1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/anon_inodes.h> 3 #include <linux/exportfs.h> 4 #include <linux/file.h> 5 #include <linux/fs.h> 6 #include <linux/cgroup.h> 7 #include <linux/magic.h> 8 #include <linux/mount.h> 9 #include <linux/pid.h> 10 #include <linux/pidfs.h> 11 #include <linux/pid_namespace.h> 12 #include <linux/poll.h> 13 #include <linux/proc_fs.h> 14 #include <linux/proc_ns.h> 15 #include <linux/pseudo_fs.h> 16 #include <linux/ptrace.h> 17 #include <linux/seq_file.h> 18 #include <uapi/linux/pidfd.h> 19 #include <linux/ipc_namespace.h> 20 #include <linux/time_namespace.h> 21 #include <linux/utsname.h> 22 #include <net/net_namespace.h> 23 #include <linux/coredump.h> 24 #include <linux/xattr.h> 25 26 #include "internal.h" 27 #include "mount.h" 28 29 #define PIDFS_PID_DEAD ERR_PTR(-ESRCH) 30 31 static struct kmem_cache *pidfs_attr_cachep __ro_after_init; 32 static struct kmem_cache *pidfs_xattr_cachep __ro_after_init; 33 34 /* 35 * Stashes information that userspace needs to access even after the 36 * process has been reaped. 37 */ 38 struct pidfs_exit_info { 39 __u64 cgroupid; 40 __s32 exit_code; 41 __u32 coredump_mask; 42 }; 43 44 struct pidfs_attr { 45 struct simple_xattrs *xattrs; 46 struct pidfs_exit_info __pei; 47 struct pidfs_exit_info *exit_info; 48 }; 49 50 static struct rb_root pidfs_ino_tree = RB_ROOT; 51 52 #if BITS_PER_LONG == 32 53 static inline unsigned long pidfs_ino(u64 ino) 54 { 55 return lower_32_bits(ino); 56 } 57 58 /* On 32 bit the generation number are the upper 32 bits. */ 59 static inline u32 pidfs_gen(u64 ino) 60 { 61 return upper_32_bits(ino); 62 } 63 64 #else 65 66 /* On 64 bit simply return ino. */ 67 static inline unsigned long pidfs_ino(u64 ino) 68 { 69 return ino; 70 } 71 72 /* On 64 bit the generation number is 0. */ 73 static inline u32 pidfs_gen(u64 ino) 74 { 75 return 0; 76 } 77 #endif 78 79 static int pidfs_ino_cmp(struct rb_node *a, const struct rb_node *b) 80 { 81 struct pid *pid_a = rb_entry(a, struct pid, pidfs_node); 82 struct pid *pid_b = rb_entry(b, struct pid, pidfs_node); 83 u64 pid_ino_a = pid_a->ino; 84 u64 pid_ino_b = pid_b->ino; 85 86 if (pid_ino_a < pid_ino_b) 87 return -1; 88 if (pid_ino_a > pid_ino_b) 89 return 1; 90 return 0; 91 } 92 93 void pidfs_add_pid(struct pid *pid) 94 { 95 static u64 pidfs_ino_nr = 2; 96 97 /* 98 * On 64 bit nothing special happens. The 64bit number assigned 99 * to struct pid is the inode number. 100 * 101 * On 32 bit the 64 bit number assigned to struct pid is split 102 * into two 32 bit numbers. The lower 32 bits are used as the 103 * inode number and the upper 32 bits are used as the inode 104 * generation number. 105 * 106 * On 32 bit pidfs_ino() will return the lower 32 bit. When 107 * pidfs_ino() returns zero a wrap around happened. When a 108 * wraparound happens the 64 bit number will be incremented by 2 109 * so inode numbering starts at 2 again. 110 * 111 * On 64 bit comparing two pidfds is as simple as comparing 112 * inode numbers. 113 * 114 * When a wraparound happens on 32 bit multiple pidfds with the 115 * same inode number are likely to exist (This isn't a problem 116 * since before pidfs pidfds used the anonymous inode meaning 117 * all pidfds had the same inode number.). Userspace can 118 * reconstruct the 64 bit identifier by retrieving both the 119 * inode number and the inode generation number to compare or 120 * use file handles. 