xref: /linux/fs/overlayfs/copy_up.c (revision c4b5140c6eac2f757d9706c6c783b60554c48cb7)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *
4  * Copyright (C) 2011 Novell Inc.
5  */
6 
7 #include <linux/module.h>
8 #include <linux/fs.h>
9 #include <linux/slab.h>
10 #include <linux/file.h>
11 #include <linux/fileattr.h>
12 #include <linux/splice.h>
13 #include <linux/xattr.h>
14 #include <linux/security.h>
15 #include <linux/uaccess.h>
16 #include <linux/sched/signal.h>
17 #include <linux/cred.h>
18 #include <linux/namei.h>
19 #include <linux/fdtable.h>
20 #include <linux/ratelimit.h>
21 #include <linux/exportfs.h>
22 #include "overlayfs.h"
23 
24 #define OVL_COPY_UP_CHUNK_SIZE (1 << 20)
25 
26 static int ovl_ccup_set(const char *buf, const struct kernel_param *param)
27 {
28 	pr_warn("\"check_copy_up\" module option is obsolete\n");
29 	return 0;
30 }
31 
32 static int ovl_ccup_get(char *buf, const struct kernel_param *param)
33 {
34 	return sprintf(buf, "N\n");
35 }
36 
37 module_param_call(check_copy_up, ovl_ccup_set, ovl_ccup_get, NULL, 0644);
38 MODULE_PARM_DESC(check_copy_up, "Obsolete; does nothing");
39 
40 static bool ovl_must_copy_xattr(const char *name)
41 {
42 	return !strcmp(name, XATTR_POSIX_ACL_ACCESS) ||
43 	       !strcmp(name, XATTR_POSIX_ACL_DEFAULT) ||
44 	       !strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN);
45 }
46 
47 static int ovl_copy_acl(struct ovl_fs *ofs, const struct path *path,
48 			struct dentry *dentry, const char *acl_name)
49 {
50 	int err;
51 	struct posix_acl *clone, *real_acl = NULL;
52 
53 	real_acl = ovl_get_acl_path(path, acl_name, false);
54 	if (!real_acl)
55 		return 0;
56 
57 	if (IS_ERR(real_acl)) {
58 		err = PTR_ERR(real_acl);
59 		if (err == -ENODATA || err == -EOPNOTSUPP)
60 			return 0;
61 		return err;
62 	}
63 
64 	clone = posix_acl_clone(real_acl, GFP_KERNEL);
65 	posix_acl_release(real_acl); /* release original acl */
66 	if (!clone)
67 		return -ENOMEM;
68 
69 	err = ovl_do_set_acl(ofs, dentry, acl_name, clone);
70 
71 	/* release cloned acl */
72 	posix_acl_release(clone);
73 	return err;
74 }
75 
76 int ovl_copy_xattr(struct super_block *sb, const struct path *oldpath, struct dentry *new)
77 {
78 	struct dentry *old = oldpath->dentry;
79 	ssize_t list_size, size, value_size = 0;
80 	char *buf, *name, *value = NULL;
81 	int error = 0;
82 	size_t slen;
83 
84 	if (!old->d_inode->i_op->listxattr || !new->d_inode->i_op->listxattr)
85 		return 0;
86 
87 	list_size = vfs_listxattr(old, NULL, 0);
88 	if (list_size <= 0) {
89 		if (list_size == -EOPNOTSUPP)
90 			return 0;
91 		return list_size;
92 	}
93 
94 	buf = kvzalloc(list_size, GFP_KERNEL);
95 	if (!buf)
96 		return -ENOMEM;
97 
98 	list_size = vfs_listxattr(old, buf, list_size);
99 	if (list_size <= 0) {
100 		error = list_size;
101 		goto out;
102 	}
103 
104 	for (name = buf; list_size; name += slen) {
105 		slen = strnlen(name, list_size) + 1;
106 
107 		/* underlying fs providing us with an broken xattr list? */
108 		if (WARN_ON(slen > list_size)) {
109 			error = -EIO;
110 			break;
111 		}
112 		list_size -= slen;
113 
114 		if (ovl_is_private_xattr(sb, name))
115 			continue;
116 
117 		error = security_inode_copy_up_xattr(name);
118 		if (error < 0 && error != -EOPNOTSUPP)
119 			break;
120 		if (error == 1) {
121 			error = 0;
122 			continue; /* Discard */
123 		}
124 
125 		if (is_posix_acl_xattr(name)) {
126 			error = ovl_copy_acl(OVL_FS(sb), oldpath, new, name);
127 			if (!error)
128 				continue;
129 			/* POSIX ACLs must be copied. */
130 			break;
131 		}
132 
133 retry:
134 		size = ovl_do_getxattr(oldpath, name, value, value_size);
135 		if (size == -ERANGE)
136 			size = ovl_do_getxattr(oldpath, name, NULL, 0);
137 
138 		if (size < 0) {
139 			error = size;
140 			break;
141 		}
142 
143 		if (size > value_size) {
144 			void *new;
145 
146 			new = kvmalloc(size, GFP_KERNEL);
147 			if (!new) {
148 				error = -ENOMEM;
149 				break;
150 			}
151 			kvfree(value);
152 			value = new;
153 			value_size = size;
154 			goto retry;
155 		}
156 
157 		error = ovl_do_setxattr(OVL_FS(sb), new, name, value, size, 0);
158 		if (error) {
159 			if (error != -EOPNOTSUPP || ovl_must_copy_xattr(name))
160 				break;
161 
162 			/* Ignore failure to copy unknown xattrs */
163 			error = 0;
164 		}
165 	}
166 	kvfree(value);
167 out:
168 	kvfree(buf);
169 	return error;
170 }
171 
172 static int ovl_copy_fileattr(struct inode *inode, const struct path *old,
173 			     const struct path *new)
174 {
175 	struct fileattr oldfa = { .flags_valid = true };
176 	struct fileattr newfa = { .flags_valid = true };
177 	int err;
178 
179 	err = ovl_real_fileattr_get(old, &oldfa);
180 	if (err) {
181 		/* Ntfs-3g returns -EINVAL for "no fileattr support" */
182 		if (err == -ENOTTY || err == -EINVAL)
183 			return 0;
184 		pr_warn("failed to retrieve lower fileattr (%pd2, err=%i)\n",
185 			old->dentry, err);
186 		return err;
187 	}
188 
189 	/*
190 	 * We cannot set immutable and append-only flags on upper inode,
191 	 * because we would not be able to link upper inode to upper dir
192 	 * not set overlay private xattr on upper inode.
