file.c 21.5 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2 3 4 5 6 7 8
/*
 *  linux/fs/file.c
 *
 *  Copyright (C) 1998-1999, Stephen Tweedie and Bill Hawes
 *
 *  Manage the dynamic fd arrays in the process files_struct.
 */

9
#include <linux/syscalls.h>
10
#include <linux/export.h>
Linus Torvalds's avatar
Linus Torvalds committed
11 12
#include <linux/fs.h>
#include <linux/mm.h>
13
#include <linux/mmzone.h>
Linus Torvalds's avatar
Linus Torvalds committed
14
#include <linux/time.h>
15
#include <linux/sched.h>
Linus Torvalds's avatar
Linus Torvalds committed
16 17 18
#include <linux/slab.h>
#include <linux/vmalloc.h>
#include <linux/file.h>
Al Viro's avatar
Al Viro committed
19
#include <linux/fdtable.h>
Linus Torvalds's avatar
Linus Torvalds committed
20
#include <linux/bitops.h>
21 22 23 24 25
#include <linux/interrupt.h>
#include <linux/spinlock.h>
#include <linux/rcupdate.h>
#include <linux/workqueue.h>

26
int sysctl_nr_open __read_mostly = 1024*1024;
27
int sysctl_nr_open_min = BITS_PER_LONG;
Al Viro's avatar
Al Viro committed
28 29 30 31
/* our max() is unusable in constant expressions ;-/ */
#define __const_max(x, y) ((x) < (y) ? (x) : (y))
int sysctl_nr_open_max = __const_max(INT_MAX, ~(size_t)0/sizeof(void *)) &
			 -BITS_PER_LONG;
32

33
static void *alloc_fdmem(size_t size)
Linus Torvalds's avatar
Linus Torvalds committed
34
{
35 36 37 38 39
	/*
	 * Very large allocations can stress page reclaim, so fall back to
	 * vmalloc() if the allocation size will be considered "large" by the VM.
	 */
	if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
40
		void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY);
41 42 43
		if (data != NULL)
			return data;
	}
44
	return vmalloc(size);
Linus Torvalds's avatar
Linus Torvalds committed
45 46
}

47
static void __free_fdtable(struct fdtable *fdt)
Linus Torvalds's avatar
Linus Torvalds committed
48
{
49 50
	kvfree(fdt->fd);
	kvfree(fdt->open_fds);
51
	kfree(fdt);
52
}
Linus Torvalds's avatar
Linus Torvalds committed
53

54
static void free_fdtable_rcu(struct rcu_head *rcu)
55
{
56
	__free_fdtable(container_of(rcu, struct fdtable, rcu));
57 58 59 60 61 62
}

/*
 * Expand the fdset in the files_struct.  Called with the files spinlock
 * held for write.
 */
63
static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt)
64
{
65
	unsigned int cpy, set;
66

67 68 69 70 71 72 73 74 75 76 77 78 79
	BUG_ON(nfdt->max_fds < ofdt->max_fds);

	cpy = ofdt->max_fds * sizeof(struct file *);
	set = (nfdt->max_fds - ofdt->max_fds) * sizeof(struct file *);
	memcpy(nfdt->fd, ofdt->fd, cpy);
	memset((char *)(nfdt->fd) + cpy, 0, set);

	cpy = ofdt->max_fds / BITS_PER_BYTE;
	set = (nfdt->max_fds - ofdt->max_fds) / BITS_PER_BYTE;
	memcpy(nfdt->open_fds, ofdt->open_fds, cpy);
	memset((char *)(nfdt->open_fds) + cpy, 0, set);
	memcpy(nfdt->close_on_exec, ofdt->close_on_exec, cpy);
	memset((char *)(nfdt->close_on_exec) + cpy, 0, set);
Linus Torvalds's avatar
Linus Torvalds committed
80 81
}

82
static struct fdtable * alloc_fdtable(unsigned int nr)
Linus Torvalds's avatar
Linus Torvalds committed
83
{
84
	struct fdtable *fdt;
85
	void *data;
Linus Torvalds's avatar
Linus Torvalds committed
86

