fcntl.c 23 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * linux/fs/fcntl.c
  4. *
  5. * Copyright (C) 1991, 1992 Linus Torvalds
  6. */
  7. #include <linux/syscalls.h>
  8. #include <linux/init.h>
  9. #include <linux/mm.h>
  10. #include <linux/sched/task.h>
  11. #include <linux/fs.h>
  12. #include <linux/file.h>
  13. #include <linux/fdtable.h>
  14. #include <linux/capability.h>
  15. #include <linux/dnotify.h>
  16. #include <linux/slab.h>
  17. #include <linux/module.h>
  18. #include <linux/pipe_fs_i.h>
  19. #include <linux/security.h>
  20. #include <linux/ptrace.h>
  21. #include <linux/signal.h>
  22. #include <linux/rcupdate.h>
  23. #include <linux/pid_namespace.h>
  24. #include <linux/user_namespace.h>
  25. #include <linux/memfd.h>
  26. #include <linux/compat.h>
  27. #include <linux/poll.h>
  28. #include <asm/siginfo.h>
  29. #include <linux/uaccess.h>
  30. #define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME)
  31. static int setfl(int fd, struct file * filp, unsigned long arg)
  32. {
  33. struct inode * inode = file_inode(filp);
  34. int error = 0;
  35. /*
  36. * O_APPEND cannot be cleared if the file is marked as append-only
  37. * and the file is open for write.
  38. */
  39. if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode))
  40. return -EPERM;
  41. /* O_NOATIME can only be set by the owner or superuser */
  42. if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME))
  43. if (!inode_owner_or_capable(inode))
  44. return -EPERM;
  45. /* required for strict SunOS emulation */
  46. if (O_NONBLOCK != O_NDELAY)
  47. if (arg & O_NDELAY)
  48. arg |= O_NONBLOCK;
  49. /* Pipe packetized mode is controlled by O_DIRECT flag */
  50. if (!S_ISFIFO(inode->i_mode) && (arg & O_DIRECT)) {
  51. if (!filp->f_mapping || !filp->f_mapping->a_ops ||
  52. !filp->f_mapping->a_ops->direct_IO)
  53. return -EINVAL;
  54. }
  55. if (filp->f_op->check_flags)
  56. error = filp->f_op->check_flags(arg);
  57. if (error)
  58. return error;
  59. /*
  60. * ->fasync() is responsible for setting the FASYNC bit.
  61. */
  62. if (((arg ^ filp->f_flags) & FASYNC) && filp->f_op->fasync) {
  63. error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);
  64. if (error < 0)
  65. goto out;
  66. if (error > 0)
  67. error = 0;
  68. }
  69. spin_lock(&filp->f_lock);
  70. filp->f_flags = (arg & SETFL_MASK) | (filp->f_flags & ~SETFL_MASK);
  71. spin_unlock(&filp->f_lock);
  72. out:
  73. return error;
  74. }
  75. static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
  76. int force)
  77. {
  78. write_lock_irq(&filp->f_owner.lock);
  79. if (force || !filp->f_owner.pid) {
  80. put_pid(filp->f_owner.pid);
  81. filp->f_owner.pid = get_pid(pid);
  82. filp->f_owner.pid_type = type;
  83. if (pid) {
  84. const struct cred *cred = current_cred();
  85. filp->f_owner.uid = cred->uid;
  86. filp->f_owner.euid = cred->euid;
  87. }
  88. }
  89. write_unlock_irq(&filp->f_owner.lock);
  90. }
  91. void __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
  92. int force)
  93. {
  94. security_file_set_fowner(filp);
  95. f_modown(filp, pid, type, force);
  96. }
  97. EXPORT_SYMBOL(__f_setown);
  98. int f_setown(struct file *filp, unsigned long arg, int force)
