1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * (c) UNIX System Laboratories, Inc. 7 * All or some portions of this file are derived from material licensed 8 * to the University of California by American Telephone and Telegraph 9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 10 * the permission of UNIX System Laboratories, Inc. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#)vfs_lookup.c 8.4 (Berkeley) 2/16/94 37 */ 38 39 #include <sys/cdefs.h> 40 __FBSDID("$FreeBSD$"); 41 42 #include "opt_capsicum.h" 43 #include "opt_ktrace.h" 44 45 #include <sys/param.h> 46 #include <sys/systm.h> 47 #include <sys/dirent.h> 48 #include <sys/kernel.h> 49 #include <sys/capsicum.h> 50 #include <sys/fcntl.h> 51 #include <sys/jail.h> 52 #include <sys/lock.h> 53 #include <sys/mutex.h> 54 #include <sys/namei.h> 55 #include <sys/vnode.h> 56 #include <sys/mount.h> 57 #include <sys/filedesc.h> 58 #include <sys/proc.h> 59 #include <sys/sdt.h> 60 #include <sys/syscallsubr.h> 61 #include <sys/sysctl.h> 62 #ifdef KTRACE 63 #include <sys/ktrace.h> 64 #endif 65 #ifdef INVARIANTS 66 #include <machine/_inttypes.h> 67 #endif 68 69 #include <security/audit/audit.h> 70 #include <security/mac/mac_framework.h> 71 72 #include <vm/uma.h> 73 74 #define NAMEI_DIAGNOSTIC 1 75 #undef NAMEI_DIAGNOSTIC 76 77 SDT_PROVIDER_DEFINE(vfs); 78 SDT_PROBE_DEFINE4(vfs, namei, lookup, entry, "struct vnode *", "char *", 79 "unsigned long", "bool"); 80 SDT_PROBE_DEFINE4(vfs, namei, lookup, return, "int", "struct vnode *", "bool", 81 "struct nameidata"); 82 83 /* Allocation zone for namei. */ 84 uma_zone_t namei_zone; 85 86 /* Placeholder vnode for mp traversal. */ 87 static struct vnode *vp_crossmp; 88 89 static int 90 crossmp_vop_islocked(struct vop_islocked_args *ap) 91 { 92 93 return (LK_SHARED); 94 } 95 96 static int 97 crossmp_vop_lock1(struct vop_lock1_args *ap) 98 { 99 struct vnode *vp; 100 struct lock *lk __unused; 101 const char *file __unused; 102 int flags, line __unused; 103 104 vp = ap->a_vp; 105 lk = vp->v_vnlock; 106 flags = ap->a_flags; 107 file = ap->a_file; 108 line = ap->a_line; 109 110 if ((flags & LK_SHARED) == 0) 111 panic("invalid lock request for crossmp"); 112 113 WITNESS_CHECKORDER(&lk->lock_object, LOP_NEWORDER, file, line, 114 flags & LK_INTERLOCK ? &VI_MTX(vp)->lock_object : NULL); 115 WITNESS_LOCK(&lk->lock_object, 0, file, line); 116 if ((flags & LK_INTERLOCK) != 0) 117 VI_UNLOCK(vp); 118 LOCK_LOG_LOCK("SLOCK", &lk->lock_object, 0, 0, ap->a_file, line); 119 return (0); 120 } 121 122 static int 123 crossmp_vop_unlock(struct vop_unlock_args *ap) 124 { 125 struct vnode *vp; 126 struct lock *lk __unused; 127 128 vp = ap->a_vp; 129 lk = vp->v_vnlock; 130 131 WITNESS_UNLOCK(&lk->lock_object, 0, LOCK_FILE, LOCK_LINE); 132 LOCK_LOG_LOCK("SUNLOCK", &lk->lock_object, 0, 0, LOCK_FILE, 133 LOCK_LINE); 134 return (0); 135 } 136 137 static struct vop_vector crossmp_vnodeops = { 138 .vop_default = &default_vnodeops, 139 .vop_islocked = crossmp_vop_islocked, 140 .vop_lock1 = crossmp_vop_lock1, 141 .vop_unlock = crossmp_vop_unlock, 142 }; 143 /* 144 * VFS_VOP_VECTOR_REGISTER(crossmp_vnodeops) is not used here since the vnode 145 * gets allocated early. See nameiinit for the direct call below. 146 */ 147 148 struct nameicap_tracker { 149 struct vnode *dp; 150 TAILQ_ENTRY(nameicap_tracker) nm_link; 151 }; 152 153 /* Zone for cap mode tracker elements used for dotdot capability checks. */ 154 MALLOC_DEFINE(M_NAMEITRACKER, "namei_tracker", "namei tracking for dotdot"); 155 156 static void 157 nameiinit(void *dummy __unused) 158 { 159 160 namei_zone = uma_zcreate("NAMEI", MAXPATHLEN, NULL, NULL, NULL, NULL, 161 UMA_ALIGN_PTR, 0); 162 vfs_vector_op_register(&crossmp_vnodeops); 163 getnewvnode("crossmp", NULL, &crossmp_vnodeops, &vp_crossmp); 164 } 165 SYSINIT(vfs, SI_SUB_VFS, SI_ORDER_SECOND, nameiinit, NULL); 166 167 static int lookup_cap_dotdot = 1; 168 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot, CTLFLAG_RWTUN, 169 &lookup_cap_dotdot, 0, 170 "enables \"..\" components in path lookup in capability mode"); 171 static int lookup_cap_dotdot_nonlocal = 1; 172 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot_nonlocal, CTLFLAG_RWTUN, 173 &lookup_cap_dotdot_nonlocal, 0, 174 "enables \"..\" components in path lookup in capability mode " 175 "on non-local mount"); 176 177 static void 178 nameicap_tracker_add(struct nameidata *ndp, struct vnode *dp) 179 { 180 struct nameicap_tracker *nt; 181 struct componentname *cnp; 182 183 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0 || dp->v_type != VDIR) 184 return; 185 cnp = &ndp->ni_cnd; 186 nt = TAILQ_LAST(&ndp->ni_cap_tracker, nameicap_tracker_head); 187 if (nt != NULL && nt->dp == dp) 188 return; 189 nt = malloc(sizeof(*nt), M_NAMEITRACKER, M_WAITOK); 190 vhold(dp); 191 nt->dp = dp; 192 TAILQ_INSERT_TAIL(&ndp->ni_cap_tracker, nt, nm_link); 193 } 194 195 static void 196 nameicap_cleanup_from(struct nameidata *ndp, struct nameicap_tracker *first) 197 { 198 struct nameicap_tracker *nt, *nt1; 199 200 nt = first; 201 TAILQ_FOREACH_FROM_SAFE(nt, &ndp->ni_cap_tracker, nm_link, nt1) { 202 TAILQ_REMOVE(&ndp->ni_cap_tracker, nt, nm_link); 203 vdrop(nt->dp); 204 free(nt, M_NAMEITRACKER); 205 } 206 } 207 208 static void 209 nameicap_cleanup(struct nameidata *ndp) 210 { 211 KASSERT(TAILQ_EMPTY(&ndp->ni_cap_tracker) || 212 (ndp->ni_lcf & NI_LCF_CAP_DOTDOT) != 0, ("not strictrelative")); 213 nameicap_cleanup_from(ndp, NULL); 214 } 215 216 /* 217 * For dotdot lookups in capability mode, only allow the component 218 * lookup to succeed if the resulting directory was already traversed 219 * during the operation. This catches situations where already 220 * traversed directory is moved to different parent, and then we walk 221 * over it with dotdots. 222 * 223 * Also allow to force failure of dotdot lookups for non-local 224 * filesystems, where external agents might assist local lookups to 225 * escape the compartment. 