1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * devtmpfs - kernel-maintained tmpfs-based /dev
4 *
5 * Copyright (C) 2009, Kay Sievers <kay.sievers@vrfy.org>
6 *
7 * During bootup, before any driver core device is registered,
8 * devtmpfs, a tmpfs-based filesystem is created. Every driver-core
9 * device which requests a device node, will add a node in this
10 * filesystem.
11 * By default, all devices are named after the name of the device,
12 * owned by root and have a default mode of 0600. Subsystems can
13 * overwrite the default setting if needed.
14 */
15
16 #define pr_fmt(fmt) "devtmpfs: " fmt
17
18 #include <linux/kernel.h>
19 #include <linux/syscalls.h>
20 #include <linux/mount.h>
21 #include <linux/device.h>
22 #include <linux/blkdev.h>
23 #include <linux/namei.h>
24 #include <linux/fs.h>
25 #include <linux/shmem_fs.h>
26 #include <linux/ramfs.h>
27 #include <linux/sched.h>
28 #include <linux/slab.h>
29 #include <linux/kthread.h>
30 #include <linux/init_syscalls.h>
31 #include <uapi/linux/mount.h>
32 #include "base.h"
33
34 #ifdef CONFIG_DEVTMPFS_SAFE
35 #define DEVTMPFS_MFLAGS (MS_SILENT | MS_NOEXEC | MS_NOSUID)
36 #else
37 #define DEVTMPFS_MFLAGS (MS_SILENT)
38 #endif
39
40 static struct task_struct *thread;
41
42 static int __initdata mount_dev = IS_ENABLED(CONFIG_DEVTMPFS_MOUNT);
43
44 static DEFINE_SPINLOCK(req_lock);
45
46 static struct req {
47 struct req *next;
48 struct completion done;
49 int err;
50 const char *name;
51 umode_t mode; /* 0 => delete */
52 kuid_t uid;
53 kgid_t gid;
54 struct device *dev;
55 } *requests;
56
mount_param(char * str)57 static int __init mount_param(char *str)
58 {
59 return kstrtoint(str, 0, &mount_dev) == 0;
60 }
61 __setup("devtmpfs.mount=", mount_param);
62
63 static struct vfsmount *mnt;
64
65 static struct file_system_type internal_fs_type = {
66 .name = "devtmpfs",
67 #ifdef CONFIG_TMPFS
68 .init_fs_context = shmem_init_fs_context,
69 #else
70 .init_fs_context = ramfs_init_fs_context,
71 #endif
72 .kill_sb = kill_anon_super,
73 };
74
75 struct devtmpfs_context {
76 struct fs_context *fc;
77 };
78
devtmpfs_free(struct fs_context * fc)79 static void devtmpfs_free(struct fs_context *fc)
80 {
81 struct devtmpfs_context *ctx = fc->fs_private;
82
83 if (ctx) {
84 put_fs_context(ctx->fc);
85 kfree(ctx);
86 }
87 }
88
devtmpfs_parse_param(struct fs_context * fc,struct fs_parameter * param)89 static int devtmpfs_parse_param(struct fs_context *fc, struct fs_parameter *param)
90 {
91 struct devtmpfs_context *ctx = fc->fs_private;
92
93 return ctx->fc->ops->parse_param(ctx->fc, param);
94 }
95
devtmpfs_parse_monolithic(struct fs_context * fc,void * data)96 static int devtmpfs_parse_monolithic(struct fs_context *fc, void *data)
97 {
98 struct devtmpfs_context *ctx = fc->fs_private;
99
100 if (ctx->fc->ops->parse_monolithic)
101 return ctx->fc->ops->parse_monolithic(ctx->fc, data);
102 return generic_parse_monolithic(ctx->fc, data);
103 }
104
devtmpfs_get_tree(struct fs_context * fc)105 static int devtmpfs_get_tree(struct fs_context *fc)
106 {
107 struct devtmpfs_context *ctx = fc->fs_private;
108 struct super_block *sb = mnt->mnt_sb;
109 int err;
110
111 atomic_inc(&sb->s_active);
112 down_write(&sb->s_umount);
113
114 if (ctx->fc->ops->reconfigure) {
115 err = ctx->fc->ops->reconfigure(ctx->fc);
116 if (err) {
117 deactivate_locked_super(sb);
118 return err;
119 }
120 }
121
122 fc->root = dget(sb->s_root);
123 return 0;
124 }
125
126 static const struct fs_context_operations devtmpfs_context_ops = {
127 .free = devtmpfs_free,
