1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/fs/file.c 4 * 5 * Copyright (C) 1998-1999, Stephen Tweedie and Bill Hawes 6 * 7 * Manage the dynamic fd arrays in the process files_struct. 8 */ 9 10 #include <linux/syscalls.h> 11 #include <linux/export.h> 12 #include <linux/fs.h> 13 #include <linux/mm.h> 14 #include <linux/mmzone.h> 15 #include <linux/time.h> 16 #include <linux/sched/signal.h> 17 #include <linux/slab.h> 18 #include <linux/vmalloc.h> 19 #include <linux/file.h> 20 #include <linux/fdtable.h> 21 #include <linux/bitops.h> 22 #include <linux/interrupt.h> 23 #include <linux/spinlock.h> 24 #include <linux/rcupdate.h> 25 #include <linux/workqueue.h> 26 27 unsigned int sysctl_nr_open __read_mostly = 1024*1024; 28 unsigned int sysctl_nr_open_min = BITS_PER_LONG; 29 /* our min() is unusable in constant expressions ;-/ */ 30 #define __const_min(x, y) ((x) < (y) ? (x) : (y)) 31 unsigned int sysctl_nr_open_max = 32 __const_min(INT_MAX, ~(size_t)0/sizeof(void *)) & -BITS_PER_LONG; 33 34 static void __free_fdtable(struct fdtable *fdt) 35 { 36 kvfree(fdt->fd); 37 kvfree(fdt->open_fds); 38 kfree(fdt); 39 } 40 41 static void free_fdtable_rcu(struct rcu_head *rcu) 42 { 43 __free_fdtable(container_of(rcu, struct fdtable, rcu)); 44 } 45 46 #define BITBIT_NR(nr) BITS_TO_LONGS(BITS_TO_LONGS(nr)) 47 #define BITBIT_SIZE(nr) (BITBIT_NR(nr) * sizeof(long)) 48 49 /* 50 * Copy 'count' fd bits from the old table to the new table and clear the extra 51 * space if any. This does not copy the file pointers. Called with the files 52 * spinlock held for write. 53 */ 54 static void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt, 55 unsigned int count) 56 { 57 unsigned int cpy, set; 58 59 cpy = count / BITS_PER_BYTE; 60 set = (nfdt->max_fds - count) / BITS_PER_BYTE; 61 memcpy(nfdt->open_fds, ofdt->open_fds, cpy); 62 memset((char *)nfdt->open_fds + cpy, 0, set); 63 memcpy(nfdt->close_on_exec, ofdt->close_on_exec, cpy); 64 memset((char *)nfdt->close_on_exec + cpy, 0, set); 65 66 cpy = BITBIT_SIZE(count); 67 set = BITBIT_SIZE(nfdt->max_fds) - cpy; 68 memcpy(nfdt->full_fds_bits, ofdt->full_fds_bits, cpy); 69 memset((char *)nfdt->full_fds_bits + cpy, 0, set); 70 } 71 72 /* 73 * Copy all file descriptors from the old table to the new, expanded table and 74 * clear the extra space. Called with the files spinlock held for write. 75 */ 76 static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt) 77 { 78 unsigned int cpy, set; 79 80 BUG_ON(nfdt->max_fds < ofdt->max_fds); 81 82 cpy = ofdt->max_fds * sizeof(struct file *); 83 set = (nfdt->max_fds - ofdt->max_fds) * sizeof(struct file *); 84 memcpy(nfdt->fd, ofdt->fd, cpy); 85 memset((char *)nfdt->fd + cpy, 0, set); 86 87 copy_fd_bitmaps(nfdt, ofdt, ofdt->max_fds); 88 } 89 90 static struct fdtable * alloc_fdtable(unsigned int nr) 91 { 92 struct fdtable *fdt; 93 void *data; 94 95 /* 96 * Figure out how many fds we actually want to support in this fdtable. 