Back to home page

OSCL-LXR

 
 

    


0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  * fs/inotify_user.c - inotify support for userspace
0004  *
0005  * Authors:
0006  *  John McCutchan  <ttb@tentacle.dhs.org>
0007  *  Robert Love <rml@novell.com>
0008  *
0009  * Copyright (C) 2005 John McCutchan
0010  * Copyright 2006 Hewlett-Packard Development Company, L.P.
0011  *
0012  * Copyright (C) 2009 Eric Paris <Red Hat Inc>
0013  * inotify was largely rewriten to make use of the fsnotify infrastructure
0014  */
0015 
0016 #include <linux/file.h>
0017 #include <linux/fs.h> /* struct inode */
0018 #include <linux/fsnotify_backend.h>
0019 #include <linux/idr.h>
0020 #include <linux/init.h> /* fs_initcall */
0021 #include <linux/inotify.h>
0022 #include <linux/kernel.h> /* roundup() */
0023 #include <linux/namei.h> /* LOOKUP_FOLLOW */
0024 #include <linux/sched/signal.h>
0025 #include <linux/slab.h> /* struct kmem_cache */
0026 #include <linux/syscalls.h>
0027 #include <linux/types.h>
0028 #include <linux/anon_inodes.h>
0029 #include <linux/uaccess.h>
0030 #include <linux/poll.h>
0031 #include <linux/wait.h>
0032 #include <linux/memcontrol.h>
0033 #include <linux/security.h>
0034 
0035 #include "inotify.h"
0036 #include "../fdinfo.h"
0037 
0038 #include <asm/ioctls.h>
0039 
0040 /*
0041  * An inotify watch requires allocating an inotify_inode_mark structure as
0042  * well as pinning the watched inode. Doubling the size of a VFS inode
0043  * should be more than enough to cover the additional filesystem inode
0044  * size increase.
0045  */
0046 #define INOTIFY_WATCH_COST  (sizeof(struct inotify_inode_mark) + \
0047                  2 * sizeof(struct inode))
0048 
0049 /* configurable via /proc/sys/fs/inotify/ */
0050 static int inotify_max_queued_events __read_mostly;
0051 
0052 struct kmem_cache *inotify_inode_mark_cachep __read_mostly;
0053 
0054 #ifdef CONFIG_SYSCTL
0055 
0056 #include <linux/sysctl.h>
0057 
0058 static long it_zero = 0;
0059 static long it_int_max = INT_MAX;
0060 
0061 static struct ctl_table inotify_table[] = {
0062     {
0063         .procname   = "max_user_instances",
0064         .data       = &init_user_ns.ucount_max[UCOUNT_INOTIFY_INSTANCES],
0065         .maxlen     = sizeof(long),
0066         .mode       = 0644,
0067         .proc_handler   = proc_doulongvec_minmax,
0068         .extra1     = &it_zero,
0069         .extra2     = &it_int_max,
0070     },
0071     {
0072         .procname   = "max_user_watches",
0073         .data       = &init_user_ns.ucount_max[UCOUNT_INOTIFY_WATCHES],
0074         .maxlen     = sizeof(long),
0075         .mode       = 0644,
0076         .proc_handler   = proc_doulongvec_minmax,
0077         .extra1     = &it_zero,
0078         .extra2     = &it_int_max,
0079     },
0080     {
0081         .procname   = "max_queued_events",
0082         .data       = &inotify_max_queued_events,
0083         .maxlen     = sizeof(int),
0084         .mode       = 0644,
0085         .proc_handler   = proc_dointvec_minmax,
0086         .extra1     = SYSCTL_ZERO
0087     },
0088     { }
0089 };
0090 
0091 static void __init inotify_sysctls_init(void)
0092 {
0093     register_sysctl("fs/inotify", inotify_table);
0094 }
0095 
0096 #else
0097 #define inotify_sysctls_init() do { } while (0)
0098 #endif /* CONFIG_SYSCTL */
0099 
0100 static inline __u32 inotify_arg_to_mask(struct inode *inode, u32 arg)
0101 {
0102     __u32 mask;
0103 
0104     /*
0105      * Everything should receive events when the inode is unmounted.
0106      * All directories care about children.
