2005-04-16 18:20:36 -04:00
|
|
|
/*
|
|
|
|
* linux/fs/proc/root.c
|
|
|
|
*
|
|
|
|
* Copyright (C) 1991, 1992 Linus Torvalds
|
|
|
|
*
|
|
|
|
* proc root directory handling functions
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <asm/uaccess.h>
|
|
|
|
|
|
|
|
#include <linux/errno.h>
|
|
|
|
#include <linux/time.h>
|
|
|
|
#include <linux/proc_fs.h>
|
|
|
|
#include <linux/stat.h>
|
|
|
|
#include <linux/init.h>
|
2006-10-18 13:55:46 -04:00
|
|
|
#include <linux/sched.h>
|
2005-04-16 18:20:36 -04:00
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/bitops.h>
|
2006-10-02 05:17:07 -04:00
|
|
|
#include <linux/mount.h>
|
2007-10-19 02:40:08 -04:00
|
|
|
#include <linux/pid_namespace.h>
|
2005-04-16 18:20:36 -04:00
|
|
|
|
2006-01-08 04:04:16 -05:00
|
|
|
#include "internal.h"
|
|
|
|
|
2007-10-19 02:40:08 -04:00
|
|
|
static int proc_test_super(struct super_block *sb, void *data)
|
|
|
|
{
|
|
|
|
return sb->s_fs_info == data;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int proc_set_super(struct super_block *sb, void *data)
|
|
|
|
{
|
|
|
|
struct pid_namespace *ns;
|
|
|
|
|
|
|
|
ns = (struct pid_namespace *)data;
|
|
|
|
sb->s_fs_info = get_pid_ns(ns);
|
|
|
|
return set_anon_super(sb, NULL);
|
|
|
|
}
|
|
|
|
|
[PATCH] VFS: Permit filesystem to override root dentry on mount
Extend the get_sb() filesystem operation to take an extra argument that
permits the VFS to pass in the target vfsmount that defines the mountpoint.
The filesystem is then required to manually set the superblock and root dentry
pointers. For most filesystems, this should be done with simple_set_mnt()
which will set the superblock pointer and then set the root dentry to the
superblock's s_root (as per the old default behaviour).
The get_sb() op now returns an integer as there's now no need to return the
superblock pointer.
This patch permits a superblock to be implicitly shared amongst several mount
points, such as can be done with NFS to avoid potential inode aliasing. In
such a case, simple_set_mnt() would not be called, and instead the mnt_root
and mnt_sb would be set directly.
The patch also makes the following changes:
(*) the get_sb_*() convenience functions in the core kernel now take a vfsmount
pointer argument and return an integer, so most filesystems have to change
very little.
(*) If one of the convenience function is not used, then get_sb() should
normally call simple_set_mnt() to instantiate the vfsmount. This will
always return 0, and so can be tail-called from get_sb().
(*) generic_shutdown_super() now calls shrink_dcache_sb() to clean up the
dcache upon superblock destruction rather than shrink_dcache_anon().
This is required because the superblock may now have multiple trees that
aren't actually bound to s_root, but that still need to be cleaned up. The
currently called functions assume that the whole tree is rooted at s_root,
and that anonymous dentries are not the roots of trees which results in
dentries being left unculled.
However, with the way NFS superblock sharing are currently set to be
implemented, these assumptions are violated: the root of the filesystem is
simply a dummy dentry and inode (the real inode for '/' may well be
inaccessible), and all the vfsmounts are rooted on anonymous[*] dentries
with child trees.
[*] Anonymous until discovered from another tree.
(*) The documentation has been adjusted, including the additional bit of
changing ext2_* into foo_* in the documentation.
[akpm@osdl.org: convert ipath_fs, do other stuff]
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Nathan Scott <nathans@sgi.com>
Cc: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-23 05:02:57 -04:00
|
|
|
static int proc_get_sb(struct file_system_type *fs_type,
|
|
|
|
int flags, const char *dev_name, void *data, struct vfsmount *mnt)
|
2005-04-16 18:20:36 -04:00
|
|
|
{
|
2007-10-19 02:40:08 -04:00
|
|
|
int err;
|
|
|
|
struct super_block *sb;
|
|
|
|
struct pid_namespace *ns;
|
|
|
|
struct proc_inode *ei;
|
|
|
|
|
2006-10-02 05:17:07 -04:00
|
|
|
if (proc_mnt) {
|
|
|
|
/* Seed the root directory with a pid so it doesn't need
|
|
|
|
* to be special in base.c. I would do this earlier but
|
|
|
|
* the only task alive when /proc is mounted the first time
|
|
|
|
* is the init_task and it doesn't have any pids.
