1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * linux/fs/open.c
4 *
5 * Copyright (C) 1991, 1992 Linus Torvalds
6 */
7
8 #include <linux/string.h>
9 #include <linux/mm.h>
10 #include <linux/file.h>
11 #include <linux/fdtable.h>
12 #include <linux/fsnotify.h>
13 #include <linux/module.h>
14 #include <linux/tty.h>
15 #include <linux/namei.h>
16 #include <linux/backing-dev.h>
17 #include <linux/capability.h>
18 #include <linux/securebits.h>
19 #include <linux/security.h>
20 #include <linux/mount.h>
21 #include <linux/fcntl.h>
22 #include <linux/slab.h>
23 #include <linux/uaccess.h>
24 #include <linux/fs.h>
25 #include <linux/personality.h>
26 #include <linux/pagemap.h>
27 #include <linux/syscalls.h>
28 #include <linux/rcupdate.h>
29 #include <linux/audit.h>
30 #include <linux/falloc.h>
31 #include <linux/fs_struct.h>
32 #include <linux/ima.h>
33 #include <linux/dnotify.h>
34 #include <linux/compat.h>
35 #include <linux/mnt_idmapping.h>
36
37 #include "internal.h"
38 #include <trace/hooks/syscall_check.h>
39
do_truncate(struct user_namespace * mnt_userns,struct dentry * dentry,loff_t length,unsigned int time_attrs,struct file * filp)40 int do_truncate(struct user_namespace *mnt_userns, struct dentry *dentry,
41 loff_t length, unsigned int time_attrs, struct file *filp)
42 {
43 int ret;
44 struct iattr newattrs;
45
46 /* Not pretty: "inode->i_size" shouldn't really be signed. But it is. */
47 if (length < 0)
48 return -EINVAL;
49
50 newattrs.ia_size = length;
51 newattrs.ia_valid = ATTR_SIZE | time_attrs;
52 if (filp) {
53 newattrs.ia_file = filp;
54 newattrs.ia_valid |= ATTR_FILE;
55 }
56
57 /* Remove suid, sgid, and file capabilities on truncate too */
58 ret = dentry_needs_remove_privs(mnt_userns, dentry);
59 if (ret < 0)
60 return ret;
61 if (ret)
62 newattrs.ia_valid |= ret | ATTR_FORCE;
63
64 inode_lock(dentry->d_inode);
65 /* Note any delegations or leases have already been broken: */
66 ret = notify_change(mnt_userns, dentry, &newattrs, NULL);
67 inode_unlock(dentry->d_inode);
68 return ret;
69 }
70
vfs_truncate(const struct path * path,loff_t length)71 long vfs_truncate(const struct path *path, loff_t length)
72 {
73 struct user_namespace *mnt_userns;
74 struct inode *inode;
75 long error;
76
77 inode = path->dentry->d_inode;
78
79 /* For directories it's -EISDIR, for other non-regulars - -EINVAL */
80 if (S_ISDIR(inode->i_mode))
81 return -EISDIR;
82 if (!S_ISREG(inode->i_mode))
83 return -EINVAL;
84
85 error = mnt_want_write(path->mnt);
86 if (error)
87 goto out;
88
89 mnt_userns = mnt_user_ns(path->mnt);
90 error = inode_permission(mnt_userns, inode, MAY_WRITE);
91 if (error)
92 goto mnt_drop_write_and_out;
93
94 error = -EPERM;
95 if (IS_APPEND(inode))
96 goto mnt_drop_write_and_out;
97
98 error = get_write_access(inode);
99 if (error)
100 goto mnt_drop_write_and_out;
101
102 /*
103 * Make sure that there are no leases. get_write_access() protects
104 * against the truncate racing with a lease-granting setlease().
105 */
106 error = break_lease(inode, O_WRONLY);
107 if (error)
108 goto put_write_and_out;
109
110 error = security_path_truncate(path);
111 if (!error)
112 error = do_truncate(mnt_userns, path->dentry, length, 0, NULL);
113
114 put_write_and_out:
115 put_write_access(inode);
116 mnt_drop_write_and_out:
117 mnt_drop_write(path->mnt);
118 out:
119 return error;
120 }
121 EXPORT_SYMBOL_GPL(vfs_truncate);
122
do_sys_truncate(const char __user * pathname,loff_t length)123 long do_sys_truncate(const char __user *pathname, loff_t length)
124 {
125 unsigned int lookup_flags = LOOKUP_FOLLOW;
126 struct path path;
127 int error;
128
129 if (length < 0) /* sorry, but loff_t says... */
130 return -EINVAL;
131
132 retry:
133 error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
134 if (!error) {
135 error = vfs_truncate(&path, length);
136 path_put(&path);
137 }
138 if (retry_estale(error, lookup_flags)) {
139 lookup_flags |= LOOKUP_REVAL;
140 goto retry;
141 }
142 return error;
143 }
144
SYSCALL_DEFINE2(truncate,const char __user *,path,long,length)145 SYSCALL_DEFINE2(truncate, const char __user *, path, long, length)
146 {
147 return do_sys_truncate(path, length);
148 }
149
150 #ifdef CONFIG_COMPAT
COMPAT_SYSCALL_DEFINE2(truncate,const char __user *,path,compat_off_t,length)151 COMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path, compat_off_t, length)
152 {
153 return do_sys_truncate(path, length);
154 }
155 #endif
156
do_sys_ftruncate(unsigned int fd,loff_t length,int small)157 long do_sys_ftruncate(unsigned int fd, loff_t length, int small)
158 {
159 struct inode *inode;
160 struct dentry *dentry;
161 struct fd f;
162 int error;
163
164 error = -EINVAL;
165 if (length < 0)
166 goto out;
167 error = -EBADF;
168 f = fdget(fd);
169 if (!f.file)
170 goto out;
171
172 /* explicitly opened as large or we are on 64-bit box */
173 if (f.file->f_flags & O_LARGEFILE)
174 small = 0;
175
176 dentry = f.file->f_path.dentry;
177 inode = dentry->d_inode;
178 error = -EINVAL;
179 if (!S_ISREG(inode->i_mode) || !(f.file->f_mode & FMODE_WRITE))
180 goto out_putf;
181
182 error = -EINVAL;
183 /* Cannot ftruncate over 2^31 bytes without large file support */
184 if (small && length > MAX_NON_LFS)
185 goto out_putf;
186
187 error = -EPERM;
188 /* Check IS_APPEND on real upper inode */
189 if (IS_APPEND(file_inode(f.file)))
190 goto out_putf;
191 sb_start_write(inode->i_sb);
192 error = security_path_truncate(&f.file->f_path);
193 if (!error)
194 error = do_truncate(file_mnt_user_ns(f.file), dentry, length,
195 ATTR_MTIME | ATTR_CTIME, f.file);
196 sb_end_write(inode->i_sb);
197 out_putf:
198 fdput(f);
199 out:
200 return error;
201 }
202
SYSCALL_DEFINE2(ftruncate,unsigned int,fd,unsigned long,length)203 SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length)
204 {
205 return do_sys_ftruncate(fd, length, 1);
206 }
207
208 #ifdef CONFIG_COMPAT
COMPAT_SYSCALL_DEFINE2(ftruncate,unsigned int,fd,compat_ulong_t,length)209 COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_ulong_t, length)
210 {