226 */ 227 static int 228 nameicap_check_dotdot(struct nameidata *ndp, struct vnode *dp) 229 { 230 struct nameicap_tracker *nt; 231 struct mount *mp; 232 233 if (dp == NULL || dp->v_type != VDIR || (ndp->ni_lcf & 234 NI_LCF_STRICTRELATIVE) == 0) 235 return (0); 236 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0) 237 return (ENOTCAPABLE); 238 mp = dp->v_mount; 239 if (lookup_cap_dotdot_nonlocal == 0 && mp != NULL && 240 (mp->mnt_flag & MNT_LOCAL) == 0) 241 return (ENOTCAPABLE); 242 TAILQ_FOREACH_REVERSE(nt, &ndp->ni_cap_tracker, nameicap_tracker_head, 243 nm_link) { 244 if (dp == nt->dp) { 245 nt = TAILQ_NEXT(nt, nm_link); 246 if (nt != NULL) 247 nameicap_cleanup_from(ndp, nt); 248 return (0); 249 } 250 } 251 return (ENOTCAPABLE); 252 } 253 254 static void 255 namei_cleanup_cnp(struct componentname *cnp) 256 { 257 258 uma_zfree(namei_zone, cnp->cn_pnbuf); 259 #ifdef DIAGNOSTIC 260 cnp->cn_pnbuf = NULL; 261 cnp->cn_nameptr = NULL; 262 #endif 263 } 264 265 static int 266 namei_handle_root(struct nameidata *ndp, struct vnode **dpp) 267 { 268 struct componentname *cnp; 269 270 cnp = &ndp->ni_cnd; 271 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0) { 272 #ifdef KTRACE 273 if (KTRPOINT(curthread, KTR_CAPFAIL)) 274 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 275 #endif 276 return (ENOTCAPABLE); 277 } 278 while (*(cnp->cn_nameptr) == '/') { 279 cnp->cn_nameptr++; 280 ndp->ni_pathlen--; 281 } 282 *dpp = ndp->ni_rootdir; 283 vrefact(*dpp); 284 return (0); 285 } 286 287 static int 288 namei_setup(struct nameidata *ndp, struct vnode **dpp, struct pwd **pwdp) 289 { 290 struct componentname *cnp; 291 struct file *dfp; 292 struct thread *td; 293 struct pwd *pwd; 294 cap_rights_t rights; 295 int error; 296 bool startdir_used; 297 298 cnp = &ndp->ni_cnd; 299 td = cnp->cn_thread; 300 301 startdir_used = false; 302 *pwdp = NULL; 303 *dpp = NULL; 304 305 #ifdef CAPABILITY_MODE 306 /* 307 * In capability mode, lookups must be restricted to happen in 308 * the subtree with the root specified by the file descriptor: 309 * - The root must be real file descriptor, not the pseudo-descriptor 310 * AT_FDCWD. 311 * - The passed path must be relative and not absolute. 312 * - If lookup_cap_dotdot is disabled, path must not contain the 313 * '..' components. 314 * - If lookup_cap_dotdot is enabled, we verify that all '..' 315 * components lookups result in the directories which were 316 * previously walked by us, which prevents an escape from 317 * the relative root. 318 */ 319 if (IN_CAPABILITY_MODE(td) && (cnp->cn_flags & NOCAPCHECK) == 0) { 320 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE; 321 ndp->ni_resflags |= NIRES_STRICTREL; 322 if (ndp->ni_dirfd == AT_FDCWD) { 323 #ifdef KTRACE 324 if (KTRPOINT(td, KTR_CAPFAIL)) 325 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 326 #endif 327 return (ECAPMODE); 328 } 329 } 330 #endif 331 error = 0; 332 333 /* 334 * Get starting point for the translation. 335 */ 336 pwd = pwd_hold(td); 337 /* 338 * The reference on ni_rootdir is acquired in the block below to avoid 339 * back-to-back atomics for absolute lookups. 340 */ 341 ndp->ni_rootdir = pwd->pwd_rdir; 342 ndp->ni_topdir = pwd->pwd_jdir; 343 344 if (cnp->cn_pnbuf[0] == '/') { 345 ndp->ni_resflags |= NIRES_ABS; 346 error = namei_handle_root(ndp, dpp); 347 } else { 348 if (ndp->ni_startdir != NULL) { 349 *dpp = ndp->ni_startdir; 350 startdir_used = true; 351 } else if (ndp->ni_dirfd == AT_FDCWD) { 352 *dpp = pwd->pwd_cdir; 353 vrefact(*dpp); 354 } else { 355 rights = *ndp->ni_rightsneeded; 356 cap_rights_set_one(&rights, CAP_LOOKUP); 357 358 if (cnp->cn_flags & AUDITVNODE1) 359 AUDIT_ARG_ATFD1(ndp->ni_dirfd); 360 if (cnp->cn_flags & AUDITVNODE2) 361 AUDIT_ARG_ATFD2(ndp->ni_dirfd); 362 /* 363 * Effectively inlined fgetvp_rights, because we need to 364 * inspect the file as well as grabbing the vnode. 365 */ 366 error = fget_cap(td, ndp->ni_dirfd, &rights, 367 &dfp, &ndp->ni_filecaps); 368 if (error != 0) { 369 /* 370 * Preserve the error; it should either be EBADF 371 * or capability-related, both of which can be 372 * safely returned to the caller. 373 */ 374 } else { 375 if (dfp->f_ops == &badfileops) { 376 error = EBADF; 377 } else if (dfp->f_vnode == NULL) { 378 error = ENOTDIR; 379 } else { 380 *dpp = dfp->f_vnode; 381 vrefact(*dpp); 382 383 if ((dfp->f_flag & FSEARCH) != 0) 384 cnp->cn_flags |= NOEXECCHECK; 385 } 386 fdrop(dfp, td); 387 } 388 #ifdef CAPABILITIES 389 /* 390 * If file descriptor doesn't have all rights, 391 * all lookups relative to it must also be 392 * strictly relative. 393 */ 394 CAP_ALL(&rights); 395 if (!cap_rights_contains(&ndp->ni_filecaps.fc_rights, 396 &rights) || 397 ndp->ni_filecaps.fc_fcntls != CAP_FCNTL_ALL || 398 ndp->ni_filecaps.fc_nioctls != -1) { 399 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE; 400 ndp->ni_resflags |= NIRES_STRICTREL; 401 } 402 #endif 403 } 404 if (error == 0 && (*dpp)->v_type != VDIR) 405 error = ENOTDIR; 406 } 407 if (error == 0 && (cnp->cn_flags & RBENEATH) != 0) { 408 if (cnp->cn_pnbuf[0] == '/') { 409 error = ENOTCAPABLE; 410 } else if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) == 0) { 411 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE | 412 NI_LCF_CAP_DOTDOT; 413 } 414 } 415 416 /* 417 * If we are auditing the kernel pathname, save the user pathname. 418 */ 419 if (cnp->cn_flags & AUDITVNODE1) 420 AUDIT_ARG_UPATH1_VP(td, ndp->ni_rootdir, *dpp, cnp->cn_pnbuf); 421 if (cnp->cn_flags & AUDITVNODE2) 422 AUDIT_ARG_UPATH2_VP(td, ndp->ni_rootdir, *dpp, cnp->cn_pnbuf); 423 if (ndp->ni_startdir != NULL && !startdir_used) 424 vrele(ndp->ni_startdir); 425 if (error != 0) { 426 if (*dpp != NULL) 427 vrele(*dpp); 428 pwd_drop(pwd); 429 return (error); 430 } 431 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0 && 432 lookup_cap_dotdot != 0) 433 ndp->ni_lcf |= NI_LCF_CAP_DOTDOT; 434 SDT_PROBE4(vfs, namei, lookup, entry, *dpp, cnp->cn_pnbuf, 435 cnp->cn_flags, false); 436 *pwdp = pwd; 437 return (0); 438 } 439 440 static int 441 namei_getpath(struct nameidata *ndp) 442 { 443 struct componentname *cnp; 444 int error; 445 446 cnp = &ndp->ni_cnd; 447 448 /* 449 * Get a buffer for the name to be translated, and copy the 450 * name into the buffer. 451 */ 452 cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK); 453 if (ndp->ni_segflg == UIO_SYSSPACE) { 454 error = copystr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 455 &ndp->ni_pathlen); 456 } else { 457 error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 458 &ndp->ni_pathlen); 459 } 460 461 if (__predict_false(error != 0)) { 462 namei_cleanup_cnp(cnp); 463 return (error); 464 } 465 466 /* 467 * Don't allow empty pathnames. 