193 	 * Store these flags in overlay.protattr xattr instead.
194 	 */
195 	if (oldfa.flags & OVL_PROT_FS_FLAGS_MASK) {
196 		err = ovl_set_protattr(inode, new->dentry, &oldfa);
197 		if (err == -EPERM)
198 			pr_warn_once("copying fileattr: no xattr on upper\n");
199 		else if (err)
200 			return err;
201 	}
202 
203 	/* Don't bother copying flags if none are set */
204 	if (!(oldfa.flags & OVL_COPY_FS_FLAGS_MASK))
205 		return 0;
206 
207 	err = ovl_real_fileattr_get(new, &newfa);
208 	if (err) {
209 		/*
210 		 * Returning an error if upper doesn't support fileattr will
211 		 * result in a regression, so revert to the old behavior.
212 		 */
213 		if (err == -ENOTTY || err == -EINVAL) {
214 			pr_warn_once("copying fileattr: no support on upper\n");
215 			return 0;
216 		}
217 		pr_warn("failed to retrieve upper fileattr (%pd2, err=%i)\n",
218 			new->dentry, err);
219 		return err;
220 	}
221 
222 	BUILD_BUG_ON(OVL_COPY_FS_FLAGS_MASK & ~FS_COMMON_FL);
223 	newfa.flags &= ~OVL_COPY_FS_FLAGS_MASK;
224 	newfa.flags |= (oldfa.flags & OVL_COPY_FS_FLAGS_MASK);
225 
226 	BUILD_BUG_ON(OVL_COPY_FSX_FLAGS_MASK & ~FS_XFLAG_COMMON);
227 	newfa.fsx_xflags &= ~OVL_COPY_FSX_FLAGS_MASK;
228 	newfa.fsx_xflags |= (oldfa.fsx_xflags & OVL_COPY_FSX_FLAGS_MASK);
229 
230 	return ovl_real_fileattr_set(new, &newfa);
231 }
232 
233 static int ovl_copy_up_file(struct ovl_fs *ofs, struct dentry *dentry,
234 			    struct file *new_file, loff_t len)
235 {
236 	struct path datapath;
237 	struct file *old_file;
238 	loff_t old_pos = 0;
239 	loff_t new_pos = 0;
240 	loff_t cloned;
241 	loff_t data_pos = -1;
242 	loff_t hole_len;
243 	bool skip_hole = false;
244 	int error = 0;
245 
246 	ovl_path_lowerdata(dentry, &datapath);
247 	if (WARN_ON(datapath.dentry == NULL))
248 		return -EIO;
249 
250 	old_file = ovl_path_open(&datapath, O_LARGEFILE | O_RDONLY);
251 	if (IS_ERR(old_file))
252 		return PTR_ERR(old_file);
253 
254 	/* Try to use clone_file_range to clone up within the same fs */
255 	cloned = do_clone_file_range(old_file, 0, new_file, 0, len, 0);
256 	if (cloned == len)
257 		goto out_fput;
258 	/* Couldn't clone, so now we try to copy the data */
259 
260 	/* Check if lower fs supports seek operation */
261 	if (old_file->f_mode & FMODE_LSEEK)
262 		skip_hole = true;
263 
264 	while (len) {
265 		size_t this_len = OVL_COPY_UP_CHUNK_SIZE;
266 		long bytes;
267 
268 		if (len < this_len)
269 			this_len = len;
270 
271 		if (signal_pending_state(TASK_KILLABLE, current)) {
272 			error = -EINTR;
273 			break;
274 		}
275 
276 		/*
277 		 * Fill zero for hole will cost unnecessary disk space
278 		 * and meanwhile slow down the copy-up speed, so we do
279 		 * an optimization for hole during copy-up, it relies
280 		 * on SEEK_DATA implementation in lower fs so if lower
281 		 * fs does not support it, copy-up will behave as before.
282 		 *
283 		 * Detail logic of hole detection as below:
284 		 * When we detect next data position is larger than current
285 		 * position we will skip that hole, otherwise we copy
286 		 * data in the size of OVL_COPY_UP_CHUNK_SIZE. Actually,
287 		 * it may not recognize all kind of holes and sometimes
288 		 * only skips partial of hole area. However, it will be
289 		 * enough for most of the use cases.
