1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright 2008 Red Hat, Inc. All rights reserved. 4 * Copyright 2008 Ian Kent <raven@themaw.net> 5 */ 6 7 #include <linux/module.h> 8 #include <linux/miscdevice.h> 9 #include <linux/compat.h> 10 #include <linux/fdtable.h> 11 #include <linux/magic.h> 12 #include <linux/nospec.h> 13 14 #include "autofs_i.h" 15 16 /* 17 * This module implements an interface for routing autofs ioctl control 18 * commands via a miscellaneous device file. 19 * 20 * The alternate interface is needed because we need to be able open 21 * an ioctl file descriptor on an autofs mount that may be covered by 22 * another mount. This situation arises when starting automount(8) 23 * or other user space daemon which uses direct mounts or offset 24 * mounts (used for autofs lazy mount/umount of nested mount trees), 25 * which have been left busy at service shutdown. 26 */ 27 28 typedef int (*ioctl_fn)(struct file *, struct autofs_sb_info *, 29 struct autofs_dev_ioctl *); 30 31 static int check_name(const char *name) 32 { 33 if (!strchr(name, '/')) 34 return -EINVAL; 35 return 0; 36 } 37 38 /* 39 * Check a string doesn't overrun the chunk of 40 * memory we copied from user land. 41 */ 42 static int invalid_str(char *str, size_t size) 43 { 44 if (memchr(str, 0, size)) 45 return 0; 46 return -EINVAL; 47 } 48 49 /* 50 * Check that the user compiled against correct version of autofs 51 * misc device code. 52 * 53 * As well as checking the version compatibility this always copies 54 * the kernel interface version out. 55 */ 56 static int check_dev_ioctl_version(int cmd, struct autofs_dev_ioctl *param) 57 { 58 int err = 0; 59 60 if ((param->ver_major != AUTOFS_DEV_IOCTL_VERSION_MAJOR) || 61 (param->ver_minor > AUTOFS_DEV_IOCTL_VERSION_MINOR)) { 62 pr_warn("ioctl control interface version mismatch: " 63 "kernel(%u.%u), user(%u.%u), cmd(0x%08x)\n", 64 AUTOFS_DEV_IOCTL_VERSION_MAJOR, 65 AUTOFS_DEV_IOCTL_VERSION_MINOR, 66 param->ver_major, param->ver_minor, cmd); 67 err = -EINVAL; 68 } 69 70 /* Fill in the kernel version. */ 71 param->ver_major = AUTOFS_DEV_IOCTL_VERSION_MAJOR; 72 param->ver_minor = AUTOFS_DEV_IOCTL_VERSION_MINOR; 73 74 return err; 75 } 76 77 /* 78 * Copy parameter control struct, including a possible path allocated 79 * at the end of the struct. 80 */ 81 static struct autofs_dev_ioctl * 82 copy_dev_ioctl(struct autofs_dev_ioctl __user *in) 83 { 84 struct autofs_dev_ioctl tmp, *res; 85 86 if (copy_from_user(&tmp, in, AUTOFS_DEV_IOCTL_SIZE)) 87 return ERR_PTR(-EFAULT); 88 89 if (tmp.size < AUTOFS_DEV_IOCTL_SIZE) 90 return ERR_PTR(-EINVAL); 91 92 if (tmp.size > AUTOFS_DEV_IOCTL_SIZE + PATH_MAX) 93 return ERR_PTR(-ENAMETOOLONG); 94 95 res = memdup_user(in, tmp.size); 96 if (!IS_ERR(res)) 97 res->size = tmp.size; 98 99 return res; 100 } 101 102 static inline void free_dev_ioctl(struct autofs_dev_ioctl *param) 103 { 104 kfree(param); 105 } 106 107 /* 108 * Check sanity of parameter control fields and if a path is present 109 * check that it is terminated and contains at least one "/". 