fcntl.c 19.4 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11
/*
 *  linux/fs/fcntl.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

#include <linux/syscalls.h>
#include <linux/init.h>
#include <linux/mm.h>
#include <linux/fs.h>
#include <linux/file.h>
A
Al Viro 已提交
12
#include <linux/fdtable.h>
13
#include <linux/capability.h>
L
Linus Torvalds 已提交
14 15 16
#include <linux/dnotify.h>
#include <linux/slab.h>
#include <linux/module.h>
17
#include <linux/pipe_fs_i.h>
L
Linus Torvalds 已提交
18 19
#include <linux/security.h>
#include <linux/ptrace.h>
20
#include <linux/signal.h>
21
#include <linux/rcupdate.h>
22
#include <linux/pid_namespace.h>
23
#include <linux/user_namespace.h>
L
Linus Torvalds 已提交
24 25 26 27 28

#include <asm/poll.h>
#include <asm/siginfo.h>
#include <asm/uaccess.h>

29
void set_close_on_exec(unsigned int fd, int flag)
L
Linus Torvalds 已提交
30 31
{
	struct files_struct *files = current->files;
32
	struct fdtable *fdt;
L
Linus Torvalds 已提交
33
	spin_lock(&files->file_lock);
34
	fdt = files_fdtable(files);
L
Linus Torvalds 已提交
35
	if (flag)
36
		__set_close_on_exec(fd, fdt);
L
Linus Torvalds 已提交
37
	else
38
		__clear_close_on_exec(fd, fdt);
L
Linus Torvalds 已提交
39 40 41
	spin_unlock(&files->file_lock);
}

42
static bool get_close_on_exec(unsigned int fd)
L
Linus Torvalds 已提交
43 44
{
	struct files_struct *files = current->files;
45
	struct fdtable *fdt;
46
	bool res;
47
	rcu_read_lock();
48
	fdt = files_fdtable(files);
49
	res = close_on_exec(fd, fdt);
50
	rcu_read_unlock();
L
Linus Torvalds 已提交
51 52 53
	return res;
}

54
SYSCALL_DEFINE3(dup3, unsigned int, oldfd, unsigned int, newfd, int, flags)
L
Linus Torvalds 已提交
55 56 57 58
{
	int err = -EBADF;
	struct file * file, *tofree;
	struct files_struct * files = current->files;
59
	struct fdtable *fdt;
L
Linus Torvalds 已提交
60

U
Ulrich Drepper 已提交
61 62 63
	if ((flags & ~O_CLOEXEC) != 0)
		return -EINVAL;

64 65 66
	if (unlikely(oldfd == newfd))
		return -EINVAL;

L
Linus Torvalds 已提交
67 68
	spin_lock(&files->file_lock);
	err = expand_files(files, newfd);
A
Al Viro 已提交
69 70 71
	file = fcheck(oldfd);
	if (unlikely(!file))
		goto Ebadf;
A
Al Viro 已提交
72 73
	if (unlikely(err < 0)) {
		if (err == -EMFILE)
A
Al Viro 已提交
74 75
			goto Ebadf;
		goto out_unlock;
A
Al Viro 已提交
76
	}
A
Al Viro 已提交
77 78 79 80 81 82 83 84 85 86 87 88 89 90
	/*
	 * We need to detect attempts to do dup2() over allocated but still
	 * not finished descriptor.  NB: OpenBSD avoids that at the price of
	 * extra work in their equivalent of fget() - they insert struct
	 * file immediately after grabbing descriptor, mark it larval if
	 * more work (e.g. actual opening) is needed and make sure that
	 * fget() treats larval files as absent.  Potentially interesting,
	 * but while extra work in fget() is trivial, locking implications
	 * and amount of surgery on open()-related paths in VFS are not.
	 * FreeBSD fails with -EBADF in the same situation, NetBSD "solution"
	 * deadlocks in rather amusing ways, AFAICS.  All of that is out of
	 * scope of POSIX or SUS, since neither considers shared descriptor
	 * tables and this condition does not arise without those.
	 */
L
Linus Torvalds 已提交
91
	err = -EBUSY;
92 93
	fdt = files_fdtable(files);
	tofree = fdt->fd[newfd];
94
	if (!tofree && fd_is_open(newfd, fdt))
A
Al Viro 已提交
95 96
		goto out_unlock;
	get_file(file);
97
	rcu_assign_pointer(fdt->fd[newfd], file);
98
	__set_open_fd(newfd, fdt);
U
Ulrich Drepper 已提交
99
	if (flags & O_CLOEXEC)
100
		__set_close_on_exec(newfd, fdt);
U
Ulrich Drepper 已提交
101
	else
102
		__clear_close_on_exec(newfd, fdt);
L
Linus Torvalds 已提交
103 104 105 106 107
	spin_unlock(&files->file_lock);

