1 /*
2 * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
29 /*
30 * Copyright (c) 1982, 1986, 1989, 1993
31 * The Regents of the University of California. All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64 * SUCH DAMAGE.
65 *
66 * @(#)vfs_vnops.c 8.14 (Berkeley) 6/15/95
67 *
68 */
69 /*
70 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
71 * support for mandatory and extensible security protections. This notice
72 * is included in support of clause 2.2 (b) of the Apple Public License,
73 * Version 2.0.
74 */
75
76 #include <sys/param.h>
77 #include <sys/types.h>
78 #include <sys/systm.h>
79 #include <sys/kernel.h>
80 #include <sys/file_internal.h>
81 #include <sys/stat.h>
82 #include <sys/proc_internal.h>
83 #include <sys/kauth.h>
84 #include <sys/mount_internal.h>
85 #include <sys/namei.h>
86 #include <sys/vnode_internal.h>
87 #include <sys/ioctl.h>
88 #include <sys/tty.h>
89 /* Temporary workaround for ubc.h until <rdar://4714366 is resolved */
90 #define ubc_setcred ubc_setcred_deprecated
91 #include <sys/ubc.h>
92 #undef ubc_setcred
93 int ubc_setcred(struct vnode *, struct proc *);
94 #include <sys/conf.h>
95 #include <sys/disk.h>
96 #include <sys/fsevents.h>
97 #include <sys/kdebug.h>
98 #include <sys/xattr.h>
99 #include <sys/ubc_internal.h>
100 #include <sys/uio_internal.h>
101 #include <sys/resourcevar.h>
102 #include <sys/signalvar.h>
103
104 #include <vm/vm_kern.h>
105 #include <vm/vm_map.h>
106
107 #include <miscfs/specfs/specdev.h>
108 #include <miscfs/fifofs/fifo.h>
109
110 #if CONFIG_MACF
111 #include <security/mac_framework.h>
112 #endif
113
114 #include <IOKit/IOBSD.h>
115 #include <libkern/section_keywords.h>
116
117 static int vn_closefile(struct fileglob *fp, vfs_context_t ctx);
118 static int vn_ioctl(struct fileproc *fp, u_long com, caddr_t data,
119 vfs_context_t ctx);
120 static int vn_read(struct fileproc *fp, struct uio *uio, int flags,
121 vfs_context_t ctx);
122 static int vn_write(struct fileproc *fp, struct uio *uio, int flags,
123 vfs_context_t ctx);
124 static int vn_select( struct fileproc *fp, int which, void * wql,
125 vfs_context_t ctx);
126 static int vn_kqfilter(struct fileproc *fp, struct knote *kn,
127 struct kevent_qos_s *kev);
128 static void filt_vndetach(struct knote *kn);
129 static int filt_vnode(struct knote *kn, long hint);
130 static int filt_vnode_common(struct knote *kn, struct kevent_qos_s *kev,
131 vnode_t vp, long hint);
132 static int vn_open_auth_finish(vnode_t vp, int fmode, vfs_context_t ctx);
133
134 const struct fileops vnops = {
135 .fo_type = DTYPE_VNODE,
136 .fo_read = vn_read,
137 .fo_write = vn_write,
138 .fo_ioctl = vn_ioctl,
139 .fo_select = vn_select,
140 .fo_close = vn_closefile,
141 .fo_drain = fo_no_drain,
142 .fo_kqfilter = vn_kqfilter,
143 };
144
145 static int filt_vntouch(struct knote *kn, struct kevent_qos_s *kev);
146 static int filt_vnprocess(struct knote *kn, struct kevent_qos_s*kev);
147
148 SECURITY_READ_ONLY_EARLY(struct filterops) vnode_filtops = {
149 .f_isfd = 1,
150 .f_attach = NULL,
151 .f_detach = filt_vndetach,
152 .f_event = filt_vnode,
153 .f_touch = filt_vntouch,
154 .f_process = filt_vnprocess,
155 };
156
157 /*
158 * Common code for vnode open operations.
159 * Check permissions, and call the VNOP_OPEN or VNOP_CREATE routine.
160 *
161 * XXX the profusion of interfaces here is probably a bad thing.
162 */
163 int
vn_open(struct nameidata * ndp,int fmode,int cmode)164 vn_open(struct nameidata *ndp, int fmode, int cmode)
165 {
166 return vn_open_modflags(ndp, &fmode, cmode);
167 }
168
169 int
vn_open_modflags(struct nameidata * ndp,int * fmodep,int cmode)170 vn_open_modflags(struct nameidata *ndp, int *fmodep, int cmode)
171 {
172 int error;
173 struct vnode_attr *vap;
174
175 vap = kalloc_type(struct vnode_attr, Z_WAITOK);
176
177 VATTR_INIT(vap);
178 VATTR_SET(vap, va_mode, (mode_t)cmode);
179
180 error = vn_open_auth(ndp, fmodep, vap);
181
182 kfree_type(struct vnode_attr, vap);
183
184 return error;
185 }
186
187 static int
vn_open_auth_finish(vnode_t vp,int fmode,vfs_context_t ctx)188 vn_open_auth_finish(vnode_t vp, int fmode, vfs_context_t ctx)
189 {
190 int error;
191
192 if ((error = vnode_ref_ext(vp, fmode, 0)) != 0) {
193 goto bad;
194 }
195
196 /* Call out to allow 3rd party notification of open.
197 * Ignore result of kauth_authorize_fileop call.
198 */
199 #if CONFIG_MACF
200 mac_vnode_notify_open(ctx, vp, fmode);
201 #endif
202 kauth_authorize_fileop(vfs_context_ucred(ctx), KAUTH_FILEOP_OPEN,
203 (uintptr_t)vp, 0);
204
205 return 0;
206
207 bad:
208 return error;
209 }
210
211 /*
212 * May do nameidone() to allow safely adding an FSEvent. Cue off of ni_dvp to
213 * determine whether that has happened.
214 */
215 static int
vn_open_auth_do_create(struct nameidata * ndp,struct vnode_attr * vap,int fmode,boolean_t * did_create,boolean_t * did_open,vfs_context_t ctx)216 vn_open_auth_do_create(struct nameidata *ndp, struct vnode_attr *vap, int fmode, boolean_t *did_create, boolean_t *did_open, vfs_context_t ctx)
217 {
218 uint32_t status = 0;
219 vnode_t dvp = ndp->ni_dvp;
220 int batched;
221 int error;
222 vnode_t vp;
223
224 batched = vnode_compound_open_available(ndp->ni_dvp);
225 *did_open = FALSE;
226
227 VATTR_SET(vap, va_type, VREG);
228 if (fmode & O_EXCL) {
229 vap->va_vaflags |= VA_EXCLUSIVE;
230 }
231
232 #if NAMEDRSRCFORK
233 if (ndp->ni_cnd.cn_flags & CN_WANTSRSRCFORK) {
234 if ((error = vn_authorize_create(dvp, &ndp->ni_cnd, vap, ctx, NULL)) != 0) {
235 goto out;
236 }
237 if ((error = vnode_makenamedstream(dvp, &ndp->ni_vp, XATTR_RESOURCEFORK_NAME, 0, ctx)) != 0) {
238 goto out;
239 }
240 *did_create = TRUE;
241 } else {
242 #endif
243 if (!batched) {
244 if ((error = vn_authorize_create(dvp, &ndp->ni_cnd, vap, ctx, NULL)) != 0) {
245 goto out;
246 }
247 }
248
249 error = vn_create(dvp, &ndp->ni_vp, ndp, vap, VN_CREATE_DOOPEN, fmode, &status, ctx);
250 if (error != 0) {
251 if (batched) {
252 *did_create = (status & COMPOUND_OPEN_STATUS_DID_CREATE) ? TRUE : FALSE;
253 } else {
254 *did_create = FALSE;
255 }
256
257 if (error == EKEEPLOOKING) {
258 if (*did_create) {
259 panic("EKEEPLOOKING, but we did a create?");
260 }
261 if (!batched) {
262 panic("EKEEPLOOKING from filesystem that doesn't support compound vnops?");
263 }
264 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
265 panic("EKEEPLOOKING, but continue flag not set?");
266 }
267
268 /*
269 * Do NOT drop the dvp: we need everything to continue the lookup.
270 */
271 return error;
272 }
273 } else {
274 if (batched) {
275 *did_create = (status & COMPOUND_OPEN_STATUS_DID_CREATE) ? 1 : 0;
276 *did_open = TRUE;
277 } else {
278 *did_create = TRUE;
279 }
280 }
281 #if NAMEDRSRCFORK
282 }
283 #endif
284
285 vp = ndp->ni_vp;
286
287 if (*did_create) {
288 int update_flags = 0;
289
290 // Make sure the name & parent pointers are hooked up
291 if (vp->v_name == NULL) {
292 update_flags |= VNODE_UPDATE_NAME;
293 }
294 if (vp->v_parent == NULLVP) {
295 update_flags |= VNODE_UPDATE_PARENT;
296 }
297
298 if (update_flags) {
299 vnode_update_identity(vp, dvp, ndp->ni_cnd.cn_nameptr, ndp->ni_cnd.cn_namelen, ndp->ni_cnd.cn_hash, update_flags);
300 }
301
302 vnode_put(dvp);
303 ndp->ni_dvp = NULLVP;
304
305 #if CONFIG_FSE
306 if (need_fsevent(FSE_CREATE_FILE, vp)) {
307 add_fsevent(FSE_CREATE_FILE, ctx,
308 FSE_ARG_VNODE, vp,
309 FSE_ARG_DONE);
310 }
311 #endif
312 }
313 out:
314 if (ndp->ni_dvp != NULLVP) {
315 vnode_put(dvp);
316 ndp->ni_dvp = NULLVP;
317 }
318
319 return error;
320 }
321
322 /*
323 * This is the number of times we'll loop in vn_open_auth without explicitly
324 * yielding the CPU when we determine we have to retry.
325 */
326 #define RETRY_NO_YIELD_COUNT 5
327
328 /*
329 * Open a file with authorization, updating the contents of the structures
330 * pointed to by ndp, fmodep, and vap as necessary to perform the requested
331 * operation. This function is used for both opens of existing files, and
332 * creation of new files.