128 .parse_param = devtmpfs_parse_param,
129 .parse_monolithic = devtmpfs_parse_monolithic,
130 .get_tree = devtmpfs_get_tree,
131 };
132
devtmpfs_init_fs_context(struct fs_context * fc)133 static int devtmpfs_init_fs_context(struct fs_context *fc)
134 {
135 struct devtmpfs_context *ctx;
136 int err;
137
138 ctx = kzalloc_obj(struct devtmpfs_context);
139 if (!ctx)
140 return -ENOMEM;
141
142 /* Each mount will reconfigure the shared superblock w/ new options */
143 ctx->fc = fs_context_for_reconfigure(mnt->mnt_root,
144 mnt->mnt_sb->s_flags, MS_RMT_MASK);
145 if (IS_ERR(ctx->fc)) {
146 err = PTR_ERR(ctx->fc);
147 kfree(ctx);
148 return err;
149 }
150
151 fc->fs_private = ctx;
152 fc->ops = &devtmpfs_context_ops;
153
154 return 0;
155 }
156
157 static struct file_system_type dev_fs_type = {
158 .name = "devtmpfs",
159 .init_fs_context = devtmpfs_init_fs_context,
160 };
161
devtmpfs_submit_req(struct req * req,const char * tmp)162 static int devtmpfs_submit_req(struct req *req, const char *tmp)
163 {
164 init_completion(&req->done);
165
166 spin_lock(&req_lock);
167 req->next = requests;
168 requests = req;
169 spin_unlock(&req_lock);
170
171 wake_up_process(thread);
172 wait_for_completion(&req->done);
173
174 kfree(tmp);
175
176 return req->err;
177 }
178
devtmpfs_create_node(struct device * dev)179 int devtmpfs_create_node(struct device *dev)
180 {
181 const char *tmp = NULL;
182 struct req req;
183
184 if (!thread)
185 return 0;
186
187 req.mode = 0;
188 req.uid = GLOBAL_ROOT_UID;
189 req.gid = GLOBAL_ROOT_GID;
190 req.name = device_get_devnode(dev, &req.mode, &req.uid, &req.gid, &tmp);
191 if (!req.name)
192 return -ENOMEM;
193
194 if (req.mode == 0)
195 req.mode = 0600;
196 if (is_blockdev(dev))
197 req.mode |= S_IFBLK;
198 else
199 req.mode |= S_IFCHR;
200
201 req.dev = dev;
202
203 return devtmpfs_submit_req(&req, tmp);
204 }
205
devtmpfs_delete_node(struct device * dev)206 int devtmpfs_delete_node(struct device *dev)
207 {
208 const char *tmp = NULL;
209 struct req req;
210
211 if (!thread)
212 return 0;
213
214 req.name = device_get_devnode(dev, NULL, NULL, NULL, &tmp);
215 if (!req.name)
216 return -ENOMEM;
217
218 req.mode = 0;
219 req.dev = dev;
220
221 return devtmpfs_submit_req(&req, tmp);
222 }
223
dev_mkdir(const char * name,umode_t mode)224 static int dev_mkdir(const char *name, umode_t mode)
225 {
226 struct dentry *dentry;
227 struct path path;
228
229 dentry = start_creating_path(AT_FDCWD, name, &path, LOOKUP_DIRECTORY);
230 if (IS_ERR(dentry))
231 return PTR_ERR(dentry);
232
233 dentry = vfs_mkdir(&nop_mnt_idmap, d_inode(path.dentry), dentry, mode, NULL);
234 if (!IS_ERR(dentry))
235 /* mark as kernel-created inode */
236 d_inode(dentry)->i_private = &thread;
237 end_creating_path(&path, dentry);
238 return PTR_ERR_OR_ZERO(dentry);
239 }
240
create_path(const char * nodepath)241 static int create_path(const char *nodepath)
242 {
243 char *path;
244 char *s;
245 int err = 0;
246
247 /* parent directories do not exist, create them */
248 path = kstrdup(nodepath, GFP_KERNEL);
249 if (!path)
250 return -ENOMEM;
251
252 s = path;
253 for (;;) {
254 s = strchr(s, '/');
255 if (!s)
256 break;
257 s[0] = '\0';
258 err = dev_mkdir(path, 0755);
259 if (err && err != -EEXIST)
260 break;
261 s[0] = '/';
262 s++;
263 }
264 kfree(path);
265 return err;
266 }
267
handle_create(const char * nodename,umode_t mode,kuid_t uid,kgid_t gid,struct device * dev)268 static int handle_create(const char *nodename, umode_t mode, kuid_t uid,
269 kgid_t gid, struct device *dev)
