1 /*
2 * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
29 /*
30 * Copyright (c) 1982, 1986, 1989, 1993
31 * The Regents of the University of California. All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64 * SUCH DAMAGE.
65 *
66 * @(#)vfs_vnops.c 8.14 (Berkeley) 6/15/95
67 *
68 */
69 /*
70 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
71 * support for mandatory and extensible security protections. This notice
72 * is included in support of clause 2.2 (b) of the Apple Public License,
73 * Version 2.0.
74 */
75
76 #include <sys/param.h>
77 #include <sys/types.h>
78 #include <sys/systm.h>
79 #include <sys/kernel.h>
80 #include <sys/file_internal.h>
81 #include <sys/stat.h>
82 #include <sys/proc_internal.h>
83 #include <sys/kauth.h>
84 #include <sys/mount_internal.h>
85 #include <sys/namei.h>
86 #include <sys/vnode_internal.h>
87 #include <sys/ioctl.h>
88 #include <sys/fsctl.h>
89 #include <sys/tty.h>
90 #include <sys/ubc.h>
91 #include <sys/conf.h>
92 #include <sys/disk.h>
93 #include <sys/fsevents.h>
94 #include <sys/kdebug.h>
95 #include <sys/xattr.h>
96 #include <sys/ubc_internal.h>
97 #include <sys/uio_internal.h>
98 #include <sys/resourcevar.h>
99 #include <sys/signalvar.h>
100
101 #include <vm/vm_kern.h>
102 #include <vm/vm_map.h>
103
104 #include <miscfs/specfs/specdev.h>
105 #include <miscfs/fifofs/fifo.h>
106
107 #if CONFIG_MACF
108 #include <security/mac_framework.h>
109 #endif
110
111 #include <IOKit/IOBSD.h>
112 #include <libkern/section_keywords.h>
113
114 static int vn_closefile(struct fileglob *fp, vfs_context_t ctx);
115 static int vn_ioctl(struct fileproc *fp, u_long com, caddr_t data,
116 vfs_context_t ctx);
117 static int vn_read(struct fileproc *fp, struct uio *uio, int flags,
118 vfs_context_t ctx);
119 static int vn_write(struct fileproc *fp, struct uio *uio, int flags,
120 vfs_context_t ctx);
121 static int vn_select( struct fileproc *fp, int which, void * wql,
122 vfs_context_t ctx);
123 static int vn_kqfilter(struct fileproc *fp, struct knote *kn,
124 struct kevent_qos_s *kev);
125 static void filt_vndetach(struct knote *kn);
126 static int filt_vnode(struct knote *kn, long hint);
127 static int filt_vnode_common(struct knote *kn, struct kevent_qos_s *kev,
128 vnode_t vp, long hint);
129 static int vn_open_auth_finish(vnode_t vp, int fmode, vfs_context_t ctx);
130
131 const struct fileops vnops = {
132 .fo_type = DTYPE_VNODE,
133 .fo_read = vn_read,
134 .fo_write = vn_write,
135 .fo_ioctl = vn_ioctl,
136 .fo_select = vn_select,
137 .fo_close = vn_closefile,
138 .fo_drain = fo_no_drain,
139 .fo_kqfilter = vn_kqfilter,
140 };
141
142 static int filt_vntouch(struct knote *kn, struct kevent_qos_s *kev);
143 static int filt_vnprocess(struct knote *kn, struct kevent_qos_s*kev);
144
145 SECURITY_READ_ONLY_EARLY(struct filterops) vnode_filtops = {
146 .f_isfd = 1,
147 .f_attach = NULL,
148 .f_detach = filt_vndetach,
149 .f_event = filt_vnode,
150 .f_touch = filt_vntouch,
151 .f_process = filt_vnprocess,
152 };
153
154 /*
155 * Common code for vnode open operations.
156 * Check permissions, and call the VNOP_OPEN or VNOP_CREATE routine.
157 *
158 * XXX the profusion of interfaces here is probably a bad thing.
159 */
160 int
vn_open(struct nameidata * ndp,int fmode,int cmode)161 vn_open(struct nameidata *ndp, int fmode, int cmode)
162 {
163 return vn_open_modflags(ndp, &fmode, cmode);
164 }
165
166 int
vn_open_modflags(struct nameidata * ndp,int * fmodep,int cmode)167 vn_open_modflags(struct nameidata *ndp, int *fmodep, int cmode)
168 {
169 int error;
170 struct vnode_attr *vap;
171
172 vap = kalloc_type(struct vnode_attr, Z_WAITOK);
173
174 VATTR_INIT(vap);
175 VATTR_SET(vap, va_mode, (mode_t)cmode);
176
177 error = vn_open_auth(ndp, fmodep, vap, NULLVP);
178
179 kfree_type(struct vnode_attr, vap);
180
181 return error;
182 }
183
184 static int
vn_open_auth_finish(vnode_t vp,int fmode,vfs_context_t ctx)185 vn_open_auth_finish(vnode_t vp, int fmode, vfs_context_t ctx)
186 {
187 int error;
188
189 if ((error = vnode_ref_ext(vp, fmode, 0)) != 0) {
190 goto bad;
191 }
192
193 /* Call out to allow 3rd party notification of open.
194 * Ignore result of kauth_authorize_fileop call.
195 */
196 #if CONFIG_MACF
197 mac_vnode_notify_open(ctx, vp, fmode);
198 #endif
199 kauth_authorize_fileop(vfs_context_ucred(ctx), KAUTH_FILEOP_OPEN,
200 (uintptr_t)vp, 0);
201
202 return 0;
203
204 bad:
205 return error;
206 }
207
208 /*
209 * May do nameidone() to allow safely adding an FSEvent. Cue off of ni_dvp to
210 * determine whether that has happened.
211 */
212 static int
vn_open_auth_do_create(struct nameidata * ndp,struct vnode_attr * vap,int fmode,boolean_t * did_create,boolean_t * did_open,vfs_context_t ctx)213 vn_open_auth_do_create(struct nameidata *ndp, struct vnode_attr *vap, int fmode, boolean_t *did_create, boolean_t *did_open, vfs_context_t ctx)
214 {
215 uint32_t status = 0;
216 vnode_t dvp = ndp->ni_dvp;
217 int batched;
218 int error;
219 vnode_t vp;
220
221 batched = vnode_compound_open_available(ndp->ni_dvp);
222 *did_open = FALSE;
223
224 VATTR_SET(vap, va_type, VREG);
225 if (fmode & O_EXCL) {
226 vap->va_vaflags |= VA_EXCLUSIVE;
227 }
228
229 #if NAMEDRSRCFORK
230 if (ndp->ni_cnd.cn_flags & CN_WANTSRSRCFORK) {
231 if ((error = vn_authorize_create(dvp, &ndp->ni_cnd, vap, ctx, NULL)) != 0) {
232 goto out;
233 }
234 if ((error = vnode_makenamedstream(dvp, &ndp->ni_vp, XATTR_RESOURCEFORK_NAME, 0, ctx)) != 0) {
235 goto out;
236 }
237 *did_create = TRUE;
238 } else {
239 #endif
240 if (!batched) {
241 if ((error = vn_authorize_create(dvp, &ndp->ni_cnd, vap, ctx, NULL)) != 0) {
242 goto out;
243 }
244 }
245
246 error = vn_create(dvp, &ndp->ni_vp, ndp, vap, VN_CREATE_DOOPEN, fmode, &status, ctx);
247 if (error != 0) {
248 if (batched) {
249 *did_create = (status & COMPOUND_OPEN_STATUS_DID_CREATE) ? TRUE : FALSE;
250 } else {
251 *did_create = FALSE;
252 }
253
254 if (error == EKEEPLOOKING) {
255 if (*did_create) {
256 panic("EKEEPLOOKING, but we did a create?");
257 }
258 if (!batched) {
259 panic("EKEEPLOOKING from filesystem that doesn't support compound vnops?");
260 }
261 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
262 panic("EKEEPLOOKING, but continue flag not set?");
263 }
264
265 /*
266 * Do NOT drop the dvp: we need everything to continue the lookup.
267 */
268 return error;
269 }
270 } else {
271 if (batched) {
272 *did_create = (status & COMPOUND_OPEN_STATUS_DID_CREATE) ? 1 : 0;
273 *did_open = TRUE;
274 } else {
275 *did_create = TRUE;
276 }
277 }
278 #if NAMEDRSRCFORK
279 }
280 #endif
281
282 vp = ndp->ni_vp;
283
284 if (*did_create) {
285 int update_flags = 0;
286
287 // Make sure the name & parent pointers are hooked up
288 if (vp->v_name == NULL) {
289 update_flags |= VNODE_UPDATE_NAME;
290 }
291 if (vp->v_parent == NULLVP) {
292 update_flags |= VNODE_UPDATE_PARENT;
293 }
294
295 if (update_flags) {
296 vnode_update_identity(vp, dvp, ndp->ni_cnd.cn_nameptr, ndp->ni_cnd.cn_namelen, ndp->ni_cnd.cn_hash, update_flags);
297 }
298
299 vnode_put(dvp);
300 ndp->ni_dvp = NULLVP;
301
302 #if CONFIG_FSE
303 if (need_fsevent(FSE_CREATE_FILE, vp)) {
304 add_fsevent(FSE_CREATE_FILE, ctx,
305 FSE_ARG_VNODE, vp,
306 FSE_ARG_DONE);
307 }
308 #endif
309 }
310 out:
311 if (ndp->ni_dvp != NULLVP) {
312 vnode_put(dvp);
313 ndp->ni_dvp = NULLVP;
314 }
315
316 return error;
317 }
318
319 /*
320 * This is the number of times we'll loop in vn_open_auth without explicitly
321 * yielding the CPU when we determine we have to retry.
322 */
323 #define RETRY_NO_YIELD_COUNT 5
324
325 /*
326 * Open a file with authorization, updating the contents of the structures
327 * pointed to by ndp, fmodep, and vap as necessary to perform the requested
328 * operation. This function is used for both opens of existing files, and
329 * creation of new files.
330 *
331 * Parameters: ndp The nami data pointer describing the
332 * file
333 * fmodep A pointer to an int containg the mode
334 * information to be used for the open
335 * vap A pointer to the vnode attribute
336 * descriptor to be used for the open
337 * authvp If non-null and VA_DP_AUTHENTICATE is set in vap,
338 * have a supporting filesystem verify that the file
339 * to be opened is on the same volume as authvp and
340 * that authvp is on an authenticated volume
341 *
342 * Indirect: * Contents of the data structures pointed
343 * to by the parameters are modified as
344 * necessary to the requested operation.
