xref: /linux/fs/open.c (revision 86f5536004a61a0c797c14a248fc976f03f55cd5)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  linux/fs/open.c
4  *
5  *  Copyright (C) 1991, 1992  Linus Torvalds
6  */
7 
8 #include <linux/string.h>
9 #include <linux/mm.h>
10 #include <linux/file.h>
11 #include <linux/fdtable.h>
12 #include <linux/fsnotify.h>
13 #include <linux/module.h>
14 #include <linux/tty.h>
15 #include <linux/namei.h>
16 #include <linux/backing-dev.h>
17 #include <linux/capability.h>
18 #include <linux/securebits.h>
19 #include <linux/security.h>
20 #include <linux/mount.h>
21 #include <linux/fcntl.h>
22 #include <linux/slab.h>
23 #include <linux/uaccess.h>
24 #include <linux/fs.h>
25 #include <linux/personality.h>
26 #include <linux/pagemap.h>
27 #include <linux/syscalls.h>
28 #include <linux/rcupdate.h>
29 #include <linux/audit.h>
30 #include <linux/falloc.h>
31 #include <linux/fs_struct.h>
32 #include <linux/dnotify.h>
33 #include <linux/compat.h>
34 #include <linux/mnt_idmapping.h>
35 #include <linux/filelock.h>
36 
37 #include "internal.h"
38 
39 int do_truncate(struct mnt_idmap *idmap, struct dentry *dentry,
40 		loff_t length, unsigned int time_attrs, struct file *filp)
41 {
42 	int ret;
43 	struct iattr newattrs;
44 
45 	/* Not pretty: "inode->i_size" shouldn't really be signed. But it is. */
46 	if (length < 0)
47 		return -EINVAL;
48 
49 	newattrs.ia_size = length;
50 	newattrs.ia_valid = ATTR_SIZE | time_attrs;
51 	if (filp) {
52 		newattrs.ia_file = filp;
53 		newattrs.ia_valid |= ATTR_FILE;
54 	}
55 
56 	/* Remove suid, sgid, and file capabilities on truncate too */
57 	ret = dentry_needs_remove_privs(idmap, dentry);
58 	if (ret < 0)
59 		return ret;
60 	if (ret)
61 		newattrs.ia_valid |= ret | ATTR_FORCE;
62 
63 	inode_lock(dentry->d_inode);
64 	/* Note any delegations or leases have already been broken: */
65 	ret = notify_change(idmap, dentry, &newattrs, NULL);
66 	inode_unlock(dentry->d_inode);
67 	return ret;
68 }
69 
70 long vfs_truncate(const struct path *path, loff_t length)
71 {
72 	struct mnt_idmap *idmap;
73 	struct inode *inode;
74 	long error;
75 
76 	inode = path->dentry->d_inode;
77 
78 	/* For directories it's -EISDIR, for other non-regulars - -EINVAL */
79 	if (S_ISDIR(inode->i_mode))
80 		return -EISDIR;
81 	if (!S_ISREG(inode->i_mode))
82 		return -EINVAL;
83 
84 	idmap = mnt_idmap(path->mnt);
85 	error = inode_permission(idmap, inode, MAY_WRITE);
86 	if (error)
87 		return error;
88 
89 	error = fsnotify_truncate_perm(path, length);
90 	if (error)
91 		return error;
92 
93 	error = mnt_want_write(path->mnt);
94 	if (error)
95 		return error;
96 
97 	error = -EPERM;
98 	if (IS_APPEND(inode))
99 		goto mnt_drop_write_and_out;
100 
101 	error = get_write_access(inode);
102 	if (error)
103 		goto mnt_drop_write_and_out;
104 
105 	/*
106 	 * Make sure that there are no leases.  get_write_access() protects
107 	 * against the truncate racing with a lease-granting setlease().
108 	 */
109 	error = break_lease(inode, O_WRONLY);
110 	if (error)
111 		goto put_write_and_out;
112 
113 	error = security_path_truncate(path);
114 	if (!error)
115 		error = do_truncate(idmap, path->dentry, length, 0, NULL);
116 
117 put_write_and_out:
118 	put_write_access(inode);
119 mnt_drop_write_and_out:
120 	mnt_drop_write(path->mnt);
121 
122 	return error;
123 }
124 EXPORT_SYMBOL_GPL(vfs_truncate);
125 
126 long do_sys_truncate(const char __user *pathname, loff_t length)
127 {
128 	unsigned int lookup_flags = LOOKUP_FOLLOW;
129 	struct path path;
130 	int error;
131 
132 	if (length < 0)	/* sorry, but loff_t says... */
133 		return -EINVAL;
134 
135 retry:
136 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
137 	if (!error) {
138 		error = vfs_truncate(&path, length);
139 		path_put(&path);
140 	}
141 	if (retry_estale(error, lookup_flags)) {
142 		lookup_flags |= LOOKUP_REVAL;
143 		goto retry;
144 	}
145 	return error;
146 }
147 
148 SYSCALL_DEFINE2(truncate, const char __user *, path, long, length)
149 {
150 	return do_sys_truncate(path, length);
151 }
152 
153 #ifdef CONFIG_COMPAT
154 COMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path, compat_off_t, length)
155 {
156 	return do_sys_truncate(path, length);
157 }
158 #endif
159 
160 long do_ftruncate(struct file *file, loff_t length, int small)
161 {
162 	struct inode *inode;
163 	struct dentry *dentry;
164 	int error;
165 
166 	/* explicitly opened as large or we are on 64-bit box */
167 	if (file->f_flags & O_LARGEFILE)
168 		small = 0;
169 
170 	dentry = file->f_path.dentry;
171 	inode = dentry->d_inode;
172 	if (!S_ISREG(inode->i_mode) || !(file->f_mode & FMODE_WRITE))
173 		return -EINVAL;
174 
175 	/* Cannot ftruncate over 2^31 bytes without large file support */
176 	if (small && length > MAX_NON_LFS)
177 		return -EINVAL;
178 
179 	/* Check IS_APPEND on real upper inode */
180 	if (IS_APPEND(file_inode(file)))
181 		return -EPERM;
182 
183 	error = security_file_truncate(file);
184 	if (error)
185 		return error;
186 
187 	error = fsnotify_truncate_perm(&file->f_path, length);
188 	if (error)
189 		return error;
190 
191 	sb_start_write(inode->i_sb);
192 	error = do_truncate(file_mnt_idmap(file), dentry, length,
193 			    ATTR_MTIME | ATTR_CTIME, file);
194 	sb_end_write(inode->i_sb);
195 
196 	return error;
197 }
198 
199 long do_sys_ftruncate(unsigned int fd, loff_t length, int small)
200 {
201 	if (length < 0)
202 		return -EINVAL;
203 	CLASS(fd, f)(fd);
204 	if (fd_empty(f))
205 		return -EBADF;
206 
207 	return do_ftruncate(fd_file(f), length, small);
208 }
209 
210 SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length)
211 {
212 	return do_sys_ftruncate(fd, length, 1);
213 }
214 
215 #ifdef CONFIG_COMPAT
216 COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length)
217 {
218 	return do_sys_ftruncate(fd, length, 1);
219 }
220 #endif
221 
222 /* LFS versions of truncate are only needed on 32 bit machines */
223 #if BITS_PER_LONG == 32
224 SYSCALL_DEFINE2(truncate64, const char __user *, path, loff_t, length)
225 {
226 	return do_sys_truncate(path, length);
227 }
228 
229 SYSCALL_DEFINE2(ftruncate64, unsigned int, fd, loff_t, length)
230 {
231 	return do_sys_ftruncate(fd, length, 0);
232 }
233 #endif /* BITS_PER_LONG == 32 */
234 
235 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_TRUNCATE64)
236 COMPAT_SYSCALL_DEFINE3(truncate64, const char __user *, pathname,
237 		       compat_arg_u64_dual(length))
238 {
239 	return ksys_truncate(pathname, compat_arg_u64_glue(length));
240 }
241 #endif
242 
243 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FTRUNCATE64)
244 COMPAT_SYSCALL_DEFINE3(ftruncate64, unsigned int, fd,
245 		       compat_arg_u64_dual(length))
246 {
247 	return ksys_ftruncate(fd, compat_arg_u64_glue(length));
248 }
249 #endif
250 
251 int vfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
252 {
253 	struct inode *inode = file_inode(file);
254 	long ret;
255 	loff_t sum;
256 
257 	if (offset < 0 || len <= 0)
258 		return -EINVAL;
259 
260 	if (mode & ~(FALLOC_FL_MODE_MASK | FALLOC_FL_KEEP_SIZE))
261 		return -EOPNOTSUPP;
262 
263 	/*
264 	 * Modes are exclusive, even if that is not obvious from the encoding
265 	 * as bit masks and the mix with the flag in the same namespace.
