xref: /linux/fs/locks.c (revision 87c9c16317882dd6dbbc07e349bc3223e14f3244)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  linux/fs/locks.c
4  *
5  *  Provide support for fcntl()'s F_GETLK, F_SETLK, and F_SETLKW calls.
6  *  Doug Evans (dje@spiff.uucp), August 07, 1992
7  *
8  *  Deadlock detection added.
9  *  FIXME: one thing isn't handled yet:
10  *	- mandatory locks (requires lots of changes elsewhere)
11  *  Kelly Carmichael (kelly@[142.24.8.65]), September 17, 1994.
12  *
13  *  Miscellaneous edits, and a total rewrite of posix_lock_file() code.
14  *  Kai Petzke (wpp@marie.physik.tu-berlin.de), 1994
15  *
16  *  Converted file_lock_table to a linked list from an array, which eliminates
17  *  the limits on how many active file locks are open.
18  *  Chad Page (pageone@netcom.com), November 27, 1994
19  *
20  *  Removed dependency on file descriptors. dup()'ed file descriptors now
21  *  get the same locks as the original file descriptors, and a close() on
22  *  any file descriptor removes ALL the locks on the file for the current
23  *  process. Since locks still depend on the process id, locks are inherited
24  *  after an exec() but not after a fork(). This agrees with POSIX, and both
25  *  BSD and SVR4 practice.
26  *  Andy Walker (andy@lysaker.kvaerner.no), February 14, 1995
27  *
28  *  Scrapped free list which is redundant now that we allocate locks
29  *  dynamically with kmalloc()/kfree().
30  *  Andy Walker (andy@lysaker.kvaerner.no), February 21, 1995
31  *
32  *  Implemented two lock personalities - FL_FLOCK and FL_POSIX.
33  *
34  *  FL_POSIX locks are created with calls to fcntl() and lockf() through the
35  *  fcntl() system call. They have the semantics described above.
36  *
37  *  FL_FLOCK locks are created with calls to flock(), through the flock()
38  *  system call, which is new. Old C libraries implement flock() via fcntl()
39  *  and will continue to use the old, broken implementation.
40  *
41  *  FL_FLOCK locks follow the 4.4 BSD flock() semantics. They are associated
42  *  with a file pointer (filp). As a result they can be shared by a parent
43  *  process and its children after a fork(). They are removed when the last
44  *  file descriptor referring to the file pointer is closed (unless explicitly
45  *  unlocked).
46  *
47  *  FL_FLOCK locks never deadlock, an existing lock is always removed before
48  *  upgrading from shared to exclusive (or vice versa). When this happens
49  *  any processes blocked by the current lock are woken up and allowed to
50  *  run before the new lock is applied.
51  *  Andy Walker (andy@lysaker.kvaerner.no), June 09, 1995
52  *
53  *  Removed some race conditions in flock_lock_file(), marked other possible
54  *  races. Just grep for FIXME to see them.
55  *  Dmitry Gorodchanin (pgmdsg@ibi.com), February 09, 1996.
56  *
57  *  Addressed Dmitry's concerns. Deadlock checking no longer recursive.
58  *  Lock allocation changed to GFP_ATOMIC as we can't afford to sleep
59  *  once we've checked for blocking and deadlocking.
60  *  Andy Walker (andy@lysaker.kvaerner.no), April 03, 1996.
61  *
62  *  Initial implementation of mandatory locks. SunOS turned out to be
63  *  a rotten model, so I implemented the "obvious" semantics.
64  *  See 'Documentation/filesystems/mandatory-locking.rst' for details.
65  *  Andy Walker (andy@lysaker.kvaerner.no), April 06, 1996.
66  *
67  *  Don't allow mandatory locks on mmap()'ed files. Added simple functions to
68  *  check if a file has mandatory locks, used by mmap(), open() and creat() to
69  *  see if system call should be rejected. Ref. HP-UX/SunOS/Solaris Reference
70  *  Manual, Section 2.
71  *  Andy Walker (andy@lysaker.kvaerner.no), April 09, 1996.
72  *
73  *  Tidied up block list handling. Added '/proc/locks' interface.
74  *  Andy Walker (andy@lysaker.kvaerner.no), April 24, 1996.
75  *
76  *  Fixed deadlock condition for pathological code that mixes calls to
77  *  flock() and fcntl().
78  *  Andy Walker (andy@lysaker.kvaerner.no), April 29, 1996.
79  *
80  *  Allow only one type of locking scheme (FL_POSIX or FL_FLOCK) to be in use
81  *  for a given file at a time. Changed the CONFIG_LOCK_MANDATORY scheme to
82  *  guarantee sensible behaviour in the case where file system modules might
83  *  be compiled with different options than the kernel itself.
84  *  Andy Walker (andy@lysaker.kvaerner.no), May 15, 1996.
85  *
86  *  Added a couple of missing wake_up() calls. Thanks to Thomas Meckel
87  *  (Thomas.Meckel@mni.fh-giessen.de) for spotting this.
88  *  Andy Walker (andy@lysaker.kvaerner.no), May 15, 1996.
89  *
90  *  Changed FL_POSIX locks to use the block list in the same way as FL_FLOCK
91  *  locks. Changed process synchronisation to avoid dereferencing locks that
92  *  have already been freed.
93  *  Andy Walker (andy@lysaker.kvaerner.no), Sep 21, 1996.
94  *
95  *  Made the block list a circular list to minimise searching in the list.
96  *  Andy Walker (andy@lysaker.kvaerner.no), Sep 25, 1996.
97  *
98  *  Made mandatory locking a mount option. Default is not to allow mandatory
99  *  locking.
100  *  Andy Walker (andy@lysaker.kvaerner.no), Oct 04, 1996.
101  *
102  *  Some adaptations for NFS support.
103  *  Olaf Kirch (okir@monad.swb.de), Dec 1996,
104  *
105  *  Fixed /proc/locks interface so that we can't overrun the buffer we are handed.
106  *  Andy Walker (andy@lysaker.kvaerner.no), May 12, 1997.
107  *
108  *  Use slab allocator instead of kmalloc/kfree.
109  *  Use generic list implementation from <linux/list.h>.
110  *  Sped up posix_locks_deadlock by only considering blocked locks.
111  *  Matthew Wilcox <willy@debian.org>, March, 2000.
112  *
113  *  Leases and LOCK_MAND
114  *  Matthew Wilcox <willy@debian.org>, June, 2000.
115  *  Stephen Rothwell <sfr@canb.auug.org.au>, June, 2000.
116  *
117  * Locking conflicts and dependencies:
118  * If multiple threads attempt to lock the same byte (or flock the same file)
119  * only one can be granted the lock, and other must wait their turn.
120  * The first lock has been "applied" or "granted", the others are "waiting"
121  * and are "blocked" by the "applied" lock..
122  *
123  * Waiting and applied locks are all kept in trees whose properties are:
124  *
125  *	- the root of a tree may be an applied or waiting lock.
126  *	- every other node in the tree is a waiting lock that
127  *	  conflicts with every ancestor of that node.
128  *
129  * Every such tree begins life as a waiting singleton which obviously
130  * satisfies the above properties.
131  *
132  * The only ways we modify trees preserve these properties:
133  *
134  *	1. We may add a new leaf node, but only after first verifying that it
135  *	   conflicts with all of its ancestors.
136  *	2. We may remove the root of a tree, creating a new singleton
137  *	   tree from the root and N new trees rooted in the immediate
138  *	   children.
139  *	3. If the root of a tree is not currently an applied lock, we may
140  *	   apply it (if possible).
141  *	4. We may upgrade the root of the tree (either extend its range,
142  *	   or upgrade its entire range from read to write).
143  *
144  * When an applied lock is modified in a way that reduces or downgrades any
145  * part of its range, we remove all its children (2 above).  This particularly
146  * happens when a lock is unlocked.
147  *
148  * For each of those child trees we "wake up" the thread which is
149  * waiting for the lock so it can continue handling as follows: if the
150  * root of the tree applies, we do so (3).  If it doesn't, it must
151  * conflict with some applied lock.  We remove (wake up) all of its children
152  * (2), and add it is a new leaf to the tree rooted in the applied
153  * lock (1).  We then repeat the process recursively with those
154  * children.
155  *
156  */
157 
158 #include <linux/capability.h>
159 #include <linux/file.h>
160 #include <linux/fdtable.h>
161 #include <linux/fs.h>
162 #include <linux/init.h>
163 #include <linux/security.h>
164 #include <linux/slab.h>
165 #include <linux/syscalls.h>
166 #include <linux/time.h>
167 #include <linux/rcupdate.h>
168 #include <linux/pid_namespace.h>
169 #include <linux/hashtable.h>
170 #include <linux/percpu.h>
171 
172 #define CREATE_TRACE_POINTS
173 #include <trace/events/filelock.h>
174 
175 #include <linux/uaccess.h>
176 
177 #define IS_POSIX(fl)	(fl->fl_flags & FL_POSIX)
178 #define IS_FLOCK(fl)	(fl->fl_flags & FL_FLOCK)
179 #define IS_LEASE(fl)	(fl->fl_flags & (FL_LEASE|FL_DELEG|FL_LAYOUT))
180 #define IS_OFDLCK(fl)	(fl->fl_flags & FL_OFDLCK)
181 #define IS_REMOTELCK(fl)	(fl->fl_pid <= 0)
182 
183 static bool lease_breaking(struct file_lock *fl)
184 {
185 	return fl->fl_flags & (FL_UNLOCK_PENDING | FL_DOWNGRADE_PENDING);
186 }
187 
188 static int target_leasetype(struct file_lock *fl)
189 {
190 	if (fl->fl_flags & FL_UNLOCK_PENDING)
191 		return F_UNLCK;
192 	if (fl->fl_flags & FL_DOWNGRADE_PENDING)
193 		return F_RDLCK;
194 	return fl->fl_type;
195 }
196 
197 int leases_enable = 1;
198 int lease_break_time = 45;
199 
200 /*
201  * The global file_lock_list is only used for displaying /proc/locks, so we
202  * keep a list on each CPU, with each list protected by its own spinlock.
203  * Global serialization is done using file_rwsem.
204  *
205  * Note that alterations to the list also require that the relevant flc_lock is
206  * held.
207  */
208 struct file_lock_list_struct {
209 	spinlock_t		lock;
210 	struct hlist_head	hlist;
211 };
212 static DEFINE_PER_CPU(struct file_lock_list_struct, file_lock_list);
213 DEFINE_STATIC_PERCPU_RWSEM(file_rwsem);
214 
215 
216 /*
217  * The blocked_hash is used to find POSIX lock loops for deadlock detection.
218  * It is protected by blocked_lock_lock.
219  *
220  * We hash locks by lockowner in order to optimize searching for the lock a
221  * particular lockowner is waiting on.
222  *
223  * FIXME: make this value scale via some heuristic? We generally will want more
224  * buckets when we have more lockowners holding locks, but that's a little
225  * difficult to determine without knowing what the workload will look like.
226  */
227 #define BLOCKED_HASH_BITS	7
228 static DEFINE_HASHTABLE(blocked_hash, BLOCKED_HASH_BITS);
229 
230 /*
231  * This lock protects the blocked_hash. Generally, if you're accessing it, you
232  * want to be holding this lock.
233  *
234  * In addition, it also protects the fl->fl_blocked_requests list, and the
235  * fl->fl_blocker pointer for file_lock structures that are acting as lock
236  * requests (in contrast to those that are acting as records of acquired locks).
237  *
238  * Note that when we acquire this lock in order to change the above fields,
239  * we often hold the flc_lock as well. In certain cases, when reading the fields
240  * protected by this lock, we can skip acquiring it iff we already hold the
241  * flc_lock.
242  */
243 static DEFINE_SPINLOCK(blocked_lock_lock);
244 
245 static struct kmem_cache *flctx_cache __read_mostly;
246 static struct kmem_cache *filelock_cache __read_mostly;
247 
248 static struct file_lock_context *
249 locks_get_lock_context(struct inode *inode, int type)
250 {
251 	struct file_lock_context *ctx;
252 
253 	/* paired with cmpxchg() below */
254 	ctx = smp_load_acquire(&inode->i_flctx);
255 	if (likely(ctx) || type == F_UNLCK)
256 		goto out;
257 
258 	ctx = kmem_cache_alloc(flctx_cache, GFP_KERNEL);
259 	if (!ctx)
260 		goto out;
261 
262 	spin_lock_init(&ctx->flc_lock);
263 	INIT_LIST_HEAD(&ctx->flc_flock);
264 	INIT_LIST_HEAD(&ctx->flc_posix);
265 	INIT_LIST_HEAD(&ctx->flc_lease);
266 
267 	/*
268 	 * Assign the pointer if it's not already assigned. If it is, then
269 	 * free the context we just allocated.
