1 /*-
2 * SPDX-License-Identifier: BSD-3-Clause
3 *
4 * Copyright (c) 1999-2004 Poul-Henning Kamp
5 * Copyright (c) 1999 Michael Smith
6 * Copyright (c) 1989, 1993
7 * The Regents of the University of California. All rights reserved.
8 * (c) UNIX System Laboratories, Inc.
9 * All or some portions of this file are derived from material licensed
10 * to the University of California by American Telephone and Telegraph
11 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
12 * the permission of UNIX System Laboratories, Inc.
13 *
14 * Redistribution and use in source and binary forms, with or without
15 * modification, are permitted provided that the following conditions
16 * are met:
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 * 2. Redistributions in binary form must reproduce the above copyright
20 * notice, this list of conditions and the following disclaimer in the
21 * documentation and/or other materials provided with the distribution.
22 * 3. Neither the name of the University nor the names of its contributors
23 * may be used to endorse or promote products derived from this software
24 * without specific prior written permission.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * SUCH DAMAGE.
37 */
38
39 #include <sys/param.h>
40 #include <sys/conf.h>
41 #include <sys/smp.h>
42 #include <sys/devctl.h>
43 #include <sys/eventhandler.h>
44 #include <sys/fcntl.h>
45 #include <sys/jail.h>
46 #include <sys/kernel.h>
47 #include <sys/ktr.h>
48 #include <sys/libkern.h>
49 #include <sys/limits.h>
50 #include <sys/malloc.h>
51 #include <sys/mount.h>
52 #include <sys/mutex.h>
53 #include <sys/namei.h>
54 #include <sys/priv.h>
55 #include <sys/proc.h>
56 #include <sys/filedesc.h>
57 #include <sys/reboot.h>
58 #include <sys/sbuf.h>
59 #include <sys/stdarg.h>
60 #include <sys/syscallsubr.h>
61 #include <sys/sysproto.h>
62 #include <sys/sx.h>
63 #include <sys/sysctl.h>
64 #include <sys/systm.h>
65 #include <sys/taskqueue.h>
66 #include <sys/vnode.h>
67 #include <vm/uma.h>
68
69 #include <netinet/in.h>
70 #include <net/radix.h>
71 #include <sys/netexport.h>
72
73 #include <geom/geom.h>
74
75 #include <security/audit/audit.h>
76 #include <security/mac/mac_framework.h>
77
78 #define VFS_MOUNTARG_SIZE_MAX (1024 * 64)
79
80 static int vfs_domount(struct thread *td, const char *fstype, char *fspath,
81 uint64_t fsflags, bool only_export, bool jail_export,
82 struct vfsoptlist **optlist);
83 static void free_mntarg(struct mntarg *ma);
84 static void pnfsd_waitreplenish(struct mount *mp);
85
86 static int usermount = 0;
87 SYSCTL_INT(_vfs, OID_AUTO, usermount, CTLFLAG_RW, &usermount, 0,
88 "Unprivileged users may mount and unmount file systems");
89
90 static bool default_autoro = false;
91 SYSCTL_BOOL(_vfs, OID_AUTO, default_autoro, CTLFLAG_RW, &default_autoro, 0,
92 "Retry failed r/w mount as r/o if no explicit ro/rw option is specified");
93
94 static bool recursive_forced_unmount = false;
95 SYSCTL_BOOL(_vfs, OID_AUTO, recursive_forced_unmount, CTLFLAG_RW,
96 &recursive_forced_unmount, 0, "Recursively unmount stacked upper mounts"
97 " when a file system is forcibly unmounted");
98
99 static SYSCTL_NODE(_vfs, OID_AUTO, deferred_unmount,
100 CTLFLAG_RD | CTLFLAG_MPSAFE, 0, "deferred unmount controls");
101
102 static unsigned int deferred_unmount_retry_limit = 10;
103 SYSCTL_UINT(_vfs_deferred_unmount, OID_AUTO, retry_limit, CTLFLAG_RW,
104 &deferred_unmount_retry_limit, 0,
105 "Maximum number of retries for deferred unmount failure");
106
107 static int deferred_unmount_retry_delay_hz;
108 SYSCTL_INT(_vfs_deferred_unmount, OID_AUTO, retry_delay_hz, CTLFLAG_RW,
109 &deferred_unmount_retry_delay_hz, 0,
110 "Delay in units of [1/kern.hz]s when retrying a failed deferred unmount");
111
112 static int deferred_unmount_total_retries = 0;
113 SYSCTL_INT(_vfs_deferred_unmount, OID_AUTO, total_retries, CTLFLAG_RD,
114 &deferred_unmount_total_retries, 0,
115 "Total number of retried deferred unmounts");
116
117 MALLOC_DEFINE(M_MOUNT, "mount", "vfs mount structure");
118 MALLOC_DEFINE(M_STATFS, "statfs", "statfs structure");
119 static uma_zone_t mount_zone;
120
121 /* List of mounted filesystems. */
122 struct mntlist mountlist = TAILQ_HEAD_INITIALIZER(mountlist);
123
124 /* For any iteration/modification of mountlist */
125 struct mtx_padalign __exclusive_cache_line mountlist_mtx;
126
127 EVENTHANDLER_LIST_DEFINE(vfs_mounted);
128 EVENTHANDLER_LIST_DEFINE(vfs_unmounted);
129
130 static void vfs_deferred_unmount(void *arg, int pending);
131 static struct timeout_task deferred_unmount_task;
132 static struct mtx deferred_unmount_lock;
133 MTX_SYSINIT(deferred_unmount, &deferred_unmount_lock, "deferred_unmount",
134 MTX_DEF);
135 static STAILQ_HEAD(, mount) deferred_unmount_list =
136 STAILQ_HEAD_INITIALIZER(deferred_unmount_list);
137 TASKQUEUE_DEFINE_THREAD(deferred_unmount);
138
139 static void mount_devctl_event(const char *type, struct mount *mp, bool donew);
140
141 /*
142 * Global opts, taken by all filesystems
143 */
144 static const char *global_opts[] = {
145 "errmsg",
146 "fstype",
147 "fspath",
148 "ro",
149 "rw",
150 "nosuid",
151 "noexec",
152 NULL
153 };
154
155 static int
mount_init(void * mem,int size,int flags)156 mount_init(void *mem, int size, int flags)
157 {
158 struct mount *mp;
159
160 mp = (struct mount *)mem;
161 mtx_init(&mp->mnt_mtx, "struct mount mtx", NULL, MTX_DEF);
162 mtx_init(&mp->mnt_listmtx, "struct mount vlist mtx", NULL, MTX_DEF);
163 lockinit(&mp->mnt_explock, PVFS, "explock", 0, 0);
164 lockinit(&mp->mnt_renamelock, PVFS, "rename", 0, 0);
165 mp->mnt_pcpu = uma_zalloc_pcpu(pcpu_zone_16, M_WAITOK | M_ZERO);
166 mp->mnt_ref = 0;
167 mp->mnt_vfs_ops = 1;
168 mp->mnt_rootvnode = NULL;
169 return (0);
170 }
171
172 static void
mount_fini(void * mem,int size)173 mount_fini(void *mem, int size)
174 {
175 struct mount *mp;
176
177 mp = (struct mount *)mem;
178 uma_zfree_pcpu(pcpu_zone_16, mp->mnt_pcpu);
179 lockdestroy(&mp->mnt_renamelock);
180 lockdestroy(&mp->mnt_explock);
181 mtx_destroy(&mp->mnt_listmtx);
182 mtx_destroy(&mp->mnt_mtx);
183 }
184
185 static void
vfs_mount_init(void * dummy __unused)186 vfs_mount_init(void *dummy __unused)
187 {
188 TIMEOUT_TASK_INIT(taskqueue_deferred_unmount, &deferred_unmount_task,
189 0, vfs_deferred_unmount, NULL);
190 deferred_unmount_retry_delay_hz = hz;
191 mount_zone = uma_zcreate("Mountpoints", sizeof(struct mount), NULL,
192 NULL, mount_init, mount_fini, UMA_ALIGN_CACHE, UMA_ZONE_NOFREE);
193 mtx_init(&mountlist_mtx, "mountlist", NULL, MTX_DEF);
194 }
195 SYSINIT(vfs_mount, SI_SUB_VFS, SI_ORDER_ANY, vfs_mount_init, NULL);
196
197 /*
198 * ---------------------------------------------------------------------
199 * Functions for building and sanitizing the mount options
200 */
201
202 /* Remove one mount option. */
203 static void
vfs_freeopt(struct vfsoptlist * opts,struct vfsopt * opt)204 vfs_freeopt(struct vfsoptlist *opts, struct vfsopt *opt)
205 {
206
207 TAILQ_REMOVE(opts, opt, link);
208 free(opt->name, M_MOUNT);
209 if (opt->value != NULL)
210 free(opt->value, M_MOUNT);
211 free(opt, M_MOUNT);
212 }
213
214 /* Release all resources related to the mount options. */
215 void
vfs_freeopts(struct vfsoptlist * opts)216 vfs_freeopts(struct vfsoptlist *opts)
217 {
218 struct vfsopt *opt;
219
220 while (!TAILQ_EMPTY(opts)) {
221 opt = TAILQ_FIRST(opts);
222 vfs_freeopt(opts, opt);
223 }
224 free(opts, M_MOUNT);
225 }
226
227 void
vfs_deleteopt(struct vfsoptlist * opts,const char * name)228 vfs_deleteopt(struct vfsoptlist *opts, const char *name)
229 {
230 struct vfsopt *opt, *temp;
231
232 if (opts == NULL)
233 return;
234 TAILQ_FOREACH_SAFE(opt, opts, link, temp) {
235 if (strcmp(opt->name, name) == 0)
236 vfs_freeopt(opts, opt);
237 }
238 }
239
240 static int
vfs_isopt_ro(const char * opt)241 vfs_isopt_ro(const char *opt)
242 {
243
244 if (strcmp(opt, "ro") == 0 || strcmp(opt, "rdonly") == 0 ||
245 strcmp(opt, "norw") == 0)
246 return (1);
247 return (0);
248 }
249
250 static int
vfs_isopt_rw(const char * opt)251 vfs_isopt_rw(const char *opt)
252 {
253
254 if (strcmp(opt, "rw") == 0 || strcmp(opt, "noro") == 0)
255 return (1);
256 return (0);
257 }
258
259 /*
260 * Check if options are equal (with or without the "no" prefix).
261 */
262 static int
vfs_equalopts(const char * opt1,const char * opt2)263 vfs_equalopts(const char *opt1, const char *opt2)
264 {
265 char *p;
266
267 /* "opt" vs. "opt" or "noopt" vs. "noopt" */
268 if (strcmp(opt1, opt2) == 0)
269 return (1);
270 /* "noopt" vs. "opt" */
271 if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
272 return (1);
273 /* "opt" vs. "noopt" */
274 if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
275 return (1);
276 while ((p = strchr(opt1, '.')) != NULL &&
277 !strncmp(opt1, opt2, ++p - opt1)) {
278 opt2 += p - opt1;
279 opt1 = p;
280 /* "foo.noopt" vs. "foo.opt" */
281 if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
282 return (1);
283 /* "foo.opt" vs. "foo.noopt" */
284 if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
285 return (1);
286 }
287 /* "ro" / "rdonly" / "norw" / "rw" / "noro" */
288 if ((vfs_isopt_ro(opt1) || vfs_isopt_rw(opt1)) &&
289 (vfs_isopt_ro(opt2) || vfs_isopt_rw(opt2)))
290 return (1);
291 return (0);
292 }
293
294 /*
295 * If a mount option is specified several times,
296 * (with or without the "no" prefix) only keep
297 * the last occurrence of it.
298 */
299 static void
vfs_sanitizeopts(struct vfsoptlist * opts)300 vfs_sanitizeopts(struct vfsoptlist *opts)
301 {
302 struct vfsopt *opt, *opt2, *tmp;
303
304 TAILQ_FOREACH_REVERSE(opt, opts, vfsoptlist, link) {
305 opt2 = TAILQ_PREV(opt, vfsoptlist, link);
306 while (opt2 != NULL) {
307 if (vfs_equalopts(opt->name, opt2->name)) {
308 tmp = TAILQ_PREV(opt2, vfsoptlist, link);
309 vfs_freeopt(opts, opt2);
310 opt2 = tmp;
311 } else {
312 opt2 = TAILQ_PREV(opt2, vfsoptlist, link);
313 }
314 }
315 }
316 }
317
318 /*
319 * Build a linked list of mount options from a struct uio.
320 */
321 int
vfs_buildopts(struct uio * auio,struct vfsoptlist ** options)322 vfs_buildopts(struct uio *auio, struct vfsoptlist **options)
323 {
324 struct vfsoptlist *opts;
325 struct vfsopt *opt;
326 size_t memused, namelen, optlen;
327 unsigned int i, iovcnt;
328 int error;
329
330 opts = malloc(sizeof(struct vfsoptlist), M_MOUNT, M_WAITOK);
331 TAILQ_INIT(opts);
332 memused = 0;
333 iovcnt = auio->uio_iovcnt;
334 for (i = 0; i < iovcnt; i += 2) {
335 namelen = auio->uio_iov[i].iov_len;
336 optlen = auio->uio_iov[i + 1].iov_len;
337 memused += sizeof(struct vfsopt) + optlen + namelen;
338 /*
339 * Avoid consuming too much memory, and attempts to overflow
340 * memused.
341 */
342 if (memused > VFS_MOUNTARG_SIZE_MAX ||
343 optlen > VFS_MOUNTARG_SIZE_MAX ||
344 namelen > VFS_MOUNTARG_SIZE_MAX) {
345 error = EINVAL;
346 goto bad;
347 }
348
349 opt = malloc(sizeof(struct vfsopt), M_MOUNT, M_WAITOK);
350 opt->name = malloc(namelen, M_MOUNT, M_WAITOK);
351 opt->value = NULL;
352 opt->len = 0;
353 opt->pos = i / 2;
354 opt->seen = 0;
355
356 /*
357 * Do this early, so jumps to "bad" will free the current
358 * option.
359 */
360 TAILQ_INSERT_TAIL(opts, opt, link);
361
362 if (auio->uio_segflg == UIO_SYSSPACE) {
363 bcopy(auio->uio_iov[i].iov_base, opt->name, namelen);
364 } else {
365 error = copyin(auio->uio_iov[i].iov_base, opt->name,
366 namelen);
367 if (error)
368 goto bad;
369 }
370 /* Ensure names are null-terminated strings. */
371 if (namelen == 0 || opt->name[namelen - 1] != '\0') {
372 error = EINVAL;
373 goto bad;
374 }
375 if (optlen != 0) {
376 opt->len = optlen;
377 opt->value = malloc(optlen, M_MOUNT, M_WAITOK);
378 if (auio->uio_segflg == UIO_SYSSPACE) {
379 bcopy(auio->uio_iov[i + 1].iov_base, opt->value,
380 optlen);
381 } else {
382 error = copyin(auio->uio_iov[i + 1].iov_base,
383 opt->value, optlen);
384 if (error)
385 goto bad;
386 }
387 }
388 }
389 vfs_sanitizeopts(opts);
390 *options = opts;
391 return (0);
392 bad:
393 vfs_freeopts(opts);
394 return (error);
395 }
396
397 /*
398 * Merge the old mount options with the new ones passed
399 * in the MNT_UPDATE case.
400 *
401 * XXX: This function will keep a "nofoo" option in the new
402 * options. E.g, if the option's canonical name is "foo",
403 * "nofoo" ends up in the mount point's active options.
404 */
405 static void
vfs_mergeopts(struct vfsoptlist * toopts,struct vfsoptlist * oldopts)406 vfs_mergeopts(struct vfsoptlist *toopts, struct vfsoptlist *oldopts)
407 {
408 struct vfsopt *opt, *new;
409
410 TAILQ_FOREACH(opt, oldopts, link) {
411 new = malloc(sizeof(struct vfsopt), M_MOUNT, M_WAITOK);
412 new->name = strdup(opt->name, M_MOUNT);
413 if (opt->len != 0) {
414 new->value = malloc(opt->len, M_MOUNT, M_WAITOK);
415 bcopy(opt->value, new->value, opt->len);
416 } else
417 new->value = NULL;
418 new->len = opt->len;
419 new->seen = opt->seen;
420 TAILQ_INSERT_HEAD(toopts, new, link);
421 }
422 vfs_sanitizeopts(toopts);
423 }
424
425 /*
426 * Mount a filesystem.
