1 /* 2 * linux/drivers/block/loop.c 3 * 4 * Written by Theodore Ts'o, 3/29/93 5 * 6 * Copyright 1993 by Theodore Ts'o. Redistribution of this file is 7 * permitted under the GNU General Public License. 8 * 9 * DES encryption plus some minor changes by Werner Almesberger, 30-MAY-1993 10 * more DES encryption plus IDEA encryption by Nicholas J. Leon, June 20, 1996 11 * 12 * Modularized and updated for 1.1.16 kernel - Mitch Dsouza 28th May 1994 13 * Adapted for 1.3.59 kernel - Andries Brouwer, 1 Feb 1996 14 * 15 * Fixed do_loop_request() re-entrancy - Vincent.Renardias@waw.com Mar 20, 1997 16 * 17 * Added devfs support - Richard Gooch <rgooch@atnf.csiro.au> 16-Jan-1998 18 * 19 * Handle sparse backing files correctly - Kenn Humborg, Jun 28, 1998 20 * 21 * Loadable modules and other fixes by AK, 1998 22 * 23 * Make real block number available to downstream transfer functions, enables 24 * CBC (and relatives) mode encryption requiring unique IVs per data block. 25 * Reed H. Petty, rhp@draper.net 26 * 27 * Maximum number of loop devices now dynamic via max_loop module parameter. 28 * Russell Kroll <rkroll@exploits.org> 19990701 29 * 30 * Maximum number of loop devices when compiled-in now selectable by passing 31 * max_loop=<1-255> to the kernel on boot. 32 * Erik I. Bolsø, <eriki@himolde.no>, Oct 31, 1999 33 * 34 * Completely rewrite request handling to be make_request_fn style and 35 * non blocking, pushing work to a helper thread. Lots of fixes from 36 * Al Viro too. 37 * Jens Axboe <axboe@suse.de>, Nov 2000 38 * 39 * Support up to 256 loop devices 40 * Heinz Mauelshagen <mge@sistina.com>, Feb 2002 41 * 42 * Support for falling back on the write file operation when the address space 43 * operations write_begin is not available on the backing filesystem. 44 * Anton Altaparmakov, 16 Feb 2005 45 * 46 * Still To Fix: 47 * - Advisory locking is ignored here. 48 * - Should use an own CAP_* category instead of CAP_SYS_ADMIN 49 * 50 */ 51 52 #include <linux/module.h> 53 #include <linux/moduleparam.h> 54 #include <linux/sched.h> 55 #include <linux/fs.h> 56 #include <linux/file.h> 57 #include <linux/stat.h> 58 #include <linux/errno.h> 59 #include <linux/major.h> 60 #include <linux/wait.h> 61 #include <linux/blkdev.h> 62 #include <linux/blkpg.h> 63 #include <linux/init.h> 64 #include <linux/swap.h> 65 #include <linux/slab.h> 66 #include <linux/loop.h> 67 #include <linux/compat.h> 68 #include <linux/suspend.h> 69 #include <linux/freezer.h> 70 #include <linux/mutex.h> 71 #include <linux/writeback.h> 72 #include <linux/buffer_head.h> /* for invalidate_bdev() */ 73 #include <linux/completion.h> 74 #include <linux/highmem.h> 75 #include <linux/kthread.h> 76 #include <linux/splice.h> 77 #include <linux/sysfs.h> 78 #include <linux/falloc.h> 79 80 #include <asm/uaccess.h> 81 82 static LIST_HEAD(loop_devices); 83 static DEFINE_MUTEX(loop_devices_mutex); 84 85 static int max_part; 86 static int part_shift; 87 88 /* 89 * Transfer functions 90 */ 91 static int transfer_none(struct loop_device *lo, int cmd, 92 struct page *raw_page, unsigned raw_off, 93 struct page *loop_page, unsigned loop_off, 94 int size, sector_t real_block) 95 { 96 char *raw_buf = kmap_atomic(raw_page, KM_USER0) + raw_off; 97 char *loop_buf = kmap_atomic(loop_page, KM_USER1) + loop_off; 98 99 if (cmd == READ) 100 memcpy(loop_buf, raw_buf, size); 101 else 102 memcpy(raw_buf, loop_buf, size); 103 104 kunmap_atomic(loop_buf, KM_USER1); 105 kunmap_atomic(raw_buf, KM_USER0); 106 cond_resched(); 107 return 0; 108 } 109 110 static int transfer_xor(struct loop_device *lo, int cmd, 111 struct page *raw_page, unsigned raw_off, 112 struct page *loop_page, unsigned loop_off, 113 int size, sector_t real_block) 114 { 115 char *raw_buf = kmap_atomic(raw_page, KM_USER0) + raw_off; 116 char *loop_buf = kmap_atomic(loop_page, KM_USER1) + loop_off; 117 char *in, *out, *key; 118 int i, keysize; 119 120 if (cmd == READ) { 121 in = raw_buf; 122 out = loop_buf; 123 } else { 124 in = loop_buf; 125 out = raw_buf; 126 } 127 128 key = lo->lo_encrypt_key; 129 keysize = lo->lo_encrypt_key_size; 130 for (i = 0; i < size; i++) 131 *out++ = *in++ ^ key[(i & 511) % keysize]; 132 133 kunmap_atomic(loop_buf, KM_USER1); 134 kunmap_atomic(raw_buf, KM_USER0); 135 cond_resched(); 136 return 0; 137 } 138 139 static int xor_init(struct loop_device *lo, const struct loop_info64 *info) 140 { 141 if (unlikely(info->lo_encrypt_key_size <= 0)) 142 return -EINVAL; 143 return 0; 144 } 145 146 static struct loop_func_table none_funcs = { 147 .number = LO_CRYPT_NONE, 148 .transfer = transfer_none, 149 }; 150 151 static struct loop_func_table xor_funcs = { 152 .number = LO_CRYPT_XOR, 153 .transfer = transfer_xor, 154 .init = xor_init 155 }; 156 157 /* xfer_funcs[0] is special - its release function is never called */ 158 static struct loop_func_table *xfer_funcs[MAX_LO_CRYPT] = { 159 &none_funcs, 160 &xor_funcs 161 }; 162 163 static loff_t get_loop_size(struct loop_device *lo, struct file *file) 164 { 165 loff_t size, offset, loopsize; 166 167 /* Compute loopsize in bytes */ 168 size = i_size_read(file->f_mapping->host); 169 offset = lo->lo_offset; 170 loopsize = size - offset; 171 if (lo->lo_sizelimit > 0 && lo->lo_sizelimit < loopsize) 172 loopsize = lo->lo_sizelimit; 173 174 /* 175 * Unfortunately, if we want to do I/O on the device, 176 * the number of 512-byte sectors has to fit into a sector_t. 177 */ 178 return loopsize >> 9; 179 } 180 181 static int 182 figure_loop_size(struct loop_device *lo) 183 { 184 loff_t size = get_loop_size(lo, lo->lo_backing_file); 185 sector_t x = (sector_t)size; 186 187 if (unlikely((loff_t)x != size)) 188 return -EFBIG; 189 190 set_capacity(lo->lo_disk, x); 191 return 0; 192 } 193 194 static inline int 195 lo_do_transfer(struct loop_device *lo, int cmd, 196 struct page *rpage, unsigned roffs, 197 struct page *lpage, unsigned loffs, 198 int size, sector_t rblock) 199 { 200 if (unlikely(!lo->transfer)) 201 return 0; 202 203 return lo->transfer(lo, cmd, rpage, roffs, lpage, loffs, size, rblock); 204 } 205 206 /** 207 * do_lo_send_aops - helper for writing data to a loop device 208 * 209 * This is the fast version for backing filesystems which implement the address 210 * space operations write_begin and write_end. 211 */ 212 static int do_lo_send_aops(struct loop_device *lo, struct bio_vec *bvec, 213 loff_t pos, struct page *unused) 214 { 215 struct file *file = lo->lo_backing_file; /* kudos to NFsckingS */ 216 struct address_space *mapping = file->f_mapping; 217 pgoff_t index; 218 unsigned offset, bv_offs; 219 int len, ret; 220 221 mutex_lock(&mapping->host->i_mutex); 222 index = pos >> PAGE_CACHE_SHIFT; 223 offset = pos & ((pgoff_t)PAGE_CACHE_SIZE - 1); 224 bv_offs = bvec->bv_offset; 225 len = bvec->bv_len; 226 while (len > 0) { 227 sector_t IV; 228 unsigned size, copied; 229 int transfer_result; 230 struct page *page; 231 void *fsdata; 232 233 IV = ((sector_t)index << (PAGE_CACHE_SHIFT - 9))+(offset >> 9); 234 size = PAGE_CACHE_SIZE - offset; 235 if (size > len) 236 size = len; 237 238 ret = pagecache_write_begin(file, mapping, pos, size, 0, 239 &page, &fsdata); 240 if (ret) 241 goto fail; 242 243 file_update_time(file); 244 245 transfer_result = lo_do_transfer(lo, WRITE, page, offset, 246 bvec->bv_page, bv_offs, size, IV); 247 copied = size; 248 if (unlikely(transfer_result)) 249 copied = 0; 250 251 ret = pagecache_write_end(file, mapping, pos, size, copied, 252 page, fsdata); 253 if (ret < 0 || ret != copied) 254 goto fail; 255 256 if (unlikely(transfer_result)) 257 goto fail; 258 259 bv_offs += copied; 260 len -= copied; 261 offset = 0; 262 index++; 263 pos += copied; 264 } 265 ret = 0; 266 out: 267 mutex_unlock(&mapping->host->i_mutex); 268 return ret; 269 fail: 270 ret = -1; 271 goto out; 272 } 273 274 /** 275 * __do_lo_send_write - helper for writing data to a loop device 276 * 277 * This helper just factors out common code between do_lo_send_direct_write() 278 * and do_lo_send_write(). 279 */ 280 static int __do_lo_send_write(struct file *file, 281 u8 *buf, const int len, loff_t pos) 282 { 283 ssize_t bw; 284 mm_segment_t old_fs = get_fs(); 285 286 set_fs(get_ds()); 287 bw = file->f_op->write(file, buf, len, &pos); 288 set_fs(old_fs); 289 if (likely(bw == len)) 290 return 0; 291 printk(KERN_ERR "loop: Write error at byte offset %llu, length %i.\n", 292 (unsigned long long)pos, len); 293 if (bw >= 0) 294 bw = -EIO; 295 return bw; 296 } 297 298 /** 299 * do_lo_send_direct_write - helper for writing data to a loop device 300 * 301 * This is the fast, non-transforming version for backing filesystems which do 302 * not implement the address space operations write_begin and write_end. 303 * It uses the write file operation which should be present on all writeable 304 * filesystems. 305 */ 306 static int do_lo_send_direct_write(struct loop_device *lo, 307 struct bio_vec *bvec, loff_t pos, struct page *page) 308 { 309 ssize_t bw = __do_lo_send_write(lo->lo_backing_file, 310 kmap(bvec->bv_page) + bvec->bv_offset, 311 bvec->bv_len, pos); 312 kunmap(bvec->bv_page); 313 cond_resched(); 314 return bw; 315 } 316 317 /** 318 * do_lo_send_write - helper for writing data to a loop device 319 * 320 * This is the slow, transforming version for filesystems which do not 321 * implement the address space operations write_begin and write_end. It 322 * uses the write file operation which should be present on all writeable 323 * filesystems. 324 * 325 * Using fops->write is slower than using aops->{prepare,commit}_write in the 326 * transforming case because we need to double buffer the data as we cannot do 327 * the transformations in place as we do not have direct access to the 328 * destination pages of the backing file. 329 */ 330 static int do_lo_send_write(struct loop_device *lo, struct bio_vec *bvec, 331 loff_t pos, struct page *page) 332 { 333 int ret = lo_do_transfer(lo, WRITE, page, 0, bvec->bv_page, 334 bvec->bv_offset, bvec->bv_len, pos >> 9); 335 if (likely(!ret)) 336 return __do_lo_send_write(lo->lo_backing_file, 337 page_address(page), bvec->bv_len, 338 pos); 339 printk(KERN_ERR "loop: Transfer error at byte offset %llu, " 340 "length %i.\n", (unsigned long long)pos, bvec->bv_len); 341 if (ret > 0) 342 ret = -EIO; 343 return ret; 344 } 345 346 static int lo_send(struct loop_device *lo, struct bio *bio, loff_t pos) 347 { 348 int (*do_lo_send)(struct loop_device *, struct bio_vec *, loff_t, 349 struct page *page); 350 struct bio_vec *bvec; 351 struct page *page = NULL; 352 int i, ret = 0; 353 354 do_lo_send = do_lo_send_aops; 355 if (!(lo->lo_flags & LO_FLAGS_USE_AOPS)) { 356 do_lo_send = do_lo_send_direct_write; 357 if (lo->transfer != transfer_none) { 358 page = alloc_page(GFP_NOIO | __GFP_HIGHMEM); 359 if (unlikely(!page)) 360 goto fail; 361 kmap(page); 362 do_lo_send = do_lo_send_write; 363 } 364 } 365 bio_for_each_segment(bvec, bio, i) { 366 ret = do_lo_send(lo, bvec, pos, page); 367 if (ret < 0) 368 break; 369 pos += bvec->bv_len; 370 } 371 if (page) { 372 kunmap(page); 373 __free_page(page); 374 } 375 out: 376 return ret; 377 fail: 378 printk(KERN_ERR "loop: Failed to allocate temporary page for write.\n"); 379 ret = -ENOMEM; 380 goto out; 381 } 382 383 struct lo_read_data { 384 struct loop_device *lo; 385 struct page *page; 386 unsigned offset; 387 int bsize; 388 }; 389 390 static int 391 lo_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf, 392 struct splice_desc *sd) 393 { 394 struct lo_read_data *p = sd->u.data; 395 struct loop_device *lo = p->lo; 396 struct page *page = buf->page; 397 sector_t IV; 398 int size; 399 400 IV = ((sector_t) page->index << (PAGE_CACHE_SHIFT - 9)) + 401 (buf->offset >> 9); 402 size = sd->len; 403 if (size > p->bsize) 404 size = p->bsize; 405 406 if (lo_do_transfer(lo, READ, page, buf->offset, p->page, p->offset, size, IV)) { 407 printk(KERN_ERR "loop: transfer error block %ld\n", 408 page->index); 409 size = -EINVAL; 410 } 411 412 flush_dcache_page(p->page); 413 414 if (size > 0) 415 p->offset += size; 416 417 return size; 418 } 419 420 static int 421 lo_direct_splice_actor(struct pipe_inode_info *pipe, struct splice_desc *sd) 422 { 423 return __splice_from_pipe(pipe, sd, lo_splice_actor); 424 } 425 426 static int 427 do_lo_receive(struct loop_device *lo, 428 struct bio_vec *bvec, int bsize, loff_t pos) 429 { 430 struct lo_read_data cookie; 431 struct splice_desc sd; 432 struct file *file; 433 long retval; 434 435 cookie.lo = lo; 436 cookie.page = bvec->bv_page; 437 cookie.offset = bvec->bv_offset; 438 cookie.bsize = bsize; 439 440 sd.len = 0; 441 sd.total_len = bvec->bv_len; 442 sd.flags = 0; 443 sd.pos = pos; 444 sd.u.data = &cookie; 445 446 file = lo->lo_backing_file; 447 retval = splice_direct_to_actor(file, &sd, lo_direct_splice_actor); 448 449 if (retval < 0) 450 return retval; 451 452 return 0; 453 } 454 455 static int 456 lo_receive(struct loop_device *lo, struct bio *bio, int bsize, loff_t pos) 457 { 458 struct bio_vec *bvec; 459 int i, ret = 0; 460 461 bio_for_each_segment(bvec, bio, i) { 462 ret = do_lo_receive(lo, bvec, bsize, pos); 463 if (ret < 0) 464 break; 465 pos += bvec->bv_len; 466 } 467 return ret; 468 } 469 470 static int do_bio_filebacked(struct loop_device *lo, struct bio *bio) 471 { 472 loff_t pos; 473 int ret; 474 475 pos = ((loff_t) bio->bi_sector << 9) + lo->lo_offset; 476 477 if (bio_rw(bio) == WRITE) { 478 struct file *file = lo->lo_backing_file; 479 480 if (bio->bi_rw & REQ_FLUSH) { 481 ret = vfs_fsync(file, 0); 482 if (unlikely(ret && ret != -EINVAL)) { 483 ret = -EIO; 484 goto out; 485 } 486 } 487 488 /* 489 * We use punch hole to reclaim the free space used by the 490 * image a.k.a. discard. However we do support discard if 491 * encryption is enabled, because it may give an attacker 492 * useful information. 