87
	/*
88 89 90 91 92
	 * Figure out how many fds we actually want to support in this fdtable.
	 * Allocation steps are keyed to the size of the fdarray, since it
	 * grows far faster than any of the other dynamic data. We try to fit
	 * the fdarray into comfortable page-tuned chunks: starting at 1024B
	 * and growing in powers of two from there on.
93
	 */
94 95 96
	nr /= (1024 / sizeof(struct file *));
	nr = roundup_pow_of_two(nr + 1);
	nr *= (1024 / sizeof(struct file *));
97 98 99 100 101 102 103 104 105 106
	/*
	 * Note that this can drive nr *below* what we had passed if sysctl_nr_open
	 * had been set lower between the check in expand_files() and here.  Deal
	 * with that in caller, it's cheaper that way.
	 *
	 * We make sure that nr remains a multiple of BITS_PER_LONG - otherwise
	 * bitmaps handling below becomes unpleasant, to put it mildly...
	 */
	if (unlikely(nr > sysctl_nr_open))
		nr = ((sysctl_nr_open - 1) | (BITS_PER_LONG - 1)) + 1;
107

108 109
	fdt = kmalloc(sizeof(struct fdtable), GFP_KERNEL);
	if (!fdt)
110
		goto out;
111 112 113 114
	fdt->max_fds = nr;
	data = alloc_fdmem(nr * sizeof(struct file *));
	if (!data)
		goto out_fdt;
115 116 117
	fdt->fd = data;

	data = alloc_fdmem(max_t(size_t,
118 119 120
				 2 * nr / BITS_PER_BYTE, L1_CACHE_BYTES));
	if (!data)
		goto out_arr;
121
	fdt->open_fds = data;
122
	data += nr / BITS_PER_BYTE;
123
	fdt->close_on_exec = data;
124

125
	return fdt;
126 127

out_arr:
128
	kvfree(fdt->fd);
129
out_fdt:
130
	kfree(fdt);
131
out:
132 133
	return NULL;
}
Linus Torvalds's avatar
Linus Torvalds committed
134

135
/*
136 137 138 139 140
 * Expand the file descriptor table.
 * This function will allocate a new fdtable and both fd array and fdset, of
 * the given size.
 * Return <0 error code on error; 1 on successful completion.
 * The files->file_lock should be held on entry, and will be held on exit.
141 142 143 144 145
 */
static int expand_fdtable(struct files_struct *files, int nr)
	__releases(files->file_lock)
	__acquires(files->file_lock)
{
146
	struct fdtable *new_fdt, *cur_fdt;
147 148

	spin_unlock(&files->file_lock);
149
	new_fdt = alloc_fdtable(nr);
150
	spin_lock(&files->file_lock);
151 152
	if (!new_fdt)
		return -ENOMEM;
153 154 155 156 157
	/*
	 * extremely unlikely race - sysctl_nr_open decreased between the check in
	 * caller and alloc_fdtable().  Cheaper to catch it here...
	 */
	if (unlikely(new_fdt->max_fds <= nr)) {
158
		__free_fdtable(new_fdt);
159 160
		return -EMFILE;
	}
161
	/*
162 163
	 * Check again since another task may have expanded the fd table while
	 * we dropped the lock
164
	 */
165
	cur_fdt = files_fdtable(files);
166
	if (nr >= cur_fdt->max_fds) {
167 168 169
		/* Continue as planned */
		copy_fdtable(new_fdt, cur_fdt);
		rcu_assign_pointer(files->fdt, new_fdt);
170
		if (cur_fdt != &files->fdtab)
Al Viro's avatar
Al Viro committed
171
			call_rcu(&cur_fdt->rcu, free_fdtable_rcu);
172
	} else {
173
		/* Somebody else expanded, so undo our attempt */
174
		__free_fdtable(new_fdt);
175
	}
176
	return 1;
Linus Torvalds's avatar
Linus Torvalds committed
177 178 179 180
}

/*
 * Expand files.
181 182 183 184 185
 * This function will expand the file structures, if the requested size exceeds
 * the current capacity and there is room for expansion.
 * Return <0 error code on error; 0 when nothing done; 1 when files were
 * expanded and execution may have blocked.
 * The files->file_lock should be held on entry, and will be held on exit.
Linus Torvalds's avatar
Linus Torvalds committed
186
 */
187
static int expand_files(struct files_struct *files, int nr)
Linus Torvalds's avatar
Linus Torvalds committed
188
{
189
	struct fdtable *fdt;
Linus Torvalds's avatar
Linus Torvalds committed
190

