1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * (c) UNIX System Laboratories, Inc. 7 * All or some portions of this file are derived from material licensed 8 * to the University of California by American Telephone and Telegraph 9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 10 * the permission of UNIX System Laboratories, Inc. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#)vfs_lookup.c 8.4 (Berkeley) 2/16/94 37 */ 38 39 #include <sys/cdefs.h> 40 __FBSDID("$FreeBSD$"); 41 42 #include "opt_capsicum.h" 43 #include "opt_ktrace.h" 44 45 #include <sys/param.h> 46 #include <sys/systm.h> 47 #include <sys/dirent.h> 48 #include <sys/kernel.h> 49 #include <sys/capsicum.h> 50 #include <sys/fcntl.h> 51 #include <sys/jail.h> 52 #include <sys/lock.h> 53 #include <sys/mutex.h> 54 #include <sys/namei.h> 55 #include <sys/vnode.h> 56 #include <sys/mount.h> 57 #include <sys/filedesc.h> 58 #include <sys/proc.h> 59 #include <sys/sdt.h> 60 #include <sys/syscallsubr.h> 61 #include <sys/sysctl.h> 62 #ifdef KTRACE 63 #include <sys/ktrace.h> 64 #endif 65 #ifdef INVARIANTS 66 #include <machine/_inttypes.h> 67 #endif 68 69 #include <security/audit/audit.h> 70 #include <security/mac/mac_framework.h> 71 72 #include <vm/uma.h> 73 74 #define NAMEI_DIAGNOSTIC 1 75 #undef NAMEI_DIAGNOSTIC 76 77 SDT_PROVIDER_DEFINE(vfs); 78 SDT_PROBE_DEFINE4(vfs, namei, lookup, entry, "struct vnode *", "char *", 79 "unsigned long", "bool"); 80 SDT_PROBE_DEFINE4(vfs, namei, lookup, return, "int", "struct vnode *", "bool", 81 "struct nameidata"); 82 83 /* Allocation zone for namei. */ 84 uma_zone_t namei_zone; 85 86 /* Placeholder vnode for mp traversal. */ 87 static struct vnode *vp_crossmp; 88 89 static int 90 crossmp_vop_islocked(struct vop_islocked_args *ap) 91 { 92 93 return (LK_SHARED); 94 } 95 96 static int 97 crossmp_vop_lock1(struct vop_lock1_args *ap) 98 { 99 struct vnode *vp; 100 struct lock *lk __diagused; 101 const char *file __diagused; 102 int flags, line __diagused; 103 104 vp = ap->a_vp; 105 lk = vp->v_vnlock; 106 flags = ap->a_flags; 107 file = ap->a_file; 108 line = ap->a_line; 109 110 if ((flags & LK_SHARED) == 0) 111 panic("invalid lock request for crossmp"); 112 113 WITNESS_CHECKORDER(&lk->lock_object, LOP_NEWORDER, file, line, 114 flags & LK_INTERLOCK ? &VI_MTX(vp)->lock_object : NULL); 115 WITNESS_LOCK(&lk->lock_object, 0, file, line); 116 if ((flags & LK_INTERLOCK) != 0) 117 VI_UNLOCK(vp); 118 LOCK_LOG_LOCK("SLOCK", &lk->lock_object, 0, 0, ap->a_file, line); 119 return (0); 120 } 121 122 static int 123 crossmp_vop_unlock(struct vop_unlock_args *ap) 124 { 125 struct vnode *vp; 126 struct lock *lk __diagused; 127 128 vp = ap->a_vp; 129 lk = vp->v_vnlock; 130 131 WITNESS_UNLOCK(&lk->lock_object, 0, LOCK_FILE, LOCK_LINE); 132 LOCK_LOG_LOCK("SUNLOCK", &lk->lock_object, 0, 0, LOCK_FILE, 133 LOCK_LINE); 134 return (0); 135 } 136 137 static struct vop_vector crossmp_vnodeops = { 138 .vop_default = &default_vnodeops, 139 .vop_islocked = crossmp_vop_islocked, 140 .vop_lock1 = crossmp_vop_lock1, 141 .vop_unlock = crossmp_vop_unlock, 142 }; 143 /* 144 * VFS_VOP_VECTOR_REGISTER(crossmp_vnodeops) is not used here since the vnode 145 * gets allocated early. See nameiinit for the direct call below. 146 */ 147 148 struct nameicap_tracker { 149 struct vnode *dp; 150 TAILQ_ENTRY(nameicap_tracker) nm_link; 151 }; 152 153 /* Zone for cap mode tracker elements used for dotdot capability checks. */ 154 MALLOC_DEFINE(M_NAMEITRACKER, "namei_tracker", "namei tracking for dotdot"); 155 156 static void 157 nameiinit(void *dummy __unused) 158 { 159 160 namei_zone = uma_zcreate("NAMEI", MAXPATHLEN, NULL, NULL, NULL, NULL, 161 UMA_ALIGN_PTR, 0); 162 vfs_vector_op_register(&crossmp_vnodeops); 163 getnewvnode("crossmp", NULL, &crossmp_vnodeops, &vp_crossmp); 164 } 165 SYSINIT(vfs, SI_SUB_VFS, SI_ORDER_SECOND, nameiinit, NULL); 166 167 static int lookup_cap_dotdot = 1; 168 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot, CTLFLAG_RWTUN, 169 &lookup_cap_dotdot, 0, 170 "enables \"..\" components in path lookup in capability mode"); 171 static int lookup_cap_dotdot_nonlocal = 1; 172 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot_nonlocal, CTLFLAG_RWTUN, 173 &lookup_cap_dotdot_nonlocal, 0, 174 "enables \"..\" components in path lookup in capability mode " 175 "on non-local mount"); 176 177 static void 178 nameicap_tracker_add(struct nameidata *ndp, struct vnode *dp) 179 { 180 struct nameicap_tracker *nt; 181 182 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0 || dp->v_type != VDIR) 183 return; 184 nt = TAILQ_LAST(&ndp->ni_cap_tracker, nameicap_tracker_head); 185 if (nt != NULL && nt->dp == dp) 186 return; 187 nt = malloc(sizeof(*nt), M_NAMEITRACKER, M_WAITOK); 188 vhold(dp); 189 nt->dp = dp; 190 TAILQ_INSERT_TAIL(&ndp->ni_cap_tracker, nt, nm_link); 191 } 192 193 static void 194 nameicap_cleanup_from(struct nameidata *ndp, struct nameicap_tracker *first) 195 { 196 struct nameicap_tracker *nt, *nt1; 197 198 nt = first; 199 TAILQ_FOREACH_FROM_SAFE(nt, &ndp->ni_cap_tracker, nm_link, nt1) { 200 TAILQ_REMOVE(&ndp->ni_cap_tracker, nt, nm_link); 201 vdrop(nt->dp); 202 free(nt, M_NAMEITRACKER); 203 } 204 } 205 206 static void 207 nameicap_cleanup(struct nameidata *ndp) 208 { 209 KASSERT(TAILQ_EMPTY(&ndp->ni_cap_tracker) || 210 (ndp->ni_lcf & NI_LCF_CAP_DOTDOT) != 0, ("not strictrelative")); 211 nameicap_cleanup_from(ndp, NULL); 212 } 213 214 /* 215 * For dotdot lookups in capability mode, only allow the component 216 * lookup to succeed if the resulting directory was already traversed 217 * during the operation. This catches situations where already 218 * traversed directory is moved to different parent, and then we walk 219 * over it with dotdots. 220 * 221 * Also allow to force failure of dotdot lookups for non-local 222 * filesystems, where external agents might assist local lookups to 223 * escape the compartment. 