	if (tofree)
		filp_close(tofree, files);

A
Al Viro 已提交
108 109 110 111 112
	return newfd;

Ebadf:
	err = -EBADF;
out_unlock:
L
Linus Torvalds 已提交
113
	spin_unlock(&files->file_lock);
A
Al Viro 已提交
114
	return err;
L
Linus Torvalds 已提交
115
}
U
Ulrich Drepper 已提交
116

117
SYSCALL_DEFINE2(dup2, unsigned int, oldfd, unsigned int, newfd)
U
Ulrich Drepper 已提交
118
{
119 120
	if (unlikely(newfd == oldfd)) { /* corner case */
		struct files_struct *files = current->files;
121 122
		int retval = oldfd;

123 124
		rcu_read_lock();
		if (!fcheck_files(files, oldfd))
125
			retval = -EBADF;
126
		rcu_read_unlock();
127
		return retval;
128
	}
U
Ulrich Drepper 已提交
129 130
	return sys_dup3(oldfd, newfd, 0);
}
L
Linus Torvalds 已提交
131

132
SYSCALL_DEFINE1(dup, unsigned int, fildes)
L
Linus Torvalds 已提交
133 134
{
	int ret = -EBADF;
135
	struct file *file = fget_raw(fildes);
136 137 138 139 140 141 142 143

	if (file) {
		ret = get_unused_fd();
		if (ret >= 0)
			fd_install(ret, file);
		else
			fput(file);
	}
L
Linus Torvalds 已提交
144 145 146
	return ret;
}

147
#define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME)
L
Linus Torvalds 已提交
148 149 150

static int setfl(int fd, struct file * filp, unsigned long arg)
{
151
	struct inode * inode = filp->f_path.dentry->d_inode;
L
Linus Torvalds 已提交
152 153
	int error = 0;

154 155 156 157 158
	/*
	 * O_APPEND cannot be cleared if the file is marked as append-only
	 * and the file is open for write.
	 */
	if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode))
L
Linus Torvalds 已提交
159 160 161 162
		return -EPERM;

	/* O_NOATIME can only be set by the owner or superuser */
	if ((arg & O_NOATIME) && !(filp->f_flags & O_NOATIME))
163
		if (!inode_owner_or_capable(inode))
L
Linus Torvalds 已提交
164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181
			return -EPERM;

	/* required for strict SunOS emulation */
	if (O_NONBLOCK != O_NDELAY)
	       if (arg & O_NDELAY)
		   arg |= O_NONBLOCK;

	if (arg & O_DIRECT) {
		if (!filp->f_mapping || !filp->f_mapping->a_ops ||
			!filp->f_mapping->a_ops->direct_IO)
				return -EINVAL;
	}

	if (filp->f_op && filp->f_op->check_flags)
		error = filp->f_op->check_flags(arg);
	if (error)
		return error;

182
	/*
183
	 * ->fasync() is responsible for setting the FASYNC bit.
184
	 */
185 186 187 188 189
	if (((arg ^ filp->f_flags) & FASYNC) && filp->f_op &&
			filp->f_op->fasync) {
		error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);
		if (error < 0)
			goto out;
190 191
		if (error > 0)
			error = 0;
L
Linus Torvalds 已提交
192
	}
J
Jonathan Corbet 已提交
193
	spin_lock(&filp->f_lock);
L
Linus Torvalds 已提交
194
	filp->f_flags = (arg & SETFL_MASK) | (filp->f_flags & ~SETFL_MASK);
J
Jonathan Corbet 已提交
195
	spin_unlock(&filp->f_lock);
196

