Line data Source code
1 : // SPDX-License-Identifier: GPL-2.0
2 : /*
3 : * linux/fs/fcntl.c
4 : *
5 : * Copyright (C) 1991, 1992 Linus Torvalds
6 : */
7 :
8 : #include <linux/syscalls.h>
9 : #include <linux/init.h>
10 : #include <linux/mm.h>
11 : #include <linux/sched/task.h>
12 : #include <linux/fs.h>
13 : #include <linux/file.h>
14 : #include <linux/fdtable.h>
15 : #include <linux/capability.h>
16 : #include <linux/dnotify.h>
17 : #include <linux/slab.h>
18 : #include <linux/module.h>
19 : #include <linux/pipe_fs_i.h>
20 : #include <linux/security.h>
21 : #include <linux/ptrace.h>
22 : #include <linux/signal.h>
23 : #include <linux/rcupdate.h>
24 : #include <linux/pid_namespace.h>
25 : #include <linux/user_namespace.h>
26 : #include <linux/memfd.h>
27 : #include <linux/compat.h>
28 : #include <linux/mount.h>
29 :
30 : #include <linux/poll.h>
31 : #include <asm/siginfo.h>
32 : #include <linux/uaccess.h>
33 :
34 : #define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME)
35 :
36 81 : static int setfl(int fd, struct file * filp, unsigned long arg)
37 : {
38 81 : struct inode * inode = file_inode(filp);
39 81 : int error = 0;
40 :
41 : /*
42 : * O_APPEND cannot be cleared if the file is marked as append-only
43 : * and the file is open for write.
44 : */
45 81 : if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode))
46 : return -EPERM;
47 :
48 : /* O_NOATIME can only be set by the owner or superuser */
49 81 : if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME))
50 0 : if (!inode_owner_or_capable(file_mnt_user_ns(filp), inode))
51 : return -EPERM;
52 :
53 : /* required for strict SunOS emulation */
54 81 : if (O_NONBLOCK != O_NDELAY)
55 : if (arg & O_NDELAY)
56 : arg |= O_NONBLOCK;
57 :
58 : /* Pipe packetized mode is controlled by O_DIRECT flag */
59 81 : if (!S_ISFIFO(inode->i_mode) && (arg & O_DIRECT)) {
60 0 : if (!filp->f_mapping || !filp->f_mapping->a_ops ||
61 0 : !filp->f_mapping->a_ops->direct_IO)
62 : return -EINVAL;
63 : }
64 :
65 81 : if (filp->f_op->check_flags)
66 0 : error = filp->f_op->check_flags(arg);
67 0 : if (error)
68 : return error;
69 :
70 : /*
71 : * ->fasync() is responsible for setting the FASYNC bit.
72 : */
73 81 : if (((arg ^ filp->f_flags) & FASYNC) && filp->f_op->fasync) {
74 0 : error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);
75 0 : if (error < 0)
76 0 : goto out;
77 0 : if (error > 0)
78 0 : error = 0;
79 : }
80 81 : spin_lock(&filp->f_lock);
81 81 : filp->f_flags = (arg & SETFL_MASK) | (filp->f_flags & ~SETFL_MASK);
82 81 : spin_unlock(&filp->f_lock);
83 :
84 : out:
85 : return error;
86 : }
87 :
88 0 : static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
89 : int force)
90 : {
91 0 : write_lock_irq(&filp->f_owner.lock);
92 0 : if (force || !filp->f_owner.pid) {
93 0 : put_pid(filp->f_owner.pid);
94 0 : filp->f_owner.pid = get_pid(pid);
95 0 : filp->f_owner.pid_type = type;
96 :
97 0 : if (pid) {
98 0 : const struct cred *cred = current_cred();
99 0 : filp->f_owner.uid = cred->uid;
100 0 : filp->f_owner.euid = cred->euid;
101 : }
102 : }
103 0 : write_unlock_irq(&filp->f_owner.lock);
104 0 : }
105 :
106 0 : void __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
107 : int force)
108 : {
109 0 : security_file_set_fowner(filp);
110 0 : f_modown(filp, pid, type, force);
111 0 : }
112 : EXPORT_SYMBOL(__f_setown);
113 :
114 0 : int f_setown(struct file *filp, unsigned long arg, int force)
115 : {
116 0 : enum pid_type type;
117 0 : struct pid *pid = NULL;