345 *
346 * Returns: 0 Success
347 * !0 errno value
348 *
349 * Notes: The kauth_filesec_t in 'vap', if any, is in host byte order.
350 *
351 * The contents of '*ndp' will be modified, based on the other
352 * arguments to this function, and to return file and directory
353 * data necessary to satisfy the requested operation.
354 *
355 * If the file does not exist and we are creating it, then the
356 * O_TRUNC flag will be cleared in '*fmodep' to indicate to the
357 * caller that the file was not truncated.
358 *
359 * If the file exists and the O_EXCL flag was not specified, then
360 * the O_CREAT flag will be cleared in '*fmodep' to indicate to
361 * the caller that the existing file was merely opened rather
362 * than created.
363 *
364 * The contents of '*vap' will be modified as necessary to
365 * complete the operation, including setting of supported
366 * attribute, clearing of fields containing unsupported attributes
367 * in the request, if the request proceeds without them, etc..
368 *
369 * XXX: This function is too complicated in actings on its arguments
370 *
371 * XXX: We should enummerate the possible errno values here, and where
372 * in the code they originated.
373 */
374 int
vn_open_auth(struct nameidata * ndp,int * fmodep,struct vnode_attr * vap,vnode_t authvp)375 vn_open_auth(struct nameidata *ndp, int *fmodep, struct vnode_attr *vap, vnode_t authvp)
376 {
377 struct vnode *vp;
378 struct vnode *dvp;
379 vfs_context_t ctx = ndp->ni_cnd.cn_context;
380 int error;
381 int fmode;
382 uint32_t origcnflags;
383 boolean_t did_create;
384 boolean_t did_open;
385 boolean_t need_vnop_open;
386 boolean_t batched;
387 boolean_t ref_failed;
388 int nretries = 0;
389
390 again:
391 vp = NULL;
392 dvp = NULL;
393 batched = FALSE;
394 did_create = FALSE;
395 need_vnop_open = TRUE;
396 ref_failed = FALSE;
397 fmode = *fmodep;
398 origcnflags = ndp->ni_cnd.cn_flags;
399
400 if (VATTR_IS_ACTIVE(vap, va_dataprotect_flags)) {
401 if ((authvp != NULLVP)
402 && !ISSET(vap->va_dataprotect_flags, VA_DP_AUTHENTICATE)) {
403 return EINVAL;
404 }
405 // If raw encrypted mode is requested, handle that here
406 if (ISSET(vap->va_dataprotect_flags, VA_DP_RAWENCRYPTED)) {
407 fmode |= FENCRYPTED;
408 }
409 }
410
411 if ((fmode & O_NOFOLLOW_ANY) && (fmode & (O_SYMLINK | O_NOFOLLOW))) {
412 error = EINVAL;
413 goto out;
414 }
415
416 /*
417 * O_CREAT
418 */
419 if (fmode & O_CREAT) {
420 if ((fmode & O_DIRECTORY)) {
421 error = EINVAL;
422 goto out;
423 }
424 ndp->ni_cnd.cn_nameiop = CREATE;
425 #if CONFIG_TRIGGERS
426 ndp->ni_op = OP_LINK;
427 #endif
428 /* Inherit USEDVP, vnode_open() supported flags only */
429 ndp->ni_cnd.cn_flags &= (USEDVP | NOCROSSMOUNT);
430 ndp->ni_cnd.cn_flags |= LOCKPARENT | LOCKLEAF | AUDITVNPATH1;
431 ndp->ni_flag = NAMEI_COMPOUNDOPEN;
432 #if NAMEDRSRCFORK
433 /* open calls are allowed for resource forks. */
434 ndp->ni_cnd.cn_flags |= CN_ALLOWRSRCFORK;
435 #endif
436 if ((fmode & O_EXCL) == 0 && (fmode & O_NOFOLLOW) == 0 && (origcnflags & FOLLOW) != 0) {
437 ndp->ni_cnd.cn_flags |= FOLLOW;
438 }
439 if (fmode & O_NOFOLLOW_ANY) {
440 /* will return ELOOP on the first symlink to be hit */
441 ndp->ni_flag |= NAMEI_NOFOLLOW_ANY;
442 }
443
444 continue_create_lookup:
445 if ((error = namei(ndp))) {
446 goto out;
447 }
448
449 dvp = ndp->ni_dvp;
450 vp = ndp->ni_vp;
451
452 batched = vnode_compound_open_available(dvp);
453
454 /* not found, create */
455 if (vp == NULL) {
456 /* must have attributes for a new file */
457 if (vap == NULL) {
458 vnode_put(dvp);
459 error = EINVAL;
460 goto out;
461 }
462 /*
463 * Attempt a create. For a system supporting compound VNOPs, we may
464 * find an existing file or create one; in either case, we will already
465 * have the file open and no VNOP_OPEN() will be needed.
466 */
467 error = vn_open_auth_do_create(ndp, vap, fmode, &did_create, &did_open, ctx);
468
469 dvp = ndp->ni_dvp;
470 vp = ndp->ni_vp;
471
472 /*
473 * Detected a node that the filesystem couldn't handle. Don't call
474 * nameidone() yet, because we need that path buffer.
475 */
476 if (error == EKEEPLOOKING) {
477 if (!batched) {
478 panic("EKEEPLOOKING from a filesystem that doesn't support compound VNOPs?");
479 }
480 goto continue_create_lookup;
481 }
482
483 nameidone(ndp);
484 if (dvp) {
485 panic("Shouldn't have a dvp here.");
486 }
487
488 if (error) {
489 /*
490 * Check for a create race.
491 */
492 if ((error == EEXIST) && !(fmode & O_EXCL)) {
493 if (vp) {
494 vnode_put(vp);
495 }
496 goto again;
497 }
498 goto bad;
499 }
500
501 need_vnop_open = !did_open;
502 } else {
503 if (fmode & O_EXCL) {
504 error = EEXIST;
505 }
506
507 /*
508 * We have a vnode. Use compound open if available
509 * or else fall through to "traditional" path. Note: can't
510 * do a compound open for root, because the parent belongs
511 * to a different FS.
512 */
513 if (error == 0 && batched && (vnode_mount(dvp) == vnode_mount(vp))) {
514 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0, fmode, NULL, NULL, ctx);
515
516 if (error == 0) {
517 vp = ndp->ni_vp;
518 need_vnop_open = FALSE;
519 } else if (error == EKEEPLOOKING) {
520 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
521 panic("EKEEPLOOKING, but continue flag not set?");
522 }
523 goto continue_create_lookup;
524 }
525 }
526 nameidone(ndp);
527 vnode_put(dvp);
528 ndp->ni_dvp = NULLVP;
529
530 if (error) {
531 goto bad;
532 }
533
534 fmode &= ~O_CREAT;
535
536 /* Fall through */
537 }
538 } else {
539 /*
540 * Not O_CREAT
541 */
542 ndp->ni_cnd.cn_nameiop = LOOKUP;
543 /* Inherit USEDVP, vnode_open() supported flags only */
544 ndp->ni_cnd.cn_flags &= (USEDVP | NOCROSSMOUNT);
545 ndp->ni_cnd.cn_flags |= FOLLOW | LOCKLEAF | AUDITVNPATH1 | WANTPARENT;
546 #if NAMEDRSRCFORK
547 /* open calls are allowed for resource forks. */
548 ndp->ni_cnd.cn_flags |= CN_ALLOWRSRCFORK;
549 #endif
550 if (fmode & FENCRYPTED) {
551 ndp->ni_cnd.cn_flags |= CN_RAW_ENCRYPTED | CN_SKIPNAMECACHE;
552 }
553 ndp->ni_flag = NAMEI_COMPOUNDOPEN;
554
555 /* preserve NOFOLLOW from vnode_open() */
556 if (fmode & O_NOFOLLOW || fmode & O_SYMLINK || (origcnflags & FOLLOW) == 0) {
557 ndp->ni_cnd.cn_flags &= ~FOLLOW;
558 }
559 if (fmode & O_NOFOLLOW_ANY) {
560 /* will return ELOOP on the first symlink to be hit */
561 ndp->ni_flag |= NAMEI_NOFOLLOW_ANY;
562 }
563
564 /* Do a lookup, possibly going directly to filesystem for compound operation */
565 do {
566 if ((error = namei(ndp))) {
567 goto out;
568 }
569 vp = ndp->ni_vp;
570 dvp = ndp->ni_dvp;
571
572 /* Check for batched lookup-open */
573 batched = vnode_compound_open_available(dvp);
574 if (batched && ((vp == NULLVP) || (vnode_mount(dvp) == vnode_mount(vp)))) {
575 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0, fmode, NULL, NULL, ctx);
576 vp = ndp->ni_vp;
577 if (error == 0) {
578 need_vnop_open = FALSE;
579 } else if (error == EKEEPLOOKING) {
580 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
581 panic("EKEEPLOOKING, but continue flag not set?");
582 }
583 } else if ((fmode & (FREAD | FWRITE | FEXEC)) == FEXEC) {
584 /*
585 * Some file systems fail in vnop_open call with absense of
586 * both FREAD and FWRITE access modes. Retry the vnop_open
587 * call again with FREAD access mode added.
588 */
589 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0,
590 fmode | FREAD, NULL, NULL, ctx);
591 if (error == 0) {
592 vp = ndp->ni_vp;
593 need_vnop_open = FALSE;
594 }
595 }
596 }
597 } while (error == EKEEPLOOKING);
598
599 nameidone(ndp);
600 vnode_put(dvp);
601 ndp->ni_dvp = NULLVP;
602
603 if (error) {
604 goto bad;
605 }
606 }
607
608 /*
609 * By this point, nameidone() is called, dvp iocount is dropped,
610 * and dvp pointer is cleared.
611 */
612 if (ndp->ni_dvp != NULLVP) {
613 panic("Haven't cleaned up adequately in vn_open_auth()");
614 }
615
616 /*
617 * Expect to use this code for filesystems without compound VNOPs, for the root
618 * of a filesystem, which can't be "looked up" in the sense of VNOP_LOOKUP(),
619 * and for shadow files, which do not live on the same filesystems as their "parents."
