2355 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2/*3 * Copyright (C) 2001, 2002 Sistina Software (UK) Limited.4 * Copyright (C) 2004 - 2006 Red Hat, Inc. All rights reserved.5 *6 * This file is released under the GPL.7 */8 9#include "dm-core.h"10#include "dm-ima.h"11#include <linux/module.h>12#include <linux/vmalloc.h>13#include <linux/miscdevice.h>14#include <linux/sched/mm.h>15#include <linux/init.h>16#include <linux/wait.h>17#include <linux/slab.h>18#include <linux/rbtree.h>19#include <linux/dm-ioctl.h>20#include <linux/hdreg.h>21#include <linux/compat.h>22#include <linux/nospec.h>23 24#include <linux/uaccess.h>25#include <linux/ima.h>26 27#define DM_MSG_PREFIX "ioctl"28#define DM_DRIVER_EMAIL "dm-devel@lists.linux.dev"29 30struct dm_file {31 /*32 * poll will wait until the global event number is greater than33 * this value.34 */35 volatile unsigned int global_event_nr;36};37 38/*39 *---------------------------------------------------------------40 * The ioctl interface needs to be able to look up devices by41 * name or uuid.42 *---------------------------------------------------------------43 */44struct hash_cell {45 struct rb_node name_node;46 struct rb_node uuid_node;47 bool name_set;48 bool uuid_set;49 50 char *name;51 char *uuid;52 struct mapped_device *md;53 struct dm_table *new_map;54};55 56struct vers_iter {57 size_t param_size;58 struct dm_target_versions *vers, *old_vers;59 char *end;60 uint32_t flags;61};62 63 64static struct rb_root name_rb_tree = RB_ROOT;65static struct rb_root uuid_rb_tree = RB_ROOT;66 67static void dm_hash_remove_all(bool keep_open_devices, bool mark_deferred, bool only_deferred);68 69/*70 * Guards access to both hash tables.71 */72static DECLARE_RWSEM(_hash_lock);73 74/*75 * Protects use of mdptr to obtain hash cell name and uuid from mapped device.76 */77static DEFINE_MUTEX(dm_hash_cells_mutex);78 79static void dm_hash_exit(void)80{81 dm_hash_remove_all(false, false, false);82}83 84/*85 *---------------------------------------------------------------86 * Code for looking up a device by name87 *---------------------------------------------------------------88 */89static struct hash_cell *__get_name_cell(const char *str)90{91 struct rb_node *n = name_rb_tree.rb_node;92 93 while (n) {94 struct hash_cell *hc = container_of(n, struct hash_cell, name_node);95 int c;96 97 c = strcmp(hc->name, str);98 if (!c) {99 dm_get(hc->md);100 return hc;101 }102 n = c >= 0 ? n->rb_left : n->rb_right;103 }104 105 return NULL;106}107 108static struct hash_cell *__get_uuid_cell(const char *str)109{110 struct rb_node *n = uuid_rb_tree.rb_node;111 112 while (n) {113 struct hash_cell *hc = container_of(n, struct hash_cell, uuid_node);114 int c;115 116 c = strcmp(hc->uuid, str);117 if (!c) {118 dm_get(hc->md);119 return hc;120 }121 n = c >= 0 ? n->rb_left : n->rb_right;122 }123 124 return NULL;125}126 127static void __unlink_name(struct hash_cell *hc)128{129 if (hc->name_set) {130 hc->name_set = false;131 rb_erase(&hc->name_node, &name_rb_tree);132 }133}134 135static void __unlink_uuid(struct hash_cell *hc)136{137 if (hc->uuid_set) {138 hc->uuid_set = false;139 rb_erase(&hc->uuid_node, &uuid_rb_tree);140 }141}142 143static void __link_name(struct hash_cell *new_hc)144{145 struct rb_node **n, *parent;146 147 __unlink_name(new_hc);148 149 new_hc->name_set = true;150 151 n = &name_rb_tree.rb_node;152 parent = NULL;153 154 while (*n) {155 struct hash_cell *hc = container_of(*n, struct hash_cell, name_node);156 int c;157 158 c = strcmp(hc->name, new_hc->name);159 BUG_ON(!c);160 parent = *n;161 n = c >= 0 ? &hc->name_node.rb_left : &hc->name_node.rb_right;162 }163 164 rb_link_node(&new_hc->name_node, parent, n);165 rb_insert_color(&new_hc->name_node, &name_rb_tree);166}167 168static void __link_uuid(struct hash_cell *new_hc)169{170 struct rb_node **n, *parent;171 172 __unlink_uuid(new_hc);173 174 new_hc->uuid_set = true;175 176 n = &uuid_rb_tree.rb_node;177 parent = NULL;178 179 while (*n) {180 struct hash_cell *hc = container_of(*n, struct hash_cell, uuid_node);181 int c;182 183 c = strcmp(hc->uuid, new_hc->uuid);184 BUG_ON(!c);185 parent = *n;186 n = c > 0 ? &hc->uuid_node.rb_left : &hc->uuid_node.rb_right;187 }188 189 rb_link_node(&new_hc->uuid_node, parent, n);190 rb_insert_color(&new_hc->uuid_node, &uuid_rb_tree);191}192 193static struct hash_cell *__get_dev_cell(uint64_t dev)194{195 struct mapped_device *md;196 struct hash_cell *hc;197 198 md = dm_get_md(huge_decode_dev(dev));199 if (!md)200 return NULL;201 202 hc = dm_get_mdptr(md);203 if (!hc) {204 dm_put(md);205 return NULL;206 }207 208 return hc;209}210 211/*212 *---------------------------------------------------------------213 * Inserting, removing and renaming a device.214 *---------------------------------------------------------------215 */216static struct hash_cell *alloc_cell(const char *name, const char *uuid,217 struct mapped_device *md)218{219 struct hash_cell *hc;220 221 hc = kmalloc(sizeof(*hc), GFP_KERNEL);222 if (!hc)223 return NULL;224 225 hc->name = kstrdup(name, GFP_KERNEL);226 if (!hc->name) {227 kfree(hc);228 return NULL;229 }230 231 if (!uuid)232 hc->uuid = NULL;233 234 else {235 hc->uuid = kstrdup(uuid, GFP_KERNEL);236 if (!hc->uuid) {237 kfree(hc->name);238 kfree(hc);239 return NULL;240 }241 }242 243 hc->name_set = hc->uuid_set = false;244 hc->md = md;245 hc->new_map = NULL;246 return hc;247}248 249static void free_cell(struct hash_cell *hc)250{251 if (hc) {252 kfree(hc->name);253 kfree(hc->uuid);254 kfree(hc);255 }256}257 258/*259 * The kdev_t and uuid of a device can never change once it is260 * initially inserted.261 */262static int dm_hash_insert(const char *name, const char *uuid, struct mapped_device *md)263{264 struct hash_cell *cell, *hc;265 266 /*267 * Allocate the new cells.268 */269 cell = alloc_cell(name, uuid, md);270 if (!cell)271 return -ENOMEM;272 273 /*274 * Insert the cell into both hash tables.275 */276 down_write(&_hash_lock);277 hc = __get_name_cell(name);278 if (hc) {279 dm_put(hc->md);280 goto bad;281 }282 283 __link_name(cell);284 285 if (uuid) {286 hc = __get_uuid_cell(uuid);287 if (hc) {288 __unlink_name(cell);289 dm_put(hc->md);290 goto bad;291 }292 __link_uuid(cell);293 }294 dm_get(md);295 mutex_lock(&dm_hash_cells_mutex);296 dm_set_mdptr(md, cell);297 mutex_unlock(&dm_hash_cells_mutex);298 up_write(&_hash_lock);299 300 return 0;301 302 bad:303 up_write(&_hash_lock);304 free_cell(cell);305 return -EBUSY;306}307 308static struct dm_table *__hash_remove(struct hash_cell *hc)309{310 struct dm_table *table;311 int srcu_idx;312 313 lockdep_assert_held(&_hash_lock);314 315 /* remove from the dev trees */316 __unlink_name(hc);317 __unlink_uuid(hc);318 mutex_lock(&dm_hash_cells_mutex);319 dm_set_mdptr(hc->md, NULL);320 mutex_unlock(&dm_hash_cells_mutex);321 322 table = dm_get_live_table(hc->md, &srcu_idx);323 if (table)324 dm_table_event(table);325 dm_put_live_table(hc->md, srcu_idx);326 327 table = NULL;328 if (hc->new_map)329 table = hc->new_map;330 dm_put(hc->md);331 free_cell(hc);332 333 return table;334}335 336static void dm_hash_remove_all(bool keep_open_devices, bool mark_deferred, bool only_deferred)337{338 int dev_skipped;339 struct rb_node *n;340 struct hash_cell *hc;341 struct mapped_device *md;342 struct dm_table *t;343 344retry:345 dev_skipped = 0;346 347 down_write(&_hash_lock);348 349 for (n = rb_first(&name_rb_tree); n; n = rb_next(n)) {350 hc = container_of(n, struct hash_cell, name_node);351 md = hc->md;352 dm_get(md);353 354 if (keep_open_devices &&355 dm_lock_for_deletion(md, mark_deferred, only_deferred)) {356 dm_put(md);357 dev_skipped++;358 continue;359 }360 361 t = __hash_remove(hc);362 363 up_write(&_hash_lock);364 365 if (t) {366 dm_sync_table(md);367 dm_table_destroy(t);368 }369 dm_ima_measure_on_device_remove(md, true);370 dm_put(md);371 if (likely(keep_open_devices))372 dm_destroy(md);373 else374 dm_destroy_immediate(md);375 376 /*377 * Some mapped devices may be using other mapped378 * devices, so repeat until we make no further379 * progress. If a new mapped device is created380 * here it will also get removed.381 */382 goto retry;383 }384 385 up_write(&_hash_lock);386 387 if (dev_skipped)388 DMWARN("remove_all left %d open device(s)", dev_skipped);389}390 391/*392 * Set the uuid of a hash_cell that isn't already set.393 */394static void __set_cell_uuid(struct hash_cell *hc, char *new_uuid)395{396 mutex_lock(&dm_hash_cells_mutex);397 hc->uuid = new_uuid;398 mutex_unlock(&dm_hash_cells_mutex);399 400 __link_uuid(hc);401}402 403/*404 * Changes the name of a hash_cell and returns the old name for405 * the caller to free.406 */407static char *__change_cell_name(struct hash_cell *hc, char *new_name)408{409 char *old_name;410 411 /*412 * Rename and move the name cell.413 */414 __unlink_name(hc);415 old_name = hc->name;416 417 mutex_lock(&dm_hash_cells_mutex);418 hc->name = new_name;419 mutex_unlock(&dm_hash_cells_mutex);420 421 __link_name(hc);422 423 return old_name;424}425 426static struct mapped_device *dm_hash_rename(struct dm_ioctl *param,427 const char *new)428{429 char *new_data, *old_name = NULL;430 struct hash_cell *hc;431 struct dm_table *table;432 struct mapped_device *md;433 unsigned int change_uuid = (param->flags & DM_UUID_FLAG) ? 1 : 0;434 int srcu_idx;435 436 /*437 * duplicate new.438 */439 new_data = kstrdup(new, GFP_KERNEL);440 if (!new_data)441 return ERR_PTR(-ENOMEM);442 443 down_write(&_hash_lock);444 445 /*446 * Is new free ?447 */448 if (change_uuid)449 hc = __get_uuid_cell(new);450 else451 hc = __get_name_cell(new);452 453 if (hc) {454 DMERR("Unable to change %s on mapped device %s to one that already exists: %s",455 change_uuid ? "uuid" : "name",456 param->name, new);457 dm_put(hc->md);458 up_write(&_hash_lock);459 kfree(new_data);460 return ERR_PTR(-EBUSY);461 }462 463 /*464 * Is there such a device as 'old' ?465 */466 hc = __get_name_cell(param->name);467 if (!hc) {468 DMERR("Unable to rename non-existent device, %s to %s%s",469 param->name, change_uuid ? "uuid " : "", new);470 up_write(&_hash_lock);471 kfree(new_data);472 return ERR_PTR(-ENXIO);473 }474 475 /*476 * Does this device already have a uuid?477 */478 if (change_uuid && hc->uuid) {479 DMERR("Unable to change uuid of mapped device %s to %s "480 "because uuid is already set to %s",481 param->name, new, hc->uuid);482 dm_put(hc->md);483 up_write(&_hash_lock);484 kfree(new_data);485 return ERR_PTR(-EINVAL);486 }487 488 if (change_uuid)489 __set_cell_uuid(hc, new_data);490 else491 old_name = __change_cell_name(hc, new_data);492 493 /*494 * Wake up any dm event waiters.495 */496 table = dm_get_live_table(hc->md, &srcu_idx);497 if (table)498 dm_table_event(table);499 dm_put_live_table(hc->md, srcu_idx);500 501 if (!dm_kobject_uevent(hc->md, KOBJ_CHANGE, param->event_nr, false))502 param->flags |= DM_UEVENT_GENERATED_FLAG;503 504 md = hc->md;505 506 dm_ima_measure_on_device_rename(md);507 508 up_write(&_hash_lock);509 kfree(old_name);510 511 return md;512}513 514void dm_deferred_remove(void)515{516 dm_hash_remove_all(true, false, true);517}518 519/*520 *---------------------------------------------------------------521 * Implementation of the ioctl commands522 *---------------------------------------------------------------523 */524/*525 * All the ioctl commands get dispatched to functions with this526 * prototype.527 */528typedef int (*ioctl_fn)(struct file *filp, struct dm_ioctl *param, size_t param_size);529 530static int remove_all(struct file *filp, struct dm_ioctl *param, size_t param_size)531{532 dm_hash_remove_all(true, !!(param->flags & DM_DEFERRED_REMOVE), false);533 param->data_size = 0;534 return 0;535}536 537/*538 * Round up the ptr to an 8-byte boundary.539 */540#define ALIGN_MASK 7541static inline size_t align_val(size_t val)542{543 return (val + ALIGN_MASK) & ~ALIGN_MASK;544}545static inline void *align_ptr(void *ptr)546{547 return (void *)align_val((size_t)ptr);548}549 550/*551 * Retrieves the data payload buffer from an already allocated552 * struct dm_ioctl.553 */554static void *get_result_buffer(struct dm_ioctl *param, size_t param_size,555 size_t *len)556{557 param->data_start = align_ptr(param + 1) - (void *) param;558 559 if (param->data_start < param_size)560 *len = param_size - param->data_start;561 else562 *len = 0;563 564 return ((void *) param) + param->data_start;565}566 567static bool filter_device(struct hash_cell *hc, const char *pfx_name, const char *pfx_uuid)568{569 const char *val;570 size_t val_len, pfx_len;571 572 val = hc->name;573 val_len = strlen(val);574 pfx_len = strnlen(pfx_name, DM_NAME_LEN);575 if (pfx_len > val_len)576 return false;577 if (memcmp(val, pfx_name, pfx_len))578 return false;579 580 val = hc->uuid ? hc->uuid : "";581 val_len = strlen(val);582 pfx_len = strnlen(pfx_uuid, DM_UUID_LEN);583 if (pfx_len > val_len)584 return false;585 if (memcmp(val, pfx_uuid, pfx_len))586 return false;587 588 return true;589}590 591static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_size)592{593 struct rb_node *n;594 struct hash_cell *hc;595 size_t len, needed = 0;596 struct gendisk *disk;597 struct dm_name_list *orig_nl, *nl, *old_nl = NULL;598 uint32_t *event_nr;599 600 down_write(&_hash_lock);601 602 /*603 * Loop through all the devices working out how much604 * space we need.605 */606 for (n = rb_first(&name_rb_tree); n; n = rb_next(n)) {607 hc = container_of(n, struct hash_cell, name_node);608 if (!filter_device(hc, param->name, param->uuid))609 continue;610 needed += align_val(offsetof(struct dm_name_list, name) + strlen(hc->name) + 1);611 needed += align_val(sizeof(uint32_t) * 2);612 if (param->flags & DM_UUID_FLAG && hc->uuid)613 needed += align_val(strlen(hc->uuid) + 1);614 }615 616 /*617 * Grab our output buffer.618 */619 nl = orig_nl = get_result_buffer(param, param_size, &len);620 if (len < needed || len < sizeof(nl->dev)) {621 param->flags |= DM_BUFFER_FULL_FLAG;622 goto out;623 }624 param->data_size = param->data_start + needed;625 626 nl->dev = 0; /* Flags no data */627 628 /*629 * Now loop through filling out the names.630 */631 for (n = rb_first(&name_rb_tree); n; n = rb_next(n)) {632 void *uuid_ptr;633 634 hc = container_of(n, struct hash_cell, name_node);635 if (!filter_device(hc, param->name, param->uuid))636 continue;637 if (old_nl)638 old_nl->next = (uint32_t) ((void *) nl -639 (void *) old_nl);640 disk = dm_disk(hc->md);641 nl->dev = huge_encode_dev(disk_devt(disk));642 nl->next = 0;643 strcpy(nl->name, hc->name);644 645 old_nl = nl;646 event_nr = align_ptr(nl->name + strlen(hc->name) + 1);647 event_nr[0] = dm_get_event_nr(hc->md);648 event_nr[1] = 0;649 uuid_ptr = align_ptr(event_nr + 2);650 if (param->flags & DM_UUID_FLAG) {651 if (hc->uuid) {652 event_nr[1] |= DM_NAME_LIST_FLAG_HAS_UUID;653 