xref: /linux/fs/fcntl.c (revision 79997eda0d31bc68203c95ecb978773ee6ce7a1f)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  *  linux/fs/fcntl.c
4  *
5  *  Copyright (C) 1991, 1992  Linus Torvalds
6  */
7 
8 #include <linux/syscalls.h>
9 #include <linux/init.h>
10 #include <linux/mm.h>
11 #include <linux/sched/task.h>
12 #include <linux/fs.h>
13 #include <linux/filelock.h>
14 #include <linux/file.h>
15 #include <linux/fdtable.h>
16 #include <linux/capability.h>
17 #include <linux/dnotify.h>
18 #include <linux/slab.h>
19 #include <linux/module.h>
20 #include <linux/pipe_fs_i.h>
21 #include <linux/security.h>
22 #include <linux/ptrace.h>
23 #include <linux/signal.h>
24 #include <linux/rcupdate.h>
25 #include <linux/pid_namespace.h>
26 #include <linux/user_namespace.h>
27 #include <linux/memfd.h>
28 #include <linux/compat.h>
29 #include <linux/mount.h>
30 
31 #include <linux/poll.h>
32 #include <asm/siginfo.h>
33 #include <linux/uaccess.h>
34 
35 #define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME)
36 
37 static int setfl(int fd, struct file * filp, unsigned int arg)
38 {
39 	struct inode * inode = file_inode(filp);
40 	int error = 0;
41 
42 	/*
43 	 * O_APPEND cannot be cleared if the file is marked as append-only
44 	 * and the file is open for write.
45 	 */
46 	if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode))
47 		return -EPERM;
48 
49 	/* O_NOATIME can only be set by the owner or superuser */
50 	if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME))
51 		if (!inode_owner_or_capable(file_mnt_idmap(filp), inode))
52 			return -EPERM;
53 
54 	/* required for strict SunOS emulation */
55 	if (O_NONBLOCK != O_NDELAY)
56 	       if (arg & O_NDELAY)
57 		   arg |= O_NONBLOCK;
58 
59 	/* Pipe packetized mode is controlled by O_DIRECT flag */
60 	if (!S_ISFIFO(inode->i_mode) &&
61 	    (arg & O_DIRECT) &&
62 	    !(filp->f_mode & FMODE_CAN_ODIRECT))
63 		return -EINVAL;
64 
65 	if (filp->f_op->check_flags)
66 		error = filp->f_op->check_flags(arg);
67 	if (error)
68 		return error;
69 
70 	/*
71 	 * ->fasync() is responsible for setting the FASYNC bit.
72 	 */
73 	if (((arg ^ filp->f_flags) & FASYNC) && filp->f_op->fasync) {
74 		error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);
75 		if (error < 0)
76 			goto out;
77 		if (error > 0)
78 			error = 0;
79 	}
80 	spin_lock(&filp->f_lock);
81 	filp->f_flags = (arg & SETFL_MASK) | (filp->f_flags & ~SETFL_MASK);
82 	filp->f_iocb_flags = iocb_flags(filp);
83 	spin_unlock(&filp->f_lock);
84 
85  out:
86 	return error;
87 }
88 
89 static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
90                      int force)
91 {
92 	write_lock_irq(&filp->f_owner.lock);
93 	if (force || !filp->f_owner.pid) {
94 		put_pid(filp->f_owner.pid);
95 		filp->f_owner.pid = get_pid(pid);
96 		filp->f_owner.pid_type = type;
97 
98 		if (pid) {
99 			const struct cred *cred = current_cred();
100 			filp->f_owner.uid = cred->uid;
101 			filp->f_owner.euid = cred->euid;
102 		}
103 	}
104 	write_unlock_irq(&filp->f_owner.lock);
105 }
106 
107 void __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
108 		int force)
109 {
