1// SPDX-License-Identifier: GPL-2.0
2/*
3 * devtmpfs - kernel-maintained tmpfs-based /dev
4 *
5 * Copyright (C) 2009, Kay Sievers <kay.sievers@vrfy.org>
6 *
7 * During bootup, before any driver core device is registered,
8 * devtmpfs, a tmpfs-based filesystem is created. Every driver-core
9 * device which requests a device node, will add a node in this
10 * filesystem.
11 * By default, all devices are named after the name of the device,
12 * owned by root and have a default mode of 0600. Subsystems can
13 * overwrite the default setting if needed.
14 */
15
16#include <linux/kernel.h>
17#include <linux/syscalls.h>
18#include <linux/mount.h>
19#include <linux/device.h>
20#include <linux/genhd.h>
21#include <linux/namei.h>
22#include <linux/fs.h>
23#include <linux/shmem_fs.h>
24#include <linux/ramfs.h>
25#include <linux/sched.h>
26#include <linux/slab.h>
27#include <linux/kthread.h>
28#include <linux/init_syscalls.h>
29#include <uapi/linux/mount.h>
30#include "base.h"
31
32static struct task_struct *thread;
33
34static int __initdata mount_dev = IS_ENABLED(CONFIG_DEVTMPFS_MOUNT);
35
36static DEFINE_SPINLOCK(req_lock);
37
38static struct req {
39	struct req *next;
40	struct completion done;
41	int err;
42	const char *name;
43	umode_t mode;	/* 0 => delete */
44	kuid_t uid;
45	kgid_t gid;
46	struct device *dev;
47} *requests;
48
49static int __init mount_param(char *str)
50{
51	mount_dev = simple_strtoul(str, NULL, 0);
52	return 1;
53}
54__setup("devtmpfs.mount=", mount_param);
55
56static struct vfsmount *mnt;
57
58static struct dentry *public_dev_mount(struct file_system_type *fs_type, int flags,
59		      const char *dev_name, void *data)
60{
61	struct super_block *s = mnt->mnt_sb;
62	int err;
63
64	atomic_inc(&s->s_active);
65	down_write(&s->s_umount);
66	err = reconfigure_single(s, flags, data);
67	if (err < 0) {
68		deactivate_locked_super(s);
69		return ERR_PTR(err);
70	}
71	return dget(s->s_root);
72}
73
74static struct file_system_type internal_fs_type = {
75	.name = "devtmpfs",
76#ifdef CONFIG_TMPFS
77	.init_fs_context = shmem_init_fs_context,
78	.parameters	= shmem_fs_parameters,
79#else
80	.init_fs_context = ramfs_init_fs_context,
81	.parameters	= ramfs_fs_parameters,
82#endif
83	.kill_sb = kill_litter_super,
84};
85
86static struct file_system_type dev_fs_type = {
87	.name = "devtmpfs",
88	.mount = public_dev_mount,
89};
90
91#ifdef CONFIG_BLOCK
92static inline int is_blockdev(struct device *dev)
93{
94	return dev->class == &block_class;
95}
96#else
97static inline int is_blockdev(struct device *dev) { return 0; }
98#endif
99
100static int devtmpfs_submit_req(struct req *req, const char *tmp)
101{
102	init_completion(&req->done);
103
104	spin_lock(&req_lock);
105	req->next = requests;
106	requests = req;
107	spin_unlock(&req_lock);
108
109	wake_up_process(thread);
110	wait_for_completion(&req->done);
111
112	kfree(tmp);
113
114	return req->err;
115}
116
117int devtmpfs_create_node(struct device *dev)
118{
119	const char *tmp = NULL;
120	struct req req;
121
122	if (!thread)
123		return 0;
124
125	req.mode = 0;
126	req.uid = GLOBAL_ROOT_UID;
127	req.gid = GLOBAL_ROOT_GID;
128	req.name = device_get_devnode(dev, &req.mode, &req.uid, &req.gid, &tmp);
129	if (!req.name)
130		return -ENOMEM;
131
132	if (req.mode == 0)
133		req.mode = 0600;
134	if (is_blockdev(dev))
135		req.mode |= S_IFBLK;
136	else
137		req.mode |= S_IFCHR;
138
139	req.dev = dev;
140
141	return devtmpfs_submit_req(&req, tmp);
142}
143
144int devtmpfs_delete_node(struct device *dev)
145{
146	const char *tmp = NULL;
147	struct req req;
148
149	if (!thread)
150		return 0;
151
152	req.name = device_get_devnode(dev, NULL, NULL, NULL, &tmp);
153	if (!req.name)
154		return -ENOMEM;
155
156	req.mode = 0;
157	req.dev = dev;
158
159	return devtmpfs_submit_req(&req, tmp);
160}
161
162static int dev_mkdir(const char *name, umode_t mode)
163{
164	struct dentry *dentry;
165	struct path path;
166	int err;
167
168	dentry = kern_path_create(AT_FDCWD, name, &path, LOOKUP_DIRECTORY);
169	if (IS_ERR(dentry))
170		return PTR_ERR(dentry);
171
172	err = vfs_mkdir(d_inode(path.dentry), dentry, mode);
173	if (!err)
174		/* mark as kernel-created inode */
175		d_inode(dentry)->i_private = &thread;
176	done_path_create(&path, dentry);
177	return err;
178}
179
