1 /*
2 * linux/fs/compat.c
3 *
4 * Kernel compatibililty routines for e.g. 32 bit syscall support
5 * on 64 bit kernels.
6 *
7 * Copyright (C) 2002 Stephen Rothwell, IBM Corporation
8 * Copyright (C) 1997-2000 Jakub Jelinek (jakub@redhat.com)
9 * Copyright (C) 1998 Eddie C. Dost (ecd@skynet.be)
10 * Copyright (C) 2001,2002 Andi Kleen, SuSE Labs
11 * Copyright (C) 2003 Pavel Machek (pavel@ucw.cz)
12 *
13 * This program is free software; you can redistribute it and/or modify
14 * it under the terms of the GNU General Public License version 2 as
15 * published by the Free Software Foundation.
16 */
17
18 #include <linux/stddef.h>
19 #include <linux/kernel.h>
20 #include <linux/linkage.h>
21 #include <linux/compat.h>
22 #include <linux/errno.h>
23 #include <linux/time.h>
24 #include <linux/fs.h>
25 #include <linux/fcntl.h>
26 #include <linux/namei.h>
27 #include <linux/file.h>
28 #include <linux/fdtable.h>
29 #include <linux/vfs.h>
30 #include <linux/ioctl.h>
31 #include <linux/init.h>
32 #include <linux/ncp_mount.h>
33 #include <linux/nfs4_mount.h>
34 #include <linux/syscalls.h>
35 #include <linux/ctype.h>
36 #include <linux/dirent.h>
37 #include <linux/fsnotify.h>
38 #include <linux/highuid.h>
39 #include <linux/personality.h>
40 #include <linux/rwsem.h>
41 #include <linux/tsacct_kern.h>
42 #include <linux/security.h>
43 #include <linux/highmem.h>
44 #include <linux/signal.h>
45 #include <linux/poll.h>
46 #include <linux/mm.h>
47 #include <linux/fs_struct.h>
48 #include <linux/slab.h>
49 #include <linux/pagemap.h>
50 #include <linux/aio.h>
51
52 #include <asm/uaccess.h>
53 #include <asm/mmu_context.h>
54 #include <asm/ioctls.h>
55 #include "internal.h"
56
57 int compat_log = 1;
58
compat_printk(const char * fmt,...)59 int compat_printk(const char *fmt, ...)
60 {
61 va_list ap;
62 int ret;
63 if (!compat_log)
64 return 0;
65 va_start(ap, fmt);
66 ret = vprintk(fmt, ap);
67 va_end(ap);
68 return ret;
69 }
70
71 /*
72 * Not all architectures have sys_utime, so implement this in terms
73 * of sys_utimes.
74 */
compat_sys_utime(const char __user * filename,struct compat_utimbuf __user * t)75 asmlinkage long compat_sys_utime(const char __user *filename,
76 struct compat_utimbuf __user *t)
77 {
78 struct timespec tv[2];
79
80 if (t) {
81 if (get_user(tv[0].tv_sec, &t->actime) ||
82 get_user(tv[1].tv_sec, &t->modtime))
83 return -EFAULT;
84 tv[0].tv_nsec = 0;
85 tv[1].tv_nsec = 0;
86 }
87 return do_utimes(AT_FDCWD, filename, t ? tv : NULL, 0);
88 }
89
compat_sys_utimensat(unsigned int dfd,const char __user * filename,struct compat_timespec __user * t,int flags)90 asmlinkage long compat_sys_utimensat(unsigned int dfd, const char __user *filename, struct compat_timespec __user *t, int flags)
91 {
92 struct timespec tv[2];
93
94 if (t) {
95 if (get_compat_timespec(&tv[0], &t[0]) ||
96 get_compat_timespec(&tv[1], &t[1]))
97 return -EFAULT;
98
99 if (tv[0].tv_nsec == UTIME_OMIT && tv[1].tv_nsec == UTIME_OMIT)
100 return 0;
101 }
102 return do_utimes(dfd, filename, t ? tv : NULL, flags);
103 }
104
compat_sys_futimesat(unsigned int dfd,const char __user * filename,struct compat_timeval __user * t)105 asmlinkage long compat_sys_futimesat(unsigned int dfd, const char __user *filename, struct compat_timeval __user *t)
106 {
107 struct timespec tv[2];
108
109 if (t) {
110 if (get_user(tv[0].tv_sec, &t[0].tv_sec) ||
111 get_user(tv[0].tv_nsec, &t[0].tv_usec) ||
112 get_user(tv[1].tv_sec, &t[1].tv_sec) ||
113 get_user(tv[1].tv_nsec, &t[1].tv_usec))
114 return -EFAULT;
115 if (tv[0].tv_nsec >= 1000000 || tv[0].tv_nsec < 0 ||
116 tv[1].tv_nsec >= 1000000 || tv[1].tv_nsec < 0)
117 return -EINVAL;
118 tv[0].tv_nsec *= 1000;
119 tv[1].tv_nsec *= 1000;
120 }
121 return do_utimes(dfd, filename, t ? tv : NULL, 0);
122 }
123
compat_sys_utimes(const char __user * filename,struct compat_timeval __user * t)124 asmlinkage long compat_sys_utimes(const char __user *filename, struct compat_timeval __user *t)
125 {
126 return compat_sys_futimesat(AT_FDCWD, filename, t);
127 }
128
cp_compat_stat(struct kstat * stat,struct compat_stat __user * ubuf)129 static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
130 {
131 struct compat_stat tmp;
132
133 if (!old_valid_dev(stat->dev) || !old_valid_dev(stat->rdev))
134 return -EOVERFLOW;
135
136 memset(&tmp, 0, sizeof(tmp));
137 tmp.st_dev = old_encode_dev(stat->dev);
138 tmp.st_ino = stat->ino;
139 if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
140 return -EOVERFLOW;
141 tmp.st_mode = stat->mode;
142 tmp.st_nlink = stat->nlink;
143 if (tmp.st_nlink != stat->nlink)
144 return -EOVERFLOW;
145 SET_UID(tmp.st_uid, from_kuid_munged(current_user_ns(), stat->uid));
146 SET_GID(tmp.st_gid, from_kgid_munged(current_user_ns(), stat->gid));
147 tmp.st_rdev = old_encode_dev(stat->rdev);
148 if ((u64) stat->size > MAX_NON_LFS)
149 return -EOVERFLOW;
150 tmp.st_size = stat->size;
151 tmp.st_atime = stat->atime.tv_sec;
152 tmp.st_atime_nsec = stat->atime.tv_nsec;
153 tmp.st_mtime = stat->mtime.tv_sec;
154 tmp.st_mtime_nsec = stat->mtime.tv_nsec;
155 tmp.st_ctime = stat->ctime.tv_sec;
156 tmp.st_ctime_nsec = stat->ctime.tv_nsec;
157 tmp.st_blocks = stat->blocks;
158 tmp.st_blksize = stat->blksize;
159 return copy_to_user(ubuf, &tmp, sizeof(tmp)) ? -EFAULT : 0;
160 }
161
compat_sys_newstat(const char __user * filename,struct compat_stat __user * statbuf)162 asmlinkage long compat_sys_newstat(const char __user * filename,
163 struct compat_stat __user *statbuf)
164 {
165 struct kstat stat;
166 int error;
167
168 error = vfs_stat(filename, &stat);
169 if (error)
170 return error;
171 return cp_compat_stat(&stat, statbuf);
172 }
173
compat_sys_newlstat(const char __user * filename,struct compat_stat __user * statbuf)174 asmlinkage long compat_sys_newlstat(const char __user * filename,
