xref: /linux/fs/namespace.c (revision adc4fb9c814b5d5cc6021022900fd5eb0b3c8165)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  linux/fs/namespace.c
4  *
5  * (C) Copyright Al Viro 2000, 2001
6  *
7  * Based on code from fs/super.c, copyright Linus Torvalds and others.
8  * Heavily rewritten.
9  */
10 
11 #include <linux/syscalls.h>
12 #include <linux/export.h>
13 #include <linux/capability.h>
14 #include <linux/mnt_namespace.h>
15 #include <linux/user_namespace.h>
16 #include <linux/namei.h>
17 #include <linux/security.h>
18 #include <linux/cred.h>
19 #include <linux/idr.h>
20 #include <linux/init.h>		/* init_rootfs */
21 #include <linux/fs_struct.h>	/* get_fs_root et.al. */
22 #include <linux/fsnotify.h>	/* fsnotify_vfsmount_delete */
23 #include <linux/file.h>
24 #include <linux/uaccess.h>
25 #include <linux/proc_ns.h>
26 #include <linux/magic.h>
27 #include <linux/memblock.h>
28 #include <linux/proc_fs.h>
29 #include <linux/task_work.h>
30 #include <linux/sched/task.h>
31 #include <uapi/linux/mount.h>
32 #include <linux/fs_context.h>
33 #include <linux/shmem_fs.h>
34 #include <linux/mnt_idmapping.h>
35 #include <linux/pidfs.h>
36 
37 #include "pnode.h"
38 #include "internal.h"
39 
40 /* Maximum number of mounts in a mount namespace */
41 static unsigned int sysctl_mount_max __read_mostly = 100000;
42 
43 static unsigned int m_hash_mask __ro_after_init;
44 static unsigned int m_hash_shift __ro_after_init;
45 static unsigned int mp_hash_mask __ro_after_init;
46 static unsigned int mp_hash_shift __ro_after_init;
47 
48 static __initdata unsigned long mhash_entries;
set_mhash_entries(char * str)49 static int __init set_mhash_entries(char *str)
50 {
51 	if (!str)
52 		return 0;
53 	mhash_entries = simple_strtoul(str, &str, 0);
54 	return 1;
55 }
56 __setup("mhash_entries=", set_mhash_entries);
57 
58 static __initdata unsigned long mphash_entries;
set_mphash_entries(char * str)59 static int __init set_mphash_entries(char *str)
60 {
61 	if (!str)
62 		return 0;
63 	mphash_entries = simple_strtoul(str, &str, 0);
64 	return 1;
65 }
66 __setup("mphash_entries=", set_mphash_entries);
67 
68 static u64 event;
69 static DEFINE_XARRAY_FLAGS(mnt_id_xa, XA_FLAGS_ALLOC);
70 static DEFINE_IDA(mnt_group_ida);
71 
72 /* Don't allow confusion with old 32bit mount ID */
73 #define MNT_UNIQUE_ID_OFFSET (1ULL << 31)
74 static u64 mnt_id_ctr = MNT_UNIQUE_ID_OFFSET;
75 
76 static struct hlist_head *mount_hashtable __ro_after_init;
77 static struct hlist_head *mountpoint_hashtable __ro_after_init;
78 static struct kmem_cache *mnt_cache __ro_after_init;
79 static DECLARE_RWSEM(namespace_sem);
80 static HLIST_HEAD(unmounted);	/* protected by namespace_sem */
81 static LIST_HEAD(ex_mountpoints); /* protected by namespace_sem */
82 static DEFINE_SEQLOCK(mnt_ns_tree_lock);
83 
84 #ifdef CONFIG_FSNOTIFY
85 LIST_HEAD(notify_list); /* protected by namespace_sem */
86 #endif
87 static struct rb_root mnt_ns_tree = RB_ROOT; /* protected by mnt_ns_tree_lock */
88 static LIST_HEAD(mnt_ns_list); /* protected by mnt_ns_tree_lock */
89 
90 enum mount_kattr_flags_t {
91 	MOUNT_KATTR_RECURSE		= (1 << 0),
92 	MOUNT_KATTR_IDMAP_REPLACE	= (1 << 1),
93 };
94 
95 struct mount_kattr {
96 	unsigned int attr_set;
97 	unsigned int attr_clr;
98 	unsigned int propagation;
99 	unsigned int lookup_flags;
100 	enum mount_kattr_flags_t kflags;
101 	struct user_namespace *mnt_userns;
102 	struct mnt_idmap *mnt_idmap;
103 };
104 
105 /* /sys/fs */
106 struct kobject *fs_kobj __ro_after_init;
107 EXPORT_SYMBOL_GPL(fs_kobj);
108 
109 /*
110  * vfsmount lock may be taken for read to prevent changes to the
111  * vfsmount hash, ie. during mountpoint lookups or walking back
112  * up the tree.
113  *
114  * It should be taken for write in all cases where the vfsmount
115  * tree or hash is modified or when a vfsmount structure is modified.
116  */
117 __cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock);
118 
node_to_mnt_ns(const struct rb_node * node)119 static inline struct mnt_namespace *node_to_mnt_ns(const struct rb_node *node)
120 {
121 	if (!node)
122 		return NULL;
123 	return rb_entry(node, struct mnt_namespace, mnt_ns_tree_node);
124 }
125 
mnt_ns_cmp(struct rb_node * a,const struct rb_node * b)126 static int mnt_ns_cmp(struct rb_node *a, const struct rb_node *b)
127 {
128 	struct mnt_namespace *ns_a = node_to_mnt_ns(a);
129 	struct mnt_namespace *ns_b = node_to_mnt_ns(b);
130 	u64 seq_a = ns_a->seq;
131 	u64 seq_b = ns_b->seq;
132 
133 	if (seq_a < seq_b)
134 		return -1;
135 	if (seq_a > seq_b)
136 		return 1;
137 	return 0;
138 }
139 
mnt_ns_tree_write_lock(void)140 static inline void mnt_ns_tree_write_lock(void)
141 {
142 	write_seqlock(&mnt_ns_tree_lock);
143 }
144 
mnt_ns_tree_write_unlock(void)145 static inline void mnt_ns_tree_write_unlock(void)
146 {
147 	write_sequnlock(&mnt_ns_tree_lock);
148 }
149 
mnt_ns_tree_add(struct mnt_namespace * ns)150 static void mnt_ns_tree_add(struct mnt_namespace *ns)
151 {
152 	struct rb_node *node, *prev;
153 
154 	mnt_ns_tree_write_lock();
155 	node = rb_find_add_rcu(&ns->mnt_ns_tree_node, &mnt_ns_tree, mnt_ns_cmp);
156 	/*
157 	 * If there's no previous entry simply add it after the
158 	 * head and if there is add it after the previous entry.
159 	 */
160 	prev = rb_prev(&ns->mnt_ns_tree_node);
161 	if (!prev)
162 		list_add_rcu(&ns->mnt_ns_list, &mnt_ns_list);
163 	else
164 		list_add_rcu(&ns->mnt_ns_list, &node_to_mnt_ns(prev)->mnt_ns_list);
165 	mnt_ns_tree_write_unlock();
166 
167 	WARN_ON_ONCE(node);
168 }
169 
mnt_ns_release(struct mnt_namespace * ns)170 static void mnt_ns_release(struct mnt_namespace *ns)
171 {
172 	/* keep alive for {list,stat}mount() */
173 	if (refcount_dec_and_test(&ns->passive)) {
174 		fsnotify_mntns_delete(ns);
175 		put_user_ns(ns->user_ns);
176 		kfree(ns);
177 	}
178 }
DEFINE_FREE(mnt_ns_release,struct mnt_namespace *,if (_T)mnt_ns_release (_T))179 DEFINE_FREE(mnt_ns_release, struct mnt_namespace *, if (_T) mnt_ns_release(_T))
180 
181 static void mnt_ns_release_rcu(struct rcu_head *rcu)
182 {
183 	mnt_ns_release(container_of(rcu, struct mnt_namespace, mnt_ns_rcu));
184 }
185 
mnt_ns_tree_remove(struct mnt_namespace * ns)186 static void mnt_ns_tree_remove(struct mnt_namespace *ns)
187 {
188 	/* remove from global mount namespace list */
189 	if (!is_anon_ns(ns)) {
190 		mnt_ns_tree_write_lock();
191 		rb_erase(&ns->mnt_ns_tree_node, &mnt_ns_tree);
192 		list_bidir_del_rcu(&ns->mnt_ns_list);
193 		mnt_ns_tree_write_unlock();
194 	}
195 
196 	call_rcu(&ns->mnt_ns_rcu, mnt_ns_release_rcu);
197 }
198 
mnt_ns_find(const void * key,const struct rb_node * node)199 static int mnt_ns_find(const void *key, const struct rb_node *node)
200 {
201 	const u64 mnt_ns_id = *(u64 *)key;
202 	const struct mnt_namespace *ns = node_to_mnt_ns(node);
203 
204 	if (mnt_ns_id < ns->seq)
205 		return -1;
206 	if (mnt_ns_id > ns->seq)
207 		return 1;
208 	return 0;
209 }
210 
211 /*
212  * Lookup a mount namespace by id and take a passive reference count. Taking a
213  * passive reference means the mount namespace can be emptied if e.g., the last
214  * task holding an active reference exits. To access the mounts of the
215  * namespace the @namespace_sem must first be acquired. If the namespace has
216  * already shut down before acquiring @namespace_sem, {list,stat}mount() will
217  * see that the mount rbtree of the namespace is empty.
218  *
219  * Note the lookup is lockless protected by a sequence counter. We only
220  * need to guard against false negatives as false positives aren't
221  * possible. So if we didn't find a mount namespace and the sequence
222  * counter has changed we need to retry. If the sequence counter is
223  * still the same we know the search actually failed.
224  */
lookup_mnt_ns(u64 mnt_ns_id)225 static struct mnt_namespace *lookup_mnt_ns(u64 mnt_ns_id)
226 {
227 	struct mnt_namespace *ns;
228 	struct rb_node *node;
229 	unsigned int seq;
230 
231 	guard(rcu)();
232 	do {
233 		seq = read_seqbegin(&mnt_ns_tree_lock);
234 		node = rb_find_rcu(&mnt_ns_id, &mnt_ns_tree, mnt_ns_find);
235 		if (node)
236 			break;
237 	} while (read_seqretry(&mnt_ns_tree_lock, seq));
238 
239 	if (!node)
240 		return NULL;
241 
242 	/*
243 	 * The last reference count is put with RCU delay so we can
244 	 * unconditonally acquire a reference here.
245 	 */
246 	ns = node_to_mnt_ns(node);
247 	refcount_inc(&ns->passive);
248 	return ns;
249 }
250 
lock_mount_hash(void)251 static inline void lock_mount_hash(void)
252 {
253 	write_seqlock(&mount_lock);
254 }
255 
unlock_mount_hash(void)256 static inline void unlock_mount_hash(void)
257 {
258 	write_sequnlock(&mount_lock);
259 }
260 
m_hash(struct vfsmount * mnt,struct dentry * dentry)261 static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry)
262 {
263 	unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES);
264 	tmp += ((unsigned long)dentry / L1_CACHE_BYTES);
265 	tmp = tmp + (tmp >> m_hash_shift);
266 	return &mount_hashtable[tmp & m_hash_mask];
267 }
268 
mp_hash(struct dentry * dentry)269 static inline struct hlist_head *mp_hash(struct dentry *dentry)
270 {
271 	unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES);
272 	tmp = tmp + (tmp >> mp_hash_shift);
273 	return &mountpoint_hashtable[tmp & mp_hash_mask];
274 }
275 
mnt_alloc_id(struct mount * mnt)276 static int mnt_alloc_id(struct mount *mnt)
277 {
278 	int res;
279 
280 	xa_lock(&mnt_id_xa);
281 	res = __xa_alloc(&mnt_id_xa, &mnt->mnt_id, mnt, XA_LIMIT(1, INT_MAX), GFP_KERNEL);
282 	if (!res)
283 		mnt->mnt_id_unique = ++mnt_id_ctr;
284 	xa_unlock(&mnt_id_xa);
285 	return res;
286 }
287 
mnt_free_id(struct mount * mnt)288 static void mnt_free_id(struct mount *mnt)
289 {
290 	xa_erase(&mnt_id_xa, mnt->mnt_id);
291 }
292 
293 /*
294  * Allocate a new peer group ID
295  */
mnt_alloc_group_id(struct mount * mnt)296 static int mnt_alloc_group_id(struct mount *mnt)
297 {
298 	int res = ida_alloc_min(&mnt_group_ida, 1, GFP_KERNEL);
299 
300 	if (res < 0)
301 		return res;
302 	mnt->mnt_group_id = res;
303 	return 0;
304 }
305 
306 /*
307  * Release a peer group ID
308  */
mnt_release_group_id(struct mount * mnt)309 void mnt_release_group_id(struct mount *mnt)
310 {
311 	ida_free(&mnt_group_ida, mnt->mnt_group_id);
312 	mnt->mnt_group_id = 0;
313 }
314 
315 /*
316  * vfsmount lock must be held for read
317  */
mnt_add_count(struct mount * mnt,int n)318 static inline void mnt_add_count(struct mount *mnt, int n)
319 {
320 #ifdef CONFIG_SMP
321 	this_cpu_add(mnt->mnt_pcp->mnt_count, n);
322 #else
323 	preempt_disable();
324 	mnt->mnt_count += n;
325 	preempt_enable();
326 #endif
327 }
328 
329 /*
330  * vfsmount lock must be held for write
331  */
mnt_get_count(struct mount * mnt)332 int mnt_get_count(struct mount *mnt)
333 {
334 #ifdef CONFIG_SMP
335 	int count = 0;
336 	int cpu;
337 
338 	for_each_possible_cpu(cpu) {
339 		count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_count;
340 	}
341 
342 	return count;
343 #else
344 	return mnt->mnt_count;
345 #endif
346 }
347 
alloc_vfsmnt(const char * name)348 static struct mount *alloc_vfsmnt(const char *name)
349 {
350 	struct mount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL);
351 	if (mnt) {
352 		int err;
353 
354 		err = mnt_alloc_id(mnt);
355 		if (err)
356 			goto out_free_cache;
357 
358 		if (name) {
359 			mnt->mnt_devname = kstrdup_const(name,
360 							 GFP_KERNEL_ACCOUNT);
361 			if (!mnt->mnt_devname)
362 				goto out_free_id;
363 		}
364 
365 #ifdef CONFIG_SMP
366 		mnt->mnt_pcp = alloc_percpu(struct mnt_pcp);
367 		if (!mnt->mnt_pcp)
368 			goto out_free_devname;
369 
370 		this_cpu_add(mnt->mnt_pcp->mnt_count, 1);
371 #else
372 		mnt->mnt_count = 1;
373 		mnt->mnt_writers = 0;
374 #endif
375 
376 		INIT_HLIST_NODE(&mnt->mnt_hash);
377 		INIT_LIST_HEAD(&mnt->mnt_child);
378 		INIT_LIST_HEAD(&mnt->mnt_mounts);
379 		INIT_LIST_HEAD(&mnt->mnt_list);
380 		INIT_LIST_HEAD(&mnt->mnt_expire);
381 		INIT_LIST_HEAD(&mnt->mnt_share);
382 		INIT_LIST_HEAD(&mnt->mnt_slave_list);
383 		INIT_LIST_HEAD(&mnt->mnt_slave);
384 		INIT_HLIST_NODE(&mnt->mnt_mp_list);
385 		INIT_LIST_HEAD(&mnt->mnt_umounting);
386 		INIT_HLIST_HEAD(&mnt->mnt_stuck_children);
387 		RB_CLEAR_NODE(&mnt->mnt_node);
388 		mnt->mnt.mnt_idmap = &nop_mnt_idmap;
389 	}
390 	return mnt;
391 
392 #ifdef CONFIG_SMP
393 out_free_devname:
394 	kfree_const(mnt->mnt_devname);
395 #endif
396 out_free_id:
397 	mnt_free_id(mnt);
398 out_free_cache:
399 	kmem_cache_free(mnt_cache, mnt);
400 	return NULL;
401 }
402 
403 /*
404  * Most r/o checks on a fs are for operations that take
405  * discrete amounts of time, like a write() or unlink().
406  * We must keep track of when those operations start
407  * (for permission checks) and when they end, so that
408  * we can determine when writes are able to occur to
409  * a filesystem.
410  */
411 /*
412  * __mnt_is_readonly: check whether a mount is read-only
413  * @mnt: the mount to check for its write status
414  *
415  * This shouldn't be used directly ouside of the VFS.
416  * It does not guarantee that the filesystem will stay
417  * r/w, just that it is right *now*.  This can not and
418  * should not be used in place of IS_RDONLY(inode).
419  * mnt_want/drop_write() will _keep_ the filesystem
420  * r/w.
421  */
__mnt_is_readonly(struct vfsmount * mnt)422 bool __mnt_is_readonly(struct vfsmount *mnt)
423 {
424 	return (mnt->mnt_flags & MNT_READONLY) || sb_rdonly(mnt->mnt_sb);
425 }
426 EXPORT_SYMBOL_GPL(__mnt_is_readonly);
427 
mnt_inc_writers(struct mount * mnt)428 static inline void mnt_inc_writers(struct mount *mnt)
429 {
430 #ifdef CONFIG_SMP
431 	this_cpu_inc(mnt->mnt_pcp->mnt_writers);
432 #else
433 	mnt->mnt_writers++;
434 #endif
435 }
436 
mnt_dec_writers(struct mount * mnt)437 static inline void mnt_dec_writers(struct mount *mnt)
438 {
439 #ifdef CONFIG_SMP
440 	this_cpu_dec(mnt->mnt_pcp->mnt_writers);
441 #else
442 	mnt->mnt_writers--;
443 #endif
444 }
445 
mnt_get_writers(struct mount * mnt)446 static unsigned int mnt_get_writers(struct mount *mnt)
447 {
448 #ifdef CONFIG_SMP
449 	unsigned int count = 0;
450 	int cpu;
451 
452 	for_each_possible_cpu(cpu) {
453 		count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers;
454 	}
455 
456 	return count;
457 #else
458 	return mnt->mnt_writers;
459 #endif
460 }
461 
mnt_is_readonly(struct vfsmount * mnt)462 static int mnt_is_readonly(struct vfsmount *mnt)
463 {
464 	if (READ_ONCE(mnt->mnt_sb->s_readonly_remount))
465 		return 1;
466 	/*
467 	 * The barrier pairs with the barrier in sb_start_ro_state_change()
468 	 * making sure if we don't see s_readonly_remount set yet, we also will
469 	 * not see any superblock / mount flag changes done by remount.
470 	 * It also pairs with the barrier in sb_end_ro_state_change()
471 	 * assuring that if we see s_readonly_remount already cleared, we will
472 	 * see the values of superblock / mount flags updated by remount.
473 	 */
474 	smp_rmb();
475 	return __mnt_is_readonly(mnt);
476 }
477 
478 /*
479  * Most r/o & frozen checks on a fs are for operations that take discrete
480  * amounts of time, like a write() or unlink().  We must keep track of when
481  * those operations start (for permission checks) and when they end, so that we
482  * can determine when writes are able to occur to a filesystem.
483  */
484 /**
485  * mnt_get_write_access - get write access to a mount without freeze protection
486  * @m: the mount on which to take a write
487  *
488  * This tells the low-level filesystem that a write is about to be performed to
489  * it, and makes sure that writes are allowed (mnt it read-write) before
490  * returning success. This operation does not protect against filesystem being
491  * frozen. When the write operation is finished, mnt_put_write_access() must be
492  * called. This is effectively a refcount.
493  */
mnt_get_write_access(struct vfsmount * m)494 int mnt_get_write_access(struct vfsmount *m)
495 {
496 	struct mount *mnt = real_mount(m);
497 	int ret = 0;
498 
499 	preempt_disable();
500 	mnt_inc_writers(mnt);
501 	/*
502 	 * The store to mnt_inc_writers must be visible before we pass
503 	 * MNT_WRITE_HOLD loop below, so that the slowpath can see our
504 	 * incremented count after it has set MNT_WRITE_HOLD.
505 	 */
506 	smp_mb();
507 	might_lock(&mount_lock.lock);
508 	while (READ_ONCE(mnt->mnt.mnt_flags) & MNT_WRITE_HOLD) {
509 		if (!IS_ENABLED(CONFIG_PREEMPT_RT)) {
510 			cpu_relax();
511 		} else {
512 			/*
513 			 * This prevents priority inversion, if the task
514 			 * setting MNT_WRITE_HOLD got preempted on a remote
515 			 * CPU, and it prevents life lock if the task setting
516 			 * MNT_WRITE_HOLD has a lower priority and is bound to
517 			 * the same CPU as the task that is spinning here.
518 			 */
519 			preempt_enable();
520 			lock_mount_hash();
521 			unlock_mount_hash();
522 			preempt_disable();
523 		}
524 	}
525 	/*
526 	 * The barrier pairs with the barrier sb_start_ro_state_change() making
527 	 * sure that if we see MNT_WRITE_HOLD cleared, we will also see
528 	 * s_readonly_remount set (or even SB_RDONLY / MNT_READONLY flags) in
529 	 * mnt_is_readonly() and bail in case we are racing with remount
530 	 * read-only.
531 	 */
532 	smp_rmb();
533 	if (mnt_is_readonly(m)) {
534 		mnt_dec_writers(mnt);
535 		ret = -EROFS;
536 	}
537 	preempt_enable();
538 
539 	return ret;
540 }
541 EXPORT_SYMBOL_GPL(mnt_get_write_access);
542 
543 /**
544  * mnt_want_write - get write access to a mount
545  * @m: the mount on which to take a write
546  *
547  * This tells the low-level filesystem that a write is about to be performed to
548  * it, and makes sure that writes are allowed (mount is read-write, filesystem
549  * is not frozen) before returning success.  When the write operation is
550  * finished, mnt_drop_write() must be called.  This is effectively a refcount.
551  */
mnt_want_write(struct vfsmount * m)552 int mnt_want_write(struct vfsmount *m)
553 {
554 	int ret;
555 
556 	sb_start_write(m->mnt_sb);
557 	ret = mnt_get_write_access(m);
558 	if (ret)
559 		sb_end_write(m->mnt_sb);
560 	return ret;
561 }
562 EXPORT_SYMBOL_GPL(mnt_want_write);
563 
564 /**
565  * mnt_get_write_access_file - get write access to a file's mount
566  * @file: the file who's mount on which to take a write
567  *
568  * This is like mnt_get_write_access, but if @file is already open for write it
569  * skips incrementing mnt_writers (since the open file already has a reference)
570  * and instead only does the check for emergency r/o remounts.  This must be
571  * paired with mnt_put_write_access_file.
572  */
mnt_get_write_access_file(struct file * file)573 int mnt_get_write_access_file(struct file *file)
574 {
575 	if (file->f_mode & FMODE_WRITER) {
576 		/*
577 		 * Superblock may have become readonly while there are still
578 		 * writable fd's, e.g. due to a fs error with errors=remount-ro
579 		 */
580 		if (__mnt_is_readonly(file->f_path.mnt))
581 			return -EROFS;
582 		return 0;
583 	}
584 	return mnt_get_write_access(file->f_path.mnt);
585 }
586 
587 /**
588  * mnt_want_write_file - get write access to a file's mount
589  * @file: the file who's mount on which to take a write
590  *
591  * This is like mnt_want_write, but if the file is already open for writing it
592  * skips incrementing mnt_writers (since the open file already has a reference)
593  * and instead only does the freeze protection and the check for emergency r/o
594  * remounts.  This must be paired with mnt_drop_write_file.
595  */
mnt_want_write_file(struct file * file)596 int mnt_want_write_file(struct file *file)
597 {
598 	int ret;
599 
600 	sb_start_write(file_inode(file)->i_sb);
601 	ret = mnt_get_write_access_file(file);
602 	if (ret)
603 		sb_end_write(file_inode(file)->i_sb);
604 	return ret;
605 }
606 EXPORT_SYMBOL_GPL(mnt_want_write_file);
607 
608 /**
609  * mnt_put_write_access - give up write access to a mount
610  * @mnt: the mount on which to give up write access
611  *
612  * Tells the low-level filesystem that we are done
613  * performing writes to it.  Must be matched with
614  * mnt_get_write_access() call above.
615  */
mnt_put_write_access(struct vfsmount * mnt)616 void mnt_put_write_access(struct vfsmount *mnt)
617 {
618 	preempt_disable();
619 	mnt_dec_writers(real_mount(mnt));
620 	preempt_enable();
621 }
622 EXPORT_SYMBOL_GPL(mnt_put_write_access);
623 
624 /**
625  * mnt_drop_write - give up write access to a mount
626  * @mnt: the mount on which to give up write access
627  *
628  * Tells the low-level filesystem that we are done performing writes to it and
629  * also allows filesystem to be frozen again.  Must be matched with
630  * mnt_want_write() call above.
631  */
mnt_drop_write(struct vfsmount * mnt)632 void mnt_drop_write(struct vfsmount *mnt)
633 {
634 	mnt_put_write_access(mnt);
635 	sb_end_write(mnt->mnt_sb);
636 }
637 EXPORT_SYMBOL_GPL(mnt_drop_write);
638 
mnt_put_write_access_file(struct file * file)639 void mnt_put_write_access_file(struct file *file)
640 {
641 	if (!(file->f_mode & FMODE_WRITER))
642 		mnt_put_write_access(file->f_path.mnt);
643 }
644 
mnt_drop_write_file(struct file * file)645 void mnt_drop_write_file(struct file *file)
646 {
647 	mnt_put_write_access_file(file);
648 	sb_end_write(file_inode(file)->i_sb);
649 }
650 EXPORT_SYMBOL(mnt_drop_write_file);
651 
652 /**
653  * mnt_hold_writers - prevent write access to the given mount
654  * @mnt: mnt to prevent write access to
655  *
656  * Prevents write access to @mnt if there are no active writers for @mnt.
657  * This function needs to be called and return successfully before changing
658  * properties of @mnt that need to remain stable for callers with write access
659  * to @mnt.
660  *
661  * After this functions has been called successfully callers must pair it with
662  * a call to mnt_unhold_writers() in order to stop preventing write access to
663  * @mnt.
664  *
665  * Context: This function expects lock_mount_hash() to be held serializing
666  *          setting MNT_WRITE_HOLD.
667  * Return: On success 0 is returned.
668  *	   On error, -EBUSY is returned.
669  */
mnt_hold_writers(struct mount * mnt)670 static inline int mnt_hold_writers(struct mount *mnt)
671 {
672 	mnt->mnt.mnt_flags |= MNT_WRITE_HOLD;
673 	/*
674 	 * After storing MNT_WRITE_HOLD, we'll read the counters. This store
675 	 * should be visible before we do.
676 	 */
677 	smp_mb();
678 
679 	/*
680 	 * With writers on hold, if this value is zero, then there are
681 	 * definitely no active writers (although held writers may subsequently
682 	 * increment the count, they'll have to wait, and decrement it after
683 	 * seeing MNT_READONLY).
684 	 *
685 	 * It is OK to have counter incremented on one CPU and decremented on
686 	 * another: the sum will add up correctly. The danger would be when we
687 	 * sum up each counter, if we read a counter before it is incremented,
688 	 * but then read another CPU's count which it has been subsequently
689 	 * decremented from -- we would see more decrements than we should.
690 	 * MNT_WRITE_HOLD protects against this scenario, because
691 	 * mnt_want_write first increments count, then smp_mb, then spins on
692 	 * MNT_WRITE_HOLD, so it can't be decremented by another CPU while
693 	 * we're counting up here.
694 	 */
695 	if (mnt_get_writers(mnt) > 0)
696 		return -EBUSY;
697 
698 	return 0;
699 }
700 
701 /**
702  * mnt_unhold_writers - stop preventing write access to the given mount
703  * @mnt: mnt to stop preventing write access to
704  *
705  * Stop preventing write access to @mnt allowing callers to gain write access
706  * to @mnt again.
707  *
708  * This function can only be called after a successful call to
709  * mnt_hold_writers().
710  *
711  * Context: This function expects lock_mount_hash() to be held.
712  */
mnt_unhold_writers(struct mount * mnt)713 static inline void mnt_unhold_writers(struct mount *mnt)
714 {
715 	/*
716 	 * MNT_READONLY must become visible before ~MNT_WRITE_HOLD, so writers
717 	 * that become unheld will see MNT_READONLY.
718 	 */
719 	smp_wmb();
720 	mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD;
721 }
722 
mnt_make_readonly(struct mount * mnt)723 static int mnt_make_readonly(struct mount *mnt)
724 {
725 	int ret;
726 
727 	ret = mnt_hold_writers(mnt);
728 	if (!ret)
729 		mnt->mnt.mnt_flags |= MNT_READONLY;
730 	mnt_unhold_writers(mnt);
731 	return ret;
732 }
733 
sb_prepare_remount_readonly(struct super_block * sb)734 int sb_prepare_remount_readonly(struct super_block *sb)
735 {
736 	struct mount *mnt;
737 	int err = 0;
738 
739 	/* Racy optimization.  Recheck the counter under MNT_WRITE_HOLD */
740 	if (atomic_long_read(&sb->s_remove_count))
741 		return -EBUSY;
742 
743 	lock_mount_hash();
744 	list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) {
745 		if (!(mnt->mnt.mnt_flags & MNT_READONLY)) {
746 			err = mnt_hold_writers(mnt);
747 			if (err)
748 				break;
749 		}
750 	}
751 	if (!err && atomic_long_read(&sb->s_remove_count))
752 		err = -EBUSY;
753 
754 	if (!err)
755 		sb_start_ro_state_change(sb);
756 	list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) {
757 		if (mnt->mnt.mnt_flags & MNT_WRITE_HOLD)
758 			mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD;
759 	}
760 	unlock_mount_hash();
761 
762 	return err;
763 }
764 
free_vfsmnt(struct mount * mnt)765 static void free_vfsmnt(struct mount *mnt)
766 {
767 	mnt_idmap_put(mnt_idmap(&mnt->mnt));
768 	kfree_const(mnt->mnt_devname);
769 #ifdef CONFIG_SMP
770 	free_percpu(mnt->mnt_pcp);
771 #endif
772 	kmem_cache_free(mnt_cache, mnt);
773 }
774 
delayed_free_vfsmnt(struct rcu_head * head)775 static void delayed_free_vfsmnt(struct rcu_head *head)
776 {
777 	free_vfsmnt(container_of(head, struct mount, mnt_rcu));
778 }
779 
780 /* call under rcu_read_lock */
__legitimize_mnt(struct vfsmount * bastard,unsigned seq)781 int __legitimize_mnt(struct vfsmount *bastard, unsigned seq)
782 {
783 	struct mount *mnt;
784 	if (read_seqretry(&mount_lock, seq))
785 		return 1;
786 	if (bastard == NULL)
787 		return 0;
788 	mnt = real_mount(bastard);
789 	mnt_add_count(mnt, 1);
790 	smp_mb();			// see mntput_no_expire()
791 	if (likely(!read_seqretry(&mount_lock, seq)))
792 		return 0;
793 	if (bastard->mnt_flags & MNT_SYNC_UMOUNT) {
794 		mnt_add_count(mnt, -1);
795 		return 1;
796 	}
797 	lock_mount_hash();
798 	if (unlikely(bastard->mnt_flags & MNT_DOOMED)) {
799 		mnt_add_count(mnt, -1);
800 		unlock_mount_hash();
801 		return 1;
802 	}
803 	unlock_mount_hash();
804 	/* caller will mntput() */
805 	return -1;
806 }
807 
808 /* call under rcu_read_lock */
legitimize_mnt(struct vfsmount * bastard,unsigned seq)809 static bool legitimize_mnt(struct vfsmount *bastard, unsigned seq)
810 {
811 	int res = __legitimize_mnt(bastard, seq);
812 	if (likely(!res))
813 		return true;
814 	if (unlikely(res < 0)) {
815 		rcu_read_unlock();
816 		mntput(bastard);
817 		rcu_read_lock();
818 	}
819 	return false;
820 }
821 
822 /**
823  * __lookup_mnt - find first child mount
824  * @mnt:	parent mount
825  * @dentry:	mountpoint
826  *
827  * If @mnt has a child mount @c mounted @dentry find and return it.