118 0 : int who = arg, ret = 0;
119 :
120 0 : type = PIDTYPE_TGID;
121 0 : if (who < 0) {
122 : /* avoid overflow below */
123 0 : if (who == INT_MIN)
124 : return -EINVAL;
125 :
126 0 : type = PIDTYPE_PGID;
127 0 : who = -who;
128 : }
129 :
130 0 : rcu_read_lock();
131 0 : if (who) {
132 0 : pid = find_vpid(who);
133 0 : if (!pid)
134 : ret = -ESRCH;
135 : }
136 :
137 : if (!ret)
138 0 : __f_setown(filp, pid, type, force);
139 0 : rcu_read_unlock();
140 :
141 0 : return ret;
142 : }
143 : EXPORT_SYMBOL(f_setown);
144 :
145 0 : void f_delown(struct file *filp)
146 : {
147 0 : f_modown(filp, NULL, PIDTYPE_TGID, 1);
148 0 : }
149 :
150 0 : pid_t f_getown(struct file *filp)
151 : {
152 0 : pid_t pid = 0;
153 0 : read_lock(&filp->f_owner.lock);
154 0 : rcu_read_lock();
155 0 : if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type)) {
156 0 : pid = pid_vnr(filp->f_owner.pid);
157 0 : if (filp->f_owner.pid_type == PIDTYPE_PGID)
158 0 : pid = -pid;
159 : }
160 0 : rcu_read_unlock();
161 0 : read_unlock(&filp->f_owner.lock);
162 0 : return pid;
163 : }
164 :
165 0 : static int f_setown_ex(struct file *filp, unsigned long arg)
166 : {
167 0 : struct f_owner_ex __user *owner_p = (void __user *)arg;
168 0 : struct f_owner_ex owner;
169 0 : struct pid *pid;
170 0 : int type;
171 0 : int ret;
172 :
173 0 : ret = copy_from_user(&owner, owner_p, sizeof(owner));
174 0 : if (ret)
175 : return -EFAULT;
176 :
177 0 : switch (owner.type) {
178 : case F_OWNER_TID:
179 : type = PIDTYPE_PID;
180 : break;
181 :
182 : case F_OWNER_PID:
183 : type = PIDTYPE_TGID;
184 : break;
185 :
186 : case F_OWNER_PGRP:
187 : type = PIDTYPE_PGID;
188 : break;
189 :
190 : default:
191 : return -EINVAL;
192 : }
193 :
194 0 : rcu_read_lock();
195 0 : pid = find_vpid(owner.pid);
196 0 : if (owner.pid && !pid)
197 : ret = -ESRCH;
198 : else
199 0 : __f_setown(filp, pid, type, 1);
200 0 : rcu_read_unlock();
201 :
202 0 : return ret;
203 : }
204 :
205 0 : static int f_getown_ex(struct file *filp, unsigned long arg)
206 : {
207 0 : struct f_owner_ex __user *owner_p = (void __user *)arg;
208 0 : struct f_owner_ex owner = {};
209 0 : int ret = 0;
210 :
211 0 : read_lock(&filp->f_owner.lock);
212 0 : rcu_read_lock();
213 0 : if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type))
214 0 : owner.pid = pid_vnr(filp->f_owner.pid);
215 0 : rcu_read_unlock();
216 0 : switch (filp->f_owner.pid_type) {
217 0 : case PIDTYPE_PID:
218 0 : owner.type = F_OWNER_TID;
219 0 : break;
220 :
221 0 : case PIDTYPE_TGID:
222 0 : owner.type = F_OWNER_PID;
223 0 : break;
224 :
225 0 : case PIDTYPE_PGID:
226 0 : owner.type = F_OWNER_PGRP;
227 0 : break;
228 :
229 : default:
230 0 : WARN_ON(1);
231 0 : ret = -EINVAL;
232 0 : break;
233 : }
234 0 : read_unlock(&filp->f_owner.lock);
235 :
236 0 : if (!ret) {
237 0 : ret = copy_to_user(owner_p, &owner, sizeof(owner));
238 0 : if (ret)
239 0 : ret = -EFAULT;
240 : }
241 0 : return ret;
242 : }
243 :
244 : #ifdef CONFIG_CHECKPOINT_RESTORE
245 : static int f_getowner_uids(struct file *filp, unsigned long arg)
246 : {
247 : struct user_namespace *user_ns = current_user_ns();
248 : uid_t __user *dst = (void __user *)arg;
249 : uid_t src[2];
250 : int err;
251 :
252 : read_lock(&filp->f_owner.lock);
253 : src[0] = from_kuid(user_ns, filp->f_owner.uid);
254 : src[1] = from_kuid(user_ns, filp->f_owner.euid);
255 : read_unlock(&filp->f_owner.lock);
256 :
257 : err = put_user(src[0], &dst[0]);
258 : err |= put_user(src[1], &dst[1]);
259 :
260 : return err;
261 : }
262 : #else