97 * Allocation steps are keyed to the size of the fdarray, since it 98 * grows far faster than any of the other dynamic data. We try to fit 99 * the fdarray into comfortable page-tuned chunks: starting at 1024B 100 * and growing in powers of two from there on. 101 */ 102 nr /= (1024 / sizeof(struct file *)); 103 nr = roundup_pow_of_two(nr + 1); 104 nr *= (1024 / sizeof(struct file *)); 105 /* 106 * Note that this can drive nr *below* what we had passed if sysctl_nr_open 107 * had been set lower between the check in expand_files() and here. Deal 108 * with that in caller, it's cheaper that way. 109 * 110 * We make sure that nr remains a multiple of BITS_PER_LONG - otherwise 111 * bitmaps handling below becomes unpleasant, to put it mildly... 112 */ 113 if (unlikely(nr > sysctl_nr_open)) 114 nr = ((sysctl_nr_open - 1) | (BITS_PER_LONG - 1)) + 1; 115 116 fdt = kmalloc(sizeof(struct fdtable), GFP_KERNEL_ACCOUNT); 117 if (!fdt) 118 goto out; 119 fdt->max_fds = nr; 120 data = kvmalloc_array(nr, sizeof(struct file *), GFP_KERNEL_ACCOUNT); 121 if (!data) 122 goto out_fdt; 123 fdt->fd = data; 124 125 data = kvmalloc(max_t(size_t, 126 2 * nr / BITS_PER_BYTE + BITBIT_SIZE(nr), L1_CACHE_BYTES), 127 GFP_KERNEL_ACCOUNT); 128 if (!data) 129 goto out_arr; 130 fdt->open_fds = data; 131 data += nr / BITS_PER_BYTE; 132 fdt->close_on_exec = data; 133 data += nr / BITS_PER_BYTE; 134 fdt->full_fds_bits = data; 135 136 return fdt; 137 138 out_arr: 139 kvfree(fdt->fd); 140 out_fdt: 141 kfree(fdt); 142 out: 143 return NULL; 144 } 145 146 /* 147 * Expand the file descriptor table. 148 * This function will allocate a new fdtable and both fd array and fdset, of 149 * the given size. 150 * Return <0 error code on error; 1 on successful completion. 151 * The files->file_lock should be held on entry, and will be held on exit. 152 */ 153 static int expand_fdtable(struct files_struct *files, unsigned int nr) 154 __releases(files->file_lock) 155 __acquires(files->file_lock) 156 { 157 struct fdtable *new_fdt, *cur_fdt; 158 159 spin_unlock(&files->file_lock); 160 new_fdt = alloc_fdtable(nr); 161 162 /* make sure all __fd_install() have seen resize_in_progress 163 * or have finished their rcu_read_lock_sched() section. 164 */ 165 if (atomic_read(&files->count) > 1) 166 synchronize_sched(); 167 168 spin_lock(&files->file_lock); 169 if (!new_fdt) 170 return -ENOMEM; 171 /* 172 * extremely unlikely race - sysctl_nr_open decreased between the check in 173 * caller and alloc_fdtable(). Cheaper to catch it here... 174 */ 175 if (unlikely(new_fdt->max_fds <= nr)) { 176 __free_fdtable(new_fdt); 177 return -EMFILE; 178 } 179 cur_fdt = files_fdtable(files); 180 BUG_ON(nr < cur_fdt->max_fds); 181 copy_fdtable(new_fdt, cur_fdt); 182 rcu_assign_pointer(files->fdt, new_fdt); 183 if (cur_fdt != &files->fdtab) 184 call_rcu(&cur_fdt->rcu, free_fdtable_rcu); 185 /* coupled with smp_rmb() in __fd_install() */ 186 smp_wmb(); 187 return 1; 188 } 189 190 /* 191 * Expand files. 192 * This function will expand the file structures, if the requested size exceeds 193 * the current capacity and there is room for expansion. 194 * Return <0 error code on error; 0 when nothing done; 1 when files were 195 * expanded and execution may have blocked. 