427 */
428 #ifndef _SYS_SYSPROTO_H_
429 struct nmount_args {
430 struct iovec *iovp;
431 unsigned int iovcnt;
432 int flags;
433 };
434 #endif
435 int
sys_nmount(struct thread * td,struct nmount_args * uap)436 sys_nmount(struct thread *td, struct nmount_args *uap)
437 {
438 struct uio *auio;
439 int error;
440 u_int iovcnt;
441 uint64_t flags;
442
443 /*
444 * Mount flags are now 64-bits. On 32-bit archtectures only
445 * 32-bits are passed in, but from here on everything handles
446 * 64-bit flags correctly.
447 */
448 flags = uap->flags;
449
450 AUDIT_ARG_FFLAGS(flags);
451 CTR4(KTR_VFS, "%s: iovp %p with iovcnt %d and flags %d", __func__,
452 uap->iovp, uap->iovcnt, flags);
453
454 /*
455 * Filter out MNT_ROOTFS. We do not want clients of nmount() in
456 * userspace to set this flag, but we must filter it out if we want
457 * MNT_UPDATE on the root file system to work.
458 * MNT_ROOTFS should only be set by the kernel when mounting its
459 * root file system.
460 */
461 flags &= ~MNT_ROOTFS;
462
463 iovcnt = uap->iovcnt;
464 /*
465 * Check that we have an even number of iovec's
466 * and that we have at least two options.
467 */
468 if ((iovcnt & 1) || (iovcnt < 4)) {
469 CTR2(KTR_VFS, "%s: failed for invalid iovcnt %d", __func__,
470 uap->iovcnt);
471 return (EINVAL);
472 }
473
474 error = copyinuio(uap->iovp, iovcnt, &auio);
475 if (error) {
476 CTR2(KTR_VFS, "%s: failed for invalid uio op with %d errno",
477 __func__, error);
478 return (error);
479 }
480 error = vfs_donmount(td, flags, auio);
481
482 freeuio(auio);
483 return (error);
484 }
485
486 /*
487 * ---------------------------------------------------------------------
488 * Various utility functions
489 */
490
491 /*
492 * Get a reference on a mount point from a vnode.
493 *
494 * The vnode is allowed to be passed unlocked and race against dooming. Note in
495 * such case there are no guarantees the referenced mount point will still be
496 * associated with it after the function returns.
497 */
498 struct mount *
vfs_ref_from_vp(struct vnode * vp)499 vfs_ref_from_vp(struct vnode *vp)
500 {
501 struct mount *mp;
502 struct mount_pcpu *mpcpu;
503
504 mp = atomic_load_ptr(&vp->v_mount);
505 if (__predict_false(mp == NULL)) {
506 return (mp);
507 }
508 if (vfs_op_thread_enter(mp, &mpcpu)) {
509 if (__predict_true(mp == vp->v_mount)) {
510 vfs_mp_count_add_pcpu(mpcpu, ref, 1);
511 vfs_op_thread_exit(mp, mpcpu);
512 } else {
513 vfs_op_thread_exit(mp, mpcpu);
514 mp = NULL;
515 }
516 } else {
517 MNT_ILOCK(mp);
518 if (mp == vp->v_mount) {
519 MNT_REF(mp);
520 MNT_IUNLOCK(mp);
521 } else {
522 MNT_IUNLOCK(mp);
523 mp = NULL;
524 }
525 }
526 return (mp);
527 }
528
529 void
vfs_ref(struct mount * mp)530 vfs_ref(struct mount *mp)
531 {
532 struct mount_pcpu *mpcpu;
533
534 CTR2(KTR_VFS, "%s: mp %p", __func__, mp);
535 if (vfs_op_thread_enter(mp, &mpcpu)) {
536 vfs_mp_count_add_pcpu(mpcpu, ref, 1);
537 vfs_op_thread_exit(mp, mpcpu);
538 return;
539 }
540
541 MNT_ILOCK(mp);
542 MNT_REF(mp);
543 MNT_IUNLOCK(mp);
544 }
545
546 /*
547 * Register ump as an upper mount of the mount associated with
548 * vnode vp. This registration will be tracked through
549 * mount_upper_node upper, which should be allocated by the
550 * caller and stored in per-mount data associated with mp.
551 *
552 * If successful, this function will return the mount associated
553 * with vp, and will ensure that it cannot be unmounted until
554 * ump has been unregistered as one of its upper mounts.
555 *
556 * Upon failure this function will return NULL.
557 */
558 struct mount *
vfs_register_upper_from_vp(struct vnode * vp,struct mount * ump,struct mount_upper_node * upper)559 vfs_register_upper_from_vp(struct vnode *vp, struct mount *ump,
560 struct mount_upper_node *upper)
561 {
562 struct mount *mp;
563
564 mp = atomic_load_ptr(&vp->v_mount);
565 if (mp == NULL)
566 return (NULL);
567 MNT_ILOCK(mp);
568 if (mp != vp->v_mount ||
569 ((mp->mnt_kern_flag & (MNTK_UNMOUNT | MNTK_RECURSE)) != 0)) {
570 MNT_IUNLOCK(mp);
571 return (NULL);
572 }
573 KASSERT(ump != mp, ("upper and lower mounts are identical"));
574 upper->mp = ump;
575 MNT_REF(mp);
576 TAILQ_INSERT_TAIL(&mp->mnt_uppers, upper, mnt_upper_link);
577 MNT_IUNLOCK(mp);
578 return (mp);
579 }
580
581 /*
582 * Register upper mount ump to receive vnode unlink/reclaim
583 * notifications from lower mount mp. This registration will
584 * be tracked through mount_upper_node upper, which should be
585 * allocated by the caller and stored in per-mount data
586 * associated with mp.
587 *
588 * ump must already be registered as an upper mount of mp
589 * through a call to vfs_register_upper_from_vp().
590 */
591 void
vfs_register_for_notification(struct mount * mp,struct mount * ump,struct mount_upper_node * upper)592 vfs_register_for_notification(struct mount *mp, struct mount *ump,
593 struct mount_upper_node *upper)
594 {
595 upper->mp = ump;
596 MNT_ILOCK(mp);
597 TAILQ_INSERT_TAIL(&mp->mnt_notify, upper, mnt_upper_link);
598 MNT_IUNLOCK(mp);
599 }
600
601 static void
vfs_drain_upper_locked(struct mount * mp)602 vfs_drain_upper_locked(struct mount *mp)
603 {
604 mtx_assert(MNT_MTX(mp), MA_OWNED);
605 while (mp->mnt_upper_pending != 0) {
606 mp->mnt_kern_flag |= MNTK_UPPER_WAITER;
607 msleep(&mp->mnt_uppers, MNT_MTX(mp), 0, "mntupw", 0);
608 }
609 }
610
611 /*
612 * Undo a previous call to vfs_register_for_notification().
613 * The mount represented by upper must be currently registered
614 * as an upper mount for mp.
615 */
616 void
vfs_unregister_for_notification(struct mount * mp,struct mount_upper_node * upper)617 vfs_unregister_for_notification(struct mount *mp,
618 struct mount_upper_node *upper)
619 {
620 MNT_ILOCK(mp);
621 vfs_drain_upper_locked(mp);
622 TAILQ_REMOVE(&mp->mnt_notify, upper, mnt_upper_link);
623 MNT_IUNLOCK(mp);
624 }
625
626 /*
627 * Undo a previous call to vfs_register_upper_from_vp().
628 * This must be done before mp can be unmounted.
629 */
630 void
vfs_unregister_upper(struct mount * mp,struct mount_upper_node * upper)631 vfs_unregister_upper(struct mount *mp, struct mount_upper_node *upper)
632 {
633 MNT_ILOCK(mp);
634 KASSERT((mp->mnt_kern_flag & MNTK_UNMOUNT) == 0,
635 ("registered upper with pending unmount"));
636 vfs_drain_upper_locked(mp);
637 TAILQ_REMOVE(&mp->mnt_uppers, upper, mnt_upper_link);
638 if ((mp->mnt_kern_flag & MNTK_TASKQUEUE_WAITER) != 0 &&
639 TAILQ_EMPTY(&mp->mnt_uppers)) {
640 mp->mnt_kern_flag &= ~MNTK_TASKQUEUE_WAITER;
641 wakeup(&mp->mnt_taskqueue_link);
642 }
643 MNT_REL(mp);
644 MNT_IUNLOCK(mp);
645 }
646
647 void
vfs_rel(struct mount * mp)648 vfs_rel(struct mount *mp)
649 {
650 struct mount_pcpu *mpcpu;
651
652 CTR2(KTR_VFS, "%s: mp %p", __func__, mp);
653 if (vfs_op_thread_enter(mp, &mpcpu)) {
654 vfs_mp_count_sub_pcpu(mpcpu, ref, 1);
655 vfs_op_thread_exit(mp, mpcpu);
656 return;
657 }
658
659 MNT_ILOCK(mp);
660 MNT_REL(mp);
661 MNT_IUNLOCK(mp);
662 }
663
664 /*
665 * Allocate and initialize the mount point struct.
666 */
667 struct mount *
vfs_mount_alloc(struct vnode * vp,struct vfsconf * vfsp,const char * fspath,struct ucred * cred)668 vfs_mount_alloc(struct vnode *vp, struct vfsconf *vfsp, const char *fspath,
669 struct ucred *cred)
670 {
671 struct mount *mp;
672
673 mp = uma_zalloc(mount_zone, M_WAITOK);
674 bzero(&mp->mnt_startzero,
675 __rangeof(struct mount, mnt_startzero, mnt_endzero));
676 mp->mnt_kern_flag = 0;
677 mp->mnt_flag = 0;
678 mp->mnt_rootvnode = NULL;
679 mp->mnt_vnodecovered = NULL;
680 mp->mnt_op = NULL;
681 mp->mnt_vfc = NULL;
682 TAILQ_INIT(&mp->mnt_nvnodelist);
683 mp->mnt_nvnodelistsize = 0;
684 TAILQ_INIT(&mp->mnt_lazyvnodelist);
685 mp->mnt_lazyvnodelistsize = 0;
686 MPPASS(mp->mnt_ref == 0 && mp->mnt_lockref == 0 &&
687 mp->mnt_writeopcount == 0, mp);
688 MPASSERT(mp->mnt_vfs_ops == 1, mp,
689 ("vfs_ops should be 1 but %d found", mp->mnt_vfs_ops));
690 (void) vfs_busy(mp, MBF_NOWAIT);
691 mp->mnt_op = vfsp->vfc_vfsops;
692 mp->mnt_vfc = vfsp;
693 mp->mnt_stat.f_type = vfsp->vfc_typenum;
694 mp->mnt_gen++;
695 strlcpy(mp->mnt_stat.f_fstypename, vfsp->vfc_name, MFSNAMELEN);
696 mp->mnt_vnodecovered = vp;
697 mp->mnt_cred = crdup(cred);
698 mp->mnt_stat.f_owner = cred->cr_uid;
699 strlcpy(mp->mnt_stat.f_mntonname, fspath, MNAMELEN);
700 mp->mnt_iosize_max = DFLTPHYS;
701 #ifdef MAC
702 mac_mount_init(mp);
703 mac_mount_create(cred, mp);
704 #endif
705 arc4rand(&mp->mnt_hashseed, sizeof mp->mnt_hashseed, 0);
706 mp->mnt_upper_pending = 0;
707 TAILQ_INIT(&mp->mnt_uppers);
708 TAILQ_INIT(&mp->mnt_notify);
709 mp->mnt_taskqueue_flags = 0;
710 mp->mnt_unmount_retries = 0;
711 return (mp);
712 }
713
714 /*
715 * Destroy the mount struct previously allocated by vfs_mount_alloc().
716 */
717 void
vfs_mount_destroy(struct mount * mp)718 vfs_mount_destroy(struct mount *mp)
719 {
720
721 MPPASS(mp->mnt_vfs_ops != 0, mp);
722
723 vfs_assert_mount_counters(mp);
724
725 MNT_ILOCK(mp);
726 mp->mnt_kern_flag |= MNTK_REFEXPIRE;
727 if (mp->mnt_kern_flag & MNTK_MWAIT) {
728 mp->mnt_kern_flag &= ~MNTK_MWAIT;
729 wakeup(mp);
730 }
731 while (mp->mnt_ref)
732 msleep(mp, MNT_MTX(mp), PVFS, "mntref", 0);
733 KASSERT(mp->mnt_ref == 0,
734 ("%s: invalid refcount in the drain path @ %s:%d", __func__,
735 __FILE__, __LINE__));
736 MPPASS(mp->mnt_writeopcount == 0, mp);
737 MPPASS(mp->mnt_secondary_writes == 0, mp);
738 if (!TAILQ_EMPTY(&mp->mnt_nvnodelist)) {
739 struct vnode *vp;
740
741 TAILQ_FOREACH(vp, &mp->mnt_nvnodelist, v_nmntvnodes)
742 vn_printf(vp, "dangling vnode ");
743 panic("unmount: dangling vnode");
744 }
745 KASSERT(mp->mnt_upper_pending == 0, ("mnt_upper_pending"));
746 KASSERT(TAILQ_EMPTY(&mp->mnt_uppers), ("mnt_uppers"));
747 KASSERT(TAILQ_EMPTY(&mp->mnt_notify), ("mnt_notify"));
748 MPPASS(mp->mnt_nvnodelistsize == 0, mp);
749 MPPASS(mp->mnt_lazyvnodelistsize == 0, mp);
750 MPPASS(mp->mnt_lockref == 0, mp);
751 MNT_IUNLOCK(mp);
752
753 MPASSERT(mp->mnt_vfs_ops == 1, mp,
754 ("vfs_ops should be 1 but %d found", mp->mnt_vfs_ops));
755
756 MPASSERT(mp->mnt_rootvnode == NULL, mp,
757 ("mount point still has a root vnode %p", mp->mnt_rootvnode));
758
759 if (mp->mnt_vnodecovered != NULL)
760 vrele(mp->mnt_vnodecovered);
761 #ifdef MAC
762 mac_mount_destroy(mp);
763 #endif
764 if (mp->mnt_opt != NULL)
765 vfs_freeopts(mp->mnt_opt);
766 if (mp->mnt_exjail != NULL) {
767 atomic_subtract_int(&mp->mnt_exjail->cr_prison->pr_exportcnt,
768 1);
769 crfree(mp->mnt_exjail);
770 }
771 if (mp->mnt_export != NULL) {
772 vfs_free_addrlist(mp->mnt_export);
773 vfs_netexport_release(mp->mnt_export);
774 }
775 vfsconf_lock();
776 mp->mnt_vfc->vfc_refcount--;
777 vfsconf_unlock();
778 crfree(mp->mnt_cred);
779 uma_zfree(mount_zone, mp);
780 }
781
782 static bool
vfs_should_downgrade_to_ro_mount(uint64_t fsflags,int error)783 vfs_should_downgrade_to_ro_mount(uint64_t fsflags, int error)
784 {
785 /* This is an upgrade of an exisiting mount. */
786 if ((fsflags & MNT_UPDATE) != 0)
787 return (false);
788 /* This is already an R/O mount. */
789 if ((fsflags & MNT_RDONLY) != 0)
790 return (false);
791
792 switch (error) {
793 case ENODEV: /* generic, geom, ... */
794 case EACCES: /* cam/scsi, ... */
795 case EROFS: /* md, mmcsd, ... */
796 /*
797 * These errors can be returned by the storage layer to signal
798 * that the media is read-only. No harm in the R/O mount
799 * attempt if the error was returned for some other reason.
800 */
801 return (true);
802 default:
803 return (false);
804 }
805 }
806
807 int
vfs_donmount(struct thread * td,uint64_t fsflags,struct uio * fsoptions)808 vfs_donmount(struct thread *td, uint64_t fsflags, struct uio *fsoptions)
809 {
810 struct vfsoptlist *optlist;
811 struct vfsopt *opt, *tmp_opt;
812 char *fstype, *fspath, *errmsg;
813 int error, fstypelen, fspathlen, errmsg_len, errmsg_pos;
814 bool autoro, has_nonexport, only_export, jail_export;
815
816 errmsg = fspath = NULL;
817 errmsg_len = fspathlen = 0;
818 errmsg_pos = -1;
819 autoro = default_autoro;
820
821 error = vfs_buildopts(fsoptions, &optlist);
822 if (error)
823 return (error);
824
825 if (vfs_getopt(optlist, "errmsg", (void **)&errmsg, &errmsg_len) == 0)
826 errmsg_pos = vfs_getopt_pos(optlist, "errmsg");
827
828 /*
829 * We need these two options before the others,
830 * and they are mandatory for any filesystem.
831 * Ensure they are NUL terminated as well.
