1 /* -*- linux-c -*- --------------------------------------------------------- * 2 * 3 * linux/fs/devpts/inode.c 4 * 5 * Copyright 1998-2004 H. Peter Anvin -- All Rights Reserved 6 * 7 * This file is part of the Linux kernel and is made available under 8 * the terms of the GNU General Public License, version 2, or at your 9 * option, any later version, incorporated herein by reference. 10 * 11 * ------------------------------------------------------------------------- */ 12 13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 14 15 #include <linux/module.h> 16 #include <linux/init.h> 17 #include <linux/fs.h> 18 #include <linux/sched.h> 19 #include <linux/namei.h> 20 #include <linux/slab.h> 21 #include <linux/mount.h> 22 #include <linux/tty.h> 23 #include <linux/mutex.h> 24 #include <linux/magic.h> 25 #include <linux/idr.h> 26 #include <linux/devpts_fs.h> 27 #include <linux/parser.h> 28 #include <linux/fsnotify.h> 29 #include <linux/seq_file.h> 30 31 #define DEVPTS_DEFAULT_MODE 0600 32 /* 33 * ptmx is a new node in /dev/pts and will be unused in legacy (single- 34 * instance) mode. To prevent surprises in user space, set permissions of 35 * ptmx to 0. Use 'chmod' or remount with '-o ptmxmode' to set meaningful 36 * permissions. 37 */ 38 #define DEVPTS_DEFAULT_PTMX_MODE 0000 39 #define PTMX_MINOR 2 40 41 /* 42 * sysctl support for setting limits on the number of Unix98 ptys allocated. 43 * Otherwise one can eat up all kernel memory by opening /dev/ptmx repeatedly. 44 */ 45 static int pty_limit = NR_UNIX98_PTY_DEFAULT; 46 static int pty_reserve = NR_UNIX98_PTY_RESERVE; 47 static int pty_limit_min; 48 static int pty_limit_max = INT_MAX; 49 static int pty_count; 50 51 static struct ctl_table pty_table[] = { 52 { 53 .procname = "max", 54 .maxlen = sizeof(int), 55 .mode = 0644, 56 .data = &pty_limit, 57 .proc_handler = proc_dointvec_minmax, 58 .extra1 = &pty_limit_min, 59 .extra2 = &pty_limit_max, 60 }, { 61 .procname = "reserve", 62 .maxlen = sizeof(int), 63 .mode = 0644, 64 .data = &pty_reserve, 65 .proc_handler = proc_dointvec_minmax, 66 .extra1 = &pty_limit_min, 67 .extra2 = &pty_limit_max, 68 }, { 69 .procname = "nr", 70 .maxlen = sizeof(int), 71 .mode = 0444, 72 .data = &pty_count, 73 .proc_handler = proc_dointvec, 74 }, 75 {} 76 }; 77 78 static struct ctl_table pty_kern_table[] = { 79 { 80 .procname = "pty", 81 .mode = 0555, 82 .child = pty_table, 83 }, 84 {} 85 }; 86 87 static struct ctl_table pty_root_table[] = { 88 { 89 .procname = "kernel", 90 .mode = 0555, 91 .child = pty_kern_table, 92 }, 93 {} 94 }; 95 96 static DEFINE_MUTEX(allocated_ptys_lock); 97 98 struct pts_mount_opts { 99 int setuid; 100 int setgid; 101 kuid_t uid; 102 kgid_t gid; 103 umode_t mode; 104 umode_t ptmxmode; 105 int reserve; 106 int max; 107 }; 108 109 enum { 110 Opt_uid, Opt_gid, Opt_mode, Opt_ptmxmode, Opt_newinstance, Opt_max, 111 Opt_err 112 }; 113 114 static const match_table_t tokens = { 115 {Opt_uid, "uid=%u"}, 116 {Opt_gid, "gid=%u"}, 117 {Opt_mode, "mode=%o"}, 118 {Opt_ptmxmode, "ptmxmode=%o"}, 119 {Opt_newinstance, "newinstance"}, 120 {Opt_max, "max=%d"}, 121 {Opt_err, NULL} 122 }; 123 124 struct pts_fs_info { 125 struct ida allocated_ptys; 126 struct