1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/anon_inodes.h>
3 #include <linux/exportfs.h>
4 #include <linux/file.h>
5 #include <linux/fs.h>
6 #include <linux/cgroup.h>
7 #include <linux/magic.h>
8 #include <linux/mount.h>
9 #include <linux/pid.h>
10 #include <linux/pidfs.h>
11 #include <linux/pid_namespace.h>
12 #include <linux/poll.h>
13 #include <linux/proc_fs.h>
14 #include <linux/proc_ns.h>
15 #include <linux/pseudo_fs.h>
16 #include <linux/ptrace.h>
17 #include <linux/seq_file.h>
18 #include <uapi/linux/pidfd.h>
19 #include <linux/ipc_namespace.h>
20 #include <linux/time_namespace.h>
21 #include <linux/utsname.h>
22 #include <net/net_namespace.h>
23 #include <linux/coredump.h>
24 #include <linux/xattr.h>
25
26 #include "internal.h"
27 #include "mount.h"
28
29 #define PIDFS_PID_DEAD ERR_PTR(-ESRCH)
30
31 static struct kmem_cache *pidfs_attr_cachep __ro_after_init;
32 static struct kmem_cache *pidfs_xattr_cachep __ro_after_init;
33
34 static struct path pidfs_root_path = {};
35
pidfs_get_root(struct path * path)36 void pidfs_get_root(struct path *path)
37 {
38 *path = pidfs_root_path;
39 path_get(path);
40 }
41
42 enum pidfs_attr_mask_bits {
43 PIDFS_ATTR_BIT_EXIT = 0,
44 PIDFS_ATTR_BIT_COREDUMP = 1,
45 };
46
47 struct pidfs_attr {
48 unsigned long attr_mask;
49 struct simple_xattrs *xattrs;
50 struct /* exit info */ {
51 __u64 cgroupid;
52 __s32 exit_code;
53 };
54 __u32 coredump_mask;
55 __u32 coredump_signal;
56 };
57
58 static struct rb_root pidfs_ino_tree = RB_ROOT;
59
60 #if BITS_PER_LONG == 32
pidfs_ino(u64 ino)61 static inline unsigned long pidfs_ino(u64 ino)
62 {
63 return lower_32_bits(ino);
64 }
65
66 /* On 32 bit the generation number are the upper 32 bits. */
pidfs_gen(u64 ino)67 static inline u32 pidfs_gen(u64 ino)
68 {
69 return upper_32_bits(ino);
70 }
71
72 #else
73
74 /* On 64 bit simply return ino. */
pidfs_ino(u64 ino)75 static inline unsigned long pidfs_ino(u64 ino)
76 {
77 return ino;
78 }
79
80 /* On 64 bit the generation number is 0. */
pidfs_gen(u64 ino)81 static inline u32 pidfs_gen(u64 ino)
82 {
83 return 0;
84 }
85 #endif
86
pidfs_ino_cmp(struct rb_node * a,const struct rb_node * b)87 static int pidfs_ino_cmp(struct rb_node *a, const struct rb_node *b)
88 {
89 struct pid *pid_a = rb_entry(a, struct pid, pidfs_node);
90 struct pid *pid_b = rb_entry(b, struct pid, pidfs_node);
91 u64 pid_ino_a = pid_a->ino;
92 u64 pid_ino_b = pid_b->ino;
93
94 if (pid_ino_a < pid_ino_b)
95 return -1;
96 if (pid_ino_a > pid_ino_b)
97 return 1;
98 return 0;
99 }
100
pidfs_add_pid(struct pid * pid)101 void pidfs_add_pid(struct pid *pid)
102 {
103 static u64 pidfs_ino_nr = 2;
104
105 /*
106 * On 64 bit nothing special happens. The 64bit number assigned
107 * to struct pid is the inode number.
108 *
109 * On 32 bit the 64 bit number assigned to struct pid is split
110 * into two 32 bit numbers. The lower 32 bits are used as the
111 * inode number and the upper 32 bits are used as the inode
112 * generation number.
113 *
114 * On 32 bit pidfs_ino() will return the lower 32 bit. When
115 * pidfs_ino() returns zero a wrap around happened. When a
116 * wraparound happens the 64 bit number will be incremented by 2
117 * so inode numbering starts at 2 again.
118 *
119 * On 64 bit comparing two pidfds is as simple as comparing
120 * inode numbers.
121 *
122 * When a wraparound happens on 32 bit multiple pidfds with the
123 * same inode number are likely to exist (This isn't a problem
124 * since before pidfs pidfds used the anonymous inode meaning
125 * all pidfds had the same inode number.). Userspace can
126 * reconstruct the 64 bit identifier by retrieving both the
127 * inode number and the inode generation number to compare or
128 * use file handles.
129 */
130 if (pidfs_ino(pidfs_ino_nr) == 0)
131 pidfs_ino_nr += 2;
132
133 pid->ino = pidfs_ino_nr;
134 pid->stashed = NULL;
135 pid->attr = NULL;
136 pidfs_ino_nr++;
137
138 write_seqcount_begin(&pidmap_lock_seq);
139 rb_find_add_rcu(&pid->pidfs_node, &pidfs_ino_tree, pidfs_ino_cmp);
140 write_seqcount_end(&pidmap_lock_seq);
141 }
142
pidfs_remove_pid(struct pid * pid)143 void pidfs_remove_pid(struct pid *pid)
144 {
145 write_seqcount_begin(&pidmap_lock_seq);
146 rb_erase(&pid->pidfs_node, &pidfs_ino_tree);
147 write_seqcount_end(&pidmap_lock_seq);
148 }
149
pidfs_free_pid(struct pid * pid)150 void pidfs_free_pid(struct pid *pid)
151 {
152 struct pidfs_attr *attr __free(kfree) = no_free_ptr(pid->attr);
153 struct simple_xattrs *xattrs __free(kfree) = NULL;
154
155 /*
156 * Any dentry must've been wiped from the pid by now.
