]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/blob - fs/open.c
bnxt_en: fix ternary sign extension bug in bnxt_show_temp()
[mirror_ubuntu-hirsute-kernel.git] / fs / open.c
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * linux/fs/open.c
4 *
5 * Copyright (C) 1991, 1992 Linus Torvalds
6 */
7
8 #include <linux/string.h>
9 #include <linux/mm.h>
10 #include <linux/file.h>
11 #include <linux/fdtable.h>
12 #include <linux/fsnotify.h>
13 #include <linux/module.h>
14 #include <linux/tty.h>
15 #include <linux/namei.h>
16 #include <linux/backing-dev.h>
17 #include <linux/capability.h>
18 #include <linux/securebits.h>
19 #include <linux/security.h>
20 #include <linux/mount.h>
21 #include <linux/fcntl.h>
22 #include <linux/slab.h>
23 #include <linux/uaccess.h>
24 #include <linux/fs.h>
25 #include <linux/personality.h>
26 #include <linux/pagemap.h>
27 #include <linux/syscalls.h>
28 #include <linux/rcupdate.h>
29 #include <linux/audit.h>
30 #include <linux/falloc.h>
31 #include <linux/fs_struct.h>
32 #include <linux/ima.h>
33 #include <linux/dnotify.h>
34 #include <linux/compat.h>
35
36 #include "internal.h"
37
38 int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs,
39 struct file *filp)
40 {
41 int ret;
42 struct iattr newattrs;
43
44 /* Not pretty: "inode->i_size" shouldn't really be signed. But it is. */
45 if (length < 0)
46 return -EINVAL;
47
48 newattrs.ia_size = length;
49 newattrs.ia_valid = ATTR_SIZE | time_attrs;
50 if (filp) {
51 newattrs.ia_file = filp;
52 newattrs.ia_valid |= ATTR_FILE;
53 }
54
55 /* Remove suid, sgid, and file capabilities on truncate too */
56 ret = dentry_needs_remove_privs(dentry);
57 if (ret < 0)
58 return ret;
59 if (ret)
60 newattrs.ia_valid |= ret | ATTR_FORCE;
61
62 inode_lock(dentry->d_inode);
63 /* Note any delegations or leases have already been broken: */
64 ret = notify_change(dentry, &newattrs, NULL);
65 inode_unlock(dentry->d_inode);
66 return ret;
67 }
68 EXPORT_SYMBOL_GPL(do_truncate);
69
70 long vfs_truncate(const struct path *path, loff_t length)
71 {
72 struct inode *inode;
73 long error;
74
75 inode = path->dentry->d_inode;
76
77 /* For directories it's -EISDIR, for other non-regulars - -EINVAL */
78 if (S_ISDIR(inode->i_mode))
79 return -EISDIR;
80 if (!S_ISREG(inode->i_mode))
81 return -EINVAL;
82
83 error = mnt_want_write(path->mnt);
84 if (error)
85 goto out;
86
87 error = inode_permission(inode, MAY_WRITE);
88 if (error)
89 goto mnt_drop_write_and_out;
90
91 error = -EPERM;
92 if (IS_APPEND(inode))
93 goto mnt_drop_write_and_out;
94
95 error = get_write_access(inode);
96 if (error)
97 goto mnt_drop_write_and_out;
98
99 /*
100 * Make sure that there are no leases. get_write_access() protects
101 * against the truncate racing with a lease-granting setlease().
102 */
103 error = break_lease(inode, O_WRONLY);
104 if (error)
105 goto put_write_and_out;
106
107 error = locks_verify_truncate(inode, NULL, length);
108 if (!error)
109 error = security_path_truncate(path);
110 if (!error)
111 error = do_truncate(path->dentry, length, 0, NULL);
112
113 put_write_and_out:
114 put_write_access(inode);
115 mnt_drop_write_and_out:
116 mnt_drop_write(path->mnt);
117 out:
118 return error;
119 }
120 EXPORT_SYMBOL_GPL(vfs_truncate);
121
122 long do_sys_truncate(const char __user *pathname, loff_t length)
123 {
124 unsigned int lookup_flags = LOOKUP_FOLLOW;
125 struct path path;
126 int error;
127
128 if (length < 0) /* sorry, but loff_t says... */
129 return -EINVAL;
130
131 retry:
132 error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
133 if (!error) {
134 error = vfs_truncate(&path, length);
135 path_put(&path);
136 }
137 if (retry_estale(error, lookup_flags)) {
138 lookup_flags |= LOOKUP_REVAL;
139 goto retry;
140 }
141 return error;
142 }
143
144 SYSCALL_DEFINE2(truncate, const char __user *, path, long, length)
145 {
146 return do_sys_truncate(path, length);
147 }
148
149 #ifdef CONFIG_COMPAT
150 COMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path, compat_off_t, length)
151 {
152 return do_sys_truncate(path, length);
153 }
154 #endif
155
156 long do_sys_ftruncate(unsigned int fd, loff_t length, int small)
157 {
158 struct inode *inode;
159 struct dentry *dentry;
160 struct fd f;
161 int error;
162
163 error = -EINVAL;
164 if (length < 0)
165 goto out;
166 error = -EBADF;
167 f = fdget(fd);
168 if (!f.file)
169 goto out;
170
171 /* explicitly opened as large or we are on 64-bit box */
172 if (f.file->f_flags & O_LARGEFILE)
173 small = 0;
174
175 dentry = f.file->f_path.dentry;
176 inode = dentry->d_inode;
177 error = -EINVAL;
178 if (!S_ISREG(inode->i_mode) || !(f.file->f_mode & FMODE_WRITE))