266 	 *
267 	 * To make things even more complicated, FALLOC_FL_ALLOCATE_RANGE is
268 	 * encoded as no bit set.
269 	 */
270 	switch (mode & FALLOC_FL_MODE_MASK) {
271 	case FALLOC_FL_ALLOCATE_RANGE:
272 	case FALLOC_FL_UNSHARE_RANGE:
273 	case FALLOC_FL_ZERO_RANGE:
274 		break;
275 	case FALLOC_FL_PUNCH_HOLE:
276 		if (!(mode & FALLOC_FL_KEEP_SIZE))
277 			return -EOPNOTSUPP;
278 		break;
279 	case FALLOC_FL_COLLAPSE_RANGE:
280 	case FALLOC_FL_INSERT_RANGE:
281 		if (mode & FALLOC_FL_KEEP_SIZE)
282 			return -EOPNOTSUPP;
283 		break;
284 	default:
285 		return -EOPNOTSUPP;
286 	}
287 
288 	if (!(file->f_mode & FMODE_WRITE))
289 		return -EBADF;
290 
291 	/*
292 	 * On append-only files only space preallocation is supported.
293 	 */
294 	if ((mode & ~FALLOC_FL_KEEP_SIZE) && IS_APPEND(inode))
295 		return -EPERM;
296 
297 	if (IS_IMMUTABLE(inode))
298 		return -EPERM;
299 
300 	/*
301 	 * We cannot allow any fallocate operation on an active swapfile
302 	 */
303 	if (IS_SWAPFILE(inode))
304 		return -ETXTBSY;
305 
306 	/*
307 	 * Revalidate the write permissions, in case security policy has
308 	 * changed since the files were opened.
309 	 */
310 	ret = security_file_permission(file, MAY_WRITE);
311 	if (ret)
312 		return ret;
313 
314 	ret = fsnotify_file_area_perm(file, MAY_WRITE, &offset, len);
315 	if (ret)
316 		return ret;
317 
318 	if (S_ISFIFO(inode->i_mode))
319 		return -ESPIPE;
320 
321 	if (S_ISDIR(inode->i_mode))
322 		return -EISDIR;
323 
324 	if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
325 		return -ENODEV;
326 
327 	/* Check for wraparound */
328 	if (check_add_overflow(offset, len, &sum))
329 		return -EFBIG;
330 
331 	if (sum > inode->i_sb->s_maxbytes)
332 		return -EFBIG;
333 
334 	if (!file->f_op->fallocate)
335 		return -EOPNOTSUPP;
336 
337 	file_start_write(file);
338 	ret = file->f_op->fallocate(file, mode, offset, len);
339 
340 	/*
341 	 * Create inotify and fanotify events.
342 	 *
343 	 * To keep the logic simple always create events if fallocate succeeds.
344 	 * This implies that events are even created if the file size remains
345 	 * unchanged, e.g. when using flag FALLOC_FL_KEEP_SIZE.
346 	 */
347 	if (ret == 0)
348 		fsnotify_modify(file);
349 
350 	file_end_write(file);
351 	return ret;
352 }
353 EXPORT_SYMBOL_GPL(vfs_fallocate);
354 
355 int ksys_fallocate(int fd, int mode, loff_t offset, loff_t len)
356 {
357 	CLASS(fd, f)(fd);
358 
359 	if (fd_empty(f))
360 		return -EBADF;
361 
362 	return vfs_fallocate(fd_file(f), mode, offset, len);
363 }
364 
365 SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len)
366 {
367 	return ksys_fallocate(fd, mode, offset, len);
368 }
369 
370 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FALLOCATE)
371 COMPAT_SYSCALL_DEFINE6(fallocate, int, fd, int, mode, compat_arg_u64_dual(offset),
372 		       compat_arg_u64_dual(len))
373 {
374 	return ksys_fallocate(fd, mode, compat_arg_u64_glue(offset),
375 			      compat_arg_u64_glue(len));
376 }
377 #endif
378 
379 /*
380  * access() needs to use the real uid/gid, not the effective uid/gid.
381  * We do this by temporarily clearing all FS-related capabilities and
382  * switching the fsuid/fsgid around to the real ones.
383  *
384  * Creating new credentials is expensive, so we try to skip doing it,
385  * which we can if the result would match what we already got.
386  */
387 static bool access_need_override_creds(int flags)
388 {
389 	const struct cred *cred;
390 
391 	if (flags & AT_EACCESS)
392 		return false;
393 
394 	cred = current_cred();
395 	if (!uid_eq(cred->fsuid, cred->uid) ||
396 	    !gid_eq(cred->fsgid, cred->gid))
397 		return true;
398 
399 	if (!issecure(SECURE_NO_SETUID_FIXUP)) {
400 		kuid_t root_uid = make_kuid(cred->user_ns, 0);
401 		if (!uid_eq(cred->uid, root_uid)) {
402 			if (!cap_isclear(cred->cap_effective))
403 				return true;
404 		} else {
405 			if (!cap_isidentical(cred->cap_effective,
406 			    cred->cap_permitted))
407 				return true;
408 		}
409 	}
410 
411 	return false;
412 }
413 
414 static const struct cred *access_override_creds(void)
415 {
416 	struct cred *override_cred;
417 
418 	override_cred = prepare_creds();
419 	if (!override_cred)
420 		return NULL;
421 
422 	/*
423 	 * XXX access_need_override_creds performs checks in hopes of skipping
424 	 * this work. Make sure it stays in sync if making any changes in this
425 	 * routine.
