Line data Source code
1 : // SPDX-License-Identifier: GPL-2.0-only
2 : /*
3 : * linux/fs/open.c
4 : *
5 : * Copyright (C) 1991, 1992 Linus Torvalds
6 : */
7 :
8 : #include <linux/string.h>
9 : #include <linux/mm.h>
10 : #include <linux/file.h>
11 : #include <linux/fdtable.h>
12 : #include <linux/fsnotify.h>
13 : #include <linux/module.h>
14 : #include <linux/tty.h>
15 : #include <linux/namei.h>
16 : #include <linux/backing-dev.h>
17 : #include <linux/capability.h>
18 : #include <linux/securebits.h>
19 : #include <linux/security.h>
20 : #include <linux/mount.h>
21 : #include <linux/fcntl.h>
22 : #include <linux/slab.h>
23 : #include <linux/uaccess.h>
24 : #include <linux/fs.h>
25 : #include <linux/personality.h>
26 : #include <linux/pagemap.h>
27 : #include <linux/syscalls.h>
28 : #include <linux/rcupdate.h>
29 : #include <linux/audit.h>
30 : #include <linux/falloc.h>
31 : #include <linux/fs_struct.h>
32 : #include <linux/ima.h>
33 : #include <linux/dnotify.h>
34 : #include <linux/compat.h>
35 : #include <linux/mnt_idmapping.h>
36 : #include <linux/filelock.h>
37 :
38 : #include "internal.h"
39 :
40 11818722 : int do_truncate(struct mnt_idmap *idmap, struct dentry *dentry,
41 : loff_t length, unsigned int time_attrs, struct file *filp)
42 : {
43 11818722 : int ret;
44 11818722 : struct iattr newattrs;
45 :
46 : /* Not pretty: "inode->i_size" shouldn't really be signed. But it is. */
47 11818722 : if (length < 0)
48 : return -EINVAL;
49 :
50 11818722 : newattrs.ia_size = length;
51 11818722 : newattrs.ia_valid = ATTR_SIZE | time_attrs;
52 11818722 : if (filp) {
53 7371755 : newattrs.ia_file = filp;
54 7371755 : newattrs.ia_valid |= ATTR_FILE;
55 : }
56 :
57 : /* Remove suid, sgid, and file capabilities on truncate too */
58 11818722 : ret = dentry_needs_remove_privs(idmap, dentry);
59 11818497 : if (ret < 0)
60 : return ret;
61 11818497 : if (ret)
62 104 : newattrs.ia_valid |= ret | ATTR_FORCE;
63 :
64 11818497 : inode_lock(dentry->d_inode);
65 : /* Note any delegations or leases have already been broken: */
66 11818874 : ret = notify_change(idmap, dentry, &newattrs, NULL);
67 11818423 : inode_unlock(dentry->d_inode);
68 11818423 : return ret;
69 : }
70 :
71 4447065 : long vfs_truncate(const struct path *path, loff_t length)
72 : {
73 4447065 : struct mnt_idmap *idmap;
74 4447065 : struct inode *inode;
75 4447065 : long error;
76 :
77 4447065 : inode = path->dentry->d_inode;
78 :
79 : /* For directories it's -EISDIR, for other non-regulars - -EINVAL */
80 4447065 : if (S_ISDIR(inode->i_mode))
81 : return -EISDIR;
82 4447065 : if (!S_ISREG(inode->i_mode))
83 : return -EINVAL;
84 :
85 4447065 : error = mnt_want_write(path->mnt);
86 4447164 : if (error)
87 0 : goto out;
88 :
89 4447164 : idmap = mnt_idmap(path->mnt);
90 4447129 : error = inode_permission(idmap, inode, MAY_WRITE);
91 4447092 : if (error)
92 26 : goto mnt_drop_write_and_out;
93 :
94 4447066 : error = -EPERM;
95 4447066 : if (IS_APPEND(inode))
96 26 : goto mnt_drop_write_and_out;
97 :
98 4447040 : error = get_write_access(inode);
99 4447083 : if (error)
100 0 : goto mnt_drop_write_and_out;
101 :
102 : /*
103 : * Make sure that there are no leases. get_write_access() protects
104 : * against the truncate racing with a lease-granting setlease().
105 : */
106 4447083 : error = break_lease(inode, O_WRONLY);
107 4447102 : if (error)
108 13 : goto put_write_and_out;
109 :
110 4447089 : error = security_path_truncate(path);
111 4447089 : if (!error)
112 4447089 : error = do_truncate(idmap, path->dentry, length, 0, NULL);
113 :
114 4446767 : put_write_and_out:
115 4446767 : put_write_access(inode);
116 4447033 : mnt_drop_write_and_out:
117 4447033 : mnt_drop_write(path->mnt);
118 : out:
119 : return error;
120 : }
121 : EXPORT_SYMBOL_GPL(vfs_truncate);
122 :
123 4446999 : long do_sys_truncate(const char __user *pathname, loff_t length)
124 : {
125 4446999 : unsigned int lookup_flags = LOOKUP_FOLLOW;
126 4446999 : struct path path;
127 4446999 : int error;
128 :
129 4446999 : if (length < 0) /* sorry, but loff_t says... */
130 : return -EINVAL;
131 :
132 4446999 : retry:
133 4447011 : error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
134 4447166 : if (!error) {
135 4447146 : error = vfs_truncate(&path, length);
136 4446792 : path_put(&path);
137 : }
138 8893518 : if (retry_estale(error, lookup_flags)) {
139 15 : lookup_flags |= LOOKUP_REVAL;
140 15 : goto retry;
141 : }
142 : return error;
143 : }
144 :
145 8893879 : SYSCALL_DEFINE2(truncate, const char __user *, path, long, length)
146 : {
147 4447033 : return do_sys_truncate(path, length);
148 : }
149 :
150 : #ifdef CONFIG_COMPAT
151 0 : COMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path, compat_off_t, length)
152 : {
153 0 : return do_sys_truncate(path, length);
154 : }
155 : #endif
156 :
157 5943803 : long do_sys_ftruncate(unsigned int fd, loff_t length, int small)
158 : {
159 5943803 : struct inode *inode;
160 5943803 : struct dentry *dentry;
161 5943803 : struct fd f;
162 5943803 : int error;
163 :
164 5943803 : error = -EINVAL;
165 5943803 : if (length < 0)
166 0 : goto out;
167 5943803 : error = -EBADF;
168 5943803 : f = fdget(fd);
169 5943856 : if (!f.file)
170 0 : goto out;
171 :
172 : /* explicitly opened as large or we are on 64-bit box */
173 5943856 : if (f.file->f_flags & O_LARGEFILE)
174 5943918 : small = 0;
175 :
176 5943856 : dentry = f.file->f_path.dentry;
177 5943856 : inode = dentry->d_inode;
178 5943856 : error = -EINVAL;
179 5943856 : if (!S_ISREG(inode->i_mode) || !(f.file->f_mode & FMODE_WRITE))
180 0 : goto out_putf;
181 :
182 5943856 : error = -EINVAL;
183 : /* Cannot ftruncate over 2^31 bytes without large file support */
184 5943856 : if (small && length > MAX_NON_LFS)
185 0 : goto out_putf;
186 :
187 5943856 : error = -EPERM;
188 : /* Check IS_APPEND on real upper inode */
189 5943856 : if (IS_APPEND(file_inode(f.file)))
190 26 : goto out_putf;
191 5943830 : sb_start_write(inode->i_sb);
192 5943768 : error = security_file_truncate(f.file);
193 5943768 : if (!error)
194 5943768 : error = do_truncate(file_mnt_idmap(f.file), dentry, length,
195 : ATTR_MTIME | ATTR_CTIME, f.file);
196 5943915 : sb_end_write(inode->i_sb);
197 5943952 : out_putf:
198 5943952 : fdput(f);
199 5943966 : out:
200 5943966 : return error;
201 : }
202 :
203 11887822 : SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length)
204 : {
205 5943863 : return do_sys_ftruncate(fd, length, 1);
206 : }
207 :
208 : #ifdef CONFIG_COMPAT
209 0 : COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_ulong_t, length)
210 : {
211 0 : return do_sys_ftruncate(fd, length, 1);
212 : }
213 : #endif
214 :
215 : /* LFS versions of truncate are only needed on 32 bit machines */
