Blame view

fs/fcntl.c 18.3 KB
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
1
2
3
4
5
6
7
8
9
10
11
  /*
   *  linux/fs/fcntl.c
   *
   *  Copyright (C) 1991, 1992  Linus Torvalds
   */
  
  #include <linux/syscalls.h>
  #include <linux/init.h>
  #include <linux/mm.h>
  #include <linux/fs.h>
  #include <linux/file.h>
9f3acc314   Al Viro   [PATCH] split lin...
12
  #include <linux/fdtable.h>
16f7e0fe2   Randy Dunlap   [PATCH] capable/c...
13
  #include <linux/capability.h>
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
14
  #include <linux/dnotify.h>
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
15
16
  #include <linux/slab.h>
  #include <linux/module.h>
35f3d14db   Jens Axboe   pipe: add support...
17
  #include <linux/pipe_fs_i.h>
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
18
19
  #include <linux/security.h>
  #include <linux/ptrace.h>
7ed20e1ad   Jesper Juhl   [PATCH] convert t...
20
  #include <linux/signal.h>
ab2af1f50   Dipankar Sarma   [PATCH] files: fi...
21
  #include <linux/rcupdate.h>
b488893a3   Pavel Emelyanov   pid namespaces: c...
22
  #include <linux/pid_namespace.h>
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
23
24
25
26
  
  #include <asm/poll.h>
  #include <asm/siginfo.h>
  #include <asm/uaccess.h>
fc9b52cd8   Harvey Harrison   fs: remove fastca...
27
  void set_close_on_exec(unsigned int fd, int flag)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
28
29
  {
  	struct files_struct *files = current->files;
badf16621   Dipankar Sarma   [PATCH] files: br...
30
  	struct fdtable *fdt;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
31
  	spin_lock(&files->file_lock);
badf16621   Dipankar Sarma   [PATCH] files: br...
32
  	fdt = files_fdtable(files);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
33
  	if (flag)
badf16621   Dipankar Sarma   [PATCH] files: br...
34
  		FD_SET(fd, fdt->close_on_exec);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
35
  	else
badf16621   Dipankar Sarma   [PATCH] files: br...
36
  		FD_CLR(fd, fdt->close_on_exec);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
37
38
  	spin_unlock(&files->file_lock);
  }
858119e15   Arjan van de Ven   [PATCH] Unlinline...
39
  static int get_close_on_exec(unsigned int fd)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
40
41
  {
  	struct files_struct *files = current->files;
badf16621   Dipankar Sarma   [PATCH] files: br...
42
  	struct fdtable *fdt;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
43
  	int res;
b835996f6   Dipankar Sarma   [PATCH] files: lo...
44
  	rcu_read_lock();
badf16621   Dipankar Sarma   [PATCH] files: br...
45
46
  	fdt = files_fdtable(files);
  	res = FD_ISSET(fd, fdt->close_on_exec);
b835996f6   Dipankar Sarma   [PATCH] files: lo...
47
  	rcu_read_unlock();
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
48
49
  	return res;
  }
a26eab240   Heiko Carstens   [CVE-2009-0029] S...
50
  SYSCALL_DEFINE3(dup3, unsigned int, oldfd, unsigned int, newfd, int, flags)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
51
52
53
54
  {
  	int err = -EBADF;
  	struct file * file, *tofree;
  	struct files_struct * files = current->files;
badf16621   Dipankar Sarma   [PATCH] files: br...
55
  	struct fdtable *fdt;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
56

336dd1f70   Ulrich Drepper   flag parameters: ...
57
58
  	if ((flags & ~O_CLOEXEC) != 0)
  		return -EINVAL;
6c5d0512a   Al Viro   [PATCH] get rid o...
59
60
  	if (unlikely(oldfd == newfd))
  		return -EINVAL;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
61
  	spin_lock(&files->file_lock);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
62
  	err = expand_files(files, newfd);
1b7e190b4   Al Viro   [PATCH] clean dup...
63
64
65
  	file = fcheck(oldfd);
  	if (unlikely(!file))
  		goto Ebadf;
4e1e018ec   Al Viro   [PATCH] fix RLIM_...
66
67
  	if (unlikely(err < 0)) {
  		if (err == -EMFILE)
1b7e190b4   Al Viro   [PATCH] clean dup...
68
69
  			goto Ebadf;
  		goto out_unlock;
4e1e018ec   Al Viro   [PATCH] fix RLIM_...
70
  	}
1b7e190b4   Al Viro   [PATCH] clean dup...
71
72
73
74
75
76
77
78
79
80
81
82
83
84
  	/*
  	 * We need to detect attempts to do dup2() over allocated but still
  	 * not finished descriptor.  NB: OpenBSD avoids that at the price of
  	 * extra work in their equivalent of fget() - they insert struct
  	 * file immediately after grabbing descriptor, mark it larval if
  	 * more work (e.g. actual opening) is needed and make sure that
  	 * fget() treats larval files as absent.  Potentially interesting,
  	 * but while extra work in fget() is trivial, locking implications
  	 * and amount of surgery on open()-related paths in VFS are not.
  	 * FreeBSD fails with -EBADF in the same situation, NetBSD "solution"
  	 * deadlocks in rather amusing ways, AFAICS.  All of that is out of
  	 * scope of POSIX or SUS, since neither considers shared descriptor
  	 * tables and this condition does not arise without those.
  	 */
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
85
  	err = -EBUSY;
badf16621   Dipankar Sarma   [PATCH] files: br...
86
87
88
  	fdt = files_fdtable(files);
  	tofree = fdt->fd[newfd];
  	if (!tofree && FD_ISSET(newfd, fdt->open_fds))
1b7e190b4   Al Viro   [PATCH] clean dup...
89
90
  		goto out_unlock;
  	get_file(file);
ab2af1f50   Dipankar Sarma   [PATCH] files: fi...
91
  	rcu_assign_pointer(fdt->fd[newfd], file);
badf16621   Dipankar Sarma   [PATCH] files: br...
92
  	FD_SET(newfd, fdt->open_fds);
336dd1f70   Ulrich Drepper   flag parameters: ...
93
94
95
96
  	if (flags & O_CLOEXEC)
  		FD_SET(newfd, fdt->close_on_exec);
  	else
  		FD_CLR(newfd, fdt->close_on_exec);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
97
98
99
100
  	spin_unlock(&files->file_lock);
  
