1 /* -*- linux-c -*- --------------------------------------------------------- * 2 * 3 * linux/fs/devpts/inode.c 4 * 5 * Copyright 1998-2004 H. Peter Anvin -- All Rights Reserved 6 * 7 * This file is part of the Linux kernel and is made available under 8 * the terms of the GNU General Public License, version 2, or at your 9 * option, any later version, incorporated herein by reference. 10 * 11 * ------------------------------------------------------------------------- */ 12 13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 14 15 #include <linux/module.h> 16 #include <linux/init.h> 17 #include <linux/fs.h> 18 #include <linux/sched.h> 19 #include <linux/namei.h> 20 #include <linux/slab.h> 21 #include <linux/mount.h> 22 #include <linux/tty.h> 23 #include <linux/mutex.h> 24 #include <linux/magic.h> 25 #include <linux/idr.h> 26 #include <linux/devpts_fs.h> 27 #include <linux/parser.h> 28 #include <linux/fsnotify.h> 29 #include <linux/seq_file.h> 30 31 #define DEVPTS_DEFAULT_MODE 0600 32 /* 33 * ptmx is a new node in /dev/pts and will be unused in legacy (single- 34 * instance) mode. To prevent surprises in user space, set permissions of 35 * ptmx to 0. Use 'chmod' or remount with '-o ptmxmode' to set meaningful 36 * permissions. 37 */ 38 #define DEVPTS_DEFAULT_PTMX_MODE 0000 39 #define PTMX_MINOR 2 40 41 /* 42 * sysctl support for setting limits on the number of Unix98 ptys allocated. 43 * Otherwise one can eat up all kernel memory by opening /dev/ptmx repeatedly. 44 */ 45 static int pty_limit = NR_UNIX98_PTY_DEFAULT; 46 static int pty_reserve = NR_UNIX98_PTY_RESERVE; 47 static int pty_limit_min; 48 static int pty_limit_max = INT_MAX; 49 static int pty_count; 50 51 static struct ctl_table pty_table[] = { 52 { 53 .procname = "max", 54 .maxlen = sizeof(int), 55 .mode = 0644, 56 .data = &pty_limit, 57 .proc_handler = proc_dointvec_minmax, 58 .extra1 = &pty_limit_min, 59 .extra2 = &pty_limit_max, 60 }, { 61 .procname = "reserve", 62 .maxlen = sizeof(int), 63 .mode = 0644, 64 .data = &pty_reserve, 65 .proc_handler = proc_dointvec_minmax, 66 .extra1 = &pty_limit_min, 67 .extra2 = &pty_limit_max, 68 }, { 69 .procname = "nr", 70 .maxlen = sizeof(int), 71 .mode = 0444, 72 .data = &pty_count, 73 .proc_handler = proc_dointvec, 74 }, 75 {} 76 }; 77 78 static struct ctl_table pty_kern_table[] = { 79 { 80 .procname = "pty", 81 .mode = 0555, 82 .child = pty_table, 83 }, 84 {} 85 }; 86 87 static struct ctl_table pty_root_table[] = { 88 { 89 .procname = "kernel", 90 .mode = 0555, 91 .child = pty_kern_table, 92 }, 93 {} 94 }; 95 96 static DEFINE_MUTEX(allocated_ptys_lock); 97 98 static struct vfsmount *devpts_mnt; 99 100 struct pts_mount_opts { 101 int setuid; 102 int setgid; 103 kuid_t uid; 104 kgid_t gid; 105 umode_t mode; 106 umode_t ptmxmode; 107 int newinstance; 108 int max; 109 }; 110 111 enum { 112 Opt_uid, Opt_gid, Opt_mode, Opt_ptmxmode, Opt_newinstance, Opt_max, 113 Opt_err 114 }; 115 116 static const match_table_t tokens = { 117 {Opt_uid, "uid=%u"}, 118 {Opt_gid, "gid=%u"}, 119 {Opt_mode, "mode=%o"}, 120 #ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES 121 {Opt_ptmxmode, "ptmxmode=%o"}, 122 {Opt_newinstance, "newinstance"}, 123 {Opt_max, "max=%d"}, 124 #endif 125 {Opt_err, NULL} 126 }; 127 128 struct pts_fs_info { 129 struct ida allocated_ptys; 130 struct pts_mount_opts mount_opts; 131 struct dentry *ptmx_dentry; 132 }; 133 134 static inline struct pts_fs_info *DEVPTS_SB(struct super_block *sb) 135 { 136 return sb->s_fs_info; 137 } 138 139 static inline struct super_block *pts_sb_from_inode(struct inode *inode) 140 { 141 #ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES 142 if (inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC) 143 return inode->i_sb; 144 #endif 145 return devpts_mnt->mnt_sb; 146 } 147 148 #define PARSE_MOUNT 0 149 #define PARSE_REMOUNT 1 150 151 /* 152 * parse_mount_options(): 153 * Set @opts to mount options specified in @data. If an option is not 154 * specified in @data, set it to its default value. The exception is 155 * 'newinstance' option which can only be set/cleared on a mount (i.e. 156 * cannot be changed during remount). 157 * 158 * Note: @data may be NULL (in which case all options are set to default). 159 */ 160 static int parse_mount_options(char *data, int op, struct pts_mount_opts *opts) 161 { 162 char *p; 163 kuid_t uid; 164 kgid_t gid; 165 166 opts->setuid = 0; 167 opts->setgid = 0; 168 opts->uid = GLOBAL_ROOT_UID; 169 opts->gid = GLOBAL_ROOT_GID; 170 opts->mode = DEVPTS_DEFAULT_MODE; 171 opts->ptmxmode = DEVPTS_DEFAULT_PTMX_MODE; 172 opts->max = NR_UNIX98_PTY_MAX; 173 174 /* newinstance makes sense only on initial mount */ 175 if (op == PARSE_MOUNT) 176 opts->newinstance = 0; 177 178 while ((p = strsep(&data, ",")) != NULL) { 179 substring_t args[MAX_OPT_ARGS]; 180 int token; 181 int option; 182 183 if (!*p) 184 continue; 185 186 token = match_token(p, tokens, args); 187 switch (token) { 188 case Opt_uid: 189 if (match_int(&args[0], &option)) 190 return -EINVAL; 191 uid = make_kuid(current_user_ns(), option); 192 if (!uid_valid(uid)) 193 return -EINVAL; 194 opts->uid = uid; 195 opts->setuid = 1; 196 break; 197 case Opt_gid: 198 if (match_int(&args[0], &option)) 199 return -EINVAL; 200 gid = make_kgid(current_user_ns(), option); 201 if (!gid_valid(gid)) 202 return -EINVAL; 203 opts->gid = gid; 204 opts->setgid = 1; 205 break; 206 case Opt_mode: 207 if (match_octal(&args[0], &option)) 208 return -EINVAL; 209 opts->mode = option & S_IALLUGO; 210 break; 211 #ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES 212 case Opt_ptmxmode: 213 if (match_octal(&args[0], &option)) 214 return -EINVAL; 215 opts->ptmxmode = option & S_IALLUGO; 216 break; 217 case Opt_newinstance: 218 /* newinstance makes sense only on initial mount */ 219 if (op == PARSE_MOUNT) 220 opts->newinstance = 1; 221 break; 222 case Opt_max: 223 if (match_int(&args[0], &option) || 224 option < 0 || option > NR_UNIX98_PTY_MAX) 225 return -EINVAL; 226 opts->max = option; 227 break; 228 #endif 229 default: 230 pr_err("called with bogus options\n"); 231 return -EINVAL; 232 } 233 } 234 235 return 0; 236 } 237 238 #ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES 239 