270 	 */
271 	if (cmpxchg(&inode->i_flctx, NULL, ctx)) {
272 		kmem_cache_free(flctx_cache, ctx);
273 		ctx = smp_load_acquire(&inode->i_flctx);
274 	}
275 out:
276 	trace_locks_get_lock_context(inode, type, ctx);
277 	return ctx;
278 }
279 
280 static void
281 locks_dump_ctx_list(struct list_head *list, char *list_type)
282 {
283 	struct file_lock *fl;
284 
285 	list_for_each_entry(fl, list, fl_list) {
286 		pr_warn("%s: fl_owner=%p fl_flags=0x%x fl_type=0x%x fl_pid=%u\n", list_type, fl->fl_owner, fl->fl_flags, fl->fl_type, fl->fl_pid);
287 	}
288 }
289 
290 static void
291 locks_check_ctx_lists(struct inode *inode)
292 {
293 	struct file_lock_context *ctx = inode->i_flctx;
294 
295 	if (unlikely(!list_empty(&ctx->flc_flock) ||
296 		     !list_empty(&ctx->flc_posix) ||
297 		     !list_empty(&ctx->flc_lease))) {
298 		pr_warn("Leaked locks on dev=0x%x:0x%x ino=0x%lx:\n",
299 			MAJOR(inode->i_sb->s_dev), MINOR(inode->i_sb->s_dev),
300 			inode->i_ino);
301 		locks_dump_ctx_list(&ctx->flc_flock, "FLOCK");
302 		locks_dump_ctx_list(&ctx->flc_posix, "POSIX");
303 		locks_dump_ctx_list(&ctx->flc_lease, "LEASE");
304 	}
305 }
306 
307 static void
308 locks_check_ctx_file_list(struct file *filp, struct list_head *list,
309 				char *list_type)
310 {
311 	struct file_lock *fl;
312 	struct inode *inode = locks_inode(filp);
313 
314 	list_for_each_entry(fl, list, fl_list)
315 		if (fl->fl_file == filp)
316 			pr_warn("Leaked %s lock on dev=0x%x:0x%x ino=0x%lx "
317 				" fl_owner=%p fl_flags=0x%x fl_type=0x%x fl_pid=%u\n",
318 				list_type, MAJOR(inode->i_sb->s_dev),
319 				MINOR(inode->i_sb->s_dev), inode->i_ino,
320 				fl->fl_owner, fl->fl_flags, fl->fl_type, fl->fl_pid);
321 }
322 
323 void
324 locks_free_lock_context(struct inode *inode)
325 {
326 	struct file_lock_context *ctx = inode->i_flctx;
327 
328 	if (unlikely(ctx)) {
329 		locks_check_ctx_lists(inode);
330 		kmem_cache_free(flctx_cache, ctx);
331 	}
332 }
333 
334 static void locks_init_lock_heads(struct file_lock *fl)
335 {
336 	INIT_HLIST_NODE(&fl->fl_link);
337 	INIT_LIST_HEAD(&fl->fl_list);
338 	INIT_LIST_HEAD(&fl->fl_blocked_requests);
339 	INIT_LIST_HEAD(&fl->fl_blocked_member);
340 	init_waitqueue_head(&fl->fl_wait);
341 }
342 
343 /* Allocate an empty lock structure. */
344 struct file_lock *locks_alloc_lock(void)
345 {
346 	struct file_lock *fl = kmem_cache_zalloc(filelock_cache, GFP_KERNEL);
347 
348 	if (fl)
349 		locks_init_lock_heads(fl);
350 
351 	return fl;
352 }
353 EXPORT_SYMBOL_GPL(locks_alloc_lock);
354 
355 void locks_release_private(struct file_lock *fl)
356 {
357 	BUG_ON(waitqueue_active(&fl->fl_wait));
358 	BUG_ON(!list_empty(&fl->fl_list));
359 	BUG_ON(!list_empty(&fl->fl_blocked_requests));
360 	BUG_ON(!list_empty(&fl->fl_blocked_member));
361 	BUG_ON(!hlist_unhashed(&fl->fl_link));
362 
363 	if (fl->fl_ops) {
364 		if (fl->fl_ops->fl_release_private)
365 			fl->fl_ops->fl_release_private(fl);
366 		fl->fl_ops = NULL;
367 	}
368 
369 	if (fl->fl_lmops) {
370 		if (fl->fl_lmops->lm_put_owner) {
371 			fl->fl_lmops->lm_put_owner(fl->fl_owner);
372 			fl->fl_owner = NULL;
373 		}
374 		fl->fl_lmops = NULL;
375 	}
376 }
377 EXPORT_SYMBOL_GPL(locks_release_private);
378 
379 /* Free a lock which is not in use. */
380 void locks_free_lock(struct file_lock *fl)
381 {
382 	locks_release_private(fl);
383 	kmem_cache_free(filelock_cache, fl);
384 }
385 EXPORT_SYMBOL(locks_free_lock);
386 
387 static void
388 locks_dispose_list(struct list_head *dispose)
389 {
390 	struct file_lock *fl;
391 
392 	while (!list_empty(dispose)) {
393 		fl = list_first_entry(dispose, struct file_lock, fl_list);
394 		list_del_init(&fl->fl_list);
395 		locks_free_lock(fl);
396 	}
397 }
398 
399 void locks_init_lock(struct file_lock *fl)
400 {
401 	memset(fl, 0, sizeof(struct file_lock));
402 	locks_init_lock_heads(fl);
403 }
404 EXPORT_SYMBOL(locks_init_lock);
405 
406 /*
407  * Initialize a new lock from an existing file_lock structure.
408  */
409 void locks_copy_conflock(struct file_lock *new, struct file_lock *fl)
410 {
411 	new->fl_owner = fl->fl_owner;
412 	new->fl_pid = fl->fl_pid;
413 	new->fl_file = NULL;
414 	new->fl_flags = fl->fl_flags;
415 	new->fl_type = fl->fl_type;
416 	new->fl_start = fl->fl_start;
417 	new->fl_end = fl->fl_end;
418 	new->fl_lmops = fl->fl_lmops;
419 	new->fl_ops = NULL;
420 
421 	if (fl->fl_lmops) {
422 		if (fl->fl_lmops->lm_get_owner)
423 			fl->fl_lmops->lm_get_owner(fl->fl_owner);
424 	}
425 }
426 EXPORT_SYMBOL(locks_copy_conflock);
427 
428 void locks_copy_lock(struct file_lock *new, struct file_lock *fl)
429 {
430 	/* "new" must be a freshly-initialized lock */
431 	WARN_ON_ONCE(new->fl_ops);
432 
433 	locks_copy_conflock(new, fl);
434 
435 	new->fl_file = fl->fl_file;
436 	new->fl_ops = fl->fl_ops;
437 
438 	if (fl->fl_ops) {
439 		if (fl->fl_ops->fl_copy_lock)
440 			fl->fl_ops->fl_copy_lock(new, fl);
441 	}
442 }
443 EXPORT_SYMBOL(locks_copy_lock);
444 
445 static void locks_move_blocks(struct file_lock *new, struct file_lock *fl)
446 {
447 	struct file_lock *f;
448 
449 	/*
450 	 * As ctx->flc_lock is held, new requests cannot be added to
451 	 * ->fl_blocked_requests, so we don't need a lock to check if it
452 	 * is empty.
453 	 */
454 	if (list_empty(&fl->fl_blocked_requests))
455 		return;
456 	spin_lock(&blocked_lock_lock);
457 	list_splice_init(&fl->fl_blocked_requests, &new->fl_blocked_requests);
458 	list_for_each_entry(f, &new->fl_blocked_requests, fl_blocked_member)
459 		f->fl_blocker = new;
460 	spin_unlock(&blocked_lock_lock);
461 }
462 
463 static inline int flock_translate_cmd(int cmd) {
464 	if (cmd & LOCK_MAND)
465 		return cmd & (LOCK_MAND | LOCK_RW);
466 	switch (cmd) {
467 	case LOCK_SH:
468 		return F_RDLCK;
469 	case LOCK_EX:
470 		return F_WRLCK;
471 	case LOCK_UN:
472 		return F_UNLCK;
473 	}
474 	return -EINVAL;
475 }
476 
477 /* Fill in a file_lock structure with an appropriate FLOCK lock. */
478 static struct file_lock *
479 flock_make_lock(struct file *filp, unsigned int cmd, struct file_lock *fl)
480 {
481 	int type = flock_translate_cmd(cmd);
482 
483 	if (type < 0)
484 		return ERR_PTR(type);
485 
486 	if (fl == NULL) {
487 		fl = locks_alloc_lock();
488 		if (fl == NULL)
489 			return ERR_PTR(-ENOMEM);
490 	} else {
491 		locks_init_lock(fl);
492 	}
493 
494 	fl->fl_file = filp;
495 	fl->fl_owner = filp;
496 	fl->fl_pid = current->tgid;
497 	fl->fl_flags = FL_FLOCK;
498 	fl->fl_type = type;
499 	fl->fl_end = OFFSET_MAX;
500 
501 	return fl;
502 }
503 
504 static int assign_type(struct file_lock *fl, long type)
505 {
506 	switch (type) {
507 	case F_RDLCK:
508 	case F_WRLCK:
509 	case F_UNLCK:
510 		fl->fl_type = type;
511 		break;
512 	default:
513 		return -EINVAL;
514 	}
515 	return 0;
516 }
517 
518 static int flock64_to_posix_lock(struct file *filp, struct file_lock *fl,
519 				 struct flock64 *l)
520 {
521 	switch (l->l_whence) {
522 	case SEEK_SET:
523 		fl->fl_start = 0;
524 		break;
525 	case SEEK_CUR:
526 		fl->fl_start = filp->f_pos;
527 		break;
528 	case SEEK_END:
529 		fl->fl_start = i_size_read(file_inode(filp));
530 		break;
531 	default:
532 		return -EINVAL;
533 	}
534 	if (l->l_start > OFFSET_MAX - fl->fl_start)
535 		return -EOVERFLOW;
536 	fl->fl_start += l->l_start;
537 	if (fl->fl_start < 0)
538 		return -EINVAL;
539 
540 	/* POSIX-1996 leaves the case l->l_len < 0 undefined;
541 	   POSIX-2001 defines it. */
542 	if (l->l_len > 0) {
543 		if (l->l_len - 1 > OFFSET_MAX - fl->fl_start)
544 			return -EOVERFLOW;
545 		fl->fl_end = fl->fl_start + (l->l_len - 1);
546 
547 	} else if (l->l_len < 0) {
548 		if (fl->fl_start + l->l_len < 0)
549 			return -EINVAL;
550 		fl->fl_end = fl->fl_start - 1;
551 		fl->fl_start += l->l_len;
552 	} else
553 		fl->fl_end = OFFSET_MAX;
554 
555 	fl->fl_owner = current->files;
556 	fl->fl_pid = current->tgid;
557 	fl->fl_file = filp;
558 	fl->fl_flags = FL_POSIX;
559 	fl->fl_ops = NULL;
560 	fl->fl_lmops = NULL;
561 
562 	return assign_type(fl, l->l_type);
563 }
564 
565 /* Verify a "struct flock" and copy it to a "struct file_lock" as a POSIX
566  * style lock.
567  */
568 static int flock_to_posix_lock(struct file *filp, struct file_lock *fl,
569 			       struct flock *l)
570 {
571 	struct flock64 ll = {
572 		.l_type = l->l_type,
573 		.l_whence = l->l_whence,
574 		.l_start = l->l_start,
575 		.l_len = l->l_len,
576 	};
577 
578 	return flock64_to_posix_lock(filp, fl, &ll);
579 }
580 
581 /* default lease lock manager operations */
582 static bool
583 lease_break_callback(struct file_lock *fl)
584 {
585 	kill_fasync(&fl->fl_fasync, SIGIO, POLL_MSG);
586 	return false;
587 }
588 
589 static void
590 lease_setup(struct file_lock *fl, void **priv)
591 {
592 	struct file *filp = fl->fl_file;
593 	struct fasync_struct *fa = *priv;
594 
595 	/*
596 	 * fasync_insert_entry() returns the old entry if any. If there was no
597 	 * old entry, then it used "priv" and inserted it into the fasync list.
598 	 * Clear the pointer to indicate that it shouldn't be freed.
599 	 */
600 	if (!fasync_insert_entry(fa->fa_fd, filp, &fl->fl_fasync, fa))
601 		*priv = NULL;
602 
603 	__f_setown(filp, task_pid(current), PIDTYPE_TGID, 0);
604 }
605 
606 static const struct lock_manager_operations lease_manager_ops = {
607 	.lm_break = lease_break_callback,
608 	.lm_change = lease_modify,
609 	.lm_setup = lease_setup,
610 };
611 
612 /*
613  * Initialize a lease, use the default lock manager operations
614  */
615 static int lease_init(struct file *filp, long type, struct file_lock *fl)
616 {
617 	if (assign_type(fl, type) != 0)
618 		return -EINVAL;
619 
620 	fl->fl_owner = filp;
621 	fl->fl_pid = current->tgid;
622 
623 	fl->fl_file = filp;
624 	fl->fl_flags = FL_LEASE;
625 	fl->fl_start = 0;
626 	fl->fl_end = OFFSET_MAX;
627 	fl->fl_ops = NULL;
628 	fl->fl_lmops = &lease_manager_ops;
629 	return 0;
630 }
631 
632 /* Allocate a file_lock initialised to this type of lease */
633 static struct file_lock *lease_alloc(struct file *filp, long type)
634 {
635 	struct file_lock *fl = locks_alloc_lock();
636 	int error = -ENOMEM;
637 
638 	if (fl == NULL)
639 		return ERR_PTR(error);
640 
641 	error = lease_init(filp, type, fl);
642 	if (error) {
643 		locks_free_lock(fl);
644 		return ERR_PTR(error);
645 	}
646 	return fl;
647 }
648 
649 /* Check if two locks overlap each other.
650  */
651 static inline int locks_overlap(struct file_lock *fl1, struct file_lock *fl2)
652 {
653 	return ((fl1->fl_end >= fl2->fl_start) &&
654 		(fl2->fl_end >= fl1->fl_start));
655 }
656 
657 /*
658  * Check whether two locks have the same owner.
659  */
660 static int posix_same_owner(struct file_lock *fl1, struct file_lock *fl2)
661 {
662 	return fl1->fl_owner == fl2->fl_owner;
663 }
664 
665 /* Must be called with the flc_lock held! */
666 static void locks_insert_global_locks(struct file_lock *fl)
667 {
668 	struct file_lock_list_struct *fll = this_cpu_ptr(&file_lock_list);
669 
670 	percpu_rwsem_assert_held(&file_rwsem);
671 
672 	spin_lock(&fll->lock);
673 	fl->fl_link_cpu = smp_processor_id();
674 	hlist_add_head(&fl->fl_link, &fll->hlist);
675 	spin_unlock(&fll->lock);
676 }
677 
678 /* Must be called with the flc_lock held! */
679 static void locks_delete_global_locks(struct file_lock *fl)
680 {
681 	struct file_lock_list_struct *fll;
682 
683 	percpu_rwsem_assert_held(&file_rwsem);
684 
685 	/*
686 	 * Avoid taking lock if already unhashed. This is safe since this check
687 	 * is done while holding the flc_lock, and new insertions into the list
688 	 * also require that it be held.
689 	 */
690 	if (hlist_unhashed(&fl->fl_link))
691 		return;
692 
693 	fll = per_cpu_ptr(&file_lock_list, fl->fl_link_cpu);
694 	spin_lock(&fll->lock);
695 	hlist_del_init(&fl->fl_link);
696 	spin_unlock(&fll->lock);
697 }
698 
699 static unsigned long
700 posix_owner_key(struct file_lock *fl)
701 {
702 	return (unsigned long)fl->fl_owner;
703 }
704 
705 static void locks_insert_global_blocked(struct file_lock *waiter)
706 {
707 	lockdep_assert_held(&blocked_lock_lock);
708 
709 	hash_add(blocked_hash, &waiter->fl_link, posix_owner_key(waiter));
710 }
711 
712 static void locks_delete_global_blocked(struct file_lock *waiter)
713 {
714 	lockdep_assert_held(&blocked_lock_lock);
715 
716 	hash_del(&waiter->fl_link);
717 }
718 
719 /* Remove waiter from blocker's block list.
720  * When blocker ends up pointing to itself then the list is empty.
721  *
722  * Must be called with blocked_lock_lock held.
723  */
724 static void __locks_delete_block(struct file_lock *waiter)
725 {
726 	locks_delete_global_blocked(waiter);
727 	list_del_init(&waiter->fl_blocked_member);
728 }
729 
730 static void __locks_wake_up_blocks(struct file_lock *blocker)
731 {
732 	while (!list_empty(&blocker->fl_blocked_requests)) {
733 		struct file_lock *waiter;
734 
735 		waiter = list_first_entry(&blocker->fl_blocked_requests,
736 					  struct file_lock, fl_blocked_member);
737 		__locks_delete_block(waiter);
738 		if (waiter->fl_lmops && waiter->fl_lmops->lm_notify)
739 			waiter->fl_lmops->lm_notify(waiter);
740 		else
741 			wake_up(&waiter->fl_wait);
742 
743 		/*
744 		 * The setting of fl_blocker to NULL marks the "done"
745 		 * point in deleting a block. Paired with acquire at the top
746 		 * of locks_delete_block().