110 */ 111 static int validate_dev_ioctl(int cmd, struct autofs_dev_ioctl *param) 112 { 113 unsigned int inr = _IOC_NR(cmd); 114 int err; 115 116 err = check_dev_ioctl_version(cmd, param); 117 if (err) { 118 pr_warn("invalid device control module version " 119 "supplied for cmd(0x%08x)\n", cmd); 120 goto out; 121 } 122 123 if (param->size > AUTOFS_DEV_IOCTL_SIZE) { 124 err = invalid_str(param->path, param->size - AUTOFS_DEV_IOCTL_SIZE); 125 if (err) { 126 pr_warn( 127 "path string terminator missing for cmd(0x%08x)\n", 128 cmd); 129 goto out; 130 } 131 132 /* Setting the per-dentry expire timeout requires a trailing 133 * path component, ie. no '/', so invert the logic of the 134 * check_name() return for AUTOFS_DEV_IOCTL_TIMEOUT_CMD. 135 */ 136 err = check_name(param->path); 137 if (inr == AUTOFS_DEV_IOCTL_TIMEOUT_CMD) 138 err = err ? 0 : -EINVAL; 139 if (err) { 140 pr_warn("invalid path supplied for cmd(0x%08x)\n", 141 cmd); 142 goto out; 143 } 144 } else { 145 if (inr == AUTOFS_DEV_IOCTL_OPENMOUNT_CMD || 146 inr == AUTOFS_DEV_IOCTL_REQUESTER_CMD || 147 inr == AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD) { 148 err = -EINVAL; 149 goto out; 150 } 151 } 152 153 err = 0; 154 out: 155 return err; 156 } 157 158 /* Return autofs dev ioctl version */ 159 static int autofs_dev_ioctl_version(struct file *fp, 160 struct autofs_sb_info *sbi, 161 struct autofs_dev_ioctl *param) 162 { 163 /* This should have already been set. */ 164 param->ver_major = AUTOFS_DEV_IOCTL_VERSION_MAJOR; 165 param->ver_minor = AUTOFS_DEV_IOCTL_VERSION_MINOR; 166 return 0; 167 } 168 169 /* Return autofs module protocol version */ 170 static int autofs_dev_ioctl_protover(struct file *fp, 171 struct autofs_sb_info *sbi, 172 struct autofs_dev_ioctl *param) 173 { 174 param->protover.version = sbi->version; 175 return 0; 176 } 177 178 /* Return autofs module protocol sub version */ 179 static int autofs_dev_ioctl_protosubver(struct file *fp, 180 struct autofs_sb_info *sbi, 181 struct autofs_dev_ioctl *param) 182 { 183 param->protosubver.sub_version = sbi->sub_version; 184 return 0; 185 } 186 187 /* Find the topmost mount satisfying test() */ 188 static int find_autofs_mount(const char *pathname, 189 struct path *res, 190 int test(const struct path *path, void *data), 191 void *data) 192 { 193 struct path path; 194 int err; 195 196 err = kern_path(pathname, LOOKUP_MOUNTPOINT, &path); 197 if (err) 198 return err; 199 err = -ENOENT; 200 while (path.dentry == path.mnt->mnt_root) { 201 if (path.dentry->d_sb->s_magic == AUTOFS_SUPER_MAGIC) { 202 if (test(&path, data)) { 203 path_get(&path); 204 *res = path; 205 err = 0; 206 break; 207 } 208 } 209 if (!follow_up(&path)) 210 break; 211 } 212 path_put(&path); 213 return err; 214 } 215 216 static int test_by_dev(const struct path *path, void *p) 217 { 218 return path->dentry->d_sb->s_dev == *(dev_t *)p; 219 } 220 221 static int test_by_type(const struct path *path, void *p) 222 { 223 struct autofs_info *ino = autofs_dentry_ino(path->dentry); 224 225 return ino && ino->sbi->type & *(unsigned *)p; 226 } 227 228 /* 229 * Open a file descriptor on the autofs mount point corresponding 230 * to the given path and device number (aka. new_encode_dev(sb->s_dev)). 