Line data Source code
1 : // SPDX-License-Identifier: GPL-2.0-or-later
2 : /* -*- linux-c -*- --------------------------------------------------------- *
3 : *
4 : * linux/fs/devpts/inode.c
5 : *
6 : * Copyright 1998-2004 H. Peter Anvin -- All Rights Reserved
7 : *
8 : * ------------------------------------------------------------------------- */
9 :
10 : #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11 :
12 : #include <linux/module.h>
13 : #include <linux/init.h>
14 : #include <linux/fs.h>
15 : #include <linux/sched.h>
16 : #include <linux/namei.h>
17 : #include <linux/slab.h>
18 : #include <linux/mount.h>
19 : #include <linux/tty.h>
20 : #include <linux/mutex.h>
21 : #include <linux/magic.h>
22 : #include <linux/idr.h>
23 : #include <linux/devpts_fs.h>
24 : #include <linux/parser.h>
25 : #include <linux/fsnotify.h>
26 : #include <linux/seq_file.h>
27 :
28 : #define DEVPTS_DEFAULT_MODE 0600
29 : /*
30 : * ptmx is a new node in /dev/pts and will be unused in legacy (single-
31 : * instance) mode. To prevent surprises in user space, set permissions of
32 : * ptmx to 0. Use 'chmod' or remount with '-o ptmxmode' to set meaningful
33 : * permissions.
34 : */
35 : #define DEVPTS_DEFAULT_PTMX_MODE 0000
36 : #define PTMX_MINOR 2
37 :
38 : /*
39 : * sysctl support for setting limits on the number of Unix98 ptys allocated.
40 : * Otherwise one can eat up all kernel memory by opening /dev/ptmx repeatedly.
41 : */
42 : static int pty_limit = NR_UNIX98_PTY_DEFAULT;
43 : static int pty_reserve = NR_UNIX98_PTY_RESERVE;
44 : static int pty_limit_min;
45 : static int pty_limit_max = INT_MAX;
46 : static atomic_t pty_count = ATOMIC_INIT(0);
47 :
48 : static struct ctl_table pty_table[] = {
49 : {
50 : .procname = "max",
51 : .maxlen = sizeof(int),
52 : .mode = 0644,
53 : .data = &pty_limit,
54 : .proc_handler = proc_dointvec_minmax,
55 : .extra1 = &pty_limit_min,
56 : .extra2 = &pty_limit_max,
57 : }, {
58 : .procname = "reserve",
59 : .maxlen = sizeof(int),
60 : .mode = 0644,
61 : .data = &pty_reserve,
62 : .proc_handler = proc_dointvec_minmax,
63 : .extra1 = &pty_limit_min,
64 : .extra2 = &pty_limit_max,
65 : }, {
66 : .procname = "nr",
67 : .maxlen = sizeof(int),
68 : .mode = 0444,
69 : .data = &pty_count,
70 : .proc_handler = proc_dointvec,
71 : },
72 : {}
73 : };
74 :
75 : static struct ctl_table pty_kern_table[] = {
76 : {
77 : .procname = "pty",
78 : .mode = 0555,
79 : .child = pty_table,
80 : },
81 : {}
82 : };
83 :
84 : static struct ctl_table pty_root_table[] = {
85 : {
86 : .procname = "kernel",
87 : .mode = 0555,
88 : .child = pty_kern_table,
89 : },
90 : {}
91 : };
92 :
93 : struct pts_mount_opts {
94 : int setuid;
95 : int setgid;
96 : kuid_t uid;
97 : kgid_t gid;
98 : umode_t mode;
99 : umode_t ptmxmode;
100 : int reserve;
101 : int max;
102 : };
103 :
104 : enum {
105 : Opt_uid, Opt_gid, Opt_mode, Opt_ptmxmode, Opt_newinstance, Opt_max,
106 : Opt_err
107 : };
108 :
109 : static const match_table_t tokens = {
110 : {Opt_uid, "uid=%u"},
111 : {Opt_gid, "gid=%u"},
112 : {Opt_mode, "mode=%o"},
113 : {Opt_ptmxmode, "ptmxmode=%o"},
114 : {Opt_newinstance, "newinstance"},
115 : {Opt_max, "max=%d"},
116 : {Opt_err, NULL}
117 : };
118 :
119 : struct pts_fs_info {
120 : struct ida allocated_ptys;
121 : struct pts_mount_opts mount_opts;
122 : struct super_block *sb;
123 : struct dentry *ptmx_dentry;
124 : };
125 :
126 287 : static inline struct pts_fs_info *DEVPTS_SB(struct super_block *sb)
127 : {
128 287 : return sb->s_fs_info;
129 : }
130 :
