개념 설명 전체 · v6.6 / fs/namei.c
1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/fs/namei.c 4 * 5 * Copyright (C) 1991, 1992 Linus Torvalds 6 */ 7 8 /* 9 * Some corrections by tytso. 10 */ 11 12 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname 13 * lookup logic. 14 */ 15 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture. 16 */ 17 18 #include <linux/init.h> 19 #include <linux/export.h> 20 #include <linux/kernel.h> 21 #include <linux/slab.h> 22 #include <linux/fs.h> 23 #include <linux/filelock.h> 24 #include <linux/namei.h> 25 #include <linux/pagemap.h> 26 #include <linux/sched/mm.h> 27 #include <linux/fsnotify.h> 28 #include <linux/personality.h> 29 #include <linux/security.h> 30 #include <linux/ima.h> 31 #include <linux/syscalls.h> 32 #include <linux/mount.h> 33 #include <linux/audit.h> 34 #include <linux/capability.h> 35 #include <linux/file.h> 36 #include <linux/fcntl.h> 37 #include <linux/device_cgroup.h> 38 #include <linux/fs_struct.h> 39 #include <linux/posix_acl.h> 40 #include <linux/hash.h> 41 #include <linux/bitops.h> 42 #include <linux/init_task.h> 43 #include <linux/uaccess.h> 44 45 #include "internal.h" 46 #include "mount.h" 47 48 /* [Feb-1997 T. Schoebel-Theuer] 49 * Fundamental changes in the pathname lookup mechanisms (namei) 50 * were necessary because of omirr. The reason is that omirr needs 51 * to know the _real_ pathname, not the user-supplied one, in case 52 * of symlinks (and also when transname replacements occur). 53 * 54 * The new code replaces the old recursive symlink resolution with 55 * an iterative one (in case of non-nested symlink chains). It does 56 * this with calls to <fs>_follow_link(). 57 * As a side effect, dir_namei(), _namei() and follow_link() are now 58 * replaced with a single function lookup_dentry() that can handle all 59 * the special cases of the former code. 60 * 61 * With the new dcache, the pathname is stored at each inode, at least as 62 * long as the refcount of the inode is positive. As a side effect, the 63 * size of the dcache depends on the inode cache and thus is dynamic. 64 * 65 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink 66 * resolution to correspond with current state of the code. 67 * 68 * Note that the symlink resolution is not *completely* iterative. 69 * There is still a significant amount of tail- and mid- recursion in 70 * the algorithm. Also, note that <fs>_readlink() is not used in 71 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink() 72 * may return different results than <fs>_follow_link(). Many virtual 73 * filesystems (including /proc) exhibit this behavior. 74 */ 75 76 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation: 77 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL 78 * and the name already exists in form of a symlink, try to create the new 79 * name indicated by the symlink. The old code always complained that the 80 * name already exists, due to not following the symlink even if its target 81 * is nonexistent. The new semantics affects also mknod() and link() when 82 * the name is a symlink pointing to a non-existent name. 83 * 84 * I don't know which semantics is the right one, since I have no access 85 * to standards. But I found by trial that HP-UX 9.0 has the full "new" 86 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the 87 * "old" one. Personally, I think the new semantics is much more logical. 88 * Note that "ln old new" where "new" is a symlink pointing to a non-existing 89 * file does succeed in both HP-UX and SunOs, but not in Solaris 90 * and in the old Linux semantics. 91 */ 92 93 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink 94 * semantics. See the comments in "open_namei" and "do_link" below. 95 * 96 * [10-Sep-98 Alan Modra] Another symlink change. 97 */ 98 99 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks: 100 * inside the path - always follow. 101 * in the last component in creation/removal/renaming - never follow. 102 * if LOOKUP_FOLLOW passed - follow. 103 * if the pathname has trailing slashes - follow. 104 * otherwise - don't follow. 105 * (applied in that order). 106 * 107 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT 108 * restored for 2.4. This is the last surviving part of old 4.2BSD bug. 109 * During the 2.4 we need to fix the userland stuff depending on it - 110 * hopefully we will be able to get rid of that wart in 2.5. So far only 111 * XEmacs seems to be relying on it... 112 */ 113 /* 114 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland) 115 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives 116 * any extra contention... 117 */ 118 119 /* In order to reduce some races, while at the same time doing additional 120 * checking and hopefully speeding things up, we copy filenames to the 121 * kernel data space before using them.. 122 * 123 * POSIX.1 2.4: an empty pathname is invalid (ENOENT). 124 * PATH_MAX includes the nul terminator --RR. 125 */ 126 127 #define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname)) 128 129 struct filename * 130 getname_flags(const char __user *filename, int flags, int *empty) 131 { 132 struct filename *result; 133 char *kname; 134 int len; 135 136 result = audit_reusename(filename); 137 if (result) 138 return result; 139 140 result = __getname(); 141 if (unlikely(!result)) 142 return ERR_PTR(-ENOMEM); 143 144 /* 145 * First, try to embed the struct filename inside the names_cache 146 * allocation 147 */ 148 kname = (char *)result->iname; 149 result->name = kname; 150 151 len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX); 152 if (unlikely(len < 0)) { 153 __putname(result); 154 return ERR_PTR(len); 155 } 156 157 /* 158 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a 159 * separate struct filename so we can dedicate the entire 160 * names_cache allocation for the pathname, and re-do the copy from 161 * userland. 162 */ 163 if (unlikely(len == EMBEDDED_NAME_MAX)) { 164 const size_t size = offsetof(struct filename, iname[1]); 165 kname = (char *)result; 166 167 /* 168 * size is chosen that way we to guarantee that 169 * result->iname[0] is within the same object and that 170 * kname can't be equal to result->iname, no matter what. 171 */ 172 result = kzalloc(size, GFP_KERNEL); 173 if (unlikely(!result)) { 174 __putname(kname); 175 return ERR_PTR(-ENOMEM); 176 } 177 result->name = kname; 178 len = strncpy_from_user(kname, filename, PATH_MAX); 179 if (unlikely(len < 0)) { 180 __putname(kname); 181 kfree(result); 182 return ERR_PTR(len); 183 } 184 if (unlikely(len == PATH_MAX)) { 185 __putname(kname); 186 kfree(result); 187 return ERR_PTR(-ENAMETOOLONG); 188 } 189 } 190 191 atomic_set(&result->refcnt, 1); 192 /* The empty path is special. */ 193 if (unlikely(!len)) { 194 if (empty) 195 *empty = 1; 196 if (!(flags & LOOKUP_EMPTY)) { 197 putname(result); 198 return ERR_PTR(-ENOENT); 199 } 200 } 201 202 result->uptr = filename; 203 result->aname = NULL; 204 audit_getname(result); 205 return result; 206 } 207 208 struct filename * 209 getname_uflags(const char __user *filename, int uflags) 210 { 211 int flags = (uflags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0; 212 213 return getname_flags(filename, flags, NULL); 214 } 215 216 struct filename * 217 getname(const char __user * filename) 218 { 219 return getname_flags(filename, 0, NULL); 220 } 221 222 struct filename * 223 getname_kernel(const char * filename) 224 { 225 struct filename *result; 226 int len = strlen(filename) + 1; 227 228 result = __getname(); 229 if (unlikely(!result)) 230 return ERR_PTR(-ENOMEM); 231 232 if (len <= EMBEDDED_NAME_MAX) { 233 result->name = (char *)result->iname; 234 } else if (len <= PATH_MAX) { 235 const size_t size = offsetof(struct filename, iname[1]); 236 struct filename *tmp; 237 238 tmp = kmalloc(size, GFP_KERNEL); 239 if (unlikely(!tmp)) { 240 __putname(result); 241 return ERR_PTR(-ENOMEM); 242 } 243 tmp->name = (char *)result; 244 result = tmp; 245 } else { 246 __putname(result); 247 return ERR_PTR(-ENAMETOOLONG); 248 } 249 memcpy((char *)result->name, filename, len); 250 result->uptr = NULL; 251 result->aname = NULL; 252 atomic_set(&result->refcnt, 1); 253 audit_getname(result); 254 255 return result; 256 } 257 EXPORT_SYMBOL(getname_kernel); 258 259 void putname(struct filename *name) 260 { 261 if (IS_ERR(name)) 262 return; 263 264 if (WARN_ON_ONCE(!atomic_read(&name->refcnt))) 265 return; 266 267 if (!atomic_dec_and_test(&name->refcnt)) 268 return; 269 270 if (name->name != name->iname) { 271 __putname(name->name); 272 kfree(name); 273 } else 274 __putname(name); 275 } 276 EXPORT_SYMBOL(putname); 277 278 /** 279 * check_acl - perform ACL permission checking 280 * @idmap: idmap of the mount the inode was found from 281 * @inode: inode to check permissions on 282 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...) 283 * 284 * This function performs the ACL permission checking. Since this function 285 * retrieve POSIX acls it needs to know whether it is called from a blocking or 286 * non-blocking context and thus cares about the MAY_NOT_BLOCK bit. 287 * 288 * If the inode has been found through an idmapped mount the idmap of 289 * the vfsmount must be passed through @idmap. This function will then take 290 * care to map the inode according to @idmap before checking permissions. 291 * On non-idmapped mounts or if permission checking is to be performed on the 292 * raw inode simply passs @nop_mnt_idmap. 293 */ 294 static int check_acl(struct mnt_idmap *idmap, 295 struct inode *inode, int mask) 296 { 297 #ifdef CONFIG_FS_POSIX_ACL 298 struct posix_acl *acl; 299 300 if (mask & MAY_NOT_BLOCK) { 301 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS); 302 if (!acl) 303 return -EAGAIN; 304 /* no ->get_inode_acl() calls in RCU mode... */ 305 if (is_uncached_acl(acl)) 306 return -ECHILD; 307 return posix_acl_permission(idmap, inode, acl, mask); 308 } 309 310 acl = get_inode_acl(inode, ACL_TYPE_ACCESS); 311 if (IS_ERR(acl)) 312 return PTR_ERR(acl); 313 if (acl) { 314 int error = posix_acl_permission(idmap, inode, acl, mask); 315 posix_acl_release(acl); 316 return error; 317 } 318 #endif 319 320 return -EAGAIN; 321 } 322 323 /** 324 * acl_permission_check - perform basic UNIX permission checking 325 * @idmap: idmap of the mount the inode was found from 326 * @inode: inode to check permissions on 327 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...) 328 * 329 * This function performs the basic UNIX permission checking. Since this 330 * function may retrieve POSIX acls it needs to know whether it is called from a 331 * blocking or non-blocking context and thus cares about the MAY_NOT_BLOCK bit. 332 * 333 * If the inode has been found through an idmapped mount the idmap of 334 * the vfsmount must be passed through @idmap. This function will then take 335 * care to map the inode according to @idmap before checking permissions. 336 * On non-idmapped mounts or if permission checking is to be performed on the 337 * raw inode simply passs @nop_mnt_idmap. 338 */ 339 static int acl_permission_check(struct mnt_idmap *idmap, 340 struct inode *inode, int mask) 341 { 342 unsigned int mode = inode->i_mode; 343 vfsuid_t vfsuid; 344 345 /* Are we the owner? If so, ACL's don't matter */ 346 vfsuid = i_uid_into_vfsuid(idmap, inode); 347 if (likely(vfsuid_eq_kuid(vfsuid, current_fsuid()))) { 348 mask &= 7; 349 mode >>= 6; 350 return (mask & ~mode) ? -EACCES : 0; 351 } 352 353 /* Do we have ACL's? */ 354 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { 355 int error = check_acl(idmap, inode, mask); 356 if (error != -EAGAIN) 357 return error; 358 } 359 360 /* Only RWX matters for group/other mode bits */ 361 mask &= 7; 362 363 /* 364 * Are the group permissions different from 365 * the other permissions in the bits we care 366 * about? Need to check group ownership if so. 367 */ 368 if (mask & (mode ^ (mode >> 3))) { 369 vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode); 370 if (vfsgid_in_group_p(vfsgid)) 371 mode >>= 3; 372 } 373 374 /* Bits in 'mode' clear that we require? */ 375 return (mask & ~mode) ? -EACCES : 0; 376 } 377 378 /** 379 * generic_permission - check for access rights on a Posix-like filesystem 380 * @idmap: idmap of the mount the inode was found from 381 * @inode: inode to check access rights for 382 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, 383 * %MAY_NOT_BLOCK ...) 384 * 385 * Used to check for read/write/execute permissions on a file. 386 * We use "fsuid" for this, letting us set arbitrary permissions 387 * for filesystem access without changing the "normal" uids which 388 * are used for other things. 389 * 390 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk 391 * request cannot be satisfied (eg. requires blocking or too much complexity). 392 * It would then be called again in ref-walk mode. 393 * 394 * If the inode has been found through an idmapped mount the idmap of 395 * the vfsmount must be passed through @idmap. This function will then take 396 * care to map the inode according to @idmap before checking permissions. 397 * On non-idmapped mounts or if permission checking is to be performed on the 398 * raw inode simply passs @nop_mnt_idmap. 399 */ 400 int generic_permission(struct mnt_idmap *idmap, struct inode *inode, 401 int mask) 402 { 403 int ret; 404 405 /* 406 * Do the basic permission checks. 407 */ 408 ret = acl_permission_check(idmap, inode, mask); 409 if (ret != -EACCES) 410 return ret; 411 412 if (S_ISDIR(inode->i_mode)) { 413 /* DACs are overridable for directories */ 414 if (!(mask & MAY_WRITE)) 415 if (capable_wrt_inode_uidgid(idmap, inode, 416 CAP_DAC_READ_SEARCH)) 417 return 0; 418 if (capable_wrt_inode_uidgid(idmap, inode, 419 CAP_DAC_OVERRIDE)) 420 return 0; 421 return -EACCES; 422 } 423 424 /* 425 * Searching includes executable on directories, else just read. 426 */ 427 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 428 if (mask == MAY_READ) 429 if (capable_wrt_inode_uidgid(idmap, inode, 430 CAP_DAC_READ_SEARCH)) 431 return 0; 432 /* 433 * Read/write DACs are always overridable. 434 * Executable DACs are overridable when there is 435 * at least one exec bit set. 436 */ 437 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 438 if (capable_wrt_inode_uidgid(idmap, inode, 439 CAP_DAC_OVERRIDE)) 440 return 0; 441 442 return -EACCES; 443 } 444 EXPORT_SYMBOL(generic_permission); 445 446 /** 447 * do_inode_permission - UNIX permission checking 448 * @idmap: idmap of the mount the inode was found from 449 * @inode: inode to check permissions on 450 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...) 451 * 452 * We _really_ want to just do "generic_permission()" without 453 * even looking at the inode->i_op values. So we keep a cache 454 * flag in inode->i_opflags, that says "this has not special 455 * permission function, use the fast case". 456 */ 457 static inline int do_inode_permission(struct mnt_idmap *idmap, 458 struct inode *inode, int mask) 459 { 460 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) { 461 if (likely(inode->i_op->permission)) 462 return inode->i_op->permission(idmap, inode, mask); 463 464 /* This gets set once for the inode lifetime */ 465 spin_lock(&inode->i_lock); 466 inode->i_opflags |= IOP_FASTPERM; 467 spin_unlock(&inode->i_lock); 468 } 469 return generic_permission(idmap, inode, mask); 470 } 471 472 /** 473 * sb_permission - Check superblock-level permissions 474 * @sb: Superblock of inode to check permission on 475 * @inode: Inode to check permission on 476 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 477 * 478 * Separate out file-system wide checks from inode-specific permission checks. 479 */ 480 static int sb_permission(struct super_block *sb, struct inode *inode, int mask) 481 { 482 if (unlikely(mask & MAY_WRITE)) { 483 umode_t mode = inode->i_mode; 484 485 /* Nobody gets write access to a read-only fs. */ 486 if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) 487 return -EROFS; 488 } 489 return 0; 490 } 491 492 /** 493 * inode_permission - Check for access rights to a given inode 494 * @idmap: idmap of the mount the inode was found from 495 * @inode: Inode to check permission on 496 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 497 * 498 * Check for read/write/execute permissions on an inode. We use fs[ug]id for 499 * this, letting us set arbitrary permissions for filesystem access without 500 * changing the "normal" UIDs which are used for other things. 501 * 502 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 503 */ 504 int inode_permission(struct mnt_idmap *idmap, 505 struct inode *inode, int mask) 506 { 507 int retval; 508 509 retval = sb_permission(inode->i_sb, inode, mask); 510 if (retval) 511 return retval; 512 513 if (unlikely(mask & MAY_WRITE)) { 514 /* 515 * Nobody gets write access to an immutable file. 516 */ 517 if (IS_IMMUTABLE(inode)) 518 return -EPERM; 519 520 /* 521 * Updating mtime will likely cause i_uid and i_gid to be 522 * written back improperly if their true value is unknown 523 * to the vfs. 524 */ 525 if (HAS_UNMAPPED_ID(idmap, inode)) 526 return -EACCES; 527 } 528 529 retval = do_inode_permission(idmap, inode, mask); 530 if (retval) 531 return retval; 532 533 retval = devcgroup_inode_permission(inode, mask); 534 if (retval) 535 return retval; 536 537 return security_inode_permission(inode, mask); 538 } 539 EXPORT_SYMBOL(inode_permission); 540 541 /** 542 * path_get - get a reference to a path 543 * @path: path to get the reference to 544 * 545 * Given a path increment the reference count to the dentry and the vfsmount. 546 */ 547 void path_get(const struct path *path) 548 { 549 mntget(path->mnt); 550 dget(path->dentry); 551 } 552 EXPORT_SYMBOL(path_get); 553 554 /** 555 * path_put - put a reference to a path 556 * @path: path to put the reference to 557 * 558 * Given a path decrement the reference count to the dentry and the vfsmount. 559 */ 560 void path_put(const struct path *path) 561 { 562 dput(path->dentry); 563 mntput(path->mnt); 564 } 565 EXPORT_SYMBOL(path_put); 566 567 #define EMBEDDED_LEVELS 2 568 struct nameidata { 569 struct path path; 570 struct qstr last; 571 struct path root; 572 struct inode *inode; /* path.dentry.d_inode */ 573 unsigned int flags, state; 574 unsigned seq, next_seq, m_seq, r_seq; 575 int last_type; 576 unsigned depth; 577 int total_link_count; 578 struct saved { 579 struct path link; 580 struct delayed_call done; 581 const char *name; 582 unsigned seq; 583 } *stack, internal[EMBEDDED_LEVELS]; 584 struct filename *name; 585 struct nameidata *saved; 586 unsigned root_seq; 587 int dfd; 588 vfsuid_t dir_vfsuid; 589 umode_t dir_mode; 590 } __randomize_layout; 591 592 #define ND_ROOT_PRESET 1 593 #define ND_ROOT_GRABBED 2 594 #define ND_JUMPED 4 595 596 static void __set_nameidata(struct nameidata *p, int dfd, struct filename *name) 597 { 598 struct nameidata *old = current->nameidata; 599 p->stack = p->internal; 600 p->depth = 0; 601 p->dfd = dfd; 602 p->name = name; 603 p->path.mnt = NULL; 604 p->path.dentry = NULL; 605 p->total_link_count = old ? old->total_link_count : 0; 606 p->saved = old; 607 current->nameidata = p; 608 } 609 610 static inline void set_nameidata(struct nameidata *p, int dfd, struct filename *name, 611 const struct path *root) 612 { 613 __set_nameidata(p, dfd, name); 614 p->state = 0; 615 if (unlikely(root)) { 616 p->state = ND_ROOT_PRESET; 617 p->root = *root; 618 } 619 } 620 621 static void restore_nameidata(void) 622 { 623 struct nameidata *now = current->nameidata, *old = now->saved; 624 625 current->nameidata = old; 626 if (old) 627 old->total_link_count = now->total_link_count; 628 if (now->stack != now->internal) 629 kfree(now->stack); 630 } 631 632 static bool nd_alloc_stack(struct nameidata *nd) 633 { 634 struct saved *p; 635 636 p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved), 637 nd->flags & LOOKUP_RCU ? GFP_ATOMIC : GFP_KERNEL); 638 if (unlikely(!p)) 639 return false; 640 memcpy(p, nd->internal, sizeof(nd->internal)); 641 nd->stack = p; 642 return true; 643 } 644 645 /** 646 * path_connected - Verify that a dentry is below mnt.mnt_root 647 * @mnt: The mountpoint to check. 