224 */ 225 static int 226 nameicap_check_dotdot(struct nameidata *ndp, struct vnode *dp) 227 { 228 struct nameicap_tracker *nt; 229 struct mount *mp; 230 231 if (dp == NULL || dp->v_type != VDIR || (ndp->ni_lcf & 232 NI_LCF_STRICTRELATIVE) == 0) 233 return (0); 234 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0) 235 return (ENOTCAPABLE); 236 mp = dp->v_mount; 237 if (lookup_cap_dotdot_nonlocal == 0 && mp != NULL && 238 (mp->mnt_flag & MNT_LOCAL) == 0) 239 return (ENOTCAPABLE); 240 TAILQ_FOREACH_REVERSE(nt, &ndp->ni_cap_tracker, nameicap_tracker_head, 241 nm_link) { 242 if (dp == nt->dp) { 243 nt = TAILQ_NEXT(nt, nm_link); 244 if (nt != NULL) 245 nameicap_cleanup_from(ndp, nt); 246 return (0); 247 } 248 } 249 return (ENOTCAPABLE); 250 } 251 252 static void 253 namei_cleanup_cnp(struct componentname *cnp) 254 { 255 256 uma_zfree(namei_zone, cnp->cn_pnbuf); 257 #ifdef DIAGNOSTIC 258 cnp->cn_pnbuf = NULL; 259 cnp->cn_nameptr = NULL; 260 #endif 261 } 262 263 static int 264 namei_handle_root(struct nameidata *ndp, struct vnode **dpp) 265 { 266 struct componentname *cnp; 267 268 cnp = &ndp->ni_cnd; 269 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0) { 270 #ifdef KTRACE 271 if (KTRPOINT(curthread, KTR_CAPFAIL)) 272 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 273 #endif 274 return (ENOTCAPABLE); 275 } 276 while (*(cnp->cn_nameptr) == '/') { 277 cnp->cn_nameptr++; 278 ndp->ni_pathlen--; 279 } 280 *dpp = ndp->ni_rootdir; 281 vrefact(*dpp); 282 return (0); 283 } 284 285 static int 286 namei_setup(struct nameidata *ndp, struct vnode **dpp, struct pwd **pwdp) 287 { 288 struct componentname *cnp; 289 struct file *dfp; 290 struct thread *td; 291 struct pwd *pwd; 292 cap_rights_t rights; 293 int error; 294 bool startdir_used; 295 296 cnp = &ndp->ni_cnd; 297 td = cnp->cn_thread; 298 299 startdir_used = false; 300 *pwdp = NULL; 301 *dpp = NULL; 302 303 #ifdef CAPABILITY_MODE 304 /* 305 * In capability mode, lookups must be restricted to happen in 306 * the subtree with the root specified by the file descriptor: 307 * - The root must be real file descriptor, not the pseudo-descriptor 308 * AT_FDCWD. 309 * - The passed path must be relative and not absolute. 310 * - If lookup_cap_dotdot is disabled, path must not contain the 311 * '..' components. 312 * - If lookup_cap_dotdot is enabled, we verify that all '..' 313 * components lookups result in the directories which were 314 * previously walked by us, which prevents an escape from 315 * the relative root. 316 */ 317 if (IN_CAPABILITY_MODE(td) && (cnp->cn_flags & NOCAPCHECK) == 0) { 318 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE; 319 ndp->ni_resflags |= NIRES_STRICTREL; 320 if (ndp->ni_dirfd == AT_FDCWD) { 321 #ifdef KTRACE 322 if (KTRPOINT(td, KTR_CAPFAIL)) 323 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 324 #endif 325 return (ECAPMODE); 326 } 327 } 328 #endif 329 error = 0; 330 331 /* 332 * Get starting point for the translation. 333 */ 334 pwd = pwd_hold(td); 335 /* 336 * The reference on ni_rootdir is acquired in the block below to avoid 337 * back-to-back atomics for absolute lookups. 338 */ 339 ndp->ni_rootdir = pwd->pwd_rdir; 340 ndp->ni_topdir = pwd->pwd_jdir; 341 342 if (cnp->cn_pnbuf[0] == '/') { 343 ndp->ni_resflags |= NIRES_ABS; 344 error = namei_handle_root(ndp, dpp); 345 } else { 346 if (ndp->ni_startdir != NULL) { 347 *dpp = ndp->ni_startdir; 348 startdir_used = true; 349 } else if (ndp->ni_dirfd == AT_FDCWD) { 350 *dpp = pwd->pwd_cdir; 351 vrefact(*dpp); 352 } else { 353 rights = *ndp->ni_rightsneeded; 354 cap_rights_set_one(&rights, CAP_LOOKUP); 355 356 if (cnp->cn_flags & AUDITVNODE1) 357 AUDIT_ARG_ATFD1(ndp->ni_dirfd); 358 if (cnp->cn_flags & AUDITVNODE2) 359 AUDIT_ARG_ATFD2(ndp->ni_dirfd); 360 /* 361 * Effectively inlined fgetvp_rights, because 362 * we need to inspect the file as well as 363 * grabbing the vnode. No check for O_PATH, 364 * files to implement its semantic. 365 */ 366 error = fget_cap(td, ndp->ni_dirfd, &rights, 367 &dfp, &ndp->ni_filecaps); 368 if (error != 0) { 369 /* 370 * Preserve the error; it should either be EBADF 371 * or capability-related, both of which can be 372 * safely returned to the caller. 373 */ 374 } else { 375 if (dfp->f_ops == &badfileops) { 376 error = EBADF; 377 } else if (dfp->f_vnode == NULL) { 378 error = ENOTDIR; 379 } else { 380 *dpp = dfp->f_vnode; 381 vref(*dpp); 382 383 if ((dfp->f_flag & FSEARCH) != 0) 384 cnp->cn_flags |= NOEXECCHECK; 385 } 386 fdrop(dfp, td); 387 } 388 #ifdef CAPABILITIES 389 /* 390 * If file descriptor doesn't have all rights, 391 * all lookups relative to it must also be 392 * strictly relative. 393 */ 394 CAP_ALL(&rights); 395 if (!cap_rights_contains(&ndp->ni_filecaps.fc_rights, 396 &rights) || 397 ndp->ni_filecaps.fc_fcntls != CAP_FCNTL_ALL || 398 ndp->ni_filecaps.fc_nioctls != -1) { 399 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE; 400 ndp->ni_resflags |= NIRES_STRICTREL; 401 } 402 #endif 403 } 404 if (error == 0 && (*dpp)->v_type != VDIR && 405 (cnp->cn_pnbuf[0] != '\0' || 406 (cnp->cn_flags & EMPTYPATH) == 0)) 407 error = ENOTDIR; 408 } 409 if (error == 0 && (cnp->cn_flags & RBENEATH) != 0) { 410 if (cnp->cn_pnbuf[0] == '/') { 411 error = ENOTCAPABLE; 412 } else if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) == 0) { 413 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE | 414 NI_LCF_CAP_DOTDOT; 415 } 416 } 417 418 /* 419 * If we are auditing the kernel pathname, save the user pathname. 420 */ 421 if (cnp->cn_flags & AUDITVNODE1) 422 AUDIT_ARG_UPATH1_VP(td, ndp->ni_rootdir, *dpp, cnp->cn_pnbuf); 423 if (cnp->cn_flags & AUDITVNODE2) 424 AUDIT_ARG_UPATH2_VP(td, ndp->ni_rootdir, *dpp, cnp->cn_pnbuf); 425 if (ndp->ni_startdir != NULL && !startdir_used) 426 vrele(ndp->ni_startdir); 427 if (error != 0) { 428 if (*dpp != NULL) 429 vrele(*dpp); 430 pwd_drop(pwd); 431 return (error); 432 } 433 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0 && 434 lookup_cap_dotdot != 0) 435 ndp->ni_lcf |= NI_LCF_CAP_DOTDOT; 436 SDT_PROBE4(vfs, namei, lookup, entry, *dpp, cnp->cn_pnbuf, 437 cnp->cn_flags, false); 438 *pwdp = pwd; 439 return (0); 440 } 441 442 static int 443 namei_getpath(struct nameidata *ndp) 444 { 445 struct componentname *cnp; 446 int error; 447 448 cnp = &ndp->ni_cnd; 449 450 /* 451 * Get a buffer for the name to be translated, and copy the 452 * name into the buffer. 453 */ 454 cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK); 455 if (ndp->ni_segflg == UIO_SYSSPACE) { 456 error = copystr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 457 &ndp->ni_pathlen); 458 } else { 459 error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 460 &ndp->ni_pathlen); 461 } 462 463 if (__predict_false(error != 0)) 464 return (error); 465 466 /* 467 * Don't allow empty pathnames unless EMPTYPATH is specified. 