1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1999-2004 Poul-Henning Kamp 5 * Copyright (c) 1999 Michael Smith 6 * Copyright (c) 1989, 1993 7 * The Regents of the University of California. All rights reserved. 8 * (c) UNIX System Laboratories, Inc. 9 * All or some portions of this file are derived from material licensed 10 * to the University of California by American Telephone and Telegraph 11 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 12 * the permission of UNIX System Laboratories, Inc. 13 * 14 * Redistribution and use in source and binary forms, with or without 15 * modification, are permitted provided that the following conditions 16 * are met: 17 * 1. Redistributions of source code must retain the above copyright 18 * notice, this list of conditions and the following disclaimer. 19 * 2. Redistributions in binary form must reproduce the above copyright 20 * notice, this list of conditions and the following disclaimer in the 21 * documentation and/or other materials provided with the distribution. 22 * 3. Neither the name of the University nor the names of its contributors 23 * may be used to endorse or promote products derived from this software 24 * without specific prior written permission. 25 * 26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 29 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 */ 38 39 #include <sys/param.h> 40 #include <sys/conf.h> 41 #include <sys/smp.h> 42 #include <sys/devctl.h> 43 #include <sys/eventhandler.h> 44 #include <sys/fcntl.h> 45 #include <sys/jail.h> 46 #include <sys/kernel.h> 47 #include <sys/ktr.h> 48 #include <sys/libkern.h> 49 #include <sys/limits.h> 50 #include <sys/malloc.h> 51 #include <sys/mount.h> 52 #include <sys/mutex.h> 53 #include <sys/namei.h> 54 #include <sys/priv.h> 55 #include <sys/proc.h> 56 #include <sys/filedesc.h> 57 #include <sys/reboot.h> 58 #include <sys/sbuf.h> 59 #include <sys/stdarg.h> 60 #include <sys/syscallsubr.h> 61 #include <sys/sysproto.h> 62 #include <sys/sx.h> 63 #include <sys/sysctl.h> 64 #include <sys/systm.h> 65 #include <sys/taskqueue.h> 66 #include <sys/vnode.h> 67 #include <vm/uma.h> 68 69 #include <netinet/in.h> 70 #include <net/radix.h> 71 #include <sys/netexport.h> 72 73 #include <geom/geom.h> 74 75 #include <security/audit/audit.h> 76 #include <security/mac/mac_framework.h> 77 78 #define VFS_MOUNTARG_SIZE_MAX (1024 * 64) 79 80 static int vfs_domount(struct thread *td, const char *fstype, char *fspath, 81 uint64_t fsflags, bool only_export, bool jail_export, 82 char *check_fsid_str, char **bailmsg_p, 83 struct vfsoptlist **optlist); 84 static void free_mntarg(struct mntarg *ma); 85 static void pnfsd_waitreplenish(struct mount *mp); 86 87 static int usermount = 0; 88 SYSCTL_INT(_vfs, OID_AUTO, usermount, CTLFLAG_RW, &usermount, 0, 89 "Unprivileged users may mount and unmount file systems"); 90 91 static bool default_autoro = false; 92 SYSCTL_BOOL(_vfs, OID_AUTO, default_autoro, CTLFLAG_RW, &default_autoro, 0, 93 "Retry failed r/w mount as r/o if no explicit ro/rw option is specified"); 94 95 static bool recursive_forced_unmount = false; 96 SYSCTL_BOOL(_vfs, OID_AUTO, recursive_forced_unmount, CTLFLAG_RW, 97 &recursive_forced_unmount, 0, "Recursively unmount stacked upper mounts" 98 " when a file system is forcibly unmounted"); 99 100 static SYSCTL_NODE(_vfs, OID_AUTO, deferred_unmount, 101 CTLFLAG_RD | CTLFLAG_MPSAFE, 0, "deferred unmount controls"); 102 103 static unsigned int deferred_unmount_retry_limit = 10; 104 SYSCTL_UINT(_vfs_deferred_unmount, OID_AUTO, retry_limit, CTLFLAG_RW, 105 &deferred_unmount_retry_limit, 0, 106 "Maximum number of retries for deferred unmount failure"); 107 108 static int deferred_unmount_retry_delay_hz; 109 SYSCTL_INT(_vfs_deferred_unmount, OID_AUTO, retry_delay_hz, CTLFLAG_RW, 110 &deferred_unmount_retry_delay_hz, 0, 111 "Delay in units of [1/kern.hz]s when retrying a failed deferred unmount"); 112 113 static int deferred_unmount_total_retries = 0; 114 SYSCTL_INT(_vfs_deferred_unmount, OID_AUTO, total_retries, CTLFLAG_RD, 115 &deferred_unmount_total_retries, 0, 116 "Total number of retried deferred unmounts"); 117 118 MALLOC_DEFINE(M_MOUNT, "mount", "vfs mount structure"); 119 MALLOC_DEFINE(M_STATFS, "statfs", "statfs structure"); 120 static uma_zone_t mount_zone; 121 122 /* List of mounted filesystems. */ 123 struct mntlist mountlist = TAILQ_HEAD_INITIALIZER(mountlist); 124 125 /* For any iteration/modification of mountlist */ 126 struct mtx_padalign __exclusive_cache_line mountlist_mtx; 127 128 EVENTHANDLER_LIST_DEFINE(vfs_mounted); 129 EVENTHANDLER_LIST_DEFINE(vfs_unmounted); 130 131 static void vfs_deferred_unmount(void *arg, int pending); 132 static struct timeout_task deferred_unmount_task; 133 static struct mtx deferred_unmount_lock; 134 MTX_SYSINIT(deferred_unmount, &deferred_unmount_lock, "deferred_unmount", 135 MTX_DEF); 136 static STAILQ_HEAD(, mount) deferred_unmount_list = 137 STAILQ_HEAD_INITIALIZER(deferred_unmount_list); 138 TASKQUEUE_DEFINE_THREAD(deferred_unmount); 139 140 static void mount_devctl_event(const char *type, struct mount *mp, bool donew); 141 142 /* 143 * Global opts, taken by all filesystems 144 */ 145 static const char *global_opts[] = { 146 "errmsg", 147 "fstype", 148 "fspath", 149 "ro", 150 "rw", 151 "nosuid", 152 "noexec", 153 NULL 154 }; 155 156 static int 157 mount_init(void *mem, int size, int flags) 158 { 159 struct mount *mp; 160 161 mp = (struct mount *)mem; 162 mtx_init(&mp->mnt_mtx, "struct mount mtx", NULL, MTX_DEF); 163 mtx_init(&mp->mnt_listmtx, "struct mount vlist mtx", NULL, MTX_DEF); 164 lockinit(&mp->mnt_explock, PVFS, "explock", 0, 0); 165 lockinit(&mp->mnt_renamelock, PVFS, "rename", 0, 0); 166 mp->mnt_pcpu = uma_zalloc_pcpu(pcpu_zone_16, M_WAITOK | M_ZERO); 167 mp->mnt_ref = 0; 168 mp->mnt_vfs_ops = 1; 169 mp->mnt_rootvnode = NULL; 170 return (0); 171 } 172 173 static void 174 mount_fini(void *mem, int size) 175 { 176 struct mount *mp; 177 178 mp = (struct mount *)mem; 179 uma_zfree_pcpu(pcpu_zone_16, mp->mnt_pcpu); 180 lockdestroy(&mp->mnt_renamelock); 181 lockdestroy(&mp->mnt_explock); 182 mtx_destroy(&mp->mnt_listmtx); 183 mtx_destroy(&mp->mnt_mtx); 184 } 185 186 static void 187 vfs_mount_init(void *dummy __unused) 188 { 189 TIMEOUT_TASK_INIT(taskqueue_deferred_unmount, &deferred_unmount_task, 190 0, vfs_deferred_unmount, NULL); 191 deferred_unmount_retry_delay_hz = hz; 192 mount_zone = uma_zcreate("Mountpoints", sizeof(struct mount), NULL, 193 NULL, mount_init, mount_fini, UMA_ALIGN_CACHE, UMA_ZONE_NOFREE); 194 mtx_init(&mountlist_mtx, "mountlist", NULL, MTX_DEF); 195 } 196 SYSINIT(vfs_mount, SI_SUB_VFS, SI_ORDER_ANY, vfs_mount_init, NULL); 197 198 /* 199 * --------------------------------------------------------------------- 200 * Functions for building and sanitizing the mount options 201 */ 202 203 /* Remove one mount option. */ 204 static void 205 vfs_freeopt(struct vfsoptlist *opts, struct vfsopt *opt) 206 { 207 208 TAILQ_REMOVE(opts, opt, link); 209 free(opt->name, M_MOUNT); 210 if (opt->value != NULL) 211 free(opt->value, M_MOUNT); 212 free(opt, M_MOUNT); 213 } 214 215 /* Release all resources related to the mount options. */ 216 void 217 vfs_freeopts(struct vfsoptlist *opts) 218 { 219 struct vfsopt *opt; 220 221 while (!TAILQ_EMPTY(opts)) { 222 opt = TAILQ_FIRST(opts); 223 vfs_freeopt(opts, opt); 224 } 225 free(opts, M_MOUNT); 226 } 227 228 void 229 vfs_deleteopt(struct vfsoptlist *opts, const char *name) 230 { 231 struct vfsopt *opt, *temp; 232 233 if (opts == NULL) 234 return; 235 TAILQ_FOREACH_SAFE(opt, opts, link, temp) { 236 if (strcmp(opt->name, name) == 0) 237 vfs_freeopt(opts, opt); 238 } 239 } 240 241 static int 242 vfs_isopt_ro(const char *opt) 243 { 244 245 if (strcmp(opt, "ro") == 0 || strcmp(opt, "rdonly") == 0 || 246 strcmp(opt, "norw") == 0) 247 return (1); 248 return (0); 249 } 250 251 static int 252 vfs_isopt_rw(const char *opt) 253 { 254 255 if (strcmp(opt, "rw") == 0 || strcmp(opt, "noro") == 0) 256 return (1); 257 return (0); 258 } 259 260 /* 261 * Check if options are equal (with or without the "no" prefix). 262 */ 263 static int 264 vfs_equalopts(const char *opt1, const char *opt2) 265 { 266 char *p; 267 268 /* "opt" vs. "opt" or "noopt" vs. "noopt" */ 269 if (strcmp(opt1, opt2) == 0) 270 return (1); 271 /* "noopt" vs. "opt" */ 272 if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0) 273 return (1); 274 /* "opt" vs. "noopt" */ 275 if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0) 276 return (1); 277 while ((p = strchr(opt1, '.')) != NULL && 278 !strncmp(opt1, opt2, ++p - opt1)) { 279 opt2 += p - opt1; 280 opt1 = p; 281 /* "foo.noopt" vs. "foo.opt" */ 282 if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0) 283 return (1); 284 /* "foo.opt" vs. "foo.noopt" */ 285 if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0) 286 return (1); 287 } 288 /* "ro" / "rdonly" / "norw" / "rw" / "noro" */ 289 if ((vfs_isopt_ro(opt1) || vfs_isopt_rw(opt1)) && 290 (vfs_isopt_ro(opt2) || vfs_isopt_rw(opt2))) 291 return (1); 292 return (0); 293 } 294 295 /* 296 * If a mount option is specified several times, 297 * (with or without the "no" prefix) only keep 298 * the last occurrence of it. 299 */ 300 static void 301 vfs_sanitizeopts(struct vfsoptlist *opts) 302 { 303 struct vfsopt *opt, *opt2, *tmp; 304 305 TAILQ_FOREACH_REVERSE(opt, opts, vfsoptlist, link) { 306 opt2 = TAILQ_PREV(opt, vfsoptlist, link); 307 while (opt2 != NULL) { 308 if (vfs_equalopts(opt->name, opt2->name)) { 309 tmp = TAILQ_PREV(opt2, vfsoptlist, link); 310 vfs_freeopt(opts, opt2); 311 opt2 = tmp; 312 } else { 313 opt2 = TAILQ_PREV(opt2, vfsoptlist, link); 314 } 315 } 316 } 317 } 318 319 /* 320 * Build a linked list of mount options from a struct uio. 321 */ 322 int 323 vfs_buildopts(struct uio *auio, struct vfsoptlist **options) 324 { 325 struct vfsoptlist *opts; 326 struct vfsopt *opt; 327 size_t memused, namelen, optlen; 328 unsigned int i, iovcnt; 329 int error; 330 331 opts = malloc(sizeof(struct vfsoptlist), M_MOUNT, M_WAITOK); 332 TAILQ_INIT(opts); 333 memused = 0; 334 iovcnt = auio->uio_iovcnt; 335 for (i = 0; i < iovcnt; i += 2) { 336 namelen = auio->uio_iov[i].iov_len; 337 optlen = auio->uio_iov[i + 1].iov_len; 338 memused += sizeof(struct vfsopt) + optlen + namelen; 339 /* 340 * Avoid consuming too much memory, and attempts to overflow 341 * memused. 342 */ 343 if (memused > VFS_MOUNTARG_SIZE_MAX || 344 optlen > VFS_MOUNTARG_SIZE_MAX || 345 namelen > VFS_MOUNTARG_SIZE_MAX) { 346 error = EINVAL; 347 goto bad; 348 } 349 350 opt = malloc(sizeof(struct vfsopt), M_MOUNT, M_WAITOK); 351 opt->name = malloc(namelen, M_MOUNT, M_WAITOK); 352 opt->value = NULL; 353 opt->len = 0; 354 opt->pos = i / 2; 355 opt->seen = 0; 356 357 /* 358 * Do this early, so jumps to "bad" will free the current 359 * option. 360 */ 361 TAILQ_INSERT_TAIL(opts, opt, link); 362 363 if (auio->uio_segflg == UIO_SYSSPACE) { 364 bcopy(auio->uio_iov[i].iov_base, opt->name, namelen); 365 } else { 366 error = copyin(auio->uio_iov[i].iov_base, opt->name, 367 namelen); 368 if (error) 369 goto bad; 370 } 371 /* Ensure names are null-terminated strings. */ 372 if (namelen == 0 || opt->name[namelen - 1] != '\0') { 373 error = EINVAL; 374 goto bad; 375 } 376 if (optlen != 0) { 377 opt->len = optlen; 378 opt->value = malloc(optlen, M_MOUNT, M_WAITOK); 379 if (auio->uio_segflg == UIO_SYSSPACE) { 380 bcopy(auio->uio_iov[i + 1].iov_base, opt->value, 381 optlen); 382 } else { 383 error = copyin(auio->uio_iov[i + 1].iov_base, 384 opt->value, optlen); 385 if (error) 386 goto bad; 387 } 388 } 389 } 390 vfs_sanitizeopts(opts); 391 *options = opts; 392 return (0); 393 bad: 394 vfs_freeopts(opts); 395 return (error); 396 } 397 398 /* 399 * Merge the old mount options with the new ones passed 400 * in the MNT_UPDATE case. 401 * 402 * XXX: This function will keep a "nofoo" option in the new 403 * options. E.g, if the option's canonical name is "foo", 404 * "nofoo" ends up in the mount point's active options. 