493 */ 494 if (bio->bi_rw & REQ_DISCARD) { 495 struct file *file = lo->lo_backing_file; 496 int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE; 497 498 if ((!file->f_op->fallocate) || 499 lo->lo_encrypt_key_size) { 500 ret = -EOPNOTSUPP; 501 goto out; 502 } 503 ret = file->f_op->fallocate(file, mode, pos, 504 bio->bi_size); 505 if (unlikely(ret && ret != -EINVAL && 506 ret != -EOPNOTSUPP)) 507 ret = -EIO; 508 goto out; 509 } 510 511 ret = lo_send(lo, bio, pos); 512 513 if ((bio->bi_rw & REQ_FUA) && !ret) { 514 ret = vfs_fsync(file, 0); 515 if (unlikely(ret && ret != -EINVAL)) 516 ret = -EIO; 517 } 518 } else 519 ret = lo_receive(lo, bio, lo->lo_blocksize, pos); 520 521 out: 522 return ret; 523 } 524 525 /* 526 * Add bio to back of pending list 527 */ 528 static void loop_add_bio(struct loop_device *lo, struct bio *bio) 529 { 530 bio_list_add(&lo->lo_bio_list, bio); 531 } 532 533 /* 534 * Grab first pending buffer 535 */ 536 static struct bio *loop_get_bio(struct loop_device *lo) 537 { 538 return bio_list_pop(&lo->lo_bio_list); 539 } 540 541 static int loop_make_request(struct request_queue *q, struct bio *old_bio) 542 { 543 struct loop_device *lo = q->queuedata; 544 int rw = bio_rw(old_bio); 545 546 if (rw == READA) 547 rw = READ; 548 549 BUG_ON(!lo || (rw != READ && rw != WRITE)); 550 551 spin_lock_irq(&lo->lo_lock); 552 if (lo->lo_state != Lo_bound) 553 goto out; 554 if (unlikely(rw == WRITE && (lo->lo_flags & LO_FLAGS_READ_ONLY))) 555 goto out; 556 loop_add_bio(lo, old_bio); 557 wake_up(&lo->lo_event); 558 spin_unlock_irq(&lo->lo_lock); 559 return 0; 560 561 out: 562 spin_unlock_irq(&lo->lo_lock); 563 bio_io_error(old_bio); 564 return 0; 565 } 566 567 struct switch_request { 568 struct file *file; 569 struct completion wait; 570 }; 571 572 static void do_loop_switch(struct loop_device *, struct switch_request *); 573 574 static inline void loop_handle_bio(struct loop_device *lo, struct bio *bio) 575 { 576 if (unlikely(!bio->bi_bdev)) { 577 do_loop_switch(lo, bio->bi_private); 578 bio_put(bio); 579 } else { 580 int ret = do_bio_filebacked(lo, bio); 581 bio_endio(bio, ret); 582 } 583 } 584 585 /* 586 * worker thread that handles reads/writes to file backed loop devices, 587 * to avoid blocking in our make_request_fn. it also does loop decrypting 588 * on reads for block backed loop, as that is too heavy to do from 589 * b_end_io context where irqs may be disabled. 590 * 591 * Loop explanation: loop_clr_fd() sets lo_state to Lo_rundown before 592 * calling kthread_stop(). Therefore once kthread_should_stop() is 593 * true, make_request will not place any more requests. Therefore 594 * once kthread_should_stop() is true and lo_bio is NULL, we are 595 * done with the loop. 596 */ 597 static int loop_thread(void *data) 598 { 599 struct loop_device *lo = data; 600 struct bio *bio; 601 602 set_user_nice(current, -20); 603 604 while (!kthread_should_stop() || !bio_list_empty(&lo->lo_bio_list)) { 605 606 wait_event_interruptible(lo->lo_event, 607 !bio_list_empty(&lo->lo_bio_list) || 608 kthread_should_stop()); 609 610 if (bio_list_empty(&lo->lo_bio_list)) 611 continue; 612 spin_lock_irq(&lo->lo_lock); 613 bio = loop_get_bio(lo); 614 spin_unlock_irq(&lo->lo_lock); 615 616 BUG_ON(!bio); 617 loop_handle_bio(lo, bio); 618 } 619 620 return 0; 621 } 622 623 /* 624 * loop_switch performs the hard work of switching a backing store. 625 * First it needs to flush existing IO, it does this by sending a magic 626 * BIO down the pipe. The completion of this BIO does the actual switch. 627 */ 628 static int loop_switch(struct loop_device *lo, struct file *file) 629 { 630 struct switch_request w; 631 struct bio *bio = bio_alloc(GFP_KERNEL, 0); 632 if (!bio) 633 return -ENOMEM; 634 init_completion(&w.wait); 635 w.file = file; 636 bio->bi_private = &w; 637 bio->bi_bdev = NULL; 638 loop_make_request(lo->lo_queue, bio); 639 wait_for_completion(&w.wait); 640 return 0; 641 } 642 643 /* 644 * Helper to flush the IOs in loop, but keeping loop thread running 645 */ 646 static int loop_flush(struct loop_device *lo) 647 { 648 /* loop not yet configured, no running thread, nothing to flush */ 649 if (!lo->lo_thread) 650 return 0; 651 652 return loop_switch(lo, NULL); 653 } 654 655 /* 656 * Do the actual switch; called from the BIO completion routine 657 */ 658 static void do_loop_switch(struct loop_device *lo, struct switch_request *p) 659 { 660 struct file *file = p->file; 661 struct file *old_file = lo->lo_backing_file; 662 struct address_space *mapping; 663 664 /* if no new file, only flush of queued bios requested */ 665 if (!file) 666 goto out; 667 668 mapping = file->f_mapping; 669 mapping_set_gfp_mask(old_file->f_mapping, lo->old_gfp_mask); 670 lo->lo_backing_file = file; 671 lo->lo_blocksize = S_ISBLK(mapping->host->i_mode) ? 672 mapping->host->i_bdev->bd_block_size : PAGE_SIZE; 673 lo->old_gfp_mask = mapping_gfp_mask(mapping); 674 mapping_set_gfp_mask(mapping, lo->old_gfp_mask & ~(__GFP_IO|__GFP_FS)); 675 out: 676 complete(&p->wait); 677 } 678 679 680 /* 681 * loop_change_fd switched the backing store of a loopback device to 682 * a new file. This is useful for operating system installers to free up 683 * the original file and in High Availability environments to switch to 684 * an alternative location for the content in case of server meltdown. 685 * This can only work if the loop device is used read-only, and if the 686 * new backing store is the same size and type as the old backing store. 687 */ 688 static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, 689 unsigned int arg) 690 { 691 struct file *file, *old_file; 692 struct inode *inode; 693 int error; 694 695 error = -ENXIO; 696 if (lo->lo_state != Lo_bound) 697 goto out; 698 699 /* the loop device has to be read-only */ 700 error = -EINVAL; 701 if (!