333 *
334 * Parameters: ndp The nami data pointer describing the
335 * file
336 * fmodep A pointer to an int containg the mode
337 * information to be used for the open
338 * vap A pointer to the vnode attribute
339 * descriptor to be used for the open
340 *
341 * Indirect: * Contents of the data structures pointed
342 * to by the parameters are modified as
343 * necessary to the requested operation.
344 *
345 * Returns: 0 Success
346 * !0 errno value
347 *
348 * Notes: The kauth_filesec_t in 'vap', if any, is in host byte order.
349 *
350 * The contents of '*ndp' will be modified, based on the other
351 * arguments to this function, and to return file and directory
352 * data necessary to satisfy the requested operation.
353 *
354 * If the file does not exist and we are creating it, then the
355 * O_TRUNC flag will be cleared in '*fmodep' to indicate to the
356 * caller that the file was not truncated.
357 *
358 * If the file exists and the O_EXCL flag was not specified, then
359 * the O_CREAT flag will be cleared in '*fmodep' to indicate to
360 * the caller that the existing file was merely opened rather
361 * than created.
362 *
363 * The contents of '*vap' will be modified as necessary to
364 * complete the operation, including setting of supported
365 * attribute, clearing of fields containing unsupported attributes
366 * in the request, if the request proceeds without them, etc..
367 *
368 * XXX: This function is too complicated in actings on its arguments
369 *
370 * XXX: We should enummerate the possible errno values here, and where
371 * in the code they originated.
372 */
373 int
vn_open_auth(struct nameidata * ndp,int * fmodep,struct vnode_attr * vap)374 vn_open_auth(struct nameidata *ndp, int *fmodep, struct vnode_attr *vap)
375 {
376 struct vnode *vp;
377 struct vnode *dvp;
378 vfs_context_t ctx = ndp->ni_cnd.cn_context;
379 int error;
380 int fmode;
381 uint32_t origcnflags;
382 boolean_t did_create;
383 boolean_t did_open;
384 boolean_t need_vnop_open;
385 boolean_t batched;
386 boolean_t ref_failed;
387 int nretries = 0;
388
389 again:
390 vp = NULL;
391 dvp = NULL;
392 batched = FALSE;
393 did_create = FALSE;
394 need_vnop_open = TRUE;
395 ref_failed = FALSE;
396 fmode = *fmodep;
397 origcnflags = ndp->ni_cnd.cn_flags;
398
399 // If raw encrypted mode is requested, handle that here
400 if (VATTR_IS_ACTIVE(vap, va_dataprotect_flags)
401 && ISSET(vap->va_dataprotect_flags, VA_DP_RAWENCRYPTED)) {
402 fmode |= FENCRYPTED;
403 }
404
405 if ((fmode & O_NOFOLLOW_ANY) && (fmode & (O_SYMLINK | O_NOFOLLOW))) {
406 error = EINVAL;
407 goto out;
408 }
409
410 /*
411 * O_CREAT
412 */
413 if (fmode & O_CREAT) {
414 if ((fmode & O_DIRECTORY)) {
415 error = EINVAL;
416 goto out;
417 }
418 ndp->ni_cnd.cn_nameiop = CREATE;
419 #if CONFIG_TRIGGERS
420 ndp->ni_op = OP_LINK;
421 #endif
422 /* Inherit USEDVP, vnode_open() supported flags only */
423 ndp->ni_cnd.cn_flags &= (USEDVP | NOCROSSMOUNT);
424 ndp->ni_cnd.cn_flags |= LOCKPARENT | LOCKLEAF | AUDITVNPATH1;
425 ndp->ni_flag = NAMEI_COMPOUNDOPEN;
426 #if NAMEDRSRCFORK
427 /* open calls are allowed for resource forks. */
428 ndp->ni_cnd.cn_flags |= CN_ALLOWRSRCFORK;
429 #endif
430 if ((fmode & O_EXCL) == 0 && (fmode & O_NOFOLLOW) == 0 && (origcnflags & FOLLOW) != 0) {
431 ndp->ni_cnd.cn_flags |= FOLLOW;
432 }
433 if (fmode & O_NOFOLLOW_ANY) {
434 /* will return ELOOP on the first symlink to be hit */
435 ndp->ni_flag |= NAMEI_NOFOLLOW_ANY;
436 }
437
438 continue_create_lookup:
439 if ((error = namei(ndp))) {
440 goto out;
441 }
442
443 dvp = ndp->ni_dvp;
444 vp = ndp->ni_vp;
445
446 batched = vnode_compound_open_available(dvp);
447
448 /* not found, create */
449 if (vp == NULL) {
450 /* must have attributes for a new file */
451 if (vap == NULL) {
452 vnode_put(dvp);
453 error = EINVAL;
454 goto out;
455 }
456 /*
457 * Attempt a create. For a system supporting compound VNOPs, we may
458 * find an existing file or create one; in either case, we will already
459 * have the file open and no VNOP_OPEN() will be needed.
460 */
461 error = vn_open_auth_do_create(ndp, vap, fmode, &did_create, &did_open, ctx);
462
463 dvp = ndp->ni_dvp;
464 vp = ndp->ni_vp;
465
466 /*
467 * Detected a node that the filesystem couldn't handle. Don't call
468 * nameidone() yet, because we need that path buffer.
469 */
470 if (error == EKEEPLOOKING) {
471 if (!batched) {
472 panic("EKEEPLOOKING from a filesystem that doesn't support compound VNOPs?");
473 }
474 goto continue_create_lookup;
475 }
476
477 nameidone(ndp);
478 if (dvp) {
479 panic("Shouldn't have a dvp here.");
480 }
481
482 if (error) {
483 /*
484 * Check for a create race.
485 */
486 if ((error == EEXIST) && !(fmode & O_EXCL)) {
487 if (vp) {
488 vnode_put(vp);
489 }
490 goto again;
491 }
492 goto bad;
493 }
494
495 need_vnop_open = !did_open;
496 } else {
497 if (fmode & O_EXCL) {
498 error = EEXIST;
499 }
500
501 /*
502 * We have a vnode. Use compound open if available
503 * or else fall through to "traditional" path. Note: can't
504 * do a compound open for root, because the parent belongs
505 * to a different FS.
506 */
507 if (error == 0 && batched && (vnode_mount(dvp) == vnode_mount(vp))) {
508 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0, fmode, NULL, NULL, ctx);
509
510 if (error == 0) {
511 vp = ndp->ni_vp;
512 need_vnop_open = FALSE;
513 } else if (error == EKEEPLOOKING) {
514 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
515 panic("EKEEPLOOKING, but continue flag not set?");
516 }
517 goto continue_create_lookup;
518 }
519 }
520 nameidone(ndp);
521 vnode_put(dvp);
522 ndp->ni_dvp = NULLVP;
523
524 if (error) {
525 goto bad;
526 }
527
528 fmode &= ~O_CREAT;
529
530 /* Fall through */
531 }
532 } else {
533 /*
534 * Not O_CREAT
535 */
536 ndp->ni_cnd.cn_nameiop = LOOKUP;
537 /* Inherit USEDVP, vnode_open() supported flags only */
538 ndp->ni_cnd.cn_flags &= (USEDVP | NOCROSSMOUNT);
539 ndp->ni_cnd.cn_flags |= FOLLOW | LOCKLEAF | AUDITVNPATH1 | WANTPARENT;
540 #if NAMEDRSRCFORK
541 /* open calls are allowed for resource forks. */
542 ndp->ni_cnd.cn_flags |= CN_ALLOWRSRCFORK;
543 #endif
544 if (fmode & FENCRYPTED) {
545 ndp->ni_cnd.cn_flags |= CN_RAW_ENCRYPTED | CN_SKIPNAMECACHE;
546 }
547 ndp->ni_flag = NAMEI_COMPOUNDOPEN;
548
549 /* preserve NOFOLLOW from vnode_open() */
550 if (fmode & O_NOFOLLOW || fmode & O_SYMLINK || (origcnflags & FOLLOW) == 0) {
551 ndp->ni_cnd.cn_flags &= ~FOLLOW;
552 }
553 if (fmode & O_NOFOLLOW_ANY) {
554 /* will return ELOOP on the first symlink to be hit */
555 ndp->ni_flag |= NAMEI_NOFOLLOW_ANY;
556 }
557
558 /* Do a lookup, possibly going directly to filesystem for compound operation */
559 do {
560 if ((error = namei(ndp))) {
561 goto out;
562 }
563 vp = ndp->ni_vp;
564 dvp = ndp->ni_dvp;
565
566 /* Check for batched lookup-open */
567 batched = vnode_compound_open_available(dvp);
568 if (batched && ((vp == NULLVP) || (vnode_mount(dvp) == vnode_mount(vp)))) {
569 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0, fmode, NULL, NULL, ctx);
570 vp = ndp->ni_vp;
571 if (error == 0) {
572 need_vnop_open = FALSE;
573 } else if (error == EKEEPLOOKING) {
574 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
575 panic("EKEEPLOOKING, but continue flag not set?");
576 }
577 }
578 }
579 } while (error == EKEEPLOOKING);
580
581 nameidone(ndp);
582 vnode_put(dvp);
583 ndp->ni_dvp = NULLVP;
584
585 if (error) {
586 goto bad;
587 }
588 }
589
590 /*
591 * By this point, nameidone() is called, dvp iocount is dropped,
592 * and dvp pointer is cleared.
593 */
594 if (ndp->ni_dvp != NULLVP) {
595 panic("Haven't cleaned up adequately in vn_open_auth()");
596 }
597
598 /*
599 * Expect to use this code for filesystems without compound VNOPs, for the root
600 * of a filesystem, which can't be "looked up" in the sense of VNOP_LOOKUP(),
601 * and for shadow files, which do not live on the same filesystems as their "parents."