131 0 : static int devpts_ptmx_path(struct path *path)
132 : {
133 0 : struct super_block *sb;
134 0 : int err;
135 :
136 : /* Is a devpts filesystem at "pts" in the same directory? */
137 0 : err = path_pts(path);
138 0 : if (err)
139 : return err;
140 :
141 : /* Is the path the root of a devpts filesystem? */
142 0 : sb = path->mnt->mnt_sb;
143 0 : if ((sb->s_magic != DEVPTS_SUPER_MAGIC) ||
144 0 : (path->mnt->mnt_root != sb->s_root))
145 0 : return -ENODEV;
146 :
147 : return 0;
148 : }
149 :
150 : /*
151 : * Try to find a suitable devpts filesystem. We support the following
152 : * scenarios:
153 : * - The ptmx device node is located in the same directory as the devpts
154 : * mount where the pts device nodes are located.
155 : * This is e.g. the case when calling open on the /dev/pts/ptmx device
156 : * node when the devpts filesystem is mounted at /dev/pts.
157 : * - The ptmx device node is located outside the devpts filesystem mount
158 : * where the pts device nodes are located. For example, the ptmx device
159 : * is a symlink, separate device node, or bind-mount.
160 : * A supported scenario is bind-mounting /dev/pts/ptmx to /dev/ptmx and
161 : * then calling open on /dev/ptmx. In this case a suitable pts
162 : * subdirectory can be found in the common parent directory /dev of the
163 : * devpts mount and the ptmx bind-mount, after resolving the /dev/ptmx
164 : * bind-mount.
165 : * If no suitable pts subdirectory can be found this function will fail.
166 : * This is e.g. the case when bind-mounting /dev/pts/ptmx to /ptmx.
167 : */
168 0 : struct vfsmount *devpts_mntget(struct file *filp, struct pts_fs_info *fsi)
169 : {
170 0 : struct path path;
171 0 : int err = 0;
172 :
173 0 : path = filp->f_path;
174 0 : path_get(&path);
175 :
176 : /* Walk upward while the start point is a bind mount of
177 : * a single file.
178 : */
179 0 : while (path.mnt->mnt_root == path.dentry)
180 0 : if (follow_up(&path) == 0)
181 : break;
182 :
183 : /* devpts_ptmx_path() finds a devpts fs or returns an error. */
184 0 : if ((path.mnt->mnt_sb->s_magic != DEVPTS_SUPER_MAGIC) ||
185 0 : (DEVPTS_SB(path.mnt->mnt_sb) != fsi))
186 0 : err = devpts_ptmx_path(&path);
187 0 : dput(path.dentry);
188 0 : if (!err) {
189 0 : if (DEVPTS_SB(path.mnt->mnt_sb) == fsi)
190 : return path.mnt;
191 :
192 : err = -ENODEV;
193 : }
194 :
195 0 : mntput(path.mnt);
196 0 : return ERR_PTR(err);
197 : }
198 :
199 0 : struct pts_fs_info *devpts_acquire(struct file *filp)
200 : {
201 0 : struct pts_fs_info *result;
202 0 : struct path path;
203 0 : struct super_block *sb;
204 :
205 0 : path = filp->f_path;
206 0 : path_get(&path);
207 :
208 : /* Has the devpts filesystem already been found? */
209 0 : if (path.mnt->mnt_sb->s_magic != DEVPTS_SUPER_MAGIC) {
210 0 : int err;
211 :
212 0 : err = devpts_ptmx_path(&path);
213 0 : if (err) {
214 0 : result = ERR_PTR(err);
215 0 : goto out;
216 : }
217 : }
218 :
219 : /*
220 : * pty code needs to hold extra references in case of last /dev/tty close
221 : */
222 0 : sb = path.mnt->mnt_sb;
223 0 : atomic_inc(&sb->s_active);
224 0 : result = DEVPTS_SB(sb);
225 :
226 0 : out:
227 0 : path_put(&path);
228 0 : return result;
229 : }
230 :
231 0 : void devpts_release(struct pts_fs_info *fsi)
232 : {
233 0 : deactivate_super(fsi->sb);
234 0 : }
235 :
236 : #define PARSE_MOUNT 0
237 : #define PARSE_REMOUNT 1
238 :
239 : /*
240 : * parse_mount_options():
241 : * Set @opts to mount options specified in @data. If an option is not
242 : * specified in @data, set it to its default value.