191
	fdt = files_fdtable(files);
192

193
	/* Do we need to expand? */
194
	if (nr < fdt->max_fds)
195
		return 0;
196

197
	/* Can we expand? */
198
	if (nr >= sysctl_nr_open)
199 200 201 202
		return -EMFILE;

	/* All good, so we try */
	return expand_fdtable(files, nr);
Linus Torvalds's avatar
Linus Torvalds committed
203
}
204

205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224
static inline void __set_close_on_exec(int fd, struct fdtable *fdt)
{
	__set_bit(fd, fdt->close_on_exec);
}

static inline void __clear_close_on_exec(int fd, struct fdtable *fdt)
{
	__clear_bit(fd, fdt->close_on_exec);
}

static inline void __set_open_fd(int fd, struct fdtable *fdt)
{
	__set_bit(fd, fdt->open_fds);
}

static inline void __clear_open_fd(int fd, struct fdtable *fdt)
{
	__clear_bit(fd, fdt->open_fds);
}

Al Viro's avatar
Al Viro committed
225 226 227 228 229 230
static int count_open_files(struct fdtable *fdt)
{
	int size = fdt->max_fds;
	int i;

	/* Find the last open fd */
231 232
	for (i = size / BITS_PER_LONG; i > 0; ) {
		if (fdt->open_fds[--i])
Al Viro's avatar
Al Viro committed
233 234
			break;
	}
235
	i = (i + 1) * BITS_PER_LONG;
Al Viro's avatar
Al Viro committed
236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251
	return i;
}

/*
 * Allocate a new files structure and copy contents from the
 * passed in files structure.
 * errorp will be valid only when the returned files_struct is NULL.
 */
struct files_struct *dup_fd(struct files_struct *oldf, int *errorp)
{
	struct files_struct *newf;
	struct file **old_fds, **new_fds;
	int open_files, size, i;
	struct fdtable *old_fdt, *new_fdt;

	*errorp = -ENOMEM;
Al Viro's avatar
Al Viro committed
252
	newf = kmem_cache_alloc(files_cachep, GFP_KERNEL);
Al Viro's avatar
Al Viro committed
253 254 255
	if (!newf)
		goto out;

Al Viro's avatar
Al Viro committed
256 257 258 259 260 261
	atomic_set(&newf->count, 1);

	spin_lock_init(&newf->file_lock);
	newf->next_fd = 0;
	new_fdt = &newf->fdtab;
	new_fdt->max_fds = NR_OPEN_DEFAULT;
262 263
	new_fdt->close_on_exec = newf->close_on_exec_init;
	new_fdt->open_fds = newf->open_fds_init;
Al Viro's avatar
Al Viro committed
264 265
	new_fdt->fd = &newf->fd_array[0];

Al Viro's avatar
Al Viro committed
266 267 268 269 270 271 272
	spin_lock(&oldf->file_lock);
	old_fdt = files_fdtable(oldf);
	open_files = count_open_files(old_fdt);

	/*
	 * Check whether we need to allocate a larger fd array and fd set.
	 */
273
	while (unlikely(open_files > new_fdt->max_fds)) {
Al Viro's avatar
Al Viro committed
274
		spin_unlock(&oldf->file_lock);
Al Viro's avatar
Al Viro committed
275

276 277
		if (new_fdt != &newf->fdtab)
			__free_fdtable(new_fdt);
278

Al Viro's avatar
Al Viro committed
279 280 281 282 283 284 285 286
		new_fdt = alloc_fdtable(open_files - 1);
		if (!new_fdt) {
			*errorp = -ENOMEM;
			goto out_release;
		}

		/* beyond sysctl_nr_open; nothing to do */
		if (unlikely(new_fdt->max_fds < open_files)) {
287
			__free_fdtable(new_fdt);
Al Viro's avatar
Al Viro committed
288
			*errorp = -EMFILE;
Al Viro's avatar
Al Viro committed
289
			goto out_release;
Al Viro's avatar
Al Viro committed
290 291
		}

