1/* SPDX-License-Identifier: GPL-2.0 */
2#include <linux/fsnotify_backend.h>
3#include <linux/path.h>
4#include <linux/slab.h>
5#include <linux/exportfs.h>
6#include <linux/hashtable.h>
7
8extern struct kmem_cache *fanotify_mark_cache;
9extern struct kmem_cache *fanotify_fid_event_cachep;
10extern struct kmem_cache *fanotify_path_event_cachep;
11extern struct kmem_cache *fanotify_perm_event_cachep;
12extern struct kmem_cache *fanotify_mnt_event_cachep;
13
14/* Possible states of the permission event */
15enum {
16 FAN_EVENT_INIT,
17 FAN_EVENT_REPORTED,
18 FAN_EVENT_ANSWERED,
19 FAN_EVENT_CANCELED,
20};
21
22/*
23 * 3 dwords are sufficient for most local fs (64bit ino, 32bit generation).
24 * fh buf should be dword aligned. On 64bit arch, the ext_buf pointer is
25 * stored in either the first or last 2 dwords.
26 */
27#define FANOTIFY_INLINE_FH_LEN (3 << 2)
28#define FANOTIFY_FH_HDR_LEN sizeof(struct fanotify_fh)
29
30/* Fixed size struct for file handle */
31struct fanotify_fh {
32 u8 type;
33 u8 len;
34#define FANOTIFY_FH_FLAG_EXT_BUF 1
35 u8 flags;
36 u8 pad;
37} __aligned(4);
38
39/* Variable size struct for dir file handle + child file handle + name */
40struct fanotify_info {
41 /* size of dir_fh/file_fh including fanotify_fh hdr size */
42 u8 dir_fh_totlen;
43 u8 dir2_fh_totlen;
44 u8 file_fh_totlen;
45 u8 name_len;
46 u8 name2_len;
47 u8 pad[3];
48 unsigned char buf[];
49 /*
50 * (struct fanotify_fh) dir_fh starts at buf[0]
51 * (optional) dir2_fh starts at buf[dir_fh_totlen]
52 * (optional) file_fh starts at buf[dir_fh_totlen + dir2_fh_totlen]
53 * name starts at buf[dir_fh_totlen + dir2_fh_totlen + file_fh_totlen]
54 * ...
55 */
56#define FANOTIFY_DIR_FH_SIZE(info) ((info)->dir_fh_totlen)
57#define FANOTIFY_DIR2_FH_SIZE(info) ((info)->dir2_fh_totlen)
58#define FANOTIFY_FILE_FH_SIZE(info) ((info)->file_fh_totlen)
59#define FANOTIFY_NAME_SIZE(info) ((info)->name_len + 1)
60#define FANOTIFY_NAME2_SIZE(info) ((info)->name2_len + 1)
61
62#define FANOTIFY_DIR_FH_OFFSET(info) 0
63#define FANOTIFY_DIR2_FH_OFFSET(info) \
64 (FANOTIFY_DIR_FH_OFFSET(info) + FANOTIFY_DIR_FH_SIZE(info))
65#define FANOTIFY_FILE_FH_OFFSET(info) \
66 (FANOTIFY_DIR2_FH_OFFSET(info) + FANOTIFY_DIR2_FH_SIZE(info))
67#define FANOTIFY_NAME_OFFSET(info) \
68 (FANOTIFY_FILE_FH_OFFSET(info) + FANOTIFY_FILE_FH_SIZE(info))
69#define FANOTIFY_NAME2_OFFSET(info) \
70 (FANOTIFY_NAME_OFFSET(info) + FANOTIFY_NAME_SIZE(info))
71
72#define FANOTIFY_DIR_FH_BUF(info) \
73 ((info)->buf + FANOTIFY_DIR_FH_OFFSET(info))
74#define FANOTIFY_DIR2_FH_BUF(info) \
75 ((info)->buf + FANOTIFY_DIR2_FH_OFFSET(info))
76#define FANOTIFY_FILE_FH_BUF(info) \
77 ((info)->buf + FANOTIFY_FILE_FH_OFFSET(info))
78#define FANOTIFY_NAME_BUF(info) \
79 ((info)->buf + FANOTIFY_NAME_OFFSET(info))
80#define FANOTIFY_NAME2_BUF(info) \
81 ((info)->buf + FANOTIFY_NAME2_OFFSET(info))
82} __aligned(4);
83
84static inline bool fanotify_fh_has_ext_buf(struct fanotify_fh *fh)
85{
86 return (fh->flags & FANOTIFY_FH_FLAG_EXT_BUF);
87}
88
89static inline char **fanotify_fh_ext_buf_ptr(struct fanotify_fh *fh)
90{
91 BUILD_BUG_ON(FANOTIFY_FH_HDR_LEN % 4);
92 BUILD_BUG_ON(__alignof__(char *) - 4 + sizeof(char *) >
93 FANOTIFY_INLINE_FH_LEN);
94 return (char **)ALIGN((unsigned long)(fh + 1), __alignof__(char *));
95}
96