426 	 */
427 
428 	override_cred->fsuid = override_cred->uid;
429 	override_cred->fsgid = override_cred->gid;
430 
431 	if (!issecure(SECURE_NO_SETUID_FIXUP)) {
432 		/* Clear the capabilities if we switch to a non-root user */
433 		kuid_t root_uid = make_kuid(override_cred->user_ns, 0);
434 		if (!uid_eq(override_cred->uid, root_uid))
435 			cap_clear(override_cred->cap_effective);
436 		else
437 			override_cred->cap_effective =
438 				override_cred->cap_permitted;
439 	}
440 
441 	/*
442 	 * The new set of credentials can *only* be used in
443 	 * task-synchronous circumstances, and does not need
444 	 * RCU freeing, unless somebody then takes a separate
445 	 * reference to it.
446 	 *
447 	 * NOTE! This is _only_ true because this credential
448 	 * is used purely for override_creds() that installs
449 	 * it as the subjective cred. Other threads will be
450 	 * accessing ->real_cred, not the subjective cred.
451 	 *
452 	 * If somebody _does_ make a copy of this (using the
453 	 * 'get_current_cred()' function), that will clear the
454 	 * non_rcu field, because now that other user may be
455 	 * expecting RCU freeing. But normal thread-synchronous
456 	 * cred accesses will keep things non-racy to avoid RCU
457 	 * freeing.
458 	 */
459 	override_cred->non_rcu = 1;
460 	return override_creds(override_cred);
461 }
462 
463 static long do_faccessat(int dfd, const char __user *filename, int mode, int flags)
464 {
465 	struct path path;
466 	struct inode *inode;
467 	int res;
468 	unsigned int lookup_flags = LOOKUP_FOLLOW;
469 	const struct cred *old_cred = NULL;
470 
471 	if (mode & ~S_IRWXO)	/* where's F_OK, X_OK, W_OK, R_OK? */
472 		return -EINVAL;
473 
474 	if (flags & ~(AT_EACCESS | AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH))
475 		return -EINVAL;
476 
477 	if (flags & AT_SYMLINK_NOFOLLOW)
478 		lookup_flags &= ~LOOKUP_FOLLOW;
479 	if (flags & AT_EMPTY_PATH)
480 		lookup_flags |= LOOKUP_EMPTY;
481 
482 	if (access_need_override_creds(flags)) {
483 		old_cred = access_override_creds();
484 		if (!old_cred)
485 			return -ENOMEM;
486 	}
487 
488 retry:
489 	res = user_path_at(dfd, filename, lookup_flags, &path);
490 	if (res)
491 		goto out;
492 
493 	inode = d_backing_inode(path.dentry);
494 
495 	if ((mode & MAY_EXEC) && S_ISREG(inode->i_mode)) {
496 		/*
497 		 * MAY_EXEC on regular files is denied if the fs is mounted
498 		 * with the "noexec" flag.
499 		 */
500 		res = -EACCES;
501 		if (path_noexec(&path))
502 			goto out_path_release;
503 	}
504 
505 	res = inode_permission(mnt_idmap(path.mnt), inode, mode | MAY_ACCESS);
506 	/* SuS v2 requires we report a read only fs too */
507 	if (res || !(mode & S_IWOTH) || special_file(inode->i_mode))
508 		goto out_path_release;
509 	/*
510 	 * This is a rare case where using __mnt_is_readonly()
511 	 * is OK without a mnt_want/drop_write() pair.  Since
512 	 * no actual write to the fs is performed here, we do
513 	 * not need to telegraph to that to anyone.
514 	 *
515 	 * By doing this, we accept that this access is
516 	 * inherently racy and know that the fs may change
517 	 * state before we even see this result.
518 	 */
519 	if (__mnt_is_readonly(path.mnt))
520 		res = -EROFS;
521 
522 out_path_release:
523 	path_put(&path);
524 	if (retry_estale(res, lookup_flags)) {
525 		lookup_flags |= LOOKUP_REVAL;
526 		goto retry;
527 	}
528 out:
529 	if (old_cred)
530 		put_cred(revert_creds(old_cred));
531 
532 	return res;
533 }
534 
535 SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
536 {
537 	return do_faccessat(dfd, filename, mode, 0);
538 }
539 
540 SYSCALL_DEFINE4(faccessat2, int, dfd, const char __user *, filename, int, mode,
541 		int, flags)
542 {
543 	return do_faccessat(dfd, filename, mode, flags);
544 }
545 
546 SYSCALL_DEFINE2(access, const char __user *, filename, int, mode)
547 {
548 	return do_faccessat(AT_FDCWD, filename, mode, 0);
549 }
550 
551 SYSCALL_DEFINE1(chdir, const char __user *, filename)
552 {
553 	struct path path;
554 	int error;
555 	unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
556 retry:
557 	error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
558 	if (error)
559 		goto out;
560 
561 	error = path_permission(&path, MAY_EXEC | MAY_CHDIR);
562 	if (error)
563 		goto dput_and_out;
564 
565 	set_fs_pwd(current->fs, &path);
566 
567 dput_and_out:
568 	path_put(&path);
569 	if (retry_estale(error, lookup_flags)) {
570 		lookup_flags |= LOOKUP_REVAL;
571 		goto retry;
572 	}
573 out:
574 	return error;
575 }
576 
577 SYSCALL_DEFINE1(fchdir, unsigned int, fd)
578 {
579 	CLASS(fd_raw, f)(fd);
580 	int error;
581 
582 	if (fd_empty(f))
583 		return -EBADF;
584 
585 	if (!d_can_lookup(fd_file(f)->f_path.dentry))
586 		return -ENOTDIR;
587 
588 	error = file_permission(fd_file(f), MAY_EXEC | MAY_CHDIR);
589 	if (!error)
590 		set_fs_pwd(current->fs, &fd_file(f)->f_path);
591 	return error;
592 }
593 
594 SYSCALL_DEFINE1(chroot, const char __user *, filename)
595 {
596 	struct path path;
597 	int error;
598 	unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
599 retry:
600 	error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
601 	if (error)
602 		goto out;
603 
604 	error = path_permission(&path, MAY_EXEC | MAY_CHDIR);
605 	if (error)
606 		goto dput_and_out;
607 
608 	error = -EPERM;
609 	if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT))
610 		goto dput_and_out;
611 	error = security_path_chroot(&path);
612 	if (error)
613 		goto dput_and_out;
614 
615 	set_fs_root(current->fs, &path);
616 	error = 0;
617 dput_and_out:
618 	path_put(&path);
619 	if (retry_estale(error, lookup_flags)) {
620 		lookup_flags |= LOOKUP_REVAL;
621 		goto retry;
622 	}
623 out:
624 	return error;
625 }
626 
627 int chmod_common(const struct path *path, umode_t mode)
628 {
629 	struct inode *inode = path->dentry->d_inode;
630 	struct inode *delegated_inode = NULL;
631 	struct iattr newattrs;
632 	int error;
633 
634 	error = mnt_want_write(path->mnt);
635 	if (error)
636 		return error;
637 retry_deleg:
638 	inode_lock(inode);
639 	error = security_path_chmod(path, mode);
640 	if (error)
641 		goto out_unlock;
642 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