263 : static int f_getowner_uids(struct file *filp, unsigned long arg)
264 : {
265 : return -EINVAL;
266 : }
267 : #endif
268 :
269 0 : static bool rw_hint_valid(enum rw_hint hint)
270 : {
271 0 : switch (hint) {
272 : case RWH_WRITE_LIFE_NOT_SET:
273 : case RWH_WRITE_LIFE_NONE:
274 : case RWH_WRITE_LIFE_SHORT:
275 : case RWH_WRITE_LIFE_MEDIUM:
276 : case RWH_WRITE_LIFE_LONG:
277 : case RWH_WRITE_LIFE_EXTREME:
278 : return true;
279 : default:
280 : return false;
281 : }
282 : }
283 :
284 0 : static long fcntl_rw_hint(struct file *file, unsigned int cmd,
285 : unsigned long arg)
286 : {
287 0 : struct inode *inode = file_inode(file);
288 0 : u64 __user *argp = (u64 __user *)arg;
289 0 : enum rw_hint hint;
290 0 : u64 h;
291 :
292 0 : switch (cmd) {
293 : case F_GET_FILE_RW_HINT:
294 0 : h = file_write_hint(file);
295 0 : if (copy_to_user(argp, &h, sizeof(*argp)))
296 0 : return -EFAULT;
297 : return 0;
298 : case F_SET_FILE_RW_HINT:
299 0 : if (copy_from_user(&h, argp, sizeof(h)))
300 : return -EFAULT;
301 0 : hint = (enum rw_hint) h;
302 0 : if (!rw_hint_valid(hint))
303 : return -EINVAL;
304 :
305 0 : spin_lock(&file->f_lock);
306 0 : file->f_write_hint = hint;
307 0 : spin_unlock(&file->f_lock);
308 0 : return 0;
309 0 : case F_GET_RW_HINT:
310 0 : h = inode->i_write_hint;
311 0 : if (copy_to_user(argp, &h, sizeof(*argp)))
312 0 : return -EFAULT;
313 : return 0;
314 : case F_SET_RW_HINT:
315 0 : if (copy_from_user(&h, argp, sizeof(h)))
316 : return -EFAULT;
317 0 : hint = (enum rw_hint) h;
318 0 : if (!rw_hint_valid(hint))
319 : return -EINVAL;
320 :
321 0 : inode_lock(inode);
322 0 : inode->i_write_hint = hint;
323 0 : inode_unlock(inode);
324 0 : return 0;
325 : default:
326 : return -EINVAL;
327 : }
328 : }
329 :
330 3955 : static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
331 : struct file *filp)
332 : {
333 3955 : void __user *argp = (void __user *)arg;
334 3955 : struct flock flock;
335 3955 : long err = -EINVAL;
336 :
337 3955 : switch (cmd) {
338 634 : case F_DUPFD:
339 634 : err = f_dupfd(arg, filp, 0);
340 634 : break;
341 651 : case F_DUPFD_CLOEXEC:
342 651 : err = f_dupfd(arg, filp, O_CLOEXEC);
343 651 : break;
344 91 : case F_GETFD:
345 91 : err = get_close_on_exec(fd) ? FD_CLOEXEC : 0;
346 91 : break;
347 1199 : case F_SETFD:
348 1199 : err = 0;
349 1199 : set_close_on_exec(fd, arg & FD_CLOEXEC);
350 1199 : break;
351 1209 : case F_GETFL:
352 1209 : err = filp->f_flags;
353 1209 : break;
354 81 : case F_SETFL:
355 81 : err = setfl(fd, filp, arg);
356 81 : break;
357 : #if BITS_PER_LONG != 32
358 : /* 32-bit arches must use fcntl64() */
359 : case F_OFD_GETLK:
360 : #endif
361 : case F_GETLK:
362 0 : if (copy_from_user(&flock, argp, sizeof(flock)))
363 : return -EFAULT;
364 0 : err = fcntl_getlk(filp, cmd, &flock);
365 0 : if (!err && copy_to_user(argp, &flock, sizeof(flock)))
366 0 : return -EFAULT;
367 : break;
368 : #if BITS_PER_LONG != 32
369 : /* 32-bit arches must use fcntl64() */
370 : case F_OFD_SETLK:
371 : case F_OFD_SETLKW:
372 : #endif
373 90 : fallthrough;
374 : case F_SETLK:
375 : case F_SETLKW:
376 90 : if (copy_from_user(&flock, argp, sizeof(flock)))
377 : return -EFAULT;
378 90 : err = fcntl_setlk(fd, filp, cmd, &flock);
379 90 : break;
380 0 : case F_GETOWN:
381 : /*
382 : * XXX If f_owner is a process group, the
383 : * negative return value will get converted
384 : * into an error. Oops. If we keep the
385 : * current syscall conventions, the only way
386 : * to fix this will be in libc.
