xref: /freebsd/sys/kern/vfs_lookup.c (revision d1d015864103b253b3fcb2f72a0da5b0cfeb31b6)
1 /*-
2  * Copyright (c) 1982, 1986, 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 4. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)vfs_lookup.c	8.4 (Berkeley) 2/16/94
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include "opt_capsicum.h"
41 #include "opt_kdtrace.h"
42 #include "opt_ktrace.h"
43 
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/kernel.h>
47 #include <sys/capability.h>
48 #include <sys/fcntl.h>
49 #include <sys/jail.h>
50 #include <sys/lock.h>
51 #include <sys/mutex.h>
52 #include <sys/namei.h>
53 #include <sys/vnode.h>
54 #include <sys/mount.h>
55 #include <sys/filedesc.h>
56 #include <sys/proc.h>
57 #include <sys/sdt.h>
58 #include <sys/syscallsubr.h>
59 #include <sys/sysctl.h>
60 #ifdef KTRACE
61 #include <sys/ktrace.h>
62 #endif
63 
64 #include <security/audit/audit.h>
65 #include <security/mac/mac_framework.h>
66 
67 #include <vm/uma.h>
68 
69 #define	NAMEI_DIAGNOSTIC 1
70 #undef NAMEI_DIAGNOSTIC
71 
72 SDT_PROVIDER_DECLARE(vfs);
73 SDT_PROBE_DEFINE3(vfs, namei, lookup, entry, entry, "struct vnode *", "char *",
74     "unsigned long");
75 SDT_PROBE_DEFINE2(vfs, namei, lookup, return, return, "int", "struct vnode *");
76 
77 /*
78  * Allocation zone for namei
79  */
80 uma_zone_t namei_zone;
81 /*
82  * Placeholder vnode for mp traversal
83  */
84 static struct vnode *vp_crossmp;
85 
86 static void
87 nameiinit(void *dummy __unused)
88 {
89 
90 	namei_zone = uma_zcreate("NAMEI", MAXPATHLEN, NULL, NULL, NULL, NULL,
91 	    UMA_ALIGN_PTR, 0);
92 	getnewvnode("crossmp", NULL, &dead_vnodeops, &vp_crossmp);
93 	vn_lock(vp_crossmp, LK_EXCLUSIVE);
94 	VN_LOCK_ASHARE(vp_crossmp);
95 	VOP_UNLOCK(vp_crossmp, 0);
96 }
97 SYSINIT(vfs, SI_SUB_VFS, SI_ORDER_SECOND, nameiinit, NULL);
98 
99 static int lookup_shared = 1;
100 SYSCTL_INT(_vfs, OID_AUTO, lookup_shared, CTLFLAG_RW, &lookup_shared, 0,
101     "Enables/Disables shared locks for path name translation");
102 TUNABLE_INT("vfs.lookup_shared", &lookup_shared);
103 
104 /*
105  * Convert a pathname into a pointer to a locked vnode.
106  *
107  * The FOLLOW flag is set when symbolic links are to be followed
108  * when they occur at the end of the name translation process.
109  * Symbolic links are always followed for all other pathname
110  * components other than the last.
111  *
112  * The segflg defines whether the name is to be copied from user
113  * space or kernel space.
114  *
115  * Overall outline of namei:
116  *
117  *	copy in name
118  *	get starting directory
119  *	while (!done && !error) {
120  *		call lookup to search path.
121  *		if symbolic link, massage name in buffer and continue
122  *	}
123  */
124 int
125 namei(struct nameidata *ndp)
126 {
127 	struct filedesc *fdp;	/* pointer to file descriptor state */
128 	char *cp;		/* pointer into pathname argument */
129 	struct vnode *dp;	/* the directory we are searching */
130 	struct iovec aiov;		/* uio for reading symbolic links */
131 	struct uio auio;
132 	int error, linklen;
133 	struct componentname *cnp = &ndp->ni_cnd;
134 	struct thread *td = cnp->cn_thread;
135 	struct proc *p = td->td_proc;
136 
137 	ndp->ni_cnd.cn_cred = ndp->ni_cnd.cn_thread->td_ucred;
138 	KASSERT(cnp->cn_cred && p, ("namei: bad cred/proc"));
139 	KASSERT((cnp->cn_nameiop & (~OPMASK)) == 0,
140 	    ("namei: nameiop contaminated with flags"));
141 	KASSERT((cnp->cn_flags & OPMASK) == 0,
142 	    ("namei: flags contaminated with nameiops"));
143 	if (!lookup_shared)
144 		cnp->cn_flags &= ~LOCKSHARED;
145 	fdp = p->p_fd;
146 
147 	/* We will set this ourselves if we need it. */
148 	cnp->cn_flags &= ~TRAILINGSLASH;
149 
150 	/*
151 	 * Get a buffer for the name to be translated, and copy the
152 	 * name into the buffer.
153 	 */
154 	if ((cnp->cn_flags & HASBUF) == 0)
155 		cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK);
156 	if (ndp->ni_segflg == UIO_SYSSPACE)
157 		error = copystr(ndp->ni_dirp, cnp->cn_pnbuf,
158 			    MAXPATHLEN, (size_t *)&ndp->ni_pathlen);
159 	else
160 		error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf,
161 			    MAXPATHLEN, (size_t *)&ndp->ni_pathlen);
162 
163 	/*
164 	 * Don't allow empty pathnames.
165 	 */
166 	if (!error && *cnp->cn_pnbuf == '\0')
167 		error = ENOENT;
168 
169 #ifdef CAPABILITY_MODE
170 	/*
171 	 * In capability mode, lookups must be "strictly relative" (i.e.
172 	 * not an absolute path, and not containing '..' components) to
173 	 * a real file descriptor, not the pseudo-descriptor AT_FDCWD.
