2005-04-16 22:20:36 +00:00
|
|
|
/*
|
|
|
|
* linux/fs/proc/inode.c
|
|
|
|
*
|
|
|
|
* Copyright (C) 1991, 1992 Linus Torvalds
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/time.h>
|
|
|
|
#include <linux/proc_fs.h>
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/mm.h>
|
|
|
|
#include <linux/string.h>
|
|
|
|
#include <linux/stat.h>
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
#include <linux/completion.h>
|
2007-09-11 22:23:55 +00:00
|
|
|
#include <linux/poll.h>
|
2005-04-16 22:20:36 +00:00
|
|
|
#include <linux/file.h>
|
|
|
|
#include <linux/limits.h>
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/smp_lock.h>
|
2008-07-15 12:54:06 +00:00
|
|
|
#include <linux/sysctl.h>
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
#include <asm/system.h>
|
|
|
|
#include <asm/uaccess.h>
|
|
|
|
|
2006-01-08 09:04:16 +00:00
|
|
|
#include "internal.h"
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2007-05-08 07:25:45 +00:00
|
|
|
struct proc_dir_entry *de_get(struct proc_dir_entry *de)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
2008-04-29 08:01:41 +00:00
|
|
|
atomic_inc(&de->count);
|
2005-04-16 22:20:36 +00:00
|
|
|
return de;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Decrements the use count and checks for deferred deletion.
|
|
|
|
*/
|
2007-05-08 07:25:45 +00:00
|
|
|
void de_put(struct proc_dir_entry *de)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
2008-04-29 08:01:41 +00:00
|
|
|
if (!atomic_read(&de->count)) {
|
|
|
|
printk("de_put: entry %s already free!\n", de->name);
|
|
|
|
return;
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
2008-04-29 08:01:41 +00:00
|
|
|
|
|
|
|
if (atomic_dec_and_test(&de->count))
|
|
|
|
free_proc_entry(de);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Decrement the use count of the proc_dir_entry.
|
|
|
|
*/
|
|
|
|
static void proc_delete_inode(struct inode *inode)
|
|
|
|
{
|
|
|
|
struct proc_dir_entry *de;
|
|
|
|
|
2005-09-09 20:01:31 +00:00
|
|
|
truncate_inode_pages(&inode->i_data, 0);
|
|
|
|
|
2006-06-26 07:25:55 +00:00
|
|
|
/* Stop tracking associated processes */
|
2006-06-26 07:25:56 +00:00
|
|
|
put_pid(PROC_I(inode)->pid);
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
/* Let go of any associated proc directory entry */
|
|
|
|
de = PROC_I(inode)->pde;
|
|
|
|
if (de) {
|
|
|
|
if (de->owner)
|
|
|
|
module_put(de->owner);
|
|
|
|
de_put(de);
|
|
|
|
}
|
2008-07-15 12:54:06 +00:00
|
|
|
if (PROC_I(inode)->sysctl)
|
|
|
|
sysctl_head_put(PROC_I(inode)->sysctl);
|
2005-04-16 22:20:36 +00:00
|
|
|
clear_inode(inode);
|
|
|
|
}
|
|
|
|
|
|
|
|
struct vfsmount *proc_mnt;
|
|
|
|
|
2006-12-07 04:33:20 +00:00
|
|
|
static struct kmem_cache * proc_inode_cachep;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
static struct inode *proc_alloc_inode(struct super_block *sb)
|
|
|
|
{
|
|
|
|
struct proc_inode *ei;
|
|
|
|
struct inode *inode;
|
|
|
|
|
2006-12-07 04:33:17 +00:00
|
|
|
ei = (struct proc_inode *)kmem_cache_alloc(proc_inode_cachep, GFP_KERNEL);
|
2005-04-16 22:20:36 +00:00
|
|
|
if (!ei)
|
|
|
|
return NULL;
|
