1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (c) 2004-2005 Silicon Graphics, Inc.
4 * All Rights Reserved.
5 */
6 #include <linux/mount.h>
7 #include <linux/fsmap.h>
8 #include "xfs.h"
9 #include "xfs_fs.h"
10 #include "xfs_shared.h"
11 #include "xfs_format.h"
12 #include "xfs_log_format.h"
13 #include "xfs_trans_resv.h"
14 #include "xfs_mount.h"
15 #include "xfs_inode.h"
16 #include "xfs_iwalk.h"
17 #include "xfs_itable.h"
18 #include "xfs_fsops.h"
19 #include "xfs_rtalloc.h"
20 #include "xfs_attr.h"
21 #include "xfs_ioctl.h"
22 #include "xfs_ioctl32.h"
23 #include "xfs_trace.h"
24 #include "xfs_sb.h"
25
26 #define _NATIVE_IOC(cmd, type) \
27 _IOC(_IOC_DIR(cmd), _IOC_TYPE(cmd), _IOC_NR(cmd), sizeof(type))
28
29 #ifdef BROKEN_X86_ALIGNMENT
30 STATIC int
xfs_compat_flock64_copyin(xfs_flock64_t * bf,compat_xfs_flock64_t __user * arg32)31 xfs_compat_flock64_copyin(
32 xfs_flock64_t *bf,
33 compat_xfs_flock64_t __user *arg32)
34 {
35 if (get_user(bf->l_type, &arg32->l_type) ||
36 get_user(bf->l_whence, &arg32->l_whence) ||
37 get_user(bf->l_start, &arg32->l_start) ||
38 get_user(bf->l_len, &arg32->l_len) ||
39 get_user(bf->l_sysid, &arg32->l_sysid) ||
40 get_user(bf->l_pid, &arg32->l_pid) ||
41 copy_from_user(bf->l_pad, &arg32->l_pad, 4*sizeof(u32)))
42 return -EFAULT;
43 return 0;
44 }
45
46 STATIC int
xfs_compat_ioc_fsgeometry_v1(struct xfs_mount * mp,compat_xfs_fsop_geom_v1_t __user * arg32)47 xfs_compat_ioc_fsgeometry_v1(
48 struct xfs_mount *mp,
49 compat_xfs_fsop_geom_v1_t __user *arg32)
50 {
51 struct xfs_fsop_geom fsgeo;
52
53 xfs_fs_geometry(&mp->m_sb, &fsgeo, 3);
54 /* The 32-bit variant simply has some padding at the end */
55 if (copy_to_user(arg32, &fsgeo, sizeof(struct compat_xfs_fsop_geom_v1)))
56 return -EFAULT;
57 return 0;
58 }
59
60 STATIC int
xfs_compat_growfs_data_copyin(struct xfs_growfs_data * in,compat_xfs_growfs_data_t __user * arg32)61 xfs_compat_growfs_data_copyin(
62 struct xfs_growfs_data *in,
63 compat_xfs_growfs_data_t __user *arg32)
64 {
65 if (get_user(in->newblocks, &arg32->newblocks) ||
66 get_user(in->imaxpct, &arg32->imaxpct))
67 return -EFAULT;
68 return 0;
69 }
70
71 STATIC int
xfs_compat_growfs_rt_copyin(struct xfs_growfs_rt * in,compat_xfs_growfs_rt_t __user * arg32)72 xfs_compat_growfs_rt_copyin(
73 struct xfs_growfs_rt *in,
74 compat_xfs_growfs_rt_t __user *arg32)
75 {
76 if (get_user(in->newblocks, &arg32->newblocks) ||
77 get_user(in->extsize, &arg32->extsize))
78 return -EFAULT;
79 return 0;
80 }
81
82 STATIC int
xfs_fsinumbers_fmt_compat(struct xfs_ibulk * breq,const struct xfs_inumbers * ig)83 xfs_fsinumbers_fmt_compat(
84 struct xfs_ibulk *breq,
85 const struct xfs_inumbers *ig)
86 {
87 struct compat_xfs_inogrp __user *p32 = breq->ubuffer;
88 struct xfs_inogrp ig1;
89 struct xfs_inogrp *igrp = &ig1;
90
91 xfs_inumbers_to_inogrp(&ig1, ig);
92
93 if (put_user(igrp->xi_startino, &p32->xi_startino) ||
