1176 lines · c
1// SPDX-License-Identifier: GPL-2.02/*3 * linux/fs/fcntl.c4 *5 * Copyright (C) 1991, 1992 Linus Torvalds6 */7 8#include <linux/syscalls.h>9#include <linux/init.h>10#include <linux/mm.h>11#include <linux/sched/task.h>12#include <linux/fs.h>13#include <linux/filelock.h>14#include <linux/file.h>15#include <linux/fdtable.h>16#include <linux/capability.h>17#include <linux/dnotify.h>18#include <linux/slab.h>19#include <linux/module.h>20#include <linux/pipe_fs_i.h>21#include <linux/security.h>22#include <linux/ptrace.h>23#include <linux/signal.h>24#include <linux/rcupdate.h>25#include <linux/pid_namespace.h>26#include <linux/user_namespace.h>27#include <linux/memfd.h>28#include <linux/compat.h>29#include <linux/mount.h>30#include <linux/rw_hint.h>31 32#include <linux/poll.h>33#include <asm/siginfo.h>34#include <linux/uaccess.h>35 36#include "internal.h"37 38#define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME)39 40static int setfl(int fd, struct file * filp, unsigned int arg)41{42 struct inode * inode = file_inode(filp);43 int error = 0;44 45 /*46 * O_APPEND cannot be cleared if the file is marked as append-only47 * and the file is open for write.48 */49 if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode))50 return -EPERM;51 52 /* O_NOATIME can only be set by the owner or superuser */53 if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME))54 if (!inode_owner_or_capable(file_mnt_idmap(filp), inode))55 return -EPERM;56 57 /* required for strict SunOS emulation */58 if (O_NONBLOCK != O_NDELAY)59 if (arg & O_NDELAY)60 arg |= O_NONBLOCK;61 62 /* Pipe packetized mode is controlled by O_DIRECT flag */63 if (!S_ISFIFO(inode->i_mode) &&64 (arg & O_DIRECT) &&65 !(filp->f_mode & FMODE_CAN_ODIRECT))66 return -EINVAL;67 68 if (filp->f_op->check_flags)69 error = filp->f_op->check_flags(arg);70 if (error)71 return error;72 73 /*74 * ->fasync() is responsible for setting the FASYNC bit.75 */76 if (((arg ^ filp->f_flags) & FASYNC) && filp->f_op->fasync) {77 error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);78 if (error < 0)79 goto out;80 if (error > 0)81 error = 0;82 }83 spin_lock(&filp->f_lock);84 filp->f_flags = (arg & SETFL_MASK) | (filp->f_flags & ~SETFL_MASK);85 filp->f_iocb_flags = iocb_flags(filp);86 spin_unlock(&filp->f_lock);87 88 out:89 return error;90}91 92/*93 * Allocate an file->f_owner struct if it doesn't exist, handling racing94 * allocations correctly.95 */96int file_f_owner_allocate(struct file *file)97{98 struct fown_struct *f_owner;99 100 f_owner = file_f_owner(file);101 if (f_owner)102 return 0;103 104 f_owner = kzalloc(sizeof(struct fown_struct), GFP_KERNEL);105 if (!f_owner)106 return -ENOMEM;107 108 rwlock_init(&f_owner->lock);109 f_owner->file = file;110 /* If someone else raced us, drop our allocation. */111 if (unlikely(cmpxchg(&file->f_owner, NULL, f_owner)))112 kfree(f_owner);113 return 0;114}115EXPORT_SYMBOL(file_f_owner_allocate);116 117void file_f_owner_release(struct file *file)118{119 struct fown_struct *f_owner;120 121 f_owner = file_f_owner(file);122 if (f_owner) {123 put_pid(f_owner->pid);124 kfree(f_owner);125 }126}127 128void __f_setown(struct file *filp, struct pid *pid, enum pid_type type,129 int force)130{131 struct fown_struct *f_owner;132 133 f_owner = file_f_owner(filp);134 if (WARN_ON_ONCE(!f_owner))135 return;136 137 write_lock_irq(&f_owner->lock);138 if (force || !f_owner->pid) {139 put_pid(f_owner->pid);140 f_owner->pid = get_pid(pid);141 f_owner->pid_type = type;142 143 if (pid) {144 const struct cred *cred = current_cred();145 security_file_set_fowner(filp);146 