fcntl.c

   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 *  linux/fs/fcntl.c
   4 *
   5 *  Copyright (C) 1991, 1992  Linus Torvalds
   6 */
   7
   8#include <linux/syscalls.h>
   9#include <linux/init.h>
  10#include <linux/mm.h>
  11#include <linux/sched/task.h>
  12#include <linux/fs.h>
  13#include <linux/filelock.h>
  14#include <linux/file.h>
  15#include <linux/capability.h>
  16#include <linux/dnotify.h>
  17#include <linux/slab.h>
  18#include <linux/module.h>
  19#include <linux/pipe_fs_i.h>
  20#include <linux/security.h>
  21#include <linux/ptrace.h>
  22#include <linux/signal.h>
  23#include <linux/rcupdate.h>
  24#include <linux/pid_namespace.h>
  25#include <linux/user_namespace.h>
  26#include <linux/memfd.h>
  27#include <linux/compat.h>
  28#include <linux/mount.h>
  29#include <linux/rw_hint.h>
  30
  31#include <linux/poll.h>
  32#include <asm/siginfo.h>
  33#include <linux/uaccess.h>
  34
  35#include "internal.h"
  36
  37#define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME)
  38
  39static int setfl(int fd, struct file * filp, unsigned int arg)
  40{
  41	struct inode * inode = file_inode(filp);
  42	int error = 0;
  43
  44	/*
  45	 * O_APPEND cannot be cleared if the file is marked as append-only
  46	 * and the file is open for write.
  47	 */
  48	if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode))
  49		return -EPERM;
  50
  51	/* O_NOATIME can only be set by the owner or superuser */
  52	if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME))
  53		if (!inode_owner_or_capable(file_mnt_idmap(filp), inode))
  54			return -EPERM;
  55
  56	/* required for strict SunOS emulation */
  57	if (O_NONBLOCK != O_NDELAY)
  58	       if (arg & O_NDELAY)
  59		   arg |= O_NONBLOCK;
  60
  61	/* Pipe packetized mode is controlled by O_DIRECT flag */
  62	if (!S_ISFIFO(inode->i_mode) &&
  63	    (arg & O_DIRECT) &&
  64	    !(filp->f_mode & FMODE_CAN_ODIRECT))
  65		return -EINVAL;
  66
  67	if (filp->f_op->check_flags)
  68		error = filp->f_op->check_flags(arg);
  69	if (error)
  70		return error;
  71
  72	/*
  73	 * ->fasync() is responsible for setting the FASYNC bit.
  74	 */
  75	if (((arg ^ filp->f_flags) & FASYNC) && filp->f_op->fasync) {
  76		error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);
  77		if (error < 0)
  78			goto out;
  79		if (error > 0)
  80			error = 0;
  81	}
  82	spin_lock(&filp->f_lock);
  83	filp->f_flags = (arg & SETFL_MASK) | (filp->f_flags & ~SETFL_MASK);
  84	filp->f_iocb_flags = iocb_flags(filp);
  85	spin_unlock(&filp->f_lock);
  86
  87 out:
  88	return error;
  89}
  90
  91/*
  92 * Allocate an file->f_owner struct if it doesn't exist, handling racing
  93 * allocations correctly.
  94 */
  95int file_f_owner_allocate(struct file *file)
  96{
  97	struct fown_struct *f_owner;
  98
  99	f_owner = file_f_owner(file);
 100	if (f_owner)
 101		return 0;
 102
 103	f_owner = kzalloc(sizeof(struct fown_struct), GFP_KERNEL);
 104	if (!f_owner)
 105		return -ENOMEM;
 106
 107	rwlock_init(&f_owner->lock);
 108	f_owner->file = file;
 109	/* If someone else raced us, drop our allocation. */
 110	if (unlikely(cmpxchg(&file->f_owner, NULL, f_owner)))
 111		kfree(f_owner);
 112	return 0;
 113}
 114EXPORT_SYMBOL(file_f_owner_allocate);
 115
 116void file_f_owner_release(struct file *file)
 117{
 118	struct fown_struct *f_owner;
 119
 120	f_owner = file_f_owner(file);
 121	if (f_owner) {
 122		put_pid(f_owner->pid);
 123		kfree(f_owner);
