1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/fanotify.h> 3 #include <linux/fdtable.h> 4 #include <linux/fsnotify_backend.h> 5 #include <linux/init.h> 6 #include <linux/jiffies.h> 7 #include <linux/kernel.h> /* UINT_MAX */ 8 #include <linux/mount.h> 9 #include <linux/sched.h> 10 #include <linux/sched/user.h> 11 #include <linux/sched/signal.h> 12 #include <linux/types.h> 13 #include <linux/wait.h> 14 #include <linux/audit.h> 15 #include <linux/sched/mm.h> 16 #include <linux/statfs.h> 17 #include <linux/stringhash.h> 18 19 #include "fanotify.h" 20 21 static bool fanotify_path_equal(struct path *p1, struct path *p2) 22 { 23 return p1->mnt == p2->mnt && p1->dentry == p2->dentry; 24 } 25 26 static unsigned int fanotify_hash_path(const struct path *path) 27 { 28 return hash_ptr(path->dentry, FANOTIFY_EVENT_HASH_BITS) ^ 29 hash_ptr(path->mnt, FANOTIFY_EVENT_HASH_BITS); 30 } 31 32 static inline bool fanotify_fsid_equal(__kernel_fsid_t *fsid1, 33 __kernel_fsid_t *fsid2) 34 { 35 return fsid1->val[0] == fsid2->val[0] && fsid1->val[1] == fsid2->val[1]; 36 } 37 38 static unsigned int fanotify_hash_fsid(__kernel_fsid_t *fsid) 39 { 40 return hash_32(fsid->val[0], FANOTIFY_EVENT_HASH_BITS) ^ 41 hash_32(fsid->val[1], FANOTIFY_EVENT_HASH_BITS); 42 } 43 44 static bool fanotify_fh_equal(struct fanotify_fh *fh1, 45 struct fanotify_fh *fh2) 46 { 47 if (fh1->type != fh2->type || fh1->len != fh2->len) 48 return false; 49 50 return !fh1->len || 51 !memcmp(fanotify_fh_buf(fh1), fanotify_fh_buf(fh2), fh1->len); 52 } 53 54 static unsigned int fanotify_hash_fh(struct fanotify_fh *fh) 55 { 56 long salt = (long)fh->type | (long)fh->len << 8; 57 58 /* 59 * full_name_hash() works long by long, so it handles fh buf optimally. 60 */ 61 return full_name_hash((void *)salt, fanotify_fh_buf(fh), fh->len); 62 } 63 64 static bool fanotify_fid_event_equal(struct fanotify_fid_event *ffe1, 65 struct fanotify_fid_event *ffe2) 66 { 67 /* Do not merge fid events without object fh */ 68 if (!ffe1->object_fh.len) 69 return false; 70 71 return fanotify_fsid_equal(&ffe1->fsid, &ffe2->fsid) && 72 fanotify_fh_equal(&ffe1->object_fh, &ffe2->object_fh); 73 } 74 75 static bool fanotify_info_equal(struct fanotify_info *info1, 76 struct fanotify_info *info2) 77 { 78 if (info1->dir_fh_totlen != info2->dir_fh_totlen || 79 info1->dir2_fh_totlen != info2->dir2_fh_totlen || 80 info1->file_fh_totlen != info2->file_fh_totlen || 81 info1->name_len != info2->name_len || 82 info1->name2_len != info2->name2_len) 83 return false; 84 85 if (info1->dir_fh_totlen && 86 !fanotify_fh_equal(fanotify_info_dir_fh(info1), 87 fanotify_info_dir_fh(info2))) 88 return false; 89 90 if (info1->dir2_fh_totlen && 91 !fanotify_fh_equal(fanotify_info_dir2_fh(info1), 92 fanotify_info_dir2_fh(info2))) 93 return false; 94 95 if (info1->file_fh_totlen && 96 !fanotify_fh_equal(fanotify_info_file_fh(info1), 97 fanotify_info_file_fh(info2))) 98 return false; 99 100 if (info1->name_len && 101 memcmp(fanotify_info_name(info1), fanotify_info_name(info2), 102 info1->name_len)) 103 return false; 104 105 return !info1->name2_len || 106 !memcmp(fanotify_info_name2(info1), fanotify_info_name2(info2), 107 info1->name2_len); 108 } 109 110 static bool fanotify_name_event_equal(struct fanotify_name_event *fne1, 111 struct fanotify_name_event *fne2) 112 { 113 struct fanotify_info *info1 = &fne1->info; 114 struct fanotify_info *info2 = &fne2->info; 115 116 /* Do not merge name events without dir fh */ 117 if (!info1->dir_fh_totlen) 118 return false; 119 120 if (!fanotify_fsid_equal(&fne1->fsid, &fne2->fsid)) 121 return false; 122 123 return fanotify_info_equal(info1, info2); 124 } 125 126 static bool fanotify_error_event_equal(struct fanotify_error_event *fee1, 127 struct fanotify_error_event *fee2) 128 { 129 /* Error events against the same file system are always merged. */ 130 if (!fanotify_fsid_equal(&fee1->fsid, &fee2->fsid)) 131 return false; 132 133 return true; 134 } 135 136 static bool fanotify_should_merge(struct fanotify_event *old, 137 struct fanotify_event *new) 138 { 139 pr_debug("%s: old=%p new=%p\n", __func__, old, new); 140 141 if (old->hash != new->hash || 142 old->type != new->type || old->pid != new->pid) 143 return false; 144 145 /* 146 * We want to merge many dirent events in the same dir (i.e. 147 * creates/unlinks/renames), but we do not want to merge dirent 148 * events referring to subdirs with dirent events referring to 149 * non subdirs, otherwise, user won't be able to tell from a 150 * mask FAN_CREATE|FAN_DELETE|FAN_ONDIR if it describes mkdir+ 151 * unlink pair or rmdir+create pair of events. 