97static inline void *fanotify_fh_ext_buf(struct fanotify_fh *fh)
98{
99 return *fanotify_fh_ext_buf_ptr(fh);
100}
101
102static inline void *fanotify_fh_buf(struct fanotify_fh *fh)
103{
104 return fanotify_fh_has_ext_buf(fh) ? fanotify_fh_ext_buf(fh) : fh + 1;
105}
106
107static inline int fanotify_info_dir_fh_len(struct fanotify_info *info)
108{
109 if (!info->dir_fh_totlen ||
110 WARN_ON_ONCE(info->dir_fh_totlen < FANOTIFY_FH_HDR_LEN))
111 return 0;
112
113 return info->dir_fh_totlen - FANOTIFY_FH_HDR_LEN;
114}
115
116static inline struct fanotify_fh *fanotify_info_dir_fh(struct fanotify_info *info)
117{
118 BUILD_BUG_ON(offsetof(struct fanotify_info, buf) % 4);
119
120 return (struct fanotify_fh *)FANOTIFY_DIR_FH_BUF(info);
121}
122
123static inline int fanotify_info_dir2_fh_len(struct fanotify_info *info)
124{
125 if (!info->dir2_fh_totlen ||
126 WARN_ON_ONCE(info->dir2_fh_totlen < FANOTIFY_FH_HDR_LEN))
127 return 0;
128
129 return info->dir2_fh_totlen - FANOTIFY_FH_HDR_LEN;
130}
131
132static inline struct fanotify_fh *fanotify_info_dir2_fh(struct fanotify_info *info)
133{
134 return (struct fanotify_fh *)FANOTIFY_DIR2_FH_BUF(info);
135}
136
137static inline int fanotify_info_file_fh_len(struct fanotify_info *info)
138{
139 if (!info->file_fh_totlen ||
140 WARN_ON_ONCE(info->file_fh_totlen < FANOTIFY_FH_HDR_LEN))
141 return 0;
142
143 return info->file_fh_totlen - FANOTIFY_FH_HDR_LEN;
144}
145
146static inline struct fanotify_fh *fanotify_info_file_fh(struct fanotify_info *info)
147{
148 return (struct fanotify_fh *)FANOTIFY_FILE_FH_BUF(info);
149}
150
151static inline char *fanotify_info_name(struct fanotify_info *info)
152{
153 if (!info->name_len)
154 return NULL;
155
156 return FANOTIFY_NAME_BUF(info);
157}
158
159static inline char *fanotify_info_name2(struct fanotify_info *info)
160{
161 if (!info->name2_len)
162 return NULL;
163
164 return FANOTIFY_NAME2_BUF(info);
165}
166
167static inline void fanotify_info_init(struct fanotify_info *info)
168{
169 BUILD_BUG_ON(FANOTIFY_FH_HDR_LEN + MAX_HANDLE_SZ > U8_MAX);
170 BUILD_BUG_ON(NAME_MAX > U8_MAX);
171
172 info->dir_fh_totlen = 0;
173 info->dir2_fh_totlen = 0;
174 info->file_fh_totlen = 0;
175 info->name_len = 0;
176 info->name2_len = 0;
177}
178
179/* These set/copy helpers MUST be called by order */
180static inline void fanotify_info_set_dir_fh(struct fanotify_info *info,
181 unsigned int totlen)
182{
183 if (WARN_ON_ONCE(info->dir2_fh_totlen > 0) ||
184 WARN_ON_ONCE(info->file_fh_totlen > 0) ||
185 WARN_ON_ONCE(info->name_len > 0) ||
186 WARN_ON_ONCE(info->name2_len > 0))
187 return;
188
189 info->dir_fh_totlen = totlen;
190}
191
192static inline void fanotify_info_set_dir2_fh(struct fanotify_info *info,
193 unsigned int totlen)
194{
195 if (WARN_ON_ONCE(info->file_fh_totlen > 0) ||
196 WARN_ON_ONCE(info->name_len > 0) ||
197 WARN_ON_ONCE(info->name2_len > 0))
198 return;
199
200 info->dir2_fh_totlen = totlen;
201}
202
203static inline void fanotify_info_set_file_fh(struct fanotify_info *info,
204 unsigned int totlen)
205{
206 if (WARN_ON_ONCE(info->name_len > 0) ||
207 WARN_ON_ONCE(info->name2_len > 0))
208 return;
209
210 info->file_fh_totlen = totlen;
211}
212
213static inline void fanotify_info_copy_name(struct fanotify_info *info,
214 const struct qstr *name)
215{
