1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * (c) UNIX System Laboratories, Inc. 7 * All or some portions of this file are derived from material licensed 8 * to the University of California by American Telephone and Telegraph 9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 10 * the permission of UNIX System Laboratories, Inc. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#)vfs_lookup.c 8.4 (Berkeley) 2/16/94 37 */ 38 39 #include <sys/cdefs.h> 40 __FBSDID("$FreeBSD$"); 41 42 #include "opt_capsicum.h" 43 #include "opt_ktrace.h" 44 45 #include <sys/param.h> 46 #include <sys/systm.h> 47 #include <sys/dirent.h> 48 #include <sys/kernel.h> 49 #include <sys/capsicum.h> 50 #include <sys/fcntl.h> 51 #include <sys/jail.h> 52 #include <sys/lock.h> 53 #include <sys/mutex.h> 54 #include <sys/namei.h> 55 #include <sys/vnode.h> 56 #include <sys/mount.h> 57 #include <sys/filedesc.h> 58 #include <sys/proc.h> 59 #include <sys/sdt.h> 60 #include <sys/syscallsubr.h> 61 #include <sys/sysctl.h> 62 #ifdef KTRACE 63 #include <sys/ktrace.h> 64 #endif 65 #ifdef INVARIANTS 66 #include <machine/_inttypes.h> 67 #endif 68 69 #include <security/audit/audit.h> 70 #include <security/mac/mac_framework.h> 71 72 #include <vm/uma.h> 73 74 #define NAMEI_DIAGNOSTIC 1 75 #undef NAMEI_DIAGNOSTIC 76 77 SDT_PROVIDER_DEFINE(vfs); 78 SDT_PROBE_DEFINE4(vfs, namei, lookup, entry, "struct vnode *", "char *", 79 "unsigned long", "bool"); 80 SDT_PROBE_DEFINE4(vfs, namei, lookup, return, "int", "struct vnode *", "bool", 81 "struct nameidata"); 82 83 /* Allocation zone for namei. */ 84 uma_zone_t namei_zone; 85 86 /* Placeholder vnode for mp traversal. */ 87 static struct vnode *vp_crossmp; 88 89 static int 90 crossmp_vop_islocked(struct vop_islocked_args *ap) 91 { 92 93 return (LK_SHARED); 94 } 95 96 static int 97 crossmp_vop_lock1(struct vop_lock1_args *ap) 98 { 99 struct vnode *vp; 100 struct lock *lk __diagused; 101 const char *file __diagused; 102 int flags, line __diagused; 103 104 vp = ap->a_vp; 105 lk = vp->v_vnlock; 106 flags = ap->a_flags; 107 file = ap->a_file; 108 line = ap->a_line; 109 110 if ((flags & LK_SHARED) == 0) 111 panic("invalid lock request for crossmp"); 112 113 WITNESS_CHECKORDER(&lk->lock_object, LOP_NEWORDER, file, line, 114 flags & LK_INTERLOCK ? &VI_MTX(vp)->lock_object : NULL); 115 WITNESS_LOCK(&lk->lock_object, 0, file, line); 116 if ((flags & LK_INTERLOCK) != 0) 117 VI_UNLOCK(vp); 118 LOCK_LOG_LOCK("SLOCK", &lk->lock_object, 0, 0, ap->a_file, line); 119 return (0); 120 } 121 122 static int 123 crossmp_vop_unlock(struct vop_unlock_args *ap) 124 { 125 struct vnode *vp; 126 struct lock *lk __diagused; 127 128 vp = ap->a_vp; 129 lk = vp->v_vnlock; 130 131 WITNESS_UNLOCK(&lk->lock_object, 0, LOCK_FILE, LOCK_LINE); 132 LOCK_LOG_LOCK("SUNLOCK", &lk->lock_object, 0, 0, LOCK_FILE, 133 LOCK_LINE); 134 return (0); 135 } 136 137 static struct vop_vector crossmp_vnodeops = { 138 .vop_default = &default_vnodeops, 139 .vop_islocked = crossmp_vop_islocked, 140 .vop_lock1 = crossmp_vop_lock1, 141 .vop_unlock = crossmp_vop_unlock, 142 }; 143 /* 144 * VFS_VOP_VECTOR_REGISTER(crossmp_vnodeops) is not used here since the vnode 145 * gets allocated early. See nameiinit for the direct call below. 146 */ 147 148 struct nameicap_tracker { 149 struct vnode *dp; 150 TAILQ_ENTRY(nameicap_tracker) nm_link; 151 }; 152 153 /* Zone for cap mode tracker elements used for dotdot capability checks. */ 154 MALLOC_DEFINE(M_NAMEITRACKER, "namei_tracker", "namei tracking for dotdot"); 155 156 static void 157 nameiinit(void *dummy __unused) 158 { 159 160 namei_zone = uma_zcreate("NAMEI", MAXPATHLEN, NULL, NULL, NULL, NULL, 161 UMA_ALIGN_PTR, 0); 162 vfs_vector_op_register(&crossmp_vnodeops); 163 getnewvnode("crossmp", NULL, &crossmp_vnodeops, &vp_crossmp); 164 } 165 SYSINIT(vfs, SI_SUB_VFS, SI_ORDER_SECOND, nameiinit, NULL); 166 167 static int lookup_cap_dotdot = 1; 168 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot, CTLFLAG_RWTUN, 169 &lookup_cap_dotdot, 0, 170 "enables \"..\" components in path lookup in capability mode"); 171 static int lookup_cap_dotdot_nonlocal = 1; 172 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot_nonlocal, CTLFLAG_RWTUN, 173 &lookup_cap_dotdot_nonlocal, 0, 174 "enables \"..\" components in path lookup in capability mode " 175 "on non-local mount"); 176 177 static void 178 nameicap_tracker_add(struct nameidata *ndp, struct vnode *dp) 179 { 180 struct nameicap_tracker *nt; 181 182 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0 || dp->v_type != VDIR) 183 return; 184 nt = TAILQ_LAST(&ndp->ni_cap_tracker, nameicap_tracker_head); 185 if (nt != NULL && nt->dp == dp) 186 return; 187 nt = malloc(sizeof(*nt), M_NAMEITRACKER, M_WAITOK); 188 vhold(dp); 189 nt->dp = dp; 190 TAILQ_INSERT_TAIL(&ndp->ni_cap_tracker, nt, nm_link); 191 } 192 193 static void 194 nameicap_cleanup_from(struct nameidata *ndp, struct nameicap_tracker *first) 195 { 196 struct nameicap_tracker *nt, *nt1; 197 198 nt = first; 199 TAILQ_FOREACH_FROM_SAFE(nt, &ndp->ni_cap_tracker, nm_link, nt1) { 200 TAILQ_REMOVE(&ndp->ni_cap_tracker, nt, nm_link); 201 vdrop(nt->dp); 202 free(nt, M_NAMEITRACKER); 203 } 204 } 205 206 static void 207 nameicap_cleanup(struct nameidata *ndp) 208 { 209 KASSERT(TAILQ_EMPTY(&ndp->ni_cap_tracker) || 210 (ndp->ni_lcf & NI_LCF_CAP_DOTDOT) != 0, ("not strictrelative")); 211 nameicap_cleanup_from(ndp, NULL); 212 } 213 214 /* 215 * For dotdot lookups in capability mode, only allow the component 216 * lookup to succeed if the resulting directory was already traversed 217 * during the operation. This catches situations where already 218 * traversed directory is moved to different parent, and then we walk 219 * over it with dotdots. 220 * 221 * Also allow to force failure of dotdot lookups for non-local 222 * filesystems, where external agents might assist local lookups to 223 * escape the compartment. 