405 */ 406 static void 407 vfs_mergeopts(struct vfsoptlist *toopts, struct vfsoptlist *oldopts) 408 { 409 struct vfsopt *opt, *new; 410 411 TAILQ_FOREACH(opt, oldopts, link) { 412 new = malloc(sizeof(struct vfsopt), M_MOUNT, M_WAITOK); 413 new->name = strdup(opt->name, M_MOUNT); 414 if (opt->len != 0) { 415 new->value = malloc(opt->len, M_MOUNT, M_WAITOK); 416 bcopy(opt->value, new->value, opt->len); 417 } else 418 new->value = NULL; 419 new->len = opt->len; 420 new->seen = opt->seen; 421 TAILQ_INSERT_HEAD(toopts, new, link); 422 } 423 vfs_sanitizeopts(toopts); 424 } 425 426 /* 427 * Mount a filesystem. 428 */ 429 #ifndef _SYS_SYSPROTO_H_ 430 struct nmount_args { 431 struct iovec *iovp; 432 unsigned int iovcnt; 433 int flags; 434 }; 435 #endif 436 int 437 sys_nmount(struct thread *td, struct nmount_args *uap) 438 { 439 struct uio *auio; 440 int error; 441 u_int iovcnt; 442 uint64_t flags; 443 444 /* 445 * Mount flags are now 64-bits. On 32-bit archtectures only 446 * 32-bits are passed in, but from here on everything handles 447 * 64-bit flags correctly. 448 */ 449 flags = uap->flags; 450 451 AUDIT_ARG_FFLAGS(flags); 452 CTR4(KTR_VFS, "%s: iovp %p with iovcnt %d and flags %d", __func__, 453 uap->iovp, uap->iovcnt, flags); 454 455 /* 456 * Filter out MNT_ROOTFS. We do not want clients of nmount() in 457 * userspace to set this flag, but we must filter it out if we want 458 * MNT_UPDATE on the root file system to work. 459 * MNT_ROOTFS should only be set by the kernel when mounting its 460 * root file system. 461 */ 462 flags &= ~MNT_ROOTFS; 463 464 iovcnt = uap->iovcnt; 465 /* 466 * Check that we have an even number of iovec's 467 * and that we have at least two options. 468 */ 469 if ((iovcnt & 1) || (iovcnt < 4)) { 470 CTR2(KTR_VFS, "%s: failed for invalid iovcnt %d", __func__, 471 uap->iovcnt); 472 return (EINVAL); 473 } 474 475 error = copyinuio(uap->iovp, iovcnt, &auio); 476 if (error) { 477 CTR2(KTR_VFS, "%s: failed for invalid uio op with %d errno", 478 __func__, error); 479 return (error); 480 } 481 error = vfs_donmount(td, flags, auio); 482 483 freeuio(auio); 484 return (error); 485 } 486 487 /* 488 * --------------------------------------------------------------------- 489 * Various utility functions 490 */ 491 492 /* 493 * Get a reference on a mount point from a vnode. 494 * 495 * The vnode is allowed to be passed unlocked and race against dooming. Note in 496 * such case there are no guarantees the referenced mount point will still be 497 * associated with it after the function returns. 498 */ 499 struct mount * 500 vfs_ref_from_vp(struct vnode *vp) 501 { 502 struct mount *mp; 503 struct mount_pcpu *mpcpu; 504 505 mp = atomic_load_ptr(&vp->v_mount); 506 if (__predict_false(mp == NULL)) { 507 return (mp); 508 } 509 if (vfs_op_thread_enter(mp, &mpcpu)) { 510 if (__predict_true(mp == vp->v_mount)) { 511 vfs_mp_count_add_pcpu(mpcpu, ref, 1); 512 vfs_op_thread_exit(mp, mpcpu); 513 } else { 514 vfs_op_thread_exit(mp, mpcpu); 515 mp = NULL; 516 } 517 } else { 518 MNT_ILOCK(mp); 519 if (mp == vp->v_mount) { 520 MNT_REF(mp); 521 MNT_IUNLOCK(mp); 522 } else { 523 MNT_IUNLOCK(mp); 524 mp = NULL; 525 } 526 } 527 return (mp); 528 } 529 530 void 531 vfs_ref(struct mount *mp) 532 { 533 struct mount_pcpu *mpcpu; 534 535 CTR2(KTR_VFS, "%s: mp %p", __func__, mp); 536 if (vfs_op_thread_enter(mp, &mpcpu)) { 537 vfs_mp_count_add_pcpu(mpcpu, ref, 1); 538 vfs_op_thread_exit(mp, mpcpu); 539 return; 540 } 541 542 MNT_ILOCK(mp); 543 MNT_REF(mp); 544 MNT_IUNLOCK(mp); 545 } 546 547 /* 548 * Register ump as an upper mount of the mount associated with 549 * vnode vp. This registration will be tracked through 550 * mount_upper_node upper, which should be allocated by the 551 * caller and stored in per-mount data associated with mp. 552 * 553 * If successful, this function will return the mount associated 554 * with vp, and will ensure that it cannot be unmounted until 555 * ump has been unregistered as one of its upper mounts. 556 * 557 * Upon failure this function will return NULL. 558 */ 559 struct mount * 560 vfs_register_upper_from_vp(struct vnode *vp, struct mount *ump, 561 struct mount_upper_node *upper) 562 { 563 struct mount *mp; 564 565 mp = atomic_load_ptr(&vp->v_mount); 566 if (mp == NULL) 567 return (NULL); 568 MNT_ILOCK(mp); 569 if (mp != vp->v_mount || 570 ((mp->mnt_kern_flag & (MNTK_UNMOUNT | MNTK_RECURSE)) != 0)) { 571 MNT_IUNLOCK(mp); 572 return (NULL); 573 } 574 KASSERT(ump != mp, ("upper and lower mounts are identical")); 575 upper->mp = ump; 576 MNT_REF(mp); 577 TAILQ_INSERT_TAIL(&mp->mnt_uppers, upper, mnt_upper_link); 578 MNT_IUNLOCK(mp); 579 return (mp); 580 } 581 582 /* 583 * Register upper mount ump to receive vnode unlink/reclaim 584 * notifications from lower mount mp. This registration will 585 * be tracked through mount_upper_node upper, which should be 586 * allocated by the caller and stored in per-mount data 587 * associated with mp. 588 * 589 * ump must already be registered as an upper mount of mp 590 * through a call to vfs_register_upper_from_vp(). 591 */ 592 void 593 vfs_register_for_notification(struct mount *mp, struct mount *ump, 594 struct mount_upper_node *upper) 595 { 596 upper->mp = ump; 597 MNT_ILOCK(mp); 598 TAILQ_INSERT_TAIL(&mp->mnt_notify, upper, mnt_upper_link); 599 MNT_IUNLOCK(mp); 600 } 601 602 static void 603 vfs_drain_upper_locked(struct mount *mp) 604 { 605 mtx_assert(MNT_MTX(mp), MA_OWNED); 606 while (mp->mnt_upper_pending != 0) { 607 mp->mnt_kern_flag |= MNTK_UPPER_WAITER; 608 msleep(&mp->mnt_uppers, MNT_MTX(mp), 0, "mntupw", 0); 609 } 610 } 611 612 /* 613 * Undo a previous call to vfs_register_for_notification(). 614 * The mount represented by upper must be currently registered 615 * as an upper mount for mp. 616 */ 617 void 618 vfs_unregister_for_notification(struct mount *mp, 619 struct mount_upper_node *upper) 620 { 621 MNT_ILOCK(mp); 622 vfs_drain_upper_locked(mp); 623 TAILQ_REMOVE(&mp->mnt_notify, upper, mnt_upper_link); 624 MNT_IUNLOCK(mp); 625 } 626 627 /* 628 * Undo a previous call to vfs_register_upper_from_vp(). 629 * This must be done before mp can be unmounted. 630 */ 631 void 632 vfs_unregister_upper(struct mount *mp, struct mount_upper_node *upper) 633 { 634 MNT_ILOCK(mp); 635 KASSERT((mp->mnt_kern_flag & MNTK_UNMOUNT) == 0, 636 ("registered upper with pending unmount")); 637 vfs_drain_upper_locked(mp); 638 TAILQ_REMOVE(&mp->mnt_uppers, upper, mnt_upper_link); 639 if ((mp->mnt_kern_flag & MNTK_TASKQUEUE_WAITER) != 0 && 640 TAILQ_EMPTY(&mp->mnt_uppers)) { 641 mp->mnt_kern_flag &= ~MNTK_TASKQUEUE_WAITER; 642 wakeup(&mp->mnt_taskqueue_link); 643 } 644 MNT_REL(mp); 645 MNT_IUNLOCK(mp); 646 } 647 648 void 649 vfs_rel(struct mount *mp) 650 { 651 struct mount_pcpu *mpcpu; 652 653 CTR2(KTR_VFS, "%s: mp %p", __func__, mp); 654 if (vfs_op_thread_enter(mp, &mpcpu)) { 655 vfs_mp_count_sub_pcpu(mpcpu, ref, 1); 656 vfs_op_thread_exit(mp, mpcpu); 657 return; 658 } 659 660 MNT_ILOCK(mp); 661 MNT_REL(mp); 662 MNT_IUNLOCK(mp); 663 } 664 665 /* 666 * Allocate and initialize the mount point struct. 667 */ 668 struct mount * 669 vfs_mount_alloc(struct vnode *vp, struct vfsconf *vfsp, const char *fspath, 670 struct ucred *cred) 671 { 672 struct mount *mp; 673 674 mp = uma_zalloc(mount_zone, M_WAITOK); 675 bzero(&mp->mnt_startzero, 676 __rangeof(struct mount, mnt_startzero, mnt_endzero)); 677 mp->mnt_kern_flag = 0; 678 mp->mnt_flag = 0; 679 mp->mnt_rootvnode = NULL; 680 mp->mnt_vnodecovered = NULL; 681 mp->mnt_op = NULL; 682 mp->mnt_vfc = NULL; 683 TAILQ_INIT(&mp->mnt_nvnodelist); 684 mp->mnt_nvnodelistsize = 0; 685 TAILQ_INIT(&mp->mnt_lazyvnodelist); 686 mp->mnt_lazyvnodelistsize = 0; 687 MPPASS(mp->mnt_ref == 0 && mp->mnt_lockref == 0 && 688 mp->mnt_writeopcount == 0, mp); 689 MPASSERT(mp->mnt_vfs_ops == 1, mp, 690 ("vfs_ops should be 1 but %d found", mp->mnt_vfs_ops)); 691 (void) vfs_busy(mp, MBF_NOWAIT); 692 mp->mnt_op = vfsp->vfc_vfsops; 693 mp->mnt_vfc = vfsp; 694 mp->mnt_stat.f_type = vfsp->vfc_typenum; 695 mp->mnt_gen++; 696 strlcpy(mp->mnt_stat.f_fstypename, vfsp->vfc_name, MFSNAMELEN); 697 mp->mnt_vnodecovered = vp; 698 mp->mnt_cred = crdup(cred); 699 mp->mnt_stat.f_owner = cred->cr_uid; 700 strlcpy(mp->mnt_stat.f_mntonname, fspath, MNAMELEN); 701 mp->mnt_iosize_max = DFLTPHYS; 702 #ifdef MAC 703 mac_mount_init(mp); 704 mac_mount_create(cred, mp); 705 #endif 706 arc4rand(&mp->mnt_hashseed, sizeof mp->mnt_hashseed, 0); 707 mp->mnt_upper_pending = 0; 708 TAILQ_INIT(&mp->mnt_uppers); 709 TAILQ_INIT(&mp->mnt_notify); 710 mp->mnt_taskqueue_flags = 0; 711 mp->mnt_unmount_retries = 0; 712 return (mp); 713 } 714 715 /* 716 * Destroy the mount struct previously allocated by vfs_mount_alloc(). 717 */ 718 void 719 vfs_mount_destroy(struct mount *mp) 720 { 721 722 MPPASS(mp->mnt_vfs_ops != 0, mp); 723 724 vfs_assert_mount_counters(mp); 725 726 MNT_ILOCK(mp); 727 mp->mnt_kern_flag |= MNTK_REFEXPIRE; 728 if (mp->mnt_kern_flag & MNTK_MWAIT) { 729 mp->mnt_kern_flag &= ~MNTK_MWAIT; 730 wakeup(mp); 731 } 732 while (mp->mnt_ref) 733 msleep(mp, MNT_MTX(mp), PVFS, "mntref", 0); 734 KASSERT(mp->mnt_ref == 0, 735 ("%s: invalid refcount in the drain path @ %s:%d", __func__, 736 __FILE__, __LINE__)); 737 MPPASS(mp->mnt_writeopcount == 0, mp); 738 MPPASS(mp->mnt_secondary_writes == 0, mp); 739 if (!TAILQ_EMPTY(&mp->mnt_nvnodelist)) { 740 struct vnode *vp; 741 742 TAILQ_FOREACH(vp, &mp->mnt_nvnodelist, v_nmntvnodes) 743 vn_printf(vp, "dangling vnode "); 744 panic("unmount: dangling vnode"); 745 } 746 KASSERT(mp->mnt_upper_pending == 0, ("mnt_upper_pending")); 747 KASSERT(TAILQ_EMPTY(&mp->mnt_uppers), ("mnt_uppers")); 748 KASSERT(TAILQ_EMPTY(&mp->mnt_notify), ("mnt_notify")); 749 MPPASS(mp->mnt_nvnodelistsize == 0, mp); 750 MPPASS(mp->mnt_lazyvnodelistsize == 0, mp); 751 MPPASS(mp->mnt_lockref == 0, mp); 752 MNT_IUNLOCK(mp); 753 754 MPASSERT(mp->mnt_vfs_ops == 1, mp, 755 ("vfs_ops should be 1 but %d found", mp->mnt_vfs_ops)); 756 757 MPASSERT(mp->mnt_rootvnode == NULL, mp, 758 ("mount point still has a root vnode %p", mp->mnt_rootvnode)); 759 760 if (mp->mnt_vnodecovered != NULL) 761 vrele(mp->mnt_vnodecovered); 762 #ifdef MAC 763 mac_mount_destroy(mp); 764 #endif 765 if (mp->mnt_opt != NULL) 766 vfs_freeopts(mp->mnt_opt); 767 if (mp->mnt_exjail != NULL) { 768 atomic_subtract_int(&mp->mnt_exjail->cr_prison->pr_exportcnt, 769 1); 770 crfree(mp->mnt_exjail); 771 } 772 if (mp->mnt_export != NULL) { 773 vfs_free_addrlist(mp->mnt_export); 774 vfs_netexport_release(mp->mnt_export); 775 } 776 vfsconf_lock(); 777 mp->mnt_vfc->vfc_refcount--; 778 vfsconf_unlock(); 779 crfree(mp->mnt_cred); 780 uma_zfree(mount_zone, mp); 781 } 782 783 static bool 784 vfs_should_downgrade_to_ro_mount(uint64_t fsflags, int error) 785 { 786 /* This is an upgrade of an exisiting mount. */ 787 if ((fsflags & MNT_UPDATE) != 0) 788 return (false); 789 /* This is already an R/O mount. */ 790 if ((fsflags & MNT_RDONLY) != 0) 791 return (false); 792 793 switch (error) { 794 case ENODEV: /* generic, geom, ... */ 795 case EACCES: /* cam/scsi, ... */ 796 case EROFS: /* md, mmcsd, ... */ 797 /* 798 * These errors can be returned by the storage layer to signal 799 * that the media is read-only. No harm in the R/O mount 800 * attempt if the error was returned for some other reason. 801 */ 802 return (true); 803 default: 804 return (false); 805 } 806 } 807 808 int 809 vfs_donmount(struct thread *td, uint64_t fsflags, struct uio *fsoptions) 810 { 811 struct vfsoptlist *optlist; 812 struct vfsopt *opt, *tmp_opt; 813 char *fstype, *fspath, *errmsg, *bailmsg, *check_fsid_str; 814 int error, fstypelen, fspathlen, errmsg_len, errmsg_pos; 815 bool autoro, has_nonexport, only_export, jail_export; 816 817 errmsg = fspath = check_fsid_str = bailmsg = NULL; 818 errmsg_len = fspathlen = 0; 819 errmsg_pos = -1; 820 autoro = default_autoro; 821 822 error = vfs_buildopts(fsoptions, &optlist); 823 if (error) 824 return (error); 825 826 if (vfs_getopt(optlist, "errmsg", (void **)&errmsg, &errmsg_len) == 0) 827 errmsg_pos = vfs_getopt_pos(optlist, "errmsg"); 828 829 /* 830 * We need these two options before the others, 831 * and they are mandatory for any filesystem. 