231 */ 232 static int autofs_dev_ioctl_open_mountpoint(const char *name, dev_t devid) 233 { 234 struct path path __free(path_put) = {}; 235 int err; 236 237 err = find_autofs_mount(name, &path, test_by_dev, &devid); 238 if (err) 239 return err; 240 241 return FD_ADD(O_CLOEXEC, dentry_open(&path, O_RDONLY, current_cred())); 242 } 243 244 /* Open a file descriptor on an autofs mount point */ 245 static int autofs_dev_ioctl_openmount(struct file *fp, 246 struct autofs_sb_info *sbi, 247 struct autofs_dev_ioctl *param) 248 { 249 const char *path; 250 dev_t devid; 251 int err, fd; 252 253 /* param->path has been checked in validate_dev_ioctl() */ 254 255 if (!param->openmount.devid) 256 return -EINVAL; 257 258 param->ioctlfd = -1; 259 260 path = param->path; 261 devid = new_decode_dev(param->openmount.devid); 262 263 err = 0; 264 fd = autofs_dev_ioctl_open_mountpoint(path, devid); 265 if (unlikely(fd < 0)) { 266 err = fd; 267 goto out; 268 } 269 270 param->ioctlfd = fd; 271 out: 272 return err; 273 } 274 275 /* Close file descriptor allocated above (user can also use close(2)). */ 276 static int autofs_dev_ioctl_closemount(struct file *fp, 277 struct autofs_sb_info *sbi, 278 struct autofs_dev_ioctl *param) 279 { 280 return close_fd(param->ioctlfd); 281 } 282 283 /* 284 * Send "ready" status for an existing wait (either a mount or an expire 285 * request). 286 */ 287 static int autofs_dev_ioctl_ready(struct file *fp, 288 struct autofs_sb_info *sbi, 289 struct autofs_dev_ioctl *param) 290 { 291 autofs_wqt_t token; 292 293 token = (autofs_wqt_t) param->ready.token; 294 return autofs_wait_release(sbi, token, 0); 295 } 296 297 /* 298 * Send "fail" status for an existing wait (either a mount or an expire 299 * request). 300 */ 301 static int autofs_dev_ioctl_fail(struct file *fp, 302 struct autofs_sb_info *sbi, 303 struct autofs_dev_ioctl *param) 304 { 305 autofs_wqt_t token; 306 int status; 307 308 token = (autofs_wqt_t) param->fail.token; 309 status = param->fail.status < 0 ? param->fail.status : -ENOENT; 310 return autofs_wait_release(sbi, token, status); 311 } 312 313 /* 314 * Set the pipe fd for kernel communication to the daemon. 315 * 316 * Normally this is set at mount using an option but if we 317 * are reconnecting to a busy mount then we need to use this 318 * to tell the autofs mount about the new kernel pipe fd. In 319 * order to protect mounts against incorrectly setting the 320 * pipefd we also require that the autofs mount be catatonic. 321 * 322 * This also sets the process group id used to identify the 323 * controlling process (eg. the owning automount(8) daemon). 324 */ 325 static int autofs_dev_ioctl_setpipefd(struct file *fp, 326 struct autofs_sb_info *sbi, 327 struct autofs_dev_ioctl *param) 328 { 329 int pipefd; 330 int err = 0; 331 struct pid *new_pid = NULL; 332 333 if (param->setpipefd.pipefd == -1) 334 return -EINVAL; 335 336 pipefd = param->setpipefd.pipefd; 337 338 mutex_lock(&sbi->wq_mutex); 339 if (!(sbi->flags & AUTOFS_SBI_CATATONIC)) { 340 mutex_unlock(&sbi->wq_mutex); 341 return -EBUSY; 342 } else { 343 struct file *pipe; 344 345 new_pid = get_task_pid(current, PIDTYPE_PGID); 346 347 if (ns_of_pid(new_pid) != ns_of_pid(sbi->oz_pgrp)) { 348 pr_warn("not allowed to change PID namespace\n"); 349 err = -EINVAL; 350 goto out; 351 } 352 353 pipe = fget(pipefd); 354 if (!pipe) { 355 err = -EBADF; 356 goto out; 357 } 358 if (autofs_prepare_pipe(pipe) < 0) { 359 err = -EPIPE; 360 fput(pipe); 361 goto out; 362 } 363 swap(sbi->oz_pgrp, new_pid); 364 sbi->pipefd = pipefd; 365 sbi->pipe = pipe; 366 sbi->flags &= ~AUTOFS_SBI_CATATONIC; 367 } 368 out: 369 put_pid(new_pid); 370 mutex_unlock(&sbi->wq_mutex); 371 return err; 372 } 373 374 /* 375 * Make the autofs mount point catatonic, no longer responsive to 376 * mount requests. Also closes the kernel pipe file descriptor. 