224 */ 225 static int 226 nameicap_check_dotdot(struct nameidata *ndp, struct vnode *dp) 227 { 228 struct nameicap_tracker *nt; 229 struct mount *mp; 230 231 if (dp == NULL || dp->v_type != VDIR || (ndp->ni_lcf & 232 NI_LCF_STRICTRELATIVE) == 0) 233 return (0); 234 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0) 235 return (ENOTCAPABLE); 236 mp = dp->v_mount; 237 if (lookup_cap_dotdot_nonlocal == 0 && mp != NULL && 238 (mp->mnt_flag & MNT_LOCAL) == 0) 239 return (ENOTCAPABLE); 240 TAILQ_FOREACH_REVERSE(nt, &ndp->ni_cap_tracker, nameicap_tracker_head, 241 nm_link) { 242 if (dp == nt->dp) { 243 nt = TAILQ_NEXT(nt, nm_link); 244 if (nt != NULL) 245 nameicap_cleanup_from(ndp, nt); 246 return (0); 247 } 248 } 249 return (ENOTCAPABLE); 250 } 251 252 static void 253 namei_cleanup_cnp(struct componentname *cnp) 254 { 255 256 uma_zfree(namei_zone, cnp->cn_pnbuf); 257 #ifdef DIAGNOSTIC 258 cnp->cn_pnbuf = NULL; 259 cnp->cn_nameptr = NULL; 260 #endif 261 } 262 263 static int 264 namei_handle_root(struct nameidata *ndp, struct vnode **dpp) 265 { 266 struct componentname *cnp; 267 268 cnp = &ndp->ni_cnd; 269 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0) { 270 #ifdef KTRACE 271 if (KTRPOINT(curthread, KTR_CAPFAIL)) 272 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 273 #endif 274 return (ENOTCAPABLE); 275 } 276 while (*(cnp->cn_nameptr) == '/') { 277 cnp->cn_nameptr++; 278 ndp->ni_pathlen--; 279 } 280 *dpp = ndp->ni_rootdir; 281 vrefact(*dpp); 282 return (0); 283 } 284 285 static int 286 namei_setup(struct nameidata *ndp, struct vnode **dpp, struct pwd **pwdp) 287 { 288 struct componentname *cnp; 289 struct file *dfp; 290 struct thread *td; 291 struct pwd *pwd; 292 cap_rights_t rights; 293 int error; 294 bool startdir_used; 295 296 cnp = &ndp->ni_cnd; 297 td = curthread; 298 299 startdir_used = false; 300 *pwdp = NULL; 301 *dpp = NULL; 302 303 #ifdef CAPABILITY_MODE 304 /* 305 * In capability mode, lookups must be restricted to happen in 306 * the subtree with the root specified by the file descriptor: 307 * - The root must be real file descriptor, not the pseudo-descriptor 308 * AT_FDCWD. 309 * - The passed path must be relative and not absolute. 310 * - If lookup_cap_dotdot is disabled, path must not contain the 311 * '..' components. 312 * - If lookup_cap_dotdot is enabled, we verify that all '..' 313 * components lookups result in the directories which were 314 * previously walked by us, which prevents an escape from 315 * the relative root. 316 */ 317 if (IN_CAPABILITY_MODE(td) && (cnp->cn_flags & NOCAPCHECK) == 0) { 318 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE; 319 ndp->ni_resflags |= NIRES_STRICTREL; 320 if (ndp->ni_dirfd == AT_FDCWD) { 321 #ifdef KTRACE 322 if (KTRPOINT(td, KTR_CAPFAIL)) 323 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 324 #endif 325 return (ECAPMODE); 326 } 327 } 328 #endif 329 error = 0; 330 331 /* 332 * Get starting point for the translation. 333 */ 334 pwd = pwd_hold(td); 335 /* 336 * The reference on ni_rootdir is acquired in the block below to avoid 337 * back-to-back atomics for absolute lookups. 338 */ 339 ndp->ni_rootdir = pwd->pwd_rdir; 340 ndp->ni_topdir = pwd->pwd_jdir; 341 342 if (cnp->cn_pnbuf[0] == '/') { 343 ndp->ni_resflags |= NIRES_ABS; 344 error = namei_handle_root(ndp, dpp); 345 } else { 346 if (ndp->ni_startdir != NULL) { 347 *dpp = ndp->ni_startdir; 348 startdir_used = true; 349 } else if (ndp->ni_dirfd == AT_FDCWD) { 350 *dpp = pwd->pwd_cdir; 351 vrefact(*dpp); 352 } else { 353 rights = *ndp->ni_rightsneeded; 354 cap_rights_set_one(&rights, CAP_LOOKUP); 355 356 if (cnp->cn_flags & AUDITVNODE1) 357 AUDIT_ARG_ATFD1(ndp->ni_dirfd); 358 if (cnp->cn_flags & AUDITVNODE2) 359 AUDIT_ARG_ATFD2(ndp->ni_dirfd); 360 /* 361 * Effectively inlined fgetvp_rights, because 362 * we need to inspect the file as well as 363 * grabbing the vnode. No check for O_PATH, 364 * files to implement its semantic. 365 */ 366 error = fget_cap(td, ndp->ni_dirfd, &rights, 367 &dfp, &ndp->ni_filecaps); 368 if (error != 0) { 369 /* 370 * Preserve the error; it should either be EBADF 371 * or capability-related, both of which can be 372 * safely returned to the caller. 373 */ 374 } else { 375 if (dfp->f_ops == &badfileops) { 376 error = EBADF; 377 } else if (dfp->f_vnode == NULL) { 378 error = ENOTDIR; 379 } else { 380 *dpp = dfp->f_vnode; 381 vref(*dpp); 382 383 if ((dfp->f_flag & FSEARCH) != 0) 384 cnp->cn_flags |= NOEXECCHECK; 385 } 386 fdrop(dfp, td); 387 } 388 #ifdef CAPABILITIES 389 /* 390 * If file descriptor doesn't have all rights, 391 * all lookups relative to it must also be 392 * strictly relative. 393 */ 394 CAP_ALL(&rights); 395 if (!cap_rights_contains(&ndp->ni_filecaps.fc_rights, 396 &rights) || 397 ndp->ni_filecaps.fc_fcntls != CAP_FCNTL_ALL || 398 ndp->ni_filecaps.fc_nioctls != -1) { 399 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE; 400 ndp->ni_resflags |= NIRES_STRICTREL; 401 } 402 #endif 403 } 404 if (error == 0 && (*dpp)->v_type != VDIR && 405 (cnp->cn_pnbuf[0] != '\0' || 406 (cnp->cn_flags & EMPTYPATH) == 0)) 407 error = ENOTDIR; 408 } 409 if (error == 0 && (cnp->cn_flags & RBENEATH) != 0) { 410 if (cnp->cn_pnbuf[0] == '/') { 411 error = ENOTCAPABLE; 412 } else if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) == 0) { 413 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE | 414 NI_LCF_CAP_DOTDOT; 415 } 416 } 417 418 /* 419 * If we are auditing the kernel pathname, save the user pathname. 420 */ 421 if (cnp->cn_flags & AUDITVNODE1) 422 AUDIT_ARG_UPATH1_VP(td, ndp->ni_rootdir, *dpp, cnp->cn_pnbuf); 423 if (cnp->cn_flags & AUDITVNODE2) 424 AUDIT_ARG_UPATH2_VP(td, ndp->ni_rootdir, *dpp, cnp->cn_pnbuf); 425 if (ndp->ni_startdir != NULL && !startdir_used) 426 vrele(ndp->ni_startdir); 427 if (error != 0) { 428 if (*dpp != NULL) 429 vrele(*dpp); 430 pwd_drop(pwd); 431 return (error); 432 } 433 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0 && 434 lookup_cap_dotdot != 0) 435 ndp->ni_lcf |= NI_LCF_CAP_DOTDOT; 436 SDT_PROBE4(vfs, namei, lookup, entry, *dpp, cnp->cn_pnbuf, 437 cnp->cn_flags, false); 438 *pwdp = pwd; 439 return (0); 440 } 441 442 static int 443 namei_getpath(struct nameidata *ndp) 444 { 445 struct componentname *cnp; 446 int error; 447 448 cnp = &ndp->ni_cnd; 449 450 /* 451 * Get a buffer for the name to be translated, and copy the 452 * name into the buffer. 453 */ 454 cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK); 455 if (ndp->ni_segflg == UIO_SYSSPACE) { 456 error = copystr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 457 &ndp->ni_pathlen); 458 } else { 459 error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 460 &ndp->ni_pathlen); 461 } 462 463 if (__predict_false(error != 0)) 464 return (error); 465 466 cnp->cn_nameptr = cnp->cn_pnbuf; 467 return (0); 468 } 469 470 static int 471 namei_emptypath(struct nameidata *ndp) 472 { 473 struct componentname *cnp; 474 struct pwd *pwd; 475 struct vnode *dp; 476 int error; 477 478 cnp = &ndp->ni_cnd; 479 MPASS(*cnp->cn_pnbuf == '\0'); 480 MPASS((cnp->cn_flags & EMPTYPATH) != 0); 481 MPASS((cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == 0); 482 483 ndp->ni_resflags |= NIRES_EMPTYPATH; 484 error = namei_setup(ndp, &dp, &pwd); 485 if (error != 0) { 486 namei_cleanup_cnp(cnp); 487 goto errout; 488 } 489 490 /* 491 * Usecount on dp already provided by namei_setup. 