121 */ 122 if (pidfs_ino(pidfs_ino_nr) == 0) 123 pidfs_ino_nr += 2; 124 125 pid->ino = pidfs_ino_nr; 126 pid->stashed = NULL; 127 pid->attr = NULL; 128 pidfs_ino_nr++; 129 130 write_seqcount_begin(&pidmap_lock_seq); 131 rb_find_add_rcu(&pid->pidfs_node, &pidfs_ino_tree, pidfs_ino_cmp); 132 write_seqcount_end(&pidmap_lock_seq); 133 } 134 135 void pidfs_remove_pid(struct pid *pid) 136 { 137 write_seqcount_begin(&pidmap_lock_seq); 138 rb_erase(&pid->pidfs_node, &pidfs_ino_tree); 139 write_seqcount_end(&pidmap_lock_seq); 140 } 141 142 void pidfs_free_pid(struct pid *pid) 143 { 144 struct pidfs_attr *attr __free(kfree) = no_free_ptr(pid->attr); 145 struct simple_xattrs *xattrs __free(kfree) = NULL; 146 147 /* 148 * Any dentry must've been wiped from the pid by now. 149 * Otherwise there's a reference count bug. 150 */ 151 VFS_WARN_ON_ONCE(pid->stashed); 152 153 if (IS_ERR(attr)) 154 return; 155 156 /* 157 * Any dentry must've been wiped from the pid by now. Otherwise 158 * there's a reference count bug. 159 */ 160 VFS_WARN_ON_ONCE(pid->stashed); 161 162 xattrs = attr->xattrs; 163 if (xattrs) 164 simple_xattrs_free(attr->xattrs, NULL); 165 } 166 167 #ifdef CONFIG_PROC_FS 168 /** 169 * pidfd_show_fdinfo - print information about a pidfd 170 * @m: proc fdinfo file 171 * @f: file referencing a pidfd 172 * 173 * Pid: 174 * This function will print the pid that a given pidfd refers to in the 175 * pid namespace of the procfs instance. 176 * If the pid namespace of the process is not a descendant of the pid 177 * namespace of the procfs instance 0 will be shown as its pid. This is 178 * similar to calling getppid() on a process whose parent is outside of 179 * its pid namespace. 180 * 181 * NSpid: 182 * If pid namespaces are supported then this function will also print 183 * the pid of a given pidfd refers to for all descendant pid namespaces 184 * starting from the current pid namespace of the instance, i.e. the 185 * Pid field and the first entry in the NSpid field will be identical. 186 * If the pid namespace of the process is not a descendant of the pid 187 * namespace of the procfs instance 0 will be shown as its first NSpid 188 * entry and no others will be shown. 189 * Note that this differs from the Pid and NSpid fields in 190 * /proc/<pid>/status where Pid and NSpid are always shown relative to 191 * the pid namespace of the procfs instance. The difference becomes 192 * obvious when sending around a pidfd between pid namespaces from a 193 * different branch of the tree, i.e. where no ancestral relation is 194 * present between the pid namespaces: 195 * - create two new pid namespaces ns1 and ns2 in the initial pid 196 * namespace (also take care to create new mount namespaces in the 197 * new pid namespace and mount procfs) 198 * - create a process with a pidfd in ns1 199 * - send pidfd from ns1 to ns2 200 * - read /proc/self/fdinfo/<pidfd> and observe that both Pid and NSpid 201 * have exactly one entry, which is 0 202 */ 203 static void pidfd_show_fdinfo(struct seq_file *m, struct file *f) 204 { 205 struct pid *pid = pidfd_pid(f); 206 struct pid_namespace *ns; 207 pid_t nr = -1; 208 209 if (likely(pid_has_task(pid, PIDTYPE_PID))) { 210 ns = proc_pid_ns(file_inode(m->file)->i_sb); 211 nr = pid_nr_ns(pid, ns); 212 } 213 214 seq_put_decimal_ll(m, "Pid:\t", nr); 215 216 #ifdef CONFIG_PID_NS 217 seq_put_decimal_ll(m, "\nNSpid:\t", nr); 218 if (nr > 0) { 219 int i; 220 221 /* If nr is non-zero it means that 'pid' is valid and that 222 * ns, i.e. the pid namespace associated with the procfs 223 * instance, is in the pid namespace hierarchy of pid. 224 * Start at one below the already printed level. 225 */ 226 for (i = ns->level + 1; i <= pid->level; i++) 227 seq_put_decimal_ll(m, "\t", pid->numbers[i].nr); 228 } 229 #endif 230 seq_putc(m, '\n'); 231 } 232 #endif 233 234 /* 235 * Poll support for process exit notification. 236 */ 237 static __poll_t pidfd_poll(struct file *file, struct poll_table_struct *pts) 238 { 239 struct pid *pid = pidfd_pid(file); 240 struct task_struct *task; 241 __poll_t poll_flags = 0; 242 243 poll_wait(file, &pid->wait_pidfd, pts); 244 /* 245 * Don't wake waiters if the thread-group leader exited 246 * prematurely. They either get notified when the last subthread 247 * exits or not at all if one of the remaining subthreads execs 248 * and assumes the struct pid of the old thread-group leader. 