602 */
603 if (need_vnop_open) {
604 if (batched && !vnode_isvroot(vp) && !vnode_isnamedstream(vp)) {
605 panic("Why am I trying to use VNOP_OPEN() on anything other than the root or a named stream?");
606 }
607
608 if (!did_create) {
609 error = vn_authorize_open_existing(vp, &ndp->ni_cnd, fmode, ctx, NULL);
610 if (error) {
611 goto bad;
612 }
613 }
614
615 if (VATTR_IS_ACTIVE(vap, va_dataprotect_flags)
616 && ISSET(vap->va_dataprotect_flags, VA_DP_RAWUNENCRYPTED)) {
617 /* Don't allow unencrypted io request from user space unless entitled */
618 boolean_t entitled = FALSE;
619 #if !SECURE_KERNEL
620 entitled = IOCurrentTaskHasEntitlement("com.apple.private.security.file-unencrypt-access");
621 #endif
622 if (!entitled) {
623 error = EPERM;
624 goto bad;
625 }
626 fmode |= FUNENCRYPTED;
627 }
628
629 error = VNOP_OPEN(vp, fmode, ctx);
630 if (error) {
631 goto bad;
632 }
633 need_vnop_open = FALSE;
634 }
635
636 // if the vnode is tagged VOPENEVT and the current process
637 // has the P_CHECKOPENEVT flag set, then we or in the O_EVTONLY
638 // flag to the open mode so that this open won't count against
639 // the vnode when carbon delete() does a vnode_isinuse() to see
640 // if a file is currently in use. this allows spotlight
641 // importers to not interfere with carbon apps that depend on
642 // the no-delete-if-busy semantics of carbon delete().
643 //
644 if (!did_create && (vp->v_flag & VOPENEVT) && (current_proc()->p_flag & P_CHECKOPENEVT)) {
645 fmode |= O_EVTONLY;
646 }
647
648 /*
649 * Grab reference, etc.
650 */
651 error = vn_open_auth_finish(vp, fmode, ctx);
652 if (error) {
653 ref_failed = TRUE;
654 goto bad;
655 }
656
657 /* Compound VNOP open is responsible for doing the truncate */
658 if (batched || did_create) {
659 fmode &= ~O_TRUNC;
660 }
661
662 *fmodep = fmode;
663 return 0;
664
665 bad:
666 /* Opened either explicitly or by a batched create */
667 if (!need_vnop_open) {
668 VNOP_CLOSE(vp, fmode, ctx);
669 }
670
671 ndp->ni_vp = NULL;
672 if (vp) {
673 #if NAMEDRSRCFORK
674 /* Aggressively recycle shadow files if we error'd out during open() */
675 if ((vnode_isnamedstream(vp)) &&
676 (vp->v_parent != NULLVP) &&
677 (vnode_isshadow(vp))) {
678 vnode_recycle(vp);
679 }
680 #endif
681 vnode_put(vp);
682 /*
683 * Check for a race against unlink. We had a vnode
684 * but according to vnode_authorize or VNOP_OPEN it
685 * no longer exists.
686 *
687 * EREDRIVEOPEN: means that we were hit by the tty allocation race.
688 */
689 if (((error == ENOENT) && (*fmodep & O_CREAT)) || (error == EREDRIVEOPEN) || ref_failed) {
690 /*
691 * We'll retry here but it may be possible that we get
692 * into a retry "spin" inside the kernel and not allow
693 * threads, which need to run in order for the retry
694 * loop to end, to run. An example is an open of a
695 * terminal which is getting revoked and we spin here
696 * without yielding becasue namei and VNOP_OPEN are
697 * successful but vnode_ref fails. The revoke needs
698 * threads with an iocount to run but if spin here we
699 * may possibly be blcoking other threads from running.
700 *
701 * We start yielding the CPU after some number of
702 * retries for increasing durations. Note that this is
703 * still a loop without an exit condition.
704 */
705 nretries += 1;
706 if (nretries > RETRY_NO_YIELD_COUNT) {
707 /* Every hz/100 secs is 10 msecs ... */
708 tsleep(&nretries, PVFS, "vn_open_auth_retry",
709 MIN((nretries * (hz / 100)), hz));
710 }
711 goto again;
712 }
713 }
714
715 out:
716 return error;
717 }
718
719 #if vn_access_DEPRECATED
720 /*
721 * Authorize an action against a vnode. This has been the canonical way to
722 * ensure that the credential/process/etc. referenced by a vfs_context
723 * is granted the rights called out in 'mode' against the vnode 'vp'.
724 *
725 * Unfortunately, the use of VREAD/VWRITE/VEXEC makes it very difficult
726 * to add support for more rights. As such, this interface will be deprecated
727 * and callers will use vnode_authorize instead.
728 */
729 int
vn_access(vnode_t vp,int mode,vfs_context_t context)730 vn_access(vnode_t vp, int mode, vfs_context_t context)
731 {
732 kauth_action_t action;
733
734 action = 0;
735 if (mode & VREAD) {
736 action |= KAUTH_VNODE_READ_DATA;
737 }
738 if (mode & VWRITE) {
739 action |= KAUTH_VNODE_WRITE_DATA;
740 }
741 if (mode & VEXEC) {
742 action |= KAUTH_VNODE_EXECUTE;
743 }
744
745 return vnode_authorize(vp, NULL, action, context);
746 }
747 #endif /* vn_access_DEPRECATED */
748
749 /*
750 * Vnode close call
751 */
752 int
vn_close(struct vnode * vp,int flags,vfs_context_t ctx)753 vn_close(struct vnode *vp, int flags, vfs_context_t ctx)
754 {
755 int error;
756 int flusherror = 0;
757
758 #if NAMEDRSRCFORK
759 /* Sync data from resource fork shadow file if needed. */
760 if ((vp->v_flag & VISNAMEDSTREAM) &&
761 (vp->v_parent != NULLVP) &&
762 vnode_isshadow(vp)) {
763 if (flags & FWASWRITTEN) {
764 flusherror = vnode_flushnamedstream(vp->v_parent, vp, ctx);
765 }
766 }
767 #endif
768 /*
769 * If vnode @vp belongs to a chardev or a blkdev then it is handled
770 * specially. We first drop its user reference count @vp->v_usecount
771 * before calling VNOP_CLOSE(). This was done historically to ensure
772 * that the last close of a special device vnode performed some
773 * conditional cleanups. Now we still need to drop this reference here
774 * to ensure that devfsspec_close() can check if the vnode is still in
775 * use.
776 */
777 if (vnode_isspec(vp)) {
778 (void)vnode_rele_ext(vp, flags, 0);
779 }
780
781 /*
782 * On HFS, we flush when the last writer closes. We do this
783 * because resource fork vnodes hold a reference on data fork
784 * vnodes and that will prevent them from getting VNOP_INACTIVE
785 * which will delay when we flush cached data. In future, we
786 * might find it beneficial to do this for all file systems.
787 * Note that it's OK to access v_writecount without the lock
788 * in this context.
789 */
790 if (vp->v_tag == VT_HFS && (flags & FWRITE) && vp->v_writecount == 1) {
791 VNOP_FSYNC(vp, MNT_NOWAIT, ctx);
792 }
793
794 error = VNOP_CLOSE(vp, flags, ctx);
795
796 #if CONFIG_FSE
797 if (flags & FWASWRITTEN) {
798 if (need_fsevent(FSE_CONTENT_MODIFIED, vp)) {
799 add_fsevent(FSE_CONTENT_MODIFIED, ctx,
800 FSE_ARG_VNODE, vp,
801 FSE_ARG_DONE);
802 }
803 }
804 #endif
805
806 if (!vnode_isspec(vp)) {
807 (void)vnode_rele_ext(vp, flags, 0);
808 }
809
810 if (flusherror) {
811 error = flusherror;
812 }
813 return error;
814 }
815
816 static int
vn_read_swapfile(struct vnode * vp,uio_t uio)817 vn_read_swapfile(
818 struct vnode *vp,
819 uio_t uio)
820 {
821 int error;
822 off_t swap_count, this_count;
823 off_t file_end, read_end;
824 off_t prev_resid;
825 char *my_swap_page;
826
827 /*
828 * Reading from a swap file will get you zeroes.
829 */
830
831 my_swap_page = NULL;
832 error = 0;
833 swap_count = uio_resid(uio);
834
835 file_end = ubc_getsize(vp);
836 read_end = uio->uio_offset + uio_resid(uio);
837 if (uio->uio_offset >= file_end) {
838 /* uio starts after end of file: nothing to read */
839 swap_count = 0;
840 } else if (read_end > file_end) {
841 /* uio extends beyond end of file: stop before that */
842 swap_count -= (read_end - file_end);
843 }
844
845 while (swap_count > 0) {
846 if (my_swap_page == NULL) {
847 my_swap_page = kalloc_data(PAGE_SIZE, Z_WAITOK | Z_ZERO);
848 /* add an end-of-line to keep line counters happy */
849 my_swap_page[PAGE_SIZE - 1] = '\n';
850 }
851 this_count = swap_count;
852 if (this_count > PAGE_SIZE) {
853 this_count = PAGE_SIZE;
854 }
855
856 prev_resid = uio_resid(uio);
857 error = uiomove((caddr_t) my_swap_page,
858 (int)this_count,
859 uio);
860 if (error) {
861 break;
862 }
863 swap_count -= (prev_resid - uio_resid(uio));
864 }
865 kfree_data(my_swap_page, PAGE_SIZE);
866
867 return error;
868 }
869 /*
870 * Package up an I/O request on a vnode into a uio and do it.