(lo->lo_flags & LO_FLAGS_READ_ONLY)) 702 goto out; 703 704 error = -EBADF; 705 file = fget(arg); 706 if (!file) 707 goto out; 708 709 inode = file->f_mapping->host; 710 old_file = lo->lo_backing_file; 711 712 error = -EINVAL; 713 714 if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode)) 715 goto out_putf; 716 717 /* size of the new backing store needs to be the same */ 718 if (get_loop_size(lo, file) != get_loop_size(lo, old_file)) 719 goto out_putf; 720 721 /* and ... switch */ 722 error = loop_switch(lo, file); 723 if (error) 724 goto out_putf; 725 726 fput(old_file); 727 if (lo->lo_flags & LO_FLAGS_PARTSCAN) 728 ioctl_by_bdev(bdev, BLKRRPART, 0); 729 return 0; 730 731 out_putf: 732 fput(file); 733 out: 734 return error; 735 } 736 737 static inline int is_loop_device(struct file *file) 738 { 739 struct inode *i = file->f_mapping->host; 740 741 return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR; 742 } 743 744 /* loop sysfs attributes */ 745 746 static ssize_t loop_attr_show(struct device *dev, char *page, 747 ssize_t (*callback)(struct loop_device *, char *)) 748 { 749 struct loop_device *l, *lo = NULL; 750 751 mutex_lock(&loop_devices_mutex); 752 list_for_each_entry(l, &loop_devices, lo_list) 753 if (disk_to_dev(l->lo_disk) == dev) { 754 lo = l; 755 break; 756 } 757 mutex_unlock(&loop_devices_mutex); 758 759 return lo ? callback(lo, page) : -EIO; 760 } 761 762 #define LOOP_ATTR_RO(_name) \ 763 static ssize_t loop_attr_##_name##_show(struct loop_device *, char *); \ 764 static ssize_t loop_attr_do_show_##_name(struct device *d, \ 765 struct device_attribute *attr, char *b) \ 766 { \ 767 return loop_attr_show(d, b, loop_attr_##_name##_show); \ 768 } \ 769 static struct device_attribute loop_attr_##_name = \ 770 __ATTR(_name, S_IRUGO, loop_attr_do_show_##_name, NULL); 771 772 static ssize_t loop_attr_backing_file_show(struct loop_device *lo, char *buf) 773 { 774 ssize_t ret; 775 char *p = NULL; 776 777 mutex_lock(&lo->lo_ctl_mutex); 778 if (lo->lo_backing_file) 779 p = d_path(&lo->lo_backing_file->f_path, buf, PAGE_SIZE - 1); 780 mutex_unlock(&lo->lo_ctl_mutex); 781 782 if (IS_ERR_OR_NULL(p)) 783 ret = PTR_ERR(p); 784 else { 785 ret = strlen(p); 786 memmove(buf, p, ret); 787 buf[ret++] = '\n'; 788 buf[ret] = 0; 789 } 790 791 return ret; 792 } 793 794 static ssize_t loop_attr_offset_show(struct loop_device *lo, char *buf) 795 { 796 return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_offset); 797 } 798 799 static ssize_t loop_attr_sizelimit_show(struct loop_device *lo, char *buf) 800 { 801 return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit); 802 } 803 804 static ssize_t loop_attr_autoclear_show(struct loop_device *lo, char *buf) 805 { 806 int autoclear = (lo->lo_flags & LO_FLAGS_AUTOCLEAR); 807 808 return sprintf(buf, "%s\n", autoclear ? "1" : "0"); 809 } 810 811 static ssize_t loop_attr_partscan_show(struct loop_device *lo, char *buf) 812 { 813 int partscan = (lo->lo_flags & LO_FLAGS_PARTSCAN); 814 815 return sprintf(buf, "%s\n", partscan ? "1" : "0"); 816 } 817 818 LOOP_ATTR_RO(backing_file); 819 LOOP_ATTR_RO(offset); 820 LOOP_ATTR_RO(sizelimit); 821 LOOP_ATTR_RO(autoclear); 822 LOOP_ATTR_RO(partscan); 823 824 static struct attribute *loop_attrs[] = { 825 &loop_attr_backing_file.attr, 826 &loop_attr_offset.attr, 827 &loop_attr_sizelimit.attr, 828 &loop_attr_autoclear.attr, 829 &loop_attr_partscan.attr, 830 NULL, 831 }; 832 833 static struct attribute_group loop_attribute_group = { 834 .name = "loop", 835 .attrs= loop_attrs, 836 }; 837 838 static int loop_sysfs_init(struct loop_device *lo) 839 { 840 return sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj, 841 &loop_attribute_group); 842 } 843 844 static void loop_sysfs_exit(struct loop_device *lo) 845 { 846 sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj, 847 &loop_attribute_group); 848 } 849 850 static void loop_config_discard(struct loop_device *lo) 851 { 852 struct file *file = lo->lo_backing_file; 853 struct inode *inode = file->f_mapping->host; 854 struct request_queue *q = lo->lo_queue; 855 856 /* 857 * We use punch hole to reclaim the free space used by the 858 * image a.k.a. discard. However we do support discard if 859 * encryption is enabled, because it may give an attacker 860 * useful information. 861 */ 862 if ((!file->f_op->fallocate) || 863 lo->lo_encrypt_key_size) { 864 q->limits.discard_granularity = 0; 865 q->limits.discard_alignment = 0; 866 q->limits.max_discard_sectors = 0; 867 q->limits.discard_zeroes_data = 0; 868 queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, q); 869 return; 870 } 871 872 q->limits.discard_granularity = inode->i_sb->s_blocksize; 873 q->limits.discard_alignment = inode->i_sb->s_blocksize; 874 q->limits.max_discard_sectors = UINT_MAX >> 9; 875 q->limits.discard_zeroes_data = 1; 876 queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q); 877 } 878 879 static int loop_set_fd(struct loop_device *lo, fmode_t mode, 880 struct block_device *bdev, unsigned int arg) 881 { 882 struct file *file, *f; 883 struct inode *inode; 884 struct address_space *mapping; 885 unsigned lo_blocksize; 886 int lo_flags = 0; 887 int error; 888 loff_t size; 889 890 /* This is safe, since we have a reference from open(). */ 891 __module_get(THIS_MODULE); 892 893 error = -EBADF; 894 file = fget(arg); 895 if (!file) 896 goto out; 897 898 error = -EBUSY; 899 if (lo->lo_state != Lo_unbound) 900 goto out_putf; 901 902 /* Avoid recursion */ 903 f = file; 904 while (is_loop_device(f)) { 905 struct loop_device *l; 906 907 if (f->f_mapping->host->i_bdev == bdev) 908 goto out_putf; 909 910 l = f->f_mapping->host->i_bdev->bd_disk->private_data; 911 if (l->lo_state == Lo_unbound) { 912 error = -EINVAL; 913 goto out_putf; 914 } 915 f = l->lo_backing_file; 916 } 917 918 mapping = file->f_mapping; 919 inode = mapping->host; 920 921 if (!(file->f_mode & FMODE_WRITE)) 922 lo_flags |= LO_FLAGS_READ_ONLY; 923 924 error = -EINVAL; 925 if (S_ISREG(inode->i_mode) || S_ISBLK(inode->i_mode)) { 926 const struct address_space_operations *aops = mapping->a_ops; 927 928 if (aops->write_begin) 929 lo_flags |= LO_FLAGS_USE_AOPS; 930 if (!(lo_flags & LO_FLAGS_USE_AOPS) && !file->f_op->write) 931 lo_flags |= LO_FLAGS_READ_ONLY; 932 933 lo_blocksize = S_ISBLK(inode->i_mode) ? 934 inode->i_bdev->bd_block_size : PAGE_SIZE; 935 936 error = 0; 937 } else { 938 goto out_putf; 939 } 940 941 size = get_loop_size(lo, file); 942 943 if ((loff_t)(sector_t)size != size) { 944 error = -EFBIG; 945 goto out_putf; 946 } 947 948 if (!(mode & FMODE_WRITE)) 949 lo_flags |= LO_FLAGS_READ_ONLY; 950 951 set_device_ro(bdev, (lo_flags & LO_FLAGS_READ_ONLY) != 0); 952 953 lo->lo_blocksize = lo_blocksize; 954 lo->lo_device = bdev; 955 lo->lo_flags = lo_flags; 956 lo->lo_backing_file = file; 957 lo->transfer = transfer_none; 958 lo->ioctl = NULL; 959 lo->lo_sizelimit = 0; 960 lo->old_gfp_mask = mapping_gfp_mask(mapping); 961 mapping_set_gfp_mask(mapping, lo->old_gfp_mask & ~(__GFP_IO|__GFP_FS)); 962 963 bio_list_init(&lo->lo_bio_list); 964 965 /* 966 * set queue make_request_fn, and add limits based on lower level 967 * device 968 */ 969 blk_queue_make_request(lo->lo_queue, loop_make_request); 970 lo->lo_queue->queuedata = lo; 971 972 if (!