1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 *  linux/fs/proc/inode.c
  4 *
  5 *  Copyright (C) 1991, 1992  Linus Torvalds
  6 */
  7
  8#include <linux/cache.h>
  9#include <linux/time.h>
 10#include <linux/proc_fs.h>
 11#include <linux/kernel.h>
 12#include <linux/pid_namespace.h>
 13#include <linux/mm.h>
 14#include <linux/string.h>
 15#include <linux/stat.h>
 16#include <linux/completion.h>
 17#include <linux/poll.h>
 18#include <linux/printk.h>
 19#include <linux/file.h>
 20#include <linux/limits.h>
 21#include <linux/init.h>
 22#include <linux/module.h>
 23#include <linux/sysctl.h>
 24#include <linux/seq_file.h>
 25#include <linux/slab.h>
 26#include <linux/mount.h>
 27#include <linux/bug.h>
 28
 29#include "internal.h"
 30
 31static void proc_evict_inode(struct inode *inode)
 32{
 33	struct ctl_table_header *head;
 34	struct proc_inode *ei = PROC_I(inode);
 35
 36	truncate_inode_pages_final(&inode->i_data);
 37	clear_inode(inode);
 38
 39	/* Stop tracking associated processes */
 40	if (ei->pid)
 41		proc_pid_evict_inode(ei);
 42
 43	head = ei->sysctl;
 44	if (head) {
 45		RCU_INIT_POINTER(ei->sysctl, NULL);
 46		proc_sys_evict_inode(inode, head);
 47	}
 48}
 49
 50static struct kmem_cache *proc_inode_cachep __ro_after_init;
 51static struct kmem_cache *pde_opener_cache __ro_after_init;
 52
 53static struct inode *proc_alloc_inode(struct super_block *sb)
 54{
 55	struct proc_inode *ei;
 56
 57	ei = alloc_inode_sb(sb, proc_inode_cachep, GFP_KERNEL);
 58	if (!ei)
 59		return NULL;
 60	ei->pid = NULL;
 61	ei->fd = 0;
 62	ei->op.proc_get_link = NULL;
 63	ei->pde = NULL;
 64	ei->sysctl = NULL;
 65	ei->sysctl_entry = NULL;
 66	INIT_HLIST_NODE(&ei->sibling_inodes);
 67	ei->ns_ops = NULL;
 68	return &ei->vfs_inode;
 69}
 70
 71static void proc_free_inode(struct inode *inode)
 72{
 73	struct proc_inode *ei = PROC_I(inode);
 74
 75	if (ei->pid)
 76		put_pid(ei->pid);
 77	/* Let go of any associated proc directory entry */
 78	if (ei->pde)
 79		pde_put(ei->pde);
 80	kmem_cache_free(proc_inode_cachep, PROC_I(inode));
 81}
 82
 83static void init_once(void *foo)
 84{
 85	struct proc_inode *ei = (struct proc_inode *) foo;
 86
 87	inode_init_once(&ei->vfs_inode);
 88}
 89
 90void __init proc_init_kmemcache(void)
 91{
 92	proc_inode_cachep = kmem_cache_create("proc_inode_cache",
 93					     sizeof(struct proc_inode),
 94					     0, (SLAB_RECLAIM_ACCOUNT|
 95						SLAB_ACCOUNT|
 96						SLAB_PANIC),
 97					     init_once);
 98	pde_opener_cache =
 99		kmem_cache_create("pde_opener", sizeof(struct pde_opener), 0,
100				  SLAB_ACCOUNT|SLAB_PANIC, NULL);
101	proc_dir_entry_cache = kmem_cache_create_usercopy(
102		"proc_dir_entry", SIZEOF_PDE, 0, SLAB_PANIC,
103		offsetof(struct proc_dir_entry, inline_name),
104		SIZEOF_PDE_INLINE_NAME, NULL);
105	BUILD_BUG_ON(sizeof(struct proc_dir_entry) >= SIZEOF_PDE);
106}
107
108void proc_invalidate_siblings_dcache(struct hlist_head *inodes, spinlock_t *lock)
109{
110	struct hlist_node *node;
111	struct super_block *old_sb = NULL;
112
113	rcu_read_lock();
114	while ((node = hlist_first_rcu(inodes))) {
115		struct proc_inode *ei = hlist_entry(node, struct proc_inode, sibling_inodes);