  99. {
  100. enum pid_type type;
  101. struct pid *pid = NULL;
  102. int who = arg, ret = 0;
  103. type = PIDTYPE_TGID;
  104. if (who < 0) {
  105. /* avoid overflow below */
  106. if (who == INT_MIN)
  107. return -EINVAL;
  108. type = PIDTYPE_PGID;
  109. who = -who;
  110. }
  111. rcu_read_lock();
  112. if (who) {
  113. pid = find_vpid(who);
  114. if (!pid)
  115. ret = -ESRCH;
  116. }
  117. if (!ret)
  118. __f_setown(filp, pid, type, force);
  119. rcu_read_unlock();
  120. return ret;
  121. }
  122. EXPORT_SYMBOL(f_setown);
  123. void f_delown(struct file *filp)
  124. {
  125. f_modown(filp, NULL, PIDTYPE_TGID, 1);
  126. }
  127. pid_t f_getown(struct file *filp)
  128. {
  129. pid_t pid;
  130. read_lock(&filp->f_owner.lock);
  131. pid = pid_vnr(filp->f_owner.pid);
  132. if (filp->f_owner.pid_type == PIDTYPE_PGID)
  133. pid = -pid;
  134. read_unlock(&filp->f_owner.lock);
  135. return pid;
  136. }
  137. static int f_setown_ex(struct file *filp, unsigned long arg)
  138. {
  139. struct f_owner_ex __user *owner_p = (void __user *)arg;
  140. struct f_owner_ex owner;
  141. struct pid *pid;
  142. int type;
  143. int ret;
  144. ret = copy_from_user(&owner, owner_p, sizeof(owner));
  145. if (ret)
  146. return -EFAULT;
  147. switch (owner.type) {
  148. case F_OWNER_TID:
  149. type = PIDTYPE_PID;
  150. break;
  151. case F_OWNER_PID:
  152. type = PIDTYPE_TGID;
  153. break;
  154. case F_OWNER_PGRP:
  155. type = PIDTYPE_PGID;
  156. break;
  157. default:
  158. return -EINVAL;
  159. }
  160. rcu_read_lock();
  161. pid = find_vpid(owner.pid);
  162. if (owner.pid && !pid)
  163. ret = -ESRCH;
  164. else
  165. __f_setown(filp, pid, type, 1);
  166. rcu_read_unlock();
  167. return ret;
  168. }
  169. static int f_getown_ex(struct file *filp, unsigned long arg)
  170. {
  171. struct f_owner_ex __user *owner_p = (void __user *)arg;
  172. struct f_owner_ex owner;
  173. int ret = 0;
  174. read_lock(&filp->f_owner.lock);
  175. owner.pid = pid_vnr(filp->f_owner.pid);
  176. switch (filp->f_owner.pid_type) {
  177. case PIDTYPE_PID:
  178. owner.type = F_OWNER_TID;
  179. break;
  180. case PIDTYPE_TGID:
  181. owner.type = F_OWNER_PID;
  182. break;
  183. case PIDTYPE_PGID:
  184. owner.type = F_OWNER_PGRP;
  185. break;
  186. default:
  187. WARN_ON(1);
  188. ret = -EINVAL;
  189. break;
  190. }
  191. read_unlock(&filp->f_owner.lock);
  192. if (!ret) {
  193. ret = copy_to_user(owner_p, &owner, sizeof(owner));
  194. if (ret)
  195. ret = -EFAULT;
  196. }
  197. return ret;
  198. }
  199. #ifdef CONFIG_CHECKPOINT_RESTORE
  200. static int f_getowner_uids(struct file *filp, unsigned long arg)
  201. {
  202. struct user_namespace *user_ns = current_user_ns();
  203. uid_t __user *dst = (void __user *)arg;
  204. uid_t src[2];
  205. int err;
  206. read_lock(&filp->f_owner.lock);
  207. src[0] = from_kuid(user_ns, filp->f_owner.uid);
  208. src[1] = from_kuid(user_ns, filp->f_owner.euid);
  209. read_unlock(&filp->f_owner.lock);
  210. err = put_user(src[0], &dst[0]);
  211. err |= put_user(src[1], &dst[1]);
  212. return err;
  213. }
  214. #else
  215. static int f_getowner_uids(struct file *filp, unsigned long arg)
  216. {
  217. return -EINVAL;
  218. }
