1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/fs/namei.c 4 * 5 * Copyright (C) 1991, 1992 Linus Torvalds 6 */ 7 8 /* 9 * Some corrections by tytso. 10 */ 11 12 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname 13 * lookup logic. 14 */ 15 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture. 16 */ 17 18 #include <linux/init.h> 19 #include <linux/export.h> 20 #include <linux/kernel.h> 21 #include <linux/slab.h> 22 #include <linux/fs.h> 23 #include <linux/filelock.h> 24 #include <linux/namei.h> 25 #include <linux/pagemap.h> 26 #include <linux/sched/mm.h> 27 #include <linux/fsnotify.h> 28 #include <linux/personality.h> 29 #include <linux/security.h> 30 #include <linux/ima.h> 31 #include <linux/syscalls.h> 32 #include <linux/mount.h> 33 #include <linux/audit.h> 34 #include <linux/capability.h> 35 #include <linux/file.h> 36 #include <linux/fcntl.h> 37 #include <linux/device_cgroup.h> 38 #include <linux/fs_struct.h> 39 #include <linux/posix_acl.h> 40 #include <linux/hash.h> 41 #include <linux/bitops.h> 42 #include <linux/init_task.h> 43 #include <linux/uaccess.h> 44 45 #include "internal.h" 46 #include "mount.h" 47 48 /* [Feb-1997 T. Schoebel-Theuer] 49 * Fundamental changes in the pathname lookup mechanisms (namei) 50 * were necessary because of omirr. The reason is that omirr needs 51 * to know the _real_ pathname, not the user-supplied one, in case 52 * of symlinks (and also when transname replacements occur). 53 * 54 * The new code replaces the old recursive symlink resolution with 55 * an iterative one (in case of non-nested symlink chains). It does 56 * this with calls to <fs>_follow_link(). 57 * As a side effect, dir_namei(), _namei() and follow_link() are now 58 * replaced with a single function lookup_dentry() that can handle all 59 * the special cases of the former code. 60 * 61 * With the new dcache, the pathname is stored at each inode, at least as 62 * long as the refcount of the inode is positive. As a side effect, the 63 * size of the dcache depends on the inode cache and thus is dynamic. 64 * 65 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink 66 * resolution to correspond with current state of the code. 67 * 68 * Note that the symlink resolution is not *completely* iterative. 69 * There is still a significant amount of tail- and mid- recursion in 70 * the algorithm. Also, note that <fs>_readlink() is not used in 71 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink() 72 * may return different results than <fs>_follow_link(). Many virtual 73 * filesystems (including /proc) exhibit this behavior. 74 */ 75 76 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation: 77 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL 78 * and the name already exists in form of a symlink, try to create the new 79 * name indicated by the symlink. The old code always complained that the 80 * name already exists, due to not following the symlink even if its target 81 * is nonexistent. The new semantics affects also mknod() and link() when 82 * the name is a symlink pointing to a non-existent name. 83 * 84 * I don't know which semantics is the right one, since I have no access 85 * to standards. But I found by trial that HP-UX 9.0 has the full "new" 86 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the 87 * "old" one. Personally, I think the new semantics is much more logical. 88 * Note that "ln old new" where "new" is a symlink pointing to a non-existing 89 * file does succeed in both HP-UX and SunOs, but not in Solaris 90 * and in the old Linux semantics. 91 */ 92 93 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink 94 * semantics. See the comments in "open_namei" and "do_link" below. 95 * 96 * [10-Sep-98 Alan Modra] Another symlink change. 97 */ 98 99 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks: 100 * inside the path - always follow. 101 * in the last component in creation/removal/renaming - never follow. 102 * if LOOKUP_FOLLOW passed - follow. 103 * if the pathname has trailing slashes - follow. 104 * otherwise - don't follow. 105 * (applied in that order). 106 * 107 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT 108 * restored for 2.4. This is the last surviving part of old 4.2BSD bug. 109 * During the 2.4 we need to fix the userland stuff depending on it - 110 * hopefully we will be able to get rid of that wart in 2.5. So far only 111 * XEmacs seems to be relying on it... 112 */ 113 /* 114 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland) 115 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives 116 * any extra contention... 117 */ 118 119 /* In order to reduce some races, while at the same time doing additional 120 * checking and hopefully speeding things up, we copy filenames to the 121 * kernel data space before using them.. 122 * 123 * POSIX.1 2.4: an empty pathname is invalid (ENOENT). 124 * PATH_MAX includes the nul terminator --RR. 125 */ 126 127 #define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname)) 128 129 struct filename * 130 getname_flags(const char __user *filename, int flags, int *empty) 131 { 132 struct filename *result; 133 char *kname; 134 int len; 135 136 result = audit_reusename(filename); 137 if (result) 138 return result; 139 140 result = __getname(); 141 if (unlikely(!result)) 142 return ERR_PTR(-ENOMEM); 143 144 /* 145 * First, try to embed the struct filename inside the names_cache 146 * allocation 147 */ 148 kname = (char *)result->iname; 149 result->name = kname; 150 151 len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX); 152 if (unlikely(len < 0)) { 153 __putname(result); 154 return ERR_PTR(len); 155 } 156 157 /* 158 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a 159 * separate struct filename so we can dedicate the entire 160 * names_cache allocation for the pathname, and re-do the copy from 161 * userland. 162 */ 163 if (unlikely(len == EMBEDDED_NAME_MAX)) { 164 const size_t size = offsetof(struct filename, iname[1]); 165 kname = (char *)result; 166 167 /* 168 * size is chosen that way we to guarantee that 169 * result->iname[0] is within the same object and that 170 * kname can't be equal to result->iname, no matter what. 171 */ 172 result = kzalloc(size, GFP_KERNEL); 173 if (unlikely(!result)) { 174 __putname(kname); 175 return ERR_PTR(-ENOMEM); 176 } 177 result->name = kname; 178 len = strncpy_from_user(kname, filename, PATH_MAX); 179 if (unlikely(len < 0)) { 180 __putname(kname); 181 kfree(result); 182 return ERR_PTR(len); 183 } 184 if (unlikely(len == PATH_MAX)) { 185 __putname(kname); 186 kfree(result); 187 return ERR_PTR(-ENAMETOOLONG); 188 } 189 } 190 191 atomic_set(&result->refcnt, 1); 192 /* The empty path is special. */ 193 if (unlikely(!len)) { 194 if (empty) 195 *empty = 1; 196 if (!(flags & LOOKUP_EMPTY)) { 197 putname(result); 198 return ERR_PTR(-ENOENT); 199 } 200 } 201 202 result->uptr = filename; 203 result->aname = NULL; 204 audit_getname(result); 205 return result; 206 } 207 208 struct filename * 209 getname_uflags(const char __user *filename, int uflags) 210 { 211 int flags = (uflags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0; 212 213 return getname_flags(filename, flags, NULL); 214 } 215 216 struct filename * 217 getname(const char __user * filename) 218 { 219 return getname_flags(filename, 0, NULL); 220 } 221 222 struct filename * 223 getname_kernel(const char * filename) 224 { 225 struct filename *result; 226 int len = strlen(filename) + 1; 227 228 result = __getname(); 229 if (unlikely(!result)) 230 return ERR_PTR(-ENOMEM); 231 232 if (len <= EMBEDDED_NAME_MAX) { 233 result->name = (char *)result->iname; 234 } else if (len <= PATH_MAX) { 235 const size_t size = offsetof(struct filename, iname[1]); 236 struct filename *tmp; 237 238 tmp = kmalloc(size, GFP_KERNEL); 239 if (unlikely(!tmp)) { 240 __putname(result); 241 return ERR_PTR(-ENOMEM); 242 } 243 tmp->name = (char *)result; 244 result = tmp; 245 } else { 246 __putname(result); 247 return ERR_PTR(-ENAMETOOLONG); 248 } 249 memcpy((char *)result->name, filename, len); 250 result->uptr = NULL; 251 result->aname = NULL; 252 atomic_set(&result->refcnt, 1); 253 audit_getname(result); 254 255 return result; 256 } 257 EXPORT_SYMBOL(getname_kernel); 258 259 void putname(struct filename *name) 260 { 261 if (IS_ERR(name)) 262 return; 263 264 if (WARN_ON_ONCE(!atomic_read(&name->refcnt))) 265 return; 266 267 if (!atomic_dec_and_test(&name->refcnt)) 268 return; 269 270 if (name->name != name->iname) { 271 __putname(name->name); 272 kfree(name); 273 } else 274 __putname(name); 275 } 276 EXPORT_SYMBOL(putname); 277 278 /** 279 * check_acl - perform ACL permission checking 280 * @idmap: idmap of the mount the inode was found from 281 * @inode: inode to check permissions on 282 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...) 283 * 284 * This function performs the ACL permission checking. Since this function 285 * retrieve POSIX acls it needs to know whether it is called from a blocking or 286 * non-blocking context and thus cares about the MAY_NOT_BLOCK bit. 287 * 288 * If the inode has been found through an idmapped mount the idmap of 289 * the vfsmount must be passed through @idmap. This function will then take 290 * care to map the inode according to @idmap before checking permissions. 291 * On non-idmapped mounts or if permission checking is to be performed on the 292 * raw inode simply passs @nop_mnt_idmap. 293 */ 294 static int check_acl(struct mnt_idmap *idmap, 295 struct inode *inode, int mask) 296 { 297 #ifdef CONFIG_FS_POSIX_ACL 298 struct posix_acl *acl; 299 300 if (mask & MAY_NOT_BLOCK) { 301 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS); 302 if (!acl) 303 return -EAGAIN; 304 /* no ->get_inode_acl() calls in RCU mode... */ 305 if (is_uncached_acl(acl)) 306 return -ECHILD; 307 return posix_acl_permission(idmap, inode, acl, mask); 308 } 309 310 acl = get_inode_acl(inode, ACL_TYPE_ACCESS); 311 if (IS_ERR(acl)) 312 return PTR_ERR(acl); 313 if (acl) { 314 int error = posix_acl_permission(idmap, inode, acl, mask); 315 posix_acl_release(acl); 316 return error; 317 } 318 #endif 319 320 return -EAGAIN; 321 } 322 323 /** 324 * acl_permission_check - perform basic UNIX permission checking 325 * @idmap: idmap of the mount the inode was found from 326 * @inode: inode to check permissions on 327 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...) 328 * 329 * This function performs the basic UNIX permission checking. Since this 330 * function may retrieve POSIX acls it needs to know whether it is called from a 331 * blocking or non-blocking context and thus cares about the MAY_NOT_BLOCK bit. 332 * 333 * If the inode has been found through an idmapped mount the idmap of 334 * the vfsmount must be passed through @idmap. This function will then take 335 * care to map the inode according to @idmap before checking permissions. 336 * On non-idmapped mounts or if permission checking is to be performed on the 337 * raw inode simply passs @nop_mnt_idmap. 338 */ 339 static int acl_permission_check(struct mnt_idmap *idmap, 340 struct inode *inode, int mask) 341 { 342 unsigned int mode = inode->i_mode; 343 vfsuid_t vfsuid; 344 345 /* Are we the owner? If so, ACL's don't matter */ 346 vfsuid = i_uid_into_vfsuid(idmap, inode); 347 if (likely(vfsuid_eq_kuid(vfsuid, current_fsuid()))) { 348 mask &= 7; 349 mode >>= 6; 350 return (mask & ~mode) ? -EACCES : 0; 351 } 352 353 /* Do we have ACL's? */ 354 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { 355 int error = check_acl(idmap, inode, mask); 356 if (error != -EAGAIN) 357 return error; 358 } 359 360 /* Only RWX matters for group/other mode bits */ 361 mask &= 7; 362 363 /* 364 * Are the group permissions different from 365 * the other permissions in the bits we care 366 * about? Need to check group ownership if so. 367 */ 368 if (mask & (mode ^ (mode >> 3))) { 369 vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode); 370 if (vfsgid_in_group_p(vfsgid)) 371 mode >>= 3; 372 } 373 374 /* Bits in 'mode' clear that we require? */ 375 return (mask & ~mode) ? -EACCES : 0; 376 } 377 378 /** 379 * generic_permission - check for access rights on a Posix-like filesystem 380 * @idmap: idmap of the mount the inode was found from 381 * @inode: inode to check access rights for 382 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, 383 * %MAY_NOT_BLOCK ...) 384 * 385 * Used to check for read/write/execute permissions on a file. 386 * We use "fsuid" for this, letting us set arbitrary permissions 387 * for filesystem access without changing the "normal" uids which 388 * are used for other things. 389 * 390 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk 391 * request cannot be satisfied (eg. requires blocking or too much complexity). 392 * It would then be called again in ref-walk mode. 393 * 394 * If the inode has been found through an idmapped mount the idmap of 395 * the vfsmount must be passed through @idmap. This function will then take 396 * care to map the inode according to @idmap before checking permissions. 397 * On non-idmapped mounts or if permission checking is to be performed on the 398 * raw inode simply passs @nop_mnt_idmap. 399 */ 400 int generic_permission(struct mnt_idmap *idmap, struct inode *inode, 401 int mask) 402 { 403 int ret; 404 405 /* 406 * Do the basic permission checks. 407 */ 408 ret = acl_permission_check(idmap, inode, mask); 409 if (ret != -EACCES) 410 return ret; 411 412 if (S_ISDIR(inode->i_mode)) { 413 /* DACs are overridable for directories */ 414 if (!(mask & MAY_WRITE)) 415 if (capable_wrt_inode_uidgid(idmap, inode, 416 CAP_DAC_READ_SEARCH)) 417 return 0; 418 if (capable_wrt_inode_uidgid(idmap, inode, 419 CAP_DAC_OVERRIDE)) 420 return 0; 421 return -EACCES; 422 } 423 424 /* 425 * Searching includes executable on directories, else just read. 426 */ 427 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 428 if (mask == MAY_READ) 429 if (capable_wrt_inode_uidgid(idmap, inode, 430 CAP_DAC_READ_SEARCH)) 431 return 0; 432 /* 433 * Read/write DACs are always overridable. 434 * Executable DACs are overridable when there is 435 * at least one exec bit set. 436 */ 437 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 438 if (capable_wrt_inode_uidgid(idmap, inode, 439 CAP_DAC_OVERRIDE)) 440 return 0; 441 442 return -EACCES; 443 } 444 EXPORT_SYMBOL(generic_permission); 445 446 /** 447 * do_inode_permission - UNIX permission checking 448 * @idmap: idmap of the mount the inode was found from 449 * @inode: inode to check permissions on 450 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...) 451 * 452 * We _really_ want to just do "generic_permission()" without 453 * even looking at the inode->i_op values. So we keep a cache 454 * flag in inode->i_opflags, that says "this has not special 455 * permission function, use the fast case". 456 */ 457 static inline int do_inode_permission(struct mnt_idmap *idmap, 458 struct inode *inode, int mask) 459 { 460 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) { 461 if (likely(inode->i_op->permission)) 462 return inode->i_op->permission(idmap, inode, mask); 463 464 /* This gets set once for the inode lifetime */ 465 spin_lock(&inode->i_lock); 466 inode->i_opflags |= IOP_FASTPERM; 467 spin_unlock(&inode->i_lock); 468 } 469 return generic_permission(idmap, inode, mask); 470 } 471 472 /** 473 * sb_permission - Check superblock-level permissions 474 * @sb: Superblock of inode to check permission on 475 * @inode: Inode to check permission on 476 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 477 * 478 * Separate out file-system wide checks from inode-specific permission checks. 479 */ 480 static int sb_permission(struct super_block *sb, struct inode *inode, int mask) 481 { 482 if (unlikely(mask & MAY_WRITE)) { 483 umode_t mode = inode->i_mode; 484 485 /* Nobody gets write access to a read-only fs. */ 486 if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) 487 return -EROFS; 488 } 489 return 0; 490 } 491 492 /** 493 * inode_permission - Check for access rights to a given inode 494 * @idmap: idmap of the mount the inode was found from 495 * @inode: Inode to check permission on 496 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 497 * 498 * Check for read/write/execute permissions on an inode. We use fs[ug]id for 499 * this, letting us set arbitrary permissions for filesystem access without 500 * changing the "normal" UIDs which are used for other things. 501 * 502 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 503 */ 504 int inode_permission(struct mnt_idmap *idmap, 505 struct inode *inode, int mask) 506 { 507 int retval; 508 509 retval = sb_permission(inode->i_sb, inode, mask); 510 if (retval) 511 return retval; 512 513 if (unlikely(mask & MAY_WRITE)) { 514 /* 515 * Nobody gets write access to an immutable file. 516 */ 517 if (IS_IMMUTABLE(inode)) 518 return -EPERM; 519 520 /* 521 * Updating mtime will likely cause i_uid and i_gid to be 522 * written back improperly if their true value is unknown 523 * to the vfs. 524 */ 525 if (HAS_UNMAPPED_ID(idmap, inode)) 526 return -EACCES; 527 } 528 529 retval = do_inode_permission(idmap, inode, mask); 530 if (retval) 531 return retval; 532 533 retval = devcgroup_inode_permission(inode, mask); 534 if (retval) 535 return retval; 536 537 return security_inode_permission(inode, mask); 538 } 539 EXPORT_SYMBOL(inode_permission); 540 541 /** 542 * path_get - get a reference to a path 543 * @path: path to get the reference to 544 * 545 * Given a path increment the reference count to the dentry and the vfsmount. 546 */ 547 void path_get(const struct path *path) 548 { 549 mntget(path->mnt); 550 dget(path->dentry); 551 } 552 EXPORT_SYMBOL(path_get); 553 554 /** 555 * path_put - put a reference to a path 556 * @path: path to put the reference to 557 * 558 * Given a path decrement the reference count to the dentry and the vfsmount. 559 */ 560 void path_put(const struct path *path) 561 { 562 dput(path->dentry); 563 mntput(path->mnt); 564 } 565 EXPORT_SYMBOL(path_put); 566 567 #define EMBEDDED_LEVELS 2 568 struct nameidata { 569 struct path path; 570 struct qstr last; 571 struct path root; 572 struct inode *inode; /* path.dentry.d_inode */ 573 unsigned int flags, state; 574 unsigned seq, next_seq, m_seq, r_seq; 575 int last_type; 576 unsigned depth; 577 int total_link_count; 578 struct saved { 579 struct path link; 580 struct delayed_call done; 581 const char *name; 582 unsigned seq; 583 } *stack, internal[EMBEDDED_LEVELS]; 584 struct filename *name; 585 struct nameidata *saved; 586 unsigned root_seq; 587 int dfd; 588 vfsuid_t dir_vfsuid; 589 umode_t dir_mode; 590 } __randomize_layout; 591 592 #define ND_ROOT_PRESET 1 593 #define ND_ROOT_GRABBED 2 594 #define ND_JUMPED 4 595 596 static void __set_nameidata(struct nameidata *p, int dfd, struct filename *name) 597 { 598 struct nameidata *old = current->nameidata; 599 p->stack = p->internal; 600 p->depth = 0; 601 p->dfd = dfd; 602 p->name = name; 603 p->path.mnt = NULL; 604 p->path.dentry = NULL; 605 p->total_link_count = old ? old->total_link_count : 0; 606 p->saved = old; 607 current->nameidata = p; 608 } 609 610 static inline void set_nameidata(struct nameidata *p, int dfd, struct filename *name, 611 const struct path *root) 612 { 613 __set_nameidata(p, dfd, name); 614 p->state = 0; 615 if (unlikely(root)) { 616 p->state = ND_ROOT_PRESET; 617 p->root = *root; 618 } 619 } 620 621 static void restore_nameidata(void) 622 { 623 struct nameidata *now = current->nameidata, *old = now->saved; 624 625 current->nameidata = old; 626 if (old) 627 old->total_link_count = now->total_link_count; 628 if (now->stack != now->internal) 629 kfree(now->stack); 630 } 631 632 static bool nd_alloc_stack(struct nameidata *nd) 633 { 634 struct saved *p; 635 636 p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved), 637 nd->flags & LOOKUP_RCU ? GFP_ATOMIC : GFP_KERNEL); 638 if (unlikely(!p)) 639 return false; 640 memcpy(p, nd->internal, sizeof(nd->internal)); 641 nd->stack = p; 642 return true; 643 } 644 645 /** 646 * path_connected - Verify that a dentry is below mnt.mnt_root 647 * @mnt: The mountpoint to check. 