|
|
|
|
*/
|
|
|
|
ei = PROC_I(proc_mnt->mnt_sb->s_root->d_inode);
|
|
|
|
if (!ei->pid)
|
|
|
|
ei->pid = find_get_pid(1);
|
|
|
|
}
|
2007-10-19 02:40:08 -04:00
|
|
|
|
|
|
|
if (flags & MS_KERNMOUNT)
|
|
|
|
ns = (struct pid_namespace *)data;
|
|
|
|
else
|
|
|
|
ns = current->nsproxy->pid_ns;
|
|
|
|
|
|
|
|
sb = sget(fs_type, proc_test_super, proc_set_super, ns);
|
|
|
|
if (IS_ERR(sb))
|
|
|
|
return PTR_ERR(sb);
|
|
|
|
|
|
|
|
if (!sb->s_root) {
|
|
|
|
sb->s_flags = flags;
|
|
|
|
err = proc_fill_super(sb);
|
|
|
|
if (err) {
|
2009-05-06 01:34:22 -04:00
|
|
|
deactivate_locked_super(sb);
|
2007-10-19 02:40:08 -04:00
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
ei = PROC_I(sb->s_root->d_inode);
|
|
|
|
if (!ei->pid) {
|
|
|
|
rcu_read_lock();
|
|
|
|
ei->pid = get_pid(find_pid_ns(1, ns));
|
|
|
|
rcu_read_unlock();
|
|
|
|
}
|
|
|
|
|
|
|
|
sb->s_flags |= MS_ACTIVE;
|
|
|
|
ns->proc_mnt = mnt;
|
|
|
|
}
|
|
|
|
|
2009-03-04 15:06:34 -05:00
|
|
|
simple_set_mnt(mnt, sb);
|
|
|
|
return 0;
|
2007-10-19 02:40:08 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
static void proc_kill_sb(struct super_block *sb)
|
|
|
|
{
|
|
|
|
struct pid_namespace *ns;
|
|
|
|
|
|
|
|
ns = (struct pid_namespace *)sb->s_fs_info;
|
|
|
|
kill_anon_super(sb);
|
|
|
|
put_pid_ns(ns);
|
2005-04-16 18:20:36 -04:00
|
|
|
}
|
|
|
|
|
proc: fix NULL ->i_fop oops
proc_kill_inodes() can clear ->i_fop in the middle of vfs_readdir resulting in
NULL dereference during "file->f_op->readdir(file, buf, filler)".
The solution is to remove proc_kill_inodes() completely:
a) we don't have tricky modules implementing their tricky readdir hooks which
could keeping this revoke from hell.
b) In a situation when module is gone but PDE still alive, standard
readdir will return only "." and "..", because pde->next was cleared by
remove_proc_entry().
c) the race proc_kill_inode() destined to prevent is not completely
fixed, just race window made smaller, because vfs_readdir() is run
without sb_lock held and without file_list_lock held. Effectively,
->i_fop is cleared at random moment, which can't fix properly anything.
BUG: unable to handle kernel NULL pointer dereference at virtual address 00000018
printing eip: c1061205 *pdpt = 0000000005b22001 *pde = 0000000000000000
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: foo af_packet ipv6 cpufreq_ondemand loop serio_raw sr_mod k8temp cdrom hwmon amd_rng
Pid: 2033, comm: find Not tainted (2.6.24-rc1-b1d08ac064268d0ae2281e98bf5e82627e0f0c56 #2)
EIP: 0060:[<c1061205>] EFLAGS: 00010246 CPU: 0
EIP is at vfs_readdir+0x47/0x74
EAX: c6b6a780 EBX: 00000000 ECX: c1061040 EDX: c5decf94
ESI: c6b6a780 EDI: fffffffe EBP: c9797c54 ESP: c5decf78
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process find (pid: 2033, ti=c5dec000 task=c64bba90 task.ti=c5dec000)
Stack: c5decf94 c1061040 fffffff7 0805ffbc 00000000 c6b6a780 c1061295 0805ffbc
00000000 00000400 00000000 00000004 0805ffbc 4588eff4 c5dec000 c10026ba
00000004 0805ffbc 00000400 0805ffbc 4588eff4 bfdc6c70 000000dc 0000007b
Call Trace:
[<c1061040>] filldir64+0x0/0xc5
[<c1061295>] sys_getdents64+0x63/0xa5
[<c10026ba>] sysenter_past_esp+0x5f/0x85
=======================
Code: 49 83 78 18 00 74 43 8d 6b 74 bf fe ff ff ff 89 e8 e8 b8 c0 12 00 f6 83 2c 01 00 00 10 75 22 8b 5e 10 8b 4c 24 04 89 f0 8b 14 24 <ff> 53 18 f6 46 1a 04 89 c7 75 0b 8b 56 0c 8b 46 08 e8 c8 66 00
EIP: [<c1061205>] vfs_readdir+0x47/0x74 SS:ESP 0068:c5decf78
hch: "Nice, getting rid of this is a very good step formwards.