468 */ 469 if (__predict_false(*cnp->cn_pnbuf == '\0')) { 470 namei_cleanup_cnp(cnp); 471 return (ENOENT); 472 } 473 474 cnp->cn_nameptr = cnp->cn_pnbuf; 475 return (0); 476 } 477 478 /* 479 * Convert a pathname into a pointer to a locked vnode. 480 * 481 * The FOLLOW flag is set when symbolic links are to be followed 482 * when they occur at the end of the name translation process. 483 * Symbolic links are always followed for all other pathname 484 * components other than the last. 485 * 486 * The segflg defines whether the name is to be copied from user 487 * space or kernel space. 488 * 489 * Overall outline of namei: 490 * 491 * copy in name 492 * get starting directory 493 * while (!done && !error) { 494 * call lookup to search path. 495 * if symbolic link, massage name in buffer and continue 496 * } 497 */ 498 int 499 namei(struct nameidata *ndp) 500 { 501 char *cp; /* pointer into pathname argument */ 502 struct vnode *dp; /* the directory we are searching */ 503 struct iovec aiov; /* uio for reading symbolic links */ 504 struct componentname *cnp; 505 struct thread *td; 506 struct pwd *pwd; 507 struct uio auio; 508 int error, linklen; 509 enum cache_fpl_status status; 510 511 cnp = &ndp->ni_cnd; 512 td = cnp->cn_thread; 513 #ifdef INVARIANTS 514 KASSERT((ndp->ni_debugflags & NAMEI_DBG_CALLED) == 0, 515 ("%s: repeated call to namei without NDREINIT", __func__)); 516 KASSERT(ndp->ni_debugflags == NAMEI_DBG_INITED, 517 ("%s: bad debugflags %d", __func__, ndp->ni_debugflags)); 518 ndp->ni_debugflags |= NAMEI_DBG_CALLED; 519 if (ndp->ni_startdir != NULL) 520 ndp->ni_debugflags |= NAMEI_DBG_HADSTARTDIR; 521 if (cnp->cn_flags & FAILIFEXISTS) { 522 KASSERT(cnp->cn_nameiop == CREATE, 523 ("%s: FAILIFEXISTS passed for op %d", __func__, cnp->cn_nameiop)); 524 /* 525 * The limitation below is to restrict hairy corner cases. 526 */ 527 KASSERT((cnp->cn_flags & (LOCKPARENT | LOCKLEAF)) == LOCKPARENT, 528 ("%s: FAILIFEXISTS must be passed with LOCKPARENT and without LOCKLEAF", 529 __func__)); 530 } 531 /* 532 * For NDVALIDATE. 533 * 534 * While NDINIT may seem like a more natural place to do it, there are 535 * callers which directly modify flags past invoking init. 536 */ 537 cnp->cn_origflags = cnp->cn_flags; 538 #endif 539 ndp->ni_cnd.cn_cred = ndp->ni_cnd.cn_thread->td_ucred; 540 KASSERT(ndp->ni_resflags == 0, ("%s: garbage in ni_resflags: %x\n", 541 __func__, ndp->ni_resflags)); 542 KASSERT(cnp->cn_cred && td->td_proc, ("namei: bad cred/proc")); 543 KASSERT((cnp->cn_flags & NAMEI_INTERNAL_FLAGS) == 0, 544 ("namei: unexpected flags: %" PRIx64 "\n", 545 cnp->cn_flags & NAMEI_INTERNAL_FLAGS)); 546 if (cnp->cn_flags & NOCACHE) 547 KASSERT(cnp->cn_nameiop != LOOKUP, 548 ("%s: NOCACHE passed with LOOKUP", __func__)); 549 MPASS(ndp->ni_startdir == NULL || ndp->ni_startdir->v_type == VDIR || 550 ndp->ni_startdir->v_type == VBAD); 551 552 ndp->ni_lcf = 0; 553 ndp->ni_loopcnt = 0; 554 ndp->ni_vp = NULL; 555 556 error = namei_getpath(ndp); 557 if (__predict_false(error != 0)) { 558 return (error); 559 } 560 561 #ifdef KTRACE 562 if (KTRPOINT(td, KTR_NAMEI)) { 563 KASSERT(cnp->cn_thread == curthread, 564 ("namei not using curthread")); 565 ktrnamei(cnp->cn_pnbuf); 566 } 567 #endif 568 569 /* 570 * First try looking up the target without locking any vnodes. 571 * 572 * We may need to start from scratch or pick up where it left off. 573 */ 574 error = cache_fplookup(ndp, &status, &pwd); 575 switch (status) { 576 case CACHE_FPL_STATUS_UNSET: 577 __assert_unreachable(); 578 break; 579 case CACHE_FPL_STATUS_HANDLED: 580 if (error == 0) 581 NDVALIDATE(ndp); 582 return (error); 583 case CACHE_FPL_STATUS_PARTIAL: 584 TAILQ_INIT(&ndp->ni_cap_tracker); 585 dp = ndp->ni_startdir; 586 break; 587 case CACHE_FPL_STATUS_DESTROYED: 588 ndp->ni_loopcnt = 0; 589 error = namei_getpath(ndp); 590 if (__predict_false(error != 0)) { 591 return (error); 592 } 593 /* FALLTHROUGH */ 594 case CACHE_FPL_STATUS_ABORTED: 595 TAILQ_INIT(&ndp->ni_cap_tracker); 596 MPASS(ndp->ni_lcf == 0); 597 error = namei_setup(ndp, &dp, &pwd); 598 if (error != 0) { 599 namei_cleanup_cnp(cnp); 600 return (error); 601 } 602 break; 603 } 604 605 /* 606 * Locked lookup. 607 */ 608 for (;;) { 609 ndp->ni_startdir = dp; 610 error = lookup(ndp); 611 if (error != 0) 612 goto out; 613 614 /* 615 * If not a symbolic link, we're done. 616 */ 617 if ((cnp->cn_flags & ISSYMLINK) == 0) { 618 SDT_PROBE4(vfs, namei, lookup, return, error, 619 (error == 0 ? ndp->ni_vp : NULL), false, ndp); 620 if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0) { 621 namei_cleanup_cnp(cnp); 622 } else 623 cnp->cn_flags |= HASBUF; 624 nameicap_cleanup(ndp); 625 pwd_drop(pwd); 626 if (error == 0) 627 NDVALIDATE(ndp); 628 return (error); 629 } 630 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) { 631 error = ELOOP; 632 break; 633 } 634 #ifdef MAC 635 if ((cnp->cn_flags & NOMACCHECK) == 0) { 636 error = mac_vnode_check_readlink(td->td_ucred, 637 ndp->ni_vp); 638 if (error != 0) 639 break; 640 } 641 #endif 642 if (ndp->ni_pathlen > 1) 643 cp = uma_zalloc(namei_zone, M_WAITOK); 644 else 645 cp = cnp->cn_pnbuf; 646 aiov.iov_base = cp; 647 aiov.iov_len = MAXPATHLEN; 648 auio.uio_iov = &aiov; 649 auio.uio_iovcnt = 1; 650 auio.uio_offset = 0; 651 auio.uio_rw = UIO_READ; 652 auio.uio_segflg = UIO_SYSSPACE; 653 auio.uio_td = td; 654 auio.uio_resid = MAXPATHLEN; 655 error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred); 656 if (error != 0) { 657 if (ndp->ni_pathlen > 1) 658 uma_zfree(namei_zone, cp); 659 break; 660 } 661 linklen = MAXPATHLEN - auio.uio_resid; 662 if (linklen == 0) { 663 if (ndp->ni_pathlen > 1) 664 uma_zfree(namei_zone, cp); 665 error = ENOENT; 666 break; 667 } 668 if (linklen + ndp->ni_pathlen > MAXPATHLEN) { 669 if (ndp->ni_pathlen > 1) 670 uma_zfree(namei_zone, cp); 671 error = ENAMETOOLONG; 672 break; 673 } 674 if (ndp->ni_pathlen > 1) { 675 bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen); 676 uma_zfree(namei_zone, cnp->cn_pnbuf); 677 cnp->cn_pnbuf = cp; 678 } else 679 cnp->cn_pnbuf[linklen] = '\0'; 680 ndp->ni_pathlen += linklen; 681 vput(ndp->ni_vp); 682 dp = ndp->ni_dvp; 683 /* 684 * Check if root directory should replace current directory. 