468 * Caller checks for ENOENT as an indication for the empty path. 469 */ 470 if (__predict_false(*cnp->cn_pnbuf == '\0')) 471 return (ENOENT); 472 473 cnp->cn_nameptr = cnp->cn_pnbuf; 474 return (0); 475 } 476 477 static int 478 namei_emptypath(struct nameidata *ndp) 479 { 480 struct componentname *cnp; 481 struct pwd *pwd; 482 struct vnode *dp; 483 int error; 484 485 cnp = &ndp->ni_cnd; 486 MPASS(*cnp->cn_pnbuf == '\0'); 487 MPASS((cnp->cn_flags & EMPTYPATH) != 0); 488 MPASS((cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == 0); 489 490 ndp->ni_resflags |= NIRES_EMPTYPATH; 491 error = namei_setup(ndp, &dp, &pwd); 492 if (error != 0) { 493 namei_cleanup_cnp(cnp); 494 goto errout; 495 } 496 497 /* 498 * Usecount on dp already provided by namei_setup. 499 */ 500 ndp->ni_vp = dp; 501 namei_cleanup_cnp(cnp); 502 pwd_drop(pwd); 503 NDVALIDATE(ndp); 504 if ((cnp->cn_flags & LOCKLEAF) != 0) { 505 VOP_LOCK(dp, (cnp->cn_flags & LOCKSHARED) != 0 ? 506 LK_SHARED : LK_EXCLUSIVE); 507 if (VN_IS_DOOMED(dp)) { 508 vput(dp); 509 error = ENOENT; 510 goto errout; 511 } 512 } 513 SDT_PROBE4(vfs, namei, lookup, return, 0, ndp->ni_vp, false, ndp); 514 return (0); 515 516 errout: 517 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, false, ndp); 518 return (error); 519 } 520 521 /* 522 * Convert a pathname into a pointer to a locked vnode. 523 * 524 * The FOLLOW flag is set when symbolic links are to be followed 525 * when they occur at the end of the name translation process. 526 * Symbolic links are always followed for all other pathname 527 * components other than the last. 528 * 529 * The segflg defines whether the name is to be copied from user 530 * space or kernel space. 531 * 532 * Overall outline of namei: 533 * 534 * copy in name 535 * get starting directory 536 * while (!done && !error) { 537 * call lookup to search path. 538 * if symbolic link, massage name in buffer and continue 539 * } 540 */ 541 int 542 namei(struct nameidata *ndp) 543 { 544 char *cp; /* pointer into pathname argument */ 545 struct vnode *dp; /* the directory we are searching */ 546 struct iovec aiov; /* uio for reading symbolic links */ 547 struct componentname *cnp; 548 struct thread *td; 549 struct pwd *pwd; 550 struct uio auio; 551 int error, linklen; 552 enum cache_fpl_status status; 553 554 cnp = &ndp->ni_cnd; 555 td = cnp->cn_thread; 556 #ifdef INVARIANTS 557 KASSERT((ndp->ni_debugflags & NAMEI_DBG_CALLED) == 0, 558 ("%s: repeated call to namei without NDREINIT", __func__)); 559 KASSERT(ndp->ni_debugflags == NAMEI_DBG_INITED, 560 ("%s: bad debugflags %d", __func__, ndp->ni_debugflags)); 561 ndp->ni_debugflags |= NAMEI_DBG_CALLED; 562 if (ndp->ni_startdir != NULL) 563 ndp->ni_debugflags |= NAMEI_DBG_HADSTARTDIR; 564 if (cnp->cn_flags & FAILIFEXISTS) { 565 KASSERT(cnp->cn_nameiop == CREATE, 566 ("%s: FAILIFEXISTS passed for op %d", __func__, cnp->cn_nameiop)); 567 /* 568 * The limitation below is to restrict hairy corner cases. 569 */ 570 KASSERT((cnp->cn_flags & (LOCKPARENT | LOCKLEAF)) == LOCKPARENT, 571 ("%s: FAILIFEXISTS must be passed with LOCKPARENT and without LOCKLEAF", 572 __func__)); 573 } 574 /* 575 * For NDVALIDATE. 576 * 577 * While NDINIT may seem like a more natural place to do it, there are 578 * callers which directly modify flags past invoking init. 579 */ 580 cnp->cn_origflags = cnp->cn_flags; 581 #endif 582 ndp->ni_cnd.cn_cred = ndp->ni_cnd.cn_thread->td_ucred; 583 KASSERT(ndp->ni_resflags == 0, ("%s: garbage in ni_resflags: %x\n", 584 __func__, ndp->ni_resflags)); 585 KASSERT(cnp->cn_cred && td->td_proc, ("namei: bad cred/proc")); 586 KASSERT((cnp->cn_flags & NAMEI_INTERNAL_FLAGS) == 0, 587 ("namei: unexpected flags: %" PRIx64 "\n", 588 cnp->cn_flags & NAMEI_INTERNAL_FLAGS)); 589 if (cnp->cn_flags & NOCACHE) 590 KASSERT(cnp->cn_nameiop != LOOKUP, 591 ("%s: NOCACHE passed with LOOKUP", __func__)); 592 MPASS(ndp->ni_startdir == NULL || ndp->ni_startdir->v_type == VDIR || 593 ndp->ni_startdir->v_type == VBAD); 594 595 ndp->ni_lcf = 0; 596 ndp->ni_loopcnt = 0; 597 ndp->ni_vp = NULL; 598 599 error = namei_getpath(ndp); 600 if (__predict_false(error != 0)) { 601 if (error == ENOENT && (cnp->cn_flags & EMPTYPATH) != 0) 602 return (namei_emptypath(ndp)); 603 namei_cleanup_cnp(cnp); 604 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, 605 false, ndp); 606 return (error); 607 } 608 609 #ifdef KTRACE 610 if (KTRPOINT(td, KTR_NAMEI)) { 611 KASSERT(cnp->cn_thread == curthread, 612 ("namei not using curthread")); 613 ktrnamei(cnp->cn_pnbuf); 614 } 615 #endif 616 617 /* 618 * First try looking up the target without locking any vnodes. 619 * 620 * We may need to start from scratch or pick up where it left off. 621 */ 622 error = cache_fplookup(ndp, &status, &pwd); 623 switch (status) { 624 case CACHE_FPL_STATUS_UNSET: 625 __assert_unreachable(); 626 break; 627 case CACHE_FPL_STATUS_HANDLED: 628 if (error == 0) 629 NDVALIDATE(ndp); 630 return (error); 631 case CACHE_FPL_STATUS_PARTIAL: 632 TAILQ_INIT(&ndp->ni_cap_tracker); 633 dp = ndp->ni_startdir; 634 break; 635 case CACHE_FPL_STATUS_DESTROYED: 636 ndp->ni_loopcnt = 0; 637 error = namei_getpath(ndp); 638 if (__predict_false(error != 0)) { 639 namei_cleanup_cnp(cnp); 640 return (error); 641 } 642 /* FALLTHROUGH */ 643 case CACHE_FPL_STATUS_ABORTED: 644 TAILQ_INIT(&ndp->ni_cap_tracker); 645 MPASS(ndp->ni_lcf == 0); 646 error = namei_setup(ndp, &dp, &pwd); 647 if (error != 0) { 648 namei_cleanup_cnp(cnp); 649 return (error); 650 } 651 break; 652 } 653 654 /* 655 * Locked lookup. 656 */ 657 for (;;) { 658 ndp->ni_startdir = dp; 659 error = lookup(ndp); 660 if (error != 0) 661 goto out; 662 663 /* 664 * If not a symbolic link, we're done. 665 */ 666 if ((cnp->cn_flags & ISSYMLINK) == 0) { 667 SDT_PROBE4(vfs, namei, lookup, return, error, 668 (error == 0 ? ndp->ni_vp : NULL), false, ndp); 669 if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0) { 670 namei_cleanup_cnp(cnp); 671 } else 672 cnp->cn_flags |= HASBUF; 673 nameicap_cleanup(ndp); 674 pwd_drop(pwd); 675 if (error == 0) 676 NDVALIDATE(ndp); 677 return (error); 678 } 679 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) { 680 error = ELOOP; 681 break; 682 } 683 #ifdef MAC 684 if ((cnp->cn_flags & NOMACCHECK) == 0) { 685 error = mac_vnode_check_readlink(td->td_ucred, 686 ndp->ni_vp); 687 if (error != 0) 688 break; 689 } 690 #endif 691 if (ndp->ni_pathlen > 1) 692 cp = uma_zalloc(namei_zone, M_WAITOK); 693 else 694 cp = cnp->cn_pnbuf; 695 aiov.iov_base = cp; 696 aiov.iov_len = MAXPATHLEN; 697 auio.uio_iov = &aiov; 698 auio.uio_iovcnt = 1; 699 auio.uio_offset = 0; 700 auio.uio_rw = UIO_READ; 701 auio.uio_segflg = UIO_SYSSPACE; 702 auio.uio_td = td; 703 auio.uio_resid = MAXPATHLEN; 704 error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred); 705 if (error != 0) { 706 if (ndp->ni_pathlen > 1) 707 uma_zfree(namei_zone, cp); 708 break; 709 } 710 linklen = MAXPATHLEN - auio.uio_resid; 711 if (linklen == 0) { 712 if (ndp->ni_pathlen > 1) 713 uma_zfree(namei_zone, cp); 714 error = ENOENT; 715 break; 716 } 717 if (linklen + ndp->ni_pathlen > MAXPATHLEN) { 718 if (ndp->ni_pathlen > 1) 719 uma_zfree(namei_zone, cp); 720 error = ENAMETOOLONG; 721 break; 722 } 723 if (ndp->ni_pathlen > 1) { 724 bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen); 725 uma_zfree(namei_zone, cnp->cn_pnbuf); 726 cnp->cn_pnbuf = cp; 727 } else 728 cnp->cn_pnbuf[linklen] = '\0'; 729 ndp->ni_pathlen += linklen; 730 vput(ndp->ni_vp); 731 dp = ndp->ni_dvp; 732 /* 733 * Check if root directory should replace current directory. 