1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * linux/fs/namespace.c 4 * 5 * (C) Copyright Al Viro 2000, 2001 6 * 7 * Based on code from fs/super.c, copyright Linus Torvalds and others. 8 * Heavily rewritten. 9 */ 10 11 #include <linux/syscalls.h> 12 #include <linux/export.h> 13 #include <linux/capability.h> 14 #include <linux/mnt_namespace.h> 15 #include <linux/user_namespace.h> 16 #include <linux/namei.h> 17 #include <linux/security.h> 18 #include <linux/cred.h> 19 #include <linux/idr.h> 20 #include <linux/init.h> /* init_rootfs */ 21 #include <linux/fs_struct.h> /* get_fs_root et.al. */ 22 #include <linux/fsnotify.h> /* fsnotify_vfsmount_delete */ 23 #include <linux/file.h> 24 #include <linux/uaccess.h> 25 #include <linux/proc_ns.h> 26 #include <linux/magic.h> 27 #include <linux/memblock.h> 28 #include <linux/proc_fs.h> 29 #include <linux/task_work.h> 30 #include <linux/sched/task.h> 31 #include <uapi/linux/mount.h> 32 #include <linux/fs_context.h> 33 #include <linux/shmem_fs.h> 34 #include <linux/mnt_idmapping.h> 35 #include <linux/nospec.h> 36 37 #include "pnode.h" 38 #include "internal.h" 39 40 /* Maximum number of mounts in a mount namespace */ 41 static unsigned int sysctl_mount_max __read_mostly = 100000; 42 43 static unsigned int m_hash_mask __ro_after_init; 44 static unsigned int m_hash_shift __ro_after_init; 45 static unsigned int mp_hash_mask __ro_after_init; 46 static unsigned int mp_hash_shift __ro_after_init; 47 48 static __initdata unsigned long mhash_entries; 49 static int __init set_mhash_entries(char *str) 50 { 51 if (!str) 52 return 0; 53 mhash_entries = simple_strtoul(str, &str, 0); 54 return 1; 55 } 56 __setup("mhash_entries=", set_mhash_entries); 57 58 static __initdata unsigned long mphash_entries; 59 static int __init set_mphash_entries(char *str) 60 { 61 if (!str) 62 return 0; 63 mphash_entries = simple_strtoul(str, &str, 0); 64 return 1; 65 } 66 __setup("mphash_entries=", set_mphash_entries); 67 68 static u64 event; 69 static DEFINE_IDA(mnt_id_ida); 70 static DEFINE_IDA(mnt_group_ida); 71 72 /* Don't allow confusion with old 32bit mount ID */ 73 #define MNT_UNIQUE_ID_OFFSET (1ULL << 31) 74 static atomic64_t mnt_id_ctr = ATOMIC64_INIT(MNT_UNIQUE_ID_OFFSET); 75 76 static struct hlist_head *mount_hashtable __ro_after_init; 77 static struct hlist_head *mountpoint_hashtable __ro_after_init; 78 static struct kmem_cache *mnt_cache __ro_after_init; 79 static DECLARE_RWSEM(namespace_sem); 80 static HLIST_HEAD(unmounted); /* protected by namespace_sem */ 81 static LIST_HEAD(ex_mountpoints); /* protected by namespace_sem */ 82 static DEFINE_RWLOCK(mnt_ns_tree_lock); 83 static struct rb_root mnt_ns_tree = RB_ROOT; /* protected by mnt_ns_tree_lock */ 84 85 struct mount_kattr { 86 unsigned int attr_set; 87 unsigned int attr_clr; 88 unsigned int propagation; 89 unsigned int lookup_flags; 90 bool recurse; 91 struct user_namespace *mnt_userns; 92 struct mnt_idmap *mnt_idmap; 93 }; 94 95 /* /sys/fs */ 96 struct kobject *fs_kobj __ro_after_init; 97 EXPORT_SYMBOL_GPL(fs_kobj); 98 99 /* 100 * vfsmount lock may be taken for read to prevent changes to the 101 * vfsmount hash, ie. during mountpoint lookups or walking back 102 * up the tree. 103 * 104 * It should be taken for write in all cases where the vfsmount 105 * tree or hash is modified or when a vfsmount structure is modified. 106 */ 107 __cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock); 108 109 static int mnt_ns_cmp(u64 seq, const struct mnt_namespace *ns) 110 { 111 u64 seq_b = ns->seq; 112 113 if (seq < seq_b) 114 return -1; 115 if (seq > seq_b) 116 return 1; 117 return 0; 118 } 119 120 static inline struct mnt_namespace *node_to_mnt_ns(const struct rb_node *node) 121 { 122 if (!node) 123 return NULL; 124 return rb_entry(node, struct mnt_namespace, mnt_ns_tree_node); 125 } 126 127 static bool mnt_ns_less(struct rb_node *a, const struct rb_node *b) 128 { 129 struct mnt_namespace *ns_a = node_to_mnt_ns(a); 130 struct mnt_namespace *ns_b = node_to_mnt_ns(b); 131 u64 seq_a = ns_a->seq; 132 133 return mnt_ns_cmp(seq_a, ns_b) < 0; 134 } 135 136 static void mnt_ns_tree_add(struct mnt_namespace *ns) 137 { 138 guard(write_lock)(&mnt_ns_tree_lock); 139 rb_add(&ns->mnt_ns_tree_node, &mnt_ns_tree, mnt_ns_less); 140 } 141 142 static void mnt_ns_release(struct mnt_namespace *ns) 143 { 144 lockdep_assert_not_held(&mnt_ns_tree_lock); 145 146 /* keep alive for {list,stat}mount() */ 147 if (refcount_dec_and_test(&ns->passive)) { 148 put_user_ns(ns->user_ns); 149 kfree(ns); 150 } 151 } 152 DEFINE_FREE(mnt_ns_release, struct mnt_namespace *, if (_T) mnt_ns_release(_T)) 153 154 static void mnt_ns_tree_remove(struct mnt_namespace *ns) 155 { 156 /* remove from global mount namespace list */ 157 if (!is_anon_ns(ns)) { 158 guard(write_lock)(&mnt_ns_tree_lock); 159 rb_erase(&ns->mnt_ns_tree_node, &mnt_ns_tree); 160 } 161 162 mnt_ns_release(ns); 163 } 164 165 /* 166 * Returns the mount namespace which either has the specified id, or has the 167 * next smallest id afer the specified one. 168 */ 169 static struct mnt_namespace *mnt_ns_find_id_at(u64 mnt_ns_id) 170 { 171 struct rb_node *node = mnt_ns_tree.rb_node; 172 struct mnt_namespace *ret = NULL; 173 174 lockdep_assert_held(&mnt_ns_tree_lock); 175 176 while (node) { 177 struct mnt_namespace *n = node_to_mnt_ns(node); 178 179 if (mnt_ns_id <= n->seq) { 180 ret = node_to_mnt_ns(node); 181 if (mnt_ns_id == n->seq) 182 break; 183 node = node->rb_left; 184 } else { 185 node = node->rb_right; 186 } 187 } 188 return ret; 189 } 190 191 /* 192 * Lookup a mount namespace by id and take a passive reference count. Taking a 193 * passive reference means the mount namespace can be emptied if e.g., the last 194 * task holding an active reference exits. To access the mounts of the 195 * namespace the @namespace_sem must first be acquired. If the namespace has 196 * already shut down before acquiring @namespace_sem, {list,stat}mount() will 197 * see that the mount rbtree of the namespace is empty. 198 */ 199 static struct mnt_namespace *lookup_mnt_ns(u64 mnt_ns_id) 200 { 201 struct mnt_namespace *ns; 202 203 guard(read_lock)(&mnt_ns_tree_lock); 204 ns = mnt_ns_find_id_at(mnt_ns_id); 205 if (!ns || ns->seq != mnt_ns_id) 206 return NULL; 207 208 refcount_inc(&ns->passive); 209 return ns; 210 } 211 212 static inline void lock_mount_hash(void) 213 { 214 write_seqlock(&mount_lock); 215 } 216 217 static inline void unlock_mount_hash(void) 218 { 219 write_sequnlock(&mount_lock); 220 } 221 222 static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry) 223 { 224 unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES); 225 tmp += ((unsigned long)dentry / L1_CACHE_BYTES); 226 tmp = tmp + (tmp >> m_hash_shift); 227 return &mount_hashtable[tmp & m_hash_mask]; 228 } 229 230 static inline struct hlist_head *mp_hash(struct dentry *dentry) 231 { 232 unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES); 233 tmp = tmp + (tmp >> mp_hash_shift); 234 return &mountpoint_hashtable[tmp & mp_hash_mask]; 235 } 236 237 static int mnt_alloc_id(struct mount *mnt) 238 { 239 int res = ida_alloc(&mnt_id_ida, GFP_KERNEL); 240 241 if (res < 0) 242 return res; 243 mnt->mnt_id = res; 244 mnt->mnt_id_unique = atomic64_inc_return(&mnt_id_ctr); 245 return 0; 246 } 247 248 static void mnt_free_id(struct mount *mnt) 249 { 250 ida_free(&mnt_id_ida, mnt->mnt_id); 251 } 252 253 /* 254 * Allocate a new peer group ID 255 */ 256 static int mnt_alloc_group_id(struct mount *mnt) 257 { 258 int res = ida_alloc_min(&mnt_group_ida, 1, GFP_KERNEL); 259 260 if (res < 0) 261 return res; 262 mnt->mnt_group_id = res; 263 return 0; 264 } 265 266 /* 267 * Release a peer group ID 268 */ 269 void mnt_release_group_id(struct mount *mnt) 270 { 271 ida_free(&mnt_group_ida, mnt->mnt_group_id); 272 mnt->mnt_group_id = 0; 273 } 274 275 /* 276 * vfsmount lock must be held for read 277 */ 278 static inline void mnt_add_count(struct mount *mnt, int n) 279 { 280 #ifdef CONFIG_SMP 281 this_cpu_add(mnt->mnt_pcp->mnt_count, n); 282 #else 283 preempt_disable(); 284 mnt->mnt_count += n; 285 preempt_enable(); 286 #endif 287 } 288 289 /* 290 * vfsmount lock must be held for write 291 */ 292 int mnt_get_count(struct mount *mnt) 293 { 294 #ifdef CONFIG_SMP 295 int count = 0; 296 int cpu; 297 298 for_each_possible_cpu(cpu) { 299 count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_count; 300 } 301 302 return count; 303 #else 304 return mnt->mnt_count; 305 #endif 306 } 307 308 static struct mount *alloc_vfsmnt(const char *name) 309 { 310 struct mount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL); 311 if (mnt) { 312 int err; 313 314 err = mnt_alloc_id(mnt); 315 if (err) 316 goto out_free_cache; 317 318 if (name) { 319 mnt->mnt_devname = kstrdup_const(name, 320 GFP_KERNEL_ACCOUNT); 321 if (!mnt->mnt_devname) 322 goto out_free_id; 323 } 324 325 #ifdef CONFIG_SMP 326 mnt->mnt_pcp = alloc_percpu(struct mnt_pcp); 327 if (!mnt->mnt_pcp) 328 goto out_free_devname; 329 330 this_cpu_add(mnt->mnt_pcp->mnt_count, 1); 331 #else 332 mnt->mnt_count = 1; 333 mnt->mnt_writers = 0; 334 #endif 335 336 INIT_HLIST_NODE(&mnt->mnt_hash); 337 INIT_LIST_HEAD(&mnt->mnt_child); 338 INIT_LIST_HEAD(&mnt->mnt_mounts); 339 INIT_LIST_HEAD(&mnt->mnt_list); 340 INIT_LIST_HEAD(&mnt->mnt_expire); 341 INIT_LIST_HEAD(&mnt->mnt_share); 342 INIT_LIST_HEAD(&mnt->mnt_slave_list); 343 INIT_LIST_HEAD(&mnt->mnt_slave); 344 INIT_HLIST_NODE(&mnt->mnt_mp_list); 345 INIT_LIST_HEAD(&mnt->mnt_umounting); 346 INIT_HLIST_HEAD(&mnt->mnt_stuck_children); 347 mnt->mnt.mnt_idmap = &nop_mnt_idmap; 348 } 349 return mnt; 350 351 #ifdef CONFIG_SMP 352 out_free_devname: 353 kfree_const(mnt->mnt_devname); 354 #endif 355 out_free_id: 356 mnt_free_id(mnt); 357 out_free_cache: 358 kmem_cache_free(mnt_cache, mnt); 359 return NULL; 360 } 361 362 /* 363 * Most r/o checks on a fs are for operations that take 364 * discrete amounts of time, like a write() or unlink(). 365 * We must keep track of when those operations start 366 * (for permission checks) and when they end, so that 367 * we can determine when writes are able to occur to 368 * a filesystem. 369 */ 370 /* 371 * __mnt_is_readonly: check whether a mount is read-only 372 * @mnt: the mount to check for its write status 373 * 374 * This shouldn't be used directly ouside of the VFS. 375 * It does not guarantee that the filesystem will stay 376 * r/w, just that it is right *now*. This can not and 377 * should not be used in place of IS_RDONLY(inode). 378 * mnt_want/drop_write() will _keep_ the filesystem 379 * r/w. 380 */ 381 bool __mnt_is_readonly(struct vfsmount *mnt) 382 { 383 return (mnt->mnt_flags & MNT_READONLY) || sb_rdonly(mnt->mnt_sb); 384 } 385 EXPORT_SYMBOL_GPL(__mnt_is_readonly); 386 387 static inline void mnt_inc_writers(struct mount *mnt) 388 { 389 #ifdef CONFIG_SMP 390 this_cpu_inc(mnt->mnt_pcp->mnt_writers); 391 #else 392 mnt->mnt_writers++; 393 #endif 394 } 395 396 static inline void mnt_dec_writers(struct mount *mnt) 397 { 398 #ifdef CONFIG_SMP 399 this_cpu_dec(mnt->mnt_pcp->mnt_writers); 400 #else 401 mnt->mnt_writers--; 402 #endif 403 } 404 405 static unsigned int mnt_get_writers(struct mount *mnt) 406 { 407 #ifdef CONFIG_SMP 408 unsigned int count = 0; 409 int cpu; 410 411 for_each_possible_cpu(cpu) { 412 count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers; 413 } 414 415 return count; 416 #else 417 return mnt->mnt_writers; 418 #endif 419 } 420 421 static int mnt_is_readonly(struct vfsmount *mnt) 422 { 423 if (READ_ONCE(mnt->mnt_sb->s_readonly_remount)) 424 return 1; 425 /* 426 * The barrier pairs with the barrier in sb_start_ro_state_change() 427 * making sure if we don't see s_readonly_remount set yet, we also will 428 * not see any superblock / mount flag changes done by remount. 429 * It also pairs with the barrier in sb_end_ro_state_change() 430 * assuring that if we see s_readonly_remount already cleared, we will 431 * see the values of superblock / mount flags updated by remount. 432 */ 433 smp_rmb(); 434 return __mnt_is_readonly(mnt); 435 } 436 437 /* 438 * Most r/o & frozen checks on a fs are for operations that take discrete 439 * amounts of time, like a write() or unlink(). We must keep track of when 440 * those operations start (for permission checks) and when they end, so that we 441 * can determine when writes are able to occur to a filesystem. 442 */ 443 /** 444 * mnt_get_write_access - get write access to a mount without freeze protection 445 * @m: the mount on which to take a write 446 * 447 * This tells the low-level filesystem that a write is about to be performed to 448 * it, and makes sure that writes are allowed (mnt it read-write) before 449 * returning success. This operation does not protect against filesystem being 450 * frozen. When the write operation is finished, mnt_put_write_access() must be 451 * called. This is effectively a refcount. 452 */ 453 int mnt_get_write_access(struct vfsmount *m) 454 { 455 struct mount *mnt = real_mount(m); 456 int ret = 0; 457 458 preempt_disable(); 459 mnt_inc_writers(mnt); 460 /* 461 * The store to mnt_inc_writers must be visible before we pass 462 * MNT_WRITE_HOLD loop below, so that the slowpath can see our 463 * incremented count after it has set MNT_WRITE_HOLD. 464 */ 465 smp_mb(); 466 might_lock(&mount_lock.lock); 467 while (READ_ONCE(mnt->mnt.mnt_flags) & MNT_WRITE_HOLD) { 468 if (!IS_ENABLED(CONFIG_PREEMPT_RT)) { 469 cpu_relax(); 470 } else { 471 /* 472 * This prevents priority inversion, if the task 473 * setting MNT_WRITE_HOLD got preempted on a remote 474 * CPU, and it prevents life lock if the task setting 475 * MNT_WRITE_HOLD has a lower priority and is bound to 476 * the same CPU as the task that is spinning here. 477 */ 478 preempt_enable(); 479 lock_mount_hash(); 480 unlock_mount_hash(); 481 preempt_disable(); 482 } 483 } 484 /* 485 * The barrier pairs with the barrier sb_start_ro_state_change() making 486 * sure that if we see MNT_WRITE_HOLD cleared, we will also see 487 * s_readonly_remount set (or even SB_RDONLY / MNT_READONLY flags) in 488 * mnt_is_readonly() and bail in case we are racing with remount 489 * read-only. 490 */ 491 smp_rmb(); 492 if (mnt_is_readonly(m)) { 493 mnt_dec_writers(mnt); 494 ret = -EROFS; 495 } 496 preempt_enable(); 497 498 return ret; 499 } 500 EXPORT_SYMBOL_GPL(mnt_get_write_access); 501 502 /** 503 * mnt_want_write - get write access to a mount 504 * @m: the mount on which to take a write 505 * 506 * This tells the low-level filesystem that a write is about to be performed to 507 * it, and makes sure that writes are allowed (mount is read-write, filesystem 508 * is not frozen) before returning success. When the write operation is 509 * finished, mnt_drop_write() must be called. This is effectively a refcount. 510 */ 511 int mnt_want_write(struct vfsmount *m) 512 { 513 int ret; 514 515 sb_start_write(m->mnt_sb); 516 ret = mnt_get_write_access(m); 517 if (ret) 518 sb_end_write(m->mnt_sb); 519 return ret; 520 } 521 EXPORT_SYMBOL_GPL(mnt_want_write); 522 523 /** 524 * mnt_get_write_access_file - get write access to a file's mount 525 * @file: the file who's mount on which to take a write 526 * 527 * This is like mnt_get_write_access, but if @file is already open for write it 528 * skips incrementing mnt_writers (since the open file already has a reference) 529 * and instead only does the check for emergency r/o remounts. This must be 530 * paired with mnt_put_write_access_file. 531 */ 532 int mnt_get_write_access_file(struct file *file) 533 { 534 if (file->f_mode & FMODE_WRITER) { 535 /* 536 * Superblock may have become readonly while there are still 537 * writable fd's, e.g. due to a fs error with errors=remount-ro 538 */ 539 if (__mnt_is_readonly(file->f_path.mnt)) 540 return -EROFS; 541 return 0; 542 } 543 return mnt_get_write_access(file->f_path.mnt); 544 } 545 546 /** 547 * mnt_want_write_file - get write access to a file's mount 548 * @file: the file who's mount on which to take a write 549 * 550 * This is like mnt_want_write, but if the file is already open for writing it 551 * skips incrementing mnt_writers (since the open file already has a reference) 552 * and instead only does the freeze protection and the check for emergency r/o 553 * remounts. This must be paired with mnt_drop_write_file. 554 */ 555 int mnt_want_write_file(struct file *file) 556 { 557 int ret; 558 559 sb_start_write(file_inode(file)->i_sb); 560 ret = mnt_get_write_access_file(file); 561 if (ret) 562 sb_end_write(file_inode(file)->i_sb); 563 return ret; 564 } 565 EXPORT_SYMBOL_GPL(mnt_want_write_file); 566 567 /** 568 * mnt_put_write_access - give up write access to a mount 569 * @mnt: the mount on which to give up write access 570 * 571 * Tells the low-level filesystem that we are done 572 * performing writes to it. Must be matched with 573 * mnt_get_write_access() call above. 574 */ 575 void mnt_put_write_access(struct vfsmount *mnt) 576 { 577 preempt_disable(); 578 mnt_dec_writers(real_mount(mnt)); 579 preempt_enable(); 580 } 581 EXPORT_SYMBOL_GPL(mnt_put_write_access); 582 583 /** 584 * mnt_drop_write - give up write access to a mount 585 * @mnt: the mount on which to give up write access 586 * 587 * Tells the low-level filesystem that we are done performing writes to it and 588 * also allows filesystem to be frozen again. Must be matched with 589 * mnt_want_write() call above. 590 */ 591 void mnt_drop_write(struct vfsmount *mnt) 592 { 593 mnt_put_write_access(mnt); 594 sb_end_write(mnt->mnt_sb); 595 } 596 EXPORT_SYMBOL_GPL(mnt_drop_write); 597 598 void mnt_put_write_access_file(struct file *file) 599 { 600 if (!(file->f_mode & FMODE_WRITER)) 601 mnt_put_write_access(file->f_path.mnt); 602 } 603 604 void mnt_drop_write_file(struct file *file) 605 { 606 mnt_put_write_access_file(file); 607 sb_end_write(file_inode(file)->i_sb); 608 } 609 EXPORT_SYMBOL(mnt_drop_write_file); 610 611 /** 612 * mnt_hold_writers - prevent write access to the given mount 613 * @mnt: mnt to prevent write access to 614 * 615 * Prevents write access to @mnt if there are no active writers for @mnt. 616 * This function needs to be called and return successfully before changing 617 * properties of @mnt that need to remain stable for callers with write access 618 * to @mnt. 619 * 620 * After this functions has been called successfully callers must pair it with 621 * a call to mnt_unhold_writers() in order to stop preventing write access to 622 * @mnt. 623 * 624 * Context: This function expects lock_mount_hash() to be held serializing 625 * setting MNT_WRITE_HOLD. 626 * Return: On success 0 is returned. 627 * On error, -EBUSY is returned. 628 */ 629 static inline int mnt_hold_writers(struct mount *mnt) 630 { 631 mnt->mnt.mnt_flags |= MNT_WRITE_HOLD; 632 /* 633 * After storing MNT_WRITE_HOLD, we'll read the counters. This store 634 * should be visible before we do. 635 */ 636 smp_mb(); 637 638 /* 639 * With writers on hold, if this value is zero, then there are 640 * definitely no active writers (although held writers may subsequently 641 * increment the count, they'll have to wait, and decrement it after 642 * seeing MNT_READONLY). 643 * 644 * It is OK to have counter incremented on one CPU and decremented on 645 * another: the sum will add up correctly. The danger would be when we 646 * sum up each counter, if we read a counter before it is incremented, 647 * but then read another CPU's count which it has been subsequently 648 * decremented from -- we would see more decrements than we should. 649 * MNT_WRITE_HOLD protects against this scenario, because 650 * mnt_want_write first increments count, then smp_mb, then spins on 651 * MNT_WRITE_HOLD, so it can't be decremented by another CPU while 652 * we're counting up here. 653 */ 654 if (mnt_get_writers(mnt) > 0) 655 return -EBUSY; 656 657 return 0; 658 } 659 660 /** 661 * mnt_unhold_writers - stop preventing write access to the given mount 662 * @mnt: mnt to stop preventing write access to 663 * 664 * Stop preventing write access to @mnt allowing callers to gain write access 665 * to @mnt again. 666 * 667 * This function can only be called after a successful call to 668 * mnt_hold_writers(). 669 * 670 * Context: This function expects lock_mount_hash() to be held. 671 */ 672 static inline void mnt_unhold_writers(struct mount *mnt) 673 { 674 /* 675 * MNT_READONLY must become visible before ~MNT_WRITE_HOLD, so writers 676 * that become unheld will see MNT_READONLY. 677 */ 678 smp_wmb(); 679 mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD; 680 } 681 682 static int mnt_make_readonly(struct mount *mnt) 683 { 684 int ret; 685 686 ret = mnt_hold_writers(mnt); 687 if (!ret) 688 mnt->mnt.mnt_flags |= MNT_READONLY; 689 mnt_unhold_writers(mnt); 690 return ret; 691 } 692 693 int sb_prepare_remount_readonly(struct super_block *sb) 694 { 695 struct mount *mnt; 696 int err = 0; 697 698 /* Racy optimization. Recheck the counter under MNT_WRITE_HOLD */ 699 if (atomic_long_read(&sb->s_remove_count)) 700 return -EBUSY; 701 702 lock_mount_hash(); 703 list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) { 704 if (!