]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blame - fs/proc/inode.c
minimal fix for do_filp_open() race
[mirror_ubuntu-zesty-kernel.git] / fs / proc / inode.c
CommitLineData
1da177e4
LT
1/*
2 * linux/fs/proc/inode.c
3 *
4 * Copyright (C) 1991, 1992 Linus Torvalds
5 */
6
7#include <linux/time.h>
8#include <linux/proc_fs.h>
9#include <linux/kernel.h>
10#include <linux/mm.h>
11#include <linux/string.h>
12#include <linux/stat.h>
786d7e16 13#include <linux/completion.h>
dd23aae4 14#include <linux/poll.h>
1da177e4
LT
15#include <linux/file.h>
16#include <linux/limits.h>
17#include <linux/init.h>
18#include <linux/module.h>
9043476f 19#include <linux/sysctl.h>
5a0e3ad6 20#include <linux/slab.h>
1da177e4
LT
21
22#include <asm/system.h>
23#include <asm/uaccess.h>
24
fee781e6 25#include "internal.h"
1da177e4 26
8267952b 27static void proc_evict_inode(struct inode *inode)
1da177e4
LT
28{
29 struct proc_dir_entry *de;
1da177e4 30
fef26658 31 truncate_inode_pages(&inode->i_data, 0);
8267952b 32 end_writeback(inode);
fef26658 33
99f89551 34 /* Stop tracking associated processes */
13b41b09 35 put_pid(PROC_I(inode)->pid);
1da177e4
LT
36
37 /* Let go of any associated proc directory entry */
38 de = PROC_I(inode)->pde;
99b76233 39 if (de)
135d5655 40 pde_put(de);
9043476f
AV
41 if (PROC_I(inode)->sysctl)
42 sysctl_head_put(PROC_I(inode)->sysctl);
1da177e4
LT
43}
44
45struct vfsmount *proc_mnt;
46
e18b890b 47static struct kmem_cache * proc_inode_cachep;
1da177e4
LT
48
49static struct inode *proc_alloc_inode(struct super_block *sb)
50{
51 struct proc_inode *ei;
52 struct inode *inode;
53
e94b1766 54 ei = (struct proc_inode *)kmem_cache_alloc(proc_inode_cachep, GFP_KERNEL);
1da177e4
LT
55 if (!ei)
56 return NULL;
13b41b09 57 ei->pid = NULL;
aed7a6c4 58 ei->fd = 0;
1da177e4
LT
59 ei->op.proc_get_link = NULL;
60 ei->pde = NULL;
9043476f
AV
61 ei->sysctl = NULL;
62 ei->sysctl_entry = NULL;
1da177e4
LT
63 inode = &ei->vfs_inode;
64 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
65 return inode;
66}
67
fa0d7e3d 68static void proc_i_callback(struct rcu_head *head)
1da177e4 69{
fa0d7e3d
NP
70 struct inode *inode = container_of(head, struct inode, i_rcu);
71 INIT_LIST_HEAD(&inode->i_dentry);
1da177e4
LT
72 kmem_cache_free(proc_inode_cachep, PROC_I(inode));
73}
74
fa0d7e3d
NP
75static void proc_destroy_inode(struct inode *inode)
76{
77 call_rcu(&inode->i_rcu, proc_i_callback);
78}
79
51cc5068 80static void init_once(void *foo)
1da177e4
LT
81{
82 struct proc_inode *ei = (struct proc_inode *) foo;
83
a35afb83 84 inode_init_once(&ei->vfs_inode);
1da177e4 85}
20c2df83 86
5bcd7ff9 87void __init proc_init_inodecache(void)
1da177e4
LT
88{
89 proc_inode_cachep = kmem_cache_create("proc_inode_cache",
90 sizeof(struct proc_inode),
fffb60f9 91 0, (SLAB_RECLAIM_ACCOUNT|
040b5c6f 92 SLAB_MEM_SPREAD|SLAB_PANIC),
20c2df83 93 init_once);
1da177e4
LT
94}
95
ee9b6d61 96static const struct super_operations proc_sops = {
1da177e4
LT
97 .alloc_inode = proc_alloc_inode,
98 .destroy_inode = proc_destroy_inode,
1da177e4 99 .drop_inode = generic_delete_inode,
8267952b 100 .evict_inode = proc_evict_inode,
1da177e4 101 .statfs = simple_statfs,
1da177e4
LT
102};
103
881adb85 104static void __pde_users_dec(struct proc_dir_entry *pde)
786d7e16 105{
786d7e16
AD
106 pde->pde_users--;
107 if (pde->pde_unload_completion && pde->pde_users == 0)
108 complete(pde->pde_unload_completion);
881adb85
AD
109}
110
3dec7f59 111void pde_users_dec(struct proc_dir_entry *pde)
881adb85
AD
112{
113 spin_lock(&pde->pde_unload_lock);
114 __pde_users_dec(pde);
786d7e16
AD
115 spin_unlock(&pde->pde_unload_lock);
116}
117
118static loff_t proc_reg_llseek(struct file *file, loff_t offset, int whence)
119{
120 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
121 loff_t rv = -EINVAL;
122 loff_t (*llseek)(struct file *, loff_t, int);
123
124 spin_lock(&pde->pde_unload_lock);
125 /*
126 * remove_proc_entry() is going to delete PDE (as part of module
127 * cleanup sequence). No new callers into module allowed.