 124	}
 125}
 126
 127void __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
 128		int force)
 129{
 130	struct fown_struct *f_owner;
 131
 132	f_owner = file_f_owner(filp);
 133	if (WARN_ON_ONCE(!f_owner))
 134		return;
 135
 136	write_lock_irq(&f_owner->lock);
 137	if (force || !f_owner->pid) {
 138		put_pid(f_owner->pid);
 139		f_owner->pid = get_pid(pid);
 140		f_owner->pid_type = type;
 141
 142		if (pid) {
 143			const struct cred *cred = current_cred();
 144			security_file_set_fowner(filp);
 145			f_owner->uid = cred->uid;
 146			f_owner->euid = cred->euid;
 147		}
 148	}
 149	write_unlock_irq(&f_owner->lock);
 150}
 151EXPORT_SYMBOL(__f_setown);
 152
 153int f_setown(struct file *filp, int who, int force)
 154{
 155	enum pid_type type;
 156	struct pid *pid = NULL;
 157	int ret = 0;
 158
 159	might_sleep();
 160
 161	type = PIDTYPE_TGID;
 162	if (who < 0) {
 163		/* avoid overflow below */
 164		if (who == INT_MIN)
 165			return -EINVAL;
 166
 167		type = PIDTYPE_PGID;
 168		who = -who;
 169	}
 170
 171	ret = file_f_owner_allocate(filp);
 172	if (ret)
 173		return ret;
 174
 175	rcu_read_lock();
 176	if (who) {
 177		pid = find_vpid(who);
 178		if (!pid)
 179			ret = -ESRCH;
 180	}
 181
 182	if (!ret)
 183		__f_setown(filp, pid, type, force);
 184	rcu_read_unlock();
 185
 186	return ret;
 187}
 188EXPORT_SYMBOL(f_setown);
 189
 190void f_delown(struct file *filp)
 191{
 192	__f_setown(filp, NULL, PIDTYPE_TGID, 1);
 193}
 194
 195pid_t f_getown(struct file *filp)
 196{
 197	pid_t pid = 0;
 198	struct fown_struct *f_owner;
 199
 200	f_owner = file_f_owner(filp);
 201	if (!f_owner)
 202		return pid;
 203
 204	read_lock_irq(&f_owner->lock);
 205	rcu_read_lock();
 206	if (pid_task(f_owner->pid, f_owner->pid_type)) {
 207		pid = pid_vnr(f_owner->pid);
 208		if (f_owner->pid_type == PIDTYPE_PGID)
 209			pid = -pid;
 210	}
 211	rcu_read_unlock();
 212	read_unlock_irq(&f_owner->lock);
 213	return pid;
 214}
 215
 216static int f_setown_ex(struct file *filp, unsigned long arg)
 217{
 218	struct f_owner_ex __user *owner_p = (void __user *)arg;
 219	struct f_owner_ex owner;
 220	struct pid *pid;
 221	int type;
 222	int ret;
 223
 224	ret = copy_from_user(&owner, owner_p, sizeof(owner));
 225	if (ret)
 226		return -EFAULT;
 227
 228	switch (owner.type) {
 229	case F_OWNER_TID:
 230		type = PIDTYPE_PID;
 231		break;
 232
 233	case F_OWNER_PID:
 234		type = PIDTYPE_TGID;
 235		break;
 236
 237	case F_OWNER_PGRP:
 238		type = PIDTYPE_PGID;
 239		break;
 240
 241	default:
 242		return -EINVAL;
 243	}
 244
 245	ret = file_f_owner_allocate(filp);
 246	if (ret)
 247		return ret;
 248
 249	rcu_read_lock();
 250	pid = find_vpid(owner.pid);
 251	if (owner.pid && !pid)
 252		ret = -ESRCH;
 253	else
 254		 __f_setown(filp, pid, type, 1);
 255	rcu_read_unlock();
 256
 257	return ret;
 258}
 259
 260static int f_getown_ex(struct file *filp, unsigned long arg)
 261{
 262	struct f_owner_ex __user *owner_p = (void __user *)arg;
 263	struct f_owner_ex owner = {};
 264	int ret = 0;
 265	struct fown_struct *f_owner;
 266	enum pid_type pid_type = PIDTYPE_PID;
 267
 268	f_owner = file_f_owner(filp);
 269	if (f_owner) {
 270		read_lock_irq(&f_owner->lock);
 271		rcu_read_lock();
 272		if (pid_task(f_owner->pid, f_owner->pid_type))
 273			owner.pid = pid_vnr(f_owner->pid);
 274		rcu_read_unlock();
 275		pid_type = f_owner->pid_type;
 276	}
 277
 278	switch (pid_type) {
 279	case PIDTYPE_PID:
 280		owner.type = F_OWNER_TID;
 281		break;
