// SPDX-License-Identifier: GPL-2.0#include <linux/kernel.h>#include <linux/errno.h>#include <linux/fs.h>#include <linux/file.h>#include <linux/fdtable.h>#include <linux/fsnotify.h>#include <linux/namei.h>#include <linux/pipe_fs_i.h>#include <linux/watch_queue.h>#include <linux/io_uring.h> #include <uapi/linux/io_uring.h> #include "../fs/internal.h" #include "filetable.h"#include "io_uring.h"#include "rsrc.h"#include "openclose.h" struct io_open {	struct file			*file;	int				dfd;	u32				file_slot;	struct delayed_filename		filename;	struct open_how			how;	unsigned long			nofile;}; struct io_close {	struct file			*file;	int				fd;	u32				file_slot;}; struct io_fixed_install {	struct file			*file;	unsigned int			o_flags;}; static bool io_openat_force_async(struct io_open *open){	/*	 * Don't bother trying for O_TRUNC, O_CREAT, or O_TMPFILE open,	 * it'll always -EAGAIN. Note that we test for __O_TMPFILE because	 * O_TMPFILE includes O_DIRECTORY, which isn't a flag we need to force	 * async for.	 */	return open->how.flags & (O_TRUNC | O_CREAT | __O_TMPFILE);} static int __io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe){	struct io_open *open = io_kiocb_to_cmd(req, struct io_open);	const char __user *fname;	int ret; 	if (unlikely(sqe->buf_index))		return -EINVAL;	if (unlikely(req->flags & REQ_F_FIXED_FILE))		return -EBADF; 	/* open.how should be already initialised */	if (!(open->how.flags & O_PATH) && force_o_largefile())		open->how.flags |= O_LARGEFILE; 	open->dfd = READ_ONCE(sqe->fd);	fname = u64_to_user_ptr(READ_ONCE(sqe->addr));	ret = delayed_getname(&open->filename, fname);	if (unlikely(ret))		return ret;	req->flags |= REQ_F_NEED_CLEANUP; 	open->file_slot = READ_ONCE(sqe->file_index);	if (open->file_slot && (open->how.flags & O_CLOEXEC))		return -EINVAL; 	open->nofile = rlimit(RLIMIT_NOFILE);	if (io_openat_force_async(open))		req->flags |= REQ_F_FORCE_ASYNC;	return 0;} void io_openat_bpf_populate(struct io_uring_bpf_ctx *bctx, struct io_kiocb *req){	struct io_open *open = io_kiocb_to_cmd(req, struct io_open); 	bctx->open.flags = open->how.flags;	bctx->open.mode = open->how.mode;	bctx->open.resolve = open->how.resolve;} int io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe){	struct io_open *open = io_kiocb_to_cmd(req, struct io_open);	u64 mode = READ_ONCE(sqe->len);	u64 flags = READ_ONCE(sqe->open_flags); 	open->how = build_open_how(flags, mode);	return __io_openat_prep(req, sqe);} int io_openat2_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe){	struct io_open *open = io_kiocb_to_cmd(req, struct io_open);	struct open_how __user *how;	size_t len;	int ret; 	how = u64_to_user_ptr(READ_ONCE(sqe->addr2));	len = READ_ONCE(sqe->len);	if (len < OPEN_HOW_SIZE_VER0)		return -EINVAL; 	ret = copy_struct_from_user(&open->how, sizeof(open->how), how, len);	if (ret)		return ret; 	return __io_openat_prep(req, sqe);} int io_openat2(struct io_kiocb *req, unsigned int issue_flags){	struct io_open *open = io_kiocb_to_cmd(req, struct io_open);	struct open_flags op;	struct file *file;	bool resolve_nonblock, nonblock_set;	bool fixed = !!open->file_slot;	CLASS(filename_complete_delayed, name)(&open->filename);	int ret; 	ret = build_open_flags(&open->how, &op);	if (ret)		goto err;	nonblock_set = op.open_flag & O_NONBLOCK;	resolve_nonblock = open->how.resolve & RESOLVE_CACHED;	if (issue_flags & IO_URING_F_NONBLOCK) {		WARN_ON_ONCE(io_openat_force_async(open));		op.lookup_flags |= LOOKUP_CACHED;		op.open_flag |= O_NONBLOCK;	} 	if (!fixed) {		ret = __get_unused_fd_flags(open->how.flags, open->nofile);		if (ret < 0)			goto err;	} 	file = do_file_open(open->dfd, name, &op);	if (IS_ERR(file)) {		/*		 * We could hang on to this 'fd' on retrying, but seems like		 * marginal gain for something that is now known to be a slower		 * path. So just put it, and we'll get a new one when we retry.		 */		if (!fixed)			put_unused_fd(ret); 		ret = PTR_ERR(file);		/* only retry if RESOLVE_CACHED wasn't already set by application */		if (ret == -EAGAIN && !resolve_nonblock &&		    (issue_flags & IO_URING_F_NONBLOCK)) {			ret = putname_to_delayed(&open->filename,						 no_free_ptr(name));			if (likely(!ret))				return -EAGAIN;		}		goto err;	} 	if ((issue_flags & IO_URING_F_NONBLOCK) && !nonblock_set)		file->f_flags &= ~O_NONBLOCK; 	if (!fixed)		fd_install(ret, file);	else		ret = io_fixed_fd_install(req, issue_flags, file,						open->file_slot);err:	req->flags &= ~REQ_F_NEED_CLEANUP;	if (ret < 0)		req_set_fail(req);	io_req_set_res(req, ret, 0);	return IOU_COMPLETE;} int io_openat(struct io_kiocb *req, unsigned int issue_flags){	return io_openat2(req, issue_flags);} void io_open_cleanup(struct io_kiocb *req){	struct io_open *open = io_kiocb_to_cmd(req, struct io_open); 	dismiss_delayed_filename(&open->filename);} int __io_close_fixed(struct io_ring_ctx *ctx, unsigned int issue_flags,		     unsigned int offset){	int ret; 	io_ring_submit_lock(ctx, issue_flags);	ret = io_fixed_fd_remove(ctx, offset);	io_ring_submit_unlock(ctx, issue_flags); 	return ret;} static inline int io_close_fixed(struct io_kiocb *req, unsigned int issue_flags){	struct io_close *close = io_kiocb_to_cmd(req, struct io_close); 	return __io_close_fixed(req->ctx, issue_flags, close->file_slot - 1);} int io_close_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe){	struct io_close *close = io_kiocb_to_cmd(req, struct io_close); 	if (sqe->off || sqe->addr || sqe->len || sqe->rw_flags || sqe->buf_index)		return -EINVAL;	if (req->flags & REQ_F_FIXED_FILE)		return -EBADF; 	close->fd = READ_ONCE(sqe->fd);	close->file_slot = READ_ONCE(sqe->file_index);	if (close->file_slot && close->fd)		return -EINVAL; 	return 0;} int io_close(struct io_kiocb *req, unsigned int issue_flags){	struct files_struct *files = current->files;	struct io_close *close = io_kiocb_to_cmd(req, struct io_close);	struct file *file;	int ret = -EBADF; 	if (close->file_slot) {		ret = io_close_fixed(req, issue_flags);		goto err;	} 	spin_lock(&files->file_lock);	file = files_lookup_fd_locked(files, close->fd);	if (!file || io_is_uring_fops(file)) {		spin_unlock(&files->file_lock);		goto err;	} 	/* if the file has a flush method, be safe and punt to async */	if (file->f_op->flush && (issue_flags & IO_URING_F_NONBLOCK)) {		spin_unlock(&files->file_lock);		return -EAGAIN;	} 	file = file_close_fd_locked(files, close->fd);	spin_unlock(&files->file_lock);	if (!file)		goto err; 	/* No ->flush() or already async, safely close from here */	ret = filp_close(file, current->files);err:	if (ret < 0)		req_set_fail(req);	io_req_set_res(req, ret, 0);	return IOU_COMPLETE;} int io_install_fixed_fd_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe){	struct io_fixed_install *ifi;	unsigned int flags; 	if (sqe->off || sqe->addr || sqe->len || sqe->buf_index ||	    sqe->splice_fd_in || sqe->addr3)		return -EINVAL; 	/* must be a fixed file */	if (!(req->flags & REQ_F_FIXED_FILE))		return -EBADF; 	flags = READ_ONCE(sqe->install_fd_flags);	if (flags & ~IORING_FIXED_FD_NO_CLOEXEC)		return -EINVAL; 	/* ensure the task's creds are used when installing/receiving fds */	if (req->flags & REQ_F_CREDS)		return -EPERM; 	/* default to O_CLOEXEC, disable if IORING_FIXED_FD_NO_CLOEXEC is set */	ifi = io_kiocb_to_cmd(req, struct io_fixed_install);	ifi->o_flags = O_CLOEXEC;	if (flags & IORING_FIXED_FD_NO_CLOEXEC)		ifi->o_flags = 0; 	return 0;} int io_install_fixed_fd(struct io_kiocb *req, unsigned int issue_flags){	struct io_fixed_install *ifi;	int ret; 	ifi = io_kiocb_to_cmd(req, struct io_fixed_install);	ret = receive_fd(req->file, NULL, ifi->o_flags);	if (ret < 0)		req_set_fail(req);	io_req_set_res(req, ret, 0);	return IOU_COMPLETE;} struct io_pipe {	struct file *file;	int __user *fds;	int flags;	int file_slot;	unsigned long nofile;}; int io_pipe_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe){	struct io_pipe *p = io_kiocb_to_cmd(req, struct io_pipe); 	if (sqe->fd || sqe->off || sqe->addr3)		return -EINVAL; 	p->fds = u64_to_user_ptr(READ_ONCE(sqe->addr));	p->flags = READ_ONCE(sqe->pipe_flags);	if (p->flags & ~(O_CLOEXEC | O_NONBLOCK | O_DIRECT | O_NOTIFICATION_PIPE))		return -EINVAL; 	p->file_slot = READ_ONCE(sqe->file_index);	p->nofile = rlimit(RLIMIT_NOFILE);	return 0;} static int io_pipe_fixed(struct io_kiocb *req, struct file **files,			 unsigned int issue_flags){	struct io_pipe *p = io_kiocb_to_cmd(req, struct io_pipe);	struct io_ring_ctx *ctx = req->ctx;	bool alloc_slot;	int ret, fds[2] = { -1, -1 };	int slot = p->file_slot; 	if (p->flags & O_CLOEXEC)		return -EINVAL; 	alloc_slot = slot == IORING_FILE_INDEX_ALLOC; 	io_ring_submit_lock(ctx, issue_flags); 	ret = __io_fixed_fd_install(ctx, files[0], slot);	if (ret < 0)		goto err;	fds[0] = alloc_slot ? ret : slot - 1;	files[0] = NULL; 	/*	 * If a specific slot is given, next one will be used for	 * the write side.	 */	if (!alloc_slot)		slot++; 	ret = __io_fixed_fd_install(ctx, files[1], slot);	if (ret < 0)		goto err;	fds[1] = alloc_slot ? ret : slot - 1;	files[1] = NULL; 	io_ring_submit_unlock(ctx, issue_flags); 	if (!copy_to_user(p->fds, fds, sizeof(fds)))		return 0; 	ret = -EFAULT;	io_ring_submit_lock(ctx, issue_flags);err:	if (fds[0] != -1)		io_fixed_fd_remove(ctx, fds[0]);	if (fds[1] != -1)		io_fixed_fd_remove(ctx, fds[1]);	io_ring_submit_unlock(ctx, issue_flags);	return ret;} static int io_pipe_fd(struct io_kiocb *req, struct file **files){	struct io_pipe *p = io_kiocb_to_cmd(req, struct io_pipe);	int ret, fds[2] = { -1, -1 }; 	ret = __get_unused_fd_flags(p->flags, p->nofile);	if (ret < 0)		goto err;	fds[0] = ret; 	ret = __get_unused_fd_flags(p->flags, p->nofile);	if (ret < 0)		goto err;	fds[1] = ret; 	if (!copy_to_user(p->fds, fds, sizeof(fds))) {		fd_install(fds[0], files[0]);		fd_install(fds[1], files[1]);		return 0;	}	ret = -EFAULT;err:	if (fds[0] != -1)		put_unused_fd(fds[0]);	if (fds[1] != -1)		put_unused_fd(fds[1]);	return ret;} int io_pipe(struct io_kiocb *req, unsigned int issue_flags){	struct io_pipe *p = io_kiocb_to_cmd(req, struct io_pipe);	struct file *files[2];	int ret; 	ret = create_pipe_files(files, p->flags);	if (ret)		return ret; 	if (!!p->file_slot)		ret = io_pipe_fixed(req, files, issue_flags);	else		ret = io_pipe_fd(req, files); 	io_req_set_res(req, ret, 0);	if (!ret)		return IOU_COMPLETE; 	req_set_fail(req);	if (files[0])		fput(files[0]);	if (files[1])		fput(files[1]);	return ret;}