211 return do_sys_ftruncate(fd, length, 1);
212 }
213 #endif
214
215 /* LFS versions of truncate are only needed on 32 bit machines */
216 #if BITS_PER_LONG == 32
SYSCALL_DEFINE2(truncate64,const char __user *,path,loff_t,length)217 SYSCALL_DEFINE2(truncate64, const char __user *, path, loff_t, length)
218 {
219 return do_sys_truncate(path, length);
220 }
221
SYSCALL_DEFINE2(ftruncate64,unsigned int,fd,loff_t,length)222 SYSCALL_DEFINE2(ftruncate64, unsigned int, fd, loff_t, length)
223 {
224 return do_sys_ftruncate(fd, length, 0);
225 }
226 #endif /* BITS_PER_LONG == 32 */
227
228 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_TRUNCATE64)
COMPAT_SYSCALL_DEFINE3(truncate64,const char __user *,pathname,compat_arg_u64_dual (length))229 COMPAT_SYSCALL_DEFINE3(truncate64, const char __user *, pathname,
230 compat_arg_u64_dual(length))
231 {
232 return ksys_truncate(pathname, compat_arg_u64_glue(length));
233 }
234 #endif
235
236 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FTRUNCATE64)
COMPAT_SYSCALL_DEFINE3(ftruncate64,unsigned int,fd,compat_arg_u64_dual (length))237 COMPAT_SYSCALL_DEFINE3(ftruncate64, unsigned int, fd,
238 compat_arg_u64_dual(length))
239 {
240 return ksys_ftruncate(fd, compat_arg_u64_glue(length));
241 }
242 #endif
243
vfs_fallocate(struct file * file,int mode,loff_t offset,loff_t len)244 int vfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
245 {
246 struct inode *inode = file_inode(file);
247 long ret;
248
249 if (offset < 0 || len <= 0)
250 return -EINVAL;
251
252 /* Return error if mode is not supported */
253 if (mode & ~FALLOC_FL_SUPPORTED_MASK)
254 return -EOPNOTSUPP;
255
256 /* Punch hole and zero range are mutually exclusive */
257 if ((mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE)) ==
258 (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE))
259 return -EOPNOTSUPP;
260
261 /* Punch hole must have keep size set */
262 if ((mode & FALLOC_FL_PUNCH_HOLE) &&
263 !(mode & FALLOC_FL_KEEP_SIZE))
264 return -EOPNOTSUPP;
265
266 /* Collapse range should only be used exclusively. */
267 if ((mode & FALLOC_FL_COLLAPSE_RANGE) &&
268 (mode & ~FALLOC_FL_COLLAPSE_RANGE))
269 return -EINVAL;
270
271 /* Insert range should only be used exclusively. */
272 if ((mode & FALLOC_FL_INSERT_RANGE) &&
273 (mode & ~FALLOC_FL_INSERT_RANGE))
274 return -EINVAL;
275
276 /* Unshare range should only be used with allocate mode. */
277 if ((mode & FALLOC_FL_UNSHARE_RANGE) &&
278 (mode & ~(FALLOC_FL_UNSHARE_RANGE | FALLOC_FL_KEEP_SIZE)))
279 return -EINVAL;
280
281 if (!(file->f_mode & FMODE_WRITE))
282 return -EBADF;
283
284 /*
285 * We can only allow pure fallocate on append only files
286 */
287 if ((mode & ~FALLOC_FL_KEEP_SIZE) && IS_APPEND(inode))
288 return -EPERM;
289
290 if (IS_IMMUTABLE(inode))
291 return -EPERM;
292
293 /*
294 * We cannot allow any fallocate operation on an active swapfile
295 */
296 if (IS_SWAPFILE(inode))
297 return -ETXTBSY;
298
299 /*
300 * Revalidate the write permissions, in case security policy has
301 * changed since the files were opened.
302 */
303 ret = security_file_permission(file, MAY_WRITE);
304 if (ret)
305 return ret;
306
307 if (S_ISFIFO(inode->i_mode))
308 return -ESPIPE;
309
310 if (S_ISDIR(inode->i_mode))
311 return -EISDIR;
312
313 if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
314 return -ENODEV;
315
316 /* Check for wrap through zero too */
317 if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0))
318 return -EFBIG;
319
320 if (!file->f_op->fallocate)
321 return -EOPNOTSUPP;
322
323 file_start_write(file);
324 ret = file->f_op->fallocate(file, mode, offset, len);
325
326 /*
327 * Create inotify and fanotify events.
328 *
329 * To keep the logic simple always create events if fallocate succeeds.
330 * This implies that events are even created if the file size remains
331 * unchanged, e.g. when using flag FALLOC_FL_KEEP_SIZE.
332 */
333 if (ret == 0)
334 fsnotify_modify(file);
335
336 file_end_write(file);
337 return ret;
338 }
339 EXPORT_SYMBOL_GPL(vfs_fallocate);
340
ksys_fallocate(int fd,int mode,loff_t offset,loff_t len)341 int ksys_fallocate(int fd, int mode, loff_t offset, loff_t len)
342 {
343 struct fd f = fdget(fd);
344 int error = -EBADF;
345
346 if (f.file) {
347 error = vfs_fallocate(f.file, mode, offset, len);
348 fdput(f);
349 }
350 return error;
351 }
352
SYSCALL_DEFINE4(fallocate,int,fd,int,mode,loff_t,offset,loff_t,len)353 SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len)
354 {
355 return ksys_fallocate(fd, mode, offset, len);
356 }
357
358 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FALLOCATE)
COMPAT_SYSCALL_DEFINE6(fallocate,int,fd,int,mode,compat_arg_u64_dual (offset),compat_arg_u64_dual (len))359 COMPAT_SYSCALL_DEFINE6(fallocate, int, fd, int, mode, compat_arg_u64_dual(offset),
360 compat_arg_u64_dual(len))
361 {
362 return ksys_fallocate(fd, mode, compat_arg_u64_glue(offset),
363 compat_arg_u64_glue(len));
364 }
365 #endif
366
367 /*
368 * access() needs to use the real uid/gid, not the effective uid/gid.
369 * We do this by temporarily clearing all FS-related capabilities and
370 * switching the fsuid/fsgid around to the real ones.
371 */
access_override_creds(void)372 static const struct cred *access_override_creds(void)
373 {
374 const struct cred *old_cred;
375 struct cred *override_cred;
376
377 override_cred = prepare_creds();
378 if (!override_cred)
379 return NULL;
380
381 override_cred->fsuid = override_cred->uid;
382 override_cred->fsgid = override_cred->gid;
383
384 if (!issecure(SECURE_NO_SETUID_FIXUP)) {
385 /* Clear the capabilities if we switch to a non-root user */
386 kuid_t root_uid = make_kuid(override_cred->user_ns, 0);
387 if (!uid_eq(override_cred->uid, root_uid))
388 cap_clear(override_cred->cap_effective);
389 else
390 override_cred->cap_effective =
391 override_cred->cap_permitted;
392 }
393
394 /*
395 * The new set of credentials can *only* be used in
396 * task-synchronous circumstances, and does not need
397 * RCU freeing, unless somebody then takes a separate
398 * reference to it.