94 put_user(igrp->xi_alloccount, &p32->xi_alloccount) ||
95 put_user(igrp->xi_allocmask, &p32->xi_allocmask))
96 return -EFAULT;
97
98 return xfs_ibulk_advance(breq, sizeof(struct compat_xfs_inogrp));
99 }
100
101 #else
102 #define xfs_fsinumbers_fmt_compat xfs_fsinumbers_fmt
103 #endif /* BROKEN_X86_ALIGNMENT */
104
105 STATIC int
xfs_ioctl32_bstime_copyin(xfs_bstime_t * bstime,compat_xfs_bstime_t __user * bstime32)106 xfs_ioctl32_bstime_copyin(
107 xfs_bstime_t *bstime,
108 compat_xfs_bstime_t __user *bstime32)
109 {
110 old_time32_t sec32; /* tv_sec differs on 64 vs. 32 */
111
112 if (get_user(sec32, &bstime32->tv_sec) ||
113 get_user(bstime->tv_nsec, &bstime32->tv_nsec))
114 return -EFAULT;
115 bstime->tv_sec = sec32;
116 return 0;
117 }
118
119 /*
120 * struct xfs_bstat has differing alignment on intel, & bstime_t sizes
121 * everywhere
122 */
123 STATIC int
xfs_ioctl32_bstat_copyin(struct xfs_bstat * bstat,struct compat_xfs_bstat __user * bstat32)124 xfs_ioctl32_bstat_copyin(
125 struct xfs_bstat *bstat,
126 struct compat_xfs_bstat __user *bstat32)
127 {
128 if (get_user(bstat->bs_ino, &bstat32->bs_ino) ||
129 get_user(bstat->bs_mode, &bstat32->bs_mode) ||
130 get_user(bstat->bs_nlink, &bstat32->bs_nlink) ||
131 get_user(bstat->bs_uid, &bstat32->bs_uid) ||
132 get_user(bstat->bs_gid, &bstat32->bs_gid) ||
133 get_user(bstat->bs_rdev, &bstat32->bs_rdev) ||
134 get_user(bstat->bs_blksize, &bstat32->bs_blksize) ||
135 get_user(bstat->bs_size, &bstat32->bs_size) ||
136 xfs_ioctl32_bstime_copyin(&bstat->bs_atime, &bstat32->bs_atime) ||
137 xfs_ioctl32_bstime_copyin(&bstat->bs_mtime, &bstat32->bs_mtime) ||
138 xfs_ioctl32_bstime_copyin(&bstat->bs_ctime, &bstat32->bs_ctime) ||
139 get_user(bstat->bs_blocks, &bstat32->bs_size) ||
140 get_user(bstat->bs_xflags, &bstat32->bs_size) ||
141 get_user(bstat->bs_extsize, &bstat32->bs_extsize) ||
142 get_user(bstat->bs_extents, &bstat32->bs_extents) ||
143 get_user(bstat->bs_gen, &bstat32->bs_gen) ||
144 get_user(bstat->bs_projid_lo, &bstat32->bs_projid_lo) ||
145 get_user(bstat->bs_projid_hi, &bstat32->bs_projid_hi) ||
146 get_user(bstat->bs_forkoff, &bstat32->bs_forkoff) ||
147 get_user(bstat->bs_dmevmask, &bstat32->bs_dmevmask) ||
148 get_user(bstat->bs_dmstate, &bstat32->bs_dmstate) ||
149 get_user(bstat->bs_aextents, &bstat32->bs_aextents))
150 return -EFAULT;
151 return 0;
152 }
153
154 /* XFS_IOC_FSBULKSTAT and friends */
155
156 STATIC int
xfs_bstime_store_compat(compat_xfs_bstime_t __user * p32,const xfs_bstime_t * p)157 xfs_bstime_store_compat(
158 compat_xfs_bstime_t __user *p32,
159 const xfs_bstime_t *p)
160 {
161 __s32 sec32;
162
163 sec32 = p->tv_sec;
164 if (put_user(sec32, &p32->tv_sec) ||
165 put_user(p->tv_nsec, &p32->tv_nsec))
166 return -EFAULT;
167 return 0;
168 }
169
170 /* Return 0 on success or positive error (to xfs_bulkstat()) */
171 STATIC int