179 goto out_putf;
180
181 error = -EINVAL;
182 /* Cannot ftruncate over 2^31 bytes without large file support */
183 if (small && length > MAX_NON_LFS)
184 goto out_putf;
185
186 error = -EPERM;
187 /* Check IS_APPEND on real upper inode */
188 if (IS_APPEND(file_inode(f.file)))
189 goto out_putf;
190
191 sb_start_write(inode->i_sb);
192 error = locks_verify_truncate(inode, f.file, length);
193 if (!error)
194 error = security_path_truncate(&f.file->f_path);
195 if (!error)
196 error = do_truncate(dentry, length, ATTR_MTIME|ATTR_CTIME, f.file);
197 sb_end_write(inode->i_sb);
198 out_putf:
199 fdput(f);
200 out:
201 return error;
202 }
203
204 SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length)
205 {
206 return do_sys_ftruncate(fd, length, 1);
207 }
208
209 #ifdef CONFIG_COMPAT
210 COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_ulong_t, length)
211 {
212 return do_sys_ftruncate(fd, length, 1);
213 }
214 #endif
215
216 /* LFS versions of truncate are only needed on 32 bit machines */
217 #if BITS_PER_LONG == 32
218 SYSCALL_DEFINE2(truncate64, const char __user *, path, loff_t, length)
219 {
220 return do_sys_truncate(path, length);
221 }
222
223 SYSCALL_DEFINE2(ftruncate64, unsigned int, fd, loff_t, length)
224 {
225 return do_sys_ftruncate(fd, length, 0);
226 }
227 #endif /* BITS_PER_LONG == 32 */
228
229
230 int vfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
231 {
232 struct inode *inode = file_inode(file);
233 long ret;
234
235 if (offset < 0 || len <= 0)
236 return -EINVAL;
237
238 /* Return error if mode is not supported */
239 if (mode & ~FALLOC_FL_SUPPORTED_MASK)
240 return -EOPNOTSUPP;
241
242 /* Punch hole and zero range are mutually exclusive */
243 if ((mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE)) ==
244 (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE))
245 return -EOPNOTSUPP;
246
247 /* Punch hole must have keep size set */
248 if ((mode & FALLOC_FL_PUNCH_HOLE) &&
249 !(mode & FALLOC_FL_KEEP_SIZE))
250 return -EOPNOTSUPP;
251
252 /* Collapse range should only be used exclusively. */
253 if ((mode & FALLOC_FL_COLLAPSE_RANGE) &&
254 (mode & ~FALLOC_FL_COLLAPSE_RANGE))
255 return -EINVAL;
256
257 /* Insert range should only be used exclusively. */
258 if ((mode & FALLOC_FL_INSERT_RANGE) &&
259 (mode & ~FALLOC_FL_INSERT_RANGE))
260 return -EINVAL;
261
262 /* Unshare range should only be used with allocate mode. */
263 if ((mode & FALLOC_FL_UNSHARE_RANGE) &&
264 (mode & ~(FALLOC_FL_UNSHARE_RANGE | FALLOC_FL_KEEP_SIZE)))
265 return -EINVAL;
266
267 if (!(file->f_mode & FMODE_WRITE))
268 return -EBADF;
269
270 /*
271 * We can only allow pure fallocate on append only files
272 */
273 if ((mode & ~FALLOC_FL_KEEP_SIZE) && IS_APPEND(inode))
274 return -EPERM;
275
276 if (IS_IMMUTABLE(inode))
277 return -EPERM;
278
279 /*
280 * We cannot allow any fallocate operation on an active swapfile
281 */
282 if (IS_SWAPFILE(inode))
283 return -ETXTBSY;
284
285 /*
286 * Revalidate the write permissions, in case security policy has
287 * changed since the files were opened.
288 */
289 ret = security_file_permission(file, MAY_WRITE);
290 if (ret)
291 return ret;
292
293 if (S_ISFIFO(inode->i_mode))
294 return -ESPIPE;
295
296 if (S_ISDIR(inode->i_mode))
297 return -EISDIR;
298
299 if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
300 return -ENODEV;
301
302 /* Check for wrap through zero too */
303 if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0))
304 return -EFBIG;
305
306 if (!file->f_op->fallocate)
307 return -EOPNOTSUPP;
308
309 file_start_write(file);
310 ret = file->f_op->fallocate(file, mode, offset, len);
311
312 /*
313 * Create inotify and fanotify events.
314 *
315 * To keep the logic simple always create events if fallocate succeeds.
316 * This implies that events are even created if the file size remains
317 * unchanged, e.g. when using flag FALLOC_FL_KEEP_SIZE.
318 */
319 if (ret == 0)
320 fsnotify_modify(file);
321
322 file_end_write(file);
323 return ret;
324 }
325 EXPORT_SYMBOL_GPL(vfs_fallocate);
326
327 int ksys_fallocate(int fd, int mode, loff_t offset, loff_t len)
328 {
329 struct fd f = fdget(fd);
330 int error = -EBADF;
331
332 if (f.file) {
333 error = vfs_fallocate(f.file, mode, offset, len);
334 fdput(f);
335 }
336 return error;
337 }
338
339 SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len)
340 {
341 return ksys_fallocate(fd, mode, offset, len);
342 }
343
344 /*
345 * access() needs to use the real uid/gid, not the effective uid/gid.
346 * We do this by temporarily clearing all FS-related capabilities and
347 * switching the fsuid/fsgid around to the real ones.
