1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * (c) UNIX System Laboratories, Inc. 7 * All or some portions of this file are derived from material licensed 8 * to the University of California by American Telephone and Telegraph 9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 10 * the permission of UNIX System Laboratories, Inc. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#)vfs_lookup.c 8.4 (Berkeley) 2/16/94 37 */ 38 39 #include <sys/cdefs.h> 40 #include "opt_capsicum.h" 41 #include "opt_ktrace.h" 42 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/dirent.h> 46 #include <sys/kernel.h> 47 #include <sys/capsicum.h> 48 #include <sys/fcntl.h> 49 #include <sys/jail.h> 50 #include <sys/lock.h> 51 #include <sys/mutex.h> 52 #include <sys/namei.h> 53 #include <sys/vnode.h> 54 #include <sys/mount.h> 55 #include <sys/filedesc.h> 56 #include <sys/proc.h> 57 #include <sys/sdt.h> 58 #include <sys/syscallsubr.h> 59 #include <sys/sysctl.h> 60 #ifdef KTRACE 61 #include <sys/ktrace.h> 62 #endif 63 #ifdef INVARIANTS 64 #include <machine/_inttypes.h> 65 #endif 66 67 #include <security/audit/audit.h> 68 #include <security/mac/mac_framework.h> 69 70 #include <vm/uma.h> 71 72 #ifdef INVARIANTS 73 static void NDVALIDATE_impl(struct nameidata *, int); 74 #define NDVALIDATE(ndp) NDVALIDATE_impl(ndp, __LINE__) 75 #else 76 #define NDVALIDATE(ndp) 77 #endif 78 79 /* 80 * Prepare namei() to restart. Reset components to its original state and set 81 * ISRESTARTED flag which signals the underlying lookup code to change the root 82 * from ABI root to actual root and prevents a further restarts. 83 */ 84 #define NDRESTART(ndp) do { \ 85 NDREINIT_DBG(ndp); \ 86 ndp->ni_resflags = 0; \ 87 ndp->ni_cnd.cn_flags &= ~NAMEI_INTERNAL_FLAGS; \ 88 ndp->ni_cnd.cn_flags |= ISRESTARTED; \ 89 } while (0) 90 91 SDT_PROVIDER_DEFINE(vfs); 92 SDT_PROBE_DEFINE4(vfs, namei, lookup, entry, "struct vnode *", "char *", 93 "unsigned long", "bool"); 94 SDT_PROBE_DEFINE4(vfs, namei, lookup, return, "int", "struct vnode *", "bool", 95 "struct nameidata"); 96 97 /* Allocation zone for namei. */ 98 uma_zone_t namei_zone; 99 100 /* Placeholder vnode for mp traversal. */ 101 static struct vnode *vp_crossmp; 102 103 static int 104 crossmp_vop_islocked(struct vop_islocked_args *ap) 105 { 106 107 return (LK_SHARED); 108 } 109 110 static int 111 crossmp_vop_lock1(struct vop_lock1_args *ap) 112 { 113 struct vnode *vp; 114 struct lock *lk __diagused; 115 int flags; 116 117 vp = ap->a_vp; 118 lk = vp->v_vnlock; 119 flags = ap->a_flags; 120 121 KASSERT((flags & (LK_SHARED | LK_NOWAIT)) == (LK_SHARED | LK_NOWAIT), 122 ("%s: invalid lock request 0x%x for crossmp", __func__, flags)); 123 124 if ((flags & LK_INTERLOCK) != 0) 125 VI_UNLOCK(vp); 126 LOCK_LOG_LOCK("SLOCK", &lk->lock_object, 0, 0, ap->a_file, ap->a_line); 127 return (0); 128 } 129 130 static int 131 crossmp_vop_unlock(struct vop_unlock_args *ap) 132 { 133 struct vnode *vp; 134 struct lock *lk __diagused; 135 136 vp = ap->a_vp; 137 lk = vp->v_vnlock; 138 139 LOCK_LOG_LOCK("SUNLOCK", &lk->lock_object, 0, 0, LOCK_FILE, 140 LOCK_LINE); 141 return (0); 142 } 143 144 static struct vop_vector crossmp_vnodeops = { 145 .vop_default = &default_vnodeops, 146 .vop_islocked = crossmp_vop_islocked, 147 .vop_lock1 = crossmp_vop_lock1, 148 .vop_unlock = crossmp_vop_unlock, 149 }; 150 /* 151 * VFS_VOP_VECTOR_REGISTER(crossmp_vnodeops) is not used here since the vnode 152 * gets allocated early. See nameiinit for the direct call below. 153 */ 154 155 struct nameicap_tracker { 156 struct vnode *dp; 157 TAILQ_ENTRY(nameicap_tracker) nm_link; 158 }; 159 160 /* Zone for cap mode tracker elements used for dotdot capability checks. */ 161 MALLOC_DEFINE(M_NAMEITRACKER, "namei_tracker", "namei tracking for dotdot"); 162 163 static void 164 nameiinit(void *dummy __unused) 165 { 166 167 namei_zone = uma_zcreate("NAMEI", MAXPATHLEN, NULL, NULL, NULL, NULL, 168 UMA_ALIGN_PTR, 0); 169 vfs_vector_op_register(&crossmp_vnodeops); 170 getnewvnode("crossmp", NULL, &crossmp_vnodeops, &vp_crossmp); 171 vp_crossmp->v_state = VSTATE_CONSTRUCTED; 172 vp_crossmp->v_irflag |= VIRF_CROSSMP; 173 } 174 SYSINIT(vfs, SI_SUB_VFS, SI_ORDER_SECOND, nameiinit, NULL); 175 176 static int lookup_cap_dotdot = 1; 177 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot, CTLFLAG_RWTUN, 178 &lookup_cap_dotdot, 0, 179 "enables \"..\" components in path lookup in capability mode"); 180 static int lookup_cap_dotdot_nonlocal = 1; 181 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot_nonlocal, CTLFLAG_RWTUN, 182 &lookup_cap_dotdot_nonlocal, 0, 183 "enables \"..\" components in path lookup in capability mode " 184 "on non-local mount"); 185 186 static void 187 nameicap_tracker_add(struct nameidata *ndp, struct vnode *dp) 188 { 189 struct nameicap_tracker *nt; 190 191 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0 || dp->v_type != VDIR) 192 return; 193 nt = TAILQ_LAST(&ndp->ni_cap_tracker, nameicap_tracker_head); 194 if (nt != NULL && nt->dp == dp) 195 return; 196 nt = malloc(sizeof(*nt), M_NAMEITRACKER, M_WAITOK); 197 vhold(dp); 198 nt->dp = dp; 199 TAILQ_INSERT_TAIL(&ndp->ni_cap_tracker, nt, nm_link); 200 } 201 202 static void 203 nameicap_cleanup_from(struct nameidata *ndp, struct nameicap_tracker *first) 204 { 205 struct nameicap_tracker *nt, *nt1; 206 207 nt = first; 208 TAILQ_FOREACH_FROM_SAFE(nt, &ndp->ni_cap_tracker, nm_link, nt1) { 209 TAILQ_REMOVE(&ndp->ni_cap_tracker, nt, nm_link); 210 vdrop(nt->dp); 211 free(nt, M_NAMEITRACKER); 212 } 213 } 214 215 static void 216 nameicap_cleanup(struct nameidata *ndp) 217 { 218 KASSERT(TAILQ_EMPTY(&ndp->ni_cap_tracker) || 219 (ndp->ni_lcf & NI_LCF_CAP_DOTDOT) != 0, ("not strictrelative")); 220 nameicap_cleanup_from(ndp, NULL); 221 } 222 223 /* 224 * For dotdot lookups in capability mode, only allow the component 225 * lookup to succeed if the resulting directory was already traversed 226 * during the operation. This catches situations where already 227 * traversed directory is moved to different parent, and then we walk 228 * over it with dotdots. 229 * 230 * Also allow to force failure of dotdot lookups for non-local 231 * filesystems, where external agents might assist local lookups to 232 * escape the compartment. 233 */ 234 static int 235 nameicap_check_dotdot(struct nameidata *ndp, struct vnode *dp) 236 { 237 struct nameicap_tracker *nt; 238 struct mount *mp; 239 240 if (dp == NULL || dp->v_type != VDIR || (ndp->ni_lcf & 241 NI_LCF_STRICTRELATIVE) == 0) 242 return (0); 243 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0) 244 return (ENOTCAPABLE); 245 mp = dp->v_mount; 246 if (lookup_cap_dotdot_nonlocal == 0 && mp != NULL && 247 (mp->mnt_flag & MNT_LOCAL) == 0) 248 return (ENOTCAPABLE); 249 TAILQ_FOREACH_REVERSE(nt, &ndp->ni_cap_tracker, nameicap_tracker_head, 250 nm_link) { 251 if (dp == nt->dp) { 252 nt = TAILQ_NEXT(nt, nm_link); 253 if (nt != NULL) 254 nameicap_cleanup_from(ndp, nt); 255 return (0); 256 } 257 } 258 return (ENOTCAPABLE); 259 } 260 261 static void 262 namei_cleanup_cnp(struct componentname *cnp) 263 { 264 265 uma_zfree(namei_zone, cnp->cn_pnbuf); 266 cnp->cn_pnbuf = NULL; 267 cnp->cn_nameptr = NULL; 268 } 269 270 static int 271 namei_handle_root(struct nameidata *ndp, struct vnode **dpp) 272 { 273 struct componentname *cnp; 274 275 cnp = &ndp->ni_cnd; 276 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0) { 277 #ifdef KTRACE 278 if (KTRPOINT(curthread, KTR_CAPFAIL)) 279 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 280 #endif 281 return (ENOTCAPABLE); 282 } 283 while (*(cnp->cn_nameptr) == '/') { 284 cnp->cn_nameptr++; 285 ndp->ni_pathlen--; 286 } 287 *dpp = ndp->ni_rootdir; 288 vrefact(*dpp); 289 return (0); 290 } 291 292 static int 293 namei_setup(struct nameidata *ndp, struct vnode **dpp, struct pwd **pwdp) 294 { 295 struct componentname *cnp; 296 struct thread *td; 297 struct pwd *pwd; 298 int error; 299 bool startdir_used; 300 301 cnp = &ndp->ni_cnd; 302 td = curthread; 303 304 startdir_used = false; 305 *pwdp = NULL; 306 *dpp = NULL; 307 308 #ifdef CAPABILITY_MODE 309 /* 310 * In capability mode, lookups must be restricted to happen in 311 * the subtree with the root specified by the file descriptor: 312 * - The root must be real file descriptor, not the pseudo-descriptor 313 * AT_FDCWD. 314 * - The passed path must be relative and not absolute. 315 * - If lookup_cap_dotdot is disabled, path must not contain the 316 * '..' components. 317 * - If lookup_cap_dotdot is enabled, we verify that all '..' 318 * components lookups result in the directories which were 319 * previously walked by us, which prevents an escape from 320 * the relative root. 321 */ 322 if (IN_CAPABILITY_MODE(td) && (cnp->cn_flags & NOCAPCHECK) == 0) { 323 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE; 324 ndp->ni_resflags |= NIRES_STRICTREL; 325 if (ndp->ni_dirfd == AT_FDCWD) { 326 #ifdef KTRACE 327 if (KTRPOINT(td, KTR_CAPFAIL)) 328 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 329 #endif 330 return (ECAPMODE); 331 } 332 } 333 #endif 334 error = 0; 335 336 /* 337 * Get starting point for the translation. 338 */ 339 pwd = pwd_hold(td); 340 /* 341 * The reference on ni_rootdir is acquired in the block below to avoid 342 * back-to-back atomics for absolute lookups. 343 */ 344 namei_setup_rootdir(ndp, cnp, pwd); 345 ndp->ni_topdir = pwd->pwd_jdir; 346 347 if (cnp->cn_pnbuf[0] == '/') { 348 ndp->ni_resflags |= NIRES_ABS; 349 error = namei_handle_root(ndp, dpp); 350 } else { 351 if (ndp->ni_startdir != NULL) { 352 *dpp = ndp->ni_startdir; 353 startdir_used = true; 354 } else if (ndp->ni_dirfd == AT_FDCWD) { 355 *dpp = pwd->pwd_cdir; 356 vrefact(*dpp); 357 } else { 358 if (cnp->cn_flags & AUDITVNODE1) 359 AUDIT_ARG_ATFD1(ndp->ni_dirfd); 360 if (cnp->cn_flags & AUDITVNODE2) 361 AUDIT_ARG_ATFD2(ndp->ni_dirfd); 362 363 error = fgetvp_lookup(ndp->ni_dirfd, ndp, dpp); 364 } 365 if (error == 0 && (*dpp)->v_type != VDIR && 366 (cnp->cn_pnbuf[0] != '\0' || 367 (cnp->cn_flags & EMPTYPATH) == 0)) 368 error = ENOTDIR; 369 } 370 if (error == 0 && (cnp->cn_flags & RBENEATH) != 0) { 371 if (cnp->cn_pnbuf[0] == '/') { 372 error = ENOTCAPABLE; 373 } else if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) == 0) { 374 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE | 375 NI_LCF_CAP_DOTDOT; 376 } 377 } 378 379 /* 380 * If we are auditing the kernel pathname, save the user pathname. 381 */ 382 if (AUDITING_TD(td)) { 383 if (cnp->cn_flags & AUDITVNODE1) 384 AUDIT_ARG_UPATH1_VP(td, ndp->ni_rootdir, *dpp, cnp->cn_pnbuf); 385 if (cnp->cn_flags & AUDITVNODE2) 386 AUDIT_ARG_UPATH2_VP(td, ndp->ni_rootdir, *dpp, cnp->cn_pnbuf); 387 } 388 if (ndp->ni_startdir != NULL && !startdir_used) 389 vrele(ndp->ni_startdir); 390 if (error != 0) { 391 if (*dpp != NULL) 392 vrele(*dpp); 393 pwd_drop(pwd); 394 return (error); 395 } 396 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0 && 397 lookup_cap_dotdot != 0) 398 ndp->ni_lcf |= NI_LCF_CAP_DOTDOT; 399 SDT_PROBE4(vfs, namei, lookup, entry, *dpp, cnp->cn_pnbuf, 400 cnp->cn_flags, false); 401 *pwdp = pwd; 402 return (0); 403 } 404 405 static int 406 namei_getpath(struct nameidata *ndp) 407 { 408 struct componentname *cnp; 409 int error; 410 411 cnp = &ndp->ni_cnd; 412 413 /* 414 * Get a buffer for the name to be translated, and copy the 415 * name into the buffer. 416 */ 417 cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK); 418 if (ndp->ni_segflg == UIO_SYSSPACE) { 419 error = copystr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 420 &ndp->ni_pathlen); 421 } else { 422 error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 423 &ndp->ni_pathlen); 424 } 425 426 return (error); 427 } 428 429 static int 430 namei_emptypath(struct nameidata *ndp) 431 { 432 struct componentname *cnp; 433 struct pwd *pwd; 434 struct vnode *dp; 435 int error; 436 437 cnp = &ndp->ni_cnd; 438 MPASS(*cnp->cn_pnbuf == '\0'); 439 MPASS((cnp->cn_flags & EMPTYPATH) != 0); 440 MPASS((cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == 0); 441 442 ndp->ni_resflags |= NIRES_EMPTYPATH; 443 error = namei_setup(ndp, &dp, &pwd); 444 if (error != 0) { 445 goto errout; 446 } 447 448 /* 449 * Usecount on dp already provided by namei_setup. 450 */ 451 ndp->ni_vp = dp; 452 pwd_drop(pwd); 453 NDVALIDATE(ndp); 454 if ((cnp->cn_flags & LOCKLEAF) != 0) { 455 VOP_LOCK(dp, (cnp->cn_flags & LOCKSHARED) != 0 ? 456 LK_SHARED : LK_EXCLUSIVE); 457 if (VN_IS_DOOMED(dp)) { 458 vput(dp); 459 error = ENOENT; 460 goto errout; 461 } 462 } 463 SDT_PROBE4(vfs, namei, lookup, return, 0, ndp->ni_vp, false, ndp); 464 return (0); 465 466 errout: 467 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, false, ndp); 468 namei_cleanup_cnp(cnp); 469 return (error); 470 } 471 472 static int __noinline 473 namei_follow_link(struct nameidata *ndp) 474 { 475 char *cp; 476 struct iovec aiov; 477 struct uio auio; 478 struct componentname *cnp; 479 struct thread *td; 480 int error, linklen; 481 482 error = 0; 483 cnp = &ndp->ni_cnd; 484 td = curthread; 485 486 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) { 487 error = ELOOP; 488 goto out; 489 } 490 #ifdef MAC 491 if ((cnp->cn_flags & NOMACCHECK) == 0) { 492 error = mac_vnode_check_readlink(td->td_ucred, ndp->ni_vp); 493 if (error != 0) 494 goto out; 495 } 496 #endif 497 if (ndp->ni_pathlen > 1) 498 cp = uma_zalloc(namei_zone, M_WAITOK); 499 else 500 cp = cnp->cn_pnbuf; 501 aiov.iov_base = cp; 502 aiov.iov_len = MAXPATHLEN; 503 auio.uio_iov = &aiov; 504 auio.uio_iovcnt = 1; 505 auio.uio_offset = 0; 506 auio.uio_rw = UIO_READ; 507 auio.uio_segflg = UIO_SYSSPACE; 508 auio.uio_td = td; 509 auio.uio_resid = MAXPATHLEN; 510 error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred); 511 if (error != 0) { 512 if (ndp->ni_pathlen > 1) 513 uma_zfree(namei_zone, cp); 514 goto out; 515 } 516 linklen = MAXPATHLEN - auio.uio_resid; 517 if (linklen == 0) { 518 if (ndp->ni_pathlen > 1) 519 uma_zfree(namei_zone, cp); 520 error = ENOENT; 521 goto out; 522 } 523 if (linklen + ndp->ni_pathlen > MAXPATHLEN) { 524 if (ndp->ni_pathlen > 1) 525 uma_zfree(namei_zone, cp); 526 error = ENAMETOOLONG; 527 goto out; 528 } 529 if (ndp->ni_pathlen > 1) { 530 bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen); 531 uma_zfree(namei_zone, cnp->cn_pnbuf); 532 cnp->cn_pnbuf = cp; 533 } else 534 cnp->cn_pnbuf[linklen] = '\0'; 535 ndp->ni_pathlen += linklen; 536 out: 537 return (error); 538 } 539 540 /* 541 * Convert a pathname into a pointer to a locked vnode. 542 * 543 * The FOLLOW flag is set when symbolic links are to be followed 544 * when they occur at the end of the name translation process. 545 * Symbolic links are always followed for all other pathname 546 * components other than the last. 547 * 548 * The segflg defines whether the name is to be copied from user 549 * space or kernel space. 550 * 551 * Overall outline of namei: 552 * 553 * copy in name 554 * get starting directory 555 * while (!done && !error) { 556 * call lookup to search path. 557 * if symbolic link, massage name in buffer and continue 558 * } 559 */ 560 int 561 namei(struct nameidata *ndp) 562 { 563 struct vnode *dp; /* the directory we are searching */ 564 struct componentname *cnp; 565 struct thread *td; 566 struct pwd *pwd; 567 int error; 568 enum cache_fpl_status status; 569 570 cnp = &ndp->ni_cnd; 571 td = curthread; 572 #ifdef INVARIANTS 573 KASSERT((ndp->ni_debugflags & NAMEI_DBG_CALLED) == 0, 574 ("%s: repeated call to namei without NDREINIT", __func__)); 575 KASSERT(ndp->ni_debugflags == NAMEI_DBG_INITED, 576 ("%s: bad debugflags %d", __func__, ndp->ni_debugflags)); 577 ndp->ni_debugflags |= NAMEI_DBG_CALLED; 578 if (ndp->ni_startdir != NULL) 579 ndp->ni_debugflags |= NAMEI_DBG_HADSTARTDIR; 580 if (cnp->cn_flags & FAILIFEXISTS) { 581 KASSERT(cnp->cn_nameiop == CREATE, 582 ("%s: FAILIFEXISTS passed for op %d", __func__, cnp->cn_nameiop)); 583 /* 584 * The limitation below is to restrict hairy corner cases. 585 */ 586 KASSERT((cnp->cn_flags & (LOCKPARENT | LOCKLEAF)) == LOCKPARENT, 587 ("%s: FAILIFEXISTS must be passed with LOCKPARENT and without LOCKLEAF", 588 __func__)); 589 } 590 #endif 591 ndp->ni_cnd.cn_cred = td->td_ucred; 592 KASSERT(ndp->ni_resflags == 0, ("%s: garbage in ni_resflags: %x\n", 593 __func__, ndp->ni_resflags)); 594 KASSERT(cnp->cn_cred && td->td_proc, ("namei: bad cred/proc")); 595 KASSERT((cnp->cn_flags & NAMEI_INTERNAL_FLAGS) == 0, 596 ("namei: unexpected flags: %" PRIx64 "\n", 597 cnp->cn_flags & NAMEI_INTERNAL_FLAGS)); 598 if (cnp->cn_flags & NOCACHE) 599 KASSERT(cnp->cn_nameiop != LOOKUP, 600 ("%s: NOCACHE passed with LOOKUP", __func__)); 601 MPASS(ndp->ni_startdir == NULL || ndp->ni_startdir->v_type == VDIR || 602 ndp->ni_startdir->v_type == VBAD); 603 604 restart: 605 ndp->ni_lcf = 0; 606 ndp->ni_loopcnt = 0; 607 ndp->ni_vp = NULL; 608 609 error = namei_getpath(ndp); 610 if (__predict_false(error != 0)) { 611 namei_cleanup_cnp(cnp); 612 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, 613 false, ndp); 614 return (error); 615 } 616 617 cnp->cn_nameptr = cnp->cn_pnbuf; 618 619 #ifdef KTRACE 620 if (KTRPOINT(td, KTR_NAMEI)) { 621 ktrnamei(cnp->cn_pnbuf); 622 } 623 #endif 624 TSNAMEI(curthread->td_proc->p_pid, cnp->cn_pnbuf); 625 626 /* 627 * First try looking up the target without locking any vnodes. 628 * 629 * We may need to start from scratch or pick up where it left off. 630 */ 631 error = cache_fplookup(ndp, &status, &pwd); 632 switch (status) { 633 case CACHE_FPL_STATUS_UNSET: 634 __assert_unreachable(); 635 break; 636 case CACHE_FPL_STATUS_HANDLED: 637 if (error == 0) 638 NDVALIDATE(ndp); 639 else if (__predict_false(pwd->pwd_adir != pwd->pwd_rdir && 640 (cnp->cn_flags & ISRESTARTED) == 0)) { 641 namei_cleanup_cnp(cnp); 642 NDRESTART(ndp); 643 goto restart; 644 } 645 return (error); 646 case CACHE_FPL_STATUS_PARTIAL: 647 TAILQ_INIT(&ndp->ni_cap_tracker); 648 dp = ndp->ni_startdir; 649 break; 650 case CACHE_FPL_STATUS_DESTROYED: 651 ndp->ni_loopcnt = 0; 652 error = namei_getpath(ndp); 653 if (__predict_false(error != 0)) { 654 namei_cleanup_cnp(cnp); 655 return (error); 656 } 657 cnp->cn_nameptr = cnp->cn_pnbuf; 658 /* FALLTHROUGH */ 659 case CACHE_FPL_STATUS_ABORTED: 660 TAILQ_INIT(&ndp->ni_cap_tracker); 661 MPASS(ndp->ni_lcf == 0); 662 if (*cnp->cn_pnbuf == '\0') { 663 if ((cnp->cn_flags & EMPTYPATH) != 0) { 664 return (namei_emptypath(ndp)); 665 } 666 namei_cleanup_cnp(cnp); 667 SDT_PROBE4(vfs, namei, lookup, return, ENOENT, NULL, 668 false, ndp); 669 return (ENOENT); 670 } 671 error = namei_setup(ndp, &dp, &pwd); 672 if (error != 0) { 673 namei_cleanup_cnp(cnp); 674 return (error); 675 } 676 break; 677 } 678 679 /* 680 * Locked lookup. 681 */ 682 for (;;) { 683 ndp->ni_startdir = dp; 684 error = vfs_lookup(ndp); 685 if (error != 0) { 686 if (__predict_false(pwd->pwd_adir != pwd->pwd_rdir && 687 error == ENOENT && 688 (cnp->cn_flags & ISRESTARTED) == 0)) { 689 nameicap_cleanup(ndp); 690 pwd_drop(pwd); 691 namei_cleanup_cnp(cnp); 692 NDRESTART(ndp); 693 goto restart; 694 } else 695 goto out; 696 } 697 698 /* 699 * If not a symbolic link, we're done. 700 */ 701 if ((cnp->cn_flags & ISSYMLINK) == 0) { 702 SDT_PROBE4(vfs, namei, lookup, return, error, 703 ndp->ni_vp, false, ndp); 704 nameicap_cleanup(ndp); 705 pwd_drop(pwd); 706 NDVALIDATE(ndp); 707 return (0); 708 } 709 error = namei_follow_link(ndp); 710 if (error != 0) 711 break; 712 vput(ndp->ni_vp); 713 dp = ndp->ni_dvp; 714 /* 715 * Check if root directory should replace current directory. 716 */ 717 cnp->cn_nameptr = cnp->cn_pnbuf; 718 if (*(cnp->cn_nameptr) == '/') { 719 /* 720 * Reset the lookup to start from the real root without 721 * origin path name reloading. 722 */ 723 if (__predict_false(ndp->ni_rootdir != pwd->pwd_rdir)) { 724 cnp->cn_flags |= ISRESTARTED; 725 ndp->ni_rootdir = pwd->pwd_rdir; 726 } 727 vrele(dp); 728 error = namei_handle_root(ndp, &dp); 729 if (error != 0) 730 goto out; 731 } 732 } 733 vput(ndp->ni_vp); 734 ndp->ni_vp = NULL; 735 vrele(ndp->ni_dvp); 736 out: 737 MPASS(error != 0); 738 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, false, ndp); 739 namei_cleanup_cnp(cnp); 740 nameicap_cleanup(ndp); 741 pwd_drop(pwd); 742 return (error); 743 } 744 745 static int 746 enforce_lkflags(struct mount *mp, int lkflags) 747 { 748 749 if (mp == NULL || ((lkflags & LK_SHARED) && 750 !(mp->mnt_kern_flag & MNTK_LOOKUP_SHARED))) { 751 lkflags &= ~LK_SHARED; 752 lkflags |= LK_EXCLUSIVE; 753 } 754 lkflags |= LK_NODDLKTREAT; 755 return (lkflags); 756 } 757 758 static __inline int 759 needs_exclusive_leaf(struct mount *mp, int flags) 760 { 761 762 /* 763 * Intermediate nodes can use shared locks, we only need to 764 * force an exclusive lock for leaf nodes. 765 */ 766 if ((flags & (ISLASTCN | LOCKLEAF)) != (ISLASTCN | LOCKLEAF)) 767 return (0); 768 769 /* Always use exclusive locks if LOCKSHARED isn't set. */ 770 if (!(flags & LOCKSHARED)) 771 return (1); 772 773 /* 774 * For lookups during open(), if the mount point supports 775 * extended shared operations, then use a shared lock for the 776 * leaf node, otherwise use an exclusive lock. 777 */ 778 if ((flags & ISOPEN) != 0) 779 return (!MNT_EXTENDED_SHARED(mp)); 780 781 /* 782 * Lookup requests outside of open() that specify LOCKSHARED 783 * only need a shared lock on the leaf vnode. 784 */ 785 return (0); 786 } 787 788 /* 789 * Various filesystems expect to be able to copy a name component with length 790 * bounded by NAME_MAX into a directory entry buffer of size MAXNAMLEN. Make 791 * sure that these are the same size. 792 */ 793 _Static_assert(MAXNAMLEN == NAME_MAX, 794 "MAXNAMLEN and NAME_MAX have different values"); 795 796 static int __noinline 797 vfs_lookup_degenerate(struct nameidata *ndp, struct vnode *dp, int wantparent) 798 { 799 struct componentname *cnp; 800 struct mount *mp; 801 int error; 802 803 cnp = &ndp->ni_cnd; 804 805 cnp->cn_flags |= ISLASTCN; 806 807 mp = atomic_load_ptr(&dp->v_mount); 808 if (needs_exclusive_leaf(mp, cnp->cn_flags)) { 809 cnp->cn_lkflags &= ~LK_SHARED; 810 cnp->cn_lkflags |= LK_EXCLUSIVE; 811 } 812 813 vn_lock(dp, enforce_lkflags(mp, cnp->cn_lkflags | LK_RETRY)); 814 815 if (dp->v_type != VDIR) { 816 error = ENOTDIR; 817 goto bad; 818 } 819 if (cnp->cn_nameiop != LOOKUP) { 820 error = EISDIR; 821 goto bad; 822 } 823 if (wantparent) { 824 ndp->ni_dvp = dp; 825 VREF(dp); 826 } 827 ndp->ni_vp = dp; 828 cnp->cn_namelen = 0; 829 830 if (cnp->cn_flags & AUDITVNODE1) 831 AUDIT_ARG_VNODE1(dp); 832 else if (cnp->cn_flags & AUDITVNODE2) 833 AUDIT_ARG_VNODE2(dp); 834 835 if (!(cnp->cn_flags & (LOCKPARENT | LOCKLEAF))) 836 VOP_UNLOCK(dp); 837 return (0); 838 bad: 839 VOP_UNLOCK(dp); 840 return (error); 841 } 842 843 /* 844 * FAILIFEXISTS handling. 845 * 846 * XXX namei called with LOCKPARENT but not LOCKLEAF has the strange 847 * behaviour of leaving the vnode unlocked if the target is the same 848 * vnode as the parent. 849 */ 850 static int __noinline 851 vfs_lookup_failifexists(struct nameidata *ndp) 852 { 853 struct componentname *cnp __diagused; 854 855 cnp = &ndp->ni_cnd; 856 857 MPASS((cnp->cn_flags & ISSYMLINK) == 0); 858 if (ndp->ni_vp == ndp->ni_dvp) 859 vrele(ndp->ni_dvp); 860 else 861 vput(ndp->ni_dvp); 862 vrele(ndp->ni_vp); 863 ndp->ni_dvp = NULL; 864 ndp->ni_vp = NULL; 865 NDFREE_PNBUF(ndp); 866 return (EEXIST); 867 } 868 869 static int __noinline 870 vfs_lookup_cross_mount(struct nameidata *ndp) 871 { 872 struct componentname *cnp; 873 struct mount *mp; 874 struct vnode *dp, *tdp; 875 int error, crosslkflags; 876 bool crosslock; 877 878 cnp = &ndp->ni_cnd; 879 dp = ndp->ni_vp; 880 881 /* 882 * The vnode has been mounted on, find the root of the mounted 883 * filesystem. 884 */ 885 for (;;) { 886 mp = dp->v_mountedhere; 887 ASSERT_VOP_LOCKED(dp, __func__); 888 VNPASS((vn_irflag_read(dp) & VIRF_MOUNTPOINT) != 0 && mp != NULL, dp); 889 890 crosslock = (dp->v_vflag & VV_CROSSLOCK) != 0; 891 crosslkflags = enforce_lkflags(mp, cnp->cn_lkflags); 892 if (__predict_false(crosslock)) { 893 /* 894 * We are going to be holding the vnode lock, which 895 * in this case is shared by the root vnode of the 896 * filesystem mounted at mp, across the call to 897 * VFS_ROOT(). Make the situation clear to the 898 * filesystem by passing LK_CANRECURSE if the 899 * lock is held exclusive, or by clearinng 900 * LK_NODDLKTREAT to allow recursion on the shared 901 * lock in the presence of an exclusive waiter. 902 */ 903 if (VOP_ISLOCKED(dp) == LK_EXCLUSIVE) { 904 crosslkflags &= ~LK_SHARED; 905 crosslkflags |= LK_EXCLUSIVE | LK_CANRECURSE; 906 } else if ((crosslkflags & LK_EXCLUSIVE) != 0) { 907 error = vn_lock(dp, LK_UPGRADE); 908 if (error != 0) { 909 MPASS(error == ENOENT); 910 vrele(dp); 911 if (dp != ndp->ni_dvp) 912 vput(ndp->ni_dvp); 913 else 914 vrele(ndp->ni_dvp); 915 break; 916 } 917 if (dp->v_mountedhere != mp) { 918 continue; 919 } 920 } else 921 crosslkflags &= ~LK_NODDLKTREAT; 922 } 923 if (vfs_busy(mp, 0) != 0) 924 continue; 925 if (__predict_true(!crosslock)) 926 vput(dp); 927 if (dp != ndp->ni_dvp) 928 vput(ndp->ni_dvp); 929 else 930 vrele(ndp->ni_dvp); 931 vrefact(vp_crossmp); 932 ndp->ni_dvp = vp_crossmp; 933 error = VFS_ROOT(mp, crosslkflags, &tdp); 934 vfs_unbusy(mp); 935 if (__predict_false(crosslock)) 936 vput(dp); 937 if (vn_lock(vp_crossmp, LK_SHARED | LK_NOWAIT)) 938 panic("vp_crossmp exclusively locked or reclaimed"); 939 if (error != 0) 940 break; 941 ndp->ni_vp = dp = tdp; 942 if ((vn_irflag_read(dp) & VIRF_MOUNTPOINT) == 0) 943 break; 944 } 945 946 return (error); 947 } 948 949 /* 950 * Search a pathname. 951 * This is a very central and rather complicated routine. 952 * 953 * The pathname is pointed to by cn_nameptr and is of length ni_pathlen. 954 * The starting directory is taken from ni_startdir. The pathname is 955 * descended until done, or a symbolic link is encountered. The cn_flags 956 * has ISLASTCN or'ed if the path is completed or ISSYMLINK or'ed if a 957 * symbolic link needing interpretation is encountered. 958 * 959 * The cn_nameiop is LOOKUP, CREATE, RENAME, or DELETE depending on 960 * whether the name is to be looked up, created, renamed, or deleted. 961 * When CREATE, RENAME, or DELETE is specified, information usable in 962 * creating, renaming, or deleting a directory entry may be calculated. 963 * If cn_flags has LOCKPARENT or'ed into it, the parent directory is returned 964 * locked. If it has WANTPARENT or'ed into it, the parent directory is 965 * returned unlocked. Otherwise the parent directory is not returned. If 966 * the target of the pathname exists and LOCKLEAF is or'ed into the cn_flags 967 * the target is returned locked, otherwise it is returned unlocked. 968 * 969 * Overall outline of lookup: 970 * 971 * handle degenerate case where name is null string 972 * 973 * dirloop: 974 * identify next component of name at ndp->ni_cnd.cn_nameptr 975 * handle .. special cases related to capabilities, chroot, jail 976 * if .. and crossing mount points and on mounted filesys, find parent 977 * call VOP_LOOKUP routine for next component name 978 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set 979 * component vnode returned in ni_vp (if it exists), locked. 980 * if result vnode is mounted on and crossing mount points, 981 * find mounted on vnode 982 * if more components of name, do next level at dirloop 983 * if VOP_LOOKUP returns ERELOOKUP, repeat the same level at dirloop 984 * return the answer in ni_vp, locked if LOCKLEAF set 985 * if LOCKPARENT set, return locked parent in ni_dvp 986 * if WANTPARENT set, return unlocked parent in ni_dvp 987 */ 988 int 989 vfs_lookup(struct nameidata *ndp) 990 { 991 char *cp; /* pointer into pathname argument */ 992 char *prev_ni_next; /* saved ndp->ni_next */ 993 char *nulchar; /* location of '\0' in cn_pnbuf */ 994 char *lastchar; /* location of the last character */ 995 struct vnode *dp = NULL; /* the directory we are searching */ 996 struct vnode *tdp; /* saved dp */ 997 struct prison *pr; 998 size_t prev_ni_pathlen; /* saved ndp->ni_pathlen */ 999 int docache; /* == 0 do not cache last component */ 1000 int wantparent; /* 1 => wantparent or lockparent flag */ 1001 int rdonly; /* lookup read-only flag bit */ 1002 int error = 0; 1003 int relookup = 0; /* do not consume the path component */ 1004 struct componentname *cnp = &ndp->ni_cnd; 1005 int lkflags_save; 1006 int ni_dvp_unlocked; 1007 1008 /* 1009 * Setup: break out flag bits into variables. 1010 */ 1011 ni_dvp_unlocked = 0; 1012 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); 1013 KASSERT(cnp->cn_nameiop == LOOKUP || wantparent, 1014 ("CREATE, DELETE, RENAME require LOCKPARENT or WANTPARENT.")); 1015 /* 1016 * When set to zero, docache causes the last component of the 1017 * pathname to be deleted from the cache and the full lookup 1018 * of the name to be done (via VOP_CACHEDLOOKUP()). Often 1019 * filesystems need some pre-computed values that are made 1020 * during the full lookup, for instance UFS sets dp->i_offset. 1021 * 1022 * The docache variable is set to zero when requested by the 1023 * NOCACHE flag and for all modifying operations except CREATE. 1024 */ 1025 docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE; 1026 if (cnp->cn_nameiop == DELETE || 1027 (wantparent && cnp->cn_nameiop != CREATE && 1028 cnp->cn_nameiop != LOOKUP)) 1029 docache = 0; 1030 rdonly = cnp->cn_flags & RDONLY; 1031 cnp->cn_flags &= ~ISSYMLINK; 1032 ndp->ni_dvp = NULL; 1033 1034 cnp->cn_lkflags = LK_SHARED; 1035 dp = ndp->ni_startdir; 1036 ndp->ni_startdir = NULLVP; 1037 1038 /* 1039 * Leading slashes, if any, are supposed to be skipped by the caller. 1040 */ 1041 MPASS(cnp->cn_nameptr[0] != '/'); 1042 1043 /* 1044 * Check for degenerate name (e.g. / or "") which is a way of talking 1045 * about a directory, e.g. like "/." or ".". 1046 */ 1047 if (__predict_false(cnp->cn_nameptr[0] == '\0')) { 1048 error = vfs_lookup_degenerate(ndp, dp, wantparent); 1049 if (error == 0) 1050 goto success_right_lock; 1051 goto bad_unlocked; 1052 } 1053 1054 /* 1055 * Nul-out trailing slashes (e.g., "foo///" -> "foo"). 1056 * 1057 * This must be done before VOP_LOOKUP() because some fs's don't know 1058 * about trailing slashes. Remember if there were trailing slashes to 1059 * handle symlinks, existing non-directories and non-existing files 1060 * that won't be directories specially later. 1061 */ 1062 MPASS(ndp->ni_pathlen >= 2); 1063 lastchar = &cnp->cn_nameptr[ndp->ni_pathlen - 2]; 1064 if (*lastchar == '/') { 1065 while (lastchar >= cnp->cn_pnbuf) { 1066 *lastchar = '\0'; 1067 lastchar--; 1068 ndp->ni_pathlen--; 1069 if (*lastchar != '/') { 1070 break; 1071 } 1072 } 1073 cnp->cn_flags |= TRAILINGSLASH; 1074 } 1075 1076 /* 1077 * We use shared locks until we hit the parent of the last cn then 1078 * we adjust based on the requesting flags. 1079 */ 1080 vn_lock(dp, 1081 enforce_lkflags(dp->v_mount, cnp->cn_lkflags | LK_RETRY)); 1082 1083 dirloop: 1084 /* 1085 * Search a new directory. 1086 * 1087 * The last component of the filename is left accessible via 1088 * cnp->cn_nameptr. It has to be freed with a call to NDFREE*. 1089 * 1090 * Store / as a temporary sentinel so that we only have one character 1091 * to test for. Pathnames tend to be short so this should not be 1092 * resulting in cache misses. 1093 */ 1094 nulchar = &cnp->cn_nameptr[ndp->ni_pathlen - 1]; 1095 KASSERT(*nulchar == '\0', 1096 ("%s: expected nul at %p; string [%s]\n", __func__, nulchar, 1097 cnp->cn_pnbuf)); 1098 *nulchar = '/'; 1099 for (cp = cnp->cn_nameptr; *cp != '/'; cp++) { 1100 KASSERT(*cp != '\0', 1101 ("%s: encountered unexpected nul; string [%s]\n", __func__, 1102 cnp->cn_nameptr)); 1103 continue; 1104 } 1105 *nulchar = '\0'; 1106 cnp->cn_namelen = cp - cnp->cn_nameptr; 1107 if (__predict_false(cnp->cn_namelen > NAME_MAX)) { 1108 error = ENAMETOOLONG; 1109 goto bad; 1110 } 1111 prev_ni_pathlen = ndp->ni_pathlen; 1112 ndp->ni_pathlen -= cnp->cn_namelen; 1113 KASSERT(ndp->ni_pathlen <= PATH_MAX, 1114 ("%s: ni_pathlen underflow to %zd\n", __func__, ndp->ni_pathlen)); 1115 prev_ni_next = ndp->ni_next; 1116 ndp->ni_next = cp; 1117 1118 /* 1119 * Something else should be clearing this. 1120 */ 1121 cnp->cn_flags &= ~(ISDOTDOT|ISLASTCN); 1122 1123 cnp->cn_flags |= MAKEENTRY; 1124 if (*cp == '\0' && docache == 0) 1125 cnp->cn_flags &= ~MAKEENTRY; 1126 if (cnp->cn_namelen == 2 && 1127 cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.') 1128 cnp->cn_flags |= ISDOTDOT; 1129 if (*ndp->ni_next == 0) { 1130 cnp->cn_flags |= ISLASTCN; 1131 1132 if (__predict_false(cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.' && 1133 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME))) { 1134 error = EINVAL; 1135 goto bad; 1136 } 1137 } 1138 1139 nameicap_tracker_add(ndp, dp); 1140 1141 /* 1142 * Make sure degenerate names don't get here, their handling was 1143 * previously found in this spot. 1144 */ 1145 MPASS(cnp->cn_nameptr[0] != '\0'); 1146 1147 /* 1148 * Handle "..": five special cases. 1149 * 0. If doing a capability lookup and lookup_cap_dotdot is 1150 * disabled, return ENOTCAPABLE. 1151 * 1. Return an error if this is the last component of 1152 * the name and the operation is DELETE or RENAME. 1153 * 2. If at root directory (e.g. after chroot) 1154 * or at absolute root directory 1155 * then ignore it so can't get out. 1156 * 3. If this vnode is the root of a mounted 1157 * filesystem, then replace it with the 1158 * vnode which was mounted on so we take the 1159 * .. in the other filesystem. 1160 * 4. If the vnode is the top directory of 1161 * the jail or chroot, don't let them out. 1162 * 5. If doing a capability lookup and lookup_cap_dotdot is 1163 * enabled, return ENOTCAPABLE if the lookup would escape 1164 * from the initial file descriptor directory. Checks are 1165 * done by ensuring that namei() already traversed the 1166 * result of dotdot lookup. 1167 */ 1168 if (cnp->cn_flags & ISDOTDOT) { 1169 if ((ndp->ni_lcf & (NI_LCF_STRICTRELATIVE | NI_LCF_CAP_DOTDOT)) 1170 == NI_LCF_STRICTRELATIVE) { 1171 #ifdef KTRACE 1172 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1173 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1174 #endif 1175 error = ENOTCAPABLE; 1176 goto bad; 1177 } 1178 if ((cnp->cn_flags & ISLASTCN) != 0 && 1179 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1180 error = EINVAL; 1181 goto bad; 1182 } 1183 for (;;) { 1184 for (pr = cnp->cn_cred->cr_prison; pr != NULL; 1185 pr = pr->pr_parent) 1186 if (dp == pr->pr_root) 1187 break; 1188 bool isroot = dp == ndp->ni_rootdir || 1189 dp == ndp->ni_topdir || dp == rootvnode || 1190 pr != NULL; 1191 if (isroot && (ndp->ni_lcf & 1192 NI_LCF_STRICTRELATIVE) != 0) { 1193 error = ENOTCAPABLE; 1194 goto capdotdot; 1195 } 1196 if (isroot || ((dp->v_vflag & VV_ROOT) != 0 && 1197 (cnp->cn_flags & NOCROSSMOUNT) != 0)) { 1198 ndp->ni_dvp = dp; 1199 ndp->ni_vp = dp; 1200 VREF(dp); 1201 goto nextname; 1202 } 1203 if ((dp->v_vflag & VV_ROOT) == 0) 1204 break; 1205 if (VN_IS_DOOMED(dp)) { /* forced unmount */ 1206 error = ENOENT; 1207 goto bad; 1208 } 1209 tdp = dp; 1210 dp = dp->v_mount->mnt_vnodecovered; 1211 VREF(dp); 1212 vput(tdp); 1213 vn_lock(dp, 1214 enforce_lkflags(dp->v_mount, cnp->cn_lkflags | 1215 LK_RETRY)); 1216 error = nameicap_check_dotdot(ndp, dp); 1217 if (error != 0) { 1218 capdotdot: 1219 #ifdef KTRACE 1220 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1221 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1222 #endif 1223 goto bad; 1224 } 1225 } 1226 } 1227 1228 /* 1229 * We now have a segment name to search for, and a directory to search. 1230 */ 1231 unionlookup: 1232 #ifdef MAC 1233 error = mac_vnode_check_lookup(cnp->cn_cred, dp, cnp); 1234 if (__predict_false(error)) 1235 goto bad; 1236 #endif 1237 ndp->ni_dvp = dp; 1238 ndp->ni_vp = NULL; 1239 ASSERT_VOP_LOCKED(dp, "lookup"); 1240 /* 1241 * If we have a shared lock we may need to upgrade the lock for the 1242 * last operation. 1243 */ 1244 if ((cnp->cn_flags & LOCKPARENT) && (cnp->cn_flags & ISLASTCN) && 1245 dp != vp_crossmp && VOP_ISLOCKED(dp) == LK_SHARED) 1246 vn_lock(dp, LK_UPGRADE|LK_RETRY); 1247 if (VN_IS_DOOMED(dp)) { 1248 error = ENOENT; 1249 goto bad; 1250 } 1251 /* 1252 * If we're looking up the last component and we need an exclusive 1253 * lock, adjust our lkflags. 1254 */ 1255 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags)) 1256 cnp->cn_lkflags = LK_EXCLUSIVE; 1257 lkflags_save = cnp->cn_lkflags; 1258 cnp->cn_lkflags = enforce_lkflags(dp->v_mount, cnp->cn_lkflags); 1259 error = VOP_LOOKUP(dp, &ndp->ni_vp, cnp); 1260 cnp->cn_lkflags = lkflags_save; 1261 if (error != 0) { 1262 KASSERT(ndp->ni_vp == NULL, ("leaf should be empty")); 1263 if ((error == ENOENT) && 1264 (dp->v_vflag & VV_ROOT) && (dp->v_mount != NULL) && 1265 (dp->v_mount->mnt_flag & MNT_UNION)) { 1266 tdp = dp; 1267 dp = dp->v_mount->mnt_vnodecovered; 1268 VREF(dp); 1269 vput(tdp); 1270 vn_lock(dp, 1271 enforce_lkflags(dp->v_mount, cnp->cn_lkflags | 1272 LK_RETRY)); 1273 nameicap_tracker_add(ndp, dp); 1274 goto unionlookup; 1275 } 1276 1277 if (error == ERELOOKUP) { 1278 vref(dp); 1279 ndp->ni_vp = dp; 1280 error = 0; 1281 relookup = 1; 1282 goto good; 1283 } 1284 1285 if (error != EJUSTRETURN) 1286 goto bad; 1287 /* 1288 * At this point, we know we're at the end of the 1289 * pathname. If creating / renaming, we can consider 1290 * allowing the file or directory to be created / renamed, 1291 * provided we're not on a read-only filesystem. 1292 */ 1293 if (rdonly) { 1294 error = EROFS; 1295 goto bad; 1296 } 1297 /* trailing slash only allowed for directories */ 1298 if ((cnp->cn_flags & TRAILINGSLASH) && 1299 !(cnp->cn_flags & WILLBEDIR)) { 1300 error = ENOENT; 1301 goto bad; 1302 } 1303 if ((cnp->cn_flags & LOCKPARENT) == 0) 1304 VOP_UNLOCK(dp); 1305 /* 1306 * We return with ni_vp NULL to indicate that the entry 1307 * doesn't currently exist, leaving a pointer to the 1308 * (possibly locked) directory vnode in ndp->ni_dvp. 1309 */ 1310 goto success; 1311 } 1312 1313 good: 1314 dp = ndp->ni_vp; 1315 1316 /* 1317 * Check for symbolic link 1318 */ 1319 if ((dp->v_type == VLNK) && 1320 ((cnp->cn_flags & FOLLOW) || (cnp->cn_flags & TRAILINGSLASH) || 1321 *ndp->ni_next == '/')) { 1322 cnp->cn_flags |= ISSYMLINK; 1323 if (VN_IS_DOOMED(dp)) { 1324 /* 1325 * We can't know whether the directory was mounted with 1326 * NOSYMFOLLOW, so we can't follow safely. 1327 */ 1328 error = ENOENT; 1329 goto bad2; 1330 } 1331 if (dp->v_mount->mnt_flag & MNT_NOSYMFOLLOW) { 1332 error = EACCES; 1333 goto bad2; 1334 } 1335 /* 1336 * Symlink code always expects an unlocked dvp. 1337 */ 1338 if (ndp->ni_dvp != ndp->ni_vp) { 1339 VOP_UNLOCK(ndp->ni_dvp); 1340 ni_dvp_unlocked = 1; 1341 } 1342 goto success; 1343 } 1344 1345 if ((vn_irflag_read(dp) & VIRF_MOUNTPOINT) != 0 && 1346 (cnp->cn_flags & NOCROSSMOUNT) == 0) { 1347 error = vfs_lookup_cross_mount(ndp); 1348 if (error != 0) 1349 goto bad_unlocked; 1350 /* 1351 * FALLTHROUGH to nextname 1352 */ 1353 dp = ndp->ni_vp; 1354 } 1355 1356 nextname: 1357 /* 1358 * Not a symbolic link that we will follow. Continue with the 1359 * next component if there is any; otherwise, we're done. 1360 */ 1361 KASSERT((cnp->cn_flags & ISLASTCN) || *ndp->ni_next == '/', 1362 ("lookup: invalid path state.")); 1363 if (relookup) { 1364 relookup = 0; 1365 ndp->ni_pathlen = prev_ni_pathlen; 1366 ndp->ni_next = prev_ni_next; 1367 if (ndp->ni_dvp != dp) 1368 vput(ndp->ni_dvp); 1369 else 1370 vrele(ndp->ni_dvp); 1371 goto dirloop; 1372 } 1373 if (cnp->cn_flags & ISDOTDOT) { 1374 error = nameicap_check_dotdot(ndp, ndp->ni_vp); 1375 if (error != 0) { 1376 #ifdef KTRACE 1377 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1378 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1379 #endif 1380 goto bad2; 1381 } 1382 } 1383 if (*ndp->ni_next == '/') { 1384 cnp->cn_nameptr = ndp->ni_next; 1385 while (*cnp->cn_nameptr == '/') { 1386 cnp->cn_nameptr++; 1387 ndp->ni_pathlen--; 1388 } 1389 if (ndp->ni_dvp != dp) 1390 vput(ndp->ni_dvp); 1391 else 1392 vrele(ndp->ni_dvp); 1393 goto dirloop; 1394 } 1395 /* 1396 * If we're processing a path with a trailing slash, 1397 * check that the end result is a directory. 1398 */ 1399 if ((cnp->cn_flags & TRAILINGSLASH) && dp->v_type != VDIR) { 1400 error = ENOTDIR; 1401 goto bad2; 1402 } 1403 /* 1404 * Disallow directory write attempts on read-only filesystems. 1405 */ 1406 if (rdonly && 1407 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1408 error = EROFS; 1409 goto bad2; 1410 } 1411 if (!wantparent) { 1412 ni_dvp_unlocked = 2; 1413 if (ndp->ni_dvp != dp) 1414 vput(ndp->ni_dvp); 1415 else 1416 vrele(ndp->ni_dvp); 1417 } else if ((cnp->cn_flags & LOCKPARENT) == 0 && ndp->ni_dvp != dp) { 1418 VOP_UNLOCK(ndp->ni_dvp); 1419 ni_dvp_unlocked = 1; 1420 } 1421 1422 if (cnp->cn_flags & AUDITVNODE1) 1423 AUDIT_ARG_VNODE1(dp); 1424 else if (cnp->cn_flags & AUDITVNODE2) 1425 AUDIT_ARG_VNODE2(dp); 1426 1427 if ((cnp->cn_flags & LOCKLEAF) == 0) 1428 VOP_UNLOCK(dp); 1429 success: 1430 /* 1431 * FIXME: for lookups which only cross a mount point to fetch the 1432 * root vnode, ni_dvp will be set to vp_crossmp. This can be a problem 1433 * if either WANTPARENT or LOCKPARENT is set. 1434 */ 1435 /* 1436 * Because of shared lookup we may have the vnode shared locked, but 1437 * the caller may want it to be exclusively locked. 1438 */ 1439 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags) && 1440 VOP_ISLOCKED(dp) != LK_EXCLUSIVE) { 1441 vn_lock(dp, LK_UPGRADE | LK_RETRY); 1442 if (VN_IS_DOOMED(dp)) { 1443 error = ENOENT; 1444 goto bad2; 1445 } 1446 } 1447 success_right_lock: 1448 if (ndp->ni_vp != NULL) { 1449 if ((cnp->cn_flags & ISDOTDOT) == 0) 1450 nameicap_tracker_add(ndp, ndp->ni_vp); 1451 if ((cnp->cn_flags & (FAILIFEXISTS | ISSYMLINK)) == FAILIFEXISTS) 1452 return (vfs_lookup_failifexists(ndp)); 1453 } 1454 return (0); 1455 1456 bad2: 1457 if (ni_dvp_unlocked != 2) { 1458 if (dp != ndp->ni_dvp && !ni_dvp_unlocked) 1459 vput(ndp->ni_dvp); 1460 else 1461 vrele(ndp->ni_dvp); 1462 } 1463 bad: 1464 vput(dp); 1465 bad_unlocked: 1466 ndp->ni_vp = NULL; 1467 return (error); 1468 } 1469 1470 /* 1471 * relookup - lookup a path name component 1472 * Used by lookup to re-acquire things. 1473 */ 1474 int 1475 vfs_relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp, 1476 bool refstart) 1477 { 1478 struct vnode *dp = NULL; /* the directory we are searching */ 1479 int rdonly; /* lookup read-only flag bit */ 1480 int error = 0; 1481 1482 KASSERT(cnp->cn_flags & ISLASTCN, 1483 ("relookup: Not given last component.")); 1484 /* 1485 * Setup: break out flag bits into variables. 1486 */ 1487 KASSERT((cnp->cn_flags & (LOCKPARENT | WANTPARENT)) != 0, 1488 ("relookup: parent not wanted")); 1489 rdonly = cnp->cn_flags & RDONLY; 1490 cnp->cn_flags &= ~ISSYMLINK; 1491 dp = dvp; 1492 cnp->cn_lkflags = LK_EXCLUSIVE; 1493 vn_lock(dp, LK_EXCLUSIVE | LK_RETRY); 1494 1495 /* 1496 * Search a new directory. 1497 * 1498 * See a comment in vfs_lookup for cnp->cn_nameptr. 1499 * 1500 * Check for "" which represents the root directory after slash 1501 * removal. 1502 */ 1503 if (cnp->cn_nameptr[0] == '\0') { 1504 /* 1505 * Support only LOOKUP for "/" because lookup() 1506 * can't succeed for CREATE, DELETE and RENAME. 1507 */ 1508 KASSERT(cnp->cn_nameiop == LOOKUP, ("nameiop must be LOOKUP")); 1509 KASSERT(dp->v_type == VDIR, ("dp is not a directory")); 1510 1511 if (!(cnp->cn_flags & LOCKLEAF)) 1512 VOP_UNLOCK(dp); 1513 *vpp = dp; 1514 /* XXX This should probably move to the top of function. */ 1515 if (refstart) 1516 panic("lookup: SAVESTART"); 1517 return (0); 1518 } 1519 1520 if (cnp->cn_flags & ISDOTDOT) 1521 panic ("relookup: lookup on dot-dot"); 1522 1523 /* 1524 * We now have a segment name to search for, and a directory to search. 1525 */ 1526 if ((error = VOP_LOOKUP(dp, vpp, cnp)) != 0) { 1527 KASSERT(*vpp == NULL, ("leaf should be empty")); 1528 if (error != EJUSTRETURN) 1529 goto bad; 1530 /* 1531 * If creating and at end of pathname, then can consider 1532 * allowing file to be created. 1533 */ 1534 if (rdonly) { 1535 error = EROFS; 1536 goto bad; 1537 } 1538 /* ASSERT(dvp == ndp->ni_startdir) */ 1539 if (refstart) 1540 VREF(dvp); 1541 if ((cnp->cn_flags & LOCKPARENT) == 0) 1542 VOP_UNLOCK(dp); 1543 /* 1544 * We return with ni_vp NULL to indicate that the entry 1545 * doesn't currently exist, leaving a pointer to the 1546 * (possibly locked) directory vnode in ndp->ni_dvp. 1547 */ 1548 return (0); 1549 } 1550 1551 dp = *vpp; 1552 1553 /* 1554 * Disallow directory write attempts on read-only filesystems. 1555 */ 1556 if (rdonly && 1557 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1558 if (dvp == dp) 1559 vrele(dvp); 1560 else 1561 vput(dvp); 1562 error = EROFS; 1563 goto bad; 1564 } 1565 /* 1566 * Set the parent lock/ref state to the requested state. 1567 */ 1568 if ((cnp->cn_flags & LOCKPARENT) == 0 && dvp != dp) 1569 VOP_UNLOCK(dvp); 1570 /* 1571 * Check for symbolic link 1572 */ 1573 KASSERT(dp->v_type != VLNK || !(cnp->cn_flags & FOLLOW), 1574 ("relookup: symlink found.\n")); 1575 1576 /* ASSERT(dvp == ndp->ni_startdir) */ 1577 if (refstart) 1578 VREF(dvp); 1579 1580 if ((cnp->cn_flags & LOCKLEAF) == 0) 1581 VOP_UNLOCK(dp); 1582 return (0); 1583 bad: 1584 vput(dp); 1585 *vpp = NULL; 1586 return (error); 1587 } 1588 1589 #ifdef INVARIANTS 1590 /* 1591 * Validate the final state of ndp after the lookup. 1592 */ 1593 static void 1594 NDVALIDATE_impl(struct nameidata *ndp, int line) 1595 { 1596 struct componentname *cnp; 1597 1598 cnp = &ndp->ni_cnd; 1599 if (cnp->cn_pnbuf == NULL) 1600 panic("%s: got no buf! called from %d", __func__, line); 1601 } 1602 1603 #endif 1604