1 /* -*- linux-c -*- --------------------------------------------------------- * 2 * 3 * linux/fs/devpts/inode.c 4 * 5 * Copyright 1998-2004 H. Peter Anvin -- All Rights Reserved 6 * 7 * This file is part of the Linux kernel and is made available under 8 * the terms of the GNU General Public License, version 2, or at your 9 * option, any later version, incorporated herein by reference. 10 * 11 * ------------------------------------------------------------------------- */ 12 13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 14 15 #include <linux/module.h> 16 #include <linux/init.h> 17 #include <linux/fs.h> 18 #include <linux/sched.h> 19 #include <linux/namei.h> 20 #include <linux/slab.h> 21 #include <linux/mount.h> 22 #include <linux/tty.h> 23 #include <linux/mutex.h> 24 #include <linux/magic.h> 25 #include <linux/idr.h> 26 #include <linux/devpts_fs.h> 27 #include <linux/parser.h> 28 #include <linux/fsnotify.h> 29 #include <linux/seq_file.h> 30 31 #define DEVPTS_DEFAULT_MODE 0600 32 /* 33 * ptmx is a new node in /dev/pts and will be unused in legacy (single- 34 * instance) mode. To prevent surprises in user space, set permissions of 35 * ptmx to 0. Use 'chmod' or remount with '-o ptmxmode' to set meaningful 36 * permissions. 37 */ 38 #define DEVPTS_DEFAULT_PTMX_MODE 0000 39 #define PTMX_MINOR 2 40 41 /* 42 * sysctl support for setting limits on the number of Unix98 ptys allocated. 43 * Otherwise one can eat up all kernel memory by opening /dev/ptmx repeatedly. 44 */ 45 static int pty_limit = NR_UNIX98_PTY_DEFAULT; 46 static int pty_reserve = NR_UNIX98_PTY_RESERVE; 47 static int pty_limit_min; 48 static int pty_limit_max = INT_MAX; 49 static int pty_count; 50 51 static struct ctl_table pty_table[] = { 52 { 53 .procname = "max", 54 .maxlen = sizeof(int), 55 .mode = 0644, 56 .data = &pty_limit, 57 .proc_handler = proc_dointvec_minmax, 58 .extra1 = &pty_limit_min, 59 .extra2 = &pty_limit_max, 60 }, { 61 .procname = "reserve", 62 .maxlen = sizeof(int), 63 .mode = 0644, 64 .data = &pty_reserve, 65 .proc_handler = proc_dointvec_minmax, 66 .extra1 = &pty_limit_min, 67 .extra2 = &pty_limit_max, 68 }, { 69 .procname = "nr", 70 .maxlen = sizeof(int), 71 .mode = 0444, 72 .data = &pty_count, 73 .proc_handler = proc_dointvec, 74 }, 75 {} 76 }; 77 78 static struct ctl_table pty_kern_table[] = { 79 { 80 .procname = "pty", 81 .mode = 0555, 82 .child = pty_table, 83 }, 84 {} 85 }; 86 87 static struct ctl_table pty_root_table[] = { 88 { 89 .procname = "kernel", 90 .mode = 0555, 91 .child = pty_kern_table, 92 }, 93 {} 94 }; 95 96 static DEFINE_MUTEX(allocated_ptys_lock); 97 98 struct pts_mount_opts { 99 int setuid; 100 int setgid; 101 kuid_t uid; 102 kgid_t gid; 103 umode_t mode; 104 umode_t ptmxmode; 105 int reserve; 106 int max; 107 }; 108 109 enum { 110 Opt_uid, Opt_gid, Opt_mode, Opt_ptmxmode, Opt_newinstance, Opt_max, 111 Opt_err 112 }; 113 114 static const match_table_t tokens = { 115 {Opt_uid, "uid=%u"}, 116 {Opt_gid, "gid=%u"}, 117 {Opt_mode, "mode=%o"}, 118 {Opt_ptmxmode, "ptmxmode=%o"}, 119 {Opt_newinstance, "newinstance"}, 120 {Opt_max, "max=%d"}, 121 {Opt_err, NULL} 122 }; 123 124 struct pts_fs_info { 125 struct ida allocated_ptys; 126 struct pts_mount_opts mount_opts; 127 struct super_block *sb; 128 struct dentry *ptmx_dentry; 129 }; 130 131 static inline struct pts_fs_info *DEVPTS_SB(struct super_block *sb) 132 { 133 return sb->s_fs_info; 134 } 135 136 static int devpts_ptmx_path(struct path *path) 137 { 138 struct super_block *sb; 139 int err; 140 141 /* Is a devpts filesystem at "pts" in the same directory? */ 142 err = path_pts(path); 143 if (err) 144 return err; 145 146 /* Is the path the root of a devpts filesystem? */ 147 sb = path->mnt->mnt_sb; 148 if ((sb->s_magic != DEVPTS_SUPER_MAGIC) || 149 (path->mnt->mnt_root != sb->s_root)) 150 return -ENODEV; 151 152 return 0; 153 } 154 155 struct vfsmount *devpts_mntget(struct file *filp, struct pts_fs_info *fsi) 156 { 157 struct path path; 158 int err = 0; 159 160 path = filp->f_path; 161 path_get(&path); 162 163 /* Walk upward while the start point is a bind mount of 164 * a single file. 165 */ 166 while (path.mnt->mnt_root == path.dentry) 167 if (follow_up(&path) == 0) 168 break; 169 170 /* devpts_ptmx_path() finds a devpts fs or returns an error. */ 171 if ((path.mnt->mnt_sb->s_magic != DEVPTS_SUPER_MAGIC) || 172 (DEVPTS_SB(path.mnt->mnt_sb) != fsi)) 173 err = devpts_ptmx_path(&path); 174 dput(path.dentry); 175 if (!err) { 176 if (DEVPTS_SB(path.mnt->mnt_sb) == fsi) 177 return path.mnt; 178 179 err = -ENODEV; 180 } 181 182 mntput(path.mnt); 183 return ERR_PTR(err); 184 } 185 186 struct pts_fs_info *devpts_acquire(struct file *filp) 187 { 188 struct pts_fs_info *result; 189 struct path path; 190 struct super_block *sb; 191 192 path = filp->f_path; 193 path_get(&path); 194 195 /* Has the devpts filesystem already been found? */ 196 if (path.mnt->mnt_sb->s_magic != DEVPTS_SUPER_MAGIC) { 197 int err; 198 199 err = devpts_ptmx_path(&path); 200 if (err) { 201 result = ERR_PTR(err); 202 goto out; 203 } 204 } 205 206 /* 207 * pty code needs to hold extra references in case of last /dev/tty close 208 */ 209 sb = path.mnt->mnt_sb; 210 atomic_inc(&sb->s_active); 211 result = DEVPTS_SB(sb); 212 213 out: 214 path_put(&path); 215 return result; 216 } 217 218 void devpts_release(struct pts_fs_info *fsi) 219 { 220 deactivate_super(fsi->sb); 221 } 222 223 #define PARSE_MOUNT 0 224 #define PARSE_REMOUNT 1 225 226 /* 227 * parse_mount_options(): 228 * Set @opts to mount options specified in @data. If an option is not 229 * specified in @data, set it to its default value. 230 * 231 * Note: @data may be NULL (in which case all options are set to default). 232 */ 233 static int parse_mount_options(char *data, int op, struct pts_mount_opts *opts) 234 { 235 char *p; 236 kuid_t uid; 237 kgid_t gid; 238 239 opts->setuid = 0; 240 opts->setgid = 0; 241 opts->uid = GLOBAL_ROOT_UID; 242 opts->gid = GLOBAL_ROOT_GID; 243 opts->mode = DEVPTS_DEFAULT_MODE; 244 opts->ptmxmode = DEVPTS_DEFAULT_PTMX_MODE; 245 opts->max = NR_UNIX98_PTY_MAX; 246 247 /* Only allow instances mounted from the initial mount 248 * namespace to tap the reserve pool of ptys. 249 */ 250 if (op == PARSE_MOUNT) 251 opts->reserve = 252 (current->nsproxy->mnt_ns == init_task.nsproxy->mnt_ns); 253 254 while ((p = strsep(&data, ",")) != NULL) { 255 substring_t args[MAX_OPT_ARGS]; 256 int token; 257 int option; 258 259 if (!