648 * @dentry: The dentry to check. 649 * 650 * Rename can sometimes move a file or directory outside of a bind 651 * mount, path_connected allows those cases to be detected. 652 */ 653 static bool path_connected(struct vfsmount *mnt, struct dentry *dentry) 654 { 655 struct super_block *sb = mnt->mnt_sb; 656 657 /* Bind mounts can have disconnected paths */ 658 if (mnt->mnt_root == sb->s_root) 659 return true; 660 661 return is_subdir(dentry, mnt->mnt_root); 662 } 663 664 static void drop_links(struct nameidata *nd) 665 { 666 int i = nd->depth; 667 while (i--) { 668 struct saved *last = nd->stack + i; 669 do_delayed_call(&last->done); 670 clear_delayed_call(&last->done); 671 } 672 } 673 674 static void leave_rcu(struct nameidata *nd) 675 { 676 nd->flags &= ~LOOKUP_RCU; 677 nd->seq = nd->next_seq = 0; 678 rcu_read_unlock(); 679 } 680 681 static void terminate_walk(struct nameidata *nd) 682 { 683 drop_links(nd); 684 if (!(nd->flags & LOOKUP_RCU)) { 685 int i; 686 path_put(&nd->path); 687 for (i = 0; i < nd->depth; i++) 688 path_put(&nd->stack[i].link); 689 if (nd->state & ND_ROOT_GRABBED) { 690 path_put(&nd->root); 691 nd->state &= ~ND_ROOT_GRABBED; 692 } 693 } else { 694 leave_rcu(nd); 695 } 696 nd->depth = 0; 697 nd->path.mnt = NULL; 698 nd->path.dentry = NULL; 699 } 700 701 /* path_put is needed afterwards regardless of success or failure */ 702 static bool __legitimize_path(struct path *path, unsigned seq, unsigned mseq) 703 { 704 int res = __legitimize_mnt(path->mnt, mseq); 705 if (unlikely(res)) { 706 if (res > 0) 707 path->mnt = NULL; 708 path->dentry = NULL; 709 return false; 710 } 711 if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) { 712 path->dentry = NULL; 713 return false; 714 } 715 return !read_seqcount_retry(&path->dentry->d_seq, seq); 716 } 717 718 static inline bool legitimize_path(struct nameidata *nd, 719 struct path *path, unsigned seq) 720 { 721 return __legitimize_path(path, seq, nd->m_seq); 722 } 723 724 static bool legitimize_links(struct nameidata *nd) 725 { 726 int i; 727 if (unlikely(nd->flags & LOOKUP_CACHED)) { 728 drop_links(nd); 729 nd->depth = 0; 730 return false; 731 } 732 for (i = 0; i < nd->depth; i++) { 733 struct saved *last = nd->stack + i; 734 if (unlikely(!legitimize_path(nd, &last->link, last->seq))) { 735 drop_links(nd); 736 nd->depth = i + 1; 737 return false; 738 } 739 } 740 return true; 741 } 742 743 static bool legitimize_root(struct nameidata *nd) 744 { 745 /* Nothing to do if nd->root is zero or is managed by the VFS user. */ 746 if (!nd->root.mnt || (nd->state & ND_ROOT_PRESET)) 747 return true; 748 nd->state |= ND_ROOT_GRABBED; 749 return legitimize_path(nd, &nd->root, nd->root_seq); 750 } 751 752 /* 753 * Path walking has 2 modes, rcu-walk and ref-walk (see 754 * Documentation/filesystems/path-lookup.txt). In situations when we can't 755 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab 756 * normal reference counts on dentries and vfsmounts to transition to ref-walk 757 * mode. Refcounts are grabbed at the last known good point before rcu-walk 758 * got stuck, so ref-walk may continue from there. If this is not successful 759 * (eg. a seqcount has changed), then failure is returned and it's up to caller 760 * to restart the path walk from the beginning in ref-walk mode. 761 */ 762 763 /** 764 * try_to_unlazy - try to switch to ref-walk mode. 765 * @nd: nameidata pathwalk data 766 * Returns: true on success, false on failure 767 * 768 * try_to_unlazy attempts to legitimize the current nd->path and nd->root 769 * for ref-walk mode. 770 * Must be called from rcu-walk context. 771 * Nothing should touch nameidata between try_to_unlazy() failure and 772 * terminate_walk(). 773 */ 774 static bool try_to_unlazy(struct nameidata *nd) 775 { 776 struct dentry *parent = nd->path.dentry; 777 778 BUG_ON(!(nd->flags & LOOKUP_RCU)); 779 780 if (unlikely(!legitimize_links(nd))) 781 goto out1; 782 if (unlikely(!legitimize_path(nd, &nd->path, nd->seq))) 783 goto out; 784 if (unlikely(!legitimize_root(nd))) 785 goto out; 786 leave_rcu(nd); 787 BUG_ON(nd->inode != parent->d_inode); 788 return true; 789 790 out1: 791 nd->path.mnt = NULL; 792 nd->path.dentry = NULL; 793 out: 794 leave_rcu(nd); 795 return false; 796 } 797 798 /** 799 * try_to_unlazy_next - try to switch to ref-walk mode. 800 * @nd: nameidata pathwalk data 801 * @dentry: next dentry to step into 802 * Returns: true on success, false on failure 803 * 804 * Similar to try_to_unlazy(), but here we have the next dentry already 805 * picked by rcu-walk and want to legitimize that in addition to the current 806 * nd->path and nd->root for ref-walk mode. Must be called from rcu-walk context. 807 * Nothing should touch nameidata between try_to_unlazy_next() failure and 808 * terminate_walk(). 809 */ 810 static bool try_to_unlazy_next(struct nameidata *nd, struct dentry *dentry) 811 { 812 int res; 813 BUG_ON(!(nd->flags & LOOKUP_RCU)); 814 815 if (unlikely(!legitimize_links(nd))) 816 goto out2; 817 res = __legitimize_mnt(nd->path.mnt, nd->m_seq); 818 if (unlikely(res)) { 819 if (res > 0) 820 goto out2; 821 goto out1; 822 } 823 if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref))) 824 goto out1; 825 826 /* 827 * We need to move both the parent and the dentry from the RCU domain 828 * to be properly refcounted. And the sequence number in the dentry 829 * validates *both* dentry counters, since we checked the sequence 830 * number of the parent after we got the child sequence number. So we 831 * know the parent must still be valid if the child sequence number is 832 */ 833 if (unlikely(!lockref_get_not_dead(&dentry->d_lockref))) 834 goto out; 835 if (read_seqcount_retry(&dentry->d_seq, nd->next_seq)) 836 goto out_dput; 837 /* 838 * Sequence counts matched. Now make sure that the root is 839 * still valid and get it if required. 840 */ 841 if (unlikely(!legitimize_root(nd))) 842 goto out_dput; 843 leave_rcu(nd); 844 return true; 845 846 out2: 847 nd->path.mnt = NULL; 848 out1: 849 nd->path.dentry = NULL; 850 out: 851 leave_rcu(nd); 852 return false; 853 out_dput: 854 leave_rcu(nd); 855 dput(dentry); 856 return false; 857 } 858 859 static inline int d_revalidate(struct dentry *dentry, unsigned int flags) 860 { 861 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) 862 return dentry->d_op->d_revalidate(dentry, flags); 863 else 864 return 1; 865 } 866 867 /** 868 * complete_walk - successful completion of path walk 869 * @nd: pointer nameidata 870 * 871 * If we had been in RCU mode, drop out of it and legitimize nd->path. 872 * Revalidate the final result, unless we'd already done that during 873 * the path walk or the filesystem doesn't ask for it. Return 0 on 874 * success, -error on failure. In case of failure caller does not 875 * need to drop nd->path. 876 */ 877 static int complete_walk(struct nameidata *nd) 878 { 879 struct dentry *dentry = nd->path.dentry; 880 int status; 881 882 if (nd->flags & LOOKUP_RCU) { 883 /* 884 * We don't want to zero nd->root for scoped-lookups or 885 * externally-managed nd->root. 886 */ 887 if (!(nd->state & ND_ROOT_PRESET)) 888 if (!(nd->flags & LOOKUP_IS_SCOPED)) 889 nd->root.mnt = NULL; 890 nd->flags &= ~LOOKUP_CACHED; 891 if (!try_to_unlazy(nd)) 892 return -ECHILD; 893 } 894 895 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) { 896 /* 897 * While the guarantee of LOOKUP_IS_SCOPED is (roughly) "don't 898 * ever step outside the root during lookup" and should already 899 * be guaranteed by the rest of namei, we want to avoid a namei 900 * BUG resulting in userspace being given a path that was not 901 * scoped within the root at some point during the lookup. 902 * 903 * So, do a final sanity-check to make sure that in the 904 * worst-case scenario (a complete bypass of LOOKUP_IS_SCOPED) 905 * we won't silently return an fd completely outside of the 906 * requested root to userspace. 907 * 908 * Userspace could move the path outside the root after this 909 * check, but as discussed elsewhere this is not a concern (the 910 * resolved file was inside the root at some point). 911 */ 912 if (!path_is_under(&nd->path, &nd->root)) 913 return -EXDEV; 914 } 915 916 if (likely(!(nd->state & ND_JUMPED))) 917 return 0; 918 919 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE))) 920 return 0; 921 922 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags); 923 if (status > 0) 924 return 0; 925 926 if (!status) 927 status = -ESTALE; 928 929 return status; 930 } 931 932 static int set_root(struct nameidata *nd) 933 { 934 struct fs_struct *fs = current->fs; 935 936 /* 937 * Jumping to the real root in a scoped-lookup is a BUG in namei, but we 938 * still have to ensure it doesn't happen because it will cause a breakout 939 * from the dirfd. 940 */ 941 if (WARN_ON(nd->flags & LOOKUP_IS_SCOPED)) 942 return -ENOTRECOVERABLE; 943 944 if (nd->flags & LOOKUP_RCU) { 945 unsigned seq; 946 947 do { 948 seq = read_seqcount_begin(&fs->seq); 949 nd->root = fs->root; 950 nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq); 951 } while (read_seqcount_retry(&fs->seq, seq)); 952 } else { 953 get_fs_root(fs, &nd->root); 954 nd->state |= ND_ROOT_GRABBED; 955 } 956 return 0; 957 } 958 959 static int nd_jump_root(struct nameidata *nd) 960 { 961 if (unlikely(nd->flags & LOOKUP_BENEATH)) 962 return -EXDEV; 963 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) { 964 /* Absolute path arguments to path_init() are allowed. */ 965 if (nd->path.mnt != NULL && nd->path.mnt != nd->root.mnt) 966 return -EXDEV; 967 } 968 if (!nd->root.mnt) { 969 int error = set_root(nd); 970 if (error) 971 return error; 972 } 973 if (nd->flags & LOOKUP_RCU) { 974 struct dentry *d; 975 nd->path = nd->root; 976 d = nd->path.dentry; 977 nd->inode = d->d_inode; 978 nd->seq = nd->root_seq; 979 if (read_seqcount_retry(&d->d_seq, nd->seq)) 980 return -ECHILD; 981 } else { 982 path_put(&nd->path); 983 nd->path = nd->root; 984 path_get(&nd->path); 985 nd->inode = nd->path.dentry->d_inode; 986 } 987 nd->state |= ND_JUMPED; 988 return 0; 989 } 990 991 /* 992 * Helper to directly jump to a known parsed path from ->get_link, 993 * caller must have taken a reference to path beforehand. 994 */ 995 int nd_jump_link(const struct path *path) 996 { 997 int error = -ELOOP; 998 struct nameidata *nd = current->nameidata; 999 1000 if (unlikely(nd->flags & LOOKUP_NO_MAGICLINKS)) 1001 goto err; 1002 1003 error = -EXDEV; 1004 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) { 1005 if (nd->path.mnt != path->mnt) 1006 goto err; 1007 } 1008 /* Not currently safe for scoped-lookups. */ 1009 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) 1010 goto err; 1011 1012 path_put(&nd->path); 1013 nd->path = *path; 1014 nd->inode = nd->path.dentry->d_inode; 1015 nd->state |= ND_JUMPED; 1016 return 0; 1017 1018 err: 1019 path_put(path); 1020 return error; 1021 } 1022 1023 static inline void put_link(struct nameidata *nd) 1024 { 1025 struct saved *last = nd->stack + --nd->depth; 1026 do_delayed_call(&last->done); 1027 if (!(nd->flags & LOOKUP_RCU)) 1028 path_put(&last->link); 1029 } 1030 1031 static int sysctl_protected_symlinks __read_mostly; 1032 static int sysctl_protected_hardlinks __read_mostly; 1033 static int sysctl_protected_fifos __read_mostly; 1034 static int sysctl_protected_regular __read_mostly; 1035 1036 #ifdef CONFIG_SYSCTL 1037 static struct ctl_table namei_sysctls[] = { 1038 { 1039 .procname = "protected_symlinks", 1040 .data = &sysctl_protected_symlinks, 1041 .maxlen = sizeof(int), 1042 .mode = 0644, 1043 .proc_handler = proc_dointvec_minmax, 1044 .extra1 = SYSCTL_ZERO, 1045 .extra2 = SYSCTL_ONE, 1046 }, 1047 { 1048 .procname = "protected_hardlinks", 1049 .data = &sysctl_protected_hardlinks, 1050 .maxlen = sizeof(int), 1051 .mode = 0644, 1052 .proc_handler = proc_dointvec_minmax, 1053 .extra1 = SYSCTL_ZERO, 1054 .extra2 = SYSCTL_ONE, 1055 }, 1056 { 1057 .procname = "protected_fifos", 1058 .data = &sysctl_protected_fifos, 1059 .maxlen = sizeof(int), 1060 .mode = 0644, 1061 .proc_handler = proc_dointvec_minmax, 1062 .extra1 = SYSCTL_ZERO, 1063 .extra2 = SYSCTL_TWO, 1064 }, 1065 { 1066 .procname = "protected_regular", 1067 .data = &sysctl_protected_regular, 1068 .maxlen = sizeof(int), 1069 .mode = 0644, 1070 .proc_handler = proc_dointvec_minmax, 1071 .extra1 = SYSCTL_ZERO, 1072 .extra2 = SYSCTL_TWO, 1073 }, 1074 { } 1075 }; 1076 1077 static int __init init_fs_namei_sysctls(void) 1078 { 1079 register_sysctl_init("fs", namei_sysctls); 1080 return 0; 1081 } 1082 fs_initcall(init_fs_namei_sysctls); 1083 1084 #endif /* CONFIG_SYSCTL */ 1085 1086 /** 1087 * may_follow_link - Check symlink following for unsafe situations 1088 * @nd: nameidata pathwalk data 1089 * @inode: Used for idmapping. 1090 * 1091 * In the case of the sysctl_protected_symlinks sysctl being enabled, 1092 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is 1093 * in a sticky world-writable directory. This is to protect privileged 1094 * processes from failing races against path names that may change out 1095 * from under them by way of other users creating malicious symlinks. 1096 * It will permit symlinks to be followed only when outside a sticky 1097 * world-writable directory, or when the uid of the symlink and follower 1098 * match, or when the directory owner matches the symlink's owner. 1099 * 1100 * Returns 0 if following the symlink is allowed, -ve on error. 1101 */ 1102 static inline int may_follow_link(struct nameidata *nd, const struct inode *inode) 1103 { 1104 struct mnt_idmap *idmap; 1105 vfsuid_t vfsuid; 1106 1107 if (!sysctl_protected_symlinks) 1108 return 0; 1109 1110 idmap = mnt_idmap(nd->path.mnt); 1111 vfsuid = i_uid_into_vfsuid(idmap, inode); 1112 /* Allowed if owner and follower match. */ 1113 if (vfsuid_eq_kuid(vfsuid, current_fsuid())) 1114 return 0; 1115 1116 /* Allowed if parent directory not sticky and world-writable. */ 1117 if ((nd->dir_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH)) 1118 return 0; 1119 1120 /* Allowed if parent directory and link owner match. */ 1121 if (vfsuid_valid(nd->dir_vfsuid) && vfsuid_eq(nd->dir_vfsuid, vfsuid)) 1122 return 0; 1123 1124 if (nd->flags & LOOKUP_RCU) 1125 return -ECHILD; 1126 1127 audit_inode(nd->name, nd->stack[0].link.dentry, 0); 1128 audit_log_path_denied(AUDIT_ANOM_LINK, "follow_link"); 1129 return -EACCES; 1130 } 1131 1132 /** 1133 * safe_hardlink_source - Check for safe hardlink conditions 1134 * @idmap: idmap of the mount the inode was found from 1135 * @inode: the source inode to hardlink from 1136 * 1137 * Return false if at least one of the following conditions: 1138 * - inode is not a regular file 1139 * - inode is setuid 1140 * - inode is setgid and group-exec 1141 * - access failure for read and write 1142 * 1143 * Otherwise returns true. 1144 */ 1145 static bool safe_hardlink_source(struct mnt_idmap *idmap, 1146 struct inode *inode) 1147 { 1148 umode_t mode = inode->i_mode; 1149 1150 /* Special files should not get pinned to the filesystem. */ 1151 if (!S_ISREG(mode)) 1152 return false; 1153 1154 /* Setuid files should not get pinned to the filesystem. */ 1155 if (mode & S_ISUID) 1156 return false; 1157 1158 /* Executable setgid files should not get pinned to the filesystem. */ 1159 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) 1160 return false; 1161 1162 /* Hardlinking to unreadable or unwritable sources is dangerous. */ 1163 if (inode_permission(idmap, inode, MAY_READ | MAY_WRITE)) 1164 return false; 1165 1166 return true; 1167 } 1168 1169 /** 1170 * may_linkat - Check permissions for creating a hardlink 1171 * @idmap: idmap of the mount the inode was found from 1172 * @link: the source to hardlink from 1173 * 1174 * Block hardlink when all of: 1175 * - sysctl_protected_hardlinks enabled 1176 * - fsuid does not match inode 1177 * - hardlink source is unsafe (see safe_hardlink_source() above) 1178 * - not CAP_FOWNER in a namespace with the inode owner uid mapped 1179 * 1180 * If the inode has been found through an idmapped mount the idmap of 1181 * the vfsmount must be passed through @idmap. This function will then take 1182 * care to map the inode according to @idmap before checking permissions. 1183 * On non-idmapped mounts or if permission checking is to be performed on the 1184 * raw inode simply pass @nop_mnt_idmap. 1185 * 1186 * Returns 0 if successful, -ve on error. 1187 */ 1188 int may_linkat(struct mnt_idmap *idmap, const struct path *link) 1189 { 1190 struct inode *inode = link->dentry->d_inode; 1191 1192 /* Inode writeback is not safe when the uid or gid are invalid. */ 1193 if (!vfsuid_valid(i_uid_into_vfsuid(idmap, inode)) || 1194 !vfsgid_valid(i_gid_into_vfsgid(idmap, inode))) 1195 return -EOVERFLOW; 1196 1197 if (!sysctl_protected_hardlinks) 1198 return 0; 1199 1200 /* Source inode owner (or CAP_FOWNER) can hardlink all they like, 1201 * otherwise, it must be a safe source. 1202 */ 1203 if (safe_hardlink_source(idmap, inode) || 1204 inode_owner_or_capable(idmap, inode)) 1205 return 0; 1206 1207 audit_log_path_denied(AUDIT_ANOM_LINK, "linkat"); 1208 return -EPERM; 1209 } 1210 1211 /** 1212 * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory 1213 * should be allowed, or not, on files that already 1214 * exist. 1215 * @idmap: idmap of the mount the inode was found from 1216 * @nd: nameidata pathwalk data 1217 * @inode: the inode of the file to open 1218 * 1219 * Block an O_CREAT open of a FIFO (or a regular file) when: 1220 * - sysctl_protected_fifos (or sysctl_protected_regular) is enabled 1221 * - the file already exists 1222 * - we are in a sticky directory 1223 * - we don't own the file 1224 * - the owner of the directory doesn't own the file 1225 * - the directory is world writable 1226 * If the sysctl_protected_fifos (or sysctl_protected_regular) is set to 2 1227 * the directory doesn't have to be world writable: being group writable will 1228 * be enough. 1229 * 1230 * If the inode has been found through an idmapped mount the idmap of 1231 * the vfsmount must be passed through @idmap. This function will then take 1232 * care to map the inode according to @idmap before checking permissions. 1233 * On non-idmapped mounts or if permission checking is to be performed on the 1234 * raw inode simply pass @nop_mnt_idmap. 1235 * 1236 * Returns 0 if the open is allowed, -ve on error. 1237 */ 1238 static int may_create_in_sticky(struct mnt_idmap *idmap, 1239 struct nameidata *nd, struct inode *const inode) 1240 { 1241 umode_t dir_mode = nd->dir_mode; 1242 vfsuid_t dir_vfsuid = nd->dir_vfsuid; 1243 1244 if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) || 1245 (!sysctl_protected_regular && S_ISREG(inode->i_mode)) || 1246 likely(!(dir_mode & S_ISVTX)) || 1247 vfsuid_eq(i_uid_into_vfsuid(idmap, inode), dir_vfsuid) || 1248 vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), current_fsuid())) 1249 return 0; 1250 1251 if (likely(dir_mode & 0002) || 1252 (dir_mode & 0020 && 1253 ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) || 1254 (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) { 1255 const char *operation = S_ISFIFO(inode->i_mode) ? 1256 "sticky_create_fifo" : 1257 "sticky_create_regular"; 1258 audit_log_path_denied(AUDIT_ANOM_CREAT, operation); 1259 return -EACCES; 1260 } 1261 return 0; 1262 } 1263 1264 /* 1265 * follow_up - Find the mountpoint of path's vfsmount 1266 * 1267 * Given a path, find the mountpoint of its source file system. 1268 * Replace @path with the path of the mountpoint in the parent mount. 1269 * Up is towards /. 