Al Viro's avatar
Al Viro committed
292 293 294 295 296 297 298
		/*
		 * Reacquire the oldf lock and a pointer to its fd table
		 * who knows it may have a new bigger fd table. We need
		 * the latest pointer.
		 */
		spin_lock(&oldf->file_lock);
		old_fdt = files_fdtable(oldf);
299
		open_files = count_open_files(old_fdt);
Al Viro's avatar
Al Viro committed
300 301 302 303 304
	}

	old_fds = old_fdt->fd;
	new_fds = new_fdt->fd;

305 306
	memcpy(new_fdt->open_fds, old_fdt->open_fds, open_files / 8);
	memcpy(new_fdt->close_on_exec, old_fdt->close_on_exec, open_files / 8);
Al Viro's avatar
Al Viro committed
307 308 309 310 311 312 313 314 315 316 317 318

	for (i = open_files; i != 0; i--) {
		struct file *f = *old_fds++;
		if (f) {
			get_file(f);
		} else {
			/*
			 * The fd may be claimed in the fd bitmap but not yet
			 * instantiated in the files array if a sibling thread
			 * is partway through open().  So make sure that this
			 * fd is available to the new process.
			 */
319
			__clear_open_fd(open_files - i, new_fdt);
Al Viro's avatar
Al Viro committed
320 321 322 323 324 325 326 327 328 329 330 331
		}
		rcu_assign_pointer(*new_fds++, f);
	}
	spin_unlock(&oldf->file_lock);

	/* compute the remainder to be cleared */
	size = (new_fdt->max_fds - open_files) * sizeof(struct file *);

	/* This is long word aligned thus could use a optimized version */
	memset(new_fds, 0, size);

	if (new_fdt->max_fds > open_files) {
332 333
		int left = (new_fdt->max_fds - open_files) / 8;
		int start = open_files / BITS_PER_LONG;
Al Viro's avatar
Al Viro committed
334

335 336
		memset(&new_fdt->open_fds[start], 0, left);
		memset(&new_fdt->close_on_exec[start], 0, left);
Al Viro's avatar
Al Viro committed
337 338
	}

Al Viro's avatar
Al Viro committed
339 340
	rcu_assign_pointer(newf->fdt, new_fdt);

Al Viro's avatar
Al Viro committed
341 342 343 344 345 346 347 348
	return newf;

out_release:
	kmem_cache_free(files_cachep, newf);
out:
	return NULL;
}

349
static struct fdtable *close_files(struct files_struct * files)
350 351 352 353
{
	/*
	 * It is safe to dereference the fd table without RCU or
	 * ->file_lock because this is the last reference to the
354
	 * files structure.
355
	 */
356 357 358
	struct fdtable *fdt = rcu_dereference_raw(files->fdt);
	int i, j = 0;

359 360 361 362 363 364 365 366 367 368 369
	for (;;) {
		unsigned long set;
		i = j * BITS_PER_LONG;
		if (i >= fdt->max_fds)
			break;
		set = fdt->open_fds[j++];
		while (set) {
			if (set & 1) {
				struct file * file = xchg(&fdt->fd[i], NULL);
				if (file) {
					filp_close(file, files);
370
					cond_resched_rcu_qs();
371 372 373 374 375 376
				}
			}
			i++;
			set >>= 1;
		}
	}
377 378

	return fdt;
379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396
}

struct files_struct *get_files_struct(struct task_struct *task)
{
	struct files_struct *files;

	task_lock(task);
	files = task->files;
	if (files)
		atomic_inc(&files->count);
	task_unlock(task);

	return files;
}

void put_files_struct(struct files_struct *files)
{
	if (atomic_dec_and_test(&files->count)) {
397 398
		struct fdtable *fdt = close_files(files);

399 400 401 402
		/* free the arrays if they are not embedded */
		if (fdt != &files->fdtab)
			__free_fdtable(fdt);
		kmem_cache_free(files_cachep, files);
403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429
	}
}

void reset_files_struct(struct files_struct *files)
{
	struct task_struct *tsk = current;
	struct files_struct *old;

	old = tsk->files;
	task_lock(tsk);
	tsk->files = files;
	task_unlock(tsk);
	put_files_struct(old);
}

void exit_files(struct task_struct *tsk)
{
	struct files_struct * files = tsk->files;

	if (files) {
		task_lock(tsk);
		tsk->files = NULL;
		task_unlock(tsk);
		put_files_struct(files);
	}
}

