HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
[linux/fpc-iii.git] / fs / signalfd.c
blob270221fcef42cc42fcfdbc098b587b571be65a12
1 /*
2 * fs/signalfd.c
4 * Copyright (C) 2003 Linus Torvalds
6 * Mon Mar 5, 2007: Davide Libenzi <davidel@xmailserver.org>
7 * Changed ->read() to return a siginfo strcture instead of signal number.
8 * Fixed locking in ->poll().
9 * Added sighand-detach notification.
10 * Added fd re-use in sys_signalfd() syscall.
11 * Now using anonymous inode source.
12 * Thanks to Oleg Nesterov for useful code review and suggestions.
13 * More comments and suggestions from Arnd Bergmann.
14 * Sat May 19, 2007: Davi E. M. Arnaut <davi@haxent.com.br>
15 * Retrieve multiple signals with one read() call
16 * Sun Jul 15, 2007: Davide Libenzi <davidel@xmailserver.org>
17 * Attach to the sighand only during read() and poll().
20 #include <linux/file.h>
21 #include <linux/poll.h>
22 #include <linux/init.h>
23 #include <linux/fs.h>
24 #include <linux/sched.h>
25 #include <linux/slab.h>
26 #include <linux/kernel.h>
27 #include <linux/signal.h>
28 #include <linux/list.h>
29 #include <linux/anon_inodes.h>
30 #include <linux/signalfd.h>
31 #include <linux/syscalls.h>
32 #include <linux/proc_fs.h>
33 #include <linux/compat.h>
35 void signalfd_cleanup(struct sighand_struct *sighand)
37 wait_queue_head_t *wqh = &sighand->signalfd_wqh;
39 * The lockless check can race with remove_wait_queue() in progress,
40 * but in this case its caller should run under rcu_read_lock() and
41 * sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return.
43 if (likely(!waitqueue_active(wqh)))
44 return;
46 /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */
47 wake_up_poll(wqh, POLLHUP | POLLFREE);
50 struct signalfd_ctx {
51 sigset_t sigmask;
54 static int signalfd_release(struct inode *inode, struct file *file)
56 kfree(file->private_data);
57 return 0;
60 static unsigned int signalfd_poll(struct file *file, poll_table *wait)
62 struct signalfd_ctx *ctx = file->private_data;
63 unsigned int events = 0;
65 poll_wait(file, &current->sighand->signalfd_wqh, wait);
67 spin_lock_irq(&current->sighand->siglock);
68 if (next_signal(&current->pending, &ctx->sigmask) ||
69 next_signal(&current->signal->shared_pending,
70 &ctx->sigmask))
71 events |= POLLIN;
72 spin_unlock_irq(&current->sighand->siglock);
74 return events;
78 * Copied from copy_siginfo_to_user() in kernel/signal.c
80 static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo,
81 siginfo_t const *kinfo)
83 long err;
85 BUILD_BUG_ON(sizeof(struct signalfd_siginfo) != 128);
88 * Unused members should be zero ...
90 err = __clear_user(uinfo, sizeof(*uinfo));
93 * If you change siginfo_t structure, please be sure
94 * this code is fixed accordingly.
96 err |= __put_user(kinfo->si_signo, &uinfo->ssi_signo);
97 err |= __put_user(kinfo->si_errno, &uinfo->ssi_errno);
98 err |= __put_user((short) kinfo->si_code, &uinfo->ssi_code);
99 switch (kinfo->si_code & __SI_MASK) {
100 case __SI_KILL:
101 err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
102 err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
103 break;
104 case __SI_TIMER:
105 err |= __put_user(kinfo->si_tid, &uinfo->ssi_tid);
106 err |= __put_user(kinfo->si_overrun, &uinfo->ssi_overrun);
107 err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
108 err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
109 break;
110 case __SI_POLL:
111 err |= __put_user(kinfo->si_band, &uinfo->ssi_band);
112 err |= __put_user(kinfo->si_fd, &uinfo->ssi_fd);
113 break;
114 case __SI_FAULT:
115 err |= __put_user((long) kinfo->si_addr, &uinfo->ssi_addr);
116 #ifdef __ARCH_SI_TRAPNO
117 err |= __put_user(kinfo->si_trapno, &uinfo->ssi_trapno);
118 #endif
119 #ifdef BUS_MCEERR_AO
121 * Other callers might not initialize the si_lsb field,
122 * so check explicitly for the right codes here.