648 * @dentry: The dentry to check. 649 * 650 * Rename can sometimes move a file or directory outside of a bind 651 * mount, path_connected allows those cases to be detected. 652 */ 653 static bool path_connected(struct vfsmount *mnt, struct dentry *dentry) 654 { 655 struct super_block *sb = mnt->mnt_sb; 656 657 /* Bind mounts can have disconnected paths */ 658 if (mnt->mnt_root == sb->s_root) 659 return true; 660 661 return is_subdir(dentry, mnt->mnt_root); 662 } 663 664 static void drop_links(struct nameidata *nd) 665 { 666 int i = nd->depth; 667 while (i--) { 668 struct saved *last = nd->stack + i; 669 do_delayed_call(&last->done); 670 clear_delayed_call(&last->done); 671 } 672 } 673 674 static void leave_rcu(struct nameidata *nd) 675 { 676 nd->flags &= ~LOOKUP_RCU; 677 nd->seq = nd->next_seq = 0; 678 rcu_read_unlock(); 679 } 680 681 static void terminate_walk(struct nameidata *nd) 682 { 683 drop_links(nd); 684 if (!(nd->flags & LOOKUP_RCU)) { 685 int i; 686 path_put(&nd->path); 687 for (i = 0; i < nd->depth; i++) 688 path_put(&nd->stack[i].link); 689 if (nd->state & ND_ROOT_GRABBED) { 690 path_put(&nd->root); 691 nd->state &= ~ND_ROOT_GRABBED; 692 } 693 } else { 694 leave_rcu(nd); 695 } 696 nd->depth = 0; 697 nd->path.mnt = NULL; 698 nd->path.dentry = NULL; 699 } 700 701 /* path_put is needed afterwards regardless of success or failure */ 702 static bool __legitimize_path(struct path *path, unsigned seq, unsigned mseq) 703 { 704 int res = __legitimize_mnt(path->mnt, mseq); 705 if (unlikely(res)) { 706 if (res > 0) 707 path->mnt = NULL; 708 path->dentry = NULL; 709 return false; 710 } 711 if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) { 712 path->dentry = NULL; 713 return false; 714 } 715 return !read_seqcount_retry(&path->dentry->d_seq, seq); 716 } 717 718 static inline bool legitimize_path(struct nameidata *nd, 719 struct path *path, unsigned seq) 720 { 721 return __legitimize_path(path, seq, nd->m_seq); 722 } 723 724 static bool legitimize_links(struct nameidata *nd) 725 { 726 int i; 727 if (unlikely(nd->flags & LOOKUP_CACHED)) { 728 drop_links(nd); 729 nd->depth = 0; 730 return false; 731 } 732 for (i = 0; i < nd->depth; i++) { 733 struct saved *last = nd->stack + i; 734 if (unlikely(!legitimize_path(nd, &last->link, last->seq))) { 735 drop_links(nd); 736 nd->depth = i + 1; 737 return false; 738 } 739 } 740 return true; 741 } 742 743 static bool legitimize_root(struct nameidata *nd) 744 { 745 /* Nothing to do if nd->root is zero or is managed by the VFS user. */ 746 if (!nd->root.mnt || (nd->state & ND_ROOT_PRESET)) 747 return true; 748 nd->state |= ND_ROOT_GRABBED; 749 return legitimize_path(nd, &nd->root, nd->root_seq); 750 } 751 752 /* 753 * Path walking has 2 modes, rcu-walk and ref-walk (see 754 * Documentation/filesystems/path-lookup.txt). In situations when we can't 755 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab 756 * normal reference counts on dentries and vfsmounts to transition to ref-walk 757 * mode. Refcounts are grabbed at the last known good point before rcu-walk 758 * got stuck, so ref-walk may continue from there. If this is not successful 759 * (eg. a seqcount has changed), then failure is returned and it's up to caller 760 * to restart the path walk from the beginning in ref-walk mode. 761 */ 762 763 /** 764 * try_to_unlazy - try to switch to ref-walk mode. 765 * @nd: nameidata pathwalk data 766 * Returns: true on success, false on failure 767 * 768 * try_to_unlazy attempts to legitimize the current nd->path and nd->root 769 * for ref-walk mode. 770 * Must be called from rcu-walk context. 771 * Nothing should touch nameidata between try_to_unlazy() failure and 772 * terminate_walk(). 773 */ 774 static bool try_to_unlazy(struct nameidata *nd) 775 { 776 struct dentry *parent = nd->path.dentry; 777 778 BUG_ON(!(nd->flags & LOOKUP_RCU)); 779 780 if (unlikely(!legitimize_links(nd))) 781 goto out1; 782 if (unlikely(!legitimize_path(nd, &nd->path, nd->seq))) 783 goto out; 784 if (unlikely(!legitimize_root(nd))) 785 goto out; 786 leave_rcu(nd); 787 BUG_ON(nd->inode != parent->d_inode); 788 return true; 789 790 out1: 791 nd->path.mnt = NULL; 792 nd->path.dentry = NULL; 793 out: 794 leave_rcu(nd); 795 return false; 796 } 797 798 /** 799 * try_to_unlazy_next - try to switch to ref-walk mode. 800 * @nd: nameidata pathwalk data 801 * @dentry: next dentry to step into 802 * Returns: true on success, false on failure 803 * 804 * Similar to try_to_unlazy(), but here we have the next dentry already 805 * picked by rcu-walk and want to legitimize that in addition to the current 806 * nd->path and nd->root for ref-walk mode. Must be called from rcu-walk context. 807 * Nothing should touch nameidata between try_to_unlazy_next() failure and 808 * terminate_walk(). 809 */ 810 static bool try_to_unlazy_next(struct nameidata *nd, struct dentry *dentry) 811 { 812 int res; 813 BUG_ON(!(nd->flags & LOOKUP_RCU)); 814 815 if (unlikely(!legitimize_links(nd))) 816 goto out2; 817 res = __legitimize_mnt(nd->path.mnt, nd->m_seq); 818 if (unlikely(res)) { 819 if (res > 0) 820 goto out2; 821 goto out1; 822 } 823 if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref))) 824 goto out1; 825 826 /* 827 * We need to move both the parent and the dentry from the RCU domain 828 * to be properly refcounted. And the sequence number in the dentry 829 * validates *both* dentry counters, since we checked the sequence 830 * number of the parent after we got the child sequence number. So we 831 * know the parent must still be valid if the child sequence number is 832 */ 833 if (unlikely(!lockref_get_not_dead(&dentry->d_lockref))) 834 goto out; 835 if (read_seqcount_retry(&dentry->d_seq, nd->next_seq)) 836 goto out_dput; 837 /* 838 * Sequence counts matched. Now make sure that the root is 839 * still valid and get it if required. 840 */ 841 if (unlikely(!legitimize_root(nd))) 842 goto out_dput; 843 leave_rcu(nd); 844 return true; 845 846 out2: 847 nd->path.mnt = NULL; 848 out1: 849 nd->path.dentry = NULL; 850 out: 851 leave_rcu(nd); 852 return false; 853 out_dput: 854 leave_rcu(nd); 855 dput(dentry); 856 return false; 857 } 858 859 static inline int d_revalidate(struct dentry *dentry, unsigned int flags) 860 { 861 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) 862 return dentry->d_op->d_revalidate(dentry, flags); 863 else 864 return 1; 865 } 866 867 /** 868 * complete_walk - successful completion of path walk 869 * @nd: pointer nameidata 870 * 871 * If we had been in RCU mode, drop out of it and legitimize nd->path. 872 * Revalidate the final result, unless we'd already done that during 873 * the path walk or the filesystem doesn't ask for it. Return 0 on 874 * success, -error on failure. In case of failure caller does not 875 * need to drop nd->path. 876 */ 877 static int complete_walk(struct nameidata *nd) 878 { 879 struct dentry *dentry = nd->path.dentry; 880 int status; 881 882 if (nd->flags & LOOKUP_RCU) { 883 /* 884 * We don't want to zero nd->root for scoped-lookups or 885 * externally-managed nd->root. 886 */ 887 if (!(nd->state & ND_ROOT_PRESET)) 888 if (!(nd->flags & LOOKUP_IS_SCOPED)) 889 nd->root.mnt = NULL; 890 nd->flags &= ~LOOKUP_CACHED; 891 if (!try_to_unlazy(nd)) 892 return -ECHILD; 893 } 894 895 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) { 896 /* 897 * While the guarantee of LOOKUP_IS_SCOPED is (roughly) "don't 898 * ever step outside the root during lookup" and should already 899 * be guaranteed by the rest of namei, we want to avoid a namei 900 * BUG resulting in userspace being given a path that was not 901 * scoped within the root at some point during the lookup. 902 * 903 * So, do a final sanity-check to make sure that in the 904 * worst-case scenario (a complete bypass of LOOKUP_IS_SCOPED) 905 * we won't silently return an fd completely outside of the 906 * requested root to userspace. 907 * 908 * Userspace could move the path outside the root after this 909 * check, but as discussed elsewhere this is not a concern (the 910 * resolved file was inside the root at some point). 911 */ 912 if (!path_is_under(&nd->path, &nd->root)) 913 return -EXDEV; 914 } 915 916 if (likely(!(nd->state & ND_JUMPED))) 917 return 0; 918 919 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE))) 920 return 0; 921 922 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags); 923 if (status > 0) 924 return 0; 925 926 if (!status) 927 status = -ESTALE; 928 929 return status; 930 } 931 932 static int set_root(struct nameidata *nd) 933 { 934 struct fs_struct *fs = current->fs; 935 936 /* 937 * Jumping to the real root in a scoped-lookup is a BUG in namei, but we 938 * still have to ensure it doesn't happen because it will cause a breakout 939 * from the dirfd. 940 */ 941 if (WARN_ON(nd->flags & LOOKUP_IS_SCOPED)) 942 return -ENOTRECOVERABLE; 943 944 if (nd->flags & LOOKUP_RCU) { 945 unsigned seq; 946 947 do { 948 seq = read_seqcount_begin(&fs->seq); 949 nd->root = fs->root; 950 nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq); 951 } while (read_seqcount_retry(&fs->seq, seq)); 952 } else { 953 get_fs_root(fs, &nd->root); 954 nd->state |= ND_ROOT_GRABBED; 955 } 956 return 0; 957 } 958 959 static int nd_jump_root(struct nameidata *nd) 960 { 961 if (unlikely(nd->flags & LOOKUP_BENEATH)) 962 return -EXDEV; 963 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) { 964 /* Absolute path arguments to path_init() are allowed. */ 965 if (nd->path.mnt != NULL && nd->path.mnt != nd->root.mnt) 966 return -EXDEV; 967 } 968 if (!nd->root.mnt) { 969 int error = set_root(nd); 970 if (error) 971 return error; 972 } 973 if (nd->flags & LOOKUP_RCU) { 974 struct dentry *d; 975 nd->path = nd->root; 976 d = nd->path.dentry; 977 nd->inode = d->d_inode; 978 nd->seq = nd->root_seq; 979 if (read_seqcount_retry(&d->d_seq, nd->seq)) 980 return -ECHILD; 981 } else { 982 path_put(&nd->path); 983 nd->path = nd->root; 984 path_get(&nd->path); 985 nd->inode = nd->path.dentry->d_inode; 986 } 987 nd->state |= ND_JUMPED; 988 return 0; 989 } 990 991 /* 992 * Helper to directly jump to a known parsed path from ->get_link, 993 * caller must have taken a reference to path beforehand. 994 */ 995 int nd_jump_link(const struct path *path) 996 { 997 int error = -ELOOP; 998 struct nameidata *nd = current->nameidata; 999 1000 if (unlikely(nd->flags & LOOKUP_NO_MAGICLINKS)) 1001 goto err; 1002 1003 error = -EXDEV; 1004 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) { 1005 if (nd->path.mnt != path->mnt) 1006 goto err; 1007 } 1008 /* Not currently safe for scoped-lookups. */ 1009 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) 1010 goto err; 1011 1012 path_put(&nd->path); 1013 nd->path = *path; 1014 nd->inode = nd->path.dentry->d_inode; 1015 nd->state |= ND_JUMPED; 1016 return 0; 1017 1018 err: 1019 path_put(path); 1020 return error; 1021 } 1022 1023 static inline void put_link(struct nameidata *nd) 1024 { 1025 struct saved *last = nd->stack + --nd->depth; 1026 do_delayed_call(&last->done); 1027 if (!(nd->flags & LOOKUP_RCU)) 1028 path_put(&last->link); 1029 } 1030 1031 static int sysctl_protected_symlinks __read_mostly; 1032 static int sysctl_protected_hardlinks __read_mostly; 1033 static int sysctl_protected_fifos __read_mostly; 1034 static int sysctl_protected_regular __read_mostly; 1035 1036 #ifdef CONFIG_SYSCTL 1037 static struct ctl_table namei_sysctls[] = { 1038 { 1039 .procname = "protected_symlinks", 1040 .data = &sysctl_protected_symlinks, 1041 .maxlen = sizeof(int), 1042 .mode = 0644, 1043 .proc_handler = proc_dointvec_minmax, 1044 .extra1 = SYSCTL_ZERO, 1045 .extra2 = SYSCTL_ONE, 1046 }, 1047 { 1048 .procname = "protected_hardlinks", 1049 .data = &sysctl_protected_hardlinks, 1050 .maxlen = sizeof(int), 1051 .mode = 0644, 1052 .proc_handler = proc_dointvec_minmax, 1053 .extra1 = SYSCTL_ZERO, 1054 .extra2 = SYSCTL_ONE, 1055 }, 1056 { 1057 .procname = "protected_fifos", 1058 .data = &sysctl_protected_fifos, 1059 .maxlen = sizeof(int), 1060 .mode = 0644, 1061 .proc_handler = proc_dointvec_minmax, 1062 .extra1 = SYSCTL_ZERO, 1063 .extra2 = SYSCTL_TWO, 1064 }, 1065 { 1066 .procname = "protected_regular", 1067 .data = &sysctl_protected_regular, 1068 .maxlen = sizeof(int), 1069 .mode = 0644, 1070 .proc_handler = proc_dointvec_minmax, 1071 .extra1 = SYSCTL_ZERO, 1072 .extra2 = SYSCTL_TWO, 1073 }, 1074 { } 1075 }; 1076 1077 static int __init init_fs_namei_sysctls(void) 1078 { 1079 register_sysctl_init("fs", namei_sysctls); 1080 return 0; 1081 } 1082 fs_initcall(init_fs_namei_sysctls); 1083 1084 #endif /* CONFIG_SYSCTL */ 1085 1086 /** 1087 * may_follow_link - Check symlink following for unsafe situations 1088 * @nd: nameidata pathwalk data 1089 * @inode: Used for idmapping. 1090 * 1091 * In the case of the sysctl_protected_symlinks sysctl being enabled, 1092 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is 1093 * in a sticky world-writable directory. This is to protect privileged 1094 * processes from failing races against path names that may change out 1095 * from under them by way of other users creating malicious symlinks. 1096 * It will permit symlinks to be followed only when outside a sticky 1097 * world-writable directory, or when the uid of the symlink and follower 1098 * match, or when the directory owner matches the symlink's owner. 1099 * 1100 * Returns 0 if following the symlink is allowed, -ve on error. 1101 */ 1102 static inline int may_follow_link(struct nameidata *nd, const struct inode *inode) 1103 { 1104 struct mnt_idmap *idmap; 1105 vfsuid_t vfsuid; 1106 1107 if (!sysctl_protected_symlinks) 1108 return 0; 1109 1110 idmap = mnt_idmap(nd->path.mnt); 1111 vfsuid = i_uid_into_vfsuid(idmap, inode); 1112 /* Allowed if owner and follower match. */ 1113 if (vfsuid_eq_kuid(vfsuid, current_fsuid())) 1114 return 0; 1115 1116 /* Allowed if parent directory not sticky and world-writable. */ 1117 if ((nd->dir_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH)) 1118 return 0; 1119 1120 /* Allowed if parent directory and link owner match. */ 1121 if (vfsuid_valid(nd->dir_vfsuid) && vfsuid_eq(nd->dir_vfsuid, vfsuid)) 1122 return 0; 1123 1124 if (nd->flags & LOOKUP_RCU) 1125 return -ECHILD; 1126 1127 audit_inode(nd->name, nd->stack[0].link.dentry, 0); 1128 audit_log_path_denied(AUDIT_ANOM_LINK, "follow_link"); 1129 return -EACCES; 1130 } 1131 1132 /** 1133 * safe_hardlink_source - Check for safe hardlink conditions 1134 * @idmap: idmap of the mount the inode was found from 1135 * @inode: the source inode to hardlink from 1136 * 1137 * Return false if at least one of the following conditions: 1138 * - inode is not a regular file 1139 * - inode is setuid 1140 * - inode is setgid and group-exec 1141 * - access failure for read and write 1142 * 1143 * Otherwise returns true. 1144 */ 1145 static bool safe_hardlink_source(struct mnt_idmap *idmap, 1146 struct inode *inode) 1147 { 1148 umode_t mode = inode->i_mode; 1149 1150 /* Special files should not get pinned to the filesystem. */ 1151 if (!S_ISREG(mode)) 1152 return false; 1153 1154 /* Setuid files should not get pinned to the filesystem. */ 1155 if (mode & S_ISUID) 1156 return false; 1157 1158 /* Executable setgid files should not get pinned to the filesystem. */ 1159 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) 1160 return false; 1161 1162 /* Hardlinking to unreadable or unwritable sources is dangerous. */ 1163 if (inode_permission(idmap, inode, MAY_READ | MAY_WRITE)) 1164 return false; 1165 1166 return true; 1167 } 1168 1169 /** 1170 * may_linkat - Check permissions for creating a hardlink 1171 * @idmap: idmap of the mount the inode was found from 1172 * @link: the source to hardlink from 1173 * 1174 * Block hardlink when all of: 1175 * - sysctl_protected_hardlinks enabled 1176 * - fsuid does not match inode 1177 * - hardlink source is unsafe (see safe_hardlink_source() above) 1178 * - not CAP_FOWNER in a namespace with the inode owner uid mapped 1179 * 1180 * If the inode has been found through an idmapped mount the idmap of 1181 * the vfsmount must be passed through @idmap. This function will then take 1182 * care to map the inode according to @idmap before checking permissions. 1183 * On non-idmapped mounts or if permission checking is to be performed on the 1184 * raw inode simply pass @nop_mnt_idmap. 1185 * 1186 * Returns 0 if successful, -ve on error. 1187 */ 1188 int may_linkat(struct mnt_idmap *idmap, const struct path *link) 1189 { 1190 struct inode *inode = link->dentry->d_inode; 1191 1192 /* Inode writeback is not safe when the uid or gid are invalid. */ 1193 if (!vfsuid_valid(i_uid_into_vfsuid(idmap, inode)) || 1194 !vfsgid_valid(i_gid_into_vfsgid(idmap, inode))) 1195 return -EOVERFLOW; 1196 1197 if (!sysctl_protected_hardlinks) 1198 return 0; 1199 1200 /* Source inode owner (or CAP_FOWNER) can hardlink all they like, 1201 * otherwise, it must be a safe source. 1202 */ 1203 if (safe_hardlink_source(idmap, inode) || 1204 inode_owner_or_capable(idmap, inode)) 1205 return 0; 1206 1207 audit_log_path_denied(AUDIT_ANOM_LINK, "linkat"); 1208 return -EPERM; 1209 } 1210 1211 /** 1212 * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory 1213 * should be allowed, or not, on files that already 1214 * exist. 1215 * @idmap: idmap of the mount the inode was found from 1216 * @nd: nameidata pathwalk data 1217 * @inode: the inode of the file to open 1218 * 1219 * Block an O_CREAT open of a FIFO (or a regular file) when: 1220 * - sysctl_protected_fifos (or sysctl_protected_regular) is enabled 1221 * - the file already exists 1222 * - we are in a sticky directory 1223 * - we don't own the file 1224 * - the owner of the directory doesn't own the file 1225 * - the directory is world writable 1226 * If the sysctl_protected_fifos (or sysctl_protected_regular) is set to 2 1227 * the directory doesn't have to be world writable: being group writable will 1228 * be enough. 1229 * 1230 * If the inode has been found through an idmapped mount the idmap of 1231 * the vfsmount must be passed through @idmap. This function will then take 1232 * care to map the inode according to @idmap before checking permissions. 1233 * On non-idmapped mounts or if permission checking is to be performed on the 1234 * raw inode simply pass @nop_mnt_idmap. 1235 * 1236 * Returns 0 if the open is allowed, -ve on error. 1237 */ 1238 static int may_create_in_sticky(struct mnt_idmap *idmap, 1239 struct nameidata *nd, struct inode *const inode) 1240 { 1241 umode_t dir_mode = nd->dir_mode; 1242 vfsuid_t dir_vfsuid = nd->dir_vfsuid; 1243 1244 if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) || 1245 (!sysctl_protected_regular && S_ISREG(inode->i_mode)) || 1246 likely(!(dir_mode & S_ISVTX)) || 1247 vfsuid_eq(i_uid_into_vfsuid(idmap, inode), dir_vfsuid) || 1248 vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), current_fsuid())) 1249 return 0; 1250 1251 if (likely(dir_mode & 0002) || 1252 (dir_mode & 0020 && 1253 ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) || 1254 (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) { 1255 const char *operation = S_ISFIFO(inode->i_mode) ? 1256 "sticky_create_fifo" : 1257 "sticky_create_regular"; 1258 audit_log_path_denied(AUDIT_ANOM_CREAT, operation); 1259 return -EACCES; 1260 } 1261 return 0; 1262 } 1263 1264 /* 1265 * follow_up - Find the mountpoint of path's vfsmount 1266 * 1267 * Given a path, find the mountpoint of its source file system. 1268 * Replace @path with the path of the mountpoint in the parent mount. 