static int mknod_ptmx(struct super_block *sb) 240 { 241 int mode; 242 int rc = -ENOMEM; 243 struct dentry *dentry; 244 struct inode *inode; 245 struct dentry *root = sb->s_root; 246 struct pts_fs_info *fsi = DEVPTS_SB(sb); 247 struct pts_mount_opts *opts = &fsi->mount_opts; 248 kuid_t root_uid; 249 kgid_t root_gid; 250 251 root_uid = make_kuid(current_user_ns(), 0); 252 root_gid = make_kgid(current_user_ns(), 0); 253 if (!uid_valid(root_uid) || !gid_valid(root_gid)) 254 return -EINVAL; 255 256 mutex_lock(&root->d_inode->i_mutex); 257 258 /* If we have already created ptmx node, return */ 259 if (fsi->ptmx_dentry) { 260 rc = 0; 261 goto out; 262 } 263 264 dentry = d_alloc_name(root, "ptmx"); 265 if (!dentry) { 266 pr_err("Unable to alloc dentry for ptmx node\n"); 267 goto out; 268 } 269 270 /* 271 * Create a new 'ptmx' node in this mount of devpts. 272 */ 273 inode = new_inode(sb); 274 if (!inode) { 275 pr_err("Unable to alloc inode for ptmx node\n"); 276 dput(dentry); 277 goto out; 278 } 279 280 inode->i_ino = 2; 281 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME; 282 283 mode = S_IFCHR|opts->ptmxmode; 284 init_special_inode(inode, mode, MKDEV(TTYAUX_MAJOR, 2)); 285 inode->i_uid = root_uid; 286 inode->i_gid = root_gid; 287 288 d_add(dentry, inode); 289 290 fsi->ptmx_dentry = dentry; 291 rc = 0; 292 out: 293 mutex_unlock(&root->d_inode->i_mutex); 294 return rc; 295 } 296 297 static void update_ptmx_mode(struct pts_fs_info *fsi) 298 { 299 struct inode *inode; 300 if (fsi->ptmx_dentry) { 301 inode = fsi->ptmx_dentry->d_inode; 302 inode->i_mode = S_IFCHR|fsi->mount_opts.ptmxmode; 303 } 304 } 305 #else 306 static inline void update_ptmx_mode(struct pts_fs_info *fsi) 307 { 308 return; 309 } 310 #endif 311 312 static int devpts_remount(struct super_block *sb, int *flags, char *data) 313 { 314 int err; 315 struct pts_fs_info *fsi = DEVPTS_SB(sb); 316 struct pts_mount_opts *opts = &fsi->mount_opts; 317 318 sync_filesystem(sb); 319 err = parse_mount_options(data, PARSE_REMOUNT, opts); 320 321 /* 322 * parse_mount_options() restores options to default values 323 * before parsing and may have changed ptmxmode. So, update the 324 * mode in the inode too. Bogus options don't fail the remount, 325 * so do this even on error return. 326 */ 327 update_ptmx_mode(fsi); 328 329 return err; 330 } 331 332 static int devpts_show_options(struct seq_file *seq, struct dentry *root) 333 { 334 struct pts_fs_info *fsi = DEVPTS_SB(root->d_sb); 335 struct pts_mount_opts *opts = &fsi->mount_opts; 336 337 if (opts->setuid) 338 seq_printf(seq, ",uid=%u", 339 from_kuid_munged(&init_user_ns, opts->uid)); 340 if (opts->setgid) 341 seq_printf(seq, ",gid=%u", 342 from_kgid_munged(&init_user_ns, opts->gid)); 343 seq_printf(seq, ",mode=%03o", opts->mode); 344 #ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES 345 seq_printf(seq, ",ptmxmode=%03o", opts->ptmxmode); 346 if (opts->max < NR_UNIX98_PTY_MAX) 347 seq_printf(seq, ",max=%d", opts->max); 348 #endif 349 350 return 0; 351 } 352 353 static const struct super_operations devpts_sops = { 354 .statfs = simple_statfs, 355 .remount_fs = devpts_remount, 356 .show_options = devpts_show_options, 357 }; 358 359 static void *new_pts_fs_info(void) 360 { 361 struct pts_fs_info *fsi; 362 363 fsi = kzalloc(sizeof(struct pts_fs_info), GFP_KERNEL); 364 if (!fsi) 365 return NULL; 366 367 ida_init(&fsi->allocated_ptys); 368 fsi->mount_opts.mode = DEVPTS_DEFAULT_MODE; 369 fsi->mount_opts.ptmxmode = DEVPTS_DEFAULT_PTMX_MODE; 370 371 return fsi; 372 } 373 374 static int 375 devpts_fill_super(struct super_block *s, void *data, int silent) 376 { 377 struct inode *inode; 378 379 s->s_blocksize = 1024; 380 s->s_blocksize_bits = 10; 381 s->s_magic = DEVPTS_SUPER_MAGIC; 382 s->s_op = &devpts_sops; 383 s->s_time_gran = 1; 384 385 s->s_fs_info = new_pts_fs_info(); 386 if (!s->s_fs_info) 387 goto fail; 388 389 inode = new_inode(s); 390 if (!inode) 391 goto fail; 392 inode->i_ino = 1; 393 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME; 394 inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR; 395 inode->i_op = &simple_dir_inode_operations; 396 inode->i_fop = &simple_dir_operations; 397 set_nlink(inode, 2); 398 399 s->s_root = d_make_root(inode); 400 if (s->s_root) 401 return 0; 402 403 pr_err("get root dentry failed\n"); 404 405 fail: 406 return -ENOMEM; 407 } 408 409 #ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES 410 static int compare_init_pts_sb(struct super_block *s, void *p) 411 { 412 if (devpts_mnt) 413 return devpts_mnt->mnt_sb == s; 414 return 0; 415 } 416 417 /* 418 * devpts_mount() 419 * 420 * If the '-o newinstance' mount option was specified, mount a new 421 * (private) instance of devpts. PTYs created in this instance are 422 * independent of the PTYs in other devpts instances. 423 * 424 * If the '-o newinstance' option was not specified, mount/remount the 425 * initial kernel mount of devpts. This type of mount gives the 426 * legacy, single-instance semantics. 427 * 428 * The 'newinstance' option is needed to support multiple namespace 429 * semantics in devpts while preserving backward compatibility of the 430 * current 'single-namespace' semantics. i.e all mounts of devpts 431 * without the 'newinstance' mount option should bind to the initial 432 * kernel mount, like mount_single(). 433 * 434 * Mounts with 'newinstance' option create a new, private namespace. 435 * 436 * NOTE: 437 * 438 * For single-mount semantics, devpts cannot use mount_single(), 439 * because mount_single()/sget() find and use the super-block from 440 * the most recent mount of devpts. But that recent mount may be a 441 * 'newinstance' mount and mount_single() would pick the newinstance 442 * super-block instead of the initial super-block. 443 */ 444 static struct dentry *devpts_mount(struct file_system_type *fs_type, 445 int flags, const char *dev_name, void *data) 446 { 447 int error; 448 struct pts_mount_opts opts; 449 struct super_block *s; 450 451 error = parse_mount_options(data, PARSE_MOUNT, &opts); 452 if (error) 453 return ERR_PTR(error); 454 455 /* Require newinstance for all user namespace mounts to ensure 456 * the mount options are not changed. 