620 */
621 if (need_vnop_open) {
622 if (batched && !vnode_isvroot(vp) && !vnode_isnamedstream(vp)) {
623 panic("Why am I trying to use VNOP_OPEN() on anything other than the root or a named stream?");
624 }
625
626 if (!did_create) {
627 error = vn_authorize_open_existing(vp, &ndp->ni_cnd, fmode, ctx, NULL);
628 if (error) {
629 goto bad;
630 }
631 }
632
633 if (VATTR_IS_ACTIVE(vap, va_dataprotect_flags)) {
634 if (ISSET(vap->va_dataprotect_flags, VA_DP_RAWUNENCRYPTED)) {
635 /* Don't allow unencrypted io request from user space unless entitled */
636 boolean_t entitled = FALSE;
637 #if !SECURE_KERNEL
638 entitled = IOCurrentTaskHasEntitlement("com.apple.private.security.file-unencrypt-access");
639 #endif /* SECURE_KERNEL */
640 if (!entitled) {
641 error = EPERM;
642 goto bad;
643 }
644 fmode |= FUNENCRYPTED;
645 }
646
647 if (ISSET(vap->va_dataprotect_flags, VA_DP_AUTHENTICATE)) {
648 fsioc_auth_fs_t afs = { .authvp = authvp };
649
650 error = VNOP_IOCTL(vp, FSIOC_AUTH_FS, (caddr_t)&afs, 0, ctx);
651 if (error) {
652 goto bad;
653 }
654 }
655 }
656
657 error = VNOP_OPEN(vp, fmode, ctx);
658 if (error) {
659 /*
660 * Some file systems fail in vnop_open call with absense of both
661 * FREAD and FWRITE access modes. Retry the vnop_open call again
662 * with FREAD access mode added.
663 */
664 if ((fmode & (FREAD | FWRITE | FEXEC)) == FEXEC) {
665 error = VNOP_OPEN(vp, fmode | FREAD, ctx);
666 }
667 if (error) {
668 goto bad;
669 }
670 }
671 need_vnop_open = FALSE;
672 }
673
674 // if the vnode is tagged VOPENEVT and the current process
675 // has the P_CHECKOPENEVT flag set, then we or in the O_EVTONLY
676 // flag to the open mode so that this open won't count against
677 // the vnode when carbon delete() does a vnode_isinuse() to see
678 // if a file is currently in use. this allows spotlight
679 // importers to not interfere with carbon apps that depend on
680 // the no-delete-if-busy semantics of carbon delete().
681 //
682 if (!did_create && (vp->v_flag & VOPENEVT) && (current_proc()->p_flag & P_CHECKOPENEVT)) {
683 fmode |= O_EVTONLY;
684 }
685
686 /*
687 * Grab reference, etc.
688 */
689 error = vn_open_auth_finish(vp, fmode, ctx);
690 if (error) {
691 ref_failed = TRUE;
692 goto bad;
693 }
694
695 /* Compound VNOP open is responsible for doing the truncate */
696 if (batched || did_create) {
697 fmode &= ~O_TRUNC;
698 }
699
700 *fmodep = fmode;
701 return 0;
702
703 bad:
704 /* Opened either explicitly or by a batched create */
705 if (!need_vnop_open) {
706 VNOP_CLOSE(vp, fmode, ctx);
707 }
708
709 ndp->ni_vp = NULL;
710 if (vp) {
711 #if NAMEDRSRCFORK
712 /* Aggressively recycle shadow files if we error'd out during open() */
713 if ((vnode_isnamedstream(vp)) &&
714 (vp->v_parent != NULLVP) &&
715 (vnode_isshadow(vp))) {
716 vnode_recycle(vp);
717 }
718 #endif
719 vnode_put(vp);
720 /*
721 * Check for a race against unlink. We had a vnode
722 * but according to vnode_authorize or VNOP_OPEN it
723 * no longer exists.
724 *
725 * EREDRIVEOPEN: means that we were hit by the tty allocation race.
726 */
727 if (((error == ENOENT) && (*fmodep & O_CREAT)) || (error == EREDRIVEOPEN) || ref_failed) {
728 /*
729 * We'll retry here but it may be possible that we get
730 * into a retry "spin" inside the kernel and not allow
731 * threads, which need to run in order for the retry
732 * loop to end, to run. An example is an open of a
733 * terminal which is getting revoked and we spin here
734 * without yielding becasue namei and VNOP_OPEN are
735 * successful but vnode_ref fails. The revoke needs
736 * threads with an iocount to run but if spin here we
737 * may possibly be blcoking other threads from running.
738 *
739 * We start yielding the CPU after some number of
740 * retries for increasing durations. Note that this is
741 * still a loop without an exit condition.
742 */
743 nretries += 1;
744 if (nretries > RETRY_NO_YIELD_COUNT) {
745 /* Every hz/100 secs is 10 msecs ... */
746 tsleep(&nretries, PVFS, "vn_open_auth_retry",
747 MIN((nretries * (hz / 100)), hz));
748 }
749 goto again;
750 }
751 }
752
753 out:
754 return error;
755 }
756
757 #if vn_access_DEPRECATED
758 /*
759 * Authorize an action against a vnode. This has been the canonical way to
760 * ensure that the credential/process/etc. referenced by a vfs_context
761 * is granted the rights called out in 'mode' against the vnode 'vp'.
762 *
763 * Unfortunately, the use of VREAD/VWRITE/VEXEC makes it very difficult
764 * to add support for more rights. As such, this interface will be deprecated
765 * and callers will use vnode_authorize instead.
766 */
767 int
vn_access(vnode_t vp,int mode,vfs_context_t context)768 vn_access(vnode_t vp, int mode, vfs_context_t context)
769 {
770 kauth_action_t action;
771
772 action = 0;
773 if (mode & VREAD) {
774 action |= KAUTH_VNODE_READ_DATA;
775 }
776 if (mode & VWRITE) {
777 action |= KAUTH_VNODE_WRITE_DATA;
778 }
779 if (mode & VEXEC) {
780 action |= KAUTH_VNODE_EXECUTE;
781 }
782
783 return vnode_authorize(vp, NULL, action, context);
784 }
785 #endif /* vn_access_DEPRECATED */
786
787 /*
788 * Vnode close call
789 */
790 int
vn_close(struct vnode * vp,int flags,vfs_context_t ctx)791 vn_close(struct vnode *vp, int flags, vfs_context_t ctx)
792 {
793 int error;
794 int flusherror = 0;
795
796 #if NAMEDRSRCFORK
797 /* Sync data from resource fork shadow file if needed. */
798 if ((vp->v_flag & VISNAMEDSTREAM) &&
799 (vp->v_parent != NULLVP) &&
800 vnode_isshadow(vp)) {
801 if (flags & FWASWRITTEN) {
802 flusherror = vnode_flushnamedstream(vp->v_parent, vp, ctx);
803 }
804 }
805 #endif
806 /*
807 * If vnode @vp belongs to a chardev or a blkdev then it is handled
808 * specially. We first drop its user reference count @vp->v_usecount
809 * before calling VNOP_CLOSE(). This was done historically to ensure
810 * that the last close of a special device vnode performed some
811 * conditional cleanups. Now we still need to drop this reference here
812 * to ensure that devfsspec_close() can check if the vnode is still in
813 * use.
814 */
815 if (vnode_isspec(vp)) {
816 (void)vnode_rele_ext(vp, flags, 0);
817 }
818
819 /*
820 * On HFS, we flush when the last writer closes. We do this
821 * because resource fork vnodes hold a reference on data fork
822 * vnodes and that will prevent them from getting VNOP_INACTIVE
823 * which will delay when we flush cached data. In future, we
824 * might find it beneficial to do this for all file systems.
825 * Note that it's OK to access v_writecount without the lock
826 * in this context.
827 */
828 if (vp->v_tag == VT_HFS && (flags & FWRITE) && vp->v_writecount == 1) {
829 VNOP_FSYNC(vp, MNT_NOWAIT, ctx);
830 }
831
832 error = VNOP_CLOSE(vp, flags, ctx);
833
834 #if CONFIG_FSE
835 if (flags & FWASWRITTEN) {
836 if (need_fsevent(FSE_CONTENT_MODIFIED, vp)) {
837 add_fsevent(FSE_CONTENT_MODIFIED, ctx,
838 FSE_ARG_VNODE, vp,
839 FSE_ARG_DONE);
840 }
841 }
842 #endif
843
844 if (!vnode_isspec(vp)) {
845 (void)vnode_rele_ext(vp, flags, 0);
846 }
847
848 if (flusherror) {
849 error = flusherror;
850 }
851 return error;
852 }
853
854 static int
vn_read_swapfile(struct vnode * vp,uio_t uio)855 vn_read_swapfile(
856 struct vnode *vp,
857 uio_t uio)
858 {
859 int error;
860 off_t swap_count, this_count;
861 off_t file_end, read_end;
862 off_t prev_resid;
863 char *my_swap_page;
864
865 /*
866 * Reading from a swap file will get you zeroes.
867 */
868
869 my_swap_page = NULL;
870 error = 0;
871 swap_count = uio_resid(uio);
872
873 file_end = ubc_getsize(vp);
874 read_end = uio->uio_offset + uio_resid(uio);
875 if (uio->uio_offset >= file_end) {
876 /* uio starts after end of file: nothing to read */
877 swap_count = 0;
878 } else if (read_end > file_end) {
879 /* uio extends beyond end of file: stop before that */
880 swap_count -= (read_end - file_end);
881 }
882
883 while (swap_count > 0) {
884 if (my_swap_page == NULL) {
885 my_swap_page = kalloc_data(PAGE_SIZE, Z_WAITOK | Z_ZERO);
886 /* add an end-of-line to keep line counters happy */
887 my_swap_page[PAGE_SIZE - 1] = '\n';
888 }
889 this_count = swap_count;
890 if (this_count > PAGE_SIZE) {
891 this_count = PAGE_SIZE;
892 }
893
894 prev_resid = uio_resid(uio);
895 error = uiomove((caddr_t) my_swap_page,
896 (int)this_count,
897 uio);
898 if (error) {
899 break;
900 }
901 swap_count -= (prev_resid - uio_resid(uio));
902 }
903 kfree_data(my_swap_page, PAGE_SIZE);
904
905 return error;
906 }
907 /*
908 * Package up an I/O request on a vnode into a uio and do it.
