1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * linux/fs/proc/inode.c
4 *
5 * Copyright (C) 1991, 1992 Linus Torvalds
6 */
7
8 #include <linux/cache.h>
9 #include <linux/time.h>
10 #include <linux/proc_fs.h>
11 #include <linux/kernel.h>
12 #include <linux/pid_namespace.h>
13 #include <linux/mm.h>
14 #include <linux/string.h>
15 #include <linux/stat.h>
16 #include <linux/completion.h>
17 #include <linux/poll.h>
18 #include <linux/printk.h>
19 #include <linux/file.h>
20 #include <linux/limits.h>
21 #include <linux/init.h>
22 #include <linux/module.h>
23 #include <linux/sysctl.h>
24 #include <linux/seq_file.h>
25 #include <linux/slab.h>
26 #include <linux/mount.h>
27 #include <linux/magic.h>
28
29 #include <linux/uaccess.h>
30
31 #include "internal.h"
32
proc_evict_inode(struct inode * inode)33 static void proc_evict_inode(struct inode *inode)
34 {
35 struct proc_dir_entry *de;
36 struct ctl_table_header *head;
37
38 truncate_inode_pages_final(&inode->i_data);
39 clear_inode(inode);
40
41 /* Stop tracking associated processes */
42 put_pid(PROC_I(inode)->pid);
43
44 /* Let go of any associated proc directory entry */
45 de = PDE(inode);
46 if (de)
47 pde_put(de);
48
49 head = PROC_I(inode)->sysctl;
50 if (head) {
51 RCU_INIT_POINTER(PROC_I(inode)->sysctl, NULL);
52 proc_sys_evict_inode(inode, head);
53 }
54 }
55
56 static struct kmem_cache *proc_inode_cachep __ro_after_init;
57 static struct kmem_cache *pde_opener_cache __ro_after_init;
58
proc_alloc_inode(struct super_block * sb)59 static struct inode *proc_alloc_inode(struct super_block *sb)
60 {
61 struct proc_inode *ei;
62 struct inode *inode;
63
64 ei = kmem_cache_alloc(proc_inode_cachep, GFP_KERNEL);
65 if (!ei)
66 return NULL;
67 ei->pid = NULL;
68 ei->fd = 0;
69 ei->op.proc_get_link = NULL;
70 ei->pde = NULL;
71 ei->sysctl = NULL;
72 ei->sysctl_entry = NULL;
73 ei->ns_ops = NULL;
74 inode = &ei->vfs_inode;
75 return inode;
76 }
77
proc_i_callback(struct rcu_head * head)78 static void proc_i_callback(struct rcu_head *head)
79 {
80 struct inode *inode = container_of(head, struct inode, i_rcu);
81 kmem_cache_free(proc_inode_cachep, PROC_I(inode));
82 }
83
proc_destroy_inode(struct inode * inode)84 static void proc_destroy_inode(struct inode *inode)
85 {
86 call_rcu(&inode->i_rcu, proc_i_callback);
87 }
88
init_once(void * foo)89 static void init_once(void *foo)
90 {
91 struct proc_inode *ei = (struct proc_inode *) foo;
92
93 inode_init_once(&ei->vfs_inode);
94 }
95
proc_init_kmemcache(void)96 void __init proc_init_kmemcache(void)
97 {
98 proc_inode_cachep = kmem_cache_create("proc_inode_cache",
99 sizeof(struct proc_inode),
100 0, (SLAB_RECLAIM_ACCOUNT|
101 SLAB_MEM_SPREAD|SLAB_ACCOUNT|
102 SLAB_PANIC),
103 init_once);
104 pde_opener_cache =
105 kmem_cache_create("pde_opener", sizeof(struct pde_opener), 0,
106 SLAB_ACCOUNT|SLAB_PANIC, NULL);
107 proc_dir_entry_cache = kmem_cache_create_usercopy(
108 "proc_dir_entry", SIZEOF_PDE, 0, SLAB_PANIC,
109 offsetof(struct proc_dir_entry, inline_name),
110 SIZEOF_PDE_INLINE_NAME, NULL);
111 BUILD_BUG_ON(sizeof(struct proc_dir_entry) >= SIZEOF_PDE);
112 }
113
proc_show_options(struct seq_file * seq,struct dentry * root)114 static int proc_show_options(struct seq_file *seq, struct dentry *root)