175 struct compat_stat __user *statbuf)
176 {
177 struct kstat stat;
178 int error;
179
180 error = vfs_lstat(filename, &stat);
181 if (error)
182 return error;
183 return cp_compat_stat(&stat, statbuf);
184 }
185
186 #ifndef __ARCH_WANT_STAT64
compat_sys_newfstatat(unsigned int dfd,const char __user * filename,struct compat_stat __user * statbuf,int flag)187 asmlinkage long compat_sys_newfstatat(unsigned int dfd,
188 const char __user *filename,
189 struct compat_stat __user *statbuf, int flag)
190 {
191 struct kstat stat;
192 int error;
193
194 error = vfs_fstatat(dfd, filename, &stat, flag);
195 if (error)
196 return error;
197 return cp_compat_stat(&stat, statbuf);
198 }
199 #endif
200
compat_sys_newfstat(unsigned int fd,struct compat_stat __user * statbuf)201 asmlinkage long compat_sys_newfstat(unsigned int fd,
202 struct compat_stat __user * statbuf)
203 {
204 struct kstat stat;
205 int error = vfs_fstat(fd, &stat);
206
207 if (!error)
208 error = cp_compat_stat(&stat, statbuf);
209 return error;
210 }
211
put_compat_statfs(struct compat_statfs __user * ubuf,struct kstatfs * kbuf)212 static int put_compat_statfs(struct compat_statfs __user *ubuf, struct kstatfs *kbuf)
213 {
214
215 if (sizeof ubuf->f_blocks == 4) {
216 if ((kbuf->f_blocks | kbuf->f_bfree | kbuf->f_bavail |
217 kbuf->f_bsize | kbuf->f_frsize) & 0xffffffff00000000ULL)
218 return -EOVERFLOW;
219 /* f_files and f_ffree may be -1; it's okay
220 * to stuff that into 32 bits */
221 if (kbuf->f_files != 0xffffffffffffffffULL
222 && (kbuf->f_files & 0xffffffff00000000ULL))
223 return -EOVERFLOW;
224 if (kbuf->f_ffree != 0xffffffffffffffffULL
225 && (kbuf->f_ffree & 0xffffffff00000000ULL))
226 return -EOVERFLOW;
227 }
228 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(*ubuf)) ||
229 __put_user(kbuf->f_type, &ubuf->f_type) ||
230 __put_user(kbuf->f_bsize, &ubuf->f_bsize) ||
231 __put_user(kbuf->f_blocks, &ubuf->f_blocks) ||
232 __put_user(kbuf->f_bfree, &ubuf->f_bfree) ||
233 __put_user(kbuf->f_bavail, &ubuf->f_bavail) ||
234 __put_user(kbuf->f_files, &ubuf->f_files) ||
235 __put_user(kbuf->f_ffree, &ubuf->f_ffree) ||
236 __put_user(kbuf->f_namelen, &ubuf->f_namelen) ||
237 __put_user(kbuf->f_fsid.val[0], &ubuf->f_fsid.val[0]) ||
238 __put_user(kbuf->f_fsid.val[1], &ubuf->f_fsid.val[1]) ||
239 __put_user(kbuf->f_frsize, &ubuf->f_frsize) ||
240 __put_user(kbuf->f_flags, &ubuf->f_flags) ||
241 __clear_user(ubuf->f_spare, sizeof(ubuf->f_spare)))
242 return -EFAULT;
243 return 0;
244 }
245
246 /*
247 * The following statfs calls are copies of code from fs/statfs.c and
248 * should be checked against those from time to time
249 */
compat_sys_statfs(const char __user * pathname,struct compat_statfs __user * buf)250 asmlinkage long compat_sys_statfs(const char __user *pathname, struct compat_statfs __user *buf)
251 {
252 struct kstatfs tmp;
253 int error = user_statfs(pathname, &tmp);
254 if (!error)
255 error = put_compat_statfs(buf, &tmp);
256 return error;
257 }
258
compat_sys_fstatfs(unsigned int fd,struct compat_statfs __user * buf)259 asmlinkage long compat_sys_fstatfs(unsigned int fd, struct compat_statfs __user *buf)
260 {
261 struct kstatfs tmp;
262 int error = fd_statfs(fd, &tmp);
263 if (!error)
264 error = put_compat_statfs(buf, &tmp);
265 return error;
266 }
267
put_compat_statfs64(struct compat_statfs64 __user * ubuf,struct kstatfs * kbuf)268 static int put_compat_statfs64(struct compat_statfs64 __user *ubuf, struct kstatfs *kbuf)
269 {
270 if (sizeof ubuf->f_blocks == 4) {
271 if ((kbuf->f_blocks | kbuf->f_bfree | kbuf->f_bavail |
272 kbuf->f_bsize | kbuf->f_frsize) & 0xffffffff00000000ULL)
273 return -EOVERFLOW;
274 /* f_files and f_ffree may be -1; it's okay
275 * to stuff that into 32 bits */
276 if (kbuf->f_files != 0xffffffffffffffffULL
277 && (kbuf->f_files & 0xffffffff00000000ULL))
278 return -EOVERFLOW;
279 if (kbuf->f_ffree != 0xffffffffffffffffULL
280 && (kbuf->f_ffree & 0xffffffff00000000ULL))
281 return -EOVERFLOW;
282 }
283 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(*ubuf)) ||
284 __put_user(kbuf->f_type, &ubuf->f_type) ||
285 __put_user(kbuf->f_bsize, &ubuf->f_bsize) ||
286 __put_user(kbuf->f_blocks, &ubuf->f_blocks) ||
287 __put_user(kbuf->f_bfree, &ubuf->f_bfree) ||
288 __put_user(kbuf->f_bavail, &ubuf->f_bavail) ||
289 __put_user(kbuf->f_files, &ubuf->f_files) ||
290 __put_user(kbuf->f_ffree, &ubuf->f_ffree) ||
291 __put_user(kbuf->f_namelen, &ubuf->f_namelen) ||
292 __put_user(kbuf->f_fsid.val[0], &ubuf->f_fsid.val[0]) ||
293 __put_user(kbuf->f_fsid.val[1], &ubuf->f_fsid.val[1]) ||
294 __put_user(kbuf->f_frsize, &ubuf->f_frsize) ||
295 __put_user(kbuf->f_flags, &ubuf->f_flags) ||
296 __clear_user(ubuf->f_spare, sizeof(ubuf->f_spare)))
297 return -EFAULT;
298 return 0;
299 }
300
compat_sys_statfs64(const char __user * pathname,compat_size_t sz,struct compat_statfs64 __user * buf)301 asmlinkage long compat_sys_statfs64(const char __user *pathname, compat_size_t sz, struct compat_statfs64 __user *buf)
302 {
303 struct kstatfs tmp;
304 int error;
305
306 if (sz != sizeof(*buf))
307 return -EINVAL;
308
309 error = user_statfs(pathname, &tmp);
310 if (!error)
311 error = put_compat_statfs64(buf, &tmp);
312 return error;
313 }
314
compat_sys_fstatfs64(unsigned int fd,compat_size_t sz,struct compat_statfs64 __user * buf)315 asmlinkage long compat_sys_fstatfs64(unsigned int fd, compat_size_t sz, struct compat_statfs64 __user *buf)
316 {
317 struct kstatfs tmp;
318 int error;
319
320 if (sz != sizeof(*buf))
321 return -EINVAL;
322
323 error = fd_statfs(fd, &tmp);
324 if (!error)
325 error = put_compat_statfs64(buf, &tmp);
326 return error;
327 }
328
329 /*
330 * This is a copy of sys_ustat, just dealing with a structure layout.