pts_mount_opts mount_opts; 127 struct super_block *sb; 128 struct dentry *ptmx_dentry; 129 }; 130 131 static inline struct pts_fs_info *DEVPTS_SB(struct super_block *sb) 132 { 133 return sb->s_fs_info; 134 } 135 136 static int devpts_ptmx_path(struct path *path) 137 { 138 struct super_block *sb; 139 int err; 140 141 /* Is a devpts filesystem at "pts" in the same directory? */ 142 err = path_pts(path); 143 if (err) 144 return err; 145 146 /* Is the path the root of a devpts filesystem? */ 147 sb = path->mnt->mnt_sb; 148 if ((sb->s_magic != DEVPTS_SUPER_MAGIC) || 149 (path->mnt->mnt_root != sb->s_root)) 150 return -ENODEV; 151 152 return 0; 153 } 154 155 struct vfsmount *devpts_mntget(struct file *filp, struct pts_fs_info *fsi) 156 { 157 struct path path; 158 int err = 0; 159 160 path = filp->f_path; 161 path_get(&path); 162 163 /* Has the devpts filesystem already been found? */ 164 if (path.mnt->mnt_sb->s_magic != DEVPTS_SUPER_MAGIC) 165 err = devpts_ptmx_path(&path); 166 dput(path.dentry); 167 if (err) { 168 mntput(path.mnt); 169 return ERR_PTR(err); 170 } 171 172 if (DEVPTS_SB(path.mnt->mnt_sb) != fsi) { 173 mntput(path.mnt); 174 return ERR_PTR(-ENODEV); 175 } 176 177 return path.mnt; 178 } 179 180 struct pts_fs_info *devpts_acquire(struct file *filp) 181 { 182 struct pts_fs_info *result; 183 struct path path; 184 struct super_block *sb; 185 186 path = filp->f_path; 187 path_get(&path); 188 189 /* Has the devpts filesystem already been found? */ 190 if (path.mnt->mnt_sb->s_magic != DEVPTS_SUPER_MAGIC) { 191 int err; 192 193 err = devpts_ptmx_path(&path); 194 if (err) { 195 result = ERR_PTR(err); 196 goto out; 197 } 198 } 199 200 /* 201 * pty code needs to hold extra references in case of last /dev/tty close 202 */ 203 sb = path.mnt->mnt_sb; 204 atomic_inc(&sb->s_active); 205 result = DEVPTS_SB(sb); 206 207 out: 208 path_put(&path); 209 return result; 210 } 211 212 void devpts_release(struct pts_fs_info *fsi) 213 { 214 deactivate_super(fsi->sb); 215 } 216 217 #define PARSE_MOUNT 0 218 #define PARSE_REMOUNT 1 219 220 /* 221 * parse_mount_options(): 222 * Set @opts to mount options specified in @data. If an option is not 223 * specified in @data, set it to its default value. 224 * 225 * Note: @data may be NULL (in which case all options are set to default). 226 */ 227 static int parse_mount_options(char *data, int op, struct pts_mount_opts *opts) 228 { 229 char *p; 230 kuid_t uid; 231 kgid_t gid; 232 233 opts->setuid = 0; 234 opts->setgid = 0; 235 opts->uid = GLOBAL_ROOT_UID; 236 opts->gid = GLOBAL_ROOT_GID; 237 opts->mode = DEVPTS_DEFAULT_MODE; 238 opts->ptmxmode = DEVPTS_DEFAULT_PTMX_MODE; 239 opts->max = NR_UNIX98_PTY_MAX; 240 241 /* Only allow instances mounted from the initial mount 242 * namespace to tap the reserve pool of ptys. 243 */ 244 if (op == PARSE_MOUNT) 245 opts->reserve = 246 (current->nsproxy->mnt_ns == init_task.nsproxy->mnt_ns); 247 248 while ((p = strsep(&data, ",")) != NULL) { 249 substring_t args[MAX_OPT_ARGS]; 250 int token; 251 int option; 252 253 if (!