115 {
116 struct super_block *sb = root->d_sb;
117 struct pid_namespace *pid = sb->s_fs_info;
118
119 if (!gid_eq(pid->pid_gid, GLOBAL_ROOT_GID))
120 seq_printf(seq, ",gid=%u", from_kgid_munged(&init_user_ns, pid->pid_gid));
121 if (pid->hide_pid != HIDEPID_OFF)
122 seq_printf(seq, ",hidepid=%u", pid->hide_pid);
123
124 return 0;
125 }
126
127 static const struct super_operations proc_sops = {
128 .alloc_inode = proc_alloc_inode,
129 .destroy_inode = proc_destroy_inode,
130 .drop_inode = generic_delete_inode,
131 .evict_inode = proc_evict_inode,
132 .statfs = simple_statfs,
133 .remount_fs = proc_remount,
134 .show_options = proc_show_options,
135 };
136
137 enum {BIAS = -1U<<31};
138
use_pde(struct proc_dir_entry * pde)139 static inline int use_pde(struct proc_dir_entry *pde)
140 {
141 return likely(atomic_inc_unless_negative(&pde->in_use));
142 }
143
unuse_pde(struct proc_dir_entry * pde)144 static void unuse_pde(struct proc_dir_entry *pde)
145 {
146 if (unlikely(atomic_dec_return(&pde->in_use) == BIAS))
147 complete(pde->pde_unload_completion);
148 }
149
150 /* pde is locked on entry, unlocked on exit */
close_pdeo(struct proc_dir_entry * pde,struct pde_opener * pdeo)151 static void close_pdeo(struct proc_dir_entry *pde, struct pde_opener *pdeo)
152 {
153 /*
154 * close() (proc_reg_release()) can't delete an entry and proceed:
155 * ->release hook needs to be available at the right moment.
156 *
157 * rmmod (remove_proc_entry() et al) can't delete an entry and proceed:
158 * "struct file" needs to be available at the right moment.
159 *
160 * Therefore, first process to enter this function does ->release() and
161 * signals its completion to the other process which does nothing.
162 */
163 if (pdeo->closing) {
164 /* somebody else is doing that, just wait */
165 DECLARE_COMPLETION_ONSTACK(c);
166 pdeo->c = &c;
167 spin_unlock(&pde->pde_unload_lock);
168 wait_for_completion(&c);
169 } else {
170 struct file *file;
171 struct completion *c;
172
173 pdeo->closing = true;
174 spin_unlock(&pde->pde_unload_lock);
175 file = pdeo->file;
176 pde->proc_fops->release(file_inode(file), file);
177 spin_lock(&pde->pde_unload_lock);
178 /* After ->release. */
179 list_del(&pdeo->lh);
180 c = pdeo->c;
181 spin_unlock(&pde->pde_unload_lock);
182 if (unlikely(c))
183 complete(c);
184 kmem_cache_free(pde_opener_cache, pdeo);
185 }
186 }
187
proc_entry_rundown(struct proc_dir_entry * de)188 void proc_entry_rundown(struct proc_dir_entry *de)
189 {
190 DECLARE_COMPLETION_ONSTACK(c);
191 /* Wait until all existing callers into module are done. */
192 de->pde_unload_completion = &c;
193 if (atomic_add_return(BIAS, &de->in_use) != BIAS)
194 wait_for_completion(&c);
195
196 /* ->pde_openers list can't grow from now on. */
197
198 spin_lock(&de->pde_unload_lock);
199 while (!list_empty(&de->pde_openers)) {
200 struct pde_opener *pdeo;
201 pdeo = list_first_entry(&de->pde_openers, struct pde_opener, lh);
202 close_pdeo(de, pdeo);
203 spin_lock(&de->pde_unload_lock);
204 }
205 spin_unlock(&de->pde_unload_lock);
206 }
207
proc_reg_llseek(struct file * file,loff_t offset,int whence)208 static loff_t proc_reg_llseek(struct file *file, loff_t offset, int whence)
