3  *  linux/fs/file.c
17 #include <linux/file.h>
36 	if (WARN_ONCE(cnt >= FILE_REF_RELEASED, "imbalanced put on file reference count")) {  in __file_ref_put_badval()
121  * space if any.  This does not copy the file pointers.  Called with the files
138  * Copy all file descriptors from the old table to the new, expanded table and
147 	cpy = ofdt->max_fds * sizeof(struct file *);  in copy_fdtable()
148 	set = (nfdt->max_fds - ofdt->max_fds) * sizeof(struct file *);  in copy_fdtable()
204 	data = kvmalloc_array(nr, sizeof(struct file *), GFP_KERNEL_ACCOUNT);  in alloc_fdtable()
231  * Expand the file descriptor table.
268  * This function will expand the file structures, if the requested size exceeds
371 	struct file **old_fds, **new_fds;  in dup_fd()
432 	 * the file can show up as we are walking the array below.  in dup_fd()
438 	 * ref the file if we see it and mark the fd slot as unused otherwise.  in dup_fd()
441 		struct file *f = rcu_dereference_raw(*old_fds++);  in dup_fd()
452 	memset(new_fds, 0, (new_fdt->max_fds - open_files) * sizeof(struct file *));  in dup_fd()
477 				struct file *file = fdt->fd[i];  in close_files()  local
478 				if (file) {  in close_files()
479 					filp_close(file, files);  in close_files()
553  * allocate a file descriptor, mark it busy.
630  * fd_install - install a file pointer in the fd array
631  * @fd: file descriptor to install the file in
632  * @file: the file to install
634  * This consumes the "file" refcount, so callers should treat it
635  * as if they had called fput(file).
637 void fd_install(unsigned int fd, struct file *file)  in fd_install()  argument
642 	if (WARN_ON_ONCE(unlikely(file->f_mode & FMODE_BACKING)))  in fd_install()
652 		rcu_assign_pointer(fdt->fd[fd], file);  in fd_install()
660 	rcu_assign_pointer(fdt->fd[fd], file);  in fd_install()
667  * file_close_fd_locked - return file associated with fd
668  * @files: file struct to retrieve file from
669  * @fd: file descriptor to retrieve file for
675  * Returns: The file associated with @fd (NULL if @fd is not open)
677 struct file *file_close_fd_locked(struct files_struct *files, unsigned fd)  in file_close_fd_locked()
680 	struct file *file;  in file_close_fd_locked()  local
688 	file = rcu_dereference_raw(fdt->fd[fd]);  in file_close_fd_locked()
689 	if (file) {  in file_close_fd_locked()
693 	return file;  in file_close_fd_locked()
699 	struct file *file;  in close_fd()  local
702 	file = file_close_fd_locked(files, fd);  in close_fd()
704 	if (!file)  in close_fd()
707 	return filp_close(file, files);  in close_fd()
713  * @fdt: File descriptor table.
741 	struct file *file;  in __range_close()  local
749 		file = file_close_fd_locked(files, fd);  in __range_close()
750 		if (file) {  in __range_close()
752 			filp_close(file, files);  in __range_close()
765  * sys_close_range() - Close all file descriptors in a given range.
767  * @fd:     starting file descriptor to close
768  * @max_fd: last file descriptor to close
771  * This closes a range of file descriptors. All file descriptors
773  * Currently, errors to close a given file descriptor are ignored.