377 */ 378 static int autofs_dev_ioctl_catatonic(struct file *fp, 379 struct autofs_sb_info *sbi, 380 struct autofs_dev_ioctl *param) 381 { 382 autofs_catatonic_mode(sbi); 383 return 0; 384 } 385 386 /* 387 * Set the autofs mount expire timeout. 388 * 389 * There are two places an expire timeout can be set, in the autofs 390 * super block info. (this is all that's needed for direct and offset 391 * mounts because there's a distinct mount corresponding to each of 392 * these) and per-dentry within within the dentry info. If a per-dentry 393 * timeout is set it will override the expire timeout set in the parent 394 * autofs super block info. 395 * 396 * If setting the autofs super block expire timeout the autofs_dev_ioctl 397 * size field will be equal to the autofs_dev_ioctl structure size. If 398 * setting the per-dentry expire timeout the mount point name is passed 399 * in the autofs_dev_ioctl path field and the size field updated to 400 * reflect this. 401 * 402 * Setting the autofs mount expire timeout sets the timeout in the super 403 * block info. struct. Setting the per-dentry timeout does a little more. 404 * If the timeout is equal to -1 the per-dentry timeout (and flag) is 405 * cleared which reverts to using the super block timeout, otherwise if 406 * timeout is 0 the timeout is set to this value and the flag is left 407 * set which disables expiration for the mount point, lastly the flag 408 * and the timeout are set enabling the dentry to use this timeout. 409 */ 410 static int autofs_dev_ioctl_timeout(struct file *fp, 411 struct autofs_sb_info *sbi, 412 struct autofs_dev_ioctl *param) 413 { 414 unsigned long timeout = param->timeout.timeout; 415 416 /* If setting the expire timeout for an individual indirect 417 * mount point dentry the mount trailing component path is 418 * placed in param->path and param->size adjusted to account 419 * for it otherwise param->size it is set to the structure 420 * size. 421 */ 422 if (param->size == AUTOFS_DEV_IOCTL_SIZE) { 423 param->timeout.timeout = sbi->exp_timeout / HZ; 424 sbi->exp_timeout = timeout * HZ; 425 } else { 426 struct dentry *base = fp->f_path.dentry; 427 int path_len = param->size - AUTOFS_DEV_IOCTL_SIZE - 1; 428 struct dentry *dentry; 429 struct autofs_info *ino; 430 431 if (!autofs_type_indirect(sbi->type)) 432 return -EINVAL; 433 434 /* An expire timeout greater than the superblock timeout 435 * could be a problem at shutdown but the super block 436 * timeout itself can change so all we can really do is 437 * warn the user. 438 */ 439 if (timeout >= sbi->exp_timeout) 440 pr_warn("per-mount expire timeout is greater than " 441 "the parent autofs mount timeout which could " 442 "prevent shutdown\n"); 443 444 dentry = try_lookup_noperm(&QSTR_LEN(param->path, path_len), 445 base); 446 if (IS_ERR_OR_NULL(dentry)) 447 return dentry ? PTR_ERR(dentry) : -ENOENT; 448 ino = autofs_dentry_ino(dentry); 449 if (!ino) { 450 dput(dentry); 451 return -ENOENT; 452 } 453 454 if (ino->exp_timeout && ino->flags & AUTOFS_INF_EXPIRE_SET) 455 param->timeout.timeout = ino->exp_timeout / HZ; 456 else 457 param->timeout.timeout = sbi->exp_timeout / HZ; 458 459 if (timeout == -1) { 460 /* Revert to using the super block timeout */ 461 ino->flags &= ~AUTOFS_INF_EXPIRE_SET; 462 ino->exp_timeout = 0; 463 } else { 464 /* Set the dentry expire flag and timeout. 465 * 466 * If timeout is 0 it will prevent the expire 467 * of this particular automount. 468 */ 469 ino->flags |= AUTOFS_INF_EXPIRE_SET; 470 ino->exp_timeout = timeout * HZ; 471 } 472 dput(dentry); 473 } 474 475 return 0; 476 } 477 478 /* 479 * Return the uid and gid of the last request for the mount 480 * 481 * When reconstructing an autofs mount tree with active mounts 482 * we need to re-connect to mounts that may have used the original 483 * process uid and gid (or string variations of them) for mount 484 * lookups within the map entry. 485 */ 486 static int autofs_dev_ioctl_requester(struct file *fp, 487 struct autofs_sb_info *sbi, 488 struct autofs_dev_ioctl *param) 489 { 490 struct autofs_info *ino; 491 struct path path; 492 dev_t devid; 493 int err = -ENOENT; 494 495 /* param->path has been checked in validate_dev_ioctl() */ 496 497 devid = sbi->sb->s_dev; 498 499 param->requester.uid = param->requester.gid = -1; 500 501 err = find_autofs_mount(param->path, &path, test_by_dev, &devid); 502 if (err) 503 goto out; 504 505 ino = autofs_dentry_ino(path.dentry); 506 if (ino) { 507 err = 0; 508 autofs_expire_wait(&path, 0); 509 spin_lock(&sbi->fs_lock); 510 param->requester.uid = 511 from_kuid_munged(current_user_ns(), ino->uid); 512 param->requester.gid = 513 from_kgid_munged(current_user_ns(), ino->gid); 514 spin_unlock(&sbi->fs_lock); 515 } 516 path_put(&path); 517 out: 518 return err; 519 } 520 521 /* 522 * Call repeatedly until it returns -EAGAIN, meaning there's nothing 523 * more that can be done. 524 */ 525 static int autofs_dev_ioctl_expire(struct file *fp, 526 struct autofs_sb_info *sbi, 527 struct autofs_dev_ioctl *param) 528 { 529 struct vfsmount *mnt; 530 int how; 531 532 how = param->expire.how; 533 mnt = fp->f_path.mnt; 534 535 return autofs_do_expire_multi(sbi->sb, mnt, sbi, how); 536 } 537 538 /* Check if autofs mount point is in use */ 539 static int autofs_dev_ioctl_askumount(struct file *fp, 540 struct autofs_sb_info *sbi, 541 struct autofs_dev_ioctl *param) 542 { 543 param->askumount.may_umount = 0; 544 if (may_umount(fp->f_path.mnt)) 545 param->askumount.may_umount = 1; 546 return 0; 547 } 548 549 /* 550 * Check if the given path is a mountpoint. 551 * 552 * If we are supplied with the file descriptor of an autofs 553 * mount we're looking for a specific mount. In this case 554 * the path is considered a mountpoint if it is itself a 555 * mountpoint or contains a mount, such as a multi-mount 556 * without a root mount. In this case we return 1 if the 557 * path is a mount point and the super magic of the covering 558 * mount if there is one or 0 if it isn't a mountpoint. 559 * 560 * If we aren't supplied with a file descriptor then we 561 * lookup the path and check if it is the root of a mount. 