348 */
349 static const struct cred *access_override_creds(void)
350 {
351 const struct cred *old_cred;
352 struct cred *override_cred;
353
354 override_cred = prepare_creds();
355 if (!override_cred)
356 return NULL;
357
358 override_cred->fsuid = override_cred->uid;
359 override_cred->fsgid = override_cred->gid;
360
361 if (!issecure(SECURE_NO_SETUID_FIXUP)) {
362 /* Clear the capabilities if we switch to a non-root user */
363 kuid_t root_uid = make_kuid(override_cred->user_ns, 0);
364 if (!uid_eq(override_cred->uid, root_uid))
365 cap_clear(override_cred->cap_effective);
366 else
367 override_cred->cap_effective =
368 override_cred->cap_permitted;
369 }
370
371 /*
372 * The new set of credentials can *only* be used in
373 * task-synchronous circumstances, and does not need
374 * RCU freeing, unless somebody then takes a separate
375 * reference to it.
376 *
377 * NOTE! This is _only_ true because this credential
378 * is used purely for override_creds() that installs
379 * it as the subjective cred. Other threads will be
380 * accessing ->real_cred, not the subjective cred.
381 *
382 * If somebody _does_ make a copy of this (using the
383 * 'get_current_cred()' function), that will clear the
384 * non_rcu field, because now that other user may be
385 * expecting RCU freeing. But normal thread-synchronous
386 * cred accesses will keep things non-RCY.
387 */
388 override_cred->non_rcu = 1;
389
390 old_cred = override_creds(override_cred);
391
392 /* override_cred() gets its own ref */
393 put_cred(override_cred);
394
395 return old_cred;
396 }
397
398 static long do_faccessat(int dfd, const char __user *filename, int mode, int flags)
399 {
400 struct path path;
401 struct inode *inode;
402 int res;
403 unsigned int lookup_flags = LOOKUP_FOLLOW;
404 const struct cred *old_cred = NULL;
405
406 if (mode & ~S_IRWXO) /* where's F_OK, X_OK, W_OK, R_OK? */
407 return -EINVAL;
408
409 if (flags & ~(AT_EACCESS | AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH))
410 return -EINVAL;
411
412 if (flags & AT_SYMLINK_NOFOLLOW)
413 lookup_flags &= ~LOOKUP_FOLLOW;
414 if (flags & AT_EMPTY_PATH)
415 lookup_flags |= LOOKUP_EMPTY;
416
417 if (!(flags & AT_EACCESS)) {
418 old_cred = access_override_creds();
419 if (!old_cred)
420 return -ENOMEM;
421 }
422
423 retry:
424 res = user_path_at(dfd, filename, lookup_flags, &path);
425 if (res)
426 goto out;
427
428 inode = d_backing_inode(path.dentry);
429
430 if ((mode & MAY_EXEC) && S_ISREG(inode->i_mode)) {
431 /*
432 * MAY_EXEC on regular files is denied if the fs is mounted
433 * with the "noexec" flag.
434 */
435 res = -EACCES;
436 if (path_noexec(&path))
437 goto out_path_release;
438 }
439
440 res = inode_permission(inode, mode | MAY_ACCESS);
441 /* SuS v2 requires we report a read only fs too */
442 if (res || !(mode & S_IWOTH) || special_file(inode->i_mode))
443 goto out_path_release;
444 /*
445 * This is a rare case where using __mnt_is_readonly()
446 * is OK without a mnt_want/drop_write() pair. Since
447 * no actual write to the fs is performed here, we do
448 * not need to telegraph to that to anyone.
449 *
450 * By doing this, we accept that this access is
451 * inherently racy and know that the fs may change
452 * state before we even see this result.
453 */
454 if (__mnt_is_readonly(path.mnt))
455 res = -EROFS;
456
457 out_path_release:
458 path_put(&path);
459 if (retry_estale(res, lookup_flags)) {
460 lookup_flags |= LOOKUP_REVAL;
461 goto retry;
462 }
463 out:
464 if (old_cred)
465 revert_creds(old_cred);
466
467 return res;
468 }
469
470 SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
471 {
472 return do_faccessat(dfd, filename, mode, 0);
473 }
474
475 SYSCALL_DEFINE4(faccessat2, int, dfd, const char __user *, filename, int, mode,
476 int, flags)
477 {
478 return do_faccessat(dfd, filename, mode, flags);
479 }
480
481 SYSCALL_DEFINE2(access, const char __user *, filename, int, mode)
482 {
483 return do_faccessat(AT_FDCWD, filename, mode, 0);
484 }
485
486 SYSCALL_DEFINE1(chdir, const char __user *, filename)
487 {
488 struct path path;
489 int error;
490 unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
491 retry:
492 error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
493 if (error)
494 goto out;
495
496 error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_CHDIR);
497 if (error)
498 goto dput_and_out;
499
500 set_fs_pwd(current->fs, &path);
501
502 dput_and_out:
503 path_put(&path);
504 if (retry_estale(error, lookup_flags)) {
505 lookup_flags |= LOOKUP_REVAL;
506 goto retry;
507 }
508 out:
509 return error;
510 }
511
512 SYSCALL_DEFINE1(fchdir, unsigned int, fd)
513 {
514 struct fd f = fdget_raw(fd);
515 int error;
516
517 error = -EBADF;
518 if (!f.file)
519 goto out;
520
521 error = -ENOTDIR;
522 if (!d_can_lookup(f.file->f_path.dentry))
523 goto out_putf;
524
525 error = inode_permission(file_inode(f.file), MAY_EXEC | MAY_CHDIR);
526 if (!error)
527 set_fs_pwd(current->fs, &f.file->f_path);
528 out_putf:
529 fdput(f);
530 out:
531 return error;
532 }
533
534 SYSCALL_DEFINE1(chroot, const char __user *, filename)