xfs_fsbulkstat_one_fmt_compat(struct xfs_ibulk * breq,const struct xfs_bulkstat * bstat)172 xfs_fsbulkstat_one_fmt_compat(
173 struct xfs_ibulk *breq,
174 const struct xfs_bulkstat *bstat)
175 {
176 struct compat_xfs_bstat __user *p32 = breq->ubuffer;
177 struct xfs_bstat bs1;
178 struct xfs_bstat *buffer = &bs1;
179
180 xfs_bulkstat_to_bstat(breq->mp, &bs1, bstat);
181
182 if (put_user(buffer->bs_ino, &p32->bs_ino) ||
183 put_user(buffer->bs_mode, &p32->bs_mode) ||
184 put_user(buffer->bs_nlink, &p32->bs_nlink) ||
185 put_user(buffer->bs_uid, &p32->bs_uid) ||
186 put_user(buffer->bs_gid, &p32->bs_gid) ||
187 put_user(buffer->bs_rdev, &p32->bs_rdev) ||
188 put_user(buffer->bs_blksize, &p32->bs_blksize) ||
189 put_user(buffer->bs_size, &p32->bs_size) ||
190 xfs_bstime_store_compat(&p32->bs_atime, &buffer->bs_atime) ||
191 xfs_bstime_store_compat(&p32->bs_mtime, &buffer->bs_mtime) ||
192 xfs_bstime_store_compat(&p32->bs_ctime, &buffer->bs_ctime) ||
193 put_user(buffer->bs_blocks, &p32->bs_blocks) ||
194 put_user(buffer->bs_xflags, &p32->bs_xflags) ||
195 put_user(buffer->bs_extsize, &p32->bs_extsize) ||
196 put_user(buffer->bs_extents, &p32->bs_extents) ||
197 put_user(buffer->bs_gen, &p32->bs_gen) ||
198 put_user(buffer->bs_projid, &p32->bs_projid) ||
199 put_user(buffer->bs_projid_hi, &p32->bs_projid_hi) ||
200 put_user(buffer->bs_forkoff, &p32->bs_forkoff) ||
201 put_user(buffer->bs_dmevmask, &p32->bs_dmevmask) ||
202 put_user(buffer->bs_dmstate, &p32->bs_dmstate) ||
203 put_user(buffer->bs_aextents, &p32->bs_aextents))
204 return -EFAULT;
205
206 return xfs_ibulk_advance(breq, sizeof(struct compat_xfs_bstat));
207 }
208
209 /* copied from xfs_ioctl.c */
210 STATIC int
xfs_compat_ioc_fsbulkstat(xfs_mount_t * mp,unsigned int cmd,struct compat_xfs_fsop_bulkreq __user * p32)211 xfs_compat_ioc_fsbulkstat(
212 xfs_mount_t *mp,
213 unsigned int cmd,
214 struct compat_xfs_fsop_bulkreq __user *p32)
215 {
216 u32 addr;
217 struct xfs_fsop_bulkreq bulkreq;
218 struct xfs_ibulk breq = {
219 .mp = mp,
220 .ocount = 0,
221 };
222 xfs_ino_t lastino;
223 int error;
224
225 /*
226 * Output structure handling functions. Depending on the command,
227 * either the xfs_bstat and xfs_inogrp structures are written out
228 * to userpace memory via bulkreq.ubuffer. Normally the compat
229 * functions and structure size are the correct ones to use ...
230 */
231 inumbers_fmt_pf inumbers_func = xfs_fsinumbers_fmt_compat;
232 bulkstat_one_fmt_pf bs_one_func = xfs_fsbulkstat_one_fmt_compat;
233
234 #ifdef CONFIG_X86_X32
235 if (in_x32_syscall()) {
236 /*
237 * ... but on x32 the input xfs_fsop_bulkreq has pointers
238 * which must be handled in the "compat" (32-bit) way, while
239 * the xfs_bstat and xfs_inogrp structures follow native 64-
240 * bit layout convention. So adjust accordingly, otherwise
241 * the data written out in compat layout will not match what
242 * x32 userspace expects.
