1 // SPDX-License-Identifier: GPL-2.0-only
2 #include <linux/slab.h>
3 #include <linux/stat.h>
4 #include <linux/sched/xacct.h>
5 #include <linux/fcntl.h>
6 #include <linux/file.h>
7 #include <linux/uio.h>
8 #include <linux/fsnotify.h>
9 #include <linux/security.h>
10 #include <linux/export.h>
11 #include <linux/syscalls.h>
12 #include <linux/pagemap.h>
13 #include <linux/splice.h>
14 #include <linux/compat.h>
15 #include <linux/mount.h>
16 #include <linux/fs.h>
17 #include <linux/dax.h>
18 #include "internal.h"
19 
20 #include <linux/uaccess.h>
21 #include <asm/unistd.h>
22 
23 /*
24  * Performs necessary checks before doing a clone.
25  *
26  * Can adjust amount of bytes to clone via @req_count argument.
27  * Returns appropriate error code that caller should return or
28  * zero in case the clone should be allowed.
29  */
generic_remap_checks(struct file * file_in,loff_t pos_in,struct file * file_out,loff_t pos_out,loff_t * req_count,unsigned int remap_flags)30 static int generic_remap_checks(struct file *file_in, loff_t pos_in,
31 				struct file *file_out, loff_t pos_out,
32 				loff_t *req_count, unsigned int remap_flags)
33 {
34 	struct inode *inode_in = file_in->f_mapping->host;
35 	struct inode *inode_out = file_out->f_mapping->host;
36 	uint64_t count = *req_count;
37 	uint64_t bcount;
38 	loff_t size_in, size_out;
39 	loff_t bs = inode_out->i_sb->s_blocksize;
40 	int ret;
41 
42 	/* The start of both ranges must be aligned to an fs block. */
43 	if (!IS_ALIGNED(pos_in, bs) || !IS_ALIGNED(pos_out, bs))
44 		return -EINVAL;
45 
46 	/* Ensure offsets don't wrap. */
47 	if (pos_in + count < pos_in || pos_out + count < pos_out)
48 		return -EINVAL;
49 
50 	size_in = i_size_read(inode_in);
51 	size_out = i_size_read(inode_out);
52 
53 	/* Dedupe requires both ranges to be within EOF. */
54 	if ((remap_flags & REMAP_FILE_DEDUP) &&
55 	    (pos_in >= size_in || pos_in + count > size_in ||
56 	     pos_out >= size_out || pos_out + count > size_out))
57 		return -EINVAL;
58 
59 	/* Ensure the infile range is within the infile. */
60 	if (pos_in >= size_in)
61 		return -EINVAL;
62 	count = min(count, size_in - (uint64_t)pos_in);
63 
64 	ret = generic_write_check_limits(file_out, pos_out, &count);
65 	if (ret)
66 		return ret;
67 
68 	/*
69 	 * If the user wanted us to link to the infile's EOF, round up to the
70 	 * next block boundary for this check.
71 	 *
72 	 * Otherwise, make sure the count is also block-aligned, having
73 	 * already confirmed the starting offsets' block alignment.
74 	 */
75 	if (pos_in + count == size_in &&
76 	    (!(remap_flags & REMAP_FILE_DEDUP) || pos_out + count == size_out)) {
77 		bcount = ALIGN(size_in, bs) - pos_in;
78 	} else {
79 		if (!IS_ALIGNED(count, bs))
80 			count = ALIGN_DOWN(count, bs);
81 		bcount = count;
82 	}
83 
84 	/* Don't allow overlapped cloning within the same file. */
85 	if (inode_in == inode_out &&
86 	    pos_out + bcount > pos_in &&
87 	    pos_out < pos_in + bcount)
88 		return -EINVAL;
89 
90 	/*
91 	 * We shortened the request but the caller can't deal with that, so
92 	 * bounce the request back to userspace.
93 	 */
94 	if (*req_count != count && !(remap_flags & REMAP_FILE_CAN_SHORTEN))
95 		return -EINVAL;
96 
97 	*req_count = count;
98 	return 0;
99 }
100 
remap_verify_area(struct file * file,loff_t pos,loff_t len,bool write)101 static int remap_verify_area(struct file *file, loff_t pos, loff_t len,
102 			     bool write)
103 {
104 	if (unlikely(pos < 0 || len < 0))
105 		return -EINVAL;
106 
107 	if (unlikely((loff_t) (pos + len) < 0))
108 		return -EINVAL;
109 
110 	return security_file_permission(file, write ? MAY_WRITE : MAY_READ);
111 }
112 
113 /*
114  * Ensure that we don't remap a partial EOF block in the middle of something
115  * else.  Assume that the offsets have already been checked for block
116  * alignment.