832 * Ensure they are NUL terminated as well. 833 */ 834 fstypelen = 0; 835 error = vfs_getopt(optlist, "fstype", (void **)&fstype, &fstypelen); 836 if (error || fstypelen <= 0 || fstype[fstypelen - 1] != '\0') { 837 error = EINVAL; 838 if (errmsg != NULL) 839 strncpy(errmsg, "Invalid fstype", errmsg_len); 840 goto bail; 841 } 842 fspathlen = 0; 843 error = vfs_getopt(optlist, "fspath", (void **)&fspath, &fspathlen); 844 if (error || fspathlen <= 0 || fspath[fspathlen - 1] != '\0') { 845 error = EINVAL; 846 if (errmsg != NULL) 847 strncpy(errmsg, "Invalid fspath", errmsg_len); 848 goto bail; 849 } 850 851 /* 852 * Check to see that "export" is only used with the "update", "fstype", 853 * "fspath", "from" and "errmsg" options when in a vnet jail. 854 * These are the ones used to set/update exports by mountd(8). 855 * If only the above options are set in a jail that can run mountd(8), 856 * then the jail_export argument of vfs_domount() will be true. 857 * When jail_export is true, the vfs_suser() check does not cause 858 * failure, but limits the update to exports only. 859 * This allows mountd(8) running within the vnet jail 860 * to export file systems visible within the jail, but 861 * mounted outside of the jail. 862 */ 863 /* 864 * We need to see if we have the "update" option 865 * before we call vfs_domount(), since vfs_domount() has special 866 * logic based on MNT_UPDATE. This is very important 867 * when we want to update the root filesystem. 868 */ 869 has_nonexport = false; 870 only_export = false; 871 TAILQ_FOREACH_SAFE(opt, optlist, link, tmp_opt) { 872 int do_freeopt = 0; 873 874 if (strcmp(opt->name, "export") != 0 && 875 strcmp(opt->name, "update") != 0 && 876 strcmp(opt->name, "fstype") != 0 && 877 strcmp(opt->name, "fspath") != 0 && 878 strcmp(opt->name, "from") != 0 && 879 strcmp(opt->name, "errmsg") != 0) 880 has_nonexport = true; 881 if (strcmp(opt->name, "update") == 0) { 882 fsflags |= MNT_UPDATE; 883 do_freeopt = 1; 884 } 885 else if (strcmp(opt->name, "async") == 0) 886 fsflags |= MNT_ASYNC; 887 else if (strcmp(opt->name, "force") == 0) { 888 fsflags |= MNT_FORCE; 889 do_freeopt = 1; 890 } 891 else if (strcmp(opt->name, "reload") == 0) { 892 fsflags |= MNT_RELOAD; 893 do_freeopt = 1; 894 } 895 else if (strcmp(opt->name, "multilabel") == 0) 896 fsflags |= MNT_MULTILABEL; 897 else if (strcmp(opt->name, "noasync") == 0) 898 fsflags &= ~MNT_ASYNC; 899 else if (strcmp(opt->name, "noatime") == 0) 900 fsflags |= MNT_NOATIME; 901 else if (strcmp(opt->name, "atime") == 0) { 902 free(opt->name, M_MOUNT); 903 opt->name = strdup("nonoatime", M_MOUNT); 904 } 905 else if (strcmp(opt->name, "noclusterr") == 0) 906 fsflags |= MNT_NOCLUSTERR; 907 else if (strcmp(opt->name, "clusterr") == 0) { 908 free(opt->name, M_MOUNT); 909 opt->name = strdup("nonoclusterr", M_MOUNT); 910 } 911 else if (strcmp(opt->name, "noclusterw") == 0) 912 fsflags |= MNT_NOCLUSTERW; 913 else if (strcmp(opt->name, "clusterw") == 0) { 914 free(opt->name, M_MOUNT); 915 opt->name = strdup("nonoclusterw", M_MOUNT); 916 } 917 else if (strcmp(opt->name, "noexec") == 0) 918 fsflags |= MNT_NOEXEC; 919 else if (strcmp(opt->name, "exec") == 0) { 920 free(opt->name, M_MOUNT); 921 opt->name = strdup("nonoexec", M_MOUNT); 922 } 923 else if (strcmp(opt->name, "nosuid") == 0) 924 fsflags |= MNT_NOSUID; 925 else if (strcmp(opt->name, "suid") == 0) { 926 free(opt->name, M_MOUNT); 927 opt->name = strdup("nonosuid", M_MOUNT); 928 } 929 else if (strcmp(opt->name, "nosymfollow") == 0) 930 fsflags |= MNT_NOSYMFOLLOW; 931 else if (strcmp(opt->name, "symfollow") == 0) { 932 free(opt->name, M_MOUNT); 933 opt->name = strdup("nonosymfollow", M_MOUNT); 934 } 935 else if (strcmp(opt->name, "noro") == 0) { 936 fsflags &= ~MNT_RDONLY; 937 autoro = false; 938 } 939 else if (strcmp(opt->name, "rw") == 0) { 940 fsflags &= ~MNT_RDONLY; 941 autoro = false; 942 } 943 else if (strcmp(opt->name, "ro") == 0) { 944 fsflags |= MNT_RDONLY; 945 autoro = false; 946 } 947 else if (strcmp(opt->name, "rdonly") == 0) { 948 free(opt->name, M_MOUNT); 949 opt->name = strdup("ro", M_MOUNT); 950 fsflags |= MNT_RDONLY; 951 autoro = false; 952 } 953 else if (strcmp(opt->name, "autoro") == 0) { 954 do_freeopt = 1; 955 autoro = true; 956 } 957 else if (strcmp(opt->name, "suiddir") == 0) 958 fsflags |= MNT_SUIDDIR; 959 else if (strcmp(opt->name, "sync") == 0) 960 fsflags |= MNT_SYNCHRONOUS; 961 else if (strcmp(opt->name, "union") == 0) 962 fsflags |= MNT_UNION; 963 else if (strcmp(opt->name, "export") == 0) { 964 fsflags |= MNT_EXPORTED; 965 only_export = true; 966 } else if (strcmp(opt->name, "automounted") == 0) { 967 fsflags |= MNT_AUTOMOUNTED; 968 do_freeopt = 1; 969 } else if (strcmp(opt->name, "nocover") == 0) { 970 fsflags |= MNT_NOCOVER; 971 do_freeopt = 1; 972 } else if (strcmp(opt->name, "cover") == 0) { 973 fsflags &= ~MNT_NOCOVER; 974 do_freeopt = 1; 975 } else if (strcmp(opt->name, "emptydir") == 0) { 976 fsflags |= MNT_EMPTYDIR; 977 do_freeopt = 1; 978 } else if (strcmp(opt->name, "noemptydir") == 0) { 979 fsflags &= ~MNT_EMPTYDIR; 980 do_freeopt = 1; 981 } else if (strcmp(opt->name, "check_fsid") == 0) { 982 check_fsid_str = strndup(opt->value, opt->len, M_MOUNT); 983 do_freeopt = 1; 984 } 985 if (do_freeopt) 986 vfs_freeopt(optlist, opt); 987 } 988 989 /* 990 * Be ultra-paranoid about making sure the type and fspath 991 * variables will fit in our mp buffers, including the 992 * terminating NUL. 993 */ 994 if (fstypelen > MFSNAMELEN || fspathlen > MNAMELEN) { 995 error = ENAMETOOLONG; 996 goto bail; 997 } 998 999 /* 1000 * only_export is set to true only if exports are being 1001 * updated and nothing else is being updated. 1002 */ 1003 if (has_nonexport) 1004 only_export = false; 1005 /* 1006 * If only_export is true and the caller is running within a 1007 * vnet prison that can run mountd(8), set jail_export true. 1008 */ 1009 jail_export = false; 1010 if (only_export && jailed(td->td_ucred) && 1011 prison_check_nfsd(td->td_ucred)) 1012 jail_export = true; 1013 1014 error = vfs_domount(td, fstype, fspath, fsflags, only_export, 1015 jail_export, check_fsid_str, &bailmsg, &optlist); 1016 if (bailmsg != NULL) { 1017 if (errmsg != NULL) 1018 strncpy(errmsg, bailmsg, errmsg_len); 1019 goto bail; 1020 } 1021 1022 /* 1023 * See if we can mount in the read-only mode if the error code suggests 1024 * that it could be possible and the mount options allow for that. 1025 * Never try it if "[no]{ro|rw}" has been explicitly requested and not 1026 * overridden by "autoro". 1027 */ 1028 if (autoro && vfs_should_downgrade_to_ro_mount(fsflags, error)) { 1029 printf("%s: R/W mount failed, possibly R/O media," 1030 " trying R/O mount\n", __func__); 1031 fsflags |= MNT_RDONLY; 1032 error = vfs_domount(td, fstype, fspath, fsflags, only_export, 1033 jail_export, check_fsid_str, &bailmsg, &optlist); 1034 } 1035 bail: 1036 /* copyout the errmsg */ 1037 if (errmsg_pos != -1 && ((2 * errmsg_pos + 1) < fsoptions->uio_iovcnt) 1038 && errmsg_len > 0 && errmsg != NULL) { 1039 if (fsoptions->uio_segflg == UIO_SYSSPACE) { 1040 bcopy(errmsg, 1041 fsoptions->uio_iov[2 * errmsg_pos + 1].iov_base, 1042 fsoptions->uio_iov[2 * errmsg_pos + 1].iov_len); 1043 } else { 1044 (void)copyout(errmsg, 1045 fsoptions->uio_iov[2 * errmsg_pos + 1].iov_base, 1046 fsoptions->uio_iov[2 * errmsg_pos + 1].iov_len); 1047 } 1048 } 1049 1050 if (optlist != NULL) 1051 vfs_freeopts(optlist); 1052 return (error); 1053 } 1054 1055 /* 1056 * Old mount API. 1057 */ 1058 #ifndef _SYS_SYSPROTO_H_ 1059 struct mount_args { 1060 char *type; 1061 char *path; 1062 int flags; 1063 caddr_t data; 1064 }; 1065 #endif 1066 /* ARGSUSED */ 1067 int 1068 sys_mount(struct thread *td, struct mount_args *uap) 1069 { 1070 char *fstype; 1071 struct vfsconf *vfsp = NULL; 1072 struct mntarg *ma = NULL; 1073 uint64_t flags; 1074 int error; 1075 1076 /* 1077 * Mount flags are now 64-bits. On 32-bit architectures only 1078 * 32-bits are passed in, but from here on everything handles 1079 * 64-bit flags correctly. 1080 */ 1081 flags = uap->flags; 1082 1083 AUDIT_ARG_FFLAGS(flags); 1084 1085 /* 1086 * Filter out MNT_ROOTFS. We do not want clients of mount() in 1087 * userspace to set this flag, but we must filter it out if we want 1088 * MNT_UPDATE on the root file system to work. 1089 * MNT_ROOTFS should only be set by the kernel when mounting its 1090 * root file system. 1091 */ 1092 flags &= ~MNT_ROOTFS; 1093 1094 fstype = malloc(MFSNAMELEN, M_TEMP, M_WAITOK); 1095 error = copyinstr(uap->type, fstype, MFSNAMELEN, NULL); 1096 if (error) { 1097 free(fstype, M_TEMP); 1098 return (error); 1099 } 1100 1101 AUDIT_ARG_TEXT(fstype); 1102 vfsp = vfs_byname_kld(fstype, td, &error); 1103 free(fstype, M_TEMP); 1104 if (vfsp == NULL) 1105 return (EINVAL); 1106 if (((vfsp->vfc_flags & VFCF_SBDRY) != 0 && 1107 vfsp->vfc_vfsops_sd->vfs_cmount == NULL) || 1108 ((vfsp->vfc_flags & VFCF_SBDRY) == 0 && 1109 vfsp->vfc_vfsops->vfs_cmount == NULL)) 1110 return (EOPNOTSUPP); 1111 1112 ma = mount_argsu(ma, "fstype", uap->type, MFSNAMELEN); 1113 ma = mount_argsu(ma, "fspath", uap->path, MNAMELEN); 1114 ma = mount_argb(ma, flags & MNT_RDONLY, "noro"); 1115 ma = mount_argb(ma, !(flags & MNT_NOSUID), "nosuid"); 1116 ma = mount_argb(ma, !(flags & MNT_NOEXEC), "noexec"); 1117 1118 if ((vfsp->vfc_flags & VFCF_SBDRY) != 0) 1119 return (vfsp->vfc_vfsops_sd->vfs_cmount(ma, uap->data, flags)); 1120 return (vfsp->vfc_vfsops->vfs_cmount(ma, uap->data, flags)); 1121 } 1122 1123 /* 1124 * vfs_domount_first(): first file system mount (not update) 1125 */ 1126 static int 1127 vfs_domount_first( 1128 struct thread *td, /* Calling thread. */ 1129 struct vfsconf *vfsp, /* File system type. */ 1130 char *fspath, /* Mount path. */ 1131 struct vnode *vp, /* Vnode to be covered. */ 1132 uint64_t fsflags, /* Flags common to all filesystems. */ 1133 struct vfsoptlist **optlist /* Options local to the filesystem. */ 1134 ) 1135 { 1136 struct vattr va; 1137 struct mount *mp; 1138 struct vnode *newdp, *rootvp; 1139 int error, error1; 1140 bool unmounted; 1141 1142 ASSERT_VOP_ELOCKED(vp, __func__); 1143 KASSERT((fsflags & MNT_UPDATE) == 0, ("MNT_UPDATE shouldn't be here")); 1144 1145 /* 1146 * If the jail of the calling thread lacks permission for this type of 1147 * file system, or is trying to cover its own root, deny immediately. 1148 */ 1149 if (jailed(td->td_ucred) && (!prison_allow(td->td_ucred, 1150 vfsp->vfc_prison_flag) || vp == td->td_ucred->cr_prison->pr_root)) { 1151 vput(vp); 1152 vfs_unref_vfsconf(vfsp); 1153 return (EPERM); 1154 } 1155 1156 /* 1157 * If the user is not root, ensure that they own the directory 1158 * onto which we are attempting to mount. 1159 */ 1160 error = VOP_GETATTR(vp, &va, td->td_ucred); 1161 if (error == 0 && va.va_uid != td->td_ucred->cr_uid) 1162 error = priv_check_cred(td->td_ucred, PRIV_VFS_ADMIN); 1163 #ifdef MAC 1164 /* 1165 * XXX XNU also has a check_mount_late variant, which takes the 1166 * struct mount instead and gives MAC visibility into, e.g., 1167 * f_mntfromname and other facts. 