828  *
829  * Note that the child mount @c need not be unique. There are cases
830  * where shadow mounts are created. For example, during mount
831  * propagation when a source mount @mnt whose root got overmounted by a
832  * mount @o after path lookup but before @namespace_sem could be
833  * acquired gets copied and propagated. So @mnt gets copied including
834  * @o. When @mnt is propagated to a destination mount @d that already
835  * has another mount @n mounted at the same mountpoint then the source
836  * mount @mnt will be tucked beneath @n, i.e., @n will be mounted on
837  * @mnt and @mnt mounted on @d. Now both @n and @o are mounted at @mnt
838  * on @dentry.
839  *
840  * Return: The first child of @mnt mounted @dentry or NULL.
841  */
__lookup_mnt(struct vfsmount * mnt,struct dentry * dentry)842 struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
843 {
844 	struct hlist_head *head = m_hash(mnt, dentry);
845 	struct mount *p;
846 
847 	hlist_for_each_entry_rcu(p, head, mnt_hash)
848 		if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry)
849 			return p;
850 	return NULL;
851 }
852 
853 /*
854  * lookup_mnt - Return the first child mount mounted at path
855  *
856  * "First" means first mounted chronologically.  If you create the
857  * following mounts:
858  *
859  * mount /dev/sda1 /mnt
860  * mount /dev/sda2 /mnt
861  * mount /dev/sda3 /mnt
862  *
863  * Then lookup_mnt() on the base /mnt dentry in the root mount will
864  * return successively the root dentry and vfsmount of /dev/sda1, then
865  * /dev/sda2, then /dev/sda3, then NULL.
866  *
867  * lookup_mnt takes a reference to the found vfsmount.
868  */
lookup_mnt(const struct path * path)869 struct vfsmount *lookup_mnt(const struct path *path)
870 {
871 	struct mount *child_mnt;
872 	struct vfsmount *m;
873 	unsigned seq;
874 
875 	rcu_read_lock();
876 	do {
877 		seq = read_seqbegin(&mount_lock);
878 		child_mnt = __lookup_mnt(path->mnt, path->dentry);
879 		m = child_mnt ? &child_mnt->mnt : NULL;
880 	} while (!legitimize_mnt(m, seq));
881 	rcu_read_unlock();
882 	return m;
883 }
884 
885 /*
886  * __is_local_mountpoint - Test to see if dentry is a mountpoint in the
887  *                         current mount namespace.
888  *
889  * The common case is dentries are not mountpoints at all and that
890  * test is handled inline.  For the slow case when we are actually
891  * dealing with a mountpoint of some kind, walk through all of the
892  * mounts in the current mount namespace and test to see if the dentry
893  * is a mountpoint.
894  *
895  * The mount_hashtable is not usable in the context because we
896  * need to identify all mounts that may be in the current mount
897  * namespace not just a mount that happens to have some specified
898  * parent mount.
899  */
__is_local_mountpoint(struct dentry * dentry)900 bool __is_local_mountpoint(struct dentry *dentry)
901 {
902 	struct mnt_namespace *ns = current->nsproxy->mnt_ns;
903 	struct mount *mnt, *n;
904 	bool is_covered = false;
905 
906 	down_read(&namespace_sem);
907 	rbtree_postorder_for_each_entry_safe(mnt, n, &ns->mounts, mnt_node) {
908 		is_covered = (mnt->mnt_mountpoint == dentry);
909 		if (is_covered)
910 			break;
911 	}
912 	up_read(&namespace_sem);
913 
914 	return is_covered;
915 }
916 
lookup_mountpoint(struct dentry * dentry)917 static struct mountpoint *lookup_mountpoint(struct dentry *dentry)
918 {
919 	struct hlist_head *chain = mp_hash(dentry);
920 	struct mountpoint *mp;
921 
922 	hlist_for_each_entry(mp, chain, m_hash) {
923 		if (mp->m_dentry == dentry) {
924 			mp->m_count++;
925 			return mp;
926 		}
927 	}
928 	return NULL;
929 }
930 
get_mountpoint(struct dentry * dentry)931 static struct mountpoint *get_mountpoint(struct dentry *dentry)
932 {
933 	struct mountpoint *mp, *new = NULL;
934 	int ret;
935 
936 	if (d_mountpoint(dentry)) {
937 		/* might be worth a WARN_ON() */
938 		if (d_unlinked(dentry))
939 			return ERR_PTR(-ENOENT);
940 mountpoint:
941 		read_seqlock_excl(&mount_lock);
942 		mp = lookup_mountpoint(dentry);
943 		read_sequnlock_excl(&mount_lock);
944 		if (mp)
945 			goto done;
946 	}
947 
948 	if (!new)
949 		new = kmalloc(sizeof(struct mountpoint), GFP_KERNEL);
950 	if (!new)
951 		return ERR_PTR(-ENOMEM);
952 
953 
954 	/* Exactly one processes may set d_mounted */
955 	ret = d_set_mounted(dentry);
956 
957 	/* Someone else set d_mounted? */
958 	if (ret == -EBUSY)
959 		goto mountpoint;
960 
961 	/* The dentry is not available as a mountpoint? */
962 	mp = ERR_PTR(ret);
963 	if (ret)
964 		goto done;
965 
966 	/* Add the new mountpoint to the hash table */
967 	read_seqlock_excl(&mount_lock);
968 	new->m_dentry = dget(dentry);
969 	new->m_count = 1;
970 	hlist_add_head(&new->m_hash, mp_hash(dentry));
971 	INIT_HLIST_HEAD(&new->m_list);
972 	read_sequnlock_excl(&mount_lock);
973 
974 	mp = new;
975 	new = NULL;
976 done:
977 	kfree(new);
978 	return mp;
979 }
980 
981 /*
982  * vfsmount lock must be held.  Additionally, the caller is responsible
983  * for serializing calls for given disposal list.
984  */
__put_mountpoint(struct mountpoint * mp,struct list_head * list)985 static void __put_mountpoint(struct mountpoint *mp, struct list_head *list)
986 {
987 	if (!--mp->m_count) {
988 		struct dentry *dentry = mp->m_dentry;
989 		BUG_ON(!hlist_empty(&mp->m_list));
990 		spin_lock(&dentry->d_lock);
991 		dentry->d_flags &= ~DCACHE_MOUNTED;
992 		spin_unlock(&dentry->d_lock);
993 		dput_to_list(dentry, list);
994 		hlist_del(&mp->m_hash);
995 		kfree(mp);
996 	}
997 }
998 
999 /* called with namespace_lock and vfsmount lock */
put_mountpoint(struct mountpoint * mp)1000 static void put_mountpoint(struct mountpoint *mp)
1001 {
1002 	__put_mountpoint(mp, &ex_mountpoints);
1003 }
1004 
check_mnt(struct mount * mnt)1005 static inline int check_mnt(struct mount *mnt)
1006 {
1007 	return mnt->mnt_ns == current->nsproxy->mnt_ns;
1008 }
1009 
check_anonymous_mnt(struct mount * mnt)1010 static inline bool check_anonymous_mnt(struct mount *mnt)
1011 {
1012 	u64 seq;
1013 
1014 	if (!is_anon_ns(mnt->mnt_ns))
1015 		return false;
1016 
1017 	seq = mnt->mnt_ns->seq_origin;
1018 	return !seq || (seq == current->nsproxy->mnt_ns->seq);
1019 }
1020 
1021 /*
1022  * vfsmount lock must be held for write
1023  */
touch_mnt_namespace(struct mnt_namespace * ns)1024 static void touch_mnt_namespace(struct mnt_namespace *ns)
1025 {
1026 	if (ns) {
1027 		ns->event = ++event;
1028 		wake_up_interruptible(&ns->poll);
1029 	}
1030 }
1031 
1032 /*
1033  * vfsmount lock must be held for write
1034  */
__touch_mnt_namespace(struct mnt_namespace * ns)1035 static void __touch_mnt_namespace(struct mnt_namespace *ns)
1036 {
1037 	if (ns && ns->event != event) {
1038 		ns->event = event;
1039 		wake_up_interruptible(&ns->poll);
1040 	}
1041 }
1042 
1043 /*
1044  * vfsmount lock must be held for write
1045  */
unhash_mnt(struct mount * mnt)1046 static struct mountpoint *unhash_mnt(struct mount *mnt)
1047 {
1048 	struct mountpoint *mp;
1049 	mnt->mnt_parent = mnt;
1050 	mnt->mnt_mountpoint = mnt->mnt.mnt_root;
1051 	list_del_init(&mnt->mnt_child);
1052 	hlist_del_init_rcu(&mnt->mnt_hash);
1053 	hlist_del_init(&mnt->mnt_mp_list);
1054 	mp = mnt->mnt_mp;
1055 	mnt->mnt_mp = NULL;
1056 	return mp;
1057 }
1058 
1059 /*
1060  * vfsmount lock must be held for write
1061  */
umount_mnt(struct mount * mnt)1062 static void umount_mnt(struct mount *mnt)
1063 {
1064 	put_mountpoint(unhash_mnt(mnt));
1065 }
1066 
1067 /*
1068  * vfsmount lock must be held for write
1069  */
mnt_set_mountpoint(struct mount * mnt,struct mountpoint * mp,struct mount * child_mnt)1070 void mnt_set_mountpoint(struct mount *mnt,
1071 			struct mountpoint *mp,
1072 			struct mount *child_mnt)
1073 {
1074 	mp->m_count++;
1075 	mnt_add_count(mnt, 1);	/* essentially, that's mntget */
1076 	child_mnt->mnt_mountpoint = mp->m_dentry;
1077 	child_mnt->mnt_parent = mnt;
1078 	child_mnt->mnt_mp = mp;
1079 	hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list);
1080 }
1081 
1082 /**
1083  * mnt_set_mountpoint_beneath - mount a mount beneath another one
1084  *
1085  * @new_parent: the source mount
1086  * @top_mnt:    the mount beneath which @new_parent is mounted
1087  * @new_mp:     the new mountpoint of @top_mnt on @new_parent
1088  *
1089  * Remove @top_mnt from its current mountpoint @top_mnt->mnt_mp and
1090  * parent @top_mnt->mnt_parent and mount it on top of @new_parent at
1091  * @new_mp. And mount @new_parent on the old parent and old
1092  * mountpoint of @top_mnt.
1093  *
1094  * Context: This function expects namespace_lock() and lock_mount_hash()
1095  *          to have been acquired in that order.
1096  */
mnt_set_mountpoint_beneath(struct mount * new_parent,struct mount * top_mnt,struct mountpoint * new_mp)1097 static void mnt_set_mountpoint_beneath(struct mount *new_parent,
1098 				       struct mount *top_mnt,
1099 				       struct mountpoint *new_mp)
1100 {
1101 	struct mount *old_top_parent = top_mnt->mnt_parent;
1102 	struct mountpoint *old_top_mp = top_mnt->mnt_mp;
1103 
1104 	mnt_set_mountpoint(old_top_parent, old_top_mp, new_parent);
1105 	mnt_change_mountpoint(new_parent, new_mp, top_mnt);
1106 }
1107 
1108 
__attach_mnt(struct mount * mnt,struct mount * parent)1109 static void __attach_mnt(struct mount *mnt, struct mount *parent)
1110 {
1111 	hlist_add_head_rcu(&mnt->mnt_hash,
1112 			   m_hash(&parent->mnt, mnt->mnt_mountpoint));
1113 	list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
1114 }
1115 
1116 /**
1117  * attach_mnt - mount a mount, attach to @mount_hashtable and parent's
1118  *              list of child mounts
1119  * @parent:  the parent
1120  * @mnt:     the new mount
1121  * @mp:      the new mountpoint
1122  * @beneath: whether to mount @mnt beneath or on top of @parent
1123  *
1124  * If @beneath is false, mount @mnt at @mp on @parent. Then attach @mnt
1125  * to @parent's child mount list and to @mount_hashtable.
1126  *
1127  * If @beneath is true, remove @mnt from its current parent and
1128  * mountpoint and mount it on @mp on @parent, and mount @parent on the
1129  * old parent and old mountpoint of @mnt. Finally, attach @parent to
1130  * @mnt_hashtable and @parent->mnt_parent->mnt_mounts.
1131  *
1132  * Note, when __attach_mnt() is called @mnt->mnt_parent already points
1133  * to the correct parent.
1134  *
1135  * Context: This function expects namespace_lock() and lock_mount_hash()
1136  *          to have been acquired in that order.
1137  */
attach_mnt(struct mount * mnt,struct mount * parent,struct mountpoint * mp,bool beneath)1138 static void attach_mnt(struct mount *mnt, struct mount *parent,
1139 		       struct mountpoint *mp, bool beneath)
1140 {
1141 	if (beneath)
1142 		mnt_set_mountpoint_beneath(mnt, parent, mp);
1143 	else
1144 		mnt_set_mountpoint(parent, mp, mnt);
1145 	/*
1146 	 * Note, @mnt->mnt_parent has to be used. If @mnt was mounted
1147 	 * beneath @parent then @mnt will need to be attached to
1148 	 * @parent's old parent, not @parent. IOW, @mnt->mnt_parent
1149 	 * isn't the same mount as @parent.
1150 	 */
1151 	__attach_mnt(mnt, mnt->mnt_parent);
1152 }
1153 
mnt_change_mountpoint(struct mount * parent,struct mountpoint * mp,struct mount * mnt)1154 void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct mount *mnt)
1155 {
1156 	struct mountpoint *old_mp = mnt->mnt_mp;
1157 	struct mount *old_parent = mnt->mnt_parent;
1158 
1159 	list_del_init(&mnt->mnt_child);
1160 	hlist_del_init(&mnt->mnt_mp_list);
1161 	hlist_del_init_rcu(&mnt->mnt_hash);
1162 
1163 	attach_mnt(mnt, parent, mp, false);
1164 
1165 	put_mountpoint(old_mp);
1166 	mnt_add_count(old_parent, -1);
1167 }
1168 
node_to_mount(struct rb_node * node)1169 static inline struct mount *node_to_mount(struct rb_node *node)
1170 {
1171 	return node ? rb_entry(node, struct mount, mnt_node) : NULL;
1172 }
1173 
mnt_add_to_ns(struct mnt_namespace * ns,struct mount * mnt)1174 static void mnt_add_to_ns(struct mnt_namespace *ns, struct mount *mnt)
1175 {
1176 	struct rb_node **link = &ns->mounts.rb_node;
1177 	struct rb_node *parent = NULL;
1178 	bool mnt_first_node = true, mnt_last_node = true;
1179 
1180 	WARN_ON(mnt_ns_attached(mnt));
1181 	mnt->mnt_ns = ns;
1182 	while (*link) {
1183 		parent = *link;
1184 		if (mnt->mnt_id_unique < node_to_mount(parent)->mnt_id_unique) {
1185 			link = &parent->rb_left;
1186 			mnt_last_node = false;
1187 		} else {
1188 			link = &parent->rb_right;
1189 			mnt_first_node = false;
1190 		}
1191 	}
1192 
1193 	if (mnt_last_node)
1194 		ns->mnt_last_node = &mnt->mnt_node;
1195 	if (mnt_first_node)
1196 		ns->mnt_first_node = &mnt->mnt_node;
1197 	rb_link_node(&mnt->mnt_node, parent, link);
1198 	rb_insert_color(&mnt->mnt_node, &ns->mounts);
1199 
1200 	mnt_notify_add(mnt);
1201 }
1202 
1203 /*
1204  * vfsmount lock must be held for write
1205  */
commit_tree(struct mount * mnt)1206 static void commit_tree(struct mount *mnt)
1207 {
1208 	struct mount *parent = mnt->mnt_parent;
1209 	struct mount *m;
1210 	LIST_HEAD(head);
1211 	struct mnt_namespace *n = parent->mnt_ns;
1212 
1213 	BUG_ON(parent == mnt);
1214 
1215 	list_add_tail(&head, &mnt->mnt_list);
1216 	while (!list_empty(&head)) {
1217 		m = list_first_entry(&head, typeof(*m), mnt_list);
1218 		list_del(&m->mnt_list);
1219 
1220 		mnt_add_to_ns(n, m);
1221 	}
1222 	n->nr_mounts += n->pending_mounts;
1223 	n->pending_mounts = 0;
1224 
1225 	__attach_mnt(mnt, parent);
1226 	touch_mnt_namespace(n);
1227 }
1228 
next_mnt(struct mount * p,struct mount * root)1229 static struct mount *next_mnt(struct mount *p, struct mount *root)
1230 {
1231 	struct list_head *next = p->mnt_mounts.next;
1232 	if (next == &p->mnt_mounts) {
1233 		while (1) {
1234 			if (p == root)
1235 				return NULL;
1236 			next = p->mnt_child.next;
1237 			if (next != &p->mnt_parent->mnt_mounts)
1238 				break;
1239 			p = p->mnt_parent;
1240 		}
1241 	}
1242 	return list_entry(next, struct mount, mnt_child);
1243 }
1244 
skip_mnt_tree(struct mount * p)1245 static struct mount *skip_mnt_tree(struct mount *p)
1246 {
1247 	struct list_head *prev = p->mnt_mounts.prev;
1248 	while (prev != &p->mnt_mounts) {
1249 		p = list_entry(prev, struct mount, mnt_child);
1250 		prev = p->mnt_mounts.prev;
1251 	}
1252 	return p;
1253 }
1254 
1255 /**
1256  * vfs_create_mount - Create a mount for a configured superblock
1257  * @fc: The configuration context with the superblock attached
1258  *
1259  * Create a mount to an already configured superblock.  If necessary, the
1260  * caller should invoke vfs_get_tree() before calling this.
1261  *
1262  * Note that this does not attach the mount to anything.
1263  */
vfs_create_mount(struct fs_context * fc)1264 struct vfsmount *vfs_create_mount(struct fs_context *fc)
1265 {
1266 	struct mount *mnt;
1267 
1268 	if (!fc->root)
1269 		return ERR_PTR(-EINVAL);
1270 
1271 	mnt = alloc_vfsmnt(fc->source ?: "none");
1272 	if (!mnt)
1273 		return ERR_PTR(-ENOMEM);
1274 
1275 	if (fc->sb_flags & SB_KERNMOUNT)
1276 		mnt->mnt.mnt_flags = MNT_INTERNAL;
1277 
1278 	atomic_inc(&fc->root->d_sb->s_active);
1279 	mnt->mnt.mnt_sb		= fc->root->d_sb;
1280 	mnt->mnt.mnt_root	= dget(fc->root);
1281 	mnt->mnt_mountpoint	= mnt->mnt.mnt_root;
1282 	mnt->mnt_parent		= mnt;
1283 
1284 	lock_mount_hash();
1285 	list_add_tail(&mnt->mnt_instance, &mnt->mnt.mnt_sb->s_mounts);
1286 	unlock_mount_hash();
1287 	return &mnt->mnt;
1288 }
1289 EXPORT_SYMBOL(vfs_create_mount);
1290 
fc_mount(struct fs_context * fc)1291 struct vfsmount *fc_mount(struct fs_context *fc)
1292 {
1293 	int err = vfs_get_tree(fc);
1294 	if (!err) {
1295 		up_write(&fc->root->d_sb->s_umount);
1296 		return vfs_create_mount(fc);
1297 	}
1298 	return ERR_PTR(err);
1299 }
1300 EXPORT_SYMBOL(fc_mount);
1301 
vfs_kern_mount(struct file_system_type * type,int flags,const char * name,void * data)1302 struct vfsmount *vfs_kern_mount(struct file_system_type *type,
1303 				int flags, const char *name,
1304 				void *data)
1305 {
1306 	struct fs_context *fc;
1307 	struct vfsmount *mnt;
1308 	int ret = 0;
1309 
1310 	if (!type)
1311 		return ERR_PTR(-EINVAL);
1312 
1313 	fc = fs_context_for_mount(type, flags);
1314 	if (IS_ERR(fc))
1315 		return ERR_CAST(fc);
1316 
1317 	if (name)
1318 		ret = vfs_parse_fs_string(fc, "source",
1319 					  name, strlen(name));
1320 	if (!ret)
1321 		ret = parse_monolithic_mount_data(fc, data);
1322 	if (!ret)
1323 		mnt = fc_mount(fc);
1324 	else
1325 		mnt = ERR_PTR(ret);
1326 
1327 	put_fs_context(fc);
1328 	return mnt;
1329 }
1330 EXPORT_SYMBOL_GPL(vfs_kern_mount);
1331 
1332 struct vfsmount *
vfs_submount(const struct dentry * mountpoint,struct file_system_type * type,const char * name,void * data)1333 vfs_submount(const struct dentry *mountpoint, struct file_system_type *type,
1334 	     const char *name, void *data)
1335 {
1336 	/* Until it is worked out how to pass the user namespace
1337 	 * through from the parent mount to the submount don't support
1338 	 * unprivileged mounts with submounts.
1339 	 */
1340 	if (mountpoint->d_sb->s_user_ns != &init_user_ns)
1341 		return ERR_PTR(-EPERM);
1342 
1343 	return vfs_kern_mount(type, SB_SUBMOUNT, name, data);
1344 }
1345 EXPORT_SYMBOL_GPL(vfs_submount);
1346 
clone_mnt(struct mount * old,struct dentry * root,int flag)1347 static struct mount *clone_mnt(struct mount *old, struct dentry *root,
1348 					int flag)
1349 {
1350 	struct super_block *sb = old->mnt.mnt_sb;
1351 	struct mount *mnt;
1352 	int err;
1353 
1354 	mnt = alloc_vfsmnt(old->mnt_devname);
1355 	if (!mnt)
1356 		return ERR_PTR(-ENOMEM);
1357 
1358 	if (flag & (CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE))
1359 		mnt->mnt_group_id = 0; /* not a peer of original */
1360 	else
1361 		mnt->mnt_group_id = old->mnt_group_id;
1362 
1363 	if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) {
1364 		err = mnt_alloc_group_id(mnt);
1365 		if (err)
1366 			goto out_free;
1367 	}
1368 
1369 	mnt->mnt.mnt_flags = old->mnt.mnt_flags;
1370 	mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL);
1371 
1372 	atomic_inc(&sb->s_active);
1373 	mnt->mnt.mnt_idmap = mnt_idmap_get(mnt_idmap(&old->mnt));
1374 
1375 	mnt->mnt.mnt_sb = sb;
1376 	mnt->mnt.mnt_root = dget(root);
1377 	mnt->mnt_mountpoint = mnt->mnt.mnt_root;
1378 	mnt->mnt_parent = mnt;
1379 	lock_mount_hash();
1380 	list_add_tail(&mnt->mnt_instance, &sb->s_mounts);
1381 	unlock_mount_hash();
1382 
1383 	if ((flag & CL_SLAVE) ||
1384 	    ((flag & CL_SHARED_TO_SLAVE) && IS_MNT_SHARED(old))) {
1385 		list_add(&mnt->mnt_slave, &old->mnt_slave_list);
1386 		mnt->mnt_master = old;
1387 		CLEAR_MNT_SHARED(mnt);
1388 	} else if (!(flag & CL_PRIVATE)) {
1389 		if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old))
1390 			list_add(&mnt->mnt_share, &old->mnt_share);
1391 		if (IS_MNT_SLAVE(old))
1392 			list_add(&mnt->mnt_slave, &old->mnt_slave);
1393 		mnt->mnt_master = old->mnt_master;
1394 	} else {
1395 		CLEAR_MNT_SHARED(mnt);
1396 	}
1397 	if (flag & CL_MAKE_SHARED)
1398 		set_mnt_shared(mnt);
1399 
1400 	/* stick the duplicate mount on the same expiry list
1401 	 * as the original if that was on one */
1402 	if (flag & CL_EXPIRE) {
1403 		if (!list_empty(&old->mnt_expire))
1404 			list_add(&mnt->mnt_expire, &old->mnt_expire);
1405 	}
1406 
1407 	return mnt;
1408 
1409  out_free:
1410 	mnt_free_id(mnt);
1411 	free_vfsmnt(mnt);
1412 	return ERR_PTR(err);
1413 }
1414 
cleanup_mnt(struct mount * mnt)1415 static void cleanup_mnt(struct mount *mnt)
1416 {
1417 	struct hlist_node *p;
1418 	struct mount *m;
1419 	/*
1420 	 * The warning here probably indicates that somebody messed
1421 	 * up a mnt_want/drop_write() pair.  If this happens, the
1422 	 * filesystem was probably unable to make r/w->r/o transitions.
1423 	 * The locking used to deal with mnt_count decrement provides barriers,
1424 	 * so mnt_get_writers() below is safe.
1425 	 */
1426 	WARN_ON(mnt_get_writers(mnt));
1427 	if (unlikely(mnt->mnt_pins.first))
1428 		mnt_pin_kill(mnt);
1429 	hlist_for_each_entry_safe(m, p, &mnt->mnt_stuck_children, mnt_umount) {
1430 		hlist_del(&m->mnt_umount);
1431 		mntput(&m->mnt);
1432 	}
1433 	fsnotify_vfsmount_delete(&mnt->mnt);
1434 	dput(mnt->mnt.mnt_root);
1435 	deactivate_super(mnt->mnt.mnt_sb);
1436 	mnt_free_id(mnt);
1437 	call_rcu(&mnt->mnt_rcu, delayed_free_vfsmnt);
1438 }
1439 
__cleanup_mnt(struct rcu_head * head)1440 static void __cleanup_mnt(struct rcu_head *head)
1441 {
1442 	cleanup_mnt(container_of(head, struct mount, mnt_rcu));
1443 }
1444 
1445 static LLIST_HEAD(delayed_mntput_list);
delayed_mntput(struct work_struct * unused)1446 static void delayed_mntput(struct work_struct *unused)
1447 {
1448 	struct llist_node *node = llist_del_all(&delayed_mntput_list);
1449 	struct mount *m, *t;
1450 
1451 	llist_for_each_entry_safe(m, t, node, mnt_llist)
1452 		cleanup_mnt(m);
1453 }
1454 static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput);
1455 
mntput_no_expire(struct mount * mnt)1456 static void mntput_no_expire(struct mount *mnt)
1457 {
1458 	LIST_HEAD(list);
1459 	int count;
1460 
1461 	rcu_read_lock();
1462 	if (likely(READ_ONCE(mnt->mnt_ns))) {
1463 		/*
1464 		 * Since we don't do lock_mount_hash() here,
1465 		 * ->mnt_ns can change under us.  However, if it's
1466 		 * non-NULL, then there's a reference that won't
1467 		 * be dropped until after an RCU delay done after
1468 		 * turning ->mnt_ns NULL.  So if we observe it
1469 		 * non-NULL under rcu_read_lock(), the reference
1470 		 * we are dropping is not the final one.
1471 		 */
1472 		mnt_add_count(mnt, -1);
1473 		rcu_read_unlock();
1474 		return;
1475 	}
1476 	lock_mount_hash();
1477 	/*
1478 	 * make sure that if __legitimize_mnt() has not seen us grab
1479 	 * mount_lock, we'll see their refcount increment here.
1480 	 */
1481 	smp_mb();
1482 	mnt_add_count(mnt, -1);
1483 	count = mnt_get_count(mnt);
1484 	if (count != 0) {
1485 		WARN_ON(count < 0);
1486 		rcu_read_unlock();
1487 		unlock_mount_hash();
1488 		return;
1489 	}
1490 	if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) {
1491 		rcu_read_unlock();
1492 		unlock_mount_hash();
1493 		return;
1494 	}
1495 	mnt->mnt.mnt_flags |= MNT_DOOMED;
1496 	rcu_read_unlock();
1497 
1498 	list_del(&mnt->mnt_instance);
1499 
1500 	if (unlikely(!list_empty(&mnt->mnt_mounts))) {
1501 		struct mount *p, *tmp;
1502 		list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts,  mnt_child) {
1503 			__put_mountpoint(unhash_mnt(p), &list);
1504 			hlist_add_head(&p->mnt_umount, &mnt->mnt_stuck_children);
1505 		}
1506 	}
1507 	unlock_mount_hash();
1508 	shrink_dentry_list(&list);
1509 
1510 	if (likely(!(mnt->mnt.mnt_flags & MNT_INTERNAL))) {
1511 		struct task_struct *task = current;
1512 		if (likely(!(task->flags & PF_KTHREAD))) {
1513 			init_task_work(&mnt->mnt_rcu, __cleanup_mnt);
1514 			if (!task_work_add(task, &mnt->mnt_rcu, TWA_RESUME))
1515 				return;
1516 		}
1517 		if (llist_add(&mnt->mnt_llist, &delayed_mntput_list))
1518 			schedule_delayed_work(&delayed_mntput_work, 1);
1519 		return;
1520 	}
1521 	cleanup_mnt(mnt);
1522 }
1523 
mntput(struct vfsmount * mnt)1524 void mntput(struct vfsmount *mnt)
1525 {
1526 	if (mnt) {
1527 		struct mount *m = real_mount(mnt);
1528 		/* avoid cacheline pingpong */
1529 		if (unlikely(m->mnt_expiry_mark))
1530 			WRITE_ONCE(m->mnt_expiry_mark, 0);
1531 		mntput_no_expire(m);
1532 	}
1533 }
1534 EXPORT_SYMBOL(mntput);
1535 
mntget(struct vfsmount * mnt)1536 struct vfsmount *mntget(struct vfsmount *mnt)
1537 {
1538 	if (mnt)
1539 		mnt_add_count(real_mount(mnt), 1);
1540 	return mnt;
1541 }
1542 EXPORT_SYMBOL(mntget);
1543 
1544 /*
1545  * Make a mount point inaccessible to new lookups.
1546  * Because there may still be current users, the caller MUST WAIT
1547  * for an RCU grace period before destroying the mount point.
1548  */
mnt_make_shortterm(struct vfsmount * mnt)1549 void mnt_make_shortterm(struct vfsmount *mnt)
1550 {
1551 	if (mnt)
1552 		real_mount(mnt)->mnt_ns = NULL;
1553 }
1554 
1555 /**
1556  * path_is_mountpoint() - Check if path is a mount in the current namespace.
1557  * @path: path to check
1558  *
1559  *  d_mountpoint() can only be used reliably to establish if a dentry is
1560  *  not mounted in any namespace and that common case is handled inline.
1561  *  d_mountpoint() isn't aware of the possibility there may be multiple
1562  *  mounts using a given dentry in a different namespace. This function
1563  *  checks if the passed in path is a mountpoint rather than the dentry
1564  *  alone.
1565  */
path_is_mountpoint(const struct path * path)1566 bool path_is_mountpoint(const struct path *path)
1567 {
1568 	unsigned seq;
1569 	bool res;
1570 
1571 	if (!d_mountpoint(path->dentry))
1572 		return false;
1573 
1574 	rcu_read_lock();
1575 	do {
1576 		seq = read_seqbegin(&mount_lock);
1577 		res = __path_is_mountpoint(path);
1578 	} while (read_seqretry(&mount_lock, seq));
1579 	rcu_read_unlock();
1580 
1581 	return res;
1582 }
1583 EXPORT_SYMBOL(path_is_mountpoint);
1584 
mnt_clone_internal(const struct path * path)1585 struct vfsmount *mnt_clone_internal(const struct path *path)
1586 {
1587 	struct mount *p;
1588 	p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE);
1589 	if (IS_ERR(p))
1590 		return ERR_CAST(p);
1591 	p->mnt.mnt_flags |= MNT_INTERNAL;
1592 	return &p->mnt;
1593 }
1594 
1595 /*
1596  * Returns the mount which either has the specified mnt_id, or has the next
1597  * smallest id afer the specified one.
1598  */
mnt_find_id_at(struct mnt_namespace * ns,u64 mnt_id)1599 static struct mount *mnt_find_id_at(struct mnt_namespace *ns, u64 mnt_id)
1600 {
1601 	struct rb_node *node = ns->mounts.rb_node;
1602 	struct mount *ret = NULL;
1603 
1604 	while (node) {
1605 		struct mount *m = node_to_mount(node);
1606 
1607 		if (mnt_id <= m->mnt_id_unique) {
1608 			ret = node_to_mount(node);
1609 			if (mnt_id == m->mnt_id_unique)
1610 				break;
1611 			node = node->rb_left;
1612 		} else {
1613 			node = node->rb_right;
1614 		}
1615 	}
1616 	return ret;
1617 }
1618 
1619 /*
1620  * Returns the mount which either has the specified mnt_id, or has the next
1621  * greater id before the specified one.
