1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/kernel.h>
3 #include <linux/errno.h>
4 #include <linux/file.h>
5 #include <linux/mm.h>
6 #include <linux/slab.h>
7 #include <linux/nospec.h>
8 #include <linux/io_uring.h>
9
10 #include <uapi/linux/io_uring.h>
11
12 #include "io_uring.h"
13 #include "rsrc.h"
14 #include "filetable.h"
15
io_file_bitmap_get(struct io_ring_ctx * ctx)16 static int io_file_bitmap_get(struct io_ring_ctx *ctx)
17 {
18 struct io_file_table *table = &ctx->file_table;
19 unsigned long nr = ctx->file_alloc_end;
20 int ret;
21
22 if (!table->bitmap)
23 return -ENFILE;
24
25 do {
26 ret = find_next_zero_bit(table->bitmap, nr, table->alloc_hint);
27 if (ret != nr)
28 return ret;
29
30 if (table->alloc_hint == ctx->file_alloc_start)
31 break;
32 nr = table->alloc_hint;
33 table->alloc_hint = ctx->file_alloc_start;
34 } while (1);
35
36 return -ENFILE;
37 }
38
io_alloc_file_tables(struct io_file_table * table,unsigned nr_files)39 bool io_alloc_file_tables(struct io_file_table *table, unsigned nr_files)
40 {
41 table->files = kvcalloc(nr_files, sizeof(table->files[0]),
42 GFP_KERNEL_ACCOUNT);
43 if (unlikely(!table->files))
44 return false;
45
46 table->bitmap = bitmap_zalloc(nr_files, GFP_KERNEL_ACCOUNT);
47 if (unlikely(!table->bitmap)) {
48 kvfree(table->files);
49 return false;
50 }
51
52 return true;
53 }
54
io_free_file_tables(struct io_file_table * table)55 void io_free_file_tables(struct io_file_table *table)
56 {
57 kvfree(table->files);
58 bitmap_free(table->bitmap);
59 table->files = NULL;
60 table->bitmap = NULL;
61 }
62
io_install_fixed_file(struct io_ring_ctx * ctx,struct file * file,u32 slot_index)63 static int io_install_fixed_file(struct io_ring_ctx *ctx, struct file *file,
64 u32 slot_index)
65 __must_hold(&req->ctx->uring_lock)
66 {
67 bool needs_switch = false;
68 struct io_fixed_file *file_slot;
69 int ret;
70
71 if (io_is_uring_fops(file))
72 return -EBADF;
73 if (!ctx->file_data)
74 return -ENXIO;
75 if (slot_index >= ctx->nr_user_files)
76 return -EINVAL;
77
78 slot_index = array_index_nospec(slot_index, ctx->nr_user_files);
79 file_slot = io_fixed_file_slot(&ctx->file_table, slot_index);
80
81 if (file_slot->file_ptr) {
82 struct file *old_file;
83
84 ret = io_rsrc_node_switch_start(ctx);
85 if (ret)
86 goto err;
87
88 old_file = (struct file *)(file_slot->file_ptr & FFS_MASK);
89 ret = io_queue_rsrc_removal(ctx->file_data, slot_index,
90 ctx->rsrc_node, old_file);
91 if (ret)
92 goto err;
93 file_slot->file_ptr = 0;
94 io_file_bitmap_clear(&ctx->file_table, slot_index);
95 needs_switch = true;
96 }
97
98 ret = io_scm_file_account(ctx, file);
99 if (!ret) {
100 *io_get_tag_slot(ctx->file_data, slot_index) = 0;
101 io_fixed_file_set(file_slot, file);
102 io_file_bitmap_set(&ctx->file_table, slot_index);
103 }
104 err:
105 if (needs_switch)
106 io_rsrc_node_switch(ctx, ctx->file_data);
107 return ret;
108 }
109
__io_fixed_fd_install(struct io_ring_ctx * ctx,struct file * file,unsigned int file_slot)110 int __io_fixed_fd_install(struct io_ring_ctx *ctx, struct file *file,
111 unsigned int file_slot)
112 {
113 bool alloc_slot = file_slot == IORING_FILE_INDEX_ALLOC;
114 int ret;
115
116 if (alloc_slot) {
117 ret = io_file_bitmap_get(ctx);
118 if (unlikely(ret < 0))
119 return ret;
120 file_slot = ret;
121 } else {
122 file_slot--;
123 }
124
125 ret = io_install_fixed_file(ctx, file, file_slot);
126 if (!ret && alloc_slot)
127 ret = file_slot;
128 return ret;
129 }
130 /*
131 * Note when io_fixed_fd_install() returns error value, it will ensure
132 * fput() is called correspondingly.
133 */
io_fixed_fd_install(struct io_kiocb * req,unsigned int issue_flags,struct file * file,unsigned int file_slot)134 int io_fixed_fd_install(struct io_kiocb *req, unsigned int issue_flags,
135 struct file *file, unsigned int file_slot)
136 {
137 struct io_ring_ctx *ctx = req->ctx;
138 int ret;
139
140 io_ring_submit_lock(ctx, issue_flags);
141 ret = __io_fixed_fd_install(ctx, file, file_slot);
142 io_ring_submit_unlock(ctx, issue_flags);
143
144 if (unlikely(ret < 0))
145 fput(file);
146 return ret;
147 }
148
io_fixed_fd_remove(struct io_ring_ctx * ctx,unsigned int offset)149 int io_fixed_fd_remove(struct io_ring_ctx *ctx, unsigned int offset)
150 {
151 struct io_fixed_file *file_slot;
152 struct file *file;
153 int ret;
154
155 if (unlikely(!ctx->file_data))
156 return -ENXIO;
157 if (offset >= ctx->nr_user_files)
158 return -EINVAL;
159 ret = io_rsrc_node_switch_start(ctx);
160 if (ret)
161 return ret;
162
163 offset = array_index_nospec(offset, ctx->nr_user_files);
164 file_slot = io_fixed_file_slot(&ctx->file_table, offset);
165 if (!file_slot->file_ptr)
166 return -EBADF;
167
168 file = (struct file *)(file_slot->file_ptr & FFS_MASK);
169 ret = io_queue_rsrc_removal(ctx->file_data, offset, ctx->rsrc_node, file);
170 if (ret)
171 return ret;
172
173 file_slot->file_ptr = 0;
174 io_file_bitmap_clear(&ctx->file_table, offset);
175 io_rsrc_node_switch(ctx, ctx->file_data);
176 return 0;
177 }
178
io_register_file_alloc_range(struct io_ring_ctx * ctx,struct io_uring_file_index_range __user * arg)179 int io_register_file_alloc_range(struct io_ring_ctx *ctx,
180 struct io_uring_file_index_range __user *arg)
181 {
182 struct io_uring_file_index_range range;
183 u32 end;
184
185 if (copy_from_user(&range, arg, sizeof(range)))
186 return -EFAULT;
187 if (check_add_overflow(range.off, range.len, &end))
188 return -EOVERFLOW;
189 if (range.resv || end > ctx->nr_user_files)
190 return -EINVAL;
191
192 io_file_table_set_alloc_range(ctx, range.off, range.len);
193 return 0;
194 }
195