f_owner->uid = cred->uid;147 f_owner->euid = cred->euid;148 }149 }150 write_unlock_irq(&f_owner->lock);151}152EXPORT_SYMBOL(__f_setown);153 154int f_setown(struct file *filp, int who, int force)155{156 enum pid_type type;157 struct pid *pid = NULL;158 int ret = 0;159 160 might_sleep();161 162 type = PIDTYPE_TGID;163 if (who < 0) {164 /* avoid overflow below */165 if (who == INT_MIN)166 return -EINVAL;167 168 type = PIDTYPE_PGID;169 who = -who;170 }171 172 ret = file_f_owner_allocate(filp);173 if (ret)174 return ret;175 176 rcu_read_lock();177 if (who) {178 pid = find_vpid(who);179 if (!pid)180 ret = -ESRCH;181 }182 183 if (!ret)184 __f_setown(filp, pid, type, force);185 rcu_read_unlock();186 187 return ret;188}189EXPORT_SYMBOL(f_setown);190 191void f_delown(struct file *filp)192{193 __f_setown(filp, NULL, PIDTYPE_TGID, 1);194}195 196pid_t f_getown(struct file *filp)197{198 pid_t pid = 0;199 struct fown_struct *f_owner;200 201 f_owner = file_f_owner(filp);202 if (!f_owner)203 return pid;204 205 read_lock_irq(&f_owner->lock);206 rcu_read_lock();207 if (pid_task(f_owner->pid, f_owner->pid_type)) {208 pid = pid_vnr(f_owner->pid);209 if (f_owner->pid_type == PIDTYPE_PGID)210 pid = -pid;211 }212 rcu_read_unlock();213 read_unlock_irq(&f_owner->lock);214 return pid;215}216 217static int f_setown_ex(struct file *filp, unsigned long arg)218{219 struct f_owner_ex __user *owner_p = (void __user *)arg;220 struct f_owner_ex owner;221 struct pid *pid;222 int type;223 int ret;224 225 ret = copy_from_user(&owner, owner_p, sizeof(owner));226 if (ret)227 return -EFAULT;228 229 switch (owner.type) {230 case F_OWNER_TID:231 type = PIDTYPE_PID;232 break;233 234 case F_OWNER_PID:235 type = PIDTYPE_TGID;236 break;237 238 case F_OWNER_PGRP:239 type = PIDTYPE_PGID;240 break;241 242 default:243 return -EINVAL;244 }245 246 ret = file_f_owner_allocate(filp);247 if (ret)248 return ret;249 250 rcu_read_lock();251 pid = find_vpid(owner.pid);252 if (owner.pid && !pid)253 ret = -ESRCH;254 else255 __f_setown(filp, pid, type, 1);256 rcu_read_unlock();257 258 return ret;259}260 261static int f_getown_ex(struct file *filp, unsigned long arg)262{263 struct f_owner_ex __user *owner_p = (void __user *)arg;264 struct f_owner_ex owner = {};265 int ret = 0;266 struct fown_struct *f_owner;267 enum pid_type pid_type = PIDTYPE_PID;268 269 f_owner = file_f_owner(filp);270 if (f_owner) {271 read_lock_irq(&f_owner->lock);272 rcu_read_lock();273 if (pid_task(f_owner->pid, f_owner->pid_type))274 owner.pid = pid_vnr(f_owner->pid);275 rcu_read_unlock();276 pid_type = f_owner->pid_type;277 }278 279 switch (pid_type) {280 case PIDTYPE_PID:281 owner.type = F_OWNER_TID;282 break;283 284 case PIDTYPE_TGID:285 owner.type = F_OWNER_PID;286 break;287 288 case PIDTYPE_PGID:289 owner.type = F_OWNER_PGRP;290 break;291 292 default:293 WARN_ON(1);294 ret = -EINVAL;295 break;296 }297 if (f_owner)298 read_unlock_irq(&f_owner->lock);299 300 if (!ret) {301 ret = copy_to_user(owner_p, &owner, sizeof(owner));302 if (ret)303 ret = -EFAULT;304 }305 return ret;306}307 308#ifdef CONFIG_CHECKPOINT_RESTORE309static int f_getowner_uids(struct file *filp, unsigned long arg)310{311 struct user_namespace *user_ns = current_user_ns();312 struct fown_struct *f_owner;313 uid_t __user *dst = (void __user *)arg;314 uid_t src[2] = {0, 0};315 int err;316 317 f_owner = file_f_owner(filp);318 if (f_owner) {319 read_lock_irq(&f_owner->lock);320 src[0] = from_kuid(user_ns, f_owner->uid);321 src[1] = from_kuid(user_ns, f_owner->euid);322 read_unlock_irq(&f_owner->lock);323 }324 325 err = put_user(src[0], &dst[0]);326 