1622  */
mnt_find_id_at_reverse(struct mnt_namespace * ns,u64 mnt_id)1623 static struct mount *mnt_find_id_at_reverse(struct mnt_namespace *ns, u64 mnt_id)
1624 {
1625 	struct rb_node *node = ns->mounts.rb_node;
1626 	struct mount *ret = NULL;
1627 
1628 	while (node) {
1629 		struct mount *m = node_to_mount(node);
1630 
1631 		if (mnt_id >= m->mnt_id_unique) {
1632 			ret = node_to_mount(node);
1633 			if (mnt_id == m->mnt_id_unique)
1634 				break;
1635 			node = node->rb_right;
1636 		} else {
1637 			node = node->rb_left;
1638 		}
1639 	}
1640 	return ret;
1641 }
1642 
1643 #ifdef CONFIG_PROC_FS
1644 
1645 /* iterator; we want it to have access to namespace_sem, thus here... */
m_start(struct seq_file * m,loff_t * pos)1646 static void *m_start(struct seq_file *m, loff_t *pos)
1647 {
1648 	struct proc_mounts *p = m->private;
1649 
1650 	down_read(&namespace_sem);
1651 
1652 	return mnt_find_id_at(p->ns, *pos);
1653 }
1654 
m_next(struct seq_file * m,void * v,loff_t * pos)1655 static void *m_next(struct seq_file *m, void *v, loff_t *pos)
1656 {
1657 	struct mount *next = NULL, *mnt = v;
1658 	struct rb_node *node = rb_next(&mnt->mnt_node);
1659 
1660 	++*pos;
1661 	if (node) {
1662 		next = node_to_mount(node);
1663 		*pos = next->mnt_id_unique;
1664 	}
1665 	return next;
1666 }
1667 
m_stop(struct seq_file * m,void * v)1668 static void m_stop(struct seq_file *m, void *v)
1669 {
1670 	up_read(&namespace_sem);
1671 }
1672 
m_show(struct seq_file * m,void * v)1673 static int m_show(struct seq_file *m, void *v)
1674 {
1675 	struct proc_mounts *p = m->private;
1676 	struct mount *r = v;
1677 	return p->show(m, &r->mnt);
1678 }
1679 
1680 const struct seq_operations mounts_op = {
1681 	.start	= m_start,
1682 	.next	= m_next,
1683 	.stop	= m_stop,
1684 	.show	= m_show,
1685 };
1686 
1687 #endif  /* CONFIG_PROC_FS */
1688 
1689 /**
1690  * may_umount_tree - check if a mount tree is busy
1691  * @m: root of mount tree
1692  *
1693  * This is called to check if a tree of mounts has any
1694  * open files, pwds, chroots or sub mounts that are
1695  * busy.
1696  */
may_umount_tree(struct vfsmount * m)1697 int may_umount_tree(struct vfsmount *m)
1698 {
1699 	struct mount *mnt = real_mount(m);
1700 	int actual_refs = 0;
1701 	int minimum_refs = 0;
1702 	struct mount *p;
1703 	BUG_ON(!m);
1704 
1705 	/* write lock needed for mnt_get_count */
1706 	lock_mount_hash();
1707 	for (p = mnt; p; p = next_mnt(p, mnt)) {
1708 		actual_refs += mnt_get_count(p);
1709 		minimum_refs += 2;
1710 	}
1711 	unlock_mount_hash();
1712 
1713 	if (actual_refs > minimum_refs)
1714 		return 0;
1715 
1716 	return 1;
1717 }
1718 
1719 EXPORT_SYMBOL(may_umount_tree);
1720 
1721 /**
1722  * may_umount - check if a mount point is busy
1723  * @mnt: root of mount
1724  *
1725  * This is called to check if a mount point has any
1726  * open files, pwds, chroots or sub mounts. If the
1727  * mount has sub mounts this will return busy
1728  * regardless of whether the sub mounts are busy.
1729  *
1730  * Doesn't take quota and stuff into account. IOW, in some cases it will
1731  * give false negatives. The main reason why it's here is that we need
1732  * a non-destructive way to look for easily umountable filesystems.
1733  */
may_umount(struct vfsmount * mnt)1734 int may_umount(struct vfsmount *mnt)
1735 {
1736 	int ret = 1;
1737 	down_read(&namespace_sem);
1738 	lock_mount_hash();
1739 	if (propagate_mount_busy(real_mount(mnt), 2))
1740 		ret = 0;
1741 	unlock_mount_hash();
1742 	up_read(&namespace_sem);
1743 	return ret;
1744 }
1745 
1746 EXPORT_SYMBOL(may_umount);
1747 
1748 #ifdef CONFIG_FSNOTIFY
mnt_notify(struct mount * p)1749 static void mnt_notify(struct mount *p)
1750 {
1751 	if (!p->prev_ns && p->mnt_ns) {
1752 		fsnotify_mnt_attach(p->mnt_ns, &p->mnt);
1753 	} else if (p->prev_ns && !p->mnt_ns) {
1754 		fsnotify_mnt_detach(p->prev_ns, &p->mnt);
1755 	} else if (p->prev_ns == p->mnt_ns) {
1756 		fsnotify_mnt_move(p->mnt_ns, &p->mnt);
1757 	} else {
1758 		fsnotify_mnt_detach(p->prev_ns, &p->mnt);
1759 		fsnotify_mnt_attach(p->mnt_ns, &p->mnt);
1760 	}
1761 	p->prev_ns = p->mnt_ns;
1762 }
1763 
notify_mnt_list(void)1764 static void notify_mnt_list(void)
1765 {
1766 	struct mount *m, *tmp;
1767 	/*
1768 	 * Notify about mounts that were added/reparented/detached/remain
1769 	 * connected after unmount.
1770 	 */
1771 	list_for_each_entry_safe(m, tmp, &notify_list, to_notify) {
1772 		mnt_notify(m);
1773 		list_del_init(&m->to_notify);
1774 	}
1775 }
1776 
need_notify_mnt_list(void)1777 static bool need_notify_mnt_list(void)
1778 {
1779 	return !list_empty(&notify_list);
1780 }
1781 #else
notify_mnt_list(void)1782 static void notify_mnt_list(void)
1783 {
1784 }
1785 
need_notify_mnt_list(void)1786 static bool need_notify_mnt_list(void)
1787 {
1788 	return false;
1789 }
1790 #endif
1791 
namespace_unlock(void)1792 static void namespace_unlock(void)
1793 {
1794 	struct hlist_head head;
1795 	struct hlist_node *p;
1796 	struct mount *m;
1797 	LIST_HEAD(list);
1798 
1799 	hlist_move_list(&unmounted, &head);
1800 	list_splice_init(&ex_mountpoints, &list);
1801 
1802 	if (need_notify_mnt_list()) {
1803 		/*
1804 		 * No point blocking out concurrent readers while notifications
1805 		 * are sent. This will also allow statmount()/listmount() to run
1806 		 * concurrently.
1807 		 */
1808 		downgrade_write(&namespace_sem);
1809 		notify_mnt_list();
1810 		up_read(&namespace_sem);
1811 	} else {
1812 		up_write(&namespace_sem);
1813 	}
1814 
1815 	shrink_dentry_list(&list);
1816 
1817 	if (likely(hlist_empty(&head)))
1818 		return;
1819 
1820 	synchronize_rcu_expedited();
1821 
1822 	hlist_for_each_entry_safe(m, p, &head, mnt_umount) {
1823 		hlist_del(&m->mnt_umount);
1824 		mntput(&m->mnt);
1825 	}
1826 }
1827 
namespace_lock(void)1828 static inline void namespace_lock(void)
1829 {
1830 	down_write(&namespace_sem);
1831 }
1832 
1833 enum umount_tree_flags {
1834 	UMOUNT_SYNC = 1,
1835 	UMOUNT_PROPAGATE = 2,
1836 	UMOUNT_CONNECTED = 4,
1837 };
1838 
disconnect_mount(struct mount * mnt,enum umount_tree_flags how)1839 static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
1840 {
1841 	/* Leaving mounts connected is only valid for lazy umounts */
1842 	if (how & UMOUNT_SYNC)
1843 		return true;
1844 
1845 	/* A mount without a parent has nothing to be connected to */
1846 	if (!mnt_has_parent(mnt))
1847 		return true;
1848 
1849 	/* Because the reference counting rules change when mounts are
1850 	 * unmounted and connected, umounted mounts may not be
1851 	 * connected to mounted mounts.
1852 	 */
1853 	if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
1854 		return true;
1855 
1856 	/* Has it been requested that the mount remain connected? */
1857 	if (how & UMOUNT_CONNECTED)
1858 		return false;
1859 
1860 	/* Is the mount locked such that it needs to remain connected? */
1861 	if (IS_MNT_LOCKED(mnt))
1862 		return false;
1863 
1864 	/* By default disconnect the mount */
1865 	return true;
1866 }
1867 
1868 /*
1869  * mount_lock must be held
1870  * namespace_sem must be held for write
1871  */
umount_tree(struct mount * mnt,enum umount_tree_flags how)1872 static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
1873 {
1874 	LIST_HEAD(tmp_list);
1875 	struct mount *p;
1876 
1877 	if (how & UMOUNT_PROPAGATE)
1878 		propagate_mount_unlock(mnt);
1879 
1880 	/* Gather the mounts to umount */
1881 	for (p = mnt; p; p = next_mnt(p, mnt)) {
1882 		p->mnt.mnt_flags |= MNT_UMOUNT;
1883 		if (mnt_ns_attached(p))
1884 			move_from_ns(p, &tmp_list);
1885 		else
1886 			list_move(&p->mnt_list, &tmp_list);
1887 	}
1888 
1889 	/* Hide the mounts from mnt_mounts */
1890 	list_for_each_entry(p, &tmp_list, mnt_list) {
1891 		list_del_init(&p->mnt_child);
1892 	}
1893 
1894 	/* Add propagated mounts to the tmp_list */
1895 	if (how & UMOUNT_PROPAGATE)
1896 		propagate_umount(&tmp_list);
1897 
1898 	while (!list_empty(&tmp_list)) {
1899 		struct mnt_namespace *ns;
1900 		bool disconnect;
1901 		p = list_first_entry(&tmp_list, struct mount, mnt_list);
1902 		list_del_init(&p->mnt_expire);
1903 		list_del_init(&p->mnt_list);
1904 		ns = p->mnt_ns;
1905 		if (ns) {
1906 			ns->nr_mounts--;
1907 			__touch_mnt_namespace(ns);
1908 		}
1909 		p->mnt_ns = NULL;
1910 		if (how & UMOUNT_SYNC)
1911 			p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
1912 
1913 		disconnect = disconnect_mount(p, how);
1914 		if (mnt_has_parent(p)) {
1915 			mnt_add_count(p->mnt_parent, -1);
1916 			if (!disconnect) {
1917 				/* Don't forget about p */
1918 				list_add_tail(&p->mnt_child, &p->mnt_parent->mnt_mounts);
1919 			} else {
1920 				umount_mnt(p);
1921 			}
1922 		}
1923 		change_mnt_propagation(p, MS_PRIVATE);
1924 		if (disconnect)
1925 			hlist_add_head(&p->mnt_umount, &unmounted);
1926 
1927 		/*
1928 		 * At this point p->mnt_ns is NULL, notification will be queued
1929 		 * only if
1930 		 *
1931 		 *  - p->prev_ns is non-NULL *and*
1932 		 *  - p->prev_ns->n_fsnotify_marks is non-NULL
1933 		 *
1934 		 * This will preclude queuing the mount if this is a cleanup
1935 		 * after a failed copy_tree() or destruction of an anonymous
1936 		 * namespace, etc.
1937 		 */
1938 		mnt_notify_add(p);
1939 	}
1940 }
1941 
1942 static void shrink_submounts(struct mount *mnt);
1943 
do_umount_root(struct super_block * sb)1944 static int do_umount_root(struct super_block *sb)
1945 {
1946 	int ret = 0;
1947 
1948 	down_write(&sb->s_umount);
1949 	if (!sb_rdonly(sb)) {
1950 		struct fs_context *fc;
1951 
1952 		fc = fs_context_for_reconfigure(sb->s_root, SB_RDONLY,
1953 						SB_RDONLY);
1954 		if (IS_ERR(fc)) {
1955 			ret = PTR_ERR(fc);
1956 		} else {
1957 			ret = parse_monolithic_mount_data(fc, NULL);
1958 			if (!ret)
1959 				ret = reconfigure_super(fc);
1960 			put_fs_context(fc);
1961 		}
1962 	}
1963 	up_write(&sb->s_umount);
1964 	return ret;
1965 }
1966 
do_umount(struct mount * mnt,int flags)1967 static int do_umount(struct mount *mnt, int flags)
1968 {
1969 	struct super_block *sb = mnt->mnt.mnt_sb;
1970 	int retval;
1971 
1972 	retval = security_sb_umount(&mnt->mnt, flags);
1973 	if (retval)
1974 		return retval;
1975 
1976 	/*
1977 	 * Allow userspace to request a mountpoint be expired rather than
1978 	 * unmounting unconditionally. Unmount only happens if:
1979 	 *  (1) the mark is already set (the mark is cleared by mntput())
1980 	 *  (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount]
1981 	 */
1982 	if (flags & MNT_EXPIRE) {
1983 		if (&mnt->mnt == current->fs->root.mnt ||
1984 		    flags & (MNT_FORCE | MNT_DETACH))
1985 			return -EINVAL;
1986 
1987 		/*
1988 		 * probably don't strictly need the lock here if we examined
1989 		 * all race cases, but it's a slowpath.
1990 		 */
1991 		lock_mount_hash();
1992 		if (mnt_get_count(mnt) != 2) {
1993 			unlock_mount_hash();
1994 			return -EBUSY;
1995 		}
1996 		unlock_mount_hash();
1997 
1998 		if (!xchg(&mnt->mnt_expiry_mark, 1))
1999 			return -EAGAIN;
2000 	}
2001 
2002 	/*
2003 	 * If we may have to abort operations to get out of this
2004 	 * mount, and they will themselves hold resources we must
2005 	 * allow the fs to do things. In the Unix tradition of
2006 	 * 'Gee thats tricky lets do it in userspace' the umount_begin
2007 	 * might fail to complete on the first run through as other tasks
2008 	 * must return, and the like. Thats for the mount program to worry
2009 	 * about for the moment.
2010 	 */
2011 
2012 	if (flags & MNT_FORCE && sb->s_op->umount_begin) {
2013 		sb->s_op->umount_begin(sb);
2014 	}
2015 
2016 	/*
2017 	 * No sense to grab the lock for this test, but test itself looks
2018 	 * somewhat bogus. Suggestions for better replacement?
2019 	 * Ho-hum... In principle, we might treat that as umount + switch
2020 	 * to rootfs. GC would eventually take care of the old vfsmount.
2021 	 * Actually it makes sense, especially if rootfs would contain a
2022 	 * /reboot - static binary that would close all descriptors and
2023 	 * call reboot(9). Then init(8) could umount root and exec /reboot.
2024 	 */
2025 	if (&mnt->mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) {
2026 		/*
2027 		 * Special case for "unmounting" root ...
2028 		 * we just try to remount it readonly.
2029 		 */
2030 		if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))
2031 			return -EPERM;
2032 		return do_umount_root(sb);
2033 	}
2034 
2035 	namespace_lock();
2036 	lock_mount_hash();
2037 
2038 	/* Recheck MNT_LOCKED with the locks held */
2039 	retval = -EINVAL;
2040 	if (mnt->mnt.mnt_flags & MNT_LOCKED)
2041 		goto out;
2042 
2043 	event++;
2044 	if (flags & MNT_DETACH) {
2045 		if (mnt_ns_attached(mnt) || !list_empty(&mnt->mnt_list))
2046 			umount_tree(mnt, UMOUNT_PROPAGATE);
2047 		retval = 0;
2048 	} else {
2049 		shrink_submounts(mnt);
2050 		retval = -EBUSY;
2051 		if (!propagate_mount_busy(mnt, 2)) {
2052 			if (mnt_ns_attached(mnt) || !list_empty(&mnt->mnt_list))
2053 				umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
2054 			retval = 0;
2055 		}
2056 	}
2057 out:
2058 	unlock_mount_hash();
2059 	namespace_unlock();
2060 	return retval;
2061 }
2062 
2063 /*
2064  * __detach_mounts - lazily unmount all mounts on the specified dentry
2065  *
2066  * During unlink, rmdir, and d_drop it is possible to loose the path
2067  * to an existing mountpoint, and wind up leaking the mount.
2068  * detach_mounts allows lazily unmounting those mounts instead of
2069  * leaking them.
2070  *
2071  * The caller may hold dentry->d_inode->i_mutex.
2072  */
__detach_mounts(struct dentry * dentry)2073 void __detach_mounts(struct dentry *dentry)
2074 {
2075 	struct mountpoint *mp;
2076 	struct mount *mnt;
2077 
2078 	namespace_lock();
2079 	lock_mount_hash();
2080 	mp = lookup_mountpoint(dentry);
2081 	if (!mp)
2082 		goto out_unlock;
2083 
2084 	event++;
2085 	while (!hlist_empty(&mp->m_list)) {
2086 		mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
2087 		if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
2088 			umount_mnt(mnt);
2089 			hlist_add_head(&mnt->mnt_umount, &unmounted);
2090 		}
2091 		else umount_tree(mnt, UMOUNT_CONNECTED);
2092 	}
2093 	put_mountpoint(mp);
2094 out_unlock:
2095 	unlock_mount_hash();
2096 	namespace_unlock();
2097 }
2098 
2099 /*
2100  * Is the caller allowed to modify his namespace?
2101  */
may_mount(void)2102 bool may_mount(void)
2103 {
2104 	return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
2105 }
2106 
warn_mandlock(void)2107 static void warn_mandlock(void)
2108 {
2109 	pr_warn_once("=======================================================\n"
2110 		     "WARNING: The mand mount option has been deprecated and\n"
2111 		     "         and is ignored by this kernel. Remove the mand\n"
2112 		     "         option from the mount to silence this warning.\n"
2113 		     "=======================================================\n");
2114 }
2115 
can_umount(const struct path * path,int flags)2116 static int can_umount(const struct path *path, int flags)
2117 {
2118 	struct mount *mnt = real_mount(path->mnt);
2119 	struct super_block *sb = path->dentry->d_sb;
2120 
2121 	if (!may_mount())
2122 		return -EPERM;
2123 	if (!path_mounted(path))
2124 		return -EINVAL;
2125 	if (!check_mnt(mnt))
2126 		return -EINVAL;
2127 	if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */
2128 		return -EINVAL;
2129 	if (flags & MNT_FORCE && !ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))
2130 		return -EPERM;
2131 	return 0;
2132 }
2133 
2134 // caller is responsible for flags being sane
path_umount(struct path * path,int flags)2135 int path_umount(struct path *path, int flags)
2136 {
2137 	struct mount *mnt = real_mount(path->mnt);
2138 	int ret;
2139 
2140 	ret = can_umount(path, flags);
2141 	if (!ret)
2142 		ret = do_umount(mnt, flags);
2143 
2144 	/* we mustn't call path_put() as that would clear mnt_expiry_mark */
2145 	dput(path->dentry);
2146 	mntput_no_expire(mnt);
2147 	return ret;
2148 }
2149 
ksys_umount(char __user * name,int flags)2150 static int ksys_umount(char __user *name, int flags)
2151 {
2152 	int lookup_flags = LOOKUP_MOUNTPOINT;
2153 	struct path path;
2154 	int ret;
2155 
2156 	// basic validity checks done first
2157 	if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
2158 		return -EINVAL;
2159 
2160 	if (!(flags & UMOUNT_NOFOLLOW))
2161 		lookup_flags |= LOOKUP_FOLLOW;
2162 	ret = user_path_at(AT_FDCWD, name, lookup_flags, &path);
2163 	if (ret)
2164 		return ret;
2165 	return path_umount(&path, flags);
2166 }
2167 
SYSCALL_DEFINE2(umount,char __user *,name,int,flags)2168 SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
2169 {
2170 	return ksys_umount(name, flags);
2171 }
2172 
2173 #ifdef __ARCH_WANT_SYS_OLDUMOUNT
2174 
2175 /*
2176  *	The 2.0 compatible umount. No flags.
2177  */
SYSCALL_DEFINE1(oldumount,char __user *,name)2178 SYSCALL_DEFINE1(oldumount, char __user *, name)
2179 {
2180 	return ksys_umount(name, 0);
2181 }
2182 
2183 #endif
2184 
is_mnt_ns_file(struct dentry * dentry)2185 static bool is_mnt_ns_file(struct dentry *dentry)
2186 {
2187 	struct ns_common *ns;
2188 
2189 	/* Is this a proxy for a mount namespace? */
2190 	if (dentry->d_op != &ns_dentry_operations)
2191 		return false;
2192 
2193 	ns = d_inode(dentry)->i_private;
2194 
2195 	return ns->ops == &mntns_operations;
2196 }
2197 
from_mnt_ns(struct mnt_namespace * mnt)2198 struct ns_common *from_mnt_ns(struct mnt_namespace *mnt)
2199 {
2200 	return &mnt->ns;
2201 }
2202 
get_sequential_mnt_ns(struct mnt_namespace * mntns,bool previous)2203 struct mnt_namespace *get_sequential_mnt_ns(struct mnt_namespace *mntns, bool previous)
2204 {
2205 	guard(rcu)();
2206 
2207 	for (;;) {
2208 		struct list_head *list;
2209 
2210 		if (previous)
2211 			list = rcu_dereference(list_bidir_prev_rcu(&mntns->mnt_ns_list));
2212 		else
2213 			list = rcu_dereference(list_next_rcu(&mntns->mnt_ns_list));
2214 		if (list_is_head(list, &mnt_ns_list))
2215 			return ERR_PTR(-ENOENT);
2216 
2217 		mntns = list_entry_rcu(list, struct mnt_namespace, mnt_ns_list);
2218 
2219 		/*
2220 		 * The last passive reference count is put with RCU
2221 		 * delay so accessing the mount namespace is not just
2222 		 * safe but all relevant members are still valid.
2223 		 */
2224 		if (!ns_capable_noaudit(mntns->user_ns, CAP_SYS_ADMIN))
2225 			continue;
2226 
2227 		/*
2228 		 * We need an active reference count as we're persisting
2229 		 * the mount namespace and it might already be on its
2230 		 * deathbed.
2231 		 */
2232 		if (!refcount_inc_not_zero(&mntns->ns.count))
2233 			continue;
2234 
2235 		return mntns;
2236 	}
2237 }
2238 
mnt_ns_from_dentry(struct dentry * dentry)2239 struct mnt_namespace *mnt_ns_from_dentry(struct dentry *dentry)
2240 {
2241 	if (!is_mnt_ns_file(dentry))
2242 		return NULL;
2243 
2244 	return to_mnt_ns(get_proc_ns(dentry->d_inode));
2245 }
2246 
mnt_ns_loop(struct dentry * dentry)2247 static bool mnt_ns_loop(struct dentry *dentry)
2248 {
2249 	/* Could bind mounting the mount namespace inode cause a
2250 	 * mount namespace loop?
2251 	 */
2252 	struct mnt_namespace *mnt_ns = mnt_ns_from_dentry(dentry);
2253 
2254 	if (!mnt_ns)
2255 		return false;
2256 
2257 	return current->nsproxy->mnt_ns->seq >= mnt_ns->seq;
2258 }
2259 
copy_tree(struct mount * src_root,struct dentry * dentry,int flag)2260 struct mount *copy_tree(struct mount *src_root, struct dentry *dentry,
2261 					int flag)
2262 {
2263 	struct mount *res, *src_parent, *src_root_child, *src_mnt,
2264 		*dst_parent, *dst_mnt;
2265 
2266 	if (!(flag & CL_COPY_UNBINDABLE) && IS_MNT_UNBINDABLE(src_root))
2267 		return ERR_PTR(-EINVAL);
2268 
2269 	if (!(flag & CL_COPY_MNT_NS_FILE) && is_mnt_ns_file(dentry))
2270 		return ERR_PTR(-EINVAL);
2271 
2272 	res = dst_mnt = clone_mnt(src_root, dentry, flag);
2273 	if (IS_ERR(dst_mnt))
2274 		return dst_mnt;
2275 
2276 	src_parent = src_root;
2277 	dst_mnt->mnt_mountpoint = src_root->mnt_mountpoint;
2278 
2279 	list_for_each_entry(src_root_child, &src_root->mnt_mounts, mnt_child) {
2280 		if (!is_subdir(src_root_child->mnt_mountpoint, dentry))
2281 			continue;
2282 
2283 		for (src_mnt = src_root_child; src_mnt;
2284 		    src_mnt = next_mnt(src_mnt, src_root_child)) {
2285 			if (!(flag & CL_COPY_UNBINDABLE) &&
2286 			    IS_MNT_UNBINDABLE(src_mnt)) {
2287 				if (src_mnt->mnt.mnt_flags & MNT_LOCKED) {
2288 					/* Both unbindable and locked. */
2289 					dst_mnt = ERR_PTR(-EPERM);
2290 					goto out;
2291 				} else {
2292 					src_mnt = skip_mnt_tree(src_mnt);
2293 					continue;
2294 				}
2295 			}
2296 			if (!(flag & CL_COPY_MNT_NS_FILE) &&
2297 			    is_mnt_ns_file(src_mnt->mnt.mnt_root)) {
2298 				src_mnt = skip_mnt_tree(src_mnt);
2299 				continue;
2300 			}
2301 			while (src_parent != src_mnt->mnt_parent) {
2302 				src_parent = src_parent->mnt_parent;
2303 				dst_mnt = dst_mnt->mnt_parent;
2304 			}
2305 
2306 			src_parent = src_mnt;
2307 			dst_parent = dst_mnt;
2308 			dst_mnt = clone_mnt(src_mnt, src_mnt->mnt.mnt_root, flag);
2309 			if (IS_ERR(dst_mnt))
2310 				goto out;
2311 			lock_mount_hash();
2312 			list_add_tail(&dst_mnt->mnt_list, &res->mnt_list);
2313 			attach_mnt(dst_mnt, dst_parent, src_parent->mnt_mp, false);
2314 			unlock_mount_hash();
2315 		}
2316 	}
2317 	return res;
2318 
2319 out:
2320 	if (res) {
2321 		lock_mount_hash();
2322 		umount_tree(res, UMOUNT_SYNC);
2323 		unlock_mount_hash();
2324 	}
2325 	return dst_mnt;
2326 }
2327 
2328 /* Caller should check returned pointer for errors */
2329 
collect_mounts(const struct path * path)2330 struct vfsmount *collect_mounts(const struct path *path)
2331 {
2332 	struct mount *tree;
2333 	namespace_lock();
2334 	if (!check_mnt(real_mount(path->mnt)))
2335 		tree = ERR_PTR(-EINVAL);
2336 	else
2337 		tree = copy_tree(real_mount(path->mnt), path->dentry,
2338 				 CL_COPY_ALL | CL_PRIVATE);
2339 	namespace_unlock();
2340 	if (IS_ERR(tree))
2341 		return ERR_CAST(tree);
2342 	return &tree->mnt;
2343 }
2344 
2345 static void free_mnt_ns(struct mnt_namespace *);
2346 static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *, bool);
2347 
must_dissolve(struct mnt_namespace * mnt_ns)2348 static inline bool must_dissolve(struct mnt_namespace *mnt_ns)
2349 {
2350 	/*
2351         * This mount belonged to an anonymous mount namespace
2352         * but was moved to a non-anonymous mount namespace and
2353         * then unmounted.
2354         */
2355 	if (unlikely(!mnt_ns))
2356 		return false;
2357 
2358 	/*
2359         * This mount belongs to a non-anonymous mount namespace
2360         * and we know that such a mount can never transition to
2361         * an anonymous mount namespace again.
2362         */
2363 	if (!is_anon_ns(mnt_ns)) {
2364 		/*
2365 		 * A detached mount either belongs to an anonymous mount
2366 		 * namespace or a non-anonymous mount namespace. It
2367 		 * should never belong to something purely internal.
2368 		 */
2369 		VFS_WARN_ON_ONCE(mnt_ns == MNT_NS_INTERNAL);
2370 		return false;
2371 	}
2372 
2373 	return true;
2374 }
2375 
dissolve_on_fput(struct vfsmount * mnt)2376 void dissolve_on_fput(struct vfsmount *mnt)
2377 {
2378 	struct mnt_namespace *ns;
2379 	struct mount *m = real_mount(mnt);
2380 
2381 	scoped_guard(rcu) {
2382 		if (!must_dissolve(READ_ONCE(m->mnt_ns)))
2383 			return;
2384 	}
2385 
2386 	scoped_guard(rwsem_write, &namespace_sem) {
2387 		ns = m->mnt_ns;
2388 		if (!must_dissolve(ns))
2389 			return;
2390 
2391 		/*
2392 		 * After must_dissolve() we know that this is a detached
2393 		 * mount in an anonymous mount namespace.
2394 		 *
2395 		 * Now when mnt_has_parent() reports that this mount
2396 		 * tree has a parent, we know that this anonymous mount
2397 		 * tree has been moved to another anonymous mount
2398 		 * namespace.
2399 		 *
2400 		 * So when closing this file we cannot unmount the mount
2401 		 * tree. This will be done when the file referring to
2402 		 * the root of the anonymous mount namespace will be
2403 		 * closed (It could already be closed but it would sync
2404 		 * on @namespace_sem and wait for us to finish.).
2405 		 */
2406 		if (mnt_has_parent(m))
2407 			return;
2408 
2409 		lock_mount_hash();
2410 		umount_tree(m, UMOUNT_CONNECTED);
2411 		unlock_mount_hash();
2412 	}
2413 
2414 	/* Make sure we notice when we leak mounts. */
2415 	VFS_WARN_ON_ONCE(!mnt_ns_empty(ns));
2416 	free_mnt_ns(ns);
2417 }
2418 
drop_collected_mounts(struct vfsmount * mnt)2419 void drop_collected_mounts(struct vfsmount *mnt)
2420 {
2421 	namespace_lock();
2422 	lock_mount_hash();
2423 	umount_tree(real_mount(mnt), 0);
2424 	unlock_mount_hash();
2425 	namespace_unlock();
2426 }
2427 
has_locked_children(struct mount * mnt,struct dentry * dentry)2428 bool has_locked_children(struct mount *mnt, struct dentry *dentry)
2429 {
2430 	struct mount *child;
2431 
2432 	list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
2433 		if (!is_subdir(child->mnt_mountpoint, dentry))
2434 			continue;
2435 
2436 		if (child->mnt.mnt_flags & MNT_LOCKED)
2437 			return true;
2438 	}
2439 	return false;
2440 }
2441 
2442 /*
2443  * Check that there aren't references to earlier/same mount namespaces in the
2444  * specified subtree.  Such references can act as pins for mount namespaces
2445  * that aren't checked by the mount-cycle checking code, thereby allowing
2446  * cycles to be made.
2447  */
check_for_nsfs_mounts(struct mount * subtree)2448 static bool check_for_nsfs_mounts(struct mount *subtree)
2449 {
2450 	struct mount *p;
2451 	bool ret = false;
2452 
2453 	lock_mount_hash();
2454 	for (p = subtree; p; p = next_mnt(p, subtree))
2455 		if (mnt_ns_loop(p->mnt.mnt_root))
2456 			goto out;
2457 
2458 	ret = true;
2459 out:
2460 	unlock_mount_hash();
2461 	return ret;
2462 }
2463 
2464 /**
2465  * clone_private_mount - create a private clone of a path
2466  * @path: path to clone
2467  *
2468  * This creates a new vfsmount, which will be the clone of @path.  The new mount
2469  * will not be attached anywhere in the namespace and will be private (i.e.
2470  * changes to the originating mount won't be propagated into this).
2471  *
2472  * This assumes caller has called or done the equivalent of may_mount().
2473  *
2474  * Release with mntput().
