]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blame_incremental - fs/proc/inode.c
minimal fix for do_filp_open() race
[mirror_ubuntu-zesty-kernel.git] / fs / proc / inode.c
... / ...
CommitLineData
1/*
2 * linux/fs/proc/inode.c
3 *
4 * Copyright (C) 1991, 1992 Linus Torvalds
5 */
6
7#include <linux/time.h>
8#include <linux/proc_fs.h>
9#include <linux/kernel.h>
10#include <linux/mm.h>
11#include <linux/string.h>
12#include <linux/stat.h>
13#include <linux/completion.h>
14#include <linux/poll.h>
15#include <linux/file.h>
16#include <linux/limits.h>
17#include <linux/init.h>
18#include <linux/module.h>
19#include <linux/sysctl.h>
20#include <linux/slab.h>
21
22#include <asm/system.h>
23#include <asm/uaccess.h>
24
25#include "internal.h"
26
27static void proc_evict_inode(struct inode *inode)
28{
29 struct proc_dir_entry *de;
30
31 truncate_inode_pages(&inode->i_data, 0);
32 end_writeback(inode);
33
34 /* Stop tracking associated processes */
35 put_pid(PROC_I(inode)->pid);
36
37 /* Let go of any associated proc directory entry */
38 de = PROC_I(inode)->pde;
39 if (de)
40 pde_put(de);
41 if (PROC_I(inode)->sysctl)
42 sysctl_head_put(PROC_I(inode)->sysctl);
43}
44
45struct vfsmount *proc_mnt;
46
47static struct kmem_cache * proc_inode_cachep;
48
49static struct inode *proc_alloc_inode(struct super_block *sb)
50{
51 struct proc_inode *ei;
52 struct inode *inode;
53
54 ei = (struct proc_inode *)kmem_cache_alloc(proc_inode_cachep, GFP_KERNEL);
55 if (!ei)
56 return NULL;
57 ei->pid = NULL;
58 ei->fd = 0;
59 ei->op.proc_get_link = NULL;
60 ei->pde = NULL;
61 ei->sysctl = NULL;
62 ei->sysctl_entry = NULL;
63 inode = &ei->vfs_inode;
64 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
65 return inode;
66}
67
68static void proc_i_callback(struct rcu_head *head)
69{
70 struct inode *inode = container_of(head, struct inode, i_rcu);
71 INIT_LIST_HEAD(&inode->i_dentry);
72 kmem_cache_free(proc_inode_cachep, PROC_I(inode));
73}
74
75static void proc_destroy_inode(struct inode *inode)
76{
77 call_rcu(&inode->i_rcu, proc_i_callback);
78}
79
80static void init_once(void *foo)
81{
82 struct proc_inode *ei = (struct proc_inode *) foo;
83
84 inode_init_once(&ei->vfs_inode);
85}
86
87void __init proc_init_inodecache(void)
88{
89 proc_inode_cachep = kmem_cache_create("proc_inode_cache",
90 sizeof(struct proc_inode),
91 0, (SLAB_RECLAIM_ACCOUNT|
92 SLAB_MEM_SPREAD|SLAB_PANIC),
93 init_once);
94}
95
96static const struct super_operations proc_sops = {
97 .alloc_inode = proc_alloc_inode,
98 .destroy_inode = proc_destroy_inode,
99 .drop_inode = generic_delete_inode,
100 .evict_inode = proc_evict_inode,
101 .statfs = simple_statfs,
102};
103
104static void __pde_users_dec(struct proc_dir_entry *pde)
105{
106 pde->pde_users--;
107 if (pde->pde_unload_completion && pde->pde_users == 0)
108 complete(pde->pde_unload_completion);
109}
110
111void pde_users_dec(struct proc_dir_entry *pde)
112{
113 spin_lock(&pde->pde_unload_lock);
114 __pde_users_dec(pde);
115 spin_unlock(&pde->pde_unload_lock);
116}
117
118static loff_t proc_reg_llseek(struct file *file, loff_t offset, int whence)
119{
120 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
121 loff_t rv = -EINVAL;
122 loff_t (*llseek)(struct file *, loff_t, int);
123
124 spin_lock(&pde->pde_unload_lock);
125 /*
126 * remove_proc_entry() is going to delete PDE (as part of module
127 * cleanup sequence). No new callers into module allowed.