128 */
129 if (!pde->proc_fops) {
130 spin_unlock(&pde->pde_unload_lock);
131 return rv;
132 }
133 /*
134 * Bump refcount so that remove_proc_entry will wail for ->llseek to
135 * complete.
136 */
137 pde->pde_users++;
138 /*
139 * Save function pointer under lock, to protect against ->proc_fops
140 * NULL'ifying right after ->pde_unload_lock is dropped.
141 */
142 llseek = pde->proc_fops->llseek;
143 spin_unlock(&pde->pde_unload_lock);
144
145 if (!llseek)
146 llseek = default_llseek;
147 rv = llseek(file, offset, whence);
148
149 pde_users_dec(pde);
150 return rv;
151}
152
153static ssize_t proc_reg_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
154{
155 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
156 ssize_t rv = -EIO;
157 ssize_t (*read)(struct file *, char __user *, size_t, loff_t *);
158
159 spin_lock(&pde->pde_unload_lock);
160 if (!pde->proc_fops) {
161 spin_unlock(&pde->pde_unload_lock);
162 return rv;
163 }
164 pde->pde_users++;
165 read = pde->proc_fops->read;
166 spin_unlock(&pde->pde_unload_lock);
167
168 if (read)
169 rv = read(file, buf, count, ppos);
170
171 pde_users_dec(pde);
172 return rv;
173}
174
175static ssize_t proc_reg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
176{
177 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
178 ssize_t rv = -EIO;
179 ssize_t (*write)(struct file *, const char __user *, size_t, loff_t *);
180
181 spin_lock(&pde->pde_unload_lock);
182 if (!pde->proc_fops) {
183 spin_unlock(&pde->pde_unload_lock);
184 return rv;
185 }
186 pde->pde_users++;
187 write = pde->proc_fops->write;
188 spin_unlock(&pde->pde_unload_lock);
189
190 if (write)
191 rv = write(file, buf, count, ppos);
192
193 pde_users_dec(pde);
194 return rv;
195}
196
197static unsigned int proc_reg_poll(struct file *file, struct poll_table_struct *pts)
198{
199 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
dd23aae4 200 unsigned int rv = DEFAULT_POLLMASK;
786d7e16
AD
201 unsigned int (*poll)(struct file *, struct poll_table_struct *);
202
203 spin_lock(&pde->pde_unload_lock);
204 if (!pde->proc_fops) {
205 spin_unlock(&pde->pde_unload_lock);
206 return rv;
207 }
208 pde->pde_users++;
209 poll = pde->proc_fops->poll;
210 spin_unlock(&pde->pde_unload_lock);
211
212 if (poll)
213 rv = poll(file, pts);
214
215 pde_users_dec(pde);
216 return rv;
217}
218
219static long proc_reg_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
220{
221 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
222 long rv = -ENOTTY;
b19dd42f 223 long (*ioctl)(struct file *, unsigned int, unsigned long);
786d7e16
AD
224
225 spin_lock(&pde->pde_unload_lock);
226 if (!pde->proc_fops) {
227 spin_unlock(&pde->pde_unload_lock);
228 return rv;
229 }
230 pde->pde_users++;
b19dd42f 231 ioctl = pde->proc_fops->unlocked_ioctl;
786d7e16
AD
232 spin_unlock(&pde->pde_unload_lock);
233
b19dd42f
AB
234 if (ioctl)
235 rv = ioctl(file, cmd, arg);
786d7e16
AD
236
237 pde_users_dec(pde);
238 return rv;
239}
240
241#ifdef CONFIG_COMPAT
242static long proc_reg_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
243{
244 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
245 long rv = -ENOTTY;
246 long (*compat_ioctl)(struct file *, unsigned int, unsigned long);
247
248 spin_lock(&pde->pde_unload_lock);
249 if (!pde->proc_fops) {
250 spin_unlock(&pde->pde_unload_lock);
251 return rv;
252 }
253 pde->pde_users++;
254 compat_ioctl = pde->proc_fops->compat_ioctl;