  219. #endif
  220. static bool rw_hint_valid(enum rw_hint hint)
  221. {
  222. switch (hint) {
  223. case RWH_WRITE_LIFE_NOT_SET:
  224. case RWH_WRITE_LIFE_NONE:
  225. case RWH_WRITE_LIFE_SHORT:
  226. case RWH_WRITE_LIFE_MEDIUM:
  227. case RWH_WRITE_LIFE_LONG:
  228. case RWH_WRITE_LIFE_EXTREME:
  229. return true;
  230. default:
  231. return false;
  232. }
  233. }
  234. static long fcntl_rw_hint(struct file *file, unsigned int cmd,
  235. unsigned long arg)
  236. {
  237. struct inode *inode = file_inode(file);
  238. u64 __user *argp = (u64 __user *)arg;
  239. enum rw_hint hint;
  240. u64 h;
  241. switch (cmd) {
  242. case F_GET_FILE_RW_HINT:
  243. h = file_write_hint(file);
  244. if (copy_to_user(argp, &h, sizeof(*argp)))
  245. return -EFAULT;
  246. return 0;
  247. case F_SET_FILE_RW_HINT:
  248. if (copy_from_user(&h, argp, sizeof(h)))
  249. return -EFAULT;
  250. hint = (enum rw_hint) h;
  251. if (!rw_hint_valid(hint))
  252. return -EINVAL;
  253. spin_lock(&file->f_lock);
  254. file->f_write_hint = hint;
  255. spin_unlock(&file->f_lock);
  256. return 0;
  257. case F_GET_RW_HINT:
  258. h = inode->i_write_hint;
  259. if (copy_to_user(argp, &h, sizeof(*argp)))
  260. return -EFAULT;
  261. return 0;
  262. case F_SET_RW_HINT:
  263. if (copy_from_user(&h, argp, sizeof(h)))
  264. return -EFAULT;
  265. hint = (enum rw_hint) h;
  266. if (!rw_hint_valid(hint))
  267. return -EINVAL;
  268. inode_lock(inode);
  269. inode->i_write_hint = hint;
  270. inode_unlock(inode);
  271. return 0;
  272. default:
  273. return -EINVAL;
  274. }
  275. }
  276. static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
  277. struct file *filp)
  278. {
  279. void __user *argp = (void __user *)arg;
  280. struct flock flock;
  281. long err = -EINVAL;
  282. switch (cmd) {
  283. case F_DUPFD:
  284. err = f_dupfd(arg, filp, 0);
  285. break;
  286. case F_DUPFD_CLOEXEC:
  287. err = f_dupfd(arg, filp, O_CLOEXEC);
  288. break;
  289. case F_GETFD:
  290. err = get_close_on_exec(fd) ? FD_CLOEXEC : 0;
  291. break;
  292. case F_SETFD:
  293. err = 0;
  294. set_close_on_exec(fd, arg & FD_CLOEXEC);
  295. break;
  296. case F_GETFL:
  297. err = filp->f_flags;
  298. break;
  299. case F_SETFL:
  300. err = setfl(fd, filp, arg);
  301. break;
  302. #if BITS_PER_LONG != 32
  303. /* 32-bit arches must use fcntl64() */
  304. case F_OFD_GETLK:
  305. #endif
  306. case F_GETLK:
  307. if (copy_from_user(&flock, argp, sizeof(flock)))
  308. return -EFAULT;
  309. err = fcntl_getlk(filp, cmd, &flock);
  310. if (!err && copy_to_user(argp, &flock, sizeof(flock)))
  311. return -EFAULT;
  312. break;
  313. #if BITS_PER_LONG != 32
  314. /* 32-bit arches must use fcntl64() */
  315. case F_OFD_SETLK:
  316. case F_OFD_SETLKW:
  317. #endif
  318. fallthrough;
  319. case F_SETLK:
  320. case F_SETLKW:
  321. if (copy_from_user(&flock, argp, sizeof(flock)))
  322. return -EFAULT;
  323. err = fcntl_setlk(fd, filp, cmd, &flock);
  324. break;
  325. case F_GETOWN:
  326. /*
  327. * XXX If f_owner is a process group, the
  328. * negative return value will get converted
  329. * into an error. Oops. If we keep the
  330. * current syscall conventions, the only way
  331. * to fix this will be in libc.