734 */ 735 cnp->cn_nameptr = cnp->cn_pnbuf; 736 if (*(cnp->cn_nameptr) == '/') { 737 vrele(dp); 738 error = namei_handle_root(ndp, &dp); 739 if (error != 0) 740 goto out; 741 } 742 } 743 vput(ndp->ni_vp); 744 ndp->ni_vp = NULL; 745 vrele(ndp->ni_dvp); 746 out: 747 MPASS(error != 0); 748 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, false, ndp); 749 namei_cleanup_cnp(cnp); 750 nameicap_cleanup(ndp); 751 pwd_drop(pwd); 752 return (error); 753 } 754 755 static int 756 compute_cn_lkflags(struct mount *mp, int lkflags, int cnflags) 757 { 758 759 if (mp == NULL || ((lkflags & LK_SHARED) && 760 (!(mp->mnt_kern_flag & MNTK_LOOKUP_SHARED) || 761 ((cnflags & ISDOTDOT) && 762 (mp->mnt_kern_flag & MNTK_LOOKUP_EXCL_DOTDOT))))) { 763 lkflags &= ~LK_SHARED; 764 lkflags |= LK_EXCLUSIVE; 765 } 766 lkflags |= LK_NODDLKTREAT; 767 return (lkflags); 768 } 769 770 static __inline int 771 needs_exclusive_leaf(struct mount *mp, int flags) 772 { 773 774 /* 775 * Intermediate nodes can use shared locks, we only need to 776 * force an exclusive lock for leaf nodes. 777 */ 778 if ((flags & (ISLASTCN | LOCKLEAF)) != (ISLASTCN | LOCKLEAF)) 779 return (0); 780 781 /* Always use exclusive locks if LOCKSHARED isn't set. */ 782 if (!(flags & LOCKSHARED)) 783 return (1); 784 785 /* 786 * For lookups during open(), if the mount point supports 787 * extended shared operations, then use a shared lock for the 788 * leaf node, otherwise use an exclusive lock. 789 */ 790 if ((flags & ISOPEN) != 0) 791 return (!MNT_EXTENDED_SHARED(mp)); 792 793 /* 794 * Lookup requests outside of open() that specify LOCKSHARED 795 * only need a shared lock on the leaf vnode. 796 */ 797 return (0); 798 } 799 800 /* 801 * Various filesystems expect to be able to copy a name component with length 802 * bounded by NAME_MAX into a directory entry buffer of size MAXNAMLEN. Make 803 * sure that these are the same size. 804 */ 805 _Static_assert(MAXNAMLEN == NAME_MAX, 806 "MAXNAMLEN and NAME_MAX have different values"); 807 808 /* 809 * Search a pathname. 810 * This is a very central and rather complicated routine. 811 * 812 * The pathname is pointed to by ni_ptr and is of length ni_pathlen. 813 * The starting directory is taken from ni_startdir. The pathname is 814 * descended until done, or a symbolic link is encountered. The variable 815 * ni_more is clear if the path is completed; it is set to one if a 816 * symbolic link needing interpretation is encountered. 817 * 818 * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on 819 * whether the name is to be looked up, created, renamed, or deleted. 820 * When CREATE, RENAME, or DELETE is specified, information usable in 821 * creating, renaming, or deleting a directory entry may be calculated. 822 * If flag has LOCKPARENT or'ed into it, the parent directory is returned 823 * locked. If flag has WANTPARENT or'ed into it, the parent directory is 824 * returned unlocked. Otherwise the parent directory is not returned. If 825 * the target of the pathname exists and LOCKLEAF is or'ed into the flag 826 * the target is returned locked, otherwise it is returned unlocked. 827 * When creating or renaming and LOCKPARENT is specified, the target may not 828 * be ".". When deleting and LOCKPARENT is specified, the target may be ".". 829 * 830 * Overall outline of lookup: 831 * 832 * dirloop: 833 * identify next component of name at ndp->ni_ptr 834 * handle degenerate case where name is null string 835 * if .. and crossing mount points and on mounted filesys, find parent 836 * call VOP_LOOKUP routine for next component name 837 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set 838 * component vnode returned in ni_vp (if it exists), locked. 839 * if result vnode is mounted on and crossing mount points, 840 * find mounted on vnode 841 * if more components of name, do next level at dirloop 842 * return the answer in ni_vp, locked if LOCKLEAF set 843 * if LOCKPARENT set, return locked parent in ni_dvp 844 * if WANTPARENT set, return unlocked parent in ni_dvp 845 */ 846 int 847 lookup(struct nameidata *ndp) 848 { 849 char *cp; /* pointer into pathname argument */ 850 char *prev_ni_next; /* saved ndp->ni_next */ 851 char *nulchar; /* location of '\0' in cn_pnbuf */ 852 struct vnode *dp = NULL; /* the directory we are searching */ 853 struct vnode *tdp; /* saved dp */ 854 struct mount *mp; /* mount table entry */ 855 struct prison *pr; 856 size_t prev_ni_pathlen; /* saved ndp->ni_pathlen */ 857 int docache; /* == 0 do not cache last component */ 858 int wantparent; /* 1 => wantparent or lockparent flag */ 859 int rdonly; /* lookup read-only flag bit */ 860 int error = 0; 861 int dpunlocked = 0; /* dp has already been unlocked */ 862 int relookup = 0; /* do not consume the path component */ 863 struct componentname *cnp = &ndp->ni_cnd; 864 int lkflags_save; 865 int ni_dvp_unlocked; 866 867 /* 868 * Setup: break out flag bits into variables. 869 */ 870 ni_dvp_unlocked = 0; 871 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); 872 KASSERT(cnp->cn_nameiop == LOOKUP || wantparent, 873 ("CREATE, DELETE, RENAME require LOCKPARENT or WANTPARENT.")); 874 /* 875 * When set to zero, docache causes the last component of the 876 * pathname to be deleted from the cache and the full lookup 877 * of the name to be done (via VOP_CACHEDLOOKUP()). Often 878 * filesystems need some pre-computed values that are made 879 * during the full lookup, for instance UFS sets dp->i_offset. 880 * 881 * The docache variable is set to zero when requested by the 882 * NOCACHE flag and for all modifying operations except CREATE. 