331 * Given how simple this syscall is that apporach is more maintainable
332 * than the various conversion hacks.
333 */
compat_sys_ustat(unsigned dev,struct compat_ustat __user * u)334 asmlinkage long compat_sys_ustat(unsigned dev, struct compat_ustat __user *u)
335 {
336 struct compat_ustat tmp;
337 struct kstatfs sbuf;
338 int err = vfs_ustat(new_decode_dev(dev), &sbuf);
339 if (err)
340 return err;
341
342 memset(&tmp, 0, sizeof(struct compat_ustat));
343 tmp.f_tfree = sbuf.f_bfree;
344 tmp.f_tinode = sbuf.f_ffree;
345 if (copy_to_user(u, &tmp, sizeof(struct compat_ustat)))
346 return -EFAULT;
347 return 0;
348 }
349
get_compat_flock(struct flock * kfl,struct compat_flock __user * ufl)350 static int get_compat_flock(struct flock *kfl, struct compat_flock __user *ufl)
351 {
352 if (!access_ok(VERIFY_READ, ufl, sizeof(*ufl)) ||
353 __get_user(kfl->l_type, &ufl->l_type) ||
354 __get_user(kfl->l_whence, &ufl->l_whence) ||
355 __get_user(kfl->l_start, &ufl->l_start) ||
356 __get_user(kfl->l_len, &ufl->l_len) ||
357 __get_user(kfl->l_pid, &ufl->l_pid))
358 return -EFAULT;
359 return 0;
360 }
361
put_compat_flock(struct flock * kfl,struct compat_flock __user * ufl)362 static int put_compat_flock(struct flock *kfl, struct compat_flock __user *ufl)
363 {
364 if (!access_ok(VERIFY_WRITE, ufl, sizeof(*ufl)) ||
365 __put_user(kfl->l_type, &ufl->l_type) ||
366 __put_user(kfl->l_whence, &ufl->l_whence) ||
367 __put_user(kfl->l_start, &ufl->l_start) ||
368 __put_user(kfl->l_len, &ufl->l_len) ||
369 __put_user(kfl->l_pid, &ufl->l_pid))
370 return -EFAULT;
371 return 0;
372 }
373
374 #ifndef HAVE_ARCH_GET_COMPAT_FLOCK64
get_compat_flock64(struct flock * kfl,struct compat_flock64 __user * ufl)375 static int get_compat_flock64(struct flock *kfl, struct compat_flock64 __user *ufl)
376 {
377 if (!access_ok(VERIFY_READ, ufl, sizeof(*ufl)) ||
378 __get_user(kfl->l_type, &ufl->l_type) ||
379 __get_user(kfl->l_whence, &ufl->l_whence) ||
380 __get_user(kfl->l_start, &ufl->l_start) ||
381 __get_user(kfl->l_len, &ufl->l_len) ||
382 __get_user(kfl->l_pid, &ufl->l_pid))
383 return -EFAULT;
384 return 0;
385 }
386 #endif
387
388 #ifndef HAVE_ARCH_PUT_COMPAT_FLOCK64
put_compat_flock64(struct flock * kfl,struct compat_flock64 __user * ufl)389 static int put_compat_flock64(struct flock *kfl, struct compat_flock64 __user *ufl)
390 {
391 if (!access_ok(VERIFY_WRITE, ufl, sizeof(*ufl)) ||
392 __put_user(kfl->l_type, &ufl->l_type) ||
393 __put_user(kfl->l_whence, &ufl->l_whence) ||
394 __put_user(kfl->l_start, &ufl->l_start) ||
395 __put_user(kfl->l_len, &ufl->l_len) ||
396 __put_user(kfl->l_pid, &ufl->l_pid))
397 return -EFAULT;
398 return 0;
399 }
400 #endif
401
compat_sys_fcntl64(unsigned int fd,unsigned int cmd,unsigned long arg)402 asmlinkage long compat_sys_fcntl64(unsigned int fd, unsigned int cmd,
403 unsigned long arg)
404 {
405 mm_segment_t old_fs;
406 struct flock f;
407 long ret;
408
409 switch (cmd) {
410 case F_GETLK:
411 case F_SETLK:
412 case F_SETLKW:
413 ret = get_compat_flock(&f, compat_ptr(arg));
414 if (ret != 0)
415 break;
416 old_fs = get_fs();
417 set_fs(KERNEL_DS);
418 ret = sys_fcntl(fd, cmd, (unsigned long)&f);
419 set_fs(old_fs);
420 if (cmd == F_GETLK && ret == 0) {
421 /* GETLK was successful and we need to return the data...
422 * but it needs to fit in the compat structure.
423 * l_start shouldn't be too big, unless the original
424 * start + end is greater than COMPAT_OFF_T_MAX, in which
425 * case the app was asking for trouble, so we return
426 * -EOVERFLOW in that case.
427 * l_len could be too big, in which case we just truncate it,
428 * and only allow the app to see that part of the conflicting
429 * lock that might make sense to it anyway
430 */
431
432 if (f.l_start > COMPAT_OFF_T_MAX)
433 ret = -EOVERFLOW;
434 if (f.l_len > COMPAT_OFF_T_MAX)
435 f.l_len = COMPAT_OFF_T_MAX;
436 if (ret == 0)
437 ret = put_compat_flock(&f, compat_ptr(arg));
438 }
439 break;
440
441 case F_GETLK64:
442 case F_SETLK64:
443 case F_SETLKW64:
444 ret = get_compat_flock64(&f, compat_ptr(arg));
445 if (ret != 0)
446 break;
447 old_fs = get_fs();
448 set_fs(KERNEL_DS);
449 ret = sys_fcntl(fd, (cmd == F_GETLK64) ? F_GETLK :
450 ((cmd == F_SETLK64) ? F_SETLK : F_SETLKW),
451 (unsigned long)&f);
452 set_fs(old_fs);
453 if (cmd == F_GETLK64 && ret == 0) {
454 /* need to return lock information - see above for commentary */
455 if (f.l_start > COMPAT_LOFF_T_MAX)
456 ret = -EOVERFLOW;
457 if (f.l_len > COMPAT_LOFF_T_MAX)
458 f.l_len = COMPAT_LOFF_T_MAX;
459 if (ret == 0)
460 ret = put_compat_flock64(&f, compat_ptr(arg));
461 }
462 break;
463
464 default:
465 ret = sys_fcntl(fd, cmd, arg);
466 break;
467 }
468 return ret;
469 }
470
compat_sys_fcntl(unsigned int fd,unsigned int cmd,unsigned long arg)471 asmlinkage long compat_sys_fcntl(unsigned int fd, unsigned int cmd,
472 unsigned long arg)
473 {
474 if ((cmd == F_GETLK64) || (cmd == F_SETLK64) || (cmd == F_SETLKW64))
475 return -EINVAL;
476 return compat_sys_fcntl64(fd, cmd, arg);
477 }
478
479 asmlinkage long
compat_sys_io_setup(unsigned nr_reqs,u32 __user * ctx32p)480 compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p)
481 {
482 long ret;
483 aio_context_t ctx64;
484
485 mm_segment_t oldfs = get_fs();
486 if (unlikely(get_user(ctx64, ctx32p)))
487 return -EFAULT;
488
489 set_fs(KERNEL_DS);
490 /* The __user pointer cast is valid because of the set_fs() */
491 ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
492 set_fs(oldfs);
493 /* truncating is ok because it's a user address */
494 if (!ret)
495 ret = put_user((u32) ctx64, ctx32p);
496 return ret;
497 }
498
499 asmlinkage long