832 */
833 fstypelen = 0;
834 error = vfs_getopt(optlist, "fstype", (void **)&fstype, &fstypelen);
835 if (error || fstypelen <= 0 || fstype[fstypelen - 1] != '\0') {
836 error = EINVAL;
837 if (errmsg != NULL)
838 strncpy(errmsg, "Invalid fstype", errmsg_len);
839 goto bail;
840 }
841 fspathlen = 0;
842 error = vfs_getopt(optlist, "fspath", (void **)&fspath, &fspathlen);
843 if (error || fspathlen <= 0 || fspath[fspathlen - 1] != '\0') {
844 error = EINVAL;
845 if (errmsg != NULL)
846 strncpy(errmsg, "Invalid fspath", errmsg_len);
847 goto bail;
848 }
849
850 /*
851 * Check to see that "export" is only used with the "update", "fstype",
852 * "fspath", "from" and "errmsg" options when in a vnet jail.
853 * These are the ones used to set/update exports by mountd(8).
854 * If only the above options are set in a jail that can run mountd(8),
855 * then the jail_export argument of vfs_domount() will be true.
856 * When jail_export is true, the vfs_suser() check does not cause
857 * failure, but limits the update to exports only.
858 * This allows mountd(8) running within the vnet jail
859 * to export file systems visible within the jail, but
860 * mounted outside of the jail.
861 */
862 /*
863 * We need to see if we have the "update" option
864 * before we call vfs_domount(), since vfs_domount() has special
865 * logic based on MNT_UPDATE. This is very important
866 * when we want to update the root filesystem.
867 */
868 has_nonexport = false;
869 only_export = false;
870 TAILQ_FOREACH_SAFE(opt, optlist, link, tmp_opt) {
871 int do_freeopt = 0;
872
873 if (strcmp(opt->name, "export") != 0 &&
874 strcmp(opt->name, "update") != 0 &&
875 strcmp(opt->name, "fstype") != 0 &&
876 strcmp(opt->name, "fspath") != 0 &&
877 strcmp(opt->name, "from") != 0 &&
878 strcmp(opt->name, "errmsg") != 0)
879 has_nonexport = true;
880 if (strcmp(opt->name, "update") == 0) {
881 fsflags |= MNT_UPDATE;
882 do_freeopt = 1;
883 }
884 else if (strcmp(opt->name, "async") == 0)
885 fsflags |= MNT_ASYNC;
886 else if (strcmp(opt->name, "force") == 0) {
887 fsflags |= MNT_FORCE;
888 do_freeopt = 1;
889 }
890 else if (strcmp(opt->name, "reload") == 0) {
891 fsflags |= MNT_RELOAD;
892 do_freeopt = 1;
893 }
894 else if (strcmp(opt->name, "multilabel") == 0)
895 fsflags |= MNT_MULTILABEL;
896 else if (strcmp(opt->name, "noasync") == 0)
897 fsflags &= ~MNT_ASYNC;
898 else if (strcmp(opt->name, "noatime") == 0)
899 fsflags |= MNT_NOATIME;
900 else if (strcmp(opt->name, "atime") == 0) {
901 free(opt->name, M_MOUNT);
902 opt->name = strdup("nonoatime", M_MOUNT);
903 }
904 else if (strcmp(opt->name, "noclusterr") == 0)
905 fsflags |= MNT_NOCLUSTERR;
906 else if (strcmp(opt->name, "clusterr") == 0) {
907 free(opt->name, M_MOUNT);
908 opt->name = strdup("nonoclusterr", M_MOUNT);
909 }
910 else if (strcmp(opt->name, "noclusterw") == 0)
911 fsflags |= MNT_NOCLUSTERW;
912 else if (strcmp(opt->name, "clusterw") == 0) {
913 free(opt->name, M_MOUNT);
914 opt->name = strdup("nonoclusterw", M_MOUNT);
915 }
916 else if (strcmp(opt->name, "noexec") == 0)
917 fsflags |= MNT_NOEXEC;
918 else if (strcmp(opt->name, "exec") == 0) {
919 free(opt->name, M_MOUNT);
920 opt->name = strdup("nonoexec", M_MOUNT);
921 }
922 else if (strcmp(opt->name, "nosuid") == 0)
923 fsflags |= MNT_NOSUID;
924 else if (strcmp(opt->name, "suid") == 0) {
925 free(opt->name, M_MOUNT);
926 opt->name = strdup("nonosuid", M_MOUNT);
927 }
928 else if (strcmp(opt->name, "nosymfollow") == 0)
929 fsflags |= MNT_NOSYMFOLLOW;
930 else if (strcmp(opt->name, "symfollow") == 0) {
931 free(opt->name, M_MOUNT);
932 opt->name = strdup("nonosymfollow", M_MOUNT);
933 }
934 else if (strcmp(opt->name, "noro") == 0) {
935 fsflags &= ~MNT_RDONLY;
936 autoro = false;
937 }
938 else if (strcmp(opt->name, "rw") == 0) {
939 fsflags &= ~MNT_RDONLY;
940 autoro = false;
941 }
942 else if (strcmp(opt->name, "ro") == 0) {
943 fsflags |= MNT_RDONLY;
944 autoro = false;
945 }
946 else if (strcmp(opt->name, "rdonly") == 0) {
947 free(opt->name, M_MOUNT);
948 opt->name = strdup("ro", M_MOUNT);
949 fsflags |= MNT_RDONLY;
950 autoro = false;
951 }
952 else if (strcmp(opt->name, "autoro") == 0) {
953 do_freeopt = 1;
954 autoro = true;
955 }
956 else if (strcmp(opt->name, "suiddir") == 0)
957 fsflags |= MNT_SUIDDIR;
958 else if (strcmp(opt->name, "sync") == 0)
959 fsflags |= MNT_SYNCHRONOUS;
960 else if (strcmp(opt->name, "union") == 0)
961 fsflags |= MNT_UNION;
962 else if (strcmp(opt->name, "export") == 0) {
963 fsflags |= MNT_EXPORTED;
964 only_export = true;
965 } else if (strcmp(opt->name, "automounted") == 0) {
966 fsflags |= MNT_AUTOMOUNTED;
967 do_freeopt = 1;
968 } else if (strcmp(opt->name, "nocover") == 0) {
969 fsflags |= MNT_NOCOVER;
970 do_freeopt = 1;
971 } else if (strcmp(opt->name, "cover") == 0) {
972 fsflags &= ~MNT_NOCOVER;
973 do_freeopt = 1;
974 } else if (strcmp(opt->name, "emptydir") == 0) {
975 fsflags |= MNT_EMPTYDIR;
976 do_freeopt = 1;
977 } else if (strcmp(opt->name, "noemptydir") == 0) {
978 fsflags &= ~MNT_EMPTYDIR;
979 do_freeopt = 1;
980 }
981 if (do_freeopt)
982 vfs_freeopt(optlist, opt);
983 }
984
985 /*
986 * Be ultra-paranoid about making sure the type and fspath
987 * variables will fit in our mp buffers, including the
988 * terminating NUL.
989 */
990 if (fstypelen > MFSNAMELEN || fspathlen > MNAMELEN) {
991 error = ENAMETOOLONG;
992 goto bail;
993 }
994
995 /*
996 * only_export is set to true only if exports are being
997 * updated and nothing else is being updated.
998 */
999 if (has_nonexport)
1000 only_export = false;
1001 /*
1002 * If only_export is true and the caller is running within a
1003 * vnet prison that can run mountd(8), set jail_export true.
1004 */
1005 jail_export = false;
1006 if (only_export && jailed(td->td_ucred) &&
1007 prison_check_nfsd(td->td_ucred))
1008 jail_export = true;
1009
1010 error = vfs_domount(td, fstype, fspath, fsflags, only_export,
1011 jail_export, &optlist);
1012 if (error == ENODEV) {
1013 error = EINVAL;
1014 if (errmsg != NULL)
1015 strncpy(errmsg, "Invalid fstype", errmsg_len);
1016 goto bail;
1017 }
1018
1019 /*
1020 * See if we can mount in the read-only mode if the error code suggests
1021 * that it could be possible and the mount options allow for that.
1022 * Never try it if "[no]{ro|rw}" has been explicitly requested and not
1023 * overridden by "autoro".
1024 */
1025 if (autoro && vfs_should_downgrade_to_ro_mount(fsflags, error)) {
1026 printf("%s: R/W mount failed, possibly R/O media,"
1027 " trying R/O mount\n", __func__);
1028 fsflags |= MNT_RDONLY;
1029 error = vfs_domount(td, fstype, fspath, fsflags, only_export,
1030 jail_export, &optlist);
1031 }
1032 bail:
1033 /* copyout the errmsg */
1034 if (errmsg_pos != -1 && ((2 * errmsg_pos + 1) < fsoptions->uio_iovcnt)
1035 && errmsg_len > 0 && errmsg != NULL) {
1036 if (fsoptions->uio_segflg == UIO_SYSSPACE) {
1037 bcopy(errmsg,
1038 fsoptions->uio_iov[2 * errmsg_pos + 1].iov_base,
1039 fsoptions->uio_iov[2 * errmsg_pos + 1].iov_len);
1040 } else {
1041 (void)copyout(errmsg,
1042 fsoptions->uio_iov[2 * errmsg_pos + 1].iov_base,
1043 fsoptions->uio_iov[2 * errmsg_pos + 1].iov_len);
1044 }
1045 }
1046
1047 if (optlist != NULL)
1048 vfs_freeopts(optlist);
1049 return (error);
1050 }
1051
1052 /*
1053 * Old mount API.
1054 */
1055 #ifndef _SYS_SYSPROTO_H_
1056 struct mount_args {
1057 char *type;
1058 char *path;
1059 int flags;
1060 caddr_t data;
1061 };
1062 #endif
1063 /* ARGSUSED */
1064 int
sys_mount(struct thread * td,struct mount_args * uap)1065 sys_mount(struct thread *td, struct mount_args *uap)
1066 {
1067 char *fstype;
1068 struct vfsconf *vfsp = NULL;
1069 struct mntarg *ma = NULL;
1070 uint64_t flags;
1071 int error;
1072
1073 /*
1074 * Mount flags are now 64-bits. On 32-bit architectures only
1075 * 32-bits are passed in, but from here on everything handles
1076 * 64-bit flags correctly.
1077 */
1078 flags = uap->flags;
1079
1080 AUDIT_ARG_FFLAGS(flags);
1081
1082 /*
1083 * Filter out MNT_ROOTFS. We do not want clients of mount() in
1084 * userspace to set this flag, but we must filter it out if we want
1085 * MNT_UPDATE on the root file system to work.
1086 * MNT_ROOTFS should only be set by the kernel when mounting its
1087 * root file system.
1088 */
1089 flags &= ~MNT_ROOTFS;
1090
1091 fstype = malloc(MFSNAMELEN, M_TEMP, M_WAITOK);
1092 error = copyinstr(uap->type, fstype, MFSNAMELEN, NULL);
1093 if (error) {
1094 free(fstype, M_TEMP);
1095 return (error);
1096 }
1097
1098 AUDIT_ARG_TEXT(fstype);
1099 vfsp = vfs_byname_kld(fstype, td, &error);
1100 free(fstype, M_TEMP);
1101 if (vfsp == NULL)
1102 return (EINVAL);
1103 if (((vfsp->vfc_flags & VFCF_SBDRY) != 0 &&
1104 vfsp->vfc_vfsops_sd->vfs_cmount == NULL) ||
1105 ((vfsp->vfc_flags & VFCF_SBDRY) == 0 &&
1106 vfsp->vfc_vfsops->vfs_cmount == NULL))
1107 return (EOPNOTSUPP);
1108
1109 ma = mount_argsu(ma, "fstype", uap->type, MFSNAMELEN);
1110 ma = mount_argsu(ma, "fspath", uap->path, MNAMELEN);
1111 ma = mount_argb(ma, flags & MNT_RDONLY, "noro");
1112 ma = mount_argb(ma, !(flags & MNT_NOSUID), "nosuid");
1113 ma = mount_argb(ma, !(flags & MNT_NOEXEC), "noexec");
1114
1115 if ((vfsp->vfc_flags & VFCF_SBDRY) != 0)
1116 return (vfsp->vfc_vfsops_sd->vfs_cmount(ma, uap->data, flags));
1117 return (vfsp->vfc_vfsops->vfs_cmount(ma, uap->data, flags));
1118 }
1119
1120 /*
1121 * vfs_domount_first(): first file system mount (not update)
1122 */
1123 static int
vfs_domount_first(struct thread * td,struct vfsconf * vfsp,char * fspath,struct vnode * vp,uint64_t fsflags,struct vfsoptlist ** optlist)1124 vfs_domount_first(
1125 struct thread *td, /* Calling thread. */
1126 struct vfsconf *vfsp, /* File system type. */
1127 char *fspath, /* Mount path. */
1128 struct vnode *vp, /* Vnode to be covered. */
1129 uint64_t fsflags, /* Flags common to all filesystems. */
1130 struct vfsoptlist **optlist /* Options local to the filesystem. */
1131 )
1132 {
1133 struct vattr va;
1134 struct mount *mp;
1135 struct vnode *newdp, *rootvp;
1136 int error, error1;
1137 bool unmounted;
1138
1139 ASSERT_VOP_ELOCKED(vp, __func__);
1140 KASSERT((fsflags & MNT_UPDATE) == 0, ("MNT_UPDATE shouldn't be here"));
1141
1142 /*
1143 * If the jail of the calling thread lacks permission for this type of
1144 * file system, or is trying to cover its own root, deny immediately.
1145 */
1146 if (jailed(td->td_ucred) && (!prison_allow(td->td_ucred,
1147 vfsp->vfc_prison_flag) || vp == td->td_ucred->cr_prison->pr_root)) {
1148 vput(vp);
1149 vfs_unref_vfsconf(vfsp);
1150 return (EPERM);
1151 }
1152
1153 /*
1154 * If the user is not root, ensure that they own the directory
1155 * onto which we are attempting to mount.
1156 */
1157 error = VOP_GETATTR(vp, &va, td->td_ucred);
1158 if (error == 0 && va.va_uid != td->td_ucred->cr_uid)
1159 error = priv_check_cred(td->td_ucred, PRIV_VFS_ADMIN);
1160 #ifdef MAC
1161 /*
1162 * XXX XNU also has a check_mount_late variant, which takes the
1163 * struct mount instead and gives MAC visibility into, e.g.,
1164 * f_mntfromname and other facts.
1165 */
1166 if (error == 0) {
1167 error = mac_mount_check_mount(td->td_ucred, vp, vfsp,
1168 optlist, fsflags);
1169 }
1170 #endif
1171 if (error == 0)
1172 error = vinvalbuf(vp, V_SAVE, 0, 0);
1173 if (vfsp->vfc_flags & VFCF_FILEMOUNT) {
1174 if (error == 0 && vp->v_type != VDIR && vp->v_type != VREG &&
1175 vp->v_type != VSOCK)
1176 error = EINVAL;
1177 /*
1178 * For file mounts, ensure that there is only one hardlink to the file.
1179 */
1180 if (error == 0 && (vp->v_type == VREG || vp->v_type == VSOCK) &&
1181 va.va_nlink != 1)
1182 error = EINVAL;
1183 } else {
1184 if (error == 0 && vp->v_type != VDIR)
1185 error = ENOTDIR;
1186 }
1187 if (error == 0 && (fsflags & MNT_EMPTYDIR) != 0)
1188 error = vn_dir_check_empty(vp);
1189 if (error == 0) {
1190 VI_LOCK(vp);
1191 if ((vp->v_iflag & VI_MOUNT) == 0 && vp->v_mountedhere == NULL)
1192 vp->v_iflag |= VI_MOUNT;
1193 else
1194 error = EBUSY;
1195 VI_UNLOCK(vp);
1196 }
1197 if (error != 0) {
1198 vput(vp);
1199 vfs_unref_vfsconf(vfsp);
1200 return (error);
1201 }
1202 vn_seqc_write_begin(vp);
1203 VOP_UNLOCK(vp);
1204
1205 /* Allocate and initialize the filesystem. */
1206 mp = vfs_mount_alloc(vp, vfsp, fspath, td->td_ucred);
1207 /* XXXMAC: pass to vfs_mount_alloc? */
1208 mp->mnt_optnew = *optlist;
1209 /* Set the mount level flags. */
1210 mp->mnt_flag = (fsflags &
1211 (MNT_UPDATEMASK | MNT_ROOTFS | MNT_RDONLY | MNT_FORCE));
1212
1213 /*
1214 * Mount the filesystem.
1215 * XXX The final recipients of VFS_MOUNT just overwrite the ndp they
1216 * get. No freeing of cn_pnbuf.