883 */ 884 docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE; 885 if (cnp->cn_nameiop == DELETE || 886 (wantparent && cnp->cn_nameiop != CREATE && 887 cnp->cn_nameiop != LOOKUP)) 888 docache = 0; 889 rdonly = cnp->cn_flags & RDONLY; 890 cnp->cn_flags &= ~ISSYMLINK; 891 ndp->ni_dvp = NULL; 892 /* 893 * We use shared locks until we hit the parent of the last cn then 894 * we adjust based on the requesting flags. 895 */ 896 cnp->cn_lkflags = LK_SHARED; 897 dp = ndp->ni_startdir; 898 ndp->ni_startdir = NULLVP; 899 vn_lock(dp, 900 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | LK_RETRY, 901 cnp->cn_flags)); 902 903 dirloop: 904 /* 905 * Search a new directory. 906 * 907 * The last component of the filename is left accessible via 908 * cnp->cn_nameptr for callers that need the name. Callers needing 909 * the name set the SAVENAME flag. When done, they assume 910 * responsibility for freeing the pathname buffer. 911 * 912 * Store / as a temporary sentinel so that we only have one character 913 * to test for. Pathnames tend to be short so this should not be 914 * resulting in cache misses. 915 */ 916 nulchar = &cnp->cn_nameptr[ndp->ni_pathlen - 1]; 917 KASSERT(*nulchar == '\0', 918 ("%s: expected nul at %p; string [%s]\n", __func__, nulchar, 919 cnp->cn_pnbuf)); 920 *nulchar = '/'; 921 for (cp = cnp->cn_nameptr; *cp != '/'; cp++) { 922 KASSERT(*cp != '\0', 923 ("%s: encountered unexpected nul; string [%s]\n", __func__, 924 cnp->cn_nameptr)); 925 continue; 926 } 927 *nulchar = '\0'; 928 cnp->cn_namelen = cp - cnp->cn_nameptr; 929 if (cnp->cn_namelen > NAME_MAX) { 930 error = ENAMETOOLONG; 931 goto bad; 932 } 933 #ifdef NAMEI_DIAGNOSTIC 934 { char c = *cp; 935 *cp = '\0'; 936 printf("{%s}: ", cnp->cn_nameptr); 937 *cp = c; } 938 #endif 939 prev_ni_pathlen = ndp->ni_pathlen; 940 ndp->ni_pathlen -= cnp->cn_namelen; 941 KASSERT(ndp->ni_pathlen <= PATH_MAX, 942 ("%s: ni_pathlen underflow to %zd\n", __func__, ndp->ni_pathlen)); 943 prev_ni_next = ndp->ni_next; 944 ndp->ni_next = cp; 945 946 /* 947 * Replace multiple slashes by a single slash and trailing slashes 948 * by a null. This must be done before VOP_LOOKUP() because some 949 * fs's don't know about trailing slashes. Remember if there were 950 * trailing slashes to handle symlinks, existing non-directories 951 * and non-existing files that won't be directories specially later. 952 */ 953 while (*cp == '/' && (cp[1] == '/' || cp[1] == '\0')) { 954 cp++; 955 ndp->ni_pathlen--; 956 if (*cp == '\0') { 957 *ndp->ni_next = '\0'; 958 cnp->cn_flags |= TRAILINGSLASH; 959 } 960 } 961 ndp->ni_next = cp; 962 963 cnp->cn_flags |= MAKEENTRY; 964 if (*cp == '\0' && docache == 0) 965 cnp->cn_flags &= ~MAKEENTRY; 966 if (cnp->cn_namelen == 2 && 967 cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.') 968 cnp->cn_flags |= ISDOTDOT; 969 else 970 cnp->cn_flags &= ~ISDOTDOT; 971 if (*ndp->ni_next == 0) 972 cnp->cn_flags |= ISLASTCN; 973 else 974 cnp->cn_flags &= ~ISLASTCN; 975 976 if ((cnp->cn_flags & ISLASTCN) != 0 && 977 cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.' && 978 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 979 error = EINVAL; 980 goto bad; 981 } 982 983 nameicap_tracker_add(ndp, dp); 984 985 /* 986 * Check for degenerate name (e.g. / or "") 987 * which is a way of talking about a directory, 988 * e.g. like "/." or ".". 989 */ 990 if (cnp->cn_nameptr[0] == '\0') { 991 if (dp->v_type != VDIR) { 992 error = ENOTDIR; 993 goto bad; 994 } 995 if (cnp->cn_nameiop != LOOKUP) { 996 error = EISDIR; 997 goto bad; 998 } 999 if (wantparent) { 1000 ndp->ni_dvp = dp; 1001 VREF(dp); 1002 } 1003 ndp->ni_vp = dp; 1004 1005 if (cnp->cn_flags & AUDITVNODE1) 1006 AUDIT_ARG_VNODE1(dp); 1007 else if (cnp->cn_flags & AUDITVNODE2) 1008 AUDIT_ARG_VNODE2(dp); 1009 1010 if (!(cnp->cn_flags & (LOCKPARENT | LOCKLEAF))) 1011 VOP_UNLOCK(dp); 1012 /* XXX This should probably move to the top of function. */ 1013 if (cnp->cn_flags & SAVESTART) 1014 panic("lookup: SAVESTART"); 1015 goto success; 1016 } 1017 1018 /* 1019 * Handle "..": five special cases. 1020 * 0. If doing a capability lookup and lookup_cap_dotdot is 1021 * disabled, return ENOTCAPABLE. 1022 * 1. Return an error if this is the last component of 1023 * the name and the operation is DELETE or RENAME. 1024 * 2. If at root directory (e.g. after chroot) 1025 * or at absolute root directory 1026 * then ignore it so can't get out. 1027 * 3. If this vnode is the root of a mounted 1028 * filesystem, then replace it with the 1029 * vnode which was mounted on so we take the 1030 * .. in the other filesystem. 1031 * 4. If the vnode is the top directory of 1032 * the jail or chroot, don't let them out. 1033 * 5. If doing a capability lookup and lookup_cap_dotdot is 1034 * enabled, return ENOTCAPABLE if the lookup would escape 1035 * from the initial file descriptor directory. Checks are 1036 * done by ensuring that namei() already traversed the 1037 * result of dotdot lookup. 1038 */ 1039 if (cnp->cn_flags & ISDOTDOT) { 1040 if ((ndp->ni_lcf & (NI_LCF_STRICTRELATIVE | NI_LCF_CAP_DOTDOT)) 1041 == NI_LCF_STRICTRELATIVE) { 1042 #ifdef KTRACE 1043 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1044 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1045 #endif 1046 error = ENOTCAPABLE; 1047 goto bad; 1048 } 1049 if ((cnp->cn_flags & ISLASTCN) != 0 && 1050 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1051 error = EINVAL; 1052 goto bad; 1053 } 1054 for (;;) { 1055 for (pr = cnp->cn_cred->cr_prison; pr != NULL; 1056 pr = pr->pr_parent) 1057 if (dp == pr->pr_root) 1058 break; 1059 if (dp == ndp->ni_rootdir || 1060 dp == ndp->ni_topdir || 1061 dp == rootvnode || 1062 pr != NULL || 1063 ((dp->v_vflag & VV_ROOT) != 0 && 1064 (cnp->cn_flags & NOCROSSMOUNT) != 0)) { 1065 ndp->ni_dvp = dp; 1066 ndp->ni_vp = dp; 1067 VREF(dp); 1068 goto nextname; 1069 } 1070 if ((dp->v_vflag & VV_ROOT) == 0) 1071 break; 1072 if (VN_IS_DOOMED(dp)) { /* forced unmount */ 1073 error = ENOENT; 1074 goto bad; 1075 } 1076 tdp = dp; 1077 dp = dp->v_mount->mnt_vnodecovered; 1078 VREF(dp); 1079 vput(tdp); 1080 vn_lock(dp, 1081 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 1082 LK_RETRY, ISDOTDOT)); 1083 error = nameicap_check_dotdot(ndp, dp); 1084 if (error != 0) { 1085 #ifdef KTRACE 1086 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1087 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1088 #endif 1089 goto bad; 1090 } 1091 } 1092 } 1093 1094 /* 1095 * We now have a segment name to search for, and a directory to search. 