1269 * Up is towards /. 1270 * 1271 * Return 1 if we went up a level and 0 if we were already at the 1272 * root. 1273 */ 1274 int follow_up(struct path *path) 1275 { 1276 struct mount *mnt = real_mount(path->mnt); 1277 struct mount *parent; 1278 struct dentry *mountpoint; 1279 1280 read_seqlock_excl(&mount_lock); 1281 parent = mnt->mnt_parent; 1282 if (parent == mnt) { 1283 read_sequnlock_excl(&mount_lock); 1284 return 0; 1285 } 1286 mntget(&parent->mnt); 1287 mountpoint = dget(mnt->mnt_mountpoint); 1288 read_sequnlock_excl(&mount_lock); 1289 dput(path->dentry); 1290 path->dentry = mountpoint; 1291 mntput(path->mnt); 1292 path->mnt = &parent->mnt; 1293 return 1; 1294 } 1295 EXPORT_SYMBOL(follow_up); 1296 1297 static bool choose_mountpoint_rcu(struct mount *m, const struct path *root, 1298 struct path *path, unsigned *seqp) 1299 { 1300 while (mnt_has_parent(m)) { 1301 struct dentry *mountpoint = m->mnt_mountpoint; 1302 1303 m = m->mnt_parent; 1304 if (unlikely(root->dentry == mountpoint && 1305 root->mnt == &m->mnt)) 1306 break; 1307 if (mountpoint != m->mnt.mnt_root) { 1308 path->mnt = &m->mnt; 1309 path->dentry = mountpoint; 1310 *seqp = read_seqcount_begin(&mountpoint->d_seq); 1311 return true; 1312 } 1313 } 1314 return false; 1315 } 1316 1317 static bool choose_mountpoint(struct mount *m, const struct path *root, 1318 struct path *path) 1319 { 1320 bool found; 1321 1322 rcu_read_lock(); 1323 while (1) { 1324 unsigned seq, mseq = read_seqbegin(&mount_lock); 1325 1326 found = choose_mountpoint_rcu(m, root, path, &seq); 1327 if (unlikely(!found)) { 1328 if (!read_seqretry(&mount_lock, mseq)) 1329 break; 1330 } else { 1331 if (likely(__legitimize_path(path, seq, mseq))) 1332 break; 1333 rcu_read_unlock(); 1334 path_put(path); 1335 rcu_read_lock(); 1336 } 1337 } 1338 rcu_read_unlock(); 1339 return found; 1340 } 1341 1342 /* 1343 * Perform an automount 1344 * - return -EISDIR to tell follow_managed() to stop and return the path we 1345 * were called with. 1346 */ 1347 static int follow_automount(struct path *path, int *count, unsigned lookup_flags) 1348 { 1349 struct dentry *dentry = path->dentry; 1350 1351 /* We don't want to mount if someone's just doing a stat - 1352 * unless they're stat'ing a directory and appended a '/' to 1353 * the name. 1354 * 1355 * We do, however, want to mount if someone wants to open or 1356 * create a file of any type under the mountpoint, wants to 1357 * traverse through the mountpoint or wants to open the 1358 * mounted directory. Also, autofs may mark negative dentries 1359 * as being automount points. These will need the attentions 1360 * of the daemon to instantiate them before they can be used. 1361 */ 1362 if (!(lookup_flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | 1363 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) && 1364 dentry->d_inode) 1365 return -EISDIR; 1366 1367 if (count && (*count)++ >= MAXSYMLINKS) 1368 return -ELOOP; 1369 1370 return finish_automount(dentry->d_op->d_automount(path), path); 1371 } 1372 1373 /* 1374 * mount traversal - out-of-line part. One note on ->d_flags accesses - 1375 * dentries are pinned but not locked here, so negative dentry can go 1376 * positive right under us. Use of smp_load_acquire() provides a barrier 1377 * sufficient for ->d_inode and ->d_flags consistency. 1378 */ 1379 static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped, 1380 int *count, unsigned lookup_flags) 1381 { 1382 struct vfsmount *mnt = path->mnt; 1383 bool need_mntput = false; 1384 int ret = 0; 1385 1386 while (flags & DCACHE_MANAGED_DENTRY) { 1387 /* Allow the filesystem to manage the transit without i_mutex 1388 * being held. */ 1389 if (flags & DCACHE_MANAGE_TRANSIT) { 1390 ret = path->dentry->d_op->d_manage(path, false); 1391 flags = smp_load_acquire(&path->dentry->d_flags); 1392 if (ret < 0) 1393 break; 1394 } 1395 1396 if (flags & DCACHE_MOUNTED) { // something's mounted on it.. 1397 struct vfsmount *mounted = lookup_mnt(path); 1398 if (mounted) { // ... in our namespace 1399 dput(path->dentry); 1400 if (need_mntput) 1401 mntput(path->mnt); 1402 path->mnt = mounted; 1403 path->dentry = dget(mounted->mnt_root); 1404 // here we know it's positive 1405 flags = path->dentry->d_flags; 1406 need_mntput = true; 1407 continue; 1408 } 1409 } 1410 1411 if (!(flags & DCACHE_NEED_AUTOMOUNT)) 1412 break; 1413 1414 // uncovered automount point 1415 ret = follow_automount(path, count, lookup_flags); 1416 flags = smp_load_acquire(&path->dentry->d_flags); 1417 if (ret < 0) 1418 break; 1419 } 1420 1421 if (ret == -EISDIR) 1422 ret = 0; 1423 // possible if you race with several mount --move 1424 if (need_mntput && path->mnt == mnt) 1425 mntput(path->mnt); 1426 if (!ret && unlikely(d_flags_negative(flags))) 1427 ret = -ENOENT; 1428 *jumped = need_mntput; 1429 return ret; 1430 } 1431 1432 static inline int traverse_mounts(struct path *path, bool *jumped, 1433 int *count, unsigned lookup_flags) 1434 { 1435 unsigned flags = smp_load_acquire(&path->dentry->d_flags); 1436 1437 /* fastpath */ 1438 if (likely(!(flags & DCACHE_MANAGED_DENTRY))) { 1439 *jumped = false; 1440 if (unlikely(d_flags_negative(flags))) 1441 return -ENOENT; 1442 return 0; 1443 } 1444 return __traverse_mounts(path, flags, jumped, count, lookup_flags); 1445 } 1446 1447 int follow_down_one(struct path *path) 1448 { 1449 struct vfsmount *mounted; 1450 1451 mounted = lookup_mnt(path); 1452 if (mounted) { 1453 dput(path->dentry); 1454 mntput(path->mnt); 1455 path->mnt = mounted; 1456 path->dentry = dget(mounted->mnt_root); 1457 return 1; 1458 } 1459 return 0; 1460 } 1461 EXPORT_SYMBOL(follow_down_one); 1462 1463 /* 1464 * Follow down to the covering mount currently visible to userspace. At each 1465 * point, the filesystem owning that dentry may be queried as to whether the 1466 * caller is permitted to proceed or not. 1467 */ 1468 int follow_down(struct path *path, unsigned int flags) 1469 { 1470 struct vfsmount *mnt = path->mnt; 1471 bool jumped; 1472 int ret = traverse_mounts(path, &jumped, NULL, flags); 1473 1474 if (path->mnt != mnt) 1475 mntput(mnt); 1476 return ret; 1477 } 1478 EXPORT_SYMBOL(follow_down); 1479 1480 /* 1481 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if 1482 * we meet a managed dentry that would need blocking. 1483 */ 1484 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path) 1485 { 1486 struct dentry *dentry = path->dentry; 1487 unsigned int flags = dentry->d_flags; 1488 1489 if (likely(!(flags & DCACHE_MANAGED_DENTRY))) 1490 return true; 1491 1492 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) 1493 return false; 1494 1495 for (;;) { 1496 /* 1497 * Don't forget we might have a non-mountpoint managed dentry 1498 * that wants to block transit. 1499 */ 1500 if (unlikely(flags & DCACHE_MANAGE_TRANSIT)) { 1501 int res = dentry->d_op->d_manage(path, true); 1502 if (res) 1503 return res == -EISDIR; 1504 flags = dentry->d_flags; 1505 } 1506 1507 if (flags & DCACHE_MOUNTED) { 1508 struct mount *mounted = __lookup_mnt(path->mnt, dentry); 1509 if (mounted) { 1510 path->mnt = &mounted->mnt; 1511 dentry = path->dentry = mounted->mnt.mnt_root; 1512 nd->state |= ND_JUMPED; 1513 nd->next_seq = read_seqcount_begin(&dentry->d_seq); 1514 flags = dentry->d_flags; 1515 // makes sure that non-RCU pathwalk could reach 1516 // this state. 1517 if (read_seqretry(&mount_lock, nd->m_seq)) 1518 return false; 1519 continue; 1520 } 1521 if (read_seqretry(&mount_lock, nd->m_seq)) 1522 return false; 1523 } 1524 return !(flags & DCACHE_NEED_AUTOMOUNT); 1525 } 1526 } 1527 1528 static inline int handle_mounts(struct nameidata *nd, struct dentry *dentry, 1529 struct path *path) 1530 { 1531 bool jumped; 1532 int ret; 1533 1534 path->mnt = nd->path.mnt; 1535 path->dentry = dentry; 1536 if (nd->flags & LOOKUP_RCU) { 1537 unsigned int seq = nd->next_seq; 1538 if (likely(__follow_mount_rcu(nd, path))) 1539 return 0; 1540 // *path and nd->next_seq might've been clobbered 1541 path->mnt = nd->path.mnt; 1542 path->dentry = dentry; 1543 nd->next_seq = seq; 1544 if (!try_to_unlazy_next(nd, dentry)) 1545 return -ECHILD; 1546 } 1547 ret = traverse_mounts(path, &jumped, &nd->total_link_count, nd->flags); 1548 if (jumped) { 1549 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) 1550 ret = -EXDEV; 1551 else 1552 nd->state |= ND_JUMPED; 1553 } 1554 if (unlikely(ret)) { 1555 dput(path->dentry); 1556 if (path->mnt != nd->path.mnt) 1557 mntput(path->mnt); 1558 } 1559 return ret; 1560 } 1561 1562 /* 1563 * This looks up the name in dcache and possibly revalidates the found dentry. 1564 * NULL is returned if the dentry does not exist in the cache. 1565 */ 1566 static struct dentry *lookup_dcache(const struct qstr *name, 1567 struct dentry *dir, 1568 unsigned int flags) 1569 { 1570 struct dentry *dentry = d_lookup(dir, name); 1571 if (dentry) { 1572 int error = d_revalidate(dentry, flags); 1573 if (unlikely(error <= 0)) { 1574 if (!error) 1575 d_invalidate(dentry); 1576 dput(dentry); 1577 return ERR_PTR(error); 1578 } 1579 } 1580 return dentry; 1581 } 1582 1583 /* 1584 * Parent directory has inode locked exclusive. This is one 1585 * and only case when ->lookup() gets called on non in-lookup 1586 * dentries - as the matter of fact, this only gets called 1587 * when directory is guaranteed to have no in-lookup children 1588 * at all. 1589 */ 1590 struct dentry *lookup_one_qstr_excl(const struct qstr *name, 1591 struct dentry *base, 1592 unsigned int flags) 1593 { 1594 struct dentry *dentry = lookup_dcache(name, base, flags); 1595 struct dentry *old; 1596 struct inode *dir = base->d_inode; 1597 1598 if (dentry) 1599 return dentry; 1600 1601 /* Don't create child dentry for a dead directory. */ 1602 if (unlikely(IS_DEADDIR(dir))) 1603 return ERR_PTR(-ENOENT); 1604 1605 dentry = d_alloc(base, name); 1606 if (unlikely(!dentry)) 1607 return ERR_PTR(-ENOMEM); 1608 1609 old = dir->i_op->lookup(dir, dentry, flags); 1610 if (unlikely(old)) { 1611 dput(dentry); 1612 dentry = old; 1613 } 1614 return dentry; 1615 } 1616 EXPORT_SYMBOL(lookup_one_qstr_excl); 1617 1618 static struct dentry *lookup_fast(struct nameidata *nd) 1619 { 1620 struct dentry *dentry, *parent = nd->path.dentry; 1621 int status = 1; 1622 1623 /* 1624 * Rename seqlock is not required here because in the off chance 1625 * of a false negative due to a concurrent rename, the caller is 1626 * going to fall back to non-racy lookup. 1627 */ 1628 if (nd->flags & LOOKUP_RCU) { 1629 dentry = __d_lookup_rcu(parent, &nd->last, &nd->next_seq); 1630 if (unlikely(!dentry)) { 1631 if (!try_to_unlazy(nd)) 1632 return ERR_PTR(-ECHILD); 1633 return NULL; 1634 } 1635 1636 /* 1637 * This sequence count validates that the parent had no 1638 * changes while we did the lookup of the dentry above. 1639 */ 1640 if (read_seqcount_retry(&parent->d_seq, nd->seq)) 1641 return ERR_PTR(-ECHILD); 1642 1643 status = d_revalidate(dentry, nd->flags); 1644 if (likely(status > 0)) 1645 return dentry; 1646 if (!try_to_unlazy_next(nd, dentry)) 1647 return ERR_PTR(-ECHILD); 1648 if (status == -ECHILD) 1649 /* we'd been told to redo it in non-rcu mode */ 1650 status = d_revalidate(dentry, nd->flags); 1651 } else { 1652 dentry = __d_lookup(parent, &nd->last); 1653 if (unlikely(!dentry)) 1654 return NULL; 1655 status = d_revalidate(dentry, nd->flags); 1656 } 1657 if (unlikely(status <= 0)) { 1658 if (!status) 1659 d_invalidate(dentry); 1660 dput(dentry); 1661 return ERR_PTR(status); 1662 } 1663 return dentry; 1664 } 1665 1666 /* Fast lookup failed, do it the slow way */ 1667 static struct dentry *__lookup_slow(const struct qstr *name, 1668 struct dentry *dir, 1669 unsigned int flags) 1670 { 1671 struct dentry *dentry, *old; 1672 struct inode *inode = dir->d_inode; 1673 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq); 1674 1675 /* Don't go there if it's already dead */ 1676 if (unlikely(IS_DEADDIR(inode))) 1677 return ERR_PTR(-ENOENT); 1678 again: 1679 dentry = d_alloc_parallel(dir, name, &wq); 1680 if (IS_ERR(dentry)) 1681 return dentry; 1682 if (unlikely(!d_in_lookup(dentry))) { 1683 int error = d_revalidate(dentry, flags); 1684 if (unlikely(error <= 0)) { 1685 if (!error) { 1686 d_invalidate(dentry); 1687 dput(dentry); 1688 goto again; 1689 } 1690 dput(dentry); 1691 dentry = ERR_PTR(error); 1692 } 1693 } else { 1694 old = inode->i_op->lookup(inode, dentry, flags); 1695 d_lookup_done(dentry); 1696 if (unlikely(old)) { 1697 dput(dentry); 1698 dentry = old; 1699 } 1700 } 1701 return dentry; 1702 } 1703 1704 static struct dentry *lookup_slow(const struct qstr *name, 1705 struct dentry *dir, 1706 unsigned int flags) 1707 { 1708 struct inode *inode = dir->d_inode; 1709 struct dentry *res; 1710 inode_lock_shared(inode); 1711 res = __lookup_slow(name, dir, flags); 1712 inode_unlock_shared(inode); 1713 return res; 1714 } 1715 1716 static inline int may_lookup(struct mnt_idmap *idmap, 1717 struct nameidata *nd) 1718 { 1719 if (nd->flags & LOOKUP_RCU) { 1720 int err = inode_permission(idmap, nd->inode, MAY_EXEC|MAY_NOT_BLOCK); 1721 if (err != -ECHILD || !try_to_unlazy(nd)) 1722 return err; 1723 } 1724 return inode_permission(idmap, nd->inode, MAY_EXEC); 1725 } 1726 1727 static int reserve_stack(struct nameidata *nd, struct path *link) 1728 { 1729 if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) 1730 return -ELOOP; 1731 1732 if (likely(nd->depth != EMBEDDED_LEVELS)) 1733 return 0; 1734 if (likely(nd->stack != nd->internal)) 1735 return 0; 1736 if (likely(nd_alloc_stack(nd))) 1737 return 0; 1738 1739 if (nd->flags & LOOKUP_RCU) { 1740 // we need to grab link before we do unlazy. And we can't skip 1741 // unlazy even if we fail to grab the link - cleanup needs it 1742 bool grabbed_link = legitimize_path(nd, link, nd->next_seq); 1743 1744 if (!try_to_unlazy(nd) || !grabbed_link) 1745 return -ECHILD; 1746 1747 if (nd_alloc_stack(nd)) 1748 return 0; 1749 } 1750 return -ENOMEM; 1751 } 1752 1753 enum {WALK_TRAILING = 1, WALK_MORE = 2, WALK_NOFOLLOW = 4}; 1754 1755 static const char *pick_link(struct nameidata *nd, struct path *link, 1756 struct inode *inode, int flags) 1757 { 1758 struct saved *last; 1759 const char *res; 1760 int error = reserve_stack(nd, link); 1761 1762 if (unlikely(error)) { 1763 if (!(nd->flags & LOOKUP_RCU)) 1764 path_put(link); 1765 return ERR_PTR(error); 1766 } 1767 last = nd->stack + nd->depth++; 1768 last->link = *link; 1769 clear_delayed_call(&last->done); 1770 last->seq = nd->next_seq; 1771 1772 if (flags & WALK_TRAILING) { 1773 error = may_follow_link(nd, inode); 1774 if (unlikely(error)) 1775 return ERR_PTR(error); 1776 } 1777 1778 if (unlikely(nd->flags & LOOKUP_NO_SYMLINKS) || 1779 unlikely(link->mnt->mnt_flags & MNT_NOSYMFOLLOW)) 1780 return ERR_PTR(-ELOOP); 1781 1782 if (!(nd->flags & LOOKUP_RCU)) { 1783 touch_atime(&last->link); 1784 cond_resched(); 1785 } else if (atime_needs_update(&last->link, inode)) { 1786 if (!try_to_unlazy(nd)) 1787 return ERR_PTR(-ECHILD); 1788 touch_atime(&last->link); 1789 } 1790 1791 error = security_inode_follow_link(link->dentry, inode, 1792 nd->flags & LOOKUP_RCU); 1793 if (unlikely(error)) 1794 return ERR_PTR(error); 1795 1796 res = READ_ONCE(inode->i_link); 1797 if (!res) { 1798 const char * (*get)(struct dentry *, struct inode *, 1799 struct delayed_call *); 1800 get = inode->i_op->get_link; 1801 if (nd->flags & LOOKUP_RCU) { 1802 res = get(NULL, inode, &last->done); 1803 if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd)) 1804 res = get(link->dentry, inode, &last->done); 1805 } else { 1806 res = get(link->dentry, inode, &last->done); 1807 } 1808 if (!res) 1809 goto all_done; 1810 if (IS_ERR(res)) 1811 return res; 1812 } 1813 if (*res == '/') { 1814 error = nd_jump_root(nd); 1815 if (unlikely(error)) 1816 return ERR_PTR(error); 1817 while (unlikely(*++res == '/')) 1818 ; 1819 } 1820 if (*res) 1821 return res; 1822 all_done: // pure jump 1823 put_link(nd); 1824 return NULL; 1825 } 1826 1827 /* 1828 * Do we need to follow links? We _really_ want to be able 1829 * to do this check without having to look at inode->i_op, 1830 * so we keep a cache of "no, this doesn't need follow_link" 1831 * for the common case. 1832 * 1833 * NOTE: dentry must be what nd->next_seq had been sampled from. 1834 */ 1835 static const char *step_into(struct nameidata *nd, int flags, 1836 struct dentry *dentry) 1837 { 1838 struct path path; 1839 struct inode *inode; 1840 int err = handle_mounts(nd, dentry, &path); 1841 1842 if (err < 0) 1843 return ERR_PTR(err); 1844 inode = path.dentry->d_inode; 1845 if (likely(!d_is_symlink(path.dentry)) || 1846 ((flags & WALK_TRAILING) && !(nd->flags & LOOKUP_FOLLOW)) || 1847 (flags & WALK_NOFOLLOW)) { 1848 /* not a symlink or should not follow */ 1849 if (nd->flags & LOOKUP_RCU) { 1850 if (read_seqcount_retry(&path.dentry->d_seq, nd->next_seq)) 1851 return ERR_PTR(-ECHILD); 1852 if (unlikely(!inode)) 1853 return ERR_PTR(-ENOENT); 1854 } else { 1855 dput(nd->path.dentry); 1856 if (nd->path.mnt != path.mnt) 1857 mntput(nd->path.mnt); 1858 } 1859 nd->path = path; 1860 nd->inode = inode; 1861 nd->seq = nd->next_seq; 1862 return NULL; 1863 } 1864 if (nd->flags & LOOKUP_RCU) { 1865 /* make sure that d_is_symlink above matches inode */ 1866 if (read_seqcount_retry(&path.dentry->d_seq, nd->next_seq)) 1867 return ERR_PTR(-ECHILD); 1868 } else { 1869 if (path.mnt == nd->path.mnt) 1870 mntget(path.mnt); 1871 } 1872 return pick_link(nd, &path, inode, flags); 1873 } 1874 1875 static struct dentry *follow_dotdot_rcu(struct nameidata *nd) 1876 { 1877 struct dentry *parent, *old; 1878 1879 if (path_equal(&nd->path, &nd->root)) 1880 goto in_root; 1881 if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) { 1882 struct path path; 1883 unsigned seq; 1884 if (!choose_mountpoint_rcu(real_mount(nd->path.mnt), 1885 &nd->root, &path, &seq)) 1886 goto in_root; 1887 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) 1888 return ERR_PTR(-ECHILD); 1889 nd->path = path; 1890 nd->inode = path.dentry->d_inode; 1891 nd->seq = seq; 1892 // makes sure that non-RCU pathwalk could reach this state 1893 if (read_seqretry(&mount_lock, nd->m_seq)) 1894 return ERR_PTR(-ECHILD); 1895 /* we know that mountpoint was pinned */ 1896 } 1897 old = nd->path.dentry; 1898 parent = old->d_parent; 1899 nd->next_seq = read_seqcount_begin(&parent->d_seq); 1900 // makes sure that non-RCU pathwalk could reach this state 1901 if (read_seqcount_retry(&old->d_seq, nd->seq)) 1902 return ERR_PTR(-ECHILD); 1903 if (unlikely(!path_connected(nd->path.mnt, parent))) 1904 return ERR_PTR(-ECHILD); 1905 return parent; 1906 in_root: 1907 if (read_seqretry(&mount_lock, nd->m_seq)) 1908 return ERR_PTR(-ECHILD); 1909 if (unlikely(nd->flags & LOOKUP_BENEATH)) 1910 return ERR_PTR(-ECHILD); 1911 nd->next_seq = nd->seq; 1912 return nd->path.dentry; 1913 } 1914 1915 static struct dentry *follow_dotdot(struct nameidata *nd) 1916 { 1917 struct dentry *parent; 1918 1919 if (path_equal(&nd->path, &nd->root)) 1920 goto in_root; 1921 if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) { 1922 struct path path; 1923 1924 if (!choose_mountpoint(real_mount(nd->path.mnt), 1925 &nd->root, &path)) 1926 goto in_root; 1927 path_put(&nd->path); 1928 nd->path = path; 1929 nd->inode = path.dentry->d_inode; 1930 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) 1931 return ERR_PTR(-EXDEV); 1932 } 1933 /* rare case of legitimate dget_parent()... */ 1934 parent = dget_parent(nd->path.dentry); 1935 if (unlikely(!path_connected(nd->path.mnt, parent))) { 1936 dput(parent); 1937 return ERR_PTR(-ENOENT); 1938 } 1939 return parent; 1940 1941 in_root: 1942 if (unlikely(nd->flags & LOOKUP_BENEATH)) 1943 return ERR_PTR(-EXDEV); 1944 return dget(nd->path.dentry); 1945 } 1946 1947 static const char *handle_dots(struct nameidata *nd, int type) 1948 { 1949 if (type == LAST_DOTDOT) { 1950 const char *error = NULL; 1951 struct dentry *parent; 1952 1953 if (!nd->root.mnt) { 1954 error = ERR_PTR(set_root(nd)); 1955 if (error) 1956 return error; 1957 } 1958 if (nd->flags & LOOKUP_RCU) 1959 parent = follow_dotdot_rcu(nd); 1960 else 1961 parent = follow_dotdot(nd); 1962 if (IS_ERR(parent)) 1963 return ERR_CAST(parent); 1964 error = step_into(nd, WALK_NOFOLLOW, parent); 1965 if (unlikely(error)) 1966 return error; 1967 1968 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) { 1969 /* 1970 * If there was a racing rename or mount along our 1971 * path, then we can't be sure that ".." hasn't jumped 1972 * above nd->root (and so userspace should retry or use 1973 * some fallback). 