2006-06-26 07:25:56 +00:00
|
|
|
ei->pid = NULL;
|
2006-06-26 07:25:44 +00:00
|
|
|
ei->fd = 0;
|
2005-04-16 22:20:36 +00:00
|
|
|
ei->op.proc_get_link = NULL;
|
|
|
|
ei->pde = NULL;
|
2008-07-15 12:54:06 +00:00
|
|
|
ei->sysctl = NULL;
|
|
|
|
ei->sysctl_entry = NULL;
|
2005-04-16 22:20:36 +00:00
|
|
|
inode = &ei->vfs_inode;
|
|
|
|
inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
|
|
|
|
return inode;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void proc_destroy_inode(struct inode *inode)
|
|
|
|
{
|
|
|
|
kmem_cache_free(proc_inode_cachep, PROC_I(inode));
|
|
|
|
}
|
|
|
|
|
2008-07-26 02:45:34 +00:00
|
|
|
static void init_once(void *foo)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
|
|
|
struct proc_inode *ei = (struct proc_inode *) foo;
|
|
|
|
|
2007-05-17 05:10:57 +00:00
|
|
|
inode_init_once(&ei->vfs_inode);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
2007-07-20 01:11:58 +00:00
|
|
|
|
2008-10-16 23:43:55 +00:00
|
|
|
void __init proc_init_inodecache(void)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
|
|
|
proc_inode_cachep = kmem_cache_create("proc_inode_cache",
|
|
|
|
sizeof(struct proc_inode),
|
2006-03-24 11:16:06 +00:00
|
|
|
0, (SLAB_RECLAIM_ACCOUNT|
|
2007-10-17 06:26:10 +00:00
|
|
|
SLAB_MEM_SPREAD|SLAB_PANIC),
|
2007-07-20 01:11:58 +00:00
|
|
|
init_once);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
2007-02-12 08:55:41 +00:00
|
|
|
static const struct super_operations proc_sops = {
|
2005-04-16 22:20:36 +00:00
|
|
|
.alloc_inode = proc_alloc_inode,
|
|
|
|
.destroy_inode = proc_destroy_inode,
|
|
|
|
.drop_inode = generic_delete_inode,
|
|
|
|
.delete_inode = proc_delete_inode,
|
|
|
|
.statfs = simple_statfs,
|
|
|
|
};
|
|
|
|
|
2008-07-25 08:48:29 +00:00
|
|
|
static void __pde_users_dec(struct proc_dir_entry *pde)
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
{
|
|
|
|
pde->pde_users--;
|
|
|
|
if (pde->pde_unload_completion && pde->pde_users == 0)
|
|
|
|
complete(pde->pde_unload_completion);
|
2008-07-25 08:48:29 +00:00
|
|
|
}
|
|
|
|
|
2009-02-20 14:04:33 +00:00
|
|
|
void pde_users_dec(struct proc_dir_entry *pde)
|
2008-07-25 08:48:29 +00:00
|
|
|
{
|
|
|
|
spin_lock(&pde->pde_unload_lock);
|
|
|
|
__pde_users_dec(pde);
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
}
|
|
|
|
|
|
|
|
static loff_t proc_reg_llseek(struct file *file, loff_t offset, int whence)
|
|
|
|
{
|
|
|
|
struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
|
|
|
|
loff_t rv = -EINVAL;
|
|
|
|
loff_t (*llseek)(struct file *, loff_t, int);
|
|
|
|
|
|
|
|
spin_lock(&pde->pde_unload_lock);
|
|
|
|
/*
|
|
|
|
* remove_proc_entry() is going to delete PDE (as part of module
|
|
|
|
* cleanup sequence). No new callers into module allowed.
|
|
|
|
*/
|
|
|
|
if (!pde->proc_fops) {
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
/*
|
|
|
|
* Bump refcount so that remove_proc_entry will wail for ->llseek to
|
|
|
|
* complete.
|
|
|
|
*/
|
|
|
|
pde->pde_users++;
|
|
|
|
/*
|
|
|
|
* Save function pointer under lock, to protect against ->proc_fops
|
|
|
|
* NULL'ifying right after ->pde_unload_lock is dropped.