243 */
244 inumbers_func = xfs_fsinumbers_fmt;
245 bs_one_func = xfs_fsbulkstat_one_fmt;
246 }
247 #endif
248
249 /* done = 1 if there are more stats to get and if bulkstat */
250 /* should be called again (unused here, but used in dmapi) */
251
252 if (!capable(CAP_SYS_ADMIN))
253 return -EPERM;
254
255 if (XFS_FORCED_SHUTDOWN(mp))
256 return -EIO;
257
258 if (get_user(addr, &p32->lastip))
259 return -EFAULT;
260 bulkreq.lastip = compat_ptr(addr);
261 if (get_user(bulkreq.icount, &p32->icount) ||
262 get_user(addr, &p32->ubuffer))
263 return -EFAULT;
264 bulkreq.ubuffer = compat_ptr(addr);
265 if (get_user(addr, &p32->ocount))
266 return -EFAULT;
267 bulkreq.ocount = compat_ptr(addr);
268
269 if (copy_from_user(&lastino, bulkreq.lastip, sizeof(__s64)))
270 return -EFAULT;
271
272 if (bulkreq.icount <= 0)
273 return -EINVAL;
274
275 if (bulkreq.ubuffer == NULL)
276 return -EINVAL;
277
278 breq.ubuffer = bulkreq.ubuffer;
279 breq.icount = bulkreq.icount;
280
281 /*
282 * FSBULKSTAT_SINGLE expects that *lastip contains the inode number
283 * that we want to stat. However, FSINUMBERS and FSBULKSTAT expect
284 * that *lastip contains either zero or the number of the last inode to
285 * be examined by the previous call and return results starting with
286 * the next inode after that. The new bulk request back end functions
287 * take the inode to start with, so we have to compute the startino
288 * parameter from lastino to maintain correct function. lastino == 0
289 * is a special case because it has traditionally meant "first inode
290 * in filesystem".
291 */
292 if (cmd == XFS_IOC_FSINUMBERS_32) {
293 breq.startino = lastino ? lastino + 1 : 0;
294 error = xfs_inumbers(&breq, inumbers_func);
295 lastino = breq.startino - 1;
296 } else if (cmd == XFS_IOC_FSBULKSTAT_SINGLE_32) {
297 breq.startino = lastino;
298 breq.icount = 1;
299 error = xfs_bulkstat_one(&breq, bs_one_func);
300 lastino = breq.startino;
301 } else if (cmd == XFS_IOC_FSBULKSTAT_32) {
302 breq.startino = lastino ? lastino + 1 : 0;
303 error = xfs_bulkstat(&breq, bs_one_func);
304 lastino = breq.startino - 1;
305 } else {
306 error = -EINVAL;
307 }
308 if (error)
309 return error;
310
311 if (bulkreq.lastip != NULL &&
312 copy_to_user(bulkreq.lastip, &lastino, sizeof(xfs_ino_t)))
313 return -EFAULT;
314
315 if (bulkreq.ocount != NULL &&
316 copy_to_user(bulkreq.ocount, &breq.ocount, sizeof(__s32)))
317 return -EFAULT;
318
319 return 0;
320 }
321
322 STATIC int
xfs_compat_handlereq_copyin(xfs_fsop_handlereq_t * hreq,compat_xfs_fsop_handlereq_t __user * arg32)323 xfs_compat_handlereq_copyin(
324 xfs_fsop_handlereq_t *hreq,
325 compat_xfs_fsop_handlereq_t __user *arg32)
326 {
327 compat_xfs_fsop_handlereq_t hreq32;
328
329 if (copy_from_user(&hreq32, arg32, sizeof(compat_xfs_fsop_handlereq_t)))
330 return -EFAULT;
331
332 hreq->fd = hreq32.fd;
333 hreq->path = compat_ptr(hreq32.path);
334 hreq->oflags = hreq32.oflags;
335 hreq->ihandle = compat_ptr(hreq32.ihandle);
336 hreq->ihandlen = hreq32.ihandlen;
