1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * linux/fs/fcntl.c
4 *
5 * Copyright (C) 1991, 1992 Linus Torvalds
6 */
7
8 #include <linux/syscalls.h>
9 #include <linux/init.h>
10 #include <linux/mm.h>
11 #include <linux/sched/task.h>
12 #include <linux/fs.h>
13 #include <linux/filelock.h>
14 #include <linux/file.h>
15 #include <linux/fdtable.h>
16 #include <linux/capability.h>
17 #include <linux/dnotify.h>
18 #include <linux/slab.h>
19 #include <linux/module.h>
20 #include <linux/pipe_fs_i.h>
21 #include <linux/security.h>
22 #include <linux/ptrace.h>
23 #include <linux/signal.h>
24 #include <linux/rcupdate.h>
25 #include <linux/pid_namespace.h>
26 #include <linux/user_namespace.h>
27 #include <linux/memfd.h>
28 #include <linux/compat.h>
29 #include <linux/mount.h>
30 #include <linux/rw_hint.h>
31
32 #include <linux/poll.h>
33 #include <asm/siginfo.h>
34 #include <linux/uaccess.h>
35
36 #define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME)
37
setfl(int fd,struct file * filp,unsigned int arg)38 static int setfl(int fd, struct file * filp, unsigned int arg)
39 {
40 struct inode * inode = file_inode(filp);
41 int error = 0;
42
43 /*
44 * O_APPEND cannot be cleared if the file is marked as append-only
45 * and the file is open for write.
46 */
47 if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode))
48 return -EPERM;
49
50 /* O_NOATIME can only be set by the owner or superuser */
51 if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME))
52 if (!inode_owner_or_capable(file_mnt_idmap(filp), inode))
53 return -EPERM;
54
55 /* required for strict SunOS emulation */
56 if (O_NONBLOCK != O_NDELAY)
57 if (arg & O_NDELAY)
58 arg |= O_NONBLOCK;
59
60 /* Pipe packetized mode is controlled by O_DIRECT flag */
61 if (!S_ISFIFO(inode->i_mode) &&
62 (arg & O_DIRECT) &&
63 !(filp->f_mode & FMODE_CAN_ODIRECT))
64 return -EINVAL;
65
66 if (filp->f_op->check_flags)
67 error = filp->f_op->check_flags(arg);
68 if (error)
69 return error;
70
71 /*
72 * ->fasync() is responsible for setting the FASYNC bit.
73 */
74 if (((arg ^ filp->f_flags) & FASYNC) && filp->f_op->fasync) {
75 error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);
76 if (error < 0)
77 goto out;
78 if (error > 0)
79 error = 0;
80 }
81 spin_lock(&filp->f_lock);
82 filp->f_flags = (arg & SETFL_MASK) | (filp->f_flags & ~SETFL_MASK);
83 filp->f_iocb_flags = iocb_flags(filp);
84 spin_unlock(&filp->f_lock);
85
86 out:
87 return error;
88 }
89
f_modown(struct file * filp,struct pid * pid,enum pid_type type,int force)90 static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
91 int force)
92 {
93 write_lock_irq(&filp->f_owner.lock);
94 if (force || !filp->f_owner.pid) {
95 put_pid(filp->f_owner.pid);
96 filp->f_owner.pid = get_pid(pid);
97 filp->f_owner.pid_type = type;
98
99 if (pid) {
100 const struct cred *cred = current_cred();
101 filp->f_owner.uid = cred->uid;
102 filp->f_owner.euid = cred->euid;
103 }
104 }
105 write_unlock_irq(&filp->f_owner.lock);
106 }
107
__f_setown(struct file * filp,struct pid * pid,enum pid_type type,int force)108 void __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
109 int force)
110 {
111 security_file_set_fowner(filp);
112 f_modown(filp, pid, type, force);
113 }
114 EXPORT_SYMBOL(__f_setown);
115
f_setown(struct file * filp,int who,int force)116 int f_setown(struct file *filp, int who, int force)
117 {
118 enum pid_type type;
119 struct pid *pid = NULL;
120 int ret = 0;
121
122 type = PIDTYPE_TGID;
123 if (who < 0) {
124 /* avoid overflow below */
125 if (who == INT_MIN)
126 return -EINVAL;
127
128 type = PIDTYPE_PGID;
129 who = -who;
130 }
131
132 rcu_read_lock();