909 */
910 int
vn_rdwr(enum uio_rw rw,struct vnode * vp,caddr_t base,int len,off_t offset,enum uio_seg segflg,int ioflg,kauth_cred_t cred,int * aresid,proc_t p)911 vn_rdwr(
912 enum uio_rw rw,
913 struct vnode *vp,
914 caddr_t base,
915 int len,
916 off_t offset,
917 enum uio_seg segflg,
918 int ioflg,
919 kauth_cred_t cred,
920 int *aresid,
921 proc_t p)
922 {
923 int64_t resid;
924 int result;
925
926 if (len < 0) {
927 return EINVAL;
928 }
929
930 result = vn_rdwr_64(rw,
931 vp,
932 (uint64_t)(uintptr_t)base,
933 (int64_t)len,
934 offset,
935 segflg,
936 ioflg,
937 cred,
938 &resid,
939 p);
940
941 /* "resid" should be bounded above by "len," which is an int */
942 if (aresid != NULL) {
943 *aresid = (int)resid;
944 }
945
946 return result;
947 }
948
949
950 int
vn_rdwr_64(enum uio_rw rw,struct vnode * vp,uint64_t base,int64_t len,off_t offset,enum uio_seg segflg,int ioflg,kauth_cred_t cred,int64_t * aresid,proc_t p)951 vn_rdwr_64(
952 enum uio_rw rw,
953 struct vnode *vp,
954 uint64_t base,
955 int64_t len,
956 off_t offset,
957 enum uio_seg segflg,
958 int ioflg,
959 kauth_cred_t cred,
960 int64_t *aresid,
961 proc_t p)
962 {
963 uio_t auio;
964 int spacetype;
965 struct vfs_context context;
966 int error = 0;
967 uio_stackbuf_t uio_buf[UIO_SIZEOF(1)];
968
969 context.vc_thread = current_thread();
970 context.vc_ucred = cred;
971
972 if (UIO_SEG_IS_USER_SPACE(segflg)) {
973 spacetype = proc_is64bit(p) ? UIO_USERSPACE64 : UIO_USERSPACE32;
974 } else {
975 spacetype = UIO_SYSSPACE;
976 }
977
978 if (len < 0) {
979 return EINVAL;
980 }
981
982 auio = uio_createwithbuffer(1, offset, spacetype, rw,
983 &uio_buf[0], sizeof(uio_buf));
984 uio_addiov(auio, CAST_USER_ADDR_T(base), (user_size_t)len);
985
986 #if CONFIG_MACF
987 /* XXXMAC
988 * IO_NOAUTH should be re-examined.
989 * Likely that mediation should be performed in caller.
990 */
991 if ((ioflg & IO_NOAUTH) == 0) {
992 /* passed cred is fp->f_cred */
993 if (rw == UIO_READ) {
994 error = mac_vnode_check_read(&context, cred, vp);
995 } else {
996 error = mac_vnode_check_write(&context, cred, vp);
997 }
998 }
999 #endif
1000
1001 if (error == 0) {
1002 if (rw == UIO_READ) {
1003 if (vnode_isswap(vp) && ((ioflg & IO_SWAP_DISPATCH) == 0)) {
1004 error = vn_read_swapfile(vp, auio);
1005 } else {
1006 error = VNOP_READ(vp, auio, ioflg, &context);
1007 }
1008 } else {
1009 error = VNOP_WRITE(vp, auio, ioflg, &context);
1010 }
1011 }
1012
1013 if (aresid) {
1014 *aresid = uio_resid(auio);
1015 assert(*aresid <= len);
1016 } else if (uio_resid(auio) && error == 0) {
1017 error = EIO;
1018 }
1019 return error;
1020 }
1021
1022 void
vn_offset_lock(struct fileglob * fg)1023 vn_offset_lock(struct fileglob *fg)
1024 {
1025 lck_mtx_lock_spin(&fg->fg_lock);
1026 while (fg->fg_lflags & FG_OFF_LOCKED) {
1027 fg->fg_lflags |= FG_OFF_LOCKWANT;
1028 msleep(&fg->fg_lflags, &fg->fg_lock, PVFS | PSPIN,
1029 "fg_offset_lock_wait", 0);
1030 }
1031 fg->fg_lflags |= FG_OFF_LOCKED;
1032 lck_mtx_unlock(&fg->fg_lock);
1033 }
1034
1035 void
vn_offset_unlock(struct fileglob * fg)1036 vn_offset_unlock(struct fileglob *fg)
1037 {
1038 int lock_wanted = 0;
1039
1040 lck_mtx_lock_spin(&fg->fg_lock);
1041 if (fg->fg_lflags & FG_OFF_LOCKWANT) {
1042 lock_wanted = 1;
1043 }
1044 fg->fg_lflags &= ~(FG_OFF_LOCKED | FG_OFF_LOCKWANT);
1045 lck_mtx_unlock(&fg->fg_lock);
1046 if (lock_wanted) {
1047 wakeup(&fg->fg_lflags);
1048 }
1049 }
1050
1051 static int
vn_read_common(vnode_t vp,struct uio * uio,int fflag,vfs_context_t ctx)1052 vn_read_common(vnode_t vp, struct uio *uio, int fflag, vfs_context_t ctx)
1053 {
1054 int error;
1055 int ioflag;
1056 off_t read_offset;
1057 user_ssize_t read_len;
1058 user_ssize_t adjusted_read_len;
1059 user_ssize_t clippedsize;
1060
1061 /* Caller has already validated read_len. */
1062 read_len = uio_resid(uio);
1063 assert(read_len >= 0 && read_len <= INT_MAX);
1064
1065 adjusted_read_len = read_len;
1066 clippedsize = 0;
1067
1068 #if CONFIG_MACF
1069 error = mac_vnode_check_read(ctx, vfs_context_ucred(ctx), vp);
1070 if (error) {
1071 return error;
1072 }
1073 #endif
1074
1075 /* This signals to VNOP handlers that this read came from a file table read */
1076 ioflag = IO_SYSCALL_DISPATCH;
1077
1078 if (fflag & FNONBLOCK) {
1079 ioflag |= IO_NDELAY;
1080 }
1081 if ((fflag & FNOCACHE) || vnode_isnocache(vp)) {
1082 ioflag |= IO_NOCACHE;
1083 }
1084 if (fflag & FENCRYPTED) {
1085 ioflag |= IO_ENCRYPTED;
1086 }
1087 if (fflag & FUNENCRYPTED) {
1088 ioflag |= IO_SKIP_ENCRYPTION;
1089 }
1090 if (fflag & O_EVTONLY) {
1091 ioflag |= IO_EVTONLY;
1092 }
1093 if (fflag & FNORDAHEAD) {
1094 ioflag |= IO_RAOFF;
1095 }
1096
1097 read_offset = uio_offset(uio);
1098 /* POSIX allows negative offsets for character devices. */
1099 if ((read_offset < 0) && (vnode_vtype(vp) != VCHR)) {
1100 error = EINVAL;
1101 goto error_out;
1102 }
1103
1104 if (read_offset == INT64_MAX) {
1105 /* can't read any more */
1106 error = 0;
1107 goto error_out;
1108 }
1109
1110 /*
1111 * If offset + len will cause overflow, reduce the len to a value
1112 * (adjusted_read_len) where it won't
1113 */
1114 if ((read_offset >= 0) && (INT64_MAX - read_offset) < read_len) {
1115 /*
1116 * 0 read_offset INT64_MAX
1117 * |-----------------------------------------------|----------|~~~
1118 * <--read_len-->
1119 * <-adjusted->
1120 */
1121 adjusted_read_len = (user_ssize_t)(INT64_MAX - read_offset);
1122 }
1123
1124 if (adjusted_read_len < read_len) {
1125 uio_setresid(uio, adjusted_read_len);
1126 clippedsize = read_len - adjusted_read_len;
1127 }
1128
1129 if (vnode_isswap(vp) && !(IO_SKIP_ENCRYPTION & ioflag)) {
1130 /* special case for swap files */
1131 error = vn_read_swapfile(vp, uio);
1132 } else {
1133 error = VNOP_READ(vp, uio, ioflag, ctx);
1134 }
1135
1136 if (clippedsize) {
1137 uio_setresid(uio, (uio_resid(uio) + clippedsize));
1138 }
1139
1140 error_out:
1141 return error;
1142 }
1143
1144 /*
1145 * File table vnode read routine.
1146 */
1147 static int
vn_read(struct fileproc * fp,struct uio * uio,int flags,vfs_context_t ctx)1148 vn_read(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx)
1149 {
1150 vnode_t vp;
1151 user_ssize_t read_len;
1152 int error;
1153 bool offset_locked;
1154
1155 read_len = uio_resid(uio);
1156 if (read_len < 0 || read_len > INT_MAX) {
1157 return EINVAL;
1158 }
1159
1160 if ((flags & FOF_OFFSET) == 0) {
1161 vn_offset_lock(fp->fp_glob);
1162 offset_locked = true;
1163 } else {
1164 offset_locked = false;
1165 }
1166 vp = (struct vnode *)fp_get_data(fp);
1167 if ((error = vnode_getwithref(vp))) {
1168 if (offset_locked) {
1169 vn_offset_unlock(fp->fp_glob);
1170 }
1171 return error;
1172 }
1173
1174 if (offset_locked && (vnode_vtype(vp) != VREG || vnode_isswap(vp))) {
1175 vn_offset_unlock(fp->fp_glob);
1176 offset_locked = false;
1177 }
1178
1179 if ((flags & FOF_OFFSET) == 0) {
1180 uio_setoffset(uio, fp->fp_glob->fg_offset);
1181 }
1182
1183 error = vn_read_common(vp, uio, fp->fp_glob->fg_flag, ctx);
1184
1185 if ((flags & FOF_OFFSET) == 0) {
1186 fp->fp_glob->fg_offset += read_len - uio_resid(uio);
1187 }
1188
1189 if (offset_locked) {
1190 vn_offset_unlock(fp->fp_glob);
1191 offset_locked = false;
1192 }
1193
1194 vnode_put(vp);
1195 return error;
1196 }
1197
1198 /*
1199 * File table vnode write routine.
