1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/syscalls.h> 3 #include <linux/slab.h> 4 #include <linux/fs.h> 5 #include <linux/file.h> 6 #include <linux/mount.h> 7 #include <linux/namei.h> 8 #include <linux/exportfs.h> 9 #include <linux/fs_struct.h> 10 #include <linux/fsnotify.h> 11 #include <linux/personality.h> 12 #include <linux/uaccess.h> 13 #include <linux/compat.h> 14 #include "internal.h" 15 #include "mount.h" 16 17 static long do_sys_name_to_handle(struct path *path, 18 struct file_handle __user *ufh, 19 int __user *mnt_id) 20 { 21 long retval; 22 struct file_handle f_handle; 23 int handle_dwords, handle_bytes; 24 struct file_handle *handle = NULL; 25 26 /* 27 * We need to make sure whether the file system 28 * support decoding of the file handle 29 */ 30 if (!path->dentry->d_sb->s_export_op || 31 !path->dentry->d_sb->s_export_op->fh_to_dentry) 32 return -EOPNOTSUPP; 33 34 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) 35 return -EFAULT; 36 37 if (f_handle.handle_bytes > MAX_HANDLE_SZ) 38 return -EINVAL; 39 40 handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes, 41 GFP_KERNEL); 42 if (!handle) 43 return -ENOMEM; 44 45 /* convert handle size to multiple of sizeof(u32) */ 46 handle_dwords = f_handle.handle_bytes >> 2; 47 48 /* we ask for a non connected handle */ 49 retval = exportfs_encode_fh(path->dentry, 50 (struct fid *)handle->f_handle, 51 &handle_dwords, 0); 52 handle->handle_type = retval; 53 /* convert handle size to bytes */ 54 handle_bytes = handle_dwords * sizeof(u32); 55 handle->handle_bytes = handle_bytes; 56 if ((handle->handle_bytes > f_handle.handle_bytes) || 57 (retval == FILEID_INVALID) || (retval == -ENOSPC)) { 58 /* As per old exportfs_encode_fh documentation 59 * we could return ENOSPC to indicate overflow 60 * But file system returned 255 always. So handle 61 * both the values 62 */ 63 /* 64 * set the handle size to zero so we copy only 65 * non variable part of the file_handle 66 */ 67 handle_bytes = 0; 68 retval = -EOVERFLOW; 69 } else 70 retval = 0; 71 /* copy the mount id */ 72 if (copy_to_user(mnt_id, &real_mount(path->mnt)->mnt_id, 73 sizeof(*mnt_id)) || 74 copy_to_user(ufh, handle, 75 sizeof(struct file_handle) + handle_bytes)) 76 retval = -EFAULT; 77 kfree(handle); 78 return retval; 79 } 80 81 /** 82 * sys_name_to_handle_at: convert name to handle 83 * @dfd: directory relative to which name is interpreted if not absolute 84 * @name: name that should be converted to handle. 85 * @handle: resulting file handle 86 * @mnt_id: mount id of the file system containing the file 87 * @flag: flag value to indicate whether to follow symlink or not 88 * 89 * @handle->handle_size indicate the space available to store the 90 * variable part of the file handle in bytes. If there is not 91 * enough space, the field is updated to return the minimum 92 * value required. 93 */ 94 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name, 95 struct file_handle __user *, handle, int __user *, mnt_id, 96 int, flag) 97 { 98 struct path path; 99 int lookup_flags; 100 int err; 101 102 if ((flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) 103 return -EINVAL; 104 105 lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0; 106 if (flag & AT_EMPTY_PATH) 107 lookup_flags |= LOOKUP_EMPTY; 108 err = user_path_at(dfd, name, lookup_flags, &path); 109 if (!err) { 110 err = do_sys_name_to_handle(&path, handle, mnt_id); 111 path_put(&path); 112 } 113 return err; 114 } 115 116 static struct vfsmount *get_vfsmount_from_fd(int fd) 117 { 118 struct vfsmount *mnt; 119 120 if (fd == AT_FDCWD) { 121 struct fs_struct *fs = current->fs; 122 spin_lock(&fs->lock); 123 mnt = mntget(fs->pwd.mnt); 124 spin_unlock(&fs->lock); 125 } else { 126 struct fd f = fdget(fd); 127 if (!f.file) 128 return ERR_PTR(-EBADF); 129 mnt = mntget(f.file->f_path.mnt); 130 fdput(f); 131 } 132 return mnt; 133 } 134 135 static int vfs_dentry_acceptable(void *context, struct dentry *dentry) 136 { 137 return 1; 138 } 139 140 static int do_handle_to_path(int mountdirfd, struct file_handle *handle, 141 struct path *path) 142 { 143 int retval = 0; 144 int handle_dwords; 145 146 path->mnt = get_vfsmount_from_fd(mountdirfd); 147 if (IS_ERR(path->mnt)) { 148 retval = PTR_ERR(path->mnt); 149 goto out_err; 150 } 151 /* change the handle size to multiple of sizeof(u32) */ 152 handle_dwords = handle->handle_bytes >> 2; 153 path->dentry = exportfs_decode_fh(path->mnt, 154 (struct fid *)handle->f_handle, 155 handle_dwords, handle->handle_type, 156 vfs_dentry_acceptable, NULL); 157 if (IS_ERR(path->dentry)) { 158 retval = PTR_ERR(path->dentry); 159 goto out_mnt; 160 } 161 return 0; 162 out_mnt: 163 mntput(path->mnt); 164 out_err: 165 return retval; 166 } 167 168 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, 169 struct path *path) 170 { 171 int retval = 0; 172 struct file_handle f_handle; 173 struct file_handle *handle = NULL; 174 175 /* 176 * With handle we don't look at the execute bit on the 177 * the directory. Ideally we would like CAP_DAC_SEARCH. 178 * But we don't have that 179 */ 180 if (!capable(CAP_DAC_READ_SEARCH)) { 181 retval = -EPERM; 182 goto out_err; 183 } 184 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) { 185 retval = -EFAULT; 186 goto out_err; 187 } 188 if ((f_handle.handle_bytes > MAX_HANDLE_SZ) || 189 (f_handle.handle_bytes == 0)) { 190 retval = -EINVAL; 191 goto out_err; 192 } 193 handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes, 194 GFP_KERNEL); 195 if (!handle) { 196 retval = -ENOMEM; 197 goto out_err; 198 } 199 /* copy the full handle */ 200 *handle = f_handle; 201 if (copy_from_user(&handle->f_handle, 202 &ufh->f_handle, 203 f_handle.handle_bytes)) { 204 retval = -EFAULT; 205 goto out_handle; 206 } 207 208 retval = do_handle_to_path(mountdirfd, handle, path); 209 210 out_handle: 211 kfree(handle); 212 out_err: 213 return retval; 214 } 215 216 static long do_handle_open(int mountdirfd, struct file_handle __user *ufh, 217 int open_flag) 218 { 219 long retval = 0; 220 struct path path; 221 struct file *file; 222 int fd; 223 224 retval = handle_to_path(mountdirfd, ufh, &path); 225 if (retval) 226 return retval; 227 228 fd = get_unused_fd_flags(open_flag); 229 if (fd < 0) { 230 path_put(&path); 231 return fd; 232 } 233 file = file_open_root(path.dentry, path.mnt, "", open_flag, 0); 234 if (IS_ERR(file)) { 235 put_unused_fd(fd); 236 retval = PTR_ERR(file); 237 } else { 238 retval = fd; 239 fsnotify_open(file); 240 fd_install(fd, file); 241 } 242 path_put(&path); 243 return retval; 244 } 245 246 /** 247 * sys_open_by_handle_at: Open the file handle 248 * @mountdirfd: directory file descriptor 249 * @handle: file handle to be opened 250 * @flag: open flags. 251 * 252 * @mountdirfd indicate the directory file descriptor 253 * of the mount point. file handle is decoded relative 254 * to the vfsmount pointed by the @mountdirfd. @flags 255 * value is same as the open(2) flags. 256 */ 257 SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd, 258 struct file_handle __user *, handle, 259 int, flags) 260 { 261 long ret; 262 263 if (force_o_largefile()) 264 flags |= O_LARGEFILE; 265 266 ret = do_handle_open(mountdirfd, handle, flags); 267 return ret; 268 } 269 270 #ifdef CONFIG_COMPAT 271 /* 272 * Exactly like fs/open.c:sys_open_by_handle_at(), except that it 273 * doesn't set the O_LARGEFILE flag. 274 */ 275 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd, 276 struct file_handle __user *, handle, int, flags) 277 { 278 return do_handle_open(mountdirfd, handle, flags); 279 } 280 #endif 281