747 		 */
748 		smp_store_release(&waiter->fl_blocker, NULL);
749 	}
750 }
751 
752 /**
753  *	locks_delete_block - stop waiting for a file lock
754  *	@waiter: the lock which was waiting
755  *
756  *	lockd/nfsd need to disconnect the lock while working on it.
757  */
758 int locks_delete_block(struct file_lock *waiter)
759 {
760 	int status = -ENOENT;
761 
762 	/*
763 	 * If fl_blocker is NULL, it won't be set again as this thread "owns"
764 	 * the lock and is the only one that might try to claim the lock.
765 	 *
766 	 * We use acquire/release to manage fl_blocker so that we can
767 	 * optimize away taking the blocked_lock_lock in many cases.
768 	 *
769 	 * The smp_load_acquire guarantees two things:
770 	 *
771 	 * 1/ that fl_blocked_requests can be tested locklessly. If something
772 	 * was recently added to that list it must have been in a locked region
773 	 * *before* the locked region when fl_blocker was set to NULL.
774 	 *
775 	 * 2/ that no other thread is accessing 'waiter', so it is safe to free
776 	 * it.  __locks_wake_up_blocks is careful not to touch waiter after
777 	 * fl_blocker is released.
778 	 *
779 	 * If a lockless check of fl_blocker shows it to be NULL, we know that
780 	 * no new locks can be inserted into its fl_blocked_requests list, and
781 	 * can avoid doing anything further if the list is empty.
782 	 */
783 	if (!smp_load_acquire(&waiter->fl_blocker) &&
784 	    list_empty(&waiter->fl_blocked_requests))
785 		return status;
786 
787 	spin_lock(&blocked_lock_lock);
788 	if (waiter->fl_blocker)
789 		status = 0;
790 	__locks_wake_up_blocks(waiter);
791 	__locks_delete_block(waiter);
792 
793 	/*
794 	 * The setting of fl_blocker to NULL marks the "done" point in deleting
795 	 * a block. Paired with acquire at the top of this function.
796 	 */
797 	smp_store_release(&waiter->fl_blocker, NULL);
798 	spin_unlock(&blocked_lock_lock);
799 	return status;
800 }
801 EXPORT_SYMBOL(locks_delete_block);
802 
803 /* Insert waiter into blocker's block list.
804  * We use a circular list so that processes can be easily woken up in
805  * the order they blocked. The documentation doesn't require this but
806  * it seems like the reasonable thing to do.
807  *
808  * Must be called with both the flc_lock and blocked_lock_lock held. The
809  * fl_blocked_requests list itself is protected by the blocked_lock_lock,
810  * but by ensuring that the flc_lock is also held on insertions we can avoid
811  * taking the blocked_lock_lock in some cases when we see that the
812  * fl_blocked_requests list is empty.
813  *
814  * Rather than just adding to the list, we check for conflicts with any existing
815  * waiters, and add beneath any waiter that blocks the new waiter.
816  * Thus wakeups don't happen until needed.
817  */
818 static void __locks_insert_block(struct file_lock *blocker,
819 				 struct file_lock *waiter,
820 				 bool conflict(struct file_lock *,
821 					       struct file_lock *))
822 {
823 	struct file_lock *fl;
824 	BUG_ON(!list_empty(&waiter->fl_blocked_member));
825 
826 new_blocker:
827 	list_for_each_entry(fl, &blocker->fl_blocked_requests, fl_blocked_member)
828 		if (conflict(fl, waiter)) {
829 			blocker =  fl;
830 			goto new_blocker;
831 		}
832 	waiter->fl_blocker = blocker;
833 	list_add_tail(&waiter->fl_blocked_member, &blocker->fl_blocked_requests);
834 	if (IS_POSIX(blocker) && !IS_OFDLCK(blocker))
835 		locks_insert_global_blocked(waiter);
836 
837 	/* The requests in waiter->fl_blocked are known to conflict with
838 	 * waiter, but might not conflict with blocker, or the requests
839 	 * and lock which block it.  So they all need to be woken.
840 	 */
841 	__locks_wake_up_blocks(waiter);
842 }
843 
844 /* Must be called with flc_lock held. */
845 static void locks_insert_block(struct file_lock *blocker,
846 			       struct file_lock *waiter,
847 			       bool conflict(struct file_lock *,
848 					     struct file_lock *))
849 {
850 	spin_lock(&blocked_lock_lock);
851 	__locks_insert_block(blocker, waiter, conflict);
852 	spin_unlock(&blocked_lock_lock);
853 }
854 
855 /*
856  * Wake up processes blocked waiting for blocker.
857  *
858  * Must be called with the inode->flc_lock held!
859  */
860 static void locks_wake_up_blocks(struct file_lock *blocker)
861 {
862 	/*
863 	 * Avoid taking global lock if list is empty. This is safe since new
864 	 * blocked requests are only added to the list under the flc_lock, and
865 	 * the flc_lock is always held here. Note that removal from the
866 	 * fl_blocked_requests list does not require the flc_lock, so we must
867 	 * recheck list_empty() after acquiring the blocked_lock_lock.
868 	 */
869 	if (list_empty(&blocker->fl_blocked_requests))
870 		return;
871 
872 	spin_lock(&blocked_lock_lock);
873 	__locks_wake_up_blocks(blocker);
874 	spin_unlock(&blocked_lock_lock);
875 }
876 
877 static void
878 locks_insert_lock_ctx(struct file_lock *fl, struct list_head *before)
879 {
880 	list_add_tail(&fl->fl_list, before);
881 	locks_insert_global_locks(fl);
882 }
883 
884 static void
885 locks_unlink_lock_ctx(struct file_lock *fl)
886 {
887 	locks_delete_global_locks(fl);
888 	list_del_init(&fl->fl_list);
889 	locks_wake_up_blocks(fl);
890 }
891 
892 static void
893 locks_delete_lock_ctx(struct file_lock *fl, struct list_head *dispose)
894 {
895 	locks_unlink_lock_ctx(fl);
896 	if (dispose)
897 		list_add(&fl->fl_list, dispose);
898 	else
899 		locks_free_lock(fl);
900 }
901 
902 /* Determine if lock sys_fl blocks lock caller_fl. Common functionality
903  * checks for shared/exclusive status of overlapping locks.
904  */
905 static bool locks_conflict(struct file_lock *caller_fl,
906 			   struct file_lock *sys_fl)
907 {
908 	if (sys_fl->fl_type == F_WRLCK)
909 		return true;
910 	if (caller_fl->fl_type == F_WRLCK)
911 		return true;
912 	return false;
913 }
914 
915 /* Determine if lock sys_fl blocks lock caller_fl. POSIX specific
916  * checking before calling the locks_conflict().
917  */
918 static bool posix_locks_conflict(struct file_lock *caller_fl,
919 				 struct file_lock *sys_fl)
920 {
921 	/* POSIX locks owned by the same process do not conflict with
922 	 * each other.
923 	 */
924 	if (posix_same_owner(caller_fl, sys_fl))
925 		return false;
926 
927 	/* Check whether they overlap */
928 	if (!locks_overlap(caller_fl, sys_fl))
929 		return false;
930 
931 	return locks_conflict(caller_fl, sys_fl);
932 }
933 
934 /* Determine if lock sys_fl blocks lock caller_fl. FLOCK specific
935  * checking before calling the locks_conflict().
936  */
937 static bool flock_locks_conflict(struct file_lock *caller_fl,
938 				 struct file_lock *sys_fl)
939 {
940 	/* FLOCK locks referring to the same filp do not conflict with
941 	 * each other.
942 	 */
943 	if (caller_fl->fl_file == sys_fl->fl_file)
944 		return false;
945 	if ((caller_fl->fl_type & LOCK_MAND) || (sys_fl->fl_type & LOCK_MAND))
946 		return false;
947 
948 	return locks_conflict(caller_fl, sys_fl);
949 }
950 
951 void
952 posix_test_lock(struct file *filp, struct file_lock *fl)
953 {
954 	struct file_lock *cfl;
955 	struct file_lock_context *ctx;
956 	struct inode *inode = locks_inode(filp);
957 
958 	ctx = smp_load_acquire(&inode->i_flctx);
959 	if (!ctx || list_empty_careful(&ctx->flc_posix)) {
960 		fl->fl_type = F_UNLCK;
961 		return;
962 	}
963 
964 	spin_lock(&ctx->flc_lock);
965 	list_for_each_entry(cfl, &ctx->flc_posix, fl_list) {
966 		if (posix_locks_conflict(fl, cfl)) {
967 			locks_copy_conflock(fl, cfl);
968 			goto out;
969 		}
970 	}
971 	fl->fl_type = F_UNLCK;
972 out:
973 	spin_unlock(&ctx->flc_lock);
974 	return;
975 }
976 EXPORT_SYMBOL(posix_test_lock);
977 
978 /*
979  * Deadlock detection:
980  *
981  * We attempt to detect deadlocks that are due purely to posix file
982  * locks.
983  *
984  * We assume that a task can be waiting for at most one lock at a time.
985  * So for any acquired lock, the process holding that lock may be
986  * waiting on at most one other lock.  That lock in turns may be held by
987  * someone waiting for at most one other lock.  Given a requested lock
988  * caller_fl which is about to wait for a conflicting lock block_fl, we
989  * follow this chain of waiters to ensure we are not about to create a
990  * cycle.
991  *
992  * Since we do this before we ever put a process to sleep on a lock, we
993  * are ensured that there is never a cycle; that is what guarantees that
994  * the while() loop in posix_locks_deadlock() eventually completes.
995  *
996  * Note: the above assumption may not be true when handling lock
997  * requests from a broken NFS client. It may also fail in the presence
998  * of tasks (such as posix threads) sharing the same open file table.
999  * To handle those cases, we just bail out after a few iterations.
1000  *
1001  * For FL_OFDLCK locks, the owner is the filp, not the files_struct.
1002  * Because the owner is not even nominally tied to a thread of
1003  * execution, the deadlock detection below can't reasonably work well. Just
1004  * skip it for those.
1005  *
1006  * In principle, we could do a more limited deadlock detection on FL_OFDLCK
1007  * locks that just checks for the case where two tasks are attempting to
1008  * upgrade from read to write locks on the same inode.
1009  */
1010 
1011 #define MAX_DEADLK_ITERATIONS 10
1012 
1013 /* Find a lock that the owner of the given block_fl is blocking on. */
1014 static struct file_lock *what_owner_is_waiting_for(struct file_lock *block_fl)
1015 {
1016 	struct file_lock *fl;
1017 
1018 	hash_for_each_possible(blocked_hash, fl, fl_link, posix_owner_key(block_fl)) {
1019 		if (posix_same_owner(fl, block_fl)) {
1020 			while (fl->fl_blocker)
1021 				fl = fl->fl_blocker;
1022 			return fl;
1023 		}
1024 	}
1025 	return NULL;
1026 }
1027 
1028 /* Must be called with the blocked_lock_lock held! */
1029 static int posix_locks_deadlock(struct file_lock *caller_fl,
1030 				struct file_lock *block_fl)
1031 {
1032 	int i = 0;
1033 
1034 	lockdep_assert_held(&blocked_lock_lock);
1035 
1036 	/*
1037 	 * This deadlock detector can't reasonably detect deadlocks with
1038 	 * FL_OFDLCK locks, since they aren't owned by a process, per-se.
1039 	 */
1040 	if (IS_OFDLCK(caller_fl))
1041 		return 0;
1042 
1043 	while ((block_fl = what_owner_is_waiting_for(block_fl))) {
1044 		if (i++ > MAX_DEADLK_ITERATIONS)
1045 			return 0;
1046 		if (posix_same_owner(caller_fl, block_fl))
1047 			return 1;
1048 	}
1049 	return 0;
1050 }
1051 
1052 /* Try to create a FLOCK lock on filp. We always insert new FLOCK locks
1053  * after any leases, but before any posix locks.
1054  *
1055  * Note that if called with an FL_EXISTS argument, the caller may determine
1056  * whether or not a lock was successfully freed by testing the return
1057  * value for -ENOENT.
1058  */
1059 static int flock_lock_inode(struct inode *inode, struct file_lock *request)
1060 {
1061 	struct file_lock *new_fl = NULL;
1062 	struct file_lock *fl;
1063 	struct file_lock_context *ctx;
1064 	int error = 0;
1065 	bool found = false;
1066 	LIST_HEAD(dispose);
1067 
1068 	ctx = locks_get_lock_context(inode, request->fl_type);
1069 	if (!ctx) {
1070 		if (request->fl_type != F_UNLCK)
1071 			return -ENOMEM;
1072 		return (request->fl_flags & FL_EXISTS) ? -ENOENT : 0;
1073 	}
1074 
1075 	if (!(request->fl_flags & FL_ACCESS) && (request->fl_type != F_UNLCK)) {
1076 		new_fl = locks_alloc_lock();
1077 		if (!new_fl)
1078 			return -ENOMEM;
1079 	}
1080 
1081 	percpu_down_read(&file_rwsem);
1082 	spin_lock(&ctx->flc_lock);
1083 	if (request->fl_flags & FL_ACCESS)
1084 		goto find_conflict;
1085 
1086 	list_for_each_entry(fl, &ctx->flc_flock, fl_list) {
1087 		if (request->fl_file != fl->fl_file)
1088 			continue;
1089 		if (request->fl_type == fl->fl_type)
1090 			goto out;
1091 		found = true;
1092 		locks_delete_lock_ctx(fl, &dispose);
1093 		break;
1094 	}
1095 
1096 	if (request->fl_type == F_UNLCK) {
1097 		if ((request->fl_flags & FL_EXISTS) && !found)
1098 			error = -ENOENT;
1099 		goto out;
1100 	}
1101 
1102 find_conflict:
1103 	list_for_each_entry(fl, &ctx->flc_flock, fl_list) {
1104 		if (!flock_locks_conflict(request, fl))
1105 			continue;
1106 		error = -EAGAIN;
1107 		if (!(request->fl_flags & FL_SLEEP))
1108 			goto out;
1109 		error = FILE_LOCK_DEFERRED;
1110 		locks_insert_block(fl, request, flock_locks_conflict);
1111 		goto out;
1112 	}
1113 	if (request->fl_flags & FL_ACCESS)
1114 		goto out;
1115 	locks_copy_lock(new_fl, request);
1116 	locks_move_blocks(new_fl, request);
1117 	locks_insert_lock_ctx(new_fl, &ctx->flc_flock);
1118 	new_fl = NULL;
1119 	error = 0;
1120 
1121 out:
1122 	spin_unlock(&ctx->flc_lock);
1123 	percpu_up_read(&file_rwsem);
1124 	if (new_fl)
1125 		locks_free_lock(new_fl);
1126 	locks_dispose_list(&dispose);
1127 	trace_flock_lock_inode(inode, request, error);
1128 	return error;
1129 }
1130 
1131 static int posix_lock_inode(struct inode *inode, struct file_lock *request,
1132 			    struct file_lock *conflock)
1133 {
1134 	struct file_lock *fl, *tmp;
1135 	struct file_lock *new_fl = NULL;
1136 	struct file_lock *new_fl2 = NULL;
1137 	struct file_lock *left = NULL;
1138 	struct file_lock *right = NULL;
1139 	struct file_lock_context *ctx;
1140 	int error;
1141 	bool added = false;
1142 	LIST_HEAD(dispose);
1143 
1144 	ctx = locks_get_lock_context(inode, request->fl_type);
1145 	if (!ctx)
1146 		return (request->fl_type == F_UNLCK) ? 0 : -ENOMEM;
1147 
1148 	/*
1149 	 * We may need two file_lock structures for this operation,
1150 	 * so we get them in advance to avoid races.
