1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/anon_inodes.h> 3 #include <linux/exportfs.h> 4 #include <linux/file.h> 5 #include <linux/fs.h> 6 #include <linux/cgroup.h> 7 #include <linux/magic.h> 8 #include <linux/mount.h> 9 #include <linux/pid.h> 10 #include <linux/pidfs.h> 11 #include <linux/sched/signal.h> 12 #include <linux/signal.h> 13 #include <linux/pid_namespace.h> 14 #include <linux/poll.h> 15 #include <linux/proc_fs.h> 16 #include <linux/proc_ns.h> 17 #include <linux/pseudo_fs.h> 18 #include <linux/ptrace.h> 19 #include <linux/seq_file.h> 20 #include <uapi/linux/pidfd.h> 21 #include <linux/ipc_namespace.h> 22 #include <linux/time_namespace.h> 23 #include <linux/utsname.h> 24 #include <net/net_namespace.h> 25 #include <linux/coredump.h> 26 #include <linux/rhashtable.h> 27 #include <linux/xattr.h> 28 #include <linux/cookie.h> 29 30 #include "internal.h" 31 #include "mount.h" 32 33 #define PIDFS_PID_DEAD ERR_PTR(-ESRCH) 34 35 static struct kmem_cache *pidfs_attr_cachep __ro_after_init; 36 static struct kmem_cache *pidfs_xattr_cachep __ro_after_init; 37 38 static struct path pidfs_root_path = {}; 39 40 void pidfs_get_root(struct path *path) 41 { 42 *path = pidfs_root_path; 43 path_get(path); 44 } 45 46 enum pidfs_attr_mask_bits { 47 PIDFS_ATTR_BIT_EXIT = 0, 48 PIDFS_ATTR_BIT_COREDUMP = 1, 49 }; 50 51 struct pidfs_attr { 52 unsigned long attr_mask; 53 struct simple_xattrs *xattrs; 54 struct /* exit info */ { 55 __u64 cgroupid; 56 __s32 exit_code; 57 }; 58 __u32 coredump_mask; 59 __u32 coredump_signal; 60 __u32 coredump_code; 61 }; 62 63 static struct rhashtable pidfs_ino_ht; 64 65 static const struct rhashtable_params pidfs_ino_ht_params = { 66 .key_offset = offsetof(struct pid, ino), 67 .key_len = sizeof(u64), 68 .head_offset = offsetof(struct pid, pidfs_hash), 69 .automatic_shrinking = true, 70 }; 71 72 /* 73 * inode number handling 74 * 75 * On 64 bit nothing special happens. The 64bit number assigned 76 * to struct pid is the inode number. 77 * 78 * On 32 bit the 64 bit number assigned to struct pid is split 79 * into two 32 bit numbers. The lower 32 bits are used as the 80 * inode number and the upper 32 bits are used as the inode 81 * generation number. 82 * 83 * On 32 bit pidfs_ino() will return the lower 32 bit. When 84 * pidfs_ino() returns zero a wrap around happened. When a 85 * wraparound happens the 64 bit number will be incremented by 1 86 * so inode numbering starts at 1 again. 87 * 88 * On 64 bit comparing two pidfds is as simple as comparing 89 * inode numbers. 90 * 91 * When a wraparound happens on 32 bit multiple pidfds with the 92 * same inode number are likely to exist (This isn't a problem 93 * since before pidfs pidfds used the anonymous inode meaning 94 * all pidfds had the same inode number.). Userspace can 95 * reconstruct the 64 bit identifier by retrieving both the 96 * inode number and the inode generation number to compare or 97 * use file handles. 98 */ 99 100 #if BITS_PER_LONG == 32 101 102 DEFINE_SPINLOCK(pidfs_ino_lock); 103 static u64 pidfs_ino_nr = 1; 104 105 static inline unsigned long pidfs_ino(u64 ino) 106 { 107 return lower_32_bits(ino); 108 } 109 110 /* On 32 bit the generation number are the upper 32 bits. */ 111 static inline u32 pidfs_gen(u64 ino) 112 { 113 return upper_32_bits(ino); 114 } 115 116 static inline u64 pidfs_alloc_ino(void) 117 { 118 u64 ino; 119 120 spin_lock(&pidfs_ino_lock); 121 if (pidfs_ino(pidfs_ino_nr) == 0) 122 pidfs_ino_nr++; 123 ino = pidfs_ino_nr++; 124 spin_unlock(&pidfs_ino_lock); 125 return ino; 126 } 127 128 #else 129 130 /* On 64 bit simply return ino. */ 131 static inline unsigned long pidfs_ino(u64 ino) 132 { 133 return ino; 134 } 135 136 /* On 64 bit the generation number is 0. */ 137 static inline u32 pidfs_gen(u64 ino) 138 { 139 return 0; 140 } 141 142 DEFINE_COOKIE(pidfs_ino_cookie); 143 144 static u64 pidfs_alloc_ino(void) 145 { 146 u64 ino; 147 148 preempt_disable(); 149 ino = gen_cookie_next(&pidfs_ino_cookie); 150 preempt_enable(); 151 152 VFS_WARN_ON_ONCE(ino < 1); 153 return ino; 154 } 155 156 #endif 157 158 void pidfs_prepare_pid(struct pid *pid) 159 { 160 pid->stashed = NULL; 161 pid->attr = NULL; 162 pid->ino = 0; 163 } 164 165 int pidfs_add_pid(struct