*p) 260 continue; 261 262 token = match_token(p, tokens, args); 263 switch (token) { 264 case Opt_uid: 265 if (match_int(&args[0], &option)) 266 return -EINVAL; 267 uid = make_kuid(current_user_ns(), option); 268 if (!uid_valid(uid)) 269 return -EINVAL; 270 opts->uid = uid; 271 opts->setuid = 1; 272 break; 273 case Opt_gid: 274 if (match_int(&args[0], &option)) 275 return -EINVAL; 276 gid = make_kgid(current_user_ns(), option); 277 if (!gid_valid(gid)) 278 return -EINVAL; 279 opts->gid = gid; 280 opts->setgid = 1; 281 break; 282 case Opt_mode: 283 if (match_octal(&args[0], &option)) 284 return -EINVAL; 285 opts->mode = option & S_IALLUGO; 286 break; 287 case Opt_ptmxmode: 288 if (match_octal(&args[0], &option)) 289 return -EINVAL; 290 opts->ptmxmode = option & S_IALLUGO; 291 break; 292 case Opt_newinstance: 293 break; 294 case Opt_max: 295 if (match_int(&args[0], &option) || 296 option < 0 || option > NR_UNIX98_PTY_MAX) 297 return -EINVAL; 298 opts->max = option; 299 break; 300 default: 301 pr_err("called with bogus options\n"); 302 return -EINVAL; 303 } 304 } 305 306 return 0; 307 } 308 309 static int mknod_ptmx(struct super_block *sb) 310 { 311 int mode; 312 int rc = -ENOMEM; 313 struct dentry *dentry; 314 struct inode *inode; 315 struct dentry *root = sb->s_root; 316 struct pts_fs_info *fsi = DEVPTS_SB(sb); 317 struct pts_mount_opts *opts = &fsi->mount_opts; 318 kuid_t ptmx_uid = current_fsuid(); 319 kgid_t ptmx_gid = current_fsgid(); 320 321 inode_lock(d_inode(root)); 322 323 /* If we have already created ptmx node, return */ 324 if (fsi->ptmx_dentry) { 325 rc = 0; 326 goto out; 327 } 328 329 dentry = d_alloc_name(root, "ptmx"); 330 if (!dentry) { 331 pr_err("Unable to alloc dentry for ptmx node\n"); 332 goto out; 333 } 334 335 /* 336 * Create a new 'ptmx' node in this mount of devpts. 337 */ 338 inode = new_inode(sb); 339 if (!inode) { 340 pr_err("Unable to alloc inode for ptmx node\n"); 341 dput(dentry); 342 goto out; 343 } 344 345 inode->i_ino = 2; 346 inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); 347 348 mode = S_IFCHR|opts->ptmxmode; 349 init_special_inode(inode, mode, MKDEV(TTYAUX_MAJOR, 2)); 350 inode->i_uid = ptmx_uid; 351 inode->i_gid = ptmx_gid; 352 353 d_add(dentry, inode); 354 355 fsi->ptmx_dentry = dentry; 356 rc = 0; 357 out: 358 inode_unlock(d_inode(root)); 359 return rc; 360 } 361 362 static void update_ptmx_mode(struct pts_fs_info *fsi) 363 { 364 struct inode *inode; 365 if (fsi->ptmx_dentry) { 366 inode = d_inode(fsi->ptmx_dentry); 367 inode->i_mode = S_IFCHR|fsi->mount_opts.ptmxmode; 368 } 369 } 370 371 static int devpts_remount(struct super_block *sb, int *flags, char *data) 372 { 373 int err; 374 struct pts_fs_info *fsi = DEVPTS_SB(sb); 375 struct pts_mount_opts *opts = &fsi->mount_opts; 376 377 err = parse_mount_options(data, PARSE_REMOUNT, opts); 378 379 /* 380 * parse_mount_options() restores options to default values 381 * before parsing and may have changed ptmxmode. So, update the 382 * mode in the inode too. Bogus options don't fail the remount, 383 * so do this even on error return. 