174 	 */
175 	if (error == 0 && IN_CAPABILITY_MODE(td) &&
176 	    (cnp->cn_flags & NOCAPCHECK) == 0) {
177 		ndp->ni_strictrelative = 1;
178 		if (ndp->ni_dirfd == AT_FDCWD) {
179 #ifdef KTRACE
180 			if (KTRPOINT(td, KTR_CAPFAIL))
181 				ktrcapfail(CAPFAIL_LOOKUP, 0, 0);
182 #endif
183 			error = ECAPMODE;
184 		}
185 	}
186 #endif
187 	if (error) {
188 		uma_zfree(namei_zone, cnp->cn_pnbuf);
189 #ifdef DIAGNOSTIC
190 		cnp->cn_pnbuf = NULL;
191 		cnp->cn_nameptr = NULL;
192 #endif
193 		ndp->ni_vp = NULL;
194 		return (error);
195 	}
196 	ndp->ni_loopcnt = 0;
197 #ifdef KTRACE
198 	if (KTRPOINT(td, KTR_NAMEI)) {
199 		KASSERT(cnp->cn_thread == curthread,
200 		    ("namei not using curthread"));
201 		ktrnamei(cnp->cn_pnbuf);
202 	}
203 #endif
204 	/*
205 	 * Get starting point for the translation.
206 	 */
207 	FILEDESC_SLOCK(fdp);
208 	ndp->ni_rootdir = fdp->fd_rdir;
209 	ndp->ni_topdir = fdp->fd_jdir;
210 
211 	/*
212 	 * If we are auditing the kernel pathname, save the user pathname.
213 	 */
214 	if (cnp->cn_flags & AUDITVNODE1)
215 		AUDIT_ARG_UPATH1(td, ndp->ni_dirfd, cnp->cn_pnbuf);
216 	if (cnp->cn_flags & AUDITVNODE2)
217 		AUDIT_ARG_UPATH2(td, ndp->ni_dirfd, cnp->cn_pnbuf);
218 
219 	dp = NULL;
220 	if (cnp->cn_pnbuf[0] != '/') {
221 		if (ndp->ni_startdir != NULL) {
222 			dp = ndp->ni_startdir;
223 			error = 0;
224 		} else if (ndp->ni_dirfd != AT_FDCWD) {
225 			cap_rights_t rights;
226 
227 			rights = ndp->ni_rightsneeded;
228 			cap_rights_set(&rights, CAP_LOOKUP);
229 
230 			if (cnp->cn_flags & AUDITVNODE1)
231 				AUDIT_ARG_ATFD1(ndp->ni_dirfd);
232 			if (cnp->cn_flags & AUDITVNODE2)
233 				AUDIT_ARG_ATFD2(ndp->ni_dirfd);
234 			error = fgetvp_rights(td, ndp->ni_dirfd,
235 			    &rights, &ndp->ni_filecaps, &dp);
236 #ifdef CAPABILITIES
237 			/*
238 			 * If file descriptor doesn't have all rights,
239 			 * all lookups relative to it must also be
240 			 * strictly relative.
241 			 */
242 			CAP_ALL(&rights);
243 			if (!cap_rights_contains(&ndp->ni_filecaps.fc_rights,
244 			    &rights) ||
245 			    ndp->ni_filecaps.fc_fcntls != CAP_FCNTL_ALL ||
246 			    ndp->ni_filecaps.fc_nioctls != -1) {
247 				ndp->ni_strictrelative = 1;
248 			}
249 #endif
250 		}
251 		if (error != 0 || dp != NULL) {
252 			FILEDESC_SUNLOCK(fdp);
253 			if (error == 0 && dp->v_type != VDIR) {
254 				vrele(dp);
255 				error = ENOTDIR;
256 			}
257 		}
258 		if (error) {
259 			uma_zfree(namei_zone, cnp->cn_pnbuf);
260 #ifdef DIAGNOSTIC
261 			cnp->cn_pnbuf = NULL;
262 			cnp->cn_nameptr = NULL;
263 #endif
264 			return (error);
265 		}
266 	}
267 	if (dp == NULL) {
268 		dp = fdp->fd_cdir;
269 		VREF(dp);
270 		FILEDESC_SUNLOCK(fdp);
271 		if (ndp->ni_startdir != NULL)
272 			vrele(ndp->ni_startdir);
273 	}
274 	SDT_PROBE(vfs, namei, lookup, entry, dp, cnp->cn_pnbuf,
275 	    cnp->cn_flags, 0, 0);
276 	for (;;) {
277 		/*
278 		 * Check if root directory should replace current directory.
279 		 * Done at start of translation and after symbolic link.
280 		 */
281 		cnp->cn_nameptr = cnp->cn_pnbuf;
282 		if (*(cnp->cn_nameptr) == '/') {
283 			vrele(dp);
284 			if (ndp->ni_strictrelative != 0) {
285 #ifdef KTRACE
286 				if (KTRPOINT(curthread, KTR_CAPFAIL))
287 					ktrcapfail(CAPFAIL_LOOKUP, 0, 0);
288 #endif
289 				return (ENOTCAPABLE);
290 			}
291 			while (*(cnp->cn_nameptr) == '/') {
292 				cnp->cn_nameptr++;
293 				ndp->ni_pathlen--;
294 			}
295 			dp = ndp->ni_rootdir;
296 			VREF(dp);
297 		}
298 		ndp->ni_startdir = dp;
299 		error = lookup(ndp);
300 		if (error) {
301 			uma_zfree(namei_zone, cnp->cn_pnbuf);
302 #ifdef DIAGNOSTIC
303 			cnp->cn_pnbuf = NULL;
304 			cnp->cn_nameptr = NULL;
305 #endif
306 			SDT_PROBE(vfs, namei, lookup, return, error, NULL, 0,
307 			    0, 0);
308 			return (error);
309 		}
310 		/*
311 		 * If not a symbolic link, we're done.