pid *pid) 166 { 167 int ret; 168 169 pid->ino = pidfs_alloc_ino(); 170 ret = rhashtable_insert_fast(&pidfs_ino_ht, &pid->pidfs_hash, 171 pidfs_ino_ht_params); 172 if (unlikely(ret)) 173 pid->ino = 0; 174 return ret; 175 } 176 177 void pidfs_remove_pid(struct pid *pid) 178 { 179 if (likely(pid->ino)) 180 rhashtable_remove_fast(&pidfs_ino_ht, &pid->pidfs_hash, 181 pidfs_ino_ht_params); 182 } 183 184 void pidfs_free_pid(struct pid *pid) 185 { 186 struct pidfs_attr *attr __free(kfree) = no_free_ptr(pid->attr); 187 struct simple_xattrs *xattrs __free(kfree) = NULL; 188 189 /* 190 * Any dentry must've been wiped from the pid by now. 191 * Otherwise there's a reference count bug. 192 */ 193 VFS_WARN_ON_ONCE(pid->stashed); 194 195 /* 196 * This if an error occurred during e.g., task creation that 197 * causes us to never go through the exit path. 198 */ 199 if (unlikely(!attr)) 200 return; 201 202 /* This never had a pidfd created. */ 203 if (IS_ERR(attr)) 204 return; 205 206 xattrs = no_free_ptr(attr->xattrs); 207 if (xattrs) 208 simple_xattrs_free(xattrs, NULL); 209 } 210 211 #ifdef CONFIG_PROC_FS 212 /** 213 * pidfd_show_fdinfo - print information about a pidfd 214 * @m: proc fdinfo file 215 * @f: file referencing a pidfd 216 * 217 * Pid: 218 * This function will print the pid that a given pidfd refers to in the 219 * pid namespace of the procfs instance. 220 * If the pid namespace of the process is not a descendant of the pid 221 * namespace of the procfs instance 0 will be shown as its pid. This is 222 * similar to calling getppid() on a process whose parent is outside of 223 * its pid namespace. 224 * 225 * NSpid: 226 * If pid namespaces are supported then this function will also print 227 * the pid of a given pidfd refers to for all descendant pid namespaces 228 * starting from the current pid namespace of the instance, i.e. the 229 * Pid field and the first entry in the NSpid field will be identical. 230 * If the pid namespace of the process is not a descendant of the pid 231 * namespace of the procfs instance 0 will be shown as its first NSpid 232 * entry and no others will be shown. 233 * Note that this differs from the Pid and NSpid fields in 234 * /proc/<pid>/status where Pid and NSpid are always shown relative to 235 * the pid namespace of the procfs instance. The difference becomes 236 * obvious when sending around a pidfd between pid namespaces from a 237 * different branch of the tree, i.e. where no ancestral relation is 238 * present between the pid namespaces: 239 * - create two new pid namespaces ns1 and ns2 in the initial pid 240 * namespace (also take care to create new mount namespaces in the 241 * new pid namespace and mount procfs) 242 * - create a process with a pidfd in ns1 243 * - send pidfd from ns1 to ns2 244 * - read /proc/self/fdinfo/<pidfd> and observe that both Pid and NSpid 245 * have exactly one entry, which is 0 246 */ 247 static void pidfd_show_fdinfo(struct seq_file *m, struct file *f) 248 { 249 struct pid *pid = pidfd_pid(f); 250 struct pid_namespace *ns; 251 pid_t nr = -1; 252 253 if (likely(pid_has_task(pid, PIDTYPE_PID))) { 254 ns = proc_pid_ns(file_inode(m->file)->i_sb); 255 nr = pid_nr_ns(pid, ns); 256 } 257 258 seq_put_decimal_ll(m, "Pid:\t", nr); 259 260 #ifdef CONFIG_PID_NS 261 seq_put_decimal_ll(m, "\nNSpid:\t", nr); 262 if (nr > 0) { 263 int i; 264 265 /* If nr is non-zero it means that 'pid' is valid and that 266 * ns, i.e. the pid namespace associated with the procfs 267 * instance, is in the pid namespace hierarchy of pid. 268 * Start at one below the already printed level. 269 */ 270 for (i = ns->level + 1; i <= pid->level; i++) 271 seq_put_decimal_ll(m, "\t", pid->numbers[i].nr); 272 } 273 #endif 274 seq_putc(m, '\n'); 275 } 276 #endif 277 278 /* 279 * Poll support for process exit notification. 280 */ 281 static __poll_t pidfd_poll(struct file *file, struct poll_table_struct *pts) 282 { 283 struct pid *pid = pidfd_pid(file); 284 struct task_struct *task; 285 __poll_t poll_flags = 0; 286 287 poll_wait(file, &pid->wait_pidfd, pts); 288 /* 289 * Don't wake waiters if the thread-group leader exited 290 * prematurely. They either get notified when the last subthread 291 * exits or not at all if one of the remaining subthreads execs 292 * and assumes the struct pid of the old thread-group leader. 