216 : #if BITS_PER_LONG == 32
217 : SYSCALL_DEFINE2(truncate64, const char __user *, path, loff_t, length)
218 : {
219 : return do_sys_truncate(path, length);
220 : }
221 :
222 : SYSCALL_DEFINE2(ftruncate64, unsigned int, fd, loff_t, length)
223 : {
224 : return do_sys_ftruncate(fd, length, 0);
225 : }
226 : #endif /* BITS_PER_LONG == 32 */
227 :
228 : #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_TRUNCATE64)
229 : COMPAT_SYSCALL_DEFINE3(truncate64, const char __user *, pathname,
230 : compat_arg_u64_dual(length))
231 : {
232 : return ksys_truncate(pathname, compat_arg_u64_glue(length));
233 : }
234 : #endif
235 :
236 : #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FTRUNCATE64)
237 : COMPAT_SYSCALL_DEFINE3(ftruncate64, unsigned int, fd,
238 : compat_arg_u64_dual(length))
239 : {
240 : return ksys_ftruncate(fd, compat_arg_u64_glue(length));
241 : }
242 : #endif
243 :
244 213597451 : int vfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
245 : {
246 213597451 : struct inode *inode = file_inode(file);
247 213597451 : long ret;
248 :
249 213597451 : if (offset < 0 || len <= 0)
250 : return -EINVAL;
251 :
252 : /* Return error if mode is not supported */
253 68920487 : if (mode & ~FALLOC_FL_SUPPORTED_MASK)
254 : return -EOPNOTSUPP;
255 :
256 : /* Punch hole and zero range are mutually exclusive */
257 68920487 : if ((mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE)) ==
258 : (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE))
259 : return -EOPNOTSUPP;
260 :
261 : /* Punch hole must have keep size set */
262 68920487 : if ((mode & FALLOC_FL_PUNCH_HOLE) &&
263 : !(mode & FALLOC_FL_KEEP_SIZE))
264 : return -EOPNOTSUPP;
265 :
266 : /* Collapse range should only be used exclusively. */
267 67876549 : if ((mode & FALLOC_FL_COLLAPSE_RANGE) &&
268 4490932 : (mode & ~FALLOC_FL_COLLAPSE_RANGE))
269 : return -EINVAL;
270 :
271 : /* Insert range should only be used exclusively. */
272 66860754 : if ((mode & FALLOC_FL_INSERT_RANGE) &&
273 3756615 : (mode & ~FALLOC_FL_INSERT_RANGE))
274 : return -EINVAL;
275 :
276 : /* Unshare range should only be used with allocate mode. */
277 65845870 : if ((mode & FALLOC_FL_UNSHARE_RANGE) &&
278 318 : (mode & ~(FALLOC_FL_UNSHARE_RANGE | FALLOC_FL_KEEP_SIZE)))
279 : return -EINVAL;
280 :
281 : /* Mapping free space should only be used by itself. */
282 65845870 : if ((mode & FALLOC_FL_MAP_FREE_SPACE) &&
283 1122 : (mode & ~FALLOC_FL_MAP_FREE_SPACE))
284 : return -EINVAL;
285 :
286 65845870 : if (!(file->f_mode & FMODE_WRITE))
287 : return -EBADF;
288 :
289 : /*
290 : * We can only allow pure fallocate on append only files
291 : */
292 65845870 : if ((mode & ~FALLOC_FL_KEEP_SIZE) && IS_APPEND(inode))
293 : return -EPERM;
294 :
295 65845870 : if (IS_IMMUTABLE(inode))
296 : return -EPERM;
297 :
298 : /*
299 : * We cannot allow any fallocate operation on an active swapfile
300 : */
301 65845870 : if (IS_SWAPFILE(inode))
302 : return -ETXTBSY;
303 :
304 : /*
305 : * Revalidate the write permissions, in case security policy has
306 : * changed since the files were opened.
307 : */
308 65845845 : ret = security_file_permission(file, MAY_WRITE);
309 65845845 : if (ret)
310 : return ret;
311 :
312 65845845 : if (S_ISFIFO(inode->i_mode))
313 : return -ESPIPE;
314 :
315 65845845 : if (S_ISDIR(inode->i_mode))
316 : return -EISDIR;
317 :
318 65845845 : if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
319 : return -ENODEV;
320 :
321 : /* Check for wrap through zero too */
322 65845845 : if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0))
323 : return -EFBIG;
324 :
325 65845823 : if (!file->f_op->fallocate)
326 : return -EOPNOTSUPP;
327 :
328 65845498 : file_start_write(file);
329 65845561 : ret = file->f_op->fallocate(file, mode, offset, len);
330 :
331 : /*
332 : * Create inotify and fanotify events.
333 : *
334 : * To keep the logic simple always create events if fallocate succeeds.
335 : * This implies that events are even created if the file size remains
336 : * unchanged, e.g. when using flag FALLOC_FL_KEEP_SIZE.
337 : */
338 65846458 : if (ret == 0)
339 63289996 : fsnotify_modify(file);
340 :
341 65846234 : file_end_write(file);
342 65846314 : return ret;
343 : }
344 : EXPORT_SYMBOL_GPL(vfs_fallocate);
345 :
346 208271209 : int ksys_fallocate(int fd, int mode, loff_t offset, loff_t len)
347 : {
348 208271209 : struct fd f = fdget(fd);
349 208616974 : int error = -EBADF;
350 :
351 208616974 : if (f.file) {
352 208616974 : error = vfs_fallocate(f.file, mode, offset, len);
353 208653242 : fdput(f);
354 : }
355 208794591 : return error;
356 : }
357 :
358 417394479 : SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len)
359 : {
360 208578767 : return ksys_fallocate(fd, mode, offset, len);
361 : }
362 :
363 : #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FALLOCATE)
364 : COMPAT_SYSCALL_DEFINE6(fallocate, int, fd, int, mode, compat_arg_u64_dual(offset),
365 : compat_arg_u64_dual(len))
366 : {
367 : return ksys_fallocate(fd, mode, compat_arg_u64_glue(offset),
368 : compat_arg_u64_glue(len));
369 : }
370 : #endif
371 :
372 : /*
373 : * access() needs to use the real uid/gid, not the effective uid/gid.
374 : * We do this by temporarily clearing all FS-related capabilities and
375 : * switching the fsuid/fsgid around to the real ones.
376 : *
377 : * Creating new credentials is expensive, so we try to skip doing it,
378 : * which we can if the result would match what we already got.
379 : */
380 138205605 : static bool access_need_override_creds(int flags)
381 : {
382 138205605 : const struct cred *cred;
383 :
384 138205605 : if (flags & AT_EACCESS)
385 : return false;
386 :
387 138062618 : cred = current_cred();
388 138062618 : if (!uid_eq(cred->fsuid, cred->uid) ||
389 : !gid_eq(cred->fsgid, cred->gid))
390 : return true;
391 :
392 138061290 : if (!issecure(SECURE_NO_SETUID_FIXUP)) {
393 138085575 : kuid_t root_uid = make_kuid(cred->user_ns, 0);
394 138010269 : if (!uid_eq(cred->uid, root_uid)) {
395 461796 : if (!cap_isclear(cred->cap_effective))
396 74239 : return true;
397 : } else {
398 137548473 : if (!cap_isidentical(cred->cap_effective,
399 : cred->cap_permitted))
400 : return true;
401 : }
402 : }
403 :
404 : return false;
405 : }
406 :
407 85716 : static const struct cred *access_override_creds(void)
408 : {
409 85716 : const struct cred *old_cred;
410 85716 : struct cred *override_cred;
411 :
412 85716 : override_cred = prepare_creds();
413 85716 : if (!override_cred)
414 : return NULL;
415 :
416 : /*
417 : * XXX access_need_override_creds performs checks in hopes of skipping
418 : * this work. Make sure it stays in sync if making any changes in this
419 : * routine.
