xref: /linux/drivers/md/dm-ioctl.c (revision 670c12ce09a8180ebe0c608d8a789a7e58fe7d8e)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2001, 2002 Sistina Software (UK) Limited.
4  * Copyright (C) 2004 - 2006 Red Hat, Inc. All rights reserved.
5  *
6  * This file is released under the GPL.
7  */
8 
9 #include "dm-core.h"
10 #include "dm-ima.h"
11 #include <linux/module.h>
12 #include <linux/vmalloc.h>
13 #include <linux/miscdevice.h>
14 #include <linux/sched/mm.h>
15 #include <linux/init.h>
16 #include <linux/wait.h>
17 #include <linux/slab.h>
18 #include <linux/rbtree.h>
19 #include <linux/dm-ioctl.h>
20 #include <linux/hdreg.h>
21 #include <linux/compat.h>
22 #include <linux/nospec.h>
23 
24 #include <linux/uaccess.h>
25 #include <linux/ima.h>
26 
27 #define DM_MSG_PREFIX "ioctl"
28 #define DM_DRIVER_EMAIL "dm-devel@lists.linux.dev"
29 
30 struct dm_file {
31 	/*
32 	 * poll will wait until the global event number is greater than
33 	 * this value.
34 	 */
35 	volatile unsigned int global_event_nr;
36 };
37 
38 /*
39  *---------------------------------------------------------------
40  * The ioctl interface needs to be able to look up devices by
41  * name or uuid.
42  *---------------------------------------------------------------
43  */
44 struct hash_cell {
45 	struct rb_node name_node;
46 	struct rb_node uuid_node;
47 	bool name_set;
48 	bool uuid_set;
49 
50 	char *name;
51 	char *uuid;
52 	struct mapped_device *md;
53 	struct dm_table *new_map;
54 };
55 
56 struct vers_iter {
57 	size_t param_size;
58 	struct dm_target_versions *vers, *old_vers;
59 	char *end;
60 	uint32_t flags;
61 };
62 
63 
64 static struct rb_root name_rb_tree = RB_ROOT;
65 static struct rb_root uuid_rb_tree = RB_ROOT;
66 
67 static void dm_hash_remove_all(bool keep_open_devices, bool mark_deferred, bool only_deferred);
68 
69 /*
70  * Guards access to both hash tables.
71  */
72 static DECLARE_RWSEM(_hash_lock);
73 
74 /*
75  * Protects use of mdptr to obtain hash cell name and uuid from mapped device.
76  */
77 static DEFINE_MUTEX(dm_hash_cells_mutex);
78 
dm_hash_exit(void)79 static void dm_hash_exit(void)
80 {
81 	dm_hash_remove_all(false, false, false);
82 }
83 
84 /*
85  *---------------------------------------------------------------
86  * Code for looking up a device by name
87  *---------------------------------------------------------------
88  */
__get_name_cell(const char * str)89 static struct hash_cell *__get_name_cell(const char *str)
90 {
91 	struct rb_node *n = name_rb_tree.rb_node;
92 
93 	while (n) {
94 		struct hash_cell *hc = container_of(n, struct hash_cell, name_node);
95 		int c;
96 
97 		c = strcmp(hc->name, str);
98 		if (!c) {
99 			dm_get(hc->md);
100 			return hc;
101 		}
102 		n = c >= 0 ? n->rb_left : n->rb_right;
103 	}
104 
105 	return NULL;
106 }
107 
__get_uuid_cell(const char * str)108 static struct hash_cell *__get_uuid_cell(const char *str)
109 {
110 	struct rb_node *n = uuid_rb_tree.rb_node;
111 
112 	while (n) {
113 		struct hash_cell *hc = container_of(n, struct hash_cell, uuid_node);
114 		int c;
115 
116 		c = strcmp(hc->uuid, str);
117 		if (!c) {
118 			dm_get(hc->md);
119 			return hc;
120 		}
121 		n = c >= 0 ? n->rb_left : n->rb_right;
122 	}
123 
124 	return NULL;
125 }
126 
__unlink_name(struct hash_cell * hc)127 static void __unlink_name(struct hash_cell *hc)
128 {
129 	if (hc->name_set) {
130 		hc->name_set = false;
131 		rb_erase(&hc->name_node, &name_rb_tree);
132 	}
133 }
134 
__unlink_uuid(struct hash_cell * hc)135 static void __unlink_uuid(struct hash_cell *hc)
136 {
137 	if (hc->uuid_set) {
138 		hc->uuid_set = false;
139 		rb_erase(&hc->uuid_node, &uuid_rb_tree);
140 	}
141 }
142 
__link_name(struct hash_cell * new_hc)143 static void __link_name(struct hash_cell *new_hc)
144 {
145 	struct rb_node **n, *parent;
146 
147 	__unlink_name(new_hc);
148 
149 	new_hc->name_set = true;
150 
151 	n = &name_rb_tree.rb_node;
152 	parent = NULL;
153 
154 	while (*n) {
155 		struct hash_cell *hc = container_of(*n, struct hash_cell, name_node);
156 		int c;
157 
158 		c = strcmp(hc->name, new_hc->name);
159 		BUG_ON(!c);
160 		parent = *n;
161 		n = c >= 0 ? &hc->name_node.rb_left : &hc->name_node.rb_right;
162 	}
163 
164 	rb_link_node(&new_hc->name_node, parent, n);
165 	rb_insert_color(&new_hc->name_node, &name_rb_tree);
166 }
167 
__link_uuid(struct hash_cell * new_hc)168 static void __link_uuid(struct hash_cell *new_hc)
169 {
170 	struct rb_node **n, *parent;
171 
172 	__unlink_uuid(new_hc);
173 
174 	new_hc->uuid_set = true;
175 
176 	n = &uuid_rb_tree.rb_node;
177 	parent = NULL;
178 
179 	while (*n) {
180 		struct hash_cell *hc = container_of(*n, struct hash_cell, uuid_node);
181 		int c;
182 
183 		c = strcmp(hc->uuid, new_hc->uuid);
184 		BUG_ON(!c);
185 		parent = *n;
186 		n = c > 0 ? &hc->uuid_node.rb_left : &hc->uuid_node.rb_right;
187 	}
188 
189 	rb_link_node(&new_hc->uuid_node, parent, n);
190 	rb_insert_color(&new_hc->uuid_node, &uuid_rb_tree);
191 }
192 
__get_dev_cell(uint64_t dev)193 static struct hash_cell *__get_dev_cell(uint64_t dev)
194 {
195 	struct mapped_device *md;
196 	struct hash_cell *hc;
197 
198 	md = dm_get_md(huge_decode_dev(dev));
199 	if (!md)
200 		return NULL;
201 
202 	hc = dm_get_mdptr(md);
203 	if (!hc) {
204 		dm_put(md);
205 		return NULL;
206 	}
207 
208 	return hc;
209 }
210 
211 /*
212  *---------------------------------------------------------------
213  * Inserting, removing and renaming a device.
214  *---------------------------------------------------------------
215  */
alloc_cell(const char * name,const char * uuid,struct mapped_device * md)216 static struct hash_cell *alloc_cell(const char *name, const char *uuid,
217 				    struct mapped_device *md)
218 {
219 	struct hash_cell *hc;
220 
221 	hc = kmalloc(sizeof(*hc), GFP_KERNEL);
222 	if (!hc)
223 		return NULL;
224 
225 	hc->name = kstrdup(name, GFP_KERNEL);
226 	if (!hc->name) {
227 		kfree(hc);
228 		return NULL;
229 	}
230 
231 	if (!uuid)
232 		hc->uuid = NULL;
233 
234 	else {
235 		hc->uuid = kstrdup(uuid, GFP_KERNEL);
236 		if (!hc->uuid) {
237 			kfree(hc->name);
238 			kfree(hc);
239 			return NULL;
240 		}
241 	}
242 
243 	hc->name_set = hc->uuid_set = false;
244 	hc->md = md;
245 	hc->new_map = NULL;
246 	return hc;
247 }
248 
free_cell(struct hash_cell * hc)249 static void free_cell(struct hash_cell *hc)
250 {
251 	if (hc) {
252 		kfree(hc->name);
253 		kfree(hc->uuid);
254 		kfree(hc);
255 	}
256 }
257 
258 /*
259  * The kdev_t and uuid of a device can never change once it is
260  * initially inserted.
261  */
dm_hash_insert(const char * name,const char * uuid,struct mapped_device * md)262 static int dm_hash_insert(const char *name, const char *uuid, struct mapped_device *md)
263 {
264 	struct hash_cell *cell, *hc;
265 
266 	/*
267 	 * Allocate the new cells.
268 	 */
269 	cell = alloc_cell(name, uuid, md);
270 	if (!cell)
271 		return -ENOMEM;
272 
273 	/*
274 	 * Insert the cell into both hash tables.
275 	 */
276 	down_write(&_hash_lock);
277 	hc = __get_name_cell(name);
278 	if (hc) {
279 		dm_put(hc->md);
280 		goto bad;
281 	}
282 
283 	__link_name(cell);
284 
285 	if (uuid) {
286 		hc = __get_uuid_cell(uuid);
287 		if (hc) {
288 			__unlink_name(cell);
289 			dm_put(hc->md);
290 			goto bad;
291 		}
292 		__link_uuid(cell);
293 	}
294 	dm_get(md);
295 	mutex_lock(&dm_hash_cells_mutex);
296 	dm_set_mdptr(md, cell);
297 	mutex_unlock(&dm_hash_cells_mutex);
298 	up_write(&_hash_lock);
299 
300 	return 0;
301 
302  bad:
303 	up_write(&_hash_lock);
304 	free_cell(cell);
305 	return -EBUSY;
306 }
307 
__hash_remove(struct hash_cell * hc)308 static struct dm_table *__hash_remove(struct hash_cell *hc)
309 {
310 	struct dm_table *table;
311 	int srcu_idx;
312 
313 	lockdep_assert_held(&_hash_lock);
314 
315 	/* remove from the dev trees */
316 	__unlink_name(hc);
317 	__unlink_uuid(hc);
318 	mutex_lock(&dm_hash_cells_mutex);
319 	dm_set_mdptr(hc->md, NULL);
320 	mutex_unlock(&dm_hash_cells_mutex);
321 
322 	table = dm_get_live_table(hc->md, &srcu_idx);
323 	if (table)
324 		dm_table_event(table);
325 	dm_put_live_table(hc->md, srcu_idx);
326 
327 	table = NULL;
328 	if (hc->new_map)
329 		table = hc->new_map;
330 	dm_put(hc->md);
331 	free_cell(hc);
332 
333 	return table;
334 }
335 
dm_hash_remove_all(bool keep_open_devices,bool mark_deferred,bool only_deferred)336 static void dm_hash_remove_all(bool keep_open_devices, bool mark_deferred, bool only_deferred)
337 {
338 	int dev_skipped;
339 	struct rb_node *n;
340 	struct hash_cell *hc;
341 	struct mapped_device *md;
342 	struct dm_table *t;
343 
344 retry:
345 	dev_skipped = 0;
346 
347 	down_write(&_hash_lock);
348 
349 	for (n = rb_first(&name_rb_tree); n; n = rb_next(n)) {
350 		hc = container_of(n, struct hash_cell, name_node);
351 		md = hc->md;
352 		dm_get(md);
353 
354 		if (keep_open_devices &&
355 		    dm_lock_for_deletion(md, mark_deferred, only_deferred)) {
356 			dm_put(md);
357 			dev_skipped++;
358 			continue;
359 		}
360 
361 		t = __hash_remove(hc);
362 
363 		up_write(&_hash_lock);
364 
365 		if (t) {
366 			dm_sync_table(md);
367 			dm_table_destroy(t);
368 		}
369 		dm_ima_measure_on_device_remove(md, true);
370 		dm_put(md);
371 		if (likely(keep_open_devices))
372 			dm_destroy(md);
373 		else
374 			dm_destroy_immediate(md);
375 
376 		/*
377 		 * Some mapped devices may be using other mapped
378 		 * devices, so repeat until we make no further
379 		 * progress.  If a new mapped device is created
380 		 * here it will also get removed.