255 spin_unlock(&pde->pde_unload_lock);
256
257 if (compat_ioctl)
258 rv = compat_ioctl(file, cmd, arg);
259
260 pde_users_dec(pde);
261 return rv;
262}
263#endif
264
265static int proc_reg_mmap(struct file *file, struct vm_area_struct *vma)
266{
267 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
268 int rv = -EIO;
269 int (*mmap)(struct file *, struct vm_area_struct *);
270
271 spin_lock(&pde->pde_unload_lock);
272 if (!pde->proc_fops) {
273 spin_unlock(&pde->pde_unload_lock);
274 return rv;
275 }
276 pde->pde_users++;
277 mmap = pde->proc_fops->mmap;
278 spin_unlock(&pde->pde_unload_lock);
279
280 if (mmap)
281 rv = mmap(file, vma);
282
283 pde_users_dec(pde);
284 return rv;
285}
286
287static int proc_reg_open(struct inode *inode, struct file *file)
288{
289 struct proc_dir_entry *pde = PDE(inode);
290 int rv = 0;
291 int (*open)(struct inode *, struct file *);
881adb85
AD
292 int (*release)(struct inode *, struct file *);
293 struct pde_opener *pdeo;
294
295 /*
296 * What for, you ask? Well, we can have open, rmmod, remove_proc_entry
297 * sequence. ->release won't be called because ->proc_fops will be
298 * cleared. Depending on complexity of ->release, consequences vary.
299 *
300 * We can't wait for mercy when close will be done for real, it's
301 * deadlockable: rmmod foo </proc/foo . So, we're going to do ->release
302 * by hand in remove_proc_entry(). For this, save opener's credentials
303 * for later.
304 */
305 pdeo = kmalloc(sizeof(struct pde_opener), GFP_KERNEL);
306 if (!pdeo)
307 return -ENOMEM;
786d7e16
AD
308
309 spin_lock(&pde->pde_unload_lock);
310 if (!pde->proc_fops) {
311 spin_unlock(&pde->pde_unload_lock);
881adb85 312 kfree(pdeo);
300b994b 313 return -EINVAL;
786d7e16
AD
314 }
315 pde->pde_users++;
316 open = pde->proc_fops->open;
881adb85 317 release = pde->proc_fops->release;
786d7e16
AD
318 spin_unlock(&pde->pde_unload_lock);
319
320 if (open)
321 rv = open(inode, file);
322
881adb85
AD
323 spin_lock(&pde->pde_unload_lock);
324 if (rv == 0 && release) {
325 /* To know what to release. */
326 pdeo->inode = inode;
327 pdeo->file = file;
328 /* Strictly for "too late" ->release in proc_reg_release(). */
329 pdeo->release = release;
330 list_add(&pdeo->lh, &pde->pde_openers);
331 } else
332 kfree(pdeo);
333 __pde_users_dec(pde);
334 spin_unlock(&pde->pde_unload_lock);
786d7e16
AD
335 return rv;
336}
337
881adb85
AD
338static struct pde_opener *find_pde_opener(struct proc_dir_entry *pde,
339 struct inode *inode, struct file *file)
340{
341 struct pde_opener *pdeo;
342
343 list_for_each_entry(pdeo, &pde->pde_openers, lh) {
344 if (pdeo->inode == inode && pdeo->file == file)
345 return pdeo;
346 }
347 return NULL;
348}
349
786d7e16
AD
350static int proc_reg_release(struct inode *inode, struct file *file)
351{
352 struct proc_dir_entry *pde = PDE(inode);
353 int rv = 0;
354 int (*release)(struct inode *, struct file *);
881adb85 355 struct pde_opener *pdeo;
786d7e16
AD
356
357 spin_lock(&pde->pde_unload_lock);
881adb85 358 pdeo = find_pde_opener(pde, inode, file);
786d7e16 359 if (!pde->proc_fops) {
881adb85
AD
360 /*
361 * Can't simply exit, __fput() will think that everything is OK,
362 * and move on to freeing struct file. remove_proc_entry() will
363 * find slacker in opener's list and will try to do non-trivial
364 * things with struct file. Therefore, remove opener from list.
365 *
366 * But if opener is removed from list, who will ->release it?