152 */ 153 if ((old->mask & FS_ISDIR) != (new->mask & FS_ISDIR)) 154 return false; 155 156 /* 157 * FAN_RENAME event is reported with special info record types, 158 * so we cannot merge it with other events. 159 */ 160 if ((old->mask & FAN_RENAME) != (new->mask & FAN_RENAME)) 161 return false; 162 163 switch (old->type) { 164 case FANOTIFY_EVENT_TYPE_PATH: 165 return fanotify_path_equal(fanotify_event_path(old), 166 fanotify_event_path(new)); 167 case FANOTIFY_EVENT_TYPE_FID: 168 return fanotify_fid_event_equal(FANOTIFY_FE(old), 169 FANOTIFY_FE(new)); 170 case FANOTIFY_EVENT_TYPE_FID_NAME: 171 return fanotify_name_event_equal(FANOTIFY_NE(old), 172 FANOTIFY_NE(new)); 173 case FANOTIFY_EVENT_TYPE_FS_ERROR: 174 return fanotify_error_event_equal(FANOTIFY_EE(old), 175 FANOTIFY_EE(new)); 176 default: 177 WARN_ON_ONCE(1); 178 } 179 180 return false; 181 } 182 183 /* Limit event merges to limit CPU overhead per event */ 184 #define FANOTIFY_MAX_MERGE_EVENTS 128 185 186 /* and the list better be locked by something too! */ 187 static int fanotify_merge(struct fsnotify_group *group, 188 struct fsnotify_event *event) 189 { 190 struct fanotify_event *old, *new = FANOTIFY_E(event); 191 unsigned int bucket = fanotify_event_hash_bucket(group, new); 192 struct hlist_head *hlist = &group->fanotify_data.merge_hash[bucket]; 193 int i = 0; 194 195 pr_debug("%s: group=%p event=%p bucket=%u\n", __func__, 196 group, event, bucket); 197 198 /* 199 * Don't merge a permission event with any other event so that we know 200 * the event structure we have created in fanotify_handle_event() is the 201 * one we should check for permission response. 202 */ 203 if (fanotify_is_perm_event(new->mask)) 204 return 0; 205 206 hlist_for_each_entry(old, hlist, merge_list) { 207 if (++i > FANOTIFY_MAX_MERGE_EVENTS) 208 break; 209 if (fanotify_should_merge(old, new)) { 210 old->mask |= new->mask; 211 212 if (fanotify_is_error_event(old->mask)) 213 FANOTIFY_EE(old)->err_count++; 214 215 return 1; 216 } 217 } 218 219 return 0; 220 } 221 222 /* 223 * Wait for response to permission event. The function also takes care of 224 * freeing the permission event (or offloads that in case the wait is canceled 225 * by a signal). The function returns 0 in case access got allowed by userspace, 226 * -EPERM in case userspace disallowed the access, and -ERESTARTSYS in case 227 * the wait got interrupted by a signal. 228 */ 229 static int fanotify_get_response(struct fsnotify_group *group, 230 struct fanotify_perm_event *event, 231 struct fsnotify_iter_info *iter_info) 232 { 233 int ret; 234 235 pr_debug("%s: group=%p event=%p\n", __func__, group, event); 236 237 ret = wait_event_killable(group->fanotify_data.access_waitq, 238 event->state == FAN_EVENT_ANSWERED); 239 /* Signal pending? */ 240 if (ret < 0) { 241 spin_lock(&group->notification_lock); 242 /* Event reported to userspace and no answer yet? */ 243 if (event->state == FAN_EVENT_REPORTED) { 244 /* Event will get freed once userspace answers to it */ 245 event->state = FAN_EVENT_CANCELED; 246 spin_unlock(&group->notification_lock); 247 return ret; 248 } 249 /* Event not yet reported? Just remove it. */ 250 if (event->state == FAN_EVENT_INIT) { 251 fsnotify_remove_queued_event(group, &event->fae.fse); 252 /* Permission events are not supposed to be hashed */ 253 WARN_ON_ONCE(!hlist_unhashed(&event->fae.merge_list)); 254 } 255 /* 256 * Event may be also answered in case signal delivery raced 257 * with wakeup. In that case we have nothing to do besides 258 * freeing the event and reporting error. 