1270 * 1271 * Return 1 if we went up a level and 0 if we were already at the 1272 * root. 1273 */ 1274 int follow_up(struct path *path) 1275 { 1276 struct mount *mnt = real_mount(path->mnt); 1277 struct mount *parent; 1278 struct dentry *mountpoint; 1279 1280 read_seqlock_excl(&mount_lock); 1281 parent = mnt->mnt_parent; 1282 if (parent == mnt) { 1283 read_sequnlock_excl(&mount_lock); 1284 return 0; 1285 } 1286 mntget(&parent->mnt); 1287 mountpoint = dget(mnt->mnt_mountpoint); 1288 read_sequnlock_excl(&mount_lock); 1289 dput(path->dentry); 1290 path->dentry = mountpoint; 1291 mntput(path->mnt); 1292 path->mnt = &parent->mnt; 1293 return 1; 1294 } 1295 EXPORT_SYMBOL(follow_up); 1296 1297 static bool choose_mountpoint_rcu(struct mount *m, const struct path *root, 1298 struct path *path, unsigned *seqp) 1299 { 1300 while (mnt_has_parent(m)) { 1301 struct dentry *mountpoint = m->mnt_mountpoint; 1302 1303 m = m->mnt_parent; 1304 if (unlikely(root->dentry == mountpoint && 1305 root->mnt == &m->mnt)) 1306 break; 1307 if (mountpoint != m->mnt.mnt_root) { 1308 path->mnt = &m->mnt; 1309 path->dentry = mountpoint; 1310 *seqp = read_seqcount_begin(&mountpoint->d_seq); 1311 return true; 1312 } 1313 } 1314 return false; 1315 } 1316 1317 static bool choose_mountpoint(struct mount *m, const struct path *root, 1318 struct path *path) 1319 { 1320 bool found; 1321 1322 rcu_read_lock(); 1323 while (1) { 1324 unsigned seq, mseq = read_seqbegin(&mount_lock); 1325 1326 found = choose_mountpoint_rcu(m, root, path, &seq); 1327 if (unlikely(!found)) { 1328 if (!read_seqretry(&mount_lock, mseq)) 1329 break; 1330 } else { 1331 if (likely(__legitimize_path(path, seq, mseq))) 1332 break; 1333 rcu_read_unlock(); 1334 path_put(path); 1335 rcu_read_lock(); 1336 } 1337 } 1338 rcu_read_unlock(); 1339 return found; 1340 } 1341 1342 /* 1343 * Perform an automount 1344 * - return -EISDIR to tell follow_managed() to stop and return the path we 1345 * were called with. 1346 */ 1347 static int follow_automount(struct path *path, int *count, unsigned lookup_flags) 1348 { 1349 struct dentry *dentry = path->dentry; 1350 1351 /* We don't want to mount if someone's just doing a stat - 1352 * unless they're stat'ing a directory and appended a '/' to 1353 * the name. 1354 * 1355 * We do, however, want to mount if someone wants to open or 1356 * create a file of any type under the mountpoint, wants to 1357 * traverse through the mountpoint or wants to open the 1358 * mounted directory. Also, autofs may mark negative dentries 1359 * as being automount points. These will need the attentions 1360 * of the daemon to instantiate them before they can be used. 1361 */ 1362 if (!(lookup_flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | 1363 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) && 1364 dentry->d_inode) 1365 return -EISDIR; 1366 1367 if (count && (*count)++ >= MAXSYMLINKS) 1368 return -ELOOP; 1369 1370 return finish_automount(dentry->d_op->d_automount(path), path); 1371 } 1372 1373 /* 1374 * mount traversal - out-of-line part. One note on ->d_flags accesses - 1375 * dentries are pinned but not locked here, so negative dentry can go 1376 * positive right under us. Use of smp_load_acquire() provides a barrier 1377 * sufficient for ->d_inode and ->d_flags consistency. 1378 */ 1379 static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped, 1380 int *count, unsigned lookup_flags) 1381 { 1382 struct vfsmount *mnt = path->mnt; 1383 bool need_mntput = false; 1384 int ret = 0; 1385 1386 while (flags & DCACHE_MANAGED_DENTRY) { 1387 /* Allow the filesystem to manage the transit without i_mutex 1388 * being held. */ 1389 if (flags & DCACHE_MANAGE_TRANSIT) { 1390 ret = path->dentry->d_op->d_manage(path, false); 1391 flags = smp_load_acquire(&path->dentry->d_flags); 1392 if (ret < 0) 1393 break; 1394 } 1395 1396 if (flags & DCACHE_MOUNTED) { // something's mounted on it.. 1397 struct vfsmount *mounted = lookup_mnt(path); 1398 if (mounted) { // ... in our namespace 1399 dput(path->dentry); 1400 if (need_mntput) 1401 mntput(path->mnt); 1402 path->mnt = mounted; 1403 path->dentry = dget(mounted->mnt_root); 1404 // here we know it's positive 1405 flags = path->dentry->d_flags; 1406 need_mntput = true; 1407 continue; 1408 } 1409 } 1410 1411 if (!(flags & DCACHE_NEED_AUTOMOUNT)) 1412 break; 1413 1414 // uncovered automount point 1415 ret = follow_automount(path, count, lookup_flags); 1416 flags = smp_load_acquire(&path->dentry->d_flags); 1417 if (ret < 0) 1418 break; 1419 } 1420 1421 if (ret == -EISDIR) 1422 ret = 0; 1423 // possible if you race with several mount --move 1424 if (need_mntput && path->mnt == mnt) 1425 mntput(path->mnt); 1426 if (!ret && unlikely(d_flags_negative(flags))) 1427 ret = -ENOENT; 1428 *jumped = need_mntput; 1429 return ret; 1430 } 1431 1432 static inline int traverse_mounts(struct path *path, bool *jumped, 1433 int *count, unsigned lookup_flags) 1434 { 1435 unsigned flags = smp_load_acquire(&path->dentry->d_flags); 1436 1437 /* fastpath */ 1438 if (likely(!(flags & DCACHE_MANAGED_DENTRY))) { 1439 *jumped = false; 1440 if (unlikely(d_flags_negative(flags))) 1441 return -ENOENT; 1442 return 0; 1443 } 1444 return __traverse_mounts(path, flags, jumped, count, lookup_flags); 1445 } 1446 1447 int follow_down_one(struct path *path) 1448 { 1449 struct vfsmount *mounted; 1450 1451 mounted = lookup_mnt(path); 1452 if (mounted) { 1453 dput(path->dentry); 1454 mntput(path->mnt); 1455 path->mnt = mounted; 1456 path->dentry = dget(mounted->mnt_root); 1457 return 1; 1458 } 1459 return 0; 1460 } 1461 EXPORT_SYMBOL(follow_down_one); 1462 1463 /* 1464 * Follow down to the covering mount currently visible to userspace. At each 1465 * point, the filesystem owning that dentry may be queried as to whether the 1466 * caller is permitted to proceed or not. 1467 */ 1468 int follow_down(struct path *path, unsigned int flags) 1469 { 1470 struct vfsmount *mnt = path->mnt; 1471 bool jumped; 1472 int ret = traverse_mounts(path, &jumped, NULL, flags); 1473 1474 if (path->mnt != mnt) 1475 mntput(mnt); 1476 return ret; 1477 } 1478 EXPORT_SYMBOL(follow_down); 1479 1480 /* 1481 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if 1482 * we meet a managed dentry that would need blocking. 1483 */ 1484 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path) 1485 { 1486 struct dentry *dentry = path->dentry; 1487 unsigned int flags = dentry->d_flags; 1488 1489 if (likely(!(flags & DCACHE_MANAGED_DENTRY))) 1490 return true; 1491 1492 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) 1493 return false; 1494 1495 for (;;) { 1496 /* 1497 * Don't forget we might have a non-mountpoint managed dentry 1498 * that wants to block transit. 1499 */ 1500 if (unlikely(flags & DCACHE_MANAGE_TRANSIT)) { 1501 int res = dentry->d_op->d_manage(path, true); 1502 if (res) 1503 return res == -EISDIR; 1504 flags = dentry->d_flags; 1505 } 1506 1507 if (flags & DCACHE_MOUNTED) { 1508 struct mount *mounted = __lookup_mnt(path->mnt, dentry); 1509 if (mounted) { 1510 path->mnt = &mounted->mnt; 1511 dentry = path->dentry = mounted->mnt.mnt_root; 1512 nd->state |= ND_JUMPED; 1513 nd->next_seq = read_seqcount_begin(&dentry->d_seq); 1514 flags = dentry->d_flags; 1515 // makes sure that non-RCU pathwalk could reach 1516 // this state. 1517 if (read_seqretry(&mount_lock, nd->m_seq)) 1518 return false; 1519 continue; 1520 } 1521 if (read_seqretry(&mount_lock, nd->m_seq)) 1522 return false; 1523 } 1524 return !(flags & DCACHE_NEED_AUTOMOUNT); 1525 } 1526 } 1527 1528 static inline int handle_mounts(struct nameidata *nd, struct dentry *dentry, 1529 struct path *path) 1530 { 1531 bool jumped; 1532 int ret; 1533 1534 path->mnt = nd->path.mnt; 1535 path->dentry = dentry; 1536 if (nd->flags & LOOKUP_RCU) { 1537 unsigned int seq = nd->next_seq; 1538 if (likely(__follow_mount_rcu(nd, path))) 1539 return 0; 1540 // *path and nd->next_seq might've been clobbered 1541 path->mnt = nd->path.mnt; 1542 path->dentry = dentry; 1543 nd->next_seq = seq; 1544 if (!try_to_unlazy_next(nd, dentry)) 1545 return -ECHILD; 1546 } 1547 ret = traverse_mounts(path, &jumped, &nd->total_link_count, nd->flags); 1548 if (jumped) { 1549 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) 1550 ret = -EXDEV; 1551 else 1552 nd->state |= ND_JUMPED; 1553 } 1554 if (unlikely(ret)) { 1555 dput(path->dentry); 1556 if (path->mnt != nd->path.mnt) 1557 mntput(path->mnt); 1558 } 1559 return ret; 1560 } 1561 1562 /* 1563 * This looks up the name in dcache and possibly revalidates the found dentry. 1564 * NULL is returned if the dentry does not exist in the cache. 1565 */ 1566 static struct dentry *lookup_dcache(const struct qstr *name, 1567 struct dentry *dir, 1568 unsigned int flags) 1569 { 1570 struct dentry *dentry = d_lookup(dir, name); 1571 if (dentry) { 1572 int error = d_revalidate(dentry, flags); 1573 if (unlikely(error <= 0)) { 1574 if (!error) 1575 d_invalidate(dentry); 1576 dput(dentry); 1577 return ERR_PTR(error); 1578 } 1579 } 1580 return dentry; 1581 } 1582 1583 /* 1584 * Parent directory has inode locked exclusive. This is one 1585 * and only case when ->lookup() gets called on non in-lookup 1586 * dentries - as the matter of fact, this only gets called 1587 * when directory is guaranteed to have no in-lookup children 1588 * at all. 1589 */ 1590 struct dentry *lookup_one_qstr_excl(const struct qstr *name, 1591 struct dentry *base, 1592 unsigned int flags) 1593 { 1594 struct dentry *dentry = lookup_dcache(name, base, flags); 1595 struct dentry *old; 1596 struct inode *dir = base->d_inode; 1597 1598 if (dentry) 1599 return dentry; 1600 1601 /* Don't create child dentry for a dead directory. */ 1602 if (unlikely(IS_DEADDIR(dir))) 1603 return ERR_PTR(-ENOENT); 1604 1605 dentry = d_alloc(base, name); 1606 if (unlikely(!dentry)) 1607 return ERR_PTR(-ENOMEM); 1608 1609 old = dir->i_op->lookup(dir, dentry, flags); 1610 if (unlikely(old)) { 1611 dput(dentry); 1612 dentry = old; 1613 } 1614 return dentry; 1615 } 1616 EXPORT_SYMBOL(lookup_one_qstr_excl); 1617 1618 static struct dentry *lookup_fast(struct nameidata *nd) 1619 { 1620 struct dentry *dentry, *parent = nd->path.dentry; 1621 int status = 1; 1622 1623 /* 1624 * Rename seqlock is not required here because in the off chance 1625 * of a false negative due to a concurrent rename, the caller is 1626 * going to fall back to non-racy lookup. 1627 */ 1628 if (nd->flags & LOOKUP_RCU) { 1629 dentry = __d_lookup_rcu(parent, &nd->last, &nd->next_seq); 1630 if (unlikely(!dentry)) { 1631 if (!try_to_unlazy(nd)) 1632 return ERR_PTR(-ECHILD); 1633 return NULL; 1634 } 1635 1636 /* 1637 * This sequence count validates that the parent had no 1638 * changes while we did the lookup of the dentry above. 1639 */ 1640 if (read_seqcount_retry(&parent->d_seq, nd->seq)) 1641 return ERR_PTR(-ECHILD); 1642 1643 status = d_revalidate(dentry, nd->flags); 1644 if (likely(status > 0)) 1645 return dentry; 1646 if (!try_to_unlazy_next(nd, dentry)) 1647 return ERR_PTR(-ECHILD); 1648 if (status == -ECHILD) 1649 /* we'd been told to redo it in non-rcu mode */ 1650 status = d_revalidate(dentry, nd->flags); 1651 } else { 1652 dentry = __d_lookup(parent, &nd->last); 1653 if (unlikely(!dentry)) 1654 return NULL; 1655 status = d_revalidate(dentry, nd->flags); 1656 } 1657 if (unlikely(status <= 0)) { 1658 if (!status) 1659 d_invalidate(dentry); 1660 dput(dentry); 1661 return ERR_PTR(status); 1662 } 1663 return dentry; 1664 } 1665 1666 /* Fast lookup failed, do it the slow way */ 1667 static struct dentry *__lookup_slow(const struct qstr *name, 1668 struct dentry *dir, 1669 unsigned int flags) 1670 { 1671 struct dentry *dentry, *old; 1672 struct inode *inode = dir->d_inode; 1673 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq); 1674 1675 /* Don't go there if it's already dead */ 1676 if (unlikely(IS_DEADDIR(inode))) 1677 return ERR_PTR(-ENOENT); 1678 again: 1679 dentry = d_alloc_parallel(dir, name, &wq); 1680 if (IS_ERR(dentry)) 1681 return dentry; 1682 if (unlikely(!d_in_lookup(dentry))) { 1683 int error = d_revalidate(dentry, flags); 1684 if (unlikely(error <= 0)) { 1685 if (!error) { 1686 d_invalidate(dentry); 1687 dput(dentry); 1688 goto again; 1689 } 1690 dput(dentry); 1691 dentry = ERR_PTR(error); 1692 } 1693 } else { 1694 old = inode->i_op->lookup(inode, dentry, flags); 1695 d_lookup_done(dentry); 1696 if (unlikely(old)) { 1697 dput(dentry); 1698 dentry = old; 1699 } 1700 } 1701 return dentry; 1702 } 1703 1704 static struct dentry *lookup_slow(const struct qstr *name, 1705 struct dentry *dir, 1706 unsigned int flags) 1707 { 1708 struct inode *inode = dir->d_inode; 1709 struct dentry *res; 1710 inode_lock_shared(inode); 1711 res = __lookup_slow(name, dir, flags); 1712 inode_unlock_shared(inode); 1713 return res; 1714 } 1715 1716 static inline int may_lookup(struct mnt_idmap *idmap, 1717 struct nameidata *nd) 1718 { 1719 if (nd->flags & LOOKUP_RCU) { 1720 int err = inode_permission(idmap, nd->inode, MAY_EXEC|MAY_NOT_BLOCK); 1721 if (err != -ECHILD || !try_to_unlazy(nd)) 1722 return err; 1723 } 1724 return inode_permission(idmap, nd->inode, MAY_EXEC); 1725 } 1726 1727 static int reserve_stack(struct nameidata *nd, struct path *link) 1728 { 1729 if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) 1730 return -ELOOP; 1731 1732 if (likely(nd->depth != EMBEDDED_LEVELS)) 1733 return 0; 1734 if (likely(nd->stack != nd->internal)) 1735 return 0; 1736 if (likely(nd_alloc_stack(nd))) 1737 return 0; 1738 1739 if (nd->flags & LOOKUP_RCU) { 1740 // we need to grab link before we do unlazy. And we can't skip 1741 // unlazy even if we fail to grab the link - cleanup needs it 1742 bool grabbed_link = legitimize_path(nd, link, nd->next_seq); 1743 1744 if (!try_to_unlazy(nd) || !grabbed_link) 1745 return -ECHILD; 1746 1747 if (nd_alloc_stack(nd)) 1748 return 0; 1749 } 1750 return -ENOMEM; 1751 } 1752 1753 enum {WALK_TRAILING = 1, WALK_MORE = 2, WALK_NOFOLLOW = 4}; 1754 1755 static const char *pick_link(struct nameidata *nd, struct path *link, 1756 struct inode *inode, int flags) 1757 { 1758 struct saved *last; 1759 const char *res; 1760 int error = reserve_stack(nd, link); 1761 1762 if (unlikely(error)) { 1763 if (!(nd->flags & LOOKUP_RCU)) 1764 path_put(link); 1765 return ERR_PTR(error); 1766 } 1767 last = nd->stack + nd->depth++; 1768 last->link = *link; 1769 clear_delayed_call(&last->done); 1770 last->seq = nd->next_seq; 1771 1772 if (flags & WALK_TRAILING) { 1773 error = may_follow_link(nd, inode); 1774 if (unlikely(error)) 1775 return ERR_PTR(error); 1776 } 1777 1778 if (unlikely(nd->flags & LOOKUP_NO_SYMLINKS) || 1779 unlikely(link->mnt->mnt_flags & MNT_NOSYMFOLLOW)) 1780 return ERR_PTR(-ELOOP); 1781 1782 if (!(nd->flags & LOOKUP_RCU)) { 1783 touch_atime(&last->link); 1784 cond_resched(); 1785 } else if (atime_needs_update(&last->link, inode)) { 1786 if (!try_to_unlazy(nd)) 1787 return ERR_PTR(-ECHILD); 1788 touch_atime(&last->link); 1789 } 1790 1791 error = security_inode_follow_link(link->dentry, inode, 1792 nd->flags & LOOKUP_RCU); 1793 if (unlikely(error)) 1794 return ERR_PTR(error); 1795 1796 res = READ_ONCE(inode->i_link); 1797 if (!res) { 1798 const char * (*get)(struct dentry *, struct inode *, 1799 struct delayed_call *); 1800 get = inode->i_op->get_link; 1801 if (nd->flags & LOOKUP_RCU) { 1802 res = get(NULL, inode, &last->done); 1803 if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd)) 1804 res = get(link->dentry, inode, &last->done); 1805 } else { 1806 res = get(link->dentry, inode, &last->done); 1807 } 1808 if (!res) 1809 goto all_done; 1810 if (IS_ERR(res)) 1811 return res; 1812 } 1813 if (*res == '/') { 1814 error = nd_jump_root(nd); 1815 if (unlikely(error)) 1816 return ERR_PTR(error); 1817 while (unlikely(*++res == '/')) 1818 ; 1819 } 1820 if (*res) 1821 return res; 1822 all_done: // pure jump 1823 put_link(nd); 1824 return NULL; 1825 } 1826 1827 /* 1828 * Do we need to follow links? We _really_ want to be able 1829 * to do this check without having to look at inode->i_op, 1830 * so we keep a cache of "no, this doesn't need follow_link" 1831 * for the common case. 1832 * 1833 * NOTE: dentry must be what nd->next_seq had been sampled from. 1834 */ 1835 static const char *step_into(struct nameidata *nd, int flags, 1836 struct dentry *dentry) 1837 { 1838 struct path path; 1839 struct inode *inode; 1840 int err = handle_mounts(nd, dentry, &path); 1841 1842 if (err < 0) 1843 return ERR_PTR(err); 1844 inode = path.dentry->d_inode; 1845 if (likely(!d_is_symlink(path.dentry)) || 1846 ((flags & WALK_TRAILING) && !(nd->flags & LOOKUP_FOLLOW)) || 1847 (flags & WALK_NOFOLLOW)) { 1848 /* not a symlink or should not follow */ 1849 if (nd->flags & LOOKUP_RCU) { 1850 if (read_seqcount_retry(&path.dentry->d_seq, nd->next_seq)) 1851 return ERR_PTR(-ECHILD); 1852 if (unlikely(!inode)) 1853 return ERR_PTR(-ENOENT); 1854 } else { 1855 dput(nd->path.dentry); 1856 if (nd->path.mnt != path.mnt) 1857 mntput(nd->path.mnt); 1858 } 1859 nd->path = path; 1860 nd->inode = inode; 1861 nd->seq = nd->next_seq; 1862 return NULL; 1863 } 1864 if (nd->flags & LOOKUP_RCU) { 1865 /* make sure that d_is_symlink above matches inode */ 1866 if (read_seqcount_retry(&path.dentry->d_seq, nd->next_seq)) 1867 return ERR_PTR(-ECHILD); 1868 } else { 1869 if (path.mnt == nd->path.mnt) 1870 mntget(path.mnt); 1871 } 1872 return pick_link(nd, &path, inode, flags); 1873 } 1874 1875 static struct dentry *follow_dotdot_rcu(struct nameidata *nd) 1876 { 1877 struct dentry *parent, *old; 1878 1879 if (path_equal(&nd->path, &nd->root)) 1880 goto in_root; 1881 if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) { 1882 struct path path; 1883 unsigned seq; 1884 if (!choose_mountpoint_rcu(real_mount(nd->path.mnt), 1885 &nd->root, &path, &seq)) 1886 goto in_root; 1887 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) 1888 return ERR_PTR(-ECHILD); 1889 nd->path = path; 1890 nd->inode = path.dentry->d_inode; 1891 nd->seq = seq; 1892 // makes sure that non-RCU pathwalk could reach this state 1893 if (read_seqretry(&mount_lock, nd->m_seq)) 1894 return ERR_PTR(-ECHILD); 1895 /* we know that mountpoint was pinned */ 1896 } 1897 old = nd->path.dentry; 1898 parent = old->d_parent; 1899 nd->next_seq = read_seqcount_begin(&parent->d_seq); 1900 // makes sure that non-RCU pathwalk could reach this state 1901 if (read_seqcount_retry(&old->d_seq, nd->seq)) 1902 return ERR_PTR(-ECHILD); 1903 if (unlikely(!path_connected(nd->path.mnt, parent))) 1904 return ERR_PTR(-ECHILD); 1905 return parent; 1906 in_root: 1907 if (read_seqretry(&mount_lock, nd->m_seq)) 1908 return ERR_PTR(-ECHILD); 1909 if (unlikely(nd->flags & LOOKUP_BENEATH)) 1910 return ERR_PTR(-ECHILD); 1911 nd->next_seq = nd->seq; 1912 return nd->path.dentry; 1913 } 1914 1915 static struct dentry *follow_dotdot(struct nameidata *nd) 1916 { 1917 struct dentry *parent; 1918 1919 if (path_equal(&nd->path, &nd->root)) 1920 goto in_root; 1921 if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) { 1922 struct path path; 1923 1924 if (!choose_mountpoint(real_mount(nd->path.mnt), 1925 &nd->root, &path)) 1926 goto in_root; 1927 path_put(&nd->path); 1928 nd->path = path; 1929 nd->inode = path.dentry->d_inode; 1930 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) 1931 return ERR_PTR(-EXDEV); 1932 } 1933 /* rare case of legitimate dget_parent()... */ 1934 parent = dget_parent(nd->path.dentry); 1935 if (unlikely(!path_connected(nd->path.mnt, parent))) { 1936 dput(parent); 1937 return ERR_PTR(-ENOENT); 1938 } 1939 return parent; 1940 1941 in_root: 1942 if (unlikely(nd->flags & LOOKUP_BENEATH)) 1943 return ERR_PTR(-EXDEV); 1944 return dget(nd->path.dentry); 1945 } 1946 1947 static const char *handle_dots(struct nameidata *nd, int type) 1948 { 1949 if (type == LAST_DOTDOT) { 1950 const char *error = NULL; 1951 struct dentry *parent; 1952 1953 if (!nd->root.mnt) { 1954 error = ERR_PTR(set_root(nd)); 1955 if (error) 1956 return error; 1957 } 1958 if (nd->flags & LOOKUP_RCU) 1959 parent = follow_dotdot_rcu(nd); 1960 else 1961 parent = follow_dotdot(nd); 1962 if (IS_ERR(parent)) 1963 return ERR_CAST(parent); 1964 error = step_into(nd, WALK_NOFOLLOW, parent); 1965 if (unlikely(error)) 1966 return error; 1967 1968 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) { 1969 /* 1970 * If there was a racing rename or mount along our 1971 * path, then we can't be sure that ".." hasn't jumped 1972 * above nd->root (and so userspace should retry or use 1973 * some fallback). 