(mnt->mnt.mnt_flags & MNT_READONLY)) { 705 err = mnt_hold_writers(mnt); 706 if (err) 707 break; 708 } 709 } 710 if (!err && atomic_long_read(&sb->s_remove_count)) 711 err = -EBUSY; 712 713 if (!err) 714 sb_start_ro_state_change(sb); 715 list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) { 716 if (mnt->mnt.mnt_flags & MNT_WRITE_HOLD) 717 mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD; 718 } 719 unlock_mount_hash(); 720 721 return err; 722 } 723 724 static void free_vfsmnt(struct mount *mnt) 725 { 726 mnt_idmap_put(mnt_idmap(&mnt->mnt)); 727 kfree_const(mnt->mnt_devname); 728 #ifdef CONFIG_SMP 729 free_percpu(mnt->mnt_pcp); 730 #endif 731 kmem_cache_free(mnt_cache, mnt); 732 } 733 734 static void delayed_free_vfsmnt(struct rcu_head *head) 735 { 736 free_vfsmnt(container_of(head, struct mount, mnt_rcu)); 737 } 738 739 /* call under rcu_read_lock */ 740 int __legitimize_mnt(struct vfsmount *bastard, unsigned seq) 741 { 742 struct mount *mnt; 743 if (read_seqretry(&mount_lock, seq)) 744 return 1; 745 if (bastard == NULL) 746 return 0; 747 mnt = real_mount(bastard); 748 mnt_add_count(mnt, 1); 749 smp_mb(); // see mntput_no_expire() 750 if (likely(!read_seqretry(&mount_lock, seq))) 751 return 0; 752 if (bastard->mnt_flags & MNT_SYNC_UMOUNT) { 753 mnt_add_count(mnt, -1); 754 return 1; 755 } 756 lock_mount_hash(); 757 if (unlikely(bastard->mnt_flags & MNT_DOOMED)) { 758 mnt_add_count(mnt, -1); 759 unlock_mount_hash(); 760 return 1; 761 } 762 unlock_mount_hash(); 763 /* caller will mntput() */ 764 return -1; 765 } 766 767 /* call under rcu_read_lock */ 768 static bool legitimize_mnt(struct vfsmount *bastard, unsigned seq) 769 { 770 int res = __legitimize_mnt(bastard, seq); 771 if (likely(!res)) 772 return true; 773 if (unlikely(res < 0)) { 774 rcu_read_unlock(); 775 mntput(bastard); 776 rcu_read_lock(); 777 } 778 return false; 779 } 780 781 /** 782 * __lookup_mnt - find first child mount 783 * @mnt: parent mount 784 * @dentry: mountpoint 785 * 786 * If @mnt has a child mount @c mounted @dentry find and return it. 787 * 788 * Note that the child mount @c need not be unique. There are cases 789 * where shadow mounts are created. For example, during mount 790 * propagation when a source mount @mnt whose root got overmounted by a 791 * mount @o after path lookup but before @namespace_sem could be 792 * acquired gets copied and propagated. So @mnt gets copied including 793 * @o. When @mnt is propagated to a destination mount @d that already 794 * has another mount @n mounted at the same mountpoint then the source 795 * mount @mnt will be tucked beneath @n, i.e., @n will be mounted on 796 * @mnt and @mnt mounted on @d. Now both @n and @o are mounted at @mnt 797 * on @dentry. 798 * 799 * Return: The first child of @mnt mounted @dentry or NULL. 800 */ 801 struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry) 802 { 803 struct hlist_head *head = m_hash(mnt, dentry); 804 struct mount *p; 805 806 hlist_for_each_entry_rcu(p, head, mnt_hash) 807 if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry) 808 return p; 809 return NULL; 810 } 811 812 /* 813 * lookup_mnt - Return the first child mount mounted at path 814 * 815 * "First" means first mounted chronologically. If you create the 816 * following mounts: 817 * 818 * mount /dev/sda1 /mnt 819 * mount /dev/sda2 /mnt 820 * mount /dev/sda3 /mnt 821 * 822 * Then lookup_mnt() on the base /mnt dentry in the root mount will 823 * return successively the root dentry and vfsmount of /dev/sda1, then 824 * /dev/sda2, then /dev/sda3, then NULL. 825 * 826 * lookup_mnt takes a reference to the found vfsmount. 827 */ 828 struct vfsmount *lookup_mnt(const struct path *path) 829 { 830 struct mount *child_mnt; 831 struct vfsmount *m; 832 unsigned seq; 833 834 rcu_read_lock(); 835 do { 836 seq = read_seqbegin(&mount_lock); 837 child_mnt = __lookup_mnt(path->mnt, path->dentry); 838 m = child_mnt ? &child_mnt->mnt : NULL; 839 } while (!legitimize_mnt(m, seq)); 840 rcu_read_unlock(); 841 return m; 842 } 843 844 /* 845 * __is_local_mountpoint - Test to see if dentry is a mountpoint in the 846 * current mount namespace. 847 * 848 * The common case is dentries are not mountpoints at all and that 849 * test is handled inline. For the slow case when we are actually 850 * dealing with a mountpoint of some kind, walk through all of the 851 * mounts in the current mount namespace and test to see if the dentry 852 * is a mountpoint. 853 * 854 * The mount_hashtable is not usable in the context because we 855 * need to identify all mounts that may be in the current mount 856 * namespace not just a mount that happens to have some specified 857 * parent mount. 858 */ 859 bool __is_local_mountpoint(struct dentry *dentry) 860 { 861 struct mnt_namespace *ns = current->nsproxy->mnt_ns; 862 struct mount *mnt, *n; 863 bool is_covered = false; 864 865 down_read(&namespace_sem); 866 rbtree_postorder_for_each_entry_safe(mnt, n, &ns->mounts, mnt_node) { 867 is_covered = (mnt->mnt_mountpoint == dentry); 868 if (is_covered) 869 break; 870 } 871 up_read(&namespace_sem); 872 873 return is_covered; 874 } 875 876 static struct mountpoint *lookup_mountpoint(struct dentry *dentry) 877 { 878 struct hlist_head *chain = mp_hash(dentry); 879 struct mountpoint *mp; 880 881 hlist_for_each_entry(mp, chain, m_hash) { 882 if (mp->m_dentry == dentry) { 883 mp->m_count++; 884 return mp; 885 } 886 } 887 return NULL; 888 } 889 890 static struct mountpoint *get_mountpoint(struct dentry *dentry) 891 { 892 struct mountpoint *mp, *new = NULL; 893 int ret; 894 895 if (d_mountpoint(dentry)) { 896 /* might be worth a WARN_ON() */ 897 if (d_unlinked(dentry)) 898 return ERR_PTR(-ENOENT); 899 mountpoint: 900 read_seqlock_excl(&mount_lock); 901 mp = lookup_mountpoint(dentry); 902 read_sequnlock_excl(&mount_lock); 903 if (mp) 904 goto done; 905 } 906 907 if (!new) 908 new = kmalloc(sizeof(struct mountpoint), GFP_KERNEL); 909 if (!new) 910 return ERR_PTR(-ENOMEM); 911 912 913 /* Exactly one processes may set d_mounted */ 914 ret = d_set_mounted(dentry); 915 916 /* Someone else set d_mounted? */ 917 if (ret == -EBUSY) 918 goto mountpoint; 919 920 /* The dentry is not available as a mountpoint? */ 921 mp = ERR_PTR(ret); 922 if (ret) 923 goto done; 924 925 /* Add the new mountpoint to the hash table */ 926 read_seqlock_excl(&mount_lock); 927 new->m_dentry = dget(dentry); 928 new->m_count = 1; 929 hlist_add_head(&new->m_hash, mp_hash(dentry)); 930 INIT_HLIST_HEAD(&new->m_list); 931 read_sequnlock_excl(&mount_lock); 932 933 mp = new; 934 new = NULL; 935 done: 936 kfree(new); 937 return mp; 938 } 939 940 /* 941 * vfsmount lock must be held. Additionally, the caller is responsible 942 * for serializing calls for given disposal list. 943 */ 944 static void __put_mountpoint(struct mountpoint *mp, struct list_head *list) 945 { 946 if (!--mp->m_count) { 947 struct dentry *dentry = mp->m_dentry; 948 BUG_ON(!hlist_empty(&mp->m_list)); 949 spin_lock(&dentry->d_lock); 950 dentry->d_flags &= ~DCACHE_MOUNTED; 951 spin_unlock(&dentry->d_lock); 952 dput_to_list(dentry, list); 953 hlist_del(&mp->m_hash); 954 kfree(mp); 955 } 956 } 957 958 /* called with namespace_lock and vfsmount lock */ 959 static void put_mountpoint(struct mountpoint *mp) 960 { 961 __put_mountpoint(mp, &ex_mountpoints); 962 } 963 964 static inline int check_mnt(struct mount *mnt) 965 { 966 return mnt->mnt_ns == current->nsproxy->mnt_ns; 967 } 968 969 /* 970 * vfsmount lock must be held for write 971 */ 972 static void touch_mnt_namespace(struct mnt_namespace *ns) 973 { 974 if (ns) { 975 ns->event = ++event; 976 wake_up_interruptible(&ns->poll); 977 } 978 } 979 980 /* 981 * vfsmount lock must be held for write 982 */ 983 static void __touch_mnt_namespace(struct mnt_namespace *ns) 984 { 985 if (ns && ns->event != event) { 986 ns->event = event; 987 wake_up_interruptible(&ns->poll); 988 } 989 } 990 991 /* 992 * vfsmount lock must be held for write 993 */ 994 static struct mountpoint *unhash_mnt(struct mount *mnt) 995 { 996 struct mountpoint *mp; 997 mnt->mnt_parent = mnt; 998 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 999 list_del_init(&mnt->mnt_child); 1000 hlist_del_init_rcu(&mnt->mnt_hash); 1001 hlist_del_init(&mnt->mnt_mp_list); 1002 mp = mnt->mnt_mp; 1003 mnt->mnt_mp = NULL; 1004 return mp; 1005 } 1006 1007 /* 1008 * vfsmount lock must be held for write 1009 */ 1010 static void umount_mnt(struct mount *mnt) 1011 { 1012 put_mountpoint(unhash_mnt(mnt)); 1013 } 1014 1015 /* 1016 * vfsmount lock must be held for write 1017 */ 1018 void mnt_set_mountpoint(struct mount *mnt, 1019 struct mountpoint *mp, 1020 struct mount *child_mnt) 1021 { 1022 mp->m_count++; 1023 mnt_add_count(mnt, 1); /* essentially, that's mntget */ 1024 child_mnt->mnt_mountpoint = mp->m_dentry; 1025 child_mnt->mnt_parent = mnt; 1026 child_mnt->mnt_mp = mp; 1027 hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list); 1028 } 1029 1030 /** 1031 * mnt_set_mountpoint_beneath - mount a mount beneath another one 1032 * 1033 * @new_parent: the source mount 1034 * @top_mnt: the mount beneath which @new_parent is mounted 1035 * @new_mp: the new mountpoint of @top_mnt on @new_parent 1036 * 1037 * Remove @top_mnt from its current mountpoint @top_mnt->mnt_mp and 1038 * parent @top_mnt->mnt_parent and mount it on top of @new_parent at 1039 * @new_mp. And mount @new_parent on the old parent and old 1040 * mountpoint of @top_mnt. 1041 * 1042 * Context: This function expects namespace_lock() and lock_mount_hash() 1043 * to have been acquired in that order. 1044 */ 1045 static void mnt_set_mountpoint_beneath(struct mount *new_parent, 1046 struct mount *top_mnt, 1047 struct mountpoint *new_mp) 1048 { 1049 struct mount *old_top_parent = top_mnt->mnt_parent; 1050 struct mountpoint *old_top_mp = top_mnt->mnt_mp; 1051 1052 mnt_set_mountpoint(old_top_parent, old_top_mp, new_parent); 1053 mnt_change_mountpoint(new_parent, new_mp, top_mnt); 1054 } 1055 1056 1057 static void __attach_mnt(struct mount *mnt, struct mount *parent) 1058 { 1059 hlist_add_head_rcu(&mnt->mnt_hash, 1060 m_hash(&parent->mnt, mnt->mnt_mountpoint)); 1061 list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); 1062 } 1063 1064 /** 1065 * attach_mnt - mount a mount, attach to @mount_hashtable and parent's 1066 * list of child mounts 1067 * @parent: the parent 1068 * @mnt: the new mount 1069 * @mp: the new mountpoint 1070 * @beneath: whether to mount @mnt beneath or on top of @parent 1071 * 1072 * If @beneath is false, mount @mnt at @mp on @parent. Then attach @mnt 1073 * to @parent's child mount list and to @mount_hashtable. 1074 * 1075 * If @beneath is true, remove @mnt from its current parent and 1076 * mountpoint and mount it on @mp on @parent, and mount @parent on the 1077 * old parent and old mountpoint of @mnt. Finally, attach @parent to 1078 * @mnt_hashtable and @parent->mnt_parent->mnt_mounts. 1079 * 1080 * Note, when __attach_mnt() is called @mnt->mnt_parent already points 1081 * to the correct parent. 1082 * 1083 * Context: This function expects namespace_lock() and lock_mount_hash() 1084 * to have been acquired in that order. 1085 */ 1086 static void attach_mnt(struct mount *mnt, struct mount *parent, 1087 struct mountpoint *mp, bool beneath) 1088 { 1089 if (beneath) 1090 mnt_set_mountpoint_beneath(mnt, parent, mp); 1091 else 1092 mnt_set_mountpoint(parent, mp, mnt); 1093 /* 1094 * Note, @mnt->mnt_parent has to be used. If @mnt was mounted 1095 * beneath @parent then @mnt will need to be attached to 1096 * @parent's old parent, not @parent. IOW, @mnt->mnt_parent 1097 * isn't the same mount as @parent. 1098 */ 1099 __attach_mnt(mnt, mnt->mnt_parent); 1100 } 1101 1102 void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct mount *mnt) 1103 { 1104 struct mountpoint *old_mp = mnt->mnt_mp; 1105 struct mount *old_parent = mnt->mnt_parent; 1106 1107 list_del_init(&mnt->mnt_child); 1108 hlist_del_init(&mnt->mnt_mp_list); 1109 hlist_del_init_rcu(&mnt->mnt_hash); 1110 1111 attach_mnt(mnt, parent, mp, false); 1112 1113 put_mountpoint(old_mp); 1114 mnt_add_count(old_parent, -1); 1115 } 1116 1117 static inline struct mount *node_to_mount(struct rb_node *node) 1118 { 1119 return node ? rb_entry(node, struct mount, mnt_node) : NULL; 1120 } 1121 1122 static void mnt_add_to_ns(struct mnt_namespace *ns, struct mount *mnt) 1123 { 1124 struct rb_node **link = &ns->mounts.rb_node; 1125 struct rb_node *parent = NULL; 1126 1127 WARN_ON(mnt->mnt.mnt_flags & MNT_ONRB); 1128 mnt->mnt_ns = ns; 1129 while (*link) { 1130 parent = *link; 1131 if (mnt->mnt_id_unique < node_to_mount(parent)->mnt_id_unique) 1132 link = &parent->rb_left; 1133 else 1134 link = &parent->rb_right; 1135 } 1136 rb_link_node(&mnt->mnt_node, parent, link); 1137 rb_insert_color(&mnt->mnt_node, &ns->mounts); 1138 mnt->mnt.mnt_flags |= MNT_ONRB; 1139 } 1140 1141 /* 1142 * vfsmount lock must be held for write 1143 */ 1144 static void commit_tree(struct mount *mnt) 1145 { 1146 struct mount *parent = mnt->mnt_parent; 1147 struct mount *m; 1148 LIST_HEAD(head); 1149 struct mnt_namespace *n = parent->mnt_ns; 1150 1151 BUG_ON(parent == mnt); 1152 1153 list_add_tail(&head, &mnt->mnt_list); 1154 while (!list_empty(&head)) { 1155 m = list_first_entry(&head, typeof(*m), mnt_list); 1156 list_del(&m->mnt_list); 1157 1158 mnt_add_to_ns(n, m); 1159 } 1160 n->nr_mounts += n->pending_mounts; 1161 n->pending_mounts = 0; 1162 1163 __attach_mnt(mnt, parent); 1164 touch_mnt_namespace(n); 1165 } 1166 1167 static struct mount *next_mnt(struct mount *p, struct mount *root) 1168 { 1169 struct list_head *next = p->mnt_mounts.next; 1170 if (next == &p->mnt_mounts) { 1171 while (1) { 1172 if (p == root) 1173 return NULL; 1174 next = p->mnt_child.next; 1175 if (next != &p->mnt_parent->mnt_mounts) 1176 break; 1177 p = p->mnt_parent; 1178 } 1179 } 1180 return list_entry(next, struct mount, mnt_child); 1181 } 1182 1183 static struct mount *skip_mnt_tree(struct mount *p) 1184 { 1185 struct list_head *prev = p->mnt_mounts.prev; 1186 while (prev != &p->mnt_mounts) { 1187 p = list_entry(prev, struct mount, mnt_child); 1188 prev = p->mnt_mounts.prev; 1189 } 1190 return p; 1191 } 1192 1193 /** 1194 * vfs_create_mount - Create a mount for a configured superblock 1195 * @fc: The configuration context with the superblock attached 1196 * 1197 * Create a mount to an already configured superblock. If necessary, the 1198 * caller should invoke vfs_get_tree() before calling this. 1199 * 1200 * Note that this does not attach the mount to anything. 1201 */ 1202 struct vfsmount *vfs_create_mount(struct fs_context *fc) 1203 { 1204 struct mount *mnt; 1205 1206 if (!fc->root) 1207 return ERR_PTR(-EINVAL); 1208 1209 mnt = alloc_vfsmnt(fc->source ?: "none"); 1210 if (!mnt) 1211 return ERR_PTR(-ENOMEM); 1212 1213 if (fc->sb_flags & SB_KERNMOUNT) 1214 mnt->mnt.mnt_flags = MNT_INTERNAL; 1215 1216 atomic_inc(&fc->root->d_sb->s_active); 1217 mnt->mnt.mnt_sb = fc->root->d_sb; 1218 mnt->mnt.mnt_root = dget(fc->root); 1219 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 1220 mnt->mnt_parent = mnt; 1221 1222 lock_mount_hash(); 1223 list_add_tail(&mnt->mnt_instance, &mnt->mnt.mnt_sb->s_mounts); 1224 unlock_mount_hash(); 1225 return &mnt->mnt; 1226 } 1227 EXPORT_SYMBOL(vfs_create_mount); 1228 1229 struct vfsmount *fc_mount(struct fs_context *fc) 1230 { 1231 int err = vfs_get_tree(fc); 1232 if (!err) { 1233 up_write(&fc->root->d_sb->s_umount); 1234 return vfs_create_mount(fc); 1235 } 1236 return ERR_PTR(err); 1237 } 1238 EXPORT_SYMBOL(fc_mount); 1239 1240 struct vfsmount *vfs_kern_mount(struct file_system_type *type, 1241 int flags, const char *name, 1242 void *data) 1243 { 1244 struct fs_context *fc; 1245 struct vfsmount *mnt; 1246 int ret = 0; 1247 1248 if (!type) 1249 return ERR_PTR(-EINVAL); 1250 1251 fc = fs_context_for_mount(type, flags); 1252 if (IS_ERR(fc)) 1253 return ERR_CAST(fc); 1254 1255 if (name) 1256 ret = vfs_parse_fs_string(fc, "source", 1257 name, strlen(name)); 1258 if (!ret) 1259 ret = parse_monolithic_mount_data(fc, data); 1260 if (!ret) 1261 mnt = fc_mount(fc); 1262 else 1263 mnt = ERR_PTR(ret); 1264 1265 put_fs_context(fc); 1266 return mnt; 1267 } 1268 EXPORT_SYMBOL_GPL(vfs_kern_mount); 1269 1270 struct vfsmount * 1271 vfs_submount(const struct dentry *mountpoint, struct file_system_type *type, 1272 const char *name, void *data) 1273 { 1274 /* Until it is worked out how to pass the user namespace 1275 * through from the parent mount to the submount don't support 1276 * unprivileged mounts with submounts. 1277 */ 1278 if (mountpoint->d_sb->s_user_ns != &init_user_ns) 1279 return ERR_PTR(-EPERM); 1280 1281 return vfs_kern_mount(type, SB_SUBMOUNT, name, data); 1282 } 1283 EXPORT_SYMBOL_GPL(vfs_submount); 1284 1285 static struct mount *clone_mnt(struct mount *old, struct dentry *root, 1286 int flag) 1287 { 1288 struct super_block *sb = old->mnt.mnt_sb; 1289 struct mount *mnt; 1290 int err; 1291 1292 mnt = alloc_vfsmnt(old->mnt_devname); 1293 if (!mnt) 1294 return ERR_PTR(-ENOMEM); 1295 1296 if (flag & (CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE)) 1297 mnt->mnt_group_id = 0; /* not a peer of original */ 1298 else 1299 mnt->mnt_group_id = old->mnt_group_id; 1300 1301 if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) { 1302 err = mnt_alloc_group_id(mnt); 1303 if (err) 1304 goto out_free; 1305 } 1306 1307 mnt->mnt.mnt_flags = old->mnt.mnt_flags; 1308 mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL|MNT_ONRB); 1309 1310 atomic_inc(&sb->s_active); 1311 mnt->mnt.mnt_idmap = mnt_idmap_get(mnt_idmap(&old->mnt)); 1312 1313 mnt->mnt.mnt_sb = sb; 1314 mnt->mnt.mnt_root = dget(root); 1315 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 1316 mnt->mnt_parent = mnt; 1317 lock_mount_hash(); 1318 list_add_tail(&mnt->mnt_instance, &sb->s_mounts); 1319 unlock_mount_hash(); 1320 1321 if ((flag & CL_SLAVE) || 1322 ((flag & CL_SHARED_TO_SLAVE) && IS_MNT_SHARED(old))) { 1323 list_add(&mnt->mnt_slave, &old->mnt_slave_list); 1324 mnt->mnt_master = old; 1325 CLEAR_MNT_SHARED(mnt); 1326 } else if (!(flag & CL_PRIVATE)) { 1327 if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old)) 1328 list_add(&mnt->mnt_share, &old->mnt_share); 1329 if (IS_MNT_SLAVE(old)) 1330 list_add(&mnt->mnt_slave, &old->mnt_slave); 1331 mnt->mnt_master = old->mnt_master; 1332 } else { 1333 CLEAR_MNT_SHARED(mnt); 1334 } 1335 if (flag & CL_MAKE_SHARED) 1336 set_mnt_shared(mnt); 1337 1338 /* stick the duplicate mount on the same expiry list 1339 * as the original if that was on one */ 1340 if (flag & CL_EXPIRE) { 1341 if (!list_empty(&old->mnt_expire)) 1342 list_add(&mnt->mnt_expire, &old->mnt_expire); 1343 } 1344 1345 return mnt; 1346 1347 out_free: 1348 mnt_free_id(mnt); 1349 free_vfsmnt(mnt); 1350 return ERR_PTR(err); 1351 } 1352 1353 static void cleanup_mnt(struct mount *mnt) 1354 { 1355 struct hlist_node *p; 1356 struct mount *m; 1357 /* 1358 * The warning here probably indicates that somebody messed 1359 * up a mnt_want/drop_write() pair. If this happens, the 1360 * filesystem was probably unable to make r/w->r/o transitions. 1361 * The locking used to deal with mnt_count decrement provides barriers, 1362 * so mnt_get_writers() below is safe. 1363 */ 1364 WARN_ON(mnt_get_writers(mnt)); 1365 if (unlikely(mnt->mnt_pins.first)) 1366 mnt_pin_kill(mnt); 1367 hlist_for_each_entry_safe(m, p, &mnt->mnt_stuck_children, mnt_umount) { 1368 hlist_del(&m->mnt_umount); 1369 mntput(&m->mnt); 1370 } 1371 fsnotify_vfsmount_delete(&mnt->mnt); 1372 dput(mnt->mnt.mnt_root); 1373 deactivate_super(mnt->mnt.mnt_sb); 1374 mnt_free_id(mnt); 1375 call_rcu(&mnt->mnt_rcu, delayed_free_vfsmnt); 1376 } 1377 1378 static void __cleanup_mnt(struct rcu_head *head) 1379 { 1380 cleanup_mnt(container_of(head, struct mount, mnt_rcu)); 1381 } 1382 1383 static LLIST_HEAD(delayed_mntput_list); 1384 static void delayed_mntput(struct work_struct *unused) 1385 { 1386 struct llist_node *node = llist_del_all(&delayed_mntput_list); 1387 struct mount *m, *t; 1388 1389 llist_for_each_entry_safe(m, t, node, mnt_llist) 1390 cleanup_mnt(m); 1391 } 1392 static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput); 1393 1394 static void mntput_no_expire(struct mount *mnt) 1395 { 1396 LIST_HEAD(list); 1397 int count; 1398 1399 rcu_read_lock(); 1400 if (likely(READ_ONCE(mnt->mnt_ns))) { 1401 /* 1402 * Since we don't do lock_mount_hash() here, 1403 * ->mnt_ns can change under us. However, if it's 1404 * non-NULL, then there's a reference that won't 1405 * be dropped until after an RCU delay done after 1406 * turning ->mnt_ns NULL. So if we observe it 1407 * non-NULL under rcu_read_lock(), the reference 1408 * we are dropping is not the final one. 1409 */ 1410 mnt_add_count(mnt, -1); 1411 rcu_read_unlock(); 1412 return; 1413 } 1414 lock_mount_hash(); 1415 /* 1416 * make sure that if __legitimize_mnt() has not seen us grab 1417 * mount_lock, we'll see their refcount increment here. 1418 */ 1419 smp_mb(); 1420 mnt_add_count(mnt, -1); 1421 count = mnt_get_count(mnt); 1422 if (count != 0) { 1423 WARN_ON(count < 0); 1424 rcu_read_unlock(); 1425 unlock_mount_hash(); 1426 return; 1427 } 1428 if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) { 1429 rcu_read_unlock(); 1430 unlock_mount_hash(); 1431 return; 1432 } 1433 mnt->mnt.mnt_flags |= MNT_DOOMED; 1434 rcu_read_unlock(); 1435 1436 list_del(&mnt->mnt_instance); 1437 1438 if (unlikely(!list_empty(&mnt->mnt_mounts))) { 1439 struct mount *p, *tmp; 1440 list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts, mnt_child) { 1441 __put_mountpoint(unhash_mnt(p), &list); 1442 hlist_add_head(&p->mnt_umount, &mnt->mnt_stuck_children); 1443 } 1444 } 1445 unlock_mount_hash(); 1446 shrink_dentry_list(&list); 1447 1448 if (likely(!