492 */ 493 ndp->ni_vp = dp; 494 namei_cleanup_cnp(cnp); 495 pwd_drop(pwd); 496 NDVALIDATE(ndp); 497 if ((cnp->cn_flags & LOCKLEAF) != 0) { 498 VOP_LOCK(dp, (cnp->cn_flags & LOCKSHARED) != 0 ? 499 LK_SHARED : LK_EXCLUSIVE); 500 if (VN_IS_DOOMED(dp)) { 501 vput(dp); 502 error = ENOENT; 503 goto errout; 504 } 505 } 506 SDT_PROBE4(vfs, namei, lookup, return, 0, ndp->ni_vp, false, ndp); 507 return (0); 508 509 errout: 510 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, false, ndp); 511 return (error); 512 } 513 514 /* 515 * Convert a pathname into a pointer to a locked vnode. 516 * 517 * The FOLLOW flag is set when symbolic links are to be followed 518 * when they occur at the end of the name translation process. 519 * Symbolic links are always followed for all other pathname 520 * components other than the last. 521 * 522 * The segflg defines whether the name is to be copied from user 523 * space or kernel space. 524 * 525 * Overall outline of namei: 526 * 527 * copy in name 528 * get starting directory 529 * while (!done && !error) { 530 * call lookup to search path. 531 * if symbolic link, massage name in buffer and continue 532 * } 533 */ 534 int 535 namei(struct nameidata *ndp) 536 { 537 char *cp; /* pointer into pathname argument */ 538 struct vnode *dp; /* the directory we are searching */ 539 struct iovec aiov; /* uio for reading symbolic links */ 540 struct componentname *cnp; 541 struct thread *td; 542 struct pwd *pwd; 543 struct uio auio; 544 int error, linklen; 545 enum cache_fpl_status status; 546 547 cnp = &ndp->ni_cnd; 548 td = curthread; 549 #ifdef INVARIANTS 550 KASSERT((ndp->ni_debugflags & NAMEI_DBG_CALLED) == 0, 551 ("%s: repeated call to namei without NDREINIT", __func__)); 552 KASSERT(ndp->ni_debugflags == NAMEI_DBG_INITED, 553 ("%s: bad debugflags %d", __func__, ndp->ni_debugflags)); 554 ndp->ni_debugflags |= NAMEI_DBG_CALLED; 555 if (ndp->ni_startdir != NULL) 556 ndp->ni_debugflags |= NAMEI_DBG_HADSTARTDIR; 557 if (cnp->cn_flags & FAILIFEXISTS) { 558 KASSERT(cnp->cn_nameiop == CREATE, 559 ("%s: FAILIFEXISTS passed for op %d", __func__, cnp->cn_nameiop)); 560 /* 561 * The limitation below is to restrict hairy corner cases. 562 */ 563 KASSERT((cnp->cn_flags & (LOCKPARENT | LOCKLEAF)) == LOCKPARENT, 564 ("%s: FAILIFEXISTS must be passed with LOCKPARENT and without LOCKLEAF", 565 __func__)); 566 } 567 /* 568 * For NDVALIDATE. 569 * 570 * While NDINIT may seem like a more natural place to do it, there are 571 * callers which directly modify flags past invoking init. 572 */ 573 cnp->cn_origflags = cnp->cn_flags; 574 #endif 575 ndp->ni_cnd.cn_cred = td->td_ucred; 576 KASSERT(ndp->ni_resflags == 0, ("%s: garbage in ni_resflags: %x\n", 577 __func__, ndp->ni_resflags)); 578 KASSERT(cnp->cn_cred && td->td_proc, ("namei: bad cred/proc")); 579 KASSERT((cnp->cn_flags & NAMEI_INTERNAL_FLAGS) == 0, 580 ("namei: unexpected flags: %" PRIx64 "\n", 581 cnp->cn_flags & NAMEI_INTERNAL_FLAGS)); 582 if (cnp->cn_flags & NOCACHE) 583 KASSERT(cnp->cn_nameiop != LOOKUP, 584 ("%s: NOCACHE passed with LOOKUP", __func__)); 585 MPASS(ndp->ni_startdir == NULL || ndp->ni_startdir->v_type == VDIR || 586 ndp->ni_startdir->v_type == VBAD); 587 588 ndp->ni_lcf = 0; 589 ndp->ni_loopcnt = 0; 590 ndp->ni_vp = NULL; 591 592 error = namei_getpath(ndp); 593 if (__predict_false(error != 0)) { 594 namei_cleanup_cnp(cnp); 595 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, 596 false, ndp); 597 return (error); 598 } 599 600 #ifdef KTRACE 601 if (KTRPOINT(td, KTR_NAMEI)) { 602 ktrnamei(cnp->cn_pnbuf); 603 } 604 #endif 605 TSNAMEI(curthread->td_proc->p_pid, cnp->cn_pnbuf); 606 607 /* 608 * First try looking up the target without locking any vnodes. 609 * 610 * We may need to start from scratch or pick up where it left off. 611 */ 612 error = cache_fplookup(ndp, &status, &pwd); 613 switch (status) { 614 case CACHE_FPL_STATUS_UNSET: 615 __assert_unreachable(); 616 break; 617 case CACHE_FPL_STATUS_HANDLED: 618 if (error == 0) 619 NDVALIDATE(ndp); 620 return (error); 621 case CACHE_FPL_STATUS_PARTIAL: 622 TAILQ_INIT(&ndp->ni_cap_tracker); 623 dp = ndp->ni_startdir; 624 break; 625 case CACHE_FPL_STATUS_DESTROYED: 626 ndp->ni_loopcnt = 0; 627 error = namei_getpath(ndp); 628 if (__predict_false(error != 0)) { 629 namei_cleanup_cnp(cnp); 630 return (error); 631 } 632 /* FALLTHROUGH */ 633 case CACHE_FPL_STATUS_ABORTED: 634 TAILQ_INIT(&ndp->ni_cap_tracker); 635 MPASS(ndp->ni_lcf == 0); 636 if (*cnp->cn_pnbuf == '\0') { 637 if ((cnp->cn_flags & EMPTYPATH) != 0) { 638 return (namei_emptypath(ndp)); 639 } 640 namei_cleanup_cnp(cnp); 641 SDT_PROBE4(vfs, namei, lookup, return, ENOENT, NULL, 642 false, ndp); 643 return (ENOENT); 644 } 645 error = namei_setup(ndp, &dp, &pwd); 646 if (error != 0) { 647 namei_cleanup_cnp(cnp); 648 return (error); 649 } 650 break; 651 } 652 653 /* 654 * Locked lookup. 655 */ 656 for (;;) { 657 ndp->ni_startdir = dp; 658 error = lookup(ndp); 659 if (error != 0) 660 goto out; 661 662 /* 663 * If not a symbolic link, we're done. 664 */ 665 if ((cnp->cn_flags & ISSYMLINK) == 0) { 666 SDT_PROBE4(vfs, namei, lookup, return, error, 667 (error == 0 ? ndp->ni_vp : NULL), false, ndp); 668 if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0) { 669 namei_cleanup_cnp(cnp); 670 } else 671 cnp->cn_flags |= HASBUF; 672 nameicap_cleanup(ndp); 673 pwd_drop(pwd); 674 if (error == 0) 675 NDVALIDATE(ndp); 676 return (error); 677 } 678 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) { 679 error = ELOOP; 680 break; 681 } 682 #ifdef MAC 683 if ((cnp->cn_flags & NOMACCHECK) == 0) { 684 error = mac_vnode_check_readlink(td->td_ucred, 685 ndp->ni_vp); 686 if (error != 0) 687 break; 688 } 689 #endif 690 if (ndp->ni_pathlen > 1) 691 cp = uma_zalloc(namei_zone, M_WAITOK); 692 else 693 cp = cnp->cn_pnbuf; 694 aiov.iov_base = cp; 695 aiov.iov_len = MAXPATHLEN; 696 auio.uio_iov = &aiov; 697 auio.uio_iovcnt = 1; 698 auio.uio_offset = 0; 699 auio.uio_rw = UIO_READ; 700 auio.uio_segflg = UIO_SYSSPACE; 701 auio.uio_td = td; 702 auio.uio_resid = MAXPATHLEN; 703 error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred); 704 if (error != 0) { 705 if (ndp->ni_pathlen > 1) 706 uma_zfree(namei_zone, cp); 707 break; 708 } 709 linklen = MAXPATHLEN - auio.uio_resid; 710 if (linklen == 0) { 711 if (ndp->ni_pathlen > 1) 712 uma_zfree(namei_zone, cp); 713 error = ENOENT; 714 break; 715 } 716 if (linklen + ndp->ni_pathlen > MAXPATHLEN) { 717 if (ndp->ni_pathlen > 1) 718 uma_zfree(namei_zone, cp); 719 error = ENAMETOOLONG; 720 break; 721 } 722 if (ndp->ni_pathlen > 1) { 723 bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen); 724 uma_zfree(namei_zone, cnp->cn_pnbuf); 725 cnp->cn_pnbuf = cp; 726 } else 727 cnp->cn_pnbuf[linklen] = '\0'; 728 ndp->ni_pathlen += linklen; 729 vput(ndp->ni_vp); 730 dp = ndp->ni_dvp; 731 /* 732 * Check if root directory should replace current directory. 