270 {
271 struct dentry *dentry;
272 struct path path;
273 int err;
274
275 dentry = start_creating_path(AT_FDCWD, nodename, &path, 0);
276 if (dentry == ERR_PTR(-ENOENT)) {
277 create_path(nodename);
278 dentry = start_creating_path(AT_FDCWD, nodename, &path, 0);
279 }
280 if (IS_ERR(dentry))
281 return PTR_ERR(dentry);
282
283 err = vfs_mknod(&nop_mnt_idmap, d_inode(path.dentry), dentry, mode,
284 dev->devt, NULL);
285 if (!err) {
286 struct iattr newattrs;
287
288 newattrs.ia_mode = mode;
289 newattrs.ia_uid = uid;
290 newattrs.ia_gid = gid;
291 newattrs.ia_valid = ATTR_MODE|ATTR_UID|ATTR_GID;
292 inode_lock(d_inode(dentry));
293 notify_change(&nop_mnt_idmap, dentry, &newattrs, NULL);
294 inode_unlock(d_inode(dentry));
295
296 /* mark as kernel-created inode */
297 d_inode(dentry)->i_private = &thread;
298 }
299 end_creating_path(&path, dentry);
300 return err;
301 }
302
dev_rmdir(const char * name)303 static int dev_rmdir(const char *name)
304 {
305 struct path parent;
306 struct dentry *dentry;
307 int err;
308
309 dentry = start_removing_path(name, &parent);
310 if (IS_ERR(dentry))
311 return PTR_ERR(dentry);
312 if (d_inode(dentry)->i_private == &thread)
313 err = vfs_rmdir(&nop_mnt_idmap, d_inode(parent.dentry),
314 dentry, NULL);
315 else
316 err = -EPERM;
317
318 end_removing_path(&parent, dentry);
319 return err;
320 }
321
delete_path(const char * nodepath)322 static int delete_path(const char *nodepath)
323 {
324 char *path;
325 int err = 0;
326
327 path = kstrdup(nodepath, GFP_KERNEL);
328 if (!path)
329 return -ENOMEM;
330
331 for (;;) {
332 char *base;
333
334 base = strrchr(path, '/');
335 if (!base)
336 break;
337 base[0] = '\0';
338 err = dev_rmdir(path);
339 if (err)
340 break;
341 }
342
343 kfree(path);
344 return err;
345 }
346
dev_mynode(struct device * dev,struct inode * inode)347 static int dev_mynode(struct device *dev, struct inode *inode)
348 {
349 /* did we create it */
350 if (inode->i_private != &thread)
351 return 0;
352
353 /* does the dev_t match */
354 if (is_blockdev(dev)) {
355 if (!S_ISBLK(inode->i_mode))
356 return 0;
357 } else {
358 if (!S_ISCHR(inode->i_mode))
359 return 0;
360 }
361 if (inode->i_rdev != dev->devt)
362 return 0;
363
364 /* ours */
365 return 1;
366 }
367
handle_remove(const char * nodename,struct device * dev)368 static int handle_remove(const char *nodename, struct device *dev)
369 {
370 struct path parent;
371 struct dentry *dentry;
372 struct inode *inode;
373 int deleted = 0;
374 int err = 0;
375
376 dentry = start_removing_path(nodename, &parent);
377 if (IS_ERR(dentry))
378 return PTR_ERR(dentry);
379
380 inode = d_inode(dentry);
381 if (dev_mynode(dev, inode)) {
382 struct iattr newattrs;
383 /*
384 * before unlinking this node, reset permissions
385 * of possible references like hardlinks
386 */
387 newattrs.ia_uid = GLOBAL_ROOT_UID;
388 newattrs.ia_gid = GLOBAL_ROOT_GID;
389 newattrs.ia_mode = inode->i_mode & ~0777;
390 newattrs.ia_valid =
391 ATTR_UID|ATTR_GID|ATTR_MODE;
392 inode_lock(d_inode(dentry));
393 notify_change(&nop_mnt_idmap, dentry, &newattrs, NULL);
394 inode_unlock(d_inode(dentry));
395 err = vfs_unlink(&nop_mnt_idmap, d_inode(parent.dentry),
396 dentry, NULL);
397 if (!err || err == -ENOENT)
398 deleted = 1;
399 }
400 end_removing_path(&parent, dentry);
401
402 if (deleted && strchr(nodename, '/'))
403 delete_path(nodename);
404 return err;
405 }
406
407 /*
408 * If configured, or requested by the commandline, devtmpfs will be
409 * auto-mounted after the kernel mounted the root filesystem.
