1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright 2008 Red Hat, Inc. All rights reserved. 4 * Copyright 2008 Ian Kent <raven@themaw.net> 5 */ 6 7 #include <linux/module.h> 8 #include <linux/miscdevice.h> 9 #include <linux/compat.h> 10 #include <linux/fdtable.h> 11 #include <linux/magic.h> 12 #include <linux/nospec.h> 13 14 #include "autofs_i.h" 15 16 /* 17 * This module implements an interface for routing autofs ioctl control 18 * commands via a miscellaneous device file. 19 * 20 * The alternate interface is needed because we need to be able open 21 * an ioctl file descriptor on an autofs mount that may be covered by 22 * another mount. This situation arises when starting automount(8) 23 * or other user space daemon which uses direct mounts or offset 24 * mounts (used for autofs lazy mount/umount of nested mount trees), 25 * which have been left busy at service shutdown. 26 */ 27 28 typedef int (*ioctl_fn)(struct file *, struct autofs_sb_info *, 29 struct autofs_dev_ioctl *); 30 31 static int check_name(const char *name) 32 { 33 if (!strchr(name, '/')) 34 return -EINVAL; 35 return 0; 36 } 37 38 /* 39 * Check a string doesn't overrun the chunk of 40 * memory we copied from user land. 41 */ 42 static int invalid_str(char *str, size_t size) 43 { 44 if (memchr(str, 0, size)) 45 return 0; 46 return -EINVAL; 47 } 48 49 /* 50 * Check that the user compiled against correct version of autofs 51 * misc device code. 52 * 53 * As well as checking the version compatibility this always copies 54 * the kernel interface version out. 55 */ 56 static int check_dev_ioctl_version(int cmd, struct autofs_dev_ioctl *param) 57 { 58 int err = 0; 59 60 if ((param->ver_major != AUTOFS_DEV_IOCTL_VERSION_MAJOR) || 61 (param->ver_minor > AUTOFS_DEV_IOCTL_VERSION_MINOR)) { 62 pr_warn("ioctl control interface version mismatch: " 63 "kernel(%u.%u), user(%u.%u), cmd(0x%08x)\n", 64 AUTOFS_DEV_IOCTL_VERSION_MAJOR, 65 AUTOFS_DEV_IOCTL_VERSION_MINOR, 66 param->ver_major, param->ver_minor, cmd); 67 err = -EINVAL; 68 } 69 70 /* Fill in the kernel version. */ 71 param->ver_major = AUTOFS_DEV_IOCTL_VERSION_MAJOR; 72 param->ver_minor = AUTOFS_DEV_IOCTL_VERSION_MINOR; 73 74 return err; 75 } 76 77 /* 78 * Copy parameter control struct, including a possible path allocated 79 * at the end of the struct. 80 */ 81 static struct autofs_dev_ioctl * 82 copy_dev_ioctl(struct autofs_dev_ioctl __user *in) 83 { 84 struct autofs_dev_ioctl tmp, *res; 85 86 if (copy_from_user(&tmp, in, AUTOFS_DEV_IOCTL_SIZE)) 87 return ERR_PTR(-EFAULT); 88 89 if (tmp.size < AUTOFS_DEV_IOCTL_SIZE) 90 return ERR_PTR(-EINVAL); 91 92 if (tmp.size > AUTOFS_DEV_IOCTL_SIZE + PATH_MAX) 93 return ERR_PTR(-ENAMETOOLONG); 94 95 res = memdup_user(in, tmp.size); 96 if (!IS_ERR(res)) 97 res->size = tmp.size; 98 99 return res; 100 } 101 102 static inline void free_dev_ioctl(struct autofs_dev_ioctl *param) 103 { 104 kfree(param); 105 } 106 107 /* 108 * Check sanity of parameter control fields and if a path is present 109 * check that it is terminated and contains at least one "/". 