116		struct super_block *sb;
117		struct inode *inode;
118
119		spin_lock(lock);
120		hlist_del_init_rcu(&ei->sibling_inodes);
121		spin_unlock(lock);
122
123		inode = &ei->vfs_inode;
124		sb = inode->i_sb;
125		if ((sb != old_sb) && !atomic_inc_not_zero(&sb->s_active))
126			continue;
127		inode = igrab(inode);
128		rcu_read_unlock();
129		if (sb != old_sb) {
130			if (old_sb)
131				deactivate_super(old_sb);
132			old_sb = sb;
133		}
134		if (unlikely(!inode)) {
135			rcu_read_lock();
136			continue;
137		}
138
139		if (S_ISDIR(inode->i_mode)) {
140			struct dentry *dir = d_find_any_alias(inode);
141			if (dir) {
142				d_invalidate(dir);
143				dput(dir);
144			}
145		} else {
146			struct dentry *dentry;
147			while ((dentry = d_find_alias(inode))) {
148				d_invalidate(dentry);
149				dput(dentry);
150			}
151		}
152		iput(inode);
153
154		rcu_read_lock();
155	}
156	rcu_read_unlock();
157	if (old_sb)
158		deactivate_super(old_sb);
159}
160
161static inline const char *hidepid2str(enum proc_hidepid v)
162{
163	switch (v) {
164		case HIDEPID_OFF: return "off";
165		case HIDEPID_NO_ACCESS: return "noaccess";
166		case HIDEPID_INVISIBLE: return "invisible";
167		case HIDEPID_NOT_PTRACEABLE: return "ptraceable";
168	}
169	WARN_ONCE(1, "bad hide_pid value: %d\n", v);
170	return "unknown";
171}
172
173static int proc_show_options(struct seq_file *seq, struct dentry *root)
174{
175	struct proc_fs_info *fs_info = proc_sb_info(root->d_sb);
176
177	if (!gid_eq(fs_info->pid_gid, GLOBAL_ROOT_GID))
178		seq_printf(seq, ",gid=%u", from_kgid_munged(&init_user_ns, fs_info->pid_gid));
179	if (fs_info->hide_pid != HIDEPID_OFF)
180		seq_printf(seq, ",hidepid=%s", hidepid2str(fs_info->hide_pid));
181	if (fs_info->pidonly != PROC_PIDONLY_OFF)
182		seq_printf(seq, ",subset=pid");
183
184	return 0;
185}
186
187const struct super_operations proc_sops = {
188	.alloc_inode	= proc_alloc_inode,
189	.free_inode	= proc_free_inode,
190	.drop_inode	= generic_delete_inode,
191	.evict_inode	= proc_evict_inode,
192	.statfs		= simple_statfs,
193	.show_options	= proc_show_options,
194};
195
196enum {BIAS = -1U<<31};
197
198static inline int use_pde(struct proc_dir_entry *pde)
199{
200	return likely(atomic_inc_unless_negative(&pde->in_use));
201}
202
203static void unuse_pde(struct proc_dir_entry *pde)
204{
205	if (unlikely(atomic_dec_return(&pde->in_use) == BIAS))
206		complete(pde->pde_unload_completion);
207}
208
209/*
210 * At most 2 contexts can enter this function: the one doing the last
211 * close on the descriptor and whoever is deleting PDE itself.
212 *
213 * First to enter calls ->proc_release hook and signals its completion
214 * to the second one which waits and then does nothing.
215 *
216 * PDE is locked on entry, unlocked on exit.
217 */
218static void close_pdeo(struct proc_dir_entry *pde, struct pde_opener *pdeo)
219	__releases(&pde->pde_unload_lock)
220{
221	/*
222	 * close() (proc_reg_release()) can't delete an entry and proceed:
223	 * ->release hook needs to be available at the right moment.
224	 *
225	 * rmmod (remove_proc_entry() et al) can't delete an entry and proceed:
226	 * "struct file" needs to be available at the right moment.
