2 * Copyright 2008 Red Hat, Inc. All rights reserved.
3 * Copyright 2008 Ian Kent <raven@themaw.net>
5 * This file is part of the Linux kernel and is made available under
6 * the terms of the GNU General Public License, version 2, or at your
7 * option, any later version, incorporated herein by reference.
10 #include <linux/module.h>
11 #include <linux/vmalloc.h>
12 #include <linux/miscdevice.h>
13 #include <linux/init.h>
14 #include <linux/wait.h>
15 #include <linux/namei.h>
16 #include <linux/fcntl.h>
17 #include <linux/file.h>
18 #include <linux/fdtable.h>
19 #include <linux/sched.h>
20 #include <linux/cred.h>
21 #include <linux/compat.h>
22 #include <linux/syscalls.h>
23 #include <linux/magic.h>
24 #include <linux/dcache.h>
25 #include <linux/uaccess.h>
26 #include <linux/slab.h>
31 * This module implements an interface for routing autofs ioctl control
32 * commands via a miscellaneous device file.
34 * The alternate interface is needed because we need to be able open
35 * an ioctl file descriptor on an autofs mount that may be covered by
36 * another mount. This situation arises when starting automount(8)
37 * or other user space daemon which uses direct mounts or offset
38 * mounts (used for autofs lazy mount/umount of nested mount trees),
39 * which have been left busy at at service shutdown.
42 typedef int (*ioctl_fn
)(struct file
*, struct autofs_sb_info
*,
43 struct autofs_dev_ioctl
*);
45 static int check_name(const char *name
)
47 if (!strchr(name
, '/'))
53 * Check a string doesn't overrun the chunk of
54 * memory we copied from user land.
56 static int invalid_str(char *str
, size_t size
)
58 if (memchr(str
, 0, size
))
64 * Check that the user compiled against correct version of autofs
67 * As well as checking the version compatibility this always copies
68 * the kernel interface version out.
70 static int check_dev_ioctl_version(int cmd
, struct autofs_dev_ioctl
*param
)
74 if ((param
->ver_major
!= AUTOFS_DEV_IOCTL_VERSION_MAJOR
) ||
75 (param
->ver_minor
> AUTOFS_DEV_IOCTL_VERSION_MINOR
)) {
76 pr_warn("ioctl control interface version mismatch: "
77 "kernel(%u.%u), user(%u.%u), cmd(0x%08x)\n",
78 AUTOFS_DEV_IOCTL_VERSION_MAJOR
,
79 AUTOFS_DEV_IOCTL_VERSION_MINOR
,
80 param
->ver_major
, param
->ver_minor
, cmd
);
84 /* Fill in the kernel version. */
85 param
->ver_major
= AUTOFS_DEV_IOCTL_VERSION_MAJOR
;
86 param
->ver_minor
= AUTOFS_DEV_IOCTL_VERSION_MINOR
;
92 * Copy parameter control struct, including a possible path allocated
93 * at the end of the struct.
95 static struct autofs_dev_ioctl
*
96 copy_dev_ioctl(struct autofs_dev_ioctl __user
*in
)
98 struct autofs_dev_ioctl tmp
, *res
;
100 if (copy_from_user(&tmp
, in
, AUTOFS_DEV_IOCTL_SIZE
))
101 return ERR_PTR(-EFAULT
);
103 if (tmp
.size
< AUTOFS_DEV_IOCTL_SIZE
)
104 return ERR_PTR(-EINVAL
);
106 if (tmp
.size
> AUTOFS_DEV_IOCTL_SIZE
+ PATH_MAX
)
107 return ERR_PTR(-ENAMETOOLONG
);
109 res
= memdup_user(in
, tmp
.size
);
111 res
->size
= tmp
.size
;
116 static inline void free_dev_ioctl(struct autofs_dev_ioctl
*param
)
122 * Check sanity of parameter control fields and if a path is present
123 * check that it is terminated and contains at least one "/".