733 */ 734 cnp->cn_nameptr = cnp->cn_pnbuf; 735 if (*(cnp->cn_nameptr) == '/') { 736 vrele(dp); 737 error = namei_handle_root(ndp, &dp); 738 if (error != 0) 739 goto out; 740 } 741 } 742 vput(ndp->ni_vp); 743 ndp->ni_vp = NULL; 744 vrele(ndp->ni_dvp); 745 out: 746 MPASS(error != 0); 747 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, false, ndp); 748 namei_cleanup_cnp(cnp); 749 nameicap_cleanup(ndp); 750 pwd_drop(pwd); 751 return (error); 752 } 753 754 static int 755 compute_cn_lkflags(struct mount *mp, int lkflags, int cnflags) 756 { 757 758 if (mp == NULL || ((lkflags & LK_SHARED) && 759 (!(mp->mnt_kern_flag & MNTK_LOOKUP_SHARED) || 760 ((cnflags & ISDOTDOT) && 761 (mp->mnt_kern_flag & MNTK_LOOKUP_EXCL_DOTDOT))))) { 762 lkflags &= ~LK_SHARED; 763 lkflags |= LK_EXCLUSIVE; 764 } 765 lkflags |= LK_NODDLKTREAT; 766 return (lkflags); 767 } 768 769 static __inline int 770 needs_exclusive_leaf(struct mount *mp, int flags) 771 { 772 773 /* 774 * Intermediate nodes can use shared locks, we only need to 775 * force an exclusive lock for leaf nodes. 776 */ 777 if ((flags & (ISLASTCN | LOCKLEAF)) != (ISLASTCN | LOCKLEAF)) 778 return (0); 779 780 /* Always use exclusive locks if LOCKSHARED isn't set. */ 781 if (!(flags & LOCKSHARED)) 782 return (1); 783 784 /* 785 * For lookups during open(), if the mount point supports 786 * extended shared operations, then use a shared lock for the 787 * leaf node, otherwise use an exclusive lock. 788 */ 789 if ((flags & ISOPEN) != 0) 790 return (!MNT_EXTENDED_SHARED(mp)); 791 792 /* 793 * Lookup requests outside of open() that specify LOCKSHARED 794 * only need a shared lock on the leaf vnode. 795 */ 796 return (0); 797 } 798 799 /* 800 * Various filesystems expect to be able to copy a name component with length 801 * bounded by NAME_MAX into a directory entry buffer of size MAXNAMLEN. Make 802 * sure that these are the same size. 803 */ 804 _Static_assert(MAXNAMLEN == NAME_MAX, 805 "MAXNAMLEN and NAME_MAX have different values"); 806 807 /* 808 * Search a pathname. 809 * This is a very central and rather complicated routine. 810 * 811 * The pathname is pointed to by ni_ptr and is of length ni_pathlen. 812 * The starting directory is taken from ni_startdir. The pathname is 813 * descended until done, or a symbolic link is encountered. The variable 814 * ni_more is clear if the path is completed; it is set to one if a 815 * symbolic link needing interpretation is encountered. 816 * 817 * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on 818 * whether the name is to be looked up, created, renamed, or deleted. 819 * When CREATE, RENAME, or DELETE is specified, information usable in 820 * creating, renaming, or deleting a directory entry may be calculated. 821 * If flag has LOCKPARENT or'ed into it, the parent directory is returned 822 * locked. If flag has WANTPARENT or'ed into it, the parent directory is 823 * returned unlocked. Otherwise the parent directory is not returned. If 824 * the target of the pathname exists and LOCKLEAF is or'ed into the flag 825 * the target is returned locked, otherwise it is returned unlocked. 826 * When creating or renaming and LOCKPARENT is specified, the target may not 827 * be ".". When deleting and LOCKPARENT is specified, the target may be ".". 828 * 829 * Overall outline of lookup: 830 * 831 * dirloop: 832 * identify next component of name at ndp->ni_ptr 833 * handle degenerate case where name is null string 834 * if .. and crossing mount points and on mounted filesys, find parent 835 * call VOP_LOOKUP routine for next component name 836 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set 837 * component vnode returned in ni_vp (if it exists), locked. 838 * if result vnode is mounted on and crossing mount points, 839 * find mounted on vnode 840 * if more components of name, do next level at dirloop 841 * return the answer in ni_vp, locked if LOCKLEAF set 842 * if LOCKPARENT set, return locked parent in ni_dvp 843 * if WANTPARENT set, return unlocked parent in ni_dvp 844 */ 845 int 846 lookup(struct nameidata *ndp) 847 { 848 char *cp; /* pointer into pathname argument */ 849 char *prev_ni_next; /* saved ndp->ni_next */ 850 char *nulchar; /* location of '\0' in cn_pnbuf */ 851 struct vnode *dp = NULL; /* the directory we are searching */ 852 struct vnode *tdp; /* saved dp */ 853 struct mount *mp; /* mount table entry */ 854 struct prison *pr; 855 size_t prev_ni_pathlen; /* saved ndp->ni_pathlen */ 856 int docache; /* == 0 do not cache last component */ 857 int wantparent; /* 1 => wantparent or lockparent flag */ 858 int rdonly; /* lookup read-only flag bit */ 859 int error = 0; 860 int dpunlocked = 0; /* dp has already been unlocked */ 861 int relookup = 0; /* do not consume the path component */ 862 struct componentname *cnp = &ndp->ni_cnd; 863 int lkflags_save; 864 int ni_dvp_unlocked; 865 866 /* 867 * Setup: break out flag bits into variables. 868 */ 869 ni_dvp_unlocked = 0; 870 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); 871 KASSERT(cnp->cn_nameiop == LOOKUP || wantparent, 872 ("CREATE, DELETE, RENAME require LOCKPARENT or WANTPARENT.")); 873 /* 874 * When set to zero, docache causes the last component of the 875 * pathname to be deleted from the cache and the full lookup 876 * of the name to be done (via VOP_CACHEDLOOKUP()). Often 877 * filesystems need some pre-computed values that are made 878 * during the full lookup, for instance UFS sets dp->i_offset. 879 * 880 * The docache variable is set to zero when requested by the 881 * NOCACHE flag and for all modifying operations except CREATE. 