0107      */
0108     mask = (FS_UNMOUNT);
0109     if (S_ISDIR(inode->i_mode))
0110         mask |= FS_EVENT_ON_CHILD;
0111 
0112     /* mask off the flags used to open the fd */
0113     mask |= (arg & INOTIFY_USER_MASK);
0114 
0115     return mask;
0116 }
0117 
0118 #define INOTIFY_MARK_FLAGS \
0119     (FSNOTIFY_MARK_FLAG_EXCL_UNLINK | FSNOTIFY_MARK_FLAG_IN_ONESHOT)
0120 
0121 static inline unsigned int inotify_arg_to_flags(u32 arg)
0122 {
0123     unsigned int flags = 0;
0124 
0125     if (arg & IN_EXCL_UNLINK)
0126         flags |= FSNOTIFY_MARK_FLAG_EXCL_UNLINK;
0127     if (arg & IN_ONESHOT)
0128         flags |= FSNOTIFY_MARK_FLAG_IN_ONESHOT;
0129 
0130     return flags;
0131 }
0132 
0133 static inline u32 inotify_mask_to_arg(__u32 mask)
0134 {
0135     return mask & (IN_ALL_EVENTS | IN_ISDIR | IN_UNMOUNT | IN_IGNORED |
0136                IN_Q_OVERFLOW);
0137 }
0138 
0139 /* inotify userspace file descriptor functions */
0140 static __poll_t inotify_poll(struct file *file, poll_table *wait)
0141 {
0142     struct fsnotify_group *group = file->private_data;
0143     __poll_t ret = 0;
0144 
0145     poll_wait(file, &group->notification_waitq, wait);
0146     spin_lock(&group->notification_lock);
0147     if (!fsnotify_notify_queue_is_empty(group))
0148         ret = EPOLLIN | EPOLLRDNORM;
0149     spin_unlock(&group->notification_lock);
0150 
0151     return ret;
0152 }
0153 
0154 static int round_event_name_len(struct fsnotify_event *fsn_event)
0155 {
0156     struct inotify_event_info *event;
0157 
0158     event = INOTIFY_E(fsn_event);
0159     if (!event->name_len)
0160         return 0;
0161     return roundup(event->name_len + 1, sizeof(struct inotify_event));
0162 }
0163 
0164 /*
0165  * Get an inotify_kernel_event if one exists and is small
0166  * enough to fit in "count". Return an error pointer if
0167  * not large enough.
0168  *
0169  * Called with the group->notification_lock held.
0170  */
0171 static struct fsnotify_event *get_one_event(struct fsnotify_group *group,
0172                         size_t count)
0173 {
0174     size_t event_size = sizeof(struct inotify_event);
0175     struct fsnotify_event *event;
0176 
0177     event = fsnotify_peek_first_event(group);
0178     if (!event)
0179         return NULL;
0180 
0181     pr_debug("%s: group=%p event=%p\n", __func__, group, event);
0182 
0183     event_size += round_event_name_len(event);
0184     if (event_size > count)
0185         return ERR_PTR(-EINVAL);
0186 
0187     /* held the notification_lock the whole time, so this is the
0188      * same event we peeked above */
0189     fsnotify_remove_first_event(group);
0190 
0191     return event;
0192 }
0193 
0194 /*
0195  * Copy an event to user space, returning how much we copied.
0196  *
0197  * We already checked that the event size is smaller than the
0198  * buffer we had in "get_one_event()" above.
0199  */
0200 static ssize_t copy_event_to_user(struct fsnotify_group *group,
0201                   struct fsnotify_event *fsn_event,
0202                   char __user *buf)
0203 {
0204     struct inotify_event inotify_event;
0205     struct inotify_event_info *event;
0206     size_t event_size = sizeof(struct inotify_event);
0207     size_t name_len;
0208     size_t pad_name_len;
0209 
0210     pr_debug("%s: group=%p event=%p\n", __func__, group, fsn_event);
0211 
0212     event = INOTIFY_E(fsn_event);
0213     name_len = event->name_len;
0214     /*
0215      * round up name length so it is a multiple of event_size
0216      * plus an extra byte for the terminating '\0'.