535 {
536 struct path path;
537 int error;
538 unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
539 retry:
540 error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
541 if (error)
542 goto out;
543
544 error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_CHDIR);
545 if (error)
546 goto dput_and_out;
547
548 error = -EPERM;
549 if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT))
550 goto dput_and_out;
551 error = security_path_chroot(&path);
552 if (error)
553 goto dput_and_out;
554
555 set_fs_root(current->fs, &path);
556 error = 0;
557 dput_and_out:
558 path_put(&path);
559 if (retry_estale(error, lookup_flags)) {
560 lookup_flags |= LOOKUP_REVAL;
561 goto retry;
562 }
563 out:
564 return error;
565 }
566
567 int chmod_common(const struct path *path, umode_t mode)
568 {
569 struct inode *inode = path->dentry->d_inode;
570 struct inode *delegated_inode = NULL;
571 struct iattr newattrs;
572 int error;
573
574 error = mnt_want_write(path->mnt);
575 if (error)
576 return error;
577 retry_deleg:
578 inode_lock(inode);
579 error = security_path_chmod(path, mode);
580 if (error)
581 goto out_unlock;
582 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
583 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
584 error = notify_change(path->dentry, &newattrs, &delegated_inode);
585 out_unlock:
586 inode_unlock(inode);
587 if (delegated_inode) {
588 error = break_deleg_wait(&delegated_inode);
589 if (!error)
590 goto retry_deleg;
591 }
592 mnt_drop_write(path->mnt);
593 return error;
594 }
595
596 int vfs_fchmod(struct file *file, umode_t mode)
597 {
598 audit_file(file);
599 return chmod_common(&file->f_path, mode);
600 }
601
602 SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode)
603 {
604 struct fd f = fdget(fd);
605 int err = -EBADF;
606
607 if (f.file) {
608 err = vfs_fchmod(f.file, mode);
609 fdput(f);
610 }
611 return err;
612 }
613
614 static int do_fchmodat(int dfd, const char __user *filename, umode_t mode)
615 {
616 struct path path;
617 int error;
618 unsigned int lookup_flags = LOOKUP_FOLLOW;
619 retry:
620 error = user_path_at(dfd, filename, lookup_flags, &path);
621 if (!error) {
622 error = chmod_common(&path, mode);
623 path_put(&path);
624 if (retry_estale(error, lookup_flags)) {
625 lookup_flags |= LOOKUP_REVAL;
626 goto retry;
627 }
628 }
629 return error;
630 }
631
632 SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename,
633 umode_t, mode)
634 {
635 return do_fchmodat(dfd, filename, mode);
636 }
637
638 SYSCALL_DEFINE2(chmod, const char __user *, filename, umode_t, mode)
639 {
640 return do_fchmodat(AT_FDCWD, filename, mode);
641 }
642
643 int chown_common(const struct path *path, uid_t user, gid_t group)
644 {
645 struct inode *inode = path->dentry->d_inode;
646 struct inode *delegated_inode = NULL;
647 int error;
648 struct iattr newattrs;
649 kuid_t uid;
650 kgid_t gid;
651
652 uid = make_kuid(current_user_ns(), user);
653 gid = make_kgid(current_user_ns(), group);
654
655 retry_deleg:
656 newattrs.ia_valid = ATTR_CTIME;
657 if (user != (uid_t) -1) {
658 if (!uid_valid(uid))
659 return -EINVAL;
660 newattrs.ia_valid |= ATTR_UID;
661 newattrs.ia_uid = uid;
662 }
663 if (group != (gid_t) -1) {
664 if (!gid_valid(gid))
665 return -EINVAL;
666 newattrs.ia_valid |= ATTR_GID;
667 newattrs.ia_gid = gid;
668 }
669 if (!S_ISDIR(inode->i_mode))
670 newattrs.ia_valid |=
671 ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_KILL_PRIV;
672 inode_lock(inode);
673 error = security_path_chown(path, uid, gid);
674 if (!error)
675 error = notify_change(path->dentry, &newattrs, &delegated_inode);
676 inode_unlock(inode);
677 if (delegated_inode) {
678 error = break_deleg_wait(&delegated_inode);
679 if (!error)
680 goto retry_deleg;
681 }
682 return error;
683 }
684
685 int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group,
686 int flag)
687 {
688 struct path path;
689 int error = -EINVAL;
690 int lookup_flags;
691
692 if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
693 goto out;
694
695 lookup_flags = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW;
696 if (flag & AT_EMPTY_PATH)
697 lookup_flags |= LOOKUP_EMPTY;
698 retry:
699 error = user_path_at(dfd, filename, lookup_flags, &path);
700 if (error)
701 goto out;
702 error = mnt_want_write(path.mnt);
703 if (error)
704 goto out_release;
705 error = chown_common(&path, user, group);
706 mnt_drop_write(path.mnt);
707 out_release:
708 path_put(&path);
709 if (retry_estale(error, lookup_flags)) {
710 lookup_flags |= LOOKUP_REVAL;
711 goto retry;
712 }
713 out:
714 return error;
715 }
716
717 SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
718 gid_t, group, int, flag)
719 {
720 return do_fchownat(dfd, filename, user, group, flag);
721 }
722
723 SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
724 {
725 return do_fchownat(AT_FDCWD, filename, user, group, 0);
726 }
727
728 SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group)
729 {
730 return do_fchownat(AT_FDCWD, filename, user, group,
731 AT_SYMLINK_NOFOLLOW);