871 */
872 int
vn_rdwr(enum uio_rw rw,struct vnode * vp,caddr_t base,int len,off_t offset,enum uio_seg segflg,int ioflg,kauth_cred_t cred,int * aresid,proc_t p)873 vn_rdwr(
874 enum uio_rw rw,
875 struct vnode *vp,
876 caddr_t base,
877 int len,
878 off_t offset,
879 enum uio_seg segflg,
880 int ioflg,
881 kauth_cred_t cred,
882 int *aresid,
883 proc_t p)
884 {
885 int64_t resid;
886 int result;
887
888 if (len < 0) {
889 return EINVAL;
890 }
891
892 result = vn_rdwr_64(rw,
893 vp,
894 (uint64_t)(uintptr_t)base,
895 (int64_t)len,
896 offset,
897 segflg,
898 ioflg,
899 cred,
900 &resid,
901 p);
902
903 /* "resid" should be bounded above by "len," which is an int */
904 if (aresid != NULL) {
905 *aresid = (int)resid;
906 }
907
908 return result;
909 }
910
911
912 int
vn_rdwr_64(enum uio_rw rw,struct vnode * vp,uint64_t base,int64_t len,off_t offset,enum uio_seg segflg,int ioflg,kauth_cred_t cred,int64_t * aresid,proc_t p)913 vn_rdwr_64(
914 enum uio_rw rw,
915 struct vnode *vp,
916 uint64_t base,
917 int64_t len,
918 off_t offset,
919 enum uio_seg segflg,
920 int ioflg,
921 kauth_cred_t cred,
922 int64_t *aresid,
923 proc_t p)
924 {
925 uio_t auio;
926 int spacetype;
927 struct vfs_context context;
928 int error = 0;
929 uio_stackbuf_t uio_buf[UIO_SIZEOF(1)];
930
931 context.vc_thread = current_thread();
932 context.vc_ucred = cred;
933
934 if (UIO_SEG_IS_USER_SPACE(segflg)) {
935 spacetype = proc_is64bit(p) ? UIO_USERSPACE64 : UIO_USERSPACE32;
936 } else {
937 spacetype = UIO_SYSSPACE;
938 }
939
940 if (len < 0) {
941 return EINVAL;
942 }
943
944 auio = uio_createwithbuffer(1, offset, spacetype, rw,
945 &uio_buf[0], sizeof(uio_buf));
946 uio_addiov(auio, CAST_USER_ADDR_T(base), (user_size_t)len);
947
948 #if CONFIG_MACF
949 /* XXXMAC
950 * IO_NOAUTH should be re-examined.
951 * Likely that mediation should be performed in caller.
952 */
953 if ((ioflg & IO_NOAUTH) == 0) {
954 /* passed cred is fp->f_cred */
955 if (rw == UIO_READ) {
956 error = mac_vnode_check_read(&context, cred, vp);
957 } else {
958 error = mac_vnode_check_write(&context, cred, vp);
959 }
960 }
961 #endif
962
963 if (error == 0) {
964 if (rw == UIO_READ) {
965 if (vnode_isswap(vp) && ((ioflg & IO_SWAP_DISPATCH) == 0)) {
966 error = vn_read_swapfile(vp, auio);
967 } else {
968 error = VNOP_READ(vp, auio, ioflg, &context);
969 }
970 } else {
971 error = VNOP_WRITE(vp, auio, ioflg, &context);
972 }
973 }
974
975 if (aresid) {
976 *aresid = uio_resid(auio);
977 assert(*aresid <= len);
978 } else if (uio_resid(auio) && error == 0) {
979 error = EIO;
980 }
981 return error;
982 }
983
984 void
vn_offset_lock(struct fileglob * fg)985 vn_offset_lock(struct fileglob *fg)
986 {
987 lck_mtx_lock_spin(&fg->fg_lock);
988 while (fg->fg_lflags & FG_OFF_LOCKED) {
989 fg->fg_lflags |= FG_OFF_LOCKWANT;
990 msleep(&fg->fg_lflags, &fg->fg_lock, PVFS | PSPIN,
991 "fg_offset_lock_wait", 0);
992 }
993 fg->fg_lflags |= FG_OFF_LOCKED;
994 lck_mtx_unlock(&fg->fg_lock);
995 }
996
997 void
vn_offset_unlock(struct fileglob * fg)998 vn_offset_unlock(struct fileglob *fg)
999 {
1000 int lock_wanted = 0;
1001
1002 lck_mtx_lock_spin(&fg->fg_lock);
1003 if (fg->fg_lflags & FG_OFF_LOCKWANT) {
1004 lock_wanted = 1;
1005 }
1006 fg->fg_lflags &= ~(FG_OFF_LOCKED | FG_OFF_LOCKWANT);
1007 lck_mtx_unlock(&fg->fg_lock);
1008 if (lock_wanted) {
1009 wakeup(&fg->fg_lflags);
1010 }
1011 }
1012
1013 static int
vn_read_common(vnode_t vp,struct uio * uio,int fflag,vfs_context_t ctx)1014 vn_read_common(vnode_t vp, struct uio *uio, int fflag, vfs_context_t ctx)
1015 {
1016 int error;
1017 int ioflag;
1018 off_t read_offset;
1019 user_ssize_t read_len;
1020 user_ssize_t adjusted_read_len;
1021 user_ssize_t clippedsize;
1022
1023 /* Caller has already validated read_len. */
1024 read_len = uio_resid(uio);
1025 assert(read_len >= 0 && read_len <= INT_MAX);
1026
1027 adjusted_read_len = read_len;
1028 clippedsize = 0;
1029
1030 #if CONFIG_MACF
1031 error = mac_vnode_check_read(ctx, vfs_context_ucred(ctx), vp);
1032 if (error) {
1033 return error;
1034 }
1035 #endif
1036
1037 /* This signals to VNOP handlers that this read came from a file table read */
1038 ioflag = IO_SYSCALL_DISPATCH;
1039
1040 if (fflag & FNONBLOCK) {
1041 ioflag |= IO_NDELAY;
1042 }
1043 if ((fflag & FNOCACHE) || vnode_isnocache(vp)) {
1044 ioflag |= IO_NOCACHE;
1045 }
1046 if (fflag & FENCRYPTED) {
1047 ioflag |= IO_ENCRYPTED;
1048 }
1049 if (fflag & FUNENCRYPTED) {
1050 ioflag |= IO_SKIP_ENCRYPTION;
1051 }
1052 if (fflag & O_EVTONLY) {
1053 ioflag |= IO_EVTONLY;
1054 }
1055 if (fflag & FNORDAHEAD) {
1056 ioflag |= IO_RAOFF;
1057 }
1058
1059 read_offset = uio_offset(uio);
1060 /* POSIX allows negative offsets for character devices. */
1061 if ((read_offset < 0) && (vnode_vtype(vp) != VCHR)) {
1062 error = EINVAL;
1063 goto error_out;
1064 }
1065
1066 if (read_offset == INT64_MAX) {
1067 /* can't read any more */
1068 error = 0;
1069 goto error_out;
1070 }
1071
1072 /*
1073 * If offset + len will cause overflow, reduce the len to a value
1074 * (adjusted_read_len) where it won't
1075 */
1076 if ((read_offset >= 0) && (INT64_MAX - read_offset) < read_len) {
1077 /*
1078 * 0 read_offset INT64_MAX
1079 * |-----------------------------------------------|----------|~~~
1080 * <--read_len-->
1081 * <-adjusted->
1082 */
1083 adjusted_read_len = (user_ssize_t)(INT64_MAX - read_offset);
1084 }
1085
1086 if (adjusted_read_len < read_len) {
1087 uio_setresid(uio, adjusted_read_len);
1088 clippedsize = read_len - adjusted_read_len;
1089 }
1090
1091 if (vnode_isswap(vp) && !(IO_SKIP_ENCRYPTION & ioflag)) {
1092 /* special case for swap files */
1093 error = vn_read_swapfile(vp, uio);
1094 } else {
1095 error = VNOP_READ(vp, uio, ioflag, ctx);
1096 }
1097
1098 if (clippedsize) {
1099 uio_setresid(uio, (uio_resid(uio) + clippedsize));
1100 }
1101
1102 error_out:
1103 return error;
1104 }
1105
1106 /*
1107 * File table vnode read routine.
1108 */
1109 static int
vn_read(struct fileproc * fp,struct uio * uio,int flags,vfs_context_t ctx)1110 vn_read(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx)
1111 {
1112 vnode_t vp;
1113 user_ssize_t read_len;
1114 int error;
1115 bool offset_locked;
1116
1117 read_len = uio_resid(uio);
1118 if (read_len < 0 || read_len > INT_MAX) {
1119 return EINVAL;
1120 }
1121
1122 if ((flags & FOF_OFFSET) == 0) {
1123 vn_offset_lock(fp->fp_glob);
1124 offset_locked = true;
1125 } else {
1126 offset_locked = false;
1127 }
1128 vp = (struct vnode *)fp_get_data(fp);
1129 if ((error = vnode_getwithref(vp))) {
1130 if (offset_locked) {
1131 vn_offset_unlock(fp->fp_glob);
1132 }
1133 return error;
1134 }
1135
1136 if (offset_locked && (vnode_vtype(vp) != VREG || vnode_isswap(vp))) {
1137 vn_offset_unlock(fp->fp_glob);
1138 offset_locked = false;
1139 }
1140
1141 if ((flags & FOF_OFFSET) == 0) {
1142 uio_setoffset(uio, fp->fp_glob->fg_offset);
1143 }
1144
1145 error = vn_read_common(vp, uio, fp->fp_glob->fg_flag, ctx);
1146
1147 if ((flags & FOF_OFFSET) == 0) {
1148 fp->fp_glob->fg_offset += read_len - uio_resid(uio);
1149 }
1150
1151 if (offset_locked) {
1152 vn_offset_unlock(fp->fp_glob);
1153 offset_locked = false;
1154 }
1155
1156 vnode_put(vp);
1157 return error;
1158 }
1159
1160 /*
1161 * File table vnode write routine.