110 */ 111 static int validate_dev_ioctl(int cmd, struct autofs_dev_ioctl *param) 112 { 113 unsigned int inr = _IOC_NR(cmd); 114 int err; 115 116 err = check_dev_ioctl_version(cmd, param); 117 if (err) { 118 pr_warn("invalid device control module version " 119 "supplied for cmd(0x%08x)\n", cmd); 120 goto out; 121 } 122 123 if (param->size > AUTOFS_DEV_IOCTL_SIZE) { 124 err = invalid_str(param->path, param->size - AUTOFS_DEV_IOCTL_SIZE); 125 if (err) { 126 pr_warn( 127 "path string terminator missing for cmd(0x%08x)\n", 128 cmd); 129 goto out; 130 } 131 132 /* Setting the per-dentry expire timeout requires a trailing 133 * path component, ie. no '/', so invert the logic of the 134 * check_name() return for AUTOFS_DEV_IOCTL_TIMEOUT_CMD. 135 */ 136 err = check_name(param->path); 137 if (inr == AUTOFS_DEV_IOCTL_TIMEOUT_CMD) 138 err = err ? 0 : -EINVAL; 139 if (err) { 140 pr_warn("invalid path supplied for cmd(0x%08x)\n", 141 cmd); 142 goto out; 143 } 144 } else { 145 if (inr == AUTOFS_DEV_IOCTL_OPENMOUNT_CMD || 146 inr == AUTOFS_DEV_IOCTL_REQUESTER_CMD || 147 inr == AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD) { 148 err = -EINVAL; 149 goto out; 150 } 151 } 152 153 err = 0; 154 out: 155 return err; 156 } 157 158 /* Return autofs dev ioctl version */ 159 static int autofs_dev_ioctl_version(struct file *fp, 160 struct autofs_sb_info *sbi, 161 struct autofs_dev_ioctl *param) 162 { 163 /* This should have already been set. */ 164 param->ver_major = AUTOFS_DEV_IOCTL_VERSION_MAJOR; 165 param->ver_minor = AUTOFS_DEV_IOCTL_VERSION_MINOR; 166 return 0; 167 } 168 169 /* Return autofs module protocol version */ 170 static int autofs_dev_ioctl_protover(struct file *fp, 171 struct autofs_sb_info *sbi, 172 struct autofs_dev_ioctl *param) 173 { 174 param->protover.version = sbi->version; 175 return 0; 176 } 177 178 /* Return autofs module protocol sub version */ 179 static int autofs_dev_ioctl_protosubver(struct file *fp, 180 struct autofs_sb_info *sbi, 181 struct autofs_dev_ioctl *param) 182 { 183 param->protosubver.sub_version = sbi->sub_version; 184 return 0; 185 } 186 187 /* Find the topmost mount satisfying test() */ 188 static int find_autofs_mount(const char *pathname, 189 struct path *res, 190 int test(const struct path *path, void *data), 191 void *data) 192 { 193 struct path path; 194 int err; 195 196 err = kern_path(pathname, LOOKUP_MOUNTPOINT, &path); 197 if (err) 198 return err; 199 err = -ENOENT; 200 while (path.dentry == path.mnt->mnt_root) { 201 if (path.dentry->d_sb->s_magic == AUTOFS_SUPER_MAGIC) { 202 if (test(&path, data)) { 203 path_get(&path); 204 *res = path; 205 err = 0; 206 break; 207 } 208 } 209 if (!follow_up(&path)) 210 break; 211 } 212 path_put(&path); 213 return err; 214 } 215 216 static int test_by_dev(const struct path *path, void *p) 217 { 218 return path->dentry->d_sb->s_dev == *(dev_t *)p; 219 } 220 221 static int test_by_type(const struct path *path, void *p) 222 { 223 struct autofs_info *ino = autofs_dentry_ino(path->dentry); 224 225 return ino && ino->sbi->type & *(unsigned *)p; 226 } 227 228 /* 229 * Open a file descriptor on the autofs mount point corresponding 230 * to the given path and device number (aka. new_encode_dev(sb->s_dev)). 