125 static int validate_dev_ioctl(int cmd
, struct autofs_dev_ioctl
*param
)
129 err
= check_dev_ioctl_version(cmd
, param
);
131 pr_warn("invalid device control module version "
132 "supplied for cmd(0x%08x)\n", cmd
);
136 if (param
->size
> AUTOFS_DEV_IOCTL_SIZE
) {
137 err
= invalid_str(param
->path
, param
->size
- AUTOFS_DEV_IOCTL_SIZE
);
140 "path string terminator missing for cmd(0x%08x)\n",
145 err
= check_name(param
->path
);
147 pr_warn("invalid path supplied for cmd(0x%08x)\n",
152 unsigned int inr
= _IOC_NR(cmd
);
154 if (inr
== AUTOFS_DEV_IOCTL_OPENMOUNT_CMD
||
155 inr
== AUTOFS_DEV_IOCTL_REQUESTER_CMD
||
156 inr
== AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD
) {
168 * Get the autofs super block info struct from the file opened on
169 * the autofs mount point.
171 static struct autofs_sb_info
*autofs_dev_ioctl_sbi(struct file
*f
)
173 struct autofs_sb_info
*sbi
= NULL
;
177 inode
= file_inode(f
);
178 sbi
= autofs4_sbi(inode
->i_sb
);
183 /* Return autofs dev ioctl version */
184 static int autofs_dev_ioctl_version(struct file
*fp
,
185 struct autofs_sb_info
*sbi
,
186 struct autofs_dev_ioctl
*param
)
188 /* This should have already been set. */
189 param
->ver_major
= AUTOFS_DEV_IOCTL_VERSION_MAJOR
;
190 param
->ver_minor
= AUTOFS_DEV_IOCTL_VERSION_MINOR
;
194 /* Return autofs module protocol version */
195 static int autofs_dev_ioctl_protover(struct file
*fp
,
196 struct autofs_sb_info
*sbi
,
197 struct autofs_dev_ioctl
*param
)
199 param
->protover
.version
= sbi
->version
;
203 /* Return autofs module protocol sub version */
204 static int autofs_dev_ioctl_protosubver(struct file
*fp
,
205 struct autofs_sb_info
*sbi
,
206 struct autofs_dev_ioctl
*param
)
208 param
->protosubver
.sub_version
= sbi
->sub_version
;
212 /* Find the topmost mount satisfying test() */
213 static int find_autofs_mount(const char *pathname
,
215 int test(const struct path
*path
, void *data
),
221 err
= kern_path_mountpoint(AT_FDCWD
, pathname
, &path
, 0);
225 while (path
.dentry
== path
.mnt
->mnt_root
) {
226 if (path
.dentry
->d_sb
->s_magic
== AUTOFS_SUPER_MAGIC
) {
227 if (test(&path
, data
)) {
234 if (!follow_up(&path
))
241 static int test_by_dev(const struct path
*path
, void *p
)
243 return path
->dentry
->d_sb
->s_dev
== *(dev_t
*)p
;
246 static int test_by_type(const struct path
*path
, void *p
)
248 struct autofs_info
*ino
= autofs4_dentry_ino(path
->dentry
);
250 return ino
&& ino
->sbi
->type
& *(unsigned *)p
;
254 * Open a file descriptor on the autofs mount point corresponding
255 * to the given path and device number (aka. new_encode_dev(sb->s_dev)).
257 static int autofs_dev_ioctl_open_mountpoint(const char *name
, dev_t devid
)
261 fd
= get_unused_fd_flags(O_CLOEXEC
);
262 if (likely(fd
>= 0)) {
266 err
= find_autofs_mount(name
, &path
, test_by_dev
, &devid
);
270 filp
= dentry_open(&path
, O_RDONLY
, current_cred());
277 fd_install(fd
, filp
);
287 /* Open a file descriptor on an autofs mount point */
288 static int autofs_dev_ioctl_openmount(struct file
*fp
,
289 struct autofs_sb_info
*sbi
,
290 struct autofs_dev_ioctl
*param
)
296 /* param->path has been checked in validate_dev_ioctl() */
298 if (!param
->openmount
.devid
)
304 devid
= new_decode_dev(param
->openmount
.devid
);
307 fd
= autofs_dev_ioctl_open_mountpoint(path
, devid
);
308 if (unlikely(fd
< 0)) {
318 /* Close file descriptor allocated above (user can also use close(2)). */
319 static int autofs_dev_ioctl_closemount(struct file
*fp
,
320 struct autofs_sb_info
*sbi
,
321 struct autofs_dev_ioctl
*param
)
323 return sys_close(param
->ioctlfd
);
327 * Send "ready" status for an existing wait (either a mount or an expire
330 static int autofs_dev_ioctl_ready(struct file
*fp
,
331 struct autofs_sb_info
*sbi
,
332 struct autofs_dev_ioctl
*param
)
336 token
= (autofs_wqt_t
) param
->ready
.token
;
337 return autofs4_wait_release(sbi
, token
, 0);
341 * Send "fail" status for an existing wait (either a mount or an expire
344 static int autofs_dev_ioctl_fail(struct file
*fp
,
345 struct autofs_sb_info
*sbi
,
346 struct autofs_dev_ioctl
*param
)
351 token
= (autofs_wqt_t
) param
->fail
.token
;
352 status
= param
->fail
.status
< 0 ? param
->fail
.status
: -ENOENT
;
353 return autofs4_wait_release(sbi
, token
, status
);
357 * Set the pipe fd for kernel communication to the daemon.