259 */ 260 spin_unlock(&group->notification_lock); 261 goto out; 262 } 263 264 /* userspace responded, convert to something usable */ 265 switch (event->response & ~FAN_AUDIT) { 266 case FAN_ALLOW: 267 ret = 0; 268 break; 269 case FAN_DENY: 270 default: 271 ret = -EPERM; 272 } 273 274 /* Check if the response should be audited */ 275 if (event->response & FAN_AUDIT) 276 audit_fanotify(event->response & ~FAN_AUDIT); 277 278 pr_debug("%s: group=%p event=%p about to return ret=%d\n", __func__, 279 group, event, ret); 280 out: 281 fsnotify_destroy_event(group, &event->fae.fse); 282 283 return ret; 284 } 285 286 /* 287 * This function returns a mask for an event that only contains the flags 288 * that have been specifically requested by the user. Flags that may have 289 * been included within the event mask, but have not been explicitly 290 * requested by the user, will not be present in the returned mask. 291 */ 292 static u32 fanotify_group_event_mask(struct fsnotify_group *group, 293 struct fsnotify_iter_info *iter_info, 294 u32 *match_mask, u32 event_mask, 295 const void *data, int data_type, 296 struct inode *dir) 297 { 298 __u32 marks_mask = 0, marks_ignore_mask = 0; 299 __u32 test_mask, user_mask = FANOTIFY_OUTGOING_EVENTS | 300 FANOTIFY_EVENT_FLAGS; 301 const struct path *path = fsnotify_data_path(data, data_type); 302 unsigned int fid_mode = FAN_GROUP_FLAG(group, FANOTIFY_FID_BITS); 303 struct fsnotify_mark *mark; 304 bool ondir = event_mask & FAN_ONDIR; 305 int type; 306 307 pr_debug("%s: report_mask=%x mask=%x data=%p data_type=%d\n", 308 __func__, iter_info->report_mask, event_mask, data, data_type); 309 310 if (!fid_mode) { 311 /* Do we have path to open a file descriptor? */ 312 if (!path) 313 return 0; 314 /* Path type events are only relevant for files and dirs */ 315 if (!d_is_reg(path->dentry) && !d_can_lookup(path->dentry)) 316 return 0; 317 } else if (!(fid_mode & FAN_REPORT_FID)) { 318 /* Do we have a directory inode to report? */ 319 if (!dir && !ondir) 320 return 0; 321 } 322 323 fsnotify_foreach_iter_mark_type(iter_info, mark, type) { 324 /* 325 * Apply ignore mask depending on event flags in ignore mask. 326 */ 327 marks_ignore_mask |= 328 fsnotify_effective_ignore_mask(mark, ondir, type); 329 330 /* 331 * Send the event depending on event flags in mark mask. 332 */ 333 if (!fsnotify_mask_applicable(mark->mask, ondir, type)) 334 continue; 335 336 marks_mask |= mark->mask; 337 338 /* Record the mark types of this group that matched the event */ 339 *match_mask |= 1U << type; 340 } 341 342 test_mask = event_mask & marks_mask & ~marks_ignore_mask; 343 344 /* 345 * For dirent modification events (create/delete/move) that do not carry 346 * the child entry name information, we report FAN_ONDIR for mkdir/rmdir 347 * so user can differentiate them from creat/unlink. 348 * 349 * For backward compatibility and consistency, do not report FAN_ONDIR 350 * to user in legacy fanotify mode (reporting fd) and report FAN_ONDIR 351 * to user in fid mode for all event types. 352 * 353 * We never report FAN_EVENT_ON_CHILD to user, but we do pass it in to 354 * fanotify_alloc_event() when group is reporting fid as indication 355 * that event happened on child. 356 */ 357 if (fid_mode) { 358 /* Do not report event flags without any event */ 359 if (!(test_mask & ~FANOTIFY_EVENT_FLAGS)) 360 return 0; 361 } else { 362 user_mask &= ~FANOTIFY_EVENT_FLAGS; 363 } 364 365 return test_mask & user_mask; 366 } 367 368 /* 369 * Check size needed to encode fanotify_fh. 370 * 371 * Return size of encoded fh without fanotify_fh header. 372 * Return 0 on failure to encode. 373 */ 374 static int fanotify_encode_fh_len(struct inode *inode) 375 { 376 int dwords = 0; 377 int fh_len; 378 379 if (!inode) 380 return 0; 381 382 exportfs_encode_inode_fh(inode, NULL, &dwords, NULL); 383 fh_len = dwords << 2; 384 385 /* 386 * struct fanotify_error_event might be preallocated and is 387 * limited to MAX_HANDLE_SZ. This should never happen, but 388 * safeguard by forcing an invalid file handle. 389 */ 390 if (WARN_ON_ONCE(fh_len > MAX_HANDLE_SZ)) 391 return 0; 392 393 return fh_len; 394 } 395 396 /* 397 * Encode fanotify_fh. 398 * 399 * Return total size of encoded fh including fanotify_fh header. 400 * Return 0 on failure to encode. 