430 431 432 433 434 435
struct files_struct init_files = {
	.count		= ATOMIC_INIT(1),
	.fdt		= &init_files.fdtab,
	.fdtab		= {
		.max_fds	= NR_OPEN_DEFAULT,
		.fd		= &init_files.fd_array[0],
436 437
		.close_on_exec	= init_files.close_on_exec_init,
		.open_fds	= init_files.open_fds_init,
438
	},
439
	.file_lock	= __SPIN_LOCK_UNLOCKED(init_files.file_lock),
440
};
441 442 443 444

/*
 * allocate a file descriptor, mark it busy.
 */
Al Viro's avatar
Al Viro committed
445 446
int __alloc_fd(struct files_struct *files,
	       unsigned start, unsigned end, unsigned flags)
447 448 449 450 451 452 453 454 455 456 457 458 459
{
	unsigned int fd;
	int error;
	struct fdtable *fdt;

	spin_lock(&files->file_lock);
repeat:
	fdt = files_fdtable(files);
	fd = start;
	if (fd < files->next_fd)
		fd = files->next_fd;

	if (fd < fdt->max_fds)
460
		fd = find_next_zero_bit(fdt->open_fds, fdt->max_fds, fd);
461

462 463 464 465 466 467 468 469
	/*
	 * N.B. For clone tasks sharing a files structure, this test
	 * will limit the total number of files that can be opened.
	 */
	error = -EMFILE;
	if (fd >= end)
		goto out;

470 471 472 473 474 475 476 477 478 479 480 481 482 483
	error = expand_files(files, fd);
	if (error < 0)
		goto out;

	/*
	 * If we needed to expand the fs array we
	 * might have blocked - try again.
	 */
	if (error)
		goto repeat;

	if (start <= files->next_fd)
		files->next_fd = fd + 1;

484
	__set_open_fd(fd, fdt);
485
	if (flags & O_CLOEXEC)
486
		__set_close_on_exec(fd, fdt);
487
	else
488
		__clear_close_on_exec(fd, fdt);
489 490 491
	error = fd;
#if 1
	/* Sanity check */
492
	if (rcu_access_pointer(fdt->fd[fd]) != NULL) {
493 494 495 496 497 498 499 500 501 502
		printk(KERN_WARNING "alloc_fd: slot %d not NULL!\n", fd);
		rcu_assign_pointer(fdt->fd[fd], NULL);
	}
#endif

out:
	spin_unlock(&files->file_lock);
	return error;
}

503
static int alloc_fd(unsigned start, unsigned flags)
Al Viro's avatar
Al Viro committed
504 505 506 507
{
	return __alloc_fd(current->files, start, rlimit(RLIMIT_NOFILE), flags);
}

508
int get_unused_fd_flags(unsigned flags)
509
{
Al Viro's avatar
Al Viro committed
510
	return __alloc_fd(current->files, 0, rlimit(RLIMIT_NOFILE), flags);
511
}
512
EXPORT_SYMBOL(get_unused_fd_flags);
513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542

static void __put_unused_fd(struct files_struct *files, unsigned int fd)
{
	struct fdtable *fdt = files_fdtable(files);
	__clear_open_fd(fd, fdt);
	if (fd < files->next_fd)
		files->next_fd = fd;
}

void put_unused_fd(unsigned int fd)
{
	struct files_struct *files = current->files;
	spin_lock(&files->file_lock);
	__put_unused_fd(files, fd);
	spin_unlock(&files->file_lock);
}

EXPORT_SYMBOL(put_unused_fd);

/*
 * Install a file pointer in the fd array.
 *
 * The VFS is full of places where we drop the files lock between
 * setting the open_fds bitmap and installing the file in the file
 * array.  At any such point, we are vulnerable to a dup2() race
 * installing a file in the array before us.  We need to detect this and
 * fput() the struct file we are about to overwrite in this case.
 *
 * It should never happen - if we allow dup2() do it, _really_ bad things
 * will follow.
543 544 545 546 547 548 549
 *
 * NOTE: __fd_install() variant is really, really low-level; don't
 * use it unless you are forced to by truly lousy API shoved down
 * your throat.  'files' *MUST* be either current->files or obtained
 * by get_files_struct(current) done by whoever had given it to you,
 * or really bad things will happen.  Normally you want to use
 * fd_install() instead.
550 551
 */

