1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* /proc/sys support
4	*/
5	#include <linux/init.h>
6	#include <linux/sysctl.h>
7	#include <linux/poll.h>
8	#include <linux/proc_fs.h>
9	#include <linux/printk.h>
10	#include <linux/security.h>
11	#include <linux/sched.h>
12	#include <linux/cred.h>
13	#include <linux/namei.h>
14	#include <linux/mm.h>
15	#include <linux/uio.h>
16	#include <linux/module.h>
17	#include <linux/bpf-cgroup.h>
18	#include <linux/mount.h>
19	#include <linux/kmemleak.h>
20	#include <linux/lockdep.h>
21	#include "internal.h"
22
23	#define list_for_each_table_entry(entry, header) \
24	entry = header->ctl_table; \
25	for (size_t i = 0 ; i < header->ctl_table_size; ++i, entry++)
26
27	static const struct dentry_operations proc_sys_dentry_operations;
28	static const struct file_operations proc_sys_file_operations;
29	static const struct inode_operations proc_sys_inode_operations;
30	static const struct file_operations proc_sys_dir_file_operations;
31	static const struct inode_operations proc_sys_dir_operations;
32
33	/*
34	* Support for permanently empty directories.
35	* Must be non-empty to avoid sharing an address with other tables.
36	*/
37	static const struct ctl_table sysctl_mount_point[] = {
38	{ }
39	};
40
41	/**
42	* register_sysctl_mount_point() - registers a sysctl mount point
43	* @path: path for the mount point
44	*
45	* Used to create a permanently empty directory to serve as mount point.
46	* There are some subtle but important permission checks this allows in the
47	* case of unprivileged mounts.
48	*/
49	struct ctl_table_header *register_sysctl_mount_point(const char *path)
50	{
51	return register_sysctl_sz(path, table: sysctl_mount_point, table_size: 0);
52	}
53	EXPORT_SYMBOL(register_sysctl_mount_point);
54
55	#define sysctl_is_perm_empty_ctl_header(hptr) \
56	(hptr->type == SYSCTL_TABLE_TYPE_PERMANENTLY_EMPTY)
57	#define sysctl_set_perm_empty_ctl_header(hptr) \
58	(hptr->type = SYSCTL_TABLE_TYPE_PERMANENTLY_EMPTY)
59	#define sysctl_clear_perm_empty_ctl_header(hptr) \
60	(hptr->type = SYSCTL_TABLE_TYPE_DEFAULT)
61
62	void proc_sys_poll_notify(struct ctl_table_poll *poll)
63	{
64	if (!poll)
65	return;
66
67	atomic_inc(v: &poll->event);
68	wake_up_interruptible(&poll->wait);
69	}
70
71	static const struct ctl_table root_table[] = {
72	{
73	.procname = "",
74	.mode = S_IFDIR|S_IRUGO|S_IXUGO,
75	},
76	};
77	static struct ctl_table_root sysctl_table_root = {
78	.default_set.dir.header = {
79	{{.count = 1,
80	.nreg = 1,
81	.ctl_table = root_table }},
82	.ctl_table_arg = root_table,
83	.root = &sysctl_table_root,
84	.set = &sysctl_table_root.default_set,
85	},
86	};
87
88	static DEFINE_SPINLOCK(sysctl_lock);
89
90	static void drop_sysctl_table(struct ctl_table_header *header);
91	static int sysctl_follow_link(struct ctl_table_header **phead,
92	const struct ctl_table **pentry);
93	static int insert_links(struct ctl_table_header *head);
94	static void put_links(struct ctl_table_header *header);
95
96	static void sysctl_print_dir(struct ctl_dir *dir)
97	{
98	if (dir->header.parent)
99	sysctl_print_dir(dir: dir->header.parent);
100	pr_cont("%s/", dir->header.ctl_table[0].procname);
101	}
102
103	static int namecmp(const char *name1, int len1, const char *name2, int len2)
104	{
105	int cmp;
106
107	cmp = memcmp(p: name1, q: name2, min(len1, len2));
108	if (cmp == 0)
109	cmp = len1 - len2;
110	return cmp;
111	}
112
113	static const struct ctl_table *find_entry(struct ctl_table_header **phead,
114	struct ctl_dir *dir, const char *name, int namelen)
115	{
116	struct ctl_table_header *head;
117	const struct ctl_table *entry;
118	struct rb_node *node = dir->root.rb_node;
119
120	lockdep_assert_held(&sysctl_lock);
121
122	while (node)
123	{
124	struct ctl_node *ctl_node;
125	const char *procname;
126	int cmp;
127
128	ctl_node = rb_entry(node, struct ctl_node, node);
129	head = ctl_node->header;
130	entry = &head->ctl_table[ctl_node - head->node];
131	procname = entry->procname;
132
133	cmp = namecmp(name1: name, len1: namelen, name2: procname, strlen(procname));
134	if (cmp < 0)
135	node = node->rb_left;
136	else if (cmp > 0)
137	node = node->rb_right;
138	else {
139	*phead = head;
140	return entry;
141	}
142	}
143	return NULL;
144	}
145
146	static int insert_entry(struct ctl_table_header *head, const struct ctl_table *entry)
147	{
148	struct rb_node *node = &head->node[entry - head->ctl_table].node;
149	struct rb_node **p = &head->parent->root.rb_node;
150	struct rb_node *parent = NULL;
151	const char *name = entry->procname;
152	int namelen = strlen(name);
153
154	while (*p) {
155	struct ctl_table_header *parent_head;
156	const struct ctl_table *parent_entry;
157	struct ctl_node *parent_node;
158	const char *parent_name;
159	int cmp;
160
161	parent = *p;
162	parent_node = rb_entry(parent, struct ctl_node, node);
163	parent_head = parent_node->header;
164	parent_entry = &parent_head->ctl_table[parent_node - parent_head->node];
165	parent_name = parent_entry->procname;
166
167	cmp = namecmp(name1: name, len1: namelen, name2: parent_name, strlen(parent_name));
168	if (cmp < 0)
169	p = &(*p)->rb_left;
170	else if (cmp > 0)
171	p = &(*p)->rb_right;
172	else {
173	pr_err("sysctl duplicate entry: ");
174	sysctl_print_dir(dir: head->parent);
175	pr_cont("%s\n", entry->procname);
176	return -EEXIST;
177	}
178	}
179
180	rb_link_node(node, parent, rb_link: p);
181	rb_insert_color(node, &head->parent->root);
182	return 0;
183	}
184
185	static void erase_entry(struct ctl_table_header *head, const struct ctl_table *entry)
186	{
187	struct rb_node *node = &head->node[entry - head->ctl_table].node;
188
189	rb_erase(node, &head->parent->root);
190	}
191
192	static void init_header(struct ctl_table_header *head,
193	struct ctl_table_root *root, struct ctl_table_set *set,
194	struct ctl_node *node, const struct ctl_table *table, size_t table_size)
195	{
196	head->ctl_table = table;
197	head->ctl_table_size = table_size;
198	head->ctl_table_arg = table;
199	head->used = 0;
200	head->count = 1;