401 */ 402 static int fanotify_encode_fh(struct fanotify_fh *fh, struct inode *inode, 403 unsigned int fh_len, unsigned int *hash, 404 gfp_t gfp) 405 { 406 int dwords, type = 0; 407 char *ext_buf = NULL; 408 void *buf = fh->buf; 409 int err; 410 411 fh->type = FILEID_ROOT; 412 fh->len = 0; 413 fh->flags = 0; 414 415 /* 416 * Invalid FHs are used by FAN_FS_ERROR for errors not 417 * linked to any inode. The f_handle won't be reported 418 * back to userspace. 419 */ 420 if (!inode) 421 goto out; 422 423 /* 424 * !gpf means preallocated variable size fh, but fh_len could 425 * be zero in that case if encoding fh len failed. 426 */ 427 err = -ENOENT; 428 if (fh_len < 4 || WARN_ON_ONCE(fh_len % 4) || fh_len > MAX_HANDLE_SZ) 429 goto out_err; 430 431 /* No external buffer in a variable size allocated fh */ 432 if (gfp && fh_len > FANOTIFY_INLINE_FH_LEN) { 433 /* Treat failure to allocate fh as failure to encode fh */ 434 err = -ENOMEM; 435 ext_buf = kmalloc(fh_len, gfp); 436 if (!ext_buf) 437 goto out_err; 438 439 *fanotify_fh_ext_buf_ptr(fh) = ext_buf; 440 buf = ext_buf; 441 fh->flags |= FANOTIFY_FH_FLAG_EXT_BUF; 442 } 443 444 dwords = fh_len >> 2; 445 type = exportfs_encode_inode_fh(inode, buf, &dwords, NULL); 446 err = -EINVAL; 447 if (!type || type == FILEID_INVALID || fh_len != dwords << 2) 448 goto out_err; 449 450 fh->type = type; 451 fh->len = fh_len; 452 453 out: 454 /* 455 * Mix fh into event merge key. Hash might be NULL in case of 456 * unhashed FID events (i.e. FAN_FS_ERROR). 457 */ 458 if (hash) 459 *hash ^= fanotify_hash_fh(fh); 460 461 return FANOTIFY_FH_HDR_LEN + fh_len; 462 463 out_err: 464 pr_warn_ratelimited("fanotify: failed to encode fid (type=%d, len=%d, err=%i)\n", 465 type, fh_len, err); 466 kfree(ext_buf); 467 *fanotify_fh_ext_buf_ptr(fh) = NULL; 468 /* Report the event without a file identifier on encode error */ 469 fh->type = FILEID_INVALID; 470 fh->len = 0; 471 return 0; 472 } 473 474 /* 475 * FAN_REPORT_FID is ambiguous in that it reports the fid of the child for 476 * some events and the fid of the parent for create/delete/move events. 477 * 478 * With the FAN_REPORT_TARGET_FID flag, the fid of the child is reported 479 * also in create/delete/move events in addition to the fid of the parent 480 * and the name of the child. 481 */ 482 static inline bool fanotify_report_child_fid(unsigned int fid_mode, u32 mask) 483 { 484 if (mask & ALL_FSNOTIFY_DIRENT_EVENTS) 485 return (fid_mode & FAN_REPORT_TARGET_FID); 486 487 return (fid_mode & FAN_REPORT_FID) && !(mask & FAN_ONDIR); 488 } 489 490 /* 491 * The inode to use as identifier when reporting fid depends on the event 492 * and the group flags. 493 * 494 * With the group flag FAN_REPORT_TARGET_FID, always report the child fid. 495 * 496 * Without the group flag FAN_REPORT_TARGET_FID, report the modified directory 497 * fid on dirent events and the child fid otherwise. 498 * 499 * For example: 500 * FS_ATTRIB reports the child fid even if reported on a watched parent. 501 * FS_CREATE reports the modified dir fid without FAN_REPORT_TARGET_FID. 502 * and reports the created child fid with FAN_REPORT_TARGET_FID. 503 */ 504 static struct inode *fanotify_fid_inode(u32 event_mask, const void *data, 505 int data_type, struct inode *dir, 506 unsigned int fid_mode) 507 { 508 if ((event_mask & ALL_FSNOTIFY_DIRENT_EVENTS) && 509 !(fid_mode & FAN_REPORT_TARGET_FID)) 510 return dir; 511 512 return fsnotify_data_inode(data, data_type); 513 } 514 515 /* 516 * The inode to use as identifier when reporting dir fid depends on the event. 517 * Report the modified directory inode on dirent modification events. 518 * Report the "victim" inode if "victim" is a directory. 519 * Report the parent inode if "victim" is not a directory and event is 520 * reported to parent. 