381 		 */
382 		goto retry;
383 	}
384 
385 	up_write(&_hash_lock);
386 
387 	if (dev_skipped)
388 		DMWARN("remove_all left %d open device(s)", dev_skipped);
389 }
390 
391 /*
392  * Set the uuid of a hash_cell that isn't already set.
393  */
__set_cell_uuid(struct hash_cell * hc,char * new_uuid)394 static void __set_cell_uuid(struct hash_cell *hc, char *new_uuid)
395 {
396 	mutex_lock(&dm_hash_cells_mutex);
397 	hc->uuid = new_uuid;
398 	mutex_unlock(&dm_hash_cells_mutex);
399 
400 	__link_uuid(hc);
401 }
402 
403 /*
404  * Changes the name of a hash_cell and returns the old name for
405  * the caller to free.
406  */
__change_cell_name(struct hash_cell * hc,char * new_name)407 static char *__change_cell_name(struct hash_cell *hc, char *new_name)
408 {
409 	char *old_name;
410 
411 	/*
412 	 * Rename and move the name cell.
413 	 */
414 	__unlink_name(hc);
415 	old_name = hc->name;
416 
417 	mutex_lock(&dm_hash_cells_mutex);
418 	hc->name = new_name;
419 	mutex_unlock(&dm_hash_cells_mutex);
420 
421 	__link_name(hc);
422 
423 	return old_name;
424 }
425 
dm_hash_rename(struct dm_ioctl * param,const char * new)426 static struct mapped_device *dm_hash_rename(struct dm_ioctl *param,
427 					    const char *new)
428 {
429 	char *new_data, *old_name = NULL;
430 	struct hash_cell *hc;
431 	struct dm_table *table;
432 	struct mapped_device *md;
433 	unsigned int change_uuid = (param->flags & DM_UUID_FLAG) ? 1 : 0;
434 	int srcu_idx;
435 
436 	/*
437 	 * duplicate new.
438 	 */
439 	new_data = kstrdup(new, GFP_KERNEL);
440 	if (!new_data)
441 		return ERR_PTR(-ENOMEM);
442 
443 	down_write(&_hash_lock);
444 
445 	/*
446 	 * Is new free ?
447 	 */
448 	if (change_uuid)
449 		hc = __get_uuid_cell(new);
450 	else
451 		hc = __get_name_cell(new);
452 
453 	if (hc) {
454 		DMERR("Unable to change %s on mapped device %s to one that already exists: %s",
455 		      change_uuid ? "uuid" : "name",
456 		      param->name, new);
457 		dm_put(hc->md);
458 		up_write(&_hash_lock);
459 		kfree(new_data);
460 		return ERR_PTR(-EBUSY);
461 	}
462 
463 	/*
464 	 * Is there such a device as 'old' ?
465 	 */
466 	hc = __get_name_cell(param->name);
467 	if (!hc) {
468 		DMERR("Unable to rename non-existent device, %s to %s%s",
469 		      param->name, change_uuid ? "uuid " : "", new);
470 		up_write(&_hash_lock);
471 		kfree(new_data);
472 		return ERR_PTR(-ENXIO);
473 	}
474 
475 	/*
476 	 * Does this device already have a uuid?
477 	 */
478 	if (change_uuid && hc->uuid) {
479 		DMERR("Unable to change uuid of mapped device %s to %s "
480 		      "because uuid is already set to %s",
481 		      param->name, new, hc->uuid);
482 		dm_put(hc->md);
483 		up_write(&_hash_lock);
484 		kfree(new_data);
485 		return ERR_PTR(-EINVAL);
486 	}
487 
488 	if (change_uuid)
489 		__set_cell_uuid(hc, new_data);
490 	else
491 		old_name = __change_cell_name(hc, new_data);
492 
493 	/*
494 	 * Wake up any dm event waiters.
495 	 */
496 	table = dm_get_live_table(hc->md, &srcu_idx);
497 	if (table)
498 		dm_table_event(table);
499 	dm_put_live_table(hc->md, srcu_idx);
500 
501 	if (!dm_kobject_uevent(hc->md, KOBJ_CHANGE, param->event_nr, false))
502 		param->flags |= DM_UEVENT_GENERATED_FLAG;
503 
504 	md = hc->md;
505 
506 	dm_ima_measure_on_device_rename(md);
507 
508 	up_write(&_hash_lock);
509 	kfree(old_name);
510 
511 	return md;
512 }
513 
dm_deferred_remove(void)514 void dm_deferred_remove(void)
515 {
516 	dm_hash_remove_all(true, false, true);
517 }
518 
519 /*
520  *---------------------------------------------------------------
521  * Implementation of the ioctl commands
522  *---------------------------------------------------------------
523  */
524 /*
525  * All the ioctl commands get dispatched to functions with this
526  * prototype.
527  */
528 typedef int (*ioctl_fn)(struct file *filp, struct dm_ioctl *param, size_t param_size);
529 
remove_all(struct file * filp,struct dm_ioctl * param,size_t param_size)530 static int remove_all(struct file *filp, struct dm_ioctl *param, size_t param_size)
531 {
532 	dm_hash_remove_all(true, !!(param->flags & DM_DEFERRED_REMOVE), false);
533 	param->data_size = 0;
534 	return 0;
535 }
536 
537 /*
538  * Round up the ptr to an 8-byte boundary.
539  */
540 #define ALIGN_MASK 7
align_val(size_t val)541 static inline size_t align_val(size_t val)
542 {
543 	return (val + ALIGN_MASK) & ~ALIGN_MASK;
544 }
align_ptr(void * ptr)545 static inline void *align_ptr(void *ptr)
546 {
547 	return (void *)align_val((size_t)ptr);
548 }
549 
550 /*
551  * Retrieves the data payload buffer from an already allocated
552  * struct dm_ioctl.
553  */
get_result_buffer(struct dm_ioctl * param,size_t param_size,size_t * len)554 static void *get_result_buffer(struct dm_ioctl *param, size_t param_size,
555 			       size_t *len)
556 {
557 	param->data_start = align_ptr(param + 1) - (void *) param;
558 
559 	if (param->data_start < param_size)
560 		*len = param_size - param->data_start;
561 	else
562 		*len = 0;
563 
564 	return ((void *) param) + param->data_start;
565 }
566 
filter_device(struct hash_cell * hc,const char * pfx_name,const char * pfx_uuid)567 static bool filter_device(struct hash_cell *hc, const char *pfx_name, const char *pfx_uuid)
568 {
569 	const char *val;
570 	size_t val_len, pfx_len;
571 
572 	val = hc->name;
573 	val_len = strlen(val);
574 	pfx_len = strnlen(pfx_name, DM_NAME_LEN);
575 	if (pfx_len > val_len)
576 		return false;
577 	if (memcmp(val, pfx_name, pfx_len))
578 		return false;
579 
580 	val = hc->uuid ? hc->uuid : "";
581 	val_len = strlen(val);
582 	pfx_len = strnlen(pfx_uuid, DM_UUID_LEN);
583 	if (pfx_len > val_len)
584 		return false;
585 	if (memcmp(val, pfx_uuid, pfx_len))
586 		return false;
587 
588 	return true;
589 }
590 
list_devices(struct file * filp,struct dm_ioctl * param,size_t param_size)591 static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_size)
592 {
593 	struct rb_node *n;
594 	struct hash_cell *hc;
595 	size_t len, needed = 0;
596 	struct gendisk *disk;
597 	struct dm_name_list *orig_nl, *nl, *old_nl = NULL;
598 	uint32_t *event_nr;
599 
600 	down_write(&_hash_lock);
601 
602 	/*
603 	 * Loop through all the devices working out how much
604 	 * space we need.
605 	 */
606 	for (n = rb_first(&name_rb_tree); n; n = rb_next(n)) {
607 		hc = container_of(n, struct hash_cell, name_node);
608 		if (!filter_device(hc, param->name, param->uuid))
609 			continue;
610 		needed += align_val(offsetof(struct dm_name_list, name) + strlen(hc->name) + 1);
611 		needed += align_val(sizeof(uint32_t) * 2);
612 		if (param->flags & DM_UUID_FLAG && hc->uuid)
613 			needed += align_val(strlen(hc->uuid) + 1);
614 	}
615 
616 	/*
617 	 * Grab our output buffer.
618 	 */
619 	nl = orig_nl = get_result_buffer(param, param_size, &len);
620 	if (len < needed || len < sizeof(nl->dev)) {
621 		param->flags |= DM_BUFFER_FULL_FLAG;
622 		goto out;
623 	}
624 	param->data_size = param->data_start + needed;
625 
626 	nl->dev = 0;	/* Flags no data */
627 
628 	/*
629 	 * Now loop through filling out the names.