552 553
void __fd_install(struct files_struct *files, unsigned int fd,
		struct file *file)
554 555 556 557 558 559 560 561 562
{
	struct fdtable *fdt;
	spin_lock(&files->file_lock);
	fdt = files_fdtable(files);
	BUG_ON(fdt->fd[fd] != NULL);
	rcu_assign_pointer(fdt->fd[fd], file);
	spin_unlock(&files->file_lock);
}

563 564 565 566 567
void fd_install(unsigned int fd, struct file *file)
{
	__fd_install(current->files, fd, file);
}

568
EXPORT_SYMBOL(fd_install);
569

570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595
/*
 * The same warnings as for __alloc_fd()/__fd_install() apply here...
 */
int __close_fd(struct files_struct *files, unsigned fd)
{
	struct file *file;
	struct fdtable *fdt;

	spin_lock(&files->file_lock);
	fdt = files_fdtable(files);
	if (fd >= fdt->max_fds)
		goto out_unlock;
	file = fdt->fd[fd];
	if (!file)
		goto out_unlock;
	rcu_assign_pointer(fdt->fd[fd], NULL);
	__clear_close_on_exec(fd, fdt);
	__put_unused_fd(files, fd);
	spin_unlock(&files->file_lock);
	return filp_close(file, files);

out_unlock:
	spin_unlock(&files->file_lock);
	return -EBADF;
}

596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631
void do_close_on_exec(struct files_struct *files)
{
	unsigned i;
	struct fdtable *fdt;

	/* exec unshares first */
	spin_lock(&files->file_lock);
	for (i = 0; ; i++) {
		unsigned long set;
		unsigned fd = i * BITS_PER_LONG;
		fdt = files_fdtable(files);
		if (fd >= fdt->max_fds)
			break;
		set = fdt->close_on_exec[i];
		if (!set)
			continue;
		fdt->close_on_exec[i] = 0;
		for ( ; set ; fd++, set >>= 1) {
			struct file *file;
			if (!(set & 1))
				continue;
			file = fdt->fd[fd];
			if (!file)
				continue;
			rcu_assign_pointer(fdt->fd[fd], NULL);
			__put_unused_fd(files, fd);
			spin_unlock(&files->file_lock);
			filp_close(file, files);
			cond_resched();
			spin_lock(&files->file_lock);
		}

	}
	spin_unlock(&files->file_lock);
}

632
static struct file *__fget(unsigned int fd, fmode_t mask)
633 634
{
	struct files_struct *files = current->files;
635
	struct file *file;
636 637 638 639 640

	rcu_read_lock();
	file = fcheck_files(files, fd);
	if (file) {
		/* File object ref couldn't be taken */
641
		if ((file->f_mode & mask) ||
642 643 644 645 646 647 648 649
		    !atomic_long_inc_not_zero(&file->f_count))
			file = NULL;
	}
	rcu_read_unlock();

	return file;
}

650 651 652 653
struct file *fget(unsigned int fd)
{
	return __fget(fd, FMODE_PATH);
}
654 655 656 657
EXPORT_SYMBOL(fget);

struct file *fget_raw(unsigned int fd)
{
658
	return __fget(fd, 0);
659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677
}
EXPORT_SYMBOL(fget_raw);

/*
 * Lightweight file lookup - no refcnt increment if fd table isn't shared.
 *
 * You can use this instead of fget if you satisfy all of the following
 * conditions:
 * 1) You must call fput_light before exiting the syscall and returning control
 *    to userspace (i.e. you cannot remember the returned struct file * after
 *    returning to userspace).
 * 2) You must not call filp_close on the returned struct file * in between
 *    calls to fget_light and fput_light.
 * 3) You must not clone the current task in between the calls to fget_light
 *    and fput_light.
 *
 * The fput_needed flag returned by fget_light should be passed to the
 * corresponding fput_light.
 */
Al Viro's avatar
Al Viro committed
678
static unsigned long __fget_light(unsigned int fd, fmode_t mask)
679 680
{
	struct files_struct *files = current->files;
681
	struct file *file;
682 683