399 *
400 * NOTE! This is _only_ true because this credential
401 * is used purely for override_creds() that installs
402 * it as the subjective cred. Other threads will be
403 * accessing ->real_cred, not the subjective cred.
404 *
405 * If somebody _does_ make a copy of this (using the
406 * 'get_current_cred()' function), that will clear the
407 * non_rcu field, because now that other user may be
408 * expecting RCU freeing. But normal thread-synchronous
409 * cred accesses will keep things non-RCY.
410 */
411 override_cred->non_rcu = 1;
412
413 old_cred = override_creds(override_cred);
414
415 /* override_cred() gets its own ref */
416 put_cred(override_cred);
417
418 return old_cred;
419 }
420
do_faccessat(int dfd,const char __user * filename,int mode,int flags)421 static long do_faccessat(int dfd, const char __user *filename, int mode, int flags)
422 {
423 struct path path;
424 struct inode *inode;
425 int res;
426 unsigned int lookup_flags = LOOKUP_FOLLOW;
427 const struct cred *old_cred = NULL;
428
429 if (mode & ~S_IRWXO) /* where's F_OK, X_OK, W_OK, R_OK? */
430 return -EINVAL;
431
432 if (flags & ~(AT_EACCESS | AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH))
433 return -EINVAL;
434
435 if (flags & AT_SYMLINK_NOFOLLOW)
436 lookup_flags &= ~LOOKUP_FOLLOW;
437 if (flags & AT_EMPTY_PATH)
438 lookup_flags |= LOOKUP_EMPTY;
439
440 if (!(flags & AT_EACCESS)) {
441 old_cred = access_override_creds();
442 if (!old_cred)
443 return -ENOMEM;
444 }
445
446 retry:
447 res = user_path_at(dfd, filename, lookup_flags, &path);
448 if (res)
449 goto out;
450
451 inode = d_backing_inode(path.dentry);
452
453 if ((mode & MAY_EXEC) && S_ISREG(inode->i_mode)) {
454 /*
455 * MAY_EXEC on regular files is denied if the fs is mounted
456 * with the "noexec" flag.
457 */
458 res = -EACCES;
459 if (path_noexec(&path))
460 goto out_path_release;
461 }
462
463 res = inode_permission(mnt_user_ns(path.mnt), inode, mode | MAY_ACCESS);
464 /* SuS v2 requires we report a read only fs too */
465 if (res || !(mode & S_IWOTH) || special_file(inode->i_mode))
466 goto out_path_release;
467 /*
468 * This is a rare case where using __mnt_is_readonly()
469 * is OK without a mnt_want/drop_write() pair. Since
470 * no actual write to the fs is performed here, we do
471 * not need to telegraph to that to anyone.
472 *
473 * By doing this, we accept that this access is
474 * inherently racy and know that the fs may change
475 * state before we even see this result.
476 */
477 if (__mnt_is_readonly(path.mnt))
478 res = -EROFS;
479
480 out_path_release:
481 path_put(&path);
482 if (retry_estale(res, lookup_flags)) {
483 lookup_flags |= LOOKUP_REVAL;
484 goto retry;
485 }
486 out:
487 if (old_cred)
488 revert_creds(old_cred);
489
490 return res;
491 }
492
SYSCALL_DEFINE3(faccessat,int,dfd,const char __user *,filename,int,mode)493 SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
494 {
495 return do_faccessat(dfd, filename, mode, 0);
496 }
497
SYSCALL_DEFINE4(faccessat2,int,dfd,const char __user *,filename,int,mode,int,flags)498 SYSCALL_DEFINE4(faccessat2, int, dfd, const char __user *, filename, int, mode,
499 int, flags)
500 {
501 return do_faccessat(dfd, filename, mode, flags);
502 }
503
SYSCALL_DEFINE2(access,const char __user *,filename,int,mode)504 SYSCALL_DEFINE2(access, const char __user *, filename, int, mode)
505 {
506 return do_faccessat(AT_FDCWD, filename, mode, 0);
507 }
508
SYSCALL_DEFINE1(chdir,const char __user *,filename)509 SYSCALL_DEFINE1(chdir, const char __user *, filename)
510 {
511 struct path path;
512 int error;
513 unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
514 retry:
515 error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
516 if (error)
517 goto out;
518
519 error = path_permission(&path, MAY_EXEC | MAY_CHDIR);
520 if (error)
521 goto dput_and_out;
522
523 set_fs_pwd(current->fs, &path);
524
525 dput_and_out:
526 path_put(&path);
527 if (retry_estale(error, lookup_flags)) {
528 lookup_flags |= LOOKUP_REVAL;
529 goto retry;
530 }
531 out:
532 return error;
533 }
534
SYSCALL_DEFINE1(fchdir,unsigned int,fd)535 SYSCALL_DEFINE1(fchdir, unsigned int, fd)
536 {
537 struct fd f = fdget_raw(fd);
538 int error;
539
540 error = -EBADF;
541 if (!f.file)
542 goto out;
543
544 error = -ENOTDIR;
545 if (!d_can_lookup(f.file->f_path.dentry))
546 goto out_putf;
547
548 error = file_permission(f.file, MAY_EXEC | MAY_CHDIR);
549 if (!error)
550 set_fs_pwd(current->fs, &f.file->f_path);
551 out_putf:
552 fdput(f);
553 out:
554 return error;
555 }
556
SYSCALL_DEFINE1(chroot,const char __user *,filename)557 SYSCALL_DEFINE1(chroot, const char __user *, filename)
558 {
559 struct path path;
560 int error;
561 unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
562 retry:
563 error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
564 if (error)
565 goto out;
566
567 error = path_permission(&path, MAY_EXEC | MAY_CHDIR);
568 if (error)
569 goto dput_and_out;
570
571 error = -EPERM;
572 if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT))
573 goto dput_and_out;
574 error = security_path_chroot(&path);
575 if (error)
576 goto dput_and_out;
577
578 set_fs_root(current->fs, &path);
579 error = 0;
580 dput_and_out:
581 path_put(&path);
582 if (retry_estale(error, lookup_flags)) {
583 lookup_flags |= LOOKUP_REVAL;
584 goto retry;
585 }
586 out:
587 return error;
588 }
589
chmod_common(const struct path * path,umode_t mode)590 int chmod_common(const struct path *path, umode_t mode)
591 {
592 struct inode *inode = path->dentry->d_inode;
593 struct inode *delegated_inode = NULL;
594 struct iattr newattrs;
595 int error;
596
597 error = mnt_want_write(path->mnt);
598 if (error)
599 return error;
600 retry_deleg:
601 inode_lock(inode);
602 error = security_path_chmod(path, mode);
603 if (error)
604 goto out_unlock;
605 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
606 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
607 error = notify_change(mnt_user_ns(path->mnt), path->dentry,
608 &newattrs, &delegated_inode);
609 out_unlock:
610 inode_unlock(inode);
611 if (delegated_inode) {
612 error = break_deleg_wait(&delegated_inode);
613 if (!error)
614 goto retry_deleg;
615 }
616 mnt_drop_write(path->mnt);
617 return error;
618 }
619
vfs_fchmod(struct file * file,umode_t mode)620 int vfs_fchmod(struct file *file, umode_t mode)
621 {
622 audit_file(file);
623 return chmod_common(&file->f_path, mode);
624 }
625
SYSCALL_DEFINE2(fchmod,unsigned int,fd,umode_t,mode)626 SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode)
627 {
628 struct fd f = fdget(fd);
629 int err = -EBADF;
630
631 if (f.file) {
632 err = vfs_fchmod(f.file, mode);
633 fdput(f);
634 }
635 return err;
636 }
637
do_fchmodat(int dfd,const char __user * filename,umode_t mode)638 static int do_fchmodat(int dfd, const char __user *filename, umode_t mode)
639 {
640 struct path path;
641 int error;
642 unsigned int lookup_flags = LOOKUP_FOLLOW;
643 retry:
644 error = user_path_at(dfd, filename, lookup_flags, &path);
645 if (!error) {
646 error = chmod_common(&path, mode);
647 path_put(&path);
648 if (retry_estale(error, lookup_flags)) {
649 lookup_flags |= LOOKUP_REVAL;
650 goto retry;
651 }
652 }
653 return error;
654 }
655
SYSCALL_DEFINE3(fchmodat,int,dfd,const char __user *,filename,umode_t,mode)656 SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename,
657 umode_t, mode)
658 {
659 return do_fchmodat(dfd, filename, mode);
660 }
661
SYSCALL_DEFINE2(chmod,const char __user *,filename,umode_t,mode)662 SYSCALL_DEFINE2(chmod, const char __user *, filename, umode_t, mode)
663 {
664 return do_fchmodat(AT_FDCWD, filename, mode);
665 }
666
667 /**
668 * setattr_vfsuid - check and set ia_fsuid attribute
669 * @kuid: new inode owner
670 *
671 * Check whether @kuid is valid and if so generate and set vfsuid_t in
672 * ia_vfsuid.