2475  */
clone_private_mount(const struct path * path)2476 struct vfsmount *clone_private_mount(const struct path *path)
2477 {
2478 	struct mount *old_mnt = real_mount(path->mnt);
2479 	struct mount *new_mnt;
2480 
2481 	scoped_guard(rwsem_read, &namespace_sem)
2482 	if (IS_MNT_UNBINDABLE(old_mnt))
2483 		return ERR_PTR(-EINVAL);
2484 
2485 	if (mnt_has_parent(old_mnt)) {
2486 		if (!check_mnt(old_mnt))
2487 			return ERR_PTR(-EINVAL);
2488 	} else {
2489 		if (!is_mounted(&old_mnt->mnt))
2490 			return ERR_PTR(-EINVAL);
2491 
2492 		/* Make sure this isn't something purely kernel internal. */
2493 		if (!is_anon_ns(old_mnt->mnt_ns))
2494 			return ERR_PTR(-EINVAL);
2495 
2496 		/* Make sure we don't create mount namespace loops. */
2497 		if (!check_for_nsfs_mounts(old_mnt))
2498 			return ERR_PTR(-EINVAL);
2499 	}
2500 
2501 	if (has_locked_children(old_mnt, path->dentry))
2502 		return ERR_PTR(-EINVAL);
2503 
2504 	new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
2505 	if (IS_ERR(new_mnt))
2506 		return ERR_PTR(-EINVAL);
2507 
2508 	/* Longterm mount to be removed by kern_unmount*() */
2509 	new_mnt->mnt_ns = MNT_NS_INTERNAL;
2510 	return &new_mnt->mnt;
2511 }
2512 EXPORT_SYMBOL_GPL(clone_private_mount);
2513 
iterate_mounts(int (* f)(struct vfsmount *,void *),void * arg,struct vfsmount * root)2514 int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg,
2515 		   struct vfsmount *root)
2516 {
2517 	struct mount *mnt;
2518 	int res = f(root, arg);
2519 	if (res)
2520 		return res;
2521 	list_for_each_entry(mnt, &real_mount(root)->mnt_list, mnt_list) {
2522 		res = f(&mnt->mnt, arg);
2523 		if (res)
2524 			return res;
2525 	}
2526 	return 0;
2527 }
2528 
lock_mnt_tree(struct mount * mnt)2529 static void lock_mnt_tree(struct mount *mnt)
2530 {
2531 	struct mount *p;
2532 
2533 	for (p = mnt; p; p = next_mnt(p, mnt)) {
2534 		int flags = p->mnt.mnt_flags;
2535 		/* Don't allow unprivileged users to change mount flags */
2536 		flags |= MNT_LOCK_ATIME;
2537 
2538 		if (flags & MNT_READONLY)
2539 			flags |= MNT_LOCK_READONLY;
2540 
2541 		if (flags & MNT_NODEV)
2542 			flags |= MNT_LOCK_NODEV;
2543 
2544 		if (flags & MNT_NOSUID)
2545 			flags |= MNT_LOCK_NOSUID;
2546 
2547 		if (flags & MNT_NOEXEC)
2548 			flags |= MNT_LOCK_NOEXEC;
2549 		/* Don't allow unprivileged users to reveal what is under a mount */
2550 		if (list_empty(&p->mnt_expire))
2551 			flags |= MNT_LOCKED;
2552 		p->mnt.mnt_flags = flags;
2553 	}
2554 }
2555 
cleanup_group_ids(struct mount * mnt,struct mount * end)2556 static void cleanup_group_ids(struct mount *mnt, struct mount *end)
2557 {
2558 	struct mount *p;
2559 
2560 	for (p = mnt; p != end; p = next_mnt(p, mnt)) {
2561 		if (p->mnt_group_id && !IS_MNT_SHARED(p))
2562 			mnt_release_group_id(p);
2563 	}
2564 }
2565 
invent_group_ids(struct mount * mnt,bool recurse)2566 static int invent_group_ids(struct mount *mnt, bool recurse)
2567 {
2568 	struct mount *p;
2569 
2570 	for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) {
2571 		if (!p->mnt_group_id && !IS_MNT_SHARED(p)) {
2572 			int err = mnt_alloc_group_id(p);
2573 			if (err) {
2574 				cleanup_group_ids(mnt, p);
2575 				return err;
2576 			}
2577 		}
2578 	}
2579 
2580 	return 0;
2581 }
2582 
count_mounts(struct mnt_namespace * ns,struct mount * mnt)2583 int count_mounts(struct mnt_namespace *ns, struct mount *mnt)
2584 {
2585 	unsigned int max = READ_ONCE(sysctl_mount_max);
2586 	unsigned int mounts = 0;
2587 	struct mount *p;
2588 
2589 	if (ns->nr_mounts >= max)
2590 		return -ENOSPC;
2591 	max -= ns->nr_mounts;
2592 	if (ns->pending_mounts >= max)
2593 		return -ENOSPC;
2594 	max -= ns->pending_mounts;
2595 
2596 	for (p = mnt; p; p = next_mnt(p, mnt))
2597 		mounts++;
2598 
2599 	if (mounts > max)
2600 		return -ENOSPC;
2601 
2602 	ns->pending_mounts += mounts;
2603 	return 0;
2604 }
2605 
2606 enum mnt_tree_flags_t {
2607 	MNT_TREE_MOVE = BIT(0),
2608 	MNT_TREE_BENEATH = BIT(1),
2609 	MNT_TREE_PROPAGATION = BIT(2),
2610 };
2611 
2612 /**
2613  * attach_recursive_mnt - attach a source mount tree
2614  * @source_mnt: mount tree to be attached
2615  * @top_mnt:    mount that @source_mnt will be mounted on or mounted beneath
2616  * @dest_mp:    the mountpoint @source_mnt will be mounted at
2617  * @flags:      modify how @source_mnt is supposed to be attached
2618  *
2619  *  NOTE: in the table below explains the semantics when a source mount
2620  *  of a given type is attached to a destination mount of a given type.
2621  * ---------------------------------------------------------------------------
2622  * |         BIND MOUNT OPERATION                                            |
2623  * |**************************************************************************
2624  * | source-->| shared        |       private  |       slave    | unbindable |
2625  * | dest     |               |                |                |            |
2626  * |   |      |               |                |                |            |
2627  * |   v      |               |                |                |            |
2628  * |**************************************************************************
2629  * |  shared  | shared (++)   |     shared (+) |     shared(+++)|  invalid   |
2630  * |          |               |                |                |            |
2631  * |non-shared| shared (+)    |      private   |      slave (*) |  invalid   |
2632  * ***************************************************************************
2633  * A bind operation clones the source mount and mounts the clone on the
2634  * destination mount.
2635  *
2636  * (++)  the cloned mount is propagated to all the mounts in the propagation
2637  * 	 tree of the destination mount and the cloned mount is added to
2638  * 	 the peer group of the source mount.
2639  * (+)   the cloned mount is created under the destination mount and is marked
2640  *       as shared. The cloned mount is added to the peer group of the source
2641  *       mount.
2642  * (+++) the mount is propagated to all the mounts in the propagation tree
2643  *       of the destination mount and the cloned mount is made slave
2644  *       of the same master as that of the source mount. The cloned mount
2645  *       is marked as 'shared and slave'.
2646  * (*)   the cloned mount is made a slave of the same master as that of the
2647  * 	 source mount.
2648  *
2649  * ---------------------------------------------------------------------------
2650  * |         		MOVE MOUNT OPERATION                                 |
2651  * |**************************************************************************
2652  * | source-->| shared        |       private  |       slave    | unbindable |
2653  * | dest     |               |                |                |            |
2654  * |   |      |               |                |                |            |
2655  * |   v      |               |                |                |            |
2656  * |**************************************************************************
2657  * |  shared  | shared (+)    |     shared (+) |    shared(+++) |  invalid   |
2658  * |          |               |                |                |            |
2659  * |non-shared| shared (+*)   |      private   |    slave (*)   | unbindable |
2660  * ***************************************************************************
2661  *
2662  * (+)  the mount is moved to the destination. And is then propagated to
2663  * 	all the mounts in the propagation tree of the destination mount.
2664  * (+*)  the mount is moved to the destination.
2665  * (+++)  the mount is moved to the destination and is then propagated to
2666  * 	all the mounts belonging to the destination mount's propagation tree.
2667  * 	the mount is marked as 'shared and slave'.
2668  * (*)	the mount continues to be a slave at the new location.
2669  *
2670  * if the source mount is a tree, the operations explained above is
2671  * applied to each mount in the tree.
2672  * Must be called without spinlocks held, since this function can sleep
2673  * in allocations.
2674  *
2675  * Context: The function expects namespace_lock() to be held.
2676  * Return: If @source_mnt was successfully attached 0 is returned.
2677  *         Otherwise a negative error code is returned.
2678  */
attach_recursive_mnt(struct mount * source_mnt,struct mount * top_mnt,struct mountpoint * dest_mp,enum mnt_tree_flags_t flags)2679 static int attach_recursive_mnt(struct mount *source_mnt,
2680 				struct mount *top_mnt,
2681 				struct mountpoint *dest_mp,
2682 				enum mnt_tree_flags_t flags)
2683 {
2684 	struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
2685 	HLIST_HEAD(tree_list);
2686 	struct mnt_namespace *ns = top_mnt->mnt_ns;
2687 	struct mountpoint *smp;
2688 	struct mount *child, *dest_mnt, *p;
2689 	struct hlist_node *n;
2690 	int err = 0;
2691 	bool moving = flags & MNT_TREE_MOVE, beneath = flags & MNT_TREE_BENEATH;
2692 
2693 	/*
2694 	 * Preallocate a mountpoint in case the new mounts need to be
2695 	 * mounted beneath mounts on the same mountpoint.
2696 	 */
2697 	smp = get_mountpoint(source_mnt->mnt.mnt_root);
2698 	if (IS_ERR(smp))
2699 		return PTR_ERR(smp);
2700 
2701 	/* Is there space to add these mounts to the mount namespace? */
2702 	if (!moving) {
2703 		err = count_mounts(ns, source_mnt);
2704 		if (err)
2705 			goto out;
2706 	}
2707 
2708 	if (beneath)
2709 		dest_mnt = top_mnt->mnt_parent;
2710 	else
2711 		dest_mnt = top_mnt;
2712 
2713 	if (IS_MNT_SHARED(dest_mnt)) {
2714 		err = invent_group_ids(source_mnt, true);
2715 		if (err)
2716 			goto out;
2717 		err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list);
2718 	}
2719 	lock_mount_hash();
2720 	if (err)
2721 		goto out_cleanup_ids;
2722 
2723 	if (IS_MNT_SHARED(dest_mnt)) {
2724 		for (p = source_mnt; p; p = next_mnt(p, source_mnt))
2725 			set_mnt_shared(p);
2726 	}
2727 
2728 	if (moving) {
2729 		if (beneath)
2730 			dest_mp = smp;
2731 		unhash_mnt(source_mnt);
2732 		attach_mnt(source_mnt, top_mnt, dest_mp, beneath);
2733 		mnt_notify_add(source_mnt);
2734 		touch_mnt_namespace(source_mnt->mnt_ns);
2735 	} else {
2736 		if (source_mnt->mnt_ns) {
2737 			LIST_HEAD(head);
2738 
2739 			/* move from anon - the caller will destroy */
2740 			for (p = source_mnt; p; p = next_mnt(p, source_mnt))
2741 				move_from_ns(p, &head);
2742 			list_del_init(&head);
2743 		}
2744 		if (beneath)
2745 			mnt_set_mountpoint_beneath(source_mnt, top_mnt, smp);
2746 		else
2747 			mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt);
2748 		commit_tree(source_mnt);
2749 	}
2750 
2751 	hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) {
2752 		struct mount *q;
2753 		hlist_del_init(&child->mnt_hash);
2754 		q = __lookup_mnt(&child->mnt_parent->mnt,
2755 				 child->mnt_mountpoint);
2756 		if (q)
2757 			mnt_change_mountpoint(child, smp, q);
2758 		/* Notice when we are propagating across user namespaces */
2759 		if (child->mnt_parent->mnt_ns->user_ns != user_ns)
2760 			lock_mnt_tree(child);
2761 		child->mnt.mnt_flags &= ~MNT_LOCKED;
2762 		commit_tree(child);
2763 	}
2764 	put_mountpoint(smp);
2765 	unlock_mount_hash();
2766 
2767 	return 0;
2768 
2769  out_cleanup_ids:
2770 	while (!hlist_empty(&tree_list)) {
2771 		child = hlist_entry(tree_list.first, struct mount, mnt_hash);
2772 		child->mnt_parent->mnt_ns->pending_mounts = 0;
2773 		umount_tree(child, UMOUNT_SYNC);
2774 	}
2775 	unlock_mount_hash();
2776 	cleanup_group_ids(source_mnt, NULL);
2777  out:
2778 	ns->pending_mounts = 0;
2779 
2780 	read_seqlock_excl(&mount_lock);
2781 	put_mountpoint(smp);
2782 	read_sequnlock_excl(&mount_lock);
2783 
2784 	return err;
2785 }
2786 
2787 /**
2788  * do_lock_mount - lock mount and mountpoint
2789  * @path:    target path
2790  * @beneath: whether the intention is to mount beneath @path
2791  *
2792  * Follow the mount stack on @path until the top mount @mnt is found. If
2793  * the initial @path->{mnt,dentry} is a mountpoint lookup the first
2794  * mount stacked on top of it. Then simply follow @{mnt,mnt->mnt_root}
2795  * until nothing is stacked on top of it anymore.
2796  *
2797  * Acquire the inode_lock() on the top mount's ->mnt_root to protect
2798  * against concurrent removal of the new mountpoint from another mount
2799  * namespace.
2800  *
2801  * If @beneath is requested, acquire inode_lock() on @mnt's mountpoint
2802  * @mp on @mnt->mnt_parent must be acquired. This protects against a
2803  * concurrent unlink of @mp->mnt_dentry from another mount namespace
2804  * where @mnt doesn't have a child mount mounted @mp. A concurrent
2805  * removal of @mnt->mnt_root doesn't matter as nothing will be mounted
2806  * on top of it for @beneath.
2807  *
2808  * In addition, @beneath needs to make sure that @mnt hasn't been
2809  * unmounted or moved from its current mountpoint in between dropping
2810  * @mount_lock and acquiring @namespace_sem. For the !@beneath case @mnt
2811  * being unmounted would be detected later by e.g., calling
2812  * check_mnt(mnt) in the function it's called from. For the @beneath
2813  * case however, it's useful to detect it directly in do_lock_mount().
2814  * If @mnt hasn't been unmounted then @mnt->mnt_mountpoint still points
2815  * to @mnt->mnt_mp->m_dentry. But if @mnt has been unmounted it will
2816  * point to @mnt->mnt_root and @mnt->mnt_mp will be NULL.
2817  *
2818  * Return: Either the target mountpoint on the top mount or the top
2819  *         mount's mountpoint.
2820  */
do_lock_mount(struct path * path,bool beneath)2821 static struct mountpoint *do_lock_mount(struct path *path, bool beneath)
2822 {
2823 	struct vfsmount *mnt = path->mnt;
2824 	struct dentry *dentry;
2825 	struct mountpoint *mp = ERR_PTR(-ENOENT);
2826 
2827 	for (;;) {
2828 		struct mount *m;
2829 
2830 		if (beneath) {
2831 			m = real_mount(mnt);
2832 			read_seqlock_excl(&mount_lock);
2833 			dentry = dget(m->mnt_mountpoint);
2834 			read_sequnlock_excl(&mount_lock);
2835 		} else {
2836 			dentry = path->dentry;
2837 		}
2838 
2839 		inode_lock(dentry->d_inode);
2840 		if (unlikely(cant_mount(dentry))) {
2841 			inode_unlock(dentry->d_inode);
2842 			goto out;
2843 		}
2844 
2845 		namespace_lock();
2846 
2847 		if (beneath && (!is_mounted(mnt) || m->mnt_mountpoint != dentry)) {
2848 			namespace_unlock();
2849 			inode_unlock(dentry->d_inode);
2850 			goto out;
2851 		}
2852 
2853 		mnt = lookup_mnt(path);
2854 		if (likely(!mnt))
2855 			break;
2856 
2857 		namespace_unlock();
2858 		inode_unlock(dentry->d_inode);
2859 		if (beneath)
2860 			dput(dentry);
2861 		path_put(path);
2862 		path->mnt = mnt;
2863 		path->dentry = dget(mnt->mnt_root);
2864 	}
2865 
2866 	mp = get_mountpoint(dentry);
2867 	if (IS_ERR(mp)) {
2868 		namespace_unlock();
2869 		inode_unlock(dentry->d_inode);
2870 	}
2871 
2872 out:
2873 	if (beneath)
2874 		dput(dentry);
2875 
2876 	return mp;
2877 }
2878 
lock_mount(struct path * path)2879 static inline struct mountpoint *lock_mount(struct path *path)
2880 {
2881 	return do_lock_mount(path, false);
2882 }
2883 
unlock_mount(struct mountpoint * where)2884 static void unlock_mount(struct mountpoint *where)
2885 {
2886 	struct dentry *dentry = where->m_dentry;
2887 
2888 	read_seqlock_excl(&mount_lock);
2889 	put_mountpoint(where);
2890 	read_sequnlock_excl(&mount_lock);
2891 
2892 	namespace_unlock();
2893 	inode_unlock(dentry->d_inode);
2894 }
2895 
graft_tree(struct mount * mnt,struct mount * p,struct mountpoint * mp)2896 static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp)
2897 {
2898 	if (mnt->mnt.mnt_sb->s_flags & SB_NOUSER)
2899 		return -EINVAL;
2900 
2901 	if (d_is_dir(mp->m_dentry) !=
2902 	      d_is_dir(mnt->mnt.mnt_root))
2903 		return -ENOTDIR;
2904 
2905 	return attach_recursive_mnt(mnt, p, mp, 0);
2906 }
2907 
2908 /*
2909  * Sanity check the flags to change_mnt_propagation.
2910  */
2911 
flags_to_propagation_type(int ms_flags)2912 static int flags_to_propagation_type(int ms_flags)
2913 {
2914 	int type = ms_flags & ~(MS_REC | MS_SILENT);
2915 
2916 	/* Fail if any non-propagation flags are set */
2917 	if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
2918 		return 0;
2919 	/* Only one propagation flag should be set */
2920 	if (!is_power_of_2(type))
2921 		return 0;
2922 	return type;
2923 }
2924 
2925 /*
2926  * recursively change the type of the mountpoint.
2927  */
do_change_type(struct path * path,int ms_flags)2928 static int do_change_type(struct path *path, int ms_flags)
2929 {
2930 	struct mount *m;
2931 	struct mount *mnt = real_mount(path->mnt);
2932 	int recurse = ms_flags & MS_REC;
2933 	int type;
2934 	int err = 0;
2935 
2936 	if (!path_mounted(path))
2937 		return -EINVAL;
2938 
2939 	type = flags_to_propagation_type(ms_flags);
2940 	if (!type)
2941 		return -EINVAL;
2942 
2943 	namespace_lock();
2944 	if (type == MS_SHARED) {
2945 		err = invent_group_ids(mnt, recurse);
2946 		if (err)
2947 			goto out_unlock;
2948 	}
2949 
2950 	lock_mount_hash();
2951 	for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL))
2952 		change_mnt_propagation(m, type);
2953 	unlock_mount_hash();
2954 
2955  out_unlock:
2956 	namespace_unlock();
2957 	return err;
2958 }
2959 
2960 /* may_copy_tree() - check if a mount tree can be copied
2961  * @path: path to the mount tree to be copied
2962  *
2963  * This helper checks if the caller may copy the mount tree starting
2964  * from @path->mnt. The caller may copy the mount tree under the
2965  * following circumstances:
2966  *
2967  * (1) The caller is located in the mount namespace of the mount tree.
2968  *     This also implies that the mount does not belong to an anonymous
2969  *     mount namespace.
2970  * (2) The caller tries to copy an nfs mount referring to a mount
2971  *     namespace, i.e., the caller is trying to copy a mount namespace
2972  *     entry from nsfs.
2973  * (3) The caller tries to copy a pidfs mount referring to a pidfd.
2974  * (4) The caller is trying to copy a mount tree that belongs to an
2975  *     anonymous mount namespace.
2976  *
2977  *     For that to be safe, this helper enforces that the origin mount
2978  *     namespace the anonymous mount namespace was created from is the
2979  *     same as the caller's mount namespace by comparing the sequence
2980  *     numbers.
2981  *
2982  *     This is not strictly necessary. The current semantics of the new
2983  *     mount api enforce that the caller must be located in the same
2984  *     mount namespace as the mount tree it interacts with. Using the
2985  *     origin sequence number preserves these semantics even for
2986  *     anonymous mount namespaces. However, one could envision extending
2987  *     the api to directly operate across mount namespace if needed.
2988  *
2989  *     The ownership of a non-anonymous mount namespace such as the
2990  *     caller's cannot change.
2991  *     => We know that the caller's mount namespace is stable.
2992  *
2993  *     If the origin sequence number of the anonymous mount namespace is
2994  *     the same as the sequence number of the caller's mount namespace.
2995  *     => The owning namespaces are the same.
2996  *
2997  *     ==> The earlier capability check on the owning namespace of the
2998  *         caller's mount namespace ensures that the caller has the
2999  *         ability to copy the mount tree.
3000  *
3001  * Returns true if the mount tree can be copied, false otherwise.
3002  */
may_copy_tree(struct path * path)3003 static inline bool may_copy_tree(struct path *path)
3004 {
3005 	struct mount *mnt = real_mount(path->mnt);
3006 	const struct dentry_operations *d_op;
3007 
3008 	if (check_mnt(mnt))
3009 		return true;
3010 
3011 	d_op = path->dentry->d_op;
3012 	if (d_op == &ns_dentry_operations)
3013 		return true;
3014 
3015 	if (d_op == &pidfs_dentry_operations)
3016 		return true;
3017 
3018 	if (!is_mounted(path->mnt))
3019 		return false;
3020 
3021 	return check_anonymous_mnt(mnt);
3022 }
3023 
3024 
__do_loopback(struct path * old_path,int recurse)3025 static struct mount *__do_loopback(struct path *old_path, int recurse)
3026 {
3027 	struct mount *mnt = ERR_PTR(-EINVAL), *old = real_mount(old_path->mnt);
3028 
3029 	if (IS_MNT_UNBINDABLE(old))
3030 		return mnt;
3031 
3032 	if (!may_copy_tree(old_path))
3033 		return mnt;
3034 
3035 	if (!recurse && has_locked_children(old, old_path->dentry))
3036 		return mnt;
3037 
3038 	if (recurse)
3039 		mnt = copy_tree(old, old_path->dentry, CL_COPY_MNT_NS_FILE);
3040 	else
3041 		mnt = clone_mnt(old, old_path->dentry, 0);
3042 
3043 	if (!IS_ERR(mnt))
3044 		mnt->mnt.mnt_flags &= ~MNT_LOCKED;
3045 
3046 	return mnt;
3047 }
3048 
3049 /*
3050  * do loopback mount.
3051  */
do_loopback(struct path * path,const char * old_name,int recurse)3052 static int do_loopback(struct path *path, const char *old_name,
3053 				int recurse)
3054 {
3055 	struct path old_path;
3056 	struct mount *mnt = NULL, *parent;
3057 	struct mountpoint *mp;
3058 	int err;
3059 	if (!old_name || !*old_name)
3060 		return -EINVAL;
3061 	err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
3062 	if (err)
3063 		return err;
3064 
3065 	err = -EINVAL;
3066 	if (mnt_ns_loop(old_path.dentry))
3067 		goto out;
3068 
3069 	mp = lock_mount(path);
3070 	if (IS_ERR(mp)) {
3071 		err = PTR_ERR(mp);
3072 		goto out;
3073 	}
3074 
3075 	parent = real_mount(path->mnt);
3076 	if (!check_mnt(parent))
3077 		goto out2;
3078 
3079 	mnt = __do_loopback(&old_path, recurse);
3080 	if (IS_ERR(mnt)) {
3081 		err = PTR_ERR(mnt);
3082 		goto out2;
3083 	}
3084 
3085 	err = graft_tree(mnt, parent, mp);
3086 	if (err) {
3087 		lock_mount_hash();
3088 		umount_tree(mnt, UMOUNT_SYNC);
3089 		unlock_mount_hash();
3090 	}
3091 out2:
3092 	unlock_mount(mp);
3093 out:
3094 	path_put(&old_path);
3095 	return err;
3096 }
3097 
open_detached_copy(struct path * path,bool recursive)3098 static struct file *open_detached_copy(struct path *path, bool recursive)
3099 {
3100 	struct mnt_namespace *ns, *mnt_ns = current->nsproxy->mnt_ns, *src_mnt_ns;
3101 	struct user_namespace *user_ns = mnt_ns->user_ns;
3102 	struct mount *mnt, *p;
3103 	struct file *file;
3104 
3105 	ns = alloc_mnt_ns(user_ns, true);
3106 	if (IS_ERR(ns))
3107 		return ERR_CAST(ns);
3108 
3109 	namespace_lock();
3110 
3111 	/*
3112 	 * Record the sequence number of the source mount namespace.
3113 	 * This needs to hold namespace_sem to ensure that the mount
3114 	 * doesn't get attached.
3115 	 */
3116 	if (is_mounted(path->mnt)) {
3117 		src_mnt_ns = real_mount(path->mnt)->mnt_ns;
3118 		if (is_anon_ns(src_mnt_ns))
3119 			ns->seq_origin = src_mnt_ns->seq_origin;
3120 		else
3121 			ns->seq_origin = src_mnt_ns->seq;
3122 	}
3123 
3124 	mnt = __do_loopback(path, recursive);
3125 	if (IS_ERR(mnt)) {
3126 		namespace_unlock();
3127 		free_mnt_ns(ns);
3128 		return ERR_CAST(mnt);
3129 	}
3130 
3131 	lock_mount_hash();
3132 	for (p = mnt; p; p = next_mnt(p, mnt)) {
3133 		mnt_add_to_ns(ns, p);
3134 		ns->nr_mounts++;
3135 	}
3136 	ns->root = mnt;
3137 	mntget(&mnt->mnt);
3138 	unlock_mount_hash();
3139 	namespace_unlock();
3140 
3141 	mntput(path->mnt);
3142 	path->mnt = &mnt->mnt;
3143 	file = dentry_open(path, O_PATH, current_cred());
3144 	if (IS_ERR(file))
3145 		dissolve_on_fput(path->mnt);
3146 	else
3147 		file->f_mode |= FMODE_NEED_UNMOUNT;
3148 	return file;
3149 }
3150 
vfs_open_tree(int dfd,const char __user * filename,unsigned int flags)3151 static struct file *vfs_open_tree(int dfd, const char __user *filename, unsigned int flags)
3152 {
3153 	int ret;
3154 	struct path path __free(path_put) = {};
3155 	int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW;
3156 	bool detached = flags & OPEN_TREE_CLONE;
3157 
3158 	BUILD_BUG_ON(OPEN_TREE_CLOEXEC != O_CLOEXEC);
3159 
3160 	if (flags & ~(AT_EMPTY_PATH | AT_NO_AUTOMOUNT | AT_RECURSIVE |
3161 		      AT_SYMLINK_NOFOLLOW | OPEN_TREE_CLONE |
3162 		      OPEN_TREE_CLOEXEC))
3163 		return ERR_PTR(-EINVAL);
3164 
3165 	if ((flags & (AT_RECURSIVE | OPEN_TREE_CLONE)) == AT_RECURSIVE)
3166 		return ERR_PTR(-EINVAL);
3167 
3168 	if (flags & AT_NO_AUTOMOUNT)
3169 		lookup_flags &= ~LOOKUP_AUTOMOUNT;
3170 	if (flags & AT_SYMLINK_NOFOLLOW)
3171 		lookup_flags &= ~LOOKUP_FOLLOW;
3172 	if (flags & AT_EMPTY_PATH)
3173 		lookup_flags |= LOOKUP_EMPTY;
3174 
3175 	if (detached && !may_mount())
3176 		return ERR_PTR(-EPERM);
3177 
3178 	ret = user_path_at(dfd, filename, lookup_flags, &path);
3179 	if (unlikely(ret))
3180 		return ERR_PTR(ret);
3181 
3182 	if (detached)
3183 		return open_detached_copy(&path, flags & AT_RECURSIVE);
3184 
3185 	return dentry_open(&path, O_PATH, current_cred());
3186 }
3187 
SYSCALL_DEFINE3(open_tree,int,dfd,const char __user *,filename,unsigned,flags)3188 SYSCALL_DEFINE3(open_tree, int, dfd, const char __user *, filename, unsigned, flags)
3189 {
3190 	int fd;
3191 	struct file *file __free(fput) = NULL;
3192 
3193 	file = vfs_open_tree(dfd, filename, flags);
3194 	if (IS_ERR(file))
3195 		return PTR_ERR(file);
3196 
3197 	fd = get_unused_fd_flags(flags & O_CLOEXEC);
3198 	if (fd < 0)
3199 		return fd;
3200 
3201 	fd_install(fd, no_free_ptr(file));
3202 	return fd;
3203 }
3204 
3205 /*
3206  * Don't allow locked mount flags to be cleared.
3207  *
3208  * No locks need to be held here while testing the various MNT_LOCK
3209  * flags because those flags can never be cleared once they are set.
3210  */
can_change_locked_flags(struct mount * mnt,unsigned int mnt_flags)3211 static bool can_change_locked_flags(struct mount *mnt, unsigned int mnt_flags)
3212 {
3213 	unsigned int fl = mnt->mnt.mnt_flags;
3214 
3215 	if ((fl & MNT_LOCK_READONLY) &&
3216 	    !(mnt_flags & MNT_READONLY))
3217 		return false;
3218 
3219 	if ((fl & MNT_LOCK_NODEV) &&
3220 	    !(mnt_flags & MNT_NODEV))
3221 		return false;
3222 
3223 	if ((fl & MNT_LOCK_NOSUID) &&
3224 	    !(mnt_flags & MNT_NOSUID))
3225 		return false;
3226 
3227 	if ((fl & MNT_LOCK_NOEXEC) &&
3228 	    !(mnt_flags & MNT_NOEXEC))
3229 		return false;
3230 
3231 	if ((fl & MNT_LOCK_ATIME) &&
3232 	    ((fl & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK)))
3233 		return false;
3234 
3235 	return true;
3236 }
3237 
change_mount_ro_state(struct mount * mnt,unsigned int mnt_flags)3238 static int change_mount_ro_state(struct mount *mnt, unsigned int mnt_flags)
3239 {
3240 	bool readonly_request = (mnt_flags & MNT_READONLY);
3241 
3242 	if (readonly_request == __mnt_is_readonly(&mnt->mnt))
3243 		return 0;
3244 
3245 	if (readonly_request)
3246 		return mnt_make_readonly(mnt);
3247 
3248 	mnt->mnt.mnt_flags &= ~MNT_READONLY;
3249 	return 0;
3250 }
3251 
set_mount_attributes(struct mount * mnt,unsigned int mnt_flags)3252 static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags)
3253 {
3254 	mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK;
3255 	mnt->mnt.mnt_flags = mnt_flags;
3256 	touch_mnt_namespace(mnt->mnt_ns);
3257 }
3258 
mnt_warn_timestamp_expiry(struct path * mountpoint,struct vfsmount * mnt)3259 static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *mnt)
3260 {
3261 	struct super_block *sb = mnt->mnt_sb;
3262 
3263 	if (!__mnt_is_readonly(mnt) &&
3264 	   (!(sb->s_iflags & SB_I_TS_EXPIRY_WARNED)) &&
3265 	   (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
3266 		char *buf, *mntpath;
3267 
3268 		buf = (char *)__get_free_page(GFP_KERNEL);
3269 		if (buf)
3270 			mntpath = d_path(mountpoint, buf, PAGE_SIZE);
3271 		else
3272 			mntpath = ERR_PTR(-ENOMEM);
3273 		if (IS_ERR(mntpath))
3274 			mntpath = "(unknown)";
3275 
3276 		pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n",
3277 			sb->s_type->name,
3278 			is_mounted(mnt) ? "remounted" : "mounted",
3279 			mntpath, &sb->s_time_max,
3280 			(unsigned long long)sb->s_time_max);
3281 
3282 		sb->s_iflags |= SB_I_TS_EXPIRY_WARNED;
3283 		if (buf)
3284 			free_page((unsigned long)buf);
3285 	}
3286 }
3287 
3288 /*
3289  * Handle reconfiguration of the mountpoint only without alteration of the
3290  * superblock it refers to.  This is triggered by specifying MS_REMOUNT|MS_BIND
3291  * to mount(2).
3292  */
do_reconfigure_mnt(struct path * path,unsigned int mnt_flags)3293 static int do_reconfigure_mnt(struct path *path, unsigned int mnt_flags)
3294 {
3295 	struct super_block *sb = path->mnt->mnt_sb;
3296 	struct mount *mnt = real_mount(path->mnt);
3297 	int ret;
3298 
3299 	if (!check_mnt(mnt))
3300 		return -EINVAL;
3301 
3302 	if (!path_mounted(path))
3303 		return -EINVAL;
3304 
3305 	if (!can_change_locked_flags(mnt, mnt_flags))
3306 		return -EPERM;
3307 
3308 	/*
3309 	 * We're only checking whether the superblock is read-only not
3310 	 * changing it, so only take down_read(&sb->s_umount).