384 */ 385 update_ptmx_mode(fsi); 386 387 return err; 388 } 389 390 static int devpts_show_options(struct seq_file *seq, struct dentry *root) 391 { 392 struct pts_fs_info *fsi = DEVPTS_SB(root->d_sb); 393 struct pts_mount_opts *opts = &fsi->mount_opts; 394 395 if (opts->setuid) 396 seq_printf(seq, ",uid=%u", 397 from_kuid_munged(&init_user_ns, opts->uid)); 398 if (opts->setgid) 399 seq_printf(seq, ",gid=%u", 400 from_kgid_munged(&init_user_ns, opts->gid)); 401 seq_printf(seq, ",mode=%03o", opts->mode); 402 seq_printf(seq, ",ptmxmode=%03o", opts->ptmxmode); 403 if (opts->max < NR_UNIX98_PTY_MAX) 404 seq_printf(seq, ",max=%d", opts->max); 405 406 return 0; 407 } 408 409 static const struct super_operations devpts_sops = { 410 .statfs = simple_statfs, 411 .remount_fs = devpts_remount, 412 .show_options = devpts_show_options, 413 }; 414 415 static void *new_pts_fs_info(struct super_block *sb) 416 { 417 struct pts_fs_info *fsi; 418 419 fsi = kzalloc(sizeof(struct pts_fs_info), GFP_KERNEL); 420 if (!fsi) 421 return NULL; 422 423 ida_init(&fsi->allocated_ptys); 424 fsi->mount_opts.mode = DEVPTS_DEFAULT_MODE; 425 fsi->mount_opts.ptmxmode = DEVPTS_DEFAULT_PTMX_MODE; 426 fsi->sb = sb; 427 428 return fsi; 429 } 430 431 static int 432 devpts_fill_super(struct super_block *s, void *data, int silent) 433 { 434 struct inode *inode; 435 int error; 436 437 s->s_iflags &= ~SB_I_NODEV; 438 s->s_blocksize = 1024; 439 s->s_blocksize_bits = 10; 440 s->s_magic = DEVPTS_SUPER_MAGIC; 441 s->s_op = &devpts_sops; 442 s->s_time_gran = 1; 443 444 error = -ENOMEM; 445 s->s_fs_info = new_pts_fs_info(s); 446 if (!s->s_fs_info) 447 goto fail; 448 449 error = parse_mount_options(data, PARSE_MOUNT, &DEVPTS_SB(s)->mount_opts); 450 if (error) 451 goto fail; 452 453 error = -ENOMEM; 454 inode = new_inode(s); 455 if (!inode) 456 goto fail; 457 inode->i_ino = 1; 458 inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); 459 inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR; 460 inode->i_op = &simple_dir_inode_operations; 461 inode->i_fop = &simple_dir_operations; 462 set_nlink(inode, 2); 463 464 s->s_root = d_make_root(inode); 465 if (!s->s_root) { 466 pr_err("get root dentry failed\n"); 467 goto fail; 468 } 469 470 error = mknod_ptmx(s); 471 if (error) 472 goto fail_dput; 473 474 return 0; 475 fail_dput: 476 dput(s->s_root); 477 s->s_root = NULL; 478 fail: 479 return error; 480 } 481 482 /* 483 * devpts_mount() 484 * 485 * Mount a new (private) instance of devpts. PTYs created in this 486 * instance are independent of the PTYs in other devpts instances. 487 */ 488 static struct dentry *devpts_mount(struct file_system_type *fs_type, 489 int flags, const char *dev_name, void *data) 490 { 491 return mount_nodev(fs_type, flags, data, devpts_fill_super); 492 } 493 494 static void devpts_kill_sb(struct super_block *sb) 495 { 496 struct pts_fs_info *fsi = DEVPTS_SB(sb); 497 498 if (fsi) 499 ida_destroy(&fsi->allocated_ptys); 500 kfree(fsi); 501 kill_litter_super(sb); 502 } 503 504 static struct file_system_type devpts_fs_type = { 505 .name = "devpts", 506 .mount = devpts_mount, 507 .kill_sb = devpts_kill_sb, 508 .fs_flags = FS_USERNS_MOUNT, 509 }; 510 511 /* 512 * The normal naming convention is simply /dev/pts/<number>; this conforms 513 * to the System V naming convention 514 */ 515 516 int devpts_new_index(struct pts_fs_info *fsi) 517 { 518 int index; 519 int ida_ret; 520 521 retry: 522 if (!ida_pre_get(&fsi->allocated_ptys, GFP_KERNEL)) 523 return -ENOMEM; 524 525 mutex_lock(&allocated_ptys_lock); 526 if (pty_count >= (pty_limit - 527 (fsi->mount_opts.reserve ? 