(mnt->mnt.mnt_flags & MNT_INTERNAL))) { 1449 struct task_struct *task = current; 1450 if (likely(!(task->flags & PF_KTHREAD))) { 1451 init_task_work(&mnt->mnt_rcu, __cleanup_mnt); 1452 if (!task_work_add(task, &mnt->mnt_rcu, TWA_RESUME)) 1453 return; 1454 } 1455 if (llist_add(&mnt->mnt_llist, &delayed_mntput_list)) 1456 schedule_delayed_work(&delayed_mntput_work, 1); 1457 return; 1458 } 1459 cleanup_mnt(mnt); 1460 } 1461 1462 void mntput(struct vfsmount *mnt) 1463 { 1464 if (mnt) { 1465 struct mount *m = real_mount(mnt); 1466 /* avoid cacheline pingpong */ 1467 if (unlikely(m->mnt_expiry_mark)) 1468 WRITE_ONCE(m->mnt_expiry_mark, 0); 1469 mntput_no_expire(m); 1470 } 1471 } 1472 EXPORT_SYMBOL(mntput); 1473 1474 struct vfsmount *mntget(struct vfsmount *mnt) 1475 { 1476 if (mnt) 1477 mnt_add_count(real_mount(mnt), 1); 1478 return mnt; 1479 } 1480 EXPORT_SYMBOL(mntget); 1481 1482 /* 1483 * Make a mount point inaccessible to new lookups. 1484 * Because there may still be current users, the caller MUST WAIT 1485 * for an RCU grace period before destroying the mount point. 1486 */ 1487 void mnt_make_shortterm(struct vfsmount *mnt) 1488 { 1489 if (mnt) 1490 real_mount(mnt)->mnt_ns = NULL; 1491 } 1492 1493 /** 1494 * path_is_mountpoint() - Check if path is a mount in the current namespace. 1495 * @path: path to check 1496 * 1497 * d_mountpoint() can only be used reliably to establish if a dentry is 1498 * not mounted in any namespace and that common case is handled inline. 1499 * d_mountpoint() isn't aware of the possibility there may be multiple 1500 * mounts using a given dentry in a different namespace. This function 1501 * checks if the passed in path is a mountpoint rather than the dentry 1502 * alone. 1503 */ 1504 bool path_is_mountpoint(const struct path *path) 1505 { 1506 unsigned seq; 1507 bool res; 1508 1509 if (!d_mountpoint(path->dentry)) 1510 return false; 1511 1512 rcu_read_lock(); 1513 do { 1514 seq = read_seqbegin(&mount_lock); 1515 res = __path_is_mountpoint(path); 1516 } while (read_seqretry(&mount_lock, seq)); 1517 rcu_read_unlock(); 1518 1519 return res; 1520 } 1521 EXPORT_SYMBOL(path_is_mountpoint); 1522 1523 struct vfsmount *mnt_clone_internal(const struct path *path) 1524 { 1525 struct mount *p; 1526 p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE); 1527 if (IS_ERR(p)) 1528 return ERR_CAST(p); 1529 p->mnt.mnt_flags |= MNT_INTERNAL; 1530 return &p->mnt; 1531 } 1532 1533 /* 1534 * Returns the mount which either has the specified mnt_id, or has the next 1535 * smallest id afer the specified one. 1536 */ 1537 static struct mount *mnt_find_id_at(struct mnt_namespace *ns, u64 mnt_id) 1538 { 1539 struct rb_node *node = ns->mounts.rb_node; 1540 struct mount *ret = NULL; 1541 1542 while (node) { 1543 struct mount *m = node_to_mount(node); 1544 1545 if (mnt_id <= m->mnt_id_unique) { 1546 ret = node_to_mount(node); 1547 if (mnt_id == m->mnt_id_unique) 1548 break; 1549 node = node->rb_left; 1550 } else { 1551 node = node->rb_right; 1552 } 1553 } 1554 return ret; 1555 } 1556 1557 /* 1558 * Returns the mount which either has the specified mnt_id, or has the next 1559 * greater id before the specified one. 1560 */ 1561 static struct mount *mnt_find_id_at_reverse(struct mnt_namespace *ns, u64 mnt_id) 1562 { 1563 struct rb_node *node = ns->mounts.rb_node; 1564 struct mount *ret = NULL; 1565 1566 while (node) { 1567 struct mount *m = node_to_mount(node); 1568 1569 if (mnt_id >= m->mnt_id_unique) { 1570 ret = node_to_mount(node); 1571 if (mnt_id == m->mnt_id_unique) 1572 break; 1573 node = node->rb_right; 1574 } else { 1575 node = node->rb_left; 1576 } 1577 } 1578 return ret; 1579 } 1580 1581 #ifdef CONFIG_PROC_FS 1582 1583 /* iterator; we want it to have access to namespace_sem, thus here... */ 1584 static void *m_start(struct seq_file *m, loff_t *pos) 1585 { 1586 struct proc_mounts *p = m->private; 1587 1588 down_read(&namespace_sem); 1589 1590 return mnt_find_id_at(p->ns, *pos); 1591 } 1592 1593 static void *m_next(struct seq_file *m, void *v, loff_t *pos) 1594 { 1595 struct mount *next = NULL, *mnt = v; 1596 struct rb_node *node = rb_next(&mnt->mnt_node); 1597 1598 ++*pos; 1599 if (node) { 1600 next = node_to_mount(node); 1601 *pos = next->mnt_id_unique; 1602 } 1603 return next; 1604 } 1605 1606 static void m_stop(struct seq_file *m, void *v) 1607 { 1608 up_read(&namespace_sem); 1609 } 1610 1611 static int m_show(struct seq_file *m, void *v) 1612 { 1613 struct proc_mounts *p = m->private; 1614 struct mount *r = v; 1615 return p->show(m, &r->mnt); 1616 } 1617 1618 const struct seq_operations mounts_op = { 1619 .start = m_start, 1620 .next = m_next, 1621 .stop = m_stop, 1622 .show = m_show, 1623 }; 1624 1625 #endif /* CONFIG_PROC_FS */ 1626 1627 /** 1628 * may_umount_tree - check if a mount tree is busy 1629 * @m: root of mount tree 1630 * 1631 * This is called to check if a tree of mounts has any 1632 * open files, pwds, chroots or sub mounts that are 1633 * busy. 1634 */ 1635 int may_umount_tree(struct vfsmount *m) 1636 { 1637 struct mount *mnt = real_mount(m); 1638 int actual_refs = 0; 1639 int minimum_refs = 0; 1640 struct mount *p; 1641 BUG_ON(!m); 1642 1643 /* write lock needed for mnt_get_count */ 1644 lock_mount_hash(); 1645 for (p = mnt; p; p = next_mnt(p, mnt)) { 1646 actual_refs += mnt_get_count(p); 1647 minimum_refs += 2; 1648 } 1649 unlock_mount_hash(); 1650 1651 if (actual_refs > minimum_refs) 1652 return 0; 1653 1654 return 1; 1655 } 1656 1657 EXPORT_SYMBOL(may_umount_tree); 1658 1659 /** 1660 * may_umount - check if a mount point is busy 1661 * @mnt: root of mount 1662 * 1663 * This is called to check if a mount point has any 1664 * open files, pwds, chroots or sub mounts. If the 1665 * mount has sub mounts this will return busy 1666 * regardless of whether the sub mounts are busy. 1667 * 1668 * Doesn't take quota and stuff into account. IOW, in some cases it will 1669 * give false negatives. The main reason why it's here is that we need 1670 * a non-destructive way to look for easily umountable filesystems. 1671 */ 1672 int may_umount(struct vfsmount *mnt) 1673 { 1674 int ret = 1; 1675 down_read(&namespace_sem); 1676 lock_mount_hash(); 1677 if (propagate_mount_busy(real_mount(mnt), 2)) 1678 ret = 0; 1679 unlock_mount_hash(); 1680 up_read(&namespace_sem); 1681 return ret; 1682 } 1683 1684 EXPORT_SYMBOL(may_umount); 1685 1686 static void namespace_unlock(void) 1687 { 1688 struct hlist_head head; 1689 struct hlist_node *p; 1690 struct mount *m; 1691 LIST_HEAD(list); 1692 1693 hlist_move_list(&unmounted, &head); 1694 list_splice_init(&ex_mountpoints, &list); 1695 1696 up_write(&namespace_sem); 1697 1698 shrink_dentry_list(&list); 1699 1700 if (likely(hlist_empty(&head))) 1701 return; 1702 1703 synchronize_rcu_expedited(); 1704 1705 hlist_for_each_entry_safe(m, p, &head, mnt_umount) { 1706 hlist_del(&m->mnt_umount); 1707 mntput(&m->mnt); 1708 } 1709 } 1710 1711 static inline void namespace_lock(void) 1712 { 1713 down_write(&namespace_sem); 1714 } 1715 1716 enum umount_tree_flags { 1717 UMOUNT_SYNC = 1, 1718 UMOUNT_PROPAGATE = 2, 1719 UMOUNT_CONNECTED = 4, 1720 }; 1721 1722 static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how) 1723 { 1724 /* Leaving mounts connected is only valid for lazy umounts */ 1725 if (how & UMOUNT_SYNC) 1726 return true; 1727 1728 /* A mount without a parent has nothing to be connected to */ 1729 if (!mnt_has_parent(mnt)) 1730 return true; 1731 1732 /* Because the reference counting rules change when mounts are 1733 * unmounted and connected, umounted mounts may not be 1734 * connected to mounted mounts. 1735 */ 1736 if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) 1737 return true; 1738 1739 /* Has it been requested that the mount remain connected? */ 1740 if (how & UMOUNT_CONNECTED) 1741 return false; 1742 1743 /* Is the mount locked such that it needs to remain connected? */ 1744 if (IS_MNT_LOCKED(mnt)) 1745 return false; 1746 1747 /* By default disconnect the mount */ 1748 return true; 1749 } 1750 1751 /* 1752 * mount_lock must be held 1753 * namespace_sem must be held for write 1754 */ 1755 static void umount_tree(struct mount *mnt, enum umount_tree_flags how) 1756 { 1757 LIST_HEAD(tmp_list); 1758 struct mount *p; 1759 1760 if (how & UMOUNT_PROPAGATE) 1761 propagate_mount_unlock(mnt); 1762 1763 /* Gather the mounts to umount */ 1764 for (p = mnt; p; p = next_mnt(p, mnt)) { 1765 p->mnt.mnt_flags |= MNT_UMOUNT; 1766 if (p->mnt.mnt_flags & MNT_ONRB) 1767 move_from_ns(p, &tmp_list); 1768 else 1769 list_move(&p->mnt_list, &tmp_list); 1770 } 1771 1772 /* Hide the mounts from mnt_mounts */ 1773 list_for_each_entry(p, &tmp_list, mnt_list) { 1774 list_del_init(&p->mnt_child); 1775 } 1776 1777 /* Add propagated mounts to the tmp_list */ 1778 if (how & UMOUNT_PROPAGATE) 1779 propagate_umount(&tmp_list); 1780 1781 while (!list_empty(&tmp_list)) { 1782 struct mnt_namespace *ns; 1783 bool disconnect; 1784 p = list_first_entry(&tmp_list, struct mount, mnt_list); 1785 list_del_init(&p->mnt_expire); 1786 list_del_init(&p->mnt_list); 1787 ns = p->mnt_ns; 1788 if (ns) { 1789 ns->nr_mounts--; 1790 __touch_mnt_namespace(ns); 1791 } 1792 p->mnt_ns = NULL; 1793 if (how & UMOUNT_SYNC) 1794 p->mnt.mnt_flags |= MNT_SYNC_UMOUNT; 1795 1796 disconnect = disconnect_mount(p, how); 1797 if (mnt_has_parent(p)) { 1798 mnt_add_count(p->mnt_parent, -1); 1799 if (!disconnect) { 1800 /* Don't forget about p */ 1801 list_add_tail(&p->mnt_child, &p->mnt_parent->mnt_mounts); 1802 } else { 1803 umount_mnt(p); 1804 } 1805 } 1806 change_mnt_propagation(p, MS_PRIVATE); 1807 if (disconnect) 1808 hlist_add_head(&p->mnt_umount, &unmounted); 1809 } 1810 } 1811 1812 static void shrink_submounts(struct mount *mnt); 1813 1814 static int do_umount_root(struct super_block *sb) 1815 { 1816 int ret = 0; 1817 1818 down_write(&sb->s_umount); 1819 if (!sb_rdonly(sb)) { 1820 struct fs_context *fc; 1821 1822 fc = fs_context_for_reconfigure(sb->s_root, SB_RDONLY, 1823 SB_RDONLY); 1824 if (IS_ERR(fc)) { 1825 ret = PTR_ERR(fc); 1826 } else { 1827 ret = parse_monolithic_mount_data(fc, NULL); 1828 if (!ret) 1829 ret = reconfigure_super(fc); 1830 put_fs_context(fc); 1831 } 1832 } 1833 up_write(&sb->s_umount); 1834 return ret; 1835 } 1836 1837 static int do_umount(struct mount *mnt, int flags) 1838 { 1839 struct super_block *sb = mnt->mnt.mnt_sb; 1840 int retval; 1841 1842 retval = security_sb_umount(&mnt->mnt, flags); 1843 if (retval) 1844 return retval; 1845 1846 /* 1847 * Allow userspace to request a mountpoint be expired rather than 1848 * unmounting unconditionally. Unmount only happens if: 1849 * (1) the mark is already set (the mark is cleared by mntput()) 1850 * (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount] 1851 */ 1852 if (flags & MNT_EXPIRE) { 1853 if (&mnt->mnt == current->fs->root.mnt || 1854 flags & (MNT_FORCE | MNT_DETACH)) 1855 return -EINVAL; 1856 1857 /* 1858 * probably don't strictly need the lock here if we examined 1859 * all race cases, but it's a slowpath. 1860 */ 1861 lock_mount_hash(); 1862 if (mnt_get_count(mnt) != 2) { 1863 unlock_mount_hash(); 1864 return -EBUSY; 1865 } 1866 unlock_mount_hash(); 1867 1868 if (!xchg(&mnt->mnt_expiry_mark, 1)) 1869 return -EAGAIN; 1870 } 1871 1872 /* 1873 * If we may have to abort operations to get out of this 1874 * mount, and they will themselves hold resources we must 1875 * allow the fs to do things. In the Unix tradition of 1876 * 'Gee thats tricky lets do it in userspace' the umount_begin 1877 * might fail to complete on the first run through as other tasks 1878 * must return, and the like. Thats for the mount program to worry 1879 * about for the moment. 1880 */ 1881 1882 if (flags & MNT_FORCE && sb->s_op->umount_begin) { 1883 sb->s_op->umount_begin(sb); 1884 } 1885 1886 /* 1887 * No sense to grab the lock for this test, but test itself looks 1888 * somewhat bogus. Suggestions for better replacement? 1889 * Ho-hum... In principle, we might treat that as umount + switch 1890 * to rootfs. GC would eventually take care of the old vfsmount. 1891 * Actually it makes sense, especially if rootfs would contain a 1892 * /reboot - static binary that would close all descriptors and 1893 * call reboot(9). Then init(8) could umount root and exec /reboot. 1894 */ 1895 if (&mnt->mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) { 1896 /* 1897 * Special case for "unmounting" root ... 1898 * we just try to remount it readonly. 1899 */ 1900 if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) 1901 return -EPERM; 1902 return do_umount_root(sb); 1903 } 1904 1905 namespace_lock(); 1906 lock_mount_hash(); 1907 1908 /* Recheck MNT_LOCKED with the locks held */ 1909 retval = -EINVAL; 1910 if (mnt->mnt.mnt_flags & MNT_LOCKED) 1911 goto out; 1912 1913 event++; 1914 if (flags & MNT_DETACH) { 1915 if (mnt->mnt.mnt_flags & MNT_ONRB || 1916 !list_empty(&mnt->mnt_list)) 1917 umount_tree(mnt, UMOUNT_PROPAGATE); 1918 retval = 0; 1919 } else { 1920 shrink_submounts(mnt); 1921 retval = -EBUSY; 1922 if (!propagate_mount_busy(mnt, 2)) { 1923 if (mnt->mnt.mnt_flags & MNT_ONRB || 1924 !list_empty(&mnt->mnt_list)) 1925 umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC); 1926 retval = 0; 1927 } 1928 } 1929 out: 1930 unlock_mount_hash(); 1931 namespace_unlock(); 1932 return retval; 1933 } 1934 1935 /* 1936 * __detach_mounts - lazily unmount all mounts on the specified dentry 1937 * 1938 * During unlink, rmdir, and d_drop it is possible to loose the path 1939 * to an existing mountpoint, and wind up leaking the mount. 1940 * detach_mounts allows lazily unmounting those mounts instead of 1941 * leaking them. 1942 * 1943 * The caller may hold dentry->d_inode->i_mutex. 1944 */ 1945 void __detach_mounts(struct dentry *dentry) 1946 { 1947 struct mountpoint *mp; 1948 struct mount *mnt; 1949 1950 namespace_lock(); 1951 lock_mount_hash(); 1952 mp = lookup_mountpoint(dentry); 1953 if (!mp) 1954 goto out_unlock; 1955 1956 event++; 1957 while (!hlist_empty(&mp->m_list)) { 1958 mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list); 1959 if (mnt->mnt.mnt_flags & MNT_UMOUNT) { 1960 umount_mnt(mnt); 1961 hlist_add_head(&mnt->mnt_umount, &unmounted); 1962 } 1963 else umount_tree(mnt, UMOUNT_CONNECTED); 1964 } 1965 put_mountpoint(mp); 1966 out_unlock: 1967 unlock_mount_hash(); 1968 namespace_unlock(); 1969 } 1970 1971 /* 1972 * Is the caller allowed to modify his namespace? 1973 */ 1974 bool may_mount(void) 1975 { 1976 return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN); 1977 } 1978 1979 static void warn_mandlock(void) 1980 { 1981 pr_warn_once("=======================================================\n" 1982 "WARNING: The mand mount option has been deprecated and\n" 1983 " and is ignored by this kernel. Remove the mand\n" 1984 " option from the mount to silence this warning.\n" 1985 "=======================================================\n"); 1986 } 1987 1988 static int can_umount(const struct path *path, int flags) 1989 { 1990 struct mount *mnt = real_mount(path->mnt); 1991 1992 if (!may_mount()) 1993 return -EPERM; 1994 if (!path_mounted(path)) 1995 return -EINVAL; 1996 if (!check_mnt(mnt)) 1997 return -EINVAL; 1998 if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */ 1999 return -EINVAL; 2000 if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN)) 2001 return -EPERM; 2002 return 0; 2003 } 2004 2005 // caller is responsible for flags being sane 2006 int path_umount(struct path *path, int flags) 2007 { 2008 struct mount *mnt = real_mount(path->mnt); 2009 int ret; 2010 2011 ret = can_umount(path, flags); 2012 if (!ret) 2013 ret = do_umount(mnt, flags); 2014 2015 /* we mustn't call path_put() as that would clear mnt_expiry_mark */ 2016 dput(path->dentry); 2017 mntput_no_expire(mnt); 2018 return ret; 2019 } 2020 2021 static int ksys_umount(char __user *name, int flags) 2022 { 2023 int lookup_flags = LOOKUP_MOUNTPOINT; 2024 struct path path; 2025 int ret; 2026 2027 // basic validity checks done first 2028 if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW)) 2029 return -EINVAL; 2030 2031 if (!(flags & UMOUNT_NOFOLLOW)) 2032 lookup_flags |= LOOKUP_FOLLOW; 2033 ret = user_path_at(AT_FDCWD, name, lookup_flags, &path); 2034 if (ret) 2035 return ret; 2036 return path_umount(&path, flags); 2037 } 2038 2039 SYSCALL_DEFINE2(umount, char __user *, name, int, flags) 2040 { 2041 return ksys_umount(name, flags); 2042 } 2043 2044 #ifdef __ARCH_WANT_SYS_OLDUMOUNT 2045 2046 /* 2047 * The 2.0 compatible umount. No flags. 2048 */ 2049 SYSCALL_DEFINE1(oldumount, char __user *, name) 2050 { 2051 return ksys_umount(name, 0); 2052 } 2053 2054 #endif 2055 2056 static bool is_mnt_ns_file(struct dentry *dentry) 2057 { 2058 /* Is this a proxy for a mount namespace? */ 2059 return dentry->d_op == &ns_dentry_operations && 2060 dentry->d_fsdata == &mntns_operations; 2061 } 2062 2063 struct ns_common *from_mnt_ns(struct mnt_namespace *mnt) 2064 { 2065 return &mnt->ns; 2066 } 2067 2068 struct mnt_namespace *__lookup_next_mnt_ns(struct mnt_namespace *mntns, bool previous) 2069 { 2070 guard(read_lock)(&mnt_ns_tree_lock); 2071 for (;;) { 2072 struct rb_node *node; 2073 2074 if (previous) 2075 node = rb_prev(&mntns->mnt_ns_tree_node); 2076 else 2077 node = rb_next(&mntns->mnt_ns_tree_node); 2078 if (!node) 2079 return ERR_PTR(-ENOENT); 2080 2081 mntns = node_to_mnt_ns(node); 2082 node = &mntns->mnt_ns_tree_node; 2083 2084 if (!ns_capable_noaudit(mntns->user_ns, CAP_SYS_ADMIN)) 2085 continue; 2086 2087 /* 2088 * Holding mnt_ns_tree_lock prevents the mount namespace from 2089 * being freed but it may well be on it's deathbed. We want an 2090 * active reference, not just a passive one here as we're 2091 * persisting the mount namespace. 2092 */ 2093 if (!refcount_inc_not_zero(&mntns->ns.count)) 2094 continue; 2095 2096 return mntns; 2097 } 2098 } 2099 2100 static bool mnt_ns_loop(struct dentry *dentry) 2101 { 2102 /* Could bind mounting the mount namespace inode cause a 2103 * mount namespace loop? 2104 */ 2105 struct mnt_namespace *mnt_ns; 2106 if (!is_mnt_ns_file(dentry)) 2107 return false; 2108 2109 mnt_ns = to_mnt_ns(get_proc_ns(dentry->d_inode)); 2110 return current->nsproxy->mnt_ns->seq >= mnt_ns->seq; 2111 } 2112 2113 struct mount *copy_tree(struct mount *src_root, struct dentry *dentry, 2114 int flag) 2115 { 2116 struct mount *res, *src_parent, *src_root_child, *src_mnt, 2117 *dst_parent, *dst_mnt; 2118 2119 if (!(flag & CL_COPY_UNBINDABLE) && IS_MNT_UNBINDABLE(src_root)) 2120 return ERR_PTR(-EINVAL); 2121 2122 if (!(flag & CL_COPY_MNT_NS_FILE) && is_mnt_ns_file(dentry)) 2123 return ERR_PTR(-EINVAL); 2124 2125 res = dst_mnt = clone_mnt(src_root, dentry, flag); 2126 if (IS_ERR(dst_mnt)) 2127 return dst_mnt; 2128 2129 src_parent = src_root; 2130 dst_mnt->mnt_mountpoint = src_root->mnt_mountpoint; 2131 2132 list_for_each_entry(src_root_child, &src_root->mnt_mounts, mnt_child) { 2133 if (!is_subdir(src_root_child->mnt_mountpoint, dentry)) 2134 continue; 2135 2136 for (src_mnt = src_root_child; src_mnt; 2137 src_mnt = next_mnt(src_mnt, src_root_child)) { 2138 if (!(flag & CL_COPY_UNBINDABLE) && 2139 IS_MNT_UNBINDABLE(src_mnt)) { 2140 if (src_mnt->mnt.mnt_flags & MNT_LOCKED) { 2141 /* Both unbindable and locked. */ 2142 dst_mnt = ERR_PTR(-EPERM); 2143 goto out; 2144 } else { 2145 src_mnt = skip_mnt_tree(src_mnt); 2146 continue; 2147 } 2148 } 2149 if (!(flag & CL_COPY_MNT_NS_FILE) && 2150 is_mnt_ns_file(src_mnt->mnt.mnt_root)) { 2151 src_mnt = skip_mnt_tree(src_mnt); 2152 continue; 2153 } 2154 while (src_parent != src_mnt->mnt_parent) { 2155 src_parent = src_parent->mnt_parent; 2156 dst_mnt = dst_mnt->mnt_parent; 2157 } 2158 2159 src_parent = src_mnt; 2160 dst_parent = dst_mnt; 2161 dst_mnt = clone_mnt(src_mnt, src_mnt->mnt.mnt_root, flag); 2162 if (IS_ERR(dst_mnt)) 2163 goto out; 2164 lock_mount_hash(); 2165 list_add_tail(&dst_mnt->mnt_list, &res->mnt_list); 2166 attach_mnt(dst_mnt, dst_parent, src_parent->mnt_mp, false); 2167 unlock_mount_hash(); 2168 } 2169 } 2170 return res; 2171 2172 out: 2173 if (res) { 2174 lock_mount_hash(); 2175 umount_tree(res, UMOUNT_SYNC); 2176 unlock_mount_hash(); 2177 } 2178 return dst_mnt; 2179 } 2180 2181 /* Caller should check returned pointer for errors */ 2182 2183 struct vfsmount *collect_mounts(const struct path *path) 2184 { 2185 struct mount *tree; 2186 namespace_lock(); 2187 if (!check_mnt(real_mount(path->mnt))) 2188 tree = ERR_PTR(-EINVAL); 2189 else 2190 tree = copy_tree(real_mount(path->mnt), path->dentry, 2191 CL_COPY_ALL | CL_PRIVATE); 2192 namespace_unlock(); 2193 if (IS_ERR(tree)) 2194 return ERR_CAST(tree); 2195 return &tree->mnt; 2196 } 2197 2198 static void free_mnt_ns(struct mnt_namespace *); 2199 static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *, bool); 2200 2201 void dissolve_on_fput(struct vfsmount *mnt) 2202 { 2203 struct mnt_namespace *ns; 2204 namespace_lock(); 2205 lock_mount_hash(); 2206 ns = real_mount(mnt)->mnt_ns; 2207 if (ns) { 2208 if (is_anon_ns(ns)) 2209 umount_tree(real_mount(mnt), UMOUNT_CONNECTED); 2210 else 2211 ns = NULL; 2212 } 2213 unlock_mount_hash(); 2214 namespace_unlock(); 2215 if (ns) 2216 free_mnt_ns(ns); 2217 } 2218 2219 void drop_collected_mounts(struct vfsmount *mnt) 2220 { 2221 namespace_lock(); 2222 lock_mount_hash(); 2223 umount_tree(real_mount(mnt), 0); 2224 unlock_mount_hash(); 2225 namespace_unlock(); 2226 } 2227 2228 bool has_locked_children(struct mount *mnt, struct dentry *dentry) 2229 { 2230 struct mount *child; 2231 2232 list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { 2233 if (!is_subdir(child->mnt_mountpoint, dentry)) 2234 continue; 2235 2236 if (child->mnt.mnt_flags & MNT_LOCKED) 2237 return true; 2238 } 2239 return false; 2240 } 2241 2242 /** 2243 * clone_private_mount - create a private clone of a path 2244 * @path: path to clone 2245 * 2246 * This creates a new vfsmount, which will be the clone of @path. The new mount 2247 * will not be attached anywhere in the namespace and will be private (i.e. 2248 * changes to the originating mount won't be propagated into this). 