249 */ 250 guard(rcu)(); 251 task = pid_task(pid, PIDTYPE_PID); 252 if (!task) 253 poll_flags = EPOLLIN | EPOLLRDNORM | EPOLLHUP; 254 else if (task->exit_state && !delay_group_leader(task)) 255 poll_flags = EPOLLIN | EPOLLRDNORM; 256 257 return poll_flags; 258 } 259 260 static inline bool pid_in_current_pidns(const struct pid *pid) 261 { 262 const struct pid_namespace *ns = task_active_pid_ns(current); 263 264 if (ns->level <= pid->level) 265 return pid->numbers[ns->level].ns == ns; 266 267 return false; 268 } 269 270 static __u32 pidfs_coredump_mask(unsigned long mm_flags) 271 { 272 switch (__get_dumpable(mm_flags)) { 273 case SUID_DUMP_USER: 274 return PIDFD_COREDUMP_USER; 275 case SUID_DUMP_ROOT: 276 return PIDFD_COREDUMP_ROOT; 277 case SUID_DUMP_DISABLE: 278 return PIDFD_COREDUMP_SKIP; 279 default: 280 WARN_ON_ONCE(true); 281 } 282 283 return 0; 284 } 285 286 static long pidfd_info(struct file *file, unsigned int cmd, unsigned long arg) 287 { 288 struct pidfd_info __user *uinfo = (struct pidfd_info __user *)arg; 289 struct pid *pid = pidfd_pid(file); 290 size_t usize = _IOC_SIZE(cmd); 291 struct pidfd_info kinfo = {}; 292 struct pidfs_exit_info *exit_info; 293 struct user_namespace *user_ns; 294 struct task_struct *task; 295 struct pidfs_attr *attr; 296 const struct cred *c; 297 __u64 mask; 298 299 if (!uinfo) 300 return -EINVAL; 301 if (usize < PIDFD_INFO_SIZE_VER0) 302 return -EINVAL; /* First version, no smaller struct possible */ 303 304 if (copy_from_user(&mask, &uinfo->mask, sizeof(mask))) 305 return -EFAULT; 306 307 /* 308 * Restrict information retrieval to tasks within the caller's pid 309 * namespace hierarchy. 310 */ 311 if (!pid_in_current_pidns(pid)) 312 return -ESRCH; 313 314 attr = READ_ONCE(pid->attr); 315 if (mask & PIDFD_INFO_EXIT) { 316 exit_info = READ_ONCE(attr->exit_info); 317 if (exit_info) { 318 kinfo.mask |= PIDFD_INFO_EXIT; 319 #ifdef CONFIG_CGROUPS 320 kinfo.cgroupid = exit_info->cgroupid; 321 kinfo.mask |= PIDFD_INFO_CGROUPID; 322 #endif 323 kinfo.exit_code = exit_info->exit_code; 324 } 325 } 326 327 if (mask & PIDFD_INFO_COREDUMP) { 328 kinfo.mask |= PIDFD_INFO_COREDUMP; 329 kinfo.coredump_mask = READ_ONCE(attr->__pei.coredump_mask); 330 } 331 332 task = get_pid_task(pid, PIDTYPE_PID); 333 if (!task) { 334 /* 335 * If the task has already been reaped, only exit 336 * information is available 337 */ 338 if (!(mask & PIDFD_INFO_EXIT)) 339 return -ESRCH; 340 341 goto copy_out; 342 } 343 344 c = get_task_cred(task); 345 if (!c) 346 return -ESRCH; 347 348 if (!(kinfo.mask & PIDFD_INFO_COREDUMP)) { 349 task_lock(task); 350 if (task->mm) 351 kinfo.coredump_mask = pidfs_coredump_mask(task->mm->flags); 352 task_unlock(task); 353 } 354 355 /* Unconditionally return identifiers and credentials, the rest only on request */ 356 357 user_ns = current_user_ns(); 358 kinfo.ruid = from_kuid_munged(user_ns, c->uid); 359 kinfo.rgid = from_kgid_munged(user_ns, c->gid); 360 kinfo.euid = from_kuid_munged(user_ns, c->euid); 361 kinfo.egid = from_kgid_munged(user_ns, c->egid); 362 kinfo.suid = from_kuid_munged(user_ns, c->suid); 363 kinfo.sgid = from_kgid_munged(user_ns, c->sgid); 364 kinfo.fsuid = from_kuid_munged(user_ns, c->fsuid); 365 kinfo.fsgid = from_kgid_munged(user_ns, c->fsgid); 366 kinfo.mask |= PIDFD_INFO_CREDS; 367 put_cred(c); 368 369 #ifdef CONFIG_CGROUPS 370 if (!kinfo.cgroupid) { 371 struct cgroup *cgrp; 372 373 rcu_read_lock(); 374 cgrp = task_dfl_cgroup(task); 375 kinfo.cgroupid = cgroup_id(cgrp); 376 kinfo.mask |= PIDFD_INFO_CGROUPID; 377 rcu_read_unlock(); 378 } 379 #endif 380 381 /* 382 * Copy pid/tgid last, to reduce the chances the information might be 383 * stale. Note that it is not possible to ensure it will be valid as the 384 * task might return as soon as the copy_to_user finishes, but that's ok 385 * and userspace expects that might happen and can act accordingly, so 386 * this