227	 */
228	if (pdeo->closing) {
229		/* somebody else is doing that, just wait */
230		DECLARE_COMPLETION_ONSTACK(c);
231		pdeo->c = &c;
232		spin_unlock(&pde->pde_unload_lock);
233		wait_for_completion(&c);
234	} else {
235		struct file *file;
236		struct completion *c;
237
238		pdeo->closing = true;
239		spin_unlock(&pde->pde_unload_lock);
240
241		file = pdeo->file;
242		pde->proc_ops->proc_release(file_inode(file), file);
243
244		spin_lock(&pde->pde_unload_lock);
245		/* Strictly after ->proc_release, see above. */
246		list_del(&pdeo->lh);
247		c = pdeo->c;
248		spin_unlock(&pde->pde_unload_lock);
249		if (unlikely(c))
250			complete(c);
251		kmem_cache_free(pde_opener_cache, pdeo);
252	}
253}
254
255void proc_entry_rundown(struct proc_dir_entry *de)
256{
257	DECLARE_COMPLETION_ONSTACK(c);
258	/* Wait until all existing callers into module are done. */
259	de->pde_unload_completion = &c;
260	if (atomic_add_return(BIAS, &de->in_use) != BIAS)
261		wait_for_completion(&c);
262
263	/* ->pde_openers list can't grow from now on. */
264
265	spin_lock(&de->pde_unload_lock);
266	while (!list_empty(&de->pde_openers)) {
267		struct pde_opener *pdeo;
268		pdeo = list_first_entry(&de->pde_openers, struct pde_opener, lh);
269		close_pdeo(de, pdeo);
270		spin_lock(&de->pde_unload_lock);
271	}
272	spin_unlock(&de->pde_unload_lock);
273}
274
275static loff_t proc_reg_llseek(struct file *file, loff_t offset, int whence)
276{
277	struct proc_dir_entry *pde = PDE(file_inode(file));
278	loff_t rv = -EINVAL;
279
280	if (pde_is_permanent(pde)) {
281		return pde->proc_ops->proc_lseek(file, offset, whence);
282	} else if (use_pde(pde)) {
283		rv = pde->proc_ops->proc_lseek(file, offset, whence);
284		unuse_pde(pde);
285	}
286	return rv;
287}
288
289static ssize_t proc_reg_read_iter(struct kiocb *iocb, struct iov_iter *iter)
290{
291	struct proc_dir_entry *pde = PDE(file_inode(iocb->ki_filp));
292	ssize_t ret;
293
294	if (pde_is_permanent(pde))
295		return pde->proc_ops->proc_read_iter(iocb, iter);
296
297	if (!use_pde(pde))
298		return -EIO;
299	ret = pde->proc_ops->proc_read_iter(iocb, iter);
300	unuse_pde(pde);
301	return ret;
302}
303
304static ssize_t pde_read(struct proc_dir_entry *pde, struct file *file, char __user *buf, size_t count, loff_t *ppos)
305{
306	typeof_member(struct proc_ops, proc_read) read;
307
308	read = pde->proc_ops->proc_read;
309	if (read)
310		return read(file, buf, count, ppos);
311	return -EIO;
312}
313
314static ssize_t proc_reg_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
315{
316	struct proc_dir_entry *pde = PDE(file_inode(file));
317	ssize_t rv = -EIO;
318
319	if (pde_is_permanent(pde)) {
320		return pde_read(pde, file, buf, count, ppos);
321	} else if (use_pde(pde)) {
322		rv = pde_read(pde, file, buf, count, ppos);
323		unuse_pde(pde);
324	}
325	return rv;
326}
327
328static ssize_t pde_write(struct proc_dir_entry *pde, struct file *file, const char __user *buf, size_t count, loff_t *ppos)
329{
330	typeof_member(struct proc_ops, proc_write) write;
331
332	write = pde->proc_ops->proc_write;
333	if (write)
334		return write(file, buf, count, ppos);
335	return -EIO;
336}
337
338static ssize_t proc_reg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
339{
340	struct proc_dir_entry *pde = PDE(file_inode(file));