201	head->nreg = 1;
202	head->unregistering = NULL;
203	head->root = root;
204	head->set = set;
205	head->parent = NULL;
206	head->node = node;
207	INIT_HLIST_HEAD(&head->inodes);
208	if (node) {
209	const struct ctl_table *entry;
210
211	list_for_each_table_entry(entry, head) {
212	node->header = head;
213	node++;
214	}
215	}
216	if (table == sysctl_mount_point)
217	sysctl_set_perm_empty_ctl_header(head);
218	}
219
220	static void erase_header(struct ctl_table_header *head)
221	{
222	const struct ctl_table *entry;
223
224	list_for_each_table_entry(entry, head)
225	erase_entry(head, entry);
226	}
227
228	static int insert_header(struct ctl_dir *dir, struct ctl_table_header *header)
229	{
230	const struct ctl_table *entry;
231	struct ctl_table_header *dir_h = &dir->header;
232	int err;
233
234
235	/* Is this a permanently empty directory? */
236	if (sysctl_is_perm_empty_ctl_header(dir_h))
237	return -EROFS;
238
239	/* Am I creating a permanently empty directory? */
240	if (sysctl_is_perm_empty_ctl_header(header)) {
241	if (!RB_EMPTY_ROOT(&dir->root))
242	return -EINVAL;
243	sysctl_set_perm_empty_ctl_header(dir_h);
244	}
245
246	dir_h->nreg++;
247	header->parent = dir;
248	err = insert_links(head: header);
249	if (err)
250	goto fail_links;
251	list_for_each_table_entry(entry, header) {
252	err = insert_entry(head: header, entry);
253	if (err)
254	goto fail;
255	}
256	return 0;
257	fail:
258	erase_header(head: header);
259	put_links(header);
260	fail_links:
261	if (header->ctl_table == sysctl_mount_point)
262	sysctl_clear_perm_empty_ctl_header(dir_h);
263	header->parent = NULL;
264	drop_sysctl_table(header: dir_h);
265	return err;
266	}
267
268	static int use_table(struct ctl_table_header *p)
269	{
270	lockdep_assert_held(&sysctl_lock);
271
272	if (unlikely(p->unregistering))
273	return 0;
274	p->used++;
275	return 1;
276	}
277
278	static void unuse_table(struct ctl_table_header *p)
279	{
280	lockdep_assert_held(&sysctl_lock);
281
282	if (!--p->used)
283	if (unlikely(p->unregistering))
284	complete(p->unregistering);
285	}
286
287	static void proc_sys_invalidate_dcache(struct ctl_table_header *head)
288	{
289	proc_invalidate_siblings_dcache(inodes: &head->inodes, lock: &sysctl_lock);
290	}
291
292	static void start_unregistering(struct ctl_table_header *p)
293	{
294	/* will reacquire if has to wait */
295	lockdep_assert_held(&sysctl_lock);
296
297	/*
298	* if p->used is 0, nobody will ever touch that entry again;
299	* we'll eliminate all paths to it before dropping sysctl_lock
300	*/
301	if (unlikely(p->used)) {
302	struct completion wait;
303	init_completion(x: &wait);
304	p->unregistering = &wait;
305	spin_unlock(lock: &sysctl_lock);
306	wait_for_completion(&wait);
307	} else {
308	/* anything non-NULL; we'll never dereference it */
309	p->unregistering = ERR_PTR(error: -EINVAL);
310	spin_unlock(lock: &sysctl_lock);
311	}
312	/*
313	* Invalidate dentries for unregistered sysctls: namespaced sysctls
314	* can have duplicate names and contaminate dcache very badly.
315	*/
316	proc_sys_invalidate_dcache(head: p);
317	/*
318	* do not remove from the list until nobody holds it; walking the
319	* list in do_sysctl() relies on that.
320	*/
321	spin_lock(lock: &sysctl_lock);
322	erase_header(head: p);
323	}
324
325	static struct ctl_table_header *sysctl_head_grab(struct ctl_table_header *head)
326	{
327	BUG_ON(!head);
328	spin_lock(lock: &sysctl_lock);
329	if (!use_table(p: head))
330	head = ERR_PTR(error: -ENOENT);
331	spin_unlock(lock: &sysctl_lock);
332	return head;
333	}
334
335	static void sysctl_head_finish(struct ctl_table_header *head)
336	{
337	if (!head)
338	return;
339	spin_lock(lock: &sysctl_lock);
340	unuse_table(p: head);
341	spin_unlock(lock: &sysctl_lock);
342	}
343
344	static struct ctl_table_set *
345	lookup_header_set(struct ctl_table_root *root)
346	{
347	struct ctl_table_set *set = &root->default_set;
348	if (root->lookup)
349	set = root->lookup(root);
350	return set;
351	}
352
353	static const struct ctl_table *lookup_entry(struct ctl_table_header **phead,
354	struct ctl_dir *dir,
355	const char *name, int namelen)
356	{
357	struct ctl_table_header *head;
358	const struct ctl_table *entry;
359
360	spin_lock(lock: &sysctl_lock);
361	entry = find_entry(phead: &head, dir, name, namelen);
362	if (entry && use_table(p: head))
363	*phead = head;
364	else
365	entry = NULL;
366	spin_unlock(lock: &sysctl_lock);
367	return entry;
368	}
369
370	static struct ctl_node *first_usable_entry(struct rb_node *node)
371	{
372	struct ctl_node *ctl_node;
373
374	for (;node; node = rb_next(node)) {
375	ctl_node = rb_entry(node, struct ctl_node, node);
376	if (use_table(p: ctl_node->header))
377	return ctl_node;
378	}
379	return NULL;
380	}
381
382	static void first_entry(struct ctl_dir *dir,
383	struct ctl_table_header **phead, const struct ctl_table **pentry)
384	{
385	struct ctl_table_header *head = NULL;
386	const struct ctl_table *entry = NULL;
387	struct ctl_node *ctl_node;
388
389	spin_lock(lock: &sysctl_lock);
390	ctl_node = first_usable_entry(node: rb_first(root: &dir->root));
391	spin_unlock(lock: &sysctl_lock);
392	if (ctl_node) {
393	head = ctl_node->header;
394	entry = &head->ctl_table[ctl_node - head->node];
395	}
396	*phead = head;
397	*pentry = entry;
398	}
399
400	static void next_entry(struct ctl_table_header **phead, const struct ctl_table **pentry)
401	{
402	struct ctl_table_header *head = *phead;
403	const struct ctl_table *entry = *pentry;
404	struct ctl_node *ctl_node = &head->node[entry - head->ctl_table];
405
406	spin_lock(lock: &sysctl_lock);
407	unuse_table(p: head);
408
409	ctl_node = first_usable_entry(node: rb_next(&ctl_node->node));
410	spin_unlock(lock: &sysctl_lock);
411	head = NULL;
412	if (ctl_node) {
413	head = ctl_node->header;
414	entry = &head->ctl_table[ctl_node - head->node];
415	}
416	*phead = head;
417	*pentry = entry;
418	}
419
420	/*
421	* sysctl_perm does NOT grant the superuser all rights automatically, because
422	* some sysctl variables are readonly even to root.