312 		 */
313 		if ((cnp->cn_flags & ISSYMLINK) == 0) {
314 			if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0) {
315 				uma_zfree(namei_zone, cnp->cn_pnbuf);
316 #ifdef DIAGNOSTIC
317 				cnp->cn_pnbuf = NULL;
318 				cnp->cn_nameptr = NULL;
319 #endif
320 			} else
321 				cnp->cn_flags |= HASBUF;
322 
323 			SDT_PROBE(vfs, namei, lookup, return, 0, ndp->ni_vp,
324 			    0, 0, 0);
325 			return (0);
326 		}
327 		if (ndp->ni_loopcnt++ >= MAXSYMLINKS) {
328 			error = ELOOP;
329 			break;
330 		}
331 #ifdef MAC
332 		if ((cnp->cn_flags & NOMACCHECK) == 0) {
333 			error = mac_vnode_check_readlink(td->td_ucred,
334 			    ndp->ni_vp);
335 			if (error)
336 				break;
337 		}
338 #endif
339 		if (ndp->ni_pathlen > 1)
340 			cp = uma_zalloc(namei_zone, M_WAITOK);
341 		else
342 			cp = cnp->cn_pnbuf;
343 		aiov.iov_base = cp;
344 		aiov.iov_len = MAXPATHLEN;
345 		auio.uio_iov = &aiov;
346 		auio.uio_iovcnt = 1;
347 		auio.uio_offset = 0;
348 		auio.uio_rw = UIO_READ;
349 		auio.uio_segflg = UIO_SYSSPACE;
350 		auio.uio_td = td;
351 		auio.uio_resid = MAXPATHLEN;
352 		error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred);
353 		if (error) {
354 			if (ndp->ni_pathlen > 1)
355 				uma_zfree(namei_zone, cp);
356 			break;
357 		}
358 		linklen = MAXPATHLEN - auio.uio_resid;
359 		if (linklen == 0) {
360 			if (ndp->ni_pathlen > 1)
361 				uma_zfree(namei_zone, cp);
362 			error = ENOENT;
363 			break;
364 		}
365 		if (linklen + ndp->ni_pathlen >= MAXPATHLEN) {
366 			if (ndp->ni_pathlen > 1)
367 				uma_zfree(namei_zone, cp);
368 			error = ENAMETOOLONG;
369 			break;
370 		}
371 		if (ndp->ni_pathlen > 1) {
372 			bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen);
373 			uma_zfree(namei_zone, cnp->cn_pnbuf);
374 			cnp->cn_pnbuf = cp;
375 		} else
376 			cnp->cn_pnbuf[linklen] = '\0';
377 		ndp->ni_pathlen += linklen;
378 		vput(ndp->ni_vp);
379 		dp = ndp->ni_dvp;
380 	}
381 	uma_zfree(namei_zone, cnp->cn_pnbuf);
382 #ifdef DIAGNOSTIC
383 	cnp->cn_pnbuf = NULL;
384 	cnp->cn_nameptr = NULL;
385 #endif
386 	vput(ndp->ni_vp);
387 	ndp->ni_vp = NULL;
388 	vrele(ndp->ni_dvp);
389 	SDT_PROBE(vfs, namei, lookup, return, error, NULL, 0, 0, 0);
390 	return (error);
391 }
392 
393 static int
394 compute_cn_lkflags(struct mount *mp, int lkflags, int cnflags)
395 {
396 
397 	if (mp == NULL || ((lkflags & LK_SHARED) &&
398 	    (!(mp->mnt_kern_flag & MNTK_LOOKUP_SHARED) ||
399 	    ((cnflags & ISDOTDOT) &&
400 	    (mp->mnt_kern_flag & MNTK_LOOKUP_EXCL_DOTDOT))))) {
401 		lkflags &= ~LK_SHARED;
402 		lkflags |= LK_EXCLUSIVE;
403 	}
404 	return (lkflags);
405 }
406 
407 static __inline int
408 needs_exclusive_leaf(struct mount *mp, int flags)
409 {
410 
411 	/*
412 	 * Intermediate nodes can use shared locks, we only need to
413 	 * force an exclusive lock for leaf nodes.
414 	 */
415 	if ((flags & (ISLASTCN | LOCKLEAF)) != (ISLASTCN | LOCKLEAF))
416 		return (0);
417 
418 	/* Always use exclusive locks if LOCKSHARED isn't set. */
419 	if (!(flags & LOCKSHARED))
420 		return (1);
421 
422 	/*
423 	 * For lookups during open(), if the mount point supports
424 	 * extended shared operations, then use a shared lock for the
425 	 * leaf node, otherwise use an exclusive lock.
426 	 */
427 	if (flags & ISOPEN) {
428 		if (mp != NULL &&
429 		    (mp->mnt_kern_flag & MNTK_EXTENDED_SHARED))
430 			return (0);
431 		else
432 			return (1);
433 	}
434 
435 	/*
436 	 * Lookup requests outside of open() that specify LOCKSHARED
437 	 * only need a shared lock on the leaf vnode.
438 	 */
439 	return (0);
440 }
441 
442 /*
443  * Search a pathname.
444  * This is a very central and rather complicated routine.
445  *
446  * The pathname is pointed to by ni_ptr and is of length ni_pathlen.
447  * The starting directory is taken from ni_startdir. The pathname is
448  * descended until done, or a symbolic link is encountered. The variable
449  * ni_more is clear if the path is completed; it is set to one if a
450  * symbolic link needing interpretation is encountered.
451  *
452  * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on
453  * whether the name is to be looked up, created, renamed, or deleted.
454  * When CREATE, RENAME, or DELETE is specified, information usable in
455  * creating, renaming, or deleting a directory entry may be calculated.
456  * If flag has LOCKPARENT or'ed into it, the parent directory is returned
457  * locked. If flag has WANTPARENT or'ed into it, the parent directory is
458  * returned unlocked. Otherwise the parent directory is not returned. If
459  * the target of the pathname exists and LOCKLEAF is or'ed into the flag
460  * the target is returned locked, otherwise it is returned unlocked.
461  * When creating or renaming and LOCKPARENT is specified, the target may not
462  * be ".".  When deleting and LOCKPARENT is specified, the target may be ".".
463  *
464  * Overall outline of lookup:
465  *
466  * dirloop:
467  *	identify next component of name at ndp->ni_ptr
468  *	handle degenerate case where name is null string
469  *	if .. and crossing mount points and on mounted filesys, find parent
470  *	call VOP_LOOKUP routine for next component name
471  *	    directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set
472  *	    component vnode returned in ni_vp (if it exists), locked.
473  *	if result vnode is mounted on and crossing mount points,
474  *	    find mounted on vnode
475  *	if more components of name, do next level at dirloop
476  *	return the answer in ni_vp, locked if LOCKLEAF set
477  *	    if LOCKPARENT set, return locked parent in ni_dvp
478  *	    if WANTPARENT set, return unlocked parent in ni_dvp
479  */
480 int
481 lookup(struct nameidata *ndp)
482 {
483 	char *cp;		/* pointer into pathname argument */
484 	struct vnode *dp = 0;	/* the directory we are searching */
485 	struct vnode *tdp;		/* saved dp */
486 	struct mount *mp;		/* mount table entry */
487 	struct prison *pr;
488 	int docache;			/* == 0 do not cache last component */
489 	int wantparent;			/* 1 => wantparent or lockparent flag */
490 	int rdonly;			/* lookup read-only flag bit */
491 	int error = 0;
492 	int dpunlocked = 0;		/* dp has already been unlocked */
493 	struct componentname *cnp = &ndp->ni_cnd;
494 	int lkflags_save;
495 	int ni_dvp_unlocked;
496 
497 	/*
498 	 * Setup: break out flag bits into variables.