157 * Otherwise there's a reference count bug.
158 */
159 VFS_WARN_ON_ONCE(pid->stashed);
160
161 /*
162 * This if an error occurred during e.g., task creation that
163 * causes us to never go through the exit path.
164 */
165 if (unlikely(!attr))
166 return;
167
168 /* This never had a pidfd created. */
169 if (IS_ERR(attr))
170 return;
171
172 xattrs = no_free_ptr(attr->xattrs);
173 if (xattrs)
174 simple_xattrs_free(xattrs, NULL);
175 }
176
177 #ifdef CONFIG_PROC_FS
178 /**
179 * pidfd_show_fdinfo - print information about a pidfd
180 * @m: proc fdinfo file
181 * @f: file referencing a pidfd
182 *
183 * Pid:
184 * This function will print the pid that a given pidfd refers to in the
185 * pid namespace of the procfs instance.
186 * If the pid namespace of the process is not a descendant of the pid
187 * namespace of the procfs instance 0 will be shown as its pid. This is
188 * similar to calling getppid() on a process whose parent is outside of
189 * its pid namespace.
190 *
191 * NSpid:
192 * If pid namespaces are supported then this function will also print
193 * the pid of a given pidfd refers to for all descendant pid namespaces
194 * starting from the current pid namespace of the instance, i.e. the
195 * Pid field and the first entry in the NSpid field will be identical.
196 * If the pid namespace of the process is not a descendant of the pid
197 * namespace of the procfs instance 0 will be shown as its first NSpid
198 * entry and no others will be shown.
199 * Note that this differs from the Pid and NSpid fields in
200 * /proc/<pid>/status where Pid and NSpid are always shown relative to
201 * the pid namespace of the procfs instance. The difference becomes
202 * obvious when sending around a pidfd between pid namespaces from a
203 * different branch of the tree, i.e. where no ancestral relation is
204 * present between the pid namespaces:
205 * - create two new pid namespaces ns1 and ns2 in the initial pid
206 * namespace (also take care to create new mount namespaces in the
207 * new pid namespace and mount procfs)
208 * - create a process with a pidfd in ns1
209 * - send pidfd from ns1 to ns2
210 * - read /proc/self/fdinfo/<pidfd> and observe that both Pid and NSpid
211 * have exactly one entry, which is 0
212 */
pidfd_show_fdinfo(struct seq_file * m,struct file * f)213 static void pidfd_show_fdinfo(struct seq_file *m, struct file *f)
214 {
215 struct pid *pid = pidfd_pid(f);
216 struct pid_namespace *ns;
217 pid_t nr = -1;
218
219 if (likely(pid_has_task(pid, PIDTYPE_PID))) {
220 ns = proc_pid_ns(file_inode(m->file)->i_sb);
221 nr = pid_nr_ns(pid, ns);
222 }
223
224 seq_put_decimal_ll(m, "Pid:\t", nr);
225
226 #ifdef CONFIG_PID_NS
227 seq_put_decimal_ll(m, "\nNSpid:\t", nr);
228 if (nr > 0) {
229 int i;
230
231 /* If nr is non-zero it means that 'pid' is valid and that
232 * ns, i.e. the pid namespace associated with the procfs
233 * instance, is in the pid namespace hierarchy of pid.
234 * Start at one below the already printed level.
235 */
236 for (i = ns->level + 1; i <= pid->level; i++)
237 seq_put_decimal_ll(m, "\t", pid->numbers[i].nr);
238 }
239 #endif
240 seq_putc(m, '\n');
241 }
242 #endif
243
244 /*
245 * Poll support for process exit notification.
246 */
pidfd_poll(struct file * file,struct poll_table_struct * pts)247 static __poll_t pidfd_poll(struct file *file, struct poll_table_struct *pts)
248 {
249 struct pid *pid = pidfd_pid(file);
250 struct task_struct *task;
251 __poll_t poll_flags = 0;
252
253 poll_wait(file, &pid->wait_pidfd, pts);
254 /*
255 * Don't wake waiters if the thread-group leader exited
256 * prematurely. They either get notified when the last subthread
257 * exits or not at all if one of the remaining subthreads execs
258 * and assumes the struct pid of the old thread-group leader.