Unfortunately we have another copy of this junk in
security/selinux/selinuxfs.c:sel_remove_entries() which would need the
same treatment."
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Acked-by: Christoph Hellwig <hch@infradead.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-11-28 19:21:23 -05:00
|
|
|
static struct file_system_type proc_fs_type = {
|
2005-04-16 18:20:36 -04:00
|
|
|
.name = "proc",
|
|
|
|
.get_sb = proc_get_sb,
|
2007-10-19 02:40:08 -04:00
|
|
|
.kill_sb = proc_kill_sb,
|
2005-04-16 18:20:36 -04:00
|
|
|
};
|
|
|
|
|
|
|
|
void __init proc_root_init(void)
|
|
|
|
{
|
2008-10-16 19:43:55 -04:00
|
|
|
int err;
|
|
|
|
|
|
|
|
proc_init_inodecache();
|
2005-04-16 18:20:36 -04:00
|
|
|
err = register_filesystem(&proc_fs_type);
|
|
|
|
if (err)
|
|
|
|
return;
|
2007-10-19 02:40:08 -04:00
|
|
|
proc_mnt = kern_mount_data(&proc_fs_type, &init_pid_ns);
|
2005-04-16 18:20:36 -04:00
|
|
|
if (IS_ERR(proc_mnt)) {
|
|
|
|
unregister_filesystem(&proc_fs_type);
|
|
|
|
return;
|
|
|
|
}
|
2007-10-19 02:40:08 -04:00
|
|
|
|
2008-10-06 06:49:39 -04:00
|
|
|
proc_symlink("mounts", NULL, "self/mounts");
|
2007-09-12 06:01:34 -04:00
|
|
|
|
|
|
|
proc_net_init();
|
2005-04-16 18:20:36 -04:00
|
|
|
|
|
|
|
#ifdef CONFIG_SYSVIPC
|
|
|
|
proc_mkdir("sysvipc", NULL);
|
|
|
|
#endif
|
2008-04-29 04:01:42 -04:00
|
|
|
proc_mkdir("fs", NULL);
|
2008-04-29 04:01:44 -04:00
|
|
|
proc_mkdir("driver", NULL);
|
2005-04-16 18:20:36 -04:00
|
|
|
proc_mkdir("fs/nfsd", NULL); /* somewhere for the nfsd filesystem to be mounted */
|
|
|
|
#if defined(CONFIG_SUN_OPENPROMFS) || defined(CONFIG_SUN_OPENPROMFS_MODULE)
|
|
|
|
/* just give it a mountpoint */
|
|
|
|
proc_mkdir("openprom", NULL);
|
|
|
|
#endif
|
|
|
|
proc_tty_init();
|
|
|
|
#ifdef CONFIG_PROC_DEVICETREE
|
|
|
|
proc_device_tree_init();
|
|
|
|
#endif
|
2008-04-29 04:01:41 -04:00
|
|
|
proc_mkdir("bus", NULL);
|
2007-02-14 03:34:12 -05:00
|
|
|
proc_sys_init();
|
2005-04-16 18:20:36 -04:00
|
|
|
}
|
|
|
|
|
2006-02-08 14:37:40 -05:00
|
|
|
static int proc_root_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat
|
|
|
|
)
|
2005-04-16 18:20:36 -04:00
|
|
|
{
|
2006-02-08 14:37:40 -05:00
|
|
|
generic_fillattr(dentry->d_inode, stat);
|
|
|
|
stat->nlink = proc_root.nlink + nr_processes();
|
|
|
|
return 0;
|
|
|
|
}
|
2005-04-16 18:20:36 -04:00
|
|
|
|
2006-02-08 14:37:40 -05:00
|
|
|
static struct dentry *proc_root_lookup(struct inode * dir, struct dentry * dentry, struct nameidata *nd)
|
|
|
|
{
|
2005-04-16 18:20:36 -04:00
|
|
|
if (!proc_lookup(dir, dentry, nd)) {
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
return proc_pid_lookup(dir, dentry, nd);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int proc_root_readdir(struct file * filp,
|
|
|
|
void * dirent, filldir_t filldir)
|
|
|
|
{
|
|
|
|
unsigned int nr = filp->f_pos;
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
if (nr < FIRST_PROCESS_ENTRY) {
|
|
|
|
int error = proc_readdir(filp, dirent, filldir);
|
proc: stop using BKL
There are four BKL users in proc: de_put(), proc_lookup_de(),
proc_readdir_de(), proc_root_readdir(),
1) de_put()
-----------
de_put() is classic atomic_dec_and_test() refcount wrapper -- no BKL
needed. BKL doesn't matter to possible refcount leak as well.