521 * Otherwise, do not report dir fid. 522 */ 523 static struct inode *fanotify_dfid_inode(u32 event_mask, const void *data, 524 int data_type, struct inode *dir) 525 { 526 struct inode *inode = fsnotify_data_inode(data, data_type); 527 528 if (event_mask & ALL_FSNOTIFY_DIRENT_EVENTS) 529 return dir; 530 531 if (inode && S_ISDIR(inode->i_mode)) 532 return inode; 533 534 return dir; 535 } 536 537 static struct fanotify_event *fanotify_alloc_path_event(const struct path *path, 538 unsigned int *hash, 539 gfp_t gfp) 540 { 541 struct fanotify_path_event *pevent; 542 543 pevent = kmem_cache_alloc(fanotify_path_event_cachep, gfp); 544 if (!pevent) 545 return NULL; 546 547 pevent->fae.type = FANOTIFY_EVENT_TYPE_PATH; 548 pevent->path = *path; 549 *hash ^= fanotify_hash_path(path); 550 path_get(path); 551 552 return &pevent->fae; 553 } 554 555 static struct fanotify_event *fanotify_alloc_perm_event(const struct path *path, 556 gfp_t gfp) 557 { 558 struct fanotify_perm_event *pevent; 559 560 pevent = kmem_cache_alloc(fanotify_perm_event_cachep, gfp); 561 if (!pevent) 562 return NULL; 563 564 pevent->fae.type = FANOTIFY_EVENT_TYPE_PATH_PERM; 565 pevent->response = 0; 566 pevent->state = FAN_EVENT_INIT; 567 pevent->path = *path; 568 path_get(path); 569 570 return &pevent->fae; 571 } 572 573 static struct fanotify_event *fanotify_alloc_fid_event(struct inode *id, 574 __kernel_fsid_t *fsid, 575 unsigned int *hash, 576 gfp_t gfp) 577 { 578 struct fanotify_fid_event *ffe; 579 580 ffe = kmem_cache_alloc(fanotify_fid_event_cachep, gfp); 581 if (!ffe) 582 return NULL; 583 584 ffe->fae.type = FANOTIFY_EVENT_TYPE_FID; 585 ffe->fsid = *fsid; 586 *hash ^= fanotify_hash_fsid(fsid); 587 fanotify_encode_fh(&ffe->object_fh, id, fanotify_encode_fh_len(id), 588 hash, gfp); 589 590 return &ffe->fae; 591 } 592 593 static struct fanotify_event *fanotify_alloc_name_event(struct inode *dir, 594 __kernel_fsid_t *fsid, 595 const struct qstr *name, 596 struct inode *child, 597 struct dentry *moved, 598 unsigned int *hash, 599 gfp_t gfp) 600 { 601 struct fanotify_name_event *fne; 602 struct fanotify_info *info; 603 struct fanotify_fh *dfh, *ffh; 604 struct inode *dir2 = moved ? d_inode(moved->d_parent) : NULL; 605 const struct qstr *name2 = moved ? &moved->d_name : NULL; 606 unsigned int dir_fh_len = fanotify_encode_fh_len(dir); 607 unsigned int dir2_fh_len = fanotify_encode_fh_len(dir2); 608 unsigned int child_fh_len = fanotify_encode_fh_len(child); 609 unsigned long name_len = name ? name->len : 0; 610 unsigned long name2_len = name2 ? name2->len : 0; 611 unsigned int len, size; 612 613 /* Reserve terminating null byte even for empty name */ 614 size = sizeof(*fne) + name_len + name2_len + 2; 615 if (dir_fh_len) 616 size += FANOTIFY_FH_HDR_LEN + dir_fh_len; 617 if (dir2_fh_len) 618 size += FANOTIFY_FH_HDR_LEN + dir2_fh_len; 619 if (child_fh_len) 620 size += FANOTIFY_FH_HDR_LEN + child_fh_len; 621 fne = kmalloc(size, gfp); 622 if (!fne) 623 return NULL; 624 625 fne->fae.type = FANOTIFY_EVENT_TYPE_FID_NAME; 626 fne->fsid = *fsid; 627 *hash ^= fanotify_hash_fsid(fsid); 628 info = &fne->info; 629 fanotify_info_init(info); 630 if (dir_fh_len) { 631 dfh = fanotify_info_dir_fh(info); 632 len = fanotify_encode_fh(dfh, dir, dir_fh_len, hash, 0); 633 fanotify_info_set_dir_fh(info, len); 634 } 635 if (dir2_fh_len) { 636 dfh = fanotify_info_dir2_fh(info); 637 len = fanotify_encode_fh(dfh, dir2, dir2_fh_len, hash, 0); 638 fanotify_info_set_dir2_fh(info, len); 639 } 640 if (child_fh_len) { 641 ffh = fanotify_info_file_fh(info); 642 len = fanotify_encode_fh(ffh, child, child_fh_len, hash, 0); 643 fanotify_info_set_file_fh(info, len); 644 } 645 if (name_len) { 646 fanotify_info_copy_name(info, name); 647 *hash ^= full_name_hash((void *)name_len, name->name, name_len); 648 } 649 if (name2_len) { 650 fanotify_info_copy_name2(info, name2); 651 *hash ^= full_name_hash((void *)name2_len, name2->name, 652 name2_len); 653 } 654 655 pr_debug("%s: size=%u dir_fh_len=%u child_fh_len=%u name_len=%u name='%.*s'\n", 656 __func__, size, dir_fh_len, child_fh_len, 657 info->name_len, info->name_len, fanotify_info_name(info)); 658 659 if (dir2_fh_len) { 660 pr_debug("%s: dir2_fh_len=%u name2_len=%u name2='%.