1151 	 *
1152 	 * In some cases we can be sure, that no new locks will be needed
1153 	 */
1154 	if (!(request->fl_flags & FL_ACCESS) &&
1155 	    (request->fl_type != F_UNLCK ||
1156 	     request->fl_start != 0 || request->fl_end != OFFSET_MAX)) {
1157 		new_fl = locks_alloc_lock();
1158 		new_fl2 = locks_alloc_lock();
1159 	}
1160 
1161 	percpu_down_read(&file_rwsem);
1162 	spin_lock(&ctx->flc_lock);
1163 	/*
1164 	 * New lock request. Walk all POSIX locks and look for conflicts. If
1165 	 * there are any, either return error or put the request on the
1166 	 * blocker's list of waiters and the global blocked_hash.
1167 	 */
1168 	if (request->fl_type != F_UNLCK) {
1169 		list_for_each_entry(fl, &ctx->flc_posix, fl_list) {
1170 			if (!posix_locks_conflict(request, fl))
1171 				continue;
1172 			if (conflock)
1173 				locks_copy_conflock(conflock, fl);
1174 			error = -EAGAIN;
1175 			if (!(request->fl_flags & FL_SLEEP))
1176 				goto out;
1177 			/*
1178 			 * Deadlock detection and insertion into the blocked
1179 			 * locks list must be done while holding the same lock!
1180 			 */
1181 			error = -EDEADLK;
1182 			spin_lock(&blocked_lock_lock);
1183 			/*
1184 			 * Ensure that we don't find any locks blocked on this
1185 			 * request during deadlock detection.
1186 			 */
1187 			__locks_wake_up_blocks(request);
1188 			if (likely(!posix_locks_deadlock(request, fl))) {
1189 				error = FILE_LOCK_DEFERRED;
1190 				__locks_insert_block(fl, request,
1191 						     posix_locks_conflict);
1192 			}
1193 			spin_unlock(&blocked_lock_lock);
1194 			goto out;
1195 		}
1196 	}
1197 
1198 	/* If we're just looking for a conflict, we're done. */
1199 	error = 0;
1200 	if (request->fl_flags & FL_ACCESS)
1201 		goto out;
1202 
1203 	/* Find the first old lock with the same owner as the new lock */
1204 	list_for_each_entry(fl, &ctx->flc_posix, fl_list) {
1205 		if (posix_same_owner(request, fl))
1206 			break;
1207 	}
1208 
1209 	/* Process locks with this owner. */
1210 	list_for_each_entry_safe_from(fl, tmp, &ctx->flc_posix, fl_list) {
1211 		if (!posix_same_owner(request, fl))
1212 			break;
1213 
1214 		/* Detect adjacent or overlapping regions (if same lock type) */
1215 		if (request->fl_type == fl->fl_type) {
1216 			/* In all comparisons of start vs end, use
1217 			 * "start - 1" rather than "end + 1". If end
1218 			 * is OFFSET_MAX, end + 1 will become negative.
1219 			 */
1220 			if (fl->fl_end < request->fl_start - 1)
1221 				continue;
1222 			/* If the next lock in the list has entirely bigger
1223 			 * addresses than the new one, insert the lock here.
1224 			 */
1225 			if (fl->fl_start - 1 > request->fl_end)
1226 				break;
1227 
1228 			/* If we come here, the new and old lock are of the
1229 			 * same type and adjacent or overlapping. Make one
1230 			 * lock yielding from the lower start address of both
1231 			 * locks to the higher end address.
1232 			 */
1233 			if (fl->fl_start > request->fl_start)
1234 				fl->fl_start = request->fl_start;
1235 			else
1236 				request->fl_start = fl->fl_start;
1237 			if (fl->fl_end < request->fl_end)
1238 				fl->fl_end = request->fl_end;
1239 			else
1240 				request->fl_end = fl->fl_end;
1241 			if (added) {
1242 				locks_delete_lock_ctx(fl, &dispose);
1243 				continue;
1244 			}
1245 			request = fl;
1246 			added = true;
1247 		} else {
1248 			/* Processing for different lock types is a bit
1249 			 * more complex.
1250 			 */
1251 			if (fl->fl_end < request->fl_start)
1252 				continue;
1253 			if (fl->fl_start > request->fl_end)
1254 				break;
1255 			if (request->fl_type == F_UNLCK)
1256 				added = true;
1257 			if (fl->fl_start < request->fl_start)
1258 				left = fl;
1259 			/* If the next lock in the list has a higher end
1260 			 * address than the new one, insert the new one here.
1261 			 */
1262 			if (fl->fl_end > request->fl_end) {
1263 				right = fl;
1264 				break;
1265 			}
1266 			if (fl->fl_start >= request->fl_start) {
1267 				/* The new lock completely replaces an old
1268 				 * one (This may happen several times).
1269 				 */
1270 				if (added) {
1271 					locks_delete_lock_ctx(fl, &dispose);
1272 					continue;
1273 				}
1274 				/*
1275 				 * Replace the old lock with new_fl, and
1276 				 * remove the old one. It's safe to do the
1277 				 * insert here since we know that we won't be
1278 				 * using new_fl later, and that the lock is
1279 				 * just replacing an existing lock.
1280 				 */
1281 				error = -ENOLCK;
1282 				if (!new_fl)
1283 					goto out;
1284 				locks_copy_lock(new_fl, request);
1285 				locks_move_blocks(new_fl, request);
1286 				request = new_fl;
1287 				new_fl = NULL;
1288 				locks_insert_lock_ctx(request, &fl->fl_list);
1289 				locks_delete_lock_ctx(fl, &dispose);
1290 				added = true;
1291 			}
1292 		}
1293 	}
1294 
1295 	/*
1296 	 * The above code only modifies existing locks in case of merging or
1297 	 * replacing. If new lock(s) need to be inserted all modifications are
1298 	 * done below this, so it's safe yet to bail out.
1299 	 */
1300 	error = -ENOLCK; /* "no luck" */
1301 	if (right && left == right && !new_fl2)
1302 		goto out;
1303 
1304 	error = 0;
1305 	if (!added) {
1306 		if (request->fl_type == F_UNLCK) {
1307 			if (request->fl_flags & FL_EXISTS)
1308 				error = -ENOENT;
1309 			goto out;
1310 		}
1311 
1312 		if (!new_fl) {
1313 			error = -ENOLCK;
1314 			goto out;
1315 		}
1316 		locks_copy_lock(new_fl, request);
1317 		locks_move_blocks(new_fl, request);
1318 		locks_insert_lock_ctx(new_fl, &fl->fl_list);
1319 		fl = new_fl;
1320 		new_fl = NULL;
1321 	}
1322 	if (right) {
1323 		if (left == right) {
1324 			/* The new lock breaks the old one in two pieces,
1325 			 * so we have to use the second new lock.
1326 			 */
1327 			left = new_fl2;
1328 			new_fl2 = NULL;
1329 			locks_copy_lock(left, right);
1330 			locks_insert_lock_ctx(left, &fl->fl_list);
1331 		}
1332 		right->fl_start = request->fl_end + 1;
1333 		locks_wake_up_blocks(right);
1334 	}
1335 	if (left) {
1336 		left->fl_end = request->fl_start - 1;
1337 		locks_wake_up_blocks(left);
1338 	}
1339  out:
1340 	spin_unlock(&ctx->flc_lock);
1341 	percpu_up_read(&file_rwsem);
1342 	/*
1343 	 * Free any unused locks.
1344 	 */
1345 	if (new_fl)
1346 		locks_free_lock(new_fl);
1347 	if (new_fl2)
1348 		locks_free_lock(new_fl2);
1349 	locks_dispose_list(&dispose);
1350 	trace_posix_lock_inode(inode, request, error);
1351 
1352 	return error;
1353 }
1354 
1355 /**
1356  * posix_lock_file - Apply a POSIX-style lock to a file
1357  * @filp: The file to apply the lock to
1358  * @fl: The lock to be applied
1359  * @conflock: Place to return a copy of the conflicting lock, if found.
1360  *
1361  * Add a POSIX style lock to a file.
1362  * We merge adjacent & overlapping locks whenever possible.
1363  * POSIX locks are sorted by owner task, then by starting address
1364  *
1365  * Note that if called with an FL_EXISTS argument, the caller may determine
1366  * whether or not a lock was successfully freed by testing the return
1367  * value for -ENOENT.
1368  */
1369 int posix_lock_file(struct file *filp, struct file_lock *fl,
1370 			struct file_lock *conflock)
1371 {
1372 	return posix_lock_inode(locks_inode(filp), fl, conflock);
1373 }
1374 EXPORT_SYMBOL(posix_lock_file);
1375 
1376 /**
1377  * posix_lock_inode_wait - Apply a POSIX-style lock to a file
1378  * @inode: inode of file to which lock request should be applied
1379  * @fl: The lock to be applied
1380  *
1381  * Apply a POSIX style lock request to an inode.
1382  */
1383 static int posix_lock_inode_wait(struct inode *inode, struct file_lock *fl)
1384 {
1385 	int error;
1386 	might_sleep ();
1387 	for (;;) {
1388 		error = posix_lock_inode(inode, fl, NULL);
1389 		if (error != FILE_LOCK_DEFERRED)
1390 			break;
1391 		error = wait_event_interruptible(fl->fl_wait,
1392 					list_empty(&fl->fl_blocked_member));
1393 		if (error)
1394 			break;
1395 	}
1396 	locks_delete_block(fl);
1397 	return error;
1398 }
1399 
1400 #ifdef CONFIG_MANDATORY_FILE_LOCKING
1401 /**
1402  * locks_mandatory_locked - Check for an active lock
1403  * @file: the file to check
1404  *
1405  * Searches the inode's list of locks to find any POSIX locks which conflict.
1406  * This function is called from locks_verify_locked() only.
1407  */
1408 int locks_mandatory_locked(struct file *file)
1409 {
1410 	int ret;
1411 	struct inode *inode = locks_inode(file);
1412 	struct file_lock_context *ctx;
1413 	struct file_lock *fl;
1414 
1415 	ctx = smp_load_acquire(&inode->i_flctx);
1416 	if (!ctx || list_empty_careful(&ctx->flc_posix))
1417 		return 0;
1418 
1419 	/*
1420 	 * Search the lock list for this inode for any POSIX locks.
1421 	 */
1422 	spin_lock(&ctx->flc_lock);
1423 	ret = 0;
1424 	list_for_each_entry(fl, &ctx->flc_posix, fl_list) {
1425 		if (fl->fl_owner != current->files &&
1426 		    fl->fl_owner != file) {
1427 			ret = -EAGAIN;
1428 			break;
1429 		}
1430 	}
1431 	spin_unlock(&ctx->flc_lock);
1432 	return ret;
1433 }
1434 
1435 /**
1436  * locks_mandatory_area - Check for a conflicting lock
1437  * @inode:	the file to check
1438  * @filp:       how the file was opened (if it was)
1439  * @start:	first byte in the file to check
1440  * @end:	lastbyte in the file to check
1441  * @type:	%F_WRLCK for a write lock, else %F_RDLCK
1442  *
1443  * Searches the inode's list of locks to find any POSIX locks which conflict.
1444  */
1445 int locks_mandatory_area(struct inode *inode, struct file *filp, loff_t start,
1446 			 loff_t end, unsigned char type)
1447 {
1448 	struct file_lock fl;
1449 	int error;
1450 	bool sleep = false;
1451 
1452 	locks_init_lock(&fl);
1453 	fl.fl_pid = current->tgid;
1454 	fl.fl_file = filp;
1455 	fl.fl_flags = FL_POSIX | FL_ACCESS;
1456 	if (filp && !(filp->f_flags & O_NONBLOCK))
1457 		sleep = true;
1458 	fl.fl_type = type;
1459 	fl.fl_start = start;
1460 	fl.fl_end = end;
1461 
1462 	for (;;) {
1463 		if (filp) {
1464 			fl.fl_owner = filp;
1465 			fl.fl_flags &= ~FL_SLEEP;
1466 			error = posix_lock_inode(inode, &fl, NULL);
1467 			if (!error)
1468 				break;
1469 		}
1470 
1471 		if (sleep)
1472 			fl.fl_flags |= FL_SLEEP;
1473 		fl.fl_owner = current->files;
1474 		error = posix_lock_inode(inode, &fl, NULL);
1475 		if (error != FILE_LOCK_DEFERRED)
1476 			break;
1477 		error = wait_event_interruptible(fl.fl_wait,
1478 					list_empty(&fl.fl_blocked_member));
1479 		if (!error) {
1480 			/*
1481 			 * If we've been sleeping someone might have
1482 			 * changed the permissions behind our back.
