1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * linux/fs/readdir.c
4 *
5 * Copyright (C) 1995 Linus Torvalds
6 */
7
8 #include <linux/stddef.h>
9 #include <linux/kernel.h>
10 #include <linux/export.h>
11 #include <linux/time.h>
12 #include <linux/mm.h>
13 #include <linux/errno.h>
14 #include <linux/stat.h>
15 #include <linux/file.h>
16 #include <linux/fs.h>
17 #include <linux/fsnotify.h>
18 #include <linux/dirent.h>
19 #include <linux/security.h>
20 #include <linux/syscalls.h>
21 #include <linux/unistd.h>
22 #include <linux/compat.h>
23 #include <linux/uaccess.h>
24
25 #define dirent_size(dirent, len) offsetof(typeof(*(dirent)), d_name[len])
26
27 /*
28 * Some filesystems were never converted to '->iterate_shared()'
29 * and their directory iterators want the inode lock held for
30 * writing. This wrapper allows for converting from the shared
31 * semantics to the exclusive inode use.
32 */
wrap_directory_iterator(struct file * file,struct dir_context * ctx,int (* iter)(struct file *,struct dir_context *))33 int wrap_directory_iterator(struct file *file,
34 struct dir_context *ctx,
35 int (*iter)(struct file *, struct dir_context *))
36 {
37 struct inode *inode = file_inode(file);
38 int ret;
39
40 /*
41 * We'd love to have an 'inode_upgrade_trylock()' operation,
42 * see the comment in mmap_upgrade_trylock() in mm/memory.c.
43 *
44 * But considering this is for "filesystems that never got
45 * converted", it really doesn't matter.
46 *
47 * Also note that since we have to return with the lock held
48 * for reading, we can't use the "killable()" locking here,
49 * since we do need to get the lock even if we're dying.
50 *
51 * We could do the write part killably and then get the read
52 * lock unconditionally if it mattered, but see above on why
53 * this does the very simplistic conversion.
54 */
55 up_read(&inode->i_rwsem);
56 down_write(&inode->i_rwsem);
57
58 /*
59 * Since we dropped the inode lock, we should do the
60 * DEADDIR test again. See 'iterate_dir()' below.
61 *
62 * Note that we don't need to re-do the f_pos games,
63 * since the file must be locked wrt f_pos anyway.
64 */
65 ret = -ENOENT;
66 if (!IS_DEADDIR(inode))
67 ret = iter(file, ctx);
68
69 downgrade_write(&inode->i_rwsem);
70 return ret;
71 }
72 EXPORT_SYMBOL(wrap_directory_iterator);
73
74 /*
75 * Note the "unsafe_put_user()" semantics: we goto a
76 * label for errors.
77 */
78 #define unsafe_copy_dirent_name(_dst, _src, _len, label) do { \
79 char __user *dst = (_dst); \
80 const char *src = (_src); \
81 size_t len = (_len); \
82 unsafe_put_user(0, dst+len, label); \
83 unsafe_copy_to_user(dst, src, len, label); \
84 } while (0)
85
86
iterate_dir(struct file * file,struct dir_context * ctx)87 int iterate_dir(struct file *file, struct dir_context *ctx)
88 {
89 struct inode *inode = file_inode(file);
90 /* never an entry, never removed: nothing for the lock to keep still */
91 bool locked = !(file->f_op->fop_flags & FOP_IMMUTABLE);
92 int res = -ENOTDIR;
93
94 if (!file->f_op->iterate_shared)
95 goto out;
96
97 res = security_file_permission(file, MAY_READ);
98 if (res)
99 goto out;
100
101 res = fsnotify_file_perm(file, MAY_READ);
102 if (res)
103 goto out;
104
105 if (locked) {
106 res = down_read_killable(&inode->i_rwsem);
107 if (res)
108 goto out;
109 }
110
111 res = -ENOENT;
112 if (!IS_DEADDIR(inode)) {
113 ctx->pos = file->f_pos;
114 res = file->f_op->iterate_shared(file, ctx);
115 file->f_pos = ctx->pos;
116 fsnotify_access(file);
117 file_accessed(file);
118 }
119 if (locked)
120 inode_unlock_shared(inode);
121 out:
122 return res;
123 }
124 EXPORT_SYMBOL(iterate_dir);
125
126 /*
127 * POSIX says that a dirent name cannot contain NULL or a '/'.
