xref: /openbsd/sys/kern/kern_descrip.c (revision b9ae17a0)
1 /*	$OpenBSD: kern_descrip.c,v 1.210 2024/12/30 02:46:00 guenther Exp $	*/
2 /*	$NetBSD: kern_descrip.c,v 1.42 1996/03/30 22:24:38 christos Exp $	*/
3 
4 /*
5  * Copyright (c) 1982, 1986, 1989, 1991, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  * (c) UNIX System Laboratories, Inc.
8  * All or some portions of this file are derived from material licensed
9  * to the University of California by American Telephone and Telegraph
10  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
11  * the permission of UNIX System Laboratories, Inc.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  * 3. Neither the name of the University nor the names of its contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  *
37  *	@(#)kern_descrip.c	8.6 (Berkeley) 4/19/94
38  */
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/filedesc.h>
43 #include <sys/vnode.h>
44 #include <sys/proc.h>
45 #include <sys/file.h>
46 #include <sys/socket.h>
47 #include <sys/stat.h>
48 #include <sys/ioctl.h>
49 #include <sys/fcntl.h>
50 #include <sys/lock.h>
51 #include <sys/malloc.h>
52 #include <sys/ucred.h>
53 #include <sys/unistd.h>
54 #include <sys/resourcevar.h>
55 #include <sys/mount.h>
56 #include <sys/syscallargs.h>
57 #include <sys/event.h>
58 #include <sys/pool.h>
59 #include <sys/ktrace.h>
60 #include <sys/pledge.h>
61 
62 /*
63  * Descriptor management.
64  *
65  * We need to block interrupts as long as `fhdlk' is being taken
66  * with and without the KERNEL_LOCK().
67  */
68 struct mutex fhdlk = MUTEX_INITIALIZER(IPL_MPFLOOR);
69 struct filelist filehead;	/* head of list of open files */
70 int numfiles;			/* actual number of open files */
71 
72 static __inline void fd_used(struct filedesc *, int);
73 static __inline void fd_unused(struct filedesc *, int);
74 static __inline int find_next_zero(u_int *, int, u_int);
75 static __inline int fd_inuse(struct filedesc *, int);
76 int finishdup(struct proc *, struct file *, int, int, register_t *, int);
77 int find_last_set(struct filedesc *, int);
78 int dodup3(struct proc *, int, int, int, register_t *);
79 
80 #define DUPF_CLOEXEC	0x01
81 #define DUPF_DUP2	0x02
82 
83 struct pool file_pool;
84 struct pool fdesc_pool;
85 
86 void
filedesc_init(void)87 filedesc_init(void)
88 {
89 	pool_init(&file_pool, sizeof(struct file), 0, IPL_MPFLOOR,
90 	    PR_WAITOK, "filepl", NULL);
91 	pool_init(&fdesc_pool, sizeof(struct filedesc0), 0, IPL_NONE,
92 	    PR_WAITOK, "fdescpl", NULL);
93 	LIST_INIT(&filehead);
94 }
95 
96 static __inline int
find_next_zero(u_int * bitmap,int want,u_int bits)97 find_next_zero(u_int *bitmap, int want, u_int bits)
98 {
99 	int i, off, maxoff;
100 	u_int sub;
101 
102 	if (want > bits)
103 		return -1;
104 
105 	off = want >> NDENTRYSHIFT;
106 	i = want & NDENTRYMASK;
107 	if (i) {
108 		sub = bitmap[off] | ((u_int)~0 >> (NDENTRIES - i));
109 		if (sub != ~0)
110 			goto found;
111 		off++;
112 	}
113 
114 	maxoff = NDLOSLOTS(bits);
115 	while (off < maxoff) {
116 		if ((sub = bitmap[off]) != ~0)
117 			goto found;
118 		off++;
119 	}
120 
121 	return -1;
122 
123  found:
124 	return (off << NDENTRYSHIFT) + ffs(~sub) - 1;
125 }
126 
127 int
find_last_set(struct filedesc * fd,int last)128 find_last_set(struct filedesc *fd, int last)
129 {
130 	int off, i;
131 	u_int *bitmap = fd->fd_lomap;
132 
133 	off = (last - 1) >> NDENTRYSHIFT;
134 
135 	while (off >= 0 && !bitmap[off])
136 		off--;
137 	if (off < 0)
138 		return 0;
139 
140 	i = ((off + 1) << NDENTRYSHIFT) - 1;
141 	if (i >= last)
142 		i = last - 1;
143 
144 	while (i > 0 && !fd_inuse(fd, i))
145 		i--;
146 	return i;
147 }
148 
149 static __inline int
fd_inuse(struct filedesc * fdp,int fd)150 fd_inuse(struct filedesc *fdp, int fd)
151 {
152 	u_int off = fd >> NDENTRYSHIFT;
153 
154 	if (fdp->fd_lomap[off] & (1U << (fd & NDENTRYMASK)))
155 		return 1;
156 
157 	return 0;
158 }
159 
160 static __inline void
fd_used(struct filedesc * fdp,int fd)161 fd_used(struct filedesc *fdp, int fd)
162 {
163 	u_int off = fd >> NDENTRYSHIFT;
164 
165 	fdp->fd_lomap[off] |= 1U << (fd & NDENTRYMASK);
166 	if (fdp->fd_lomap[off] == ~0)
167 		fdp->fd_himap[off >> NDENTRYSHIFT] |= 1U << (off & NDENTRYMASK);
168 
169 	if (fd > fdp->fd_lastfile)
170 		fdp->fd_lastfile = fd;
171 	fdp->fd_openfd++;
172 }
173 
174 static __inline void
fd_unused(struct filedesc * fdp,int fd)175 fd_unused(struct filedesc *fdp, int fd)
176 {
177 	u_int off = fd >> NDENTRYSHIFT;
178 
179 	if (fd < fdp->fd_freefile)
180 		fdp->fd_freefile = fd;
181 
182 	if (fdp->fd_lomap[off] == ~0)
183 		fdp->fd_himap[off >> NDENTRYSHIFT] &= ~(1U << (off & NDENTRYMASK));
184 	fdp->fd_lomap[off] &= ~(1U << (fd & NDENTRYMASK));
185 
186 #ifdef DIAGNOSTIC
187 	if (fd > fdp->fd_lastfile)
188 		panic("fd_unused: fd_lastfile inconsistent");
189 #endif
190 	if (fd == fdp->fd_lastfile)
191 		fdp->fd_lastfile = find_last_set(fdp, fd);
192 	fdp->fd_openfd--;
193 }
194 
195 struct file *