is just best-effort. What we can do however is checking that all 387 * the fields are set correctly, or return ESRCH to avoid providing 388 * incomplete information. */ 389 390 kinfo.ppid = task_ppid_nr_ns(task, NULL); 391 kinfo.tgid = task_tgid_vnr(task); 392 kinfo.pid = task_pid_vnr(task); 393 kinfo.mask |= PIDFD_INFO_PID; 394 395 if (kinfo.pid == 0 || kinfo.tgid == 0 || (kinfo.ppid == 0 && kinfo.pid != 1)) 396 return -ESRCH; 397 398 copy_out: 399 /* 400 * If userspace and the kernel have the same struct size it can just 401 * be copied. If userspace provides an older struct, only the bits that 402 * userspace knows about will be copied. If userspace provides a new 403 * struct, only the bits that the kernel knows about will be copied. 404 */ 405 return copy_struct_to_user(uinfo, usize, &kinfo, sizeof(kinfo), NULL); 406 } 407 408 static bool pidfs_ioctl_valid(unsigned int cmd) 409 { 410 switch (cmd) { 411 case FS_IOC_GETVERSION: 412 case PIDFD_GET_CGROUP_NAMESPACE: 413 case PIDFD_GET_IPC_NAMESPACE: 414 case PIDFD_GET_MNT_NAMESPACE: 415 case PIDFD_GET_NET_NAMESPACE: 416 case PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE: 417 case PIDFD_GET_TIME_NAMESPACE: 418 case PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE: 419 case PIDFD_GET_UTS_NAMESPACE: 420 case PIDFD_GET_USER_NAMESPACE: 421 case PIDFD_GET_PID_NAMESPACE: 422 return true; 423 } 424 425 /* Extensible ioctls require some more careful checks. */ 426 switch (_IOC_NR(cmd)) { 427 case _IOC_NR(PIDFD_GET_INFO): 428 /* 429 * Try to prevent performing a pidfd ioctl when someone 430 * erronously mistook the file descriptor for a pidfd. 431 * This is not perfect but will catch most cases. 432 */ 433 return (_IOC_TYPE(cmd) == _IOC_TYPE(PIDFD_GET_INFO)); 434 } 435 436 return false; 437 } 438 439 static long pidfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 440 { 441 struct task_struct *task __free(put_task) = NULL; 442 struct nsproxy *nsp __free(put_nsproxy) = NULL; 443 struct ns_common *ns_common = NULL; 444 struct pid_namespace *pid_ns; 445 446 if (!pidfs_ioctl_valid(cmd)) 447 return -ENOIOCTLCMD; 448 449 if (cmd == FS_IOC_GETVERSION) { 450 if (!arg) 451 return -EINVAL; 452 453 __u32 __user *argp = (__u32 __user *)arg; 454 return put_user(file_inode(file)->i_generation, argp); 455 } 456 457 /* Extensible IOCTL that does not open namespace FDs, take a shortcut */ 458 if (_IOC_NR(cmd) == _IOC_NR(PIDFD_GET_INFO)) 459 return pidfd_info(file, cmd, arg); 460 461 task = get_pid_task(pidfd_pid(file), PIDTYPE_PID); 462 if (!task) 463 return -ESRCH; 464 465 if (arg) 466 return -EINVAL; 467 468 scoped_guard(task_lock, task) { 469 nsp = task->nsproxy; 470 if (nsp) 471 get_nsproxy(nsp); 472 } 473 if (!nsp) 474 return -ESRCH; /* just pretend it didn't exist */ 475 476 /* 477 * We're trying to open a file descriptor to the namespace so perform a 478 * filesystem cred ptrace check. Also, we mirror nsfs behavior. 479 */ 480 if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) 481 return -EACCES; 482 483 switch (cmd) { 484 /* Namespaces that hang of nsproxy. */ 485 case PIDFD_GET_CGROUP_NAMESPACE: 486 if (IS_ENABLED(CONFIG_CGROUPS)) { 487 get_cgroup_ns(nsp->cgroup_ns); 488 ns_common = to_ns_common(nsp->cgroup_ns); 489 } 490 break; 491 case PIDFD_GET_IPC_NAMESPACE: 492 if (IS_ENABLED(CONFIG_IPC_NS)) { 493 get_ipc_ns(nsp->ipc_ns); 494 ns_common = to_ns_common(nsp->ipc_ns); 495 } 496 break; 497 case PIDFD_GET_MNT_NAMESPACE: 498 get_mnt_ns(nsp->mnt_ns); 499 ns_common = to_ns_common(nsp->mnt_ns); 500 break; 501 case PIDFD_GET_NET_NAMESPACE: 502 if (IS_ENABLED(CONFIG_NET_NS)) { 503 ns_common = to_ns_common(nsp->net_ns); 504 get_net_ns(ns_common); 505 } 506 break; 507 case PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE: 508 if (IS_ENABLED(CONFIG_PID_NS)) { 509 get_pid_ns(nsp->pid_ns_for_children); 510 ns_common = to_ns_common(nsp->pid_ns_for_children); 511 } 512 break; 