499 	 */
500 	ni_dvp_unlocked = 0;
501 	wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT);
502 	KASSERT(cnp->cn_nameiop == LOOKUP || wantparent,
503 	    ("CREATE, DELETE, RENAME require LOCKPARENT or WANTPARENT."));
504 	docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE;
505 	if (cnp->cn_nameiop == DELETE ||
506 	    (wantparent && cnp->cn_nameiop != CREATE &&
507 	     cnp->cn_nameiop != LOOKUP))
508 		docache = 0;
509 	rdonly = cnp->cn_flags & RDONLY;
510 	cnp->cn_flags &= ~ISSYMLINK;
511 	ndp->ni_dvp = NULL;
512 	/*
513 	 * We use shared locks until we hit the parent of the last cn then
514 	 * we adjust based on the requesting flags.
515 	 */
516 	if (lookup_shared)
517 		cnp->cn_lkflags = LK_SHARED;
518 	else
519 		cnp->cn_lkflags = LK_EXCLUSIVE;
520 	dp = ndp->ni_startdir;
521 	ndp->ni_startdir = NULLVP;
522 	vn_lock(dp,
523 	    compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | LK_RETRY,
524 	    cnp->cn_flags));
525 
526 dirloop:
527 	/*
528 	 * Search a new directory.
529 	 *
530 	 * The last component of the filename is left accessible via
531 	 * cnp->cn_nameptr for callers that need the name. Callers needing
532 	 * the name set the SAVENAME flag. When done, they assume
533 	 * responsibility for freeing the pathname buffer.
534 	 */
535 	cnp->cn_consume = 0;
536 	for (cp = cnp->cn_nameptr; *cp != 0 && *cp != '/'; cp++)
537 		continue;
538 	cnp->cn_namelen = cp - cnp->cn_nameptr;
539 	if (cnp->cn_namelen > NAME_MAX) {
540 		error = ENAMETOOLONG;
541 		goto bad;
542 	}
543 #ifdef NAMEI_DIAGNOSTIC
544 	{ char c = *cp;
545 	*cp = '\0';
546 	printf("{%s}: ", cnp->cn_nameptr);
547 	*cp = c; }
548 #endif
549 	ndp->ni_pathlen -= cnp->cn_namelen;
550 	ndp->ni_next = cp;
551 
552 	/*
553 	 * Replace multiple slashes by a single slash and trailing slashes
554 	 * by a null.  This must be done before VOP_LOOKUP() because some
555 	 * fs's don't know about trailing slashes.  Remember if there were
556 	 * trailing slashes to handle symlinks, existing non-directories
557 	 * and non-existing files that won't be directories specially later.
558 	 */
559 	while (*cp == '/' && (cp[1] == '/' || cp[1] == '\0')) {
560 		cp++;
561 		ndp->ni_pathlen--;
562 		if (*cp == '\0') {
563 			*ndp->ni_next = '\0';
564 			cnp->cn_flags |= TRAILINGSLASH;
565 		}
566 	}
567 	ndp->ni_next = cp;
568 
569 	cnp->cn_flags |= MAKEENTRY;
570 	if (*cp == '\0' && docache == 0)
571 		cnp->cn_flags &= ~MAKEENTRY;
572 	if (cnp->cn_namelen == 2 &&
573 	    cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.')
574 		cnp->cn_flags |= ISDOTDOT;
575 	else
576 		cnp->cn_flags &= ~ISDOTDOT;
577 	if (*ndp->ni_next == 0)
578 		cnp->cn_flags |= ISLASTCN;
579 	else
580 		cnp->cn_flags &= ~ISLASTCN;
581 
582 	if ((cnp->cn_flags & ISLASTCN) != 0 &&
583 	    cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.' &&
584 	    (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
585 		error = EINVAL;
586 		goto bad;
587 	}
588 
589 	/*
590 	 * Check for degenerate name (e.g. / or "")
591 	 * which is a way of talking about a directory,
592 	 * e.g. like "/." or ".".
593 	 */
594 	if (cnp->cn_nameptr[0] == '\0') {
595 		if (dp->v_type != VDIR) {
596 			error = ENOTDIR;
597 			goto bad;
598 		}
599 		if (cnp->cn_nameiop != LOOKUP) {
600 			error = EISDIR;
601 			goto bad;
602 		}
603 		if (wantparent) {
604 			ndp->ni_dvp = dp;
605 			VREF(dp);
606 		}
607 		ndp->ni_vp = dp;
608 
609 		if (cnp->cn_flags & AUDITVNODE1)
610 			AUDIT_ARG_VNODE1(dp);
611 		else if (cnp->cn_flags & AUDITVNODE2)
612 			AUDIT_ARG_VNODE2(dp);
613 
614 		if (!(cnp->cn_flags & (LOCKPARENT | LOCKLEAF)))
615 			VOP_UNLOCK(dp, 0);
616 		/* XXX This should probably move to the top of function. */
617 		if (cnp->cn_flags & SAVESTART)
618 			panic("lookup: SAVESTART");
619 		goto success;
620 	}
621 
622 	/*
623 	 * Handle "..": five special cases.
624 	 * 0. If doing a capability lookup, return ENOTCAPABLE (this is a
625 	 *    fairly conservative design choice, but it's the only one that we
626 	 *    are satisfied guarantees the property we're looking for).
627 	 * 1. Return an error if this is the last component of
628 	 *    the name and the operation is DELETE or RENAME.
629 	 * 2. If at root directory (e.g. after chroot)
630 	 *    or at absolute root directory
631 	 *    then ignore it so can't get out.
632 	 * 3. If this vnode is the root of a mounted
633 	 *    filesystem, then replace it with the
634 	 *    vnode which was mounted on so we take the
635 	 *    .. in the other filesystem.