562 * If a type is given we are looking for a particular autofs 563 * mount and if we don't find a match we return fail. If the 564 * located path is the root of a mount we return 1 along with 565 * the super magic of the mount or 0 otherwise. 566 * 567 * In both cases the device number (as returned by 568 * new_encode_dev()) is also returned. 569 */ 570 static int autofs_dev_ioctl_ismountpoint(struct file *fp, 571 struct autofs_sb_info *sbi, 572 struct autofs_dev_ioctl *param) 573 { 574 struct path path; 575 const char *name; 576 unsigned int type; 577 unsigned int devid, magic; 578 int err = -ENOENT; 579 580 /* param->path has been checked in validate_dev_ioctl() */ 581 582 name = param->path; 583 type = param->ismountpoint.in.type; 584 585 param->ismountpoint.out.devid = devid = 0; 586 param->ismountpoint.out.magic = magic = 0; 587 588 if (!fp || param->ioctlfd == -1) { 589 if (autofs_type_any(type)) 590 err = kern_path(name, LOOKUP_FOLLOW | LOOKUP_MOUNTPOINT, 591 &path); 592 else 593 err = find_autofs_mount(name, &path, 594 test_by_type, &type); 595 if (err) 596 goto out; 597 devid = new_encode_dev(path.dentry->d_sb->s_dev); 598 err = 0; 599 if (path.mnt->mnt_root == path.dentry) { 600 err = 1; 601 magic = path.dentry->d_sb->s_magic; 602 } 603 } else { 604 dev_t dev = sbi->sb->s_dev; 605 606 err = find_autofs_mount(name, &path, test_by_dev, &dev); 607 if (err) 608 goto out; 609 610 devid = new_encode_dev(dev); 611 612 err = path_has_submounts(&path); 613 614 if (follow_down_one(&path)) 615 magic = path.dentry->d_sb->s_magic; 616 } 617 618 param->ismountpoint.out.devid = devid; 619 param->ismountpoint.out.magic = magic; 620 path_put(&path); 621 out: 622 return err; 623 } 624 625 /* 626 * Our range of ioctl numbers isn't 0 based so we need to shift 627 * the array index by _IOC_NR(AUTOFS_CTL_IOC_FIRST) for the table 628 * lookup. 629 */ 630 #define cmd_idx(cmd) (cmd - _IOC_NR(AUTOFS_DEV_IOCTL_IOC_FIRST)) 631 632 static ioctl_fn lookup_dev_ioctl(unsigned int cmd) 633 { 634 static const ioctl_fn _ioctls[] = { 635 autofs_dev_ioctl_version, 636 autofs_dev_ioctl_protover, 637 autofs_dev_ioctl_protosubver, 638 autofs_dev_ioctl_openmount, 639 autofs_dev_ioctl_closemount, 640 autofs_dev_ioctl_ready, 641 autofs_dev_ioctl_fail, 642 autofs_dev_ioctl_setpipefd, 643 autofs_dev_ioctl_catatonic, 644 autofs_dev_ioctl_timeout, 645 autofs_dev_ioctl_requester, 646 autofs_dev_ioctl_expire, 647 autofs_dev_ioctl_askumount, 648 autofs_dev_ioctl_ismountpoint, 649 }; 650 unsigned int idx = cmd_idx(cmd); 651 652 if (idx >= ARRAY_SIZE(_ioctls)) 653 return NULL; 654 idx = array_index_nospec(idx, ARRAY_SIZE(_ioctls)); 655 return _ioctls[idx]; 656 } 657 658 /* ioctl dispatcher */ 659 static int _autofs_dev_ioctl(unsigned int command, 660 struct autofs_dev_ioctl __user *user) 661 { 662 struct autofs_dev_ioctl *param; 663 struct file *fp; 664 struct autofs_sb_info *sbi; 665 unsigned int cmd_first, cmd; 666 ioctl_fn fn = NULL; 667 int err = 0; 668 669 cmd_first = _IOC_NR(AUTOFS_DEV_IOCTL_IOC_FIRST); 670 cmd = _IOC_NR(command); 671 672 if (_IOC_TYPE(command) != _IOC_TYPE(AUTOFS_DEV_IOCTL_IOC_FIRST) || 673 cmd - cmd_first > AUTOFS_DEV_IOCTL_IOC_COUNT) { 674 return -ENOTTY; 675 } 676 677 /* Only