1168 */ 1169 if (error == 0) { 1170 error = mac_mount_check_mount(td->td_ucred, vp, vfsp, 1171 optlist, fsflags); 1172 } 1173 #endif 1174 if (error == 0) 1175 error = vinvalbuf(vp, V_SAVE, 0, 0); 1176 if (vfsp->vfc_flags & VFCF_FILEMOUNT) { 1177 if (error == 0 && vp->v_type != VDIR && vp->v_type != VREG && 1178 vp->v_type != VSOCK) 1179 error = EINVAL; 1180 /* 1181 * For file mounts, ensure that there is only one hardlink to the file. 1182 */ 1183 if (error == 0 && (vp->v_type == VREG || vp->v_type == VSOCK) && 1184 va.va_nlink != 1) 1185 error = EINVAL; 1186 } else { 1187 if (error == 0 && vp->v_type != VDIR) 1188 error = ENOTDIR; 1189 } 1190 if (error == 0 && (fsflags & MNT_EMPTYDIR) != 0) 1191 error = vn_dir_check_empty(vp); 1192 if (error == 0) { 1193 VI_LOCK(vp); 1194 if ((vp->v_iflag & VI_MOUNT) == 0 && vp->v_mountedhere == NULL) 1195 vp->v_iflag |= VI_MOUNT; 1196 else 1197 error = EBUSY; 1198 VI_UNLOCK(vp); 1199 } 1200 if (error != 0) { 1201 vput(vp); 1202 vfs_unref_vfsconf(vfsp); 1203 return (error); 1204 } 1205 vn_seqc_write_begin(vp); 1206 VOP_UNLOCK(vp); 1207 1208 /* Allocate and initialize the filesystem. */ 1209 mp = vfs_mount_alloc(vp, vfsp, fspath, td->td_ucred); 1210 /* XXXMAC: pass to vfs_mount_alloc? */ 1211 mp->mnt_optnew = *optlist; 1212 /* Set the mount level flags. */ 1213 mp->mnt_flag = (fsflags & 1214 (MNT_UPDATEMASK | MNT_ROOTFS | MNT_RDONLY | MNT_FORCE)); 1215 1216 /* 1217 * Mount the filesystem. 1218 * XXX The final recipients of VFS_MOUNT just overwrite the ndp they 1219 * get. No freeing of cn_pnbuf. 1220 */ 1221 error1 = 0; 1222 unmounted = true; 1223 if ((error = VFS_MOUNT(mp)) != 0 || 1224 (error1 = VFS_STATFS(mp, &mp->mnt_stat)) != 0 || 1225 (error1 = VFS_ROOT(mp, LK_EXCLUSIVE, &newdp)) != 0) { 1226 rootvp = NULL; 1227 if (error1 != 0) { 1228 MPASS(error == 0); 1229 rootvp = vfs_cache_root_clear(mp); 1230 if (rootvp != NULL) { 1231 vhold(rootvp); 1232 vrele(rootvp); 1233 } 1234 (void)vn_start_write(NULL, &mp, V_WAIT); 1235 MNT_ILOCK(mp); 1236 mp->mnt_kern_flag |= MNTK_UNMOUNT | MNTK_UNMOUNTF; 1237 MNT_IUNLOCK(mp); 1238 VFS_PURGE(mp); 1239 error = VFS_UNMOUNT(mp, 0); 1240 vn_finished_write(mp); 1241 if (error != 0) { 1242 printf( 1243 "failed post-mount (%d): rollback unmount returned %d\n", 1244 error1, error); 1245 unmounted = false; 1246 } 1247 error = error1; 1248 } 1249 vfs_unbusy(mp); 1250 mp->mnt_vnodecovered = NULL; 1251 if (unmounted) { 1252 /* XXXKIB wait for mnt_lockref drain? */ 1253 vfs_mount_destroy(mp); 1254 } 1255 VI_LOCK(vp); 1256 vp->v_iflag &= ~VI_MOUNT; 1257 VI_UNLOCK(vp); 1258 if (rootvp != NULL) { 1259 vn_seqc_write_end(rootvp); 1260 vdrop(rootvp); 1261 } 1262 vn_seqc_write_end(vp); 1263 vrele(vp); 1264 return (error); 1265 } 1266 vn_seqc_write_begin(newdp); 1267 VOP_UNLOCK(newdp); 1268 1269 if (mp->mnt_opt != NULL) 1270 vfs_freeopts(mp->mnt_opt); 1271 mp->mnt_opt = mp->mnt_optnew; 1272 *optlist = NULL; 1273 1274 /* 1275 * Prevent external consumers of mount options from reading mnt_optnew. 1276 */ 1277 mp->mnt_optnew = NULL; 1278 1279 MNT_ILOCK(mp); 1280 if ((mp->mnt_flag & MNT_ASYNC) != 0 && 1281 (mp->mnt_kern_flag & MNTK_NOASYNC) == 0) 1282 mp->mnt_kern_flag |= MNTK_ASYNC; 1283 else 1284 mp->mnt_kern_flag &= ~MNTK_ASYNC; 1285 MNT_IUNLOCK(mp); 1286 1287 /* 1288 * VIRF_MOUNTPOINT and v_mountedhere need to be set under the 1289 * vp lock to satisfy vfs_lookup() requirements. 1290 */ 1291 VOP_LOCK(vp, LK_EXCLUSIVE | LK_RETRY); 1292 VI_LOCK(vp); 1293 vn_irflag_set_locked(vp, VIRF_MOUNTPOINT); 1294 vp->v_mountedhere = mp; 1295 VI_UNLOCK(vp); 1296 VOP_UNLOCK(vp); 1297 cache_purge(vp); 1298 1299 /* 1300 * We need to lock both vnodes. 1301 * 1302 * Use vn_lock_pair to avoid establishing an ordering between vnodes 1303 * from different filesystems. 1304 */ 1305 error1 = vn_lock_pair(vp, false, LK_EXCLUSIVE, newdp, false, 1306 LK_EXCLUSIVE); 1307 1308 VI_LOCK(vp); 1309 vp->v_iflag &= ~VI_MOUNT; 1310 VI_UNLOCK(vp); 1311 /* Place the new filesystem at the end of the mount list. */ 1312 mtx_lock(&mountlist_mtx); 1313 TAILQ_INSERT_TAIL(&mountlist, mp, mnt_list); 1314 mtx_unlock(&mountlist_mtx); 1315 vfs_event_signal(NULL, VQ_MOUNT, 0); 1316 if (error1 == 0) 1317 VOP_UNLOCK(vp); 1318 else 1319 MPASS(error1 == EDEADLK); 1320 EVENTHANDLER_DIRECT_INVOKE(vfs_mounted, mp, newdp, td); 1321 VOP_UNLOCK(newdp); 1322 mount_devctl_event("MOUNT", mp, false); 1323 mountcheckdirs(vp, newdp); 1324 vn_seqc_write_end(vp); 1325 vn_seqc_write_end(newdp); 1326 vrele(newdp); 1327 if ((mp->mnt_flag & MNT_RDONLY) == 0) 1328 vfs_allocate_syncvnode(mp); 1329 vfs_op_exit(mp); 1330 vfs_unbusy(mp); 1331 return (0); 1332 } 1333 1334 /* 1335 * vfs_domount_update(): update of mounted file system 1336 */ 1337 static int 1338 vfs_domount_update( 1339 struct thread *td, /* Calling thread. */ 1340 struct vnode *vp, /* Mount point vnode. */ 1341 uint64_t fsflags, /* Flags common to all filesystems. */ 1342 bool only_export, /* Got export option. */ 1343 bool jail_export, /* Got export option in vnet prison. */ 1344 struct vfsoptlist **optlist /* Options local to the filesystem. */ 1345 ) 1346 { 1347 struct export_args export; 1348 struct o2export_args o2export; 1349 struct vnode *rootvp; 1350 void *bufp; 1351 struct mount *mp; 1352 int error, export_error, i, len, fsid_up_len; 1353 uint64_t flag, mnt_union; 1354 gid_t *grps; 1355 fsid_t *fsid_up; 1356 bool vfs_suser_failed; 1357 1358 ASSERT_VOP_ELOCKED(vp, __func__); 1359 KASSERT((fsflags & MNT_UPDATE) != 0, ("MNT_UPDATE should be here")); 1360 mp = vp->v_mount; 1361 1362 if ((vp->v_vflag & VV_ROOT) == 0) { 1363 if (vfs_copyopt(*optlist, "export", &export, sizeof(export)) 1364 == 0) 1365 error = EXDEV; 1366 else 1367 error = EINVAL; 1368 vput(vp); 1369 return (error); 1370 } 1371 1372 /* 1373 * We only allow the filesystem to be reloaded if it 1374 * is currently mounted read-only. 1375 */ 1376 flag = mp->mnt_flag; 1377 if ((fsflags & MNT_RELOAD) != 0 && (flag & MNT_RDONLY) == 0) { 1378 vput(vp); 1379 return (EOPNOTSUPP); /* Needs translation */ 1380 } 1381 /* 1382 * Only privileged root, or (if MNT_USER is set) the user that 1383 * did the original mount is permitted to update it. 1384 */ 1385 /* 1386 * For the case of mountd(8) doing exports in a jail, the vfs_suser() 1387 * call does not cause failure. vfs_domount() has already checked 1388 * that "root" is doing this and vfs_suser() will fail when 1389 * the file system has been mounted outside the jail. 1390 * jail_export set true indicates that "export" is not mixed 1391 * with other options that change mount behaviour. 1392 */ 1393 vfs_suser_failed = false; 1394 error = vfs_suser(mp, td); 1395 if (jail_export && error != 0) { 1396 error = 0; 1397 vfs_suser_failed = true; 1398 } 1399 #ifdef MAC 1400 if (error == 0) { 1401 error = mac_mount_check_update(td->td_ucred, mp, optlist, 1402 fsflags); 1403 } 1404 #endif 1405 if (error != 0) { 1406 vput(vp); 1407 return (error); 1408 } 1409 if (vfs_busy(mp, MBF_NOWAIT)) { 1410 vput(vp); 1411 return (EBUSY); 1412 } 1413 VI_LOCK(vp); 1414 if ((vp->v_iflag & VI_MOUNT) != 0 || vp->v_mountedhere != NULL) { 1415 VI_UNLOCK(vp); 1416 vfs_unbusy(mp); 1417 vput(vp); 1418 return (EBUSY); 1419 } 1420 vp->v_iflag |= VI_MOUNT; 1421 VI_UNLOCK(vp); 1422 VOP_UNLOCK(vp); 1423 1424 rootvp = NULL; 1425 vfs_op_enter(mp); 1426 vn_seqc_write_begin(vp); 1427 1428 if (vfs_getopt(*optlist, "fsid", (void **)&fsid_up, 1429 &fsid_up_len) == 0) { 1430 if (fsid_up_len != sizeof(*fsid_up)) { 1431 error = EINVAL; 1432 goto end; 1433 } 1434 if (fsidcmp(fsid_up, &mp->mnt_stat.f_fsid) != 0) { 1435 error = ENOENT; 1436 goto end; 1437 } 1438 vfs_deleteopt(*optlist, "fsid"); 1439 } 1440 1441 mnt_union = 0; 1442 MNT_ILOCK(mp); 1443 if ((mp->mnt_kern_flag & MNTK_UNMOUNT) != 0) { 1444 MNT_IUNLOCK(mp); 1445 error = EBUSY; 1446 goto end; 1447 } 1448 if (vfs_suser_failed) { 1449 KASSERT((fsflags & (MNT_EXPORTED | MNT_UPDATE)) == 1450 (MNT_EXPORTED | MNT_UPDATE), 1451 ("%s: jailed export did not set expected fsflags", 1452 __func__)); 1453 /* 1454 * For this case, only MNT_UPDATE and 1455 * MNT_EXPORTED have been set in fsflags 1456 * by the options. Only set MNT_UPDATE, 1457 * since that is the one that would be set 1458 * when set in fsflags, below. 1459 */ 1460 mp->mnt_flag |= MNT_UPDATE; 1461 } else { 1462 mp->mnt_flag &= ~MNT_UPDATEMASK; 1463 if ((mp->mnt_flag & MNT_UNION) == 0 && 1464 (fsflags & MNT_UNION) != 0) { 1465 fsflags &= ~MNT_UNION; 1466 mnt_union = MNT_UNION; 1467 } 1468 mp->mnt_flag |= fsflags & (MNT_RELOAD | MNT_FORCE | MNT_UPDATE | 1469 MNT_SNAPSHOT | MNT_ROOTFS | MNT_UPDATEMASK | MNT_RDONLY); 1470 if ((mp->mnt_flag & MNT_ASYNC) == 0) 1471 mp->mnt_kern_flag &= ~MNTK_ASYNC; 1472 } 1473 rootvp = vfs_cache_root_clear(mp); 1474 MNT_IUNLOCK(mp); 1475 mp->mnt_optnew = *optlist; 1476 vfs_mergeopts(mp->mnt_optnew, mp->mnt_opt); 1477 1478 /* 1479 * Mount the filesystem. 1480 * XXX The final recipients of VFS_MOUNT just overwrite the ndp they 1481 * get. No freeing of cn_pnbuf. 1482 */ 1483 /* 1484 * When only updating mount exports, VFS_MOUNT() does not need to 1485 * be called, as indicated by only_export being set true. 1486 * For the case of mountd(8) doing exports from within a vnet jail, 1487 * "from" is typically not set correctly such that VFS_MOUNT() will 1488 * return ENOENT. For ZFS, there is a locking bug which can result in 1489 * deadlock if VFS_MOUNT() is called when extended attributes are 1490 * being updated. 1491 */ 1492 error = 0; 1493 if (!only_export) 1494 error = VFS_MOUNT(mp); 1495 1496 export_error = 0; 1497 /* Process the export option. */ 1498 if (error == 0 && vfs_getopt(mp->mnt_optnew, "export", &bufp, 1499 &len) == 0) { 1500 /* Assume that there is only 1 ABI for each length. */ 1501 switch (len) { 1502 case (sizeof(struct oexport_args)): 1503 bzero(&o2export, sizeof(o2export)); 1504 /* FALLTHROUGH */ 1505 case (sizeof(o2export)): 1506 bcopy(bufp, &o2export, len); 1507 export.ex_flags = (uint64_t)o2export.ex_flags; 1508 export.ex_root = o2export.ex_root; 1509 export.ex_uid = o2export.ex_anon.cr_uid; 1510 export.ex_groups = NULL; 1511 export.ex_ngroups = o2export.ex_anon.cr_ngroups; 1512 if (export.ex_ngroups > 0) { 1513 if (export.ex_ngroups <= XU_NGROUPS) { 1514 export.ex_groups = malloc( 1515 export.ex_ngroups * sizeof(gid_t), 1516 M_TEMP, M_WAITOK); 1517 for (i = 0; i < export.ex_ngroups; i++) 1518 export.ex_groups[i] = 1519 o2export.ex_anon.cr_groups[i]; 1520 } else 1521 export_error = EINVAL; 1522 } else if (export.ex_ngroups < 0) 1523 export_error = EINVAL; 1524 export.ex_addr = o2export.ex_addr; 1525 export.ex_addrlen = o2export.ex_addrlen; 1526 export.ex_mask = o2export.ex_mask; 1527 export.ex_masklen = o2export.ex_masklen; 1528 export.ex_indexfile = o2export.ex_indexfile; 1529 export.ex_numsecflavors = o2export.ex_numsecflavors; 1530 if (export.ex_numsecflavors < MAXSECFLAVORS) { 1531 for (i = 0; i < export.ex_numsecflavors; i++) 1532 export.ex_secflavors[i] = 1533 o2export.ex_secflavors[i]; 1534 } else 1535 export_error = EINVAL; 1536 if (export_error == 0) 1537 export_error = vfs_export(mp, &export, true); 1538 free(export.ex_groups, M_TEMP); 1539 break; 1540 case (sizeof(export)): 1541 bcopy(bufp, &export, len); 1542 grps = NULL; 1543 if (export.ex_ngroups > 0) { 1544 if (export.ex_ngroups <= ngroups_max + 1) { 1545 grps = malloc(export.ex_ngroups * 1546 sizeof(gid_t), M_TEMP, M_WAITOK); 1547 export_error = copyin(export.ex_groups, 1548 grps, export.ex_ngroups * 1549 sizeof(gid_t)); 1550 if (export_error == 0) 1551 export.ex_groups = grps; 1552 } else 1553 export_error = EINVAL; 1554 } else if (export.ex_ngroups == 0) 1555 export.ex_groups = NULL; 1556 else 1557 export_error = EINVAL; 1558 if (export_error == 0) 1559 export_error = vfs_export(mp, &export, true); 1560 free(grps, M_TEMP); 1561 break; 1562 default: 1563 export_error = EINVAL; 1564 break; 1565 } 1566 } 1567 1568 MNT_ILOCK(mp); 1569 if (error == 0) { 1570 mp->mnt_flag &= ~(MNT_UPDATE | MNT_RELOAD | MNT_FORCE | 1571 MNT_SNAPSHOT); 1572 mp->mnt_flag |= mnt_union; 1573 } else { 1574 /* 1575 * If we fail, restore old mount flags. MNT_QUOTA is special, 1576 * because it is not part of MNT_UPDATEMASK, but it could have 1577 * changed in the meantime if quotactl(2) was called. 