290 		 */
291 
292 		if (skip_hole && data_pos < old_pos) {
293 			data_pos = vfs_llseek(old_file, old_pos, SEEK_DATA);
294 			if (data_pos > old_pos) {
295 				hole_len = data_pos - old_pos;
296 				len -= hole_len;
297 				old_pos = new_pos = data_pos;
298 				continue;
299 			} else if (data_pos == -ENXIO) {
300 				break;
301 			} else if (data_pos < 0) {
302 				skip_hole = false;
303 			}
304 		}
305 
306 		bytes = do_splice_direct(old_file, &old_pos,
307 					 new_file, &new_pos,
308 					 this_len, SPLICE_F_MOVE);
309 		if (bytes <= 0) {
310 			error = bytes;
311 			break;
312 		}
313 		WARN_ON(old_pos != new_pos);
314 
315 		len -= bytes;
316 	}
317 	if (!error && ovl_should_sync(ofs))
318 		error = vfs_fsync(new_file, 0);
319 out_fput:
320 	fput(old_file);
321 	return error;
322 }
323 
324 static int ovl_set_size(struct ovl_fs *ofs,
325 			struct dentry *upperdentry, struct kstat *stat)
326 {
327 	struct iattr attr = {
328 		.ia_valid = ATTR_SIZE,
329 		.ia_size = stat->size,
330 	};
331 
332 	return ovl_do_notify_change(ofs, upperdentry, &attr);
333 }
334 
335 static int ovl_set_timestamps(struct ovl_fs *ofs, struct dentry *upperdentry,
336 			      struct kstat *stat)
337 {
338 	struct iattr attr = {
339 		.ia_valid =
340 		     ATTR_ATIME | ATTR_MTIME | ATTR_ATIME_SET | ATTR_MTIME_SET,
341 		.ia_atime = stat->atime,
342 		.ia_mtime = stat->mtime,
343 	};
344 
345 	return ovl_do_notify_change(ofs, upperdentry, &attr);
346 }
347 
348 int ovl_set_attr(struct ovl_fs *ofs, struct dentry *upperdentry,
349 		 struct kstat *stat)
350 {
351 	int err = 0;
352 
353 	if (!S_ISLNK(stat->mode)) {
354 		struct iattr attr = {
355 			.ia_valid = ATTR_MODE,
356 			.ia_mode = stat->mode,
357 		};
358 		err = ovl_do_notify_change(ofs, upperdentry, &attr);
359 	}
360 	if (!err) {
361 		struct iattr attr = {
362 			.ia_valid = ATTR_UID | ATTR_GID,
363 			.ia_vfsuid = VFSUIDT_INIT(stat->uid),
364 			.ia_vfsgid = VFSGIDT_INIT(stat->gid),
365 		};
366 		err = ovl_do_notify_change(ofs, upperdentry, &attr);
367 	}
368 	if (!err)
369 		ovl_set_timestamps(ofs, upperdentry, stat);
370 
371 	return err;
372 }
373 
374 struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real,
375 				  bool is_upper)
376 {
377 	struct ovl_fh *fh;
378 	int fh_type, dwords;
379 	int buflen = MAX_HANDLE_SZ;
380 	uuid_t *uuid = &real->d_sb->s_uuid;
381 	int err;
382 
383 	/* Make sure the real fid stays 32bit aligned */
384 	BUILD_BUG_ON(OVL_FH_FID_OFFSET % 4);
385 	BUILD_BUG_ON(MAX_HANDLE_SZ + OVL_FH_FID_OFFSET > 255);
386 
387 	fh = kzalloc(buflen + OVL_FH_FID_OFFSET, GFP_KERNEL);
388 	if (!fh)
389 		return ERR_PTR(-ENOMEM);
390 
391 	/*
392 	 * We encode a non-connectable file handle for non-dir, because we
393 	 * only need to find the lower inode number and we don't want to pay
394 	 * the price or reconnecting the dentry.
395 	 */
396 	dwords = buflen >> 2;
397 	fh_type = exportfs_encode_fh(real, (void *)fh->fb.fid, &dwords, 0);
398 	buflen = (dwords << 2);
399 
400 	err = -EIO;
401 	if (WARN_ON(fh_type < 0) ||
402 	    WARN_ON(buflen > MAX_HANDLE_SZ) ||
403 	    WARN_ON(fh_type == FILEID_INVALID))
404 		goto out_err;
405 
406 	fh->fb.version = OVL_FH_VERSION;
407 	fh->fb.magic = OVL_FH_MAGIC;
408 	fh->fb.type = fh_type;
409 	fh->fb.flags = OVL_FH_FLAG_CPU_ENDIAN;
410 	/*
411 	 * When we will want to decode an overlay dentry from this handle
412 	 * and all layers are on the same fs, if we get a disconncted real
413 	 * dentry when we decode fid, the only way to tell if we should assign
414 	 * it to upperdentry or to lowerstack is by checking this flag.
415 	 */
416 	if (is_upper)
417 		fh->fb.flags |= OVL_FH_FLAG_PATH_UPPER;
418 	fh->fb.len = sizeof(fh->fb) + buflen;
419 	if (ovl_origin_uuid(ofs))
420 		fh->fb.uuid = *uuid;
421 
422 	return fh;
423 
424 out_err:
425 	kfree(fh);
426 	return ERR_PTR(err);
427 }
428 
429 int ovl_set_origin(struct ovl_fs *ofs, struct dentry *lower,
430 		   struct dentry *upper)
431 {
432 	const struct ovl_fh *fh = NULL;
433 	int err;
434 
435 	/*
436 	 * When lower layer doesn't support export operations store a 'null' fh,
437 	 * so we can use the overlay.origin xattr to distignuish between a copy
438 	 * up and a pure upper inode.