L
Linus Torvalds 已提交
197 198 199 200
 out:
	return error;
}

201
static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
202
                     int force)
L
Linus Torvalds 已提交
203
{
204
	write_lock_irq(&filp->f_owner.lock);
L
Linus Torvalds 已提交
205
	if (force || !filp->f_owner.pid) {
206 207 208
		put_pid(filp->f_owner.pid);
		filp->f_owner.pid = get_pid(pid);
		filp->f_owner.pid_type = type;
209 210 211 212 213 214

		if (pid) {
			const struct cred *cred = current_cred();
			filp->f_owner.uid = cred->uid;
			filp->f_owner.euid = cred->euid;
		}
L
Linus Torvalds 已提交
215
	}
216
	write_unlock_irq(&filp->f_owner.lock);
L
Linus Torvalds 已提交
217 218
}

219 220
int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
		int force)
L
Linus Torvalds 已提交
221 222
{
	int err;
223

L
Linus Torvalds 已提交
224 225 226 227
	err = security_file_set_fowner(filp);
	if (err)
		return err;

228
	f_modown(filp, pid, type, force);
L
Linus Torvalds 已提交
229 230
	return 0;
}
231
EXPORT_SYMBOL(__f_setown);
L
Linus Torvalds 已提交
232

233 234 235 236 237 238 239 240 241 242 243 244
int f_setown(struct file *filp, unsigned long arg, int force)
{
	enum pid_type type;
	struct pid *pid;
	int who = arg;
	int result;
	type = PIDTYPE_PID;
	if (who < 0) {
		type = PIDTYPE_PGID;
		who = -who;
	}
	rcu_read_lock();
245
	pid = find_vpid(who);
246 247 248 249
	result = __f_setown(filp, pid, type, force);
	rcu_read_unlock();
	return result;
}
L
Linus Torvalds 已提交
250 251 252 253
EXPORT_SYMBOL(f_setown);

void f_delown(struct file *filp)
{
254
	f_modown(filp, NULL, PIDTYPE_PID, 1);
255 256 257 258 259
}

pid_t f_getown(struct file *filp)
{
	pid_t pid;
260
	read_lock(&filp->f_owner.lock);
261
	pid = pid_vnr(filp->f_owner.pid);
262 263
	if (filp->f_owner.pid_type == PIDTYPE_PGID)
		pid = -pid;
264
	read_unlock(&filp->f_owner.lock);
265
	return pid;
L
Linus Torvalds 已提交
266 267
}

P
Peter Zijlstra 已提交
268 269 270 271 272 273 274 275 276 277
static int f_setown_ex(struct file *filp, unsigned long arg)
{
	struct f_owner_ex * __user owner_p = (void * __user)arg;
	struct f_owner_ex owner;
	struct pid *pid;
	int type;
	int ret;

	ret = copy_from_user(&owner, owner_p, sizeof(owner));
	if (ret)
278
		return -EFAULT;
P
Peter Zijlstra 已提交
279 280 281 282 283 284 285 286 287 288

	switch (owner.type) {
	case F_OWNER_TID:
		type = PIDTYPE_MAX;
		break;

	case F_OWNER_PID:
		type = PIDTYPE_PID;
		break;

289
	case F_OWNER_PGRP:
P
Peter Zijlstra 已提交
290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325
		type = PIDTYPE_PGID;
		break;

	default:
		return -EINVAL;
	}

	rcu_read_lock();
	pid = find_vpid(owner.pid);
	if (owner.pid && !pid)
		ret = -ESRCH;
	else
		ret = __f_setown(filp, pid, type, 1);
	rcu_read_unlock();

	return ret;
}

static int f_getown_ex(struct file *filp, unsigned long arg)
{
	struct f_owner_ex * __user owner_p = (void * __user)arg;
	struct f_owner_ex owner;
	int ret = 0;

	read_lock(&filp->f_owner.lock);
	owner.pid = pid_vnr(filp->f_owner.pid);
	switch (filp->f_owner.pid_type) {
	case PIDTYPE_MAX:
		owner.type = F_OWNER_TID;
		break;

	case PIDTYPE_PID:
		owner.type = F_OWNER_PID;
		break;

	case PIDTYPE_PGID:
326
		owner.type = F_OWNER_PGRP;
P
Peter Zijlstra 已提交
327 328 329 330 331 332 333 334 335
		break;

	default:
		WARN_ON(1);
		ret = -EINVAL;
		break;
	}
	read_unlock(&filp->f_owner.lock);