2) proc_lookup_de()
-------------------
Walking PDE list is protected by proc_subdir_lock(), proc_get_inode() is
potentially blocking, all callers of proc_lookup_de() eventually end up
from ->lookup hooks which is protected by directory's ->i_mutex -- BKL
doesn't protect anything.
3) proc_readdir_de()
--------------------
"." and ".." part doesn't need BKL, walking PDE list is under
proc_subdir_lock, calling filldir callback is potentially blocking
because it writes to luserspace. All proc_readdir_de() callers
eventually come from ->readdir hook which is under directory's
->i_mutex -- BKL doesn't protect anything.
4) proc_root_readdir_de()
-------------------------
proc_root_readdir_de is ->readdir hook, see (3).
Since readdir hooks doesn't use BKL anymore, switch to
generic_file_llseek, since it also takes directory's i_mutex.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
2008-10-27 15:48:36 -04:00
|
|
|
if (error <= 0)
|
2005-04-16 18:20:36 -04:00
|
|
|
return error;
|
|
|
|
filp->f_pos = FIRST_PROCESS_ENTRY;
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = proc_pid_readdir(filp, dirent, filldir);
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The root /proc directory is special, as it has the
|
|
|
|
* <pid> directories. Thus we don't use the generic
|
|
|
|
* directory handling functions for that..
|
|
|
|
*/
|
2007-02-12 03:55:34 -05:00
|
|
|
static const struct file_operations proc_root_operations = {
|
2005-04-16 18:20:36 -04:00
|
|
|
.read = generic_read_dir,
|
|
|
|
.readdir = proc_root_readdir,
|
|
|
|
};
|
|
|
|
|
|
|
|
/*
|
|
|
|
* proc root can do almost nothing..
|
|
|
|
*/
|
2007-02-12 03:55:40 -05:00
|
|
|
static const struct inode_operations proc_root_inode_operations = {
|
2005-04-16 18:20:36 -04:00
|
|
|
.lookup = proc_root_lookup,
|
2006-02-08 14:37:40 -05:00
|
|
|
.getattr = proc_root_getattr,
|
2005-04-16 18:20:36 -04:00
|
|
|
};
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This is the root "inode" in the /proc tree..
|
|
|
|
*/
|
|
|
|
struct proc_dir_entry proc_root = {
|
|
|
|
.low_ino = PROC_ROOT_INO,
|
|
|
|
.namelen = 5,
|
|
|
|
.name = "/proc",
|
|
|
|
.mode = S_IFDIR | S_IRUGO | S_IXUGO,
|
|
|
|
.nlink = 2,
|
proc: fix proc_dir_entry refcounting
Creating PDEs with refcount 0 and "deleted" flag has problems (see below).
Switch to usual scheme:
* PDE is created with refcount 1
* every de_get does +1
* every de_put() and remove_proc_entry() do -1
* once refcount reaches 0, PDE is freed.