1974 */ 1975 smp_rmb(); 1976 if (__read_seqcount_retry(&mount_lock.seqcount, nd->m_seq)) 1977 return ERR_PTR(-EAGAIN); 1978 if (__read_seqcount_retry(&rename_lock.seqcount, nd->r_seq)) 1979 return ERR_PTR(-EAGAIN); 1980 } 1981 } 1982 return NULL; 1983 } 1984 1985 static const char *walk_component(struct nameidata *nd, int flags) 1986 { 1987 struct dentry *dentry; 1988 /* 1989 * "." and ".." are special - ".." especially so because it has 1990 * to be able to know about the current root directory and 1991 * parent relationships. 1992 */ 1993 if (unlikely(nd->last_type != LAST_NORM)) { 1994 if (!(flags & WALK_MORE) && nd->depth) 1995 put_link(nd); 1996 return handle_dots(nd, nd->last_type); 1997 } 1998 dentry = lookup_fast(nd); 1999 if (IS_ERR(dentry)) 2000 return ERR_CAST(dentry); 2001 if (unlikely(!dentry)) { 2002 dentry = lookup_slow(&nd->last, nd->path.dentry, nd->flags); 2003 if (IS_ERR(dentry)) 2004 return ERR_CAST(dentry); 2005 } 2006 if (!(flags & WALK_MORE) && nd->depth) 2007 put_link(nd); 2008 return step_into(nd, flags, dentry); 2009 } 2010 2011 /* 2012 * We can do the critical dentry name comparison and hashing 2013 * operations one word at a time, but we are limited to: 2014 * 2015 * - Architectures with fast unaligned word accesses. We could 2016 * do a "get_unaligned()" if this helps and is sufficiently 2017 * fast. 2018 * 2019 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we 2020 * do not trap on the (extremely unlikely) case of a page 2021 * crossing operation. 2022 * 2023 * - Furthermore, we need an efficient 64-bit compile for the 2024 * 64-bit case in order to generate the "number of bytes in 2025 * the final mask". Again, that could be replaced with a 2026 * efficient population count instruction or similar. 2027 */ 2028 #ifdef CONFIG_DCACHE_WORD_ACCESS 2029 2030 #include <asm/word-at-a-time.h> 2031 2032 #ifdef HASH_MIX 2033 2034 /* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */ 2035 2036 #elif defined(CONFIG_64BIT) 2037 /* 2038 * Register pressure in the mixing function is an issue, particularly 2039 * on 32-bit x86, but almost any function requires one state value and 2040 * one temporary. Instead, use a function designed for two state values 2041 * and no temporaries. 2042 * 2043 * This function cannot create a collision in only two iterations, so 2044 * we have two iterations to achieve avalanche. In those two iterations, 2045 * we have six layers of mixing, which is enough to spread one bit's 2046 * influence out to 2^6 = 64 state bits. 2047 * 2048 * Rotate constants are scored by considering either 64 one-bit input 2049 * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the 2050 * probability of that delta causing a change to each of the 128 output 2051 * bits, using a sample of random initial states. 2052 * 2053 * The Shannon entropy of the computed probabilities is then summed 2054 * to produce a score. Ideally, any input change has a 50% chance of 2055 * toggling any given output bit. 2056 * 2057 * Mixing scores (in bits) for (12,45): 2058 * Input delta: 1-bit 2-bit 2059 * 1 round: 713.3 42542.6 2060 * 2 rounds: 2753.7 140389.8 2061 * 3 rounds: 5954.1 233458.2 2062 * 4 rounds: 7862.6 256672.2 2063 * Perfect: 8192 258048 2064 * (64*128) (64*63/2 * 128) 2065 */ 2066 #define HASH_MIX(x, y, a) \ 2067 ( x ^= (a), \ 2068 y ^= x, x = rol64(x,12),\ 2069 x += y, y = rol64(y,45),\ 2070 y *= 9 ) 2071 2072 /* 2073 * Fold two longs into one 32-bit hash value. This must be fast, but 2074 * latency isn't quite as critical, as there is a fair bit of additional 2075 * work done before the hash value is used. 2076 */ 2077 static inline unsigned int fold_hash(unsigned long x, unsigned long y) 2078 { 2079 y ^= x * GOLDEN_RATIO_64; 2080 y *= GOLDEN_RATIO_64; 2081 return y >> 32; 2082 } 2083 2084 #else /* 32-bit case */ 2085 2086 /* 2087 * Mixing scores (in bits) for (7,20): 2088 * Input delta: 1-bit 2-bit 2089 * 1 round: 330.3 9201.6 2090 * 2 rounds: 1246.4 25475.4 2091 * 3 rounds: 1907.1 31295.1 2092 * 4 rounds: 2042.3 31718.6 2093 * Perfect: 2048 31744 2094 * (32*64) (32*31/2 * 64) 2095 */ 2096 #define HASH_MIX(x, y, a) \ 2097 ( x ^= (a), \ 2098 y ^= x, x = rol32(x, 7),\ 2099 x += y, y = rol32(y,20),\ 2100 y *= 9 ) 2101 2102 static inline unsigned int fold_hash(unsigned long x, unsigned long y) 2103 { 2104 /* Use arch-optimized multiply if one exists */ 2105 return __hash_32(y ^ __hash_32(x)); 2106 } 2107 2108 #endif 2109 2110 /* 2111 * Return the hash of a string of known length. This is carfully 2112 * designed to match hash_name(), which is the more critical function. 2113 * In particular, we must end by hashing a final word containing 0..7 2114 * payload bytes, to match the way that hash_name() iterates until it 2115 * finds the delimiter after the name. 2116 */ 2117 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len) 2118 { 2119 unsigned long a, x = 0, y = (unsigned long)salt; 2120 2121 for (;;) { 2122 if (!len) 2123 goto done; 2124 a = load_unaligned_zeropad(name); 2125 if (len < sizeof(unsigned long)) 2126 break; 2127 HASH_MIX(x, y, a); 2128 name += sizeof(unsigned long); 2129 len -= sizeof(unsigned long); 2130 } 2131 x ^= a & bytemask_from_count(len); 2132 done: 2133 return fold_hash(x, y); 2134 } 2135 EXPORT_SYMBOL(full_name_hash); 2136 2137 /* Return the "hash_len" (hash and length) of a null-terminated string */ 2138 u64 hashlen_string(const void *salt, const char *name) 2139 { 2140 unsigned long a = 0, x = 0, y = (unsigned long)salt; 2141 unsigned long adata, mask, len; 2142 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 2143 2144 len = 0; 2145 goto inside; 2146 2147 do { 2148 HASH_MIX(x, y, a); 2149 len += sizeof(unsigned long); 2150 inside: 2151 a = load_unaligned_zeropad(name+len); 2152 } while (!has_zero(a, &adata, &constants)); 2153 2154 adata = prep_zero_mask(a, adata, &constants); 2155 mask = create_zero_mask(adata); 2156 x ^= a & zero_bytemask(mask); 2157 2158 return hashlen_create(fold_hash(x, y), len + find_zero(mask)); 2159 } 2160 EXPORT_SYMBOL(hashlen_string); 2161 2162 /* 2163 * Calculate the length and hash of the path component, and 2164 * return the "hash_len" as the result. 2165 */ 2166 static inline u64 hash_name(const void *salt, const char *name) 2167 { 2168 unsigned long a = 0, b, x = 0, y = (unsigned long)salt; 2169 unsigned long adata, bdata, mask, len; 2170 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 2171 2172 len = 0; 2173 goto inside; 2174 2175 do { 2176 HASH_MIX(x, y, a); 2177 len += sizeof(unsigned long); 2178 inside: 2179 a = load_unaligned_zeropad(name+len); 2180 b = a ^ REPEAT_BYTE('/'); 2181 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants))); 2182 2183 adata = prep_zero_mask(a, adata, &constants); 2184 bdata = prep_zero_mask(b, bdata, &constants); 2185 mask = create_zero_mask(adata | bdata); 2186 x ^= a & zero_bytemask(mask); 2187 2188 return hashlen_create(fold_hash(x, y), len + find_zero(mask)); 2189 } 2190 2191 #else /* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */ 2192 2193 /* Return the hash of a string of known length */ 2194 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len) 2195 { 2196 unsigned long hash = init_name_hash(salt); 2197 while (len--) 2198 hash = partial_name_hash((unsigned char)*name++, hash); 2199 return end_name_hash(hash); 2200 } 2201 EXPORT_SYMBOL(full_name_hash); 2202 2203 /* Return the "hash_len" (hash and length) of a null-terminated string */ 2204 u64 hashlen_string(const void *salt, const char *name) 2205 { 2206 unsigned long hash = init_name_hash(salt); 2207 unsigned long len = 0, c; 2208 2209 c = (unsigned char)*name; 2210 while (c) { 2211 len++; 2212 hash = partial_name_hash(c, hash); 2213 c = (unsigned char)name[len]; 2214 } 2215 return hashlen_create(end_name_hash(hash), len); 2216 } 2217 EXPORT_SYMBOL(hashlen_string); 2218 2219 /* 2220 * We know there's a real path component here of at least 2221 * one character. 2222 */ 2223 static inline u64 hash_name(const void *salt, const char *name) 2224 { 2225 unsigned long hash = init_name_hash(salt); 2226 unsigned long len = 0, c; 2227 2228 c = (unsigned char)*name; 2229 do { 2230 len++; 2231 hash = partial_name_hash(c, hash); 2232 c = (unsigned char)name[len]; 2233 } while (c && c != '/'); 2234 return hashlen_create(end_name_hash(hash), len); 2235 } 2236 2237 #endif 2238 2239 /* 2240 * Name resolution. 2241 * This is the basic name resolution function, turning a pathname into 2242 * the final dentry. We expect 'base' to be positive and a directory. 2243 * 2244 * Returns 0 and nd will have valid dentry and mnt on success. 2245 * Returns error and drops reference to input namei data on failure. 2246 */ 2247 static int link_path_walk(const char *name, struct nameidata *nd) 2248 { 2249 int depth = 0; // depth <= nd->depth 2250 int err; 2251 2252 nd->last_type = LAST_ROOT; 2253 nd->flags |= LOOKUP_PARENT; 2254 if (IS_ERR(name)) 2255 return PTR_ERR(name); 2256 while (*name=='/') 2257 name++; 2258 if (!*name) { 2259 nd->dir_mode = 0; // short-circuit the 'hardening' idiocy 2260 return 0; 2261 } 2262 2263 /* At this point we know we have a real path component. */ 2264 for(;;) { 2265 struct mnt_idmap *idmap; 2266 const char *link; 2267 u64 hash_len; 2268 int type; 2269 2270 idmap = mnt_idmap(nd->path.mnt); 2271 err = may_lookup(idmap, nd); 2272 if (err) 2273 return err; 2274 2275 hash_len = hash_name(nd->path.dentry, name); 2276 2277 type = LAST_NORM; 2278 if (name[0] == '.') switch (hashlen_len(hash_len)) { 2279 case 2: 2280 if (name[1] == '.') { 2281 type = LAST_DOTDOT; 2282 nd->state |= ND_JUMPED; 2283 } 2284 break; 2285 case 1: 2286 type = LAST_DOT; 2287 } 2288 if (likely(type == LAST_NORM)) { 2289 struct dentry *parent = nd->path.dentry; 2290 nd->state &= ~ND_JUMPED; 2291 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { 2292 struct qstr this = { { .hash_len = hash_len }, .name = name }; 2293 err = parent->d_op->d_hash(parent, &this); 2294 if (err < 0) 2295 return err; 2296 hash_len = this.hash_len; 2297 name = this.name; 2298 } 2299 } 2300 2301 nd->last.hash_len = hash_len; 2302 nd->last.name = name; 2303 nd->last_type = type; 2304 2305 name += hashlen_len(hash_len); 2306 if (!*name) 2307 goto OK; 2308 /* 2309 * If it wasn't NUL, we know it was '/'. Skip that 2310 * slash, and continue until no more slashes. 2311 */ 2312 do { 2313 name++; 2314 } while (unlikely(*name == '/')); 2315 if (unlikely(!*name)) { 2316 OK: 2317 /* pathname or trailing symlink, done */ 2318 if (!depth) { 2319 nd->dir_vfsuid = i_uid_into_vfsuid(idmap, nd->inode); 2320 nd->dir_mode = nd->inode->i_mode; 2321 nd->flags &= ~LOOKUP_PARENT; 2322 return 0; 2323 } 2324 /* last component of nested symlink */ 2325 name = nd->stack[--depth].name; 2326 link = walk_component(nd, 0); 2327 } else { 2328 /* not the last component */ 2329 link = walk_component(nd, WALK_MORE); 2330 } 2331 if (unlikely(link)) { 2332 if (IS_ERR(link)) 2333 return PTR_ERR(link); 2334 /* a symlink to follow */ 2335 nd->stack[depth++].name = name; 2336 name = link; 2337 continue; 2338 } 2339 if (unlikely(!d_can_lookup(nd->path.dentry))) { 2340 if (nd->flags & LOOKUP_RCU) { 2341 if (!try_to_unlazy(nd)) 2342 return -ECHILD; 2343 } 2344 return -ENOTDIR; 2345 } 2346 } 2347 } 2348 2349 /* must be paired with terminate_walk() */ 2350 static const char *path_init(struct nameidata *nd, unsigned flags) 2351 { 2352 int error; 2353 const char *s = nd->name->name; 2354 2355 /* LOOKUP_CACHED requires RCU, ask caller to retry */ 2356 if ((flags & (LOOKUP_RCU | LOOKUP_CACHED)) == LOOKUP_CACHED) 2357 return ERR_PTR(-EAGAIN); 2358 2359 if (!*s) 2360 flags &= ~LOOKUP_RCU; 2361 if (flags & LOOKUP_RCU) 2362 rcu_read_lock(); 2363 else 2364 nd->seq = nd->next_seq = 0; 2365 2366 nd->flags = flags; 2367 nd->state |= ND_JUMPED; 2368 2369 nd->m_seq = __read_seqcount_begin(&mount_lock.seqcount); 2370 nd->r_seq = __read_seqcount_begin(&rename_lock.seqcount); 2371 smp_rmb(); 2372 2373 if (nd->state & ND_ROOT_PRESET) { 2374 struct dentry *root = nd->root.dentry; 2375 struct inode *inode = root->d_inode; 2376 if (*s && unlikely(!d_can_lookup(root))) 2377 return ERR_PTR(-ENOTDIR); 2378 nd->path = nd->root; 2379 nd->inode = inode; 2380 if (flags & LOOKUP_RCU) { 2381 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 2382 nd->root_seq = nd->seq; 2383 } else { 2384 path_get(&nd->path); 2385 } 2386 return s; 2387 } 2388 2389 nd->root.mnt = NULL; 2390 2391 /* Absolute pathname -- fetch the root (LOOKUP_IN_ROOT uses nd->dfd). */ 2392 if (*s == '/' && !(flags & LOOKUP_IN_ROOT)) { 2393 error = nd_jump_root(nd); 2394 if (unlikely(error)) 2395 return ERR_PTR(error); 2396 return s; 2397 } 2398 2399 /* Relative pathname -- get the starting-point it is relative to. */ 2400 if (nd->dfd == AT_FDCWD) { 2401 if (flags & LOOKUP_RCU) { 2402 struct fs_struct *fs = current->fs; 2403 unsigned seq; 2404 2405 do { 2406 seq = read_seqcount_begin(&fs->seq); 2407 nd->path = fs->pwd; 2408 nd->inode = nd->path.dentry->d_inode; 2409 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 2410 } while (read_seqcount_retry(&fs->seq, seq)); 2411 } else { 2412 get_fs_pwd(current->fs, &nd->path); 2413 nd->inode = nd->path.dentry->d_inode; 2414 } 2415 } else { 2416 /* Caller must check execute permissions on the starting path component */ 2417 struct fd f = fdget_raw(nd->dfd); 2418 struct dentry *dentry; 2419 2420 if (!f.file) 2421 return ERR_PTR(-EBADF); 2422 2423 dentry = f.file->f_path.dentry; 2424 2425 if (*s && unlikely(!d_can_lookup(dentry))) { 2426 fdput(f); 2427 return ERR_PTR(-ENOTDIR); 2428 } 2429 2430 nd->path = f.file->f_path; 2431 if (flags & LOOKUP_RCU) { 2432 nd->inode = nd->path.dentry->d_inode; 2433 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 2434 } else { 2435 path_get(&nd->path); 2436 nd->inode = nd->path.dentry->d_inode; 2437 } 2438 fdput(f); 2439 } 2440 2441 /* For scoped-lookups we need to set the root to the dirfd as well. */ 2442 if (flags & LOOKUP_IS_SCOPED) { 2443 nd->root = nd->path; 2444 if (flags & LOOKUP_RCU) { 2445 nd->root_seq = nd->seq; 2446 } else { 2447 path_get(&nd->root); 2448 nd->state |= ND_ROOT_GRABBED; 2449 } 2450 } 2451 return s; 2452 } 2453 2454 static inline const char *lookup_last(struct nameidata *nd) 2455 { 2456 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len]) 2457 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 2458 2459 return walk_component(nd, WALK_TRAILING); 2460 } 2461 2462 static int handle_lookup_down(struct nameidata *nd) 2463 { 2464 if (!(nd->flags & LOOKUP_RCU)) 2465 dget(nd->path.dentry); 2466 nd->next_seq = nd->seq; 2467 return PTR_ERR(step_into(nd, WALK_NOFOLLOW, nd->path.dentry)); 2468 } 2469 2470 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 2471 static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path) 2472 { 2473 const char *s = path_init(nd, flags); 2474 int err; 2475 2476 if (unlikely(flags & LOOKUP_DOWN) && !IS_ERR(s)) { 2477 err = handle_lookup_down(nd); 2478 if (unlikely(err < 0)) 2479 s = ERR_PTR(err); 2480 } 2481 2482 while (!(err = link_path_walk(s, nd)) && 2483 (s = lookup_last(nd)) != NULL) 2484 ; 2485 if (!err && unlikely(nd->flags & LOOKUP_MOUNTPOINT)) { 2486 err = handle_lookup_down(nd); 2487 nd->state &= ~ND_JUMPED; // no d_weak_revalidate(), please... 2488 } 2489 if (!err) 2490 err = complete_walk(nd); 2491 2492 if (!err && nd->flags & LOOKUP_DIRECTORY) 2493 if (!d_can_lookup(nd->path.dentry)) 2494 err = -ENOTDIR; 2495 if (!err) { 2496 *path = nd->path; 2497 nd->path.mnt = NULL; 2498 nd->path.dentry = NULL; 2499 } 2500 terminate_walk(nd); 2501 return err; 2502 } 2503 2504 int filename_lookup(int dfd, struct filename *name, unsigned flags, 2505 struct path *path, struct path *root) 2506 { 2507 int retval; 2508 struct nameidata nd; 2509 if (IS_ERR(name)) 2510 return PTR_ERR(name); 2511 set_nameidata(&nd, dfd, name, root); 2512 retval = path_lookupat(&nd, flags | LOOKUP_RCU, path); 2513 if (unlikely(retval == -ECHILD)) 2514 retval = path_lookupat(&nd, flags, path); 2515 if (unlikely(retval == -ESTALE)) 2516 retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path); 2517 2518 if (likely(!retval)) 2519 audit_inode(name, path->dentry, 2520 flags & LOOKUP_MOUNTPOINT ? AUDIT_INODE_NOEVAL : 0); 2521 restore_nameidata(); 2522 return retval; 2523 } 2524 2525 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 2526 static int path_parentat(struct nameidata *nd, unsigned flags, 2527 struct path *parent) 2528 { 2529 const char *s = path_init(nd, flags); 2530 int err = link_path_walk(s, nd); 2531 if (!err) 2532 err = complete_walk(nd); 2533 if (!err) { 2534 *parent = nd->path; 2535 nd->path.mnt = NULL; 2536 nd->path.dentry = NULL; 2537 } 2538 terminate_walk(nd); 2539 return err; 2540 } 2541 2542 /* Note: this does not consume "name" */ 2543 static int __filename_parentat(int dfd, struct filename *name, 2544 unsigned int flags, struct path *parent, 2545 struct qstr *last, int *type, 2546 const struct path *root) 2547 { 2548 int retval; 2549 struct nameidata nd; 2550 2551 if (IS_ERR(name)) 2552 return PTR_ERR(name); 2553 set_nameidata(&nd, dfd, name, root); 2554 retval = path_parentat(&nd, flags | LOOKUP_RCU, parent); 2555 if (unlikely(retval == -ECHILD)) 2556 retval = path_parentat(&nd, flags, parent); 2557 if (unlikely(retval == -ESTALE)) 2558 retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent); 2559 if (likely(!retval)) { 2560 *last = nd.last; 2561 *type = nd.last_type; 2562 audit_inode(name, parent->dentry, AUDIT_INODE_PARENT); 2563 } 2564 restore_nameidata(); 2565 return retval; 2566 } 2567 2568 static int filename_parentat(int dfd, struct filename *name, 2569 unsigned int flags, struct path *parent, 2570 struct qstr *last, int *type) 2571 { 2572 return __filename_parentat(dfd, name, flags, parent, last, type, NULL); 2573 } 2574 2575 /* does lookup, returns the object with parent locked */ 2576 static struct dentry *__kern_path_locked(struct filename *name, struct path *path) 2577 { 2578 struct dentry *d; 2579 struct qstr last; 2580 int type, error; 2581 2582 error = filename_parentat(AT_FDCWD, name, 0, path, &last, &type); 2583 if (error) 2584 return ERR_PTR(error); 2585 if (unlikely(type != LAST_NORM)) { 2586 path_put(path); 2587 return ERR_PTR(-EINVAL); 2588 } 2589 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT); 2590 d = lookup_one_qstr_excl(&last, path->dentry, 0); 2591 if (IS_ERR(d)) { 2592 inode_unlock(path->dentry->d_inode); 2593 path_put(path); 2594 } 2595 return d; 2596 } 2597 2598 struct dentry *kern_path_locked(const char *name, struct path *path) 2599 { 2600 struct filename *filename = getname_kernel(name); 2601 struct dentry *res = __kern_path_locked(filename, path); 2602 2603 putname(filename); 2604 return res; 2605 } 2606 2607 int kern_path(const char *name, unsigned int flags, struct path *path) 2608 { 2609 struct filename *filename = getname_kernel(name); 2610 int ret = filename_lookup(AT_FDCWD, filename, flags, path, NULL); 2611 2612 putname(filename); 2613 return ret; 2614 2615 } 2616 EXPORT_SYMBOL(kern_path); 2617 2618 /** 2619 * vfs_path_parent_lookup - lookup a parent path relative to a dentry-vfsmount pair 2620 * @filename: filename structure 2621 * @flags: lookup flags 2622 * @parent: pointer to struct path to fill 2623 * @last: last component 2624 * @type: type of the last component 2625 * @root: pointer to struct path of the base directory 2626 */ 2627 int vfs_path_parent_lookup(struct filename *filename, unsigned int flags, 2628 struct path *parent, struct qstr *last, int *type, 2629 const struct path *root) 2630 { 2631 return __filename_parentat(AT_FDCWD, filename, flags, parent, last, 2632 type, root); 2633 } 2634 EXPORT_SYMBOL(vfs_path_parent_lookup); 2635 2636 /** 2637 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair 2638 * @dentry: pointer to dentry of the base directory 2639 * @mnt: pointer to vfs mount of the base directory 2640 * @name: pointer to file name 2641 * @flags: lookup flags 2642 * @path: pointer to struct path to fill 2643 */ 2644 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, 2645 const char *name, unsigned int flags, 2646 struct path *path) 2647 { 2648 struct filename *filename; 2649 struct path root = {.mnt = mnt, .dentry = dentry}; 2650 int ret; 2651 2652 filename = getname_kernel(name); 2653 /* the first argument of filename_lookup() is ignored with root */ 2654 ret = filename_lookup(AT_FDCWD, filename, flags, path, &root); 2655 putname(filename); 2656 return ret; 2657 } 2658 EXPORT_SYMBOL(vfs_path_lookup); 2659 2660 static int lookup_one_common(struct mnt_idmap *idmap, 2661 const char *name, struct dentry *base, int len, 2662 struct qstr *this) 2663 { 2664 this->name = name; 2665 this->len = len; 2666 this->hash = full_name_hash(base, name, len); 2667 if (!len) 2668 return -EACCES; 2669 2670 if (unlikely(name[0] == '.')) { 2671 if (len < 2 || (len == 2 && name[1] == '.')) 