337 hreq->ohandle = compat_ptr(hreq32.ohandle);
338 hreq->ohandlen = compat_ptr(hreq32.ohandlen);
339
340 return 0;
341 }
342
343 STATIC struct dentry *
xfs_compat_handlereq_to_dentry(struct file * parfilp,compat_xfs_fsop_handlereq_t * hreq)344 xfs_compat_handlereq_to_dentry(
345 struct file *parfilp,
346 compat_xfs_fsop_handlereq_t *hreq)
347 {
348 return xfs_handle_to_dentry(parfilp,
349 compat_ptr(hreq->ihandle), hreq->ihandlen);
350 }
351
352 STATIC int
xfs_compat_attrlist_by_handle(struct file * parfilp,compat_xfs_fsop_attrlist_handlereq_t __user * p)353 xfs_compat_attrlist_by_handle(
354 struct file *parfilp,
355 compat_xfs_fsop_attrlist_handlereq_t __user *p)
356 {
357 compat_xfs_fsop_attrlist_handlereq_t al_hreq;
358 struct dentry *dentry;
359 int error;
360
361 if (!capable(CAP_SYS_ADMIN))
362 return -EPERM;
363 if (copy_from_user(&al_hreq, p, sizeof(al_hreq)))
364 return -EFAULT;
365
366 dentry = xfs_compat_handlereq_to_dentry(parfilp, &al_hreq.hreq);
367 if (IS_ERR(dentry))
368 return PTR_ERR(dentry);
369
370 error = xfs_ioc_attr_list(XFS_I(d_inode(dentry)),
371 compat_ptr(al_hreq.buffer), al_hreq.buflen,
372 al_hreq.flags, &p->pos);
373 dput(dentry);
374 return error;
375 }
376
377 STATIC int
xfs_compat_attrmulti_by_handle(struct file * parfilp,void __user * arg)378 xfs_compat_attrmulti_by_handle(
379 struct file *parfilp,
380 void __user *arg)
381 {
382 int error;
383 compat_xfs_attr_multiop_t *ops;
384 compat_xfs_fsop_attrmulti_handlereq_t am_hreq;
385 struct dentry *dentry;
386 unsigned int i, size;
387
388 if (!capable(CAP_SYS_ADMIN))
389 return -EPERM;
390 if (copy_from_user(&am_hreq, arg,
391 sizeof(compat_xfs_fsop_attrmulti_handlereq_t)))
392 return -EFAULT;
393
394 /* overflow check */
395 if (am_hreq.opcount >= INT_MAX / sizeof(compat_xfs_attr_multiop_t))
396 return -E2BIG;
397
398 dentry = xfs_compat_handlereq_to_dentry(parfilp, &am_hreq.hreq);
399 if (IS_ERR(dentry))
400 return PTR_ERR(dentry);
401
402 error = -E2BIG;
403 size = am_hreq.opcount * sizeof(compat_xfs_attr_multiop_t);
404 if (!size || size > 16 * PAGE_SIZE)
405 goto out_dput;
406
407 ops = memdup_user(compat_ptr(am_hreq.ops), size);
408 if (IS_ERR(ops)) {
409 error = PTR_ERR(ops);
410 goto out_dput;
411 }
412
413 error = 0;
414 for (i = 0; i < am_hreq.opcount; i++) {
415 ops[i].am_error = xfs_ioc_attrmulti_one(parfilp,
416 d_inode(dentry), ops[i].am_opcode,
417 compat_ptr(ops[i].am_attrname),
418 compat_ptr(ops[i].am_attrvalue),
419 &ops[i].am_length, ops[i].am_flags);
420 }
421
422 if (copy_to_user(compat_ptr(am_hreq.ops), ops, size))
423 error = -EFAULT;
424
425 kfree(ops);
426 out_dput:
427 dput(dentry);
428 return error;
429 }
430
431 long
xfs_file_compat_ioctl(struct file * filp,unsigned cmd,unsigned long p)432 xfs_file_compat_ioctl(
433 struct file *filp,
434 unsigned cmd,
435 unsigned long p)
436 {
437 struct inode *inode = file_inode(filp);
438 struct xfs_inode *ip = XFS_I(inode);
439 struct xfs_mount *mp = ip->i_mount;
440 void __user *arg = compat_ptr(p);
441 int error;