1162 */
1163 static int
vn_write(struct fileproc * fp,struct uio * uio,int flags,vfs_context_t ctx)1164 vn_write(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx)
1165 {
1166 struct vnode *vp;
1167 int error, ioflag;
1168 off_t write_offset;
1169 off_t write_end_offset;
1170 user_ssize_t write_len;
1171 user_ssize_t adjusted_write_len;
1172 user_ssize_t clippedsize;
1173 bool offset_locked;
1174 proc_t p = vfs_context_proc(ctx);
1175 rlim_t rlim_cur_fsize = p ? proc_limitgetcur(p, RLIMIT_FSIZE) : 0;
1176
1177 write_len = uio_resid(uio);
1178 if (write_len < 0 || write_len > INT_MAX) {
1179 return EINVAL;
1180 }
1181 adjusted_write_len = write_len;
1182 clippedsize = 0;
1183
1184 if ((flags & FOF_OFFSET) == 0) {
1185 vn_offset_lock(fp->fp_glob);
1186 offset_locked = true;
1187 } else {
1188 offset_locked = false;
1189 }
1190
1191 vp = (struct vnode *)fp_get_data(fp);
1192 if ((error = vnode_getwithref(vp))) {
1193 if (offset_locked) {
1194 vn_offset_unlock(fp->fp_glob);
1195 }
1196 return error;
1197 }
1198
1199 if (offset_locked && (vnode_vtype(vp) != VREG || vnode_isswap(vp))) {
1200 vn_offset_unlock(fp->fp_glob);
1201 offset_locked = false;
1202 }
1203
1204 #if CONFIG_MACF
1205 error = mac_vnode_check_write(ctx, vfs_context_ucred(ctx), vp);
1206 if (error) {
1207 (void)vnode_put(vp);
1208 if (offset_locked) {
1209 vn_offset_unlock(fp->fp_glob);
1210 }
1211 return error;
1212 }
1213 #endif
1214
1215 /*
1216 * IO_SYSCALL_DISPATCH signals to VNOP handlers that this write came from
1217 * a file table write
1218 */
1219 ioflag = (IO_UNIT | IO_SYSCALL_DISPATCH);
1220
1221 if (vp->v_type == VREG && (fp->fp_glob->fg_flag & O_APPEND)) {
1222 ioflag |= IO_APPEND;
1223 }
1224 if (fp->fp_glob->fg_flag & FNONBLOCK) {
1225 ioflag |= IO_NDELAY;
1226 }
1227 if ((fp->fp_glob->fg_flag & FNOCACHE) || vnode_isnocache(vp)) {
1228 ioflag |= IO_NOCACHE;
1229 }
1230 if (fp->fp_glob->fg_flag & FNODIRECT) {
1231 ioflag |= IO_NODIRECT;
1232 }
1233 if (fp->fp_glob->fg_flag & FSINGLE_WRITER) {
1234 ioflag |= IO_SINGLE_WRITER;
1235 }
1236 if (fp->fp_glob->fg_flag & O_EVTONLY) {
1237 ioflag |= IO_EVTONLY;
1238 }
1239
1240 /*
1241 * Treat synchronous mounts and O_FSYNC on the fd as equivalent.
1242 *
1243 * XXX We treat O_DSYNC as O_FSYNC for now, since we can not delay
1244 * XXX the non-essential metadata without some additional VFS work;
1245 * XXX the intent at this point is to plumb the interface for it.
1246 */
1247 if ((fp->fp_glob->fg_flag & (O_FSYNC | O_DSYNC)) ||
1248 (vp->v_mount && (vp->v_mount->mnt_flag & MNT_SYNCHRONOUS))) {
1249 ioflag |= IO_SYNC;
1250 }
1251
1252 if ((flags & FOF_OFFSET) == 0) {
1253 write_offset = fp->fp_glob->fg_offset;
1254 uio_setoffset(uio, write_offset);
1255 } else {
1256 /* for pwrite, append should be ignored */
1257 ioflag &= ~IO_APPEND;
1258 write_offset = uio_offset(uio);
1259 /* POSIX allows negative offsets for character devices. */
1260 if ((write_offset < 0) && (vnode_vtype(vp) != VCHR)) {
1261 error = EINVAL;
1262 goto error_out;
1263 }
1264 }
1265
1266 if (write_offset == INT64_MAX) {
1267 /* writes are not possible */
1268 error = EFBIG;
1269 goto error_out;
1270 }
1271
1272 /*
1273 * write_len is the original write length that was requested.
1274 * We may however need to reduce that becasue of two reasons
1275 *
1276 * 1) If write_offset + write_len will exceed OFF_T_MAX (i.e. INT64_MAX)
1277 * and/or
1278 * 2) If write_offset + write_len will exceed the administrative
1279 * limit for the maximum file size.
1280 *
1281 * In both cases the write will be denied if we can't write even a single
1282 * byte otherwise it will be "clipped" (i.e. a short write).
1283 */
1284
1285 /*
1286 * If offset + len will cause overflow, reduce the len
1287 * to a value (adjusted_write_len) where it won't
1288 */
1289 if ((write_offset >= 0) && (INT64_MAX - write_offset) < write_len) {
1290 /*
1291 * 0 write_offset INT64_MAX
1292 * |-----------------------------------------------|----------|~~~
1293 * <--write_len-->
1294 * <-adjusted->
1295 */
1296 adjusted_write_len = (user_ssize_t)(INT64_MAX - write_offset);
1297 }
1298
1299 /* write_end_offset will always be [0, INT64_MAX] */
1300 write_end_offset = write_offset + adjusted_write_len;
1301
1302 if (p && (vp->v_type == VREG) &&
1303 (rlim_cur_fsize != RLIM_INFINITY) &&
1304 (rlim_cur_fsize <= INT64_MAX) &&
1305 (write_end_offset > (off_t)rlim_cur_fsize)) {
1306 /*
1307 * If the requested residual would cause us to go past the
1308 * administrative limit, then we need to adjust the residual
1309 * down to cause fewer bytes than requested to be written. If
1310 * we can't do that (e.g. the residual is already 1 byte),
1311 * then we fail the write with EFBIG.
1312 */
1313 if (write_offset >= (off_t)rlim_cur_fsize) {
1314 /*
1315 * 0 rlim_fsize write_offset write_end INT64_MAX
1316 * |------------------------|----------|-------------|--------|
1317 * <--write_len-->
1318 *
1319 * write not permitted
1320 */
1321 psignal(p, SIGXFSZ);
1322 error = EFBIG;
1323 goto error_out;
1324 }
1325
1326 /*
1327 * 0 write_offset rlim_fsize write_end INT64_MAX
1328 * |------------------------|-----------|---------|------------|
1329 * <------write_len------>
1330 * <-adjusted-->
1331 */
1332 adjusted_write_len = (user_ssize_t)((off_t)rlim_cur_fsize - write_offset);
1333 assert((adjusted_write_len > 0) && (adjusted_write_len < write_len));
1334 }
1335
1336 if (adjusted_write_len < write_len) {
1337 uio_setresid(uio, adjusted_write_len);
1338 clippedsize = write_len - adjusted_write_len;
1339 }
1340
1341 error = VNOP_WRITE(vp, uio, ioflag, ctx);
1342
1343 /*
1344 * If we had to reduce the size of write requested either because
1345 * of rlimit or because it would have exceeded
1346 * maximum file size, we have to add that back to the residual so
1347 * it correctly reflects what we did in this function.
1348 */
1349 if (clippedsize) {
1350 uio_setresid(uio, (uio_resid(uio) + clippedsize));
1351 }
1352
1353 if ((flags & FOF_OFFSET) == 0) {
1354 if (ioflag & IO_APPEND) {
1355 fp->fp_glob->fg_offset = uio_offset(uio);
1356 } else {
1357 fp->fp_glob->fg_offset += (write_len - uio_resid(uio));
1358 }
1359 if (offset_locked) {
1360 vn_offset_unlock(fp->fp_glob);
1361 offset_locked = false;
1362 }
1363 }
1364
1365 /*
1366 * Set the credentials on successful writes
1367 */
1368 if ((error == 0) && (vp->v_tag == VT_NFS) && (UBCINFOEXISTS(vp))) {
1369 /*
1370 * When called from aio subsystem, we only have the proc from
1371 * which to get the credential, at this point, so use that
1372 * instead. This means aio functions are incompatible with
1373 * per-thread credentials (aio operations are proxied). We
1374 * can't easily correct the aio vs. settid race in this case
1375 * anyway, so we disallow it.
1376 */
1377 if ((flags & FOF_PCRED) == 0) {
1378 ubc_setthreadcred(vp, p, current_thread());
1379 } else {
1380 ubc_setcred(vp, p);
1381 }
1382 }
1383 (void)vnode_put(vp);
1384 return error;
1385
1386 error_out:
1387 if (offset_locked) {
1388 vn_offset_unlock(fp->fp_glob);
1389 }
1390 (void)vnode_put(vp);
1391 return error;
1392 }
1393
1394 /*
1395 * File table vnode stat routine.
1396 *
1397 * Returns: 0 Success
1398 * EBADF
1399 * ENOMEM
1400 * vnode_getattr:???
1401 */
1402 int
vn_stat_noauth(struct vnode * vp,void * sbptr,kauth_filesec_t * xsec,int isstat64,int needsrealdev,vfs_context_t ctx,struct ucred * file_cred)1403 vn_stat_noauth(struct vnode *vp, void *sbptr, kauth_filesec_t *xsec, int isstat64,
1404 int needsrealdev, vfs_context_t ctx, struct ucred *file_cred)
1405 {
1406 struct vnode_attr va;
1407 int error;
1408 u_short mode;
1409 kauth_filesec_t fsec;
1410 struct stat *sb = (struct stat *)0; /* warning avoidance ; protected by isstat64 */
1411 struct stat64 * sb64 = (struct stat64 *)0; /* warning avoidance ; protected by isstat64 */
1412
1413 if (isstat64 != 0) {
1414 sb64 = (struct stat64 *)sbptr;
1415 } else {
1416 sb = (struct stat *)sbptr;
1417 }
1418 memset(&va, 0, sizeof(va));
1419 VATTR_INIT(&va);
1420 VATTR_WANTED(&va, va_fsid);
1421 VATTR_WANTED(&va, va_fileid);
1422 VATTR_WANTED(&va, va_mode);
1423 VATTR_WANTED(&va, va_type);
1424 VATTR_WANTED(&va, va_nlink);
1425 VATTR_WANTED(&va, va_uid);
1426 VATTR_WANTED(&va, va_gid);
1427 VATTR_WANTED(&va, va_rdev);
1428 VATTR_WANTED(&va, va_data_size);
1429 VATTR_WANTED(&va, va_access_time);
1430 VATTR_WANTED(&va, va_modify_time);
1431 VATTR_WANTED(&va, va_change_time);
1432 VATTR_WANTED(&va, va_create_time);
1433 VATTR_WANTED(&va, va_flags);
1434 VATTR_WANTED(&va, va_gen);
1435 VATTR_WANTED(&va, va_iosize);
1436 /* lower layers will synthesise va_total_alloc from va_data_size if required */
1437 VATTR_WANTED(&va, va_total_alloc);
1438 if (xsec != NULL) {
1439 VATTR_WANTED(&va, va_uuuid);
1440 VATTR_WANTED(&va, va_guuid);
1441 VATTR_WANTED(&va, va_acl);
1442 }
1443 if (needsrealdev) {
1444 va.va_vaflags = VA_REALFSID;
1445 }
1446 error = vnode_getattr(vp, &va, ctx);
1447 if (error) {
1448 goto out;
1449 }
1450 #if CONFIG_MACF
1451 /*
1452 * Give MAC polices a chance to reject or filter the attributes
1453 * returned by the filesystem. Note that MAC policies are consulted
1454 * *after* calling the filesystem because filesystems can return more
1455 * attributes than were requested so policies wouldn't be authoritative
1456 * is consulted beforehand. This also gives policies an opportunity
1457 * to change the values of attributes retrieved.