err |= put_user(src[1], &dst[1]);327 328 return err;329}330#else331static int f_getowner_uids(struct file *filp, unsigned long arg)332{333 return -EINVAL;334}335#endif336 337static bool rw_hint_valid(u64 hint)338{339 BUILD_BUG_ON(WRITE_LIFE_NOT_SET != RWH_WRITE_LIFE_NOT_SET);340 BUILD_BUG_ON(WRITE_LIFE_NONE != RWH_WRITE_LIFE_NONE);341 BUILD_BUG_ON(WRITE_LIFE_SHORT != RWH_WRITE_LIFE_SHORT);342 BUILD_BUG_ON(WRITE_LIFE_MEDIUM != RWH_WRITE_LIFE_MEDIUM);343 BUILD_BUG_ON(WRITE_LIFE_LONG != RWH_WRITE_LIFE_LONG);344 BUILD_BUG_ON(WRITE_LIFE_EXTREME != RWH_WRITE_LIFE_EXTREME);345 346 switch (hint) {347 case RWH_WRITE_LIFE_NOT_SET:348 case RWH_WRITE_LIFE_NONE:349 case RWH_WRITE_LIFE_SHORT:350 case RWH_WRITE_LIFE_MEDIUM:351 case RWH_WRITE_LIFE_LONG:352 case RWH_WRITE_LIFE_EXTREME:353 return true;354 default:355 return false;356 }357}358 359static long fcntl_get_rw_hint(struct file *file, unsigned int cmd,360 unsigned long arg)361{362 struct inode *inode = file_inode(file);363 u64 __user *argp = (u64 __user *)arg;364 u64 hint = READ_ONCE(inode->i_write_hint);365 366 if (copy_to_user(argp, &hint, sizeof(*argp)))367 return -EFAULT;368 return 0;369}370 371static long fcntl_set_rw_hint(struct file *file, unsigned int cmd,372 unsigned long arg)373{374 struct inode *inode = file_inode(file);375 u64 __user *argp = (u64 __user *)arg;376 u64 hint;377 378 if (copy_from_user(&hint, argp, sizeof(hint)))379 return -EFAULT;380 if (!rw_hint_valid(hint))381 return -EINVAL;382 383 WRITE_ONCE(inode->i_write_hint, hint);384 385 /*386 * file->f_mapping->host may differ from inode. As an example,387 * blkdev_open() modifies file->f_mapping.388 */389 if (file->f_mapping->host != inode)390 WRITE_ONCE(file->f_mapping->host->i_write_hint, hint);391 392 return 0;393}394 395/* Is the file descriptor a dup of the file? */396static long f_dupfd_query(int fd, struct file *filp)397{398 CLASS(fd_raw, f)(fd);399 400 /*401 * We can do the 'fdput()' immediately, as the only thing that402 * matters is the pointer value which isn't changed by the fdput.403 *404 * Technically we didn't need a ref at all, and 'fdget()' was405 * overkill, but given our lockless file pointer lookup, the406 * alternatives are complicated.407 */408 return fd_file(f) == filp;409}410 411/* Let the caller figure out whether a given file was just created. */412static long f_created_query(const struct file *filp)413{414 return !!(filp->f_mode & FMODE_CREATED);415}416 417static int f_owner_sig(struct file *filp, int signum, bool setsig)418{419 int ret = 0;420 struct fown_struct *f_owner;421 422 might_sleep();423 424 if (setsig) {425 if (!valid_signal(signum))426 return -EINVAL;427 428 ret = file_f_owner_allocate(filp);429 if (ret)430 return ret;431 }432 433 f_owner = file_f_owner(filp);434 if (setsig)435 f_owner->signum = signum;436 else if (f_owner)437 ret = f_owner->signum;438 return ret;439}440 441static HWJS_SUSPENDS long do_fcntl(int fd, unsigned int cmd, unsigned long arg,442 struct file *filp)443{444 void __user *argp = (void __user *)arg;445 int argi = (int)arg;446 struct flock flock;447 long err = -EINVAL;448 449 switch (cmd) {450 case F_CREATED_QUERY:451 err = f_created_query(filp);452 break;453 case F_DUPFD:454 err = f_dupfd(argi, filp, 0);455 break;456 case F_DUPFD_CLOEXEC:457 err = f_dupfd(argi, filp, O_CLOEXEC);458 break;459 case F_DUPFD_QUERY:460 err = f_dupfd_query(argi, filp);461 break;462 case F_GETFD:463 err = get_close_on_exec(fd) ? FD_CLOEXEC : 0;464 break;465 case F_SETFD:466 err = 0;467 set_close_on_exec(fd, argi & FD_CLOEXEC);468 break;469 case F_GETFL:470 err = filp->f_flags;471 break;472 case F_SETFL:473 err = setfl(fd, filp, argi);474 break;475#if BITS_PER_LONG != 32476 /* 32-bit arches must use fcntl64() */477 case F_OFD_GETLK:478#endif479 case F_GETLK:480 if (copy_from_user(&flock, argp, sizeof(flock)))481 return -EFAULT;482 err = fcntl_getlk(filp, cmd, &flock);483 if (!err && copy_to_user(argp, &flock, sizeof(flock)))484 return -EFAULT;485 break;486#if BITS_PER_LONG != 32487 /* 32-bit arches must use fcntl64() */488 case F_OFD_SETLK:489 case F_OFD_SETLKW:490 fallthrough;491#endif492 case F_SETLK:493 case F_SETLKW:494 if (copy_from_user(&flock, argp, sizeof(flock)))495 return -EFAULT;496 err = fcntl_setlk(fd, filp, cmd, &flock);497 break;498 case F_GETOWN:499 /*500 * XXX If f_owner is a process group, the501 * negative return value will get converted502 * into an error. Oops. If we keep the503 * current syscall conventions, the only way504 * to fix this will be in libc.505 */506 err = f_getown(filp);507 force_successful_syscall_return();508 break;509 case F_SETOWN:510 err = f_setown(filp, argi, 1);511 break;512 case F_GETOWN_EX:513 err = f_getown_ex(filp, arg);514 break;515 case F_SETOWN_EX:516 err = f_setown_ex(filp, arg);517 break;518 case F_GETOWNER_UIDS:519 err = f_getowner_uids(filp, arg);520 break;521 case F_GETSIG:522 err = f_owner_sig(filp, 0, false);523 break;524 case F_SETSIG:525 err = f_owner_sig(filp, argi, true);526 break;527 case F_GETLEASE:528 err = fcntl_getlease(filp);529 break;530 case F_SETLEASE:531 err = fcntl_setlease(fd, filp, argi);532 break;533 case F_NOTIFY:534 err = fcntl_dirnotify(fd, filp, argi);535 break;536 case F_SETPIPE_SZ:537 case F_GETPIPE_SZ:538 err = pipe_fcntl(filp, cmd, argi);539 break;540 case F_ADD_SEALS:541 case F_GET_SEALS:542 err = memfd_fcntl(filp, cmd, argi);543 break;544 case F_GET_RW_HINT:545 err = fcntl_get_rw_hint(filp, cmd, arg);546 break;547 case F_SET_RW_HINT:548 err = fcntl_set_rw_hint(filp, cmd, arg);549 break;550 default:551 break;552 }553 return err;554}555 556static int check_fcntl_cmd(unsigned cmd)557{558 switch (cmd) {559 case F_CREATED_QUERY:560 case F_DUPFD:561 case F_DUPFD_CLOEXEC:562 case F_DUPFD_QUERY:563 case F_GETFD:564 case F_SETFD:565 case F_GETFL:566 return 1;567 }568 return 0;569}570 571SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)572{ 573 struct fd f = fdget_raw(fd);574 long err = -EBADF;575 576 if (!fd_file(f))577 goto out;578 579 if (unlikely(fd_file(f)->f_mode & FMODE_PATH)) {580 if (!check_fcntl_cmd(cmd))581 goto out1;582 }583 584 err = security_file_fcntl(fd_file(f), cmd, arg);585 if (!err)586 err = do_fcntl(fd, cmd, arg, fd_file(f));587 588out1:589 fdput(f);590out:591 return err;592}593 594#if BITS_PER_LONG == 32595SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,596 unsigned long, arg)597{ 598 void __user *argp = (void __user *)arg;599 struct fd f = fdget_raw(fd);600 struct flock64 flock;601 long err = -EBADF;602 603 if (!fd_file(f))604 goto out;605 606 if (unlikely(fd_file(f)->f_mode & FMODE_PATH)) {607 if (!check_fcntl_cmd(cmd))608 goto out1;609 }610 611 err = security_file_fcntl(fd_file(f), cmd, arg);612 if (err)613 goto out1;614 615 switch (cmd) {616 case F_GETLK64:617 case F_OFD_GETLK:618 err = -EFAULT;619 if (copy_from_user(&flock, argp, sizeof(flock)))620 break;621 err = fcntl_getlk64(fd_file(f), cmd, &flock);622 if (!err && copy_to_user(argp, &flock, sizeof(flock)))623 err = -EFAULT;624 break;625 case F_SETLK64:626 case F_SETLKW64:627 case F_OFD_SETLK:628 case F_OFD_SETLKW:629 err = -EFAULT;630 if (copy_from_user(&flock, argp, sizeof(flock)))631 break;632 err = fcntl_setlk64(fd, fd_file(f), cmd, &flock);633 