1483 			 */
1484 			if (__mandatory_lock(inode))
1485 				continue;
1486 		}
1487 
1488 		break;
1489 	}
1490 	locks_delete_block(&fl);
1491 
1492 	return error;
1493 }
1494 EXPORT_SYMBOL(locks_mandatory_area);
1495 #endif /* CONFIG_MANDATORY_FILE_LOCKING */
1496 
1497 static void lease_clear_pending(struct file_lock *fl, int arg)
1498 {
1499 	switch (arg) {
1500 	case F_UNLCK:
1501 		fl->fl_flags &= ~FL_UNLOCK_PENDING;
1502 		fallthrough;
1503 	case F_RDLCK:
1504 		fl->fl_flags &= ~FL_DOWNGRADE_PENDING;
1505 	}
1506 }
1507 
1508 /* We already had a lease on this file; just change its type */
1509 int lease_modify(struct file_lock *fl, int arg, struct list_head *dispose)
1510 {
1511 	int error = assign_type(fl, arg);
1512 
1513 	if (error)
1514 		return error;
1515 	lease_clear_pending(fl, arg);
1516 	locks_wake_up_blocks(fl);
1517 	if (arg == F_UNLCK) {
1518 		struct file *filp = fl->fl_file;
1519 
1520 		f_delown(filp);
1521 		filp->f_owner.signum = 0;
1522 		fasync_helper(0, fl->fl_file, 0, &fl->fl_fasync);
1523 		if (fl->fl_fasync != NULL) {
1524 			printk(KERN_ERR "locks_delete_lock: fasync == %p\n", fl->fl_fasync);
1525 			fl->fl_fasync = NULL;
1526 		}
1527 		locks_delete_lock_ctx(fl, dispose);
1528 	}
1529 	return 0;
1530 }
1531 EXPORT_SYMBOL(lease_modify);
1532 
1533 static bool past_time(unsigned long then)
1534 {
1535 	if (!then)
1536 		/* 0 is a special value meaning "this never expires": */
1537 		return false;
1538 	return time_after(jiffies, then);
1539 }
1540 
1541 static void time_out_leases(struct inode *inode, struct list_head *dispose)
1542 {
1543 	struct file_lock_context *ctx = inode->i_flctx;
1544 	struct file_lock *fl, *tmp;
1545 
1546 	lockdep_assert_held(&ctx->flc_lock);
1547 
1548 	list_for_each_entry_safe(fl, tmp, &ctx->flc_lease, fl_list) {
1549 		trace_time_out_leases(inode, fl);
1550 		if (past_time(fl->fl_downgrade_time))
1551 			lease_modify(fl, F_RDLCK, dispose);
1552 		if (past_time(fl->fl_break_time))
1553 			lease_modify(fl, F_UNLCK, dispose);
1554 	}
1555 }
1556 
1557 static bool leases_conflict(struct file_lock *lease, struct file_lock *breaker)
1558 {
1559 	bool rc;
1560 
1561 	if (lease->fl_lmops->lm_breaker_owns_lease
1562 			&& lease->fl_lmops->lm_breaker_owns_lease(lease))
1563 		return false;
1564 	if ((breaker->fl_flags & FL_LAYOUT) != (lease->fl_flags & FL_LAYOUT)) {
1565 		rc = false;
1566 		goto trace;
1567 	}
1568 	if ((breaker->fl_flags & FL_DELEG) && (lease->fl_flags & FL_LEASE)) {
1569 		rc = false;
1570 		goto trace;
1571 	}
1572 
1573 	rc = locks_conflict(breaker, lease);
1574 trace:
1575 	trace_leases_conflict(rc, lease, breaker);
1576 	return rc;
1577 }
1578 
1579 static bool
1580 any_leases_conflict(struct inode *inode, struct file_lock *breaker)
1581 {
1582 	struct file_lock_context *ctx = inode->i_flctx;
1583 	struct file_lock *fl;
1584 
1585 	lockdep_assert_held(&ctx->flc_lock);
1586 
1587 	list_for_each_entry(fl, &ctx->flc_lease, fl_list) {
1588 		if (leases_conflict(fl, breaker))
1589 			return true;
1590 	}
1591 	return false;
1592 }
1593 
1594 /**
1595  *	__break_lease	-	revoke all outstanding leases on file
1596  *	@inode: the inode of the file to return
1597  *	@mode: O_RDONLY: break only write leases; O_WRONLY or O_RDWR:
1598  *	    break all leases
1599  *	@type: FL_LEASE: break leases and delegations; FL_DELEG: break
1600  *	    only delegations
1601  *
1602  *	break_lease (inlined for speed) has checked there already is at least
1603  *	some kind of lock (maybe a lease) on this file.  Leases are broken on
1604  *	a call to open() or truncate().  This function can sleep unless you
1605  *	specified %O_NONBLOCK to your open().
1606  */
1607 int __break_lease(struct inode *inode, unsigned int mode, unsigned int type)
1608 {
1609 	int error = 0;
1610 	struct file_lock_context *ctx;
1611 	struct file_lock *new_fl, *fl, *tmp;
1612 	unsigned long break_time;
1613 	int want_write = (mode & O_ACCMODE) != O_RDONLY;
1614 	LIST_HEAD(dispose);
1615 
1616 	new_fl = lease_alloc(NULL, want_write ? F_WRLCK : F_RDLCK);
1617 	if (IS_ERR(new_fl))
1618 		return PTR_ERR(new_fl);
1619 	new_fl->fl_flags = type;
1620 
1621 	/* typically we will check that ctx is non-NULL before calling */
1622 	ctx = smp_load_acquire(&inode->i_flctx);
1623 	if (!ctx) {
1624 		WARN_ON_ONCE(1);
1625 		goto free_lock;
1626 	}
1627 
1628 	percpu_down_read(&file_rwsem);
1629 	spin_lock(&ctx->flc_lock);
1630 
1631 	time_out_leases(inode, &dispose);
1632 
1633 	if (!any_leases_conflict(inode, new_fl))
1634 		goto out;
1635 
1636 	break_time = 0;
1637 	if (lease_break_time > 0) {
1638 		break_time = jiffies + lease_break_time * HZ;
1639 		if (break_time == 0)
1640 			break_time++;	/* so that 0 means no break time */
1641 	}
1642 
1643 	list_for_each_entry_safe(fl, tmp, &ctx->flc_lease, fl_list) {
1644 		if (!leases_conflict(fl, new_fl))
1645 			continue;
1646 		if (want_write) {
1647 			if (fl->fl_flags & FL_UNLOCK_PENDING)
1648 				continue;
1649 			fl->fl_flags |= FL_UNLOCK_PENDING;
1650 			fl->fl_break_time = break_time;
1651 		} else {
1652 			if (lease_breaking(fl))
1653 				continue;
1654 			fl->fl_flags |= FL_DOWNGRADE_PENDING;
1655 			fl->fl_downgrade_time = break_time;
1656 		}
1657 		if (fl->fl_lmops->lm_break(fl))
1658 			locks_delete_lock_ctx(fl, &dispose);
1659 	}
1660 
1661 	if (list_empty(&ctx->flc_lease))
1662 		goto out;
1663 
1664 	if (mode & O_NONBLOCK) {
1665 		trace_break_lease_noblock(inode, new_fl);
1666 		error = -EWOULDBLOCK;
1667 		goto out;
1668 	}
1669 
1670 restart:
1671 	fl = list_first_entry(&ctx->flc_lease, struct file_lock, fl_list);
1672 	break_time = fl->fl_break_time;
1673 	if (break_time != 0)
1674 		break_time -= jiffies;
1675 	if (break_time == 0)
1676 		break_time++;
1677 	locks_insert_block(fl, new_fl, leases_conflict);
1678 	trace_break_lease_block(inode, new_fl);
1679 	spin_unlock(&ctx->flc_lock);
1680 	percpu_up_read(&file_rwsem);
1681 
1682 	locks_dispose_list(&dispose);
1683 	error = wait_event_interruptible_timeout(new_fl->fl_wait,
1684 					list_empty(&new_fl->fl_blocked_member),
1685 					break_time);
1686 
1687 	percpu_down_read(&file_rwsem);
1688 	spin_lock(&ctx->flc_lock);
1689 	trace_break_lease_unblock(inode, new_fl);
1690 	locks_delete_block(new_fl);
1691 	if (error >= 0) {
1692 		/*
1693 		 * Wait for the next conflicting lease that has not been
1694 		 * broken yet
1695 		 */
1696 		if (error == 0)
1697 			time_out_leases(inode, &dispose);
1698 		if (any_leases_conflict(inode, new_fl))
1699 			goto restart;
1700 		error = 0;
1701 	}
1702 out:
1703 	spin_unlock(&ctx->flc_lock);
1704 	percpu_up_read(&file_rwsem);
1705 	locks_dispose_list(&dispose);
1706 free_lock:
1707 	locks_free_lock(new_fl);
1708 	return error;
1709 }
1710 EXPORT_SYMBOL(__break_lease);
1711 
1712 /**
1713  *	lease_get_mtime - update modified time of an inode with exclusive lease
1714  *	@inode: the inode
1715  *      @time:  pointer to a timespec which contains the last modified time
1716  *
1717  * This is to force NFS clients to flush their caches for files with
1718  * exclusive leases.  The justification is that if someone has an
1719  * exclusive lease, then they could be modifying it.
1720  */
1721 void lease_get_mtime(struct inode *inode, struct timespec64 *time)
1722 {
1723 	bool has_lease = false;
1724 	struct file_lock_context *ctx;
1725 	struct file_lock *fl;
1726 
1727 	ctx = smp_load_acquire(&inode->i_flctx);
1728 	if (ctx && !list_empty_careful(&ctx->flc_lease)) {
1729 		spin_lock(&ctx->flc_lock);
1730 		fl = list_first_entry_or_null(&ctx->flc_lease,
1731 					      struct file_lock, fl_list);
1732 		if (fl && (fl->fl_type == F_WRLCK))
1733 			has_lease = true;
1734 		spin_unlock(&ctx->flc_lock);
1735 	}
1736 
1737 	if (has_lease)
1738 		*time = current_time(inode);
1739 }
1740 EXPORT_SYMBOL(lease_get_mtime);
1741 
1742 /**
1743  *	fcntl_getlease - Enquire what lease is currently active
1744  *	@filp: the file
1745  *
1746  *	The value returned by this function will be one of
1747  *	(if no lease break is pending):
1748  *
1749  *	%F_RDLCK to indicate a shared lease is held.
1750  *
1751  *	%F_WRLCK to indicate an exclusive lease is held.
1752  *
1753  *	%F_UNLCK to indicate no lease is held.
1754  *
1755  *	(if a lease break is pending):
1756  *
1757  *	%F_RDLCK to indicate an exclusive lease needs to be
1758  *		changed to a shared lease (or removed).
1759  *
1760  *	%F_UNLCK to indicate the lease needs to be removed.
1761  *
1762  *	XXX: sfr & willy disagree over whether F_INPROGRESS
1763  *	should be returned to userspace.
1764  */
1765 int fcntl_getlease(struct file *filp)
1766 {
1767 	struct file_lock *fl;
1768 	struct inode *inode = locks_inode(filp);
1769 	struct file_lock_context *ctx;
1770 	int type = F_UNLCK;
1771 	LIST_HEAD(dispose);
1772 
1773 	ctx = smp_load_acquire(&inode->i_flctx);
1774 	if (ctx && !list_empty_careful(&ctx->flc_lease)) {
1775 		percpu_down_read(&file_rwsem);
1776 		spin_lock(&ctx->flc_lock);
1777 		time_out_leases(inode, &dispose);
1778 		list_for_each_entry(fl, &ctx->flc_lease, fl_list) {
1779 			if (fl->fl_file != filp)
1780 				continue;
1781 			type = target_leasetype(fl);
1782 			break;
1783 		}
1784 		spin_unlock(&ctx->flc_lock);
1785 		percpu_up_read(&file_rwsem);
1786 
1787 		locks_dispose_list(&dispose);
1788 	}
1789 	return type;
1790 }
1791 
1792 /**
1793  * check_conflicting_open - see if the given file points to an inode that has
1794  *			    an existing open that would conflict with the
1795  *			    desired lease.
1796  * @filp:	file to check
1797  * @arg:	type of lease that we're trying to acquire
1798  * @flags:	current lock flags
1799  *
1800  * Check to see if there's an existing open fd on this file that would
1801  * conflict with the lease we're trying to set.
1802  */
1803 static int
1804 check_conflicting_open(struct file *filp, const long arg, int flags)
1805 {
1806 	struct inode *inode = locks_inode(filp);
1807 	int self_wcount = 0, self_rcount = 0;
1808 
1809 	if (flags & FL_LAYOUT)
1810 		return 0;
1811 	if (flags & FL_DELEG)
1812 		/* We leave these checks to the caller */
1813 		return 0;
1814 
1815 	if (arg == F_RDLCK)
1816 		return inode_is_open_for_write(inode) ? -EAGAIN : 0;
1817 	else if (arg != F_WRLCK)
1818 		return 0;
1819 
1820 	/*
1821 	 * Make sure that only read/write count is from lease requestor.
1822 	 * Note that this will result in denying write leases when i_writecount
1823 	 * is negative, which is what we want.  (We shouldn't grant write leases
1824 	 * on files open for execution.)
1825 	 */
1826 	if (filp->f_mode & FMODE_WRITE)
1827 		self_wcount = 1;
1828 	else if (filp->f_mode & FMODE_READ)
1829 		self_rcount = 1;
1830 
1831 	if (atomic_read(&inode->i_writecount) != self_wcount ||
1832 	    atomic_read(&inode->i_readcount) != self_rcount)
1833 		return -EAGAIN;
1834 
1835 	return 0;
1836 }
1837 
1838 static int
1839 generic_add_lease(struct file *filp, long arg, struct file_lock **flp, void **priv)
1840 {
1841 	struct file_lock *fl, *my_fl = NULL, *lease;
1842 	struct inode *inode = locks_inode(filp);
1843 	struct file_lock_context *ctx;
1844 	bool is_deleg = (*flp)->fl_flags & FL_DELEG;
1845 	int error;
1846 	LIST_HEAD(dispose);
1847 
1848 	lease = *flp;
1849 	trace_generic_add_lease(inode, lease);
1850 
1851 	/* Note that arg is never F_UNLCK here */
1852 	ctx = locks_get_lock_context(inode, arg);
1853 	if (!ctx)
1854 		return -ENOMEM;
1855 
1856 	/*
1857 	 * In the delegation case we need mutual exclusion with
1858 	 * a number of operations that take the i_mutex.  We trylock
1859 	 * because delegations are an optional optimization, and if
1860 	 * there's some chance of a conflict--we'd rather not
1861 	 * bother, maybe that's a sign this just isn't a good file to
1862 	 * hand out a delegation on.
1863 	 */
1864 	if (is_deleg && !inode_trylock(inode))
1865 		return -EAGAIN;
1866 
1867 	if (is_deleg && arg == F_WRLCK) {
1868 		/* Write delegations are not currently supported: */
1869 		inode_unlock(inode);
1870 		WARN_ON_ONCE(1);
1871 		return -EINVAL;
1872 	}
1873 
1874 	percpu_down_read(&file_rwsem);
1875 	spin_lock(&ctx->flc_lock);
1876 	time_out_leases(inode, &dispose);
1877 	error = check_conflicting_open(filp, arg, lease->fl_flags);
1878 	if (error)
1879 		goto out;
1880 
1881 	/*
1882 	 * At this point, we know that if there is an exclusive
1883 	 * lease on this file, then we hold it on this filp
1884 	 * (otherwise our open of this file would have blocked).
1885 	 * And if we are trying to acquire an exclusive lease,
1886 	 * then the file is not open by anyone (including us)
1887 	 * except for this filp.
1888 	 */
1889 	error = -EAGAIN;
1890 	list_for_each_entry(fl, &ctx->flc_lease, fl_list) {
1891 		if (fl->fl_file == filp &&
1892 		    fl->fl_owner == lease->fl_owner) {
1893 			my_fl = fl;
1894 			continue;
1895 		}
1896 
1897 		/*
1898 		 * No exclusive leases if someone else has a lease on
1899 		 * this file:
1900 		 */
1901 		if (arg == F_WRLCK)
1902 			goto out;
1903 		/*
1904 		 * Modifying our existing lease is OK, but no getting a
1905 		 * new lease if someone else is opening for write:
1906 		 */
1907 		if (fl->fl_flags & FL_UNLOCK_PENDING)
1908 			goto out;
1909 	}
1910 
1911 	if (my_fl != NULL) {
1912 		lease = my_fl;
1913 		error = lease->fl_lmops->lm_change(lease, arg, &dispose);
1914 		if (error)
1915 			goto out;
1916 		goto out_setup;
1917 	}
1918 
1919 	error = -EINVAL;
1920 	if (!leases_enable)
1921 		goto out;
1922 
1923 	locks_insert_lock_ctx(lease, &ctx->flc_lease);
1924 	/*
1925 	 * The check in break_lease() is lockless. It's possible for another
1926 	 * open to race in after we did the earlier check for a conflicting
1927 	 * open but before the lease was inserted. Check again for a
1928 	 * conflicting open and cancel the lease if there is one.