110 	security_file_set_fowner(filp);
111 	f_modown(filp, pid, type, force);
112 }
113 EXPORT_SYMBOL(__f_setown);
114 
115 int f_setown(struct file *filp, int who, int force)
116 {
117 	enum pid_type type;
118 	struct pid *pid = NULL;
119 	int ret = 0;
120 
121 	type = PIDTYPE_TGID;
122 	if (who < 0) {
123 		/* avoid overflow below */
124 		if (who == INT_MIN)
125 			return -EINVAL;
126 
127 		type = PIDTYPE_PGID;
128 		who = -who;
129 	}
130 
131 	rcu_read_lock();
132 	if (who) {
133 		pid = find_vpid(who);
134 		if (!pid)
135 			ret = -ESRCH;
136 	}
137 
138 	if (!ret)
139 		__f_setown(filp, pid, type, force);
140 	rcu_read_unlock();
141 
142 	return ret;
143 }
144 EXPORT_SYMBOL(f_setown);
145 
146 void f_delown(struct file *filp)
147 {
148 	f_modown(filp, NULL, PIDTYPE_TGID, 1);
149 }
150 
151 pid_t f_getown(struct file *filp)
152 {
153 	pid_t pid = 0;
154 
155 	read_lock_irq(&filp->f_owner.lock);
156 	rcu_read_lock();
157 	if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type)) {
158 		pid = pid_vnr(filp->f_owner.pid);
159 		if (filp->f_owner.pid_type == PIDTYPE_PGID)
160 			pid = -pid;
161 	}
162 	rcu_read_unlock();
163 	read_unlock_irq(&filp->f_owner.lock);
164 	return pid;
165 }
166 
167 static int f_setown_ex(struct file *filp, unsigned long arg)
168 {
169 	struct f_owner_ex __user *owner_p = (void __user *)arg;
170 	struct f_owner_ex owner;
171 	struct pid *pid;
172 	int type;
173 	int ret;
174 
175 	ret = copy_from_user(&owner, owner_p, sizeof(owner));
176 	if (ret)
177 		return -EFAULT;
178 
179 	switch (owner.type) {
180 	case F_OWNER_TID:
181 		type = PIDTYPE_PID;
182 		break;
183 
184 	case F_OWNER_PID:
185 		type = PIDTYPE_TGID;
186 		break;
187 
188 	case F_OWNER_PGRP:
189 		type = PIDTYPE_PGID;
190 		break;
191 
192 	default:
193 		return -EINVAL;
194 	}
195 
196 	rcu_read_lock();
197 	pid = find_vpid(owner.pid);
198 	if (owner.pid && !pid)
199 		ret = -ESRCH;
200 	else
201 		 __f_setown(filp, pid, type, 1);
202 	rcu_read_unlock();
203 
204 	return ret;
205 }
206 
207 static int f_getown_ex(struct file *filp, unsigned long arg)
208 {
209 	struct f_owner_ex __user *owner_p = (void __user *)arg;
210 	struct f_owner_ex owner = {};
211 	int ret = 0;
212 
213 	read_lock_irq(&filp->f_owner.lock);
214 	rcu_read_lock();
215 	if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type))
216 		owner.pid = pid_vnr(filp->f_owner.pid);
217 	rcu_read_unlock();
218 	switch (filp->f_owner.pid_type) {
219 	case PIDTYPE_PID:
220 		owner.type = F_OWNER_TID;
221 		break;
222 
223 	case PIDTYPE_TGID:
224 		owner.type = F_OWNER_PID;
225 		break;
226 
227 	case PIDTYPE_PGID:
228 		owner.type = F_OWNER_PGRP;
229 		break;
230 
231 	default:
232 		WARN_ON(1);
233 		ret = -EINVAL;
234 		break;
235 	}
236 	read_unlock_irq(&filp->f_owner.lock);
237 
238 	if (!ret) {
239 		ret = copy_to_user(owner_p, &owner, sizeof(owner));
240 		if (ret)
241 			ret = -EFAULT;
242 	}
243 	return ret;
244 }
245 
246 #ifdef CONFIG_CHECKPOINT_RESTORE
247 static int f_getowner_uids(struct file *filp, unsigned long arg)
248 {
249 	struct user_namespace *user_ns = current_user_ns();
250 	uid_t __user *dst = (void __user *)arg;
251 	uid_t src[2];