630 	 */
631 	for (n = rb_first(&name_rb_tree); n; n = rb_next(n)) {
632 		void *uuid_ptr;
633 
634 		hc = container_of(n, struct hash_cell, name_node);
635 		if (!filter_device(hc, param->name, param->uuid))
636 			continue;
637 		if (old_nl)
638 			old_nl->next = (uint32_t) ((void *) nl -
639 						   (void *) old_nl);
640 		disk = dm_disk(hc->md);
641 		nl->dev = huge_encode_dev(disk_devt(disk));
642 		nl->next = 0;
643 		strcpy(nl->name, hc->name);
644 
645 		old_nl = nl;
646 		event_nr = align_ptr(nl->name + strlen(hc->name) + 1);
647 		event_nr[0] = dm_get_event_nr(hc->md);
648 		event_nr[1] = 0;
649 		uuid_ptr = align_ptr(event_nr + 2);
650 		if (param->flags & DM_UUID_FLAG) {
651 			if (hc->uuid) {
652 				event_nr[1] |= DM_NAME_LIST_FLAG_HAS_UUID;
653 				strcpy(uuid_ptr, hc->uuid);
654 				uuid_ptr = align_ptr(uuid_ptr + strlen(hc->uuid) + 1);
655 			} else {
656 				event_nr[1] |= DM_NAME_LIST_FLAG_DOESNT_HAVE_UUID;
657 			}
658 		}
659 		nl = uuid_ptr;
660 	}
661 	/*
662 	 * If mismatch happens, security may be compromised due to buffer
663 	 * overflow, so it's better to crash.
664 	 */
665 	BUG_ON((char *)nl - (char *)orig_nl != needed);
666 
667  out:
668 	up_write(&_hash_lock);
669 	return 0;
670 }
671 
list_version_get_needed(struct target_type * tt,void * needed_param)672 static void list_version_get_needed(struct target_type *tt, void *needed_param)
673 {
674 	size_t *needed = needed_param;
675 
676 	*needed += sizeof(struct dm_target_versions);
677 	*needed += strlen(tt->name) + 1;
678 	*needed += ALIGN_MASK;
679 }
680 
list_version_get_info(struct target_type * tt,void * param)681 static void list_version_get_info(struct target_type *tt, void *param)
682 {
683 	struct vers_iter *info = param;
684 
685 	/* Check space - it might have changed since the first iteration */
686 	if ((char *)info->vers + sizeof(tt->version) + strlen(tt->name) + 1 > info->end) {
687 		info->flags = DM_BUFFER_FULL_FLAG;
688 		return;
689 	}
690 
691 	if (info->old_vers)
692 		info->old_vers->next = (uint32_t) ((void *)info->vers - (void *)info->old_vers);
693 
694 	info->vers->version[0] = tt->version[0];
695 	info->vers->version[1] = tt->version[1];
696 	info->vers->version[2] = tt->version[2];
697 	info->vers->next = 0;
698 	strcpy(info->vers->name, tt->name);
699 
700 	info->old_vers = info->vers;
701 	info->vers = align_ptr((void *)(info->vers + 1) + strlen(tt->name) + 1);
702 }
703 
__list_versions(struct dm_ioctl * param,size_t param_size,const char * name)704 static int __list_versions(struct dm_ioctl *param, size_t param_size, const char *name)
705 {
706 	size_t len, needed = 0;
707 	struct dm_target_versions *vers;
708 	struct vers_iter iter_info;
709 	struct target_type *tt = NULL;
710 
711 	if (name) {
712 		tt = dm_get_target_type(name);
713 		if (!tt)
714 			return -EINVAL;
715 	}
716 
717 	/*
718 	 * Loop through all the devices working out how much
719 	 * space we need.
720 	 */
721 	if (!tt)
722 		dm_target_iterate(list_version_get_needed, &needed);
723 	else
724 		list_version_get_needed(tt, &needed);
725 
726 	/*
727 	 * Grab our output buffer.
728 	 */
729 	vers = get_result_buffer(param, param_size, &len);
730 	if (len < needed) {
731 		param->flags |= DM_BUFFER_FULL_FLAG;
732 		goto out;
733 	}
734 	param->data_size = param->data_start + needed;
735 
736 	iter_info.param_size = param_size;
737 	iter_info.old_vers = NULL;
738 	iter_info.vers = vers;
739 	iter_info.flags = 0;
740 	iter_info.end = (char *)vers + needed;
741 
742 	/*
743 	 * Now loop through filling out the names & versions.
744 	 */
745 	if (!tt)
746 		dm_target_iterate(list_version_get_info, &iter_info);
747 	else
748 		list_version_get_info(tt, &iter_info);
749 	param->flags |= iter_info.flags;
750 
751  out:
752 	if (tt)
753 		dm_put_target_type(tt);
754 	return 0;
755 }
756 
list_versions(struct file * filp,struct dm_ioctl * param,size_t param_size)757 static int list_versions(struct file *filp, struct dm_ioctl *param, size_t param_size)
758 {
759 	return __list_versions(param, param_size, NULL);
760 }
761 
get_target_version(struct file * filp,struct dm_ioctl * param,size_t param_size)762 static int get_target_version(struct file *filp, struct dm_ioctl *param, size_t param_size)
763 {
764 	return __list_versions(param, param_size, param->name);
765 }
766 
check_name(const char * name)767 static int check_name(const char *name)
768 {
769 	if (strchr(name, '/')) {
770 		DMERR("device name cannot contain '/'");
771 		return -EINVAL;
772 	}
773 
774 	if (strcmp(name, DM_CONTROL_NODE) == 0 ||
775 	    strcmp(name, ".") == 0 ||
776 	    strcmp(name, "..") == 0) {
777 		DMERR("device name cannot be \"%s\", \".\", or \"..\"", DM_CONTROL_NODE);
778 		return -EINVAL;
779 	}
780 
781 	return 0;
782 }
783 
784 /*
785  * On successful return, the caller must not attempt to acquire
786  * _hash_lock without first calling dm_put_live_table, because dm_table_destroy
787  * waits for this dm_put_live_table and could be called under this lock.
788  */
dm_get_inactive_table(struct mapped_device * md,int * srcu_idx)789 static struct dm_table *dm_get_inactive_table(struct mapped_device *md, int *srcu_idx)
790 {
791 	struct hash_cell *hc;
792 	struct dm_table *table = NULL;
793 
794 	/* increment rcu count, we don't care about the table pointer */
795 	dm_get_live_table(md, srcu_idx);
796 
797 	down_read(&_hash_lock);
798 	hc = dm_get_mdptr(md);
799 	if (!hc) {
800 		DMERR("device has been removed from the dev hash table.");
801 		goto out;
802 	}
803 
804 	table = hc->new_map;
805 
806 out:
807 	up_read(&_hash_lock);
808 
809 	return table;
810 }
811 
dm_get_live_or_inactive_table(struct mapped_device * md,struct dm_ioctl * param,int * srcu_idx)812 static struct dm_table *dm_get_live_or_inactive_table(struct mapped_device *md,
813 						      struct dm_ioctl *param,
814 						      int *srcu_idx)
815 {
816 	return (param->flags & DM_QUERY_INACTIVE_TABLE_FLAG) ?
817 		dm_get_inactive_table(md, srcu_idx) : dm_get_live_table(md, srcu_idx);
818 }
819 
820 /*
821  * Fills in a dm_ioctl structure, ready for sending back to
822  * userland.
823  */
__dev_status(struct mapped_device * md,struct dm_ioctl * param)824 static void __dev_status(struct mapped_device *md, struct dm_ioctl *param)
825 {
826 	struct gendisk *disk = dm_disk(md);
827 	struct dm_table *table;
828 	int srcu_idx;
829 
830 	param->flags &= ~(DM_SUSPEND_FLAG | DM_READONLY_FLAG |
831 			  DM_ACTIVE_PRESENT_FLAG | DM_INTERNAL_SUSPEND_FLAG);
832 
833 	if (dm_suspended_md(md))
834 		param->flags |= DM_SUSPEND_FLAG;
835 
836 	if (dm_suspended_internally_md(md))
837 		param->flags |= DM_INTERNAL_SUSPEND_FLAG;
838 
839 	if (dm_test_deferred_remove_flag(md))
840 		param->flags |= DM_DEFERRED_REMOVE;
841 
842 	param->dev = huge_encode_dev(disk_devt(disk));
843 
844 	/*
845 	 * Yes, this will be out of date by the time it gets back
846 	 * to userland, but it is still very useful for
847 	 * debugging.
848 	 */
849 	param->open_count = dm_open_count(md);
850 
851 	param->event_nr = dm_get_event_nr(md);
852 	param->target_count = 0;
853 
854 	table = dm_get_live_table(md, &srcu_idx);
855 	if (table) {
856 		if (!(param->flags & DM_QUERY_INACTIVE_TABLE_FLAG)) {
857 			if (get_disk_ro(disk))
858 				param->flags |= DM_READONLY_FLAG;
859 			param->target_count = table->num_targets;
860 		}
861 
862 		param->flags |= DM_ACTIVE_PRESENT_FLAG;
863 	}
864 	dm_put_live_table(md, srcu_idx);
865 
866 	if (param->flags & DM_QUERY_INACTIVE_TABLE_FLAG) {
867 		int srcu_idx;
868 
869 		table = dm_get_inactive_table(md, &srcu_idx);
870 		if (table) {
871 			if (!(dm_table_get_mode(table) & BLK_OPEN_WRITE))
872 				param->flags |= DM_READONLY_FLAG;
873 			param->target_count = table->num_targets;
874 		}
875 		dm_put_live_table(md, srcu_idx);
876 	}
877 }
878 
dev_create(struct file * filp,struct dm_ioctl * param,size_t param_size)879 static int dev_create(struct file *filp, struct dm_ioctl *param, size_t param_size)
880 {
881 	int r, m = DM_ANY_MINOR;
882 	struct mapped_device *md;
883 
884 	r = check_name(param->name);
885 	if (r)
886 		return r;
887 
888 	if (param->flags & DM_PERSISTENT_DEV_FLAG)
889 		m = MINOR(huge_decode_dev(param->dev));
890 
891 	r = dm_create(m, &md);
892 	if (r)
893 		return r;
894 
895 	r = dm_hash_insert(param->name, *param->uuid ? param->uuid : NULL, md);
896 	if (r) {
897 		dm_put(md);
898 		dm_destroy(md);
899 		return r;
900 	}
901 
902 	param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
903 
904 	__dev_status(md, param);
905 
906 	dm_put(md);
907 
908 	return 0;
909 }
910 
911 /*
912  * Always use UUID for lookups if it's present, otherwise use name or dev.
913  */
__find_device_hash_cell(struct dm_ioctl * param)914 static struct hash_cell *__find_device_hash_cell(struct dm_ioctl *param)
915 {
916 	struct hash_cell *hc = NULL;
917 
918 	if (*param->uuid) {
919 		if (*param->name || param->dev) {
920 			DMERR("Invalid ioctl structure: uuid %s, name %s, dev %llx",
921 			      param->uuid, param->name, (unsigned long long)param->dev);
922 			return NULL;
923 		}
924 
925 		hc = __get_uuid_cell(param->uuid);
926 		if (!hc)
927 			return NULL;
928 	} else if (*param->name) {
929 		if (param->dev) {
930 			DMERR("Invalid ioctl structure: name %s, dev %llx",
931 			      param->name, (unsigned long long)param->dev);
932 			return NULL;
933 		}
934 
935 		hc = __get_name_cell(param->name);
936 		if (!hc)
937 			return NULL;
938 	} else if (param->dev) {
939 		hc = __get_dev_cell(param->dev);
940 		if (!hc)
941 			return NULL;
942 	} else
943 		return NULL;
944 
945 	/*
946 	 * Sneakily write in both the name and the uuid
947 	 * while we have the cell.