1929 	 *
1930 	 * We also add a barrier here to ensure that the insertion of the lock
1931 	 * precedes these checks.
1932 	 */
1933 	smp_mb();
1934 	error = check_conflicting_open(filp, arg, lease->fl_flags);
1935 	if (error) {
1936 		locks_unlink_lock_ctx(lease);
1937 		goto out;
1938 	}
1939 
1940 out_setup:
1941 	if (lease->fl_lmops->lm_setup)
1942 		lease->fl_lmops->lm_setup(lease, priv);
1943 out:
1944 	spin_unlock(&ctx->flc_lock);
1945 	percpu_up_read(&file_rwsem);
1946 	locks_dispose_list(&dispose);
1947 	if (is_deleg)
1948 		inode_unlock(inode);
1949 	if (!error && !my_fl)
1950 		*flp = NULL;
1951 	return error;
1952 }
1953 
1954 static int generic_delete_lease(struct file *filp, void *owner)
1955 {
1956 	int error = -EAGAIN;
1957 	struct file_lock *fl, *victim = NULL;
1958 	struct inode *inode = locks_inode(filp);
1959 	struct file_lock_context *ctx;
1960 	LIST_HEAD(dispose);
1961 
1962 	ctx = smp_load_acquire(&inode->i_flctx);
1963 	if (!ctx) {
1964 		trace_generic_delete_lease(inode, NULL);
1965 		return error;
1966 	}
1967 
1968 	percpu_down_read(&file_rwsem);
1969 	spin_lock(&ctx->flc_lock);
1970 	list_for_each_entry(fl, &ctx->flc_lease, fl_list) {
1971 		if (fl->fl_file == filp &&
1972 		    fl->fl_owner == owner) {
1973 			victim = fl;
1974 			break;
1975 		}
1976 	}
1977 	trace_generic_delete_lease(inode, victim);
1978 	if (victim)
1979 		error = fl->fl_lmops->lm_change(victim, F_UNLCK, &dispose);
1980 	spin_unlock(&ctx->flc_lock);
1981 	percpu_up_read(&file_rwsem);
1982 	locks_dispose_list(&dispose);
1983 	return error;
1984 }
1985 
1986 /**
1987  *	generic_setlease	-	sets a lease on an open file
1988  *	@filp:	file pointer
1989  *	@arg:	type of lease to obtain
1990  *	@flp:	input - file_lock to use, output - file_lock inserted
1991  *	@priv:	private data for lm_setup (may be NULL if lm_setup
1992  *		doesn't require it)
1993  *
1994  *	The (input) flp->fl_lmops->lm_break function is required
1995  *	by break_lease().
1996  */
1997 int generic_setlease(struct file *filp, long arg, struct file_lock **flp,
1998 			void **priv)
1999 {
2000 	struct inode *inode = locks_inode(filp);
2001 	int error;
2002 
2003 	if ((!uid_eq(current_fsuid(), inode->i_uid)) && !capable(CAP_LEASE))
2004 		return -EACCES;
2005 	if (!S_ISREG(inode->i_mode))
2006 		return -EINVAL;
2007 	error = security_file_lock(filp, arg);
2008 	if (error)
2009 		return error;
2010 
2011 	switch (arg) {
2012 	case F_UNLCK:
2013 		return generic_delete_lease(filp, *priv);
2014 	case F_RDLCK:
2015 	case F_WRLCK:
2016 		if (!(*flp)->fl_lmops->lm_break) {
2017 			WARN_ON_ONCE(1);
2018 			return -ENOLCK;
2019 		}
2020 
2021 		return generic_add_lease(filp, arg, flp, priv);
2022 	default:
2023 		return -EINVAL;
2024 	}
2025 }
2026 EXPORT_SYMBOL(generic_setlease);
2027 
2028 #if IS_ENABLED(CONFIG_SRCU)
2029 /*
2030  * Kernel subsystems can register to be notified on any attempt to set
2031  * a new lease with the lease_notifier_chain. This is used by (e.g.) nfsd
2032  * to close files that it may have cached when there is an attempt to set a
2033  * conflicting lease.
2034  */
2035 static struct srcu_notifier_head lease_notifier_chain;
2036 
2037 static inline void
2038 lease_notifier_chain_init(void)
2039 {
2040 	srcu_init_notifier_head(&lease_notifier_chain);
2041 }
2042 
2043 static inline void
2044 setlease_notifier(long arg, struct file_lock *lease)
2045 {
2046 	if (arg != F_UNLCK)
2047 		srcu_notifier_call_chain(&lease_notifier_chain, arg, lease);
2048 }
2049 
2050 int lease_register_notifier(struct notifier_block *nb)
2051 {
2052 	return srcu_notifier_chain_register(&lease_notifier_chain, nb);
2053 }
2054 EXPORT_SYMBOL_GPL(lease_register_notifier);
2055 
2056 void lease_unregister_notifier(struct notifier_block *nb)
2057 {
2058 	srcu_notifier_chain_unregister(&lease_notifier_chain, nb);
2059 }
2060 EXPORT_SYMBOL_GPL(lease_unregister_notifier);
2061 
2062 #else /* !IS_ENABLED(CONFIG_SRCU) */
2063 static inline void
2064 lease_notifier_chain_init(void)
2065 {
2066 }
2067 
2068 static inline void
2069 setlease_notifier(long arg, struct file_lock *lease)
2070 {
2071 }
2072 
2073 int lease_register_notifier(struct notifier_block *nb)
2074 {
2075 	return 0;
2076 }
2077 EXPORT_SYMBOL_GPL(lease_register_notifier);
2078 
2079 void lease_unregister_notifier(struct notifier_block *nb)
2080 {
2081 }
2082 EXPORT_SYMBOL_GPL(lease_unregister_notifier);
2083 
2084 #endif /* IS_ENABLED(CONFIG_SRCU) */
2085 
2086 /**
2087  * vfs_setlease        -       sets a lease on an open file
2088  * @filp:	file pointer
2089  * @arg:	type of lease to obtain
2090  * @lease:	file_lock to use when adding a lease
2091  * @priv:	private info for lm_setup when adding a lease (may be
2092  *		NULL if lm_setup doesn't require it)
2093  *
2094  * Call this to establish a lease on the file. The "lease" argument is not
2095  * used for F_UNLCK requests and may be NULL. For commands that set or alter
2096  * an existing lease, the ``(*lease)->fl_lmops->lm_break`` operation must be
2097  * set; if not, this function will return -ENOLCK (and generate a scary-looking
2098  * stack trace).
2099  *
2100  * The "priv" pointer is passed directly to the lm_setup function as-is. It
2101  * may be NULL if the lm_setup operation doesn't require it.
2102  */
2103 int
2104 vfs_setlease(struct file *filp, long arg, struct file_lock **lease, void **priv)
2105 {
2106 	if (lease)
2107 		setlease_notifier(arg, *lease);
2108 	if (filp->f_op->setlease)
2109 		return filp->f_op->setlease(filp, arg, lease, priv);
2110 	else
2111 		return generic_setlease(filp, arg, lease, priv);
2112 }
2113 EXPORT_SYMBOL_GPL(vfs_setlease);
2114 
2115 static int do_fcntl_add_lease(unsigned int fd, struct file *filp, long arg)
2116 {
2117 	struct file_lock *fl;
2118 	struct fasync_struct *new;
2119 	int error;
2120 
2121 	fl = lease_alloc(filp, arg);
2122 	if (IS_ERR(fl))
2123 		return PTR_ERR(fl);
2124 
2125 	new = fasync_alloc();
2126 	if (!new) {
2127 		locks_free_lock(fl);
2128 		return -ENOMEM;
2129 	}
2130 	new->fa_fd = fd;
2131 
2132 	error = vfs_setlease(filp, arg, &fl, (void **)&new);
2133 	if (fl)
2134 		locks_free_lock(fl);
2135 	if (new)
2136 		fasync_free(new);
2137 	return error;
2138 }
2139 
2140 /**
2141  *	fcntl_setlease	-	sets a lease on an open file
2142  *	@fd: open file descriptor
2143  *	@filp: file pointer
2144  *	@arg: type of lease to obtain
2145  *
2146  *	Call this fcntl to establish a lease on the file.
2147  *	Note that you also need to call %F_SETSIG to
2148  *	receive a signal when the lease is broken.
2149  */
2150 int fcntl_setlease(unsigned int fd, struct file *filp, long arg)
2151 {
2152 	if (arg == F_UNLCK)
2153 		return vfs_setlease(filp, F_UNLCK, NULL, (void **)&filp);
2154 	return do_fcntl_add_lease(fd, filp, arg);
2155 }
2156 
2157 /**
2158  * flock_lock_inode_wait - Apply a FLOCK-style lock to a file
2159  * @inode: inode of the file to apply to
2160  * @fl: The lock to be applied
2161  *
2162  * Apply a FLOCK style lock request to an inode.
2163  */
2164 static int flock_lock_inode_wait(struct inode *inode, struct file_lock *fl)
2165 {
2166 	int error;
2167 	might_sleep();
2168 	for (;;) {
2169 		error = flock_lock_inode(inode, fl);
2170 		if (error != FILE_LOCK_DEFERRED)
2171 			break;
2172 		error = wait_event_interruptible(fl->fl_wait,
2173 				list_empty(&fl->fl_blocked_member));
2174 		if (error)
2175 			break;
2176 	}
2177 	locks_delete_block(fl);
2178 	return error;
2179 }
2180 
2181 /**
2182  * locks_lock_inode_wait - Apply a lock to an inode
2183  * @inode: inode of the file to apply to
2184  * @fl: The lock to be applied
2185  *
2186  * Apply a POSIX or FLOCK style lock request to an inode.
2187  */
2188 int locks_lock_inode_wait(struct inode *inode, struct file_lock *fl)
2189 {
2190 	int res = 0;
2191 	switch (fl->fl_flags & (FL_POSIX|FL_FLOCK)) {
2192 		case FL_POSIX:
2193 			res = posix_lock_inode_wait(inode, fl);
2194 			break;
2195 		case FL_FLOCK:
2196 			res = flock_lock_inode_wait(inode, fl);
2197 			break;
2198 		default:
2199 			BUG();
2200 	}
2201 	return res;
2202 }
2203 EXPORT_SYMBOL(locks_lock_inode_wait);
2204 
2205 /**
2206  *	sys_flock: - flock() system call.
2207  *	@fd: the file descriptor to lock.
2208  *	@cmd: the type of lock to apply.
2209  *
2210  *	Apply a %FL_FLOCK style lock to an open file descriptor.
2211  *	The @cmd can be one of:
2212  *
2213  *	- %LOCK_SH -- a shared lock.
2214  *	- %LOCK_EX -- an exclusive lock.
2215  *	- %LOCK_UN -- remove an existing lock.
2216  *	- %LOCK_MAND -- a 'mandatory' flock.
2217  *	  This exists to emulate Windows Share Modes.
2218  *
2219  *	%LOCK_MAND can be combined with %LOCK_READ or %LOCK_WRITE to allow other
2220  *	processes read and write access respectively.
2221  */
2222 SYSCALL_DEFINE2(flock, unsigned int, fd, unsigned int, cmd)
2223 {
2224 	struct fd f = fdget(fd);
2225 	struct file_lock *lock;
2226 	int can_sleep, unlock;
2227 	int error;
2228 
2229 	error = -EBADF;
2230 	if (!f.file)
2231 		goto out;
2232 
2233 	can_sleep = !(cmd & LOCK_NB);
2234 	cmd &= ~LOCK_NB;
2235 	unlock = (cmd == LOCK_UN);
2236 
2237 	if (!unlock && !(cmd & LOCK_MAND) &&
2238 	    !(f.file->f_mode & (FMODE_READ|FMODE_WRITE)))
2239 		goto out_putf;
2240 
2241 	lock = flock_make_lock(f.file, cmd, NULL);
2242 	if (IS_ERR(lock)) {
2243 		error = PTR_ERR(lock);
2244 		goto out_putf;
2245 	}
2246 
2247 	if (can_sleep)
2248 		lock->fl_flags |= FL_SLEEP;
2249 
2250 	error = security_file_lock(f.file, lock->fl_type);
2251 	if (error)
2252 		goto out_free;
2253 
2254 	if (f.file->f_op->flock)
2255 		error = f.file->f_op->flock(f.file,
2256 					  (can_sleep) ? F_SETLKW : F_SETLK,
2257 					  lock);
2258 	else
2259 		error = locks_lock_file_wait(f.file, lock);
2260 
2261  out_free:
2262 	locks_free_lock(lock);
2263 
2264  out_putf:
2265 	fdput(f);
2266  out:
2267 	return error;
2268 }
2269 
2270 /**
2271  * vfs_test_lock - test file byte range lock
2272  * @filp: The file to test lock for
2273  * @fl: The lock to test; also used to hold result
2274  *
2275  * Returns -ERRNO on failure.  Indicates presence of conflicting lock by
2276  * setting conf->fl_type to something other than F_UNLCK.
2277  */
2278 int vfs_test_lock(struct file *filp, struct file_lock *fl)
2279 {
2280 	if (filp->f_op->lock)
2281 		return filp->f_op->lock(filp, F_GETLK, fl);
2282 	posix_test_lock(filp, fl);
2283 	return 0;
2284 }
2285 EXPORT_SYMBOL_GPL(vfs_test_lock);
2286 
2287 /**
2288  * locks_translate_pid - translate a file_lock's fl_pid number into a namespace
2289  * @fl: The file_lock who's fl_pid should be translated
2290  * @ns: The namespace into which the pid should be translated
2291  *
2292  * Used to tranlate a fl_pid into a namespace virtual pid number
2293  */
2294 static pid_t locks_translate_pid(struct file_lock *fl, struct pid_namespace *ns)
2295 {
2296 	pid_t vnr;
2297 	struct pid *pid;
2298 
2299 	if (IS_OFDLCK(fl))
2300 		return -1;
2301 	if (IS_REMOTELCK(fl))
2302 		return fl->fl_pid;
2303 	/*
2304 	 * If the flock owner process is dead and its pid has been already
2305 	 * freed, the translation below won't work, but we still want to show
2306 	 * flock owner pid number in init pidns.