*s'\n", 661 __func__, dir2_fh_len, info->name2_len, 662 info->name2_len, fanotify_info_name2(info)); 663 } 664 665 return &fne->fae; 666 } 667 668 static struct fanotify_event *fanotify_alloc_error_event( 669 struct fsnotify_group *group, 670 __kernel_fsid_t *fsid, 671 const void *data, int data_type, 672 unsigned int *hash) 673 { 674 struct fs_error_report *report = 675 fsnotify_data_error_report(data, data_type); 676 struct inode *inode; 677 struct fanotify_error_event *fee; 678 int fh_len; 679 680 if (WARN_ON_ONCE(!report)) 681 return NULL; 682 683 fee = mempool_alloc(&group->fanotify_data.error_events_pool, GFP_NOFS); 684 if (!fee) 685 return NULL; 686 687 fee->fae.type = FANOTIFY_EVENT_TYPE_FS_ERROR; 688 fee->error = report->error; 689 fee->err_count = 1; 690 fee->fsid = *fsid; 691 692 inode = report->inode; 693 fh_len = fanotify_encode_fh_len(inode); 694 695 /* Bad fh_len. Fallback to using an invalid fh. Should never happen. */ 696 if (!fh_len && inode) 697 inode = NULL; 698 699 fanotify_encode_fh(&fee->object_fh, inode, fh_len, NULL, 0); 700 701 *hash ^= fanotify_hash_fsid(fsid); 702 703 return &fee->fae; 704 } 705 706 static struct fanotify_event *fanotify_alloc_event( 707 struct fsnotify_group *group, 708 u32 mask, const void *data, int data_type, 709 struct inode *dir, const struct qstr *file_name, 710 __kernel_fsid_t *fsid, u32 match_mask) 711 { 712 struct fanotify_event *event = NULL; 713 gfp_t gfp = GFP_KERNEL_ACCOUNT; 714 unsigned int fid_mode = FAN_GROUP_FLAG(group, FANOTIFY_FID_BITS); 715 struct inode *id = fanotify_fid_inode(mask, data, data_type, dir, 716 fid_mode); 717 struct inode *dirid = fanotify_dfid_inode(mask, data, data_type, dir); 718 const struct path *path = fsnotify_data_path(data, data_type); 719 struct mem_cgroup *old_memcg; 720 struct dentry *moved = NULL; 721 struct inode *child = NULL; 722 bool name_event = false; 723 unsigned int hash = 0; 724 bool ondir = mask & FAN_ONDIR; 725 struct pid *pid; 726 727 if ((fid_mode & FAN_REPORT_DIR_FID) && dirid) { 728 /* 729 * For certain events and group flags, report the child fid 730 * in addition to reporting the parent fid and maybe child name. 731 */ 732 if (fanotify_report_child_fid(fid_mode, mask) && id != dirid) 733 child = id; 734 735 id = dirid; 736 737 /* 738 * We record file name only in a group with FAN_REPORT_NAME 739 * and when we have a directory inode to report. 740 * 741 * For directory entry modification event, we record the fid of 742 * the directory and the name of the modified entry. 743 * 744 * For event on non-directory that is reported to parent, we 745 * record the fid of the parent and the name of the child. 746 * 747 * Even if not reporting name, we need a variable length 748 * fanotify_name_event if reporting both parent and child fids. 749 */ 750 if (!(fid_mode & FAN_REPORT_NAME)) { 751 name_event = !!child; 752 file_name = NULL; 753 } else if ((mask & ALL_FSNOTIFY_DIRENT_EVENTS) || !ondir) { 754 name_event = true; 755 } 756 757 /* 758 * In the special case of FAN_RENAME event, use the match_mask 759 * to determine if we need to report only the old parent+name, 760 * only the new parent+name or both. 761 * 'dirid' and 'file_name' are the old parent+name and 762 * 'moved' has the new parent+name. 763 */ 764 if (mask & FAN_RENAME) { 765 bool report_old, report_new; 766 767 if (WARN_ON_ONCE(!match_mask)) 768 return NULL; 769 770 /* Report both old and new parent+name if sb watching */ 771 report_old = report_new = 772 match_mask & (1U << FSNOTIFY_ITER_TYPE_SB); 773 report_old |= 774 match_mask & (1U << FSNOTIFY_ITER_TYPE_INODE); 775 report_new |= 776 match_mask & (1U << FSNOTIFY_ITER_TYPE_INODE2); 777 778 if (!report_old) { 779 /* Do not report old parent+name */ 780 dirid = NULL; 781 file_name = NULL; 782 } 783 if (report_new) { 784 /* Report new parent+name */ 785 moved = fsnotify_data_dentry(data, data_type); 786 } 787 } 788 } 789 790 /* 791 * For queues with unlimited length lost events are not expected and 792 * can possibly have security implications. Avoid losing events when 793 * memory is short. For the limited size queues, avoid OOM killer in the 794 * target monitoring memcg as it may have security repercussion. 