|
|
|
|
*/
|
|
|
|
llseek = pde->proc_fops->llseek;
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
|
|
|
|
if (!llseek)
|
|
|
|
llseek = default_llseek;
|
|
|
|
rv = llseek(file, offset, whence);
|
|
|
|
|
|
|
|
pde_users_dec(pde);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
|
|
|
static ssize_t proc_reg_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
|
|
|
|
{
|
|
|
|
struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
|
|
|
|
ssize_t rv = -EIO;
|
|
|
|
ssize_t (*read)(struct file *, char __user *, size_t, loff_t *);
|
|
|
|
|
|
|
|
spin_lock(&pde->pde_unload_lock);
|
|
|
|
if (!pde->proc_fops) {
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
pde->pde_users++;
|
|
|
|
read = pde->proc_fops->read;
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
|
|
|
|
if (read)
|
|
|
|
rv = read(file, buf, count, ppos);
|
|
|
|
|
|
|
|
pde_users_dec(pde);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
|
|
|
static ssize_t proc_reg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
|
|
|
|
{
|
|
|
|
struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
|
|
|
|
ssize_t rv = -EIO;
|
|
|
|
ssize_t (*write)(struct file *, const char __user *, size_t, loff_t *);
|
|
|
|
|
|
|
|
spin_lock(&pde->pde_unload_lock);
|
|
|
|
if (!pde->proc_fops) {
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
pde->pde_users++;
|
|
|
|
write = pde->proc_fops->write;
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
|
|
|
|
if (write)
|
|
|
|
rv = write(file, buf, count, ppos);
|
|
|
|
|
|
|
|
pde_users_dec(pde);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
|
|
|
static unsigned int proc_reg_poll(struct file *file, struct poll_table_struct *pts)
|
|
|
|
{
|
|
|
|
struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
|
2007-09-11 22:23:55 +00:00
|
|
|
unsigned int rv = DEFAULT_POLLMASK;
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
unsigned int (*poll)(struct file *, struct poll_table_struct *);
|
|
|
|
|
|
|
|
spin_lock(&pde->pde_unload_lock);
|
|
|
|
if (!pde->proc_fops) {
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
pde->pde_users++;
|
|
|
|
poll = pde->proc_fops->poll;
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
|
|
|
|
if (poll)
|
|
|
|
rv = poll(file, pts);
|
|
|
|
|
|
|
|
pde_users_dec(pde);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
|
|
|
static long proc_reg_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
|
|
|
|
{
|
|
|
|
struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
|
|
|
|
long rv = -ENOTTY;
|
|
|
|
long (*unlocked_ioctl)(struct file *, unsigned int, unsigned long);
|
|
|
|
int (*ioctl)(struct inode *, struct file *, unsigned int, unsigned long);
|
|
|
|
|
|
|
|
spin_lock(&pde->pde_unload_lock);
|
|
|
|
if (!pde->proc_fops) {
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
pde->pde_users++;
|
|
|
|
unlocked_ioctl = pde->proc_fops->unlocked_ioctl;
|
|
|
|
ioctl = pde->proc_fops->ioctl;
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
|
|
|
|
if (unlocked_ioctl) {
|
|
|
|
rv = unlocked_ioctl(file, cmd, arg);
|
|
|
|
if (rv == -ENOIOCTLCMD)
|
|
|
|
rv = -EINVAL;
|
|
|
|
} else if (ioctl) {
|
|
|
|
lock_kernel();
|
|
|
|
rv = ioctl(file->f_path.dentry->d_inode, file, cmd, arg);
|
|
|
|
unlock_kernel();
|
|
|
|
}
|
|
|
|
|
|
|
|
pde_users_dec(pde);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef CONFIG_COMPAT
|
|
|
|
static long proc_reg_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
|
|
|
|
{
|
|
|
|
struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
|
|
|
|
long rv = -ENOTTY;
|
|
|
|
long (*compat_ioctl)(struct file *, unsigned int, unsigned long);
|
|
|
|
|
|
|
|
spin_lock(&pde->pde_unload_lock);
|
|
|
|
if (!pde->proc_fops) {
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
pde->pde_users++;
|
|
|
|
compat_ioctl = pde->proc_fops->compat_ioctl;
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
|
|
|
|
if (compat_ioctl)
|
|
|
|
rv = compat_ioctl(file, cmd, arg);
|
|
|
|
|
|
|
|
pde_users_dec(pde);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
static int proc_reg_mmap(struct file *file, struct vm_area_struct *vma)
|
|
|
|
{
|
|
|
|
struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
|
|
|
|
int rv = -EIO;
|
|
|
|
int (*mmap)(struct file *, struct vm_area_struct *);
|
|
|
|
|
|
|
|
spin_lock(&pde->pde_unload_lock);
|
|
|
|
if (!pde->proc_fops) {
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
pde->pde_users++;
|
|
|
|
mmap = pde->proc_fops->mmap;
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
|
|
|
|
if (mmap)
|
|
|
|
rv = mmap(file, vma);
|
|
|
|
|
|
|
|
pde_users_dec(pde);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int proc_reg_open(struct inode *inode, struct file *file)
|
|
|
|
{
|
|
|
|
struct proc_dir_entry *pde = PDE(inode);
|
|
|
|
int rv = 0;
|
|
|
|
int (*open)(struct inode *, struct file *);
|
2008-07-25 08:48:29 +00:00
|
|
|
int (*release)(struct inode *, struct file *);
|
|
|
|
struct pde_opener *pdeo;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* What for, you ask? Well, we can have open, rmmod, remove_proc_entry
|
|
|
|
* sequence. ->release won't be called because ->proc_fops will be
|
|
|
|
* cleared. Depending on complexity of ->release, consequences vary.
