1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * devtmpfs - kernel-maintained tmpfs-based /dev
4 *
5 * Copyright (C) 2009, Kay Sievers <kay.sievers@vrfy.org>
6 *
7 * During bootup, before any driver core device is registered,
8 * devtmpfs, a tmpfs-based filesystem is created. Every driver-core
9 * device which requests a device node, will add a node in this
10 * filesystem.
11 * By default, all devices are named after the name of the device,
12 * owned by root and have a default mode of 0600. Subsystems can
13 * overwrite the default setting if needed.
14 */
15
16 #define pr_fmt(fmt) "devtmpfs: " fmt
17
18 #include <linux/kernel.h>
19 #include <linux/syscalls.h>
20 #include <linux/mount.h>
21 #include <linux/device.h>
22 #include <linux/blkdev.h>
23 #include <linux/namei.h>
24 #include <linux/fs.h>
25 #include <linux/shmem_fs.h>
26 #include <linux/ramfs.h>
27 #include <linux/sched.h>
28 #include <linux/slab.h>
29 #include <linux/kthread.h>
30 #include <linux/init_syscalls.h>
31 #include <uapi/linux/mount.h>
32 #include "base.h"
33
34 #ifdef CONFIG_DEVTMPFS_SAFE
35 #define DEVTMPFS_MFLAGS (MS_SILENT | MS_NOEXEC | MS_NOSUID)
36 #else
37 #define DEVTMPFS_MFLAGS (MS_SILENT)
38 #endif
39
40 static struct task_struct *thread;
41
42 static int __initdata mount_dev = IS_ENABLED(CONFIG_DEVTMPFS_MOUNT);
43
44 static DEFINE_SPINLOCK(req_lock);
45
46 static struct req {
47 struct req *next;
48 struct completion done;
49 int err;
50 const char *name;
51 umode_t mode; /* 0 => delete */
52 kuid_t uid;
53 kgid_t gid;
54 struct device *dev;
55 } *requests;
56
mount_param(char * str)57 static int __init mount_param(char *str)
58 {
59 mount_dev = simple_strtoul(str, NULL, 0);
60 return 1;
61 }
62 __setup("devtmpfs.mount=", mount_param);
63
64 static struct vfsmount *mnt;
65
public_dev_mount(struct file_system_type * fs_type,int flags,const char * dev_name,void * data)66 static struct dentry *public_dev_mount(struct file_system_type *fs_type, int flags,
67 const char *dev_name, void *data)
68 {
69 struct super_block *s = mnt->mnt_sb;
70 int err;
71
72 atomic_inc(&s->s_active);
73 down_write(&s->s_umount);
74 err = reconfigure_single(s, flags, data);
75 if (err < 0) {
76 deactivate_locked_super(s);
77 return ERR_PTR(err);
78 }
79 return dget(s->s_root);
80 }
81
82 static struct file_system_type internal_fs_type = {
83 .name = "devtmpfs",
84 #ifdef CONFIG_TMPFS
85 .init_fs_context = shmem_init_fs_context,
86 #else
87 .init_fs_context = ramfs_init_fs_context,
88 #endif
89 .kill_sb = kill_litter_super,
90 };
91
92 static struct file_system_type dev_fs_type = {
93 .name = "devtmpfs",
94 .mount = public_dev_mount,
95 };
96
97 #ifdef CONFIG_BLOCK
is_blockdev(struct device * dev)98 static inline int is_blockdev(struct device *dev)
99 {
100 return dev->class == &block_class;
101 }
102 #else
is_blockdev(struct device * dev)103 static inline int is_blockdev(struct device *dev) { return 0; }
104 #endif
105
devtmpfs_submit_req(struct req * req,const char * tmp)106 static int devtmpfs_submit_req(struct req *req, const char *tmp)
107 {
108 init_completion(&req->done);
109
110 spin_lock(&req_lock);
111 req->next = requests;