882 */ 883 docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE; 884 if (cnp->cn_nameiop == DELETE || 885 (wantparent && cnp->cn_nameiop != CREATE && 886 cnp->cn_nameiop != LOOKUP)) 887 docache = 0; 888 rdonly = cnp->cn_flags & RDONLY; 889 cnp->cn_flags &= ~ISSYMLINK; 890 ndp->ni_dvp = NULL; 891 /* 892 * We use shared locks until we hit the parent of the last cn then 893 * we adjust based on the requesting flags. 894 */ 895 cnp->cn_lkflags = LK_SHARED; 896 dp = ndp->ni_startdir; 897 ndp->ni_startdir = NULLVP; 898 vn_lock(dp, 899 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | LK_RETRY, 900 cnp->cn_flags)); 901 902 dirloop: 903 /* 904 * Search a new directory. 905 * 906 * The last component of the filename is left accessible via 907 * cnp->cn_nameptr for callers that need the name. Callers needing 908 * the name set the SAVENAME flag. When done, they assume 909 * responsibility for freeing the pathname buffer. 910 * 911 * Store / as a temporary sentinel so that we only have one character 912 * to test for. Pathnames tend to be short so this should not be 913 * resulting in cache misses. 914 */ 915 nulchar = &cnp->cn_nameptr[ndp->ni_pathlen - 1]; 916 KASSERT(*nulchar == '\0', 917 ("%s: expected nul at %p; string [%s]\n", __func__, nulchar, 918 cnp->cn_pnbuf)); 919 *nulchar = '/'; 920 for (cp = cnp->cn_nameptr; *cp != '/'; cp++) { 921 KASSERT(*cp != '\0', 922 ("%s: encountered unexpected nul; string [%s]\n", __func__, 923 cnp->cn_nameptr)); 924 continue; 925 } 926 *nulchar = '\0'; 927 cnp->cn_namelen = cp - cnp->cn_nameptr; 928 if (cnp->cn_namelen > NAME_MAX) { 929 error = ENAMETOOLONG; 930 goto bad; 931 } 932 #ifdef NAMEI_DIAGNOSTIC 933 { char c = *cp; 934 *cp = '\0'; 935 printf("{%s}: ", cnp->cn_nameptr); 936 *cp = c; } 937 #endif 938 prev_ni_pathlen = ndp->ni_pathlen; 939 ndp->ni_pathlen -= cnp->cn_namelen; 940 KASSERT(ndp->ni_pathlen <= PATH_MAX, 941 ("%s: ni_pathlen underflow to %zd\n", __func__, ndp->ni_pathlen)); 942 prev_ni_next = ndp->ni_next; 943 ndp->ni_next = cp; 944 945 /* 946 * Replace multiple slashes by a single slash and trailing slashes 947 * by a null. This must be done before VOP_LOOKUP() because some 948 * fs's don't know about trailing slashes. Remember if there were 949 * trailing slashes to handle symlinks, existing non-directories 950 * and non-existing files that won't be directories specially later. 951 */ 952 while (*cp == '/' && (cp[1] == '/' || cp[1] == '\0')) { 953 cp++; 954 ndp->ni_pathlen--; 955 if (*cp == '\0') { 956 *ndp->ni_next = '\0'; 957 cnp->cn_flags |= TRAILINGSLASH; 958 } 959 } 960 ndp->ni_next = cp; 961 962 cnp->cn_flags |= MAKEENTRY; 963 if (*cp == '\0' && docache == 0) 964 cnp->cn_flags &= ~MAKEENTRY; 965 if (cnp->cn_namelen == 2 && 966 cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.') 967 cnp->cn_flags |= ISDOTDOT; 968 else 969 cnp->cn_flags &= ~ISDOTDOT; 970 if (*ndp->ni_next == 0) 971 cnp->cn_flags |= ISLASTCN; 972 else 973 cnp->cn_flags &= ~ISLASTCN; 974 975 if ((cnp->cn_flags & ISLASTCN) != 0 && 976 cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.' && 977 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 978 error = EINVAL; 979 goto bad; 980 } 981 982 nameicap_tracker_add(ndp, dp); 983 984 /* 985 * Check for degenerate name (e.g. / or "") 986 * which is a way of talking about a directory, 987 * e.g. like "/." or ".". 988 */ 989 if (cnp->cn_nameptr[0] == '\0') { 990 if (dp->v_type != VDIR) { 991 error = ENOTDIR; 992 goto bad; 993 } 994 if (cnp->cn_nameiop != LOOKUP) { 995 error = EISDIR; 996 goto bad; 997 } 998 if (wantparent) { 999 ndp->ni_dvp = dp; 1000 VREF(dp); 1001 } 1002 ndp->ni_vp = dp; 1003 1004 if (cnp->cn_flags & AUDITVNODE1) 1005 AUDIT_ARG_VNODE1(dp); 1006 else if (cnp->cn_flags & AUDITVNODE2) 1007 AUDIT_ARG_VNODE2(dp); 1008 1009 if (!(cnp->cn_flags & (LOCKPARENT | LOCKLEAF))) 1010 VOP_UNLOCK(dp); 1011 /* XXX This should probably move to the top of function. */ 1012 if (cnp->cn_flags & SAVESTART) 1013 panic("lookup: SAVESTART"); 1014 goto success; 1015 } 1016 1017 /* 1018 * Handle "..": five special cases. 1019 * 0. If doing a capability lookup and lookup_cap_dotdot is 1020 * disabled, return ENOTCAPABLE. 1021 * 1. Return an error if this is the last component of 1022 * the name and the operation is DELETE or RENAME. 1023 * 2. If at root directory (e.g. after chroot) 1024 * or at absolute root directory 1025 * then ignore it so can't get out. 1026 * 3. If this vnode is the root of a mounted 1027 * filesystem, then replace it with the 1028 * vnode which was mounted on so we take the 1029 * .. in the other filesystem. 1030 * 4. If the vnode is the top directory of 1031 * the jail or chroot, don't let them out. 1032 * 5. If doing a capability lookup and lookup_cap_dotdot is 1033 * enabled, return ENOTCAPABLE if the lookup would escape 1034 * from the initial file descriptor directory. Checks are 1035 * done by ensuring that namei() already traversed the 1036 * result of dotdot lookup. 1037 */ 1038 if (cnp->cn_flags & ISDOTDOT) { 1039 if ((ndp->ni_lcf & (NI_LCF_STRICTRELATIVE | NI_LCF_CAP_DOTDOT)) 1040 == NI_LCF_STRICTRELATIVE) { 1041 #ifdef KTRACE 1042 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1043 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1044 #endif 1045 error = ENOTCAPABLE; 1046 goto bad; 1047 } 1048 if ((cnp->cn_flags & ISLASTCN) != 0 && 1049 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1050 error = EINVAL; 1051 goto bad; 1052 } 1053 for (;;) { 1054 for (pr = cnp->cn_cred->cr_prison; pr != NULL; 1055 pr = pr->pr_parent) 1056 if (dp == pr->pr_root) 1057 break; 1058 if (dp == ndp->ni_rootdir || 1059 dp == ndp->ni_topdir || 1060 dp == rootvnode || 1061 pr != NULL || 1062 ((dp->v_vflag & VV_ROOT) != 0 && 1063 (cnp->cn_flags & NOCROSSMOUNT) != 0)) { 1064 ndp->ni_dvp = dp; 1065 ndp->ni_vp = dp; 1066 VREF(dp); 1067 goto nextname; 1068 } 1069 if ((dp->v_vflag & VV_ROOT) == 0) 1070 break; 1071 if (VN_IS_DOOMED(dp)) { /* forced unmount */ 1072 error = ENOENT; 1073 goto bad; 1074 } 1075 tdp = dp; 1076 dp = dp->v_mount->mnt_vnodecovered; 1077 VREF(dp); 1078 vput(tdp); 1079 vn_lock(dp, 1080 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 1081 LK_RETRY, ISDOTDOT)); 1082 error = nameicap_check_dotdot(ndp, dp); 1083 if (error != 0) { 1084 #ifdef KTRACE 1085 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1086 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1087 #endif 1088 goto bad; 1089 } 1090 } 1091 } 1092 1093 /* 1094 * We now have a segment name to search for, and a directory to search. 