compat_sys_io_getevents(aio_context_t ctx_id,unsigned long min_nr,unsigned long nr,struct io_event __user * events,struct compat_timespec __user * timeout)500 compat_sys_io_getevents(aio_context_t ctx_id,
501 unsigned long min_nr,
502 unsigned long nr,
503 struct io_event __user *events,
504 struct compat_timespec __user *timeout)
505 {
506 long ret;
507 struct timespec t;
508 struct timespec __user *ut = NULL;
509
510 ret = -EFAULT;
511 if (unlikely(!access_ok(VERIFY_WRITE, events,
512 nr * sizeof(struct io_event))))
513 goto out;
514 if (timeout) {
515 if (get_compat_timespec(&t, timeout))
516 goto out;
517
518 ut = compat_alloc_user_space(sizeof(*ut));
519 if (copy_to_user(ut, &t, sizeof(t)) )
520 goto out;
521 }
522 ret = sys_io_getevents(ctx_id, min_nr, nr, events, ut);
523 out:
524 return ret;
525 }
526
527 /* A write operation does a read from user space and vice versa */
528 #define vrfy_dir(type) ((type) == READ ? VERIFY_WRITE : VERIFY_READ)
529
compat_rw_copy_check_uvector(int type,const struct compat_iovec __user * uvector,unsigned long nr_segs,unsigned long fast_segs,struct iovec * fast_pointer,struct iovec ** ret_pointer)530 ssize_t compat_rw_copy_check_uvector(int type,
531 const struct compat_iovec __user *uvector, unsigned long nr_segs,
532 unsigned long fast_segs, struct iovec *fast_pointer,
533 struct iovec **ret_pointer)
534 {
535 compat_ssize_t tot_len;
536 struct iovec *iov = *ret_pointer = fast_pointer;
537 ssize_t ret = 0;
538 int seg;
539
540 /*
541 * SuS says "The readv() function *may* fail if the iovcnt argument
542 * was less than or equal to 0, or greater than {IOV_MAX}. Linux has
543 * traditionally returned zero for zero segments, so...
544 */
545 if (nr_segs == 0)
546 goto out;
547
548 ret = -EINVAL;
549 if (nr_segs > UIO_MAXIOV || nr_segs < 0)
550 goto out;
551 if (nr_segs > fast_segs) {
552 ret = -ENOMEM;
553 iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL);
554 if (iov == NULL)
555 goto out;
556 }
557 *ret_pointer = iov;
558
559 ret = -EFAULT;
560 if (!access_ok(VERIFY_READ, uvector, nr_segs*sizeof(*uvector)))
561 goto out;
562
563 /*
564 * Single unix specification:
565 * We should -EINVAL if an element length is not >= 0 and fitting an
566 * ssize_t.
567 *
568 * In Linux, the total length is limited to MAX_RW_COUNT, there is
569 * no overflow possibility.
570 */
571 tot_len = 0;
572 ret = -EINVAL;
573 for (seg = 0; seg < nr_segs; seg++) {
574 compat_uptr_t buf;
575 compat_ssize_t len;
576
577 if (__get_user(len, &uvector->iov_len) ||
578 __get_user(buf, &uvector->iov_base)) {
579 ret = -EFAULT;
580 goto out;
581 }
582 if (len < 0) /* size_t not fitting in compat_ssize_t .. */
583 goto out;
584 if (type >= 0 &&
585 !access_ok(vrfy_dir(type), compat_ptr(buf), len)) {
586 ret = -EFAULT;
587 goto out;
588 }
589 if (len > MAX_RW_COUNT - tot_len)
590 len = MAX_RW_COUNT - tot_len;
591 tot_len += len;
592 iov->iov_base = compat_ptr(buf);
593 iov->iov_len = (compat_size_t) len;
594 uvector++;
595 iov++;
596 }
597 ret = tot_len;
598
599 out:
600 return ret;
601 }
602
603 static inline long
copy_iocb(long nr,u32 __user * ptr32,struct iocb __user * __user * ptr64)604 copy_iocb(long nr, u32 __user *ptr32, struct iocb __user * __user *ptr64)
605 {
606 compat_uptr_t uptr;
607 int i;
608
609 for (i = 0; i < nr; ++i) {
610 if (get_user(uptr, ptr32 + i))
611 return -EFAULT;
612 if (put_user(compat_ptr(uptr), ptr64 + i))
613 return -EFAULT;
614 }
615 return 0;
616 }
617
618 #define MAX_AIO_SUBMITS (PAGE_SIZE/sizeof(struct iocb *))
619
620 asmlinkage long
compat_sys_io_submit(aio_context_t ctx_id,int nr,u32 __user * iocb)621 compat_sys_io_submit(aio_context_t ctx_id, int nr, u32 __user *iocb)
622 {
623 struct iocb __user * __user *iocb64;
624 long ret;
625
626 if (unlikely(nr < 0))
627 return -EINVAL;
628
629 if (nr > MAX_AIO_SUBMITS)
630 nr = MAX_AIO_SUBMITS;
631
632 iocb64 = compat_alloc_user_space(nr * sizeof(*iocb64));
633 ret = copy_iocb(nr, iocb, iocb64);
634 if (!ret)
635 ret = do_io_submit(ctx_id, nr, iocb64, 1);
636 return ret;
637 }
638
639 struct compat_ncp_mount_data {
640 compat_int_t version;
641 compat_uint_t ncp_fd;
642 __compat_uid_t mounted_uid;
643 compat_pid_t wdog_pid;
644 unsigned char mounted_vol[NCP_VOLNAME_LEN + 1];
645 compat_uint_t time_out;
646 compat_uint_t retry_count;
647 compat_uint_t flags;
648 __compat_uid_t uid;
649 __compat_gid_t gid;
650 compat_mode_t file_mode;
651 compat_mode_t dir_mode;
652 };
653
654 struct compat_ncp_mount_data_v4 {
655 compat_int_t version;
656 compat_ulong_t flags;
657 compat_ulong_t mounted_uid;
658 compat_long_t wdog_pid;
659 compat_uint_t ncp_fd;
660 compat_uint_t time_out;
661 compat_uint_t retry_count;
662 compat_ulong_t uid;
663 compat_ulong_t gid;
664 compat_ulong_t file_mode;
665 compat_ulong_t dir_mode;
666 };
667
do_ncp_super_data_conv(void * raw_data)668 static void *do_ncp_super_data_conv(void *raw_data)
669 {
670 int version = *(unsigned int *)raw_data;
671
672 if (version == 3) {
673 struct compat_ncp_mount_data *c_n = raw_data;
674 struct ncp_mount_data *n = raw_data;
675
676 n->dir_mode = c_n->dir_mode;
677 n->file_mode = c_n->file_mode;
678 n->gid = c_n->gid;
679 n->uid = c_n->uid;
680 memmove (n->mounted_vol, c_n->mounted_vol, (sizeof (c_n->mounted_vol) + 3 * sizeof (unsigned int)));
681 n->wdog_pid = c_n->wdog_pid;
682 n->mounted_uid = c_n->mounted_uid;
683 } else if (version == 4) {
684 struct compat_ncp_mount_data_v4 *c_n = raw_data;
685 struct ncp_mount_data_v4 *n = raw_data;
686
687 n->dir_mode = c_n->dir_mode;
688 n->file_mode = c_n->file_mode;
689 n->gid = c_n->gid;
690 n->uid = c_n->uid;
691 n->retry_count = c_n->retry_count;