420 : */
421 :
422 85716 : override_cred->fsuid = override_cred->uid;
423 85716 : override_cred->fsgid = override_cred->gid;
424 :
425 85716 : if (!issecure(SECURE_NO_SETUID_FIXUP)) {
426 : /* Clear the capabilities if we switch to a non-root user */
427 85716 : kuid_t root_uid = make_kuid(override_cred->user_ns, 0);
428 85716 : if (!uid_eq(override_cred->uid, root_uid))
429 74317 : cap_clear(override_cred->cap_effective);
430 : else
431 11399 : override_cred->cap_effective =
432 : override_cred->cap_permitted;
433 : }
434 :
435 : /*
436 : * The new set of credentials can *only* be used in
437 : * task-synchronous circumstances, and does not need
438 : * RCU freeing, unless somebody then takes a separate
439 : * reference to it.
440 : *
441 : * NOTE! This is _only_ true because this credential
442 : * is used purely for override_creds() that installs
443 : * it as the subjective cred. Other threads will be
444 : * accessing ->real_cred, not the subjective cred.
445 : *
446 : * If somebody _does_ make a copy of this (using the
447 : * 'get_current_cred()' function), that will clear the
448 : * non_rcu field, because now that other user may be
449 : * expecting RCU freeing. But normal thread-synchronous
450 : * cred accesses will keep things non-RCY.
451 : */
452 85716 : override_cred->non_rcu = 1;
453 :
454 85716 : old_cred = override_creds(override_cred);
455 :
456 : /* override_cred() gets its own ref */
457 85716 : put_cred(override_cred);
458 :
459 85716 : return old_cred;
460 : }
461 :
462 138227655 : static long do_faccessat(int dfd, const char __user *filename, int mode, int flags)
463 : {
464 138227655 : struct path path;
465 138227655 : struct inode *inode;
466 138227655 : int res;
467 138227655 : unsigned int lookup_flags = LOOKUP_FOLLOW;
468 138227655 : const struct cred *old_cred = NULL;
469 :
470 138227655 : if (mode & ~S_IRWXO) /* where's F_OK, X_OK, W_OK, R_OK? */
471 : return -EINVAL;
472 :
473 138227655 : if (flags & ~(AT_EACCESS | AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH))
474 : return -EINVAL;
475 :
476 138227655 : if (flags & AT_SYMLINK_NOFOLLOW)
477 100222 : lookup_flags &= ~LOOKUP_FOLLOW;
478 138227655 : if (flags & AT_EMPTY_PATH)
479 0 : lookup_flags |= LOOKUP_EMPTY;
480 :
481 138227655 : if (access_need_override_creds(flags)) {
482 85716 : old_cred = access_override_creds();
483 85716 : if (!old_cred)
484 : return -ENOMEM;
485 : }
486 :
487 138151235 : retry:
488 138152064 : res = user_path_at(dfd, filename, lookup_flags, &path);
489 138220018 : if (res)
490 67523971 : goto out;
491 :
492 70696047 : inode = d_backing_inode(path.dentry);
493 :
494 70696047 : if ((mode & MAY_EXEC) && S_ISREG(inode->i_mode)) {
495 : /*
496 : * MAY_EXEC on regular files is denied if the fs is mounted
497 : * with the "noexec" flag.
498 : */
499 25524581 : res = -EACCES;
500 25524581 : if (path_noexec(&path))
501 0 : goto out_path_release;
502 : }
503 :
504 70684638 : res = inode_permission(mnt_idmap(path.mnt), inode, mode | MAY_ACCESS);
505 : /* SuS v2 requires we report a read only fs too */
506 70676384 : if (res || !(mode & S_IWOTH) || special_file(inode->i_mode))
507 70355488 : goto out_path_release;
508 : /*
509 : * This is a rare case where using __mnt_is_readonly()
510 : * is OK without a mnt_want/drop_write() pair. Since
511 : * no actual write to the fs is performed here, we do
512 : * not need to telegraph to that to anyone.
513 : *
514 : * By doing this, we accept that this access is
515 : * inherently racy and know that the fs may change
516 : * state before we even see this result.
517 : */
518 320896 : if (__mnt_is_readonly(path.mnt))
519 540 : res = -EROFS;
520 :
521 320395 : out_path_release:
522 70676423 : path_put(&path);
523 141480700 : if (retry_estale(res, lookup_flags)) {
524 829 : lookup_flags |= LOOKUP_REVAL;
525 829 : goto retry;
526 : }
527 70739521 : out:
528 138263492 : if (old_cred)
529 85716 : revert_creds(old_cred);
530 :
531 138245361 : return res;
532 : }
533 :
534 0 : SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
535 : {
536 0 : return do_faccessat(dfd, filename, mode, 0);
537 : }
538 :
539 2762935 : SYSCALL_DEFINE4(faccessat2, int, dfd, const char __user *, filename, int, mode,
540 : int, flags)
541 : {
542 1381247 : return do_faccessat(dfd, filename, mode, flags);
543 : }
544 :
545 273733399 : SYSCALL_DEFINE2(access, const char __user *, filename, int, mode)
546 : {
547 136888877 : return do_faccessat(AT_FDCWD, filename, mode, 0);
548 : }
549 :
550 2243501093 : SYSCALL_DEFINE1(chdir, const char __user *, filename)
551 : {
552 1121694532 : struct path path;
553 1121694532 : int error;
554 1121694532 : unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
555 1121733291 : retry:
556 1121733291 : error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
557 1120877800 : if (error)
558 94982206 : goto out;
559 :
560 1025895594 : error = path_permission(&path, MAY_EXEC | MAY_CHDIR);
561 1025472127 : if (error)
562 0 : goto dput_and_out;
563 :
564 1025472127 : set_fs_pwd(current->fs, &path);
565 :
566 1026198242 : dput_and_out:
567 1026198242 : path_put(&path);
568 2052492072 : if (retry_estale(error, lookup_flags)) {
569 38761 : lookup_flags |= LOOKUP_REVAL;
570 38761 : goto retry;
571 : }
572 1026207277 : out:
573 1121189483 : return error;
574 : }
575 :
576 12077122 : SYSCALL_DEFINE1(fchdir, unsigned int, fd)
577 : {
578 6038561 : struct fd f = fdget_raw(fd);
579 6038561 : int error;
580 :
581 6038561 : error = -EBADF;
582 6038561 : if (!f.file)
583 0 : goto out;
584 :
585 6038561 : error = -ENOTDIR;
586 6038561 : if (!d_can_lookup(f.file->f_path.dentry))
587 0 : goto out_putf;
588 :
589 6038561 : error = file_permission(f.file, MAY_EXEC | MAY_CHDIR);
590 6038559 : if (!error)
591 6038559 : set_fs_pwd(current->fs, &f.file->f_path);
592 0 : out_putf:
593 6038561 : fdput(f);
594 6038561 : out:
595 6038561 : return error;
596 : }
597 :
598 182 : SYSCALL_DEFINE1(chroot, const char __user *, filename)
599 : {
600 91 : struct path path;
601 91 : int error;
602 91 : unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
603 91 : retry:
604 91 : error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
605 91 : if (error)
606 0 : goto out;
607 :
608 91 : error = path_permission(&path, MAY_EXEC | MAY_CHDIR);
609 91 : if (error)
610 0 : goto dput_and_out;
611 :
612 91 : error = -EPERM;
613 91 : if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT))
614 0 : goto dput_and_out;
615 91 : error = security_path_chroot(&path);
616 91 : if (error)
617 : goto dput_and_out;
618 :
619 91 : set_fs_root(current->fs, &path);
620 91 : error = 0;
621 91 : dput_and_out:
622 91 : path_put(&path);
623 182 : if (retry_estale(error, lookup_flags)) {
624 0 : lookup_flags |= LOOKUP_REVAL;
625 0 : goto retry;
626 : }
627 91 : out:
628 91 : return error;
629 : }
630 :
631 1612036 : int chmod_common(const struct path *path, umode_t mode)
