LCOV - code coverage report
Current view: top level - fs - fcntl.c (source / functions) Hit Total Coverage
Test: coverage.info Lines: 6 302 2.0 %
Date: 2023-07-19 18:55:55 Functions: 2 26 7.7 %

          Line data    Source code
       1             : // SPDX-License-Identifier: GPL-2.0
       2             : /*
       3             :  *  linux/fs/fcntl.c
       4             :  *
       5             :  *  Copyright (C) 1991, 1992  Linus Torvalds
       6             :  */
       7             : 
       8             : #include <linux/syscalls.h>
       9             : #include <linux/init.h>
      10             : #include <linux/mm.h>
      11             : #include <linux/sched/task.h>
      12             : #include <linux/fs.h>
      13             : #include <linux/filelock.h>
      14             : #include <linux/file.h>
      15             : #include <linux/fdtable.h>
      16             : #include <linux/capability.h>
      17             : #include <linux/dnotify.h>
      18             : #include <linux/slab.h>
      19             : #include <linux/module.h>
      20             : #include <linux/pipe_fs_i.h>
      21             : #include <linux/security.h>
      22             : #include <linux/ptrace.h>
      23             : #include <linux/signal.h>
      24             : #include <linux/rcupdate.h>
      25             : #include <linux/pid_namespace.h>
      26             : #include <linux/user_namespace.h>
      27             : #include <linux/memfd.h>
      28             : #include <linux/compat.h>
      29             : #include <linux/mount.h>
      30             : 
      31             : #include <linux/poll.h>
      32             : #include <asm/siginfo.h>
      33             : #include <linux/uaccess.h>
      34             : 
      35             : #define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME)
      36             : 
      37           0 : static int setfl(int fd, struct file * filp, unsigned long arg)
      38             : {
      39           0 :         struct inode * inode = file_inode(filp);
      40           0 :         int error = 0;
      41             : 
      42             :         /*
      43             :          * O_APPEND cannot be cleared if the file is marked as append-only
      44             :          * and the file is open for write.
      45             :          */
      46           0 :         if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode))
      47             :                 return -EPERM;
      48             : 
      49             :         /* O_NOATIME can only be set by the owner or superuser */
      50           0 :         if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME))
      51           0 :                 if (!inode_owner_or_capable(file_mnt_idmap(filp), inode))
      52             :                         return -EPERM;
      53             : 
      54             :         /* required for strict SunOS emulation */
      55             :         if (O_NONBLOCK != O_NDELAY)
      56             :                if (arg & O_NDELAY)
      57             :                    arg |= O_NONBLOCK;
      58             : 
      59             :         /* Pipe packetized mode is controlled by O_DIRECT flag */
      60           0 :         if (!S_ISFIFO(inode->i_mode) &&
      61           0 :             (arg & O_DIRECT) &&
      62           0 :             !(filp->f_mode & FMODE_CAN_ODIRECT))
      63             :                 return -EINVAL;
      64             : 
      65           0 :         if (filp->f_op->check_flags)
      66           0 :                 error = filp->f_op->check_flags(arg);
      67           0 :         if (error)
      68             :                 return error;
      69             : 
      70             :         /*
      71             :          * ->fasync() is responsible for setting the FASYNC bit.
      72             :          */
      73           0 :         if (((arg ^ filp->f_flags) & FASYNC) && filp->f_op->fasync) {
      74           0 :                 error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);
      75           0 :                 if (error < 0)
      76             :                         goto out;
      77           0 :                 if (error > 0)
      78           0 :                         error = 0;
      79             :         }
      80           0 :         spin_lock(&filp->f_lock);
      81           0 :         filp->f_flags = (arg & SETFL_MASK) | (filp->f_flags & ~SETFL_MASK);
      82           0 :         filp->f_iocb_flags = iocb_flags(filp);
      83           0 :         spin_unlock(&filp->f_lock);
      84             : 
      85             :  out:
      86             :         return error;
      87             : }
      88             : 
      89           0 : static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
      90             :                      int force)
      91             : {
      92           0 :         write_lock_irq(&filp->f_owner.lock);
      93           0 :         if (force || !filp->f_owner.pid) {
      94           0 :                 put_pid(filp->f_owner.pid);
      95           0 :                 filp->f_owner.pid = get_pid(pid);
      96           0 :                 filp->f_owner.pid_type = type;
      97             : 
      98           0 :                 if (pid) {
      99           0 :                         const struct cred *cred = current_cred();
     100           0 :                         filp->f_owner.uid = cred->uid;
     101           0 :                         filp->f_owner.euid = cred->euid;
     102             :                 }
     103             :         }
     104           0 :         write_unlock_irq(&filp->f_owner.lock);
     105           0 : }
     106             : 
     107           0 : void __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
     108             :                 int force)
     109             : {
     110           0 :         security_file_set_fowner(filp);
     111           0 :         f_modown(filp, pid, type, force);
     112           0 : }
     113             : EXPORT_SYMBOL(__f_setown);
     114             : 
     115           0 : int f_setown(struct file *filp, unsigned long arg, int force)
     116             : {
     117             :         enum pid_type type;
     118           0 :         struct pid *pid = NULL;