341	ssize_t rv = -EIO;
342
343	if (pde_is_permanent(pde)) {
344		return pde_write(pde, file, buf, count, ppos);
345	} else if (use_pde(pde)) {
346		rv = pde_write(pde, file, buf, count, ppos);
347		unuse_pde(pde);
348	}
349	return rv;
350}
351
352static __poll_t pde_poll(struct proc_dir_entry *pde, struct file *file, struct poll_table_struct *pts)
353{
354	typeof_member(struct proc_ops, proc_poll) poll;
355
356	poll = pde->proc_ops->proc_poll;
357	if (poll)
358		return poll(file, pts);
359	return DEFAULT_POLLMASK;
360}
361
362static __poll_t proc_reg_poll(struct file *file, struct poll_table_struct *pts)
363{
364	struct proc_dir_entry *pde = PDE(file_inode(file));
365	__poll_t rv = DEFAULT_POLLMASK;
366
367	if (pde_is_permanent(pde)) {
368		return pde_poll(pde, file, pts);
369	} else if (use_pde(pde)) {
370		rv = pde_poll(pde, file, pts);
371		unuse_pde(pde);
372	}
373	return rv;
374}
375
376static long pde_ioctl(struct proc_dir_entry *pde, struct file *file, unsigned int cmd, unsigned long arg)
377{
378	typeof_member(struct proc_ops, proc_ioctl) ioctl;
379
380	ioctl = pde->proc_ops->proc_ioctl;
381	if (ioctl)
382		return ioctl(file, cmd, arg);
383	return -ENOTTY;
384}
385
386static long proc_reg_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
387{
388	struct proc_dir_entry *pde = PDE(file_inode(file));
389	long rv = -ENOTTY;
390
391	if (pde_is_permanent(pde)) {
392		return pde_ioctl(pde, file, cmd, arg);
393	} else if (use_pde(pde)) {
394		rv = pde_ioctl(pde, file, cmd, arg);
395		unuse_pde(pde);
396	}
397	return rv;
398}
399
400#ifdef CONFIG_COMPAT
401static long pde_compat_ioctl(struct proc_dir_entry *pde, struct file *file, unsigned int cmd, unsigned long arg)
402{
403	typeof_member(struct proc_ops, proc_compat_ioctl) compat_ioctl;
404
405	compat_ioctl = pde->proc_ops->proc_compat_ioctl;
406	if (compat_ioctl)
407		return compat_ioctl(file, cmd, arg);
408	return -ENOTTY;
409}
410
411static long proc_reg_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
412{
413	struct proc_dir_entry *pde = PDE(file_inode(file));
414	long rv = -ENOTTY;
415	if (pde_is_permanent(pde)) {
416		return pde_compat_ioctl(pde, file, cmd, arg);
417	} else if (use_pde(pde)) {
418		rv = pde_compat_ioctl(pde, file, cmd, arg);
419		unuse_pde(pde);
420	}
421	return rv;
422}
423#endif
424
425static int pde_mmap(struct proc_dir_entry *pde, struct file *file, struct vm_area_struct *vma)
426{
427	typeof_member(struct proc_ops, proc_mmap) mmap;
428
429	mmap = pde->proc_ops->proc_mmap;
430	if (mmap)
431		return mmap(file, vma);
432	return -EIO;
433}
434
435static int proc_reg_mmap(struct file *file, struct vm_area_struct *vma)
436{
437	struct proc_dir_entry *pde = PDE(file_inode(file));
438	int rv = -EIO;
439
440	if (pde_is_permanent(pde)) {
441		return pde_mmap(pde, file, vma);
442	} else if (use_pde(pde)) {
443		rv = pde_mmap(pde, file, vma);
444		unuse_pde(pde);
445	}
446	return rv;
447}
448
449static unsigned long
450pde_get_unmapped_area(struct proc_dir_entry *pde, struct file *file, unsigned long orig_addr,
451			   unsigned long len, unsigned long pgoff,
452			   unsigned long flags)
453{
454	typeof_member(struct proc_ops, proc_get_unmapped_area) get_area;
 
455
456	get_area = pde->proc_ops->proc_get_unmapped_area;