252 	int err;
253 
254 	read_lock_irq(&filp->f_owner.lock);
255 	src[0] = from_kuid(user_ns, filp->f_owner.uid);
256 	src[1] = from_kuid(user_ns, filp->f_owner.euid);
257 	read_unlock_irq(&filp->f_owner.lock);
258 
259 	err  = put_user(src[0], &dst[0]);
260 	err |= put_user(src[1], &dst[1]);
261 
262 	return err;
263 }
264 #else
265 static int f_getowner_uids(struct file *filp, unsigned long arg)
266 {
267 	return -EINVAL;
268 }
269 #endif
270 
271 static bool rw_hint_valid(enum rw_hint hint)
272 {
273 	switch (hint) {
274 	case RWH_WRITE_LIFE_NOT_SET:
275 	case RWH_WRITE_LIFE_NONE:
276 	case RWH_WRITE_LIFE_SHORT:
277 	case RWH_WRITE_LIFE_MEDIUM:
278 	case RWH_WRITE_LIFE_LONG:
279 	case RWH_WRITE_LIFE_EXTREME:
280 		return true;
281 	default:
282 		return false;
283 	}
284 }
285 
286 static long fcntl_rw_hint(struct file *file, unsigned int cmd,
287 			  unsigned long arg)
288 {
289 	struct inode *inode = file_inode(file);
290 	u64 __user *argp = (u64 __user *)arg;
291 	enum rw_hint hint;
292 	u64 h;
293 
294 	switch (cmd) {
295 	case F_GET_RW_HINT:
296 		h = inode->i_write_hint;
297 		if (copy_to_user(argp, &h, sizeof(*argp)))
298 			return -EFAULT;
299 		return 0;
300 	case F_SET_RW_HINT:
301 		if (copy_from_user(&h, argp, sizeof(h)))
302 			return -EFAULT;
303 		hint = (enum rw_hint) h;
304 		if (!rw_hint_valid(hint))
305 			return -EINVAL;
306 
307 		inode_lock(inode);
308 		inode->i_write_hint = hint;
309 		inode_unlock(inode);
310 		return 0;
311 	default:
312 		return -EINVAL;
313 	}
314 }
315 
316 static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
317 		struct file *filp)
318 {
319 	void __user *argp = (void __user *)arg;
320 	int argi = (int)arg;
321 	struct flock flock;
322 	long err = -EINVAL;
323 
324 	switch (cmd) {
325 	case F_DUPFD:
326 		err = f_dupfd(argi, filp, 0);
327 		break;
328 	case F_DUPFD_CLOEXEC:
329 		err = f_dupfd(argi, filp, O_CLOEXEC);
330 		break;
331 	case F_GETFD:
332 		err = get_close_on_exec(fd) ? FD_CLOEXEC : 0;
333 		break;
334 	case F_SETFD:
335 		err = 0;
336 		set_close_on_exec(fd, argi & FD_CLOEXEC);
337 		break;
338 	case F_GETFL:
339 		err = filp->f_flags;
340 		break;
341 	case F_SETFL:
342 		err = setfl(fd, filp, argi);
343 		break;
344 #if BITS_PER_LONG != 32
345 	/* 32-bit arches must use fcntl64() */
346 	case F_OFD_GETLK:
347 #endif
348 	case F_GETLK:
349 		if (copy_from_user(&flock, argp, sizeof(flock)))
350 			return -EFAULT;
351 		err = fcntl_getlk(filp, cmd, &flock);
352 		if (!err && copy_to_user(argp, &flock, sizeof(flock)))
353 			return -EFAULT;
354 		break;
355 #if BITS_PER_LONG != 32
356 	/* 32-bit arches must use fcntl64() */
357 	case F_OFD_SETLK:
358 	case F_OFD_SETLKW:
359 		fallthrough;
360 #endif
361 	case F_SETLK:
362 	case F_SETLKW:
363 		if (copy_from_user(&flock, argp, sizeof(flock)))
364 			return -EFAULT;
365 		err = fcntl_setlk(fd, filp, cmd, &flock);
366 		break;
367 	case F_GETOWN:
368 		/*
369 		 * XXX If f_owner is a process group, the
370 		 * negative return value will get converted
371 		 * into an error.  Oops.  If we keep the
372 		 * current syscall conventions, the only way
373 		 * to fix this will be in libc.