685 */ 686 cnp->cn_nameptr = cnp->cn_pnbuf; 687 if (*(cnp->cn_nameptr) == '/') { 688 vrele(dp); 689 error = namei_handle_root(ndp, &dp); 690 if (error != 0) 691 goto out; 692 } 693 } 694 vput(ndp->ni_vp); 695 ndp->ni_vp = NULL; 696 vrele(ndp->ni_dvp); 697 out: 698 MPASS(error != 0); 699 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, false, ndp); 700 namei_cleanup_cnp(cnp); 701 nameicap_cleanup(ndp); 702 pwd_drop(pwd); 703 return (error); 704 } 705 706 static int 707 compute_cn_lkflags(struct mount *mp, int lkflags, int cnflags) 708 { 709 710 if (mp == NULL || ((lkflags & LK_SHARED) && 711 (!(mp->mnt_kern_flag & MNTK_LOOKUP_SHARED) || 712 ((cnflags & ISDOTDOT) && 713 (mp->mnt_kern_flag & MNTK_LOOKUP_EXCL_DOTDOT))))) { 714 lkflags &= ~LK_SHARED; 715 lkflags |= LK_EXCLUSIVE; 716 } 717 lkflags |= LK_NODDLKTREAT; 718 return (lkflags); 719 } 720 721 static __inline int 722 needs_exclusive_leaf(struct mount *mp, int flags) 723 { 724 725 /* 726 * Intermediate nodes can use shared locks, we only need to 727 * force an exclusive lock for leaf nodes. 728 */ 729 if ((flags & (ISLASTCN | LOCKLEAF)) != (ISLASTCN | LOCKLEAF)) 730 return (0); 731 732 /* Always use exclusive locks if LOCKSHARED isn't set. */ 733 if (!(flags & LOCKSHARED)) 734 return (1); 735 736 /* 737 * For lookups during open(), if the mount point supports 738 * extended shared operations, then use a shared lock for the 739 * leaf node, otherwise use an exclusive lock. 740 */ 741 if ((flags & ISOPEN) != 0) 742 return (!MNT_EXTENDED_SHARED(mp)); 743 744 /* 745 * Lookup requests outside of open() that specify LOCKSHARED 746 * only need a shared lock on the leaf vnode. 747 */ 748 return (0); 749 } 750 751 /* 752 * Various filesystems expect to be able to copy a name component with length 753 * bounded by NAME_MAX into a directory entry buffer of size MAXNAMLEN. Make 754 * sure that these are the same size. 755 */ 756 _Static_assert(MAXNAMLEN == NAME_MAX, 757 "MAXNAMLEN and NAME_MAX have different values"); 758 759 /* 760 * Search a pathname. 761 * This is a very central and rather complicated routine. 762 * 763 * The pathname is pointed to by ni_ptr and is of length ni_pathlen. 764 * The starting directory is taken from ni_startdir. The pathname is 765 * descended until done, or a symbolic link is encountered. The variable 766 * ni_more is clear if the path is completed; it is set to one if a 767 * symbolic link needing interpretation is encountered. 768 * 769 * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on 770 * whether the name is to be looked up, created, renamed, or deleted. 771 * When CREATE, RENAME, or DELETE is specified, information usable in 772 * creating, renaming, or deleting a directory entry may be calculated. 773 * If flag has LOCKPARENT or'ed into it, the parent directory is returned 774 * locked. If flag has WANTPARENT or'ed into it, the parent directory is 775 * returned unlocked. Otherwise the parent directory is not returned. If 776 * the target of the pathname exists and LOCKLEAF is or'ed into the flag 777 * the target is returned locked, otherwise it is returned unlocked. 778 * When creating or renaming and LOCKPARENT is specified, the target may not 779 * be ".". When deleting and LOCKPARENT is specified, the target may be ".". 780 * 781 * Overall outline of lookup: 782 * 783 * dirloop: 784 * identify next component of name at ndp->ni_ptr 785 * handle degenerate case where name is null string 786 * if .. and crossing mount points and on mounted filesys, find parent 787 * call VOP_LOOKUP routine for next component name 788 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set 789 * component vnode returned in ni_vp (if it exists), locked. 790 * if result vnode is mounted on and crossing mount points, 791 * find mounted on vnode 792 * if more components of name, do next level at dirloop 793 * return the answer in ni_vp, locked if LOCKLEAF set 794 * if LOCKPARENT set, return locked parent in ni_dvp 795 * if WANTPARENT set, return unlocked parent in ni_dvp 796 */ 797 int 798 lookup(struct nameidata *ndp) 799 { 800 char *cp; /* pointer into pathname argument */ 801 char *prev_ni_next; /* saved ndp->ni_next */ 802 struct vnode *dp = NULL; /* the directory we are searching */ 803 struct vnode *tdp; /* saved dp */ 804 struct mount *mp; /* mount table entry */ 805 struct prison *pr; 806 size_t prev_ni_pathlen; /* saved ndp->ni_pathlen */ 807 int docache; /* == 0 do not cache last component */ 808 int wantparent; /* 1 => wantparent or lockparent flag */ 809 int rdonly; /* lookup read-only flag bit */ 810 int error = 0; 811 int dpunlocked = 0; /* dp has already been unlocked */ 812 int relookup = 0; /* do not consume the path component */ 813 struct componentname *cnp = &ndp->ni_cnd; 814 int lkflags_save; 815 int ni_dvp_unlocked; 816 817 /* 818 * Setup: break out flag bits into variables. 819 */ 820 ni_dvp_unlocked = 0; 821 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); 822 KASSERT(cnp->cn_nameiop == LOOKUP || wantparent, 823 ("CREATE, DELETE, RENAME require LOCKPARENT or WANTPARENT.")); 824 /* 825 * When set to zero, docache causes the last component of the 826 * pathname to be deleted from the cache and the full lookup 827 * of the name to be done (via VOP_CACHEDLOOKUP()). Often 828 * filesystems need some pre-computed values that are made 829 * during the full lookup, for instance UFS sets dp->i_offset. 830 * 831 * The docache variable is set to zero when requested by the 832 * NOCACHE flag and for all modifying operations except CREATE. 833 */ 834 docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE; 835 if (cnp->cn_nameiop == DELETE || 836 (wantparent && cnp->cn_nameiop != CREATE && 837 cnp->cn_nameiop != LOOKUP)) 838 docache = 0; 839 rdonly = cnp->cn_flags & RDONLY; 840 cnp->cn_flags &= ~ISSYMLINK; 841 ndp->ni_dvp = NULL; 842 /* 843 * We use shared locks until we hit the parent of the last cn then 844 * we adjust based on the requesting flags. 845 */ 846 cnp->cn_lkflags = LK_SHARED; 847 dp = ndp->ni_startdir; 848 ndp->ni_startdir = NULLVP; 849 vn_lock(dp, 850 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | LK_RETRY, 851 cnp->cn_flags)); 852 853 dirloop: 854 /* 855 * Search a new directory. 