1200 */
1201 static int
vn_write(struct fileproc * fp,struct uio * uio,int flags,vfs_context_t ctx)1202 vn_write(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx)
1203 {
1204 struct vnode *vp;
1205 int error, ioflag;
1206 off_t write_offset;
1207 off_t write_end_offset;
1208 user_ssize_t write_len;
1209 user_ssize_t adjusted_write_len;
1210 user_ssize_t clippedsize;
1211 bool offset_locked;
1212 proc_t p = vfs_context_proc(ctx);
1213 rlim_t rlim_cur_fsize = p ? proc_limitgetcur(p, RLIMIT_FSIZE) : 0;
1214
1215 write_len = uio_resid(uio);
1216 if (write_len < 0 || write_len > INT_MAX) {
1217 return EINVAL;
1218 }
1219 adjusted_write_len = write_len;
1220 clippedsize = 0;
1221
1222 if ((flags & FOF_OFFSET) == 0) {
1223 vn_offset_lock(fp->fp_glob);
1224 offset_locked = true;
1225 } else {
1226 offset_locked = false;
1227 }
1228
1229 vp = (struct vnode *)fp_get_data(fp);
1230 if ((error = vnode_getwithref(vp))) {
1231 if (offset_locked) {
1232 vn_offset_unlock(fp->fp_glob);
1233 }
1234 return error;
1235 }
1236
1237 if (offset_locked && (vnode_vtype(vp) != VREG || vnode_isswap(vp))) {
1238 vn_offset_unlock(fp->fp_glob);
1239 offset_locked = false;
1240 }
1241
1242 #if CONFIG_MACF
1243 error = mac_vnode_check_write(ctx, vfs_context_ucred(ctx), vp);
1244 if (error) {
1245 (void)vnode_put(vp);
1246 if (offset_locked) {
1247 vn_offset_unlock(fp->fp_glob);
1248 }
1249 return error;
1250 }
1251 #endif
1252
1253 /*
1254 * IO_SYSCALL_DISPATCH signals to VNOP handlers that this write came from
1255 * a file table write
1256 */
1257 ioflag = (IO_UNIT | IO_SYSCALL_DISPATCH);
1258
1259 if (vp->v_type == VREG && (fp->fp_glob->fg_flag & O_APPEND)) {
1260 ioflag |= IO_APPEND;
1261 }
1262 if (fp->fp_glob->fg_flag & FNONBLOCK) {
1263 ioflag |= IO_NDELAY;
1264 }
1265 if ((fp->fp_glob->fg_flag & FNOCACHE) || vnode_isnocache(vp)) {
1266 ioflag |= IO_NOCACHE;
1267 }
1268 if (fp->fp_glob->fg_flag & FNODIRECT) {
1269 ioflag |= IO_NODIRECT;
1270 }
1271 if (fp->fp_glob->fg_flag & FSINGLE_WRITER) {
1272 ioflag |= IO_SINGLE_WRITER;
1273 }
1274 if (fp->fp_glob->fg_flag & O_EVTONLY) {
1275 ioflag |= IO_EVTONLY;
1276 }
1277
1278 /*
1279 * Treat synchronous mounts and O_FSYNC on the fd as equivalent.
1280 *
1281 * XXX We treat O_DSYNC as O_FSYNC for now, since we can not delay
1282 * XXX the non-essential metadata without some additional VFS work;
1283 * XXX the intent at this point is to plumb the interface for it.
1284 */
1285 if ((fp->fp_glob->fg_flag & (O_FSYNC | O_DSYNC)) ||
1286 (vp->v_mount && (vp->v_mount->mnt_flag & MNT_SYNCHRONOUS))) {
1287 ioflag |= IO_SYNC;
1288 }
1289
1290 if ((flags & FOF_OFFSET) == 0) {
1291 write_offset = fp->fp_glob->fg_offset;
1292 uio_setoffset(uio, write_offset);
1293 } else {
1294 /* for pwrite, append should be ignored */
1295 ioflag &= ~IO_APPEND;
1296 write_offset = uio_offset(uio);
1297 /* POSIX allows negative offsets for character devices. */
1298 if ((write_offset < 0) && (vnode_vtype(vp) != VCHR)) {
1299 error = EINVAL;
1300 goto error_out;
1301 }
1302 }
1303
1304 if (write_offset == INT64_MAX) {
1305 /* writes are not possible */
1306 error = EFBIG;
1307 goto error_out;
1308 }
1309
1310 /*
1311 * write_len is the original write length that was requested.
1312 * We may however need to reduce that becasue of two reasons
1313 *
1314 * 1) If write_offset + write_len will exceed OFF_T_MAX (i.e. INT64_MAX)
1315 * and/or
1316 * 2) If write_offset + write_len will exceed the administrative
1317 * limit for the maximum file size.
1318 *
1319 * In both cases the write will be denied if we can't write even a single
1320 * byte otherwise it will be "clipped" (i.e. a short write).
1321 */
1322
1323 /*
1324 * If offset + len will cause overflow, reduce the len
1325 * to a value (adjusted_write_len) where it won't
1326 */
1327 if ((write_offset >= 0) && (INT64_MAX - write_offset) < write_len) {
1328 /*
1329 * 0 write_offset INT64_MAX
1330 * |-----------------------------------------------|----------|~~~
1331 * <--write_len-->
1332 * <-adjusted->
1333 */
1334 adjusted_write_len = (user_ssize_t)(INT64_MAX - write_offset);
1335 }
1336
1337 /* write_end_offset will always be [0, INT64_MAX] */
1338 write_end_offset = write_offset + adjusted_write_len;
1339
1340 if (p && (vp->v_type == VREG) &&
1341 (rlim_cur_fsize != RLIM_INFINITY) &&
1342 (rlim_cur_fsize <= INT64_MAX) &&
1343 (write_end_offset > (off_t)rlim_cur_fsize)) {
1344 /*
1345 * If the requested residual would cause us to go past the
1346 * administrative limit, then we need to adjust the residual
1347 * down to cause fewer bytes than requested to be written. If
1348 * we can't do that (e.g. the residual is already 1 byte),
1349 * then we fail the write with EFBIG.
1350 */
1351 if (write_offset >= (off_t)rlim_cur_fsize) {
1352 /*
1353 * 0 rlim_fsize write_offset write_end INT64_MAX
1354 * |------------------------|----------|-------------|--------|
1355 * <--write_len-->
1356 *
1357 * write not permitted
1358 */
1359 psignal(p, SIGXFSZ);
1360 error = EFBIG;
1361 goto error_out;
1362 }
1363
1364 /*
1365 * 0 write_offset rlim_fsize write_end INT64_MAX
1366 * |------------------------|-----------|---------|------------|
1367 * <------write_len------>
1368 * <-adjusted-->
1369 */
1370 adjusted_write_len = (user_ssize_t)((off_t)rlim_cur_fsize - write_offset);
1371 assert((adjusted_write_len > 0) && (adjusted_write_len < write_len));
1372 }
1373
1374 if (adjusted_write_len < write_len) {
1375 uio_setresid(uio, adjusted_write_len);
1376 clippedsize = write_len - adjusted_write_len;
1377 }
1378
1379 error = VNOP_WRITE(vp, uio, ioflag, ctx);
1380
1381 /*
1382 * If we had to reduce the size of write requested either because
1383 * of rlimit or because it would have exceeded
1384 * maximum file size, we have to add that back to the residual so
1385 * it correctly reflects what we did in this function.
1386 */
1387 if (clippedsize) {
1388 uio_setresid(uio, (uio_resid(uio) + clippedsize));
1389 }
1390
1391 if ((flags & FOF_OFFSET) == 0) {
1392 if (ioflag & IO_APPEND) {
1393 fp->fp_glob->fg_offset = uio_offset(uio);
1394 } else {
1395 fp->fp_glob->fg_offset += (write_len - uio_resid(uio));
1396 }
1397 if (offset_locked) {
1398 vn_offset_unlock(fp->fp_glob);
1399 offset_locked = false;
1400 }
1401 }
1402
1403 /*
1404 * Set the credentials on successful writes
1405 */
1406 if ((error == 0) && (vp->v_tag == VT_NFS) && (UBCINFOEXISTS(vp))) {
1407 ubc_setcred(vp, vfs_context_ucred(ctx));
1408 }
1409
1410 #if CONFIG_FILE_LEASES
1411 /*
1412 * On success, break the parent dir lease as the file's attributes (size
1413 * and/or mtime) have changed. Best attempt to break lease, just drop the
1414 * the error upon failure as there is no point to return error when the
1415 * write has completed successfully.
1416 */
1417 if (__probable(error == 0)) {
1418 vnode_breakdirlease(vp, true, O_WRONLY);
1419 }
1420 #endif /* CONFIG_FILE_LEASES */
1421
1422 (void)vnode_put(vp);
1423 return error;
1424
1425 error_out:
1426 if (offset_locked) {
1427 vn_offset_unlock(fp->fp_glob);
1428 }
1429 (void)vnode_put(vp);
1430 return error;
1431 }
1432
1433 /*
1434 * File table vnode stat routine.
1435 *
1436 * Returns: 0 Success
1437 * EBADF
1438 * ENOMEM
1439 * vnode_getattr:???
1440 */
1441 int
vn_stat_noauth(struct vnode * vp,void * sbptr,kauth_filesec_t * xsec,int isstat64,int needsrealdev,vfs_context_t ctx,struct ucred * file_cred)1442 vn_stat_noauth(struct vnode *vp, void *sbptr, kauth_filesec_t *xsec, int isstat64,
1443 int needsrealdev, vfs_context_t ctx, struct ucred *file_cred)
1444 {
1445 struct vnode_attr va;
1446 int error;
1447 u_short mode;
1448 kauth_filesec_t fsec;
1449 struct stat *sb = (struct stat *)0; /* warning avoidance ; protected by isstat64 */
1450 struct stat64 * sb64 = (struct stat64 *)0; /* warning avoidance ; protected by isstat64 */
1451
1452 if (isstat64 != 0) {
1453 sb64 = (struct stat64 *)sbptr;
1454 } else {
1455 sb = (struct stat *)sbptr;
1456 }
1457 memset(&va, 0, sizeof(va));
1458 VATTR_INIT(&va);
1459 VATTR_WANTED(&va, va_fsid);
1460 VATTR_WANTED(&va, va_fileid);
1461 VATTR_WANTED(&va, va_mode);
1462 VATTR_WANTED(&va, va_type);
1463 VATTR_WANTED(&va, va_nlink);
1464 VATTR_WANTED(&va, va_uid);
1465 VATTR_WANTED(&va, va_gid);
1466 VATTR_WANTED(&va, va_rdev);
1467 VATTR_WANTED(&va, va_data_size);
1468 VATTR_WANTED(&va, va_access_time);
1469 VATTR_WANTED(&va, va_modify_time);
1470 VATTR_WANTED(&va, va_change_time);
1471 VATTR_WANTED(&va, va_create_time);
1472 VATTR_WANTED(&va, va_flags);
1473 VATTR_WANTED(&va, va_gen);
1474 VATTR_WANTED(&va, va_iosize);
1475 /* lower layers will synthesise va_total_alloc from va_data_size if required */
1476 VATTR_WANTED(&va, va_total_alloc);
1477 if (xsec != NULL) {
1478 VATTR_WANTED(&va, va_uuuid);
1479 VATTR_WANTED(&va, va_guuid);
1480 VATTR_WANTED(&va, va_acl);
1481 }
1482 if (needsrealdev) {
1483 va.va_vaflags = VA_REALFSID;
1484 }
1485 error = vnode_getattr(vp, &va, ctx);
1486 if (error) {
1487 goto out;
1488 }
1489 #if CONFIG_MACF
1490 /*
1491 * Give MAC polices a chance to reject or filter the attributes
1492 * returned by the filesystem. Note that MAC policies are consulted
1493 * *after* calling the filesystem because filesystems can return more
1494 * attributes than were requested so policies wouldn't be authoritative
1495 * is consulted beforehand. This also gives policies an opportunity
1496 * to change the values of attributes retrieved.