293 */ 294 guard(rcu)(); 295 task = pid_task(pid, PIDTYPE_PID); 296 if (!task) 297 poll_flags = EPOLLIN | EPOLLRDNORM | EPOLLHUP; 298 else if (task->exit_state && !delay_group_leader(task)) 299 poll_flags = EPOLLIN | EPOLLRDNORM; 300 301 return poll_flags; 302 } 303 304 static inline bool pid_in_current_pidns(const struct pid *pid) 305 { 306 const struct pid_namespace *ns = task_active_pid_ns(current); 307 308 if (ns->level <= pid->level) 309 return pid->numbers[ns->level].ns == ns; 310 311 return false; 312 } 313 314 static __u32 pidfs_coredump_mask(unsigned long mm_flags) 315 { 316 switch (__get_dumpable(mm_flags)) { 317 case SUID_DUMP_USER: 318 return PIDFD_COREDUMP_USER; 319 case SUID_DUMP_ROOT: 320 return PIDFD_COREDUMP_ROOT; 321 case SUID_DUMP_DISABLE: 322 return PIDFD_COREDUMP_SKIP; 323 default: 324 WARN_ON_ONCE(true); 325 } 326 327 return 0; 328 } 329 330 /* This must be updated whenever a new flag is added */ 331 #define PIDFD_INFO_SUPPORTED (PIDFD_INFO_PID | \ 332 PIDFD_INFO_CREDS | \ 333 PIDFD_INFO_CGROUPID | \ 334 PIDFD_INFO_EXIT | \ 335 PIDFD_INFO_COREDUMP | \ 336 PIDFD_INFO_SUPPORTED_MASK | \ 337 PIDFD_INFO_COREDUMP_SIGNAL | \ 338 PIDFD_INFO_COREDUMP_CODE) 339 340 static long pidfd_info(struct file *file, unsigned int cmd, unsigned long arg) 341 { 342 struct pidfd_info __user *uinfo = (struct pidfd_info __user *)arg; 343 struct task_struct *task __free(put_task) = NULL; 344 struct pid *pid = pidfd_pid(file); 345 size_t usize = _IOC_SIZE(cmd); 346 struct pidfd_info kinfo = {}; 347 struct user_namespace *user_ns; 348 struct pidfs_attr *attr; 349 const struct cred *c; 350 __u64 mask; 351 352 BUILD_BUG_ON(sizeof(struct pidfd_info) != PIDFD_INFO_SIZE_VER3); 353 354 if (!uinfo) 355 return -EINVAL; 356 if (usize < PIDFD_INFO_SIZE_VER0) 357 return -EINVAL; /* First version, no smaller struct possible */ 358 359 if (copy_from_user(&mask, &uinfo->mask, sizeof(mask))) 360 return -EFAULT; 361 362 /* 363 * Restrict information retrieval to tasks within the caller's pid 364 * namespace hierarchy. 365 */ 366 if (!pid_in_current_pidns(pid)) 367 return -EREMOTE; 368 369 attr = READ_ONCE(pid->attr); 370 if (mask & PIDFD_INFO_EXIT) { 371 if (test_bit(PIDFS_ATTR_BIT_EXIT, &attr->attr_mask)) { 372 smp_rmb(); 373 kinfo.mask |= PIDFD_INFO_EXIT; 374 #ifdef CONFIG_CGROUPS 375 kinfo.cgroupid = attr->cgroupid; 376 kinfo.mask |= PIDFD_INFO_CGROUPID; 377 #endif 378 kinfo.exit_code = attr->exit_code; 379 } 380 } 381 382 if (mask & PIDFD_INFO_COREDUMP) { 383 if (test_bit(PIDFS_ATTR_BIT_COREDUMP, &attr->attr_mask)) { 384 smp_rmb(); 385 kinfo.mask |= PIDFD_INFO_COREDUMP | PIDFD_INFO_COREDUMP_SIGNAL | PIDFD_INFO_COREDUMP_CODE; 386 kinfo.coredump_mask = attr->coredump_mask; 387 kinfo.coredump_signal = attr->coredump_signal; 388 kinfo.coredump_code = attr->coredump_code; 389 } 390 } 391 392 task = get_pid_task(pid, PIDTYPE_PID); 393 if (!task) { 394 /* 395 * If the task has already been reaped, only exit 396 * information is available 397 */ 398 if (!(mask & PIDFD_INFO_EXIT)) 399 return -ESRCH; 400 401 goto copy_out; 402 } 403 404 c = get_task_cred(task); 405 if (!c) 406 return -ESRCH; 407 408 if ((mask & PIDFD_INFO_COREDUMP) && !kinfo.coredump_mask) { 409 guard(task_lock)(task); 410 if (task->mm) { 411 unsigned long flags = __mm_flags_get_dumpable(task->mm); 412 413 kinfo.coredump_mask = pidfs_coredump_mask(flags); 414 kinfo.mask |= PIDFD_INFO_COREDUMP; 415 /* No coredump actually took place, so no coredump signal. */ 416 } 417 } 418 419 /* Unconditionally return identifiers and credentials, the rest only on request */ 420 421 user_ns = current_user_ns(); 422 kinfo.ruid = from_kuid_munged(user_ns, c->uid); 423 kinfo.rgid = from_kgid_munged(user_ns, c->gid); 424 kinfo.euid = from_kuid_munged(user_ns, c->euid); 425 kinfo.egid = from_kgid_munged(user_ns, c->egid); 426 kinfo.suid = from_kuid_munged(user_ns, c->suid); 427 kinfo.sgid = from_kgid_munged(user_ns, c->sgid); 428 kinfo.fsuid = from_kuid_munged(user_ns, c->fsuid); 429 kinfo.fsgid = from_kgid_munged(user_ns, c->fsgid); 430 kinfo.mask |= PIDFD_INFO_CREDS; 431 put_cred(c); 432 433 #ifdef CONFIG_CGROUPS 434 if (!kinfo.cgroupid) { 435 struct