423	*/
424
425	static int test_perm(int mode, int op)
426	{
427	if (uid_eq(current_euid(), GLOBAL_ROOT_UID))
428	mode >>= 6;
429	else if (in_egroup_p(GLOBAL_ROOT_GID))
430	mode >>= 3;
431	if ((op & ~mode & (MAY_READ|MAY_WRITE|MAY_EXEC)) == 0)
432	return 0;
433	return -EACCES;
434	}
435
436	static int sysctl_perm(struct ctl_table_header *head, const struct ctl_table *table, int op)
437	{
438	struct ctl_table_root *root = head->root;
439	int mode;
440
441	if (root->permissions)
442	mode = root->permissions(head, table);
443	else
444	mode = table->mode;
445
446	return test_perm(mode, op);
447	}
448
449	static struct inode *proc_sys_make_inode(struct super_block *sb,
450	struct ctl_table_header *head, const struct ctl_table *table)
451	{
452	struct ctl_table_root *root = head->root;
453	struct inode *inode;
454	struct proc_inode *ei;
455
456	inode = new_inode(sb);
457	if (!inode)
458	return ERR_PTR(error: -ENOMEM);
459
460	inode->i_ino = get_next_ino();
461
462	ei = PROC_I(inode);
463
464	spin_lock(lock: &sysctl_lock);
465	if (unlikely(head->unregistering)) {
466	spin_unlock(lock: &sysctl_lock);
467	iput(inode);
468	return ERR_PTR(error: -ENOENT);
469	}
470	ei->sysctl = head;
471	ei->sysctl_entry = table;
472	hlist_add_head_rcu(n: &ei->sibling_inodes, h: &head->inodes);
473	head->count++;
474	spin_unlock(lock: &sysctl_lock);
475
476	simple_inode_init_ts(inode);
477	inode->i_mode = table->mode;
478	if (!S_ISDIR(table->mode)) {
479	inode->i_mode |= S_IFREG;
480	inode->i_op = &proc_sys_inode_operations;
481	inode->i_fop = &proc_sys_file_operations;
482	} else {
483	inode->i_mode |= S_IFDIR;
484	inode->i_op = &proc_sys_dir_operations;
485	inode->i_fop = &proc_sys_dir_file_operations;
486	if (sysctl_is_perm_empty_ctl_header(head))
487	make_empty_dir_inode(inode);
488	}
489
490	inode->i_uid = GLOBAL_ROOT_UID;
491	inode->i_gid = GLOBAL_ROOT_GID;
492	if (root->set_ownership)
493	root->set_ownership(head, &inode->i_uid, &inode->i_gid);
494
495	return inode;
496	}
497
498	void proc_sys_evict_inode(struct inode *inode, struct ctl_table_header *head)
499	{
500	spin_lock(lock: &sysctl_lock);
501	hlist_del_init_rcu(n: &PROC_I(inode)->sibling_inodes);
502	if (!--head->count)
503	kfree_rcu(head, rcu);
504	spin_unlock(lock: &sysctl_lock);
505	}
506
507	static struct ctl_table_header *grab_header(struct inode *inode)
508	{
509	struct ctl_table_header *head = PROC_I(inode)->sysctl;
510	if (!head)
511	head = &sysctl_table_root.default_set.dir.header;
512	return sysctl_head_grab(head);
513	}
514
515	static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
516	unsigned int flags)
517	{
518	struct ctl_table_header *head = grab_header(inode: dir);
519	struct ctl_table_header *h = NULL;
520	const struct qstr *name = &dentry->d_name;
521	const struct ctl_table *p;
522	struct inode *inode;
523	struct dentry *err = ERR_PTR(error: -ENOENT);
524	struct ctl_dir *ctl_dir;
525	int ret;
526
527	if (IS_ERR(ptr: head))
528	return ERR_CAST(ptr: head);
529
530	ctl_dir = container_of(head, struct ctl_dir, header);
531
532	p = lookup_entry(phead: &h, dir: ctl_dir, name: name->name, namelen: name->len);
533	if (!p)
534	goto out;
535
536	if (S_ISLNK(p->mode)) {
537	ret = sysctl_follow_link(phead: &h, pentry: &p);
538	err = ERR_PTR(error: ret);
539	if (ret)
540	goto out;
541	}
542
543	inode = proc_sys_make_inode(sb: dir->i_sb, head: h ? h : head, table: p);
544	err = d_splice_alias_ops(inode, dentry, &proc_sys_dentry_operations);
545
546	out:
547	if (h)
548	sysctl_head_finish(head: h);
549	sysctl_head_finish(head);
550	return err;
551	}
552
553	static ssize_t proc_sys_call_handler(struct kiocb *iocb, struct iov_iter *iter,
554	int write)
555	{
556	struct inode *inode = file_inode(f: iocb->ki_filp);
557	struct ctl_table_header *head = grab_header(inode);
558	const struct ctl_table *table = PROC_I(inode)->sysctl_entry;
559	size_t count = iov_iter_count(i: iter);
560	char *kbuf;
561	ssize_t error;
562
563	if (IS_ERR(ptr: head))
564	return PTR_ERR(ptr: head);
565
566	/*
567	* At this point we know that the sysctl was not unregistered
568	* and won't be until we finish.
569	*/
570	error = -EPERM;
571	if (sysctl_perm(head, table, op: write ? MAY_WRITE : MAY_READ))
572	goto out;
573
574	/* if that can happen at all, it should be -EINVAL, not -EISDIR */
575	error = -EINVAL;
576	if (!table->proc_handler)
577	goto out;
578
579	/* don't even try if the size is too large */
580	error = -ENOMEM;
581	if (count >= KMALLOC_MAX_SIZE)
582	goto out;
583	kbuf = kvzalloc(count + 1, GFP_KERNEL);
584	if (!kbuf)
585	goto out;
586
587	if (write) {
588	error = -EFAULT;
589	if (!copy_from_iter_full(addr: kbuf, bytes: count, i: iter))
590	goto out_free_buf;
591	kbuf[count] = '\0';
592	}
593
594	error = BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, &kbuf, &count,
595	&iocb->ki_pos);
596	if (error)
597	goto out_free_buf;
598
599	/* careful: calling conventions are nasty here */
600	error = table->proc_handler(table, write, kbuf, &count, &iocb->ki_pos);
601	if (error)
602	goto out_free_buf;
603
604	if (!write) {
605	error = -EFAULT;
606	if (copy_to_iter(addr: kbuf, bytes: count, i: iter) < count)
607	goto out_free_buf;
608	}
609
610	error = count;
611	out_free_buf:
612	kvfree(addr: kbuf);
613	out:
614	sysctl_head_finish(head);
615
616	return error;
617	}
618
619	static ssize_t proc_sys_read(struct kiocb *iocb, struct iov_iter *iter)
620	{
621	return proc_sys_call_handler(iocb, iter, write: 0);
622	}
623
624	static ssize_t proc_sys_write(struct kiocb *iocb, struct iov_iter *iter)
625	{
626	return proc_sys_call_handler(iocb, iter, write: 1);
627	}
628
629	static int proc_sys_open(struct inode *inode, struct file *filp)
630	{
631	struct ctl_table_header *head = grab_header(inode);
632	const struct ctl_table *table = PROC_I(inode)->sysctl_entry;
633
634	/* sysctl was unregistered */
635	if (IS_ERR(ptr: head))
636	return PTR_ERR(ptr: head);
637
638	if (table->poll)
639	filp->private_data = proc_sys_poll_event(poll: table->poll);
640
641	sysctl_head_finish(head);
642
643	return 0;
644	}
645
646	static __poll_t proc_sys_poll(struct file *filp, poll_table *wait)
647	{
648	struct inode *inode = file_inode(f: filp);
649	struct ctl_table_header *head = grab_header(inode);
650	const struct ctl_table *table = PROC_I(inode)->sysctl_entry;
651	__poll_t ret = DEFAULT_POLLMASK;
652	unsigned long event;
653
654	/* sysctl was unregistered */
655	if (IS_ERR(ptr: head))
656	return EPOLLERR | EPOLLHUP;
657
658	if (!table->proc_handler)
659	goto out;
660
661	if (!table->poll)
662	goto out;
663
664	event = (unsigned long)filp->private_data;
665	poll_wait(filp, wait_address: &table->poll->wait, p: wait);
666
667	if (event != atomic_read(v: &table->poll->event)) {
668	filp->private_data = proc_sys_poll_event(poll: table->poll);
669	ret = EPOLLIN | EPOLLRDNORM | EPOLLERR | EPOLLPRI;
670	}
671
672	out:
673	sysctl_head_finish(head);
674
675	return ret;
676	}
677
678	static bool proc_sys_fill_cache(struct file *file,
679	struct dir_context *ctx,
680	struct ctl_table_header *head,
681	const struct ctl_table *table)
682	{
683	struct dentry *child, *dir = file->f_path.dentry;
684	struct inode *inode;
685	struct qstr qname;
686	ino_t ino = 0;
687	unsigned type = DT_UNKNOWN;
688
689	qname.name = table->procname;
690	qname.len = strlen(table->procname);
691	qname.hash = full_name_hash(salt: dir, qname.name, qname.len);
692
693	child = d_lookup(dir, &qname);
694	if (!child) {
695	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
696	child = d_alloc_parallel(dir, &qname, &wq);
697	if (IS_ERR(ptr: child))
698	return false;
699	if (d_in_lookup(dentry: child)) {
700	struct dentry *res;
701	inode = proc_sys_make_inode(sb: dir->d_sb, head, table);
702	res = d_splice_alias_ops(inode, child,