1578 * All in all we want current value of MNT_QUOTA, not the old 1579 * one. 1580 */ 1581 mp->mnt_flag = (mp->mnt_flag & MNT_QUOTA) | (flag & ~MNT_QUOTA); 1582 } 1583 if ((mp->mnt_flag & MNT_ASYNC) != 0 && 1584 (mp->mnt_kern_flag & MNTK_NOASYNC) == 0) 1585 mp->mnt_kern_flag |= MNTK_ASYNC; 1586 else 1587 mp->mnt_kern_flag &= ~MNTK_ASYNC; 1588 MNT_IUNLOCK(mp); 1589 1590 if (error != 0) 1591 goto end; 1592 1593 mount_devctl_event("REMOUNT", mp, true); 1594 if (mp->mnt_opt != NULL) 1595 vfs_freeopts(mp->mnt_opt); 1596 mp->mnt_opt = mp->mnt_optnew; 1597 *optlist = NULL; 1598 (void)VFS_STATFS(mp, &mp->mnt_stat); 1599 /* 1600 * Prevent external consumers of mount options from reading 1601 * mnt_optnew. 1602 */ 1603 mp->mnt_optnew = NULL; 1604 1605 if ((mp->mnt_flag & MNT_RDONLY) == 0) 1606 vfs_allocate_syncvnode(mp); 1607 else 1608 vfs_deallocate_syncvnode(mp); 1609 end: 1610 vfs_op_exit(mp); 1611 if (rootvp != NULL) { 1612 vn_seqc_write_end(rootvp); 1613 vrele(rootvp); 1614 } 1615 vn_seqc_write_end(vp); 1616 vfs_unbusy(mp); 1617 VI_LOCK(vp); 1618 vp->v_iflag &= ~VI_MOUNT; 1619 VI_UNLOCK(vp); 1620 vrele(vp); 1621 return (error != 0 ? error : export_error); 1622 } 1623 1624 /* 1625 * vfs_domount(): actually attempt a filesystem mount. 1626 */ 1627 static int 1628 vfs_domount( 1629 struct thread *td, /* Calling thread. */ 1630 const char *fstype, /* Filesystem type. */ 1631 char *fspath, /* Mount path. */ 1632 uint64_t fsflags, /* Flags common to all filesystems. */ 1633 bool only_export, /* Got export option. */ 1634 bool jail_export, /* Got export option in vnet prison. */ 1635 char *check_fsid_str, /* fsid of an inode we're expecting 1636 to mount over. */ 1637 char **bailmsg_p, /* textual error returned to caller */ 1638 struct vfsoptlist **optlist /* Options local to the filesystem. */ 1639 ) 1640 { 1641 struct vfsconf *vfsp; 1642 struct nameidata nd; 1643 struct vnode *vp; 1644 char *pathbuf; 1645 fsid_t check_fsid; 1646 int error; 1647 1648 /* 1649 * Be ultra-paranoid about making sure the type and fspath 1650 * variables will fit in our mp buffers, including the 1651 * terminating NUL. 1652 */ 1653 if (strlen(fstype) >= MFSNAMELEN || strlen(fspath) >= MNAMELEN) 1654 return (ENAMETOOLONG); 1655 1656 if (check_fsid_str != NULL) { 1657 bool parsed; 1658 1659 parsed = sscanf(check_fsid_str, "FSID:%d:%d", 1660 &check_fsid.val[0], &check_fsid.val[1]) == 2; 1661 free(check_fsid_str, M_MOUNT); 1662 if (!parsed) { 1663 *bailmsg_p = "Invalid check_fsid value"; 1664 return (ENOENT); 1665 } 1666 } 1667 1668 if (jail_export) { 1669 error = priv_check(td, PRIV_NFS_DAEMON); 1670 if (error) 1671 return (error); 1672 } else if (jailed(td->td_ucred) || usermount == 0) { 1673 if ((error = priv_check(td, PRIV_VFS_MOUNT)) != 0) 1674 return (error); 1675 } 1676 1677 /* 1678 * Do not allow NFS export or MNT_SUIDDIR by unprivileged users. 1679 */ 1680 if (fsflags & MNT_EXPORTED) { 1681 error = priv_check(td, PRIV_VFS_MOUNT_EXPORTED); 1682 if (error) 1683 return (error); 1684 } 1685 if (fsflags & MNT_SUIDDIR) { 1686 error = priv_check(td, PRIV_VFS_MOUNT_SUIDDIR); 1687 if (error) 1688 return (error); 1689 } 1690 /* 1691 * Silently enforce MNT_NOSUID and MNT_USER for unprivileged users. 1692 */ 1693 if ((fsflags & (MNT_NOSUID | MNT_USER)) != (MNT_NOSUID | MNT_USER)) { 1694 if (priv_check(td, PRIV_VFS_MOUNT_NONUSER) != 0) 1695 fsflags |= MNT_NOSUID | MNT_USER; 1696 } 1697 1698 /* Load KLDs before we lock the covered vnode to avoid reversals. */ 1699 vfsp = NULL; 1700 if ((fsflags & MNT_UPDATE) == 0) { 1701 /* Don't try to load KLDs if we're mounting the root. */ 1702 if (fsflags & MNT_ROOTFS) { 1703 if ((vfsp = vfs_byname(fstype)) == NULL) { 1704 *bailmsg_p = "Invalid fstype"; 1705 return (EINVAL); 1706 } 1707 } else { 1708 if ((vfsp = vfs_byname_kld(fstype, td, &error)) == NULL) 1709 return (error); 1710 } 1711 } 1712 1713 /* 1714 * Get vnode to be covered or mount point's vnode in case of MNT_UPDATE. 1715 */ 1716 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | AUDITVNODE1 | WANTPARENT, 1717 UIO_SYSSPACE, fspath); 1718 error = namei(&nd); 1719 if (error != 0) 1720 return (error); 1721 vp = nd.ni_vp; 1722 if (check_fsid_str != NULL) { 1723 struct mount *mp; 1724 1725 mp = vfs_getvfs(&check_fsid); 1726 if (mp != vp->v_mount) { 1727 vput(vp); 1728 error = ENOENT; 1729 *bailmsg_p = "vnode's FSID does not match check_fsid"; 1730 } 1731 if (mp != NULL) 1732 vfs_rel(mp); 1733 if (error != 0) 1734 goto out; 1735 } 1736 /* 1737 * Don't allow stacking file mounts to work around problems with the way 1738 * that namei sets nd.ni_dvp to vp_crossmp for these. 1739 */ 1740 if (vp->v_type == VREG || vp->v_type == VSOCK) 1741 fsflags |= MNT_NOCOVER; 1742 if ((fsflags & MNT_UPDATE) == 0) { 1743 if ((vp->v_vflag & VV_ROOT) != 0 && 1744 (fsflags & MNT_NOCOVER) != 0) { 1745 vput(vp); 1746 error = EBUSY; 1747 goto out; 1748 } 1749 pathbuf = malloc(MNAMELEN, M_TEMP, M_WAITOK); 1750 strcpy(pathbuf, fspath); 1751 /* 1752 * Note: we allow any vnode type here. If the path sanity check 1753 * succeeds, the type will be validated in vfs_domount_first 1754 * above. 1755 */ 1756 if (vp->v_type == VDIR) 1757 error = vn_path_to_global_path(td, vp, pathbuf, 1758 MNAMELEN); 1759 else 1760 error = vn_path_to_global_path_hardlink(td, vp, 1761 nd.ni_dvp, pathbuf, MNAMELEN, 1762 nd.ni_cnd.cn_nameptr, nd.ni_cnd.cn_namelen); 1763 if (error == 0) { 1764 error = vfs_domount_first(td, vfsp, pathbuf, vp, 1765 fsflags, optlist); 1766 } 1767 free(pathbuf, M_TEMP); 1768 } else 1769 error = vfs_domount_update(td, vp, fsflags, only_export, 1770 jail_export, optlist); 1771 1772 out: 1773 NDFREE_PNBUF(&nd); 1774 vrele(nd.ni_dvp); 1775 1776 return (error); 1777 } 1778 1779 /* 1780 * Unmount a filesystem. 1781 * 1782 * Note: unmount takes a path to the vnode mounted on as argument, not 1783 * special file (as before). 1784 */ 1785 #ifndef _SYS_SYSPROTO_H_ 1786 struct unmount_args { 1787 char *path; 1788 int flags; 1789 }; 1790 #endif 1791 /* ARGSUSED */ 1792 int 1793 sys_unmount(struct thread *td, struct unmount_args *uap) 1794 { 1795 1796 return (kern_unmount(td, uap->path, (unsigned)uap->flags)); 1797 } 1798 1799 int 1800 kern_unmount(struct thread *td, const char *path, uint64_t flags) 1801 { 1802 struct nameidata nd; 1803 struct mount *mp; 1804 char *fsidbuf, *pathbuf; 1805 fsid_t fsid; 1806 int error; 1807 1808 AUDIT_ARG_VALUE(flags); 1809 if ((flags & (MNT_DEFERRED | MNT_RECURSE)) != 0) 1810 return (EINVAL); 1811 if (jailed(td->td_ucred) || usermount == 0) { 1812 error = priv_check(td, PRIV_VFS_UNMOUNT); 1813 if (error) 1814 return (error); 1815 } 1816 if (flags & MNT_BYFSID) { 1817 fsidbuf = malloc(MNAMELEN, M_TEMP, M_WAITOK); 1818 error = copyinstr(path, fsidbuf, MNAMELEN, NULL); 1819 if (error) { 1820 free(fsidbuf, M_TEMP); 1821 return (error); 1822 } 1823 1824 AUDIT_ARG_TEXT(fsidbuf); 1825 /* Decode the filesystem ID. */ 1826 if (sscanf(fsidbuf, "FSID:%d:%d", &fsid.val[0], &fsid.val[1]) != 2) { 1827 free(fsidbuf, M_TEMP); 1828 return (EINVAL); 1829 } 1830 1831 mp = vfs_getvfs(&fsid); 1832 free(fsidbuf, M_TEMP); 1833 if (mp == NULL) { 1834 return (ENOENT); 1835 } 1836 } else { 1837 pathbuf = malloc(MNAMELEN, M_TEMP, M_WAITOK); 1838 error = copyinstr(path, pathbuf, MNAMELEN, NULL); 1839 if (error) { 1840 free(pathbuf, M_TEMP); 1841 return (error); 1842 } 1843 1844 /* 1845 * Try to find global path for path argument. 1846 */ 1847 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | AUDITVNODE1, 1848 UIO_SYSSPACE, pathbuf); 1849 if (namei(&nd) == 0) { 1850 NDFREE_PNBUF(&nd); 1851 error = vn_path_to_global_path(td, nd.ni_vp, pathbuf, 1852 MNAMELEN); 1853 if (error == 0) 1854 vput(nd.ni_vp); 1855 } 1856 mtx_lock(&mountlist_mtx); 1857 TAILQ_FOREACH_REVERSE(mp, &mountlist, mntlist, mnt_list) { 1858 if (strcmp(mp->mnt_stat.f_mntonname, pathbuf) == 0) { 1859 vfs_ref(mp); 1860 break; 1861 } 1862 } 1863 mtx_unlock(&mountlist_mtx); 1864 free(pathbuf, M_TEMP); 1865 if (mp == NULL) { 1866 /* 1867 * Previously we returned ENOENT for a nonexistent path and 1868 * EINVAL for a non-mountpoint. We cannot tell these apart 1869 * now, so in the !MNT_BYFSID case return the more likely 1870 * EINVAL for compatibility. 1871 */ 1872 return (EINVAL); 1873 } 1874 } 1875 1876 /* 1877 * Don't allow unmounting the root filesystem. 1878 */ 1879 if (mp->mnt_flag & MNT_ROOTFS) { 1880 vfs_rel(mp); 1881 return (EINVAL); 1882 } 1883 #ifdef MAC 1884 error = mac_mount_check_unmount(td->td_ucred, mp, flags); 1885 if (error != 0) { 1886 vfs_rel(mp); 1887 return (error); 1888 } 1889 #endif 1890 error = dounmount(mp, flags, td); 1891 return (error); 1892 } 1893 1894 /* 1895 * Return error if any of the vnodes, ignoring the root vnode 1896 * and the syncer vnode, have non-zero usecount. 1897 * 1898 * This function is purely advisory - it can return false positives 1899 * and negatives. 1900 */ 1901 static int 1902 vfs_check_usecounts(struct mount *mp) 1903 { 1904 struct vnode *vp, *mvp; 1905 1906 MNT_VNODE_FOREACH_ALL(vp, mp, mvp) { 1907 if ((vp->v_vflag & VV_ROOT) == 0 && vp->v_type != VNON && 1908 vp->v_usecount != 0) { 1909 VI_UNLOCK(vp); 1910 MNT_VNODE_FOREACH_ALL_ABORT(mp, mvp); 1911 return (EBUSY); 1912 } 1913 VI_UNLOCK(vp); 1914 } 1915 1916 return (0); 1917 } 1918 1919 static void 1920 dounmount_cleanup(struct mount *mp, struct vnode *coveredvp, int mntkflags, 1921 bool disablerec) 1922 { 1923 1924 mtx_assert(MNT_MTX(mp), MA_OWNED); 1925 mp->mnt_kern_flag &= ~mntkflags; 1926 if ((mp->mnt_kern_flag & MNTK_MWAIT) != 0) { 1927 mp->mnt_kern_flag &= ~MNTK_MWAIT; 1928 wakeup(mp); 1929 } 1930 vfs_op_exit_locked(mp); 1931 MNT_IUNLOCK(mp); 1932 if (coveredvp != NULL) { 1933 if (disablerec) 1934 VN_LOCK_DREC(coveredvp); 1935 VOP_UNLOCK(coveredvp); 1936 vdrop(coveredvp); 1937 } 1938 vn_finished_write(mp); 1939 vfs_rel(mp); 1940 } 1941 1942 /* 1943 * There are various reference counters associated with the mount point. 1944 * Normally it is permitted to modify them without taking the mnt ilock, 1945 * but this behavior can be temporarily disabled if stable value is needed 1946 * or callers are expected to block (e.g. to not allow new users during 1947 * forced unmount). 1948 */ 1949 void 1950 vfs_op_enter(struct mount *mp) 1951 { 1952 struct mount_pcpu *mpcpu; 1953 int cpu; 1954 1955 MNT_ILOCK(mp); 1956 mp->mnt_vfs_ops++; 1957 if (mp->mnt_vfs_ops > 1) { 1958 MNT_IUNLOCK(mp); 1959 return; 1960 } 1961 vfs_op_barrier_wait(mp); 1962 CPU_FOREACH(cpu) { 1963 mpcpu = vfs_mount_pcpu_remote(mp, cpu); 1964 1965 mp->mnt_ref += mpcpu->mntp_ref; 1966 mpcpu->mntp_ref = 0; 1967 1968 mp->mnt_lockref += mpcpu->mntp_lockref; 1969 mpcpu->mntp_lockref = 0; 1970 1971 mp->mnt_writeopcount += mpcpu->mntp_writeopcount; 1972 mpcpu->mntp_writeopcount = 0; 1973 } 1974 MPASSERT(mp->mnt_ref > 0 && mp->mnt_lockref >= 0 && 1975 mp->mnt_writeopcount >= 0, mp, 1976 ("invalid count(s): ref %d lockref %d writeopcount %d", 1977 mp->mnt_ref, mp->mnt_lockref, mp->mnt_writeopcount)); 1978 MNT_IUNLOCK(mp); 1979 vfs_assert_mount_counters(mp); 1980 } 1981 1982 void 1983 vfs_op_exit_locked(struct mount *mp) 1984 { 1985 1986 mtx_assert(MNT_MTX(mp), MA_OWNED); 1987 1988 MPASSERT(mp->mnt_vfs_ops > 0, mp, 1989 ("invalid vfs_ops count %d", mp->mnt_vfs_ops)); 1990 MPASSERT(mp->mnt_vfs_ops > 1 || 1991 (mp->mnt_kern_flag & (MNTK_UNMOUNT | MNTK_SUSPEND)) == 0, mp, 1992 ("vfs_ops too low %d in unmount or suspend", mp->mnt_vfs_ops)); 1993 mp->mnt_vfs_ops--; 1994 } 1995 1996 void 1997 vfs_op_exit(struct mount *mp) 1998 { 1999 2000 MNT_ILOCK(mp); 2001 vfs_op_exit_locked(mp); 2002 MNT_IUNLOCK(mp); 2003 } 2004 2005 struct vfs_op_barrier_ipi { 2006 struct mount *mp; 2007 struct smp_rendezvous_cpus_retry_arg srcra; 2008 }; 2009 2010 static void 2011 vfs_op_action_func(void *arg) 2012 { 2013 struct vfs_op_barrier_ipi *vfsopipi; 2014 struct mount *mp; 2015 2016 vfsopipi = __containerof(arg, struct vfs_op_barrier_ipi, srcra); 2017 mp = vfsopipi->mp; 2018 2019 if (!vfs_op_thread_entered(mp)) 2020 smp_rendezvous_cpus_done(arg); 2021 } 2022 2023 static void 2024 vfs_op_wait_func(void *arg, int cpu) 2025 { 2026 struct vfs_op_barrier_ipi *vfsopipi; 2027 struct