0 : pty_reserve))) { 528 mutex_unlock(&allocated_ptys_lock); 529 return -ENOSPC; 530 } 531 532 ida_ret = ida_get_new(&fsi->allocated_ptys, &index); 533 if (ida_ret < 0) { 534 mutex_unlock(&allocated_ptys_lock); 535 if (ida_ret == -EAGAIN) 536 goto retry; 537 return -EIO; 538 } 539 540 if (index >= fsi->mount_opts.max) { 541 ida_remove(&fsi->allocated_ptys, index); 542 mutex_unlock(&allocated_ptys_lock); 543 return -ENOSPC; 544 } 545 pty_count++; 546 mutex_unlock(&allocated_ptys_lock); 547 return index; 548 } 549 550 void devpts_kill_index(struct pts_fs_info *fsi, int idx) 551 { 552 mutex_lock(&allocated_ptys_lock); 553 ida_remove(&fsi->allocated_ptys, idx); 554 pty_count--; 555 mutex_unlock(&allocated_ptys_lock); 556 } 557 558 /** 559 * devpts_pty_new -- create a new inode in /dev/pts/ 560 * @ptmx_inode: inode of the master 561 * @device: major+minor of the node to be created 562 * @index: used as a name of the node 563 * @priv: what's given back by devpts_get_priv 564 * 565 * The created inode is returned. Remove it from /dev/pts/ by devpts_pty_kill. 566 */ 567 struct dentry *devpts_pty_new(struct pts_fs_info *fsi, int index, void *priv) 568 { 569 struct dentry *dentry; 570 struct super_block *sb = fsi->sb; 571 struct inode *inode; 572 struct dentry *root; 573 struct pts_mount_opts *opts; 574 char s[12]; 575 576 root = sb->s_root; 577 opts = &fsi->mount_opts; 578 579 inode = new_inode(sb); 580 if (!inode) 581 return ERR_PTR(-ENOMEM); 582 583 inode->i_ino = index + 3; 584 inode->i_uid = opts->setuid ? opts->uid : current_fsuid(); 585 inode->i_gid = opts->setgid ? opts->gid : current_fsgid(); 586 inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); 587 init_special_inode(inode, S_IFCHR|opts->mode, MKDEV(UNIX98_PTY_SLAVE_MAJOR, index)); 588 589 sprintf(s, "%d", index); 590 591 dentry = d_alloc_name(root, s); 592 if (dentry) { 593 dentry->d_fsdata = priv; 594 d_add(dentry, inode); 595 fsnotify_create(d_inode(root), dentry); 596 } else { 597 iput(inode); 598 dentry = ERR_PTR(-ENOMEM); 599 } 600 601 return dentry; 602 } 603 604 /** 605 * devpts_get_priv -- get private data for a slave 606 * @pts_inode: inode of the slave 607 * 608 * Returns whatever was passed as priv in devpts_pty_new for a given inode. 609 */ 610 void *devpts_get_priv(struct dentry *dentry) 611 { 612 if (dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC) 613 return NULL; 614 return dentry->d_fsdata; 615 } 616 617 /** 618 * devpts_pty_kill -- remove inode form /dev/pts/ 619 * @inode: inode of the slave to be removed 620 * 621 * This is an inverse operation of devpts_pty_new. 622 */ 623 void devpts_pty_kill(struct dentry *dentry) 624 { 625 WARN_ON_ONCE(dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC); 626 627 dentry->d_fsdata = NULL; 628 drop_nlink(dentry->d_inode); 629 d_delete(dentry); 630 dput(dentry); /* d_alloc_name() in devpts_pty_new() */ 631 } 632 633 static int __init init_devpts_fs(void) 634 { 635 int err = register_filesystem(&devpts_fs_type); 636 if (!err) { 637 register_sysctl_table(pty_root_table); 638 } 639 return err; 640 } 641 module_init(init_devpts_fs) 642