374 		 */
375 		err = f_getown(filp);
376 		force_successful_syscall_return();
377 		break;
378 	case F_SETOWN:
379 		err = f_setown(filp, argi, 1);
380 		break;
381 	case F_GETOWN_EX:
382 		err = f_getown_ex(filp, arg);
383 		break;
384 	case F_SETOWN_EX:
385 		err = f_setown_ex(filp, arg);
386 		break;
387 	case F_GETOWNER_UIDS:
388 		err = f_getowner_uids(filp, arg);
389 		break;
390 	case F_GETSIG:
391 		err = filp->f_owner.signum;
392 		break;
393 	case F_SETSIG:
394 		/* arg == 0 restores default behaviour. */
395 		if (!valid_signal(argi)) {
396 			break;
397 		}
398 		err = 0;
399 		filp->f_owner.signum = argi;
400 		break;
401 	case F_GETLEASE:
402 		err = fcntl_getlease(filp);
403 		break;
404 	case F_SETLEASE:
405 		err = fcntl_setlease(fd, filp, argi);
406 		break;
407 	case F_NOTIFY:
408 		err = fcntl_dirnotify(fd, filp, argi);
409 		break;
410 	case F_SETPIPE_SZ:
411 	case F_GETPIPE_SZ:
412 		err = pipe_fcntl(filp, cmd, argi);
413 		break;
414 	case F_ADD_SEALS:
415 	case F_GET_SEALS:
416 		err = memfd_fcntl(filp, cmd, argi);
417 		break;
418 	case F_GET_RW_HINT:
419 	case F_SET_RW_HINT:
420 		err = fcntl_rw_hint(filp, cmd, arg);
421 		break;
422 	default:
423 		break;
424 	}
425 	return err;
426 }
427 
428 static int check_fcntl_cmd(unsigned cmd)
429 {
430 	switch (cmd) {
431 	case F_DUPFD:
432 	case F_DUPFD_CLOEXEC:
433 	case F_GETFD:
434 	case F_SETFD:
435 	case F_GETFL:
436 		return 1;
437 	}
438 	return 0;
439 }
440 
441 SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
442 {
443 	struct fd f = fdget_raw(fd);
444 	long err = -EBADF;
445 
446 	if (!f.file)
447 		goto out;
448 
449 	if (unlikely(f.file->f_mode & FMODE_PATH)) {
450 		if (!check_fcntl_cmd(cmd))
451 			goto out1;
452 	}
453 
454 	err = security_file_fcntl(f.file, cmd, arg);
455 	if (!err)
456 		err = do_fcntl(fd, cmd, arg, f.file);
457 
458 out1:
459  	fdput(f);
460 out:
461 	return err;
462 }
463 
464 #if BITS_PER_LONG == 32
465 SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
466 		unsigned long, arg)
467 {
468 	void __user *argp = (void __user *)arg;
469 	struct fd f = fdget_raw(fd);
470 	struct flock64 flock;
471 	long err = -EBADF;
472 
473 	if (!f.file)
474 		goto out;
475 
476 	if (unlikely(f.file->f_mode & FMODE_PATH)) {
477 		if (!check_fcntl_cmd(cmd))
478 			goto out1;
479 	}
480 
481 	err = security_file_fcntl(f.file, cmd, arg);
482 	if (err)
483 		goto out1;
484 
485 	switch (cmd) {
486 	case F_GETLK64:
487 	case F_OFD_GETLK:
488 		err = -EFAULT;
489 		if (copy_from_user(&flock, argp, sizeof(flock)))
490 			break;
491 		err = fcntl_getlk64(f.file, cmd, &flock);
492 		if (!err && copy_to_user(argp, &flock, sizeof(flock)))
493 			err = -EFAULT;
494 		break;
495 	case F_SETLK64:
496 	case F_SETLKW64:
497 	case F_OFD_SETLK:
498 	case F_OFD_SETLKW:
499 		err = -EFAULT;
500 		if (copy_from_user(&flock, argp, sizeof(flock)))
501 			break;
502 		err = fcntl_setlk64(fd, f.file, cmd, &flock);
503 		break;
504 	default:
505 		err = do_fcntl(fd, cmd, arg, f.file);
506 		break;
507 	}
508 out1:
509 	fdput(f);
510 out:
511 	return err;
512 }
513 #endif
514 
515 #ifdef CONFIG_COMPAT
516 /* careful - don't use anywhere else */
517 #define copy_flock_fields(dst, src)		\
518 	(dst)->l_type = (src)->l_type;		\
519 	(dst)->l_whence = (src)->l_whence;	\
520 	(dst)->l_start = (src)->l_start;	\
521 	(dst)->l_len = (src)->l_len;		\
522 	(dst)->l_pid = (src)->l_pid;