703	&proc_sys_dentry_operations);
704	d_lookup_done(dentry: child);
705	if (unlikely(res)) {
706	dput(child);
707
708	if (IS_ERR(ptr: res))
709	return false;
710
711	child = res;
712	}
713	}
714	}
715	inode = d_inode(dentry: child);
716	ino = inode->i_ino;
717	type = inode->i_mode >> 12;
718	dput(child);
719	return dir_emit(ctx, name: qname.name, namelen: qname.len, ino, type);
720	}
721
722	static bool proc_sys_link_fill_cache(struct file *file,
723	struct dir_context *ctx,
724	struct ctl_table_header *head,
725	const struct ctl_table *table)
726	{
727	bool ret = true;
728
729	head = sysctl_head_grab(head);
730	if (IS_ERR(ptr: head))
731	return false;
732
733	/* It is not an error if we can not follow the link ignore it */
734	if (sysctl_follow_link(phead: &head, pentry: &table))
735	goto out;
736
737	ret = proc_sys_fill_cache(file, ctx, head, table);
738	out:
739	sysctl_head_finish(head);
740	return ret;
741	}
742
743	static int scan(struct ctl_table_header *head, const struct ctl_table *table,
744	unsigned long *pos, struct file *file,
745	struct dir_context *ctx)
746	{
747	bool res;
748
749	if ((*pos)++ < ctx->pos)
750	return true;
751
752	if (unlikely(S_ISLNK(table->mode)))
753	res = proc_sys_link_fill_cache(file, ctx, head, table);
754	else
755	res = proc_sys_fill_cache(file, ctx, head, table);
756
757	if (res)
758	ctx->pos = *pos;
759
760	return res;
761	}
762
763	static int proc_sys_readdir(struct file *file, struct dir_context *ctx)
764	{
765	struct ctl_table_header *head = grab_header(inode: file_inode(f: file));
766	struct ctl_table_header *h = NULL;
767	const struct ctl_table *entry;
768	struct ctl_dir *ctl_dir;
769	unsigned long pos;
770
771	if (IS_ERR(ptr: head))
772	return PTR_ERR(ptr: head);
773
774	ctl_dir = container_of(head, struct ctl_dir, header);
775
776	if (!dir_emit_dots(file, ctx))
777	goto out;
778
779	pos = 2;
780
781	for (first_entry(dir: ctl_dir, phead: &h, pentry: &entry); h; next_entry(phead: &h, pentry: &entry)) {
782	if (!scan(head: h, table: entry, pos: &pos, file, ctx)) {
783	sysctl_head_finish(head: h);
784	break;
785	}
786	}
787	out:
788	sysctl_head_finish(head);
789	return 0;
790	}
791
792	static int proc_sys_permission(struct mnt_idmap *idmap,
793	struct inode *inode, int mask)
794	{
795	/*
796	* sysctl entries that are not writeable,
797	* are _NOT_ writeable, capabilities or not.
798	*/
799	struct ctl_table_header *head;
800	const struct ctl_table *table;
801	int error;
802
803	/* Executable files are not allowed under /proc/sys/ */
804	if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode))
805	return -EACCES;
806
807	head = grab_header(inode);
808	if (IS_ERR(ptr: head))
809	return PTR_ERR(ptr: head);
810
811	table = PROC_I(inode)->sysctl_entry;
812	if (!table) /* global root - r-xr-xr-x */
813	error = mask & MAY_WRITE ? -EACCES : 0;
814	else /* Use the permissions on the sysctl table entry */
815	error = sysctl_perm(head, table, op: mask & ~MAY_NOT_BLOCK);
816
817	sysctl_head_finish(head);
818	return error;
819	}
820
821	static int proc_sys_setattr(struct mnt_idmap *idmap,
822	struct dentry *dentry, struct iattr *attr)
823	{
824	struct inode *inode = d_inode(dentry);
825	int error;
826
827	if (attr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID))
828	return -EPERM;
829
830	error = setattr_prepare(&nop_mnt_idmap, dentry, attr);
831	if (error)
832	return error;
833
834	setattr_copy(&nop_mnt_idmap, inode, attr);
835	return 0;
836	}
837
838	static int proc_sys_getattr(struct mnt_idmap *idmap,
839	const struct path *path, struct kstat *stat,
840	u32 request_mask, unsigned int query_flags)
841	{
842	struct inode *inode = d_inode(dentry: path->dentry);
843	struct ctl_table_header *head = grab_header(inode);
844	const struct ctl_table *table = PROC_I(inode)->sysctl_entry;
845
846	if (IS_ERR(ptr: head))
847	return PTR_ERR(ptr: head);
848
849	generic_fillattr(&nop_mnt_idmap, request_mask, inode, stat);
850	if (table)
851	stat->mode = (stat->mode & S_IFMT) | table->mode;
852
853	sysctl_head_finish(head);
854	return 0;
855	}
856
857	static const struct file_operations proc_sys_file_operations = {
858	.open = proc_sys_open,
859	.poll = proc_sys_poll,
860	.read_iter = proc_sys_read,
861	.write_iter = proc_sys_write,
862	.splice_read = copy_splice_read,
863	.splice_write = iter_file_splice_write,
864	.llseek = default_llseek,
865	};
866
867	static const struct file_operations proc_sys_dir_file_operations = {
868	.read = generic_read_dir,
869	.iterate_shared = proc_sys_readdir,
870	.llseek = generic_file_llseek,
871	};
872
873	static const struct inode_operations proc_sys_inode_operations = {
874	.permission = proc_sys_permission,
875	.setattr = proc_sys_setattr,
876	.getattr = proc_sys_getattr,
877	};
878
879	static const struct inode_operations proc_sys_dir_operations = {
880	.lookup = proc_sys_lookup,
881	.permission = proc_sys_permission,
882	.setattr = proc_sys_setattr,
883	.getattr = proc_sys_getattr,
884	};
885
886	static int proc_sys_revalidate(struct inode *dir, const struct qstr *name,
887	struct dentry *dentry, unsigned int flags)
888	{
889	if (flags & LOOKUP_RCU)
890	return -ECHILD;
891	return !PROC_I(inode: d_inode(dentry))->sysctl->unregistering;
892	}
893
894	static int proc_sys_delete(const struct dentry *dentry)
895	{
896	return !!PROC_I(inode: d_inode(dentry))->sysctl->unregistering;
897	}
898
899	static int sysctl_is_seen(struct ctl_table_header *p)
900	{
901	struct ctl_table_set *set = p->set;
902	int res;
903	spin_lock(lock: &sysctl_lock);
904	if (p->unregistering)
905	res = 0;
906	else if (!set->is_seen)
907	res = 1;
908	else
909	res = set->is_seen(set);
910	spin_unlock(lock: &sysctl_lock);
911	return res;
912	}
913
914	static int proc_sys_compare(const struct dentry *dentry,
915	unsigned int len, const char *str, const struct qstr *name)
916	{
917	struct ctl_table_header *head;
918	struct inode *inode;
919
920	if (name->len != len)
921	return 1;
922	if (memcmp(p: name->name, q: str, size: len))
923	return 1;
924
925	// false positive is fine here - we'll recheck anyway
926	if (d_in_lookup(dentry))
927	return 0;
928
929	inode = d_inode_rcu(dentry);
930	// we just might have run into dentry in the middle of __dentry_kill()
931	if (!inode)
932	return 1;
933
934	head = READ_ONCE(PROC_I(inode)->sysctl);
935	return !head || !sysctl_is_seen(p: head);
936	}
937
938	static const struct dentry_operations proc_sys_dentry_operations = {
939	.d_revalidate = proc_sys_revalidate,
940	.d_delete = proc_sys_delete,
941	.d_compare = proc_sys_compare,
942	};
943
944	static struct ctl_dir *find_subdir(struct ctl_dir *dir,
945	const char *name, int namelen)
946	{
947	struct ctl_table_header *head;
948	const struct ctl_table *entry;
949
950	entry = find_entry(phead: &head, dir, name, namelen);
951	if (!entry)
952	return ERR_PTR(error: -ENOENT);
953	if (!S_ISDIR(entry->mode))
954	return ERR_PTR(error: -ENOTDIR);
955	return container_of(head, struct ctl_dir, header);
956	}
957
958	static struct ctl_dir *new_dir(struct ctl_table_set *set,
959	const char *name, int namelen)
960	{
961	struct ctl_table *table;
962	struct ctl_dir *new;
963	struct ctl_node *node;
964	char *new_name;
965
966	new = kzalloc(sizeof(*new) + sizeof(struct ctl_node) +
967	sizeof(struct ctl_table) + namelen + 1,
968	GFP_KERNEL);
969	if (!new)
970	return NULL;
971
972	node = (struct ctl_node *)(new + 1);
973	table = (struct ctl_table *)(node + 1);
974	new_name = (char *)(table + 1);
975	memcpy(new_name, name, namelen);
976	table[0].procname = new_name;
977	table[0].mode = S_IFDIR|S_IRUGO|S_IXUGO;
978	init_header(head: &new->header, root: set->dir.header.root, set, node, table, table_size: 1);
979
980	return new;
981	}
982
983	/**
984	* get_subdir - find or create a subdir with the specified name.