0217      */
0218     pad_name_len = round_event_name_len(fsn_event);
0219     inotify_event.len = pad_name_len;
0220     inotify_event.mask = inotify_mask_to_arg(event->mask);
0221     inotify_event.wd = event->wd;
0222     inotify_event.cookie = event->sync_cookie;
0223 
0224     /* send the main event */
0225     if (copy_to_user(buf, &inotify_event, event_size))
0226         return -EFAULT;
0227 
0228     buf += event_size;
0229 
0230     /*
0231      * fsnotify only stores the pathname, so here we have to send the pathname
0232      * and then pad that pathname out to a multiple of sizeof(inotify_event)
0233      * with zeros.
0234      */
0235     if (pad_name_len) {
0236         /* copy the path name */
0237         if (copy_to_user(buf, event->name, name_len))
0238             return -EFAULT;
0239         buf += name_len;
0240 
0241         /* fill userspace with 0's */
0242         if (clear_user(buf, pad_name_len - name_len))
0243             return -EFAULT;
0244         event_size += pad_name_len;
0245     }
0246 
0247     return event_size;
0248 }
0249 
0250 static ssize_t inotify_read(struct file *file, char __user *buf,
0251                 size_t count, loff_t *pos)
0252 {
0253     struct fsnotify_group *group;
0254     struct fsnotify_event *kevent;
0255     char __user *start;
0256     int ret;
0257     DEFINE_WAIT_FUNC(wait, woken_wake_function);
0258 
0259     start = buf;
0260     group = file->private_data;
0261 
0262     add_wait_queue(&group->notification_waitq, &wait);
0263     while (1) {
0264         spin_lock(&group->notification_lock);
0265         kevent = get_one_event(group, count);
0266         spin_unlock(&group->notification_lock);
0267 
0268         pr_debug("%s: group=%p kevent=%p\n", __func__, group, kevent);
0269 
0270         if (kevent) {
0271             ret = PTR_ERR(kevent);
0272             if (IS_ERR(kevent))
0273                 break;
0274             ret = copy_event_to_user(group, kevent, buf);
0275             fsnotify_destroy_event(group, kevent);
0276             if (ret < 0)
0277                 break;
0278             buf += ret;
0279             count -= ret;
0280             continue;
0281         }
0282 
0283         ret = -EAGAIN;
0284         if (file->f_flags & O_NONBLOCK)
0285             break;
0286         ret = -ERESTARTSYS;
0287         if (signal_pending(current))
0288             break;
0289 
0290         if (start != buf)
0291             break;
0292 
0293         wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
0294     }
0295     remove_wait_queue(&group->notification_waitq, &wait);
0296 
0297     if (start != buf && ret != -EFAULT)
0298         ret = buf - start;
0299     return ret;
0300 }
0301 
0302 static int inotify_release(struct inode *ignored, struct file *file)
0303 {
0304     struct fsnotify_group *group = file->private_data;
0305 
0306     pr_debug("%s: group=%p\n", __func__, group);
0307 
0308     /* free this group, matching get was inotify_init->fsnotify_obtain_group */
0309     fsnotify_destroy_group(group);
0310 
0311     return 0;
0312 }
0313 
0314 static long inotify_ioctl(struct file *file, unsigned int cmd,
0315               unsigned long arg)
0316 {
0317     struct fsnotify_group *group;
0318     struct fsnotify_event *fsn_event;
0319     void __user *p;
0320     int ret = -ENOTTY;
0321     size_t send_len = 0;
0322 
0323     group = file->private_data;
0324     p = (void __user *) arg;
0325 
0326     pr_debug("%s: group=%p cmd=%u\n", __func__, group, cmd);
0327 
0328     switch (cmd) {
0329     case FIONREAD:
0330         spin_lock(&group->notification_lock);
0331         list_for_each_entry(fsn_event, &group->notification_list,
0332                     list) {
0333             send_len += sizeof(struct inotify_event);
0334             send_len += round_event_name_len(fsn_event);
0335         }
0336         spin_unlock(&group->notification_lock);
0337         ret = put_user(send_len, (int __user *) p);
0338         break;
0339 #ifdef CONFIG_CHECKPOINT_RESTORE
0340     case INOTIFY_IOC_SETNEXTWD:
0341         ret = -EINVAL;
0342         if (arg >= 1 && arg <= INT_MAX) {
0343             struct inotify_group_private_data *data;
0344 
0345             data = &group->inotify_data;
0346             spin_lock(&data->idr_lock);
0347             idr_set_cursor(&data->idr, (unsigned int)arg);
0348             spin_unlock(&data->idr_lock);
0349             ret = 0;
0350         }
0351         break;
0352 #endif /* CONFIG_CHECKPOINT_RESTORE */
0353     }
0354 
0355     return ret;
0356 }
0357 
0358 static const struct file_operations inotify_fops = {
0359     .show_fdinfo    = inotify_show_fdinfo,
0360     .poll       = inotify_poll,
0361     .read       = inotify_read,
0362     .fasync     = fsnotify_fasync,
0363     .release    = inotify_release,
0364     .unlocked_ioctl = inotify_ioctl,
0365     .compat_ioctl   = inotify_ioctl,
0366     .llseek     = noop_llseek,
0367 };
0368 
0369 
0370 /*
0371  * find_inode - resolve a user-given path to a specific inode
0372  */
0373 static int inotify_find_inode(const char __user *dirname, struct path *path,
0374                         unsigned int flags, __u64 mask)
0375 {
0376     int error;
0377 
0378     error = user_path_at(AT_FDCWD, dirname, flags, path);
0379     if (error)
0380         return error;
0381     /* you can only watch an inode if you have read permissions on it */
0382     error = path_permission(path, MAY_READ);
0383     if (error) {
0384         path_put(path);
0385         return error;
0386     }
0387     error = security_path_notify(path, mask,
0388                 FSNOTIFY_OBJ_TYPE_INODE);
0389     if (error)
0390         path_put(path);
0391 
0392     return error;
0393 }
0394 
0395 static int inotify_add_to_idr(struct idr *idr, spinlock_t *idr_lock,
0396                   struct inotify_inode_mark *i_mark)
0397 {
0398     int ret;
0399 
0400     idr_preload(GFP_KERNEL);
0401     spin_lock(idr_lock);
0402 
0403     ret = idr_alloc_cyclic(idr, i_mark, 1, 0, GFP_NOWAIT);
0404     if (ret >= 0) {
0405         /* we added the mark to the idr, take a reference */
0406         i_mark->wd = ret;
0407         fsnotify_get_mark(&i_mark->fsn_mark);
0408     }
0409 
0410     spin_unlock(idr_lock);
0411     idr_preload_end();
0412     return ret < 0 ? ret : 0;
0413 }
0414 
0415 static struct inotify_inode_mark *inotify_idr_find_locked(struct fsnotify_group *group,
0416                                 int wd)
0417 {
0418     struct idr *idr = &group->inotify_data.idr;
0419     spinlock_t *idr_lock = &group->inotify_data.idr_lock;
0420     struct inotify_inode_mark *i_mark;
0421 
0422     assert_spin_locked(idr_lock);
0423 
0424     i_mark = idr_find(idr, wd);
0425     if (i_mark) {
0426         struct fsnotify_mark *fsn_mark = &i_mark->fsn_mark;
0427 
0428         fsnotify_get_mark(fsn_mark);
0429         /* One ref for being in the idr, one ref we just took */
0430         BUG_ON(refcount_read(&fsn_mark->refcnt) < 2);
0431     }
0432 
0433     return i_mark;
0434 }
0435 
0436 static struct inotify_inode_mark *inotify_idr_find(struct fsnotify_group *group,
0437                              int wd)
0438 {
0439     struct inotify_inode_mark *i_mark;
0440     spinlock_t *idr_lock = &group->inotify_data.idr_lock;
0441 
0442     spin_lock(idr_lock);
0443     i_mark = inotify_idr_find_locked(group, wd);
0444     spin_unlock(idr_lock);
0445 
0446     return i_mark;
0447 }
0448 
0449 /*
0450  * Remove the mark from the idr (if present) and drop the reference
0451  * on the mark because it was in the idr.
0452  */
0453 static void inotify_remove_from_idr(struct fsnotify_group *group,
0454                     struct inotify_inode_mark *i_mark)
0455 {
0456     struct idr *idr = &group->inotify_data.idr;
0457     spinlock_t *idr_lock = &group->inotify_data.idr_lock;
0458     struct inotify_inode_mark *found_i_mark = NULL;
0459     int wd;
0460 
0461     spin_lock(idr_lock);
0462     wd = i_mark->wd;
0463 
0464     /*
0465      * does this i_mark think it is in the idr?  we shouldn't get called
0466      * if it wasn't....