632 : {
633 1612036 : struct inode *inode = path->dentry->d_inode;
634 1612036 : struct inode *delegated_inode = NULL;
635 1612036 : struct iattr newattrs;
636 1612036 : int error;
637 :
638 1612036 : error = mnt_want_write(path->mnt);
639 1615424 : if (error)
640 : return error;
641 1615308 : retry_deleg:
642 1615308 : inode_lock(inode);
643 1615327 : error = security_path_chmod(path, mode);
644 1615327 : if (error)
645 : goto out_unlock;
646 1615327 : newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
647 1615327 : newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
648 1615327 : error = notify_change(mnt_idmap(path->mnt), path->dentry,
649 : &newattrs, &delegated_inode);
650 : out_unlock:
651 1616057 : inode_unlock(inode);
652 1616841 : if (delegated_inode) {
653 0 : error = break_deleg_wait(&delegated_inode);
654 0 : if (!error)
655 0 : goto retry_deleg;
656 : }
657 1616841 : mnt_drop_write(path->mnt);
658 1616841 : return error;
659 : }
660 :
661 0 : int vfs_fchmod(struct file *file, umode_t mode)
662 : {
663 1572678 : audit_file(file);
664 0 : return chmod_common(&file->f_path, mode);
665 : }
666 :
667 3148067 : SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode)
668 : {
669 1572716 : struct fd f = fdget(fd);
670 1572678 : int err = -EBADF;
671 :
672 1572678 : if (f.file) {
673 1572678 : err = vfs_fchmod(f.file, mode);
674 1574783 : fdput(f);
675 : }
676 1577614 : return err;
677 : }
678 :
679 38054 : static int do_fchmodat(int dfd, const char __user *filename, umode_t mode)
680 : {
681 38054 : struct path path;
682 38054 : int error;
683 38054 : unsigned int lookup_flags = LOOKUP_FOLLOW;
684 38054 : retry:
685 38054 : error = user_path_at(dfd, filename, lookup_flags, &path);
686 38054 : if (!error) {
687 38054 : error = chmod_common(&path, mode);
688 38054 : path_put(&path);
689 76108 : if (retry_estale(error, lookup_flags)) {
690 0 : lookup_flags |= LOOKUP_REVAL;
691 0 : goto retry;
692 : }
693 : }
694 38054 : return error;
695 : }
696 :
697 12168 : SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename,
698 : umode_t, mode)
699 : {
700 6084 : return do_fchmodat(dfd, filename, mode);
701 : }
702 :
703 63940 : SYSCALL_DEFINE2(chmod, const char __user *, filename, umode_t, mode)
704 : {
705 31970 : return do_fchmodat(AT_FDCWD, filename, mode);
706 : }
707 :
708 : /*
709 : * Check whether @kuid is valid and if so generate and set vfsuid_t in
710 : * ia_vfsuid.
711 : *
712 : * Return: true if @kuid is valid, false if not.
713 : */
714 : static inline bool setattr_vfsuid(struct iattr *attr, kuid_t kuid)
715 : {
716 19729537 : if (!uid_valid(kuid))
717 : return false;
718 19599472 : attr->ia_valid |= ATTR_UID;
719 19599472 : attr->ia_vfsuid = VFSUIDT_INIT(kuid);
720 19599472 : return true;
721 : }
722 :
723 : /*
724 : * Check whether @kgid is valid and if so generate and set vfsgid_t in
725 : * ia_vfsgid.
726 : *
727 : * Return: true if @kgid is valid, false if not.
728 : */
729 : static inline bool setattr_vfsgid(struct iattr *attr, kgid_t kgid)
730 : {
731 19641935 : if (!gid_valid(kgid))
732 : return false;
733 19641935 : attr->ia_valid |= ATTR_GID;
734 19641935 : attr->ia_vfsgid = VFSGIDT_INIT(kgid);
735 19641935 : return true;
736 : }
737 :
738 19780412 : int chown_common(const struct path *path, uid_t user, gid_t group)
739 : {
740 19780412 : struct mnt_idmap *idmap;
741 19780412 : struct user_namespace *fs_userns;
742 19780412 : struct inode *inode = path->dentry->d_inode;
743 19780412 : struct inode *delegated_inode = NULL;
744 19780412 : int error;
745 19780412 : struct iattr newattrs;
746 19780412 : kuid_t uid;
747 19780412 : kgid_t gid;
748 :
749 19780412 : uid = make_kuid(current_user_ns(), user);
750 19722885 : gid = make_kgid(current_user_ns(), group);
751 :
752 19744474 : idmap = mnt_idmap(path->mnt);
753 19746190 : fs_userns = i_user_ns(inode);
754 :
755 19776295 : retry_deleg:
756 19776295 : newattrs.ia_vfsuid = INVALID_VFSUID;
757 19776295 : newattrs.ia_vfsgid = INVALID_VFSGID;
758 19776295 : newattrs.ia_valid = ATTR_CTIME;
759 19776295 : if ((user != (uid_t)-1) && !setattr_vfsuid(&newattrs, uid))
760 : return -EINVAL;
761 19646230 : if ((group != (gid_t)-1) && !setattr_vfsgid(&newattrs, gid))
762 : return -EINVAL;
763 19646230 : inode_lock(inode);
764 19625761 : if (!S_ISDIR(inode->i_mode))
765 18312416 : newattrs.ia_valid |= ATTR_KILL_SUID | ATTR_KILL_PRIV |
766 18309036 : setattr_should_drop_sgid(idmap, inode);
767 : /* Continue to send actual fs values, not the mount values. */
768 19629141 : error = security_path_chown(
769 : path,
770 : from_vfsuid(idmap, fs_userns, newattrs.ia_vfsuid),
771 : from_vfsgid(idmap, fs_userns, newattrs.ia_vfsgid));
772 19612462 : if (!error)
773 19612462 : error = notify_change(idmap, path->dentry, &newattrs,
774 : &delegated_inode);
775 19758152 : inode_unlock(inode);
776 19751315 : if (delegated_inode) {
777 0 : error = break_deleg_wait(&delegated_inode);
778 33191 : if (!error)
779 33191 : goto retry_deleg;
780 : }
781 : return error;
782 : }
783 :
784 8078396 : int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group,
785 : int flag)
786 : {
787 8078396 : struct path path;
788 8078396 : int error = -EINVAL;
789 8078396 : int lookup_flags;
790 :
791 8078396 : if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
792 0 : goto out;
793 :
794 8078396 : lookup_flags = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW;
795 8078396 : if (flag & AT_EMPTY_PATH)
796 6552 : lookup_flags |= LOOKUP_EMPTY;
797 8071844 : retry:
798 8078462 : error = user_path_at(dfd, filename, lookup_flags, &path);
799 8078438 : if (error)
800 8 : goto out;
801 8078430 : error = mnt_want_write(path.mnt);
802 8078446 : if (error)
803 0 : goto out_release;
804 8078446 : error = chown_common(&path, user, group);
805 8078129 : mnt_drop_write(path.mnt);
806 8078099 : out_release:
807 8078099 : path_put(&path);
808 16155454 : if (retry_estale(error, lookup_flags)) {
809 69 : lookup_flags |= LOOKUP_REVAL;
810 69 : goto retry;
811 : }
812 8077661 : out:
813 8077669 : return error;
814 : }
815 :
816 2149208 : SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
817 : gid_t, group, int, flag)
818 : {
819 1074604 : return do_fchownat(dfd, filename, user, group, flag);
820 : }
821 :
822 807112 : SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
823 : {
824 403556 : return do_fchownat(AT_FDCWD, filename, user, group, 0);
825 : }
826 :
827 13199999 : SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group)
828 : {
829 6600244 : return do_fchownat(AT_FDCWD, filename, user, group,
830 : AT_SYMLINK_NOFOLLOW);
831 : }
832 :
833 11757117 : int vfs_fchown(struct file *file, uid_t user, gid_t group)
834 : {
835 11757117 : int error;
836 :
837 11757117 : error = mnt_want_write_file(file);
838 11669223 : if (error)
839 : return error;
840 11670701 : audit_file(file);
841 11670701 : error = chown_common(&file->f_path, user, group);