985	* @dir: Directory to create the subdirectory in
986	* @name: The name of the subdirectory to find or create
987	* @namelen: The length of name
988	*
989	* Takes a directory with an elevated reference count so we know that
990	* if we drop the lock the directory will not go away. Upon success
991	* the reference is moved from @dir to the returned subdirectory.
992	* Upon error an error code is returned and the reference on @dir is
993	* simply dropped.
994	*/
995	static struct ctl_dir *get_subdir(struct ctl_dir *dir,
996	const char *name, int namelen)
997	{
998	struct ctl_table_set *set = dir->header.set;
999	struct ctl_dir *subdir, *new = NULL;
1000	int err;
1001
1002	spin_lock(lock: &sysctl_lock);
1003	subdir = find_subdir(dir, name, namelen);
1004	if (!IS_ERR(ptr: subdir))
1005	goto found;
1006	if (PTR_ERR(ptr: subdir) != -ENOENT)
1007	goto failed;
1008
1009	spin_unlock(lock: &sysctl_lock);
1010	new = new_dir(set, name, namelen);
1011	spin_lock(lock: &sysctl_lock);
1012	subdir = ERR_PTR(error: -ENOMEM);
1013	if (!new)
1014	goto failed;
1015
1016	/* Was the subdir added while we dropped the lock? */
1017	subdir = find_subdir(dir, name, namelen);
1018	if (!IS_ERR(ptr: subdir))
1019	goto found;
1020	if (PTR_ERR(ptr: subdir) != -ENOENT)
1021	goto failed;
1022
1023	/* Nope. Use the our freshly made directory entry. */
1024	err = insert_header(dir, header: &new->header);
1025	subdir = ERR_PTR(error: err);
1026	if (err)
1027	goto failed;
1028	subdir = new;
1029	found:
1030	subdir->header.nreg++;
1031	failed:
1032	if (IS_ERR(ptr: subdir)) {
1033	pr_err("sysctl could not get directory: ");
1034	sysctl_print_dir(dir);
1035	pr_cont("%*.*s %ld\n", namelen, namelen, name,
1036	PTR_ERR(subdir));
1037	}
1038	drop_sysctl_table(header: &dir->header);
1039	if (new)
1040	drop_sysctl_table(header: &new->header);
1041	spin_unlock(lock: &sysctl_lock);
1042	return subdir;
1043	}
1044
1045	static struct ctl_dir *xlate_dir(struct ctl_table_set *set, struct ctl_dir *dir)
1046	{
1047	struct ctl_dir *parent;
1048	const char *procname;
1049	if (!dir->header.parent)
1050	return &set->dir;
1051	parent = xlate_dir(set, dir: dir->header.parent);
1052	if (IS_ERR(ptr: parent))
1053	return parent;
1054	procname = dir->header.ctl_table[0].procname;
1055	return find_subdir(dir: parent, name: procname, strlen(procname));
1056	}
1057
1058	static int sysctl_follow_link(struct ctl_table_header **phead,
1059	const struct ctl_table **pentry)
1060	{
1061	struct ctl_table_header *head;
1062	const struct ctl_table *entry;
1063	struct ctl_table_root *root;
1064	struct ctl_table_set *set;
1065	struct ctl_dir *dir;
1066	int ret;
1067
1068	spin_lock(lock: &sysctl_lock);
1069	root = (*pentry)->data;
1070	set = lookup_header_set(root);
1071	dir = xlate_dir(set, dir: (*phead)->parent);
1072	if (IS_ERR(ptr: dir))
1073	ret = PTR_ERR(ptr: dir);
1074	else {
1075	const char *procname = (*pentry)->procname;
1076	head = NULL;
1077	entry = find_entry(phead: &head, dir, name: procname, strlen(procname));
1078	ret = -ENOENT;
1079	if (entry && use_table(p: head)) {
1080	unuse_table(p: *phead);
1081	*phead = head;
1082	*pentry = entry;
1083	ret = 0;
1084	}
1085	}
1086
1087	spin_unlock(lock: &sysctl_lock);
1088	return ret;
1089	}
1090
1091	static int sysctl_err(const char *path, const struct ctl_table *table, char *fmt, ...)