fd_iterfile(struct file * fp,struct proc * p)196 fd_iterfile(struct file *fp, struct proc *p)
197 {
198 	struct file *nfp;
199 	unsigned int count;
200 
201 	mtx_enter(&fhdlk);
202 	if (fp == NULL)
203 		nfp = LIST_FIRST(&filehead);
204 	else
205 		nfp = LIST_NEXT(fp, f_list);
206 
207 	/* don't refcount when f_count == 0 to avoid race in fdrop() */
208 	while (nfp != NULL) {
209 		count = nfp->f_count;
210 		if (count == 0) {
211 			nfp = LIST_NEXT(nfp, f_list);
212 			continue;
213 		}
214 		if (atomic_cas_uint(&nfp->f_count, count, count + 1) == count)
215 			break;
216 	}
217 	mtx_leave(&fhdlk);
218 
219 	if (fp != NULL)
220 		FRELE(fp, p);
221 
222 	return nfp;
223 }
224 
225 struct file *
fd_getfile(struct filedesc * fdp,int fd)226 fd_getfile(struct filedesc *fdp, int fd)
227 {
228 	struct file *fp;
229 
230 	vfs_stall_barrier();
231 
232 	if ((u_int)fd >= fdp->fd_nfiles)
233 		return (NULL);
234 
235 	mtx_enter(&fdp->fd_fplock);
236 	fp = fdp->fd_ofiles[fd];
237 	if (fp != NULL)
238 		atomic_inc_int(&fp->f_count);
239 	mtx_leave(&fdp->fd_fplock);
240 
241 	return (fp);
242 }
243 
244 struct file *
fd_getfile_mode(struct filedesc * fdp,int fd,int mode)245 fd_getfile_mode(struct filedesc *fdp, int fd, int mode)
246 {
247 	struct file *fp;
248 
249 	KASSERT(mode != 0);
250 
251 	fp = fd_getfile(fdp, fd);
252 	if (fp == NULL)
253 		return (NULL);
254 
255 	if ((fp->f_flag & mode) == 0) {
256 		FRELE(fp, curproc);
257 		return (NULL);
258 	}
259 
260 	return (fp);
261 }
262 
263 int
fd_checkclosed(struct filedesc * fdp,int fd,struct file * fp)264 fd_checkclosed(struct filedesc *fdp, int fd, struct file *fp)
265 {
266 	int closed;
267 
268 	mtx_enter(&fdp->fd_fplock);
269 	KASSERT(fd < fdp->fd_nfiles);
270 	closed = (fdp->fd_ofiles[fd] != fp);
271 	mtx_leave(&fdp->fd_fplock);
272 	return (closed);
273 }
274 
275 /*
276  * System calls on descriptors.
277  */
278 
279 /*
280  * Duplicate a file descriptor.
281  */
282 int
sys_dup(struct proc * p,void * v,register_t * retval)283 sys_dup(struct proc *p, void *v, register_t *retval)
284 {
285 	struct sys_dup_args /* {
286 		syscallarg(int) fd;
287 	} */ *uap = v;
288 	struct filedesc *fdp = p->p_fd;
289 	int old = SCARG(uap, fd);
290 	struct file *fp;
291 	int new;
292 	int error;
293 
294 restart:
295 	if ((fp = fd_getfile(fdp, old)) == NULL)
296 		return (EBADF);
297 	fdplock(fdp);
298 	if ((error = fdalloc(p, 0, &new)) != 0) {
299 		if (error == ENOSPC) {
300 			fdexpand(p);
301 			fdpunlock(fdp);
302 			FRELE(fp, p);
303 			goto restart;
304 		}
305 		fdpunlock(fdp);
306 		FRELE(fp, p);
307 		return (error);
308 	}
309 	/* No need for FRELE(), finishdup() uses current ref. */
310 	return (finishdup(p, fp, old, new, retval, 0));
311 }
312 
313 /*
314  * Duplicate a file descriptor to a particular value.
315  */
316 int
sys_dup2(struct proc * p,void * v,register_t * retval)317 sys_dup2(struct proc *p, void *v, register_t *retval)
318 {
319 	struct sys_dup2_args /* {
320 		syscallarg(int) from;
321 		syscallarg(int) to;
322 	} */ *uap = v;
323 
324 	return (dodup3(p, SCARG(uap, from), SCARG(uap, to), 0, retval));
325 }
326 
327 int
sys_dup3(struct proc * p,void * v,register_t * retval)328 sys_dup3(struct proc *p, void *v, register_t *retval)
329 {
330 	struct sys_dup3_args /* {
331 		syscallarg(int) from;
332 		syscallarg(int) to;
333 		syscallarg(int) flags;
334 	} */ *uap = v;
335 
336 	if (SCARG(uap, from) == SCARG(uap, to))
337 		return (EINVAL);
338 	if (SCARG(uap, flags) & ~O_CLOEXEC)
339 		return (EINVAL);
340 	return (dodup3(p, SCARG(uap, from), SCARG(uap, to),
341 	    SCARG(uap, flags), retval));
342 }
343 
344 int
dodup3(struct proc * p,int old,int new,int flags,register_t * retval)345 dodup3(struct proc *p, int old, int new, int flags, register_t *retval)
346 {
347 	struct filedesc *fdp = p->p_fd;
348 	struct file *fp;
349 	int dupflags, error, i;
350 
351 restart:
352 	if ((fp = fd_getfile(fdp, old)) == NULL)
353 		return (EBADF);
354 	if (old == new) {
355 		/*
356 		 * NOTE! This doesn't clear the close-on-exec flag. This might
357 		 * or might not be the intended behavior from the start, but
358 		 * this is what everyone else does.
359 		 */
360 		*retval = new;
361 		FRELE(fp, p);
362 		return (0);
363 	}
364 	if ((u_int)new >= lim_cur(RLIMIT_NOFILE) ||
365 	    (u_int)new >= atomic_load_int(&maxfiles)) {
366 		FRELE(fp, p);
367 		return (EBADF);
368 	}
369 	fdplock(fdp);
370 	if (new >= fdp->fd_nfiles) {
371 		if ((error = fdalloc(p, new, &i)) != 0) {
372 			if (error == ENOSPC) {
373 				fdexpand(p);
374 				fdpunlock(fdp);
375 				FRELE(fp, p);
376 				goto restart;
377 			}
378 			fdpunlock(fdp);
379 			FRELE(fp, p);
380 			return (error);
381 		}
382 		if (new != i)
383 			panic("dup2: fdalloc");
384 		fd_unused(fdp, new);
385 	}
386 
387 	dupflags = DUPF_DUP2;
388 	if (flags & O_CLOEXEC)
389 		dupflags |= DUPF_CLOEXEC;
390 
391 	/* No need for FRELE(), finishdup() uses current ref. */
392 	return (finishdup(p, fp, old, new, retval, dupflags));
393 }
394 
395 /*
396  * The file control system call.