1974 */ 1975 smp_rmb(); 1976 if (__read_seqcount_retry(&mount_lock.seqcount, nd->m_seq)) 1977 return ERR_PTR(-EAGAIN); 1978 if (__read_seqcount_retry(&rename_lock.seqcount, nd->r_seq)) 1979 return ERR_PTR(-EAGAIN); 1980 } 1981 } 1982 return NULL; 1983 } 1984 1985 static const char *walk_component(struct nameidata *nd, int flags) 1986 { 1987 struct dentry *dentry; 1988 /* 1989 * "." and ".." are special - ".." especially so because it has 1990 * to be able to know about the current root directory and 1991 * parent relationships. 1992 */ 1993 if (unlikely(nd->last_type != LAST_NORM)) { 1994 if (!(flags & WALK_MORE) && nd->depth) 1995 put_link(nd); 1996 return handle_dots(nd, nd->last_type); 1997 } 1998 dentry = lookup_fast(nd); 1999 if (IS_ERR(dentry)) 2000 return ERR_CAST(dentry); 2001 if (unlikely(!dentry)) { 2002 dentry = lookup_slow(&nd->last, nd->path.dentry, nd->flags); 2003 if (IS_ERR(dentry)) 2004 return ERR_CAST(dentry); 2005 } 2006 if (!(flags & WALK_MORE) && nd->depth) 2007 put_link(nd); 2008 return step_into(nd, flags, dentry); 2009 } 2010 2011 /* 2012 * We can do the critical dentry name comparison and hashing 2013 * operations one word at a time, but we are limited to: 2014 * 2015 * - Architectures with fast unaligned word accesses. We could 2016 * do a "get_unaligned()" if this helps and is sufficiently 2017 * fast. 2018 * 2019 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we 2020 * do not trap on the (extremely unlikely) case of a page 2021 * crossing operation. 2022 * 2023 * - Furthermore, we need an efficient 64-bit compile for the 2024 * 64-bit case in order to generate the "number of bytes in 2025 * the final mask". Again, that could be replaced with a 2026 * efficient population count instruction or similar. 2027 */ 2028 #ifdef CONFIG_DCACHE_WORD_ACCESS 2029 2030 #include <asm/word-at-a-time.h> 2031 2032 #ifdef HASH_MIX 2033 2034 /* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */ 2035 2036 #elif defined(CONFIG_64BIT) 2037 /* 2038 * Register pressure in the mixing function is an issue, particularly 2039 * on 32-bit x86, but almost any function requires one state value and 2040 * one temporary. Instead, use a function designed for two state values 2041 * and no temporaries. 2042 * 2043 * This function cannot create a collision in only two iterations, so 2044 * we have two iterations to achieve avalanche. In those two iterations, 2045 * we have six layers of mixing, which is enough to spread one bit's 2046 * influence out to 2^6 = 64 state bits. 2047 * 2048 * Rotate constants are scored by considering either 64 one-bit input 2049 * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the 2050 * probability of that delta causing a change to each of the 128 output 2051 * bits, using a sample of random initial states. 2052 * 2053 * The Shannon entropy of the computed probabilities is then summed 2054 * to produce a score. Ideally, any input change has a 50% chance of 2055 * toggling any given output bit. 2056 * 2057 * Mixing scores (in bits) for (12,45): 2058 * Input delta: 1-bit 2-bit 2059 * 1 round: 713.3 42542.6 2060 * 2 rounds: 2753.7 140389.8 2061 * 3 rounds: 5954.1 233458.2 2062 * 4 rounds: 7862.6 256672.2 2063 * Perfect: 8192 258048 2064 * (64*128) (64*63/2 * 128) 2065 */ 2066 #define HASH_MIX(x, y, a) \ 2067 ( x ^= (a), \ 2068 y ^= x, x = rol64(x,12),\ 2069 x += y, y = rol64(y,45),\ 2070 y *= 9 ) 2071 2072 /* 2073 * Fold two longs into one 32-bit hash value. This must be fast, but 2074 * latency isn't quite as critical, as there is a fair bit of additional 2075 * work done before the hash value is used. 2076 */ 2077 static inline unsigned int fold_hash(unsigned long x, unsigned long y) 2078 { 2079 y ^= x * GOLDEN_RATIO_64; 2080 y *= GOLDEN_RATIO_64; 2081 return y >> 32; 2082 } 2083 2084 #else /* 32-bit case */ 2085 2086 /* 2087 * Mixing scores (in bits) for (7,20): 2088 * Input delta: 1-bit 2-bit 2089 * 1 round: 330.3 9201.6 2090 * 2 rounds: 1246.4 25475.4 2091 * 3 rounds: 1907.1 31295.1 2092 * 4 rounds: 2042.3 31718.6 2093 * Perfect: 2048 31744 2094 * (32*64) (32*31/2 * 64) 2095 */ 2096 #define HASH_MIX(x, y, a) \ 2097 ( x ^= (a), \ 2098 y ^= x, x = rol32(x, 7),\ 2099 x += y, y = rol32(y,20),\ 2100 y *= 9 ) 2101 2102 static inline unsigned int fold_hash(unsigned long x, unsigned long y) 2103 { 2104 /* Use arch-optimized multiply if one exists */ 2105 return __hash_32(y ^ __hash_32(x)); 2106 } 2107 2108 #endif 2109 2110 /* 2111 * Return the hash of a string of known length. This is carfully 2112 * designed to match hash_name(), which is the more critical function. 2113 * In particular, we must end by hashing a final word containing 0..7 2114 * payload bytes, to match the way that hash_name() iterates until it 2115 * finds the delimiter after the name. 2116 */ 2117 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len) 2118 { 2119 unsigned long a, x = 0, y = (unsigned long)salt; 2120 2121 for (;;) { 2122 if (!len) 2123 goto done; 2124 a = load_unaligned_zeropad(name); 2125 if (len < sizeof(unsigned long)) 2126 break; 2127 HASH_MIX(x, y, a); 2128 name += sizeof(unsigned long); 2129 len -= sizeof(unsigned long); 2130 } 2131 x ^= a & bytemask_from_count(len); 2132 done: 2133 return fold_hash(x, y); 2134 } 2135 EXPORT_SYMBOL(full_name_hash); 2136 2137 /* Return the "hash_len" (hash and length) of a null-terminated string */ 2138 u64 hashlen_string(const void *salt, const char *name) 2139 { 2140 unsigned long a = 0, x = 0, y = (unsigned long)salt; 2141 unsigned long adata, mask, len; 2142 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 2143 2144 len = 0; 2145 goto inside; 2146 2147 do { 2148 HASH_MIX(x, y, a); 2149 len += sizeof(unsigned long); 2150 inside: 2151 a = load_unaligned_zeropad(name+len); 2152 } while (!has_zero(a, &adata, &constants)); 2153 2154 adata = prep_zero_mask(a, adata, &constants); 2155 mask = create_zero_mask(adata); 2156 x ^= a & zero_bytemask(mask); 2157 2158 return hashlen_create(fold_hash(x, y), len + find_zero(mask)); 2159 } 2160 EXPORT_SYMBOL(hashlen_string); 2161 2162 /* 2163 * Calculate the length and hash of the path component, and 2164 * return the "hash_len" as the result. 2165 */ 2166 static inline u64 hash_name(const void *salt, const char *name) 2167 { 2168 unsigned long a = 0, b, x = 0, y = (unsigned long)salt; 2169 unsigned long adata, bdata, mask, len; 2170 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 2171 2172 len = 0; 2173 goto inside; 2174 2175 do { 2176 HASH_MIX(x, y, a); 2177 len += sizeof(unsigned long); 2178 inside: 2179 a = load_unaligned_zeropad(name+len); 2180 b = a ^ REPEAT_BYTE('/'); 2181 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants))); 2182 2183 adata = prep_zero_mask(a, adata, &constants); 2184 bdata = prep_zero_mask(b, bdata, &constants); 2185 mask = create_zero_mask(adata | bdata); 2186 x ^= a & zero_bytemask(mask); 2187 2188 return hashlen_create(fold_hash(x, y), len + find_zero(mask)); 2189 } 2190 2191 #else /* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */ 2192 2193 /* Return the hash of a string of known length */ 2194 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len) 2195 { 2196 unsigned long hash = init_name_hash(salt); 2197 while (len--) 2198 hash = partial_name_hash((unsigned char)*name++, hash); 2199 return end_name_hash(hash); 2200 } 2201 EXPORT_SYMBOL(full_name_hash); 2202 2203 /* Return the "hash_len" (hash and length) of a null-terminated string */ 2204 u64 hashlen_string(const void *salt, const char *name) 2205 { 2206 unsigned long hash = init_name_hash(salt); 2207 unsigned long len = 0, c; 2208 2209 c = (unsigned char)*name; 2210 while (c) { 2211 len++; 2212 hash = partial_name_hash(c, hash); 2213 c = (unsigned char)name[len]; 2214 } 2215 return hashlen_create(end_name_hash(hash), len); 2216 } 2217 EXPORT_SYMBOL(hashlen_string); 2218 2219 /* 2220 * We know there's a real path component here of at least 2221 * one character. 2222 */ 2223 static inline u64 hash_name(const void *salt, const char *name) 2224 { 2225 unsigned long hash = init_name_hash(salt); 2226 unsigned long len = 0, c; 2227 2228 c = (unsigned char)*name; 2229 do { 2230 len++; 2231 hash = partial_name_hash(c, hash); 2232 c = (unsigned char)name[len]; 2233 } while (c && c != '/'); 2234 return hashlen_create(end_name_hash(hash), len); 2235 } 2236 2237 #endif 2238 2239 /* 2240 * Name resolution. 2241 * This is the basic name resolution function, turning a pathname into 2242 * the final dentry. We expect 'base' to be positive and a directory. 2243 * 2244 * Returns 0 and nd will have valid dentry and mnt on success. 2245 * Returns error and drops reference to input namei data on failure. 2246 */ 2247 static int link_path_walk(const char *name, struct nameidata *nd) 2248 { 2249 int depth = 0; // depth <= nd->depth 2250 int err; 2251 2252 nd->last_type = LAST_ROOT; 2253 nd->flags |= LOOKUP_PARENT; 2254 if (IS_ERR(name)) 2255 return PTR_ERR(name); 2256 while (*name=='/') 2257 name++; 2258 if (!*name) { 2259 nd->dir_mode = 0; // short-circuit the 'hardening' idiocy 2260 return 0; 2261 } 2262 2263 /* At this point we know we have a real path component. */ 2264 for(;;) { 2265 struct mnt_idmap *idmap; 2266 const char *link; 2267 u64 hash_len; 2268 int type; 2269 2270 idmap = mnt_idmap(nd->path.mnt); 2271 err = may_lookup(idmap, nd); 2272 if (err) 2273 return err; 2274 2275 hash_len = hash_name(nd->path.dentry, name); 2276 2277 type = LAST_NORM; 2278 if (name[0] == '.') switch (hashlen_len(hash_len)) { 2279 case 2: 2280 if (name[1] == '.') { 2281 type = LAST_DOTDOT; 2282 nd->state |= ND_JUMPED; 2283 } 2284 break; 2285 case 1: 2286 type = LAST_DOT; 2287 } 2288 if (likely(type == LAST_NORM)) { 2289 struct dentry *parent = nd->path.dentry; 2290 nd->state &= ~ND_JUMPED; 2291 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { 2292 struct qstr this = { { .hash_len = hash_len }, .name = name }; 2293 err = parent->d_op->d_hash(parent, &this); 2294 if (err < 0) 2295 return err; 2296 hash_len = this.hash_len; 2297 name = this.name; 2298 } 2299 } 2300 2301 nd->last.hash_len = hash_len; 2302 nd->last.name = name; 2303 nd->last_type = type; 2304 2305 name += hashlen_len(hash_len); 2306 if (!*name) 2307 goto OK; 2308 /* 2309 * If it wasn't NUL, we know it was '/'. Skip that 2310 * slash, and continue until no more slashes. 2311 */ 2312 do { 2313 name++; 2314 } while (unlikely(*name == '/')); 2315 if (unlikely(!*name)) { 2316 OK: 2317 /* pathname or trailing symlink, done */ 2318 if (!depth) { 2319 nd->dir_vfsuid = i_uid_into_vfsuid(idmap, nd->inode); 2320 nd->dir_mode = nd->inode->i_mode; 2321 nd->flags &= ~LOOKUP_PARENT; 2322 return 0; 2323 } 2324 /* last component of nested symlink */ 2325 name = nd->stack[--depth].name; 2326 link = walk_component(nd, 0); 2327 } else { 2328 /* not the last component */ 2329 link = walk_component(nd, WALK_MORE); 2330 } 2331 if (unlikely(link)) { 2332 if (IS_ERR(link)) 2333 return PTR_ERR(link); 2334 /* a symlink to follow */ 2335 nd->stack[depth++].name = name; 2336 name = link; 2337 continue; 2338 } 2339 if (unlikely(!d_can_lookup(nd->path.dentry))) { 2340 if (nd->flags & LOOKUP_RCU) { 2341 if (!try_to_unlazy(nd)) 2342 return -ECHILD; 2343 } 2344 return -ENOTDIR; 2345 } 2346 } 2347 } 2348 2349 /* must be paired with terminate_walk() */ 2350 static const char *path_init(struct nameidata *nd, unsigned flags) 2351 { 2352 int error; 2353 const char *s = nd->name->name; 2354 2355 /* LOOKUP_CACHED requires RCU, ask caller to retry */ 2356 if ((flags & (LOOKUP_RCU | LOOKUP_CACHED)) == LOOKUP_CACHED) 2357 return ERR_PTR(-EAGAIN); 2358 2359 if (!*s) 2360 flags &= ~LOOKUP_RCU; 2361 if (flags & LOOKUP_RCU) 2362 rcu_read_lock(); 2363 else 2364 nd->seq = nd->next_seq = 0; 2365 2366 nd->flags = flags; 2367 nd->state |= ND_JUMPED; 2368 2369 nd->m_seq = __read_seqcount_begin(&mount_lock.seqcount); 2370 nd->r_seq = __read_seqcount_begin(&rename_lock.seqcount); 2371 smp_rmb(); 2372 2373 if (nd->state & ND_ROOT_PRESET) { 2374 struct dentry *root = nd->root.dentry; 2375 struct inode *inode = root->d_inode; 2376 if (*s && unlikely(!d_can_lookup(root))) 2377 return ERR_PTR(-ENOTDIR); 2378 nd->path = nd->root; 2379 nd->inode = inode; 2380 if (flags & LOOKUP_RCU) { 2381 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 2382 nd->root_seq = nd->seq; 2383 } else { 2384 path_get(&nd->path); 2385 } 2386 return s; 2387 } 2388 2389 nd->root.mnt = NULL; 2390 2391 /* Absolute pathname -- fetch the root (LOOKUP_IN_ROOT uses nd->dfd). */ 2392 if (*s == '/' && !(flags & LOOKUP_IN_ROOT)) { 2393 error = nd_jump_root(nd); 2394 if (unlikely(error)) 2395 return ERR_PTR(error); 2396 return s; 2397 } 2398 2399 /* Relative pathname -- get the starting-point it is relative to. */ 2400 if (nd->dfd == AT_FDCWD) { 2401 if (flags & LOOKUP_RCU) { 2402 struct fs_struct *fs = current->fs; 2403 unsigned seq; 2404 2405 do { 2406 seq = read_seqcount_begin(&fs->seq); 2407 nd->path = fs->pwd; 2408 nd->inode = nd->path.dentry->d_inode; 2409 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 2410 } while (read_seqcount_retry(&fs->seq, seq)); 2411 } else { 2412 get_fs_pwd(current->fs, &nd->path); 2413 nd->inode = nd->path.dentry->d_inode; 2414 } 2415 } else { 2416 /* Caller must check execute permissions on the starting path component */ 2417 struct fd f = fdget_raw(nd->dfd); 2418 struct dentry *dentry; 2419 2420 if (!f.file) 2421 return ERR_PTR(-EBADF); 2422 2423 dentry = f.file->f_path.dentry; 2424 2425 if (*s && unlikely(!d_can_lookup(dentry))) { 2426 fdput(f); 2427 return ERR_PTR(-ENOTDIR); 2428 } 2429 2430 nd->path = f.file->f_path; 2431 if (flags & LOOKUP_RCU) { 2432 nd->inode = nd->path.dentry->d_inode; 2433 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 2434 } else { 2435 path_get(&nd->path); 2436 nd->inode = nd->path.dentry->d_inode; 2437 } 2438 fdput(f); 2439 } 2440 2441 /* For scoped-lookups we need to set the root to the dirfd as well. */ 2442 if (flags & LOOKUP_IS_SCOPED) { 2443 nd->root = nd->path; 2444 if (flags & LOOKUP_RCU) { 2445 nd->root_seq = nd->seq; 2446 } else { 2447 path_get(&nd->root); 2448 nd->state |= ND_ROOT_GRABBED; 2449 } 2450 } 2451 return s; 2452 } 2453 2454 static inline const char *lookup_last(struct nameidata *nd) 2455 { 2456 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len]) 2457 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 2458 2459 return walk_component(nd, WALK_TRAILING); 2460 } 2461 2462 static int handle_lookup_down(struct nameidata *nd) 2463 { 2464 if (!(nd->flags & LOOKUP_RCU)) 2465 dget(nd->path.dentry); 2466 nd->next_seq = nd->seq; 2467 return PTR_ERR(step_into(nd, WALK_NOFOLLOW, nd->path.dentry)); 2468 } 2469 2470 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 2471 static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path) 2472 { 2473 const char *s = path_init(nd, flags); 2474 int err; 2475 2476 if (unlikely(flags & LOOKUP_DOWN) && !IS_ERR(s)) { 2477 err = handle_lookup_down(nd); 2478 if (unlikely(err < 0)) 2479 s = ERR_PTR(err); 2480 } 2481 2482 while (!(err = link_path_walk(s, nd)) && 2483 (s = lookup_last(nd)) != NULL) 2484 ; 2485 if (!err && unlikely(nd->flags & LOOKUP_MOUNTPOINT)) { 2486 err = handle_lookup_down(nd); 2487 nd->state &= ~ND_JUMPED; // no d_weak_revalidate(), please... 2488 } 2489 if (!err) 2490 err = complete_walk(nd); 2491 2492 if (!err && nd->flags & LOOKUP_DIRECTORY) 2493 if (!d_can_lookup(nd->path.dentry)) 2494 err = -ENOTDIR; 2495 if (!err) { 2496 *path = nd->path; 2497 nd->path.mnt = NULL; 2498 nd->path.dentry = NULL; 2499 } 2500 terminate_walk(nd); 2501 return err; 2502 } 2503 2504 int filename_lookup(int dfd, struct filename *name, unsigned flags, 2505 struct path *path, struct path *root) 2506 { 2507 int retval; 2508 struct nameidata nd; 2509 if (IS_ERR(name)) 2510 return PTR_ERR(name); 2511 set_nameidata(&nd, dfd, name, root); 2512 retval = path_lookupat(&nd, flags | LOOKUP_RCU, path); 2513 if (unlikely(retval == -ECHILD)) 2514 retval = path_lookupat(&nd, flags, path); 2515 if (unlikely(retval == -ESTALE)) 2516 retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path); 2517 2518 if (likely(!retval)) 2519 audit_inode(name, path->dentry, 2520 flags & LOOKUP_MOUNTPOINT ? AUDIT_INODE_NOEVAL : 0); 2521 restore_nameidata(); 2522 return retval; 2523 } 2524 2525 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 2526 static int path_parentat(struct nameidata *nd, unsigned flags, 2527 struct path *parent) 2528 { 2529 const char *s = path_init(nd, flags); 2530 int err = link_path_walk(s, nd); 2531 if (!err) 2532 err = complete_walk(nd); 2533 if (!err) { 2534 *parent = nd->path; 2535 nd->path.mnt = NULL; 2536 nd->path.dentry = NULL; 2537 } 2538 terminate_walk(nd); 2539 return err; 2540 } 2541 2542 /* Note: this does not consume "name" */ 2543 static int __filename_parentat(int dfd, struct filename *name, 2544 unsigned int flags, struct path *parent, 2545 struct qstr *last, int *type, 2546 const struct path *root) 2547 { 2548 int retval; 2549 struct nameidata nd; 2550 2551 if (IS_ERR(name)) 2552 return PTR_ERR(name); 2553 set_nameidata(&nd, dfd, name, root); 2554 retval = path_parentat(&nd, flags | LOOKUP_RCU, parent); 2555 if (unlikely(retval == -ECHILD)) 2556 retval = path_parentat(&nd, flags, parent); 2557 if (unlikely(retval == -ESTALE)) 2558 retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent); 2559 if (likely(!retval)) { 2560 *last = nd.last; 2561 *type = nd.last_type; 2562 audit_inode(name, parent->dentry, AUDIT_INODE_PARENT); 2563 } 2564 restore_nameidata(); 2565 return retval; 2566 } 2567 2568 static int filename_parentat(int dfd, struct filename *name, 2569 unsigned int flags, struct path *parent, 2570 struct qstr *last, int *type) 2571 { 2572 return __filename_parentat(dfd, name, flags, parent, last, type, NULL); 2573 } 2574 2575 /* does lookup, returns the object with parent locked */ 2576 static struct dentry *__kern_path_locked(int dfd, struct filename *name, struct path *path) 2577 { 2578 struct dentry *d; 2579 struct qstr last; 2580 int type, error; 2581 2582 error = filename_parentat(dfd, name, 0, path, &last, &type); 2583 if (error) 2584 return ERR_PTR(error); 2585 if (unlikely(type != LAST_NORM)) { 2586 path_put(path); 2587 return ERR_PTR(-EINVAL); 2588 } 2589 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT); 2590 d = lookup_one_qstr_excl(&last, path->dentry, 0); 2591 if (IS_ERR(d)) { 2592 inode_unlock(path->dentry->d_inode); 2593 path_put(path); 2594 } 2595 return d; 2596 } 2597 2598 struct dentry *kern_path_locked(const char *name, struct path *path) 2599 { 2600 struct filename *filename = getname_kernel(name); 2601 struct dentry *res = __kern_path_locked(AT_FDCWD, filename, path); 2602 2603 putname(filename); 2604 return res; 2605 } 2606 2607 struct dentry *user_path_locked_at(int dfd, const char __user *name, struct path *path) 2608 { 2609 struct filename *filename = getname(name); 2610 struct dentry *res = __kern_path_locked(dfd, filename, path); 2611 2612 putname(filename); 2613 return res; 2614 } 2615 EXPORT_SYMBOL(user_path_locked_at); 2616 2617 int kern_path(const char *name, unsigned int flags, struct path *path) 2618 { 2619 struct filename *filename = getname_kernel(name); 2620 int ret = filename_lookup(AT_FDCWD, filename, flags, path, NULL); 2621 2622 putname(filename); 2623 return ret; 2624 2625 } 2626 EXPORT_SYMBOL(kern_path); 2627 2628 /** 2629 * vfs_path_parent_lookup - lookup a parent path relative to a dentry-vfsmount pair 2630 * @filename: filename structure 2631 * @flags: lookup flags 2632 * @parent: pointer to struct path to fill 2633 * @last: last component 2634 * @type: type of the last component 2635 * @root: pointer to struct path of the base directory 2636 */ 2637 int vfs_path_parent_lookup(struct filename *filename, unsigned int flags, 2638 struct path *parent, struct qstr *last, int *type, 2639 const struct path *root) 2640 { 2641 return __filename_parentat(AT_FDCWD, filename, flags, parent, last, 2642 type, root); 2643 } 2644 EXPORT_SYMBOL(vfs_path_parent_lookup); 2645 2646 /** 2647 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair 2648 * @dentry: pointer to dentry of the base directory 2649 * @mnt: pointer to vfs mount of the base directory 2650 * @name: pointer to file name 2651 * @flags: lookup flags 2652 * @path: pointer to struct path to fill 2653 */ 2654 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, 2655 const char *name, unsigned int flags, 2656 struct path *path) 2657 { 2658 struct filename *filename; 2659 struct path root = {.mnt = mnt, .dentry = dentry}; 2660 int ret; 2661 2662 filename = getname_kernel(name); 2663 /* the first argument of filename_lookup() is ignored with root */ 2664 ret = filename_lookup(AT_FDCWD, filename, flags, path, &root); 2665 putname(filename); 2666 return ret; 2667 } 2668 EXPORT_SYMBOL(vfs_path_lookup); 2669 2670 static int lookup_one_common(struct mnt_idmap *idmap, 2671 const char *name, struct dentry *base, int len, 2672 struct qstr *this) 2673 { 2674 this->name = name; 2675 this->len = len; 2676 this->hash = full_name_hash(base, name, len); 2677 if (!len) 2678 return -EACCES; 2679 2680 if (unlikely(name[0] == '.')) { 2681 if (len < 2 || (len == 2 && name[1] == '.')) 