1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * devtmpfs - kernel-maintained tmpfs-based /dev 4 * 5 * Copyright (C) 2009, Kay Sievers <kay.sievers@vrfy.org> 6 * 7 * During bootup, before any driver core device is registered, 8 * devtmpfs, a tmpfs-based filesystem is created. Every driver-core 9 * device which requests a device node, will add a node in this 10 * filesystem. 11 * By default, all devices are named after the name of the device, 12 * owned by root and have a default mode of 0600. Subsystems can 13 * overwrite the default setting if needed. 14 */ 15 16 #define pr_fmt(fmt) "devtmpfs: " fmt 17 18 #include <linux/kernel.h> 19 #include <linux/syscalls.h> 20 #include <linux/mount.h> 21 #include <linux/device.h> 22 #include <linux/blkdev.h> 23 #include <linux/namei.h> 24 #include <linux/fs.h> 25 #include <linux/shmem_fs.h> 26 #include <linux/ramfs.h> 27 #include <linux/sched.h> 28 #include <linux/slab.h> 29 #include <linux/kthread.h> 30 #include <linux/init_syscalls.h> 31 #include <uapi/linux/mount.h> 32 #include "base.h" 33 34 #ifdef CONFIG_DEVTMPFS_SAFE 35 #define DEVTMPFS_MFLAGS (MS_SILENT | MS_NOEXEC | MS_NOSUID) 36 #else 37 #define DEVTMPFS_MFLAGS (MS_SILENT) 38 #endif 39 40 static struct task_struct *thread; 41 42 static int __initdata mount_dev = IS_ENABLED(CONFIG_DEVTMPFS_MOUNT); 43 44 static DEFINE_SPINLOCK(req_lock); 45 46 static struct req { 47 struct req *next; 48 struct completion done; 49 int err; 50 const char *name; 51 umode_t mode; /* 0 => delete */ 52 kuid_t uid; 53 kgid_t gid; 54 struct device *dev; 55 } *requests; 56 57 static int __init mount_param(char *str) 58 { 59 mount_dev = simple_strtoul(str, NULL, 0); 60 return 1; 61 } 62 __setup("devtmpfs.mount=", mount_param); 63 64 static struct vfsmount *mnt; 65 66 static struct dentry *public_dev_mount(struct file_system_type *fs_type, int flags, 67 const char *dev_name, void *data) 68 { 69 struct super_block *s = mnt->mnt_sb; 70 int err; 71 72 atomic_inc(&s->s_active); 73 down_write(&s->s_umount); 74 err = reconfigure_single(s, flags, data); 75 if (err < 0) { 76 deactivate_locked_super(s); 77 return ERR_PTR(err); 78 } 79 return dget(s->s_root); 80 } 81 82 static struct file_system_type internal_fs_type = { 83 .name = "devtmpfs", 84 #ifdef CONFIG_TMPFS 85 .init_fs_context = shmem_init_fs_context, 86 #else 87 .init_fs_context = ramfs_init_fs_context, 88 #endif 89 .kill_sb = kill_litter_super, 90 }; 91 92 static struct file_system_type dev_fs_type = { 93 .name = "devtmpfs", 94 .mount = public_dev_mount, 95 }; 96 97 #ifdef CONFIG_BLOCK 98 static inline int is_blockdev(struct device *dev) 99 { 100 return dev->class == &block_class; 101 } 102 #else 103 static inline int is_blockdev(struct device *dev) { return 0; } 104 #endif 105 106 static int devtmpfs_submit_req(struct req *req, const char *tmp) 107 { 108 init_completion(&req->done); 109 110 spin_lock(&req_lock); 111 req->next = requests; 112 requests = req; 113 spin_unlock(&req_lock); 114 115 wake_up_process(thread); 116 wait_for_completion(&req->done); 117 118 kfree(tmp); 119 120 return req->err; 121 } 122 123 int devtmpfs_create_node(struct device *dev) 124 { 125 const char *tmp = NULL; 126 struct req req; 127 128 if (!thread) 129 return 0; 130 131 req.mode = 0; 132 req.uid = GLOBAL_ROOT_UID; 133 req.gid = GLOBAL_ROOT_GID; 134 req.name = device_get_devnode(dev, &req.mode, &req.uid, &req.gid, &tmp); 135 if (!req.name) 136 return -ENOMEM; 137 138 if (req.mode == 0) 139 req.mode = 0600; 140 if (is_blockdev(dev)) 141 req.mode |= S_IFBLK; 142 else 143 req.mode |= S_IFCHR; 144 145 req.dev = dev; 146 147 return devtmpfs_submit_req(&req, tmp); 148 } 149 150 int devtmpfs_delete_node(struct device *dev) 151 { 152 const char *tmp = NULL; 153 struct req req; 154 155 if (!thread) 156 return 0; 157 158 req.name = device_get_devnode(dev, NULL, NULL, NULL, &tmp); 159 if (!req.name) 160 return -ENOMEM; 161 162 req.mode = 0; 163 req.dev = dev; 164 165 return devtmpfs_submit_req(&req, tmp); 166 } 167 168 static int dev_mkdir(const char *name, umode_t mode) 169 { 170 struct dentry *dentry; 171 struct path path; 172 int err; 173 174 dentry = kern_path_create(AT_FDCWD, name, &path, LOOKUP_DIRECTORY); 175 if (IS_ERR(dentry)) 176 return PTR_ERR(dentry); 177 178 err = vfs_mkdir(&nop_mnt_idmap, d_inode(path.dentry), dentry, mode); 179 if (!err) 180 /* mark as kernel-created inode */ 181 d_inode(dentry)->i_private = &thread; 182 done_path_create(&path, dentry); 183 return err; 184 } 185 186 static int create_path(const char *nodepath) 187 { 188 char *path; 189 char *s; 190 int err = 0; 191 192 /* parent directories do not exist, create them */ 193 path = kstrdup(nodepath, GFP_KERNEL); 194 if (!path) 195 return -ENOMEM; 196 197 s = path; 198 for (;;) { 199 s = strchr(s, '/'); 200 if (!s) 201 break; 202 s[0] = '\0'; 203 err = dev_mkdir(path, 0755); 204 if (err && err != -EEXIST) 205 break; 206 s[0] = '/'; 207 s++; 208 } 209 kfree(path); 210 return err; 211 } 212 213 static int handle_create(const char *nodename, umode_t mode, kuid_t uid, 214 kgid_t gid, struct device *dev) 215 { 216 struct dentry *dentry; 217 struct path path; 218 int err; 219 220 dentry = kern_path_create(AT_FDCWD, nodename, &path, 0); 221 if (dentry == ERR_PTR(-ENOENT)) { 222 create_path(nodename); 223 dentry = kern_path_create(AT_FDCWD, nodename, &path, 0); 224 } 225 if (IS_ERR(dentry)) 226 return PTR_ERR(dentry); 227 228 err = vfs_mknod(&nop_mnt_idmap, d_inode(path.dentry), dentry, mode, 229 dev->devt); 230 if (!err) { 231 struct iattr newattrs; 232 233 newattrs.ia_mode = mode; 234 newattrs.ia_uid = uid; 235 newattrs.ia_gid = gid; 236 newattrs.ia_valid = ATTR_MODE|ATTR_UID|ATTR_GID; 237 inode_lock(d_inode(dentry)); 238 notify_change(&nop_mnt_idmap, dentry, &newattrs, NULL); 239 inode_unlock(d_inode(dentry)); 240 241 /* mark as kernel-created inode */ 242 d_inode(dentry)->i_private = &thread; 243 } 244 done_path_create(&path, dentry); 245 return err; 246 } 247 248 static int dev_rmdir(const char *name) 249 { 250 struct path parent; 251 struct dentry *dentry; 252 int err; 253 254 dentry = kern_path_locked(name, &parent); 255 if (IS_ERR(dentry)) 256 return PTR_ERR(dentry); 257 if (d_really_is_positive(dentry)) { 258 if (d_inode(dentry)->i_private == &thread) 259 err = vfs_rmdir(&nop_mnt_idmap, d_inode(parent.dentry), 260 dentry); 261 else 262 err = -EPERM; 263 } else { 264 err = -ENOENT; 265 } 266 dput(dentry); 267 inode_unlock(d_inode(parent.dentry)); 268 path_put(&parent); 269 return err; 270 } 271 272 static int delete_path(const char *nodepath) 273 { 274 char *path; 275 int err = 0; 276 277 path = kstrdup(nodepath, GFP_KERNEL); 278 if (!path) 279 return -ENOMEM; 280 281 for (;;) { 282 char *base; 283 284 base = strrchr(path, '/'); 285 if (!base) 286 break; 287 base[0] = '\0'; 288 err = dev_rmdir(path); 289 if (err) 290 break; 291 } 292 293 kfree(path); 294 return err; 295 } 296 297 static int dev_mynode(struct device *dev, struct inode *inode, struct kstat *stat) 298 { 299 /* did we create it */ 300 if (inode->i_private != &thread) 301 return 0; 302 303 /* does the dev_t match */ 304 if (is_blockdev(dev)) { 305 if (!S_ISBLK(stat->mode)) 306 return 0; 307 } else { 308 if (!S_ISCHR(stat->mode)) 309 return 0; 310 } 311 if (stat->rdev != dev->devt) 312 return 0; 313 314 /* ours */ 315 return 1; 316 } 317 318 static int handle_remove(const char *nodename, struct device *dev) 319 { 320 struct path parent; 321 struct dentry *dentry; 322 int deleted = 0; 323 int err; 324 325 dentry = kern_path_locked(nodename, &parent); 326 if (IS_ERR(dentry)) 327 return PTR_ERR(dentry); 328 329 if (d_really_is_positive(dentry)) { 330 struct kstat stat; 331 struct path p = {.mnt = parent.mnt, .dentry = dentry}; 332 err = vfs_getattr(&p, &stat, STATX_TYPE | STATX_MODE, 