387 : */
388 0 : err = f_getown(filp);
389 0 : force_successful_syscall_return();
390 0 : break;
391 0 : case F_SETOWN:
392 0 : err = f_setown(filp, arg, 1);
393 0 : break;
394 0 : case F_GETOWN_EX:
395 0 : err = f_getown_ex(filp, arg);
396 0 : break;
397 0 : case F_SETOWN_EX:
398 0 : err = f_setown_ex(filp, arg);
399 0 : break;
400 : case F_GETOWNER_UIDS:
401 3955 : err = f_getowner_uids(filp, arg);
402 : break;
403 0 : case F_GETSIG:
404 0 : err = filp->f_owner.signum;
405 0 : break;
406 : case F_SETSIG:
407 : /* arg == 0 restores default behaviour. */
408 0 : if (!valid_signal(arg)) {
409 : break;
410 : }
411 0 : err = 0;
412 0 : filp->f_owner.signum = arg;
413 0 : break;
414 0 : case F_GETLEASE:
415 0 : err = fcntl_getlease(filp);
416 0 : break;
417 0 : case F_SETLEASE:
418 0 : err = fcntl_setlease(fd, filp, arg);
419 0 : break;
420 : case F_NOTIFY:
421 3955 : err = fcntl_dirnotify(fd, filp, arg);
422 : break;
423 0 : case F_SETPIPE_SZ:
424 : case F_GETPIPE_SZ:
425 0 : err = pipe_fcntl(filp, cmd, arg);
426 0 : break;
427 0 : case F_ADD_SEALS:
428 : case F_GET_SEALS:
429 0 : err = memfd_fcntl(filp, cmd, arg);
430 0 : break;
431 0 : case F_GET_RW_HINT:
432 : case F_SET_RW_HINT:
433 : case F_GET_FILE_RW_HINT:
434 : case F_SET_FILE_RW_HINT:
435 0 : err = fcntl_rw_hint(filp, cmd, arg);
436 0 : break;
437 : default:
438 : break;
439 : }
440 0 : return err;
441 : }
442 :
443 3 : static int check_fcntl_cmd(unsigned cmd)
444 : {
445 3 : switch (cmd) {
446 : case F_DUPFD:
447 : case F_DUPFD_CLOEXEC:
448 : case F_GETFD:
449 : case F_SETFD:
450 : case F_GETFL:
451 : return 1;
452 : }
453 0 : return 0;
454 : }
455 :
456 7990 : SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
457 : {
458 3995 : struct fd f = fdget_raw(fd);
459 3995 : long err = -EBADF;
460 :
461 3995 : if (!f.file)
462 40 : goto out;
463 :
464 3955 : if (unlikely(f.file->f_mode & FMODE_PATH)) {
465 3 : if (!check_fcntl_cmd(cmd))
466 0 : goto out1;
467 : }
468 :
469 3955 : err = security_file_fcntl(f.file, cmd, arg);
470 3955 : if (!err)
471 3955 : err = do_fcntl(fd, cmd, arg, f.file);
472 :
473 0 : out1:
474 3963 : fdput(f);
475 3995 : out:
476 3995 : return err;
477 : }
478 :
479 : #if BITS_PER_LONG == 32
480 : SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
481 : unsigned long, arg)
482 : {
483 : void __user *argp = (void __user *)arg;
484 : struct fd f = fdget_raw(fd);
485 : struct flock64 flock;
486 : long err = -EBADF;
487 :
488 : if (!f.file)
489 : goto out;
490 :
491 : if (unlikely(f.file->f_mode & FMODE_PATH)) {
492 : if (!check_fcntl_cmd(cmd))
493 : goto out1;
494 : }
495 :
496 : err = security_file_fcntl(f.file, cmd, arg);
497 : if (err)
498 : goto out1;
499 :
500 : switch (cmd) {
501 : case F_GETLK64:
502 : case F_OFD_GETLK:
503 : err = -EFAULT;
504 : if (copy_from_user(&flock, argp, sizeof(flock)))
505 : break;
506 : err = fcntl_getlk64(f.file, cmd, &flock);
507 : if (!err && copy_to_user(argp, &flock, sizeof(flock)))
508 : err = -EFAULT;
509 : break;
510 : case F_SETLK64:
511 : case F_SETLKW64:
512 : case F_OFD_SETLK:
513 : case F_OFD_SETLKW:
514 : err = -EFAULT;
515 : if (copy_from_user(&flock, argp, sizeof(flock)))
516 : break;
517 : err = fcntl_setlk64(fd, f.file, cmd, &flock);
518 : break;
519 : default:
520 : err = do_fcntl(fd, cmd, arg, f.file);
521 : break;
522 : }
523 : out1:
524 : fdput(f);
525 : out:
526 : return err;
527 : }
528 : #endif
529 :
530 : #ifdef CONFIG_COMPAT
531 : /* careful - don't use anywhere else */
532 : #define copy_flock_fields(dst, src) \
533 : (dst)->l_type = (src)->l_type; \
534 : (dst)->l_whence = (src)->l_whence; \