1497 */
1498 error = mac_vnode_check_getattr(ctx, file_cred, vp, &va);
1499 if (error) {
1500 goto out;
1501 }
1502 #endif
1503 /*
1504 * Copy from vattr table
1505 */
1506 if (isstat64 != 0) {
1507 sb64->st_dev = va.va_fsid;
1508 sb64->st_ino = (ino64_t)va.va_fileid;
1509 } else {
1510 sb->st_dev = va.va_fsid;
1511 sb->st_ino = (ino_t)va.va_fileid;
1512 }
1513 mode = va.va_mode;
1514 switch (vp->v_type) {
1515 case VREG:
1516 mode |= S_IFREG;
1517 break;
1518 case VDIR:
1519 mode |= S_IFDIR;
1520 break;
1521 case VBLK:
1522 mode |= S_IFBLK;
1523 break;
1524 case VCHR:
1525 mode |= S_IFCHR;
1526 break;
1527 case VLNK:
1528 mode |= S_IFLNK;
1529 break;
1530 case VSOCK:
1531 mode |= S_IFSOCK;
1532 break;
1533 case VFIFO:
1534 mode |= S_IFIFO;
1535 break;
1536 default:
1537 error = EBADF;
1538 goto out;
1539 }
1540 ;
1541 if (isstat64 != 0) {
1542 sb64->st_mode = mode;
1543 sb64->st_nlink = VATTR_IS_SUPPORTED(&va, va_nlink) ? va.va_nlink > UINT16_MAX ? UINT16_MAX : (u_int16_t)va.va_nlink : 1;
1544 sb64->st_uid = va.va_uid;
1545 sb64->st_gid = va.va_gid;
1546 sb64->st_rdev = va.va_rdev;
1547 sb64->st_size = va.va_data_size;
1548 sb64->st_atimespec = va.va_access_time;
1549 sb64->st_mtimespec = va.va_modify_time;
1550 sb64->st_ctimespec = va.va_change_time;
1551 if (VATTR_IS_SUPPORTED(&va, va_create_time)) {
1552 sb64->st_birthtimespec = va.va_create_time;
1553 } else {
1554 sb64->st_birthtimespec.tv_sec = sb64->st_birthtimespec.tv_nsec = 0;
1555 }
1556 sb64->st_blksize = va.va_iosize;
1557 sb64->st_flags = va.va_flags;
1558 sb64->st_blocks = roundup(va.va_total_alloc, 512) / 512;
1559 } else {
1560 sb->st_mode = mode;
1561 sb->st_nlink = VATTR_IS_SUPPORTED(&va, va_nlink) ? va.va_nlink > UINT16_MAX ? UINT16_MAX : (u_int16_t)va.va_nlink : 1;
1562 sb->st_uid = va.va_uid;
1563 sb->st_gid = va.va_gid;
1564 sb->st_rdev = va.va_rdev;
1565 sb->st_size = va.va_data_size;
1566 sb->st_atimespec = va.va_access_time;
1567 sb->st_mtimespec = va.va_modify_time;
1568 sb->st_ctimespec = va.va_change_time;
1569 sb->st_blksize = va.va_iosize;
1570 sb->st_flags = va.va_flags;
1571 sb->st_blocks = roundup(va.va_total_alloc, 512) / 512;
1572 }
1573
1574 /* if we're interested in extended security data and we got an ACL */
1575 if (xsec != NULL) {
1576 if (!VATTR_IS_SUPPORTED(&va, va_acl) &&
1577 !VATTR_IS_SUPPORTED(&va, va_uuuid) &&
1578 !VATTR_IS_SUPPORTED(&va, va_guuid)) {
1579 *xsec = KAUTH_FILESEC_NONE;
1580 } else {
1581 if (VATTR_IS_SUPPORTED(&va, va_acl) && (va.va_acl != NULL)) {
1582 fsec = kauth_filesec_alloc(va.va_acl->acl_entrycount);
1583 } else {
1584 fsec = kauth_filesec_alloc(0);
1585 }
1586 if (fsec == NULL) {
1587 error = ENOMEM;
1588 goto out;
1589 }
1590 fsec->fsec_magic = KAUTH_FILESEC_MAGIC;
1591 if (VATTR_IS_SUPPORTED(&va, va_uuuid)) {
1592 fsec->fsec_owner = va.va_uuuid;
1593 } else {
1594 fsec->fsec_owner = kauth_null_guid;
1595 }
1596 if (VATTR_IS_SUPPORTED(&va, va_guuid)) {
1597 fsec->fsec_group = va.va_guuid;
1598 } else {
1599 fsec->fsec_group = kauth_null_guid;
1600 }
1601 if (VATTR_IS_SUPPORTED(&va, va_acl) && (va.va_acl != NULL)) {
1602 __nochk_bcopy(va.va_acl, &(fsec->fsec_acl), KAUTH_ACL_COPYSIZE(va.va_acl));
1603 } else {
1604 fsec->fsec_acl.acl_entrycount = KAUTH_FILESEC_NOACL;
1605 }
1606 *xsec = fsec;
1607 }
1608 }
1609
1610 /* Do not give the generation number out to unpriviledged users */
1611 if (va.va_gen && !vfs_context_issuser(ctx)) {
1612 if (isstat64 != 0) {
1613 sb64->st_gen = 0;
1614 } else {
1615 sb->st_gen = 0;
1616 }
1617 } else {
1618 if (isstat64 != 0) {
1619 sb64->st_gen = va.va_gen;
1620 } else {
1621 sb->st_gen = va.va_gen;
1622 }
1623 }
1624
1625 error = 0;
1626 out:
1627 if (VATTR_IS_SUPPORTED(&va, va_acl) && va.va_acl != NULL) {
1628 kauth_acl_free(va.va_acl);
1629 }
1630 return error;
1631 }
1632
1633 int
vn_stat(struct vnode * vp,void * sb,kauth_filesec_t * xsec,int isstat64,int needsrealdev,vfs_context_t ctx)1634 vn_stat(struct vnode *vp, void *sb, kauth_filesec_t *xsec, int isstat64, int needsrealdev, vfs_context_t ctx)
1635 {
1636 int error;
1637
1638 #if CONFIG_MACF
1639 error = mac_vnode_check_stat(ctx, NOCRED, vp);
1640 if (error) {
1641 return error;
1642 }
1643 #endif
1644
1645 /* authorize */
1646 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_READ_ATTRIBUTES | KAUTH_VNODE_READ_SECURITY, ctx)) != 0) {
1647 return error;
1648 }
1649
1650 /* actual stat */
1651 return vn_stat_noauth(vp, sb, xsec, isstat64, needsrealdev, ctx, NOCRED);
1652 }
1653
1654
1655 /*
1656 * File table vnode ioctl routine.
1657 */
1658 static int
vn_ioctl(struct fileproc * fp,u_long com,caddr_t data,vfs_context_t ctx)1659 vn_ioctl(struct fileproc *fp, u_long com, caddr_t data, vfs_context_t ctx)
1660 {
1661 struct vnode *vp = (struct vnode *)fp_get_data(fp);
1662 off_t file_size;
1663 int error;
1664 struct vnode *ttyvp;
1665
1666 if ((error = vnode_getwithref(vp))) {
1667 return error;
1668 }
1669
1670 #if CONFIG_MACF
1671 error = mac_vnode_check_ioctl(ctx, vp, com);
1672 if (error) {
1673 goto out;
1674 }
1675 #endif
1676
1677 switch (vp->v_type) {
1678 case VREG:
1679 case VDIR:
1680 if (com == FIONREAD) {
1681 off_t temp_nbytes;
1682 if ((error = vnode_size(vp, &file_size, ctx)) != 0) {
1683 goto out;
1684 }
1685 temp_nbytes = file_size - fp->fp_glob->fg_offset;
1686 if (temp_nbytes > INT_MAX) {
1687 *(int *)data = INT_MAX;
1688 } else if (temp_nbytes < 0) {
1689 *(int *)data = 0;
1690 } else {
1691 *(int *)data = (int)temp_nbytes;
1692 }
1693 goto out;
1694 }
1695 if (com == FIONBIO || com == FIOASYNC) { /* XXX */
1696 goto out;
1697 }
1698 OS_FALLTHROUGH;
1699
1700 default:
1701 error = ENOTTY;
1702 goto out;
1703
1704 case VFIFO:
1705 case VCHR:
1706 case VBLK:
1707
1708 if (com == TIOCREVOKE || com == TIOCREVOKECLEAR) {
1709 error = ENOTTY;
1710 goto out;
1711 }
1712
1713 /* Should not be able to set block size from user space */
1714 if (com == DKIOCSETBLOCKSIZE) {
1715 error = EPERM;
1716 goto out;
1717 }
1718
1719 /* Should not be able to check if filesystem is authenticated from user space */
1720 if (com == FSIOC_AUTH_FS) {
1721 error = ENOTTY;
1722 goto out;
1723 }
1724
1725 if (com == FIODTYPE) {
1726 if (vp->v_type == VBLK) {
1727 if (major(vp->v_rdev) >= nblkdev) {
1728 error = ENXIO;
1729 goto out;
1730 }
1731 *(int *)data = bdevsw[major(vp->v_rdev)].d_type;
1732 } else if (vp->v_type == VCHR) {
1733 if (major(vp->v_rdev) >= nchrdev) {
1734 error = ENXIO;
1735 goto out;
1736 }
1737 *(int *)data = cdevsw[major(vp->v_rdev)].d_type;
1738 } else {
1739 error = ENOTTY;
1740 goto out;
1741 }
1742 goto out;
1743 }
1744 error = VNOP_IOCTL(vp, com, data, fp->fp_glob->fg_flag, ctx);
1745
1746 if (error == 0 && com == TIOCSCTTY) {
1747 struct session *sessp;
1748 struct pgrp *pg;
1749
1750 pg = proc_pgrp(vfs_context_proc(ctx), &sessp);
1751
1752 session_lock(sessp);
1753 ttyvp = sessp->s_ttyvp;
1754 sessp->s_ttyvp = vp;
1755 sessp->s_ttyvid = vnode_vid(vp);
1756 session_unlock(sessp);
1757
1758 pgrp_rele(pg);
1759 }
1760 }
1761 out:
1762 (void)vnode_put(vp);
1763 return error;
1764 }
1765
1766 /*
1767 * File table vnode select routine.