1458 */
1459 error = mac_vnode_check_getattr(ctx, file_cred, vp, &va);
1460 if (error) {
1461 goto out;
1462 }
1463 #endif
1464 /*
1465 * Copy from vattr table
1466 */
1467 if (isstat64 != 0) {
1468 sb64->st_dev = va.va_fsid;
1469 sb64->st_ino = (ino64_t)va.va_fileid;
1470 } else {
1471 sb->st_dev = va.va_fsid;
1472 sb->st_ino = (ino_t)va.va_fileid;
1473 }
1474 mode = va.va_mode;
1475 switch (vp->v_type) {
1476 case VREG:
1477 mode |= S_IFREG;
1478 break;
1479 case VDIR:
1480 mode |= S_IFDIR;
1481 break;
1482 case VBLK:
1483 mode |= S_IFBLK;
1484 break;
1485 case VCHR:
1486 mode |= S_IFCHR;
1487 break;
1488 case VLNK:
1489 mode |= S_IFLNK;
1490 break;
1491 case VSOCK:
1492 mode |= S_IFSOCK;
1493 break;
1494 case VFIFO:
1495 mode |= S_IFIFO;
1496 break;
1497 default:
1498 error = EBADF;
1499 goto out;
1500 }
1501 ;
1502 if (isstat64 != 0) {
1503 sb64->st_mode = mode;
1504 sb64->st_nlink = VATTR_IS_SUPPORTED(&va, va_nlink) ? va.va_nlink > UINT16_MAX ? UINT16_MAX : (u_int16_t)va.va_nlink : 1;
1505 sb64->st_uid = va.va_uid;
1506 sb64->st_gid = va.va_gid;
1507 sb64->st_rdev = va.va_rdev;
1508 sb64->st_size = va.va_data_size;
1509 sb64->st_atimespec = va.va_access_time;
1510 sb64->st_mtimespec = va.va_modify_time;
1511 sb64->st_ctimespec = va.va_change_time;
1512 if (VATTR_IS_SUPPORTED(&va, va_create_time)) {
1513 sb64->st_birthtimespec = va.va_create_time;
1514 } else {
1515 sb64->st_birthtimespec.tv_sec = sb64->st_birthtimespec.tv_nsec = 0;
1516 }
1517 sb64->st_blksize = va.va_iosize;
1518 sb64->st_flags = va.va_flags;
1519 sb64->st_blocks = roundup(va.va_total_alloc, 512) / 512;
1520 } else {
1521 sb->st_mode = mode;
1522 sb->st_nlink = VATTR_IS_SUPPORTED(&va, va_nlink) ? va.va_nlink > UINT16_MAX ? UINT16_MAX : (u_int16_t)va.va_nlink : 1;
1523 sb->st_uid = va.va_uid;
1524 sb->st_gid = va.va_gid;
1525 sb->st_rdev = va.va_rdev;
1526 sb->st_size = va.va_data_size;
1527 sb->st_atimespec = va.va_access_time;
1528 sb->st_mtimespec = va.va_modify_time;
1529 sb->st_ctimespec = va.va_change_time;
1530 sb->st_blksize = va.va_iosize;
1531 sb->st_flags = va.va_flags;
1532 sb->st_blocks = roundup(va.va_total_alloc, 512) / 512;
1533 }
1534
1535 /* if we're interested in extended security data and we got an ACL */
1536 if (xsec != NULL) {
1537 if (!VATTR_IS_SUPPORTED(&va, va_acl) &&
1538 !VATTR_IS_SUPPORTED(&va, va_uuuid) &&
1539 !VATTR_IS_SUPPORTED(&va, va_guuid)) {
1540 *xsec = KAUTH_FILESEC_NONE;
1541 } else {
1542 if (VATTR_IS_SUPPORTED(&va, va_acl) && (va.va_acl != NULL)) {
1543 fsec = kauth_filesec_alloc(va.va_acl->acl_entrycount);
1544 } else {
1545 fsec = kauth_filesec_alloc(0);
1546 }
1547 if (fsec == NULL) {
1548 error = ENOMEM;
1549 goto out;
1550 }
1551 fsec->fsec_magic = KAUTH_FILESEC_MAGIC;
1552 if (VATTR_IS_SUPPORTED(&va, va_uuuid)) {
1553 fsec->fsec_owner = va.va_uuuid;
1554 } else {
1555 fsec->fsec_owner = kauth_null_guid;
1556 }
1557 if (VATTR_IS_SUPPORTED(&va, va_guuid)) {
1558 fsec->fsec_group = va.va_guuid;
1559 } else {
1560 fsec->fsec_group = kauth_null_guid;
1561 }
1562 if (VATTR_IS_SUPPORTED(&va, va_acl) && (va.va_acl != NULL)) {
1563 __nochk_bcopy(va.va_acl, &(fsec->fsec_acl), KAUTH_ACL_COPYSIZE(va.va_acl));
1564 } else {
1565 fsec->fsec_acl.acl_entrycount = KAUTH_FILESEC_NOACL;
1566 }
1567 *xsec = fsec;
1568 }
1569 }
1570
1571 /* Do not give the generation number out to unpriviledged users */
1572 if (va.va_gen && !vfs_context_issuser(ctx)) {
1573 if (isstat64 != 0) {
1574 sb64->st_gen = 0;
1575 } else {
1576 sb->st_gen = 0;
1577 }
1578 } else {
1579 if (isstat64 != 0) {
1580 sb64->st_gen = va.va_gen;
1581 } else {
1582 sb->st_gen = va.va_gen;
1583 }
1584 }
1585
1586 error = 0;
1587 out:
1588 if (VATTR_IS_SUPPORTED(&va, va_acl) && va.va_acl != NULL) {
1589 kauth_acl_free(va.va_acl);
1590 }
1591 return error;
1592 }
1593
1594 int
vn_stat(struct vnode * vp,void * sb,kauth_filesec_t * xsec,int isstat64,int needsrealdev,vfs_context_t ctx)1595 vn_stat(struct vnode *vp, void *sb, kauth_filesec_t *xsec, int isstat64, int needsrealdev, vfs_context_t ctx)
1596 {
1597 int error;
1598
1599 #if CONFIG_MACF
1600 error = mac_vnode_check_stat(ctx, NOCRED, vp);
1601 if (error) {
1602 return error;
1603 }
1604 #endif
1605
1606 /* authorize */
1607 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_READ_ATTRIBUTES | KAUTH_VNODE_READ_SECURITY, ctx)) != 0) {
1608 return error;
1609 }
1610
1611 /* actual stat */
1612 return vn_stat_noauth(vp, sb, xsec, isstat64, needsrealdev, ctx, NOCRED);
1613 }
1614
1615
1616 /*
1617 * File table vnode ioctl routine.
1618 */
1619 static int
vn_ioctl(struct fileproc * fp,u_long com,caddr_t data,vfs_context_t ctx)1620 vn_ioctl(struct fileproc *fp, u_long com, caddr_t data, vfs_context_t ctx)
1621 {
1622 struct vnode *vp = (struct vnode *)fp_get_data(fp);
1623 off_t file_size;
1624 int error;
1625 struct vnode *ttyvp;
1626
1627 if ((error = vnode_getwithref(vp))) {
1628 return error;
1629 }
1630
1631 #if CONFIG_MACF
1632 error = mac_vnode_check_ioctl(ctx, vp, com);
1633 if (error) {
1634 goto out;
1635 }
1636 #endif
1637
1638 switch (vp->v_type) {
1639 case VREG:
1640 case VDIR:
1641 if (com == FIONREAD) {
1642 off_t temp_nbytes;
1643 if ((error = vnode_size(vp, &file_size, ctx)) != 0) {
1644 goto out;
1645 }
1646 temp_nbytes = file_size - fp->fp_glob->fg_offset;
1647 if (temp_nbytes > INT_MAX) {
1648 *(int *)data = INT_MAX;
1649 } else if (temp_nbytes < 0) {
1650 *(int *)data = 0;
1651 } else {
1652 *(int *)data = (int)temp_nbytes;
1653 }
1654 goto out;
1655 }
1656 if (com == FIONBIO || com == FIOASYNC) { /* XXX */
1657 goto out;
1658 }
1659 OS_FALLTHROUGH;
1660
1661 default:
1662 error = ENOTTY;
1663 goto out;
1664
1665 case VFIFO:
1666 case VCHR:
1667 case VBLK:
1668
1669 if (com == TIOCREVOKE || com == TIOCREVOKECLEAR) {
1670 error = ENOTTY;
1671 goto out;
1672 }
1673
1674 /* Should not be able to set block size from user space */
1675 if (com == DKIOCSETBLOCKSIZE) {
1676 error = EPERM;
1677 goto out;
1678 }
1679
1680 if (com == FIODTYPE) {
1681 if (vp->v_type == VBLK) {
1682 if (major(vp->v_rdev) >= nblkdev) {
1683 error = ENXIO;
1684 goto out;
1685 }
1686 *(int *)data = bdevsw[major(vp->v_rdev)].d_type;
1687 } else if (vp->v_type == VCHR) {
1688 if (major(vp->v_rdev) >= nchrdev) {
1689 error = ENXIO;
1690 goto out;
1691 }
1692 *(int *)data = cdevsw[major(vp->v_rdev)].d_type;
1693 } else {
1694 error = ENOTTY;
1695 goto out;
1696 }
1697 goto out;
1698 }
1699 error = VNOP_IOCTL(vp, com, data, fp->fp_glob->fg_flag, ctx);
1700
1701 if (error == 0 && com == TIOCSCTTY) {
1702 struct session *sessp;
1703 struct pgrp *pg;
1704
1705 pg = proc_pgrp(vfs_context_proc(ctx), &sessp);
1706
1707 session_lock(sessp);
1708 ttyvp = sessp->s_ttyvp;
1709 sessp->s_ttyvp = vp;
1710 sessp->s_ttyvid = vnode_vid(vp);
1711 session_unlock(sessp);
1712
1713 pgrp_rele(pg);
1714 }
1715 }
1716 out:
1717 (void)vnode_put(vp);
1718 return error;
1719 }
1720
1721 /*
1722 * File table vnode select routine.