856 * 857 * The last component of the filename is left accessible via 858 * cnp->cn_nameptr for callers that need the name. Callers needing 859 * the name set the SAVENAME flag. When done, they assume 860 * responsibility for freeing the pathname buffer. 861 */ 862 for (cp = cnp->cn_nameptr; *cp != 0 && *cp != '/'; cp++) 863 continue; 864 cnp->cn_namelen = cp - cnp->cn_nameptr; 865 if (cnp->cn_namelen > NAME_MAX) { 866 error = ENAMETOOLONG; 867 goto bad; 868 } 869 #ifdef NAMEI_DIAGNOSTIC 870 { char c = *cp; 871 *cp = '\0'; 872 printf("{%s}: ", cnp->cn_nameptr); 873 *cp = c; } 874 #endif 875 prev_ni_pathlen = ndp->ni_pathlen; 876 ndp->ni_pathlen -= cnp->cn_namelen; 877 KASSERT(ndp->ni_pathlen <= PATH_MAX, 878 ("%s: ni_pathlen underflow to %zd\n", __func__, ndp->ni_pathlen)); 879 prev_ni_next = ndp->ni_next; 880 ndp->ni_next = cp; 881 882 /* 883 * Replace multiple slashes by a single slash and trailing slashes 884 * by a null. This must be done before VOP_LOOKUP() because some 885 * fs's don't know about trailing slashes. Remember if there were 886 * trailing slashes to handle symlinks, existing non-directories 887 * and non-existing files that won't be directories specially later. 888 */ 889 while (*cp == '/' && (cp[1] == '/' || cp[1] == '\0')) { 890 cp++; 891 ndp->ni_pathlen--; 892 if (*cp == '\0') { 893 *ndp->ni_next = '\0'; 894 cnp->cn_flags |= TRAILINGSLASH; 895 } 896 } 897 ndp->ni_next = cp; 898 899 cnp->cn_flags |= MAKEENTRY; 900 if (*cp == '\0' && docache == 0) 901 cnp->cn_flags &= ~MAKEENTRY; 902 if (cnp->cn_namelen == 2 && 903 cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.') 904 cnp->cn_flags |= ISDOTDOT; 905 else 906 cnp->cn_flags &= ~ISDOTDOT; 907 if (*ndp->ni_next == 0) 908 cnp->cn_flags |= ISLASTCN; 909 else 910 cnp->cn_flags &= ~ISLASTCN; 911 912 if ((cnp->cn_flags & ISLASTCN) != 0 && 913 cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.' && 914 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 915 error = EINVAL; 916 goto bad; 917 } 918 919 nameicap_tracker_add(ndp, dp); 920 921 /* 922 * Check for degenerate name (e.g. / or "") 923 * which is a way of talking about a directory, 924 * e.g. like "/." or ".". 925 */ 926 if (cnp->cn_nameptr[0] == '\0') { 927 if (dp->v_type != VDIR) { 928 error = ENOTDIR; 929 goto bad; 930 } 931 if (cnp->cn_nameiop != LOOKUP) { 932 error = EISDIR; 933 goto bad; 934 } 935 if (wantparent) { 936 ndp->ni_dvp = dp; 937 VREF(dp); 938 } 939 ndp->ni_vp = dp; 940 941 if (cnp->cn_flags & AUDITVNODE1) 942 AUDIT_ARG_VNODE1(dp); 943 else if (cnp->cn_flags & AUDITVNODE2) 944 AUDIT_ARG_VNODE2(dp); 945 946 if (!(cnp->cn_flags & (LOCKPARENT | LOCKLEAF))) 947 VOP_UNLOCK(dp); 948 /* XXX This should probably move to the top of function. */ 949 if (cnp->cn_flags & SAVESTART) 950 panic("lookup: SAVESTART"); 951 goto success; 952 } 953 954 /* 955 * Handle "..": five special cases. 956 * 0. If doing a capability lookup and lookup_cap_dotdot is 957 * disabled, return ENOTCAPABLE. 958 * 1. Return an error if this is the last component of 959 * the name and the operation is DELETE or RENAME. 960 * 2. If at root directory (e.g. after chroot) 961 * or at absolute root directory 962 * then ignore it so can't get out. 963 * 3. If this vnode is the root of a mounted 964 * filesystem, then replace it with the 965 * vnode which was mounted on so we take the 966 * .. in the other filesystem. 967 * 4. If the vnode is the top directory of 968 * the jail or chroot, don't let them out. 969 * 5. If doing a capability lookup and lookup_cap_dotdot is 970 * enabled, return ENOTCAPABLE if the lookup would escape 971 * from the initial file descriptor directory. Checks are 972 * done by ensuring that namei() already traversed the 973 * result of dotdot lookup. 974 */ 975 if (cnp->cn_flags & ISDOTDOT) { 976 if ((ndp->ni_lcf & (NI_LCF_STRICTRELATIVE | NI_LCF_CAP_DOTDOT)) 977 == NI_LCF_STRICTRELATIVE) { 978 #ifdef KTRACE 979 if (KTRPOINT(curthread, KTR_CAPFAIL)) 980 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 981 #endif 982 error = ENOTCAPABLE; 983 goto bad; 984 } 985 if ((cnp->cn_flags & ISLASTCN) != 0 && 986 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 987 error = EINVAL; 988 goto bad; 989 } 990 for (;;) { 991 for (pr = cnp->cn_cred->cr_prison; pr != NULL; 992 pr = pr->pr_parent) 993 if (dp == pr->pr_root) 994 break; 995 if (dp == ndp->ni_rootdir || 996 dp == ndp->ni_topdir || 997 dp == rootvnode || 998 pr != NULL || 999 ((dp->v_vflag & VV_ROOT) != 0 && 1000 (cnp->cn_flags & NOCROSSMOUNT) != 0)) { 1001 ndp->ni_dvp = dp; 1002 ndp->ni_vp = dp; 1003 VREF(dp); 1004 goto nextname; 1005 } 1006 if ((dp->v_vflag & VV_ROOT) == 0) 1007 break; 1008 if (VN_IS_DOOMED(dp)) { /* forced unmount */ 1009 error = ENOENT; 1010 goto bad; 1011 } 1012 tdp = dp; 1013 dp = dp->v_mount->mnt_vnodecovered; 1014 VREF(dp); 1015 vput(tdp); 1016 vn_lock(dp, 1017 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 1018 LK_RETRY, ISDOTDOT)); 1019 error = nameicap_check_dotdot(ndp, dp); 1020 if (error != 0) { 1021 #ifdef KTRACE 1022 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1023 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1024 #endif 1025 goto bad; 1026 } 1027 } 1028 } 1029 1030 /* 1031 * We now have a segment name to search for, and a directory to search. 1032 */ 1033 unionlookup: 1034 #ifdef MAC 1035 error = mac_vnode_check_lookup(cnp->cn_thread->td_ucred, dp, cnp); 1036 if (error) 1037 goto bad; 1038 #endif 1039 ndp->ni_dvp = dp; 1040 ndp->ni_vp = NULL; 1041 ASSERT_VOP_LOCKED(dp, "lookup"); 1042 /* 1043 * If we have a shared lock we may need to upgrade the lock for the 1044 * last operation. 1045 */ 1046 if ((cnp->cn_flags & LOCKPARENT) && (cnp->cn_flags & ISLASTCN) && 1047 dp != vp_crossmp && VOP_ISLOCKED(dp) == LK_SHARED) 1048 vn_lock(dp, LK_UPGRADE|LK_RETRY); 1049 if (VN_IS_DOOMED(dp)) { 1050 error = ENOENT; 1051 goto bad; 1052 } 1053 /* 1054 * If we're looking up the last component and we need an exclusive 1055 * lock, adjust our lkflags. 