This elegantly fixes at least two following races (both observed) without
introducing new locks, without abusing old locks, without spreading
lock_kernel():
1) PDE leak
remove_proc_entry de_put
----------------- ------
[refcnt = 1]
if (atomic_read(&de->count) == 0)
if (atomic_dec_and_test(&de->count))
if (de->deleted)
/* also not taken! */
free_proc_entry(de);
else
de->deleted = 1;
[refcount=0, deleted=1]
2) use after free
remove_proc_entry de_put
----------------- ------
[refcnt = 1]
if (atomic_dec_and_test(&de->count))
if (atomic_read(&de->count) == 0)
free_proc_entry(de);
/* boom! */
if (de->deleted)
free_proc_entry(de);
BUG: unable to handle kernel paging request at virtual address 6b6b6b6b
printing eip: c10acdda *pdpt = 00000000338f8001 *pde = 0000000000000000
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: af_packet ipv6 cpufreq_ondemand loop serio_raw psmouse k8temp hwmon sr_mod cdrom
Pid: 23161, comm: cat Not tainted (2.6.24-rc2-8c0863403f109a43d7000b4646da4818220d501f #4)
EIP: 0060:[<c10acdda>] EFLAGS: 00210097 CPU: 1
EIP is at strnlen+0x6/0x18
EAX: 6b6b6b6b EBX: 6b6b6b6b ECX: 6b6b6b6b EDX: fffffffe
ESI: c128fa3b EDI: f380bf34 EBP: ffffffff ESP: f380be44
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process cat (pid: 23161, ti=f380b000 task=f38f2570 task.ti=f380b000)
Stack: c10ac4f0 00000278 c12ce000 f43cd2a8 00000163 00000000 7da86067 00000400
c128fa20 00896b18 f38325a8 c128fe20 ffffffff 00000000 c11f291e 00000400
f75be300 c128fa20 f769c9a0 c10ac779 f380bf34 f7bfee70 c1018e6b f380bf34
Call Trace:
[<c10ac4f0>] vsnprintf+0x2ad/0x49b
[<c10ac779>] vscnprintf+0x14/0x1f
[<c1018e6b>] vprintk+0xc5/0x2f9
[<c10379f1>] handle_fasteoi_irq+0x0/0xab
[<c1004f44>] do_IRQ+0x9f/0xb7
[<c117db3b>] preempt_schedule_irq+0x3f/0x5b
[<c100264e>] need_resched+0x1f/0x21
[<c10190ba>] printk+0x1b/0x1f
[<c107c8ad>] de_put+0x3d/0x50
[<c107c8f8>] proc_delete_inode+0x38/0x41
[<c107c8c0>] proc_delete_inode+0x0/0x41
[<c1066298>] generic_delete_inode+0x5e/0xc6
[<c1065aa9>] iput+0x60/0x62
[<c1063c8e>] d_kill+0x2d/0x46
[<c1063fa9>] dput+0xdc/0xe4
[<c10571a1>] __fput+0xb0/0xcd
[<c1054e49>] filp_close+0x48/0x4f
[<c1055ee9>] sys_close+0x67/0xa5
[<c10026b6>] sysenter_past_esp+0x5f/0x85
=======================
Code: c9 74 0c f2 ae 74 05 bf 01 00 00 00 4f 89 fa 5f 89 d0 c3 85 c9 57 89 c7 89 d0 74 05 f2 ae 75 01 4f 89 f8 5f c3 89 c1 89 c8 eb 06 <80> 38 00 74 07 40 4a 83 fa ff 75 f4 29 c8 c3 90 90 90 57 83 c9
EIP: [<c10acdda>] strnlen+0x6/0x18 SS:ESP 0068:f380be44
Also, remove broken usage of ->deleted from reiserfs: if sget() succeeds,
module is already pinned and remove_proc_entry() can't happen => nobody
can mark PDE deleted.
Dummy proc root in netns code is not marked with refcount 1. AFAICS, we
never get it, it's just for proper /proc/net removal. I double checked
CLONE_NETNS continues to work.
Patch survives many hours of modprobe/rmmod/cat loops without new bugs
which can be attributed to refcounting.
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-12-05 02:45:28 -05:00
|
|
|
.count = ATOMIC_INIT(1),
|
2005-04-16 18:20:36 -04:00
|
|
|
.proc_iops = &proc_root_inode_operations,
|
|
|
|
.proc_fops = &proc_root_operations,
|
|
|
|
.parent = &proc_root,
|
|
|
|
};
|
|
|
|
|
2007-10-19 02:40:11 -04:00
|
|
|
int pid_ns_prepare_proc(struct pid_namespace *ns)
|
|
|
|
{
|
|
|
|
struct vfsmount *mnt;
|
|
|
|
|
|
|
|
mnt = kern_mount_data(&proc_fs_type, ns);
|
|
|
|
if (IS_ERR(mnt))
|
|
|
|
return PTR_ERR(mnt);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
void pid_ns_release_proc(struct pid_namespace *ns)
|
|
|
|
{
|
|
|
|
mntput(ns->proc_mnt);
|
|
|
|
}
|