1092	{
1093	struct va_format vaf;
1094	va_list args;
1095
1096	va_start(args, fmt);
1097	vaf.fmt = fmt;
1098	vaf.va = &args;
1099
1100	pr_err("sysctl table check failed: %s/%s %pV\n",
1101	path, table->procname, &vaf);
1102
1103	va_end(args);
1104	return -EINVAL;
1105	}
1106
1107	static int sysctl_check_table_array(const char *path, const struct ctl_table *table)
1108	{
1109	unsigned int extra;
1110	int err = 0;
1111
1112	if ((table->proc_handler == proc_douintvec) ||
1113	(table->proc_handler == proc_douintvec_minmax)) {
1114	if (table->maxlen != sizeof(unsigned int))
1115	err |= sysctl_err(path, table, fmt: "array not allowed");
1116	}
1117
1118	if (table->proc_handler == proc_dou8vec_minmax) {
1119	if (table->maxlen != sizeof(u8))
1120	err |= sysctl_err(path, table, fmt: "array not allowed");
1121
1122	if (table->extra1) {
1123	extra = *(unsigned int *) table->extra1;
1124	if (extra > 255U)
1125	err |= sysctl_err(path, table,
1126	fmt: "range value too large for proc_dou8vec_minmax");
1127	}
1128	if (table->extra2) {
1129	extra = *(unsigned int *) table->extra2;
1130	if (extra > 255U)
1131	err |= sysctl_err(path, table,
1132	fmt: "range value too large for proc_dou8vec_minmax");
1133	}
1134	}
1135
1136	if (table->proc_handler == proc_dobool) {
1137	if (table->maxlen != sizeof(bool))
1138	err |= sysctl_err(path, table, fmt: "array not allowed");
1139	}
1140
1141	return err;
1142	}
1143
1144	static int sysctl_check_table(const char *path, struct ctl_table_header *header)
1145	{
1146	const struct ctl_table *entry;
1147	int err = 0;
1148	list_for_each_table_entry(entry, header) {
1149	if (!entry->procname)
1150	err |= sysctl_err(path, table: entry, fmt: "procname is null");
1151	if ((entry->proc_handler == proc_dostring) ||
1152	(entry->proc_handler == proc_dobool) ||
1153	(entry->proc_handler == proc_dointvec) ||
1154	(entry->proc_handler == proc_douintvec) ||
1155	(entry->proc_handler == proc_douintvec_minmax) ||
1156	(entry->proc_handler == proc_dointvec_minmax) ||
1157	(entry->proc_handler == proc_dou8vec_minmax) ||
1158	(entry->proc_handler == proc_dointvec_jiffies) ||
1159	(entry->proc_handler == proc_dointvec_userhz_jiffies) ||
1160	(entry->proc_handler == proc_dointvec_ms_jiffies) ||
1161	(entry->proc_handler == proc_doulongvec_minmax) ||
1162	(entry->proc_handler == proc_doulongvec_ms_jiffies_minmax)) {
1163	if (!entry->data)
1164	err |= sysctl_err(path, table: entry, fmt: "No data");
1165	if (!entry->maxlen)
1166	err |= sysctl_err(path, table: entry, fmt: "No maxlen");
1167	else
1168	err |= sysctl_check_table_array(path, table: entry);
1169	}
1170	if (!entry->proc_handler)
1171	err |= sysctl_err(path, table: entry, fmt: "No proc_handler");
1172
1173	if ((entry->mode & (S_IRUGO|S_IWUGO)) != entry->mode)
1174	err |= sysctl_err(path, table: entry, fmt: "bogus .mode 0%o",
1175	entry->mode);
1176	}
1177	return err;
1178	}
1179
1180	static struct ctl_table_header *new_links(struct ctl_dir *dir, struct ctl_table_header *head)
1181	{
1182	struct ctl_table *link_table, *link;
1183	struct ctl_table_header *links;
1184	const struct ctl_table *entry;
1185	struct ctl_node *node;
1186	char *link_name;
1187	int name_bytes;
1188
1189	name_bytes = 0;
1190	list_for_each_table_entry(entry, head) {
1191	name_bytes += strlen(entry->procname) + 1;
1192	}
1193
1194	links = kzalloc(sizeof(struct ctl_table_header) +
1195	sizeof(struct ctl_node)*head->ctl_table_size +
1196	sizeof(struct ctl_table)*head->ctl_table_size +
1197	name_bytes,
1198	GFP_KERNEL);
1199
1200	if (!links)
1201	return NULL;
1202
1203	node = (struct ctl_node *)(links + 1);
1204	link_table = (struct ctl_table *)(node + head->ctl_table_size);
1205	link_name = (char *)(link_table + head->ctl_table_size);
1206	link = link_table;
1207
1208	list_for_each_table_entry(entry, head) {
1209	int len = strlen(entry->procname) + 1;
1210	memcpy(link_name, entry->procname, len);
1211	link->procname = link_name;
1212	link->mode = S_IFLNK|S_IRWXUGO;
1213	link->data = head->root;
1214	link_name += len;
1215	link++;
1216	}
1217	init_header(head: links, root: dir->header.root, set: dir->header.set, node, table: link_table,
1218	table_size: head->ctl_table_size);
1219	links->nreg = head->ctl_table_size;
1220
1221	return links;
1222	}
1223
1224	static bool get_links(struct ctl_dir *dir,
1225	struct ctl_table_header *header,
1226	struct ctl_table_root *link_root)
1227	{
1228	struct ctl_table_header *tmp_head;
1229	const struct ctl_table *entry, *link;
1230
1231	if (header->ctl_table_size == 0 ||
1232	sysctl_is_perm_empty_ctl_header(header))
1233	return true;
1234
1235	/* Are there links available for every entry in table? */
1236	list_for_each_table_entry(entry, header) {
1237	const char *procname = entry->procname;
1238	link = find_entry(phead: &tmp_head, dir, name: procname, strlen(procname));
1239	if (!link)
1240	return false;
1241	if (S_ISDIR(link->mode) && S_ISDIR(entry->mode))
1242	continue;
1243	if (S_ISLNK(link->mode) && (link->data == link_root))
1244	continue;
1245	return false;
1246	}
1247
1248	/* The checks passed. Increase the registration count on the links */
1249	list_for_each_table_entry(entry, header) {
1250	const char *procname = entry->procname;
1251	link = find_entry(phead: &tmp_head, dir, name: procname, strlen(procname));
1252	tmp_head->nreg++;
1253	}
1254	return true;
1255	}
1256
1257	static int insert_links(struct ctl_table_header *head)
1258	{
1259	struct ctl_table_set *root_set = &sysctl_table_root.default_set;
1260	struct ctl_dir *core_parent;
1261	struct ctl_table_header *links;
1262	int err;
1263
1264	if (head->set == root_set)
1265	return 0;
1266
1267	core_parent = xlate_dir(set: root_set, dir: head->parent);
1268	if (IS_ERR(ptr: core_parent))
1269	return 0;
1270
1271	if (get_links(dir: core_parent, header: head, link_root: head->root))
1272	return 0;
1273
1274	core_parent->header.nreg++;
1275	spin_unlock(lock: &sysctl_lock);
1276
1277	links = new_links(dir: core_parent, head);
1278
1279	spin_lock(lock: &sysctl_lock);
1280	err = -ENOMEM;
1281	if (!links)
1282	goto out;
1283
1284	err = 0;
1285	if (get_links(dir: core_parent, header: head, link_root: head->root)) {
1286	kfree(objp: links);
1287	goto out;
1288	}
1289
1290	err = insert_header(dir: core_parent, header: links);
1291	if (err)
1292	kfree(objp: links);
1293	out:
1294	drop_sysctl_table(header: &core_parent->header);
1295	return err;
1296	}
1297
1298	/* Find the directory for the ctl_table. If one is not found create it. */
1299	static struct ctl_dir *sysctl_mkdir_p(struct ctl_dir *dir, const char *path)
1300	{
1301	const char *name, *nextname;
1302
1303	for (name = path; name; name = nextname) {
1304	int namelen;
1305	nextname = strchr(name, '/');
1306	if (nextname) {
1307	namelen = nextname - name;
1308	nextname++;
1309	} else {
1310	namelen = strlen(name);
1311	}
1312	if (namelen == 0)
1313	continue;
1314
1315	/*
1316	* namelen ensures if name is "foo/bar/yay" only foo is
1317	* registered first. We traverse as if using mkdir -p and
1318	* return a ctl_dir for the last directory entry.
1319	*/
1320	dir = get_subdir(dir, name, namelen);
1321	if (IS_ERR(ptr: dir))
1322	break;
1323	}
1324	return dir;
1325	}
1326
1327	/**
1328	* __register_sysctl_table - register a leaf sysctl table
1329	* @set: Sysctl tree to register on
1330	* @path: The path to the directory the sysctl table is in.
1331	*
1332	* @table: the top-level table structure. This table should not be free'd
1333	* after registration. So it should not be used on stack. It can either
1334	* be a global or dynamically allocated by the caller and free'd later
1335	* after sysctl unregistration.
1336	* @table_size : The number of elements in table
1337	*
1338	* Register a sysctl table hierarchy. @table should be a filled in ctl_table
1339	* array.