535 : (dst)->l_start = (src)->l_start; \
536 : (dst)->l_len = (src)->l_len; \
537 : (dst)->l_pid = (src)->l_pid;
538 :
539 0 : static int get_compat_flock(struct flock *kfl, const struct compat_flock __user *ufl)
540 : {
541 0 : struct compat_flock fl;
542 :
543 0 : if (copy_from_user(&fl, ufl, sizeof(struct compat_flock)))
544 : return -EFAULT;
545 0 : copy_flock_fields(kfl, &fl);
546 0 : return 0;
547 : }
548 :
549 0 : static int get_compat_flock64(struct flock *kfl, const struct compat_flock64 __user *ufl)
550 : {
551 0 : struct compat_flock64 fl;
552 :
553 0 : if (copy_from_user(&fl, ufl, sizeof(struct compat_flock64)))
554 : return -EFAULT;
555 0 : copy_flock_fields(kfl, &fl);
556 0 : return 0;
557 : }
558 :
559 0 : static int put_compat_flock(const struct flock *kfl, struct compat_flock __user *ufl)
560 : {
561 0 : struct compat_flock fl;
562 :
563 0 : memset(&fl, 0, sizeof(struct compat_flock));
564 0 : copy_flock_fields(&fl, kfl);
565 0 : if (copy_to_user(ufl, &fl, sizeof(struct compat_flock)))
566 0 : return -EFAULT;
567 : return 0;
568 : }
569 :
570 0 : static int put_compat_flock64(const struct flock *kfl, struct compat_flock64 __user *ufl)
571 : {
572 0 : struct compat_flock64 fl;
573 :
574 0 : BUILD_BUG_ON(sizeof(kfl->l_start) > sizeof(ufl->l_start));
575 0 : BUILD_BUG_ON(sizeof(kfl->l_len) > sizeof(ufl->l_len));
576 :
577 0 : memset(&fl, 0, sizeof(struct compat_flock64));
578 0 : copy_flock_fields(&fl, kfl);
579 0 : if (copy_to_user(ufl, &fl, sizeof(struct compat_flock64)))
580 0 : return -EFAULT;
581 : return 0;
582 : }
583 : #undef copy_flock_fields
584 :
585 : static unsigned int
586 0 : convert_fcntl_cmd(unsigned int cmd)
587 : {
588 0 : switch (cmd) {
589 : case F_GETLK64:
590 : return F_GETLK;
591 : case F_SETLK64:
592 : return F_SETLK;
593 : case F_SETLKW64:
594 : return F_SETLKW;
595 : }
596 :
597 : return cmd;
598 : }
599 :
600 : /*
601 : * GETLK was successful and we need to return the data, but it needs to fit in
602 : * the compat structure.
603 : * l_start shouldn't be too big, unless the original start + end is greater than
604 : * COMPAT_OFF_T_MAX, in which case the app was asking for trouble, so we return
605 : * -EOVERFLOW in that case. l_len could be too big, in which case we just
606 : * truncate it, and only allow the app to see that part of the conflicting lock
607 : * that might make sense to it anyway
608 : */
609 0 : static int fixup_compat_flock(struct flock *flock)
610 : {
611 0 : if (flock->l_start > COMPAT_OFF_T_MAX)
612 : return -EOVERFLOW;
613 0 : if (flock->l_len > COMPAT_OFF_T_MAX)
614 0 : flock->l_len = COMPAT_OFF_T_MAX;
615 : return 0;
616 : }
617 :
618 0 : static long do_compat_fcntl64(unsigned int fd, unsigned int cmd,
619 : compat_ulong_t arg)
620 : {
621 0 : struct fd f = fdget_raw(fd);
622 0 : struct flock flock;
623 0 : long err = -EBADF;
624 :
625 0 : if (!f.file)
626 : return err;
627 :
628 0 : if (unlikely(f.file->f_mode & FMODE_PATH)) {
629 0 : if (!check_fcntl_cmd(cmd))
630 0 : goto out_put;
631 : }
632 :
633 0 : err = security_file_fcntl(f.file, cmd, arg);
634 0 : if (err)
635 0 : goto out_put;
636 :
637 0 : switch (cmd) {
638 : case F_GETLK:
639 0 : err = get_compat_flock(&flock, compat_ptr(arg));
640 0 : if (err)
641 : break;
642 0 : err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
643 0 : if (err)
644 : break;
645 0 : err = fixup_compat_flock(&flock);
646 0 : if (!err)
647 0 : err = put_compat_flock(&flock, compat_ptr(arg));
648 : break;
649 : case F_GETLK64:
650 : case F_OFD_GETLK:
651 0 : err = get_compat_flock64(&flock, compat_ptr(arg));