     119           0 :         int who = arg, ret = 0;
     120             : 
     121           0 :         type = PIDTYPE_TGID;
     122           0 :         if (who < 0) {
     123             :                 /* avoid overflow below */
     124           0 :                 if (who == INT_MIN)
     125             :                         return -EINVAL;
     126             : 
     127           0 :                 type = PIDTYPE_PGID;
     128           0 :                 who = -who;
     129             :         }
     130             : 
     131             :         rcu_read_lock();
     132           0 :         if (who) {
     133           0 :                 pid = find_vpid(who);
     134           0 :                 if (!pid)
     135           0 :                         ret = -ESRCH;
     136             :         }
     137             : 
     138           0 :         if (!ret)
     139             :                 __f_setown(filp, pid, type, force);
     140             :         rcu_read_unlock();
     141             : 
     142           0 :         return ret;
     143             : }
     144             : EXPORT_SYMBOL(f_setown);
     145             : 
     146           0 : void f_delown(struct file *filp)
     147             : {
     148           0 :         f_modown(filp, NULL, PIDTYPE_TGID, 1);
     149           0 : }
     150             : 
     151           0 : pid_t f_getown(struct file *filp)
     152             : {
     153           0 :         pid_t pid = 0;
     154             : 
     155           0 :         read_lock_irq(&filp->f_owner.lock);
     156             :         rcu_read_lock();
     157           0 :         if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type)) {
     158           0 :                 pid = pid_vnr(filp->f_owner.pid);
     159           0 :                 if (filp->f_owner.pid_type == PIDTYPE_PGID)
     160           0 :                         pid = -pid;
     161             :         }
     162             :         rcu_read_unlock();
     163           0 :         read_unlock_irq(&filp->f_owner.lock);
     164           0 :         return pid;
     165             : }
     166             : 
     167           0 : static int f_setown_ex(struct file *filp, unsigned long arg)
     168             : {
     169           0 :         struct f_owner_ex __user *owner_p = (void __user *)arg;
     170             :         struct f_owner_ex owner;
     171             :         struct pid *pid;
     172             :         int type;
     173             :         int ret;
     174             : 
     175           0 :         ret = copy_from_user(&owner, owner_p, sizeof(owner));
     176           0 :         if (ret)
     177             :                 return -EFAULT;
     178             : 
     179           0 :         switch (owner.type) {
     180             :         case F_OWNER_TID:
     181             :                 type = PIDTYPE_PID;
     182             :                 break;
     183             : 
     184             :         case F_OWNER_PID:
     185           0 :                 type = PIDTYPE_TGID;
     186           0 :                 break;
     187             : 
     188             :         case F_OWNER_PGRP:
     189           0 :                 type = PIDTYPE_PGID;
     190           0 :                 break;
     191             : 
     192             :         default:
     193             :                 return -EINVAL;
     194             :         }
     195             : 
     196             :         rcu_read_lock();
     197           0 :         pid = find_vpid(owner.pid);
     198           0 :         if (owner.pid && !pid)
     199             :                 ret = -ESRCH;
     200             :         else
     201           0 :                  __f_setown(filp, pid, type, 1);
     202             :         rcu_read_unlock();
     203             : 
     204           0 :         return ret;
     205             : }
     206             : 
     207           0 : static int f_getown_ex(struct file *filp, unsigned long arg)
     208             : {
     209           0 :         struct f_owner_ex __user *owner_p = (void __user *)arg;
     210           0 :         struct f_owner_ex owner = {};
     211           0 :         int ret = 0;
     212             : 
     213           0 :         read_lock_irq(&filp->f_owner.lock);
     214             :         rcu_read_lock();
     215           0 :         if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type))
     216           0 :                 owner.pid = pid_vnr(filp->f_owner.pid);
     217             :         rcu_read_unlock();
     218           0 :         switch (filp->f_owner.pid_type) {
     219             :         case PIDTYPE_PID:
     220           0 :                 owner.type = F_OWNER_TID;
     221             :                 break;
     222             : 
     223             :         case PIDTYPE_TGID:
     224           0 :                 owner.type = F_OWNER_PID;
     225             :                 break;
     226             : 
     227             :         case PIDTYPE_PGID:
     228           0 :                 owner.type = F_OWNER_PGRP;
     229             :                 break;
     230             : 
     231             :         default:
     232           0 :                 WARN_ON(1);
     233           0 :                 ret = -EINVAL;
     234             :                 break;
     235             :         }
     236           0 :         read_unlock_irq(&filp->f_owner.lock);
     237             : 
     238           0 :         if (!ret) {
     239           0 :                 ret = copy_to_user(owner_p, &owner, sizeof(owner));
     240           0 :                 if (ret)
     241           0 :                         ret = -EFAULT;
     242             :         }
     243           0 :         return ret;
     244             : }
     245             : 
     246             : #ifdef CONFIG_CHECKPOINT_RESTORE
     247             : static int f_getowner_uids(struct file *filp, unsigned long arg)
     248             : {
     249             :         struct user_namespace *user_ns = current_user_ns();
     250             :         uid_t __user *dst = (void __user *)arg;
     251             :         uid_t src[2];
     252             :         int err;