133 if (who) {
134 pid = find_vpid(who);
135 if (!pid)
136 ret = -ESRCH;
137 }
138
139 if (!ret)
140 __f_setown(filp, pid, type, force);
141 rcu_read_unlock();
142
143 return ret;
144 }
145 EXPORT_SYMBOL(f_setown);
146
f_delown(struct file * filp)147 void f_delown(struct file *filp)
148 {
149 f_modown(filp, NULL, PIDTYPE_TGID, 1);
150 }
151
f_getown(struct file * filp)152 pid_t f_getown(struct file *filp)
153 {
154 pid_t pid = 0;
155
156 read_lock_irq(&filp->f_owner.lock);
157 rcu_read_lock();
158 if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type)) {
159 pid = pid_vnr(filp->f_owner.pid);
160 if (filp->f_owner.pid_type == PIDTYPE_PGID)
161 pid = -pid;
162 }
163 rcu_read_unlock();
164 read_unlock_irq(&filp->f_owner.lock);
165 return pid;
166 }
167
f_setown_ex(struct file * filp,unsigned long arg)168 static int f_setown_ex(struct file *filp, unsigned long arg)
169 {
170 struct f_owner_ex __user *owner_p = (void __user *)arg;
171 struct f_owner_ex owner;
172 struct pid *pid;
173 int type;
174 int ret;
175
176 ret = copy_from_user(&owner, owner_p, sizeof(owner));
177 if (ret)
178 return -EFAULT;
179
180 switch (owner.type) {
181 case F_OWNER_TID:
182 type = PIDTYPE_PID;
183 break;
184
185 case F_OWNER_PID:
186 type = PIDTYPE_TGID;
187 break;
188
189 case F_OWNER_PGRP:
190 type = PIDTYPE_PGID;
191 break;
192
193 default:
194 return -EINVAL;
195 }
196
197 rcu_read_lock();
198 pid = find_vpid(owner.pid);
199 if (owner.pid && !pid)
200 ret = -ESRCH;
201 else
202 __f_setown(filp, pid, type, 1);
203 rcu_read_unlock();
204
205 return ret;
206 }
207
f_getown_ex(struct file * filp,unsigned long arg)208 static int f_getown_ex(struct file *filp, unsigned long arg)
209 {
210 struct f_owner_ex __user *owner_p = (void __user *)arg;
211 struct f_owner_ex owner = {};
212 int ret = 0;
213
214 read_lock_irq(&filp->f_owner.lock);
215 rcu_read_lock();
216 if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type))
217 owner.pid = pid_vnr(filp->f_owner.pid);
218 rcu_read_unlock();
219 switch (filp->f_owner.pid_type) {
220 case PIDTYPE_PID:
221 owner.type = F_OWNER_TID;
222 break;
223
224 case PIDTYPE_TGID:
225 owner.type = F_OWNER_PID;
226 break;
227
228 case PIDTYPE_PGID:
229 owner.type = F_OWNER_PGRP;
230 break;
231
232 default:
233 WARN_ON(1);
234 ret = -EINVAL;
235 break;
236 }
237 read_unlock_irq(&filp->f_owner.lock);
238
239 if (!ret) {
240 ret = copy_to_user(owner_p, &owner, sizeof(owner));
241 if (ret)
242 ret = -EFAULT;
243 }
244 return ret;
245 }
246
247 #ifdef CONFIG_CHECKPOINT_RESTORE
f_getowner_uids(struct file * filp,unsigned long arg)248 static int f_getowner_uids(struct file *filp, unsigned long arg)
249 {
250 struct user_namespace *user_ns = current_user_ns();
251 uid_t __user *dst = (void __user *)arg;
252 uid_t src[2];
253 int err;
254
255 read_lock_irq(&filp->f_owner.lock);
256 src[0] = from_kuid(user_ns, filp->f_owner.uid);
257 src[1] = from_kuid(user_ns, filp->f_owner.euid);
258 read_unlock_irq(&filp->f_owner.lock);
259
260 err = put_user(src[0], &dst[0]);
261 err |= put_user(src[1], &dst[1]);
262
263 return err;
264 }
265 #else
f_getowner_uids(struct file * filp,unsigned long arg)266 static int f_getowner_uids(struct file *filp, unsigned long arg)
267 {
268 return -EINVAL;
269 }
270 #endif
271
rw_hint_valid(u64 hint)272 static bool rw_hint_valid(u64 hint)
273 {
274 BUILD_BUG_ON(WRITE_LIFE_NOT_SET != RWH_WRITE_LIFE_NOT_SET);
275 BUILD_BUG_ON(WRITE_LIFE_NONE != RWH_WRITE_LIFE_NONE);
276 BUILD_BUG_ON(WRITE_LIFE_SHORT != RWH_WRITE_LIFE_SHORT);
277 BUILD_BUG_ON(WRITE_LIFE_MEDIUM != RWH_WRITE_LIFE_MEDIUM);
278 BUILD_BUG_ON(WRITE_LIFE_LONG != RWH_WRITE_LIFE_LONG);