842 11790605 : mnt_drop_write_file(file);
843 11790605 : return error;
844 : }
845 :
846 11652100 : int ksys_fchown(unsigned int fd, uid_t user, gid_t group)
847 : {
848 11652100 : struct fd f = fdget(fd);
849 11724105 : int error = -EBADF;
850 :
851 11724105 : if (f.file) {
852 11724105 : error = vfs_fchown(f.file, user, group);
853 11783130 : fdput(f);
854 : }
855 11783130 : return error;
856 : }
857 :
858 23530171 : SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
859 : {
860 11747345 : return ksys_fchown(fd, user, group);
861 : }
862 :
863 1322976987 : static int do_dentry_open(struct file *f,
864 : struct inode *inode,
865 : int (*open)(struct inode *, struct file *))
866 : {
867 1322976987 : static const struct file_operations empty_fops = {};
868 1322976987 : int error;
869 :
870 1322976987 : path_get(&f->f_path);
871 1323730628 : f->f_inode = inode;
872 1323730628 : f->f_mapping = inode->i_mapping;
873 1323730628 : f->f_wb_err = filemap_sample_wb_err(f->f_mapping);
874 1324092487 : f->f_sb_err = file_sample_sb_err(f);
875 :
876 1323758059 : if (unlikely(f->f_flags & O_PATH)) {
877 74219752 : f->f_mode = FMODE_PATH | FMODE_OPENED;
878 74219752 : f->f_op = &empty_fops;
879 74219752 : return 0;
880 : }
881 :
882 1249538307 : if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) {
883 626808598 : i_readcount_inc(inode);
884 622729709 : } else if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
885 611198950 : error = get_write_access(inode);
886 612023168 : if (unlikely(error))
887 0 : goto cleanup_file;
888 612023168 : error = __mnt_want_write(f->f_path.mnt);
889 612139657 : if (unlikely(error)) {
890 0 : put_write_access(inode);
891 0 : goto cleanup_file;
892 : }
893 612139657 : f->f_mode |= FMODE_WRITER;
894 : }
895 :
896 : /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */
897 1251138858 : if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode))
898 1234831549 : f->f_mode |= FMODE_ATOMIC_POS;
899 :
900 1251138858 : f->f_op = fops_get(inode->i_fop);
901 1250560849 : if (WARN_ON(!f->f_op)) {
902 0 : error = -ENODEV;
903 0 : goto cleanup_all;
904 : }
905 :
906 1250560849 : error = security_file_open(f);
907 1250560849 : if (error)
908 : goto cleanup_all;
909 :
910 1250560849 : error = break_lease(file_inode(f), f->f_flags);
911 1250942885 : if (error)
912 0 : goto cleanup_all;
913 :
914 : /* normally all 3 are set; ->open() can clear them if needed */
915 1250942885 : f->f_mode |= FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE;
916 1250942885 : if (!open)
917 1250934630 : open = f->f_op->open;
918 1250942885 : if (open) {
919 1246415081 : error = open(inode, f);
920 1244374522 : if (error)
921 1438876 : goto cleanup_all;
922 : }
923 1247463450 : f->f_mode |= FMODE_OPENED;
924 1247463450 : if ((f->f_mode & FMODE_READ) &&
925 669785726 : likely(f->f_op->read || f->f_op->read_iter))
926 669675401 : f->f_mode |= FMODE_CAN_READ;
927 1247463450 : if ((f->f_mode & FMODE_WRITE) &&
928 621222283 : likely(f->f_op->write || f->f_op->write_iter))
929 621113822 : f->f_mode |= FMODE_CAN_WRITE;
930 1247463450 : if ((f->f_mode & FMODE_LSEEK) && !f->f_op->llseek)
931 1864 : f->f_mode &= ~FMODE_LSEEK;
932 1247463450 : if (f->f_mapping->a_ops && f->f_mapping->a_ops->direct_IO)
933 52932869 : f->f_mode |= FMODE_CAN_ODIRECT;
934 :
935 1247463450 : f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC);
936 1247463450 : f->f_iocb_flags = iocb_flags(f);
937 :
938 1247463450 : file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping);
939 :
940 1247057833 : if ((f->f_flags & O_DIRECT) && !(f->f_mode & FMODE_CAN_ODIRECT))
941 : return -EINVAL;
942 :
943 : /*
944 : * XXX: Huge page cache doesn't support writing yet. Drop all page
945 : * cache for this file before processing writes.
946 : */
947 1247057825 : if (f->f_mode & FMODE_WRITE) {
948 : /*
949 : * Paired with smp_mb() in collapse_file() to ensure nr_thps
950 : * is up to date and the update to i_writecount by
951 : * get_write_access() is visible. Ensures subsequent insertion
952 : * of THPs into the page cache will fail.
953 : */
954 621027814 : smp_mb();
955 621027814 : if (filemap_nr_thps(inode->i_mapping)) {
956 : struct address_space *mapping = inode->i_mapping;
957 :
958 : filemap_invalidate_lock(inode->i_mapping);
959 : /*
960 : * unmap_mapping_range just need to be called once
961 : * here, because the private pages is not need to be
962 : * unmapped mapping (e.g. data segment of dynamic
963 : * shared libraries here).
964 : */
965 : unmap_mapping_range(mapping, 0, 0, 0);
966 : truncate_inode_pages(mapping, 0);
967 : filemap_invalidate_unlock(inode->i_mapping);
968 : }
969 : }
970 :
971 : /*
972 : * Once we return a file with FMODE_OPENED, __fput() will call
973 : * fsnotify_close(), so we need fsnotify_open() here for symmetry.
974 : */
975 1248210221 : fsnotify_open(f);
976 1248210221 : return 0;
977 :
978 1438876 : cleanup_all:
979 1438876 : if (WARN_ON_ONCE(error > 0))
980 0 : error = -EINVAL;
981 1438876 : fops_put(f->f_op);
982 1438873 : put_file_access(f);
983 1438868 : cleanup_file:
984 1438868 : path_put(&f->f_path);
985 1438875 : f->f_path.mnt = NULL;
986 1438875 : f->f_path.dentry = NULL;
987 1438875 : f->f_inode = NULL;
988 1438875 : return error;
989 : }
990 :
991 : /**
992 : * finish_open - finish opening a file
993 : * @file: file pointer
994 : * @dentry: pointer to dentry
995 : * @open: open callback
996 : *
997 : * This can be used to finish opening a file passed to i_op->atomic_open().
998 : *
999 : * If the open callback is set to NULL, then the standard f_op->open()
1000 : * filesystem callback is substituted.
1001 : *
1002 : * NB: the dentry reference is _not_ consumed. If, for example, the dentry is
1003 : * the return value of d_splice_alias(), then the caller needs to perform dput()
1004 : * on it after finish_open().
1005 : *
1006 : * Returns zero on success or -errno if the open failed.
1007 : */
1008 7935855 : int finish_open(struct file *file, struct dentry *dentry,
1009 : int (*open)(struct inode *, struct file *))
1010 : {
1011 7935855 : BUG_ON(file->f_mode & FMODE_OPENED); /* once it's opened, it's opened */
1012 :
1013 7935855 : file->f_path.dentry = dentry;
1014 7935855 : return do_dentry_open(file, d_backing_inode(dentry), open);
1015 : }
1016 : EXPORT_SYMBOL(finish_open);
1017 :
1018 : /**
1019 : * finish_no_open - finish ->atomic_open() without opening the file
1020 : *
1021 : * @file: file pointer
1022 : * @dentry: dentry or NULL (as returned from ->lookup())
1023 : *
1024 : * This can be used to set the result of a successful lookup in ->atomic_open().
1025 : *
1026 : * NB: unlike finish_open() this function does consume the dentry reference and
1027 : * the caller need not dput() it.
1028 : *
1029 : * Returns "0" which must be the return value of ->atomic_open() after having
1030 : * called this function.