259 */
260 guard(rcu)();
261 task = pid_task(pid, PIDTYPE_PID);
262 if (!task)
263 poll_flags = EPOLLIN | EPOLLRDNORM | EPOLLHUP;
264 else if (task->exit_state && !delay_group_leader(task))
265 poll_flags = EPOLLIN | EPOLLRDNORM;
266
267 return poll_flags;
268 }
269
pid_in_current_pidns(const struct pid * pid)270 static inline bool pid_in_current_pidns(const struct pid *pid)
271 {
272 const struct pid_namespace *ns = task_active_pid_ns(current);
273
274 if (ns->level <= pid->level)
275 return pid->numbers[ns->level].ns == ns;
276
277 return false;
278 }
279
pidfs_coredump_mask(unsigned long mm_flags)280 static __u32 pidfs_coredump_mask(unsigned long mm_flags)
281 {
282 switch (__get_dumpable(mm_flags)) {
283 case SUID_DUMP_USER:
284 return PIDFD_COREDUMP_USER;
285 case SUID_DUMP_ROOT:
286 return PIDFD_COREDUMP_ROOT;
287 case SUID_DUMP_DISABLE:
288 return PIDFD_COREDUMP_SKIP;
289 default:
290 WARN_ON_ONCE(true);
291 }
292
293 return 0;
294 }
295
296 /* This must be updated whenever a new flag is added */
297 #define PIDFD_INFO_SUPPORTED (PIDFD_INFO_PID | \
298 PIDFD_INFO_CREDS | \
299 PIDFD_INFO_CGROUPID | \
300 PIDFD_INFO_EXIT | \
301 PIDFD_INFO_COREDUMP | \
302 PIDFD_INFO_SUPPORTED_MASK | \
303 PIDFD_INFO_COREDUMP_SIGNAL)
304
pidfd_info(struct file * file,unsigned int cmd,unsigned long arg)305 static long pidfd_info(struct file *file, unsigned int cmd, unsigned long arg)
306 {
307 struct pidfd_info __user *uinfo = (struct pidfd_info __user *)arg;
308 struct task_struct *task __free(put_task) = NULL;
309 struct pid *pid = pidfd_pid(file);
310 size_t usize = _IOC_SIZE(cmd);
311 struct pidfd_info kinfo = {};
312 struct user_namespace *user_ns;
313 struct pidfs_attr *attr;
314 const struct cred *c;
315 __u64 mask;
316
317 BUILD_BUG_ON(sizeof(struct pidfd_info) != PIDFD_INFO_SIZE_VER2);
318
319 if (!uinfo)
320 return -EINVAL;
321 if (usize < PIDFD_INFO_SIZE_VER0)
322 return -EINVAL; /* First version, no smaller struct possible */
323
324 if (copy_from_user(&mask, &uinfo->mask, sizeof(mask)))
325 return -EFAULT;
326
327 /*
328 * Restrict information retrieval to tasks within the caller's pid
329 * namespace hierarchy.
330 */
331 if (!pid_in_current_pidns(pid))
332 return -ESRCH;
333
334 attr = READ_ONCE(pid->attr);
335 if (mask & PIDFD_INFO_EXIT) {
336 if (test_bit(PIDFS_ATTR_BIT_EXIT, &attr->attr_mask)) {
337 smp_rmb();
338 kinfo.mask |= PIDFD_INFO_EXIT;
339 #ifdef CONFIG_CGROUPS
340 kinfo.cgroupid = attr->cgroupid;
341 kinfo.mask |= PIDFD_INFO_CGROUPID;
342 #endif
343 kinfo.exit_code = attr->exit_code;
344 }
345 }
346
347 if (mask & PIDFD_INFO_COREDUMP) {
348 if (test_bit(PIDFS_ATTR_BIT_COREDUMP, &attr->attr_mask)) {
349 smp_rmb();
350 kinfo.mask |= PIDFD_INFO_COREDUMP | PIDFD_INFO_COREDUMP_SIGNAL;
351 kinfo.coredump_mask = attr->coredump_mask;
352 kinfo.coredump_signal = attr->coredump_signal;
353 }
354 }
355
356 task = get_pid_task(pid, PIDTYPE_PID);
357 if (!task) {
358 /*
359 * If the task has already been reaped, only exit
360 * information is available
361 */
362 if (!(mask & PIDFD_INFO_EXIT))
363 return -ESRCH;
364
365 goto copy_out;
366 }
367
368 c = get_task_cred(task);
369 if (!c)
370 return -ESRCH;
371
372 if ((mask & PIDFD_INFO_COREDUMP) && !kinfo.coredump_mask) {
373 guard(task_lock)(task);
374 if (task->mm) {
375 unsigned long flags = __mm_flags_get_dumpable(task->mm);
376
377 kinfo.coredump_mask = pidfs_coredump_mask(flags);
378 kinfo.mask |= PIDFD_INFO_COREDUMP;
379 /* No coredump actually took place, so no coredump signal. */
380 }
381 }
382
383 /* Unconditionally return identifiers and credentials, the rest only on request */
384
385 user_ns = current_user_ns();
386 kinfo.ruid = from_kuid_munged(user_ns, c->uid);
387 kinfo.rgid = from_kgid_munged(user_ns, c->gid);
388 kinfo.euid = from_kuid_munged(user_ns, c->euid);
389 kinfo.egid = from_kgid_munged(user_ns, c->egid);
390 kinfo.suid = from_kuid_munged(user_ns, c->suid);
391 kinfo.sgid = from_kgid_munged(user_ns, c->sgid);
392 kinfo.fsuid = from_kuid_munged(user_ns, c->fsuid);
393 kinfo.fsgid = from_kgid_munged(user_ns, c->fsgid);
394 kinfo.mask |= PIDFD_INFO_CREDS;
395 put_cred(c);
396
397 #ifdef CONFIG_CGROUPS
398 if (!kinfo.cgroupid) {
399 struct cgroup *cgrp;
400
401 rcu_read_lock();
402 cgrp = task_dfl_cgroup(task);
403 kinfo.cgroupid = cgroup_id(cgrp);
404 kinfo.mask |= PIDFD_INFO_CGROUPID;
405 rcu_read_unlock();
406 }
407 #endif
408
409 /*
410 * Copy pid/tgid last, to reduce the chances the information might be
411 * stale. Note that it is not possible to ensure it will be valid as the
412 * task might return as soon as the copy_to_user finishes, but that's ok
413 * and userspace expects that might happen and can act accordingly, so
414 * this is just best-effort. What we can do however is checking that all
415 * the fields are set correctly, or return ESRCH to avoid providing
416 * incomplete information. */
417
418 kinfo.ppid = task_ppid_nr_ns(task, NULL);
419 kinfo.tgid = task_tgid_vnr(task);
420 kinfo.pid = task_pid_vnr(task);
421 kinfo.mask |= PIDFD_INFO_PID;
422
423 if (kinfo.pid == 0 || kinfo.tgid == 0)
424 return -ESRCH;
425
426 copy_out:
427 if (mask & PIDFD_INFO_SUPPORTED_MASK) {
428 kinfo.mask |= PIDFD_INFO_SUPPORTED_MASK;
429 kinfo.supported_mask = PIDFD_INFO_SUPPORTED;
430 }
431
432 /* Are there bits in the return mask not present in PIDFD_INFO_SUPPORTED? */
433 WARN_ON_ONCE(~PIDFD_INFO_SUPPORTED & kinfo.mask);
434 /*
435 * If userspace and the kernel have the same struct size it can just
436 * be copied. If userspace provides an older struct, only the bits that
437 * userspace knows about will be copied. If userspace provides a new
438 * struct, only the bits that the kernel knows about will be copied.