3311 	 */
3312 	down_read(&sb->s_umount);
3313 	lock_mount_hash();
3314 	ret = change_mount_ro_state(mnt, mnt_flags);
3315 	if (ret == 0)
3316 		set_mount_attributes(mnt, mnt_flags);
3317 	unlock_mount_hash();
3318 	up_read(&sb->s_umount);
3319 
3320 	mnt_warn_timestamp_expiry(path, &mnt->mnt);
3321 
3322 	return ret;
3323 }
3324 
3325 /*
3326  * change filesystem flags. dir should be a physical root of filesystem.
3327  * If you've mounted a non-root directory somewhere and want to do remount
3328  * on it - tough luck.
3329  */
do_remount(struct path * path,int ms_flags,int sb_flags,int mnt_flags,void * data)3330 static int do_remount(struct path *path, int ms_flags, int sb_flags,
3331 		      int mnt_flags, void *data)
3332 {
3333 	int err;
3334 	struct super_block *sb = path->mnt->mnt_sb;
3335 	struct mount *mnt = real_mount(path->mnt);
3336 	struct fs_context *fc;
3337 
3338 	if (!check_mnt(mnt))
3339 		return -EINVAL;
3340 
3341 	if (!path_mounted(path))
3342 		return -EINVAL;
3343 
3344 	if (!can_change_locked_flags(mnt, mnt_flags))
3345 		return -EPERM;
3346 
3347 	fc = fs_context_for_reconfigure(path->dentry, sb_flags, MS_RMT_MASK);
3348 	if (IS_ERR(fc))
3349 		return PTR_ERR(fc);
3350 
3351 	/*
3352 	 * Indicate to the filesystem that the remount request is coming
3353 	 * from the legacy mount system call.
3354 	 */
3355 	fc->oldapi = true;
3356 
3357 	err = parse_monolithic_mount_data(fc, data);
3358 	if (!err) {
3359 		down_write(&sb->s_umount);
3360 		err = -EPERM;
3361 		if (ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) {
3362 			err = reconfigure_super(fc);
3363 			if (!err) {
3364 				lock_mount_hash();
3365 				set_mount_attributes(mnt, mnt_flags);
3366 				unlock_mount_hash();
3367 			}
3368 		}
3369 		up_write(&sb->s_umount);
3370 	}
3371 
3372 	mnt_warn_timestamp_expiry(path, &mnt->mnt);
3373 
3374 	put_fs_context(fc);
3375 	return err;
3376 }
3377 
tree_contains_unbindable(struct mount * mnt)3378 static inline int tree_contains_unbindable(struct mount *mnt)
3379 {
3380 	struct mount *p;
3381 	for (p = mnt; p; p = next_mnt(p, mnt)) {
3382 		if (IS_MNT_UNBINDABLE(p))
3383 			return 1;
3384 	}
3385 	return 0;
3386 }
3387 
do_set_group(struct path * from_path,struct path * to_path)3388 static int do_set_group(struct path *from_path, struct path *to_path)
3389 {
3390 	struct mount *from, *to;
3391 	int err;
3392 
3393 	from = real_mount(from_path->mnt);
3394 	to = real_mount(to_path->mnt);
3395 
3396 	namespace_lock();
3397 
3398 	err = -EINVAL;
3399 	/* To and From must be mounted */
3400 	if (!is_mounted(&from->mnt))
3401 		goto out;
3402 	if (!is_mounted(&to->mnt))
3403 		goto out;
3404 
3405 	err = -EPERM;
3406 	/* We should be allowed to modify mount namespaces of both mounts */
3407 	if (!ns_capable(from->mnt_ns->user_ns, CAP_SYS_ADMIN))
3408 		goto out;
3409 	if (!ns_capable(to->mnt_ns->user_ns, CAP_SYS_ADMIN))
3410 		goto out;
3411 
3412 	err = -EINVAL;
3413 	/* To and From paths should be mount roots */
3414 	if (!path_mounted(from_path))
3415 		goto out;
3416 	if (!path_mounted(to_path))
3417 		goto out;
3418 
3419 	/* Setting sharing groups is only allowed across same superblock */
3420 	if (from->mnt.mnt_sb != to->mnt.mnt_sb)
3421 		goto out;
3422 
3423 	/* From mount root should be wider than To mount root */
3424 	if (!is_subdir(to->mnt.mnt_root, from->mnt.mnt_root))
3425 		goto out;
3426 
3427 	/* From mount should not have locked children in place of To's root */
3428 	if (has_locked_children(from, to->mnt.mnt_root))
3429 		goto out;
3430 
3431 	/* Setting sharing groups is only allowed on private mounts */
3432 	if (IS_MNT_SHARED(to) || IS_MNT_SLAVE(to))
3433 		goto out;
3434 
3435 	/* From should not be private */
3436 	if (!IS_MNT_SHARED(from) && !IS_MNT_SLAVE(from))
3437 		goto out;
3438 
3439 	if (IS_MNT_SLAVE(from)) {
3440 		struct mount *m = from->mnt_master;
3441 
3442 		list_add(&to->mnt_slave, &m->mnt_slave_list);
3443 		to->mnt_master = m;
3444 	}
3445 
3446 	if (IS_MNT_SHARED(from)) {
3447 		to->mnt_group_id = from->mnt_group_id;
3448 		list_add(&to->mnt_share, &from->mnt_share);
3449 		lock_mount_hash();
3450 		set_mnt_shared(to);
3451 		unlock_mount_hash();
3452 	}
3453 
3454 	err = 0;
3455 out:
3456 	namespace_unlock();
3457 	return err;
3458 }
3459 
3460 /**
3461  * path_overmounted - check if path is overmounted
3462  * @path: path to check
3463  *
3464  * Check if path is overmounted, i.e., if there's a mount on top of
3465  * @path->mnt with @path->dentry as mountpoint.
3466  *
3467  * Context: This function expects namespace_lock() to be held.
3468  * Return: If path is overmounted true is returned, false if not.
3469  */
path_overmounted(const struct path * path)3470 static inline bool path_overmounted(const struct path *path)
3471 {
3472 	rcu_read_lock();
3473 	if (unlikely(__lookup_mnt(path->mnt, path->dentry))) {
3474 		rcu_read_unlock();
3475 		return true;
3476 	}
3477 	rcu_read_unlock();
3478 	return false;
3479 }
3480 
3481 /**
3482  * can_move_mount_beneath - check that we can mount beneath the top mount
3483  * @from: mount to mount beneath
3484  * @to:   mount under which to mount
3485  * @mp:   mountpoint of @to
3486  *
3487  * - Make sure that @to->dentry is actually the root of a mount under
3488  *   which we can mount another mount.
3489  * - Make sure that nothing can be mounted beneath the caller's current
3490  *   root or the rootfs of the namespace.
3491  * - Make sure that the caller can unmount the topmost mount ensuring
3492  *   that the caller could reveal the underlying mountpoint.
3493  * - Ensure that nothing has been mounted on top of @from before we
3494  *   grabbed @namespace_sem to avoid creating pointless shadow mounts.
3495  * - Prevent mounting beneath a mount if the propagation relationship
3496  *   between the source mount, parent mount, and top mount would lead to
3497  *   nonsensical mount trees.
3498  *
3499  * Context: This function expects namespace_lock() to be held.
3500  * Return: On success 0, and on error a negative error code is returned.
3501  */
can_move_mount_beneath(const struct path * from,const struct path * to,const struct mountpoint * mp)3502 static int can_move_mount_beneath(const struct path *from,
3503 				  const struct path *to,
3504 				  const struct mountpoint *mp)
3505 {
3506 	struct mount *mnt_from = real_mount(from->mnt),
3507 		     *mnt_to = real_mount(to->mnt),
3508 		     *parent_mnt_to = mnt_to->mnt_parent;
3509 
3510 	if (!mnt_has_parent(mnt_to))
3511 		return -EINVAL;
3512 
3513 	if (!path_mounted(to))
3514 		return -EINVAL;
3515 
3516 	if (IS_MNT_LOCKED(mnt_to))
3517 		return -EINVAL;
3518 
3519 	/* Avoid creating shadow mounts during mount propagation. */
3520 	if (path_overmounted(from))
3521 		return -EINVAL;
3522 
3523 	/*
3524 	 * Mounting beneath the rootfs only makes sense when the
3525 	 * semantics of pivot_root(".", ".") are used.
3526 	 */
3527 	if (&mnt_to->mnt == current->fs->root.mnt)
3528 		return -EINVAL;
3529 	if (parent_mnt_to == current->nsproxy->mnt_ns->root)
3530 		return -EINVAL;
3531 
3532 	for (struct mount *p = mnt_from; mnt_has_parent(p); p = p->mnt_parent)
3533 		if (p == mnt_to)
3534 			return -EINVAL;
3535 
3536 	/*
3537 	 * If the parent mount propagates to the child mount this would
3538 	 * mean mounting @mnt_from on @mnt_to->mnt_parent and then
3539 	 * propagating a copy @c of @mnt_from on top of @mnt_to. This
3540 	 * defeats the whole purpose of mounting beneath another mount.
3541 	 */
3542 	if (propagation_would_overmount(parent_mnt_to, mnt_to, mp))
3543 		return -EINVAL;
3544 
3545 	/*
3546 	 * If @mnt_to->mnt_parent propagates to @mnt_from this would
3547 	 * mean propagating a copy @c of @mnt_from on top of @mnt_from.
3548 	 * Afterwards @mnt_from would be mounted on top of
3549 	 * @mnt_to->mnt_parent and @mnt_to would be unmounted from
3550 	 * @mnt->mnt_parent and remounted on @mnt_from. But since @c is
3551 	 * already mounted on @mnt_from, @mnt_to would ultimately be
3552 	 * remounted on top of @c. Afterwards, @mnt_from would be
3553 	 * covered by a copy @c of @mnt_from and @c would be covered by
3554 	 * @mnt_from itself. This defeats the whole purpose of mounting
3555 	 * @mnt_from beneath @mnt_to.
3556 	 */
3557 	if (propagation_would_overmount(parent_mnt_to, mnt_from, mp))
3558 		return -EINVAL;
3559 
3560 	return 0;
3561 }
3562 
3563 /* may_use_mount() - check if a mount tree can be used
3564  * @mnt: vfsmount to be used
3565  *
3566  * This helper checks if the caller may use the mount tree starting
3567  * from @path->mnt. The caller may use the mount tree under the
3568  * following circumstances:
3569  *
3570  * (1) The caller is located in the mount namespace of the mount tree.
3571  *     This also implies that the mount does not belong to an anonymous
3572  *     mount namespace.
3573  * (2) The caller is trying to use a mount tree that belongs to an
3574  *     anonymous mount namespace.
3575  *
3576  *     For that to be safe, this helper enforces that the origin mount
3577  *     namespace the anonymous mount namespace was created from is the
3578  *     same as the caller's mount namespace by comparing the sequence
3579  *     numbers.
3580  *
3581  *     The ownership of a non-anonymous mount namespace such as the
3582  *     caller's cannot change.
3583  *     => We know that the caller's mount namespace is stable.
3584  *
3585  *     If the origin sequence number of the anonymous mount namespace is
3586  *     the same as the sequence number of the caller's mount namespace.
3587  *     => The owning namespaces are the same.
3588  *
3589  *     ==> The earlier capability check on the owning namespace of the
3590  *         caller's mount namespace ensures that the caller has the
3591  *         ability to use the mount tree.
3592  *
3593  * Returns true if the mount tree can be used, false otherwise.
3594  */
may_use_mount(struct mount * mnt)3595 static inline bool may_use_mount(struct mount *mnt)
3596 {
3597 	if (check_mnt(mnt))
3598 		return true;
3599 
3600 	/*
3601 	 * Make sure that noone unmounted the target path or somehow
3602 	 * managed to get their hands on something purely kernel
3603 	 * internal.
3604 	 */
3605 	if (!is_mounted(&mnt->mnt))
3606 		return false;
3607 
3608 	return check_anonymous_mnt(mnt);
3609 }
3610 
do_move_mount(struct path * old_path,struct path * new_path,enum mnt_tree_flags_t flags)3611 static int do_move_mount(struct path *old_path,
3612 			 struct path *new_path, enum mnt_tree_flags_t flags)
3613 {
3614 	struct mnt_namespace *ns;
3615 	struct mount *p;
3616 	struct mount *old;
3617 	struct mount *parent;
3618 	struct mountpoint *mp, *old_mp;
3619 	int err;
3620 	bool attached, beneath = flags & MNT_TREE_BENEATH;
3621 
3622 	mp = do_lock_mount(new_path, beneath);
3623 	if (IS_ERR(mp))
3624 		return PTR_ERR(mp);
3625 
3626 	old = real_mount(old_path->mnt);
3627 	p = real_mount(new_path->mnt);
3628 	parent = old->mnt_parent;
3629 	attached = mnt_has_parent(old);
3630 	if (attached)
3631 		flags |= MNT_TREE_MOVE;
3632 	old_mp = old->mnt_mp;
3633 	ns = old->mnt_ns;
3634 
3635 	err = -EINVAL;
3636 	if (!may_use_mount(p))
3637 		goto out;
3638 
3639 	/* The thing moved must be mounted... */
3640 	if (!is_mounted(&old->mnt))
3641 		goto out;
3642 
3643 	/* ... and either ours or the root of anon namespace */
3644 	if (!(attached ? check_mnt(old) : is_anon_ns(ns)))
3645 		goto out;
3646 
3647 	if (is_anon_ns(ns)) {
3648 		/*
3649 		 * Ending up with two files referring to the root of the
3650 		 * same anonymous mount namespace would cause an error
3651 		 * as this would mean trying to move the same mount
3652 		 * twice into the mount tree which would be rejected
3653 		 * later. But be explicit about it right here.
3654 		 */
3655 		if ((is_anon_ns(p->mnt_ns) && ns == p->mnt_ns))
3656 			goto out;
3657 
3658 		/*
3659 		 * If this is an anonymous mount tree ensure that mount
3660 		 * propagation can detect mounts that were just
3661 		 * propagated to the target mount tree so we don't
3662 		 * propagate onto them.
3663 		 */
3664 		ns->mntns_flags |= MNTNS_PROPAGATING;
3665 	} else if (is_anon_ns(p->mnt_ns)) {
3666 		/*
3667 		 * Don't allow moving an attached mount tree to an
3668 		 * anonymous mount tree.
3669 		 */
3670 		goto out;
3671 	}
3672 
3673 	if (old->mnt.mnt_flags & MNT_LOCKED)
3674 		goto out;
3675 
3676 	if (!path_mounted(old_path))
3677 		goto out;
3678 
3679 	if (d_is_dir(new_path->dentry) !=
3680 	    d_is_dir(old_path->dentry))
3681 		goto out;
3682 	/*
3683 	 * Don't move a mount residing in a shared parent.
3684 	 */
3685 	if (attached && IS_MNT_SHARED(parent))
3686 		goto out;
3687 
3688 	if (beneath) {
3689 		err = can_move_mount_beneath(old_path, new_path, mp);
3690 		if (err)
3691 			goto out;
3692 
3693 		err = -EINVAL;
3694 		p = p->mnt_parent;
3695 		flags |= MNT_TREE_BENEATH;
3696 	}
3697 
3698 	/*
3699 	 * Don't move a mount tree containing unbindable mounts to a destination
3700 	 * mount which is shared.
3701 	 */
3702 	if (IS_MNT_SHARED(p) && tree_contains_unbindable(old))
3703 		goto out;
3704 	err = -ELOOP;
3705 	if (!check_for_nsfs_mounts(old))
3706 		goto out;
3707 	for (; mnt_has_parent(p); p = p->mnt_parent)
3708 		if (p == old)
3709 			goto out;
3710 
3711 	err = attach_recursive_mnt(old, real_mount(new_path->mnt), mp, flags);
3712 	if (err)
3713 		goto out;
3714 
3715 	if (is_anon_ns(ns))
3716 		ns->mntns_flags &= ~MNTNS_PROPAGATING;
3717 
3718 	/* if the mount is moved, it should no longer be expire
3719 	 * automatically */
3720 	list_del_init(&old->mnt_expire);
3721 	if (attached)
3722 		put_mountpoint(old_mp);
3723 out:
3724 	unlock_mount(mp);
3725 	if (!err) {
3726 		if (attached) {
3727 			mntput_no_expire(parent);
3728 		} else {
3729 			/* Make sure we notice when we leak mounts. */
3730 			VFS_WARN_ON_ONCE(!mnt_ns_empty(ns));
3731 			free_mnt_ns(ns);
3732 		}
3733 	}
3734 	return err;
3735 }
3736 
do_move_mount_old(struct path * path,const char * old_name)3737 static int do_move_mount_old(struct path *path, const char *old_name)
3738 {
3739 	struct path old_path;
3740 	int err;
3741 
3742 	if (!old_name || !*old_name)
3743 		return -EINVAL;
3744 
3745 	err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
3746 	if (err)
3747 		return err;
3748 
3749 	err = do_move_mount(&old_path, path, 0);
3750 	path_put(&old_path);
3751 	return err;
3752 }
3753 
3754 /*
3755  * add a mount into a namespace's mount tree
3756  */
do_add_mount(struct mount * newmnt,struct mountpoint * mp,const struct path * path,int mnt_flags)3757 static int do_add_mount(struct mount *newmnt, struct mountpoint *mp,
3758 			const struct path *path, int mnt_flags)
3759 {
3760 	struct mount *parent = real_mount(path->mnt);
3761 
3762 	mnt_flags &= ~MNT_INTERNAL_FLAGS;
3763 
3764 	if (unlikely(!check_mnt(parent))) {
3765 		/* that's acceptable only for automounts done in private ns */
3766 		if (!(mnt_flags & MNT_SHRINKABLE))
3767 			return -EINVAL;
3768 		/* ... and for those we'd better have mountpoint still alive */
3769 		if (!parent->mnt_ns)
3770 			return -EINVAL;
3771 	}
3772 
3773 	/* Refuse the same filesystem on the same mount point */
3774 	if (path->mnt->mnt_sb == newmnt->mnt.mnt_sb && path_mounted(path))
3775 		return -EBUSY;
3776 
3777 	if (d_is_symlink(newmnt->mnt.mnt_root))
3778 		return -EINVAL;
3779 
3780 	newmnt->mnt.mnt_flags = mnt_flags;
3781 	return graft_tree(newmnt, parent, mp);
3782 }
3783 
3784 static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags);
3785 
3786 /*
3787  * Create a new mount using a superblock configuration and request it
3788  * be added to the namespace tree.
3789  */
do_new_mount_fc(struct fs_context * fc,struct path * mountpoint,unsigned int mnt_flags)3790 static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint,
3791 			   unsigned int mnt_flags)
3792 {
3793 	struct vfsmount *mnt;
3794 	struct mountpoint *mp;
3795 	struct super_block *sb = fc->root->d_sb;
3796 	int error;
3797 
3798 	error = security_sb_kern_mount(sb);
3799 	if (!error && mount_too_revealing(sb, &mnt_flags))
3800 		error = -EPERM;
3801 
3802 	if (unlikely(error)) {
3803 		fc_drop_locked(fc);
3804 		return error;
3805 	}
3806 
3807 	up_write(&sb->s_umount);
3808 
3809 	mnt = vfs_create_mount(fc);
3810 	if (IS_ERR(mnt))
3811 		return PTR_ERR(mnt);
3812 
3813 	mnt_warn_timestamp_expiry(mountpoint, mnt);
3814 
3815 	mp = lock_mount(mountpoint);
3816 	if (IS_ERR(mp)) {
3817 		mntput(mnt);
3818 		return PTR_ERR(mp);
3819 	}
3820 	error = do_add_mount(real_mount(mnt), mp, mountpoint, mnt_flags);
3821 	unlock_mount(mp);
3822 	if (error < 0)
3823 		mntput(mnt);
3824 	return error;
3825 }
3826 
3827 /*
3828  * create a new mount for userspace and request it to be added into the
3829  * namespace's tree
3830  */
do_new_mount(struct path * path,const char * fstype,int sb_flags,int mnt_flags,const char * name,void * data)3831 static int do_new_mount(struct path *path, const char *fstype, int sb_flags,
3832 			int mnt_flags, const char *name, void *data)
3833 {
3834 	struct file_system_type *type;
3835 	struct fs_context *fc;
3836 	const char *subtype = NULL;
3837 	int err = 0;
3838 
3839 	if (!fstype)
3840 		return -EINVAL;
3841 
3842 	type = get_fs_type(fstype);
3843 	if (!type)
3844 		return -ENODEV;
3845 
3846 	if (type->fs_flags & FS_HAS_SUBTYPE) {
3847 		subtype = strchr(fstype, '.');
3848 		if (subtype) {
3849 			subtype++;
3850 			if (!*subtype) {
3851 				put_filesystem(type);
3852 				return -EINVAL;
3853 			}
3854 		}
3855 	}
3856 
3857 	fc = fs_context_for_mount(type, sb_flags);
3858 	put_filesystem(type);
3859 	if (IS_ERR(fc))
3860 		return PTR_ERR(fc);
3861 
3862 	/*
3863 	 * Indicate to the filesystem that the mount request is coming
3864 	 * from the legacy mount system call.
3865 	 */
3866 	fc->oldapi = true;
3867 
3868 	if (subtype)
3869 		err = vfs_parse_fs_string(fc, "subtype",
3870 					  subtype, strlen(subtype));
3871 	if (!err && name)
3872 		err = vfs_parse_fs_string(fc, "source", name, strlen(name));
3873 	if (!err)
3874 		err = parse_monolithic_mount_data(fc, data);
3875 	if (!err && !mount_capable(fc))
3876 		err = -EPERM;
3877 	if (!err)
3878 		err = vfs_get_tree(fc);
3879 	if (!err)
3880 		err = do_new_mount_fc(fc, path, mnt_flags);
3881 
3882 	put_fs_context(fc);
3883 	return err;
3884 }
3885 
finish_automount(struct vfsmount * m,const struct path * path)3886 int finish_automount(struct vfsmount *m, const struct path *path)
3887 {
3888 	struct dentry *dentry = path->dentry;
3889 	struct mountpoint *mp;
3890 	struct mount *mnt;
3891 	int err;
3892 
3893 	if (!m)
3894 		return 0;
3895 	if (IS_ERR(m))
3896 		return PTR_ERR(m);
3897 
3898 	mnt = real_mount(m);
3899 	/* The new mount record should have at least 2 refs to prevent it being
3900 	 * expired before we get a chance to add it
3901 	 */
3902 	BUG_ON(mnt_get_count(mnt) < 2);
3903 
3904 	if (m->mnt_sb == path->mnt->mnt_sb &&
3905 	    m->mnt_root == dentry) {
3906 		err = -ELOOP;
3907 		goto discard;
3908 	}
3909 
3910 	/*
3911 	 * we don't want to use lock_mount() - in this case finding something
3912 	 * that overmounts our mountpoint to be means "quitely drop what we've
3913 	 * got", not "try to mount it on top".
3914 	 */
3915 	inode_lock(dentry->d_inode);
3916 	namespace_lock();
3917 	if (unlikely(cant_mount(dentry))) {
3918 		err = -ENOENT;
3919 		goto discard_locked;
3920 	}
3921 	if (path_overmounted(path)) {
3922 		err = 0;
3923 		goto discard_locked;
3924 	}
3925 	mp = get_mountpoint(dentry);
3926 	if (IS_ERR(mp)) {
3927 		err = PTR_ERR(mp);
3928 		goto discard_locked;
3929 	}
3930 
3931 	err = do_add_mount(mnt, mp, path, path->mnt->mnt_flags | MNT_SHRINKABLE);
3932 	unlock_mount(mp);
3933 	if (unlikely(err))
3934 		goto discard;
3935 	mntput(m);
3936 	return 0;
3937 
3938 discard_locked:
3939 	namespace_unlock();
3940 	inode_unlock(dentry->d_inode);
3941 discard:
3942 	/* remove m from any expiration list it may be on */
3943 	if (!list_empty(&mnt->mnt_expire)) {
3944 		namespace_lock();
3945 		list_del_init(&mnt->mnt_expire);
3946 		namespace_unlock();
3947 	}
3948 	mntput(m);
3949 	mntput(m);
3950 	return err;
3951 }
3952 
3953 /**
3954  * mnt_set_expiry - Put a mount on an expiration list
3955  * @mnt: The mount to list.
3956  * @expiry_list: The list to add the mount to.
3957  */
mnt_set_expiry(struct vfsmount * mnt,struct list_head * expiry_list)3958 void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list)
3959 {
3960 	namespace_lock();
3961 
3962 	list_add_tail(&real_mount(mnt)->mnt_expire, expiry_list);
3963 
3964 	namespace_unlock();
3965 }
3966 EXPORT_SYMBOL(mnt_set_expiry);
3967 
3968 /*
3969  * process a list of expirable mountpoints with the intent of discarding any
3970  * mountpoints that aren't in use and haven't been touched since last we came
3971  * here
3972  */
mark_mounts_for_expiry(struct list_head * mounts)3973 void mark_mounts_for_expiry(struct list_head *mounts)
3974 {
3975 	struct mount *mnt, *next;
3976 	LIST_HEAD(graveyard);
3977 
3978 	if (list_empty(mounts))
3979 		return;
3980 
3981 	namespace_lock();
3982 	lock_mount_hash();
3983 
3984 	/* extract from the expiration list every vfsmount that matches the
3985 	 * following criteria:
3986 	 * - only referenced by its parent vfsmount
3987 	 * - still marked for expiry (marked on the last call here; marks are
3988 	 *   cleared by mntput())
3989 	 */
3990 	list_for_each_entry_safe(mnt, next, mounts, mnt_expire) {
3991 		if (!xchg(&mnt->mnt_expiry_mark, 1) ||
3992 			propagate_mount_busy(mnt, 1))
3993 			continue;
3994 		list_move(&mnt->mnt_expire, &graveyard);
3995 	}
3996 	while (!list_empty(&graveyard)) {
3997 		mnt = list_first_entry(&graveyard, struct mount, mnt_expire);
3998 		touch_mnt_namespace(mnt->mnt_ns);
3999 		umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
4000 	}
4001 	unlock_mount_hash();
4002 	namespace_unlock();
4003 }
4004 
4005 EXPORT_SYMBOL_GPL(mark_mounts_for_expiry);
4006 
4007 /*
4008  * Ripoff of 'select_parent()'
4009  *
4010  * search the list of submounts for a given mountpoint, and move any
4011  * shrinkable submounts to the 'graveyard' list.
4012  */
select_submounts(struct mount * parent,struct list_head * graveyard)4013 static int select_submounts(struct mount *parent, struct list_head *graveyard)
4014 {
4015 	struct mount *this_parent = parent;
4016 	struct list_head *next;
4017 	int found = 0;
4018 
4019 repeat:
4020 	next = this_parent->mnt_mounts.next;
4021 resume:
4022 	while (next != &this_parent->mnt_mounts) {
4023 		struct list_head *tmp = next;
4024 		struct mount *mnt = list_entry(tmp, struct mount, mnt_child);
4025 
4026 		next = tmp->next;
4027 		if (!(mnt->mnt.mnt_flags & MNT_SHRINKABLE))
4028 			continue;
4029 		/*
4030 		 * Descend a level if the d_mounts list is non-empty.
4031 		 */
4032 		if (!list_empty(&mnt->mnt_mounts)) {
4033 			this_parent = mnt;
4034 			goto repeat;
4035 		}
4036 
4037 		if (!propagate_mount_busy(mnt, 1)) {
4038 			list_move_tail(&mnt->mnt_expire, graveyard);
4039 			found++;
4040 		}
4041 	}
4042 	/*
4043 	 * All done at this level ... ascend and resume the search
4044 	 */
4045 	if (this_parent != parent) {
4046 		next = this_parent->mnt_child.next;
4047 		this_parent = this_parent->mnt_parent;
4048 		goto resume;
4049 	}
4050 	return found;
4051 }
4052 
4053 /*
4054  * process a list of expirable mountpoints with the intent of discarding any
4055  * submounts of a specific parent mountpoint
4056  *
4057  * mount_lock must be held for write
4058  */
shrink_submounts(struct mount * mnt)4059 static void shrink_submounts(struct mount *mnt)
4060 {
4061 	LIST_HEAD(graveyard);
4062 	struct mount *m;
4063 
4064 	/* extract submounts of 'mountpoint' from the expiration list */
4065 	while (select_submounts(mnt, &graveyard)) {
4066 		while (!list_empty(&graveyard)) {
4067 			m = list_first_entry(&graveyard, struct mount,
4068 						mnt_expire);
4069 			touch_mnt_namespace(m->mnt_ns);
4070 			umount_tree(m, UMOUNT_PROPAGATE|UMOUNT_SYNC);
4071 		}
4072 	}
4073 }
4074 
copy_mount_options(const void __user * data)4075 static void *copy_mount_options(const void __user * data)
4076 {
4077 	char *copy;
4078 	unsigned left, offset;
4079 
4080 	if (!data)
4081 		return NULL;
4082 
4083 	copy = kmalloc(PAGE_SIZE, GFP_KERNEL);
4084 	if (!copy)
4085 		return ERR_PTR(-ENOMEM);
4086 
4087 	left = copy_from_user(copy, data, PAGE_SIZE);
4088 
4089 	/*
4090 	 * Not all architectures have an exact copy_from_user(). Resort to
4091 	 * byte at a time.
4092 	 */
4093 	offset = PAGE_SIZE - left;
4094 	while (left) {
4095 		char c;
4096 		if (get_user(c, (const char __user *)data + offset))
4097 			break;
4098 		copy[offset] = c;
4099 		left--;
4100 		offset++;
4101 	}
4102 
4103 	if (left == PAGE_SIZE) {
4104 		kfree(copy);
4105 		return ERR_PTR(-EFAULT);
4106 	}
4107 
4108 	return copy;
4109 }
4110 
copy_mount_string(const void __user * data)4111 static char *copy_mount_string(const void __user *data)
4112 {
4113 	return data ? strndup_user(data, PATH_MAX) : NULL;
4114 }
4115 
4116 /*
4117  * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to
4118  * be given to the mount() call (ie: read-only, no-dev, no-suid etc).
4119  *
4120  * data is a (void *) that can point to any structure up to
4121  * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent
4122  * information (or be NULL).
4123  *
4124  * Pre-0.97 versions of mount() didn't have a flags word.
4125  * When the flags word was introduced its top half was required
4126  * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9.
4127  * Therefore, if this magic number is present, it carries no information
4128  * and must be discarded.