359 * Normally this is set at mount using an option but if we
360 * are reconnecting to a busy mount then we need to use this
361 * to tell the autofs mount about the new kernel pipe fd. In
362 * order to protect mounts against incorrectly setting the
363 * pipefd we also require that the autofs mount be catatonic.
365 * This also sets the process group id used to identify the
366 * controlling process (eg. the owning automount(8) daemon).
368 static int autofs_dev_ioctl_setpipefd(struct file
*fp
,
369 struct autofs_sb_info
*sbi
,
370 struct autofs_dev_ioctl
*param
)
374 struct pid
*new_pid
= NULL
;
376 if (param
->setpipefd
.pipefd
== -1)
379 pipefd
= param
->setpipefd
.pipefd
;
381 mutex_lock(&sbi
->wq_mutex
);
382 if (!sbi
->catatonic
) {
383 mutex_unlock(&sbi
->wq_mutex
);
388 new_pid
= get_task_pid(current
, PIDTYPE_PGID
);
390 if (ns_of_pid(new_pid
) != ns_of_pid(sbi
->oz_pgrp
)) {
391 pr_warn("not allowed to change PID namespace\n");
401 if (autofs_prepare_pipe(pipe
) < 0) {
406 swap(sbi
->oz_pgrp
, new_pid
);
407 sbi
->pipefd
= pipefd
;
413 mutex_unlock(&sbi
->wq_mutex
);
418 * Make the autofs mount point catatonic, no longer responsive to
419 * mount requests. Also closes the kernel pipe file descriptor.
421 static int autofs_dev_ioctl_catatonic(struct file
*fp
,
422 struct autofs_sb_info
*sbi
,
423 struct autofs_dev_ioctl
*param
)
425 autofs4_catatonic_mode(sbi
);
429 /* Set the autofs mount timeout */
430 static int autofs_dev_ioctl_timeout(struct file
*fp
,
431 struct autofs_sb_info
*sbi
,
432 struct autofs_dev_ioctl
*param
)
434 unsigned long timeout
;
436 timeout
= param
->timeout
.timeout
;
437 param
->timeout
.timeout
= sbi
->exp_timeout
/ HZ
;
438 sbi
->exp_timeout
= timeout
* HZ
;
443 * Return the uid and gid of the last request for the mount
445 * When reconstructing an autofs mount tree with active mounts
446 * we need to re-connect to mounts that may have used the original
447 * process uid and gid (or string variations of them) for mount
448 * lookups within the map entry.
450 static int autofs_dev_ioctl_requester(struct file
*fp
,
451 struct autofs_sb_info
*sbi
,
452 struct autofs_dev_ioctl
*param
)
454 struct autofs_info
*ino
;
459 /* param->path has been checked in validate_dev_ioctl() */
461 devid
= sbi
->sb
->s_dev
;
463 param
->requester
.uid
= param
->requester
.gid
= -1;
465 err
= find_autofs_mount(param
->path
, &path
, test_by_dev
, &devid
);
469 ino
= autofs4_dentry_ino(path
.dentry
);
472 autofs4_expire_wait(&path
, 0);
473 spin_lock(&sbi
->fs_lock
);
474 param
->requester
.uid
=
475 from_kuid_munged(current_user_ns(), ino
->uid
);
476 param
->requester
.gid
=
477 from_kgid_munged(current_user_ns(), ino
->gid
);
478 spin_unlock(&sbi
->fs_lock
);
486 * Call repeatedly until it returns -EAGAIN, meaning there's nothing
487 * more that can be done.