break;634 default:635 err = do_fcntl(fd, cmd, arg, fd_file(f));636 break;637 }638out1:639 fdput(f);640out:641 return err;642}643#endif644 645#ifdef CONFIG_COMPAT646/* careful - don't use anywhere else */647#define copy_flock_fields(dst, src) \648 (dst)->l_type = (src)->l_type; \649 (dst)->l_whence = (src)->l_whence; \650 (dst)->l_start = (src)->l_start; \651 (dst)->l_len = (src)->l_len; \652 (dst)->l_pid = (src)->l_pid;653 654static int get_compat_flock(struct flock *kfl, const struct compat_flock __user *ufl)655{656 struct compat_flock fl;657 658 if (copy_from_user(&fl, ufl, sizeof(struct compat_flock)))659 return -EFAULT;660 copy_flock_fields(kfl, &fl);661 return 0;662}663 664static int get_compat_flock64(struct flock *kfl, const struct compat_flock64 __user *ufl)665{666 struct compat_flock64 fl;667 668 if (copy_from_user(&fl, ufl, sizeof(struct compat_flock64)))669 return -EFAULT;670 copy_flock_fields(kfl, &fl);671 return 0;672}673 674static int put_compat_flock(const struct flock *kfl, struct compat_flock __user *ufl)675{676 struct compat_flock fl;677 678 memset(&fl, 0, sizeof(struct compat_flock));679 copy_flock_fields(&fl, kfl);680 if (copy_to_user(ufl, &fl, sizeof(struct compat_flock)))681 return -EFAULT;682 return 0;683}684 685static int put_compat_flock64(const struct flock *kfl, struct compat_flock64 __user *ufl)686{687 struct compat_flock64 fl;688 689 BUILD_BUG_ON(sizeof(kfl->l_start) > sizeof(ufl->l_start));690 BUILD_BUG_ON(sizeof(kfl->l_len) > sizeof(ufl->l_len));691 692 memset(&fl, 0, sizeof(struct compat_flock64));693 copy_flock_fields(&fl, kfl);694 if (copy_to_user(ufl, &fl, sizeof(struct compat_flock64)))695 return -EFAULT;696 return 0;697}698#undef copy_flock_fields699 700static unsigned int701convert_fcntl_cmd(unsigned int cmd)702{703 switch (cmd) {704 case F_GETLK64:705 return F_GETLK;706 case F_SETLK64:707 return F_SETLK;708 case F_SETLKW64:709 return F_SETLKW;710 }711 712 return cmd;713}714 715/*716 * GETLK was successful and we need to return the data, but it needs to fit in717 * the compat structure.718 * l_start shouldn't be too big, unless the original start + end is greater than719 * COMPAT_OFF_T_MAX, in which case the app was asking for trouble, so we return720 * -EOVERFLOW in that case. l_len could be too big, in which case we just721 * truncate it, and only allow the app to see that part of the conflicting lock722 * that might make sense to it anyway723 */724static int fixup_compat_flock(struct flock *flock)725{726 if (flock->l_start > COMPAT_OFF_T_MAX)727 return -EOVERFLOW;728 if (flock->l_len > COMPAT_OFF_T_MAX)729 flock->l_len = COMPAT_OFF_T_MAX;730 return 0;731}732 733static long do_compat_fcntl64(unsigned int fd, unsigned int cmd,734 compat_ulong_t arg)735{736 struct fd f = fdget_raw(fd);737 struct flock flock;738 long err = -EBADF;739 740 if (!fd_file(f))741 return err;742 743 if (unlikely(fd_file(f)->f_mode & FMODE_PATH)) {744 if (!check_fcntl_cmd(cmd))745 goto out_put;746 }747 748 err = security_file_fcntl(fd_file(f), cmd, arg);749 if (err)750 goto out_put;751 752 switch (cmd) {753 case F_GETLK:754 err = get_compat_flock(&flock, compat_ptr(arg));755 if (err)756 break;757 err = fcntl_getlk(fd_file(f), convert_fcntl_cmd(cmd), &flock);758 if (err)759 break;760 err = fixup_compat_flock(&flock);761 if (!err)762 err = put_compat_flock(&flock, compat_ptr(arg));763 break;764 case F_GETLK64:765 case F_OFD_GETLK:766 err = get_compat_flock64(&flock, compat_ptr(arg));767 if (err)768 break;769 err = fcntl_getlk(fd_file(f), convert_fcntl_cmd(cmd), &flock);770 if (!err)771 err = put_compat_flock64(&flock, compat_ptr(arg));772 break;773 case F_SETLK:774 case F_SETLKW:775 err = get_compat_flock(&flock, compat_ptr(arg));776 if (err)777 break;778 err = fcntl_setlk(fd, fd_file(f), convert_fcntl_cmd(cmd), &flock);779 break;780 case F_SETLK64:781 case F_SETLKW64:782 case F_OFD_SETLK:783 case F_OFD_SETLKW:784 err = get_compat_flock64(&flock, compat_ptr(arg));785 if (err)786 break;787 err = fcntl_setlk(fd, fd_file(f), convert_fcntl_cmd(cmd), &flock);788 break;789 default:790 err = do_fcntl(fd, cmd, arg, fd_file(f));791 break;792 }793out_put:794 fdput(f);795 return err;796}797 798COMPAT_SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,799 compat_ulong_t, arg)800{801 return do_compat_fcntl64(fd, cmd, arg);802}803 804COMPAT_SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd,805 compat_ulong_t, arg)806{807 switch (cmd) {808 case F_GETLK64:809 case F_SETLK64:810 case F_SETLKW64:811 case F_OFD_GETLK:812 case F_OFD_SETLK:813 case F_OFD_SETLKW:814 return -EINVAL;815 }816 return do_compat_fcntl64(fd, cmd, arg);817}818#endif819 820/* Table to convert sigio signal codes into poll band bitmaps */821 822static const __poll_t band_table[NSIGPOLL] = {823 EPOLLIN | EPOLLRDNORM, /* POLL_IN */824 EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND, /* POLL_OUT */825 EPOLLIN | EPOLLRDNORM | EPOLLMSG, /* POLL_MSG */826 EPOLLERR, /* POLL_ERR */827 EPOLLPRI | EPOLLRDBAND, /* POLL_PRI */828 EPOLLHUP | EPOLLERR /* POLL_HUP */829};830 831static inline int sigio_perm(struct task_struct *p,832 struct fown_struct *fown, int sig)833{834 const struct cred *cred;835 int ret;836 837 rcu_read_lock();838 cred = __task_cred(p);839 ret = ((uid_eq(fown->euid, GLOBAL_ROOT_UID) ||840 uid_eq(fown->euid, cred->suid) || uid_eq(fown->euid, cred->uid) ||841 uid_eq(fown->uid, cred->suid) || uid_eq(fown->uid, cred->uid)) &&842 !security_file_send_sigiotask(p, fown, sig));843 rcu_read_unlock();844 return ret;845}846 847static HWJS_SUSPENDS void send_sigio_to_task(struct task_struct *p,848 struct fown_struct *fown,849 int fd, int reason, enum pid_type type)850{851 /*852 * F_SETSIG can change ->signum lockless in parallel, make853 * sure we read it once and use the same value throughout.854 */855 int signum = READ_ONCE(fown->signum);856 857 if (!sigio_perm(p, fown, signum))858 return;859 860 switch (signum) {861 default: {862 kernel_siginfo_t si;863 864 /* Queue a rt signal with the appropriate fd as its865 value. We use SI_SIGIO as the source, not 866 SI_KERNEL, since kernel signals always get 867 delivered even if we can't queue. Failure to868 queue in this case _should_ be reported; we fall869 back to SIGIO in that case. --sct */870 clear_siginfo(&si);871 si.si_signo = signum;872 si.si_errno = 0;873 si.si_code = reason;874 /*875 * Posix definies POLL_IN and friends to be signal876 * specific si_codes for SIG_POLL. Linux extended877 * these si_codes to other signals in a way that is878 * ambiguous if other signals also have signal879 * specific si_codes. In that case use SI_SIGIO instead880 * to remove the ambiguity.881 */882 if ((signum != SIGPOLL) && sig_specific_sicodes(signum))883 si.si_code = SI_SIGIO;884 885 /* Make sure we are called with one of the POLL_*886 reasons, otherwise we could leak kernel stack into887 userspace. */888 BUG_ON((reason < POLL_IN) || ((reason - POLL_IN) >= NSIGPOLL));889 if (reason - POLL_IN >= NSIGPOLL)890 si.si_band = ~0L;891 else892 si.si_band = mangle_poll(band_table[reason - POLL_IN]);893 si.si_fd = fd;894 if (!do_send_sig_info(signum, &si, p, type))895 break;896 }897 fallthrough; /* fall back on the old