513 case PIDFD_GET_TIME_NAMESPACE: 514 if (IS_ENABLED(CONFIG_TIME_NS)) { 515 get_time_ns(nsp->time_ns); 516 ns_common = to_ns_common(nsp->time_ns); 517 } 518 break; 519 case PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE: 520 if (IS_ENABLED(CONFIG_TIME_NS)) { 521 get_time_ns(nsp->time_ns_for_children); 522 ns_common = to_ns_common(nsp->time_ns_for_children); 523 } 524 break; 525 case PIDFD_GET_UTS_NAMESPACE: 526 if (IS_ENABLED(CONFIG_UTS_NS)) { 527 get_uts_ns(nsp->uts_ns); 528 ns_common = to_ns_common(nsp->uts_ns); 529 } 530 break; 531 /* Namespaces that don't hang of nsproxy. */ 532 case PIDFD_GET_USER_NAMESPACE: 533 if (IS_ENABLED(CONFIG_USER_NS)) { 534 rcu_read_lock(); 535 ns_common = to_ns_common(get_user_ns(task_cred_xxx(task, user_ns))); 536 rcu_read_unlock(); 537 } 538 break; 539 case PIDFD_GET_PID_NAMESPACE: 540 if (IS_ENABLED(CONFIG_PID_NS)) { 541 rcu_read_lock(); 542 pid_ns = task_active_pid_ns(task); 543 if (pid_ns) 544 ns_common = to_ns_common(get_pid_ns(pid_ns)); 545 rcu_read_unlock(); 546 } 547 break; 548 default: 549 return -ENOIOCTLCMD; 550 } 551 552 if (!ns_common) 553 return -EOPNOTSUPP; 554 555 /* open_namespace() unconditionally consumes the reference */ 556 return open_namespace(ns_common); 557 } 558 559 static const struct file_operations pidfs_file_operations = { 560 .poll = pidfd_poll, 561 #ifdef CONFIG_PROC_FS 562 .show_fdinfo = pidfd_show_fdinfo, 563 #endif 564 .unlocked_ioctl = pidfd_ioctl, 565 .compat_ioctl = compat_ptr_ioctl, 566 }; 567 568 struct pid *pidfd_pid(const struct file *file) 569 { 570 if (file->f_op != &pidfs_file_operations) 571 return ERR_PTR(-EBADF); 572 return file_inode(file)->i_private; 573 } 574 575 /* 576 * We're called from release_task(). We know there's at least one 577 * reference to struct pid being held that won't be released until the 578 * task has been reaped which cannot happen until we're out of 579 * release_task(). 580 * 581 * If this struct pid has at least once been referred to by a pidfd then 582 * pid->attr will be allocated. If not we mark the struct pid as dead so 583 * anyone who is trying to register it with pidfs will fail to do so. 584 * Otherwise we would hand out pidfs for reaped tasks without having 585 * exit information available. 586 * 587 * Worst case is that we've filled in the info and the pid gets freed 588 * right away in free_pid() when no one holds a pidfd anymore. Since 589 * pidfs_exit() currently is placed after exit_task_work() we know that 590 * it cannot be us aka the exiting task holding a pidfd to itself. 591 */ 592 void pidfs_exit(struct task_struct *tsk) 593 { 594 struct pid *pid = task_pid(tsk); 595 struct pidfs_attr *attr; 596 struct pidfs_exit_info *exit_info; 597 #ifdef CONFIG_CGROUPS 598 struct cgroup *cgrp; 599 #endif 600 601 might_sleep(); 602 603 guard(spinlock_irq)(&pid->wait_pidfd.lock); 604 attr = pid->attr; 605 if (!attr) { 606 /* 607 * No one ever held a pidfd for this struct pid. 608 * Mark it as dead so no one can add a pidfs 609 * entry anymore. We're about to be reaped and 610 * so no exit information would be available. 611 */ 612 pid->attr = PIDFS_PID_DEAD; 613 return; 614 } 615 616 /* 617 * If @pid->attr is set someone might still legitimately hold a 618 * pidfd to @pid or someone might concurrently still be getting 619 * a reference to an already stashed dentry from @pid->stashed. 