489 static int autofs_dev_ioctl_expire(struct file
*fp
,
490 struct autofs_sb_info
*sbi
,
491 struct autofs_dev_ioctl
*param
)
493 struct vfsmount
*mnt
;
496 how
= param
->expire
.how
;
497 mnt
= fp
->f_path
.mnt
;
499 return autofs4_do_expire_multi(sbi
->sb
, mnt
, sbi
, how
);
502 /* Check if autofs mount point is in use */
503 static int autofs_dev_ioctl_askumount(struct file
*fp
,
504 struct autofs_sb_info
*sbi
,
505 struct autofs_dev_ioctl
*param
)
507 param
->askumount
.may_umount
= 0;
508 if (may_umount(fp
->f_path
.mnt
))
509 param
->askumount
.may_umount
= 1;
514 * Check if the given path is a mountpoint.
516 * If we are supplied with the file descriptor of an autofs
517 * mount we're looking for a specific mount. In this case
518 * the path is considered a mountpoint if it is itself a
519 * mountpoint or contains a mount, such as a multi-mount
520 * without a root mount. In this case we return 1 if the
521 * path is a mount point and the super magic of the covering
522 * mount if there is one or 0 if it isn't a mountpoint.
524 * If we aren't supplied with a file descriptor then we
525 * lookup the path and check if it is the root of a mount.
526 * If a type is given we are looking for a particular autofs
527 * mount and if we don't find a match we return fail. If the
528 * located path is the root of a mount we return 1 along with
529 * the super magic of the mount or 0 otherwise.
531 * In both cases the the device number (as returned by
532 * new_encode_dev()) is also returned.
534 static int autofs_dev_ioctl_ismountpoint(struct file
*fp
,
535 struct autofs_sb_info
*sbi
,
536 struct autofs_dev_ioctl
*param
)
541 unsigned int devid
, magic
;
544 /* param->path has been checked in validate_dev_ioctl() */
547 type
= param
->ismountpoint
.in
.type
;
549 param
->ismountpoint
.out
.devid
= devid
= 0;
550 param
->ismountpoint
.out
.magic
= magic
= 0;
552 if (!fp
|| param
->ioctlfd
== -1) {
553 if (autofs_type_any(type
))
554 err
= kern_path_mountpoint(AT_FDCWD
,
555 name
, &path
, LOOKUP_FOLLOW
);
557 err
= find_autofs_mount(name
, &path
,
558 test_by_type
, &type
);
561 devid
= new_encode_dev(path
.dentry
->d_sb
->s_dev
);
563 if (path
.mnt
->mnt_root
== path
.dentry
) {
565 magic
= path
.dentry
->d_sb
->s_magic
;
568 dev_t dev
= sbi
->sb
->s_dev
;
570 err
= find_autofs_mount(name
, &path
, test_by_dev
, &dev
);
574 devid
= new_encode_dev(dev
);
576 err
= path_has_submounts(&path
);
578 if (follow_down_one(&path
))
579 magic
= path
.dentry
->d_sb
->s_magic
;
582 param
->ismountpoint
.out
.devid
= devid
;
583 param
->ismountpoint
.out
.magic
= magic
;
590 * Our range of ioctl numbers isn't 0 based so we need to shift
591 * the array index by _IOC_NR(AUTOFS_CTL_IOC_FIRST) for the table
594 #define cmd_idx(cmd) (cmd - _IOC_NR(AUTOFS_DEV_IOCTL_IOC_FIRST))
596 static ioctl_fn
lookup_dev_ioctl(unsigned int cmd
)
598 static ioctl_fn _ioctls
[] = {
599 autofs_dev_ioctl_version
,
600 autofs_dev_ioctl_protover
,
601 autofs_dev_ioctl_protosubver
,
602 autofs_dev_ioctl_openmount
,
603 autofs_dev_ioctl_closemount
,
604 autofs_dev_ioctl_ready
,
605 autofs_dev_ioctl_fail
,
606 autofs_dev_ioctl_setpipefd
,
607 autofs_dev_ioctl_catatonic