     253             : 
     254             :         read_lock_irq(&filp->f_owner.lock);
     255             :         src[0] = from_kuid(user_ns, filp->f_owner.uid);
     256             :         src[1] = from_kuid(user_ns, filp->f_owner.euid);
     257             :         read_unlock_irq(&filp->f_owner.lock);
     258             : 
     259             :         err  = put_user(src[0], &dst[0]);
     260             :         err |= put_user(src[1], &dst[1]);
     261             : 
     262             :         return err;
     263             : }
     264             : #else
     265             : static int f_getowner_uids(struct file *filp, unsigned long arg)
     266             : {
     267             :         return -EINVAL;
     268             : }
     269             : #endif
     270             : 
     271             : static bool rw_hint_valid(enum rw_hint hint)
     272             : {
     273           0 :         switch (hint) {
     274             :         case RWH_WRITE_LIFE_NOT_SET:
     275             :         case RWH_WRITE_LIFE_NONE:
     276             :         case RWH_WRITE_LIFE_SHORT:
     277             :         case RWH_WRITE_LIFE_MEDIUM:
     278             :         case RWH_WRITE_LIFE_LONG:
     279             :         case RWH_WRITE_LIFE_EXTREME:
     280             :                 return true;
     281             :         default:
     282             :                 return false;
     283             :         }
     284             : }
     285             : 
     286           0 : static long fcntl_rw_hint(struct file *file, unsigned int cmd,
     287             :                           unsigned long arg)
     288             : {
     289           0 :         struct inode *inode = file_inode(file);
     290           0 :         u64 __user *argp = (u64 __user *)arg;
     291             :         enum rw_hint hint;
     292             :         u64 h;
     293             : 
     294           0 :         switch (cmd) {
     295             :         case F_GET_RW_HINT:
     296           0 :                 h = inode->i_write_hint;
     297           0 :                 if (copy_to_user(argp, &h, sizeof(*argp)))
     298             :                         return -EFAULT;
     299           0 :                 return 0;
     300             :         case F_SET_RW_HINT:
     301           0 :                 if (copy_from_user(&h, argp, sizeof(h)))
     302             :                         return -EFAULT;
     303           0 :                 hint = (enum rw_hint) h;
     304           0 :                 if (!rw_hint_valid(hint))
     305             :                         return -EINVAL;
     306             : 
     307           0 :                 inode_lock(inode);
     308           0 :                 inode->i_write_hint = hint;
     309           0 :                 inode_unlock(inode);
     310           0 :                 return 0;
     311             :         default:
     312             :                 return -EINVAL;
     313             :         }
     314             : }
     315             : 
     316           0 : static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
     317             :                 struct file *filp)
     318             : {
     319           0 :         void __user *argp = (void __user *)arg;
     320             :         struct flock flock;
     321           0 :         long err = -EINVAL;
     322             : 
     323           0 :         switch (cmd) {
     324             :         case F_DUPFD:
     325           0 :                 err = f_dupfd(arg, filp, 0);
     326           0 :                 break;
     327             :         case F_DUPFD_CLOEXEC:
     328           0 :                 err = f_dupfd(arg, filp, O_CLOEXEC);
     329           0 :                 break;
     330             :         case F_GETFD:
     331           0 :                 err = get_close_on_exec(fd) ? FD_CLOEXEC : 0;
     332           0 :                 break;
     333             :         case F_SETFD:
     334           0 :                 err = 0;
     335           0 :                 set_close_on_exec(fd, arg & FD_CLOEXEC);
     336           0 :                 break;
     337             :         case F_GETFL:
     338           0 :                 err = filp->f_flags;
     339           0 :                 break;
     340             :         case F_SETFL:
     341           0 :                 err = setfl(fd, filp, arg);
     342           0 :                 break;
     343             : #if BITS_PER_LONG != 32
     344             :         /* 32-bit arches must use fcntl64() */
     345             :         case F_OFD_GETLK:
     346             : #endif
     347             :         case F_GETLK:
     348           0 :                 if (copy_from_user(&flock, argp, sizeof(flock)))
     349             :                         return -EFAULT;
     350           0 :                 err = fcntl_getlk(filp, cmd, &flock);
     351           0 :                 if (!err && copy_to_user(argp, &flock, sizeof(flock)))
     352             :                         return -EFAULT;
     353             :                 break;
     354             : #if BITS_PER_LONG != 32
     355             :         /* 32-bit arches must use fcntl64() */
     356             :         case F_OFD_SETLK:
     357             :         case F_OFD_SETLKW:
     358             :                 fallthrough;
     359             : #endif
     360             :         case F_SETLK:
     361             :         case F_SETLKW:
     362           0 :                 if (copy_from_user(&flock, argp, sizeof(flock)))
     363             :                         return -EFAULT;
     364           0 :                 err = fcntl_setlk(fd, filp, cmd, &flock);
     365           0 :                 break;
     366             :         case F_GETOWN:
     367             :                 /*
     368             :                  * XXX If f_owner is a process group, the
     369             :                  * negative return value will get converted
     370             :                  * into an error.  Oops.  If we keep the
     371             :                  * current syscall conventions, the only way
     372             :                  * to fix this will be in libc.