1217 */
1218 error1 = 0;
1219 unmounted = true;
1220 if ((error = VFS_MOUNT(mp)) != 0 ||
1221 (error1 = VFS_STATFS(mp, &mp->mnt_stat)) != 0 ||
1222 (error1 = VFS_ROOT(mp, LK_EXCLUSIVE, &newdp)) != 0) {
1223 rootvp = NULL;
1224 if (error1 != 0) {
1225 MPASS(error == 0);
1226 rootvp = vfs_cache_root_clear(mp);
1227 if (rootvp != NULL) {
1228 vhold(rootvp);
1229 vrele(rootvp);
1230 }
1231 (void)vn_start_write(NULL, &mp, V_WAIT);
1232 MNT_ILOCK(mp);
1233 mp->mnt_kern_flag |= MNTK_UNMOUNT | MNTK_UNMOUNTF;
1234 MNT_IUNLOCK(mp);
1235 VFS_PURGE(mp);
1236 error = VFS_UNMOUNT(mp, 0);
1237 vn_finished_write(mp);
1238 if (error != 0) {
1239 printf(
1240 "failed post-mount (%d): rollback unmount returned %d\n",
1241 error1, error);
1242 unmounted = false;
1243 }
1244 error = error1;
1245 }
1246 vfs_unbusy(mp);
1247 mp->mnt_vnodecovered = NULL;
1248 if (unmounted) {
1249 /* XXXKIB wait for mnt_lockref drain? */
1250 vfs_mount_destroy(mp);
1251 }
1252 VI_LOCK(vp);
1253 vp->v_iflag &= ~VI_MOUNT;
1254 VI_UNLOCK(vp);
1255 if (rootvp != NULL) {
1256 vn_seqc_write_end(rootvp);
1257 vdrop(rootvp);
1258 }
1259 vn_seqc_write_end(vp);
1260 vrele(vp);
1261 return (error);
1262 }
1263 vn_seqc_write_begin(newdp);
1264 VOP_UNLOCK(newdp);
1265
1266 if (mp->mnt_opt != NULL)
1267 vfs_freeopts(mp->mnt_opt);
1268 mp->mnt_opt = mp->mnt_optnew;
1269 *optlist = NULL;
1270
1271 /*
1272 * Prevent external consumers of mount options from reading mnt_optnew.
1273 */
1274 mp->mnt_optnew = NULL;
1275
1276 MNT_ILOCK(mp);
1277 if ((mp->mnt_flag & MNT_ASYNC) != 0 &&
1278 (mp->mnt_kern_flag & MNTK_NOASYNC) == 0)
1279 mp->mnt_kern_flag |= MNTK_ASYNC;
1280 else
1281 mp->mnt_kern_flag &= ~MNTK_ASYNC;
1282 MNT_IUNLOCK(mp);
1283
1284 /*
1285 * VIRF_MOUNTPOINT and v_mountedhere need to be set under the
1286 * vp lock to satisfy vfs_lookup() requirements.
1287 */
1288 VOP_LOCK(vp, LK_EXCLUSIVE | LK_RETRY);
1289 VI_LOCK(vp);
1290 vn_irflag_set_locked(vp, VIRF_MOUNTPOINT);
1291 vp->v_mountedhere = mp;
1292 VI_UNLOCK(vp);
1293 VOP_UNLOCK(vp);
1294 cache_purge(vp);
1295
1296 /*
1297 * We need to lock both vnodes.
1298 *
1299 * Use vn_lock_pair to avoid establishing an ordering between vnodes
1300 * from different filesystems.
1301 */
1302 error1 = vn_lock_pair(vp, false, LK_EXCLUSIVE, newdp, false,
1303 LK_EXCLUSIVE);
1304
1305 VI_LOCK(vp);
1306 vp->v_iflag &= ~VI_MOUNT;
1307 VI_UNLOCK(vp);
1308 /* Place the new filesystem at the end of the mount list. */
1309 mtx_lock(&mountlist_mtx);
1310 TAILQ_INSERT_TAIL(&mountlist, mp, mnt_list);
1311 mtx_unlock(&mountlist_mtx);
1312 vfs_event_signal(NULL, VQ_MOUNT, 0);
1313 if (error1 == 0)
1314 VOP_UNLOCK(vp);
1315 else
1316 MPASS(error1 == EDEADLK);
1317 EVENTHANDLER_DIRECT_INVOKE(vfs_mounted, mp, newdp, td);
1318 VOP_UNLOCK(newdp);
1319 mount_devctl_event("MOUNT", mp, false);
1320 mountcheckdirs(vp, newdp);
1321 vn_seqc_write_end(vp);
1322 vn_seqc_write_end(newdp);
1323 vrele(newdp);
1324 if ((mp->mnt_flag & MNT_RDONLY) == 0)
1325 vfs_allocate_syncvnode(mp);
1326 vfs_op_exit(mp);
1327 vfs_unbusy(mp);
1328 return (0);
1329 }
1330
1331 /*
1332 * vfs_domount_update(): update of mounted file system
1333 */
1334 static int
vfs_domount_update(struct thread * td,struct vnode * vp,uint64_t fsflags,bool only_export,bool jail_export,struct vfsoptlist ** optlist)1335 vfs_domount_update(
1336 struct thread *td, /* Calling thread. */
1337 struct vnode *vp, /* Mount point vnode. */
1338 uint64_t fsflags, /* Flags common to all filesystems. */
1339 bool only_export, /* Got export option. */
1340 bool jail_export, /* Got export option in vnet prison. */
1341 struct vfsoptlist **optlist /* Options local to the filesystem. */
1342 )
1343 {
1344 struct export_args export;
1345 struct o2export_args o2export;
1346 struct vnode *rootvp;
1347 void *bufp;
1348 struct mount *mp;
1349 int error, export_error, i, len, fsid_up_len;
1350 uint64_t flag, mnt_union;
1351 gid_t *grps;
1352 fsid_t *fsid_up;
1353 bool vfs_suser_failed;
1354
1355 ASSERT_VOP_ELOCKED(vp, __func__);
1356 KASSERT((fsflags & MNT_UPDATE) != 0, ("MNT_UPDATE should be here"));
1357 mp = vp->v_mount;
1358
1359 if ((vp->v_vflag & VV_ROOT) == 0) {
1360 if (vfs_copyopt(*optlist, "export", &export, sizeof(export))
1361 == 0)
1362 error = EXDEV;
1363 else
1364 error = EINVAL;
1365 vput(vp);
1366 return (error);
1367 }
1368
1369 /*
1370 * We only allow the filesystem to be reloaded if it
1371 * is currently mounted read-only.
1372 */
1373 flag = mp->mnt_flag;
1374 if ((fsflags & MNT_RELOAD) != 0 && (flag & MNT_RDONLY) == 0) {
1375 vput(vp);
1376 return (EOPNOTSUPP); /* Needs translation */
1377 }
1378 /*
1379 * Only privileged root, or (if MNT_USER is set) the user that
1380 * did the original mount is permitted to update it.
1381 */
1382 /*
1383 * For the case of mountd(8) doing exports in a jail, the vfs_suser()
1384 * call does not cause failure. vfs_domount() has already checked
1385 * that "root" is doing this and vfs_suser() will fail when
1386 * the file system has been mounted outside the jail.
1387 * jail_export set true indicates that "export" is not mixed
1388 * with other options that change mount behaviour.
1389 */
1390 vfs_suser_failed = false;
1391 error = vfs_suser(mp, td);
1392 if (jail_export && error != 0) {
1393 error = 0;
1394 vfs_suser_failed = true;
1395 }
1396 #ifdef MAC
1397 if (error == 0) {
1398 error = mac_mount_check_update(td->td_ucred, mp, optlist,
1399 fsflags);
1400 }
1401 #endif
1402 if (error != 0) {
1403 vput(vp);
1404 return (error);
1405 }
1406 if (vfs_busy(mp, MBF_NOWAIT)) {
1407 vput(vp);
1408 return (EBUSY);
1409 }
1410 VI_LOCK(vp);
1411 if ((vp->v_iflag & VI_MOUNT) != 0 || vp->v_mountedhere != NULL) {
1412 VI_UNLOCK(vp);
1413 vfs_unbusy(mp);
1414 vput(vp);
1415 return (EBUSY);
1416 }
1417 vp->v_iflag |= VI_MOUNT;
1418 VI_UNLOCK(vp);
1419 VOP_UNLOCK(vp);
1420
1421 rootvp = NULL;
1422 vfs_op_enter(mp);
1423 vn_seqc_write_begin(vp);
1424
1425 if (vfs_getopt(*optlist, "fsid", (void **)&fsid_up,
1426 &fsid_up_len) == 0) {
1427 if (fsid_up_len != sizeof(*fsid_up)) {
1428 error = EINVAL;
1429 goto end;
1430 }
1431 if (fsidcmp(fsid_up, &mp->mnt_stat.f_fsid) != 0) {
1432 error = ENOENT;
1433 goto end;
1434 }
1435 vfs_deleteopt(*optlist, "fsid");
1436 }
1437
1438 mnt_union = 0;
1439 MNT_ILOCK(mp);
1440 if ((mp->mnt_kern_flag & MNTK_UNMOUNT) != 0) {
1441 MNT_IUNLOCK(mp);
1442 error = EBUSY;
1443 goto end;
1444 }
1445 if (vfs_suser_failed) {
1446 KASSERT((fsflags & (MNT_EXPORTED | MNT_UPDATE)) ==
1447 (MNT_EXPORTED | MNT_UPDATE),
1448 ("%s: jailed export did not set expected fsflags",
1449 __func__));
1450 /*
1451 * For this case, only MNT_UPDATE and
1452 * MNT_EXPORTED have been set in fsflags
1453 * by the options. Only set MNT_UPDATE,
1454 * since that is the one that would be set
1455 * when set in fsflags, below.
1456 */
1457 mp->mnt_flag |= MNT_UPDATE;
1458 } else {
1459 mp->mnt_flag &= ~MNT_UPDATEMASK;
1460 if ((mp->mnt_flag & MNT_UNION) == 0 &&
1461 (fsflags & MNT_UNION) != 0) {
1462 fsflags &= ~MNT_UNION;
1463 mnt_union = MNT_UNION;
1464 }
1465 mp->mnt_flag |= fsflags & (MNT_RELOAD | MNT_FORCE | MNT_UPDATE |
1466 MNT_SNAPSHOT | MNT_ROOTFS | MNT_UPDATEMASK | MNT_RDONLY);
1467 if ((mp->mnt_flag & MNT_ASYNC) == 0)
1468 mp->mnt_kern_flag &= ~MNTK_ASYNC;
1469 }
1470 rootvp = vfs_cache_root_clear(mp);
1471 MNT_IUNLOCK(mp);
1472 mp->mnt_optnew = *optlist;
1473 vfs_mergeopts(mp->mnt_optnew, mp->mnt_opt);
1474
1475 /*
1476 * Mount the filesystem.
1477 * XXX The final recipients of VFS_MOUNT just overwrite the ndp they
1478 * get. No freeing of cn_pnbuf.
1479 */
1480 /*
1481 * When only updating mount exports, VFS_MOUNT() does not need to
1482 * be called, as indicated by only_export being set true.
1483 * For the case of mountd(8) doing exports from within a vnet jail,
1484 * "from" is typically not set correctly such that VFS_MOUNT() will
1485 * return ENOENT. For ZFS, there is a locking bug which can result in
1486 * deadlock if VFS_MOUNT() is called when extended attributes are
1487 * being updated.
1488 */
1489 error = 0;
1490 if (!only_export)
1491 error = VFS_MOUNT(mp);
1492
1493 export_error = 0;
1494 /* Process the export option. */
1495 if (error == 0 && vfs_getopt(mp->mnt_optnew, "export", &bufp,
1496 &len) == 0) {
1497 /* Assume that there is only 1 ABI for each length. */
1498 switch (len) {
1499 case (sizeof(struct oexport_args)):
1500 bzero(&o2export, sizeof(o2export));
1501 /* FALLTHROUGH */
1502 case (sizeof(o2export)):
1503 bcopy(bufp, &o2export, len);
1504 export.ex_flags = (uint64_t)o2export.ex_flags;
1505 export.ex_root = o2export.ex_root;
1506 export.ex_uid = o2export.ex_anon.cr_uid;
1507 export.ex_groups = NULL;
1508 export.ex_ngroups = o2export.ex_anon.cr_ngroups;
1509 if (export.ex_ngroups > 0) {
1510 if (export.ex_ngroups <= XU_NGROUPS) {
1511 export.ex_groups = malloc(
1512 export.ex_ngroups * sizeof(gid_t),
1513 M_TEMP, M_WAITOK);
1514 for (i = 0; i < export.ex_ngroups; i++)
1515 export.ex_groups[i] =
1516 o2export.ex_anon.cr_groups[i];
1517 } else
1518 export_error = EINVAL;
1519 } else if (export.ex_ngroups < 0)
1520 export_error = EINVAL;
1521 export.ex_addr = o2export.ex_addr;
1522 export.ex_addrlen = o2export.ex_addrlen;
1523 export.ex_mask = o2export.ex_mask;
1524 export.ex_masklen = o2export.ex_masklen;
1525 export.ex_indexfile = o2export.ex_indexfile;
1526 export.ex_numsecflavors = o2export.ex_numsecflavors;
1527 if (export.ex_numsecflavors < MAXSECFLAVORS) {
1528 for (i = 0; i < export.ex_numsecflavors; i++)
1529 export.ex_secflavors[i] =
1530 o2export.ex_secflavors[i];
1531 } else
1532 export_error = EINVAL;
1533 if (export_error == 0)
1534 export_error = vfs_export(mp, &export, true);
1535 free(export.ex_groups, M_TEMP);
1536 break;
1537 case (sizeof(export)):
1538 bcopy(bufp, &export, len);
1539 grps = NULL;
1540 if (export.ex_ngroups > 0) {
1541 if (export.ex_ngroups <= ngroups_max + 1) {
1542 grps = malloc(export.ex_ngroups *
1543 sizeof(gid_t), M_TEMP, M_WAITOK);
1544 export_error = copyin(export.ex_groups,
1545 grps, export.ex_ngroups *
1546 sizeof(gid_t));
1547 if (export_error == 0)
1548 export.ex_groups = grps;
1549 } else
1550 export_error = EINVAL;
1551 } else if (export.ex_ngroups == 0)
1552 export.ex_groups = NULL;
1553 else
1554 export_error = EINVAL;
1555 if (export_error == 0)
1556 export_error = vfs_export(mp, &export, true);
1557 free(grps, M_TEMP);
1558 break;
1559 default:
1560 export_error = EINVAL;
1561 break;
1562 }
1563 }
1564
1565 MNT_ILOCK(mp);
1566 if (error == 0) {
1567 mp->mnt_flag &= ~(MNT_UPDATE | MNT_RELOAD | MNT_FORCE |
1568 MNT_SNAPSHOT);
1569 mp->mnt_flag |= mnt_union;
1570 } else {
1571 /*
1572 * If we fail, restore old mount flags. MNT_QUOTA is special,
1573 * because it is not part of MNT_UPDATEMASK, but it could have
1574 * changed in the meantime if quotactl(2) was called.
1575 * All in all we want current value of MNT_QUOTA, not the old
1576 * one.
1577 */
1578 mp->mnt_flag = (mp->mnt_flag & MNT_QUOTA) | (flag & ~MNT_QUOTA);
1579 }
1580 if ((mp->mnt_flag & MNT_ASYNC) != 0 &&
1581 (mp->mnt_kern_flag & MNTK_NOASYNC) == 0)
1582 mp->mnt_kern_flag |= MNTK_ASYNC;
1583 else
1584 mp->mnt_kern_flag &= ~MNTK_ASYNC;
1585 MNT_IUNLOCK(mp);
1586
1587 if (error != 0)
1588 goto end;
1589
1590 mount_devctl_event("REMOUNT", mp, true);
1591 if (mp->mnt_opt != NULL)
1592 vfs_freeopts(mp->mnt_opt);
1593 mp->mnt_opt = mp->mnt_optnew;
1594 *optlist = NULL;
1595 (void)VFS_STATFS(mp, &mp->mnt_stat);
1596 /*
1597 * Prevent external consumers of mount options from reading
1598 * mnt_optnew.
1599 */
1600 mp->mnt_optnew = NULL;
1601
1602 if ((mp->mnt_flag & MNT_RDONLY) == 0)
1603 vfs_allocate_syncvnode(mp);
1604 else
1605 vfs_deallocate_syncvnode(mp);
1606 end:
1607 vfs_op_exit(mp);
1608 if (rootvp != NULL) {
1609 vn_seqc_write_end(rootvp);
1610 vrele(rootvp);
1611 }
1612 vn_seqc_write_end(vp);
1613 vfs_unbusy(mp);
1614 VI_LOCK(vp);
1615 vp->v_iflag &= ~VI_MOUNT;
1616 VI_UNLOCK(vp);
1617 vrele(vp);
1618 return (error != 0 ? error : export_error);
1619 }
1620
1621 /*
1622 * vfs_domount(): actually attempt a filesystem mount.