732 }
733
734 int vfs_fchown(struct file *file, uid_t user, gid_t group)
735 {
736 int error;
737
738 error = mnt_want_write_file(file);
739 if (error)
740 return error;
741 audit_file(file);
742 error = chown_common(&file->f_path, user, group);
743 mnt_drop_write_file(file);
744 return error;
745 }
746
747 int ksys_fchown(unsigned int fd, uid_t user, gid_t group)
748 {
749 struct fd f = fdget(fd);
750 int error = -EBADF;
751
752 if (f.file) {
753 error = vfs_fchown(f.file, user, group);
754 fdput(f);
755 }
756 return error;
757 }
758
759 SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
760 {
761 return ksys_fchown(fd, user, group);
762 }
763
764 static int do_dentry_open(struct file *f,
765 struct inode *inode,
766 int (*open)(struct inode *, struct file *))
767 {
768 static const struct file_operations empty_fops = {};
769 int error;
770
771 path_get(&f->f_path);
772 f->f_inode = inode;
773 f->f_mapping = inode->i_mapping;
774 f->f_wb_err = filemap_sample_wb_err(f->f_mapping);
775 f->f_sb_err = file_sample_sb_err(f);
776
777 if (unlikely(f->f_flags & O_PATH)) {
778 f->f_mode = FMODE_PATH | FMODE_OPENED;
779 f->f_op = &empty_fops;
780 return 0;
781 }
782
783 if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
784 error = get_write_access(inode);
785 if (unlikely(error))
786 goto cleanup_file;
787 error = __mnt_want_write(f->f_path.mnt);
788 if (unlikely(error)) {
789 put_write_access(inode);
790 goto cleanup_file;
791 }
792 f->f_mode |= FMODE_WRITER;
793 }
794
795 /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */
796 if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode))
797 f->f_mode |= FMODE_ATOMIC_POS;
798
799 f->f_op = fops_get(inode->i_fop);
800 if (WARN_ON(!f->f_op)) {
801 error = -ENODEV;
802 goto cleanup_all;
803 }
804
805 error = security_file_open(f);
806 if (error)
807 goto cleanup_all;
808
809 error = break_lease(locks_inode(f), f->f_flags);
810 if (error)
811 goto cleanup_all;
812
813 /* normally all 3 are set; ->open() can clear them if needed */
814 f->f_mode |= FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE;
815 if (!open)
816 open = f->f_op->open;
817 if (open) {
818 error = open(inode, f);
819 if (error)
820 goto cleanup_all;
821 }
822 f->f_mode |= FMODE_OPENED;
823 if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ)
824 i_readcount_inc(inode);
825 if ((f->f_mode & FMODE_READ) &&
826 likely(f->f_op->read || f->f_op->read_iter))
827 f->f_mode |= FMODE_CAN_READ;
828 if ((f->f_mode & FMODE_WRITE) &&
829 likely(f->f_op->write || f->f_op->write_iter))
830 f->f_mode |= FMODE_CAN_WRITE;
831
832 f->f_write_hint = WRITE_LIFE_NOT_SET;
833 f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC);
834
835 file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping);
836
837 /* NB: we're sure to have correct a_ops only after f_op->open */
838 if (f->f_flags & O_DIRECT) {
839 if (!f->f_mapping->a_ops || !f->f_mapping->a_ops->direct_IO)
840 return -EINVAL;
841 }
842
843 /*
844 * XXX: Huge page cache doesn't support writing yet. Drop all page
845 * cache for this file before processing writes.
846 */
847 if ((f->f_mode & FMODE_WRITE) && filemap_nr_thps(inode->i_mapping))
848 truncate_pagecache(inode, 0);
849
850 return 0;
851
852 cleanup_all:
853 if (WARN_ON_ONCE(error > 0))
854 error = -EINVAL;
855 fops_put(f->f_op);
856 if (f->f_mode & FMODE_WRITER) {
857 put_write_access(inode);
858 __mnt_drop_write(f->f_path.mnt);
859 }
860 cleanup_file:
861 path_put(&f->f_path);
862 f->f_path.mnt = NULL;
863 f->f_path.dentry = NULL;
864 f->f_inode = NULL;
865 return error;
866 }
867
868 /**
869 * finish_open - finish opening a file
870 * @file: file pointer
871 * @dentry: pointer to dentry
872 * @open: open callback
873 * @opened: state of open
874 *
875 * This can be used to finish opening a file passed to i_op->atomic_open().
876 *
877 * If the open callback is set to NULL, then the standard f_op->open()
878 * filesystem callback is substituted.
879 *
880 * NB: the dentry reference is _not_ consumed. If, for example, the dentry is
881 * the return value of d_splice_alias(), then the caller needs to perform dput()
882 * on it after finish_open().
883 *
884 * Returns zero on success or -errno if the open failed.
885 */
886 int finish_open(struct file *file, struct dentry *dentry,
887 int (*open)(struct inode *, struct file *))
888 {
889 BUG_ON(file->f_mode & FMODE_OPENED); /* once it's opened, it's opened */
890
891 file->f_path.dentry = dentry;
892 return do_dentry_open(file, d_backing_inode(dentry), open);
893 }
894 EXPORT_SYMBOL(finish_open);
895
896 /**
897 * finish_no_open - finish ->atomic_open() without opening the file
898 *
899 * @file: file pointer
900 * @dentry: dentry or NULL (as returned from ->lookup())
901 *
902 * This can be used to set the result of a successful lookup in ->atomic_open().
903 *
904 * NB: unlike finish_open() this function does consume the dentry reference and
905 * the caller need not dput() it.
906 *
907 * Returns "0" which must be the return value of ->atomic_open() after having
908 * called this function.