795 */ 796 if (group->max_events == UINT_MAX) 797 gfp |= __GFP_NOFAIL; 798 else 799 gfp |= __GFP_RETRY_MAYFAIL; 800 801 /* Whoever is interested in the event, pays for the allocation. */ 802 old_memcg = set_active_memcg(group->memcg); 803 804 if (fanotify_is_perm_event(mask)) { 805 event = fanotify_alloc_perm_event(path, gfp); 806 } else if (fanotify_is_error_event(mask)) { 807 event = fanotify_alloc_error_event(group, fsid, data, 808 data_type, &hash); 809 } else if (name_event && (file_name || moved || child)) { 810 event = fanotify_alloc_name_event(dirid, fsid, file_name, child, 811 moved, &hash, gfp); 812 } else if (fid_mode) { 813 event = fanotify_alloc_fid_event(id, fsid, &hash, gfp); 814 } else { 815 event = fanotify_alloc_path_event(path, &hash, gfp); 816 } 817 818 if (!event) 819 goto out; 820 821 if (FAN_GROUP_FLAG(group, FAN_REPORT_TID)) 822 pid = get_pid(task_pid(current)); 823 else 824 pid = get_pid(task_tgid(current)); 825 826 /* Mix event info, FAN_ONDIR flag and pid into event merge key */ 827 hash ^= hash_long((unsigned long)pid | ondir, FANOTIFY_EVENT_HASH_BITS); 828 fanotify_init_event(event, hash, mask); 829 event->pid = pid; 830 831 out: 832 set_active_memcg(old_memcg); 833 return event; 834 } 835 836 /* 837 * Get cached fsid of the filesystem containing the object from any connector. 838 * All connectors are supposed to have the same fsid, but we do not verify that 839 * here. 840 */ 841 static __kernel_fsid_t fanotify_get_fsid(struct fsnotify_iter_info *iter_info) 842 { 843 struct fsnotify_mark *mark; 844 int type; 845 __kernel_fsid_t fsid = {}; 846 847 fsnotify_foreach_iter_mark_type(iter_info, mark, type) { 848 struct fsnotify_mark_connector *conn; 849 850 conn = READ_ONCE(mark->connector); 851 /* Mark is just getting destroyed or created? */ 852 if (!conn) 853 continue; 854 if (!(conn->flags & FSNOTIFY_CONN_FLAG_HAS_FSID)) 855 continue; 856 /* Pairs with smp_wmb() in fsnotify_add_mark_list() */ 857 smp_rmb(); 858 fsid = conn->fsid; 859 if (WARN_ON_ONCE(!fsid.val[0] && !fsid.val[1])) 860 continue; 861 return fsid; 862 } 863 864 return fsid; 865 } 866 867 /* 868 * Add an event to hash table for faster merge. 869 */ 870 static void fanotify_insert_event(struct fsnotify_group *group, 871 struct fsnotify_event *fsn_event) 872 { 873 struct fanotify_event *event = FANOTIFY_E(fsn_event); 874 unsigned int bucket = fanotify_event_hash_bucket(group, event); 875 struct hlist_head *hlist = &group->fanotify_data.merge_hash[bucket]; 876 877 assert_spin_locked(&group->notification_lock); 878 879 if (!fanotify_is_hashed_event(event->mask)) 880 return; 881 882 pr_debug("%s: group=%p event=%p bucket=%u\n", __func__, 883 group, event, bucket); 884 885 hlist_add_head(&event->merge_list, hlist); 886 } 887 888 static int fanotify_handle_event(struct fsnotify_group *group, u32 mask, 889 const void *data, int data_type, 890 struct inode *dir, 891 const struct qstr *file_name, u32 cookie, 892 struct fsnotify_iter_info *iter_info) 893 { 894 int ret = 0; 895 struct fanotify_event *event; 896 struct fsnotify_event *fsn_event; 897 __kernel_fsid_t fsid = {}; 898 u32 match_mask = 0; 899 900 BUILD_BUG_ON(FAN_ACCESS != FS_ACCESS); 901 BUILD_BUG_ON(FAN_MODIFY != FS_MODIFY); 902 BUILD_BUG_ON(FAN_ATTRIB != FS_ATTRIB); 903 BUILD_BUG_ON(FAN_CLOSE_NOWRITE != FS_CLOSE_NOWRITE); 904 BUILD_BUG_ON(FAN_CLOSE_WRITE != FS_CLOSE_WRITE); 905 BUILD_BUG_ON(FAN_OPEN != FS_OPEN); 906 BUILD_BUG_ON(FAN_MOVED_TO != FS_MOVED_TO); 907 BUILD_BUG_ON(FAN_MOVED_FROM != FS_MOVED_FROM); 908 BUILD_BUG_ON(FAN_CREATE != FS_CREATE); 909 BUILD_BUG_ON(FAN_DELETE != FS_DELETE); 910 BUILD_BUG_ON(FAN_DELETE_SELF != FS_DELETE_SELF); 911 BUILD_BUG_ON(FAN_MOVE_SELF != FS_MOVE_SELF); 912 BUILD_BUG_ON(FAN_EVENT_ON_CHILD != FS_EVENT_ON_CHILD); 913 BUILD_BUG_ON(FAN_Q_OVERFLOW != FS_Q_OVERFLOW); 914 BUILD_BUG_ON(FAN_OPEN_PERM != FS_OPEN_PERM); 915 BUILD_BUG_ON(FAN_ACCESS_PERM != FS_ACCESS_PERM); 916 BUILD_BUG_ON(FAN_ONDIR != FS_ISDIR); 917 BUILD_BUG_ON(FAN_OPEN_EXEC != FS_OPEN_EXEC); 918 BUILD_BUG_ON(FAN_OPEN_EXEC_PERM != FS_OPEN_EXEC_PERM); 919 BUILD_BUG_ON(FAN_FS_ERROR != FS_ERROR); 920 BUILD_BUG_ON(FAN_RENAME != FS_RENAME); 921 922 BUILD_BUG_ON(HWEIGHT32(ALL_FANOTIFY_EVENT_BITS) != 21); 923 924 mask = fanotify_group_event_mask(group, iter_info, &match_mask, 925 mask, data, data_type, dir); 926 if (!mask) 927 return 0; 928 929 pr_debug("%s: group=%p mask=%x report_mask=%x\n", __func__, 930 group, mask, match_mask); 931 932 if (fanotify_is_perm_event(mask)) { 933 /* 934 * fsnotify_prepare_user_wait() fails if we race with mark 935 * deletion. Just let the operation pass in that case. 936 */ 937 if (!fsnotify_prepare_user_wait(iter_info)) 938 