0467      */
0468     if (wd == -1) {
0469         WARN_ONCE(1, "%s: i_mark=%p i_mark->wd=%d i_mark->group=%p\n",
0470             __func__, i_mark, i_mark->wd, i_mark->fsn_mark.group);
0471         goto out;
0472     }
0473 
0474     /* Lets look in the idr to see if we find it */
0475     found_i_mark = inotify_idr_find_locked(group, wd);
0476     if (unlikely(!found_i_mark)) {
0477         WARN_ONCE(1, "%s: i_mark=%p i_mark->wd=%d i_mark->group=%p\n",
0478             __func__, i_mark, i_mark->wd, i_mark->fsn_mark.group);
0479         goto out;
0480     }
0481 
0482     /*
0483      * We found an mark in the idr at the right wd, but it's
0484      * not the mark we were told to remove.  eparis seriously
0485      * fucked up somewhere.
0486      */
0487     if (unlikely(found_i_mark != i_mark)) {
0488         WARN_ONCE(1, "%s: i_mark=%p i_mark->wd=%d i_mark->group=%p "
0489             "found_i_mark=%p found_i_mark->wd=%d "
0490             "found_i_mark->group=%p\n", __func__, i_mark,
0491             i_mark->wd, i_mark->fsn_mark.group, found_i_mark,
0492             found_i_mark->wd, found_i_mark->fsn_mark.group);
0493         goto out;
0494     }
0495 
0496     /*
0497      * One ref for being in the idr
0498      * one ref grabbed by inotify_idr_find
0499      */
0500     if (unlikely(refcount_read(&i_mark->fsn_mark.refcnt) < 2)) {
0501         printk(KERN_ERR "%s: i_mark=%p i_mark->wd=%d i_mark->group=%p\n",
0502              __func__, i_mark, i_mark->wd, i_mark->fsn_mark.group);
0503         /* we can't really recover with bad ref cnting.. */
0504         BUG();
0505     }
0506 
0507     idr_remove(idr, wd);
0508     /* Removed from the idr, drop that ref. */
0509     fsnotify_put_mark(&i_mark->fsn_mark);
0510 out:
0511     i_mark->wd = -1;
0512     spin_unlock(idr_lock);
0513     /* match the ref taken by inotify_idr_find_locked() */
0514     if (found_i_mark)
0515         fsnotify_put_mark(&found_i_mark->fsn_mark);
0516 }
0517 
0518 /*
0519  * Send IN_IGNORED for this wd, remove this wd from the idr.
0520  */
0521 void inotify_ignored_and_remove_idr(struct fsnotify_mark *fsn_mark,
0522                     struct fsnotify_group *group)
0523 {
0524     struct inotify_inode_mark *i_mark;
0525 
0526     /* Queue ignore event for the watch */
0527     inotify_handle_inode_event(fsn_mark, FS_IN_IGNORED, NULL, NULL, NULL,
0528                    0);
0529 
0530     i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark);
0531     /* remove this mark from the idr */
0532     inotify_remove_from_idr(group, i_mark);
0533 
0534     dec_inotify_watches(group->inotify_data.ucounts);
0535 }
0536 
0537 static int inotify_update_existing_watch(struct fsnotify_group *group,
0538                      struct inode *inode,
0539                      u32 arg)
0540 {
0541     struct fsnotify_mark *fsn_mark;
0542     struct inotify_inode_mark *i_mark;
0543     __u32 old_mask, new_mask;
0544     int replace = !(arg & IN_MASK_ADD);
0545     int create = (arg & IN_MASK_CREATE);
0546     int ret;
0547 
0548     fsn_mark = fsnotify_find_mark(&inode->i_fsnotify_marks, group);
0549     if (!fsn_mark)
0550         return -ENOENT;
0551     else if (create) {
0552         ret = -EEXIST;
0553         goto out;
0554     }
0555 
0556     i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark);
0557 
0558     spin_lock(&fsn_mark->lock);
0559     old_mask = fsn_mark->mask;
0560     if (replace) {
0561         fsn_mark->mask = 0;