1768 */
1769 static int
vn_select(struct fileproc * fp,int which,void * wql,__unused vfs_context_t ctx)1770 vn_select(struct fileproc *fp, int which, void *wql, __unused vfs_context_t ctx)
1771 {
1772 int error;
1773 struct vnode * vp = (struct vnode *)fp_get_data(fp);
1774 struct vfs_context context;
1775
1776 if ((error = vnode_getwithref(vp)) == 0) {
1777 context.vc_thread = current_thread();
1778 context.vc_ucred = fp->fp_glob->fg_cred;
1779
1780 #if CONFIG_MACF
1781 /*
1782 * XXX We should use a per thread credential here; minimally,
1783 * XXX the process credential should have a persistent
1784 * XXX reference on it before being passed in here.
1785 */
1786 error = mac_vnode_check_select(ctx, vp, which);
1787 if (error == 0)
1788 #endif
1789 error = VNOP_SELECT(vp, which, fp->fp_glob->fg_flag, wql, ctx);
1790
1791 (void)vnode_put(vp);
1792 }
1793 return error;
1794 }
1795
1796 /*
1797 * File table vnode close routine.
1798 */
1799 static int
vn_closefile(struct fileglob * fg,vfs_context_t ctx)1800 vn_closefile(struct fileglob *fg, vfs_context_t ctx)
1801 {
1802 struct vnode *vp = fg_get_data(fg);
1803 int error;
1804
1805 if ((error = vnode_getwithref(vp)) == 0) {
1806 if (FILEGLOB_DTYPE(fg) == DTYPE_VNODE &&
1807 ((fg->fg_flag & FWASLOCKED) != 0 ||
1808 (fg->fg_lflags & FG_HAS_OFDLOCK) != 0)) {
1809 struct flock lf = {
1810 .l_whence = SEEK_SET,
1811 .l_start = 0,
1812 .l_len = 0,
1813 .l_type = F_UNLCK
1814 };
1815
1816 if ((fg->fg_flag & FWASLOCKED) != 0) {
1817 (void) VNOP_ADVLOCK(vp, (caddr_t)fg,
1818 F_UNLCK, &lf, F_FLOCK, ctx, NULL);
1819 }
1820
1821 if ((fg->fg_lflags & FG_HAS_OFDLOCK) != 0) {
1822 (void) VNOP_ADVLOCK(vp, (caddr_t)fg,
1823 F_UNLCK, &lf, F_OFD_LOCK, ctx, NULL);
1824 }
1825 }
1826 #if CONFIG_FILE_LEASES
1827 if (FILEGLOB_DTYPE(fg) == DTYPE_VNODE && !LIST_EMPTY(&vp->v_leases)) {
1828 /* Expected open count doesn't matter for release. */
1829 (void)vnode_setlease(vp, fg, F_UNLCK, 0, ctx);
1830 }
1831 #endif
1832 error = vn_close(vp, fg->fg_flag, ctx);
1833 (void) vnode_put(vp);
1834 }
1835 return error;
1836 }
1837
1838 /*
1839 * Returns: 0 Success
1840 * VNOP_PATHCONF:???
1841 */
1842 int
vn_pathconf(vnode_t vp,int name,int32_t * retval,vfs_context_t ctx)1843 vn_pathconf(vnode_t vp, int name, int32_t *retval, vfs_context_t ctx)
1844 {
1845 int error = 0;
1846 struct vfs_attr vfa;
1847
1848 switch (name) {
1849 case _PC_EXTENDED_SECURITY_NP:
1850 *retval = vfs_extendedsecurity(vnode_mount(vp)) ? 1 : 0;
1851 break;
1852 case _PC_AUTH_OPAQUE_NP:
1853 *retval = vfs_authopaque(vnode_mount(vp));
1854 break;
1855 case _PC_2_SYMLINKS:
1856 *retval = 1; /* XXX NOTSUP on MSDOS, etc. */
1857 break;
1858 case _PC_ALLOC_SIZE_MIN:
1859 *retval = 1; /* XXX lie: 1 byte */
1860 break;
1861 case _PC_ASYNC_IO: /* unistd.h: _POSIX_ASYNCHRONUS_IO */
1862 *retval = 1; /* [AIO] option is supported */
1863 break;
1864 case _PC_PRIO_IO: /* unistd.h: _POSIX_PRIORITIZED_IO */
1865 *retval = 0; /* [PIO] option is not supported */
1866 break;
1867 case _PC_REC_INCR_XFER_SIZE:
1868 *retval = 4096; /* XXX go from MIN to MAX 4K at a time */
1869 break;
1870 case _PC_REC_MIN_XFER_SIZE:
1871 *retval = 4096; /* XXX recommend 4K minimum reads/writes */
1872 break;
1873 case _PC_REC_MAX_XFER_SIZE:
1874 *retval = 65536; /* XXX recommend 64K maximum reads/writes */
1875 break;
1876 case _PC_REC_XFER_ALIGN:
1877 *retval = 4096; /* XXX recommend page aligned buffers */
1878 break;
1879 case _PC_SYMLINK_MAX:
1880 *retval = 255; /* Minimum acceptable POSIX value */
1881 break;
1882 case _PC_SYNC_IO: /* unistd.h: _POSIX_SYNCHRONIZED_IO */
1883 *retval = 0; /* [SIO] option is not supported */
1884 break;
1885 case _PC_XATTR_SIZE_BITS:
1886 /* The number of bits used to store maximum extended
1887 * attribute size in bytes. For example, if the maximum
1888 * attribute size supported by a file system is 128K, the
1889 * value returned will be 18. However a value 18 can mean
1890 * that the maximum attribute size can be anywhere from
1891 * (256KB - 1) to 128KB. As a special case, the resource
1892 * fork can have much larger size, and some file system
1893 * specific extended attributes can have smaller and preset
1894 * size; for example, Finder Info is always 32 bytes.
1895 */
1896 memset(&vfa, 0, sizeof(vfa));
1897 VFSATTR_INIT(&vfa);
1898 VFSATTR_WANTED(&vfa, f_capabilities);
1899 if (vfs_getattr(vnode_mount(vp), &vfa, ctx) == 0 &&
1900 (VFSATTR_IS_SUPPORTED(&vfa, f_capabilities)) &&
1901 (vfa.f_capabilities.capabilities[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_EXTENDED_ATTR) &&
1902 (vfa.f_capabilities.valid[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_EXTENDED_ATTR)) {
1903 /* Supports native extended attributes */
1904 error = VNOP_PATHCONF(vp, name, retval, ctx);
1905 } else {
1906 /* Number of bits used to represent the maximum size of
1907 * extended attribute stored in an Apple Double file.
1908 */
1909 *retval = AD_XATTR_SIZE_BITS;
1910 }
1911 break;
1912 default:
1913 error = VNOP_PATHCONF(vp, name, retval, ctx);
1914 break;
1915 }
1916
1917 return error;
1918 }
1919
1920 static int
vn_kqfilter(struct fileproc * fp,struct knote * kn,struct kevent_qos_s * kev)1921 vn_kqfilter(struct fileproc *fp, struct knote *kn, struct kevent_qos_s *kev)
1922 {
1923 vfs_context_t ctx = vfs_context_current();
1924 struct vnode *vp;
1925 int error = 0;
1926 int result = 0;
1927
1928 vp = (struct vnode *)fp_get_data(fp);
1929
1930 /*
1931 * Don't attach a knote to a dead vnode.
1932 */
1933 if ((error = vget_internal(vp, 0, VNODE_NODEAD)) == 0) {
1934 switch (kn->kn_filter) {
1935 case EVFILT_READ:
1936 case EVFILT_WRITE:
1937 if (vnode_isfifo(vp)) {
1938 /* We'll only watch FIFOs that use our fifofs */
1939 if (!(vp->v_fifoinfo && vp->v_fifoinfo->fi_readsock)) {
1940 error = ENOTSUP;
1941 }
1942 } else if (!vnode_isreg(vp)) {
1943 if (vnode_ischr(vp)) {
1944 result = spec_kqfilter(vp, kn, kev);
1945 if ((kn->kn_flags & EV_ERROR) == 0) {
1946 /* claimed by a special device */
1947 vnode_put(vp);
1948 return result;
1949 }
1950 }
1951 error = EINVAL;
1952 }
1953 break;
1954 case EVFILT_VNODE:
1955 break;
1956 default:
1957 error = EINVAL;
1958 }
1959
1960 if (error == 0) {
1961 #if CONFIG_MACF
1962 error = mac_vnode_check_kqfilter(ctx, fp->fp_glob->fg_cred, kn, vp);
1963 if (error) {
1964 vnode_put(vp);
1965 goto out;
1966 }
1967 #endif
1968
1969 kn->kn_hook = (void*)vp;
1970 kn->kn_filtid = EVFILTID_VN;
1971 vnode_hold(vp);
1972
1973 vnode_lock(vp);
1974 KNOTE_ATTACH(&vp->v_knotes, kn);
1975 result = filt_vnode_common(kn, NULL, vp, 0);
1976 vnode_unlock(vp);
1977
1978 /*
1979 * Ask the filesystem to provide remove notifications,
1980 * but ignore failure
1981 */
1982 VNOP_MONITOR(vp, 0, VNODE_MONITOR_BEGIN, (void*) kn, ctx);
1983 }
1984
1985 vnode_put(vp);
1986 }
1987
1988 out:
1989 if (error) {
1990 knote_set_error(kn, error);
1991 }
1992
1993 return result;
1994 }
1995
1996 static void
filt_vndetach(struct knote * kn)1997 filt_vndetach(struct knote *kn)
1998 {
1999 vfs_context_t ctx = vfs_context_current();
2000 struct vnode *vp = (struct vnode *)kn->kn_hook;
2001 uint32_t vid = vnode_vid(vp);
2002 if (vnode_getwithvid(vp, vid)) {
2003 vnode_drop(vp);
2004 return;
2005 }
2006 vnode_drop(vp);
2007
2008 vnode_lock(vp);
2009 KNOTE_DETACH(&vp->v_knotes, kn);
2010 vnode_unlock(vp);
2011
2012 /*
2013 * Tell a (generally networked) filesystem that we're no longer watching
2014 * If the FS wants to track contexts, it should still be using the one from
2015 * the VNODE_MONITOR_BEGIN.