strcpy(uuid_ptr, hc->uuid);654 uuid_ptr = align_ptr(uuid_ptr + strlen(hc->uuid) + 1);655 } else {656 event_nr[1] |= DM_NAME_LIST_FLAG_DOESNT_HAVE_UUID;657 }658 }659 nl = uuid_ptr;660 }661 /*662 * If mismatch happens, security may be compromised due to buffer663 * overflow, so it's better to crash.664 */665 BUG_ON((char *)nl - (char *)orig_nl != needed);666 667 out:668 up_write(&_hash_lock);669 return 0;670}671 672static void list_version_get_needed(struct target_type *tt, void *needed_param)673{674 size_t *needed = needed_param;675 676 *needed += sizeof(struct dm_target_versions);677 *needed += strlen(tt->name) + 1;678 *needed += ALIGN_MASK;679}680 681static void list_version_get_info(struct target_type *tt, void *param)682{683 struct vers_iter *info = param;684 685 /* Check space - it might have changed since the first iteration */686 if ((char *)info->vers + sizeof(tt->version) + strlen(tt->name) + 1 > info->end) {687 info->flags = DM_BUFFER_FULL_FLAG;688 return;689 }690 691 if (info->old_vers)692 info->old_vers->next = (uint32_t) ((void *)info->vers - (void *)info->old_vers);693 694 info->vers->version[0] = tt->version[0];695 info->vers->version[1] = tt->version[1];696 info->vers->version[2] = tt->version[2];697 info->vers->next = 0;698 strcpy(info->vers->name, tt->name);699 700 info->old_vers = info->vers;701 info->vers = align_ptr((void *)(info->vers + 1) + strlen(tt->name) + 1);702}703 704static int __list_versions(struct dm_ioctl *param, size_t param_size, const char *name)705{706 size_t len, needed = 0;707 struct dm_target_versions *vers;708 struct vers_iter iter_info;709 struct target_type *tt = NULL;710 711 if (name) {712 tt = dm_get_target_type(name);713 if (!tt)714 return -EINVAL;715 }716 717 /*718 * Loop through all the devices working out how much719 * space we need.720 */721 if (!tt)722 dm_target_iterate(list_version_get_needed, &needed);723 else724 list_version_get_needed(tt, &needed);725 726 /*727 * Grab our output buffer.728 */729 vers = get_result_buffer(param, param_size, &len);730 if (len < needed) {731 param->flags |= DM_BUFFER_FULL_FLAG;732 goto out;733 }734 param->data_size = param->data_start + needed;735 736 iter_info.param_size = param_size;737 iter_info.old_vers = NULL;738 iter_info.vers = vers;739 iter_info.flags = 0;740 iter_info.end = (char *)vers + needed;741 742 /*743 * Now loop through filling out the names & versions.744 */745 if (!tt)746 dm_target_iterate(list_version_get_info, &iter_info);747 else748 list_version_get_info(tt, &iter_info);749 param->flags |= iter_info.flags;750 751 out:752 if (tt)753 dm_put_target_type(tt);754 return 0;755}756 757static int list_versions(struct file *filp, struct dm_ioctl *param, size_t param_size)758{759 return __list_versions(param, param_size, NULL);760}761 762static int get_target_version(struct file *filp, struct dm_ioctl *param, size_t param_size)763{764 return __list_versions(param, param_size, param->name);765}766 767static int check_name(const char *name)768{769 if (strchr(name, '/')) {770 DMERR("device name cannot contain '/'");771 return -EINVAL;772 }773 774 if (strcmp(name, DM_CONTROL_NODE) == 0 ||775 strcmp(name, ".") == 0 ||776 strcmp(name, "..") == 0) {777 DMERR("device name cannot be \"%s\", \".\", or \"..\"", DM_CONTROL_NODE);778 return -EINVAL;779 }780 781 return 0;782}783 784/*785 * On successful return, the caller must not attempt to acquire786 * _hash_lock without first calling dm_put_live_table, because dm_table_destroy787 * waits for this dm_put_live_table and could be called under this lock.788 */789static struct dm_table *dm_get_inactive_table(struct mapped_device *md, int *srcu_idx)790{791 struct hash_cell *hc;792 struct dm_table *table = NULL;793 794 /* increment rcu count, we don't care about the table pointer */795 dm_get_live_table(md, srcu_idx);796 797 down_read(&_hash_lock);798 hc = dm_get_mdptr(md);799 if (!hc) {800 DMERR("device has been removed from the dev hash table.");801 goto out;802 }803 804 table = hc->new_map;805 806out:807 up_read(&_hash_lock);808 809 return table;810}811 812static struct dm_table *dm_get_live_or_inactive_table(struct mapped_device *md,813 struct dm_ioctl *param,814 int *srcu_idx)815{816 return (param->flags & DM_QUERY_INACTIVE_TABLE_FLAG) ?817 dm_get_inactive_table(md, srcu_idx) : dm_get_live_table(md, srcu_idx);818}819 820/*821 * Fills in a dm_ioctl structure, ready for sending back to822 * userland.823 */824static void __dev_status(struct mapped_device *md, struct dm_ioctl *param)825{826 struct gendisk *disk = dm_disk(md);827 struct dm_table *table;828 int srcu_idx;829 830 param->flags &= ~(DM_SUSPEND_FLAG | DM_READONLY_FLAG |831 DM_ACTIVE_PRESENT_FLAG | DM_INTERNAL_SUSPEND_FLAG);832 833 if (dm_suspended_md(md))834 param->flags |= DM_SUSPEND_FLAG;835 836 if (dm_suspended_internally_md(md))837 param->flags |= DM_INTERNAL_SUSPEND_FLAG;838 839 if (dm_test_deferred_remove_flag(md))840 param->flags |= DM_DEFERRED_REMOVE;841 842 param->dev = huge_encode_dev(disk_devt(disk));843 844 /*845 * Yes, this will be out of date by the time it gets back846 * to userland, but it is still very useful for847 * debugging.848 */849 param->open_count = dm_open_count(md);850 851 param->event_nr = dm_get_event_nr(md);852 param->target_count = 0;853 854 table = dm_get_live_table(md, &srcu_idx);855 if (table) {856 if (!(param->flags & DM_QUERY_INACTIVE_TABLE_FLAG)) {857 if (get_disk_ro(disk))858 param->flags |= DM_READONLY_FLAG;859 param->target_count = table->num_targets;860 }861 862 param->flags |= DM_ACTIVE_PRESENT_FLAG;863 }864 dm_put_live_table(md, srcu_idx);865 866 if (param->flags & DM_QUERY_INACTIVE_TABLE_FLAG) {867 int srcu_idx;868 869 table = dm_get_inactive_table(md, &srcu_idx);870 if (table) {871 if (!(dm_table_get_mode(table) & BLK_OPEN_WRITE))872 param->flags |= DM_READONLY_FLAG;873 param->target_count = table->num_targets;874 }875 dm_put_live_table(md, srcu_idx);876 }877}878 879static int dev_create(struct file *filp, struct dm_ioctl *param, size_t param_size)880{881 int r, m = DM_ANY_MINOR;882 struct mapped_device *md;883 884 r = check_name(param->name);885 if (r)886 return r;887 888 if (param->flags & DM_PERSISTENT_DEV_FLAG)889 m = MINOR(huge_decode_dev(param->dev));890 891 r = dm_create(m, &md);892 if (r)893 return r;894 895 r = dm_hash_insert(param->name, *param->uuid ? param->uuid : NULL, md);896 if (r) {897 dm_put(md);898 dm_destroy(md);899 return r;900 }901 902 param->flags &= ~DM_INACTIVE_PRESENT_FLAG;903 904 __dev_status(md, param);905 906 dm_put(md);907 908 return 0;909}910 911/*912 * Always use UUID for lookups if it's present, otherwise use name or dev.913 */914static struct hash_cell *__find_device_hash_cell(struct dm_ioctl *param)915{916 struct hash_cell *hc = NULL;917 918 if (*param->uuid) {919 if (*param->name || param->dev) {920 DMERR("Invalid ioctl structure: uuid %s, name %s, dev %llx",921 param->uuid, param->name, (unsigned long long)param->dev);922 return NULL;923 }924 925 hc = __get_uuid_cell(param->uuid);926 if (!hc)927 return NULL;928 } else if (*param->name) {929 if (param->dev) {930 DMERR("Invalid ioctl structure: name %s, dev %llx",931 param->name, (unsigned long long)param->dev);932 return NULL;933 }934 935 hc = __get_name_cell(param->name);936 if (!hc)937 return NULL;938 } else if (param->dev) {939 hc = __get_dev_cell(param->dev);940 if (!hc)941 return NULL;942 } else943 return