1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * umd - User mode driver support |
4 | */ |
5 | #include <linux/shmem_fs.h> |
6 | #include <linux/pipe_fs_i.h> |
7 | #include <linux/mount.h> |
8 | #include <linux/fs_struct.h> |
9 | #include <linux/task_work.h> |
10 | #include <linux/usermode_driver.h> |
11 | |
12 | static struct vfsmount *blob_to_mnt(const void *data, size_t len, const char *name) |
13 | { |
14 | struct file_system_type *type; |
15 | struct vfsmount *mnt; |
16 | struct file *file; |
17 | ssize_t written; |
18 | loff_t pos = 0; |
19 | |
20 | type = get_fs_type(name: "tmpfs" ); |
21 | if (!type) |
22 | return ERR_PTR(error: -ENODEV); |
23 | |
24 | mnt = kern_mount(type); |
25 | put_filesystem(fs: type); |
26 | if (IS_ERR(ptr: mnt)) |
27 | return mnt; |
28 | |
29 | file = file_open_root_mnt(mnt, name, O_CREAT | O_WRONLY, mode: 0700); |
30 | if (IS_ERR(ptr: file)) { |
31 | kern_unmount(mnt); |
32 | return ERR_CAST(ptr: file); |
33 | } |
34 | |
35 | written = kernel_write(file, data, len, &pos); |
36 | if (written != len) { |
37 | int err = written; |
38 | if (err >= 0) |
39 | err = -ENOMEM; |
40 | filp_close(file, NULL); |
41 | kern_unmount(mnt); |
42 | return ERR_PTR(error: err); |
43 | } |
44 | |
45 | fput(file); |
46 | |
47 | /* Flush delayed fput so exec can open the file read-only */ |
48 | flush_delayed_fput(); |
49 | task_work_run(); |
50 | return mnt; |
51 | } |
52 | |
53 | /** |
54 | * umd_load_blob - Remember a blob of bytes for fork_usermode_driver |
55 | * @info: information about usermode driver |
56 | * @data: a blob of bytes that can be executed as a file |
57 | * @len: The lentgh of the blob |
58 | * |
59 | */ |
60 | int umd_load_blob(struct umd_info *info, const void *data, size_t len) |
61 | { |
62 | struct vfsmount *mnt; |
63 | |
64 | if (WARN_ON_ONCE(info->wd.dentry || info->wd.mnt)) |
65 | return -EBUSY; |
66 | |
67 | mnt = blob_to_mnt(data, len, name: info->driver_name); |
68 | if (IS_ERR(ptr: mnt)) |
69 | return PTR_ERR(ptr: mnt); |
70 | |
71 | info->wd.mnt = mnt; |
72 | info->wd.dentry = mnt->mnt_root; |
73 | return 0; |
74 | } |
75 | EXPORT_SYMBOL_GPL(umd_load_blob); |
76 | |
77 | /** |
78 | * umd_unload_blob - Disassociate @info from a previously loaded blob |
79 | * @info: information about usermode driver |
80 | * |
81 | */ |
82 | int umd_unload_blob(struct umd_info *info) |
83 | { |
84 | if (WARN_ON_ONCE(!info->wd.mnt || |
85 | !info->wd.dentry || |
86 | info->wd.mnt->mnt_root != info->wd.dentry)) |
87 | return -EINVAL; |
88 | |
89 | kern_unmount(mnt: info->wd.mnt); |
90 | info->wd.mnt = NULL; |
91 | info->wd.dentry = NULL; |
92 | return 0; |
93 | } |
94 | EXPORT_SYMBOL_GPL(umd_unload_blob); |
95 | |
96 | static int umd_setup(struct subprocess_info *info, struct cred *new) |
97 | { |
98 | struct umd_info *umd_info = info->data; |
99 | struct file *from_umh[2]; |
100 | struct file *to_umh[2]; |
101 | int err; |
102 | |
103 | /* create pipe to send data to umh */ |
104 | err = create_pipe_files(to_umh, 0); |
105 | if (err) |
106 | return err; |
107 | err = replace_fd(fd: 0, file: to_umh[0], flags: 0); |
108 | fput(to_umh[0]); |
109 | if (err < 0) { |
110 | fput(to_umh[1]); |
111 | return err; |
112 | } |
113 | |
114 | /* create pipe to receive data from umh */ |
115 | err = create_pipe_files(from_umh, 0); |
116 | if (err) { |
117 | fput(to_umh[1]); |
118 | replace_fd(fd: 0, NULL, flags: 0); |
119 | return err; |
120 | } |
121 | err = replace_fd(fd: 1, file: from_umh[1], flags: 0); |
122 | fput(from_umh[1]); |
123 | if (err < 0) { |
124 | fput(to_umh[1]); |
125 | replace_fd(fd: 0, NULL, flags: 0); |
126 | fput(from_umh[0]); |
127 | return err; |
128 | } |
129 | |
130 | set_fs_pwd(current->fs, &umd_info->wd); |
131 | umd_info->pipe_to_umh = to_umh[1]; |
132 | umd_info->pipe_from_umh = from_umh[0]; |
133 | umd_info->tgid = get_pid(pid: task_tgid(current)); |
134 | return 0; |
135 | } |
136 | |
137 | static void umd_cleanup(struct subprocess_info *info) |
138 | { |
139 | struct umd_info *umd_info = info->data; |
140 | |
141 | /* cleanup if umh_setup() was successful but exec failed */ |
142 | if (info->retval) |
143 | umd_cleanup_helper(info: umd_info); |
144 | } |
145 | |
146 | /** |
147 | * umd_cleanup_helper - release the resources which were allocated in umd_setup |
148 | * @info: information about usermode driver |
149 | */ |
150 | void umd_cleanup_helper(struct umd_info *info) |
151 | { |
152 | fput(info->pipe_to_umh); |
153 | fput(info->pipe_from_umh); |
154 | put_pid(pid: info->tgid); |
155 | info->tgid = NULL; |
156 | } |
157 | EXPORT_SYMBOL_GPL(umd_cleanup_helper); |
158 | |
159 | /** |
160 | * fork_usermode_driver - fork a usermode driver |
161 | * @info: information about usermode driver (shouldn't be NULL) |
162 | * |
163 | * Returns either negative error or zero which indicates success in |
164 | * executing a usermode driver. In such case 'struct umd_info *info' |
165 | * is populated with two pipes and a tgid of the process. The caller is |
166 | * responsible for health check of the user process, killing it via |
167 | * tgid, and closing the pipes when user process is no longer needed. |
168 | */ |
169 | int fork_usermode_driver(struct umd_info *info) |
170 | { |
171 | struct subprocess_info *sub_info; |
172 | const char *argv[] = { info->driver_name, NULL }; |
173 | int err; |
174 | |
175 | if (WARN_ON_ONCE(info->tgid)) |
176 | return -EBUSY; |
177 | |
178 | err = -ENOMEM; |
179 | sub_info = call_usermodehelper_setup(path: info->driver_name, |
180 | argv: (char **)argv, NULL, GFP_KERNEL, |
181 | init: umd_setup, cleanup: umd_cleanup, data: info); |
182 | if (!sub_info) |
183 | goto out; |
184 | |
185 | err = call_usermodehelper_exec(info: sub_info, UMH_WAIT_EXEC); |
186 | out: |
187 | return err; |
188 | } |
189 | EXPORT_SYMBOL_GPL(fork_usermode_driver); |
190 | |
191 | |
192 | |