643 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
644 	error = notify_change(mnt_idmap(path->mnt), path->dentry,
645 			      &newattrs, &delegated_inode);
646 out_unlock:
647 	inode_unlock(inode);
648 	if (delegated_inode) {
649 		error = break_deleg_wait(&delegated_inode);
650 		if (!error)
651 			goto retry_deleg;
652 	}
653 	mnt_drop_write(path->mnt);
654 	return error;
655 }
656 
657 int vfs_fchmod(struct file *file, umode_t mode)
658 {
659 	audit_file(file);
660 	return chmod_common(&file->f_path, mode);
661 }
662 
663 SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode)
664 {
665 	CLASS(fd, f)(fd);
666 
667 	if (fd_empty(f))
668 		return -EBADF;
669 
670 	return vfs_fchmod(fd_file(f), mode);
671 }
672 
673 static int do_fchmodat(int dfd, const char __user *filename, umode_t mode,
674 		       unsigned int flags)
675 {
676 	struct path path;
677 	int error;
678 	unsigned int lookup_flags;
679 
680 	if (unlikely(flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)))
681 		return -EINVAL;
682 
683 	lookup_flags = (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW;
684 	if (flags & AT_EMPTY_PATH)
685 		lookup_flags |= LOOKUP_EMPTY;
686 
687 retry:
688 	error = user_path_at(dfd, filename, lookup_flags, &path);
689 	if (!error) {
690 		error = chmod_common(&path, mode);
691 		path_put(&path);
692 		if (retry_estale(error, lookup_flags)) {
693 			lookup_flags |= LOOKUP_REVAL;
694 			goto retry;
695 		}
696 	}
697 	return error;
698 }
699 
700 SYSCALL_DEFINE4(fchmodat2, int, dfd, const char __user *, filename,
701 		umode_t, mode, unsigned int, flags)
702 {
703 	return do_fchmodat(dfd, filename, mode, flags);
704 }
705 
706 SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename,
707 		umode_t, mode)
708 {
709 	return do_fchmodat(dfd, filename, mode, 0);
710 }
711 
712 SYSCALL_DEFINE2(chmod, const char __user *, filename, umode_t, mode)
713 {
714 	return do_fchmodat(AT_FDCWD, filename, mode, 0);
715 }
716 
717 /*
718  * Check whether @kuid is valid and if so generate and set vfsuid_t in
719  * ia_vfsuid.
720  *
721  * Return: true if @kuid is valid, false if not.
722  */
723 static inline bool setattr_vfsuid(struct iattr *attr, kuid_t kuid)
724 {
725 	if (!uid_valid(kuid))
726 		return false;
727 	attr->ia_valid |= ATTR_UID;
728 	attr->ia_vfsuid = VFSUIDT_INIT(kuid);
729 	return true;
730 }
731 
732 /*
733  * Check whether @kgid is valid and if so generate and set vfsgid_t in
734  * ia_vfsgid.
735  *
736  * Return: true if @kgid is valid, false if not.
737  */
738 static inline bool setattr_vfsgid(struct iattr *attr, kgid_t kgid)
739 {
740 	if (!gid_valid(kgid))
741 		return false;
742 	attr->ia_valid |= ATTR_GID;
743 	attr->ia_vfsgid = VFSGIDT_INIT(kgid);
744 	return true;
745 }
746 
747 int chown_common(const struct path *path, uid_t user, gid_t group)
748 {
749 	struct mnt_idmap *idmap;
750 	struct user_namespace *fs_userns;
751 	struct inode *inode = path->dentry->d_inode;
752 	struct inode *delegated_inode = NULL;
753 	int error;
754 	struct iattr newattrs;
755 	kuid_t uid;
756 	kgid_t gid;
757 
758 	uid = make_kuid(current_user_ns(), user);
759 	gid = make_kgid(current_user_ns(), group);
760 
761 	idmap = mnt_idmap(path->mnt);
762 	fs_userns = i_user_ns(inode);
763 
764 retry_deleg:
765 	newattrs.ia_vfsuid = INVALID_VFSUID;
766 	newattrs.ia_vfsgid = INVALID_VFSGID;
767 	newattrs.ia_valid =  ATTR_CTIME;
768 	if ((user != (uid_t)-1) && !setattr_vfsuid(&newattrs, uid))
769 		return -EINVAL;
770 	if ((group != (gid_t)-1) && !setattr_vfsgid(&newattrs, gid))
771 		return -EINVAL;
772 	inode_lock(inode);
773 	if (!S_ISDIR(inode->i_mode))
774 		newattrs.ia_valid |= ATTR_KILL_SUID | ATTR_KILL_PRIV |
775 				     setattr_should_drop_sgid(idmap, inode);
776 	/* Continue to send actual fs values, not the mount values. */
777 	error = security_path_chown(
778 		path,
779 		from_vfsuid(idmap, fs_userns, newattrs.ia_vfsuid),
780 		from_vfsgid(idmap, fs_userns, newattrs.ia_vfsgid));
781 	if (!error)
782 		error = notify_change(idmap, path->dentry, &newattrs,
783 				      &delegated_inode);
784 	inode_unlock(inode);
785 	if (delegated_inode) {
786 		error = break_deleg_wait(&delegated_inode);
787 		if (!error)
788 			goto retry_deleg;
789 	}
790 	return error;
791 }
792 
793 int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group,
794 		int flag)
795 {
796 	struct path path;
797 	int error = -EINVAL;
798 	int lookup_flags;
799 
800 	if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
801 		goto out;
802 
803 	lookup_flags = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW;
804 	if (flag & AT_EMPTY_PATH)
805 		lookup_flags |= LOOKUP_EMPTY;
806 retry:
807 	error = user_path_at(dfd, filename, lookup_flags, &path);
808 	if (error)
809 		goto out;
810 	error = mnt_want_write(path.mnt);
811 	if (error)
812 		goto out_release;
813 	error = chown_common(&path, user, group);
814 	mnt_drop_write(path.mnt);
815 out_release:
816 	path_put(&path);
817 	if (retry_estale(error, lookup_flags)) {
818 		lookup_flags |= LOOKUP_REVAL;
819 		goto retry;
820 	}
821 out:
822 	return error;
823 }
824 
825 SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
826 		gid_t, group, int, flag)
827 {
828 	return do_fchownat(dfd, filename, user, group, flag);
829 }
830 
831 SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
832 {
833 	return do_fchownat(AT_FDCWD, filename, user, group, 0);
834 }
835 
836 SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group)
837 {
838 	return do_fchownat(AT_FDCWD, filename, user, group,
839 			   AT_SYMLINK_NOFOLLOW);
840 }
841 
842 int vfs_fchown(struct file *file, uid_t user, gid_t group)
843 {
844 	int error;
845 
846 	error = mnt_want_write_file(file);
847 	if (error)
848 		return error;
849 	audit_file(file);
850 	error = chown_common(&file->f_path, user, group);
851 	mnt_drop_write_file(file);
852 	return error;
853 }
854 
855 int ksys_fchown(unsigned int fd, uid_t user, gid_t group)
856 {
857 	CLASS(fd, f)(fd);
858 
859 	if (fd_empty(f))
860 		return -EBADF;
861 
862 	return vfs_fchown(fd_file(f), user, group);
863 }
864 
865 SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
866 {