692 n->time_out = c_n->time_out;
693 n->ncp_fd = c_n->ncp_fd;
694 n->wdog_pid = c_n->wdog_pid;
695 n->mounted_uid = c_n->mounted_uid;
696 n->flags = c_n->flags;
697 } else if (version != 5) {
698 return NULL;
699 }
700
701 return raw_data;
702 }
703
704
705 struct compat_nfs_string {
706 compat_uint_t len;
707 compat_uptr_t data;
708 };
709
compat_nfs_string(struct nfs_string * dst,struct compat_nfs_string * src)710 static inline void compat_nfs_string(struct nfs_string *dst,
711 struct compat_nfs_string *src)
712 {
713 dst->data = compat_ptr(src->data);
714 dst->len = src->len;
715 }
716
717 struct compat_nfs4_mount_data_v1 {
718 compat_int_t version;
719 compat_int_t flags;
720 compat_int_t rsize;
721 compat_int_t wsize;
722 compat_int_t timeo;
723 compat_int_t retrans;
724 compat_int_t acregmin;
725 compat_int_t acregmax;
726 compat_int_t acdirmin;
727 compat_int_t acdirmax;
728 struct compat_nfs_string client_addr;
729 struct compat_nfs_string mnt_path;
730 struct compat_nfs_string hostname;
731 compat_uint_t host_addrlen;
732 compat_uptr_t host_addr;
733 compat_int_t proto;
734 compat_int_t auth_flavourlen;
735 compat_uptr_t auth_flavours;
736 };
737
do_nfs4_super_data_conv(void * raw_data)738 static int do_nfs4_super_data_conv(void *raw_data)
739 {
740 int version = *(compat_uint_t *) raw_data;
741
742 if (version == 1) {
743 struct compat_nfs4_mount_data_v1 *raw = raw_data;
744 struct nfs4_mount_data *real = raw_data;
745
746 /* copy the fields backwards */
747 real->auth_flavours = compat_ptr(raw->auth_flavours);
748 real->auth_flavourlen = raw->auth_flavourlen;
749 real->proto = raw->proto;
750 real->host_addr = compat_ptr(raw->host_addr);
751 real->host_addrlen = raw->host_addrlen;
752 compat_nfs_string(&real->hostname, &raw->hostname);
753 compat_nfs_string(&real->mnt_path, &raw->mnt_path);
754 compat_nfs_string(&real->client_addr, &raw->client_addr);
755 real->acdirmax = raw->acdirmax;
756 real->acdirmin = raw->acdirmin;
757 real->acregmax = raw->acregmax;
758 real->acregmin = raw->acregmin;
759 real->retrans = raw->retrans;
760 real->timeo = raw->timeo;
761 real->wsize = raw->wsize;
762 real->rsize = raw->rsize;
763 real->flags = raw->flags;
764 real->version = raw->version;
765 }
766
767 return 0;
768 }
769
770 #define NCPFS_NAME "ncpfs"
771 #define NFS4_NAME "nfs4"
772
compat_sys_mount(const char __user * dev_name,const char __user * dir_name,const char __user * type,unsigned long flags,const void __user * data)773 asmlinkage long compat_sys_mount(const char __user * dev_name,
774 const char __user * dir_name,
775 const char __user * type, unsigned long flags,
776 const void __user * data)
777 {
778 char *kernel_type;
779 unsigned long data_page;
780 char *kernel_dev;
781 struct filename *dir;
782 int retval;
783
784 retval = copy_mount_string(type, &kernel_type);
785 if (retval < 0)
786 goto out;
787
788 dir = getname(dir_name);
789 retval = PTR_ERR(dir);
790 if (IS_ERR(dir))
791 goto out1;
792
793 retval = copy_mount_string(dev_name, &kernel_dev);
794 if (retval < 0)
795 goto out2;
796
797 retval = copy_mount_options(data, &data_page);
798 if (retval < 0)
799 goto out3;
800
801 retval = -EINVAL;
802
803 if (kernel_type && data_page) {
804 if (!strcmp(kernel_type, NCPFS_NAME)) {
805 do_ncp_super_data_conv((void *)data_page);
806 } else if (!strcmp(kernel_type, NFS4_NAME)) {
807 if (do_nfs4_super_data_conv((void *) data_page))
808 goto out4;
809 }
810 }
811
812 retval = do_mount(kernel_dev, dir->name, kernel_type,
813 flags, (void*)data_page);
814
815 out4:
816 free_page(data_page);
817 out3:
818 kfree(kernel_dev);
819 out2:
820 putname(dir);
821 out1:
822 kfree(kernel_type);
823 out:
824 return retval;
825 }
826
827 struct compat_old_linux_dirent {
828 compat_ulong_t d_ino;
829 compat_ulong_t d_offset;
830 unsigned short d_namlen;
831 char d_name[1];
832 };
833
834 struct compat_readdir_callback {
835 struct dir_context ctx;
836 struct compat_old_linux_dirent __user *dirent;
837 int result;
838 };
839
compat_fillonedir(void * __buf,const char * name,int namlen,loff_t offset,u64 ino,unsigned int d_type)840 static int compat_fillonedir(void *__buf, const char *name, int namlen,
841 loff_t offset, u64 ino, unsigned int d_type)
842 {
843 struct compat_readdir_callback *buf = __buf;
844 struct compat_old_linux_dirent __user *dirent;
845 compat_ulong_t d_ino;
846
847 if (buf->result)
848 return -EINVAL;
849 d_ino = ino;
850 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
851 buf->result = -EOVERFLOW;
852 return -EOVERFLOW;
853 }
854 buf->result++;
855 dirent = buf->dirent;
856 if (!access_ok(VERIFY_WRITE, dirent,
857 (unsigned long)(dirent->d_name + namlen + 1) -
858 (unsigned long)dirent))
859 goto efault;
860 if ( __put_user(d_ino, &dirent->d_ino) ||
861 __put_user(offset, &dirent->d_offset) ||
862 __put_user(namlen, &dirent->d_namlen) ||
863 __copy_to_user(dirent->d_name, name, namlen) ||
864 __put_user(0, dirent->d_name + namlen))
865 goto efault;
866 return 0;
867 efault:
868 buf->result = -EFAULT;
869 return -EFAULT;
870 }
871
compat_sys_old_readdir(unsigned int fd,struct compat_old_linux_dirent __user * dirent,unsigned int count)872 asmlinkage long compat_sys_old_readdir(unsigned int fd,
873 struct compat_old_linux_dirent __user *dirent, unsigned int count)
874 {
875 int error;
876 struct fd f = fdget(fd);
877 struct compat_readdir_callback buf = {
878 .ctx.actor = compat_fillonedir,
879 .dirent = dirent
880 };
881
882 if (!f.file)
883 return -EBADF;
884
885 error = iterate_dir(f.file, &buf.ctx);
886 if (buf.result)
887 error = buf.result;
888
889 fdput(f);
890 return error;
891 }
892
893 struct compat_linux_dirent {