1056 */ 1057 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags)) 1058 cnp->cn_lkflags = LK_EXCLUSIVE; 1059 #ifdef NAMEI_DIAGNOSTIC 1060 vn_printf(dp, "lookup in "); 1061 #endif 1062 lkflags_save = cnp->cn_lkflags; 1063 cnp->cn_lkflags = compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags, 1064 cnp->cn_flags); 1065 error = VOP_LOOKUP(dp, &ndp->ni_vp, cnp); 1066 cnp->cn_lkflags = lkflags_save; 1067 if (error != 0) { 1068 KASSERT(ndp->ni_vp == NULL, ("leaf should be empty")); 1069 #ifdef NAMEI_DIAGNOSTIC 1070 printf("not found\n"); 1071 #endif 1072 if ((error == ENOENT) && 1073 (dp->v_vflag & VV_ROOT) && (dp->v_mount != NULL) && 1074 (dp->v_mount->mnt_flag & MNT_UNION)) { 1075 tdp = dp; 1076 dp = dp->v_mount->mnt_vnodecovered; 1077 VREF(dp); 1078 vput(tdp); 1079 vn_lock(dp, 1080 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 1081 LK_RETRY, cnp->cn_flags)); 1082 nameicap_tracker_add(ndp, dp); 1083 goto unionlookup; 1084 } 1085 1086 if (error == ERELOOKUP) { 1087 vref(dp); 1088 ndp->ni_vp = dp; 1089 error = 0; 1090 relookup = 1; 1091 goto good; 1092 } 1093 1094 if (error != EJUSTRETURN) 1095 goto bad; 1096 /* 1097 * At this point, we know we're at the end of the 1098 * pathname. If creating / renaming, we can consider 1099 * allowing the file or directory to be created / renamed, 1100 * provided we're not on a read-only filesystem. 1101 */ 1102 if (rdonly) { 1103 error = EROFS; 1104 goto bad; 1105 } 1106 /* trailing slash only allowed for directories */ 1107 if ((cnp->cn_flags & TRAILINGSLASH) && 1108 !(cnp->cn_flags & WILLBEDIR)) { 1109 error = ENOENT; 1110 goto bad; 1111 } 1112 if ((cnp->cn_flags & LOCKPARENT) == 0) 1113 VOP_UNLOCK(dp); 1114 /* 1115 * We return with ni_vp NULL to indicate that the entry 1116 * doesn't currently exist, leaving a pointer to the 1117 * (possibly locked) directory vnode in ndp->ni_dvp. 1118 */ 1119 if (cnp->cn_flags & SAVESTART) { 1120 ndp->ni_startdir = ndp->ni_dvp; 1121 VREF(ndp->ni_startdir); 1122 } 1123 goto success; 1124 } 1125 1126 good: 1127 #ifdef NAMEI_DIAGNOSTIC 1128 printf("found\n"); 1129 #endif 1130 dp = ndp->ni_vp; 1131 1132 /* 1133 * Check to see if the vnode has been mounted on; 1134 * if so find the root of the mounted filesystem. 1135 */ 1136 while (dp->v_type == VDIR && (mp = dp->v_mountedhere) && 1137 (cnp->cn_flags & NOCROSSMOUNT) == 0) { 1138 if (vfs_busy(mp, 0)) 1139 continue; 1140 vput(dp); 1141 if (dp != ndp->ni_dvp) 1142 vput(ndp->ni_dvp); 1143 else 1144 vrele(ndp->ni_dvp); 1145 vrefact(vp_crossmp); 1146 ndp->ni_dvp = vp_crossmp; 1147 error = VFS_ROOT(mp, compute_cn_lkflags(mp, cnp->cn_lkflags, 1148 cnp->cn_flags), &tdp); 1149 vfs_unbusy(mp); 1150 if (vn_lock(vp_crossmp, LK_SHARED | LK_NOWAIT)) 1151 panic("vp_crossmp exclusively locked or reclaimed"); 1152 if (error) { 1153 dpunlocked = 1; 1154 goto bad2; 1155 } 1156 ndp->ni_vp = dp = tdp; 1157 } 1158 1159 /* 1160 * Check for symbolic link 1161 */ 1162 if ((dp->v_type == VLNK) && 1163 ((cnp->cn_flags & FOLLOW) || (cnp->cn_flags & TRAILINGSLASH) || 1164 *ndp->ni_next == '/')) { 1165 cnp->cn_flags |= ISSYMLINK; 1166 if (VN_IS_DOOMED(dp)) { 1167 /* 1168 * We can't know whether the directory was mounted with 1169 * NOSYMFOLLOW, so we can't follow safely. 1170 */ 1171 error = ENOENT; 1172 goto bad2; 1173 } 1174 if (dp->v_mount->mnt_flag & MNT_NOSYMFOLLOW) { 1175 error = EACCES; 1176 goto bad2; 1177 } 1178 /* 1179 * Symlink code always expects an unlocked dvp. 1180 */ 1181 if (ndp->ni_dvp != ndp->ni_vp) { 1182 VOP_UNLOCK(ndp->ni_dvp); 1183 ni_dvp_unlocked = 1; 1184 } 1185 goto success; 1186 } 1187 1188 nextname: 1189 /* 1190 * Not a symbolic link that we will follow. Continue with the 1191 * next component if there is any; otherwise, we're done. 1192 */ 1193 KASSERT((cnp->cn_flags & ISLASTCN) || *ndp->ni_next == '/', 1194 ("lookup: invalid path state.")); 1195 if (relookup) { 1196 relookup = 0; 1197 ndp->ni_pathlen = prev_ni_pathlen; 1198 ndp->ni_next = prev_ni_next; 1199 if (ndp->ni_dvp != dp) 1200 vput(ndp->ni_dvp); 1201 else 1202 vrele(ndp->ni_dvp); 1203 goto dirloop; 1204 } 1205 if (cnp->cn_flags & ISDOTDOT) { 1206 error = nameicap_check_dotdot(ndp, ndp->ni_vp); 1207 if (error != 0) { 1208 #ifdef KTRACE 1209 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1210 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1211 #endif 1212 goto bad2; 1213 } 1214 } 1215 if (*ndp->ni_next == '/') { 1216 cnp->cn_nameptr = ndp->ni_next; 1217 while (*cnp->cn_nameptr == '/') { 1218 cnp->cn_nameptr++; 1219 ndp->ni_pathlen--; 1220 } 1221 if (ndp->ni_dvp != dp) 1222 vput(ndp->ni_dvp); 1223 else 1224 vrele(ndp->ni_dvp); 1225 goto dirloop; 1226 } 1227 /* 1228 * If we're processing a path with a trailing slash, 1229 * check that the end result is a directory. 1230 */ 1231 if ((cnp->cn_flags & TRAILINGSLASH) && dp->v_type != VDIR) { 1232 error = ENOTDIR; 1233 goto bad2; 1234 } 1235 /* 1236 * Disallow directory write attempts on read-only filesystems. 1237 */ 1238 if (rdonly && 1239 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1240 error = EROFS; 1241 goto bad2; 1242 } 1243 if (cnp->cn_flags & SAVESTART) { 1244 ndp->ni_startdir = ndp->ni_dvp; 1245 VREF(ndp->ni_startdir); 1246 } 1247 if (!wantparent) { 1248 ni_dvp_unlocked = 2; 1249 if (ndp->ni_dvp != dp) 1250 vput(ndp->ni_dvp); 1251 else 1252 vrele(ndp->ni_dvp); 1253 } else if ((cnp->cn_flags & LOCKPARENT) == 0 && ndp->ni_dvp != dp) { 1254 VOP_UNLOCK(ndp->ni_dvp); 1255 ni_dvp_unlocked = 1; 1256 } 1257 1258 if (cnp->cn_flags & AUDITVNODE1) 1259 AUDIT_ARG_VNODE1(dp); 1260 else if (cnp->cn_flags & AUDITVNODE2) 1261 AUDIT_ARG_VNODE2(dp); 1262 1263 if ((cnp->cn_flags & LOCKLEAF) == 0) 1264 VOP_UNLOCK(dp); 1265 success: 1266 /* 1267 * FIXME: for lookups which only cross a mount point to fetch the 1268 * root vnode, ni_dvp will be set to vp_crossmp. This can be a problem 1269 * if either WANTPARENT or LOCKPARENT is set. 1270 */ 1271 /* 1272 * Because of shared lookup we may have the vnode shared locked, but 1273 * the caller may want it to be exclusively locked. 1274 */ 1275 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags) && 1276 VOP_ISLOCKED(dp) != LK_EXCLUSIVE) { 1277 vn_lock(dp, LK_UPGRADE | LK_RETRY); 1278 if (VN_IS_DOOMED(dp)) { 1279 error = ENOENT; 1280 goto bad2; 1281 } 1282 } 1283 if (ndp->ni_vp != NULL) { 1284 if ((cnp->cn_flags & ISDOTDOT) == 0) 1285 nameicap_tracker_add(ndp, ndp->ni_vp); 1286 if ((cnp->cn_flags & (FAILIFEXISTS | ISSYMLINK)) == FAILIFEXISTS) 1287 goto bad_eexist; 1288 } 1289 return (0); 1290 1291 bad2: 1292 if (ni_dvp_unlocked != 2) { 1293 if (dp != ndp->ni_dvp && !ni_dvp_unlocked) 1294 vput(ndp->ni_dvp); 1295 else 1296 vrele(ndp->ni_dvp); 1297 } 1298 bad: 1299 if (!dpunlocked) 1300 vput(dp); 1301 ndp->ni_vp = NULL; 1302 return (error); 1303 bad_eexist: 1304 /* 1305 * FAILIFEXISTS handling. 