1096 */ 1097 unionlookup: 1098 #ifdef MAC 1099 error = mac_vnode_check_lookup(cnp->cn_thread->td_ucred, dp, cnp); 1100 if (error) 1101 goto bad; 1102 #endif 1103 ndp->ni_dvp = dp; 1104 ndp->ni_vp = NULL; 1105 ASSERT_VOP_LOCKED(dp, "lookup"); 1106 /* 1107 * If we have a shared lock we may need to upgrade the lock for the 1108 * last operation. 1109 */ 1110 if ((cnp->cn_flags & LOCKPARENT) && (cnp->cn_flags & ISLASTCN) && 1111 dp != vp_crossmp && VOP_ISLOCKED(dp) == LK_SHARED) 1112 vn_lock(dp, LK_UPGRADE|LK_RETRY); 1113 if (VN_IS_DOOMED(dp)) { 1114 error = ENOENT; 1115 goto bad; 1116 } 1117 /* 1118 * If we're looking up the last component and we need an exclusive 1119 * lock, adjust our lkflags. 1120 */ 1121 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags)) 1122 cnp->cn_lkflags = LK_EXCLUSIVE; 1123 #ifdef NAMEI_DIAGNOSTIC 1124 vn_printf(dp, "lookup in "); 1125 #endif 1126 lkflags_save = cnp->cn_lkflags; 1127 cnp->cn_lkflags = compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags, 1128 cnp->cn_flags); 1129 error = VOP_LOOKUP(dp, &ndp->ni_vp, cnp); 1130 cnp->cn_lkflags = lkflags_save; 1131 if (error != 0) { 1132 KASSERT(ndp->ni_vp == NULL, ("leaf should be empty")); 1133 #ifdef NAMEI_DIAGNOSTIC 1134 printf("not found\n"); 1135 #endif 1136 if ((error == ENOENT) && 1137 (dp->v_vflag & VV_ROOT) && (dp->v_mount != NULL) && 1138 (dp->v_mount->mnt_flag & MNT_UNION)) { 1139 tdp = dp; 1140 dp = dp->v_mount->mnt_vnodecovered; 1141 VREF(dp); 1142 vput(tdp); 1143 vn_lock(dp, 1144 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 1145 LK_RETRY, cnp->cn_flags)); 1146 nameicap_tracker_add(ndp, dp); 1147 goto unionlookup; 1148 } 1149 1150 if (error == ERELOOKUP) { 1151 vref(dp); 1152 ndp->ni_vp = dp; 1153 error = 0; 1154 relookup = 1; 1155 goto good; 1156 } 1157 1158 if (error != EJUSTRETURN) 1159 goto bad; 1160 /* 1161 * At this point, we know we're at the end of the 1162 * pathname. If creating / renaming, we can consider 1163 * allowing the file or directory to be created / renamed, 1164 * provided we're not on a read-only filesystem. 1165 */ 1166 if (rdonly) { 1167 error = EROFS; 1168 goto bad; 1169 } 1170 /* trailing slash only allowed for directories */ 1171 if ((cnp->cn_flags & TRAILINGSLASH) && 1172 !(cnp->cn_flags & WILLBEDIR)) { 1173 error = ENOENT; 1174 goto bad; 1175 } 1176 if ((cnp->cn_flags & LOCKPARENT) == 0) 1177 VOP_UNLOCK(dp); 1178 /* 1179 * We return with ni_vp NULL to indicate that the entry 1180 * doesn't currently exist, leaving a pointer to the 1181 * (possibly locked) directory vnode in ndp->ni_dvp. 1182 */ 1183 if (cnp->cn_flags & SAVESTART) { 1184 ndp->ni_startdir = ndp->ni_dvp; 1185 VREF(ndp->ni_startdir); 1186 } 1187 goto success; 1188 } 1189 1190 good: 1191 #ifdef NAMEI_DIAGNOSTIC 1192 printf("found\n"); 1193 #endif 1194 dp = ndp->ni_vp; 1195 1196 /* 1197 * Check to see if the vnode has been mounted on; 1198 * if so find the root of the mounted filesystem. 1199 */ 1200 while (dp->v_type == VDIR && (mp = dp->v_mountedhere) && 1201 (cnp->cn_flags & NOCROSSMOUNT) == 0) { 1202 if (vfs_busy(mp, 0)) 1203 continue; 1204 vput(dp); 1205 if (dp != ndp->ni_dvp) 1206 vput(ndp->ni_dvp); 1207 else 1208 vrele(ndp->ni_dvp); 1209 vrefact(vp_crossmp); 1210 ndp->ni_dvp = vp_crossmp; 1211 error = VFS_ROOT(mp, compute_cn_lkflags(mp, cnp->cn_lkflags, 1212 cnp->cn_flags), &tdp); 1213 vfs_unbusy(mp); 1214 if (vn_lock(vp_crossmp, LK_SHARED | LK_NOWAIT)) 1215 panic("vp_crossmp exclusively locked or reclaimed"); 1216 if (error) { 1217 dpunlocked = 1; 1218 goto bad2; 1219 } 1220 ndp->ni_vp = dp = tdp; 1221 } 1222 1223 /* 1224 * Check for symbolic link 1225 */ 1226 if ((dp->v_type == VLNK) && 1227 ((cnp->cn_flags & FOLLOW) || (cnp->cn_flags & TRAILINGSLASH) || 1228 *ndp->ni_next == '/')) { 1229 cnp->cn_flags |= ISSYMLINK; 1230 if (VN_IS_DOOMED(dp)) { 1231 /* 1232 * We can't know whether the directory was mounted with 1233 * NOSYMFOLLOW, so we can't follow safely. 1234 */ 1235 error = ENOENT; 1236 goto bad2; 1237 } 1238 if (dp->v_mount->mnt_flag & MNT_NOSYMFOLLOW) { 1239 error = EACCES; 1240 goto bad2; 1241 } 1242 /* 1243 * Symlink code always expects an unlocked dvp. 1244 */ 1245 if (ndp->ni_dvp != ndp->ni_vp) { 1246 VOP_UNLOCK(ndp->ni_dvp); 1247 ni_dvp_unlocked = 1; 1248 } 1249 goto success; 1250 } 1251 1252 nextname: 1253 /* 1254 * Not a symbolic link that we will follow. Continue with the 1255 * next component if there is any; otherwise, we're done. 1256 */ 1257 KASSERT((cnp->cn_flags & ISLASTCN) || *ndp->ni_next == '/', 1258 ("lookup: invalid path state.")); 1259 if (relookup) { 1260 relookup = 0; 1261 ndp->ni_pathlen = prev_ni_pathlen; 1262 ndp->ni_next = prev_ni_next; 1263 if (ndp->ni_dvp != dp) 1264 vput(ndp->ni_dvp); 1265 else 1266 vrele(ndp->ni_dvp); 1267 goto dirloop; 1268 } 1269 if (cnp->cn_flags & ISDOTDOT) { 1270 error = nameicap_check_dotdot(ndp, ndp->ni_vp); 1271 if (error != 0) { 1272 #ifdef KTRACE 1273 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1274 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1275 #endif 1276 goto bad2; 1277 } 1278 } 1279 if (*ndp->ni_next == '/') { 1280 cnp->cn_nameptr = ndp->ni_next; 1281 while (*cnp->cn_nameptr == '/') { 1282 cnp->cn_nameptr++; 1283 ndp->ni_pathlen--; 1284 } 1285 if (ndp->ni_dvp != dp) 1286 vput(ndp->ni_dvp); 1287 else 1288 vrele(ndp->ni_dvp); 1289 goto dirloop; 1290 } 1291 /* 1292 * If we're processing a path with a trailing slash, 1293 * check that the end result is a directory. 1294 */ 1295 if ((cnp->cn_flags & TRAILINGSLASH) && dp->v_type != VDIR) { 1296 error = ENOTDIR; 1297 goto bad2; 1298 } 1299 /* 1300 * Disallow directory write attempts on read-only filesystems. 1301 */ 1302 if (rdonly && 1303 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1304 error = EROFS; 1305 goto bad2; 1306 } 1307 if (cnp->cn_flags & SAVESTART) { 1308 ndp->ni_startdir = ndp->ni_dvp; 1309 VREF(ndp->ni_startdir); 1310 } 1311 if (!wantparent) { 1312 ni_dvp_unlocked = 2; 1313 if (ndp->ni_dvp != dp) 1314 vput(ndp->ni_dvp); 1315 else 1316 vrele(ndp->ni_dvp); 1317 } else if ((cnp->cn_flags & LOCKPARENT) == 0 && ndp->ni_dvp != dp) { 1318 VOP_UNLOCK(ndp->ni_dvp); 1319 ni_dvp_unlocked = 1; 1320 } 1321 1322 if (cnp->cn_flags & AUDITVNODE1) 1323 AUDIT_ARG_VNODE1(dp); 1324 else if (cnp->cn_flags & AUDITVNODE2) 1325 AUDIT_ARG_VNODE2(dp); 1326 1327 if ((cnp->cn_flags & LOCKLEAF) == 0) 1328 VOP_UNLOCK(dp); 1329 success: 1330 /* 1331 * FIXME: for lookups which only cross a mount point to fetch the 1332 * root vnode, ni_dvp will be set to vp_crossmp. This can be a problem 1333 * if either WANTPARENT or LOCKPARENT is set. 1334 */ 1335 /* 1336 * Because of shared lookup we may have the vnode shared locked, but 1337 * the caller may want it to be exclusively locked. 