909 */
910 int finish_no_open(struct file *file, struct dentry *dentry)
911 {
912 file->f_path.dentry = dentry;
913 return 0;
914 }
915 EXPORT_SYMBOL(finish_no_open);
916
917 char *file_path(struct file *filp, char *buf, int buflen)
918 {
919 return d_path(&filp->f_path, buf, buflen);
920 }
921 EXPORT_SYMBOL(file_path);
922
923 /**
924 * vfs_open - open the file at the given path
925 * @path: path to open
926 * @file: newly allocated file with f_flag initialized
927 * @cred: credentials to use
928 */
929 int vfs_open(const struct path *path, struct file *file)
930 {
931 file->f_path = *path;
932 return do_dentry_open(file, d_backing_inode(path->dentry), NULL);
933 }
934
935 struct file *dentry_open(const struct path *path, int flags,
936 const struct cred *cred)
937 {
938 int error;
939 struct file *f;
940
941 validate_creds(cred);
942
943 /* We must always pass in a valid mount pointer. */
944 BUG_ON(!path->mnt);
945
946 f = alloc_empty_file(flags, cred);
947 if (!IS_ERR(f)) {
948 error = vfs_open(path, f);
949 if (error) {
950 fput(f);
951 f = ERR_PTR(error);
952 }
953 }
954 return f;
955 }
956 EXPORT_SYMBOL(dentry_open);
957
958 struct file *open_with_fake_path(const struct path *path, int flags,
959 struct inode *inode, const struct cred *cred)
960 {
961 struct file *f = alloc_empty_file_noaccount(flags, cred);
962 if (!IS_ERR(f)) {
963 int error;
964
965 f->f_path = *path;
966 error = do_dentry_open(f, inode, NULL);
967 if (error) {
968 fput(f);
969 f = ERR_PTR(error);
970 }
971 }
972 return f;
973 }
974 EXPORT_SYMBOL(open_with_fake_path);
975
976 #define WILL_CREATE(flags) (flags & (O_CREAT | __O_TMPFILE))
977 #define O_PATH_FLAGS (O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC)
978
979 inline struct open_how build_open_how(int flags, umode_t mode)
980 {
981 struct open_how how = {
982 .flags = flags & VALID_OPEN_FLAGS,
983 .mode = mode & S_IALLUGO,
984 };
985
986 /* O_PATH beats everything else. */
987 if (how.flags & O_PATH)
988 how.flags &= O_PATH_FLAGS;
989 /* Modes should only be set for create-like flags. */
990 if (!WILL_CREATE(how.flags))
991 how.mode = 0;
992 return how;
993 }
994
995 inline int build_open_flags(const struct open_how *how, struct open_flags *op)
996 {
997 int flags = how->flags;
998 int lookup_flags = 0;
999 int acc_mode = ACC_MODE(flags);
1000
1001 /* Must never be set by userspace */
1002 flags &= ~(FMODE_NONOTIFY | O_CLOEXEC);
1003
1004 /*
1005 * Older syscalls implicitly clear all of the invalid flags or argument
1006 * values before calling build_open_flags(), but openat2(2) checks all
1007 * of its arguments.
1008 */
1009 if (flags & ~VALID_OPEN_FLAGS)
1010 return -EINVAL;
1011 if (how->resolve & ~VALID_RESOLVE_FLAGS)
1012 return -EINVAL;
1013
1014 /* Scoping flags are mutually exclusive. */
1015 if ((how->resolve & RESOLVE_BENEATH) && (how->resolve & RESOLVE_IN_ROOT))
1016 return -EINVAL;
1017
1018 /* Deal with the mode. */
1019 if (WILL_CREATE(flags)) {
1020 if (how->mode & ~S_IALLUGO)
1021 return -EINVAL;
1022 op->mode = how->mode | S_IFREG;
1023 } else {
1024 if (how->mode != 0)
1025 return -EINVAL;
1026 op->mode = 0;
1027 }
1028
1029 /*
1030 * In order to ensure programs get explicit errors when trying to use
1031 * O_TMPFILE on old kernels, O_TMPFILE is implemented such that it
1032 * looks like (O_DIRECTORY|O_RDWR & ~O_CREAT) to old kernels. But we
1033 * have to require userspace to explicitly set it.
1034 */
1035 if (flags & __O_TMPFILE) {
1036 if ((flags & O_TMPFILE_MASK) != O_TMPFILE)
1037 return -EINVAL;
1038 if (!(acc_mode & MAY_WRITE))
1039 return -EINVAL;
1040 }
1041 if (flags & O_PATH) {
1042 /* O_PATH only permits certain other flags to be set. */
1043 if (flags & ~O_PATH_FLAGS)
1044 return -EINVAL;
1045 acc_mode = 0;
1046 }
1047
1048 /*
1049 * O_SYNC is implemented as __O_SYNC|O_DSYNC. As many places only
1050 * check for O_DSYNC if the need any syncing at all we enforce it's
1051 * always set instead of having to deal with possibly weird behaviour
1052 * for malicious applications setting only __O_SYNC.