0562         fsn_mark->flags &= ~INOTIFY_MARK_FLAGS;
0563     }
0564     fsn_mark->mask |= inotify_arg_to_mask(inode, arg);
0565     fsn_mark->flags |= inotify_arg_to_flags(arg);
0566     new_mask = fsn_mark->mask;
0567     spin_unlock(&fsn_mark->lock);
0568 
0569     if (old_mask != new_mask) {
0570         /* more bits in old than in new? */
0571         int dropped = (old_mask & ~new_mask);
0572         /* more bits in this fsn_mark than the inode's mask? */
0573         int do_inode = (new_mask & ~inode->i_fsnotify_mask);
0574 
0575         /* update the inode with this new fsn_mark */
0576         if (dropped || do_inode)
0577             fsnotify_recalc_mask(inode->i_fsnotify_marks);
0578 
0579     }
0580 
0581     /* return the wd */
0582     ret = i_mark->wd;
0583 
0584 out:
0585     /* match the get from fsnotify_find_mark() */
0586     fsnotify_put_mark(fsn_mark);
0587 
0588     return ret;
0589 }
0590 
0591 static int inotify_new_watch(struct fsnotify_group *group,
0592                  struct inode *inode,
0593                  u32 arg)
0594 {
0595     struct inotify_inode_mark *tmp_i_mark;
0596     int ret;
0597     struct idr *idr = &group->inotify_data.idr;
0598     spinlock_t *idr_lock = &group->inotify_data.idr_lock;
0599 
0600     tmp_i_mark = kmem_cache_alloc(inotify_inode_mark_cachep, GFP_KERNEL);
0601     if (unlikely(!tmp_i_mark))
0602         return -ENOMEM;
0603 
0604     fsnotify_init_mark(&tmp_i_mark->fsn_mark, group);
0605     tmp_i_mark->fsn_mark.mask = inotify_arg_to_mask(inode, arg);
0606     tmp_i_mark->fsn_mark.flags = inotify_arg_to_flags(arg);
0607     tmp_i_mark->wd = -1;
0608 
0609     ret = inotify_add_to_idr(idr, idr_lock, tmp_i_mark);
0610     if (ret)
0611         goto out_err;
0612 
0613     /* increment the number of watches the user has */
0614     if (!inc_inotify_watches(group->inotify_data.ucounts)) {
0615         inotify_remove_from_idr(group, tmp_i_mark);
0616         ret = -ENOSPC;
0617         goto out_err;
0618     }
0619 
0620     /* we are on the idr, now get on the inode */
0621     ret = fsnotify_add_inode_mark_locked(&tmp_i_mark->fsn_mark, inode, 0);
0622     if (ret) {
0623         /* we failed to get on the inode, get off the idr */
0624         inotify_remove_from_idr(group, tmp_i_mark);
0625         goto out_err;
0626     }
0627 
0628 
0629     /* return the watch descriptor for this new mark */
0630     ret = tmp_i_mark->wd;
0631 
0632 out_err:
0633     /* match the ref from fsnotify_init_mark() */
0634     fsnotify_put_mark(&tmp_i_mark->fsn_mark);
0635 
0636     return ret;
0637 }
0638 
0639 static int inotify_update_watch(struct fsnotify_group *group, struct inode *inode, u32 arg)
0640 {
0641     int ret = 0;
0642 
0643     fsnotify_group_lock(group);
0644     /* try to update and existing watch with the new arg */
0645     ret = inotify_update_existing_watch(group, inode, arg);
0646     /* no mark present, try to add a new one */
0647     if (ret == -ENOENT)
0648         ret = inotify_new_watch(group, inode, arg);
0649     fsnotify_group_unlock(group);
0650 
0651     return ret;
0652 }
0653 
0654 static struct fsnotify_group *inotify_new_group(unsigned int max_events)
0655 {
0656     struct fsnotify_group *group;
0657     struct inotify_event_info *oevent;
0658 
0659     group = fsnotify_alloc_group(&inotify_fsnotify_ops,
0660                      FSNOTIFY_GROUP_USER);
0661     if (IS_ERR(group))
0662         return group;
0663 
0664     oevent = kmalloc(sizeof(struct inotify_event_info), GFP_KERNEL_ACCOUNT);