243 : *
244 : * Note: @data may be NULL (in which case all options are set to default).
245 : */
246 1 : static int parse_mount_options(char *data, int op, struct pts_mount_opts *opts)
247 : {
248 1 : char *p;
249 1 : kuid_t uid;
250 1 : kgid_t gid;
251 :
252 1 : opts->setuid = 0;
253 1 : opts->setgid = 0;
254 1 : opts->uid = GLOBAL_ROOT_UID;
255 1 : opts->gid = GLOBAL_ROOT_GID;
256 1 : opts->mode = DEVPTS_DEFAULT_MODE;
257 1 : opts->ptmxmode = DEVPTS_DEFAULT_PTMX_MODE;
258 1 : opts->max = NR_UNIX98_PTY_MAX;
259 :
260 : /* Only allow instances mounted from the initial mount
261 : * namespace to tap the reserve pool of ptys.
262 : */
263 1 : if (op == PARSE_MOUNT)
264 1 : opts->reserve =
265 1 : (current->nsproxy->mnt_ns == init_task.nsproxy->mnt_ns);
266 :
267 3 : while ((p = strsep(&data, ",")) != NULL) {
268 2 : substring_t args[MAX_OPT_ARGS];
269 2 : int token;
270 2 : int option;
271 :
272 2 : if (!*p)
273 0 : continue;
274 :
275 2 : token = match_token(p, tokens, args);
276 2 : switch (token) {
277 0 : case Opt_uid:
278 0 : if (match_int(&args[0], &option))
279 0 : return -EINVAL;
280 0 : uid = make_kuid(current_user_ns(), option);
281 0 : if (!uid_valid(uid))
282 : return -EINVAL;
283 0 : opts->uid = uid;
284 0 : opts->setuid = 1;
285 0 : break;
286 1 : case Opt_gid:
287 1 : if (match_int(&args[0], &option))
288 : return -EINVAL;
289 1 : gid = make_kgid(current_user_ns(), option);
290 1 : if (!gid_valid(gid))
291 : return -EINVAL;
292 1 : opts->gid = gid;
293 1 : opts->setgid = 1;
294 1 : break;
295 1 : case Opt_mode:
296 1 : if (match_octal(&args[0], &option))
297 : return -EINVAL;
298 1 : opts->mode = option & S_IALLUGO;
299 1 : break;
300 0 : case Opt_ptmxmode:
301 0 : if (match_octal(&args[0], &option))
302 : return -EINVAL;
303 0 : opts->ptmxmode = option & S_IALLUGO;
304 0 : break;
305 : case Opt_newinstance:
306 : break;
307 0 : case Opt_max:
308 0 : if (match_int(&args[0], &option) ||
309 0 : option < 0 || option > NR_UNIX98_PTY_MAX)
310 : return -EINVAL;
311 0 : opts->max = option;
312 0 : break;
313 0 : default:
314 0 : pr_err("called with bogus options\n");
315 0 : return -EINVAL;
316 : }
317 : }
318 :
319 : return 0;
320 : }
321 :
322 1 : static int mknod_ptmx(struct super_block *sb)
323 : {
324 1 : int mode;
325 1 : int rc = -ENOMEM;
326 1 : struct dentry *dentry;
327 1 : struct inode *inode;
328 1 : struct dentry *root = sb->s_root;
329 1 : struct pts_fs_info *fsi = DEVPTS_SB(sb);
330 1 : struct pts_mount_opts *opts = &fsi->mount_opts;
331 1 : kuid_t ptmx_uid = current_fsuid();
332 1 : kgid_t ptmx_gid = current_fsgid();
333 :
334 1 : inode_lock(d_inode(root));
335 :
336 : /* If we have already created ptmx node, return */
337 1 : if (fsi->ptmx_dentry) {
338 0 : rc = 0;
339 0 : goto out;
340 : }
341 :
342 1 : dentry = d_alloc_name(root, "ptmx");
343 1 : if (!dentry) {
344 0 : pr_err("Unable to alloc dentry for ptmx node\n");
345 0 : goto out;
346 : }
347 :
348 : /*
349 : * Create a new 'ptmx' node in this mount of devpts.