  	if (tofree)
  		filp_close(tofree, files);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
101

1b7e190b4   Al Viro   [PATCH] clean dup...
102
103
104
105
106
  	return newfd;
  
  Ebadf:
  	err = -EBADF;
  out_unlock:
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
107
  	spin_unlock(&files->file_lock);
1b7e190b4   Al Viro   [PATCH] clean dup...
108
  	return err;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
109
  }
336dd1f70   Ulrich Drepper   flag parameters: ...
110

a26eab240   Heiko Carstens   [CVE-2009-0029] S...
111
  SYSCALL_DEFINE2(dup2, unsigned int, oldfd, unsigned int, newfd)
336dd1f70   Ulrich Drepper   flag parameters: ...
112
  {
6c5d0512a   Al Viro   [PATCH] get rid o...
113
114
  	if (unlikely(newfd == oldfd)) { /* corner case */
  		struct files_struct *files = current->files;
2b79bc4f7   Jeff Mahoney   dup2: Fix return ...
115
  		int retval = oldfd;
6c5d0512a   Al Viro   [PATCH] get rid o...
116
117
  		rcu_read_lock();
  		if (!fcheck_files(files, oldfd))
2b79bc4f7   Jeff Mahoney   dup2: Fix return ...
118
  			retval = -EBADF;
6c5d0512a   Al Viro   [PATCH] get rid o...
119
  		rcu_read_unlock();
2b79bc4f7   Jeff Mahoney   dup2: Fix return ...
120
  		return retval;
6c5d0512a   Al Viro   [PATCH] get rid o...
121
  	}
336dd1f70   Ulrich Drepper   flag parameters: ...
122
123
  	return sys_dup3(oldfd, newfd, 0);
  }
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
124

a26eab240   Heiko Carstens   [CVE-2009-0029] S...
125
  SYSCALL_DEFINE1(dup, unsigned int, fildes)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
126
127
  {
  	int ret = -EBADF;
1027abe88   Al Viro   [PATCH] merge loc...
128
129
130
131
132
133
134
135
136
  	struct file *file = fget(fildes);
  
  	if (file) {
  		ret = get_unused_fd();
  		if (ret >= 0)
  			fd_install(ret, file);
  		else
  			fput(file);
  	}
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
137
138
  	return ret;
  }
76398425b   Jonathan Corbet   Move FASYNC bit h...
139
  #define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
140
141
142
  
  static int setfl(int fd, struct file * filp, unsigned long arg)
  {
0f7fc9e4d   Josef "Jeff" Sipek   [PATCH] VFS: chan...
143
  	struct inode * inode = filp->f_path.dentry->d_inode;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
144
  	int error = 0;
7d95c8f27   dean gaudet   [PATCH] fcntl F_S...
145
146
147
148
149
  	/*
  	 * O_APPEND cannot be cleared if the file is marked as append-only
  	 * and the file is open for write.
  	 */
  	if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode))
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
150
151
152
153
  		return -EPERM;
  
  	/* O_NOATIME can only be set by the owner or superuser */
  	if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME))
3bd858ab1   Satyam Sharma   Introduce is_owne...
154
  		if (!is_owner_or_cap(inode))
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
  			return -EPERM;
  