867 	return ksys_fchown(fd, user, group);
868 }
869 
870 static inline int file_get_write_access(struct file *f)
871 {
872 	int error;
873 
874 	error = get_write_access(f->f_inode);
875 	if (unlikely(error))
876 		return error;
877 	error = mnt_get_write_access(f->f_path.mnt);
878 	if (unlikely(error))
879 		goto cleanup_inode;
880 	if (unlikely(f->f_mode & FMODE_BACKING)) {
881 		error = mnt_get_write_access(backing_file_user_path(f)->mnt);
882 		if (unlikely(error))
883 			goto cleanup_mnt;
884 	}
885 	return 0;
886 
887 cleanup_mnt:
888 	mnt_put_write_access(f->f_path.mnt);
889 cleanup_inode:
890 	put_write_access(f->f_inode);
891 	return error;
892 }
893 
894 static int do_dentry_open(struct file *f,
895 			  int (*open)(struct inode *, struct file *))
896 {
897 	static const struct file_operations empty_fops = {};
898 	struct inode *inode = f->f_path.dentry->d_inode;
899 	int error;
900 
901 	path_get(&f->f_path);
902 	f->f_inode = inode;
903 	f->f_mapping = inode->i_mapping;
904 	f->f_wb_err = filemap_sample_wb_err(f->f_mapping);
905 	f->f_sb_err = file_sample_sb_err(f);
906 
907 	if (unlikely(f->f_flags & O_PATH)) {
908 		f->f_mode = FMODE_PATH | FMODE_OPENED | FMODE_NONOTIFY;
909 		f->f_op = &empty_fops;
910 		return 0;
911 	}
912 
913 	if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) {
914 		i_readcount_inc(inode);
915 	} else if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
916 		error = file_get_write_access(f);
917 		if (unlikely(error))
918 			goto cleanup_file;
919 		f->f_mode |= FMODE_WRITER;
920 	}
921 
922 	/* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */
923 	if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode))
924 		f->f_mode |= FMODE_ATOMIC_POS;
925 
926 	f->f_op = fops_get(inode->i_fop);
927 	if (WARN_ON(!f->f_op)) {
928 		error = -ENODEV;
929 		goto cleanup_all;
930 	}
931 
932 	error = security_file_open(f);
933 	if (error)
934 		goto cleanup_all;
935 
936 	/*
937 	 * Set FMODE_NONOTIFY_* bits according to existing permission watches.
938 	 * If FMODE_NONOTIFY was already set for an fanotify fd, this doesn't
939 	 * change anything.
940 	 */
941 	file_set_fsnotify_mode(f);
942 	error = fsnotify_open_perm(f);
943 	if (error)
944 		goto cleanup_all;
945 
946 	error = break_lease(file_inode(f), f->f_flags);
947 	if (error)
948 		goto cleanup_all;
949 
950 	/* normally all 3 are set; ->open() can clear them if needed */
951 	f->f_mode |= FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE;
952 	if (!open)
953 		open = f->f_op->open;
954 	if (open) {
955 		error = open(inode, f);
956 		if (error)
957 			goto cleanup_all;
958 	}
959 	f->f_mode |= FMODE_OPENED;
960 	if ((f->f_mode & FMODE_READ) &&
961 	     likely(f->f_op->read || f->f_op->read_iter))
962 		f->f_mode |= FMODE_CAN_READ;
963 	if ((f->f_mode & FMODE_WRITE) &&
964 	     likely(f->f_op->write || f->f_op->write_iter))
965 		f->f_mode |= FMODE_CAN_WRITE;
966 	if ((f->f_mode & FMODE_LSEEK) && !f->f_op->llseek)
967 		f->f_mode &= ~FMODE_LSEEK;
968 	if (f->f_mapping->a_ops && f->f_mapping->a_ops->direct_IO)
969 		f->f_mode |= FMODE_CAN_ODIRECT;
970 
971 	f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC);
972 	f->f_iocb_flags = iocb_flags(f);
973 
974 	file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping);
975 
976 	if ((f->f_flags & O_DIRECT) && !(f->f_mode & FMODE_CAN_ODIRECT))
977 		return -EINVAL;
978 
979 	/*
980 	 * XXX: Huge page cache doesn't support writing yet. Drop all page
981 	 * cache for this file before processing writes.
982 	 */
983 	if (f->f_mode & FMODE_WRITE) {
984 		/*
985 		 * Depends on full fence from get_write_access() to synchronize
986 		 * against collapse_file() regarding i_writecount and nr_thps
987 		 * updates. Ensures subsequent insertion of THPs into the page
988 		 * cache will fail.
989 		 */
990 		if (filemap_nr_thps(inode->i_mapping)) {
991 			struct address_space *mapping = inode->i_mapping;
992 
993 			filemap_invalidate_lock(inode->i_mapping);
994 			/*
995 			 * unmap_mapping_range just need to be called once
996 			 * here, because the private pages is not need to be
997 			 * unmapped mapping (e.g. data segment of dynamic
998 			 * shared libraries here).
999 			 */
1000 			unmap_mapping_range(mapping, 0, 0, 0);
1001 			truncate_inode_pages(mapping, 0);
1002 			filemap_invalidate_unlock(inode->i_mapping);
1003 		}
1004 	}
1005 
1006 	return 0;
1007 
1008 cleanup_all:
1009 	if (WARN_ON_ONCE(error > 0))
1010 		error = -EINVAL;
1011 	fops_put(f->f_op);
1012 	put_file_access(f);
1013 cleanup_file:
1014 	path_put(&f->f_path);
1015 	f->f_path.mnt = NULL;
1016 	f->f_path.dentry = NULL;
1017 	f->f_inode = NULL;
1018 	return error;
1019 }
1020 
1021 /**
1022  * finish_open - finish opening a file
1023  * @file: file pointer
1024  * @dentry: pointer to dentry
1025  * @open: open callback
1026  *
1027  * This can be used to finish opening a file passed to i_op->atomic_open().
1028  *
1029  * If the open callback is set to NULL, then the standard f_op->open()
1030  * filesystem callback is substituted.
1031  *
1032  * NB: the dentry reference is _not_ consumed.  If, for example, the dentry is
1033  * the return value of d_splice_alias(), then the caller needs to perform dput()
1034  * on it after finish_open().
1035  *
1036  * Returns zero on success or -errno if the open failed.
1037  */
1038 int finish_open(struct file *file, struct dentry *dentry,
1039 		int (*open)(struct inode *, struct file *))
1040 {
1041 	BUG_ON(file->f_mode & FMODE_OPENED); /* once it's opened, it's opened */
1042 
1043 	file->f_path.dentry = dentry;
1044 	return do_dentry_open(file, open);
1045 }
1046 EXPORT_SYMBOL(finish_open);
1047 
1048 /**
1049  * finish_no_open - finish ->atomic_open() without opening the file
1050  *
1051  * @file: file pointer
1052  * @dentry: dentry or NULL (as returned from ->lookup())
1053  *
1054  * This can be used to set the result of a successful lookup in ->atomic_open().
1055  *
1056  * NB: unlike finish_open() this function does consume the dentry reference and
1057  * the caller need not dput() it.
1058  *
1059  * Returns "0" which must be the return value of ->atomic_open() after having
1060  * called this function.