124 if (kinfo->si_signo == SIGBUS &&
125 (kinfo->si_code == BUS_MCEERR_AR ||
126 kinfo->si_code == BUS_MCEERR_AO))
127 err |= __put_user((short) kinfo->si_addr_lsb,
128 &uinfo->ssi_addr_lsb);
129 #endif
130 break;
131 case __SI_CHLD:
132 err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
133 err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
134 err |= __put_user(kinfo->si_status, &uinfo->ssi_status);
135 err |= __put_user(kinfo->si_utime, &uinfo->ssi_utime);
136 err |= __put_user(kinfo->si_stime, &uinfo->ssi_stime);
137 break;
138 case __SI_RT: /* This is not generated by the kernel as of now. */
139 case __SI_MESGQ: /* But this is */
140 err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
141 err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
142 err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
143 err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
144 break;
145 default:
147 * This case catches also the signals queued by sigqueue().
149 err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
150 err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
151 err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
152 err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
153 break;
156 return err ? -EFAULT: sizeof(*uinfo);
159 static ssize_t signalfd_dequeue(struct signalfd_ctx *ctx, siginfo_t *info,
160 int nonblock)
162 ssize_t ret;
163 DECLARE_WAITQUEUE(wait, current);
165 spin_lock_irq(&current->sighand->siglock);
166 ret = dequeue_signal(current, &ctx->sigmask, info);
167 switch (ret) {
168 case 0:
169 if (!nonblock)
170 break;
171 ret = -EAGAIN;
172 default:
173 spin_unlock_irq(&current->sighand->siglock);
174 return ret;
177 add_wait_queue(&current->sighand->signalfd_wqh, &wait);
178 for (;;) {
179 set_current_state(TASK_INTERRUPTIBLE);
180 ret = dequeue_signal(current, &ctx->sigmask, info);
181 if (ret != 0)
182 break;
183 if (signal_pending(current)) {
184 ret = -ERESTARTSYS;
185 break;
187 spin_unlock_irq(&current->sighand->siglock);
188 schedule();
189 spin_lock_irq(&current->sighand->siglock);
191 spin_unlock_irq(&current->sighand->siglock);
193 remove_wait_queue(&current->sighand->signalfd_wqh, &wait);
194 __set_current_state(TASK_RUNNING);
196 return ret;
200 * Returns a multiple of the size of a "struct signalfd_siginfo", or a negative
201 * error code. The "count" parameter must be at least the size of a
202 * "struct signalfd_siginfo".