2672 return -EACCES; 2673 } 2674 2675 while (len--) { 2676 unsigned int c = *(const unsigned char *)name++; 2677 if (c == '/' || c == '\0') 2678 return -EACCES; 2679 } 2680 /* 2681 * See if the low-level filesystem might want 2682 * to use its own hash.. 2683 */ 2684 if (base->d_flags & DCACHE_OP_HASH) { 2685 int err = base->d_op->d_hash(base, this); 2686 if (err < 0) 2687 return err; 2688 } 2689 2690 return inode_permission(idmap, base->d_inode, MAY_EXEC); 2691 } 2692 2693 /** 2694 * try_lookup_one_len - filesystem helper to lookup single pathname component 2695 * @name: pathname component to lookup 2696 * @base: base directory to lookup from 2697 * @len: maximum length @len should be interpreted to 2698 * 2699 * Look up a dentry by name in the dcache, returning NULL if it does not 2700 * currently exist. The function does not try to create a dentry. 2701 * 2702 * Note that this routine is purely a helper for filesystem usage and should 2703 * not be called by generic code. 2704 * 2705 * The caller must hold base->i_mutex. 2706 */ 2707 struct dentry *try_lookup_one_len(const char *name, struct dentry *base, int len) 2708 { 2709 struct qstr this; 2710 int err; 2711 2712 WARN_ON_ONCE(!inode_is_locked(base->d_inode)); 2713 2714 err = lookup_one_common(&nop_mnt_idmap, name, base, len, &this); 2715 if (err) 2716 return ERR_PTR(err); 2717 2718 return lookup_dcache(&this, base, 0); 2719 } 2720 EXPORT_SYMBOL(try_lookup_one_len); 2721 2722 /** 2723 * lookup_one_len - filesystem helper to lookup single pathname component 2724 * @name: pathname component to lookup 2725 * @base: base directory to lookup from 2726 * @len: maximum length @len should be interpreted to 2727 * 2728 * Note that this routine is purely a helper for filesystem usage and should 2729 * not be called by generic code. 2730 * 2731 * The caller must hold base->i_mutex. 2732 */ 2733 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len) 2734 { 2735 struct dentry *dentry; 2736 struct qstr this; 2737 int err; 2738 2739 WARN_ON_ONCE(!inode_is_locked(base->d_inode)); 2740 2741 err = lookup_one_common(&nop_mnt_idmap, name, base, len, &this); 2742 if (err) 2743 return ERR_PTR(err); 2744 2745 dentry = lookup_dcache(&this, base, 0); 2746 return dentry ? dentry : __lookup_slow(&this, base, 0); 2747 } 2748 EXPORT_SYMBOL(lookup_one_len); 2749 2750 /** 2751 * lookup_one - filesystem helper to lookup single pathname component 2752 * @idmap: idmap of the mount the lookup is performed from 2753 * @name: pathname component to lookup 2754 * @base: base directory to lookup from 2755 * @len: maximum length @len should be interpreted to 2756 * 2757 * Note that this routine is purely a helper for filesystem usage and should 2758 * not be called by generic code. 2759 * 2760 * The caller must hold base->i_mutex. 2761 */ 2762 struct dentry *lookup_one(struct mnt_idmap *idmap, const char *name, 2763 struct dentry *base, int len) 2764 { 2765 struct dentry *dentry; 2766 struct qstr this; 2767 int err; 2768 2769 WARN_ON_ONCE(!inode_is_locked(base->d_inode)); 2770 2771 err = lookup_one_common(idmap, name, base, len, &this); 2772 if (err) 2773 return ERR_PTR(err); 2774 2775 dentry = lookup_dcache(&this, base, 0); 2776 return dentry ? dentry : __lookup_slow(&this, base, 0); 2777 } 2778 EXPORT_SYMBOL(lookup_one); 2779 2780 /** 2781 * lookup_one_unlocked - filesystem helper to lookup single pathname component 2782 * @idmap: idmap of the mount the lookup is performed from 2783 * @name: pathname component to lookup 2784 * @base: base directory to lookup from 2785 * @len: maximum length @len should be interpreted to 2786 * 2787 * Note that this routine is purely a helper for filesystem usage and should 2788 * not be called by generic code. 2789 * 2790 * Unlike lookup_one_len, it should be called without the parent 2791 * i_mutex held, and will take the i_mutex itself if necessary. 2792 */ 2793 struct dentry *lookup_one_unlocked(struct mnt_idmap *idmap, 2794 const char *name, struct dentry *base, 2795 int len) 2796 { 2797 struct qstr this; 2798 int err; 2799 struct dentry *ret; 2800 2801 err = lookup_one_common(idmap, name, base, len, &this); 2802 if (err) 2803 return ERR_PTR(err); 2804 2805 ret = lookup_dcache(&this, base, 0); 2806 if (!ret) 2807 ret = lookup_slow(&this, base, 0); 2808 return ret; 2809 } 2810 EXPORT_SYMBOL(lookup_one_unlocked); 2811 2812 /** 2813 * lookup_one_positive_unlocked - filesystem helper to lookup single 2814 * pathname component 2815 * @idmap: idmap of the mount the lookup is performed from 2816 * @name: pathname component to lookup 2817 * @base: base directory to lookup from 2818 * @len: maximum length @len should be interpreted to 2819 * 2820 * This helper will yield ERR_PTR(-ENOENT) on negatives. The helper returns 2821 * known positive or ERR_PTR(). This is what most of the users want. 2822 * 2823 * Note that pinned negative with unlocked parent _can_ become positive at any 2824 * time, so callers of lookup_one_unlocked() need to be very careful; pinned 2825 * positives have >d_inode stable, so this one avoids such problems. 2826 * 2827 * Note that this routine is purely a helper for filesystem usage and should 2828 * not be called by generic code. 2829 * 2830 * The helper should be called without i_mutex held. 2831 */ 2832 struct dentry *lookup_one_positive_unlocked(struct mnt_idmap *idmap, 2833 const char *name, 2834 struct dentry *base, int len) 2835 { 2836 struct dentry *ret = lookup_one_unlocked(idmap, name, base, len); 2837 2838 if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) { 2839 dput(ret); 2840 ret = ERR_PTR(-ENOENT); 2841 } 2842 return ret; 2843 } 2844 EXPORT_SYMBOL(lookup_one_positive_unlocked); 2845 2846 /** 2847 * lookup_one_len_unlocked - filesystem helper to lookup single pathname component 2848 * @name: pathname component to lookup 2849 * @base: base directory to lookup from 2850 * @len: maximum length @len should be interpreted to 2851 * 2852 * Note that this routine is purely a helper for filesystem usage and should 2853 * not be called by generic code. 2854 * 2855 * Unlike lookup_one_len, it should be called without the parent 2856 * i_mutex held, and will take the i_mutex itself if necessary. 2857 */ 2858 struct dentry *lookup_one_len_unlocked(const char *name, 2859 struct dentry *base, int len) 2860 { 2861 return lookup_one_unlocked(&nop_mnt_idmap, name, base, len); 2862 } 2863 EXPORT_SYMBOL(lookup_one_len_unlocked); 2864 2865 /* 2866 * Like lookup_one_len_unlocked(), except that it yields ERR_PTR(-ENOENT) 2867 * on negatives. Returns known positive or ERR_PTR(); that's what 2868 * most of the users want. Note that pinned negative with unlocked parent 2869 * _can_ become positive at any time, so callers of lookup_one_len_unlocked() 2870 * need to be very careful; pinned positives have ->d_inode stable, so 2871 * this one avoids such problems. 2872 */ 2873 struct dentry *lookup_positive_unlocked(const char *name, 2874 struct dentry *base, int len) 2875 { 2876 return lookup_one_positive_unlocked(&nop_mnt_idmap, name, base, len); 2877 } 2878 EXPORT_SYMBOL(lookup_positive_unlocked); 2879 2880 #ifdef CONFIG_UNIX98_PTYS 2881 int path_pts(struct path *path) 2882 { 2883 /* Find something mounted on "pts" in the same directory as 2884 * the input path. 2885 */ 2886 struct dentry *parent = dget_parent(path->dentry); 2887 struct dentry *child; 2888 struct qstr this = QSTR_INIT("pts", 3); 2889 2890 if (unlikely(!path_connected(path->mnt, parent))) { 2891 dput(parent); 2892 return -ENOENT; 2893 } 2894 dput(path->dentry); 2895 path->dentry = parent; 2896 child = d_hash_and_lookup(parent, &this); 2897 if (IS_ERR_OR_NULL(child)) 2898 return -ENOENT; 2899 2900 path->dentry = child; 2901 dput(parent); 2902 follow_down(path, 0); 2903 return 0; 2904 } 2905 #endif 2906 2907 int user_path_at_empty(int dfd, const char __user *name, unsigned flags, 2908 struct path *path, int *empty) 2909 { 2910 struct filename *filename = getname_flags(name, flags, empty); 2911 int ret = filename_lookup(dfd, filename, flags, path, NULL); 2912 2913 putname(filename); 2914 return ret; 2915 } 2916 EXPORT_SYMBOL(user_path_at_empty); 2917 2918 int __check_sticky(struct mnt_idmap *idmap, struct inode *dir, 2919 struct inode *inode) 2920 { 2921 kuid_t fsuid = current_fsuid(); 2922 2923 if (vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), fsuid)) 2924 return 0; 2925 if (vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, dir), fsuid)) 2926 return 0; 2927 return !capable_wrt_inode_uidgid(idmap, inode, CAP_FOWNER); 2928 } 2929 EXPORT_SYMBOL(__check_sticky); 2930 2931 /* 2932 * Check whether we can remove a link victim from directory dir, check 2933 * whether the type of victim is right. 2934 * 1. We can't do it if dir is read-only (done in permission()) 2935 * 2. We should have write and exec permissions on dir 2936 * 3. We can't remove anything from append-only dir 2937 * 4. We can't do anything with immutable dir (done in permission()) 2938 * 5. If the sticky bit on dir is set we should either 2939 * a. be owner of dir, or 2940 * b. be owner of victim, or 2941 * c. have CAP_FOWNER capability 2942 * 6. If the victim is append-only or immutable we can't do antyhing with 2943 * links pointing to it. 2944 * 7. If the victim has an unknown uid or gid we can't change the inode. 2945 * 8. If we were asked to remove a directory and victim isn't one - ENOTDIR. 2946 * 9. If we were asked to remove a non-directory and victim isn't one - EISDIR. 2947 * 10. We can't remove a root or mountpoint. 2948 * 11. We don't allow removal of NFS sillyrenamed files; it's handled by 2949 * nfs_async_unlink(). 2950 */ 2951 static int may_delete(struct mnt_idmap *idmap, struct inode *dir, 2952 struct dentry *victim, bool isdir) 2953 { 2954 struct inode *inode = d_backing_inode(victim); 2955 int error; 2956 2957 if (d_is_negative(victim)) 2958 return -ENOENT; 2959 BUG_ON(!inode); 2960 2961 BUG_ON(victim->d_parent->d_inode != dir); 2962 2963 /* Inode writeback is not safe when the uid or gid are invalid. */ 2964 if (!vfsuid_valid(i_uid_into_vfsuid(idmap, inode)) || 2965 !vfsgid_valid(i_gid_into_vfsgid(idmap, inode))) 2966 return -EOVERFLOW; 2967 2968 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE); 2969 2970 error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC); 2971 if (error) 2972 return error; 2973 if (IS_APPEND(dir)) 2974 return -EPERM; 2975 2976 if (check_sticky(idmap, dir, inode) || IS_APPEND(inode) || 2977 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) || 2978 HAS_UNMAPPED_ID(idmap, inode)) 2979 return -EPERM; 2980 if (isdir) { 2981 if (!d_is_dir(victim)) 2982 return -ENOTDIR; 2983 if (IS_ROOT(victim)) 2984 return -EBUSY; 2985 } else if (d_is_dir(victim)) 2986 return -EISDIR; 2987 if (IS_DEADDIR(dir)) 2988 return -ENOENT; 2989 if (victim->d_flags & DCACHE_NFSFS_RENAMED) 2990 return -EBUSY; 2991 return 0; 2992 } 2993 2994 /* Check whether we can create an object with dentry child in directory 2995 * dir. 2996 * 1. We can't do it if child already exists (open has special treatment for 2997 * this case, but since we are inlined it's OK) 2998 * 2. We can't do it if dir is read-only (done in permission()) 2999 * 3. We can't do it if the fs can't represent the fsuid or fsgid. 3000 * 4. We should have write and exec permissions on dir 3001 * 5. We can't do it if dir is immutable (done in permission()) 3002 */ 3003 static inline int may_create(struct mnt_idmap *idmap, 3004 struct inode *dir, struct dentry *child) 3005 { 3006 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE); 3007 if (child->d_inode) 3008 return -EEXIST; 3009 if (IS_DEADDIR(dir)) 3010 return -ENOENT; 3011 if (!fsuidgid_has_mapping(dir->i_sb, idmap)) 3012 return -EOVERFLOW; 3013 3014 return inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC); 3015 } 3016 3017 static struct dentry *lock_two_directories(struct dentry *p1, struct dentry *p2) 3018 { 3019 struct dentry *p; 3020 3021 p = d_ancestor(p2, p1); 3022 if (p) { 3023 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); 3024 inode_lock_nested(p1->d_inode, I_MUTEX_CHILD); 3025 return p; 3026 } 3027 3028 p = d_ancestor(p1, p2); 3029 if (p) { 3030 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 3031 inode_lock_nested(p2->d_inode, I_MUTEX_CHILD); 3032 return p; 3033 } 3034 3035 lock_two_inodes(p1->d_inode, p2->d_inode, 3036 I_MUTEX_PARENT, I_MUTEX_PARENT2); 3037 return NULL; 3038 } 3039 3040 /* 3041 * p1 and p2 should be directories on the same fs. 3042 */ 3043 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) 3044 { 3045 if (p1 == p2) { 3046 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 3047 return NULL; 3048 } 3049 3050 mutex_lock(&p1->d_sb->s_vfs_rename_mutex); 3051 return lock_two_directories(p1, p2); 3052 } 3053 EXPORT_SYMBOL(lock_rename); 3054 3055 /* 3056 * c1 and p2 should be on the same fs. 3057 */ 3058 struct dentry *lock_rename_child(struct dentry *c1, struct dentry *p2) 3059 { 3060 if (READ_ONCE(c1->d_parent) == p2) { 3061 /* 3062 * hopefully won't need to touch ->s_vfs_rename_mutex at all. 3063 */ 3064 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); 3065 /* 3066 * now that p2 is locked, nobody can move in or out of it, 3067 * so the test below is safe. 3068 */ 3069 if (likely(c1->d_parent == p2)) 3070 return NULL; 3071 3072 /* 3073 * c1 got moved out of p2 while we'd been taking locks; 3074 * unlock and fall back to slow case. 3075 */ 3076 inode_unlock(p2->d_inode); 3077 } 3078 3079 mutex_lock(&c1->d_sb->s_vfs_rename_mutex); 3080 /* 3081 * nobody can move out of any directories on this fs. 3082 */ 3083 if (likely(c1->d_parent != p2)) 3084 return lock_two_directories(c1->d_parent, p2); 3085 3086 /* 3087 * c1 got moved into p2 while we were taking locks; 3088 * we need p2 locked and ->s_vfs_rename_mutex unlocked, 3089 * for consistency with lock_rename(). 3090 */ 3091 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); 3092 mutex_unlock(&c1->d_sb->s_vfs_rename_mutex); 3093 return NULL; 3094 } 3095 EXPORT_SYMBOL(lock_rename_child); 3096 3097 void unlock_rename(struct dentry *p1, struct dentry *p2) 3098 { 3099 inode_unlock(p1->d_inode); 3100 if (p1 != p2) { 3101 inode_unlock(p2->d_inode); 3102 mutex_unlock(&p1->d_sb->s_vfs_rename_mutex); 3103 } 3104 } 3105 EXPORT_SYMBOL(unlock_rename); 3106 3107 /** 3108 * mode_strip_umask - handle vfs umask stripping 3109 * @dir: parent directory of the new inode 3110 * @mode: mode of the new inode to be created in @dir 3111 * 3112 * Umask stripping depends on whether or not the filesystem supports POSIX 3113 * ACLs. If the filesystem doesn't support it umask stripping is done directly 3114 * in here. If the filesystem does support POSIX ACLs umask stripping is 3115 * deferred until the filesystem calls posix_acl_create(). 3116 * 3117 * Returns: mode 3118 */ 3119 static inline umode_t mode_strip_umask(const struct inode *dir, umode_t mode) 3120 { 3121 if (!IS_POSIXACL(dir)) 3122 mode &= ~current_umask(); 3123 return mode; 3124 } 3125 3126 /** 3127 * vfs_prepare_mode - prepare the mode to be used for a new inode 3128 * @idmap: idmap of the mount the inode was found from 3129 * @dir: parent directory of the new inode 3130 * @mode: mode of the new inode 3131 * @mask_perms: allowed permission by the vfs 3132 * @type: type of file to be created 3133 * 3134 * This helper consolidates and enforces vfs restrictions on the @mode of a new 3135 * object to be created. 3136 * 3137 * Umask stripping depends on whether the filesystem supports POSIX ACLs (see 3138 * the kernel documentation for mode_strip_umask()). Moving umask stripping 3139 * after setgid stripping allows the same ordering for both non-POSIX ACL and 3140 * POSIX ACL supporting filesystems. 3141 * 3142 * Note that it's currently valid for @type to be 0 if a directory is created. 3143 * Filesystems raise that flag individually and we need to check whether each 3144 * filesystem can deal with receiving S_IFDIR from the vfs before we enforce a 3145 * non-zero type. 3146 * 3147 * Returns: mode to be passed to the filesystem 3148 */ 3149 static inline umode_t vfs_prepare_mode(struct mnt_idmap *idmap, 3150 const struct inode *dir, umode_t mode, 3151 umode_t mask_perms, umode_t type) 3152 { 3153 mode = mode_strip_sgid(idmap, dir, mode); 3154 mode = mode_strip_umask(dir, mode); 3155 3156 /* 3157 * Apply the vfs mandated allowed permission mask and set the type of 3158 * file to be created before we call into the filesystem. 3159 */ 3160 mode &= (mask_perms & ~S_IFMT); 3161 mode |= (type & S_IFMT); 3162 3163 return mode; 3164 } 3165 3166 /** 3167 * vfs_create - create new file 3168 * @idmap: idmap of the mount the inode was found from 3169 * @dir: inode of @dentry 3170 * @dentry: pointer to dentry of the base directory 3171 * @mode: mode of the new file 3172 * @want_excl: whether the file must not yet exist 3173 * 3174 * Create a new file. 3175 * 3176 * If the inode has been found through an idmapped mount the idmap of 3177 * the vfsmount must be passed through @idmap. This function will then take 3178 * care to map the inode according to @idmap before checking permissions. 3179 * On non-idmapped mounts or if permission checking is to be performed on the 3180 * raw inode simply passs @nop_mnt_idmap. 3181 */ 3182 int vfs_create(struct mnt_idmap *idmap, struct inode *dir, 3183 struct dentry *dentry, umode_t mode, bool want_excl) 3184 { 3185 int error; 3186 3187 error = may_create(idmap, dir, dentry); 3188 if (error) 3189 return error; 3190 3191 if (!dir->i_op->create) 3192 return -EACCES; /* shouldn't it be ENOSYS? */ 3193 3194 mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG); 3195 error = security_inode_create(dir, dentry, mode); 3196 if (error) 3197 return error; 3198 error = dir->i_op->create(idmap, dir, dentry, mode, want_excl); 3199 if (!error) 3200 fsnotify_create(dir, dentry); 3201 return error; 3202 } 3203 EXPORT_SYMBOL(vfs_create); 3204 3205 int vfs_mkobj(struct dentry *dentry, umode_t mode, 3206 int (*f)(struct dentry *, umode_t, void *), 3207 void *arg) 3208 { 3209 struct inode *dir = dentry->d_parent->d_inode; 3210 int error = may_create(&nop_mnt_idmap, dir, dentry); 3211 if (error) 3212 return error; 3213 3214 mode &= S_IALLUGO; 3215 mode |= S_IFREG; 3216 error = security_inode_create(dir, dentry, mode); 3217 if (error) 3218 return error; 3219 error = f(dentry, mode, arg); 3220 if (!error) 3221 fsnotify_create(dir, dentry); 3222 return error; 3223 } 3224 EXPORT_SYMBOL(vfs_mkobj); 3225 3226 bool may_open_dev(const struct path *path) 3227 { 3228 return !