1095 */ 1096 unionlookup: 1097 #ifdef MAC 1098 error = mac_vnode_check_lookup(cnp->cn_cred, dp, cnp); 1099 if (error) 1100 goto bad; 1101 #endif 1102 ndp->ni_dvp = dp; 1103 ndp->ni_vp = NULL; 1104 ASSERT_VOP_LOCKED(dp, "lookup"); 1105 /* 1106 * If we have a shared lock we may need to upgrade the lock for the 1107 * last operation. 1108 */ 1109 if ((cnp->cn_flags & LOCKPARENT) && (cnp->cn_flags & ISLASTCN) && 1110 dp != vp_crossmp && VOP_ISLOCKED(dp) == LK_SHARED) 1111 vn_lock(dp, LK_UPGRADE|LK_RETRY); 1112 if (VN_IS_DOOMED(dp)) { 1113 error = ENOENT; 1114 goto bad; 1115 } 1116 /* 1117 * If we're looking up the last component and we need an exclusive 1118 * lock, adjust our lkflags. 1119 */ 1120 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags)) 1121 cnp->cn_lkflags = LK_EXCLUSIVE; 1122 #ifdef NAMEI_DIAGNOSTIC 1123 vn_printf(dp, "lookup in "); 1124 #endif 1125 lkflags_save = cnp->cn_lkflags; 1126 cnp->cn_lkflags = compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags, 1127 cnp->cn_flags); 1128 error = VOP_LOOKUP(dp, &ndp->ni_vp, cnp); 1129 cnp->cn_lkflags = lkflags_save; 1130 if (error != 0) { 1131 KASSERT(ndp->ni_vp == NULL, ("leaf should be empty")); 1132 #ifdef NAMEI_DIAGNOSTIC 1133 printf("not found\n"); 1134 #endif 1135 if ((error == ENOENT) && 1136 (dp->v_vflag & VV_ROOT) && (dp->v_mount != NULL) && 1137 (dp->v_mount->mnt_flag & MNT_UNION)) { 1138 tdp = dp; 1139 dp = dp->v_mount->mnt_vnodecovered; 1140 VREF(dp); 1141 vput(tdp); 1142 vn_lock(dp, 1143 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 1144 LK_RETRY, cnp->cn_flags)); 1145 nameicap_tracker_add(ndp, dp); 1146 goto unionlookup; 1147 } 1148 1149 if (error == ERELOOKUP) { 1150 vref(dp); 1151 ndp->ni_vp = dp; 1152 error = 0; 1153 relookup = 1; 1154 goto good; 1155 } 1156 1157 if (error != EJUSTRETURN) 1158 goto bad; 1159 /* 1160 * At this point, we know we're at the end of the 1161 * pathname. If creating / renaming, we can consider 1162 * allowing the file or directory to be created / renamed, 1163 * provided we're not on a read-only filesystem. 1164 */ 1165 if (rdonly) { 1166 error = EROFS; 1167 goto bad; 1168 } 1169 /* trailing slash only allowed for directories */ 1170 if ((cnp->cn_flags & TRAILINGSLASH) && 1171 !(cnp->cn_flags & WILLBEDIR)) { 1172 error = ENOENT; 1173 goto bad; 1174 } 1175 if ((cnp->cn_flags & LOCKPARENT) == 0) 1176 VOP_UNLOCK(dp); 1177 /* 1178 * We return with ni_vp NULL to indicate that the entry 1179 * doesn't currently exist, leaving a pointer to the 1180 * (possibly locked) directory vnode in ndp->ni_dvp. 1181 */ 1182 if (cnp->cn_flags & SAVESTART) { 1183 ndp->ni_startdir = ndp->ni_dvp; 1184 VREF(ndp->ni_startdir); 1185 } 1186 goto success; 1187 } 1188 1189 good: 1190 #ifdef NAMEI_DIAGNOSTIC 1191 printf("found\n"); 1192 #endif 1193 dp = ndp->ni_vp; 1194 1195 /* 1196 * Check to see if the vnode has been mounted on; 1197 * if so find the root of the mounted filesystem. 1198 */ 1199 while (dp->v_type == VDIR && (mp = dp->v_mountedhere) && 1200 (cnp->cn_flags & NOCROSSMOUNT) == 0) { 1201 if (vfs_busy(mp, 0)) 1202 continue; 1203 vput(dp); 1204 if (dp != ndp->ni_dvp) 1205 vput(ndp->ni_dvp); 1206 else 1207 vrele(ndp->ni_dvp); 1208 vrefact(vp_crossmp); 1209 ndp->ni_dvp = vp_crossmp; 1210 error = VFS_ROOT(mp, compute_cn_lkflags(mp, cnp->cn_lkflags, 1211 cnp->cn_flags), &tdp); 1212 vfs_unbusy(mp); 1213 if (vn_lock(vp_crossmp, LK_SHARED | LK_NOWAIT)) 1214 panic("vp_crossmp exclusively locked or reclaimed"); 1215 if (error) { 1216 dpunlocked = 1; 1217 goto bad2; 1218 } 1219 ndp->ni_vp = dp = tdp; 1220 } 1221 1222 /* 1223 * Check for symbolic link 1224 */ 1225 if ((dp->v_type == VLNK) && 1226 ((cnp->cn_flags & FOLLOW) || (cnp->cn_flags & TRAILINGSLASH) || 1227 *ndp->ni_next == '/')) { 1228 cnp->cn_flags |= ISSYMLINK; 1229 if (VN_IS_DOOMED(dp)) { 1230 /* 1231 * We can't know whether the directory was mounted with 1232 * NOSYMFOLLOW, so we can't follow safely. 1233 */ 1234 error = ENOENT; 1235 goto bad2; 1236 } 1237 if (dp->v_mount->mnt_flag & MNT_NOSYMFOLLOW) { 1238 error = EACCES; 1239 goto bad2; 1240 } 1241 /* 1242 * Symlink code always expects an unlocked dvp. 1243 */ 1244 if (ndp->ni_dvp != ndp->ni_vp) { 1245 VOP_UNLOCK(ndp->ni_dvp); 1246 ni_dvp_unlocked = 1; 1247 } 1248 goto success; 1249 } 1250 1251 nextname: 1252 /* 1253 * Not a symbolic link that we will follow. Continue with the 1254 * next component if there is any; otherwise, we're done. 1255 */ 1256 KASSERT((cnp->cn_flags & ISLASTCN) || *ndp->ni_next == '/', 1257 ("lookup: invalid path state.")); 1258 if (relookup) { 1259 relookup = 0; 1260 ndp->ni_pathlen = prev_ni_pathlen; 1261 ndp->ni_next = prev_ni_next; 1262 if (ndp->ni_dvp != dp) 1263 vput(ndp->ni_dvp); 1264 else 1265 vrele(ndp->ni_dvp); 1266 goto dirloop; 1267 } 1268 if (cnp->cn_flags & ISDOTDOT) { 1269 error = nameicap_check_dotdot(ndp, ndp->ni_vp); 1270 if (error != 0) { 1271 #ifdef KTRACE 1272 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1273 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1274 #endif 1275 goto bad2; 1276 } 1277 } 1278 if (*ndp->ni_next == '/') { 1279 cnp->cn_nameptr = ndp->ni_next; 1280 while (*cnp->cn_nameptr == '/') { 1281 cnp->cn_nameptr++; 1282 ndp->ni_pathlen--; 1283 } 1284 if (ndp->ni_dvp != dp) 1285 vput(ndp->ni_dvp); 1286 else 1287 vrele(ndp->ni_dvp); 1288 goto dirloop; 1289 } 1290 /* 1291 * If we're processing a path with a trailing slash, 1292 * check that the end result is a directory. 1293 */ 1294 if ((cnp->cn_flags & TRAILINGSLASH) && dp->v_type != VDIR) { 1295 error = ENOTDIR; 1296 goto bad2; 1297 } 1298 /* 1299 * Disallow directory write attempts on read-only filesystems. 1300 */ 1301 if (rdonly && 1302 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1303 error = EROFS; 1304 goto bad2; 1305 } 1306 if (cnp->cn_flags & SAVESTART) { 1307 ndp->ni_startdir = ndp->ni_dvp; 1308 VREF(ndp->ni_startdir); 1309 } 1310 if (!wantparent) { 1311 ni_dvp_unlocked = 2; 1312 if (ndp->ni_dvp != dp) 1313 vput(ndp->ni_dvp); 1314 else 1315 vrele(ndp->ni_dvp); 1316 } else if ((cnp->cn_flags & LOCKPARENT) == 0 && ndp->ni_dvp != dp) { 1317 VOP_UNLOCK(ndp->ni_dvp); 1318 ni_dvp_unlocked = 1; 1319 } 1320 1321 if (cnp->cn_flags & AUDITVNODE1) 1322 AUDIT_ARG_VNODE1(dp); 1323 else if (cnp->cn_flags & AUDITVNODE2) 1324 AUDIT_ARG_VNODE2(dp); 1325 1326 if ((cnp->cn_flags & LOCKLEAF) == 0) 1327 VOP_UNLOCK(dp); 1328 success: 1329 /* 1330 * FIXME: for lookups which only cross a mount point to fetch the 1331 * root vnode, ni_dvp will be set to vp_crossmp. This can be a problem 1332 * if either WANTPARENT or LOCKPARENT is set. 1333 */ 1334 /* 1335 * Because of shared lookup we may have the vnode shared locked, but 1336 * the caller may want it to be exclusively locked. 