128 *
129 * It's not 100% clear what we should really do in this case.
130 * The filesystem is clearly corrupted, but returning a hard
131 * error means that you now don't see any of the other names
132 * either, so that isn't a perfect alternative.
133 *
134 * And if you return an error, what error do you use? Several
135 * filesystems seem to have decided on EUCLEAN being the error
136 * code for EFSCORRUPTED, and that may be the error to use. Or
137 * just EIO, which is perhaps more obvious to users.
138 *
139 * In order to see the other file names in the directory, the
140 * caller might want to make this a "soft" error: skip the
141 * entry, and return the error at the end instead.
142 *
143 * Note that this should likely do a "memchr(name, 0, len)"
144 * check too, since that would be filesystem corruption as
145 * well. However, that case can't actually confuse user space,
146 * which has to do a strlen() on the name anyway to find the
147 * filename length, and the above "soft error" worry means
148 * that it's probably better left alone until we have that
149 * issue clarified.
150 *
151 * Note the PATH_MAX check - it's arbitrary but the real
152 * kernel limit on a possible path component, not NAME_MAX,
153 * which is the technical standard limit.
154 */
verify_dirent_name(const char * name,int len)155 static int verify_dirent_name(const char *name, int len)
156 {
157 if (len <= 0 || len >= PATH_MAX)
158 return -EIO;
159 if (memchr(name, '/', len))
160 return -EIO;
161 return 0;
162 }
163
164 /*
165 * Traditional linux readdir() handling..
166 *
167 * "count=1" is a special case, meaning that the buffer is one
168 * dirent-structure in size and that the code can't handle more
169 * anyway. Thus the special "fillonedir()" function for that
170 * case (the low-level handlers don't need to care about this).
171 */
172
173 #ifdef __ARCH_WANT_OLD_READDIR
174
175 struct old_linux_dirent {
176 unsigned long d_ino;
177 unsigned long d_offset;
178 unsigned short d_namlen;
179 char d_name[];
180 };
181
182 struct readdir_callback {
183 struct dir_context ctx;
184 struct old_linux_dirent __user * dirent;
185 int result;
186 };
187
fillonedir(struct dir_context * ctx,const char * name,int namlen,loff_t offset,u64 ino,unsigned int d_type)188 static bool fillonedir(struct dir_context *ctx, const char *name, int namlen,
189 loff_t offset, u64 ino, unsigned int d_type)
190 {
191 struct readdir_callback *buf =
192 container_of(ctx, struct readdir_callback, ctx);
193 struct old_linux_dirent __user * dirent;
194 unsigned long d_ino;
195
196 if (buf->result)
197 return false;
198 buf->result = verify_dirent_name(name, namlen);
199 if (buf->result)
200 return false;
201 d_ino = ino;
202 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
203 buf->result = -EOVERFLOW;
204 return false;
205 }
206 buf->result++;
207 dirent = buf->dirent;
208 scoped_user_write_access_size(dirent, dirent_size(dirent, namlen + 1), efault) {
209 unsafe_put_user(d_ino, &dirent->d_ino, efault);
210 unsafe_put_user(offset, &dirent->d_offset, efault);
211 unsafe_put_user(namlen, &dirent->d_namlen, efault);
212 unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault);
213 }
214 return true;
215 efault:
216 buf->result = -EFAULT;
217 return false;
218 }
219
SYSCALL_DEFINE3(old_readdir,unsigned int,fd,struct old_linux_dirent __user *,dirent,unsigned int,count)220 SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
221 struct old_linux_dirent __user *, dirent, unsigned int, count)
222 {
223 int error;
224 CLASS(fd_pos, f)(fd);
225 struct readdir_callback buf = {
226 .ctx.actor = fillonedir,
227 .ctx.count = 1, /* Hint to fs: just one entry. */
228 .dirent = dirent
229 };
230
231 if (fd_empty(f))
232 return -EBADF;
233
234 error = iterate_dir(fd_file(f), &buf.ctx);
235 if (buf.result)
236 error = buf.result;
237
238 return error;
239 }
240
241 #endif /* __ARCH_WANT_OLD_READDIR */
242
243 /*
244 * New, all-improved, singing, dancing, iBCS2-compliant getdents()
245 * interface.