442
443 trace_xfs_file_compat_ioctl(ip);
444
445 switch (cmd) {
446 #if defined(BROKEN_X86_ALIGNMENT)
447 case XFS_IOC_ALLOCSP_32:
448 case XFS_IOC_FREESP_32:
449 case XFS_IOC_ALLOCSP64_32:
450 case XFS_IOC_FREESP64_32: {
451 struct xfs_flock64 bf;
452
453 if (xfs_compat_flock64_copyin(&bf, arg))
454 return -EFAULT;
455 cmd = _NATIVE_IOC(cmd, struct xfs_flock64);
456 return xfs_ioc_space(filp, &bf);
457 }
458 case XFS_IOC_FSGEOMETRY_V1_32:
459 return xfs_compat_ioc_fsgeometry_v1(mp, arg);
460 case XFS_IOC_FSGROWFSDATA_32: {
461 struct xfs_growfs_data in;
462
463 if (xfs_compat_growfs_data_copyin(&in, arg))
464 return -EFAULT;
465 error = mnt_want_write_file(filp);
466 if (error)
467 return error;
468 error = xfs_growfs_data(mp, &in);
469 mnt_drop_write_file(filp);
470 return error;
471 }
472 case XFS_IOC_FSGROWFSRT_32: {
473 struct xfs_growfs_rt in;
474
475 if (xfs_compat_growfs_rt_copyin(&in, arg))
476 return -EFAULT;
477 error = mnt_want_write_file(filp);
478 if (error)
479 return error;
480 error = xfs_growfs_rt(mp, &in);
481 mnt_drop_write_file(filp);
482 return error;
483 }
484 #endif
485 /* long changes size, but xfs only copiese out 32 bits */
486 case XFS_IOC_GETXFLAGS_32:
487 case XFS_IOC_SETXFLAGS_32:
488 case XFS_IOC_GETVERSION_32:
489 cmd = _NATIVE_IOC(cmd, long);
490 return xfs_file_ioctl(filp, cmd, p);
491 case XFS_IOC_SWAPEXT_32: {
492 struct xfs_swapext sxp;
493 struct compat_xfs_swapext __user *sxu = arg;
494
495 /* Bulk copy in up to the sx_stat field, then copy bstat */
496 if (copy_from_user(&sxp, sxu,
497 offsetof(struct xfs_swapext, sx_stat)) ||
498 xfs_ioctl32_bstat_copyin(&sxp.sx_stat, &sxu->sx_stat))
499 return -EFAULT;
500 error = mnt_want_write_file(filp);
501 if (error)
502 return error;
503 error = xfs_ioc_swapext(&sxp);
504 mnt_drop_write_file(filp);
505 return error;
506 }
507 case XFS_IOC_FSBULKSTAT_32:
508 case XFS_IOC_FSBULKSTAT_SINGLE_32:
509 case XFS_IOC_FSINUMBERS_32:
510 return xfs_compat_ioc_fsbulkstat(mp, cmd, arg);
511 case XFS_IOC_FD_TO_HANDLE_32:
512 case XFS_IOC_PATH_TO_HANDLE_32:
513 case XFS_IOC_PATH_TO_FSHANDLE_32: {
514 struct xfs_fsop_handlereq hreq;
515
516 if (xfs_compat_handlereq_copyin(&hreq, arg))
517 return -EFAULT;
518 cmd = _NATIVE_IOC(cmd, struct xfs_fsop_handlereq);
519 return xfs_find_handle(cmd, &hreq);
520 }
521 case XFS_IOC_OPEN_BY_HANDLE_32: {
522 struct xfs_fsop_handlereq hreq;
523
524 if (xfs_compat_handlereq_copyin(&hreq, arg))
525 return -EFAULT;
526 return xfs_open_by_handle(filp, &hreq);
527 }
528 case XFS_IOC_READLINK_BY_HANDLE_32: {
529 struct xfs_fsop_handlereq hreq;
530
531 if (xfs_compat_handlereq_copyin(&hreq, arg))
532 return -EFAULT;
533 return xfs_readlink_by_handle(filp, &hreq);
534 }
535 case XFS_IOC_ATTRLIST_BY_HANDLE_32:
536 return xfs_compat_attrlist_by_handle(filp, arg);
537 case XFS_IOC_ATTRMULTI_BY_HANDLE_32:
538 return xfs_compat_attrmulti_by_handle(filp, arg);
539 default:
540 /* try the native version */
541 return xfs_file_ioctl(filp, cmd, (unsigned long)arg);
542 }
543 }
544