652 0 : if (err)
653 : break;
654 0 : err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
655 0 : if (!err)
656 0 : err = put_compat_flock64(&flock, compat_ptr(arg));
657 : break;
658 : case F_SETLK:
659 : case F_SETLKW:
660 0 : err = get_compat_flock(&flock, compat_ptr(arg));
661 0 : if (err)
662 : break;
663 0 : err = fcntl_setlk(fd, f.file, convert_fcntl_cmd(cmd), &flock);
664 0 : break;
665 : case F_SETLK64:
666 : case F_SETLKW64:
667 : case F_OFD_SETLK:
668 : case F_OFD_SETLKW:
669 0 : err = get_compat_flock64(&flock, compat_ptr(arg));
670 0 : if (err)
671 : break;
672 0 : err = fcntl_setlk(fd, f.file, convert_fcntl_cmd(cmd), &flock);
673 0 : break;
674 0 : default:
675 0 : err = do_fcntl(fd, cmd, arg, f.file);
676 0 : break;
677 : }
678 0 : out_put:
679 0 : fdput(f);
680 0 : return err;
681 : }
682 :
683 0 : COMPAT_SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
684 : compat_ulong_t, arg)
685 : {
686 0 : return do_compat_fcntl64(fd, cmd, arg);
687 : }
688 :
689 0 : COMPAT_SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd,
690 : compat_ulong_t, arg)
691 : {
692 0 : switch (cmd) {
693 : case F_GETLK64:
694 : case F_SETLK64:
695 : case F_SETLKW64:
696 : case F_OFD_GETLK:
697 : case F_OFD_SETLK:
698 : case F_OFD_SETLKW:
699 : return -EINVAL;
700 : }
701 0 : return do_compat_fcntl64(fd, cmd, arg);
702 : }
703 : #endif
704 :
705 : /* Table to convert sigio signal codes into poll band bitmaps */
706 :
707 : static const __poll_t band_table[NSIGPOLL] = {
708 : EPOLLIN | EPOLLRDNORM, /* POLL_IN */
709 : EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND, /* POLL_OUT */
710 : EPOLLIN | EPOLLRDNORM | EPOLLMSG, /* POLL_MSG */
711 : EPOLLERR, /* POLL_ERR */
712 : EPOLLPRI | EPOLLRDBAND, /* POLL_PRI */
713 : EPOLLHUP | EPOLLERR /* POLL_HUP */
714 : };
715 :
716 0 : static inline int sigio_perm(struct task_struct *p,
717 : struct fown_struct *fown, int sig)
718 : {
719 0 : const struct cred *cred;
720 0 : int ret;
721 :
722 0 : rcu_read_lock();
723 0 : cred = __task_cred(p);
724 0 : ret = ((uid_eq(fown->euid, GLOBAL_ROOT_UID) ||
725 0 : uid_eq(fown->euid, cred->suid) || uid_eq(fown->euid, cred->uid) ||
726 0 : uid_eq(fown->uid, cred->suid) || uid_eq(fown->uid, cred->uid)) &&
727 0 : !security_file_send_sigiotask(p, fown, sig));
728 0 : rcu_read_unlock();
729 0 : return ret;
730 : }
731 :
732 0 : static void send_sigio_to_task(struct task_struct *p,
733 : struct fown_struct *fown,
734 : int fd, int reason, enum pid_type type)
735 : {
736 : /*
737 : * F_SETSIG can change ->signum lockless in parallel, make
738 : * sure we read it once and use the same value throughout.
739 : */
740 0 : int signum = READ_ONCE(fown->signum);
741 :
742 0 : if (!sigio_perm(p, fown, signum))
743 : return;
744 :
745 0 : switch (signum) {
746 : default: {
747 0 : kernel_siginfo_t si;
748 :
749 : /* Queue a rt signal with the appropriate fd as its
750 : value. We use SI_SIGIO as the source, not
751 : SI_KERNEL, since kernel signals always get
752 : delivered even if we can't queue. Failure to
753 : queue in this case _should_ be reported; we fall
754 : back to SIGIO in that case. --sct */
755 0 : clear_siginfo(&si);
756 0 : si.si_signo = signum;
757 0 : si.si_errno = 0;
758 0 : si.si_code = reason;
759 : /*
760 : * Posix definies POLL_IN and friends to be signal
761 : * specific si_codes for SIG_POLL. Linux extended
762 : * these si_codes to other signals in a way that is
763 : * ambiguous if other signals also have signal
764 : * specific si_codes. In that case use SI_SIGIO instead
765 : * to remove the ambiguity.