673 *
674 * Return: true if @kuid is valid, false if not.
675 */
setattr_vfsuid(struct iattr * attr,kuid_t kuid)676 static inline bool setattr_vfsuid(struct iattr *attr, kuid_t kuid)
677 {
678 if (!uid_valid(kuid))
679 return false;
680 attr->ia_valid |= ATTR_UID;
681 attr->ia_vfsuid = VFSUIDT_INIT(kuid);
682 return true;
683 }
684
685 /**
686 * setattr_vfsgid - check and set ia_fsgid attribute
687 * @kgid: new inode owner
688 *
689 * Check whether @kgid is valid and if so generate and set vfsgid_t in
690 * ia_vfsgid.
691 *
692 * Return: true if @kgid is valid, false if not.
693 */
setattr_vfsgid(struct iattr * attr,kgid_t kgid)694 static inline bool setattr_vfsgid(struct iattr *attr, kgid_t kgid)
695 {
696 if (!gid_valid(kgid))
697 return false;
698 attr->ia_valid |= ATTR_GID;
699 attr->ia_vfsgid = VFSGIDT_INIT(kgid);
700 return true;
701 }
702
chown_common(const struct path * path,uid_t user,gid_t group)703 int chown_common(const struct path *path, uid_t user, gid_t group)
704 {
705 struct user_namespace *mnt_userns, *fs_userns;
706 struct inode *inode = path->dentry->d_inode;
707 struct inode *delegated_inode = NULL;
708 int error;
709 struct iattr newattrs;
710 kuid_t uid;
711 kgid_t gid;
712
713 uid = make_kuid(current_user_ns(), user);
714 gid = make_kgid(current_user_ns(), group);
715
716 mnt_userns = mnt_user_ns(path->mnt);
717 fs_userns = i_user_ns(inode);
718
719 retry_deleg:
720 newattrs.ia_vfsuid = INVALID_VFSUID;
721 newattrs.ia_vfsgid = INVALID_VFSGID;
722 newattrs.ia_valid = ATTR_CTIME;
723 if ((user != (uid_t)-1) && !setattr_vfsuid(&newattrs, uid))
724 return -EINVAL;
725 if ((group != (gid_t)-1) && !setattr_vfsgid(&newattrs, gid))
726 return -EINVAL;
727 inode_lock(inode);
728 if (!S_ISDIR(inode->i_mode))
729 newattrs.ia_valid |= ATTR_KILL_SUID | ATTR_KILL_PRIV |
730 setattr_should_drop_sgid(mnt_userns, inode);
731 /* Continue to send actual fs values, not the mount values. */
732 error = security_path_chown(
733 path,
734 from_vfsuid(mnt_userns, fs_userns, newattrs.ia_vfsuid),
735 from_vfsgid(mnt_userns, fs_userns, newattrs.ia_vfsgid));
736 if (!error)
737 error = notify_change(mnt_userns, path->dentry, &newattrs,
738 &delegated_inode);
739 inode_unlock(inode);
740 if (delegated_inode) {
741 error = break_deleg_wait(&delegated_inode);
742 if (!error)
743 goto retry_deleg;
744 }
745 return error;
746 }
747
do_fchownat(int dfd,const char __user * filename,uid_t user,gid_t group,int flag)748 int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group,
749 int flag)
750 {
751 struct path path;
752 int error = -EINVAL;
753 int lookup_flags;
754
755 if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
756 goto out;
757
758 lookup_flags = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW;
759 if (flag & AT_EMPTY_PATH)
760 lookup_flags |= LOOKUP_EMPTY;
761 retry:
762 error = user_path_at(dfd, filename, lookup_flags, &path);
763 if (error)
764 goto out;
765 error = mnt_want_write(path.mnt);
766 if (error)
767 goto out_release;
768 error = chown_common(&path, user, group);
769 mnt_drop_write(path.mnt);
770 out_release:
771 path_put(&path);
772 if (retry_estale(error, lookup_flags)) {
773 lookup_flags |= LOOKUP_REVAL;
774 goto retry;
775 }
776 out:
777 return error;
778 }
779
SYSCALL_DEFINE5(fchownat,int,dfd,const char __user *,filename,uid_t,user,gid_t,group,int,flag)780 SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
781 gid_t, group, int, flag)
782 {
783 return do_fchownat(dfd, filename, user, group, flag);
784 }
785
SYSCALL_DEFINE3(chown,const char __user *,filename,uid_t,user,gid_t,group)786 SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
787 {
788 return do_fchownat(AT_FDCWD, filename, user, group, 0);
789 }
790
SYSCALL_DEFINE3(lchown,const char __user *,filename,uid_t,user,gid_t,group)791 SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group)
792 {
793 return do_fchownat(AT_FDCWD, filename, user, group,
794 AT_SYMLINK_NOFOLLOW);
795 }
796
vfs_fchown(struct file * file,uid_t user,gid_t group)797 int vfs_fchown(struct file *file, uid_t user, gid_t group)
798 {
799 int error;
800
801 error = mnt_want_write_file(file);
802 if (error)
803 return error;
804 audit_file(file);
805 error = chown_common(&file->f_path, user, group);
806 mnt_drop_write_file(file);
807 return error;
808 }
809
ksys_fchown(unsigned int fd,uid_t user,gid_t group)810 int ksys_fchown(unsigned int fd, uid_t user, gid_t group)
811 {
812 struct fd f = fdget(fd);
813 int error = -EBADF;
814
815 if (f.file) {
816 error = vfs_fchown(f.file, user, group);
817 fdput(f);
818 }
819 return error;
820 }
821
SYSCALL_DEFINE3(fchown,unsigned int,fd,uid_t,user,gid_t,group)822 SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
823 {
824 return ksys_fchown(fd, user, group);
825 }
826
do_dentry_open(struct file * f,struct inode * inode,int (* open)(struct inode *,struct file *))827 static int do_dentry_open(struct file *f,
828 struct inode *inode,
829 int (*open)(struct inode *, struct file *))
830 {
831 static const struct file_operations empty_fops = {};