620 * So defer cleaning @pid->attr until the last reference to @pid 621 * is put 622 */ 623 624 exit_info = &attr->__pei; 625 626 #ifdef CONFIG_CGROUPS 627 rcu_read_lock(); 628 cgrp = task_dfl_cgroup(tsk); 629 exit_info->cgroupid = cgroup_id(cgrp); 630 rcu_read_unlock(); 631 #endif 632 exit_info->exit_code = tsk->exit_code; 633 634 /* Ensure that PIDFD_GET_INFO sees either all or nothing. */ 635 smp_store_release(&attr->exit_info, &attr->__pei); 636 } 637 638 #ifdef CONFIG_COREDUMP 639 void pidfs_coredump(const struct coredump_params *cprm) 640 { 641 struct pid *pid = cprm->pid; 642 struct pidfs_exit_info *exit_info; 643 struct pidfs_attr *attr; 644 __u32 coredump_mask = 0; 645 646 attr = READ_ONCE(pid->attr); 647 648 VFS_WARN_ON_ONCE(!attr); 649 VFS_WARN_ON_ONCE(attr == PIDFS_PID_DEAD); 650 651 exit_info = &attr->__pei; 652 /* Note how we were coredumped. */ 653 coredump_mask = pidfs_coredump_mask(cprm->mm_flags); 654 /* Note that we actually did coredump. */ 655 coredump_mask |= PIDFD_COREDUMPED; 656 /* If coredumping is set to skip we should never end up here. */ 657 VFS_WARN_ON_ONCE(coredump_mask & PIDFD_COREDUMP_SKIP); 658 smp_store_release(&exit_info->coredump_mask, coredump_mask); 659 } 660 #endif 661 662 static struct vfsmount *pidfs_mnt __ro_after_init; 663 664 /* 665 * The vfs falls back to simple_setattr() if i_op->setattr() isn't 666 * implemented. Let's reject it completely until we have a clean 667 * permission concept for pidfds. 668 */ 669 static int pidfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, 670 struct iattr *attr) 671 { 672 return anon_inode_setattr(idmap, dentry, attr); 673 } 674 675 static int pidfs_getattr(struct mnt_idmap *idmap, const struct path *path, 676 struct kstat *stat, u32 request_mask, 677 unsigned int query_flags) 678 { 679 return anon_inode_getattr(idmap, path, stat, request_mask, query_flags); 680 } 681 682 static ssize_t pidfs_listxattr(struct dentry *dentry, char *buf, size_t size) 683 { 684 struct inode *inode = d_inode(dentry); 685 struct pid *pid = inode->i_private; 686 struct pidfs_attr *attr = pid->attr; 687 struct simple_xattrs *xattrs; 688 689 xattrs = READ_ONCE(attr->xattrs); 690 if (!xattrs) 691 return 0; 692 693 return simple_xattr_list(inode, xattrs, buf, size); 694 } 695 696 static const struct inode_operations pidfs_inode_operations = { 697 .getattr = pidfs_getattr, 698 .setattr = pidfs_setattr, 699 .listxattr = pidfs_listxattr, 700 }; 701 702 static void pidfs_evict_inode(struct inode *inode) 703 { 704 struct pid *pid = inode->i_private; 705 706 clear_inode(inode); 707 put_pid(pid); 708 } 709 710 static const struct super_operations pidfs_sops = { 711 .drop_inode = generic_delete_inode, 712 .evict_inode = pidfs_evict_inode, 713 .statfs = simple_statfs, 714 }; 715 716 /* 717 * 'lsof' has knowledge of out historical anon_inode use, and expects 718 * the pidfs dentry name to start with 'anon_inode'. 719 */ 720 static char *pidfs_dname(struct dentry *dentry, char *buffer, int buflen) 721 { 722 return dynamic_dname(buffer, buflen, "anon_inode:[pidfd]"); 723 } 724 725 const struct dentry_operations pidfs_dentry_operations = { 726 .d_dname = pidfs_dname, 727 .d_prune = stashed_dentry_prune, 728 }; 729 730 static int pidfs_encode_fh(struct inode *inode, u32 *fh, int *max_len, 731 struct inode *parent) 732 { 733 const struct pid *pid = inode->i_private; 734 735 if (*max_len < 2) { 736 *max_len = 2; 737 return FILEID_INVALID; 738 } 739 740 *max_len = 2; 741 *(u64 *)fh = pid->ino; 742 return FILEID_KERNFS; 743 } 744 745 static int pidfs_ino_find(const void *key, const struct rb_node *node) 746 { 747 const u64 pid_ino = *(u64 *)key; 748 const struct pid *pid = rb_entry(node, struct pid, pidfs_node); 749 750 if (pid_ino < pid->ino) 751 return -1; 752 if (pid_ino > pid->ino) 753 return 1; 754 return 0; 755 } 756 757 /* Find a struct pid based on the inode number. */ 758 static struct pid *pidfs_ino_get_pid(u64 ino) 759 { 760 struct pid *pid; 761 struct rb_node *node; 762 unsigned int seq; 763 764 guard(rcu)(); 765 do { 766 seq = read_seqcount_begin(&pidmap_lock_seq); 767 node = rb_find_rcu(&ino, &pidfs_ino_tree, pidfs_ino_find); 768 if (node) 769 break; 770 } while (read_seqcount_retry(&pidmap_lock_seq, seq)); 771 772 if (!node) 773 return NULL; 774 775 pid = rb_entry(node, struct pid, pidfs_node); 776 777 /* Within our pid namespace hierarchy? */ 778 if (pid_vnr(pid) == 0) 779 return NULL; 780 