NULL;944 945 /*946 * Sneakily write in both the name and the uuid947 * while we have the cell.948 */949 strscpy(param->name, hc->name, sizeof(param->name));950 if (hc->uuid)951 strscpy(param->uuid, hc->uuid, sizeof(param->uuid));952 else953 param->uuid[0] = '\0';954 955 if (hc->new_map)956 param->flags |= DM_INACTIVE_PRESENT_FLAG;957 else958 param->flags &= ~DM_INACTIVE_PRESENT_FLAG;959 960 return hc;961}962 963static struct mapped_device *find_device(struct dm_ioctl *param)964{965 struct hash_cell *hc;966 struct mapped_device *md = NULL;967 968 down_read(&_hash_lock);969 hc = __find_device_hash_cell(param);970 if (hc)971 md = hc->md;972 up_read(&_hash_lock);973 974 return md;975}976 977static int dev_remove(struct file *filp, struct dm_ioctl *param, size_t param_size)978{979 struct hash_cell *hc;980 struct mapped_device *md;981 int r;982 struct dm_table *t;983 984 down_write(&_hash_lock);985 hc = __find_device_hash_cell(param);986 987 if (!hc) {988 DMDEBUG_LIMIT("device doesn't appear to be in the dev hash table.");989 up_write(&_hash_lock);990 return -ENXIO;991 }992 993 md = hc->md;994 995 /*996 * Ensure the device is not open and nothing further can open it.997 */998 r = dm_lock_for_deletion(md, !!(param->flags & DM_DEFERRED_REMOVE), false);999 if (r) {1000 if (r == -EBUSY && param->flags & DM_DEFERRED_REMOVE) {1001 up_write(&_hash_lock);1002 dm_put(md);1003 return 0;1004 }1005 DMDEBUG_LIMIT("unable to remove open device %s", hc->name);1006 up_write(&_hash_lock);1007 dm_put(md);1008 return r;1009 }1010 1011 t = __hash_remove(hc);1012 up_write(&_hash_lock);1013 1014 if (t) {1015 dm_sync_table(md);1016 dm_table_destroy(t);1017 }1018 1019 param->flags &= ~DM_DEFERRED_REMOVE;1020 1021 dm_ima_measure_on_device_remove(md, false);1022 1023 if (!dm_kobject_uevent(md, KOBJ_REMOVE, param->event_nr, false))1024 param->flags |= DM_UEVENT_GENERATED_FLAG;1025 1026 dm_put(md);1027 dm_destroy(md);1028 return 0;1029}1030 1031/*1032 * Check a string doesn't overrun the chunk of1033 * memory we copied from userland.1034 */1035static int invalid_str(char *str, void *end)1036{1037 while ((void *) str < end)1038 if (!*str++)1039 return 0;1040 1041 return -EINVAL;1042}1043 1044static int dev_rename(struct file *filp, struct dm_ioctl *param, size_t param_size)1045{1046 int r;1047 char *new_data = (char *) param + param->data_start;1048 struct mapped_device *md;1049 unsigned int change_uuid = (param->flags & DM_UUID_FLAG) ? 1 : 0;1050 1051 if (new_data < param->data ||1052 invalid_str(new_data, (void *) param + param_size) || !*new_data ||1053 strlen(new_data) > (change_uuid ? DM_UUID_LEN - 1 : DM_NAME_LEN - 1)) {1054 DMERR("Invalid new mapped device name or uuid string supplied.");1055 return -EINVAL;1056 }1057 1058 if (!change_uuid) {1059 r = check_name(new_data);1060 if (r)1061 return r;1062 }1063 1064 md = dm_hash_rename(param, new_data);1065 if (IS_ERR(md))1066 return PTR_ERR(md);1067 1068 __dev_status(md, param);1069 dm_put(md);1070 1071 return 0;1072}1073 1074static int dev_set_geometry(struct file *filp, struct dm_ioctl *param, size_t param_size)1075{1076 int r = -EINVAL, x;1077 struct mapped_device *md;1078 struct hd_geometry geometry;1079 unsigned long indata[4];1080 char *geostr = (char *) param + param->data_start;1081 char dummy;1082 1083 md = find_device(param);1084 if (!md)1085 return -ENXIO;1086 1087 if (geostr < param->data ||1088 invalid_str(geostr, (void *) param + param_size)) {1089 DMERR("Invalid geometry supplied.");1090 goto out;1091 }1092 1093 x = sscanf(geostr, "%lu %lu %lu %lu%c", indata,1094 indata + 1, indata + 2, indata + 3, &dummy);1095 1096 if (x != 4) {1097 DMERR("Unable to interpret geometry settings.");1098 goto out;1099 }1100 1101 if (indata[0] > 65535 || indata[1] > 255 || indata[2] > 255) {1102 DMERR("Geometry exceeds range limits.");1103 goto out;1104 }1105 1106 geometry.cylinders = indata[0];1107 geometry.heads = indata[1];1108 geometry.sectors = indata[2];1109 geometry.start = indata[3];1110 1111 r = dm_set_geometry(md, &geometry);1112 1113 param->data_size = 0;1114 1115out:1116 dm_put(md);1117 return r;1118}1119 1120static int do_suspend(struct dm_ioctl *param)1121{1122 int r = 0;1123 unsigned int suspend_flags = DM_SUSPEND_LOCKFS_FLAG;1124 struct mapped_device *md;1125 1126 md = find_device(param);1127 if (!md)1128 return -ENXIO;1129 1130 if (param->flags & DM_SKIP_LOCKFS_FLAG)1131 suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG;1132 if (param->flags & DM_NOFLUSH_FLAG)1133 suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;1134 1135 if (!dm_suspended_md(md)) {1136 r = dm_suspend(md, suspend_flags);1137 if (r)1138 goto out;1139 }1140 1141 __dev_status(md, param);1142 1143out:1144 dm_put(md);1145 1146 return r;1147}1148 1149static int do_resume(struct dm_ioctl *param)1150{1151 int r = 0;1152 unsigned int suspend_flags = DM_SUSPEND_LOCKFS_FLAG;1153 struct hash_cell *hc;1154 struct mapped_device *md;1155 struct dm_table *new_map, *old_map = NULL;1156 bool need_resize_uevent = false;1157 1158 down_write(&_hash_lock);1159 1160 hc = __find_device_hash_cell(param);1161 if (!hc) {1162 DMDEBUG_LIMIT("device doesn't appear to be in the dev hash table.");1163 up_write(&_hash_lock);1164 return -ENXIO;1165 }1166 1167 md = hc->md;1168 1169 new_map = hc->new_map;1170 hc->new_map = NULL;1171 param->flags &= ~DM_INACTIVE_PRESENT_FLAG;1172 1173 up_write(&_hash_lock);1174 1175 /* Do we need to load a new map ? */1176 if (new_map) {1177 sector_t old_size, new_size;1178 1179 /* Suspend if it isn't already suspended */1180 if (param->flags & DM_SKIP_LOCKFS_FLAG)1181 suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG;1182 if (param->flags & DM_NOFLUSH_FLAG)1183 suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;1184 if (!dm_suspended_md(md)) {1185 r = dm_suspend(md, suspend_flags);1186 if (r) {1187 down_write(&_hash_lock);1188 hc = dm_get_mdptr(md);1189 if (hc && !hc->new_map) {1190 hc->new_map = new_map;1191 new_map = NULL;1192 } else {1193 r = -ENXIO;1194 }1195 up_write(&_hash_lock);1196 if (new_map) {1197 dm_sync_table(md);1198 dm_table_destroy(new_map);1199 }1200 dm_put(md);1201 return r;1202 }1203 }1204 1205 old_size = dm_get_size(md);1206 old_map = dm_swap_table(md, new_map);1207 if (IS_ERR(old_map)) {1208 dm_sync_table(md);1209 dm_table_destroy(new_map);1210 dm_put(md);1211 return PTR_ERR(old_map);1212 }1213 new_size = dm_get_size(md);1214 if (old_size && new_size && old_size != new_size)1215 need_resize_uevent = true;1216 1217 if (dm_table_get_mode(new_map) & BLK_OPEN_WRITE)1218 set_disk_ro(dm_disk(md), 0);1219 else1220 set_disk_ro(dm_disk(md), 1);1221 }1222 1223 if (dm_suspended_md(md)) {1224 r = dm_resume(md);1225 if (!r) {1226 dm_ima_measure_on_device_resume(md, new_map ? true : false);1227 1228 if (!dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr, need_resize_uevent))1229 param->flags |= DM_UEVENT_GENERATED_FLAG;1230 }1231 }1232 1233 /*1234 * Since dm_swap_table synchronizes RCU, nobody should be in1235 * read-side critical section already.1236 */1237 if (old_map)1238 dm_table_destroy(old_map);1239 1240 if (!r)1241 __dev_status(md, param);1242 1243 dm_put(md);1244 return r;1245}1246 1247/*1248 * Set or unset the suspension state of a device.1249 * If the device already is in the requested state we just return its status.1250 */1251static int dev_suspend(struct file *filp, struct dm_ioctl *param, size_t param_size)1252{1253 if (param->flags & DM_SUSPEND_FLAG)1254 return do_suspend(param);1255 1256 return do_resume(param);1257}1258 1259/*1260 * Copies device info back to user space, used by1261 * the create and info ioctls.1262 */1263static int dev_status(struct file *filp, struct dm_ioctl *param, size_t param_size)1264{1265 struct mapped_device *md;1266 1267 md = find_device(param);1268 if (!md)1269 return -ENXIO;1270 1271 __dev_status(md, param);1272 dm_put(md);1273 1274 return 0;1275}1276 1277/*1278 * Build up the status struct for each target1279 */1280static void retrieve_status(struct dm_table *table,1281 struct dm_ioctl *param, size_t param_size)1282{1283 unsigned int i, num_targets;1284 struct dm_target_spec *spec;1285 char *outbuf, *outptr;1286 status_type_t type;1287 size_t remaining, len, used = 0;1288 unsigned int status_flags = 0;1289 1290 outptr = outbuf = get_result_buffer(param, param_size, &len);1291 1292 if (param->flags & DM_STATUS_TABLE_FLAG)1293 type = STATUSTYPE_TABLE;1294 else if (param->flags & DM_IMA_MEASUREMENT_FLAG)1295 type = STATUSTYPE_IMA;1296 else1297 type = STATUSTYPE_INFO;1298 1299 /* Get all the target info */1300 num_targets = table->num_targets;1301 for (i = 0; i < num_targets; i++) {1302 struct dm_target *ti = dm_table_get_target(table, i);1303 size_t l;1304 1305 remaining = len - (outptr - outbuf);1306 if (remaining <= sizeof(struct dm_target_spec)) {1307 param->flags |= DM_BUFFER_FULL_FLAG;1308 break;1309 }1310 1311 spec = (struct dm_target_spec *) outptr;1312 1313 spec->status = 0;1314 spec->sector_start = ti->begin;1315 spec->length = ti->len;1316 strscpy_pad(spec->target_type, ti->type->name,1317 sizeof(spec->target_type));1318 1319 outptr += sizeof(struct dm_target_spec);1320 remaining = len - (outptr - outbuf);1321 if (remaining <= 0) {1322 param->flags |= DM_BUFFER_FULL_FLAG;1323 break;1324 }1325 1326 /* Get the status/table string from the target driver */1327 if (ti->type->status) {1328 if (param->flags & DM_NOFLUSH_FLAG)1329 status_flags |= DM_STATUS_NOFLUSH_FLAG;1330 ti->type->status(ti, type, status_flags, outptr, remaining);1331 } else1332 outptr[0] = '\0';1333 1334 l = strlen(outptr) + 1;1335 if (l == remaining) {1336 param->flags |= DM_BUFFER_FULL_FLAG;1337 break;1338 }1339 1340 outptr += l;1341 used = param->data_start + (outptr - outbuf);1342 1343 outptr = align_ptr(outptr);1344 spec->next = outptr - outbuf;1345 }1346 1347 if (used)1348 param->data_size = used;1349 1350 param->target_count = num_targets;1351}1352 1353/*1354 * Wait for a device to report an event1355 */1356static int dev_wait(struct file *filp, struct dm_ioctl *param, size_t param_size)1357{1358 int r = 0;1359 struct mapped_device *md;1360 struct dm_table *table;1361 int srcu_idx;1362 1363 md = find_device(param);1364 if (!md)1365 return -ENXIO;1366 1367 /*1368 * Wait for a notification event1369 */1370 if (dm_wait_event(md, param->event_nr)) {1371 r = -ERESTARTSYS;1372 goto out;1373 }1374 1375 /*1376 * The userland program is going to want to know what1377 * changed to trigger the event, so we may as well tell1378 * him and save an ioctl.1379 */1380 __dev_status(md, param);1381 1382 table = dm_get_live_or_inactive_table(md, param, &srcu_idx);1383 if (table)1384 retrieve_status(table, param, param_size);1385 dm_put_live_table(md, srcu_idx);1386 1387out:1388 dm_put(md);1389 1390 return r;1391}1392 1393/*1394 * Remember the global event number and make it possible to poll1395 * for further events.1396 */1397static int dev_arm_poll(struct file *filp, struct dm_ioctl *param, size_t param_size)1398{1399 struct dm_file *priv = filp->private_data;1400 1401 priv->global_event_nr = atomic_read(&dm_global_event_nr);1402 1403 return 0;1404}1405 1406static inline blk_mode_t get_mode(struct dm_ioctl *param)1407{1408 blk_mode_t mode = BLK_OPEN_READ | BLK_OPEN_WRITE;1409 1410 if (param->flags & DM_READONLY_FLAG)1411 mode = BLK_OPEN_READ;1412 1413 return mode;1414}1415 1416static int next_target(struct dm_target_spec *last, uint32_t next, const char *end,1417 struct dm_target_spec **spec, char **target_params)1418{1419 static_assert(__alignof__(struct dm_target_spec) <= 8,1420 "struct dm_target_spec must not require more than 8-byte alignment");1421 1422 /*1423 * Number of bytes remaining, starting with last. This is always1424 * sizeof(struct dm_target_spec) or more, as otherwise *last was1425 * out of bounds already.1426 */1427 size_t remaining = end - (char *)last;1428 1429 /*1430 * There must be room for both the next target spec and the1431 * NUL-terminator of the target itself.1432 */1433 if (remaining - sizeof(struct dm_target_spec) <= next) {1434 DMERR("Target spec extends beyond end of parameters");1435 return -EINVAL;1436 }1437 1438 if (next % __alignof__(struct dm_target_spec)) {1439 DMERR("Next dm_target_spec (offset %u) is not %zu-byte aligned",1440 next, __alignof__(struct dm_target_spec));1441 return -EINVAL;1442 }1443 1444 *spec = (struct dm_target_spec *) ((unsigned char *) last + next);1445 *target_params = (char *) (*spec + 1);1446 1447 return 0;1448}1449 1450static int populate_table(struct dm_table *table,1451 struct dm_ioctl *param, size_t param_size)1452{1453 int r;1454 unsigned int i = 0;1455 struct dm_target_spec *spec = (struct dm_target_spec *) param;1456 uint32_t next = param->data_start;1457 const char *const end = (const char *) param + param_size;1458 char *target_params;1459 size_t min_size = sizeof(struct dm_ioctl);1460 1461 if (!param->target_count) {1462 DMERR("%s: no targets specified", __func__);1463 return -EINVAL;1464 }1465 1466 for (i = 0; i < param->target_count; i++) {1467 const char *nul_terminator;1468 1469 if (next < min_size) {1470 DMERR("%s: next target spec (offset %u) overlaps %s",1471 __func__, next, i ? "previous target" : "'struct dm_ioctl'");1472 return -EINVAL;1473 }1474 1475 r = next_target(spec, next, end, &spec, &target_params);1476 if (r) {1477 DMERR("unable to find target");1478 return r;1479 }1480 1481 nul_terminator = memchr(target_params, 0, (size_t)(end - target_params));1482 if (nul_terminator == NULL) {1483 DMERR("%s: target parameters not NUL-terminated", __func__);1484 return -EINVAL;1485 }1486 1487 /* Add 1 for NUL terminator */1488 min_size = (size_t)(nul_terminator - (const char *)spec) + 1;1489 1490 r = dm_table_add_target(table, spec->target_type,1491 (sector_t) spec->sector_start,1492 (sector_t) spec->length,1493 target_params);1494 if (r) {1495 DMERR("error adding target to table");1496 return r;1497 }1498 1499 next = spec->next;1500 }1501 1502 return dm_table_complete(table);1503}1504 1505static bool is_valid_type(enum dm_queue_mode cur, enum dm_queue_mode new)1506{1507 if (cur == new ||1508 (cur == DM_TYPE_BIO_BASED && new == DM_TYPE_DAX_BIO_BASED))1509 return true;1510 1511 return false;1512}1513 1514static int table_load(struct file *filp, struct dm_ioctl *param, size_t param_size)1515{1516 int r;1517 struct hash_cell *hc;1518 struct dm_table *t, *old_map = NULL;1519 struct mapped_device *md;1520 struct target_type *immutable_target_type;1521 1522 md = find_device(param);1523 if (!md)1524 return -ENXIO;1525 1526 r = dm_table_create(&t, get_mode(param), param->target_count, md);1527 if (r)1528 goto err;1529 1530 /* Protect md->type and md->queue against concurrent table loads. */1531 dm_lock_md_type(md);1532 r = populate_table(t, param, param_size);1533 