832 int error;
833
834 path_get(&f->f_path);
835 f->f_inode = inode;
836 f->f_mapping = inode->i_mapping;
837 f->f_wb_err = filemap_sample_wb_err(f->f_mapping);
838 f->f_sb_err = file_sample_sb_err(f);
839
840 if (unlikely(f->f_flags & O_PATH)) {
841 f->f_mode = FMODE_PATH | FMODE_OPENED;
842 f->f_op = &empty_fops;
843 return 0;
844 }
845
846 if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) {
847 i_readcount_inc(inode);
848 } else if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
849 error = get_write_access(inode);
850 if (unlikely(error))
851 goto cleanup_file;
852 error = __mnt_want_write(f->f_path.mnt);
853 if (unlikely(error)) {
854 put_write_access(inode);
855 goto cleanup_file;
856 }
857 f->f_mode |= FMODE_WRITER;
858 }
859
860 /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */
861 if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode))
862 f->f_mode |= FMODE_ATOMIC_POS;
863
864 f->f_op = fops_get(inode->i_fop);
865 if (WARN_ON(!f->f_op)) {
866 error = -ENODEV;
867 goto cleanup_all;
868 }
869 trace_android_vh_check_file_open(f);
870
871 error = security_file_open(f);
872 if (error)
873 goto cleanup_all;
874
875 error = break_lease(locks_inode(f), f->f_flags);
876 if (error)
877 goto cleanup_all;
878
879 /* normally all 3 are set; ->open() can clear them if needed */
880 f->f_mode |= FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE;
881 if (!open)
882 open = f->f_op->open;
883 if (open) {
884 error = open(inode, f);
885 if (error)
886 goto cleanup_all;
887 }
888 f->f_mode |= FMODE_OPENED;
889 if ((f->f_mode & FMODE_READ) &&
890 likely(f->f_op->read || f->f_op->read_iter))
891 f->f_mode |= FMODE_CAN_READ;
892 if ((f->f_mode & FMODE_WRITE) &&
893 likely(f->f_op->write || f->f_op->write_iter))
894 f->f_mode |= FMODE_CAN_WRITE;
895 if ((f->f_mode & FMODE_LSEEK) && !f->f_op->llseek)
896 f->f_mode &= ~FMODE_LSEEK;
897 if (f->f_mapping->a_ops && f->f_mapping->a_ops->direct_IO)
898 f->f_mode |= FMODE_CAN_ODIRECT;
899
900 f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC);
901 f->f_iocb_flags = iocb_flags(f);
902
903 file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping);
904
905 if ((f->f_flags & O_DIRECT) && !(f->f_mode & FMODE_CAN_ODIRECT))
906 return -EINVAL;
907
908 /*
909 * XXX: Huge page cache doesn't support writing yet. Drop all page
910 * cache for this file before processing writes.
911 */
912 if (f->f_mode & FMODE_WRITE) {
913 /*
914 * Paired with smp_mb() in collapse_file() to ensure nr_thps
915 * is up to date and the update to i_writecount by
916 * get_write_access() is visible. Ensures subsequent insertion
917 * of THPs into the page cache will fail.
918 */
919 smp_mb();
920 if (filemap_nr_thps(inode->i_mapping)) {
921 struct address_space *mapping = inode->i_mapping;
922
923 filemap_invalidate_lock(inode->i_mapping);
924 /*
925 * unmap_mapping_range just need to be called once
926 * here, because the private pages is not need to be
927 * unmapped mapping (e.g. data segment of dynamic
928 * shared libraries here).
929 */
930 unmap_mapping_range(mapping, 0, 0, 0);
931 truncate_inode_pages(mapping, 0);
932 filemap_invalidate_unlock(inode->i_mapping);
933 }
934 }
935
936 return 0;
937
938 cleanup_all:
939 if (WARN_ON_ONCE(error > 0))
940 error = -EINVAL;
941 fops_put(f->f_op);
942 put_file_access(f);
943 cleanup_file:
944 path_put(&f->f_path);
945 f->f_path.mnt = NULL;
946 f->f_path.dentry = NULL;
947 f->f_inode = NULL;
948 return error;
949 }
950
951 /**
952 * finish_open - finish opening a file
953 * @file: file pointer
954 * @dentry: pointer to dentry
955 * @open: open callback
956 * @opened: state of open
957 *
958 * This can be used to finish opening a file passed to i_op->atomic_open().
959 *
960 * If the open callback is set to NULL, then the standard f_op->open()
961 * filesystem callback is substituted.
962 *
963 * NB: the dentry reference is _not_ consumed. If, for example, the dentry is
964 * the return value of d_splice_alias(), then the caller needs to perform dput()
965 * on it after finish_open().
966 *
967 * Returns zero on success or -errno if the open failed.
968 */
finish_open(struct file * file,struct dentry * dentry,int (* open)(struct inode *,struct file *))969 int finish_open(struct file *file, struct dentry *dentry,
970 int (*open)(struct inode *, struct file *))
971 {
972 BUG_ON(file->f_mode & FMODE_OPENED); /* once it's opened, it's opened */
973
974 file->f_path.dentry = dentry;
975 return do_dentry_open(file, d_backing_inode(dentry), open);
976 }
977 EXPORT_SYMBOL(finish_open);
978
979 /**
980 * finish_no_open - finish ->atomic_open() without opening the file
981 *
982 * @file: file pointer
983 * @dentry: dentry or NULL (as returned from ->lookup())
984 *
985 * This can be used to set the result of a successful lookup in ->atomic_open().
986 *
987 * NB: unlike finish_open() this function does consume the dentry reference and
988 * the caller need not dput() it.
989 *
990 * Returns "0" which must be the return value of ->atomic_open() after having
991 * called this function.