209 {
210 struct proc_dir_entry *pde = PDE(file_inode(file));
211 loff_t rv = -EINVAL;
212 if (use_pde(pde)) {
213 loff_t (*llseek)(struct file *, loff_t, int);
214 llseek = pde->proc_fops->llseek;
215 if (!llseek)
216 llseek = default_llseek;
217 rv = llseek(file, offset, whence);
218 unuse_pde(pde);
219 }
220 return rv;
221 }
222
proc_reg_read(struct file * file,char __user * buf,size_t count,loff_t * ppos)223 static ssize_t proc_reg_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
224 {
225 ssize_t (*read)(struct file *, char __user *, size_t, loff_t *);
226 struct proc_dir_entry *pde = PDE(file_inode(file));
227 ssize_t rv = -EIO;
228 if (use_pde(pde)) {
229 read = pde->proc_fops->read;
230 if (read)
231 rv = read(file, buf, count, ppos);
232 unuse_pde(pde);
233 }
234 return rv;
235 }
236
proc_reg_write(struct file * file,const char __user * buf,size_t count,loff_t * ppos)237 static ssize_t proc_reg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
238 {
239 ssize_t (*write)(struct file *, const char __user *, size_t, loff_t *);
240 struct proc_dir_entry *pde = PDE(file_inode(file));
241 ssize_t rv = -EIO;
242 if (use_pde(pde)) {
243 write = pde->proc_fops->write;
244 if (write)
245 rv = write(file, buf, count, ppos);
246 unuse_pde(pde);
247 }
248 return rv;
249 }
250
proc_reg_poll(struct file * file,struct poll_table_struct * pts)251 static __poll_t proc_reg_poll(struct file *file, struct poll_table_struct *pts)
252 {
253 struct proc_dir_entry *pde = PDE(file_inode(file));
254 __poll_t rv = DEFAULT_POLLMASK;
255 __poll_t (*poll)(struct file *, struct poll_table_struct *);
256 if (use_pde(pde)) {
257 poll = pde->proc_fops->poll;
258 if (poll)
259 rv = poll(file, pts);
260 unuse_pde(pde);
261 }
262 return rv;
263 }
264
proc_reg_unlocked_ioctl(struct file * file,unsigned int cmd,unsigned long arg)265 static long proc_reg_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
266 {
267 struct proc_dir_entry *pde = PDE(file_inode(file));
268 long rv = -ENOTTY;
269 long (*ioctl)(struct file *, unsigned int, unsigned long);
270 if (use_pde(pde)) {
271 ioctl = pde->proc_fops->unlocked_ioctl;
272 if (ioctl)
273 rv = ioctl(file, cmd, arg);
274 unuse_pde(pde);
275 }
276 return rv;
277 }
278
279 #ifdef CONFIG_COMPAT
proc_reg_compat_ioctl(struct file * file,unsigned int cmd,unsigned long arg)280 static long proc_reg_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
281 {
282 struct proc_dir_entry *pde = PDE(file_inode(file));
283 long rv = -ENOTTY;
284 long (*compat_ioctl)(struct file *, unsigned int, unsigned long);
285 if (use_pde(pde)) {
286 compat_ioctl = pde->proc_fops->compat_ioctl;
287 if (compat_ioctl)
288 rv = compat_ioctl(file, cmd, arg);
289 unuse_pde(pde);
290 }
291 return rv;
292 }
293 #endif
294
proc_reg_mmap(struct file * file,struct vm_area_struct * vma)295 static int proc_reg_mmap(struct file *file, struct vm_area_struct *vma)
296 {
297 struct proc_dir_entry *pde = PDE(file_inode(file));
298 int rv = -EIO;
299 int (*mmap)(struct file *, struct vm_area_struct *);
300 if (use_pde(pde)) {
301 mmap = pde->proc_fops->mmap;
302 if (mmap)
303 rv = mmap(file, vma);
304 unuse_pde(pde);
305 }
306 return rv;
307 }
308
309 static unsigned long