112 requests = req;
113 spin_unlock(&req_lock);
114
115 wake_up_process(thread);
116 wait_for_completion(&req->done);
117
118 kfree(tmp);
119
120 return req->err;
121 }
122
devtmpfs_create_node(struct device * dev)123 int devtmpfs_create_node(struct device *dev)
124 {
125 const char *tmp = NULL;
126 struct req req;
127
128 if (!thread)
129 return 0;
130
131 req.mode = 0;
132 req.uid = GLOBAL_ROOT_UID;
133 req.gid = GLOBAL_ROOT_GID;
134 req.name = device_get_devnode(dev, &req.mode, &req.uid, &req.gid, &tmp);
135 if (!req.name)
136 return -ENOMEM;
137
138 if (req.mode == 0)
139 req.mode = 0600;
140 if (is_blockdev(dev))
141 req.mode |= S_IFBLK;
142 else
143 req.mode |= S_IFCHR;
144
145 req.dev = dev;
146
147 return devtmpfs_submit_req(&req, tmp);
148 }
149
devtmpfs_delete_node(struct device * dev)150 int devtmpfs_delete_node(struct device *dev)
151 {
152 const char *tmp = NULL;
153 struct req req;
154
155 if (!thread)
156 return 0;
157
158 req.name = device_get_devnode(dev, NULL, NULL, NULL, &tmp);
159 if (!req.name)
160 return -ENOMEM;
161
162 req.mode = 0;
163 req.dev = dev;
164
165 return devtmpfs_submit_req(&req, tmp);
166 }
167
dev_mkdir(const char * name,umode_t mode)168 static int dev_mkdir(const char *name, umode_t mode)
169 {
170 struct dentry *dentry;
171 struct path path;
172 int err;
173
174 dentry = kern_path_create(AT_FDCWD, name, &path, LOOKUP_DIRECTORY);
175 if (IS_ERR(dentry))
176 return PTR_ERR(dentry);
177
178 err = vfs_mkdir(&nop_mnt_idmap, d_inode(path.dentry), dentry, mode);
179 if (!err)
180 /* mark as kernel-created inode */
181 d_inode(dentry)->i_private = &thread;
182 done_path_create(&path, dentry);
183 return err;
184 }
185
create_path(const char * nodepath)186 static int create_path(const char *nodepath)
187 {
188 char *path;
189 char *s;
190 int err = 0;
191
192 /* parent directories do not exist, create them */
193 path = kstrdup(nodepath, GFP_KERNEL);
194 if (!path)
195 return -ENOMEM;
196
197 s = path;
198 for (;;) {
199 s = strchr(s, '/');
200 if (!s)
201 break;
202 s[0] = '\0';
203 err = dev_mkdir(path, 0755);
204 if (err && err != -EEXIST)
205 break;
206 s[0] = '/';
207 s++;
208 }
209 kfree(path);
210 return err;
211 }
212
handle_create(const char * nodename,umode_t mode,kuid_t uid,kgid_t gid,struct device * dev)213 static int handle_create(const char *nodename, umode_t mode, kuid_t uid,
214 kgid_t gid, struct device *dev)
215 {
216 struct dentry *dentry;
217 struct path path;
218 int err;
219
220 dentry = kern_path_create(AT_FDCWD, nodename, &path, 0);
221 if (dentry == ERR_PTR(-ENOENT)) {
222 create_path(nodename);
223 dentry = kern_path_create(AT_FDCWD, nodename, &path, 0);
224 }
225 if (IS_ERR(dentry))
226 return PTR_ERR(dentry);
227
228 err = vfs_mknod(&nop_mnt_idmap, d_inode(path.dentry), dentry, mode,
229 dev->devt);
230 if (!err) {
231 struct iattr newattrs;
232
233 newattrs.ia_mode = mode;
234 newattrs.ia_uid = uid;
235 newattrs.ia_gid = gid;
236 newattrs.ia_valid = ATTR_MODE|ATTR_UID|ATTR_GID;
237 inode_lock(d_inode(dentry));
238 notify_change(&nop_mnt_idmap, dentry, &newattrs, NULL);
239 inode_unlock(d_inode(dentry));
240
241 /* mark as kernel-created inode */