992 */
finish_no_open(struct file * file,struct dentry * dentry)993 int finish_no_open(struct file *file, struct dentry *dentry)
994 {
995 file->f_path.dentry = dentry;
996 return 0;
997 }
998 EXPORT_SYMBOL(finish_no_open);
999
file_path(struct file * filp,char * buf,int buflen)1000 char *file_path(struct file *filp, char *buf, int buflen)
1001 {
1002 return d_path(&filp->f_path, buf, buflen);
1003 }
1004 EXPORT_SYMBOL(file_path);
1005
1006 /**
1007 * vfs_open - open the file at the given path
1008 * @path: path to open
1009 * @file: newly allocated file with f_flag initialized
1010 * @cred: credentials to use
1011 */
vfs_open(const struct path * path,struct file * file)1012 int vfs_open(const struct path *path, struct file *file)
1013 {
1014 file->f_path = *path;
1015 return do_dentry_open(file, d_backing_inode(path->dentry), NULL);
1016 }
1017
dentry_open(const struct path * path,int flags,const struct cred * cred)1018 struct file *dentry_open(const struct path *path, int flags,
1019 const struct cred *cred)
1020 {
1021 int error;
1022 struct file *f;
1023
1024 validate_creds(cred);
1025
1026 /* We must always pass in a valid mount pointer. */
1027 BUG_ON(!path->mnt);
1028
1029 f = alloc_empty_file(flags, cred);
1030 if (!IS_ERR(f)) {
1031 error = vfs_open(path, f);
1032 if (error) {
1033 fput(f);
1034 f = ERR_PTR(error);
1035 }
1036 }
1037 return f;
1038 }
1039 EXPORT_SYMBOL(dentry_open);
1040
1041 /**
1042 * dentry_create - Create and open a file
1043 * @path: path to create
1044 * @flags: O_ flags
1045 * @mode: mode bits for new file
1046 * @cred: credentials to use
1047 *
1048 * Caller must hold the parent directory's lock, and have prepared
1049 * a negative dentry, placed in @path->dentry, for the new file.
1050 *
1051 * Caller sets @path->mnt to the vfsmount of the filesystem where
1052 * the new file is to be created. The parent directory and the
1053 * negative dentry must reside on the same filesystem instance.
1054 *
1055 * On success, returns a "struct file *". Otherwise a ERR_PTR
1056 * is returned.
1057 */
dentry_create(const struct path * path,int flags,umode_t mode,const struct cred * cred)1058 struct file *dentry_create(const struct path *path, int flags, umode_t mode,
1059 const struct cred *cred)
1060 {
1061 struct file *f;
1062 int error;
1063
1064 validate_creds(cred);
1065 f = alloc_empty_file(flags, cred);
1066 if (IS_ERR(f))
1067 return f;
1068
1069 error = vfs_create(mnt_user_ns(path->mnt),
1070 d_inode(path->dentry->d_parent),
1071 path->dentry, mode, true);
1072 if (!error)
1073 error = vfs_open(path, f);
1074
1075 if (unlikely(error)) {
1076 fput(f);
1077 return ERR_PTR(error);
1078 }
1079 return f;
1080 }
1081 EXPORT_SYMBOL(dentry_create);
1082
open_with_fake_path(const struct path * path,int flags,struct inode * inode,const struct cred * cred)1083 struct file *open_with_fake_path(const struct path *path, int flags,
1084 struct inode *inode, const struct cred *cred)
1085 {
1086 struct file *f = alloc_empty_file_noaccount(flags, cred);
1087 if (!IS_ERR(f)) {
1088 int error;
1089
1090 f->f_path = *path;
1091 error = do_dentry_open(f, inode, NULL);
1092 if (error) {
1093 fput(f);
1094 f = ERR_PTR(error);
1095 }
1096 }
1097 return f;
1098 }
1099 EXPORT_SYMBOL(open_with_fake_path);
1100
1101 #define WILL_CREATE(flags) (flags & (O_CREAT | __O_TMPFILE))
1102 #define O_PATH_FLAGS (O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC)
1103
build_open_how(int flags,umode_t mode)1104 inline struct open_how build_open_how(int flags, umode_t mode)
1105 {
1106 struct open_how how = {
1107 .flags = flags & VALID_OPEN_FLAGS,
1108 .mode = mode & S_IALLUGO,
1109 };
1110
1111 /* O_PATH beats everything else. */
1112 if (how.flags & O_PATH)
1113 how.flags &= O_PATH_FLAGS;
1114 /* Modes should only be set for create-like flags. */
1115 if (!WILL_CREATE(how.flags))
1116 how.mode = 0;
1117 return how;
1118 }
1119
build_open_flags(const struct open_how * how,struct open_flags * op)1120 inline int build_open_flags(const struct open_how *how, struct open_flags *op)
1121 {
1122 u64 flags = how->flags;
1123 u64 strip = FMODE_NONOTIFY | O_CLOEXEC;
1124 int lookup_flags = 0;
1125 int acc_mode = ACC_MODE(flags);
1126
1127 BUILD_BUG_ON_MSG(upper_32_bits(VALID_OPEN_FLAGS),
1128 "struct open_flags doesn't yet handle flags > 32 bits");
1129
1130 /*
1131 * Strip flags that either shouldn't be set by userspace like
1132 * FMODE_NONOTIFY or that aren't relevant in determining struct
1133 * open_flags like O_CLOEXEC.
1134 */
1135 flags &= ~strip;
1136
1137 /*
1138 * Older syscalls implicitly clear all of the invalid flags or argument
1139 * values before calling build_open_flags(), but openat2(2) checks all
1140 * of its arguments.
1141 */
1142 if (flags & ~VALID_OPEN_FLAGS)
1143 return -EINVAL;
1144 if (how->resolve & ~VALID_RESOLVE_FLAGS)
1145 return -EINVAL;
1146
1147 /* Scoping flags are mutually exclusive. */
1148 if ((how->resolve & RESOLVE_BENEATH) && (how->resolve & RESOLVE_IN_ROOT))
1149 return -EINVAL;
1150
1151 /* Deal with the mode. */
1152 if (WILL_CREATE(flags)) {
1153 if (how->mode & ~S_IALLUGO)
1154 return -EINVAL;
1155 op->mode = how->mode | S_IFREG;
1156 } else {
1157 if (how->mode != 0)
1158 return -EINVAL;
1159 op->mode = 0;
1160 }
1161
1162 /*
1163 * Block bugs where O_DIRECTORY | O_CREAT created regular files.
1164 * Note, that blocking O_DIRECTORY | O_CREAT here also protects
1165 * O_TMPFILE below which requires O_DIRECTORY being raised.
1166 */
1167 if ((flags & (O_DIRECTORY | O_CREAT)) == (O_DIRECTORY | O_CREAT))
1168 return -EINVAL;
1169
1170 /* Now handle the creative implementation of O_TMPFILE. */
1171 if (flags & __O_TMPFILE) {
1172 /*
1173 * In order to ensure programs get explicit errors when trying
1174 * to use O_TMPFILE on old kernels we enforce that O_DIRECTORY
1175 * is raised alongside __O_TMPFILE.
1176 */
1177 if (!(flags & O_DIRECTORY))
1178 return -EINVAL;
1179 if (!(acc_mode & MAY_WRITE))
1180 return -EINVAL;
1181 }
1182 if (flags & O_PATH) {
1183 /* O_PATH only permits certain other flags to be set. */
1184 if (flags & ~O_PATH_FLAGS)
1185 return -EINVAL;
1186 acc_mode = 0;
1187 }
1188
1189 /*
1190 * O_SYNC is implemented as __O_SYNC|O_DSYNC. As many places only
1191 * check for O_DSYNC if the need any syncing at all we enforce it's
1192 * always set instead of having to deal with possibly weird behaviour
1193 * for malicious applications setting only __O_SYNC.