1031 : */
1032 30718 : int finish_no_open(struct file *file, struct dentry *dentry)
1033 : {
1034 30718 : file->f_path.dentry = dentry;
1035 30718 : return 0;
1036 : }
1037 : EXPORT_SYMBOL(finish_no_open);
1038 :
1039 201 : char *file_path(struct file *filp, char *buf, int buflen)
1040 : {
1041 201 : return d_path(&filp->f_path, buf, buflen);
1042 : }
1043 : EXPORT_SYMBOL(file_path);
1044 :
1045 : /**
1046 : * vfs_open - open the file at the given path
1047 : * @path: path to open
1048 : * @file: newly allocated file with f_flag initialized
1049 : */
1050 1271632433 : int vfs_open(const struct path *path, struct file *file)
1051 : {
1052 1271632433 : file->f_path = *path;
1053 1271632433 : return do_dentry_open(file, d_backing_inode(path->dentry), NULL);
1054 : }
1055 :
1056 78872463 : struct file *dentry_open(const struct path *path, int flags,
1057 : const struct cred *cred)
1058 : {
1059 78872463 : int error;
1060 78872463 : struct file *f;
1061 :
1062 78872463 : validate_creds(cred);
1063 :
1064 : /* We must always pass in a valid mount pointer. */
1065 78872463 : BUG_ON(!path->mnt);
1066 :
1067 78872463 : f = alloc_empty_file(flags, cred);
1068 78701756 : if (!IS_ERR(f)) {
1069 78701756 : error = vfs_open(path, f);
1070 78399629 : if (error) {
1071 0 : fput(f);
1072 0 : f = ERR_PTR(error);
1073 : }
1074 : }
1075 78399629 : return f;
1076 : }
1077 : EXPORT_SYMBOL(dentry_open);
1078 :
1079 : /**
1080 : * dentry_create - Create and open a file
1081 : * @path: path to create
1082 : * @flags: O_ flags
1083 : * @mode: mode bits for new file
1084 : * @cred: credentials to use
1085 : *
1086 : * Caller must hold the parent directory's lock, and have prepared
1087 : * a negative dentry, placed in @path->dentry, for the new file.
1088 : *
1089 : * Caller sets @path->mnt to the vfsmount of the filesystem where
1090 : * the new file is to be created. The parent directory and the
1091 : * negative dentry must reside on the same filesystem instance.
1092 : *
1093 : * On success, returns a "struct file *". Otherwise a ERR_PTR
1094 : * is returned.
1095 : */
1096 0 : struct file *dentry_create(const struct path *path, int flags, umode_t mode,
1097 : const struct cred *cred)
1098 : {
1099 0 : struct file *f;
1100 0 : int error;
1101 :
1102 0 : validate_creds(cred);
1103 0 : f = alloc_empty_file(flags, cred);
1104 0 : if (IS_ERR(f))
1105 : return f;
1106 :
1107 0 : error = vfs_create(mnt_idmap(path->mnt),
1108 0 : d_inode(path->dentry->d_parent),
1109 0 : path->dentry, mode, true);
1110 0 : if (!error)
1111 0 : error = vfs_open(path, f);
1112 :
1113 0 : if (unlikely(error)) {
1114 0 : fput(f);
1115 0 : return ERR_PTR(error);
1116 : }
1117 : return f;
1118 : }
1119 : EXPORT_SYMBOL(dentry_create);
1120 :
1121 : /**
1122 : * kernel_file_open - open a file for kernel internal use
1123 : * @path: path of the file to open
1124 : * @flags: open flags
1125 : * @inode: the inode
1126 : * @cred: credentials for open
1127 : *
1128 : * Open a file for use by in-kernel consumers. The file is not accounted
1129 : * against nr_files and must not be installed into the file descriptor
1130 : * table.
1131 : *
1132 : * Return: Opened file on success, an error pointer on failure.
1133 : */
1134 0 : struct file *kernel_file_open(const struct path *path, int flags,
1135 : struct inode *inode, const struct cred *cred)
1136 : {
1137 0 : struct file *f;
1138 0 : int error;
1139 :
1140 0 : f = alloc_empty_file_noaccount(flags, cred);
1141 0 : if (IS_ERR(f))
1142 : return f;
1143 :
1144 0 : f->f_path = *path;
1145 0 : error = do_dentry_open(f, inode, NULL);
1146 0 : if (error) {
1147 0 : fput(f);
1148 0 : f = ERR_PTR(error);
1149 : }
1150 : return f;
1151 : }
1152 : EXPORT_SYMBOL_GPL(kernel_file_open);
1153 :
1154 : /**
1155 : * backing_file_open - open a backing file for kernel internal use
1156 : * @path: path of the file to open
1157 : * @flags: open flags
1158 : * @path: path of the backing file
1159 : * @cred: credentials for open
1160 : *
1161 : * Open a backing file for a stackable filesystem (e.g., overlayfs).
1162 : * @path may be on the stackable filesystem and backing inode on the
1163 : * underlying filesystem. In this case, we want to be able to return
1164 : * the @real_path of the backing inode. This is done by embedding the
1165 : * returned file into a container structure that also stores the path of
1166 : * the backing inode on the underlying filesystem, which can be
1167 : * retrieved using backing_file_real_path().
1168 : */
1169 43628517 : struct file *backing_file_open(const struct path *path, int flags,
1170 : const struct path *real_path,
1171 : const struct cred *cred)
1172 : {
1173 43628517 : struct file *f;
1174 43628517 : int error;
1175 :
1176 43628517 : f = alloc_empty_backing_file(flags, cred);
1177 43677376 : if (IS_ERR(f))
1178 : return f;
1179 :
1180 43677376 : f->f_path = *path;
1181 43677376 : path_get(real_path);
1182 43702531 : *backing_file_real_path(f) = *real_path;
1183 43677081 : error = do_dentry_open(f, d_inode(real_path->dentry), NULL);
1184 43683533 : if (error) {
1185 109 : fput(f);
1186 109 : f = ERR_PTR(error);
1187 : }
1188 :
1189 : return f;
1190 : }
1191 : EXPORT_SYMBOL_GPL(backing_file_open);
1192 :
1193 : #define WILL_CREATE(flags) (flags & (O_CREAT | __O_TMPFILE))
1194 : #define O_PATH_FLAGS (O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC)
1195 :
1196 0 : inline struct open_how build_open_how(int flags, umode_t mode)
1197 : {
1198 1153607979 : struct open_how how = {
1199 0 : .flags = flags & VALID_OPEN_FLAGS,
1200 1153607979 : .mode = mode & S_IALLUGO,
1201 : };
1202 :
1203 : /* O_PATH beats everything else. */
1204 0 : if (how.flags & O_PATH)
1205 76463708 : how.flags &= O_PATH_FLAGS;
1206 : /* Modes should only be set for create-like flags. */
1207 1153607979 : if (!WILL_CREATE(how.flags))
1208 1071929857 : how.mode = 0;
1209 1153607979 : return how;
1210 : }
1211 :
1212 1153158525 : inline int build_open_flags(const struct open_how *how, struct open_flags *op)
1213 : {
1214 1153158525 : u64 flags = how->flags;
1215 1153158525 : u64 strip = __FMODE_NONOTIFY | O_CLOEXEC;
1216 1153158525 : int lookup_flags = 0;
1217 1153158525 : int acc_mode = ACC_MODE(flags);
1218 :
1219 1153158525 : BUILD_BUG_ON_MSG(upper_32_bits(VALID_OPEN_FLAGS),
1220 : "struct open_flags doesn't yet handle flags > 32 bits");
1221 :
1222 : /*
1223 : * Strip flags that either shouldn't be set by userspace like
1224 : * FMODE_NONOTIFY or that aren't relevant in determining struct
1225 : * open_flags like O_CLOEXEC.
1226 : */
1227 1153158525 : flags &= ~strip;
1228 :
1229 : /*
1230 : * Older syscalls implicitly clear all of the invalid flags or argument
1231 : * values before calling build_open_flags(), but openat2(2) checks all
1232 : * of its arguments.
1233 : */
1234 1153158525 : if (flags & ~VALID_OPEN_FLAGS)
1235 : return -EINVAL;
1236 1153158525 : if (how->resolve & ~VALID_RESOLVE_FLAGS)
1237 : return -EINVAL;
1238 :
1239 : /* Scoping flags are mutually exclusive. */
1240 1153158525 : if ((how->resolve & RESOLVE_BENEATH) && (how->resolve & RESOLVE_IN_ROOT))
1241 : return -EINVAL;
1242 :
1243 : /* Deal with the mode. */
1244 1153158525 : if (WILL_CREATE(flags)) {
1245 81406694 : if (how->mode & ~S_IALLUGO)
1246 : return -EINVAL;
1247 81406694 : op->mode = how->mode | S_IFREG;
1248 : } else {
1249 1071751831 : if (how->mode != 0)
1250 : return -EINVAL;
1251 1071751831 : op->mode = 0;
1252 : }
1253 :
1254 : /*
1255 : * Block bugs where O_DIRECTORY | O_CREAT created regular files.