(path->mnt->mnt_flags & MNT_NODEV) && 3229 !(path->mnt->mnt_sb->s_iflags & SB_I_NODEV); 3230 } 3231 3232 static int may_open(struct mnt_idmap *idmap, const struct path *path, 3233 int acc_mode, int flag) 3234 { 3235 struct dentry *dentry = path->dentry; 3236 struct inode *inode = dentry->d_inode; 3237 int error; 3238 3239 if (!inode) 3240 return -ENOENT; 3241 3242 switch (inode->i_mode & S_IFMT) { 3243 case S_IFLNK: 3244 return -ELOOP; 3245 case S_IFDIR: 3246 if (acc_mode & MAY_WRITE) 3247 return -EISDIR; 3248 if (acc_mode & MAY_EXEC) 3249 return -EACCES; 3250 break; 3251 case S_IFBLK: 3252 case S_IFCHR: 3253 if (!may_open_dev(path)) 3254 return -EACCES; 3255 fallthrough; 3256 case S_IFIFO: 3257 case S_IFSOCK: 3258 if (acc_mode & MAY_EXEC) 3259 return -EACCES; 3260 flag &= ~O_TRUNC; 3261 break; 3262 case S_IFREG: 3263 if ((acc_mode & MAY_EXEC) && path_noexec(path)) 3264 return -EACCES; 3265 break; 3266 } 3267 3268 error = inode_permission(idmap, inode, MAY_OPEN | acc_mode); 3269 if (error) 3270 return error; 3271 3272 /* 3273 * An append-only file must be opened in append mode for writing. 3274 */ 3275 if (IS_APPEND(inode)) { 3276 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND)) 3277 return -EPERM; 3278 if (flag & O_TRUNC) 3279 return -EPERM; 3280 } 3281 3282 /* O_NOATIME can only be set by the owner or superuser */ 3283 if (flag & O_NOATIME && !inode_owner_or_capable(idmap, inode)) 3284 return -EPERM; 3285 3286 return 0; 3287 } 3288 3289 static int handle_truncate(struct mnt_idmap *idmap, struct file *filp) 3290 { 3291 const struct path *path = &filp->f_path; 3292 struct inode *inode = path->dentry->d_inode; 3293 int error = get_write_access(inode); 3294 if (error) 3295 return error; 3296 3297 error = security_file_truncate(filp); 3298 if (!error) { 3299 error = do_truncate(idmap, path->dentry, 0, 3300 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN, 3301 filp); 3302 } 3303 put_write_access(inode); 3304 return error; 3305 } 3306 3307 static inline int open_to_namei_flags(int flag) 3308 { 3309 if ((flag & O_ACCMODE) == 3) 3310 flag--; 3311 return flag; 3312 } 3313 3314 static int may_o_create(struct mnt_idmap *idmap, 3315 const struct path *dir, struct dentry *dentry, 3316 umode_t mode) 3317 { 3318 int error = security_path_mknod(dir, dentry, mode, 0); 3319 if (error) 3320 return error; 3321 3322 if (!fsuidgid_has_mapping(dir->dentry->d_sb, idmap)) 3323 return -EOVERFLOW; 3324 3325 error = inode_permission(idmap, dir->dentry->d_inode, 3326 MAY_WRITE | MAY_EXEC); 3327 if (error) 3328 return error; 3329 3330 return security_inode_create(dir->dentry->d_inode, dentry, mode); 3331 } 3332 3333 /* 3334 * Attempt to atomically look up, create and open a file from a negative 3335 * dentry. 3336 * 3337 * Returns 0 if successful. The file will have been created and attached to 3338 * @file by the filesystem calling finish_open(). 3339 * 3340 * If the file was looked up only or didn't need creating, FMODE_OPENED won't 3341 * be set. The caller will need to perform the open themselves. @path will 3342 * have been updated to point to the new dentry. This may be negative. 3343 * 3344 * Returns an error code otherwise. 3345 */ 3346 static struct dentry *atomic_open(struct nameidata *nd, struct dentry *dentry, 3347 struct file *file, 3348 int open_flag, umode_t mode) 3349 { 3350 struct dentry *const DENTRY_NOT_SET = (void *) -1UL; 3351 struct inode *dir = nd->path.dentry->d_inode; 3352 int error; 3353 3354 if (nd->flags & LOOKUP_DIRECTORY) 3355 open_flag |= O_DIRECTORY; 3356 3357 file->f_path.dentry = DENTRY_NOT_SET; 3358 file->f_path.mnt = nd->path.mnt; 3359 error = dir->i_op->atomic_open(dir, dentry, file, 3360 open_to_namei_flags(open_flag), mode); 3361 d_lookup_done(dentry); 3362 if (!error) { 3363 if (file->f_mode & FMODE_OPENED) { 3364 if (unlikely(dentry != file->f_path.dentry)) { 3365 dput(dentry); 3366 dentry = dget(file->f_path.dentry); 3367 } 3368 } else if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) { 3369 error = -EIO; 3370 } else { 3371 if (file->f_path.dentry) { 3372 dput(dentry); 3373 dentry = file->f_path.dentry; 3374 } 3375 if (unlikely(d_is_negative(dentry))) 3376 error = -ENOENT; 3377 } 3378 } 3379 if (error) { 3380 dput(dentry); 3381 dentry = ERR_PTR(error); 3382 } 3383 return dentry; 3384 } 3385 3386 /* 3387 * Look up and maybe create and open the last component. 3388 * 3389 * Must be called with parent locked (exclusive in O_CREAT case). 3390 * 3391 * Returns 0 on success, that is, if 3392 * the file was successfully atomically created (if necessary) and opened, or 3393 * the file was not completely opened at this time, though lookups and 3394 * creations were performed. 3395 * These case are distinguished by presence of FMODE_OPENED on file->f_mode. 3396 * In the latter case dentry returned in @path might be negative if O_CREAT 3397 * hadn't been specified. 3398 * 3399 * An error code is returned on failure. 3400 */ 3401 static struct dentry *lookup_open(struct nameidata *nd, struct file *file, 3402 const struct open_flags *op, 3403 bool got_write) 3404 { 3405 struct mnt_idmap *idmap; 3406 struct dentry *dir = nd->path.dentry; 3407 struct inode *dir_inode = dir->d_inode; 3408 int open_flag = op->open_flag; 3409 struct dentry *dentry; 3410 int error, create_error = 0; 3411 umode_t mode = op->mode; 3412 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq); 3413 3414 if (unlikely(IS_DEADDIR(dir_inode))) 3415 return ERR_PTR(-ENOENT); 3416 3417 file->f_mode &= ~FMODE_CREATED; 3418 dentry = d_lookup(dir, &nd->last); 3419 for (;;) { 3420 if (!dentry) { 3421 dentry = d_alloc_parallel(dir, &nd->last, &wq); 3422 if (IS_ERR(dentry)) 3423 return dentry; 3424 } 3425 if (d_in_lookup(dentry)) 3426 break; 3427 3428 error = d_revalidate(dentry, nd->flags); 3429 if (likely(error > 0)) 3430 break; 3431 if (error) 3432 goto out_dput; 3433 d_invalidate(dentry); 3434 dput(dentry); 3435 dentry = NULL; 3436 } 3437 if (dentry->d_inode) { 3438 /* Cached positive dentry: will open in f_op->open */ 3439 return dentry; 3440 } 3441 3442 /* 3443 * Checking write permission is tricky, bacuse we don't know if we are 3444 * going to actually need it: O_CREAT opens should work as long as the 3445 * file exists. But checking existence breaks atomicity. The trick is 3446 * to check access and if not granted clear O_CREAT from the flags. 3447 * 3448 * Another problem is returing the "right" error value (e.g. for an 3449 * O_EXCL open we want to return EEXIST not EROFS). 3450 */ 3451 if (unlikely(!got_write)) 3452 open_flag &= ~O_TRUNC; 3453 idmap = mnt_idmap(nd->path.mnt); 3454 if (open_flag & O_CREAT) { 3455 if (open_flag & O_EXCL) 3456 open_flag &= ~O_TRUNC; 3457 mode = vfs_prepare_mode(idmap, dir->d_inode, mode, mode, mode); 3458 if (likely(got_write)) 3459 create_error = may_o_create(idmap, &nd->path, 3460 dentry, mode); 3461 else 3462 create_error = -EROFS; 3463 } 3464 if (create_error) 3465 open_flag &= ~O_CREAT; 3466 if (dir_inode->i_op->atomic_open) { 3467 dentry = atomic_open(nd, dentry, file, open_flag, mode); 3468 if (unlikely(create_error) && dentry == ERR_PTR(-ENOENT)) 3469 dentry = ERR_PTR(create_error); 3470 return dentry; 3471 } 3472 3473 if (d_in_lookup(dentry)) { 3474 struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry, 3475 nd->flags); 3476 d_lookup_done(dentry); 3477 if (unlikely(res)) { 3478 if (IS_ERR(res)) { 3479 error = PTR_ERR(res); 3480 goto out_dput; 3481 } 3482 dput(dentry); 3483 dentry = res; 3484 } 3485 } 3486 3487 /* Negative dentry, just create the file */ 3488 if (!dentry->d_inode && (open_flag & O_CREAT)) { 3489 file->f_mode |= FMODE_CREATED; 3490 audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE); 3491 if (!dir_inode->i_op->create) { 3492 error = -EACCES; 3493 goto out_dput; 3494 } 3495 3496 error = dir_inode->i_op->create(idmap, dir_inode, dentry, 3497 mode, open_flag & O_EXCL); 3498 if (error) 3499 goto out_dput; 3500 } 3501 if (unlikely(create_error) && !dentry->d_inode) { 3502 error = create_error; 3503 goto out_dput; 3504 } 3505 return dentry; 3506 3507 out_dput: 3508 dput(dentry); 3509 return ERR_PTR(error); 3510 } 3511 3512 static const char *open_last_lookups(struct nameidata *nd, 3513 struct file *file, const struct open_flags *op) 3514 { 3515 struct dentry *dir = nd->path.dentry; 3516 int open_flag = op->open_flag; 3517 bool got_write = false; 3518 struct dentry *dentry; 3519 const char *res; 3520 3521 nd->flags |= op->intent; 3522 3523 if (nd->last_type != LAST_NORM) { 3524 if (nd->depth) 3525 put_link(nd); 3526 return handle_dots(nd, nd->last_type); 3527 } 3528 3529 if (!(open_flag & O_CREAT)) { 3530 if (nd->last.name[nd->last.len]) 3531 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 3532 /* we _can_ be in RCU mode here */ 3533 dentry = lookup_fast(nd); 3534 if (IS_ERR(dentry)) 3535 return ERR_CAST(dentry); 3536 if (likely(dentry)) 3537 goto finish_lookup; 3538 3539 BUG_ON(nd->flags & LOOKUP_RCU); 3540 } else { 3541 /* create side of things */ 3542 if (nd->flags & LOOKUP_RCU) { 3543 if (!try_to_unlazy(nd)) 3544 return ERR_PTR(-ECHILD); 3545 } 3546 audit_inode(nd->name, dir, AUDIT_INODE_PARENT); 3547 /* trailing slashes? */ 3548 if (unlikely(nd->last.name[nd->last.len])) 3549 return ERR_PTR(-EISDIR); 3550 } 3551 3552 if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) { 3553 got_write = !mnt_want_write(nd->path.mnt); 3554 /* 3555 * do _not_ fail yet - we might not need that or fail with 3556 * a different error; let lookup_open() decide; we'll be 3557 * dropping this one anyway. 3558 */ 3559 } 3560 if (open_flag & O_CREAT) 3561 inode_lock(dir->d_inode); 3562 else 3563 inode_lock_shared(dir->d_inode); 3564 dentry = lookup_open(nd, file, op, got_write); 3565 if (!IS_ERR(dentry) && (file->f_mode & FMODE_CREATED)) 3566 fsnotify_create(dir->d_inode, dentry); 3567 if (open_flag & O_CREAT) 3568 inode_unlock(dir->d_inode); 3569 else 3570 inode_unlock_shared(dir->d_inode); 3571 3572 if (got_write) 3573 mnt_drop_write(nd->path.mnt); 3574 3575 if (IS_ERR(dentry)) 3576 return ERR_CAST(dentry); 3577 3578 if (file->f_mode & (FMODE_OPENED | FMODE_CREATED)) { 3579 dput(nd->path.dentry); 3580 nd->path.dentry = dentry; 3581 return NULL; 3582 } 3583 3584 finish_lookup: 3585 if (nd->depth) 3586 put_link(nd); 3587 res = step_into(nd, WALK_TRAILING, dentry); 3588 if (unlikely(res)) 3589 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL); 3590 return res; 3591 } 3592 3593 /* 3594 * Handle the last step of open() 3595 */ 3596 static int do_open(struct nameidata *nd, 3597 struct file *file, const struct open_flags *op) 3598 { 3599 struct mnt_idmap *idmap; 3600 int open_flag = op->open_flag; 3601 bool do_truncate; 3602 int acc_mode; 3603 int error; 3604 3605 if (!(file->f_mode & (FMODE_OPENED | FMODE_CREATED))) { 3606 error = complete_walk(nd); 3607 if (error) 3608 return error; 3609 } 3610 if (!(file->f_mode & FMODE_CREATED)) 3611 audit_inode(nd->name, nd->path.dentry, 0); 3612 idmap = mnt_idmap(nd->path.mnt); 3613 if (open_flag & O_CREAT) { 3614 if ((open_flag & O_EXCL) && !(file->f_mode & FMODE_CREATED)) 3615 return -EEXIST; 3616 if (d_is_dir(nd->path.dentry)) 3617 return -EISDIR; 3618 error = may_create_in_sticky(idmap, nd, 3619 d_backing_inode(nd->path.dentry)); 3620 if (unlikely(error)) 3621 return error; 3622 } 3623 if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry)) 3624 return -ENOTDIR; 3625 3626 do_truncate = false; 3627 acc_mode = op->acc_mode; 3628 if (file->f_mode & FMODE_CREATED) { 3629 /* Don't check for write permission, don't truncate */ 3630 open_flag &= ~O_TRUNC; 3631 acc_mode = 0; 3632 } else if (d_is_reg(nd->path.dentry) && open_flag & O_TRUNC) { 3633 error = mnt_want_write(nd->path.mnt); 3634 if (error) 3635 return error; 3636 do_truncate = true; 3637 } 3638 error = may_open(idmap, &nd->path, acc_mode, open_flag); 3639 if (!error && !(file->f_mode & FMODE_OPENED)) 3640 error = vfs_open(&nd->path, file); 3641 if (!error) 3642 error = ima_file_check(file, op->acc_mode); 3643 if (!error && do_truncate) 3644 error = handle_truncate(idmap, file); 3645 if (unlikely(error > 0)) { 3646 WARN_ON(1); 3647 error = -EINVAL; 3648 } 3649 if (do_truncate) 3650 mnt_drop_write(nd->path.mnt); 3651 return error; 3652 } 3653 3654 /** 3655 * vfs_tmpfile - create tmpfile 3656 * @idmap: idmap of the mount the inode was found from 3657 * @parentpath: pointer to the path of the base directory 3658 * @file: file descriptor of the new tmpfile 3659 * @mode: mode of the new tmpfile 3660 * 3661 * Create a temporary file. 3662 * 3663 * If the inode has been found through an idmapped mount the idmap of 3664 * the vfsmount must be passed through @idmap. This function will then take 3665 * care to map the inode according to @idmap before checking permissions. 3666 * On non-idmapped mounts or if permission checking is to be performed on the 3667 * raw inode simply passs @nop_mnt_idmap. 3668 */ 3669 static int vfs_tmpfile(struct mnt_idmap *idmap, 3670 const struct path *parentpath, 3671 struct file *file, umode_t mode) 3672 { 3673 struct dentry *child; 3674 struct inode *dir = d_inode(parentpath->dentry); 3675 struct inode *inode; 3676 int error; 3677 int open_flag = file->f_flags; 3678 3679 /* we want directory to be writable */ 3680 error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC); 3681 if (error) 3682 return error; 3683 if (!dir->i_op->tmpfile) 3684 return -EOPNOTSUPP; 3685 child = d_alloc(parentpath->dentry, &slash_name); 3686 if (unlikely(!child)) 3687 return -ENOMEM; 3688 file->f_path.mnt = parentpath->mnt; 3689 file->f_path.dentry = child; 3690 mode = vfs_prepare_mode(idmap, dir, mode, mode, mode); 3691 error = dir->i_op->tmpfile(idmap, dir, file, mode); 3692 dput(child); 3693 if (error) 3694 return error; 3695 /* Don't check for other permissions, the inode was just created */ 3696 error = may_open(idmap, &file->f_path, 0, file->f_flags); 3697 if (error) 3698 return error; 3699 inode = file_inode(file); 3700 if (!(open_flag & O_EXCL)) { 3701 spin_lock(&inode->i_lock); 3702 inode->i_state |= I_LINKABLE; 3703 spin_unlock(&inode->i_lock); 3704 } 3705 ima_post_create_tmpfile(idmap, inode); 3706 return 0; 3707 } 3708 3709 /** 3710 * kernel_tmpfile_open - open a tmpfile for kernel internal use 3711 * @idmap: idmap of the mount the inode was found from 3712 * @parentpath: path of the base directory 3713 * @mode: mode of the new tmpfile 3714 * @open_flag: flags 3715 * @cred: credentials for open 3716 * 3717 * Create and open a temporary file. The file is not accounted in nr_files, 3718 * hence this is only for kernel internal use, and must not be installed into 3719 * file tables or such. 3720 */ 3721 struct file *kernel_tmpfile_open(struct mnt_idmap *idmap, 3722 const struct path *parentpath, 3723 umode_t mode, int open_flag, 3724 const struct cred *cred) 3725 { 3726 struct file *file; 3727 int error; 3728 3729 file = alloc_empty_file_noaccount(open_flag, cred); 3730 if (IS_ERR(file)) 3731 return file; 3732 3733 error = vfs_tmpfile(idmap, parentpath, file, mode); 3734 if (error) { 3735 fput(file); 3736 file = ERR_PTR(error); 3737 } 3738 return file; 3739 } 3740 EXPORT_SYMBOL(kernel_tmpfile_open); 3741 3742 static int do_tmpfile(struct nameidata *nd, unsigned flags, 3743 const struct open_flags *op, 3744 struct file *file) 3745 { 3746 struct path path; 3747 int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path); 3748 3749 if (unlikely(error)) 3750 return error; 3751 error = mnt_want_write(path.mnt); 3752 if (unlikely(error)) 3753 goto out; 3754 error = vfs_tmpfile(mnt_idmap(path.mnt), &path, file, op->mode); 3755 if (error) 3756 goto out2; 3757 audit_inode(nd->name, file->f_path.dentry, 0); 3758 out2: 3759 mnt_drop_write(path.mnt); 3760 out: 3761 path_put(&path); 3762 return error; 3763 } 3764 3765 static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file) 3766 { 3767 struct path path; 3768 int error = path_lookupat(nd, flags, &path); 3769 if (!error) { 3770 audit_inode(nd->name, path.dentry, 0); 3771 error = vfs_open(&path, file); 3772 path_put(&path); 3773 } 3774 return error; 3775 } 3776 3777 static struct file *path_openat(struct nameidata *nd, 3778 const struct open_flags *op, unsigned flags) 3779 { 3780 struct file *file; 3781 int error; 3782 3783 file = alloc_empty_file(op->open_flag, current_cred()); 3784 if (IS_ERR(file)) 3785 return file; 3786 3787 if (unlikely(file->f_flags & __O_TMPFILE)) { 3788 error = do_tmpfile(nd, flags, op, file); 3789 } else if (unlikely(file->f_flags & O_PATH)) { 3790 error = do_o_path(nd, flags, file); 3791 } else { 3792 const char *s = path_init(nd, flags); 3793 while (!(error = link_path_walk(s, nd)) && 3794 (s = open_last_lookups(nd, file, op)) != NULL) 3795 ; 3796 if (!error) 3797 error = do_open(nd, file, op); 3798 terminate_walk(nd); 3799 } 3800 if (likely(!error)) { 3801 if (likely(file->f_mode & FMODE_OPENED)) 3802 return file; 3803 WARN_ON(1); 3804 error = -EINVAL; 3805 } 3806 fput(file); 3807 if (error == -EOPENSTALE) { 3808 if (flags & LOOKUP_RCU) 3809 error = -ECHILD; 3810 else 3811 error = -ESTALE; 3812 } 3813 return ERR_PTR(error); 3814 } 3815 3816 struct file *do_filp_open(int dfd, struct filename *pathname, 3817 const struct open_flags *op) 3818 { 3819 struct nameidata nd; 3820 int flags = op->lookup_flags; 3821 struct file *filp; 3822 3823 set_nameidata(&nd, dfd, pathname, NULL); 3824 filp = path_openat(&nd, op, flags | LOOKUP_RCU); 3825 if (unlikely(filp == ERR_PTR(-ECHILD))) 3826 filp = path_openat(&nd, op, flags); 3827 if (unlikely(filp == ERR_PTR(-ESTALE))) 3828 filp = path_openat(&nd, op, flags | LOOKUP_REVAL); 3829 restore_nameidata(); 3830 return filp; 3831 } 3832 3833 struct file *do_file_open_root(const struct path *root, 3834 const char *name, const struct open_flags *op) 3835 { 3836 struct nameidata nd; 3837 struct file *file; 3838 struct filename *filename; 3839 int flags = op->lookup_flags; 3840 3841 if (d_is_symlink(root->dentry) && op->intent & LOOKUP_OPEN) 3842 return ERR_PTR(-ELOOP); 3843 3844 filename = getname_kernel(name); 3845 if (IS_ERR(filename)) 3846 return ERR_CAST(filename); 3847 3848 set_nameidata(&nd, -1, filename, root); 3849 file = path_openat(&nd, op, flags | LOOKUP_RCU); 3850 if (unlikely(file == ERR_PTR(-ECHILD))) 3851 file = path_openat(&nd, op, flags); 3852 if (unlikely(file == ERR_PTR(-ESTALE))) 3853 file = path_openat(&nd, op, flags | LOOKUP_REVAL); 3854 restore_nameidata(); 3855 putname(filename); 3856 return file; 3857 } 3858 3859 static struct dentry *filename_create(int dfd, struct filename *name, 3860 struct path *path, unsigned int lookup_flags) 3861 { 3862 struct dentry *dentry = ERR_PTR(-EEXIST); 3863 struct qstr last; 3864 bool want_dir = lookup_flags & LOOKUP_DIRECTORY; 3865 unsigned int reval_flag = lookup_flags & LOOKUP_REVAL; 3866 unsigned int create_flags = LOOKUP_CREATE | LOOKUP_EXCL; 3867 int type; 3868 int err2; 3869 int error; 3870 3871 error = filename_parentat(dfd, name, reval_flag, path, &last, &type); 3872 if (error) 3873 return ERR_PTR(error); 3874 3875 /* 3876 * Yucky last component or no last component at all? 3877 * (foo/., foo/.., /////) 3878 */ 3879 if (unlikely(type != LAST_NORM)) 3880 goto out; 3881 3882 /* don't fail immediately if it's r/o, at least try to report other errors */ 3883 err2 = mnt_want_write(path->mnt); 3884 /* 3885 * Do the final lookup. Suppress 'create' if there is a trailing 3886 * '/', and a directory wasn't requested. 