457 */ 458 if ((current_user_ns() != &init_user_ns) && !opts.newinstance) 459 return ERR_PTR(-EINVAL); 460 461 if (opts.newinstance) 462 s = sget(fs_type, NULL, set_anon_super, flags, NULL); 463 else 464 s = sget(fs_type, compare_init_pts_sb, set_anon_super, flags, 465 NULL); 466 467 if (IS_ERR(s)) 468 return ERR_CAST(s); 469 470 if (!s->s_root) { 471 error = devpts_fill_super(s, data, flags & MS_SILENT ? 1 : 0); 472 if (error) 473 goto out_undo_sget; 474 s->s_flags |= MS_ACTIVE; 475 } 476 477 memcpy(&(DEVPTS_SB(s))->mount_opts, &opts, sizeof(opts)); 478 479 error = mknod_ptmx(s); 480 if (error) 481 goto out_undo_sget; 482 483 return dget(s->s_root); 484 485 out_undo_sget: 486 deactivate_locked_super(s); 487 return ERR_PTR(error); 488 } 489 490 #else 491 /* 492 * This supports only the legacy single-instance semantics (no 493 * multiple-instance semantics) 494 */ 495 static struct dentry *devpts_mount(struct file_system_type *fs_type, int flags, 496 const char *dev_name, void *data) 497 { 498 return mount_single(fs_type, flags, data, devpts_fill_super); 499 } 500 #endif 501 502 static void devpts_kill_sb(struct super_block *sb) 503 { 504 struct pts_fs_info *fsi = DEVPTS_SB(sb); 505 506 ida_destroy(&fsi->allocated_ptys); 507 kfree(fsi); 508 kill_litter_super(sb); 509 } 510 511 static struct file_system_type devpts_fs_type = { 512 .name = "devpts", 513 .mount = devpts_mount, 514 .kill_sb = devpts_kill_sb, 515 #ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES 516 .fs_flags = FS_USERNS_MOUNT | FS_USERNS_DEV_MOUNT, 517 #endif 518 }; 519 520 /* 521 * The normal naming convention is simply /dev/pts/<number>; this conforms 522 * to the System V naming convention 523 */ 524 525 int devpts_new_index(struct inode *ptmx_inode) 526 { 527 struct super_block *sb = pts_sb_from_inode(ptmx_inode); 528 struct pts_fs_info *fsi = DEVPTS_SB(sb); 529 int index; 530 int ida_ret; 531 532 retry: 533 if (!ida_pre_get(&fsi->allocated_ptys, GFP_KERNEL)) 534 return -ENOMEM; 535 536 mutex_lock(&allocated_ptys_lock); 537 if (pty_count >= pty_limit - 538 (fsi->mount_opts.newinstance ? pty_reserve : 0)) { 539 mutex_unlock(&allocated_ptys_lock); 540 return -ENOSPC; 541 } 542 543 ida_ret = ida_get_new(&fsi->allocated_ptys, &index); 544 if (ida_ret < 0) { 545 mutex_unlock(&allocated_ptys_lock); 546 if (ida_ret == -EAGAIN) 547 goto retry; 548 return -EIO; 549 } 550 551 if (index >= fsi->mount_opts.max) { 552 ida_remove(&fsi->allocated_ptys, index); 553 mutex_unlock(&allocated_ptys_lock); 554 return -ENOSPC; 555 } 556 pty_count++; 557 mutex_unlock(&allocated_ptys_lock); 558 return index; 559 } 560 561 void devpts_kill_index(struct inode *ptmx_inode, int idx) 562 { 563 struct super_block *sb = pts_sb_from_inode(ptmx_inode); 564 struct pts_fs_info *fsi = DEVPTS_SB(sb); 565 566 mutex_lock(&allocated_ptys_lock); 567 ida_remove(&fsi->allocated_ptys, idx); 568 pty_count--; 569 mutex_unlock(&allocated_ptys_lock); 570 } 571 572 /** 573 * devpts_pty_new -- create a new inode in /dev/pts/ 574 * @ptmx_inode: inode of the master 575 * @device: major+minor of the node to be created 576 * @index: used as a name