792 		 * copy all of the file descriptors since they still want to  in SYSCALL_DEFINE3()
802 		 * We used to share our file descriptor table, and have now  in SYSCALL_DEFINE3()
816 		 * the new file descriptor table and drop the old one.  in SYSCALL_DEFINE3()
828  * file_close_fd - return file associated with fd
829  * @fd: file descriptor to retrieve file for
833  * Returns: The file associated with @fd (NULL if @fd is not open)
835 struct file *file_close_fd(unsigned int fd)  in file_close_fd()
838 	struct file *file;  in file_close_fd()  local
841 	file = file_close_fd_locked(files, fd);  in file_close_fd()
844 	return file;  in file_close_fd()
865 			struct file *file;  in do_close_on_exec()  local
868 			file = fdt->fd[fd];  in do_close_on_exec()
869 			if (!file)  in do_close_on_exec()
874 			filp_close(file, files);  in do_close_on_exec()
883 static struct file *__get_file_rcu(struct file __rcu **f)  in __get_file_rcu()
885 	struct file __rcu *file;  in __get_file_rcu()  local
886 	struct file __rcu *file_reloaded;  in __get_file_rcu()
887 	struct file __rcu *file_reloaded_cmp;  in __get_file_rcu()
889 	file = rcu_dereference_raw(*f);  in __get_file_rcu()
890 	if (!file)  in __get_file_rcu()
893 	if (unlikely(!file_ref_get(&file->f_ref)))  in __get_file_rcu()
911 	 * __rcu protected file pointer so that if that pointer still  in __get_file_rcu()
912 	 * matches the current file, we know we have successfully  in __get_file_rcu()
913 	 * acquired a reference to the right file.  in __get_file_rcu()
915 	 * If the pointers don't match the file has been reallocated by  in __get_file_rcu()
918 	if (file == file_reloaded_cmp)  in __get_file_rcu()
921 	fput(file);  in __get_file_rcu()
926  * get_file_rcu - try go get a reference to a file under rcu
927  * @f: the file to get a reference on
937 struct file *get_file_rcu(struct file __rcu **f)  in get_file_rcu()
940 		struct file __rcu *file;  in get_file_rcu()  local
942 		file = __get_file_rcu(f);  in get_file_rcu()
943 		if (!IS_ERR(file))  in get_file_rcu()
944 			return file;  in get_file_rcu()
950  * get_file_active - try go get a reference to a file
951  * @f: the file to get a reference on
961 struct file *get_file_active(struct file **f)  in get_file_active()
963 	struct file __rcu *file;  in get_file_active()  local
966 	file = __get_file_rcu(f);  in get_file_active()
968 	if (IS_ERR(file))  in get_file_active()
969 		file = NULL;  in get_file_active()
970 	return file;  in get_file_active()
974 static inline struct file *__fget_files_rcu(struct files_struct *files,  in __fget_files_rcu()
978 		struct file *file;  in __fget_files_rcu()  local
980 		struct file __rcu **fdentry;  in __fget_files_rcu()
994 		file = rcu_dereference_raw(*fdentry);  in __fget_files_rcu()
995 		file = (void *)(nospec_mask & (unsigned long)file);  in __fget_files_rcu()
996 		if (unlikely(!file))  in __fget_files_rcu()
1000 		 * Ok, we have a file pointer that was valid at  in __fget_files_rcu()
1010 		if (unlikely(!file_ref_get(&file->f_ref)))  in __fget_files_rcu()
1016 		 *  (a) the file ref already went down to zero and the  in __fget_files_rcu()
1017 		 *      file hasn't been reused yet or the file count  in __fget_files_rcu()
1018 		 *      isn't zero but the file has already been reused.  in __fget_files_rcu()
1020 		 *  (b) the file table entry has changed under us.  in __fget_files_rcu()
1027 		if (unlikely(file != rcu_dereference_raw(*fdentry)) ||  in __fget_files_rcu()
1029 			fput(file);  in __fget_files_rcu()
1034 		 * This isn't the file we're looking for or we're not  in __fget_files_rcu()
1037 		if (unlikely(file->f_mode & mask)) {  in __fget_files_rcu()
1038 			fput(file);  in __fget_files_rcu()
1043 		 * Ok, we have a ref to the file, and checked that it  in __fget_files_rcu()
1046 		return file;  in __fget_files_rcu()
1050 static struct file *__fget_files(struct files_struct *files, unsigned int fd,  in __fget_files()
1053 	struct file *file;  in __fget_files()  local
1056 	file = __fget_files_rcu(files, fd, mask);  in __fget_files()
1059 	return file;  in __fget_files()
1062 static inline struct file *__fget(unsigned int fd, fmode_t mask)  in __fget()
1067 struct file *fget(unsigned int fd)  in fget()
1073 struct file *fget_raw(unsigned int fd)  in fget_raw()
1079 struct file *fget_task(struct task_struct *task, unsigned int fd)  in fget_task()
1081 	struct file *file = NULL;  in fget_task()  local
1085 		file = __fget_files(task->files, fd, 0);  in fget_task()
1088 	return file;  in fget_task()
1091 struct file *fget_task_next(struct task_struct *task, unsigned int *ret_fd)  in fget_task_next()
1096 	struct file *file = NULL;  in fget_task_next()  local
1103 			file = __fget_files_rcu(files, fd, 0);  in fget_task_next()
1104 			if (file)  in fget_task_next()
1111 	return file;  in fget_task_next()
1116  * Lightweight file lookup - no refcnt increment if fd table isn't shared.
1121  *    to userspace (i.e. you cannot remember the returned struct file * after
1123  * 2) You must not call filp_close on the returned struct file * in between
1136  * See also the documentation in rust/kernel/file.rs.