128 */
129 if (!pde->proc_fops) {
130 spin_unlock(&pde->pde_unload_lock);
131 return rv;
132 }
133 /*
134 * Bump refcount so that remove_proc_entry will wail for ->llseek to
135 * complete.
136 */
137 pde->pde_users++;
138 /*
139 * Save function pointer under lock, to protect against ->proc_fops
140 * NULL'ifying right after ->pde_unload_lock is dropped.
141 */
142 llseek = pde->proc_fops->llseek;
143 spin_unlock(&pde->pde_unload_lock);
144
145 if (!llseek)
146 llseek = default_llseek;
147 rv = llseek(file, offset, whence);
148
149 pde_users_dec(pde);
150 return rv;
151}
152
153static ssize_t proc_reg_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
154{
155 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
156 ssize_t rv = -EIO;
157 ssize_t (*read)(struct file *, char __user *, size_t, loff_t *);
158
159 spin_lock(&pde->pde_unload_lock);
160 if (!pde->proc_fops) {
161 spin_unlock(&pde->pde_unload_lock);
162 return rv;
163 }
164 pde->pde_users++;
165 read = pde->proc_fops->read;
166 spin_unlock(&pde->pde_unload_lock);
167
168 if (read)
169 rv = read(file, buf, count, ppos);
170
171 pde_users_dec(pde);
172 return rv;
173}
174
175static ssize_t proc_reg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
176{
177 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
178 ssize_t rv = -EIO;
179 ssize_t (*write)(struct file *, const char __user *, size_t, loff_t *);
180
181 spin_lock(&pde->pde_unload_lock);
182 if (!pde->proc_fops) {
183 spin_unlock(&pde->pde_unload_lock);
184 return rv;
185 }
186 pde->pde_users++;
187 write = pde->proc_fops->write;
188 spin_unlock(&pde->pde_unload_lock);
189
190 if (write)
191 rv = write(file, buf, count, ppos);
192
193 pde_users_dec(pde);
194 return rv;
195}
196
197static unsigned int proc_reg_poll(struct file *file, struct poll_table_struct *pts)
198{
199 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
200 unsigned int rv = DEFAULT_POLLMASK;
201 unsigned int (*poll)(struct file *, struct poll_table_struct *);
202
203 spin_lock(&pde->pde_unload_lock);
204 if (!pde->proc_fops) {
205 spin_unlock(&pde->pde_unload_lock);
206 return rv;
207 }
208 pde->pde_users++;
209 poll = pde->proc_fops->poll;
210 spin_unlock(&pde->pde_unload_lock);
211
212 if (poll)
213 rv = poll(file, pts);
214
215 pde_users_dec(pde);
216 return rv;
217}
218
219static long proc_reg_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
220{
221 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
222 long rv = -ENOTTY;
223 long (*ioctl)(struct file *, unsigned int, unsigned long);
224
225 spin_lock(&pde->pde_unload_lock);
226 if (!pde->proc_fops) {
227 spin_unlock(&pde->pde_unload_lock);
228 return rv;
229 }
230 pde->pde_users++;
231 ioctl = pde->proc_fops->unlocked_ioctl;
232 spin_unlock(&pde->pde_unload_lock);
233
234 if (ioctl)
235 rv = ioctl(file, cmd, arg);
236
237 pde_users_dec(pde);
238 return rv;
239}
240
241#ifdef CONFIG_COMPAT
242static long proc_reg_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
243{
244 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
245 long rv = -ENOTTY;
246 long (*compat_ioctl)(struct file *, unsigned int, unsigned long);
247
248 spin_lock(&pde->pde_unload_lock);
249 if (!pde->proc_fops) {
250 spin_unlock(&pde->pde_unload_lock);
251 return rv;
252 }