*p) 254 continue; 255 256 token = match_token(p, tokens, args); 257 switch (token) { 258 case Opt_uid: 259 if (match_int(&args[0], &option)) 260 return -EINVAL; 261 uid = make_kuid(current_user_ns(), option); 262 if (!uid_valid(uid)) 263 return -EINVAL; 264 opts->uid = uid; 265 opts->setuid = 1; 266 break; 267 case Opt_gid: 268 if (match_int(&args[0], &option)) 269 return -EINVAL; 270 gid = make_kgid(current_user_ns(), option); 271 if (!gid_valid(gid)) 272 return -EINVAL; 273 opts->gid = gid; 274 opts->setgid = 1; 275 break; 276 case Opt_mode: 277 if (match_octal(&args[0], &option)) 278 return -EINVAL; 279 opts->mode = option & S_IALLUGO; 280 break; 281 case Opt_ptmxmode: 282 if (match_octal(&args[0], &option)) 283 return -EINVAL; 284 opts->ptmxmode = option & S_IALLUGO; 285 break; 286 case Opt_newinstance: 287 break; 288 case Opt_max: 289 if (match_int(&args[0], &option) || 290 option < 0 || option > NR_UNIX98_PTY_MAX) 291 return -EINVAL; 292 opts->max = option; 293 break; 294 default: 295 pr_err("called with bogus options\n"); 296 return -EINVAL; 297 } 298 } 299 300 return 0; 301 } 302 303 static int mknod_ptmx(struct super_block *sb) 304 { 305 int mode; 306 int rc = -ENOMEM; 307 struct dentry *dentry; 308 struct inode *inode; 309 struct dentry *root = sb->s_root; 310 struct pts_fs_info *fsi = DEVPTS_SB(sb); 311 struct pts_mount_opts *opts = &fsi->mount_opts; 312 kuid_t ptmx_uid = current_fsuid(); 313 kgid_t ptmx_gid = current_fsgid(); 314 315 inode_lock(d_inode(root)); 316 317 /* If we have already created ptmx node, return */ 318 if (fsi->ptmx_dentry) { 319 rc = 0; 320 goto out; 321 } 322 323 dentry = d_alloc_name(root, "ptmx"); 324 if (!dentry) { 325 pr_err("Unable to alloc dentry for ptmx node\n"); 326 goto out; 327 } 328 329 /* 330 * Create a new 'ptmx' node in this mount of devpts. 331 */ 332 inode = new_inode(sb); 333 if (!inode) { 334 pr_err("Unable to alloc inode for ptmx node\n"); 335 dput(dentry); 336 goto out; 337 } 338 339 inode->i_ino = 2; 340 inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); 341 342 mode = S_IFCHR|opts->ptmxmode; 343 init_special_inode(inode, mode, MKDEV(TTYAUX_MAJOR, 2)); 344 inode->i_uid = ptmx_uid; 345 inode->i_gid = ptmx_gid; 346 347 d_add(dentry, inode); 348 349 fsi->ptmx_dentry = dentry; 350 rc = 0; 351 out: 352 inode_unlock(d_inode(root)); 353 return rc; 354 } 355 356 static void update_ptmx_mode(struct pts_fs_info *fsi) 357 { 358 struct inode *inode; 359 if (fsi->ptmx_dentry) { 360 inode = d_inode(fsi->ptmx_dentry); 361 inode->i_mode = S_IFCHR|fsi->mount_opts.ptmxmode; 362 } 363 } 364 365 static int devpts_remount(struct super_block *sb, int *flags, char *data) 366 { 367 int err; 368 struct pts_fs_info *fsi = DEVPTS_SB(sb); 369 struct pts_mount_opts *opts = &fsi->mount_opts; 370 371 err = parse_mount_options(data, PARSE_REMOUNT, opts); 372 373 /* 374 * parse_mount_options() restores options to default values 375 * before parsing and may have changed ptmxmode. So, update the 376 * mode in the inode too. Bogus options don't fail the remount, 377 * so do this even on error return. 