1141 	struct file *file;  in __fget_light()  local
1147 	 * return a file that is concurrently being freed.  in __fget_light()
1153 		file = files_lookup_fd_raw(files, fd);  in __fget_light()
1154 		if (!file || unlikely(file->f_mode & mask))  in __fget_light()
1156 		return BORROWED_FD(file);  in __fget_light()
1158 		file = __fget_files(files, fd, mask);  in __fget_light()
1159 		if (!file)  in __fget_light()
1161 		return CLONED_FD(file);  in __fget_light()
1177  * file is marked for FMODE_ATOMIC_POS, and it can be
1181  * can make a file accessible even if it otherwise would
1185 static inline bool file_needs_f_pos_lock(struct file *file)  in file_needs_f_pos_lock()  argument
1187 	if (!(file->f_mode & FMODE_ATOMIC_POS))  in file_needs_f_pos_lock()
1189 	if (__file_ref_read_raw(&file->f_ref) != FILE_REF_ONEREF)  in file_needs_f_pos_lock()
1191 	if (file->f_op->iterate_shared)  in file_needs_f_pos_lock()
1196 bool file_seek_cur_needs_f_lock(struct file *file)  in file_seek_cur_needs_f_lock()  argument
1198 	if (!(file->f_mode & FMODE_ATOMIC_POS) && !file->f_op->iterate_shared)  in file_seek_cur_needs_f_lock()
1201 	VFS_WARN_ON_ONCE((file_count(file) > 1) &&  in file_seek_cur_needs_f_lock()
1202 			 !mutex_is_locked(&file->f_pos_lock));  in file_seek_cur_needs_f_lock()
1209 	struct file *file = fd_file(f);  in fdget_pos()  local
1211 	if (likely(file) && file_needs_f_pos_lock(file)) {  in fdget_pos()
1213 		mutex_lock(&file->f_pos_lock);  in fdget_pos()
1218 void __f_unlock_pos(struct file *f)  in __f_unlock_pos()
1224  * We only lock f_pos if we have threads or if the file might be
1226  * file count (done either by fdget() or by fork()).
1247 	struct file *file, unsigned fd, unsigned flags)  in do_dup2()  argument
1250 	struct file *tofree;  in do_dup2()
1254 	 * dup2() is expected to close the file installed in the target fd slot  in do_dup2()
1261 	 * file = hard_work_goes_here();  in do_dup2()
1262 	 * fd_install(fd, file);           // only now ->fd[fd] == file  in do_dup2()
1267 	 * If we fit the window, we have the fd to populate, yet no target file  in do_dup2()
1268 	 * to close. Trying to ignore it and install our new file would violate  in do_dup2()
1269 	 * the invariant and make fd_install() overwrite our file.  in do_dup2()
1284 	get_file(file);  in do_dup2()
1285 	rcu_assign_pointer(fdt->fd[fd], file);  in do_dup2()
1299 int replace_fd(unsigned fd, struct file *file, unsigned flags)  in replace_fd()  argument
1304 	if (!file)  in replace_fd()
1314 	return do_dup2(files, file, fd, flags);  in replace_fd()
1322  * receive_fd() - Install received file into file descriptor table
1323  * @file: struct file that was received from another process
1327  * Installs a received file into the file descriptor table, with appropriate
1332  * struct file.
1336 int receive_fd(struct file *file, int __user *ufd, unsigned int o_flags)  in receive_fd()  argument
1341 	error = security_file_receive(file);  in receive_fd()
1357 	fd_install(new_fd, get_file(file));  in receive_fd()
1358 	__receive_sock(file);  in receive_fd()
1363 int receive_fd_replace(int new_fd, struct file *file, unsigned int o_flags)  in receive_fd_replace()  argument
1367 	error = security_file_receive(file);  in receive_fd_replace()
1370 	error = replace_fd(new_fd, file, o_flags);  in receive_fd_replace()
1373 	__receive_sock(file);  in receive_fd_replace()
1380 	struct file *file;  in ksys_dup3()  local
1394 	file = files_lookup_fd_locked(files, oldfd);  in ksys_dup3()
1395 	if (unlikely(!file))  in ksys_dup3()
1402 	return do_dup2(files, file, newfd, flags);  in ksys_dup3()
1420 		struct file *f;  in SYSCALL_DEFINE2()
1438 	struct file *file = fget_raw(fildes);  in SYSCALL_DEFINE1()  local
1440 	if (file) {  in SYSCALL_DEFINE1()
1443 			fd_install(ret, file);  in SYSCALL_DEFINE1()
1445 			fput(file);  in SYSCALL_DEFINE1()
1450 int f_dupfd(unsigned int from, struct file *file, unsigned flags)  in f_dupfd()  argument
1458 		get_file(file);  in f_dupfd()
1459 		fd_install(err, file);  in f_dupfd()
1465 		int (*f)(const void *, struct file *, unsigned),  in iterate_fd()  argument
1474 		struct file *file;  in iterate_fd()  local
1475 		file = rcu_dereference_check_fdtable(files, fdt->fd[n]);  in iterate_fd()
1476 		if (!file)  in iterate_fd()
1478 		res = f(p, file, n);  in iterate_fd()