246 */
247 struct linux_dirent {
248 unsigned long d_ino;
249 unsigned long d_off;
250 unsigned short d_reclen;
251 char d_name[];
252 };
253
254 struct getdents_callback {
255 struct dir_context ctx;
256 struct linux_dirent __user * current_dir;
257 int prev_reclen;
258 int error;
259 };
260
filldir(struct dir_context * ctx,const char * name,int namlen,loff_t offset,u64 ino,unsigned int d_type)261 static bool filldir(struct dir_context *ctx, const char *name, int namlen,
262 loff_t offset, u64 ino, unsigned int d_type)
263 {
264 struct linux_dirent __user *dirent, *prev;
265 struct getdents_callback *buf =
266 container_of(ctx, struct getdents_callback, ctx);
267 unsigned long d_ino;
268 int reclen = ALIGN(dirent_size(dirent, namlen + 2), sizeof(long));
269 int prev_reclen;
270 unsigned int flags = d_type;
271
272 BUILD_BUG_ON(FILLDIR_FLAG_NOINTR & S_DT_MASK);
273 d_type &= S_DT_MASK;
274
275 buf->error = verify_dirent_name(name, namlen);
276 if (unlikely(buf->error))
277 return false;
278 buf->error = -EINVAL; /* only used if we fail.. */
279 if (reclen > ctx->count)
280 return false;
281 d_ino = ino;
282 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
283 buf->error = -EOVERFLOW;
284 return false;
285 }
286 prev_reclen = buf->prev_reclen;
287 if (!(flags & FILLDIR_FLAG_NOINTR) && prev_reclen && signal_pending(current))
288 return false;
289 dirent = buf->current_dir;
290 prev = (void __user *) dirent - prev_reclen;
291 scoped_user_write_access_size(prev, reclen + prev_reclen, efault) {
292 /* This might be 'dirent->d_off', but if so it will get overwritten */
293 unsafe_put_user(offset, &prev->d_off, efault);
294 unsafe_put_user(d_ino, &dirent->d_ino, efault);
295 unsafe_put_user(reclen, &dirent->d_reclen, efault);
296 unsafe_put_user(d_type, (char __user *)dirent + reclen - 1, efault);
297 unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault);
298 }
299
300 buf->current_dir = (void __user *)dirent + reclen;
301 buf->prev_reclen = reclen;
302 ctx->count -= reclen;
303 return true;
304 efault:
305 buf->error = -EFAULT;
306 return false;
307 }
308
SYSCALL_DEFINE3(getdents,unsigned int,fd,struct linux_dirent __user *,dirent,unsigned int,count)309 SYSCALL_DEFINE3(getdents, unsigned int, fd,
310 struct linux_dirent __user *, dirent, unsigned int, count)
311 {
312 CLASS(fd_pos, f)(fd);
313 struct getdents_callback buf = {
314 .ctx.actor = filldir,
315 .ctx.count = count,
316 .ctx.dt_flags_mask = FILLDIR_FLAG_NOINTR,
317 .current_dir = dirent
318 };
319 int error;
320
321 if (fd_empty(f))
322 return -EBADF;
323
324 error = iterate_dir(fd_file(f), &buf.ctx);
325 if (error >= 0)
326 error = buf.error;
327 if (buf.prev_reclen) {
328 struct linux_dirent __user * lastdirent;
329 lastdirent = (void __user *)buf.current_dir - buf.prev_reclen;
330
331 if (put_user(buf.ctx.pos, &lastdirent->d_off))
332 error = -EFAULT;
333 else
334 error = count - buf.ctx.count;
335 }
336 return error;
337 }
338
339 struct getdents_callback64 {
340 struct dir_context ctx;
341 struct linux_dirent64 __user * current_dir;
342 int prev_reclen;
343 int error;
344 };
345
filldir64(struct dir_context * ctx,const char * name,int namlen,loff_t offset,u64 ino,unsigned int d_type)346 static bool filldir64(struct dir_context *ctx, const char *name, int namlen,
347 loff_t offset, u64 ino, unsigned int d_type)
348 {
349 struct linux_dirent64 __user *dirent, *prev;
350 struct getdents_callback64 *buf =
351 container_of(ctx, struct getdents_callback64, ctx);
352 int reclen = ALIGN(dirent_size(dirent, namlen + 1), sizeof(u64));
353 int prev_reclen;