333 AT_STATX_SYNC_AS_STAT); 334 if (!err && dev_mynode(dev, d_inode(dentry), &stat)) { 335 struct iattr newattrs; 336 /* 337 * before unlinking this node, reset permissions 338 * of possible references like hardlinks 339 */ 340 newattrs.ia_uid = GLOBAL_ROOT_UID; 341 newattrs.ia_gid = GLOBAL_ROOT_GID; 342 newattrs.ia_mode = stat.mode & ~0777; 343 newattrs.ia_valid = 344 ATTR_UID|ATTR_GID|ATTR_MODE; 345 inode_lock(d_inode(dentry)); 346 notify_change(&nop_mnt_idmap, dentry, &newattrs, NULL); 347 inode_unlock(d_inode(dentry)); 348 err = vfs_unlink(&nop_mnt_idmap, d_inode(parent.dentry), 349 dentry, NULL); 350 if (!err || err == -ENOENT) 351 deleted = 1; 352 } 353 } else { 354 err = -ENOENT; 355 } 356 dput(dentry); 357 inode_unlock(d_inode(parent.dentry)); 358 359 path_put(&parent); 360 if (deleted && strchr(nodename, '/')) 361 delete_path(nodename); 362 return err; 363 } 364 365 /* 366 * If configured, or requested by the commandline, devtmpfs will be 367 * auto-mounted after the kernel mounted the root filesystem. 368 */ 369 int __init devtmpfs_mount(void) 370 { 371 int err; 372 373 if (!mount_dev) 374 return 0; 375 376 if (!thread) 377 return 0; 378 379 err = init_mount("devtmpfs", "dev", "devtmpfs", DEVTMPFS_MFLAGS, NULL); 380 if (err) 381 pr_info("error mounting %d\n", err); 382 else 383 pr_info("mounted\n"); 384 return err; 385 } 386 387 static __initdata DECLARE_COMPLETION(setup_done); 388 389 static int handle(const char *name, umode_t mode, kuid_t uid, kgid_t gid, 390 struct device *dev) 391 { 392 if (mode) 393 return handle_create(name, mode, uid, gid, dev); 394 else 395 return handle_remove(name, dev); 396 } 397 398 static void __noreturn devtmpfs_work_loop(void) 399 { 400 while (1) { 401 spin_lock(&req_lock); 402 while (requests) { 403 struct req *req = requests; 404 requests = NULL; 405 spin_unlock(&req_lock); 406 while (req) { 407 struct req *next = req->next; 408 req->err = handle(req->name, req->mode, 409 req->uid, req->gid, req->dev); 410 complete(&req->done); 411 req = next; 412 } 413 spin_lock(&req_lock); 414 } 415 __set_current_state(TASK_INTERRUPTIBLE); 416 spin_unlock(&req_lock); 417 schedule(); 418 } 419 } 420 421 static noinline int __init devtmpfs_setup(void *p) 422 { 423 int err; 424 425 err = ksys_unshare(CLONE_NEWNS); 426 if (err) 427 goto out; 428 err = init_mount("devtmpfs", "/", "devtmpfs", DEVTMPFS_MFLAGS, NULL); 429 if (err) 430 goto out; 431 init_chdir("/.."); /* will traverse into overmounted root */ 432 init_chroot("."); 433 out: 434 *(int *)p = err; 435 return err; 436 } 437 438 /* 439 * The __ref is because devtmpfs_setup needs to be __init for the routines it 440 * calls. That call is done while devtmpfs_init, which is marked __init, 441 * synchronously waits for it to complete. 442 */ 443 static int __ref devtmpfsd(void *p) 444 { 445 int err = devtmpfs_setup(p); 446 447 complete(&setup_done); 448 if (err) 449 return err; 450 devtmpfs_work_loop(); 451 return 0; 452 } 453 454 /* 455 * Create devtmpfs instance, driver-core devices will add their device 456 * nodes here. 457 */ 458 int __init devtmpfs_init(void) 459 { 460 char opts[] = "mode=0755"; 461 int err; 462 463 mnt = vfs_kern_mount(&internal_fs_type, 0, "devtmpfs", opts); 464 if (IS_ERR(mnt)) { 465 pr_err("unable to create devtmpfs %ld\n", PTR_ERR(mnt)); 466 return PTR_ERR(mnt); 467 } 468 err = register_filesystem(&dev_fs_type); 469 if (err) { 470 pr_err("unable to register devtmpfs type %d\n", err); 471 return err; 472 } 473 474 thread = kthread_run(devtmpfsd, &err, "kdevtmpfs"); 475 if (!IS_ERR(thread)) { 476 wait_for_completion(&setup_done); 477 } else { 478 err = PTR_ERR(thread); 479 thread = NULL; 480 } 481 482 if (err) { 483 pr_err("unable to create devtmpfs %d\n", err); 484 unregister_filesystem(&dev_fs_type); 485 thread = NULL; 486 return err; 487 } 488 489 pr_info("initialized\n"); 490 return 0; 491 } 492