locks: add new fcntl cmd values for handling file private locks

Due to some unfortunate history, POSIX locks have very strange and
unhelpful semantics. The thing that usually catches people by surprise
is that they are dropped whenever the process closes any file descriptor
associated with the inode.

This is extremely problematic for people developing file servers that
need to implement byte-range locks. Developers often need a "lock
management" facility to ensure that file descriptors are not closed
until all of the locks associated with the inode are finished.

Additionally, "classic" POSIX locks are owned by the process. Locks
taken between threads within the same process won't conflict with one
another, which renders them useless for synchronization between threads.

This patchset adds a new type of lock that attempts to address these
issues. These locks conflict with classic POSIX read/write locks, but
have semantics that are more like BSD locks with respect to inheritance
and behavior on close.

This is implemented primarily by changing how fl_owner field is set for
these locks. Instead of having them owned by the files_struct of the
process, they are instead owned by the filp on which they were acquired.
Thus, they are inherited across fork() and are only released when the
last reference to a filp is put.

These new semantics prevent them from being merged with classic POSIX
locks, even if they are acquired by the same process. These locks will
also conflict with classic POSIX locks even if they are acquired by
the same process or on the same file descriptor.

The new locks are managed using a new set of cmd values to the fcntl()
syscall. The initial implementation of this converts these values to
"classic" cmd values at a fairly high level, and the details are not
exposed to the underlying filesystem. We may eventually want to push
this handing out to the lower filesystem code but for now I don't
see any need for it.

Also, note that with this implementation the new cmd values are only
available via fcntl64() on 32-bit arches. There's little need to
add support for legacy apps on a new interface like this.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Change-Id: I35691bdfed9cadcbbcb6ff6804d9eea1db661ddc
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>

diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index 87c010557b1d45fbf42d638333636f3fa24a48ea..7a41528bdb09c9748dabc302821e1c6191a4c86c 100644 (file)
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -232,6 +232,9 @@ asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd,
                                 unsigned long arg)
 {
        switch (cmd) {
+       case F_GETLKP:
+       case F_SETLKP:
+       case F_SETLKPW:
        case F_GETLK64:
        case F_SETLK64:
        case F_SETLKW64:

diff --git a/fs/compat.c b/fs/compat.c
index 6af20de2c1a3c29d5cc7c251d8fb3fa2182de445..f340dcf11f689cb45db686547974833c347d4f86 100644 (file)
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -399,12 +399,28 @@ static int put_compat_flock64(struct flock *kfl, struct compat_flock64 __user *u
 }
 #endif
 
+static unsigned int
+convert_fcntl_cmd(unsigned int cmd)
+{
+       switch (cmd) {
+       case F_GETLK64:
+               return F_GETLK;
+       case F_SETLK64:
+               return F_SETLK;
+       case F_SETLKW64:
+               return F_SETLKW;
+       }
+
+       return cmd;
+}
+
 asmlinkage long compat_sys_fcntl64(unsigned int fd, unsigned int cmd,
                unsigned long arg)
 {
        mm_segment_t old_fs;
        struct flock f;
        long ret;
+       unsigned int conv_cmd;
 
        switch (cmd) {
        case F_GETLK:
@@ -441,16 +457,18 @@ asmlinkage long compat_sys_fcntl64(unsigned int fd, unsigned int cmd,
        case F_GETLK64:
        case F_SETLK64:
        case F_SETLKW64:
+       case F_GETLKP:
+       case F_SETLKP:
+       case F_SETLKPW:
                ret = get_compat_flock64(&f, compat_ptr(arg));
                if (ret != 0)
                        break;
                old_fs = get_fs();
                set_fs(KERNEL_DS);
-               ret = sys_fcntl(fd, (cmd == F_GETLK64) ? F_GETLK :
-                               ((cmd == F_SETLK64) ? F_SETLK : F_SETLKW),
-                               (unsigned long)&f);
+               conv_cmd = convert_fcntl_cmd(cmd);
+               ret = sys_fcntl(fd, conv_cmd, (unsigned long)&f);
                set_fs(old_fs);
-               if (cmd == F_GETLK64 && ret == 0) {
+               if ((conv_cmd == F_GETLK || conv_cmd == F_GETLKP) && ret == 0) {
                        /* need to return lock information - see above for commentary */
                        if (f.l_start > COMPAT_LOFF_T_MAX)
                                ret = -EOVERFLOW;
@@ -471,8 +489,15 @@ asmlinkage long compat_sys_fcntl64(unsigned int fd, unsigned int cmd,
 asmlinkage long compat_sys_fcntl(unsigned int fd, unsigned int cmd,
                unsigned long arg)
 {
-       if ((cmd == F_GETLK64) || (cmd == F_SETLK64) || (cmd == F_SETLKW64))
+       switch (cmd) {
+       case F_GETLK64:
+       case F_SETLK64:
+       case F_SETLKW64:
+       case F_GETLKP:
+       case F_SETLKP:
+       case F_SETLKPW:
                return -EINVAL;
+       }
        return compat_sys_fcntl64(fd, cmd, arg);
 }
 