if (r)1534 goto err_unlock_md_type;1535 1536 dm_ima_measure_on_table_load(t, STATUSTYPE_IMA);1537 1538 immutable_target_type = dm_get_immutable_target_type(md);1539 if (immutable_target_type &&1540 (immutable_target_type != dm_table_get_immutable_target_type(t)) &&1541 !dm_table_get_wildcard_target(t)) {1542 DMERR("can't replace immutable target type %s",1543 immutable_target_type->name);1544 r = -EINVAL;1545 goto err_unlock_md_type;1546 }1547 1548 if (dm_get_md_type(md) == DM_TYPE_NONE) {1549 /* setup md->queue to reflect md's type (may block) */1550 r = dm_setup_md_queue(md, t);1551 if (r) {1552 DMERR("unable to set up device queue for new table.");1553 goto err_unlock_md_type;1554 }1555 } else if (!is_valid_type(dm_get_md_type(md), dm_table_get_type(t))) {1556 DMERR("can't change device type (old=%u vs new=%u) after initial table load.",1557 dm_get_md_type(md), dm_table_get_type(t));1558 r = -EINVAL;1559 goto err_unlock_md_type;1560 }1561 1562 dm_unlock_md_type(md);1563 1564 /* stage inactive table */1565 down_write(&_hash_lock);1566 hc = dm_get_mdptr(md);1567 if (!hc) {1568 DMERR("device has been removed from the dev hash table.");1569 up_write(&_hash_lock);1570 r = -ENXIO;1571 goto err_destroy_table;1572 }1573 1574 if (hc->new_map)1575 old_map = hc->new_map;1576 hc->new_map = t;1577 up_write(&_hash_lock);1578 1579 param->flags |= DM_INACTIVE_PRESENT_FLAG;1580 __dev_status(md, param);1581 1582 if (old_map) {1583 dm_sync_table(md);1584 dm_table_destroy(old_map);1585 }1586 1587 dm_put(md);1588 1589 return 0;1590 1591err_unlock_md_type:1592 dm_unlock_md_type(md);1593err_destroy_table:1594 dm_table_destroy(t);1595err:1596 dm_put(md);1597 1598 return r;1599}1600 1601static int table_clear(struct file *filp, struct dm_ioctl *param, size_t param_size)1602{1603 struct hash_cell *hc;1604 struct mapped_device *md;1605 struct dm_table *old_map = NULL;1606 bool has_new_map = false;1607 1608 down_write(&_hash_lock);1609 1610 hc = __find_device_hash_cell(param);1611 if (!hc) {1612 DMDEBUG_LIMIT("device doesn't appear to be in the dev hash table.");1613 up_write(&_hash_lock);1614 return -ENXIO;1615 }1616 1617 if (hc->new_map) {1618 old_map = hc->new_map;1619 hc->new_map = NULL;1620 has_new_map = true;1621 }1622 1623 md = hc->md;1624 up_write(&_hash_lock);1625 1626 param->flags &= ~DM_INACTIVE_PRESENT_FLAG;1627 __dev_status(md, param);1628 1629 if (old_map) {1630 dm_sync_table(md);1631 dm_table_destroy(old_map);1632 }1633 dm_ima_measure_on_table_clear(md, has_new_map);1634 dm_put(md);1635 1636 return 0;1637}1638 1639/*1640 * Retrieves a list of devices used by a particular dm device.1641 */1642static void retrieve_deps(struct dm_table *table,1643 struct dm_ioctl *param, size_t param_size)1644{1645 unsigned int count = 0;1646 struct list_head *tmp;1647 size_t len, needed;1648 struct dm_dev_internal *dd;1649 struct dm_target_deps *deps;1650 1651 down_read(&table->devices_lock);1652 1653 deps = get_result_buffer(param, param_size, &len);1654 1655 /*1656 * Count the devices.1657 */1658 list_for_each(tmp, dm_table_get_devices(table))1659 count++;1660 1661 /*1662 * Check we have enough space.1663 */1664 needed = struct_size(deps, dev, count);1665 if (len < needed) {1666 param->flags |= DM_BUFFER_FULL_FLAG;1667 goto out;1668 }1669 1670 /*1671 * Fill in the devices.1672 */1673 deps->count = count;1674 count = 0;1675 list_for_each_entry(dd, dm_table_get_devices(table), list)1676 deps->dev[count++] = huge_encode_dev(dd->dm_dev->bdev->bd_dev);1677 1678 param->data_size = param->data_start + needed;1679 1680out:1681 up_read(&table->devices_lock);1682}1683 1684static int table_deps(struct file *filp, struct dm_ioctl *param, size_t param_size)1685{1686 struct mapped_device *md;1687 struct dm_table *table;1688 int srcu_idx;1689 1690 md = find_device(param);1691 if (!md)1692 return -ENXIO;1693 1694 __dev_status(md, param);1695 1696 table = dm_get_live_or_inactive_table(md, param, &srcu_idx);1697 if (table)1698 retrieve_deps(table, param, param_size);1699 dm_put_live_table(md, srcu_idx);1700 1701 dm_put(md);1702 1703 return 0;1704}1705 1706/*1707 * Return the status of a device as a text string for each1708 * target.1709 */1710static int table_status(struct file *filp, struct dm_ioctl *param, size_t param_size)1711{1712 struct mapped_device *md;1713 struct dm_table *table;1714 int srcu_idx;1715 1716 md = find_device(param);1717 if (!md)1718 return -ENXIO;1719 1720 __dev_status(md, param);1721 1722 table = dm_get_live_or_inactive_table(md, param, &srcu_idx);1723 if (table)1724 retrieve_status(table, param, param_size);1725 dm_put_live_table(md, srcu_idx);1726 1727 dm_put(md);1728 1729 return 0;1730}1731 1732/*1733 * Process device-mapper dependent messages. Messages prefixed with '@'1734 * are processed by the DM core. All others are delivered to the target.1735 * Returns a number <= 1 if message was processed by device mapper.1736 * Returns 2 if message should be delivered to the target.1737 */1738static int message_for_md(struct mapped_device *md, unsigned int argc, char **argv,1739 char *result, unsigned int maxlen)1740{1741 int r;1742 1743 if (**argv != '@')1744 return 2; /* no '@' prefix, deliver to target */1745 1746 if (!strcasecmp(argv[0], "@cancel_deferred_remove")) {1747 if (argc != 1) {1748 DMERR("Invalid arguments for @cancel_deferred_remove");1749 return -EINVAL;1750 }1751 return dm_cancel_deferred_remove(md);1752 }1753 1754 r = dm_stats_message(md, argc, argv, result, maxlen);1755 if (r < 2)1756 return r;1757 1758 DMERR("Unsupported message sent to DM core: %s", argv[0]);1759 return -EINVAL;1760}1761 1762/*1763 * Pass a message to the target that's at the supplied device offset.1764 */1765static int target_message(struct file *filp, struct dm_ioctl *param, size_t param_size)1766{1767 int r, argc;1768 char **argv;1769 struct mapped_device *md;1770 struct dm_table *table;1771 struct dm_target *ti;1772 struct dm_target_msg *tmsg = (void *) param + param->data_start;1773 size_t maxlen;1774 char *result = get_result_buffer(param, param_size, &maxlen);1775 int srcu_idx;1776 1777 md = find_device(param);1778 if (!md)1779 return -ENXIO;1780 1781 if (tmsg < (struct dm_target_msg *) param->data ||1782 invalid_str(tmsg->message, (void *) param + param_size)) {1783 DMERR("Invalid target message parameters.");1784 r = -EINVAL;1785 goto out;1786 }1787 1788 r = dm_split_args(&argc, &argv, tmsg->message);1789 if (r) {1790 DMERR("Failed to split target message parameters");1791 goto out;1792 }1793 1794 if (!argc) {1795 DMERR("Empty message received.");1796 r = -EINVAL;1797 goto out_argv;1798 }1799 1800 r = message_for_md(md, argc, argv, result, maxlen);1801 if (r <= 1)1802 goto out_argv;1803 1804 table = dm_get_live_table(md, &srcu_idx);1805 if (!table)1806 goto out_table;1807 1808 if (dm_deleting_md(md)) {1809 r = -ENXIO;1810 goto out_table;1811 }1812 1813 ti = dm_table_find_target(table, tmsg->sector);1814 if (!ti) {1815 DMERR("Target message sector outside device.");1816 r = -EINVAL;1817 } else if (ti->type->message)1818 r = ti->type->message(ti, argc, argv, result, maxlen);1819 else {1820 DMERR("Target type does not support messages");1821 r = -EINVAL;1822 }1823 1824 out_table:1825 dm_put_live_table(md, srcu_idx);1826 out_argv:1827 kfree(argv);1828 out:1829 if (r >= 0)1830 __dev_status(md, param);1831 1832 if (r == 1) {1833 param->flags |= DM_DATA_OUT_FLAG;1834 