180static int create_path(const char *nodepath)
181{
182	char *path;
183	char *s;
184	int err = 0;
185
186	/* parent directories do not exist, create them */
187	path = kstrdup(nodepath, GFP_KERNEL);
188	if (!path)
189		return -ENOMEM;
190
191	s = path;
192	for (;;) {
193		s = strchr(s, '/');
194		if (!s)
195			break;
196		s[0] = '\0';
197		err = dev_mkdir(path, 0755);
198		if (err && err != -EEXIST)
199			break;
200		s[0] = '/';
201		s++;
202	}
203	kfree(path);
204	return err;
205}
206
207static int handle_create(const char *nodename, umode_t mode, kuid_t uid,
208			 kgid_t gid, struct device *dev)
209{
210	struct dentry *dentry;
211	struct path path;
212	int err;
213
214	dentry = kern_path_create(AT_FDCWD, nodename, &path, 0);
215	if (dentry == ERR_PTR(-ENOENT)) {
216		create_path(nodename);
217		dentry = kern_path_create(AT_FDCWD, nodename, &path, 0);
218	}
219	if (IS_ERR(dentry))
220		return PTR_ERR(dentry);
221
222	err = vfs_mknod(d_inode(path.dentry), dentry, mode, dev->devt);
223	if (!err) {
224		struct iattr newattrs;
225
226		newattrs.ia_mode = mode;
227		newattrs.ia_uid = uid;
228		newattrs.ia_gid = gid;
229		newattrs.ia_valid = ATTR_MODE|ATTR_UID|ATTR_GID;
230		inode_lock(d_inode(dentry));
231		notify_change(dentry, &newattrs, NULL);
232		inode_unlock(d_inode(dentry));
233
234		/* mark as kernel-created inode */
235		d_inode(dentry)->i_private = &thread;
236	}
237	done_path_create(&path, dentry);
238	return err;
239}
240
241static int dev_rmdir(const char *name)
242{
243	struct path parent;
244	struct dentry *dentry;
245	int err;
246
247	dentry = kern_path_locked(name, &parent);
248	if (IS_ERR(dentry))
249		return PTR_ERR(dentry);
250	if (d_really_is_positive(dentry)) {
251		if (d_inode(dentry)->i_private == &thread)
252			err = vfs_rmdir(d_inode(parent.dentry), dentry);
253		else
254			err = -EPERM;
255	} else {
256		err = -ENOENT;
257	}
258	dput(dentry);
259	inode_unlock(d_inode(parent.dentry));
260	path_put(&parent);
261	return err;
262}
263
264static int delete_path(const char *nodepath)
265{
266	char *path;
267	int err = 0;
268
269	path = kstrdup(nodepath, GFP_KERNEL);
270	if (!path)
271		return -ENOMEM;
272
273	for (;;) {
274		char *base;
275
276		base = strrchr(path, '/');
277		if (!base)
278			break;
279		base[0] = '\0';
280		err = dev_rmdir(path);
281		if (err)
282			break;
283	}
284
285	kfree(path);
286	return err;
287}
288
289static int dev_mynode(struct device *dev, struct inode *inode, struct kstat *stat)
290{
291	/* did we create it */
292	if (inode->i_private != &thread)
293		return 0;
294
295	/* does the dev_t match */
296	if (is_blockdev(dev)) {
297		if (!S_ISBLK(stat->mode))
298			return 0;
299	} else {
300		if (!S_ISCHR(stat->mode))
301			return 0;
302	}
303	if (stat->rdev != dev->devt)
304		return 0;
305
306	/* ours */
307	return 1;
308}
309
310static int handle_remove(const char *nodename, struct device *dev)
311{
312	struct path parent;
313	struct dentry *dentry;
314	int deleted = 0;
315	int err;
316
317	dentry = kern_path_locked(nodename, &parent);
318	if (IS_ERR(dentry))
319		return PTR_ERR(dentry);
320
321	if (d_really_is_positive(dentry)) {
322		struct kstat stat;
323		struct path p = {.mnt = parent.mnt, .dentry = dentry};
324		err = vfs_getattr(&p, &stat, STATX_TYPE | STATX_MODE,
325				  AT_STATX_SYNC_AS_STAT);
326		if (!err && dev_mynode(dev, d_inode(dentry), &stat)) {
327			struct iattr newattrs;
328			/*
329			 * before unlinking this node, reset permissions
330			 * of possible references like hardlinks
331			 */
332			newattrs.ia_uid = GLOBAL_ROOT_UID;
333			newattrs.ia_gid = GLOBAL_ROOT_GID;
334			newattrs.ia_mode = stat.mode & ~0777;
335			newattrs.ia_valid =
336				ATTR_UID|ATTR_GID|ATTR_MODE;
337			inode_lock(d_inode(dentry));
338			notify_change(dentry, &newattrs, NULL);
339			inode_unlock(d_inode(dentry));
340			err = vfs_unlink(d_inode(parent.dentry), dentry, NULL);
341			if (!err || err == -ENOENT)
342				deleted = 1;
343		}
344	} else {
345		err = -ENOENT;
346	}
347	dput(dentry);
348	inode_unlock(d_inode(parent.dentry));
349
350	path_put(&parent);
351	if (deleted && strchr(nodename, '/'))
352		delete_path(nodename);
353	return err;
354}
355
356/*
357 * If configured, or requested by the commandline, devtmpfs will be
358 * auto-mounted after the kernel mounted the root filesystem.