     373             :                  */
     374           0 :                 err = f_getown(filp);
     375             :                 force_successful_syscall_return();
     376           0 :                 break;
     377             :         case F_SETOWN:
     378           0 :                 err = f_setown(filp, arg, 1);
     379           0 :                 break;
     380             :         case F_GETOWN_EX:
     381           0 :                 err = f_getown_ex(filp, arg);
     382           0 :                 break;
     383             :         case F_SETOWN_EX:
     384           0 :                 err = f_setown_ex(filp, arg);
     385           0 :                 break;
     386             :         case F_GETOWNER_UIDS:
     387             :                 err = f_getowner_uids(filp, arg);
     388             :                 break;
     389             :         case F_GETSIG:
     390           0 :                 err = filp->f_owner.signum;
     391           0 :                 break;
     392             :         case F_SETSIG:
     393             :                 /* arg == 0 restores default behaviour. */
     394           0 :                 if (!valid_signal(arg)) {
     395             :                         break;
     396             :                 }
     397           0 :                 err = 0;
     398           0 :                 filp->f_owner.signum = arg;
     399           0 :                 break;
     400             :         case F_GETLEASE:
     401           0 :                 err = fcntl_getlease(filp);
     402           0 :                 break;
     403             :         case F_SETLEASE:
     404           0 :                 err = fcntl_setlease(fd, filp, arg);
     405           0 :                 break;
     406             :         case F_NOTIFY:
     407           0 :                 err = fcntl_dirnotify(fd, filp, arg);
     408           0 :                 break;
     409             :         case F_SETPIPE_SZ:
     410             :         case F_GETPIPE_SZ:
     411           0 :                 err = pipe_fcntl(filp, cmd, arg);
     412           0 :                 break;
     413             :         case F_ADD_SEALS:
     414             :         case F_GET_SEALS:
     415             :                 err = memfd_fcntl(filp, cmd, arg);
     416             :                 break;
     417             :         case F_GET_RW_HINT:
     418             :         case F_SET_RW_HINT:
     419           0 :                 err = fcntl_rw_hint(filp, cmd, arg);
     420           0 :                 break;
     421             :         default:
     422             :                 break;
     423             :         }
     424             :         return err;
     425             : }
     426             : 
     427             : static int check_fcntl_cmd(unsigned cmd)
     428             : {
     429           0 :         switch (cmd) {
     430             :         case F_DUPFD:
     431             :         case F_DUPFD_CLOEXEC:
     432             :         case F_GETFD:
     433             :         case F_SETFD:
     434             :         case F_GETFL:
     435             :                 return 1;
     436             :         }
     437             :         return 0;
     438             : }
     439             : 
     440           0 : SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
     441             : {       
     442           0 :         struct fd f = fdget_raw(fd);
     443           0 :         long err = -EBADF;
     444             : 
     445           0 :         if (!f.file)
     446             :                 goto out;
     447             : 
     448           0 :         if (unlikely(f.file->f_mode & FMODE_PATH)) {
     449           0 :                 if (!check_fcntl_cmd(cmd))
     450             :                         goto out1;
     451             :         }
     452             : 
     453           0 :         err = security_file_fcntl(f.file, cmd, arg);
     454             :         if (!err)
     455           0 :                 err = do_fcntl(fd, cmd, arg, f.file);
     456             : 
     457             : out1:
     458           0 :         fdput(f);
     459             : out:
     460           0 :         return err;
     461             : }
     462             : 
     463             : #if BITS_PER_LONG == 32
     464             : SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
     465             :                 unsigned long, arg)
     466             : {       
     467             :         void __user *argp = (void __user *)arg;
     468             :         struct fd f = fdget_raw(fd);
     469             :         struct flock64 flock;
     470             :         long err = -EBADF;
     471             : 
     472             :         if (!f.file)
     473             :                 goto out;
     474             : 
     475             :         if (unlikely(f.file->f_mode & FMODE_PATH)) {
     476             :                 if (!check_fcntl_cmd(cmd))
     477             :                         goto out1;
     478             :         }
     479             : 
     480             :         err = security_file_fcntl(f.file, cmd, arg);
     481             :         if (err)
     482             :                 goto out1;
     483             :         
     484             :         switch (cmd) {
     485             :         case F_GETLK64:
     486             :         case F_OFD_GETLK:
     487             :                 err = -EFAULT;
     488             :                 if (copy_from_user(&flock, argp, sizeof(flock)))
     489             :                         break;
     490             :                 err = fcntl_getlk64(f.file, cmd, &flock);
     491             :                 if (!err && copy_to_user(argp, &flock, sizeof(flock)))
     492             :                         err = -EFAULT;
     493             :                 break;
     494             :         case F_SETLK64:
     495             :         case F_SETLKW64:
     496             :         case F_OFD_SETLK:
     497             :         case F_OFD_SETLKW:
     498             :                 err = -EFAULT;
     499             :                 if (copy_from_user(&flock, argp, sizeof(flock)))
     500             :                         break;
     501             :                 err = fcntl_setlk64(fd, f.file, cmd, &flock);
     502             :                 break;
     503             :         default:
     504             :                 err = do_fcntl(fd, cmd, arg, f.file);
     505             :                 break;
     506             :         }
     507             : out1:
     508             :         fdput(f);
     509             : out:
     510             :         return err;
     511             : }
     512             : #endif
     513             : 
     514             : #ifdef CONFIG_COMPAT
     515             : /* careful - don't use anywhere else */
     516             : #define copy_flock_fields(dst, src)             \
     517             :         (dst)->l_type = (src)->l_type;            \
     518             :         (dst)->l_whence = (src)->l_whence;        \
     519             :         (dst)->l_start = (src)->l_start;  \
     520             :         (dst)->l_len = (src)->l_len;              \
     521             :         (dst)->l_pid = (src)->l_pid;
     522             : 
     523             : static int get_compat_flock(struct flock *kfl, const struct compat_flock __user *ufl)
     524             : {
     525             :         struct compat_flock fl;
     526             : 
     527             :         if (copy_from_user(&fl, ufl, sizeof(struct compat_flock)))
     528             :                 return -EFAULT;
     529             :         copy_flock_fields(kfl, &fl);
     530             :         return 0;
     531             : }
     532             : 
     533             : static int get_compat_flock64(struct flock *kfl, const struct compat_flock64 __user *ufl)
     534             : {
     535             :         struct compat_flock64 fl;
     536             : 
     537             :         if (copy_from_user(&fl, ufl, sizeof(struct compat_flock64)))
     538             :                 return -EFAULT;
     539             :         copy_flock_fields(kfl, &fl);
     540             :         return 0;
     541             : }
     542             : 
     543             : static int put_compat_flock(const struct flock *kfl, struct compat_flock __user *ufl)
     544             : {
     545             :         struct compat_flock fl;
     546             : 
     547             :         memset(&fl, 0, sizeof(struct compat_flock));
     548             :         copy_flock_fields(&fl, kfl);
     549             :         if (copy_to_user(ufl, &fl, sizeof(struct compat_flock)))
     550             :                 return -EFAULT;
     551             :         return 0;
     552             : }
     553             : 
     554             : static int put_compat_flock64(const struct flock *kfl, struct compat_flock64 __user *ufl)
     555             : {
     556             :         struct compat_flock64 fl;
     557             : 
     558             :         BUILD_BUG_ON(sizeof(kfl->l_start) > sizeof(ufl->l_start));
     559             :         BUILD_BUG_ON(sizeof(kfl->l_len) > sizeof(ufl->l_len));
     560             : 
     561             :         memset(&fl, 0, sizeof(struct compat_flock64));
     562             :         copy_flock_fields(&fl, kfl);
     563             :         if (copy_to_user(ufl, &fl, sizeof(struct compat_flock64)))
     564             :                 return -EFAULT;
     565             :         return 0;
     566             : }
     567             : #undef copy_flock_fields
     568             : 
     569             : static unsigned int
     570             : convert_fcntl_cmd(unsigned int cmd)
     571             : {
     572             :         switch (cmd) {
     573             :         case F_GETLK64:
     574             :                 return F_GETLK;
     575             :         case F_SETLK64:
     576             :                 return F_SETLK;
     577             :         case F_SETLKW64:
     578             :                 return F_SETLKW;
     579             :         }
     580             : 
     581             :         return cmd;
     582             : }
     583             : 
     584             : /*
     585             :  * GETLK was successful and we need to return the data, but it needs to fit in
     586             :  * the compat structure.
     587             :  * l_start shouldn't be too big, unless the original start + end is greater than
     588             :  * COMPAT_OFF_T_MAX, in which case the app was asking for trouble, so we return
     589             :  * -EOVERFLOW in that case.  l_len could be too big, in which case we just
     590             :  * truncate it, and only allow the app to see that part of the conflicting lock
     591             :  * that might make sense to it anyway
     592             :  */
     593             : static int fixup_compat_flock(struct flock *flock)
     594             : {
     595             :         if (flock->l_start > COMPAT_OFF_T_MAX)
     596             :                 return -EOVERFLOW;
     597             :         if (flock->l_len > COMPAT_OFF_T_MAX)
     598             :                 flock->l_len = COMPAT_OFF_T_MAX;
     599             :         return 0;
     600             : }
     601             : 
     602             : static long do_compat_fcntl64(unsigned int fd, unsigned int cmd,
     603             :                              compat_ulong_t arg)
     604             : {
     605             :         struct fd f = fdget_raw(fd);
     606             :         struct flock flock;
     607             :         long err = -EBADF;
     608             : 
     609             :         if (!f.file)
     610             :                 return err;
     611             : 
     612             :         if (unlikely(f.file->f_mode & FMODE_PATH)) {
     613             :                 if (!check_fcntl_cmd(cmd))
     614             :                         goto out_put;
     615             :         }
     616             : 
     617             :         err = security_file_fcntl(f.file, cmd, arg);
     618             :         if (err)
     619             :                 goto out_put;
     620             : 
     621             :         switch (cmd) {
     622             :         case F_GETLK:
     623             :                 err = get_compat_flock(&flock, compat_ptr(arg));
     624             :                 if (err)
     625             :                         break;
     626             :                 err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
     627             :                 if (err)
     628             :                         break;
     629             :                 err = fixup_compat_flock(&flock);
     630             :                 if (!err)
     631             :                         err = put_compat_flock(&flock, compat_ptr(arg));
     632             :                 break;
     633             :         case F_GETLK64:
     634             :         case F_OFD_GETLK:
     635             :                 err = get_compat_flock64(&flock, compat_ptr(arg));