204 static ssize_t signalfd_read(struct file *file, char __user *buf, size_t count,
205 loff_t *ppos)
207 struct signalfd_ctx *ctx = file->private_data;
208 struct signalfd_siginfo __user *siginfo;
209 int nonblock = file->f_flags & O_NONBLOCK;
210 ssize_t ret, total = 0;
211 siginfo_t info;
213 count /= sizeof(struct signalfd_siginfo);
214 if (!count)
215 return -EINVAL;
217 siginfo = (struct signalfd_siginfo __user *) buf;
218 do {
219 ret = signalfd_dequeue(ctx, &info, nonblock);
220 if (unlikely(ret <= 0))
221 break;
222 ret = signalfd_copyinfo(siginfo, &info);
223 if (ret < 0)
224 break;
225 siginfo++;
226 total += ret;
227 nonblock = 1;
228 } while (--count);
230 return total ? total: ret;
233 #ifdef CONFIG_PROC_FS
234 static void signalfd_show_fdinfo(struct seq_file *m, struct file *f)
236 struct signalfd_ctx *ctx = f->private_data;
237 sigset_t sigmask;
239 sigmask = ctx->sigmask;
240 signotset(&sigmask);
241 render_sigset_t(m, "sigmask:\t", &sigmask);
243 #endif
245 static const struct file_operations signalfd_fops = {
246 #ifdef CONFIG_PROC_FS
247 .show_fdinfo = signalfd_show_fdinfo,
248 #endif
249 .release = signalfd_release,
250 .poll = signalfd_poll,
251 .read = signalfd_read,
252 .llseek = noop_llseek,
255 SYSCALL_DEFINE4(signalfd4, int, ufd, sigset_t __user *, user_mask,
256 size_t, sizemask, int, flags)
258 sigset_t sigmask;
259 struct signalfd_ctx *ctx;
261 /* Check the SFD_* constants for consistency. */
262 BUILD_BUG_ON(SFD_CLOEXEC != O_CLOEXEC);
263 BUILD_BUG_ON(SFD_NONBLOCK != O_NONBLOCK);
265 if (flags & ~(SFD_CLOEXEC | SFD_NONBLOCK))
266 return -EINVAL;
268 if (sizemask != sizeof(sigset_t) ||
269 copy_from_user(&sigmask, user_mask, sizeof(sigmask)))
270 return -EINVAL;
271 sigdelsetmask(&sigmask, sigmask(SIGKILL) | sigmask(SIGSTOP));
272 signotset(&sigmask);
274 if (ufd == -1) {
275 ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
276 if (!ctx)
277 return -ENOMEM;
279 ctx->sigmask = sigmask;
282 * When we call this, the initialization must be complete, since
283 * anon_inode_getfd() will install the fd.
285 ufd = anon_inode_getfd("[signalfd]", &signalfd_fops, ctx,
286 O_RDWR | (flags & (O_CLOEXEC | O_NONBLOCK)));
287 if (ufd < 0)
288 kfree(ctx);
289 } else {
290 struct fd f = fdget(ufd);
291 if (!f.file)
292 return -EBADF;
293 ctx = f.file->private_data;
294 if (f.file->f_op != &signalfd_fops) {
295 fdput(f);
296 return -EINVAL;
298 spin_lock_irq(&current->sighand->siglock);
299 ctx->sigmask = sigmask;
300 spin_unlock_irq(&current->sighand->siglock);
302 wake_up(&current->sighand->signalfd_wqh);
303 fdput(f);
306 return ufd;
309 SYSCALL_DEFINE3(signalfd, int, ufd, sigset_t __user *, user_mask,
310 size_t, sizemask)
312 return sys_signalfd4(ufd, user_mask, sizemask, 0);
315 #ifdef CONFIG_COMPAT
316 COMPAT_SYSCALL_DEFINE4(signalfd4, int, ufd,
317 const compat_sigset_t __user *,sigmask,
318 compat_size_t, sigsetsize,
319 int, flags)
321 compat_sigset_t ss32;
322 sigset_t tmp;
323 sigset_t __user *ksigmask;
325 if (sigsetsize != sizeof(compat_sigset_t))
326 return -EINVAL;
327 if (copy_from_user(&ss32, sigmask, sizeof(ss32)))
328 return -EFAULT;
329 sigset_from_compat(&tmp, &ss32);
330 ksigmask = compat_alloc_user_space(sizeof(sigset_t));
331 if (copy_to_user(ksigmask, &tmp, sizeof(sigset_t)))
332 return -EFAULT;
334 return sys_signalfd4(ufd, ksigmask, sizeof(sigset_t), flags);
337 COMPAT_SYSCALL_DEFINE3(signalfd, int, ufd,
338 const compat_sigset_t __user *,sigmask,
339 compat_size_t, sigsetsize)
341 return compat_sys_signalfd4(ufd, sigmask, sigsetsize, 0);
343 #endif