336
	if (!ret) {
P
Peter Zijlstra 已提交
337
		ret = copy_to_user(owner_p, &owner, sizeof(owner));
338 339 340
		if (ret)
			ret = -EFAULT;
	}
P
Peter Zijlstra 已提交
341 342 343
	return ret;
}

344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368
#ifdef CONFIG_CHECKPOINT_RESTORE
static int f_getowner_uids(struct file *filp, unsigned long arg)
{
	struct user_namespace *user_ns = current_user_ns();
	uid_t * __user dst = (void * __user)arg;
	uid_t src[2];
	int err;

	read_lock(&filp->f_owner.lock);
	src[0] = from_kuid(user_ns, filp->f_owner.uid);
	src[1] = from_kuid(user_ns, filp->f_owner.euid);
	read_unlock(&filp->f_owner.lock);

	err  = put_user(src[0], &dst[0]);
	err |= put_user(src[1], &dst[1]);

	return err;
}
#else
static int f_getowner_uids(struct file *filp, unsigned long arg)
{
	return -EINVAL;
}
#endif

L
Linus Torvalds 已提交
369 370 371 372 373 374 375
static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
		struct file *filp)
{
	long err = -EINVAL;

	switch (cmd) {
	case F_DUPFD:
U
Ulrich Drepper 已提交
376
	case F_DUPFD_CLOEXEC:
J
Jiri Slaby 已提交
377
		if (arg >= rlimit(RLIMIT_NOFILE))
A
Al Viro 已提交
378
			break;
379 380 381 382 383
		err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
		if (err >= 0) {
			get_file(filp);
			fd_install(err, filp);
		}
L
Linus Torvalds 已提交
384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402
		break;
	case F_GETFD:
		err = get_close_on_exec(fd) ? FD_CLOEXEC : 0;
		break;
	case F_SETFD:
		err = 0;
		set_close_on_exec(fd, arg & FD_CLOEXEC);
		break;
	case F_GETFL:
		err = filp->f_flags;
		break;
	case F_SETFL:
		err = setfl(fd, filp, arg);
		break;
	case F_GETLK:
		err = fcntl_getlk(filp, (struct flock __user *) arg);
		break;
	case F_SETLK:
	case F_SETLKW:
403
		err = fcntl_setlk(fd, filp, cmd, (struct flock __user *) arg);
L
Linus Torvalds 已提交
404 405 406 407 408 409 410 411 412
		break;
	case F_GETOWN:
		/*
		 * XXX If f_owner is a process group, the
		 * negative return value will get converted
		 * into an error.  Oops.  If we keep the
		 * current syscall conventions, the only way
		 * to fix this will be in libc.
		 */
413
		err = f_getown(filp);
L
Linus Torvalds 已提交
414 415 416 417 418
		force_successful_syscall_return();
		break;
	case F_SETOWN:
		err = f_setown(filp, arg, 1);
		break;
P
Peter Zijlstra 已提交
419 420 421 422 423 424
	case F_GETOWN_EX:
		err = f_getown_ex(filp, arg);
		break;
	case F_SETOWN_EX:
		err = f_setown_ex(filp, arg);
		break;
425 426 427
	case F_GETOWNER_UIDS:
		err = f_getowner_uids(filp, arg);
		break;
L
Linus Torvalds 已提交
428 429 430 431 432
	case F_GETSIG:
		err = filp->f_owner.signum;
		break;
	case F_SETSIG:
		/* arg == 0 restores default behaviour. */
433
		if (!valid_signal(arg)) {
L
Linus Torvalds 已提交
434 435 436 437 438 439 440 441 442 443 444 445 446 447
			break;
		}
		err = 0;
		filp->f_owner.signum = arg;
		break;
	case F_GETLEASE:
		err = fcntl_getlease(filp);
		break;
	case F_SETLEASE:
		err = fcntl_setlease(fd, filp, arg);
		break;
	case F_NOTIFY:
		err = fcntl_dirnotify(fd, filp, arg);
		break;
448 449 450 451
	case F_SETPIPE_SZ:
	case F_GETPIPE_SZ:
		err = pipe_fcntl(filp, cmd, arg);
		break;
L
Linus Torvalds 已提交
452 453 454 455 456 457
	default:
		break;
	}
	return err;
}

458 459 460 461 462 463 464 465 466 467 468 469 470
static int check_fcntl_cmd(unsigned cmd)
{
	switch (cmd) {
	case F_DUPFD:
	case F_DUPFD_CLOEXEC:
	case F_GETFD:
	case F_SETFD:
	case F_GETFL:
		return 1;
	}
	return 0;
}

471
SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
L
Linus Torvalds 已提交
472 473
{	
	struct file *filp;
474
	int fput_needed;
L
Linus Torvalds 已提交
475 476
	long err = -EBADF;

477
	filp = fget_raw_light(fd, &fput_needed);
L
Linus Torvalds 已提交
478 479 480
	if (!filp)
		goto out;

481
	if (unlikely(filp->f_mode & FMODE_PATH)) {
482 483
		if (!check_fcntl_cmd(cmd))
			goto out1;
484 485
	}

L
Linus Torvalds 已提交
486
	err = security_file_fcntl(filp, cmd, arg);
487 488
	if (!err)
		err = do_fcntl(fd, cmd, arg, filp);
L
Linus Torvalds 已提交
489

490 491
out1:
 	fput_light(filp, fput_needed);
L
Linus Torvalds 已提交
492 493 494 495 496
out:
	return err;
}

#if BITS_PER_LONG == 32
497 498
SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
		unsigned long, arg)
L
Linus Torvalds 已提交
499 500
{	
	struct file * filp;
501 502
	long err = -EBADF;
	int fput_needed;
L
Linus Torvalds 已提交
503

504
	filp = fget_raw_light(fd, &fput_needed);
L
Linus Torvalds 已提交
505 506 507
	if (!filp)
		goto out;

508
	if (unlikely(filp->f_mode & FMODE_PATH)) {
509 510
		if (!check_fcntl_cmd(cmd))
			goto out1;
511 512
	}

L
Linus Torvalds 已提交
513
	err = security_file_fcntl(filp, cmd, arg);
514 515
	if (err)
		goto out1;
L
Linus Torvalds 已提交
516 517 518 519 520 521 522
	
	switch (cmd) {
		case F_GETLK64:
			err = fcntl_getlk64(filp, (struct flock64 __user *) arg);
			break;
		case F_SETLK64:
		case F_SETLKW64:
523 524
			err = fcntl_setlk64(fd, filp, cmd,
					(struct flock64 __user *) arg);
L
Linus Torvalds 已提交
525 526 527 528 529
			break;
		default:
			err = do_fcntl(fd, cmd, arg, filp);
			break;
	}
530 531
out1:
	fput_light(filp, fput_needed);
L
Linus Torvalds 已提交
532 533 534 535 536 537 538
out:
	return err;
}
#endif

/* Table to convert sigio signal codes into poll band bitmaps */

539
static const long band_table[NSIGPOLL] = {
L
Linus Torvalds 已提交
540 541 542 543 544 545 546 547 548 549 550
	POLLIN | POLLRDNORM,			/* POLL_IN */
	POLLOUT | POLLWRNORM | POLLWRBAND,	/* POLL_OUT */
	POLLIN | POLLRDNORM | POLLMSG,		/* POLL_MSG */
	POLLERR,				/* POLL_ERR */
	POLLPRI | POLLRDBAND,			/* POLL_PRI */
	POLLHUP | POLLERR			/* POLL_HUP */
};

static inline int sigio_perm(struct task_struct *p,
                             struct fown_struct *fown, int sig)
{
551 552 553 554 555
	const struct cred *cred;
	int ret;

	rcu_read_lock();
	cred = __task_cred(p);
556 557 558
	ret = ((uid_eq(fown->euid, GLOBAL_ROOT_UID) ||
		uid_eq(fown->euid, cred->suid) || uid_eq(fown->euid, cred->uid) ||
		uid_eq(fown->uid,  cred->suid) || uid_eq(fown->uid,  cred->uid)) &&
559 560 561
	       !security_file_send_sigiotask(p, fown, sig));
	rcu_read_unlock();
	return ret;
L
Linus Torvalds 已提交
562 563 564
}