  332. */
  333. err = f_getown(filp);
  334. force_successful_syscall_return();
  335. break;
  336. case F_SETOWN:
  337. err = f_setown(filp, arg, 1);
  338. break;
  339. case F_GETOWN_EX:
  340. err = f_getown_ex(filp, arg);
  341. break;
  342. case F_SETOWN_EX:
  343. err = f_setown_ex(filp, arg);
  344. break;
  345. case F_GETOWNER_UIDS:
  346. err = f_getowner_uids(filp, arg);
  347. break;
  348. case F_GETSIG:
  349. err = filp->f_owner.signum;
  350. break;
  351. case F_SETSIG:
  352. /* arg == 0 restores default behaviour. */
  353. if (!valid_signal(arg)) {
  354. break;
  355. }
  356. err = 0;
  357. filp->f_owner.signum = arg;
  358. break;
  359. case F_GETLEASE:
  360. err = fcntl_getlease(filp);
  361. break;
  362. case F_SETLEASE:
  363. err = fcntl_setlease(fd, filp, arg);
  364. break;
  365. case F_NOTIFY:
  366. err = fcntl_dirnotify(fd, filp, arg);
  367. break;
  368. case F_SETPIPE_SZ:
  369. case F_GETPIPE_SZ:
  370. err = pipe_fcntl(filp, cmd, arg);
  371. break;
  372. case F_ADD_SEALS:
  373. case F_GET_SEALS:
  374. err = memfd_fcntl(filp, cmd, arg);
  375. break;
  376. case F_GET_RW_HINT:
  377. case F_SET_RW_HINT:
  378. case F_GET_FILE_RW_HINT:
  379. case F_SET_FILE_RW_HINT:
  380. err = fcntl_rw_hint(filp, cmd, arg);
  381. break;
  382. default:
  383. break;
  384. }
  385. return err;
  386. }
  387. static int check_fcntl_cmd(unsigned cmd)
  388. {
  389. switch (cmd) {
  390. case F_DUPFD:
  391. case F_DUPFD_CLOEXEC:
  392. case F_GETFD:
  393. case F_SETFD:
  394. case F_GETFL:
  395. return 1;
  396. }
  397. return 0;
  398. }
  399. SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
  400. {
  401. struct fd f = fdget_raw(fd);
  402. long err = -EBADF;
  403. if (!f.file)
  404. goto out;
  405. if (unlikely(f.file->f_mode & FMODE_PATH)) {
  406. if (!check_fcntl_cmd(cmd))
  407. goto out1;
  408. }
  409. err = security_file_fcntl(f.file, cmd, arg);
  410. if (!err)
  411. err = do_fcntl(fd, cmd, arg, f.file);
  412. out1:
  413. fdput(f);
  414. out:
  415. return err;
  416. }
  417. #if BITS_PER_LONG == 32
  418. SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
  419. unsigned long, arg)
  420. {
  421. void __user *argp = (void __user *)arg;
  422. struct fd f = fdget_raw(fd);
  423. struct flock64 flock;
  424. long err = -EBADF;
  425. if (!f.file)
  426. goto out;
  427. if (unlikely(f.file->f_mode & FMODE_PATH)) {
  428. if (!check_fcntl_cmd(cmd))
  429. goto out1;
  430. }
  431. err = security_file_fcntl(f.file, cmd, arg);
  432. if (err)
  433. goto out1;
  434. switch (cmd) {
  435. case F_GETLK64:
  436. case F_OFD_GETLK:
  437. err = -EFAULT;
  438. if (copy_from_user(&flock, argp, sizeof(flock)))
  439. break;
  440. err = fcntl_getlk64(f.file, cmd, &flock);
  441. if (!err && copy_to_user(argp, &flock, sizeof(flock)))
  442. err = -EFAULT;
  443. break;
  444. case F_SETLK64:
  445. case F_SETLKW64:
  446. case F_OFD_SETLK:
  447. case F_OFD_SETLKW:
  448. err = -EFAULT;
  449. if (copy_from_user(&flock, argp, sizeof(flock)))
  450. break;
  451. err = fcntl_setlk64(fd, f.file, cmd, &flock);
  452. break;
  453. default:
  454. err = do_fcntl(fd, cmd, arg, f.file);
  455. break;
  456. }
  457. out1:
  458. fdput(f);
  459. out:
  460. return err;
  461. }
  462. #endif
  463. #ifdef CONFIG_COMPAT
  464. /* careful - don't use anywhere else */
  465. #define copy_flock_fields(dst, src) \
  466. (dst)->l_type = (src)->l_type; \
  467. (dst)->l_whence = (src)->l_whence; \