279 BUILD_BUG_ON(WRITE_LIFE_EXTREME != RWH_WRITE_LIFE_EXTREME);
280
281 switch (hint) {
282 case RWH_WRITE_LIFE_NOT_SET:
283 case RWH_WRITE_LIFE_NONE:
284 case RWH_WRITE_LIFE_SHORT:
285 case RWH_WRITE_LIFE_MEDIUM:
286 case RWH_WRITE_LIFE_LONG:
287 case RWH_WRITE_LIFE_EXTREME:
288 return true;
289 default:
290 return false;
291 }
292 }
293
fcntl_get_rw_hint(struct file * file,unsigned int cmd,unsigned long arg)294 static long fcntl_get_rw_hint(struct file *file, unsigned int cmd,
295 unsigned long arg)
296 {
297 struct inode *inode = file_inode(file);
298 u64 __user *argp = (u64 __user *)arg;
299 u64 hint = READ_ONCE(inode->i_write_hint);
300
301 if (copy_to_user(argp, &hint, sizeof(*argp)))
302 return -EFAULT;
303 return 0;
304 }
305
fcntl_set_rw_hint(struct file * file,unsigned int cmd,unsigned long arg)306 static long fcntl_set_rw_hint(struct file *file, unsigned int cmd,
307 unsigned long arg)
308 {
309 struct inode *inode = file_inode(file);
310 u64 __user *argp = (u64 __user *)arg;
311 u64 hint;
312
313 if (copy_from_user(&hint, argp, sizeof(hint)))
314 return -EFAULT;
315 if (!rw_hint_valid(hint))
316 return -EINVAL;
317
318 WRITE_ONCE(inode->i_write_hint, hint);
319
320 /*
321 * file->f_mapping->host may differ from inode. As an example,
322 * blkdev_open() modifies file->f_mapping.
323 */
324 if (file->f_mapping->host != inode)
325 WRITE_ONCE(file->f_mapping->host->i_write_hint, hint);
326
327 return 0;
328 }
329
330 /* Is the file descriptor a dup of the file? */
f_dupfd_query(int fd,struct file * filp)331 static long f_dupfd_query(int fd, struct file *filp)
332 {
333 CLASS(fd_raw, f)(fd);
334
335 /*
336 * We can do the 'fdput()' immediately, as the only thing that
337 * matters is the pointer value which isn't changed by the fdput.
338 *
339 * Technically we didn't need a ref at all, and 'fdget()' was
340 * overkill, but given our lockless file pointer lookup, the
341 * alternatives are complicated.
342 */
343 return f.file == filp;
344 }
345
do_fcntl(int fd,unsigned int cmd,unsigned long arg,struct file * filp)346 static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
347 struct file *filp)
348 {
349 void __user *argp = (void __user *)arg;
350 int argi = (int)arg;
351 struct flock flock;
352 long err = -EINVAL;
353
354 switch (cmd) {
355 case F_DUPFD:
356 err = f_dupfd(argi, filp, 0);
357 break;
358 case F_DUPFD_CLOEXEC:
359 err = f_dupfd(argi, filp, O_CLOEXEC);
360 break;
361 case F_DUPFD_QUERY:
362 err = f_dupfd_query(argi, filp);
363 break;
364 case F_GETFD:
365 err = get_close_on_exec(fd) ? FD_CLOEXEC : 0;
366 break;
367 case F_SETFD:
368 err = 0;
369 set_close_on_exec(fd, argi & FD_CLOEXEC);
370 break;
371 case F_GETFL:
372 err = filp->f_flags;
373 break;
374 case F_SETFL:
375 err = setfl(fd, filp, argi);
376 break;
377 #if BITS_PER_LONG != 32
378 /* 32-bit arches must use fcntl64() */
379 case F_OFD_GETLK:
380 #endif
381 case F_GETLK:
382 if (copy_from_user(&flock, argp, sizeof(flock)))
383 return -EFAULT;
384 err = fcntl_getlk(filp, cmd, &flock);
385 if (!err && copy_to_user(argp, &flock, sizeof(flock)))
386 return -EFAULT;
387 break;
388 #if BITS_PER_LONG != 32
389 /* 32-bit arches must use fcntl64() */
390 case F_OFD_SETLK:
391 case F_OFD_SETLKW:
392 fallthrough;
393 #endif
394 case F_SETLK:
395 case F_SETLKW:
396 if (copy_from_user(&flock, argp, sizeof(flock)))
397 return -EFAULT;
398 err = fcntl_setlk(fd, filp, cmd, &flock);
399 break;
400 case F_GETOWN:
401 /*
402 * XXX If f_owner is a process group, the
403 * negative return value will get converted
404 * into an error. Oops. If we keep the
405 * current syscall conventions, the only way
406 * to fix this will be in libc.