439 */
440 return copy_struct_to_user(uinfo, usize, &kinfo, sizeof(kinfo), NULL);
441 }
442
pidfs_ioctl_valid(unsigned int cmd)443 static bool pidfs_ioctl_valid(unsigned int cmd)
444 {
445 switch (cmd) {
446 case FS_IOC_GETVERSION:
447 case PIDFD_GET_CGROUP_NAMESPACE:
448 case PIDFD_GET_IPC_NAMESPACE:
449 case PIDFD_GET_MNT_NAMESPACE:
450 case PIDFD_GET_NET_NAMESPACE:
451 case PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE:
452 case PIDFD_GET_TIME_NAMESPACE:
453 case PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE:
454 case PIDFD_GET_UTS_NAMESPACE:
455 case PIDFD_GET_USER_NAMESPACE:
456 case PIDFD_GET_PID_NAMESPACE:
457 return true;
458 }
459
460 /* Extensible ioctls require some more careful checks. */
461 switch (_IOC_NR(cmd)) {
462 case _IOC_NR(PIDFD_GET_INFO):
463 /*
464 * Try to prevent performing a pidfd ioctl when someone
465 * erronously mistook the file descriptor for a pidfd.
466 * This is not perfect but will catch most cases.
467 */
468 return extensible_ioctl_valid(cmd, PIDFD_GET_INFO, PIDFD_INFO_SIZE_VER0);
469 }
470
471 return false;
472 }
473
pidfd_ioctl(struct file * file,unsigned int cmd,unsigned long arg)474 static long pidfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
475 {
476 struct task_struct *task __free(put_task) = NULL;
477 struct nsproxy *nsp __free(put_nsproxy) = NULL;
478 struct ns_common *ns_common = NULL;
479
480 if (!pidfs_ioctl_valid(cmd))
481 return -ENOIOCTLCMD;
482
483 if (cmd == FS_IOC_GETVERSION) {
484 if (!arg)
485 return -EINVAL;
486
487 __u32 __user *argp = (__u32 __user *)arg;
488 return put_user(file_inode(file)->i_generation, argp);
489 }
490
491 /* Extensible IOCTL that does not open namespace FDs, take a shortcut */
492 if (_IOC_NR(cmd) == _IOC_NR(PIDFD_GET_INFO))
493 return pidfd_info(file, cmd, arg);
494
495 task = get_pid_task(pidfd_pid(file), PIDTYPE_PID);
496 if (!task)
497 return -ESRCH;
498
499 if (arg)
500 return -EINVAL;
501
502 scoped_guard(task_lock, task) {
503 nsp = task->nsproxy;
504 if (nsp)
505 get_nsproxy(nsp);
506 }
507 if (!nsp)
508 return -ESRCH; /* just pretend it didn't exist */
509
510 /*
511 * We're trying to open a file descriptor to the namespace so perform a
512 * filesystem cred ptrace check. Also, we mirror nsfs behavior.