(lo_flags & LO_FLAGS_READ_ONLY) && file->f_op->fsync) 973 blk_queue_flush(lo->lo_queue, REQ_FLUSH); 974 975 set_capacity(lo->lo_disk, size); 976 bd_set_size(bdev, size << 9); 977 loop_sysfs_init(lo); 978 /* let user-space know about the new size */ 979 kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); 980 981 set_blocksize(bdev, lo_blocksize); 982 983 lo->lo_thread = kthread_create(loop_thread, lo, "loop%d", 984 lo->lo_number); 985 if (IS_ERR(lo->lo_thread)) { 986 error = PTR_ERR(lo->lo_thread); 987 goto out_clr; 988 } 989 lo->lo_state = Lo_bound; 990 wake_up_process(lo->lo_thread); 991 if (part_shift) 992 lo->lo_flags |= LO_FLAGS_PARTSCAN; 993 if (lo->lo_flags & LO_FLAGS_PARTSCAN) 994 ioctl_by_bdev(bdev, BLKRRPART, 0); 995 return 0; 996 997 out_clr: 998 loop_sysfs_exit(lo); 999 lo->lo_thread = NULL; 1000 lo->lo_device = NULL; 1001 lo->lo_backing_file = NULL; 1002 lo->lo_flags = 0; 1003 set_capacity(lo->lo_disk, 0); 1004 invalidate_bdev(bdev); 1005 bd_set_size(bdev, 0); 1006 kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); 1007 mapping_set_gfp_mask(mapping, lo->old_gfp_mask); 1008 lo->lo_state = Lo_unbound; 1009 out_putf: 1010 fput(file); 1011 out: 1012 /* This is safe: open() is still holding a reference. */ 1013 module_put(THIS_MODULE); 1014 return error; 1015 } 1016 1017 static int 1018 loop_release_xfer(struct loop_device *lo) 1019 { 1020 int err = 0; 1021 struct loop_func_table *xfer = lo->lo_encryption; 1022 1023 if (xfer) { 1024 if (xfer->release) 1025 err = xfer->release(lo); 1026 lo->transfer = NULL; 1027 lo->lo_encryption = NULL; 1028 module_put(xfer->owner); 1029 } 1030 return err; 1031 } 1032 1033 static int 1034 loop_init_xfer(struct loop_device *lo, struct loop_func_table *xfer, 1035 const struct loop_info64 *i) 1036 { 1037 int err = 0; 1038 1039 if (xfer) { 1040 struct module *owner = xfer->owner; 1041 1042 if (!try_module_get(owner)) 1043 return -EINVAL; 1044 if (xfer->init) 1045 err = xfer->init(lo, i); 1046 if (err) 1047 module_put(owner); 1048 else 1049 lo->lo_encryption = xfer; 1050 } 1051 return err; 1052 } 1053 1054 static int loop_clr_fd(struct loop_device *lo) 1055 { 1056 struct file *filp = lo->lo_backing_file; 1057 gfp_t gfp = lo->old_gfp_mask; 1058 struct block_device *bdev = lo->lo_device; 1059 1060 if (lo->lo_state != Lo_bound) 1061 return -ENXIO; 1062 1063 if (lo->lo_refcnt > 1) /* we needed one fd for the ioctl */ 1064 return -EBUSY; 1065 1066 if (filp == NULL) 1067 return -EINVAL; 1068 1069 spin_lock_irq(&lo->lo_lock); 1070 lo->lo_state = Lo_rundown; 1071 spin_unlock_irq(&lo->lo_lock); 1072 1073 kthread_stop(lo->lo_thread); 1074 1075 lo->lo_backing_file = NULL; 1076 1077 loop_release_xfer(lo); 1078 lo->transfer = NULL; 1079 lo->ioctl = NULL; 1080 lo->lo_device = NULL; 1081 lo->lo_encryption = NULL; 1082 lo->lo_offset = 0; 1083 lo->lo_sizelimit = 0; 1084 lo->lo_encrypt_key_size = 0; 1085 lo->lo_thread = NULL; 1086 memset(lo->lo_encrypt_key, 0, LO_KEY_SIZE); 1087 memset(lo->lo_crypt_name, 0, LO_NAME_SIZE); 1088 memset(lo->lo_file_name, 0, LO_NAME_SIZE); 1089 if (bdev) 1090 invalidate_bdev(bdev); 1091 set_capacity(lo->lo_disk, 0); 1092 loop_sysfs_exit(lo); 1093 if (bdev) { 1094 bd_set_size(bdev, 0); 1095 /* let user-space know about this change */ 1096 kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); 1097 } 1098 mapping_set_gfp_mask(filp->f_mapping, gfp); 1099 lo->lo_state = Lo_unbound; 1100 /* This is safe: open() is still holding a reference. */ 1101 module_put(THIS_MODULE); 1102 if (lo->lo_flags & LO_FLAGS_PARTSCAN && bdev) 1103 ioctl_by_bdev(bdev, BLKRRPART, 0); 1104 lo->lo_flags = 0; 1105 if (!part_shift) 1106 lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN; 1107 mutex_unlock(&lo->lo_ctl_mutex); 1108 /* 1109 * Need not hold lo_ctl_mutex to fput backing file. 1110 * Calling fput holding lo_ctl_mutex triggers a circular 1111 * lock dependency possibility warning as fput can take 1112 * bd_mutex which is usually taken before lo_ctl_mutex. 1113 */ 1114 fput(filp); 1115 return 0; 1116 } 1117 1118 static int 1119 loop_set_status(struct loop_device *lo, const struct loop_info64 *info) 1120 { 1121 int err; 1122 struct loop_func_table *xfer; 1123 uid_t uid = current_uid(); 1124 1125 if (lo->lo_encrypt_key_size && 1126 lo->lo_key_owner != uid && 1127 !capable(CAP_SYS_ADMIN)) 1128 return -EPERM; 1129 if (lo->lo_state != Lo_bound) 1130 return -ENXIO; 1131 if ((unsigned int) info->lo_encrypt_key_size > LO_KEY_SIZE) 1132 return -EINVAL; 1133 1134 err = loop_release_xfer(lo); 1135 if (err) 1136 return err; 1137 1138 if (info->lo_encrypt_type) { 1139 unsigned int type = info->lo_encrypt_type; 1140 1141 if (type >= MAX_LO_CRYPT) 1142 return -EINVAL; 1143 xfer = xfer_funcs[type]; 1144 if (xfer == NULL) 1145 return -EINVAL; 1146 } else 1147 xfer = NULL; 1148 1149 err = loop_init_xfer(lo, xfer, info); 1150 if (err) 1151 return err; 1152 1153 if (lo->lo_offset != info->lo_offset || 1154 lo->lo_sizelimit != info->lo_sizelimit) { 1155 lo->lo_offset = info->lo_offset; 1156 lo->lo_sizelimit = info->lo_sizelimit; 1157 if (figure_loop_size(lo)) 1158 return -EFBIG; 1159 } 1160 loop_config_discard(lo); 1161 1162 memcpy(lo->lo_file_name, info->lo_file_name, LO_NAME_SIZE); 1163 memcpy(lo->lo_crypt_name, info->lo_crypt_name, LO_NAME_SIZE); 1164 lo->lo_file_name[LO_NAME_SIZE-1] = 0; 1165 lo->lo_crypt_name[LO_NAME_SIZE-1] = 0; 1166 1167 if (!xfer) 1168 xfer = &none_funcs; 1169 lo->transfer = xfer->transfer; 1170 lo->ioctl = xfer->ioctl; 1171 1172 if ((lo->lo_flags & LO_FLAGS_AUTOCLEAR) != 1173 (info->lo_flags & LO_FLAGS_AUTOCLEAR)) 1174 lo->lo_flags ^= LO_FLAGS_AUTOCLEAR; 1175 1176 if ((info->lo_flags & LO_FLAGS_PARTSCAN) && 1177 !