1623 */
1624 static int
vfs_domount(struct thread * td,const char * fstype,char * fspath,uint64_t fsflags,bool only_export,bool jail_export,struct vfsoptlist ** optlist)1625 vfs_domount(
1626 struct thread *td, /* Calling thread. */
1627 const char *fstype, /* Filesystem type. */
1628 char *fspath, /* Mount path. */
1629 uint64_t fsflags, /* Flags common to all filesystems. */
1630 bool only_export, /* Got export option. */
1631 bool jail_export, /* Got export option in vnet prison. */
1632 struct vfsoptlist **optlist /* Options local to the filesystem. */
1633 )
1634 {
1635 struct vfsconf *vfsp;
1636 struct nameidata nd;
1637 struct vnode *vp;
1638 char *pathbuf;
1639 int error;
1640
1641 /*
1642 * Be ultra-paranoid about making sure the type and fspath
1643 * variables will fit in our mp buffers, including the
1644 * terminating NUL.
1645 */
1646 if (strlen(fstype) >= MFSNAMELEN || strlen(fspath) >= MNAMELEN)
1647 return (ENAMETOOLONG);
1648
1649 if (jail_export) {
1650 error = priv_check(td, PRIV_NFS_DAEMON);
1651 if (error)
1652 return (error);
1653 } else if (jailed(td->td_ucred) || usermount == 0) {
1654 if ((error = priv_check(td, PRIV_VFS_MOUNT)) != 0)
1655 return (error);
1656 }
1657
1658 /*
1659 * Do not allow NFS export or MNT_SUIDDIR by unprivileged users.
1660 */
1661 if (fsflags & MNT_EXPORTED) {
1662 error = priv_check(td, PRIV_VFS_MOUNT_EXPORTED);
1663 if (error)
1664 return (error);
1665 }
1666 if (fsflags & MNT_SUIDDIR) {
1667 error = priv_check(td, PRIV_VFS_MOUNT_SUIDDIR);
1668 if (error)
1669 return (error);
1670 }
1671 /*
1672 * Silently enforce MNT_NOSUID and MNT_USER for unprivileged users.
1673 */
1674 if ((fsflags & (MNT_NOSUID | MNT_USER)) != (MNT_NOSUID | MNT_USER)) {
1675 if (priv_check(td, PRIV_VFS_MOUNT_NONUSER) != 0)
1676 fsflags |= MNT_NOSUID | MNT_USER;
1677 }
1678
1679 /* Load KLDs before we lock the covered vnode to avoid reversals. */
1680 vfsp = NULL;
1681 if ((fsflags & MNT_UPDATE) == 0) {
1682 /* Don't try to load KLDs if we're mounting the root. */
1683 if (fsflags & MNT_ROOTFS) {
1684 if ((vfsp = vfs_byname(fstype)) == NULL)
1685 return (ENODEV);
1686 } else {
1687 if ((vfsp = vfs_byname_kld(fstype, td, &error)) == NULL)
1688 return (error);
1689 }
1690 }
1691
1692 /*
1693 * Get vnode to be covered or mount point's vnode in case of MNT_UPDATE.
1694 */
1695 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | AUDITVNODE1 | WANTPARENT,
1696 UIO_SYSSPACE, fspath);
1697 error = namei(&nd);
1698 if (error != 0)
1699 return (error);
1700 vp = nd.ni_vp;
1701 /*
1702 * Don't allow stacking file mounts to work around problems with the way
1703 * that namei sets nd.ni_dvp to vp_crossmp for these.
1704 */
1705 if (vp->v_type == VREG || vp->v_type == VSOCK)
1706 fsflags |= MNT_NOCOVER;
1707 if ((fsflags & MNT_UPDATE) == 0) {
1708 if ((vp->v_vflag & VV_ROOT) != 0 &&
1709 (fsflags & MNT_NOCOVER) != 0) {
1710 vput(vp);
1711 error = EBUSY;
1712 goto out;
1713 }
1714 pathbuf = malloc(MNAMELEN, M_TEMP, M_WAITOK);
1715 strcpy(pathbuf, fspath);
1716 /*
1717 * Note: we allow any vnode type here. If the path sanity check
1718 * succeeds, the type will be validated in vfs_domount_first
1719 * above.
1720 */
1721 if (vp->v_type == VDIR)
1722 error = vn_path_to_global_path(td, vp, pathbuf,
1723 MNAMELEN);
1724 else
1725 error = vn_path_to_global_path_hardlink(td, vp,
1726 nd.ni_dvp, pathbuf, MNAMELEN,
1727 nd.ni_cnd.cn_nameptr, nd.ni_cnd.cn_namelen);
1728 if (error == 0) {
1729 error = vfs_domount_first(td, vfsp, pathbuf, vp,
1730 fsflags, optlist);
1731 }
1732 free(pathbuf, M_TEMP);
1733 } else
1734 error = vfs_domount_update(td, vp, fsflags, only_export,
1735 jail_export, optlist);
1736
1737 out:
1738 NDFREE_PNBUF(&nd);
1739 vrele(nd.ni_dvp);
1740
1741 return (error);
1742 }
1743
1744 /*
1745 * Unmount a filesystem.
1746 *
1747 * Note: unmount takes a path to the vnode mounted on as argument, not
1748 * special file (as before).
1749 */
1750 #ifndef _SYS_SYSPROTO_H_
1751 struct unmount_args {
1752 char *path;
1753 int flags;
1754 };
1755 #endif
1756 /* ARGSUSED */
1757 int
sys_unmount(struct thread * td,struct unmount_args * uap)1758 sys_unmount(struct thread *td, struct unmount_args *uap)
1759 {
1760
1761 return (kern_unmount(td, uap->path, (unsigned)uap->flags));
1762 }
1763
1764 int
kern_unmount(struct thread * td,const char * path,uint64_t flags)1765 kern_unmount(struct thread *td, const char *path, uint64_t flags)
1766 {
1767 struct nameidata nd;
1768 struct mount *mp;
1769 char *fsidbuf, *pathbuf;
1770 fsid_t fsid;
1771 int error;
1772
1773 AUDIT_ARG_VALUE(flags);
1774 if ((flags & (MNT_DEFERRED | MNT_RECURSE)) != 0)
1775 return (EINVAL);
1776 if (jailed(td->td_ucred) || usermount == 0) {
1777 error = priv_check(td, PRIV_VFS_UNMOUNT);
1778 if (error)
1779 return (error);
1780 }
1781 if (flags & MNT_BYFSID) {
1782 fsidbuf = malloc(MNAMELEN, M_TEMP, M_WAITOK);
1783 error = copyinstr(path, fsidbuf, MNAMELEN, NULL);
1784 if (error) {
1785 free(fsidbuf, M_TEMP);
1786 return (error);
1787 }
1788
1789 AUDIT_ARG_TEXT(fsidbuf);
1790 /* Decode the filesystem ID. */
1791 if (sscanf(fsidbuf, "FSID:%d:%d", &fsid.val[0], &fsid.val[1]) != 2) {
1792 free(fsidbuf, M_TEMP);
1793 return (EINVAL);
1794 }
1795
1796 mp = vfs_getvfs(&fsid);
1797 free(fsidbuf, M_TEMP);
1798 if (mp == NULL) {
1799 return (ENOENT);
1800 }
1801 } else {
1802 pathbuf = malloc(MNAMELEN, M_TEMP, M_WAITOK);
1803 error = copyinstr(path, pathbuf, MNAMELEN, NULL);
1804 if (error) {
1805 free(pathbuf, M_TEMP);
1806 return (error);
1807 }
1808
1809 /*
1810 * Try to find global path for path argument.
1811 */
1812 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | AUDITVNODE1,
1813 UIO_SYSSPACE, pathbuf);
1814 if (namei(&nd) == 0) {
1815 NDFREE_PNBUF(&nd);
1816 error = vn_path_to_global_path(td, nd.ni_vp, pathbuf,
1817 MNAMELEN);
1818 if (error == 0)
1819 vput(nd.ni_vp);
1820 }
1821 mtx_lock(&mountlist_mtx);
1822 TAILQ_FOREACH_REVERSE(mp, &mountlist, mntlist, mnt_list) {
1823 if (strcmp(mp->mnt_stat.f_mntonname, pathbuf) == 0) {
1824 vfs_ref(mp);
1825 break;
1826 }
1827 }
1828 mtx_unlock(&mountlist_mtx);
1829 free(pathbuf, M_TEMP);
1830 if (mp == NULL) {
1831 /*
1832 * Previously we returned ENOENT for a nonexistent path and
1833 * EINVAL for a non-mountpoint. We cannot tell these apart
1834 * now, so in the !MNT_BYFSID case return the more likely
1835 * EINVAL for compatibility.
1836 */
1837 return (EINVAL);
1838 }
1839 }
1840
1841 /*
1842 * Don't allow unmounting the root filesystem.
1843 */
1844 if (mp->mnt_flag & MNT_ROOTFS) {
1845 vfs_rel(mp);
1846 return (EINVAL);
1847 }
1848 #ifdef MAC
1849 error = mac_mount_check_unmount(td->td_ucred, mp, flags);
1850 if (error != 0) {
1851 vfs_rel(mp);
1852 return (error);
1853 }
1854 #endif
1855 error = dounmount(mp, flags, td);
1856 return (error);
1857 }
1858
1859 /*
1860 * Return error if any of the vnodes, ignoring the root vnode
1861 * and the syncer vnode, have non-zero usecount.
1862 *
1863 * This function is purely advisory - it can return false positives
1864 * and negatives.
1865 */
1866 static int
vfs_check_usecounts(struct mount * mp)1867 vfs_check_usecounts(struct mount *mp)
1868 {
1869 struct vnode *vp, *mvp;
1870
1871 MNT_VNODE_FOREACH_ALL(vp, mp, mvp) {
1872 if ((vp->v_vflag & VV_ROOT) == 0 && vp->v_type != VNON &&
1873 vp->v_usecount != 0) {
1874 VI_UNLOCK(vp);
1875 MNT_VNODE_FOREACH_ALL_ABORT(mp, mvp);
1876 return (EBUSY);
1877 }
1878 VI_UNLOCK(vp);
1879 }
1880
1881 return (0);
1882 }
1883
1884 static void
dounmount_cleanup(struct mount * mp,struct vnode * coveredvp,int mntkflags,bool disablerec)1885 dounmount_cleanup(struct mount *mp, struct vnode *coveredvp, int mntkflags,
1886 bool disablerec)
1887 {
1888
1889 mtx_assert(MNT_MTX(mp), MA_OWNED);
1890 mp->mnt_kern_flag &= ~mntkflags;
1891 if ((mp->mnt_kern_flag & MNTK_MWAIT) != 0) {
1892 mp->mnt_kern_flag &= ~MNTK_MWAIT;
1893 wakeup(mp);
1894 }
1895 vfs_op_exit_locked(mp);
1896 MNT_IUNLOCK(mp);
1897 if (coveredvp != NULL) {
1898 if (disablerec)
1899 VN_LOCK_DREC(coveredvp);
1900 VOP_UNLOCK(coveredvp);
1901 vdrop(coveredvp);
1902 }
1903 vn_finished_write(mp);
1904 vfs_rel(mp);
1905 }
1906
1907 /*
1908 * There are various reference counters associated with the mount point.
1909 * Normally it is permitted to modify them without taking the mnt ilock,
1910 * but this behavior can be temporarily disabled if stable value is needed
1911 * or callers are expected to block (e.g. to not allow new users during
1912 * forced unmount).
1913 */
1914 void
vfs_op_enter(struct mount * mp)1915 vfs_op_enter(struct mount *mp)
1916 {
1917 struct mount_pcpu *mpcpu;
1918 int cpu;
1919
1920 MNT_ILOCK(mp);
1921 mp->mnt_vfs_ops++;
1922 if (mp->mnt_vfs_ops > 1) {
1923 MNT_IUNLOCK(mp);
1924 return;
1925 }
1926 vfs_op_barrier_wait(mp);
1927 CPU_FOREACH(cpu) {
1928 mpcpu = vfs_mount_pcpu_remote(mp, cpu);
1929
1930 mp->mnt_ref += mpcpu->mntp_ref;
1931 mpcpu->mntp_ref = 0;
1932
1933 mp->mnt_lockref += mpcpu->mntp_lockref;
1934 mpcpu->mntp_lockref = 0;
1935
1936 mp->mnt_writeopcount += mpcpu->mntp_writeopcount;
1937 mpcpu->mntp_writeopcount = 0;
1938 }
1939 MPASSERT(mp->mnt_ref > 0 && mp->mnt_lockref >= 0 &&
1940 mp->mnt_writeopcount >= 0, mp,
1941 ("invalid count(s): ref %d lockref %d writeopcount %d",
1942 mp->mnt_ref, mp->mnt_lockref, mp->mnt_writeopcount));
1943 MNT_IUNLOCK(mp);
1944 vfs_assert_mount_counters(mp);
1945 }
1946
1947 void
vfs_op_exit_locked(struct mount * mp)1948 vfs_op_exit_locked(struct mount *mp)
1949 {
1950
1951 mtx_assert(MNT_MTX(mp), MA_OWNED);
1952
1953 MPASSERT(mp->mnt_vfs_ops > 0, mp,
1954 ("invalid vfs_ops count %d", mp->mnt_vfs_ops));
1955 MPASSERT(mp->mnt_vfs_ops > 1 ||
1956 (mp->mnt_kern_flag & (MNTK_UNMOUNT | MNTK_SUSPEND)) == 0, mp,
1957 ("vfs_ops too low %d in unmount or suspend", mp->mnt_vfs_ops));
1958 mp->mnt_vfs_ops--;
1959 }
1960
1961 void
vfs_op_exit(struct mount * mp)1962 vfs_op_exit(struct mount *mp)
1963 {
1964
1965 MNT_ILOCK(mp);
1966 vfs_op_exit_locked(mp);
1967 MNT_IUNLOCK(mp);
1968 }
1969
1970 struct vfs_op_barrier_ipi {
1971 struct mount *mp;
1972 struct smp_rendezvous_cpus_retry_arg srcra;
1973 };
1974
1975 static void
vfs_op_action_func(void * arg)1976 vfs_op_action_func(void *arg)
1977 {
1978 struct vfs_op_barrier_ipi *vfsopipi;
1979 struct mount *mp;
1980
1981 vfsopipi = __containerof(arg, struct vfs_op_barrier_ipi, srcra);
1982 mp = vfsopipi->mp;
1983
1984 if (!vfs_op_thread_entered(mp))
1985 smp_rendezvous_cpus_done(arg);
1986 }
1987
1988 static void
vfs_op_wait_func(void * arg,int cpu)1989 vfs_op_wait_func(void *arg, int cpu)
1990 {
1991 struct vfs_op_barrier_ipi *vfsopipi;
1992 struct mount *mp;
1993 struct mount_pcpu *mpcpu;
1994
1995 vfsopipi = __containerof(arg, struct vfs_op_barrier_ipi, srcra);
1996 mp = vfsopipi->mp;
1997
1998 mpcpu = vfs_mount_pcpu_remote(mp, cpu);
1999 while (atomic_load_int(&mpcpu->mntp_thread_in_ops))
2000 cpu_spinwait();
2001 }
2002
2003 void
vfs_op_barrier_wait(struct mount * mp)2004 vfs_op_barrier_wait(struct mount *mp)
2005 {
2006 struct vfs_op_barrier_ipi vfsopipi;
2007
2008 vfsopipi.mp = mp;
2009
2010 smp_rendezvous_cpus_retry(all_cpus,
2011 smp_no_rendezvous_barrier,
2012 vfs_op_action_func,
2013 smp_no_rendezvous_barrier,
2014 vfs_op_wait_func,
2015 &vfsopipi.srcra);
2016 }
2017
2018 #ifdef DIAGNOSTIC
2019 void
vfs_assert_mount_counters(struct mount * mp)2020 vfs_assert_mount_counters(struct mount *mp)
2021 {
2022 struct mount_pcpu *mpcpu;
2023 int cpu;
2024
2025 if (mp->mnt_vfs_ops == 0)
2026 return;
2027
2028 CPU_FOREACH(cpu) {
2029 mpcpu = vfs_mount_pcpu_remote(mp, cpu);
2030 if (mpcpu->mntp_ref != 0 ||
2031 mpcpu->mntp_lockref != 0 ||
2032 mpcpu->mntp_writeopcount != 0)
2033 vfs_dump_mount_counters(mp);
2034 }
2035 }
2036
2037 void
vfs_dump_mount_counters(struct mount * mp)2038 vfs_dump_mount_counters(struct mount *mp)
2039 {
2040 struct mount_pcpu *mpcpu;
2041 int ref, lockref, writeopcount;
2042 int cpu;
2043
2044 printf("%s: mp %p vfs_ops %d\n", __func__, mp, mp->mnt_vfs_ops);
2045
2046 printf(" ref : ");
2047 ref = mp->mnt_ref;
2048 CPU_FOREACH(cpu) {