  468. (dst)->l_start = (src)->l_start; \
  469. (dst)->l_len = (src)->l_len; \
  470. (dst)->l_pid = (src)->l_pid;
  471. static int get_compat_flock(struct flock *kfl, const struct compat_flock __user *ufl)
  472. {
  473. struct compat_flock fl;
  474. if (copy_from_user(&fl, ufl, sizeof(struct compat_flock)))
  475. return -EFAULT;
  476. copy_flock_fields(kfl, &fl);
  477. return 0;
  478. }
  479. static int get_compat_flock64(struct flock *kfl, const struct compat_flock64 __user *ufl)
  480. {
  481. struct compat_flock64 fl;
  482. if (copy_from_user(&fl, ufl, sizeof(struct compat_flock64)))
  483. return -EFAULT;
  484. copy_flock_fields(kfl, &fl);
  485. return 0;
  486. }
  487. static int put_compat_flock(const struct flock *kfl, struct compat_flock __user *ufl)
  488. {
  489. struct compat_flock fl;
  490. memset(&fl, 0, sizeof(struct compat_flock));
  491. copy_flock_fields(&fl, kfl);
  492. if (copy_to_user(ufl, &fl, sizeof(struct compat_flock)))
  493. return -EFAULT;
  494. return 0;
  495. }
  496. static int put_compat_flock64(const struct flock *kfl, struct compat_flock64 __user *ufl)
  497. {
  498. struct compat_flock64 fl;
  499. BUILD_BUG_ON(sizeof(kfl->l_start) > sizeof(ufl->l_start));
  500. BUILD_BUG_ON(sizeof(kfl->l_len) > sizeof(ufl->l_len));
  501. memset(&fl, 0, sizeof(struct compat_flock64));
  502. copy_flock_fields(&fl, kfl);
  503. if (copy_to_user(ufl, &fl, sizeof(struct compat_flock64)))
  504. return -EFAULT;
  505. return 0;
  506. }
  507. #undef copy_flock_fields
  508. static unsigned int
  509. convert_fcntl_cmd(unsigned int cmd)
  510. {
  511. switch (cmd) {
  512. case F_GETLK64:
  513. return F_GETLK;
  514. case F_SETLK64:
  515. return F_SETLK;
  516. case F_SETLKW64:
  517. return F_SETLKW;
  518. }
  519. return cmd;
  520. }
  521. /*
  522. * GETLK was successful and we need to return the data, but it needs to fit in
  523. * the compat structure.
  524. * l_start shouldn't be too big, unless the original start + end is greater than
  525. * COMPAT_OFF_T_MAX, in which case the app was asking for trouble, so we return
  526. * -EOVERFLOW in that case. l_len could be too big, in which case we just
  527. * truncate it, and only allow the app to see that part of the conflicting lock
  528. * that might make sense to it anyway
  529. */
  530. static int fixup_compat_flock(struct flock *flock)
  531. {
  532. if (flock->l_start > COMPAT_OFF_T_MAX)
  533. return -EOVERFLOW;
  534. if (flock->l_len > COMPAT_OFF_T_MAX)
  535. flock->l_len = COMPAT_OFF_T_MAX;
  536. return 0;
  537. }
  538. static long do_compat_fcntl64(unsigned int fd, unsigned int cmd,
  539. compat_ulong_t arg)
  540. {
  541. struct fd f = fdget_raw(fd);
  542. struct flock flock;
  543. long err = -EBADF;
  544. if (!f.file)
  545. return err;
  546. if (unlikely(f.file->f_mode & FMODE_PATH)) {
  547. if (!check_fcntl_cmd(cmd))
  548. goto out_put;
  549. }
  550. err = security_file_fcntl(f.file, cmd, arg);
  551. if (err)
  552. goto out_put;
  553. switch (cmd) {
  554. case F_GETLK:
  555. err = get_compat_flock(&flock, compat_ptr(arg));
  556. if (err)
  557. break;
  558. err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
  559. if (err)
  560. break;
  561. err = fixup_compat_flock(&flock);
  562. if (!err)
  563. err = put_compat_flock(&flock, compat_ptr(arg));
  564. break;
  565. case F_GETLK64:
  566. case F_OFD_GETLK:
  567. err = get_compat_flock64(&flock, compat_ptr(arg));
  568. if (err)