root can use ioctls other than AUTOFS_DEV_IOCTL_VERSION_CMD 678 * and AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD 679 */ 680 if (cmd != AUTOFS_DEV_IOCTL_VERSION_CMD && 681 cmd != AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD && 682 !capable(CAP_SYS_ADMIN)) 683 return -EPERM; 684 685 /* Copy the parameters into kernel space. */ 686 param = copy_dev_ioctl(user); 687 if (IS_ERR(param)) 688 return PTR_ERR(param); 689 690 err = validate_dev_ioctl(command, param); 691 if (err) 692 goto out; 693 694 fn = lookup_dev_ioctl(cmd); 695 if (!fn) { 696 pr_warn("unknown command 0x%08x\n", command); 697 err = -ENOTTY; 698 goto out; 699 } 700 701 fp = NULL; 702 sbi = NULL; 703 704 /* 705 * For obvious reasons the openmount can't have a file 706 * descriptor yet. We don't take a reference to the 707 * file during close to allow for immediate release, 708 * and the same for retrieving ioctl version. 709 */ 710 if (cmd != AUTOFS_DEV_IOCTL_VERSION_CMD && 711 cmd != AUTOFS_DEV_IOCTL_OPENMOUNT_CMD && 712 cmd != AUTOFS_DEV_IOCTL_CLOSEMOUNT_CMD) { 713 struct super_block *sb; 714 715 fp = fget(param->ioctlfd); 716 if (!fp) { 717 if (cmd == AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD) 718 goto cont; 719 err = -EBADF; 720 goto out; 721 } 722 723 sb = file_inode(fp)->i_sb; 724 if (sb->s_type != &autofs_fs_type) { 725 err = -EINVAL; 726 fput(fp); 727 goto out; 728 } 729 sbi = autofs_sbi(sb); 730 731 /* 732 * Admin needs to be able to set the mount catatonic in 733 * order to be able to perform the re-open. 734 */ 735 if (!autofs_oz_mode(sbi) && 736 cmd != AUTOFS_DEV_IOCTL_CATATONIC_CMD) { 737 err = -EACCES; 738 fput(fp); 739 goto out; 740 } 741 } 742 cont: 743 err = fn(fp, sbi, param); 744 745 if (fp) 746 fput(fp); 747 if (err >= 0 && copy_to_user(user, param, AUTOFS_DEV_IOCTL_SIZE)) 748 err = -EFAULT; 749 out: 750 free_dev_ioctl(param); 751 return err; 752 } 753 754 static long autofs_dev_ioctl(struct file *file, unsigned int command, 755 unsigned long u) 756 { 757 int err; 758 759 err = _autofs_dev_ioctl(command, (struct autofs_dev_ioctl __user *) u); 760 return (long) err; 761 } 762 763 #ifdef CONFIG_COMPAT 764 static long autofs_dev_ioctl_compat(struct file *file, unsigned int command, 765 unsigned long u) 766 { 767 return autofs_dev_ioctl(file, command, (unsigned long) compat_ptr(u)); 768 } 769 #else 770 #define autofs_dev_ioctl_compat NULL 771 #endif 772 773 static const struct file_operations _dev_ioctl_fops = { 774 .unlocked_ioctl = autofs_dev_ioctl, 775 .compat_ioctl = autofs_dev_ioctl_compat, 776 .owner = THIS_MODULE, 777 .llseek = noop_llseek, 778 }; 779 780 static struct miscdevice _autofs_dev_ioctl_misc = { 781 .minor = AUTOFS_MINOR, 782 .name = AUTOFS_DEVICE_NAME, 783 .fops = &_dev_ioctl_fops, 784 .mode = 0644, 785 }; 786 787 MODULE_ALIAS_MISCDEV(AUTOFS_MINOR); 788 MODULE_ALIAS("devname:autofs"); 789 790 /* Register/deregister misc character device */ 791 int __init autofs_dev_ioctl_init(void) 792 { 793 int r; 794 795 r = misc_register(&_autofs_dev_ioctl_misc); 796 if (r) { 797 pr_err("misc_register failed for control device\n"); 798 return r; 799 } 800 801 return 0; 802 } 803 804 void autofs_dev_ioctl_exit(void) 805 { 806 misc_deregister(&_autofs_dev_ioctl_misc); 807 } 808