plain SIGIO signal */898 case 0:899 do_send_sig_info(SIGIO, SEND_SIG_PRIV, p, type);900 }901}902 903void send_sigio(struct fown_struct *fown, int fd, int band)904{905 struct task_struct *p;906 enum pid_type type;907 unsigned long flags;908 struct pid *pid;909 910 read_lock_irqsave(&fown->lock, flags);911 912 type = fown->pid_type;913 pid = fown->pid;914 if (!pid)915 goto out_unlock_fown;916 917 if (type <= PIDTYPE_TGID) {918 rcu_read_lock();919 p = pid_task(pid, PIDTYPE_PID);920 if (p)921 send_sigio_to_task(p, fown, fd, band, type);922 rcu_read_unlock();923 } else {924 read_lock(&tasklist_lock);925 do_each_pid_task(pid, type, p) {926 send_sigio_to_task(p, fown, fd, band, type);927 } while_each_pid_task(pid, type, p);928 read_unlock(&tasklist_lock);929 }930 out_unlock_fown:931 read_unlock_irqrestore(&fown->lock, flags);932}933 934static HWJS_SUSPENDS void send_sigurg_to_task(struct task_struct *p,935 struct fown_struct *fown, enum pid_type type)936{937 if (sigio_perm(p, fown, SIGURG))938 do_send_sig_info(SIGURG, SEND_SIG_PRIV, p, type);939}940 941int send_sigurg(struct file *file)942{943 struct fown_struct *fown;944 struct task_struct *p;945 enum pid_type type;946 struct pid *pid;947 unsigned long flags;948 int ret = 0;949 950 fown = file_f_owner(file);951 if (!fown)952 return 0;953 954 read_lock_irqsave(&fown->lock, flags);955 956 type = fown->pid_type;957 pid = fown->pid;958 if (!pid)959 goto out_unlock_fown;960 961 ret = 1;962 963 if (type <= PIDTYPE_TGID) {964 rcu_read_lock();965 p = pid_task(pid, PIDTYPE_PID);966 if (p)967 send_sigurg_to_task(p, fown, type);968 rcu_read_unlock();969 } else {970 read_lock(&tasklist_lock);971 do_each_pid_task(pid, type, p) {972 send_sigurg_to_task(p, fown, type);973 } while_each_pid_task(pid, type, p);974 read_unlock(&tasklist_lock);975 }976 out_unlock_fown:977 read_unlock_irqrestore(&fown->lock, flags);978 return ret;979}980 981static DEFINE_SPINLOCK(fasync_lock);982static struct kmem_cache *fasync_cache __ro_after_init;983 984/*985 * Remove a fasync entry. If successfully removed, return986 * positive and clear the FASYNC flag. If no entry exists,987 * do nothing and return 0.988 *989 * NOTE! It is very important that the FASYNC flag always990 * match the state "is the filp on a fasync list".991 *992 */993int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)994{995 struct fasync_struct *fa, **fp;996 int result = 0;997 998 spin_lock(&filp->f_lock);999 spin_lock(&fasync_lock);1000 for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {1001 if (fa->fa_file != filp)1002 continue;1003 1004 write_lock_irq(&fa->fa_lock);1005 fa->fa_file = NULL;1006 write_unlock_irq(&fa->fa_lock);1007 1008 *fp = fa->fa_next;1009 kfree_rcu(fa, fa_rcu);1010 filp->f_flags &= ~FASYNC;1011 result = 1;1012 break;1013 }1014 spin_unlock(&fasync_lock);1015 spin_unlock(&filp->f_lock);1016 return result;1017}1018 1019struct fasync_struct *fasync_alloc(void)1020{1021 return kmem_cache_alloc(fasync_cache, GFP_KERNEL);1022}1023 1024/*1025 * NOTE! This can be used only for unused fasync entries:1026 * entries that actually got inserted on the fasync list1027 * need to be released by rcu - see fasync_remove_entry.1028 */1029void fasync_free(struct fasync_struct *new)1030{1031 kmem_cache_free(fasync_cache, new);1032}1033 1034/*1035 * Insert a new entry into the fasync list. Return the pointer to the1036 * old one if we didn't use the new one.1037 *1038 * NOTE! It is very important that the FASYNC flag always1039 * match the state "is the filp on a fasync list".1040 */1041struct fasync_struct *fasync_insert_entry(int fd, struct