     636             :                 if (err)
     637             :                         break;
     638             :                 err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
     639             :                 if (!err)
     640             :                         err = put_compat_flock64(&flock, compat_ptr(arg));
     641             :                 break;
     642             :         case F_SETLK:
     643             :         case F_SETLKW:
     644             :                 err = get_compat_flock(&flock, compat_ptr(arg));
     645             :                 if (err)
     646             :                         break;
     647             :                 err = fcntl_setlk(fd, f.file, convert_fcntl_cmd(cmd), &flock);
     648             :                 break;
     649             :         case F_SETLK64:
     650             :         case F_SETLKW64:
     651             :         case F_OFD_SETLK:
     652             :         case F_OFD_SETLKW:
     653             :                 err = get_compat_flock64(&flock, compat_ptr(arg));
     654             :                 if (err)
     655             :                         break;
     656             :                 err = fcntl_setlk(fd, f.file, convert_fcntl_cmd(cmd), &flock);
     657             :                 break;
     658             :         default:
     659             :                 err = do_fcntl(fd, cmd, arg, f.file);
     660             :                 break;
     661             :         }
     662             : out_put:
     663             :         fdput(f);
     664             :         return err;
     665             : }
     666             : 
     667             : COMPAT_SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
     668             :                        compat_ulong_t, arg)
     669             : {
     670             :         return do_compat_fcntl64(fd, cmd, arg);
     671             : }
     672             : 
     673             : COMPAT_SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd,
     674             :                        compat_ulong_t, arg)
     675             : {
     676             :         switch (cmd) {
     677             :         case F_GETLK64:
     678             :         case F_SETLK64:
     679             :         case F_SETLKW64:
     680             :         case F_OFD_GETLK:
     681             :         case F_OFD_SETLK:
     682             :         case F_OFD_SETLKW:
     683             :                 return -EINVAL;
     684             :         }
     685             :         return do_compat_fcntl64(fd, cmd, arg);
     686             : }
     687             : #endif
     688             : 
     689             : /* Table to convert sigio signal codes into poll band bitmaps */
     690             : 
     691             : static const __poll_t band_table[NSIGPOLL] = {
     692             :         EPOLLIN | EPOLLRDNORM,                  /* POLL_IN */
     693             :         EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND,   /* POLL_OUT */
     694             :         EPOLLIN | EPOLLRDNORM | EPOLLMSG,               /* POLL_MSG */
     695             :         EPOLLERR,                               /* POLL_ERR */
     696             :         EPOLLPRI | EPOLLRDBAND,                 /* POLL_PRI */
     697             :         EPOLLHUP | EPOLLERR                     /* POLL_HUP */
     698             : };
     699             : 
     700             : static inline int sigio_perm(struct task_struct *p,
     701             :                              struct fown_struct *fown, int sig)
     702             : {
     703             :         const struct cred *cred;
     704             :         int ret;
     705             : 
     706             :         rcu_read_lock();
     707           0 :         cred = __task_cred(p);
     708           0 :         ret = ((uid_eq(fown->euid, GLOBAL_ROOT_UID) ||
     709           0 :                 uid_eq(fown->euid, cred->suid) || uid_eq(fown->euid, cred->uid) ||
     710           0 :                 uid_eq(fown->uid,  cred->suid) || uid_eq(fown->uid,  cred->uid)) &&
     711             :                !security_file_send_sigiotask(p, fown, sig));
     712             :         rcu_read_unlock();
     713             :         return ret;
     714             : }
     715             : 
     716           0 : static void send_sigio_to_task(struct task_struct *p,
     717             :                                struct fown_struct *fown,
     718             :                                int fd, int reason, enum pid_type type)
     719             : {
     720             :         /*
     721             :          * F_SETSIG can change ->signum lockless in parallel, make
     722             :          * sure we read it once and use the same value throughout.
     723             :          */
     724           0 :         int signum = READ_ONCE(fown->signum);
     725             : 
     726           0 :         if (!sigio_perm(p, fown, signum))
     727             :                 return;
     728             : 
     729           0 :         switch (signum) {
     730             :                 default: {
     731             :                         kernel_siginfo_t si;
     732             : 
     733             :                         /* Queue a rt signal with the appropriate fd as its
     734             :                            value.  We use SI_SIGIO as the source, not 
     735             :                            SI_KERNEL, since kernel signals always get 
     736             :                            delivered even if we can't queue.  Failure to
     737             :                            queue in this case _should_ be reported; we fall
     738             :                            back to SIGIO in that case. --sct */
     739           0 :                         clear_siginfo(&si);
     740           0 :                         si.si_signo = signum;
     741           0 :                         si.si_errno = 0;
     742           0 :                         si.si_code  = reason;
     743             :                         /*
     744             :                          * Posix definies POLL_IN and friends to be signal
     745             :                          * specific si_codes for SIG_POLL.  Linux extended
     746             :                          * these si_codes to other signals in a way that is
     747             :                          * ambiguous if other signals also have signal
     748             :                          * specific si_codes.  In that case use SI_SIGIO instead
     749             :                          * to remove the ambiguity.