 282
 283	case PIDTYPE_TGID:
 284		owner.type = F_OWNER_PID;
 285		break;
 286
 287	case PIDTYPE_PGID:
 288		owner.type = F_OWNER_PGRP;
 289		break;
 290
 291	default:
 292		WARN_ON(1);
 293		ret = -EINVAL;
 294		break;
 295	}
 296	if (f_owner)
 297		read_unlock_irq(&f_owner->lock);
 298
 299	if (!ret) {
 300		ret = copy_to_user(owner_p, &owner, sizeof(owner));
 301		if (ret)
 302			ret = -EFAULT;
 303	}
 304	return ret;
 305}
 306
 307#ifdef CONFIG_CHECKPOINT_RESTORE
 308static int f_getowner_uids(struct file *filp, unsigned long arg)
 309{
 310	struct user_namespace *user_ns = current_user_ns();
 311	struct fown_struct *f_owner;
 312	uid_t __user *dst = (void __user *)arg;
 313	uid_t src[2] = {0, 0};
 314	int err;
 315
 316	f_owner = file_f_owner(filp);
 317	if (f_owner) {
 318		read_lock_irq(&f_owner->lock);
 319		src[0] = from_kuid(user_ns, f_owner->uid);
 320		src[1] = from_kuid(user_ns, f_owner->euid);
 321		read_unlock_irq(&f_owner->lock);
 322	}
 323
 324	err  = put_user(src[0], &dst[0]);
 325	err |= put_user(src[1], &dst[1]);
 326
 327	return err;
 328}
 329#else
 330static int f_getowner_uids(struct file *filp, unsigned long arg)
 331{
 332	return -EINVAL;
 333}
 334#endif
 335
 336static bool rw_hint_valid(u64 hint)
 337{
 338	BUILD_BUG_ON(WRITE_LIFE_NOT_SET != RWH_WRITE_LIFE_NOT_SET);
 339	BUILD_BUG_ON(WRITE_LIFE_NONE != RWH_WRITE_LIFE_NONE);
 340	BUILD_BUG_ON(WRITE_LIFE_SHORT != RWH_WRITE_LIFE_SHORT);
 341	BUILD_BUG_ON(WRITE_LIFE_MEDIUM != RWH_WRITE_LIFE_MEDIUM);
 342	BUILD_BUG_ON(WRITE_LIFE_LONG != RWH_WRITE_LIFE_LONG);
 343	BUILD_BUG_ON(WRITE_LIFE_EXTREME != RWH_WRITE_LIFE_EXTREME);
 344
 345	switch (hint) {
 346	case RWH_WRITE_LIFE_NOT_SET:
 347	case RWH_WRITE_LIFE_NONE:
 348	case RWH_WRITE_LIFE_SHORT:
 349	case RWH_WRITE_LIFE_MEDIUM:
 350	case RWH_WRITE_LIFE_LONG:
 351	case RWH_WRITE_LIFE_EXTREME:
 352		return true;
 353	default:
 354		return false;
 355	}
 356}
 357
 358static long fcntl_get_rw_hint(struct file *file, unsigned long arg)
 359{
 360	struct inode *inode = file_inode(file);
 361	u64 __user *argp = (u64 __user *)arg;
 362	u64 hint = READ_ONCE(inode->i_write_hint);
 363
 364	if (copy_to_user(argp, &hint, sizeof(*argp)))
 365		return -EFAULT;
 366	return 0;
 367}
 368
 369static long fcntl_set_rw_hint(struct file *file, unsigned long arg)
 370{
 371	struct inode *inode = file_inode(file);
 372	u64 __user *argp = (u64 __user *)arg;
 373	u64 hint;
 374
 375	if (!inode_owner_or_capable(file_mnt_idmap(file), inode))
 376		return -EPERM;
 377
 378	if (copy_from_user(&hint, argp, sizeof(hint)))
 379		return -EFAULT;
 380	if (!rw_hint_valid(hint))
 381		return -EINVAL;
 382
 383	WRITE_ONCE(inode->i_write_hint, hint);
 384
 385	/*
 386	 * file->f_mapping->host may differ from inode. As an example,
 387	 * blkdev_open() modifies file->f_mapping.
 388	 */
 389	if (file->f_mapping->host != inode)
 390		WRITE_ONCE(file->f_mapping->host->i_write_hint, hint);
 391
 392	return 0;
 393}
 394
 395/* Is the file descriptor a dup of the file? */
 396static long f_dupfd_query(int fd, struct file *filp)
 397{
 398	CLASS(fd_raw, f)(fd);
 399
 400	if (fd_empty(f))
 401		return -EBADF;
 402
 403	/*
 404	 * We can do the 'fdput()' immediately, as the only thing that
 405	 * matters is the pointer value which isn't changed by the fdput.
 406	 *
 407	 * Technically we didn't need a ref at all, and 'fdget()' was
 408	 * overkill, but given our lockless file pointer lookup, the
 409	 * alternatives are complicated.