1194 */
1195 if (flags & __O_SYNC)
1196 flags |= O_DSYNC;
1197
1198 op->open_flag = flags;
1199
1200 /* O_TRUNC implies we need access checks for write permissions */
1201 if (flags & O_TRUNC)
1202 acc_mode |= MAY_WRITE;
1203
1204 /* Allow the LSM permission hook to distinguish append
1205 access from general write access. */
1206 if (flags & O_APPEND)
1207 acc_mode |= MAY_APPEND;
1208
1209 op->acc_mode = acc_mode;
1210
1211 op->intent = flags & O_PATH ? 0 : LOOKUP_OPEN;
1212
1213 if (flags & O_CREAT) {
1214 op->intent |= LOOKUP_CREATE;
1215 if (flags & O_EXCL) {
1216 op->intent |= LOOKUP_EXCL;
1217 flags |= O_NOFOLLOW;
1218 }
1219 }
1220
1221 if (flags & O_DIRECTORY)
1222 lookup_flags |= LOOKUP_DIRECTORY;
1223 if (!(flags & O_NOFOLLOW))
1224 lookup_flags |= LOOKUP_FOLLOW;
1225
1226 if (how->resolve & RESOLVE_NO_XDEV)
1227 lookup_flags |= LOOKUP_NO_XDEV;
1228 if (how->resolve & RESOLVE_NO_MAGICLINKS)
1229 lookup_flags |= LOOKUP_NO_MAGICLINKS;
1230 if (how->resolve & RESOLVE_NO_SYMLINKS)
1231 lookup_flags |= LOOKUP_NO_SYMLINKS;
1232 if (how->resolve & RESOLVE_BENEATH)
1233 lookup_flags |= LOOKUP_BENEATH;
1234 if (how->resolve & RESOLVE_IN_ROOT)
1235 lookup_flags |= LOOKUP_IN_ROOT;
1236 if (how->resolve & RESOLVE_CACHED) {
1237 /* Don't bother even trying for create/truncate/tmpfile open */
1238 if (flags & (O_TRUNC | O_CREAT | __O_TMPFILE))
1239 return -EAGAIN;
1240 lookup_flags |= LOOKUP_CACHED;
1241 }
1242
1243 op->lookup_flags = lookup_flags;
1244 return 0;
1245 }
1246
1247 /**
1248 * file_open_name - open file and return file pointer
1249 *
1250 * @name: struct filename containing path to open
1251 * @flags: open flags as per the open(2) second argument
1252 * @mode: mode for the new file if O_CREAT is set, else ignored
1253 *
1254 * This is the helper to open a file from kernelspace if you really
1255 * have to. But in generally you should not do this, so please move
1256 * along, nothing to see here..
1257 */
file_open_name(struct filename * name,int flags,umode_t mode)1258 struct file *file_open_name(struct filename *name, int flags, umode_t mode)
1259 {
1260 struct open_flags op;
1261 struct open_how how = build_open_how(flags, mode);
1262 int err = build_open_flags(&how, &op);
1263 if (err)
1264 return ERR_PTR(err);
1265 return do_filp_open(AT_FDCWD, name, &op);
1266 }
1267
1268 /**
1269 * filp_open - open file and return file pointer
1270 *
1271 * @filename: path to open
1272 * @flags: open flags as per the open(2) second argument
1273 * @mode: mode for the new file if O_CREAT is set, else ignored
1274 *
1275 * This is the helper to open a file from kernelspace if you really
1276 * have to. But in generally you should not do this, so please move
1277 * along, nothing to see here..
1278 */
filp_open(const char * filename,int flags,umode_t mode)1279 struct file *filp_open(const char *filename, int flags, umode_t mode)
1280 {
1281 struct filename *name = getname_kernel(filename);
1282 struct file *file = ERR_CAST(name);
1283
1284 if (!IS_ERR(name)) {
1285 file = file_open_name(name, flags, mode);
1286 putname(name);
1287 }
1288 return file;
1289 }
1290 EXPORT_SYMBOL(filp_open);
1291
1292
1293 /* ANDROID: Allow drivers to open only block files from kernel mode */
filp_open_block(const char * filename,int flags,umode_t mode)1294 struct file *filp_open_block(const char *filename, int flags, umode_t mode)
1295 {
1296 struct file *file;
1297
1298 file = filp_open(filename, flags, mode);
1299 if (IS_ERR(file))
1300 goto err_out;
1301
1302 /* Drivers should only be allowed to open block devices */
1303 if (!S_ISBLK(file->f_mapping->host->i_mode)) {
1304 filp_close(file, NULL);
1305 file = ERR_PTR(-ENOTBLK);
1306 }
1307
1308 err_out:
1309 return file;
1310 }
1311 EXPORT_SYMBOL_GPL(filp_open_block);
1312
file_open_root(const struct path * root,const char * filename,int flags,umode_t mode)1313 struct file *file_open_root(const struct path *root,
1314 const char *filename, int flags, umode_t mode)
1315 {
1316 struct open_flags op;
1317 struct open_how how = build_open_how(flags, mode);
1318 int err = build_open_flags(&how, &op);
1319 if (err)
1320 return ERR_PTR(err);
1321 return do_file_open_root(root, filename, &op);
1322 }
1323 EXPORT_SYMBOL(file_open_root);
1324
do_sys_openat2(int dfd,const char __user * filename,struct open_how * how)1325 static long do_sys_openat2(int dfd, const char __user *filename,
1326 struct open_how *how)
1327 {
1328 struct open_flags op;
1329 int fd = build_open_flags(how, &op);
1330 struct filename *tmp;
1331
1332 if (fd)
1333 return fd;
1334
1335 tmp = getname(filename);
1336 if (IS_ERR(tmp))
1337 return PTR_ERR(tmp);
1338
1339 fd = get_unused_fd_flags(how->flags);
1340 if (fd >= 0) {
1341 struct file *f = do_filp_open(dfd, tmp, &op);
1342 if (IS_ERR(f)) {
1343 put_unused_fd(fd);
1344 fd = PTR_ERR(f);
1345 } else {
1346 fsnotify_open(f);
1347 fd_install(fd, f);
1348 }
1349 }
1350 putname(tmp);
1351 return fd;
1352 }
1353
do_sys_open(int dfd,const char __user * filename,int flags,umode_t mode)1354 long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
1355 {
1356 struct open_how how = build_open_how(flags, mode);
1357 return do_sys_openat2(dfd, filename, &how);
1358 }
1359
1360
SYSCALL_DEFINE3(open,const char __user *,filename,int,flags,umode_t,mode)1361 SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1362 {
1363 if (force_o_largefile())
1364 flags |= O_LARGEFILE;
1365 return do_sys_open(AT_FDCWD, filename, flags, mode);
1366 }
1367
SYSCALL_DEFINE4(openat,int,dfd,const char __user *,filename,int,flags,umode_t,mode)1368 SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags,
1369 umode_t, mode)
1370 {
1371 if (force_o_largefile())
1372 flags |= O_LARGEFILE;
1373 return do_sys_open(dfd, filename, flags, mode);
1374 }
1375
SYSCALL_DEFINE4(openat2,int,dfd,const char __user *,filename,struct open_how __user *,how,size_t,usize)1376 SYSCALL_DEFINE4(openat2, int, dfd, const char __user *, filename,
1377 struct open_how __user *, how, size_t, usize)
1378 {
1379 int err;
1380 struct open_how tmp;
1381
1382 BUILD_BUG_ON(sizeof(struct open_how) < OPEN_HOW_SIZE_VER0);
1383 BUILD_BUG_ON(sizeof(struct open_how) != OPEN_HOW_SIZE_LATEST);
1384
1385 if (unlikely(usize < OPEN_HOW_SIZE_VER0))
1386 return -EINVAL;
1387
1388 err = copy_struct_from_user(&tmp, sizeof(tmp), how, usize);
1389 if (err)
1390 return err;
1391
1392 audit_openat2_how(&tmp);
1393
1394 /* O_LARGEFILE is only allowed for non-O_PATH. */
1395 if (!(tmp.flags & O_PATH) && force_o_largefile())
1396 tmp.flags |= O_LARGEFILE;
1397
1398 return do_sys_openat2(dfd, filename, &tmp);
1399 }
1400
1401 #ifdef CONFIG_COMPAT
1402 /*
1403 * Exactly like sys_open(), except that it doesn't set the
1404 * O_LARGEFILE flag.