1256 : * Note, that blocking O_DIRECTORY | O_CREAT here also protects
1257 : * O_TMPFILE below which requires O_DIRECTORY being raised.
1258 : */
1259 1153158525 : if ((flags & (O_DIRECTORY | O_CREAT)) == (O_DIRECTORY | O_CREAT))
1260 : return -EINVAL;
1261 :
1262 : /* Now handle the creative implementation of O_TMPFILE. */
1263 1153158525 : if (flags & __O_TMPFILE) {
1264 : /*
1265 : * In order to ensure programs get explicit errors when trying
1266 : * to use O_TMPFILE on old kernels we enforce that O_DIRECTORY
1267 : * is raised alongside __O_TMPFILE.
1268 : */
1269 8211364 : if (!(flags & O_DIRECTORY))
1270 : return -EINVAL;
1271 8211364 : if (!(acc_mode & MAY_WRITE))
1272 : return -EINVAL;
1273 : }
1274 1153158512 : if (flags & O_PATH) {
1275 : /* O_PATH only permits certain other flags to be set. */
1276 76258917 : if (flags & ~O_PATH_FLAGS)
1277 : return -EINVAL;
1278 : acc_mode = 0;
1279 : }
1280 :
1281 : /*
1282 : * O_SYNC is implemented as __O_SYNC|O_DSYNC. As many places only
1283 : * check for O_DSYNC if the need any syncing at all we enforce it's
1284 : * always set instead of having to deal with possibly weird behaviour
1285 : * for malicious applications setting only __O_SYNC.
1286 : */
1287 1153158512 : if (flags & __O_SYNC)
1288 72529 : flags |= O_DSYNC;
1289 :
1290 1153158512 : op->open_flag = flags;
1291 :
1292 : /* O_TRUNC implies we need access checks for write permissions */
1293 1153158512 : if (flags & O_TRUNC)
1294 43737806 : acc_mode |= MAY_WRITE;
1295 :
1296 : /* Allow the LSM permission hook to distinguish append
1297 : access from general write access. */
1298 1153158512 : if (flags & O_APPEND)
1299 5535464 : acc_mode |= MAY_APPEND;
1300 :
1301 1153158512 : op->acc_mode = acc_mode;
1302 :
1303 1153158512 : op->intent = flags & O_PATH ? 0 : LOOKUP_OPEN;
1304 :
1305 1153158512 : if (flags & O_CREAT) {
1306 72843981 : op->intent |= LOOKUP_CREATE;
1307 72843981 : if (flags & O_EXCL) {
1308 16701630 : op->intent |= LOOKUP_EXCL;
1309 16701630 : flags |= O_NOFOLLOW;
1310 : }
1311 : }
1312 :
1313 1153158512 : if (flags & O_DIRECTORY)
1314 44221137 : lookup_flags |= LOOKUP_DIRECTORY;
1315 1153158512 : if (!(flags & O_NOFOLLOW))
1316 1051828189 : lookup_flags |= LOOKUP_FOLLOW;
1317 :
1318 1153158512 : if (how->resolve & RESOLVE_NO_XDEV)
1319 0 : lookup_flags |= LOOKUP_NO_XDEV;
1320 1153158512 : if (how->resolve & RESOLVE_NO_MAGICLINKS)
1321 0 : lookup_flags |= LOOKUP_NO_MAGICLINKS;
1322 1153158512 : if (how->resolve & RESOLVE_NO_SYMLINKS)
1323 0 : lookup_flags |= LOOKUP_NO_SYMLINKS;
1324 1153158512 : if (how->resolve & RESOLVE_BENEATH)
1325 0 : lookup_flags |= LOOKUP_BENEATH;
1326 1153158512 : if (how->resolve & RESOLVE_IN_ROOT)
1327 0 : lookup_flags |= LOOKUP_IN_ROOT;
1328 1153158512 : if (how->resolve & RESOLVE_CACHED) {
1329 : /* Don't bother even trying for create/truncate/tmpfile open */
1330 0 : if (flags & (O_TRUNC | O_CREAT | O_TMPFILE))
1331 : return -EAGAIN;
1332 0 : lookup_flags |= LOOKUP_CACHED;
1333 : }
1334 :
1335 1153158512 : op->lookup_flags = lookup_flags;
1336 1153158512 : return 0;
1337 : }
1338 :
1339 : /**
1340 : * file_open_name - open file and return file pointer
1341 : *
1342 : * @name: struct filename containing path to open
1343 : * @flags: open flags as per the open(2) second argument
1344 : * @mode: mode for the new file if O_CREAT is set, else ignored
1345 : *
1346 : * This is the helper to open a file from kernelspace if you really
1347 : * have to. But in generally you should not do this, so please move
1348 : * along, nothing to see here..
1349 : */
1350 20125 : struct file *file_open_name(struct filename *name, int flags, umode_t mode)
1351 : {
1352 20125 : struct open_flags op;
1353 20125 : struct open_how how = build_open_how(flags, mode);
1354 20125 : int err = build_open_flags(&how, &op);
1355 20109 : if (err)
1356 0 : return ERR_PTR(err);
1357 20109 : return do_filp_open(AT_FDCWD, name, &op);
1358 : }
1359 :
1360 : /**
1361 : * filp_open - open file and return file pointer
1362 : *
1363 : * @filename: path to open
1364 : * @flags: open flags as per the open(2) second argument
1365 : * @mode: mode for the new file if O_CREAT is set, else ignored
1366 : *
1367 : * This is the helper to open a file from kernelspace if you really
1368 : * have to. But in generally you should not do this, so please move
1369 : * along, nothing to see here..
1370 : */
1371 19030 : struct file *filp_open(const char *filename, int flags, umode_t mode)
1372 : {
1373 19030 : struct filename *name = getname_kernel(filename);
1374 19035 : struct file *file = ERR_CAST(name);
1375 :
1376 19035 : if (!IS_ERR(name)) {
1377 19035 : file = file_open_name(name, flags, mode);
1378 19032 : putname(name);
1379 : }
1380 19032 : return file;
1381 : }
1382 : EXPORT_SYMBOL(filp_open);
1383 :
1384 41444 : struct file *file_open_root(const struct path *root,
1385 : const char *filename, int flags, umode_t mode)
1386 : {
1387 41444 : struct open_flags op;
1388 41444 : struct open_how how = build_open_how(flags, mode);
1389 41444 : int err = build_open_flags(&how, &op);
1390 41444 : if (err)
1391 0 : return ERR_PTR(err);
1392 41444 : return do_file_open_root(root, filename, &op);
1393 : }
1394 : EXPORT_SYMBOL(file_open_root);
1395 :
1396 1153163702 : static long do_sys_openat2(int dfd, const char __user *filename,
1397 : struct open_how *how)
1398 : {
1399 1153163702 : struct open_flags op;
1400 1153163702 : int fd = build_open_flags(how, &op);
1401 1151900427 : struct filename *tmp;
1402 :
1403 1151900427 : if (fd)
1404 13 : return fd;
1405 :
1406 1151900414 : tmp = getname(filename);
1407 1152719380 : if (IS_ERR(tmp))
1408 193 : return PTR_ERR(tmp);
1409 :
1410 1152719187 : fd = get_unused_fd_flags(how->flags);
1411 1154741979 : if (fd >= 0) {
1412 1154717713 : struct file *f = do_filp_open(dfd, tmp, &op);
1413 1153997332 : if (IS_ERR(f)) {
1414 28010070 : put_unused_fd(fd);
1415 28028692 : fd = PTR_ERR(f);
1416 : } else {
1417 1125987262 : fd_install(fd, f);
1418 : }
1419 : }
1420 1154343424 : putname(tmp);
1421 1153630221 : return fd;
1422 : }
1423 :
1424 1153546410 : long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
1425 : {
1426 1153546410 : struct open_how how = build_open_how(flags, mode);
1427 1153546410 : return do_sys_openat2(dfd, filename, &how);
1428 : }
1429 :
1430 :
1431 0 : SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1432 : {
1433 0 : if (force_o_largefile())
1434 0 : flags |= O_LARGEFILE;
1435 0 : return do_sys_open(AT_FDCWD, filename, flags, mode);
1436 : }
1437 :
1438 2261828763 : SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags,
1439 : umode_t, mode)
1440 : {
1441 1130870176 : if (force_o_largefile())
1442 1130870176 : flags |= O_LARGEFILE;
1443 1130870176 : return do_sys_open(dfd, filename, flags, mode);
1444 : }
1445 :
1446 0 : SYSCALL_DEFINE4(openat2, int, dfd, const char __user *, filename,
1447 : struct open_how __user *, how, size_t, usize)
1448 : {
1449 0 : int err;
1450 0 : struct open_how tmp;
1451 :
1452 0 : BUILD_BUG_ON(sizeof(struct open_how) < OPEN_HOW_SIZE_VER0);
1453 0 : BUILD_BUG_ON(sizeof(struct open_how) != OPEN_HOW_SIZE_LATEST);
1454 :
1455 0 : if (unlikely(usize < OPEN_HOW_SIZE_VER0))
1456 : return -EINVAL;
1457 :
1458 0 : err = copy_struct_from_user(&tmp, sizeof(tmp), how, usize);
1459 0 : if (err)
1460 0 : return err;
1461 :
1462 0 : audit_openat2_how(&tmp);
1463 :
1464 : /* O_LARGEFILE is only allowed for non-O_PATH. */
1465 0 : if (!(tmp.flags & O_PATH) && force_o_largefile())
1466 0 : tmp.flags |= O_LARGEFILE;
1467 :
1468 0 : return do_sys_openat2(dfd, filename, &tmp);
1469 : }
1470 :
1471 : #ifdef CONFIG_COMPAT
1472 : /*
1473 : * Exactly like sys_open(), except that it doesn't set the
1474 : * O_LARGEFILE flag.