523 
524 static int get_compat_flock(struct flock *kfl, const struct compat_flock __user *ufl)
525 {
526 	struct compat_flock fl;
527 
528 	if (copy_from_user(&fl, ufl, sizeof(struct compat_flock)))
529 		return -EFAULT;
530 	copy_flock_fields(kfl, &fl);
531 	return 0;
532 }
533 
534 static int get_compat_flock64(struct flock *kfl, const struct compat_flock64 __user *ufl)
535 {
536 	struct compat_flock64 fl;
537 
538 	if (copy_from_user(&fl, ufl, sizeof(struct compat_flock64)))
539 		return -EFAULT;
540 	copy_flock_fields(kfl, &fl);
541 	return 0;
542 }
543 
544 static int put_compat_flock(const struct flock *kfl, struct compat_flock __user *ufl)
545 {
546 	struct compat_flock fl;
547 
548 	memset(&fl, 0, sizeof(struct compat_flock));
549 	copy_flock_fields(&fl, kfl);
550 	if (copy_to_user(ufl, &fl, sizeof(struct compat_flock)))
551 		return -EFAULT;
552 	return 0;
553 }
554 
555 static int put_compat_flock64(const struct flock *kfl, struct compat_flock64 __user *ufl)
556 {
557 	struct compat_flock64 fl;
558 
559 	BUILD_BUG_ON(sizeof(kfl->l_start) > sizeof(ufl->l_start));
560 	BUILD_BUG_ON(sizeof(kfl->l_len) > sizeof(ufl->l_len));
561 
562 	memset(&fl, 0, sizeof(struct compat_flock64));
563 	copy_flock_fields(&fl, kfl);
564 	if (copy_to_user(ufl, &fl, sizeof(struct compat_flock64)))
565 		return -EFAULT;
566 	return 0;
567 }
568 #undef copy_flock_fields
569 
570 static unsigned int
571 convert_fcntl_cmd(unsigned int cmd)
572 {
573 	switch (cmd) {
574 	case F_GETLK64:
575 		return F_GETLK;
576 	case F_SETLK64:
577 		return F_SETLK;
578 	case F_SETLKW64:
579 		return F_SETLKW;
580 	}
581 
582 	return cmd;
583 }
584 
585 /*
586  * GETLK was successful and we need to return the data, but it needs to fit in
587  * the compat structure.
588  * l_start shouldn't be too big, unless the original start + end is greater than
589  * COMPAT_OFF_T_MAX, in which case the app was asking for trouble, so we return
590  * -EOVERFLOW in that case.  l_len could be too big, in which case we just
591  * truncate it, and only allow the app to see that part of the conflicting lock
592  * that might make sense to it anyway
593  */
594 static int fixup_compat_flock(struct flock *flock)
595 {
596 	if (flock->l_start > COMPAT_OFF_T_MAX)
597 		return -EOVERFLOW;
598 	if (flock->l_len > COMPAT_OFF_T_MAX)
599 		flock->l_len = COMPAT_OFF_T_MAX;
600 	return 0;
601 }
602 
603 static long do_compat_fcntl64(unsigned int fd, unsigned int cmd,
604 			     compat_ulong_t arg)
605 {
606 	struct fd f = fdget_raw(fd);
607 	struct flock flock;
608 	long err = -EBADF;
609 
610 	if (!f.file)
611 		return err;
612 
613 	if (unlikely(f.file->f_mode & FMODE_PATH)) {
614 		if (!check_fcntl_cmd(cmd))
615 			goto out_put;
616 	}
617 
618 	err = security_file_fcntl(f.file, cmd, arg);
619 	if (err)
620 		goto out_put;
621 
622 	switch (cmd) {
623 	case F_GETLK:
624 		err = get_compat_flock(&flock, compat_ptr(arg));
625 		if (err)
626 			break;
627 		err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
628 		if (err)
629 			break;
630 		err = fixup_compat_flock(&flock);
631 		if (!err)
632 			err = put_compat_flock(&flock, compat_ptr(arg));
633 		break;
634 	case F_GETLK64:
635 	case F_OFD_GETLK:
636 		err = get_compat_flock64(&flock, compat_ptr(arg));
637 		if (err)
638 			break;
639 		err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
640 		if (!err)
641 			err = put_compat_flock64(&flock, compat_ptr(arg));
642 		break;
643 	case F_SETLK:
644 	case F_SETLKW:
645 		err = get_compat_flock(&flock, compat_ptr(arg));
646 		if (err)
647 			break;
648 		err = fcntl_setlk(fd, f.file, convert_fcntl_cmd(cmd), &flock);
649 		break;
650 	case F_SETLK64:
651 	case F_SETLKW64:
652 	case F_OFD_SETLK:
653 	case F_OFD_SETLKW:
654 		err = get_compat_flock64(&flock, compat_ptr(arg));
655 		if (err)
656 			break;
657 		err = fcntl_setlk(fd, f.file, convert_fcntl_cmd(cmd), &flock);
658 		break;
659 	default:
660 		err = do_fcntl(fd, cmd, arg, f.file);
661 		break;
662 	}
663 out_put:
664 	fdput(f);
665 	return err;
666 }
667 
668 COMPAT_SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
669 		       compat_ulong_t, arg)
670 {
671 	return do_compat_fcntl64(fd, cmd, arg);
672 }
673 
674 COMPAT_SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd,
675 		       compat_ulong_t, arg)
676 {
677 	switch (cmd) {
678 	case F_GETLK64:
679 	case F_SETLK64:
680 	case F_SETLKW64:
681 	case F_OFD_GETLK:
682 	case F_OFD_SETLK:
683 	case F_OFD_SETLKW:
684 		return -EINVAL;
685 	}
686 	return do_compat_fcntl64(fd, cmd, arg);
687 }
688 #endif
689 
690 /* Table to convert sigio signal codes into poll band bitmaps */
691 
692 static const __poll_t band_table[NSIGPOLL] = {
693 	EPOLLIN | EPOLLRDNORM,			/* POLL_IN */
694 	EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND,	/* POLL_OUT */
695 	EPOLLIN | EPOLLRDNORM | EPOLLMSG,		/* POLL_MSG */
696 	EPOLLERR,				/* POLL_ERR */
697 	EPOLLPRI | EPOLLRDBAND,			/* POLL_PRI */
698 	EPOLLHUP | EPOLLERR			/* POLL_HUP */
699 };
700 
701 static inline int sigio_perm(struct task_struct *p,
702                              struct fown_struct *fown, int sig)
703 {
704 	const struct cred *cred;
705 	int ret;
706 
707 	rcu_read_lock();
708 	cred = __task_cred(p);
709 	ret = ((uid_eq(fown->euid, GLOBAL_ROOT_UID) ||
710 		uid_eq(fown->euid, cred->suid) || uid_eq(fown->euid, cred->uid) ||
711 		uid_eq(fown->uid,  cred->suid) || uid_eq(fown->uid,  cred->uid)) &&
712 	       !security_file_send_sigiotask(p, fown, sig));
713 	rcu_read_unlock();
714 	return ret;
715 }
716 
717 static void send_sigio_to_task(struct task_struct *p,
718 			       struct fown_struct *fown,
719 			       int fd, int reason, enum pid_type type)
720 {
721 	/*
722 	 * F_SETSIG can change ->signum lockless in parallel, make
723 	 * sure we read it once and use the same value throughout.
724 	 */
725 	int signum = READ_ONCE(fown->signum);
726 
727 	if (!sigio_perm(p, fown, signum))
728 		return;
729 
730 	switch (signum) {
731 		default: {
732 			kernel_siginfo_t si;
733 
734 			/* Queue a rt signal with the appropriate fd as its
735 			   value.  We use SI_SIGIO as the source, not
736 			   SI_KERNEL, since kernel signals always get
737 			   delivered even if we can't queue.  Failure to
738 			   queue in this case _should_ be reported; we fall
739 			   back to SIGIO in that case. --sct */
740 			clear_siginfo(&si);
741 			si.si_signo = signum;
742 			si.si_errno = 0;
743 		        si.si_code  = reason;
744 			/*
745 			 * Posix definies POLL_IN and friends to be signal
746 			 * specific si_codes for SIG_POLL.  Linux extended
747 			 * these si_codes to other signals in a way that is
748 			 * ambiguous if other signals also have signal
749 			 * specific si_codes.  In that case use SI_SIGIO instead
750 			 * to remove the ambiguity.
751 			 */
752 			if ((signum != SIGPOLL) && sig_specific_sicodes(signum))
753 				si.si_code = SI_SIGIO;
754 
755 			/* Make sure we are called with one of the POLL_*
756 			   reasons, otherwise we could leak kernel stack into
757 			   userspace.  */
758 			BUG_ON((reason < POLL_IN) || ((reason - POLL_IN) >= NSIGPOLL));
759 			if (reason - POLL_IN >= NSIGPOLL)
760 				si.si_band  = ~0L;
761 			else
762 				si.si_band = mangle_poll(band_table[reason - POLL_IN]);
763 			si.si_fd    = fd;
764 			if (!do_send_sig_info(signum, &si, p, type))
765 				break;
766 		}
767 			fallthrough;	/* fall back on the old plain SIGIO signal */
768 		case 0:
769 			do_send_sig_info(SIGIO, SEND_SIG_PRIV, p, type);
770 	}
771 }
772 
773 void send_sigio(struct fown_struct *fown, int fd, int band)
774 {
775 	struct task_struct *p;
776 	enum pid_type type;
777 	unsigned long flags;
778 	struct pid *pid;
779 
780 	read_lock_irqsave(&fown->lock, flags);
781 
782 	type = fown->pid_type;
783 	pid = fown->pid;
784 	if (!pid)
785 		goto out_unlock_fown;
786 
787 	if (type <= PIDTYPE_TGID) {
788 		rcu_read_lock();
789 		p = pid_task(pid, PIDTYPE_PID);
790 		if (p)
791 			send_sigio_to_task(p, fown, fd, band, type);
792 		rcu_read_unlock();
793 	} else {
794 		read_lock(&tasklist_lock);
795 		do_each_pid_task(pid, type, p) {
796 			send_sigio_to_task(p, fown, fd, band, type);
797 		} while_each_pid_task(pid, type, p);
798 		read_unlock(&tasklist_lock);
799 	}
800  out_unlock_fown:
801 	read_unlock_irqrestore(&fown->lock, flags);
802 }
803 
804 static void send_sigurg_to_task(struct task_struct *p,
805 				struct fown_struct *fown, enum pid_type type)
806 {
807 	if (sigio_perm(p, fown, SIGURG))
808 		do_send_sig_info(SIGURG, SEND_SIG_PRIV, p, type);
809 }
810 
811 int send_sigurg(struct fown_struct *fown)
812 {
813 	struct task_struct *p;
814 	enum pid_type type;
815 	struct pid *pid;
816 	unsigned long flags;
817 	int ret = 0;
818 
819 	read_lock_irqsave(&fown->lock, flags);
820 
821 	type = fown->pid_type;
822 	pid = fown->pid;
823 	if (!pid)
824 		goto out_unlock_fown;
825 
826 	ret = 1;
827 
828 	if (type <= PIDTYPE_TGID) {
829 		rcu_read_lock();
830 		p = pid_task(pid, PIDTYPE_PID);
831 		if (p)
832 			send_sigurg_to_task(p, fown, type);
833 		rcu_read_unlock();
834 	} else {
835 		read_lock(&tasklist_lock);
836 		do_each_pid_task(pid, type, p) {
837 			send_sigurg_to_task(p, fown, type);
838 		} while_each_pid_task(pid, type, p);
839 		read_unlock(&tasklist_lock);
840 	}
841  out_unlock_fown:
842 	read_unlock_irqrestore(&fown->lock, flags);
843 	return ret;
844 }
845 
846 static DEFINE_SPINLOCK(fasync_lock);
847 static struct kmem_cache *fasync_cache __ro_after_init;
848 
849 static void fasync_free_rcu(struct rcu_head *head)
850 {
851 	kmem_cache_free(fasync_cache,
852 			container_of(head, struct fasync_struct, fa_rcu));
853 }
854 
855 /*
856  * Remove a fasync entry. If successfully removed, return
857  * positive and clear the FASYNC flag. If no entry exists,
858  * do nothing and return 0.
859  *
860  * NOTE! It is very important that the FASYNC flag always
861  * match the state "is the filp on a fasync list".
862  *
863  */
864 int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
865 {
866 	struct fasync_struct *fa, **fp;
867 	int result = 0;
868 
869 	spin_lock(&filp->f_lock);
870 	spin_lock(&fasync_lock);
871 	for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
872 		if (fa->fa_file != filp)
873 			continue;
874 
875 		write_lock_irq(&fa->fa_lock);
876 		fa->fa_file = NULL;
877 		write_unlock_irq(&fa->fa_lock);
878 
879 		*fp = fa->fa_next;
880 		call_rcu(&fa->fa_rcu, fasync_free_rcu);
881 		filp->f_flags &= ~FASYNC;
882 		result = 1;
883 		break;
884 	}
885 	spin_unlock(&fasync_lock);
886 	spin_unlock(&filp->f_lock);
887 	return result;
888 }
889 
890 struct fasync_struct *fasync_alloc(void)
891 {
892 	return kmem_cache_alloc(fasync_cache, GFP_KERNEL);
893 }
894 
895 /*
896  * NOTE! This can be used only for unused fasync entries:
897  * entries that actually got inserted on the fasync list
898  * need to be released by rcu - see fasync_remove_entry.
899  */
900 void fasync_free(struct fasync_struct *new)
901 {
902 	kmem_cache_free(fasync_cache, new);
903 }
904 
905 /*
906  * Insert a new entry into the fasync list.  Return the pointer to the
907  * old one if we didn't use the new one.
908  *
909  * NOTE! It is very important that the FASYNC flag always
910  * match the state "is the filp on a fasync list".