2307 	 */
2308 	if (ns == &init_pid_ns)
2309 		return (pid_t)fl->fl_pid;
2310 
2311 	rcu_read_lock();
2312 	pid = find_pid_ns(fl->fl_pid, &init_pid_ns);
2313 	vnr = pid_nr_ns(pid, ns);
2314 	rcu_read_unlock();
2315 	return vnr;
2316 }
2317 
2318 static int posix_lock_to_flock(struct flock *flock, struct file_lock *fl)
2319 {
2320 	flock->l_pid = locks_translate_pid(fl, task_active_pid_ns(current));
2321 #if BITS_PER_LONG == 32
2322 	/*
2323 	 * Make sure we can represent the posix lock via
2324 	 * legacy 32bit flock.
2325 	 */
2326 	if (fl->fl_start > OFFT_OFFSET_MAX)
2327 		return -EOVERFLOW;
2328 	if (fl->fl_end != OFFSET_MAX && fl->fl_end > OFFT_OFFSET_MAX)
2329 		return -EOVERFLOW;
2330 #endif
2331 	flock->l_start = fl->fl_start;
2332 	flock->l_len = fl->fl_end == OFFSET_MAX ? 0 :
2333 		fl->fl_end - fl->fl_start + 1;
2334 	flock->l_whence = 0;
2335 	flock->l_type = fl->fl_type;
2336 	return 0;
2337 }
2338 
2339 #if BITS_PER_LONG == 32
2340 static void posix_lock_to_flock64(struct flock64 *flock, struct file_lock *fl)
2341 {
2342 	flock->l_pid = locks_translate_pid(fl, task_active_pid_ns(current));
2343 	flock->l_start = fl->fl_start;
2344 	flock->l_len = fl->fl_end == OFFSET_MAX ? 0 :
2345 		fl->fl_end - fl->fl_start + 1;
2346 	flock->l_whence = 0;
2347 	flock->l_type = fl->fl_type;
2348 }
2349 #endif
2350 
2351 /* Report the first existing lock that would conflict with l.
2352  * This implements the F_GETLK command of fcntl().
2353  */
2354 int fcntl_getlk(struct file *filp, unsigned int cmd, struct flock *flock)
2355 {
2356 	struct file_lock *fl;
2357 	int error;
2358 
2359 	fl = locks_alloc_lock();
2360 	if (fl == NULL)
2361 		return -ENOMEM;
2362 	error = -EINVAL;
2363 	if (flock->l_type != F_RDLCK && flock->l_type != F_WRLCK)
2364 		goto out;
2365 
2366 	error = flock_to_posix_lock(filp, fl, flock);
2367 	if (error)
2368 		goto out;
2369 
2370 	if (cmd == F_OFD_GETLK) {
2371 		error = -EINVAL;
2372 		if (flock->l_pid != 0)
2373 			goto out;
2374 
2375 		fl->fl_flags |= FL_OFDLCK;
2376 		fl->fl_owner = filp;
2377 	}
2378 
2379 	error = vfs_test_lock(filp, fl);
2380 	if (error)
2381 		goto out;
2382 
2383 	flock->l_type = fl->fl_type;
2384 	if (fl->fl_type != F_UNLCK) {
2385 		error = posix_lock_to_flock(flock, fl);
2386 		if (error)
2387 			goto out;
2388 	}
2389 out:
2390 	locks_free_lock(fl);
2391 	return error;
2392 }
2393 
2394 /**
2395  * vfs_lock_file - file byte range lock
2396  * @filp: The file to apply the lock to
2397  * @cmd: type of locking operation (F_SETLK, F_GETLK, etc.)
2398  * @fl: The lock to be applied
2399  * @conf: Place to return a copy of the conflicting lock, if found.
2400  *
2401  * A caller that doesn't care about the conflicting lock may pass NULL
2402  * as the final argument.
2403  *
2404  * If the filesystem defines a private ->lock() method, then @conf will
2405  * be left unchanged; so a caller that cares should initialize it to
2406  * some acceptable default.
2407  *
2408  * To avoid blocking kernel daemons, such as lockd, that need to acquire POSIX
2409  * locks, the ->lock() interface may return asynchronously, before the lock has
2410  * been granted or denied by the underlying filesystem, if (and only if)
2411  * lm_grant is set. Callers expecting ->lock() to return asynchronously
2412  * will only use F_SETLK, not F_SETLKW; they will set FL_SLEEP if (and only if)
2413  * the request is for a blocking lock. When ->lock() does return asynchronously,
2414  * it must return FILE_LOCK_DEFERRED, and call ->lm_grant() when the lock
2415  * request completes.
2416  * If the request is for non-blocking lock the file system should return
2417  * FILE_LOCK_DEFERRED then try to get the lock and call the callback routine
2418  * with the result. If the request timed out the callback routine will return a
2419  * nonzero return code and the file system should release the lock. The file
2420  * system is also responsible to keep a corresponding posix lock when it
2421  * grants a lock so the VFS can find out which locks are locally held and do
2422  * the correct lock cleanup when required.
2423  * The underlying filesystem must not drop the kernel lock or call
2424  * ->lm_grant() before returning to the caller with a FILE_LOCK_DEFERRED
2425  * return code.
2426  */
2427 int vfs_lock_file(struct file *filp, unsigned int cmd, struct file_lock *fl, struct file_lock *conf)
2428 {
2429 	if (filp->f_op->lock)
2430 		return filp->f_op->lock(filp, cmd, fl);
2431 	else
2432 		return posix_lock_file(filp, fl, conf);
2433 }
2434 EXPORT_SYMBOL_GPL(vfs_lock_file);
2435 
2436 static int do_lock_file_wait(struct file *filp, unsigned int cmd,
2437 			     struct file_lock *fl)
2438 {
2439 	int error;
2440 
2441 	error = security_file_lock(filp, fl->fl_type);
2442 	if (error)
2443 		return error;
2444 
2445 	for (;;) {
2446 		error = vfs_lock_file(filp, cmd, fl, NULL);
2447 		if (error != FILE_LOCK_DEFERRED)
2448 			break;
2449 		error = wait_event_interruptible(fl->fl_wait,
2450 					list_empty(&fl->fl_blocked_member));
2451 		if (error)
2452 			break;
2453 	}
2454 	locks_delete_block(fl);
2455 
2456 	return error;
2457 }
2458 
2459 /* Ensure that fl->fl_file has compatible f_mode for F_SETLK calls */
2460 static int
2461 check_fmode_for_setlk(struct file_lock *fl)
2462 {
2463 	switch (fl->fl_type) {
2464 	case F_RDLCK:
2465 		if (!(fl->fl_file->f_mode & FMODE_READ))
2466 			return -EBADF;
2467 		break;
2468 	case F_WRLCK:
2469 		if (!(fl->fl_file->f_mode & FMODE_WRITE))
2470 			return -EBADF;
2471 	}
2472 	return 0;
2473 }
2474 
2475 /* Apply the lock described by l to an open file descriptor.
2476  * This implements both the F_SETLK and F_SETLKW commands of fcntl().
2477  */
2478 int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
2479 		struct flock *flock)
2480 {
2481 	struct file_lock *file_lock = locks_alloc_lock();
2482 	struct inode *inode = locks_inode(filp);
2483 	struct file *f;
2484 	int error;
2485 
2486 	if (file_lock == NULL)
2487 		return -ENOLCK;
2488 
2489 	/* Don't allow mandatory locks on files that may be memory mapped
2490 	 * and shared.
2491 	 */
2492 	if (mandatory_lock(inode) && mapping_writably_mapped(filp->f_mapping)) {
2493 		error = -EAGAIN;
2494 		goto out;
2495 	}
2496 
2497 	error = flock_to_posix_lock(filp, file_lock, flock);
2498 	if (error)
2499 		goto out;
2500 
2501 	error = check_fmode_for_setlk(file_lock);
2502 	if (error)
2503 		goto out;
2504 
2505 	/*
2506 	 * If the cmd is requesting file-private locks, then set the
2507 	 * FL_OFDLCK flag and override the owner.
2508 	 */
2509 	switch (cmd) {
2510 	case F_OFD_SETLK:
2511 		error = -EINVAL;
2512 		if (flock->l_pid != 0)
2513 			goto out;
2514 
2515 		cmd = F_SETLK;
2516 		file_lock->fl_flags |= FL_OFDLCK;
2517 		file_lock->fl_owner = filp;
2518 		break;
2519 	case F_OFD_SETLKW:
2520 		error = -EINVAL;
2521 		if (flock->l_pid != 0)
2522 			goto out;
2523 
2524 		cmd = F_SETLKW;
2525 		file_lock->fl_flags |= FL_OFDLCK;
2526 		file_lock->fl_owner = filp;
2527 		fallthrough;
2528 	case F_SETLKW:
2529 		file_lock->fl_flags |= FL_SLEEP;
2530 	}
2531 
2532 	error = do_lock_file_wait(filp, cmd, file_lock);
2533 
2534 	/*
2535 	 * Attempt to detect a close/fcntl race and recover by releasing the
2536 	 * lock that was just acquired. There is no need to do that when we're
2537 	 * unlocking though, or for OFD locks.
2538 	 */
2539 	if (!error && file_lock->fl_type != F_UNLCK &&
2540 	    !(file_lock->fl_flags & FL_OFDLCK)) {
2541 		struct files_struct *files = current->files;
2542 		/*
2543 		 * We need that spin_lock here - it prevents reordering between
2544 		 * update of i_flctx->flc_posix and check for it done in
2545 		 * close(). rcu_read_lock() wouldn't do.
2546 		 */
2547 		spin_lock(&files->file_lock);
2548 		f = files_lookup_fd_locked(files, fd);
2549 		spin_unlock(&files->file_lock);
2550 		if (f != filp) {
2551 			file_lock->fl_type = F_UNLCK;
2552 			error = do_lock_file_wait(filp, cmd, file_lock);
2553 			WARN_ON_ONCE(error);
2554 			error = -EBADF;
2555 		}
2556 	}
2557 out:
2558 	trace_fcntl_setlk(inode, file_lock, error);
2559 	locks_free_lock(file_lock);
2560 	return error;
2561 }
2562 
2563 #if BITS_PER_LONG == 32
2564 /* Report the first existing lock that would conflict with l.
2565  * This implements the F_GETLK command of fcntl().
2566  */
2567 int fcntl_getlk64(struct file *filp, unsigned int cmd, struct flock64 *flock)
2568 {
2569 	struct file_lock *fl;
2570 	int error;
2571 
2572 	fl = locks_alloc_lock();
2573 	if (fl == NULL)
2574 		return -ENOMEM;
2575 
2576 	error = -EINVAL;
2577 	if (flock->l_type != F_RDLCK && flock->l_type != F_WRLCK)
2578 		goto out;
2579 
2580 	error = flock64_to_posix_lock(filp, fl, flock);
2581 	if (error)
2582 		goto out;
2583 
2584 	if (cmd == F_OFD_GETLK) {
2585 		error = -EINVAL;
2586 		if (flock->l_pid != 0)
2587 			goto out;
2588 
2589 		cmd = F_GETLK64;
2590 		fl->fl_flags |= FL_OFDLCK;
2591 		fl->fl_owner = filp;
2592 	}
2593 
2594 	error = vfs_test_lock(filp, fl);
2595 	if (error)
2596 		goto out;
2597 
2598 	flock->l_type = fl->fl_type;
2599 	if (fl->fl_type != F_UNLCK)
2600 		posix_lock_to_flock64(flock, fl);
2601 
2602 out:
2603 	locks_free_lock(fl);
2604 	return error;
2605 }
2606 
2607 /* Apply the lock described by l to an open file descriptor.
2608  * This implements both the F_SETLK and F_SETLKW commands of fcntl().
2609  */
2610 int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
2611 		struct flock64 *flock)
2612 {
2613 	struct file_lock *file_lock = locks_alloc_lock();
2614 	struct inode *inode = locks_inode(filp);
2615 	struct file *f;
2616 	int error;
2617 
2618 	if (file_lock == NULL)
2619 		return -ENOLCK;
2620 
2621 	/* Don't allow mandatory locks on files that may be memory mapped
2622 	 * and shared.
2623 	 */
2624 	if (mandatory_lock(inode) && mapping_writably_mapped(filp->f_mapping)) {
2625 		error = -EAGAIN;
2626 		goto out;
2627 	}
2628 
2629 	error = flock64_to_posix_lock(filp, file_lock, flock);
2630 	if (error)
2631 		goto out;
2632 
2633 	error = check_fmode_for_setlk(file_lock);
2634 	if (error)
2635 		goto out;
2636 
2637 	/*
2638 	 * If the cmd is requesting file-private locks, then set the
2639 	 * FL_OFDLCK flag and override the owner.
2640 	 */
2641 	switch (cmd) {
2642 	case F_OFD_SETLK:
2643 		error = -EINVAL;
2644 		if (flock->l_pid != 0)
2645 			goto out;
2646 
2647 		cmd = F_SETLK64;
2648 		file_lock->fl_flags |= FL_OFDLCK;
2649 		file_lock->fl_owner = filp;
2650 		break;
2651 	case F_OFD_SETLKW:
2652 		error = -EINVAL;
2653 		if (flock->l_pid != 0)
2654 			goto out;
2655 
2656 		cmd = F_SETLKW64;
2657 		file_lock->fl_flags |= FL_OFDLCK;
2658 		file_lock->fl_owner = filp;
2659 		fallthrough;
2660 	case F_SETLKW64:
2661 		file_lock->fl_flags |= FL_SLEEP;
2662 	}
2663 
2664 	error = do_lock_file_wait(filp, cmd, file_lock);
2665 
2666 	/*
2667 	 * Attempt to detect a close/fcntl race and recover by releasing the
2668 	 * lock that was just acquired. There is no need to do that when we're
2669 	 * unlocking though, or for OFD locks.
2670 	 */
2671 	if (!error && file_lock->fl_type != F_UNLCK &&
2672 	    !(file_lock->fl_flags & FL_OFDLCK)) {
2673 		struct files_struct *files = current->files;
2674 		/*
2675 		 * We need that spin_lock here - it prevents reordering between
2676 		 * update of i_flctx->flc_posix and check for it done in
2677 		 * close(). rcu_read_lock() wouldn't do.
2678 		 */
2679 		spin_lock(&files->file_lock);
2680 		f = files_lookup_fd_locked(files, fd);
2681 		spin_unlock(&files->file_lock);
2682 		if (f != filp) {
2683 			file_lock->fl_type = F_UNLCK;
2684 			error = do_lock_file_wait(filp, cmd, file_lock);
2685 			WARN_ON_ONCE(error);
2686 			error = -EBADF;
2687 		}
2688 	}
2689 out:
2690 	locks_free_lock(file_lock);
2691 	return error;
2692 }
2693 #endif /* BITS_PER_LONG == 32 */
2694 
2695 /*
2696  * This function is called when the file is being removed
2697  * from the task's fd array.  POSIX locks belonging to this task
2698  * are deleted at this time.