766 : */
767 0 : if ((signum != SIGPOLL) && sig_specific_sicodes(signum))
768 0 : si.si_code = SI_SIGIO;
769 :
770 : /* Make sure we are called with one of the POLL_*
771 : reasons, otherwise we could leak kernel stack into
772 : userspace. */
773 0 : BUG_ON((reason < POLL_IN) || ((reason - POLL_IN) >= NSIGPOLL));
774 0 : if (reason - POLL_IN >= NSIGPOLL)
775 0 : si.si_band = ~0L;
776 : else
777 0 : si.si_band = mangle_poll(band_table[reason - POLL_IN]);
778 0 : si.si_fd = fd;
779 0 : if (!do_send_sig_info(signum, &si, p, type))
780 : break;
781 : }
782 0 : fallthrough; /* fall back on the old plain SIGIO signal */
783 : case 0:
784 0 : do_send_sig_info(SIGIO, SEND_SIG_PRIV, p, type);
785 : }
786 : }
787 :
788 0 : void send_sigio(struct fown_struct *fown, int fd, int band)
789 : {
790 0 : struct task_struct *p;
791 0 : enum pid_type type;
792 0 : unsigned long flags;
793 0 : struct pid *pid;
794 :
795 0 : read_lock_irqsave(&fown->lock, flags);
796 :
797 0 : type = fown->pid_type;
798 0 : pid = fown->pid;
799 0 : if (!pid)
800 0 : goto out_unlock_fown;
801 :
802 0 : if (type <= PIDTYPE_TGID) {
803 0 : rcu_read_lock();
804 0 : p = pid_task(pid, PIDTYPE_PID);
805 0 : if (p)
806 0 : send_sigio_to_task(p, fown, fd, band, type);
807 0 : rcu_read_unlock();
808 : } else {
809 0 : read_lock(&tasklist_lock);
810 0 : do_each_pid_task(pid, type, p) {
811 0 : send_sigio_to_task(p, fown, fd, band, type);
812 0 : } while_each_pid_task(pid, type, p);
813 0 : read_unlock(&tasklist_lock);
814 : }
815 0 : out_unlock_fown:
816 0 : read_unlock_irqrestore(&fown->lock, flags);
817 0 : }
818 :
819 0 : static void send_sigurg_to_task(struct task_struct *p,
820 : struct fown_struct *fown, enum pid_type type)
821 : {
822 0 : if (sigio_perm(p, fown, SIGURG))
823 0 : do_send_sig_info(SIGURG, SEND_SIG_PRIV, p, type);
824 0 : }
825 :
826 0 : int send_sigurg(struct fown_struct *fown)
827 : {
828 0 : struct task_struct *p;
829 0 : enum pid_type type;
830 0 : struct pid *pid;
831 0 : unsigned long flags;
832 0 : int ret = 0;
833 :
834 0 : read_lock_irqsave(&fown->lock, flags);
835 :
836 0 : type = fown->pid_type;
837 0 : pid = fown->pid;
838 0 : if (!pid)
839 0 : goto out_unlock_fown;
840 :
841 0 : ret = 1;
842 :
843 0 : if (type <= PIDTYPE_TGID) {
844 0 : rcu_read_lock();
845 0 : p = pid_task(pid, PIDTYPE_PID);
846 0 : if (p)
847 0 : send_sigurg_to_task(p, fown, type);
848 0 : rcu_read_unlock();
849 : } else {
850 0 : read_lock(&tasklist_lock);
851 0 : do_each_pid_task(pid, type, p) {
852 0 : send_sigurg_to_task(p, fown, type);
853 0 : } while_each_pid_task(pid, type, p);
854 0 : read_unlock(&tasklist_lock);
855 : }
856 0 : out_unlock_fown:
857 0 : read_unlock_irqrestore(&fown->lock, flags);
858 0 : return ret;
859 : }
860 :
861 : static DEFINE_SPINLOCK(fasync_lock);
862 : static struct kmem_cache *fasync_cache __read_mostly;
863 :
864 0 : static void fasync_free_rcu(struct rcu_head *head)
865 : {
866 0 : kmem_cache_free(fasync_cache,
867 0 : container_of(head, struct fasync_struct, fa_rcu));
868 0 : }
869 :
870 : /*
871 : * Remove a fasync entry. If successfully removed, return
872 : * positive and clear the FASYNC flag. If no entry exists,
873 : * do nothing and return 0.
874 : *
875 : * NOTE! It is very important that the FASYNC flag always
876 : * match the state "is the filp on a fasync list".
877 : *
878 : */
879 175 : int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
880 : {
881 175 : struct fasync_struct *fa, **fp;
882 175 : int result = 0;
883 :
884 175 : spin_lock(&filp->f_lock);
885 175 : spin_lock(&fasync_lock);
886 350 : for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
887 0 : if (fa->fa_file != filp)
888 0 : continue;
889 :
890 0 : write_lock_irq(&fa->fa_lock);
891 0 : fa->fa_file = NULL;
892 0 : write_unlock_irq(&fa->fa_lock);
893 :
894 0 : *fp = fa->fa_next;
895 0 : call_rcu(&fa->fa_rcu, fasync_free_rcu);
896 0 : filp->f_flags &= ~FASYNC;
897 0 : result = 1;
898 0 : break;
899 : }
900 175 : spin_unlock(&fasync_lock);
901 175 : spin_unlock(&filp->f_lock);
902 175 : return result;
903 : }
904 :
905 0 : struct fasync_struct *fasync_alloc(void)
906 : {
907 0 : return kmem_cache_alloc(fasync_cache, GFP_KERNEL);
908 : }
909 :
910 : /*
911 : * NOTE! This can be used only for unused fasync entries:
912 : * entries that actually got inserted on the fasync list
913 : * need to be released by rcu - see fasync_remove_entry.
914 : */
915 0 : void fasync_free(struct fasync_struct *new)
916 : {
917 0 : kmem_cache_free(fasync_cache, new);
918 0 : }
919 :
920 : /*
921 : * Insert a new entry into the fasync list. Return the pointer to the
922 : * old one if we didn't use the new one.
