe *sqe = cmd->sqe;
 	struct io_uring_mock_create mc, __user *uarg;
-	struct io_mock_file *mf = NULL;
-	struct file *file = NULL;
+	struct io_mock_file *mf __free(kfree) = NULL;
 	size_t uarg_size;
-	int fd = -1, ret;
 
 	/*
 	 * It's a testing only driver that allows exercising edge cases
@@ -246,10 +244,6 @@ static int io_create_mock_file(struct io_uring_cmd *cmd, unsigned int issue_flag
 	if (!mf)
 		return -ENOMEM;
 
-	ret = fd = get_unused_fd_flags(O_RDWR | O_CLOEXEC);
-	if (fd < 0)
-		goto fail;
-
 	init_waitqueue_head(&mf->poll_wq);
 	mf->size = mc.file_size;
 	mf->rw_delay_ns = mc.rw_delay_ns;
@@ -258,33 +252,28 @@ static int io_create_mock_file(struct io_uring_cmd *cmd, unsigned int issue_flag
 		mf->pollable = true;
 	}
 
-	file = anon_inode_create_getfile("[io_uring_mock]", fops,
-					 mf, O_RDWR | O_CLOEXEC, NULL);
-	if (IS_ERR(file)) {
-		ret = PTR_ERR(file);
-		goto fail;
-	}
+	FD_PREPARE(fdf, O_RDWR | O_CLOEXEC,
+		   anon_inode_create_getfile("[io_uring_mock]", fops,
+					     mf, O_RDWR | O_CLOEXEC, NULL)) {
+		struct file *file;
 
-	file->f_mode |= FMODE_READ | FMODE_CAN_READ |
-			FMODE_WRITE | FMODE_CAN_WRITE |
-			FMODE_LSEEK;
-	if (mc.flags & IORING_MOCK_CREATE_F_SUPPORT_NOWAIT)
-		file->f_mode |= FMODE_NOWAIT;
-
-	mc.out_fd = fd;
-	if (copy_to_user(uarg, &mc, uarg_size)) {
-		fput(file);
-		ret = -EFAULT;
-		goto fail;
-	}
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	fd_install(fd, file);
-	return 0;
-fail:
-	if (fd >= 0)
-		put_unused_fd(fd);
-	kfree(mf);
-	return ret;
+		file = fd_prepare_file(fdf);
+		file->f_mode |= FMODE_READ | FMODE_CAN_READ |
+				FMODE_WRITE | FMODE_CAN_WRITE |
+				FMODE_LSEEK;
+		if (mc.flags & IORING_MOCK_CREATE_F_SUPPORT_NOWAIT)
+			file->f_mode |= FMODE_NOWAIT;
+
+		mc.out_fd = fd_prepare_fd(fdf);
+		if (copy_to_user(uarg, &mc, uarg_size))
+			return -EFAULT;
+
+		retain_and_null_ptr(mf);
+		return fd_publish(fdf);
+	}
 }
 
 static int io_probe_mock(struct io_uring_cmd *cmd)

-- 
2.47.3

[PATCH RFC v2 47/48] kvm: convert kvm_arch_supports_gmem_init_shared() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 virt/kvm/guest_memfd.c | 81 ++++++++++++++++++++++----------------------------
 1 file changed, 35 insertions(+), 46 deletions(-)

diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index fbca8c0972da..c536423424ef 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -493,56 +493,45 @@ bool __weak kvm_arch_supports_gmem_init_shared(struct kvm *kvm)
 static int __kvm_gmem_create(struct kvm *kvm, loff_t size, u64 flags)
 {
 	const char *anon_name = "[kvm-gmem]";
-	struct kvm_gmem *gmem;
+	struct kvm_gmem *gmem __free(kfree) = NULL;
 	struct inode *inode;
-	struct file *file;
-	int fd, err;
-
-	fd = get_unused_fd_flags(0);
-	if (fd < 0)
-		return fd;
 
 	gmem = kzalloc(sizeof(*gmem), GFP_KERNEL);
-	if (!gmem) {
-		err = -ENOMEM;
-		goto err_fd;
+	if (!gmem)
+		return -ENOMEM;
+
+	FD_PREPARE(fdf, 0, anon_inode_create_getfile(anon_name, &kvm_gmem_fops,
+						     gmem, O_RDWR, NULL)) {
+		struct file *file;
+
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
+
+		file = fd_prepare_file(fdf);
+		file->f_flags |= O_LARGEFILE;
+
+		inode = file->f_inode;
+		WARN_ON(file->f_mapping != inode->i_mapping);
+
+		inode->i_private = (void *)(unsigned long)flags;
+		inode->i_op = &kvm_gmem_iops;
+		inode->i_mapping->a_ops = &kvm_gmem_aops;
+		inode->i_mode |= S_IFREG;
+		inode->i_size = size;
+		mapping_set_gfp_mask(inode->i_mapping, GFP_HIGHUSER);
+		mapping_set_inaccessible(inode->i_mapping);
+		/* Unmovable mappings are supposed to be marked unevictable as well. */
+		WARN_ON_ONCE(!mapping_unevictable(inode->i_mapping));
+
+		kvm_get_kvm(kvm);
+		gmem->kvm = kvm;
+		xa_init(&gmem->bindings);
+		list_add(&gmem->entry, &inode->i_mapping->i_private_list);
+
+		/* Ownership of gmem transferred to file */
+		retain_and_null_ptr(gmem);
+		return fd_publish(fdf);
 	}
-
-	file = anon_inode_create_getfile(anon_name, &kvm_gmem_fops, gmem,
-					 O_RDWR, NULL);
-	if (IS_ERR(file)) {
-		err = PTR_ERR(file);
-		goto err_gmem;
-	}
-
-	file->f_flags |= O_LARGEFILE;
-
-	inode = file->f_inode;
-	WARN_ON(file->f_mapping != inode->i_mapping);
-
-	inode->i_private = (void *)(unsigned long)flags;
-	inode->i_op = &kvm_gmem_iops;
-	inode->i_mapping->a_ops = &kvm_gmem_aops;
-	inode->i_mode |= S_IFREG;
-	inode->i_size = size;
-	mapping_set_gfp_mask(inode->i_mapping, GFP_HIGHUSER);
-	mapping_set_inaccessible(inode->i_mapping);
-	/* Unmovable mappings are supposed to be marked unevictable as well. */
-	WARN_ON_ONCE(!mapping_unevictable(inode->i_mapping));
-
-	kvm_get_kvm(kvm);
-	gmem->kvm = kvm;
-	xa_init(&gmem->bindings);
-	list_add(&gmem->entry, &inode->i_mapping->i_private_list);
-
-	fd_install(fd, file);
-	return fd;
-
-err_gmem:
-	kfree(gmem);
-err_fd:
-	put_unused_fd(fd);
-	return err;
 }
 
 int kvm_gmem_create(struct kvm *kvm, struct kvm_create_guest_memfd *args)

-- 
2.47.3

[PATCH RFC v2 48/48] kvm: convert kvm_vcpu_ioctl_get_stats_fd() to FD_PREPARE()

[Christian Brauner]

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 virt/kvm/kvm_main.c | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index b7a0ae2a7b20..9bb51da668dd 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -4313,27 +4313,20 @@ static const struct file_operations kvm_vcpu_stats_fops = {
 
 static int kvm_vcpu_ioctl_get_stats_fd(struct kvm_vcpu *vcpu)
 {
-	int fd;
-	struct file *file;
 	char name[15 + ITOA_MAX_LEN + 1];
 
 	snprintf(name, sizeof(name), "kvm-vcpu-stats:%d", vcpu->vcpu_id);
 
-	fd = get_unused_fd_flags(O_CLOEXEC);
-	if (fd < 0)
-		return fd;
+	FD_PREPARE(fdf, O_CLOEXEC, anon_inode_getfile_fmode(name,
+							     &kvm_vcpu_stats_fops,
+							     vcpu, O_RDONLY,
+							     FMODE_PREAD)) {
+		if (fd_prepare_failed(fdf))
+			return fd_prepare_error(fdf);
 
-	file = anon_inode_getfile_fmode(name, &kvm_vcpu_stats_fops, vcpu,
-					O_RDONLY, FMODE_PREAD);
-	if (IS_ERR(file)) {
-		put_unused_fd(fd);
-		return PTR_ERR(file);
+		kvm_get_kvm(vcpu->kvm);
+		return fd_publish(fdf);
 	}
-
-	kvm_get_kvm(vcpu->kvm);
-	fd_install(fd, file);
-
-	return fd;
 }
 
 #ifdef CONFIG_KVM_GENERIC_PRE_FAULT_MEMORY

-- 
2.47.3

Re: [PATCH RFC v2 00/48] file: add and convert to FD_PREPARE()

[Linus Torvalds]

On Thu, 20 Nov 2025 at 14:32, Christian Brauner <brauner@kernel.org> wrote:
>
> My take is to add a scope-based FD_PREPARE() primitive that work as
> follows:
>
> FD_PREPARE(fdprep, open_flag, file_open_handle(&path, open_flag)) {
>         if (fd_prepare_failed(fdprep))
>                 return fd_prepare_error(fdprep);
>
>         return fd_publish(fdprep);
> }

I'm really not a fan of the syntax.

The scoping in particular makes absolutely no sense. The fallthrough
case is just a silent and very non-obvious failure case - I don't
think there is any sane use case that falls through. You *have* to
basically end it with fd_publish(), nothing else makes sense, but it
means that the whole usage pattern effectively *has* to be that

        FD_PREPARE(fdf, flags, something()) {
                if (fd_prepare_failed(fdf))
                        return fd_prepare_error(fdf);
                ...
                return fd_publish(fdf);
        }

and absolutely nothing else. Yes, the variations are of the form "do
extra cleanup of other things before the returns", and some of those
are then done *outside* the scope by having other variables from
outside the scope, but it all feels really nasty.

And so in most cases, all the scoping does is to make for an extra
indentation level - it doesn't make the code clearer.

The docs you add in 01/48 are showing some other syntax entirely, ie
the comments say

+ * FD_PREPARE(fdf, O_RDWR | O_CLOEXEC,
+ *                  anon_inode_getfile("[eventpoll]",
&eventpoll_fops, ep, O_RDWR));
+ * if (fd_prepare_failed(fdf))
+ *     return fd_prepare_error(fdf);
+ *
+ * ep->file = fd_prepare_file(fdf);
+ * return fd_publish(fdf);

and that non-scoped version would actually be more legible, I feel.
But given the implementation, that's actively *wrong*, because it
doesn't do the scope at all. The scope silently ended at the
FD_PREPARE, and I don't think that example would ever even compile, as
far as I can tell. You need to add the  { } around the block that then
uses the fdf. No?

And I think the reason the docs are wrong is that the syntax makes so
little sense.

Now, if the whole odd sequence of   FD_PREPARE / fd_prepare_failed /
fd_prepare_error / fd_publish coudl somehow be encapsulated by the
macro, that would be one thing. But this macro forces that really
stilted and odd format for the code that uses it.

Admittedly then most cases do pretty much *only* that minimum required
pattern and absolutely nothing else, but I feel like you made the odd
syntax choices for the few cases that wanted something more, and in
the process made everybody have that nasty thing.

And yes, the code that uses this ends up shorter, so you do remove
more lines than you add overall.

But I really wish the end result wouldn't look so odd. This is a case
where the scoping seems to hurt more than help.

                  Linus

Re: [PATCH RFC v2 00/48] file: add and convert to FD_PREPARE()

[Linus Torvalds]

On Thu, 20 Nov 2025 at 15:08, Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> But I really wish the end result wouldn't look so odd. This is a case
> where the scoping seems to hurt more than help.

Maybe you could make the basic building blocks not start a new scope
at all, which would make the docs in the comment actually match
reality?

And then the (few) cases that want a new scope and actually have
something that follows the final

        return fd_publish(fdf);

would have to do their own scope themselves, possibly with a statement
expression?