4129  */
path_mount(const char * dev_name,struct path * path,const char * type_page,unsigned long flags,void * data_page)4130 int path_mount(const char *dev_name, struct path *path,
4131 		const char *type_page, unsigned long flags, void *data_page)
4132 {
4133 	unsigned int mnt_flags = 0, sb_flags;
4134 	int ret;
4135 
4136 	/* Discard magic */
4137 	if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
4138 		flags &= ~MS_MGC_MSK;
4139 
4140 	/* Basic sanity checks */
4141 	if (data_page)
4142 		((char *)data_page)[PAGE_SIZE - 1] = 0;
4143 
4144 	if (flags & MS_NOUSER)
4145 		return -EINVAL;
4146 
4147 	ret = security_sb_mount(dev_name, path, type_page, flags, data_page);
4148 	if (ret)
4149 		return ret;
4150 	if (!may_mount())
4151 		return -EPERM;
4152 	if (flags & SB_MANDLOCK)
4153 		warn_mandlock();
4154 
4155 	/* Default to relatime unless overriden */
4156 	if (!(flags & MS_NOATIME))
4157 		mnt_flags |= MNT_RELATIME;
4158 
4159 	/* Separate the per-mountpoint flags */
4160 	if (flags & MS_NOSUID)
4161 		mnt_flags |= MNT_NOSUID;
4162 	if (flags & MS_NODEV)
4163 		mnt_flags |= MNT_NODEV;
4164 	if (flags & MS_NOEXEC)
4165 		mnt_flags |= MNT_NOEXEC;
4166 	if (flags & MS_NOATIME)
4167 		mnt_flags |= MNT_NOATIME;
4168 	if (flags & MS_NODIRATIME)
4169 		mnt_flags |= MNT_NODIRATIME;
4170 	if (flags & MS_STRICTATIME)
4171 		mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME);
4172 	if (flags & MS_RDONLY)
4173 		mnt_flags |= MNT_READONLY;
4174 	if (flags & MS_NOSYMFOLLOW)
4175 		mnt_flags |= MNT_NOSYMFOLLOW;
4176 
4177 	/* The default atime for remount is preservation */
4178 	if ((flags & MS_REMOUNT) &&
4179 	    ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME |
4180 		       MS_STRICTATIME)) == 0)) {
4181 		mnt_flags &= ~MNT_ATIME_MASK;
4182 		mnt_flags |= path->mnt->mnt_flags & MNT_ATIME_MASK;
4183 	}
4184 
4185 	sb_flags = flags & (SB_RDONLY |
4186 			    SB_SYNCHRONOUS |
4187 			    SB_MANDLOCK |
4188 			    SB_DIRSYNC |
4189 			    SB_SILENT |
4190 			    SB_POSIXACL |
4191 			    SB_LAZYTIME |
4192 			    SB_I_VERSION);
4193 
4194 	if ((flags & (MS_REMOUNT | MS_BIND)) == (MS_REMOUNT | MS_BIND))
4195 		return do_reconfigure_mnt(path, mnt_flags);
4196 	if (flags & MS_REMOUNT)
4197 		return do_remount(path, flags, sb_flags, mnt_flags, data_page);
4198 	if (flags & MS_BIND)
4199 		return do_loopback(path, dev_name, flags & MS_REC);
4200 	if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
4201 		return do_change_type(path, flags);
4202 	if (flags & MS_MOVE)
4203 		return do_move_mount_old(path, dev_name);
4204 
4205 	return do_new_mount(path, type_page, sb_flags, mnt_flags, dev_name,
4206 			    data_page);
4207 }
4208 
do_mount(const char * dev_name,const char __user * dir_name,const char * type_page,unsigned long flags,void * data_page)4209 int do_mount(const char *dev_name, const char __user *dir_name,
4210 		const char *type_page, unsigned long flags, void *data_page)
4211 {
4212 	struct path path;
4213 	int ret;
4214 
4215 	ret = user_path_at(AT_FDCWD, dir_name, LOOKUP_FOLLOW, &path);
4216 	if (ret)
4217 		return ret;
4218 	ret = path_mount(dev_name, &path, type_page, flags, data_page);
4219 	path_put(&path);
4220 	return ret;
4221 }
4222 
inc_mnt_namespaces(struct user_namespace * ns)4223 static struct ucounts *inc_mnt_namespaces(struct user_namespace *ns)
4224 {
4225 	return inc_ucount(ns, current_euid(), UCOUNT_MNT_NAMESPACES);
4226 }
4227 
dec_mnt_namespaces(struct ucounts * ucounts)4228 static void dec_mnt_namespaces(struct ucounts *ucounts)
4229 {
4230 	dec_ucount(ucounts, UCOUNT_MNT_NAMESPACES);
4231 }
4232 
free_mnt_ns(struct mnt_namespace * ns)4233 static void free_mnt_ns(struct mnt_namespace *ns)
4234 {
4235 	if (!is_anon_ns(ns))
4236 		ns_free_inum(&ns->ns);
4237 	dec_mnt_namespaces(ns->ucounts);
4238 	mnt_ns_tree_remove(ns);
4239 }
4240 
4241 /*
4242  * Assign a sequence number so we can detect when we attempt to bind
4243  * mount a reference to an older mount namespace into the current
4244  * mount namespace, preventing reference counting loops.  A 64bit
4245  * number incrementing at 10Ghz will take 12,427 years to wrap which
4246  * is effectively never, so we can ignore the possibility.
4247  */
4248 static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1);
4249 
alloc_mnt_ns(struct user_namespace * user_ns,bool anon)4250 static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns, bool anon)
4251 {
4252 	struct mnt_namespace *new_ns;
4253 	struct ucounts *ucounts;
4254 	int ret;
4255 
4256 	ucounts = inc_mnt_namespaces(user_ns);
4257 	if (!ucounts)
4258 		return ERR_PTR(-ENOSPC);
4259 
4260 	new_ns = kzalloc(sizeof(struct mnt_namespace), GFP_KERNEL_ACCOUNT);
4261 	if (!new_ns) {
4262 		dec_mnt_namespaces(ucounts);
4263 		return ERR_PTR(-ENOMEM);
4264 	}
4265 	if (!anon) {
4266 		ret = ns_alloc_inum(&new_ns->ns);
4267 		if (ret) {
4268 			kfree(new_ns);
4269 			dec_mnt_namespaces(ucounts);
4270 			return ERR_PTR(ret);
4271 		}
4272 	}
4273 	new_ns->ns.ops = &mntns_operations;
4274 	if (!anon)
4275 		new_ns->seq = atomic64_inc_return(&mnt_ns_seq);
4276 	refcount_set(&new_ns->ns.count, 1);
4277 	refcount_set(&new_ns->passive, 1);
4278 	new_ns->mounts = RB_ROOT;
4279 	INIT_LIST_HEAD(&new_ns->mnt_ns_list);
4280 	RB_CLEAR_NODE(&new_ns->mnt_ns_tree_node);
4281 	init_waitqueue_head(&new_ns->poll);
4282 	new_ns->user_ns = get_user_ns(user_ns);
4283 	new_ns->ucounts = ucounts;
4284 	return new_ns;
4285 }
4286 
4287 __latent_entropy
copy_mnt_ns(unsigned long flags,struct mnt_namespace * ns,struct user_namespace * user_ns,struct fs_struct * new_fs)4288 struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
4289 		struct user_namespace *user_ns, struct fs_struct *new_fs)
4290 {
4291 	struct mnt_namespace *new_ns;
4292 	struct vfsmount *rootmnt = NULL, *pwdmnt = NULL;
4293 	struct mount *p, *q;
4294 	struct mount *old;
4295 	struct mount *new;
4296 	int copy_flags;
4297 
4298 	BUG_ON(!ns);
4299 
4300 	if (likely(!(flags & CLONE_NEWNS))) {
4301 		get_mnt_ns(ns);
4302 		return ns;
4303 	}
4304 
4305 	old = ns->root;
4306 
4307 	new_ns = alloc_mnt_ns(user_ns, false);
4308 	if (IS_ERR(new_ns))
4309 		return new_ns;
4310 
4311 	namespace_lock();
4312 	/* First pass: copy the tree topology */
4313 	copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE;
4314 	if (user_ns != ns->user_ns)
4315 		copy_flags |= CL_SHARED_TO_SLAVE;
4316 	new = copy_tree(old, old->mnt.mnt_root, copy_flags);
4317 	if (IS_ERR(new)) {
4318 		namespace_unlock();
4319 		ns_free_inum(&new_ns->ns);
4320 		dec_mnt_namespaces(new_ns->ucounts);
4321 		mnt_ns_release(new_ns);
4322 		return ERR_CAST(new);
4323 	}
4324 	if (user_ns != ns->user_ns) {
4325 		lock_mount_hash();
4326 		lock_mnt_tree(new);
4327 		unlock_mount_hash();
4328 	}
4329 	new_ns->root = new;
4330 
4331 	/*
4332 	 * Second pass: switch the tsk->fs->* elements and mark new vfsmounts
4333 	 * as belonging to new namespace.  We have already acquired a private
4334 	 * fs_struct, so tsk->fs->lock is not needed.
4335 	 */
4336 	p = old;
4337 	q = new;
4338 	while (p) {
4339 		mnt_add_to_ns(new_ns, q);
4340 		new_ns->nr_mounts++;
4341 		if (new_fs) {
4342 			if (&p->mnt == new_fs->root.mnt) {
4343 				new_fs->root.mnt = mntget(&q->mnt);
4344 				rootmnt = &p->mnt;
4345 			}
4346 			if (&p->mnt == new_fs->pwd.mnt) {
4347 				new_fs->pwd.mnt = mntget(&q->mnt);
4348 				pwdmnt = &p->mnt;
4349 			}
4350 		}
4351 		p = next_mnt(p, old);
4352 		q = next_mnt(q, new);
4353 		if (!q)
4354 			break;
4355 		// an mntns binding we'd skipped?
4356 		while (p->mnt.mnt_root != q->mnt.mnt_root)
4357 			p = next_mnt(skip_mnt_tree(p), old);
4358 	}
4359 	namespace_unlock();
4360 
4361 	if (rootmnt)
4362 		mntput(rootmnt);
4363 	if (pwdmnt)
4364 		mntput(pwdmnt);
4365 
4366 	mnt_ns_tree_add(new_ns);
4367 	return new_ns;
4368 }
4369 
mount_subtree(struct vfsmount * m,const char * name)4370 struct dentry *mount_subtree(struct vfsmount *m, const char *name)
4371 {
4372 	struct mount *mnt = real_mount(m);
4373 	struct mnt_namespace *ns;
4374 	struct super_block *s;
4375 	struct path path;
4376 	int err;
4377 
4378 	ns = alloc_mnt_ns(&init_user_ns, true);
4379 	if (IS_ERR(ns)) {
4380 		mntput(m);
4381 		return ERR_CAST(ns);
4382 	}
4383 	ns->root = mnt;
4384 	ns->nr_mounts++;
4385 	mnt_add_to_ns(ns, mnt);
4386 
4387 	err = vfs_path_lookup(m->mnt_root, m,
4388 			name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
4389 
4390 	put_mnt_ns(ns);
4391 
4392 	if (err)
4393 		return ERR_PTR(err);
4394 
4395 	/* trade a vfsmount reference for active sb one */
4396 	s = path.mnt->mnt_sb;
4397 	atomic_inc(&s->s_active);
4398 	mntput(path.mnt);
4399 	/* lock the sucker */
4400 	down_write(&s->s_umount);
4401 	/* ... and return the root of (sub)tree on it */
4402 	return path.dentry;
4403 }
4404 EXPORT_SYMBOL(mount_subtree);
4405 
SYSCALL_DEFINE5(mount,char __user *,dev_name,char __user *,dir_name,char __user *,type,unsigned long,flags,void __user *,data)4406 SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
4407 		char __user *, type, unsigned long, flags, void __user *, data)
4408 {
4409 	int ret;
4410 	char *kernel_type;
4411 	char *kernel_dev;
4412 	void *options;
4413 
4414 	kernel_type = copy_mount_string(type);
4415 	ret = PTR_ERR(kernel_type);
4416 	if (IS_ERR(kernel_type))
4417 		goto out_type;
4418 
4419 	kernel_dev = copy_mount_string(dev_name);
4420 	ret = PTR_ERR(kernel_dev);
4421 	if (IS_ERR(kernel_dev))
4422 		goto out_dev;
4423 
4424 	options = copy_mount_options(data);
4425 	ret = PTR_ERR(options);
4426 	if (IS_ERR(options))
4427 		goto out_data;
4428 
4429 	ret = do_mount(kernel_dev, dir_name, kernel_type, flags, options);
4430 
4431 	kfree(options);
4432 out_data:
4433 	kfree(kernel_dev);
4434 out_dev:
4435 	kfree(kernel_type);
4436 out_type:
4437 	return ret;
4438 }
4439 
4440 #define FSMOUNT_VALID_FLAGS                                                    \
4441 	(MOUNT_ATTR_RDONLY | MOUNT_ATTR_NOSUID | MOUNT_ATTR_NODEV |            \
4442 	 MOUNT_ATTR_NOEXEC | MOUNT_ATTR__ATIME | MOUNT_ATTR_NODIRATIME |       \
4443 	 MOUNT_ATTR_NOSYMFOLLOW)
4444 
4445 #define MOUNT_SETATTR_VALID_FLAGS (FSMOUNT_VALID_FLAGS | MOUNT_ATTR_IDMAP)
4446 
4447 #define MOUNT_SETATTR_PROPAGATION_FLAGS \
4448 	(MS_UNBINDABLE | MS_PRIVATE | MS_SLAVE | MS_SHARED)
4449 
attr_flags_to_mnt_flags(u64 attr_flags)4450 static unsigned int attr_flags_to_mnt_flags(u64 attr_flags)
4451 {
4452 	unsigned int mnt_flags = 0;
4453 
4454 	if (attr_flags & MOUNT_ATTR_RDONLY)
4455 		mnt_flags |= MNT_READONLY;
4456 	if (attr_flags & MOUNT_ATTR_NOSUID)
4457 		mnt_flags |= MNT_NOSUID;
4458 	if (attr_flags & MOUNT_ATTR_NODEV)
4459 		mnt_flags |= MNT_NODEV;
4460 	if (attr_flags & MOUNT_ATTR_NOEXEC)
4461 		mnt_flags |= MNT_NOEXEC;
4462 	if (attr_flags & MOUNT_ATTR_NODIRATIME)
4463 		mnt_flags |= MNT_NODIRATIME;
4464 	if (attr_flags & MOUNT_ATTR_NOSYMFOLLOW)
4465 		mnt_flags |= MNT_NOSYMFOLLOW;
4466 
4467 	return mnt_flags;
4468 }
4469 
4470 /*
4471  * Create a kernel mount representation for a new, prepared superblock
4472  * (specified by fs_fd) and attach to an open_tree-like file descriptor.
4473  */
SYSCALL_DEFINE3(fsmount,int,fs_fd,unsigned int,flags,unsigned int,attr_flags)4474 SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
4475 		unsigned int, attr_flags)
4476 {
4477 	struct mnt_namespace *ns;
4478 	struct fs_context *fc;
4479 	struct file *file;
4480 	struct path newmount;
4481 	struct mount *mnt;
4482 	unsigned int mnt_flags = 0;
4483 	long ret;
4484 
4485 	if (!may_mount())
4486 		return -EPERM;
4487 
4488 	if ((flags & ~(FSMOUNT_CLOEXEC)) != 0)
4489 		return -EINVAL;
4490 
4491 	if (attr_flags & ~FSMOUNT_VALID_FLAGS)
4492 		return -EINVAL;
4493 
4494 	mnt_flags = attr_flags_to_mnt_flags(attr_flags);
4495 
4496 	switch (attr_flags & MOUNT_ATTR__ATIME) {
4497 	case MOUNT_ATTR_STRICTATIME:
4498 		break;
4499 	case MOUNT_ATTR_NOATIME:
4500 		mnt_flags |= MNT_NOATIME;
4501 		break;
4502 	case MOUNT_ATTR_RELATIME:
4503 		mnt_flags |= MNT_RELATIME;
4504 		break;
4505 	default:
4506 		return -EINVAL;
4507 	}
4508 
4509 	CLASS(fd, f)(fs_fd);
4510 	if (fd_empty(f))
4511 		return -EBADF;
4512 
4513 	if (fd_file(f)->f_op != &fscontext_fops)
4514 		return -EINVAL;
4515 
4516 	fc = fd_file(f)->private_data;
4517 
4518 	ret = mutex_lock_interruptible(&fc->uapi_mutex);
4519 	if (ret < 0)
4520 		return ret;
4521 
4522 	/* There must be a valid superblock or we can't mount it */
4523 	ret = -EINVAL;
4524 	if (!fc->root)
4525 		goto err_unlock;
4526 
4527 	ret = -EPERM;
4528 	if (mount_too_revealing(fc->root->d_sb, &mnt_flags)) {
4529 		pr_warn("VFS: Mount too revealing\n");
4530 		goto err_unlock;
4531 	}
4532 
4533 	ret = -EBUSY;
4534 	if (fc->phase != FS_CONTEXT_AWAITING_MOUNT)
4535 		goto err_unlock;
4536 
4537 	if (fc->sb_flags & SB_MANDLOCK)
4538 		warn_mandlock();
4539 
4540 	newmount.mnt = vfs_create_mount(fc);
4541 	if (IS_ERR(newmount.mnt)) {
4542 		ret = PTR_ERR(newmount.mnt);
4543 		goto err_unlock;
4544 	}
4545 	newmount.dentry = dget(fc->root);
4546 	newmount.mnt->mnt_flags = mnt_flags;
4547 
4548 	/* We've done the mount bit - now move the file context into more or
4549 	 * less the same state as if we'd done an fspick().  We don't want to
4550 	 * do any memory allocation or anything like that at this point as we
4551 	 * don't want to have to handle any errors incurred.
4552 	 */
4553 	vfs_clean_context(fc);
4554 
4555 	ns = alloc_mnt_ns(current->nsproxy->mnt_ns->user_ns, true);
4556 	if (IS_ERR(ns)) {
4557 		ret = PTR_ERR(ns);
4558 		goto err_path;
4559 	}
4560 	mnt = real_mount(newmount.mnt);
4561 	ns->root = mnt;
4562 	ns->nr_mounts = 1;
4563 	mnt_add_to_ns(ns, mnt);
4564 	mntget(newmount.mnt);
4565 
4566 	/* Attach to an apparent O_PATH fd with a note that we need to unmount
4567 	 * it, not just simply put it.
4568 	 */
4569 	file = dentry_open(&newmount, O_PATH, fc->cred);
4570 	if (IS_ERR(file)) {
4571 		dissolve_on_fput(newmount.mnt);
4572 		ret = PTR_ERR(file);
4573 		goto err_path;
4574 	}
4575 	file->f_mode |= FMODE_NEED_UNMOUNT;
4576 
4577 	ret = get_unused_fd_flags((flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0);
4578 	if (ret >= 0)
4579 		fd_install(ret, file);
4580 	else
4581 		fput(file);
4582 
4583 err_path:
4584 	path_put(&newmount);
4585 err_unlock:
4586 	mutex_unlock(&fc->uapi_mutex);
4587 	return ret;
4588 }
4589 
vfs_move_mount(struct path * from_path,struct path * to_path,enum mnt_tree_flags_t mflags)4590 static inline int vfs_move_mount(struct path *from_path, struct path *to_path,
4591 				 enum mnt_tree_flags_t mflags)
4592 {
4593 	int ret;
4594 
4595 	ret = security_move_mount(from_path, to_path);
4596 	if (ret)
4597 		return ret;
4598 
4599 	if (mflags & MNT_TREE_PROPAGATION)
4600 		return do_set_group(from_path, to_path);
4601 
4602 	return do_move_mount(from_path, to_path, mflags);
4603 }
4604 
4605 /*
4606  * Move a mount from one place to another.  In combination with
4607  * fsopen()/fsmount() this is used to install a new mount and in combination
4608  * with open_tree(OPEN_TREE_CLONE [| AT_RECURSIVE]) it can be used to copy
4609  * a mount subtree.
4610  *
4611  * Note the flags value is a combination of MOVE_MOUNT_* flags.
4612  */
SYSCALL_DEFINE5(move_mount,int,from_dfd,const char __user *,from_pathname,int,to_dfd,const char __user *,to_pathname,unsigned int,flags)4613 SYSCALL_DEFINE5(move_mount,
4614 		int, from_dfd, const char __user *, from_pathname,
4615 		int, to_dfd, const char __user *, to_pathname,
4616 		unsigned int, flags)
4617 {
4618 	struct path to_path __free(path_put) = {};
4619 	struct path from_path __free(path_put) = {};
4620 	struct filename *to_name __free(putname) = NULL;
4621 	struct filename *from_name __free(putname) = NULL;
4622 	unsigned int lflags, uflags;
4623 	enum mnt_tree_flags_t mflags = 0;
4624 	int ret = 0;
4625 
4626 	if (!may_mount())
4627 		return -EPERM;
4628 
4629 	if (flags & ~MOVE_MOUNT__MASK)
4630 		return -EINVAL;
4631 
4632 	if ((flags & (MOVE_MOUNT_BENEATH | MOVE_MOUNT_SET_GROUP)) ==
4633 	    (MOVE_MOUNT_BENEATH | MOVE_MOUNT_SET_GROUP))
4634 		return -EINVAL;
4635 
4636 	if (flags & MOVE_MOUNT_SET_GROUP)	mflags |= MNT_TREE_PROPAGATION;
4637 	if (flags & MOVE_MOUNT_BENEATH)		mflags |= MNT_TREE_BENEATH;
4638 
4639 	lflags = 0;
4640 	if (flags & MOVE_MOUNT_F_SYMLINKS)	lflags |= LOOKUP_FOLLOW;
4641 	if (flags & MOVE_MOUNT_F_AUTOMOUNTS)	lflags |= LOOKUP_AUTOMOUNT;
4642 	uflags = 0;
4643 	if (flags & MOVE_MOUNT_F_EMPTY_PATH)	uflags = AT_EMPTY_PATH;
4644 	from_name = getname_maybe_null(from_pathname, uflags);
4645 	if (IS_ERR(from_name))
4646 		return PTR_ERR(from_name);
4647 
4648 	lflags = 0;
4649 	if (flags & MOVE_MOUNT_T_SYMLINKS)	lflags |= LOOKUP_FOLLOW;
4650 	if (flags & MOVE_MOUNT_T_AUTOMOUNTS)	lflags |= LOOKUP_AUTOMOUNT;
4651 	uflags = 0;
4652 	if (flags & MOVE_MOUNT_T_EMPTY_PATH)	uflags = AT_EMPTY_PATH;
4653 	to_name = getname_maybe_null(to_pathname, uflags);
4654 	if (IS_ERR(to_name))
4655 		return PTR_ERR(to_name);
4656 
4657 	if (!to_name && to_dfd >= 0) {
4658 		CLASS(fd_raw, f_to)(to_dfd);
4659 		if (fd_empty(f_to))
4660 			return -EBADF;
4661 
4662 		to_path = fd_file(f_to)->f_path;
4663 		path_get(&to_path);
4664 	} else {
4665 		ret = filename_lookup(to_dfd, to_name, lflags, &to_path, NULL);
4666 		if (ret)
4667 			return ret;
4668 	}
4669 
4670 	if (!from_name && from_dfd >= 0) {
4671 		CLASS(fd_raw, f_from)(from_dfd);
4672 		if (fd_empty(f_from))
4673 			return -EBADF;
4674 
4675 		return vfs_move_mount(&fd_file(f_from)->f_path, &to_path, mflags);
4676 	}
4677 
4678 	ret = filename_lookup(from_dfd, from_name, lflags, &from_path, NULL);
4679 	if (ret)
4680 		return ret;
4681 
4682 	return vfs_move_mount(&from_path, &to_path, mflags);
4683 }
4684 
4685 /*
4686  * Return true if path is reachable from root
4687  *
4688  * namespace_sem or mount_lock is held
4689  */
is_path_reachable(struct mount * mnt,struct dentry * dentry,const struct path * root)4690 bool is_path_reachable(struct mount *mnt, struct dentry *dentry,
4691 			 const struct path *root)
4692 {
4693 	while (&mnt->mnt != root->mnt && mnt_has_parent(mnt)) {
4694 		dentry = mnt->mnt_mountpoint;
4695 		mnt = mnt->mnt_parent;
4696 	}
4697 	return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry);
4698 }
4699 
path_is_under(const struct path * path1,const struct path * path2)4700 bool path_is_under(const struct path *path1, const struct path *path2)
4701 {
4702 	bool res;
4703 	read_seqlock_excl(&mount_lock);
4704 	res = is_path_reachable(real_mount(path1->mnt), path1->dentry, path2);
4705 	read_sequnlock_excl(&mount_lock);
4706 	return res;
4707 }
4708 EXPORT_SYMBOL(path_is_under);
4709 
4710 /*
4711  * pivot_root Semantics:
4712  * Moves the root file system of the current process to the directory put_old,
4713  * makes new_root as the new root file system of the current process, and sets
4714  * root/cwd of all processes which had them on the current root to new_root.
4715  *
4716  * Restrictions:
4717  * The new_root and put_old must be directories, and  must not be on the
4718  * same file  system as the current process root. The put_old  must  be
4719  * underneath new_root,  i.e. adding a non-zero number of /.. to the string
4720  * pointed to by put_old must yield the same directory as new_root. No other
4721  * file system may be mounted on put_old. After all, new_root is a mountpoint.
4722  *
4723  * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem.
4724  * See Documentation/filesystems/ramfs-rootfs-initramfs.rst for alternatives
4725  * in this situation.
4726  *
4727  * Notes:
4728  *  - we don't move root/cwd if they are not at the root (reason: if something
4729  *    cared enough to change them, it's probably wrong to force them elsewhere)
4730  *  - it's okay to pick a root that isn't the root of a file system, e.g.
4731  *    /nfs/my_root where /nfs is the mount point. It must be a mountpoint,
4732  *    though, so you may need to say mount --bind /nfs/my_root /nfs/my_root
4733  *    first.
4734  */
SYSCALL_DEFINE2(pivot_root,const char __user *,new_root,const char __user *,put_old)4735 SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
4736 		const char __user *, put_old)
4737 {
4738 	struct path new, old, root;
4739 	struct mount *new_mnt, *root_mnt, *old_mnt, *root_parent, *ex_parent;
4740 	struct mountpoint *old_mp, *root_mp;
4741 	int error;
4742 
4743 	if (!may_mount())
4744 		return -EPERM;
4745 
4746 	error = user_path_at(AT_FDCWD, new_root,
4747 			     LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &new);
4748 	if (error)
4749 		goto out0;
4750 
4751 	error = user_path_at(AT_FDCWD, put_old,
4752 			     LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &old);
4753 	if (error)
4754 		goto out1;
4755 
4756 	error = security_sb_pivotroot(&old, &new);
4757 	if (error)
4758 		goto out2;
4759 
4760 	get_fs_root(current->fs, &root);
4761 	old_mp = lock_mount(&old);
4762 	error = PTR_ERR(old_mp);
4763 	if (IS_ERR(old_mp))
4764 		goto out3;
4765 
4766 	error = -EINVAL;
4767 	new_mnt = real_mount(new.mnt);
4768 	root_mnt = real_mount(root.mnt);
4769 	old_mnt = real_mount(old.mnt);
4770 	ex_parent = new_mnt->mnt_parent;
4771 	root_parent = root_mnt->mnt_parent;
4772 	if (IS_MNT_SHARED(old_mnt) ||
4773 		IS_MNT_SHARED(ex_parent) ||
4774 		IS_MNT_SHARED(root_parent))
4775 		goto out4;
4776 	if (!check_mnt(root_mnt) || !check_mnt(new_mnt))
4777 		goto out4;
4778 	if (new_mnt->mnt.mnt_flags & MNT_LOCKED)
4779 		goto out4;
4780 	error = -ENOENT;
4781 	if (d_unlinked(new.dentry))
4782 		goto out4;
4783 	error = -EBUSY;
4784 	if (new_mnt == root_mnt || old_mnt == root_mnt)
4785 		goto out4; /* loop, on the same file system  */
4786 	error = -EINVAL;
4787 	if (!path_mounted(&root))
4788 		goto out4; /* not a mountpoint */
4789 	if (!mnt_has_parent(root_mnt))
4790 		goto out4; /* not attached */
4791 	if (!path_mounted(&new))
4792 		goto out4; /* not a mountpoint */
4793 	if (!mnt_has_parent(new_mnt))
4794 		goto out4; /* not attached */
4795 	/* make sure we can reach put_old from new_root */
4796 	if (!is_path_reachable(old_mnt, old.dentry, &new))
4797 		goto out4;
4798 	/* make certain new is below the root */
4799 	if (!is_path_reachable(new_mnt, new.dentry, &root))
4800 		goto out4;
4801 	lock_mount_hash();
4802 	umount_mnt(new_mnt);
4803 	root_mp = unhash_mnt(root_mnt);  /* we'll need its mountpoint */
4804 	if (root_mnt->mnt.mnt_flags & MNT_LOCKED) {
4805 		new_mnt->mnt.mnt_flags |= MNT_LOCKED;
4806 		root_mnt->mnt.mnt_flags &= ~MNT_LOCKED;
4807 	}
4808 	/* mount old root on put_old */
4809 	attach_mnt(root_mnt, old_mnt, old_mp, false);
4810 	/* mount new_root on / */
4811 	attach_mnt(new_mnt, root_parent, root_mp, false);
4812 	mnt_add_count(root_parent, -1);
4813 	touch_mnt_namespace(current->nsproxy->mnt_ns);
4814 	/* A moved mount should not expire automatically */
4815 	list_del_init(&new_mnt->mnt_expire);
4816 	put_mountpoint(root_mp);
4817 	unlock_mount_hash();
4818 	mnt_notify_add(root_mnt);
4819 	mnt_notify_add(new_mnt);
4820 	chroot_fs_refs(&root, &new);
4821 	error = 0;
4822 out4:
4823 	unlock_mount(old_mp);
4824 	if (!error)
4825 		mntput_no_expire(ex_parent);
4826 out3:
4827 	path_put(&root);
4828 out2:
4829 	path_put(&old);
4830 out1:
4831 	path_put(&new);
4832 out0:
4833 	return error;
4834 }
4835 
recalc_flags(struct mount_kattr * kattr,struct mount * mnt)4836 static unsigned int recalc_flags(struct mount_kattr *kattr, struct mount *mnt)
4837 {
4838 	unsigned int flags = mnt->mnt.mnt_flags;
4839 
4840 	/*  flags to clear */
4841 	flags &= ~kattr->attr_clr;
4842 	/* flags to raise */
4843 	flags |= kattr->attr_set;
4844 
4845 	return flags;
4846 }
4847 
can_idmap_mount(const struct mount_kattr * kattr,struct mount * mnt)4848 static int can_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
4849 {
4850 	struct vfsmount *m = &mnt->mnt;
4851 	struct user_namespace *fs_userns = m->mnt_sb->s_user_ns;
4852 
4853 	if (!kattr->mnt_idmap)
4854 		return 0;
4855 
4856 	/*
4857 	 * Creating an idmapped mount with the filesystem wide idmapping
4858 	 * doesn't make sense so block that. We don't allow mushy semantics.
4859 	 */
4860 	if (kattr->mnt_userns == m->mnt_sb->s_user_ns)
4861 		return -EINVAL;
4862 
4863 	/*
4864 	 * We only allow an mount to change it's idmapping if it has
4865 	 * never been accessible to userspace.
4866 	 */
4867 	if (!(kattr->kflags & MOUNT_KATTR_IDMAP_REPLACE) && is_idmapped_mnt(m))
4868 		return -EPERM;
4869 
4870 	/* The underlying filesystem doesn't support idmapped mounts yet. */
4871 	if (!(m->mnt_sb->s_type->fs_flags & FS_ALLOW_IDMAP))
4872 		return -EINVAL;
4873 
4874 	/* The filesystem has turned off idmapped mounts. */
4875 	if (m->mnt_sb->s_iflags & SB_I_NOIDMAP)
4876 		return -EINVAL;
4877 
4878 	/* We're not controlling the superblock. */
4879 	if (!ns_capable(fs_userns, CAP_SYS_ADMIN))
4880 		return -EPERM;
4881 
4882 	/* Mount has already been visible in the filesystem hierarchy. */
4883 	if (!is_anon_ns(mnt->mnt_ns))
4884 		return -EINVAL;
4885 
4886 	return 0;
4887 }
4888 
4889 /**
4890  * mnt_allow_writers() - check whether the attribute change allows writers
4891  * @kattr: the new mount attributes
4892  * @mnt: the mount to which @kattr will be applied
4893  *
4894  * Check whether thew new mount attributes in @kattr allow concurrent writers.
4895  *
4896  * Return: true if writers need to be held, false if not
4897  */
mnt_allow_writers(const struct mount_kattr * kattr,const struct mount * mnt)4898 static inline bool mnt_allow_writers(const struct mount_kattr *kattr,
4899 				     const struct mount *mnt)
4900 {
4901 	return (!(kattr->attr_set & MNT_READONLY) ||
4902 		(mnt->mnt.mnt_flags & MNT_READONLY)) &&
4903 	       !kattr->mnt_idmap;
4904 }
4905 
mount_setattr_prepare(struct mount_kattr * kattr,struct mount * mnt)4906 static int mount_setattr_prepare(struct mount_kattr *kattr, struct mount *mnt)
4907 {
4908 	struct mount *m;
4909 	int err;
4910 
4911 	for (m = mnt; m; m = next_mnt(m, mnt)) {
4912 		if (!can_change_locked_flags(m, recalc_flags(kattr, m))) {
4913 			err = -EPERM;
4914 			break;
4915 		}
4916 
4917 		err = can_idmap_mount(kattr, m);
4918 		if (err)
4919 			break;
4920 
4921 		if (!mnt_allow_writers(kattr, m)) {
4922 			err = mnt_hold_writers(m);
4923 			if (err)
4924 				break;
4925 		}
4926 
4927 		if (!(kattr->kflags & MOUNT_KATTR_RECURSE))
4928 			return 0;
4929 	}
4930 
4931 	if (err) {
4932 		struct mount *p;
4933 
4934 		/*
4935 		 * If we had to call mnt_hold_writers() MNT_WRITE_HOLD will
4936 		 * be set in @mnt_flags. The loop unsets MNT_WRITE_HOLD for all
4937 		 * mounts and needs to take care to include the first mount.