1405 */
COMPAT_SYSCALL_DEFINE3(open,const char __user *,filename,int,flags,umode_t,mode)1406 COMPAT_SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1407 {
1408 return do_sys_open(AT_FDCWD, filename, flags, mode);
1409 }
1410
1411 /*
1412 * Exactly like sys_openat(), except that it doesn't set the
1413 * O_LARGEFILE flag.
1414 */
COMPAT_SYSCALL_DEFINE4(openat,int,dfd,const char __user *,filename,int,flags,umode_t,mode)1415 COMPAT_SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode)
1416 {
1417 return do_sys_open(dfd, filename, flags, mode);
1418 }
1419 #endif
1420
1421 #ifndef __alpha__
1422
1423 /*
1424 * For backward compatibility? Maybe this should be moved
1425 * into arch/i386 instead?
1426 */
SYSCALL_DEFINE2(creat,const char __user *,pathname,umode_t,mode)1427 SYSCALL_DEFINE2(creat, const char __user *, pathname, umode_t, mode)
1428 {
1429 int flags = O_CREAT | O_WRONLY | O_TRUNC;
1430
1431 if (force_o_largefile())
1432 flags |= O_LARGEFILE;
1433 return do_sys_open(AT_FDCWD, pathname, flags, mode);
1434 }
1435 #endif
1436
1437 /*
1438 * "id" is the POSIX thread ID. We use the
1439 * files pointer for this..
1440 */
filp_close(struct file * filp,fl_owner_t id)1441 int filp_close(struct file *filp, fl_owner_t id)
1442 {
1443 int retval = 0;
1444
1445 if (CHECK_DATA_CORRUPTION(file_count(filp) == 0,
1446 "VFS: Close: file count is 0 (f_op=%ps)",
1447 filp->f_op)) {
1448 return 0;
1449 }
1450
1451 if (filp->f_op->flush)
1452 retval = filp->f_op->flush(filp, id);
1453
1454 if (likely(!(filp->f_mode & FMODE_PATH))) {
1455 dnotify_flush(filp, id);
1456 locks_remove_posix(filp, id);
1457 }
1458 fput(filp);
1459 return retval;
1460 }
1461
1462 EXPORT_SYMBOL(filp_close);
1463
1464 /*
1465 * Careful here! We test whether the file pointer is NULL before
1466 * releasing the fd. This ensures that one clone task can't release
1467 * an fd while another clone is opening it.
1468 */
SYSCALL_DEFINE1(close,unsigned int,fd)1469 SYSCALL_DEFINE1(close, unsigned int, fd)
1470 {
1471 int retval = close_fd(fd);
1472
1473 /* can't restart close syscall because file table entry was cleared */
1474 if (unlikely(retval == -ERESTARTSYS ||
1475 retval == -ERESTARTNOINTR ||
1476 retval == -ERESTARTNOHAND ||
1477 retval == -ERESTART_RESTARTBLOCK))
1478 retval = -EINTR;
1479
1480 return retval;
1481 }
1482
1483 /**
1484 * close_range() - Close all file descriptors in a given range.
1485 *
1486 * @fd: starting file descriptor to close
1487 * @max_fd: last file descriptor to close
1488 * @flags: reserved for future extensions
1489 *
1490 * This closes a range of file descriptors. All file descriptors
1491 * from @fd up to and including @max_fd are closed.
1492 * Currently, errors to close a given file descriptor are ignored.
1493 */
SYSCALL_DEFINE3(close_range,unsigned int,fd,unsigned int,max_fd,unsigned int,flags)1494 SYSCALL_DEFINE3(close_range, unsigned int, fd, unsigned int, max_fd,
1495 unsigned int, flags)
1496 {
1497 return __close_range(fd, max_fd, flags);
1498 }
1499
1500 /*
1501 * This routine simulates a hangup on the tty, to arrange that users
1502 * are given clean terminals at login time.
1503 */
SYSCALL_DEFINE0(vhangup)1504 SYSCALL_DEFINE0(vhangup)
1505 {
1506 if (capable(CAP_SYS_TTY_CONFIG)) {
1507 tty_vhangup_self();
1508 return 0;
1509 }
1510 return -EPERM;
1511 }
1512
1513 /*
1514 * Called when an inode is about to be open.
1515 * We use this to disallow opening large files on 32bit systems if
1516 * the caller didn't specify O_LARGEFILE. On 64bit systems we force
1517 * on this flag in sys_open.
1518 */
generic_file_open(struct inode * inode,struct file * filp)1519 int generic_file_open(struct inode * inode, struct file * filp)
1520 {
1521 if (!(filp->f_flags & O_LARGEFILE) && i_size_read(inode) > MAX_NON_LFS)
1522 return -EOVERFLOW;
1523 return 0;
1524 }
1525
1526 EXPORT_SYMBOL(generic_file_open);
1527
1528 /*
1529 * This is used by subsystems that don't want seekable
1530 * file descriptors. The function is not supposed to ever fail, the only
1531 * reason it returns an 'int' and not 'void' is so that it can be plugged
1532 * directly into file_operations structure.
1533 */
nonseekable_open(struct inode * inode,struct file * filp)1534 int nonseekable_open(struct inode *inode, struct file *filp)
1535 {
1536 filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
1537 return 0;
1538 }
1539
1540 EXPORT_SYMBOL(nonseekable_open);
1541
1542 /*
1543 * stream_open is used by subsystems that want stream-like file descriptors.
1544 * Such file descriptors are not seekable and don't have notion of position
1545 * (file.f_pos is always 0 and ppos passed to .read()/.write() is always NULL).
1546 * Contrary to file descriptors of other regular files, .read() and .write()
1547 * can run simultaneously.
1548 *
1549 * stream_open never fails and is marked to return int so that it could be
1550 * directly used as file_operations.open .
1551 */
stream_open(struct inode * inode,struct file * filp)1552 int stream_open(struct inode *inode, struct file *filp)
1553 {
1554 filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS);
1555 filp->f_mode |= FMODE_STREAM;
1556 return 0;
1557 }
1558
1559 EXPORT_SYMBOL(stream_open);
1560