948 	 */
949 	strscpy(param->name, hc->name, sizeof(param->name));
950 	if (hc->uuid)
951 		strscpy(param->uuid, hc->uuid, sizeof(param->uuid));
952 	else
953 		param->uuid[0] = '\0';
954 
955 	if (hc->new_map)
956 		param->flags |= DM_INACTIVE_PRESENT_FLAG;
957 	else
958 		param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
959 
960 	return hc;
961 }
962 
find_device(struct dm_ioctl * param)963 static struct mapped_device *find_device(struct dm_ioctl *param)
964 {
965 	struct hash_cell *hc;
966 	struct mapped_device *md = NULL;
967 
968 	down_read(&_hash_lock);
969 	hc = __find_device_hash_cell(param);
970 	if (hc)
971 		md = hc->md;
972 	up_read(&_hash_lock);
973 
974 	return md;
975 }
976 
dev_remove(struct file * filp,struct dm_ioctl * param,size_t param_size)977 static int dev_remove(struct file *filp, struct dm_ioctl *param, size_t param_size)
978 {
979 	struct hash_cell *hc;
980 	struct mapped_device *md;
981 	int r;
982 	struct dm_table *t;
983 
984 	down_write(&_hash_lock);
985 	hc = __find_device_hash_cell(param);
986 
987 	if (!hc) {
988 		DMDEBUG_LIMIT("device doesn't appear to be in the dev hash table.");
989 		up_write(&_hash_lock);
990 		return -ENXIO;
991 	}
992 
993 	md = hc->md;
994 
995 	/*
996 	 * Ensure the device is not open and nothing further can open it.
997 	 */
998 	r = dm_lock_for_deletion(md, !!(param->flags & DM_DEFERRED_REMOVE), false);
999 	if (r) {
1000 		if (r == -EBUSY && param->flags & DM_DEFERRED_REMOVE) {
1001 			up_write(&_hash_lock);
1002 			dm_put(md);
1003 			return 0;
1004 		}
1005 		DMDEBUG_LIMIT("unable to remove open device %s", hc->name);
1006 		up_write(&_hash_lock);
1007 		dm_put(md);
1008 		return r;
1009 	}
1010 
1011 	t = __hash_remove(hc);
1012 	up_write(&_hash_lock);
1013 
1014 	if (t) {
1015 		dm_sync_table(md);
1016 		dm_table_destroy(t);
1017 	}
1018 
1019 	param->flags &= ~DM_DEFERRED_REMOVE;
1020 
1021 	dm_ima_measure_on_device_remove(md, false);
1022 
1023 	if (!dm_kobject_uevent(md, KOBJ_REMOVE, param->event_nr, false))
1024 		param->flags |= DM_UEVENT_GENERATED_FLAG;
1025 
1026 	dm_put(md);
1027 	dm_destroy(md);
1028 	return 0;
1029 }
1030 
1031 /*
1032  * Check a string doesn't overrun the chunk of
1033  * memory we copied from userland.
1034  */
invalid_str(char * str,void * end)1035 static int invalid_str(char *str, void *end)
1036 {
1037 	while ((void *) str < end)
1038 		if (!*str++)
1039 			return 0;
1040 
1041 	return -EINVAL;
1042 }
1043 
dev_rename(struct file * filp,struct dm_ioctl * param,size_t param_size)1044 static int dev_rename(struct file *filp, struct dm_ioctl *param, size_t param_size)
1045 {
1046 	int r;
1047 	char *new_data = (char *) param + param->data_start;
1048 	struct mapped_device *md;
1049 	unsigned int change_uuid = (param->flags & DM_UUID_FLAG) ? 1 : 0;
1050 
1051 	if (new_data < param->data ||
1052 	    invalid_str(new_data, (void *) param + param_size) || !*new_data ||
1053 	    strlen(new_data) > (change_uuid ? DM_UUID_LEN - 1 : DM_NAME_LEN - 1)) {
1054 		DMERR("Invalid new mapped device name or uuid string supplied.");
1055 		return -EINVAL;
1056 	}
1057 
1058 	if (!change_uuid) {
1059 		r = check_name(new_data);
1060 		if (r)
1061 			return r;
1062 	}
1063 
1064 	md = dm_hash_rename(param, new_data);
1065 	if (IS_ERR(md))
1066 		return PTR_ERR(md);
1067 
1068 	__dev_status(md, param);
1069 	dm_put(md);
1070 
1071 	return 0;
1072 }
1073 
dev_set_geometry(struct file * filp,struct dm_ioctl * param,size_t param_size)1074 static int dev_set_geometry(struct file *filp, struct dm_ioctl *param, size_t param_size)
1075 {
1076 	int r = -EINVAL, x;
1077 	struct mapped_device *md;
1078 	struct hd_geometry geometry;
1079 	unsigned long indata[4];
1080 	char *geostr = (char *) param + param->data_start;
1081 	char dummy;
1082 
1083 	md = find_device(param);
1084 	if (!md)
1085 		return -ENXIO;
1086 
1087 	if (geostr < param->data ||
1088 	    invalid_str(geostr, (void *) param + param_size)) {
1089 		DMERR("Invalid geometry supplied.");
1090 		goto out;
1091 	}
1092 
1093 	x = sscanf(geostr, "%lu %lu %lu %lu%c", indata,
1094 		   indata + 1, indata + 2, indata + 3, &dummy);
1095 
1096 	if (x != 4) {
1097 		DMERR("Unable to interpret geometry settings.");
1098 		goto out;
1099 	}
1100 
1101 	if (indata[0] > 65535 || indata[1] > 255 || indata[2] > 255) {
1102 		DMERR("Geometry exceeds range limits.");
1103 		goto out;
1104 	}
1105 
1106 	geometry.cylinders = indata[0];
1107 	geometry.heads = indata[1];
1108 	geometry.sectors = indata[2];
1109 	geometry.start = indata[3];
1110 
1111 	r = dm_set_geometry(md, &geometry);
1112 
1113 	param->data_size = 0;
1114 
1115 out:
1116 	dm_put(md);
1117 	return r;
1118 }
1119 
do_suspend(struct dm_ioctl * param)1120 static int do_suspend(struct dm_ioctl *param)
1121 {
1122 	int r = 0;
1123 	unsigned int suspend_flags = DM_SUSPEND_LOCKFS_FLAG;
1124 	struct mapped_device *md;
1125 
1126 	md = find_device(param);
1127 	if (!md)
1128 		return -ENXIO;
1129 
1130 	if (param->flags & DM_SKIP_LOCKFS_FLAG)
1131 		suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG;
1132 	if (param->flags & DM_NOFLUSH_FLAG)
1133 		suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;
1134 
1135 	if (!dm_suspended_md(md)) {
1136 		r = dm_suspend(md, suspend_flags);
1137 		if (r)
1138 			goto out;
1139 	}
1140 
1141 	__dev_status(md, param);
1142 
1143 out:
1144 	dm_put(md);
1145 
1146 	return r;
1147 }
1148 
do_resume(struct dm_ioctl * param)1149 static int do_resume(struct dm_ioctl *param)
1150 {
1151 	int r = 0;
1152 	unsigned int suspend_flags = DM_SUSPEND_LOCKFS_FLAG;
1153 	struct hash_cell *hc;
1154 	struct mapped_device *md;
1155 	struct dm_table *new_map, *old_map = NULL;
1156 	bool need_resize_uevent = false;
1157 
1158 	down_write(&_hash_lock);
1159 
1160 	hc = __find_device_hash_cell(param);
1161 	if (!hc) {
1162 		DMDEBUG_LIMIT("device doesn't appear to be in the dev hash table.");
1163 		up_write(&_hash_lock);
1164 		return -ENXIO;
1165 	}
1166 
1167 	md = hc->md;
1168 
1169 	new_map = hc->new_map;
1170 	hc->new_map = NULL;
1171 	param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
1172 
1173 	up_write(&_hash_lock);
1174 
1175 	/* Do we need to load a new map ? */
1176 	if (new_map) {
1177 		sector_t old_size, new_size;
1178 
1179 		/* Suspend if it isn't already suspended */
1180 		if (param->flags & DM_SKIP_LOCKFS_FLAG)
1181 			suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG;
1182 		if (param->flags & DM_NOFLUSH_FLAG)
1183 			suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;
1184 		if (!dm_suspended_md(md)) {
1185 			r = dm_suspend(md, suspend_flags);
1186 			if (r) {
1187 				down_write(&_hash_lock);
1188 				hc = dm_get_mdptr(md);
1189 				if (hc && !hc->new_map) {
1190 					hc->new_map = new_map;
1191 					new_map = NULL;
1192 				} else {
1193 					r = -ENXIO;
1194 				}
1195 				up_write(&_hash_lock);
1196 				if (new_map) {
1197 					dm_sync_table(md);
1198 					dm_table_destroy(new_map);
1199 				}
1200 				dm_put(md);
1201 				return r;
1202 			}
1203 		}
1204 
1205 		old_size = dm_get_size(md);
1206 		old_map = dm_swap_table(md, new_map);
1207 		if (IS_ERR(old_map)) {
1208 			dm_sync_table(md);
1209 			dm_table_destroy(new_map);
1210 			dm_put(md);
1211 			return PTR_ERR(old_map);
1212 		}
1213 		new_size = dm_get_size(md);
1214 		if (old_size && new_size && old_size != new_size)
1215 			need_resize_uevent = true;
1216 
1217 		if (dm_table_get_mode(new_map) & BLK_OPEN_WRITE)
1218 			set_disk_ro(dm_disk(md), 0);
1219 		else
1220 			set_disk_ro(dm_disk(md), 1);
1221 	}
1222 
1223 	if (dm_suspended_md(md)) {
1224 		r = dm_resume(md);
1225 		if (!r) {
1226 			dm_ima_measure_on_device_resume(md, new_map ? true : false);
1227 
1228 			if (!dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr, need_resize_uevent))
1229 				param->flags |= DM_UEVENT_GENERATED_FLAG;
1230 		}
1231 	}
1232 
1233 	/*
1234 	 * Since dm_swap_table synchronizes RCU, nobody should be in
1235 	 * read-side critical section already.
1236 	 */
1237 	if (old_map)
1238 		dm_table_destroy(old_map);
1239 
1240 	if (!r)
1241 		__dev_status(md, param);
1242 
1243 	dm_put(md);
1244 	return r;
1245 }
1246 
1247 /*
1248  * Set or unset the suspension state of a device.