350 : */
351 1 : inode = new_inode(sb);
352 1 : if (!inode) {
353 0 : pr_err("Unable to alloc inode for ptmx node\n");
354 0 : dput(dentry);
355 0 : goto out;
356 : }
357 :
358 1 : inode->i_ino = 2;
359 1 : inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
360 :
361 1 : mode = S_IFCHR|opts->ptmxmode;
362 1 : init_special_inode(inode, mode, MKDEV(TTYAUX_MAJOR, 2));
363 1 : inode->i_uid = ptmx_uid;
364 1 : inode->i_gid = ptmx_gid;
365 :
366 1 : d_add(dentry, inode);
367 :
368 1 : fsi->ptmx_dentry = dentry;
369 1 : rc = 0;
370 1 : out:
371 1 : inode_unlock(d_inode(root));
372 1 : return rc;
373 : }
374 :
375 0 : static void update_ptmx_mode(struct pts_fs_info *fsi)
376 : {
377 0 : struct inode *inode;
378 0 : if (fsi->ptmx_dentry) {
379 0 : inode = d_inode(fsi->ptmx_dentry);
380 0 : inode->i_mode = S_IFCHR|fsi->mount_opts.ptmxmode;
381 : }
382 : }
383 :
384 0 : static int devpts_remount(struct super_block *sb, int *flags, char *data)
385 : {
386 0 : int err;
387 0 : struct pts_fs_info *fsi = DEVPTS_SB(sb);
388 0 : struct pts_mount_opts *opts = &fsi->mount_opts;
389 :
390 0 : err = parse_mount_options(data, PARSE_REMOUNT, opts);
391 :
392 : /*
393 : * parse_mount_options() restores options to default values
394 : * before parsing and may have changed ptmxmode. So, update the
395 : * mode in the inode too. Bogus options don't fail the remount,
396 : * so do this even on error return.