if (dm_message_test_buffer_overflow(result, maxlen))1835 param->flags |= DM_BUFFER_FULL_FLAG;1836 else1837 param->data_size = param->data_start + strlen(result) + 1;1838 r = 0;1839 }1840 1841 dm_put(md);1842 return r;1843}1844 1845/*1846 * The ioctl parameter block consists of two parts, a dm_ioctl struct1847 * followed by a data buffer. This flag is set if the second part,1848 * which has a variable size, is not used by the function processing1849 * the ioctl.1850 */1851#define IOCTL_FLAGS_NO_PARAMS 11852#define IOCTL_FLAGS_ISSUE_GLOBAL_EVENT 21853 1854/*1855 *---------------------------------------------------------------1856 * Implementation of open/close/ioctl on the special char device.1857 *---------------------------------------------------------------1858 */1859static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)1860{1861 static const struct {1862 int cmd;1863 int flags;1864 ioctl_fn fn;1865 } _ioctls[] = {1866 {DM_VERSION_CMD, 0, NULL}, /* version is dealt with elsewhere */1867 {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, remove_all},1868 {DM_LIST_DEVICES_CMD, 0, list_devices},1869 1870 {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_create},1871 {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_remove},1872 {DM_DEV_RENAME_CMD, IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_rename},1873 {DM_DEV_SUSPEND_CMD, IOCTL_FLAGS_NO_PARAMS, dev_suspend},1874 {DM_DEV_STATUS_CMD, IOCTL_FLAGS_NO_PARAMS, dev_status},1875 {DM_DEV_WAIT_CMD, 0, dev_wait},1876 1877 {DM_TABLE_LOAD_CMD, 0, table_load},1878 {DM_TABLE_CLEAR_CMD, IOCTL_FLAGS_NO_PARAMS, table_clear},1879 {DM_TABLE_DEPS_CMD, 0, table_deps},1880 {DM_TABLE_STATUS_CMD, 0, table_status},1881 1882 {DM_LIST_VERSIONS_CMD, 0, list_versions},1883 1884 {DM_TARGET_MSG_CMD, 0, target_message},1885 {DM_DEV_SET_GEOMETRY_CMD, 0, dev_set_geometry},1886 {DM_DEV_ARM_POLL_CMD, IOCTL_FLAGS_NO_PARAMS, dev_arm_poll},1887 {DM_GET_TARGET_VERSION_CMD, 0, get_target_version},1888 };1889 1890 if (unlikely(cmd >= ARRAY_SIZE(_ioctls)))1891 return NULL;1892 1893 cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls));1894 *ioctl_flags = _ioctls[cmd].flags;1895 return _ioctls[cmd].fn;1896}1897 1898/*1899 * As well as checking the version compatibility this always1900 * copies the kernel interface version out.1901 */1902static int check_version(unsigned int cmd, struct dm_ioctl __user *user,1903 struct dm_ioctl *kernel_params)1904{1905 int r = 0;1906 1907 /* Make certain version is first member of dm_ioctl struct */1908 BUILD_BUG_ON(offsetof(struct dm_ioctl, version) != 0);1909 1910 if (copy_from_user(kernel_params->version, user->version, sizeof(kernel_params->version)))1911 return -EFAULT;1912 1913 if ((kernel_params->version[0] != DM_VERSION_MAJOR) ||1914 (kernel_params->version[1] > DM_VERSION_MINOR)) {1915 DMERR("ioctl interface mismatch: kernel(%u.%u.%u), user(%u.%u.%u), cmd(%d)",1916 DM_VERSION_MAJOR, DM_VERSION_MINOR,1917 DM_VERSION_PATCHLEVEL,1918 kernel_params->version[0],1919 kernel_params->version[1],1920 kernel_params->version[2],1921 cmd);1922 r = -EINVAL;1923 }1924 1925 /*1926 * Fill in the kernel version.1927 */1928 kernel_params->version[0] = DM_VERSION_MAJOR;1929 kernel_params->version[1] = DM_VERSION_MINOR;1930 kernel_params->version[2] = DM_VERSION_PATCHLEVEL;1931 if (copy_to_user(user->version, kernel_params->version, sizeof(kernel_params->version)))1932 return -EFAULT;1933 1934 return r;1935}1936 1937#define DM_PARAMS_MALLOC 0x0001 /* Params allocated with kvmalloc() */1938#define DM_WIPE_BUFFER 0x0010 /* Wipe input buffer before returning from ioctl */1939 1940static void free_params(struct dm_ioctl *param, size_t param_size, int param_flags)1941{1942 if (param_flags & DM_WIPE_BUFFER)1943 memset(param, 0, param_size);1944 1945 if (param_flags & DM_PARAMS_MALLOC)1946 kvfree(param);1947}1948 1949static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kernel,1950 int ioctl_flags, struct dm_ioctl **param, int *param_flags)1951{1952 struct dm_ioctl *dmi;1953 int secure_data;1954 const size_t minimum_data_size = offsetof(struct dm_ioctl, data);1955 1956 /* check_version() already copied version from userspace, avoid TOCTOU */1957 if (copy_from_user((char *)param_kernel + sizeof(param_kernel->version),1958 (char __user *)user + sizeof(param_kernel->version),1959 minimum_data_size - sizeof(param_kernel->version)))1960 return -EFAULT;1961 1962 if (unlikely(param_kernel->data_size < minimum_data_size) ||1963 unlikely(param_kernel->data_size > DM_MAX_TARGETS * DM_MAX_TARGET_PARAMS)) {1964 DMERR("Invalid data size in the ioctl structure: %u",1965 param_kernel->data_size);1966 return -EINVAL;1967 }1968 1969 secure_data = param_kernel->flags & DM_SECURE_DATA_FLAG;1970 1971 *param_flags = secure_data ? DM_WIPE_BUFFER : 0;1972 1973 if (ioctl_flags & IOCTL_FLAGS_NO_PARAMS) {1974 dmi = param_kernel;1975 dmi->data_size = minimum_data_size;1976 goto data_copied;1977 }1978 1979 /*1980 * Use __GFP_HIGH to avoid low memory issues when a device is1981 * suspended and the ioctl is needed to resume it.1982 * Use kmalloc() rather than vmalloc() when we can.1983 */1984 dmi = NULL;1985 dmi = kvmalloc(param_kernel->data_size, GFP_NOIO | __GFP_HIGH);1986 1987 if (!dmi) {1988 if (secure_data && clear_user(user, param_kernel->data_size))1989 return -EFAULT;1990 return -ENOMEM;1991 }1992 1993 *param_flags |= DM_PARAMS_MALLOC;1994 1995 /* Copy from param_kernel (which was already copied from user) */1996 memcpy(dmi, param_kernel, minimum_data_size);1997 1998 if (copy_from_user(&dmi->data, (char __user *)user + minimum_data_size,1999 param_kernel->data_size - minimum_data_size))2000 goto bad;2001data_copied:2002 /* Wipe the user buffer so we do not return it to userspace */2003 if (secure_data && clear_user(user, param_kernel->data_size))2004 goto bad;2005 2006 *param = dmi;2007 return 0;2008 2009bad:2010 free_params(dmi, param_kernel->data_size, *param_flags);2011 2012 return -EFAULT;2013}2014 2015static int validate_params(uint cmd, struct dm_ioctl *param)2016{2017 /* Always clear this flag */2018 param->flags &= ~DM_BUFFER_FULL_FLAG;2019 param->flags &= ~DM_UEVENT_GENERATED_FLAG;2020 param->flags &= ~DM_SECURE_DATA_FLAG;2021 param->flags &= ~DM_DATA_OUT_FLAG;2022 2023 /* Ignores parameters */2024 if (cmd == DM_REMOVE_ALL_CMD ||2025 cmd == DM_LIST_DEVICES_CMD ||2026 cmd == DM_LIST_VERSIONS_CMD)2027 return 0;2028 2029 if (cmd == DM_DEV_CREATE_CMD) {2030 if (!