1340	*
1341	* The members of the &struct ctl_table structure are used as follows:
1342	* procname - the name of the sysctl file under /proc/sys. Set to %NULL to not
1343	* enter a sysctl file
1344	* data - a pointer to data for use by proc_handler
1345	* maxlen - the maximum size in bytes of the data
1346	* mode - the file permissions for the /proc/sys file
1347	* type - Defines the target type (described in struct definition)
1348	* proc_handler - the text handler routine (described below)
1349	*
1350	* extra1, extra2 - extra pointers usable by the proc handler routines
1351	* XXX: we should eventually modify these to use long min / max [0]
1352	* [0] https://lkml.kernel.org/87zgpte9o4.fsf@email.froward.int.ebiederm.org
1353	*
1354	* Leaf nodes in the sysctl tree will be represented by a single file
1355	* under /proc; non-leaf nodes are not allowed.
1356	*
1357	* There must be a proc_handler routine for any terminal nodes.
1358	* Several default handlers are available to cover common cases -
1359	*
1360	* proc_dostring(), proc_dointvec(), proc_dointvec_jiffies(),
1361	* proc_dointvec_userhz_jiffies(), proc_dointvec_minmax(),
1362	* proc_doulongvec_ms_jiffies_minmax(), proc_doulongvec_minmax()
1363	*
1364	* It is the handler's job to read the input buffer from user memory
1365	* and process it. The handler should return 0 on success.
1366	*
1367	* This routine returns %NULL on a failure to register, and a pointer
1368	* to the table header on success.
1369	*/
1370	struct ctl_table_header *__register_sysctl_table(
1371	struct ctl_table_set *set,
1372	const char *path, const struct ctl_table *table, size_t table_size)
1373	{
1374	struct ctl_table_root *root = set->dir.header.root;
1375	struct ctl_table_header *header;
1376	struct ctl_dir *dir;
1377	struct ctl_node *node;
1378
1379	header = kzalloc(sizeof(struct ctl_table_header) +
1380	sizeof(struct ctl_node)*table_size, GFP_KERNEL_ACCOUNT);
1381	if (!header)
1382	return NULL;
1383
1384	node = (struct ctl_node *)(header + 1);
1385	init_header(head: header, root, set, node, table, table_size);
1386	if (sysctl_check_table(path, header))
1387	goto fail;
1388
1389	spin_lock(lock: &sysctl_lock);
1390	dir = &set->dir;
1391	/* Reference moved down the directory tree get_subdir */
1392	dir->header.nreg++;
1393	spin_unlock(lock: &sysctl_lock);
1394
1395	dir = sysctl_mkdir_p(dir, path);
1396	if (IS_ERR(ptr: dir))
1397	goto fail;
1398	spin_lock(lock: &sysctl_lock);
1399	if (insert_header(dir, header))
1400	goto fail_put_dir_locked;
1401
1402	drop_sysctl_table(header: &dir->header);
1403	spin_unlock(lock: &sysctl_lock);
1404
1405	return header;
1406
1407	fail_put_dir_locked:
1408	drop_sysctl_table(header: &dir->header);
1409	spin_unlock(lock: &sysctl_lock);
1410	fail:
1411	kfree(objp: header);
1412	return NULL;
1413	}
1414
1415	/**
1416	* register_sysctl_sz - register a sysctl table
1417	* @path: The path to the directory the sysctl table is in. If the path
1418	* doesn't exist we will create it for you.
1419	* @table: the table structure. The calller must ensure the life of the @table
1420	* will be kept during the lifetime use of the syctl. It must not be freed
1421	* until unregister_sysctl_table() is called with the given returned table
1422	* with this registration. If your code is non modular then you don't need
1423	* to call unregister_sysctl_table() and can instead use something like
1424	* register_sysctl_init() which does not care for the result of the syctl
1425	* registration.
1426	* @table_size: The number of elements in table.
1427	*
1428	* Register a sysctl table. @table should be a filled in ctl_table
1429	* array. A completely 0 filled entry terminates the table.
1430	*
1431	* See __register_sysctl_table for more details.
1432	*/
1433	struct ctl_table_header *register_sysctl_sz(const char *path, const struct ctl_table *table,
1434	size_t table_size)
1435	{
1436	return __register_sysctl_table(set: &sysctl_table_root.default_set,
1437	path, table, table_size);
1438	}
1439	EXPORT_SYMBOL(register_sysctl_sz);
1440
1441	/**
1442	* __register_sysctl_init() - register sysctl table to path
1443	* @path: path name for sysctl base. If that path doesn't exist we will create
1444	* it for you.
1445	* @table: This is the sysctl table that needs to be registered to the path.
1446	* The caller must ensure the life of the @table will be kept during the
1447	* lifetime use of the sysctl.
1448	* @table_name: The name of sysctl table, only used for log printing when
1449	* registration fails
1450	* @table_size: The number of elements in table
1451	*
1452	* The sysctl interface is used by userspace to query or modify at runtime
1453	* a predefined value set on a variable. These variables however have default
1454	* values pre-set. Code which depends on these variables will always work even
1455	* if register_sysctl() fails. If register_sysctl() fails you'd just loose the
1456	* ability to query or modify the sysctls dynamically at run time. Chances of
1457	* register_sysctl() failing on init are extremely low, and so for both reasons
1458	* this function does not return any error as it is used by initialization code.
1459	*
1460	* Context: if your base directory does not exist it will be created for you.
1461	*/
1462	void __init __register_sysctl_init(const char *path, const struct ctl_table *table,
1463	const char *table_name, size_t table_size)
1464	{
1465	struct ctl_table_header *hdr = register_sysctl_sz(path, table, table_size);
1466
1467	if (unlikely(!hdr)) {
1468	pr_err("failed when register_sysctl_sz %s to %s\n", table_name, path);
1469	return;
1470	}
1471	kmemleak_not_leak(ptr: hdr);
1472	}
1473
1474	static void put_links(struct ctl_table_header *header)
1475	{
1476	struct ctl_table_set *root_set = &sysctl_table_root.default_set;
1477	struct ctl_table_root *root = header->root;
1478	struct ctl_dir *parent = header->parent;
1479	struct ctl_dir *core_parent;
1480	const struct ctl_table *entry;
1481
1482	if (header->set == root_set)
1483	return;
1484
1485	core_parent = xlate_dir(set: root_set, dir: parent);
1486	if (IS_ERR(ptr: core_parent))
1487	return;
1488
1489	list_for_each_table_entry(entry, header) {
1490	struct ctl_table_header *link_head;
1491	const struct ctl_table *link;
1492	const char *name = entry->procname;
1493
1494	link = find_entry(phead: &link_head, dir: core_parent, name, strlen(name));
1495	if (link &&
1496	((S_ISDIR(link->mode) && S_ISDIR(entry->mode)) ||
1497	(S_ISLNK(link->mode) && (link->data == root)))) {
1498	drop_sysctl_table(header: link_head);
1499	}
1500	else {
1501	pr_err("sysctl link missing during unregister: ");
1502	sysctl_print_dir(dir: parent);
1503	pr_cont("%s\n", name);
1504	}
1505	}
1506	}
1507
1508	static void drop_sysctl_table(struct ctl_table_header *header)
1509	{
1510	struct ctl_dir *parent = header->parent;
1511
1512	if (--header->nreg)
1513	return;
1514
1515	if (parent) {
1516	put_links(header);
1517	start_unregistering(p: header);
1518	}
1519
1520	if (!--header->count)
1521	kfree_rcu(header, rcu);
1522
1523	if (parent)
1524	drop_sysctl_table(header: &parent->header);
1525	}
1526
1527	/**
1528	* unregister_sysctl_table - unregister a sysctl table hierarchy
1529	* @header: the header returned from register_sysctl or __register_sysctl_table
1530	*
1531	* Unregisters the sysctl table and all children. proc entries may not
1532	* actually be removed until they are no longer used by anyone.