     750             :                          */
     751           0 :                         if ((signum != SIGPOLL) && sig_specific_sicodes(signum))
     752           0 :                                 si.si_code = SI_SIGIO;
     753             : 
     754             :                         /* Make sure we are called with one of the POLL_*
     755             :                            reasons, otherwise we could leak kernel stack into
     756             :                            userspace.  */
     757           0 :                         BUG_ON((reason < POLL_IN) || ((reason - POLL_IN) >= NSIGPOLL));
     758           0 :                         if (reason - POLL_IN >= NSIGPOLL)
     759           0 :                                 si.si_band  = ~0L;
     760             :                         else
     761           0 :                                 si.si_band = mangle_poll(band_table[reason - POLL_IN]);
     762           0 :                         si.si_fd    = fd;
     763           0 :                         if (!do_send_sig_info(signum, &si, p, type))
     764             :                                 break;
     765             :                 }
     766             :                         fallthrough;    /* fall back on the old plain SIGIO signal */
     767             :                 case 0:
     768           0 :                         do_send_sig_info(SIGIO, SEND_SIG_PRIV, p, type);
     769             :         }
     770             : }
     771             : 
     772           0 : void send_sigio(struct fown_struct *fown, int fd, int band)
     773             : {
     774             :         struct task_struct *p;
     775             :         enum pid_type type;
     776             :         unsigned long flags;
     777             :         struct pid *pid;
     778             :         
     779           0 :         read_lock_irqsave(&fown->lock, flags);
     780             : 
     781           0 :         type = fown->pid_type;
     782           0 :         pid = fown->pid;
     783           0 :         if (!pid)
     784             :                 goto out_unlock_fown;
     785             : 
     786           0 :         if (type <= PIDTYPE_TGID) {
     787             :                 rcu_read_lock();
     788           0 :                 p = pid_task(pid, PIDTYPE_PID);
     789           0 :                 if (p)
     790           0 :                         send_sigio_to_task(p, fown, fd, band, type);
     791             :                 rcu_read_unlock();
     792             :         } else {
     793           0 :                 read_lock(&tasklist_lock);
     794           0 :                 do_each_pid_task(pid, type, p) {
     795           0 :                         send_sigio_to_task(p, fown, fd, band, type);
     796           0 :                 } while_each_pid_task(pid, type, p);
     797           0 :                 read_unlock(&tasklist_lock);
     798             :         }
     799             :  out_unlock_fown:
     800           0 :         read_unlock_irqrestore(&fown->lock, flags);
     801           0 : }
     802             : 
     803           0 : static void send_sigurg_to_task(struct task_struct *p,
     804             :                                 struct fown_struct *fown, enum pid_type type)
     805             : {
     806           0 :         if (sigio_perm(p, fown, SIGURG))
     807           0 :                 do_send_sig_info(SIGURG, SEND_SIG_PRIV, p, type);
     808           0 : }
     809             : 
     810           0 : int send_sigurg(struct fown_struct *fown)
     811             : {
     812             :         struct task_struct *p;
     813             :         enum pid_type type;
     814             :         struct pid *pid;
     815             :         unsigned long flags;
     816           0 :         int ret = 0;
     817             :         
     818           0 :         read_lock_irqsave(&fown->lock, flags);
     819             : 
     820           0 :         type = fown->pid_type;
     821           0 :         pid = fown->pid;
     822           0 :         if (!pid)
     823             :                 goto out_unlock_fown;
     824             : 
     825           0 :         ret = 1;
     826             : 
     827           0 :         if (type <= PIDTYPE_TGID) {
     828             :                 rcu_read_lock();
     829           0 :                 p = pid_task(pid, PIDTYPE_PID);
     830           0 :                 if (p)
     831           0 :                         send_sigurg_to_task(p, fown, type);
     832             :                 rcu_read_unlock();
     833             :         } else {
     834           0 :                 read_lock(&tasklist_lock);
     835           0 :                 do_each_pid_task(pid, type, p) {
     836           0 :                         send_sigurg_to_task(p, fown, type);
     837           0 :                 } while_each_pid_task(pid, type, p);
     838           0 :                 read_unlock(&tasklist_lock);
     839             :         }
     840             :  out_unlock_fown:
     841           0 :         read_unlock_irqrestore(&fown->lock, flags);
     842           0 :         return ret;
     843             : }
     844             : 
     845             : static DEFINE_SPINLOCK(fasync_lock);
     846             : static struct kmem_cache *fasync_cache __read_mostly;
     847             : 
     848           0 : static void fasync_free_rcu(struct rcu_head *head)
     849             : {
     850           0 :         kmem_cache_free(fasync_cache,
     851           0 :                         container_of(head, struct fasync_struct, fa_rcu));
     852           0 : }
     853             : 
     854             : /*
     855             :  * Remove a fasync entry. If successfully removed, return
     856             :  * positive and clear the FASYNC flag. If no entry exists,
     857             :  * do nothing and return 0.
     858             :  *
     859             :  * NOTE! It is very important that the FASYNC flag always
     860             :  * match the state "is the filp on a fasync list".
     861             :  *
     862             :  */
     863           0 : int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
     864             : {
     865             :         struct fasync_struct *fa, **fp;
     866           0 :         int result = 0;
     867             : 
     868           0 :         spin_lock(&filp->f_lock);
     869           0 :         spin_lock(&fasync_lock);
     870           0 :         for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
     871           0 :                 if (fa->fa_file != filp)
     872           0 :                         continue;
     873             : 
     874           0 :                 write_lock_irq(&fa->fa_lock);
     875           0 :                 fa->fa_file = NULL;
     876           0 :                 write_unlock_irq(&fa->fa_lock);
     877             : 
     878           0 :                 *fp = fa->fa_next;
     879           0 :                 call_rcu(&fa->fa_rcu, fasync_free_rcu);
     880           0 :                 filp->f_flags &= ~FASYNC;
     881           0 :                 result = 1;
     882           0 :                 break;
     883             :         }
     884           0 :         spin_unlock(&fasync_lock);
     885           0 :         spin_unlock(&filp->f_lock);
     886           0 :         return result;
     887             : }
     888             : 
     889           0 : struct fasync_struct *fasync_alloc(void)
     890             : {
     891           0 :         return kmem_cache_alloc(fasync_cache, GFP_KERNEL);
     892             : }
     893             : 
     894             : /*
     895             :  * NOTE! This can be used only for unused fasync entries:
     896             :  * entries that actually got inserted on the fasync list
     897             :  * need to be released by rcu - see fasync_remove_entry.
     898             :  */
     899           0 : void fasync_free(struct fasync_struct *new)
     900             : {
     901           0 :         kmem_cache_free(fasync_cache, new);
     902           0 : }
     903             : 
     904             : /*
     905             :  * Insert a new entry into the fasync list.  Return the pointer to the
     906             :  * old one if we didn't use the new one.
     907             :  *
     908             :  * NOTE! It is very important that the FASYNC flag always
     909             :  * match the state "is the filp on a fasync list".