196 * The files->file_lock should be held on entry, and will be held on exit. 197 */ 198 static int expand_files(struct files_struct *files, unsigned int nr) 199 __releases(files->file_lock) 200 __acquires(files->file_lock) 201 { 202 struct fdtable *fdt; 203 int expanded = 0; 204 205 repeat: 206 fdt = files_fdtable(files); 207 208 /* Do we need to expand? */ 209 if (nr < fdt->max_fds) 210 return expanded; 211 212 /* Can we expand? */ 213 if (nr >= sysctl_nr_open) 214 return -EMFILE; 215 216 if (unlikely(files->resize_in_progress)) { 217 spin_unlock(&files->file_lock); 218 expanded = 1; 219 wait_event(files->resize_wait, !files->resize_in_progress); 220 spin_lock(&files->file_lock); 221 goto repeat; 222 } 223 224 /* All good, so we try */ 225 files->resize_in_progress = true; 226 expanded = expand_fdtable(files, nr); 227 files->resize_in_progress = false; 228 229 wake_up_all(&files->resize_wait); 230 return expanded; 231 } 232 233 static inline void __set_close_on_exec(unsigned int fd, struct fdtable *fdt) 234 { 235 __set_bit(fd, fdt->close_on_exec); 236 } 237 238 static inline void __clear_close_on_exec(unsigned int fd, struct fdtable *fdt) 239 { 240 if (test_bit(fd, fdt->close_on_exec)) 241 __clear_bit(fd, fdt->close_on_exec); 242 } 243 244 static inline void __set_open_fd(unsigned int fd, struct fdtable *fdt) 245 { 246 __set_bit(fd, fdt->open_fds); 247 fd /= BITS_PER_LONG; 248 if (!~fdt->open_fds[fd]) 249 __set_bit(fd, fdt->full_fds_bits); 250 } 251 252 static inline void __clear_open_fd(unsigned int fd, struct fdtable *fdt) 253 { 254 __clear_bit(fd, fdt->open_fds); 255 __clear_bit(fd / BITS_PER_LONG, fdt->full_fds_bits); 256 } 257 258 static unsigned int count_open_files(struct fdtable *fdt) 259 { 260 unsigned int size = fdt->max_fds; 261 unsigned int i; 262 263 /* Find the last open fd */ 264 for (i = size / BITS_PER_LONG; i > 0; ) { 265 if (fdt->open_fds[--i]) 266 break; 267 } 268 i = (i + 1) * BITS_PER_LONG; 269 return i; 270 } 271 272 /* 273 * Allocate a new files structure and copy contents from the 274 * passed in files structure. 275 * errorp will be valid only when the returned files_struct is NULL. 276 */ 277 struct files_struct *dup_fd(struct files_struct *oldf, int *errorp) 278 { 279 struct files_struct *newf; 280 struct file **old_fds, **new_fds; 281 unsigned int open_files, i; 282 struct fdtable *old_fdt, *new_fdt; 283 284 *errorp = -ENOMEM; 285 newf = kmem_cache_alloc(files_cachep, GFP_KERNEL); 286 if (!newf) 287 goto out; 288 289 atomic_set(&newf->count, 1); 290 291 spin_lock_init(&newf->file_lock); 292 newf->resize_in_progress = false; 293 init_waitqueue_head(&newf->resize_wait); 294 newf->next_fd = 0; 295 new_fdt = &newf->fdtab; 296 new_fdt->max_fds = NR_OPEN_DEFAULT; 297 new_fdt->close_on_exec = newf->close_on_exec_init; 298 new_fdt->open_fds = newf->open_fds_init; 299 new_fdt->full_fds_bits = newf->full_fds_bits_init; 300 new_fdt->fd = &newf->fd_array[0]; 301 302 spin_lock(&oldf->file_lock); 303 old_fdt = files_fdtable(oldf); 304 open_files = count_open_files(old_fdt); 305 306 /* 307 * Check whether we need to allocate a larger fd array and fd set. 308 */ 309 while (unlikely(open_files > new_fdt->max_fds)) { 310 spin_unlock(&oldf->file_lock); 311 312 if (new_fdt != &newf->fdtab) 313 __free_fdtable(new_fdt); 314 315 new_fdt = alloc_fdtable(open_files - 1); 316 if (!new_fdt) { 317 *errorp = -ENOMEM; 318 goto out_release; 319 } 320 321 /* beyond sysctl_nr_open; nothing to do */ 322 if (unlikely(new_fdt->max_fds < open_files)) { 323 __free_fdtable(new_fdt); 324 *errorp = -EMFILE; 325 goto out_release; 326 } 327 328 /* 329 * Reacquire the oldf lock and a pointer to its fd table 330 * who knows it may have a new bigger fd table. We need 331 * the latest pointer. 332 */ 333 spin_lock(&oldf->file_lock); 334 old_fdt = files_fdtable(oldf); 335 open_files = count_open_files(old_fdt); 336 } 337 338 copy_fd_bitmaps(new_fdt, old_fdt, open_files); 339 340 old_fds = old_fdt->fd; 341 new_fds = new_fdt->fd; 342 343 for (i = open_files; i != 0; i--) { 344 struct file *f = *old_fds++; 345 if (f) { 346 get_file(f); 347 } else { 348 /* 349 * The fd may be claimed in the fd bitmap but not yet 350 * instantiated in the files array if a sibling thread 351 * is partway through open(). So make sure that this 352 * fd is available to the new process. 353 */ 354 __clear_open_fd(open_files - i, new_fdt); 355 } 356 rcu_assign_pointer(*new_fds++, f); 357 } 358 spin_unlock(&oldf->file_lock); 359 360 /* clear the remainder */ 361 memset(new_fds, 0, (new_fdt->max_fds - open_files) * sizeof(struct file *)); 362 363 rcu_assign_pointer(newf->fdt, new_fdt); 364 365 return newf; 366 367 out_release: 368 kmem_cache_free(files_cachep, newf); 369 out: 370 return NULL; 371 } 372 373 static struct fdtable *close_files(struct files_struct * files) 374 { 375 /* 376 * It is safe to dereference the fd table without RCU or 377 * ->file_lock because this is the last reference to the 378 * files structure. 379 */ 380 struct fdtable *fdt = rcu_dereference_raw(files->fdt); 381 unsigned int i, j = 0; 382 383 for (;;) { 384 unsigned long set; 385 i = j * BITS_PER_LONG; 386 if (i >= fdt->max_fds) 387 break; 388 set = fdt->open_fds[j++]; 389 while (set) { 390 if (set & 1) { 391 struct file * file = xchg(&fdt->fd[i], NULL); 392 if (file) { 393 filp_close(file, files); 394 cond_resched_rcu_qs(); 395 } 396 } 397 i++; 398 set >>= 1; 399 } 400 } 401 402 return fdt; 403 } 404 405 struct files_struct *get_files_struct(struct task_struct *task) 406 { 407 struct files_struct *files; 408 409 task_lock(task); 410 files = task->files; 411 if (files) 412 atomic_inc(&files->count); 413 task_unlock(task); 414 415 return files; 416 } 417 418 void put_files_struct(struct files_struct *files) 419 { 420 if (atomic_dec_and_test(&files->count)) { 421 struct fdtable *fdt = close_files(files); 422 423 /* free the arrays if they are not embedded */ 424 if (fdt != &files->fdtab) 425 __free_fdtable(fdt); 426 kmem_cache_free(files_cachep, files); 427 } 428 } 429 430 void reset_files_struct(struct files_struct *files) 431 { 432 struct task_struct *tsk = current; 433 struct files_struct *old; 434 435 old = tsk->files; 436 task_lock(tsk); 437 tsk->files = files; 438 task_unlock(tsk); 439 put_files_struct(old); 440 } 441 442 void exit_files(struct task_struct *tsk) 443 { 444 struct files_struct * files = tsk->files; 445 446 if (files) { 447 task_lock(tsk); 448 tsk->files = NULL; 449 task_unlock(tsk); 450 put_files_struct(files); 451 } 452 } 453 454 struct files_struct init_files = { 455 .count = ATOMIC_INIT(1), 456 .fdt = &init_files.fdtab, 457 .fdtab = { 458 .max_fds = NR_OPEN_DEFAULT, 459 .fd = &init_files.fd_array[0], 460 .close_on_exec = init_files.close_on_exec_init, 461 .open_fds = init_files.open_fds_init, 462 .full_fds_bits = init_files.full_fds_bits_init, 463 }, 464 .file_lock = __SPIN_LOCK_UNLOCKED(init_files.file_lock), 465 }; 466 467 static unsigned int find_next_fd(struct fdtable *fdt, unsigned int start) 468 { 469 unsigned int maxfd = fdt->max_fds; 470 unsigned int maxbit = maxfd / BITS_PER_LONG; 471 unsigned int bitbit = start / BITS_PER_LONG; 472 473 bitbit = find_next_zero_bit(fdt->full_fds_bits, maxbit, bitbit) * BITS_PER_LONG; 474 if (bitbit > maxfd) 475 return maxfd; 476 if (bitbit > start) 477 start = bitbit; 478 return find_next_zero_bit(fdt->open_fds, maxfd, start); 479 } 480 481 /* 482 * allocate a file descriptor, mark it busy. 483 */ 484 int __alloc_fd(struct files_struct *files, 485 unsigned start, unsigned end, unsigned flags) 486 { 487 unsigned int fd; 488 int error; 489 struct fdtable *fdt; 490 491 spin_lock(&files->file_lock); 492 repeat: 493 fdt = files_fdtable(files); 494 fd = start; 495 if (fd < files->next_fd) 496 fd = files->next_fd; 497 498 if (fd < fdt->max_fds) 499 fd = find_next_fd(fdt, fd); 500 501 /* 502 * N.B. For clone tasks sharing a files structure, this test 503 * will limit the total number of files that can be opened. 504 */ 505 error = -EMFILE; 506 if (fd >= end) 507 goto out; 508 509 error = expand_files(files, fd); 510 if (error < 0) 511 goto out; 512 513 /* 514 * If we needed to expand the fs array we 515 * might have blocked - try again. 516 */ 517 if (error) 518 goto repeat; 519 520 if (start <= files->next_fd) 521 files->next_fd = fd + 1; 522 523 __set_open_fd(fd, fdt); 524 if (flags & O_CLOEXEC) 525 __set_close_on_exec(fd, fdt); 526 else 527 __clear_close_on_exec(fd, fdt); 528 error = fd; 529 #if 1 530 /* Sanity check */ 531 if (rcu_access_pointer(fdt->fd[fd]) != NULL) { 532 printk(KERN_WARNING "alloc_fd: slot %d not NULL!\n", fd); 533 rcu_assign_pointer(fdt->fd[fd], NULL); 534 } 535 #endif 536 537 out: 538 spin_unlock(&files->file_lock); 539 return error; 540 } 541 542 static int alloc_fd(unsigned start, unsigned flags) 543 { 544 return __alloc_fd(current->files, start, rlimit(RLIMIT_NOFILE), flags); 545 } 546 547 int get_unused_fd_flags(unsigned flags) 548 { 549 return __alloc_fd(current->files, 0, rlimit(RLIMIT_NOFILE), flags); 550 } 551 EXPORT_SYMBOL(get_unused_fd_flags); 552 553 static void __put_unused_fd(struct files_struct *files, unsigned int fd) 554 { 555 struct fdtable *fdt = files_fdtable(files); 556 __clear_open_fd(fd, fdt); 557 if (fd < files->next_fd) 558 files->next_fd = fd; 559 } 560 561 void put_unused_fd(unsigned int fd) 562 { 563 struct files_struct *files = current->files; 564 spin_lock(&files->file_lock); 565 __put_unused_fd(files, fd); 566 spin_unlock(&files->file_lock); 567 } 568 569 EXPORT_SYMBOL(put_unused_fd); 570 571 /* 572 * Install a file pointer in the fd array. 573 * 574 * The VFS is full of places where we drop the files lock between 575 * setting the open_fds bitmap and installing the file in the file 576 * array. At any such point, we are vulnerable to a dup2() race 577 * installing a file in the array before us. We need to detect this and 578 * fput() the struct file we are about to overwrite in this case. 579 * 580 * It should never happen - if we allow dup2() do it, _really_ bad things 581 * will follow. 582 * 583 * NOTE: __fd_install() variant is really, really low-level; don't 584 * use it unless you are forced to by truly lousy API shoved down 585 * your throat. 'files' *MUST* be either current->files or obtained 586 * by get_files_struct(current) done by whoever had given it to you, 587 * or really bad things will happen. Normally you want to use 588 * fd_install() instead. 589 */ 590 591 void __fd_install(struct files_struct *files, unsigned int fd, 592 struct file *file) 593 { 594 struct fdtable *fdt; 595 596 might_sleep(); 597 rcu_read_lock_sched(); 598 599 while (unlikely(files->resize_in_progress)) { 600 rcu_read_unlock_sched(); 601 wait_event(files->resize_wait, !files->resize_in_progress); 602 rcu_read_lock_sched(); 603 } 604 /* coupled with smp_wmb() in expand_fdtable() */ 605 smp_rmb(); 606 fdt = rcu_dereference_sched(files->fdt); 607 BUG_ON(fdt->fd[fd] != NULL); 608 rcu_assign_pointer(fdt->fd[fd], file); 609 rcu_read_unlock_sched(); 610 } 611 612 void fd_install(unsigned int fd, struct file *file) 613 { 614 __fd_install(current->files, fd, file); 615 } 616 617 EXPORT_SYMBOL(fd_install); 618 619 /* 620 * The same warnings as for __alloc_fd()/__fd_install() apply here... 621 */ 622 int __close_fd(struct files_struct *files, unsigned fd) 623 { 624 struct file *file; 625 struct fdtable *fdt; 626 627 spin_lock(&files->file_lock); 628 fdt = files_fdtable(files); 629 if (fd >= fdt->max_fds) 630 goto out_unlock; 631 file = fdt->fd[fd]; 632 if (!file) 633 goto out_unlock; 634 rcu_assign_pointer(fdt->fd[fd], NULL); 635 __clear_close_on_exec(fd, fdt); 636 __put_unused_fd(files, fd); 637 spin_unlock(&files->file_lock); 638 return filp_close(file, files); 639 640 out_unlock: 641 spin_unlock(&files->file_lock); 642 return -EBADF; 643 } 644 645 void do_close_on_exec(struct files_struct *files) 646 { 647 unsigned i; 648 struct fdtable *fdt; 649 650 /* exec unshares first */ 651 spin_lock(&files->file_lock); 652 for (i = 0; ; i++) { 653 unsigned long set; 654 unsigned fd = i * BITS_PER_LONG; 655 fdt = files_fdtable(files); 656 if (fd >= fdt->max_fds) 657 break; 658 set = fdt->close_on_exec[i]; 659 if (!set) 660 continue; 661 fdt->close_on_exec[i] = 0; 662 for ( ; set ; fd++, set >>= 1) { 663 struct file *file; 664 if (!(set & 1)) 665 continue; 666 file = fdt->fd[fd]; 667 if (!file) 668 continue; 669 rcu_assign_pointer(fdt->fd[fd], NULL); 670 __put_unused_fd(files, fd); 671 spin_unlock(&files->file_lock); 672 filp_close(file, files); 673 cond_resched(); 674 spin_lock(&files->file_lock); 675 } 676 677 } 678 spin_unlock(&files->file_lock); 679 } 680 681 static struct file *__fget(unsigned int fd, fmode_t mask) 682 { 683 struct files_struct *files = current->files; 684 struct file *file; 685 686 rcu_read_lock(); 687 loop: 688 file = fcheck_files(files, fd); 689 if (file) { 690 /* File object ref couldn't be taken. 691 * dup2() atomicity guarantee is the reason 692 * we loop to catch the new file (or NULL pointer) 693 */ 694 if (file->f_mode & mask) 695 file = NULL; 696 else if (!get_file_rcu(file)) 697 goto loop; 698 } 699 rcu_read_unlock(); 700 701 return file; 702 } 703 704 struct file *fget(unsigned int fd) 705 { 706 return __fget(fd, FMODE_PATH); 707 } 708 EXPORT_SYMBOL(fget); 709 710 struct file *fget_raw(unsigned int fd) 711 { 712 return __fget(fd, 0); 713 } 714 EXPORT_SYMBOL(fget_raw); 715 716 /* 717 * Lightweight file lookup - no refcnt increment if fd table isn't shared. 718 * 719 * You can use this instead of fget if you satisfy all of the following 720 * conditions: 721 * 1) You must call fput_light before exiting the syscall and returning control 722 * to userspace (i.e. you cannot remember the returned struct file * after 723 * returning to userspace). 