894 compat_ulong_t d_ino;
895 compat_ulong_t d_off;
896 unsigned short d_reclen;
897 char d_name[1];
898 };
899
900 struct compat_getdents_callback {
901 struct dir_context ctx;
902 struct compat_linux_dirent __user *current_dir;
903 struct compat_linux_dirent __user *previous;
904 int count;
905 int error;
906 };
907
compat_filldir(void * __buf,const char * name,int namlen,loff_t offset,u64 ino,unsigned int d_type)908 static int compat_filldir(void *__buf, const char *name, int namlen,
909 loff_t offset, u64 ino, unsigned int d_type)
910 {
911 struct compat_linux_dirent __user * dirent;
912 struct compat_getdents_callback *buf = __buf;
913 compat_ulong_t d_ino;
914 int reclen = ALIGN(offsetof(struct compat_linux_dirent, d_name) +
915 namlen + 2, sizeof(compat_long_t));
916
917 buf->error = -EINVAL; /* only used if we fail.. */
918 if (reclen > buf->count)
919 return -EINVAL;
920 d_ino = ino;
921 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
922 buf->error = -EOVERFLOW;
923 return -EOVERFLOW;
924 }
925 dirent = buf->previous;
926 if (dirent) {
927 if (__put_user(offset, &dirent->d_off))
928 goto efault;
929 }
930 dirent = buf->current_dir;
931 if (__put_user(d_ino, &dirent->d_ino))
932 goto efault;
933 if (__put_user(reclen, &dirent->d_reclen))
934 goto efault;
935 if (copy_to_user(dirent->d_name, name, namlen))
936 goto efault;
937 if (__put_user(0, dirent->d_name + namlen))
938 goto efault;
939 if (__put_user(d_type, (char __user *) dirent + reclen - 1))
940 goto efault;
941 buf->previous = dirent;
942 dirent = (void __user *)dirent + reclen;
943 buf->current_dir = dirent;
944 buf->count -= reclen;
945 return 0;
946 efault:
947 buf->error = -EFAULT;
948 return -EFAULT;
949 }
950
compat_sys_getdents(unsigned int fd,struct compat_linux_dirent __user * dirent,unsigned int count)951 asmlinkage long compat_sys_getdents(unsigned int fd,
952 struct compat_linux_dirent __user *dirent, unsigned int count)
953 {
954 struct fd f;
955 struct compat_linux_dirent __user * lastdirent;
956 struct compat_getdents_callback buf = {
957 .ctx.actor = compat_filldir,
958 .current_dir = dirent,
959 .count = count
960 };
961 int error;
962
963 if (!access_ok(VERIFY_WRITE, dirent, count))
964 return -EFAULT;
965
966 f = fdget(fd);
967 if (!f.file)
968 return -EBADF;
969
970 error = iterate_dir(f.file, &buf.ctx);
971 if (error >= 0)
972 error = buf.error;
973 lastdirent = buf.previous;
974 if (lastdirent) {
975 if (put_user(buf.ctx.pos, &lastdirent->d_off))
976 error = -EFAULT;
977 else
978 error = count - buf.count;
979 }
980 fdput(f);
981 return error;
982 }
983
984 #ifndef __ARCH_OMIT_COMPAT_SYS_GETDENTS64
985
986 struct compat_getdents_callback64 {
987 struct dir_context ctx;
988 struct linux_dirent64 __user *current_dir;
989 struct linux_dirent64 __user *previous;
990 int count;
991 int error;
992 };
993
compat_filldir64(void * __buf,const char * name,int namlen,loff_t offset,u64 ino,unsigned int d_type)994 static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t offset,
995 u64 ino, unsigned int d_type)
996 {
997 struct linux_dirent64 __user *dirent;
998 struct compat_getdents_callback64 *buf = __buf;
999 int reclen = ALIGN(offsetof(struct linux_dirent64, d_name) + namlen + 1,
1000 sizeof(u64));
1001 u64 off;
1002
1003 buf->error = -EINVAL; /* only used if we fail.. */
1004 if (reclen > buf->count)
1005 return -EINVAL;
1006 dirent = buf->previous;
1007
1008 if (dirent) {
1009 if (__put_user_unaligned(offset, &dirent->d_off))
1010 goto efault;
1011 }
1012 dirent = buf->current_dir;
1013 if (__put_user_unaligned(ino, &dirent->d_ino))
1014 goto efault;
1015 off = 0;
1016 if (__put_user_unaligned(off, &dirent->d_off))
1017 goto efault;
1018 if (__put_user(reclen, &dirent->d_reclen))
1019 goto efault;
1020 if (__put_user(d_type, &dirent->d_type))
1021 goto efault;
1022 if (copy_to_user(dirent->d_name, name, namlen))
1023 goto efault;
1024 if (__put_user(0, dirent->d_name + namlen))
1025 goto efault;
1026 buf->previous = dirent;
1027 dirent = (void __user *)dirent + reclen;
1028 buf->current_dir = dirent;
1029 buf->count -= reclen;
1030 return 0;
1031 efault:
1032 buf->error = -EFAULT;
1033 return -EFAULT;
1034 }
1035
compat_sys_getdents64(unsigned int fd,struct linux_dirent64 __user * dirent,unsigned int count)1036 asmlinkage long compat_sys_getdents64(unsigned int fd,
1037 struct linux_dirent64 __user * dirent, unsigned int count)
1038 {
1039 struct fd f;
1040 struct linux_dirent64 __user * lastdirent;
1041 struct compat_getdents_callback64 buf = {
1042 .ctx.actor = compat_filldir64,
1043 .current_dir = dirent,
1044 .count = count
1045 };
1046 int error;
1047
1048 if (!access_ok(VERIFY_WRITE, dirent, count))
1049 return -EFAULT;
1050
1051 f = fdget(fd);
1052 if (!f.file)
1053 return -EBADF;
1054
1055 error = iterate_dir(f.file, &buf.ctx);
1056 if (error >= 0)
1057 error = buf.error;
1058 lastdirent = buf.previous;
1059 if (lastdirent) {
1060 typeof(lastdirent->d_off) d_off = buf.ctx.pos;
1061 if (__put_user_unaligned(d_off, &lastdirent->d_off))
1062 error = -EFAULT;
1063 else
1064 error = count - buf.count;
1065 }
1066 fdput(f);
1067 return error;
1068 }
1069 #endif /* ! __ARCH_OMIT_COMPAT_SYS_GETDENTS64 */
1070
1071 /*
1072 * Exactly like fs/open.c:sys_open(), except that it doesn't set the
1073 * O_LARGEFILE flag.
1074 */
COMPAT_SYSCALL_DEFINE3(open,const char __user *,filename,int,flags,umode_t,mode)1075 COMPAT_SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1076 {
1077 return do_sys_open(AT_FDCWD, filename, flags, mode);
1078 }
1079
1080 /*
1081 * Exactly like fs/open.c:sys_openat(), except that it doesn't set the
1082 * O_LARGEFILE flag.