367 */
368 if (pdeo) {
369 list_del(&pdeo->lh);
370 spin_unlock(&pde->pde_unload_lock);
371 rv = pdeo->release(inode, file);
372 kfree(pdeo);
373 } else
374 spin_unlock(&pde->pde_unload_lock);
786d7e16
AD
375 return rv;
376 }
377 pde->pde_users++;
378 release = pde->proc_fops->release;
881adb85
AD
379 if (pdeo) {
380 list_del(&pdeo->lh);
381 kfree(pdeo);
382 }
786d7e16
AD
383 spin_unlock(&pde->pde_unload_lock);
384
385 if (release)
386 rv = release(inode, file);
387
388 pde_users_dec(pde);
389 return rv;
390}
391
392static const struct file_operations proc_reg_file_ops = {
393 .llseek = proc_reg_llseek,
394 .read = proc_reg_read,
395 .write = proc_reg_write,
396 .poll = proc_reg_poll,
397 .unlocked_ioctl = proc_reg_unlocked_ioctl,
398#ifdef CONFIG_COMPAT
399 .compat_ioctl = proc_reg_compat_ioctl,
400#endif
401 .mmap = proc_reg_mmap,
402 .open = proc_reg_open,
403 .release = proc_reg_release,
404};
405
778f3dd5
DM
406#ifdef CONFIG_COMPAT
407static const struct file_operations proc_reg_file_ops_no_compat = {
408 .llseek = proc_reg_llseek,
409 .read = proc_reg_read,
410 .write = proc_reg_write,
411 .poll = proc_reg_poll,
412 .unlocked_ioctl = proc_reg_unlocked_ioctl,
413 .mmap = proc_reg_mmap,
414 .open = proc_reg_open,
415 .release = proc_reg_release,
416};
417#endif
418
6d1b6e4e 419struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
1da177e4
LT
420{
421 struct inode * inode;
422
6d1b6e4e 423 inode = iget_locked(sb, de->low_ino);
1da177e4 424 if (!inode)
99b76233 425 return NULL;
a1d4aebb
DH
426 if (inode->i_state & I_NEW) {
427 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
428 PROC_I(inode)->fd = 0;
429 PROC_I(inode)->pde = de;
5e971dce
AD
430
431 if (de->mode) {
432 inode->i_mode = de->mode;
433 inode->i_uid = de->uid;
434 inode->i_gid = de->gid;
435 }
436 if (de->size)
437 inode->i_size = de->size;
438 if (de->nlink)
439 inode->i_nlink = de->nlink;
440 if (de->proc_iops)
441 inode->i_op = de->proc_iops;
442 if (de->proc_fops) {
443 if (S_ISREG(inode->i_mode)) {
778f3dd5 444#ifdef CONFIG_COMPAT
5e971dce
AD
445 if (!de->proc_fops->compat_ioctl)
446 inode->i_fop =
447 &proc_reg_file_ops_no_compat;
448 else
778f3dd5 449#endif
5e971dce
AD
450 inode->i_fop = &proc_reg_file_ops;
451 } else {
452 inode->i_fop = de->proc_fops;
778f3dd5 453 }
786d7e16 454 }
a1d4aebb 455 unlock_new_inode(inode);
99b76233 456 } else
135d5655 457 pde_put(de);
1da177e4 458 return inode;
1da177e4
LT
459}
460
07543f5c 461int proc_fill_super(struct super_block *s)
1da177e4
LT
462{
463 struct inode * root_inode;
464
92d03285 465 s->s_flags |= MS_NODIRATIME | MS_NOSUID | MS_NOEXEC;
1da177e4
LT
466 s->s_blocksize = 1024;
467 s->s_blocksize_bits = 10;
468 s->s_magic = PROC_SUPER_MAGIC;
469 s->s_op = &proc_sops;
470 s->s_time_gran = 1;
471
135d5655 472 pde_get(&proc_root);
6d1b6e4e 473 root_inode = proc_get_inode(s, &proc_root);
1da177e4
LT
474 if (!root_inode)
475 goto out_no_root;
1da177e4
LT
476 root_inode->i_uid = 0;
477 root_inode->i_gid = 0;
478 s->s_root = d_alloc_root(root_inode);
479 if (!s->s_root)
480 goto out_no_root;
481 return 0;
482
483out_no_root:
484 printk("proc_read_super: get root inode failed\n");
485 iput(root_inode);
135d5655 486 pde_put(&proc_root);
1da177e4
LT
487 return -ENOMEM;
488}