2016 */
2017 VNOP_MONITOR(vp, 0, VNODE_MONITOR_END, (void*)kn, ctx);
2018 vnode_put(vp);
2019 }
2020
2021
2022 /*
2023 * Used for EVFILT_READ
2024 *
2025 * Takes only VFIFO or VREG. vnode is locked. We handle the "poll" case
2026 * differently than the regular case for VREG files. If not in poll(),
2027 * then we need to know current fileproc offset for VREG.
2028 */
2029 static int64_t
vnode_readable_data_count(vnode_t vp,off_t current_offset,int ispoll)2030 vnode_readable_data_count(vnode_t vp, off_t current_offset, int ispoll)
2031 {
2032 if (vnode_isfifo(vp)) {
2033 #if FIFO
2034 int cnt;
2035 int err = fifo_charcount(vp, &cnt);
2036 if (err == 0) {
2037 return (int64_t)cnt;
2038 } else
2039 #endif
2040 {
2041 return 0;
2042 }
2043 } else if (vnode_isreg(vp)) {
2044 if (ispoll) {
2045 return 1;
2046 }
2047
2048 off_t amount;
2049 amount = vp->v_un.vu_ubcinfo->ui_size - current_offset;
2050 if (amount > INT64_MAX) {
2051 return INT64_MAX;
2052 } else if (amount < INT64_MIN) {
2053 return INT64_MIN;
2054 } else {
2055 return (int64_t)amount;
2056 }
2057 } else {
2058 panic("Should never have an EVFILT_READ except for reg or fifo.");
2059 return 0;
2060 }
2061 }
2062
2063 /*
2064 * Used for EVFILT_WRITE.
2065 *
2066 * For regular vnodes, we can always write (1). For named pipes,
2067 * see how much space there is in the buffer. Nothing else is covered.
2068 */
2069 static intptr_t
vnode_writable_space_count(vnode_t vp)2070 vnode_writable_space_count(vnode_t vp)
2071 {
2072 if (vnode_isfifo(vp)) {
2073 #if FIFO
2074 long spc;
2075 int err = fifo_freespace(vp, &spc);
2076 if (err == 0) {
2077 return (intptr_t)spc;
2078 } else
2079 #endif
2080 {
2081 return (intptr_t)0;
2082 }
2083 } else if (vnode_isreg(vp)) {
2084 return (intptr_t)1;
2085 } else {
2086 panic("Should never have an EVFILT_READ except for reg or fifo.");
2087 return 0;
2088 }
2089 }
2090
2091 /*
2092 * Determine whether this knote should be active
2093 *
2094 * This is kind of subtle.
2095 * --First, notice if the vnode has been revoked: in so, override hint
2096 * --EVFILT_READ knotes are checked no matter what the hint is
2097 * --Other knotes activate based on hint.
2098 * --If hint is revoke, set special flags and activate
2099 */
2100 static int
filt_vnode_common(struct knote * kn,struct kevent_qos_s * kev,vnode_t vp,long hint)2101 filt_vnode_common(struct knote *kn, struct kevent_qos_s *kev, vnode_t vp, long hint)
2102 {
2103 int activate = 0;
2104 int64_t data = 0;
2105
2106 lck_mtx_assert(&vp->v_lock, LCK_MTX_ASSERT_OWNED);
2107
2108 /* Special handling for vnodes that are in recycle or already gone */
2109 if (NOTE_REVOKE == hint) {
2110 kn->kn_flags |= (EV_EOF | EV_ONESHOT);
2111 activate = 1;
2112
2113 if ((kn->kn_filter == EVFILT_VNODE) && (kn->kn_sfflags & NOTE_REVOKE)) {
2114 kn->kn_fflags |= NOTE_REVOKE;
2115 }
2116 } else {
2117 switch (kn->kn_filter) {
2118 case EVFILT_READ:
2119 data = vnode_readable_data_count(vp, kn->kn_fp->fp_glob->fg_offset, (kn->kn_flags & EV_POLL));
2120 activate = (data != 0);
2121 break;
2122 case EVFILT_WRITE:
2123 data = vnode_writable_space_count(vp);
2124 activate = (data != 0);
2125 break;
2126 case EVFILT_VNODE:
2127 /* Check events this note matches against the hint */
2128 if (kn->kn_sfflags & hint) {
2129 kn->kn_fflags |= (uint32_t)hint; /* Set which event occurred */
2130 }
2131 activate = (kn->kn_fflags != 0);
2132 break;
2133 default:
2134 panic("Invalid knote filter on a vnode!");
2135 }
2136 }
2137
2138 if (kev && activate) {
2139 knote_fill_kevent(kn, kev, data);
2140 }
2141
2142 return activate;
2143 }
2144
2145 static int
filt_vnode(struct knote * kn,long hint)2146 filt_vnode(struct knote *kn, long hint)
2147 {
2148 vnode_t vp = (struct vnode *)kn->kn_hook;
2149
2150 return filt_vnode_common(kn, NULL, vp, hint);
2151 }
2152
2153 static int
filt_vntouch(struct knote * kn,struct kevent_qos_s * kev)2154 filt_vntouch(struct knote *kn, struct kevent_qos_s *kev)
2155 {
2156 vnode_t vp = (struct vnode *)kn->kn_hook;
2157 uint32_t vid = vnode_vid(vp);
2158 int activate;
2159 int hint = 0;
2160
2161 vnode_lock(vp);
2162 if (vnode_getiocount(vp, vid, VNODE_NODEAD | VNODE_WITHID) != 0) {
2163 /* is recycled */
2164 hint = NOTE_REVOKE;
2165 }
2166
2167 /* accept new input fflags mask */
2168 kn->kn_sfflags = kev->fflags;
2169
2170 activate = filt_vnode_common(kn, NULL, vp, hint);
2171
2172 if (hint == 0) {
2173 vnode_put_locked(vp);
2174 }
2175 vnode_unlock(vp);
2176
2177 return activate;
2178 }
2179
2180 static int
filt_vnprocess(struct knote * kn,struct kevent_qos_s * kev)2181 filt_vnprocess(struct knote *kn, struct kevent_qos_s *kev)
2182 {
2183 vnode_t vp = (struct vnode *)kn->kn_hook;
2184 uint32_t vid = vnode_vid(vp);
2185 int activate;
2186 int hint = 0;
2187
2188 vnode_lock(vp);
2189 if (vnode_getiocount(vp, vid, VNODE_NODEAD | VNODE_WITHID) != 0) {
2190 /* Is recycled */
2191 hint = NOTE_REVOKE;
2192 }
2193 activate = filt_vnode_common(kn, kev, vp, hint);
2194
2195 /* Definitely need to unlock, may need to put */
2196 if (hint == 0) {
2197 vnode_put_locked(vp);
2198 }
2199 vnode_unlock(vp);
2200
2201 return activate;
2202 }
2203
2204 struct vniodesc {
2205 vnode_t vnio_vnode; /* associated vnode */
2206 int vnio_fflags; /* cached fileglob flags */
2207 };
2208
2209 errno_t
vnio_openfd(int fd,vniodesc_t * vniop)2210 vnio_openfd(int fd, vniodesc_t *vniop)
2211 {
2212 proc_t p = current_proc();
2213 struct fileproc *fp = NULL;
2214 vniodesc_t vnio;
2215 vnode_t vp;
2216 int error;
2217 bool need_drop = false;
2218
2219 vnio = kalloc_type(struct vniodesc, Z_WAITOK);
2220
2221 error = fp_getfvp(p, fd, &fp, &vp);
2222 if (error) {
2223 goto out;
2224 }
2225 need_drop = true;
2226
2227 if ((fp->fp_glob->fg_flag & (FREAD | FWRITE)) == 0) {
2228 error = EBADF;
2229 goto out;
2230 }
2231
2232 if (vnode_isswap(vp)) {
2233 error = EPERM;
2234 goto out;
2235 }
2236
2237 if (vp->v_type != VREG) {
2238 error = EFTYPE;
2239 goto out;
2240 }
2241
2242 error = vnode_getwithref(vp);
2243 if (error) {
2244 goto out;
2245 }
2246
2247 vnio->vnio_vnode = vp;
2248 vnio->vnio_fflags = fp->fp_glob->fg_flag;
2249
2250 (void)fp_drop(p, fd, fp, 0);
2251 need_drop = false;
2252
2253 error = vnode_ref_ext(vp, vnio->vnio_fflags, 0);
2254 if (error == 0) {
2255 *vniop = vnio;
2256 vnio = NULL;
2257 }
2258
2259 vnode_put(vp);
2260
2261 out:
2262 if (need_drop) {
2263 fp_drop(p, fd, fp, 0);
2264 }
2265 if (vnio != NULL) {
2266 kfree_type(struct vniodesc, vnio);
2267 }
2268 return error;
2269 }
2270
2271 errno_t
vnio_close(vniodesc_t vnio)2272 vnio_close(vniodesc_t vnio)
2273 {
2274 int error;
2275
2276 /*
2277 * The vniodesc is always destroyed, because the close
2278 * always "succeeds". We just return whatever error
2279 * might have been encountered while doing so.
2280 */
2281
2282 error = vnode_getwithref(vnio->vnio_vnode);
2283 if (error == 0) {
2284 error = vnode_close(vnio->vnio_vnode, vnio->vnio_fflags, NULL);
2285 }
2286
2287 kfree_type(struct vniodesc, vnio);
2288
2289 return error;
2290 }
2291
2292 errno_t
vnio_read(vniodesc_t vnio,uio_t uio)2293 vnio_read(vniodesc_t vnio, uio_t uio)
2294 {
2295 vnode_t vp = vnio->vnio_vnode;
2296 user_ssize_t read_len;
2297 int error;
2298
2299 read_len = uio_resid(uio);
2300 if (read_len < 0 || read_len > INT_MAX) {
2301 return EINVAL;
2302 }
2303
2304 error = vnode_getwithref(vp);
2305 if (error == 0) {
2306 error = vn_read_common(vp, uio, vnio->vnio_fflags,
2307 vfs_context_current());
2308 vnode_put(vp);
2309 }
2310
2311 return error;
2312 }
2313
2314 vnode_t
vnio_vnode(vniodesc_t vnio)2315 vnio_vnode(vniodesc_t vnio)
2316 {
2317 return vnio->vnio_vnode;
2318 }
2319