,
608 autofs_dev_ioctl_timeout
,
609 autofs_dev_ioctl_requester
,
610 autofs_dev_ioctl_expire
,
611 autofs_dev_ioctl_askumount
,
612 autofs_dev_ioctl_ismountpoint
,
614 unsigned int idx
= cmd_idx(cmd
);
616 return (idx
>= ARRAY_SIZE(_ioctls
)) ? NULL
: _ioctls
[idx
];
619 /* ioctl dispatcher */
620 static int _autofs_dev_ioctl(unsigned int command
,
621 struct autofs_dev_ioctl __user
*user
)
623 struct autofs_dev_ioctl
*param
;
625 struct autofs_sb_info
*sbi
;
626 unsigned int cmd_first
, cmd
;
630 cmd_first
= _IOC_NR(AUTOFS_DEV_IOCTL_IOC_FIRST
);
631 cmd
= _IOC_NR(command
);
633 if (_IOC_TYPE(command
) != _IOC_TYPE(AUTOFS_DEV_IOCTL_IOC_FIRST
) ||
634 cmd
- cmd_first
> AUTOFS_DEV_IOCTL_IOC_COUNT
) {
638 /* Only root can use ioctls other than AUTOFS_DEV_IOCTL_VERSION_CMD
639 * and AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD
641 if (cmd
!= AUTOFS_DEV_IOCTL_VERSION_CMD
&&
642 cmd
!= AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD
&&
643 !capable(CAP_SYS_ADMIN
))
646 /* Copy the parameters into kernel space. */
647 param
= copy_dev_ioctl(user
);
649 return PTR_ERR(param
);
651 err
= validate_dev_ioctl(command
, param
);
655 fn
= lookup_dev_ioctl(cmd
);
657 pr_warn("unknown command 0x%08x\n", command
);
666 * For obvious reasons the openmount can't have a file
667 * descriptor yet. We don't take a reference to the
668 * file during close to allow for immediate release,
669 * and the same for retrieving ioctl version.
671 if (cmd
!= AUTOFS_DEV_IOCTL_VERSION_CMD
&&
672 cmd
!= AUTOFS_DEV_IOCTL_OPENMOUNT_CMD
&&
673 cmd
!= AUTOFS_DEV_IOCTL_CLOSEMOUNT_CMD
) {
674 fp
= fget(param
->ioctlfd
);
676 if (cmd
== AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD
)
682 sbi
= autofs_dev_ioctl_sbi(fp
);
683 if (!sbi
|| sbi
->magic
!= AUTOFS_SBI_MAGIC
) {
690 * Admin needs to be able to set the mount catatonic in
691 * order to be able to perform the re-open.
693 if (!autofs4_oz_mode(sbi
) &&
694 cmd
!= AUTOFS_DEV_IOCTL_CATATONIC_CMD
) {
701 err
= fn(fp
, sbi
, param
);
705 if (err
>= 0 && copy_to_user(user
, param
, AUTOFS_DEV_IOCTL_SIZE
))
708 free_dev_ioctl(param
);
712 static long autofs_dev_ioctl(struct file
*file
, unsigned int command
,
717 err
= _autofs_dev_ioctl(command
, (struct autofs_dev_ioctl __user
*) u
);
722 static long autofs_dev_ioctl_compat(struct file
*file
, unsigned int command
,
725 return autofs_dev_ioctl(file
, command
, (unsigned long) compat_ptr(u
));
728 #define autofs_dev_ioctl_compat NULL
731 static const struct file_operations _dev_ioctl_fops
= {
732 .unlocked_ioctl
= autofs_dev_ioctl
,
733 .compat_ioctl
= autofs_dev_ioctl_compat
,
734 .owner
= THIS_MODULE
,
735 .llseek
= noop_llseek
,
738 static struct miscdevice _autofs_dev_ioctl_misc
= {
739 .minor
= AUTOFS_MINOR
,
740 .name
= AUTOFS_DEVICE_NAME
,
741 .fops
= &_dev_ioctl_fops
,
745 MODULE_ALIAS_MISCDEV(AUTOFS_MINOR
);
746 MODULE_ALIAS("devname:autofs");
748 /* Register/deregister misc character device */
749 int __init
autofs_dev_ioctl_init(void)
753 r
= misc_register(&_autofs_dev_ioctl_misc
);
755 pr_err("misc_register failed for control device\n");
762 void autofs_dev_ioctl_exit(void)
764 misc_deregister(&_autofs_dev_ioctl_misc
);