1306 * 1307 * XXX namei called with LOCKPARENT but not LOCKLEAF has the strange 1308 * behaviour of leaving the vnode unlocked if the target is the same 1309 * vnode as the parent. 1310 */ 1311 MPASS((cnp->cn_flags & ISSYMLINK) == 0); 1312 if (ndp->ni_vp == ndp->ni_dvp) 1313 vrele(ndp->ni_dvp); 1314 else 1315 vput(ndp->ni_dvp); 1316 vrele(ndp->ni_vp); 1317 ndp->ni_dvp = NULL; 1318 ndp->ni_vp = NULL; 1319 NDFREE(ndp, NDF_ONLY_PNBUF); 1320 return (EEXIST); 1321 } 1322 1323 /* 1324 * relookup - lookup a path name component 1325 * Used by lookup to re-acquire things. 1326 */ 1327 int 1328 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp) 1329 { 1330 struct vnode *dp = NULL; /* the directory we are searching */ 1331 int rdonly; /* lookup read-only flag bit */ 1332 int error = 0; 1333 1334 KASSERT(cnp->cn_flags & ISLASTCN, 1335 ("relookup: Not given last component.")); 1336 /* 1337 * Setup: break out flag bits into variables. 1338 */ 1339 KASSERT((cnp->cn_flags & (LOCKPARENT | WANTPARENT)) != 0, 1340 ("relookup: parent not wanted")); 1341 rdonly = cnp->cn_flags & RDONLY; 1342 cnp->cn_flags &= ~ISSYMLINK; 1343 dp = dvp; 1344 cnp->cn_lkflags = LK_EXCLUSIVE; 1345 vn_lock(dp, LK_EXCLUSIVE | LK_RETRY); 1346 1347 /* 1348 * Search a new directory. 1349 * 1350 * The last component of the filename is left accessible via 1351 * cnp->cn_nameptr for callers that need the name. Callers needing 1352 * the name set the SAVENAME flag. When done, they assume 1353 * responsibility for freeing the pathname buffer. 1354 */ 1355 #ifdef NAMEI_DIAGNOSTIC 1356 printf("{%s}: ", cnp->cn_nameptr); 1357 #endif 1358 1359 /* 1360 * Check for "" which represents the root directory after slash 1361 * removal. 1362 */ 1363 if (cnp->cn_nameptr[0] == '\0') { 1364 /* 1365 * Support only LOOKUP for "/" because lookup() 1366 * can't succeed for CREATE, DELETE and RENAME. 1367 */ 1368 KASSERT(cnp->cn_nameiop == LOOKUP, ("nameiop must be LOOKUP")); 1369 KASSERT(dp->v_type == VDIR, ("dp is not a directory")); 1370 1371 if (!(cnp->cn_flags & LOCKLEAF)) 1372 VOP_UNLOCK(dp); 1373 *vpp = dp; 1374 /* XXX This should probably move to the top of function. */ 1375 if (cnp->cn_flags & SAVESTART) 1376 panic("lookup: SAVESTART"); 1377 return (0); 1378 } 1379 1380 if (cnp->cn_flags & ISDOTDOT) 1381 panic ("relookup: lookup on dot-dot"); 1382 1383 /* 1384 * We now have a segment name to search for, and a directory to search. 1385 */ 1386 #ifdef NAMEI_DIAGNOSTIC 1387 vn_printf(dp, "search in "); 1388 #endif 1389 if ((error = VOP_LOOKUP(dp, vpp, cnp)) != 0) { 1390 KASSERT(*vpp == NULL, ("leaf should be empty")); 1391 if (error != EJUSTRETURN) 1392 goto bad; 1393 /* 1394 * If creating and at end of pathname, then can consider 1395 * allowing file to be created. 1396 */ 1397 if (rdonly) { 1398 error = EROFS; 1399 goto bad; 1400 } 1401 /* ASSERT(dvp == ndp->ni_startdir) */ 1402 if (cnp->cn_flags & SAVESTART) 1403 VREF(dvp); 1404 if ((cnp->cn_flags & LOCKPARENT) == 0) 1405 VOP_UNLOCK(dp); 1406 /* 1407 * We return with ni_vp NULL to indicate that the entry 1408 * doesn't currently exist, leaving a pointer to the 1409 * (possibly locked) directory vnode in ndp->ni_dvp. 1410 */ 1411 return (0); 1412 } 1413 1414 dp = *vpp; 1415 1416 /* 1417 * Disallow directory write attempts on read-only filesystems. 1418 */ 1419 if (rdonly && 1420 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1421 if (dvp == dp) 1422 vrele(dvp); 1423 else 1424 vput(dvp); 1425 error = EROFS; 1426 goto bad; 1427 } 1428 /* 1429 * Set the parent lock/ref state to the requested state. 1430 */ 1431 if ((cnp->cn_flags & LOCKPARENT) == 0 && dvp != dp) 1432 VOP_UNLOCK(dvp); 1433 /* 1434 * Check for symbolic link 1435 */ 1436 KASSERT(dp->v_type != VLNK || !(cnp->cn_flags & FOLLOW), 1437 ("relookup: symlink found.\n")); 1438 1439 /* ASSERT(dvp == ndp->ni_startdir) */ 1440 if (cnp->cn_flags & SAVESTART) 1441 VREF(dvp); 1442 1443 if ((cnp->cn_flags & LOCKLEAF) == 0) 1444 VOP_UNLOCK(dp); 1445 return (0); 1446 bad: 1447 vput(dp); 1448 *vpp = NULL; 1449 return (error); 1450 } 1451 1452 /* 1453 * Free data allocated by namei(); see namei(9) for details. 1454 */ 1455 void 1456 NDFREE_PNBUF(struct nameidata *ndp) 1457 { 1458 1459 if ((ndp->ni_cnd.cn_flags & HASBUF) != 0) { 1460 MPASS((ndp->ni_cnd.cn_flags & (SAVENAME | SAVESTART)) != 0); 1461 uma_zfree(namei_zone, ndp->ni_cnd.cn_pnbuf); 1462 ndp->ni_cnd.cn_flags &= ~HASBUF; 1463 } 1464 } 1465 1466 /* 1467 * NDFREE_PNBUF replacement for callers that know there is no buffer. 1468 * 1469 * This is a hack. Preferably the VFS layer would not produce anything more 1470 * than it was asked to do. Unfortunately several non-LOOKUP cases can add the 1471 * HASBUF flag to the result. Even then an interface could be implemented where 1472 * the caller specifies what they expected to see in the result and what they 1473 * are going to take care of. 1474 * 1475 * In the meantime provide this kludge as a trivial replacement for NDFREE_PNBUF 1476 * calls scattered throughout the kernel where we know for a fact the flag must not 1477 * be seen. 1478 */ 1479 #ifdef INVARIANTS 1480 void 1481 NDFREE_NOTHING(struct nameidata *ndp) 1482 { 1483 struct componentname *cnp; 1484 1485 cnp = &ndp->ni_cnd; 1486 KASSERT(cnp->cn_nameiop == LOOKUP, ("%s: got non-LOOKUP op %d\n", 1487 __func__, cnp->cn_nameiop)); 1488 KASSERT((cnp->cn_flags & (SAVENAME | HASBUF)) == 0, 1489 ("%s: bad flags \%" PRIx64 "\n", __func__, cnp->cn_flags)); 1490 } 1491 #endif 1492 1493 void 1494 (NDFREE)(struct nameidata *ndp, const u_int flags) 1495 { 1496 int unlock_dvp; 1497 int unlock_vp; 1498 1499 unlock_dvp = 0; 1500 unlock_vp = 0; 1501 1502 if (!(flags & NDF_NO_FREE_PNBUF)) { 1503 NDFREE_PNBUF(ndp); 1504 } 1505 if (!(flags & NDF_NO_VP_UNLOCK) && 1506 (ndp->ni_cnd.cn_flags & LOCKLEAF) && ndp->ni_vp) 1507 unlock_vp = 1; 1508 if (!