3887 */ 3888 if (last.name[last.len] && !want_dir) 3889 create_flags = 0; 3890 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT); 3891 dentry = lookup_one_qstr_excl(&last, path->dentry, 3892 reval_flag | create_flags); 3893 if (IS_ERR(dentry)) 3894 goto unlock; 3895 3896 error = -EEXIST; 3897 if (d_is_positive(dentry)) 3898 goto fail; 3899 3900 /* 3901 * Special case - lookup gave negative, but... we had foo/bar/ 3902 * From the vfs_mknod() POV we just have a negative dentry - 3903 * all is fine. Let's be bastards - you had / on the end, you've 3904 * been asking for (non-existent) directory. -ENOENT for you. 3905 */ 3906 if (unlikely(!create_flags)) { 3907 error = -ENOENT; 3908 goto fail; 3909 } 3910 if (unlikely(err2)) { 3911 error = err2; 3912 goto fail; 3913 } 3914 return dentry; 3915 fail: 3916 dput(dentry); 3917 dentry = ERR_PTR(error); 3918 unlock: 3919 inode_unlock(path->dentry->d_inode); 3920 if (!err2) 3921 mnt_drop_write(path->mnt); 3922 out: 3923 path_put(path); 3924 return dentry; 3925 } 3926 3927 struct dentry *kern_path_create(int dfd, const char *pathname, 3928 struct path *path, unsigned int lookup_flags) 3929 { 3930 struct filename *filename = getname_kernel(pathname); 3931 struct dentry *res = filename_create(dfd, filename, path, lookup_flags); 3932 3933 putname(filename); 3934 return res; 3935 } 3936 EXPORT_SYMBOL(kern_path_create); 3937 3938 void done_path_create(struct path *path, struct dentry *dentry) 3939 { 3940 dput(dentry); 3941 inode_unlock(path->dentry->d_inode); 3942 mnt_drop_write(path->mnt); 3943 path_put(path); 3944 } 3945 EXPORT_SYMBOL(done_path_create); 3946 3947 inline struct dentry *user_path_create(int dfd, const char __user *pathname, 3948 struct path *path, unsigned int lookup_flags) 3949 { 3950 struct filename *filename = getname(pathname); 3951 struct dentry *res = filename_create(dfd, filename, path, lookup_flags); 3952 3953 putname(filename); 3954 return res; 3955 } 3956 EXPORT_SYMBOL(user_path_create); 3957 3958 /** 3959 * vfs_mknod - create device node or file 3960 * @idmap: idmap of the mount the inode was found from 3961 * @dir: inode of @dentry 3962 * @dentry: pointer to dentry of the base directory 3963 * @mode: mode of the new device node or file 3964 * @dev: device number of device to create 3965 * 3966 * Create a device node or file. 3967 * 3968 * If the inode has been found through an idmapped mount the idmap of 3969 * the vfsmount must be passed through @idmap. This function will then take 3970 * care to map the inode according to @idmap before checking permissions. 3971 * On non-idmapped mounts or if permission checking is to be performed on the 3972 * raw inode simply passs @nop_mnt_idmap. 3973 */ 3974 int vfs_mknod(struct mnt_idmap *idmap, struct inode *dir, 3975 struct dentry *dentry, umode_t mode, dev_t dev) 3976 { 3977 bool is_whiteout = S_ISCHR(mode) && dev == WHITEOUT_DEV; 3978 int error = may_create(idmap, dir, dentry); 3979 3980 if (error) 3981 return error; 3982 3983 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !is_whiteout && 3984 !capable(CAP_MKNOD)) 3985 return -EPERM; 3986 3987 if (!dir->i_op->mknod) 3988 return -EPERM; 3989 3990 mode = vfs_prepare_mode(idmap, dir, mode, mode, mode); 3991 error = devcgroup_inode_mknod(mode, dev); 3992 if (error) 3993 return error; 3994 3995 error = security_inode_mknod(dir, dentry, mode, dev); 3996 if (error) 3997 return error; 3998 3999 error = dir->i_op->mknod(idmap, dir, dentry, mode, dev); 4000 if (!error) 4001 fsnotify_create(dir, dentry); 4002 return error; 4003 } 4004 EXPORT_SYMBOL(vfs_mknod); 4005 4006 static int may_mknod(umode_t mode) 4007 { 4008 switch (mode & S_IFMT) { 4009 case S_IFREG: 4010 case S_IFCHR: 4011 case S_IFBLK: 4012 case S_IFIFO: 4013 case S_IFSOCK: 4014 case 0: /* zero mode translates to S_IFREG */ 4015 return 0; 4016 case S_IFDIR: 4017 return -EPERM; 4018 default: 4019 return -EINVAL; 4020 } 4021 } 4022 4023 static int do_mknodat(int dfd, struct filename *name, umode_t mode, 4024 unsigned int dev) 4025 { 4026 struct mnt_idmap *idmap; 4027 struct dentry *dentry; 4028 struct path path; 4029 int error; 4030 unsigned int lookup_flags = 0; 4031 4032 error = may_mknod(mode); 4033 if (error) 4034 goto out1; 4035 retry: 4036 dentry = filename_create(dfd, name, &path, lookup_flags); 4037 error = PTR_ERR(dentry); 4038 if (IS_ERR(dentry)) 4039 goto out1; 4040 4041 error = security_path_mknod(&path, dentry, 4042 mode_strip_umask(path.dentry->d_inode, mode), dev); 4043 if (error) 4044 goto out2; 4045 4046 idmap = mnt_idmap(path.mnt); 4047 switch (mode & S_IFMT) { 4048 case 0: case S_IFREG: 4049 error = vfs_create(idmap, path.dentry->d_inode, 4050 dentry, mode, true); 4051 if (!error) 4052 ima_post_path_mknod(idmap, dentry); 4053 break; 4054 case S_IFCHR: case S_IFBLK: 4055 error = vfs_mknod(idmap, path.dentry->d_inode, 4056 dentry, mode, new_decode_dev(dev)); 4057 break; 4058 case S_IFIFO: case S_IFSOCK: 4059 error = vfs_mknod(idmap, path.dentry->d_inode, 4060 dentry, mode, 0); 4061 break; 4062 } 4063 out2: 4064 done_path_create(&path, dentry); 4065 if (retry_estale(error, lookup_flags)) { 4066 lookup_flags |= LOOKUP_REVAL; 4067 goto retry; 4068 } 4069 out1: 4070 putname(name); 4071 return error; 4072 } 4073 4074 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, 4075 unsigned int, dev) 4076 { 4077 return do_mknodat(dfd, getname(filename), mode, dev); 4078 } 4079 4080 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev) 4081 { 4082 return do_mknodat(AT_FDCWD, getname(filename), mode, dev); 4083 } 4084 4085 /** 4086 * vfs_mkdir - create directory 4087 * @idmap: idmap of the mount the inode was found from 4088 * @dir: inode of @dentry 4089 * @dentry: pointer to dentry of the base directory 4090 * @mode: mode of the new directory 4091 * 4092 * Create a directory. 4093 * 4094 * If the inode has been found through an idmapped mount the idmap of 4095 * the vfsmount must be passed through @idmap. This function will then take 4096 * care to map the inode according to @idmap before checking permissions. 4097 * On non-idmapped mounts or if permission checking is to be performed on the 4098 * raw inode simply passs @nop_mnt_idmap. 4099 */ 4100 int vfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, 4101 struct dentry *dentry, umode_t mode) 4102 { 4103 int error; 4104 unsigned max_links = dir->i_sb->s_max_links; 4105 4106 error = may_create(idmap, dir, dentry); 4107 if (error) 4108 return error; 4109 4110 if (!dir->i_op->mkdir) 4111 return -EPERM; 4112 4113 mode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO | S_ISVTX, 0); 4114 error = security_inode_mkdir(dir, dentry, mode); 4115 if (error) 4116 return error; 4117 4118 if (max_links && dir->i_nlink >= max_links) 4119 return -EMLINK; 4120 4121 error = dir->i_op->mkdir(idmap, dir, dentry, mode); 4122 if (!error) 4123 fsnotify_mkdir(dir, dentry); 4124 return error; 4125 } 4126 EXPORT_SYMBOL(vfs_mkdir); 4127 4128 int do_mkdirat(int dfd, struct filename *name, umode_t mode) 4129 { 4130 struct dentry *dentry; 4131 struct path path; 4132 int error; 4133 unsigned int lookup_flags = LOOKUP_DIRECTORY; 4134 4135 retry: 4136 dentry = filename_create(dfd, name, &path, lookup_flags); 4137 error = PTR_ERR(dentry); 4138 if (IS_ERR(dentry)) 4139 goto out_putname; 4140 4141 error = security_path_mkdir(&path, dentry, 4142 mode_strip_umask(path.dentry->d_inode, mode)); 4143 if (!error) { 4144 error = vfs_mkdir(mnt_idmap(path.mnt), path.dentry->d_inode, 4145 dentry, mode); 4146 } 4147 done_path_create(&path, dentry); 4148 if (retry_estale(error, lookup_flags)) { 4149 lookup_flags |= LOOKUP_REVAL; 4150 goto retry; 4151 } 4152 out_putname: 4153 putname(name); 4154 return error; 4155 } 4156 4157 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) 4158 { 4159 return do_mkdirat(dfd, getname(pathname), mode); 4160 } 4161 4162 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode) 4163 { 4164 return do_mkdirat(AT_FDCWD, getname(pathname), mode); 4165 } 4166 4167 /** 4168 * vfs_rmdir - remove directory 4169 * @idmap: idmap of the mount the inode was found from 4170 * @dir: inode of @dentry 4171 * @dentry: pointer to dentry of the base directory 4172 * 4173 * Remove a directory. 4174 * 4175 * If the inode has been found through an idmapped mount the idmap of 4176 * the vfsmount must be passed through @idmap. This function will then take 4177 * care to map the inode according to @idmap before checking permissions. 4178 * On non-idmapped mounts or if permission checking is to be performed on the 4179 * raw inode simply passs @nop_mnt_idmap. 4180 */ 4181 int vfs_rmdir(struct mnt_idmap *idmap, struct inode *dir, 4182 struct dentry *dentry) 4183 { 4184 int error = may_delete(idmap, dir, dentry, 1); 4185 4186 if (error) 4187 return error; 4188 4189 if (!dir->i_op->rmdir) 4190 return -EPERM; 4191 4192 dget(dentry); 4193 inode_lock(dentry->d_inode); 4194 4195 error = -EBUSY; 4196 if (is_local_mountpoint(dentry) || 4197 (dentry->d_inode->i_flags & S_KERNEL_FILE)) 4198 goto out; 4199 4200 error = security_inode_rmdir(dir, dentry); 4201 if (error) 4202 goto out; 4203 4204 error = dir->i_op->rmdir(dir, dentry); 4205 if (error) 4206 goto out; 4207 4208 shrink_dcache_parent(dentry); 4209 dentry->d_inode->i_flags |= S_DEAD; 4210 dont_mount(dentry); 4211 detach_mounts(dentry); 4212 4213 out: 4214 inode_unlock(dentry->d_inode); 4215 dput(dentry); 4216 if (!error) 4217 d_delete_notify(dir, dentry); 4218 return error; 4219 } 4220 EXPORT_SYMBOL(vfs_rmdir); 4221 4222 int do_rmdir(int dfd, struct filename *name) 4223 { 4224 int error; 4225 struct dentry *dentry; 4226 struct path path; 4227 struct qstr last; 4228 int type; 4229 unsigned int lookup_flags = 0; 4230 retry: 4231 error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type); 4232 if (error) 4233 goto exit1; 4234 4235 switch (type) { 4236 case LAST_DOTDOT: 4237 error = -ENOTEMPTY; 4238 goto exit2; 4239 case LAST_DOT: 4240 error = -EINVAL; 4241 goto exit2; 4242 case LAST_ROOT: 4243 error = -EBUSY; 4244 goto exit2; 4245 } 4246 4247 error = mnt_want_write(path.mnt); 4248 if (error) 4249 goto exit2; 4250 4251 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT); 4252 dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags); 4253 error = PTR_ERR(dentry); 4254 if (IS_ERR(dentry)) 4255 goto exit3; 4256 if (!dentry->d_inode) { 4257 error = -ENOENT; 4258 goto exit4; 4259 } 4260 error = security_path_rmdir(&path, dentry); 4261 if (error) 4262 goto exit4; 4263 error = vfs_rmdir(mnt_idmap(path.mnt), path.dentry->d_inode, dentry); 4264 exit4: 4265 dput(dentry); 4266 exit3: 4267 inode_unlock(path.dentry->d_inode); 4268 mnt_drop_write(path.mnt); 4269 exit2: 4270 path_put(&path); 4271 if (retry_estale(error, lookup_flags)) { 4272 lookup_flags |= LOOKUP_REVAL; 4273 goto retry; 4274 } 4275 exit1: 4276 putname(name); 4277 return error; 4278 } 4279 4280 SYSCALL_DEFINE1(rmdir, const char __user *, pathname) 4281 { 4282 return do_rmdir(AT_FDCWD, getname(pathname)); 4283 } 4284 4285 /** 4286 * vfs_unlink - unlink a filesystem object 4287 * @idmap: idmap of the mount the inode was found from 4288 * @dir: parent directory 4289 * @dentry: victim 4290 * @delegated_inode: returns victim inode, if the inode is delegated. 4291 * 4292 * The caller must hold dir->i_mutex. 4293 * 4294 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and 4295 * return a reference to the inode in delegated_inode. The caller 4296 * should then break the delegation on that inode and retry. Because 4297 * breaking a delegation may take a long time, the caller should drop 4298 * dir->i_mutex before doing so. 4299 * 4300 * Alternatively, a caller may pass NULL for delegated_inode. This may 4301 * be appropriate for callers that expect the underlying filesystem not 4302 * to be NFS exported. 4303 * 4304 * If the inode has been found through an idmapped mount the idmap of 4305 * the vfsmount must be passed through @idmap. This function will then take 4306 * care to map the inode according to @idmap before checking permissions. 4307 * On non-idmapped mounts or if permission checking is to be performed on the 4308 * raw inode simply passs @nop_mnt_idmap. 4309 */ 4310 int vfs_unlink(struct mnt_idmap *idmap, struct inode *dir, 4311 struct dentry *dentry, struct inode **delegated_inode) 4312 { 4313 struct inode *target = dentry->d_inode; 4314 int error = may_delete(idmap, dir, dentry, 0); 4315 4316 if (error) 4317 return error; 4318 4319 if (!dir->i_op->unlink) 4320 return -EPERM; 4321 4322 inode_lock(target); 4323 if (IS_SWAPFILE(target)) 4324 error = -EPERM; 4325 else if (is_local_mountpoint(dentry)) 4326 error = -EBUSY; 4327 else { 4328 error = security_inode_unlink(dir, dentry); 4329 if (!error) { 4330 error = try_break_deleg(target, delegated_inode); 4331 if (error) 4332 goto out; 4333 error = dir->i_op->unlink(dir, dentry); 4334 if (!error) { 4335 dont_mount(dentry); 4336 detach_mounts(dentry); 4337 } 4338 } 4339 } 4340 out: 4341 inode_unlock(target); 4342 4343 /* We don't d_delete() NFS sillyrenamed files--they still exist. */ 4344 if (!error && dentry->d_flags & DCACHE_NFSFS_RENAMED) { 4345 fsnotify_unlink(dir, dentry); 4346 } else if (!error) { 4347 fsnotify_link_count(target); 4348 d_delete_notify(dir, dentry); 4349 } 4350 4351 return error; 4352 } 4353 EXPORT_SYMBOL(vfs_unlink); 4354 4355 /* 4356 * Make sure that the actual truncation of the file will occur outside its 4357 * directory's i_mutex. Truncate can take a long time if there is a lot of 4358 * writeout happening, and we don't want to prevent access to the directory 4359 * while waiting on the I/O. 4360 */ 4361 int do_unlinkat(int dfd, struct filename *name) 4362 { 4363 int error; 4364 struct dentry *dentry; 4365 struct path path; 4366 struct qstr last; 4367 int type; 4368 struct inode *inode = NULL; 4369 struct inode *delegated_inode = NULL; 4370 unsigned int lookup_flags = 0; 4371 retry: 4372 error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type); 4373 if (error) 4374 goto exit1; 4375 4376 error = -EISDIR; 4377 if (type != LAST_NORM) 4378 goto exit2; 4379 4380 error = mnt_want_write(path.mnt); 4381 if (error) 4382 goto exit2; 4383 retry_deleg: 4384 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT); 4385 dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags); 4386 error = PTR_ERR(dentry); 4387 if (!IS_ERR(dentry)) { 4388 4389 /* Why not before? Because we want correct error value */ 4390 if (last.name[last.len]) 4391 goto slashes; 4392 inode = dentry->d_inode; 4393 if (d_is_negative(dentry)) 4394 goto slashes; 4395 ihold(inode); 4396 error = security_path_unlink(&path, dentry); 4397 if (error) 4398 goto exit3; 4399 error = vfs_unlink(mnt_idmap(path.mnt), path.dentry->d_inode, 4400 dentry, &delegated_inode); 4401 exit3: 4402 dput(dentry); 4403 } 4404 inode_unlock(path.dentry->d_inode); 4405 if (inode) 4406 iput(inode); /* truncate the inode here */ 4407 inode = NULL; 4408 if (delegated_inode) { 4409 error = break_deleg_wait(&delegated_inode); 4410 if (!error) 4411 goto retry_deleg; 4412 } 4413 mnt_drop_write(path.mnt); 4414 exit2: 4415 path_put(&path); 4416 if (retry_estale(error, lookup_flags)) { 4417 lookup_flags |= LOOKUP_REVAL; 4418 inode = NULL; 4419 goto retry; 4420 } 4421 exit1: 4422 putname(name); 4423 return error; 4424 4425 slashes: 4426 if (d_is_negative(dentry)) 4427 error = -ENOENT; 4428 else if (d_is_dir(dentry)) 4429 error = -EISDIR; 4430 else 4431 error = -ENOTDIR; 4432 goto exit3; 4433 } 4434 4435 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) 4436 { 4437 if ((flag & ~AT_REMOVEDIR) != 0) 4438 return -EINVAL; 4439 4440 if (flag & AT_REMOVEDIR) 4441 return do_rmdir(dfd, getname(pathname)); 4442 return do_unlinkat(dfd, getname(pathname)); 4443 } 4444 4445 SYSCALL_DEFINE1(unlink, const char __user *, pathname) 4446 { 4447 return do_unlinkat(AT_FDCWD, getname(pathname)); 4448 } 4449 4450 /** 4451 * vfs_symlink - create symlink 4452 * @idmap: idmap of the mount the inode was found from 4453 * @dir: inode of @dentry 4454 * @dentry: pointer to dentry of the base directory 4455 * @oldname: name of the file to link to 4456 * 4457 * Create a symlink. 4458 * 4459 * If the inode has been found through an idmapped mount the idmap of 4460 * the vfsmount must be passed through @idmap. This function will then take 4461 * care to map the inode according to @idmap before checking permissions. 4462 * On non-idmapped mounts or if permission checking is to be performed on the 4463 * raw inode simply passs @nop_mnt_idmap. 4464 */ 4465 int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir, 4466 struct dentry *dentry, const char *oldname) 4467 { 4468 int error; 4469 4470 error = may_create(idmap, dir, dentry); 4471 if (error) 4472 return error; 4473 4474 if (!dir->i_op->symlink) 4475 return -EPERM; 4476 4477 error = security_inode_symlink(dir, dentry, oldname); 4478 if (error) 4479 return error; 4480 4481 error = dir->i_op->symlink(idmap, dir, dentry, oldname); 4482 if (!error) 4483 fsnotify_create(dir, dentry); 4484 return error; 4485 } 4486 EXPORT_SYMBOL(vfs_symlink); 4487 4488 int do_symlinkat(struct filename *from, int newdfd, struct filename *to) 4489 { 4490 int error; 4491 struct dentry *dentry; 4492 struct path path; 4493 unsigned int lookup_flags = 0; 4494 4495 if (IS_ERR(from)) { 4496 error = PTR_ERR(from); 4497 goto out_putnames; 4498 } 4499 retry: 4500 dentry = filename_create(newdfd, to, &path, lookup_flags); 4501 error = PTR_ERR(dentry); 4502 if (IS_ERR(dentry)) 4503 goto out_putnames; 4504 4505 error = security_path_symlink(&path, dentry, from->name); 4506 if (!error) 4507 error = vfs_symlink(mnt_idmap(path.mnt), path.dentry->d_inode, 4508 dentry, from->name); 4509 done_path_create(&path, dentry); 4510 if (retry_estale(error, lookup_flags)) { 4511 lookup_flags |= LOOKUP_REVAL; 4512 goto retry; 4513 } 4514 out_putnames: 4515 putname(to); 4516 putname(from); 4517 return error; 4518 } 4519 4520 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, 4521 int, newdfd, const char __user *, newname) 4522 { 4523 return do_symlinkat(getname(oldname), newdfd, getname(newname)); 4524 } 4525 4526 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) 4527 { 4528 return do_symlinkat(getname(oldname), AT_FDCWD, getname(newname)); 4529 } 4530 4531 /** 4532 * vfs_link - create a new link 4533 * @old_dentry: object to be linked 4534 * @idmap: idmap of the mount 4535 * @dir: new parent 4536 * @new_dentry: where to create the new link 4537 * @delegated_inode: returns inode needing a delegation break 4538 * 4539 * The caller must hold dir->i_mutex 4540 * 4541 * If vfs_link discovers a delegation on the to-be-linked file in need 4542 * of breaking, it will return -EWOULDBLOCK and return a reference to the 4543 * inode in delegated_inode. The caller should then break the delegation 4544 * and retry. Because breaking a delegation may take a long time, the 4545 * caller should drop the i_mutex before doing so. 4546 * 4547 * Alternatively, a caller may pass NULL for delegated_inode. This may 4548 * be appropriate for callers that expect the underlying filesystem not 4549 * to be NFS exported. 4550 * 4551 * If the inode has been found through an idmapped mount the idmap of 4552 * the vfsmount must be passed through @idmap. This function will then take 4553 * care to map the inode according to @idmap before checking permissions. 4554 * On non-idmapped mounts or if permission checking is to be performed on the 4555 * raw inode simply passs @nop_mnt_idmap. 4556 */ 4557 int vfs_link(struct dentry *old_dentry, struct mnt_idmap *idmap, 4558 struct inode *dir, struct dentry *new_dentry, 4559 struct inode **delegated_inode) 4560 { 4561 struct inode *inode = old_dentry->d_inode; 4562 unsigned max_links = dir->i_sb->s_max_links; 4563 int error; 4564 4565 if (!inode) 4566 return -ENOENT; 4567 4568 error = may_create(idmap, dir, new_dentry); 4569 if (error) 4570 return error; 4571 4572 if (dir->i_sb != inode->i_sb) 4573 return -EXDEV; 4574 4575 /* 4576 * A link to an append-only or immutable file cannot be created. 