636 	 * 4. If the vnode is the top directory of
637 	 *    the jail or chroot, don't let them out.
638 	 */
639 	if (cnp->cn_flags & ISDOTDOT) {
640 		if (ndp->ni_strictrelative != 0) {
641 #ifdef KTRACE
642 			if (KTRPOINT(curthread, KTR_CAPFAIL))
643 				ktrcapfail(CAPFAIL_LOOKUP, 0, 0);
644 #endif
645 			error = ENOTCAPABLE;
646 			goto bad;
647 		}
648 		if ((cnp->cn_flags & ISLASTCN) != 0 &&
649 		    (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
650 			error = EINVAL;
651 			goto bad;
652 		}
653 		for (;;) {
654 			for (pr = cnp->cn_cred->cr_prison; pr != NULL;
655 			     pr = pr->pr_parent)
656 				if (dp == pr->pr_root)
657 					break;
658 			if (dp == ndp->ni_rootdir ||
659 			    dp == ndp->ni_topdir ||
660 			    dp == rootvnode ||
661 			    pr != NULL ||
662 			    ((dp->v_vflag & VV_ROOT) != 0 &&
663 			     (cnp->cn_flags & NOCROSSMOUNT) != 0)) {
664 				ndp->ni_dvp = dp;
665 				ndp->ni_vp = dp;
666 				VREF(dp);
667 				goto nextname;
668 			}
669 			if ((dp->v_vflag & VV_ROOT) == 0)
670 				break;
671 			if (dp->v_iflag & VI_DOOMED) {	/* forced unmount */
672 				error = ENOENT;
673 				goto bad;
674 			}
675 			tdp = dp;
676 			dp = dp->v_mount->mnt_vnodecovered;
677 			VREF(dp);
678 			vput(tdp);
679 			vn_lock(dp,
680 			    compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags |
681 			    LK_RETRY, ISDOTDOT));
682 		}
683 	}
684 
685 	/*
686 	 * We now have a segment name to search for, and a directory to search.
687 	 */
688 unionlookup:
689 #ifdef MAC
690 	if ((cnp->cn_flags & NOMACCHECK) == 0) {
691 		error = mac_vnode_check_lookup(cnp->cn_thread->td_ucred, dp,
692 		    cnp);
693 		if (error)
694 			goto bad;
695 	}
696 #endif
697 	ndp->ni_dvp = dp;
698 	ndp->ni_vp = NULL;
699 	ASSERT_VOP_LOCKED(dp, "lookup");
700 	/*
701 	 * If we have a shared lock we may need to upgrade the lock for the
702 	 * last operation.
703 	 */
704 	if (dp != vp_crossmp &&
705 	    VOP_ISLOCKED(dp) == LK_SHARED &&
706 	    (cnp->cn_flags & ISLASTCN) && (cnp->cn_flags & LOCKPARENT))
707 		vn_lock(dp, LK_UPGRADE|LK_RETRY);
708 	if ((dp->v_iflag & VI_DOOMED) != 0) {
709 		error = ENOENT;
710 		goto bad;
711 	}
712 	/*
713 	 * If we're looking up the last component and we need an exclusive
714 	 * lock, adjust our lkflags.
715 	 */
716 	if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags))
717 		cnp->cn_lkflags = LK_EXCLUSIVE;
718 #ifdef NAMEI_DIAGNOSTIC
719 	vprint("lookup in", dp);
720 #endif
721 	lkflags_save = cnp->cn_lkflags;
722 	cnp->cn_lkflags = compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags,
723 	    cnp->cn_flags);
724 	if ((error = VOP_LOOKUP(dp, &ndp->ni_vp, cnp)) != 0) {
725 		cnp->cn_lkflags = lkflags_save;
726 		KASSERT(ndp->ni_vp == NULL, ("leaf should be empty"));
727 #ifdef NAMEI_DIAGNOSTIC
728 		printf("not found\n");
729 #endif
730 		if ((error == ENOENT) &&
731 		    (dp->v_vflag & VV_ROOT) && (dp->v_mount != NULL) &&
732 		    (dp->v_mount->mnt_flag & MNT_UNION)) {
733 			tdp = dp;
734 			dp = dp->v_mount->mnt_vnodecovered;
735 			VREF(dp);
736 			vput(tdp);
737 			vn_lock(dp,
738 			    compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags |
739 			    LK_RETRY, cnp->cn_flags));
740 			goto unionlookup;
741 		}
742 
743 		if (error != EJUSTRETURN)
744 			goto bad;
745 		/*
746 		 * At this point, we know we're at the end of the
747 		 * pathname.  If creating / renaming, we can consider
748 		 * allowing the file or directory to be created / renamed,
749 		 * provided we're not on a read-only filesystem.
750 		 */
751 		if (rdonly) {
752 			error = EROFS;
753 			goto bad;
754 		}
755 		/* trailing slash only allowed for directories */
756 		if ((cnp->cn_flags & TRAILINGSLASH) &&
757 		    !(cnp->cn_flags & WILLBEDIR)) {
758 			error = ENOENT;
759 			goto bad;
760 		}
761 		if ((cnp->cn_flags & LOCKPARENT) == 0)
762 			VOP_UNLOCK(dp, 0);
763 		/*
764 		 * We return with ni_vp NULL to indicate that the entry
765 		 * doesn't currently exist, leaving a pointer to the
766 		 * (possibly locked) directory vnode in ndp->ni_dvp.
767 		 */
768 		if (cnp->cn_flags & SAVESTART) {
769 			ndp->ni_startdir = ndp->ni_dvp;
770 			VREF(ndp->ni_startdir);
771 		}
772 		goto success;
773 	} else
774 		cnp->cn_lkflags = lkflags_save;
775 #ifdef NAMEI_DIAGNOSTIC
776 	printf("found\n");
777 #endif
778 	/*
779 	 * Take into account any additional components consumed by
780 	 * the underlying filesystem.
781 	 */
782 	if (cnp->cn_consume > 0) {
783 		cnp->cn_nameptr += cnp->cn_consume;
784 		ndp->ni_next += cnp->cn_consume;
785 		ndp->ni_pathlen -= cnp->cn_consume;
786 		cnp->cn_consume = 0;
787 	}
788 
789 	dp = ndp->ni_vp;
790 
791 	/*
792 	 * Check to see if the vnode has been mounted on;
793 	 * if so find the root of the mounted filesystem.