2249 * 2250 * Release with mntput(). 2251 */ 2252 struct vfsmount *clone_private_mount(const struct path *path) 2253 { 2254 struct mount *old_mnt = real_mount(path->mnt); 2255 struct mount *new_mnt; 2256 2257 down_read(&namespace_sem); 2258 if (IS_MNT_UNBINDABLE(old_mnt)) 2259 goto invalid; 2260 2261 if (!check_mnt(old_mnt)) 2262 goto invalid; 2263 2264 if (has_locked_children(old_mnt, path->dentry)) 2265 goto invalid; 2266 2267 new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE); 2268 up_read(&namespace_sem); 2269 2270 if (IS_ERR(new_mnt)) 2271 return ERR_CAST(new_mnt); 2272 2273 /* Longterm mount to be removed by kern_unmount*() */ 2274 new_mnt->mnt_ns = MNT_NS_INTERNAL; 2275 2276 return &new_mnt->mnt; 2277 2278 invalid: 2279 up_read(&namespace_sem); 2280 return ERR_PTR(-EINVAL); 2281 } 2282 EXPORT_SYMBOL_GPL(clone_private_mount); 2283 2284 int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg, 2285 struct vfsmount *root) 2286 { 2287 struct mount *mnt; 2288 int res = f(root, arg); 2289 if (res) 2290 return res; 2291 list_for_each_entry(mnt, &real_mount(root)->mnt_list, mnt_list) { 2292 res = f(&mnt->mnt, arg); 2293 if (res) 2294 return res; 2295 } 2296 return 0; 2297 } 2298 2299 static void lock_mnt_tree(struct mount *mnt) 2300 { 2301 struct mount *p; 2302 2303 for (p = mnt; p; p = next_mnt(p, mnt)) { 2304 int flags = p->mnt.mnt_flags; 2305 /* Don't allow unprivileged users to change mount flags */ 2306 flags |= MNT_LOCK_ATIME; 2307 2308 if (flags & MNT_READONLY) 2309 flags |= MNT_LOCK_READONLY; 2310 2311 if (flags & MNT_NODEV) 2312 flags |= MNT_LOCK_NODEV; 2313 2314 if (flags & MNT_NOSUID) 2315 flags |= MNT_LOCK_NOSUID; 2316 2317 if (flags & MNT_NOEXEC) 2318 flags |= MNT_LOCK_NOEXEC; 2319 /* Don't allow unprivileged users to reveal what is under a mount */ 2320 if (list_empty(&p->mnt_expire)) 2321 flags |= MNT_LOCKED; 2322 p->mnt.mnt_flags = flags; 2323 } 2324 } 2325 2326 static void cleanup_group_ids(struct mount *mnt, struct mount *end) 2327 { 2328 struct mount *p; 2329 2330 for (p = mnt; p != end; p = next_mnt(p, mnt)) { 2331 if (p->mnt_group_id && !IS_MNT_SHARED(p)) 2332 mnt_release_group_id(p); 2333 } 2334 } 2335 2336 static int invent_group_ids(struct mount *mnt, bool recurse) 2337 { 2338 struct mount *p; 2339 2340 for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) { 2341 if (!p->mnt_group_id && !IS_MNT_SHARED(p)) { 2342 int err = mnt_alloc_group_id(p); 2343 if (err) { 2344 cleanup_group_ids(mnt, p); 2345 return err; 2346 } 2347 } 2348 } 2349 2350 return 0; 2351 } 2352 2353 int count_mounts(struct mnt_namespace *ns, struct mount *mnt) 2354 { 2355 unsigned int max = READ_ONCE(sysctl_mount_max); 2356 unsigned int mounts = 0; 2357 struct mount *p; 2358 2359 if (ns->nr_mounts >= max) 2360 return -ENOSPC; 2361 max -= ns->nr_mounts; 2362 if (ns->pending_mounts >= max) 2363 return -ENOSPC; 2364 max -= ns->pending_mounts; 2365 2366 for (p = mnt; p; p = next_mnt(p, mnt)) 2367 mounts++; 2368 2369 if (mounts > max) 2370 return -ENOSPC; 2371 2372 ns->pending_mounts += mounts; 2373 return 0; 2374 } 2375 2376 enum mnt_tree_flags_t { 2377 MNT_TREE_MOVE = BIT(0), 2378 MNT_TREE_BENEATH = BIT(1), 2379 }; 2380 2381 /** 2382 * attach_recursive_mnt - attach a source mount tree 2383 * @source_mnt: mount tree to be attached 2384 * @top_mnt: mount that @source_mnt will be mounted on or mounted beneath 2385 * @dest_mp: the mountpoint @source_mnt will be mounted at 2386 * @flags: modify how @source_mnt is supposed to be attached 2387 * 2388 * NOTE: in the table below explains the semantics when a source mount 2389 * of a given type is attached to a destination mount of a given type. 2390 * --------------------------------------------------------------------------- 2391 * | BIND MOUNT OPERATION | 2392 * |************************************************************************** 2393 * | source-->| shared | private | slave | unbindable | 2394 * | dest | | | | | 2395 * | | | | | | | 2396 * | v | | | | | 2397 * |************************************************************************** 2398 * | shared | shared (++) | shared (+) | shared(+++)| invalid | 2399 * | | | | | | 2400 * |non-shared| shared (+) | private | slave (*) | invalid | 2401 * *************************************************************************** 2402 * A bind operation clones the source mount and mounts the clone on the 2403 * destination mount. 2404 * 2405 * (++) the cloned mount is propagated to all the mounts in the propagation 2406 * tree of the destination mount and the cloned mount is added to 2407 * the peer group of the source mount. 2408 * (+) the cloned mount is created under the destination mount and is marked 2409 * as shared. The cloned mount is added to the peer group of the source 2410 * mount. 2411 * (+++) the mount is propagated to all the mounts in the propagation tree 2412 * of the destination mount and the cloned mount is made slave 2413 * of the same master as that of the source mount. The cloned mount 2414 * is marked as 'shared and slave'. 2415 * (*) the cloned mount is made a slave of the same master as that of the 2416 * source mount. 2417 * 2418 * --------------------------------------------------------------------------- 2419 * | MOVE MOUNT OPERATION | 2420 * |************************************************************************** 2421 * | source-->| shared | private | slave | unbindable | 2422 * | dest | | | | | 2423 * | | | | | | | 2424 * | v | | | | | 2425 * |************************************************************************** 2426 * | shared | shared (+) | shared (+) | shared(+++) | invalid | 2427 * | | | | | | 2428 * |non-shared| shared (+*) | private | slave (*) | unbindable | 2429 * *************************************************************************** 2430 * 2431 * (+) the mount is moved to the destination. And is then propagated to 2432 * all the mounts in the propagation tree of the destination mount. 2433 * (+*) the mount is moved to the destination. 2434 * (+++) the mount is moved to the destination and is then propagated to 2435 * all the mounts belonging to the destination mount's propagation tree. 2436 * the mount is marked as 'shared and slave'. 2437 * (*) the mount continues to be a slave at the new location. 2438 * 2439 * if the source mount is a tree, the operations explained above is 2440 * applied to each mount in the tree. 2441 * Must be called without spinlocks held, since this function can sleep 2442 * in allocations. 2443 * 2444 * Context: The function expects namespace_lock() to be held. 2445 * Return: If @source_mnt was successfully attached 0 is returned. 2446 * Otherwise a negative error code is returned. 2447 */ 2448 static int attach_recursive_mnt(struct mount *source_mnt, 2449 struct mount *top_mnt, 2450 struct mountpoint *dest_mp, 2451 enum mnt_tree_flags_t flags) 2452 { 2453 struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns; 2454 HLIST_HEAD(tree_list); 2455 struct mnt_namespace *ns = top_mnt->mnt_ns; 2456 struct mountpoint *smp; 2457 struct mount *child, *dest_mnt, *p; 2458 struct hlist_node *n; 2459 int err = 0; 2460 bool moving = flags & MNT_TREE_MOVE, beneath = flags & MNT_TREE_BENEATH; 2461 2462 /* 2463 * Preallocate a mountpoint in case the new mounts need to be 2464 * mounted beneath mounts on the same mountpoint. 2465 */ 2466 smp = get_mountpoint(source_mnt->mnt.mnt_root); 2467 if (IS_ERR(smp)) 2468 return PTR_ERR(smp); 2469 2470 /* Is there space to add these mounts to the mount namespace? */ 2471 if (!moving) { 2472 err = count_mounts(ns, source_mnt); 2473 if (err) 2474 goto out; 2475 } 2476 2477 if (beneath) 2478 dest_mnt = top_mnt->mnt_parent; 2479 else 2480 dest_mnt = top_mnt; 2481 2482 if (IS_MNT_SHARED(dest_mnt)) { 2483 err = invent_group_ids(source_mnt, true); 2484 if (err) 2485 goto out; 2486 err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list); 2487 } 2488 lock_mount_hash(); 2489 if (err) 2490 goto out_cleanup_ids; 2491 2492 if (IS_MNT_SHARED(dest_mnt)) { 2493 for (p = source_mnt; p; p = next_mnt(p, source_mnt)) 2494 set_mnt_shared(p); 2495 } 2496 2497 if (moving) { 2498 if (beneath) 2499 dest_mp = smp; 2500 unhash_mnt(source_mnt); 2501 attach_mnt(source_mnt, top_mnt, dest_mp, beneath); 2502 touch_mnt_namespace(source_mnt->mnt_ns); 2503 } else { 2504 if (source_mnt->mnt_ns) { 2505 LIST_HEAD(head); 2506 2507 /* move from anon - the caller will destroy */ 2508 for (p = source_mnt; p; p = next_mnt(p, source_mnt)) 2509 move_from_ns(p, &head); 2510 list_del_init(&head); 2511 } 2512 if (beneath) 2513 mnt_set_mountpoint_beneath(source_mnt, top_mnt, smp); 2514 else 2515 mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt); 2516 commit_tree(source_mnt); 2517 } 2518 2519 hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) { 2520 struct mount *q; 2521 hlist_del_init(&child->mnt_hash); 2522 q = __lookup_mnt(&child->mnt_parent->mnt, 2523 child->mnt_mountpoint); 2524 if (q) 2525 mnt_change_mountpoint(child, smp, q); 2526 /* Notice when we are propagating across user namespaces */ 2527 if (child->mnt_parent->mnt_ns->user_ns != user_ns) 2528 lock_mnt_tree(child); 2529 child->mnt.mnt_flags &= ~MNT_LOCKED; 2530 commit_tree(child); 2531 } 2532 put_mountpoint(smp); 2533 unlock_mount_hash(); 2534 2535 return 0; 2536 2537 out_cleanup_ids: 2538 while (!hlist_empty(&tree_list)) { 2539 child = hlist_entry(tree_list.first, struct mount, mnt_hash); 2540 child->mnt_parent->mnt_ns->pending_mounts = 0; 2541 umount_tree(child, UMOUNT_SYNC); 2542 } 2543 unlock_mount_hash(); 2544 cleanup_group_ids(source_mnt, NULL); 2545 out: 2546 ns->pending_mounts = 0; 2547 2548 read_seqlock_excl(&mount_lock); 2549 put_mountpoint(smp); 2550 read_sequnlock_excl(&mount_lock); 2551 2552 return err; 2553 } 2554 2555 /** 2556 * do_lock_mount - lock mount and mountpoint 2557 * @path: target path 2558 * @beneath: whether the intention is to mount beneath @path 2559 * 2560 * Follow the mount stack on @path until the top mount @mnt is found. If 2561 * the initial @path->{mnt,dentry} is a mountpoint lookup the first 2562 * mount stacked on top of it. Then simply follow @{mnt,mnt->mnt_root} 2563 * until nothing is stacked on top of it anymore. 2564 * 2565 * Acquire the inode_lock() on the top mount's ->mnt_root to protect 2566 * against concurrent removal of the new mountpoint from another mount 2567 * namespace. 2568 * 2569 * If @beneath is requested, acquire inode_lock() on @mnt's mountpoint 2570 * @mp on @mnt->mnt_parent must be acquired. This protects against a 2571 * concurrent unlink of @mp->mnt_dentry from another mount namespace 2572 * where @mnt doesn't have a child mount mounted @mp. A concurrent 2573 * removal of @mnt->mnt_root doesn't matter as nothing will be mounted 2574 * on top of it for @beneath. 2575 * 2576 * In addition, @beneath needs to make sure that @mnt hasn't been 2577 * unmounted or moved from its current mountpoint in between dropping 2578 * @mount_lock and acquiring @namespace_sem. For the !@beneath case @mnt 2579 * being unmounted would be detected later by e.g., calling 2580 * check_mnt(mnt) in the function it's called from. For the @beneath 2581 * case however, it's useful to detect it directly in do_lock_mount(). 2582 * If @mnt hasn't been unmounted then @mnt->mnt_mountpoint still points 2583 * to @mnt->mnt_mp->m_dentry. But if @mnt has been unmounted it will 2584 * point to @mnt->mnt_root and @mnt->mnt_mp will be NULL. 2585 * 2586 * Return: Either the target mountpoint on the top mount or the top 2587 * mount's mountpoint. 2588 */ 2589 static struct mountpoint *do_lock_mount(struct path *path, bool beneath) 2590 { 2591 struct vfsmount *mnt = path->mnt; 2592 struct dentry *dentry; 2593 struct mountpoint *mp = ERR_PTR(-ENOENT); 2594 2595 for (;;) { 2596 struct mount *m; 2597 2598 if (beneath) { 2599 m = real_mount(mnt); 2600 read_seqlock_excl(&mount_lock); 2601 dentry = dget(m->mnt_mountpoint); 2602 read_sequnlock_excl(&mount_lock); 2603 } else { 2604 dentry = path->dentry; 2605 } 2606 2607 inode_lock(dentry->d_inode); 2608 if (unlikely(cant_mount(dentry))) { 2609 inode_unlock(dentry->d_inode); 2610 goto out; 2611 } 2612 2613 namespace_lock(); 2614 2615 if (beneath && (!is_mounted(mnt) || m->mnt_mountpoint != dentry)) { 2616 namespace_unlock(); 2617 inode_unlock(dentry->d_inode); 2618 goto out; 2619 } 2620 2621 mnt = lookup_mnt(path); 2622 if (likely(!mnt)) 2623 break; 2624 2625 namespace_unlock(); 2626 inode_unlock(dentry->d_inode); 2627 if (beneath) 2628 dput(dentry); 2629 path_put(path); 2630 path->mnt = mnt; 2631 path->dentry = dget(mnt->mnt_root); 2632 } 2633 2634 mp = get_mountpoint(dentry); 2635 if (IS_ERR(mp)) { 2636 namespace_unlock(); 2637 inode_unlock(dentry->d_inode); 2638 } 2639 2640 out: 2641 if (beneath) 2642 dput(dentry); 2643 2644 return mp; 2645 } 2646 2647 static inline struct mountpoint *lock_mount(struct path *path) 2648 { 2649 return do_lock_mount(path, false); 2650 } 2651 2652 static void unlock_mount(struct mountpoint *where) 2653 { 2654 struct dentry *dentry = where->m_dentry; 2655 2656 read_seqlock_excl(&mount_lock); 2657 put_mountpoint(where); 2658 read_sequnlock_excl(&mount_lock); 2659 2660 namespace_unlock(); 2661 inode_unlock(dentry->d_inode); 2662 } 2663 2664 static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp) 2665 { 2666 if (mnt->mnt.mnt_sb->s_flags & SB_NOUSER) 2667 return -EINVAL; 2668 2669 if (d_is_dir(mp->m_dentry) != 2670 d_is_dir(mnt->mnt.mnt_root)) 2671 return -ENOTDIR; 2672 2673 return attach_recursive_mnt(mnt, p, mp, 0); 2674 } 2675 2676 /* 2677 * Sanity check the flags to change_mnt_propagation. 2678 */ 2679 2680 static int flags_to_propagation_type(int ms_flags) 2681 { 2682 int type = ms_flags & ~(MS_REC | MS_SILENT); 2683 2684 /* Fail if any non-propagation flags are set */ 2685 if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) 2686 return 0; 2687 /* Only one propagation flag should be set */ 2688 if (!is_power_of_2(type)) 2689 return 0; 2690 return type; 2691 } 2692 2693 /* 2694 * recursively change the type of the mountpoint. 2695 */ 2696 static int do_change_type(struct path *path, int ms_flags) 2697 { 2698 struct mount *m; 2699 struct mount *mnt = real_mount(path->mnt); 2700 int recurse = ms_flags & MS_REC; 2701 int type; 2702 int err = 0; 2703 2704 if (!path_mounted(path)) 2705 return -EINVAL; 2706 2707 type = flags_to_propagation_type(ms_flags); 2708 if (!type) 2709 return -EINVAL; 2710 2711 namespace_lock(); 2712 if (type == MS_SHARED) { 2713 err = invent_group_ids(mnt, recurse); 2714 if (err) 2715 goto out_unlock; 2716 } 2717 2718 lock_mount_hash(); 2719 for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL)) 2720 change_mnt_propagation(m, type); 2721 unlock_mount_hash(); 2722 2723 out_unlock: 2724 namespace_unlock(); 2725 return err; 2726 } 2727 2728 static struct mount *__do_loopback(struct path *old_path, int recurse) 2729 { 2730 struct mount *mnt = ERR_PTR(-EINVAL), *old = real_mount(old_path->mnt); 2731 2732 if (IS_MNT_UNBINDABLE(old)) 2733 return mnt; 2734 2735 if (!check_mnt(old) && old_path->dentry->d_op != &ns_dentry_operations) 2736 return mnt; 2737 2738 if (!recurse && has_locked_children(old, old_path->dentry)) 2739 return mnt; 2740 2741 if (recurse) 2742 mnt = copy_tree(old, old_path->dentry, CL_COPY_MNT_NS_FILE); 2743 else 2744 mnt = clone_mnt(old, old_path->dentry, 0); 2745 2746 if (!IS_ERR(mnt)) 2747 mnt->mnt.mnt_flags &= ~MNT_LOCKED; 2748 2749 return mnt; 2750 } 2751 2752 /* 2753 * do loopback mount. 2754 */ 2755 static int do_loopback(struct path *path, const char *old_name, 2756 int recurse) 2757 { 2758 struct path old_path; 2759 struct mount *mnt = NULL, *parent; 2760 struct mountpoint *mp; 2761 int err; 2762 if (!old_name || !*old_name) 2763 return -EINVAL; 2764 err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path); 2765 if (err) 2766 return err; 2767 2768 err = -EINVAL; 2769 if (mnt_ns_loop(old_path.dentry)) 2770 goto out; 2771 2772 mp = lock_mount(path); 2773 if (IS_ERR(mp)) { 2774 err = PTR_ERR(mp); 2775 goto out; 2776 } 2777 2778 parent = real_mount(path->mnt); 2779 if (!check_mnt(parent)) 2780 goto out2; 2781 2782 mnt = __do_loopback(&old_path, recurse); 2783 if (IS_ERR(mnt)) { 2784 err = PTR_ERR(mnt); 2785 goto out2; 2786 } 2787 2788 err = graft_tree(mnt, parent, mp); 2789 if (err) { 2790 lock_mount_hash(); 2791 umount_tree(mnt, UMOUNT_SYNC); 2792 unlock_mount_hash(); 2793 } 2794 out2: 2795 unlock_mount(mp); 2796 out: 2797 path_put(&old_path); 2798 return err; 2799 } 2800 2801 static struct file *open_detached_copy(struct path *path, bool recursive) 2802 { 2803 struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns; 2804 struct mnt_namespace *ns = alloc_mnt_ns(user_ns, true); 2805 struct mount *mnt, *p; 2806 struct file *file; 2807 2808 if (IS_ERR(ns)) 2809 return ERR_CAST(ns); 2810 2811 namespace_lock(); 2812 mnt = __do_loopback(path, recursive); 2813 if (IS_ERR(mnt)) { 2814 namespace_unlock(); 2815 free_mnt_ns(ns); 2816 return ERR_CAST(mnt); 2817 } 2818 2819 lock_mount_hash(); 2820 for (p = mnt; p; p = next_mnt(p, mnt)) { 2821 mnt_add_to_ns(ns, p); 2822 ns->nr_mounts++; 2823 } 2824 ns->root = mnt; 2825 mntget(&mnt->mnt); 2826 unlock_mount_hash(); 2827 namespace_unlock(); 2828 2829 mntput(path->mnt); 2830 path->mnt = &mnt->mnt; 2831 file = dentry_open(path, O_PATH, current_cred()); 2832 if (IS_ERR(file)) 2833 dissolve_on_fput(path->mnt); 2834 else 2835 file->f_mode |= FMODE_NEED_UNMOUNT; 2836 return file; 2837 } 2838 2839 SYSCALL_DEFINE3(open_tree, int, dfd, const char __user *, filename, unsigned, flags) 2840 { 2841 struct file *file; 2842 struct path path; 2843 int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW; 2844 bool detached = flags & OPEN_TREE_CLONE; 2845 int error; 2846 int fd; 2847 2848 BUILD_BUG_ON(OPEN_TREE_CLOEXEC != O_CLOEXEC); 2849 2850 if (flags & ~(AT_EMPTY_PATH | AT_NO_AUTOMOUNT | AT_RECURSIVE | 2851 AT_SYMLINK_NOFOLLOW | OPEN_TREE_CLONE | 2852 OPEN_TREE_CLOEXEC)) 2853 return -EINVAL; 2854 2855 if ((flags & (AT_RECURSIVE | OPEN_TREE_CLONE)) == AT_RECURSIVE) 2856 return -EINVAL; 2857 2858 if (flags & AT_NO_AUTOMOUNT) 2859 lookup_flags &= ~LOOKUP_AUTOMOUNT; 2860 if (flags & AT_SYMLINK_NOFOLLOW) 2861 lookup_flags &= ~LOOKUP_FOLLOW; 2862 if (flags & AT_EMPTY_PATH) 2863 lookup_flags |= LOOKUP_EMPTY; 2864 2865 if (detached && !may_mount()) 2866 return -EPERM; 2867 2868 fd = get_unused_fd_flags(flags & O_CLOEXEC); 2869 if (fd < 0) 2870 return fd; 2871 2872 error = user_path_at(dfd, filename, lookup_flags, &path); 2873 if (unlikely(error)) { 2874 file = ERR_PTR(error); 2875 } else { 2876 if (detached) 2877 file = open_detached_copy(&path, flags & AT_RECURSIVE); 2878 else 2879 file = dentry_open(&path, O_PATH, current_cred()); 2880 path_put(&path); 2881 } 2882 if (IS_ERR(file)) { 2883 put_unused_fd(fd); 2884 return PTR_ERR(file); 2885 } 2886 fd_install(fd, file); 2887 return fd; 2888 } 2889 2890 /* 2891 * Don't allow locked mount flags to be cleared. 2892 * 2893 * No locks need to be held here while testing the various MNT_LOCK 2894 * flags because those flags can never be cleared once they are set. 2895 */ 2896 static bool can_change_locked_flags(struct mount *mnt, unsigned int mnt_flags) 2897 { 2898 unsigned int fl = mnt->mnt.mnt_flags; 2899 2900 if ((fl & MNT_LOCK_READONLY) && 2901 !(mnt_flags & MNT_READONLY)) 2902 return false; 2903 2904 if ((fl & MNT_LOCK_NODEV) && 2905 !(mnt_flags & MNT_NODEV)) 2906 return false; 2907 2908 if ((fl & MNT_LOCK_NOSUID) && 2909 !(mnt_flags & MNT_NOSUID)) 2910 return false; 2911 2912 if ((fl & MNT_LOCK_NOEXEC) && 2913 !(mnt_flags & MNT_NOEXEC)) 2914 return false; 2915 2916 if ((fl & MNT_LOCK_ATIME) && 2917 ((fl & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK))) 2918 return false; 2919 2920 return true; 2921 } 2922 2923 static int change_mount_ro_state(struct mount *mnt, unsigned int mnt_flags) 2924 { 2925 bool readonly_request = (mnt_flags & MNT_READONLY); 2926 2927 if (readonly_request == __mnt_is_readonly(&mnt->mnt)) 2928 return 0; 2929 2930 if (readonly_request) 2931 return mnt_make_readonly(mnt); 2932 2933 mnt->mnt.mnt_flags &= ~MNT_READONLY; 2934 return 0; 2935 } 2936 2937 static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags) 2938 { 2939 mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK; 2940 mnt->mnt.mnt_flags = mnt_flags; 2941 touch_mnt_namespace(mnt->mnt_ns); 2942 } 2943 2944 static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *mnt) 2945 { 2946 struct super_block *sb = mnt->mnt_sb; 2947 2948 if (!