4938 		 */
4939 		for (p = mnt; p; p = next_mnt(p, mnt)) {
4940 			/* If we had to hold writers unblock them. */
4941 			if (p->mnt.mnt_flags & MNT_WRITE_HOLD)
4942 				mnt_unhold_writers(p);
4943 
4944 			/*
4945 			 * We're done once the first mount we changed got
4946 			 * MNT_WRITE_HOLD unset.
4947 			 */
4948 			if (p == m)
4949 				break;
4950 		}
4951 	}
4952 	return err;
4953 }
4954 
do_idmap_mount(const struct mount_kattr * kattr,struct mount * mnt)4955 static void do_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
4956 {
4957 	struct mnt_idmap *old_idmap;
4958 
4959 	if (!kattr->mnt_idmap)
4960 		return;
4961 
4962 	old_idmap = mnt_idmap(&mnt->mnt);
4963 
4964 	/* Pairs with smp_load_acquire() in mnt_idmap(). */
4965 	smp_store_release(&mnt->mnt.mnt_idmap, mnt_idmap_get(kattr->mnt_idmap));
4966 	mnt_idmap_put(old_idmap);
4967 }
4968 
mount_setattr_commit(struct mount_kattr * kattr,struct mount * mnt)4969 static void mount_setattr_commit(struct mount_kattr *kattr, struct mount *mnt)
4970 {
4971 	struct mount *m;
4972 
4973 	for (m = mnt; m; m = next_mnt(m, mnt)) {
4974 		unsigned int flags;
4975 
4976 		do_idmap_mount(kattr, m);
4977 		flags = recalc_flags(kattr, m);
4978 		WRITE_ONCE(m->mnt.mnt_flags, flags);
4979 
4980 		/* If we had to hold writers unblock them. */
4981 		if (m->mnt.mnt_flags & MNT_WRITE_HOLD)
4982 			mnt_unhold_writers(m);
4983 
4984 		if (kattr->propagation)
4985 			change_mnt_propagation(m, kattr->propagation);
4986 		if (!(kattr->kflags & MOUNT_KATTR_RECURSE))
4987 			break;
4988 	}
4989 	touch_mnt_namespace(mnt->mnt_ns);
4990 }
4991 
do_mount_setattr(struct path * path,struct mount_kattr * kattr)4992 static int do_mount_setattr(struct path *path, struct mount_kattr *kattr)
4993 {
4994 	struct mount *mnt = real_mount(path->mnt);
4995 	int err = 0;
4996 
4997 	if (!path_mounted(path))
4998 		return -EINVAL;
4999 
5000 	if (kattr->mnt_userns) {
5001 		struct mnt_idmap *mnt_idmap;
5002 
5003 		mnt_idmap = alloc_mnt_idmap(kattr->mnt_userns);
5004 		if (IS_ERR(mnt_idmap))
5005 			return PTR_ERR(mnt_idmap);
5006 		kattr->mnt_idmap = mnt_idmap;
5007 	}
5008 
5009 	if (kattr->propagation) {
5010 		/*
5011 		 * Only take namespace_lock() if we're actually changing
5012 		 * propagation.
5013 		 */
5014 		namespace_lock();
5015 		if (kattr->propagation == MS_SHARED) {
5016 			err = invent_group_ids(mnt, kattr->kflags & MOUNT_KATTR_RECURSE);
5017 			if (err) {
5018 				namespace_unlock();
5019 				return err;
5020 			}
5021 		}
5022 	}
5023 
5024 	err = -EINVAL;
5025 	lock_mount_hash();
5026 
5027 	/* Ensure that this isn't anything purely vfs internal. */
5028 	if (!is_mounted(&mnt->mnt))
5029 		goto out;
5030 
5031 	/*
5032 	 * If this is an attached mount make sure it's located in the callers
5033 	 * mount namespace. If it's not don't let the caller interact with it.
5034 	 *
5035 	 * If this mount doesn't have a parent it's most often simply a
5036 	 * detached mount with an anonymous mount namespace. IOW, something
5037 	 * that's simply not attached yet. But there are apparently also users
5038 	 * that do change mount properties on the rootfs itself. That obviously
5039 	 * neither has a parent nor is it a detached mount so we cannot
5040 	 * unconditionally check for detached mounts.
5041 	 */
5042 	if ((mnt_has_parent(mnt) || !is_anon_ns(mnt->mnt_ns)) && !check_mnt(mnt))
5043 		goto out;
5044 
5045 	/*
5046 	 * First, we get the mount tree in a shape where we can change mount
5047 	 * properties without failure. If we succeeded to do so we commit all
5048 	 * changes and if we failed we clean up.
5049 	 */
5050 	err = mount_setattr_prepare(kattr, mnt);
5051 	if (!err)
5052 		mount_setattr_commit(kattr, mnt);
5053 
5054 out:
5055 	unlock_mount_hash();
5056 
5057 	if (kattr->propagation) {
5058 		if (err)
5059 			cleanup_group_ids(mnt, NULL);
5060 		namespace_unlock();
5061 	}
5062 
5063 	return err;
5064 }
5065 
build_mount_idmapped(const struct mount_attr * attr,size_t usize,struct mount_kattr * kattr)5066 static int build_mount_idmapped(const struct mount_attr *attr, size_t usize,
5067 				struct mount_kattr *kattr)
5068 {
5069 	struct ns_common *ns;
5070 	struct user_namespace *mnt_userns;
5071 
5072 	if (!((attr->attr_set | attr->attr_clr) & MOUNT_ATTR_IDMAP))
5073 		return 0;
5074 
5075 	if (attr->attr_clr & MOUNT_ATTR_IDMAP) {
5076 		/*
5077 		 * We can only remove an idmapping if it's never been
5078 		 * exposed to userspace.
5079 		 */
5080 		if (!(kattr->kflags & MOUNT_KATTR_IDMAP_REPLACE))
5081 			return -EINVAL;
5082 
5083 		/*
5084 		 * Removal of idmappings is equivalent to setting
5085 		 * nop_mnt_idmap.
5086 		 */
5087 		if (!(attr->attr_set & MOUNT_ATTR_IDMAP)) {
5088 			kattr->mnt_idmap = &nop_mnt_idmap;
5089 			return 0;
5090 		}
5091 	}
5092 
5093 	if (attr->userns_fd > INT_MAX)
5094 		return -EINVAL;
5095 
5096 	CLASS(fd, f)(attr->userns_fd);
5097 	if (fd_empty(f))
5098 		return -EBADF;
5099 
5100 	if (!proc_ns_file(fd_file(f)))
5101 		return -EINVAL;
5102 
5103 	ns = get_proc_ns(file_inode(fd_file(f)));
5104 	if (ns->ops->type != CLONE_NEWUSER)
5105 		return -EINVAL;
5106 
5107 	/*
5108 	 * The initial idmapping cannot be used to create an idmapped
5109 	 * mount. We use the initial idmapping as an indicator of a mount
5110 	 * that is not idmapped. It can simply be passed into helpers that
5111 	 * are aware of idmapped mounts as a convenient shortcut. A user
5112 	 * can just create a dedicated identity mapping to achieve the same
5113 	 * result.
5114 	 */
5115 	mnt_userns = container_of(ns, struct user_namespace, ns);
5116 	if (mnt_userns == &init_user_ns)
5117 		return -EPERM;
5118 
5119 	/* We're not controlling the target namespace. */
5120 	if (!ns_capable(mnt_userns, CAP_SYS_ADMIN))
5121 		return -EPERM;
5122 
5123 	kattr->mnt_userns = get_user_ns(mnt_userns);
5124 	return 0;
5125 }
5126 
build_mount_kattr(const struct mount_attr * attr,size_t usize,struct mount_kattr * kattr)5127 static int build_mount_kattr(const struct mount_attr *attr, size_t usize,
5128 			     struct mount_kattr *kattr)
5129 {
5130 	if (attr->propagation & ~MOUNT_SETATTR_PROPAGATION_FLAGS)
5131 		return -EINVAL;
5132 	if (hweight32(attr->propagation & MOUNT_SETATTR_PROPAGATION_FLAGS) > 1)
5133 		return -EINVAL;
5134 	kattr->propagation = attr->propagation;
5135 
5136 	if ((attr->attr_set | attr->attr_clr) & ~MOUNT_SETATTR_VALID_FLAGS)
5137 		return -EINVAL;
5138 
5139 	kattr->attr_set = attr_flags_to_mnt_flags(attr->attr_set);
5140 	kattr->attr_clr = attr_flags_to_mnt_flags(attr->attr_clr);
5141 
5142 	/*
5143 	 * Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap,
5144 	 * users wanting to transition to a different atime setting cannot
5145 	 * simply specify the atime setting in @attr_set, but must also
5146 	 * specify MOUNT_ATTR__ATIME in the @attr_clr field.
5147 	 * So ensure that MOUNT_ATTR__ATIME can't be partially set in
5148 	 * @attr_clr and that @attr_set can't have any atime bits set if
5149 	 * MOUNT_ATTR__ATIME isn't set in @attr_clr.
5150 	 */
5151 	if (attr->attr_clr & MOUNT_ATTR__ATIME) {
5152 		if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME)
5153 			return -EINVAL;
5154 
5155 		/*
5156 		 * Clear all previous time settings as they are mutually
5157 		 * exclusive.
5158 		 */
5159 		kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME;
5160 		switch (attr->attr_set & MOUNT_ATTR__ATIME) {
5161 		case MOUNT_ATTR_RELATIME:
5162 			kattr->attr_set |= MNT_RELATIME;
5163 			break;
5164 		case MOUNT_ATTR_NOATIME:
5165 			kattr->attr_set |= MNT_NOATIME;
5166 			break;
5167 		case MOUNT_ATTR_STRICTATIME:
5168 			break;
5169 		default:
5170 			return -EINVAL;
5171 		}
5172 	} else {
5173 		if (attr->attr_set & MOUNT_ATTR__ATIME)
5174 			return -EINVAL;
5175 	}
5176 
5177 	return build_mount_idmapped(attr, usize, kattr);
5178 }
5179 
finish_mount_kattr(struct mount_kattr * kattr)5180 static void finish_mount_kattr(struct mount_kattr *kattr)
5181 {
5182 	if (kattr->mnt_userns) {
5183 		put_user_ns(kattr->mnt_userns);
5184 		kattr->mnt_userns = NULL;
5185 	}
5186 
5187 	if (kattr->mnt_idmap)
5188 		mnt_idmap_put(kattr->mnt_idmap);
5189 }
5190 
copy_mount_setattr(struct mount_attr __user * uattr,size_t usize,struct mount_kattr * kattr)5191 static int copy_mount_setattr(struct mount_attr __user *uattr, size_t usize,
5192 			      struct mount_kattr *kattr)
5193 {
5194 	int ret;
5195 	struct mount_attr attr;
5196 
5197 	BUILD_BUG_ON(sizeof(struct mount_attr) != MOUNT_ATTR_SIZE_VER0);
5198 
5199 	if (unlikely(usize > PAGE_SIZE))
5200 		return -E2BIG;
5201 	if (unlikely(usize < MOUNT_ATTR_SIZE_VER0))
5202 		return -EINVAL;
5203 
5204 	if (!may_mount())
5205 		return -EPERM;
5206 
5207 	ret = copy_struct_from_user(&attr, sizeof(attr), uattr, usize);
5208 	if (ret)
5209 		return ret;
5210 
5211 	/* Don't bother walking through the mounts if this is a nop. */
5212 	if (attr.attr_set == 0 &&
5213 	    attr.attr_clr == 0 &&
5214 	    attr.propagation == 0)
5215 		return 0;
5216 
5217 	return build_mount_kattr(&attr, usize, kattr);
5218 }
5219 
SYSCALL_DEFINE5(mount_setattr,int,dfd,const char __user *,path,unsigned int,flags,struct mount_attr __user *,uattr,size_t,usize)5220 SYSCALL_DEFINE5(mount_setattr, int, dfd, const char __user *, path,
5221 		unsigned int, flags, struct mount_attr __user *, uattr,
5222 		size_t, usize)
5223 {
5224 	int err;
5225 	struct path target;
5226 	struct mount_kattr kattr;
5227 	unsigned int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW;
5228 
5229 	if (flags & ~(AT_EMPTY_PATH |
5230 		      AT_RECURSIVE |
5231 		      AT_SYMLINK_NOFOLLOW |
5232 		      AT_NO_AUTOMOUNT))
5233 		return -EINVAL;
5234 
5235 	if (flags & AT_NO_AUTOMOUNT)
5236 		lookup_flags &= ~LOOKUP_AUTOMOUNT;
5237 	if (flags & AT_SYMLINK_NOFOLLOW)
5238 		lookup_flags &= ~LOOKUP_FOLLOW;
5239 	if (flags & AT_EMPTY_PATH)
5240 		lookup_flags |= LOOKUP_EMPTY;
5241 
5242 	kattr = (struct mount_kattr) {
5243 		.lookup_flags	= lookup_flags,
5244 	};
5245 
5246 	if (flags & AT_RECURSIVE)
5247 		kattr.kflags |= MOUNT_KATTR_RECURSE;
5248 
5249 	err = copy_mount_setattr(uattr, usize, &kattr);
5250 	if (err)
5251 		return err;
5252 
5253 	err = user_path_at(dfd, path, kattr.lookup_flags, &target);
5254 	if (!err) {
5255 		err = do_mount_setattr(&target, &kattr);
5256 		path_put(&target);
5257 	}
5258 	finish_mount_kattr(&kattr);
5259 	return err;
5260 }
5261 
SYSCALL_DEFINE5(open_tree_attr,int,dfd,const char __user *,filename,unsigned,flags,struct mount_attr __user *,uattr,size_t,usize)5262 SYSCALL_DEFINE5(open_tree_attr, int, dfd, const char __user *, filename,
5263 		unsigned, flags, struct mount_attr __user *, uattr,
5264 		size_t, usize)
5265 {
5266 	struct file __free(fput) *file = NULL;
5267 	int fd;
5268 
5269 	if (!uattr && usize)
5270 		return -EINVAL;
5271 
5272 	file = vfs_open_tree(dfd, filename, flags);
5273 	if (IS_ERR(file))
5274 		return PTR_ERR(file);
5275 
5276 	if (uattr) {
5277 		int ret;
5278 		struct mount_kattr kattr = {};
5279 
5280 		kattr.kflags = MOUNT_KATTR_IDMAP_REPLACE;
5281 		if (flags & AT_RECURSIVE)
5282 			kattr.kflags |= MOUNT_KATTR_RECURSE;
5283 
5284 		ret = copy_mount_setattr(uattr, usize, &kattr);
5285 		if (ret)
5286 			return ret;
5287 
5288 		ret = do_mount_setattr(&file->f_path, &kattr);
5289 		if (ret)
5290 			return ret;
5291 
5292 		finish_mount_kattr(&kattr);
5293 	}
5294 
5295 	fd = get_unused_fd_flags(flags & O_CLOEXEC);
5296 	if (fd < 0)
5297 		return fd;
5298 
5299 	fd_install(fd, no_free_ptr(file));
5300 	return fd;
5301 }
5302 
show_path(struct seq_file * m,struct dentry * root)5303 int show_path(struct seq_file *m, struct dentry *root)
5304 {
5305 	if (root->d_sb->s_op->show_path)
5306 		return root->d_sb->s_op->show_path(m, root);
5307 
5308 	seq_dentry(m, root, " \t\n\\");
5309 	return 0;
5310 }
5311 
lookup_mnt_in_ns(u64 id,struct mnt_namespace * ns)5312 static struct vfsmount *lookup_mnt_in_ns(u64 id, struct mnt_namespace *ns)
5313 {
5314 	struct mount *mnt = mnt_find_id_at(ns, id);
5315 
5316 	if (!mnt || mnt->mnt_id_unique != id)
5317 		return NULL;
5318 
5319 	return &mnt->mnt;
5320 }
5321 
5322 struct kstatmount {
5323 	struct statmount __user *buf;
5324 	size_t bufsize;
5325 	struct vfsmount *mnt;
5326 	struct mnt_idmap *idmap;
5327 	u64 mask;
5328 	struct path root;
5329 	struct statmount sm;
5330 	struct seq_file seq;
5331 };
5332 
mnt_to_attr_flags(struct vfsmount * mnt)5333 static u64 mnt_to_attr_flags(struct vfsmount *mnt)
5334 {
5335 	unsigned int mnt_flags = READ_ONCE(mnt->mnt_flags);
5336 	u64 attr_flags = 0;
5337 
5338 	if (mnt_flags & MNT_READONLY)
5339 		attr_flags |= MOUNT_ATTR_RDONLY;
5340 	if (mnt_flags & MNT_NOSUID)
5341 		attr_flags |= MOUNT_ATTR_NOSUID;
5342 	if (mnt_flags & MNT_NODEV)
5343 		attr_flags |= MOUNT_ATTR_NODEV;
5344 	if (mnt_flags & MNT_NOEXEC)
5345 		attr_flags |= MOUNT_ATTR_NOEXEC;
5346 	if (mnt_flags & MNT_NODIRATIME)
5347 		attr_flags |= MOUNT_ATTR_NODIRATIME;
5348 	if (mnt_flags & MNT_NOSYMFOLLOW)
5349 		attr_flags |= MOUNT_ATTR_NOSYMFOLLOW;
5350 
5351 	if (mnt_flags & MNT_NOATIME)
5352 		attr_flags |= MOUNT_ATTR_NOATIME;
5353 	else if (mnt_flags & MNT_RELATIME)
5354 		attr_flags |= MOUNT_ATTR_RELATIME;
5355 	else
5356 		attr_flags |= MOUNT_ATTR_STRICTATIME;
5357 
5358 	if (is_idmapped_mnt(mnt))
5359 		attr_flags |= MOUNT_ATTR_IDMAP;
5360 
5361 	return attr_flags;
5362 }
5363 
mnt_to_propagation_flags(struct mount * m)5364 static u64 mnt_to_propagation_flags(struct mount *m)
5365 {
5366 	u64 propagation = 0;
5367 
5368 	if (IS_MNT_SHARED(m))
5369 		propagation |= MS_SHARED;
5370 	if (IS_MNT_SLAVE(m))
5371 		propagation |= MS_SLAVE;
5372 	if (IS_MNT_UNBINDABLE(m))
5373 		propagation |= MS_UNBINDABLE;
5374 	if (!propagation)
5375 		propagation |= MS_PRIVATE;
5376 
5377 	return propagation;
5378 }
5379 
statmount_sb_basic(struct kstatmount * s)5380 static void statmount_sb_basic(struct kstatmount *s)
5381 {
5382 	struct super_block *sb = s->mnt->mnt_sb;
5383 
5384 	s->sm.mask |= STATMOUNT_SB_BASIC;
5385 	s->sm.sb_dev_major = MAJOR(sb->s_dev);
5386 	s->sm.sb_dev_minor = MINOR(sb->s_dev);
5387 	s->sm.sb_magic = sb->s_magic;
5388 	s->sm.sb_flags = sb->s_flags & (SB_RDONLY|SB_SYNCHRONOUS|SB_DIRSYNC|SB_LAZYTIME);
5389 }
5390 
statmount_mnt_basic(struct kstatmount * s)5391 static void statmount_mnt_basic(struct kstatmount *s)
5392 {
5393 	struct mount *m = real_mount(s->mnt);
5394 
5395 	s->sm.mask |= STATMOUNT_MNT_BASIC;
5396 	s->sm.mnt_id = m->mnt_id_unique;
5397 	s->sm.mnt_parent_id = m->mnt_parent->mnt_id_unique;
5398 	s->sm.mnt_id_old = m->mnt_id;
5399 	s->sm.mnt_parent_id_old = m->mnt_parent->mnt_id;
5400 	s->sm.mnt_attr = mnt_to_attr_flags(&m->mnt);
5401 	s->sm.mnt_propagation = mnt_to_propagation_flags(m);
5402 	s->sm.mnt_peer_group = IS_MNT_SHARED(m) ? m->mnt_group_id : 0;
5403 	s->sm.mnt_master = IS_MNT_SLAVE(m) ? m->mnt_master->mnt_group_id : 0;
5404 }
5405 
statmount_propagate_from(struct kstatmount * s)5406 static void statmount_propagate_from(struct kstatmount *s)
5407 {
5408 	struct mount *m = real_mount(s->mnt);
5409 
5410 	s->sm.mask |= STATMOUNT_PROPAGATE_FROM;
5411 	if (IS_MNT_SLAVE(m))
5412 		s->sm.propagate_from = get_dominating_id(m, &current->fs->root);
5413 }
5414 
statmount_mnt_root(struct kstatmount * s,struct seq_file * seq)5415 static int statmount_mnt_root(struct kstatmount *s, struct seq_file *seq)
5416 {
5417 	int ret;
5418 	size_t start = seq->count;
5419 
5420 	ret = show_path(seq, s->mnt->mnt_root);
5421 	if (ret)
5422 		return ret;
5423 
5424 	if (unlikely(seq_has_overflowed(seq)))
5425 		return -EAGAIN;
5426 
5427 	/*
5428          * Unescape the result. It would be better if supplied string was not
5429          * escaped in the first place, but that's a pretty invasive change.
5430          */
5431 	seq->buf[seq->count] = '\0';
5432 	seq->count = start;
5433 	seq_commit(seq, string_unescape_inplace(seq->buf + start, UNESCAPE_OCTAL));
5434 	return 0;
5435 }
5436 
statmount_mnt_point(struct kstatmount * s,struct seq_file * seq)5437 static int statmount_mnt_point(struct kstatmount *s, struct seq_file *seq)
5438 {
5439 	struct vfsmount *mnt = s->mnt;
5440 	struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
5441 	int err;
5442 
5443 	err = seq_path_root(seq, &mnt_path, &s->root, "");
5444 	return err == SEQ_SKIP ? 0 : err;
5445 }
5446 
statmount_fs_type(struct kstatmount * s,struct seq_file * seq)5447 static int statmount_fs_type(struct kstatmount *s, struct seq_file *seq)
5448 {
5449 	struct super_block *sb = s->mnt->mnt_sb;
5450 
5451 	seq_puts(seq, sb->s_type->name);
5452 	return 0;
5453 }
5454 
statmount_fs_subtype(struct kstatmount * s,struct seq_file * seq)5455 static void statmount_fs_subtype(struct kstatmount *s, struct seq_file *seq)
5456 {
5457 	struct super_block *sb = s->mnt->mnt_sb;
5458 
5459 	if (sb->s_subtype)
5460 		seq_puts(seq, sb->s_subtype);
5461 }
5462 
statmount_sb_source(struct kstatmount * s,struct seq_file * seq)5463 static int statmount_sb_source(struct kstatmount *s, struct seq_file *seq)
5464 {
5465 	struct super_block *sb = s->mnt->mnt_sb;
5466 	struct mount *r = real_mount(s->mnt);
5467 
5468 	if (sb->s_op->show_devname) {
5469 		size_t start = seq->count;
5470 		int ret;
5471 
5472 		ret = sb->s_op->show_devname(seq, s->mnt->mnt_root);
5473 		if (ret)
5474 			return ret;
5475 
5476 		if (unlikely(seq_has_overflowed(seq)))
5477 			return -EAGAIN;
5478 
5479 		/* Unescape the result */
5480 		seq->buf[seq->count] = '\0';
5481 		seq->count = start;
5482 		seq_commit(seq, string_unescape_inplace(seq->buf + start, UNESCAPE_OCTAL));
5483 	} else if (r->mnt_devname) {
5484 		seq_puts(seq, r->mnt_devname);
5485 	}
5486 	return 0;
5487 }
5488 
statmount_mnt_ns_id(struct kstatmount * s,struct mnt_namespace * ns)5489 static void statmount_mnt_ns_id(struct kstatmount *s, struct mnt_namespace *ns)
5490 {
5491 	s->sm.mask |= STATMOUNT_MNT_NS_ID;
5492 	s->sm.mnt_ns_id = ns->seq;
5493 }
5494 
statmount_mnt_opts(struct kstatmount * s,struct seq_file * seq)5495 static int statmount_mnt_opts(struct kstatmount *s, struct seq_file *seq)
5496 {
5497 	struct vfsmount *mnt = s->mnt;
5498 	struct super_block *sb = mnt->mnt_sb;
5499 	size_t start = seq->count;
5500 	int err;
5501 
5502 	err = security_sb_show_options(seq, sb);
5503 	if (err)
5504 		return err;
5505 
5506 	if (sb->s_op->show_options) {
5507 		err = sb->s_op->show_options(seq, mnt->mnt_root);
5508 		if (err)
5509 			return err;
5510 	}
5511 
5512 	if (unlikely(seq_has_overflowed(seq)))
5513 		return -EAGAIN;
5514 
5515 	if (seq->count == start)
5516 		return 0;
5517 
5518 	/* skip leading comma */
5519 	memmove(seq->buf + start, seq->buf + start + 1,
5520 		seq->count - start - 1);
5521 	seq->count--;
5522 
5523 	return 0;
5524 }
5525 
statmount_opt_process(struct seq_file * seq,size_t start)5526 static inline int statmount_opt_process(struct seq_file *seq, size_t start)
5527 {
5528 	char *buf_end, *opt_end, *src, *dst;
5529 	int count = 0;
5530 
5531 	if (unlikely(seq_has_overflowed(seq)))
5532 		return -EAGAIN;
5533 
5534 	buf_end = seq->buf + seq->count;
5535 	dst = seq->buf + start;
5536 	src = dst + 1;	/* skip initial comma */
5537 
5538 	if (src >= buf_end) {
5539 		seq->count = start;
5540 		return 0;
5541 	}
5542 
5543 	*buf_end = '\0';
5544 	for (; src < buf_end; src = opt_end + 1) {
5545 		opt_end = strchrnul(src, ',');
5546 		*opt_end = '\0';
5547 		dst += string_unescape(src, dst, 0, UNESCAPE_OCTAL) + 1;
5548 		if (WARN_ON_ONCE(++count == INT_MAX))
5549 			return -EOVERFLOW;
5550 	}
5551 	seq->count = dst - 1 - seq->buf;
5552 	return count;
5553 }
5554 
statmount_opt_array(struct kstatmount * s,struct seq_file * seq)5555 static int statmount_opt_array(struct kstatmount *s, struct seq_file *seq)
5556 {
5557 	struct vfsmount *mnt = s->mnt;
5558 	struct super_block *sb = mnt->mnt_sb;
5559 	size_t start = seq->count;
5560 	int err;
5561 
5562 	if (!sb->s_op->show_options)
5563 		return 0;
5564 
5565 	err = sb->s_op->show_options(seq, mnt->mnt_root);
5566 	if (err)
5567 		return err;
5568 
5569 	err = statmount_opt_process(seq, start);
5570 	if (err < 0)
5571 		return err;
5572 
5573 	s->sm.opt_num = err;
5574 	return 0;
5575 }
5576 
statmount_opt_sec_array(struct kstatmount * s,struct seq_file * seq)5577 static int statmount_opt_sec_array(struct kstatmount *s, struct seq_file *seq)
5578 {
5579 	struct vfsmount *mnt = s->mnt;
5580 	struct super_block *sb = mnt->mnt_sb;
5581 	size_t start = seq->count;
5582 	int err;
5583 
5584 	err = security_sb_show_options(seq, sb);
5585 	if (err)
5586 		return err;
5587 
5588 	err = statmount_opt_process(seq, start);
5589 	if (err < 0)
5590 		return err;
5591 
5592 	s->sm.opt_sec_num = err;
5593 	return 0;
5594 }
5595 
statmount_mnt_uidmap(struct kstatmount * s,struct seq_file * seq)5596 static inline int statmount_mnt_uidmap(struct kstatmount *s, struct seq_file *seq)
5597 {
5598 	int ret;
5599 
5600 	ret = statmount_mnt_idmap(s->idmap, seq, true);
5601 	if (ret < 0)
5602 		return ret;
5603 
5604 	s->sm.mnt_uidmap_num = ret;
5605 	/*
5606 	 * Always raise STATMOUNT_MNT_UIDMAP even if there are no valid
5607 	 * mappings. This allows userspace to distinguish between a
5608 	 * non-idmapped mount and an idmapped mount where none of the
5609 	 * individual mappings are valid in the caller's idmapping.
5610 	 */
5611 	if (is_valid_mnt_idmap(s->idmap))
5612 		s->sm.mask |= STATMOUNT_MNT_UIDMAP;
5613 	return 0;
5614 }
5615 
statmount_mnt_gidmap(struct kstatmount * s,struct seq_file * seq)5616 static inline int statmount_mnt_gidmap(struct kstatmount *s, struct seq_file *seq)
5617 {
5618 	int ret;
5619 
5620 	ret = statmount_mnt_idmap(s->idmap, seq, false);
5621 	if (ret < 0)
5622 		return ret;
5623 
5624 	s->sm.mnt_gidmap_num = ret;
5625 	/*
5626 	 * Always raise STATMOUNT_MNT_GIDMAP even if there are no valid
5627 	 * mappings. This allows userspace to distinguish between a
5628 	 * non-idmapped mount and an idmapped mount where none of the
5629 	 * individual mappings are valid in the caller's idmapping.
5630 	 */
5631 	if (is_valid_mnt_idmap(s->idmap))
5632 		s->sm.mask |= STATMOUNT_MNT_GIDMAP;
5633 	return 0;
5634 }
5635 
statmount_string(struct kstatmount * s,u64 flag)5636 static int statmount_string(struct kstatmount *s, u64 flag)
5637 {
5638 	int ret = 0;
5639 	size_t kbufsize;
5640 	struct seq_file *seq = &s->seq;
5641 	struct statmount *sm = &s->sm;
5642 	u32 start, *offp;
5643 
5644 	/* Reserve an empty string at the beginning for any unset offsets */
5645 	if (!seq->count)
5646 		seq_putc(seq, 0);
5647 
5648 	start = seq->count;
5649 
5650 	switch (flag) {
5651 	case STATMOUNT_FS_TYPE:
5652 		offp = &sm->fs_type;
5653 		ret = statmount_fs_type(s, seq);
5654 		break;
5655 	case STATMOUNT_MNT_ROOT:
5656 		offp = &sm->mnt_root;
5657 		ret = statmount_mnt_root(s, seq);
5658 		break;
5659 	case STATMOUNT_MNT_POINT:
5660 		offp = &sm->mnt_point;
5661 		ret = statmount_mnt_point(s, seq);
5662 		break;
5663 	case STATMOUNT_MNT_OPTS:
5664 		offp = &sm->mnt_opts;
5665 		ret = statmount_mnt_opts(s, seq);
5666 		break;
5667 	case STATMOUNT_OPT_ARRAY:
5668 		offp = &sm->opt_array;
5669 		ret = statmount_opt_array(s, seq);
5670 		break;
5671 	case STATMOUNT_OPT_SEC_ARRAY:
5672 		offp = &sm->opt_sec_array;
5673 		ret = statmount_opt_sec_array(s, seq);
5674 		break;
5675 	case STATMOUNT_FS_SUBTYPE:
5676 		offp = &sm->fs_subtype;
5677 		statmount_fs_subtype(s, seq);
5678 		break;
5679 	case STATMOUNT_SB_SOURCE:
5680 		offp = &sm->sb_source;
5681 		ret = statmount_sb_source(s, seq);
5682 		break;
5683 	case STATMOUNT_MNT_UIDMAP:
5684 		sm->mnt_uidmap = start;
5685 		ret = statmount_mnt_uidmap(s, seq);
5686 		break;
5687 	case STATMOUNT_MNT_GIDMAP:
5688 		sm->mnt_gidmap = start;
5689 		ret = statmount_mnt_gidmap(s, seq);
5690 		break;
5691 	default:
5692 		WARN_ON_ONCE(true);
5693 		return -EINVAL;
5694 	}
5695 
5696 	/*
5697 	 * If nothing was emitted, return to avoid setting the flag
5698 	 * and terminating the buffer.