(lo->lo_flags & LO_FLAGS_PARTSCAN)) { 1178 lo->lo_flags |= LO_FLAGS_PARTSCAN; 1179 lo->lo_disk->flags &= ~GENHD_FL_NO_PART_SCAN; 1180 ioctl_by_bdev(lo->lo_device, BLKRRPART, 0); 1181 } 1182 1183 lo->lo_encrypt_key_size = info->lo_encrypt_key_size; 1184 lo->lo_init[0] = info->lo_init[0]; 1185 lo->lo_init[1] = info->lo_init[1]; 1186 if (info->lo_encrypt_key_size) { 1187 memcpy(lo->lo_encrypt_key, info->lo_encrypt_key, 1188 info->lo_encrypt_key_size); 1189 lo->lo_key_owner = uid; 1190 } 1191 1192 return 0; 1193 } 1194 1195 static int 1196 loop_get_status(struct loop_device *lo, struct loop_info64 *info) 1197 { 1198 struct file *file = lo->lo_backing_file; 1199 struct kstat stat; 1200 int error; 1201 1202 if (lo->lo_state != Lo_bound) 1203 return -ENXIO; 1204 error = vfs_getattr(file->f_path.mnt, file->f_path.dentry, &stat); 1205 if (error) 1206 return error; 1207 memset(info, 0, sizeof(*info)); 1208 info->lo_number = lo->lo_number; 1209 info->lo_device = huge_encode_dev(stat.dev); 1210 info->lo_inode = stat.ino; 1211 info->lo_rdevice = huge_encode_dev(lo->lo_device ? stat.rdev : stat.dev); 1212 info->lo_offset = lo->lo_offset; 1213 info->lo_sizelimit = lo->lo_sizelimit; 1214 info->lo_flags = lo->lo_flags; 1215 memcpy(info->lo_file_name, lo->lo_file_name, LO_NAME_SIZE); 1216 memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE); 1217 info->lo_encrypt_type = 1218 lo->lo_encryption ? lo->lo_encryption->number : 0; 1219 if (lo->lo_encrypt_key_size && capable(CAP_SYS_ADMIN)) { 1220 info->lo_encrypt_key_size = lo->lo_encrypt_key_size; 1221 memcpy(info->lo_encrypt_key, lo->lo_encrypt_key, 1222 lo->lo_encrypt_key_size); 1223 } 1224 return 0; 1225 } 1226 1227 static void 1228 loop_info64_from_old(const struct loop_info *info, struct loop_info64 *info64) 1229 { 1230 memset(info64, 0, sizeof(*info64)); 1231 info64->lo_number = info->lo_number; 1232 info64->lo_device = info->lo_device; 1233 info64->lo_inode = info->lo_inode; 1234 info64->lo_rdevice = info->lo_rdevice; 1235 info64->lo_offset = info->lo_offset; 1236 info64->lo_sizelimit = 0; 1237 info64->lo_encrypt_type = info->lo_encrypt_type; 1238 info64->lo_encrypt_key_size = info->lo_encrypt_key_size; 1239 info64->lo_flags = info->lo_flags; 1240 info64->lo_init[0] = info->lo_init[0]; 1241 info64->lo_init[1] = info->lo_init[1]; 1242 if (info->lo_encrypt_type == LO_CRYPT_CRYPTOAPI) 1243 memcpy(info64->lo_crypt_name, info->lo_name, LO_NAME_SIZE); 1244 else 1245 memcpy(info64->lo_file_name, info->lo_name, LO_NAME_SIZE); 1246 memcpy(info64->lo_encrypt_key, info->lo_encrypt_key, LO_KEY_SIZE); 1247 } 1248 1249 static int 1250 loop_info64_to_old(const struct loop_info64 *info64, struct loop_info *info) 1251 { 1252 memset(info, 0, sizeof(*info)); 1253 info->lo_number = info64->lo_number; 1254 info->lo_device = info64->lo_device; 1255 info->lo_inode = info64->lo_inode; 1256 info->lo_rdevice = info64->lo_rdevice; 1257 info->lo_offset = info64->lo_offset; 1258 info->lo_encrypt_type = info64->lo_encrypt_type; 1259 info->lo_encrypt_key_size = info64->lo_encrypt_key_size; 1260 info->lo_flags = info64->lo_flags; 1261 info->lo_init[0] = info64->lo_init[0]; 1262 info->lo_init[1] = info64->lo_init[1]; 1263 if (info->lo_encrypt_type == LO_CRYPT_CRYPTOAPI) 1264 memcpy(info->lo_name, info64->lo_crypt_name, LO_NAME_SIZE); 1265 else 1266 memcpy(info->lo_name, info64->lo_file_name, LO_NAME_SIZE); 1267 memcpy(info->lo_encrypt_key, info64->lo_encrypt_key, LO_KEY_SIZE); 1268 1269 /* error in case values were truncated */ 1270 if (info->lo_device != info64->lo_device || 1271 info->lo_rdevice != info64->lo_rdevice || 1272 info->lo_inode != info64->lo_inode || 1273 info->lo_offset != info64->lo_offset) 1274 return -EOVERFLOW; 1275 1276 return 0; 1277 } 1278 1279 static int 1280 loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg) 1281 { 1282 struct loop_info info; 1283 struct loop_info64 info64; 1284 1285 if (copy_from_user(&info, arg, sizeof (struct loop_info))) 1286 return -EFAULT; 1287 loop_info64_from_old(&info, &info64); 1288 return loop_set_status(lo, &info64); 1289 } 1290 1291 static int 1292 loop_set_status64(struct loop_device *lo, const struct loop_info64 __user *arg) 1293 { 1294 struct loop_info64 info64; 1295 1296 if (copy_from_user(&info64, arg, sizeof (struct loop_info64))) 1297 return -EFAULT; 1298 return loop_set_status(lo, &info64); 1299 } 1300 1301 static int 1302 loop_get_status_old(struct loop_device *lo, struct loop_info __user *arg) { 1303 struct loop_info info; 1304 struct loop_info64 info64; 1305 int err = 0; 1306 1307 if (!arg) 1308 err = -EINVAL; 1309 if (!err) 1310 err = loop_get_status(lo, &info64); 1311 if (!err) 1312 err = loop_info64_to_old(&info64, &info); 1313 if (!err && copy_to_user(arg, &info, sizeof(info))) 1314 err = -EFAULT; 1315 1316 return err; 1317 } 1318 1319 static int 1320 loop_get_status64(struct loop_device *lo, struct loop_info64 __user *arg) { 1321 struct loop_info64 info64; 1322 int err = 0; 1323 1324 if (!arg) 1325 err = -EINVAL; 1326 if (!err) 1327 err = loop_get_status(lo, &info64); 1328 if (!err && copy_to_user(arg, &info64, sizeof(info64))) 1329 err = -EFAULT; 1330 1331 return err; 1332 } 1333 1334 static int loop_set_capacity(struct loop_device *lo, struct block_device *bdev) 1335 { 1336 int err; 1337 sector_t sec; 1338 loff_t sz; 1339 1340 err = -ENXIO; 1341 if (unlikely(lo->lo_state != Lo_bound)) 1342 goto out; 1343 err = figure_loop_size(lo); 1344 if (unlikely(err)) 1345 goto out; 1346 sec = get_capacity(lo->lo_disk); 1347 /* the width of sector_t may be narrow for bit-shift */ 1348 sz = sec; 1349 sz <<= 9; 1350 mutex_lock(&bdev->bd_mutex); 1351 bd_set_size(bdev, sz); 1352 /* let user-space know about the new size */ 1353 kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); 1354 mutex_unlock(&bdev->bd_mutex); 1355 1356 out: 1357 return err; 1358 } 1359 1360 static int lo_ioctl(struct block_device *bdev, fmode_t mode, 1361 unsigned int cmd, unsigned long arg) 1362 { 1363 struct loop_device *lo = bdev->bd_disk->private_data; 1364 int err; 1365 1366 mutex_lock_nested(&lo->lo_ctl_mutex, 1); 1367 switch (cmd) { 1368 case LOOP_SET_FD: 1369 err = loop_set_fd(lo, mode, bdev, arg); 1370 break; 1371 case LOOP_CHANGE_FD: 1372 err = loop_change_fd(lo, bdev, arg); 1373 break; 1374 case LOOP_CLR_FD: 1375 /* loop_clr_fd would have unlocked lo_ctl_mutex on success */ 1376 err = loop_clr_fd(lo); 1377 if (!err) 1378 goto out_unlocked; 1379 break; 1380 case LOOP_SET_STATUS: 1381 err = loop_set_status_old(lo, (struct loop_info __user *) arg); 1382 break; 1383 case LOOP_GET_STATUS: 1384 err = loop_get_status_old(lo, (struct loop_info __user *) arg); 1385 break; 1386 case LOOP_SET_STATUS64: 1387 err = loop_set_status64(lo, (struct loop_info64 __user *) arg); 1388 break; 1389 case LOOP_GET_STATUS64: 1390 err = loop_get_status64(lo, (struct loop_info64 __user *) arg); 1391 break; 1392 case LOOP_SET_CAPACITY: 1393 err = -EPERM; 1394 if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN)) 1395 err = loop_set_capacity(lo, bdev); 1396 break; 1397 default: 1398 err = lo->ioctl ? lo->ioctl(lo, cmd, arg) : -EINVAL; 1399 } 1400 mutex_unlock(&lo->lo_ctl_mutex); 1401 1402 out_unlocked: 1403 return err; 1404 } 1405 1406 #ifdef CONFIG_COMPAT 1407 struct compat_loop_info { 1408 compat_int_t lo_number; /* ioctl r/o */ 1409 compat_dev_t