cgroup *cgrp; 436 437 rcu_read_lock(); 438 cgrp = task_dfl_cgroup(task); 439 kinfo.cgroupid = cgroup_id(cgrp); 440 kinfo.mask |= PIDFD_INFO_CGROUPID; 441 rcu_read_unlock(); 442 } 443 #endif 444 445 /* 446 * Copy pid/tgid last, to reduce the chances the information might be 447 * stale. Note that it is not possible to ensure it will be valid as the 448 * task might return as soon as the copy_to_user finishes, but that's ok 449 * and userspace expects that might happen and can act accordingly, so 450 * this is just best-effort. What we can do however is checking that all 451 * the fields are set correctly, or return ESRCH to avoid providing 452 * incomplete information. */ 453 454 kinfo.ppid = task_ppid_vnr(task); 455 kinfo.tgid = task_tgid_vnr(task); 456 kinfo.pid = task_pid_vnr(task); 457 kinfo.mask |= PIDFD_INFO_PID; 458 459 if (kinfo.pid == 0 || kinfo.tgid == 0) 460 return -ESRCH; 461 462 copy_out: 463 if (mask & PIDFD_INFO_SUPPORTED_MASK) { 464 kinfo.mask |= PIDFD_INFO_SUPPORTED_MASK; 465 kinfo.supported_mask = PIDFD_INFO_SUPPORTED; 466 } 467 468 /* Are there bits in the return mask not present in PIDFD_INFO_SUPPORTED? */ 469 WARN_ON_ONCE(~PIDFD_INFO_SUPPORTED & kinfo.mask); 470 /* 471 * If userspace and the kernel have the same struct size it can just 472 * be copied. If userspace provides an older struct, only the bits that 473 * userspace knows about will be copied. If userspace provides a new 474 * struct, only the bits that the kernel knows about will be copied. 475 */ 476 return copy_struct_to_user(uinfo, usize, &kinfo, sizeof(kinfo), NULL); 477 } 478 479 static bool pidfs_ioctl_valid(unsigned int cmd) 480 { 481 switch (cmd) { 482 case FS_IOC_GETVERSION: 483 case PIDFD_GET_CGROUP_NAMESPACE: 484 case PIDFD_GET_IPC_NAMESPACE: 485 case PIDFD_GET_MNT_NAMESPACE: 486 case PIDFD_GET_NET_NAMESPACE: 487 case PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE: 488 case PIDFD_GET_TIME_NAMESPACE: 489 case PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE: 490 case PIDFD_GET_UTS_NAMESPACE: 491 case PIDFD_GET_USER_NAMESPACE: 492 case PIDFD_GET_PID_NAMESPACE: 493 return true; 494 } 495 496 /* Extensible ioctls require some more careful checks. */ 497 switch (_IOC_NR(cmd)) { 498 case _IOC_NR(PIDFD_GET_INFO): 499 /* 500 * Try to prevent performing a pidfd ioctl when someone 501 * erronously mistook the file descriptor for a pidfd. 502 * This is not perfect but will catch most cases. 503 */ 504 return extensible_ioctl_valid(cmd, PIDFD_GET_INFO, PIDFD_INFO_SIZE_VER0); 505 } 506 507 return false; 508 } 509 510 static long pidfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 511 { 512 struct task_struct *task __free(put_task) = NULL; 513 struct nsproxy *nsp __free(put_nsproxy) = NULL; 514 struct ns_common *ns_common = NULL; 515 516 if (!pidfs_ioctl_valid(cmd)) 517 return -ENOIOCTLCMD; 518 519 if (cmd == FS_IOC_GETVERSION) { 520 if (!arg) 521 return -EINVAL; 522 523 __u32 __user *argp = (__u32 __user *)arg; 524 return put_user(file_inode(file)->i_generation, argp); 525 } 526 527 /* Extensible IOCTL that does not open namespace FDs, take a shortcut */ 528 if (_IOC_NR(cmd) == _IOC_NR(PIDFD_GET_INFO)) 529 return pidfd_info(file, cmd, arg); 530 531 task = get_pid_task(pidfd_pid(file), PIDTYPE_PID); 532 if (!task) 533 return -ESRCH; 534 535 if (arg) 536 return -EINVAL; 537 538 scoped_guard(task_lock, task) { 539 nsp = task->nsproxy; 540 if (nsp) 541 get_nsproxy(nsp); 542 } 543 if (!nsp) 544 return -ESRCH; /* just pretend it didn't exist */ 545 546 /* 547 * We're trying to open a file descriptor to the namespace so perform a 548 * filesystem cred ptrace check. Also, we mirror nsfs behavior. 