439 	 */
440 	if (ovl_can_decode_fh(lower->d_sb)) {
441 		fh = ovl_encode_real_fh(ofs, lower, false);
442 		if (IS_ERR(fh))
443 			return PTR_ERR(fh);
444 	}
445 
446 	/*
447 	 * Do not fail when upper doesn't support xattrs.
448 	 */
449 	err = ovl_check_setxattr(ofs, upper, OVL_XATTR_ORIGIN, fh->buf,
450 				 fh ? fh->fb.len : 0, 0);
451 	kfree(fh);
452 
453 	/* Ignore -EPERM from setting "user.*" on symlink/special */
454 	return err == -EPERM ? 0 : err;
455 }
456 
457 /* Store file handle of @upper dir in @index dir entry */
458 static int ovl_set_upper_fh(struct ovl_fs *ofs, struct dentry *upper,
459 			    struct dentry *index)
460 {
461 	const struct ovl_fh *fh;
462 	int err;
463 
464 	fh = ovl_encode_real_fh(ofs, upper, true);
465 	if (IS_ERR(fh))
466 		return PTR_ERR(fh);
467 
468 	err = ovl_setxattr(ofs, index, OVL_XATTR_UPPER, fh->buf, fh->fb.len);
469 
470 	kfree(fh);
471 	return err;
472 }
473 
474 /*
475  * Create and install index entry.
476  *
477  * Caller must hold i_mutex on indexdir.
478  */
479 static int ovl_create_index(struct dentry *dentry, struct dentry *origin,
480 			    struct dentry *upper)
481 {
482 	struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
483 	struct dentry *indexdir = ovl_indexdir(dentry->d_sb);
484 	struct inode *dir = d_inode(indexdir);
485 	struct dentry *index = NULL;
486 	struct dentry *temp = NULL;
487 	struct qstr name = { };
488 	int err;
489 
490 	/*
491 	 * For now this is only used for creating index entry for directories,
492 	 * because non-dir are copied up directly to index and then hardlinked
493 	 * to upper dir.
494 	 *
495 	 * TODO: implement create index for non-dir, so we can call it when
496 	 * encoding file handle for non-dir in case index does not exist.
497 	 */
498 	if (WARN_ON(!d_is_dir(dentry)))
499 		return -EIO;
500 
501 	/* Directory not expected to be indexed before copy up */
502 	if (WARN_ON(ovl_test_flag(OVL_INDEX, d_inode(dentry))))
503 		return -EIO;
504 
505 	err = ovl_get_index_name(ofs, origin, &name);
506 	if (err)
507 		return err;
508 
509 	temp = ovl_create_temp(ofs, indexdir, OVL_CATTR(S_IFDIR | 0));
510 	err = PTR_ERR(temp);
511 	if (IS_ERR(temp))
512 		goto free_name;
513 
514 	err = ovl_set_upper_fh(ofs, upper, temp);
515 	if (err)
516 		goto out;
517 
518 	index = ovl_lookup_upper(ofs, name.name, indexdir, name.len);
519 	if (IS_ERR(index)) {
520 		err = PTR_ERR(index);
521 	} else {
522 		err = ovl_do_rename(ofs, dir, temp, dir, index, 0);
523 		dput(index);
524 	}
525 out:
526 	if (err)
527 		ovl_cleanup(ofs, dir, temp);
528 	dput(temp);
529 free_name:
530 	kfree(name.name);
531 	return err;
532 }
533 
534 struct ovl_copy_up_ctx {
535 	struct dentry *parent;
536 	struct dentry *dentry;
537 	struct path lowerpath;
538 	struct kstat stat;
539 	struct kstat pstat;
540 	const char *link;
541 	struct dentry *destdir;
542 	struct qstr destname;
543 	struct dentry *workdir;
544 	bool origin;
545 	bool indexed;
546 	bool metacopy;
547 	bool metacopy_digest;
548 };
549 
550 static int ovl_link_up(struct ovl_copy_up_ctx *c)
551 {
552 	int err;
553 	struct dentry *upper;
554 	struct dentry *upperdir = ovl_dentry_upper(c->parent);
555 	struct ovl_fs *ofs = OVL_FS(c->dentry->d_sb);
556 	struct inode *udir = d_inode(upperdir);
557 
558 	/* Mark parent "impure" because it may now contain non-pure upper */
559 	err = ovl_set_impure(c->parent, upperdir);
560 	if (err)
561 		return err;
562 
563 	err = ovl_set_nlink_lower(c->dentry);
564 	if (err)
565 		return err;
566 
567 	inode_lock_nested(udir, I_MUTEX_PARENT);
568 	upper = ovl_lookup_upper(ofs, c->dentry->d_name.name, upperdir,
569 				 c->dentry->d_name.len);
570 	err = PTR_ERR(upper);
571 	if (!IS_ERR(upper)) {
572 		err = ovl_do_link(ofs, ovl_dentry_upper(c->dentry), udir, upper);
573 		dput(upper);
574 
575 		if (!err) {
576 			/* Restore timestamps on parent (best effort) */
577 			ovl_set_timestamps(ofs, upperdir, &c->pstat);
578 			ovl_dentry_set_upper_alias(c->dentry);
579 			ovl_dentry_update_reval(c->dentry, upper);
580 		}
581 	}
582 	inode_unlock(udir);
583 	if (err)
584 		return err;
585 
586 	err = ovl_set_nlink_upper(c->dentry);
587 
588 	return err;
589 }
590 
591 static int ovl_copy_up_data(struct ovl_copy_up_ctx *c, const struct path *temp)
592 {
593 	struct ovl_fs *ofs = OVL_FS(c->dentry->d_sb);
594 	struct file *new_file;
595 	int err;
596 
597 	if (!S_ISREG(c->stat.mode) || c->metacopy || !c->stat.size)
598 		return 0;
599 
600 	new_file = ovl_path_open(temp, O_LARGEFILE | O_WRONLY);
601 	if (IS_ERR(new_file))
602 		return PTR_ERR(new_file);
603 
604 	err = ovl_copy_up_file(ofs, c->dentry, new_file, c->stat.size);
605 	fput(new_file);
606 
607 	return err;
608 }
609 
610 static int ovl_copy_up_metadata(struct ovl_copy_up_ctx *c, struct dentry *temp)
611 {
612 	struct ovl_fs *ofs = OVL_FS(c->dentry->d_sb);
613 	struct inode *inode = d_inode(c->dentry);
614 	struct path upperpath = { .mnt = ovl_upper_mnt(ofs), .dentry = temp };
615 	int err;
616 
617 	err = ovl_copy_xattr(c->dentry->d_sb, &c->lowerpath, temp);
618 	if (err)
619 		return err;
620 
621 	if (inode->i_flags & OVL_COPY_I_FLAGS_MASK) {
622 		/*
623 		 * Copy the fileattr inode flags that are the source of already
624 		 * copied i_flags
625 		 */
626 		err = ovl_copy_fileattr(inode, &c->lowerpath, &upperpath);
627 		if (err)
628 			return err;
629 	}
630 
631 	/*
632 	 * Store identifier of lower inode in upper inode xattr to
633 	 * allow lookup of the copy up origin inode.
634 	 *
635 	 * Don't set origin when we are breaking the association with a lower
636 	 * hard link.
637 	 */
638 	if (c->origin) {
639 		err = ovl_set_origin(ofs, c->lowerpath.dentry, temp);
640 		if (err)
641 			return err;
642 	}
643 
644 	if (c->metacopy) {
645 		struct path lowerdatapath;
646 		struct ovl_metacopy metacopy_data = OVL_METACOPY_INIT;
647 
648 		ovl_path_lowerdata(c->dentry, &lowerdatapath);
649 		if (WARN_ON_ONCE(lowerdatapath.dentry == NULL))
650 			return -EIO;
651 		err = ovl_get_verity_digest(ofs, &lowerdatapath, &metacopy_data);
652 		if (err)
653 			return err;
654 
655 		if (metacopy_data.digest_algo)
656 			c->metacopy_digest = true;
657 
658 		err = ovl_set_metacopy_xattr(ofs, temp, &metacopy_data);
659 		if (err)
660 			return err;
661 	}
662 
663 	inode_lock(temp->d_inode);
664 	if (S_ISREG(c->stat.mode))
665 		err = ovl_set_size(ofs, temp, &c->stat);
666 	if (!err)
667 		err = ovl_set_attr(ofs, temp, &c->stat);
668 	inode_unlock(temp->d_inode);
669 
670 	return err;
671 }
672 
673 struct ovl_cu_creds {
674 	const struct cred *old;
675 	struct cred *new;
676 };
677 
678 static int ovl_prep_cu_creds(struct dentry *dentry, struct ovl_cu_creds *cc)
679 {
680 	int err;
681 
682 	cc->old = cc->new = NULL;
683 	err = security_inode_copy_up(dentry, &cc->new);
684 	if (err < 0)
685 		return err;
686 
687 	if (cc->new)
688 		cc->old = override_creds(cc->new);
689 
690 	return 0;
691 }
692 
693 static void ovl_revert_cu_creds(struct ovl_cu_creds *cc)
694 {
695 	if (cc->new) {
696 		revert_creds(cc->old);
697 		put_cred(cc->new);
698 	}
699 }
700 
701 /*
702  * Copyup using workdir to prepare temp file.  Used when copying up directories,
703  * special files or when upper fs doesn't support O_TMPFILE.
704  */
705 static int ovl_copy_up_workdir(struct ovl_copy_up_ctx *c)
706 {
707 	struct ovl_fs *ofs = OVL_FS(c->dentry->d_sb);
708 	struct inode *inode;
709 	struct inode *udir = d_inode(c->destdir), *wdir = d_inode(c->workdir);
710 	struct path path = { .mnt = ovl_upper_mnt(ofs) };
711 	struct dentry *temp, *upper;
712 	struct ovl_cu_creds cc;
713 	int err;
714 	struct ovl_cattr cattr = {
715 		/* Can't properly set mode on creation because of the umask */
716 		.mode = c->stat.mode & S_IFMT,
717 		.rdev = c->stat.rdev,
718 		.link = c->link
719 	};
720 
721 	/* workdir and destdir could be the same when copying up to indexdir */
722 	err = -EIO;
723 	if (lock_rename(c->workdir, c->destdir) != NULL)
724 		goto unlock;
725 
726 	err = ovl_prep_cu_creds(c->dentry, &cc);
727 	if (err)
728 		goto unlock;
729 
730 	temp = ovl_create_temp(ofs, c->workdir, &cattr);
731 	ovl_revert_cu_creds(&cc);
732 
733 	err = PTR_ERR(temp);
734 	if (IS_ERR(temp))
735 		goto unlock;
736 
737 	/*
738 	 * Copy up data first and then xattrs. Writing data after
739 	 * xattrs will remove security.capability xattr automatically.
740 	 */
741 	path.dentry = temp;
742 	err = ovl_copy_up_data(c, &path);
743 	if (err)
744 		goto cleanup;
745 
746 	err = ovl_copy_up_metadata(c, temp);
747 	if (err)
748 		goto cleanup;
749 
750 	if (S_ISDIR(c->stat.mode) && c->indexed) {
751 		err = ovl_create_index(c->dentry, c->lowerpath.dentry, temp);
752 		if (err)
753 			goto cleanup;
754 	}
755 
756 	upper = ovl_lookup_upper(ofs, c->destname.name, c->destdir,
757 				 c->destname.len);
758 	err = PTR_ERR(upper);
759 	if (IS_ERR(upper))
760 		goto cleanup;
761 
762 	err = ovl_do_rename(ofs, wdir, temp, udir, upper, 0);
763 	dput(upper);
764 	if (err)
765 		goto cleanup;
766 
767 	inode = d_inode(c->dentry);
768 	if (c->metacopy_digest)
769 		ovl_set_flag(OVL_HAS_DIGEST, inode);
770 	else
771 		ovl_clear_flag(OVL_HAS_DIGEST, inode);
772 	ovl_clear_flag(OVL_VERIFIED_DIGEST, inode);
773 
774 	if (!c->metacopy)
775 		ovl_set_upperdata(inode);
776 	ovl_inode_update(inode, temp);
777 	if (S_ISDIR(inode->i_mode))
778 		ovl_set_flag(OVL_WHITEOUTS, inode);
779 unlock:
780 	unlock_rename(c->workdir, c->destdir);
781 
782 	return err;
783 
784 cleanup:
785 	ovl_cleanup(ofs, wdir, temp);
786 	dput(temp);
787 	goto unlock;
788 }
789 
790 /* Copyup using O_TMPFILE which does not require cross dir locking */
791 static int ovl_copy_up_tmpfile(struct ovl_copy_up_ctx *c)
792 {
793 	struct ovl_fs *ofs = OVL_FS(c->dentry->d_sb);
794 	struct inode *udir = d_inode(c->destdir);
795 	struct dentry *temp, *upper;
796 	struct file *tmpfile;
797 	struct ovl_cu_creds cc;
798 	int err;
799 
800 	err = ovl_prep_cu_creds(c->dentry, &cc);
801 	if (err)
802 		return err;
803 
804 	tmpfile = ovl_do_tmpfile(ofs, c->workdir, c->stat.mode);
805 	ovl_revert_cu_creds(&cc);
806 
807 	if (IS_ERR(tmpfile))
808 		return PTR_ERR(tmpfile);
809 
810 	temp = tmpfile->f_path.dentry;
811 	if (!c->metacopy && c->stat.size) {
812 		err = ovl_copy_up_file(ofs, c->dentry, tmpfile, c->stat.size);
813 		if (err)
814 			goto out_fput;
815 	}
816 
817 	err = ovl_copy_up_metadata(c, temp);
818 	if (err)
819 		goto out_fput;
820 
821 	inode_lock_nested(udir, I_MUTEX_PARENT);
822 
823 	upper = ovl_lookup_upper(ofs, c->destname.name, c->destdir,
824 				 c->destname.len);
825 	err = PTR_ERR(upper);
826 	if (!IS_ERR(upper)) {
827 		err = ovl_do_link(ofs, temp, udir, upper);
828 		dput(upper);
829 	}
830 	inode_unlock(udir);
831 
832 	if (err)
833 		goto out_fput;
834 
835 	if (c->metacopy_digest)
836 		ovl_set_flag(OVL_HAS_DIGEST, d_inode(c->dentry));
837 	else
838 		ovl_clear_flag(OVL_HAS_DIGEST, d_inode(c->dentry));
839 	ovl_clear_flag(OVL_VERIFIED_DIGEST, d_inode(c->dentry));
840 
841 	if (!c->metacopy)
842 		ovl_set_upperdata(d_inode(c->dentry));
843 	ovl_inode_update(d_inode(c->dentry), dget(temp));
844 
845 out_fput:
846 	fput(tmpfile);
847 	return err;
848 }
849 
850 /*
851  * Copy up a single dentry
852  *
853  * All renames start with copy up of source if necessary.  The actual
854  * rename will only proceed once the copy up was successful.  Copy up uses
855  * upper parent i_mutex for exclusion.  Since rename can change d_parent it
856  * is possible that the copy up will lock the old parent.  At that point
857  * the file will have already been copied up anyway.
858  */
859 static int ovl_do_copy_up(struct ovl_copy_up_ctx *c)
860 {
861 	int err;
862 	struct ovl_fs *ofs = OVL_FS(c->dentry->d_sb);
863 	bool to_index = false;
864 
865 	/*
866 	 * Indexed non-dir is copied up directly to the index entry and then
867 	 * hardlinked to upper dir. Indexed dir is copied up to indexdir,
868 	 * then index entry is created and then copied up dir installed.
869 	 * Copying dir up to indexdir instead of workdir simplifies locking.
870 	 */
871 	if (ovl_need_index(c->dentry)) {
872 		c->indexed = true;
873 		if (S_ISDIR(c->stat.mode))
874 			c->workdir = ovl_indexdir(c->dentry->d_sb);
875 		else
876 			to_index = true;
877 	}
878 
879 	if (S_ISDIR(c->stat.mode) || c->stat.nlink == 1 || to_index)
880 		c->origin = true;
881 
882 	if (to_index) {
883 		c->destdir = ovl_indexdir(c->dentry->d_sb);
884 		err = ovl_get_index_name(ofs, c->lowerpath.dentry, &c->destname);
885 		if (err)
886 			return err;
887 	} else if (WARN_ON(!c->parent)) {
888 		/* Disconnected dentry must be copied up to index dir */
889 		return -EIO;
890 	} else {
891 		/*
892 		 * Mark parent "impure" because it may now contain non-pure
893 		 * upper
894 		 */
895 		err = ovl_set_impure(c->parent, c->destdir);
896 		if (err)
897 			return err;
898 	}
899 
900 	/* Should we copyup with O_TMPFILE or with workdir? */
901 	if (S_ISREG(c->stat.mode) && ofs->tmpfile)
902 		err = ovl_copy_up_tmpfile(c);
903 	else
904 		err = ovl_copy_up_workdir(c);
905 	if (err)
906 		goto out;
907 
908 	if (c->indexed)
909 		ovl_set_flag(OVL_INDEX, d_inode(c->dentry));
910 
911 	if (to_index) {
912 		/* Initialize nlink for copy up of disconnected dentry */
913 		err = ovl_set_nlink_upper(c->dentry);
914 	} else {
915 		struct inode *udir = d_inode(c->destdir);
916 
917 		/* Restore timestamps on parent (best effort) */
918 		inode_lock(udir);
919 		ovl_set_timestamps(ofs, c->destdir, &c->pstat);
920 		inode_unlock(udir);
921 
922 		ovl_dentry_set_upper_alias(c->dentry);
923 		ovl_dentry_update_reval(c->dentry, ovl_dentry_upper(c->dentry));
924 	}
925 
926 out:
927 	if (to_index)
928 		kfree(c->destname.name);
929 	return err;
930 }
931 
932 static bool ovl_need_meta_copy_up(struct dentry *dentry, umode_t mode,
933 				  int flags)
934 {
935 	struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
936 
937 	if (!ofs->config.metacopy)
938 		return false;
939 
940 	if (!S_ISREG(mode))
941 		return false;
942 
943 	if (flags && ((OPEN_FMODE(flags) & FMODE_WRITE) || (flags & O_TRUNC)))
944 		return false;
945 
946 	/* Fall back to full copy if no fsverity on source data and we require verity */
947 	if (ofs->config.verity_mode == OVL_VERITY_REQUIRE) {
948 		struct path lowerdata;
949 
950 		ovl_path_lowerdata(dentry, &lowerdata);
951 
952 		if (WARN_ON_ONCE(lowerdata.dentry == NULL) ||
953 		    ovl_ensure_verity_loaded(&lowerdata) ||
954 		    !fsverity_active(d_inode(lowerdata.dentry))) {
955 			return false;
956 		}
957 	}
958 
959 	return true;
960 }
961 
962 static ssize_t ovl_getxattr_value(const struct path *path, char *name, char **value)
963 {
964 	ssize_t res;
965 	char *buf;
966 
967 	res = ovl_do_getxattr(path, name, NULL, 0);
968 	if (res == -ENODATA || res == -EOPNOTSUPP)
969 		res = 0;
970 
971 	if (res > 0) {
972 		buf = kzalloc(res, GFP_KERNEL);
973 		if (!buf)
974 			return -ENOMEM;
975 
976 		res = ovl_do_getxattr(path, name, buf, res);
977 		if (res < 0)
978 			kfree(buf);
979 		else
980 			*value = buf;
981 	}
982 	return res;
983 }
984 
985 /* Copy up data of an inode which was copied up metadata only in the past. */
986 static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c)
987 {
988 	struct ovl_fs *ofs = OVL_FS(c->dentry->d_sb);
989 	struct path upperpath;
990 	int err;
991 	char *capability = NULL;
992 	ssize_t cap_size;
993 
994 	ovl_path_upper(c->dentry, &upperpath);
995 	if (WARN_ON(upperpath.dentry == NULL))
996 		return -EIO;
997 
998 	if (c->stat.size) {
999 		err = cap_size = ovl_getxattr_value(&upperpath, XATTR_NAME_CAPS,
1000 						    &capability);
1001 		if (cap_size < 0)
1002 			goto out;
1003 	}
1004 
1005 	err = ovl_copy_up_data(c, &upperpath);
1006 	if (err)
1007 		goto out_free;
1008 
1009 	/*
1010 	 * Writing to upper file will clear security.capability xattr. We
1011 	 * don't want that to happen for normal copy-up operation.
1012 	 */
1013 	if (capability) {
1014 		err = ovl_do_setxattr(ofs, upperpath.dentry, XATTR_NAME_CAPS,
1015 				      capability, cap_size, 0);
1016 		if (err)
1017 			goto out_free;
1018 	}
1019 
1020 
1021 	err = ovl_removexattr(ofs, upperpath.dentry, OVL_XATTR_METACOPY);
1022 	if (err)
1023 		goto out_free;
1024 
1025 	ovl_clear_flag(OVL_HAS_DIGEST, d_inode(c->dentry));
1026 	ovl_clear_flag(OVL_VERIFIED_DIGEST, d_inode(c->dentry));
1027 	ovl_set_upperdata(d_inode(c->dentry));
1028 out_free:
1029 	kfree(capability);
1030 out:
1031 	return err;
1032 }
1033 
1034 static int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
1035 			   int flags)
1036 {
1037 	int err;
1038 	DEFINE_DELAYED_CALL(done);
1039 	struct path parentpath;
1040 	struct ovl_copy_up_ctx ctx = {
1041 		.parent = parent,
1042 		.dentry = dentry,
1043 		.workdir = ovl_workdir(dentry),
1044 	};
1045 
1046 	if (WARN_ON(!ctx.workdir))
1047 		return -EROFS;
1048 
1049 	ovl_path_lower(dentry, &ctx.lowerpath);
1050 	err = vfs_getattr(&ctx.lowerpath, &ctx.stat,
1051 			  STATX_BASIC_STATS, AT_STATX_SYNC_AS_STAT);
1052 	if (err)
1053 		return err;
1054 
1055 	if (!kuid_has_mapping(current_user_ns(), ctx.stat.uid) ||
1056 	    !kgid_has_mapping(current_user_ns(), ctx.stat.gid))
1057 		return -EOVERFLOW;
1058 
1059 	ctx.metacopy = ovl_need_meta_copy_up(dentry, ctx.stat.mode, flags);
1060 
1061 	if (parent) {
1062 		ovl_path_upper(parent, &parentpath);
1063 		ctx.destdir = parentpath.dentry;
1064 		ctx.destname = dentry->d_name;
1065 
1066 		err = vfs_getattr(&parentpath, &ctx.pstat,
1067 				  STATX_ATIME | STATX_MTIME,
1068 				  AT_STATX_SYNC_AS_STAT);
1069 		if (err)
1070 			return err;
1071 	}
1072 
1073 	/* maybe truncate regular file. this has no effect on dirs */
1074 	if (flags & O_TRUNC)
1075 		ctx.stat.size = 0;
1076 
1077 	if (S_ISLNK(ctx.stat.mode)) {
1078 		ctx.link = vfs_get_link(ctx.lowerpath.dentry, &done);
1079 		if (IS_ERR(ctx.link))
1080 			return PTR_ERR(ctx.link);
1081 	}
1082 
1083 	err = ovl_copy_up_start(dentry, flags);
1084 	/* err < 0: interrupted, err > 0: raced with another copy-up */
1085 	if (unlikely(err)) {
1086 		if (err > 0)
1087 			err = 0;
1088 	} else {
1089 		if (!ovl_dentry_upper(dentry))
1090 			err = ovl_do_copy_up(&ctx);
1091 		if (!err && parent && !ovl_dentry_has_upper_alias(dentry))
1092 			err = ovl_link_up(&ctx);
1093 		if (!err && ovl_dentry_needs_data_copy_up_locked(dentry, flags))
1094 			err = ovl_copy_up_meta_inode_data(&ctx);
1095 		ovl_copy_up_end(dentry);
1096 	}
1097 	do_delayed_call(&done);
1098 
1099 	return err;
1100 }
1101 
1102 static int ovl_copy_up_flags(struct dentry *dentry, int flags)
1103 {
1104 	int err = 0;
1105 	const struct cred *old_cred;
1106 	bool disconnected = (dentry->d_flags & DCACHE_DISCONNECTED);
1107 
1108 	/*
1109 	 * With NFS export, copy up can get called for a disconnected non-dir.
1110 	 * In this case, we will copy up lower inode to index dir without
1111 	 * linking it to upper dir.
1112 	 */
1113 	if (WARN_ON(disconnected && d_is_dir(dentry)))
1114 		return -EIO;
1115 
1116 	/*
1117 	 * We may not need lowerdata if we are only doing metacopy up, but it is
1118 	 * not very important to optimize this case, so do lazy lowerdata lookup
1119 	 * before any copy up, so we can do it before taking ovl_inode_lock().
1120 	 */
1121 	err = ovl_verify_lowerdata(dentry);
1122 	if (err)
1123 		return err;
1124 
1125 	old_cred = ovl_override_creds(dentry->d_sb);
1126 	while (!err) {
1127 		struct dentry *next;
1128 		struct dentry *parent = NULL;
1129 
1130 		if (ovl_already_copied_up(dentry, flags))
1131 			break;
1132 
1133 		next = dget(dentry);
1134 		/* find the topmost dentry not yet copied up */
1135 		for (; !disconnected;) {
1136 			parent = dget_parent(next);
1137 
1138 			if (ovl_dentry_upper(parent))
1139 				break;
1140 
1141 			dput(next);
1142 			next = parent;
1143 		}
1144 
1145 		err = ovl_copy_up_one(parent, next, flags);
1146 
1147 		dput(parent);
1148 		dput(next);
1149 	}
1150 	revert_creds(old_cred);
1151 
1152 	return err;
1153 }
1154 
1155 static bool ovl_open_need_copy_up(struct dentry *dentry, int flags)
1156 {
1157 	/* Copy up of disconnected dentry does not set upper alias */
1158 	if (ovl_already_copied_up(dentry, flags))
1159 		return false;
1160 
1161 	if (special_file(d_inode(dentry)->i_mode))
1162 		return false;
1163 
1164 	if (!ovl_open_flags_need_copy_up(flags))
1165 		return false;
1166 
1167 	return true;
1168 }
1169 
1170 int ovl_maybe_copy_up(struct dentry *dentry, int flags)
1171 {
1172 	int err = 0;
1173 
1174 	if (ovl_open_need_copy_up(dentry, flags)) {
1175 		err = ovl_want_write(dentry);
1176 		if (!err) {
1177 			err = ovl_copy_up_flags(dentry, flags);
1178 			ovl_drop_write(dentry);
1179 		}
1180 	}
1181 
1182 	return err;
1183 }
1184 
1185 int ovl_copy_up_with_data(struct dentry *dentry)
1186 {
1187 	return ovl_copy_up_flags(dentry, O_WRONLY);
1188 }
1189 
1190 int ovl_copy_up(struct dentry *dentry)
1191 {
1192 	return ovl_copy_up_flags(dentry, 0);
1193 }
1194