__mnt_is_readonly(mnt) && 2949 (!(sb->s_iflags & SB_I_TS_EXPIRY_WARNED)) && 2950 (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) { 2951 char *buf, *mntpath; 2952 2953 buf = (char *)__get_free_page(GFP_KERNEL); 2954 if (buf) 2955 mntpath = d_path(mountpoint, buf, PAGE_SIZE); 2956 else 2957 mntpath = ERR_PTR(-ENOMEM); 2958 if (IS_ERR(mntpath)) 2959 mntpath = "(unknown)"; 2960 2961 pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n", 2962 sb->s_type->name, 2963 is_mounted(mnt) ? "remounted" : "mounted", 2964 mntpath, &sb->s_time_max, 2965 (unsigned long long)sb->s_time_max); 2966 2967 sb->s_iflags |= SB_I_TS_EXPIRY_WARNED; 2968 if (buf) 2969 free_page((unsigned long)buf); 2970 } 2971 } 2972 2973 /* 2974 * Handle reconfiguration of the mountpoint only without alteration of the 2975 * superblock it refers to. This is triggered by specifying MS_REMOUNT|MS_BIND 2976 * to mount(2). 2977 */ 2978 static int do_reconfigure_mnt(struct path *path, unsigned int mnt_flags) 2979 { 2980 struct super_block *sb = path->mnt->mnt_sb; 2981 struct mount *mnt = real_mount(path->mnt); 2982 int ret; 2983 2984 if (!check_mnt(mnt)) 2985 return -EINVAL; 2986 2987 if (!path_mounted(path)) 2988 return -EINVAL; 2989 2990 if (!can_change_locked_flags(mnt, mnt_flags)) 2991 return -EPERM; 2992 2993 /* 2994 * We're only checking whether the superblock is read-only not 2995 * changing it, so only take down_read(&sb->s_umount). 2996 */ 2997 down_read(&sb->s_umount); 2998 lock_mount_hash(); 2999 ret = change_mount_ro_state(mnt, mnt_flags); 3000 if (ret == 0) 3001 set_mount_attributes(mnt, mnt_flags); 3002 unlock_mount_hash(); 3003 up_read(&sb->s_umount); 3004 3005 mnt_warn_timestamp_expiry(path, &mnt->mnt); 3006 3007 return ret; 3008 } 3009 3010 /* 3011 * change filesystem flags. dir should be a physical root of filesystem. 3012 * If you've mounted a non-root directory somewhere and want to do remount 3013 * on it - tough luck. 3014 */ 3015 static int do_remount(struct path *path, int ms_flags, int sb_flags, 3016 int mnt_flags, void *data) 3017 { 3018 int err; 3019 struct super_block *sb = path->mnt->mnt_sb; 3020 struct mount *mnt = real_mount(path->mnt); 3021 struct fs_context *fc; 3022 3023 if (!check_mnt(mnt)) 3024 return -EINVAL; 3025 3026 if (!path_mounted(path)) 3027 return -EINVAL; 3028 3029 if (!can_change_locked_flags(mnt, mnt_flags)) 3030 return -EPERM; 3031 3032 fc = fs_context_for_reconfigure(path->dentry, sb_flags, MS_RMT_MASK); 3033 if (IS_ERR(fc)) 3034 return PTR_ERR(fc); 3035 3036 /* 3037 * Indicate to the filesystem that the remount request is coming 3038 * from the legacy mount system call. 3039 */ 3040 fc->oldapi = true; 3041 3042 err = parse_monolithic_mount_data(fc, data); 3043 if (!err) { 3044 down_write(&sb->s_umount); 3045 err = -EPERM; 3046 if (ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) { 3047 err = reconfigure_super(fc); 3048 if (!err) { 3049 lock_mount_hash(); 3050 set_mount_attributes(mnt, mnt_flags); 3051 unlock_mount_hash(); 3052 } 3053 } 3054 up_write(&sb->s_umount); 3055 } 3056 3057 mnt_warn_timestamp_expiry(path, &mnt->mnt); 3058 3059 put_fs_context(fc); 3060 return err; 3061 } 3062 3063 static inline int tree_contains_unbindable(struct mount *mnt) 3064 { 3065 struct mount *p; 3066 for (p = mnt; p; p = next_mnt(p, mnt)) { 3067 if (IS_MNT_UNBINDABLE(p)) 3068 return 1; 3069 } 3070 return 0; 3071 } 3072 3073 /* 3074 * Check that there aren't references to earlier/same mount namespaces in the 3075 * specified subtree. Such references can act as pins for mount namespaces 3076 * that aren't checked by the mount-cycle checking code, thereby allowing 3077 * cycles to be made. 3078 */ 3079 static bool check_for_nsfs_mounts(struct mount *subtree) 3080 { 3081 struct mount *p; 3082 bool ret = false; 3083 3084 lock_mount_hash(); 3085 for (p = subtree; p; p = next_mnt(p, subtree)) 3086 if (mnt_ns_loop(p->mnt.mnt_root)) 3087 goto out; 3088 3089 ret = true; 3090 out: 3091 unlock_mount_hash(); 3092 return ret; 3093 } 3094 3095 static int do_set_group(struct path *from_path, struct path *to_path) 3096 { 3097 struct mount *from, *to; 3098 int err; 3099 3100 from = real_mount(from_path->mnt); 3101 to = real_mount(to_path->mnt); 3102 3103 namespace_lock(); 3104 3105 err = -EINVAL; 3106 /* To and From must be mounted */ 3107 if (!is_mounted(&from->mnt)) 3108 goto out; 3109 if (!is_mounted(&to->mnt)) 3110 goto out; 3111 3112 err = -EPERM; 3113 /* We should be allowed to modify mount namespaces of both mounts */ 3114 if (!ns_capable(from->mnt_ns->user_ns, CAP_SYS_ADMIN)) 3115 goto out; 3116 if (!ns_capable(to->mnt_ns->user_ns, CAP_SYS_ADMIN)) 3117 goto out; 3118 3119 err = -EINVAL; 3120 /* To and From paths should be mount roots */ 3121 if (!path_mounted(from_path)) 3122 goto out; 3123 if (!path_mounted(to_path)) 3124 goto out; 3125 3126 /* Setting sharing groups is only allowed across same superblock */ 3127 if (from->mnt.mnt_sb != to->mnt.mnt_sb) 3128 goto out; 3129 3130 /* From mount root should be wider than To mount root */ 3131 if (!is_subdir(to->mnt.mnt_root, from->mnt.mnt_root)) 3132 goto out; 3133 3134 /* From mount should not have locked children in place of To's root */ 3135 if (has_locked_children(from, to->mnt.mnt_root)) 3136 goto out; 3137 3138 /* Setting sharing groups is only allowed on private mounts */ 3139 if (IS_MNT_SHARED(to) || IS_MNT_SLAVE(to)) 3140 goto out; 3141 3142 /* From should not be private */ 3143 if (!IS_MNT_SHARED(from) && !IS_MNT_SLAVE(from)) 3144 goto out; 3145 3146 if (IS_MNT_SLAVE(from)) { 3147 struct mount *m = from->mnt_master; 3148 3149 list_add(&to->mnt_slave, &m->mnt_slave_list); 3150 to->mnt_master = m; 3151 } 3152 3153 if (IS_MNT_SHARED(from)) { 3154 to->mnt_group_id = from->mnt_group_id; 3155 list_add(&to->mnt_share, &from->mnt_share); 3156 lock_mount_hash(); 3157 set_mnt_shared(to); 3158 unlock_mount_hash(); 3159 } 3160 3161 err = 0; 3162 out: 3163 namespace_unlock(); 3164 return err; 3165 } 3166 3167 /** 3168 * path_overmounted - check if path is overmounted 3169 * @path: path to check 3170 * 3171 * Check if path is overmounted, i.e., if there's a mount on top of 3172 * @path->mnt with @path->dentry as mountpoint. 3173 * 3174 * Context: This function expects namespace_lock() to be held. 3175 * Return: If path is overmounted true is returned, false if not. 3176 */ 3177 static inline bool path_overmounted(const struct path *path) 3178 { 3179 rcu_read_lock(); 3180 if (unlikely(__lookup_mnt(path->mnt, path->dentry))) { 3181 rcu_read_unlock(); 3182 return true; 3183 } 3184 rcu_read_unlock(); 3185 return false; 3186 } 3187 3188 /** 3189 * can_move_mount_beneath - check that we can mount beneath the top mount 3190 * @from: mount to mount beneath 3191 * @to: mount under which to mount 3192 * @mp: mountpoint of @to 3193 * 3194 * - Make sure that @to->dentry is actually the root of a mount under 3195 * which we can mount another mount. 3196 * - Make sure that nothing can be mounted beneath the caller's current 3197 * root or the rootfs of the namespace. 3198 * - Make sure that the caller can unmount the topmost mount ensuring 3199 * that the caller could reveal the underlying mountpoint. 3200 * - Ensure that nothing has been mounted on top of @from before we 3201 * grabbed @namespace_sem to avoid creating pointless shadow mounts. 3202 * - Prevent mounting beneath a mount if the propagation relationship 3203 * between the source mount, parent mount, and top mount would lead to 3204 * nonsensical mount trees. 3205 * 3206 * Context: This function expects namespace_lock() to be held. 3207 * Return: On success 0, and on error a negative error code is returned. 3208 */ 3209 static int can_move_mount_beneath(const struct path *from, 3210 const struct path *to, 3211 const struct mountpoint *mp) 3212 { 3213 struct mount *mnt_from = real_mount(from->mnt), 3214 *mnt_to = real_mount(to->mnt), 3215 *parent_mnt_to = mnt_to->mnt_parent; 3216 3217 if (!mnt_has_parent(mnt_to)) 3218 return -EINVAL; 3219 3220 if (!path_mounted(to)) 3221 return -EINVAL; 3222 3223 if (IS_MNT_LOCKED(mnt_to)) 3224 return -EINVAL; 3225 3226 /* Avoid creating shadow mounts during mount propagation. */ 3227 if (path_overmounted(from)) 3228 return -EINVAL; 3229 3230 /* 3231 * Mounting beneath the rootfs only makes sense when the 3232 * semantics of pivot_root(".", ".") are used. 3233 */ 3234 if (&mnt_to->mnt == current->fs->root.mnt) 3235 return -EINVAL; 3236 if (parent_mnt_to == current->nsproxy->mnt_ns->root) 3237 return -EINVAL; 3238 3239 for (struct mount *p = mnt_from; mnt_has_parent(p); p = p->mnt_parent) 3240 if (p == mnt_to) 3241 return -EINVAL; 3242 3243 /* 3244 * If the parent mount propagates to the child mount this would 3245 * mean mounting @mnt_from on @mnt_to->mnt_parent and then 3246 * propagating a copy @c of @mnt_from on top of @mnt_to. This 3247 * defeats the whole purpose of mounting beneath another mount. 3248 */ 3249 if (propagation_would_overmount(parent_mnt_to, mnt_to, mp)) 3250 return -EINVAL; 3251 3252 /* 3253 * If @mnt_to->mnt_parent propagates to @mnt_from this would 3254 * mean propagating a copy @c of @mnt_from on top of @mnt_from. 3255 * Afterwards @mnt_from would be mounted on top of 3256 * @mnt_to->mnt_parent and @mnt_to would be unmounted from 3257 * @mnt->mnt_parent and remounted on @mnt_from. But since @c is 3258 * already mounted on @mnt_from, @mnt_to would ultimately be 3259 * remounted on top of @c. Afterwards, @mnt_from would be 3260 * covered by a copy @c of @mnt_from and @c would be covered by 3261 * @mnt_from itself. This defeats the whole purpose of mounting 3262 * @mnt_from beneath @mnt_to. 3263 */ 3264 if (propagation_would_overmount(parent_mnt_to, mnt_from, mp)) 3265 return -EINVAL; 3266 3267 return 0; 3268 } 3269 3270 static int do_move_mount(struct path *old_path, struct path *new_path, 3271 bool beneath) 3272 { 3273 struct mnt_namespace *ns; 3274 struct mount *p; 3275 struct mount *old; 3276 struct mount *parent; 3277 struct mountpoint *mp, *old_mp; 3278 int err; 3279 bool attached; 3280 enum mnt_tree_flags_t flags = 0; 3281 3282 mp = do_lock_mount(new_path, beneath); 3283 if (IS_ERR(mp)) 3284 return PTR_ERR(mp); 3285 3286 old = real_mount(old_path->mnt); 3287 p = real_mount(new_path->mnt); 3288 parent = old->mnt_parent; 3289 attached = mnt_has_parent(old); 3290 if (attached) 3291 flags |= MNT_TREE_MOVE; 3292 old_mp = old->mnt_mp; 3293 ns = old->mnt_ns; 3294 3295 err = -EINVAL; 3296 /* The mountpoint must be in our namespace. */ 3297 if (!check_mnt(p)) 3298 goto out; 3299 3300 /* The thing moved must be mounted... */ 3301 if (!is_mounted(&old->mnt)) 3302 goto out; 3303 3304 /* ... and either ours or the root of anon namespace */ 3305 if (!(attached ? check_mnt(old) : is_anon_ns(ns))) 3306 goto out; 3307 3308 if (old->mnt.mnt_flags & MNT_LOCKED) 3309 goto out; 3310 3311 if (!path_mounted(old_path)) 3312 goto out; 3313 3314 if (d_is_dir(new_path->dentry) != 3315 d_is_dir(old_path->dentry)) 3316 goto out; 3317 /* 3318 * Don't move a mount residing in a shared parent. 3319 */ 3320 if (attached && IS_MNT_SHARED(parent)) 3321 goto out; 3322 3323 if (beneath) { 3324 err = can_move_mount_beneath(old_path, new_path, mp); 3325 if (err) 3326 goto out; 3327 3328 err = -EINVAL; 3329 p = p->mnt_parent; 3330 flags |= MNT_TREE_BENEATH; 3331 } 3332 3333 /* 3334 * Don't move a mount tree containing unbindable mounts to a destination 3335 * mount which is shared. 3336 */ 3337 if (IS_MNT_SHARED(p) && tree_contains_unbindable(old)) 3338 goto out; 3339 err = -ELOOP; 3340 if (!check_for_nsfs_mounts(old)) 3341 goto out; 3342 for (; mnt_has_parent(p); p = p->mnt_parent) 3343 if (p == old) 3344 goto out; 3345 3346 err = attach_recursive_mnt(old, real_mount(new_path->mnt), mp, flags); 3347 if (err) 3348 goto out; 3349 3350 /* if the mount is moved, it should no longer be expire 3351 * automatically */ 3352 list_del_init(&old->mnt_expire); 3353 if (attached) 3354 put_mountpoint(old_mp); 3355 out: 3356 unlock_mount(mp); 3357 if (!err) { 3358 if (attached) 3359 mntput_no_expire(parent); 3360 else 3361 free_mnt_ns(ns); 3362 } 3363 return err; 3364 } 3365 3366 static int do_move_mount_old(struct path *path, const char *old_name) 3367 { 3368 struct path old_path; 3369 int err; 3370 3371 if (!old_name || !*old_name) 3372 return -EINVAL; 3373 3374 err = kern_path(old_name, LOOKUP_FOLLOW, &old_path); 3375 if (err) 3376 return err; 3377 3378 err = do_move_mount(&old_path, path, false); 3379 path_put(&old_path); 3380 return err; 3381 } 3382 3383 /* 3384 * add a mount into a namespace's mount tree 3385 */ 3386 static int do_add_mount(struct mount *newmnt, struct mountpoint *mp, 3387 const struct path *path, int mnt_flags) 3388 { 3389 struct mount *parent = real_mount(path->mnt); 3390 3391 mnt_flags &= ~MNT_INTERNAL_FLAGS; 3392 3393 if (unlikely(!check_mnt(parent))) { 3394 /* that's acceptable only for automounts done in private ns */ 3395 if (!(mnt_flags & MNT_SHRINKABLE)) 3396 return -EINVAL; 3397 /* ... and for those we'd better have mountpoint still alive */ 3398 if (!parent->mnt_ns) 3399 return -EINVAL; 3400 } 3401 3402 /* Refuse the same filesystem on the same mount point */ 3403 if (path->mnt->mnt_sb == newmnt->mnt.mnt_sb && path_mounted(path)) 3404 return -EBUSY; 3405 3406 if (d_is_symlink(newmnt->mnt.mnt_root)) 3407 return -EINVAL; 3408 3409 newmnt->mnt.mnt_flags = mnt_flags; 3410 return graft_tree(newmnt, parent, mp); 3411 } 3412 3413 static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags); 3414 3415 /* 3416 * Create a new mount using a superblock configuration and request it 3417 * be added to the namespace tree. 3418 */ 3419 static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint, 3420 unsigned int mnt_flags) 3421 { 3422 struct vfsmount *mnt; 3423 struct mountpoint *mp; 3424 struct super_block *sb = fc->root->d_sb; 3425 int error; 3426 3427 error = security_sb_kern_mount(sb); 3428 if (!error && mount_too_revealing(sb, &mnt_flags)) 3429 error = -EPERM; 3430 3431 if (unlikely(error)) { 3432 fc_drop_locked(fc); 3433 return error; 3434 } 3435 3436 up_write(&sb->s_umount); 3437 3438 mnt = vfs_create_mount(fc); 3439 if (IS_ERR(mnt)) 3440 return PTR_ERR(mnt); 3441 3442 mnt_warn_timestamp_expiry(mountpoint, mnt); 3443 3444 mp = lock_mount(mountpoint); 3445 if (IS_ERR(mp)) { 3446 mntput(mnt); 3447 return PTR_ERR(mp); 3448 } 3449 error = do_add_mount(real_mount(mnt), mp, mountpoint, mnt_flags); 3450 unlock_mount(mp); 3451 if (error < 0) 3452 mntput(mnt); 3453 return error; 3454 } 3455 3456 /* 3457 * create a new mount for userspace and request it to be added into the 3458 * namespace's tree 3459 */ 3460 static int do_new_mount(struct path *path, const char *fstype, int sb_flags, 3461 int mnt_flags, const char *name, void *data) 3462 { 3463 struct file_system_type *type; 3464 struct fs_context *fc; 3465 const char *subtype = NULL; 3466 int err = 0; 3467 3468 if (!fstype) 3469 return -EINVAL; 3470 3471 type = get_fs_type(fstype); 3472 if (!type) 3473 return -ENODEV; 3474 3475 if (type->fs_flags & FS_HAS_SUBTYPE) { 3476 subtype = strchr(fstype, '.'); 3477 if (subtype) { 3478 subtype++; 3479 if (!*subtype) { 3480 put_filesystem(type); 3481 return -EINVAL; 3482 } 3483 } 3484 } 3485 3486 fc = fs_context_for_mount(type, sb_flags); 3487 put_filesystem(type); 3488 if (IS_ERR(fc)) 3489 return PTR_ERR(fc); 3490 3491 /* 3492 * Indicate to the filesystem that the mount request is coming 3493 * from the legacy mount system call. 3494 */ 3495 fc->oldapi = true; 3496 3497 if (subtype) 3498 err = vfs_parse_fs_string(fc, "subtype", 3499 subtype, strlen(subtype)); 3500 if (!err && name) 3501 err = vfs_parse_fs_string(fc, "source", name, strlen(name)); 3502 if (!err) 3503 err = parse_monolithic_mount_data(fc, data); 3504 if (!err && !mount_capable(fc)) 3505 err = -EPERM; 3506 if (!err) 3507 err = vfs_get_tree(fc); 3508 if (!err) 3509 err = do_new_mount_fc(fc, path, mnt_flags); 3510 3511 put_fs_context(fc); 3512 return err; 3513 } 3514 3515 int finish_automount(struct vfsmount *m, const struct path *path) 3516 { 3517 struct dentry *dentry = path->dentry; 3518 struct mountpoint *mp; 3519 struct mount *mnt; 3520 int err; 3521 3522 if (!m) 3523 return 0; 3524 if (IS_ERR(m)) 3525 return PTR_ERR(m); 3526 3527 mnt = real_mount(m); 3528 /* The new mount record should have at least 2 refs to prevent it being 3529 * expired before we get a chance to add it 3530 */ 3531 BUG_ON(mnt_get_count(mnt) < 2); 3532 3533 if (m->mnt_sb == path->mnt->mnt_sb && 3534 m->mnt_root == dentry) { 3535 err = -ELOOP; 3536 goto discard; 3537 } 3538 3539 /* 3540 * we don't want to use lock_mount() - in this case finding something 3541 * that overmounts our mountpoint to be means "quitely drop what we've 3542 * got", not "try to mount it on top". 3543 */ 3544 inode_lock(dentry->d_inode); 3545 namespace_lock(); 3546 if (unlikely(cant_mount(dentry))) { 3547 err = -ENOENT; 3548 goto discard_locked; 3549 } 3550 if (path_overmounted(path)) { 3551 err = 0; 3552 goto discard_locked; 3553 } 3554 mp = get_mountpoint(dentry); 3555 if (IS_ERR(mp)) { 3556 err = PTR_ERR(mp); 3557 goto discard_locked; 3558 } 3559 3560 err = do_add_mount(mnt, mp, path, path->mnt->mnt_flags | MNT_SHRINKABLE); 3561 unlock_mount(mp); 3562 if (unlikely(err)) 3563 goto discard; 3564 mntput(m); 3565 return 0; 3566 3567 discard_locked: 3568 namespace_unlock(); 3569 inode_unlock(dentry->d_inode); 3570 discard: 3571 /* remove m from any expiration list it may be on */ 3572 if (!list_empty(&mnt->mnt_expire)) { 3573 namespace_lock(); 3574 list_del_init(&mnt->mnt_expire); 3575 namespace_unlock(); 3576 } 3577 mntput(m); 3578 mntput(m); 3579 return err; 3580 } 3581 3582 /** 3583 * mnt_set_expiry - Put a mount on an expiration list 3584 * @mnt: The mount to list. 3585 * @expiry_list: The list to add the mount to. 3586 */ 3587 void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list) 3588 { 3589 namespace_lock(); 3590 3591 list_add_tail(&real_mount(mnt)->mnt_expire, expiry_list); 3592 3593 namespace_unlock(); 3594 } 3595 EXPORT_SYMBOL(mnt_set_expiry); 3596 3597 /* 3598 * process a list of expirable mountpoints with the intent of discarding any 3599 * mountpoints that aren't in use and haven't been touched since last we came 3600 * here 3601 */ 3602 void mark_mounts_for_expiry(struct list_head *mounts) 3603 { 3604 struct mount *mnt, *next; 3605 LIST_HEAD(graveyard); 3606 3607 if (list_empty(mounts)) 3608 return; 3609 3610 namespace_lock(); 3611 lock_mount_hash(); 3612 3613 /* extract from the expiration list every vfsmount that matches the 3614 * following criteria: 3615 * - only referenced by its parent vfsmount 3616 * - still marked for expiry (marked on the last call here; marks are 3617 * cleared by mntput()) 3618 */ 3619 list_for_each_entry_safe(mnt, next, mounts, mnt_expire) { 3620 if (!xchg(&mnt->mnt_expiry_mark, 1) || 3621 propagate_mount_busy(mnt, 1)) 3622 continue; 3623 list_move(&mnt->mnt_expire, &graveyard); 3624 } 3625 while (!list_empty(&graveyard)) { 3626 mnt = list_first_entry(&graveyard, struct mount, mnt_expire); 3627 touch_mnt_namespace(mnt->mnt_ns); 3628 umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC); 3629 } 3630 unlock_mount_hash(); 3631 namespace_unlock(); 3632 } 3633 3634 EXPORT_SYMBOL_GPL(mark_mounts_for_expiry); 3635 3636 /* 3637 * Ripoff of 'select_parent()' 3638 * 3639 * search the list of submounts for a given mountpoint, and move any 3640 * shrinkable submounts to the 'graveyard' list. 3641 */ 3642 static int select_submounts(struct mount *parent, struct list_head *graveyard) 3643 { 3644 struct mount *this_parent = parent; 3645 struct list_head *next; 3646 int found = 0; 3647 3648 repeat: 3649 next = this_parent->mnt_mounts.next; 3650 resume: 3651 while (next != &this_parent->mnt_mounts) { 3652 struct list_head *tmp = next; 3653 struct mount *mnt = list_entry(tmp, struct mount, mnt_child); 3654 3655 next = tmp->next; 3656 if (!(mnt->mnt.mnt_flags & MNT_SHRINKABLE)) 3657 continue; 3658 /* 3659 * Descend a level if the d_mounts list is non-empty. 