diff --git a/fs/fcntl.c b/fs/fcntl.c
index d67ee2c7de68b8510ae78475fb72183bd62f2109..3476c43e12dceda15e6a4fcb53394d4e4926b191 100644 (file)
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -274,9 +274,19 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
        case F_SETFL:
                err = setfl(fd, filp, arg);
                break;
+#if BITS_PER_LONG != 32
+       /* 32-bit arches must use fcntl64() */
+       case F_GETLKP:
+#endif
        case F_GETLK:
                err = fcntl_getlk(filp, cmd, (struct flock __user *) arg);
                break;
+#if BITS_PER_LONG != 32
+       /* 32-bit arches must use fcntl64() */
+       case F_SETLKP:
+       case F_SETLKPW:
+#endif
+               /* Fallthrough */
        case F_SETLK:
        case F_SETLKW:
                err = fcntl_setlk(fd, filp, cmd, (struct flock __user *) arg);
@@ -394,17 +404,20 @@ SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
                goto out1;
        
        switch (cmd) {
-               case F_GETLK64:
-                       err = fcntl_getlk64(f.file, cmd, (struct flock64 __user *) arg);
-                       break;
-               case F_SETLK64:
-               case F_SETLKW64:
-                       err = fcntl_setlk64(fd, f.file, cmd,
-                                       (struct flock64 __user *) arg);
-                       break;
-               default:
-                       err = do_fcntl(fd, cmd, arg, f.file);
-                       break;
+       case F_GETLK64:
+       case F_GETLKP:
+               err = fcntl_getlk64(f.file, cmd, (struct flock64 __user *) arg);
+               break;
+       case F_SETLK64:
+       case F_SETLKW64:
+       case F_SETLKP:
+       case F_SETLKPW:
+               err = fcntl_setlk64(fd, f.file, cmd,
+                               (struct flock64 __user *) arg);
+               break;
+       default:
+               err = do_fcntl(fd, cmd, arg, f.file);
+               break;
        }
 out1:
        fdput(f);

diff --git a/fs/locks.c b/fs/locks.c
index ffb7a049a663c57345c56872856dd5eea8c8620b..d74772ddea0cfc13c8a86d4be0e12c2d50b087a0 100644 (file)
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1738,6 +1738,12 @@ int fcntl_getlk(struct file *filp, unsigned int cmd, struct flock __user *l)
        if (error)
                goto out;
 
+       if (cmd == F_GETLKP) {
+               cmd = F_GETLK;
+               file_lock.fl_flags |= FL_FILE_PVT;
+               file_lock.fl_owner = (fl_owner_t)filp;
+       }
+
        error = vfs_test_lock(filp, &file_lock);
        if (error)
                goto out;
@@ -1856,10 +1862,26 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
        error = flock_to_posix_lock(filp, file_lock, &flock);
        if (error)
                goto out;
-       if (cmd == F_SETLKW) {
+
+       /*
+        * If the cmd is requesting file-private locks, then set the
+        * FL_FILE_PVT flag and override the owner.
+        */
+       switch (cmd) {
+       case F_SETLKP:
+               cmd = F_SETLK;
+               file_lock->fl_flags |= FL_FILE_PVT;
+               file_lock->fl_owner = (fl_owner_t)filp;
+               break;
+       case F_SETLKPW:
+               cmd = F_SETLKW;
+               file_lock->fl_flags |= FL_FILE_PVT;
+               file_lock->fl_owner = (fl_owner_t)filp;
+               /* Fallthrough */
+       case F_SETLKW:
                file_lock->fl_flags |= FL_SLEEP;
        }
-       
+
        error = -EBADF;
        switch (flock.l_type) {
        case F_RDLCK:
@@ -1925,6 +1947,12 @@ int fcntl_getlk64(struct file *filp, unsigned int cmd, struct flock64 __user *l)
        if (error)
                goto out;
 