549 */ 550 if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) 551 return -EACCES; 552 553 switch (cmd) { 554 /* Namespaces that hang of nsproxy. */ 555 case PIDFD_GET_CGROUP_NAMESPACE: 556 #ifdef CONFIG_CGROUPS 557 if (!ns_ref_get(nsp->cgroup_ns)) 558 break; 559 ns_common = to_ns_common(nsp->cgroup_ns); 560 #endif 561 break; 562 case PIDFD_GET_IPC_NAMESPACE: 563 #ifdef CONFIG_IPC_NS 564 if (!ns_ref_get(nsp->ipc_ns)) 565 break; 566 ns_common = to_ns_common(nsp->ipc_ns); 567 #endif 568 break; 569 case PIDFD_GET_MNT_NAMESPACE: 570 if (!ns_ref_get(nsp->mnt_ns)) 571 break; 572 ns_common = to_ns_common(nsp->mnt_ns); 573 break; 574 case PIDFD_GET_NET_NAMESPACE: 575 #ifdef CONFIG_NET_NS 576 if (!ns_ref_get(nsp->net_ns)) 577 break; 578 ns_common = to_ns_common(nsp->net_ns); 579 #endif 580 break; 581 case PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE: 582 #ifdef CONFIG_PID_NS 583 if (!ns_ref_get(nsp->pid_ns_for_children)) 584 break; 585 ns_common = to_ns_common(nsp->pid_ns_for_children); 586 #endif 587 break; 588 case PIDFD_GET_TIME_NAMESPACE: 589 #ifdef CONFIG_TIME_NS 590 if (!ns_ref_get(nsp->time_ns)) 591 break; 592 ns_common = to_ns_common(nsp->time_ns); 593 #endif 594 break; 595 case PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE: 596 #ifdef CONFIG_TIME_NS 597 if (!ns_ref_get(nsp->time_ns_for_children)) 598 break; 599 ns_common = to_ns_common(nsp->time_ns_for_children); 600 #endif 601 break; 602 case PIDFD_GET_UTS_NAMESPACE: 603 #ifdef CONFIG_UTS_NS 604 if (!ns_ref_get(nsp->uts_ns)) 605 break; 606 ns_common = to_ns_common(nsp->uts_ns); 607 #endif 608 break; 609 /* Namespaces that don't hang of nsproxy. */ 610 case PIDFD_GET_USER_NAMESPACE: 611 #ifdef CONFIG_USER_NS 612 scoped_guard(rcu) { 613 struct user_namespace *user_ns; 614 615 user_ns = task_cred_xxx(task, user_ns); 616 if (!ns_ref_get(user_ns)) 617 break; 618 ns_common = to_ns_common(user_ns); 619 } 620 #endif 621 break; 622 case PIDFD_GET_PID_NAMESPACE: 623 #ifdef CONFIG_PID_NS 624 scoped_guard(rcu) { 625 struct pid_namespace *pid_ns; 626 627 pid_ns = task_active_pid_ns(task); 628 if (!ns_ref_get(pid_ns)) 629 break; 630 ns_common = to_ns_common(pid_ns); 631 } 632 #endif 633 break; 634 default: 635 return -ENOIOCTLCMD; 636 } 637 638 if (!ns_common) 639 return -EOPNOTSUPP; 640 641 /* open_namespace() unconditionally consumes the reference */ 642 return open_namespace(ns_common); 643 } 644 645 static int pidfs_file_release(struct inode *inode, struct file *file) 646 { 647 struct pid *pid = inode->i_private; 648 struct task_struct *task; 649 650 if (!(file->f_flags & PIDFD_AUTOKILL)) 651 return 0; 652 653 guard(rcu)(); 654 task = pid_task(pid, PIDTYPE_TGID); 655 if (!task) 656 return 0; 657 658 /* Not available for kthreads or user workers for now. */ 659 if (WARN_ON_ONCE(task->flags & (PF_KTHREAD | PF_USER_WORKER))) 660 return 0; 661 do_send_sig_info(SIGKILL, SEND_SIG_PRIV, task, PIDTYPE_TGID); 662 return 0; 663 } 664 665 static const struct file_operations pidfs_file_operations = { 666 .release = pidfs_file_release, 667 .poll = pidfd_poll, 668 #ifdef CONFIG_PROC_FS 669 .show_fdinfo = pidfd_show_fdinfo, 670 #endif 671 .unlocked_ioctl = pidfd_ioctl, 672 .compat_ioctl = compat_ptr_ioctl, 673 }; 674 675 struct pid *pidfd_pid(const struct file *file) 676 { 677 if (file->f_op != &pidfs_file_operations) 678 return ERR_PTR(-EBADF); 679 return file_inode(file)->i_private; 680 } 681 682 /* 683 * We're called from release_task(). We know there's at least one 684 * reference to struct pid being held that won't be released until the 685 * task has been reaped which cannot happen until we're out of 686 * release_task(). 687 * 688 * If this struct pid has at least once been referred to by a pidfd then 689 * pid->attr will be allocated. If not we mark the struct pid as dead so 690 * anyone who is trying to register it with pidfs will fail to do so. 691 * Otherwise we would hand out pidfs for reaped tasks without having 692 * exit information available. 693 * 694 * Worst case is that we've filled in the info and the pid gets freed 695 * right away in free_pid() when no one holds a pidfd anymore. Since 696 * pidfs_exit() currently is placed after exit_task_work() we know that 697 * it cannot be us aka the exiting task holding a pidfd to itself. 698 */ 699 void pidfs_exit(struct task_struct *tsk) 700 { 701 struct pid *pid = task_pid(tsk); 702 struct pidfs_attr *attr; 703 #ifdef CONFIG_CGROUPS 704 struct cgroup *cgrp; 705 #endif 706 707 might_sleep(); 708 709 /* Synchronize with pidfs_register_pid(). */ 710 scoped_guard(spinlock_irq, &pid->wait_pidfd.lock) { 711 attr = pid->attr; 712 if (!attr) { 713 /* 714 * No one ever held a pidfd for this struct pid. 715 * Mark it as dead so no one can add a pidfs 716 * entry anymore. We're about to be reaped and 717 * so no exit information would be available. 