397 : */
398 0 : update_ptmx_mode(fsi);
399 :
400 0 : return err;
401 : }
402 :
403 285 : static int devpts_show_options(struct seq_file *seq, struct dentry *root)
404 : {
405 285 : struct pts_fs_info *fsi = DEVPTS_SB(root->d_sb);
406 285 : struct pts_mount_opts *opts = &fsi->mount_opts;
407 :
408 285 : if (opts->setuid)
409 0 : seq_printf(seq, ",uid=%u",
410 : from_kuid_munged(&init_user_ns, opts->uid));
411 285 : if (opts->setgid)
412 285 : seq_printf(seq, ",gid=%u",
413 : from_kgid_munged(&init_user_ns, opts->gid));
414 285 : seq_printf(seq, ",mode=%03o", opts->mode);
415 285 : seq_printf(seq, ",ptmxmode=%03o", opts->ptmxmode);
416 285 : if (opts->max < NR_UNIX98_PTY_MAX)
417 0 : seq_printf(seq, ",max=%d", opts->max);
418 :
419 285 : return 0;
420 : }
421 :
422 : static const struct super_operations devpts_sops = {
423 : .statfs = simple_statfs,
424 : .remount_fs = devpts_remount,
425 : .show_options = devpts_show_options,
426 : };
427 :
428 1 : static void *new_pts_fs_info(struct super_block *sb)
429 : {
430 1 : struct pts_fs_info *fsi;
431 :
432 1 : fsi = kzalloc(sizeof(struct pts_fs_info), GFP_KERNEL);
433 1 : if (!fsi)
434 : return NULL;
435 :
436 1 : ida_init(&fsi->allocated_ptys);
437 1 : fsi->mount_opts.mode = DEVPTS_DEFAULT_MODE;
438 1 : fsi->mount_opts.ptmxmode = DEVPTS_DEFAULT_PTMX_MODE;
439 1 : fsi->sb = sb;
440 :
441 1 : return fsi;
442 : }
443 :
444 : static int
445 1 : devpts_fill_super(struct super_block *s, void *data, int silent)
446 : {
447 1 : struct inode *inode;
448 1 : int error;
449 :
450 1 : s->s_iflags &= ~SB_I_NODEV;
451 1 : s->s_blocksize = 1024;
452 1 : s->s_blocksize_bits = 10;
453 1 : s->s_magic = DEVPTS_SUPER_MAGIC;
454 1 : s->s_op = &devpts_sops;
455 1 : s->s_d_op = &simple_dentry_operations;
456 1 : s->s_time_gran = 1;
457 :
458 1 : error = -ENOMEM;
459 1 : s->s_fs_info = new_pts_fs_info(s);
460 1 : if (!s->s_fs_info)
461 0 : goto fail;
462 :
463 1 : error = parse_mount_options(data, PARSE_MOUNT, &DEVPTS_SB(s)->mount_opts);
464 1 : if (error)
465 0 : goto fail;
466 :
467 1 : error = -ENOMEM;
468 1 : inode = new_inode(s);
469 1 : if (!inode)
470 0 : goto fail;
471 1 : inode->i_ino = 1;
472 1 : inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
473 1 : inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR;
474 1 : inode->i_op = &simple_dir_inode_operations;
475 1 : inode->i_fop = &simple_dir_operations;
476 1 : set_nlink(inode, 2);
477 :
478 1 : s->s_root = d_make_root(inode);
479 1 : if (!s->s_root) {
480 0 : pr_err("get root dentry failed\n");
481 0 : goto fail;
482 : }
483 :
484 1 : error = mknod_ptmx(s);
485 1 : if (error)
486 0 : goto fail_dput;
487 :
488 : return 0;
489 0 : fail_dput:
490 0 : dput(s->s_root);
491 0 : s->s_root = NULL;
492 : fail:
493 : return error;
494 : }
495 :
496 : /*
497 : * devpts_mount()
498 : *
499 : * Mount a new (private) instance of devpts. PTYs created in this
500 : * instance are independent of the PTYs in other devpts instances.
501 : */
502 1 : static struct dentry *devpts_mount(struct file_system_type *fs_type,
503 : int flags, const char *dev_name, void *data)
504 : {
505 1 : return mount_nodev(fs_type, flags, data, devpts_fill_super);
506 : }
507 :
508 0 : static void devpts_kill_sb(struct super_block *sb)
509 : {
510 0 : struct pts_fs_info *fsi = DEVPTS_SB(sb);
511 :
512 0 : if (fsi)
513 0 : ida_destroy(&fsi->allocated_ptys);
514 0 : kfree(fsi);
515 0 : kill_litter_super(sb);
516 0 : }
517 :
518 : static struct file_system_type devpts_fs_type = {
519 : .name = "devpts",
520 : .mount = devpts_mount,
521 : .kill_sb = devpts_kill_sb,
522 : .fs_flags = FS_USERNS_MOUNT,
523 : };
524 :
525 : /*
526 : * The normal naming convention is simply /dev/pts/<number>; this conforms
527 : * to the System V naming convention
528 : */
529 :
530 0 : int devpts_new_index(struct pts_fs_info *fsi)
531 : {
532 0 : int index = -ENOSPC;
533 :
534 0 : if (atomic_inc_return(&pty_count) >= (pty_limit -
535 0 : (fsi->mount_opts.reserve ? 0 : pty_reserve)))
536 0 : goto out;
537 :
538 0 : index = ida_alloc_max(&fsi->allocated_ptys, fsi->mount_opts.max - 1,
539 : GFP_KERNEL);
540 :
541 0 : out:
542 0 : if (index < 0)
543 0 : atomic_dec(&pty_count);
544 0 : return index;
545 : }
546 :
547 0 : void devpts_kill_index(struct pts_fs_info *fsi, int idx)
548 : {
549 0 : ida_free(&fsi->allocated_ptys, idx);
550 0 : atomic_dec(&pty_count);
551 0 : }
552 :
553 : /**
554 : * devpts_pty_new -- create a new inode in /dev/pts/
555 : * @ptmx_inode: inode of the master
556 : * @device: major+minor of the node to be created
557 : * @index: used as a name of the node
558 : * @priv: what's given back by devpts_get_priv
559 : *
560 : * The created inode is returned. Remove it from /dev/pts/ by devpts_pty_kill.
