3  *  linux/fs/file.c
17 #include <linux/file.h>
36 	if (WARN_ONCE(cnt >= FILE_REF_RELEASED, "imbalanced put on file reference count")) {  in __file_ref_put_badval()
121  * space if any.  This does not copy the file pointers.  Called with the files
138  * Copy all file descriptors from the old table to the new, expanded table and
147 	cpy = ofdt->max_fds * sizeof(struct file *);  in copy_fdtable()
148 	set = (nfdt->max_fds - ofdt->max_fds) * sizeof(struct file *);  in copy_fdtable()
206 	 * a process tries to use a file descriptor near that limit. For example,  in alloc_fdtable()
208 	 * systemd typically sets it to - then trying to use a file descriptor  in alloc_fdtable()
209 	 * close to that value will require allocating a file descriptor table  in alloc_fdtable()
212 	if (unlikely(nr > INT_MAX / sizeof(struct file *)))  in alloc_fdtable()
219 	data = kvmalloc_array(nr, sizeof(struct file *), GFP_KERNEL_ACCOUNT);  in alloc_fdtable()
246  * Expand the file descriptor table.
283  * This function will expand the file structures, if the requested size exceeds
386 	struct file **old_fds, **new_fds;  in dup_fd()
447 	 * the file can show up as we are walking the array below.  in dup_fd()
453 	 * ref the file if we see it and mark the fd slot as unused otherwise.  in dup_fd()
456 		struct file *f = rcu_dereference_raw(*old_fds++);  in dup_fd()
467 	memset(new_fds, 0, (new_fdt->max_fds - open_files) * sizeof(struct file *));  in dup_fd()
492 				struct file *file = fdt->fd[i];  in close_files()  local
493 				if (file) {  in close_files()
494 					filp_close(file, files);  in close_files()
568  * allocate a file descriptor, mark it busy.
645  * fd_install - install a file pointer in the fd array
646  * @fd: file descriptor to install the file in
647  * @file: the file to install
649  * This consumes the "file" refcount, so callers should treat it
650  * as if they had called fput(file).
652 void fd_install(unsigned int fd, struct file *file)  in fd_install()  argument
657 	if (WARN_ON_ONCE(unlikely(file->f_mode & FMODE_BACKING)))  in fd_install()
667 		rcu_assign_pointer(fdt->fd[fd], file);  in fd_install()
675 	rcu_assign_pointer(fdt->fd[fd], file);  in fd_install()
682  * file_close_fd_locked - return file associated with fd
683  * @files: file struct to retrieve file from
684  * @fd: file descriptor to retrieve file for
690  * Returns: The file associated with @fd (NULL if @fd is not open)
692 struct file *file_close_fd_locked(struct files_struct *files, unsigned fd)  in file_close_fd_locked()
695 	struct file *file;  in file_close_fd_locked()  local
703 	file = rcu_dereference_raw(fdt->fd[fd]);  in file_close_fd_locked()
704 	if (file) {  in file_close_fd_locked()
708 	return file;  in file_close_fd_locked()
714 	struct file *file;  in close_fd()  local
717 	file = file_close_fd_locked(files, fd);  in close_fd()
719 	if (!file)  in close_fd()
722 	return filp_close(file, files);  in close_fd()
728  * @fdt: File descriptor table.
756 	struct file *file;  in __range_close()  local
764 		file = file_close_fd_locked(files, fd);  in __range_close()
765 		if (file) {  in __range_close()
767 			filp_close(file, files);  in __range_close()
780  * sys_close_range() - Close all file descriptors in a given range.
782  * @fd:     starting file descriptor to close
783  * @max_fd: last file descriptor to close
786  * This closes a range of file descriptors. All file descriptors
788  * Currently, errors to close a given file descriptor are ignored.