457#ifdef CONFIG_MMU
458	if (!get_area)
459		get_area = current->mm->get_unmapped_area;
460#endif
461	if (get_area)
462		return get_area(file, orig_addr, len, pgoff, flags);
463	return orig_addr;
464}
465
466static unsigned long
467proc_reg_get_unmapped_area(struct file *file, unsigned long orig_addr,
468			   unsigned long len, unsigned long pgoff,
469			   unsigned long flags)
470{
471	struct proc_dir_entry *pde = PDE(file_inode(file));
472	unsigned long rv = -EIO;
473
474	if (pde_is_permanent(pde)) {
475		return pde_get_unmapped_area(pde, file, orig_addr, len, pgoff, flags);
476	} else if (use_pde(pde)) {
477		rv = pde_get_unmapped_area(pde, file, orig_addr, len, pgoff, flags);
478		unuse_pde(pde);
479	}
480	return rv;
481}
482
483static int proc_reg_open(struct inode *inode, struct file *file)
484{
485	struct proc_dir_entry *pde = PDE(inode);
486	int rv = 0;
487	typeof_member(struct proc_ops, proc_open) open;
488	typeof_member(struct proc_ops, proc_release) release;
489	struct pde_opener *pdeo;
490
491	if (!pde->proc_ops->proc_lseek)
492		file->f_mode &= ~FMODE_LSEEK;
493
494	if (pde_is_permanent(pde)) {
495		open = pde->proc_ops->proc_open;
496		if (open)
497			rv = open(inode, file);
498		return rv;
499	}
500
501	/*
502	 * Ensure that
503	 * 1) PDE's ->release hook will be called no matter what
504	 *    either normally by close()/->release, or forcefully by
505	 *    rmmod/remove_proc_entry.
506	 *
507	 * 2) rmmod isn't blocked by opening file in /proc and sitting on
508	 *    the descriptor (including "rmmod foo </proc/foo" scenario).
509	 *
510	 * Save every "struct file" with custom ->release hook.
511	 */
512	if (!use_pde(pde))
513		return -ENOENT;
514
515	release = pde->proc_ops->proc_release;
516	if (release) {
517		pdeo = kmem_cache_alloc(pde_opener_cache, GFP_KERNEL);
518		if (!pdeo) {
519			rv = -ENOMEM;
520			goto out_unuse;
521		}
522	}
523
524	open = pde->proc_ops->proc_open;
525	if (open)
526		rv = open(inode, file);
527
528	if (release) {
529		if (rv == 0) {
530			/* To know what to release. */
531			pdeo->file = file;
532			pdeo->closing = false;
533			pdeo->c = NULL;
534			spin_lock(&pde->pde_unload_lock);
535			list_add(&pdeo->lh, &pde->pde_openers);
536			spin_unlock(&pde->pde_unload_lock);
537		} else
538			kmem_cache_free(pde_opener_cache, pdeo);
539	}
540
541out_unuse:
542	unuse_pde(pde);
543	return rv;
544}
545
546static int proc_reg_release(struct inode *inode, struct file *file)
547{
548	struct proc_dir_entry *pde = PDE(inode);
549	struct pde_opener *pdeo;
550
551	if (pde_is_permanent(pde)) {
552		typeof_member(struct proc_ops, proc_release) release;
553
554		release = pde->proc_ops->proc_release;
555		if (release) {
556			return release(inode, file);
557		}
558		return 0;
559	}
560
561	spin_lock(&pde->pde_unload_lock);
562	list_for_each_entry(pdeo, &pde->pde_openers, lh) {
563		if (pdeo->file == file) {
564			close_pdeo(pde, pdeo);
565			return 0;
566		}
567	}
568	spin_unlock(&pde->pde_unload_lock);
569	return 0;
570}
571
572static const struct file_operations proc_reg_file_ops = {
573	.llseek		= proc_reg_llseek,
574	.read		= proc_reg_read,
575	.write		= proc_reg_write,
576	.poll		= proc_reg_poll,
577	.unlocked_ioctl	= proc_reg_unlocked_ioctl,
578	.mmap		= proc_reg_mmap,