mount *mp; 2028 struct mount_pcpu *mpcpu; 2029 2030 vfsopipi = __containerof(arg, struct vfs_op_barrier_ipi, srcra); 2031 mp = vfsopipi->mp; 2032 2033 mpcpu = vfs_mount_pcpu_remote(mp, cpu); 2034 while (atomic_load_int(&mpcpu->mntp_thread_in_ops)) 2035 cpu_spinwait(); 2036 } 2037 2038 void 2039 vfs_op_barrier_wait(struct mount *mp) 2040 { 2041 struct vfs_op_barrier_ipi vfsopipi; 2042 2043 vfsopipi.mp = mp; 2044 2045 smp_rendezvous_cpus_retry(all_cpus, 2046 smp_no_rendezvous_barrier, 2047 vfs_op_action_func, 2048 smp_no_rendezvous_barrier, 2049 vfs_op_wait_func, 2050 &vfsopipi.srcra); 2051 } 2052 2053 #ifdef DIAGNOSTIC 2054 void 2055 vfs_assert_mount_counters(struct mount *mp) 2056 { 2057 struct mount_pcpu *mpcpu; 2058 int cpu; 2059 2060 if (mp->mnt_vfs_ops == 0) 2061 return; 2062 2063 CPU_FOREACH(cpu) { 2064 mpcpu = vfs_mount_pcpu_remote(mp, cpu); 2065 if (mpcpu->mntp_ref != 0 || 2066 mpcpu->mntp_lockref != 0 || 2067 mpcpu->mntp_writeopcount != 0) 2068 vfs_dump_mount_counters(mp); 2069 } 2070 } 2071 2072 void 2073 vfs_dump_mount_counters(struct mount *mp) 2074 { 2075 struct mount_pcpu *mpcpu; 2076 int ref, lockref, writeopcount; 2077 int cpu; 2078 2079 printf("%s: mp %p vfs_ops %d\n", __func__, mp, mp->mnt_vfs_ops); 2080 2081 printf(" ref : "); 2082 ref = mp->mnt_ref; 2083 CPU_FOREACH(cpu) { 2084 mpcpu = vfs_mount_pcpu_remote(mp, cpu); 2085 printf("%d ", mpcpu->mntp_ref); 2086 ref += mpcpu->mntp_ref; 2087 } 2088 printf("\n"); 2089 printf(" lockref : "); 2090 lockref = mp->mnt_lockref; 2091 CPU_FOREACH(cpu) { 2092 mpcpu = vfs_mount_pcpu_remote(mp, cpu); 2093 printf("%d ", mpcpu->mntp_lockref); 2094 lockref += mpcpu->mntp_lockref; 2095 } 2096 printf("\n"); 2097 printf("writeopcount: "); 2098 writeopcount = mp->mnt_writeopcount; 2099 CPU_FOREACH(cpu) { 2100 mpcpu = vfs_mount_pcpu_remote(mp, cpu); 2101 printf("%d ", mpcpu->mntp_writeopcount); 2102 writeopcount += mpcpu->mntp_writeopcount; 2103 } 2104 printf("\n"); 2105 2106 printf("counter struct total\n"); 2107 printf("ref %-5d %-5d\n", mp->mnt_ref, ref); 2108 printf("lockref %-5d %-5d\n", mp->mnt_lockref, lockref); 2109 printf("writeopcount %-5d %-5d\n", mp->mnt_writeopcount, writeopcount); 2110 2111 panic("invalid counts on struct mount"); 2112 } 2113 #endif 2114 2115 int 2116 vfs_mount_fetch_counter(struct mount *mp, enum mount_counter which) 2117 { 2118 struct mount_pcpu *mpcpu; 2119 int cpu, sum; 2120 2121 switch (which) { 2122 case MNT_COUNT_REF: 2123 sum = mp->mnt_ref; 2124 break; 2125 case MNT_COUNT_LOCKREF: 2126 sum = mp->mnt_lockref; 2127 break; 2128 case MNT_COUNT_WRITEOPCOUNT: 2129 sum = mp->mnt_writeopcount; 2130 break; 2131 } 2132 2133 CPU_FOREACH(cpu) { 2134 mpcpu = vfs_mount_pcpu_remote(mp, cpu); 2135 switch (which) { 2136 case MNT_COUNT_REF: 2137 sum += mpcpu->mntp_ref; 2138 break; 2139 case MNT_COUNT_LOCKREF: 2140 sum += mpcpu->mntp_lockref; 2141 break; 2142 case MNT_COUNT_WRITEOPCOUNT: 2143 sum += mpcpu->mntp_writeopcount; 2144 break; 2145 } 2146 } 2147 return (sum); 2148 } 2149 2150 static bool 2151 deferred_unmount_enqueue(struct mount *mp, uint64_t flags, bool requeue, 2152 int timeout_ticks) 2153 { 2154 bool enqueued; 2155 2156 enqueued = false; 2157 mtx_lock(&deferred_unmount_lock); 2158 if ((mp->mnt_taskqueue_flags & MNT_DEFERRED) == 0 || requeue) { 2159 mp->mnt_taskqueue_flags = flags | MNT_DEFERRED; 2160 STAILQ_INSERT_TAIL(&deferred_unmount_list, mp, 2161 mnt_taskqueue_link); 2162 enqueued = true; 2163 } 2164 mtx_unlock(&deferred_unmount_lock); 2165 2166 if (enqueued) { 2167 taskqueue_enqueue_timeout(taskqueue_deferred_unmount, 2168 &deferred_unmount_task, timeout_ticks); 2169 } 2170 2171 return (enqueued); 2172 } 2173 2174 /* 2175 * Taskqueue handler for processing async/recursive unmounts 2176 */ 2177 static void 2178 vfs_deferred_unmount(void *argi __unused, int pending __unused) 2179 { 2180 STAILQ_HEAD(, mount) local_unmounts; 2181 uint64_t flags; 2182 struct mount *mp, *tmp; 2183 int error; 2184 unsigned int retries; 2185 bool unmounted; 2186 2187 STAILQ_INIT(&local_unmounts); 2188 mtx_lock(&deferred_unmount_lock); 2189 STAILQ_CONCAT(&local_unmounts, &deferred_unmount_list); 2190 mtx_unlock(&deferred_unmount_lock); 2191 2192 STAILQ_FOREACH_SAFE(mp, &local_unmounts, mnt_taskqueue_link, tmp) { 2193 flags = mp->mnt_taskqueue_flags; 2194 KASSERT((flags & MNT_DEFERRED) != 0, 2195 ("taskqueue unmount without MNT_DEFERRED")); 2196 error = dounmount(mp, flags, curthread); 2197 if (error != 0) { 2198 MNT_ILOCK(mp); 2199 unmounted = ((mp->mnt_kern_flag & MNTK_REFEXPIRE) != 0); 2200 MNT_IUNLOCK(mp); 2201 2202 /* 2203 * The deferred unmount thread is the only thread that 2204 * modifies the retry counts, so locking/atomics aren't 2205 * needed here. 2206 */ 2207 retries = (mp->mnt_unmount_retries)++; 2208 deferred_unmount_total_retries++; 2209 if (!unmounted && retries < deferred_unmount_retry_limit) { 2210 deferred_unmount_enqueue(mp, flags, true, 2211 -deferred_unmount_retry_delay_hz); 2212 } else { 2213 if (retries >= deferred_unmount_retry_limit) { 2214 printf("giving up on deferred unmount " 2215 "of %s after %d retries, error %d\n", 2216 mp->mnt_stat.f_mntonname, retries, error); 2217 } 2218 vfs_rel(mp); 2219 } 2220 } 2221 } 2222 } 2223 2224 /* 2225 * Do the actual filesystem unmount. 2226 */ 2227 int 2228 dounmount(struct mount *mp, uint64_t flags, struct thread *td) 2229 { 2230 struct mount_upper_node *upper; 2231 struct vnode *coveredvp, *rootvp; 2232 int error; 2233 uint64_t async_flag; 2234 int mnt_gen_r; 2235 unsigned int retries; 2236 bool coveredrec; 2237 2238 KASSERT((flags & MNT_DEFERRED) == 0 || 2239 (flags & (MNT_RECURSE | MNT_FORCE)) == (MNT_RECURSE | MNT_FORCE), 2240 ("MNT_DEFERRED requires MNT_RECURSE | MNT_FORCE")); 2241 2242 /* 2243 * If the caller has explicitly requested the unmount to be handled by 2244 * the taskqueue and we're not already in taskqueue context, queue 2245 * up the unmount request and exit. This is done prior to any 2246 * credential checks; MNT_DEFERRED should be used only for kernel- 2247 * initiated unmounts and will therefore be processed with the 2248 * (kernel) credentials of the taskqueue thread. Still, callers 2249 * should be sure this is the behavior they want. 2250 */ 2251 if ((flags & MNT_DEFERRED) != 0 && 2252 taskqueue_member(taskqueue_deferred_unmount, curthread) == 0) { 2253 if (!deferred_unmount_enqueue(mp, flags, false, 0)) 2254 vfs_rel(mp); 2255 return (EINPROGRESS); 2256 } 2257 2258 /* 2259 * Only privileged root, or (if MNT_USER is set) the user that did the 2260 * original mount is permitted to unmount this filesystem. 2261 * This check should be made prior to queueing up any recursive 2262 * unmounts of upper filesystems. Those unmounts will be executed 2263 * with kernel thread credentials and are expected to succeed, so 2264 * we must at least ensure the originating context has sufficient 2265 * privilege to unmount the base filesystem before proceeding with 2266 * the uppers. 2267 */ 2268 error = vfs_suser(mp, td); 2269 if (error != 0) { 2270 KASSERT((flags & MNT_DEFERRED) == 0, 2271 ("taskqueue unmount with insufficient privilege")); 2272 vfs_rel(mp); 2273 return (error); 2274 } 2275 2276 if (recursive_forced_unmount && ((flags & MNT_FORCE) != 0)) 2277 flags |= MNT_RECURSE; 2278 2279 if ((flags & MNT_RECURSE) != 0) { 2280 KASSERT((flags & MNT_FORCE) != 0, 2281 ("MNT_RECURSE requires MNT_FORCE")); 2282 2283 MNT_ILOCK(mp); 2284 /* 2285 * Set MNTK_RECURSE to prevent new upper mounts from being 2286 * added, and note that an operation on the uppers list is in 2287 * progress. This will ensure that unregistration from the 2288 * uppers list, and therefore any pending unmount of the upper 2289 * FS, can't complete until after we finish walking the list. 2290 */ 2291 mp->mnt_kern_flag |= MNTK_RECURSE; 2292 mp->mnt_upper_pending++; 2293 TAILQ_FOREACH(upper, &mp->mnt_uppers, mnt_upper_link) { 2294 retries = upper->mp->mnt_unmount_retries; 2295 if (retries > deferred_unmount_retry_limit) { 2296 error = EBUSY; 2297 continue; 2298 } 2299 MNT_IUNLOCK(mp); 2300 2301 vfs_ref(upper->mp); 2302 if (!deferred_unmount_enqueue(upper->mp, flags, 2303 false, 0)) 2304 vfs_rel(upper->mp); 2305 MNT_ILOCK(mp); 2306 } 2307 mp->mnt_upper_pending--; 2308 if ((mp->mnt_kern_flag & MNTK_UPPER_WAITER) != 0 && 2309 mp->mnt_upper_pending == 0) { 2310 mp->mnt_kern_flag &= ~MNTK_UPPER_WAITER; 2311 wakeup(&mp->mnt_uppers); 2312 } 2313 2314 /* 2315 * If we're not on the taskqueue, wait until the uppers list 2316 * is drained before proceeding with unmount. Otherwise, if 2317 * we are on the taskqueue and there are still pending uppers, 2318 * just re-enqueue on the end of the taskqueue. 2319 */ 2320 if ((flags & MNT_DEFERRED) == 0) { 2321 while (error == 0 && !TAILQ_EMPTY(&mp->mnt_uppers)) { 2322 mp->mnt_kern_flag |= MNTK_TASKQUEUE_WAITER; 2323 error = msleep(&mp->mnt_taskqueue_link, 2324 MNT_MTX(mp), PCATCH, "umntqw", 0); 2325 } 2326 if (error != 0) { 2327 MNT_REL(mp); 2328 MNT_IUNLOCK(mp); 2329 return (error); 2330 } 2331 } else if (!TAILQ_EMPTY(&mp->mnt_uppers)) { 2332 MNT_IUNLOCK(mp); 2333 if (error == 0) 2334 deferred_unmount_enqueue(mp, flags, true, 0); 2335 return (error); 2336 } 2337 MNT_IUNLOCK(mp); 2338 KASSERT(TAILQ_EMPTY(&mp->mnt_uppers), ("mnt_uppers not empty")); 2339 } 2340 2341 /* Allow the taskqueue to safely re-enqueue on failure */ 2342 if ((flags & MNT_DEFERRED) != 0) 2343 vfs_ref(mp); 2344 2345 coveredrec = false; 2346 if ((coveredvp = mp->mnt_vnodecovered) != NULL) { 2347 mnt_gen_r = mp->mnt_gen; 2348 VI_LOCK(coveredvp); 2349 vholdl(coveredvp); 2350 vn_lock(coveredvp, LK_EXCLUSIVE | LK_INTERLOCK | LK_RETRY); 2351 /* 2352 * Check for mp being unmounted while waiting for the 2353 * covered vnode lock. 2354 */ 2355 if (coveredvp->v_mountedhere != mp || 2356 coveredvp->v_mountedhere->mnt_gen != mnt_gen_r) { 2357 VOP_UNLOCK(coveredvp); 2358 vdrop(coveredvp); 2359 vfs_rel(mp); 2360 return (EBUSY); 2361 } 2362 2363 /* 2364 * For stacked filesystems such as nullfs and unionfs, 2365 * it is possible for the covered vnode lock for the 2366 * mount to be shared with one of the vnodes belonging 2367 * to the mount. At unmount time, vflush() will then 2368 * recurse on the covered vnode lock when reclaiming 2369 * the vnode. 2370 * 2371 * To work around it, temprorarily allow recursion for 2372 * the covered vnode lock. 2373 */ 2374 coveredrec = VN_LOCK_CANREC(coveredvp); 2375 VN_LOCK_AREC(coveredvp); 2376 } 2377 2378 vfs_op_enter(mp); 2379 2380 vn_start_write(NULL, &mp, V_WAIT); 2381 MNT_ILOCK(mp); 2382 if ((mp->mnt_kern_flag & MNTK_UNMOUNT) != 0 || 2383 (mp->mnt_flag & MNT_UPDATE) != 0 || 2384 !TAILQ_EMPTY(&mp->mnt_uppers)) { 2385 dounmount_cleanup(mp, coveredvp, 0, !coveredrec); 2386 return (EBUSY); 2387 } 2388 mp->mnt_kern_flag |= MNTK_UNMOUNT; 2389 rootvp = vfs_cache_root_clear(mp); 2390 if (coveredvp != NULL) 2391 vn_seqc_write_begin(coveredvp); 2392 if (flags & MNT_NONBUSY) { 2393 MNT_IUNLOCK(mp); 2394 error = vfs_check_usecounts(mp); 2395 MNT_ILOCK(mp); 2396 if (error != 0) { 2397 vn_seqc_write_end(coveredvp); 2398 dounmount_cleanup(mp, coveredvp, MNTK_UNMOUNT, 2399 !coveredrec); 2400 if (rootvp != NULL) { 2401 vn_seqc_write_end(rootvp); 2402 vrele(rootvp); 2403 } 2404 return (error); 2405 } 2406 } 2407 /* Allow filesystems to detect that a forced unmount is in progress. */ 2408 if (flags & MNT_FORCE) { 2409 mp->mnt_kern_flag |= MNTK_UNMOUNTF; 2410 MNT_IUNLOCK(mp); 2411 /* 2412 * Must be done after setting MNTK_UNMOUNTF and before 2413 * waiting for mnt_lockref to become 0. 2414 */ 2415 VFS_PURGE(mp); 2416 MNT_ILOCK(mp); 2417 } 2418 error = 0; 2419 if (mp->mnt_lockref) { 2420 mp->mnt_kern_flag |= MNTK_DRAINING; 2421 error = msleep(&mp->mnt_lockref, MNT_MTX(mp), PVFS, 2422 "mount drain", 0); 2423 } 2424 MNT_IUNLOCK(mp); 2425 KASSERT(mp->mnt_lockref == 0, 2426 ("%s: invalid lock refcount in the drain path @ %s:%d", 2427 __func__, __FILE__, __LINE__)); 2428 KASSERT(error == 0, 2429 ("%s: invalid return value for msleep in the drain path @ %s:%d", 2430 __func__, __FILE__, __LINE__)); 2431 2432 /* 2433 * We want to keep the vnode around so that we can vn_seqc_write_end 2434 * after we are done with unmount. Downgrade our reference to a mere 2435 * hold count so that we don't interefere with anything. 