397  */
398 int
sys_fcntl(struct proc * p,void * v,register_t * retval)399 sys_fcntl(struct proc *p, void *v, register_t *retval)
400 {
401 	struct sys_fcntl_args /* {
402 		syscallarg(int) fd;
403 		syscallarg(int) cmd;
404 		syscallarg(void *) arg;
405 	} */ *uap = v;
406 	int fd = SCARG(uap, fd);
407 	struct filedesc *fdp = p->p_fd;
408 	struct file *fp;
409 	struct vnode *vp;
410 	int i, prev, tmp, newmin, flg = F_POSIX;
411 	struct flock fl;
412 	int error = 0;
413 
414 	error = pledge_fcntl(p, SCARG(uap, cmd));
415 	if (error)
416 		return (error);
417 
418 restart:
419 	if ((fp = fd_getfile(fdp, fd)) == NULL)
420 		return (EBADF);
421 	switch (SCARG(uap, cmd)) {
422 
423 	case F_DUPFD:
424 	case F_DUPFD_CLOEXEC:
425 		newmin = (long)SCARG(uap, arg);
426 		if ((u_int)newmin >= lim_cur(RLIMIT_NOFILE) ||
427 		    (u_int)newmin >= atomic_load_int(&maxfiles)) {
428 			error = EINVAL;
429 			break;
430 		}
431 		fdplock(fdp);
432 		if ((error = fdalloc(p, newmin, &i)) != 0) {
433 			if (error == ENOSPC) {
434 				fdexpand(p);
435 				fdpunlock(fdp);
436 				FRELE(fp, p);
437 				goto restart;
438 			}
439 			fdpunlock(fdp);
440 			FRELE(fp, p);
441 		} else {
442 			int dupflags = 0;
443 
444 			if (SCARG(uap, cmd) == F_DUPFD_CLOEXEC)
445 				dupflags |= DUPF_CLOEXEC;
446 
447 			/* No need for FRELE(), finishdup() uses current ref. */
448 			error = finishdup(p, fp, fd, i, retval, dupflags);
449 		}
450 		return (error);
451 
452 	case F_GETFD:
453 		fdplock(fdp);
454 		*retval = fdp->fd_ofileflags[fd] & UF_EXCLOSE ? 1 : 0;
455 		fdpunlock(fdp);
456 		break;
457 
458 	case F_SETFD:
459 		fdplock(fdp);
460 		if ((long)SCARG(uap, arg) & 1)
461 			fdp->fd_ofileflags[fd] |= UF_EXCLOSE;
462 		else
463 			fdp->fd_ofileflags[fd] &= ~UF_EXCLOSE;
464 		fdpunlock(fdp);
465 		break;
466 
467 	case F_GETFL:
468 		*retval = OFLAGS(fp->f_flag);
469 		break;
470 
471 	case F_ISATTY:
472 		vp = fp->f_data;
473 	        if (fp->f_type == DTYPE_VNODE && (vp->v_flag & VISTTY))
474 			*retval = 1;
475 		else {
476 			*retval = 0;
477 			error = ENOTTY;
478 		}
479 		break;
480 
481 	case F_SETFL:
482 		do {
483 			tmp = prev = fp->f_flag;
484 			tmp &= ~FCNTLFLAGS;
485 			tmp |= FFLAGS((long)SCARG(uap, arg)) & FCNTLFLAGS;
486 		} while (atomic_cas_uint(&fp->f_flag, prev, tmp) != prev);
487 		tmp = fp->f_flag & FASYNC;
488 		error = (*fp->f_ops->fo_ioctl)(fp, FIOASYNC, (caddr_t)&tmp, p);
489 		break;
490 
491 	case F_GETOWN:
492 		tmp = 0;
493 		error = (*fp->f_ops->fo_ioctl)
494 			(fp, FIOGETOWN, (caddr_t)&tmp, p);
495 		*retval = tmp;
496 		break;
497 
498 	case F_SETOWN:
499 		tmp = (long)SCARG(uap, arg);
500 		error = ((*fp->f_ops->fo_ioctl)
501 			(fp, FIOSETOWN, (caddr_t)&tmp, p));
502 		break;
503 
504 	case F_SETLKW:
505 		flg |= F_WAIT;
506 		/* FALLTHROUGH */
507 
508 	case F_SETLK:
509 		error = pledge_flock(p);
510 		if (error != 0)
511 			break;
512 
513 		if (fp->f_type != DTYPE_VNODE) {
514 			error = EINVAL;
515 			break;
516 		}
517 		vp = fp->f_data;
518 		/* Copy in the lock structure */
519 		error = copyin((caddr_t)SCARG(uap, arg), (caddr_t)&fl,
520 		    sizeof (fl));
521 		if (error)
522 			break;
523 #ifdef KTRACE
524 		if (KTRPOINT(p, KTR_STRUCT))
525 			ktrflock(p, &fl);
526 #endif
527 		if (fl.l_whence == SEEK_CUR) {
528 			off_t offset = foffset(fp);
529 
530 			if (fl.l_start == 0 && fl.l_len < 0) {
531 				/* lockf(3) compliance hack */
532 				fl.l_len = -fl.l_len;
533 				fl.l_start = offset - fl.l_len;
534 			} else
535 				fl.l_start += offset;
536 		}
537 		switch (fl.l_type) {
538 
539 		case F_RDLCK:
540 			if ((fp->f_flag & FREAD) == 0) {
541 				error = EBADF;
542 				goto out;
543 			}
544 			atomic_setbits_int(&fdp->fd_flags, FD_ADVLOCK);
545 			error = VOP_ADVLOCK(vp, fdp, F_SETLK, &fl, flg);
546 			break;
547 
548 		case F_WRLCK:
549 			if ((fp->f_flag & FWRITE) == 0) {
550 				error = EBADF;
551 				goto out;
552 			}
553 			atomic_setbits_int(&fdp->fd_flags, FD_ADVLOCK);
554 			error = VOP_ADVLOCK(vp, fdp, F_SETLK, &fl, flg);
555 			break;
556 
557 		case F_UNLCK:
558 			error = VOP_ADVLOCK(vp, fdp, F_UNLCK, &fl, F_POSIX);
559 			goto out;
560 
561 		default:
562 			error = EINVAL;
563 			goto out;
564 		}
565 
566 		if (fd_checkclosed(fdp, fd, fp)) {
567 			/*
568 			 * We have lost the race with close() or dup2();
569 			 * unlock, pretend that we've won the race and that
570 			 * lock had been removed by close()
571 			 */
572 			fl.l_whence = SEEK_SET;
573 			fl.l_start = 0;
574 			fl.l_len = 0;
575 			VOP_ADVLOCK(vp, fdp, F_UNLCK, &fl, F_POSIX);
576 			fl.l_type = F_UNLCK;
577 		}
578 		goto out;
579 
580 
581 	case F_GETLK:
582 		error = pledge_flock(p);
583 		if (error != 0)
584 			break;
585 
586 		if (fp->f_type != DTYPE_VNODE) {
587 			error = EINVAL;
588 			break;
589 		}
590 		vp = fp->f_data;
591 		/* Copy in the lock structure */
592 		error = copyin((caddr_t)SCARG(uap, arg), (caddr_t)&fl,
593 		    sizeof (fl));
594 		if (error)
595 			break;
596 		if (fl.l_whence == SEEK_CUR) {
597 			off_t offset = foffset(fp);
598 
599 			if (fl.l_start == 0 && fl.l_len < 0) {
600 				/* lockf(3) compliance hack */
601 				fl.l_len = -fl.l_len;
602 				fl.l_start = offset - fl.l_len;
603 			} else
604 				fl.l_start += offset;
605 		}
606 		if (fl.l_type != F_RDLCK &&
607 		    fl.l_type != F_WRLCK &&
608 		    fl.l_type != F_UNLCK &&
609 		    fl.l_type != 0) {
610 			error = EINVAL;
611 			break;
612 		}
613 		error = VOP_ADVLOCK(vp, fdp, F_GETLK, &fl, F_POSIX);
614 		if (error)
615 			break;
616 #ifdef KTRACE
617 		if (KTRPOINT(p, KTR_STRUCT))
618 			ktrflock(p, &fl);
619 #endif
620 		error = (copyout((caddr_t)&fl, (caddr_t)SCARG(uap, arg),
621 		    sizeof (fl)));
622 		break;
623 
624 	default:
625 		error = EINVAL;
626 		break;
627 	}
628 out:
629 	FRELE(fp, p);
630 	return (error);
631 }
632 
633 /*
634  * Common code for dup, dup2, and fcntl(F_DUPFD).