359 */
360int __init devtmpfs_mount(void)
361{
362	int err;
363
364	if (!mount_dev)
365		return 0;
366
367	if (!thread)
368		return 0;
369
370	err = init_mount("devtmpfs", "dev", "devtmpfs", MS_SILENT, NULL);
371	if (err)
372		printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
373	else
374		printk(KERN_INFO "devtmpfs: mounted\n");
375	return err;
376}
377
378static DECLARE_COMPLETION(setup_done);
379
380static int handle(const char *name, umode_t mode, kuid_t uid, kgid_t gid,
381		  struct device *dev)
382{
383	if (mode)
384		return handle_create(name, mode, uid, gid, dev);
385	else
386		return handle_remove(name, dev);
387}
388
389static void __noreturn devtmpfs_work_loop(void)
390{
391	while (1) {
392		spin_lock(&req_lock);
393		while (requests) {
394			struct req *req = requests;
395			requests = NULL;
396			spin_unlock(&req_lock);
397			while (req) {
398				struct req *next = req->next;
399				req->err = handle(req->name, req->mode,
400						  req->uid, req->gid, req->dev);
401				complete(&req->done);
402				req = next;
403			}
404			spin_lock(&req_lock);
405		}
406		__set_current_state(TASK_INTERRUPTIBLE);
407		spin_unlock(&req_lock);
408		schedule();
409	}
410}
411
412static int __init devtmpfs_setup(void *p)
413{
414	int err;
415
416	err = ksys_unshare(CLONE_NEWNS);
417	if (err)
418		goto out;
419	err = init_mount("devtmpfs", "/", "devtmpfs", MS_SILENT, NULL);
420	if (err)
421		goto out;
422	init_chdir("/.."); /* will traverse into overmounted root */
423	init_chroot(".");
424out:
425	*(int *)p = err;
426	return err;
427}
428
429/*
430 * The __ref is because devtmpfs_setup needs to be __init for the routines it
431 * calls.  That call is done while devtmpfs_init, which is marked __init,
432 * synchronously waits for it to complete.
433 */
434static int __ref devtmpfsd(void *p)
435{
436	int err = devtmpfs_setup(p);
437
438	complete(&setup_done);
439	if (err)
440		return err;
441	devtmpfs_work_loop();
442	return 0;
443}
444
445/*
446 * Create devtmpfs instance, driver-core devices will add their device
447 * nodes here.
448 */
449int __init devtmpfs_init(void)
450{
451	char opts[] = "mode=0755";
452	int err;
453
454	mnt = vfs_kern_mount(&internal_fs_type, 0, "devtmpfs", opts);
455	if (IS_ERR(mnt)) {
456		printk(KERN_ERR "devtmpfs: unable to create devtmpfs %ld\n",
457				PTR_ERR(mnt));
458		return PTR_ERR(mnt);
459	}
460	err = register_filesystem(&dev_fs_type);
461	if (err) {
462		printk(KERN_ERR "devtmpfs: unable to register devtmpfs "
463		       "type %i\n", err);
464		return err;
465	}
466
467	thread = kthread_run(devtmpfsd, &err, "kdevtmpfs");
468	if (!IS_ERR(thread)) {
469		wait_for_completion(&setup_done);
470	} else {
471		err = PTR_ERR(thread);
472		thread = NULL;
473	}
474
475	if (err) {
476		printk(KERN_ERR "devtmpfs: unable to create devtmpfs %i\n", err);
477		unregister_filesystem(&dev_fs_type);
478		return err;
479	}
480
481	printk(KERN_INFO "devtmpfs: initialized\n");
482	return 0;
483}
484