1249  * If the device already is in the requested state we just return its status.
1250  */
dev_suspend(struct file * filp,struct dm_ioctl * param,size_t param_size)1251 static int dev_suspend(struct file *filp, struct dm_ioctl *param, size_t param_size)
1252 {
1253 	if (param->flags & DM_SUSPEND_FLAG)
1254 		return do_suspend(param);
1255 
1256 	return do_resume(param);
1257 }
1258 
1259 /*
1260  * Copies device info back to user space, used by
1261  * the create and info ioctls.
1262  */
dev_status(struct file * filp,struct dm_ioctl * param,size_t param_size)1263 static int dev_status(struct file *filp, struct dm_ioctl *param, size_t param_size)
1264 {
1265 	struct mapped_device *md;
1266 
1267 	md = find_device(param);
1268 	if (!md)
1269 		return -ENXIO;
1270 
1271 	__dev_status(md, param);
1272 	dm_put(md);
1273 
1274 	return 0;
1275 }
1276 
1277 /*
1278  * Build up the status struct for each target
1279  */
retrieve_status(struct dm_table * table,struct dm_ioctl * param,size_t param_size)1280 static void retrieve_status(struct dm_table *table,
1281 			    struct dm_ioctl *param, size_t param_size)
1282 {
1283 	unsigned int i, num_targets;
1284 	struct dm_target_spec *spec;
1285 	char *outbuf, *outptr;
1286 	status_type_t type;
1287 	size_t remaining, len, used = 0;
1288 	unsigned int status_flags = 0;
1289 
1290 	outptr = outbuf = get_result_buffer(param, param_size, &len);
1291 
1292 	if (param->flags & DM_STATUS_TABLE_FLAG)
1293 		type = STATUSTYPE_TABLE;
1294 	else if (param->flags & DM_IMA_MEASUREMENT_FLAG)
1295 		type = STATUSTYPE_IMA;
1296 	else
1297 		type = STATUSTYPE_INFO;
1298 
1299 	/* Get all the target info */
1300 	num_targets = table->num_targets;
1301 	for (i = 0; i < num_targets; i++) {
1302 		struct dm_target *ti = dm_table_get_target(table, i);
1303 		size_t l;
1304 
1305 		remaining = len - (outptr - outbuf);
1306 		if (remaining <= sizeof(struct dm_target_spec)) {
1307 			param->flags |= DM_BUFFER_FULL_FLAG;
1308 			break;
1309 		}
1310 
1311 		spec = (struct dm_target_spec *) outptr;
1312 
1313 		spec->status = 0;
1314 		spec->sector_start = ti->begin;
1315 		spec->length = ti->len;
1316 		strscpy_pad(spec->target_type, ti->type->name,
1317 			sizeof(spec->target_type));
1318 
1319 		outptr += sizeof(struct dm_target_spec);
1320 		remaining = len - (outptr - outbuf);
1321 		if (remaining <= 0) {
1322 			param->flags |= DM_BUFFER_FULL_FLAG;
1323 			break;
1324 		}
1325 
1326 		/* Get the status/table string from the target driver */
1327 		if (ti->type->status) {
1328 			if (param->flags & DM_NOFLUSH_FLAG)
1329 				status_flags |= DM_STATUS_NOFLUSH_FLAG;
1330 			ti->type->status(ti, type, status_flags, outptr, remaining);
1331 		} else
1332 			outptr[0] = '\0';
1333 
1334 		l = strlen(outptr) + 1;
1335 		if (l == remaining) {
1336 			param->flags |= DM_BUFFER_FULL_FLAG;
1337 			break;
1338 		}
1339 
1340 		outptr += l;
1341 		used = param->data_start + (outptr - outbuf);
1342 
1343 		outptr = align_ptr(outptr);
1344 		spec->next = outptr - outbuf;
1345 	}
1346 
1347 	if (used)
1348 		param->data_size = used;
1349 
1350 	param->target_count = num_targets;
1351 }
1352 
1353 /*
1354  * Wait for a device to report an event
1355  */
dev_wait(struct file * filp,struct dm_ioctl * param,size_t param_size)1356 static int dev_wait(struct file *filp, struct dm_ioctl *param, size_t param_size)
1357 {
1358 	int r = 0;
1359 	struct mapped_device *md;
1360 	struct dm_table *table;
1361 	int srcu_idx;
1362 
1363 	md = find_device(param);
1364 	if (!md)
1365 		return -ENXIO;
1366 
1367 	/*
1368 	 * Wait for a notification event
1369 	 */
1370 	if (dm_wait_event(md, param->event_nr)) {
1371 		r = -ERESTARTSYS;
1372 		goto out;
1373 	}
1374 
1375 	/*
1376 	 * The userland program is going to want to know what
1377 	 * changed to trigger the event, so we may as well tell
1378 	 * him and save an ioctl.
1379 	 */
1380 	__dev_status(md, param);
1381 
1382 	table = dm_get_live_or_inactive_table(md, param, &srcu_idx);
1383 	if (table)
1384 		retrieve_status(table, param, param_size);
1385 	dm_put_live_table(md, srcu_idx);
1386 
1387 out:
1388 	dm_put(md);
1389 
1390 	return r;
1391 }
1392 
1393 /*
1394  * Remember the global event number and make it possible to poll
1395  * for further events.
1396  */
dev_arm_poll(struct file * filp,struct dm_ioctl * param,size_t param_size)1397 static int dev_arm_poll(struct file *filp, struct dm_ioctl *param, size_t param_size)
1398 {
1399 	struct dm_file *priv = filp->private_data;
1400 
1401 	priv->global_event_nr = atomic_read(&dm_global_event_nr);
1402 
1403 	return 0;
1404 }
1405 
get_mode(struct dm_ioctl * param)1406 static inline blk_mode_t get_mode(struct dm_ioctl *param)
1407 {
1408 	blk_mode_t mode = BLK_OPEN_READ | BLK_OPEN_WRITE;
1409 
1410 	if (param->flags & DM_READONLY_FLAG)
1411 		mode = BLK_OPEN_READ;
1412 
1413 	return mode;
1414 }
1415 
next_target(struct dm_target_spec * last,uint32_t next,const char * end,struct dm_target_spec ** spec,char ** target_params)1416 static int next_target(struct dm_target_spec *last, uint32_t next, const char *end,
1417 		       struct dm_target_spec **spec, char **target_params)
1418 {
1419 	static_assert(__alignof__(struct dm_target_spec) <= 8,
1420 		"struct dm_target_spec must not require more than 8-byte alignment");
1421 
1422 	/*
1423 	 * Number of bytes remaining, starting with last. This is always
1424 	 * sizeof(struct dm_target_spec) or more, as otherwise *last was
1425 	 * out of bounds already.
1426 	 */
1427 	size_t remaining = end - (char *)last;
1428 
1429 	/*
1430 	 * There must be room for both the next target spec and the
1431 	 * NUL-terminator of the target itself.
1432 	 */
1433 	if (remaining - sizeof(struct dm_target_spec) <= next) {
1434 		DMERR("Target spec extends beyond end of parameters");
1435 		return -EINVAL;
1436 	}
1437 
1438 	if (next % __alignof__(struct dm_target_spec)) {
1439 		DMERR("Next dm_target_spec (offset %u) is not %zu-byte aligned",
1440 		      next, __alignof__(struct dm_target_spec));
1441 		return -EINVAL;
1442 	}
1443 
1444 	*spec = (struct dm_target_spec *) ((unsigned char *) last + next);
1445 	*target_params = (char *) (*spec + 1);
1446 
1447 	return 0;
1448 }
1449 
populate_table(struct dm_table * table,struct dm_ioctl * param,size_t param_size)1450 static int populate_table(struct dm_table *table,
1451 			  struct dm_ioctl *param, size_t param_size)
1452 {
1453 	int r;
1454 	unsigned int i = 0;
1455 	struct dm_target_spec *spec = (struct dm_target_spec *) param;
1456 	uint32_t next = param->data_start;
1457 	const char *const end = (const char *) param + param_size;
1458 	char *target_params;
1459 	size_t min_size = sizeof(struct dm_ioctl);
1460 
1461 	if (!param->target_count) {
1462 		DMERR("%s: no targets specified", __func__);
1463 		return -EINVAL;
1464 	}
1465 
1466 	for (i = 0; i < param->target_count; i++) {
1467 		const char *nul_terminator;
1468 
1469 		if (next < min_size) {
1470 			DMERR("%s: next target spec (offset %u) overlaps %s",
1471 			      __func__, next, i ? "previous target" : "'struct dm_ioctl'");
1472 			return -EINVAL;
1473 		}
1474 
1475 		r = next_target(spec, next, end, &spec, &target_params);
1476 		if (r) {
1477 			DMERR("unable to find target");
1478 			return r;
1479 		}
1480 
1481 		nul_terminator = memchr(target_params, 0, (size_t)(end - target_params));
1482 		if (nul_terminator == NULL) {
1483 			DMERR("%s: target parameters not NUL-terminated", __func__);
1484 			return -EINVAL;
1485 		}
1486 
1487 		/* Add 1 for NUL terminator */
1488 		min_size = (size_t)(nul_terminator - (const char *)spec) + 1;
1489 
1490 		r = dm_table_add_target(table, spec->target_type,
1491 					(sector_t) spec->sector_start,
1492 					(sector_t) spec->length,
1493 					target_params);
1494 		if (r) {
1495 			DMERR("error adding target to table");
1496 			return r;
1497 		}
1498 
1499 		next = spec->next;
1500 	}
1501 
1502 	return dm_table_complete(table);
1503 }
1504 
is_valid_type(enum dm_queue_mode cur,enum dm_queue_mode new)1505 static bool is_valid_type(enum dm_queue_mode cur, enum dm_queue_mode new)
1506 {
1507 	if (cur == new ||
1508 	    (cur == DM_TYPE_BIO_BASED && new == DM_TYPE_DAX_BIO_BASED))
1509 		return true;
1510 
1511 	return false;
1512 }
1513 
table_load(struct file * filp,struct dm_ioctl * param,size_t param_size)1514 static int table_load(struct file *filp, struct dm_ioctl *param, size_t param_size)
1515 {
1516 	int r;
1517 	struct hash_cell *hc;
1518 	struct dm_table *t, *old_map = NULL;
1519 	struct mapped_device *md;
1520 	struct target_type *immutable_target_type;
1521 
1522 	md = find_device(param);
1523 	if (!md)
1524 		return -ENXIO;
1525 
1526 	r = dm_table_create(&t, get_mode(param), param->target_count, md);
1527 	if (r)
1528 		goto err;
1529 
1530 	/* Protect md->type and md->queue against concurrent table loads. */
1531 	dm_lock_md_type(md);
1532 	r = populate_table(t, param, param_size);
1533 	if (r)
1534 		goto err_unlock_md_type;