635  */
636 int
finishdup(struct proc * p,struct file * fp,int old,int new,register_t * retval,int dupflags)637 finishdup(struct proc *p, struct file *fp, int old, int new,
638     register_t *retval, int dupflags)
639 {
640 	struct file *oldfp;
641 	struct filedesc *fdp = p->p_fd;
642 	int error;
643 
644 	fdpassertlocked(fdp);
645 	KASSERT(fp->f_iflags & FIF_INSERTED);
646 
647 	if (fp->f_count >= FDUP_MAX_COUNT) {
648 		error = EDEADLK;
649 		goto fail;
650 	}
651 
652 	oldfp = fd_getfile(fdp, new);
653 	if ((dupflags & DUPF_DUP2) && oldfp == NULL) {
654 		if (fd_inuse(fdp, new)) {
655 			error = EBUSY;
656 			goto fail;
657 		}
658 		fd_used(fdp, new);
659 	}
660 
661 	/*
662 	 * Use `fd_fplock' to synchronize with fd_getfile() so that
663 	 * the function no longer creates a new reference to the old file.
664 	 */
665 	mtx_enter(&fdp->fd_fplock);
666 	fdp->fd_ofiles[new] = fp;
667 	mtx_leave(&fdp->fd_fplock);
668 
669 	fdp->fd_ofileflags[new] = fdp->fd_ofileflags[old] & ~UF_EXCLOSE;
670 	if (dupflags & DUPF_CLOEXEC)
671 		fdp->fd_ofileflags[new] |= UF_EXCLOSE;
672 	*retval = new;
673 
674 	if (oldfp != NULL) {
675 		knote_fdclose(p, new);
676 		fdpunlock(fdp);
677 		closef(oldfp, p);
678 	} else {
679 		fdpunlock(fdp);
680 	}
681 
682 	return (0);
683 
684 fail:
685 	fdpunlock(fdp);
686 	FRELE(fp, p);
687 	return (error);
688 }
689 
690 void
fdinsert(struct filedesc * fdp,int fd,int flags,struct file * fp)691 fdinsert(struct filedesc *fdp, int fd, int flags, struct file *fp)
692 {
693 	struct file *fq;
694 
695 	fdpassertlocked(fdp);
696 
697 	mtx_enter(&fhdlk);
698 	if ((fp->f_iflags & FIF_INSERTED) == 0) {
699 		atomic_setbits_int(&fp->f_iflags, FIF_INSERTED);
700 		if ((fq = fdp->fd_ofiles[0]) != NULL) {
701 			LIST_INSERT_AFTER(fq, fp, f_list);
702 		} else {
703 			LIST_INSERT_HEAD(&filehead, fp, f_list);
704 		}
705 	}
706 	mtx_leave(&fhdlk);
707 
708 	mtx_enter(&fdp->fd_fplock);
709 	KASSERT(fdp->fd_ofiles[fd] == NULL);
710 	fdp->fd_ofiles[fd] = fp;
711 	mtx_leave(&fdp->fd_fplock);
712 
713 	fdp->fd_ofileflags[fd] |= (flags & UF_EXCLOSE);
714 }
715 
716 void
fdremove(struct filedesc * fdp,int fd)717 fdremove(struct filedesc *fdp, int fd)
718 {
719 	fdpassertlocked(fdp);
720 
721 	/*
722 	 * Use `fd_fplock' to synchronize with fd_getfile() so that
723 	 * the function no longer creates a new reference to the file.
724 	 */
725 	mtx_enter(&fdp->fd_fplock);
726 	fdp->fd_ofiles[fd] = NULL;
727 	mtx_leave(&fdp->fd_fplock);
728 
729 	fdp->fd_ofileflags[fd] = 0;
730 
731 	fd_unused(fdp, fd);
732 }
733 
734 int
fdrelease(struct proc * p,int fd)735 fdrelease(struct proc *p, int fd)
736 {
737 	struct filedesc *fdp = p->p_fd;
738 	struct file *fp;
739 
740 	fdpassertlocked(fdp);
741 
742 	fp = fd_getfile(fdp, fd);
743 	if (fp == NULL) {
744 		fdpunlock(fdp);
745 		return (EBADF);
746 	}
747 	fdremove(fdp, fd);
748 	knote_fdclose(p, fd);
749 	fdpunlock(fdp);
750 	return (closef(fp, p));
751 }
752 
753 /*
754  * Close a file descriptor.
755  */
756 int
sys_close(struct proc * p,void * v,register_t * retval)757 sys_close(struct proc *p, void *v, register_t *retval)
758 {
759 	struct sys_close_args /* {
760 		syscallarg(int) fd;
761 	} */ *uap = v;
762 	int fd = SCARG(uap, fd), error;
763 	struct filedesc *fdp = p->p_fd;
764 
765 	fdplock(fdp);
766 	/* fdrelease unlocks fdp. */
767 	error = fdrelease(p, fd);
768 
769 	return (error);
770 }
771 
772 /*
773  * Return status information about a file descriptor.
774  */
775 int
sys_fstat(struct proc * p,void * v,register_t * retval)776 sys_fstat(struct proc *p, void *v, register_t *retval)
777 {
778 	struct sys_fstat_args /* {
779 		syscallarg(int) fd;
780 		syscallarg(struct stat *) sb;
781 	} */ *uap = v;
782 	int fd = SCARG(uap, fd);
783 	struct filedesc *fdp = p->p_fd;
784 	struct file *fp;
785 	struct stat ub;
786 	int error;
787 
788 	if ((fp = fd_getfile(fdp, fd)) == NULL)
789 		return (EBADF);
790 	error = (*fp->f_ops->fo_stat)(fp, &ub, p);
791 	FRELE(fp, p);
792 	if (error == 0) {
793 		/*
794 		 * Don't let non-root see generation numbers
795 		 * (for NFS security)
796 		 */
797 		if (suser(p))
798 			ub.st_gen = 0;
799 		error = copyout((caddr_t)&ub, (caddr_t)SCARG(uap, sb),
800 		    sizeof (ub));
801 	}
802 #ifdef KTRACE
803 	if (error == 0 && KTRPOINT(p, KTR_STRUCT))
804 		ktrstat(p, &ub);
805 #endif
806 	return (error);
807 }
808 
809 /*
810  * Return pathconf information about a file descriptor.