354 unsigned int flags = d_type;
355
356 BUILD_BUG_ON(FILLDIR_FLAG_NOINTR & S_DT_MASK);
357 d_type &= S_DT_MASK;
358
359 buf->error = verify_dirent_name(name, namlen);
360 if (unlikely(buf->error))
361 return false;
362 buf->error = -EINVAL; /* only used if we fail.. */
363 if (reclen > ctx->count)
364 return false;
365 prev_reclen = buf->prev_reclen;
366 if (!(flags & FILLDIR_FLAG_NOINTR) && prev_reclen && signal_pending(current))
367 return false;
368 dirent = buf->current_dir;
369 prev = (void __user *)dirent - prev_reclen;
370 scoped_user_write_access_size(prev, reclen + prev_reclen, efault) {
371 /* This might be 'dirent->d_off', but if so it will get overwritten */
372 unsafe_put_user(offset, &prev->d_off, efault);
373 unsafe_put_user(ino, &dirent->d_ino, efault);
374 unsafe_put_user(reclen, &dirent->d_reclen, efault);
375 unsafe_put_user(d_type, &dirent->d_type, efault);
376 unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault);
377 }
378
379 buf->prev_reclen = reclen;
380 buf->current_dir = (void __user *)dirent + reclen;
381 ctx->count -= reclen;
382 return true;
383
384 efault:
385 buf->error = -EFAULT;
386 return false;
387 }
388
SYSCALL_DEFINE3(getdents64,unsigned int,fd,struct linux_dirent64 __user *,dirent,unsigned int,count)389 SYSCALL_DEFINE3(getdents64, unsigned int, fd,
390 struct linux_dirent64 __user *, dirent, unsigned int, count)
391 {
392 CLASS(fd_pos, f)(fd);
393 struct getdents_callback64 buf = {
394 .ctx.actor = filldir64,
395 .ctx.count = count,
396 .ctx.dt_flags_mask = FILLDIR_FLAG_NOINTR,
397 .current_dir = dirent
398 };
399 int error;
400
401 if (fd_empty(f))
402 return -EBADF;
403
404 error = iterate_dir(fd_file(f), &buf.ctx);
405 if (error >= 0)
406 error = buf.error;
407 if (buf.prev_reclen) {
408 struct linux_dirent64 __user * lastdirent;
409 typeof(lastdirent->d_off) d_off = buf.ctx.pos;
410
411 lastdirent = (void __user *) buf.current_dir - buf.prev_reclen;
412 if (put_user(d_off, &lastdirent->d_off))
413 error = -EFAULT;
414 else
415 error = count - buf.ctx.count;
416 }
417 return error;
418 }
419
420 #ifdef CONFIG_COMPAT
421 struct compat_old_linux_dirent {
422 compat_ulong_t d_ino;
423 compat_ulong_t d_offset;
424 unsigned short d_namlen;
425 char d_name[];
426 };
427
428 struct compat_readdir_callback {
429 struct dir_context ctx;
430 struct compat_old_linux_dirent __user *dirent;
431 int result;
432 };
433
compat_fillonedir(struct dir_context * ctx,const char * name,int namlen,loff_t offset,u64 ino,unsigned int d_type)434 static bool compat_fillonedir(struct dir_context *ctx, const char *name,
435 int namlen, loff_t offset, u64 ino,
436 unsigned int d_type)
437 {
438 struct compat_readdir_callback *buf =
439 container_of(ctx, struct compat_readdir_callback, ctx);
440 struct compat_old_linux_dirent __user *dirent;
441 compat_ulong_t d_ino;
442
443 if (buf->result)
444 return false;
445 buf->result = verify_dirent_name(name, namlen);
446 if (buf->result)
447 return false;
448 d_ino = ino;
449 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
450 buf->result = -EOVERFLOW;
451 return false;
452 }
453 buf->result++;
454 dirent = buf->dirent;
455 scoped_user_write_access_size(dirent, dirent_size(dirent, namlen + 1), efault) {
456 unsafe_put_user(d_ino, &dirent->d_ino, efault);
457 unsafe_put_user(offset, &dirent->d_offset, efault);
458 unsafe_put_user(namlen, &dirent->d_namlen, efault);
459 unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault);
460 }
461 return true;
462 efault:
463 buf->result = -EFAULT;
464 return false;
465 }
466