2682 return -EACCES; 2683 } 2684 2685 while (len--) { 2686 unsigned int c = *(const unsigned char *)name++; 2687 if (c == '/' || c == '\0') 2688 return -EACCES; 2689 } 2690 /* 2691 * See if the low-level filesystem might want 2692 * to use its own hash.. 2693 */ 2694 if (base->d_flags & DCACHE_OP_HASH) { 2695 int err = base->d_op->d_hash(base, this); 2696 if (err < 0) 2697 return err; 2698 } 2699 2700 return inode_permission(idmap, base->d_inode, MAY_EXEC); 2701 } 2702 2703 /** 2704 * try_lookup_one_len - filesystem helper to lookup single pathname component 2705 * @name: pathname component to lookup 2706 * @base: base directory to lookup from 2707 * @len: maximum length @len should be interpreted to 2708 * 2709 * Look up a dentry by name in the dcache, returning NULL if it does not 2710 * currently exist. The function does not try to create a dentry. 2711 * 2712 * Note that this routine is purely a helper for filesystem usage and should 2713 * not be called by generic code. 2714 * 2715 * The caller must hold base->i_mutex. 2716 */ 2717 struct dentry *try_lookup_one_len(const char *name, struct dentry *base, int len) 2718 { 2719 struct qstr this; 2720 int err; 2721 2722 WARN_ON_ONCE(!inode_is_locked(base->d_inode)); 2723 2724 err = lookup_one_common(&nop_mnt_idmap, name, base, len, &this); 2725 if (err) 2726 return ERR_PTR(err); 2727 2728 return lookup_dcache(&this, base, 0); 2729 } 2730 EXPORT_SYMBOL(try_lookup_one_len); 2731 2732 /** 2733 * lookup_one_len - filesystem helper to lookup single pathname component 2734 * @name: pathname component to lookup 2735 * @base: base directory to lookup from 2736 * @len: maximum length @len should be interpreted to 2737 * 2738 * Note that this routine is purely a helper for filesystem usage and should 2739 * not be called by generic code. 2740 * 2741 * The caller must hold base->i_mutex. 2742 */ 2743 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len) 2744 { 2745 struct dentry *dentry; 2746 struct qstr this; 2747 int err; 2748 2749 WARN_ON_ONCE(!inode_is_locked(base->d_inode)); 2750 2751 err = lookup_one_common(&nop_mnt_idmap, name, base, len, &this); 2752 if (err) 2753 return ERR_PTR(err); 2754 2755 dentry = lookup_dcache(&this, base, 0); 2756 return dentry ? dentry : __lookup_slow(&this, base, 0); 2757 } 2758 EXPORT_SYMBOL(lookup_one_len); 2759 2760 /** 2761 * lookup_one - filesystem helper to lookup single pathname component 2762 * @idmap: idmap of the mount the lookup is performed from 2763 * @name: pathname component to lookup 2764 * @base: base directory to lookup from 2765 * @len: maximum length @len should be interpreted to 2766 * 2767 * Note that this routine is purely a helper for filesystem usage and should 2768 * not be called by generic code. 2769 * 2770 * The caller must hold base->i_mutex. 2771 */ 2772 struct dentry *lookup_one(struct mnt_idmap *idmap, const char *name, 2773 struct dentry *base, int len) 2774 { 2775 struct dentry *dentry; 2776 struct qstr this; 2777 int err; 2778 2779 WARN_ON_ONCE(!inode_is_locked(base->d_inode)); 2780 2781 err = lookup_one_common(idmap, name, base, len, &this); 2782 if (err) 2783 return ERR_PTR(err); 2784 2785 dentry = lookup_dcache(&this, base, 0); 2786 return dentry ? dentry : __lookup_slow(&this, base, 0); 2787 } 2788 EXPORT_SYMBOL(lookup_one); 2789 2790 /** 2791 * lookup_one_unlocked - filesystem helper to lookup single pathname component 2792 * @idmap: idmap of the mount the lookup is performed from 2793 * @name: pathname component to lookup 2794 * @base: base directory to lookup from 2795 * @len: maximum length @len should be interpreted to 2796 * 2797 * Note that this routine is purely a helper for filesystem usage and should 2798 * not be called by generic code. 2799 * 2800 * Unlike lookup_one_len, it should be called without the parent 2801 * i_mutex held, and will take the i_mutex itself if necessary. 2802 */ 2803 struct dentry *lookup_one_unlocked(struct mnt_idmap *idmap, 2804 const char *name, struct dentry *base, 2805 int len) 2806 { 2807 struct qstr this; 2808 int err; 2809 struct dentry *ret; 2810 2811 err = lookup_one_common(idmap, name, base, len, &this); 2812 if (err) 2813 return ERR_PTR(err); 2814 2815 ret = lookup_dcache(&this, base, 0); 2816 if (!ret) 2817 ret = lookup_slow(&this, base, 0); 2818 return ret; 2819 } 2820 EXPORT_SYMBOL(lookup_one_unlocked); 2821 2822 /** 2823 * lookup_one_positive_unlocked - filesystem helper to lookup single 2824 * pathname component 2825 * @idmap: idmap of the mount the lookup is performed from 2826 * @name: pathname component to lookup 2827 * @base: base directory to lookup from 2828 * @len: maximum length @len should be interpreted to 2829 * 2830 * This helper will yield ERR_PTR(-ENOENT) on negatives. The helper returns 2831 * known positive or ERR_PTR(). This is what most of the users want. 2832 * 2833 * Note that pinned negative with unlocked parent _can_ become positive at any 2834 * time, so callers of lookup_one_unlocked() need to be very careful; pinned 2835 * positives have >d_inode stable, so this one avoids such problems. 2836 * 2837 * Note that this routine is purely a helper for filesystem usage and should 2838 * not be called by generic code. 2839 * 2840 * The helper should be called without i_mutex held. 2841 */ 2842 struct dentry *lookup_one_positive_unlocked(struct mnt_idmap *idmap, 2843 const char *name, 2844 struct dentry *base, int len) 2845 { 2846 struct dentry *ret = lookup_one_unlocked(idmap, name, base, len); 2847 2848 if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) { 2849 dput(ret); 2850 ret = ERR_PTR(-ENOENT); 2851 } 2852 return ret; 2853 } 2854 EXPORT_SYMBOL(lookup_one_positive_unlocked); 2855 2856 /** 2857 * lookup_one_len_unlocked - filesystem helper to lookup single pathname component 2858 * @name: pathname component to lookup 2859 * @base: base directory to lookup from 2860 * @len: maximum length @len should be interpreted to 2861 * 2862 * Note that this routine is purely a helper for filesystem usage and should 2863 * not be called by generic code. 2864 * 2865 * Unlike lookup_one_len, it should be called without the parent 2866 * i_mutex held, and will take the i_mutex itself if necessary. 2867 */ 2868 struct dentry *lookup_one_len_unlocked(const char *name, 2869 struct dentry *base, int len) 2870 { 2871 return lookup_one_unlocked(&nop_mnt_idmap, name, base, len); 2872 } 2873 EXPORT_SYMBOL(lookup_one_len_unlocked); 2874 2875 /* 2876 * Like lookup_one_len_unlocked(), except that it yields ERR_PTR(-ENOENT) 2877 * on negatives. Returns known positive or ERR_PTR(); that's what 2878 * most of the users want. Note that pinned negative with unlocked parent 2879 * _can_ become positive at any time, so callers of lookup_one_len_unlocked() 2880 * need to be very careful; pinned positives have ->d_inode stable, so 2881 * this one avoids such problems. 2882 */ 2883 struct dentry *lookup_positive_unlocked(const char *name, 2884 struct dentry *base, int len) 2885 { 2886 return lookup_one_positive_unlocked(&nop_mnt_idmap, name, base, len); 2887 } 2888 EXPORT_SYMBOL(lookup_positive_unlocked); 2889 2890 #ifdef CONFIG_UNIX98_PTYS 2891 int path_pts(struct path *path) 2892 { 2893 /* Find something mounted on "pts" in the same directory as 2894 * the input path. 2895 */ 2896 struct dentry *parent = dget_parent(path->dentry); 2897 struct dentry *child; 2898 struct qstr this = QSTR_INIT("pts", 3); 2899 2900 if (unlikely(!path_connected(path->mnt, parent))) { 2901 dput(parent); 2902 return -ENOENT; 2903 } 2904 dput(path->dentry); 2905 path->dentry = parent; 2906 child = d_hash_and_lookup(parent, &this); 2907 if (IS_ERR_OR_NULL(child)) 2908 return -ENOENT; 2909 2910 path->dentry = child; 2911 dput(parent); 2912 follow_down(path, 0); 2913 return 0; 2914 } 2915 #endif 2916 2917 int user_path_at_empty(int dfd, const char __user *name, unsigned flags, 2918 struct path *path, int *empty) 2919 { 2920 struct filename *filename = getname_flags(name, flags, empty); 2921 int ret = filename_lookup(dfd, filename, flags, path, NULL); 2922 2923 putname(filename); 2924 return ret; 2925 } 2926 EXPORT_SYMBOL(user_path_at_empty); 2927 2928 int __check_sticky(struct mnt_idmap *idmap, struct inode *dir, 2929 struct inode *inode) 2930 { 2931 kuid_t fsuid = current_fsuid(); 2932 2933 if (vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), fsuid)) 2934 return 0; 2935 if (vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, dir), fsuid)) 2936 return 0; 2937 return !capable_wrt_inode_uidgid(idmap, inode, CAP_FOWNER); 2938 } 2939 EXPORT_SYMBOL(__check_sticky); 2940 2941 /* 2942 * Check whether we can remove a link victim from directory dir, check 2943 * whether the type of victim is right. 2944 * 1. We can't do it if dir is read-only (done in permission()) 2945 * 2. We should have write and exec permissions on dir 2946 * 3. We can't remove anything from append-only dir 2947 * 4. We can't do anything with immutable dir (done in permission()) 2948 * 5. If the sticky bit on dir is set we should either 2949 * a. be owner of dir, or 2950 * b. be owner of victim, or 2951 * c. have CAP_FOWNER capability 2952 * 6. If the victim is append-only or immutable we can't do antyhing with 2953 * links pointing to it. 2954 * 7. If the victim has an unknown uid or gid we can't change the inode. 2955 * 8. If we were asked to remove a directory and victim isn't one - ENOTDIR. 2956 * 9. If we were asked to remove a non-directory and victim isn't one - EISDIR. 2957 * 10. We can't remove a root or mountpoint. 2958 * 11. We don't allow removal of NFS sillyrenamed files; it's handled by 2959 * nfs_async_unlink(). 2960 */ 2961 static int may_delete(struct mnt_idmap *idmap, struct inode *dir, 2962 struct dentry *victim, bool isdir) 2963 { 2964 struct inode *inode = d_backing_inode(victim); 2965 int error; 2966 2967 if (d_is_negative(victim)) 2968 return -ENOENT; 2969 BUG_ON(!inode); 2970 2971 BUG_ON(victim->d_parent->d_inode != dir); 2972 2973 /* Inode writeback is not safe when the uid or gid are invalid. */ 2974 if (!vfsuid_valid(i_uid_into_vfsuid(idmap, inode)) || 2975 !vfsgid_valid(i_gid_into_vfsgid(idmap, inode))) 2976 return -EOVERFLOW; 2977 2978 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE); 2979 2980 error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC); 2981 if (error) 2982 return error; 2983 if (IS_APPEND(dir)) 2984 return -EPERM; 2985 2986 if (check_sticky(idmap, dir, inode) || IS_APPEND(inode) || 2987 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) || 2988 HAS_UNMAPPED_ID(idmap, inode)) 2989 return -EPERM; 2990 if (isdir) { 2991 if (!d_is_dir(victim)) 2992 return -ENOTDIR; 2993 if (IS_ROOT(victim)) 2994 return -EBUSY; 2995 } else if (d_is_dir(victim)) 2996 return -EISDIR; 2997 if (IS_DEADDIR(dir)) 2998 return -ENOENT; 2999 if (victim->d_flags & DCACHE_NFSFS_RENAMED) 3000 return -EBUSY; 3001 return 0; 3002 } 3003 3004 /* Check whether we can create an object with dentry child in directory 3005 * dir. 3006 * 1. We can't do it if child already exists (open has special treatment for 3007 * this case, but since we are inlined it's OK) 3008 * 2. We can't do it if dir is read-only (done in permission()) 3009 * 3. We can't do it if the fs can't represent the fsuid or fsgid. 3010 * 4. We should have write and exec permissions on dir 3011 * 5. We can't do it if dir is immutable (done in permission()) 3012 */ 3013 static inline int may_create(struct mnt_idmap *idmap, 3014 struct inode *dir, struct dentry *child) 3015 { 3016 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE); 3017 if (child->d_inode) 3018 return -EEXIST; 3019 if (IS_DEADDIR(dir)) 3020 return -ENOENT; 3021 if (!fsuidgid_has_mapping(dir->i_sb, idmap)) 3022 return -EOVERFLOW; 3023 3024 return inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC); 3025 } 3026 3027 static struct dentry *lock_two_directories(struct dentry *p1, struct dentry *p2) 3028 { 3029 struct dentry *p; 3030 3031 p = d_ancestor(p2, p1); 3032 if (p) { 3033 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); 3034 inode_lock_nested(p1->d_inode, I_MUTEX_CHILD); 3035 return p; 3036 } 3037 3038 p = d_ancestor(p1, p2); 3039 if (p) { 3040 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 3041 inode_lock_nested(p2->d_inode, I_MUTEX_CHILD); 3042 return p; 3043 } 3044 3045 lock_two_inodes(p1->d_inode, p2->d_inode, 3046 I_MUTEX_PARENT, I_MUTEX_PARENT2); 3047 return NULL; 3048 } 3049 3050 /* 3051 * p1 and p2 should be directories on the same fs. 3052 */ 3053 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) 3054 { 3055 if (p1 == p2) { 3056 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 3057 return NULL; 3058 } 3059 3060 mutex_lock(&p1->d_sb->s_vfs_rename_mutex); 3061 return lock_two_directories(p1, p2); 3062 } 3063 EXPORT_SYMBOL(lock_rename); 3064 3065 /* 3066 * c1 and p2 should be on the same fs. 3067 */ 3068 struct dentry *lock_rename_child(struct dentry *c1, struct dentry *p2) 3069 { 3070 if (READ_ONCE(c1->d_parent) == p2) { 3071 /* 3072 * hopefully won't need to touch ->s_vfs_rename_mutex at all. 3073 */ 3074 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); 3075 /* 3076 * now that p2 is locked, nobody can move in or out of it, 3077 * so the test below is safe. 3078 */ 3079 if (likely(c1->d_parent == p2)) 3080 return NULL; 3081 3082 /* 3083 * c1 got moved out of p2 while we'd been taking locks; 3084 * unlock and fall back to slow case. 3085 */ 3086 inode_unlock(p2->d_inode); 3087 } 3088 3089 mutex_lock(&c1->d_sb->s_vfs_rename_mutex); 3090 /* 3091 * nobody can move out of any directories on this fs. 3092 */ 3093 if (likely(c1->d_parent != p2)) 3094 return lock_two_directories(c1->d_parent, p2); 3095 3096 /* 3097 * c1 got moved into p2 while we were taking locks; 3098 * we need p2 locked and ->s_vfs_rename_mutex unlocked, 3099 * for consistency with lock_rename(). 3100 */ 3101 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); 3102 mutex_unlock(&c1->d_sb->s_vfs_rename_mutex); 3103 return NULL; 3104 } 3105 EXPORT_SYMBOL(lock_rename_child); 3106 3107 void unlock_rename(struct dentry *p1, struct dentry *p2) 3108 { 3109 inode_unlock(p1->d_inode); 3110 if (p1 != p2) { 3111 inode_unlock(p2->d_inode); 3112 mutex_unlock(&p1->d_sb->s_vfs_rename_mutex); 3113 } 3114 } 3115 EXPORT_SYMBOL(unlock_rename); 3116 3117 /** 3118 * vfs_prepare_mode - prepare the mode to be used for a new inode 3119 * @idmap: idmap of the mount the inode was found from 3120 * @dir: parent directory of the new inode 3121 * @mode: mode of the new inode 3122 * @mask_perms: allowed permission by the vfs 3123 * @type: type of file to be created 3124 * 3125 * This helper consolidates and enforces vfs restrictions on the @mode of a new 3126 * object to be created. 3127 * 3128 * Umask stripping depends on whether the filesystem supports POSIX ACLs (see 3129 * the kernel documentation for mode_strip_umask()). Moving umask stripping 3130 * after setgid stripping allows the same ordering for both non-POSIX ACL and 3131 * POSIX ACL supporting filesystems. 3132 * 3133 * Note that it's currently valid for @type to be 0 if a directory is created. 3134 * Filesystems raise that flag individually and we need to check whether each 3135 * filesystem can deal with receiving S_IFDIR from the vfs before we enforce a 3136 * non-zero type. 3137 * 3138 * Returns: mode to be passed to the filesystem 3139 */ 3140 static inline umode_t vfs_prepare_mode(struct mnt_idmap *idmap, 3141 const struct inode *dir, umode_t mode, 3142 umode_t mask_perms, umode_t type) 3143 { 3144 mode = mode_strip_sgid(idmap, dir, mode); 3145 mode = mode_strip_umask(dir, mode); 3146 3147 /* 3148 * Apply the vfs mandated allowed permission mask and set the type of 3149 * file to be created before we call into the filesystem. 3150 */ 3151 mode &= (mask_perms & ~S_IFMT); 3152 mode |= (type & S_IFMT); 3153 3154 return mode; 3155 } 3156 3157 /** 3158 * vfs_create - create new file 3159 * @idmap: idmap of the mount the inode was found from 3160 * @dir: inode of @dentry 3161 * @dentry: pointer to dentry of the base directory 3162 * @mode: mode of the new file 3163 * @want_excl: whether the file must not yet exist 3164 * 3165 * Create a new file. 3166 * 3167 * If the inode has been found through an idmapped mount the idmap of 3168 * the vfsmount must be passed through @idmap. This function will then take 3169 * care to map the inode according to @idmap before checking permissions. 3170 * On non-idmapped mounts or if permission checking is to be performed on the 3171 * raw inode simply passs @nop_mnt_idmap. 3172 */ 3173 int vfs_create(struct mnt_idmap *idmap, struct inode *dir, 3174 struct dentry *dentry, umode_t mode, bool want_excl) 3175 { 3176 int error; 3177 3178 error = may_create(idmap, dir, dentry); 3179 if (error) 3180 return error; 3181 3182 if (!dir->i_op->create) 3183 return -EACCES; /* shouldn't it be ENOSYS? */ 3184 3185 mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG); 3186 error = security_inode_create(dir, dentry, mode); 3187 if (error) 3188 return error; 3189 error = dir->i_op->create(idmap, dir, dentry, mode, want_excl); 3190 if (!error) 3191 fsnotify_create(dir, dentry); 3192 return error; 3193 } 3194 EXPORT_SYMBOL(vfs_create); 3195 3196 int vfs_mkobj(struct dentry *dentry, umode_t mode, 3197 int (*f)(struct dentry *, umode_t, void *), 3198 void *arg) 3199 { 3200 struct inode *dir = dentry->d_parent->d_inode; 3201 int error = may_create(&nop_mnt_idmap, dir, dentry); 3202 if (error) 3203 return error; 3204 3205 mode &= S_IALLUGO; 3206 mode |= S_IFREG; 3207 error = security_inode_create(dir, dentry, mode); 3208 if (error) 3209 return error; 3210 error = f(dentry, mode, arg); 3211 if (!error) 3212 fsnotify_create(dir, dentry); 3213 return error; 3214 } 3215 EXPORT_SYMBOL(vfs_mkobj); 3216 3217 bool may_open_dev(const struct path *path) 3218 { 3219 return !