static void send_sigio_to_task(struct task_struct *p,
565
			       struct fown_struct *fown,
P
Peter Zijlstra 已提交
566
			       int fd, int reason, int group)
L
Linus Torvalds 已提交
567
{
568 569 570 571 572 573 574
	/*
	 * F_SETSIG can change ->signum lockless in parallel, make
	 * sure we read it once and use the same value throughout.
	 */
	int signum = ACCESS_ONCE(fown->signum);

	if (!sigio_perm(p, fown, signum))
L
Linus Torvalds 已提交
575 576
		return;

577
	switch (signum) {
L
Linus Torvalds 已提交
578 579 580 581 582 583 584 585
		siginfo_t si;
		default:
			/* Queue a rt signal with the appropriate fd as its
			   value.  We use SI_SIGIO as the source, not 
			   SI_KERNEL, since kernel signals always get 
			   delivered even if we can't queue.  Failure to
			   queue in this case _should_ be reported; we fall
			   back to SIGIO in that case. --sct */
586
			si.si_signo = signum;
L
Linus Torvalds 已提交
587 588 589 590 591
			si.si_errno = 0;
		        si.si_code  = reason;
			/* Make sure we are called with one of the POLL_*
			   reasons, otherwise we could leak kernel stack into
			   userspace.  */
592
			BUG_ON((reason & __SI_MASK) != __SI_POLL);
L
Linus Torvalds 已提交
593 594 595 596 597
			if (reason - POLL_IN >= NSIGPOLL)
				si.si_band  = ~0L;
			else
				si.si_band = band_table[reason - POLL_IN];
			si.si_fd    = fd;
P
Peter Zijlstra 已提交
598
			if (!do_send_sig_info(signum, &si, p, group))
L
Linus Torvalds 已提交
599 600 601
				break;
		/* fall-through: fall back on the old plain SIGIO signal */
		case 0:
P
Peter Zijlstra 已提交
602
			do_send_sig_info(SIGIO, SEND_SIG_PRIV, p, group);
L
Linus Torvalds 已提交
603 604 605 606 607 608
	}
}

void send_sigio(struct fown_struct *fown, int fd, int band)
{
	struct task_struct *p;
609 610
	enum pid_type type;
	struct pid *pid;
P
Peter Zijlstra 已提交
611
	int group = 1;
L
Linus Torvalds 已提交
612 613
	
	read_lock(&fown->lock);
P
Peter Zijlstra 已提交
614

615
	type = fown->pid_type;
P
Peter Zijlstra 已提交
616 617 618 619 620
	if (type == PIDTYPE_MAX) {
		group = 0;
		type = PIDTYPE_PID;
	}

L
Linus Torvalds 已提交
621 622 623 624 625
	pid = fown->pid;
	if (!pid)
		goto out_unlock_fown;
	
	read_lock(&tasklist_lock);
626
	do_each_pid_task(pid, type, p) {
P
Peter Zijlstra 已提交
627
		send_sigio_to_task(p, fown, fd, band, group);
628
	} while_each_pid_task(pid, type, p);
L
Linus Torvalds 已提交
629 630 631 632 633 634
	read_unlock(&tasklist_lock);
 out_unlock_fown:
	read_unlock(&fown->lock);
}

static void send_sigurg_to_task(struct task_struct *p,
P
Peter Zijlstra 已提交
635
				struct fown_struct *fown, int group)
L
Linus Torvalds 已提交
636 637
{
	if (sigio_perm(p, fown, SIGURG))
P
Peter Zijlstra 已提交
638
		do_send_sig_info(SIGURG, SEND_SIG_PRIV, p, group);
L
Linus Torvalds 已提交
639 640 641 642 643
}

int send_sigurg(struct fown_struct *fown)
{
	struct task_struct *p;
644 645
	enum pid_type type;
	struct pid *pid;
P
Peter Zijlstra 已提交
646
	int group = 1;
647
	int ret = 0;
L
Linus Torvalds 已提交
648 649
	
	read_lock(&fown->lock);
P
Peter Zijlstra 已提交
650

651
	type = fown->pid_type;
P
Peter Zijlstra 已提交
652 653 654 655 656
	if (type == PIDTYPE_MAX) {
		group = 0;
		type = PIDTYPE_PID;
	}