1061  */
1062 int finish_no_open(struct file *file, struct dentry *dentry)
1063 {
1064 	file->f_path.dentry = dentry;
1065 	return 0;
1066 }
1067 EXPORT_SYMBOL(finish_no_open);
1068 
1069 char *file_path(struct file *filp, char *buf, int buflen)
1070 {
1071 	return d_path(&filp->f_path, buf, buflen);
1072 }
1073 EXPORT_SYMBOL(file_path);
1074 
1075 /**
1076  * vfs_open - open the file at the given path
1077  * @path: path to open
1078  * @file: newly allocated file with f_flag initialized
1079  */
1080 int vfs_open(const struct path *path, struct file *file)
1081 {
1082 	int ret;
1083 
1084 	file->f_path = *path;
1085 	ret = do_dentry_open(file, NULL);
1086 	if (!ret) {
1087 		/*
1088 		 * Once we return a file with FMODE_OPENED, __fput() will call
1089 		 * fsnotify_close(), so we need fsnotify_open() here for
1090 		 * symmetry.
1091 		 */
1092 		fsnotify_open(file);
1093 	}
1094 	return ret;
1095 }
1096 
1097 struct file *dentry_open(const struct path *path, int flags,
1098 			 const struct cred *cred)
1099 {
1100 	int error;
1101 	struct file *f;
1102 
1103 	/* We must always pass in a valid mount pointer. */
1104 	BUG_ON(!path->mnt);
1105 
1106 	f = alloc_empty_file(flags, cred);
1107 	if (!IS_ERR(f)) {
1108 		error = vfs_open(path, f);
1109 		if (error) {
1110 			fput(f);
1111 			f = ERR_PTR(error);
1112 		}
1113 	}
1114 	return f;
1115 }
1116 EXPORT_SYMBOL(dentry_open);
1117 
1118 struct file *dentry_open_nonotify(const struct path *path, int flags,
1119 				  const struct cred *cred)
1120 {
1121 	struct file *f = alloc_empty_file(flags, cred);
1122 	if (!IS_ERR(f)) {
1123 		int error;
1124 
1125 		f->f_mode |= FMODE_NONOTIFY;
1126 		error = vfs_open(path, f);
1127 		if (error) {
1128 			fput(f);
1129 			f = ERR_PTR(error);
1130 		}
1131 	}
1132 	return f;
1133 }
1134 
1135 /**
1136  * dentry_create - Create and open a file
1137  * @path: path to create
1138  * @flags: O_ flags
1139  * @mode: mode bits for new file
1140  * @cred: credentials to use
1141  *
1142  * Caller must hold the parent directory's lock, and have prepared
1143  * a negative dentry, placed in @path->dentry, for the new file.
1144  *
1145  * Caller sets @path->mnt to the vfsmount of the filesystem where
1146  * the new file is to be created. The parent directory and the
1147  * negative dentry must reside on the same filesystem instance.
1148  *
1149  * On success, returns a "struct file *". Otherwise a ERR_PTR
1150  * is returned.
1151  */
1152 struct file *dentry_create(const struct path *path, int flags, umode_t mode,
1153 			   const struct cred *cred)
1154 {
1155 	struct file *f;
1156 	int error;
1157 
1158 	f = alloc_empty_file(flags, cred);
1159 	if (IS_ERR(f))
1160 		return f;
1161 
1162 	error = vfs_create(mnt_idmap(path->mnt),
1163 			   d_inode(path->dentry->d_parent),
1164 			   path->dentry, mode, true);
1165 	if (!error)
1166 		error = vfs_open(path, f);
1167 
1168 	if (unlikely(error)) {
1169 		fput(f);
1170 		return ERR_PTR(error);
1171 	}
1172 	return f;
1173 }
1174 EXPORT_SYMBOL(dentry_create);
1175 
1176 /**
1177  * kernel_file_open - open a file for kernel internal use
1178  * @path:	path of the file to open
1179  * @flags:	open flags
1180  * @cred:	credentials for open
1181  *
1182  * Open a file for use by in-kernel consumers. The file is not accounted
1183  * against nr_files and must not be installed into the file descriptor
1184  * table.
1185  *
1186  * Return: Opened file on success, an error pointer on failure.
1187  */
1188 struct file *kernel_file_open(const struct path *path, int flags,
1189 				const struct cred *cred)
1190 {
1191 	struct file *f;
1192 	int error;
1193 
1194 	f = alloc_empty_file_noaccount(flags, cred);
1195 	if (IS_ERR(f))
1196 		return f;
1197 
1198 	f->f_path = *path;
1199 	error = do_dentry_open(f, NULL);
1200 	if (error) {
1201 		fput(f);
1202 		return ERR_PTR(error);
1203 	}
1204 
1205 	fsnotify_open(f);
1206 	return f;
1207 }
1208 EXPORT_SYMBOL_GPL(kernel_file_open);
1209 
1210 #define WILL_CREATE(flags)	(flags & (O_CREAT | __O_TMPFILE))
1211 #define O_PATH_FLAGS		(O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC)
1212 
1213 inline struct open_how build_open_how(int flags, umode_t mode)
1214 {
1215 	struct open_how how = {
1216 		.flags = flags & VALID_OPEN_FLAGS,
1217 		.mode = mode & S_IALLUGO,
1218 	};
1219 
1220 	/* O_PATH beats everything else. */
1221 	if (how.flags & O_PATH)
1222 		how.flags &= O_PATH_FLAGS;
1223 	/* Modes should only be set for create-like flags. */
1224 	if (!WILL_CREATE(how.flags))
1225 		how.mode = 0;
1226 	return how;
1227 }
1228 
1229 inline int build_open_flags(const struct open_how *how, struct open_flags *op)
1230 {
1231 	u64 flags = how->flags;
1232 	u64 strip = O_CLOEXEC;
1233 	int lookup_flags = 0;
1234 	int acc_mode = ACC_MODE(flags);
1235 
1236 	BUILD_BUG_ON_MSG(upper_32_bits(VALID_OPEN_FLAGS),
1237 			 "struct open_flags doesn't yet handle flags > 32 bits");
1238 
1239 	/*
1240 	 * Strip flags that aren't relevant in determining struct open_flags.
1241 	 */
1242 	flags &= ~strip;
1243 
1244 	/*
1245 	 * Older syscalls implicitly clear all of the invalid flags or argument
1246 	 * values before calling build_open_flags(), but openat2(2) checks all
1247 	 * of its arguments.
1248 	 */
1249 	if (flags & ~VALID_OPEN_FLAGS)
1250 		return -EINVAL;
1251 	if (how->resolve & ~VALID_RESOLVE_FLAGS)
1252 		return -EINVAL;
1253 
1254 	/* Scoping flags are mutually exclusive. */
1255 	if ((how->resolve & RESOLVE_BENEATH) && (how->resolve & RESOLVE_IN_ROOT))
1256 		return -EINVAL;
1257 
1258 	/* Deal with the mode. */
1259 	if (WILL_CREATE(flags)) {
1260 		if (how->mode & ~S_IALLUGO)
1261 			return -EINVAL;
1262 		op->mode = how->mode | S_IFREG;
1263 	} else {
1264 		if (how->mode != 0)
1265 			return -EINVAL;
1266 		op->mode = 0;
1267 	}
1268 
1269 	/*
1270 	 * Block bugs where O_DIRECTORY | O_CREAT created regular files.