513 */
514 if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
515 return -EACCES;
516
517 switch (cmd) {
518 /* Namespaces that hang of nsproxy. */
519 case PIDFD_GET_CGROUP_NAMESPACE:
520 if (!ns_ref_get(nsp->cgroup_ns))
521 break;
522 ns_common = to_ns_common(nsp->cgroup_ns);
523 break;
524 case PIDFD_GET_IPC_NAMESPACE:
525 if (!ns_ref_get(nsp->ipc_ns))
526 break;
527 ns_common = to_ns_common(nsp->ipc_ns);
528 break;
529 case PIDFD_GET_MNT_NAMESPACE:
530 if (!ns_ref_get(nsp->mnt_ns))
531 break;
532 ns_common = to_ns_common(nsp->mnt_ns);
533 break;
534 case PIDFD_GET_NET_NAMESPACE:
535 if (!ns_ref_get(nsp->net_ns))
536 break;
537 ns_common = to_ns_common(nsp->net_ns);
538 break;
539 case PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE:
540 if (!ns_ref_get(nsp->pid_ns_for_children))
541 break;
542 ns_common = to_ns_common(nsp->pid_ns_for_children);
543 break;
544 case PIDFD_GET_TIME_NAMESPACE:
545 if (!ns_ref_get(nsp->time_ns))
546 break;
547 ns_common = to_ns_common(nsp->time_ns);
548 break;
549 case PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE:
550 if (!ns_ref_get(nsp->time_ns_for_children))
551 break;
552 ns_common = to_ns_common(nsp->time_ns_for_children);
553 break;
554 case PIDFD_GET_UTS_NAMESPACE:
555 if (!ns_ref_get(nsp->uts_ns))
556 break;
557 ns_common = to_ns_common(nsp->uts_ns);
558 break;
559 /* Namespaces that don't hang of nsproxy. */
560 case PIDFD_GET_USER_NAMESPACE:
561 scoped_guard(rcu) {
562 struct user_namespace *user_ns;
563
564 user_ns = task_cred_xxx(task, user_ns);
565 if (!ns_ref_get(user_ns))
566 break;
567 ns_common = to_ns_common(user_ns);
568 }
569 break;
570 case PIDFD_GET_PID_NAMESPACE:
571 scoped_guard(rcu) {
572 struct pid_namespace *pid_ns;
573
574 pid_ns = task_active_pid_ns(task);
575 if (!ns_ref_get(pid_ns))
576 break;
577 ns_common = to_ns_common(pid_ns);
578 }
579 break;
580 default:
581 return -ENOIOCTLCMD;
582 }
583
584 if (!ns_common)
585 return -EOPNOTSUPP;
586
587 /* open_namespace() unconditionally consumes the reference */
588 return open_namespace(ns_common);
589 }
590
591 static const struct file_operations pidfs_file_operations = {
592 .poll = pidfd_poll,
593 #ifdef CONFIG_PROC_FS
594 .show_fdinfo = pidfd_show_fdinfo,
595 #endif
596 .unlocked_ioctl = pidfd_ioctl,
597 .compat_ioctl = compat_ptr_ioctl,
598 };
599
pidfd_pid(const struct file * file)600 struct pid *pidfd_pid(const struct file *file)
601 {
602 if (file->f_op != &pidfs_file_operations)
603 return ERR_PTR(-EBADF);
604 return file_inode(file)->i_private;
605 }
606
607 /*
608 * We're called from release_task(). We know there's at least one
609 * reference to struct pid being held that won't be released until the
610 * task has been reaped which cannot happen until we're out of
611 * release_task().
612 *
613 * If this struct pid has at least once been referred to by a pidfd then
614 * pid->attr will be allocated. If not we mark the struct pid as dead so
615 * anyone who is trying to register it with pidfs will fail to do so.
616 * Otherwise we would hand out pidfs for reaped tasks without having
617 * exit information available.
618 *
619 * Worst case is that we've filled in the info and the pid gets freed
620 * right away in free_pid() when no one holds a pidfd anymore. Since
621 * pidfs_exit() currently is placed after exit_task_work() we know that
622 * it cannot be us aka the exiting task holding a pidfd to itself.
623 */
pidfs_exit(struct task_struct * tsk)624 void pidfs_exit(struct task_struct *tsk)
625 {
626 struct pid *pid = task_pid(tsk);
627 struct pidfs_attr *attr;
628 #ifdef CONFIG_CGROUPS
629 struct cgroup *cgrp;
630 #endif
631
632 might_sleep();
633
634 /* Synchronize with pidfs_register_pid(). */
635 scoped_guard(spinlock_irq, &pid->wait_pidfd.lock) {
636 attr = pid->attr;
637 if (!attr) {
638 /*
639 * No one ever held a pidfd for this struct pid.
640 * Mark it as dead so no one can add a pidfs
641 * entry anymore. We're about to be reaped and
642 * so no exit information would be available.
643 */
644 pid->attr = PIDFS_PID_DEAD;
645 return;
646 }
647 }
648
649 /*
650 * If @pid->attr is set someone might still legitimately hold a
651 * pidfd to @pid or someone might concurrently still be getting
652 * a reference to an already stashed dentry from @pid->stashed.
653 * So defer cleaning @pid->attr until the last reference to @pid
654 * is put
655 */
656
657 #ifdef CONFIG_CGROUPS
658 rcu_read_lock();
659 cgrp = task_dfl_cgroup(tsk);
660 attr->cgroupid = cgroup_id(cgrp);
661 rcu_read_unlock();
662 #endif
663 attr->exit_code = tsk->exit_code;
664
665 /* Ensure that PIDFD_GET_INFO sees either all or nothing. */
666 smp_wmb();
667 set_bit(PIDFS_ATTR_BIT_EXIT, &attr->attr_mask);
668 }
669
670 #ifdef CONFIG_COREDUMP
pidfs_coredump(const struct coredump_params * cprm)671 void pidfs_coredump(const struct coredump_params *cprm)
672 {
673 struct pid *pid = cprm->pid;
674 struct pidfs_attr *attr;
675
676 attr = READ_ONCE(pid->attr);
677
678 VFS_WARN_ON_ONCE(!attr);
679 VFS_WARN_ON_ONCE(attr == PIDFS_PID_DEAD);
680
681 /* Note how we were coredumped and that we coredumped. */
682 attr->coredump_mask = pidfs_coredump_mask(cprm->mm_flags) |
683 PIDFD_COREDUMPED;
684 /* If coredumping is set to skip we should never end up here. */
685 VFS_WARN_ON_ONCE(attr->coredump_mask & PIDFD_COREDUMP_SKIP);
686 /* Expose the signal number that caused the coredump. */
687 attr->coredump_signal = cprm->siginfo->si_signo;
688 smp_wmb();
689 set_bit(PIDFS_ATTR_BIT_COREDUMP, &attr->attr_mask);
690 }
691 #endif
692
693 static struct vfsmount *pidfs_mnt __ro_after_init;
694
695 /*
696 * The vfs falls back to simple_setattr() if i_op->setattr() isn't
697 * implemented. Let's reject it completely until we have a clean
698 * permission concept for pidfds.