724 * 2) You must not call filp_close on the returned struct file * in between 725 * calls to fget_light and fput_light. 726 * 3) You must not clone the current task in between the calls to fget_light 727 * and fput_light. 728 * 729 * The fput_needed flag returned by fget_light should be passed to the 730 * corresponding fput_light. 731 */ 732 static unsigned long __fget_light(unsigned int fd, fmode_t mask) 733 { 734 struct files_struct *files = current->files; 735 struct file *file; 736 737 if (atomic_read(&files->count) == 1) { 738 file = __fcheck_files(files, fd); 739 if (!file || unlikely(file->f_mode & mask)) 740 return 0; 741 return (unsigned long)file; 742 } else { 743 file = __fget(fd, mask); 744 if (!file) 745 return 0; 746 return FDPUT_FPUT | (unsigned long)file; 747 } 748 } 749 unsigned long __fdget(unsigned int fd) 750 { 751 return __fget_light(fd, FMODE_PATH); 752 } 753 EXPORT_SYMBOL(__fdget); 754 755 unsigned long __fdget_raw(unsigned int fd) 756 { 757 return __fget_light(fd, 0); 758 } 759 760 unsigned long __fdget_pos(unsigned int fd) 761 { 762 unsigned long v = __fdget(fd); 763 struct file *file = (struct file *)(v & ~3); 764 765 if (file && (file->f_mode & FMODE_ATOMIC_POS)) { 766 if (file_count(file) > 1) { 767 v |= FDPUT_POS_UNLOCK; 768 mutex_lock(&file->f_pos_lock); 769 } 770 } 771 return v; 772 } 773 774 void __f_unlock_pos(struct file *f) 775 { 776 mutex_unlock(&f->f_pos_lock); 777 } 778 779 /* 780 * We only lock f_pos if we have threads or if the file might be 781 * shared with another process. In both cases we'll have an elevated 782 * file count (done either by fdget() or by fork()). 783 */ 784 785 void set_close_on_exec(unsigned int fd, int flag) 786 { 787 struct files_struct *files = current->files; 788 struct fdtable *fdt; 789 spin_lock(&files->file_lock); 790 fdt = files_fdtable(files); 791 if (flag) 792 __set_close_on_exec(fd, fdt); 793 else 794 __clear_close_on_exec(fd, fdt); 795 spin_unlock(&files->file_lock); 796 } 797 798 bool get_close_on_exec(unsigned int fd) 799 { 800 struct files_struct *files = current->files; 801 struct fdtable *fdt; 802 bool res; 803 rcu_read_lock(); 804 fdt = files_fdtable(files); 805 res = close_on_exec(fd, fdt); 806 rcu_read_unlock(); 807 return res; 808 } 809 810 static int do_dup2(struct files_struct *files, 811 struct file *file, unsigned fd, unsigned flags) 812 __releases(&files->file_lock) 813 { 814 struct file *tofree; 815 struct fdtable *fdt; 816 817 /* 818 * We need to detect attempts to do dup2() over allocated but still 819 * not finished descriptor. NB: OpenBSD avoids that at the price of 820 * extra work in their equivalent of fget() - they insert struct 821 * file immediately after grabbing descriptor, mark it larval if 822 * more work (e.g. actual opening) is needed and make sure that 823 * fget() treats larval files as absent. Potentially interesting, 824 * but while extra work in fget() is trivial, locking implications 825 * and amount of surgery on open()-related paths in VFS are not. 826 * FreeBSD fails with -EBADF in the same situation, NetBSD "solution" 827 * deadlocks in rather amusing ways, AFAICS. All of that is out of 828 * scope of POSIX or SUS, since neither considers shared descriptor 829 * tables and this condition does not arise without those. 830 */ 831 fdt = files_fdtable(files); 832 tofree = fdt->fd[fd]; 833 if (!tofree && fd_is_open(fd, fdt)) 834 goto Ebusy; 835 get_file(file); 836 rcu_assign_pointer(fdt->fd[fd], file); 837 __set_open_fd(fd, fdt); 838 if (flags & O_CLOEXEC) 839 __set_close_on_exec(fd, fdt); 840 else 841 __clear_close_on_exec(fd, fdt); 842 spin_unlock(&files->file_lock); 843 844 if (tofree) 845 filp_close(tofree, files); 846 847 return fd; 848 849 Ebusy: 850 spin_unlock(&files->file_lock); 851 return -EBUSY; 852 } 853 854 int replace_fd(unsigned fd, struct file *file, unsigned flags) 855 { 856 int err; 857 struct files_struct *files = current->files; 858 859 if (!file) 860 return __close_fd(files, fd); 861 862 if (fd >= rlimit(RLIMIT_NOFILE)) 863 return -EBADF; 864 865 spin_lock(&files->file_lock); 866 err = expand_files(files, fd); 867 if (unlikely(err < 0)) 868 goto out_unlock; 869 return do_dup2(files, file, fd, flags); 870 871 out_unlock: 872 spin_unlock(&files->file_lock); 873 return err; 874 } 875 876 SYSCALL_DEFINE3(dup3, unsigned int, oldfd, unsigned int, newfd, int, flags) 877 { 878 int err = -EBADF; 879 struct file *file; 880 struct files_struct *files = current->files; 881 882 if ((flags & ~O_CLOEXEC) != 0) 883 return -EINVAL; 884 885 if (unlikely(oldfd == newfd)) 886 return -EINVAL; 887 888 if (newfd >= rlimit(RLIMIT_NOFILE)) 889 return -EBADF; 890 891 spin_lock(&files->file_lock); 892 err = expand_files(files, newfd); 893 file = fcheck(oldfd); 894 if (unlikely(!file)) 895 goto Ebadf; 896 if (unlikely(err < 0)) { 897 if (err == -EMFILE) 898 goto Ebadf; 899 goto out_unlock; 900 } 901 return do_dup2(files, file, newfd, flags); 902 903 Ebadf: 904 err = -EBADF; 905 out_unlock: 906 spin_unlock(&files->file_lock); 907 return err; 908 } 909 910 SYSCALL_DEFINE2(dup2, unsigned int, oldfd, unsigned int, newfd) 911 { 912 if (unlikely(newfd == oldfd)) { /* corner case */ 913 struct files_struct *files = current->files; 914 int retval = oldfd; 915 916 rcu_read_lock(); 917 if (!fcheck_files(files, oldfd)) 918 retval = -EBADF; 919 rcu_read_unlock(); 920 return retval; 921 } 922 return sys_dup3(oldfd, newfd, 0); 923 } 924 925 SYSCALL_DEFINE1(dup, unsigned int, fildes) 926 { 927 int ret = -EBADF; 928 struct file *file = fget_raw(fildes); 929 930 if (file) { 931 ret = get_unused_fd_flags(0); 932 if (ret >= 0) 933 fd_install(ret, file); 934 else 935 fput(file); 936 } 937 return ret; 938 } 939 940 int f_dupfd(unsigned int from, struct file *file, unsigned flags) 941 { 942 int err; 943 if (from >= rlimit(RLIMIT_NOFILE)) 944 return -EINVAL; 945 err = alloc_fd(from, flags); 946 if (err >= 0) { 947 get_file(file); 948 fd_install(err, file); 949 } 950 return err; 951 } 952 953 int iterate_fd(struct files_struct *files, unsigned n, 954 int (*f)(const void *, struct file *, unsigned), 955 const void *p) 956 { 957 struct fdtable *fdt; 958 int res = 0; 959 if (!files) 960 return 0; 961 spin_lock(&files->file_lock); 962 for (fdt = files_fdtable(files); n < fdt->max_fds; n++) { 963 struct file *file; 964 file = rcu_dereference_check_fdtable(files, fdt->fd[n]); 965 if (!file) 966 continue; 967 res = f(p, file, n); 968 if (res) 969 break; 970 } 971 spin_unlock(&files->file_lock); 972 return res; 973 } 974 EXPORT_SYMBOL(iterate_fd); 975