1083 */
COMPAT_SYSCALL_DEFINE4(openat,int,dfd,const char __user *,filename,int,flags,umode_t,mode)1084 COMPAT_SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode)
1085 {
1086 return do_sys_open(dfd, filename, flags, mode);
1087 }
1088
1089 #define __COMPAT_NFDBITS (8 * sizeof(compat_ulong_t))
1090
poll_select_copy_remaining(struct timespec * end_time,void __user * p,int timeval,int ret)1091 static int poll_select_copy_remaining(struct timespec *end_time, void __user *p,
1092 int timeval, int ret)
1093 {
1094 struct timespec ts;
1095
1096 if (!p)
1097 return ret;
1098
1099 if (current->personality & STICKY_TIMEOUTS)
1100 goto sticky;
1101
1102 /* No update for zero timeout */
1103 if (!end_time->tv_sec && !end_time->tv_nsec)
1104 return ret;
1105
1106 ktime_get_ts(&ts);
1107 ts = timespec_sub(*end_time, ts);
1108 if (ts.tv_sec < 0)
1109 ts.tv_sec = ts.tv_nsec = 0;
1110
1111 if (timeval) {
1112 struct compat_timeval rtv;
1113
1114 rtv.tv_sec = ts.tv_sec;
1115 rtv.tv_usec = ts.tv_nsec / NSEC_PER_USEC;
1116
1117 if (!copy_to_user(p, &rtv, sizeof(rtv)))
1118 return ret;
1119 } else {
1120 struct compat_timespec rts;
1121
1122 rts.tv_sec = ts.tv_sec;
1123 rts.tv_nsec = ts.tv_nsec;
1124
1125 if (!copy_to_user(p, &rts, sizeof(rts)))
1126 return ret;
1127 }
1128 /*
1129 * If an application puts its timeval in read-only memory, we
1130 * don't want the Linux-specific update to the timeval to
1131 * cause a fault after the select has completed
1132 * successfully. However, because we're not updating the
1133 * timeval, we can't restart the system call.
1134 */
1135
1136 sticky:
1137 if (ret == -ERESTARTNOHAND)
1138 ret = -EINTR;
1139 return ret;
1140 }
1141
1142 /*
1143 * Ooo, nasty. We need here to frob 32-bit unsigned longs to
1144 * 64-bit unsigned longs.
1145 */
1146 static
compat_get_fd_set(unsigned long nr,compat_ulong_t __user * ufdset,unsigned long * fdset)1147 int compat_get_fd_set(unsigned long nr, compat_ulong_t __user *ufdset,
1148 unsigned long *fdset)
1149 {
1150 nr = DIV_ROUND_UP(nr, __COMPAT_NFDBITS);
1151 if (ufdset) {
1152 unsigned long odd;
1153
1154 if (!access_ok(VERIFY_WRITE, ufdset, nr*sizeof(compat_ulong_t)))
1155 return -EFAULT;
1156
1157 odd = nr & 1UL;
1158 nr &= ~1UL;
1159 while (nr) {
1160 unsigned long h, l;
1161 if (__get_user(l, ufdset) || __get_user(h, ufdset+1))
1162 return -EFAULT;
1163 ufdset += 2;
1164 *fdset++ = h << 32 | l;
1165 nr -= 2;
1166 }
1167 if (odd && __get_user(*fdset, ufdset))
1168 return -EFAULT;
1169 } else {
1170 /* Tricky, must clear full unsigned long in the
1171 * kernel fdset at the end, this makes sure that
1172 * actually happens.
1173 */
1174 memset(fdset, 0, ((nr + 1) & ~1)*sizeof(compat_ulong_t));
1175 }
1176 return 0;
1177 }
1178
1179 static
compat_set_fd_set(unsigned long nr,compat_ulong_t __user * ufdset,unsigned long * fdset)1180 int compat_set_fd_set(unsigned long nr, compat_ulong_t __user *ufdset,
1181 unsigned long *fdset)
1182 {
1183 unsigned long odd;
1184 nr = DIV_ROUND_UP(nr, __COMPAT_NFDBITS);
1185
1186 if (!ufdset)
1187 return 0;
1188
1189 odd = nr & 1UL;
1190 nr &= ~1UL;
1191 while (nr) {
1192 unsigned long h, l;
1193 l = *fdset++;
1194 h = l >> 32;
1195 if (__put_user(l, ufdset) || __put_user(h, ufdset+1))
1196 return -EFAULT;
1197 ufdset += 2;
1198 nr -= 2;
1199 }
1200 if (odd && __put_user(*fdset, ufdset))
1201 return -EFAULT;
1202 return 0;
1203 }
1204
1205
1206 /*
1207 * This is a virtual copy of sys_select from fs/select.c and probably
1208 * should be compared to it from time to time
1209 */
1210
1211 /*
1212 * We can actually return ERESTARTSYS instead of EINTR, but I'd
1213 * like to be certain this leads to no problems. So I return
1214 * EINTR just for safety.
1215 *
1216 * Update: ERESTARTSYS breaks at least the xview clock binary, so
1217 * I'm trying ERESTARTNOHAND which restart only when you want to.
1218 */
compat_core_sys_select(int n,compat_ulong_t __user * inp,compat_ulong_t __user * outp,compat_ulong_t __user * exp,struct timespec * end_time)1219 int compat_core_sys_select(int n, compat_ulong_t __user *inp,
1220 compat_ulong_t __user *outp, compat_ulong_t __user *exp,
1221 struct timespec *end_time)
1222 {
1223 fd_set_bits fds;
1224 void *bits;
1225 int size, max_fds, ret = -EINVAL;
1226 struct fdtable *fdt;
1227 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
1228
1229 if (n < 0)
1230 goto out_nofds;
1231
1232 /* max_fds can increase, so grab it once to avoid race */
1233 rcu_read_lock();
1234 fdt = files_fdtable(current->files);
1235 max_fds = fdt->max_fds;
1236 rcu_read_unlock();
1237 if (n > max_fds)
1238 n = max_fds;
1239
1240 /*
1241 * We need 6 bitmaps (in/out/ex for both incoming and outgoing),
1242 * since we used fdset we need to allocate memory in units of
1243 * long-words.
1244 */
1245 size = FDS_BYTES(n);
1246 bits = stack_fds;
1247 if (size > sizeof(stack_fds) / 6) {
1248 bits = kmalloc(6 * size, GFP_KERNEL);
1249 ret = -ENOMEM;
1250 if (!bits)
1251 goto out_nofds;
1252 }
1253 fds.in = (unsigned long *) bits;
1254 fds.out = (unsigned long *) (bits + size);
1255 fds.ex = (unsigned long *) (bits + 2*size);
1256 fds.res_in = (unsigned long *) (bits + 3*size);
1257 fds.res_out = (unsigned long *) (bits + 4*size);
1258 fds.res_ex = (unsigned long *) (bits + 5*size);
1259
1260 if ((ret = compat_get_fd_set(n, inp, fds.in)) ||
1261 (ret = compat_get_fd_set(n, outp, fds.out)) ||
1262 (ret = compat_get_fd_set(n, exp, fds.ex)))
1263 goto out;
1264 zero_fd_set(n, fds.res_in);
1265 zero_fd_set(n, fds.res_out);
1266 zero_fd_set(n, fds.res_ex);
1267
1268 ret = do_select(n, &fds, end_time);
1269
1270 if (ret < 0)
1271 goto out;
1272 if (!ret) {
1273 ret = -ERESTARTNOHAND;
1274 if (signal_pending(current))
1275 goto out;
1276 ret = 0;
1277 }
1278
1279 if (compat_set_fd_set(n, inp, fds.res_in) ||
1280 compat_set_fd_set(n, outp, fds.res_out) ||
1281 compat_set_fd_set(n, exp, fds.res_ex))
1282 ret = -EFAULT;
1283 out:
1284 if (bits != stack_fds)
1285 kfree(bits);
1286 out_nofds:
1287 return ret;
1288 }
1289