579	.get_unmapped_area = proc_reg_get_unmapped_area,
580	.open		= proc_reg_open,
581	.release	= proc_reg_release,
582};
583
584static const struct file_operations proc_iter_file_ops = {
585	.llseek		= proc_reg_llseek,
586	.read_iter	= proc_reg_read_iter,
587	.write		= proc_reg_write,
588	.splice_read	= copy_splice_read,
589	.poll		= proc_reg_poll,
590	.unlocked_ioctl	= proc_reg_unlocked_ioctl,
591	.mmap		= proc_reg_mmap,
592	.get_unmapped_area = proc_reg_get_unmapped_area,
593	.open		= proc_reg_open,
594	.release	= proc_reg_release,
595};
596
597#ifdef CONFIG_COMPAT
598static const struct file_operations proc_reg_file_ops_compat = {
599	.llseek		= proc_reg_llseek,
600	.read		= proc_reg_read,
601	.write		= proc_reg_write,
602	.poll		= proc_reg_poll,
603	.unlocked_ioctl	= proc_reg_unlocked_ioctl,
604	.compat_ioctl	= proc_reg_compat_ioctl,
605	.mmap		= proc_reg_mmap,
606	.get_unmapped_area = proc_reg_get_unmapped_area,
607	.open		= proc_reg_open,
608	.release	= proc_reg_release,
609};
610
611static const struct file_operations proc_iter_file_ops_compat = {
612	.llseek		= proc_reg_llseek,
613	.read_iter	= proc_reg_read_iter,
614	.splice_read	= copy_splice_read,
615	.write		= proc_reg_write,
616	.poll		= proc_reg_poll,
617	.unlocked_ioctl	= proc_reg_unlocked_ioctl,
618	.compat_ioctl	= proc_reg_compat_ioctl,
619	.mmap		= proc_reg_mmap,
620	.get_unmapped_area = proc_reg_get_unmapped_area,
621	.open		= proc_reg_open,
622	.release	= proc_reg_release,
623};
624#endif
625
626static void proc_put_link(void *p)
627{
628	unuse_pde(p);
629}
630
631static const char *proc_get_link(struct dentry *dentry,
632				 struct inode *inode,
633				 struct delayed_call *done)
634{
635	struct proc_dir_entry *pde = PDE(inode);
636	if (!use_pde(pde))
637		return ERR_PTR(-EINVAL);
638	set_delayed_call(done, proc_put_link, pde);
639	return pde->data;
640}
641
642const struct inode_operations proc_link_inode_operations = {
643	.get_link	= proc_get_link,
644};
645
646struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
647{
648	struct inode *inode = new_inode(sb);
649
650	if (!inode) {
651		pde_put(de);
652		return NULL;
653	}
654
655	inode->i_private = de->data;
656	inode->i_ino = de->low_ino;
657	simple_inode_init_ts(inode);
658	PROC_I(inode)->pde = de;
659	if (is_empty_pde(de)) {
660		make_empty_dir_inode(inode);
661		return inode;
662	}
663
664	if (de->mode) {
665		inode->i_mode = de->mode;
666		inode->i_uid = de->uid;
667		inode->i_gid = de->gid;
668	}
669	if (de->size)
670		inode->i_size = de->size;
671	if (de->nlink)
672		set_nlink(inode, de->nlink);
673
674	if (S_ISREG(inode->i_mode)) {
675		inode->i_op = de->proc_iops;
676		if (de->proc_ops->proc_read_iter)
677			inode->i_fop = &proc_iter_file_ops;
678		else
679			inode->i_fop = &proc_reg_file_ops;
680#ifdef CONFIG_COMPAT
681		if (de->proc_ops->proc_compat_ioctl) {
682			if (de->proc_ops->proc_read_iter)
683				inode->i_fop = &proc_iter_file_ops_compat;
684			else
685				inode->i_fop = &proc_reg_file_ops_compat;
686		}
687#endif
688	} else if (S_ISDIR(inode->i_mode)) {
689		inode->i_op = de->proc_iops;
690		inode->i_fop = de->proc_dir_ops;
691	} else if (S_ISLNK(inode->i_mode)) {
692		inode->i_op = de->proc_iops;
693		inode->i_fop = NULL;
694	} else {
695		BUG();
696	}
697	return inode;
698}