718 */ 719 pid->attr = PIDFS_PID_DEAD; 720 return; 721 } 722 } 723 724 /* 725 * If @pid->attr is set someone might still legitimately hold a 726 * pidfd to @pid or someone might concurrently still be getting 727 * a reference to an already stashed dentry from @pid->stashed. 728 * So defer cleaning @pid->attr until the last reference to @pid 729 * is put 730 */ 731 732 #ifdef CONFIG_CGROUPS 733 rcu_read_lock(); 734 cgrp = task_dfl_cgroup(tsk); 735 attr->cgroupid = cgroup_id(cgrp); 736 rcu_read_unlock(); 737 #endif 738 attr->exit_code = tsk->exit_code; 739 740 /* Ensure that PIDFD_GET_INFO sees either all or nothing. */ 741 smp_wmb(); 742 set_bit(PIDFS_ATTR_BIT_EXIT, &attr->attr_mask); 743 } 744 745 #ifdef CONFIG_COREDUMP 746 void pidfs_coredump(const struct coredump_params *cprm) 747 { 748 struct pid *pid = cprm->pid; 749 struct pidfs_attr *attr; 750 751 attr = READ_ONCE(pid->attr); 752 753 VFS_WARN_ON_ONCE(!attr); 754 VFS_WARN_ON_ONCE(attr == PIDFS_PID_DEAD); 755 756 /* Note how we were coredumped and that we coredumped. */ 757 attr->coredump_mask = pidfs_coredump_mask(cprm->mm_flags) | 758 PIDFD_COREDUMPED; 759 /* If coredumping is set to skip we should never end up here. */ 760 VFS_WARN_ON_ONCE(attr->coredump_mask & PIDFD_COREDUMP_SKIP); 761 /* Expose the signal number and code that caused the coredump. */ 762 attr->coredump_signal = cprm->siginfo->si_signo; 763 attr->coredump_code = cprm->siginfo->si_code; 764 smp_wmb(); 765 set_bit(PIDFS_ATTR_BIT_COREDUMP, &attr->attr_mask); 766 } 767 #endif 768 769 static struct vfsmount *pidfs_mnt __ro_after_init; 770 771 /* 772 * The vfs falls back to simple_setattr() if i_op->setattr() isn't 773 * implemented. Let's reject it completely until we have a clean 774 * permission concept for pidfds. 775 */ 776 static int pidfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, 777 struct iattr *attr) 778 { 779 return anon_inode_setattr(idmap, dentry, attr); 780 } 781 782 static int pidfs_getattr(struct mnt_idmap *idmap, const struct path *path, 783 struct kstat *stat, u32 request_mask, 784 unsigned int query_flags) 785 { 786 return anon_inode_getattr(idmap, path, stat, request_mask, query_flags); 787 } 788 789 static ssize_t pidfs_listxattr(struct dentry *dentry, char *buf, size_t size) 790 { 791 struct inode *inode = d_inode(dentry); 792 struct pid *pid = inode->i_private; 793 struct pidfs_attr *attr = pid->attr; 794 struct simple_xattrs *xattrs; 795 796 xattrs = READ_ONCE(attr->xattrs); 797 if (!xattrs) 798 return 0; 799 800 return simple_xattr_list(inode, xattrs, buf, size); 801 } 802 803 static const struct inode_operations pidfs_inode_operations = { 804 .getattr = pidfs_getattr, 805 .setattr = pidfs_setattr, 806 .listxattr = pidfs_listxattr, 807 }; 808 809 static void pidfs_evict_inode(struct inode *inode) 810 { 811 struct pid *pid = inode->i_private; 812 813 clear_inode(inode); 814 put_pid(pid); 815 } 816 817 static const struct super_operations pidfs_sops = { 818 .drop_inode = inode_just_drop, 819 .evict_inode = pidfs_evict_inode, 820 .statfs = simple_statfs, 821 }; 822 823 /* 824 * 'lsof' has knowledge of out historical anon_inode use, and expects 825 * the pidfs dentry name to start with 'anon_inode'. 826 */ 827 static char *pidfs_dname(struct dentry *dentry, char *buffer, int buflen) 828 { 829 return dynamic_dname(buffer, buflen, "anon_inode:[pidfd]"); 830 } 831 832 const struct dentry_operations pidfs_dentry_operations = { 833 .d_dname = pidfs_dname, 834 .d_prune = stashed_dentry_prune, 835 }; 836 837 static int pidfs_encode_fh(struct inode *inode, u32 *fh, int *max_len, 838 struct inode *parent) 839 { 840 const struct pid *pid = inode->i_private; 841 842 if (*max_len < 2) { 843 *max_len = 2; 844 return FILEID_INVALID; 845 } 846 847 *max_len = 2; 848 *(u64 *)fh = pid->ino; 849 return FILEID_KERNFS; 850 } 851 852 /* Find a struct pid based on the inode number. */ 853 static struct pid *pidfs_ino_get_pid(u64 ino) 854 { 855 struct pid *pid; 856 struct pidfs_attr *attr; 857 858 guard(rcu)(); 859 pid = rhashtable_lookup(&pidfs_ino_ht, &ino, pidfs_ino_ht_params); 860 if (!pid) 861 return NULL; 862 attr = READ_ONCE(pid->attr); 863 if (IS_ERR_OR_NULL(attr)) 864 return NULL; 865 