(path->mnt->mnt_flags & MNT_NODEV) && 3220 !(path->mnt->mnt_sb->s_iflags & SB_I_NODEV); 3221 } 3222 3223 static int may_open(struct mnt_idmap *idmap, const struct path *path, 3224 int acc_mode, int flag) 3225 { 3226 struct dentry *dentry = path->dentry; 3227 struct inode *inode = dentry->d_inode; 3228 int error; 3229 3230 if (!inode) 3231 return -ENOENT; 3232 3233 switch (inode->i_mode & S_IFMT) { 3234 case S_IFLNK: 3235 return -ELOOP; 3236 case S_IFDIR: 3237 if (acc_mode & MAY_WRITE) 3238 return -EISDIR; 3239 if (acc_mode & MAY_EXEC) 3240 return -EACCES; 3241 break; 3242 case S_IFBLK: 3243 case S_IFCHR: 3244 if (!may_open_dev(path)) 3245 return -EACCES; 3246 fallthrough; 3247 case S_IFIFO: 3248 case S_IFSOCK: 3249 if (acc_mode & MAY_EXEC) 3250 return -EACCES; 3251 flag &= ~O_TRUNC; 3252 break; 3253 case S_IFREG: 3254 if ((acc_mode & MAY_EXEC) && path_noexec(path)) 3255 return -EACCES; 3256 break; 3257 } 3258 3259 error = inode_permission(idmap, inode, MAY_OPEN | acc_mode); 3260 if (error) 3261 return error; 3262 3263 /* 3264 * An append-only file must be opened in append mode for writing. 3265 */ 3266 if (IS_APPEND(inode)) { 3267 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND)) 3268 return -EPERM; 3269 if (flag & O_TRUNC) 3270 return -EPERM; 3271 } 3272 3273 /* O_NOATIME can only be set by the owner or superuser */ 3274 if (flag & O_NOATIME && !inode_owner_or_capable(idmap, inode)) 3275 return -EPERM; 3276 3277 return 0; 3278 } 3279 3280 static int handle_truncate(struct mnt_idmap *idmap, struct file *filp) 3281 { 3282 const struct path *path = &filp->f_path; 3283 struct inode *inode = path->dentry->d_inode; 3284 int error = get_write_access(inode); 3285 if (error) 3286 return error; 3287 3288 error = security_file_truncate(filp); 3289 if (!error) { 3290 error = do_truncate(idmap, path->dentry, 0, 3291 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN, 3292 filp); 3293 } 3294 put_write_access(inode); 3295 return error; 3296 } 3297 3298 static inline int open_to_namei_flags(int flag) 3299 { 3300 if ((flag & O_ACCMODE) == 3) 3301 flag--; 3302 return flag; 3303 } 3304 3305 static int may_o_create(struct mnt_idmap *idmap, 3306 const struct path *dir, struct dentry *dentry, 3307 umode_t mode) 3308 { 3309 int error = security_path_mknod(dir, dentry, mode, 0); 3310 if (error) 3311 return error; 3312 3313 if (!fsuidgid_has_mapping(dir->dentry->d_sb, idmap)) 3314 return -EOVERFLOW; 3315 3316 error = inode_permission(idmap, dir->dentry->d_inode, 3317 MAY_WRITE | MAY_EXEC); 3318 if (error) 3319 return error; 3320 3321 return security_inode_create(dir->dentry->d_inode, dentry, mode); 3322 } 3323 3324 /* 3325 * Attempt to atomically look up, create and open a file from a negative 3326 * dentry. 3327 * 3328 * Returns 0 if successful. The file will have been created and attached to 3329 * @file by the filesystem calling finish_open(). 3330 * 3331 * If the file was looked up only or didn't need creating, FMODE_OPENED won't 3332 * be set. The caller will need to perform the open themselves. @path will 3333 * have been updated to point to the new dentry. This may be negative. 3334 * 3335 * Returns an error code otherwise. 3336 */ 3337 static struct dentry *atomic_open(struct nameidata *nd, struct dentry *dentry, 3338 struct file *file, 3339 int open_flag, umode_t mode) 3340 { 3341 struct dentry *const DENTRY_NOT_SET = (void *) -1UL; 3342 struct inode *dir = nd->path.dentry->d_inode; 3343 int error; 3344 3345 if (nd->flags & LOOKUP_DIRECTORY) 3346 open_flag |= O_DIRECTORY; 3347 3348 file->f_path.dentry = DENTRY_NOT_SET; 3349 file->f_path.mnt = nd->path.mnt; 3350 error = dir->i_op->atomic_open(dir, dentry, file, 3351 open_to_namei_flags(open_flag), mode); 3352 d_lookup_done(dentry); 3353 if (!error) { 3354 if (file->f_mode & FMODE_OPENED) { 3355 if (unlikely(dentry != file->f_path.dentry)) { 3356 dput(dentry); 3357 dentry = dget(file->f_path.dentry); 3358 } 3359 } else if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) { 3360 error = -EIO; 3361 } else { 3362 if (file->f_path.dentry) { 3363 dput(dentry); 3364 dentry = file->f_path.dentry; 3365 } 3366 if (unlikely(d_is_negative(dentry))) 3367 error = -ENOENT; 3368 } 3369 } 3370 if (error) { 3371 dput(dentry); 3372 dentry = ERR_PTR(error); 3373 } 3374 return dentry; 3375 } 3376 3377 /* 3378 * Look up and maybe create and open the last component. 3379 * 3380 * Must be called with parent locked (exclusive in O_CREAT case). 3381 * 3382 * Returns 0 on success, that is, if 3383 * the file was successfully atomically created (if necessary) and opened, or 3384 * the file was not completely opened at this time, though lookups and 3385 * creations were performed. 3386 * These case are distinguished by presence of FMODE_OPENED on file->f_mode. 3387 * In the latter case dentry returned in @path might be negative if O_CREAT 3388 * hadn't been specified. 3389 * 3390 * An error code is returned on failure. 3391 */ 3392 static struct dentry *lookup_open(struct nameidata *nd, struct file *file, 3393 const struct open_flags *op, 3394 bool got_write) 3395 { 3396 struct mnt_idmap *idmap; 3397 struct dentry *dir = nd->path.dentry; 3398 struct inode *dir_inode = dir->d_inode; 3399 int open_flag = op->open_flag; 3400 struct dentry *dentry; 3401 int error, create_error = 0; 3402 umode_t mode = op->mode; 3403 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq); 3404 3405 if (unlikely(IS_DEADDIR(dir_inode))) 3406 return ERR_PTR(-ENOENT); 3407 3408 file->f_mode &= ~FMODE_CREATED; 3409 dentry = d_lookup(dir, &nd->last); 3410 for (;;) { 3411 if (!dentry) { 3412 dentry = d_alloc_parallel(dir, &nd->last, &wq); 3413 if (IS_ERR(dentry)) 3414 return dentry; 3415 } 3416 if (d_in_lookup(dentry)) 3417 break; 3418 3419 error = d_revalidate(dentry, nd->flags); 3420 if (likely(error > 0)) 3421 break; 3422 if (error) 3423 goto out_dput; 3424 d_invalidate(dentry); 3425 dput(dentry); 3426 dentry = NULL; 3427 } 3428 if (dentry->d_inode) { 3429 /* Cached positive dentry: will open in f_op->open */ 3430 return dentry; 3431 } 3432 3433 /* 3434 * Checking write permission is tricky, bacuse we don't know if we are 3435 * going to actually need it: O_CREAT opens should work as long as the 3436 * file exists. But checking existence breaks atomicity. The trick is 3437 * to check access and if not granted clear O_CREAT from the flags. 3438 * 3439 * Another problem is returing the "right" error value (e.g. for an 3440 * O_EXCL open we want to return EEXIST not EROFS). 3441 */ 3442 if (unlikely(!got_write)) 3443 open_flag &= ~O_TRUNC; 3444 idmap = mnt_idmap(nd->path.mnt); 3445 if (open_flag & O_CREAT) { 3446 if (open_flag & O_EXCL) 3447 open_flag &= ~O_TRUNC; 3448 mode = vfs_prepare_mode(idmap, dir->d_inode, mode, mode, mode); 3449 if (likely(got_write)) 3450 create_error = may_o_create(idmap, &nd->path, 3451 dentry, mode); 3452 else 3453 create_error = -EROFS; 3454 } 3455 if (create_error) 3456 open_flag &= ~O_CREAT; 3457 if (dir_inode->i_op->atomic_open) { 3458 dentry = atomic_open(nd, dentry, file, open_flag, mode); 3459 if (unlikely(create_error) && dentry == ERR_PTR(-ENOENT)) 3460 dentry = ERR_PTR(create_error); 3461 return dentry; 3462 } 3463 3464 if (d_in_lookup(dentry)) { 3465 struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry, 3466 nd->flags); 3467 d_lookup_done(dentry); 3468 if (unlikely(res)) { 3469 if (IS_ERR(res)) { 3470 error = PTR_ERR(res); 3471 goto out_dput; 3472 } 3473 dput(dentry); 3474 dentry = res; 3475 } 3476 } 3477 3478 /* Negative dentry, just create the file */ 3479 if (!dentry->d_inode && (open_flag & O_CREAT)) { 3480 file->f_mode |= FMODE_CREATED; 3481 audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE); 3482 if (!dir_inode->i_op->create) { 3483 error = -EACCES; 3484 goto out_dput; 3485 } 3486 3487 error = dir_inode->i_op->create(idmap, dir_inode, dentry, 3488 mode, open_flag & O_EXCL); 3489 if (error) 3490 goto out_dput; 3491 } 3492 if (unlikely(create_error) && !dentry->d_inode) { 3493 error = create_error; 3494 goto out_dput; 3495 } 3496 return dentry; 3497 3498 out_dput: 3499 dput(dentry); 3500 return ERR_PTR(error); 3501 } 3502 3503 static const char *open_last_lookups(struct nameidata *nd, 3504 struct file *file, const struct open_flags *op) 3505 { 3506 struct dentry *dir = nd->path.dentry; 3507 int open_flag = op->open_flag; 3508 bool got_write = false; 3509 struct dentry *dentry; 3510 const char *res; 3511 3512 nd->flags |= op->intent; 3513 3514 if (nd->last_type != LAST_NORM) { 3515 if (nd->depth) 3516 put_link(nd); 3517 return handle_dots(nd, nd->last_type); 3518 } 3519 3520 if (!(open_flag & O_CREAT)) { 3521 if (nd->last.name[nd->last.len]) 3522 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 3523 /* we _can_ be in RCU mode here */ 3524 dentry = lookup_fast(nd); 3525 if (IS_ERR(dentry)) 3526 return ERR_CAST(dentry); 3527 if (likely(dentry)) 3528 goto finish_lookup; 3529 3530 if (WARN_ON_ONCE(nd->flags & LOOKUP_RCU)) 3531 return ERR_PTR(-ECHILD); 3532 } else { 3533 /* create side of things */ 3534 if (nd->flags & LOOKUP_RCU) { 3535 if (!try_to_unlazy(nd)) 3536 return ERR_PTR(-ECHILD); 3537 } 3538 audit_inode(nd->name, dir, AUDIT_INODE_PARENT); 3539 /* trailing slashes? */ 3540 if (unlikely(nd->last.name[nd->last.len])) 3541 return ERR_PTR(-EISDIR); 3542 } 3543 3544 if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) { 3545 got_write = !mnt_want_write(nd->path.mnt); 3546 /* 3547 * do _not_ fail yet - we might not need that or fail with 3548 * a different error; let lookup_open() decide; we'll be 3549 * dropping this one anyway. 3550 */ 3551 } 3552 if (open_flag & O_CREAT) 3553 inode_lock(dir->d_inode); 3554 else 3555 inode_lock_shared(dir->d_inode); 3556 dentry = lookup_open(nd, file, op, got_write); 3557 if (!IS_ERR(dentry) && (file->f_mode & FMODE_CREATED)) 3558 fsnotify_create(dir->d_inode, dentry); 3559 if (open_flag & O_CREAT) 3560 inode_unlock(dir->d_inode); 3561 else 3562 inode_unlock_shared(dir->d_inode); 3563 3564 if (got_write) 3565 mnt_drop_write(nd->path.mnt); 3566 3567 if (IS_ERR(dentry)) 3568 return ERR_CAST(dentry); 3569 3570 if (file->f_mode & (FMODE_OPENED | FMODE_CREATED)) { 3571 dput(nd->path.dentry); 3572 nd->path.dentry = dentry; 3573 return NULL; 3574 } 3575 3576 finish_lookup: 3577 if (nd->depth) 3578 put_link(nd); 3579 res = step_into(nd, WALK_TRAILING, dentry); 3580 if (unlikely(res)) 3581 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL); 3582 return res; 3583 } 3584 3585 /* 3586 * Handle the last step of open() 3587 */ 3588 static int do_open(struct nameidata *nd, 3589 struct file *file, const struct open_flags *op) 3590 { 3591 struct mnt_idmap *idmap; 3592 int open_flag = op->open_flag; 3593 bool do_truncate; 3594 int acc_mode; 3595 int error; 3596 3597 if (!(file->f_mode & (FMODE_OPENED | FMODE_CREATED))) { 3598 error = complete_walk(nd); 3599 if (error) 3600 return error; 3601 } 3602 if (!(file->f_mode & FMODE_CREATED)) 3603 audit_inode(nd->name, nd->path.dentry, 0); 3604 idmap = mnt_idmap(nd->path.mnt); 3605 if (open_flag & O_CREAT) { 3606 if ((open_flag & O_EXCL) && !(file->f_mode & FMODE_CREATED)) 3607 return -EEXIST; 3608 if (d_is_dir(nd->path.dentry)) 3609 return -EISDIR; 3610 error = may_create_in_sticky(idmap, nd, 3611 d_backing_inode(nd->path.dentry)); 3612 if (unlikely(error)) 3613 return error; 3614 } 3615 if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry)) 3616 return -ENOTDIR; 3617 3618 do_truncate = false; 3619 acc_mode = op->acc_mode; 3620 if (file->f_mode & FMODE_CREATED) { 3621 /* Don't check for write permission, don't truncate */ 3622 open_flag &= ~O_TRUNC; 3623 acc_mode = 0; 3624 } else if (d_is_reg(nd->path.dentry) && open_flag & O_TRUNC) { 3625 error = mnt_want_write(nd->path.mnt); 3626 if (error) 3627 return error; 3628 do_truncate = true; 3629 } 3630 error = may_open(idmap, &nd->path, acc_mode, open_flag); 3631 if (!error && !(file->f_mode & FMODE_OPENED)) 3632 error = vfs_open(&nd->path, file); 3633 if (!error) 3634 error = ima_file_check(file, op->acc_mode); 3635 if (!error && do_truncate) 3636 error = handle_truncate(idmap, file); 3637 if (unlikely(error > 0)) { 3638 WARN_ON(1); 3639 error = -EINVAL; 3640 } 3641 if (do_truncate) 3642 mnt_drop_write(nd->path.mnt); 3643 return error; 3644 } 3645 3646 /** 3647 * vfs_tmpfile - create tmpfile 3648 * @idmap: idmap of the mount the inode was found from 3649 * @parentpath: pointer to the path of the base directory 3650 * @file: file descriptor of the new tmpfile 3651 * @mode: mode of the new tmpfile 3652 * 3653 * Create a temporary file. 3654 * 3655 * If the inode has been found through an idmapped mount the idmap of 3656 * the vfsmount must be passed through @idmap. This function will then take 3657 * care to map the inode according to @idmap before checking permissions. 3658 * On non-idmapped mounts or if permission checking is to be performed on the 3659 * raw inode simply passs @nop_mnt_idmap. 3660 */ 3661 static int vfs_tmpfile(struct mnt_idmap *idmap, 3662 const struct path *parentpath, 3663 struct file *file, umode_t mode) 3664 { 3665 struct dentry *child; 3666 struct inode *dir = d_inode(parentpath->dentry); 3667 struct inode *inode; 3668 int error; 3669 int open_flag = file->f_flags; 3670 3671 /* we want directory to be writable */ 3672 error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC); 3673 if (error) 3674 return error; 3675 if (!dir->i_op->tmpfile) 3676 return -EOPNOTSUPP; 3677 child = d_alloc(parentpath->dentry, &slash_name); 3678 if (unlikely(!child)) 3679 return -ENOMEM; 3680 file->f_path.mnt = parentpath->mnt; 3681 file->f_path.dentry = child; 3682 mode = vfs_prepare_mode(idmap, dir, mode, mode, mode); 3683 error = dir->i_op->tmpfile(idmap, dir, file, mode); 3684 dput(child); 3685 if (error) 3686 return error; 3687 /* Don't check for other permissions, the inode was just created */ 3688 error = may_open(idmap, &file->f_path, 0, file->f_flags); 3689 if (error) 3690 return error; 3691 inode = file_inode(file); 3692 if (!(open_flag & O_EXCL)) { 3693 spin_lock(&inode->i_lock); 3694 inode->i_state |= I_LINKABLE; 3695 spin_unlock(&inode->i_lock); 3696 } 3697 ima_post_create_tmpfile(idmap, inode); 3698 return 0; 3699 } 3700 3701 /** 3702 * kernel_tmpfile_open - open a tmpfile for kernel internal use 3703 * @idmap: idmap of the mount the inode was found from 3704 * @parentpath: path of the base directory 3705 * @mode: mode of the new tmpfile 3706 * @open_flag: flags 3707 * @cred: credentials for open 3708 * 3709 * Create and open a temporary file. The file is not accounted in nr_files, 3710 * hence this is only for kernel internal use, and must not be installed into 3711 * file tables or such. 3712 */ 3713 struct file *kernel_tmpfile_open(struct mnt_idmap *idmap, 3714 const struct path *parentpath, 3715 umode_t mode, int open_flag, 3716 const struct cred *cred) 3717 { 3718 struct file *file; 3719 int error; 3720 3721 file = alloc_empty_file_noaccount(open_flag, cred); 3722 if (IS_ERR(file)) 3723 return file; 3724 3725 error = vfs_tmpfile(idmap, parentpath, file, mode); 3726 if (error) { 3727 fput(file); 3728 file = ERR_PTR(error); 3729 } 3730 return file; 3731 } 3732 EXPORT_SYMBOL(kernel_tmpfile_open); 3733 3734 static int do_tmpfile(struct nameidata *nd, unsigned flags, 3735 const struct open_flags *op, 3736 struct file *file) 3737 { 3738 struct path path; 3739 int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path); 3740 3741 if (unlikely(error)) 3742 return error; 3743 error = mnt_want_write(path.mnt); 3744 if (unlikely(error)) 3745 goto out; 3746 error = vfs_tmpfile(mnt_idmap(path.mnt), &path, file, op->mode); 3747 if (error) 3748 goto out2; 3749 audit_inode(nd->name, file->f_path.dentry, 0); 3750 out2: 3751 mnt_drop_write(path.mnt); 3752 out: 3753 path_put(&path); 3754 return error; 3755 } 3756 3757 static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file) 3758 { 3759 struct path path; 3760 int error = path_lookupat(nd, flags, &path); 3761 if (!error) { 3762 audit_inode(nd->name, path.dentry, 0); 3763 error = vfs_open(&path, file); 3764 path_put(&path); 3765 } 3766 return error; 3767 } 3768 3769 static struct file *path_openat(struct nameidata *nd, 3770 const struct open_flags *op, unsigned flags) 3771 { 3772 struct file *file; 3773 int error; 3774 3775 file = alloc_empty_file(op->open_flag, current_cred()); 3776 if (IS_ERR(file)) 3777 return file; 3778 3779 if (unlikely(file->f_flags & __O_TMPFILE)) { 3780 error = do_tmpfile(nd, flags, op, file); 3781 } else if (unlikely(file->f_flags & O_PATH)) { 3782 error = do_o_path(nd, flags, file); 3783 } else { 3784 const char *s = path_init(nd, flags); 3785 while (!(error = link_path_walk(s, nd)) && 3786 (s = open_last_lookups(nd, file, op)) != NULL) 3787 ; 3788 if (!error) 3789 error = do_open(nd, file, op); 3790 terminate_walk(nd); 3791 } 3792 if (likely(!error)) { 3793 if (likely(file->f_mode & FMODE_OPENED)) 3794 return file; 3795 WARN_ON(1); 3796 error = -EINVAL; 3797 } 3798 if (unlikely(file->f_mode & FMODE_OPENED)) 3799 fput(file); 3800 else 3801 release_empty_file(file); 3802 if (error == -EOPENSTALE) { 3803 if (flags & LOOKUP_RCU) 3804 error = -ECHILD; 3805 else 3806 error = -ESTALE; 3807 } 3808 return ERR_PTR(error); 3809 } 3810 3811 struct file *do_filp_open(int dfd, struct filename *pathname, 3812 const struct open_flags *op) 3813 { 3814 struct nameidata nd; 3815 int flags = op->lookup_flags; 3816 struct file *filp; 3817 3818 set_nameidata(&nd, dfd, pathname, NULL); 3819 filp = path_openat(&nd, op, flags | LOOKUP_RCU); 3820 if (unlikely(filp == ERR_PTR(-ECHILD))) 3821 filp = path_openat(&nd, op, flags); 3822 if (unlikely(filp == ERR_PTR(-ESTALE))) 3823 filp = path_openat(&nd, op, flags | LOOKUP_REVAL); 3824 restore_nameidata(); 3825 return filp; 3826 } 3827 3828 struct file *do_file_open_root(const struct path *root, 3829 const char *name, const struct open_flags *op) 3830 { 3831 struct nameidata nd; 3832 struct file *file; 3833 struct filename *filename; 3834 int flags = op->lookup_flags; 3835 3836 if (d_is_symlink(root->dentry) && op->intent & LOOKUP_OPEN) 3837 return ERR_PTR(-ELOOP); 3838 3839 filename = getname_kernel(name); 3840 if (IS_ERR(filename)) 3841 return ERR_CAST(filename); 3842 3843 set_nameidata(&nd, -1, filename, root); 3844 file = path_openat(&nd, op, flags | LOOKUP_RCU); 3845 if (unlikely(file == ERR_PTR(-ECHILD))) 3846 file = path_openat(&nd, op, flags); 3847 if (unlikely(file == ERR_PTR(-ESTALE))) 3848 file = path_openat(&nd, op, flags | LOOKUP_REVAL); 3849 restore_nameidata(); 3850 putname(filename); 3851 return file; 3852 } 3853 3854 static struct dentry *filename_create(int dfd, struct filename *name, 3855 struct path *path, unsigned int lookup_flags) 3856 { 3857 struct dentry *dentry = ERR_PTR(-EEXIST); 3858 struct qstr last; 3859 bool want_dir = lookup_flags & LOOKUP_DIRECTORY; 3860 unsigned int reval_flag = lookup_flags & LOOKUP_REVAL; 3861 unsigned int create_flags = LOOKUP_CREATE | LOOKUP_EXCL; 3862 int type; 3863 int err2; 3864 int error; 3865 3866 error = filename_parentat(dfd, name, reval_flag, path, &last, &type); 3867 if (error) 3868 return ERR_PTR(error); 3869 3870 /* 3871 * Yucky last component or no last component at all? 3872 * (foo/., foo/.., /////) 3873 */ 3874 if (unlikely(type != LAST_NORM)) 3875 goto out; 3876 3877 /* don't fail immediately if it's r/o, at least try to report other errors */ 3878 err2 = mnt_want_write(path->mnt); 3879 /* 3880 * Do the final lookup. Suppress 'create' if there is a trailing 3881 * '/', and a directory wasn't requested. 