	if (atomic_read(&files->count) == 1) {
684
		file = __fcheck_files(files, fd);
Al Viro's avatar
Al Viro committed
685 686 687
		if (!file || unlikely(file->f_mode & mask))
			return 0;
		return (unsigned long)file;
688
	} else {
689
		file = __fget(fd, mask);
Al Viro's avatar
Al Viro committed
690 691 692
		if (!file)
			return 0;
		return FDPUT_FPUT | (unsigned long)file;
693 694
	}
}
Al Viro's avatar
Al Viro committed
695
unsigned long __fdget(unsigned int fd)
696
{
Al Viro's avatar
Al Viro committed
697
	return __fget_light(fd, FMODE_PATH);
698
}
Al Viro's avatar
Al Viro committed
699
EXPORT_SYMBOL(__fdget);
700

Al Viro's avatar
Al Viro committed
701
unsigned long __fdget_raw(unsigned int fd)
702
{
Al Viro's avatar
Al Viro committed
703
	return __fget_light(fd, 0);
704
}
705

Al Viro's avatar
Al Viro committed
706 707
unsigned long __fdget_pos(unsigned int fd)
{
708 709
	unsigned long v = __fdget(fd);
	struct file *file = (struct file *)(v & ~3);
Al Viro's avatar
Al Viro committed
710

711
	if (file && (file->f_mode & FMODE_ATOMIC_POS)) {
Al Viro's avatar
Al Viro committed
712 713 714 715 716
		if (file_count(file) > 1) {
			v |= FDPUT_POS_UNLOCK;
			mutex_lock(&file->f_pos_lock);
		}
	}
717
	return v;
Al Viro's avatar
Al Viro committed
718 719 720 721 722 723 724 725
}

/*
 * We only lock f_pos if we have threads or if the file might be
 * shared with another process. In both cases we'll have an elevated
 * file count (done either by fdget() or by fork()).
 */

726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750
void set_close_on_exec(unsigned int fd, int flag)
{
	struct files_struct *files = current->files;
	struct fdtable *fdt;
	spin_lock(&files->file_lock);
	fdt = files_fdtable(files);
	if (flag)
		__set_close_on_exec(fd, fdt);
	else
		__clear_close_on_exec(fd, fdt);
	spin_unlock(&files->file_lock);
}

bool get_close_on_exec(unsigned int fd)
{
	struct files_struct *files = current->files;
	struct fdtable *fdt;
	bool res;
	rcu_read_lock();
	fdt = files_fdtable(files);
	res = close_on_exec(fd, fdt);
	rcu_read_unlock();
	return res;
}

Al Viro's avatar
Al Viro committed
751 752
static int do_dup2(struct files_struct *files,
	struct file *file, unsigned fd, unsigned flags)
753
{
Al Viro's avatar
Al Viro committed
754
	struct file *tofree;
755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771
	struct fdtable *fdt;

	/*
	 * We need to detect attempts to do dup2() over allocated but still
	 * not finished descriptor.  NB: OpenBSD avoids that at the price of
	 * extra work in their equivalent of fget() - they insert struct
	 * file immediately after grabbing descriptor, mark it larval if
	 * more work (e.g. actual opening) is needed and make sure that
	 * fget() treats larval files as absent.  Potentially interesting,
	 * but while extra work in fget() is trivial, locking implications
	 * and amount of surgery on open()-related paths in VFS are not.
	 * FreeBSD fails with -EBADF in the same situation, NetBSD "solution"
	 * deadlocks in rather amusing ways, AFAICS.  All of that is out of
	 * scope of POSIX or SUS, since neither considers shared descriptor
	 * tables and this condition does not arise without those.
	 */
	fdt = files_fdtable(files);
Al Viro's avatar
Al Viro committed
772 773 774
	tofree = fdt->fd[fd];
	if (!tofree && fd_is_open(fd, fdt))
		goto Ebusy;
775
	get_file(file);
Al Viro's avatar
Al Viro committed
776 777
	rcu_assign_pointer(fdt->fd[fd], file);
	__set_open_fd(fd, fdt);
778
	if (flags & O_CLOEXEC)
Al Viro's avatar
Al Viro committed
779
		__set_close_on_exec(fd, fdt);
780
	else
Al Viro's avatar
Al Viro committed
781
		__clear_close_on_exec(fd, fdt);
782 783 784 785 786
	spin_unlock(&files->file_lock);

	if (tofree)
		filp_close(tofree, files);