1337 */ 1338 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags) && 1339 VOP_ISLOCKED(dp) != LK_EXCLUSIVE) { 1340 vn_lock(dp, LK_UPGRADE | LK_RETRY); 1341 if (VN_IS_DOOMED(dp)) { 1342 error = ENOENT; 1343 goto bad2; 1344 } 1345 } 1346 if (ndp->ni_vp != NULL) { 1347 if ((cnp->cn_flags & ISDOTDOT) == 0) 1348 nameicap_tracker_add(ndp, ndp->ni_vp); 1349 if ((cnp->cn_flags & (FAILIFEXISTS | ISSYMLINK)) == FAILIFEXISTS) 1350 goto bad_eexist; 1351 } 1352 return (0); 1353 1354 bad2: 1355 if (ni_dvp_unlocked != 2) { 1356 if (dp != ndp->ni_dvp && !ni_dvp_unlocked) 1357 vput(ndp->ni_dvp); 1358 else 1359 vrele(ndp->ni_dvp); 1360 } 1361 bad: 1362 if (!dpunlocked) 1363 vput(dp); 1364 ndp->ni_vp = NULL; 1365 return (error); 1366 bad_eexist: 1367 /* 1368 * FAILIFEXISTS handling. 1369 * 1370 * XXX namei called with LOCKPARENT but not LOCKLEAF has the strange 1371 * behaviour of leaving the vnode unlocked if the target is the same 1372 * vnode as the parent. 1373 */ 1374 MPASS((cnp->cn_flags & ISSYMLINK) == 0); 1375 if (ndp->ni_vp == ndp->ni_dvp) 1376 vrele(ndp->ni_dvp); 1377 else 1378 vput(ndp->ni_dvp); 1379 vrele(ndp->ni_vp); 1380 ndp->ni_dvp = NULL; 1381 ndp->ni_vp = NULL; 1382 NDFREE(ndp, NDF_ONLY_PNBUF); 1383 return (EEXIST); 1384 } 1385 1386 /* 1387 * relookup - lookup a path name component 1388 * Used by lookup to re-acquire things. 1389 */ 1390 int 1391 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp) 1392 { 1393 struct vnode *dp = NULL; /* the directory we are searching */ 1394 int rdonly; /* lookup read-only flag bit */ 1395 int error = 0; 1396 1397 KASSERT(cnp->cn_flags & ISLASTCN, 1398 ("relookup: Not given last component.")); 1399 /* 1400 * Setup: break out flag bits into variables. 1401 */ 1402 KASSERT((cnp->cn_flags & (LOCKPARENT | WANTPARENT)) != 0, 1403 ("relookup: parent not wanted")); 1404 rdonly = cnp->cn_flags & RDONLY; 1405 cnp->cn_flags &= ~ISSYMLINK; 1406 dp = dvp; 1407 cnp->cn_lkflags = LK_EXCLUSIVE; 1408 vn_lock(dp, LK_EXCLUSIVE | LK_RETRY); 1409 1410 /* 1411 * Search a new directory. 1412 * 1413 * The last component of the filename is left accessible via 1414 * cnp->cn_nameptr for callers that need the name. Callers needing 1415 * the name set the SAVENAME flag. When done, they assume 1416 * responsibility for freeing the pathname buffer. 1417 */ 1418 #ifdef NAMEI_DIAGNOSTIC 1419 printf("{%s}: ", cnp->cn_nameptr); 1420 #endif 1421 1422 /* 1423 * Check for "" which represents the root directory after slash 1424 * removal. 1425 */ 1426 if (cnp->cn_nameptr[0] == '\0') { 1427 /* 1428 * Support only LOOKUP for "/" because lookup() 1429 * can't succeed for CREATE, DELETE and RENAME. 1430 */ 1431 KASSERT(cnp->cn_nameiop == LOOKUP, ("nameiop must be LOOKUP")); 1432 KASSERT(dp->v_type == VDIR, ("dp is not a directory")); 1433 1434 if (!(cnp->cn_flags & LOCKLEAF)) 1435 VOP_UNLOCK(dp); 1436 *vpp = dp; 1437 /* XXX This should probably move to the top of function. */ 1438 if (cnp->cn_flags & SAVESTART) 1439 panic("lookup: SAVESTART"); 1440 return (0); 1441 } 1442 1443 if (cnp->cn_flags & ISDOTDOT) 1444 panic ("relookup: lookup on dot-dot"); 1445 1446 /* 1447 * We now have a segment name to search for, and a directory to search. 1448 */ 1449 #ifdef NAMEI_DIAGNOSTIC 1450 vn_printf(dp, "search in "); 1451 #endif 1452 if ((error = VOP_LOOKUP(dp, vpp, cnp)) != 0) { 1453 KASSERT(*vpp == NULL, ("leaf should be empty")); 1454 if (error != EJUSTRETURN) 1455 goto bad; 1456 /* 1457 * If creating and at end of pathname, then can consider 1458 * allowing file to be created. 1459 */ 1460 if (rdonly) { 1461 error = EROFS; 1462 goto bad; 1463 } 1464 /* ASSERT(dvp == ndp->ni_startdir) */ 1465 if (cnp->cn_flags & SAVESTART) 1466 VREF(dvp); 1467 if ((cnp->cn_flags & LOCKPARENT) == 0) 1468 VOP_UNLOCK(dp); 1469 /* 1470 * We return with ni_vp NULL to indicate that the entry 1471 * doesn't currently exist, leaving a pointer to the 1472 * (possibly locked) directory vnode in ndp->ni_dvp. 1473 */ 1474 return (0); 1475 } 1476 1477 dp = *vpp; 1478 1479 /* 1480 * Disallow directory write attempts on read-only filesystems. 1481 */ 1482 if (rdonly && 1483 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1484 if (dvp == dp) 1485 vrele(dvp); 1486 else 1487 vput(dvp); 1488 error = EROFS; 1489 goto bad; 1490 } 1491 /* 1492 * Set the parent lock/ref state to the requested state. 1493 */ 1494 if ((cnp->cn_flags & LOCKPARENT) == 0 && dvp != dp) 1495 VOP_UNLOCK(dvp); 1496 /* 1497 * Check for symbolic link 1498 */ 1499 KASSERT(dp->v_type != VLNK || !(cnp->cn_flags & FOLLOW), 1500 ("relookup: symlink found.\n")); 1501 1502 /* ASSERT(dvp == ndp->ni_startdir) */ 1503 if (cnp->cn_flags & SAVESTART) 1504 VREF(dvp); 1505 1506 if ((cnp->cn_flags & LOCKLEAF) == 0) 1507 VOP_UNLOCK(dp); 1508 return (0); 1509 bad: 1510 vput(dp); 1511 *vpp = NULL; 1512 return (error); 1513 } 1514 1515 /* 1516 * Free data allocated by namei(); see namei(9) for details. 1517 */ 1518 void 1519 NDFREE_PNBUF(struct nameidata *ndp) 1520 { 1521 1522 if ((ndp->ni_cnd.cn_flags & HASBUF) != 0) { 1523 MPASS((ndp->ni_cnd.cn_flags & (SAVENAME | SAVESTART)) != 0); 1524 uma_zfree(namei_zone, ndp->ni_cnd.cn_pnbuf); 1525 ndp->ni_cnd.cn_flags &= ~HASBUF; 1526 } 1527 } 1528 1529 /* 1530 * NDFREE_PNBUF replacement for callers that know there is no buffer. 1531 * 1532 * This is a hack. Preferably the VFS layer would not produce anything more 1533 * than it was asked to do. Unfortunately several non-LOOKUP cases can add the 1534 * HASBUF flag to the result. Even then an interface could be implemented where 1535 * the caller specifies what they expected to see in the result and what they 1536 * are going to take care of. 1537 * 1538 * In the meantime provide this kludge as a trivial replacement for NDFREE_PNBUF 1539 * calls scattered throughout the kernel where we know for a fact the flag must not 1540 * be seen. 1541 */ 1542 #ifdef INVARIANTS 1543 void 1544 NDFREE_NOTHING(struct nameidata *ndp) 1545 { 1546 struct componentname *cnp; 1547 1548 cnp = &ndp->ni_cnd; 1549 KASSERT(cnp->cn_nameiop == LOOKUP, ("%s: got non-LOOKUP op %d\n", 1550 __func__, cnp->cn_nameiop)); 1551 KASSERT((cnp->cn_flags & (SAVENAME | HASBUF)) == 0, 1552 ("%s: bad flags \%" PRIx64 "\n", __func__, cnp->cn_flags)); 1553 } 1554 #endif 1555 1556 void 1557 (NDFREE)(struct nameidata *ndp, const u_int flags) 1558 { 1559 int unlock_dvp; 1560 int unlock_vp; 1561 1562 unlock_dvp = 0; 1563 unlock_vp = 0; 1564 1565 if (!