117  *
118  * For clone we only link a partial EOF block above or at the destination file's
119  * EOF.  For deduplication we accept a partial EOF block only if it ends at the
120  * destination file's EOF (can not link it into the middle of a file).
121  *
122  * Shorten the request if possible.
123  */
generic_remap_check_len(struct inode * inode_in,struct inode * inode_out,loff_t pos_out,loff_t * len,unsigned int remap_flags)124 static int generic_remap_check_len(struct inode *inode_in,
125 				   struct inode *inode_out,
126 				   loff_t pos_out,
127 				   loff_t *len,
128 				   unsigned int remap_flags)
129 {
130 	u64 blkmask = i_blocksize(inode_in) - 1;
131 	loff_t new_len = *len;
132 
133 	if ((*len & blkmask) == 0)
134 		return 0;
135 
136 	if (pos_out + *len < i_size_read(inode_out))
137 		new_len &= ~blkmask;
138 
139 	if (new_len == *len)
140 		return 0;
141 
142 	if (remap_flags & REMAP_FILE_CAN_SHORTEN) {
143 		*len = new_len;
144 		return 0;
145 	}
146 
147 	return (remap_flags & REMAP_FILE_DEDUP) ? -EBADE : -EINVAL;
148 }
149 
150 /* Read a page's worth of file data into the page cache. */
vfs_dedupe_get_folio(struct file * file,loff_t pos)151 static struct folio *vfs_dedupe_get_folio(struct file *file, loff_t pos)
152 {
153 	return read_mapping_folio(file->f_mapping, pos >> PAGE_SHIFT, file);
154 }
155 
156 /*
157  * Lock two folios, ensuring that we lock in offset order if the folios
158  * are from the same file.
159  */
vfs_lock_two_folios(struct folio * folio1,struct folio * folio2)160 static void vfs_lock_two_folios(struct folio *folio1, struct folio *folio2)
161 {
162 	/* Always lock in order of increasing index. */
163 	if (folio1->index > folio2->index)
164 		swap(folio1, folio2);
165 
166 	folio_lock(folio1);
167 	if (folio1 != folio2)
168 		folio_lock(folio2);
169 }
170 
171 /* Unlock two folios, being careful not to unlock the same folio twice. */
vfs_unlock_two_folios(struct folio * folio1,struct folio * folio2)172 static void vfs_unlock_two_folios(struct folio *folio1, struct folio *folio2)
173 {
174 	folio_unlock(folio1);
175 	if (folio1 != folio2)
176 		folio_unlock(folio2);
177 }
178 
179 /*
180  * Compare extents of two files to see if they are the same.
181  * Caller must have locked both inodes to prevent write races.
182  */
vfs_dedupe_file_range_compare(struct file * src,loff_t srcoff,struct file * dest,loff_t dstoff,loff_t len,bool * is_same)183 static int vfs_dedupe_file_range_compare(struct file *src, loff_t srcoff,
184 					 struct file *dest, loff_t dstoff,
185 					 loff_t len, bool *is_same)
186 {
187 	bool same = true;
188 	int error = -EINVAL;
189 
190 	while (len) {
191 		struct folio *src_folio, *dst_folio;
192 		void *src_addr, *dst_addr;
193 		loff_t cmp_len = min(PAGE_SIZE - offset_in_page(srcoff),
194 				     PAGE_SIZE - offset_in_page(dstoff));
195 
196 		cmp_len = min(cmp_len, len);
197 		if (cmp_len <= 0)
198 			goto out_error;
199 
200 		src_folio = vfs_dedupe_get_folio(src, srcoff);
201 		if (IS_ERR(src_folio)) {
202 			error = PTR_ERR(src_folio);
203 			goto out_error;
204 		}
205 		dst_folio = vfs_dedupe_get_folio(dest, dstoff);
206 		if (IS_ERR(dst_folio)) {
207 			error = PTR_ERR(dst_folio);
208 			folio_put(src_folio);
209 			goto out_error;
210 		}
211 
212 		vfs_lock_two_folios(src_folio, dst_folio);
213 
214 		/*
215 		 * Now that we've locked both folios, make sure they're still
216 		 * mapped to the file data we're interested in.  If not,
217 		 * someone is invalidating pages on us and we lose.