216 if (WARN_ON_ONCE(name->len > NAME_MAX) ||
217 WARN_ON_ONCE(info->name2_len > 0))
218 return;
219
220 info->name_len = name->len;
221 strcpy(fanotify_info_name(info), name->name);
222}
223
224static inline void fanotify_info_copy_name2(struct fanotify_info *info,
225 const struct qstr *name)
226{
227 if (WARN_ON_ONCE(name->len > NAME_MAX))
228 return;
229
230 info->name2_len = name->len;
231 strcpy(fanotify_info_name2(info), name->name);
232}
233
234/*
235 * Common structure for fanotify events. Concrete structs are allocated in
236 * fanotify_handle_event() and freed when the information is retrieved by
237 * userspace. The type of event determines how it was allocated, how it will
238 * be freed and which concrete struct it may be cast to.
239 */
240enum fanotify_event_type {
241 FANOTIFY_EVENT_TYPE_FID, /* fixed length */
242 FANOTIFY_EVENT_TYPE_FID_NAME, /* variable length */
243 FANOTIFY_EVENT_TYPE_PATH,
244 FANOTIFY_EVENT_TYPE_PATH_PERM,
245 FANOTIFY_EVENT_TYPE_OVERFLOW, /* struct fanotify_event */
246 FANOTIFY_EVENT_TYPE_FS_ERROR, /* struct fanotify_error_event */
247 FANOTIFY_EVENT_TYPE_MNT,
248 __FANOTIFY_EVENT_TYPE_NUM
249};
250
251#define FANOTIFY_EVENT_TYPE_BITS \
252 (ilog2(__FANOTIFY_EVENT_TYPE_NUM - 1) + 1)
253#define FANOTIFY_EVENT_HASH_BITS \
254 (32 - FANOTIFY_EVENT_TYPE_BITS)
255
256struct fanotify_event {
257 struct fsnotify_event fse;
258 struct hlist_node merge_list; /* List for hashed merge */
259 u32 mask;
260 struct {
261 unsigned int type : FANOTIFY_EVENT_TYPE_BITS;
262 unsigned int hash : FANOTIFY_EVENT_HASH_BITS;
263 };
264 struct pid *pid;
265};
266
267static inline void fanotify_init_event(struct fanotify_event *event,
268 unsigned int hash, u32 mask)
269{
270 fsnotify_init_event(event: &event->fse);
271 INIT_HLIST_NODE(h: &event->merge_list);
272 event->hash = hash;
273 event->mask = mask;
274 event->pid = NULL;
275}
276
277#define FANOTIFY_INLINE_FH(name, size) \
278struct { \
279 struct fanotify_fh name; \
280 /* Space for filehandle - access with fanotify_fh_buf() */ \
281 unsigned char _inline_fh_buf[size]; \
282}
283
284struct fanotify_fid_event {
285 struct fanotify_event fae;
286 __kernel_fsid_t fsid;
287
288 FANOTIFY_INLINE_FH(object_fh, FANOTIFY_INLINE_FH_LEN);
289};
290
291static inline struct fanotify_fid_event *
292FANOTIFY_FE(struct fanotify_event *event)
293{
294 return container_of(event, struct fanotify_fid_event, fae);
295}
296
297struct fanotify_name_event {
298 struct fanotify_event fae;
299 __kernel_fsid_t fsid;
300 struct fanotify_info info;
301};
302
303static inline struct fanotify_name_event *
304FANOTIFY_NE(struct fanotify_event *event)
305{
306 return container_of(event, struct fanotify_name_event, fae);
307}
308
309struct fanotify_error_event {
310 struct fanotify_event fae;
311 s32 error; /* Error reported by the Filesystem. */
312 u32 err_count; /* Suppressed errors count */
313
314 __kernel_fsid_t fsid; /* FSID this error refers to. */
315
316 FANOTIFY_INLINE_FH(object_fh, MAX_HANDLE_SZ);
317};
318
319static inline struct fanotify_error_event *
320FANOTIFY_EE(struct fanotify_event *event)
321{
322 return container_of(event, struct fanotify_error_event, fae);
323}
324
325static inline __kernel_fsid_t *fanotify_event_fsid(struct fanotify_event *event)
326{
327 if (event->type == FANOTIFY_EVENT_TYPE_FID)
328 return &FANOTIFY_FE(event)->fsid;
329 else if (event->type == FANOTIFY_EVENT_TYPE_FID_NAME)
330 return &FANOTIFY_NE(event)->fsid;
331 else if (event->type == FANOTIFY_EVENT_TYPE_FS_ERROR)
332 return &FANOTIFY_EE(event)->fsid;
333 else
334 return NULL;
335}
336
337static inline struct fanotify_fh *fanotify_event_object_fh(
338 struct fanotify_event *event)
339{
340 if (event->type == FANOTIFY_EVENT_TYPE_FID)
341 return &FANOTIFY_FE(event)->object_fh;
342 else if (event->type == FANOTIFY_EVENT_TYPE_FID_NAME)
343 return fanotify_info_file_fh(info: &FANOTIFY_NE(event)->info);
344 else if (event->type == FANOTIFY_EVENT_TYPE_FS_ERROR)
345 return &FANOTIFY_EE(event)->object_fh;
346 else
347 return NULL;
348}
349
350static inline struct fanotify_info *fanotify_event_info(
351 struct fanotify_event *event)
352{
353 if (event->type == FANOTIFY_EVENT_TYPE_FID_NAME)
354 return &FANOTIFY_NE(event)->info;
355 else
356 return NULL;
357}
358
359static inline int fanotify_event_object_fh_len(struct fanotify_event *event)
360{
361 struct fanotify_info *info = fanotify_event_info(event);
362 struct fanotify_fh *fh = fanotify_event_object_fh(event);
363
364 if (info)
365 return info->file_fh_totlen ? fh->len : 0;
366 else
367 return fh ? fh->len : 0;
368}
369
370static inline int fanotify_event_dir_fh_len(struct fanotify_event *event)
371{
372 struct fanotify_info *info = fanotify_event_info(event);
373
374 return info ? fanotify_info_dir_fh_len(info) : 0;
375}
376
377static inline int fanotify_event_dir2_fh_len(struct fanotify_event *event)
378{
379 struct fanotify_info *info = fanotify_event_info(event);
380
381 return info ? fanotify_info_dir2_fh_len(info) : 0;
382}
383
384static inline bool fanotify_event_has_object_fh(struct fanotify_event *event)
385{
386 /* For error events, even zeroed fh are reported. */
387 if (event->type == FANOTIFY_EVENT_TYPE_FS_ERROR)
388 return true;
389 return fanotify_event_object_fh_len(event) > 0;
390}
391
392static inline bool fanotify_event_has_dir_fh(struct fanotify_event *event)
393{
394 return fanotify_event_dir_fh_len(event) > 0;
395}
396
397static inline bool fanotify_event_has_dir2_fh(struct fanotify_event *event)
398{
399 return fanotify_event_dir2_fh_len(event) > 0;
400}
401
402static inline bool fanotify_event_has_any_dir_fh(struct fanotify_event *event)
403{
404 return fanotify_event_has_dir_fh(event) ||
405 fanotify_event_has_dir2_fh(event);
406}
407
408struct fanotify_path_event {
409 struct fanotify_event fae;
410 struct path path;
411};
412
413struct fanotify_mnt_event {
414 struct fanotify_event fae;
415 u64 mnt_id;
416};
417
418static inline struct fanotify_path_event *
419FANOTIFY_PE(struct fanotify_event *event)
420{
421 return container_of(event, struct fanotify_path_event, fae);
422}
423
424static inline struct fanotify_mnt_event *
425FANOTIFY_ME(struct fanotify_event *event)
426{
427 return container_of(event, struct fanotify_mnt_event, fae);
428}
429
430/*
431 * Structure for permission fanotify events. It gets allocated and freed in
432 * fanotify_handle_event() since we wait there for user response. When the
433 * information is retrieved by userspace the structure is moved from
434 * group->notification_list to group->fanotify_data.access_list to wait for
435 * user response.