L
Linus Torvalds 已提交
657 658 659 660 661 662 663
	pid = fown->pid;
	if (!pid)
		goto out_unlock_fown;

	ret = 1;
	
	read_lock(&tasklist_lock);
664
	do_each_pid_task(pid, type, p) {
P
Peter Zijlstra 已提交
665
		send_sigurg_to_task(p, fown, group);
666
	} while_each_pid_task(pid, type, p);
L
Linus Torvalds 已提交
667 668 669 670 671 672
	read_unlock(&tasklist_lock);
 out_unlock_fown:
	read_unlock(&fown->lock);
	return ret;
}

673
static DEFINE_SPINLOCK(fasync_lock);
674
static struct kmem_cache *fasync_cache __read_mostly;
L
Linus Torvalds 已提交
675

676 677 678 679 680 681
static void fasync_free_rcu(struct rcu_head *head)
{
	kmem_cache_free(fasync_cache,
			container_of(head, struct fasync_struct, fa_rcu));
}

L
Linus Torvalds 已提交
682
/*
683 684 685 686 687 688 689
 * Remove a fasync entry. If successfully removed, return
 * positive and clear the FASYNC flag. If no entry exists,
 * do nothing and return 0.
 *
 * NOTE! It is very important that the FASYNC flag always
 * match the state "is the filp on a fasync list".
 *
L
Linus Torvalds 已提交
690
 */
691
int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
L
Linus Torvalds 已提交
692 693 694 695
{
	struct fasync_struct *fa, **fp;
	int result = 0;

696
	spin_lock(&filp->f_lock);
697
	spin_lock(&fasync_lock);
698 699 700
	for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
		if (fa->fa_file != filp)
			continue;
701 702 703 704 705

		spin_lock_irq(&fa->fa_lock);
		fa->fa_file = NULL;
		spin_unlock_irq(&fa->fa_lock);

706
		*fp = fa->fa_next;
707
		call_rcu(&fa->fa_rcu, fasync_free_rcu);
708 709 710
		filp->f_flags &= ~FASYNC;
		result = 1;
		break;
L
Linus Torvalds 已提交
711
	}
712
	spin_unlock(&fasync_lock);
713 714 715 716
	spin_unlock(&filp->f_lock);
	return result;
}

717 718 719 720 721
struct fasync_struct *fasync_alloc(void)
{
	return kmem_cache_alloc(fasync_cache, GFP_KERNEL);
}

722
/*
723 724 725
 * NOTE! This can be used only for unused fasync entries:
 * entries that actually got inserted on the fasync list
 * need to be released by rcu - see fasync_remove_entry.
726
 */
727
void fasync_free(struct fasync_struct *new)
728
{
729 730
	kmem_cache_free(fasync_cache, new);
}
731

732 733 734
/*
 * Insert a new entry into the fasync list.  Return the pointer to the
 * old one if we didn't use the new one.
735 736 737
 *
 * NOTE! It is very important that the FASYNC flag always
 * match the state "is the filp on a fasync list".
738 739 740 741
 */
struct fasync_struct *fasync_insert_entry(int fd, struct file *filp, struct fasync_struct **fapp, struct fasync_struct *new)
{
        struct fasync_struct *fa, **fp;
742 743

	spin_lock(&filp->f_lock);
744
	spin_lock(&fasync_lock);
L
Linus Torvalds 已提交
745
	for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
746 747
		if (fa->fa_file != filp)
			continue;
748 749

		spin_lock_irq(&fa->fa_lock);
750
		fa->fa_fd = fd;
751
		spin_unlock_irq(&fa->fa_lock);
752
		goto out;
L
Linus Torvalds 已提交
753 754
	}

755
	spin_lock_init(&new->fa_lock);
756 757 758 759
	new->magic = FASYNC_MAGIC;
	new->fa_file = filp;
	new->fa_fd = fd;
	new->fa_next = *fapp;
760
	rcu_assign_pointer(*fapp, new);
761 762
	filp->f_flags |= FASYNC;