file *filp, struct fasync_struct **fapp, struct fasync_struct *new)1042{1043 struct fasync_struct *fa, **fp;1044 1045 spin_lock(&filp->f_lock);1046 spin_lock(&fasync_lock);1047 for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {1048 if (fa->fa_file != filp)1049 continue;1050 1051 write_lock_irq(&fa->fa_lock);1052 fa->fa_fd = fd;1053 write_unlock_irq(&fa->fa_lock);1054 goto out;1055 }1056 1057 rwlock_init(&new->fa_lock);1058 new->magic = FASYNC_MAGIC;1059 new->fa_file = filp;1060 new->fa_fd = fd;1061 new->fa_next = *fapp;1062 rcu_assign_pointer(*fapp, new);1063 filp->f_flags |= FASYNC;1064 1065out:1066 spin_unlock(&fasync_lock);1067 spin_unlock(&filp->f_lock);1068 return fa;1069}1070 1071/*1072 * Add a fasync entry. Return negative on error, positive if1073 * added, and zero if did nothing but change an existing one.1074 */1075static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)1076{1077 struct fasync_struct *new;1078 1079 new = fasync_alloc();1080 if (!new)1081 return -ENOMEM;1082 1083 /*1084 * fasync_insert_entry() returns the old (update) entry if1085 * it existed.1086 *1087 * So free the (unused) new entry and return 0 to let the1088 * caller know that we didn't add any new fasync entries.1089 */1090 if (fasync_insert_entry(fd, filp, fapp, new)) {1091 fasync_free(new);1092 return 0;1093 }1094 1095 return 1;1096}1097 1098/*1099 * fasync_helper() is used by almost all character device drivers1100 * to set up the fasync queue, and for regular files by the file1101 * lease code. It returns negative on error, 0 if it did no changes1102 * and positive if it added/deleted the entry.1103 */1104int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)1105{1106 if (!on)1107 return fasync_remove_entry(filp, fapp);1108 return fasync_add_entry(fd, filp, fapp);1109}1110 1111EXPORT_SYMBOL(fasync_helper);1112 1113/*1114 * rcu_read_lock() is held1115 */1116static HWJS_SUSPENDS void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)1117{1118 while (fa) {1119 struct fown_struct *fown;1120 unsigned long flags;1121 1122 if (fa->magic != FASYNC_MAGIC) {1123 printk(KERN_ERR "kill_fasync: bad magic number in "1124 "fasync_struct!\n");1125 return;1126 }1127 read_lock_irqsave(&fa->fa_lock, flags);1128 if (fa->fa_file) {1129 fown = file_f_owner(fa->fa_file);1130 if (!fown)1131 goto next;1132 /* Don't send SIGURG to processes which have not set a1133 queued signum: SIGURG has its own default signalling1134 mechanism. */1135 if (!(sig == SIGURG && fown->signum == 0))1136 send_sigio(fown, fa->fa_fd, band);1137 }1138next:1139 read_unlock_irqrestore(&fa->fa_lock, flags);1140 fa = rcu_dereference(fa->fa_next);1141 }1142}1143 1144void kill_fasync(struct fasync_struct **fp, int sig, int band)1145{1146 /* First a quick test without locking: usually1147 * the list is empty.1148 */1149 if (*fp) {1150 rcu_read_lock();1151 kill_fasync_rcu(rcu_dereference(*fp), sig, band);1152 rcu_read_unlock();1153 }1154}1155EXPORT_SYMBOL(kill_fasync);1156 1157static int __init fcntl_init(void)1158{1159 /*1160 * Please add new bits here to ensure allocation uniqueness.1161 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY1162 * is defined as O_NONBLOCK on some platforms and not on others.1163 */1164 BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ !=1165 HWEIGHT32(1166 (VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) |1167 __FMODE_EXEC | __FMODE_NONOTIFY));1168 1169 fasync_cache = kmem_cache_create("fasync_cache",1170 sizeof(struct fasync_struct), 0,1171 SLAB_PANIC | SLAB_ACCOUNT, NULL);1172 return 0;1173}1174 1175module_init(fcntl_init)1176