1535 
1536 	dm_ima_measure_on_table_load(t, STATUSTYPE_IMA);
1537 
1538 	immutable_target_type = dm_get_immutable_target_type(md);
1539 	if (immutable_target_type &&
1540 	    (immutable_target_type != dm_table_get_immutable_target_type(t)) &&
1541 	    !dm_table_get_wildcard_target(t)) {
1542 		DMERR("can't replace immutable target type %s",
1543 		      immutable_target_type->name);
1544 		r = -EINVAL;
1545 		goto err_unlock_md_type;
1546 	}
1547 
1548 	if (dm_get_md_type(md) == DM_TYPE_NONE) {
1549 		/* setup md->queue to reflect md's type (may block) */
1550 		r = dm_setup_md_queue(md, t);
1551 		if (r) {
1552 			DMERR("unable to set up device queue for new table.");
1553 			goto err_unlock_md_type;
1554 		}
1555 	} else if (!is_valid_type(dm_get_md_type(md), dm_table_get_type(t))) {
1556 		DMERR("can't change device type (old=%u vs new=%u) after initial table load.",
1557 		      dm_get_md_type(md), dm_table_get_type(t));
1558 		r = -EINVAL;
1559 		goto err_unlock_md_type;
1560 	}
1561 
1562 	dm_unlock_md_type(md);
1563 
1564 	/* stage inactive table */
1565 	down_write(&_hash_lock);
1566 	hc = dm_get_mdptr(md);
1567 	if (!hc) {
1568 		DMERR("device has been removed from the dev hash table.");
1569 		up_write(&_hash_lock);
1570 		r = -ENXIO;
1571 		goto err_destroy_table;
1572 	}
1573 
1574 	if (hc->new_map)
1575 		old_map = hc->new_map;
1576 	hc->new_map = t;
1577 	up_write(&_hash_lock);
1578 
1579 	param->flags |= DM_INACTIVE_PRESENT_FLAG;
1580 	__dev_status(md, param);
1581 
1582 	if (old_map) {
1583 		dm_sync_table(md);
1584 		dm_table_destroy(old_map);
1585 	}
1586 
1587 	dm_put(md);
1588 
1589 	return 0;
1590 
1591 err_unlock_md_type:
1592 	dm_unlock_md_type(md);
1593 err_destroy_table:
1594 	dm_table_destroy(t);
1595 err:
1596 	dm_put(md);
1597 
1598 	return r;
1599 }
1600 
table_clear(struct file * filp,struct dm_ioctl * param,size_t param_size)1601 static int table_clear(struct file *filp, struct dm_ioctl *param, size_t param_size)
1602 {
1603 	struct hash_cell *hc;
1604 	struct mapped_device *md;
1605 	struct dm_table *old_map = NULL;
1606 	bool has_new_map = false;
1607 
1608 	down_write(&_hash_lock);
1609 
1610 	hc = __find_device_hash_cell(param);
1611 	if (!hc) {
1612 		DMDEBUG_LIMIT("device doesn't appear to be in the dev hash table.");
1613 		up_write(&_hash_lock);
1614 		return -ENXIO;
1615 	}
1616 
1617 	if (hc->new_map) {
1618 		old_map = hc->new_map;
1619 		hc->new_map = NULL;
1620 		has_new_map = true;
1621 	}
1622 
1623 	md = hc->md;
1624 	up_write(&_hash_lock);
1625 
1626 	param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
1627 	__dev_status(md, param);
1628 
1629 	if (old_map) {
1630 		dm_sync_table(md);
1631 		dm_table_destroy(old_map);
1632 	}
1633 	dm_ima_measure_on_table_clear(md, has_new_map);
1634 	dm_put(md);
1635 
1636 	return 0;
1637 }
1638 
1639 /*
1640  * Retrieves a list of devices used by a particular dm device.
1641  */
retrieve_deps(struct dm_table * table,struct dm_ioctl * param,size_t param_size)1642 static void retrieve_deps(struct dm_table *table,
1643 			  struct dm_ioctl *param, size_t param_size)
1644 {
1645 	unsigned int count = 0;
1646 	struct list_head *tmp;
1647 	size_t len, needed;
1648 	struct dm_dev_internal *dd;
1649 	struct dm_target_deps *deps;
1650 
1651 	down_read(&table->devices_lock);
1652 
1653 	deps = get_result_buffer(param, param_size, &len);
1654 
1655 	/*
1656 	 * Count the devices.
1657 	 */
1658 	list_for_each(tmp, dm_table_get_devices(table))
1659 		count++;
1660 
1661 	/*
1662 	 * Check we have enough space.
1663 	 */
1664 	needed = struct_size(deps, dev, count);
1665 	if (len < needed) {
1666 		param->flags |= DM_BUFFER_FULL_FLAG;
1667 		goto out;
1668 	}
1669 
1670 	/*
1671 	 * Fill in the devices.
1672 	 */
1673 	deps->count = count;
1674 	count = 0;
1675 	list_for_each_entry(dd, dm_table_get_devices(table), list)
1676 		deps->dev[count++] = huge_encode_dev(dd->dm_dev->bdev->bd_dev);
1677 
1678 	param->data_size = param->data_start + needed;
1679 
1680 out:
1681 	up_read(&table->devices_lock);
1682 }
1683 
table_deps(struct file * filp,struct dm_ioctl * param,size_t param_size)1684 static int table_deps(struct file *filp, struct dm_ioctl *param, size_t param_size)
1685 {
1686 	struct mapped_device *md;
1687 	struct dm_table *table;
1688 	int srcu_idx;
1689 
1690 	md = find_device(param);
1691 	if (!md)
1692 		return -ENXIO;
1693 
1694 	__dev_status(md, param);
1695 
1696 	table = dm_get_live_or_inactive_table(md, param, &srcu_idx);
1697 	if (table)
1698 		retrieve_deps(table, param, param_size);
1699 	dm_put_live_table(md, srcu_idx);
1700 
1701 	dm_put(md);
1702 
1703 	return 0;
1704 }
1705 
1706 /*
1707  * Return the status of a device as a text string for each
1708  * target.
1709  */
table_status(struct file * filp,struct dm_ioctl * param,size_t param_size)1710 static int table_status(struct file *filp, struct dm_ioctl *param, size_t param_size)
1711 {
1712 	struct mapped_device *md;
1713 	struct dm_table *table;
1714 	int srcu_idx;
1715 
1716 	md = find_device(param);
1717 	if (!md)
1718 		return -ENXIO;
1719 
1720 	__dev_status(md, param);
1721 
1722 	table = dm_get_live_or_inactive_table(md, param, &srcu_idx);
1723 	if (table)
1724 		retrieve_status(table, param, param_size);
1725 	dm_put_live_table(md, srcu_idx);
1726 
1727 	dm_put(md);
1728 
1729 	return 0;
1730 }
1731 
1732 /*
1733  * Process device-mapper dependent messages.  Messages prefixed with '@'
1734  * are processed by the DM core.  All others are delivered to the target.
1735  * Returns a number <= 1 if message was processed by device mapper.
1736  * Returns 2 if message should be delivered to the target.
1737  */
message_for_md(struct mapped_device * md,unsigned int argc,char ** argv,char * result,unsigned int maxlen)1738 static int message_for_md(struct mapped_device *md, unsigned int argc, char **argv,
1739 			  char *result, unsigned int maxlen)
1740 {
1741 	int r;
1742 
1743 	if (**argv != '@')
1744 		return 2; /* no '@' prefix, deliver to target */
1745 
1746 	if (!strcasecmp(argv[0], "@cancel_deferred_remove")) {
1747 		if (argc != 1) {
1748 			DMERR("Invalid arguments for @cancel_deferred_remove");
1749 			return -EINVAL;
1750 		}
1751 		return dm_cancel_deferred_remove(md);
1752 	}
1753 
1754 	r = dm_stats_message(md, argc, argv, result, maxlen);
1755 	if (r < 2)
1756 		return r;
1757 
1758 	DMERR("Unsupported message sent to DM core: %s", argv[0]);
1759 	return -EINVAL;
1760 }
1761 
1762 /*
1763  * Pass a message to the target that's at the supplied device offset.
1764  */
target_message(struct file * filp,struct dm_ioctl * param,size_t param_size)1765 static int target_message(struct file *filp, struct dm_ioctl *param, size_t param_size)
1766 {
1767 	int r, argc;
1768 	char **argv;
1769 	struct mapped_device *md;
1770 	struct dm_table *table;
1771 	struct dm_target *ti;
1772 	struct dm_target_msg *tmsg = (void *) param + param->data_start;
1773 	size_t maxlen;
1774 	char *result = get_result_buffer(param, param_size, &maxlen);
1775 	int srcu_idx;
1776 
1777 	md = find_device(param);
1778 	if (!md)
1779 		return -ENXIO;
1780 
1781 	if (tmsg < (struct dm_target_msg *) param->data ||
1782 	    invalid_str(tmsg->message, (void *) param + param_size)) {
1783 		DMERR("Invalid target message parameters.");
1784 		r = -EINVAL;
1785 		goto out;
1786 	}
1787 
1788 	r = dm_split_args(&argc, &argv, tmsg->message);
1789 	if (r) {
1790 		DMERR("Failed to split target message parameters");
1791 		goto out;
1792 	}
1793 
1794 	if (!argc) {
1795 		DMERR("Empty message received.");
1796 		r = -EINVAL;
1797 		goto out_argv;
1798 	}
1799 
1800 	r = message_for_md(md, argc, argv, result, maxlen);
1801 	if (r <= 1)
1802 		goto out_argv;
1803 
1804 	table = dm_get_live_table(md, &srcu_idx);
1805 	if (!table)
1806 		goto out_table;
1807 
1808 	if (dm_deleting_md(md)) {
1809 		r = -ENXIO;
1810 		goto out_table;
1811 	}
1812 
1813 	ti = dm_table_find_target(table, tmsg->sector);
1814 	if (!ti) {
1815 		DMERR("Target message sector outside device.");
1816 		r = -EINVAL;
1817 	} else if (ti->type->message)
1818 		r = ti->type->message(ti, argc, argv, result, maxlen);
1819 	else {
1820 		DMERR("Target type does not support messages");
1821 		r = -EINVAL;
1822 	}
1823 
1824  out_table:
1825 	dm_put_live_table(md, srcu_idx);
1826  out_argv:
1827 	kfree(argv);
1828  out:
1829 	if (r >= 0)
1830 		__dev_status(md, param);
1831 
1832 	if (r == 1) {
1833 		param->flags |= DM_DATA_OUT_FLAG;
1834 		if (dm_message_test_buffer_overflow(result, maxlen))
1835 			param->flags |= DM_BUFFER_FULL_FLAG;
1836 		else
1837 			param->data_size = param->data_start + strlen(result) + 1;
1838 		r = 0;
1839 	}
1840 
1841 	dm_put(md);
1842 	return r;
1843 }
1844 
1845 /*
1846  * The ioctl parameter block consists of two parts, a dm_ioctl struct
1847  * followed by a data buffer.  This flag is set if the second part,
1848  * which has a variable size, is not used by the function processing
1849  * the ioctl.