911  */
912 struct fasync_struct *fasync_insert_entry(int fd, struct file *filp, struct fasync_struct **fapp, struct fasync_struct *new)
913 {
914         struct fasync_struct *fa, **fp;
915 
916 	spin_lock(&filp->f_lock);
917 	spin_lock(&fasync_lock);
918 	for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
919 		if (fa->fa_file != filp)
920 			continue;
921 
922 		write_lock_irq(&fa->fa_lock);
923 		fa->fa_fd = fd;
924 		write_unlock_irq(&fa->fa_lock);
925 		goto out;
926 	}
927 
928 	rwlock_init(&new->fa_lock);
929 	new->magic = FASYNC_MAGIC;
930 	new->fa_file = filp;
931 	new->fa_fd = fd;
932 	new->fa_next = *fapp;
933 	rcu_assign_pointer(*fapp, new);
934 	filp->f_flags |= FASYNC;
935 
936 out:
937 	spin_unlock(&fasync_lock);
938 	spin_unlock(&filp->f_lock);
939 	return fa;
940 }
941 
942 /*
943  * Add a fasync entry. Return negative on error, positive if
944  * added, and zero if did nothing but change an existing one.
945  */
946 static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)
947 {
948 	struct fasync_struct *new;
949 
950 	new = fasync_alloc();
951 	if (!new)
952 		return -ENOMEM;
953 
954 	/*
955 	 * fasync_insert_entry() returns the old (update) entry if
956 	 * it existed.
957 	 *
958 	 * So free the (unused) new entry and return 0 to let the
959 	 * caller know that we didn't add any new fasync entries.
960 	 */
961 	if (fasync_insert_entry(fd, filp, fapp, new)) {
962 		fasync_free(new);
963 		return 0;
964 	}
965 
966 	return 1;
967 }
968 
969 /*
970  * fasync_helper() is used by almost all character device drivers
971  * to set up the fasync queue, and for regular files by the file
972  * lease code. It returns negative on error, 0 if it did no changes
973  * and positive if it added/deleted the entry.
974  */
975 int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
976 {
977 	if (!on)
978 		return fasync_remove_entry(filp, fapp);
979 	return fasync_add_entry(fd, filp, fapp);
980 }
981 
982 EXPORT_SYMBOL(fasync_helper);
983 
984 /*
985  * rcu_read_lock() is held
986  */
987 static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
988 {
989 	while (fa) {
990 		struct fown_struct *fown;
991 		unsigned long flags;
992 
993 		if (fa->magic != FASYNC_MAGIC) {
994 			printk(KERN_ERR "kill_fasync: bad magic number in "
995 			       "fasync_struct!\n");
996 			return;
997 		}
998 		read_lock_irqsave(&fa->fa_lock, flags);
999 		if (fa->fa_file) {
1000 			fown = &fa->fa_file->f_owner;
1001 			/* Don't send SIGURG to processes which have not set a
1002 			   queued signum: SIGURG has its own default signalling
1003 			   mechanism. */
1004 			if (!(sig == SIGURG && fown->signum == 0))
1005 				send_sigio(fown, fa->fa_fd, band);
1006 		}
1007 		read_unlock_irqrestore(&fa->fa_lock, flags);
1008 		fa = rcu_dereference(fa->fa_next);
1009 	}
1010 }
1011 
1012 void kill_fasync(struct fasync_struct **fp, int sig, int band)
1013 {
1014 	/* First a quick test without locking: usually
1015 	 * the list is empty.
1016 	 */
1017 	if (*fp) {
1018 		rcu_read_lock();
1019 		kill_fasync_rcu(rcu_dereference(*fp), sig, band);
1020 		rcu_read_unlock();
1021 	}
1022 }
1023 EXPORT_SYMBOL(kill_fasync);
1024 
1025 static int __init fcntl_init(void)
1026 {
1027 	/*
1028 	 * Please add new bits here to ensure allocation uniqueness.
1029 	 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
1030 	 * is defined as O_NONBLOCK on some platforms and not on others.
1031 	 */
1032 	BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ !=
1033 		HWEIGHT32(
1034 			(VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) |
1035 			__FMODE_EXEC | __FMODE_NONOTIFY));
1036 
1037 	fasync_cache = kmem_cache_create("fasync_cache",
1038 					 sizeof(struct fasync_struct), 0,
1039 					 SLAB_PANIC | SLAB_ACCOUNT, NULL);
1040 	return 0;
1041 }
1042 
1043 module_init(fcntl_init)
1044