3882 */ 3883 if (last.name[last.len] && !want_dir) 3884 create_flags = 0; 3885 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT); 3886 dentry = lookup_one_qstr_excl(&last, path->dentry, 3887 reval_flag | create_flags); 3888 if (IS_ERR(dentry)) 3889 goto unlock; 3890 3891 error = -EEXIST; 3892 if (d_is_positive(dentry)) 3893 goto fail; 3894 3895 /* 3896 * Special case - lookup gave negative, but... we had foo/bar/ 3897 * From the vfs_mknod() POV we just have a negative dentry - 3898 * all is fine. Let's be bastards - you had / on the end, you've 3899 * been asking for (non-existent) directory. -ENOENT for you. 3900 */ 3901 if (unlikely(!create_flags)) { 3902 error = -ENOENT; 3903 goto fail; 3904 } 3905 if (unlikely(err2)) { 3906 error = err2; 3907 goto fail; 3908 } 3909 return dentry; 3910 fail: 3911 dput(dentry); 3912 dentry = ERR_PTR(error); 3913 unlock: 3914 inode_unlock(path->dentry->d_inode); 3915 if (!err2) 3916 mnt_drop_write(path->mnt); 3917 out: 3918 path_put(path); 3919 return dentry; 3920 } 3921 3922 struct dentry *kern_path_create(int dfd, const char *pathname, 3923 struct path *path, unsigned int lookup_flags) 3924 { 3925 struct filename *filename = getname_kernel(pathname); 3926 struct dentry *res = filename_create(dfd, filename, path, lookup_flags); 3927 3928 putname(filename); 3929 return res; 3930 } 3931 EXPORT_SYMBOL(kern_path_create); 3932 3933 void done_path_create(struct path *path, struct dentry *dentry) 3934 { 3935 dput(dentry); 3936 inode_unlock(path->dentry->d_inode); 3937 mnt_drop_write(path->mnt); 3938 path_put(path); 3939 } 3940 EXPORT_SYMBOL(done_path_create); 3941 3942 inline struct dentry *user_path_create(int dfd, const char __user *pathname, 3943 struct path *path, unsigned int lookup_flags) 3944 { 3945 struct filename *filename = getname(pathname); 3946 struct dentry *res = filename_create(dfd, filename, path, lookup_flags); 3947 3948 putname(filename); 3949 return res; 3950 } 3951 EXPORT_SYMBOL(user_path_create); 3952 3953 /** 3954 * vfs_mknod - create device node or file 3955 * @idmap: idmap of the mount the inode was found from 3956 * @dir: inode of @dentry 3957 * @dentry: pointer to dentry of the base directory 3958 * @mode: mode of the new device node or file 3959 * @dev: device number of device to create 3960 * 3961 * Create a device node or file. 3962 * 3963 * If the inode has been found through an idmapped mount the idmap of 3964 * the vfsmount must be passed through @idmap. This function will then take 3965 * care to map the inode according to @idmap before checking permissions. 3966 * On non-idmapped mounts or if permission checking is to be performed on the 3967 * raw inode simply passs @nop_mnt_idmap. 3968 */ 3969 int vfs_mknod(struct mnt_idmap *idmap, struct inode *dir, 3970 struct dentry *dentry, umode_t mode, dev_t dev) 3971 { 3972 bool is_whiteout = S_ISCHR(mode) && dev == WHITEOUT_DEV; 3973 int error = may_create(idmap, dir, dentry); 3974 3975 if (error) 3976 return error; 3977 3978 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !is_whiteout && 3979 !capable(CAP_MKNOD)) 3980 return -EPERM; 3981 3982 if (!dir->i_op->mknod) 3983 return -EPERM; 3984 3985 mode = vfs_prepare_mode(idmap, dir, mode, mode, mode); 3986 error = devcgroup_inode_mknod(mode, dev); 3987 if (error) 3988 return error; 3989 3990 error = security_inode_mknod(dir, dentry, mode, dev); 3991 if (error) 3992 return error; 3993 3994 error = dir->i_op->mknod(idmap, dir, dentry, mode, dev); 3995 if (!error) 3996 fsnotify_create(dir, dentry); 3997 return error; 3998 } 3999 EXPORT_SYMBOL(vfs_mknod); 4000 4001 static int may_mknod(umode_t mode) 4002 { 4003 switch (mode & S_IFMT) { 4004 case S_IFREG: 4005 case S_IFCHR: 4006 case S_IFBLK: 4007 case S_IFIFO: 4008 case S_IFSOCK: 4009 case 0: /* zero mode translates to S_IFREG */ 4010 return 0; 4011 case S_IFDIR: 4012 return -EPERM; 4013 default: 4014 return -EINVAL; 4015 } 4016 } 4017 4018 static int do_mknodat(int dfd, struct filename *name, umode_t mode, 4019 unsigned int dev) 4020 { 4021 struct mnt_idmap *idmap; 4022 struct dentry *dentry; 4023 struct path path; 4024 int error; 4025 unsigned int lookup_flags = 0; 4026 4027 error = may_mknod(mode); 4028 if (error) 4029 goto out1; 4030 retry: 4031 dentry = filename_create(dfd, name, &path, lookup_flags); 4032 error = PTR_ERR(dentry); 4033 if (IS_ERR(dentry)) 4034 goto out1; 4035 4036 error = security_path_mknod(&path, dentry, 4037 mode_strip_umask(path.dentry->d_inode, mode), dev); 4038 if (error) 4039 goto out2; 4040 4041 idmap = mnt_idmap(path.mnt); 4042 switch (mode & S_IFMT) { 4043 case 0: case S_IFREG: 4044 error = vfs_create(idmap, path.dentry->d_inode, 4045 dentry, mode, true); 4046 if (!error) 4047 ima_post_path_mknod(idmap, dentry); 4048 break; 4049 case S_IFCHR: case S_IFBLK: 4050 error = vfs_mknod(idmap, path.dentry->d_inode, 4051 dentry, mode, new_decode_dev(dev)); 4052 break; 4053 case S_IFIFO: case S_IFSOCK: 4054 error = vfs_mknod(idmap, path.dentry->d_inode, 4055 dentry, mode, 0); 4056 break; 4057 } 4058 out2: 4059 done_path_create(&path, dentry); 4060 if (retry_estale(error, lookup_flags)) { 4061 lookup_flags |= LOOKUP_REVAL; 4062 goto retry; 4063 } 4064 out1: 4065 putname(name); 4066 return error; 4067 } 4068 4069 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, 4070 unsigned int, dev) 4071 { 4072 return do_mknodat(dfd, getname(filename), mode, dev); 4073 } 4074 4075 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev) 4076 { 4077 return do_mknodat(AT_FDCWD, getname(filename), mode, dev); 4078 } 4079 4080 /** 4081 * vfs_mkdir - create directory 4082 * @idmap: idmap of the mount the inode was found from 4083 * @dir: inode of @dentry 4084 * @dentry: pointer to dentry of the base directory 4085 * @mode: mode of the new directory 4086 * 4087 * Create a directory. 4088 * 4089 * If the inode has been found through an idmapped mount the idmap of 4090 * the vfsmount must be passed through @idmap. This function will then take 4091 * care to map the inode according to @idmap before checking permissions. 4092 * On non-idmapped mounts or if permission checking is to be performed on the 4093 * raw inode simply passs @nop_mnt_idmap. 4094 */ 4095 int vfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, 4096 struct dentry *dentry, umode_t mode) 4097 { 4098 int error; 4099 unsigned max_links = dir->i_sb->s_max_links; 4100 4101 error = may_create(idmap, dir, dentry); 4102 if (error) 4103 return error; 4104 4105 if (!dir->i_op->mkdir) 4106 return -EPERM; 4107 4108 mode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO | S_ISVTX, 0); 4109 error = security_inode_mkdir(dir, dentry, mode); 4110 if (error) 4111 return error; 4112 4113 if (max_links && dir->i_nlink >= max_links) 4114 return -EMLINK; 4115 4116 error = dir->i_op->mkdir(idmap, dir, dentry, mode); 4117 if (!error) 4118 fsnotify_mkdir(dir, dentry); 4119 return error; 4120 } 4121 EXPORT_SYMBOL(vfs_mkdir); 4122 4123 int do_mkdirat(int dfd, struct filename *name, umode_t mode) 4124 { 4125 struct dentry *dentry; 4126 struct path path; 4127 int error; 4128 unsigned int lookup_flags = LOOKUP_DIRECTORY; 4129 4130 retry: 4131 dentry = filename_create(dfd, name, &path, lookup_flags); 4132 error = PTR_ERR(dentry); 4133 if (IS_ERR(dentry)) 4134 goto out_putname; 4135 4136 error = security_path_mkdir(&path, dentry, 4137 mode_strip_umask(path.dentry->d_inode, mode)); 4138 if (!error) { 4139 error = vfs_mkdir(mnt_idmap(path.mnt), path.dentry->d_inode, 4140 dentry, mode); 4141 } 4142 done_path_create(&path, dentry); 4143 if (retry_estale(error, lookup_flags)) { 4144 lookup_flags |= LOOKUP_REVAL; 4145 goto retry; 4146 } 4147 out_putname: 4148 putname(name); 4149 return error; 4150 } 4151 4152 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) 4153 { 4154 return do_mkdirat(dfd, getname(pathname), mode); 4155 } 4156 4157 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode) 4158 { 4159 return do_mkdirat(AT_FDCWD, getname(pathname), mode); 4160 } 4161 4162 /** 4163 * vfs_rmdir - remove directory 4164 * @idmap: idmap of the mount the inode was found from 4165 * @dir: inode of @dentry 4166 * @dentry: pointer to dentry of the base directory 4167 * 4168 * Remove a directory. 4169 * 4170 * If the inode has been found through an idmapped mount the idmap of 4171 * the vfsmount must be passed through @idmap. This function will then take 4172 * care to map the inode according to @idmap before checking permissions. 4173 * On non-idmapped mounts or if permission checking is to be performed on the 4174 * raw inode simply passs @nop_mnt_idmap. 4175 */ 4176 int vfs_rmdir(struct mnt_idmap *idmap, struct inode *dir, 4177 struct dentry *dentry) 4178 { 4179 int error = may_delete(idmap, dir, dentry, 1); 4180 4181 if (error) 4182 return error; 4183 4184 if (!dir->i_op->rmdir) 4185 return -EPERM; 4186 4187 dget(dentry); 4188 inode_lock(dentry->d_inode); 4189 4190 error = -EBUSY; 4191 if (is_local_mountpoint(dentry) || 4192 (dentry->d_inode->i_flags & S_KERNEL_FILE)) 4193 goto out; 4194 4195 error = security_inode_rmdir(dir, dentry); 4196 if (error) 4197 goto out; 4198 4199 error = dir->i_op->rmdir(dir, dentry); 4200 if (error) 4201 goto out; 4202 4203 shrink_dcache_parent(dentry); 4204 dentry->d_inode->i_flags |= S_DEAD; 4205 dont_mount(dentry); 4206 detach_mounts(dentry); 4207 4208 out: 4209 inode_unlock(dentry->d_inode); 4210 dput(dentry); 4211 if (!error) 4212 d_delete_notify(dir, dentry); 4213 return error; 4214 } 4215 EXPORT_SYMBOL(vfs_rmdir); 4216 4217 int do_rmdir(int dfd, struct filename *name) 4218 { 4219 int error; 4220 struct dentry *dentry; 4221 struct path path; 4222 struct qstr last; 4223 int type; 4224 unsigned int lookup_flags = 0; 4225 retry: 4226 error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type); 4227 if (error) 4228 goto exit1; 4229 4230 switch (type) { 4231 case LAST_DOTDOT: 4232 error = -ENOTEMPTY; 4233 goto exit2; 4234 case LAST_DOT: 4235 error = -EINVAL; 4236 goto exit2; 4237 case LAST_ROOT: 4238 error = -EBUSY; 4239 goto exit2; 4240 } 4241 4242 error = mnt_want_write(path.mnt); 4243 if (error) 4244 goto exit2; 4245 4246 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT); 4247 dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags); 4248 error = PTR_ERR(dentry); 4249 if (IS_ERR(dentry)) 4250 goto exit3; 4251 if (!dentry->d_inode) { 4252 error = -ENOENT; 4253 goto exit4; 4254 } 4255 error = security_path_rmdir(&path, dentry); 4256 if (error) 4257 goto exit4; 4258 error = vfs_rmdir(mnt_idmap(path.mnt), path.dentry->d_inode, dentry); 4259 exit4: 4260 dput(dentry); 4261 exit3: 4262 inode_unlock(path.dentry->d_inode); 4263 mnt_drop_write(path.mnt); 4264 exit2: 4265 path_put(&path); 4266 if (retry_estale(error, lookup_flags)) { 4267 lookup_flags |= LOOKUP_REVAL; 4268 goto retry; 4269 } 4270 exit1: 4271 putname(name); 4272 return error; 4273 } 4274 4275 SYSCALL_DEFINE1(rmdir, const char __user *, pathname) 4276 { 4277 return do_rmdir(AT_FDCWD, getname(pathname)); 4278 } 4279 4280 /** 4281 * vfs_unlink - unlink a filesystem object 4282 * @idmap: idmap of the mount the inode was found from 4283 * @dir: parent directory 4284 * @dentry: victim 4285 * @delegated_inode: returns victim inode, if the inode is delegated. 4286 * 4287 * The caller must hold dir->i_mutex. 4288 * 4289 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and 4290 * return a reference to the inode in delegated_inode. The caller 4291 * should then break the delegation on that inode and retry. Because 4292 * breaking a delegation may take a long time, the caller should drop 4293 * dir->i_mutex before doing so. 4294 * 4295 * Alternatively, a caller may pass NULL for delegated_inode. This may 4296 * be appropriate for callers that expect the underlying filesystem not 4297 * to be NFS exported. 4298 * 4299 * If the inode has been found through an idmapped mount the idmap of 4300 * the vfsmount must be passed through @idmap. This function will then take 4301 * care to map the inode according to @idmap before checking permissions. 4302 * On non-idmapped mounts or if permission checking is to be performed on the 4303 * raw inode simply passs @nop_mnt_idmap. 4304 */ 4305 int vfs_unlink(struct mnt_idmap *idmap, struct inode *dir, 4306 struct dentry *dentry, struct inode **delegated_inode) 4307 { 4308 struct inode *target = dentry->d_inode; 4309 int error = may_delete(idmap, dir, dentry, 0); 4310 4311 if (error) 4312 return error; 4313 4314 if (!dir->i_op->unlink) 4315 return -EPERM; 4316 4317 inode_lock(target); 4318 if (IS_SWAPFILE(target)) 4319 error = -EPERM; 4320 else if (is_local_mountpoint(dentry)) 4321 error = -EBUSY; 4322 else { 4323 error = security_inode_unlink(dir, dentry); 4324 if (!error) { 4325 error = try_break_deleg(target, delegated_inode); 4326 if (error) 4327 goto out; 4328 error = dir->i_op->unlink(dir, dentry); 4329 if (!error) { 4330 dont_mount(dentry); 4331 detach_mounts(dentry); 4332 } 4333 } 4334 } 4335 out: 4336 inode_unlock(target); 4337 4338 /* We don't d_delete() NFS sillyrenamed files--they still exist. */ 4339 if (!error && dentry->d_flags & DCACHE_NFSFS_RENAMED) { 4340 fsnotify_unlink(dir, dentry); 4341 } else if (!error) { 4342 fsnotify_link_count(target); 4343 d_delete_notify(dir, dentry); 4344 } 4345 4346 return error; 4347 } 4348 EXPORT_SYMBOL(vfs_unlink); 4349 4350 /* 4351 * Make sure that the actual truncation of the file will occur outside its 4352 * directory's i_mutex. Truncate can take a long time if there is a lot of 4353 * writeout happening, and we don't want to prevent access to the directory 4354 * while waiting on the I/O. 4355 */ 4356 int do_unlinkat(int dfd, struct filename *name) 4357 { 4358 int error; 4359 struct dentry *dentry; 4360 struct path path; 4361 struct qstr last; 4362 int type; 4363 struct inode *inode = NULL; 4364 struct inode *delegated_inode = NULL; 4365 unsigned int lookup_flags = 0; 4366 retry: 4367 error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type); 4368 if (error) 4369 goto exit1; 4370 4371 error = -EISDIR; 4372 if (type != LAST_NORM) 4373 goto exit2; 4374 4375 error = mnt_want_write(path.mnt); 4376 if (error) 4377 goto exit2; 4378 retry_deleg: 4379 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT); 4380 dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags); 4381 error = PTR_ERR(dentry); 4382 if (!IS_ERR(dentry)) { 4383 4384 /* Why not before? Because we want correct error value */ 4385 if (last.name[last.len] || d_is_negative(dentry)) 4386 goto slashes; 4387 inode = dentry->d_inode; 4388 ihold(inode); 4389 error = security_path_unlink(&path, dentry); 4390 if (error) 4391 goto exit3; 4392 error = vfs_unlink(mnt_idmap(path.mnt), path.dentry->d_inode, 4393 dentry, &delegated_inode); 4394 exit3: 4395 dput(dentry); 4396 } 4397 inode_unlock(path.dentry->d_inode); 4398 if (inode) 4399 iput(inode); /* truncate the inode here */ 4400 inode = NULL; 4401 if (delegated_inode) { 4402 error = break_deleg_wait(&delegated_inode); 4403 if (!error) 4404 goto retry_deleg; 4405 } 4406 mnt_drop_write(path.mnt); 4407 exit2: 4408 path_put(&path); 4409 if (retry_estale(error, lookup_flags)) { 4410 lookup_flags |= LOOKUP_REVAL; 4411 inode = NULL; 4412 goto retry; 4413 } 4414 exit1: 4415 putname(name); 4416 return error; 4417 4418 slashes: 4419 if (d_is_negative(dentry)) 4420 error = -ENOENT; 4421 else if (d_is_dir(dentry)) 4422 error = -EISDIR; 4423 else 4424 error = -ENOTDIR; 4425 goto exit3; 4426 } 4427 4428 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) 4429 { 4430 if ((flag & ~AT_REMOVEDIR) != 0) 4431 return -EINVAL; 4432 4433 if (flag & AT_REMOVEDIR) 4434 return do_rmdir(dfd, getname(pathname)); 4435 return do_unlinkat(dfd, getname(pathname)); 4436 } 4437 4438 SYSCALL_DEFINE1(unlink, const char __user *, pathname) 4439 { 4440 return do_unlinkat(AT_FDCWD, getname(pathname)); 4441 } 4442 4443 /** 4444 * vfs_symlink - create symlink 4445 * @idmap: idmap of the mount the inode was found from 4446 * @dir: inode of @dentry 4447 * @dentry: pointer to dentry of the base directory 4448 * @oldname: name of the file to link to 4449 * 4450 * Create a symlink. 4451 * 4452 * If the inode has been found through an idmapped mount the idmap of 4453 * the vfsmount must be passed through @idmap. This function will then take 4454 * care to map the inode according to @idmap before checking permissions. 4455 * On non-idmapped mounts or if permission checking is to be performed on the 4456 * raw inode simply passs @nop_mnt_idmap. 4457 */ 4458 int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir, 4459 struct dentry *dentry, const char *oldname) 4460 { 4461 int error; 4462 4463 error = may_create(idmap, dir, dentry); 4464 if (error) 4465 return error; 4466 4467 if (!dir->i_op->symlink) 4468 return -EPERM; 4469 4470 error = security_inode_symlink(dir, dentry, oldname); 4471 if (error) 4472 return error; 4473 4474 error = dir->i_op->symlink(idmap, dir, dentry, oldname); 4475 if (!error) 4476 fsnotify_create(dir, dentry); 4477 return error; 4478 } 4479 EXPORT_SYMBOL(vfs_symlink); 4480 4481 int do_symlinkat(struct filename *from, int newdfd, struct filename *to) 4482 { 4483 int error; 4484 struct dentry *dentry; 4485 struct path path; 4486 unsigned int lookup_flags = 0; 4487 4488 if (IS_ERR(from)) { 4489 error = PTR_ERR(from); 4490 goto out_putnames; 4491 } 4492 retry: 4493 dentry = filename_create(newdfd, to, &path, lookup_flags); 4494 error = PTR_ERR(dentry); 4495 if (IS_ERR(dentry)) 4496 goto out_putnames; 4497 4498 error = security_path_symlink(&path, dentry, from->name); 4499 if (!error) 4500 error = vfs_symlink(mnt_idmap(path.mnt), path.dentry->d_inode, 4501 dentry, from->name); 4502 done_path_create(&path, dentry); 4503 if (retry_estale(error, lookup_flags)) { 4504 lookup_flags |= LOOKUP_REVAL; 4505 goto retry; 4506 } 4507 out_putnames: 4508 putname(to); 4509 putname(from); 4510 return error; 4511 } 4512 4513 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, 4514 int, newdfd, const char __user *, newname) 4515 { 4516 return do_symlinkat(getname(oldname), newdfd, getname(newname)); 4517 } 4518 4519 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) 4520 { 4521 return do_symlinkat(getname(oldname), AT_FDCWD, getname(newname)); 4522 } 4523 4524 /** 4525 * vfs_link - create a new link 4526 * @old_dentry: object to be linked 4527 * @idmap: idmap of the mount 4528 * @dir: new parent 4529 * @new_dentry: where to create the new link 4530 * @delegated_inode: returns inode needing a delegation break 4531 * 4532 * The caller must hold dir->i_mutex 4533 * 4534 * If vfs_link discovers a delegation on the to-be-linked file in need 4535 * of breaking, it will return -EWOULDBLOCK and return a reference to the 4536 * inode in delegated_inode. The caller should then break the delegation 4537 * and retry. Because breaking a delegation may take a long time, the 4538 * caller should drop the i_mutex before doing so. 4539 * 4540 * Alternatively, a caller may pass NULL for delegated_inode. This may 4541 * be appropriate for callers that expect the underlying filesystem not 4542 * to be NFS exported. 4543 * 4544 * If the inode has been found through an idmapped mount the idmap of 4545 * the vfsmount must be passed through @idmap. This function will then take 4546 * care to map the inode according to @idmap before checking permissions. 4547 * On non-idmapped mounts or if permission checking is to be performed on the 4548 * raw inode simply passs @nop_mnt_idmap. 4549 */ 4550 int vfs_link(struct dentry *old_dentry, struct mnt_idmap *idmap, 4551 struct inode *dir, struct dentry *new_dentry, 4552 struct inode **delegated_inode) 4553 { 4554 struct inode *inode = old_dentry->d_inode; 4555 unsigned max_links = dir->i_sb->s_max_links; 4556 int error; 4557 4558 if (!inode) 4559 return -ENOENT; 4560 4561 error = may_create(idmap, dir, new_dentry); 4562 if (error) 4563 return error; 4564 4565 if (dir->i_sb != inode->i_sb) 4566 return -EXDEV; 4567 4568 /* 4569 * A link to an append-only or immutable file cannot be created. 