794 	 */
795 	while (dp->v_type == VDIR && (mp = dp->v_mountedhere) &&
796 	       (cnp->cn_flags & NOCROSSMOUNT) == 0) {
797 		if (vfs_busy(mp, 0))
798 			continue;
799 		vput(dp);
800 		if (dp != ndp->ni_dvp)
801 			vput(ndp->ni_dvp);
802 		else
803 			vrele(ndp->ni_dvp);
804 		vref(vp_crossmp);
805 		ndp->ni_dvp = vp_crossmp;
806 		error = VFS_ROOT(mp, compute_cn_lkflags(mp, cnp->cn_lkflags,
807 		    cnp->cn_flags), &tdp);
808 		vfs_unbusy(mp);
809 		if (vn_lock(vp_crossmp, LK_SHARED | LK_NOWAIT))
810 			panic("vp_crossmp exclusively locked or reclaimed");
811 		if (error) {
812 			dpunlocked = 1;
813 			goto bad2;
814 		}
815 		ndp->ni_vp = dp = tdp;
816 	}
817 
818 	/*
819 	 * Check for symbolic link
820 	 */
821 	if ((dp->v_type == VLNK) &&
822 	    ((cnp->cn_flags & FOLLOW) || (cnp->cn_flags & TRAILINGSLASH) ||
823 	     *ndp->ni_next == '/')) {
824 		cnp->cn_flags |= ISSYMLINK;
825 		if (dp->v_iflag & VI_DOOMED) {
826 			/*
827 			 * We can't know whether the directory was mounted with
828 			 * NOSYMFOLLOW, so we can't follow safely.
829 			 */
830 			error = ENOENT;
831 			goto bad2;
832 		}
833 		if (dp->v_mount->mnt_flag & MNT_NOSYMFOLLOW) {
834 			error = EACCES;
835 			goto bad2;
836 		}
837 		/*
838 		 * Symlink code always expects an unlocked dvp.
839 		 */
840 		if (ndp->ni_dvp != ndp->ni_vp) {
841 			VOP_UNLOCK(ndp->ni_dvp, 0);
842 			ni_dvp_unlocked = 1;
843 		}
844 		goto success;
845 	}
846 
847 nextname:
848 	/*
849 	 * Not a symbolic link that we will follow.  Continue with the
850 	 * next component if there is any; otherwise, we're done.
851 	 */
852 	KASSERT((cnp->cn_flags & ISLASTCN) || *ndp->ni_next == '/',
853 	    ("lookup: invalid path state."));
854 	if (*ndp->ni_next == '/') {
855 		cnp->cn_nameptr = ndp->ni_next;
856 		while (*cnp->cn_nameptr == '/') {
857 			cnp->cn_nameptr++;
858 			ndp->ni_pathlen--;
859 		}
860 		if (ndp->ni_dvp != dp)
861 			vput(ndp->ni_dvp);
862 		else
863 			vrele(ndp->ni_dvp);
864 		goto dirloop;
865 	}
866 	/*
867 	 * If we're processing a path with a trailing slash,
868 	 * check that the end result is a directory.
869 	 */
870 	if ((cnp->cn_flags & TRAILINGSLASH) && dp->v_type != VDIR) {
871 		error = ENOTDIR;
872 		goto bad2;
873 	}
874 	/*
875 	 * Disallow directory write attempts on read-only filesystems.
876 	 */
877 	if (rdonly &&
878 	    (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
879 		error = EROFS;
880 		goto bad2;
881 	}
882 	if (cnp->cn_flags & SAVESTART) {
883 		ndp->ni_startdir = ndp->ni_dvp;
884 		VREF(ndp->ni_startdir);
885 	}
886 	if (!wantparent) {
887 		ni_dvp_unlocked = 2;
888 		if (ndp->ni_dvp != dp)
889 			vput(ndp->ni_dvp);
890 		else
891 			vrele(ndp->ni_dvp);
892 	} else if ((cnp->cn_flags & LOCKPARENT) == 0 && ndp->ni_dvp != dp) {
893 		VOP_UNLOCK(ndp->ni_dvp, 0);
894 		ni_dvp_unlocked = 1;
895 	}
896 
897 	if (cnp->cn_flags & AUDITVNODE1)
898 		AUDIT_ARG_VNODE1(dp);
899 	else if (cnp->cn_flags & AUDITVNODE2)
900 		AUDIT_ARG_VNODE2(dp);
901 
902 	if ((cnp->cn_flags & LOCKLEAF) == 0)
903 		VOP_UNLOCK(dp, 0);
904 success:
905 	/*
906 	 * Because of lookup_shared we may have the vnode shared locked, but
907 	 * the caller may want it to be exclusively locked.
908 	 */
909 	if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags) &&
910 	    VOP_ISLOCKED(dp) != LK_EXCLUSIVE) {
911 		vn_lock(dp, LK_UPGRADE | LK_RETRY);
912 		if (dp->v_iflag & VI_DOOMED) {
913 			error = ENOENT;
914 			goto bad2;
915 		}
916 	}
917 	return (0);
918 
919 bad2:
920 	if (ni_dvp_unlocked != 2) {
921 		if (dp != ndp->ni_dvp && !ni_dvp_unlocked)
922 			vput(ndp->ni_dvp);
923 		else
924 			vrele(ndp->ni_dvp);
925 	}
926 bad:
927 	if (!dpunlocked)
928 		vput(dp);
929 	ndp->ni_vp = NULL;
930 	return (error);
931 }
932 
933 /*
934  * relookup - lookup a path name component
935  *    Used by lookup to re-acquire things.
936  */
937 int
938 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp)
939 {
940 	struct vnode *dp = 0;		/* the directory we are searching */
941 	int wantparent;			/* 1 => wantparent or lockparent flag */
942 	int rdonly;			/* lookup read-only flag bit */
943 	int error = 0;
944 
945 	KASSERT(cnp->cn_flags & ISLASTCN,
946 	    ("relookup: Not given last component."));
947 	/*
948 	 * Setup: break out flag bits into variables.