 410	 */
 411	return fd_file(f) == filp;
 412}
 413
 414/* Let the caller figure out whether a given file was just created. */
 415static long f_created_query(const struct file *filp)
 416{
 417	return !!(filp->f_mode & FMODE_CREATED);
 418}
 419
 420static int f_owner_sig(struct file *filp, int signum, bool setsig)
 421{
 422	int ret = 0;
 423	struct fown_struct *f_owner;
 424
 425	might_sleep();
 426
 427	if (setsig) {
 428		if (!valid_signal(signum))
 429			return -EINVAL;
 430
 431		ret = file_f_owner_allocate(filp);
 432		if (ret)
 433			return ret;
 434	}
 435
 436	f_owner = file_f_owner(filp);
 437	if (setsig)
 438		f_owner->signum = signum;
 439	else if (f_owner)
 440		ret = f_owner->signum;
 441	return ret;
 442}
 443
 444static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
 445		struct file *filp)
 446{
 447	void __user *argp = (void __user *)arg;
 448	struct delegation deleg;
 449	int argi = (int)arg;
 450	struct flock flock;
 451	long err = -EINVAL;
 452
 453	switch (cmd) {
 454	case F_CREATED_QUERY:
 455		err = f_created_query(filp);
 456		break;
 457	case F_DUPFD:
 458		err = f_dupfd(argi, filp, 0);
 459		break;
 460	case F_DUPFD_CLOEXEC:
 461		err = f_dupfd(argi, filp, O_CLOEXEC);
 462		break;
 463	case F_DUPFD_QUERY:
 464		err = f_dupfd_query(argi, filp);
 465		break;
 466	case F_GETFD:
 467		err = get_close_on_exec(fd) ? FD_CLOEXEC : 0;
 468		break;
 469	case F_SETFD:
 470		err = 0;
 471		set_close_on_exec(fd, argi & FD_CLOEXEC);
 472		break;
 473	case F_GETFL:
 474		err = filp->f_flags;
 475		break;
 476	case F_SETFL:
 477		err = setfl(fd, filp, argi);
 478		break;
 479#if BITS_PER_LONG != 32
 480	/* 32-bit arches must use fcntl64() */
 481	case F_OFD_GETLK:
 482#endif
 483	case F_GETLK:
 484		if (copy_from_user(&flock, argp, sizeof(flock)))
 485			return -EFAULT;
 486		err = fcntl_getlk(filp, cmd, &flock);
 487		if (!err && copy_to_user(argp, &flock, sizeof(flock)))
 488			return -EFAULT;
 489		break;
 490#if BITS_PER_LONG != 32
 491	/* 32-bit arches must use fcntl64() */
 492	case F_OFD_SETLK:
 493	case F_OFD_SETLKW:
 494		fallthrough;
 495#endif
 496	case F_SETLK:
 497	case F_SETLKW:
 498		if (copy_from_user(&flock, argp, sizeof(flock)))
 499			return -EFAULT;
 500		err = fcntl_setlk(fd, filp, cmd, &flock);
 501		break;
 502	case F_GETOWN:
 503		/*
 504		 * XXX If f_owner is a process group, the
 505		 * negative return value will get converted
 506		 * into an error.  Oops.  If we keep the
 507		 * current syscall conventions, the only way
 508		 * to fix this will be in libc.
 509		 */
 510		err = f_getown(filp);
 511		force_successful_syscall_return();
 512		break;
 513	case F_SETOWN:
 514		err = f_setown(filp, argi, 1);
 515		break;
 516	case F_GETOWN_EX:
 517		err = f_getown_ex(filp, arg);
 518		break;
 519	case F_SETOWN_EX:
 520		err = f_setown_ex(filp, arg);
 521		break;
 522	case F_GETOWNER_UIDS:
 523		err = f_getowner_uids(filp, arg);
 524		break;
 525	case F_GETSIG:
 526		err = f_owner_sig(filp, 0, false);
 527		break;
 528	case F_SETSIG:
 529		err = f_owner_sig(filp, argi, true);
 530		break;
 531	case F_GETLEASE:
 532		err = fcntl_getlease(filp);
 533		break;
 534	case F_SETLEASE:
 535		err = fcntl_setlease(fd, filp, argi);
 536		break;
 537	case F_NOTIFY:
 538		err = fcntl_dirnotify(fd, filp, argi);
 539		break;
 540	case F_SETPIPE_SZ:
 541	case F_GETPIPE_SZ:
 542		err = pipe_fcntl(filp, cmd, argi);
 543		break;
 544	case F_ADD_SEALS:
 545	case F_GET_SEALS:
 546		err = memfd_fcntl(filp, cmd, argi);
 547		break;
 548	case F_GET_RW_HINT:
 549		err = fcntl_get_rw_hint(filp, arg);
 550		break;
 551	case F_SET_RW_HINT:
 552		err = fcntl_set_rw_hint(filp, arg);
 553		break;
 554	case F_GETDELEG:
 555		if (copy_from_user(&deleg, argp, sizeof(deleg)))
 556			return -EFAULT;
 557		err = fcntl_getdeleg(filp, &deleg);
 558		if (!err && copy_to_user(argp, &deleg, sizeof(deleg)))
 559			return -EFAULT;
 560		break;
 561	case F_SETDELEG:
 562		if (copy_from_user(&deleg, argp, sizeof(deleg)))
 563			return -EFAULT;
 564		err = fcntl_setdeleg(fd, filp, &deleg);