5699 	 */
5700 	if (seq->count == start)
5701 		return ret;
5702 	if (unlikely(check_add_overflow(sizeof(*sm), seq->count, &kbufsize)))
5703 		return -EOVERFLOW;
5704 	if (kbufsize >= s->bufsize)
5705 		return -EOVERFLOW;
5706 
5707 	/* signal a retry */
5708 	if (unlikely(seq_has_overflowed(seq)))
5709 		return -EAGAIN;
5710 
5711 	if (ret)
5712 		return ret;
5713 
5714 	seq->buf[seq->count++] = '\0';
5715 	sm->mask |= flag;
5716 	*offp = start;
5717 	return 0;
5718 }
5719 
copy_statmount_to_user(struct kstatmount * s)5720 static int copy_statmount_to_user(struct kstatmount *s)
5721 {
5722 	struct statmount *sm = &s->sm;
5723 	struct seq_file *seq = &s->seq;
5724 	char __user *str = ((char __user *)s->buf) + sizeof(*sm);
5725 	size_t copysize = min_t(size_t, s->bufsize, sizeof(*sm));
5726 
5727 	if (seq->count && copy_to_user(str, seq->buf, seq->count))
5728 		return -EFAULT;
5729 
5730 	/* Return the number of bytes copied to the buffer */
5731 	sm->size = copysize + seq->count;
5732 	if (copy_to_user(s->buf, sm, copysize))
5733 		return -EFAULT;
5734 
5735 	return 0;
5736 }
5737 
listmnt_next(struct mount * curr,bool reverse)5738 static struct mount *listmnt_next(struct mount *curr, bool reverse)
5739 {
5740 	struct rb_node *node;
5741 
5742 	if (reverse)
5743 		node = rb_prev(&curr->mnt_node);
5744 	else
5745 		node = rb_next(&curr->mnt_node);
5746 
5747 	return node_to_mount(node);
5748 }
5749 
grab_requested_root(struct mnt_namespace * ns,struct path * root)5750 static int grab_requested_root(struct mnt_namespace *ns, struct path *root)
5751 {
5752 	struct mount *first, *child;
5753 
5754 	rwsem_assert_held(&namespace_sem);
5755 
5756 	/* We're looking at our own ns, just use get_fs_root. */
5757 	if (ns == current->nsproxy->mnt_ns) {
5758 		get_fs_root(current->fs, root);
5759 		return 0;
5760 	}
5761 
5762 	/*
5763 	 * We have to find the first mount in our ns and use that, however it
5764 	 * may not exist, so handle that properly.
5765 	 */
5766 	if (mnt_ns_empty(ns))
5767 		return -ENOENT;
5768 
5769 	first = child = ns->root;
5770 	for (;;) {
5771 		child = listmnt_next(child, false);
5772 		if (!child)
5773 			return -ENOENT;
5774 		if (child->mnt_parent == first)
5775 			break;
5776 	}
5777 
5778 	root->mnt = mntget(&child->mnt);
5779 	root->dentry = dget(root->mnt->mnt_root);
5780 	return 0;
5781 }
5782 
5783 /* This must be updated whenever a new flag is added */
5784 #define STATMOUNT_SUPPORTED (STATMOUNT_SB_BASIC | \
5785 			     STATMOUNT_MNT_BASIC | \
5786 			     STATMOUNT_PROPAGATE_FROM | \
5787 			     STATMOUNT_MNT_ROOT | \
5788 			     STATMOUNT_MNT_POINT | \
5789 			     STATMOUNT_FS_TYPE | \
5790 			     STATMOUNT_MNT_NS_ID | \
5791 			     STATMOUNT_MNT_OPTS | \
5792 			     STATMOUNT_FS_SUBTYPE | \
5793 			     STATMOUNT_SB_SOURCE | \
5794 			     STATMOUNT_OPT_ARRAY | \
5795 			     STATMOUNT_OPT_SEC_ARRAY | \
5796 			     STATMOUNT_SUPPORTED_MASK)
5797 
do_statmount(struct kstatmount * s,u64 mnt_id,u64 mnt_ns_id,struct mnt_namespace * ns)5798 static int do_statmount(struct kstatmount *s, u64 mnt_id, u64 mnt_ns_id,
5799 			struct mnt_namespace *ns)
5800 {
5801 	struct path root __free(path_put) = {};
5802 	struct mount *m;
5803 	int err;
5804 
5805 	/* Has the namespace already been emptied? */
5806 	if (mnt_ns_id && mnt_ns_empty(ns))
5807 		return -ENOENT;
5808 
5809 	s->mnt = lookup_mnt_in_ns(mnt_id, ns);
5810 	if (!s->mnt)
5811 		return -ENOENT;
5812 
5813 	err = grab_requested_root(ns, &root);
5814 	if (err)
5815 		return err;
5816 
5817 	/*
5818 	 * Don't trigger audit denials. We just want to determine what
5819 	 * mounts to show users.
5820 	 */
5821 	m = real_mount(s->mnt);
5822 	if (!is_path_reachable(m, m->mnt.mnt_root, &root) &&
5823 	    !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
5824 		return -EPERM;
5825 
5826 	err = security_sb_statfs(s->mnt->mnt_root);
5827 	if (err)
5828 		return err;
5829 
5830 	s->root = root;
5831 	s->idmap = mnt_idmap(s->mnt);
5832 	if (s->mask & STATMOUNT_SB_BASIC)
5833 		statmount_sb_basic(s);
5834 
5835 	if (s->mask & STATMOUNT_MNT_BASIC)
5836 		statmount_mnt_basic(s);
5837 
5838 	if (s->mask & STATMOUNT_PROPAGATE_FROM)
5839 		statmount_propagate_from(s);
5840 
5841 	if (s->mask & STATMOUNT_FS_TYPE)
5842 		err = statmount_string(s, STATMOUNT_FS_TYPE);
5843 
5844 	if (!err && s->mask & STATMOUNT_MNT_ROOT)
5845 		err = statmount_string(s, STATMOUNT_MNT_ROOT);
5846 
5847 	if (!err && s->mask & STATMOUNT_MNT_POINT)
5848 		err = statmount_string(s, STATMOUNT_MNT_POINT);
5849 
5850 	if (!err && s->mask & STATMOUNT_MNT_OPTS)
5851 		err = statmount_string(s, STATMOUNT_MNT_OPTS);
5852 
5853 	if (!err && s->mask & STATMOUNT_OPT_ARRAY)
5854 		err = statmount_string(s, STATMOUNT_OPT_ARRAY);
5855 
5856 	if (!err && s->mask & STATMOUNT_OPT_SEC_ARRAY)
5857 		err = statmount_string(s, STATMOUNT_OPT_SEC_ARRAY);
5858 
5859 	if (!err && s->mask & STATMOUNT_FS_SUBTYPE)
5860 		err = statmount_string(s, STATMOUNT_FS_SUBTYPE);
5861 
5862 	if (!err && s->mask & STATMOUNT_SB_SOURCE)
5863 		err = statmount_string(s, STATMOUNT_SB_SOURCE);
5864 
5865 	if (!err && s->mask & STATMOUNT_MNT_UIDMAP)
5866 		err = statmount_string(s, STATMOUNT_MNT_UIDMAP);
5867 
5868 	if (!err && s->mask & STATMOUNT_MNT_GIDMAP)
5869 		err = statmount_string(s, STATMOUNT_MNT_GIDMAP);
5870 
5871 	if (!err && s->mask & STATMOUNT_MNT_NS_ID)
5872 		statmount_mnt_ns_id(s, ns);
5873 
5874 	if (!err && s->mask & STATMOUNT_SUPPORTED_MASK) {
5875 		s->sm.mask |= STATMOUNT_SUPPORTED_MASK;
5876 		s->sm.supported_mask = STATMOUNT_SUPPORTED;
5877 	}
5878 
5879 	if (err)
5880 		return err;
5881 
5882 	/* Are there bits in the return mask not present in STATMOUNT_SUPPORTED? */
5883 	WARN_ON_ONCE(~STATMOUNT_SUPPORTED & s->sm.mask);
5884 
5885 	return 0;
5886 }
5887 
retry_statmount(const long ret,size_t * seq_size)5888 static inline bool retry_statmount(const long ret, size_t *seq_size)
5889 {
5890 	if (likely(ret != -EAGAIN))
5891 		return false;
5892 	if (unlikely(check_mul_overflow(*seq_size, 2, seq_size)))
5893 		return false;
5894 	if (unlikely(*seq_size > MAX_RW_COUNT))
5895 		return false;
5896 	return true;
5897 }
5898 
5899 #define STATMOUNT_STRING_REQ (STATMOUNT_MNT_ROOT | STATMOUNT_MNT_POINT | \
5900 			      STATMOUNT_FS_TYPE | STATMOUNT_MNT_OPTS | \
5901 			      STATMOUNT_FS_SUBTYPE | STATMOUNT_SB_SOURCE | \
5902 			      STATMOUNT_OPT_ARRAY | STATMOUNT_OPT_SEC_ARRAY | \
5903 			      STATMOUNT_MNT_UIDMAP | STATMOUNT_MNT_GIDMAP)
5904 
prepare_kstatmount(struct kstatmount * ks,struct mnt_id_req * kreq,struct statmount __user * buf,size_t bufsize,size_t seq_size)5905 static int prepare_kstatmount(struct kstatmount *ks, struct mnt_id_req *kreq,
5906 			      struct statmount __user *buf, size_t bufsize,
5907 			      size_t seq_size)
5908 {
5909 	if (!access_ok(buf, bufsize))
5910 		return -EFAULT;
5911 
5912 	memset(ks, 0, sizeof(*ks));
5913 	ks->mask = kreq->param;
5914 	ks->buf = buf;
5915 	ks->bufsize = bufsize;
5916 
5917 	if (ks->mask & STATMOUNT_STRING_REQ) {
5918 		if (bufsize == sizeof(ks->sm))
5919 			return -EOVERFLOW;
5920 
5921 		ks->seq.buf = kvmalloc(seq_size, GFP_KERNEL_ACCOUNT);
5922 		if (!ks->seq.buf)
5923 			return -ENOMEM;
5924 
5925 		ks->seq.size = seq_size;
5926 	}
5927 
5928 	return 0;
5929 }
5930 
copy_mnt_id_req(const struct mnt_id_req __user * req,struct mnt_id_req * kreq)5931 static int copy_mnt_id_req(const struct mnt_id_req __user *req,
5932 			   struct mnt_id_req *kreq)
5933 {
5934 	int ret;
5935 	size_t usize;
5936 
5937 	BUILD_BUG_ON(sizeof(struct mnt_id_req) != MNT_ID_REQ_SIZE_VER1);
5938 
5939 	ret = get_user(usize, &req->size);
5940 	if (ret)
5941 		return -EFAULT;
5942 	if (unlikely(usize > PAGE_SIZE))
5943 		return -E2BIG;
5944 	if (unlikely(usize < MNT_ID_REQ_SIZE_VER0))
5945 		return -EINVAL;
5946 	memset(kreq, 0, sizeof(*kreq));
5947 	ret = copy_struct_from_user(kreq, sizeof(*kreq), req, usize);
5948 	if (ret)
5949 		return ret;
5950 	if (kreq->spare != 0)
5951 		return -EINVAL;
5952 	/* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */
5953 	if (kreq->mnt_id <= MNT_UNIQUE_ID_OFFSET)
5954 		return -EINVAL;
5955 	return 0;
5956 }
5957 
5958 /*
5959  * If the user requested a specific mount namespace id, look that up and return
5960  * that, or if not simply grab a passive reference on our mount namespace and
5961  * return that.
5962  */
grab_requested_mnt_ns(const struct mnt_id_req * kreq)5963 static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq)
5964 {
5965 	struct mnt_namespace *mnt_ns;
5966 
5967 	if (kreq->mnt_ns_id && kreq->spare)
5968 		return ERR_PTR(-EINVAL);
5969 
5970 	if (kreq->mnt_ns_id)
5971 		return lookup_mnt_ns(kreq->mnt_ns_id);
5972 
5973 	if (kreq->spare) {
5974 		struct ns_common *ns;
5975 
5976 		CLASS(fd, f)(kreq->spare);
5977 		if (fd_empty(f))
5978 			return ERR_PTR(-EBADF);
5979 
5980 		if (!proc_ns_file(fd_file(f)))
5981 			return ERR_PTR(-EINVAL);
5982 
5983 		ns = get_proc_ns(file_inode(fd_file(f)));
5984 		if (ns->ops->type != CLONE_NEWNS)
5985 			return ERR_PTR(-EINVAL);
5986 
5987 		mnt_ns = to_mnt_ns(ns);
5988 	} else {
5989 		mnt_ns = current->nsproxy->mnt_ns;
5990 	}
5991 
5992 	refcount_inc(&mnt_ns->passive);
5993 	return mnt_ns;
5994 }
5995 
SYSCALL_DEFINE4(statmount,const struct mnt_id_req __user *,req,struct statmount __user *,buf,size_t,bufsize,unsigned int,flags)5996 SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req,
5997 		struct statmount __user *, buf, size_t, bufsize,
5998 		unsigned int, flags)
5999 {
6000 	struct mnt_namespace *ns __free(mnt_ns_release) = NULL;
6001 	struct kstatmount *ks __free(kfree) = NULL;
6002 	struct mnt_id_req kreq;
6003 	/* We currently support retrieval of 3 strings. */
6004 	size_t seq_size = 3 * PATH_MAX;
6005 	int ret;
6006 
6007 	if (flags)
6008 		return -EINVAL;
6009 
6010 	ret = copy_mnt_id_req(req, &kreq);
6011 	if (ret)
6012 		return ret;
6013 
6014 	ns = grab_requested_mnt_ns(&kreq);
6015 	if (!ns)
6016 		return -ENOENT;
6017 
6018 	if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) &&
6019 	    !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
6020 		return -ENOENT;
6021 
6022 	ks = kmalloc(sizeof(*ks), GFP_KERNEL_ACCOUNT);
6023 	if (!ks)
6024 		return -ENOMEM;
6025 
6026 retry:
6027 	ret = prepare_kstatmount(ks, &kreq, buf, bufsize, seq_size);
6028 	if (ret)
6029 		return ret;
6030 
6031 	scoped_guard(rwsem_read, &namespace_sem)
6032 		ret = do_statmount(ks, kreq.mnt_id, kreq.mnt_ns_id, ns);
6033 
6034 	if (!ret)
6035 		ret = copy_statmount_to_user(ks);
6036 	kvfree(ks->seq.buf);
6037 	if (retry_statmount(ret, &seq_size))
6038 		goto retry;
6039 	return ret;
6040 }
6041 
do_listmount(struct mnt_namespace * ns,u64 mnt_parent_id,u64 last_mnt_id,u64 * mnt_ids,size_t nr_mnt_ids,bool reverse)6042 static ssize_t do_listmount(struct mnt_namespace *ns, u64 mnt_parent_id,
6043 			    u64 last_mnt_id, u64 *mnt_ids, size_t nr_mnt_ids,
6044 			    bool reverse)
6045 {
6046 	struct path root __free(path_put) = {};
6047 	struct path orig;
6048 	struct mount *r, *first;
6049 	ssize_t ret;
6050 
6051 	rwsem_assert_held(&namespace_sem);
6052 
6053 	ret = grab_requested_root(ns, &root);
6054 	if (ret)
6055 		return ret;
6056 
6057 	if (mnt_parent_id == LSMT_ROOT) {
6058 		orig = root;
6059 	} else {
6060 		orig.mnt = lookup_mnt_in_ns(mnt_parent_id, ns);
6061 		if (!orig.mnt)
6062 			return -ENOENT;
6063 		orig.dentry = orig.mnt->mnt_root;
6064 	}
6065 
6066 	/*
6067 	 * Don't trigger audit denials. We just want to determine what
6068 	 * mounts to show users.
6069 	 */
6070 	if (!is_path_reachable(real_mount(orig.mnt), orig.dentry, &root) &&
6071 	    !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
6072 		return -EPERM;
6073 
6074 	ret = security_sb_statfs(orig.dentry);
6075 	if (ret)
6076 		return ret;
6077 
6078 	if (!last_mnt_id) {
6079 		if (reverse)
6080 			first = node_to_mount(ns->mnt_last_node);
6081 		else
6082 			first = node_to_mount(ns->mnt_first_node);
6083 	} else {
6084 		if (reverse)
6085 			first = mnt_find_id_at_reverse(ns, last_mnt_id - 1);
6086 		else
6087 			first = mnt_find_id_at(ns, last_mnt_id + 1);
6088 	}
6089 
6090 	for (ret = 0, r = first; r && nr_mnt_ids; r = listmnt_next(r, reverse)) {
6091 		if (r->mnt_id_unique == mnt_parent_id)
6092 			continue;
6093 		if (!is_path_reachable(r, r->mnt.mnt_root, &orig))
6094 			continue;
6095 		*mnt_ids = r->mnt_id_unique;
6096 		mnt_ids++;
6097 		nr_mnt_ids--;
6098 		ret++;
6099 	}
6100 	return ret;
6101 }
6102 
SYSCALL_DEFINE4(listmount,const struct mnt_id_req __user *,req,u64 __user *,mnt_ids,size_t,nr_mnt_ids,unsigned int,flags)6103 SYSCALL_DEFINE4(listmount, const struct mnt_id_req __user *, req,
6104 		u64 __user *, mnt_ids, size_t, nr_mnt_ids, unsigned int, flags)
6105 {
6106 	u64 *kmnt_ids __free(kvfree) = NULL;
6107 	const size_t maxcount = 1000000;
6108 	struct mnt_namespace *ns __free(mnt_ns_release) = NULL;
6109 	struct mnt_id_req kreq;
6110 	u64 last_mnt_id;
6111 	ssize_t ret;
6112 
6113 	if (flags & ~LISTMOUNT_REVERSE)
6114 		return -EINVAL;
6115 
6116 	/*
6117 	 * If the mount namespace really has more than 1 million mounts the
6118 	 * caller must iterate over the mount namespace (and reconsider their
6119 	 * system design...).
6120 	 */
6121 	if (unlikely(nr_mnt_ids > maxcount))
6122 		return -EOVERFLOW;
6123 
6124 	if (!access_ok(mnt_ids, nr_mnt_ids * sizeof(*mnt_ids)))
6125 		return -EFAULT;
6126 
6127 	ret = copy_mnt_id_req(req, &kreq);
6128 	if (ret)
6129 		return ret;
6130 
6131 	last_mnt_id = kreq.param;
6132 	/* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */
6133 	if (last_mnt_id != 0 && last_mnt_id <= MNT_UNIQUE_ID_OFFSET)
6134 		return -EINVAL;
6135 
6136 	kmnt_ids = kvmalloc_array(nr_mnt_ids, sizeof(*kmnt_ids),
6137 				  GFP_KERNEL_ACCOUNT);
6138 	if (!kmnt_ids)
6139 		return -ENOMEM;
6140 
6141 	ns = grab_requested_mnt_ns(&kreq);
6142 	if (!ns)
6143 		return -ENOENT;
6144 
6145 	if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) &&
6146 	    !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
6147 		return -ENOENT;
6148 
6149 	scoped_guard(rwsem_read, &namespace_sem)
6150 		ret = do_listmount(ns, kreq.mnt_id, last_mnt_id, kmnt_ids,
6151 				   nr_mnt_ids, (flags & LISTMOUNT_REVERSE));
6152 	if (ret <= 0)
6153 		return ret;
6154 
6155 	if (copy_to_user(mnt_ids, kmnt_ids, ret * sizeof(*mnt_ids)))
6156 		return -EFAULT;
6157 
6158 	return ret;
6159 }
6160 
init_mount_tree(void)6161 static void __init init_mount_tree(void)
6162 {
6163 	struct vfsmount *mnt;
6164 	struct mount *m;
6165 	struct mnt_namespace *ns;
6166 	struct path root;
6167 
6168 	mnt = vfs_kern_mount(&rootfs_fs_type, 0, "rootfs", NULL);
6169 	if (IS_ERR(mnt))
6170 		panic("Can't create rootfs");
6171 
6172 	ns = alloc_mnt_ns(&init_user_ns, false);
6173 	if (IS_ERR(ns))
6174 		panic("Can't allocate initial namespace");
6175 	m = real_mount(mnt);
6176 	ns->root = m;
6177 	ns->nr_mounts = 1;
6178 	mnt_add_to_ns(ns, m);
6179 	init_task.nsproxy->mnt_ns = ns;
6180 	get_mnt_ns(ns);
6181 
6182 	root.mnt = mnt;
6183 	root.dentry = mnt->mnt_root;
6184 	mnt->mnt_flags |= MNT_LOCKED;
6185 
6186 	set_fs_pwd(current->fs, &root);
6187 	set_fs_root(current->fs, &root);
6188 
6189 	mnt_ns_tree_add(ns);
6190 }
6191 
mnt_init(void)6192 void __init mnt_init(void)
6193 {
6194 	int err;
6195 
6196 	mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount),
6197 			0, SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, NULL);
6198 
6199 	mount_hashtable = alloc_large_system_hash("Mount-cache",
6200 				sizeof(struct hlist_head),
6201 				mhash_entries, 19,
6202 				HASH_ZERO,
6203 				&m_hash_shift, &m_hash_mask, 0, 0);
6204 	mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache",
6205 				sizeof(struct hlist_head),
6206 				mphash_entries, 19,
6207 				HASH_ZERO,
6208 				&mp_hash_shift, &mp_hash_mask, 0, 0);
6209 
6210 	if (!mount_hashtable || !mountpoint_hashtable)
6211 		panic("Failed to allocate mount hash table\n");
6212 
6213 	kernfs_init();
6214 
6215 	err = sysfs_init();
6216 	if (err)
6217 		printk(KERN_WARNING "%s: sysfs_init error: %d\n",
6218 			__func__, err);
6219 	fs_kobj = kobject_create_and_add("fs", NULL);
6220 	if (!fs_kobj)
6221 		printk(KERN_WARNING "%s: kobj create error\n", __func__);
6222 	shmem_init();
6223 	init_rootfs();
6224 	init_mount_tree();
6225 }
6226 
put_mnt_ns(struct mnt_namespace * ns)6227 void put_mnt_ns(struct mnt_namespace *ns)
6228 {
6229 	if (!refcount_dec_and_test(&ns->ns.count))
6230 		return;
6231 	drop_collected_mounts(&ns->root->mnt);
6232 	free_mnt_ns(ns);
6233 }
6234 
kern_mount(struct file_system_type * type)6235 struct vfsmount *kern_mount(struct file_system_type *type)
6236 {
6237 	struct vfsmount *mnt;
6238 	mnt = vfs_kern_mount(type, SB_KERNMOUNT, type->name, NULL);
6239 	if (!IS_ERR(mnt)) {
6240 		/*
6241 		 * it is a longterm mount, don't release mnt until
6242 		 * we unmount before file sys is unregistered
6243 		*/
6244 		real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL;
6245 	}
6246 	return mnt;
6247 }
6248 EXPORT_SYMBOL_GPL(kern_mount);
6249 
kern_unmount(struct vfsmount * mnt)6250 void kern_unmount(struct vfsmount *mnt)
6251 {
6252 	/* release long term mount so mount point can be released */
6253 	if (!IS_ERR(mnt)) {
6254 		mnt_make_shortterm(mnt);
6255 		synchronize_rcu();	/* yecchhh... */
6256 		mntput(mnt);
6257 	}
6258 }
6259 EXPORT_SYMBOL(kern_unmount);
6260 
kern_unmount_array(struct vfsmount * mnt[],unsigned int num)6261 void kern_unmount_array(struct vfsmount *mnt[], unsigned int num)
6262 {
6263 	unsigned int i;
6264 
6265 	for (i = 0; i < num; i++)
6266 		mnt_make_shortterm(mnt[i]);
6267 	synchronize_rcu_expedited();
6268 	for (i = 0; i < num; i++)
6269 		mntput(mnt[i]);
6270 }
6271 EXPORT_SYMBOL(kern_unmount_array);
6272 
our_mnt(struct vfsmount * mnt)6273 bool our_mnt(struct vfsmount *mnt)
6274 {
6275 	return check_mnt(real_mount(mnt));
6276 }
6277 
current_chrooted(void)6278 bool current_chrooted(void)
6279 {
6280 	/* Does the current process have a non-standard root */
6281 	struct path ns_root;
6282 	struct path fs_root;
6283 	bool chrooted;
6284 
6285 	/* Find the namespace root */
6286 	ns_root.mnt = &current->nsproxy->mnt_ns->root->mnt;
6287 	ns_root.dentry = ns_root.mnt->mnt_root;
6288 	path_get(&ns_root);
6289 	while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root))
6290 		;
6291 
6292 	get_fs_root(current->fs, &fs_root);
6293 
6294 	chrooted = !path_equal(&fs_root, &ns_root);
6295 
6296 	path_put(&fs_root);
6297 	path_put(&ns_root);
6298 
6299 	return chrooted;
6300 }
6301 
mnt_already_visible(struct mnt_namespace * ns,const struct super_block * sb,int * new_mnt_flags)6302 static bool mnt_already_visible(struct mnt_namespace *ns,
6303 				const struct super_block *sb,
6304 				int *new_mnt_flags)
6305 {
6306 	int new_flags = *new_mnt_flags;
6307 	struct mount *mnt, *n;
6308 	bool visible = false;
6309 
6310 	down_read(&namespace_sem);
6311 	rbtree_postorder_for_each_entry_safe(mnt, n, &ns->mounts, mnt_node) {
6312 		struct mount *child;
6313 		int mnt_flags;
6314 
6315 		if (mnt->mnt.mnt_sb->s_type != sb->s_type)
6316 			continue;
6317 
6318 		/* This mount is not fully visible if it's root directory
6319 		 * is not the root directory of the filesystem.
6320 		 */
6321 		if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
6322 			continue;
6323 
6324 		/* A local view of the mount flags */
6325 		mnt_flags = mnt->mnt.mnt_flags;
6326 
6327 		/* Don't miss readonly hidden in the superblock flags */
6328 		if (sb_rdonly(mnt->mnt.mnt_sb))
6329 			mnt_flags |= MNT_LOCK_READONLY;
6330 
6331 		/* Verify the mount flags are equal to or more permissive
6332 		 * than the proposed new mount.
6333 		 */
6334 		if ((mnt_flags & MNT_LOCK_READONLY) &&
6335 		    !(new_flags & MNT_READONLY))
6336 			continue;
6337 		if ((mnt_flags & MNT_LOCK_ATIME) &&
6338 		    ((mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK)))
6339 			continue;
6340 
6341 		/* This mount is not fully visible if there are any
6342 		 * locked child mounts that cover anything except for
6343 		 * empty directories.
6344 		 */
6345 		list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
6346 			struct inode *inode = child->mnt_mountpoint->d_inode;
6347 			/* Only worry about locked mounts */
6348 			if (!(child->mnt.mnt_flags & MNT_LOCKED))
6349 				continue;
6350 			/* Is the directory permanently empty? */
6351 			if (!is_empty_dir_inode(inode))
6352 				goto next;
6353 		}
6354 		/* Preserve the locked attributes */
6355 		*new_mnt_flags |= mnt_flags & (MNT_LOCK_READONLY | \
6356 					       MNT_LOCK_ATIME);
6357 		visible = true;
6358 		goto found;
6359 	next:	;
6360 	}
6361 found:
6362 	up_read(&namespace_sem);
6363 	return visible;
6364 }
6365 
mount_too_revealing(const struct super_block * sb,int * new_mnt_flags)6366 static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags)
6367 {
6368 	const unsigned long required_iflags = SB_I_NOEXEC | SB_I_NODEV;
6369 	struct mnt_namespace *ns = current->nsproxy->mnt_ns;
6370 	unsigned long s_iflags;
6371 
6372 	if (ns->user_ns == &init_user_ns)
6373 		return false;
6374 
6375 	/* Can this filesystem be too revealing? */
6376 	s_iflags = sb->s_iflags;
6377 	if (!(s_iflags & SB_I_USERNS_VISIBLE))
6378 		return false;
6379 
6380 	if ((s_iflags & required_iflags) != required_iflags) {
6381 		WARN_ONCE(1, "Expected s_iflags to contain 0x%lx\n",
6382 			  required_iflags);
6383 		return true;
6384 	}
6385 
6386 	return !mnt_already_visible(ns, sb, new_mnt_flags);
6387 }
6388 
mnt_may_suid(struct vfsmount * mnt)6389 bool mnt_may_suid(struct vfsmount *mnt)
6390 {
6391 	/*
6392 	 * Foreign mounts (accessed via fchdir or through /proc
6393 	 * symlinks) are always treated as if they are nosuid.  This
6394 	 * prevents namespaces from trusting potentially unsafe
6395 	 * suid/sgid bits, file caps, or security labels that originate
6396 	 * in other namespaces.
6397 	 */
6398 	return !(mnt->mnt_flags & MNT_NOSUID) && check_mnt(real_mount(mnt)) &&
6399 	       current_in_userns(mnt->mnt_sb->s_user_ns);
6400 }
6401 
mntns_get(struct task_struct * task)6402 static struct ns_common *mntns_get(struct task_struct *task)
6403 {
6404 	struct ns_common *ns = NULL;
6405 	struct nsproxy *nsproxy;
6406 
6407 	task_lock(task);
6408 	nsproxy = task->nsproxy;
6409 	if (nsproxy) {
6410 		ns = &nsproxy->mnt_ns->ns;
6411 		get_mnt_ns(to_mnt_ns(ns));
6412 	}
6413 	task_unlock(task);
6414 
6415 	return ns;
6416 }
6417 
mntns_put(struct ns_common * ns)6418 static void mntns_put(struct ns_common *ns)
6419 {
6420 	put_mnt_ns(to_mnt_ns(ns));
6421 }
6422 
mntns_install(struct nsset * nsset,struct ns_common * ns)6423 static int mntns_install(struct nsset *nsset, struct ns_common *ns)
6424 {
6425 	struct nsproxy *nsproxy = nsset->nsproxy;
6426 	struct fs_struct *fs = nsset->fs;
6427 	struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns;
6428 	struct user_namespace *user_ns = nsset->cred->user_ns;
6429 	struct path root;
6430 	int err;
6431 
6432 	if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
6433 	    !ns_capable(user_ns, CAP_SYS_CHROOT) ||
6434 	    !ns_capable(user_ns, CAP_SYS_ADMIN))
6435 		return -EPERM;
6436 
6437 	if (is_anon_ns(mnt_ns))
6438 		return -EINVAL;
6439 
6440 	if (fs->users != 1)
6441 		return -EINVAL;
6442 
6443 	get_mnt_ns(mnt_ns);
6444 	old_mnt_ns = nsproxy->mnt_ns;
6445 	nsproxy->mnt_ns = mnt_ns;
6446 
6447 	/* Find the root */
6448 	err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt,
6449 				"/", LOOKUP_DOWN, &root);
6450 	if (err) {
6451 		/* revert to old namespace */
6452 		nsproxy->mnt_ns = old_mnt_ns;
6453 		put_mnt_ns(mnt_ns);
6454 		return err;
6455 	}
6456 
6457 	put_mnt_ns(old_mnt_ns);
6458 
6459 	/* Update the pwd and root */
6460 	set_fs_pwd(fs, &root);
6461 	set_fs_root(fs, &root);
6462 
6463 	path_put(&root);
6464 	return 0;
6465 }
6466 
mntns_owner(struct ns_common * ns)6467 static struct user_namespace *mntns_owner(struct ns_common *ns)
6468 {
6469 	return to_mnt_ns(ns)->user_ns;
6470 }
6471 
6472 const struct proc_ns_operations mntns_operations = {
6473 	.name		= "mnt",
6474 	.type		= CLONE_NEWNS,
6475 	.get		= mntns_get,
6476 	.put		= mntns_put,
6477 	.install	= mntns_install,
6478 	.owner		= mntns_owner,
6479 };
6480 
6481 #ifdef CONFIG_SYSCTL
6482 static const struct ctl_table fs_namespace_sysctls[] = {
6483 	{
6484 		.procname	= "mount-max",
6485 		.data		= &sysctl_mount_max,
6486 		.maxlen		= sizeof(unsigned int),
6487 		.mode		= 0644,
6488 		.proc_handler	= proc_dointvec_minmax,
6489 		.extra1		= SYSCTL_ONE,
6490 	},
6491 };
6492 
init_fs_namespace_sysctls(void)6493 static int __init init_fs_namespace_sysctls(void)
6494 {
6495 	register_sysctl_init("fs", fs_namespace_sysctls);
6496 	return 0;
6497 }
6498 fs_initcall(init_fs_namespace_sysctls);
6499 
6500 #endif /* CONFIG_SYSCTL */
6501