2699  */
2700 void locks_remove_posix(struct file *filp, fl_owner_t owner)
2701 {
2702 	int error;
2703 	struct inode *inode = locks_inode(filp);
2704 	struct file_lock lock;
2705 	struct file_lock_context *ctx;
2706 
2707 	/*
2708 	 * If there are no locks held on this file, we don't need to call
2709 	 * posix_lock_file().  Another process could be setting a lock on this
2710 	 * file at the same time, but we wouldn't remove that lock anyway.
2711 	 */
2712 	ctx =  smp_load_acquire(&inode->i_flctx);
2713 	if (!ctx || list_empty(&ctx->flc_posix))
2714 		return;
2715 
2716 	locks_init_lock(&lock);
2717 	lock.fl_type = F_UNLCK;
2718 	lock.fl_flags = FL_POSIX | FL_CLOSE;
2719 	lock.fl_start = 0;
2720 	lock.fl_end = OFFSET_MAX;
2721 	lock.fl_owner = owner;
2722 	lock.fl_pid = current->tgid;
2723 	lock.fl_file = filp;
2724 	lock.fl_ops = NULL;
2725 	lock.fl_lmops = NULL;
2726 
2727 	error = vfs_lock_file(filp, F_SETLK, &lock, NULL);
2728 
2729 	if (lock.fl_ops && lock.fl_ops->fl_release_private)
2730 		lock.fl_ops->fl_release_private(&lock);
2731 	trace_locks_remove_posix(inode, &lock, error);
2732 }
2733 EXPORT_SYMBOL(locks_remove_posix);
2734 
2735 /* The i_flctx must be valid when calling into here */
2736 static void
2737 locks_remove_flock(struct file *filp, struct file_lock_context *flctx)
2738 {
2739 	struct file_lock fl;
2740 	struct inode *inode = locks_inode(filp);
2741 
2742 	if (list_empty(&flctx->flc_flock))
2743 		return;
2744 
2745 	flock_make_lock(filp, LOCK_UN, &fl);
2746 	fl.fl_flags |= FL_CLOSE;
2747 
2748 	if (filp->f_op->flock)
2749 		filp->f_op->flock(filp, F_SETLKW, &fl);
2750 	else
2751 		flock_lock_inode(inode, &fl);
2752 
2753 	if (fl.fl_ops && fl.fl_ops->fl_release_private)
2754 		fl.fl_ops->fl_release_private(&fl);
2755 }
2756 
2757 /* The i_flctx must be valid when calling into here */
2758 static void
2759 locks_remove_lease(struct file *filp, struct file_lock_context *ctx)
2760 {
2761 	struct file_lock *fl, *tmp;
2762 	LIST_HEAD(dispose);
2763 
2764 	if (list_empty(&ctx->flc_lease))
2765 		return;
2766 
2767 	percpu_down_read(&file_rwsem);
2768 	spin_lock(&ctx->flc_lock);
2769 	list_for_each_entry_safe(fl, tmp, &ctx->flc_lease, fl_list)
2770 		if (filp == fl->fl_file)
2771 			lease_modify(fl, F_UNLCK, &dispose);
2772 	spin_unlock(&ctx->flc_lock);
2773 	percpu_up_read(&file_rwsem);
2774 
2775 	locks_dispose_list(&dispose);
2776 }
2777 
2778 /*
2779  * This function is called on the last close of an open file.
2780  */
2781 void locks_remove_file(struct file *filp)
2782 {
2783 	struct file_lock_context *ctx;
2784 
2785 	ctx = smp_load_acquire(&locks_inode(filp)->i_flctx);
2786 	if (!ctx)
2787 		return;
2788 
2789 	/* remove any OFD locks */
2790 	locks_remove_posix(filp, filp);
2791 
2792 	/* remove flock locks */
2793 	locks_remove_flock(filp, ctx);
2794 
2795 	/* remove any leases */
2796 	locks_remove_lease(filp, ctx);
2797 
2798 	spin_lock(&ctx->flc_lock);
2799 	locks_check_ctx_file_list(filp, &ctx->flc_posix, "POSIX");
2800 	locks_check_ctx_file_list(filp, &ctx->flc_flock, "FLOCK");
2801 	locks_check_ctx_file_list(filp, &ctx->flc_lease, "LEASE");
2802 	spin_unlock(&ctx->flc_lock);
2803 }
2804 
2805 /**
2806  * vfs_cancel_lock - file byte range unblock lock
2807  * @filp: The file to apply the unblock to
2808  * @fl: The lock to be unblocked
2809  *
2810  * Used by lock managers to cancel blocked requests
2811  */
2812 int vfs_cancel_lock(struct file *filp, struct file_lock *fl)
2813 {
2814 	if (filp->f_op->lock)
2815 		return filp->f_op->lock(filp, F_CANCELLK, fl);
2816 	return 0;
2817 }
2818 EXPORT_SYMBOL_GPL(vfs_cancel_lock);
2819 
2820 #ifdef CONFIG_PROC_FS
2821 #include <linux/proc_fs.h>
2822 #include <linux/seq_file.h>
2823 
2824 struct locks_iterator {
2825 	int	li_cpu;
2826 	loff_t	li_pos;
2827 };
2828 
2829 static void lock_get_status(struct seq_file *f, struct file_lock *fl,
2830 			    loff_t id, char *pfx, int repeat)
2831 {
2832 	struct inode *inode = NULL;
2833 	unsigned int fl_pid;
2834 	struct pid_namespace *proc_pidns = proc_pid_ns(file_inode(f->file)->i_sb);
2835 
2836 	fl_pid = locks_translate_pid(fl, proc_pidns);
2837 	/*
2838 	 * If lock owner is dead (and pid is freed) or not visible in current
2839 	 * pidns, zero is shown as a pid value. Check lock info from
2840 	 * init_pid_ns to get saved lock pid value.
2841 	 */
2842 
2843 	if (fl->fl_file != NULL)
2844 		inode = locks_inode(fl->fl_file);
2845 
2846 	seq_printf(f, "%lld: ", id);
2847 
2848 	if (repeat)
2849 		seq_printf(f, "%*s", repeat - 1 + (int)strlen(pfx), pfx);
2850 
2851 	if (IS_POSIX(fl)) {
2852 		if (fl->fl_flags & FL_ACCESS)
2853 			seq_puts(f, "ACCESS");
2854 		else if (IS_OFDLCK(fl))
2855 			seq_puts(f, "OFDLCK");
2856 		else
2857 			seq_puts(f, "POSIX ");
2858 
2859 		seq_printf(f, " %s ",
2860 			     (inode == NULL) ? "*NOINODE*" :
2861 			     mandatory_lock(inode) ? "MANDATORY" : "ADVISORY ");
2862 	} else if (IS_FLOCK(fl)) {
2863 		if (fl->fl_type & LOCK_MAND) {
2864 			seq_puts(f, "FLOCK  MSNFS     ");
2865 		} else {
2866 			seq_puts(f, "FLOCK  ADVISORY  ");
2867 		}
2868 	} else if (IS_LEASE(fl)) {
2869 		if (fl->fl_flags & FL_DELEG)
2870 			seq_puts(f, "DELEG  ");
2871 		else
2872 			seq_puts(f, "LEASE  ");
2873 
2874 		if (lease_breaking(fl))
2875 			seq_puts(f, "BREAKING  ");
2876 		else if (fl->fl_file)
2877 			seq_puts(f, "ACTIVE    ");
2878 		else
2879 			seq_puts(f, "BREAKER   ");
2880 	} else {
2881 		seq_puts(f, "UNKNOWN UNKNOWN  ");
2882 	}
2883 	if (fl->fl_type & LOCK_MAND) {
2884 		seq_printf(f, "%s ",
2885 			       (fl->fl_type & LOCK_READ)
2886 			       ? (fl->fl_type & LOCK_WRITE) ? "RW   " : "READ "
2887 			       : (fl->fl_type & LOCK_WRITE) ? "WRITE" : "NONE ");
2888 	} else {
2889 		int type = IS_LEASE(fl) ? target_leasetype(fl) : fl->fl_type;
2890 
2891 		seq_printf(f, "%s ", (type == F_WRLCK) ? "WRITE" :
2892 				     (type == F_RDLCK) ? "READ" : "UNLCK");
2893 	}
2894 	if (inode) {
2895 		/* userspace relies on this representation of dev_t */
2896 		seq_printf(f, "%d %02x:%02x:%lu ", fl_pid,
2897 				MAJOR(inode->i_sb->s_dev),
2898 				MINOR(inode->i_sb->s_dev), inode->i_ino);
2899 	} else {
2900 		seq_printf(f, "%d <none>:0 ", fl_pid);
2901 	}
2902 	if (IS_POSIX(fl)) {
2903 		if (fl->fl_end == OFFSET_MAX)
2904 			seq_printf(f, "%Ld EOF\n", fl->fl_start);
2905 		else
2906 			seq_printf(f, "%Ld %Ld\n", fl->fl_start, fl->fl_end);
2907 	} else {
2908 		seq_puts(f, "0 EOF\n");
2909 	}
2910 }
2911 
2912 static struct file_lock *get_next_blocked_member(struct file_lock *node)
2913 {
2914 	struct file_lock *tmp;
2915 
2916 	/* NULL node or root node */
2917 	if (node == NULL || node->fl_blocker == NULL)
2918 		return NULL;
2919 
2920 	/* Next member in the linked list could be itself */
2921 	tmp = list_next_entry(node, fl_blocked_member);
2922 	if (list_entry_is_head(tmp, &node->fl_blocker->fl_blocked_requests, fl_blocked_member)
2923 		|| tmp == node) {
2924 		return NULL;
2925 	}
2926 
2927 	return tmp;
2928 }
2929 
2930 static int locks_show(struct seq_file *f, void *v)
2931 {
2932 	struct locks_iterator *iter = f->private;
2933 	struct file_lock *cur, *tmp;
2934 	struct pid_namespace *proc_pidns = proc_pid_ns(file_inode(f->file)->i_sb);
2935 	int level = 0;
2936 
2937 	cur = hlist_entry(v, struct file_lock, fl_link);
2938 
2939 	if (locks_translate_pid(cur, proc_pidns) == 0)
2940 		return 0;
2941 
2942 	/* View this crossed linked list as a binary tree, the first member of fl_blocked_requests
2943 	 * is the left child of current node, the next silibing in fl_blocked_member is the
2944 	 * right child, we can alse get the parent of current node from fl_blocker, so this
2945 	 * question becomes traversal of a binary tree
2946 	 */
2947 	while (cur != NULL) {
2948 		if (level)
2949 			lock_get_status(f, cur, iter->li_pos, "-> ", level);
2950 		else
2951 			lock_get_status(f, cur, iter->li_pos, "", level);
2952 
2953 		if (!list_empty(&cur->fl_blocked_requests)) {
2954 			/* Turn left */
2955 			cur = list_first_entry_or_null(&cur->fl_blocked_requests,
2956 				struct file_lock, fl_blocked_member);
2957 			level++;
2958 		} else {
2959 			/* Turn right */
2960 			tmp = get_next_blocked_member(cur);
2961 			/* Fall back to parent node */
2962 			while (tmp == NULL && cur->fl_blocker != NULL) {
2963 				cur = cur->fl_blocker;
2964 				level--;
2965 				tmp = get_next_blocked_member(cur);
2966 			}
2967 			cur = tmp;
2968 		}
2969 	}
2970 
2971 	return 0;
2972 }
2973 
2974 static void __show_fd_locks(struct seq_file *f,
2975 			struct list_head *head, int *id,
2976 			struct file *filp, struct files_struct *files)
2977 {
2978 	struct file_lock *fl;
2979 
2980 	list_for_each_entry(fl, head, fl_list) {
2981 
2982 		if (filp != fl->fl_file)
2983 			continue;
2984 		if (fl->fl_owner != files &&
2985 		    fl->fl_owner != filp)
2986 			continue;
2987 
2988 		(*id)++;
2989 		seq_puts(f, "lock:\t");
2990 		lock_get_status(f, fl, *id, "", 0);
2991 	}
2992 }
2993 
2994 void show_fd_locks(struct seq_file *f,
2995 		  struct file *filp, struct files_struct *files)
2996 {
2997 	struct inode *inode = locks_inode(filp);
2998 	struct file_lock_context *ctx;
2999 	int id = 0;
3000 
3001 	ctx = smp_load_acquire(&inode->i_flctx);
3002 	if (!ctx)
3003 		return;
3004 
3005 	spin_lock(&ctx->flc_lock);
3006 	__show_fd_locks(f, &ctx->flc_flock, &id, filp, files);
3007 	__show_fd_locks(f, &ctx->flc_posix, &id, filp, files);
3008 	__show_fd_locks(f, &ctx->flc_lease, &id, filp, files);
3009 	spin_unlock(&ctx->flc_lock);
3010 }
3011 
3012 static void *locks_start(struct seq_file *f, loff_t *pos)
3013 	__acquires(&blocked_lock_lock)
3014 {
3015 	struct locks_iterator *iter = f->private;
3016 
3017 	iter->li_pos = *pos + 1;
3018 	percpu_down_write(&file_rwsem);
3019 	spin_lock(&blocked_lock_lock);
3020 	return seq_hlist_start_percpu(&file_lock_list.hlist, &iter->li_cpu, *pos);
3021 }
3022 
3023 static void *locks_next(struct seq_file *f, void *v, loff_t *pos)
3024 {
3025 	struct locks_iterator *iter = f->private;
3026 
3027 	++iter->li_pos;
3028 	return seq_hlist_next_percpu(v, &file_lock_list.hlist, &iter->li_cpu, pos);
3029 }
3030 
3031 static void locks_stop(struct seq_file *f, void *v)
3032 	__releases(&blocked_lock_lock)
3033 {
3034 	spin_unlock(&blocked_lock_lock);
3035 	percpu_up_write(&file_rwsem);
3036 }
3037 
3038 static const struct seq_operations locks_seq_operations = {
3039 	.start	= locks_start,
3040 	.next	= locks_next,
3041 	.stop	= locks_stop,
3042 	.show	= locks_show,
3043 };
3044 
3045 static int __init proc_locks_init(void)
3046 {
3047 	proc_create_seq_private("locks", 0, NULL, &locks_seq_operations,
3048 			sizeof(struct locks_iterator), NULL);
3049 	return 0;
3050 }
3051 fs_initcall(proc_locks_init);
3052 #endif
3053 
3054 static int __init filelock_init(void)
3055 {
3056 	int i;
3057 
3058 	flctx_cache = kmem_cache_create("file_lock_ctx",
3059 			sizeof(struct file_lock_context), 0, SLAB_PANIC, NULL);
3060 
3061 	filelock_cache = kmem_cache_create("file_lock_cache",
3062 			sizeof(struct file_lock), 0, SLAB_PANIC, NULL);
3063 
3064 	for_each_possible_cpu(i) {
3065 		struct file_lock_list_struct *fll = per_cpu_ptr(&file_lock_list, i);
3066 
3067 		spin_lock_init(&fll->lock);
3068 		INIT_HLIST_HEAD(&fll->hlist);
3069 	}
3070 
3071 	lease_notifier_chain_init();
3072 	return 0;
3073 }
3074 core_initcall(filelock_init);
3075