1053 */
1054 if (flags & __O_SYNC)
1055 flags |= O_DSYNC;
1056
1057 op->open_flag = flags;
1058
1059 /* O_TRUNC implies we need access checks for write permissions */
1060 if (flags & O_TRUNC)
1061 acc_mode |= MAY_WRITE;
1062
1063 /* Allow the LSM permission hook to distinguish append
1064 access from general write access. */
1065 if (flags & O_APPEND)
1066 acc_mode |= MAY_APPEND;
1067
1068 op->acc_mode = acc_mode;
1069
1070 op->intent = flags & O_PATH ? 0 : LOOKUP_OPEN;
1071
1072 if (flags & O_CREAT) {
1073 op->intent |= LOOKUP_CREATE;
1074 if (flags & O_EXCL) {
1075 op->intent |= LOOKUP_EXCL;
1076 flags |= O_NOFOLLOW;
1077 }
1078 }
1079
1080 if (flags & O_DIRECTORY)
1081 lookup_flags |= LOOKUP_DIRECTORY;
1082 if (!(flags & O_NOFOLLOW))
1083 lookup_flags |= LOOKUP_FOLLOW;
1084
1085 if (how->resolve & RESOLVE_NO_XDEV)
1086 lookup_flags |= LOOKUP_NO_XDEV;
1087 if (how->resolve & RESOLVE_NO_MAGICLINKS)
1088 lookup_flags |= LOOKUP_NO_MAGICLINKS;
1089 if (how->resolve & RESOLVE_NO_SYMLINKS)
1090 lookup_flags |= LOOKUP_NO_SYMLINKS;
1091 if (how->resolve & RESOLVE_BENEATH)
1092 lookup_flags |= LOOKUP_BENEATH;
1093 if (how->resolve & RESOLVE_IN_ROOT)
1094 lookup_flags |= LOOKUP_IN_ROOT;
1095
1096 op->lookup_flags = lookup_flags;
1097 return 0;
1098 }
1099
1100 /**
1101 * file_open_name - open file and return file pointer
1102 *
1103 * @name: struct filename containing path to open
1104 * @flags: open flags as per the open(2) second argument
1105 * @mode: mode for the new file if O_CREAT is set, else ignored
1106 *
1107 * This is the helper to open a file from kernelspace if you really
1108 * have to. But in generally you should not do this, so please move
1109 * along, nothing to see here..
1110 */
1111 struct file *file_open_name(struct filename *name, int flags, umode_t mode)
1112 {
1113 struct open_flags op;
1114 struct open_how how = build_open_how(flags, mode);
1115 int err = build_open_flags(&how, &op);
1116 if (err)
1117 return ERR_PTR(err);
1118 return do_filp_open(AT_FDCWD, name, &op);
1119 }
1120
1121 /**
1122 * filp_open - open file and return file pointer
1123 *
1124 * @filename: path to open
1125 * @flags: open flags as per the open(2) second argument
1126 * @mode: mode for the new file if O_CREAT is set, else ignored
1127 *
1128 * This is the helper to open a file from kernelspace if you really
1129 * have to. But in generally you should not do this, so please move
1130 * along, nothing to see here..
1131 */
1132 struct file *filp_open(const char *filename, int flags, umode_t mode)
1133 {
1134 struct filename *name = getname_kernel(filename);
1135 struct file *file = ERR_CAST(name);
1136
1137 if (!IS_ERR(name)) {
1138 file = file_open_name(name, flags, mode);
1139 putname(name);
1140 }
1141 return file;
1142 }
1143 EXPORT_SYMBOL(filp_open);
1144
1145 struct file *file_open_root(struct dentry *dentry, struct vfsmount *mnt,
1146 const char *filename, int flags, umode_t mode)
1147 {
1148 struct open_flags op;
1149 struct open_how how = build_open_how(flags, mode);
1150 int err = build_open_flags(&how, &op);
1151 if (err)
1152 return ERR_PTR(err);
1153 return do_file_open_root(dentry, mnt, filename, &op);
1154 }
1155 EXPORT_SYMBOL(file_open_root);
1156
1157 static long do_sys_openat2(int dfd, const char __user *filename,
1158 struct open_how *how)
1159 {
1160 struct open_flags op;
1161 int fd = build_open_flags(how, &op);
1162 struct filename *tmp;
1163
1164 if (fd)
1165 return fd;
1166
1167 tmp = getname(filename);
1168 if (IS_ERR(tmp))
1169 return PTR_ERR(tmp);
1170
1171 fd = get_unused_fd_flags(how->flags);
1172 if (fd >= 0) {
1173 struct file *f = do_filp_open(dfd, tmp, &op);
1174 if (IS_ERR(f)) {
1175 put_unused_fd(fd);
1176 fd = PTR_ERR(f);
1177 } else {
1178 fsnotify_open(f);
1179 fd_install(fd, f);
1180 }
1181 }
1182 putname(tmp);
1183 return fd;
1184 }
1185
1186 long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
1187 {
1188 struct open_how how = build_open_how(flags, mode);
1189 return do_sys_openat2(dfd, filename, &how);
1190 }
1191
1192
1193 SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1194 {
1195 if (force_o_largefile())
1196 flags |= O_LARGEFILE;
1197 return do_sys_open(AT_FDCWD, filename, flags, mode);
1198 }
1199
1200 SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags,
1201 umode_t, mode)
1202 {
1203 if (force_o_largefile())
1204 flags |= O_LARGEFILE;
1205 return do_sys_open(dfd, filename, flags, mode);
1206 }
1207
1208 SYSCALL_DEFINE4(openat2, int, dfd, const char __user *, filename,
1209 struct open_how __user *, how, size_t, usize)
1210 {
1211 int err;
1212 struct open_how tmp;
1213
1214 BUILD_BUG_ON(sizeof(struct open_how) < OPEN_HOW_SIZE_VER0);
1215 BUILD_BUG_ON(sizeof(struct open_how) != OPEN_HOW_SIZE_LATEST);
1216
1217 if (unlikely(usize < OPEN_HOW_SIZE_VER0))
1218 return -EINVAL;
1219
1220 err = copy_struct_from_user(&tmp, sizeof(tmp), how, usize);
1221 if (err)
1222 return err;
1223
1224 /* O_LARGEFILE is only allowed for non-O_PATH. */
1225 if (!(tmp.flags & O_PATH) && force_o_largefile())
1226 tmp.flags |= O_LARGEFILE;
1227
1228 return do_sys_openat2(dfd, filename, &tmp);
1229 }
1230
1231 #ifdef CONFIG_COMPAT
1232 /*
1233 * Exactly like sys_open(), except that it doesn't set the
1234 * O_LARGEFILE flag.