|
|
|
|
*
|
|
|
|
* We can't wait for mercy when close will be done for real, it's
|
|
|
|
* deadlockable: rmmod foo </proc/foo . So, we're going to do ->release
|
|
|
|
* by hand in remove_proc_entry(). For this, save opener's credentials
|
|
|
|
* for later.
|
|
|
|
*/
|
|
|
|
pdeo = kmalloc(sizeof(struct pde_opener), GFP_KERNEL);
|
|
|
|
if (!pdeo)
|
|
|
|
return -ENOMEM;
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
|
|
|
|
spin_lock(&pde->pde_unload_lock);
|
|
|
|
if (!pde->proc_fops) {
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
2008-07-25 08:48:29 +00:00
|
|
|
kfree(pdeo);
|
2008-10-02 20:18:52 +00:00
|
|
|
return -EINVAL;
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
}
|
|
|
|
pde->pde_users++;
|
|
|
|
open = pde->proc_fops->open;
|
2008-07-25 08:48:29 +00:00
|
|
|
release = pde->proc_fops->release;
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
|
|
|
|
if (open)
|
|
|
|
rv = open(inode, file);
|
|
|
|
|
2008-07-25 08:48:29 +00:00
|
|
|
spin_lock(&pde->pde_unload_lock);
|
|
|
|
if (rv == 0 && release) {
|
|
|
|
/* To know what to release. */
|
|
|
|
pdeo->inode = inode;
|
|
|
|
pdeo->file = file;
|
|
|
|
/* Strictly for "too late" ->release in proc_reg_release(). */
|
|
|
|
pdeo->release = release;
|
|
|
|
list_add(&pdeo->lh, &pde->pde_openers);
|
|
|
|
} else
|
|
|
|
kfree(pdeo);
|
|
|
|
__pde_users_dec(pde);
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
2008-07-25 08:48:29 +00:00
|
|
|
static struct pde_opener *find_pde_opener(struct proc_dir_entry *pde,
|
|
|
|
struct inode *inode, struct file *file)
|
|
|
|
{
|
|
|
|
struct pde_opener *pdeo;
|
|
|
|
|
|
|
|
list_for_each_entry(pdeo, &pde->pde_openers, lh) {
|
|
|
|
if (pdeo->inode == inode && pdeo->file == file)
|
|
|
|
return pdeo;
|
|
|
|
}
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
static int proc_reg_release(struct inode *inode, struct file *file)
|
|
|
|
{
|
|
|
|
struct proc_dir_entry *pde = PDE(inode);
|
|
|
|
int rv = 0;
|
|
|
|
int (*release)(struct inode *, struct file *);
|
2008-07-25 08:48:29 +00:00
|
|
|
struct pde_opener *pdeo;
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
|
|
|
|
spin_lock(&pde->pde_unload_lock);
|
2008-07-25 08:48:29 +00:00
|
|
|
pdeo = find_pde_opener(pde, inode, file);
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
if (!pde->proc_fops) {
|
2008-07-25 08:48:29 +00:00
|
|
|
/*
|
|
|
|
* Can't simply exit, __fput() will think that everything is OK,
|
|
|
|
* and move on to freeing struct file. remove_proc_entry() will
|
|
|
|
* find slacker in opener's list and will try to do non-trivial
|
|
|
|
* things with struct file. Therefore, remove opener from list.