811  */
812 int
sys_fpathconf(struct proc * p,void * v,register_t * retval)813 sys_fpathconf(struct proc *p, void *v, register_t *retval)
814 {
815 	struct sys_fpathconf_args /* {
816 		syscallarg(int) fd;
817 		syscallarg(int) name;
818 	} */ *uap = v;
819 	int fd = SCARG(uap, fd);
820 	struct filedesc *fdp = p->p_fd;
821 	struct file *fp;
822 	struct vnode *vp;
823 	int error;
824 
825 	if ((fp = fd_getfile(fdp, fd)) == NULL)
826 		return (EBADF);
827 	switch (fp->f_type) {
828 	case DTYPE_PIPE:
829 	case DTYPE_SOCKET:
830 		if (SCARG(uap, name) != _PC_PIPE_BUF) {
831 			error = EINVAL;
832 			break;
833 		}
834 		*retval = PIPE_BUF;
835 		error = 0;
836 		break;
837 
838 	case DTYPE_VNODE:
839 		vp = fp->f_data;
840 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
841 		error = VOP_PATHCONF(vp, SCARG(uap, name), retval);
842 		VOP_UNLOCK(vp);
843 		break;
844 
845 	default:
846 		error = EOPNOTSUPP;
847 		break;
848 	}
849 	FRELE(fp, p);
850 	return (error);
851 }
852 
853 /*
854  * Allocate a file descriptor for the process.
855  */
856 int
fdalloc(struct proc * p,int want,int * result)857 fdalloc(struct proc *p, int want, int *result)
858 {
859 	struct filedesc *fdp = p->p_fd;
860 	int lim, last, i;
861 	u_int new, off;
862 
863 	fdpassertlocked(fdp);
864 
865 	/*
866 	 * Search for a free descriptor starting at the higher
867 	 * of want or fd_freefile.  If that fails, consider
868 	 * expanding the ofile array.
869 	 */
870 restart:
871 	lim = min((int)lim_cur(RLIMIT_NOFILE), atomic_load_int(&maxfiles));
872 	last = min(fdp->fd_nfiles, lim);
873 	if ((i = want) < fdp->fd_freefile)
874 		i = fdp->fd_freefile;
875 	off = i >> NDENTRYSHIFT;
876 	new = find_next_zero(fdp->fd_himap, off,
877 	    (last + NDENTRIES - 1) >> NDENTRYSHIFT);
878 	if (new != -1) {
879 		i = find_next_zero(&fdp->fd_lomap[new],
880 				   new > off ? 0 : i & NDENTRYMASK,
881 				   NDENTRIES);
882 		if (i == -1) {
883 			/*
884 			 * Free file descriptor in this block was
885 			 * below want, try again with higher want.
886 			 */
887 			want = (new + 1) << NDENTRYSHIFT;
888 			goto restart;
889 		}
890 		i += (new << NDENTRYSHIFT);
891 		if (i < last) {
892 			fd_used(fdp, i);
893 			if (want <= fdp->fd_freefile)
894 				fdp->fd_freefile = i;
895 			*result = i;
896 			fdp->fd_ofileflags[i] = 0;
897 			if (ISSET(p->p_p->ps_flags, PS_PLEDGE))
898 				fdp->fd_ofileflags[i] |= UF_PLEDGED;
899 			return (0);
900 		}
901 	}
902 	if (fdp->fd_nfiles >= lim)
903 		return (EMFILE);
904 
905 	return (ENOSPC);
906 }
907 
908 void
fdexpand(struct proc * p)909 fdexpand(struct proc *p)
910 {
911 	struct filedesc *fdp = p->p_fd;
912 	int nfiles, oldnfiles;
913 	size_t copylen;
914 	struct file **newofile, **oldofile;
915 	char *newofileflags;
916 	u_int *newhimap, *newlomap;
917 
918 	fdpassertlocked(fdp);
919 
920 	oldnfiles = fdp->fd_nfiles;
921 	oldofile = fdp->fd_ofiles;
922 
923 	/*
924 	 * No space in current array.
925 	 */
926 	if (fdp->fd_nfiles < NDEXTENT)
927 		nfiles = NDEXTENT;
928 	else
929 		nfiles = 2 * fdp->fd_nfiles;
930 
931 	newofile = mallocarray(nfiles, OFILESIZE, M_FILEDESC, M_WAITOK);
932 	/*
933 	 * Allocate all required chunks before calling free(9) to make
934 	 * sure that ``fd_ofiles'' stays valid if we go to sleep.
935 	 */
936 	if (NDHISLOTS(nfiles) > NDHISLOTS(fdp->fd_nfiles)) {
937 		newhimap = mallocarray(NDHISLOTS(nfiles), sizeof(u_int),
938 		    M_FILEDESC, M_WAITOK);
939 		newlomap = mallocarray(NDLOSLOTS(nfiles), sizeof(u_int),
940 		    M_FILEDESC, M_WAITOK);
941 	}
942 	newofileflags = (char *) &newofile[nfiles];
943 
944 	/*
945 	 * Copy the existing ofile and ofileflags arrays
946 	 * and zero the new portion of each array.
947 	 */
948 	copylen = sizeof(struct file *) * fdp->fd_nfiles;
949 	memcpy(newofile, fdp->fd_ofiles, copylen);
950 	memset((char *)newofile + copylen, 0,
951 	    nfiles * sizeof(struct file *) - copylen);
952 	copylen = sizeof(char) * fdp->fd_nfiles;
953 	memcpy(newofileflags, fdp->fd_ofileflags, copylen);
954 	memset(newofileflags + copylen, 0, nfiles * sizeof(char) - copylen);
955 
956 	if (NDHISLOTS(nfiles) > NDHISLOTS(fdp->fd_nfiles)) {
957 		copylen = NDHISLOTS(fdp->fd_nfiles) * sizeof(u_int);
958 		memcpy(newhimap, fdp->fd_himap, copylen);
959 		memset((char *)newhimap + copylen, 0,
960 		    NDHISLOTS(nfiles) * sizeof(u_int) - copylen);
961 
962 		copylen = NDLOSLOTS(fdp->fd_nfiles) * sizeof(u_int);
963 		memcpy(newlomap, fdp->fd_lomap, copylen);
964 		memset((char *)newlomap + copylen, 0,
965 		    NDLOSLOTS(nfiles) * sizeof(u_int) - copylen);
966 
967 		if (NDHISLOTS(fdp->fd_nfiles) > NDHISLOTS(NDFILE)) {
968 			free(fdp->fd_himap, M_FILEDESC,
969 			    NDHISLOTS(fdp->fd_nfiles) * sizeof(u_int));
970 			free(fdp->fd_lomap, M_FILEDESC,
971 			    NDLOSLOTS(fdp->fd_nfiles) * sizeof(u_int));
972 		}
973 		fdp->fd_himap = newhimap;
974 		fdp->fd_lomap = newlomap;
975 	}
976 
977 	mtx_enter(&fdp->fd_fplock);
978 	fdp->fd_ofiles = newofile;
979 	mtx_leave(&fdp->fd_fplock);
980 
981 	fdp->fd_ofileflags = newofileflags;
982 	fdp->fd_nfiles = nfiles;
983 
984 	if (oldnfiles > NDFILE)
985 		free(oldofile, M_FILEDESC, oldnfiles * OFILESIZE);
986 }
987 
988 /*
989  * Create a new open file structure and allocate
990  * a file descriptor for the process that refers to it.