(flags & NDF_NO_FREE_PNBUF)) { 1566 NDFREE_PNBUF(ndp); 1567 } 1568 if (!(flags & NDF_NO_VP_UNLOCK) && 1569 (ndp->ni_cnd.cn_flags & LOCKLEAF) && ndp->ni_vp) 1570 unlock_vp = 1; 1571 if (!(flags & NDF_NO_DVP_UNLOCK) && 1572 (ndp->ni_cnd.cn_flags & LOCKPARENT) && 1573 ndp->ni_dvp != ndp->ni_vp) 1574 unlock_dvp = 1; 1575 if (!(flags & NDF_NO_VP_RELE) && ndp->ni_vp) { 1576 if (unlock_vp) { 1577 vput(ndp->ni_vp); 1578 unlock_vp = 0; 1579 } else 1580 vrele(ndp->ni_vp); 1581 ndp->ni_vp = NULL; 1582 } 1583 if (unlock_vp) 1584 VOP_UNLOCK(ndp->ni_vp); 1585 if (!(flags & NDF_NO_DVP_RELE) && 1586 (ndp->ni_cnd.cn_flags & (LOCKPARENT|WANTPARENT))) { 1587 if (unlock_dvp) { 1588 vput(ndp->ni_dvp); 1589 unlock_dvp = 0; 1590 } else 1591 vrele(ndp->ni_dvp); 1592 ndp->ni_dvp = NULL; 1593 } 1594 if (unlock_dvp) 1595 VOP_UNLOCK(ndp->ni_dvp); 1596 if (!(flags & NDF_NO_STARTDIR_RELE) && 1597 (ndp->ni_cnd.cn_flags & SAVESTART)) { 1598 vrele(ndp->ni_startdir); 1599 ndp->ni_startdir = NULL; 1600 } 1601 } 1602 1603 #ifdef INVARIANTS 1604 /* 1605 * Validate the final state of ndp after the lookup. 1606 * 1607 * Historically filesystems were allowed to modify cn_flags. Most notably they 1608 * can add SAVENAME to the request, resulting in HASBUF and pushing subsequent 1609 * clean up to the consumer. In practice this seems to only concern != LOOKUP 1610 * operations. 1611 * 1612 * As a step towards stricter API contract this routine validates the state to 1613 * clean up. Note validation is a work in progress with the intent of becoming 1614 * stricter over time. 1615 */ 1616 #define NDMODIFYINGFLAGS (LOCKLEAF | LOCKPARENT | WANTPARENT | SAVENAME | SAVESTART | HASBUF) 1617 void 1618 NDVALIDATE(struct nameidata *ndp) 1619 { 1620 struct componentname *cnp; 1621 u_int64_t used, orig; 1622 1623 cnp = &ndp->ni_cnd; 1624 orig = cnp->cn_origflags; 1625 used = cnp->cn_flags; 1626 switch (cnp->cn_nameiop) { 1627 case LOOKUP: 1628 /* 1629 * For plain lookup we require strict conformance -- nothing 1630 * to clean up if it was not requested by the caller. 1631 */ 1632 orig &= NDMODIFYINGFLAGS; 1633 used &= NDMODIFYINGFLAGS; 1634 if ((orig & (SAVENAME | SAVESTART)) != 0) 1635 orig |= HASBUF; 1636 if (orig != used) { 1637 goto out_mismatch; 1638 } 1639 break; 1640 case CREATE: 1641 case DELETE: 1642 case RENAME: 1643 /* 1644 * Some filesystems set SAVENAME to provoke HASBUF, accomodate 1645 * for it until it gets fixed. 1646 */ 1647 orig &= NDMODIFYINGFLAGS; 1648 orig |= (SAVENAME | HASBUF); 1649 used &= NDMODIFYINGFLAGS; 1650 used |= (SAVENAME | HASBUF); 1651 if (orig != used) { 1652 goto out_mismatch; 1653 } 1654 break; 1655 } 1656 return; 1657 out_mismatch: 1658 panic("%s: mismatched flags for op %d: added %" PRIx64 ", " 1659 "removed %" PRIx64" (%" PRIx64" != %" PRIx64"; stored %" PRIx64" != %" PRIx64")", 1660 __func__, cnp->cn_nameiop, used & ~orig, orig &~ used, 1661 orig, used, cnp->cn_origflags, cnp->cn_flags); 1662 } 1663 #endif 1664 1665 /* 1666 * Determine if there is a suitable alternate filename under the specified 1667 * prefix for the specified path. If the create flag is set, then the 1668 * alternate prefix will be used so long as the parent directory exists. 1669 * This is used by the various compatibility ABIs so that Linux binaries prefer 1670 * files under /compat/linux for example. The chosen path (whether under 1671 * the prefix or under /) is returned in a kernel malloc'd buffer pointed 1672 * to by pathbuf. The caller is responsible for free'ing the buffer from 1673 * the M_TEMP bucket if one is returned. 1674 */ 1675 int 1676 kern_alternate_path(const char *prefix, const char *path, enum uio_seg pathseg, 1677 char **pathbuf, int create, int dirfd) 1678 { 1679 struct nameidata nd, ndroot; 1680 char *ptr, *buf, *cp; 1681 size_t len, sz; 1682 int error; 1683 1684 buf = (char *) malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 1685 *pathbuf = buf; 1686 1687 /* Copy the prefix into the new pathname as a starting point. */ 1688 len = strlcpy(buf, prefix, MAXPATHLEN); 1689 if (len >= MAXPATHLEN) { 1690 *pathbuf = NULL; 1691 free(buf, M_TEMP); 1692 return (EINVAL); 1693 } 1694 sz = MAXPATHLEN - len; 1695 ptr = buf + len; 1696 1697 /* Append the filename to the prefix. */ 1698 if (pathseg == UIO_SYSSPACE) 1699 error = copystr(path, ptr, sz, &len); 1700 else 1701 error = copyinstr(path, ptr, sz, &len); 1702 1703 if (error) { 1704 *pathbuf = NULL; 1705 free(buf, M_TEMP); 1706 return (error); 1707 } 1708 1709 /* Only use a prefix with absolute pathnames. */ 1710 if (*ptr != '/') { 1711 error = EINVAL; 1712 goto keeporig; 1713 } 1714 1715 if (dirfd != AT_FDCWD) { 1716 /* 1717 * We want the original because the "prefix" is 1718 * included in the already opened dirfd. 1719 */ 1720 bcopy(ptr, buf, len); 1721 return (0); 1722 } 1723 1724 /* 1725 * We know that there is a / somewhere in this pathname. 1726 * Search backwards for it, to find the file's parent dir 1727 * to see if it exists in the alternate tree. If it does, 1728 * and we want to create a file (cflag is set). We don't 1729 * need to worry about the root comparison in this case. 1730 */ 1731 1732 if (create) { 1733 for (cp = &ptr[len] - 1; *cp != '/'; cp--); 1734 *cp = '\0'; 1735 1736 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, buf); 1737 error = namei(&nd); 1738 *cp = '/'; 1739 if (error != 0) 1740 goto keeporig; 1741 } else { 1742 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, buf); 1743 1744 error = namei(&nd); 1745 if (error != 0) 1746 goto keeporig; 1747 1748 /* 1749 * We now compare the vnode of the prefix to the one 1750 * vnode asked. If they resolve to be the same, then we 1751 * ignore the match so that the real root gets used. 1752 * This avoids the problem of traversing "../.." to find the 1753 * root directory and never finding it, because "/" resolves 1754 * to the emulation root directory. This is expensive :-( 1755 */ 1756 NDINIT(&ndroot, LOOKUP, FOLLOW, UIO_SYSSPACE, prefix); 1757 1758 /* We shouldn't ever get an error from this namei(). */ 1759 error = namei(&ndroot); 1760 if (error == 0) { 1761 if (nd.ni_vp == ndroot.ni_vp) 1762 error = ENOENT; 1763 1764 NDFREE(&ndroot, NDF_ONLY_PNBUF); 1765 vrele(ndroot.ni_vp); 1766 } 1767 } 1768 1769 NDFREE(&nd, NDF_ONLY_PNBUF); 1770 vrele(nd.ni_vp); 1771 1772 keeporig: 1773 /* If there was an error, use the original path name. */ 1774 if (error) 1775 bcopy(ptr, buf, len); 1776 return (error); 1777 } 1778