|
|
|
|
*
|
|
|
|
* But if opener is removed from list, who will ->release it?
|
|
|
|
*/
|
|
|
|
if (pdeo) {
|
|
|
|
list_del(&pdeo->lh);
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
rv = pdeo->release(inode, file);
|
|
|
|
kfree(pdeo);
|
|
|
|
} else
|
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
pde->pde_users++;
|
|
|
|
release = pde->proc_fops->release;
|
2008-07-25 08:48:29 +00:00
|
|
|
if (pdeo) {
|
|
|
|
list_del(&pdeo->lh);
|
|
|
|
kfree(pdeo);
|
|
|
|
}
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
|
|
|
|
|
|
if (release)
|
|
|
|
rv = release(inode, file);
|
|
|
|
|
|
|
|
pde_users_dec(pde);
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
|
|
|
static const struct file_operations proc_reg_file_ops = {
|
|
|
|
.llseek = proc_reg_llseek,
|
|
|
|
.read = proc_reg_read,
|
|
|
|
.write = proc_reg_write,
|
|
|
|
.poll = proc_reg_poll,
|
|
|
|
.unlocked_ioctl = proc_reg_unlocked_ioctl,
|
|
|
|
#ifdef CONFIG_COMPAT
|
|
|
|
.compat_ioctl = proc_reg_compat_ioctl,
|
|
|
|
#endif
|
|
|
|
.mmap = proc_reg_mmap,
|
|
|
|
.open = proc_reg_open,
|
|
|
|
.release = proc_reg_release,
|
|
|
|
};
|
|
|
|
|
2007-07-28 05:58:37 +00:00
|
|
|
#ifdef CONFIG_COMPAT
|
|
|
|
static const struct file_operations proc_reg_file_ops_no_compat = {
|
|
|
|
.llseek = proc_reg_llseek,
|
|
|
|
.read = proc_reg_read,
|
|
|
|
.write = proc_reg_write,
|
|
|
|
.poll = proc_reg_poll,
|
|
|
|
.unlocked_ioctl = proc_reg_unlocked_ioctl,
|
|
|
|
.mmap = proc_reg_mmap,
|
|
|
|
.open = proc_reg_open,
|
|
|
|
.release = proc_reg_release,
|
|
|
|
};
|
|
|
|
#endif
|
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
struct inode *proc_get_inode(struct super_block *sb, unsigned int ino,
|
|
|
|
struct proc_dir_entry *de)
|
|
|
|
{
|
|
|
|
struct inode * inode;
|
|
|
|
|
2008-04-29 08:01:41 +00:00
|
|
|
if (!try_module_get(de->owner))
|
2005-10-30 23:02:26 +00:00
|
|
|
goto out_mod;
|
|
|
|
|
2008-02-07 08:15:45 +00:00
|
|
|
inode = iget_locked(sb, ino);
|
2005-04-16 22:20:36 +00:00
|
|
|
if (!inode)
|
2005-10-30 23:02:26 +00:00
|
|
|
goto out_ino;
|
2008-02-07 08:15:45 +00:00
|
|
|
if (inode->i_state & I_NEW) {
|
|
|
|
inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
|
|
|
|
PROC_I(inode)->fd = 0;
|
|
|
|
PROC_I(inode)->pde = de;
|
2008-04-29 08:01:41 +00:00
|
|
|
|
|
|
|
if (de->mode) {
|
|
|
|
inode->i_mode = de->mode;
|
|
|
|
inode->i_uid = de->uid;
|
|
|
|
inode->i_gid = de->gid;
|
|
|
|
}
|
|
|
|
if (de->size)
|
|
|
|
inode->i_size = de->size;
|
|
|
|
if (de->nlink)
|
|
|
|
inode->i_nlink = de->nlink;
|
|
|
|
if (de->proc_iops)
|
|
|
|
inode->i_op = de->proc_iops;
|
|
|
|
if (de->proc_fops) {
|
|
|
|
if (S_ISREG(inode->i_mode)) {
|
2007-07-28 05:58:37 +00:00
|
|
|
#ifdef CONFIG_COMPAT
|
2008-04-29 08:01:41 +00:00
|
|
|
if (!de->proc_fops->compat_ioctl)
|
|
|
|
inode->i_fop =
|
|
|
|
&proc_reg_file_ops_no_compat;
|
|
|
|
else
|
2007-07-28 05:58:37 +00:00
|
|
|
#endif
|
2008-04-29 08:01:41 +00:00
|
|
|
inode->i_fop = &proc_reg_file_ops;
|
|
|
|
} else {
|
|
|
|
inode->i_fop = de->proc_fops;
|
2007-07-28 05:58:37 +00:00
|
|
|
}
|
Fix rmmod/read/write races in /proc entries
Fix following races:
===========================================
1. Write via ->write_proc sleeps in copy_from_user(). Module disappears
meanwhile. Or, more generically, system call done on /proc file, method
supplied by module is called, module dissapeares meanwhile.