 565		break;
 566	default:
 567		break;
 568	}
 569	return err;
 570}
 571
 572static int check_fcntl_cmd(unsigned cmd)
 573{
 574	switch (cmd) {
 575	case F_CREATED_QUERY:
 576	case F_DUPFD:
 577	case F_DUPFD_CLOEXEC:
 578	case F_DUPFD_QUERY:
 579	case F_GETFD:
 580	case F_SETFD:
 581	case F_GETFL:
 582		return 1;
 583	}
 584	return 0;
 585}
 586
 587SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
 588{	
 589	CLASS(fd_raw, f)(fd);
 590	long err;
 591
 592	if (fd_empty(f))
 593		return -EBADF;
 594
 595	if (unlikely(fd_file(f)->f_mode & FMODE_PATH)) {
 596		if (!check_fcntl_cmd(cmd))
 597			return -EBADF;
 598	}
 599
 600	err = security_file_fcntl(fd_file(f), cmd, arg);
 601	if (!err)
 602		err = do_fcntl(fd, cmd, arg, fd_file(f));
 603
 604	return err;
 605}
 606
 607#if BITS_PER_LONG == 32
 608SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
 609		unsigned long, arg)
 610{	
 611	void __user *argp = (void __user *)arg;
 612	CLASS(fd_raw, f)(fd);
 613	struct flock64 flock;
 614	long err;
 615
 616	if (fd_empty(f))
 617		return -EBADF;
 618
 619	if (unlikely(fd_file(f)->f_mode & FMODE_PATH)) {
 620		if (!check_fcntl_cmd(cmd))
 621			return -EBADF;
 622	}
 623
 624	err = security_file_fcntl(fd_file(f), cmd, arg);
 625	if (err)
 626		return err;
 627	
 628	switch (cmd) {
 629	case F_GETLK64:
 630	case F_OFD_GETLK:
 631		err = -EFAULT;
 632		if (copy_from_user(&flock, argp, sizeof(flock)))
 633			break;
 634		err = fcntl_getlk64(fd_file(f), cmd, &flock);
 635		if (!err && copy_to_user(argp, &flock, sizeof(flock)))
 636			err = -EFAULT;
 637		break;
 638	case F_SETLK64:
 639	case F_SETLKW64:
 640	case F_OFD_SETLK:
 641	case F_OFD_SETLKW:
 642		err = -EFAULT;
 643		if (copy_from_user(&flock, argp, sizeof(flock)))
 644			break;
 645		err = fcntl_setlk64(fd, fd_file(f), cmd, &flock);
 646		break;
 647	default:
 648		err = do_fcntl(fd, cmd, arg, fd_file(f));
 649		break;
 650	}
 651	return err;
 652}
 653#endif
 654
 655#ifdef CONFIG_COMPAT
 656/* careful - don't use anywhere else */
 657#define copy_flock_fields(dst, src)		\
 658	(dst)->l_type = (src)->l_type;		\
 659	(dst)->l_whence = (src)->l_whence;	\
 660	(dst)->l_start = (src)->l_start;	\
 661	(dst)->l_len = (src)->l_len;		\
 662	(dst)->l_pid = (src)->l_pid;
 663
 664static int get_compat_flock(struct flock *kfl, const struct compat_flock __user *ufl)
 665{
 666	struct compat_flock fl;
 667
 668	if (copy_from_user(&fl, ufl, sizeof(struct compat_flock)))
 669		return -EFAULT;
 670	copy_flock_fields(kfl, &fl);
 671	return 0;
 672}
 673
 674static int get_compat_flock64(struct flock *kfl, const struct compat_flock64 __user *ufl)
 675{
 676	struct compat_flock64 fl;
 677
 678	if (copy_from_user(&fl, ufl, sizeof(struct compat_flock64)))
 679		return -EFAULT;
 680	copy_flock_fields(kfl, &fl);
 681	return 0;
 682}
 683
 684static int put_compat_flock(const struct flock *kfl, struct compat_flock __user *ufl)
 685{
 686	struct compat_flock fl;
 687
 688	memset(&fl, 0, sizeof(struct compat_flock));
 689	copy_flock_fields(&fl, kfl);
 690	if (copy_to_user(ufl, &fl, sizeof(struct compat_flock)))
 691		return -EFAULT;
 692	return 0;
 693}
 694
 695static int put_compat_flock64(const struct flock *kfl, struct compat_flock64 __user *ufl)
 696{
 697	struct compat_flock64 fl;
 698
 699	BUILD_BUG_ON(sizeof(kfl->l_start) > sizeof(ufl->l_start));
 700	BUILD_BUG_ON(sizeof(kfl->l_len) > sizeof(ufl->l_len));
 701
 702	memset(&fl, 0, sizeof(struct compat_flock64));
 703	copy_flock_fields(&fl, kfl);
 704	if (copy_to_user(ufl, &fl, sizeof(struct compat_flock64)))
 705		return -EFAULT;
 706	return 0;
 707}
 708#undef copy_flock_fields
 709
 710static unsigned int
 711convert_fcntl_cmd(unsigned int cmd)
 712{
 713	switch (cmd) {
 714	case F_GETLK64:
 715		return F_GETLK;
 716	case F_SETLK64:
 717		return F_SETLK;
 718	case F_SETLKW64:
 719		return F_SETLKW;
 720	}
 721
 722	return cmd;
 723}
 724
 725/*
 726 * GETLK was successful and we need to return the data, but it needs to fit in
 727 * the compat structure.