  	/* required for strict SunOS emulation */
  	if (O_NONBLOCK != O_NDELAY)
  	       if (arg & O_NDELAY)
  		   arg |= O_NONBLOCK;
  
  	if (arg & O_DIRECT) {
  		if (!filp->f_mapping || !filp->f_mapping->a_ops ||
  			!filp->f_mapping->a_ops->direct_IO)
  				return -EINVAL;
  	}
  
  	if (filp->f_op && filp->f_op->check_flags)
  		error = filp->f_op->check_flags(arg);
  	if (error)
  		return error;
218d11a8b   Jonathan Corbet   Fix a race condit...
172
  	/*
76398425b   Jonathan Corbet   Move FASYNC bit h...
173
  	 * ->fasync() is responsible for setting the FASYNC bit.
218d11a8b   Jonathan Corbet   Fix a race condit...
174
  	 */
76398425b   Jonathan Corbet   Move FASYNC bit h...
175
176
177
178
179
  	if (((arg ^ filp->f_flags) & FASYNC) && filp->f_op &&
  			filp->f_op->fasync) {
  		error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);
  		if (error < 0)
  			goto out;
60aa49243   Jonathan Corbet   Rationalize fasyn...
180
181
  		if (error > 0)
  			error = 0;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
182
  	}
db1dd4d37   Jonathan Corbet   Use f_lock to pro...
183
  	spin_lock(&filp->f_lock);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
184
  	filp->f_flags = (arg & SETFL_MASK) | (filp->f_flags & ~SETFL_MASK);
db1dd4d37   Jonathan Corbet   Use f_lock to pro...
185
  	spin_unlock(&filp->f_lock);
76398425b   Jonathan Corbet   Move FASYNC bit h...
186

1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
187
   out:
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
188
189
  	return error;
  }
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
190
  static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
2f38d70fb   Oleg Nesterov   shift current_cre...
191
                       int force)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
192
  {
80e1e8239   Linus Torvalds   Fix race in tty_f...
193
  	write_lock_irq(&filp->f_owner.lock);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
194
  	if (force || !filp->f_owner.pid) {
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
195
196
197
  		put_pid(filp->f_owner.pid);
  		filp->f_owner.pid = get_pid(pid);
  		filp->f_owner.pid_type = type;
2f38d70fb   Oleg Nesterov   shift current_cre...
198
199
200
201
202
203
  
  		if (pid) {
  			const struct cred *cred = current_cred();
  			filp->f_owner.uid = cred->uid;
  			filp->f_owner.euid = cred->euid;
  		}
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
204
  	}
80e1e8239   Linus Torvalds   Fix race in tty_f...
205
  	write_unlock_irq(&filp->f_owner.lock);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
206
  }
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
207
208
  int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
  		int force)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
209
210
  {
  	int err;
2f38d70fb   Oleg Nesterov   shift current_cre...
211

1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
212
213
214
  	err = security_file_set_fowner(filp);
  	if (err)
  		return err;
2f38d70fb   Oleg Nesterov   shift current_cre...
215
  	f_modown(filp, pid, type, force);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
216
217
  	return 0;
  }
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
218
  EXPORT_SYMBOL(__f_setown);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
219

609d7fa95   Eric W. Biederman   [PATCH] file: mod...
220
221
222
223
224
225
226
227
228
229
230
231
  int f_setown(struct file *filp, unsigned long arg, int force)
  {
  	enum pid_type type;
  	struct pid *pid;
  	int who = arg;
  	int result;
  	type = PIDTYPE_PID;
  	if (who < 0) {
  		type = PIDTYPE_PGID;
  		who = -who;
  	}
  	rcu_read_lock();
b488893a3   Pavel Emelyanov   pid namespaces: c...
232
  	pid = find_vpid(who);
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
233
234
235
236
  	result = __f_setown(filp, pid, type, force);
  	rcu_read_unlock();
  	return result;
  }
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
237
238
239
240
  EXPORT_SYMBOL(f_setown);
  
  void f_delown(struct file *filp)
  {
2f38d70fb   Oleg Nesterov   shift current_cre...
241
  	f_modown(filp, NULL, PIDTYPE_PID, 1);
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
242
243
244
245
246
  }
  
  pid_t f_getown(struct file *filp)
  {
  	pid_t pid;
43fa1adb9   Eric W. Biederman   [PATCH] file: Add...
247
  	read_lock(&filp->f_owner.lock);
6c5f3e7b4   Pavel Emelyanov   Pidns: make full ...
248
  	pid = pid_vnr(filp->f_owner.pid);
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
249
250
  	if (filp->f_owner.pid_type == PIDTYPE_PGID)
  		pid = -pid;
43fa1adb9   Eric W. Biederman   [PATCH] file: Add...
251
  	read_unlock(&filp->f_owner.lock);
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
252
  	return pid;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
253
  }
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
254
255
256
257
258
259
260
261
262
263
  static int f_setown_ex(struct file *filp, unsigned long arg)
  {
  	struct f_owner_ex * __user owner_p = (void * __user)arg;
  	struct f_owner_ex owner;
  	struct pid *pid;
  	int type;
  	int ret;
  