compat_sys_select(int n,compat_ulong_t __user * inp,compat_ulong_t __user * outp,compat_ulong_t __user * exp,struct compat_timeval __user * tvp)1290 asmlinkage long compat_sys_select(int n, compat_ulong_t __user *inp,
1291 compat_ulong_t __user *outp, compat_ulong_t __user *exp,
1292 struct compat_timeval __user *tvp)
1293 {
1294 struct timespec end_time, *to = NULL;
1295 struct compat_timeval tv;
1296 int ret;
1297
1298 if (tvp) {
1299 if (copy_from_user(&tv, tvp, sizeof(tv)))
1300 return -EFAULT;
1301
1302 to = &end_time;
1303 if (poll_select_set_timeout(to,
1304 tv.tv_sec + (tv.tv_usec / USEC_PER_SEC),
1305 (tv.tv_usec % USEC_PER_SEC) * NSEC_PER_USEC))
1306 return -EINVAL;
1307 }
1308
1309 ret = compat_core_sys_select(n, inp, outp, exp, to);
1310 ret = poll_select_copy_remaining(&end_time, tvp, 1, ret);
1311
1312 return ret;
1313 }
1314
1315 struct compat_sel_arg_struct {
1316 compat_ulong_t n;
1317 compat_uptr_t inp;
1318 compat_uptr_t outp;
1319 compat_uptr_t exp;
1320 compat_uptr_t tvp;
1321 };
1322
compat_sys_old_select(struct compat_sel_arg_struct __user * arg)1323 asmlinkage long compat_sys_old_select(struct compat_sel_arg_struct __user *arg)
1324 {
1325 struct compat_sel_arg_struct a;
1326
1327 if (copy_from_user(&a, arg, sizeof(a)))
1328 return -EFAULT;
1329 return compat_sys_select(a.n, compat_ptr(a.inp), compat_ptr(a.outp),
1330 compat_ptr(a.exp), compat_ptr(a.tvp));
1331 }
1332
do_compat_pselect(int n,compat_ulong_t __user * inp,compat_ulong_t __user * outp,compat_ulong_t __user * exp,struct compat_timespec __user * tsp,compat_sigset_t __user * sigmask,compat_size_t sigsetsize)1333 static long do_compat_pselect(int n, compat_ulong_t __user *inp,
1334 compat_ulong_t __user *outp, compat_ulong_t __user *exp,
1335 struct compat_timespec __user *tsp, compat_sigset_t __user *sigmask,
1336 compat_size_t sigsetsize)
1337 {
1338 compat_sigset_t ss32;
1339 sigset_t ksigmask, sigsaved;
1340 struct compat_timespec ts;
1341 struct timespec end_time, *to = NULL;
1342 int ret;
1343
1344 if (tsp) {
1345 if (copy_from_user(&ts, tsp, sizeof(ts)))
1346 return -EFAULT;
1347
1348 to = &end_time;
1349 if (poll_select_set_timeout(to, ts.tv_sec, ts.tv_nsec))
1350 return -EINVAL;
1351 }
1352
1353 if (sigmask) {
1354 if (sigsetsize != sizeof(compat_sigset_t))
1355 return -EINVAL;
1356 if (copy_from_user(&ss32, sigmask, sizeof(ss32)))
1357 return -EFAULT;
1358 sigset_from_compat(&ksigmask, &ss32);
1359
1360 sigdelsetmask(&ksigmask, sigmask(SIGKILL)|sigmask(SIGSTOP));
1361 sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
1362 }
1363
1364 ret = compat_core_sys_select(n, inp, outp, exp, to);
1365 ret = poll_select_copy_remaining(&end_time, tsp, 0, ret);
1366
1367 if (ret == -ERESTARTNOHAND) {
1368 /*
1369 * Don't restore the signal mask yet. Let do_signal() deliver
1370 * the signal on the way back to userspace, before the signal
1371 * mask is restored.
1372 */
1373 if (sigmask) {
1374 memcpy(¤t->saved_sigmask, &sigsaved,
1375 sizeof(sigsaved));
1376 set_restore_sigmask();
1377 }
1378 } else if (sigmask)
1379 sigprocmask(SIG_SETMASK, &sigsaved, NULL);
1380
1381 return ret;
1382 }
1383
compat_sys_pselect6(int n,compat_ulong_t __user * inp,compat_ulong_t __user * outp,compat_ulong_t __user * exp,struct compat_timespec __user * tsp,void __user * sig)1384 asmlinkage long compat_sys_pselect6(int n, compat_ulong_t __user *inp,
1385 compat_ulong_t __user *outp, compat_ulong_t __user *exp,
1386 struct compat_timespec __user *tsp, void __user *sig)
1387 {
1388 compat_size_t sigsetsize = 0;
1389 compat_uptr_t up = 0;
1390
1391 if (sig) {
1392 if (!access_ok(VERIFY_READ, sig,
1393 sizeof(compat_uptr_t)+sizeof(compat_size_t)) ||
1394 __get_user(up, (compat_uptr_t __user *)sig) ||
1395 __get_user(sigsetsize,
1396 (compat_size_t __user *)(sig+sizeof(up))))
1397 return -EFAULT;
1398 }
1399 return do_compat_pselect(n, inp, outp, exp, tsp, compat_ptr(up),
1400 sigsetsize);
1401 }
1402
compat_sys_ppoll(struct pollfd __user * ufds,unsigned int nfds,struct compat_timespec __user * tsp,const compat_sigset_t __user * sigmask,compat_size_t sigsetsize)1403 asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
1404 unsigned int nfds, struct compat_timespec __user *tsp,
1405 const compat_sigset_t __user *sigmask, compat_size_t sigsetsize)
1406 {
1407 compat_sigset_t ss32;
1408 sigset_t ksigmask, sigsaved;
1409 struct compat_timespec ts;
1410 struct timespec end_time, *to = NULL;
1411 int ret;
1412
1413 if (tsp) {
1414 if (copy_from_user(&ts, tsp, sizeof(ts)))
1415 return -EFAULT;
1416
1417 to = &end_time;
1418 if (poll_select_set_timeout(to, ts.tv_sec, ts.tv_nsec))
1419 return -EINVAL;
1420 }
1421
1422 if (sigmask) {
1423 if (sigsetsize != sizeof(compat_sigset_t))
1424 return -EINVAL;
1425 if (copy_from_user(&ss32, sigmask, sizeof(ss32)))
1426 return -EFAULT;
1427 sigset_from_compat(&ksigmask, &ss32);
1428
1429 sigdelsetmask(&ksigmask, sigmask(SIGKILL)|sigmask(SIGSTOP));
1430 sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
1431 }
1432
1433 ret = do_sys_poll(ufds, nfds, to);
1434
1435 /* We can restart this syscall, usually */
1436 if (ret == -EINTR) {
1437 /*
1438 * Don't restore the signal mask yet. Let do_signal() deliver
1439 * the signal on the way back to userspace, before the signal
1440 * mask is restored.
1441 */
1442 if (sigmask) {
1443 memcpy(¤t->saved_sigmask, &sigsaved,
1444 sizeof(sigsaved));
1445 set_restore_sigmask();
1446 }
1447 ret = -ERESTARTNOHAND;
1448 } else if (sigmask)
1449 sigprocmask(SIG_SETMASK, &sigsaved, NULL);
1450
1451 ret = poll_select_copy_remaining(&end_time, tsp, 0, ret);
1452
1453 return ret;
1454 }
1455
1456 #ifdef CONFIG_FHANDLE
1457 /*
1458 * Exactly like fs/open.c:sys_open_by_handle_at(), except that it
1459 * doesn't set the O_LARGEFILE flag.
1460 */
COMPAT_SYSCALL_DEFINE3(open_by_handle_at,int,mountdirfd,struct file_handle __user *,handle,int,flags)1461 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
1462 struct file_handle __user *, handle, int, flags)
1463 {
1464 return do_handle_open(mountdirfd, handle, flags);
1465 }
1466 #endif
1467