991  */
992 int
falloc(struct proc * p,struct file ** resultfp,int * resultfd)993 falloc(struct proc *p, struct file **resultfp, int *resultfd)
994 {
995 	struct file *fp;
996 	int error, i;
997 
998 	KASSERT(resultfp != NULL);
999 	KASSERT(resultfd != NULL);
1000 
1001 	fdpassertlocked(p->p_fd);
1002 restart:
1003 	if ((error = fdalloc(p, 0, &i)) != 0) {
1004 		if (error == ENOSPC) {
1005 			fdexpand(p);
1006 			goto restart;
1007 		}
1008 		return (error);
1009 	}
1010 
1011 	fp = fnew(p);
1012 	if (fp == NULL) {
1013 		fd_unused(p->p_fd, i);
1014 		return (ENFILE);
1015 	}
1016 
1017 	FREF(fp);
1018 	*resultfp = fp;
1019 	*resultfd = i;
1020 
1021 	return (0);
1022 }
1023 
1024 struct file *
fnew(struct proc * p)1025 fnew(struct proc *p)
1026 {
1027 	struct file *fp;
1028 	int nfiles;
1029 
1030 	nfiles = atomic_inc_int_nv(&numfiles);
1031 	if (nfiles > atomic_load_int(&maxfiles)) {
1032 		atomic_dec_int(&numfiles);
1033 		tablefull("file");
1034 		return (NULL);
1035 	}
1036 
1037 	fp = pool_get(&file_pool, PR_WAITOK|PR_ZERO);
1038 	/*
1039 	 * We need to block interrupts as long as `f_mtx' is being taken
1040 	 * with and without the KERNEL_LOCK().
1041 	 */
1042 	mtx_init(&fp->f_mtx, IPL_MPFLOOR);
1043 	fp->f_count = 1;
1044 	fp->f_cred = p->p_ucred;
1045 	crhold(fp->f_cred);
1046 
1047 	return (fp);
1048 }
1049 
1050 /*
1051  * Build a new filedesc structure.
1052  */
1053 struct filedesc *
fdinit(void)1054 fdinit(void)
1055 {
1056 	struct filedesc0 *newfdp;
1057 
1058 	newfdp = pool_get(&fdesc_pool, PR_WAITOK|PR_ZERO);
1059 	rw_init(&newfdp->fd_fd.fd_lock, "fdlock");
1060 	mtx_init(&newfdp->fd_fd.fd_fplock, IPL_MPFLOOR);
1061 	LIST_INIT(&newfdp->fd_fd.fd_kqlist);
1062 
1063 	/* Create the file descriptor table. */
1064 	newfdp->fd_fd.fd_refcnt = 1;
1065 	newfdp->fd_fd.fd_cmask = S_IWGRP|S_IWOTH;
1066 	newfdp->fd_fd.fd_ofiles = newfdp->fd_dfiles;
1067 	newfdp->fd_fd.fd_ofileflags = newfdp->fd_dfileflags;
1068 	newfdp->fd_fd.fd_nfiles = NDFILE;
1069 	newfdp->fd_fd.fd_himap = newfdp->fd_dhimap;
1070 	newfdp->fd_fd.fd_lomap = newfdp->fd_dlomap;
1071 
1072 	newfdp->fd_fd.fd_freefile = 0;
1073 	newfdp->fd_fd.fd_lastfile = 0;
1074 
1075 	return (&newfdp->fd_fd);
1076 }
1077 
1078 /*
1079  * Share a filedesc structure.
1080  */
1081 struct filedesc *
fdshare(struct process * pr)1082 fdshare(struct process *pr)
1083 {
1084 	pr->ps_fd->fd_refcnt++;
1085 	return (pr->ps_fd);
1086 }
1087 
1088 /*
1089  * Copy a filedesc structure.
1090  */
1091 struct filedesc *
fdcopy(struct process * pr)1092 fdcopy(struct process *pr)
1093 {
1094 	struct filedesc *newfdp, *fdp = pr->ps_fd;
1095 	int i;
1096 
1097 	newfdp = fdinit();
1098 
1099 	fdplock(fdp);
1100 	if (fdp->fd_cdir) {
1101 		vref(fdp->fd_cdir);
1102 		newfdp->fd_cdir = fdp->fd_cdir;
1103 	}
1104 	if (fdp->fd_rdir) {
1105 		vref(fdp->fd_rdir);
1106 		newfdp->fd_rdir = fdp->fd_rdir;
1107 	}
1108 
1109 	/*
1110 	 * If the number of open files fits in the internal arrays
1111 	 * of the open file structure, use them, otherwise allocate
1112 	 * additional memory for the number of descriptors currently
1113 	 * in use.
1114 	 */
1115 	if (fdp->fd_lastfile >= NDFILE) {
1116 		/*
1117 		 * Compute the smallest multiple of NDEXTENT needed
1118 		 * for the file descriptors currently in use,
1119 		 * allowing the table to shrink.
1120 		 */
1121 		i = fdp->fd_nfiles;
1122 		while (i >= 2 * NDEXTENT && i > fdp->fd_lastfile * 2)
1123 			i /= 2;
1124 		newfdp->fd_ofiles = mallocarray(i, OFILESIZE, M_FILEDESC,
1125 		    M_WAITOK | M_ZERO);
1126 		newfdp->fd_ofileflags = (char *) &newfdp->fd_ofiles[i];
1127 		newfdp->fd_nfiles = i;
1128 	}
1129 	if (NDHISLOTS(newfdp->fd_nfiles) > NDHISLOTS(NDFILE)) {
1130 		newfdp->fd_himap = mallocarray(NDHISLOTS(newfdp->fd_nfiles),
1131 		    sizeof(u_int), M_FILEDESC, M_WAITOK | M_ZERO);
1132 		newfdp->fd_lomap = mallocarray(NDLOSLOTS(newfdp->fd_nfiles),
1133 		    sizeof(u_int), M_FILEDESC, M_WAITOK | M_ZERO);
1134 	}
1135 	newfdp->fd_freefile = fdp->fd_freefile;
1136 	newfdp->fd_flags = fdp->fd_flags;
1137 	newfdp->fd_cmask = fdp->fd_cmask;
1138 
1139 	for (i = 0; i <= fdp->fd_lastfile; i++) {
1140 		struct file *fp = fdp->fd_ofiles[i];
1141 
1142 		if (fp != NULL) {
1143 			/*
1144 			 * XXX Gruesome hack. If count gets too high, fail
1145 			 * to copy an fd, since fdcopy()'s callers do not
1146 			 * permit it to indicate failure yet.