1850  */
1851 #define IOCTL_FLAGS_NO_PARAMS		1
1852 #define IOCTL_FLAGS_ISSUE_GLOBAL_EVENT	2
1853 
1854 /*
1855  *---------------------------------------------------------------
1856  * Implementation of open/close/ioctl on the special char device.
1857  *---------------------------------------------------------------
1858  */
lookup_ioctl(unsigned int cmd,int * ioctl_flags)1859 static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
1860 {
1861 	static const struct {
1862 		int cmd;
1863 		int flags;
1864 		ioctl_fn fn;
1865 	} _ioctls[] = {
1866 		{DM_VERSION_CMD, 0, NULL}, /* version is dealt with elsewhere */
1867 		{DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, remove_all},
1868 		{DM_LIST_DEVICES_CMD, 0, list_devices},
1869 
1870 		{DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_create},
1871 		{DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_remove},
1872 		{DM_DEV_RENAME_CMD, IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_rename},
1873 		{DM_DEV_SUSPEND_CMD, IOCTL_FLAGS_NO_PARAMS, dev_suspend},
1874 		{DM_DEV_STATUS_CMD, IOCTL_FLAGS_NO_PARAMS, dev_status},
1875 		{DM_DEV_WAIT_CMD, 0, dev_wait},
1876 
1877 		{DM_TABLE_LOAD_CMD, 0, table_load},
1878 		{DM_TABLE_CLEAR_CMD, IOCTL_FLAGS_NO_PARAMS, table_clear},
1879 		{DM_TABLE_DEPS_CMD, 0, table_deps},
1880 		{DM_TABLE_STATUS_CMD, 0, table_status},
1881 
1882 		{DM_LIST_VERSIONS_CMD, 0, list_versions},
1883 
1884 		{DM_TARGET_MSG_CMD, 0, target_message},
1885 		{DM_DEV_SET_GEOMETRY_CMD, 0, dev_set_geometry},
1886 		{DM_DEV_ARM_POLL_CMD, IOCTL_FLAGS_NO_PARAMS, dev_arm_poll},
1887 		{DM_GET_TARGET_VERSION_CMD, 0, get_target_version},
1888 	};
1889 
1890 	if (unlikely(cmd >= ARRAY_SIZE(_ioctls)))
1891 		return NULL;
1892 
1893 	cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls));
1894 	*ioctl_flags = _ioctls[cmd].flags;
1895 	return _ioctls[cmd].fn;
1896 }
1897 
1898 /*
1899  * As well as checking the version compatibility this always
1900  * copies the kernel interface version out.
1901  */
check_version(unsigned int cmd,struct dm_ioctl __user * user,struct dm_ioctl * kernel_params)1902 static int check_version(unsigned int cmd, struct dm_ioctl __user *user,
1903 			 struct dm_ioctl *kernel_params)
1904 {
1905 	int r = 0;
1906 
1907 	/* Make certain version is first member of dm_ioctl struct */
1908 	BUILD_BUG_ON(offsetof(struct dm_ioctl, version) != 0);
1909 
1910 	if (copy_from_user(kernel_params->version, user->version, sizeof(kernel_params->version)))
1911 		return -EFAULT;
1912 
1913 	if ((kernel_params->version[0] != DM_VERSION_MAJOR) ||
1914 	    (kernel_params->version[1] > DM_VERSION_MINOR)) {
1915 		DMERR("ioctl interface mismatch: kernel(%u.%u.%u), user(%u.%u.%u), cmd(%d)",
1916 		      DM_VERSION_MAJOR, DM_VERSION_MINOR,
1917 		      DM_VERSION_PATCHLEVEL,
1918 		      kernel_params->version[0],
1919 		      kernel_params->version[1],
1920 		      kernel_params->version[2],
1921 		      cmd);
1922 		r = -EINVAL;
1923 	}
1924 
1925 	/*
1926 	 * Fill in the kernel version.
1927 	 */
1928 	kernel_params->version[0] = DM_VERSION_MAJOR;
1929 	kernel_params->version[1] = DM_VERSION_MINOR;
1930 	kernel_params->version[2] = DM_VERSION_PATCHLEVEL;
1931 	if (copy_to_user(user->version, kernel_params->version, sizeof(kernel_params->version)))
1932 		return -EFAULT;
1933 
1934 	return r;
1935 }
1936 
1937 #define DM_PARAMS_MALLOC	0x0001	/* Params allocated with kvmalloc() */
1938 #define DM_WIPE_BUFFER		0x0010	/* Wipe input buffer before returning from ioctl */
1939 
free_params(struct dm_ioctl * param,size_t param_size,int param_flags)1940 static void free_params(struct dm_ioctl *param, size_t param_size, int param_flags)
1941 {
1942 	if (param_flags & DM_WIPE_BUFFER)
1943 		memset(param, 0, param_size);
1944 
1945 	if (param_flags & DM_PARAMS_MALLOC)
1946 		kvfree(param);
1947 }
1948 
copy_params(struct dm_ioctl __user * user,struct dm_ioctl * param_kernel,int ioctl_flags,struct dm_ioctl ** param,int * param_flags)1949 static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kernel,
1950 		       int ioctl_flags, struct dm_ioctl **param, int *param_flags)
1951 {
1952 	struct dm_ioctl *dmi;
1953 	int secure_data;
1954 	const size_t minimum_data_size = offsetof(struct dm_ioctl, data);
1955 
1956 	/* check_version() already copied version from userspace, avoid TOCTOU */
1957 	if (copy_from_user((char *)param_kernel + sizeof(param_kernel->version),
1958 			   (char __user *)user + sizeof(param_kernel->version),
1959 			   minimum_data_size - sizeof(param_kernel->version)))
1960 		return -EFAULT;
1961 
1962 	if (unlikely(param_kernel->data_size < minimum_data_size) ||
1963 	    unlikely(param_kernel->data_size > DM_MAX_TARGETS * DM_MAX_TARGET_PARAMS)) {
1964 		DMERR("Invalid data size in the ioctl structure: %u",
1965 		      param_kernel->data_size);
1966 		return -EINVAL;
1967 	}
1968 
1969 	secure_data = param_kernel->flags & DM_SECURE_DATA_FLAG;
1970 
1971 	*param_flags = secure_data ? DM_WIPE_BUFFER : 0;
1972 
1973 	if (ioctl_flags & IOCTL_FLAGS_NO_PARAMS) {
1974 		dmi = param_kernel;
1975 		dmi->data_size = minimum_data_size;
1976 		goto data_copied;
1977 	}
1978 
1979 	/*
1980 	 * Use __GFP_HIGH to avoid low memory issues when a device is
1981 	 * suspended and the ioctl is needed to resume it.
1982 	 * Use kmalloc() rather than vmalloc() when we can.
1983 	 */
1984 	dmi = NULL;
1985 	dmi = kvmalloc(param_kernel->data_size, GFP_NOIO | __GFP_HIGH);
1986 
1987 	if (!dmi) {
1988 		if (secure_data && clear_user(user, param_kernel->data_size))
1989 			return -EFAULT;
1990 		return -ENOMEM;
1991 	}
1992 
1993 	*param_flags |= DM_PARAMS_MALLOC;
1994 
1995 	/* Copy from param_kernel (which was already copied from user) */
1996 	memcpy(dmi, param_kernel, minimum_data_size);
1997 
1998 	if (copy_from_user(&dmi->data, (char __user *)user + minimum_data_size,
1999 			   param_kernel->data_size - minimum_data_size))
2000 		goto bad;
2001 data_copied:
2002 	/* Wipe the user buffer so we do not return it to userspace */
2003 	if (secure_data && clear_user(user, param_kernel->data_size))
2004 		goto bad;
2005 
2006 	*param = dmi;
2007 	return 0;
2008 
2009 bad:
2010 	free_params(dmi, param_kernel->data_size, *param_flags);
2011 
2012 	return -EFAULT;
2013 }
2014 
validate_params(uint cmd,struct dm_ioctl * param)2015 static int validate_params(uint cmd, struct dm_ioctl *param)
2016 {
2017 	/* Always clear this flag */
2018 	param->flags &= ~DM_BUFFER_FULL_FLAG;
2019 	param->flags &= ~DM_UEVENT_GENERATED_FLAG;
2020 	param->flags &= ~DM_SECURE_DATA_FLAG;
2021 	param->flags &= ~DM_DATA_OUT_FLAG;
2022 
2023 	/* Ignores parameters */
2024 	if (cmd == DM_REMOVE_ALL_CMD ||
2025 	    cmd == DM_LIST_DEVICES_CMD ||
2026 	    cmd == DM_LIST_VERSIONS_CMD)
2027 		return 0;
2028 
2029 	if (cmd == DM_DEV_CREATE_CMD) {
2030 		if (!*param->name) {
2031 			DMERR("name not supplied when creating device");
2032 			return -EINVAL;
2033 		}
2034 	} else if (*param->uuid && *param->name) {
2035 		DMERR("only supply one of name or uuid, cmd(%u)", cmd);
2036 		return -EINVAL;
2037 	}
2038 
2039 	/* Ensure strings are terminated */
2040 	param->name[DM_NAME_LEN - 1] = '\0';
2041 	param->uuid[DM_UUID_LEN - 1] = '\0';
2042 
2043 	return 0;
2044 }
2045 
ctl_ioctl(struct file * file,uint command,struct dm_ioctl __user * user)2046 static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *user)
2047 {
2048 	int r = 0;
2049 	int ioctl_flags;
2050 	int param_flags;
2051 	unsigned int cmd;
2052 	struct dm_ioctl *param;
2053 	ioctl_fn fn = NULL;
2054 	size_t input_param_size;
2055 	struct dm_ioctl param_kernel;
2056 
2057 	/* only root can play with this */
2058 	if (!capable(CAP_SYS_ADMIN))
2059 		return -EACCES;
2060 
2061 	if (_IOC_TYPE(command) != DM_IOCTL)
2062 		return -ENOTTY;
2063 
2064 	cmd = _IOC_NR(command);
2065 
2066 	/*
2067 	 * Check the interface version passed in.  This also
2068 	 * writes out the kernel's interface version.
2069 	 */
2070 	r = check_version(cmd, user, &param_kernel);
2071 	if (r)
2072 		return r;
2073 
2074 	/*
2075 	 * Nothing more to do for the version command.