699 */
pidfs_setattr(struct mnt_idmap * idmap,struct dentry * dentry,struct iattr * attr)700 static int pidfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
701 struct iattr *attr)
702 {
703 return anon_inode_setattr(idmap, dentry, attr);
704 }
705
pidfs_getattr(struct mnt_idmap * idmap,const struct path * path,struct kstat * stat,u32 request_mask,unsigned int query_flags)706 static int pidfs_getattr(struct mnt_idmap *idmap, const struct path *path,
707 struct kstat *stat, u32 request_mask,
708 unsigned int query_flags)
709 {
710 return anon_inode_getattr(idmap, path, stat, request_mask, query_flags);
711 }
712
pidfs_listxattr(struct dentry * dentry,char * buf,size_t size)713 static ssize_t pidfs_listxattr(struct dentry *dentry, char *buf, size_t size)
714 {
715 struct inode *inode = d_inode(dentry);
716 struct pid *pid = inode->i_private;
717 struct pidfs_attr *attr = pid->attr;
718 struct simple_xattrs *xattrs;
719
720 xattrs = READ_ONCE(attr->xattrs);
721 if (!xattrs)
722 return 0;
723
724 return simple_xattr_list(inode, xattrs, buf, size);
725 }
726
727 static const struct inode_operations pidfs_inode_operations = {
728 .getattr = pidfs_getattr,
729 .setattr = pidfs_setattr,
730 .listxattr = pidfs_listxattr,
731 };
732
pidfs_evict_inode(struct inode * inode)733 static void pidfs_evict_inode(struct inode *inode)
734 {
735 struct pid *pid = inode->i_private;
736
737 clear_inode(inode);
738 put_pid(pid);
739 }
740
741 static const struct super_operations pidfs_sops = {
742 .drop_inode = inode_just_drop,
743 .evict_inode = pidfs_evict_inode,
744 .statfs = simple_statfs,
745 };
746
747 /*
748 * 'lsof' has knowledge of out historical anon_inode use, and expects
749 * the pidfs dentry name to start with 'anon_inode'.
750 */
pidfs_dname(struct dentry * dentry,char * buffer,int buflen)751 static char *pidfs_dname(struct dentry *dentry, char *buffer, int buflen)
752 {
753 return dynamic_dname(buffer, buflen, "anon_inode:[pidfd]");
754 }
755
756 const struct dentry_operations pidfs_dentry_operations = {
757 .d_dname = pidfs_dname,
758 .d_prune = stashed_dentry_prune,
759 };
760
pidfs_encode_fh(struct inode * inode,u32 * fh,int * max_len,struct inode * parent)761 static int pidfs_encode_fh(struct inode *inode, u32 *fh, int *max_len,
762 struct inode *parent)
763 {
764 const struct pid *pid = inode->i_private;
765
766 if (*max_len < 2) {
767 *max_len = 2;
768 return FILEID_INVALID;
769 }
770
771 *max_len = 2;
772 *(u64 *)fh = pid->ino;
773 return FILEID_KERNFS;
774 }
775
pidfs_ino_find(const void * key,const struct rb_node * node)776 static int pidfs_ino_find(const void *key, const struct rb_node *node)
777 {
778 const u64 pid_ino = *(u64 *)key;
779 const struct pid *pid = rb_entry(node, struct pid, pidfs_node);
780
781 if (pid_ino < pid->ino)
782 return -1;
783 if (pid_ino > pid->ino)
784 return 1;
785 return 0;
786 }
787
788 /* Find a struct pid based on the inode number. */
pidfs_ino_get_pid(u64 ino)789 static struct pid *pidfs_ino_get_pid(u64 ino)
790 {
791 struct pid *pid;
792 struct rb_node *node;
793 unsigned int seq;
794
795 guard(rcu)();
796 do {
797 seq = read_seqcount_begin(&pidmap_lock_seq);
798 node = rb_find_rcu(&ino, &pidfs_ino_tree, pidfs_ino_find);
799 if (node)
800 break;
801 } while (read_seqcount_retry(&pidmap_lock_seq, seq));
802
803 if (!node)
804 return NULL;
805
806 pid = rb_entry(node, struct pid, pidfs_node);
807
808 /* Within our pid namespace hierarchy? */
809 if (pid_vnr(pid) == 0)
810 return NULL;
811
812 return get_pid(pid);
813 }
814
pidfs_fh_to_dentry(struct super_block * sb,struct fid * fid,int fh_len,int fh_type)815 static struct dentry *pidfs_fh_to_dentry(struct super_block *sb,
816 struct fid *fid, int fh_len,
817 int fh_type)
818 {
819 int ret;
820 u64 pid_ino;
821 struct path path;
822 struct pid *pid;
823
824 if (fh_len < 2)
825 return NULL;
826
827 switch (fh_type) {
828 case FILEID_KERNFS:
829 pid_ino = *(u64 *)fid;
830 break;
831 default:
832 return NULL;
833 }
834
835 pid = pidfs_ino_get_pid(pid_ino);
836 if (!pid)
837 return NULL;
838
839 ret = path_from_stashed(&pid->stashed, pidfs_mnt, pid, &path);
840 if (ret < 0)
841 return ERR_PTR(ret);
842
843 VFS_WARN_ON_ONCE(!pid->attr);
844
845 mntput(path.mnt);
846 return path.dentry;
847 }
848
849 /*
850 * Make sure that we reject any nonsensical flags that users pass via
851 * open_by_handle_at(). Note that PIDFD_THREAD is defined as O_EXCL, and
852 * PIDFD_NONBLOCK as O_NONBLOCK.
853 */
854 #define VALID_FILE_HANDLE_OPEN_FLAGS \
855 (O_RDONLY | O_WRONLY | O_RDWR | O_NONBLOCK | O_CLOEXEC | O_EXCL)
856
pidfs_export_permission(struct handle_to_path_ctx * ctx,unsigned int oflags)857 static int pidfs_export_permission(struct handle_to_path_ctx *ctx,
858 unsigned int oflags)
859 {
860 if (oflags & ~(VALID_FILE_HANDLE_OPEN_FLAGS | O_LARGEFILE))
861 return -EINVAL;
862
863 /*
864 * pidfd_ino_get_pid() will verify that the struct pid is part
865 * of the caller's pid namespace hierarchy. No further
866 * permission checks are needed.
867 */
868 return 0;
869 }
870
pidfs_export_open(const struct path * path,unsigned int oflags)871 static struct file *pidfs_export_open(const struct path *path, unsigned int oflags)
872 {
873 /*
874 * Clear O_LARGEFILE as open_by_handle_at() forces it and raise
875 * O_RDWR as pidfds always are.
876 */
877 oflags &= ~O_LARGEFILE;
878 return dentry_open(path, oflags | O_RDWR, current_cred());
879 }
880
881 static const struct export_operations pidfs_export_operations = {
882 .encode_fh = pidfs_encode_fh,
883 .fh_to_dentry = pidfs_fh_to_dentry,
884 .open = pidfs_export_open,
885 .permission = pidfs_export_permission,
886 };
887
pidfs_init_inode(struct inode * inode,void * data)888 static int pidfs_init_inode(struct inode *inode, void *data)
889 {
890 const struct pid *pid = data;
891
892 inode->i_private = data;
893 inode->i_flags |= S_PRIVATE | S_ANON_INODE;
894 /* We allow to set xattrs. */
895 inode->i_flags &= ~S_IMMUTABLE;
896 inode->i_mode |= S_IRWXU;
897 inode->i_op = &pidfs_inode_operations;
898 inode->i_fop = &pidfs_file_operations;
899 inode->i_ino = pidfs_ino(pid->ino);
900 inode->i_generation = pidfs_gen(pid->ino);
901 return 0;
902 }
903
pidfs_put_data(void * data)904 static void pidfs_put_data(void *data)
905 {
906 struct pid *pid = data;
907 put_pid(pid);
908 }
909
910 /**
911 * pidfs_register_pid - register a struct pid in pidfs
912 * @pid: pid to pin
913 *
914 * Register a struct pid in pidfs.
915 *
916 * Return: On success zero, on error a negative error code is returned.
917 */
pidfs_register_pid(struct pid * pid)918 int pidfs_register_pid(struct pid *pid)
919 {
920 struct pidfs_attr *new_attr __free(kfree) = NULL;
921 struct pidfs_attr *attr;
922
923 might_sleep();
924
925 if (!pid)
926 return 0;
927
928 attr = READ_ONCE(pid->attr);
929 if (unlikely(attr == PIDFS_PID_DEAD))
930 return PTR_ERR(PIDFS_PID_DEAD);
931 if (attr)
932 return 0;
933
934 new_attr = kmem_cache_zalloc(pidfs_attr_cachep, GFP_KERNEL);
935 if (!new_attr)
936 return -ENOMEM;
937
938 /* Synchronize with pidfs_exit(). */
939 guard(spinlock_irq)(&pid->wait_pidfd.lock);
940
941 attr = pid->attr;
942 if (unlikely(attr == PIDFS_PID_DEAD))
943 return PTR_ERR(PIDFS_PID_DEAD);
944 if (unlikely(attr))
945 return 0;
946
947 pid->attr = no_free_ptr(new_attr);
948 return 0;
949 }
950
pidfs_stash_dentry(struct dentry ** stashed,struct dentry * dentry)951 static struct dentry *pidfs_stash_dentry(struct dentry **stashed,
952 struct dentry *dentry)
953 {
954 int ret;
955 struct pid *pid = d_inode(dentry)->i_private;
956
957 VFS_WARN_ON_ONCE(stashed != &pid->stashed);
958
959 ret = pidfs_register_pid(pid);
960 if (ret)
961 return ERR_PTR(ret);
962
963 return stash_dentry(stashed, dentry);
964 }
965
966 static const struct stashed_operations pidfs_stashed_ops = {
967 .stash_dentry = pidfs_stash_dentry,
968 .init_inode = pidfs_init_inode,
969 .put_data = pidfs_put_data,
970 };
971
pidfs_xattr_get(const struct xattr_handler * handler,struct dentry * unused,struct inode * inode,const char * suffix,void * value,size_t size)972 static int pidfs_xattr_get(const struct xattr_handler *handler,
973 struct dentry *unused, struct inode *inode,
974 const char *suffix, void *value, size_t size)
975 {
976 struct pid *pid = inode->i_private;
977 struct pidfs_attr *attr = pid->attr;
978 const char *name;
979 struct simple_xattrs *xattrs;
980
981 xattrs = READ_ONCE(attr->xattrs);
982 if (!xattrs)
983 return 0;
984
985 name = xattr_full_name(handler, suffix);
986 return simple_xattr_get(xattrs, name, value, size);
987 }
988
pidfs_xattr_set(const struct xattr_handler * handler,struct mnt_idmap * idmap,struct dentry * unused,struct inode * inode,const char * suffix,const void * value,size_t size,int flags)989 static int pidfs_xattr_set(const struct xattr_handler *handler,
990 struct mnt_idmap *idmap, struct dentry *unused,
991 struct inode *inode, const char *suffix,
992 const void *value, size_t size, int flags)
993 {
994 struct pid *pid = inode->i_private;
995 struct pidfs_attr *attr = pid->attr;
996 const char *name;
997 struct simple_xattrs *xattrs;
998 struct simple_xattr *old_xattr;
999
1000 /* Ensure we're the only one to set @attr->xattrs. */
1001 WARN_ON_ONCE(!inode_is_locked(inode));
1002
1003 xattrs = READ_ONCE(attr->xattrs);
1004 if (!xattrs) {
1005 xattrs = kmem_cache_zalloc(pidfs_xattr_cachep, GFP_KERNEL);
1006 if (!xattrs)
1007 return -ENOMEM;
1008
1009 simple_xattrs_init(xattrs);
1010 smp_store_release(&pid->attr->xattrs, xattrs);
1011 }
1012
1013 name = xattr_full_name(handler, suffix);
1014 old_xattr = simple_xattr_set(xattrs, name, value, size, flags);
1015 if (IS_ERR(old_xattr))
1016 return PTR_ERR(old_xattr);
1017
1018 simple_xattr_free(old_xattr);
1019 return 0;
1020 }
1021
1022 static const struct xattr_handler pidfs_trusted_xattr_handler = {
1023 .prefix = XATTR_TRUSTED_PREFIX,
1024 .get = pidfs_xattr_get,
1025 .set = pidfs_xattr_set,
1026 };
1027
1028 static const struct xattr_handler *const pidfs_xattr_handlers[] = {
1029 &pidfs_trusted_xattr_handler,
1030 NULL
1031 };
1032
pidfs_init_fs_context(struct fs_context * fc)1033 static int pidfs_init_fs_context(struct fs_context *fc)
1034 {
1035 struct pseudo_fs_context *ctx;
1036
1037 ctx = init_pseudo(fc, PID_FS_MAGIC);
1038 if (!ctx)
1039 return -ENOMEM;
1040
1041 fc->s_iflags |= SB_I_NOEXEC;
1042 fc->s_iflags |= SB_I_NODEV;
1043 ctx->s_d_flags |= DCACHE_DONTCACHE;
1044 ctx->ops = &pidfs_sops;
1045 ctx->eops = &pidfs_export_operations;
1046 ctx->dops = &pidfs_dentry_operations;
1047 ctx->xattr = pidfs_xattr_handlers;
1048 fc->s_fs_info = (void *)&pidfs_stashed_ops;
1049 return 0;
1050 }
1051
1052 static struct file_system_type pidfs_type = {
1053 .name = "pidfs",
1054 .init_fs_context = pidfs_init_fs_context,
1055 .kill_sb = kill_anon_super,
1056 };
1057
pidfs_alloc_file(struct pid * pid,unsigned int flags)1058 struct file *pidfs_alloc_file(struct pid *pid, unsigned int flags)
1059 {
1060 struct file *pidfd_file;
1061 struct path path __free(path_put) = {};
1062 int ret;
1063
1064 /*
1065 * Ensure that PIDFD_STALE can be passed as a flag without
1066 * overloading other uapi pidfd flags.
1067 */
1068 BUILD_BUG_ON(PIDFD_STALE == PIDFD_THREAD);
1069 BUILD_BUG_ON(PIDFD_STALE == PIDFD_NONBLOCK);
1070
1071 ret = path_from_stashed(&pid->stashed, pidfs_mnt, get_pid(pid), &path);
1072 if (ret < 0)
1073 return ERR_PTR(ret);
1074
1075 VFS_WARN_ON_ONCE(!pid->attr);
1076
1077 flags &= ~PIDFD_STALE;
1078 flags |= O_RDWR;
1079 pidfd_file = dentry_open(&path, flags, current_cred());
1080 /* Raise PIDFD_THREAD explicitly as do_dentry_open() strips it. */
1081 if (!IS_ERR(pidfd_file))
1082 pidfd_file->f_flags |= (flags & PIDFD_THREAD);
1083
1084 return pidfd_file;
1085 }
1086
pidfs_init(void)1087 void __init pidfs_init(void)
1088 {
1089 pidfs_attr_cachep = kmem_cache_create("pidfs_attr_cache", sizeof(struct pidfs_attr), 0,
1090 (SLAB_HWCACHE_ALIGN | SLAB_RECLAIM_ACCOUNT |
1091 SLAB_ACCOUNT | SLAB_PANIC), NULL);
1092
1093 pidfs_xattr_cachep = kmem_cache_create("pidfs_xattr_cache",
1094 sizeof(struct simple_xattrs), 0,
1095 (SLAB_HWCACHE_ALIGN | SLAB_RECLAIM_ACCOUNT |
1096 SLAB_ACCOUNT | SLAB_PANIC), NULL);
1097
1098 pidfs_mnt = kern_mount(&pidfs_type);
1099 if (IS_ERR(pidfs_mnt))
1100 panic("Failed to mount pidfs pseudo filesystem");
1101
1102 pidfs_root_path.mnt = pidfs_mnt;
1103 pidfs_root_path.dentry = pidfs_mnt->mnt_root;
1104 }
1105