  569. break;
  570. err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
  571. if (!err)
  572. err = put_compat_flock64(&flock, compat_ptr(arg));
  573. break;
  574. case F_SETLK:
  575. case F_SETLKW:
  576. err = get_compat_flock(&flock, compat_ptr(arg));
  577. if (err)
  578. break;
  579. err = fcntl_setlk(fd, f.file, convert_fcntl_cmd(cmd), &flock);
  580. break;
  581. case F_SETLK64:
  582. case F_SETLKW64:
  583. case F_OFD_SETLK:
  584. case F_OFD_SETLKW:
  585. err = get_compat_flock64(&flock, compat_ptr(arg));
  586. if (err)
  587. break;
  588. err = fcntl_setlk(fd, f.file, convert_fcntl_cmd(cmd), &flock);
  589. break;
  590. default:
  591. err = do_fcntl(fd, cmd, arg, f.file);
  592. break;
  593. }
  594. out_put:
  595. fdput(f);
  596. return err;
  597. }
  598. COMPAT_SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
  599. compat_ulong_t, arg)
  600. {
  601. return do_compat_fcntl64(fd, cmd, arg);
  602. }
  603. COMPAT_SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd,
  604. compat_ulong_t, arg)
  605. {
  606. switch (cmd) {
  607. case F_GETLK64:
  608. case F_SETLK64:
  609. case F_SETLKW64:
  610. case F_OFD_GETLK:
  611. case F_OFD_SETLK:
  612. case F_OFD_SETLKW:
  613. return -EINVAL;
  614. }
  615. return do_compat_fcntl64(fd, cmd, arg);
  616. }
  617. #endif
  618. /* Table to convert sigio signal codes into poll band bitmaps */
  619. static const __poll_t band_table[NSIGPOLL] = {
  620. EPOLLIN | EPOLLRDNORM, /* POLL_IN */
  621. EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND, /* POLL_OUT */
  622. EPOLLIN | EPOLLRDNORM | EPOLLMSG, /* POLL_MSG */
  623. EPOLLERR, /* POLL_ERR */
  624. EPOLLPRI | EPOLLRDBAND, /* POLL_PRI */
  625. EPOLLHUP | EPOLLERR /* POLL_HUP */
  626. };
  627. static inline int sigio_perm(struct task_struct *p,
  628. struct fown_struct *fown, int sig)
  629. {
  630. const struct cred *cred;
  631. int ret;
  632. rcu_read_lock();
  633. cred = __task_cred(p);
  634. ret = ((uid_eq(fown->euid, GLOBAL_ROOT_UID) ||
  635. uid_eq(fown->euid, cred->suid) || uid_eq(fown->euid, cred->uid) ||
  636. uid_eq(fown->uid, cred->suid) || uid_eq(fown->uid, cred->uid)) &&
  637. !security_file_send_sigiotask(p, fown, sig));
  638. rcu_read_unlock();
  639. return ret;
  640. }
  641. static void send_sigio_to_task(struct task_struct *p,
  642. struct fown_struct *fown,
  643. int fd, int reason, enum pid_type type)
  644. {
  645. /*
  646. * F_SETSIG can change ->signum lockless in parallel, make
  647. * sure we read it once and use the same value throughout.
  648. */
  649. int signum = READ_ONCE(fown->signum);
  650. if (!sigio_perm(p, fown, signum))
  651. return;
  652. switch (signum) {
  653. default: {
  654. kernel_siginfo_t si;
  655. /* Queue a rt signal with the appropriate fd as its
  656. value. We use SI_SIGIO as the source, not
  657. SI_KERNEL, since kernel signals always get
  658. delivered even if we can't queue. Failure to
  659. queue in this case _should_ be reported; we fall
  660. back to SIGIO in that case. --sct */
  661. clear_siginfo(&si);
  662. si.si_signo = signum;
  663. si.si_errno = 0;
  664. si.si_code = reason;
  665. /*
  666. * Posix definies POLL_IN and friends to be signal
  667. * specific si_codes for SIG_POLL. Linux extended
  668. * these si_codes to other signals in a way that is
  669. * ambiguous if other signals also have signal
  670. * specific si_codes. In that case use SI_SIGIO instead
  671. * to remove the ambiguity.