2049 mpcpu = vfs_mount_pcpu_remote(mp, cpu);
2050 printf("%d ", mpcpu->mntp_ref);
2051 ref += mpcpu->mntp_ref;
2052 }
2053 printf("\n");
2054 printf(" lockref : ");
2055 lockref = mp->mnt_lockref;
2056 CPU_FOREACH(cpu) {
2057 mpcpu = vfs_mount_pcpu_remote(mp, cpu);
2058 printf("%d ", mpcpu->mntp_lockref);
2059 lockref += mpcpu->mntp_lockref;
2060 }
2061 printf("\n");
2062 printf("writeopcount: ");
2063 writeopcount = mp->mnt_writeopcount;
2064 CPU_FOREACH(cpu) {
2065 mpcpu = vfs_mount_pcpu_remote(mp, cpu);
2066 printf("%d ", mpcpu->mntp_writeopcount);
2067 writeopcount += mpcpu->mntp_writeopcount;
2068 }
2069 printf("\n");
2070
2071 printf("counter struct total\n");
2072 printf("ref %-5d %-5d\n", mp->mnt_ref, ref);
2073 printf("lockref %-5d %-5d\n", mp->mnt_lockref, lockref);
2074 printf("writeopcount %-5d %-5d\n", mp->mnt_writeopcount, writeopcount);
2075
2076 panic("invalid counts on struct mount");
2077 }
2078 #endif
2079
2080 int
vfs_mount_fetch_counter(struct mount * mp,enum mount_counter which)2081 vfs_mount_fetch_counter(struct mount *mp, enum mount_counter which)
2082 {
2083 struct mount_pcpu *mpcpu;
2084 int cpu, sum;
2085
2086 switch (which) {
2087 case MNT_COUNT_REF:
2088 sum = mp->mnt_ref;
2089 break;
2090 case MNT_COUNT_LOCKREF:
2091 sum = mp->mnt_lockref;
2092 break;
2093 case MNT_COUNT_WRITEOPCOUNT:
2094 sum = mp->mnt_writeopcount;
2095 break;
2096 }
2097
2098 CPU_FOREACH(cpu) {
2099 mpcpu = vfs_mount_pcpu_remote(mp, cpu);
2100 switch (which) {
2101 case MNT_COUNT_REF:
2102 sum += mpcpu->mntp_ref;
2103 break;
2104 case MNT_COUNT_LOCKREF:
2105 sum += mpcpu->mntp_lockref;
2106 break;
2107 case MNT_COUNT_WRITEOPCOUNT:
2108 sum += mpcpu->mntp_writeopcount;
2109 break;
2110 }
2111 }
2112 return (sum);
2113 }
2114
2115 static bool
deferred_unmount_enqueue(struct mount * mp,uint64_t flags,bool requeue,int timeout_ticks)2116 deferred_unmount_enqueue(struct mount *mp, uint64_t flags, bool requeue,
2117 int timeout_ticks)
2118 {
2119 bool enqueued;
2120
2121 enqueued = false;
2122 mtx_lock(&deferred_unmount_lock);
2123 if ((mp->mnt_taskqueue_flags & MNT_DEFERRED) == 0 || requeue) {
2124 mp->mnt_taskqueue_flags = flags | MNT_DEFERRED;
2125 STAILQ_INSERT_TAIL(&deferred_unmount_list, mp,
2126 mnt_taskqueue_link);
2127 enqueued = true;
2128 }
2129 mtx_unlock(&deferred_unmount_lock);
2130
2131 if (enqueued) {
2132 taskqueue_enqueue_timeout(taskqueue_deferred_unmount,
2133 &deferred_unmount_task, timeout_ticks);
2134 }
2135
2136 return (enqueued);
2137 }
2138
2139 /*
2140 * Taskqueue handler for processing async/recursive unmounts
2141 */
2142 static void
vfs_deferred_unmount(void * argi __unused,int pending __unused)2143 vfs_deferred_unmount(void *argi __unused, int pending __unused)
2144 {
2145 STAILQ_HEAD(, mount) local_unmounts;
2146 uint64_t flags;
2147 struct mount *mp, *tmp;
2148 int error;
2149 unsigned int retries;
2150 bool unmounted;
2151
2152 STAILQ_INIT(&local_unmounts);
2153 mtx_lock(&deferred_unmount_lock);
2154 STAILQ_CONCAT(&local_unmounts, &deferred_unmount_list);
2155 mtx_unlock(&deferred_unmount_lock);
2156
2157 STAILQ_FOREACH_SAFE(mp, &local_unmounts, mnt_taskqueue_link, tmp) {
2158 flags = mp->mnt_taskqueue_flags;
2159 KASSERT((flags & MNT_DEFERRED) != 0,
2160 ("taskqueue unmount without MNT_DEFERRED"));
2161 error = dounmount(mp, flags, curthread);
2162 if (error != 0) {
2163 MNT_ILOCK(mp);
2164 unmounted = ((mp->mnt_kern_flag & MNTK_REFEXPIRE) != 0);
2165 MNT_IUNLOCK(mp);
2166
2167 /*
2168 * The deferred unmount thread is the only thread that
2169 * modifies the retry counts, so locking/atomics aren't
2170 * needed here.
2171 */
2172 retries = (mp->mnt_unmount_retries)++;
2173 deferred_unmount_total_retries++;
2174 if (!unmounted && retries < deferred_unmount_retry_limit) {
2175 deferred_unmount_enqueue(mp, flags, true,
2176 -deferred_unmount_retry_delay_hz);
2177 } else {
2178 if (retries >= deferred_unmount_retry_limit) {
2179 printf("giving up on deferred unmount "
2180 "of %s after %d retries, error %d\n",
2181 mp->mnt_stat.f_mntonname, retries, error);
2182 }
2183 vfs_rel(mp);
2184 }
2185 }
2186 }
2187 }
2188
2189 /*
2190 * Do the actual filesystem unmount.
2191 */
2192 int
dounmount(struct mount * mp,uint64_t flags,struct thread * td)2193 dounmount(struct mount *mp, uint64_t flags, struct thread *td)
2194 {
2195 struct mount_upper_node *upper;
2196 struct vnode *coveredvp, *rootvp;
2197 int error;
2198 uint64_t async_flag;
2199 int mnt_gen_r;
2200 unsigned int retries;
2201 bool coveredrec;
2202
2203 KASSERT((flags & MNT_DEFERRED) == 0 ||
2204 (flags & (MNT_RECURSE | MNT_FORCE)) == (MNT_RECURSE | MNT_FORCE),
2205 ("MNT_DEFERRED requires MNT_RECURSE | MNT_FORCE"));
2206
2207 /*
2208 * If the caller has explicitly requested the unmount to be handled by
2209 * the taskqueue and we're not already in taskqueue context, queue
2210 * up the unmount request and exit. This is done prior to any
2211 * credential checks; MNT_DEFERRED should be used only for kernel-
2212 * initiated unmounts and will therefore be processed with the
2213 * (kernel) credentials of the taskqueue thread. Still, callers
2214 * should be sure this is the behavior they want.
2215 */
2216 if ((flags & MNT_DEFERRED) != 0 &&
2217 taskqueue_member(taskqueue_deferred_unmount, curthread) == 0) {
2218 if (!deferred_unmount_enqueue(mp, flags, false, 0))
2219 vfs_rel(mp);
2220 return (EINPROGRESS);
2221 }
2222
2223 /*
2224 * Only privileged root, or (if MNT_USER is set) the user that did the
2225 * original mount is permitted to unmount this filesystem.
2226 * This check should be made prior to queueing up any recursive
2227 * unmounts of upper filesystems. Those unmounts will be executed
2228 * with kernel thread credentials and are expected to succeed, so
2229 * we must at least ensure the originating context has sufficient
2230 * privilege to unmount the base filesystem before proceeding with
2231 * the uppers.
2232 */
2233 error = vfs_suser(mp, td);
2234 if (error != 0) {
2235 KASSERT((flags & MNT_DEFERRED) == 0,
2236 ("taskqueue unmount with insufficient privilege"));
2237 vfs_rel(mp);
2238 return (error);
2239 }
2240
2241 if (recursive_forced_unmount && ((flags & MNT_FORCE) != 0))
2242 flags |= MNT_RECURSE;
2243
2244 if ((flags & MNT_RECURSE) != 0) {
2245 KASSERT((flags & MNT_FORCE) != 0,
2246 ("MNT_RECURSE requires MNT_FORCE"));
2247
2248 MNT_ILOCK(mp);
2249 /*
2250 * Set MNTK_RECURSE to prevent new upper mounts from being
2251 * added, and note that an operation on the uppers list is in
2252 * progress. This will ensure that unregistration from the
2253 * uppers list, and therefore any pending unmount of the upper
2254 * FS, can't complete until after we finish walking the list.
2255 */
2256 mp->mnt_kern_flag |= MNTK_RECURSE;
2257 mp->mnt_upper_pending++;
2258 TAILQ_FOREACH(upper, &mp->mnt_uppers, mnt_upper_link) {
2259 retries = upper->mp->mnt_unmount_retries;
2260 if (retries > deferred_unmount_retry_limit) {
2261 error = EBUSY;
2262 continue;
2263 }
2264 MNT_IUNLOCK(mp);
2265
2266 vfs_ref(upper->mp);
2267 if (!deferred_unmount_enqueue(upper->mp, flags,
2268 false, 0))
2269 vfs_rel(upper->mp);
2270 MNT_ILOCK(mp);
2271 }
2272 mp->mnt_upper_pending--;
2273 if ((mp->mnt_kern_flag & MNTK_UPPER_WAITER) != 0 &&
2274 mp->mnt_upper_pending == 0) {
2275 mp->mnt_kern_flag &= ~MNTK_UPPER_WAITER;
2276 wakeup(&mp->mnt_uppers);
2277 }
2278
2279 /*
2280 * If we're not on the taskqueue, wait until the uppers list
2281 * is drained before proceeding with unmount. Otherwise, if
2282 * we are on the taskqueue and there are still pending uppers,
2283 * just re-enqueue on the end of the taskqueue.
2284 */
2285 if ((flags & MNT_DEFERRED) == 0) {
2286 while (error == 0 && !TAILQ_EMPTY(&mp->mnt_uppers)) {
2287 mp->mnt_kern_flag |= MNTK_TASKQUEUE_WAITER;
2288 error = msleep(&mp->mnt_taskqueue_link,
2289 MNT_MTX(mp), PCATCH, "umntqw", 0);
2290 }
2291 if (error != 0) {
2292 MNT_REL(mp);
2293 MNT_IUNLOCK(mp);
2294 return (error);
2295 }
2296 } else if (!TAILQ_EMPTY(&mp->mnt_uppers)) {
2297 MNT_IUNLOCK(mp);
2298 if (error == 0)
2299 deferred_unmount_enqueue(mp, flags, true, 0);
2300 return (error);
2301 }
2302 MNT_IUNLOCK(mp);
2303 KASSERT(TAILQ_EMPTY(&mp->mnt_uppers), ("mnt_uppers not empty"));
2304 }
2305
2306 /* Allow the taskqueue to safely re-enqueue on failure */
2307 if ((flags & MNT_DEFERRED) != 0)
2308 vfs_ref(mp);
2309
2310 coveredrec = false;
2311 if ((coveredvp = mp->mnt_vnodecovered) != NULL) {
2312 mnt_gen_r = mp->mnt_gen;
2313 VI_LOCK(coveredvp);
2314 vholdl(coveredvp);
2315 vn_lock(coveredvp, LK_EXCLUSIVE | LK_INTERLOCK | LK_RETRY);
2316 /*
2317 * Check for mp being unmounted while waiting for the
2318 * covered vnode lock.
2319 */
2320 if (coveredvp->v_mountedhere != mp ||
2321 coveredvp->v_mountedhere->mnt_gen != mnt_gen_r) {
2322 VOP_UNLOCK(coveredvp);
2323 vdrop(coveredvp);
2324 vfs_rel(mp);
2325 return (EBUSY);
2326 }
2327
2328 /*
2329 * For stacked filesystems such as nullfs and unionfs,
2330 * it is possible for the covered vnode lock for the
2331 * mount to be shared with one of the vnodes belonging
2332 * to the mount. At unmount time, vflush() will then
2333 * recurse on the covered vnode lock when reclaiming
2334 * the vnode.
2335 *
2336 * To work around it, temprorarily allow recursion for
2337 * the covered vnode lock.
2338 */
2339 coveredrec = VN_LOCK_CANREC(coveredvp);
2340 VN_LOCK_AREC(coveredvp);
2341 }
2342
2343 vfs_op_enter(mp);
2344
2345 vn_start_write(NULL, &mp, V_WAIT);
2346 MNT_ILOCK(mp);
2347 if ((mp->mnt_kern_flag & MNTK_UNMOUNT) != 0 ||
2348 (mp->mnt_flag & MNT_UPDATE) != 0 ||
2349 !TAILQ_EMPTY(&mp->mnt_uppers)) {
2350 dounmount_cleanup(mp, coveredvp, 0, !coveredrec);
2351 return (EBUSY);
2352 }
2353 mp->mnt_kern_flag |= MNTK_UNMOUNT;
2354 rootvp = vfs_cache_root_clear(mp);
2355 if (coveredvp != NULL)
2356 vn_seqc_write_begin(coveredvp);
2357 if (flags & MNT_NONBUSY) {
2358 MNT_IUNLOCK(mp);
2359 error = vfs_check_usecounts(mp);
2360 MNT_ILOCK(mp);
2361 if (error != 0) {
2362 vn_seqc_write_end(coveredvp);
2363 dounmount_cleanup(mp, coveredvp, MNTK_UNMOUNT,
2364 !coveredrec);
2365 if (rootvp != NULL) {
2366 vn_seqc_write_end(rootvp);
2367 vrele(rootvp);
2368 }
2369 return (error);
2370 }
2371 }
2372 /* Allow filesystems to detect that a forced unmount is in progress. */
2373 if (flags & MNT_FORCE) {
2374 mp->mnt_kern_flag |= MNTK_UNMOUNTF;
2375 MNT_IUNLOCK(mp);
2376 /*
2377 * Must be done after setting MNTK_UNMOUNTF and before
2378 * waiting for mnt_lockref to become 0.
2379 */
2380 VFS_PURGE(mp);
2381 MNT_ILOCK(mp);
2382 }
2383 error = 0;
2384 if (mp->mnt_lockref) {
2385 mp->mnt_kern_flag |= MNTK_DRAINING;
2386 error = msleep(&mp->mnt_lockref, MNT_MTX(mp), PVFS,
2387 "mount drain", 0);
2388 }
2389 MNT_IUNLOCK(mp);
2390 KASSERT(mp->mnt_lockref == 0,
2391 ("%s: invalid lock refcount in the drain path @ %s:%d",
2392 __func__, __FILE__, __LINE__));
2393 KASSERT(error == 0,
2394 ("%s: invalid return value for msleep in the drain path @ %s:%d",
2395 __func__, __FILE__, __LINE__));
2396
2397 /*
2398 * We want to keep the vnode around so that we can vn_seqc_write_end
2399 * after we are done with unmount. Downgrade our reference to a mere
2400 * hold count so that we don't interefere with anything.
2401 */
2402 if (rootvp != NULL) {
2403 vhold(rootvp);
2404 vrele(rootvp);
2405 }
2406
2407 if (mp->mnt_flag & MNT_EXPUBLIC)
2408 vfs_setpublicfs(NULL, NULL, NULL);
2409
2410 vfs_periodic(mp, MNT_WAIT);
2411 MNT_ILOCK(mp);
2412 async_flag = mp->mnt_flag & MNT_ASYNC;
2413 mp->mnt_flag &= ~MNT_ASYNC;
2414 mp->mnt_kern_flag &= ~MNTK_ASYNC;
2415 MNT_IUNLOCK(mp);
2416
2417 /* Wait for any replenish kernel process to terminate. */
2418 pnfsd_waitreplenish(mp);
2419
2420 vfs_deallocate_syncvnode(mp);
2421 error = VFS_UNMOUNT(mp, flags);
2422 vn_finished_write(mp);
2423 vfs_rel(mp);
2424 /*
2425 * If we failed to flush the dirty blocks for this mount point,
2426 * undo all the cdir/rdir and rootvnode changes we made above.
2427 * Unless we failed to do so because the device is reporting that
2428 * it doesn't exist anymore.