436 */
437struct fanotify_perm_event {
438 struct fanotify_event fae;
439 struct path path;
440 const loff_t *ppos; /* optional file range info */
441 size_t count;
442 u32 response; /* userspace answer to the event */
443 unsigned short state; /* state of the event */
444 unsigned short watchdog_cnt; /* already scanned by watchdog? */
445 int fd; /* fd we passed to userspace for this event */
446 pid_t recv_pid; /* pid of task receiving the event */
447 union {
448 struct fanotify_response_info_header hdr;
449 struct fanotify_response_info_audit_rule audit_rule;
450 };
451};
452
453static inline struct fanotify_perm_event *
454FANOTIFY_PERM(struct fanotify_event *event)
455{
456 return container_of(event, struct fanotify_perm_event, fae);
457}
458
459static inline bool fanotify_is_perm_event(u32 mask)
460{
461 return IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS) &&
462 mask & FANOTIFY_PERM_EVENTS;
463}
464
465static inline bool fanotify_event_has_access_range(struct fanotify_event *event)
466{
467 if (!(event->mask & FANOTIFY_PRE_CONTENT_EVENTS))
468 return false;
469
470 return FANOTIFY_PERM(event)->ppos;
471}
472
473static inline struct fanotify_event *FANOTIFY_E(struct fsnotify_event *fse)
474{
475 return container_of(fse, struct fanotify_event, fse);
476}
477
478static inline bool fanotify_is_error_event(u32 mask)
479{
480 return mask & FAN_FS_ERROR;
481}
482
483static inline bool fanotify_is_mnt_event(u32 mask)
484{
485 return mask & (FAN_MNT_ATTACH | FAN_MNT_DETACH);
486}
487
488static inline const struct path *fanotify_event_path(struct fanotify_event *event)
489{
490 if (event->type == FANOTIFY_EVENT_TYPE_PATH)
491 return &FANOTIFY_PE(event)->path;
492 else if (event->type == FANOTIFY_EVENT_TYPE_PATH_PERM)
493 return &FANOTIFY_PERM(event)->path;
494 else
495 return NULL;
496}
497
498/*
499 * Use 128 size hash table to speed up events merge.
500 */
501#define FANOTIFY_HTABLE_BITS (7)
502#define FANOTIFY_HTABLE_SIZE (1 << FANOTIFY_HTABLE_BITS)
503#define FANOTIFY_HTABLE_MASK (FANOTIFY_HTABLE_SIZE - 1)
504
505/*
506 * Permission events and overflow event do not get merged - don't hash them.
507 */
508static inline bool fanotify_is_hashed_event(u32 mask)
509{
510 return !(fanotify_is_perm_event(mask) ||
511 fsnotify_is_overflow_event(mask));
512}
513
514static inline unsigned int fanotify_event_hash_bucket(
515 struct fsnotify_group *group,
516 struct fanotify_event *event)
517{
518 return event->hash & FANOTIFY_HTABLE_MASK;
519}
520
521struct fanotify_mark {
522 struct fsnotify_mark fsn_mark;
523 __kernel_fsid_t fsid;
524};
525
526static inline struct fanotify_mark *FANOTIFY_MARK(struct fsnotify_mark *mark)
527{
528 return container_of(mark, struct fanotify_mark, fsn_mark);
529}
530
531static inline bool fanotify_fsid_equal(__kernel_fsid_t *fsid1,
532 __kernel_fsid_t *fsid2)
533{
534 return fsid1->val[0] == fsid2->val[0] && fsid1->val[1] == fsid2->val[1];
535}
536
537static inline unsigned int fanotify_mark_user_flags(struct fsnotify_mark *mark)
538{
539 unsigned int mflags = 0;
540
541 if (mark->flags & FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY)
542 mflags |= FAN_MARK_IGNORED_SURV_MODIFY;
543 if (mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF)
544 mflags |= FAN_MARK_EVICTABLE;
545 if (mark->flags & FSNOTIFY_MARK_FLAG_HAS_IGNORE_FLAGS)
546 mflags |= FAN_MARK_IGNORE;
547
548 return mflags;
549}
550
551static inline u32 fanotify_get_response_errno(int res)
552{
553 return (res >> FAN_ERRNO_SHIFT) & FAN_ERRNO_MASK;
554}
555