1147 			 * Meanwhile, kqueue files have to be
1148 			 * tied to the process that opened them to enforce
1149 			 * their internal consistency, so close them here.
1150 			 */
1151 			if (fp->f_count >= FDUP_MAX_COUNT ||
1152 			    fp->f_type == DTYPE_KQUEUE) {
1153 				if (i < newfdp->fd_freefile)
1154 					newfdp->fd_freefile = i;
1155 				continue;
1156 			}
1157 
1158 			FREF(fp);
1159 			newfdp->fd_ofiles[i] = fp;
1160 			newfdp->fd_ofileflags[i] = fdp->fd_ofileflags[i];
1161 			fd_used(newfdp, i);
1162 		}
1163 	}
1164 	fdpunlock(fdp);
1165 
1166 	return (newfdp);
1167 }
1168 
1169 /*
1170  * Release a filedesc structure.
1171  */
1172 void
fdfree(struct proc * p)1173 fdfree(struct proc *p)
1174 {
1175 	struct filedesc *fdp = p->p_fd;
1176 	struct file *fp;
1177 	int fd;
1178 
1179 	if (--fdp->fd_refcnt > 0)
1180 		return;
1181 	for (fd = 0; fd <= fdp->fd_lastfile; fd++) {
1182 		fp = fdp->fd_ofiles[fd];
1183 		if (fp != NULL) {
1184 			fdp->fd_ofiles[fd] = NULL;
1185 			knote_fdclose(p, fd);
1186 			 /* closef() expects a refcount of 2 */
1187 			FREF(fp);
1188 			(void) closef(fp, p);
1189 		}
1190 	}
1191 	p->p_fd = NULL;
1192 	if (fdp->fd_nfiles > NDFILE)
1193 		free(fdp->fd_ofiles, M_FILEDESC, fdp->fd_nfiles * OFILESIZE);
1194 	if (NDHISLOTS(fdp->fd_nfiles) > NDHISLOTS(NDFILE)) {
1195 		free(fdp->fd_himap, M_FILEDESC,
1196 		    NDHISLOTS(fdp->fd_nfiles) * sizeof(u_int));
1197 		free(fdp->fd_lomap, M_FILEDESC,
1198 		    NDLOSLOTS(fdp->fd_nfiles) * sizeof(u_int));
1199 	}
1200 	if (fdp->fd_cdir)
1201 		vrele(fdp->fd_cdir);
1202 	if (fdp->fd_rdir)
1203 		vrele(fdp->fd_rdir);
1204 	pool_put(&fdesc_pool, fdp);
1205 }
1206 
1207 /*
1208  * Internal form of close.
1209  * Decrement reference count on file structure.
1210  * Note: p may be NULL when closing a file
1211  * that was being passed in a message.
1212  *
1213  * The fp must have its usecount bumped and will be FRELEd here.
1214  */
1215 int
closef(struct file * fp,struct proc * p)1216 closef(struct file *fp, struct proc *p)
1217 {
1218 	struct filedesc *fdp;
1219 
1220 	if (fp == NULL)
1221 		return (0);
1222 
1223 	KASSERTMSG(fp->f_count >= 2, "count (%u) < 2", fp->f_count);
1224 
1225 	atomic_dec_int(&fp->f_count);
1226 
1227 	/*
1228 	 * POSIX record locking dictates that any close releases ALL
1229 	 * locks owned by this process.  This is handled by setting
1230 	 * a flag in the unlock to free ONLY locks obeying POSIX
1231 	 * semantics, and not to free BSD-style file locks.
1232 	 * If the descriptor was in a message, POSIX-style locks
1233 	 * aren't passed with the descriptor.
1234 	 */
1235 
1236 	if (p && ((fdp = p->p_fd) != NULL) &&
1237 	    (fdp->fd_flags & FD_ADVLOCK) &&
1238 	    fp->f_type == DTYPE_VNODE) {
1239 		struct vnode *vp = fp->f_data;
1240 		struct flock lf;
1241 
1242 		lf.l_whence = SEEK_SET;
1243 		lf.l_start = 0;
1244 		lf.l_len = 0;
1245 		lf.l_type = F_UNLCK;
1246 		(void) VOP_ADVLOCK(vp, fdp, F_UNLCK, &lf, F_POSIX);
1247 	}
1248 
1249 	return (FRELE(fp, p));
1250 }
1251 
1252 int
fdrop(struct file * fp,struct proc * p)1253 fdrop(struct file *fp, struct proc *p)
1254 {
1255 	int error;
1256 
1257 	KASSERTMSG(fp->f_count == 0, "count (%u) != 0", fp->f_count);
1258 
1259 	mtx_enter(&fhdlk);
1260 	if (fp->f_iflags & FIF_INSERTED)
1261 		LIST_REMOVE(fp, f_list);
1262 	mtx_leave(&fhdlk);
1263 
1264 	if (fp->f_ops)
1265 		error = (*fp->f_ops->fo_close)(fp, p);
1266 	else
1267 		error = 0;
1268 
1269 	crfree(fp->f_cred);
1270 	atomic_dec_int(&numfiles);
1271 	pool_put(&file_pool, fp);
1272 
1273 	return (error);
1274 }
1275 
1276 /*
1277  * Apply an advisory lock on a file descriptor.
1278  *
1279  * Just attempt to get a record lock of the requested type on
1280  * the entire file (l_whence = SEEK_SET, l_start = 0, l_len = 0).