proc_reg_get_unmapped_area(struct file * file,unsigned long orig_addr,unsigned long len,unsigned long pgoff,unsigned long flags)310 proc_reg_get_unmapped_area(struct file *file, unsigned long orig_addr,
311 unsigned long len, unsigned long pgoff,
312 unsigned long flags)
313 {
314 struct proc_dir_entry *pde = PDE(file_inode(file));
315 unsigned long rv = -EIO;
316
317 if (use_pde(pde)) {
318 typeof(proc_reg_get_unmapped_area) *get_area;
319
320 get_area = pde->proc_fops->get_unmapped_area;
321 #ifdef CONFIG_MMU
322 if (!get_area)
323 get_area = current->mm->get_unmapped_area;
324 #endif
325
326 if (get_area)
327 rv = get_area(file, orig_addr, len, pgoff, flags);
328 else
329 rv = orig_addr;
330 unuse_pde(pde);
331 }
332 return rv;
333 }
334
proc_reg_open(struct inode * inode,struct file * file)335 static int proc_reg_open(struct inode *inode, struct file *file)
336 {
337 struct proc_dir_entry *pde = PDE(inode);
338 int rv = 0;
339 int (*open)(struct inode *, struct file *);
340 int (*release)(struct inode *, struct file *);
341 struct pde_opener *pdeo;
342
343 /*
344 * Ensure that
345 * 1) PDE's ->release hook will be called no matter what
346 * either normally by close()/->release, or forcefully by
347 * rmmod/remove_proc_entry.
348 *
349 * 2) rmmod isn't blocked by opening file in /proc and sitting on
350 * the descriptor (including "rmmod foo </proc/foo" scenario).
351 *
352 * Save every "struct file" with custom ->release hook.
353 */
354 if (!use_pde(pde))
355 return -ENOENT;
356
357 release = pde->proc_fops->release;
358 if (release) {
359 pdeo = kmem_cache_alloc(pde_opener_cache, GFP_KERNEL);
360 if (!pdeo) {
361 rv = -ENOMEM;
362 goto out_unuse;
363 }
364 }
365
366 open = pde->proc_fops->open;
367 if (open)
368 rv = open(inode, file);
369
370 if (release) {
371 if (rv == 0) {
372 /* To know what to release. */
373 pdeo->file = file;
374 pdeo->closing = false;
375 pdeo->c = NULL;
376 spin_lock(&pde->pde_unload_lock);
377 list_add(&pdeo->lh, &pde->pde_openers);
378 spin_unlock(&pde->pde_unload_lock);
379 } else
380 kmem_cache_free(pde_opener_cache, pdeo);
381 }
382
383 out_unuse:
384 unuse_pde(pde);
385 return rv;
386 }
387
proc_reg_release(struct inode * inode,struct file * file)388 static int proc_reg_release(struct inode *inode, struct file *file)
389 {
390 struct proc_dir_entry *pde = PDE(inode);
391 struct pde_opener *pdeo;
392 spin_lock(&pde->pde_unload_lock);
393 list_for_each_entry(pdeo, &pde->pde_openers, lh) {
394 if (pdeo->file == file) {
395 close_pdeo(pde, pdeo);
396 return 0;
397 }
398 }
399 spin_unlock(&pde->pde_unload_lock);
400 return 0;
401 }
402
403 static const struct file_operations proc_reg_file_ops = {
404 .llseek = proc_reg_llseek,
405 .read = proc_reg_read,
406 .write = proc_reg_write,
407 .poll = proc_reg_poll,
408 .unlocked_ioctl = proc_reg_unlocked_ioctl,
409 #ifdef CONFIG_COMPAT
410 .compat_ioctl = proc_reg_compat_ioctl,
411 #endif
412 .mmap = proc_reg_mmap,
413 .get_unmapped_area = proc_reg_get_unmapped_area,
414 .open = proc_reg_open,
415 .release = proc_reg_release,
416 };
417
418 #ifdef CONFIG_COMPAT
419 static const struct file_operations proc_reg_file_ops_no_compat = {
420 .llseek = proc_reg_llseek,
421 .read = proc_reg_read,