if (test_bit(PIDFS_ATTR_BIT_EXIT, &attr->attr_mask)) 866 return NULL; 867 /* Within our pid namespace hierarchy? */ 868 if (pid_vnr(pid) == 0) 869 return NULL; 870 return get_pid(pid); 871 } 872 873 static struct dentry *pidfs_fh_to_dentry(struct super_block *sb, 874 struct fid *fid, int fh_len, 875 int fh_type) 876 { 877 int ret; 878 u64 pid_ino; 879 struct path path; 880 struct pid *pid; 881 882 if (fh_len < 2) 883 return NULL; 884 885 switch (fh_type) { 886 case FILEID_KERNFS: 887 pid_ino = *(u64 *)fid; 888 break; 889 default: 890 return NULL; 891 } 892 893 pid = pidfs_ino_get_pid(pid_ino); 894 if (!pid) 895 return NULL; 896 897 ret = path_from_stashed(&pid->stashed, pidfs_mnt, pid, &path); 898 if (ret < 0) 899 return ERR_PTR(ret); 900 901 VFS_WARN_ON_ONCE(!pid->attr); 902 903 mntput(path.mnt); 904 return path.dentry; 905 } 906 907 /* 908 * Make sure that we reject any nonsensical flags that users pass via 909 * open_by_handle_at(). Note that PIDFD_THREAD is defined as O_EXCL, and 910 * PIDFD_NONBLOCK as O_NONBLOCK. 911 */ 912 #define VALID_FILE_HANDLE_OPEN_FLAGS \ 913 (O_RDONLY | O_WRONLY | O_RDWR | O_NONBLOCK | O_CLOEXEC | O_EXCL) 914 915 static int pidfs_export_permission(struct handle_to_path_ctx *ctx, 916 unsigned int oflags) 917 { 918 if (oflags & ~(VALID_FILE_HANDLE_OPEN_FLAGS | O_LARGEFILE)) 919 return -EINVAL; 920 921 /* 922 * pidfd_ino_get_pid() will verify that the struct pid is part 923 * of the caller's pid namespace hierarchy. No further 924 * permission checks are needed. 925 */ 926 return 0; 927 } 928 929 static struct file *pidfs_export_open(const struct path *path, unsigned int oflags) 930 { 931 /* 932 * Clear O_LARGEFILE as open_by_handle_at() forces it and raise 933 * O_RDWR as pidfds always are. 934 */ 935 oflags &= ~O_LARGEFILE; 936 return dentry_open(path, oflags | O_RDWR, current_cred()); 937 } 938 939 static const struct export_operations pidfs_export_operations = { 940 .encode_fh = pidfs_encode_fh, 941 .fh_to_dentry = pidfs_fh_to_dentry, 942 .open = pidfs_export_open, 943 .permission = pidfs_export_permission, 944 }; 945 946 static int pidfs_init_inode(struct inode *inode, void *data) 947 { 948 const struct pid *pid = data; 949 950 inode->i_private = data; 951 inode->i_flags |= S_PRIVATE | S_ANON_INODE; 952 /* We allow to set xattrs. */ 953 inode->i_flags &= ~S_IMMUTABLE; 954 inode->i_mode |= S_IRWXU; 955 inode->i_op = &pidfs_inode_operations; 956 inode->i_fop = &pidfs_file_operations; 957 inode->i_ino = pidfs_ino(pid->ino); 958 inode->i_generation = pidfs_gen(pid->ino); 959 return 0; 960 } 961 962 static void pidfs_put_data(void *data) 963 { 964 struct pid *pid = data; 965 put_pid(pid); 966 } 967 968 /** 969 * pidfs_register_pid - register a struct pid in pidfs 970 * @pid: pid to pin 971 * 972 * Register a struct pid in pidfs. 973 * 974 * Return: On success zero, on error a negative error code is returned. 975 */ 976 int pidfs_register_pid(struct pid *pid) 977 { 978 struct pidfs_attr *new_attr __free(kfree) = NULL; 979 struct pidfs_attr *attr; 980 981 might_sleep(); 982 983 if (!pid) 984 return 0; 985 986 attr = READ_ONCE(pid->attr); 987 if (unlikely(attr == PIDFS_PID_DEAD)) 988 return PTR_ERR(PIDFS_PID_DEAD); 989 if (attr) 990 return 0; 991 992 new_attr = kmem_cache_zalloc(pidfs_attr_cachep, GFP_KERNEL); 993 if (!new_attr) 994 return -ENOMEM; 995 996 /* Synchronize with pidfs_exit(). */ 997 guard(spinlock_irq)(&pid->wait_pidfd.lock); 998 999 attr = pid->attr; 1000 if (unlikely(attr == PIDFS_PID_DEAD)) 1001 return PTR_ERR(PIDFS_PID_DEAD); 1002 if (unlikely(attr)) 1003 return 0; 1004 1005 pid->attr = no_free_ptr(new_attr); 1006 return 0; 1007 } 1008 1009 static struct dentry *pidfs_stash_dentry(struct dentry **stashed, 1010 struct dentry *dentry) 1011 { 1012 int ret; 1013 struct pid *pid = d_inode(dentry)->i_private; 1014 1015 VFS_WARN_ON_ONCE(stashed != &pid->stashed); 1016 1017 ret = pidfs_register_pid(pid); 1018 if (ret) 1019 return ERR_PTR(ret); 1020 1021 return stash_dentry(stashed, dentry); 1022 } 1023 1024 static const struct stashed_operations pidfs_stashed_ops = { 1025 .stash_dentry = pidfs_stash_dentry, 1026 .init_inode = pidfs_init_inode, 1027 .put_data = pidfs_put_data, 1028 }; 1029 1030 static int pidfs_xattr_get(const