3660 */ 3661 if (!list_empty(&mnt->mnt_mounts)) { 3662 this_parent = mnt; 3663 goto repeat; 3664 } 3665 3666 if (!propagate_mount_busy(mnt, 1)) { 3667 list_move_tail(&mnt->mnt_expire, graveyard); 3668 found++; 3669 } 3670 } 3671 /* 3672 * All done at this level ... ascend and resume the search 3673 */ 3674 if (this_parent != parent) { 3675 next = this_parent->mnt_child.next; 3676 this_parent = this_parent->mnt_parent; 3677 goto resume; 3678 } 3679 return found; 3680 } 3681 3682 /* 3683 * process a list of expirable mountpoints with the intent of discarding any 3684 * submounts of a specific parent mountpoint 3685 * 3686 * mount_lock must be held for write 3687 */ 3688 static void shrink_submounts(struct mount *mnt) 3689 { 3690 LIST_HEAD(graveyard); 3691 struct mount *m; 3692 3693 /* extract submounts of 'mountpoint' from the expiration list */ 3694 while (select_submounts(mnt, &graveyard)) { 3695 while (!list_empty(&graveyard)) { 3696 m = list_first_entry(&graveyard, struct mount, 3697 mnt_expire); 3698 touch_mnt_namespace(m->mnt_ns); 3699 umount_tree(m, UMOUNT_PROPAGATE|UMOUNT_SYNC); 3700 } 3701 } 3702 } 3703 3704 static void *copy_mount_options(const void __user * data) 3705 { 3706 char *copy; 3707 unsigned left, offset; 3708 3709 if (!data) 3710 return NULL; 3711 3712 copy = kmalloc(PAGE_SIZE, GFP_KERNEL); 3713 if (!copy) 3714 return ERR_PTR(-ENOMEM); 3715 3716 left = copy_from_user(copy, data, PAGE_SIZE); 3717 3718 /* 3719 * Not all architectures have an exact copy_from_user(). Resort to 3720 * byte at a time. 3721 */ 3722 offset = PAGE_SIZE - left; 3723 while (left) { 3724 char c; 3725 if (get_user(c, (const char __user *)data + offset)) 3726 break; 3727 copy[offset] = c; 3728 left--; 3729 offset++; 3730 } 3731 3732 if (left == PAGE_SIZE) { 3733 kfree(copy); 3734 return ERR_PTR(-EFAULT); 3735 } 3736 3737 return copy; 3738 } 3739 3740 static char *copy_mount_string(const void __user *data) 3741 { 3742 return data ? strndup_user(data, PATH_MAX) : NULL; 3743 } 3744 3745 /* 3746 * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to 3747 * be given to the mount() call (ie: read-only, no-dev, no-suid etc). 3748 * 3749 * data is a (void *) that can point to any structure up to 3750 * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent 3751 * information (or be NULL). 3752 * 3753 * Pre-0.97 versions of mount() didn't have a flags word. 3754 * When the flags word was introduced its top half was required 3755 * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9. 3756 * Therefore, if this magic number is present, it carries no information 3757 * and must be discarded. 3758 */ 3759 int path_mount(const char *dev_name, struct path *path, 3760 const char *type_page, unsigned long flags, void *data_page) 3761 { 3762 unsigned int mnt_flags = 0, sb_flags; 3763 int ret; 3764 3765 /* Discard magic */ 3766 if ((flags & MS_MGC_MSK) == MS_MGC_VAL) 3767 flags &= ~MS_MGC_MSK; 3768 3769 /* Basic sanity checks */ 3770 if (data_page) 3771 ((char *)data_page)[PAGE_SIZE - 1] = 0; 3772 3773 if (flags & MS_NOUSER) 3774 return -EINVAL; 3775 3776 ret = security_sb_mount(dev_name, path, type_page, flags, data_page); 3777 if (ret) 3778 return ret; 3779 if (!may_mount()) 3780 return -EPERM; 3781 if (flags & SB_MANDLOCK) 3782 warn_mandlock(); 3783 3784 /* Default to relatime unless overriden */ 3785 if (!(flags & MS_NOATIME)) 3786 mnt_flags |= MNT_RELATIME; 3787 3788 /* Separate the per-mountpoint flags */ 3789 if (flags & MS_NOSUID) 3790 mnt_flags |= MNT_NOSUID; 3791 if (flags & MS_NODEV) 3792 mnt_flags |= MNT_NODEV; 3793 if (flags & MS_NOEXEC) 3794 mnt_flags |= MNT_NOEXEC; 3795 if (flags & MS_NOATIME) 3796 mnt_flags |= MNT_NOATIME; 3797 if (flags & MS_NODIRATIME) 3798 mnt_flags |= MNT_NODIRATIME; 3799 if (flags & MS_STRICTATIME) 3800 mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME); 3801 if (flags & MS_RDONLY) 3802 mnt_flags |= MNT_READONLY; 3803 if (flags & MS_NOSYMFOLLOW) 3804 mnt_flags |= MNT_NOSYMFOLLOW; 3805 3806 /* The default atime for remount is preservation */ 3807 if ((flags & MS_REMOUNT) && 3808 ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME | 3809 MS_STRICTATIME)) == 0)) { 3810 mnt_flags &= ~MNT_ATIME_MASK; 3811 mnt_flags |= path->mnt->mnt_flags & MNT_ATIME_MASK; 3812 } 3813 3814 sb_flags = flags & (SB_RDONLY | 3815 SB_SYNCHRONOUS | 3816 SB_MANDLOCK | 3817 SB_DIRSYNC | 3818 SB_SILENT | 3819 SB_POSIXACL | 3820 SB_LAZYTIME | 3821 SB_I_VERSION); 3822 3823 if ((flags & (MS_REMOUNT | MS_BIND)) == (MS_REMOUNT | MS_BIND)) 3824 return do_reconfigure_mnt(path, mnt_flags); 3825 if (flags & MS_REMOUNT) 3826 return do_remount(path, flags, sb_flags, mnt_flags, data_page); 3827 if (flags & MS_BIND) 3828 return do_loopback(path, dev_name, flags & MS_REC); 3829 if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) 3830 return do_change_type(path, flags); 3831 if (flags & MS_MOVE) 3832 return do_move_mount_old(path, dev_name); 3833 3834 return do_new_mount(path, type_page, sb_flags, mnt_flags, dev_name, 3835 data_page); 3836 } 3837 3838 long do_mount(const char *dev_name, const char __user *dir_name, 3839 const char *type_page, unsigned long flags, void *data_page) 3840 { 3841 struct path path; 3842 int ret; 3843 3844 ret = user_path_at(AT_FDCWD, dir_name, LOOKUP_FOLLOW, &path); 3845 if (ret) 3846 return ret; 3847 ret = path_mount(dev_name, &path, type_page, flags, data_page); 3848 path_put(&path); 3849 return ret; 3850 } 3851 3852 static struct ucounts *inc_mnt_namespaces(struct user_namespace *ns) 3853 { 3854 return inc_ucount(ns, current_euid(), UCOUNT_MNT_NAMESPACES); 3855 } 3856 3857 static void dec_mnt_namespaces(struct ucounts *ucounts) 3858 { 3859 dec_ucount(ucounts, UCOUNT_MNT_NAMESPACES); 3860 } 3861 3862 static void free_mnt_ns(struct mnt_namespace *ns) 3863 { 3864 if (!is_anon_ns(ns)) 3865 ns_free_inum(&ns->ns); 3866 dec_mnt_namespaces(ns->ucounts); 3867 mnt_ns_tree_remove(ns); 3868 } 3869 3870 /* 3871 * Assign a sequence number so we can detect when we attempt to bind 3872 * mount a reference to an older mount namespace into the current 3873 * mount namespace, preventing reference counting loops. A 64bit 3874 * number incrementing at 10Ghz will take 12,427 years to wrap which 3875 * is effectively never, so we can ignore the possibility. 3876 */ 3877 static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1); 3878 3879 static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns, bool anon) 3880 { 3881 struct mnt_namespace *new_ns; 3882 struct ucounts *ucounts; 3883 int ret; 3884 3885 ucounts = inc_mnt_namespaces(user_ns); 3886 if (!ucounts) 3887 return ERR_PTR(-ENOSPC); 3888 3889 new_ns = kzalloc(sizeof(struct mnt_namespace), GFP_KERNEL_ACCOUNT); 3890 if (!new_ns) { 3891 dec_mnt_namespaces(ucounts); 3892 return ERR_PTR(-ENOMEM); 3893 } 3894 if (!anon) { 3895 ret = ns_alloc_inum(&new_ns->ns); 3896 if (ret) { 3897 kfree(new_ns); 3898 dec_mnt_namespaces(ucounts); 3899 return ERR_PTR(ret); 3900 } 3901 } 3902 new_ns->ns.ops = &mntns_operations; 3903 if (!anon) 3904 new_ns->seq = atomic64_inc_return(&mnt_ns_seq); 3905 refcount_set(&new_ns->ns.count, 1); 3906 refcount_set(&new_ns->passive, 1); 3907 new_ns->mounts = RB_ROOT; 3908 RB_CLEAR_NODE(&new_ns->mnt_ns_tree_node); 3909 init_waitqueue_head(&new_ns->poll); 3910 new_ns->user_ns = get_user_ns(user_ns); 3911 new_ns->ucounts = ucounts; 3912 return new_ns; 3913 } 3914 3915 __latent_entropy 3916 struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, 3917 struct user_namespace *user_ns, struct fs_struct *new_fs) 3918 { 3919 struct mnt_namespace *new_ns; 3920 struct vfsmount *rootmnt = NULL, *pwdmnt = NULL; 3921 struct mount *p, *q; 3922 struct mount *old; 3923 struct mount *new; 3924 int copy_flags; 3925 3926 BUG_ON(!ns); 3927 3928 if (likely(!(flags & CLONE_NEWNS))) { 3929 get_mnt_ns(ns); 3930 return ns; 3931 } 3932 3933 old = ns->root; 3934 3935 new_ns = alloc_mnt_ns(user_ns, false); 3936 if (IS_ERR(new_ns)) 3937 return new_ns; 3938 3939 namespace_lock(); 3940 /* First pass: copy the tree topology */ 3941 copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE; 3942 if (user_ns != ns->user_ns) 3943 copy_flags |= CL_SHARED_TO_SLAVE; 3944 new = copy_tree(old, old->mnt.mnt_root, copy_flags); 3945 if (IS_ERR(new)) { 3946 namespace_unlock(); 3947 ns_free_inum(&new_ns->ns); 3948 dec_mnt_namespaces(new_ns->ucounts); 3949 mnt_ns_release(new_ns); 3950 return ERR_CAST(new); 3951 } 3952 if (user_ns != ns->user_ns) { 3953 lock_mount_hash(); 3954 lock_mnt_tree(new); 3955 unlock_mount_hash(); 3956 } 3957 new_ns->root = new; 3958 3959 /* 3960 * Second pass: switch the tsk->fs->* elements and mark new vfsmounts 3961 * as belonging to new namespace. We have already acquired a private 3962 * fs_struct, so tsk->fs->lock is not needed. 3963 */ 3964 p = old; 3965 q = new; 3966 while (p) { 3967 mnt_add_to_ns(new_ns, q); 3968 new_ns->nr_mounts++; 3969 if (new_fs) { 3970 if (&p->mnt == new_fs->root.mnt) { 3971 new_fs->root.mnt = mntget(&q->mnt); 3972 rootmnt = &p->mnt; 3973 } 3974 if (&p->mnt == new_fs->pwd.mnt) { 3975 new_fs->pwd.mnt = mntget(&q->mnt); 3976 pwdmnt = &p->mnt; 3977 } 3978 } 3979 p = next_mnt(p, old); 3980 q = next_mnt(q, new); 3981 if (!q) 3982 break; 3983 // an mntns binding we'd skipped? 3984 while (p->mnt.mnt_root != q->mnt.mnt_root) 3985 p = next_mnt(skip_mnt_tree(p), old); 3986 } 3987 mnt_ns_tree_add(new_ns); 3988 namespace_unlock(); 3989 3990 if (rootmnt) 3991 mntput(rootmnt); 3992 if (pwdmnt) 3993 mntput(pwdmnt); 3994 3995 return new_ns; 3996 } 3997 3998 struct dentry *mount_subtree(struct vfsmount *m, const char *name) 3999 { 4000 struct mount *mnt = real_mount(m); 4001 struct mnt_namespace *ns; 4002 struct super_block *s; 4003 struct path path; 4004 int err; 4005 4006 ns = alloc_mnt_ns(&init_user_ns, true); 4007 if (IS_ERR(ns)) { 4008 mntput(m); 4009 return ERR_CAST(ns); 4010 } 4011 ns->root = mnt; 4012 ns->nr_mounts++; 4013 mnt_add_to_ns(ns, mnt); 4014 4015 err = vfs_path_lookup(m->mnt_root, m, 4016 name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path); 4017 4018 put_mnt_ns(ns); 4019 4020 if (err) 4021 return ERR_PTR(err); 4022 4023 /* trade a vfsmount reference for active sb one */ 4024 s = path.mnt->mnt_sb; 4025 atomic_inc(&s->s_active); 4026 mntput(path.mnt); 4027 /* lock the sucker */ 4028 down_write(&s->s_umount); 4029 /* ... and return the root of (sub)tree on it */ 4030 return path.dentry; 4031 } 4032 EXPORT_SYMBOL(mount_subtree); 4033 4034 SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name, 4035 char __user *, type, unsigned long, flags, void __user *, data) 4036 { 4037 int ret; 4038 char *kernel_type; 4039 char *kernel_dev; 4040 void *options; 4041 4042 kernel_type = copy_mount_string(type); 4043 ret = PTR_ERR(kernel_type); 4044 if (IS_ERR(kernel_type)) 4045 goto out_type; 4046 4047 kernel_dev = copy_mount_string(dev_name); 4048 ret = PTR_ERR(kernel_dev); 4049 if (IS_ERR(kernel_dev)) 4050 goto out_dev; 4051 4052 options = copy_mount_options(data); 4053 ret = PTR_ERR(options); 4054 if (IS_ERR(options)) 4055 goto out_data; 4056 4057 ret = do_mount(kernel_dev, dir_name, kernel_type, flags, options); 4058 4059 kfree(options); 4060 out_data: 4061 kfree(kernel_dev); 4062 out_dev: 4063 kfree(kernel_type); 4064 out_type: 4065 return ret; 4066 } 4067 4068 #define FSMOUNT_VALID_FLAGS \ 4069 (MOUNT_ATTR_RDONLY | MOUNT_ATTR_NOSUID | MOUNT_ATTR_NODEV | \ 4070 MOUNT_ATTR_NOEXEC | MOUNT_ATTR__ATIME | MOUNT_ATTR_NODIRATIME | \ 4071 MOUNT_ATTR_NOSYMFOLLOW) 4072 4073 #define MOUNT_SETATTR_VALID_FLAGS (FSMOUNT_VALID_FLAGS | MOUNT_ATTR_IDMAP) 4074 4075 #define MOUNT_SETATTR_PROPAGATION_FLAGS \ 4076 (MS_UNBINDABLE | MS_PRIVATE | MS_SLAVE | MS_SHARED) 4077 4078 static unsigned int attr_flags_to_mnt_flags(u64 attr_flags) 4079 { 4080 unsigned int mnt_flags = 0; 4081 4082 if (attr_flags & MOUNT_ATTR_RDONLY) 4083 mnt_flags |= MNT_READONLY; 4084 if (attr_flags & MOUNT_ATTR_NOSUID) 4085 mnt_flags |= MNT_NOSUID; 4086 if (attr_flags & MOUNT_ATTR_NODEV) 4087 mnt_flags |= MNT_NODEV; 4088 if (attr_flags & MOUNT_ATTR_NOEXEC) 4089 mnt_flags |= MNT_NOEXEC; 4090 if (attr_flags & MOUNT_ATTR_NODIRATIME) 4091 mnt_flags |= MNT_NODIRATIME; 4092 if (attr_flags & MOUNT_ATTR_NOSYMFOLLOW) 4093 mnt_flags |= MNT_NOSYMFOLLOW; 4094 4095 return mnt_flags; 4096 } 4097 4098 /* 4099 * Create a kernel mount representation for a new, prepared superblock 4100 * (specified by fs_fd) and attach to an open_tree-like file descriptor. 4101 */ 4102 SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, 4103 unsigned int, attr_flags) 4104 { 4105 struct mnt_namespace *ns; 4106 struct fs_context *fc; 4107 struct file *file; 4108 struct path newmount; 4109 struct mount *mnt; 4110 unsigned int mnt_flags = 0; 4111 long ret; 4112 4113 if (!may_mount()) 4114 return -EPERM; 4115 4116 if ((flags & ~(FSMOUNT_CLOEXEC)) != 0) 4117 return -EINVAL; 4118 4119 if (attr_flags & ~FSMOUNT_VALID_FLAGS) 4120 return -EINVAL; 4121 4122 mnt_flags = attr_flags_to_mnt_flags(attr_flags); 4123 4124 switch (attr_flags & MOUNT_ATTR__ATIME) { 4125 case MOUNT_ATTR_STRICTATIME: 4126 break; 4127 case MOUNT_ATTR_NOATIME: 4128 mnt_flags |= MNT_NOATIME; 4129 break; 4130 case MOUNT_ATTR_RELATIME: 4131 mnt_flags |= MNT_RELATIME; 4132 break; 4133 default: 4134 return -EINVAL; 4135 } 4136 4137 CLASS(fd, f)(fs_fd); 4138 if (fd_empty(f)) 4139 return -EBADF; 4140 4141 if (fd_file(f)->f_op != &fscontext_fops) 4142 return -EINVAL; 4143 4144 fc = fd_file(f)->private_data; 4145 4146 ret = mutex_lock_interruptible(&fc->uapi_mutex); 4147 if (ret < 0) 4148 return ret; 4149 4150 /* There must be a valid superblock or we can't mount it */ 4151 ret = -EINVAL; 4152 if (!fc->root) 4153 goto err_unlock; 4154 4155 ret = -EPERM; 4156 if (mount_too_revealing(fc->root->d_sb, &mnt_flags)) { 4157 pr_warn("VFS: Mount too revealing\n"); 4158 goto err_unlock; 4159 } 4160 4161 ret = -EBUSY; 4162 if (fc->phase != FS_CONTEXT_AWAITING_MOUNT) 4163 goto err_unlock; 4164 4165 if (fc->sb_flags & SB_MANDLOCK) 4166 warn_mandlock(); 4167 4168 newmount.mnt = vfs_create_mount(fc); 4169 if (IS_ERR(newmount.mnt)) { 4170 ret = PTR_ERR(newmount.mnt); 4171 goto err_unlock; 4172 } 4173 newmount.dentry = dget(fc->root); 4174 newmount.mnt->mnt_flags = mnt_flags; 4175 4176 /* We've done the mount bit - now move the file context into more or 4177 * less the same state as if we'd done an fspick(). We don't want to 4178 * do any memory allocation or anything like that at this point as we 4179 * don't want to have to handle any errors incurred. 4180 */ 4181 vfs_clean_context(fc); 4182 4183 ns = alloc_mnt_ns(current->nsproxy->mnt_ns->user_ns, true); 4184 if (IS_ERR(ns)) { 4185 ret = PTR_ERR(ns); 4186 goto err_path; 4187 } 4188 mnt = real_mount(newmount.mnt); 4189 ns->root = mnt; 4190 ns->nr_mounts = 1; 4191 mnt_add_to_ns(ns, mnt); 4192 mntget(newmount.mnt); 4193 4194 /* Attach to an apparent O_PATH fd with a note that we need to unmount 4195 * it, not just simply put it. 4196 */ 4197 file = dentry_open(&newmount, O_PATH, fc->cred); 4198 if (IS_ERR(file)) { 4199 dissolve_on_fput(newmount.mnt); 4200 ret = PTR_ERR(file); 4201 goto err_path; 4202 } 4203 file->f_mode |= FMODE_NEED_UNMOUNT; 4204 4205 ret = get_unused_fd_flags((flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0); 4206 if (ret >= 0) 4207 fd_install(ret, file); 4208 else 4209 fput(file); 4210 4211 err_path: 4212 path_put(&newmount); 4213 err_unlock: 4214 mutex_unlock(&fc->uapi_mutex); 4215 return ret; 4216 } 4217 4218 /* 4219 * Move a mount from one place to another. In combination with 4220 * fsopen()/fsmount() this is used to install a new mount and in combination 4221 * with open_tree(OPEN_TREE_CLONE [| AT_RECURSIVE]) it can be used to copy 4222 * a mount subtree. 4223 * 4224 * Note the flags value is a combination of MOVE_MOUNT_* flags. 4225 */ 4226 SYSCALL_DEFINE5(move_mount, 4227 int, from_dfd, const char __user *, from_pathname, 4228 int, to_dfd, const char __user *, to_pathname, 4229 unsigned int, flags) 4230 { 4231 struct path from_path, to_path; 4232 unsigned int lflags; 4233 int ret = 0; 4234 4235 if (!may_mount()) 4236 return -EPERM; 4237 4238 if (flags & ~MOVE_MOUNT__MASK) 4239 return -EINVAL; 4240 4241 if ((flags & (MOVE_MOUNT_BENEATH | MOVE_MOUNT_SET_GROUP)) == 4242 (MOVE_MOUNT_BENEATH | MOVE_MOUNT_SET_GROUP)) 4243 return -EINVAL; 4244 4245 /* If someone gives a pathname, they aren't permitted to move 4246 * from an fd that requires unmount as we can't get at the flag 4247 * to clear it afterwards. 4248 */ 4249 lflags = 0; 4250 if (flags & MOVE_MOUNT_F_SYMLINKS) lflags |= LOOKUP_FOLLOW; 4251 if (flags & MOVE_MOUNT_F_AUTOMOUNTS) lflags |= LOOKUP_AUTOMOUNT; 4252 if (flags & MOVE_MOUNT_F_EMPTY_PATH) lflags |= LOOKUP_EMPTY; 4253 4254 ret = user_path_at(from_dfd, from_pathname, lflags, &from_path); 4255 if (ret < 0) 4256 return ret; 4257 4258 lflags = 0; 4259 if (flags & MOVE_MOUNT_T_SYMLINKS) lflags |= LOOKUP_FOLLOW; 4260 if (flags & MOVE_MOUNT_T_AUTOMOUNTS) lflags |= LOOKUP_AUTOMOUNT; 4261 if (flags & MOVE_MOUNT_T_EMPTY_PATH) lflags |= LOOKUP_EMPTY; 4262 4263 ret = user_path_at(to_dfd, to_pathname, lflags, &to_path); 4264 if (ret < 0) 4265 goto out_from; 4266 4267 ret = security_move_mount(&from_path, &to_path); 4268 if (ret < 0) 4269 goto out_to; 4270 4271 if (flags & MOVE_MOUNT_SET_GROUP) 4272 ret = do_set_group(&from_path, &to_path); 4273 else 4274 ret = do_move_mount(&from_path, &to_path, 4275 (flags & MOVE_MOUNT_BENEATH)); 4276 4277 out_to: 4278 path_put(&to_path); 4279 out_from: 4280 path_put(&from_path); 4281 return ret; 4282 } 4283 4284 /* 4285 * Return true if path is reachable from root 4286 * 4287 * namespace_sem or mount_lock is held 4288 */ 4289 bool is_path_reachable(struct mount *mnt, struct dentry *dentry, 4290 const struct path *root) 4291 { 4292 while (&mnt->mnt != root->mnt && mnt_has_parent(mnt)) { 4293 dentry = mnt->mnt_mountpoint; 4294 mnt = mnt->mnt_parent; 4295 } 4296 return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry); 4297 } 4298 4299 bool path_is_under(const struct path *path1, const struct path *path2) 4300 { 4301 bool res; 4302 read_seqlock_excl(&mount_lock); 4303 res = is_path_reachable(real_mount(path1->mnt), path1->dentry, path2); 4304 read_sequnlock_excl(&mount_lock); 4305 return res; 4306 } 4307 EXPORT_SYMBOL(path_is_under); 4308 4309 /* 4310 * pivot_root Semantics: 4311 * Moves the root file system of the current process to the directory put_old, 4312 * makes new_root as the new root file system of the current process, and sets 4313 * root/cwd of all processes which had them on the current root to new_root. 4314 * 4315 * Restrictions: 4316 * The new_root and put_old must be directories, and must not be on the 4317 * same file system as the current process root. The put_old must be 4318 * underneath new_root, i.e. adding a non-zero number of /.. to the string 4319 * pointed to by put_old must yield the same directory as new_root. No other 4320 * file system may be mounted on put_old. After all, new_root is a mountpoint. 4321 * 4322 * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem. 4323 * See Documentation/filesystems/ramfs-rootfs-initramfs.rst for alternatives 4324 * in this situation. 4325 * 4326 * Notes: 4327 * - we don't move root/cwd if they are not at the root (reason: if something 4328 * cared enough to change them, it's probably wrong to force them elsewhere) 4329 * - it's okay to pick a root that isn't the root of a file system, e.g. 4330 * /nfs/my_root where /nfs is the mount point. It must be a mountpoint, 4331 * though, so you may need to say mount --bind /nfs/my_root /nfs/my_root 4332 * first. 4333 */ 4334 SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, 4335 const char __user *, put_old) 4336 { 4337 struct path new, old, root; 4338 struct mount *new_mnt, *root_mnt, *old_mnt, *root_parent, *ex_parent; 4339 struct mountpoint *old_mp, *root_mp; 4340 int error; 4341 4342 if (!may_mount()) 4343 return -EPERM; 4344 4345 error = user_path_at(AT_FDCWD, new_root, 4346 LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &new); 4347 if (error) 4348 goto out0; 4349 4350 error = user_path_at(AT_FDCWD, put_old, 4351 LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &old); 4352 if (error) 4353 goto out1; 4354 4355 error = security_sb_pivotroot(&old, &new); 4356 if (error) 4357 goto out2; 4358 4359 get_fs_root(current->fs, &root); 4360 old_mp = lock_mount(&old); 4361 error = PTR_ERR(old_mp); 4362 if (IS_ERR(old_mp)) 4363 goto out3; 4364 4365 error = -EINVAL; 4366 new_mnt = real_mount(new.mnt); 4367 root_mnt = real_mount(root.mnt); 4368 old_mnt = real_mount(old.mnt); 4369 ex_parent = new_mnt->mnt_parent; 4370 root_parent = root_mnt->mnt_parent; 4371 if (IS_MNT_SHARED(old_mnt) || 4372 IS_MNT_SHARED(ex_parent) || 4373 IS_MNT_SHARED(root_parent)) 4374 goto out4; 4375 if (!check_mnt(root_mnt) || !check_mnt(new_mnt)) 4376 goto out4; 4377 if (new_mnt->mnt.mnt_flags & MNT_LOCKED) 4378 goto out4; 4379 error = -ENOENT; 4380 if (d_unlinked(new.dentry)) 4381 goto out4; 4382 error = -EBUSY; 4383 if (new_mnt == root_mnt || old_mnt == root_mnt) 4384 goto out4; /* loop, on the same file system */ 4385 error = -EINVAL; 4386 if (!path_mounted(&root)) 4387 goto out4; /* not a mountpoint */ 4388 if (!mnt_has_parent(root_mnt)) 4389 goto out4; /* not attached */ 4390 if (!path_mounted(&new)) 4391 goto out4; /* not a mountpoint */ 4392 if (!mnt_has_parent(new_mnt)) 4393 goto out4; /* not attached */ 4394 /* make sure we can reach put_old from new_root */ 4395 if (!is_path_reachable(old_mnt, old.dentry, &new)) 4396 goto out4; 4397 /* make certain new is below the root */ 4398 if (!is_path_reachable(new_mnt, new.dentry, &root)) 4399 goto out4; 4400 lock_mount_hash(); 4401 umount_mnt(new_mnt); 4402 root_mp = unhash_mnt(root_mnt); /* we'll need its mountpoint */ 4403 if (root_mnt->mnt.mnt_flags & MNT_LOCKED) { 4404 new_mnt->mnt.mnt_flags |= MNT_LOCKED; 4405 root_mnt->mnt.mnt_flags &= ~MNT_LOCKED; 4406 } 4407 /* mount old root on put_old */ 4408 attach_mnt(root_mnt, old_mnt, old_mp, false); 4409 /* mount new_root on / */ 4410 attach_mnt(new_mnt, root_parent, root_mp, false); 4411 mnt_add_count(root_parent, -1); 4412 touch_mnt_namespace(current->nsproxy->mnt_ns); 4413 /* A moved mount should not expire automatically */ 4414 list_del_init(&new_mnt->mnt_expire); 4415 put_mountpoint(root_mp); 4416 unlock_mount_hash(); 4417 chroot_fs_refs(&root, &new); 4418 error = 0; 4419 out4: 4420 unlock_mount(old_mp); 4421 if (!error) 4422 mntput_no_expire(ex_parent); 4423 out3: 4424 path_put(&root); 4425 out2: 4426 path_put(&old); 4427 out1: 4428 path_put(&new); 4429 out0: 4430 return error; 4431 } 4432 4433 static unsigned int recalc_flags(struct mount_kattr *kattr, struct mount *mnt) 4434 { 4435 unsigned int flags = mnt->mnt.mnt_flags; 4436 4437 /* flags to clear */ 4438 flags &= ~kattr->attr_clr; 4439 /* flags to raise */ 4440 flags |= kattr->attr_set; 4441 4442 return flags; 4443 } 4444 4445 static int can_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt) 4446 { 4447 struct vfsmount *m = &mnt->mnt; 4448 struct user_namespace *fs_userns = m->mnt_sb->s_user_ns; 4449 4450 if (!kattr->mnt_idmap) 4451 return 0; 4452 4453 /* 4454 * Creating an idmapped mount with the filesystem wide idmapping 4455 * doesn't make sense so block that. We don't allow mushy semantics. 4456 */ 4457 if (kattr->mnt_userns == m->mnt_sb->s_user_ns) 4458 return -EINVAL; 4459 4460 /* 4461 * Once a mount has been idmapped we don't allow it to change its 4462 * mapping. It makes things simpler and callers can just create 4463 * another bind-mount they can idmap if they want to. 4464 */ 4465 if (is_idmapped_mnt(m)) 4466 return -EPERM; 4467 4468 /* The underlying filesystem doesn't support idmapped mounts yet. */ 4469 if (!(m->mnt_sb->s_type->fs_flags & FS_ALLOW_IDMAP)) 4470 return -EINVAL; 4471 4472 /* The filesystem has turned off idmapped mounts. */ 4473 if (m->mnt_sb->s_iflags & SB_I_NOIDMAP) 4474 return -EINVAL; 4475 4476 /* We're not controlling the superblock. */ 4477 if (!ns_capable(fs_userns, CAP_SYS_ADMIN)) 4478 return -EPERM; 4479 4480 /* Mount has already been visible in the filesystem hierarchy. */ 4481 if (!is_anon_ns(mnt->mnt_ns)) 4482 return -EINVAL; 4483 4484 return 0; 4485 } 4486 4487 /** 4488 * mnt_allow_writers() - check whether the attribute change allows writers 4489 * @kattr: the new mount attributes 4490 * @mnt: the mount to which @kattr will be applied 4491 * 4492 * Check whether thew new mount attributes in @kattr allow concurrent writers. 4493 * 4494 * Return: true if writers need to be held, false if not 4495 */ 4496 static inline bool mnt_allow_writers(const struct mount_kattr *kattr, 4497 const struct mount *mnt) 4498 { 4499 return (!(kattr->attr_set & MNT_READONLY) || 4500 (mnt->mnt.mnt_flags & MNT_READONLY)) && 4501 !kattr->mnt_idmap; 4502 } 4503 4504 static int mount_setattr_prepare(struct mount_kattr *kattr, struct mount *mnt) 4505 { 4506 struct mount *m; 4507 int err; 4508 4509 for (m = mnt; m; m = next_mnt(m, mnt)) { 4510 if (!can_change_locked_flags(m, recalc_flags(kattr, m))) { 4511 err = -EPERM; 4512 break; 4513 } 4514 4515 err = can_idmap_mount(kattr, m); 4516 if (err) 4517 break; 4518 4519 if (!mnt_allow_writers(kattr, m)) { 4520 err = mnt_hold_writers(m); 4521 if (err) 4522 break; 4523 } 4524 4525 if (!kattr->recurse) 4526 return 0; 4527 } 4528 4529 if (err) { 4530 struct mount *p; 4531 4532 /* 4533 * If we had to call mnt_hold_writers() MNT_WRITE_HOLD will 4534 * be set in @mnt_flags. The loop unsets MNT_WRITE_HOLD for all 4535 * mounts and needs to take care to include the first mount. 4536 */ 4537 for (p = mnt; p; p = next_mnt(p, mnt)) { 4538 /* If we had to hold writers unblock them. */ 4539 if (p->mnt.mnt_flags & MNT_WRITE_HOLD) 4540 mnt_unhold_writers(p); 4541 4542 /* 4543 * We're done once the first mount we changed got 4544 * MNT_WRITE_HOLD unset. 4545 */ 4546 if (p == m) 4547 break; 4548 } 4549 } 4550 return err; 4551 } 4552 4553 static void do_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt) 4554 { 4555 if (!kattr->mnt_idmap) 4556 return; 4557 4558 /* 4559 * Pairs with smp_load_acquire() in mnt_idmap(). 4560 * 4561 * Since we only allow a mount to change the idmapping once and 4562 * verified this in can_idmap_mount() we know that the mount has 4563 * @nop_mnt_idmap attached to it. So there's no need to drop any 4564 * references. 4565 */ 4566 smp_store_release(&mnt->mnt.mnt_idmap, mnt_idmap_get(kattr->mnt_idmap)); 4567 } 4568 4569 static void mount_setattr_commit(struct mount_kattr *kattr, struct mount *mnt) 4570 { 4571 struct mount *m; 4572 4573 for (m = mnt; m; m = next_mnt(m, mnt)) { 4574 unsigned int flags; 4575 4576 do_idmap_mount(kattr, m); 4577 flags = recalc_flags(kattr, m); 4578 WRITE_ONCE(m->mnt.mnt_flags, flags); 4579 4580 /* If we had to hold writers unblock them. */ 4581 if (m->mnt.mnt_flags & MNT_WRITE_HOLD) 4582 mnt_unhold_writers(m); 4583 4584 if (kattr->propagation) 4585 change_mnt_propagation(m, kattr->propagation); 4586 if (!kattr->recurse) 4587 break; 4588 } 4589 touch_mnt_namespace(mnt->mnt_ns); 4590 } 4591 4592 static int do_mount_setattr(struct path *path, struct mount_kattr *kattr) 4593 { 4594 struct mount *mnt = real_mount(path->mnt); 4595 int err = 0; 4596 4597 if (!path_mounted(path)) 4598 return -EINVAL; 4599 4600 if (kattr->mnt_userns) { 4601 struct mnt_idmap *mnt_idmap; 4602 4603 mnt_idmap = alloc_mnt_idmap(kattr->mnt_userns); 4604 if (IS_ERR(mnt_idmap)) 4605 return PTR_ERR(mnt_idmap); 4606 kattr->mnt_idmap = mnt_idmap; 4607 } 4608 4609 if (kattr->propagation) { 4610 /* 4611 * Only take namespace_lock() if we're actually changing 4612 * propagation. 4613 */ 4614 namespace_lock(); 4615 if (kattr->propagation == MS_SHARED) { 4616 err = invent_group_ids(mnt, kattr->recurse); 4617 if (err) { 4618 namespace_unlock(); 4619 return err; 4620 } 4621 } 4622 } 4623 4624 err = -EINVAL; 4625 lock_mount_hash(); 4626 4627 /* Ensure that this isn't anything purely vfs internal. */ 4628 if (!is_mounted(&mnt->mnt)) 4629 goto out; 4630 4631 /* 4632 * If this is an attached mount make sure it's located in the callers 4633 * mount namespace. If it's not don't let the caller interact with it. 4634 * 4635 * If this mount doesn't have a parent it's most often simply a 4636 * detached mount with an anonymous mount namespace. IOW, something 4637 * that's simply not attached yet. But there are apparently also users 4638 * that do change mount properties on the rootfs itself. That obviously 4639 * neither has a parent nor is it a detached mount so we cannot 4640 * unconditionally check for detached mounts. 4641 */ 4642 if ((mnt_has_parent(mnt) || !is_anon_ns(mnt->mnt_ns)) && !check_mnt(mnt)) 4643 goto out; 4644 4645 /* 4646 * First, we get the mount tree in a shape where we can change mount 4647 * properties without failure. If we succeeded to do so we commit all 4648 * changes and if we failed we clean up. 4649 */ 4650 err = mount_setattr_prepare(kattr, mnt); 4651 if (!err) 4652 mount_setattr_commit(kattr, mnt); 4653 4654 out: 4655 unlock_mount_hash(); 4656 4657 if (kattr->propagation) { 4658 if (err) 4659 cleanup_group_ids(mnt, NULL); 4660 namespace_unlock(); 4661 } 4662 4663 return err; 4664 } 4665 4666 static int build_mount_idmapped(const struct mount_attr *attr, size_t usize, 4667 struct mount_kattr *kattr, unsigned int flags) 4668 { 4669 struct ns_common *ns; 4670 struct user_namespace *mnt_userns; 4671 4672 if (!((attr->attr_set | attr->attr_clr) & MOUNT_ATTR_IDMAP)) 4673 return 0; 4674 4675 /* 4676 * We currently do not support clearing an idmapped mount. If this ever 4677 * is a use-case we can revisit this but for now let's keep it simple 4678 * and not allow it. 4679 */ 4680 if (attr->attr_clr & MOUNT_ATTR_IDMAP) 4681 return -EINVAL; 4682 4683 if (attr->userns_fd > INT_MAX) 4684 return -EINVAL; 4685 4686 CLASS(fd, f)(attr->userns_fd); 4687 if (fd_empty(f)) 4688 return -EBADF; 4689 4690 if (!proc_ns_file(fd_file(f))) 4691 return -EINVAL; 4692 4693 ns = get_proc_ns(file_inode(fd_file(f))); 4694 if (ns->ops->type != CLONE_NEWUSER) 4695 return -EINVAL; 4696 4697 /* 4698 * The initial idmapping cannot be used to create an idmapped 4699 * mount. We use the initial idmapping as an indicator of a mount 4700 * that is not idmapped. It can simply be passed into helpers that 4701 * are aware of idmapped mounts as a convenient shortcut. A user 4702 * can just create a dedicated identity mapping to achieve the same 4703 * result. 4704 */ 4705 mnt_userns = container_of(ns, struct user_namespace, ns); 4706 if (mnt_userns == &init_user_ns) 4707 return -EPERM; 4708 4709 /* We're not controlling the target namespace. */ 4710 if (!ns_capable(mnt_userns, CAP_SYS_ADMIN)) 4711 return -EPERM; 4712 4713 kattr->mnt_userns = get_user_ns(mnt_userns); 4714 return 0; 4715 } 4716 4717 static int build_mount_kattr(const struct mount_attr *attr, size_t usize, 4718 struct mount_kattr *kattr, unsigned int flags) 4719 { 4720 unsigned int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW; 4721 4722 if (flags & AT_NO_AUTOMOUNT) 4723 lookup_flags &= ~LOOKUP_AUTOMOUNT; 4724 if (flags & AT_SYMLINK_NOFOLLOW) 4725 lookup_flags &= ~LOOKUP_FOLLOW; 4726 if (flags & AT_EMPTY_PATH) 4727 lookup_flags |= LOOKUP_EMPTY; 4728 4729 *kattr = (struct mount_kattr) { 4730 .lookup_flags = lookup_flags, 4731 .recurse = !!(flags & AT_RECURSIVE), 4732 }; 4733 4734 if (attr->propagation & ~MOUNT_SETATTR_PROPAGATION_FLAGS) 4735 return -EINVAL; 4736 if (hweight32(attr->propagation & MOUNT_SETATTR_PROPAGATION_FLAGS) > 1) 4737 return -EINVAL; 4738 kattr->propagation = attr->propagation; 4739 4740 if ((attr->attr_set | attr->attr_clr) & ~MOUNT_SETATTR_VALID_FLAGS) 4741 return -EINVAL; 4742 4743 kattr->attr_set = attr_flags_to_mnt_flags(attr->attr_set); 4744 kattr->attr_clr = attr_flags_to_mnt_flags(attr->attr_clr); 4745 4746 /* 4747 * Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap, 4748 * users wanting to transition to a different atime setting cannot 4749 * simply specify the atime setting in @attr_set, but must also 4750 * specify MOUNT_ATTR__ATIME in the @attr_clr field. 4751 * So ensure that MOUNT_ATTR__ATIME can't be partially set in 4752 * @attr_clr and that @attr_set can't have any atime bits set if 4753 * MOUNT_ATTR__ATIME isn't set in @attr_clr. 4754 */ 4755 if (attr->attr_clr & MOUNT_ATTR__ATIME) { 4756 if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME) 4757 return -EINVAL; 4758 4759 /* 4760 * Clear all previous time settings as they are mutually 4761 * exclusive. 4762 */ 4763 kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME; 4764 switch (attr->attr_set & MOUNT_ATTR__ATIME) { 4765 case MOUNT_ATTR_RELATIME: 4766 kattr->attr_set |= MNT_RELATIME; 4767 break; 4768 case MOUNT_ATTR_NOATIME: 4769 kattr->attr_set |= MNT_NOATIME; 4770 break; 4771 case MOUNT_ATTR_STRICTATIME: 4772 break; 4773 default: 4774 return -EINVAL; 4775 } 4776 } else { 4777 if (attr->attr_set & MOUNT_ATTR__ATIME) 4778 return -EINVAL; 4779 } 4780 4781 return build_mount_idmapped(attr, usize, kattr, flags); 4782 } 4783 4784 static void finish_mount_kattr(struct mount_kattr *kattr) 4785 { 4786 put_user_ns(kattr->mnt_userns); 4787 kattr->mnt_userns = NULL; 4788 4789 if (kattr->mnt_idmap) 4790 mnt_idmap_put(kattr->mnt_idmap); 4791 } 4792 4793 SYSCALL_DEFINE5(mount_setattr, int, dfd, const char __user *, path, 4794 unsigned int, flags, struct mount_attr __user *, uattr, 4795 size_t, usize) 4796 { 4797 int err; 4798 struct path target; 4799 struct mount_attr attr; 4800 struct mount_kattr kattr; 4801 4802 BUILD_BUG_ON(sizeof(struct mount_attr) != MOUNT_ATTR_SIZE_VER0); 4803 4804 if (flags & ~(AT_EMPTY_PATH | 4805 AT_RECURSIVE | 4806 AT_SYMLINK_NOFOLLOW | 4807 AT_NO_AUTOMOUNT)) 4808 return -EINVAL; 4809 4810 if (unlikely(usize > PAGE_SIZE)) 4811 return -E2BIG; 4812 if (unlikely(usize < MOUNT_ATTR_SIZE_VER0)) 4813 return -EINVAL; 4814 4815 if (!may_mount()) 4816 return -EPERM; 4817 4818 err = copy_struct_from_user(&attr, sizeof(attr), uattr, usize); 4819 if (err) 4820 return err; 4821 4822 /* Don't bother walking through the mounts if this is a nop. */ 4823 if (attr.attr_set == 0 && 4824 attr.attr_clr == 0 && 4825 attr.propagation == 0) 4826 return 0; 4827 4828 err = build_mount_kattr(&attr, usize, &kattr, flags); 4829 if (err) 4830 return err; 4831 4832 err = user_path_at(dfd, path, kattr.lookup_flags, &target); 4833 if (!err) { 4834 err = do_mount_setattr(&target, &kattr); 4835 path_put(&target); 4836 } 4837 finish_mount_kattr(&kattr); 4838 return err; 4839 } 4840 4841 int show_path(struct seq_file *m, struct dentry *root) 4842 { 4843 if (root->d_sb->s_op->show_path) 4844 return root->d_sb->s_op->show_path(m, root); 4845 4846 seq_dentry(m, root, " \t\n\\"); 4847 return 0; 4848 } 4849 4850 static struct vfsmount *lookup_mnt_in_ns(u64 id, struct mnt_namespace *ns) 4851 { 4852 struct mount *mnt = mnt_find_id_at(ns, id); 4853 4854 if (!mnt || mnt->mnt_id_unique != id) 4855 return NULL; 4856 4857 return &mnt->mnt; 4858 } 4859 4860 struct kstatmount { 4861 struct statmount __user *buf; 4862 size_t bufsize; 4863 struct vfsmount *mnt; 4864 u64 mask; 4865 struct path root; 4866 struct statmount sm; 4867 struct seq_file seq; 4868 }; 4869 4870 static u64 mnt_to_attr_flags(struct vfsmount *mnt) 4871 { 4872 unsigned int mnt_flags = READ_ONCE(mnt->mnt_flags); 4873 u64 attr_flags = 0; 4874 4875 if (mnt_flags & MNT_READONLY) 4876 attr_flags |= MOUNT_ATTR_RDONLY; 4877 if (mnt_flags & MNT_NOSUID) 4878 attr_flags |= MOUNT_ATTR_NOSUID; 4879 if (mnt_flags & MNT_NODEV) 4880 attr_flags |= MOUNT_ATTR_NODEV; 4881 if (mnt_flags & MNT_NOEXEC) 4882 attr_flags |= MOUNT_ATTR_NOEXEC; 4883 if (mnt_flags & MNT_NODIRATIME) 4884 attr_flags |= MOUNT_ATTR_NODIRATIME; 4885 if (mnt_flags & MNT_NOSYMFOLLOW) 4886 attr_flags |= MOUNT_ATTR_NOSYMFOLLOW; 4887 4888 if (mnt_flags & MNT_NOATIME) 4889 attr_flags |= MOUNT_ATTR_NOATIME; 4890 else if (mnt_flags & MNT_RELATIME) 4891 attr_flags |= MOUNT_ATTR_RELATIME; 4892 else 4893 attr_flags |= MOUNT_ATTR_STRICTATIME; 4894 4895 if (is_idmapped_mnt(mnt)) 4896 attr_flags |= MOUNT_ATTR_IDMAP; 4897 4898 return attr_flags; 4899 } 4900 4901 static u64 mnt_to_propagation_flags(struct mount *m) 4902 { 4903 u64 propagation = 0; 4904 4905 if (IS_MNT_SHARED(m)) 4906 propagation |= MS_SHARED; 4907 if (IS_MNT_SLAVE(m)) 4908 propagation |= MS_SLAVE; 4909 if (IS_MNT_UNBINDABLE(m)) 4910 propagation |= MS_UNBINDABLE; 4911 if (!propagation) 4912 propagation |= MS_PRIVATE; 4913 4914 return propagation; 4915 } 4916 4917 static void statmount_sb_basic(struct kstatmount *s) 4918 { 4919 struct super_block *sb = s->mnt->mnt_sb; 4920 4921 s->sm.mask |= STATMOUNT_SB_BASIC; 4922 s->sm.sb_dev_major = MAJOR(sb->s_dev); 4923 s->sm.sb_dev_minor = MINOR(sb->s_dev); 4924 s->sm.sb_magic = sb->s_magic; 4925 s->sm.sb_flags = sb->s_flags & (SB_RDONLY|SB_SYNCHRONOUS|SB_DIRSYNC|SB_LAZYTIME); 4926 } 4927 4928 static void statmount_mnt_basic(struct kstatmount *s) 4929 { 4930 struct mount *m = real_mount(s->mnt); 4931 4932 s->sm.mask |= STATMOUNT_MNT_BASIC; 4933 s->sm.mnt_id = m->mnt_id_unique; 4934 s->sm.mnt_parent_id = m->mnt_parent->mnt_id_unique; 4935 s->sm.mnt_id_old = m->mnt_id; 4936 s->sm.mnt_parent_id_old = m->mnt_parent->mnt_id; 4937 s->sm.mnt_attr = mnt_to_attr_flags(&m->mnt); 4938 s->sm.mnt_propagation = mnt_to_propagation_flags(m); 4939 s->sm.mnt_peer_group = IS_MNT_SHARED(m) ? m->mnt_group_id : 0; 4940 s->sm.mnt_master = IS_MNT_SLAVE(m) ? m->mnt_master->mnt_group_id : 0; 4941 } 4942 4943 static void statmount_propagate_from(struct kstatmount *s) 4944 { 4945 struct mount *m = real_mount(s->mnt); 4946 4947 s->sm.mask |= STATMOUNT_PROPAGATE_FROM; 4948 if (IS_MNT_SLAVE(m)) 4949 s->sm.propagate_from = get_dominating_id(m, ¤t->fs->root); 4950 } 4951 4952 static int statmount_mnt_root(struct kstatmount *s, struct seq_file *seq) 4953 { 4954 int ret; 4955 size_t start = seq->count; 4956 4957 ret = show_path(seq, s->mnt->mnt_root); 4958 if (ret) 4959 return ret; 4960 4961 if (unlikely(seq_has_overflowed(seq))) 4962 return -EAGAIN; 4963 4964 /* 4965 * Unescape the result. It would be better if supplied string was not 4966 * escaped in the first place, but that's a pretty invasive change. 4967 */ 4968 seq->buf[seq->count] = '\0'; 4969 seq->count = start; 4970 seq_commit(seq, string_unescape_inplace(seq->buf + start, UNESCAPE_OCTAL)); 4971 return 0; 4972 } 4973 4974 static int statmount_mnt_point(struct kstatmount *s, struct seq_file *seq) 4975 { 4976 struct vfsmount *mnt = s->mnt; 4977 struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt }; 4978 int err; 4979 4980 err = seq_path_root(seq, &mnt_path, &s->root, ""); 4981 return err == SEQ_SKIP ? 0 : err; 4982 } 4983 4984 static int statmount_fs_type(struct kstatmount *s, struct seq_file *seq) 4985 { 4986 struct super_block *sb = s->mnt->mnt_sb; 4987 4988 seq_puts(seq, sb->s_type->name); 4989 return 0; 4990 } 4991 4992 static void statmount_fs_subtype(struct kstatmount *s, struct seq_file *seq) 4993 { 4994 struct super_block *sb = s->mnt->mnt_sb; 4995 4996 if (sb->s_subtype) 4997 seq_puts(seq, sb->s_subtype); 4998 } 4999 5000 static int statmount_sb_source(struct kstatmount *s, struct seq_file *seq) 5001 { 5002 struct super_block *sb = s->mnt->mnt_sb; 5003 struct mount *r = real_mount(s->mnt); 5004 5005 if (sb->s_op->show_devname) { 5006 size_t start = seq->count; 5007 int ret; 5008 5009 ret = sb->s_op->show_devname(seq, s->mnt->mnt_root); 5010 if (ret) 5011 return ret; 5012 5013 if (unlikely(seq_has_overflowed(seq))) 5014 return -EAGAIN; 5015 5016 /* Unescape the result */ 5017 seq->buf[seq->count] = '\0'; 5018 seq->count = start; 5019 seq_commit(seq, string_unescape_inplace(seq->buf + start, UNESCAPE_OCTAL)); 5020 } else if (r->mnt_devname) { 5021 seq_puts(seq, r->mnt_devname); 5022 } 5023 return 0; 5024 } 5025 5026 static void statmount_mnt_ns_id(struct kstatmount *s, struct mnt_namespace *ns) 5027 { 5028 s->sm.mask |= STATMOUNT_MNT_NS_ID; 5029 s->sm.mnt_ns_id = ns->seq; 5030 } 5031 5032 static int statmount_mnt_opts(struct kstatmount *s, struct seq_file *seq) 5033 { 5034 struct vfsmount *mnt = s->mnt; 5035 struct super_block *sb = mnt->mnt_sb; 5036 int err; 5037 5038 if (sb->s_op->show_options) { 5039 size_t start = seq->count; 5040 5041 err = sb->s_op->show_options(seq, mnt->mnt_root); 5042 if (err) 5043 return err; 5044 5045 if (unlikely(seq_has_overflowed(seq))) 5046 return -EAGAIN; 5047 5048 if (seq->count == start) 5049 return 0; 5050 5051 /* skip leading comma */ 5052 memmove(seq->buf + start, seq->buf + start + 1, 5053 seq->count - start - 1); 5054 seq->count--; 5055 } 5056 5057 return 0; 5058 } 5059 5060 static inline int statmount_opt_unescape(struct seq_file *seq, char *buf_start) 5061 { 5062 char *buf_end, *opt_start, *opt_end; 5063 int count = 0; 5064 5065 buf_end = seq->buf + seq->count; 5066 *buf_end = '\0'; 5067 for (opt_start = buf_start + 1; opt_start < buf_end; opt_start = opt_end + 1) { 5068 opt_end = strchrnul(opt_start, ','); 5069 *opt_end = '\0'; 5070 buf_start += string_unescape(opt_start, buf_start, 0, UNESCAPE_OCTAL) + 1; 5071 if (WARN_ON_ONCE(++count == INT_MAX)) 5072 return -EOVERFLOW; 5073 } 5074 seq->count = buf_start - 1 - seq->buf; 5075 return count; 5076 } 5077 5078 static int statmount_opt_array(struct kstatmount *s, struct seq_file *seq) 5079 { 5080 struct vfsmount *mnt = s->mnt; 5081 struct super_block *sb = mnt->mnt_sb; 5082 size_t start = seq->count; 5083 char *buf_start; 5084 int err; 5085 5086 if (!sb->s_op->show_options) 5087 return 0; 5088 5089 buf_start = seq->buf + start; 5090 err = sb->s_op->show_options(seq, mnt->mnt_root); 5091 if (err) 5092 return err; 5093 5094 if (unlikely(seq_has_overflowed(seq))) 5095 return -EAGAIN; 5096 5097 if (seq->count == start) 5098 return 0; 5099 5100 err = statmount_opt_unescape(seq, buf_start); 5101 if (err < 0) 5102 return err; 5103 5104 s->sm.opt_num = err; 5105 return 0; 5106 } 5107 5108 static int statmount_opt_sec_array(struct kstatmount *s, struct seq_file *seq) 5109 { 5110 struct vfsmount *mnt = s->mnt; 5111 struct super_block *sb = mnt->mnt_sb; 5112 size_t start = seq->count; 5113 char *buf_start; 5114 int err; 5115 5116 buf_start = seq->buf + start; 5117 5118 err = security_sb_show_options(seq, sb); 5119 if (!err) 5120 return err; 5121 5122 if (unlikely(seq_has_overflowed(seq))) 5123 return -EAGAIN; 5124 5125 if (seq->count == start) 5126 return 0; 5127 5128 err = statmount_opt_unescape(seq, buf_start); 5129 if (err < 0) 5130 return err; 5131 5132 s->sm.opt_sec_num = err; 5133 return 0; 5134 } 5135 5136 static int statmount_string(struct kstatmount *s, u64 flag) 5137 { 5138 int ret = 0; 5139 size_t kbufsize; 5140 struct seq_file *seq = &s->seq; 5141 struct statmount *sm = &s->sm; 5142 u32 start = seq->count; 5143 5144 switch (flag) { 5145 case STATMOUNT_FS_TYPE: 5146 sm->fs_type = start; 5147 ret = statmount_fs_type(s, seq); 5148 break; 5149 case STATMOUNT_MNT_ROOT: 5150 sm->mnt_root = start; 5151 ret = statmount_mnt_root(s, seq); 5152 break; 5153 case STATMOUNT_MNT_POINT: 5154 sm->mnt_point = start; 5155 ret = statmount_mnt_point(s, seq); 5156 break; 5157 case STATMOUNT_MNT_OPTS: 5158 sm->mnt_opts = start; 5159 ret = statmount_mnt_opts(s, seq); 5160 break; 5161 case STATMOUNT_OPT_ARRAY: 5162 sm->opt_array = start; 5163 ret = statmount_opt_array(s, seq); 5164 break; 5165 case STATMOUNT_OPT_SEC_ARRAY: 5166 sm->opt_sec_array = start; 5167 ret = statmount_opt_sec_array(s, seq); 5168 break; 5169 case STATMOUNT_FS_SUBTYPE: 5170 sm->fs_subtype = start; 5171 statmount_fs_subtype(s, seq); 5172 break; 5173 case STATMOUNT_SB_SOURCE: 5174 sm->sb_source = start; 5175 ret = statmount_sb_source(s, seq); 5176 break; 5177 default: 5178 WARN_ON_ONCE(true); 5179 return -EINVAL; 5180 } 5181 5182 /* 5183 * If nothing was emitted, return to avoid setting the flag 5184 * and terminating the buffer. 5185 */ 5186 if (seq->count == start) 5187 return ret; 5188 if (unlikely(check_add_overflow(sizeof(*sm), seq->count, &kbufsize))) 5189 return -EOVERFLOW; 5190 if (kbufsize >= s->bufsize) 5191 return -EOVERFLOW; 5192 5193 /* signal a retry */ 5194 if (unlikely(seq_has_overflowed(seq))) 5195 return -EAGAIN; 5196 5197 if (ret) 5198 return ret; 5199 5200 seq->buf[seq->count++] = '\0'; 5201 sm->mask |= flag; 5202 return 0; 5203 } 5204 5205 static int copy_statmount_to_user(struct kstatmount *s) 5206 { 5207 struct statmount *sm = &s->sm; 5208 struct seq_file *seq = &s->seq; 5209 char __user *str = ((char __user *)s->buf) + sizeof(*sm); 5210 size_t copysize = min_t(size_t, s->bufsize, sizeof(*sm)); 5211 5212 if (seq->count && copy_to_user(str, seq->buf, seq->count)) 5213 return -EFAULT; 5214 5215 /* Return the number of bytes copied to the buffer */ 5216 sm->size = copysize + seq->count; 5217 if (copy_to_user(s->buf, sm, copysize)) 5218 return -EFAULT; 5219 5220 return 0; 5221 } 5222 5223 static struct mount *listmnt_next(struct mount *curr, bool reverse) 5224 { 5225 struct rb_node *node; 5226 5227 if (reverse) 5228 node = rb_prev(&curr->mnt_node); 5229 else 5230 node = rb_next(&curr->mnt_node); 5231 5232 return node_to_mount(node); 5233 } 5234 5235 static int grab_requested_root(struct mnt_namespace *ns, struct path *root) 5236 { 5237 struct mount *first, *child; 5238 5239 rwsem_assert_held(&namespace_sem); 5240 5241 /* We're looking at our own ns, just use get_fs_root. */ 5242 if (ns == current->nsproxy->mnt_ns) { 5243 get_fs_root(current->fs, root); 5244 return 0; 5245 } 5246 5247 /* 5248 * We have to find the first mount in our ns and use that, however it 5249 * may not exist, so handle that properly. 5250 */ 5251 if (RB_EMPTY_ROOT(&ns->mounts)) 5252 return -ENOENT; 5253 5254 first = child = ns->root; 5255 for (;;) { 5256 child = listmnt_next(child, false); 5257 if (!child) 5258 return -ENOENT; 5259 if (child->mnt_parent == first) 5260 break; 5261 } 5262 5263 root->mnt = mntget(&child->mnt); 5264 root->dentry = dget(root->mnt->mnt_root); 5265 return 0; 5266 } 5267 5268 static int do_statmount(struct kstatmount *s, u64 mnt_id, u64 mnt_ns_id, 5269 struct mnt_namespace *ns) 5270 { 5271 struct path root __free(path_put) = {}; 5272 struct mount *m; 5273 int err; 5274 5275 /* Has the namespace already been emptied? */ 5276 if (mnt_ns_id && RB_EMPTY_ROOT(&ns->mounts)) 5277 return -ENOENT; 5278 5279 s->mnt = lookup_mnt_in_ns(mnt_id, ns); 5280 if (!s->mnt) 5281 return -ENOENT; 5282 5283 err = grab_requested_root(ns, &root); 5284 if (err) 5285 return err; 5286 5287 /* 5288 * Don't trigger audit denials. We just want to determine what 5289 * mounts to show users. 5290 */ 5291 m = real_mount(s->mnt); 5292 if (!is_path_reachable(m, m->mnt.mnt_root, &root) && 5293 !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN)) 5294 return -EPERM; 5295 5296 err = security_sb_statfs(s->mnt->mnt_root); 5297 if (err) 5298 return err; 5299 5300 s->root = root; 5301 if (s->mask & STATMOUNT_SB_BASIC) 5302 statmount_sb_basic(s); 5303 5304 if (s->mask & STATMOUNT_MNT_BASIC) 5305 statmount_mnt_basic(s); 5306 5307 if (s->mask & STATMOUNT_PROPAGATE_FROM) 5308 statmount_propagate_from(s); 5309 5310 if (s->mask & STATMOUNT_FS_TYPE) 5311 err = statmount_string(s, STATMOUNT_FS_TYPE); 5312 5313 if (!err && s->mask & STATMOUNT_MNT_ROOT) 5314 err = statmount_string(s, STATMOUNT_MNT_ROOT); 5315 5316 if (!err && s->mask & STATMOUNT_MNT_POINT) 5317 err = statmount_string(s, STATMOUNT_MNT_POINT); 5318 5319 if (!err && s->mask & STATMOUNT_MNT_OPTS) 5320 err = statmount_string(s, STATMOUNT_MNT_OPTS); 5321 5322 if (!err && s->mask & STATMOUNT_OPT_ARRAY) 5323 err = statmount_string(s, STATMOUNT_OPT_ARRAY); 5324 5325 if (!err && s->mask & STATMOUNT_OPT_SEC_ARRAY) 5326 err = statmount_string(s, STATMOUNT_OPT_SEC_ARRAY); 5327 5328 if (!err && s->mask & STATMOUNT_FS_SUBTYPE) 5329 err = statmount_string(s, STATMOUNT_FS_SUBTYPE); 5330 5331 if (!err && s->mask & STATMOUNT_SB_SOURCE) 5332 err = statmount_string(s, STATMOUNT_SB_SOURCE); 5333 5334 if (!err && s->mask & STATMOUNT_MNT_NS_ID) 5335 statmount_mnt_ns_id(s, ns); 5336 5337 if (err) 5338 return err; 5339 5340 return 0; 5341 } 5342 5343 static inline bool retry_statmount(const long ret, size_t *seq_size) 5344 { 5345 if (likely(ret != -EAGAIN)) 5346 return false; 5347 if (unlikely(check_mul_overflow(*seq_size, 2, seq_size))) 5348 return false; 5349 if (unlikely(*seq_size > MAX_RW_COUNT)) 5350 return false; 5351 return true; 5352 } 5353 5354 #define STATMOUNT_STRING_REQ (STATMOUNT_MNT_ROOT | STATMOUNT_MNT_POINT | \ 5355 STATMOUNT_FS_TYPE | STATMOUNT_MNT_OPTS | \ 5356 STATMOUNT_FS_SUBTYPE | STATMOUNT_SB_SOURCE | \ 5357 STATMOUNT_OPT_ARRAY | STATMOUNT_OPT_SEC_ARRAY) 5358 5359 static int prepare_kstatmount(struct kstatmount *ks, struct mnt_id_req *kreq, 5360 struct statmount __user *buf, size_t bufsize, 5361 size_t seq_size) 5362 { 5363 if (!access_ok(buf, bufsize)) 5364 return -EFAULT; 5365 5366 memset(ks, 0, sizeof(*ks)); 5367 ks->mask = kreq->param; 5368 ks->buf = buf; 5369 ks->bufsize = bufsize; 5370 5371 if (ks->mask & STATMOUNT_STRING_REQ) { 5372 if (bufsize == sizeof(ks->sm)) 5373 return -EOVERFLOW; 5374 5375 ks->seq.buf = kvmalloc(seq_size, GFP_KERNEL_ACCOUNT); 5376 if (!ks->seq.buf) 5377 return -ENOMEM; 5378 5379 ks->seq.size = seq_size; 5380 } 5381 5382 return 0; 5383 } 5384 5385 static int copy_mnt_id_req(const struct mnt_id_req __user *req, 5386 struct mnt_id_req *kreq) 5387 { 5388 int ret; 5389 size_t usize; 5390 5391 BUILD_BUG_ON(sizeof(struct mnt_id_req) != MNT_ID_REQ_SIZE_VER1); 5392 5393 ret = get_user(usize, &req->size); 5394 if (ret) 5395 return -EFAULT; 5396 if (unlikely(usize > PAGE_SIZE)) 5397 return -E2BIG; 5398 if (unlikely(usize < MNT_ID_REQ_SIZE_VER0)) 5399 return -EINVAL; 5400 memset(kreq, 0, sizeof(*kreq)); 5401 ret = copy_struct_from_user(kreq, sizeof(*kreq), req, usize); 5402 if (ret) 5403 return ret; 5404 if (kreq->spare != 0) 5405 return -EINVAL; 5406 /* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */ 5407 if (kreq->mnt_id <= MNT_UNIQUE_ID_OFFSET) 5408 return -EINVAL; 5409 return 0; 5410 } 5411 5412 /* 5413 * If the user requested a specific mount namespace id, look that up and return 5414 * that, or if not simply grab a passive reference on our mount namespace and 5415 * return that. 5416 */ 5417 static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq) 5418 { 5419 struct mnt_namespace *mnt_ns; 5420 5421 if (kreq->mnt_ns_id && kreq->spare) 5422 return ERR_PTR(-EINVAL); 5423 5424 if (kreq->mnt_ns_id) 5425 return lookup_mnt_ns(kreq->mnt_ns_id); 5426 5427 if (kreq->spare) { 5428 struct ns_common *ns; 5429 5430 CLASS(fd, f)(kreq->spare); 5431 if (fd_empty(f)) 5432 return ERR_PTR(-EBADF); 5433 5434 if (!proc_ns_file(fd_file(f))) 5435 return ERR_PTR(-EINVAL); 5436 5437 ns = get_proc_ns(file_inode(fd_file(f))); 5438 if (ns->ops->type != CLONE_NEWNS) 5439 return ERR_PTR(-EINVAL); 5440 5441 mnt_ns = to_mnt_ns(ns); 5442 } else { 5443 mnt_ns = current->nsproxy->mnt_ns; 5444 } 5445 5446 refcount_inc(&mnt_ns->passive); 5447 return mnt_ns; 5448 } 5449 5450 SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req, 5451 struct statmount __user *, buf, size_t, bufsize, 5452 unsigned int, flags) 5453 { 5454 struct mnt_namespace *ns __free(mnt_ns_release) = NULL; 5455 struct kstatmount *ks __free(kfree) = NULL; 5456 struct mnt_id_req kreq; 5457 /* We currently support retrieval of 3 strings. */ 5458 size_t seq_size = 3 * PATH_MAX; 5459 int ret; 5460 5461 if (flags) 5462 return -EINVAL; 5463 5464 ret = copy_mnt_id_req(req, &kreq); 5465 if (ret) 5466 return ret; 5467 5468 ns = grab_requested_mnt_ns(&kreq); 5469 if (!ns) 5470 return -ENOENT; 5471 5472 if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) && 5473 !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN)) 5474 return -ENOENT; 5475 5476 ks = kmalloc(sizeof(*ks), GFP_KERNEL_ACCOUNT); 5477 if (!ks) 5478 return -ENOMEM; 5479 5480 retry: 5481 ret = prepare_kstatmount(ks, &kreq, buf, bufsize, seq_size); 5482 if (ret) 5483 return ret; 5484 5485 scoped_guard(rwsem_read, &namespace_sem) 5486 ret = do_statmount(ks, kreq.mnt_id, kreq.mnt_ns_id, ns); 5487 5488 if (!ret) 5489 ret = copy_statmount_to_user(ks); 5490 kvfree(ks->seq.buf); 5491 if (retry_statmount(ret, &seq_size)) 5492 goto retry; 5493 return ret; 5494 } 5495 5496 static ssize_t do_listmount(struct mnt_namespace *ns, u64 mnt_parent_id, 5497 u64 last_mnt_id, u64 *mnt_ids, size_t nr_mnt_ids, 5498 bool reverse) 5499 { 5500 struct path root __free(path_put) = {}; 5501 struct path orig; 5502 struct mount *r, *first; 5503 ssize_t ret; 5504 5505 rwsem_assert_held(&namespace_sem); 5506 5507 ret = grab_requested_root(ns, &root); 5508 if (ret) 5509 return ret; 5510 5511 if (mnt_parent_id == LSMT_ROOT) { 5512 orig = root; 5513 } else { 5514 orig.mnt = lookup_mnt_in_ns(mnt_parent_id, ns); 5515 if (!orig.mnt) 5516 return -ENOENT; 5517 orig.dentry = orig.mnt->mnt_root; 5518 } 5519 5520 /* 5521 * Don't trigger audit denials. We just want to determine what 5522 * mounts to show users. 5523 */ 5524 if (!is_path_reachable(real_mount(orig.mnt), orig.dentry, &root) && 5525 !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN)) 5526 return -EPERM; 5527 5528 ret = security_sb_statfs(orig.dentry); 5529 if (ret) 5530 return ret; 5531 5532 if (!last_mnt_id) { 5533 if (reverse) 5534 first = node_to_mount(rb_last(&ns->mounts)); 5535 else 5536 first = node_to_mount(rb_first(&ns->mounts)); 5537 } else { 5538 if (reverse) 5539 first = mnt_find_id_at_reverse(ns, last_mnt_id - 1); 5540 else 5541 first = mnt_find_id_at(ns, last_mnt_id + 1); 5542 } 5543 5544 for (ret = 0, r = first; r && nr_mnt_ids; r = listmnt_next(r, reverse)) { 5545 if (r->mnt_id_unique == mnt_parent_id) 5546 continue; 5547 if (!is_path_reachable(r, r->mnt.mnt_root, &orig)) 5548 continue; 5549 *mnt_ids = r->mnt_id_unique; 5550 mnt_ids++; 5551 nr_mnt_ids--; 5552 ret++; 5553 } 5554 return ret; 5555 } 5556 5557 SYSCALL_DEFINE4(listmount, const struct mnt_id_req __user *, req, 5558 u64 __user *, mnt_ids, size_t, nr_mnt_ids, unsigned int, flags) 5559 { 5560 u64 *kmnt_ids __free(kvfree) = NULL; 5561 const size_t maxcount = 1000000; 5562 struct mnt_namespace *ns __free(mnt_ns_release) = NULL; 5563 struct mnt_id_req kreq; 5564 u64 last_mnt_id; 5565 ssize_t ret; 5566 5567 if (flags & ~LISTMOUNT_REVERSE) 5568 return -EINVAL; 5569 5570 /* 5571 * If the mount namespace really has more than 1 million mounts the 5572 * caller must iterate over the mount namespace (and reconsider their 5573 * system design...). 5574 */ 5575 if (unlikely(nr_mnt_ids > maxcount)) 5576 return -EOVERFLOW; 5577 5578 if (!access_ok(mnt_ids, nr_mnt_ids * sizeof(*mnt_ids))) 5579 return -EFAULT; 5580 5581 ret = copy_mnt_id_req(req, &kreq); 5582 if (ret) 5583 return ret; 5584 5585 last_mnt_id = kreq.param; 5586 /* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */ 5587 if (last_mnt_id != 0 && last_mnt_id <= MNT_UNIQUE_ID_OFFSET) 5588 return -EINVAL; 5589 5590 kmnt_ids = kvmalloc_array(nr_mnt_ids, sizeof(*kmnt_ids), 5591 GFP_KERNEL_ACCOUNT); 5592 if (!kmnt_ids) 5593 return -ENOMEM; 5594 5595 ns = grab_requested_mnt_ns(&kreq); 5596 if (!ns) 5597 return -ENOENT; 5598 5599 if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) && 5600 !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN)) 5601 return -ENOENT; 5602 5603 scoped_guard(rwsem_read, &namespace_sem) 5604 ret = do_listmount(ns, kreq.mnt_id, last_mnt_id, kmnt_ids, 5605 nr_mnt_ids, (flags & LISTMOUNT_REVERSE)); 5606 if (ret <= 0) 5607 return ret; 5608 5609 if (copy_to_user(mnt_ids, kmnt_ids, ret * sizeof(*mnt_ids))) 5610 return -EFAULT; 5611 5612 return ret; 5613 } 5614 5615 static void __init init_mount_tree(void) 5616 { 5617 struct vfsmount *mnt; 5618 struct mount *m; 5619 struct mnt_namespace *ns; 5620 struct path root; 5621 5622 mnt = vfs_kern_mount(&rootfs_fs_type, 0, "rootfs", NULL); 5623 if (IS_ERR(mnt)) 5624 panic("Can't create rootfs"); 5625 5626 ns = alloc_mnt_ns(&init_user_ns, false); 5627 if (IS_ERR(ns)) 5628 panic("Can't allocate initial namespace"); 5629 m = real_mount(mnt); 5630 ns->root = m; 5631 ns->nr_mounts = 1; 5632 mnt_add_to_ns(ns, m); 5633 init_task.nsproxy->mnt_ns = ns; 5634 get_mnt_ns(ns); 5635 5636 root.mnt = mnt; 5637 root.dentry = mnt->mnt_root; 5638 mnt->mnt_flags |= MNT_LOCKED; 5639 5640 set_fs_pwd(current->fs, &root); 5641 set_fs_root(current->fs, &root); 5642 5643 mnt_ns_tree_add(ns); 5644 } 5645 5646 void __init mnt_init(void) 5647 { 5648 int err; 5649 5650 mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount), 5651 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, NULL); 5652 5653 mount_hashtable = alloc_large_system_hash("Mount-cache", 5654 sizeof(struct hlist_head), 5655 mhash_entries, 19, 5656 HASH_ZERO, 5657 &m_hash_shift, &m_hash_mask, 0, 0); 5658 mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache", 5659 sizeof(struct hlist_head), 5660 mphash_entries, 19, 5661 HASH_ZERO, 5662 &mp_hash_shift, &mp_hash_mask, 0, 0); 5663 5664 if (!mount_hashtable || !mountpoint_hashtable) 5665 panic("Failed to allocate mount hash table\n"); 5666 5667 kernfs_init(); 5668 5669 err = sysfs_init(); 5670 if (err) 5671 printk(KERN_WARNING "%s: sysfs_init error: %d\n", 5672 __func__, err); 5673 fs_kobj = kobject_create_and_add("fs", NULL); 5674 if (!fs_kobj) 5675 printk(KERN_WARNING "%s: kobj create error\n", __func__); 5676 shmem_init(); 5677 init_rootfs(); 5678 init_mount_tree(); 5679 } 5680 5681 void put_mnt_ns(struct mnt_namespace *ns) 5682 { 5683 if (!refcount_dec_and_test(&ns->ns.count)) 5684 return; 5685 drop_collected_mounts(&ns->root->mnt); 5686 free_mnt_ns(ns); 5687 } 5688 5689 struct vfsmount *kern_mount(struct file_system_type *type) 5690 { 5691 struct vfsmount *mnt; 5692 mnt = vfs_kern_mount(type, SB_KERNMOUNT, type->name, NULL); 5693 if (!IS_ERR(mnt)) { 5694 /* 5695 * it is a longterm mount, don't release mnt until 5696 * we unmount before file sys is unregistered 5697 */ 5698 real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL; 5699 } 5700 return mnt; 5701 } 5702 EXPORT_SYMBOL_GPL(kern_mount); 5703 5704 void kern_unmount(struct vfsmount *mnt) 5705 { 5706 /* release long term mount so mount point can be released */ 5707 if (!IS_ERR(mnt)) { 5708 mnt_make_shortterm(mnt); 5709 synchronize_rcu(); /* yecchhh... */ 5710 mntput(mnt); 5711 } 5712 } 5713 EXPORT_SYMBOL(kern_unmount); 5714 5715 void kern_unmount_array(struct vfsmount *mnt[], unsigned int num) 5716 { 5717 unsigned int i; 5718 5719 for (i = 0; i < num; i++) 5720 mnt_make_shortterm(mnt[i]); 5721 synchronize_rcu_expedited(); 5722 for (i = 0; i < num; i++) 5723 mntput(mnt[i]); 5724 } 5725 EXPORT_SYMBOL(kern_unmount_array); 5726 5727 bool our_mnt(struct vfsmount *mnt) 5728 { 5729 return check_mnt(real_mount(mnt)); 5730 } 5731 5732 bool current_chrooted(void) 5733 { 5734 /* Does the current process have a non-standard root */ 5735 struct path ns_root; 5736 struct path fs_root; 5737 bool chrooted; 5738 5739 /* Find the namespace root */ 5740 ns_root.mnt = ¤t->nsproxy->mnt_ns->root->mnt; 5741 ns_root.dentry = ns_root.mnt->mnt_root; 5742 path_get(&ns_root); 5743 while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root)) 5744 ; 5745 5746 get_fs_root(current->fs, &fs_root); 5747 5748 chrooted = !path_equal(&fs_root, &ns_root); 5749 5750 path_put(&fs_root); 5751 path_put(&ns_root); 5752 5753 return chrooted; 5754 } 5755 5756 static bool mnt_already_visible(struct mnt_namespace *ns, 5757 const struct super_block *sb, 5758 int *new_mnt_flags) 5759 { 5760 int new_flags = *new_mnt_flags; 5761 struct mount *mnt, *n; 5762 bool visible = false; 5763 5764 down_read(&namespace_sem); 5765 rbtree_postorder_for_each_entry_safe(mnt, n, &ns->mounts, mnt_node) { 5766 struct mount *child; 5767 int mnt_flags; 5768 5769 if (mnt->mnt.mnt_sb->s_type != sb->s_type) 5770 continue; 5771 5772 /* This mount is not fully visible if it's root directory 5773 * is not the root directory of the filesystem. 5774 */ 5775 if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root) 5776 continue; 5777 5778 /* A local view of the mount flags */ 5779 mnt_flags = mnt->mnt.mnt_flags; 5780 5781 /* Don't miss readonly hidden in the superblock flags */ 5782 if (sb_rdonly(mnt->mnt.mnt_sb)) 5783 mnt_flags |= MNT_LOCK_READONLY; 5784 5785 /* Verify the mount flags are equal to or more permissive 5786 * than the proposed new mount. 5787 */ 5788 if ((mnt_flags & MNT_LOCK_READONLY) && 5789 !(new_flags & MNT_READONLY)) 5790 continue; 5791 if ((mnt_flags & MNT_LOCK_ATIME) && 5792 ((mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK))) 5793 continue; 5794 5795 /* This mount is not fully visible if there are any 5796 * locked child mounts that cover anything except for 5797 * empty directories. 5798 */ 5799 list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { 5800 struct inode *inode = child->mnt_mountpoint->d_inode; 5801 /* Only worry about locked mounts */ 5802 if (!(child->mnt.mnt_flags & MNT_LOCKED)) 5803 continue; 5804 /* Is the directory permanently empty? */ 5805 if (!is_empty_dir_inode(inode)) 5806 goto next; 5807 } 5808 /* Preserve the locked attributes */ 5809 *new_mnt_flags |= mnt_flags & (MNT_LOCK_READONLY | \ 5810 MNT_LOCK_ATIME); 5811 visible = true; 5812 goto found; 5813 next: ; 5814 } 5815 found: 5816 up_read(&namespace_sem); 5817 return visible; 5818 } 5819 5820 static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags) 5821 { 5822 const unsigned long required_iflags = SB_I_NOEXEC | SB_I_NODEV; 5823 struct mnt_namespace *ns = current->nsproxy->mnt_ns; 5824 unsigned long s_iflags; 5825 5826 if (ns->user_ns == &init_user_ns) 5827 return false; 5828 5829 /* Can this filesystem be too revealing? */ 5830 s_iflags = sb->s_iflags; 5831 if (!(s_iflags & SB_I_USERNS_VISIBLE)) 5832 return false; 5833 5834 if ((s_iflags & required_iflags) != required_iflags) { 5835 WARN_ONCE(1, "Expected s_iflags to contain 0x%lx\n", 5836 required_iflags); 5837 return true; 5838 } 5839 5840 return !mnt_already_visible(ns, sb, new_mnt_flags); 5841 } 5842 5843 bool mnt_may_suid(struct vfsmount *mnt) 5844 { 5845 /* 5846 * Foreign mounts (accessed via fchdir or through /proc 5847 * symlinks) are always treated as if they are nosuid. This 5848 * prevents namespaces from trusting potentially unsafe 5849 * suid/sgid bits, file caps, or security labels that originate 5850 * in other namespaces. 5851 */ 5852 return !(mnt->mnt_flags & MNT_NOSUID) && check_mnt(real_mount(mnt)) && 5853 current_in_userns(mnt->mnt_sb->s_user_ns); 5854 } 5855 5856 static struct ns_common *mntns_get(struct task_struct *task) 5857 { 5858 struct ns_common *ns = NULL; 5859 struct nsproxy *nsproxy; 5860 5861 task_lock(task); 5862 nsproxy = task->nsproxy; 5863 if (nsproxy) { 5864 ns = &nsproxy->mnt_ns->ns; 5865 get_mnt_ns(to_mnt_ns(ns)); 5866 } 5867 task_unlock(task); 5868 5869 return ns; 5870 } 5871 5872 static void mntns_put(struct ns_common *ns) 5873 { 5874 put_mnt_ns(to_mnt_ns(ns)); 5875 } 5876 5877 static int mntns_install(struct nsset *nsset, struct ns_common *ns) 5878 { 5879 struct nsproxy *nsproxy = nsset->nsproxy; 5880 struct fs_struct *fs = nsset->fs; 5881 struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns; 5882 struct user_namespace *user_ns = nsset->cred->user_ns; 5883 struct path root; 5884 int err; 5885 5886 if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) || 5887 !ns_capable(user_ns, CAP_SYS_CHROOT) || 5888 !ns_capable(user_ns, CAP_SYS_ADMIN)) 5889 return -EPERM; 5890 5891 if (is_anon_ns(mnt_ns)) 5892 return -EINVAL; 5893 5894 if (fs->users != 1) 5895 return -EINVAL; 5896 5897 get_mnt_ns(mnt_ns); 5898 old_mnt_ns = nsproxy->mnt_ns; 5899 nsproxy->mnt_ns = mnt_ns; 5900 5901 /* Find the root */ 5902 err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt, 5903 "/", LOOKUP_DOWN, &root); 5904 if (err) { 5905 /* revert to old namespace */ 5906 nsproxy->mnt_ns = old_mnt_ns; 5907 put_mnt_ns(mnt_ns); 5908 return err; 5909 } 5910 5911 put_mnt_ns(old_mnt_ns); 5912 5913 /* Update the pwd and root */ 5914 set_fs_pwd(fs, &root); 5915 set_fs_root(fs, &root); 5916 5917 path_put(&root); 5918 return 0; 5919 } 5920 5921 static struct user_namespace *mntns_owner(struct ns_common *ns) 5922 { 5923 return to_mnt_ns(ns)->user_ns; 5924 } 5925 5926 const struct proc_ns_operations mntns_operations = { 5927 .name = "mnt", 5928 .type = CLONE_NEWNS, 5929 .get = mntns_get, 5930 .put = mntns_put, 5931 .install = mntns_install, 5932 .owner = mntns_owner, 5933 }; 5934 5935 #ifdef CONFIG_SYSCTL 5936 static struct ctl_table fs_namespace_sysctls[] = { 5937 { 5938 .procname = "mount-max", 5939 .data = &sysctl_mount_max, 5940 .maxlen = sizeof(unsigned int), 5941 .mode = 0644, 5942 .proc_handler = proc_dointvec_minmax, 5943 .extra1 = SYSCTL_ONE, 5944 }, 5945 }; 5946 5947 static int __init init_fs_namespace_sysctls(void) 5948 { 5949 register_sysctl_init("fs", fs_namespace_sysctls); 5950 return 0; 5951 } 5952 fs_initcall(init_fs_namespace_sysctls); 5953 5954 #endif /* CONFIG_SYSCTL */ 5955