422 .write = proc_reg_write,
423 .poll = proc_reg_poll,
424 .unlocked_ioctl = proc_reg_unlocked_ioctl,
425 .mmap = proc_reg_mmap,
426 .get_unmapped_area = proc_reg_get_unmapped_area,
427 .open = proc_reg_open,
428 .release = proc_reg_release,
429 };
430 #endif
431
proc_put_link(void * p)432 static void proc_put_link(void *p)
433 {
434 unuse_pde(p);
435 }
436
proc_get_link(struct dentry * dentry,struct inode * inode,struct delayed_call * done)437 static const char *proc_get_link(struct dentry *dentry,
438 struct inode *inode,
439 struct delayed_call *done)
440 {
441 struct proc_dir_entry *pde = PDE(inode);
442 if (!use_pde(pde))
443 return ERR_PTR(-EINVAL);
444 set_delayed_call(done, proc_put_link, pde);
445 return pde->data;
446 }
447
448 const struct inode_operations proc_link_inode_operations = {
449 .get_link = proc_get_link,
450 };
451
proc_get_inode(struct super_block * sb,struct proc_dir_entry * de)452 struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
453 {
454 struct inode *inode = new_inode_pseudo(sb);
455
456 if (inode) {
457 inode->i_ino = de->low_ino;
458 inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
459 PROC_I(inode)->pde = de;
460
461 if (is_empty_pde(de)) {
462 make_empty_dir_inode(inode);
463 return inode;
464 }
465 if (de->mode) {
466 inode->i_mode = de->mode;
467 inode->i_uid = de->uid;
468 inode->i_gid = de->gid;
469 }
470 if (de->size)
471 inode->i_size = de->size;
472 if (de->nlink)
473 set_nlink(inode, de->nlink);
474 WARN_ON(!de->proc_iops);
475 inode->i_op = de->proc_iops;
476 if (de->proc_fops) {
477 if (S_ISREG(inode->i_mode)) {
478 #ifdef CONFIG_COMPAT
479 if (!de->proc_fops->compat_ioctl)
480 inode->i_fop =
481 &proc_reg_file_ops_no_compat;
482 else
483 #endif
484 inode->i_fop = &proc_reg_file_ops;
485 } else {
486 inode->i_fop = de->proc_fops;
487 }
488 }
489 } else
490 pde_put(de);
491 return inode;
492 }
493
proc_fill_super(struct super_block * s,void * data,int silent)494 int proc_fill_super(struct super_block *s, void *data, int silent)
495 {
496 struct pid_namespace *ns = get_pid_ns(s->s_fs_info);
497 struct inode *root_inode;
498 int ret;
499
500 if (!proc_parse_options(data, ns))
501 return -EINVAL;
502
503 /* User space would break if executables or devices appear on proc */
504 s->s_iflags |= SB_I_USERNS_VISIBLE | SB_I_NOEXEC | SB_I_NODEV;
505 s->s_flags |= SB_NODIRATIME | SB_NOSUID | SB_NOEXEC;
506 s->s_blocksize = 1024;
507 s->s_blocksize_bits = 10;
508 s->s_magic = PROC_SUPER_MAGIC;
509 s->s_op = &proc_sops;
510 s->s_time_gran = 1;
511
512 /*
513 * procfs isn't actually a stacking filesystem; however, there is
514 * too much magic going on inside it to permit stacking things on
515 * top of it
516 */
517 s->s_stack_depth = FILESYSTEM_MAX_STACK_DEPTH;
518
519 pde_get(&proc_root);
520 root_inode = proc_get_inode(s, &proc_root);
521 if (!root_inode) {
522 pr_err("proc_fill_super: get root inode failed\n");
523 return -ENOMEM;
524 }
525
526 s->s_root = d_make_root(root_inode);
527 if (!s->s_root) {
528 pr_err("proc_fill_super: allocate dentry failed\n");
529 return -ENOMEM;
530 }
531
532 ret = proc_setup_self(s);
533 if (ret) {
534 return ret;
535 }
536 return proc_setup_thread_self(s);
537 }
538