struct xattr_handler *handler, 1031 struct dentry *unused, struct inode *inode, 1032 const char *suffix, void *value, size_t size) 1033 { 1034 struct pid *pid = inode->i_private; 1035 struct pidfs_attr *attr = pid->attr; 1036 const char *name; 1037 struct simple_xattrs *xattrs; 1038 1039 xattrs = READ_ONCE(attr->xattrs); 1040 if (!xattrs) 1041 return 0; 1042 1043 name = xattr_full_name(handler, suffix); 1044 return simple_xattr_get(xattrs, name, value, size); 1045 } 1046 1047 static int pidfs_xattr_set(const struct xattr_handler *handler, 1048 struct mnt_idmap *idmap, struct dentry *unused, 1049 struct inode *inode, const char *suffix, 1050 const void *value, size_t size, int flags) 1051 { 1052 struct pid *pid = inode->i_private; 1053 struct pidfs_attr *attr = pid->attr; 1054 const char *name; 1055 struct simple_xattrs *xattrs; 1056 struct simple_xattr *old_xattr; 1057 1058 /* Ensure we're the only one to set @attr->xattrs. */ 1059 WARN_ON_ONCE(!inode_is_locked(inode)); 1060 1061 xattrs = READ_ONCE(attr->xattrs); 1062 if (!xattrs) { 1063 xattrs = kmem_cache_zalloc(pidfs_xattr_cachep, GFP_KERNEL); 1064 if (!xattrs) 1065 return -ENOMEM; 1066 1067 simple_xattrs_init(xattrs); 1068 smp_store_release(&pid->attr->xattrs, xattrs); 1069 } 1070 1071 name = xattr_full_name(handler, suffix); 1072 old_xattr = simple_xattr_set(xattrs, name, value, size, flags); 1073 if (IS_ERR(old_xattr)) 1074 return PTR_ERR(old_xattr); 1075 1076 simple_xattr_free(old_xattr); 1077 return 0; 1078 } 1079 1080 static const struct xattr_handler pidfs_trusted_xattr_handler = { 1081 .prefix = XATTR_TRUSTED_PREFIX, 1082 .get = pidfs_xattr_get, 1083 .set = pidfs_xattr_set, 1084 }; 1085 1086 static const struct xattr_handler *const pidfs_xattr_handlers[] = { 1087 &pidfs_trusted_xattr_handler, 1088 NULL 1089 }; 1090 1091 static int pidfs_init_fs_context(struct fs_context *fc) 1092 { 1093 struct pseudo_fs_context *ctx; 1094 1095 ctx = init_pseudo(fc, PID_FS_MAGIC); 1096 if (!ctx) 1097 return -ENOMEM; 1098 1099 fc->s_iflags |= SB_I_NOEXEC; 1100 fc->s_iflags |= SB_I_NODEV; 1101 ctx->s_d_flags |= DCACHE_DONTCACHE; 1102 ctx->ops = &pidfs_sops; 1103 ctx->eops = &pidfs_export_operations; 1104 ctx->dops = &pidfs_dentry_operations; 1105 ctx->xattr = pidfs_xattr_handlers; 1106 fc->s_fs_info = (void *)&pidfs_stashed_ops; 1107 return 0; 1108 } 1109 1110 static struct file_system_type pidfs_type = { 1111 .name = "pidfs", 1112 .init_fs_context = pidfs_init_fs_context, 1113 .kill_sb = kill_anon_super, 1114 }; 1115 1116 struct file *pidfs_alloc_file(struct pid *pid, unsigned int flags) 1117 { 1118 struct file *pidfd_file; 1119 struct path path __free(path_put) = {}; 1120 int ret; 1121 1122 /* 1123 * Ensure that internal pidfd flags don't overlap with each 1124 * other or with uapi pidfd flags. 1125 */ 1126 BUILD_BUG_ON(hweight32(PIDFD_THREAD | PIDFD_NONBLOCK | 1127 PIDFD_STALE | PIDFD_AUTOKILL) != 4); 1128 1129 ret = path_from_stashed(&pid->stashed, pidfs_mnt, get_pid(pid), &path); 1130 if (ret < 0) 1131 return ERR_PTR(ret); 1132 1133 VFS_WARN_ON_ONCE(!pid->attr); 1134 1135 flags &= ~PIDFD_STALE; 1136 flags |= O_RDWR; 1137 pidfd_file = dentry_open(&path, flags, current_cred()); 1138 /* 1139 * Raise PIDFD_THREAD and PIDFD_AUTOKILL explicitly as 1140 * do_dentry_open() strips O_EXCL and O_TRUNC. 1141 */ 1142 if (!IS_ERR(pidfd_file)) 1143 pidfd_file->f_flags |= (flags & (PIDFD_THREAD | PIDFD_AUTOKILL)); 1144 1145 return pidfd_file; 1146 } 1147 1148 void __init pidfs_init(void) 1149 { 1150 if (rhashtable_init(&pidfs_ino_ht, &pidfs_ino_ht_params)) 1151 panic("Failed to initialize pidfs hashtable"); 1152 1153 pidfs_attr_cachep = kmem_cache_create("pidfs_attr_cache", sizeof(struct pidfs_attr), 0, 1154 (SLAB_HWCACHE_ALIGN | SLAB_RECLAIM_ACCOUNT | 1155 SLAB_ACCOUNT | SLAB_PANIC), NULL); 1156 1157 pidfs_xattr_cachep = kmem_cache_create("pidfs_xattr_cache", 1158 sizeof(struct simple_xattrs), 0, 1159 (SLAB_HWCACHE_ALIGN | SLAB_RECLAIM_ACCOUNT | 1160 SLAB_ACCOUNT | SLAB_PANIC), NULL); 1161 1162 pidfs_mnt = kern_mount(&pidfs_type); 1163 if (IS_ERR(pidfs_mnt)) 1164 panic("Failed to mount pidfs pseudo filesystem"); 1165 1166 pidfs_root_path.mnt = pidfs_mnt; 1167 pidfs_root_path.dentry = pidfs_mnt->mnt_root; 1168 } 1169