2429 */
2430 if (error && error != ENXIO) {
2431 MNT_ILOCK(mp);
2432 if ((mp->mnt_flag & MNT_RDONLY) == 0) {
2433 MNT_IUNLOCK(mp);
2434 vfs_allocate_syncvnode(mp);
2435 MNT_ILOCK(mp);
2436 }
2437 mp->mnt_kern_flag &= ~(MNTK_UNMOUNT | MNTK_UNMOUNTF);
2438 mp->mnt_flag |= async_flag;
2439 if ((mp->mnt_flag & MNT_ASYNC) != 0 &&
2440 (mp->mnt_kern_flag & MNTK_NOASYNC) == 0)
2441 mp->mnt_kern_flag |= MNTK_ASYNC;
2442 if (mp->mnt_kern_flag & MNTK_MWAIT) {
2443 mp->mnt_kern_flag &= ~MNTK_MWAIT;
2444 wakeup(mp);
2445 }
2446 vfs_op_exit_locked(mp);
2447 MNT_IUNLOCK(mp);
2448 if (coveredvp) {
2449 vn_seqc_write_end(coveredvp);
2450 if (!coveredrec)
2451 VN_LOCK_DREC(coveredvp);
2452 VOP_UNLOCK(coveredvp);
2453 vdrop(coveredvp);
2454 }
2455 if (rootvp != NULL) {
2456 vn_seqc_write_end(rootvp);
2457 vdrop(rootvp);
2458 }
2459 return (error);
2460 }
2461
2462 mtx_lock(&mountlist_mtx);
2463 TAILQ_REMOVE(&mountlist, mp, mnt_list);
2464 mtx_unlock(&mountlist_mtx);
2465 EVENTHANDLER_DIRECT_INVOKE(vfs_unmounted, mp, td);
2466 if (coveredvp != NULL) {
2467 VI_LOCK(coveredvp);
2468 vn_irflag_unset_locked(coveredvp, VIRF_MOUNTPOINT);
2469 coveredvp->v_mountedhere = NULL;
2470 vn_seqc_write_end_locked(coveredvp);
2471 VI_UNLOCK(coveredvp);
2472 if (!coveredrec)
2473 VN_LOCK_DREC(coveredvp);
2474 VOP_UNLOCK(coveredvp);
2475 vdrop(coveredvp);
2476 }
2477 mount_devctl_event("UNMOUNT", mp, false);
2478 if (rootvp != NULL) {
2479 vn_seqc_write_end(rootvp);
2480 vdrop(rootvp);
2481 }
2482 vfs_event_signal(NULL, VQ_UNMOUNT, 0);
2483 if (rootvnode != NULL && mp == rootvnode->v_mount) {
2484 vrele(rootvnode);
2485 rootvnode = NULL;
2486 }
2487 if (mp == rootdevmp)
2488 rootdevmp = NULL;
2489 if ((flags & MNT_DEFERRED) != 0)
2490 vfs_rel(mp);
2491 vfs_mount_destroy(mp);
2492 return (0);
2493 }
2494
2495 /*
2496 * Report errors during filesystem mounting.
2497 */
2498 void
vfs_mount_error(struct mount * mp,const char * fmt,...)2499 vfs_mount_error(struct mount *mp, const char *fmt, ...)
2500 {
2501 struct vfsoptlist *moptlist = mp->mnt_optnew;
2502 va_list ap;
2503 int error, len;
2504 char *errmsg;
2505
2506 error = vfs_getopt(moptlist, "errmsg", (void **)&errmsg, &len);
2507 if (error || errmsg == NULL || len <= 0)
2508 return;
2509
2510 va_start(ap, fmt);
2511 vsnprintf(errmsg, (size_t)len, fmt, ap);
2512 va_end(ap);
2513 }
2514
2515 void
vfs_opterror(struct vfsoptlist * opts,const char * fmt,...)2516 vfs_opterror(struct vfsoptlist *opts, const char *fmt, ...)
2517 {
2518 va_list ap;
2519 int error, len;
2520 char *errmsg;
2521
2522 error = vfs_getopt(opts, "errmsg", (void **)&errmsg, &len);
2523 if (error || errmsg == NULL || len <= 0)
2524 return;
2525
2526 va_start(ap, fmt);
2527 vsnprintf(errmsg, (size_t)len, fmt, ap);
2528 va_end(ap);
2529 }
2530
2531 /*
2532 * ---------------------------------------------------------------------
2533 * Functions for querying mount options/arguments from filesystems.
2534 */
2535
2536 /*
2537 * Check that no unknown options are given
2538 */
2539 int
vfs_filteropt(struct vfsoptlist * opts,const char ** legal)2540 vfs_filteropt(struct vfsoptlist *opts, const char **legal)
2541 {
2542 struct vfsopt *opt;
2543 char errmsg[255];
2544 const char **t, *p, *q;
2545 int ret = 0;
2546
2547 TAILQ_FOREACH(opt, opts, link) {
2548 p = opt->name;
2549 q = NULL;
2550 if (p[0] == 'n' && p[1] == 'o')
2551 q = p + 2;
2552 for(t = global_opts; *t != NULL; t++) {
2553 if (strcmp(*t, p) == 0)
2554 break;
2555 if (q != NULL) {
2556 if (strcmp(*t, q) == 0)
2557 break;
2558 }
2559 }
2560 if (*t != NULL)
2561 continue;
2562 for(t = legal; *t != NULL; t++) {
2563 if (strcmp(*t, p) == 0)
2564 break;
2565 if (q != NULL) {
2566 if (strcmp(*t, q) == 0)
2567 break;
2568 }
2569 }
2570 if (*t != NULL)
2571 continue;
2572 snprintf(errmsg, sizeof(errmsg),
2573 "mount option <%s> is unknown", p);
2574 ret = EINVAL;
2575 }
2576 if (ret != 0) {
2577 TAILQ_FOREACH(opt, opts, link) {
2578 if (strcmp(opt->name, "errmsg") == 0) {
2579 strncpy((char *)opt->value, errmsg, opt->len);
2580 break;
2581 }
2582 }
2583 if (opt == NULL)
2584 printf("%s\n", errmsg);
2585 }
2586 return (ret);
2587 }
2588
2589 /*
2590 * Get a mount option by its name.
2591 *
2592 * Return 0 if the option was found, ENOENT otherwise.
2593 * If len is non-NULL it will be filled with the length
2594 * of the option. If buf is non-NULL, it will be filled
2595 * with the address of the option.
2596 */
2597 int
vfs_getopt(struct vfsoptlist * opts,const char * name,void ** buf,int * len)2598 vfs_getopt(struct vfsoptlist *opts, const char *name, void **buf, int *len)
2599 {
2600 struct vfsopt *opt;
2601
2602 KASSERT(opts != NULL, ("vfs_getopt: caller passed 'opts' as NULL"));
2603
2604 TAILQ_FOREACH(opt, opts, link) {
2605 if (strcmp(name, opt->name) == 0) {
2606 opt->seen = 1;
2607 if (len != NULL)
2608 *len = opt->len;
2609 if (buf != NULL)
2610 *buf = opt->value;
2611 return (0);
2612 }
2613 }
2614 return (ENOENT);
2615 }
2616
2617 int
vfs_getopt_pos(struct vfsoptlist * opts,const char * name)2618 vfs_getopt_pos(struct vfsoptlist *opts, const char *name)
2619 {
2620 struct vfsopt *opt;
2621
2622 if (opts == NULL)
2623 return (-1);
2624
2625 TAILQ_FOREACH(opt, opts, link) {
2626 if (strcmp(name, opt->name) == 0) {
2627 opt->seen = 1;
2628 return (opt->pos);
2629 }
2630 }
2631 return (-1);
2632 }
2633
2634 int
vfs_getopt_size(struct vfsoptlist * opts,const char * name,off_t * value)2635 vfs_getopt_size(struct vfsoptlist *opts, const char *name, off_t *value)
2636 {
2637 char *opt_value, *vtp;
2638 quad_t iv;
2639 int error, opt_len;
2640
2641 error = vfs_getopt(opts, name, (void **)&opt_value, &opt_len);
2642 if (error != 0)
2643 return (error);
2644 if (opt_len == 0 || opt_value == NULL)
2645 return (EINVAL);
2646 if (opt_value[0] == '\0' || opt_value[opt_len - 1] != '\0')
2647 return (EINVAL);
2648 iv = strtoq(opt_value, &vtp, 0);
2649 if (vtp == opt_value || (vtp[0] != '\0' && vtp[1] != '\0'))
2650 return (EINVAL);
2651 if (iv < 0)
2652 return (EINVAL);
2653 switch (vtp[0]) {
2654 case 't': case 'T':
2655 iv *= 1024;
2656 /* FALLTHROUGH */
2657 case 'g': case 'G':
2658 iv *= 1024;
2659 /* FALLTHROUGH */
2660 case 'm': case 'M':
2661 iv *= 1024;
2662 /* FALLTHROUGH */
2663 case 'k': case 'K':
2664 iv *= 1024;
2665 case '\0':
2666 break;
2667 default:
2668 return (EINVAL);
2669 }
2670 *value = iv;
2671
2672 return (0);
2673 }
2674
2675 char *
vfs_getopts(struct vfsoptlist * opts,const char * name,int * error)2676 vfs_getopts(struct vfsoptlist *opts, const char *name, int *error)
2677 {
2678 struct vfsopt *opt;
2679
2680 *error = 0;
2681 TAILQ_FOREACH(opt, opts, link) {
2682 if (strcmp(name, opt->name) != 0)
2683 continue;
2684 opt->seen = 1;
2685 if (opt->len == 0 ||
2686 ((char *)opt->value)[opt->len - 1] != '\0') {
2687 *error = EINVAL;
2688 return (NULL);
2689 }
2690 return (opt->value);
2691 }
2692 *error = ENOENT;
2693 return (NULL);
2694 }
2695
2696 int
vfs_flagopt(struct vfsoptlist * opts,const char * name,uint64_t * w,uint64_t val)2697 vfs_flagopt(struct vfsoptlist *opts, const char *name, uint64_t *w,
2698 uint64_t val)
2699 {
2700 struct vfsopt *opt;
2701
2702 TAILQ_FOREACH(opt, opts, link) {
2703 if (strcmp(name, opt->name) == 0) {
2704 opt->seen = 1;
2705 if (w != NULL)
2706 *w |= val;
2707 return (1);
2708 }
2709 }
2710 if (w != NULL)
2711 *w &= ~val;
2712 return (0);
2713 }
2714
2715 int
vfs_scanopt(struct vfsoptlist * opts,const char * name,const char * fmt,...)2716 vfs_scanopt(struct vfsoptlist *opts, const char *name, const char *fmt, ...)
2717 {
2718 va_list ap;
2719 struct vfsopt *opt;
2720 int ret;
2721
2722 KASSERT(opts != NULL, ("vfs_getopt: caller passed 'opts' as NULL"));
2723
2724 TAILQ_FOREACH(opt, opts, link) {
2725 if (strcmp(name, opt->name) != 0)
2726 continue;
2727 opt->seen = 1;
2728 if (opt->len == 0 || opt->value == NULL)
2729 return (0);
2730 if (((char *)opt->value)[opt->len - 1] != '\0')
2731 return (0);
2732 va_start(ap, fmt);
2733 ret = vsscanf(opt->value, fmt, ap);
2734 va_end(ap);
2735 return (ret);
2736 }
2737 return (0);
2738 }
2739
2740 int
vfs_setopt(struct vfsoptlist * opts,const char * name,void * value,int len)2741 vfs_setopt(struct vfsoptlist *opts, const char *name, void *value, int len)
2742 {
2743 struct vfsopt *opt;
2744
2745 TAILQ_FOREACH(opt, opts, link) {
2746 if (strcmp(name, opt->name) != 0)
2747 continue;
2748 opt->seen = 1;
2749 if (opt->value == NULL)
2750 opt->len = len;
2751 else {
2752 if (opt->len != len)
2753 return (EINVAL);
2754 bcopy(value, opt->value, len);
2755 }
2756 return (0);
2757 }
2758 return (ENOENT);
2759 }
2760
2761 int
vfs_setopt_part(struct vfsoptlist * opts,const char * name,void * value,int len)2762 vfs_setopt_part(struct vfsoptlist *opts, const char *name, void *value, int len)
2763 {
2764 struct vfsopt *opt;
2765
2766 TAILQ_FOREACH(opt, opts, link) {
2767 if (strcmp(name, opt->name) != 0)
2768 continue;
2769 opt->seen = 1;
2770 if (opt->value == NULL)
2771 opt->len = len;
2772 else {
2773 if (opt->len < len)
2774 return (EINVAL);
2775 opt->len = len;
2776 bcopy(value, opt->value, len);
2777 }
2778 return (0);
2779 }
2780 return (ENOENT);
2781 }
2782
2783 int
vfs_setopts(struct vfsoptlist * opts,const char * name,const char * value)2784 vfs_setopts(struct vfsoptlist *opts, const char *name, const char *value)
2785 {
2786 struct vfsopt *opt;
2787
2788 TAILQ_FOREACH(opt, opts, link) {
2789 if (strcmp(name, opt->name) != 0)
2790 continue;
2791 opt->seen = 1;
2792 if (opt->value == NULL)
2793 opt->len = strlen(value) + 1;
2794 else if (strlcpy(opt->value, value, opt->len) >= opt->len)
2795 return (EINVAL);
2796 return (0);
2797 }
2798 return (ENOENT);
2799 }
2800
2801 /*
2802 * Find and copy a mount option.
2803 *
2804 * The size of the buffer has to be specified
2805 * in len, if it is not the same length as the
2806 * mount option, EINVAL is returned.
2807 * Returns ENOENT if the option is not found.
2808 */
2809 int
vfs_copyopt(struct vfsoptlist * opts,const char * name,void * dest,int len)2810 vfs_copyopt(struct vfsoptlist *opts, const char *name, void *dest, int len)
2811 {
2812 struct vfsopt *opt;
2813
2814 KASSERT(opts != NULL, ("vfs_copyopt: caller passed 'opts' as NULL"));
2815
2816 TAILQ_FOREACH(opt, opts, link) {
2817 if (strcmp(name, opt->name) == 0) {
2818 opt->seen = 1;
2819 if (len != opt->len)
2820 return (EINVAL);
2821 bcopy(opt->value, dest, opt->len);
2822 return (0);
2823 }
2824 }
2825 return (ENOENT);
2826 }
2827
2828 int
__vfs_statfs(struct mount * mp,struct statfs * sbp)2829 __vfs_statfs(struct mount *mp, struct statfs *sbp)
2830 {
2831 /*
2832 * Filesystems only fill in part of the structure for updates, we
2833 * have to read the entirety first to get all content.
2834 */
2835 if (sbp != &mp->mnt_stat)
2836 memcpy(sbp, &mp->mnt_stat, sizeof(*sbp));
2837
2838 /*
2839 * Set these in case the underlying filesystem fails to do so.
2840 */
2841 sbp->f_version = STATFS_VERSION;
2842 sbp->f_namemax = NAME_MAX;
2843 sbp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK;
2844 sbp->f_nvnodelistsize = mp->mnt_nvnodelistsize;
2845
2846 return (mp->mnt_op->vfs_statfs(mp, sbp));
2847 }
2848
2849 void
vfs_mountedfrom(struct mount * mp,const char * from)2850 vfs_mountedfrom(struct mount *mp, const char *from)
2851 {
2852
2853 bzero(mp->mnt_stat.f_mntfromname, sizeof mp->mnt_stat.f_mntfromname);
2854 strlcpy(mp->mnt_stat.f_mntfromname, from,
2855 sizeof mp->mnt_stat.f_mntfromname);
2856 }
2857
2858 /*
2859 * ---------------------------------------------------------------------
2860 * This is the api for building mount args and mounting filesystems from
2861 * inside the kernel.
2862 *
2863 * The API works by accumulation of individual args. First error is
2864 * latched.
2865 *
2866 * XXX: should be documented in new manpage kernel_mount(9)
2867 */
2868
2869 /* A memory allocation which must be freed when we are done */
2870 struct mntaarg {
2871 SLIST_ENTRY(mntaarg) next;
2872 };
2873
2874 /* The header for the mount arguments */
2875 struct mntarg {
2876 struct iovec *v;
2877 int len;
2878 int error;
2879 SLIST_HEAD(, mntaarg) list;
2880 };
2881
2882 /*
2883 * Add a boolean argument.
2884 *
2885 * flag is the boolean value.
2886 * name must start with "no".
2887 */
2888 struct mntarg *
mount_argb(struct mntarg * ma,int flag,const char * name)2889 mount_argb(struct mntarg *ma, int flag, const char *name)
2890 {
2891
2892 KASSERT(name[0] == 'n' && name[1] == 'o',
2893 ("mount_argb(...,%s): name must start with 'no'", name));
2894
2895 return (mount_arg(ma, name + (flag ? 2 : 0), NULL, 0));
2896 }
2897
2898 /*
2899 * Add an argument printf style
2900 */
2901 struct mntarg *
mount_argf(struct mntarg * ma,const char * name,const char * fmt,...)2902 mount_argf(struct mntarg *ma, const char *name, const char *fmt, ...)