  672. */
  673. if ((signum != SIGPOLL) && sig_specific_sicodes(signum))
  674. si.si_code = SI_SIGIO;
  675. /* Make sure we are called with one of the POLL_*
  676. reasons, otherwise we could leak kernel stack into
  677. userspace. */
  678. BUG_ON((reason < POLL_IN) || ((reason - POLL_IN) >= NSIGPOLL));
  679. if (reason - POLL_IN >= NSIGPOLL)
  680. si.si_band = ~0L;
  681. else
  682. si.si_band = mangle_poll(band_table[reason - POLL_IN]);
  683. si.si_fd = fd;
  684. if (!do_send_sig_info(signum, &si, p, type))
  685. break;
  686. }
  687. fallthrough; /* fall back on the old plain SIGIO signal */
  688. case 0:
  689. do_send_sig_info(SIGIO, SEND_SIG_PRIV, p, type);
  690. }
  691. }
  692. void send_sigio(struct fown_struct *fown, int fd, int band)
  693. {
  694. struct task_struct *p;
  695. enum pid_type type;
  696. unsigned long flags;
  697. struct pid *pid;
  698. read_lock_irqsave(&fown->lock, flags);
  699. type = fown->pid_type;
  700. pid = fown->pid;
  701. if (!pid)
  702. goto out_unlock_fown;
  703. if (type <= PIDTYPE_TGID) {
  704. rcu_read_lock();
  705. p = pid_task(pid, PIDTYPE_PID);
  706. if (p)
  707. send_sigio_to_task(p, fown, fd, band, type);
  708. rcu_read_unlock();
  709. } else {
  710. read_lock(&tasklist_lock);
  711. do_each_pid_task(pid, type, p) {
  712. send_sigio_to_task(p, fown, fd, band, type);
  713. } while_each_pid_task(pid, type, p);
  714. read_unlock(&tasklist_lock);
  715. }
  716. out_unlock_fown:
  717. read_unlock_irqrestore(&fown->lock, flags);
  718. }
  719. static void send_sigurg_to_task(struct task_struct *p,
  720. struct fown_struct *fown, enum pid_type type)
  721. {
  722. if (sigio_perm(p, fown, SIGURG))
  723. do_send_sig_info(SIGURG, SEND_SIG_PRIV, p, type);
  724. }
  725. int send_sigurg(struct fown_struct *fown)
  726. {
  727. struct task_struct *p;
  728. enum pid_type type;
  729. struct pid *pid;
  730. unsigned long flags;
  731. int ret = 0;
  732. read_lock_irqsave(&fown->lock, flags);
  733. type = fown->pid_type;
  734. pid = fown->pid;
  735. if (!pid)
  736. goto out_unlock_fown;
  737. ret = 1;
  738. if (type <= PIDTYPE_TGID) {
  739. rcu_read_lock();
  740. p = pid_task(pid, PIDTYPE_PID);
  741. if (p)
  742. send_sigurg_to_task(p, fown, type);
  743. rcu_read_unlock();
  744. } else {
  745. read_lock(&tasklist_lock);
  746. do_each_pid_task(pid, type, p) {
  747. send_sigurg_to_task(p, fown, type);
  748. } while_each_pid_task(pid, type, p);
  749. read_unlock(&tasklist_lock);
  750. }
  751. out_unlock_fown:
  752. read_unlock_irqrestore(&fown->lock, flags);
  753. return ret;
  754. }
  755. static DEFINE_SPINLOCK(fasync_lock);
  756. static struct kmem_cache *fasync_cache __read_mostly;
  757. static void fasync_free_rcu(struct rcu_head *head)
  758. {
  759. kmem_cache_free(fasync_cache,
  760. container_of(head, struct fasync_struct, fa_rcu));
  761. }
  762. /*
  763. * Remove a fasync entry. If successfully removed, return
  764. * positive and clear the FASYNC flag. If no entry exists,
  765. * do nothing and return 0.
  766. *
  767. * NOTE! It is very important that the FASYNC flag always
  768. * match the state "is the filp on a fasync list".
  769. *
  770. */
  771. int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
  772. {
  773. struct fasync_struct *fa, **fp;
  774. int result = 0;
  775. spin_lock(&filp->f_lock);
  776. spin_lock(&fasync_lock);
  777. for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
  778. if (fa->fa_file != filp)
  779. continue;
  780. write_lock_irq(&fa->fa_lock);
  781. fa->fa_file = NULL;
  782. write_unlock_irq(&fa->fa_lock);
  783. *fp = fa->fa_next;
  784. call_rcu(&fa->fa_rcu, fasync_free_rcu);
  785. filp->f_flags &= ~FASYNC;
  786. result = 1;
  787. break;
  788. }
  789. spin_unlock(&fasync_lock);
  790. spin_unlock(&filp->f_lock);
  791. return result;
  792. }
  793. struct fasync_struct *fasync_alloc(void)
  794. {
  795. return kmem_cache_alloc(fasync_cache, GFP_KERNEL);
  796. }
  797. /*
  798. * NOTE! This can be used only for unused fasync entries:
  799. * entries that actually got inserted on the fasync list
  800. * need to be released by rcu - see fasync_remove_entry.
  801. */
  802. void fasync_free(struct fasync_struct *new)
  803. {
  804. kmem_cache_free(fasync_cache, new);
  805. }
  806. /*
  807. * Insert a new entry into the fasync list. Return the pointer to the
  808. * old one if we didn't use the new one.