lo_device; /* ioctl r/o */ 1410 compat_ulong_t lo_inode; /* ioctl r/o */ 1411 compat_dev_t lo_rdevice; /* ioctl r/o */ 1412 compat_int_t lo_offset; 1413 compat_int_t lo_encrypt_type; 1414 compat_int_t lo_encrypt_key_size; /* ioctl w/o */ 1415 compat_int_t lo_flags; /* ioctl r/o */ 1416 char lo_name[LO_NAME_SIZE]; 1417 unsigned char lo_encrypt_key[LO_KEY_SIZE]; /* ioctl w/o */ 1418 compat_ulong_t lo_init[2]; 1419 char reserved[4]; 1420 }; 1421 1422 /* 1423 * Transfer 32-bit compatibility structure in userspace to 64-bit loop info 1424 * - noinlined to reduce stack space usage in main part of driver 1425 */ 1426 static noinline int 1427 loop_info64_from_compat(const struct compat_loop_info __user *arg, 1428 struct loop_info64 *info64) 1429 { 1430 struct compat_loop_info info; 1431 1432 if (copy_from_user(&info, arg, sizeof(info))) 1433 return -EFAULT; 1434 1435 memset(info64, 0, sizeof(*info64)); 1436 info64->lo_number = info.lo_number; 1437 info64->lo_device = info.lo_device; 1438 info64->lo_inode = info.lo_inode; 1439 info64->lo_rdevice = info.lo_rdevice; 1440 info64->lo_offset = info.lo_offset; 1441 info64->lo_sizelimit = 0; 1442 info64->lo_encrypt_type = info.lo_encrypt_type; 1443 info64->lo_encrypt_key_size = info.lo_encrypt_key_size; 1444 info64->lo_flags = info.lo_flags; 1445 info64->lo_init[0] = info.lo_init[0]; 1446 info64->lo_init[1] = info.lo_init[1]; 1447 if (info.lo_encrypt_type == LO_CRYPT_CRYPTOAPI) 1448 memcpy(info64->lo_crypt_name, info.lo_name, LO_NAME_SIZE); 1449 else 1450 memcpy(info64->lo_file_name, info.lo_name, LO_NAME_SIZE); 1451 memcpy(info64->lo_encrypt_key, info.lo_encrypt_key, LO_KEY_SIZE); 1452 return 0; 1453 } 1454 1455 /* 1456 * Transfer 64-bit loop info to 32-bit compatibility structure in userspace 1457 * - noinlined to reduce stack space usage in main part of driver 1458 */ 1459 static noinline int 1460 loop_info64_to_compat(const struct loop_info64 *info64, 1461 struct compat_loop_info __user *arg) 1462 { 1463 struct compat_loop_info info; 1464 1465 memset(&info, 0, sizeof(info)); 1466 info.lo_number = info64->lo_number; 1467 info.lo_device = info64->lo_device; 1468 info.lo_inode = info64->lo_inode; 1469 info.lo_rdevice = info64->lo_rdevice; 1470 info.lo_offset = info64->lo_offset; 1471 info.lo_encrypt_type = info64->lo_encrypt_type; 1472 info.lo_encrypt_key_size = info64->lo_encrypt_key_size; 1473 info.lo_flags = info64->lo_flags; 1474 info.lo_init[0] = info64->lo_init[0]; 1475 info.lo_init[1] = info64->lo_init[1]; 1476 if (info.lo_encrypt_type == LO_CRYPT_CRYPTOAPI) 1477 memcpy(info.lo_name, info64->lo_crypt_name, LO_NAME_SIZE); 1478 else 1479 memcpy(info.lo_name, info64->lo_file_name, LO_NAME_SIZE); 1480 memcpy(info.lo_encrypt_key, info64->lo_encrypt_key, LO_KEY_SIZE); 1481 1482 /* error in case values were truncated */ 1483 if (info.lo_device != info64->lo_device || 1484 info.lo_rdevice != info64->lo_rdevice || 1485 info.lo_inode != info64->lo_inode || 1486 info.lo_offset != info64->lo_offset || 1487 info.lo_init[0] != info64->lo_init[0] || 1488 info.lo_init[1] != info64->lo_init[1]) 1489 return -EOVERFLOW; 1490 1491 if (copy_to_user(arg, &info, sizeof(info))) 1492 return -EFAULT; 1493 return 0; 1494 } 1495 1496 static int 1497 loop_set_status_compat(struct loop_device *lo, 1498 const struct compat_loop_info __user *arg) 1499 { 1500 struct loop_info64 info64; 1501 int ret; 1502 1503 ret = loop_info64_from_compat(arg, &info64); 1504 if (ret < 0) 1505 return ret; 1506 return loop_set_status(lo, &info64); 1507 } 1508 1509 static int 1510 loop_get_status_compat(struct loop_device *lo, 1511 struct compat_loop_info __user *arg) 1512 { 1513 struct loop_info64 info64; 1514 int err = 0; 1515 1516 if (!arg) 1517 err = -EINVAL; 1518 if (!err) 1519 err = loop_get_status(lo, &info64); 1520 if (!err) 1521 err = loop_info64_to_compat(&info64, arg); 1522 return err; 1523 } 1524 1525 static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, 1526 unsigned int cmd, unsigned long arg) 1527 { 1528 struct loop_device *lo = bdev->bd_disk->private_data; 1529 int err; 1530 1531 switch(cmd) { 1532 case LOOP_SET_STATUS: 1533 mutex_lock(&lo->lo_ctl_mutex); 1534 err = loop_set_status_compat( 1535 lo, (const struct compat_loop_info __user *) arg); 1536 mutex_unlock(&lo->lo_ctl_mutex); 1537 break; 1538 case LOOP_GET_STATUS: 1539 mutex_lock(&lo->lo_ctl_mutex); 1540 err = loop_get_status_compat( 1541 lo, (struct compat_loop_info __user *) arg); 1542 mutex_unlock(&lo->lo_ctl_mutex); 1543 break; 1544 case LOOP_SET_CAPACITY: 1545 case LOOP_CLR_FD: 1546 case LOOP_GET_STATUS64: 1547 case LOOP_SET_STATUS64: 1548 arg = (unsigned long) compat_ptr(arg); 1549 case LOOP_SET_FD: 1550 case LOOP_CHANGE_FD: 1551 err = lo_ioctl(bdev, mode, cmd, arg); 1552 break; 1553 default: 1554 err = -ENOIOCTLCMD; 1555 break; 1556 } 1557 return err; 1558 } 1559 #endif 1560 1561 static int lo_open(struct block_device *bdev, fmode_t mode) 1562 { 1563 struct loop_device *lo = bdev->bd_disk->private_data; 1564 1565 mutex_lock(&lo->lo_ctl_mutex); 1566 lo->lo_refcnt++; 1567 mutex_unlock(&lo->lo_ctl_mutex); 1568 1569 return 0; 1570 } 1571 1572 static int lo_release(struct gendisk *disk, fmode_t mode) 1573 { 1574 struct loop_device *lo = disk->private_data; 1575 int err; 1576 1577 mutex_lock(&lo->lo_ctl_mutex); 1578 1579 if (--lo->lo_refcnt) 1580 goto out; 1581 1582 if (lo->lo_flags & LO_FLAGS_AUTOCLEAR) { 1583 /* 1584 * In autoclear mode, stop the loop thread 1585 * and remove configuration after last close. 1586 */ 1587 err = loop_clr_fd(lo); 1588 if (!err) 1589 goto out_unlocked; 1590 } else { 1591 /* 1592 * Otherwise keep thread (if running) and config, 1593 * but flush possible ongoing bios in thread. 1594 */ 1595 loop_flush(lo); 1596 } 1597 1598 out: 1599 mutex_unlock(&lo->lo_ctl_mutex); 1600 out_unlocked: 1601 return 0; 1602 } 1603 1604 static const struct block_device_operations lo_fops = { 1605 .owner = THIS_MODULE, 1606 .open = lo_open, 1607 .release = lo_release, 1608 .ioctl = lo_ioctl, 1609 #ifdef CONFIG_COMPAT 1610 .compat_ioctl = lo_compat_ioctl, 1611 #endif 1612 }; 1613 1614 /* 1615 * And now the modules code and kernel interface. 