949 	 */
950 	wantparent = cnp->cn_flags & (LOCKPARENT|WANTPARENT);
951 	KASSERT(wantparent, ("relookup: parent not wanted."));
952 	rdonly = cnp->cn_flags & RDONLY;
953 	cnp->cn_flags &= ~ISSYMLINK;
954 	dp = dvp;
955 	cnp->cn_lkflags = LK_EXCLUSIVE;
956 	vn_lock(dp, LK_EXCLUSIVE | LK_RETRY);
957 
958 	/*
959 	 * Search a new directory.
960 	 *
961 	 * The last component of the filename is left accessible via
962 	 * cnp->cn_nameptr for callers that need the name. Callers needing
963 	 * the name set the SAVENAME flag. When done, they assume
964 	 * responsibility for freeing the pathname buffer.
965 	 */
966 #ifdef NAMEI_DIAGNOSTIC
967 	printf("{%s}: ", cnp->cn_nameptr);
968 #endif
969 
970 	/*
971 	 * Check for "" which represents the root directory after slash
972 	 * removal.
973 	 */
974 	if (cnp->cn_nameptr[0] == '\0') {
975 		/*
976 		 * Support only LOOKUP for "/" because lookup()
977 		 * can't succeed for CREATE, DELETE and RENAME.
978 		 */
979 		KASSERT(cnp->cn_nameiop == LOOKUP, ("nameiop must be LOOKUP"));
980 		KASSERT(dp->v_type == VDIR, ("dp is not a directory"));
981 
982 		if (!(cnp->cn_flags & LOCKLEAF))
983 			VOP_UNLOCK(dp, 0);
984 		*vpp = dp;
985 		/* XXX This should probably move to the top of function. */
986 		if (cnp->cn_flags & SAVESTART)
987 			panic("lookup: SAVESTART");
988 		return (0);
989 	}
990 
991 	if (cnp->cn_flags & ISDOTDOT)
992 		panic ("relookup: lookup on dot-dot");
993 
994 	/*
995 	 * We now have a segment name to search for, and a directory to search.
996 	 */
997 #ifdef NAMEI_DIAGNOSTIC
998 	vprint("search in:", dp);
999 #endif
1000 	if ((error = VOP_LOOKUP(dp, vpp, cnp)) != 0) {
1001 		KASSERT(*vpp == NULL, ("leaf should be empty"));
1002 		if (error != EJUSTRETURN)
1003 			goto bad;
1004 		/*
1005 		 * If creating and at end of pathname, then can consider
1006 		 * allowing file to be created.
1007 		 */
1008 		if (rdonly) {
1009 			error = EROFS;
1010 			goto bad;
1011 		}
1012 		/* ASSERT(dvp == ndp->ni_startdir) */
1013 		if (cnp->cn_flags & SAVESTART)
1014 			VREF(dvp);
1015 		if ((cnp->cn_flags & LOCKPARENT) == 0)
1016 			VOP_UNLOCK(dp, 0);
1017 		/*
1018 		 * We return with ni_vp NULL to indicate that the entry
1019 		 * doesn't currently exist, leaving a pointer to the
1020 		 * (possibly locked) directory vnode in ndp->ni_dvp.
1021 		 */
1022 		return (0);
1023 	}
1024 
1025 	dp = *vpp;
1026 
1027 	/*
1028 	 * Disallow directory write attempts on read-only filesystems.
1029 	 */
1030 	if (rdonly &&
1031 	    (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
1032 		if (dvp == dp)
1033 			vrele(dvp);
1034 		else
1035 			vput(dvp);
1036 		error = EROFS;
1037 		goto bad;
1038 	}
1039 	/*
1040 	 * Set the parent lock/ref state to the requested state.
1041 	 */
1042 	if ((cnp->cn_flags & LOCKPARENT) == 0 && dvp != dp) {
1043 		if (wantparent)
1044 			VOP_UNLOCK(dvp, 0);
1045 		else
1046 			vput(dvp);
1047 	} else if (!wantparent)
1048 		vrele(dvp);
1049 	/*
1050 	 * Check for symbolic link
1051 	 */
1052 	KASSERT(dp->v_type != VLNK || !(cnp->cn_flags & FOLLOW),
1053 	    ("relookup: symlink found.\n"));
1054 
1055 	/* ASSERT(dvp == ndp->ni_startdir) */
1056 	if (cnp->cn_flags & SAVESTART)
1057 		VREF(dvp);
1058 
1059 	if ((cnp->cn_flags & LOCKLEAF) == 0)
1060 		VOP_UNLOCK(dp, 0);
1061 	return (0);
1062 bad:
1063 	vput(dp);
1064 	*vpp = NULL;
1065 	return (error);
1066 }
1067 
1068 void
1069 NDINIT_ALL(struct nameidata *ndp, u_long op, u_long flags, enum uio_seg segflg,
1070     const char *namep, int dirfd, struct vnode *startdir, cap_rights_t *rightsp,
1071     struct thread *td)
1072 {
1073 
1074 	ndp->ni_cnd.cn_nameiop = op;
1075 	ndp->ni_cnd.cn_flags = flags;
1076 	ndp->ni_segflg = segflg;
1077 	ndp->ni_dirp = namep;
1078 	ndp->ni_dirfd = dirfd;
1079 	ndp->ni_startdir = startdir;
1080 	ndp->ni_strictrelative = 0;
1081 	if (rightsp != NULL)
1082 		ndp->ni_rightsneeded = *rightsp;
1083 	else
1084 		cap_rights_init(&ndp->ni_rightsneeded);
1085 	filecaps_init(&ndp->ni_filecaps);
1086 	ndp->ni_cnd.cn_thread = td;
1087 }
1088 
1089 /*
1090  * Free data allocated by namei(); see namei(9) for details.