410 */
devtmpfs_mount(void)411 int __init devtmpfs_mount(void)
412 {
413 int err;
414
415 if (!mount_dev)
416 return 0;
417
418 if (!thread)
419 return 0;
420
421 err = init_mount("devtmpfs", "dev", "devtmpfs", DEVTMPFS_MFLAGS, NULL);
422 if (err)
423 pr_info("error mounting %d\n", err);
424 else
425 pr_info("mounted\n");
426 return err;
427 }
428
429 static __initdata DECLARE_COMPLETION(setup_done);
430
handle(const char * name,umode_t mode,kuid_t uid,kgid_t gid,struct device * dev)431 static int handle(const char *name, umode_t mode, kuid_t uid, kgid_t gid,
432 struct device *dev)
433 {
434 if (mode)
435 return handle_create(name, mode, uid, gid, dev);
436 else
437 return handle_remove(name, dev);
438 }
439
devtmpfs_work_loop(void)440 static void __noreturn devtmpfs_work_loop(void)
441 {
442 while (1) {
443 spin_lock(&req_lock);
444 while (requests) {
445 struct req *req = requests;
446 requests = NULL;
447 spin_unlock(&req_lock);
448 while (req) {
449 struct req *next = req->next;
450 req->err = handle(req->name, req->mode,
451 req->uid, req->gid, req->dev);
452 complete(&req->done);
453 req = next;
454 }
455 spin_lock(&req_lock);
456 }
457 __set_current_state(TASK_INTERRUPTIBLE);
458 spin_unlock(&req_lock);
459 schedule();
460 }
461 }
462
devtmpfs_setup(void * p)463 static noinline int __init devtmpfs_setup(void *p)
464 {
465 int err;
466
467 err = ksys_unshare(UNSHARE_EMPTY_MNTNS);
468 if (err)
469 goto out;
470 err = init_mount("devtmpfs", "/", "devtmpfs", DEVTMPFS_MFLAGS, NULL);
471 if (err)
472 goto out;
473 init_chdir("/.."); /* will traverse into overmounted root */
474 init_chroot(".");
475 out:
476 *(int *)p = err;
477 return err;
478 }
479
480 /*
481 * The __ref is because devtmpfs_setup needs to be __init for the routines it
482 * calls. That call is done while devtmpfs_init, which is marked __init,
483 * synchronously waits for it to complete.
484 */
devtmpfsd(void * p)485 static int __ref devtmpfsd(void *p)
486 {
487 int err = devtmpfs_setup(p);
488
489 complete(&setup_done);
490 if (err)
491 return err;
492 devtmpfs_work_loop();
493 return 0;
494 }
495
496 /*
497 * Create devtmpfs instance, driver-core devices will add their device
498 * nodes here.
499 */
devtmpfs_init(void)500 int __init devtmpfs_init(void)
501 {
502 char opts[] = "mode=0755";
503 int err;
504
505 mnt = vfs_kern_mount(&internal_fs_type, 0, "devtmpfs", opts);
506 if (IS_ERR(mnt)) {
507 pr_err("unable to create devtmpfs %ld\n", PTR_ERR(mnt));
508 return PTR_ERR(mnt);
509 }
510
511 err = register_filesystem(&dev_fs_type);
512 if (err) {
513 pr_err("unable to register devtmpfs type %d\n", err);
514 return err;
515 }
516
517 thread = kthread_run(devtmpfsd, &err, "kdevtmpfs");
518 if (!IS_ERR(thread)) {
519 wait_for_completion(&setup_done);
520 } else {
521 err = PTR_ERR(thread);
522 thread = NULL;
523 }
524
525 if (err) {
526 pr_err("unable to create devtmpfs %d\n", err);
527 unregister_filesystem(&dev_fs_type);
528 thread = NULL;
529 return err;
530 }
531
532 pr_info("initialized\n");
533 return 0;
534 }
535