407 */
408 err = f_getown(filp);
409 force_successful_syscall_return();
410 break;
411 case F_SETOWN:
412 err = f_setown(filp, argi, 1);
413 break;
414 case F_GETOWN_EX:
415 err = f_getown_ex(filp, arg);
416 break;
417 case F_SETOWN_EX:
418 err = f_setown_ex(filp, arg);
419 break;
420 case F_GETOWNER_UIDS:
421 err = f_getowner_uids(filp, arg);
422 break;
423 case F_GETSIG:
424 err = filp->f_owner.signum;
425 break;
426 case F_SETSIG:
427 /* arg == 0 restores default behaviour. */
428 if (!valid_signal(argi)) {
429 break;
430 }
431 err = 0;
432 filp->f_owner.signum = argi;
433 break;
434 case F_GETLEASE:
435 err = fcntl_getlease(filp);
436 break;
437 case F_SETLEASE:
438 err = fcntl_setlease(fd, filp, argi);
439 break;
440 case F_NOTIFY:
441 err = fcntl_dirnotify(fd, filp, argi);
442 break;
443 case F_SETPIPE_SZ:
444 case F_GETPIPE_SZ:
445 err = pipe_fcntl(filp, cmd, argi);
446 break;
447 case F_ADD_SEALS:
448 case F_GET_SEALS:
449 err = memfd_fcntl(filp, cmd, argi);
450 break;
451 case F_GET_RW_HINT:
452 err = fcntl_get_rw_hint(filp, cmd, arg);
453 break;
454 case F_SET_RW_HINT:
455 err = fcntl_set_rw_hint(filp, cmd, arg);
456 break;
457 default:
458 break;
459 }
460 return err;
461 }
462
check_fcntl_cmd(unsigned cmd)463 static int check_fcntl_cmd(unsigned cmd)
464 {
465 switch (cmd) {
466 case F_DUPFD:
467 case F_DUPFD_CLOEXEC:
468 case F_DUPFD_QUERY:
469 case F_GETFD:
470 case F_SETFD:
471 case F_GETFL:
472 return 1;
473 }
474 return 0;
475 }
476
SYSCALL_DEFINE3(fcntl,unsigned int,fd,unsigned int,cmd,unsigned long,arg)477 SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
478 {
479 struct fd f = fdget_raw(fd);
480 long err = -EBADF;
481
482 if (!f.file)
483 goto out;
484
485 if (unlikely(f.file->f_mode & FMODE_PATH)) {
486 if (!check_fcntl_cmd(cmd))
487 goto out1;
488 }
489
490 err = security_file_fcntl(f.file, cmd, arg);
491 if (!err)
492 err = do_fcntl(fd, cmd, arg, f.file);
493
494 out1:
495 fdput(f);
496 out:
497 return err;
498 }
499
500 #if BITS_PER_LONG == 32
SYSCALL_DEFINE3(fcntl64,unsigned int,fd,unsigned int,cmd,unsigned long,arg)501 SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
502 unsigned long, arg)
503 {
504 void __user *argp = (void __user *)arg;
505 struct fd f = fdget_raw(fd);
506 struct flock64 flock;
507 long err = -EBADF;
508
509 if (!f.file)
510 goto out;
511
512 if (unlikely(f.file->f_mode & FMODE_PATH)) {
513 if (!check_fcntl_cmd(cmd))
514 goto out1;
515 }
516
517 err = security_file_fcntl(f.file, cmd, arg);
518 if (err)
519 goto out1;
520
521 switch (cmd) {
522 case F_GETLK64:
523 case F_OFD_GETLK:
524 err = -EFAULT;
525 if (copy_from_user(&flock, argp, sizeof(flock)))
526 break;
527 err = fcntl_getlk64(f.file, cmd, &flock);
528 if (!err && copy_to_user(argp, &flock, sizeof(flock)))
529 err = -EFAULT;
530 break;
531 case F_SETLK64:
532 case F_SETLKW64:
533 case F_OFD_SETLK:
534 case F_OFD_SETLKW:
535 err = -EFAULT;
536 if (copy_from_user(&flock, argp, sizeof(flock)))
537 break;
538 err = fcntl_setlk64(fd, f.file, cmd, &flock);
539 break;
540 default:
541 err = do_fcntl(fd, cmd, arg, f.file);
542 break;
543 }
544 out1:
545 fdput(f);
546 out:
547 return err;
548 }
549 #endif
550
551 #ifdef CONFIG_COMPAT
552 /* careful - don't use anywhere else */
553 #define copy_flock_fields(dst, src) \
554 (dst)->l_type = (src)->l_type; \
555 (dst)->l_whence = (src)->l_whence; \
556 (dst)->l_start = (src)->l_start; \
557 (dst)->l_len = (src)->l_len; \
558 (dst)->l_pid = (src)->l_pid;
559
get_compat_flock(struct flock * kfl,const struct compat_flock __user * ufl)560 static int get_compat_flock(struct flock *kfl, const struct compat_flock __user *ufl)
561 {
562 struct compat_flock fl;
563
564 if (copy_from_user(&fl, ufl, sizeof(struct compat_flock)))
565 return -EFAULT;
566 copy_flock_fields(kfl, &fl);
567 return 0;
568 }
569
get_compat_flock64(struct flock * kfl,const struct compat_flock64 __user * ufl)570 static int get_compat_flock64(struct flock *kfl, const struct compat_flock64 __user *ufl)
571 {
572 struct compat_flock64 fl;
573
574 if (copy_from_user(&fl, ufl, sizeof(struct compat_flock64)))
575 return -EFAULT;
576 copy_flock_fields(kfl, &fl);
577 return 0;
578 }
579
put_compat_flock(const struct flock * kfl,struct compat_flock __user * ufl)580 static int put_compat_flock(const struct flock *kfl, struct compat_flock __user *ufl)
581 {
582 struct compat_flock fl;
583
584 memset(&fl, 0, sizeof(struct compat_flock));
585 copy_flock_fields(&fl, kfl);
586 if (copy_to_user(ufl, &fl, sizeof(struct compat_flock)))
587 return -EFAULT;
588 return 0;
589 }
590
put_compat_flock64(const struct flock * kfl,struct compat_flock64 __user * ufl)591 static int put_compat_flock64(const struct flock *kfl, struct compat_flock64 __user *ufl)
592 {
593 struct compat_flock64 fl;
594
595 BUILD_BUG_ON(sizeof(kfl->l_start) > sizeof(ufl->l_start));
596 BUILD_BUG_ON(sizeof(kfl->l_len) > sizeof(ufl->l_len));
597
598 memset(&fl, 0, sizeof(struct compat_flock64));
599 copy_flock_fields(&fl, kfl);
600 if (copy_to_user(ufl, &fl, sizeof(struct compat_flock64)))
601 return -EFAULT;
602 return 0;
603 }
604 #undef copy_flock_fields
605
606 static unsigned int
convert_fcntl_cmd(unsigned int cmd)607 convert_fcntl_cmd(unsigned int cmd)
608 {
609 switch (cmd) {
610 case F_GETLK64:
611 return F_GETLK;
612 case F_SETLK64:
613 return F_SETLK;
614 case F_SETLKW64:
615 return F_SETLKW;
616 }
617
618 return cmd;
619 }
620
621 /*
622 * GETLK was successful and we need to return the data, but it needs to fit in
623 * the compat structure.
624 * l_start shouldn't be too big, unless the original start + end is greater than
625 * COMPAT_OFF_T_MAX, in which case the app was asking for trouble, so we return
626 * -EOVERFLOW in that case. l_len could be too big, in which case we just
627 * truncate it, and only allow the app to see that part of the conflicting lock
628 * that might make sense to it anyway
629 */
fixup_compat_flock(struct flock * flock)630 static int fixup_compat_flock(struct flock *flock)
631 {
632 if (flock->l_start > COMPAT_OFF_T_MAX)
633 return -EOVERFLOW;
634 if (flock->l_len > COMPAT_OFF_T_MAX)
635 flock->l_len = COMPAT_OFF_T_MAX;
636 return 0;
637 }
638
do_compat_fcntl64(unsigned int fd,unsigned int cmd,compat_ulong_t arg)639 static long do_compat_fcntl64(unsigned int fd, unsigned int cmd,
640 compat_ulong_t arg)
641 {
642 struct fd f = fdget_raw(fd);
643 struct flock flock;
644 long err = -EBADF;
645
646 if (!f.file)
647 return err;
648
649 if (unlikely(f.file->f_mode & FMODE_PATH)) {
650 if (!check_fcntl_cmd(cmd))
651 goto out_put;
652 }
653
654 err = security_file_fcntl(f.file, cmd, arg);
655 if (err)
656 goto out_put;
657
658 switch (cmd) {
659 case F_GETLK:
660 err = get_compat_flock(&flock, compat_ptr(arg));
661 if (err)
662 break;
663 err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
664 if (err)
665 break;
666 err = fixup_compat_flock(&flock);
667 if (!err)
668 err = put_compat_flock(&flock, compat_ptr(arg));
669 break;
670 case F_GETLK64:
671 case F_OFD_GETLK:
672 err = get_compat_flock64(&flock, compat_ptr(arg));
673 if (err)
674 break;