of the node 577 * @priv: what's given back by devpts_get_priv 578 * 579 * The created inode is returned. Remove it from /dev/pts/ by devpts_pty_kill. 580 */ 581 struct inode *devpts_pty_new(struct inode *ptmx_inode, dev_t device, int index, 582 void *priv) 583 { 584 struct dentry *dentry; 585 struct super_block *sb = pts_sb_from_inode(ptmx_inode); 586 struct inode *inode; 587 struct dentry *root = sb->s_root; 588 struct pts_fs_info *fsi = DEVPTS_SB(sb); 589 struct pts_mount_opts *opts = &fsi->mount_opts; 590 char s[12]; 591 592 inode = new_inode(sb); 593 if (!inode) 594 return ERR_PTR(-ENOMEM); 595 596 inode->i_ino = index + 3; 597 inode->i_uid = opts->setuid ? opts->uid : current_fsuid(); 598 inode->i_gid = opts->setgid ? opts->gid : current_fsgid(); 599 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME; 600 init_special_inode(inode, S_IFCHR|opts->mode, device); 601 inode->i_private = priv; 602 603 sprintf(s, "%d", index); 604 605 mutex_lock(&root->d_inode->i_mutex); 606 607 dentry = d_alloc_name(root, s); 608 if (dentry) { 609 d_add(dentry, inode); 610 fsnotify_create(root->d_inode, dentry); 611 } else { 612 iput(inode); 613 inode = ERR_PTR(-ENOMEM); 614 } 615 616 mutex_unlock(&root->d_inode->i_mutex); 617 618 return inode; 619 } 620 621 /** 622 * devpts_get_priv -- get private data for a slave 623 * @pts_inode: inode of the slave 624 * 625 * Returns whatever was passed as priv in devpts_pty_new for a given inode. 626 */ 627 void *devpts_get_priv(struct inode *pts_inode) 628 { 629 struct dentry *dentry; 630 void *priv = NULL; 631 632 BUG_ON(pts_inode->i_rdev == MKDEV(TTYAUX_MAJOR, PTMX_MINOR)); 633 634 /* Ensure dentry has not been deleted by devpts_pty_kill() */ 635 dentry = d_find_alias(pts_inode); 636 if (!dentry) 637 return NULL; 638 639 if (pts_inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC) 640 priv = pts_inode->i_private; 641 642 dput(dentry); 643 644 return priv; 645 } 646 647 /** 648 * devpts_pty_kill -- remove inode form /dev/pts/ 649 * @inode: inode of the slave to be removed 650 * 651 * This is an inverse operation of devpts_pty_new. 652 */ 653 void devpts_pty_kill(struct inode *inode) 654 { 655 struct super_block *sb = pts_sb_from_inode(inode); 656 struct dentry *root = sb->s_root; 657 struct dentry *dentry; 658 659 BUG_ON(inode->i_rdev == MKDEV(TTYAUX_MAJOR, PTMX_MINOR)); 660 661 mutex_lock(&root->d_inode->i_mutex); 662 663 dentry = d_find_alias(inode); 664 665 drop_nlink(inode); 666 d_delete(dentry); 667 dput(dentry); /* d_alloc_name() in devpts_pty_new() */ 668 dput(dentry); /* d_find_alias above */ 669 670 mutex_unlock(&root->d_inode->i_mutex); 671 } 672 673 static int __init init_devpts_fs(void) 674 { 675 int err = register_filesystem(&devpts_fs_type); 676 struct ctl_table_header *table; 677 678 if (!err) { 679 table = register_sysctl_table(pty_root_table); 680 devpts_mnt = kern_mount(&devpts_fs_type); 681 if (IS_ERR(devpts_mnt)) { 682 err = PTR_ERR(devpts_mnt); 683 unregister_filesystem(&devpts_fs_type); 684 unregister_sysctl_table(table); 685 } 686 } 687 return err; 688 } 689 module_init(init_devpts_fs) 690