2436 */ 2437 if (rootvp != NULL) { 2438 vhold(rootvp); 2439 vrele(rootvp); 2440 } 2441 2442 if (mp->mnt_flag & MNT_EXPUBLIC) 2443 vfs_setpublicfs(NULL, NULL, NULL); 2444 2445 vfs_periodic(mp, MNT_WAIT); 2446 MNT_ILOCK(mp); 2447 async_flag = mp->mnt_flag & MNT_ASYNC; 2448 mp->mnt_flag &= ~MNT_ASYNC; 2449 mp->mnt_kern_flag &= ~MNTK_ASYNC; 2450 MNT_IUNLOCK(mp); 2451 2452 /* Wait for any replenish kernel process to terminate. */ 2453 pnfsd_waitreplenish(mp); 2454 2455 vfs_deallocate_syncvnode(mp); 2456 error = VFS_UNMOUNT(mp, flags); 2457 vn_finished_write(mp); 2458 vfs_rel(mp); 2459 /* 2460 * If we failed to flush the dirty blocks for this mount point, 2461 * undo all the cdir/rdir and rootvnode changes we made above. 2462 * Unless we failed to do so because the device is reporting that 2463 * it doesn't exist anymore. 2464 */ 2465 if (error && error != ENXIO) { 2466 MNT_ILOCK(mp); 2467 if ((mp->mnt_flag & MNT_RDONLY) == 0) { 2468 MNT_IUNLOCK(mp); 2469 vfs_allocate_syncvnode(mp); 2470 MNT_ILOCK(mp); 2471 } 2472 mp->mnt_kern_flag &= ~(MNTK_UNMOUNT | MNTK_UNMOUNTF); 2473 mp->mnt_flag |= async_flag; 2474 if ((mp->mnt_flag & MNT_ASYNC) != 0 && 2475 (mp->mnt_kern_flag & MNTK_NOASYNC) == 0) 2476 mp->mnt_kern_flag |= MNTK_ASYNC; 2477 if (mp->mnt_kern_flag & MNTK_MWAIT) { 2478 mp->mnt_kern_flag &= ~MNTK_MWAIT; 2479 wakeup(mp); 2480 } 2481 vfs_op_exit_locked(mp); 2482 MNT_IUNLOCK(mp); 2483 if (coveredvp) { 2484 vn_seqc_write_end(coveredvp); 2485 if (!coveredrec) 2486 VN_LOCK_DREC(coveredvp); 2487 VOP_UNLOCK(coveredvp); 2488 vdrop(coveredvp); 2489 } 2490 if (rootvp != NULL) { 2491 vn_seqc_write_end(rootvp); 2492 vdrop(rootvp); 2493 } 2494 return (error); 2495 } 2496 2497 mtx_lock(&mountlist_mtx); 2498 TAILQ_REMOVE(&mountlist, mp, mnt_list); 2499 mtx_unlock(&mountlist_mtx); 2500 EVENTHANDLER_DIRECT_INVOKE(vfs_unmounted, mp, td); 2501 if (coveredvp != NULL) { 2502 VI_LOCK(coveredvp); 2503 vn_irflag_unset_locked(coveredvp, VIRF_MOUNTPOINT); 2504 coveredvp->v_mountedhere = NULL; 2505 vn_seqc_write_end_locked(coveredvp); 2506 VI_UNLOCK(coveredvp); 2507 if (!coveredrec) 2508 VN_LOCK_DREC(coveredvp); 2509 VOP_UNLOCK(coveredvp); 2510 vdrop(coveredvp); 2511 } 2512 mount_devctl_event("UNMOUNT", mp, false); 2513 if (rootvp != NULL) { 2514 vn_seqc_write_end(rootvp); 2515 vdrop(rootvp); 2516 } 2517 vfs_event_signal(NULL, VQ_UNMOUNT, 0); 2518 if (rootvnode != NULL && mp == rootvnode->v_mount) { 2519 vrele(rootvnode); 2520 rootvnode = NULL; 2521 } 2522 if (mp == rootdevmp) 2523 rootdevmp = NULL; 2524 if ((flags & MNT_DEFERRED) != 0) 2525 vfs_rel(mp); 2526 vfs_mount_destroy(mp); 2527 return (0); 2528 } 2529 2530 /* 2531 * Report errors during filesystem mounting. 2532 */ 2533 void 2534 vfs_mount_error(struct mount *mp, const char *fmt, ...) 2535 { 2536 struct vfsoptlist *moptlist = mp->mnt_optnew; 2537 va_list ap; 2538 int error, len; 2539 char *errmsg; 2540 2541 error = vfs_getopt(moptlist, "errmsg", (void **)&errmsg, &len); 2542 if (error || errmsg == NULL || len <= 0) 2543 return; 2544 2545 va_start(ap, fmt); 2546 vsnprintf(errmsg, (size_t)len, fmt, ap); 2547 va_end(ap); 2548 } 2549 2550 void 2551 vfs_opterror(struct vfsoptlist *opts, const char *fmt, ...) 2552 { 2553 va_list ap; 2554 int error, len; 2555 char *errmsg; 2556 2557 error = vfs_getopt(opts, "errmsg", (void **)&errmsg, &len); 2558 if (error || errmsg == NULL || len <= 0) 2559 return; 2560 2561 va_start(ap, fmt); 2562 vsnprintf(errmsg, (size_t)len, fmt, ap); 2563 va_end(ap); 2564 } 2565 2566 /* 2567 * --------------------------------------------------------------------- 2568 * Functions for querying mount options/arguments from filesystems. 2569 */ 2570 2571 /* 2572 * Check that no unknown options are given 2573 */ 2574 int 2575 vfs_filteropt(struct vfsoptlist *opts, const char **legal) 2576 { 2577 struct vfsopt *opt; 2578 char errmsg[255]; 2579 const char **t, *p, *q; 2580 int ret = 0; 2581 2582 TAILQ_FOREACH(opt, opts, link) { 2583 p = opt->name; 2584 q = NULL; 2585 if (p[0] == 'n' && p[1] == 'o') 2586 q = p + 2; 2587 for(t = global_opts; *t != NULL; t++) { 2588 if (strcmp(*t, p) == 0) 2589 break; 2590 if (q != NULL) { 2591 if (strcmp(*t, q) == 0) 2592 break; 2593 } 2594 } 2595 if (*t != NULL) 2596 continue; 2597 for(t = legal; *t != NULL; t++) { 2598 if (strcmp(*t, p) == 0) 2599 break; 2600 if (q != NULL) { 2601 if (strcmp(*t, q) == 0) 2602 break; 2603 } 2604 } 2605 if (*t != NULL) 2606 continue; 2607 snprintf(errmsg, sizeof(errmsg), 2608 "mount option <%s> is unknown", p); 2609 ret = EINVAL; 2610 } 2611 if (ret != 0) { 2612 TAILQ_FOREACH(opt, opts, link) { 2613 if (strcmp(opt->name, "errmsg") == 0) { 2614 strncpy((char *)opt->value, errmsg, opt->len); 2615 break; 2616 } 2617 } 2618 if (opt == NULL) 2619 printf("%s\n", errmsg); 2620 } 2621 return (ret); 2622 } 2623 2624 /* 2625 * Get a mount option by its name. 2626 * 2627 * Return 0 if the option was found, ENOENT otherwise. 2628 * If len is non-NULL it will be filled with the length 2629 * of the option. If buf is non-NULL, it will be filled 2630 * with the address of the option. 2631 */ 2632 int 2633 vfs_getopt(struct vfsoptlist *opts, const char *name, void **buf, int *len) 2634 { 2635 struct vfsopt *opt; 2636 2637 KASSERT(opts != NULL, ("vfs_getopt: caller passed 'opts' as NULL")); 2638 2639 TAILQ_FOREACH(opt, opts, link) { 2640 if (strcmp(name, opt->name) == 0) { 2641 opt->seen = 1; 2642 if (len != NULL) 2643 *len = opt->len; 2644 if (buf != NULL) 2645 *buf = opt->value; 2646 return (0); 2647 } 2648 } 2649 return (ENOENT); 2650 } 2651 2652 int 2653 vfs_getopt_pos(struct vfsoptlist *opts, const char *name) 2654 { 2655 struct vfsopt *opt; 2656 2657 if (opts == NULL) 2658 return (-1); 2659 2660 TAILQ_FOREACH(opt, opts, link) { 2661 if (strcmp(name, opt->name) == 0) { 2662 opt->seen = 1; 2663 return (opt->pos); 2664 } 2665 } 2666 return (-1); 2667 } 2668 2669 int 2670 vfs_getopt_size(struct vfsoptlist *opts, const char *name, off_t *value) 2671 { 2672 char *opt_value, *vtp; 2673 quad_t iv; 2674 int error, opt_len; 2675 2676 error = vfs_getopt(opts, name, (void **)&opt_value, &opt_len); 2677 if (error != 0) 2678 return (error); 2679 if (opt_len == 0 || opt_value == NULL) 2680 return (EINVAL); 2681 if (opt_value[0] == '\0' || opt_value[opt_len - 1] != '\0') 2682 return (EINVAL); 2683 iv = strtoq(opt_value, &vtp, 0); 2684 if (vtp == opt_value || (vtp[0] != '\0' && vtp[1] != '\0')) 2685 return (EINVAL); 2686 if (iv < 0) 2687 return (EINVAL); 2688 switch (vtp[0]) { 2689 case 't': case 'T': 2690 iv *= 1024; 2691 /* FALLTHROUGH */ 2692 case 'g': case 'G': 2693 iv *= 1024; 2694 /* FALLTHROUGH */ 2695 case 'm': case 'M': 2696 iv *= 1024; 2697 /* FALLTHROUGH */ 2698 case 'k': case 'K': 2699 iv *= 1024; 2700 case '\0': 2701 break; 2702 default: 2703 return (EINVAL); 2704 } 2705 *value = iv; 2706 2707 return (0); 2708 } 2709 2710 char * 2711 vfs_getopts(struct vfsoptlist *opts, const char *name, int *error) 2712 { 2713 struct vfsopt *opt; 2714 2715 *error = 0; 2716 TAILQ_FOREACH(opt, opts, link) { 2717 if (strcmp(name, opt->name) != 0) 2718 continue; 2719 opt->seen = 1; 2720 if (opt->len == 0 || 2721 ((char *)opt->value)[opt->len - 1] != '\0') { 2722 *error = EINVAL; 2723 return (NULL); 2724 } 2725 return (opt->value); 2726 } 2727 *error = ENOENT; 2728 return (NULL); 2729 } 2730 2731 int 2732 vfs_flagopt(struct vfsoptlist *opts, const char *name, uint64_t *w, 2733 uint64_t val) 2734 { 2735 struct vfsopt *opt; 2736 2737 TAILQ_FOREACH(opt, opts, link) { 2738 if (strcmp(name, opt->name) == 0) { 2739 opt->seen = 1; 2740 if (w != NULL) 2741 *w |= val; 2742 return (1); 2743 } 2744 } 2745 if (w != NULL) 2746 *w &= ~val; 2747 return (0); 2748 } 2749 2750 int 2751 vfs_scanopt(struct vfsoptlist *opts, const char *name, const char *fmt, ...) 2752 { 2753 va_list ap; 2754 struct vfsopt *opt; 2755 int ret; 2756 2757 KASSERT(opts != NULL, ("vfs_getopt: caller passed 'opts' as NULL")); 2758 2759 TAILQ_FOREACH(opt, opts, link) { 2760 if (strcmp(name, opt->name) != 0) 2761 continue; 2762 opt->seen = 1; 2763 if (opt->len == 0 || opt->value == NULL) 2764 return (0); 2765 if (((char *)opt->value)[opt->len - 1] != '\0') 2766 return (0); 2767 va_start(ap, fmt); 2768 ret = vsscanf(opt->value, fmt, ap); 2769 va_end(ap); 2770 return (ret); 2771 } 2772 return (0); 2773 } 2774 2775 int 2776 vfs_setopt(struct vfsoptlist *opts, const char *name, void *value, int len) 2777 { 2778 struct vfsopt *opt; 2779 2780 TAILQ_FOREACH(opt, opts, link) { 2781 if (strcmp(name, opt->name) != 0) 2782 continue; 2783 opt->seen = 1; 2784 if (opt->value == NULL) 2785 opt->len = len; 2786 else { 2787 if (opt->len != len) 2788 return (EINVAL); 2789 bcopy(value, opt->value, len); 2790 } 2791 return (0); 2792 } 2793 return (ENOENT); 2794 } 2795 2796 int 2797 vfs_setopt_part(struct vfsoptlist *opts, const char *name, void *value, int len) 2798 { 2799 struct vfsopt *opt; 2800 2801 TAILQ_FOREACH(opt, opts, link) { 2802 if (strcmp(name, opt->name) != 0) 2803 continue; 2804 opt->seen = 1; 2805 if (opt->value == NULL) 2806 opt->len = len; 2807 else { 2808 if (opt->len < len) 2809 return (EINVAL); 2810 opt->len = len; 2811 bcopy(value, opt->value, len); 2812 } 2813 return (0); 2814 } 2815 return (ENOENT); 2816 } 2817 2818 int 2819 vfs_setopts(struct vfsoptlist *opts, const char *name, const char *value) 2820 { 2821 struct vfsopt *opt; 2822 2823 TAILQ_FOREACH(opt, opts, link) { 2824 if (strcmp(name, opt->name) != 0) 2825 continue; 2826 opt->seen = 1; 2827 if (opt->value == NULL) 2828 opt->len = strlen(value) + 1; 2829 else if (strlcpy(opt->value, value, opt->len) >= opt->len) 2830 return (EINVAL); 2831 return (0); 2832 } 2833 return (ENOENT); 2834 } 2835 2836 /* 2837 * Find and copy a mount option. 2838 * 2839 * The size of the buffer has to be specified 2840 * in len, if it is not the same length as the 2841 * mount option, EINVAL is returned. 2842 * Returns ENOENT if the option is not found. 2843 */ 2844 int 2845 vfs_copyopt(struct vfsoptlist *opts, const char *name, void *dest, int len) 2846 { 2847 struct vfsopt *opt; 2848 2849 KASSERT(opts != NULL, ("vfs_copyopt: caller passed 'opts' as NULL")); 2850 2851 TAILQ_FOREACH(opt, opts, link) { 2852 if (strcmp(name, opt->name) == 0) { 2853 opt->seen = 1; 2854 if (len != opt->len) 2855 return (EINVAL); 2856 bcopy(opt->value, dest, opt->len); 2857 return (0); 2858 } 2859 } 2860 return (ENOENT); 2861 } 2862 2863 int 2864 __vfs_statfs(struct mount *mp, struct statfs *sbp) 2865 { 2866 /* 2867 * Filesystems only fill in part of the structure for updates, we 2868 * have to read the entirety first to get all content. 2869 */ 2870 if (sbp != &mp->mnt_stat) 2871 memcpy(sbp, &mp->mnt_stat, sizeof(*sbp)); 2872 2873 /* 2874 * Set these in case the underlying filesystem fails to do so. 2875 */ 2876 sbp->f_version = STATFS_VERSION; 2877 sbp->f_namemax = NAME_MAX; 2878 sbp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK; 2879 sbp->f_nvnodelistsize = mp->mnt_nvnodelistsize; 2880 2881 return (mp->mnt_op->vfs_statfs(mp, sbp)); 2882 } 2883 2884 void 2885 vfs_mountedfrom(struct mount *mp, const char *from) 2886 { 2887 2888 bzero(mp->mnt_stat.f_mntfromname, sizeof mp->mnt_stat.f_mntfromname); 2889 strlcpy(mp->mnt_stat.f_mntfromname, from, 2890 sizeof mp->mnt_stat.f_mntfromname); 2891 } 2892 2893 /* 2894 * --------------------------------------------------------------------- 2895 * This is the api for building mount args and mounting filesystems from 2896 * inside the kernel. 2897 * 2898 * The API works by accumulation of individual args. First error is 2899 * latched. 