675 err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
676 if (!err)
677 err = put_compat_flock64(&flock, compat_ptr(arg));
678 break;
679 case F_SETLK:
680 case F_SETLKW:
681 err = get_compat_flock(&flock, compat_ptr(arg));
682 if (err)
683 break;
684 err = fcntl_setlk(fd, f.file, convert_fcntl_cmd(cmd), &flock);
685 break;
686 case F_SETLK64:
687 case F_SETLKW64:
688 case F_OFD_SETLK:
689 case F_OFD_SETLKW:
690 err = get_compat_flock64(&flock, compat_ptr(arg));
691 if (err)
692 break;
693 err = fcntl_setlk(fd, f.file, convert_fcntl_cmd(cmd), &flock);
694 break;
695 default:
696 err = do_fcntl(fd, cmd, arg, f.file);
697 break;
698 }
699 out_put:
700 fdput(f);
701 return err;
702 }
703
COMPAT_SYSCALL_DEFINE3(fcntl64,unsigned int,fd,unsigned int,cmd,compat_ulong_t,arg)704 COMPAT_SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
705 compat_ulong_t, arg)
706 {
707 return do_compat_fcntl64(fd, cmd, arg);
708 }
709
COMPAT_SYSCALL_DEFINE3(fcntl,unsigned int,fd,unsigned int,cmd,compat_ulong_t,arg)710 COMPAT_SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd,
711 compat_ulong_t, arg)
712 {
713 switch (cmd) {
714 case F_GETLK64:
715 case F_SETLK64:
716 case F_SETLKW64:
717 case F_OFD_GETLK:
718 case F_OFD_SETLK:
719 case F_OFD_SETLKW:
720 return -EINVAL;
721 }
722 return do_compat_fcntl64(fd, cmd, arg);
723 }
724 #endif
725
726 /* Table to convert sigio signal codes into poll band bitmaps */
727
728 static const __poll_t band_table[NSIGPOLL] = {
729 EPOLLIN | EPOLLRDNORM, /* POLL_IN */
730 EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND, /* POLL_OUT */
731 EPOLLIN | EPOLLRDNORM | EPOLLMSG, /* POLL_MSG */
732 EPOLLERR, /* POLL_ERR */
733 EPOLLPRI | EPOLLRDBAND, /* POLL_PRI */
734 EPOLLHUP | EPOLLERR /* POLL_HUP */
735 };
736
sigio_perm(struct task_struct * p,struct fown_struct * fown,int sig)737 static inline int sigio_perm(struct task_struct *p,
738 struct fown_struct *fown, int sig)
739 {
740 const struct cred *cred;
741 int ret;
742
743 rcu_read_lock();
744 cred = __task_cred(p);
745 ret = ((uid_eq(fown->euid, GLOBAL_ROOT_UID) ||
746 uid_eq(fown->euid, cred->suid) || uid_eq(fown->euid, cred->uid) ||
747 uid_eq(fown->uid, cred->suid) || uid_eq(fown->uid, cred->uid)) &&
748 !security_file_send_sigiotask(p, fown, sig));
749 rcu_read_unlock();
750 return ret;
751 }
752
send_sigio_to_task(struct task_struct * p,struct fown_struct * fown,int fd,int reason,enum pid_type type)753 static void send_sigio_to_task(struct task_struct *p,
754 struct fown_struct *fown,
755 int fd, int reason, enum pid_type type)
756 {
757 /*
758 * F_SETSIG can change ->signum lockless in parallel, make
759 * sure we read it once and use the same value throughout.
760 */
761 int signum = READ_ONCE(fown->signum);
762
763 if (!sigio_perm(p, fown, signum))
764 return;
765
766 switch (signum) {
767 default: {
768 kernel_siginfo_t si;
769
770 /* Queue a rt signal with the appropriate fd as its
771 value. We use SI_SIGIO as the source, not
772 SI_KERNEL, since kernel signals always get
773 delivered even if we can't queue. Failure to
774 queue in this case _should_ be reported; we fall
775 back to SIGIO in that case. --sct */
776 clear_siginfo(&si);
777 si.si_signo = signum;
778 si.si_errno = 0;
779 si.si_code = reason;
780 /*
781 * Posix definies POLL_IN and friends to be signal
782 * specific si_codes for SIG_POLL. Linux extended
783 * these si_codes to other signals in a way that is
784 * ambiguous if other signals also have signal
785 * specific si_codes. In that case use SI_SIGIO instead
786 * to remove the ambiguity.