2903 {
2904 va_list ap;
2905 struct mntaarg *maa;
2906 struct sbuf *sb;
2907 int len;
2908
2909 if (ma == NULL) {
2910 ma = malloc(sizeof *ma, M_MOUNT, M_WAITOK | M_ZERO);
2911 SLIST_INIT(&ma->list);
2912 }
2913 if (ma->error)
2914 return (ma);
2915
2916 ma->v = realloc(ma->v, sizeof *ma->v * (ma->len + 2),
2917 M_MOUNT, M_WAITOK);
2918 ma->v[ma->len].iov_base = (void *)(uintptr_t)name;
2919 ma->v[ma->len].iov_len = strlen(name) + 1;
2920 ma->len++;
2921
2922 sb = sbuf_new_auto();
2923 va_start(ap, fmt);
2924 sbuf_vprintf(sb, fmt, ap);
2925 va_end(ap);
2926 sbuf_finish(sb);
2927 len = sbuf_len(sb) + 1;
2928 maa = malloc(sizeof *maa + len, M_MOUNT, M_WAITOK | M_ZERO);
2929 SLIST_INSERT_HEAD(&ma->list, maa, next);
2930 bcopy(sbuf_data(sb), maa + 1, len);
2931 sbuf_delete(sb);
2932
2933 ma->v[ma->len].iov_base = maa + 1;
2934 ma->v[ma->len].iov_len = len;
2935 ma->len++;
2936
2937 return (ma);
2938 }
2939
2940 /*
2941 * Add an argument which is a userland string.
2942 */
2943 struct mntarg *
mount_argsu(struct mntarg * ma,const char * name,const void * val,int len)2944 mount_argsu(struct mntarg *ma, const char *name, const void *val, int len)
2945 {
2946 struct mntaarg *maa;
2947 char *tbuf;
2948
2949 if (val == NULL)
2950 return (ma);
2951 if (ma == NULL) {
2952 ma = malloc(sizeof *ma, M_MOUNT, M_WAITOK | M_ZERO);
2953 SLIST_INIT(&ma->list);
2954 }
2955 if (ma->error)
2956 return (ma);
2957 maa = malloc(sizeof *maa + len, M_MOUNT, M_WAITOK | M_ZERO);
2958 SLIST_INSERT_HEAD(&ma->list, maa, next);
2959 tbuf = (void *)(maa + 1);
2960 ma->error = copyinstr(val, tbuf, len, NULL);
2961 return (mount_arg(ma, name, tbuf, -1));
2962 }
2963
2964 /*
2965 * Plain argument.
2966 *
2967 * If length is -1, treat value as a C string.
2968 */
2969 struct mntarg *
mount_arg(struct mntarg * ma,const char * name,const void * val,int len)2970 mount_arg(struct mntarg *ma, const char *name, const void *val, int len)
2971 {
2972
2973 if (ma == NULL) {
2974 ma = malloc(sizeof *ma, M_MOUNT, M_WAITOK | M_ZERO);
2975 SLIST_INIT(&ma->list);
2976 }
2977 if (ma->error)
2978 return (ma);
2979
2980 ma->v = realloc(ma->v, sizeof *ma->v * (ma->len + 2),
2981 M_MOUNT, M_WAITOK);
2982 ma->v[ma->len].iov_base = (void *)(uintptr_t)name;
2983 ma->v[ma->len].iov_len = strlen(name) + 1;
2984 ma->len++;
2985
2986 ma->v[ma->len].iov_base = (void *)(uintptr_t)val;
2987 if (len < 0)
2988 ma->v[ma->len].iov_len = strlen(val) + 1;
2989 else
2990 ma->v[ma->len].iov_len = len;
2991 ma->len++;
2992 return (ma);
2993 }
2994
2995 /*
2996 * Free a mntarg structure
2997 */
2998 static void
free_mntarg(struct mntarg * ma)2999 free_mntarg(struct mntarg *ma)
3000 {
3001 struct mntaarg *maa;
3002
3003 while (!SLIST_EMPTY(&ma->list)) {
3004 maa = SLIST_FIRST(&ma->list);
3005 SLIST_REMOVE_HEAD(&ma->list, next);
3006 free(maa, M_MOUNT);
3007 }
3008 free(ma->v, M_MOUNT);
3009 free(ma, M_MOUNT);
3010 }
3011
3012 /*
3013 * Mount a filesystem
3014 */
3015 int
kernel_mount(struct mntarg * ma,uint64_t flags)3016 kernel_mount(struct mntarg *ma, uint64_t flags)
3017 {
3018 struct uio auio;
3019 int error;
3020
3021 KASSERT(ma != NULL, ("kernel_mount NULL ma"));
3022 KASSERT(ma->error != 0 || ma->v != NULL, ("kernel_mount NULL ma->v"));
3023 KASSERT(!(ma->len & 1), ("kernel_mount odd ma->len (%d)", ma->len));
3024
3025 error = ma->error;
3026 if (error == 0) {
3027 auio.uio_iov = ma->v;
3028 auio.uio_iovcnt = ma->len;
3029 auio.uio_segflg = UIO_SYSSPACE;
3030 error = vfs_donmount(curthread, flags, &auio);
3031 }
3032 free_mntarg(ma);
3033 return (error);
3034 }
3035
3036 /* Map from mount options to printable formats. */
3037 static struct mntoptnames optnames[] = {
3038 MNTOPT_NAMES
3039 };
3040
3041 #define DEVCTL_LEN 1024
3042 static void
mount_devctl_event(const char * type,struct mount * mp,bool donew)3043 mount_devctl_event(const char *type, struct mount *mp, bool donew)
3044 {
3045 const uint8_t *cp;
3046 struct mntoptnames *fp;
3047 struct sbuf sb;
3048 struct statfs *sfp = &mp->mnt_stat;
3049 char *buf;
3050
3051 buf = malloc(DEVCTL_LEN, M_MOUNT, M_NOWAIT);
3052 if (buf == NULL)
3053 return;
3054 sbuf_new(&sb, buf, DEVCTL_LEN, SBUF_FIXEDLEN);
3055 sbuf_cpy(&sb, "mount-point=\"");
3056 devctl_safe_quote_sb(&sb, sfp->f_mntonname);
3057 sbuf_cat(&sb, "\" mount-dev=\"");
3058 devctl_safe_quote_sb(&sb, sfp->f_mntfromname);
3059 sbuf_cat(&sb, "\" mount-type=\"");
3060 devctl_safe_quote_sb(&sb, sfp->f_fstypename);
3061 sbuf_cat(&sb, "\" fsid=0x");
3062 cp = (const uint8_t *)&sfp->f_fsid.val[0];
3063 for (int i = 0; i < sizeof(sfp->f_fsid); i++)
3064 sbuf_printf(&sb, "%02x", cp[i]);
3065 sbuf_printf(&sb, " owner=%u flags=\"", sfp->f_owner);
3066 for (fp = optnames; fp->o_opt != 0; fp++) {
3067 if ((mp->mnt_flag & fp->o_opt) != 0) {
3068 sbuf_cat(&sb, fp->o_name);
3069 sbuf_putc(&sb, ';');
3070 }
3071 }
3072 sbuf_putc(&sb, '"');
3073 sbuf_finish(&sb);
3074
3075 /*
3076 * Options are not published because the form of the options depends on
3077 * the file system and may include binary data. In addition, they don't
3078 * necessarily provide enough useful information to be actionable when
3079 * devd processes them.
3080 */
3081
3082 if (sbuf_error(&sb) == 0)
3083 devctl_notify("VFS", "FS", type, sbuf_data(&sb));
3084 sbuf_delete(&sb);
3085 free(buf, M_MOUNT);
3086 }
3087
3088 /*
3089 * Force remount specified mount point to read-only. The argument
3090 * must be busied to avoid parallel unmount attempts.
3091 *
3092 * Intended use is to prevent further writes if some metadata
3093 * inconsistency is detected. Note that the function still flushes
3094 * all cached metadata and data for the mount point, which might be
3095 * not always suitable.
3096 */
3097 int
vfs_remount_ro(struct mount * mp)3098 vfs_remount_ro(struct mount *mp)
3099 {
3100 struct vfsoptlist *opts;
3101 struct vfsopt *opt;
3102 struct vnode *vp_covered, *rootvp;
3103 int error;
3104
3105 vfs_op_enter(mp);
3106 KASSERT(mp->mnt_lockref > 0,
3107 ("vfs_remount_ro: mp %p is not busied", mp));
3108 KASSERT((mp->mnt_kern_flag & MNTK_UNMOUNT) == 0,
3109 ("vfs_remount_ro: mp %p is being unmounted (and busy?)", mp));
3110
3111 rootvp = NULL;
3112 vp_covered = mp->mnt_vnodecovered;
3113 error = vget(vp_covered, LK_EXCLUSIVE | LK_NOWAIT);
3114 if (error != 0) {
3115 vfs_op_exit(mp);
3116 return (error);
3117 }
3118 VI_LOCK(vp_covered);
3119 if ((vp_covered->v_iflag & VI_MOUNT) != 0) {
3120 VI_UNLOCK(vp_covered);
3121 vput(vp_covered);
3122 vfs_op_exit(mp);
3123 return (EBUSY);
3124 }
3125 vp_covered->v_iflag |= VI_MOUNT;
3126 VI_UNLOCK(vp_covered);
3127 vn_seqc_write_begin(vp_covered);
3128
3129 MNT_ILOCK(mp);
3130 if ((mp->mnt_flag & MNT_RDONLY) != 0) {
3131 MNT_IUNLOCK(mp);
3132 error = EBUSY;
3133 goto out;
3134 }
3135 mp->mnt_flag |= MNT_UPDATE | MNT_FORCE | MNT_RDONLY;
3136 rootvp = vfs_cache_root_clear(mp);
3137 MNT_IUNLOCK(mp);
3138
3139 opts = malloc(sizeof(struct vfsoptlist), M_MOUNT, M_WAITOK | M_ZERO);
3140 TAILQ_INIT(opts);
3141 opt = malloc(sizeof(struct vfsopt), M_MOUNT, M_WAITOK | M_ZERO);
3142 opt->name = strdup("ro", M_MOUNT);
3143 opt->value = NULL;
3144 TAILQ_INSERT_TAIL(opts, opt, link);
3145 vfs_mergeopts(opts, mp->mnt_opt);
3146 mp->mnt_optnew = opts;
3147
3148 error = VFS_MOUNT(mp);
3149
3150 if (error == 0) {
3151 MNT_ILOCK(mp);
3152 mp->mnt_flag &= ~(MNT_UPDATE | MNT_FORCE);
3153 MNT_IUNLOCK(mp);
3154 vfs_deallocate_syncvnode(mp);
3155 if (mp->mnt_opt != NULL)
3156 vfs_freeopts(mp->mnt_opt);
3157 mp->mnt_opt = mp->mnt_optnew;
3158 } else {
3159 MNT_ILOCK(mp);
3160 mp->mnt_flag &= ~(MNT_UPDATE | MNT_FORCE | MNT_RDONLY);
3161 MNT_IUNLOCK(mp);
3162 vfs_freeopts(mp->mnt_optnew);
3163 }
3164 mp->mnt_optnew = NULL;
3165
3166 out:
3167 vfs_op_exit(mp);
3168 VI_LOCK(vp_covered);
3169 vp_covered->v_iflag &= ~VI_MOUNT;
3170 VI_UNLOCK(vp_covered);
3171 vput(vp_covered);
3172 vn_seqc_write_end(vp_covered);
3173 if (rootvp != NULL) {
3174 vn_seqc_write_end(rootvp);
3175 vrele(rootvp);
3176 }
3177 return (error);
3178 }
3179
3180 /*
3181 * Suspend write operations on all local writeable filesystems. Does
3182 * full sync of them in the process.
3183 *
3184 * Iterate over the mount points in reverse order, suspending most
3185 * recently mounted filesystems first. It handles a case where a
3186 * filesystem mounted from a md(4) vnode-backed device should be
3187 * suspended before the filesystem that owns the vnode.
3188 */
3189 void
suspend_all_fs(void)3190 suspend_all_fs(void)
3191 {
3192 struct mount *mp;
3193 int error;
3194
3195 mtx_lock(&mountlist_mtx);
3196 TAILQ_FOREACH_REVERSE(mp, &mountlist, mntlist, mnt_list) {
3197 error = vfs_busy(mp, MBF_MNTLSTLOCK | MBF_NOWAIT);
3198 if (error != 0)
3199 continue;
3200 if ((mp->mnt_flag & (MNT_RDONLY | MNT_LOCAL)) != MNT_LOCAL ||
3201 (mp->mnt_kern_flag & MNTK_SUSPEND) != 0) {
3202 mtx_lock(&mountlist_mtx);
3203 vfs_unbusy(mp);
3204 continue;
3205 }
3206 error = vfs_write_suspend(mp, 0);
3207 if (error == 0) {
3208 MNT_ILOCK(mp);
3209 MPASS((mp->mnt_kern_flag & MNTK_SUSPEND_ALL) == 0);
3210 mp->mnt_kern_flag |= MNTK_SUSPEND_ALL;
3211 MNT_IUNLOCK(mp);
3212 mtx_lock(&mountlist_mtx);
3213 } else {
3214 printf("suspend of %s failed, error %d\n",
3215 mp->mnt_stat.f_mntonname, error);
3216 mtx_lock(&mountlist_mtx);
3217 vfs_unbusy(mp);
3218 }
3219 }
3220 mtx_unlock(&mountlist_mtx);
3221 }
3222
3223 /*
3224 * Clone the mnt_exjail field to a new mount point.
3225 */
3226 void
vfs_exjail_clone(struct mount * inmp,struct mount * outmp)3227 vfs_exjail_clone(struct mount *inmp, struct mount *outmp)
3228 {
3229 struct ucred *cr;
3230 struct prison *pr;
3231
3232 MNT_ILOCK(inmp);
3233 cr = inmp->mnt_exjail;
3234 if (cr != NULL) {
3235 crhold(cr);
3236 MNT_IUNLOCK(inmp);
3237 pr = cr->cr_prison;
3238 sx_slock(&allprison_lock);
3239 if (!prison_isalive(pr)) {
3240 sx_sunlock(&allprison_lock);
3241 crfree(cr);
3242 return;
3243 }
3244 MNT_ILOCK(outmp);
3245 if (outmp->mnt_exjail == NULL) {
3246 outmp->mnt_exjail = cr;
3247 atomic_add_int(&pr->pr_exportcnt, 1);
3248 cr = NULL;
3249 }
3250 MNT_IUNLOCK(outmp);
3251 sx_sunlock(&allprison_lock);
3252 if (cr != NULL)
3253 crfree(cr);
3254 } else
3255 MNT_IUNLOCK(inmp);
3256 }
3257
3258 void
resume_all_fs(void)3259 resume_all_fs(void)
3260 {
3261 struct mount *mp;
3262
3263 mtx_lock(&mountlist_mtx);
3264 TAILQ_FOREACH(mp, &mountlist, mnt_list) {
3265 if ((mp->mnt_kern_flag & MNTK_SUSPEND_ALL) == 0)
3266 continue;
3267 mtx_unlock(&mountlist_mtx);
3268 MNT_ILOCK(mp);
3269 MPASS((mp->mnt_kern_flag & MNTK_SUSPEND) != 0);
3270 mp->mnt_kern_flag &= ~MNTK_SUSPEND_ALL;
3271 MNT_IUNLOCK(mp);
3272 vfs_write_resume(mp, 0);
3273 mtx_lock(&mountlist_mtx);
3274 vfs_unbusy(mp);
3275 }
3276 mtx_unlock(&mountlist_mtx);
3277 }
3278
3279 static void
pnfsd_waitreplenish(struct mount * mp)3280 pnfsd_waitreplenish(struct mount *mp)
3281 {
3282 struct netexport *nep;
3283
3284 lockmgr(&mp->mnt_explock, LK_SHARED, NULL);
3285 nep = mp->mnt_export;
3286 if (nep != NULL) {
3287 refcount_acquire(&nep->ne_ref);
3288 lockmgr(&mp->mnt_explock, LK_RELEASE, NULL);
3289 MNTEXP_LOCK(nep);
3290 if (nep->ne_pnfsnumfile != NULL &&
3291 nep->ne_pnfsnumfile != PNFSD_STOPPED) {
3292 nep->ne_pnfsnumfile = PNFSD_STOP;
3293 wakeup(&mp->mnt_export);
3294 while (nep->ne_pnfsnumfile != PNFSD_STOPPED)
3295 (void)msleep(&mp->mnt_explock, MNTEXP_MTX(nep),
3296 PVFS, "pnfsw", hz);
3297 }
3298 MNTEXP_UNLOCK(nep);
3299 vfs_netexport_release(nep);
3300 } else
3301 lockmgr(&mp->mnt_explock, LK_RELEASE, NULL);
3302 }
3303