From quick (and possibly incomplete) look through the patches, of 48
patches, only *two* had a

        variable = fd_publish();

pattern with code after the scope. The rest all seemed to just want to
finish with that fd_publish() and the scope didn't really help them.

eg media_request_alloc() ended up doing

                *alloc_fd = fd_publish(fdf);
                return 0;

instead, and kcm_ioctl() does

                        err = fd_publish(fdf);

and then breaks out of the case statement. Maybe there were others.
But all that the second case actually does is then "return err"
outside the case statement anyway.

Now, those do probably want scoping, just because they do have other
code after the "return" anyway (due to this all being inside a case
statement, or they had a error label or something). But I think they
could have actually used a statement expression (or even just a bare
nested block) for that.

A statement expression might even look reasonable, something like

        int fd = ({
                FD_PREPARE(fdf, 0, kcm_clone(sock));
                if (fd_prepare_failed(fdf))
                        return fd_prepare_error(fdf);
                info.fd = fd_prepare_fd(fdf);
                if (copy_to_user((void __user *)arg, &info, sizeof(info)))
                        return -EFAULT;
                fd_publish(fdf);
        });

certainly looks *very* odd too (those returns inside the statement
expression are downright evil), but I think it would actually be
preferable to the odd "you have to do a block scope after the
FD_PREPARE()".

I dunno. There may be some reason you did it the way you did that I
don't immediately see.

                 Linus

Re: [PATCH RFC v2 00/48] file: add and convert to FD_PREPARE()

[Christian Brauner]

On Thu, Nov 20, 2025 at 03:28:25PM -0800, Linus Torvalds wrote:
> On Thu, 20 Nov 2025 at 15:08, Linus Torvalds
> <torvalds@linux-foundation.org> wrote:
> >
> > But I really wish the end result wouldn't look so odd. This is a case
> > where the scoping seems to hurt more than help.
> 
> Maybe you could make the basic building blocks not start a new scope
> at all, which would make the docs in the comment actually match
> reality?
> 
> And then the (few) cases that want a new scope and actually have
> something that follows the final
> 
>         return fd_publish(fdf);
> 
> would have to do their own scope themselves, possibly with a statement
> expression?
> 
> >From quick (and possibly incomplete) look through the patches, of 48
> patches, only *two* had a
> 
>         variable = fd_publish();
> 
> pattern with code after the scope. The rest all seemed to just want to
> finish with that fd_publish() and the scope didn't really help them.
> 
> eg media_request_alloc() ended up doing
> 
>                 *alloc_fd = fd_publish(fdf);
>                 return 0;
> 
> instead, and kcm_ioctl() does
> 
>                         err = fd_publish(fdf);
> 
> and then breaks out of the case statement. Maybe there were others.
> But all that the second case actually does is then "return err"
> outside the case statement anyway.
> 
> Now, those do probably want scoping, just because they do have other
> code after the "return" anyway (due to this all being inside a case
> statement, or they had a error label or something). But I think they
> could have actually used a statement expression (or even just a bare
> nested block) for that.
> 
> A statement expression might even look reasonable, something like
> 
>         int fd = ({
>                 FD_PREPARE(fdf, 0, kcm_clone(sock));
>                 if (fd_prepare_failed(fdf))
>                         return fd_prepare_error(fdf);
>                 info.fd = fd_prepare_fd(fdf);
>                 if (copy_to_user((void __user *)arg, &info, sizeof(info)))
>                         return -EFAULT;
>                 fd_publish(fdf);
>         });
> 
> certainly looks *very* odd too (those returns inside the statement
> expression are downright evil), but I think it would actually be
> preferable to the odd "you have to do a block scope after the
> FD_PREPARE()".
> 
> I dunno. There may be some reason you did it the way you did that I
> don't immediately see.

Having a separate scope avoids the "cannot jump from this goto statement
to its label" problem. But it's actually irrelevant because all
codepaths are simplified to an extent that by this new api that nearly
all gotos go away anyway.

So I think you're right to nak the scope.

Fwiw, the reason the documentation doesn't match the implementation is
that v1 - which I had cced you on already - had a non-scoped variant and
I forgot to update it. And I should've stuck with that.

I also realized that fd_prepare_failed() and fd_prepare_error() aren't
needed. Since peterz added ACQUIRE_ERR() a short while ago we can easily
integrate with that. I'll send you a v2 in a few minutes that does all
that.