787 */
788 if ((signum != SIGPOLL) && sig_specific_sicodes(signum))
789 si.si_code = SI_SIGIO;
790
791 /* Make sure we are called with one of the POLL_*
792 reasons, otherwise we could leak kernel stack into
793 userspace. */
794 BUG_ON((reason < POLL_IN) || ((reason - POLL_IN) >= NSIGPOLL));
795 if (reason - POLL_IN >= NSIGPOLL)
796 si.si_band = ~0L;
797 else
798 si.si_band = mangle_poll(band_table[reason - POLL_IN]);
799 si.si_fd = fd;
800 if (!do_send_sig_info(signum, &si, p, type))
801 break;
802 }
803 fallthrough; /* fall back on the old plain SIGIO signal */
804 case 0:
805 do_send_sig_info(SIGIO, SEND_SIG_PRIV, p, type);
806 }
807 }
808
send_sigio(struct fown_struct * fown,int fd,int band)809 void send_sigio(struct fown_struct *fown, int fd, int band)
810 {
811 struct task_struct *p;
812 enum pid_type type;
813 unsigned long flags;
814 struct pid *pid;
815
816 read_lock_irqsave(&fown->lock, flags);
817
818 type = fown->pid_type;
819 pid = fown->pid;
820 if (!pid)
821 goto out_unlock_fown;
822
823 if (type <= PIDTYPE_TGID) {
824 rcu_read_lock();
825 p = pid_task(pid, PIDTYPE_PID);
826 if (p)
827 send_sigio_to_task(p, fown, fd, band, type);
828 rcu_read_unlock();
829 } else {
830 read_lock(&tasklist_lock);
831 do_each_pid_task(pid, type, p) {
832 send_sigio_to_task(p, fown, fd, band, type);
833 } while_each_pid_task(pid, type, p);
834 read_unlock(&tasklist_lock);
835 }
836 out_unlock_fown:
837 read_unlock_irqrestore(&fown->lock, flags);
838 }
839
send_sigurg_to_task(struct task_struct * p,struct fown_struct * fown,enum pid_type type)840 static void send_sigurg_to_task(struct task_struct *p,
841 struct fown_struct *fown, enum pid_type type)
842 {
843 if (sigio_perm(p, fown, SIGURG))
844 do_send_sig_info(SIGURG, SEND_SIG_PRIV, p, type);
845 }
846
send_sigurg(struct fown_struct * fown)847 int send_sigurg(struct fown_struct *fown)
848 {
849 struct task_struct *p;
850 enum pid_type type;
851 struct pid *pid;
852 unsigned long flags;
853 int ret = 0;
854
855 read_lock_irqsave(&fown->lock, flags);
856
857 type = fown->pid_type;
858 pid = fown->pid;
859 if (!pid)
860 goto out_unlock_fown;
861
862 ret = 1;
863
864 if (type <= PIDTYPE_TGID) {
865 rcu_read_lock();
866 p = pid_task(pid, PIDTYPE_PID);
867 if (p)
868 send_sigurg_to_task(p, fown, type);
869 rcu_read_unlock();
870 } else {
871 read_lock(&tasklist_lock);
872 do_each_pid_task(pid, type, p) {
873 send_sigurg_to_task(p, fown, type);
874 } while_each_pid_task(pid, type, p);
875 read_unlock(&tasklist_lock);
876 }
877 out_unlock_fown:
878 read_unlock_irqrestore(&fown->lock, flags);
879 return ret;
880 }
881
882 static DEFINE_SPINLOCK(fasync_lock);
883 static struct kmem_cache *fasync_cache __ro_after_init;
884
885 /*
886 * Remove a fasync entry. If successfully removed, return
887 * positive and clear the FASYNC flag. If no entry exists,
888 * do nothing and return 0.
889 *
890 * NOTE! It is very important that the FASYNC flag always
891 * match the state "is the filp on a fasync list".
892 *
893 */
fasync_remove_entry(struct file * filp,struct fasync_struct ** fapp)894 int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
895 {
896 struct fasync_struct *fa, **fp;
897 int result = 0;
898
899 spin_lock(&filp->f_lock);
900 spin_lock(&fasync_lock);
901 for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
902 if (fa->fa_file != filp)
903 continue;
904
905 write_lock_irq(&fa->fa_lock);
906 fa->fa_file = NULL;
907 write_unlock_irq(&fa->fa_lock);
908
909 *fp = fa->fa_next;
910 kfree_rcu(fa, fa_rcu);
911 filp->f_flags &= ~FASYNC;
912 result = 1;
913 break;
914 }
915 spin_unlock(&fasync_lock);
916 spin_unlock(&filp->f_lock);
917 return result;
918 }
919
fasync_alloc(void)920 struct fasync_struct *fasync_alloc(void)
921 {
922 return kmem_cache_alloc(fasync_cache, GFP_KERNEL);
923 }
924
925 /*
926 * NOTE! This can be used only for unused fasync entries:
927 * entries that actually got inserted on the fasync list
928 * need to be released by rcu - see fasync_remove_entry.
929 */
fasync_free(struct fasync_struct * new)930 void fasync_free(struct fasync_struct *new)
931 {
932 kmem_cache_free(fasync_cache, new);
933 }
934
935 /*
936 * Insert a new entry into the fasync list. Return the pointer to the
937 * old one if we didn't use the new one.
938 *
939 * NOTE! It is very important that the FASYNC flag always
940 * match the state "is the filp on a fasync list".