253 pde->pde_users++;
254 compat_ioctl = pde->proc_fops->compat_ioctl;
255 spin_unlock(&pde->pde_unload_lock);
256
257 if (compat_ioctl)
258 rv = compat_ioctl(file, cmd, arg);
259
260 pde_users_dec(pde);
261 return rv;
262}
263#endif
264
265static int proc_reg_mmap(struct file *file, struct vm_area_struct *vma)
266{
267 struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
268 int rv = -EIO;
269 int (*mmap)(struct file *, struct vm_area_struct *);
270
271 spin_lock(&pde->pde_unload_lock);
272 if (!pde->proc_fops) {
273 spin_unlock(&pde->pde_unload_lock);
274 return rv;
275 }
276 pde->pde_users++;
277 mmap = pde->proc_fops->mmap;
278 spin_unlock(&pde->pde_unload_lock);
279
280 if (mmap)
281 rv = mmap(file, vma);
282
283 pde_users_dec(pde);
284 return rv;
285}
286
287static int proc_reg_open(struct inode *inode, struct file *file)
288{
289 struct proc_dir_entry *pde = PDE(inode);
290 int rv = 0;
291 int (*open)(struct inode *, struct file *);
292 int (*release)(struct inode *, struct file *);
293 struct pde_opener *pdeo;
294
295 /*
296 * What for, you ask? Well, we can have open, rmmod, remove_proc_entry
297 * sequence. ->release won't be called because ->proc_fops will be
298 * cleared. Depending on complexity of ->release, consequences vary.
299 *
300 * We can't wait for mercy when close will be done for real, it's
301 * deadlockable: rmmod foo </proc/foo . So, we're going to do ->release
302 * by hand in remove_proc_entry(). For this, save opener's credentials
303 * for later.
304 */
305 pdeo = kmalloc(sizeof(struct pde_opener), GFP_KERNEL);
306 if (!pdeo)
307 return -ENOMEM;
308
309 spin_lock(&pde->pde_unload_lock);
310 if (!pde->proc_fops) {
311 spin_unlock(&pde->pde_unload_lock);
312 kfree(pdeo);
313 return -EINVAL;
314 }
315 pde->pde_users++;
316 open = pde->proc_fops->open;
317 release = pde->proc_fops->release;
318 spin_unlock(&pde->pde_unload_lock);
319
320 if (open)
321 rv = open(inode, file);
322
323 spin_lock(&pde->pde_unload_lock);
324 if (rv == 0 && release) {
325 /* To know what to release. */
326 pdeo->inode = inode;
327 pdeo->file = file;
328 /* Strictly for "too late" ->release in proc_reg_release(). */
329 pdeo->release = release;
330 list_add(&pdeo->lh, &pde->pde_openers);
331 } else
332 kfree(pdeo);
333 __pde_users_dec(pde);
334 spin_unlock(&pde->pde_unload_lock);
335 return rv;
336}
337
338static struct pde_opener *find_pde_opener(struct proc_dir_entry *pde,
339 struct inode *inode, struct file *file)
340{
341 struct pde_opener *pdeo;
342
343 list_for_each_entry(pdeo, &pde->pde_openers, lh) {
344 if (pdeo->inode == inode && pdeo->file == file)
345 return pdeo;
346 }
347 return NULL;
348}
349
350static int proc_reg_release(struct inode *inode, struct file *file)
351{
352 struct proc_dir_entry *pde = PDE(inode);
353 int rv = 0;
354 int (*release)(struct inode *, struct file *);
355 struct pde_opener *pdeo;
356
357 spin_lock(&pde->pde_unload_lock);
358 pdeo = find_pde_opener(pde, inode, file);
359 if (!pde->proc_fops) {
360 /*
361 * Can't simply exit, __fput() will think that everything is OK,
362 * and move on to freeing struct file. remove_proc_entry() will
363 * find slacker in opener's list and will try to do non-trivial
364 * things with struct file. Therefore, remove opener from list.