2076 	 */
2077 	if (cmd == DM_VERSION_CMD)
2078 		return 0;
2079 
2080 	fn = lookup_ioctl(cmd, &ioctl_flags);
2081 	if (!fn) {
2082 		DMERR("dm_ctl_ioctl: unknown command 0x%x", command);
2083 		return -ENOTTY;
2084 	}
2085 
2086 	/*
2087 	 * Copy the parameters into kernel space.
2088 	 */
2089 	r = copy_params(user, &param_kernel, ioctl_flags, &param, &param_flags);
2090 
2091 	if (r)
2092 		return r;
2093 
2094 	input_param_size = param->data_size;
2095 	r = validate_params(cmd, param);
2096 	if (r)
2097 		goto out;
2098 
2099 	param->data_size = offsetof(struct dm_ioctl, data);
2100 	r = fn(file, param, input_param_size);
2101 
2102 	if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) &&
2103 	    unlikely(ioctl_flags & IOCTL_FLAGS_NO_PARAMS))
2104 		DMERR("ioctl %d tried to output some data but has IOCTL_FLAGS_NO_PARAMS set", cmd);
2105 
2106 	if (!r && ioctl_flags & IOCTL_FLAGS_ISSUE_GLOBAL_EVENT)
2107 		dm_issue_global_event();
2108 
2109 	/*
2110 	 * Copy the results back to userland.
2111 	 */
2112 	if (!r && copy_to_user(user, param, param->data_size))
2113 		r = -EFAULT;
2114 
2115 out:
2116 	free_params(param, input_param_size, param_flags);
2117 	return r;
2118 }
2119 
dm_ctl_ioctl(struct file * file,uint command,ulong u)2120 static long dm_ctl_ioctl(struct file *file, uint command, ulong u)
2121 {
2122 	return (long)ctl_ioctl(file, command, (struct dm_ioctl __user *)u);
2123 }
2124 
2125 #ifdef CONFIG_COMPAT
dm_compat_ctl_ioctl(struct file * file,uint command,ulong u)2126 static long dm_compat_ctl_ioctl(struct file *file, uint command, ulong u)
2127 {
2128 	return (long)dm_ctl_ioctl(file, command, (ulong) compat_ptr(u));
2129 }
2130 #else
2131 #define dm_compat_ctl_ioctl NULL
2132 #endif
2133 
dm_open(struct inode * inode,struct file * filp)2134 static int dm_open(struct inode *inode, struct file *filp)
2135 {
2136 	int r;
2137 	struct dm_file *priv;
2138 
2139 	r = nonseekable_open(inode, filp);
2140 	if (unlikely(r))
2141 		return r;
2142 
2143 	priv = filp->private_data = kmalloc(sizeof(struct dm_file), GFP_KERNEL);
2144 	if (!priv)
2145 		return -ENOMEM;
2146 
2147 	priv->global_event_nr = atomic_read(&dm_global_event_nr);
2148 
2149 	return 0;
2150 }
2151 
dm_release(struct inode * inode,struct file * filp)2152 static int dm_release(struct inode *inode, struct file *filp)
2153 {
2154 	kfree(filp->private_data);
2155 	return 0;
2156 }
2157 
dm_poll(struct file * filp,poll_table * wait)2158 static __poll_t dm_poll(struct file *filp, poll_table *wait)
2159 {
2160 	struct dm_file *priv = filp->private_data;
2161 	__poll_t mask = 0;
2162 
2163 	poll_wait(filp, &dm_global_eventq, wait);
2164 
2165 	if ((int)(atomic_read(&dm_global_event_nr) - priv->global_event_nr) > 0)
2166 		mask |= EPOLLIN;
2167 
2168 	return mask;
2169 }
2170 
2171 static const struct file_operations _ctl_fops = {
2172 	.open    = dm_open,
2173 	.release = dm_release,
2174 	.poll    = dm_poll,
2175 	.unlocked_ioctl	 = dm_ctl_ioctl,
2176 	.compat_ioctl = dm_compat_ctl_ioctl,
2177 	.owner	 = THIS_MODULE,
2178 	.llseek  = noop_llseek,
2179 };
2180 
2181 static struct miscdevice _dm_misc = {
2182 	.minor		= MAPPER_CTRL_MINOR,
2183 	.name		= DM_NAME,
2184 	.nodename	= DM_DIR "/" DM_CONTROL_NODE,
2185 	.fops		= &_ctl_fops
2186 };
2187 
2188 MODULE_ALIAS_MISCDEV(MAPPER_CTRL_MINOR);
2189 MODULE_ALIAS("devname:" DM_DIR "/" DM_CONTROL_NODE);
2190 
2191 /*
2192  * Create misc character device and link to DM_DIR/control.
2193  */
dm_interface_init(void)2194 int __init dm_interface_init(void)
2195 {
2196 	int r;
2197 
2198 	r = misc_register(&_dm_misc);
2199 	if (r) {
2200 		DMERR("misc_register failed for control device");
2201 		return r;
2202 	}
2203 
2204 	DMINFO("%d.%d.%d%s initialised: %s", DM_VERSION_MAJOR,
2205 	       DM_VERSION_MINOR, DM_VERSION_PATCHLEVEL, DM_VERSION_EXTRA,
2206 	       DM_DRIVER_EMAIL);
2207 	return 0;
2208 }
2209 
dm_interface_exit(void)2210 void dm_interface_exit(void)
2211 {
2212 	misc_deregister(&_dm_misc);
2213 	dm_hash_exit();
2214 }
2215 
2216 /**
2217  * dm_copy_name_and_uuid - Copy mapped device name & uuid into supplied buffers
2218  * @md: Pointer to mapped_device
2219  * @name: Buffer (size DM_NAME_LEN) for name
2220  * @uuid: Buffer (size DM_UUID_LEN) for uuid or empty string if uuid not defined
2221  */
dm_copy_name_and_uuid(struct mapped_device * md,char * name,char * uuid)2222 int dm_copy_name_and_uuid(struct mapped_device *md, char *name, char *uuid)
2223 {
2224 	int r = 0;
2225 	struct hash_cell *hc;
2226 
2227 	if (!md)
2228 		return -ENXIO;
2229 
2230 	mutex_lock(&dm_hash_cells_mutex);
2231 	hc = dm_get_mdptr(md);
2232 	if (!hc) {
2233 		r = -ENXIO;
2234 		goto out;
2235 	}
2236 
2237 	if (name)
2238 		strcpy(name, hc->name);
2239 	if (uuid)
2240 		strcpy(uuid, hc->uuid ? : "");
2241 
2242 out:
2243 	mutex_unlock(&dm_hash_cells_mutex);
2244 
2245 	return r;
2246 }
2247 EXPORT_SYMBOL_GPL(dm_copy_name_and_uuid);
2248 
2249 /**
2250  * dm_early_create - create a mapped device in early boot.
2251  *
2252  * @dmi: Contains main information of the device mapping to be created.
2253  * @spec_array: array of pointers to struct dm_target_spec. Describes the
2254  * mapping table of the device.
2255  * @target_params_array: array of strings with the parameters to a specific
2256  * target.
2257  *
2258  * Instead of having the struct dm_target_spec and the parameters for every
2259  * target embedded at the end of struct dm_ioctl (as performed in a normal
2260  * ioctl), pass them as arguments, so the caller doesn't need to serialize them.
2261  * The size of the spec_array and target_params_array is given by
2262  * @dmi->target_count.
2263  * This function is supposed to be called in early boot, so locking mechanisms
2264  * to protect against concurrent loads are not required.
2265  */
dm_early_create(struct dm_ioctl * dmi,struct dm_target_spec ** spec_array,char ** target_params_array)2266 int __init dm_early_create(struct dm_ioctl *dmi,
2267 			   struct dm_target_spec **spec_array,
2268 			   char **target_params_array)
2269 {
2270 	int r, m = DM_ANY_MINOR;
2271 	struct dm_table *t, *old_map;
2272 	struct mapped_device *md;
2273 	unsigned int i;
2274 
2275 	if (!dmi->target_count)
2276 		return -EINVAL;
2277 
2278 	r = check_name(dmi->name);
2279 	if (r)
2280 		return r;
2281 
2282 	if (dmi->flags & DM_PERSISTENT_DEV_FLAG)
2283 		m = MINOR(huge_decode_dev(dmi->dev));
2284 
2285 	/* alloc dm device */
2286 	r = dm_create(m, &md);
2287 	if (r)
2288 		return r;
2289 
2290 	/* hash insert */
2291 	r = dm_hash_insert(dmi->name, *dmi->uuid ? dmi->uuid : NULL, md);
2292 	if (r)
2293 		goto err_destroy_dm;
2294 
2295 	/* alloc table */
2296 	r = dm_table_create(&t, get_mode(dmi), dmi->target_count, md);
2297 	if (r)
2298 		goto err_hash_remove;
2299 
2300 	/* add targets */
2301 	for (i = 0; i < dmi->target_count; i++) {
2302 		r = dm_table_add_target(t, spec_array[i]->target_type,
2303 					(sector_t) spec_array[i]->sector_start,
2304 					(sector_t) spec_array[i]->length,
2305 					target_params_array[i]);
2306 		if (r) {
2307 			DMERR("error adding target to table");
2308 			goto err_destroy_table;
2309 		}
2310 	}
2311 
2312 	/* finish table */
2313 	r = dm_table_complete(t);
2314 	if (r)
2315 		goto err_destroy_table;
2316 
2317 	/* setup md->queue to reflect md's type (may block) */
2318 	r = dm_setup_md_queue(md, t);
2319 	if (r) {
2320 		DMERR("unable to set up device queue for new table.");
2321 		goto err_destroy_table;
2322 	}
2323 
2324 	/* Set new map */
2325 	dm_suspend(md, 0);
2326 	old_map = dm_swap_table(md, t);
2327 	if (IS_ERR(old_map)) {
2328 		r = PTR_ERR(old_map);
2329 		goto err_destroy_table;
2330 	}
2331 	set_disk_ro(dm_disk(md), !!(dmi->flags & DM_READONLY_FLAG));
2332 
2333 	/* resume device */
2334 	r = dm_resume(md);
2335 	if (r)
2336 		goto err_destroy_table;
2337 
2338 	DMINFO("%s (%s) is ready", md->disk->disk_name, dmi->name);
2339 	dm_put(md);
2340 	return 0;
2341 
2342 err_destroy_table:
2343 	dm_table_destroy(t);
2344 err_hash_remove:
2345 	down_write(&_hash_lock);
2346 	(void) __hash_remove(__get_name_cell(dmi->name));
2347 	up_write(&_hash_lock);
2348 	/* release reference from __get_name_cell */
2349 	dm_put(md);
2350 err_destroy_dm:
2351 	dm_put(md);
2352 	dm_destroy(md);
2353 	return r;
2354 }
2355