L
Linus Torvalds 已提交
763
out:
764
	spin_unlock(&fasync_lock);
765
	spin_unlock(&filp->f_lock);
766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793
	return fa;
}

/*
 * Add a fasync entry. Return negative on error, positive if
 * added, and zero if did nothing but change an existing one.
 */
static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)
{
	struct fasync_struct *new;

	new = fasync_alloc();
	if (!new)
		return -ENOMEM;

	/*
	 * fasync_insert_entry() returns the old (update) entry if
	 * it existed.
	 *
	 * So free the (unused) new entry and return 0 to let the
	 * caller know that we didn't add any new fasync entries.
	 */
	if (fasync_insert_entry(fd, filp, fapp, new)) {
		fasync_free(new);
		return 0;
	}

	return 1;
L
Linus Torvalds 已提交
794 795
}

796 797 798 799 800 801 802 803 804 805 806 807 808
/*
 * fasync_helper() is used by almost all character device drivers
 * to set up the fasync queue, and for regular files by the file
 * lease code. It returns negative on error, 0 if it did no changes
 * and positive if it added/deleted the entry.
 */
int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
{
	if (!on)
		return fasync_remove_entry(filp, fapp);
	return fasync_add_entry(fd, filp, fapp);
}

L
Linus Torvalds 已提交
809 810
EXPORT_SYMBOL(fasync_helper);

811 812 813 814
/*
 * rcu_read_lock() is held
 */
static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
L
Linus Torvalds 已提交
815 816
{
	while (fa) {
817
		struct fown_struct *fown;
818 819
		unsigned long flags;

L
Linus Torvalds 已提交
820 821 822 823 824
		if (fa->magic != FASYNC_MAGIC) {
			printk(KERN_ERR "kill_fasync: bad magic number in "
			       "fasync_struct!\n");
			return;
		}
825
		spin_lock_irqsave(&fa->fa_lock, flags);
826 827 828 829 830 831 832 833
		if (fa->fa_file) {
			fown = &fa->fa_file->f_owner;
			/* Don't send SIGURG to processes which have not set a
			   queued signum: SIGURG has its own default signalling
			   mechanism. */
			if (!(sig == SIGURG && fown->signum == 0))
				send_sigio(fown, fa->fa_fd, band);
		}
834
		spin_unlock_irqrestore(&fa->fa_lock, flags);
835
		fa = rcu_dereference(fa->fa_next);
L
Linus Torvalds 已提交
836 837 838 839 840 841 842 843 844
	}
}

void kill_fasync(struct fasync_struct **fp, int sig, int band)
{
	/* First a quick test without locking: usually
	 * the list is empty.
	 */
	if (*fp) {
845 846 847
		rcu_read_lock();
		kill_fasync_rcu(rcu_dereference(*fp), sig, band);
		rcu_read_unlock();
L
Linus Torvalds 已提交
848 849 850 851
	}
}
EXPORT_SYMBOL(kill_fasync);

852
static int __init fcntl_init(void)
L
Linus Torvalds 已提交
853
{
854 855 856 857 858
	/*
	 * Please add new bits here to ensure allocation uniqueness.
	 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
	 * is defined as O_NONBLOCK on some platforms and not on others.
	 */
859
	BUILD_BUG_ON(19 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
860 861
		O_RDONLY	| O_WRONLY	| O_RDWR	|
		O_CREAT		| O_EXCL	| O_NOCTTY	|
862
		O_TRUNC		| O_APPEND	| /* O_NONBLOCK	| */
863 864 865
		__O_SYNC	| O_DSYNC	| FASYNC	|
		O_DIRECT	| O_LARGEFILE	| O_DIRECTORY	|
		O_NOFOLLOW	| O_NOATIME	| O_CLOEXEC	|
866
		__FMODE_EXEC	| O_PATH
867 868
		));

L
Linus Torvalds 已提交
869
	fasync_cache = kmem_cache_create("fasync_cache",
870
		sizeof(struct fasync_struct), 0, SLAB_PANIC, NULL);
L
Linus Torvalds 已提交
871 872 873
	return 0;
}

874
module_init(fcntl_init)