218 		 */
219 		if (!folio_test_uptodate(src_folio) || !folio_test_uptodate(dst_folio) ||
220 		    src_folio->mapping != src->f_mapping ||
221 		    dst_folio->mapping != dest->f_mapping) {
222 			same = false;
223 			goto unlock;
224 		}
225 
226 		src_addr = kmap_local_folio(src_folio,
227 					offset_in_folio(src_folio, srcoff));
228 		dst_addr = kmap_local_folio(dst_folio,
229 					offset_in_folio(dst_folio, dstoff));
230 
231 		flush_dcache_folio(src_folio);
232 		flush_dcache_folio(dst_folio);
233 
234 		if (memcmp(src_addr, dst_addr, cmp_len))
235 			same = false;
236 
237 		kunmap_local(dst_addr);
238 		kunmap_local(src_addr);
239 unlock:
240 		vfs_unlock_two_folios(src_folio, dst_folio);
241 		folio_put(dst_folio);
242 		folio_put(src_folio);
243 
244 		if (!same)
245 			break;
246 
247 		srcoff += cmp_len;
248 		dstoff += cmp_len;
249 		len -= cmp_len;
250 	}
251 
252 	*is_same = same;
253 	return 0;
254 
255 out_error:
256 	return error;
257 }
258 
259 /*
260  * Check that the two inodes are eligible for cloning, the ranges make
261  * sense, and then flush all dirty data.  Caller must ensure that the
262  * inodes have been locked against any other modifications.
263  *
264  * If there's an error, then the usual negative error code is returned.
265  * Otherwise returns 0 with *len set to the request length.
266  */
267 int
__generic_remap_file_range_prep(struct file * file_in,loff_t pos_in,struct file * file_out,loff_t pos_out,loff_t * len,unsigned int remap_flags,const struct iomap_ops * dax_read_ops)268 __generic_remap_file_range_prep(struct file *file_in, loff_t pos_in,
269 				struct file *file_out, loff_t pos_out,
270 				loff_t *len, unsigned int remap_flags,
271 				const struct iomap_ops *dax_read_ops)
272 {
273 	struct inode *inode_in = file_inode(file_in);
274 	struct inode *inode_out = file_inode(file_out);
275 	bool same_inode = (inode_in == inode_out);
276 	int ret;
277 
278 	/* Don't touch certain kinds of inodes */
279 	if (IS_IMMUTABLE(inode_out))
280 		return -EPERM;
281 
282 	if (IS_SWAPFILE(inode_in) || IS_SWAPFILE(inode_out))
283 		return -ETXTBSY;
284 
285 	/* Don't reflink dirs, pipes, sockets... */
286 	if (S_ISDIR(inode_in->i_mode) || S_ISDIR(inode_out->i_mode))
287 		return -EISDIR;
288 	if (!S_ISREG(inode_in->i_mode) || !S_ISREG(inode_out->i_mode))
289 		return -EINVAL;
290 
291 	/* Zero length dedupe exits immediately; reflink goes to EOF. */
292 	if (*len == 0) {
293 		loff_t isize = i_size_read(inode_in);
294 
295 		if ((remap_flags & REMAP_FILE_DEDUP) || pos_in == isize)
296 			return 0;
297 		if (pos_in > isize)
298 			return -EINVAL;
299 		*len = isize - pos_in;
300 		if (*len == 0)
301 			return 0;
302 	}
303 
304 	/* Check that we don't violate system file offset limits. */
305 	ret = generic_remap_checks(file_in, pos_in, file_out, pos_out, len,
306 			remap_flags);
307 	if (ret || *len == 0)
308 		return ret;
309 
310 	/* Wait for the completion of any pending IOs on both files */
311 	inode_dio_wait(inode_in);
312 	if (!same_inode)
313 		inode_dio_wait(inode_out);
314 
315 	ret = filemap_write_and_wait_range(inode_in->i_mapping,
316 			pos_in, pos_in + *len - 1);
317 	if (ret)
318 		return ret;
319 
320 	ret = filemap_write_and_wait_range(inode_out->i_mapping,
321 			pos_out, pos_out + *len - 1);
322 	if (ret)
323 		return ret;
324 
325 	/*
326 	 * Check that the extents are the same.