807 		 * copy all of the file descriptors since they still want to  in SYSCALL_DEFINE3()
817 		 * We used to share our file descriptor table, and have now  in SYSCALL_DEFINE3()
831 		 * the new file descriptor table and drop the old one.  in SYSCALL_DEFINE3()
843  * file_close_fd - return file associated with fd
844  * @fd: file descriptor to retrieve file for
848  * Returns: The file associated with @fd (NULL if @fd is not open)
850 struct file *file_close_fd(unsigned int fd)  in file_close_fd()
853 	struct file *file;  in file_close_fd()  local
856 	file = file_close_fd_locked(files, fd);  in file_close_fd()
859 	return file;  in file_close_fd()
880 			struct file *file;  in do_close_on_exec()  local
883 			file = fdt->fd[fd];  in do_close_on_exec()
884 			if (!file)  in do_close_on_exec()
889 			filp_close(file, files);  in do_close_on_exec()
898 static struct file *__get_file_rcu(struct file __rcu **f)  in __get_file_rcu()
900 	struct file __rcu *file;  in __get_file_rcu()  local
901 	struct file __rcu *file_reloaded;  in __get_file_rcu()
902 	struct file __rcu *file_reloaded_cmp;  in __get_file_rcu()
904 	file = rcu_dereference_raw(*f);  in __get_file_rcu()
905 	if (!file)  in __get_file_rcu()
908 	if (unlikely(!file_ref_get(&file->f_ref)))  in __get_file_rcu()
926 	 * __rcu protected file pointer so that if that pointer still  in __get_file_rcu()
927 	 * matches the current file, we know we have successfully  in __get_file_rcu()
928 	 * acquired a reference to the right file.  in __get_file_rcu()
930 	 * If the pointers don't match the file has been reallocated by  in __get_file_rcu()
933 	if (file == file_reloaded_cmp)  in __get_file_rcu()
936 	fput(file);  in __get_file_rcu()
941  * get_file_rcu - try go get a reference to a file under rcu
942  * @f: the file to get a reference on
952 struct file *get_file_rcu(struct file __rcu **f)  in get_file_rcu()
955 		struct file __rcu *file;  in get_file_rcu()  local
957 		file = __get_file_rcu(f);  in get_file_rcu()
958 		if (!IS_ERR(file))  in get_file_rcu()
959 			return file;  in get_file_rcu()
965  * get_file_active - try go get a reference to a file
966  * @f: the file to get a reference on
976 struct file *get_file_active(struct file **f)  in get_file_active()
978 	struct file __rcu *file;  in get_file_active()  local
981 	file = __get_file_rcu(f);  in get_file_active()
983 	if (IS_ERR(file))  in get_file_active()
984 		file = NULL;  in get_file_active()
985 	return file;  in get_file_active()
989 static inline struct file *__fget_files_rcu(struct files_struct *files,  in __fget_files_rcu()
993 		struct file *file;  in __fget_files_rcu()  local
995 		struct file __rcu **fdentry;  in __fget_files_rcu()
1009 		file = rcu_dereference_raw(*fdentry);  in __fget_files_rcu()
1010 		file = (void *)(nospec_mask & (unsigned long)file);  in __fget_files_rcu()
1011 		if (unlikely(!file))  in __fget_files_rcu()
1015 		 * Ok, we have a file pointer that was valid at  in __fget_files_rcu()
1025 		if (unlikely(!file_ref_get(&file->f_ref)))  in __fget_files_rcu()
1031 		 *  (a) the file ref already went down to zero and the  in __fget_files_rcu()
1032 		 *      file hasn't been reused yet or the file count  in __fget_files_rcu()
1033 		 *      isn't zero but the file has already been reused.  in __fget_files_rcu()
1035 		 *  (b) the file table entry has changed under us.  in __fget_files_rcu()
1042 		if (unlikely(file != rcu_dereference_raw(*fdentry)) ||  in __fget_files_rcu()
1044 			fput(file);  in __fget_files_rcu()
1049 		 * This isn't the file we're looking for or we're not  in __fget_files_rcu()
1052 		if (unlikely(file->f_mode & mask)) {  in __fget_files_rcu()
1053 			fput(file);  in __fget_files_rcu()
1058 		 * Ok, we have a ref to the file, and checked that it  in __fget_files_rcu()
1061 		return file;  in __fget_files_rcu()
1065 static struct file *__fget_files(struct files_struct *files, unsigned int fd,  in __fget_files()
1068 	struct file *file;  in __fget_files()  local
1071 	file = __fget_files_rcu(files, fd, mask);  in __fget_files()
1074 	return file;  in __fget_files()
1077 static inline struct file *__fget(unsigned int fd, fmode_t mask)  in __fget()
1082 struct file *fget(unsigned int fd)  in fget()
1088 struct file *fget_raw(unsigned int fd)  in fget_raw()
1094 struct file *fget_task(struct task_struct *task, unsigned int fd)  in fget_task()
1096 	struct file *file = NULL;  in fget_task()  local
1100 		file = __fget_files(task->files, fd, 0);  in fget_task()
1103 	return file;  in fget_task()
1106 struct file *fget_task_next(struct task_struct *task, unsigned int *ret_fd)  in fget_task_next()
1111 	struct file *file = NULL;  in fget_task_next()  local
1118 			file = __fget_files_rcu(files, fd, 0);  in fget_task_next()
1119 			if (file)  in fget_task_next()
1126 	return file;  in fget_task_next()
1131  * Lightweight file lookup - no refcnt increment if fd table isn't shared.
1136  *    to userspace (i.e. you cannot remember the returned struct file * after
1138  * 2) You must not call filp_close on the returned struct file * in between
1151  * See also the documentation in rust/kernel/file.rs.
1156 	struct file *file;  in __fget_light()  local
1162 	 * return a file that is concurrently being freed.  in __fget_light()
1168 		file = files_lookup_fd_raw(files, fd);  in __fget_light()
1169 		if (!file || unlikely(file->f_mode & mask))  in __fget_light()
1171 		return BORROWED_FD(file);  in __fget_light()
1173 		file = __fget_files(files, fd, mask);  in __fget_light()
1174 		if (!file)  in __fget_light()
1176 		return CLONED_FD(file);  in __fget_light()
1192  * file is marked for FMODE_ATOMIC_POS, and it can be
1196  * can make a file accessible even if it otherwise would
1200 static inline bool file_needs_f_pos_lock(struct file *file)  in file_needs_f_pos_lock()  argument
1202 	if (!(file->f_mode & FMODE_ATOMIC_POS))  in file_needs_f_pos_lock()
1204 	if (__file_ref_read_raw(&file->f_ref) != FILE_REF_ONEREF)  in file_needs_f_pos_lock()
1206 	if (file->f_op->iterate_shared)  in file_needs_f_pos_lock()
1211 bool file_seek_cur_needs_f_lock(struct file *file)  in file_seek_cur_needs_f_lock()  argument
1213 	if (!(file->f_mode & FMODE_ATOMIC_POS) && !file->f_op->iterate_shared)  in file_seek_cur_needs_f_lock()
1218 	 * this file obj, in which case the caller is expected to provide the  in file_seek_cur_needs_f_lock()
1228 	struct file *file = fd_file(f);  in fdget_pos()  local
1230 	if (likely(file) && file_needs_f_pos_lock(file)) {  in fdget_pos()
1232 		mutex_lock(&file->f_pos_lock);  in fdget_pos()
1237 void __f_unlock_pos(struct file *f)  in __f_unlock_pos()
1243  * We only lock f_pos if we have threads or if the file might be
1245  * file count (done either by fdget() or by fork()).
1266 	struct file *file, unsigned fd, unsigned flags)  in do_dup2()  argument
1269 	struct file *tofree;  in do_dup2()
1273 	 * dup2() is expected to close the file installed in the target fd slot  in do_dup2()
1280 	 * file = hard_work_goes_here();  in do_dup2()
1281 	 * fd_install(fd, file);           // only now ->fd[fd] == file  in do_dup2()
1286 	 * If we fit the window, we have the fd to populate, yet no target file  in do_dup2()
1287 	 * to close. Trying to ignore it and install our new file would violate  in do_dup2()
1288 	 * the invariant and make fd_install() overwrite our file.  in do_dup2()
1303 	get_file(file);  in do_dup2()
1304 	rcu_assign_pointer(fdt->fd[fd], file);  in do_dup2()
1318 int replace_fd(unsigned fd, struct file *file, unsigned flags)  in replace_fd()  argument
1323 	if (!file)  in replace_fd()
1333 	err = do_dup2(files, file, fd, flags);  in replace_fd()
1344  * receive_fd() - Install received file into file descriptor table
1345  * @file: struct file that was received from another process
1349  * Installs a received file into the file descriptor table, with appropriate
1354  * struct file.
1358 int receive_fd(struct file *file, int __user *ufd, unsigned int o_flags)  in receive_fd()  argument
1363 	error = security_file_receive(file);  in receive_fd()
1379 	fd_install(new_fd, get_file(file));  in receive_fd()
1380 	__receive_sock(file);  in receive_fd()
1385 int receive_fd_replace(int new_fd, struct file *file, unsigned int o_flags)  in receive_fd_replace()  argument
1389 	error = security_file_receive(file);  in receive_fd_replace()
1392 	error = replace_fd(new_fd, file, o_flags);  in receive_fd_replace()
1395 	__receive_sock(file);  in receive_fd_replace()
1402 	struct file *file;  in ksys_dup3()  local
1416 	file = files_lookup_fd_locked(files, oldfd);  in ksys_dup3()
1417 	if (unlikely(!file))  in ksys_dup3()
1424 	return do_dup2(files, file, newfd, flags);  in ksys_dup3()
1442 		struct file *f;  in SYSCALL_DEFINE2()
1460 	struct file *file = fget_raw(fildes);  in SYSCALL_DEFINE1()  local
1462 	if (file) {  in SYSCALL_DEFINE1()
1465 			fd_install(ret, file);  in SYSCALL_DEFINE1()
1467 			fput(file);  in SYSCALL_DEFINE1()
1472 int f_dupfd(unsigned int from, struct file *file, unsigned flags)  in f_dupfd()  argument
1480 		get_file(file);  in f_dupfd()
1481 		fd_install(err, file);  in f_dupfd()
1487 		int (*f)(const void *, struct file *, unsigned),  in iterate_fd()  argument
1496 		struct file *file;  in iterate_fd()  local
1497 		file = rcu_dereference_check_fdtable(files, fdt->fd[n]);  in iterate_fd()
1498 		if (!file)  in iterate_fd()
1500 		res = f(p, file, n);  in iterate_fd()