1271 	 * Note, that blocking O_DIRECTORY | O_CREAT here also protects
1272 	 * O_TMPFILE below which requires O_DIRECTORY being raised.
1273 	 */
1274 	if ((flags & (O_DIRECTORY | O_CREAT)) == (O_DIRECTORY | O_CREAT))
1275 		return -EINVAL;
1276 
1277 	/* Now handle the creative implementation of O_TMPFILE. */
1278 	if (flags & __O_TMPFILE) {
1279 		/*
1280 		 * In order to ensure programs get explicit errors when trying
1281 		 * to use O_TMPFILE on old kernels we enforce that O_DIRECTORY
1282 		 * is raised alongside __O_TMPFILE.
1283 		 */
1284 		if (!(flags & O_DIRECTORY))
1285 			return -EINVAL;
1286 		if (!(acc_mode & MAY_WRITE))
1287 			return -EINVAL;
1288 	}
1289 	if (flags & O_PATH) {
1290 		/* O_PATH only permits certain other flags to be set. */
1291 		if (flags & ~O_PATH_FLAGS)
1292 			return -EINVAL;
1293 		acc_mode = 0;
1294 	}
1295 
1296 	/*
1297 	 * O_SYNC is implemented as __O_SYNC|O_DSYNC.  As many places only
1298 	 * check for O_DSYNC if the need any syncing at all we enforce it's
1299 	 * always set instead of having to deal with possibly weird behaviour
1300 	 * for malicious applications setting only __O_SYNC.
1301 	 */
1302 	if (flags & __O_SYNC)
1303 		flags |= O_DSYNC;
1304 
1305 	op->open_flag = flags;
1306 
1307 	/* O_TRUNC implies we need access checks for write permissions */
1308 	if (flags & O_TRUNC)
1309 		acc_mode |= MAY_WRITE;
1310 
1311 	/* Allow the LSM permission hook to distinguish append
1312 	   access from general write access. */
1313 	if (flags & O_APPEND)
1314 		acc_mode |= MAY_APPEND;
1315 
1316 	op->acc_mode = acc_mode;
1317 
1318 	op->intent = flags & O_PATH ? 0 : LOOKUP_OPEN;
1319 
1320 	if (flags & O_CREAT) {
1321 		op->intent |= LOOKUP_CREATE;
1322 		if (flags & O_EXCL) {
1323 			op->intent |= LOOKUP_EXCL;
1324 			flags |= O_NOFOLLOW;
1325 		}
1326 	}
1327 
1328 	if (flags & O_DIRECTORY)
1329 		lookup_flags |= LOOKUP_DIRECTORY;
1330 	if (!(flags & O_NOFOLLOW))
1331 		lookup_flags |= LOOKUP_FOLLOW;
1332 
1333 	if (how->resolve & RESOLVE_NO_XDEV)
1334 		lookup_flags |= LOOKUP_NO_XDEV;
1335 	if (how->resolve & RESOLVE_NO_MAGICLINKS)
1336 		lookup_flags |= LOOKUP_NO_MAGICLINKS;
1337 	if (how->resolve & RESOLVE_NO_SYMLINKS)
1338 		lookup_flags |= LOOKUP_NO_SYMLINKS;
1339 	if (how->resolve & RESOLVE_BENEATH)
1340 		lookup_flags |= LOOKUP_BENEATH;
1341 	if (how->resolve & RESOLVE_IN_ROOT)
1342 		lookup_flags |= LOOKUP_IN_ROOT;
1343 	if (how->resolve & RESOLVE_CACHED) {
1344 		/* Don't bother even trying for create/truncate/tmpfile open */
1345 		if (flags & (O_TRUNC | O_CREAT | __O_TMPFILE))
1346 			return -EAGAIN;
1347 		lookup_flags |= LOOKUP_CACHED;
1348 	}
1349 
1350 	op->lookup_flags = lookup_flags;
1351 	return 0;
1352 }
1353 
1354 /**
1355  * file_open_name - open file and return file pointer
1356  *
1357  * @name:	struct filename containing path to open
1358  * @flags:	open flags as per the open(2) second argument
1359  * @mode:	mode for the new file if O_CREAT is set, else ignored
1360  *
1361  * This is the helper to open a file from kernelspace if you really
1362  * have to.  But in generally you should not do this, so please move
1363  * along, nothing to see here..
1364  */
1365 struct file *file_open_name(struct filename *name, int flags, umode_t mode)
1366 {
1367 	struct open_flags op;
1368 	struct open_how how = build_open_how(flags, mode);
1369 	int err = build_open_flags(&how, &op);
1370 	if (err)
1371 		return ERR_PTR(err);
1372 	return do_filp_open(AT_FDCWD, name, &op);
1373 }
1374 
1375 /**
1376  * filp_open - open file and return file pointer
1377  *
1378  * @filename:	path to open
1379  * @flags:	open flags as per the open(2) second argument
1380  * @mode:	mode for the new file if O_CREAT is set, else ignored
1381  *
1382  * This is the helper to open a file from kernelspace if you really
1383  * have to.  But in generally you should not do this, so please move
1384  * along, nothing to see here..
1385  */
1386 struct file *filp_open(const char *filename, int flags, umode_t mode)
1387 {
1388 	struct filename *name = getname_kernel(filename);
1389 	struct file *file = ERR_CAST(name);
1390 
1391 	if (!IS_ERR(name)) {
1392 		file = file_open_name(name, flags, mode);
1393 		putname(name);
1394 	}
1395 	return file;
1396 }
1397 EXPORT_SYMBOL(filp_open);
1398 
1399 struct file *file_open_root(const struct path *root,
1400 			    const char *filename, int flags, umode_t mode)
1401 {
1402 	struct open_flags op;
1403 	struct open_how how = build_open_how(flags, mode);
1404 	int err = build_open_flags(&how, &op);
1405 	if (err)
1406 		return ERR_PTR(err);
1407 	return do_file_open_root(root, filename, &op);
1408 }
1409 EXPORT_SYMBOL(file_open_root);
1410 
1411 static long do_sys_openat2(int dfd, const char __user *filename,
1412 			   struct open_how *how)
1413 {
1414 	struct open_flags op;
1415 	int fd = build_open_flags(how, &op);
1416 	struct filename *tmp;
1417 
1418 	if (fd)
1419 		return fd;
1420 
1421 	tmp = getname(filename);
1422 	if (IS_ERR(tmp))
1423 		return PTR_ERR(tmp);
1424 
1425 	fd = get_unused_fd_flags(how->flags);
1426 	if (fd >= 0) {
1427 		struct file *f = do_filp_open(dfd, tmp, &op);
1428 		if (IS_ERR(f)) {
1429 			put_unused_fd(fd);
1430 			fd = PTR_ERR(f);
1431 		} else {
1432 			fd_install(fd, f);
1433 		}
1434 	}
1435 	putname(tmp);
1436 	return fd;
1437 }
1438 
1439 long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
1440 {
1441 	struct open_how how = build_open_how(flags, mode);
1442 	return do_sys_openat2(dfd, filename, &how);
1443 }
1444 
1445 
1446 SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1447 {
1448 	if (force_o_largefile())
1449 		flags |= O_LARGEFILE;
1450 	return do_sys_open(AT_FDCWD, filename, flags, mode);
1451 }
1452 
1453 SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags,
1454 		umode_t, mode)
1455 {
1456 	if (force_o_largefile())
1457 		flags |= O_LARGEFILE;
1458 	return do_sys_open(dfd, filename, flags, mode);
1459 }
1460 
1461 SYSCALL_DEFINE4(openat2, int, dfd, const char __user *, filename,
1462 		struct open_how __user *, how, size_t, usize)
1463 {
1464 	int err;
1465 	struct open_how tmp;
1466 
1467 	BUILD_BUG_ON(sizeof(struct open_how) < OPEN_HOW_SIZE_VER0);
1468 	BUILD_BUG_ON(sizeof(struct open_how) != OPEN_HOW_SIZE_LATEST);
1469 
1470 	if (unlikely(usize < OPEN_HOW_SIZE_VER0))
1471 		return -EINVAL;
1472 	if (unlikely(usize > PAGE_SIZE))
1473 		return -E2BIG;
1474 
1475 	err = copy_struct_from_user(&tmp, sizeof(tmp), how, usize);
1476 	if (err)
1477 		return err;
1478 
1479 	audit_openat2_how(&tmp);
1480 
1481 	/* O_LARGEFILE is only allowed for non-O_PATH. */
1482 	if (!(tmp.flags & O_PATH) && force_o_largefile())
1483 		tmp.flags |= O_LARGEFILE;
1484 
1485 	return do_sys_openat2(dfd, filename, &tmp);
1486 }
1487 
1488 #ifdef CONFIG_COMPAT
1489 /*
1490  * Exactly like sys_open(), except that it doesn't set the
1491  * O_LARGEFILE flag.