327 	 */
328 	if (remap_flags & REMAP_FILE_DEDUP) {
329 		bool		is_same = false;
330 
331 		if (!IS_DAX(inode_in))
332 			ret = vfs_dedupe_file_range_compare(file_in, pos_in,
333 					file_out, pos_out, *len, &is_same);
334 		else if (dax_read_ops)
335 			ret = dax_dedupe_file_range_compare(inode_in, pos_in,
336 					inode_out, pos_out, *len, &is_same,
337 					dax_read_ops);
338 		else
339 			return -EINVAL;
340 		if (ret)
341 			return ret;
342 		if (!is_same)
343 			return -EBADE;
344 	}
345 
346 	ret = generic_remap_check_len(inode_in, inode_out, pos_out, len,
347 			remap_flags);
348 	if (ret || *len == 0)
349 		return ret;
350 
351 	/* If can't alter the file contents, we're done. */
352 	if (!(remap_flags & REMAP_FILE_DEDUP))
353 		ret = file_modified(file_out);
354 
355 	return ret;
356 }
357 
generic_remap_file_range_prep(struct file * file_in,loff_t pos_in,struct file * file_out,loff_t pos_out,loff_t * len,unsigned int remap_flags)358 int generic_remap_file_range_prep(struct file *file_in, loff_t pos_in,
359 				  struct file *file_out, loff_t pos_out,
360 				  loff_t *len, unsigned int remap_flags)
361 {
362 	return __generic_remap_file_range_prep(file_in, pos_in, file_out,
363 					       pos_out, len, remap_flags, NULL);
364 }
365 EXPORT_SYMBOL(generic_remap_file_range_prep);
366 
do_clone_file_range(struct file * file_in,loff_t pos_in,struct file * file_out,loff_t pos_out,loff_t len,unsigned int remap_flags)367 loff_t do_clone_file_range(struct file *file_in, loff_t pos_in,
368 			   struct file *file_out, loff_t pos_out,
369 			   loff_t len, unsigned int remap_flags)
370 {
371 	loff_t ret;
372 
373 	WARN_ON_ONCE(remap_flags & REMAP_FILE_DEDUP);
374 
375 	if (file_inode(file_in)->i_sb != file_inode(file_out)->i_sb)
376 		return -EXDEV;
377 
378 	ret = generic_file_rw_checks(file_in, file_out);
379 	if (ret < 0)
380 		return ret;
381 
382 	if (!file_in->f_op->remap_file_range)
383 		return -EOPNOTSUPP;
384 
385 	ret = remap_verify_area(file_in, pos_in, len, false);
386 	if (ret)
387 		return ret;
388 
389 	ret = remap_verify_area(file_out, pos_out, len, true);
390 	if (ret)
391 		return ret;
392 
393 	ret = file_in->f_op->remap_file_range(file_in, pos_in,
394 			file_out, pos_out, len, remap_flags);
395 	if (ret < 0)
396 		return ret;
397 
398 	fsnotify_access(file_in);
399 	fsnotify_modify(file_out);
400 	return ret;
401 }
402 EXPORT_SYMBOL(do_clone_file_range);
403 
vfs_clone_file_range(struct file * file_in,loff_t pos_in,struct file * file_out,loff_t pos_out,loff_t len,unsigned int remap_flags)404 loff_t vfs_clone_file_range(struct file *file_in, loff_t pos_in,
405 			    struct file *file_out, loff_t pos_out,
406 			    loff_t len, unsigned int remap_flags)
407 {
408 	loff_t ret;
409 
410 	file_start_write(file_out);
411 	ret = do_clone_file_range(file_in, pos_in, file_out, pos_out, len,
412 				  remap_flags);
413 	file_end_write(file_out);
414 
415 	return ret;
416 }
417 EXPORT_SYMBOL(vfs_clone_file_range);
418 
419 /* Check whether we are allowed to dedupe the destination file */
allow_file_dedupe(struct file * file)420 static bool allow_file_dedupe(struct file *file)
421 {
422 	struct mnt_idmap *idmap = file_mnt_idmap(file);
423 	struct inode *inode = file_inode(file);
424 
425 	if (capable(CAP_SYS_ADMIN))
426 		return true;
427 	if (file->f_mode & FMODE_WRITE)
428 		return true;
429 	if (vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), current_fsuid()))
430 		return true;
431 	if (!inode_permission(idmap, inode, MAY_WRITE))
432 		return true;
433 	return false;
434 }
435 
vfs_dedupe_file_range_one(struct file * src_file,loff_t src_pos,struct file * dst_file,loff_t dst_pos,loff_t len,unsigned int remap_flags)436 loff_t vfs_dedupe_file_range_one(struct file *src_file, loff_t src_pos,
437 				 struct file *dst_file, loff_t dst_pos,
438 				 loff_t len, unsigned int remap_flags)
439 {
440 	loff_t ret;
441 
442 	WARN_ON_ONCE(remap_flags & ~(REMAP_FILE_DEDUP |
443 				     REMAP_FILE_CAN_SHORTEN));
444 
445 	ret = mnt_want_write_file(dst_file);
446 	if (ret)
447 		return ret;
448 
449 	/*
450 	 * This is redundant if called from vfs_dedupe_file_range(), but other
451 	 * callers need it and it's not performance sesitive...