1723 */
1724 static int
vn_select(struct fileproc * fp,int which,void * wql,__unused vfs_context_t ctx)1725 vn_select(struct fileproc *fp, int which, void *wql, __unused vfs_context_t ctx)
1726 {
1727 int error;
1728 struct vnode * vp = (struct vnode *)fp_get_data(fp);
1729 struct vfs_context context;
1730
1731 if ((error = vnode_getwithref(vp)) == 0) {
1732 context.vc_thread = current_thread();
1733 context.vc_ucred = fp->fp_glob->fg_cred;
1734
1735 #if CONFIG_MACF
1736 /*
1737 * XXX We should use a per thread credential here; minimally,
1738 * XXX the process credential should have a persistent
1739 * XXX reference on it before being passed in here.
1740 */
1741 error = mac_vnode_check_select(ctx, vp, which);
1742 if (error == 0)
1743 #endif
1744 error = VNOP_SELECT(vp, which, fp->fp_glob->fg_flag, wql, ctx);
1745
1746 (void)vnode_put(vp);
1747 }
1748 return error;
1749 }
1750
1751 /*
1752 * File table vnode close routine.
1753 */
1754 static int
vn_closefile(struct fileglob * fg,vfs_context_t ctx)1755 vn_closefile(struct fileglob *fg, vfs_context_t ctx)
1756 {
1757 struct vnode *vp = fg_get_data(fg);
1758 int error;
1759
1760 if ((error = vnode_getwithref(vp)) == 0) {
1761 if (FILEGLOB_DTYPE(fg) == DTYPE_VNODE &&
1762 ((fg->fg_flag & FWASLOCKED) != 0 ||
1763 (fg->fg_lflags & FG_HAS_OFDLOCK) != 0)) {
1764 struct flock lf = {
1765 .l_whence = SEEK_SET,
1766 .l_start = 0,
1767 .l_len = 0,
1768 .l_type = F_UNLCK
1769 };
1770
1771 if ((fg->fg_flag & FWASLOCKED) != 0) {
1772 (void) VNOP_ADVLOCK(vp, (caddr_t)fg,
1773 F_UNLCK, &lf, F_FLOCK, ctx, NULL);
1774 }
1775
1776 if ((fg->fg_lflags & FG_HAS_OFDLOCK) != 0) {
1777 (void) VNOP_ADVLOCK(vp, (caddr_t)fg,
1778 F_UNLCK, &lf, F_OFD_LOCK, ctx, NULL);
1779 }
1780 }
1781 error = vn_close(vp, fg->fg_flag, ctx);
1782 (void) vnode_put(vp);
1783 }
1784 return error;
1785 }
1786
1787 /*
1788 * Returns: 0 Success
1789 * VNOP_PATHCONF:???
1790 */
1791 int
vn_pathconf(vnode_t vp,int name,int32_t * retval,vfs_context_t ctx)1792 vn_pathconf(vnode_t vp, int name, int32_t *retval, vfs_context_t ctx)
1793 {
1794 int error = 0;
1795 struct vfs_attr vfa;
1796
1797 switch (name) {
1798 case _PC_EXTENDED_SECURITY_NP:
1799 *retval = vfs_extendedsecurity(vnode_mount(vp)) ? 1 : 0;
1800 break;
1801 case _PC_AUTH_OPAQUE_NP:
1802 *retval = vfs_authopaque(vnode_mount(vp));
1803 break;
1804 case _PC_2_SYMLINKS:
1805 *retval = 1; /* XXX NOTSUP on MSDOS, etc. */
1806 break;
1807 case _PC_ALLOC_SIZE_MIN:
1808 *retval = 1; /* XXX lie: 1 byte */
1809 break;
1810 case _PC_ASYNC_IO: /* unistd.h: _POSIX_ASYNCHRONUS_IO */
1811 *retval = 1; /* [AIO] option is supported */
1812 break;
1813 case _PC_PRIO_IO: /* unistd.h: _POSIX_PRIORITIZED_IO */
1814 *retval = 0; /* [PIO] option is not supported */
1815 break;
1816 case _PC_REC_INCR_XFER_SIZE:
1817 *retval = 4096; /* XXX go from MIN to MAX 4K at a time */
1818 break;
1819 case _PC_REC_MIN_XFER_SIZE:
1820 *retval = 4096; /* XXX recommend 4K minimum reads/writes */
1821 break;
1822 case _PC_REC_MAX_XFER_SIZE:
1823 *retval = 65536; /* XXX recommend 64K maximum reads/writes */
1824 break;
1825 case _PC_REC_XFER_ALIGN:
1826 *retval = 4096; /* XXX recommend page aligned buffers */
1827 break;
1828 case _PC_SYMLINK_MAX:
1829 *retval = 255; /* Minimum acceptable POSIX value */
1830 break;
1831 case _PC_SYNC_IO: /* unistd.h: _POSIX_SYNCHRONIZED_IO */
1832 *retval = 0; /* [SIO] option is not supported */
1833 break;
1834 case _PC_XATTR_SIZE_BITS:
1835 /* The number of bits used to store maximum extended
1836 * attribute size in bytes. For example, if the maximum
1837 * attribute size supported by a file system is 128K, the
1838 * value returned will be 18. However a value 18 can mean
1839 * that the maximum attribute size can be anywhere from
1840 * (256KB - 1) to 128KB. As a special case, the resource
1841 * fork can have much larger size, and some file system
1842 * specific extended attributes can have smaller and preset
1843 * size; for example, Finder Info is always 32 bytes.
1844 */
1845 memset(&vfa, 0, sizeof(vfa));
1846 VFSATTR_INIT(&vfa);
1847 VFSATTR_WANTED(&vfa, f_capabilities);
1848 if (vfs_getattr(vnode_mount(vp), &vfa, ctx) == 0 &&
1849 (VFSATTR_IS_SUPPORTED(&vfa, f_capabilities)) &&
1850 (vfa.f_capabilities.capabilities[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_EXTENDED_ATTR) &&
1851 (vfa.f_capabilities.valid[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_EXTENDED_ATTR)) {
1852 /* Supports native extended attributes */
1853 error = VNOP_PATHCONF(vp, name, retval, ctx);
1854 } else {
1855 /* Number of bits used to represent the maximum size of
1856 * extended attribute stored in an Apple Double file.
1857 */
1858 *retval = AD_XATTR_SIZE_BITS;
1859 }
1860 break;
1861 default:
1862 error = VNOP_PATHCONF(vp, name, retval, ctx);
1863 break;
1864 }
1865
1866 return error;
1867 }
1868
1869 static int
vn_kqfilter(struct fileproc * fp,struct knote * kn,struct kevent_qos_s * kev)1870 vn_kqfilter(struct fileproc *fp, struct knote *kn, struct kevent_qos_s *kev)
1871 {
1872 vfs_context_t ctx = vfs_context_current();
1873 struct vnode *vp;
1874 int error = 0;
1875 int result = 0;
1876
1877 vp = (struct vnode *)fp_get_data(fp);
1878
1879 /*
1880 * Don't attach a knote to a dead vnode.
1881 */
1882 if ((error = vget_internal(vp, 0, VNODE_NODEAD)) == 0) {
1883 switch (kn->kn_filter) {
1884 case EVFILT_READ:
1885 case EVFILT_WRITE:
1886 if (vnode_isfifo(vp)) {
1887 /* We'll only watch FIFOs that use our fifofs */
1888 if (!(vp->v_fifoinfo && vp->v_fifoinfo->fi_readsock)) {
1889 error = ENOTSUP;
1890 }
1891 } else if (!vnode_isreg(vp)) {
1892 if (vnode_ischr(vp)) {
1893 result = spec_kqfilter(vp, kn, kev);
1894 if ((kn->kn_flags & EV_ERROR) == 0) {
1895 /* claimed by a special device */
1896 vnode_put(vp);
1897 return result;
1898 }
1899 }
1900 error = EINVAL;
1901 }
1902 break;
1903 case EVFILT_VNODE:
1904 break;
1905 default:
1906 error = EINVAL;
1907 }
1908
1909 if (error == 0) {
1910 #if CONFIG_MACF
1911 error = mac_vnode_check_kqfilter(ctx, fp->fp_glob->fg_cred, kn, vp);
1912 if (error) {
1913 vnode_put(vp);
1914 goto out;
1915 }
1916 #endif
1917
1918 kn->kn_hook = (void*)vp;
1919 kn->kn_filtid = EVFILTID_VN;
1920
1921 vnode_lock(vp);
1922 KNOTE_ATTACH(&vp->v_knotes, kn);
1923 result = filt_vnode_common(kn, NULL, vp, 0);
1924 vnode_unlock(vp);
1925
1926 /*
1927 * Ask the filesystem to provide remove notifications,
1928 * but ignore failure
1929 */
1930 VNOP_MONITOR(vp, 0, VNODE_MONITOR_BEGIN, (void*) kn, ctx);
1931 }
1932
1933 vnode_put(vp);
1934 }
1935
1936 out:
1937 if (error) {
1938 knote_set_error(kn, error);
1939 }
1940
1941 return result;
1942 }
1943
1944 static void
filt_vndetach(struct knote * kn)1945 filt_vndetach(struct knote *kn)
1946 {
1947 vfs_context_t ctx = vfs_context_current();
1948 struct vnode *vp = (struct vnode *)kn->kn_hook;
1949 uint32_t vid = vnode_vid(vp);
1950 if (vnode_getwithvid(vp, vid)) {
1951 return;
1952 }
1953
1954 vnode_lock(vp);
1955 KNOTE_DETACH(&vp->v_knotes, kn);
1956 vnode_unlock(vp);
1957
1958 /*
1959 * Tell a (generally networked) filesystem that we're no longer watching
1960 * If the FS wants to track contexts, it should still be using the one from
1961 * the VNODE_MONITOR_BEGIN.
1962 */
1963 VNOP_MONITOR(vp, 0, VNODE_MONITOR_END, (void*)kn, ctx);
1964 vnode_put(vp);
1965 }
1966
1967
1968 /*
1969 * Used for EVFILT_READ
1970 *
1971 * Takes only VFIFO or VREG. vnode is locked. We handle the "poll" case
1972 * differently than the regular case for VREG files. If not in poll(),
1973 * then we need to know current fileproc offset for VREG.
1974 */
1975 static int64_t
vnode_readable_data_count(vnode_t vp,off_t current_offset,int ispoll)1976 vnode_readable_data_count(vnode_t vp, off_t current_offset, int ispoll)
1977 {
1978 if (vnode_isfifo(vp)) {
1979 #if FIFO
1980 int cnt;
1981 int err = fifo_charcount(vp, &cnt);
1982 if (err == 0) {
1983 return (int64_t)cnt;
1984 } else
1985 #endif
1986 {
1987 return 0;
1988 }
1989 } else if (vnode_isreg(vp)) {
1990 if (ispoll) {
1991 return 1;
1992 }
1993
1994 off_t amount;
1995 amount = vp->v_un.vu_ubcinfo->ui_size - current_offset;
1996 if (amount > INT64_MAX) {
1997 return INT64_MAX;
1998 } else if (amount < INT64_MIN) {
1999 return INT64_MIN;
2000 } else {
2001 return (int64_t)amount;
2002 }
2003 } else {
2004 panic("Should never have an EVFILT_READ except for reg or fifo.");
2005 return 0;
2006 }
2007 }
2008
2009 /*
2010 * Used for EVFILT_WRITE.
2011 *
2012 * For regular vnodes, we can always write (1). For named pipes,
2013 * see how much space there is in the buffer. Nothing else is covered.
2014 */
2015 static intptr_t
vnode_writable_space_count(vnode_t vp)2016 vnode_writable_space_count(vnode_t vp)
2017 {
2018 if (vnode_isfifo(vp)) {
2019 #if FIFO
2020 long spc;
2021 int err = fifo_freespace(vp, &spc);
2022 if (err == 0) {
2023 return (intptr_t)spc;
2024 } else
2025 #endif
2026 {
2027 return (intptr_t)0;
2028 }
2029 } else if (vnode_isreg(vp)) {
2030 return (intptr_t)1;
2031 } else {
2032 panic("Should never have an EVFILT_READ except for reg or fifo.");
2033 return 0;
2034 }
2035 }
2036
2037 /*
2038 * Determine whether this knote should be active
2039 *
2040 * This is kind of subtle.
2041 * --First, notice if the vnode has been revoked: in so, override hint
2042 * --EVFILT_READ knotes are checked no matter what the hint is
2043 * --Other knotes activate based on hint.
2044 * --If hint is revoke, set special flags and activate
2045 */
2046 static int
filt_vnode_common(struct knote * kn,struct kevent_qos_s * kev,vnode_t vp,long hint)2047 filt_vnode_common(struct knote *kn, struct kevent_qos_s *kev, vnode_t vp, long hint)
2048 {
2049 int activate = 0;
2050 int64_t data = 0;
2051
2052 lck_mtx_assert(&vp->v_lock, LCK_MTX_ASSERT_OWNED);
2053
2054 /* Special handling for vnodes that are in recycle or already gone */
2055 if (NOTE_REVOKE == hint) {
2056 kn->kn_flags |= (EV_EOF | EV_ONESHOT);
2057 activate = 1;
2058
2059 if ((kn->kn_filter == EVFILT_VNODE) && (kn->kn_sfflags & NOTE_REVOKE)) {
2060 kn->kn_fflags |= NOTE_REVOKE;
2061 }
2062 } else {
2063 switch (kn->kn_filter) {
2064 case EVFILT_READ:
2065 data = vnode_readable_data_count(vp, kn->kn_fp->fp_glob->fg_offset, (kn->kn_flags & EV_POLL));
2066 activate = (data != 0);
2067 break;
2068 case EVFILT_WRITE:
2069 data = vnode_writable_space_count(vp);
2070 activate = (data != 0);
2071 break;
2072 case EVFILT_VNODE:
2073 /* Check events this note matches against the hint */
2074 if (kn->kn_sfflags & hint) {
2075 kn->kn_fflags |= hint; /* Set which event occurred */
2076 }
2077 activate = (kn->kn_fflags != 0);
2078 break;
2079 default:
2080 panic("Invalid knote filter on a vnode!");
2081 }
2082 }
2083
2084 if (kev && activate) {
2085 knote_fill_kevent(kn, kev, data);
2086 }
2087
2088 return activate;
2089 }
2090
2091 static int
filt_vnode(struct knote * kn,long hint)2092 filt_vnode(struct knote *kn, long hint)
2093 {
2094 vnode_t vp = (struct vnode *)kn->kn_hook;
2095
2096 return filt_vnode_common(kn, NULL, vp, hint);
2097 }
2098
2099 static int
filt_vntouch(struct knote * kn,struct kevent_qos_s * kev)2100 filt_vntouch(struct knote *kn, struct kevent_qos_s *kev)
2101 {
2102 vnode_t vp = (struct vnode *)kn->kn_hook;
2103 uint32_t vid = vnode_vid(vp);
2104 int activate;
2105 int hint = 0;
2106
2107 vnode_lock(vp);
2108 if (vnode_getiocount(vp, vid, VNODE_NODEAD | VNODE_WITHID) != 0) {
2109 /* is recycled */
2110 hint = NOTE_REVOKE;
2111 }
2112
2113 /* accept new input fflags mask */
2114 kn->kn_sfflags = kev->fflags;
2115
2116 activate = filt_vnode_common(kn, NULL, vp, hint);
2117
2118 if (hint == 0) {
2119 vnode_put_locked(vp);
2120 }
2121 vnode_unlock(vp);
2122
2123 return activate;
2124 }
2125
2126 static int
filt_vnprocess(struct knote * kn,struct kevent_qos_s * kev)2127 filt_vnprocess(struct knote *kn, struct kevent_qos_s *kev)
2128 {
2129 vnode_t vp = (struct vnode *)kn->kn_hook;
2130 uint32_t vid = vnode_vid(vp);
2131 int activate;
2132 int hint = 0;
2133
2134 vnode_lock(vp);
2135 if (vnode_getiocount(vp, vid, VNODE_NODEAD | VNODE_WITHID) != 0) {
2136 /* Is recycled */
2137 hint = NOTE_REVOKE;
2138 }
2139 activate = filt_vnode_common(kn, kev, vp, hint);
2140
2141 /* Definitely need to unlock, may need to put */
2142 if (hint == 0) {
2143 vnode_put_locked(vp);
2144 }
2145 vnode_unlock(vp);
2146
2147 return activate;
2148 }
2149
2150 struct vniodesc {
2151 vnode_t vnio_vnode; /* associated vnode */
2152 int vnio_fflags; /* cached fileglob flags */
2153 };
2154
2155 errno_t
vnio_openfd(int fd,vniodesc_t * vniop)2156 vnio_openfd(int fd, vniodesc_t *vniop)
2157 {
2158 proc_t p = current_proc();
2159 struct fileproc *fp = NULL;
2160 vniodesc_t vnio;
2161 vnode_t vp;
2162 int error;
2163 bool need_drop = false;
2164
2165 vnio = kalloc_type(struct vniodesc, Z_WAITOK);
2166
2167 error = fp_getfvp(p, fd, &fp, &vp);
2168 if (error) {
2169 goto out;
2170 }
2171 need_drop = true;
2172
2173 if ((fp->fp_glob->fg_flag & (FREAD | FWRITE)) == 0) {
2174 error = EBADF;
2175 goto out;
2176 }
2177
2178 if (vnode_isswap(vp)) {
2179 error = EPERM;
2180 goto out;
2181 }
2182
2183 if (vp->v_type != VREG) {
2184 error = EFTYPE;
2185 goto out;
2186 }
2187
2188 error = vnode_getwithref(vp);
2189 if (error) {
2190 goto out;
2191 }
2192
2193 vnio->vnio_vnode = vp;
2194 vnio->vnio_fflags = fp->fp_glob->fg_flag;
2195
2196 (void)fp_drop(p, fd, fp, 0);
2197 need_drop = false;
2198
2199 error = vnode_ref_ext(vp, vnio->vnio_fflags, 0);
2200 if (error == 0) {
2201 *vniop = vnio;
2202 vnio = NULL;
2203 }
2204
2205 vnode_put(vp);
2206
2207 out:
2208 if (need_drop) {
2209 fp_drop(p, fd, fp, 0);
2210 }
2211 if (vnio != NULL) {
2212 kfree_type(struct vniodesc, vnio);
2213 }
2214 return error;
2215 }
2216
2217 errno_t
vnio_close(vniodesc_t vnio)2218 vnio_close(vniodesc_t vnio)
2219 {
2220 int error;
2221
2222 /*
2223 * The vniodesc is always destroyed, because the close
2224 * always "succeeds". We just return whatever error
2225 * might have been encountered while doing so.
2226 */
2227
2228 error = vnode_getwithref(vnio->vnio_vnode);
2229 if (error == 0) {
2230 error = vnode_close(vnio->vnio_vnode, vnio->vnio_fflags, NULL);
2231 }
2232
2233 kfree_type(struct vniodesc, vnio);
2234
2235 return error;
2236 }
2237
2238 errno_t
vnio_read(vniodesc_t vnio,uio_t uio)2239 vnio_read(vniodesc_t vnio, uio_t uio)
2240 {
2241 vnode_t vp = vnio->vnio_vnode;
2242 user_ssize_t read_len;
2243 int error;
2244
2245 read_len = uio_resid(uio);
2246 if (read_len < 0 || read_len > INT_MAX) {
2247 return EINVAL;
2248 }
2249
2250 error = vnode_getwithref(vp);
2251 if (error == 0) {
2252 error = vn_read_common(vp, uio, vnio->vnio_fflags,
2253 vfs_context_current());
2254 vnode_put(vp);
2255 }
2256
2257 return error;
2258 }
2259
2260 vnode_t
vnio_vnode(vniodesc_t vnio)2261 vnio_vnode(vniodesc_t vnio)
2262 {
2263 return vnio->vnio_vnode;
2264 }
2265