1492  */
1493 COMPAT_SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1494 {
1495 	return do_sys_open(AT_FDCWD, filename, flags, mode);
1496 }
1497 
1498 /*
1499  * Exactly like sys_openat(), except that it doesn't set the
1500  * O_LARGEFILE flag.
1501  */
1502 COMPAT_SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode)
1503 {
1504 	return do_sys_open(dfd, filename, flags, mode);
1505 }
1506 #endif
1507 
1508 #ifndef __alpha__
1509 
1510 /*
1511  * For backward compatibility?  Maybe this should be moved
1512  * into arch/i386 instead?
1513  */
1514 SYSCALL_DEFINE2(creat, const char __user *, pathname, umode_t, mode)
1515 {
1516 	int flags = O_CREAT | O_WRONLY | O_TRUNC;
1517 
1518 	if (force_o_largefile())
1519 		flags |= O_LARGEFILE;
1520 	return do_sys_open(AT_FDCWD, pathname, flags, mode);
1521 }
1522 #endif
1523 
1524 /*
1525  * "id" is the POSIX thread ID. We use the
1526  * files pointer for this..
1527  */
1528 static int filp_flush(struct file *filp, fl_owner_t id)
1529 {
1530 	int retval = 0;
1531 
1532 	if (CHECK_DATA_CORRUPTION(file_count(filp) == 0, filp,
1533 			"VFS: Close: file count is 0 (f_op=%ps)",
1534 			filp->f_op)) {
1535 		return 0;
1536 	}
1537 
1538 	if (filp->f_op->flush)
1539 		retval = filp->f_op->flush(filp, id);
1540 
1541 	if (likely(!(filp->f_mode & FMODE_PATH))) {
1542 		dnotify_flush(filp, id);
1543 		locks_remove_posix(filp, id);
1544 	}
1545 	return retval;
1546 }
1547 
1548 int filp_close(struct file *filp, fl_owner_t id)
1549 {
1550 	int retval;
1551 
1552 	retval = filp_flush(filp, id);
1553 	fput(filp);
1554 
1555 	return retval;
1556 }
1557 EXPORT_SYMBOL(filp_close);
1558 
1559 /*
1560  * Careful here! We test whether the file pointer is NULL before
1561  * releasing the fd. This ensures that one clone task can't release
1562  * an fd while another clone is opening it.
1563  */
1564 SYSCALL_DEFINE1(close, unsigned int, fd)
1565 {
1566 	int retval;
1567 	struct file *file;
1568 
1569 	file = file_close_fd(fd);
1570 	if (!file)
1571 		return -EBADF;
1572 
1573 	retval = filp_flush(file, current->files);
1574 
1575 	/*
1576 	 * We're returning to user space. Don't bother
1577 	 * with any delayed fput() cases.
1578 	 */
1579 	__fput_sync(file);
1580 
1581 	/* can't restart close syscall because file table entry was cleared */
1582 	if (unlikely(retval == -ERESTARTSYS ||
1583 		     retval == -ERESTARTNOINTR ||
1584 		     retval == -ERESTARTNOHAND ||
1585 		     retval == -ERESTART_RESTARTBLOCK))
1586 		retval = -EINTR;
1587 
1588 	return retval;
1589 }
1590 
1591 /*
1592  * This routine simulates a hangup on the tty, to arrange that users
1593  * are given clean terminals at login time.
1594  */
1595 SYSCALL_DEFINE0(vhangup)
1596 {
1597 	if (capable(CAP_SYS_TTY_CONFIG)) {
1598 		tty_vhangup_self();
1599 		return 0;
1600 	}
1601 	return -EPERM;
1602 }
1603 
1604 /*
1605  * Called when an inode is about to be open.
1606  * We use this to disallow opening large files on 32bit systems if
1607  * the caller didn't specify O_LARGEFILE.  On 64bit systems we force
1608  * on this flag in sys_open.
1609  */
1610 int generic_file_open(struct inode * inode, struct file * filp)
1611 {
1612 	if (!(filp->f_flags & O_LARGEFILE) && i_size_read(inode) > MAX_NON_LFS)
1613 		return -EOVERFLOW;
1614 	return 0;
1615 }
1616 
1617 EXPORT_SYMBOL(generic_file_open);
1618 
1619 /*
1620  * This is used by subsystems that don't want seekable
1621  * file descriptors. The function is not supposed to ever fail, the only
1622  * reason it returns an 'int' and not 'void' is so that it can be plugged
1623  * directly into file_operations structure.
1624  */
1625 int nonseekable_open(struct inode *inode, struct file *filp)
1626 {
1627 	filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
1628 	return 0;
1629 }
1630 
1631 EXPORT_SYMBOL(nonseekable_open);
1632 
1633 /*
1634  * stream_open is used by subsystems that want stream-like file descriptors.
1635  * Such file descriptors are not seekable and don't have notion of position
1636  * (file.f_pos is always 0 and ppos passed to .read()/.write() is always NULL).
1637  * Contrary to file descriptors of other regular files, .read() and .write()
1638  * can run simultaneously.
1639  *
1640  * stream_open never fails and is marked to return int so that it could be
1641  * directly used as file_operations.open .
1642  */
1643 int stream_open(struct inode *inode, struct file *filp)
1644 {
1645 	filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS);
1646 	filp->f_mode |= FMODE_STREAM;
1647 	return 0;
1648 }
1649 
1650 EXPORT_SYMBOL(stream_open);
1651