return 0; 939 } 940 941 if (FAN_GROUP_FLAG(group, FANOTIFY_FID_BITS)) { 942 fsid = fanotify_get_fsid(iter_info); 943 /* Racing with mark destruction or creation? */ 944 if (!fsid.val[0] && !fsid.val[1]) 945 return 0; 946 } 947 948 event = fanotify_alloc_event(group, mask, data, data_type, dir, 949 file_name, &fsid, match_mask); 950 ret = -ENOMEM; 951 if (unlikely(!event)) { 952 /* 953 * We don't queue overflow events for permission events as 954 * there the access is denied and so no event is in fact lost. 955 */ 956 if (!fanotify_is_perm_event(mask)) 957 fsnotify_queue_overflow(group); 958 goto finish; 959 } 960 961 fsn_event = &event->fse; 962 ret = fsnotify_insert_event(group, fsn_event, fanotify_merge, 963 fanotify_insert_event); 964 if (ret) { 965 /* Permission events shouldn't be merged */ 966 BUG_ON(ret == 1 && mask & FANOTIFY_PERM_EVENTS); 967 /* Our event wasn't used in the end. Free it. */ 968 fsnotify_destroy_event(group, fsn_event); 969 970 ret = 0; 971 } else if (fanotify_is_perm_event(mask)) { 972 ret = fanotify_get_response(group, FANOTIFY_PERM(event), 973 iter_info); 974 } 975 finish: 976 if (fanotify_is_perm_event(mask)) 977 fsnotify_finish_user_wait(iter_info); 978 979 return ret; 980 } 981 982 static void fanotify_free_group_priv(struct fsnotify_group *group) 983 { 984 kfree(group->fanotify_data.merge_hash); 985 if (group->fanotify_data.ucounts) 986 dec_ucount(group->fanotify_data.ucounts, 987 UCOUNT_FANOTIFY_GROUPS); 988 989 if (mempool_initialized(&group->fanotify_data.error_events_pool)) 990 mempool_exit(&group->fanotify_data.error_events_pool); 991 } 992 993 static void fanotify_free_path_event(struct fanotify_event *event) 994 { 995 path_put(fanotify_event_path(event)); 996 kmem_cache_free(fanotify_path_event_cachep, FANOTIFY_PE(event)); 997 } 998 999 static void fanotify_free_perm_event(struct fanotify_event *event) 1000 { 1001 path_put(fanotify_event_path(event)); 1002 kmem_cache_free(fanotify_perm_event_cachep, FANOTIFY_PERM(event)); 1003 } 1004 1005 static void fanotify_free_fid_event(struct fanotify_event *event) 1006 { 1007 struct fanotify_fid_event *ffe = FANOTIFY_FE(event); 1008 1009 if (fanotify_fh_has_ext_buf(&ffe->object_fh)) 1010 kfree(fanotify_fh_ext_buf(&ffe->object_fh)); 1011 kmem_cache_free(fanotify_fid_event_cachep, ffe); 1012 } 1013 1014 static void fanotify_free_name_event(struct fanotify_event *event) 1015 { 1016 kfree(FANOTIFY_NE(event)); 1017 } 1018 1019 static void fanotify_free_error_event(struct fsnotify_group *group, 1020 struct fanotify_event *event) 1021 { 1022 struct fanotify_error_event *fee = FANOTIFY_EE(event); 1023 1024 mempool_free(fee, &group->fanotify_data.error_events_pool); 1025 } 1026 1027 static void fanotify_free_event(struct fsnotify_group *group, 1028 struct fsnotify_event *fsn_event) 1029 { 1030 struct fanotify_event *event; 1031 1032 event = FANOTIFY_E(fsn_event); 1033 put_pid(event->pid); 1034 switch (event->type) { 1035 case FANOTIFY_EVENT_TYPE_PATH: 1036 fanotify_free_path_event(event); 1037 break; 1038 case FANOTIFY_EVENT_TYPE_PATH_PERM: 1039 fanotify_free_perm_event(event); 1040 break; 1041 case FANOTIFY_EVENT_TYPE_FID: 1042 fanotify_free_fid_event(event); 1043 break; 1044 case FANOTIFY_EVENT_TYPE_FID_NAME: 1045 fanotify_free_name_event(event); 1046 break; 1047 case FANOTIFY_EVENT_TYPE_OVERFLOW: 1048 kfree(event); 1049 break; 1050 case FANOTIFY_EVENT_TYPE_FS_ERROR: 1051 fanotify_free_error_event(group, event); 1052 break; 1053 default: 1054 WARN_ON_ONCE(1); 1055 } 1056 } 1057 1058 static void fanotify_freeing_mark(struct fsnotify_mark *mark, 1059 struct fsnotify_group *group) 1060 { 1061 if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS)) 1062 dec_ucount(group->fanotify_data.ucounts, UCOUNT_FANOTIFY_MARKS); 1063 } 1064 1065 static void fanotify_free_mark(struct fsnotify_mark *fsn_mark) 1066 { 1067 kmem_cache_free(fanotify_mark_cache, fsn_mark); 1068 } 1069 1070 const struct fsnotify_ops fanotify_fsnotify_ops = { 1071 .handle_event = fanotify_handle_event, 1072 .free_group_priv = fanotify_free_group_priv, 1073 .free_event = fanotify_free_event, 1074 .freeing_mark = fanotify_freeing_mark, 1075 .free_mark = fanotify_free_mark, 1076 }; 1077