941 */
fasync_insert_entry(int fd,struct file * filp,struct fasync_struct ** fapp,struct fasync_struct * new)942 struct fasync_struct *fasync_insert_entry(int fd, struct file *filp, struct fasync_struct **fapp, struct fasync_struct *new)
943 {
944 struct fasync_struct *fa, **fp;
945
946 spin_lock(&filp->f_lock);
947 spin_lock(&fasync_lock);
948 for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
949 if (fa->fa_file != filp)
950 continue;
951
952 write_lock_irq(&fa->fa_lock);
953 fa->fa_fd = fd;
954 write_unlock_irq(&fa->fa_lock);
955 goto out;
956 }
957
958 rwlock_init(&new->fa_lock);
959 new->magic = FASYNC_MAGIC;
960 new->fa_file = filp;
961 new->fa_fd = fd;
962 new->fa_next = *fapp;
963 rcu_assign_pointer(*fapp, new);
964 filp->f_flags |= FASYNC;
965
966 out:
967 spin_unlock(&fasync_lock);
968 spin_unlock(&filp->f_lock);
969 return fa;
970 }
971
972 /*
973 * Add a fasync entry. Return negative on error, positive if
974 * added, and zero if did nothing but change an existing one.
975 */
fasync_add_entry(int fd,struct file * filp,struct fasync_struct ** fapp)976 static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)
977 {
978 struct fasync_struct *new;
979
980 new = fasync_alloc();
981 if (!new)
982 return -ENOMEM;
983
984 /*
985 * fasync_insert_entry() returns the old (update) entry if
986 * it existed.
987 *
988 * So free the (unused) new entry and return 0 to let the
989 * caller know that we didn't add any new fasync entries.
990 */
991 if (fasync_insert_entry(fd, filp, fapp, new)) {
992 fasync_free(new);
993 return 0;
994 }
995
996 return 1;
997 }
998
999 /*
1000 * fasync_helper() is used by almost all character device drivers
1001 * to set up the fasync queue, and for regular files by the file
1002 * lease code. It returns negative on error, 0 if it did no changes
1003 * and positive if it added/deleted the entry.
1004 */
fasync_helper(int fd,struct file * filp,int on,struct fasync_struct ** fapp)1005 int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
1006 {
1007 if (!on)
1008 return fasync_remove_entry(filp, fapp);
1009 return fasync_add_entry(fd, filp, fapp);
1010 }
1011
1012 EXPORT_SYMBOL(fasync_helper);
1013
1014 /*
1015 * rcu_read_lock() is held
1016 */
kill_fasync_rcu(struct fasync_struct * fa,int sig,int band)1017 static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
1018 {
1019 while (fa) {
1020 struct fown_struct *fown;
1021 unsigned long flags;
1022
1023 if (fa->magic != FASYNC_MAGIC) {
1024 printk(KERN_ERR "kill_fasync: bad magic number in "
1025 "fasync_struct!\n");
1026 return;
1027 }
1028 read_lock_irqsave(&fa->fa_lock, flags);
1029 if (fa->fa_file) {
1030 fown = &fa->fa_file->f_owner;
1031 /* Don't send SIGURG to processes which have not set a
1032 queued signum: SIGURG has its own default signalling
1033 mechanism. */
1034 if (!(sig == SIGURG && fown->signum == 0))
1035 send_sigio(fown, fa->fa_fd, band);
1036 }
1037 read_unlock_irqrestore(&fa->fa_lock, flags);
1038 fa = rcu_dereference(fa->fa_next);
1039 }
1040 }
1041
kill_fasync(struct fasync_struct ** fp,int sig,int band)1042 void kill_fasync(struct fasync_struct **fp, int sig, int band)
1043 {
1044 /* First a quick test without locking: usually
1045 * the list is empty.
1046 */
1047 if (*fp) {
1048 rcu_read_lock();
1049 kill_fasync_rcu(rcu_dereference(*fp), sig, band);
1050 rcu_read_unlock();
1051 }
1052 }
1053 EXPORT_SYMBOL(kill_fasync);
1054
fcntl_init(void)1055 static int __init fcntl_init(void)
1056 {
1057 /*
1058 * Please add new bits here to ensure allocation uniqueness.
1059 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
1060 * is defined as O_NONBLOCK on some platforms and not on others.
1061 */
1062 BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ !=
1063 HWEIGHT32(
1064 (VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) |
1065 __FMODE_EXEC | __FMODE_NONOTIFY));
1066
1067 fasync_cache = kmem_cache_create("fasync_cache",
1068 sizeof(struct fasync_struct), 0,
1069 SLAB_PANIC | SLAB_ACCOUNT, NULL);
1070 return 0;
1071 }
1072
1073 module_init(fcntl_init)
1074