1091  */
1092 void
1093 NDFREE(struct nameidata *ndp, const u_int flags)
1094 {
1095 	int unlock_dvp;
1096 	int unlock_vp;
1097 
1098 	unlock_dvp = 0;
1099 	unlock_vp = 0;
1100 
1101 	if (!(flags & NDF_NO_FREE_PNBUF) &&
1102 	    (ndp->ni_cnd.cn_flags & HASBUF)) {
1103 		uma_zfree(namei_zone, ndp->ni_cnd.cn_pnbuf);
1104 		ndp->ni_cnd.cn_flags &= ~HASBUF;
1105 	}
1106 	if (!(flags & NDF_NO_VP_UNLOCK) &&
1107 	    (ndp->ni_cnd.cn_flags & LOCKLEAF) && ndp->ni_vp)
1108 		unlock_vp = 1;
1109 	if (!(flags & NDF_NO_VP_RELE) && ndp->ni_vp) {
1110 		if (unlock_vp) {
1111 			vput(ndp->ni_vp);
1112 			unlock_vp = 0;
1113 		} else
1114 			vrele(ndp->ni_vp);
1115 		ndp->ni_vp = NULL;
1116 	}
1117 	if (unlock_vp)
1118 		VOP_UNLOCK(ndp->ni_vp, 0);
1119 	if (!(flags & NDF_NO_DVP_UNLOCK) &&
1120 	    (ndp->ni_cnd.cn_flags & LOCKPARENT) &&
1121 	    ndp->ni_dvp != ndp->ni_vp)
1122 		unlock_dvp = 1;
1123 	if (!(flags & NDF_NO_DVP_RELE) &&
1124 	    (ndp->ni_cnd.cn_flags & (LOCKPARENT|WANTPARENT))) {
1125 		if (unlock_dvp) {
1126 			vput(ndp->ni_dvp);
1127 			unlock_dvp = 0;
1128 		} else
1129 			vrele(ndp->ni_dvp);
1130 		ndp->ni_dvp = NULL;
1131 	}
1132 	if (unlock_dvp)
1133 		VOP_UNLOCK(ndp->ni_dvp, 0);
1134 	if (!(flags & NDF_NO_STARTDIR_RELE) &&
1135 	    (ndp->ni_cnd.cn_flags & SAVESTART)) {
1136 		vrele(ndp->ni_startdir);
1137 		ndp->ni_startdir = NULL;
1138 	}
1139 }
1140 
1141 /*
1142  * Determine if there is a suitable alternate filename under the specified
1143  * prefix for the specified path.  If the create flag is set, then the
1144  * alternate prefix will be used so long as the parent directory exists.
1145  * This is used by the various compatiblity ABIs so that Linux binaries prefer
1146  * files under /compat/linux for example.  The chosen path (whether under
1147  * the prefix or under /) is returned in a kernel malloc'd buffer pointed
1148  * to by pathbuf.  The caller is responsible for free'ing the buffer from
1149  * the M_TEMP bucket if one is returned.
1150  */
1151 int
1152 kern_alternate_path(struct thread *td, const char *prefix, const char *path,
1153     enum uio_seg pathseg, char **pathbuf, int create, int dirfd)
1154 {
1155 	struct nameidata nd, ndroot;
1156 	char *ptr, *buf, *cp;
1157 	size_t len, sz;
1158 	int error;
1159 
1160 	buf = (char *) malloc(MAXPATHLEN, M_TEMP, M_WAITOK);
1161 	*pathbuf = buf;
1162 
1163 	/* Copy the prefix into the new pathname as a starting point. */
1164 	len = strlcpy(buf, prefix, MAXPATHLEN);
1165 	if (len >= MAXPATHLEN) {
1166 		*pathbuf = NULL;
1167 		free(buf, M_TEMP);
1168 		return (EINVAL);
1169 	}
1170 	sz = MAXPATHLEN - len;
1171 	ptr = buf + len;
1172 
1173 	/* Append the filename to the prefix. */
1174 	if (pathseg == UIO_SYSSPACE)
1175 		error = copystr(path, ptr, sz, &len);
1176 	else
1177 		error = copyinstr(path, ptr, sz, &len);
1178 
1179 	if (error) {
1180 		*pathbuf = NULL;
1181 		free(buf, M_TEMP);
1182 		return (error);
1183 	}
1184 
1185 	/* Only use a prefix with absolute pathnames. */
1186 	if (*ptr != '/') {
1187 		error = EINVAL;
1188 		goto keeporig;
1189 	}
1190 
1191 	if (dirfd != AT_FDCWD) {
1192 		/*
1193 		 * We want the original because the "prefix" is
1194 		 * included in the already opened dirfd.
1195 		 */
1196 		bcopy(ptr, buf, len);
1197 		return (0);
1198 	}
1199 
1200 	/*
1201 	 * We know that there is a / somewhere in this pathname.
1202 	 * Search backwards for it, to find the file's parent dir
1203 	 * to see if it exists in the alternate tree. If it does,
1204 	 * and we want to create a file (cflag is set). We don't
1205 	 * need to worry about the root comparison in this case.
1206 	 */
1207 
1208 	if (create) {
1209 		for (cp = &ptr[len] - 1; *cp != '/'; cp--);
1210 		*cp = '\0';
1211 
1212 		NDINIT(&nd, LOOKUP, FOLLOW, UIO_SYSSPACE, buf, td);
1213 		error = namei(&nd);
1214 		*cp = '/';
1215 		if (error != 0)
1216 			goto keeporig;
1217 	} else {
1218 		NDINIT(&nd, LOOKUP, FOLLOW, UIO_SYSSPACE, buf, td);
1219 
1220 		error = namei(&nd);
1221 		if (error != 0)
1222 			goto keeporig;
1223 
1224 		/*
1225 		 * We now compare the vnode of the prefix to the one
1226 		 * vnode asked. If they resolve to be the same, then we
1227 		 * ignore the match so that the real root gets used.
1228 		 * This avoids the problem of traversing "../.." to find the
1229 		 * root directory and never finding it, because "/" resolves
1230 		 * to the emulation root directory. This is expensive :-(
1231 		 */
1232 		NDINIT(&ndroot, LOOKUP, FOLLOW, UIO_SYSSPACE, prefix,
1233 		    td);
1234 
1235 		/* We shouldn't ever get an error from this namei(). */
1236 		error = namei(&ndroot);
1237 		if (error == 0) {
1238 			if (nd.ni_vp == ndroot.ni_vp)
1239 				error = ENOENT;
1240 
1241 			NDFREE(&ndroot, NDF_ONLY_PNBUF);
1242 			vrele(ndroot.ni_vp);
1243 		}
1244 	}
1245 
1246 	NDFREE(&nd, NDF_ONLY_PNBUF);
1247 	vrele(nd.ni_vp);
1248 
1249 keeporig:
1250 	/* If there was an error, use the original path name. */
1251 	if (error)
1252 		bcopy(ptr, buf, len);
1253 	return (error);
1254 }
1255