231 */ 232 static int autofs_dev_ioctl_open_mountpoint(const char *name, dev_t devid) 233 { 234 struct path path __free(path_put) = {}; 235 int err; 236 237 err = find_autofs_mount(name, &path, test_by_dev, &devid); 238 if (err) 239 return err; 240 241 return FD_ADD(O_CLOEXEC, dentry_open(&path, O_RDONLY, current_cred())); 242 } 243 244 /* Open a file descriptor on an autofs mount point */ 245 static int autofs_dev_ioctl_openmount(struct file *fp, 246 struct autofs_sb_info *sbi, 247 struct autofs_dev_ioctl *param) 248 { 249 const char *path; 250 dev_t devid; 251 int err, fd; 252 253 /* param->path has been checked in validate_dev_ioctl() */ 254 255 if (!param->openmount.devid) 256 return -EINVAL; 257 258 param->ioctlfd = -1; 259 260 path = param->path; 261 devid = new_decode_dev(param->openmount.devid); 262 263 err = 0; 264 fd = autofs_dev_ioctl_open_mountpoint(path, devid); 265 if (unlikely(fd < 0)) { 266 err = fd; 267 goto out; 268 } 269 270 param->ioctlfd = fd; 271 out: 272 return err; 273 } 274 275 /* Close file descriptor allocated above (user can also use close(2)). */ 276 static int autofs_dev_ioctl_closemount(struct file *fp, 277 struct autofs_sb_info *sbi, 278 struct autofs_dev_ioctl *param) 279 { 280 return close_fd(param->ioctlfd); 281 } 282 283 /* 284 * Send "ready" status for an existing wait (either a mount or an expire 285 * request). 286 */ 287 static int autofs_dev_ioctl_ready(struct file *fp, 288 struct autofs_sb_info *sbi, 289 struct autofs_dev_ioctl *param) 290 { 291 autofs_wqt_t token; 292 293 token = (autofs_wqt_t) param->ready.token; 294 return autofs_wait_release(sbi, token, 0); 295 } 296 297 /* 298 * Send "fail" status for an existing wait (either a mount or an expire 299 * request). 300 */ 301 static int autofs_dev_ioctl_fail(struct file *fp, 302 struct autofs_sb_info *sbi, 303 struct autofs_dev_ioctl *param) 304 { 305 autofs_wqt_t token; 306 int status; 307 308 token = (autofs_wqt_t) param->fail.token; 309 status = param->fail.status < 0 ? param->fail.status : -ENOENT; 310 return autofs_wait_release(sbi, token, status); 311 } 312 313 /* 314 * Set the pipe fd for kernel communication to the daemon. 315 * 316 * Normally this is set at mount using an option but if we 317 * are reconnecting to a busy mount then we need to use this 318 * to tell the autofs mount about the new kernel pipe fd. In 319 * order to protect mounts against incorrectly setting the 320 * pipefd we also require that the autofs mount be catatonic. 321 * 322 * This also sets the process group id used to identify the 323 * controlling process (eg. the owning automount(8) daemon). 324 */ 325 static int autofs_dev_ioctl_setpipefd(struct file *fp, 326 struct autofs_sb_info *sbi, 327 struct autofs_dev_ioctl *param) 328 { 329 int pipefd; 330 int err = 0; 331 struct pid *new_pid = NULL; 332 333 if (param->setpipefd.pipefd == -1) 334 return -EINVAL; 335 336 pipefd = param->setpipefd.pipefd; 337 338 mutex_lock(&sbi->wq_mutex); 339 if (!(sbi->flags & AUTOFS_SBI_CATATONIC)) { 340 mutex_unlock(&sbi->wq_mutex); 341 return -EBUSY; 342 } else { 343 struct file *pipe; 344 345 new_pid = get_task_pid(current, PIDTYPE_PGID); 346 347 if (ns_of_pid(new_pid) != ns_of_pid(sbi->oz_pgrp)) { 348 pr_warn("not allowed to change PID namespace\n"); 349 err = -EINVAL; 350 goto out; 351 } 352 353 pipe = fget(pipefd); 354 if (!pipe) { 355 err = -EBADF; 356 goto out; 357 } 358 if (autofs_prepare_pipe(pipe) < 0) { 359 err = -EPIPE; 360 fput(pipe); 361 goto out; 362 } 363 swap(sbi->oz_pgrp, new_pid); 364 sbi->pipefd = pipefd; 365 sbi->pipe = pipe; 366 sbi->mnt_ns_id = to_ns_common(current->nsproxy->mnt_ns)->ns_id; 367 sbi->flags &= ~AUTOFS_SBI_CATATONIC; 368 } 369 out: 370 put_pid(new_pid); 371 mutex_unlock(&sbi->wq_mutex); 372 return err; 373 } 374 375 /* 376 * Make the autofs mount point catatonic, no longer responsive to 377 * mount requests. Also closes the kernel pipe file descriptor. 378 */ 379 static int autofs_dev_ioctl_catatonic(struct file *fp, 380 struct autofs_sb_info *sbi, 381 struct autofs_dev_ioctl *param) 382 { 383 autofs_catatonic_mode(sbi); 384 return 0; 385 } 386 387 /* 388 * Set the autofs mount expire timeout. 389 * 390 * There are two places an expire timeout can be set, in the autofs 391 * super block info. (this is all that's needed for direct and offset 392 * mounts because there's a distinct mount corresponding to each of 393 * these) and per-dentry within within the dentry info. If a per-dentry 394 * timeout is set it will override the expire timeout set in the parent 395 * autofs super block info. 396 * 397 * If setting the autofs super block expire timeout the autofs_dev_ioctl 398 * size field will be equal to the autofs_dev_ioctl structure size. If 399 * setting the per-dentry expire timeout the mount point name is passed 400 * in the autofs_dev_ioctl path field and the size field updated to 401 * reflect this. 402 * 403 * Setting the autofs mount expire timeout sets the timeout in the super 404 * block info. struct. Setting the per-dentry timeout does a little more. 405 * If the timeout is equal to -1 the per-dentry timeout (and flag) is 406 * cleared which reverts to using the super block timeout, otherwise if 407 * timeout is 0 the timeout is set to this value and the flag is left 408 * set which disables expiration for the mount point, lastly the flag 409 * and the timeout are set enabling the dentry to use this timeout. 410 */ 411 static int autofs_dev_ioctl_timeout(struct file *fp, 412 struct autofs_sb_info *sbi, 413 struct autofs_dev_ioctl *param) 414 { 415 unsigned long timeout = param->timeout.timeout; 416 417 /* If setting the expire timeout for an individual indirect 418 * mount point dentry the mount trailing component path is 419 * placed in param->path and param->size adjusted to account 420 * for it otherwise param->size it is set to the structure 421 * size. 422 */ 423 if (param->size == AUTOFS_DEV_IOCTL_SIZE) { 424 param->timeout.timeout = sbi->exp_timeout / HZ; 425 sbi->exp_timeout = timeout * HZ; 426 } else { 427 struct dentry *base = fp->f_path.dentry; 428 int path_len = param->size - AUTOFS_DEV_IOCTL_SIZE - 1; 429 struct dentry *dentry; 430 struct autofs_info *ino; 431 432 if (!autofs_type_indirect(sbi->type)) 433 return -EINVAL; 434 435 /* An expire timeout greater than the superblock timeout 436 * could be a problem at shutdown but the super block 437 * timeout itself can change so all we can really do is 438 * warn the user. 439 */ 440 if (timeout >= sbi->exp_timeout) 441 pr_warn("per-mount expire timeout is greater than " 442 "the parent autofs mount timeout which could " 443 "prevent shutdown\n"); 444 445 dentry = try_lookup_noperm(&QSTR_LEN(param->path, path_len), 446 base); 447 if (IS_ERR_OR_NULL(dentry)) 448 return dentry ? PTR_ERR(dentry) : -ENOENT; 449 ino = autofs_dentry_ino(dentry); 450 if (!ino) { 451 dput(dentry); 452 return -ENOENT; 453 } 454 455 if (ino->exp_timeout && ino->flags & AUTOFS_INF_EXPIRE_SET) 456 param->timeout.timeout = ino->exp_timeout / HZ; 457 else 458 param->timeout.timeout = sbi->exp_timeout / HZ; 459 460 if (timeout == -1) { 461 /* Revert to using the super block timeout */ 462 ino->flags &= ~AUTOFS_INF_EXPIRE_SET; 463 ino->exp_timeout = 0; 464 } else { 465 /* Set the dentry expire flag and timeout. 466 * 467 * If timeout is 0 it will prevent the expire 468 * of this particular automount. 469 */ 470 ino->flags |= AUTOFS_INF_EXPIRE_SET; 471 ino->exp_timeout = timeout * HZ; 472 } 473 dput(dentry); 474 } 475 476 return 0; 477 } 478 479 /* 480 * Return the uid and gid of the last request for the mount 481 * 482 * When reconstructing an autofs mount tree with active mounts 483 * we need to re-connect to mounts that may have used the original 484 * process uid and gid (or string variations of them) for mount 485 * lookups within the map entry. 486 */ 487 static int autofs_dev_ioctl_requester(struct file *fp, 488 struct autofs_sb_info *sbi, 489 struct autofs_dev_ioctl *param) 490 { 491 struct autofs_info *ino; 492 struct path path; 493 dev_t devid; 494 int err = -ENOENT; 495 496 /* param->path has been checked in validate_dev_ioctl() */ 497 498 devid = sbi->sb->s_dev; 499 500 param->requester.uid = param->requester.gid = -1; 501 502 err = find_autofs_mount(param->path, &path, test_by_dev, &devid); 503 if (err) 504 goto out; 505 506 ino = autofs_dentry_ino(path.dentry); 507 if (ino) { 508 err = 0; 509 autofs_expire_wait(&path, 0); 510 spin_lock(&sbi->fs_lock); 511 param->requester.uid = 512 from_kuid_munged(current_user_ns(), ino->uid); 513 param->requester.gid = 514 from_kgid_munged(current_user_ns(), ino->gid); 515 spin_unlock(&sbi->fs_lock); 516 } 517 path_put(&path); 518 out: 519 return err; 520 } 521 522 /* 523 * Call repeatedly until it returns -EAGAIN, meaning there's nothing 524 * more that can be done. 525 */ 526 static int autofs_dev_ioctl_expire(struct file *fp, 527 struct autofs_sb_info *sbi, 528 struct autofs_dev_ioctl *param) 529 { 530 struct vfsmount *mnt; 531 int how; 532 533 how = param->expire.how; 534 mnt = fp->f_path.mnt; 535 536 return autofs_do_expire_multi(sbi->sb, mnt, sbi, how); 537 } 538 539 /* Check if autofs mount point is in use */ 540 static int autofs_dev_ioctl_askumount(struct file *fp, 541 struct autofs_sb_info *sbi, 542 struct autofs_dev_ioctl *param) 543 { 544 param->askumount.may_umount = 0; 545 if (may_umount(fp->f_path.mnt)) 546 param->askumount.may_umount = 1; 547 return 0; 548 } 549 550 /* 551 * Check if the given path is a mountpoint. 552 * 553 * If we are supplied with the file descriptor of an autofs 554 * mount we're looking for a specific mount. In this case 555 * the path is considered a mountpoint if it is itself a 556 * mountpoint or contains a mount, such as a multi-mount 557 * without a root mount. In this case we return 1 if the 558 * path is a mount point and the super magic of the covering 559 * mount if there is one or 0 if it isn't a mountpoint. 560 * 561 * If we aren't supplied with a file descriptor then we 562 * lookup the path and check if it is the root of a mount. 563 * If a type is given we are looking for a particular autofs 564 * mount and if we don't find a match we return fail. If the 565 * located path is the root of a mount we return 1 along with 566 * the super magic of the mount or 0 otherwise. 567 * 568 * In both cases the device number (as returned by 569 * new_encode_dev()) is also returned. 570 */ 571 static int autofs_dev_ioctl_ismountpoint(struct file *fp, 572 struct autofs_sb_info *sbi, 573 struct autofs_dev_ioctl *param) 574 { 575 struct path path; 576 const char *name; 577 unsigned int type; 578 unsigned int devid, magic; 579 int err = -ENOENT; 580 581 /* param->path has been checked in validate_dev_ioctl() */ 582 583 name = param->path; 584 type = param->ismountpoint.in.type; 585 586 param->ismountpoint.out.devid = devid = 0; 587 param->ismountpoint.out.magic = magic = 0; 588 589 if (!fp || param->ioctlfd == -1) { 590 if (autofs_type_any(type)) 591 err = kern_path(name, LOOKUP_FOLLOW | LOOKUP_MOUNTPOINT, 592 &path); 593 else 594 err = find_autofs_mount(name, &path, 595 test_by_type, &type); 596 if (err) 597 goto out; 598 devid = new_encode_dev(path.dentry->d_sb->s_dev); 599 err = 0; 600 if (path.mnt->mnt_root == path.dentry) { 601 err = 1; 602 magic = path.dentry->d_sb->s_magic; 603 } 604 } else { 605 dev_t dev = sbi->sb->s_dev; 606 607 err = find_autofs_mount(name, &path, test_by_dev, &dev); 608 if (err) 609 goto out; 610 611 devid = new_encode_dev(dev); 612 613 err = path_has_submounts(&path); 614 615 if (follow_down_one(&path)) 616 magic = path.dentry->d_sb->s_magic; 617 } 618 619 param->ismountpoint.out.devid = devid; 620 param->ismountpoint.out.magic = magic; 621 path_put(&path); 622 out: 623 return err; 624 } 625 626 /* 627 * Our range of ioctl numbers isn't 0 based so we need to shift 628 * the array index by _IOC_NR(AUTOFS_CTL_IOC_FIRST) for the table 629 * lookup. 630 */ 631 #define cmd_idx(cmd) (cmd - _IOC_NR(AUTOFS_DEV_IOCTL_IOC_FIRST)) 632 633 static ioctl_fn lookup_dev_ioctl(unsigned int cmd) 634 { 635 static const ioctl_fn _ioctls[] = { 636 autofs_dev_ioctl_version, 637 autofs_dev_ioctl_protover, 638 autofs_dev_ioctl_protosubver, 639 autofs_dev_ioctl_openmount, 640 autofs_dev_ioctl_closemount, 641 autofs_dev_ioctl_ready, 642 autofs_dev_ioctl_fail, 643 autofs_dev_ioctl_setpipefd, 644 autofs_dev_ioctl_catatonic, 645 autofs_dev_ioctl_timeout, 646 autofs_dev_ioctl_requester, 647 autofs_dev_ioctl_expire, 648 autofs_dev_ioctl_askumount, 649 autofs_dev_ioctl_ismountpoint, 650 }; 651 unsigned int idx = cmd_idx(cmd); 652 653 if (idx >= ARRAY_SIZE(_ioctls)) 654 return NULL; 655 idx = array_index_nospec(idx, ARRAY_SIZE(_ioctls)); 656 return _ioctls[idx]; 657 } 658 659 /* ioctl dispatcher */ 660 static int _autofs_dev_ioctl(unsigned int command, 661 struct autofs_dev_ioctl __user *user) 662 { 663 struct autofs_dev_ioctl *param; 664 struct file *fp; 665 struct autofs_sb_info *sbi; 666 unsigned int cmd_first, cmd; 667 ioctl_fn fn = NULL; 668 int err = 0; 669 670 cmd_first = _IOC_NR(AUTOFS_DEV_IOCTL_IOC_FIRST); 671 cmd = _IOC_NR(command); 672 673 if (_IOC_TYPE(command) != _IOC_TYPE(AUTOFS_DEV_IOCTL_IOC_FIRST) || 674 cmd - cmd_first > AUTOFS_DEV_IOCTL_IOC_COUNT) { 675 return -ENOTTY; 676 } 677 678 /* Only root can use ioctls other than AUTOFS_DEV_IOCTL_VERSION_CMD 679 * and AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD 680 */ 681 if (cmd != AUTOFS_DEV_IOCTL_VERSION_CMD && 682 cmd != AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD && 683 !capable(CAP_SYS_ADMIN)) 684 return -EPERM; 685 686 /* Copy the parameters into kernel space. */ 687 param = copy_dev_ioctl(user); 688 if (IS_ERR(param)) 689 return PTR_ERR(param); 690 691 err = validate_dev_ioctl(command, param); 692 if (err) 693 goto out; 694 695 fn = lookup_dev_ioctl(cmd); 696 if (!fn) { 697 pr_warn("unknown command 0x%08x\n", command); 698 err = -ENOTTY; 699 goto out; 700 } 701 702 fp = NULL; 703 sbi = NULL; 704 705 /* 706 * For obvious reasons the openmount can't have a file 707 * descriptor yet. We don't take a reference to the 708 * file during close to allow for immediate release, 709 * and the same for retrieving ioctl version. 710 */ 711 if (cmd != AUTOFS_DEV_IOCTL_VERSION_CMD && 712 cmd != AUTOFS_DEV_IOCTL_OPENMOUNT_CMD && 713 cmd != AUTOFS_DEV_IOCTL_CLOSEMOUNT_CMD) { 714 struct super_block *sb; 715 716 fp = fget(param->ioctlfd); 717 if (!fp) { 718 if (cmd == AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD) 719 goto cont; 720 err = -EBADF; 721 goto out; 722 } 723 724 sb = file_inode(fp)->i_sb; 725 if (sb->s_type != &autofs_fs_type) { 726 err = -EINVAL; 727 fput(fp); 728 goto out; 729 } 730 sbi = autofs_sbi(sb); 731 732 /* 733 * Admin needs to be able to set the mount catatonic in 734 * order to be able to perform the re-open. 735 */ 736 if (!autofs_oz_mode(sbi) && 737 cmd != AUTOFS_DEV_IOCTL_CATATONIC_CMD) { 738 err = -EACCES; 739 fput(fp); 740 goto out; 741 } 742 } 743 cont: 744 err = fn(fp, sbi, param); 745 746 if (fp) 747 fput(fp); 748 if (err >= 0 && copy_to_user(user, param, AUTOFS_DEV_IOCTL_SIZE)) 749 err = -EFAULT; 750 out: 751 free_dev_ioctl(param); 752 return err; 753 } 754 755 static long autofs_dev_ioctl(struct file *file, unsigned int command, 756 unsigned long u) 757 { 758 int err; 759 760 err = _autofs_dev_ioctl(command, (struct autofs_dev_ioctl __user *) u); 761 return (long) err; 762 } 763 764 #ifdef CONFIG_COMPAT 765 static long autofs_dev_ioctl_compat(struct file *file, unsigned int command, 766 unsigned long u) 767 { 768 return autofs_dev_ioctl(file, command, (unsigned long) compat_ptr(u)); 769 } 770 #else 771 #define autofs_dev_ioctl_compat NULL 772 #endif 773 774 static const struct file_operations _dev_ioctl_fops = { 775 .unlocked_ioctl = autofs_dev_ioctl, 776 .compat_ioctl = autofs_dev_ioctl_compat, 777 .owner = THIS_MODULE, 778 .llseek = noop_llseek, 779 }; 780 781 static struct miscdevice _autofs_dev_ioctl_misc = { 782 .minor = AUTOFS_MINOR, 783 .name = AUTOFS_DEVICE_NAME, 784 .fops = &_dev_ioctl_fops, 785 .mode = 0644, 786 }; 787 788 MODULE_ALIAS_MISCDEV(AUTOFS_MINOR); 789 MODULE_ALIAS("devname:autofs"); 790 791 /* Register/deregister misc character device */ 792 int __init autofs_dev_ioctl_init(void) 793 { 794 int r; 795 796 r = misc_register(&_autofs_dev_ioctl_misc); 797 if (r) { 798 pr_err("misc_register failed for control device\n"); 799 return r; 800 } 801 802 return 0; 803 } 804 805 void autofs_dev_ioctl_exit(void) 806 { 807 misc_deregister(&_autofs_dev_ioctl_misc); 808 } 809