1475 : */
1476 0 : COMPAT_SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1477 : {
1478 0 : return do_sys_open(AT_FDCWD, filename, flags, mode);
1479 : }
1480 :
1481 : /*
1482 : * Exactly like sys_openat(), except that it doesn't set the
1483 : * O_LARGEFILE flag.
1484 : */
1485 44 : COMPAT_SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode)
1486 : {
1487 22 : return do_sys_open(dfd, filename, flags, mode);
1488 : }
1489 : #endif
1490 :
1491 : #ifndef __alpha__
1492 :
1493 : /*
1494 : * For backward compatibility? Maybe this should be moved
1495 : * into arch/i386 instead?
1496 : */
1497 46634516 : SYSCALL_DEFINE2(creat, const char __user *, pathname, umode_t, mode)
1498 : {
1499 23315279 : int flags = O_CREAT | O_WRONLY | O_TRUNC;
1500 :
1501 23315279 : if (force_o_largefile())
1502 23315279 : flags |= O_LARGEFILE;
1503 23315279 : return do_sys_open(AT_FDCWD, pathname, flags, mode);
1504 : }
1505 : #endif
1506 :
1507 : /*
1508 : * "id" is the POSIX thread ID. We use the
1509 : * files pointer for this..
1510 : */
1511 1673246215 : int filp_close(struct file *filp, fl_owner_t id)
1512 : {
1513 1673246215 : int retval = 0;
1514 :
1515 1673246215 : if (CHECK_DATA_CORRUPTION(file_count(filp) == 0,
1516 : "VFS: Close: file count is 0 (f_op=%ps)",
1517 : filp->f_op)) {
1518 : return 0;
1519 : }
1520 :
1521 1673246215 : if (filp->f_op->flush)
1522 276096128 : retval = filp->f_op->flush(filp, id);
1523 :
1524 1673226718 : if (likely(!(filp->f_mode & FMODE_PATH))) {
1525 1599082496 : dnotify_flush(filp, id);
1526 1598972487 : locks_remove_posix(filp, id);
1527 : }
1528 1672767411 : fput(filp);
1529 1672792416 : return retval;
1530 : }
1531 :
1532 : EXPORT_SYMBOL(filp_close);
1533 :
1534 : /*
1535 : * Careful here! We test whether the file pointer is NULL before
1536 : * releasing the fd. This ensures that one clone task can't release
1537 : * an fd while another clone is opening it.
1538 : */
1539 2831346116 : SYSCALL_DEFINE1(close, unsigned int, fd)
1540 : {
1541 1415346633 : int retval = close_fd(fd);
1542 :
1543 : /* can't restart close syscall because file table entry was cleared */
1544 1416575532 : if (unlikely(retval == -ERESTARTSYS ||
1545 : retval == -ERESTARTNOINTR ||
1546 : retval == -ERESTARTNOHAND ||
1547 : retval == -ERESTART_RESTARTBLOCK))
1548 0 : retval = -EINTR;
1549 :
1550 1416575532 : return retval;
1551 : }
1552 :
1553 : /**
1554 : * close_range() - Close all file descriptors in a given range.
1555 : *
1556 : * @fd: starting file descriptor to close
1557 : * @max_fd: last file descriptor to close
1558 : * @flags: reserved for future extensions
1559 : *
1560 : * This closes a range of file descriptors. All file descriptors
1561 : * from @fd up to and including @max_fd are closed.
1562 : * Currently, errors to close a given file descriptor are ignored.
1563 : */
1564 227992 : SYSCALL_DEFINE3(close_range, unsigned int, fd, unsigned int, max_fd,
1565 : unsigned int, flags)
1566 : {
1567 113995 : return __close_range(fd, max_fd, flags);
1568 : }
1569 :
1570 : /*
1571 : * This routine simulates a hangup on the tty, to arrange that users
1572 : * are given clean terminals at login time.
1573 : */
1574 0 : SYSCALL_DEFINE0(vhangup)
1575 : {
1576 0 : if (capable(CAP_SYS_TTY_CONFIG)) {
1577 0 : tty_vhangup_self();
1578 0 : return 0;
1579 : }
1580 : return -EPERM;
1581 : }
1582 :
1583 : /*
1584 : * Called when an inode is about to be open.
1585 : * We use this to disallow opening large files on 32bit systems if
1586 : * the caller didn't specify O_LARGEFILE. On 64bit systems we force
1587 : * on this flag in sys_open.
1588 : */
1589 808101609 : int generic_file_open(struct inode * inode, struct file * filp)
1590 : {
1591 808101609 : if (!(filp->f_flags & O_LARGEFILE) && i_size_read(inode) > MAX_NON_LFS)
1592 0 : return -EOVERFLOW;
1593 : return 0;
1594 : }
1595 :
1596 : EXPORT_SYMBOL(generic_file_open);
1597 :
1598 : /*
1599 : * This is used by subsystems that don't want seekable
1600 : * file descriptors. The function is not supposed to ever fail, the only
1601 : * reason it returns an 'int' and not 'void' is so that it can be plugged
1602 : * directly into file_operations structure.
1603 : */
1604 239327 : int nonseekable_open(struct inode *inode, struct file *filp)
1605 : {
1606 239327 : filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
1607 239327 : return 0;
1608 : }
1609 :
1610 : EXPORT_SYMBOL(nonseekable_open);
1611 :
1612 : /*
1613 : * stream_open is used by subsystems that want stream-like file descriptors.
1614 : * Such file descriptors are not seekable and don't have notion of position
1615 : * (file.f_pos is always 0 and ppos passed to .read()/.write() is always NULL).
1616 : * Contrary to file descriptors of other regular files, .read() and .write()
1617 : * can run simultaneously.
1618 : *
1619 : * stream_open never fails and is marked to return int so that it could be
1620 : * directly used as file_operations.open .
1621 : */
1622 63621088 : int stream_open(struct inode *inode, struct file *filp)
1623 : {
1624 63621088 : filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS);
1625 63621088 : filp->f_mode |= FMODE_STREAM;
1626 63621088 : return 0;
1627 : }
1628 :
1629 : EXPORT_SYMBOL(stream_open);
|