1338 */ 1339 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags) && 1340 VOP_ISLOCKED(dp) != LK_EXCLUSIVE) { 1341 vn_lock(dp, LK_UPGRADE | LK_RETRY); 1342 if (VN_IS_DOOMED(dp)) { 1343 error = ENOENT; 1344 goto bad2; 1345 } 1346 } 1347 if (ndp->ni_vp != NULL) { 1348 if ((cnp->cn_flags & ISDOTDOT) == 0) 1349 nameicap_tracker_add(ndp, ndp->ni_vp); 1350 if ((cnp->cn_flags & (FAILIFEXISTS | ISSYMLINK)) == FAILIFEXISTS) 1351 goto bad_eexist; 1352 } 1353 return (0); 1354 1355 bad2: 1356 if (ni_dvp_unlocked != 2) { 1357 if (dp != ndp->ni_dvp && !ni_dvp_unlocked) 1358 vput(ndp->ni_dvp); 1359 else 1360 vrele(ndp->ni_dvp); 1361 } 1362 bad: 1363 if (!dpunlocked) 1364 vput(dp); 1365 ndp->ni_vp = NULL; 1366 return (error); 1367 bad_eexist: 1368 /* 1369 * FAILIFEXISTS handling. 1370 * 1371 * XXX namei called with LOCKPARENT but not LOCKLEAF has the strange 1372 * behaviour of leaving the vnode unlocked if the target is the same 1373 * vnode as the parent. 1374 */ 1375 MPASS((cnp->cn_flags & ISSYMLINK) == 0); 1376 if (ndp->ni_vp == ndp->ni_dvp) 1377 vrele(ndp->ni_dvp); 1378 else 1379 vput(ndp->ni_dvp); 1380 vrele(ndp->ni_vp); 1381 ndp->ni_dvp = NULL; 1382 ndp->ni_vp = NULL; 1383 NDFREE(ndp, NDF_ONLY_PNBUF); 1384 return (EEXIST); 1385 } 1386 1387 /* 1388 * relookup - lookup a path name component 1389 * Used by lookup to re-acquire things. 1390 */ 1391 int 1392 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp) 1393 { 1394 struct vnode *dp = NULL; /* the directory we are searching */ 1395 int rdonly; /* lookup read-only flag bit */ 1396 int error = 0; 1397 1398 KASSERT(cnp->cn_flags & ISLASTCN, 1399 ("relookup: Not given last component.")); 1400 /* 1401 * Setup: break out flag bits into variables. 1402 */ 1403 KASSERT((cnp->cn_flags & (LOCKPARENT | WANTPARENT)) != 0, 1404 ("relookup: parent not wanted")); 1405 rdonly = cnp->cn_flags & RDONLY; 1406 cnp->cn_flags &= ~ISSYMLINK; 1407 dp = dvp; 1408 cnp->cn_lkflags = LK_EXCLUSIVE; 1409 vn_lock(dp, LK_EXCLUSIVE | LK_RETRY); 1410 1411 /* 1412 * Search a new directory. 1413 * 1414 * The last component of the filename is left accessible via 1415 * cnp->cn_nameptr for callers that need the name. Callers needing 1416 * the name set the SAVENAME flag. When done, they assume 1417 * responsibility for freeing the pathname buffer. 1418 */ 1419 #ifdef NAMEI_DIAGNOSTIC 1420 printf("{%s}: ", cnp->cn_nameptr); 1421 #endif 1422 1423 /* 1424 * Check for "" which represents the root directory after slash 1425 * removal. 1426 */ 1427 if (cnp->cn_nameptr[0] == '\0') { 1428 /* 1429 * Support only LOOKUP for "/" because lookup() 1430 * can't succeed for CREATE, DELETE and RENAME. 1431 */ 1432 KASSERT(cnp->cn_nameiop == LOOKUP, ("nameiop must be LOOKUP")); 1433 KASSERT(dp->v_type == VDIR, ("dp is not a directory")); 1434 1435 if (!(cnp->cn_flags & LOCKLEAF)) 1436 VOP_UNLOCK(dp); 1437 *vpp = dp; 1438 /* XXX This should probably move to the top of function. */ 1439 if (cnp->cn_flags & SAVESTART) 1440 panic("lookup: SAVESTART"); 1441 return (0); 1442 } 1443 1444 if (cnp->cn_flags & ISDOTDOT) 1445 panic ("relookup: lookup on dot-dot"); 1446 1447 /* 1448 * We now have a segment name to search for, and a directory to search. 1449 */ 1450 #ifdef NAMEI_DIAGNOSTIC 1451 vn_printf(dp, "search in "); 1452 #endif 1453 if ((error = VOP_LOOKUP(dp, vpp, cnp)) != 0) { 1454 KASSERT(*vpp == NULL, ("leaf should be empty")); 1455 if (error != EJUSTRETURN) 1456 goto bad; 1457 /* 1458 * If creating and at end of pathname, then can consider 1459 * allowing file to be created. 1460 */ 1461 if (rdonly) { 1462 error = EROFS; 1463 goto bad; 1464 } 1465 /* ASSERT(dvp == ndp->ni_startdir) */ 1466 if (cnp->cn_flags & SAVESTART) 1467 VREF(dvp); 1468 if ((cnp->cn_flags & LOCKPARENT) == 0) 1469 VOP_UNLOCK(dp); 1470 /* 1471 * We return with ni_vp NULL to indicate that the entry 1472 * doesn't currently exist, leaving a pointer to the 1473 * (possibly locked) directory vnode in ndp->ni_dvp. 1474 */ 1475 return (0); 1476 } 1477 1478 dp = *vpp; 1479 1480 /* 1481 * Disallow directory write attempts on read-only filesystems. 1482 */ 1483 if (rdonly && 1484 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1485 if (dvp == dp) 1486 vrele(dvp); 1487 else 1488 vput(dvp); 1489 error = EROFS; 1490 goto bad; 1491 } 1492 /* 1493 * Set the parent lock/ref state to the requested state. 1494 */ 1495 if ((cnp->cn_flags & LOCKPARENT) == 0 && dvp != dp) 1496 VOP_UNLOCK(dvp); 1497 /* 1498 * Check for symbolic link 1499 */ 1500 KASSERT(dp->v_type != VLNK || !(cnp->cn_flags & FOLLOW), 1501 ("relookup: symlink found.\n")); 1502 1503 /* ASSERT(dvp == ndp->ni_startdir) */ 1504 if (cnp->cn_flags & SAVESTART) 1505 VREF(dvp); 1506 1507 if ((cnp->cn_flags & LOCKLEAF) == 0) 1508 VOP_UNLOCK(dp); 1509 return (0); 1510 bad: 1511 vput(dp); 1512 *vpp = NULL; 1513 return (error); 1514 } 1515 1516 /* 1517 * Free data allocated by namei(); see namei(9) for details. 1518 */ 1519 void 1520 NDFREE_PNBUF(struct nameidata *ndp) 1521 { 1522 1523 if ((ndp->ni_cnd.cn_flags & HASBUF) != 0) { 1524 MPASS((ndp->ni_cnd.cn_flags & (SAVENAME | SAVESTART)) != 0); 1525 uma_zfree(namei_zone, ndp->ni_cnd.cn_pnbuf); 1526 ndp->ni_cnd.cn_flags &= ~HASBUF; 1527 } 1528 } 1529 1530 /* 1531 * NDFREE_PNBUF replacement for callers that know there is no buffer. 1532 * 1533 * This is a hack. Preferably the VFS layer would not produce anything more 1534 * than it was asked to do. Unfortunately several non-LOOKUP cases can add the 1535 * HASBUF flag to the result. Even then an interface could be implemented where 1536 * the caller specifies what they expected to see in the result and what they 1537 * are going to take care of. 1538 * 1539 * In the meantime provide this kludge as a trivial replacement for NDFREE_PNBUF 1540 * calls scattered throughout the kernel where we know for a fact the flag must not 1541 * be seen. 1542 */ 1543 #ifdef INVARIANTS 1544 void 1545 NDFREE_NOTHING(struct nameidata *ndp) 1546 { 1547 struct componentname *cnp; 1548 1549 cnp = &ndp->ni_cnd; 1550 KASSERT(cnp->cn_nameiop == LOOKUP, ("%s: got non-LOOKUP op %d\n", 1551 __func__, cnp->cn_nameiop)); 1552 KASSERT((cnp->cn_flags & (SAVENAME | HASBUF)) == 0, 1553 ("%s: bad flags \%" PRIx64 "\n", __func__, cnp->cn_flags)); 1554 } 1555 #endif 1556 1557 void 1558 (NDFREE)(struct nameidata *ndp, const u_int flags) 1559 { 1560 int unlock_dvp; 1561 int unlock_vp; 1562 1563 unlock_dvp = 0; 1564 unlock_vp = 0; 1565 1566 if (!