1235 */
1236 COMPAT_SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1237 {
1238 return do_sys_open(AT_FDCWD, filename, flags, mode);
1239 }
1240
1241 /*
1242 * Exactly like sys_openat(), except that it doesn't set the
1243 * O_LARGEFILE flag.
1244 */
1245 COMPAT_SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode)
1246 {
1247 return do_sys_open(dfd, filename, flags, mode);
1248 }
1249 #endif
1250
1251 #ifndef __alpha__
1252
1253 /*
1254 * For backward compatibility? Maybe this should be moved
1255 * into arch/i386 instead?
1256 */
1257 SYSCALL_DEFINE2(creat, const char __user *, pathname, umode_t, mode)
1258 {
1259 int flags = O_CREAT | O_WRONLY | O_TRUNC;
1260
1261 if (force_o_largefile())
1262 flags |= O_LARGEFILE;
1263 return do_sys_open(AT_FDCWD, pathname, flags, mode);
1264 }
1265 #endif
1266
1267 /*
1268 * "id" is the POSIX thread ID. We use the
1269 * files pointer for this..
1270 */
1271 int filp_close(struct file *filp, fl_owner_t id)
1272 {
1273 int retval = 0;
1274
1275 if (!file_count(filp)) {
1276 printk(KERN_ERR "VFS: Close: file count is 0\n");
1277 return 0;
1278 }
1279
1280 if (filp->f_op->flush)
1281 retval = filp->f_op->flush(filp, id);
1282
1283 if (likely(!(filp->f_mode & FMODE_PATH))) {
1284 dnotify_flush(filp, id);
1285 locks_remove_posix(filp, id);
1286 }
1287 fput(filp);
1288 return retval;
1289 }
1290
1291 EXPORT_SYMBOL(filp_close);
1292
1293 /*
1294 * Careful here! We test whether the file pointer is NULL before
1295 * releasing the fd. This ensures that one clone task can't release
1296 * an fd while another clone is opening it.
1297 */
1298 SYSCALL_DEFINE1(close, unsigned int, fd)
1299 {
1300 int retval = close_fd(fd);
1301
1302 /* can't restart close syscall because file table entry was cleared */
1303 if (unlikely(retval == -ERESTARTSYS ||
1304 retval == -ERESTARTNOINTR ||
1305 retval == -ERESTARTNOHAND ||
1306 retval == -ERESTART_RESTARTBLOCK))
1307 retval = -EINTR;
1308
1309 return retval;
1310 }
1311
1312 /**
1313 * close_range() - Close all file descriptors in a given range.
1314 *
1315 * @fd: starting file descriptor to close
1316 * @max_fd: last file descriptor to close
1317 * @flags: reserved for future extensions
1318 *
1319 * This closes a range of file descriptors. All file descriptors
1320 * from @fd up to and including @max_fd are closed.
1321 * Currently, errors to close a given file descriptor are ignored.
1322 */
1323 SYSCALL_DEFINE3(close_range, unsigned int, fd, unsigned int, max_fd,
1324 unsigned int, flags)
1325 {
1326 return __close_range(fd, max_fd, flags);
1327 }
1328
1329 /*
1330 * This routine simulates a hangup on the tty, to arrange that users
1331 * are given clean terminals at login time.
1332 */
1333 SYSCALL_DEFINE0(vhangup)
1334 {
1335 if (capable(CAP_SYS_TTY_CONFIG)) {
1336 tty_vhangup_self();
1337 return 0;
1338 }
1339 return -EPERM;
1340 }
1341
1342 /*
1343 * Called when an inode is about to be open.
1344 * We use this to disallow opening large files on 32bit systems if
1345 * the caller didn't specify O_LARGEFILE. On 64bit systems we force
1346 * on this flag in sys_open.
1347 */
1348 int generic_file_open(struct inode * inode, struct file * filp)
1349 {
1350 if (!(filp->f_flags & O_LARGEFILE) && i_size_read(inode) > MAX_NON_LFS)
1351 return -EOVERFLOW;
1352 return 0;
1353 }
1354
1355 EXPORT_SYMBOL(generic_file_open);
1356
1357 /*
1358 * This is used by subsystems that don't want seekable
1359 * file descriptors. The function is not supposed to ever fail, the only
1360 * reason it returns an 'int' and not 'void' is so that it can be plugged
1361 * directly into file_operations structure.
1362 */
1363 int nonseekable_open(struct inode *inode, struct file *filp)
1364 {
1365 filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
1366 return 0;
1367 }
1368
1369 EXPORT_SYMBOL(nonseekable_open);
1370
1371 /*
1372 * stream_open is used by subsystems that want stream-like file descriptors.
1373 * Such file descriptors are not seekable and don't have notion of position
1374 * (file.f_pos is always 0 and ppos passed to .read()/.write() is always NULL).
1375 * Contrary to file descriptors of other regular files, .read() and .write()
1376 * can run simultaneously.
1377 *
1378 * stream_open never fails and is marked to return int so that it could be
1379 * directly used as file_operations.open .
1380 */
1381 int stream_open(struct inode *inode, struct file *filp)
1382 {
1383 filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS);
1384 filp->f_mode |= FMODE_STREAM;
1385 return 0;
1386 }
1387
1388 EXPORT_SYMBOL(stream_open);