365 *
366 * But if opener is removed from list, who will ->release it?
367 */
368 if (pdeo) {
369 list_del(&pdeo->lh);
370 spin_unlock(&pde->pde_unload_lock);
371 rv = pdeo->release(inode, file);
372 kfree(pdeo);
373 } else
374 spin_unlock(&pde->pde_unload_lock);
375 return rv;
376 }
377 pde->pde_users++;
378 release = pde->proc_fops->release;
379 if (pdeo) {
380 list_del(&pdeo->lh);
381 kfree(pdeo);
382 }
383 spin_unlock(&pde->pde_unload_lock);
384
385 if (release)
386 rv = release(inode, file);
387
388 pde_users_dec(pde);
389 return rv;
390}
391
392static const struct file_operations proc_reg_file_ops = {
393 .llseek = proc_reg_llseek,
394 .read = proc_reg_read,
395 .write = proc_reg_write,
396 .poll = proc_reg_poll,
397 .unlocked_ioctl = proc_reg_unlocked_ioctl,
398#ifdef CONFIG_COMPAT
399 .compat_ioctl = proc_reg_compat_ioctl,
400#endif
401 .mmap = proc_reg_mmap,
402 .open = proc_reg_open,
403 .release = proc_reg_release,
404};
405
406#ifdef CONFIG_COMPAT
407static const struct file_operations proc_reg_file_ops_no_compat = {
408 .llseek = proc_reg_llseek,
409 .read = proc_reg_read,
410 .write = proc_reg_write,
411 .poll = proc_reg_poll,
412 .unlocked_ioctl = proc_reg_unlocked_ioctl,
413 .mmap = proc_reg_mmap,
414 .open = proc_reg_open,
415 .release = proc_reg_release,
416};
417#endif
418
419struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
420{
421 struct inode * inode;
422
423 inode = iget_locked(sb, de->low_ino);
424 if (!inode)
425 return NULL;
426 if (inode->i_state & I_NEW) {
427 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
428 PROC_I(inode)->fd = 0;
429 PROC_I(inode)->pde = de;
430
431 if (de->mode) {
432 inode->i_mode = de->mode;
433 inode->i_uid = de->uid;
434 inode->i_gid = de->gid;
435 }
436 if (de->size)
437 inode->i_size = de->size;
438 if (de->nlink)
439 inode->i_nlink = de->nlink;
440 if (de->proc_iops)
441 inode->i_op = de->proc_iops;
442 if (de->proc_fops) {
443 if (S_ISREG(inode->i_mode)) {
444#ifdef CONFIG_COMPAT
445 if (!de->proc_fops->compat_ioctl)
446 inode->i_fop =
447 &proc_reg_file_ops_no_compat;
448 else
449#endif
450 inode->i_fop = &proc_reg_file_ops;
451 } else {
452 inode->i_fop = de->proc_fops;
453 }
454 }
455 unlock_new_inode(inode);
456 } else
457 pde_put(de);
458 return inode;
459}
460
461int proc_fill_super(struct super_block *s)
462{
463 struct inode * root_inode;
464
465 s->s_flags |= MS_NODIRATIME | MS_NOSUID | MS_NOEXEC;
466 s->s_blocksize = 1024;
467 s->s_blocksize_bits = 10;
468 s->s_magic = PROC_SUPER_MAGIC;
469 s->s_op = &proc_sops;
470 s->s_time_gran = 1;
471
472 pde_get(&proc_root);
473 root_inode = proc_get_inode(s, &proc_root);
474 if (!root_inode)
475 goto out_no_root;
476 root_inode->i_uid = 0;
477 root_inode->i_gid = 0;
478 s->s_root = d_alloc_root(root_inode);
479 if (!s->s_root)
480 goto out_no_root;
481 return 0;
482
483out_no_root:
484 printk("proc_read_super: get root inode failed\n");
485 iput(root_inode);
486 pde_put(&proc_root);
487 return -ENOMEM;
488}