923 : *
924 : * NOTE! It is very important that the FASYNC flag always
925 : * match the state "is the filp on a fasync list".
926 : */
927 0 : struct fasync_struct *fasync_insert_entry(int fd, struct file *filp, struct fasync_struct **fapp, struct fasync_struct *new)
928 : {
929 0 : struct fasync_struct *fa, **fp;
930 :
931 0 : spin_lock(&filp->f_lock);
932 0 : spin_lock(&fasync_lock);
933 0 : for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
934 0 : if (fa->fa_file != filp)
935 0 : continue;
936 :
937 0 : write_lock_irq(&fa->fa_lock);
938 0 : fa->fa_fd = fd;
939 0 : write_unlock_irq(&fa->fa_lock);
940 0 : goto out;
941 : }
942 :
943 0 : rwlock_init(&new->fa_lock);
944 0 : new->magic = FASYNC_MAGIC;
945 0 : new->fa_file = filp;
946 0 : new->fa_fd = fd;
947 0 : new->fa_next = *fapp;
948 0 : rcu_assign_pointer(*fapp, new);
949 0 : filp->f_flags |= FASYNC;
950 :
951 0 : out:
952 0 : spin_unlock(&fasync_lock);
953 0 : spin_unlock(&filp->f_lock);
954 0 : return fa;
955 : }
956 :
957 : /*
958 : * Add a fasync entry. Return negative on error, positive if
959 : * added, and zero if did nothing but change an existing one.
960 : */
961 0 : static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)
962 : {
963 0 : struct fasync_struct *new;
964 :
965 0 : new = fasync_alloc();
966 0 : if (!new)
967 : return -ENOMEM;
968 :
969 : /*
970 : * fasync_insert_entry() returns the old (update) entry if
971 : * it existed.
972 : *
973 : * So free the (unused) new entry and return 0 to let the
974 : * caller know that we didn't add any new fasync entries.
975 : */
976 0 : if (fasync_insert_entry(fd, filp, fapp, new)) {
977 0 : fasync_free(new);
978 0 : return 0;
979 : }
980 :
981 : return 1;
982 : }
983 :
984 : /*
985 : * fasync_helper() is used by almost all character device drivers
986 : * to set up the fasync queue, and for regular files by the file
987 : * lease code. It returns negative on error, 0 if it did no changes
988 : * and positive if it added/deleted the entry.
989 : */
990 175 : int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
991 : {
992 175 : if (!on)
993 175 : return fasync_remove_entry(filp, fapp);
994 0 : return fasync_add_entry(fd, filp, fapp);
995 : }
996 :
997 : EXPORT_SYMBOL(fasync_helper);
998 :
999 : /*
1000 : * rcu_read_lock() is held
1001 : */
1002 0 : static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
1003 : {
1004 0 : while (fa) {
1005 0 : struct fown_struct *fown;
1006 :
1007 0 : if (fa->magic != FASYNC_MAGIC) {
1008 0 : printk(KERN_ERR "kill_fasync: bad magic number in "
1009 : "fasync_struct!\n");
1010 0 : return;
1011 : }
1012 0 : read_lock(&fa->fa_lock);
1013 0 : if (fa->fa_file) {
1014 0 : fown = &fa->fa_file->f_owner;
1015 : /* Don't send SIGURG to processes which have not set a
1016 : queued signum: SIGURG has its own default signalling
1017 : mechanism. */
1018 0 : if (!(sig == SIGURG && fown->signum == 0))
1019 0 : send_sigio(fown, fa->fa_fd, band);
1020 : }
1021 0 : read_unlock(&fa->fa_lock);
1022 0 : fa = rcu_dereference(fa->fa_next);
1023 : }
1024 : }
1025 :
1026 1577 : void kill_fasync(struct fasync_struct **fp, int sig, int band)
1027 : {
1028 : /* First a quick test without locking: usually
1029 : * the list is empty.
1030 : */
1031 1577 : if (*fp) {
1032 0 : rcu_read_lock();
1033 0 : kill_fasync_rcu(rcu_dereference(*fp), sig, band);
1034 0 : rcu_read_unlock();
1035 : }
1036 1577 : }
1037 : EXPORT_SYMBOL(kill_fasync);
1038 :
1039 1 : static int __init fcntl_init(void)
1040 : {
1041 : /*
1042 : * Please add new bits here to ensure allocation uniqueness.
1043 : * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
1044 : * is defined as O_NONBLOCK on some platforms and not on others.
1045 : */
1046 1 : BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ !=
1047 : HWEIGHT32(
1048 : (VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) |
1049 : __FMODE_EXEC | __FMODE_NONOTIFY));
1050 :
1051 1 : fasync_cache = kmem_cache_create("fasync_cache",
1052 : sizeof(struct fasync_struct), 0, SLAB_PANIC, NULL);
1053 1 : return 0;
1054 : }
1055 :
1056 : module_init(fcntl_init)
|