561 : */
562 0 : struct dentry *devpts_pty_new(struct pts_fs_info *fsi, int index, void *priv)
563 : {
564 0 : struct dentry *dentry;
565 0 : struct super_block *sb = fsi->sb;
566 0 : struct inode *inode;
567 0 : struct dentry *root;
568 0 : struct pts_mount_opts *opts;
569 0 : char s[12];
570 :
571 0 : root = sb->s_root;
572 0 : opts = &fsi->mount_opts;
573 :
574 0 : inode = new_inode(sb);
575 0 : if (!inode)
576 0 : return ERR_PTR(-ENOMEM);
577 :
578 0 : inode->i_ino = index + 3;
579 0 : inode->i_uid = opts->setuid ? opts->uid : current_fsuid();
580 0 : inode->i_gid = opts->setgid ? opts->gid : current_fsgid();
581 0 : inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
582 0 : init_special_inode(inode, S_IFCHR|opts->mode, MKDEV(UNIX98_PTY_SLAVE_MAJOR, index));
583 :
584 0 : sprintf(s, "%d", index);
585 :
586 0 : dentry = d_alloc_name(root, s);
587 0 : if (dentry) {
588 0 : dentry->d_fsdata = priv;
589 0 : d_add(dentry, inode);
590 0 : fsnotify_create(d_inode(root), dentry);
591 : } else {
592 0 : iput(inode);
593 0 : dentry = ERR_PTR(-ENOMEM);
594 : }
595 :
596 : return dentry;
597 : }
598 :
599 : /**
600 : * devpts_get_priv -- get private data for a slave
601 : * @pts_inode: inode of the slave
602 : *
603 : * Returns whatever was passed as priv in devpts_pty_new for a given inode.
604 : */
605 0 : void *devpts_get_priv(struct dentry *dentry)
606 : {
607 0 : if (dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC)
608 : return NULL;
609 0 : return dentry->d_fsdata;
610 : }
611 :
612 : /**
613 : * devpts_pty_kill -- remove inode form /dev/pts/
614 : * @inode: inode of the slave to be removed
615 : *
616 : * This is an inverse operation of devpts_pty_new.
617 : */
618 0 : void devpts_pty_kill(struct dentry *dentry)
619 : {
620 0 : WARN_ON_ONCE(dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC);
621 :
622 0 : dentry->d_fsdata = NULL;
623 0 : drop_nlink(dentry->d_inode);
624 0 : fsnotify_unlink(d_inode(dentry->d_parent), dentry);
625 0 : d_drop(dentry);
626 0 : dput(dentry); /* d_alloc_name() in devpts_pty_new() */
627 0 : }
628 :
629 1 : static int __init init_devpts_fs(void)
630 : {
631 1 : int err = register_filesystem(&devpts_fs_type);
632 1 : if (!err) {
633 1 : register_sysctl_table(pty_root_table);
634 : }
635 1 : return err;
636 : }
637 : module_init(init_devpts_fs)
|