COMPAT_SYSCALL_DEFINE3(old_readdir,unsigned int,fd,struct compat_old_linux_dirent __user *,dirent,unsigned int,count)467 COMPAT_SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
468 struct compat_old_linux_dirent __user *, dirent, unsigned int, count)
469 {
470 int error;
471 CLASS(fd_pos, f)(fd);
472 struct compat_readdir_callback buf = {
473 .ctx.actor = compat_fillonedir,
474 .ctx.count = 1, /* Hint to fs: just one entry. */
475 .dirent = dirent
476 };
477
478 if (fd_empty(f))
479 return -EBADF;
480
481 error = iterate_dir(fd_file(f), &buf.ctx);
482 if (buf.result)
483 error = buf.result;
484
485 return error;
486 }
487
488 struct compat_linux_dirent {
489 compat_ulong_t d_ino;
490 compat_ulong_t d_off;
491 unsigned short d_reclen;
492 char d_name[];
493 };
494
495 struct compat_getdents_callback {
496 struct dir_context ctx;
497 struct compat_linux_dirent __user *current_dir;
498 int prev_reclen;
499 int error;
500 };
501
compat_filldir(struct dir_context * ctx,const char * name,int namlen,loff_t offset,u64 ino,unsigned int d_type)502 static bool compat_filldir(struct dir_context *ctx, const char *name, int namlen,
503 loff_t offset, u64 ino, unsigned int d_type)
504 {
505 struct compat_linux_dirent __user *dirent, *prev;
506 struct compat_getdents_callback *buf =
507 container_of(ctx, struct compat_getdents_callback, ctx);
508 compat_ulong_t d_ino;
509 int reclen = ALIGN(dirent_size(dirent, namlen + 2), sizeof(compat_long_t));
510 int prev_reclen;
511 unsigned int flags = d_type;
512
513 BUILD_BUG_ON(FILLDIR_FLAG_NOINTR & S_DT_MASK);
514 d_type &= S_DT_MASK;
515
516 buf->error = verify_dirent_name(name, namlen);
517 if (unlikely(buf->error))
518 return false;
519 buf->error = -EINVAL; /* only used if we fail.. */
520 if (reclen > ctx->count)
521 return false;
522 d_ino = ino;
523 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
524 buf->error = -EOVERFLOW;
525 return false;
526 }
527 prev_reclen = buf->prev_reclen;
528 if (!(flags & FILLDIR_FLAG_NOINTR) && prev_reclen && signal_pending(current))
529 return false;
530 dirent = buf->current_dir;
531 prev = (void __user *) dirent - prev_reclen;
532 scoped_user_write_access_size(prev, reclen + prev_reclen, efault) {
533 unsafe_put_user(offset, &prev->d_off, efault);
534 unsafe_put_user(d_ino, &dirent->d_ino, efault);
535 unsafe_put_user(reclen, &dirent->d_reclen, efault);
536 unsafe_put_user(d_type, (char __user *)dirent + reclen - 1, efault);
537 unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault);
538 }
539
540 buf->prev_reclen = reclen;
541 buf->current_dir = (void __user *)dirent + reclen;
542 ctx->count -= reclen;
543 return true;
544 efault:
545 buf->error = -EFAULT;
546 return false;
547 }
548
COMPAT_SYSCALL_DEFINE3(getdents,unsigned int,fd,struct compat_linux_dirent __user *,dirent,unsigned int,count)549 COMPAT_SYSCALL_DEFINE3(getdents, unsigned int, fd,
550 struct compat_linux_dirent __user *, dirent, unsigned int, count)
551 {
552 CLASS(fd_pos, f)(fd);
553 struct compat_getdents_callback buf = {
554 .ctx.actor = compat_filldir,
555 .ctx.count = count,
556 .ctx.dt_flags_mask = FILLDIR_FLAG_NOINTR,
557 .current_dir = dirent,
558 };
559 int error;
560
561 if (fd_empty(f))
562 return -EBADF;
563
564 error = iterate_dir(fd_file(f), &buf.ctx);
565 if (error >= 0)
566 error = buf.error;
567 if (buf.prev_reclen) {
568 struct compat_linux_dirent __user * lastdirent;
569 lastdirent = (void __user *)buf.current_dir - buf.prev_reclen;
570
571 if (put_user(buf.ctx.pos, &lastdirent->d_off))
572 error = -EFAULT;
573 else
574 error = count - buf.ctx.count;
575 }
576 return error;
577 }
578 #endif
579