1281  */
1282 int
sys_flock(struct proc * p,void * v,register_t * retval)1283 sys_flock(struct proc *p, void *v, register_t *retval)
1284 {
1285 	struct sys_flock_args /* {
1286 		syscallarg(int) fd;
1287 		syscallarg(int) how;
1288 	} */ *uap = v;
1289 	int fd = SCARG(uap, fd);
1290 	int how = SCARG(uap, how);
1291 	struct filedesc *fdp = p->p_fd;
1292 	struct file *fp;
1293 	struct vnode *vp;
1294 	struct flock lf;
1295 	int error;
1296 
1297 	if ((fp = fd_getfile(fdp, fd)) == NULL)
1298 		return (EBADF);
1299 	if (fp->f_type != DTYPE_VNODE) {
1300 		error = EOPNOTSUPP;
1301 		goto out;
1302 	}
1303 	vp = fp->f_data;
1304 	lf.l_whence = SEEK_SET;
1305 	lf.l_start = 0;
1306 	lf.l_len = 0;
1307 	if (how & LOCK_UN) {
1308 		lf.l_type = F_UNLCK;
1309 		atomic_clearbits_int(&fp->f_iflags, FIF_HASLOCK);
1310 		error = VOP_ADVLOCK(vp, (caddr_t)fp, F_UNLCK, &lf, F_FLOCK);
1311 		goto out;
1312 	}
1313 	if (how & LOCK_EX)
1314 		lf.l_type = F_WRLCK;
1315 	else if (how & LOCK_SH)
1316 		lf.l_type = F_RDLCK;
1317 	else {
1318 		error = EINVAL;
1319 		goto out;
1320 	}
1321 	atomic_setbits_int(&fp->f_iflags, FIF_HASLOCK);
1322 	if (how & LOCK_NB)
1323 		error = VOP_ADVLOCK(vp, (caddr_t)fp, F_SETLK, &lf, F_FLOCK);
1324 	else
1325 		error = VOP_ADVLOCK(vp, (caddr_t)fp, F_SETLK, &lf, F_FLOCK|F_WAIT);
1326 out:
1327 	FRELE(fp, p);
1328 	return (error);
1329 }
1330 
1331 /*
1332  * File Descriptor pseudo-device driver (/dev/fd/).
1333  *
1334  * Opening minor device N dup()s the file (if any) connected to file
1335  * descriptor N belonging to the calling process.  Note that this driver
1336  * consists of only the ``open()'' routine, because all subsequent
1337  * references to this file will be direct to the other driver.
1338  */
1339 int
filedescopen(dev_t dev,int mode,int type,struct proc * p)1340 filedescopen(dev_t dev, int mode, int type, struct proc *p)
1341 {
1342 
1343 	/*
1344 	 * XXX Kludge: set curproc->p_dupfd to contain the value of the
1345 	 * the file descriptor being sought for duplication. The error
1346 	 * return ensures that the vnode for this device will be released
1347 	 * by vn_open. Open will detect this special error and take the
1348 	 * actions in dupfdopen below. Other callers of vn_open or VOP_OPEN
1349 	 * will simply report the error.
1350 	 */
1351 	p->p_dupfd = minor(dev);
1352 	return (ENODEV);
1353 }
1354 
1355 /*
1356  * Duplicate the specified descriptor to a free descriptor.
1357  */
1358 int
dupfdopen(struct proc * p,int indx,int mode)1359 dupfdopen(struct proc *p, int indx, int mode)
1360 {
1361 	struct filedesc *fdp = p->p_fd;
1362 	int dupfd = p->p_dupfd;
1363 	struct file *wfp;
1364 
1365 	fdpassertlocked(fdp);
1366 
1367 	/*
1368 	 * Assume that the filename was user-specified; applications do
1369 	 * not tend to open /dev/fd/# when they can just call dup()
1370 	 */
1371 	if ((p->p_p->ps_flags & (PS_SUGIDEXEC | PS_SUGID))) {
1372 		if (p->p_descfd == 255)
1373 			return (EPERM);
1374 		if (p->p_descfd != dupfd)
1375 			return (EPERM);
1376 	}
1377 
1378 	/*
1379 	 * If the to-be-dup'd fd number is greater than the allowed number
1380 	 * of file descriptors, or the fd to be dup'd has already been
1381 	 * closed, reject. Note, there is no need to check for new == old
1382 	 * because fd_getfile will return NULL if the file at indx is
1383 	 * newly created by falloc.
1384 	 */
1385 	if ((wfp = fd_getfile(fdp, dupfd)) == NULL)
1386 		return (EBADF);
1387 
1388 	/*
1389 	 * Check that the mode the file is being opened for is a
1390 	 * subset of the mode of the existing descriptor.
1391 	 */
1392 	if (((mode & (FREAD|FWRITE)) | wfp->f_flag) != wfp->f_flag) {
1393 		FRELE(wfp, p);
1394 		return (EACCES);
1395 	}
1396 	if (wfp->f_count >= FDUP_MAX_COUNT) {
1397 		FRELE(wfp, p);
1398 		return (EDEADLK);
1399 	}
1400 
1401 	KASSERT(wfp->f_iflags & FIF_INSERTED);
1402 
1403 	mtx_enter(&fdp->fd_fplock);
1404 	KASSERT(fdp->fd_ofiles[indx] == NULL);
1405 	fdp->fd_ofiles[indx] = wfp;
1406 	mtx_leave(&fdp->fd_fplock);
1407 
1408 	fdp->fd_ofileflags[indx] = (fdp->fd_ofileflags[indx] & UF_EXCLOSE) |
1409 	    (fdp->fd_ofileflags[dupfd] & ~UF_EXCLOSE);
1410 
1411 	return (0);
1412 }
1413 
1414 /*
1415  * Close any files on exec?
1416  */
1417 void
fdcloseexec(struct proc * p)1418 fdcloseexec(struct proc *p)
1419 {
1420 	struct filedesc *fdp = p->p_fd;
1421 	int fd;
1422 
1423 	fdplock(fdp);
1424 	for (fd = 0; fd <= fdp->fd_lastfile; fd++) {
1425 		fdp->fd_ofileflags[fd] &= ~UF_PLEDGED;
1426 		if (fdp->fd_ofileflags[fd] & UF_EXCLOSE) {
1427 			/* fdrelease() unlocks fdp. */
1428 			(void) fdrelease(p, fd);
1429 			fdplock(fdp);
1430 		}
1431 	}
1432 	fdpunlock(fdp);
1433 }
1434 
1435 int
sys_closefrom(struct proc * p,void * v,register_t * retval)1436 sys_closefrom(struct proc *p, void *v, register_t *retval)
1437 {
1438 	struct sys_closefrom_args *uap = v;
1439 	struct filedesc *fdp = p->p_fd;
1440 	u_int startfd, i;
1441 
1442 	startfd = SCARG(uap, fd);
1443 	fdplock(fdp);
1444 
1445 	if (startfd > fdp->fd_lastfile) {
1446 		fdpunlock(fdp);
1447 		return (EBADF);
1448 	}
1449 
1450 	for (i = startfd; i <= fdp->fd_lastfile; i++) {
1451 		/* fdrelease() unlocks fdp. */
1452 		fdrelease(p, i);
1453 		fdplock(fdp);
1454 	}
1455 
1456 	fdpunlock(fdp);
1457 	return (0);
1458 }
1459 
1460 int
sys_getdtablecount(struct proc * p,void * v,register_t * retval)1461 sys_getdtablecount(struct proc *p, void *v, register_t *retval)
1462 {
1463 	*retval = p->p_fd->fd_openfd;
1464 	return (0);
1465 }
1466