Al Viro's avatar
Al Viro committed
787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802
	return fd;

Ebusy:
	spin_unlock(&files->file_lock);
	return -EBUSY;
}

int replace_fd(unsigned fd, struct file *file, unsigned flags)
{
	int err;
	struct files_struct *files = current->files;

	if (!file)
		return __close_fd(files, fd);

	if (fd >= rlimit(RLIMIT_NOFILE))
803
		return -EBADF;
Al Viro's avatar
Al Viro committed
804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824

	spin_lock(&files->file_lock);
	err = expand_files(files, fd);
	if (unlikely(err < 0))
		goto out_unlock;
	return do_dup2(files, file, fd, flags);

out_unlock:
	spin_unlock(&files->file_lock);
	return err;
}

SYSCALL_DEFINE3(dup3, unsigned int, oldfd, unsigned int, newfd, int, flags)
{
	int err = -EBADF;
	struct file *file;
	struct files_struct *files = current->files;

	if ((flags & ~O_CLOEXEC) != 0)
		return -EINVAL;

825 826 827
	if (unlikely(oldfd == newfd))
		return -EINVAL;

Al Viro's avatar
Al Viro committed
828
	if (newfd >= rlimit(RLIMIT_NOFILE))
829
		return -EBADF;
Al Viro's avatar
Al Viro committed
830 831 832 833 834 835 836 837 838 839 840 841

	spin_lock(&files->file_lock);
	err = expand_files(files, newfd);
	file = fcheck(oldfd);
	if (unlikely(!file))
		goto Ebadf;
	if (unlikely(err < 0)) {
		if (err == -EMFILE)
			goto Ebadf;
		goto out_unlock;
	}
	return do_dup2(files, file, newfd, flags);
842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891

Ebadf:
	err = -EBADF;
out_unlock:
	spin_unlock(&files->file_lock);
	return err;
}

SYSCALL_DEFINE2(dup2, unsigned int, oldfd, unsigned int, newfd)
{
	if (unlikely(newfd == oldfd)) { /* corner case */
		struct files_struct *files = current->files;
		int retval = oldfd;

		rcu_read_lock();
		if (!fcheck_files(files, oldfd))
			retval = -EBADF;
		rcu_read_unlock();
		return retval;
	}
	return sys_dup3(oldfd, newfd, 0);
}

SYSCALL_DEFINE1(dup, unsigned int, fildes)
{
	int ret = -EBADF;
	struct file *file = fget_raw(fildes);

	if (file) {
		ret = get_unused_fd();
		if (ret >= 0)
			fd_install(ret, file);
		else
			fput(file);
	}
	return ret;
}

int f_dupfd(unsigned int from, struct file *file, unsigned flags)
{
	int err;
	if (from >= rlimit(RLIMIT_NOFILE))
		return -EINVAL;
	err = alloc_fd(from, flags);
	if (err >= 0) {
		get_file(file);
		fd_install(err, file);
	}
	return err;
}
Al Viro's avatar
Al Viro committed
892 893 894 895 896 897 898 899 900 901

int iterate_fd(struct files_struct *files, unsigned n,
		int (*f)(const void *, struct file *, unsigned),
		const void *p)
{
	struct fdtable *fdt;
	int res = 0;
	if (!files)
		return 0;
	spin_lock(&files->file_lock);
902 903 904 905 906 907 908 909
	for (fdt = files_fdtable(files); n < fdt->max_fds; n++) {
		struct file *file;
		file = rcu_dereference_check_fdtable(files, fdt->fd[n]);
		if (!file)
			continue;
		res = f(p, file, n);
		if (res)
			break;
Al Viro's avatar
Al Viro committed
910 911 912 913 914
	}
	spin_unlock(&files->file_lock);
	return res;
}
EXPORT_SYMBOL(iterate_fd);