1616 */ 1617 static int max_loop; 1618 module_param(max_loop, int, S_IRUGO); 1619 MODULE_PARM_DESC(max_loop, "Maximum number of loop devices"); 1620 module_param(max_part, int, S_IRUGO); 1621 MODULE_PARM_DESC(max_part, "Maximum number of partitions per loop device"); 1622 MODULE_LICENSE("GPL"); 1623 MODULE_ALIAS_BLOCKDEV_MAJOR(LOOP_MAJOR); 1624 1625 int loop_register_transfer(struct loop_func_table *funcs) 1626 { 1627 unsigned int n = funcs->number; 1628 1629 if (n >= MAX_LO_CRYPT || xfer_funcs[n]) 1630 return -EINVAL; 1631 xfer_funcs[n] = funcs; 1632 return 0; 1633 } 1634 1635 int loop_unregister_transfer(int number) 1636 { 1637 unsigned int n = number; 1638 struct loop_device *lo; 1639 struct loop_func_table *xfer; 1640 1641 if (n == 0 || n >= MAX_LO_CRYPT || (xfer = xfer_funcs[n]) == NULL) 1642 return -EINVAL; 1643 1644 xfer_funcs[n] = NULL; 1645 1646 list_for_each_entry(lo, &loop_devices, lo_list) { 1647 mutex_lock(&lo->lo_ctl_mutex); 1648 1649 if (lo->lo_encryption == xfer) 1650 loop_release_xfer(lo); 1651 1652 mutex_unlock(&lo->lo_ctl_mutex); 1653 } 1654 1655 return 0; 1656 } 1657 1658 EXPORT_SYMBOL(loop_register_transfer); 1659 EXPORT_SYMBOL(loop_unregister_transfer); 1660 1661 static struct loop_device *loop_alloc(int i) 1662 { 1663 struct loop_device *lo; 1664 struct gendisk *disk; 1665 1666 lo = kzalloc(sizeof(*lo), GFP_KERNEL); 1667 if (!lo) 1668 goto out; 1669 1670 lo->lo_queue = blk_alloc_queue(GFP_KERNEL); 1671 if (!lo->lo_queue) 1672 goto out_free_dev; 1673 1674 disk = lo->lo_disk = alloc_disk(1 << part_shift); 1675 if (!disk) 1676 goto out_free_queue; 1677 1678 /* 1679 * Disable partition scanning by default. The in-kernel partition 1680 * scanning can be requested individually per-device during its 1681 * setup. Userspace can always add and remove partitions from all 1682 * devices. The needed partition minors are allocated from the 1683 * extended minor space, the main loop device numbers will continue 1684 * to match the loop minors, regardless of the number of partitions 1685 * used. 1686 * 1687 * If max_part is given, partition scanning is globally enabled for 1688 * all loop devices. The minors for the main loop devices will be 1689 * multiples of max_part. 1690 * 1691 * Note: Global-for-all-devices, set-only-at-init, read-only module 1692 * parameteters like 'max_loop' and 'max_part' make things needlessly 1693 * complicated, are too static, inflexible and may surprise 1694 * userspace tools. Parameters like this in general should be avoided. 1695 */ 1696 if (!part_shift) 1697 disk->flags |= GENHD_FL_NO_PART_SCAN; 1698 disk->flags |= GENHD_FL_EXT_DEVT; 1699 mutex_init(&lo->lo_ctl_mutex); 1700 lo->lo_number = i; 1701 lo->lo_thread = NULL; 1702 init_waitqueue_head(&lo->lo_event); 1703 spin_lock_init(&lo->lo_lock); 1704 disk->major = LOOP_MAJOR; 1705 disk->first_minor = i << part_shift; 1706 disk->fops = &lo_fops; 1707 disk->private_data = lo; 1708 disk->queue = lo->lo_queue; 1709 sprintf(disk->disk_name, "loop%d", i); 1710 return lo; 1711 1712 out_free_queue: 1713 blk_cleanup_queue(lo->lo_queue); 1714 out_free_dev: 1715 kfree(lo); 1716 out: 1717 return NULL; 1718 } 1719 1720 static void loop_free(struct loop_device *lo) 1721 { 1722 blk_cleanup_queue(lo->lo_queue); 1723 put_disk(lo->lo_disk); 1724 list_del(&lo->lo_list); 1725 kfree(lo); 1726 } 1727 1728 static struct loop_device *loop_init_one(int i) 1729 { 1730 struct loop_device *lo; 1731 1732 list_for_each_entry(lo, &loop_devices, lo_list) { 1733 if (lo->lo_number == i) 1734 return lo; 1735 } 1736 1737 lo = loop_alloc(i); 1738 if (lo) { 1739 add_disk(lo->lo_disk); 1740 list_add_tail(&lo->lo_list, &loop_devices); 1741 } 1742 return lo; 1743 } 1744 1745 static void loop_del_one(struct loop_device *lo) 1746 { 1747 del_gendisk(lo->lo_disk); 1748 loop_free(lo); 1749 } 1750 1751 static struct kobject *loop_probe(dev_t dev, int *part, void *data) 1752 { 1753 struct loop_device *lo; 1754 struct kobject *kobj; 1755 1756 mutex_lock(&loop_devices_mutex); 1757 lo = loop_init_one(MINOR(dev) >> part_shift); 1758 kobj = lo ? get_disk(lo->lo_disk) : ERR_PTR(-ENOMEM); 1759 mutex_unlock(&loop_devices_mutex); 1760 1761 *part = 0; 1762 return kobj; 1763 } 1764 1765 static int __init loop_init(void) 1766 { 1767 int i, nr; 1768 unsigned long range; 1769 struct loop_device *lo, *next; 1770 1771 /* 1772 * loop module now has a feature to instantiate underlying device 1773 * structure on-demand, provided that there is an access dev node. 1774 * However, this will not work well with user space tool that doesn't 1775 * know about such "feature". In order to not break any existing 1776 * tool, we do the following: 1777 * 1778 * (1) if max_loop is specified, create that many upfront, and this 1779 * also becomes a hard limit. 1780 * (2) if max_loop is not specified, create 8 loop device on module 1781 * load, user can further extend loop device by create dev node 1782 * themselves and have kernel automatically instantiate actual 1783 * device on-demand. 1784 */ 1785 1786 part_shift = 0; 1787 if (max_part > 0) { 1788 part_shift = fls(max_part); 1789 1790 /* 1791 * Adjust max_part according to part_shift as it is exported 1792 * to user space so that user can decide correct minor number 1793 * if [s]he want to create more devices. 1794 * 1795 * Note that -1 is required because partition 0 is reserved 1796 * for the whole disk. 1797 */ 1798 max_part = (1UL << part_shift) - 1; 1799 } 1800 1801 if ((1UL << part_shift) > DISK_MAX_PARTS) 1802 return -EINVAL; 1803 1804 if (max_loop > 1UL << (MINORBITS - part_shift)) 1805 return -EINVAL; 1806 1807 if (max_loop) { 1808 nr = max_loop; 1809 range = max_loop << part_shift; 1810 } else { 1811 nr = 8; 1812 range = 1UL << MINORBITS; 1813 } 1814 1815 if (register_blkdev(LOOP_MAJOR, "loop")) 1816 return -EIO; 1817 1818 for (i = 0; i < nr; i++) { 1819 lo = loop_alloc(i); 1820 if (!lo) 1821 goto Enomem; 1822 list_add_tail(&lo->lo_list, &loop_devices); 1823 } 1824 1825 /* point of no return */ 1826 1827 list_for_each_entry(lo, &loop_devices, lo_list) 1828 add_disk(lo->lo_disk); 1829 1830 blk_register_region(MKDEV(LOOP_MAJOR, 0), range, 1831 THIS_MODULE, loop_probe, NULL, NULL); 1832 1833 printk(KERN_INFO "loop: module loaded\n"); 1834 return 0; 1835 1836 Enomem: 1837 printk(KERN_INFO "loop: out of memory\n"); 1838 1839 list_for_each_entry_safe(lo, next, &loop_devices, lo_list) 1840 loop_free(lo); 1841 1842 unregister_blkdev(LOOP_MAJOR, "loop"); 1843 return -ENOMEM; 1844 } 1845 1846 static void __exit loop_exit(void) 1847 { 1848 unsigned long range; 1849 struct loop_device *lo, *next; 1850 1851 range = max_loop ? max_loop << part_shift : 1UL << MINORBITS; 1852 1853 list_for_each_entry_safe(lo, next, &loop_devices, lo_list) 1854 loop_del_one(lo); 1855 1856 blk_unregister_region(MKDEV(LOOP_MAJOR, 0), range); 1857 unregister_blkdev(LOOP_MAJOR, "loop"); 1858 } 1859 1860 module_init(loop_init); 1861 module_exit(loop_exit); 1862 1863 #ifndef MODULE 1864 static int __init max_loop_setup(char *str) 1865 { 1866 max_loop = simple_strtol(str, NULL, 0); 1867 return 1; 1868 } 1869 1870 __setup("max_loop=", max_loop_setup); 1871 #endif 1872