242 d_inode(dentry)->i_private = &thread;
243 }
244 done_path_create(&path, dentry);
245 return err;
246 }
247
dev_rmdir(const char * name)248 static int dev_rmdir(const char *name)
249 {
250 struct path parent;
251 struct dentry *dentry;
252 int err;
253
254 dentry = kern_path_locked(name, &parent);
255 if (IS_ERR(dentry))
256 return PTR_ERR(dentry);
257 if (d_really_is_positive(dentry)) {
258 if (d_inode(dentry)->i_private == &thread)
259 err = vfs_rmdir(&nop_mnt_idmap, d_inode(parent.dentry),
260 dentry);
261 else
262 err = -EPERM;
263 } else {
264 err = -ENOENT;
265 }
266 dput(dentry);
267 inode_unlock(d_inode(parent.dentry));
268 path_put(&parent);
269 return err;
270 }
271
delete_path(const char * nodepath)272 static int delete_path(const char *nodepath)
273 {
274 char *path;
275 int err = 0;
276
277 path = kstrdup(nodepath, GFP_KERNEL);
278 if (!path)
279 return -ENOMEM;
280
281 for (;;) {
282 char *base;
283
284 base = strrchr(path, '/');
285 if (!base)
286 break;
287 base[0] = '\0';
288 err = dev_rmdir(path);
289 if (err)
290 break;
291 }
292
293 kfree(path);
294 return err;
295 }
296
dev_mynode(struct device * dev,struct inode * inode,struct kstat * stat)297 static int dev_mynode(struct device *dev, struct inode *inode, struct kstat *stat)
298 {
299 /* did we create it */
300 if (inode->i_private != &thread)
301 return 0;
302
303 /* does the dev_t match */
304 if (is_blockdev(dev)) {
305 if (!S_ISBLK(stat->mode))
306 return 0;
307 } else {
308 if (!S_ISCHR(stat->mode))
309 return 0;
310 }
311 if (stat->rdev != dev->devt)
312 return 0;
313
314 /* ours */
315 return 1;
316 }
317
handle_remove(const char * nodename,struct device * dev)318 static int handle_remove(const char *nodename, struct device *dev)
319 {
320 struct path parent;
321 struct dentry *dentry;
322 int deleted = 0;
323 int err;
324
325 dentry = kern_path_locked(nodename, &parent);
326 if (IS_ERR(dentry))
327 return PTR_ERR(dentry);
328
329 if (d_really_is_positive(dentry)) {
330 struct kstat stat;
331 struct path p = {.mnt = parent.mnt, .dentry = dentry};
332 err = vfs_getattr(&p, &stat, STATX_TYPE | STATX_MODE,
333 AT_STATX_SYNC_AS_STAT);
334 if (!err && dev_mynode(dev, d_inode(dentry), &stat)) {
335 struct iattr newattrs;
336 /*
337 * before unlinking this node, reset permissions
338 * of possible references like hardlinks
339 */
340 newattrs.ia_uid = GLOBAL_ROOT_UID;
341 newattrs.ia_gid = GLOBAL_ROOT_GID;
342 newattrs.ia_mode = stat.mode & ~0777;
343 newattrs.ia_valid =
344 ATTR_UID|ATTR_GID|ATTR_MODE;
345 inode_lock(d_inode(dentry));
346 notify_change(&nop_mnt_idmap, dentry, &newattrs, NULL);
347 inode_unlock(d_inode(dentry));
348 err = vfs_unlink(&nop_mnt_idmap, d_inode(parent.dentry),
349 dentry, NULL);
350 if (!err || err == -ENOENT)
351 deleted = 1;
352 }
353 } else {
354 err = -ENOENT;
355 }
356 dput(dentry);
357 inode_unlock(d_inode(parent.dentry));
358
359 path_put(&parent);
360 if (deleted && strchr(nodename, '/'))
361 delete_path(nodename);
362 return err;
363 }
364
365 /*
366 * If configured, or requested by the commandline, devtmpfs will be
367 * auto-mounted after the kernel mounted the root filesystem.