+       if (cmd == F_GETLKP) {
+               cmd = F_GETLK64;
+               file_lock.fl_flags |= FL_FILE_PVT;
+               file_lock.fl_owner = (fl_owner_t)filp;
+       }
+
        error = vfs_test_lock(filp, &file_lock);
        if (error)
                goto out;
@@ -1976,10 +2004,26 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
        error = flock64_to_posix_lock(filp, file_lock, &flock);
        if (error)
                goto out;
-       if (cmd == F_SETLKW64) {
+
+       /*
+        * If the cmd is requesting file-private locks, then set the
+        * FL_FILE_PVT flag and override the owner.
+        */
+       switch (cmd) {
+       case F_SETLKP:
+               cmd = F_SETLK64;
+               file_lock->fl_flags |= FL_FILE_PVT;
+               file_lock->fl_owner = (fl_owner_t)filp;
+               break;
+       case F_SETLKPW:
+               cmd = F_SETLKW64;
+               file_lock->fl_flags |= FL_FILE_PVT;
+               file_lock->fl_owner = (fl_owner_t)filp;
+               /* Fallthrough */
+       case F_SETLKW64:
                file_lock->fl_flags |= FL_SLEEP;
        }
-       
+
        error = -EBADF;
        switch (flock.l_type) {
        case F_RDLCK:
@@ -2072,6 +2116,8 @@ void locks_remove_file(struct file *filp)
        if (!inode->i_flock)
                return;
 
+       locks_remove_posix(filp, (fl_owner_t)filp);
+
        if (filp->f_op && filp->f_op->flock) {
                struct file_lock fl = {
                        .fl_pid = current->tgid,

diff --git a/include/uapi/asm-generic/fcntl.h b/include/uapi/asm-generic/fcntl.h
index 95e46c8e05f90db319b2828eb53aa93bdca0629d..bd4c16f2d180bc8258a6a63aa365d38aa1a4698f 100644 (file)
--- a/include/uapi/asm-generic/fcntl.h
+++ b/include/uapi/asm-generic/fcntl.h
@@ -132,6 +132,22 @@
 #define F_GETOWNER_UIDS        17
 #endif
 
+/*
+ * fd "private" POSIX locks.
+ *
+ * Usually POSIX locks held by a process are released on *any* close and are
+ * not inherited across a fork().
+ *
+ * These cmd values will set locks that conflict with normal POSIX locks, but
+ * are "owned" by the opened file, not the process. This means that they are
+ * inherited across fork() like BSD (flock) locks, and they are only released
+ * automatically when the last reference to the the open file against which
+ * they were acquired is put.
+ */
+#define F_GETLKP       36
+#define F_SETLKP       37
+#define F_SETLKPW      38
+
 #define F_OWNER_TID    0
 #define F_OWNER_PID    1
 #define F_OWNER_PGRP   2

diff --git a/security/selinux_n/hooks.c b/security/selinux_n/hooks.c
index dc4a3c539fc4356635628b298907227781bfdf23..06b3b39738ed02cba9529c99d0ff30c575111093 100644 (file)
--- a/security/selinux_n/hooks.c
+++ b/security/selinux_n/hooks.c
@@ -3702,6 +3702,9 @@ static int selinux_file_fcntl(struct file *file, unsigned int cmd,
        case F_GETLK:
        case F_SETLK:
        case F_SETLKW:
+       case F_GETLKP:
+       case F_SETLKP:
+       case F_SETLKPW:
 #if BITS_PER_LONG == 32
        case F_GETLK64:
        case F_SETLK64: