1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved 4 * Copyright 2001-2006 Ian Kent <raven@themaw.net> 5 */ 6 7 #include <linux/sched/signal.h> 8 #include "autofs_i.h" 9 10 /* We make this a static variable rather than a part of the superblock; it 11 * is better if we don't reassign numbers easily even across filesystems 12 */ 13 static autofs_wqt_t autofs_next_wait_queue = 1; 14 15 static void autofs_catatonic_mode_locked(struct autofs_sb_info *sbi) 16 { 17 struct autofs_wait_queue *wq, *nwq; 18 19 lockdep_assert_held(&sbi->wq_mutex); 20 if (sbi->flags & AUTOFS_SBI_CATATONIC) 21 return; 22 23 pr_debug("entering catatonic mode\n"); 24 25 sbi->flags |= AUTOFS_SBI_CATATONIC; 26 wq = sbi->queues; 27 sbi->queues = NULL; /* Erase all wait queues */ 28 while (wq) { 29 nwq = wq->next; 30 wq->status = -ENOENT; /* Magic is gone - report failure */ 31 kfree(wq->name.name - wq->offset); 32 wq->name.name = NULL; 33 wake_up(&wq->queue); 34 if (!--wq->wait_ctr) 35 kfree(wq); 36 wq = nwq; 37 } 38 fput(sbi->pipe); /* Close the pipe */ 39 sbi->pipe = NULL; 40 sbi->pipefd = -1; 41 } 42 43 void autofs_catatonic_mode(struct autofs_sb_info *sbi) 44 { 45 mutex_lock(&sbi->wq_mutex); 46 autofs_catatonic_mode_locked(sbi); 47 mutex_unlock(&sbi->wq_mutex); 48 } 49 50 static void autofs_catatonic_mode_for_pipe(struct autofs_sb_info *sbi, 51 struct file *pipe) 52 { 53 mutex_lock(&sbi->wq_mutex); 54 if (sbi->pipe == pipe) 55 autofs_catatonic_mode_locked(sbi); 56 mutex_unlock(&sbi->wq_mutex); 57 } 58 59 static int autofs_write(struct autofs_sb_info *sbi, 60 struct file *file, const void *addr, int bytes) 61 { 62 unsigned long sigpipe, flags; 63 const char *data = (const char *)addr; 64 ssize_t wr = 0; 65 66 sigpipe = sigismember(¤t->pending.signal, SIGPIPE); 67 68 mutex_lock(&sbi->pipe_mutex); 69 while (bytes) { 70 wr = __kernel_write(file, data, bytes, NULL); 71 if (wr <= 0) 72 break; 73 data += wr; 74 bytes -= wr; 75 } 76 mutex_unlock(&sbi->pipe_mutex); 77 78 /* Keep the currently executing process from receiving a 79 * SIGPIPE unless it was already supposed to get one 80 */ 81 if (wr == -EPIPE && !sigpipe) { 82 spin_lock_irqsave(¤t->sighand->siglock, flags); 83 sigdelset(¤t->pending.signal, SIGPIPE); 84 recalc_sigpending(); 85 spin_unlock_irqrestore(¤t->sighand->siglock, flags); 86 } 87 88 /* if 'wr' returned 0 (impossible) we assume -EIO (safe) */ 89 return bytes == 0 ? 0 : wr < 0 ? wr : -EIO; 90 } 91 92 static void autofs_notify_daemon(struct autofs_sb_info *sbi, 93 struct autofs_wait_queue *wq, 94 int type) 95 { 96 union { 97 struct autofs_packet_hdr hdr; 98 union autofs_packet_union v4_pkt; 99 union autofs_v5_packet_union v5_pkt; 100 } pkt; 101 struct file *pipe = NULL; 102 size_t pktsz; 103 int ret; 104 105 pr_debug("wait id = 0x%08lx, name = %.*s, type=%d\n", 106 (unsigned long) wq->wait_queue_token, 107 wq->name.len, wq->name.name, type); 108 109 memset(&pkt, 0, sizeof(pkt)); /* For security reasons */ 110 111 pkt.hdr.proto_version = sbi->version; 112 pkt.hdr.type = type; 113 114 switch (type) { 115 /* Kernel protocol v4 missing and expire packets */ 116 case autofs_ptype_missing: 117 { 118 struct autofs_packet_missing *mp = &pkt.v4_pkt.missing; 119 120 pktsz = sizeof(*mp); 121 122 mp->wait_queue_token = wq->wait_queue_token; 123 mp->len = wq->name.len; 124 memcpy(mp->name, wq->name.name, wq->name.len); 125 mp->name[wq->name.len] = '\0'; 126 break; 127 } 128 case autofs_ptype_expire_multi: 129 { 130 struct autofs_packet_expire_multi *ep = 131 &pkt.v4_pkt.expire_multi; 132 133 pktsz = sizeof(*ep); 134 135 ep->wait_queue_token = wq->wait_queue_token; 136 ep->len = wq->name.len; 137 memcpy(ep->name, wq->name.name, wq->name.len); 138 ep->name[wq->name.len] = '\0'; 139 break; 140 } 141 /* 142 * Kernel protocol v5 packet for handling indirect and direct 143 * mount missing and expire requests 144 */ 145 case autofs_ptype_missing_indirect: 146 case autofs_ptype_expire_indirect: 147 case autofs_ptype_missing_direct: 148 case autofs_ptype_expire_direct: 149 { 150 struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet; 151 struct user_namespace *user_ns = sbi->pipe->f_cred->user_ns; 152 153 pktsz = sizeof(*packet); 154 155 packet->wait_queue_token = wq->wait_queue_token; 156 packet->len = wq->name.len; 157 memcpy(packet->name, wq->name.name, wq->name.len); 158 packet->name[wq->name.len] = '\0'; 159 packet->dev = wq->dev; 160 packet->ino = wq->ino; 161 packet->uid = from_kuid_munged(user_ns, wq->uid); 162 packet->gid = from_kgid_munged(user_ns, wq->gid); 163 packet->pid = wq->pid; 164 packet->tgid = wq->tgid; 165 break; 166 } 167 default: 168 pr_warn("bad type %d!\n", type); 169 mutex_unlock(&sbi->wq_mutex); 170 return; 171 } 172 173 pipe = get_file(sbi->pipe); 174 175 mutex_unlock(&sbi->wq_mutex); 176 177 switch (ret = autofs_write(sbi, pipe, &pkt, pktsz)) { 178 case 0: 179 break; 180 case -ENOMEM: 181 case -ERESTARTSYS: 182 /* Just fail this one */ 183 autofs_wait_release(sbi, wq->wait_queue_token, ret); 184 break; 185 default: 186 autofs_catatonic_mode_for_pipe(sbi, pipe); 187 break; 188 } 189 fput(pipe); 190 } 191 192 static struct autofs_wait_queue * 193 autofs_find_wait(struct autofs_sb_info *sbi, const struct qstr *qstr) 194 { 195 struct autofs_wait_queue *wq; 196 197 for (wq = sbi->queues; wq; wq = wq->next) { 198 if (wq->name.hash == qstr->hash && 199 wq->name.len == qstr->len && 200 wq->name.name && 201 !memcmp(wq->name.name, qstr->name, qstr->len)) 202 break; 203 } 204 return wq; 205 } 206 207 /* 208 * Check if we have a valid request. 209 * Returns 210 * 1 if the request should continue. 211 * In this case we can return an autofs_wait_queue entry if one is 212 * found or NULL to idicate a new wait needs to be created. 213 * 0 or a negative errno if the request shouldn't continue. 214 */ 215 static int validate_request(struct autofs_wait_queue **wait, 216 struct autofs_sb_info *sbi, 217 const struct qstr *qstr, 218 const struct path *path, enum autofs_notify notify) 219 { 220 struct dentry *dentry = path->dentry; 221 struct autofs_wait_queue *wq; 222 struct autofs_info *ino; 223 224 if (sbi->flags & AUTOFS_SBI_CATATONIC) 225 return -ENOENT; 226 227 /* Wait in progress, continue; */ 228 wq = autofs_find_wait(sbi, qstr); 229 if (wq) { 230 *wait = wq; 231 return 1; 232 } 233 234 *wait = NULL; 235 236 /* If we don't yet have any info this is a new request */ 237 ino = autofs_dentry_ino(dentry); 238 if (!ino) 239 return 1; 240 241 /* 242 * If we've been asked to wait on an existing expire (NFY_NONE) 243 * but there is no wait in the queue ... 244 */ 245 if (notify == NFY_NONE) { 246 /* 247 * Either we've betean the pending expire to post it's 248 * wait or it finished while we waited on the mutex. 249 * So we need to wait till either, the wait appears 250 * or the expire finishes. 251 */ 252 253 while (ino->flags & AUTOFS_INF_EXPIRING) { 254 mutex_unlock(&sbi->wq_mutex); 255 schedule_timeout_interruptible(HZ/10); 256 if (mutex_lock_interruptible(&sbi->wq_mutex)) 257 return -EINTR; 258 259 if (sbi->flags & AUTOFS_SBI_CATATONIC) 260 return -ENOENT; 261 262 wq = autofs_find_wait(sbi, qstr); 263 if (wq) { 264 *wait = wq; 265 return 1; 266 } 267 } 268 269 /* 270 * Not ideal but the status has already gone. Of the two 271 * cases where we wait on NFY_NONE neither depend on the 272 * return status of the wait. 273 */ 274 return 0; 275 } 276 277 /* 278 * If we've been asked to trigger a mount and the request 279 * completed while we waited on the mutex ... 280 */ 281 if (notify == NFY_MOUNT) { 282 struct dentry *new = NULL; 283 struct path this; 284 int valid = 1; 285 286 /* 287 * If the dentry was successfully mounted while we slept 288 * on the wait queue mutex we can return success. If it 289 * isn't mounted (doesn't have submounts for the case of 290 * a multi-mount with no mount at it's base) we can 291 * continue on and create a new request. 292 */ 293 if (!IS_ROOT(dentry)) { 294 if (d_unhashed(dentry) && 295 d_really_is_positive(dentry)) { 296 struct dentry *parent = dentry->d_parent; 297 298 new = d_lookup(parent, &dentry->d_name); 299 if (new) 300 dentry = new; 301 } 302 } 303 this.mnt = path->mnt; 304 this.dentry = dentry; 305 if (path_has_submounts(&this)) 306 valid = 0; 307 308 if (new) 309 dput(new); 310 return valid; 311 } 312 313 return 1; 314 } 315 316 int autofs_wait(struct autofs_sb_info *sbi, 317 const struct path *path, enum autofs_notify notify) 318 { 319 struct dentry *dentry = path->dentry; 320 struct autofs_wait_queue *wq; 321 struct qstr qstr; 322 char *name; 323 int status, ret, type; 324 unsigned int offset = 0; 325 pid_t pid; 326 pid_t tgid; 327 328 /* In catatonic mode, we don't wait for nobody */ 329 if (sbi->flags & AUTOFS_SBI_CATATONIC) 330 return -ENOENT; 331 332 /* 333 * Try translating pids to the namespace of the daemon. 334 * 335 * Zero means failure: we are in an unrelated pid namespace. 336 */ 337 pid = task_pid_nr_ns(current, ns_of_pid(sbi->oz_pgrp)); 338 tgid = task_tgid_nr_ns(current, ns_of_pid(sbi->oz_pgrp)); 339 if (pid == 0 || tgid == 0) 340 return -ENOENT; 341 342 if (d_really_is_negative(dentry)) { 343 /* 344 * A wait for a negative dentry is invalid for certain 345 * cases. A direct or offset mount "always" has its mount 346 * point directory created and so the request dentry must 347 * be positive or the map key doesn't exist. The situation 348 * is very similar for indirect mounts except only dentrys 349 * in the root of the autofs file system may be negative. 350 */ 351 if (autofs_type_trigger(sbi->type)) 352 return -ENOENT; 353 else if (!IS_ROOT(dentry->d_parent)) 354 return -ENOENT; 355 } 356 357 name = kmalloc(NAME_MAX + 1, GFP_KERNEL); 358 if (!name) 359 return -ENOMEM; 360 361 /* If this is a direct mount request create a dummy name */ 362 if (IS_ROOT(dentry) && autofs_type_trigger(sbi->type)) { 363 qstr.name = name; 364 qstr.len = sprintf(name, "%p", dentry); 365 } else { 366 char *p = dentry_path_raw(dentry, name, NAME_MAX); 367 if (IS_ERR(p)) { 368 kfree(name); 369 return -ENOENT; 370 } 371 qstr.name = ++p; // skip the leading slash 372 qstr.len = strlen(p); 373 offset = p - name; 374 } 375 qstr.hash = full_name_hash(dentry, qstr.name, qstr.len); 376 377 if (mutex_lock_interruptible(&sbi->wq_mutex)) { 378 kfree(name); 379 return -EINTR; 380 } 381 382 ret = validate_request(&wq, sbi, &qstr, path, notify); 383 if (ret <= 0) { 384 if (ret != -EINTR) 385 mutex_unlock(&sbi->wq_mutex); 386 kfree(name); 387 return ret; 388 } 389 390 if (!wq) { 391 /* Create a new wait queue */ 392 wq = kmalloc_obj(struct autofs_wait_queue); 393 if (!wq) { 394 kfree(name); 395 mutex_unlock(&sbi->wq_mutex); 396 return -ENOMEM; 397 } 398 399 wq->wait_queue_token = autofs_next_wait_queue; 400 if (++autofs_next_wait_queue == 0) 401 autofs_next_wait_queue = 1; 402 wq->next = sbi->queues; 403 sbi->queues = wq; 404 init_waitqueue_head(&wq->queue); 405 memcpy(&wq->name, &qstr, sizeof(struct qstr)); 406 wq->offset = offset; 407 wq->dev = autofs_get_dev(sbi); 408 wq->ino = autofs_get_ino(sbi); 409 wq->uid = current_uid(); 410 wq->gid = current_gid(); 411 wq->pid = pid; 412 wq->tgid = tgid; 413 wq->status = -EINTR; /* Status return if interrupted */ 414 wq->wait_ctr = 2; 415 416 if (sbi->version < 5) { 417 if (notify == NFY_MOUNT) 418 type = autofs_ptype_missing; 419 else 420 type = autofs_ptype_expire_multi; 421 } else { 422 if (notify == NFY_MOUNT) 423 type = autofs_type_trigger(sbi->type) ? 424 autofs_ptype_missing_direct : 425 autofs_ptype_missing_indirect; 426 else 427 type = autofs_type_trigger(sbi->type) ? 428 autofs_ptype_expire_direct : 429 autofs_ptype_expire_indirect; 430 } 431 432 pr_debug("new wait id = 0x%08lx, name = %.*s, nfy=%d\n", 433 (unsigned long) wq->wait_queue_token, wq->name.len, 434 wq->name.name, notify); 435 436 /* 437 * autofs_notify_daemon() may block; it will unlock ->wq_mutex 438 */ 439 autofs_notify_daemon(sbi, wq, type); 440 } else { 441 wq->wait_ctr++; 442 pr_debug("existing wait id = 0x%08lx, name = %.*s, nfy=%d\n", 443 (unsigned long) wq->wait_queue_token, wq->name.len, 444 wq->name.name, notify); 445 mutex_unlock(&sbi->wq_mutex); 446 kfree(name); 447 } 448 449 /* 450 * wq->name.name is NULL iff the lock is already released 451 * or the mount has been made catatonic. 452 */ 453 wait_event_killable(wq->queue, wq->name.name == NULL); 454 status = wq->status; 455 456 /* 457 * For direct and offset mounts we need to track the requester's 458 * uid and gid in the dentry info struct. This is so it can be 459 * supplied, on request, by the misc device ioctl interface. 460 * This is needed during daemon resatart when reconnecting 461 * to existing, active, autofs mounts. The uid and gid (and 462 * related string values) may be used for macro substitution 463 * in autofs mount maps. 464 */ 465 if (!status) { 466 struct autofs_info *ino; 467 struct dentry *de = NULL; 468 469 /* direct mount or browsable map */ 470 ino = autofs_dentry_ino(dentry); 471 if (!ino) { 472 /* If not lookup actual dentry used */ 473 de = d_lookup(dentry->d_parent, &dentry->d_name); 474 if (de) 475 ino = autofs_dentry_ino(de); 476 } 477 478 /* Set mount requester */ 479 if (ino) { 480 spin_lock(&sbi->fs_lock); 481 ino->uid = wq->uid; 482 ino->gid = wq->gid; 483 spin_unlock(&sbi->fs_lock); 484 } 485 486 if (de) 487 dput(de); 488 } 489 490 /* Are we the last process to need status? */ 491 mutex_lock(&sbi->wq_mutex); 492 if (!--wq->wait_ctr) 493 kfree(wq); 494 mutex_unlock(&sbi->wq_mutex); 495 496 return status; 497 } 498 499 500 int autofs_wait_release(struct autofs_sb_info *sbi, 501 autofs_wqt_t wait_queue_token, int status) 502 { 503 struct autofs_wait_queue *wq, **wql; 504 505 mutex_lock(&sbi->wq_mutex); 506 for (wql = &sbi->queues; (wq = *wql) != NULL; wql = &wq->next) { 507 if (wq->wait_queue_token == wait_queue_token) 508 break; 509 } 510 511 if (!wq) { 512 mutex_unlock(&sbi->wq_mutex); 513 return -EINVAL; 514 } 515 516 *wql = wq->next; /* Unlink from chain */ 517 kfree(wq->name.name - wq->offset); 518 wq->name.name = NULL; /* Do not wait on this queue */ 519 wq->status = status; 520 wake_up(&wq->queue); 521 if (!--wq->wait_ctr) 522 kfree(wq); 523 mutex_unlock(&sbi->wq_mutex); 524 525 return 0; 526 } 527