(flags & NDF_NO_DVP_UNLOCK) && 1509 (ndp->ni_cnd.cn_flags & LOCKPARENT) && 1510 ndp->ni_dvp != ndp->ni_vp) 1511 unlock_dvp = 1; 1512 if (!(flags & NDF_NO_VP_RELE) && ndp->ni_vp) { 1513 if (unlock_vp) { 1514 vput(ndp->ni_vp); 1515 unlock_vp = 0; 1516 } else 1517 vrele(ndp->ni_vp); 1518 ndp->ni_vp = NULL; 1519 } 1520 if (unlock_vp) 1521 VOP_UNLOCK(ndp->ni_vp); 1522 if (!(flags & NDF_NO_DVP_RELE) && 1523 (ndp->ni_cnd.cn_flags & (LOCKPARENT|WANTPARENT))) { 1524 if (unlock_dvp) { 1525 vput(ndp->ni_dvp); 1526 unlock_dvp = 0; 1527 } else 1528 vrele(ndp->ni_dvp); 1529 ndp->ni_dvp = NULL; 1530 } 1531 if (unlock_dvp) 1532 VOP_UNLOCK(ndp->ni_dvp); 1533 if (!(flags & NDF_NO_STARTDIR_RELE) && 1534 (ndp->ni_cnd.cn_flags & SAVESTART)) { 1535 vrele(ndp->ni_startdir); 1536 ndp->ni_startdir = NULL; 1537 } 1538 } 1539 1540 #ifdef INVARIANTS 1541 /* 1542 * Validate the final state of ndp after the lookup. 1543 * 1544 * Historically filesystems were allowed to modify cn_flags. Most notably they 1545 * can add SAVENAME to the request, resulting in HASBUF and pushing subsequent 1546 * clean up to the consumer. In practice this seems to only concern != LOOKUP 1547 * operations. 1548 * 1549 * As a step towards stricter API contract this routine validates the state to 1550 * clean up. Note validation is a work in progress with the intent of becoming 1551 * stricter over time. 1552 */ 1553 #define NDMODIFYINGFLAGS (LOCKLEAF | LOCKPARENT | WANTPARENT | SAVENAME | SAVESTART | HASBUF) 1554 void 1555 NDVALIDATE(struct nameidata *ndp) 1556 { 1557 struct componentname *cnp; 1558 u_int64_t used, orig; 1559 1560 cnp = &ndp->ni_cnd; 1561 orig = cnp->cn_origflags; 1562 used = cnp->cn_flags; 1563 switch (cnp->cn_nameiop) { 1564 case LOOKUP: 1565 /* 1566 * For plain lookup we require strict conformance -- nothing 1567 * to clean up if it was not requested by the caller. 1568 */ 1569 orig &= NDMODIFYINGFLAGS; 1570 used &= NDMODIFYINGFLAGS; 1571 if ((orig & (SAVENAME | SAVESTART)) != 0) 1572 orig |= HASBUF; 1573 if (orig != used) { 1574 goto out_mismatch; 1575 } 1576 break; 1577 case CREATE: 1578 case DELETE: 1579 case RENAME: 1580 /* 1581 * Some filesystems set SAVENAME to provoke HASBUF, accomodate 1582 * for it until it gets fixed. 1583 */ 1584 orig &= NDMODIFYINGFLAGS; 1585 orig |= (SAVENAME | HASBUF); 1586 used &= NDMODIFYINGFLAGS; 1587 used |= (SAVENAME | HASBUF); 1588 if (orig != used) { 1589 goto out_mismatch; 1590 } 1591 break; 1592 } 1593 return; 1594 out_mismatch: 1595 panic("%s: mismatched flags for op %d: added %" PRIx64 ", " 1596 "removed %" PRIx64" (%" PRIx64" != %" PRIx64"; stored %" PRIx64" != %" PRIx64")", 1597 __func__, cnp->cn_nameiop, used & ~orig, orig &~ used, 1598 orig, used, cnp->cn_origflags, cnp->cn_flags); 1599 } 1600 #endif 1601 1602 /* 1603 * Determine if there is a suitable alternate filename under the specified 1604 * prefix for the specified path. If the create flag is set, then the 1605 * alternate prefix will be used so long as the parent directory exists. 1606 * This is used by the various compatibility ABIs so that Linux binaries prefer 1607 * files under /compat/linux for example. The chosen path (whether under 1608 * the prefix or under /) is returned in a kernel malloc'd buffer pointed 1609 * to by pathbuf. The caller is responsible for free'ing the buffer from 1610 * the M_TEMP bucket if one is returned. 1611 */ 1612 int 1613 kern_alternate_path(struct thread *td, const char *prefix, const char *path, 1614 enum uio_seg pathseg, char **pathbuf, int create, int dirfd) 1615 { 1616 struct nameidata nd, ndroot; 1617 char *ptr, *buf, *cp; 1618 size_t len, sz; 1619 int error; 1620 1621 buf = (char *) malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 1622 *pathbuf = buf; 1623 1624 /* Copy the prefix into the new pathname as a starting point. */ 1625 len = strlcpy(buf, prefix, MAXPATHLEN); 1626 if (len >= MAXPATHLEN) { 1627 *pathbuf = NULL; 1628 free(buf, M_TEMP); 1629 return (EINVAL); 1630 } 1631 sz = MAXPATHLEN - len; 1632 ptr = buf + len; 1633 1634 /* Append the filename to the prefix. */ 1635 if (pathseg == UIO_SYSSPACE) 1636 error = copystr(path, ptr, sz, &len); 1637 else 1638 error = copyinstr(path, ptr, sz, &len); 1639 1640 if (error) { 1641 *pathbuf = NULL; 1642 free(buf, M_TEMP); 1643 return (error); 1644 } 1645 1646 /* Only use a prefix with absolute pathnames. */ 1647 if (*ptr != '/') { 1648 error = EINVAL; 1649 goto keeporig; 1650 } 1651 1652 if (dirfd != AT_FDCWD) { 1653 /* 1654 * We want the original because the "prefix" is 1655 * included in the already opened dirfd. 1656 */ 1657 bcopy(ptr, buf, len); 1658 return (0); 1659 } 1660 1661 /* 1662 * We know that there is a / somewhere in this pathname. 1663 * Search backwards for it, to find the file's parent dir 1664 * to see if it exists in the alternate tree. If it does, 1665 * and we want to create a file (cflag is set). We don't 1666 * need to worry about the root comparison in this case. 1667 */ 1668 1669 if (create) { 1670 for (cp = &ptr[len] - 1; *cp != '/'; cp--); 1671 *cp = '\0'; 1672 1673 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, buf, td); 1674 error = namei(&nd); 1675 *cp = '/'; 1676 if (error != 0) 1677 goto keeporig; 1678 } else { 1679 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, buf, td); 1680 1681 error = namei(&nd); 1682 if (error != 0) 1683 goto keeporig; 1684 1685 /* 1686 * We now compare the vnode of the prefix to the one 1687 * vnode asked. If they resolve to be the same, then we 1688 * ignore the match so that the real root gets used. 1689 * This avoids the problem of traversing "../.." to find the 1690 * root directory and never finding it, because "/" resolves 1691 * to the emulation root directory. This is expensive :-( 1692 */ 1693 NDINIT(&ndroot, LOOKUP, FOLLOW, UIO_SYSSPACE, prefix, 1694 td); 1695 1696 /* We shouldn't ever get an error from this namei(). */ 1697 error = namei(&ndroot); 1698 if (error == 0) { 1699 if (nd.ni_vp == ndroot.ni_vp) 1700 error = ENOENT; 1701 1702 NDFREE(&ndroot, NDF_ONLY_PNBUF); 1703 vrele(ndroot.ni_vp); 1704 } 1705 } 1706 1707 NDFREE(&nd, NDF_ONLY_PNBUF); 1708 vrele(nd.ni_vp); 1709 1710 keeporig: 1711 /* If there was an error, use the original path name. */ 1712 if (error) 1713 bcopy(ptr, buf, len); 1714 return (error); 1715 } 1716