781 return get_pid(pid); 782 } 783 784 static struct dentry *pidfs_fh_to_dentry(struct super_block *sb, 785 struct fid *fid, int fh_len, 786 int fh_type) 787 { 788 int ret; 789 u64 pid_ino; 790 struct path path; 791 struct pid *pid; 792 793 if (fh_len < 2) 794 return NULL; 795 796 switch (fh_type) { 797 case FILEID_KERNFS: 798 pid_ino = *(u64 *)fid; 799 break; 800 default: 801 return NULL; 802 } 803 804 pid = pidfs_ino_get_pid(pid_ino); 805 if (!pid) 806 return NULL; 807 808 ret = path_from_stashed(&pid->stashed, pidfs_mnt, pid, &path); 809 if (ret < 0) 810 return ERR_PTR(ret); 811 812 mntput(path.mnt); 813 return path.dentry; 814 } 815 816 /* 817 * Make sure that we reject any nonsensical flags that users pass via 818 * open_by_handle_at(). Note that PIDFD_THREAD is defined as O_EXCL, and 819 * PIDFD_NONBLOCK as O_NONBLOCK. 820 */ 821 #define VALID_FILE_HANDLE_OPEN_FLAGS \ 822 (O_RDONLY | O_WRONLY | O_RDWR | O_NONBLOCK | O_CLOEXEC | O_EXCL) 823 824 static int pidfs_export_permission(struct handle_to_path_ctx *ctx, 825 unsigned int oflags) 826 { 827 if (oflags & ~(VALID_FILE_HANDLE_OPEN_FLAGS | O_LARGEFILE)) 828 return -EINVAL; 829 830 /* 831 * pidfd_ino_get_pid() will verify that the struct pid is part 832 * of the caller's pid namespace hierarchy. No further 833 * permission checks are needed. 834 */ 835 return 0; 836 } 837 838 static struct file *pidfs_export_open(struct path *path, unsigned int oflags) 839 { 840 /* 841 * Clear O_LARGEFILE as open_by_handle_at() forces it and raise 842 * O_RDWR as pidfds always are. 843 */ 844 oflags &= ~O_LARGEFILE; 845 return dentry_open(path, oflags | O_RDWR, current_cred()); 846 } 847 848 static const struct export_operations pidfs_export_operations = { 849 .encode_fh = pidfs_encode_fh, 850 .fh_to_dentry = pidfs_fh_to_dentry, 851 .open = pidfs_export_open, 852 .permission = pidfs_export_permission, 853 }; 854 855 static int pidfs_init_inode(struct inode *inode, void *data) 856 { 857 const struct pid *pid = data; 858 859 inode->i_private = data; 860 inode->i_flags |= S_PRIVATE | S_ANON_INODE; 861 /* We allow to set xattrs. */ 862 inode->i_flags &= ~S_IMMUTABLE; 863 inode->i_mode |= S_IRWXU; 864 inode->i_op = &pidfs_inode_operations; 865 inode->i_fop = &pidfs_file_operations; 866 inode->i_ino = pidfs_ino(pid->ino); 867 inode->i_generation = pidfs_gen(pid->ino); 868 return 0; 869 } 870 871 static void pidfs_put_data(void *data) 872 { 873 struct pid *pid = data; 874 put_pid(pid); 875 } 876 877 /** 878 * pidfs_register_pid - register a struct pid in pidfs 879 * @pid: pid to pin 880 * 881 * Register a struct pid in pidfs. 882 * 883 * Return: On success zero, on error a negative error code is returned. 884 */ 885 int pidfs_register_pid(struct pid *pid) 886 { 887 struct pidfs_attr *new_attr __free(kfree) = NULL; 888 struct pidfs_attr *attr; 889 890 might_sleep(); 891 892 if (!pid) 893 return 0; 894 895 attr = READ_ONCE(pid->attr); 896 if (unlikely(attr == PIDFS_PID_DEAD)) 897 return PTR_ERR(PIDFS_PID_DEAD); 898 if (attr) 899 return 0; 900 901 new_attr = kmem_cache_zalloc(pidfs_attr_cachep, GFP_KERNEL); 902 if (!new_attr) 903 return -ENOMEM; 904 905 /* Synchronize with pidfs_exit(). */ 906 guard(spinlock_irq)(&pid->wait_pidfd.lock); 907 908 attr = pid->attr; 909 if (unlikely(attr == PIDFS_PID_DEAD)) 910 return PTR_ERR(PIDFS_PID_DEAD); 911 if (unlikely(attr)) 912 return 0; 913 914 pid->attr = no_free_ptr(new_attr); 915 return 0; 916 } 917 918 static struct dentry *pidfs_stash_dentry(struct dentry **stashed, 919 struct dentry *dentry) 920 { 921 int ret; 922 struct pid *pid = d_inode(dentry)->i_private; 923 924 VFS_WARN_ON_ONCE(stashed != &pid->stashed); 925 926 ret = pidfs_register_pid(pid); 927 if (ret) 928 return ERR_PTR(ret); 929 930 return stash_dentry(stashed, dentry); 931 } 932 933 static const struct stashed_operations pidfs_stashed_ops = { 934 .stash_dentry = pidfs_stash_dentry, 935 .init_inode = pidfs_init_inode, 936 .put_data = pidfs_put_data, 937 }; 938 939 static int pidfs_xattr_get(const struct xattr_handler *handler, 940 struct dentry *unused, struct inode *inode, 941 const char *suffix, void *value, size_t size) 942 { 943 struct pid *pid = inode->i_private; 944 struct pidfs_attr *attr = pid->attr; 945 const char *name; 946 struct simple_xattrs *xattrs; 947 948 xattrs = READ_ONCE(attr->xattrs); 949 if (!xattrs) 950 return 0; 951 952 name = xattr_full_name(handler, suffix); 953 return simple_xattr_get(xattrs, name, value, size); 954 } 955 956 static int pidfs_xattr_set(const struct xattr_handler *handler, 957 struct mnt_idmap *idmap, struct dentry *unused, 958 struct inode *inode, const char *suffix, 959 const void *value, size_t size, int flags) 960 { 961 struct pid *pid = inode->i_private; 962 struct pidfs_attr *attr = pid->attr; 963 const char *name; 964 struct simple_xattrs *xattrs; 965 struct simple_xattr *old_xattr; 966 967 /* Ensure we're the only one to set @attr->xattrs. */ 968 WARN_ON_ONCE(!inode_is_locked(inode)); 969 970 xattrs = READ_ONCE(attr->xattrs); 971 if (!xattrs) { 972 xattrs = kmem_cache_zalloc(pidfs_xattr_cachep, GFP_KERNEL); 973 if (!xattrs) 974 return -ENOMEM; 975 976 simple_xattrs_init(xattrs); 977 smp_store_release(&pid->attr->xattrs, xattrs); 978 } 979 980 name = xattr_full_name(handler, suffix); 981 old_xattr = simple_xattr_set(xattrs, name, value, size, flags); 982 if (IS_ERR(old_xattr)) 983 return PTR_ERR(old_xattr); 984 985 simple_xattr_free(old_xattr); 986 return 0; 987 } 988 989 static const struct xattr_handler pidfs_trusted_xattr_handler = { 990 .prefix = XATTR_TRUSTED_PREFIX, 991 .get = pidfs_xattr_get, 992 .set = pidfs_xattr_set, 993 }; 994 995 static const struct xattr_handler *const pidfs_xattr_handlers[] = { 996 &pidfs_trusted_xattr_handler, 997 NULL 998 }; 999 1000 static int pidfs_init_fs_context(struct fs_context *fc) 1001 { 1002 struct pseudo_fs_context *ctx; 1003 1004 ctx = init_pseudo(fc, PID_FS_MAGIC); 1005 if (!ctx) 1006 return -ENOMEM; 1007 1008 fc->s_iflags |= SB_I_NOEXEC; 1009 fc->s_iflags |= SB_I_NODEV; 1010 ctx->ops = &pidfs_sops; 1011 ctx->eops = &pidfs_export_operations; 1012 ctx->dops = &pidfs_dentry_operations; 1013 ctx->xattr = pidfs_xattr_handlers; 1014 fc->s_fs_info = (void *)&pidfs_stashed_ops; 1015 return 0; 1016 } 1017 1018 static struct file_system_type pidfs_type = { 1019 .name = "pidfs", 1020 .init_fs_context = pidfs_init_fs_context, 1021 .kill_sb = kill_anon_super, 1022 }; 1023 1024 struct file *pidfs_alloc_file(struct pid *pid, unsigned int flags) 1025 { 1026 struct file *pidfd_file; 1027 struct path path __free(path_put) = {}; 1028 int ret; 1029 1030 /* 1031 * Ensure that PIDFD_STALE can be passed as a flag without 1032 * overloading other uapi pidfd flags. 1033 */ 1034 BUILD_BUG_ON(PIDFD_STALE == PIDFD_THREAD); 1035 BUILD_BUG_ON(PIDFD_STALE == PIDFD_NONBLOCK); 1036 1037 ret = path_from_stashed(&pid->stashed, pidfs_mnt, get_pid(pid), &path); 1038 if (ret < 0) 1039 return ERR_PTR(ret); 1040 1041 flags &= ~PIDFD_STALE; 1042 flags |= O_RDWR; 1043 pidfd_file = dentry_open(&path, flags, current_cred()); 1044 /* Raise PIDFD_THREAD explicitly as do_dentry_open() strips it. */ 1045 if (!IS_ERR(pidfd_file)) 1046 pidfd_file->f_flags |= (flags & PIDFD_THREAD); 1047 1048 return pidfd_file; 1049 } 1050 1051 void __init pidfs_init(void) 1052 { 1053 pidfs_attr_cachep = kmem_cache_create("pidfs_attr_cache", sizeof(struct pidfs_attr), 0, 1054 (SLAB_HWCACHE_ALIGN | SLAB_RECLAIM_ACCOUNT | 1055 SLAB_ACCOUNT | SLAB_PANIC), NULL); 1056 1057 pidfs_xattr_cachep = kmem_cache_create("pidfs_xattr_cache", 1058 sizeof(struct simple_xattrs), 0, 1059 (SLAB_HWCACHE_ALIGN | SLAB_RECLAIM_ACCOUNT | 1060 SLAB_ACCOUNT | SLAB_PANIC), NULL); 1061 1062 pidfs_mnt = kern_mount(&pidfs_type); 1063 if (IS_ERR(pidfs_mnt)) 1064 panic("Failed to mount pidfs pseudo filesystem"); 1065 } 1066