 728 * l_start shouldn't be too big, unless the original start + end is greater than
 729 * COMPAT_OFF_T_MAX, in which case the app was asking for trouble, so we return
 730 * -EOVERFLOW in that case.  l_len could be too big, in which case we just
 731 * truncate it, and only allow the app to see that part of the conflicting lock
 732 * that might make sense to it anyway
 733 */
 734static int fixup_compat_flock(struct flock *flock)
 735{
 736	if (flock->l_start > COMPAT_OFF_T_MAX)
 737		return -EOVERFLOW;
 738	if (flock->l_len > COMPAT_OFF_T_MAX)
 739		flock->l_len = COMPAT_OFF_T_MAX;
 740	return 0;
 741}
 742
 743static long do_compat_fcntl64(unsigned int fd, unsigned int cmd,
 744			     compat_ulong_t arg)
 745{
 746	CLASS(fd_raw, f)(fd);
 747	struct flock flock;
 748	long err;
 749
 750	if (fd_empty(f))
 751		return -EBADF;
 752
 753	if (unlikely(fd_file(f)->f_mode & FMODE_PATH)) {
 754		if (!check_fcntl_cmd(cmd))
 755			return -EBADF;
 756	}
 757
 758	err = security_file_fcntl(fd_file(f), cmd, arg);
 759	if (err)
 760		return err;
 761
 762	switch (cmd) {
 763	case F_GETLK:
 764		err = get_compat_flock(&flock, compat_ptr(arg));
 765		if (err)
 766			break;
 767		err = fcntl_getlk(fd_file(f), convert_fcntl_cmd(cmd), &flock);
 768		if (err)
 769			break;
 770		err = fixup_compat_flock(&flock);
 771		if (!err)
 772			err = put_compat_flock(&flock, compat_ptr(arg));
 773		break;
 774	case F_GETLK64:
 775	case F_OFD_GETLK:
 776		err = get_compat_flock64(&flock, compat_ptr(arg));
 777		if (err)
 778			break;
 779		err = fcntl_getlk(fd_file(f), convert_fcntl_cmd(cmd), &flock);
 780		if (!err)
 781			err = put_compat_flock64(&flock, compat_ptr(arg));
 782		break;
 783	case F_SETLK:
 784	case F_SETLKW:
 785		err = get_compat_flock(&flock, compat_ptr(arg));
 786		if (err)
 787			break;
 788		err = fcntl_setlk(fd, fd_file(f), convert_fcntl_cmd(cmd), &flock);
 789		break;
 790	case F_SETLK64:
 791	case F_SETLKW64:
 792	case F_OFD_SETLK:
 793	case F_OFD_SETLKW:
 794		err = get_compat_flock64(&flock, compat_ptr(arg));
 795		if (err)
 796			break;
 797		err = fcntl_setlk(fd, fd_file(f), convert_fcntl_cmd(cmd), &flock);
 798		break;
 799	default:
 800		err = do_fcntl(fd, cmd, arg, fd_file(f));
 801		break;
 802	}
 803	return err;
 804}
 805
 806COMPAT_SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
 807		       compat_ulong_t, arg)
 808{
 809	return do_compat_fcntl64(fd, cmd, arg);
 810}
 811
 812COMPAT_SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd,
 813		       compat_ulong_t, arg)
 814{
 815	switch (cmd) {
 816	case F_GETLK64:
 817	case F_SETLK64:
 818	case F_SETLKW64:
 819	case F_OFD_GETLK:
 820	case F_OFD_SETLK:
 821	case F_OFD_SETLKW:
 822		return -EINVAL;
 823	}
 824	return do_compat_fcntl64(fd, cmd, arg);
 825}
 826#endif
 827
 828/* Table to convert sigio signal codes into poll band bitmaps */
 829
 830static const __poll_t band_table[NSIGPOLL] = {
 831	EPOLLIN | EPOLLRDNORM,			/* POLL_IN */
 832	EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND,	/* POLL_OUT */
 833	EPOLLIN | EPOLLRDNORM | EPOLLMSG,		/* POLL_MSG */
 834	EPOLLERR,				/* POLL_ERR */
 835	EPOLLPRI | EPOLLRDBAND,			/* POLL_PRI */
 836	EPOLLHUP | EPOLLERR			/* POLL_HUP */
 837};
 838
 839static inline int sigio_perm(struct task_struct *p,
 840                             struct fown_struct *fown, int sig)
 841{
 842	const struct cred *cred;
 843	int ret;
 844
 845	rcu_read_lock();
 846	cred = __task_cred(p);
 847	ret = ((uid_eq(fown->euid, GLOBAL_ROOT_UID) ||
 848		uid_eq(fown->euid, cred->suid) || uid_eq(fown->euid, cred->uid) ||
 849		uid_eq(fown->uid,  cred->suid) || uid_eq(fown->uid,  cred->uid)) &&
 850	       !security_file_send_sigiotask(p, fown, sig));
 851	rcu_read_unlock();
 852	return ret;
 853}
 854
 855static void send_sigio_to_task(struct task_struct *p,
 856			       struct fown_struct *fown,
 857			       int fd, int reason, enum pid_type type)
 858{
 859	/*
 860	 * F_SETSIG can change ->signum lockless in parallel, make
 861	 * sure we read it once and use the same value throughout.
 862	 */
 863	int signum = READ_ONCE(fown->signum);
 864
 865	if (!sigio_perm(p, fown, signum))
 866		return;
 867
 868	switch (signum) {
 869		default: {
 870			kernel_siginfo_t si;
 871
 872			/* Queue a rt signal with the appropriate fd as its
 873			   value.  We use SI_SIGIO as the source, not 
 874			   SI_KERNEL, since kernel signals always get 
 875			   delivered even if we can't queue.  Failure to
 876			   queue in this case _should_ be reported; we fall
 877			   back to SIGIO in that case. --sct */
 878			clear_siginfo(&si);
 879			si.si_signo = signum;
 880			si.si_errno = 0;
 881		        si.si_code  = reason;
 882			/*
 883			 * Posix definies POLL_IN and friends to be signal
 884			 * specific si_codes for SIG_POLL.  Linux extended
 885			 * these si_codes to other signals in a way that is
 886			 * ambiguous if other signals also have signal
 887			 * specific si_codes.  In that case use SI_SIGIO instead
 888			 * to remove the ambiguity.
 889			 */
 890			if ((signum != SIGPOLL) && sig_specific_sicodes(signum))
 891				si.si_code = SI_SIGIO;
 892
 893			/* Make sure we are called with one of the POLL_*
 894			   reasons, otherwise we could leak kernel stack into
 895			   userspace.  */
 896			BUG_ON((reason < POLL_IN) || ((reason - POLL_IN) >= NSIGPOLL));
 897			if (reason - POLL_IN >= NSIGPOLL)
 898				si.si_band  = ~0L;
 899			else
 900				si.si_band = mangle_poll(band_table[reason - POLL_IN]);
 901			si.si_fd    = fd;
 902			if (!do_send_sig_info(signum, &si, p, type))
 903				break;
 904		}
 905			fallthrough;	/* fall back on the old plain SIGIO signal */
 906		case 0:
 907			do_send_sig_info(SIGIO, SEND_SIG_PRIV, p, type);
 908	}
 909}
 910
 911void send_sigio(struct fown_struct *fown, int fd, int band)
 912{
 913	struct task_struct *p;
 914	enum pid_type type;
 915	unsigned long flags;
 916	struct pid *pid;
 917	
 918	read_lock_irqsave(&fown->lock, flags);
 919
 920	type = fown->pid_type;
 921	pid = fown->pid;
 922	if (!pid)
 923		goto out_unlock_fown;
 924
 925	if (type <= PIDTYPE_TGID) {
 926		rcu_read_lock();
 927		p = pid_task(pid, PIDTYPE_PID);
 928		if (p)
 929			send_sigio_to_task(p, fown, fd, band, type);
 930		rcu_read_unlock();
 931	} else {
 932		read_lock(&tasklist_lock);
 933		do_each_pid_task(pid, type, p) {
 934			send_sigio_to_task(p, fown, fd, band, type);
 935		} while_each_pid_task(pid, type, p);
 936		read_unlock(&tasklist_lock);
 937	}
 938 out_unlock_fown:
 939	read_unlock_irqrestore(&fown->lock, flags);
 940}
 941
 942static void send_sigurg_to_task(struct task_struct *p,
 943				struct fown_struct *fown, enum pid_type type)
 944{
 945	if (sigio_perm(p, fown, SIGURG))
 946		do_send_sig_info(SIGURG, SEND_SIG_PRIV, p, type);
 947}
 948
 949int send_sigurg(struct file *file)
 950{
 951	struct fown_struct *fown;
 952	struct task_struct *p;
 953	enum pid_type type;
 954	struct pid *pid;
 955	unsigned long flags;
 956	int ret = 0;
 957	
 958	fown = file_f_owner(file);
 959	if (!fown)
 960		return 0;
 961
 962	read_lock_irqsave(&fown->lock, flags);
 963
 964	type = fown->pid_type;
 965	pid = fown->pid;
 966	if (!pid)
 967		goto out_unlock_fown;
 968
 969	ret = 1;
 970
 971	if (type <= PIDTYPE_TGID) {
 972		rcu_read_lock();
 973		p = pid_task(pid, PIDTYPE_PID);
 974		if (p)
 975			send_sigurg_to_task(p, fown, type);
 976		rcu_read_unlock();
 977	} else {
 978		read_lock(&tasklist_lock);
 979		do_each_pid_task(pid, type, p) {
 980			send_sigurg_to_task(p, fown, type);
 981		} while_each_pid_task(pid, type, p);
 982		read_unlock(&tasklist_lock);
 983	}
 984 out_unlock_fown:
 985	read_unlock_irqrestore(&fown->lock, flags);
 986	return ret;
 987}
 988
 989static DEFINE_SPINLOCK(fasync_lock);
 990static struct kmem_cache *fasync_cache __ro_after_init;
 991
 992/*
 993 * Remove a fasync entry. If successfully removed, return
 994 * positive and clear the FASYNC flag. If no entry exists,
 995 * do nothing and return 0.
 996 *
 997 * NOTE! It is very important that the FASYNC flag always
 998 * match the state "is the filp on a fasync list".
 999 *
1000 */
1001int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
1002{
1003	struct fasync_struct *fa, **fp;
1004	int result = 0;
1005
1006	spin_lock(&filp->f_lock);
1007	spin_lock(&fasync_lock);
1008	for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
1009		if (fa->fa_file != filp)
1010			continue;
1011
1012		write_lock_irq(&fa->fa_lock);
1013		fa->fa_file = NULL;
1014		write_unlock_irq(&fa->fa_lock);
1015
1016		*fp = fa->fa_next;
1017		kfree_rcu(fa, fa_rcu);
1018		filp->f_flags &= ~FASYNC;
1019		result = 1;
1020		break;
1021	}
1022	spin_unlock(&fasync_lock);
1023	spin_unlock(&filp->f_lock);
1024	return result;
1025}
1026
1027struct fasync_struct *fasync_alloc(void)
1028{
1029	return kmem_cache_alloc(fasync_cache, GFP_KERNEL);
1030}
1031
1032/*
1033 * NOTE! This can be used only for unused fasync entries:
1034 * entries that actually got inserted on the fasync list
1035 * need to be released by rcu - see fasync_remove_entry.