2900 * 2901 * XXX: should be documented in new manpage kernel_mount(9) 2902 */ 2903 2904 /* A memory allocation which must be freed when we are done */ 2905 struct mntaarg { 2906 SLIST_ENTRY(mntaarg) next; 2907 }; 2908 2909 /* The header for the mount arguments */ 2910 struct mntarg { 2911 struct iovec *v; 2912 int len; 2913 int error; 2914 SLIST_HEAD(, mntaarg) list; 2915 }; 2916 2917 /* 2918 * Add a boolean argument. 2919 * 2920 * flag is the boolean value. 2921 * name must start with "no". 2922 */ 2923 struct mntarg * 2924 mount_argb(struct mntarg *ma, int flag, const char *name) 2925 { 2926 2927 KASSERT(name[0] == 'n' && name[1] == 'o', 2928 ("mount_argb(...,%s): name must start with 'no'", name)); 2929 2930 return (mount_arg(ma, name + (flag ? 2 : 0), NULL, 0)); 2931 } 2932 2933 /* 2934 * Add an argument printf style 2935 */ 2936 struct mntarg * 2937 mount_argf(struct mntarg *ma, const char *name, const char *fmt, ...) 2938 { 2939 va_list ap; 2940 struct mntaarg *maa; 2941 struct sbuf *sb; 2942 int len; 2943 2944 if (ma == NULL) { 2945 ma = malloc(sizeof *ma, M_MOUNT, M_WAITOK | M_ZERO); 2946 SLIST_INIT(&ma->list); 2947 } 2948 if (ma->error) 2949 return (ma); 2950 2951 ma->v = realloc(ma->v, sizeof *ma->v * (ma->len + 2), 2952 M_MOUNT, M_WAITOK); 2953 ma->v[ma->len].iov_base = (void *)(uintptr_t)name; 2954 ma->v[ma->len].iov_len = strlen(name) + 1; 2955 ma->len++; 2956 2957 sb = sbuf_new_auto(); 2958 va_start(ap, fmt); 2959 sbuf_vprintf(sb, fmt, ap); 2960 va_end(ap); 2961 sbuf_finish(sb); 2962 len = sbuf_len(sb) + 1; 2963 maa = malloc(sizeof *maa + len, M_MOUNT, M_WAITOK | M_ZERO); 2964 SLIST_INSERT_HEAD(&ma->list, maa, next); 2965 bcopy(sbuf_data(sb), maa + 1, len); 2966 sbuf_delete(sb); 2967 2968 ma->v[ma->len].iov_base = maa + 1; 2969 ma->v[ma->len].iov_len = len; 2970 ma->len++; 2971 2972 return (ma); 2973 } 2974 2975 /* 2976 * Add an argument which is a userland string. 2977 */ 2978 struct mntarg * 2979 mount_argsu(struct mntarg *ma, const char *name, const void *val, int len) 2980 { 2981 struct mntaarg *maa; 2982 char *tbuf; 2983 2984 if (val == NULL) 2985 return (ma); 2986 if (ma == NULL) { 2987 ma = malloc(sizeof *ma, M_MOUNT, M_WAITOK | M_ZERO); 2988 SLIST_INIT(&ma->list); 2989 } 2990 if (ma->error) 2991 return (ma); 2992 maa = malloc(sizeof *maa + len, M_MOUNT, M_WAITOK | M_ZERO); 2993 SLIST_INSERT_HEAD(&ma->list, maa, next); 2994 tbuf = (void *)(maa + 1); 2995 ma->error = copyinstr(val, tbuf, len, NULL); 2996 return (mount_arg(ma, name, tbuf, -1)); 2997 } 2998 2999 /* 3000 * Plain argument. 3001 * 3002 * If length is -1, treat value as a C string. 3003 */ 3004 struct mntarg * 3005 mount_arg(struct mntarg *ma, const char *name, const void *val, int len) 3006 { 3007 3008 if (ma == NULL) { 3009 ma = malloc(sizeof *ma, M_MOUNT, M_WAITOK | M_ZERO); 3010 SLIST_INIT(&ma->list); 3011 } 3012 if (ma->error) 3013 return (ma); 3014 3015 ma->v = realloc(ma->v, sizeof *ma->v * (ma->len + 2), 3016 M_MOUNT, M_WAITOK); 3017 ma->v[ma->len].iov_base = (void *)(uintptr_t)name; 3018 ma->v[ma->len].iov_len = strlen(name) + 1; 3019 ma->len++; 3020 3021 ma->v[ma->len].iov_base = (void *)(uintptr_t)val; 3022 if (len < 0) 3023 ma->v[ma->len].iov_len = strlen(val) + 1; 3024 else 3025 ma->v[ma->len].iov_len = len; 3026 ma->len++; 3027 return (ma); 3028 } 3029 3030 /* 3031 * Free a mntarg structure 3032 */ 3033 static void 3034 free_mntarg(struct mntarg *ma) 3035 { 3036 struct mntaarg *maa; 3037 3038 while (!SLIST_EMPTY(&ma->list)) { 3039 maa = SLIST_FIRST(&ma->list); 3040 SLIST_REMOVE_HEAD(&ma->list, next); 3041 free(maa, M_MOUNT); 3042 } 3043 free(ma->v, M_MOUNT); 3044 free(ma, M_MOUNT); 3045 } 3046 3047 /* 3048 * Mount a filesystem 3049 */ 3050 int 3051 kernel_mount(struct mntarg *ma, uint64_t flags) 3052 { 3053 struct uio auio; 3054 int error; 3055 3056 KASSERT(ma != NULL, ("kernel_mount NULL ma")); 3057 KASSERT(ma->error != 0 || ma->v != NULL, ("kernel_mount NULL ma->v")); 3058 KASSERT(!(ma->len & 1), ("kernel_mount odd ma->len (%d)", ma->len)); 3059 3060 error = ma->error; 3061 if (error == 0) { 3062 auio.uio_iov = ma->v; 3063 auio.uio_iovcnt = ma->len; 3064 auio.uio_segflg = UIO_SYSSPACE; 3065 error = vfs_donmount(curthread, flags, &auio); 3066 } 3067 free_mntarg(ma); 3068 return (error); 3069 } 3070 3071 /* Map from mount options to printable formats. */ 3072 static struct mntoptnames optnames[] = { 3073 MNTOPT_NAMES 3074 }; 3075 3076 #define DEVCTL_LEN 1024 3077 static void 3078 mount_devctl_event(const char *type, struct mount *mp, bool donew) 3079 { 3080 const uint8_t *cp; 3081 struct mntoptnames *fp; 3082 struct sbuf sb; 3083 struct statfs *sfp = &mp->mnt_stat; 3084 char *buf; 3085 3086 buf = malloc(DEVCTL_LEN, M_MOUNT, M_NOWAIT); 3087 if (buf == NULL) 3088 return; 3089 sbuf_new(&sb, buf, DEVCTL_LEN, SBUF_FIXEDLEN); 3090 sbuf_cpy(&sb, "mount-point=\""); 3091 devctl_safe_quote_sb(&sb, sfp->f_mntonname); 3092 sbuf_cat(&sb, "\" mount-dev=\""); 3093 devctl_safe_quote_sb(&sb, sfp->f_mntfromname); 3094 sbuf_cat(&sb, "\" mount-type=\""); 3095 devctl_safe_quote_sb(&sb, sfp->f_fstypename); 3096 sbuf_cat(&sb, "\" fsid=0x"); 3097 cp = (const uint8_t *)&sfp->f_fsid.val[0]; 3098 for (int i = 0; i < sizeof(sfp->f_fsid); i++) 3099 sbuf_printf(&sb, "%02x", cp[i]); 3100 sbuf_printf(&sb, " owner=%u flags=\"", sfp->f_owner); 3101 for (fp = optnames; fp->o_opt != 0; fp++) { 3102 if ((mp->mnt_flag & fp->o_opt) != 0) { 3103 sbuf_cat(&sb, fp->o_name); 3104 sbuf_putc(&sb, ';'); 3105 } 3106 } 3107 sbuf_putc(&sb, '"'); 3108 sbuf_finish(&sb); 3109 3110 /* 3111 * Options are not published because the form of the options depends on 3112 * the file system and may include binary data. In addition, they don't 3113 * necessarily provide enough useful information to be actionable when 3114 * devd processes them. 3115 */ 3116 3117 if (sbuf_error(&sb) == 0) 3118 devctl_notify("VFS", "FS", type, sbuf_data(&sb)); 3119 sbuf_delete(&sb); 3120 free(buf, M_MOUNT); 3121 } 3122 3123 /* 3124 * Force remount specified mount point to read-only. The argument 3125 * must be busied to avoid parallel unmount attempts. 3126 * 3127 * Intended use is to prevent further writes if some metadata 3128 * inconsistency is detected. Note that the function still flushes 3129 * all cached metadata and data for the mount point, which might be 3130 * not always suitable. 3131 */ 3132 int 3133 vfs_remount_ro(struct mount *mp) 3134 { 3135 struct vfsoptlist *opts; 3136 struct vfsopt *opt; 3137 struct vnode *vp_covered, *rootvp; 3138 int error; 3139 3140 vfs_op_enter(mp); 3141 KASSERT(mp->mnt_lockref > 0, 3142 ("vfs_remount_ro: mp %p is not busied", mp)); 3143 KASSERT((mp->mnt_kern_flag & MNTK_UNMOUNT) == 0, 3144 ("vfs_remount_ro: mp %p is being unmounted (and busy?)", mp)); 3145 3146 rootvp = NULL; 3147 vp_covered = mp->mnt_vnodecovered; 3148 error = vget(vp_covered, LK_EXCLUSIVE | LK_NOWAIT); 3149 if (error != 0) { 3150 vfs_op_exit(mp); 3151 return (error); 3152 } 3153 VI_LOCK(vp_covered); 3154 if ((vp_covered->v_iflag & VI_MOUNT) != 0) { 3155 VI_UNLOCK(vp_covered); 3156 vput(vp_covered); 3157 vfs_op_exit(mp); 3158 return (EBUSY); 3159 } 3160 vp_covered->v_iflag |= VI_MOUNT; 3161 VI_UNLOCK(vp_covered); 3162 vn_seqc_write_begin(vp_covered); 3163 3164 MNT_ILOCK(mp); 3165 if ((mp->mnt_flag & MNT_RDONLY) != 0) { 3166 MNT_IUNLOCK(mp); 3167 error = EBUSY; 3168 goto out; 3169 } 3170 mp->mnt_flag |= MNT_UPDATE | MNT_FORCE | MNT_RDONLY; 3171 rootvp = vfs_cache_root_clear(mp); 3172 MNT_IUNLOCK(mp); 3173 3174 opts = malloc(sizeof(struct vfsoptlist), M_MOUNT, M_WAITOK | M_ZERO); 3175 TAILQ_INIT(opts); 3176 opt = malloc(sizeof(struct vfsopt), M_MOUNT, M_WAITOK | M_ZERO); 3177 opt->name = strdup("ro", M_MOUNT); 3178 opt->value = NULL; 3179 TAILQ_INSERT_TAIL(opts, opt, link); 3180 vfs_mergeopts(opts, mp->mnt_opt); 3181 mp->mnt_optnew = opts; 3182 3183 error = VFS_MOUNT(mp); 3184 3185 if (error == 0) { 3186 MNT_ILOCK(mp); 3187 mp->mnt_flag &= ~(MNT_UPDATE | MNT_FORCE); 3188 MNT_IUNLOCK(mp); 3189 vfs_deallocate_syncvnode(mp); 3190 if (mp->mnt_opt != NULL) 3191 vfs_freeopts(mp->mnt_opt); 3192 mp->mnt_opt = mp->mnt_optnew; 3193 } else { 3194 MNT_ILOCK(mp); 3195 mp->mnt_flag &= ~(MNT_UPDATE | MNT_FORCE | MNT_RDONLY); 3196 MNT_IUNLOCK(mp); 3197 vfs_freeopts(mp->mnt_optnew); 3198 } 3199 mp->mnt_optnew = NULL; 3200 3201 out: 3202 vfs_op_exit(mp); 3203 VI_LOCK(vp_covered); 3204 vp_covered->v_iflag &= ~VI_MOUNT; 3205 VI_UNLOCK(vp_covered); 3206 vput(vp_covered); 3207 vn_seqc_write_end(vp_covered); 3208 if (rootvp != NULL) { 3209 vn_seqc_write_end(rootvp); 3210 vrele(rootvp); 3211 } 3212 return (error); 3213 } 3214 3215 /* 3216 * Suspend write operations on all local writeable filesystems. Does 3217 * full sync of them in the process. 3218 * 3219 * Iterate over the mount points in reverse order, suspending most 3220 * recently mounted filesystems first. It handles a case where a 3221 * filesystem mounted from a md(4) vnode-backed device should be 3222 * suspended before the filesystem that owns the vnode. 3223 */ 3224 void 3225 suspend_all_fs(void) 3226 { 3227 struct mount *mp; 3228 int error; 3229 3230 mtx_lock(&mountlist_mtx); 3231 TAILQ_FOREACH_REVERSE(mp, &mountlist, mntlist, mnt_list) { 3232 error = vfs_busy(mp, MBF_MNTLSTLOCK | MBF_NOWAIT); 3233 if (error != 0) 3234 continue; 3235 if ((mp->mnt_flag & (MNT_RDONLY | MNT_LOCAL)) != MNT_LOCAL || 3236 (mp->mnt_kern_flag & MNTK_SUSPEND) != 0) { 3237 mtx_lock(&mountlist_mtx); 3238 vfs_unbusy(mp); 3239 continue; 3240 } 3241 error = vfs_write_suspend(mp, 0); 3242 if (error == 0) { 3243 MNT_ILOCK(mp); 3244 MPASS((mp->mnt_kern_flag & MNTK_SUSPEND_ALL) == 0); 3245 mp->mnt_kern_flag |= MNTK_SUSPEND_ALL; 3246 MNT_IUNLOCK(mp); 3247 mtx_lock(&mountlist_mtx); 3248 } else { 3249 printf("suspend of %s failed, error %d\n", 3250 mp->mnt_stat.f_mntonname, error); 3251 mtx_lock(&mountlist_mtx); 3252 vfs_unbusy(mp); 3253 } 3254 } 3255 mtx_unlock(&mountlist_mtx); 3256 } 3257 3258 /* 3259 * Clone the mnt_exjail field to a new mount point. 3260 */ 3261 void 3262 vfs_exjail_clone(struct mount *inmp, struct mount *outmp) 3263 { 3264 struct ucred *cr; 3265 struct prison *pr; 3266 3267 MNT_ILOCK(inmp); 3268 cr = inmp->mnt_exjail; 3269 if (cr != NULL) { 3270 crhold(cr); 3271 MNT_IUNLOCK(inmp); 3272 pr = cr->cr_prison; 3273 sx_slock(&allprison_lock); 3274 if (!prison_isalive(pr)) { 3275 sx_sunlock(&allprison_lock); 3276 crfree(cr); 3277 return; 3278 } 3279 MNT_ILOCK(outmp); 3280 if (outmp->mnt_exjail == NULL) { 3281 outmp->mnt_exjail = cr; 3282 atomic_add_int(&pr->pr_exportcnt, 1); 3283 cr = NULL; 3284 } 3285 MNT_IUNLOCK(outmp); 3286 sx_sunlock(&allprison_lock); 3287 if (cr != NULL) 3288 crfree(cr); 3289 } else 3290 MNT_IUNLOCK(inmp); 3291 } 3292 3293 void 3294 resume_all_fs(void) 3295 { 3296 struct mount *mp; 3297 3298 mtx_lock(&mountlist_mtx); 3299 TAILQ_FOREACH(mp, &mountlist, mnt_list) { 3300 if ((mp->mnt_kern_flag & MNTK_SUSPEND_ALL) == 0) 3301 continue; 3302 mtx_unlock(&mountlist_mtx); 3303 MNT_ILOCK(mp); 3304 MPASS((mp->mnt_kern_flag & MNTK_SUSPEND) != 0); 3305 mp->mnt_kern_flag &= ~MNTK_SUSPEND_ALL; 3306 MNT_IUNLOCK(mp); 3307 vfs_write_resume(mp, 0); 3308 mtx_lock(&mountlist_mtx); 3309 vfs_unbusy(mp); 3310 } 3311 mtx_unlock(&mountlist_mtx); 3312 } 3313 3314 static void 3315 pnfsd_waitreplenish(struct mount *mp) 3316 { 3317 struct netexport *nep; 3318 3319 lockmgr(&mp->mnt_explock, LK_SHARED, NULL); 3320 nep = mp->mnt_export; 3321 if (nep != NULL) { 3322 refcount_acquire(&nep->ne_ref); 3323 lockmgr(&mp->mnt_explock, LK_RELEASE, NULL); 3324 MNTEXP_LOCK(nep); 3325 if (nep->ne_pnfsnumfile != NULL && 3326 nep->ne_pnfsnumfile != PNFSD_STOPPED) { 3327 nep->ne_pnfsnumfile = PNFSD_STOP; 3328 wakeup(&mp->mnt_export); 3329 while (nep->ne_pnfsnumfile != PNFSD_STOPPED) 3330 (void)msleep(&mp->mnt_explock, MNTEXP_MTX(nep), 3331 PVFS, "pnfsw", hz); 3332 } 3333 MNTEXP_UNLOCK(nep); 3334 vfs_netexport_release(nep); 3335 } else 3336 lockmgr(&mp->mnt_explock, LK_RELEASE, NULL); 3337 } 3338