*param->name) {2031 DMERR("name not supplied when creating device");2032 return -EINVAL;2033 }2034 } else if (*param->uuid && *param->name) {2035 DMERR("only supply one of name or uuid, cmd(%u)", cmd);2036 return -EINVAL;2037 }2038 2039 /* Ensure strings are terminated */2040 param->name[DM_NAME_LEN - 1] = '\0';2041 param->uuid[DM_UUID_LEN - 1] = '\0';2042 2043 return 0;2044}2045 2046static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *user)2047{2048 int r = 0;2049 int ioctl_flags;2050 int param_flags;2051 unsigned int cmd;2052 struct dm_ioctl *param;2053 ioctl_fn fn = NULL;2054 size_t input_param_size;2055 struct dm_ioctl param_kernel;2056 2057 /* only root can play with this */2058 if (!capable(CAP_SYS_ADMIN))2059 return -EACCES;2060 2061 if (_IOC_TYPE(command) != DM_IOCTL)2062 return -ENOTTY;2063 2064 cmd = _IOC_NR(command);2065 2066 /*2067 * Check the interface version passed in. This also2068 * writes out the kernel's interface version.2069 */2070 r = check_version(cmd, user, ¶m_kernel);2071 if (r)2072 return r;2073 2074 /*2075 * Nothing more to do for the version command.2076 */2077 if (cmd == DM_VERSION_CMD)2078 return 0;2079 2080 fn = lookup_ioctl(cmd, &ioctl_flags);2081 if (!fn) {2082 DMERR("dm_ctl_ioctl: unknown command 0x%x", command);2083 return -ENOTTY;2084 }2085 2086 /*2087 * Copy the parameters into kernel space.2088 */2089 r = copy_params(user, ¶m_kernel, ioctl_flags, ¶m, ¶m_flags);2090 2091 if (r)2092 return r;2093 2094 input_param_size = param->data_size;2095 r = validate_params(cmd, param);2096 if (r)2097 goto out;2098 2099 param->data_size = offsetof(struct dm_ioctl, data);2100 r = fn(file, param, input_param_size);2101 2102 if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) &&2103 unlikely(ioctl_flags & IOCTL_FLAGS_NO_PARAMS))2104 DMERR("ioctl %d tried to output some data but has IOCTL_FLAGS_NO_PARAMS set", cmd);2105 2106 if (!r && ioctl_flags & IOCTL_FLAGS_ISSUE_GLOBAL_EVENT)2107 dm_issue_global_event();2108 2109 /*2110 * Copy the results back to userland.2111 */2112 if (!r && copy_to_user(user, param, param->data_size))2113 r = -EFAULT;2114 2115out:2116 free_params(param, input_param_size, param_flags);2117 return r;2118}2119 2120static long dm_ctl_ioctl(struct file *file, uint command, ulong u)2121{2122 return (long)ctl_ioctl(file, command, (struct dm_ioctl __user *)u);2123}2124 2125#ifdef CONFIG_COMPAT2126static long dm_compat_ctl_ioctl(struct file *file, uint command, ulong u)2127{2128 return (long)dm_ctl_ioctl(file, command, (ulong) compat_ptr(u));2129}2130#else2131#define dm_compat_ctl_ioctl NULL2132#endif2133 2134static int dm_open(struct inode *inode, struct file *filp)2135{2136 int r;2137 struct dm_file *priv;2138 2139 r = nonseekable_open(inode, filp);2140 if (unlikely(r))2141 return r;2142 2143 priv = filp->private_data = kmalloc(sizeof(struct dm_file), GFP_KERNEL);2144 if (!priv)2145 return -ENOMEM;2146 2147 priv->global_event_nr = atomic_read(&dm_global_event_nr);2148 2149 return 0;2150}2151 2152static int dm_release(struct inode *inode, struct file *filp)2153{2154 kfree(filp->private_data);2155 return 0;2156}2157 2158static __poll_t dm_poll(struct file *filp, poll_table *wait)2159{2160 struct dm_file *priv = filp->private_data;2161 __poll_t mask = 0;2162 2163 poll_wait(filp, &dm_global_eventq, wait);2164 2165 if ((int)(atomic_read(&dm_global_event_nr) - priv->global_event_nr) > 0)2166 mask |= EPOLLIN;2167 2168 return mask;2169}2170 2171static const struct file_operations _ctl_fops = {2172 .open = dm_open,2173 .release = dm_release,2174 .poll = dm_poll,2175 .unlocked_ioctl = dm_ctl_ioctl,2176 .compat_ioctl = dm_compat_ctl_ioctl,2177 .owner = THIS_MODULE,2178 .llseek = noop_llseek,2179};2180 2181static struct miscdevice _dm_misc = {2182 .minor = MAPPER_CTRL_MINOR,2183 .name = DM_NAME,2184 .nodename = DM_DIR "/" DM_CONTROL_NODE,2185 .fops = &_ctl_fops2186};2187 2188MODULE_ALIAS_MISCDEV(MAPPER_CTRL_MINOR);2189MODULE_ALIAS("devname:" DM_DIR "/" DM_CONTROL_NODE);2190 2191/*2192 * Create misc character device and link to DM_DIR/control.2193 */2194int __init dm_interface_init(void)2195{2196 int r;2197 2198 r = misc_register(&_dm_misc);2199 if (r) {2200 DMERR("misc_register failed for control device");2201 return r;2202 }2203 2204 DMINFO("%d.%d.%d%s initialised: %s", DM_VERSION_MAJOR,2205 DM_VERSION_MINOR, DM_VERSION_PATCHLEVEL, DM_VERSION_EXTRA,2206 DM_DRIVER_EMAIL);2207 return 0;2208}2209 2210void dm_interface_exit(void)2211{2212 misc_deregister(&_dm_misc);2213 dm_hash_exit();2214}2215 2216/**2217 * dm_copy_name_and_uuid - Copy mapped device name & uuid into supplied buffers2218 * @md: Pointer to mapped_device2219 * @name: Buffer (size DM_NAME_LEN) for name2220 * @uuid: Buffer (size DM_UUID_LEN) for uuid or empty string if uuid not defined2221 */2222int dm_copy_name_and_uuid(struct mapped_device *md, char *name, char *uuid)2223{2224 int r = 0;2225 struct hash_cell *hc;2226 2227 if (!md)2228 return -ENXIO;2229 2230 mutex_lock(&dm_hash_cells_mutex);2231 hc = dm_get_mdptr(md);2232 if (!hc) {2233 r = -ENXIO;2234 goto out;2235 }2236 2237 if (name)2238 strcpy(name, hc->name);2239 if (uuid)2240 strcpy(uuid, hc->uuid ? : "");2241 2242out:2243 mutex_unlock(&dm_hash_cells_mutex);2244 2245 return r;2246}2247EXPORT_SYMBOL_GPL(dm_copy_name_and_uuid);2248 2249/**2250 * dm_early_create - create a mapped device in early boot.2251 *2252 * @dmi: Contains main information of the device mapping to be created.2253 * @spec_array: array of pointers to struct dm_target_spec. Describes the2254 * mapping table of the device.2255 * @target_params_array: array of strings with the parameters to a specific2256 * target.2257 *2258 * Instead of having the struct dm_target_spec and the parameters for every2259 * target embedded at the end of struct dm_ioctl (as performed in a normal2260 * ioctl), pass them as arguments, so the caller doesn't need to serialize them.2261 * The size of the spec_array and target_params_array is given by2262 * @dmi->target_count.2263 * This function is supposed to be called in early boot, so locking mechanisms2264 * to protect against concurrent loads are not required.2265 */2266int __init dm_early_create(struct dm_ioctl *dmi,2267 struct dm_target_spec **spec_array,2268 char **target_params_array)2269{2270 int r, m = DM_ANY_MINOR;2271 struct dm_table *t, *old_map;2272 struct mapped_device *md;2273 unsigned int i;2274 2275 if (!dmi->target_count)2276 return -EINVAL;2277 2278 r = check_name(dmi->name);2279 if (r)2280 return r;2281 2282 if (dmi->flags & DM_PERSISTENT_DEV_FLAG)2283 m = MINOR(huge_decode_dev(dmi->dev));2284 2285 /* alloc dm device */2286 r = dm_create(m, &md);2287 if (r)2288 return r;2289 2290 /* hash insert */2291 r = dm_hash_insert(dmi->name, *dmi->uuid ? dmi->uuid : NULL, md);2292 if (r)2293 goto err_destroy_dm;2294 2295 /* alloc table */2296 r = dm_table_create(&t, get_mode(dmi), dmi->target_count, md);2297 if (r)2298 goto err_hash_remove;2299 2300 /* add targets */2301 for (i = 0; i < dmi->target_count; i++) {2302 r = dm_table_add_target(t, spec_array[i]->target_type,2303 (sector_t) spec_array[i]->sector_start,2304 (sector_t) spec_array[i]->length,2305 target_params_array[i]);2306 if (r) {2307 DMERR("error adding target to table");2308 goto err_destroy_table;2309 }2310 }2311 2312 /* finish table */2313 r = dm_table_complete(t);2314 if (r)2315 goto err_destroy_table;2316 2317 /* setup md->queue to reflect md's type (may block) */2318 r = dm_setup_md_queue(md, t);2319 if (r) {2320 DMERR("unable to set up device queue for new table.");2321 goto err_destroy_table;2322 }2323 2324 /* Set new map */2325 dm_suspend(md, 0);2326 old_map = dm_swap_table(md, t);2327 if (IS_ERR(old_map)) {2328 r = PTR_ERR(old_map);2329 goto err_destroy_table;2330 }2331 set_disk_ro(dm_disk(md), !!(dmi->flags & DM_READONLY_FLAG));2332 2333 /* resume device */2334 r = dm_resume(md);2335 if (r)2336 goto err_destroy_table;2337 2338 DMINFO("%s (%s) is ready", md->disk->disk_name, dmi->name);2339 dm_put(md);2340 return 0;2341 2342err_destroy_table:2343 dm_table_destroy(t);2344err_hash_remove:2345 down_write(&_hash_lock);2346 (void) __hash_remove(__get_name_cell(dmi->name));2347 up_write(&_hash_lock);2348 /* release reference from __get_name_cell */2349 dm_put(md);2350err_destroy_dm:2351 dm_put(md);2352 dm_destroy(md);2353 return r;2354}2355