452 	 */
453 	ret = remap_verify_area(src_file, src_pos, len, false);
454 	if (ret)
455 		goto out_drop_write;
456 
457 	ret = remap_verify_area(dst_file, dst_pos, len, true);
458 	if (ret)
459 		goto out_drop_write;
460 
461 	ret = -EPERM;
462 	if (!allow_file_dedupe(dst_file))
463 		goto out_drop_write;
464 
465 	ret = -EXDEV;
466 	if (file_inode(src_file)->i_sb != file_inode(dst_file)->i_sb)
467 		goto out_drop_write;
468 
469 	ret = -EISDIR;
470 	if (S_ISDIR(file_inode(dst_file)->i_mode))
471 		goto out_drop_write;
472 
473 	ret = -EINVAL;
474 	if (!dst_file->f_op->remap_file_range)
475 		goto out_drop_write;
476 
477 	if (len == 0) {
478 		ret = 0;
479 		goto out_drop_write;
480 	}
481 
482 	ret = dst_file->f_op->remap_file_range(src_file, src_pos, dst_file,
483 			dst_pos, len, remap_flags | REMAP_FILE_DEDUP);
484 out_drop_write:
485 	mnt_drop_write_file(dst_file);
486 
487 	return ret;
488 }
489 EXPORT_SYMBOL(vfs_dedupe_file_range_one);
490 
vfs_dedupe_file_range(struct file * file,struct file_dedupe_range * same)491 int vfs_dedupe_file_range(struct file *file, struct file_dedupe_range *same)
492 {
493 	struct file_dedupe_range_info *info;
494 	struct inode *src = file_inode(file);
495 	u64 off;
496 	u64 len;
497 	int i;
498 	int ret;
499 	u16 count = same->dest_count;
500 	loff_t deduped;
501 
502 	if (!(file->f_mode & FMODE_READ))
503 		return -EINVAL;
504 
505 	if (same->reserved1 || same->reserved2)
506 		return -EINVAL;
507 
508 	off = same->src_offset;
509 	len = same->src_length;
510 
511 	if (S_ISDIR(src->i_mode))
512 		return -EISDIR;
513 
514 	if (!S_ISREG(src->i_mode))
515 		return -EINVAL;
516 
517 	if (!file->f_op->remap_file_range)
518 		return -EOPNOTSUPP;
519 
520 	ret = remap_verify_area(file, off, len, false);
521 	if (ret < 0)
522 		return ret;
523 	ret = 0;
524 
525 	if (off + len > i_size_read(src))
526 		return -EINVAL;
527 
528 	/* Arbitrary 1G limit on a single dedupe request, can be raised. */
529 	len = min_t(u64, len, 1 << 30);
530 
531 	/* pre-format output fields to sane values */
532 	for (i = 0; i < count; i++) {
533 		same->info[i].bytes_deduped = 0ULL;
534 		same->info[i].status = FILE_DEDUPE_RANGE_SAME;
535 	}
536 
537 	for (i = 0, info = same->info; i < count; i++, info++) {
538 		struct fd dst_fd = fdget(info->dest_fd);
539 		struct file *dst_file = dst_fd.file;
540 
541 		if (!dst_file) {
542 			info->status = -EBADF;
543 			goto next_loop;
544 		}
545 
546 		if (info->reserved) {
547 			info->status = -EINVAL;
548 			goto next_fdput;
549 		}
550 
551 		deduped = vfs_dedupe_file_range_one(file, off, dst_file,
552 						    info->dest_offset, len,
553 						    REMAP_FILE_CAN_SHORTEN);
554 		if (deduped == -EBADE)
555 			info->status = FILE_DEDUPE_RANGE_DIFFERS;
556 		else if (deduped < 0)
557 			info->status = deduped;
558 		else
559 			info->bytes_deduped = len;
560 
561 next_fdput:
562 		fdput(dst_fd);
563 next_loop:
564 		if (fatal_signal_pending(current))
565 			break;
566 	}
567 	return ret;
568 }
569 EXPORT_SYMBOL(vfs_dedupe_file_range);
570