0665     if (unlikely(!oevent)) {
0666         fsnotify_destroy_group(group);
0667         return ERR_PTR(-ENOMEM);
0668     }
0669     group->overflow_event = &oevent->fse;
0670     fsnotify_init_event(group->overflow_event);
0671     oevent->mask = FS_Q_OVERFLOW;
0672     oevent->wd = -1;
0673     oevent->sync_cookie = 0;
0674     oevent->name_len = 0;
0675 
0676     group->max_events = max_events;
0677     group->memcg = get_mem_cgroup_from_mm(current->mm);
0678 
0679     spin_lock_init(&group->inotify_data.idr_lock);
0680     idr_init(&group->inotify_data.idr);
0681     group->inotify_data.ucounts = inc_ucount(current_user_ns(),
0682                          current_euid(),
0683                          UCOUNT_INOTIFY_INSTANCES);
0684 
0685     if (!group->inotify_data.ucounts) {
0686         fsnotify_destroy_group(group);
0687         return ERR_PTR(-EMFILE);
0688     }
0689 
0690     return group;
0691 }
0692 
0693 
0694 /* inotify syscalls */
0695 static int do_inotify_init(int flags)
0696 {
0697     struct fsnotify_group *group;
0698     int ret;
0699 
0700     /* Check the IN_* constants for consistency.  */
0701     BUILD_BUG_ON(IN_CLOEXEC != O_CLOEXEC);
0702     BUILD_BUG_ON(IN_NONBLOCK != O_NONBLOCK);
0703 
0704     if (flags & ~(IN_CLOEXEC | IN_NONBLOCK))
0705         return -EINVAL;
0706 
0707     /* fsnotify_obtain_group took a reference to group, we put this when we kill the file in the end */
0708     group = inotify_new_group(inotify_max_queued_events);
0709     if (IS_ERR(group))
0710         return PTR_ERR(group);
0711 
0712     ret = anon_inode_getfd("inotify", &inotify_fops, group,
0713                   O_RDONLY | flags);
0714     if (ret < 0)
0715         fsnotify_destroy_group(group);
0716 
0717     return ret;
0718 }
0719 
0720 SYSCALL_DEFINE1(inotify_init1, int, flags)
0721 {
0722     return do_inotify_init(flags);
0723 }
0724 
0725 SYSCALL_DEFINE0(inotify_init)
0726 {
0727     return do_inotify_init(0);
0728 }
0729 
0730 SYSCALL_DEFINE3(inotify_add_watch, int, fd, const char __user *, pathname,
0731         u32, mask)
0732 {
0733     struct fsnotify_group *group;
0734     struct inode *inode;
0735     struct path path;
0736     struct fd f;
0737     int ret;
0738     unsigned flags = 0;
0739 
0740     /*
0741      * We share a lot of code with fs/dnotify.  We also share
0742      * the bit layout between inotify's IN_* and the fsnotify
0743      * FS_*.  This check ensures that only the inotify IN_*
0744      * bits get passed in and set in watches/events.
0745      */
0746     if (unlikely(mask & ~ALL_INOTIFY_BITS))
0747         return -EINVAL;
0748     /*
0749      * Require at least one valid bit set in the mask.
0750      * Without _something_ set, we would have no events to
0751      * watch for.
0752      */
0753     if (unlikely(!(mask & ALL_INOTIFY_BITS)))
0754         return -EINVAL;
0755 
0756     f = fdget(fd);
0757     if (unlikely(!f.file))
0758         return -EBADF;
0759 
0760     /* IN_MASK_ADD and IN_MASK_CREATE don't make sense together */
0761     if (unlikely((mask & IN_MASK_ADD) && (mask & IN_MASK_CREATE))) {
0762         ret = -EINVAL;
0763         goto fput_and_out;
0764     }
0765 
0766     /* verify that this is indeed an inotify instance */
0767     if (unlikely(f.file->f_op != &inotify_fops)) {
0768         ret = -EINVAL;
0769         goto fput_and_out;
0770     }
0771 
0772     if (!(mask & IN_DONT_FOLLOW))
0773         flags |= LOOKUP_FOLLOW;
0774     if (mask & IN_ONLYDIR)
0775         flags |= LOOKUP_DIRECTORY;
0776 
0777     ret = inotify_find_inode(pathname, &path, flags,
0778             (mask & IN_ALL_EVENTS));
0779     if (ret)
0780         goto fput_and_out;
0781 
0782     /* inode held in place by reference to path; group by fget on fd */
0783     inode = path.dentry->d_inode;
0784     group = f.file->private_data;
0785 
0786     /* create/update an inode mark */
0787     ret = inotify_update_watch(group, inode, mask);
0788     path_put(&path);
0789 fput_and_out:
0790     fdput(f);
0791     return ret;
0792 }
0793 
0794 SYSCALL_DEFINE2(inotify_rm_watch, int, fd, __s32, wd)
0795 {
0796     struct fsnotify_group *group;
0797     struct inotify_inode_mark *i_mark;
0798     struct fd f;
0799     int ret = -EINVAL;
0800 
0801     f = fdget(fd);
0802     if (unlikely(!f.file))
0803         return -EBADF;
0804 
0805     /* verify that this is indeed an inotify instance */
0806     if (unlikely(f.file->f_op != &inotify_fops))
0807         goto out;
0808 
0809     group = f.file->private_data;
0810 
0811     i_mark = inotify_idr_find(group, wd);
0812     if (unlikely(!i_mark))
0813         goto out;
0814 
0815     ret = 0;
0816 
0817     fsnotify_destroy_mark(&i_mark->fsn_mark, group);
0818 
0819     /* match ref taken by inotify_idr_find */
0820     fsnotify_put_mark(&i_mark->fsn_mark);
0821 
0822 out:
0823     fdput(f);
0824     return ret;
0825 }
0826 
0827 /*
0828  * inotify_user_setup - Our initialization function.  Note that we cannot return
0829  * error because we have compiled-in VFS hooks.  So an (unlikely) failure here
0830  * must result in panic().
0831  */
0832 static int __init inotify_user_setup(void)
0833 {
0834     unsigned long watches_max;
0835     struct sysinfo si;
0836 
0837     si_meminfo(&si);
0838     /*
0839      * Allow up to 1% of addressable memory to be allocated for inotify
0840      * watches (per user) limited to the range [8192, 1048576].
0841      */
0842     watches_max = (((si.totalram - si.totalhigh) / 100) << PAGE_SHIFT) /
0843             INOTIFY_WATCH_COST;
0844     watches_max = clamp(watches_max, 8192UL, 1048576UL);
0845 
0846     BUILD_BUG_ON(IN_ACCESS != FS_ACCESS);
0847     BUILD_BUG_ON(IN_MODIFY != FS_MODIFY);
0848     BUILD_BUG_ON(IN_ATTRIB != FS_ATTRIB);
0849     BUILD_BUG_ON(IN_CLOSE_WRITE != FS_CLOSE_WRITE);
0850     BUILD_BUG_ON(IN_CLOSE_NOWRITE != FS_CLOSE_NOWRITE);
0851     BUILD_BUG_ON(IN_OPEN != FS_OPEN);
0852     BUILD_BUG_ON(IN_MOVED_FROM != FS_MOVED_FROM);
0853     BUILD_BUG_ON(IN_MOVED_TO != FS_MOVED_TO);
0854     BUILD_BUG_ON(IN_CREATE != FS_CREATE);
0855     BUILD_BUG_ON(IN_DELETE != FS_DELETE);
0856     BUILD_BUG_ON(IN_DELETE_SELF != FS_DELETE_SELF);
0857     BUILD_BUG_ON(IN_MOVE_SELF != FS_MOVE_SELF);
0858     BUILD_BUG_ON(IN_UNMOUNT != FS_UNMOUNT);
0859     BUILD_BUG_ON(IN_Q_OVERFLOW != FS_Q_OVERFLOW);
0860     BUILD_BUG_ON(IN_IGNORED != FS_IN_IGNORED);
0861     BUILD_BUG_ON(IN_ISDIR != FS_ISDIR);
0862 
0863     BUILD_BUG_ON(HWEIGHT32(ALL_INOTIFY_BITS) != 22);
0864 
0865     inotify_inode_mark_cachep = KMEM_CACHE(inotify_inode_mark,
0866                            SLAB_PANIC|SLAB_ACCOUNT);
0867 
0868     inotify_max_queued_events = 16384;
0869     init_user_ns.ucount_max[UCOUNT_INOTIFY_INSTANCES] = 128;
0870     init_user_ns.ucount_max[UCOUNT_INOTIFY_WATCHES] = watches_max;
0871     inotify_sysctls_init();
0872 
0873     return 0;
0874 }
0875 fs_initcall(inotify_user_setup);