1533	*/
1534	void unregister_sysctl_table(struct ctl_table_header * header)
1535	{
1536	might_sleep();
1537
1538	if (header == NULL)
1539	return;
1540
1541	spin_lock(lock: &sysctl_lock);
1542	drop_sysctl_table(header);
1543	spin_unlock(lock: &sysctl_lock);
1544	}
1545	EXPORT_SYMBOL(unregister_sysctl_table);
1546
1547	void setup_sysctl_set(struct ctl_table_set *set,
1548	struct ctl_table_root *root,
1549	int (*is_seen)(struct ctl_table_set *))
1550	{
1551	memset(set, 0, sizeof(*set));
1552	set->is_seen = is_seen;
1553	init_header(head: &set->dir.header, root, set, NULL, table: root_table, table_size: 1);
1554	}
1555
1556	void retire_sysctl_set(struct ctl_table_set *set)
1557	{
1558	WARN_ON(!RB_EMPTY_ROOT(&set->dir.root));
1559	}
1560
1561	int __init proc_sys_init(void)
1562	{
1563	struct proc_dir_entry *proc_sys_root;
1564
1565	proc_sys_root = proc_mkdir("sys", NULL);
1566	proc_sys_root->proc_iops = &proc_sys_dir_operations;
1567	proc_sys_root->proc_dir_ops = &proc_sys_dir_file_operations;
1568	proc_sys_root->nlink = 0;
1569
1570	return sysctl_init_bases();
1571	}
1572
1573	struct sysctl_alias {
1574	const char *kernel_param;
1575	const char *sysctl_param;
1576	};
1577
1578	/*
1579	* Historically some settings had both sysctl and a command line parameter.
1580	* With the generic sysctl. parameter support, we can handle them at a single
1581	* place and only keep the historical name for compatibility. This is not meant
1582	* to add brand new aliases. When adding existing aliases, consider whether
1583	* the possibly different moment of changing the value (e.g. from early_param
1584	* to the moment do_sysctl_args() is called) is an issue for the specific
1585	* parameter.
1586	*/
1587	static const struct sysctl_alias sysctl_aliases[] = {
1588	{"hardlockup_all_cpu_backtrace", "kernel.hardlockup_all_cpu_backtrace" },
1589	{"hung_task_panic", "kernel.hung_task_panic" },
1590	{"numa_zonelist_order", "vm.numa_zonelist_order" },
1591	{"softlockup_all_cpu_backtrace", "kernel.softlockup_all_cpu_backtrace" },
1592	{ }
1593	};
1594
1595	static const char *sysctl_find_alias(char *param)
1596	{
1597	const struct sysctl_alias *alias;
1598
1599	for (alias = &sysctl_aliases[0]; alias->kernel_param != NULL; alias++) {
1600	if (strcmp(alias->kernel_param, param) == 0)
1601	return alias->sysctl_param;
1602	}
1603
1604	return NULL;
1605	}
1606
1607	bool sysctl_is_alias(char *param)
1608	{
1609	const char *alias = sysctl_find_alias(param);
1610
1611	return alias != NULL;
1612	}
1613
1614	/* Set sysctl value passed on kernel command line. */
1615	static int process_sysctl_arg(char *param, char *val,
1616	const char *unused, void *arg)
1617	{
1618	char *path;
1619	struct vfsmount **proc_mnt = arg;
1620	struct file_system_type *proc_fs_type;
1621	struct file *file;
1622	int len;
1623	int err;
1624	loff_t pos = 0;
1625	ssize_t wret;
1626
1627	if (strncmp(param, "sysctl", sizeof("sysctl") - 1) == 0) {
1628	param += sizeof("sysctl") - 1;
1629
1630	if (param[0] != '/' && param[0] != '.')
1631	return 0;
1632
1633	param++;
1634	} else {
1635	param = (char *) sysctl_find_alias(param);
1636	if (!param)
1637	return 0;
1638	}
1639
1640	if (!val)
1641	return -EINVAL;
1642	len = strlen(val);
1643	if (len == 0)
1644	return -EINVAL;
1645
1646	/*
1647	* To set sysctl options, we use a temporary mount of proc, look up the
1648	* respective sys/ file and write to it. To avoid mounting it when no
1649	* options were given, we mount it only when the first sysctl option is
1650	* found. Why not a persistent mount? There are problems with a
1651	* persistent mount of proc in that it forces userspace not to use any
1652	* proc mount options.
1653	*/
1654	if (!*proc_mnt) {
1655	proc_fs_type = get_fs_type(name: "proc");
1656	if (!proc_fs_type) {
1657	pr_err("Failed to find procfs to set sysctl from command line\n");
1658	return 0;
1659	}
1660	*proc_mnt = kern_mount(proc_fs_type);
1661	put_filesystem(fs: proc_fs_type);
1662	if (IS_ERR(ptr: *proc_mnt)) {
1663	pr_err("Failed to mount procfs to set sysctl from command line\n");
1664	return 0;
1665	}
1666	}
1667
1668	path = kasprintf(GFP_KERNEL, fmt: "sys/%s", param);
1669	if (!path)
1670	panic(fmt: "%s: Failed to allocate path for %s\n", __func__, param);
1671	strreplace(str: path, old: '.', new: '/');
1672
1673	file = file_open_root_mnt(mnt: *proc_mnt, name: path, O_WRONLY, mode: 0);
1674	if (IS_ERR(ptr: file)) {
1675	err = PTR_ERR(ptr: file);
1676	if (err == -ENOENT)
1677	pr_err("Failed to set sysctl parameter '%s=%s': parameter not found\n",
1678	param, val);
1679	else if (err == -EACCES)
1680	pr_err("Failed to set sysctl parameter '%s=%s': permission denied (read-only?)\n",
1681	param, val);
1682	else
1683	pr_err("Error %pe opening proc file to set sysctl parameter '%s=%s'\n",
1684	file, param, val);
1685	goto out;
1686	}
1687	wret = kernel_write(file, val, len, &pos);
1688	if (wret < 0) {
1689	err = wret;
1690	if (err == -EINVAL)
1691	pr_err("Failed to set sysctl parameter '%s=%s': invalid value\n",
1692	param, val);
1693	else
1694	pr_err("Error %pe writing to proc file to set sysctl parameter '%s=%s'\n",
1695	ERR_PTR(err), param, val);
1696	} else if (wret != len) {
1697	pr_err("Wrote only %zd bytes of %d writing to proc file %s to set sysctl parameter '%s=%s\n",
1698	wret, len, path, param, val);
1699	}
1700
1701	err = filp_close(file, NULL);
1702	if (err)
1703	pr_err("Error %pe closing proc file to set sysctl parameter '%s=%s\n",
1704	ERR_PTR(err), param, val);
1705	out:
1706	kfree(objp: path);
1707	return 0;
1708	}
1709
1710	void do_sysctl_args(void)
1711	{
1712	char *command_line;
1713	struct vfsmount *proc_mnt = NULL;
1714
1715	command_line = kstrdup(s: saved_command_line, GFP_KERNEL);
1716	if (!command_line)
1717	panic(fmt: "%s: Failed to allocate copy of command line\n", __func__);
1718
1719	parse_args(name: "Setting sysctl args", args: command_line,
1720	NULL, num: 0, level_min: -1, level_max: -1, arg: &proc_mnt, unknown: process_sysctl_arg);
1721
1722	if (proc_mnt)
1723	kern_unmount(mnt: proc_mnt);
1724
1725	kfree(objp: command_line);
1726	}
1727