4570 */ 4571 if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) 4572 return -EPERM; 4573 /* 4574 * Updating the link count will likely cause i_uid and i_gid to 4575 * be writen back improperly if their true value is unknown to 4576 * the vfs. 4577 */ 4578 if (HAS_UNMAPPED_ID(idmap, inode)) 4579 return -EPERM; 4580 if (!dir->i_op->link) 4581 return -EPERM; 4582 if (S_ISDIR(inode->i_mode)) 4583 return -EPERM; 4584 4585 error = security_inode_link(old_dentry, dir, new_dentry); 4586 if (error) 4587 return error; 4588 4589 inode_lock(inode); 4590 /* Make sure we don't allow creating hardlink to an unlinked file */ 4591 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE)) 4592 error = -ENOENT; 4593 else if (max_links && inode->i_nlink >= max_links) 4594 error = -EMLINK; 4595 else { 4596 error = try_break_deleg(inode, delegated_inode); 4597 if (!error) 4598 error = dir->i_op->link(old_dentry, dir, new_dentry); 4599 } 4600 4601 if (!error && (inode->i_state & I_LINKABLE)) { 4602 spin_lock(&inode->i_lock); 4603 inode->i_state &= ~I_LINKABLE; 4604 spin_unlock(&inode->i_lock); 4605 } 4606 inode_unlock(inode); 4607 if (!error) 4608 fsnotify_link(dir, inode, new_dentry); 4609 return error; 4610 } 4611 EXPORT_SYMBOL(vfs_link); 4612 4613 /* 4614 * Hardlinks are often used in delicate situations. We avoid 4615 * security-related surprises by not following symlinks on the 4616 * newname. --KAB 4617 * 4618 * We don't follow them on the oldname either to be compatible 4619 * with linux 2.0, and to avoid hard-linking to directories 4620 * and other special files. --ADM 4621 */ 4622 int do_linkat(int olddfd, struct filename *old, int newdfd, 4623 struct filename *new, int flags) 4624 { 4625 struct mnt_idmap *idmap; 4626 struct dentry *new_dentry; 4627 struct path old_path, new_path; 4628 struct inode *delegated_inode = NULL; 4629 int how = 0; 4630 int error; 4631 4632 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) { 4633 error = -EINVAL; 4634 goto out_putnames; 4635 } 4636 /* 4637 * To use null names we require CAP_DAC_READ_SEARCH 4638 * This ensures that not everyone will be able to create 4639 * handlink using the passed filedescriptor. 4640 */ 4641 if (flags & AT_EMPTY_PATH && !capable(CAP_DAC_READ_SEARCH)) { 4642 error = -ENOENT; 4643 goto out_putnames; 4644 } 4645 4646 if (flags & AT_SYMLINK_FOLLOW) 4647 how |= LOOKUP_FOLLOW; 4648 retry: 4649 error = filename_lookup(olddfd, old, how, &old_path, NULL); 4650 if (error) 4651 goto out_putnames; 4652 4653 new_dentry = filename_create(newdfd, new, &new_path, 4654 (how & LOOKUP_REVAL)); 4655 error = PTR_ERR(new_dentry); 4656 if (IS_ERR(new_dentry)) 4657 goto out_putpath; 4658 4659 error = -EXDEV; 4660 if (old_path.mnt != new_path.mnt) 4661 goto out_dput; 4662 idmap = mnt_idmap(new_path.mnt); 4663 error = may_linkat(idmap, &old_path); 4664 if (unlikely(error)) 4665 goto out_dput; 4666 error = security_path_link(old_path.dentry, &new_path, new_dentry); 4667 if (error) 4668 goto out_dput; 4669 error = vfs_link(old_path.dentry, idmap, new_path.dentry->d_inode, 4670 new_dentry, &delegated_inode); 4671 out_dput: 4672 done_path_create(&new_path, new_dentry); 4673 if (delegated_inode) { 4674 error = break_deleg_wait(&delegated_inode); 4675 if (!error) { 4676 path_put(&old_path); 4677 goto retry; 4678 } 4679 } 4680 if (retry_estale(error, how)) { 4681 path_put(&old_path); 4682 how |= LOOKUP_REVAL; 4683 goto retry; 4684 } 4685 out_putpath: 4686 path_put(&old_path); 4687 out_putnames: 4688 putname(old); 4689 putname(new); 4690 4691 return error; 4692 } 4693 4694 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, 4695 int, newdfd, const char __user *, newname, int, flags) 4696 { 4697 return do_linkat(olddfd, getname_uflags(oldname, flags), 4698 newdfd, getname(newname), flags); 4699 } 4700 4701 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) 4702 { 4703 return do_linkat(AT_FDCWD, getname(oldname), AT_FDCWD, getname(newname), 0); 4704 } 4705 4706 /** 4707 * vfs_rename - rename a filesystem object 4708 * @rd: pointer to &struct renamedata info 4709 * 4710 * The caller must hold multiple mutexes--see lock_rename()). 4711 * 4712 * If vfs_rename discovers a delegation in need of breaking at either 4713 * the source or destination, it will return -EWOULDBLOCK and return a 4714 * reference to the inode in delegated_inode. The caller should then 4715 * break the delegation and retry. Because breaking a delegation may 4716 * take a long time, the caller should drop all locks before doing 4717 * so. 4718 * 4719 * Alternatively, a caller may pass NULL for delegated_inode. This may 4720 * be appropriate for callers that expect the underlying filesystem not 4721 * to be NFS exported. 4722 * 4723 * The worst of all namespace operations - renaming directory. "Perverted" 4724 * doesn't even start to describe it. Somebody in UCB had a heck of a trip... 4725 * Problems: 4726 * 4727 * a) we can get into loop creation. 4728 * b) race potential - two innocent renames can create a loop together. 4729 * That's where 4.4 screws up. Current fix: serialization on 4730 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another 4731 * story. 4732 * c) we have to lock _four_ objects - parents and victim (if it exists), 4733 * and source. 4734 * And that - after we got ->i_mutex on parents (until then we don't know 4735 * whether the target exists). Solution: try to be smart with locking 4736 * order for inodes. We rely on the fact that tree topology may change 4737 * only under ->s_vfs_rename_mutex _and_ that parent of the object we 4738 * move will be locked. Thus we can rank directories by the tree 4739 * (ancestors first) and rank all non-directories after them. 4740 * That works since everybody except rename does "lock parent, lookup, 4741 * lock child" and rename is under ->s_vfs_rename_mutex. 4742 * HOWEVER, it relies on the assumption that any object with ->lookup() 4743 * has no more than 1 dentry. If "hybrid" objects will ever appear, 4744 * we'd better make sure that there's no link(2) for them. 4745 * d) conversion from fhandle to dentry may come in the wrong moment - when 4746 * we are removing the target. Solution: we will have to grab ->i_mutex 4747 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on 4748 * ->i_mutex on parents, which works but leads to some truly excessive 4749 * locking]. 4750 */ 4751 int vfs_rename(struct renamedata *rd) 4752 { 4753 int error; 4754 struct inode *old_dir = rd->old_dir, *new_dir = rd->new_dir; 4755 struct dentry *old_dentry = rd->old_dentry; 4756 struct dentry *new_dentry = rd->new_dentry; 4757 struct inode **delegated_inode = rd->delegated_inode; 4758 unsigned int flags = rd->flags; 4759 bool is_dir = d_is_dir(old_dentry); 4760 struct inode *source = old_dentry->d_inode; 4761 struct inode *target = new_dentry->d_inode; 4762 bool new_is_dir = false; 4763 unsigned max_links = new_dir->i_sb->s_max_links; 4764 struct name_snapshot old_name; 4765 4766 if (source == target) 4767 return 0; 4768 4769 error = may_delete(rd->old_mnt_idmap, old_dir, old_dentry, is_dir); 4770 if (error) 4771 return error; 4772 4773 if (!target) { 4774 error = may_create(rd->new_mnt_idmap, new_dir, new_dentry); 4775 } else { 4776 new_is_dir = d_is_dir(new_dentry); 4777 4778 if (!(flags & RENAME_EXCHANGE)) 4779 error = may_delete(rd->new_mnt_idmap, new_dir, 4780 new_dentry, is_dir); 4781 else 4782 error = may_delete(rd->new_mnt_idmap, new_dir, 4783 new_dentry, new_is_dir); 4784 } 4785 if (error) 4786 return error; 4787 4788 if (!old_dir->i_op->rename) 4789 return -EPERM; 4790 4791 /* 4792 * If we are going to change the parent - check write permissions, 4793 * we'll need to flip '..'. 4794 */ 4795 if (new_dir != old_dir) { 4796 if (is_dir) { 4797 error = inode_permission(rd->old_mnt_idmap, source, 4798 MAY_WRITE); 4799 if (error) 4800 return error; 4801 } 4802 if ((flags & RENAME_EXCHANGE) && new_is_dir) { 4803 error = inode_permission(rd->new_mnt_idmap, target, 4804 MAY_WRITE); 4805 if (error) 4806 return error; 4807 } 4808 } 4809 4810 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry, 4811 flags); 4812 if (error) 4813 return error; 4814 4815 take_dentry_name_snapshot(&old_name, old_dentry); 4816 dget(new_dentry); 4817 /* 4818 * Lock all moved children. Moved directories may need to change parent 4819 * pointer so they need the lock to prevent against concurrent 4820 * directory changes moving parent pointer. For regular files we've 4821 * historically always done this. The lockdep locking subclasses are 4822 * somewhat arbitrary but RENAME_EXCHANGE in particular can swap 4823 * regular files and directories so it's difficult to tell which 4824 * subclasses to use. 4825 */ 4826 lock_two_inodes(source, target, I_MUTEX_NORMAL, I_MUTEX_NONDIR2); 4827 4828 error = -EPERM; 4829 if (IS_SWAPFILE(source) || (target && IS_SWAPFILE(target))) 4830 goto out; 4831 4832 error = -EBUSY; 4833 if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry)) 4834 goto out; 4835 4836 if (max_links && new_dir != old_dir) { 4837 error = -EMLINK; 4838 if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links) 4839 goto out; 4840 if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir && 4841 old_dir->i_nlink >= max_links) 4842 goto out; 4843 } 4844 if (!is_dir) { 4845 error = try_break_deleg(source, delegated_inode); 4846 if (error) 4847 goto out; 4848 } 4849 if (target && !new_is_dir) { 4850 error = try_break_deleg(target, delegated_inode); 4851 if (error) 4852 goto out; 4853 } 4854 error = old_dir->i_op->rename(rd->new_mnt_idmap, old_dir, old_dentry, 4855 new_dir, new_dentry, flags); 4856 if (error) 4857 goto out; 4858 4859 if (!(flags & RENAME_EXCHANGE) && target) { 4860 if (is_dir) { 4861 shrink_dcache_parent(new_dentry); 4862 target->i_flags |= S_DEAD; 4863 } 4864 dont_mount(new_dentry); 4865 detach_mounts(new_dentry); 4866 } 4867 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) { 4868 if (!(flags & RENAME_EXCHANGE)) 4869 d_move(old_dentry, new_dentry); 4870 else 4871 d_exchange(old_dentry, new_dentry); 4872 } 4873 out: 4874 inode_unlock(source); 4875 if (target) 4876 inode_unlock(target); 4877 dput(new_dentry); 4878 if (!error) { 4879 fsnotify_move(old_dir, new_dir, &old_name.name, is_dir, 4880 !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry); 4881 if (flags & RENAME_EXCHANGE) { 4882 fsnotify_move(new_dir, old_dir, &old_dentry->d_name, 4883 new_is_dir, NULL, new_dentry); 4884 } 4885 } 4886 release_dentry_name_snapshot(&old_name); 4887 4888 return error; 4889 } 4890 EXPORT_SYMBOL(vfs_rename); 4891 4892 int do_renameat2(int olddfd, struct filename *from, int newdfd, 4893 struct filename *to, unsigned int flags) 4894 { 4895 struct renamedata rd; 4896 struct dentry *old_dentry, *new_dentry; 4897 struct dentry *trap; 4898 struct path old_path, new_path; 4899 struct qstr old_last, new_last; 4900 int old_type, new_type; 4901 struct inode *delegated_inode = NULL; 4902 unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET; 4903 bool should_retry = false; 4904 int error = -EINVAL; 4905 4906 if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT)) 4907 goto put_names; 4908 4909 if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) && 4910 (flags & RENAME_EXCHANGE)) 4911 goto put_names; 4912 4913 if (flags & RENAME_EXCHANGE) 4914 target_flags = 0; 4915 4916 retry: 4917 error = filename_parentat(olddfd, from, lookup_flags, &old_path, 4918 &old_last, &old_type); 4919 if (error) 4920 goto put_names; 4921 4922 error = filename_parentat(newdfd, to, lookup_flags, &new_path, &new_last, 4923 &new_type); 4924 if (error) 4925 goto exit1; 4926 4927 error = -EXDEV; 4928 if (old_path.mnt != new_path.mnt) 4929 goto exit2; 4930 4931 error = -EBUSY; 4932 if (old_type != LAST_NORM) 4933 goto exit2; 4934 4935 if (flags & RENAME_NOREPLACE) 4936 error = -EEXIST; 4937 if (new_type != LAST_NORM) 4938 goto exit2; 4939 4940 error = mnt_want_write(old_path.mnt); 4941 if (error) 4942 goto exit2; 4943 4944 retry_deleg: 4945 trap = lock_rename(new_path.dentry, old_path.dentry); 4946 4947 old_dentry = lookup_one_qstr_excl(&old_last, old_path.dentry, 4948 lookup_flags); 4949 error = PTR_ERR(old_dentry); 4950 if (IS_ERR(old_dentry)) 4951 goto exit3; 4952 /* source must exist */ 4953 error = -ENOENT; 4954 if (d_is_negative(old_dentry)) 4955 goto exit4; 4956 new_dentry = lookup_one_qstr_excl(&new_last, new_path.dentry, 4957 lookup_flags | target_flags); 4958 error = PTR_ERR(new_dentry); 4959 if (IS_ERR(new_dentry)) 4960 goto exit4; 4961 error = -EEXIST; 4962 if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry)) 4963 goto exit5; 4964 if (flags & RENAME_EXCHANGE) { 4965 error = -ENOENT; 4966 if (d_is_negative(new_dentry)) 4967 goto exit5; 4968 4969 if (!d_is_dir(new_dentry)) { 4970 error = -ENOTDIR; 4971 if (new_last.name[new_last.len]) 4972 goto exit5; 4973 } 4974 } 4975 /* unless the source is a directory trailing slashes give -ENOTDIR */ 4976 if (!d_is_dir(old_dentry)) { 4977 error = -ENOTDIR; 4978 if (old_last.name[old_last.len]) 4979 goto exit5; 4980 if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len]) 4981 goto exit5; 4982 } 4983 /* source should not be ancestor of target */ 4984 error = -EINVAL; 4985 if (old_dentry == trap) 4986 goto exit5; 4987 /* target should not be an ancestor of source */ 4988 if (!(flags & RENAME_EXCHANGE)) 4989 error = -ENOTEMPTY; 4990 if (new_dentry == trap) 4991 goto exit5; 4992 4993 error = security_path_rename(&old_path, old_dentry, 4994 &new_path, new_dentry, flags); 4995 if (error) 4996 goto exit5; 4997 4998 rd.old_dir = old_path.dentry->d_inode; 4999 rd.old_dentry = old_dentry; 5000 rd.old_mnt_idmap = mnt_idmap(old_path.mnt); 5001 rd.new_dir = new_path.dentry->d_inode; 5002 rd.new_dentry = new_dentry; 5003 rd.new_mnt_idmap = mnt_idmap(new_path.mnt); 5004 rd.delegated_inode = &delegated_inode; 5005 rd.flags = flags; 5006 error = vfs_rename(&rd); 5007 exit5: 5008 dput(new_dentry); 5009 exit4: 5010 dput(old_dentry); 5011 exit3: 5012 unlock_rename(new_path.dentry, old_path.dentry); 5013 if (delegated_inode) { 5014 error = break_deleg_wait(&delegated_inode); 5015 if (!error) 5016 goto retry_deleg; 5017 } 5018 mnt_drop_write(old_path.mnt); 5019 exit2: 5020 if (retry_estale(error, lookup_flags)) 5021 should_retry = true; 5022 path_put(&new_path); 5023 exit1: 5024 path_put(&old_path); 5025 if (should_retry) { 5026 should_retry = false; 5027 lookup_flags |= LOOKUP_REVAL; 5028 goto retry; 5029 } 5030 put_names: 5031 putname(from); 5032 putname(to); 5033 return error; 5034 } 5035 5036 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname, 5037 int, newdfd, const char __user *, newname, unsigned int, flags) 5038 { 5039 return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname), 5040 flags); 5041 } 5042 5043 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, 5044 int, newdfd, const char __user *, newname) 5045 { 5046 return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname), 5047 0); 5048 } 5049 5050 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) 5051 { 5052 return do_renameat2(AT_FDCWD, getname(oldname), AT_FDCWD, 5053 getname(newname), 0); 5054 } 5055 5056 int readlink_copy(char __user *buffer, int buflen, const char *link) 5057 { 5058 int len = PTR_ERR(link); 5059 if (IS_ERR(link)) 5060 goto out; 5061 5062 len = strlen(link); 5063 if (len > (unsigned) buflen) 5064 len = buflen; 5065 if (copy_to_user(buffer, link, len)) 5066 len = -EFAULT; 5067 out: 5068 return len; 5069 } 5070 5071 /** 5072 * vfs_readlink - copy symlink body into userspace buffer 5073 * @dentry: dentry on which to get symbolic link 5074 * @buffer: user memory pointer 5075 * @buflen: size of buffer 5076 * 5077 * Does not touch atime. That's up to the caller if necessary 5078 * 5079 * Does not call security hook. 5080 */ 5081 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen) 5082 { 5083 struct inode *inode = d_inode(dentry); 5084 DEFINE_DELAYED_CALL(done); 5085 const char *link; 5086 int res; 5087 5088 if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) { 5089 if (unlikely(inode->i_op->readlink)) 5090 return inode->i_op->readlink(dentry, buffer, buflen); 5091 5092 if (!d_is_symlink(dentry)) 5093 return -EINVAL; 5094 5095 spin_lock(&inode->i_lock); 5096 inode->i_opflags |= IOP_DEFAULT_READLINK; 5097 spin_unlock(&inode->i_lock); 5098 } 5099 5100 link = READ_ONCE(inode->i_link); 5101 if (!link) { 5102 link = inode->i_op->get_link(dentry, inode, &done); 5103 if (IS_ERR(link)) 5104 return PTR_ERR(link); 5105 } 5106 res = readlink_copy(buffer, buflen, link); 5107 do_delayed_call(&done); 5108 return res; 5109 } 5110 EXPORT_SYMBOL(vfs_readlink); 5111 5112 /** 5113 * vfs_get_link - get symlink body 5114 * @dentry: dentry on which to get symbolic link 5115 * @done: caller needs to free returned data with this 5116 * 5117 * Calls security hook and i_op->get_link() on the supplied inode. 5118 * 5119 * It does not touch atime. That's up to the caller if necessary. 5120 * 5121 * Does not work on "special" symlinks like /proc/$$/fd/N 5122 */ 5123 const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done) 5124 { 5125 const char *res = ERR_PTR(-EINVAL); 5126 struct inode *inode = d_inode(dentry); 5127 5128 if (d_is_symlink(dentry)) { 5129 res = ERR_PTR(security_inode_readlink(dentry)); 5130 if (!res) 5131 res = inode->i_op->get_link(dentry, inode, done); 5132 } 5133 return res; 5134 } 5135 EXPORT_SYMBOL(vfs_get_link); 5136 5137 /* get the link contents into pagecache */ 5138 const char *page_get_link(struct dentry *dentry, struct inode *inode, 5139 struct delayed_call *callback) 5140 { 5141 char *kaddr; 5142 struct page *page; 5143 struct address_space *mapping = inode->i_mapping; 5144 5145 if (!dentry) { 5146 page = find_get_page(mapping, 0); 5147 if (!page) 5148 return ERR_PTR(-ECHILD); 5149 if (!PageUptodate(page)) { 5150 put_page(page); 5151 return ERR_PTR(-ECHILD); 5152 } 5153 } else { 5154 page = read_mapping_page(mapping, 0, NULL); 5155 if (IS_ERR(page)) 5156 return (char*)page; 5157 } 5158 set_delayed_call(callback, page_put_link, page); 5159 BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM); 5160 kaddr = page_address(page); 5161 nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1); 5162 return kaddr; 5163 } 5164 5165 EXPORT_SYMBOL(page_get_link); 5166 5167 void page_put_link(void *arg) 5168 { 5169 put_page(arg); 5170 } 5171 EXPORT_SYMBOL(page_put_link); 5172 5173 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen) 5174 { 5175 DEFINE_DELAYED_CALL(done); 5176 int res = readlink_copy(buffer, buflen, 5177 page_get_link(dentry, d_inode(dentry), 5178 &done)); 5179 do_delayed_call(&done); 5180 return res; 5181 } 5182 EXPORT_SYMBOL(page_readlink); 5183 5184 int page_symlink(struct inode *inode, const char *symname, int len) 5185 { 5186 struct address_space *mapping = inode->i_mapping; 5187 const struct address_space_operations *aops = mapping->a_ops; 5188 bool nofs = !mapping_gfp_constraint(mapping, __GFP_FS); 5189 struct page *page; 5190 void *fsdata = NULL; 5191 int err; 5192 unsigned int flags; 5193 5194 retry: 5195 if (nofs) 5196 flags = memalloc_nofs_save(); 5197 err = aops->write_begin(NULL, mapping, 0, len-1, &page, &fsdata); 5198 if (nofs) 5199 memalloc_nofs_restore(flags); 5200 if (err) 5201 goto fail; 5202 5203 memcpy(page_address(page), symname, len-1); 5204 5205 err = aops->write_end(NULL, mapping, 0, len-1, len-1, 5206 page, fsdata); 5207 if (err < 0) 5208 goto fail; 5209 if (err < len-1) 5210 goto retry; 5211 5212 mark_inode_dirty(inode); 5213 return 0; 5214 fail: 5215 return err; 5216 } 5217 EXPORT_SYMBOL(page_symlink); 5218 5219 const struct inode_operations page_symlink_inode_operations = { 5220 .get_link = page_get_link, 5221 }; 5222 EXPORT_SYMBOL(page_symlink_inode_operations); 5223