4577 */ 4578 if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) 4579 return -EPERM; 4580 /* 4581 * Updating the link count will likely cause i_uid and i_gid to 4582 * be writen back improperly if their true value is unknown to 4583 * the vfs. 4584 */ 4585 if (HAS_UNMAPPED_ID(idmap, inode)) 4586 return -EPERM; 4587 if (!dir->i_op->link) 4588 return -EPERM; 4589 if (S_ISDIR(inode->i_mode)) 4590 return -EPERM; 4591 4592 error = security_inode_link(old_dentry, dir, new_dentry); 4593 if (error) 4594 return error; 4595 4596 inode_lock(inode); 4597 /* Make sure we don't allow creating hardlink to an unlinked file */ 4598 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE)) 4599 error = -ENOENT; 4600 else if (max_links && inode->i_nlink >= max_links) 4601 error = -EMLINK; 4602 else { 4603 error = try_break_deleg(inode, delegated_inode); 4604 if (!error) 4605 error = dir->i_op->link(old_dentry, dir, new_dentry); 4606 } 4607 4608 if (!error && (inode->i_state & I_LINKABLE)) { 4609 spin_lock(&inode->i_lock); 4610 inode->i_state &= ~I_LINKABLE; 4611 spin_unlock(&inode->i_lock); 4612 } 4613 inode_unlock(inode); 4614 if (!error) 4615 fsnotify_link(dir, inode, new_dentry); 4616 return error; 4617 } 4618 EXPORT_SYMBOL(vfs_link); 4619 4620 /* 4621 * Hardlinks are often used in delicate situations. We avoid 4622 * security-related surprises by not following symlinks on the 4623 * newname. --KAB 4624 * 4625 * We don't follow them on the oldname either to be compatible 4626 * with linux 2.0, and to avoid hard-linking to directories 4627 * and other special files. --ADM 4628 */ 4629 int do_linkat(int olddfd, struct filename *old, int newdfd, 4630 struct filename *new, int flags) 4631 { 4632 struct mnt_idmap *idmap; 4633 struct dentry *new_dentry; 4634 struct path old_path, new_path; 4635 struct inode *delegated_inode = NULL; 4636 int how = 0; 4637 int error; 4638 4639 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) { 4640 error = -EINVAL; 4641 goto out_putnames; 4642 } 4643 /* 4644 * To use null names we require CAP_DAC_READ_SEARCH 4645 * This ensures that not everyone will be able to create 4646 * handlink using the passed filedescriptor. 4647 */ 4648 if (flags & AT_EMPTY_PATH && !capable(CAP_DAC_READ_SEARCH)) { 4649 error = -ENOENT; 4650 goto out_putnames; 4651 } 4652 4653 if (flags & AT_SYMLINK_FOLLOW) 4654 how |= LOOKUP_FOLLOW; 4655 retry: 4656 error = filename_lookup(olddfd, old, how, &old_path, NULL); 4657 if (error) 4658 goto out_putnames; 4659 4660 new_dentry = filename_create(newdfd, new, &new_path, 4661 (how & LOOKUP_REVAL)); 4662 error = PTR_ERR(new_dentry); 4663 if (IS_ERR(new_dentry)) 4664 goto out_putpath; 4665 4666 error = -EXDEV; 4667 if (old_path.mnt != new_path.mnt) 4668 goto out_dput; 4669 idmap = mnt_idmap(new_path.mnt); 4670 error = may_linkat(idmap, &old_path); 4671 if (unlikely(error)) 4672 goto out_dput; 4673 error = security_path_link(old_path.dentry, &new_path, new_dentry); 4674 if (error) 4675 goto out_dput; 4676 error = vfs_link(old_path.dentry, idmap, new_path.dentry->d_inode, 4677 new_dentry, &delegated_inode); 4678 out_dput: 4679 done_path_create(&new_path, new_dentry); 4680 if (delegated_inode) { 4681 error = break_deleg_wait(&delegated_inode); 4682 if (!error) { 4683 path_put(&old_path); 4684 goto retry; 4685 } 4686 } 4687 if (retry_estale(error, how)) { 4688 path_put(&old_path); 4689 how |= LOOKUP_REVAL; 4690 goto retry; 4691 } 4692 out_putpath: 4693 path_put(&old_path); 4694 out_putnames: 4695 putname(old); 4696 putname(new); 4697 4698 return error; 4699 } 4700 4701 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, 4702 int, newdfd, const char __user *, newname, int, flags) 4703 { 4704 return do_linkat(olddfd, getname_uflags(oldname, flags), 4705 newdfd, getname(newname), flags); 4706 } 4707 4708 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) 4709 { 4710 return do_linkat(AT_FDCWD, getname(oldname), AT_FDCWD, getname(newname), 0); 4711 } 4712 4713 /** 4714 * vfs_rename - rename a filesystem object 4715 * @rd: pointer to &struct renamedata info 4716 * 4717 * The caller must hold multiple mutexes--see lock_rename()). 4718 * 4719 * If vfs_rename discovers a delegation in need of breaking at either 4720 * the source or destination, it will return -EWOULDBLOCK and return a 4721 * reference to the inode in delegated_inode. The caller should then 4722 * break the delegation and retry. Because breaking a delegation may 4723 * take a long time, the caller should drop all locks before doing 4724 * so. 4725 * 4726 * Alternatively, a caller may pass NULL for delegated_inode. This may 4727 * be appropriate for callers that expect the underlying filesystem not 4728 * to be NFS exported. 4729 * 4730 * The worst of all namespace operations - renaming directory. "Perverted" 4731 * doesn't even start to describe it. Somebody in UCB had a heck of a trip... 4732 * Problems: 4733 * 4734 * a) we can get into loop creation. 4735 * b) race potential - two innocent renames can create a loop together. 4736 * That's where 4.4 screws up. Current fix: serialization on 4737 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another 4738 * story. 4739 * c) we have to lock _four_ objects - parents and victim (if it exists), 4740 * and source. 4741 * And that - after we got ->i_mutex on parents (until then we don't know 4742 * whether the target exists). Solution: try to be smart with locking 4743 * order for inodes. We rely on the fact that tree topology may change 4744 * only under ->s_vfs_rename_mutex _and_ that parent of the object we 4745 * move will be locked. Thus we can rank directories by the tree 4746 * (ancestors first) and rank all non-directories after them. 4747 * That works since everybody except rename does "lock parent, lookup, 4748 * lock child" and rename is under ->s_vfs_rename_mutex. 4749 * HOWEVER, it relies on the assumption that any object with ->lookup() 4750 * has no more than 1 dentry. If "hybrid" objects will ever appear, 4751 * we'd better make sure that there's no link(2) for them. 4752 * d) conversion from fhandle to dentry may come in the wrong moment - when 4753 * we are removing the target. Solution: we will have to grab ->i_mutex 4754 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on 4755 * ->i_mutex on parents, which works but leads to some truly excessive 4756 * locking]. 4757 */ 4758 int vfs_rename(struct renamedata *rd) 4759 { 4760 int error; 4761 struct inode *old_dir = rd->old_dir, *new_dir = rd->new_dir; 4762 struct dentry *old_dentry = rd->old_dentry; 4763 struct dentry *new_dentry = rd->new_dentry; 4764 struct inode **delegated_inode = rd->delegated_inode; 4765 unsigned int flags = rd->flags; 4766 bool is_dir = d_is_dir(old_dentry); 4767 struct inode *source = old_dentry->d_inode; 4768 struct inode *target = new_dentry->d_inode; 4769 bool new_is_dir = false; 4770 unsigned max_links = new_dir->i_sb->s_max_links; 4771 struct name_snapshot old_name; 4772 4773 if (source == target) 4774 return 0; 4775 4776 error = may_delete(rd->old_mnt_idmap, old_dir, old_dentry, is_dir); 4777 if (error) 4778 return error; 4779 4780 if (!target) { 4781 error = may_create(rd->new_mnt_idmap, new_dir, new_dentry); 4782 } else { 4783 new_is_dir = d_is_dir(new_dentry); 4784 4785 if (!(flags & RENAME_EXCHANGE)) 4786 error = may_delete(rd->new_mnt_idmap, new_dir, 4787 new_dentry, is_dir); 4788 else 4789 error = may_delete(rd->new_mnt_idmap, new_dir, 4790 new_dentry, new_is_dir); 4791 } 4792 if (error) 4793 return error; 4794 4795 if (!old_dir->i_op->rename) 4796 return -EPERM; 4797 4798 /* 4799 * If we are going to change the parent - check write permissions, 4800 * we'll need to flip '..'. 4801 */ 4802 if (new_dir != old_dir) { 4803 if (is_dir) { 4804 error = inode_permission(rd->old_mnt_idmap, source, 4805 MAY_WRITE); 4806 if (error) 4807 return error; 4808 } 4809 if ((flags & RENAME_EXCHANGE) && new_is_dir) { 4810 error = inode_permission(rd->new_mnt_idmap, target, 4811 MAY_WRITE); 4812 if (error) 4813 return error; 4814 } 4815 } 4816 4817 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry, 4818 flags); 4819 if (error) 4820 return error; 4821 4822 take_dentry_name_snapshot(&old_name, old_dentry); 4823 dget(new_dentry); 4824 /* 4825 * Lock all moved children. Moved directories may need to change parent 4826 * pointer so they need the lock to prevent against concurrent 4827 * directory changes moving parent pointer. For regular files we've 4828 * historically always done this. The lockdep locking subclasses are 4829 * somewhat arbitrary but RENAME_EXCHANGE in particular can swap 4830 * regular files and directories so it's difficult to tell which 4831 * subclasses to use. 4832 */ 4833 lock_two_inodes(source, target, I_MUTEX_NORMAL, I_MUTEX_NONDIR2); 4834 4835 error = -EPERM; 4836 if (IS_SWAPFILE(source) || (target && IS_SWAPFILE(target))) 4837 goto out; 4838 4839 error = -EBUSY; 4840 if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry)) 4841 goto out; 4842 4843 if (max_links && new_dir != old_dir) { 4844 error = -EMLINK; 4845 if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links) 4846 goto out; 4847 if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir && 4848 old_dir->i_nlink >= max_links) 4849 goto out; 4850 } 4851 if (!is_dir) { 4852 error = try_break_deleg(source, delegated_inode); 4853 if (error) 4854 goto out; 4855 } 4856 if (target && !new_is_dir) { 4857 error = try_break_deleg(target, delegated_inode); 4858 if (error) 4859 goto out; 4860 } 4861 error = old_dir->i_op->rename(rd->new_mnt_idmap, old_dir, old_dentry, 4862 new_dir, new_dentry, flags); 4863 if (error) 4864 goto out; 4865 4866 if (!(flags & RENAME_EXCHANGE) && target) { 4867 if (is_dir) { 4868 shrink_dcache_parent(new_dentry); 4869 target->i_flags |= S_DEAD; 4870 } 4871 dont_mount(new_dentry); 4872 detach_mounts(new_dentry); 4873 } 4874 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) { 4875 if (!(flags & RENAME_EXCHANGE)) 4876 d_move(old_dentry, new_dentry); 4877 else 4878 d_exchange(old_dentry, new_dentry); 4879 } 4880 out: 4881 inode_unlock(source); 4882 if (target) 4883 inode_unlock(target); 4884 dput(new_dentry); 4885 if (!error) { 4886 fsnotify_move(old_dir, new_dir, &old_name.name, is_dir, 4887 !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry); 4888 if (flags & RENAME_EXCHANGE) { 4889 fsnotify_move(new_dir, old_dir, &old_dentry->d_name, 4890 new_is_dir, NULL, new_dentry); 4891 } 4892 } 4893 release_dentry_name_snapshot(&old_name); 4894 4895 return error; 4896 } 4897 EXPORT_SYMBOL(vfs_rename); 4898 4899 int do_renameat2(int olddfd, struct filename *from, int newdfd, 4900 struct filename *to, unsigned int flags) 4901 { 4902 struct renamedata rd; 4903 struct dentry *old_dentry, *new_dentry; 4904 struct dentry *trap; 4905 struct path old_path, new_path; 4906 struct qstr old_last, new_last; 4907 int old_type, new_type; 4908 struct inode *delegated_inode = NULL; 4909 unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET; 4910 bool should_retry = false; 4911 int error = -EINVAL; 4912 4913 if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT)) 4914 goto put_names; 4915 4916 if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) && 4917 (flags & RENAME_EXCHANGE)) 4918 goto put_names; 4919 4920 if (flags & RENAME_EXCHANGE) 4921 target_flags = 0; 4922 4923 retry: 4924 error = filename_parentat(olddfd, from, lookup_flags, &old_path, 4925 &old_last, &old_type); 4926 if (error) 4927 goto put_names; 4928 4929 error = filename_parentat(newdfd, to, lookup_flags, &new_path, &new_last, 4930 &new_type); 4931 if (error) 4932 goto exit1; 4933 4934 error = -EXDEV; 4935 if (old_path.mnt != new_path.mnt) 4936 goto exit2; 4937 4938 error = -EBUSY; 4939 if (old_type != LAST_NORM) 4940 goto exit2; 4941 4942 if (flags & RENAME_NOREPLACE) 4943 error = -EEXIST; 4944 if (new_type != LAST_NORM) 4945 goto exit2; 4946 4947 error = mnt_want_write(old_path.mnt); 4948 if (error) 4949 goto exit2; 4950 4951 retry_deleg: 4952 trap = lock_rename(new_path.dentry, old_path.dentry); 4953 4954 old_dentry = lookup_one_qstr_excl(&old_last, old_path.dentry, 4955 lookup_flags); 4956 error = PTR_ERR(old_dentry); 4957 if (IS_ERR(old_dentry)) 4958 goto exit3; 4959 /* source must exist */ 4960 error = -ENOENT; 4961 if (d_is_negative(old_dentry)) 4962 goto exit4; 4963 new_dentry = lookup_one_qstr_excl(&new_last, new_path.dentry, 4964 lookup_flags | target_flags); 4965 error = PTR_ERR(new_dentry); 4966 if (IS_ERR(new_dentry)) 4967 goto exit4; 4968 error = -EEXIST; 4969 if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry)) 4970 goto exit5; 4971 if (flags & RENAME_EXCHANGE) { 4972 error = -ENOENT; 4973 if (d_is_negative(new_dentry)) 4974 goto exit5; 4975 4976 if (!d_is_dir(new_dentry)) { 4977 error = -ENOTDIR; 4978 if (new_last.name[new_last.len]) 4979 goto exit5; 4980 } 4981 } 4982 /* unless the source is a directory trailing slashes give -ENOTDIR */ 4983 if (!d_is_dir(old_dentry)) { 4984 error = -ENOTDIR; 4985 if (old_last.name[old_last.len]) 4986 goto exit5; 4987 if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len]) 4988 goto exit5; 4989 } 4990 /* source should not be ancestor of target */ 4991 error = -EINVAL; 4992 if (old_dentry == trap) 4993 goto exit5; 4994 /* target should not be an ancestor of source */ 4995 if (!(flags & RENAME_EXCHANGE)) 4996 error = -ENOTEMPTY; 4997 if (new_dentry == trap) 4998 goto exit5; 4999 5000 error = security_path_rename(&old_path, old_dentry, 5001 &new_path, new_dentry, flags); 5002 if (error) 5003 goto exit5; 5004 5005 rd.old_dir = old_path.dentry->d_inode; 5006 rd.old_dentry = old_dentry; 5007 rd.old_mnt_idmap = mnt_idmap(old_path.mnt); 5008 rd.new_dir = new_path.dentry->d_inode; 5009 rd.new_dentry = new_dentry; 5010 rd.new_mnt_idmap = mnt_idmap(new_path.mnt); 5011 rd.delegated_inode = &delegated_inode; 5012 rd.flags = flags; 5013 error = vfs_rename(&rd); 5014 exit5: 5015 dput(new_dentry); 5016 exit4: 5017 dput(old_dentry); 5018 exit3: 5019 unlock_rename(new_path.dentry, old_path.dentry); 5020 if (delegated_inode) { 5021 error = break_deleg_wait(&delegated_inode); 5022 if (!error) 5023 goto retry_deleg; 5024 } 5025 mnt_drop_write(old_path.mnt); 5026 exit2: 5027 if (retry_estale(error, lookup_flags)) 5028 should_retry = true; 5029 path_put(&new_path); 5030 exit1: 5031 path_put(&old_path); 5032 if (should_retry) { 5033 should_retry = false; 5034 lookup_flags |= LOOKUP_REVAL; 5035 goto retry; 5036 } 5037 put_names: 5038 putname(from); 5039 putname(to); 5040 return error; 5041 } 5042 5043 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname, 5044 int, newdfd, const char __user *, newname, unsigned int, flags) 5045 { 5046 return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname), 5047 flags); 5048 } 5049 5050 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, 5051 int, newdfd, const char __user *, newname) 5052 { 5053 return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname), 5054 0); 5055 } 5056 5057 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) 5058 { 5059 return do_renameat2(AT_FDCWD, getname(oldname), AT_FDCWD, 5060 getname(newname), 0); 5061 } 5062 5063 int readlink_copy(char __user *buffer, int buflen, const char *link) 5064 { 5065 int len = PTR_ERR(link); 5066 if (IS_ERR(link)) 5067 goto out; 5068 5069 len = strlen(link); 5070 if (len > (unsigned) buflen) 5071 len = buflen; 5072 if (copy_to_user(buffer, link, len)) 5073 len = -EFAULT; 5074 out: 5075 return len; 5076 } 5077 5078 /** 5079 * vfs_readlink - copy symlink body into userspace buffer 5080 * @dentry: dentry on which to get symbolic link 5081 * @buffer: user memory pointer 5082 * @buflen: size of buffer 5083 * 5084 * Does not touch atime. That's up to the caller if necessary 5085 * 5086 * Does not call security hook. 5087 */ 5088 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen) 5089 { 5090 struct inode *inode = d_inode(dentry); 5091 DEFINE_DELAYED_CALL(done); 5092 const char *link; 5093 int res; 5094 5095 if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) { 5096 if (unlikely(inode->i_op->readlink)) 5097 return inode->i_op->readlink(dentry, buffer, buflen); 5098 5099 if (!d_is_symlink(dentry)) 5100 return -EINVAL; 5101 5102 spin_lock(&inode->i_lock); 5103 inode->i_opflags |= IOP_DEFAULT_READLINK; 5104 spin_unlock(&inode->i_lock); 5105 } 5106 5107 link = READ_ONCE(inode->i_link); 5108 if (!link) { 5109 link = inode->i_op->get_link(dentry, inode, &done); 5110 if (IS_ERR(link)) 5111 return PTR_ERR(link); 5112 } 5113 res = readlink_copy(buffer, buflen, link); 5114 do_delayed_call(&done); 5115 return res; 5116 } 5117 EXPORT_SYMBOL(vfs_readlink); 5118 5119 /** 5120 * vfs_get_link - get symlink body 5121 * @dentry: dentry on which to get symbolic link 5122 * @done: caller needs to free returned data with this 5123 * 5124 * Calls security hook and i_op->get_link() on the supplied inode. 5125 * 5126 * It does not touch atime. That's up to the caller if necessary. 5127 * 5128 * Does not work on "special" symlinks like /proc/$$/fd/N 5129 */ 5130 const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done) 5131 { 5132 const char *res = ERR_PTR(-EINVAL); 5133 struct inode *inode = d_inode(dentry); 5134 5135 if (d_is_symlink(dentry)) { 5136 res = ERR_PTR(security_inode_readlink(dentry)); 5137 if (!res) 5138 res = inode->i_op->get_link(dentry, inode, done); 5139 } 5140 return res; 5141 } 5142 EXPORT_SYMBOL(vfs_get_link); 5143 5144 /* get the link contents into pagecache */ 5145 const char *page_get_link(struct dentry *dentry, struct inode *inode, 5146 struct delayed_call *callback) 5147 { 5148 char *kaddr; 5149 struct page *page; 5150 struct address_space *mapping = inode->i_mapping; 5151 5152 if (!dentry) { 5153 page = find_get_page(mapping, 0); 5154 if (!page) 5155 return ERR_PTR(-ECHILD); 5156 if (!PageUptodate(page)) { 5157 put_page(page); 5158 return ERR_PTR(-ECHILD); 5159 } 5160 } else { 5161 page = read_mapping_page(mapping, 0, NULL); 5162 if (IS_ERR(page)) 5163 return (char*)page; 5164 } 5165 set_delayed_call(callback, page_put_link, page); 5166 BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM); 5167 kaddr = page_address(page); 5168 nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1); 5169 return kaddr; 5170 } 5171 5172 EXPORT_SYMBOL(page_get_link); 5173 5174 void page_put_link(void *arg) 5175 { 5176 put_page(arg); 5177 } 5178 EXPORT_SYMBOL(page_put_link); 5179 5180 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen) 5181 { 5182 DEFINE_DELAYED_CALL(done); 5183 int res = readlink_copy(buffer, buflen, 5184 page_get_link(dentry, d_inode(dentry), 5185 &done)); 5186 do_delayed_call(&done); 5187 return res; 5188 } 5189 EXPORT_SYMBOL(page_readlink); 5190 5191 int page_symlink(struct inode *inode, const char *symname, int len) 5192 { 5193 struct address_space *mapping = inode->i_mapping; 5194 const struct address_space_operations *aops = mapping->a_ops; 5195 bool nofs = !mapping_gfp_constraint(mapping, __GFP_FS); 5196 struct page *page; 5197 void *fsdata = NULL; 5198 int err; 5199 unsigned int flags; 5200 5201 retry: 5202 if (nofs) 5203 flags = memalloc_nofs_save(); 5204 err = aops->write_begin(NULL, mapping, 0, len-1, &page, &fsdata); 5205 if (nofs) 5206 memalloc_nofs_restore(flags); 5207 if (err) 5208 goto fail; 5209 5210 memcpy(page_address(page), symname, len-1); 5211 5212 err = aops->write_end(NULL, mapping, 0, len-1, len-1, 5213 page, fsdata); 5214 if (err < 0) 5215 goto fail; 5216 if (err < len-1) 5217 goto retry; 5218 5219 mark_inode_dirty(inode); 5220 return 0; 5221 fail: 5222 return err; 5223 } 5224 EXPORT_SYMBOL(page_symlink); 5225 5226 const struct inode_operations page_symlink_inode_operations = { 5227 .get_link = page_get_link, 5228 }; 5229 EXPORT_SYMBOL(page_symlink_inode_operations);