static int locate_fd(struct files_struct *files,
       struct file *file, unsigned int orig_start)//从orig_start位开始分配fd
{
 unsigned int newfd;
 unsigned int start;
 int error;
 struct fdtable *fdt;

 error = -EINVAL;
 if (orig_start >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)//检查orig_start是大于进程最大可以打开文件的数量
  goto out;

repeat:
 fdt = files_fdtable(files);//文件描述符位图
 /*
  * Someone might have closed fd's in the range
  * orig_start..fdt->next_fd
  */
 start = orig_start;
 if (start < fdt->next_fd)
  start = fdt->next_fd;//如果orig_start小于next_fd，那就从next_fd开始分配

 newfd = start;
 if (start < fdt->max_fdset) {//max_fdset是描述符问题的位数，下面会具体讲解
  newfd = find_next_zero_bit(fdt->open_fds->fds_bits,
   fdt->max_fdset, start);//分配fd
 }
 
 error = -EMFILE;
 if (newfd >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)//进行判断，分配的fd不能大于进程最大可以打开的文件数量
  goto out;

 error = expand_files(files, newfd);//文件描述符表的扩展，这个我们留在下一篇文章中详细讲解
 if (error < 0)
  goto out;

 /*
  * If we needed to expand the fs array we
  * might have blocked - try again.
  */
 if (error)
  goto repeat;

 /*
  * We reacquired files_lock, so we are safe as long as
  * we reacquire the fdtable pointer and use it while holding
  * the lock, no one can free it during that time.
  */
 fdt = files_fdtable(files);
 if (start <= fdt->next_fd)
  fdt->next_fd = newfd + 1;//更新next_fd值

 error = newfd;
 
out:
 return error;
}

linux/arch/arm/kernel/init_task.c

struct task_struct init_task = INIT_TASK(init_task);

#define INIT_TASK(tsk) \
{         \
 ...
 .files  = &init_files,     \
 ...   
}