  	ret = copy_from_user(&owner, owner_p, sizeof(owner));
  	if (ret)
5b54470da   Dan Carpenter   fcntl: return -EF...
264
  		return -EFAULT;
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
265
266
267
268
269
270
271
272
273
  
  	switch (owner.type) {
  	case F_OWNER_TID:
  		type = PIDTYPE_MAX;
  		break;
  
  	case F_OWNER_PID:
  		type = PIDTYPE_PID;
  		break;
978b4053a   Peter Zijlstra   fcntl: rename F_O...
274
  	case F_OWNER_PGRP:
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
  		type = PIDTYPE_PGID;
  		break;
  
  	default:
  		return -EINVAL;
  	}
  
  	rcu_read_lock();
  	pid = find_vpid(owner.pid);
  	if (owner.pid && !pid)
  		ret = -ESRCH;
  	else
  		ret = __f_setown(filp, pid, type, 1);
  	rcu_read_unlock();
  
  	return ret;
  }
  
  static int f_getown_ex(struct file *filp, unsigned long arg)
  {
  	struct f_owner_ex * __user owner_p = (void * __user)arg;
  	struct f_owner_ex owner;
  	int ret = 0;
  
  	read_lock(&filp->f_owner.lock);
  	owner.pid = pid_vnr(filp->f_owner.pid);
  	switch (filp->f_owner.pid_type) {
  	case PIDTYPE_MAX:
  		owner.type = F_OWNER_TID;
  		break;
  
  	case PIDTYPE_PID:
  		owner.type = F_OWNER_PID;
  		break;
  
  	case PIDTYPE_PGID:
978b4053a   Peter Zijlstra   fcntl: rename F_O...
311
  		owner.type = F_OWNER_PGRP;
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
312
313
314
315
316
317
318
319
  		break;
  
  	default:
  		WARN_ON(1);
  		ret = -EINVAL;
  		break;
  	}
  	read_unlock(&filp->f_owner.lock);
5b54470da   Dan Carpenter   fcntl: return -EF...
320
  	if (!ret) {
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
321
  		ret = copy_to_user(owner_p, &owner, sizeof(owner));
5b54470da   Dan Carpenter   fcntl: return -EF...
322
323
324
  		if (ret)
  			ret = -EFAULT;
  	}
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
325
326
  	return ret;
  }
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
327
328
329
330
331
332
333
  static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
  		struct file *filp)
  {
  	long err = -EINVAL;
  
  	switch (cmd) {
  	case F_DUPFD:
22d2b35b2   Ulrich Drepper   F_DUPFD_CLOEXEC i...
334
  	case F_DUPFD_CLOEXEC:
d554ed895   Jiri Slaby   fs: use rlimit he...
335
  		if (arg >= rlimit(RLIMIT_NOFILE))
4e1e018ec   Al Viro   [PATCH] fix RLIM_...
336
  			break;
1027abe88   Al Viro   [PATCH] merge loc...
337
338
339
340
341
  		err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
  		if (err >= 0) {
  			get_file(filp);
  			fd_install(err, filp);
  		}
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
  		break;
  	case F_GETFD:
  		err = get_close_on_exec(fd) ? FD_CLOEXEC : 0;
  		break;
  	case F_SETFD:
  		err = 0;
  		set_close_on_exec(fd, arg & FD_CLOEXEC);
  		break;
  	case F_GETFL:
  		err = filp->f_flags;
  		break;
  	case F_SETFL:
  		err = setfl(fd, filp, arg);
  		break;
  	case F_GETLK:
  		err = fcntl_getlk(filp, (struct flock __user *) arg);
  		break;
  	case F_SETLK:
  	case F_SETLKW:
c293621bb   Peter Staubach   [PATCH] stale POS...
361
  		err = fcntl_setlk(fd, filp, cmd, (struct flock __user *) arg);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
362
363
364
365
366
367
368
369
370
  		break;
  	case F_GETOWN:
  		/*
  		 * XXX If f_owner is a process group, the
  		 * negative return value will get converted
  		 * into an error.  Oops.  If we keep the
  		 * current syscall conventions, the only way
  		 * to fix this will be in libc.
  		 */
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
371
  		err = f_getown(filp);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
372
373
374
375
376
  		force_successful_syscall_return();
  		break;
  	case F_SETOWN:
  		err = f_setown(filp, arg, 1);
  		break;
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
377
378
379
380
381
382
  	case F_GETOWN_EX:
  		err = f_getown_ex(filp, arg);
  		break;
  	case F_SETOWN_EX:
  		err = f_setown_ex(filp, arg);
  		break;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
383
384
385
386
387
  	case F_GETSIG:
  		err = filp->f_owner.signum;
  		break;
  	case F_SETSIG:
  		/* arg == 0 restores default behaviour. */
7ed20e1ad   Jesper Juhl   [PATCH] convert t...
388
  		if (!valid_signal(arg)) {
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
389
390
391
392
393
394
395
396
397
398
399
400
401
402
  			break;
  		}
  		err = 0;
  		filp->f_owner.signum = arg;
  		break;
  	case F_GETLEASE:
  		err = fcntl_getlease(filp);
  		break;
  	case F_SETLEASE:
  		err = fcntl_setlease(fd, filp, arg);
  		break;
  	case F_NOTIFY:
  		err = fcntl_dirnotify(fd, filp, arg);
  		break;
35f3d14db   Jens Axboe   pipe: add support...
403
404
405
406
  	case F_SETPIPE_SZ:
  	case F_GETPIPE_SZ:
  		err = pipe_fcntl(filp, cmd, arg);
  		break;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
407
408
409
410
411
  	default:
  		break;
  	}
  	return err;
  }
a26eab240   Heiko Carstens   [CVE-2009-0029] S...
412
  SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
  {	
  	struct file *filp;
  	long err = -EBADF;
  