378 */ 379 update_ptmx_mode(fsi); 380 381 return err; 382 } 383 384 static int devpts_show_options(struct seq_file *seq, struct dentry *root) 385 { 386 struct pts_fs_info *fsi = DEVPTS_SB(root->d_sb); 387 struct pts_mount_opts *opts = &fsi->mount_opts; 388 389 if (opts->setuid) 390 seq_printf(seq, ",uid=%u", 391 from_kuid_munged(&init_user_ns, opts->uid)); 392 if (opts->setgid) 393 seq_printf(seq, ",gid=%u", 394 from_kgid_munged(&init_user_ns, opts->gid)); 395 seq_printf(seq, ",mode=%03o", opts->mode); 396 seq_printf(seq, ",ptmxmode=%03o", opts->ptmxmode); 397 if (opts->max < NR_UNIX98_PTY_MAX) 398 seq_printf(seq, ",max=%d", opts->max); 399 400 return 0; 401 } 402 403 static const struct super_operations devpts_sops = { 404 .statfs = simple_statfs, 405 .remount_fs = devpts_remount, 406 .show_options = devpts_show_options, 407 }; 408 409 static void *new_pts_fs_info(struct super_block *sb) 410 { 411 struct pts_fs_info *fsi; 412 413 fsi = kzalloc(sizeof(struct pts_fs_info), GFP_KERNEL); 414 if (!fsi) 415 return NULL; 416 417 ida_init(&fsi->allocated_ptys); 418 fsi->mount_opts.mode = DEVPTS_DEFAULT_MODE; 419 fsi->mount_opts.ptmxmode = DEVPTS_DEFAULT_PTMX_MODE; 420 fsi->sb = sb; 421 422 return fsi; 423 } 424 425 static int 426 devpts_fill_super(struct super_block *s, void *data, int silent) 427 { 428 struct inode *inode; 429 int error; 430 431 s->s_iflags &= ~SB_I_NODEV; 432 s->s_blocksize = 1024; 433 s->s_blocksize_bits = 10; 434 s->s_magic = DEVPTS_SUPER_MAGIC; 435 s->s_op = &devpts_sops; 436 s->s_time_gran = 1; 437 438 error = -ENOMEM; 439 s->s_fs_info = new_pts_fs_info(s); 440 if (!s->s_fs_info) 441 goto fail; 442 443 error = parse_mount_options(data, PARSE_MOUNT, &DEVPTS_SB(s)->mount_opts); 444 if (error) 445 goto fail; 446 447 error = -ENOMEM; 448 inode = new_inode(s); 449 if (!inode) 450 goto fail; 451 inode->i_ino = 1; 452 inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); 453 inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR; 454 inode->i_op = &simple_dir_inode_operations; 455 inode->i_fop = &simple_dir_operations; 456 set_nlink(inode, 2); 457 458 s->s_root = d_make_root(inode); 459 if (!s->s_root) { 460 pr_err("get root dentry failed\n"); 461 goto fail; 462 } 463 464 error = mknod_ptmx(s); 465 if (error) 466 goto fail_dput; 467 468 return 0; 469 fail_dput: 470 dput(s->s_root); 471 s->s_root = NULL; 472 fail: 473 return error; 474 } 475 476 /* 477 * devpts_mount() 478 * 479 * Mount a new (private) instance of devpts. PTYs created in this 480 * instance are independent of the PTYs in other devpts instances. 481 */ 482 static struct dentry *devpts_mount(struct file_system_type *fs_type, 483 int flags, const char *dev_name, void *data) 484 { 485 return mount_nodev(fs_type, flags, data, devpts_fill_super); 486 } 487 488 static void devpts_kill_sb(struct super_block *sb) 489 { 490 struct pts_fs_info *fsi = DEVPTS_SB(sb); 491 492 if (fsi) 493 ida_destroy(&fsi->allocated_ptys); 494 kfree(fsi); 495 kill_litter_super(sb); 496 } 497 498 static struct file_system_type devpts_fs_type = { 499 .name = "devpts", 500 .mount = devpts_mount, 501 .kill_sb = devpts_kill_sb, 502 .fs_flags = FS_USERNS_MOUNT, 503 }; 504 505 /* 506 * The normal naming convention is simply /dev/pts/<number>; this conforms 507 * to the System V naming convention 508 */ 509 510 int devpts_new_index(struct pts_fs_info *fsi) 511 { 512 int index; 513 int ida_ret; 514 515 retry: 516 if (!ida_pre_get(&fsi->allocated_ptys, GFP_KERNEL)) 517 return -ENOMEM; 518 519 mutex_lock(&allocated_ptys_lock); 520 if (pty_count >= (pty_limit - 521 (fsi->mount_opts.reserve ? 