     910             :  */
     911           0 : struct fasync_struct *fasync_insert_entry(int fd, struct file *filp, struct fasync_struct **fapp, struct fasync_struct *new)
     912             : {
     913             :         struct fasync_struct *fa, **fp;
     914             : 
     915           0 :         spin_lock(&filp->f_lock);
     916           0 :         spin_lock(&fasync_lock);
     917           0 :         for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
     918           0 :                 if (fa->fa_file != filp)
     919           0 :                         continue;
     920             : 
     921           0 :                 write_lock_irq(&fa->fa_lock);
     922           0 :                 fa->fa_fd = fd;
     923           0 :                 write_unlock_irq(&fa->fa_lock);
     924           0 :                 goto out;
     925             :         }
     926             : 
     927             :         rwlock_init(&new->fa_lock);
     928           0 :         new->magic = FASYNC_MAGIC;
     929           0 :         new->fa_file = filp;
     930           0 :         new->fa_fd = fd;
     931           0 :         new->fa_next = *fapp;
     932           0 :         rcu_assign_pointer(*fapp, new);
     933           0 :         filp->f_flags |= FASYNC;
     934             : 
     935             : out:
     936           0 :         spin_unlock(&fasync_lock);
     937           0 :         spin_unlock(&filp->f_lock);
     938           0 :         return fa;
     939             : }
     940             : 
     941             : /*
     942             :  * Add a fasync entry. Return negative on error, positive if
     943             :  * added, and zero if did nothing but change an existing one.
     944             :  */
     945           0 : static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)
     946             : {
     947             :         struct fasync_struct *new;
     948             : 
     949           0 :         new = fasync_alloc();
     950           0 :         if (!new)
     951             :                 return -ENOMEM;
     952             : 
     953             :         /*
     954             :          * fasync_insert_entry() returns the old (update) entry if
     955             :          * it existed.
     956             :          *
     957             :          * So free the (unused) new entry and return 0 to let the
     958             :          * caller know that we didn't add any new fasync entries.
     959             :          */
     960           0 :         if (fasync_insert_entry(fd, filp, fapp, new)) {
     961           0 :                 fasync_free(new);
     962           0 :                 return 0;
     963             :         }
     964             : 
     965             :         return 1;
     966             : }
     967             : 
     968             : /*
     969             :  * fasync_helper() is used by almost all character device drivers
     970             :  * to set up the fasync queue, and for regular files by the file
     971             :  * lease code. It returns negative on error, 0 if it did no changes
     972             :  * and positive if it added/deleted the entry.
     973             :  */
     974           0 : int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
     975             : {
     976           0 :         if (!on)
     977           0 :                 return fasync_remove_entry(filp, fapp);
     978           0 :         return fasync_add_entry(fd, filp, fapp);
     979             : }
     980             : 
     981             : EXPORT_SYMBOL(fasync_helper);
     982             : 
     983             : /*
     984             :  * rcu_read_lock() is held
     985             :  */
     986           0 : static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
     987             : {
     988           0 :         while (fa) {
     989             :                 struct fown_struct *fown;
     990             :                 unsigned long flags;
     991             : 
     992           0 :                 if (fa->magic != FASYNC_MAGIC) {
     993           0 :                         printk(KERN_ERR "kill_fasync: bad magic number in "
     994             :                                "fasync_struct!\n");
     995           0 :                         return;
     996             :                 }
     997           0 :                 read_lock_irqsave(&fa->fa_lock, flags);
     998           0 :                 if (fa->fa_file) {
     999           0 :                         fown = &fa->fa_file->f_owner;
    1000             :                         /* Don't send SIGURG to processes which have not set a
    1001             :                            queued signum: SIGURG has its own default signalling
    1002             :                            mechanism. */
    1003           0 :                         if (!(sig == SIGURG && fown->signum == 0))
    1004           0 :                                 send_sigio(fown, fa->fa_fd, band);
    1005             :                 }
    1006           0 :                 read_unlock_irqrestore(&fa->fa_lock, flags);
    1007           0 :                 fa = rcu_dereference(fa->fa_next);
    1008             :         }
    1009             : }
    1010             : 
    1011           1 : void kill_fasync(struct fasync_struct **fp, int sig, int band)
    1012             : {
    1013             :         /* First a quick test without locking: usually
    1014             :          * the list is empty.
    1015             :          */
    1016           1 :         if (*fp) {
    1017             :                 rcu_read_lock();
    1018           0 :                 kill_fasync_rcu(rcu_dereference(*fp), sig, band);
    1019             :                 rcu_read_unlock();
    1020             :         }
    1021           1 : }
    1022             : EXPORT_SYMBOL(kill_fasync);
    1023             : 
    1024           1 : static int __init fcntl_init(void)
    1025             : {
    1026             :         /*
    1027             :          * Please add new bits here to ensure allocation uniqueness.
    1028             :          * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
    1029             :          * is defined as O_NONBLOCK on some platforms and not on others.
    1030             :          */
    1031             :         BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ !=
    1032             :                 HWEIGHT32(
    1033             :                         (VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) |
    1034             :                         __FMODE_EXEC | __FMODE_NONOTIFY));
    1035             : 
    1036           1 :         fasync_cache = kmem_cache_create("fasync_cache",
    1037             :                                          sizeof(struct fasync_struct), 0,
    1038             :                                          SLAB_PANIC | SLAB_ACCOUNT, NULL);
    1039           1 :         return 0;
    1040             : }
    1041             : 
    1042             : module_init(fcntl_init)

Generated by: LCOV version 1.14