1036 */
1037void fasync_free(struct fasync_struct *new)
1038{
1039	kmem_cache_free(fasync_cache, new);
1040}
1041
1042/*
1043 * Insert a new entry into the fasync list.  Return the pointer to the
1044 * old one if we didn't use the new one.
1045 *
1046 * NOTE! It is very important that the FASYNC flag always
1047 * match the state "is the filp on a fasync list".
1048 */
1049struct fasync_struct *fasync_insert_entry(int fd, struct file *filp, struct fasync_struct **fapp, struct fasync_struct *new)
1050{
1051        struct fasync_struct *fa, **fp;
1052
1053	spin_lock(&filp->f_lock);
1054	spin_lock(&fasync_lock);
1055	for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
1056		if (fa->fa_file != filp)
1057			continue;
1058
1059		write_lock_irq(&fa->fa_lock);
1060		fa->fa_fd = fd;
1061		write_unlock_irq(&fa->fa_lock);
1062		goto out;
1063	}
1064
1065	rwlock_init(&new->fa_lock);
1066	new->magic = FASYNC_MAGIC;
1067	new->fa_file = filp;
1068	new->fa_fd = fd;
1069	new->fa_next = *fapp;
1070	rcu_assign_pointer(*fapp, new);
1071	filp->f_flags |= FASYNC;
1072
1073out:
1074	spin_unlock(&fasync_lock);
1075	spin_unlock(&filp->f_lock);
1076	return fa;
1077}
1078
1079/*
1080 * Add a fasync entry. Return negative on error, positive if
1081 * added, and zero if did nothing but change an existing one.
1082 */
1083static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)
1084{
1085	struct fasync_struct *new;
1086
1087	new = fasync_alloc();
1088	if (!new)
1089		return -ENOMEM;
1090
1091	/*
1092	 * fasync_insert_entry() returns the old (update) entry if
1093	 * it existed.
1094	 *
1095	 * So free the (unused) new entry and return 0 to let the
1096	 * caller know that we didn't add any new fasync entries.
1097	 */
1098	if (fasync_insert_entry(fd, filp, fapp, new)) {
1099		fasync_free(new);
1100		return 0;
1101	}
1102
1103	return 1;
1104}
1105
1106/*
1107 * fasync_helper() is used by almost all character device drivers
1108 * to set up the fasync queue, and for regular files by the file
1109 * lease code. It returns negative on error, 0 if it did no changes
1110 * and positive if it added/deleted the entry.
1111 */
1112int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
1113{
1114	if (!on)
1115		return fasync_remove_entry(filp, fapp);
1116	return fasync_add_entry(fd, filp, fapp);
1117}
1118
1119EXPORT_SYMBOL(fasync_helper);
1120
1121/*
1122 * rcu_read_lock() is held
1123 */
1124static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
1125{
1126	while (fa) {
1127		struct fown_struct *fown;
1128		unsigned long flags;
1129
1130		if (fa->magic != FASYNC_MAGIC) {
1131			printk(KERN_ERR "kill_fasync: bad magic number in "
1132			       "fasync_struct!\n");
1133			return;
1134		}
1135		read_lock_irqsave(&fa->fa_lock, flags);
1136		if (fa->fa_file) {
1137			fown = file_f_owner(fa->fa_file);
1138			if (!fown)
1139				goto next;
1140			/* Don't send SIGURG to processes which have not set a
1141			   queued signum: SIGURG has its own default signalling
1142			   mechanism. */
1143			if (!(sig == SIGURG && fown->signum == 0))
1144				send_sigio(fown, fa->fa_fd, band);
1145		}
1146next:
1147		read_unlock_irqrestore(&fa->fa_lock, flags);
1148		fa = rcu_dereference(fa->fa_next);
1149	}
1150}
1151
1152void kill_fasync(struct fasync_struct **fp, int sig, int band)
1153{
1154	/* First a quick test without locking: usually
1155	 * the list is empty.
1156	 */
1157	if (*fp) {
1158		rcu_read_lock();
1159		kill_fasync_rcu(rcu_dereference(*fp), sig, band);
1160		rcu_read_unlock();
1161	}
1162}
1163EXPORT_SYMBOL(kill_fasync);
1164
1165static int __init fcntl_init(void)
1166{
1167	/*
1168	 * Please add new bits here to ensure allocation uniqueness.
1169	 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
1170	 * is defined as O_NONBLOCK on some platforms and not on others.
1171	 */
1172	BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ !=
1173		HWEIGHT32(
1174			(VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) |
1175			__FMODE_EXEC));
1176
1177	fasync_cache = kmem_cache_create("fasync_cache",
1178					 sizeof(struct fasync_struct), 0,
1179					 SLAB_PANIC | SLAB_ACCOUNT, NULL);
1180	return 0;
1181}
1182
1183module_init(fcntl_init)