0 : pty_reserve))) { 522 mutex_unlock(&allocated_ptys_lock); 523 return -ENOSPC; 524 } 525 526 ida_ret = ida_get_new(&fsi->allocated_ptys, &index); 527 if (ida_ret < 0) { 528 mutex_unlock(&allocated_ptys_lock); 529 if (ida_ret == -EAGAIN) 530 goto retry; 531 return -EIO; 532 } 533 534 if (index >= fsi->mount_opts.max) { 535 ida_remove(&fsi->allocated_ptys, index); 536 mutex_unlock(&allocated_ptys_lock); 537 return -ENOSPC; 538 } 539 pty_count++; 540 mutex_unlock(&allocated_ptys_lock); 541 return index; 542 } 543 544 void devpts_kill_index(struct pts_fs_info *fsi, int idx) 545 { 546 mutex_lock(&allocated_ptys_lock); 547 ida_remove(&fsi->allocated_ptys, idx); 548 pty_count--; 549 mutex_unlock(&allocated_ptys_lock); 550 } 551 552 /** 553 * devpts_pty_new -- create a new inode in /dev/pts/ 554 * @ptmx_inode: inode of the master 555 * @device: major+minor of the node to be created 556 * @index: used as a name of the node 557 * @priv: what's given back by devpts_get_priv 558 * 559 * The created inode is returned. Remove it from /dev/pts/ by devpts_pty_kill. 560 */ 561 struct dentry *devpts_pty_new(struct pts_fs_info *fsi, int index, void *priv) 562 { 563 struct dentry *dentry; 564 struct super_block *sb = fsi->sb; 565 struct inode *inode; 566 struct dentry *root; 567 struct pts_mount_opts *opts; 568 char s[12]; 569 570 root = sb->s_root; 571 opts = &fsi->mount_opts; 572 573 inode = new_inode(sb); 574 if (!inode) 575 return ERR_PTR(-ENOMEM); 576 577 inode->i_ino = index + 3; 578 inode->i_uid = opts->setuid ? opts->uid : current_fsuid(); 579 inode->i_gid = opts->setgid ? opts->gid : current_fsgid(); 580 inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); 581 init_special_inode(inode, S_IFCHR|opts->mode, MKDEV(UNIX98_PTY_SLAVE_MAJOR, index)); 582 583 sprintf(s, "%d", index); 584 585 dentry = d_alloc_name(root, s); 586 if (dentry) { 587 dentry->d_fsdata = priv; 588 d_add(dentry, inode); 589 fsnotify_create(d_inode(root), dentry); 590 } else { 591 iput(inode); 592 dentry = ERR_PTR(-ENOMEM); 593 } 594 595 return dentry; 596 } 597 598 /** 599 * devpts_get_priv -- get private data for a slave 600 * @pts_inode: inode of the slave 601 * 602 * Returns whatever was passed as priv in devpts_pty_new for a given inode. 603 */ 604 void *devpts_get_priv(struct dentry *dentry) 605 { 606 if (dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC) 607 return NULL; 608 return dentry->d_fsdata; 609 } 610 611 /** 612 * devpts_pty_kill -- remove inode form /dev/pts/ 613 * @inode: inode of the slave to be removed 614 * 615 * This is an inverse operation of devpts_pty_new. 616 */ 617 void devpts_pty_kill(struct dentry *dentry) 618 { 619 WARN_ON_ONCE(dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC); 620 621 dentry->d_fsdata = NULL; 622 drop_nlink(dentry->d_inode); 623 d_delete(dentry); 624 dput(dentry); /* d_alloc_name() in devpts_pty_new() */ 625 } 626 627 static int __init init_devpts_fs(void) 628 { 629 int err = register_filesystem(&devpts_fs_type); 630 if (!err) { 631 register_sysctl_table(pty_root_table); 632 } 633 return err; 634 } 635 module_init(init_devpts_fs) 636