(flags & NDF_NO_FREE_PNBUF)) { 1567 NDFREE_PNBUF(ndp); 1568 } 1569 if (!(flags & NDF_NO_VP_UNLOCK) && 1570 (ndp->ni_cnd.cn_flags & LOCKLEAF) && ndp->ni_vp) 1571 unlock_vp = 1; 1572 if (!(flags & NDF_NO_DVP_UNLOCK) && 1573 (ndp->ni_cnd.cn_flags & LOCKPARENT) && 1574 ndp->ni_dvp != ndp->ni_vp) 1575 unlock_dvp = 1; 1576 if (!(flags & NDF_NO_VP_RELE) && ndp->ni_vp) { 1577 if (unlock_vp) { 1578 vput(ndp->ni_vp); 1579 unlock_vp = 0; 1580 } else 1581 vrele(ndp->ni_vp); 1582 ndp->ni_vp = NULL; 1583 } 1584 if (unlock_vp) 1585 VOP_UNLOCK(ndp->ni_vp); 1586 if (!(flags & NDF_NO_DVP_RELE) && 1587 (ndp->ni_cnd.cn_flags & (LOCKPARENT|WANTPARENT))) { 1588 if (unlock_dvp) { 1589 vput(ndp->ni_dvp); 1590 unlock_dvp = 0; 1591 } else 1592 vrele(ndp->ni_dvp); 1593 ndp->ni_dvp = NULL; 1594 } 1595 if (unlock_dvp) 1596 VOP_UNLOCK(ndp->ni_dvp); 1597 if (!(flags & NDF_NO_STARTDIR_RELE) && 1598 (ndp->ni_cnd.cn_flags & SAVESTART)) { 1599 vrele(ndp->ni_startdir); 1600 ndp->ni_startdir = NULL; 1601 } 1602 } 1603 1604 #ifdef INVARIANTS 1605 /* 1606 * Validate the final state of ndp after the lookup. 1607 * 1608 * Historically filesystems were allowed to modify cn_flags. Most notably they 1609 * can add SAVENAME to the request, resulting in HASBUF and pushing subsequent 1610 * clean up to the consumer. In practice this seems to only concern != LOOKUP 1611 * operations. 1612 * 1613 * As a step towards stricter API contract this routine validates the state to 1614 * clean up. Note validation is a work in progress with the intent of becoming 1615 * stricter over time. 1616 */ 1617 #define NDMODIFYINGFLAGS (LOCKLEAF | LOCKPARENT | WANTPARENT | SAVENAME | SAVESTART | HASBUF) 1618 void 1619 NDVALIDATE(struct nameidata *ndp) 1620 { 1621 struct componentname *cnp; 1622 u_int64_t used, orig; 1623 1624 cnp = &ndp->ni_cnd; 1625 orig = cnp->cn_origflags; 1626 used = cnp->cn_flags; 1627 switch (cnp->cn_nameiop) { 1628 case LOOKUP: 1629 /* 1630 * For plain lookup we require strict conformance -- nothing 1631 * to clean up if it was not requested by the caller. 1632 */ 1633 orig &= NDMODIFYINGFLAGS; 1634 used &= NDMODIFYINGFLAGS; 1635 if ((orig & (SAVENAME | SAVESTART)) != 0) 1636 orig |= HASBUF; 1637 if (orig != used) { 1638 goto out_mismatch; 1639 } 1640 break; 1641 case CREATE: 1642 case DELETE: 1643 case RENAME: 1644 /* 1645 * Some filesystems set SAVENAME to provoke HASBUF, accomodate 1646 * for it until it gets fixed. 1647 */ 1648 orig &= NDMODIFYINGFLAGS; 1649 orig |= (SAVENAME | HASBUF); 1650 used &= NDMODIFYINGFLAGS; 1651 used |= (SAVENAME | HASBUF); 1652 if (orig != used) { 1653 goto out_mismatch; 1654 } 1655 break; 1656 } 1657 return; 1658 out_mismatch: 1659 panic("%s: mismatched flags for op %d: added %" PRIx64 ", " 1660 "removed %" PRIx64" (%" PRIx64" != %" PRIx64"; stored %" PRIx64" != %" PRIx64")", 1661 __func__, cnp->cn_nameiop, used & ~orig, orig &~ used, 1662 orig, used, cnp->cn_origflags, cnp->cn_flags); 1663 } 1664 #endif 1665 1666 /* 1667 * Determine if there is a suitable alternate filename under the specified 1668 * prefix for the specified path. If the create flag is set, then the 1669 * alternate prefix will be used so long as the parent directory exists. 1670 * This is used by the various compatibility ABIs so that Linux binaries prefer 1671 * files under /compat/linux for example. The chosen path (whether under 1672 * the prefix or under /) is returned in a kernel malloc'd buffer pointed 1673 * to by pathbuf. The caller is responsible for free'ing the buffer from 1674 * the M_TEMP bucket if one is returned. 1675 */ 1676 int 1677 kern_alternate_path(struct thread *td, const char *prefix, const char *path, 1678 enum uio_seg pathseg, char **pathbuf, int create, int dirfd) 1679 { 1680 struct nameidata nd, ndroot; 1681 char *ptr, *buf, *cp; 1682 size_t len, sz; 1683 int error; 1684 1685 buf = (char *) malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 1686 *pathbuf = buf; 1687 1688 /* Copy the prefix into the new pathname as a starting point. */ 1689 len = strlcpy(buf, prefix, MAXPATHLEN); 1690 if (len >= MAXPATHLEN) { 1691 *pathbuf = NULL; 1692 free(buf, M_TEMP); 1693 return (EINVAL); 1694 } 1695 sz = MAXPATHLEN - len; 1696 ptr = buf + len; 1697 1698 /* Append the filename to the prefix. */ 1699 if (pathseg == UIO_SYSSPACE) 1700 error = copystr(path, ptr, sz, &len); 1701 else 1702 error = copyinstr(path, ptr, sz, &len); 1703 1704 if (error) { 1705 *pathbuf = NULL; 1706 free(buf, M_TEMP); 1707 return (error); 1708 } 1709 1710 /* Only use a prefix with absolute pathnames. */ 1711 if (*ptr != '/') { 1712 error = EINVAL; 1713 goto keeporig; 1714 } 1715 1716 if (dirfd != AT_FDCWD) { 1717 /* 1718 * We want the original because the "prefix" is 1719 * included in the already opened dirfd. 1720 */ 1721 bcopy(ptr, buf, len); 1722 return (0); 1723 } 1724 1725 /* 1726 * We know that there is a / somewhere in this pathname. 1727 * Search backwards for it, to find the file's parent dir 1728 * to see if it exists in the alternate tree. If it does, 1729 * and we want to create a file (cflag is set). We don't 1730 * need to worry about the root comparison in this case. 1731 */ 1732 1733 if (create) { 1734 for (cp = &ptr[len] - 1; *cp != '/'; cp--); 1735 *cp = '\0'; 1736 1737 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, buf, td); 1738 error = namei(&nd); 1739 *cp = '/'; 1740 if (error != 0) 1741 goto keeporig; 1742 } else { 1743 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, buf, td); 1744 1745 error = namei(&nd); 1746 if (error != 0) 1747 goto keeporig; 1748 1749 /* 1750 * We now compare the vnode of the prefix to the one 1751 * vnode asked. If they resolve to be the same, then we 1752 * ignore the match so that the real root gets used. 1753 * This avoids the problem of traversing "../.." to find the 1754 * root directory and never finding it, because "/" resolves 1755 * to the emulation root directory. This is expensive :-( 1756 */ 1757 NDINIT(&ndroot, LOOKUP, FOLLOW, UIO_SYSSPACE, prefix, 1758 td); 1759 1760 /* We shouldn't ever get an error from this namei(). */ 1761 error = namei(&ndroot); 1762 if (error == 0) { 1763 if (nd.ni_vp == ndroot.ni_vp) 1764 error = ENOENT; 1765 1766 NDFREE(&ndroot, NDF_ONLY_PNBUF); 1767 vrele(ndroot.ni_vp); 1768 } 1769 } 1770 1771 NDFREE(&nd, NDF_ONLY_PNBUF); 1772 vrele(nd.ni_vp); 1773 1774 keeporig: 1775 /* If there was an error, use the original path name. */ 1776 if (error) 1777 bcopy(ptr, buf, len); 1778 return (error); 1779 } 1780