  	filp = fget(fd);
  	if (!filp)
  		goto out;
  
  	err = security_file_fcntl(filp, cmd, arg);
  	if (err) {
  		fput(filp);
  		return err;
  	}
  
  	err = do_fcntl(fd, cmd, arg, filp);
  
   	fput(filp);
  out:
  	return err;
  }
  
  #if BITS_PER_LONG == 32
a26eab240   Heiko Carstens   [CVE-2009-0029] S...
435
436
  SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
  		unsigned long, arg)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
  {	
  	struct file * filp;
  	long err;
  
  	err = -EBADF;
  	filp = fget(fd);
  	if (!filp)
  		goto out;
  
  	err = security_file_fcntl(filp, cmd, arg);
  	if (err) {
  		fput(filp);
  		return err;
  	}
  	err = -EBADF;
  	
  	switch (cmd) {
  		case F_GETLK64:
  			err = fcntl_getlk64(filp, (struct flock64 __user *) arg);
  			break;
  		case F_SETLK64:
  		case F_SETLKW64:
c293621bb   Peter Staubach   [PATCH] stale POS...
459
460
  			err = fcntl_setlk64(fd, filp, cmd,
  					(struct flock64 __user *) arg);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
461
462
463
464
465
466
467
468
469
470
471
472
  			break;
  		default:
  			err = do_fcntl(fd, cmd, arg, filp);
  			break;
  	}
  	fput(filp);
  out:
  	return err;
  }
  #endif
  
  /* Table to convert sigio signal codes into poll band bitmaps */
fa3536cc1   Eric Dumazet   [PATCH] Use __rea...
473
  static const long band_table[NSIGPOLL] = {
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
474
475
476
477
478
479
480
481
482
483
484
  	POLLIN | POLLRDNORM,			/* POLL_IN */
  	POLLOUT | POLLWRNORM | POLLWRBAND,	/* POLL_OUT */
  	POLLIN | POLLRDNORM | POLLMSG,		/* POLL_MSG */
  	POLLERR,				/* POLL_ERR */
  	POLLPRI | POLLRDBAND,			/* POLL_PRI */
  	POLLHUP | POLLERR			/* POLL_HUP */
  };
  
  static inline int sigio_perm(struct task_struct *p,
                               struct fown_struct *fown, int sig)
  {
c69e8d9c0   David Howells   CRED: Use RCU to ...
485
486
487
488
489
490
491
492
493
494
495
  	const struct cred *cred;
  	int ret;
  
  	rcu_read_lock();
  	cred = __task_cred(p);
  	ret = ((fown->euid == 0 ||
  		fown->euid == cred->suid || fown->euid == cred->uid ||
  		fown->uid  == cred->suid || fown->uid  == cred->uid) &&
  	       !security_file_send_sigiotask(p, fown, sig));
  	rcu_read_unlock();
  	return ret;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
496
497
498
  }
  
  static void send_sigio_to_task(struct task_struct *p,
8eeee4e2f   Oleg Nesterov   send_sigio_to_tas...
499
  			       struct fown_struct *fown,
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
500
  			       int fd, int reason, int group)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
501
  {
8eeee4e2f   Oleg Nesterov   send_sigio_to_tas...
502
503
504
505
506
507
508
  	/*
  	 * F_SETSIG can change ->signum lockless in parallel, make
  	 * sure we read it once and use the same value throughout.
  	 */
  	int signum = ACCESS_ONCE(fown->signum);
  
  	if (!sigio_perm(p, fown, signum))
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
509
  		return;
8eeee4e2f   Oleg Nesterov   send_sigio_to_tas...
510
  	switch (signum) {
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
511
512
513
514
515
516
517
518
  		siginfo_t si;
  		default:
  			/* Queue a rt signal with the appropriate fd as its
  			   value.  We use SI_SIGIO as the source, not 
  			   SI_KERNEL, since kernel signals always get 
  			   delivered even if we can't queue.  Failure to
  			   queue in this case _should_ be reported; we fall
  			   back to SIGIO in that case. --sct */
8eeee4e2f   Oleg Nesterov   send_sigio_to_tas...
519
  			si.si_signo = signum;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
520
521
522
523
524
  			si.si_errno = 0;
  		        si.si_code  = reason;
  			/* Make sure we are called with one of the POLL_*
  			   reasons, otherwise we could leak kernel stack into
  			   userspace.  */
f6298aab2   Eric Sesterhenn   BUG_ON() Conversi...
525
  			BUG_ON((reason & __SI_MASK) != __SI_POLL);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
526
527
528
529
530
  			if (reason - POLL_IN >= NSIGPOLL)
  				si.si_band  = ~0L;
  			else
  				si.si_band = band_table[reason - POLL_IN];
  			si.si_fd    = fd;
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
531
  			if (!do_send_sig_info(signum, &si, p, group))
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
532
533
534
  				break;
  		/* fall-through: fall back on the old plain SIGIO signal */
  		case 0:
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
535
  			do_send_sig_info(SIGIO, SEND_SIG_PRIV, p, group);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
536
537
538
539
540
541
  	}
  }
  
  void send_sigio(struct fown_struct *fown, int fd, int band)
  {
  	struct task_struct *p;
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
542
543
  	enum pid_type type;
  	struct pid *pid;
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
544
  	int group = 1;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
545
546
  	
  	read_lock(&fown->lock);
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
547

609d7fa95   Eric W. Biederman   [PATCH] file: mod...
548
  	type = fown->pid_type;
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
549
550
551
552
  	if (type == PIDTYPE_MAX) {
  		group = 0;
  		type = PIDTYPE_PID;
  	}
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
553
554
555
556
557
  	pid = fown->pid;
  	if (!pid)
  		goto out_unlock_fown;
  	
  	read_lock(&tasklist_lock);
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
558
  	do_each_pid_task(pid, type, p) {
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
559
  		send_sigio_to_task(p, fown, fd, band, group);
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
560
  	} while_each_pid_task(pid, type, p);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
561
562
563
564
565
566
  	read_unlock(&tasklist_lock);
   out_unlock_fown:
  	read_unlock(&fown->lock);
  }
  
  static void send_sigurg_to_task(struct task_struct *p,
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
567
  				struct fown_struct *fown, int group)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
568
569
  {
  	if (sigio_perm(p, fown, SIGURG))
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
570
  		do_send_sig_info(SIGURG, SEND_SIG_PRIV, p, group);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
571
572
573
574
575
  }
  
  int send_sigurg(struct fown_struct *fown)
  {
  	struct task_struct *p;
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
576
577
  	enum pid_type type;
  	struct pid *pid;
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
578
  	int group = 1;
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
579
  	int ret = 0;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
580
581
  	
  	read_lock(&fown->lock);
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
582

609d7fa95   Eric W. Biederman   [PATCH] file: mod...
583
  	type = fown->pid_type;
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
584
585
586
587
  	if (type == PIDTYPE_MAX) {
  		group = 0;
  		type = PIDTYPE_PID;
  	}
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
588
589
590
591
592
593
594
  	pid = fown->pid;
  	if (!pid)
  		goto out_unlock_fown;
  
  	ret = 1;
  	
  	read_lock(&tasklist_lock);
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
595
  	do_each_pid_task(pid, type, p) {
ba0a6c9f6   Peter Zijlstra   fcntl: add F_[SG]...
596
  		send_sigurg_to_task(p, fown, group);
609d7fa95   Eric W. Biederman   [PATCH] file: mod...
597
  	} while_each_pid_task(pid, type, p);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
598
599
600
601
602
  	read_unlock(&tasklist_lock);
   out_unlock_fown:
  	read_unlock(&fown->lock);
  	return ret;
  }
989a29792   Eric Dumazet   fasync: RCU and f...
603
  static DEFINE_SPINLOCK(fasync_lock);
e18b890bb   Christoph Lameter   [PATCH] slab: rem...
604
  static struct kmem_cache *fasync_cache __read_mostly;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
605

989a29792   Eric Dumazet   fasync: RCU and f...
606
607
608
609
610
  static void fasync_free_rcu(struct rcu_head *head)
  {
  	kmem_cache_free(fasync_cache,
  			container_of(head, struct fasync_struct, fa_rcu));
  }
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
611
  /*
53281b6d3   Linus Torvalds   fasync: split 'fa...
612
613
614
615
616
617
618
   * Remove a fasync entry. If successfully removed, return
   * positive and clear the FASYNC flag. If no entry exists,
   * do nothing and return 0.
   *
   * NOTE! It is very important that the FASYNC flag always
   * match the state "is the filp on a fasync list".
   *
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
619
   */
f7347ce4e   Linus Torvalds   fasync: re-organi...
620
  int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
621
622
  {
  	struct fasync_struct *fa, **fp;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
623
  	int result = 0;
53281b6d3   Linus Torvalds   fasync: split 'fa...
624
  	spin_lock(&filp->f_lock);
989a29792   Eric Dumazet   fasync: RCU and f...
625
  	spin_lock(&fasync_lock);
53281b6d3   Linus Torvalds   fasync: split 'fa...
626
627
628
  	for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
  		if (fa->fa_file != filp)
  			continue;
989a29792   Eric Dumazet   fasync: RCU and f...
629
630
631
632
  
  		spin_lock_irq(&fa->fa_lock);
  		fa->fa_file = NULL;
  		spin_unlock_irq(&fa->fa_lock);
53281b6d3   Linus Torvalds   fasync: split 'fa...
633
  		*fp = fa->fa_next;
989a29792   Eric Dumazet   fasync: RCU and f...
634
  		call_rcu(&fa->fa_rcu, fasync_free_rcu);
53281b6d3   Linus Torvalds   fasync: split 'fa...
635
636
637
  		filp->f_flags &= ~FASYNC;
  		result = 1;
  		break;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
638
  	}
989a29792   Eric Dumazet   fasync: RCU and f...
639
  	spin_unlock(&fasync_lock);
53281b6d3   Linus Torvalds   fasync: split 'fa...
640
641
642
  	spin_unlock(&filp->f_lock);
  	return result;
  }
f7347ce4e   Linus Torvalds   fasync: re-organi...
643
644
645
646
  struct fasync_struct *fasync_alloc(void)
  {
  	return kmem_cache_alloc(fasync_cache, GFP_KERNEL);
  }
53281b6d3   Linus Torvalds   fasync: split 'fa...
647
  /*
f7347ce4e   Linus Torvalds   fasync: re-organi...
648
649
650
   * NOTE! This can be used only for unused fasync entries:
   * entries that actually got inserted on the fasync list
   * need to be released by rcu - see fasync_remove_entry.
53281b6d3   Linus Torvalds   fasync: split 'fa...
651
   */
f7347ce4e   Linus Torvalds   fasync: re-organi...
652
  void fasync_free(struct fasync_struct *new)
53281b6d3   Linus Torvalds   fasync: split 'fa...
653
  {
f7347ce4e   Linus Torvalds   fasync: re-organi...
654
655
  	kmem_cache_free(fasync_cache, new);
  }
53281b6d3   Linus Torvalds   fasync: split 'fa...
656

f7347ce4e   Linus Torvalds   fasync: re-organi...
657
658
659
  /*
   * Insert a new entry into the fasync list.  Return the pointer to the
   * old one if we didn't use the new one.
55f335a88   Linus Torvalds   fasync: Fix place...
660
661
662
   *
   * NOTE! It is very important that the FASYNC flag always
   * match the state "is the filp on a fasync list".
f7347ce4e   Linus Torvalds   fasync: re-organi...
663
664
665
666
   */
  struct fasync_struct *fasync_insert_entry(int fd, struct file *filp, struct fasync_struct **fapp, struct fasync_struct *new)
  {
          struct fasync_struct *fa, **fp;
4a6a44996   Jonathan Corbet   Fix a lockdep war...
667

4a6a44996   Jonathan Corbet   Fix a lockdep war...
668
  	spin_lock(&filp->f_lock);
989a29792   Eric Dumazet   fasync: RCU and f...
669
  	spin_lock(&fasync_lock);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
670
  	for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
53281b6d3   Linus Torvalds   fasync: split 'fa...
671
672
  		if (fa->fa_file != filp)
  			continue;
989a29792   Eric Dumazet   fasync: RCU and f...
673
674
  
  		spin_lock_irq(&fa->fa_lock);
53281b6d3   Linus Torvalds   fasync: split 'fa...
675
  		fa->fa_fd = fd;
989a29792   Eric Dumazet   fasync: RCU and f...
676
  		spin_unlock_irq(&fa->fa_lock);
53281b6d3   Linus Torvalds   fasync: split 'fa...
677
  		goto out;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
678
  	}
989a29792   Eric Dumazet   fasync: RCU and f...
679
  	spin_lock_init(&new->fa_lock);
53281b6d3   Linus Torvalds   fasync: split 'fa...
680
681
682
683
  	new->magic = FASYNC_MAGIC;
  	new->fa_file = filp;
  	new->fa_fd = fd;
  	new->fa_next = *fapp;
989a29792   Eric Dumazet   fasync: RCU and f...
684
  	rcu_assign_pointer(*fapp, new);
53281b6d3   Linus Torvalds   fasync: split 'fa...
685
  	filp->f_flags |= FASYNC;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
686
  out:
989a29792   Eric Dumazet   fasync: RCU and f...
687
  	spin_unlock(&fasync_lock);
4a6a44996   Jonathan Corbet   Fix a lockdep war...
688
  	spin_unlock(&filp->f_lock);
f7347ce4e   Linus Torvalds   fasync: re-organi...
689
690
691
692
693
694
  	return fa;
  }
  
  /*
   * Add a fasync entry. Return negative on error, positive if
   * added, and zero if did nothing but change an existing one.
f7347ce4e   Linus Torvalds   fasync: re-organi...
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
   */
  static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)
  {
  	struct fasync_struct *new;
  
  	new = fasync_alloc();
  	if (!new)
  		return -ENOMEM;
  
  	/*
  	 * fasync_insert_entry() returns the old (update) entry if
  	 * it existed.
  	 *
  	 * So free the (unused) new entry and return 0 to let the
  	 * caller know that we didn't add any new fasync entries.
  	 */
  	if (fasync_insert_entry(fd, filp, fapp, new)) {
  		fasync_free(new);
  		return 0;
  	}
  
  	return 1;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
717
  }
53281b6d3   Linus Torvalds   fasync: split 'fa...
718
719
720
721
722
723
724
725
726
727
728
729
  /*
   * fasync_helper() is used by almost all character device drivers
   * to set up the fasync queue, and for regular files by the file
   * lease code. It returns negative on error, 0 if it did no changes
   * and positive if it added/deleted the entry.
   */
  int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
  {
  	if (!on)
  		return fasync_remove_entry(filp, fapp);
  	return fasync_add_entry(fd, filp, fapp);
  }
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
730
  EXPORT_SYMBOL(fasync_helper);
989a29792   Eric Dumazet   fasync: RCU and f...
731
732
733
734
  /*
   * rcu_read_lock() is held
   */
  static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
735
736
  {
  	while (fa) {
989a29792   Eric Dumazet   fasync: RCU and f...
737
  		struct fown_struct *fown;
f4985dc71   Andrew Morton   fs/fcntl.c:kill_f...
738
  		unsigned long flags;
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
739
740
741
742
743
744
  		if (fa->magic != FASYNC_MAGIC) {
  			printk(KERN_ERR "kill_fasync: bad magic number in "
  			       "fasync_struct!
  ");
  			return;
  		}
f4985dc71   Andrew Morton   fs/fcntl.c:kill_f...
745
  		spin_lock_irqsave(&fa->fa_lock, flags);
989a29792   Eric Dumazet   fasync: RCU and f...
746
747
748
749
750
751
752
753
  		if (fa->fa_file) {
  			fown = &fa->fa_file->f_owner;
  			/* Don't send SIGURG to processes which have not set a
  			   queued signum: SIGURG has its own default signalling
  			   mechanism. */
  			if (!(sig == SIGURG && fown->signum == 0))
  				send_sigio(fown, fa->fa_fd, band);
  		}
f4985dc71   Andrew Morton   fs/fcntl.c:kill_f...
754
  		spin_unlock_irqrestore(&fa->fa_lock, flags);
989a29792   Eric Dumazet   fasync: RCU and f...
755
  		fa = rcu_dereference(fa->fa_next);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
756
757
  	}
  }
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
758
759
760
761
762
763
  void kill_fasync(struct fasync_struct **fp, int sig, int band)
  {
  	/* First a quick test without locking: usually
  	 * the list is empty.
  	 */
  	if (*fp) {
989a29792   Eric Dumazet   fasync: RCU and f...
764
765
766
  		rcu_read_lock();
  		kill_fasync_rcu(rcu_dereference(*fp), sig, band);
  		rcu_read_unlock();
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
767
768
769
  	}
  }
  EXPORT_SYMBOL(kill_fasync);
454eedb89   Wu Fengguang   vfs: O_* bit numb...
770
  static int __init fcntl_init(void)
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
771
  {
3ab04d5cf   James Bottomley   vfs: take O_NONBL...
772
773
774
775
776
777
  	/*
  	 * Please add new bits here to ensure allocation uniqueness.
  	 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
  	 * is defined as O_NONBLOCK on some platforms and not on others.
  	 */
  	BUILD_BUG_ON(18 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
454eedb89   Wu Fengguang   vfs: O_* bit numb...
778
779
  		O_RDONLY	| O_WRONLY	| O_RDWR	|
  		O_CREAT		| O_EXCL	| O_NOCTTY	|
3ab04d5cf   James Bottomley   vfs: take O_NONBL...
780
  		O_TRUNC		| O_APPEND	| /* O_NONBLOCK	| */
454eedb89   Wu Fengguang   vfs: O_* bit numb...
781
782
783
784
785
  		__O_SYNC	| O_DSYNC	| FASYNC	|
  		O_DIRECT	| O_LARGEFILE	| O_DIRECTORY	|
  		O_NOFOLLOW	| O_NOATIME	| O_CLOEXEC	|
  		FMODE_EXEC
  		));
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
786
  	fasync_cache = kmem_cache_create("fasync_cache",
20c2df83d   Paul Mundt   mm: Remove slab d...
787
  		sizeof(struct fasync_struct), 0, SLAB_PANIC, NULL);
1da177e4c   Linus Torvalds   Linux-2.6.12-rc2
788
789
  	return 0;
  }
454eedb89   Wu Fengguang   vfs: O_* bit numb...
790
  module_init(fcntl_init)