pde = create_proc_entry()
if (!pde)
return -ENOMEM;
pde->write_proc = ...
open
write
copy_from_user
pde = create_proc_entry();
if (!pde) {
remove_proc_entry();
return -ENOMEM;
/* module unloaded */
}
*boom*
==========================================
2. bogo-revoke aka proc_kill_inodes()
remove_proc_entry vfs_read
proc_kill_inodes [check ->f_op validness]
[check ->f_op->read validness]
[verify_area, security permissions checks]
->f_op = NULL;
if (file->f_op->read)
/* ->f_op dereference, boom */
NOTE, NOTE, NOTE: file_operations are proxied for regular files only. Let's
see how this scheme behaves, then extend if needed for directories.
Directories creators in /proc only set ->owner for them, so proxying for
directories may be unneeded.
NOTE, NOTE, NOTE: methods being proxied are ->llseek, ->read, ->write,
->poll, ->unlocked_ioctl, ->ioctl, ->compat_ioctl, ->open, ->release.
If your in-tree module uses something else, yell on me. Full audit pending.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 06:39:00 +00:00
|
|
|
}
|
2008-02-07 08:15:45 +00:00
|
|
|
unlock_new_inode(inode);
|
2009-02-23 21:21:55 +00:00
|
|
|
} else {
|
2008-05-23 20:04:47 +00:00
|
|
|
module_put(de->owner);
|
2009-02-23 21:21:55 +00:00
|
|
|
de_put(de);
|
|
|
|
}
|
2005-04-16 22:20:36 +00:00
|
|
|
return inode;
|
|
|
|
|
2005-10-30 23:02:26 +00:00
|
|
|
out_ino:
|
2008-04-29 08:01:41 +00:00
|
|
|
module_put(de->owner);
|
2005-10-30 23:02:26 +00:00
|
|
|
out_mod:
|
|
|
|
return NULL;
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
2007-10-19 06:40:08 +00:00
|
|
|
int proc_fill_super(struct super_block *s)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
|
|
|
struct inode * root_inode;
|
|
|
|
|
2006-07-15 19:20:05 +00:00
|
|
|
s->s_flags |= MS_NODIRATIME | MS_NOSUID | MS_NOEXEC;
|
2005-04-16 22:20:36 +00:00
|
|
|
s->s_blocksize = 1024;
|
|
|
|
s->s_blocksize_bits = 10;
|
|
|
|
s->s_magic = PROC_SUPER_MAGIC;
|
|
|
|
s->s_op = &proc_sops;
|
|
|
|
s->s_time_gran = 1;
|
|
|
|
|
2007-05-08 07:25:45 +00:00
|
|
|
de_get(&proc_root);
|
2005-04-16 22:20:36 +00:00
|
|
|
root_inode = proc_get_inode(s, PROC_ROOT_INO, &proc_root);
|
|
|
|
if (!root_inode)
|
|
|
|
goto out_no_root;
|
|
|
|
root_inode->i_uid = 0;
|
|
|
|
root_inode->i_gid = 0;
|
|
|
|
s->s_root = d_alloc_root(root_inode);
|
|
|
|
if (!s->s_root)
|
|
|
|
goto out_no_root;
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
out_no_root:
|
|
|
|
printk("proc_read_super: get root inode failed\n");
|
|
|
|
iput(root_inode);
|
2007-05-08 07:25:45 +00:00
|
|
|
de_put(&proc_root);
|
2005-04-16 22:20:36 +00:00
|
|
|
return -ENOMEM;
|
|
|
|
}
|