  809. *
  810. * NOTE! It is very important that the FASYNC flag always
  811. * match the state "is the filp on a fasync list".
  812. */
  813. struct fasync_struct *fasync_insert_entry(int fd, struct file *filp, struct fasync_struct **fapp, struct fasync_struct *new)
  814. {
  815. struct fasync_struct *fa, **fp;
  816. spin_lock(&filp->f_lock);
  817. spin_lock(&fasync_lock);
  818. for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
  819. if (fa->fa_file != filp)
  820. continue;
  821. write_lock_irq(&fa->fa_lock);
  822. fa->fa_fd = fd;
  823. write_unlock_irq(&fa->fa_lock);
  824. goto out;
  825. }
  826. rwlock_init(&new->fa_lock);
  827. new->magic = FASYNC_MAGIC;
  828. new->fa_file = filp;
  829. new->fa_fd = fd;
  830. new->fa_next = *fapp;
  831. rcu_assign_pointer(*fapp, new);
  832. filp->f_flags |= FASYNC;
  833. out:
  834. spin_unlock(&fasync_lock);
  835. spin_unlock(&filp->f_lock);
  836. return fa;
  837. }
  838. /*
  839. * Add a fasync entry. Return negative on error, positive if
  840. * added, and zero if did nothing but change an existing one.
  841. */
  842. static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)
  843. {
  844. struct fasync_struct *new;
  845. new = fasync_alloc();
  846. if (!new)
  847. return -ENOMEM;
  848. /*
  849. * fasync_insert_entry() returns the old (update) entry if
  850. * it existed.
  851. *
  852. * So free the (unused) new entry and return 0 to let the
  853. * caller know that we didn't add any new fasync entries.
  854. */
  855. if (fasync_insert_entry(fd, filp, fapp, new)) {
  856. fasync_free(new);
  857. return 0;
  858. }
  859. return 1;
  860. }
  861. /*
  862. * fasync_helper() is used by almost all character device drivers
  863. * to set up the fasync queue, and for regular files by the file
  864. * lease code. It returns negative on error, 0 if it did no changes
  865. * and positive if it added/deleted the entry.
  866. */
  867. int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
  868. {
  869. if (!on)
  870. return fasync_remove_entry(filp, fapp);
  871. return fasync_add_entry(fd, filp, fapp);
  872. }
  873. EXPORT_SYMBOL(fasync_helper);
  874. /*
  875. * rcu_read_lock() is held
  876. */
  877. static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
  878. {
  879. while (fa) {
  880. struct fown_struct *fown;
  881. unsigned long flags;
  882. if (fa->magic != FASYNC_MAGIC) {
  883. printk(KERN_ERR "kill_fasync: bad magic number in "
  884. "fasync_struct!\n");
  885. return;
  886. }
  887. read_lock_irqsave(&fa->fa_lock, flags);
  888. if (fa->fa_file) {
  889. fown = &fa->fa_file->f_owner;
  890. /* Don't send SIGURG to processes which have not set a
  891. queued signum: SIGURG has its own default signalling
  892. mechanism. */
  893. if (!(sig == SIGURG && fown->signum == 0))
  894. send_sigio(fown, fa->fa_fd, band);
  895. }
  896. read_unlock_irqrestore(&fa->fa_lock, flags);
  897. fa = rcu_dereference(fa->fa_next);
  898. }
  899. }
  900. void kill_fasync(struct fasync_struct **fp, int sig, int band)
  901. {
  902. /* First a quick test without locking: usually
  903. * the list is empty.
  904. */
  905. if (*fp) {
  906. rcu_read_lock();
  907. kill_fasync_rcu(rcu_dereference(*fp), sig, band);
  908. rcu_read_unlock();
  909. }
  910. }
  911. EXPORT_SYMBOL(kill_fasync);
  912. static int __init fcntl_init(void)
  913. {
  914. /*
  915. * Please add new bits here to ensure allocation uniqueness.
  916. * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
  917. * is defined as O_NONBLOCK on some platforms and not on others.
  918. */
  919. BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ !=
  920. HWEIGHT32(
  921. (VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) |
  922. __FMODE_EXEC | __FMODE_NONOTIFY));
  923. fasync_cache = kmem_cache_create("fasync_cache",
  924. sizeof(struct fasync_struct), 0, SLAB_PANIC, NULL);
  925. return 0;
  926. }
  927. module_init(fcntl_init)