368 */
devtmpfs_mount(void)369 int __init devtmpfs_mount(void)
370 {
371 int err;
372
373 if (!mount_dev)
374 return 0;
375
376 if (!thread)
377 return 0;
378
379 err = init_mount("devtmpfs", "dev", "devtmpfs", DEVTMPFS_MFLAGS, NULL);
380 if (err)
381 pr_info("error mounting %d\n", err);
382 else
383 pr_info("mounted\n");
384 return err;
385 }
386
387 static __initdata DECLARE_COMPLETION(setup_done);
388
handle(const char * name,umode_t mode,kuid_t uid,kgid_t gid,struct device * dev)389 static int handle(const char *name, umode_t mode, kuid_t uid, kgid_t gid,
390 struct device *dev)
391 {
392 if (mode)
393 return handle_create(name, mode, uid, gid, dev);
394 else
395 return handle_remove(name, dev);
396 }
397
devtmpfs_work_loop(void)398 static void __noreturn devtmpfs_work_loop(void)
399 {
400 while (1) {
401 spin_lock(&req_lock);
402 while (requests) {
403 struct req *req = requests;
404 requests = NULL;
405 spin_unlock(&req_lock);
406 while (req) {
407 struct req *next = req->next;
408 req->err = handle(req->name, req->mode,
409 req->uid, req->gid, req->dev);
410 complete(&req->done);
411 req = next;
412 }
413 spin_lock(&req_lock);
414 }
415 __set_current_state(TASK_INTERRUPTIBLE);
416 spin_unlock(&req_lock);
417 schedule();
418 }
419 }
420
devtmpfs_setup(void * p)421 static noinline int __init devtmpfs_setup(void *p)
422 {
423 int err;
424
425 err = ksys_unshare(CLONE_NEWNS);
426 if (err)
427 goto out;
428 err = init_mount("devtmpfs", "/", "devtmpfs", DEVTMPFS_MFLAGS, NULL);
429 if (err)
430 goto out;
431 init_chdir("/.."); /* will traverse into overmounted root */
432 init_chroot(".");
433 out:
434 *(int *)p = err;
435 return err;
436 }
437
438 /*
439 * The __ref is because devtmpfs_setup needs to be __init for the routines it
440 * calls. That call is done while devtmpfs_init, which is marked __init,
441 * synchronously waits for it to complete.
442 */
devtmpfsd(void * p)443 static int __ref devtmpfsd(void *p)
444 {
445 int err = devtmpfs_setup(p);
446
447 complete(&setup_done);
448 if (err)
449 return err;
450 devtmpfs_work_loop();
451 return 0;
452 }
453
454 /*
455 * Create devtmpfs instance, driver-core devices will add their device
456 * nodes here.
457 */
devtmpfs_init(void)458 int __init devtmpfs_init(void)
459 {
460 char opts[] = "mode=0755";
461 int err;
462
463 mnt = vfs_kern_mount(&internal_fs_type, 0, "devtmpfs", opts);
464 if (IS_ERR(mnt)) {
465 pr_err("unable to create devtmpfs %ld\n", PTR_ERR(mnt));
466 return PTR_ERR(mnt);
467 }
468 err = register_filesystem(&dev_fs_type);
469 if (err) {
470 pr_err("unable to register devtmpfs type %d\n", err);
471 return err;
472 }
473
474 thread = kthread_run(devtmpfsd, &err, "kdevtmpfs");
475 if (!IS_ERR(thread)) {
476 wait_for_completion(&setup_done);
477 } else {
478 err = PTR_ERR(thread);
479 thread = NULL;
480 }
481
482 if (err) {
483 pr_err("unable to create devtmpfs %d\n", err);
484 unregister_filesystem(&dev_fs_type);
485 thread = NULL;
486 return err;
487 }
488
489 pr_info("initialized\n");
490 return 0;
491 }
492