580.65.06

kernel-open/nvidia/nv-caps.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: Copyright (c) 2019-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-FileCopyrightText: Copyright (c) 2019-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
  * SPDX-License-Identifier: MIT
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
@@ -510,8 +510,6 @@ int NV_API_CALL nv_cap_validate_and_dup_fd(const nv_cap_t *cap, int fd)
     int dup_fd;
     struct inode *inode = NULL;
     dev_t rdev = 0;
-    struct files_struct *files = current->files;
-    struct fdtable *fdt;
 
     if (cap == NULL)
     {
@@ -543,29 +541,10 @@ int NV_API_CALL nv_cap_validate_and_dup_fd(const nv_cap_t *cap, int fd)
         goto err;
     }
 
-    dup_fd = NV_GET_UNUSED_FD_FLAGS(O_CLOEXEC);
+    dup_fd = get_unused_fd_flags(O_CLOEXEC);
     if (dup_fd < 0)
     {
-        dup_fd = NV_GET_UNUSED_FD();
-        if (dup_fd < 0)
-        {
-            goto err;
-        }
-
-        /*
-         * Set CLOEXEC before installing the FD.
-         *
-         * If fork() happens in between, the opened unused FD will have
-         * a NULL struct file associated with it, which is okay.
-         *
-         * The only well known bug here is the race with dup(2), which is
-         * already documented in the kernel, see fd_install()'s description.
-         */
-
-        spin_lock(&files->file_lock);
-        fdt = files_fdtable(files);
-        __set_bit(dup_fd, fdt->close_on_exec);
-        spin_unlock(&files->file_lock);
+        goto err;
     }
 
     fd_install(dup_fd, file);
@@ -582,6 +561,9 @@ err:
 void NV_API_CALL nv_cap_close_fd(int fd)
 {
 #if NV_FILESYSTEM_ACCESS_AVAILABLE
+    struct file *file;
+    NvBool is_nv_cap_fd;
+
     if (fd == -1)
     {
         return;
@@ -600,6 +582,30 @@ void NV_API_CALL nv_cap_close_fd(int fd)
         return;
     }
 
+    file = fget(fd);
+    if (file == NULL)
+    {
+        task_unlock(current);
+        return;
+    }
+
+    /* Make sure the fd belongs to the nv-cap-drv */
+    is_nv_cap_fd = (file->f_op == &g_nv_cap_drv_fops);
+
+    fput(file);
+
+    /*
+     * In some cases, we may be in shutdown path and execute
+     * in context of unrelated process. In that case we should
+     * not access any 'current' state, but instead let kernel
+     * clean up capability files on its own.
+     */
+    if (!is_nv_cap_fd)
+    {
+        task_unlock(current);
+        return;
+    }
+
 /*
  * From v4.17-rc1 (to v5.10.8) kernels have stopped exporting sys_close(fd)
  * and started exporting __close_fd, as of this commit: