1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * 4 * Copyright (C) 2011 Novell Inc. 5 */ 6 7 #include <uapi/linux/magic.h> 8 #include <linux/fs.h> 9 #include <linux/namei.h> 10 #include <linux/xattr.h> 11 #include <linux/mount.h> 12 #include <linux/parser.h> 13 #include <linux/module.h> 14 #include <linux/statfs.h> 15 #include <linux/seq_file.h> 16 #include <linux/posix_acl_xattr.h> 17 #include <linux/exportfs.h> 18 #include "overlayfs.h" 19 20 MODULE_AUTHOR("Miklos Szeredi <miklos@szeredi.hu>"); 21 MODULE_DESCRIPTION("Overlay filesystem"); 22 MODULE_LICENSE("GPL"); 23 24 25 struct ovl_dir_cache; 26 27 #define OVL_MAX_STACK 500 28 29 static bool ovl_redirect_dir_def = IS_ENABLED(CONFIG_OVERLAY_FS_REDIRECT_DIR); 30 module_param_named(redirect_dir, ovl_redirect_dir_def, bool, 0644); 31 MODULE_PARM_DESC(redirect_dir, 32 "Default to on or off for the redirect_dir feature"); 33 34 static bool ovl_redirect_always_follow = 35 IS_ENABLED(CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW); 36 module_param_named(redirect_always_follow, ovl_redirect_always_follow, 37 bool, 0644); 38 MODULE_PARM_DESC(redirect_always_follow, 39 "Follow redirects even if redirect_dir feature is turned off"); 40 41 static bool ovl_index_def = IS_ENABLED(CONFIG_OVERLAY_FS_INDEX); 42 module_param_named(index, ovl_index_def, bool, 0644); 43 MODULE_PARM_DESC(index, 44 "Default to on or off for the inodes index feature"); 45 46 static bool ovl_nfs_export_def = IS_ENABLED(CONFIG_OVERLAY_FS_NFS_EXPORT); 47 module_param_named(nfs_export, ovl_nfs_export_def, bool, 0644); 48 MODULE_PARM_DESC(nfs_export, 49 "Default to on or off for the NFS export feature"); 50 51 static bool ovl_xino_auto_def = IS_ENABLED(CONFIG_OVERLAY_FS_XINO_AUTO); 52 module_param_named(xino_auto, ovl_xino_auto_def, bool, 0644); 53 MODULE_PARM_DESC(xino_auto, 54 "Auto enable xino feature"); 55 56 static void ovl_entry_stack_free(struct ovl_entry *oe) 57 { 58 unsigned int i; 59 60 for (i = 0; i < oe->numlower; i++) 61 dput(oe->lowerstack[i].dentry); 62 } 63 64 static bool ovl_metacopy_def = IS_ENABLED(CONFIG_OVERLAY_FS_METACOPY); 65 module_param_named(metacopy, ovl_metacopy_def, bool, 0644); 66 MODULE_PARM_DESC(metacopy, 67 "Default to on or off for the metadata only copy up feature"); 68 69 static void ovl_dentry_release(struct dentry *dentry) 70 { 71 struct ovl_entry *oe = dentry->d_fsdata; 72 73 if (oe) { 74 ovl_entry_stack_free(oe); 75 kfree_rcu(oe, rcu); 76 } 77 } 78 79 static struct dentry *ovl_d_real(struct dentry *dentry, 80 const struct inode *inode) 81 { 82 struct dentry *real; 83 84 /* It's an overlay file */ 85 if (inode && d_inode(dentry) == inode) 86 return dentry; 87 88 if (!d_is_reg(dentry)) { 89 if (!inode || inode == d_inode(dentry)) 90 return dentry; 91 goto bug; 92 } 93 94 real = ovl_dentry_upper(dentry); 95 if (real && (inode == d_inode(real))) 96 return real; 97 98 if (real && !inode && ovl_has_upperdata(d_inode(dentry))) 99 return real; 100 101 real = ovl_dentry_lowerdata(dentry); 102 if (!real) 103 goto bug; 104 105 /* Handle recursion */ 106 real = d_real(real, inode); 107 108 if (!inode || inode == d_inode(real)) 109 return real; 110 bug: 111 WARN(1, "ovl_d_real(%pd4, %s:%lu): real dentry not found\n", dentry, 112 inode ? inode->i_sb->s_id : "NULL", inode ? inode->i_ino : 0); 113 return dentry; 114 } 115 116 static int ovl_revalidate_real(struct dentry *d, unsigned int flags, bool weak) 117 { 118 int ret = 1; 119 120 if (weak) { 121 if (d->d_flags & DCACHE_OP_WEAK_REVALIDATE) 122 ret = d->d_op->d_weak_revalidate(d, flags); 123 } else if (d->d_flags & DCACHE_OP_REVALIDATE) { 124 ret = d->d_op->d_revalidate(d, flags); 125 if (!ret) { 126 if (!(flags & LOOKUP_RCU)) 127 d_invalidate(d); 128 ret = -ESTALE; 129 } 130 } 131 return ret; 132 } 133 134 static int ovl_dentry_revalidate_common(struct dentry *dentry, 135 unsigned int flags, bool weak) 136 { 137 struct ovl_entry *oe = dentry->d_fsdata; 138 struct dentry *upper; 139 unsigned int i; 140 int ret = 1; 141 142 upper = ovl_dentry_upper(dentry); 143 if (upper) 144 ret = ovl_revalidate_real(upper, flags, weak); 145 146 for (i = 0; ret > 0 && i < oe->numlower; i++) { 147 ret = ovl_revalidate_real(oe->lowerstack[i].dentry, flags, 148 weak); 149 } 150 return ret; 151 } 152 153 static int ovl_dentry_revalidate(struct dentry *dentry, unsigned int flags) 154 { 155 return ovl_dentry_revalidate_common(dentry, flags, false); 156 } 157 158 static int ovl_dentry_weak_revalidate(struct dentry *dentry, unsigned int flags) 159 { 160 return ovl_dentry_revalidate_common(dentry, flags, true); 161 } 162 163 static const struct dentry_operations ovl_dentry_operations = { 164 .d_release = ovl_dentry_release, 165 .d_real = ovl_d_real, 166 .d_revalidate = ovl_dentry_revalidate, 167 .d_weak_revalidate = ovl_dentry_weak_revalidate, 168 }; 169 170 static struct kmem_cache *ovl_inode_cachep; 171 172 static struct inode *ovl_alloc_inode(struct super_block *sb) 173 { 174 struct ovl_inode *oi = kmem_cache_alloc(ovl_inode_cachep, GFP_KERNEL); 175 176 if (!oi) 177 return NULL; 178 179 oi->cache = NULL; 180 oi->redirect = NULL; 181 oi->version = 0; 182 oi->flags = 0; 183 oi->__upperdentry = NULL; 184 oi->lower = NULL; 185 oi->lowerdata = NULL; 186 mutex_init(&oi->lock); 187 188 return &oi->vfs_inode; 189 } 190 191 static void ovl_free_inode(struct inode *inode) 192 { 193 struct ovl_inode *oi = OVL_I(inode); 194 195 kfree(oi->redirect); 196 mutex_destroy(&oi->lock); 197 kmem_cache_free(ovl_inode_cachep, oi); 198 } 199 200 static void ovl_destroy_inode(struct inode *inode) 201 { 202 struct ovl_inode *oi = OVL_I(inode); 203 204 dput(oi->__upperdentry); 205 iput(oi->lower); 206 if (S_ISDIR(inode->i_mode)) 207 ovl_dir_cache_free(inode); 208 else 209 iput(oi->lowerdata); 210 } 211 212 static void ovl_free_fs(struct ovl_fs *ofs) 213 { 214 unsigned i; 215 216 iput(ofs->workbasedir_trap); 217 iput(ofs->indexdir_trap); 218 iput(ofs->workdir_trap); 219 iput(ofs->upperdir_trap); 220 dput(ofs->indexdir); 221 dput(ofs->workdir); 222 if (ofs->workdir_locked) 223 ovl_inuse_unlock(ofs->workbasedir); 224 dput(ofs->workbasedir); 225 if (ofs->upperdir_locked) 226 ovl_inuse_unlock(ofs->upper_mnt->mnt_root); 227 mntput(ofs->upper_mnt); 228 for (i = 1; i < ofs->numlayer; i++) { 229 iput(ofs->layers[i].trap); 230 mntput(ofs->layers[i].mnt); 231 } 232 kfree(ofs->layers); 233 for (i = 0; i < ofs->numfs; i++) 234 free_anon_bdev(ofs->fs[i].pseudo_dev); 235 kfree(ofs->fs); 236 237 kfree(ofs->config.lowerdir); 238 kfree(ofs->config.upperdir); 239 kfree(ofs->config.workdir); 240 kfree(ofs->config.redirect_mode); 241 if (ofs->creator_cred) 242 put_cred(ofs->creator_cred); 243 kfree(ofs); 244 } 245 246 static void ovl_put_super(struct super_block *sb) 247 { 248 struct ovl_fs *ofs = sb->s_fs_info; 249 250 ovl_free_fs(ofs); 251 } 252 253 /* Sync real dirty inodes in upper filesystem (if it exists) */ 254 static int ovl_sync_fs(struct super_block *sb, int wait) 255 { 256 struct ovl_fs *ofs = sb->s_fs_info; 257 struct super_block *upper_sb; 258 int ret; 259 260 if (!ofs->upper_mnt) 261 return 0; 262 263 /* 264 * If this is a sync(2) call or an emergency sync, all the super blocks 265 * will be iterated, including upper_sb, so no need to do anything. 266 * 267 * If this is a syncfs(2) call, then we do need to call 268 * sync_filesystem() on upper_sb, but enough if we do it when being 269 * called with wait == 1. 270 */ 271 if (!wait) 272 return 0; 273 274 upper_sb = ofs->upper_mnt->mnt_sb; 275 276 down_read(&upper_sb->s_umount); 277 ret = sync_filesystem(upper_sb); 278 up_read(&upper_sb->s_umount); 279 280 return ret; 281 } 282 283 /** 284 * ovl_statfs 285 * @sb: The overlayfs super block 286 * @buf: The struct kstatfs to fill in with stats 287 * 288 * Get the filesystem statistics. As writes always target the upper layer 289 * filesystem pass the statfs to the upper filesystem (if it exists) 290 */ 291 static int ovl_statfs(struct dentry *dentry, struct kstatfs *buf) 292 { 293 struct ovl_fs *ofs = dentry->d_sb->s_fs_info; 294 struct dentry *root_dentry = dentry->d_sb->s_root; 295 struct path path; 296 int err; 297 298 ovl_path_real(root_dentry, &path); 299 300 err = vfs_statfs(&path, buf); 301 if (!err) { 302 buf->f_namelen = ofs->namelen; 303 buf->f_type = OVERLAYFS_SUPER_MAGIC; 304 } 305 306 return err; 307 } 308 309 /* Will this overlay be forced to mount/remount ro? */ 310 static bool ovl_force_readonly(struct ovl_fs *ofs) 311 { 312 return (!ofs->upper_mnt || !ofs->workdir); 313 } 314 315 static const char *ovl_redirect_mode_def(void) 316 { 317 return ovl_redirect_dir_def ? "on" : "off"; 318 } 319 320 static const char * const ovl_xino_str[] = { 321 "off", 322 "auto", 323 "on", 324 }; 325 326 static inline int ovl_xino_def(void) 327 { 328 return ovl_xino_auto_def ? OVL_XINO_AUTO : OVL_XINO_OFF; 329 } 330 331 /** 332 * ovl_show_options 333 * 334 * Prints the mount options for a given superblock. 335 * Returns zero; does not fail. 336 */ 337 static int ovl_show_options(struct seq_file *m, struct dentry *dentry) 338 { 339 struct super_block *sb = dentry->d_sb; 340 struct ovl_fs *ofs = sb->s_fs_info; 341 342 seq_show_option(m, "lowerdir", ofs->config.lowerdir); 343 if (ofs->config.upperdir) { 344 seq_show_option(m, "upperdir", ofs->config.upperdir); 345 seq_show_option(m, "workdir", ofs->config.workdir); 346 } 347 if (ofs->config.default_permissions) 348 seq_puts(m, ",default_permissions"); 349 if (strcmp(ofs->config.redirect_mode, ovl_redirect_mode_def()) != 0) 350 seq_printf(m, ",redirect_dir=%s", ofs->config.redirect_mode); 351 if (ofs->config.index != ovl_index_def) 352 seq_printf(m, ",index=%s", ofs->config.index ? "on" : "off"); 353 if (ofs->config.nfs_export != ovl_nfs_export_def) 354 seq_printf(m, ",nfs_export=%s", ofs->config.nfs_export ? 355 "on" : "off"); 356 if (ofs->config.xino != ovl_xino_def() && !ovl_same_fs(sb)) 357 seq_printf(m, ",xino=%s", ovl_xino_str[ofs->config.xino]); 358 if (ofs->config.metacopy != ovl_metacopy_def) 359 seq_printf(m, ",metacopy=%s", 360 ofs->config.metacopy ? "on" : "off"); 361 return 0; 362 } 363 364 static int ovl_remount(struct super_block *sb, int *flags, char *data) 365 { 366 struct ovl_fs *ofs = sb->s_fs_info; 367 368 if (!(*flags & SB_RDONLY) && ovl_force_readonly(ofs)) 369 return -EROFS; 370 371 return 0; 372 } 373 374 static const struct super_operations ovl_super_operations = { 375 .alloc_inode = ovl_alloc_inode, 376 .free_inode = ovl_free_inode, 377 .destroy_inode = ovl_destroy_inode, 378 .drop_inode = generic_delete_inode, 379 .put_super = ovl_put_super, 380 .sync_fs = ovl_sync_fs, 381 .statfs = ovl_statfs, 382 .show_options = ovl_show_options, 383 .remount_fs = ovl_remount, 384 }; 385 386 enum { 387 OPT_LOWERDIR, 388 OPT_UPPERDIR, 389 OPT_WORKDIR, 390 OPT_DEFAULT_PERMISSIONS, 391 OPT_REDIRECT_DIR, 392 OPT_INDEX_ON, 393 OPT_INDEX_OFF, 394 OPT_NFS_EXPORT_ON, 395 OPT_NFS_EXPORT_OFF, 396 OPT_XINO_ON, 397 OPT_XINO_OFF, 398 OPT_XINO_AUTO, 399 OPT_METACOPY_ON, 400 OPT_METACOPY_OFF, 401 OPT_ERR, 402 }; 403 404 static const match_table_t ovl_tokens = { 405 {OPT_LOWERDIR, "lowerdir=%s"}, 406 {OPT_UPPERDIR, "upperdir=%s"}, 407 {OPT_WORKDIR, "workdir=%s"}, 408 {OPT_DEFAULT_PERMISSIONS, "default_permissions"}, 409 {OPT_REDIRECT_DIR, "redirect_dir=%s"}, 410 {OPT_INDEX_ON, "index=on"}, 411 {OPT_INDEX_OFF, "index=off"}, 412 {OPT_NFS_EXPORT_ON, "nfs_export=on"}, 413 {OPT_NFS_EXPORT_OFF, "nfs_export=off"}, 414 {OPT_XINO_ON, "xino=on"}, 415 {OPT_XINO_OFF, "xino=off"}, 416 {OPT_XINO_AUTO, "xino=auto"}, 417 {OPT_METACOPY_ON, "metacopy=on"}, 418 {OPT_METACOPY_OFF, "metacopy=off"}, 419 {OPT_ERR, NULL} 420 }; 421 422 static char *ovl_next_opt(char **s) 423 { 424 char *sbegin = *s; 425 char *p; 426 427 if (sbegin == NULL) 428 return NULL; 429 430 for (p = sbegin; *p; p++) { 431 if (*p == '\\') { 432 p++; 433 if (!*p) 434 break; 435 } else if (*p == ',') { 436 *p = '\0'; 437 *s = p + 1; 438 return sbegin; 439 } 440 } 441 *s = NULL; 442 return sbegin; 443 } 444 445 static int ovl_parse_redirect_mode(struct ovl_config *config, const char *mode) 446 { 447 if (strcmp(mode, "on") == 0) { 448 config->redirect_dir = true; 449 /* 450 * Does not make sense to have redirect creation without 451 * redirect following. 452 */ 453 config->redirect_follow = true; 454 } else if (strcmp(mode, "follow") == 0) { 455 config->redirect_follow = true; 456 } else if (strcmp(mode, "off") == 0) { 457 if (ovl_redirect_always_follow) 458 config->redirect_follow = true; 459 } else if (strcmp(mode, "nofollow") != 0) { 460 pr_err("bad mount option \"redirect_dir=%s\"\n", 461 mode); 462 return -EINVAL; 463 } 464 465 return 0; 466 } 467 468 static int ovl_parse_opt(char *opt, struct ovl_config *config) 469 { 470 char *p; 471 int err; 472 bool metacopy_opt = false, redirect_opt = false; 473 474 config->redirect_mode = kstrdup(ovl_redirect_mode_def(), GFP_KERNEL); 475 if (!config->redirect_mode) 476 return -ENOMEM; 477 478 while ((p = ovl_next_opt(&opt)) != NULL) { 479 int token; 480 substring_t args[MAX_OPT_ARGS]; 481 482 if (!*p) 483 continue; 484 485 token = match_token(p, ovl_tokens, args); 486 switch (token) { 487 case OPT_UPPERDIR: 488 kfree(config->upperdir); 489 config->upperdir = match_strdup(&args[0]); 490 if (!config->upperdir) 491 return -ENOMEM; 492 break; 493 494 case OPT_LOWERDIR: 495 kfree(config->lowerdir); 496 config->lowerdir = match_strdup(&args[0]); 497 if (!config->lowerdir) 498 return -ENOMEM; 499 break; 500 501 case OPT_WORKDIR: 502 kfree(config->workdir); 503 config->workdir = match_strdup(&args[0]); 504 if (!config->workdir) 505 return -ENOMEM; 506 break; 507 508 case OPT_DEFAULT_PERMISSIONS: 509 config->default_permissions = true; 510 break; 511 512 case OPT_REDIRECT_DIR: 513 kfree(config->redirect_mode); 514 config->redirect_mode = match_strdup(&args[0]); 515 if (!config->redirect_mode) 516 return -ENOMEM; 517 redirect_opt = true; 518 break; 519 520 case OPT_INDEX_ON: 521 config->index = true; 522 break; 523 524 case OPT_INDEX_OFF: 525 config->index = false; 526 break; 527 528 case OPT_NFS_EXPORT_ON: 529 config->nfs_export = true; 530 break; 531 532 case OPT_NFS_EXPORT_OFF: 533 config->nfs_export = false; 534 break; 535 536 case OPT_XINO_ON: 537 config->xino = OVL_XINO_ON; 538 break; 539 540 case OPT_XINO_OFF: 541 config->xino = OVL_XINO_OFF; 542 break; 543 544 case OPT_XINO_AUTO: 545 config->xino = OVL_XINO_AUTO; 546 break; 547 548 case OPT_METACOPY_ON: 549 config->metacopy = true; 550 metacopy_opt = true; 551 break; 552 553 case OPT_METACOPY_OFF: 554 config->metacopy = false; 555 break; 556 557 default: 558 pr_err("unrecognized mount option \"%s\" or missing value\n", 559 p); 560 return -EINVAL; 561 } 562 } 563 564 /* Workdir is useless in non-upper mount */ 565 if (!config->upperdir && config->workdir) { 566 pr_info("option \"workdir=%s\" is useless in a non-upper mount, ignore\n", 567 config->workdir); 568 kfree(config->workdir); 569 config->workdir = NULL; 570 } 571 572 err = ovl_parse_redirect_mode(config, config->redirect_mode); 573 if (err) 574 return err; 575 576 /* 577 * This is to make the logic below simpler. It doesn't make any other 578 * difference, since config->redirect_dir is only used for upper. 579 */ 580 if (!config->upperdir && config->redirect_follow) 581 config->redirect_dir = true; 582 583 /* Resolve metacopy -> redirect_dir dependency */ 584 if (config->metacopy && !config->redirect_dir) { 585 if (metacopy_opt && redirect_opt) { 586 pr_err("conflicting options: metacopy=on,redirect_dir=%s\n", 587 config->redirect_mode); 588 return -EINVAL; 589 } 590 if (redirect_opt) { 591 /* 592 * There was an explicit redirect_dir=... that resulted 593 * in this conflict. 594 */ 595 pr_info("disabling metacopy due to redirect_dir=%s\n", 596 config->redirect_mode); 597 config->metacopy = false; 598 } else { 599 /* Automatically enable redirect otherwise. */ 600 config->redirect_follow = config->redirect_dir = true; 601 } 602 } 603 604 return 0; 605 } 606 607 #define OVL_WORKDIR_NAME "work" 608 #define OVL_INDEXDIR_NAME "index" 609 610 static struct dentry *ovl_workdir_create(struct ovl_fs *ofs, 611 const char *name, bool persist) 612 { 613 struct inode *dir = ofs->workbasedir->d_inode; 614 struct vfsmount *mnt = ofs->upper_mnt; 615 struct dentry *work; 616 int err; 617 bool retried = false; 618 bool locked = false; 619 620 inode_lock_nested(dir, I_MUTEX_PARENT); 621 locked = true; 622 623 retry: 624 work = lookup_one_len(name, ofs->workbasedir, strlen(name)); 625 626 if (!IS_ERR(work)) { 627 struct iattr attr = { 628 .ia_valid = ATTR_MODE, 629 .ia_mode = S_IFDIR | 0, 630 }; 631 632 if (work->d_inode) { 633 err = -EEXIST; 634 if (retried) 635 goto out_dput; 636 637 if (persist) 638 goto out_unlock; 639 640 retried = true; 641 ovl_workdir_cleanup(dir, mnt, work, 0); 642 dput(work); 643 goto retry; 644 } 645 646 work = ovl_create_real(dir, work, OVL_CATTR(attr.ia_mode)); 647 err = PTR_ERR(work); 648 if (IS_ERR(work)) 649 goto out_err; 650 651 /* 652 * Try to remove POSIX ACL xattrs from workdir. We are good if: 653 * 654 * a) success (there was a POSIX ACL xattr and was removed) 655 * b) -ENODATA (there was no POSIX ACL xattr) 656 * c) -EOPNOTSUPP (POSIX ACL xattrs are not supported) 657 * 658 * There are various other error values that could effectively 659 * mean that the xattr doesn't exist (e.g. -ERANGE is returned 660 * if the xattr name is too long), but the set of filesystems 661 * allowed as upper are limited to "normal" ones, where checking 662 * for the above two errors is sufficient. 663 */ 664 err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT); 665 if (err && err != -ENODATA && err != -EOPNOTSUPP) 666 goto out_dput; 667 668 err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS); 669 if (err && err != -ENODATA && err != -EOPNOTSUPP) 670 goto out_dput; 671 672 /* Clear any inherited mode bits */ 673 inode_lock(work->d_inode); 674 err = notify_change(work, &attr, NULL); 675 inode_unlock(work->d_inode); 676 if (err) 677 goto out_dput; 678 } else { 679 err = PTR_ERR(work); 680 goto out_err; 681 } 682 out_unlock: 683 if (locked) 684 inode_unlock(dir); 685 686 return work; 687 688 out_dput: 689 dput(work); 690 out_err: 691 pr_warn("failed to create directory %s/%s (errno: %i); mounting read-only\n", 692 ofs->config.workdir, name, -err); 693 work = NULL; 694 goto out_unlock; 695 } 696 697 static void ovl_unescape(char *s) 698 { 699 char *d = s; 700 701 for (;; s++, d++) { 702 if (*s == '\\') 703 s++; 704 *d = *s; 705 if (!*s) 706 break; 707 } 708 } 709 710 static int ovl_mount_dir_noesc(const char *name, struct path *path) 711 { 712 int err = -EINVAL; 713 714 if (!*name) { 715 pr_err("empty lowerdir\n"); 716 goto out; 717 } 718 err = kern_path(name, LOOKUP_FOLLOW, path); 719 if (err) { 720 pr_err("failed to resolve '%s': %i\n", name, err); 721 goto out; 722 } 723 err = -EINVAL; 724 if (ovl_dentry_weird(path->dentry)) { 725 pr_err("filesystem on '%s' not supported\n", name); 726 goto out_put; 727 } 728 if (!d_is_dir(path->dentry)) { 729 pr_err("'%s' not a directory\n", name); 730 goto out_put; 731 } 732 return 0; 733 734 out_put: 735 path_put_init(path); 736 out: 737 return err; 738 } 739 740 static int ovl_mount_dir(const char *name, struct path *path) 741 { 742 int err = -ENOMEM; 743 char *tmp = kstrdup(name, GFP_KERNEL); 744 745 if (tmp) { 746 ovl_unescape(tmp); 747 err = ovl_mount_dir_noesc(tmp, path); 748 749 if (!err && path->dentry->d_flags & DCACHE_OP_REAL) { 750 pr_err("filesystem on '%s' not supported as upperdir\n", 751 tmp); 752 path_put_init(path); 753 err = -EINVAL; 754 } 755 kfree(tmp); 756 } 757 return err; 758 } 759 760 static int ovl_check_namelen(struct path *path, struct ovl_fs *ofs, 761 const char *name) 762 { 763 struct kstatfs statfs; 764 int err = vfs_statfs(path, &statfs); 765 766 if (err) 767 pr_err("statfs failed on '%s'\n", name); 768 else 769 ofs->namelen = max(ofs->namelen, statfs.f_namelen); 770 771 return err; 772 } 773 774 static int ovl_lower_dir(const char *name, struct path *path, 775 struct ovl_fs *ofs, int *stack_depth) 776 { 777 int fh_type; 778 int err; 779 780 err = ovl_mount_dir_noesc(name, path); 781 if (err) 782 goto out; 783 784 err = ovl_check_namelen(path, ofs, name); 785 if (err) 786 goto out_put; 787 788 *stack_depth = max(*stack_depth, path->mnt->mnt_sb->s_stack_depth); 789 790 /* 791 * The inodes index feature and NFS export need to encode and decode 792 * file handles, so they require that all layers support them. 793 */ 794 fh_type = ovl_can_decode_fh(path->dentry->d_sb); 795 if ((ofs->config.nfs_export || 796 (ofs->config.index && ofs->config.upperdir)) && !fh_type) { 797 ofs->config.index = false; 798 ofs->config.nfs_export = false; 799 pr_warn("fs on '%s' does not support file handles, falling back to index=off,nfs_export=off.\n", 800 name); 801 } 802 803 /* Check if lower fs has 32bit inode numbers */ 804 if (fh_type != FILEID_INO32_GEN) 805 ofs->xino_mode = -1; 806 807 return 0; 808 809 out_put: 810 path_put_init(path); 811 out: 812 return err; 813 } 814 815 /* Workdir should not be subdir of upperdir and vice versa */ 816 static bool ovl_workdir_ok(struct dentry *workdir, struct dentry *upperdir) 817 { 818 bool ok = false; 819 820 if (workdir != upperdir) { 821 ok = (lock_rename(workdir, upperdir) == NULL); 822 unlock_rename(workdir, upperdir); 823 } 824 return ok; 825 } 826 827 static unsigned int ovl_split_lowerdirs(char *str) 828 { 829 unsigned int ctr = 1; 830 char *s, *d; 831 832 for (s = d = str;; s++, d++) { 833 if (*s == '\\') { 834 s++; 835 } else if (*s == ':') { 836 *d = '\0'; 837 ctr++; 838 continue; 839 } 840 *d = *s; 841 if (!*s) 842 break; 843 } 844 return ctr; 845 } 846 847 static int __maybe_unused 848 ovl_posix_acl_xattr_get(const struct xattr_handler *handler, 849 struct dentry *dentry, struct inode *inode, 850 const char *name, void *buffer, size_t size) 851 { 852 return ovl_xattr_get(dentry, inode, handler->name, buffer, size); 853 } 854 855 static int __maybe_unused 856 ovl_posix_acl_xattr_set(const struct xattr_handler *handler, 857 struct dentry *dentry, struct inode *inode, 858 const char *name, const void *value, 859 size_t size, int flags) 860 { 861 struct dentry *workdir = ovl_workdir(dentry); 862 struct inode *realinode = ovl_inode_real(inode); 863 struct posix_acl *acl = NULL; 864 int err; 865 866 /* Check that everything is OK before copy-up */ 867 if (value) { 868 acl = posix_acl_from_xattr(&init_user_ns, value, size); 869 if (IS_ERR(acl)) 870 return PTR_ERR(acl); 871 } 872 err = -EOPNOTSUPP; 873 if (!IS_POSIXACL(d_inode(workdir))) 874 goto out_acl_release; 875 if (!realinode->i_op->set_acl) 876 goto out_acl_release; 877 if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) { 878 err = acl ? -EACCES : 0; 879 goto out_acl_release; 880 } 881 err = -EPERM; 882 if (!inode_owner_or_capable(inode)) 883 goto out_acl_release; 884 885 posix_acl_release(acl); 886 887 /* 888 * Check if sgid bit needs to be cleared (actual setacl operation will 889 * be done with mounter's capabilities and so that won't do it for us). 890 */ 891 if (unlikely(inode->i_mode & S_ISGID) && 892 handler->flags == ACL_TYPE_ACCESS && 893 !in_group_p(inode->i_gid) && 894 !capable_wrt_inode_uidgid(inode, CAP_FSETID)) { 895 struct iattr iattr = { .ia_valid = ATTR_KILL_SGID }; 896 897 err = ovl_setattr(dentry, &iattr); 898 if (err) 899 return err; 900 } 901 902 err = ovl_xattr_set(dentry, inode, handler->name, value, size, flags); 903 if (!err) 904 ovl_copyattr(ovl_inode_real(inode), inode); 905 906 return err; 907 908 out_acl_release: 909 posix_acl_release(acl); 910 return err; 911 } 912 913 static int ovl_own_xattr_get(const struct xattr_handler *handler, 914 struct dentry *dentry, struct inode *inode, 915 const char *name, void *buffer, size_t size) 916 { 917 return -EOPNOTSUPP; 918 } 919 920 static int ovl_own_xattr_set(const struct xattr_handler *handler, 921 struct dentry *dentry, struct inode *inode, 922 const char *name, const void *value, 923 size_t size, int flags) 924 { 925 return -EOPNOTSUPP; 926 } 927 928 static int ovl_other_xattr_get(const struct xattr_handler *handler, 929 struct dentry *dentry, struct inode *inode, 930 const char *name, void *buffer, size_t size) 931 { 932 return ovl_xattr_get(dentry, inode, name, buffer, size); 933 } 934 935 static int ovl_other_xattr_set(const struct xattr_handler *handler, 936 struct dentry *dentry, struct inode *inode, 937 const char *name, const void *value, 938 size_t size, int flags) 939 { 940 return ovl_xattr_set(dentry, inode, name, value, size, flags); 941 } 942 943 static const struct xattr_handler __maybe_unused 944 ovl_posix_acl_access_xattr_handler = { 945 .name = XATTR_NAME_POSIX_ACL_ACCESS, 946 .flags = ACL_TYPE_ACCESS, 947 .get = ovl_posix_acl_xattr_get, 948 .set = ovl_posix_acl_xattr_set, 949 }; 950 951 static const struct xattr_handler __maybe_unused 952 ovl_posix_acl_default_xattr_handler = { 953 .name = XATTR_NAME_POSIX_ACL_DEFAULT, 954 .flags = ACL_TYPE_DEFAULT, 955 .get = ovl_posix_acl_xattr_get, 956 .set = ovl_posix_acl_xattr_set, 957 }; 958 959 static const struct xattr_handler ovl_own_xattr_handler = { 960 .prefix = OVL_XATTR_PREFIX, 961 .get = ovl_own_xattr_get, 962 .set = ovl_own_xattr_set, 963 }; 964 965 static const struct xattr_handler ovl_other_xattr_handler = { 966 .prefix = "", /* catch all */ 967 .get = ovl_other_xattr_get, 968 .set = ovl_other_xattr_set, 969 }; 970 971 static const struct xattr_handler *ovl_xattr_handlers[] = { 972 #ifdef CONFIG_FS_POSIX_ACL 973 &ovl_posix_acl_access_xattr_handler, 974 &ovl_posix_acl_default_xattr_handler, 975 #endif 976 &ovl_own_xattr_handler, 977 &ovl_other_xattr_handler, 978 NULL 979 }; 980 981 static int ovl_setup_trap(struct super_block *sb, struct dentry *dir, 982 struct inode **ptrap, const char *name) 983 { 984 struct inode *trap; 985 int err; 986 987 trap = ovl_get_trap_inode(sb, dir); 988 err = PTR_ERR_OR_ZERO(trap); 989 if (err) { 990 if (err == -ELOOP) 991 pr_err("conflicting %s path\n", name); 992 return err; 993 } 994 995 *ptrap = trap; 996 return 0; 997 } 998 999 /* 1000 * Determine how we treat concurrent use of upperdir/workdir based on the 1001 * index feature. This is papering over mount leaks of container runtimes, 1002 * for example, an old overlay mount is leaked and now its upperdir is 1003 * attempted to be used as a lower layer in a new overlay mount. 1004 */ 1005 static int ovl_report_in_use(struct ovl_fs *ofs, const char *name) 1006 { 1007 if (ofs->config.index) { 1008 pr_err("%s is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.\n", 1009 name); 1010 return -EBUSY; 1011 } else { 1012 pr_warn("%s is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.\n", 1013 name); 1014 return 0; 1015 } 1016 } 1017 1018 static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs, 1019 struct path *upperpath) 1020 { 1021 struct vfsmount *upper_mnt; 1022 int err; 1023 1024 err = ovl_mount_dir(ofs->config.upperdir, upperpath); 1025 if (err) 1026 goto out; 1027 1028 /* Upper fs should not be r/o */ 1029 if (sb_rdonly(upperpath->mnt->mnt_sb)) { 1030 pr_err("upper fs is r/o, try multi-lower layers mount\n"); 1031 err = -EINVAL; 1032 goto out; 1033 } 1034 1035 err = ovl_check_namelen(upperpath, ofs, ofs->config.upperdir); 1036 if (err) 1037 goto out; 1038 1039 err = ovl_setup_trap(sb, upperpath->dentry, &ofs->upperdir_trap, 1040 "upperdir"); 1041 if (err) 1042 goto out; 1043 1044 upper_mnt = clone_private_mount(upperpath); 1045 err = PTR_ERR(upper_mnt); 1046 if (IS_ERR(upper_mnt)) { 1047 pr_err("failed to clone upperpath\n"); 1048 goto out; 1049 } 1050 1051 /* Don't inherit atime flags */ 1052 upper_mnt->mnt_flags &= ~(MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME); 1053 ofs->upper_mnt = upper_mnt; 1054 1055 if (ovl_inuse_trylock(ofs->upper_mnt->mnt_root)) { 1056 ofs->upperdir_locked = true; 1057 } else { 1058 err = ovl_report_in_use(ofs, "upperdir"); 1059 if (err) 1060 goto out; 1061 } 1062 1063 err = 0; 1064 out: 1065 return err; 1066 } 1067 1068 /* 1069 * Returns 1 if RENAME_WHITEOUT is supported, 0 if not supported and 1070 * negative values if error is encountered. 1071 */ 1072 static int ovl_check_rename_whiteout(struct dentry *workdir) 1073 { 1074 struct inode *dir = d_inode(workdir); 1075 struct dentry *temp; 1076 struct dentry *dest; 1077 struct dentry *whiteout; 1078 struct name_snapshot name; 1079 int err; 1080 1081 inode_lock_nested(dir, I_MUTEX_PARENT); 1082 1083 temp = ovl_create_temp(workdir, OVL_CATTR(S_IFREG | 0)); 1084 err = PTR_ERR(temp); 1085 if (IS_ERR(temp)) 1086 goto out_unlock; 1087 1088 dest = ovl_lookup_temp(workdir); 1089 err = PTR_ERR(dest); 1090 if (IS_ERR(dest)) { 1091 dput(temp); 1092 goto out_unlock; 1093 } 1094 1095 /* Name is inline and stable - using snapshot as a copy helper */ 1096 take_dentry_name_snapshot(&name, temp); 1097 err = ovl_do_rename(dir, temp, dir, dest, RENAME_WHITEOUT); 1098 if (err) { 1099 if (err == -EINVAL) 1100 err = 0; 1101 goto cleanup_temp; 1102 } 1103 1104 whiteout = lookup_one_len(name.name.name, workdir, name.name.len); 1105 err = PTR_ERR(whiteout); 1106 if (IS_ERR(whiteout)) 1107 goto cleanup_temp; 1108 1109 err = ovl_is_whiteout(whiteout); 1110 1111 /* Best effort cleanup of whiteout and temp file */ 1112 if (err) 1113 ovl_cleanup(dir, whiteout); 1114 dput(whiteout); 1115 1116 cleanup_temp: 1117 ovl_cleanup(dir, temp); 1118 release_dentry_name_snapshot(&name); 1119 dput(temp); 1120 dput(dest); 1121 1122 out_unlock: 1123 inode_unlock(dir); 1124 1125 return err; 1126 } 1127 1128 static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs, 1129 struct path *workpath) 1130 { 1131 struct vfsmount *mnt = ofs->upper_mnt; 1132 struct dentry *temp; 1133 bool rename_whiteout; 1134 bool d_type; 1135 int fh_type; 1136 int err; 1137 1138 err = mnt_want_write(mnt); 1139 if (err) 1140 return err; 1141 1142 ofs->workdir = ovl_workdir_create(ofs, OVL_WORKDIR_NAME, false); 1143 if (!ofs->workdir) 1144 goto out; 1145 1146 err = ovl_setup_trap(sb, ofs->workdir, &ofs->workdir_trap, "workdir"); 1147 if (err) 1148 goto out; 1149 1150 /* 1151 * Upper should support d_type, else whiteouts are visible. Given 1152 * workdir and upper are on same fs, we can do iterate_dir() on 1153 * workdir. This check requires successful creation of workdir in 1154 * previous step. 1155 */ 1156 err = ovl_check_d_type_supported(workpath); 1157 if (err < 0) 1158 goto out; 1159 1160 d_type = err; 1161 if (!d_type) 1162 pr_warn("upper fs needs to support d_type.\n"); 1163 1164 /* Check if upper/work fs supports O_TMPFILE */ 1165 temp = ovl_do_tmpfile(ofs->workdir, S_IFREG | 0); 1166 ofs->tmpfile = !IS_ERR(temp); 1167 if (ofs->tmpfile) 1168 dput(temp); 1169 else 1170 pr_warn("upper fs does not support tmpfile.\n"); 1171 1172 1173 /* Check if upper/work fs supports RENAME_WHITEOUT */ 1174 err = ovl_check_rename_whiteout(ofs->workdir); 1175 if (err < 0) 1176 goto out; 1177 1178 rename_whiteout = err; 1179 if (!rename_whiteout) 1180 pr_warn("upper fs does not support RENAME_WHITEOUT.\n"); 1181 1182 /* 1183 * Check if upper/work fs supports trusted.overlay.* xattr 1184 */ 1185 err = ovl_do_setxattr(ofs->workdir, OVL_XATTR_OPAQUE, "0", 1, 0); 1186 if (err) { 1187 ofs->noxattr = true; 1188 ofs->config.index = false; 1189 ofs->config.metacopy = false; 1190 pr_warn("upper fs does not support xattr, falling back to index=off and metacopy=off.\n"); 1191 err = 0; 1192 } else { 1193 vfs_removexattr(ofs->workdir, OVL_XATTR_OPAQUE); 1194 } 1195 1196 /* 1197 * We allowed sub-optimal upper fs configuration and don't want to break 1198 * users over kernel upgrade, but we never allowed remote upper fs, so 1199 * we can enforce strict requirements for remote upper fs. 1200 */ 1201 if (ovl_dentry_remote(ofs->workdir) && 1202 (!d_type || !rename_whiteout || ofs->noxattr)) { 1203 pr_err("upper fs missing required features.\n"); 1204 err = -EINVAL; 1205 goto out; 1206 } 1207 1208 /* Check if upper/work fs supports file handles */ 1209 fh_type = ovl_can_decode_fh(ofs->workdir->d_sb); 1210 if (ofs->config.index && !fh_type) { 1211 ofs->config.index = false; 1212 pr_warn("upper fs does not support file handles, falling back to index=off.\n"); 1213 } 1214 1215 /* Check if upper fs has 32bit inode numbers */ 1216 if (fh_type != FILEID_INO32_GEN) 1217 ofs->xino_mode = -1; 1218 1219 /* NFS export of r/w mount depends on index */ 1220 if (ofs->config.nfs_export && !ofs->config.index) { 1221 pr_warn("NFS export requires \"index=on\", falling back to nfs_export=off.\n"); 1222 ofs->config.nfs_export = false; 1223 } 1224 out: 1225 mnt_drop_write(mnt); 1226 return err; 1227 } 1228 1229 static int ovl_get_workdir(struct super_block *sb, struct ovl_fs *ofs, 1230 struct path *upperpath) 1231 { 1232 int err; 1233 struct path workpath = { }; 1234 1235 err = ovl_mount_dir(ofs->config.workdir, &workpath); 1236 if (err) 1237 goto out; 1238 1239 err = -EINVAL; 1240 if (upperpath->mnt != workpath.mnt) { 1241 pr_err("workdir and upperdir must reside under the same mount\n"); 1242 goto out; 1243 } 1244 if (!ovl_workdir_ok(workpath.dentry, upperpath->dentry)) { 1245 pr_err("workdir and upperdir must be separate subtrees\n"); 1246 goto out; 1247 } 1248 1249 ofs->workbasedir = dget(workpath.dentry); 1250 1251 if (ovl_inuse_trylock(ofs->workbasedir)) { 1252 ofs->workdir_locked = true; 1253 } else { 1254 err = ovl_report_in_use(ofs, "workdir"); 1255 if (err) 1256 goto out; 1257 } 1258 1259 err = ovl_setup_trap(sb, ofs->workbasedir, &ofs->workbasedir_trap, 1260 "workdir"); 1261 if (err) 1262 goto out; 1263 1264 err = ovl_make_workdir(sb, ofs, &workpath); 1265 1266 out: 1267 path_put(&workpath); 1268 1269 return err; 1270 } 1271 1272 static int ovl_get_indexdir(struct super_block *sb, struct ovl_fs *ofs, 1273 struct ovl_entry *oe, struct path *upperpath) 1274 { 1275 struct vfsmount *mnt = ofs->upper_mnt; 1276 int err; 1277 1278 err = mnt_want_write(mnt); 1279 if (err) 1280 return err; 1281 1282 /* Verify lower root is upper root origin */ 1283 err = ovl_verify_origin(upperpath->dentry, oe->lowerstack[0].dentry, 1284 true); 1285 if (err) { 1286 pr_err("failed to verify upper root origin\n"); 1287 goto out; 1288 } 1289 1290 ofs->indexdir = ovl_workdir_create(ofs, OVL_INDEXDIR_NAME, true); 1291 if (ofs->indexdir) { 1292 err = ovl_setup_trap(sb, ofs->indexdir, &ofs->indexdir_trap, 1293 "indexdir"); 1294 if (err) 1295 goto out; 1296 1297 /* 1298 * Verify upper root is exclusively associated with index dir. 1299 * Older kernels stored upper fh in "trusted.overlay.origin" 1300 * xattr. If that xattr exists, verify that it is a match to 1301 * upper dir file handle. In any case, verify or set xattr 1302 * "trusted.overlay.upper" to indicate that index may have 1303 * directory entries. 1304 */ 1305 if (ovl_check_origin_xattr(ofs->indexdir)) { 1306 err = ovl_verify_set_fh(ofs->indexdir, OVL_XATTR_ORIGIN, 1307 upperpath->dentry, true, false); 1308 if (err) 1309 pr_err("failed to verify index dir 'origin' xattr\n"); 1310 } 1311 err = ovl_verify_upper(ofs->indexdir, upperpath->dentry, true); 1312 if (err) 1313 pr_err("failed to verify index dir 'upper' xattr\n"); 1314 1315 /* Cleanup bad/stale/orphan index entries */ 1316 if (!err) 1317 err = ovl_indexdir_cleanup(ofs); 1318 } 1319 if (err || !ofs->indexdir) 1320 pr_warn("try deleting index dir or mounting with '-o index=off' to disable inodes index.\n"); 1321 1322 out: 1323 mnt_drop_write(mnt); 1324 return err; 1325 } 1326 1327 static bool ovl_lower_uuid_ok(struct ovl_fs *ofs, const uuid_t *uuid) 1328 { 1329 unsigned int i; 1330 1331 if (!ofs->config.nfs_export && !ofs->upper_mnt) 1332 return true; 1333 1334 for (i = 0; i < ofs->numfs; i++) { 1335 /* 1336 * We use uuid to associate an overlay lower file handle with a 1337 * lower layer, so we can accept lower fs with null uuid as long 1338 * as all lower layers with null uuid are on the same fs. 1339 * if we detect multiple lower fs with the same uuid, we 1340 * disable lower file handle decoding on all of them. 1341 */ 1342 if (ofs->fs[i].is_lower && 1343 uuid_equal(&ofs->fs[i].sb->s_uuid, uuid)) { 1344 ofs->fs[i].bad_uuid = true; 1345 return false; 1346 } 1347 } 1348 return true; 1349 } 1350 1351 /* Get a unique fsid for the layer */ 1352 static int ovl_get_fsid(struct ovl_fs *ofs, const struct path *path) 1353 { 1354 struct super_block *sb = path->mnt->mnt_sb; 1355 unsigned int i; 1356 dev_t dev; 1357 int err; 1358 bool bad_uuid = false; 1359 1360 for (i = 0; i < ofs->numfs; i++) { 1361 if (ofs->fs[i].sb == sb) 1362 return i; 1363 } 1364 1365 if (!ovl_lower_uuid_ok(ofs, &sb->s_uuid)) { 1366 bad_uuid = true; 1367 if (ofs->config.index || ofs->config.nfs_export) { 1368 ofs->config.index = false; 1369 ofs->config.nfs_export = false; 1370 pr_warn("%s uuid detected in lower fs '%pd2', falling back to index=off,nfs_export=off.\n", 1371 uuid_is_null(&sb->s_uuid) ? "null" : 1372 "conflicting", 1373 path->dentry); 1374 } 1375 } 1376 1377 err = get_anon_bdev(&dev); 1378 if (err) { 1379 pr_err("failed to get anonymous bdev for lowerpath\n"); 1380 return err; 1381 } 1382 1383 ofs->fs[ofs->numfs].sb = sb; 1384 ofs->fs[ofs->numfs].pseudo_dev = dev; 1385 ofs->fs[ofs->numfs].bad_uuid = bad_uuid; 1386 1387 return ofs->numfs++; 1388 } 1389 1390 static int ovl_get_layers(struct super_block *sb, struct ovl_fs *ofs, 1391 struct path *stack, unsigned int numlower) 1392 { 1393 int err; 1394 unsigned int i; 1395 struct ovl_layer *layers; 1396 1397 err = -ENOMEM; 1398 layers = kcalloc(numlower + 1, sizeof(struct ovl_layer), GFP_KERNEL); 1399 if (!layers) 1400 goto out; 1401 ofs->layers = layers; 1402 1403 ofs->fs = kcalloc(numlower + 1, sizeof(struct ovl_sb), GFP_KERNEL); 1404 if (ofs->fs == NULL) 1405 goto out; 1406 1407 /* idx/fsid 0 are reserved for upper fs even with lower only overlay */ 1408 ofs->numfs++; 1409 1410 layers[0].mnt = ofs->upper_mnt; 1411 layers[0].idx = 0; 1412 layers[0].fsid = 0; 1413 ofs->numlayer = 1; 1414 1415 /* 1416 * All lower layers that share the same fs as upper layer, use the same 1417 * pseudo_dev as upper layer. Allocate fs[0].pseudo_dev even for lower 1418 * only overlay to simplify ovl_fs_free(). 1419 * is_lower will be set if upper fs is shared with a lower layer. 1420 */ 1421 err = get_anon_bdev(&ofs->fs[0].pseudo_dev); 1422 if (err) { 1423 pr_err("failed to get anonymous bdev for upper fs\n"); 1424 goto out; 1425 } 1426 1427 if (ofs->upper_mnt) { 1428 ofs->fs[0].sb = ofs->upper_mnt->mnt_sb; 1429 ofs->fs[0].is_lower = false; 1430 } 1431 1432 for (i = 0; i < numlower; i++) { 1433 struct vfsmount *mnt; 1434 struct inode *trap; 1435 int fsid; 1436 1437 err = fsid = ovl_get_fsid(ofs, &stack[i]); 1438 if (err < 0) 1439 goto out; 1440 1441 err = ovl_setup_trap(sb, stack[i].dentry, &trap, "lowerdir"); 1442 if (err) 1443 goto out; 1444 1445 if (ovl_is_inuse(stack[i].dentry)) { 1446 err = ovl_report_in_use(ofs, "lowerdir"); 1447 if (err) 1448 goto out; 1449 } 1450 1451 mnt = clone_private_mount(&stack[i]); 1452 err = PTR_ERR(mnt); 1453 if (IS_ERR(mnt)) { 1454 pr_err("failed to clone lowerpath\n"); 1455 iput(trap); 1456 goto out; 1457 } 1458 1459 /* 1460 * Make lower layers R/O. That way fchmod/fchown on lower file 1461 * will fail instead of modifying lower fs. 1462 */ 1463 mnt->mnt_flags |= MNT_READONLY | MNT_NOATIME; 1464 1465 layers[ofs->numlayer].trap = trap; 1466 layers[ofs->numlayer].mnt = mnt; 1467 layers[ofs->numlayer].idx = ofs->numlayer; 1468 layers[ofs->numlayer].fsid = fsid; 1469 layers[ofs->numlayer].fs = &ofs->fs[fsid]; 1470 ofs->numlayer++; 1471 ofs->fs[fsid].is_lower = true; 1472 } 1473 1474 /* 1475 * When all layers on same fs, overlay can use real inode numbers. 1476 * With mount option "xino=<on|auto>", mounter declares that there are 1477 * enough free high bits in underlying fs to hold the unique fsid. 1478 * If overlayfs does encounter underlying inodes using the high xino 1479 * bits reserved for fsid, it emits a warning and uses the original 1480 * inode number or a non persistent inode number allocated from a 1481 * dedicated range. 1482 */ 1483 if (ofs->numfs - !ofs->upper_mnt == 1) { 1484 if (ofs->config.xino == OVL_XINO_ON) 1485 pr_info("\"xino=on\" is useless with all layers on same fs, ignore.\n"); 1486 ofs->xino_mode = 0; 1487 } else if (ofs->config.xino == OVL_XINO_OFF) { 1488 ofs->xino_mode = -1; 1489 } else if (ofs->xino_mode < 0) { 1490 /* 1491 * This is a roundup of number of bits needed for encoding 1492 * fsid, where fsid 0 is reserved for upper fs (even with 1493 * lower only overlay) +1 extra bit is reserved for the non 1494 * persistent inode number range that is used for resolving 1495 * xino lower bits overflow. 1496 */ 1497 BUILD_BUG_ON(ilog2(OVL_MAX_STACK) > 30); 1498 ofs->xino_mode = ilog2(ofs->numfs - 1) + 2; 1499 } 1500 1501 if (ofs->xino_mode > 0) { 1502 pr_info("\"xino\" feature enabled using %d upper inode bits.\n", 1503 ofs->xino_mode); 1504 } 1505 1506 err = 0; 1507 out: 1508 return err; 1509 } 1510 1511 static struct ovl_entry *ovl_get_lowerstack(struct super_block *sb, 1512 struct ovl_fs *ofs) 1513 { 1514 int err; 1515 char *lowertmp, *lower; 1516 struct path *stack = NULL; 1517 unsigned int stacklen, numlower = 0, i; 1518 struct ovl_entry *oe; 1519 1520 err = -ENOMEM; 1521 lowertmp = kstrdup(ofs->config.lowerdir, GFP_KERNEL); 1522 if (!lowertmp) 1523 goto out_err; 1524 1525 err = -EINVAL; 1526 stacklen = ovl_split_lowerdirs(lowertmp); 1527 if (stacklen > OVL_MAX_STACK) { 1528 pr_err("too many lower directories, limit is %d\n", 1529 OVL_MAX_STACK); 1530 goto out_err; 1531 } else if (!ofs->config.upperdir && stacklen == 1) { 1532 pr_err("at least 2 lowerdir are needed while upperdir nonexistent\n"); 1533 goto out_err; 1534 } else if (!ofs->config.upperdir && ofs->config.nfs_export && 1535 ofs->config.redirect_follow) { 1536 pr_warn("NFS export requires \"redirect_dir=nofollow\" on non-upper mount, falling back to nfs_export=off.\n"); 1537 ofs->config.nfs_export = false; 1538 } 1539 1540 err = -ENOMEM; 1541 stack = kcalloc(stacklen, sizeof(struct path), GFP_KERNEL); 1542 if (!stack) 1543 goto out_err; 1544 1545 err = -EINVAL; 1546 lower = lowertmp; 1547 for (numlower = 0; numlower < stacklen; numlower++) { 1548 err = ovl_lower_dir(lower, &stack[numlower], ofs, 1549 &sb->s_stack_depth); 1550 if (err) 1551 goto out_err; 1552 1553 lower = strchr(lower, '\0') + 1; 1554 } 1555 1556 err = -EINVAL; 1557 sb->s_stack_depth++; 1558 if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) { 1559 pr_err("maximum fs stacking depth exceeded\n"); 1560 goto out_err; 1561 } 1562 1563 err = ovl_get_layers(sb, ofs, stack, numlower); 1564 if (err) 1565 goto out_err; 1566 1567 err = -ENOMEM; 1568 oe = ovl_alloc_entry(numlower); 1569 if (!oe) 1570 goto out_err; 1571 1572 for (i = 0; i < numlower; i++) { 1573 oe->lowerstack[i].dentry = dget(stack[i].dentry); 1574 oe->lowerstack[i].layer = &ofs->layers[i+1]; 1575 } 1576 1577 out: 1578 for (i = 0; i < numlower; i++) 1579 path_put(&stack[i]); 1580 kfree(stack); 1581 kfree(lowertmp); 1582 1583 return oe; 1584 1585 out_err: 1586 oe = ERR_PTR(err); 1587 goto out; 1588 } 1589 1590 /* 1591 * Check if this layer root is a descendant of: 1592 * - another layer of this overlayfs instance 1593 * - upper/work dir of any overlayfs instance 1594 */ 1595 static int ovl_check_layer(struct super_block *sb, struct ovl_fs *ofs, 1596 struct dentry *dentry, const char *name) 1597 { 1598 struct dentry *next = dentry, *parent; 1599 int err = 0; 1600 1601 if (!dentry) 1602 return 0; 1603 1604 parent = dget_parent(next); 1605 1606 /* Walk back ancestors to root (inclusive) looking for traps */ 1607 while (!err && parent != next) { 1608 if (ovl_lookup_trap_inode(sb, parent)) { 1609 err = -ELOOP; 1610 pr_err("overlapping %s path\n", name); 1611 } else if (ovl_is_inuse(parent)) { 1612 err = ovl_report_in_use(ofs, name); 1613 } 1614 next = parent; 1615 parent = dget_parent(next); 1616 dput(next); 1617 } 1618 1619 dput(parent); 1620 1621 return err; 1622 } 1623 1624 /* 1625 * Check if any of the layers or work dirs overlap. 1626 */ 1627 static int ovl_check_overlapping_layers(struct super_block *sb, 1628 struct ovl_fs *ofs) 1629 { 1630 int i, err; 1631 1632 if (ofs->upper_mnt) { 1633 err = ovl_check_layer(sb, ofs, ofs->upper_mnt->mnt_root, 1634 "upperdir"); 1635 if (err) 1636 return err; 1637 1638 /* 1639 * Checking workbasedir avoids hitting ovl_is_inuse(parent) of 1640 * this instance and covers overlapping work and index dirs, 1641 * unless work or index dir have been moved since created inside 1642 * workbasedir. In that case, we already have their traps in 1643 * inode cache and we will catch that case on lookup. 1644 */ 1645 err = ovl_check_layer(sb, ofs, ofs->workbasedir, "workdir"); 1646 if (err) 1647 return err; 1648 } 1649 1650 for (i = 1; i < ofs->numlayer; i++) { 1651 err = ovl_check_layer(sb, ofs, 1652 ofs->layers[i].mnt->mnt_root, 1653 "lowerdir"); 1654 if (err) 1655 return err; 1656 } 1657 1658 return 0; 1659 } 1660 1661 static struct dentry *ovl_get_root(struct super_block *sb, 1662 struct dentry *upperdentry, 1663 struct ovl_entry *oe) 1664 { 1665 struct dentry *root; 1666 struct ovl_path *lowerpath = &oe->lowerstack[0]; 1667 unsigned long ino = d_inode(lowerpath->dentry)->i_ino; 1668 int fsid = lowerpath->layer->fsid; 1669 struct ovl_inode_params oip = { 1670 .upperdentry = upperdentry, 1671 .lowerpath = lowerpath, 1672 }; 1673 1674 root = d_make_root(ovl_new_inode(sb, S_IFDIR, 0)); 1675 if (!root) 1676 return NULL; 1677 1678 root->d_fsdata = oe; 1679 1680 if (upperdentry) { 1681 /* Root inode uses upper st_ino/i_ino */ 1682 ino = d_inode(upperdentry)->i_ino; 1683 fsid = 0; 1684 ovl_dentry_set_upper_alias(root); 1685 if (ovl_is_impuredir(upperdentry)) 1686 ovl_set_flag(OVL_IMPURE, d_inode(root)); 1687 } 1688 1689 /* Root is always merge -> can have whiteouts */ 1690 ovl_set_flag(OVL_WHITEOUTS, d_inode(root)); 1691 ovl_dentry_set_flag(OVL_E_CONNECTED, root); 1692 ovl_set_upperdata(d_inode(root)); 1693 ovl_inode_init(d_inode(root), &oip, ino, fsid); 1694 ovl_dentry_update_reval(root, upperdentry, DCACHE_OP_WEAK_REVALIDATE); 1695 1696 return root; 1697 } 1698 1699 static int ovl_fill_super(struct super_block *sb, void *data, int silent) 1700 { 1701 struct path upperpath = { }; 1702 struct dentry *root_dentry; 1703 struct ovl_entry *oe; 1704 struct ovl_fs *ofs; 1705 struct cred *cred; 1706 int err; 1707 1708 sb->s_d_op = &ovl_dentry_operations; 1709 1710 err = -ENOMEM; 1711 ofs = kzalloc(sizeof(struct ovl_fs), GFP_KERNEL); 1712 if (!ofs) 1713 goto out; 1714 1715 ofs->creator_cred = cred = prepare_creds(); 1716 if (!cred) 1717 goto out_err; 1718 1719 ofs->config.index = ovl_index_def; 1720 ofs->config.nfs_export = ovl_nfs_export_def; 1721 ofs->config.xino = ovl_xino_def(); 1722 ofs->config.metacopy = ovl_metacopy_def; 1723 err = ovl_parse_opt((char *) data, &ofs->config); 1724 if (err) 1725 goto out_err; 1726 1727 err = -EINVAL; 1728 if (!ofs->config.lowerdir) { 1729 if (!silent) 1730 pr_err("missing 'lowerdir'\n"); 1731 goto out_err; 1732 } 1733 1734 sb->s_stack_depth = 0; 1735 sb->s_maxbytes = MAX_LFS_FILESIZE; 1736 atomic_long_set(&ofs->last_ino, 1); 1737 /* Assume underlaying fs uses 32bit inodes unless proven otherwise */ 1738 if (ofs->config.xino != OVL_XINO_OFF) { 1739 ofs->xino_mode = BITS_PER_LONG - 32; 1740 if (!ofs->xino_mode) { 1741 pr_warn("xino not supported on 32bit kernel, falling back to xino=off.\n"); 1742 ofs->config.xino = OVL_XINO_OFF; 1743 } 1744 } 1745 1746 /* alloc/destroy_inode needed for setting up traps in inode cache */ 1747 sb->s_op = &ovl_super_operations; 1748 1749 if (ofs->config.upperdir) { 1750 if (!ofs->config.workdir) { 1751 pr_err("missing 'workdir'\n"); 1752 goto out_err; 1753 } 1754 1755 err = ovl_get_upper(sb, ofs, &upperpath); 1756 if (err) 1757 goto out_err; 1758 1759 err = ovl_get_workdir(sb, ofs, &upperpath); 1760 if (err) 1761 goto out_err; 1762 1763 if (!ofs->workdir) 1764 sb->s_flags |= SB_RDONLY; 1765 1766 sb->s_stack_depth = ofs->upper_mnt->mnt_sb->s_stack_depth; 1767 sb->s_time_gran = ofs->upper_mnt->mnt_sb->s_time_gran; 1768 1769 } 1770 oe = ovl_get_lowerstack(sb, ofs); 1771 err = PTR_ERR(oe); 1772 if (IS_ERR(oe)) 1773 goto out_err; 1774 1775 /* If the upper fs is nonexistent, we mark overlayfs r/o too */ 1776 if (!ofs->upper_mnt) 1777 sb->s_flags |= SB_RDONLY; 1778 1779 if (!(ovl_force_readonly(ofs)) && ofs->config.index) { 1780 err = ovl_get_indexdir(sb, ofs, oe, &upperpath); 1781 if (err) 1782 goto out_free_oe; 1783 1784 /* Force r/o mount with no index dir */ 1785 if (!ofs->indexdir) { 1786 dput(ofs->workdir); 1787 ofs->workdir = NULL; 1788 sb->s_flags |= SB_RDONLY; 1789 } 1790 1791 } 1792 1793 err = ovl_check_overlapping_layers(sb, ofs); 1794 if (err) 1795 goto out_free_oe; 1796 1797 /* Show index=off in /proc/mounts for forced r/o mount */ 1798 if (!ofs->indexdir) { 1799 ofs->config.index = false; 1800 if (ofs->upper_mnt && ofs->config.nfs_export) { 1801 pr_warn("NFS export requires an index dir, falling back to nfs_export=off.\n"); 1802 ofs->config.nfs_export = false; 1803 } 1804 } 1805 1806 if (ofs->config.metacopy && ofs->config.nfs_export) { 1807 pr_warn("NFS export is not supported with metadata only copy up, falling back to nfs_export=off.\n"); 1808 ofs->config.nfs_export = false; 1809 } 1810 1811 if (ofs->config.nfs_export) 1812 sb->s_export_op = &ovl_export_operations; 1813 1814 /* Never override disk quota limits or use reserved space */ 1815 cap_lower(cred->cap_effective, CAP_SYS_RESOURCE); 1816 1817 sb->s_magic = OVERLAYFS_SUPER_MAGIC; 1818 sb->s_xattr = ovl_xattr_handlers; 1819 sb->s_fs_info = ofs; 1820 sb->s_flags |= SB_POSIXACL; 1821 1822 err = -ENOMEM; 1823 root_dentry = ovl_get_root(sb, upperpath.dentry, oe); 1824 if (!root_dentry) 1825 goto out_free_oe; 1826 1827 mntput(upperpath.mnt); 1828 1829 sb->s_root = root_dentry; 1830 1831 return 0; 1832 1833 out_free_oe: 1834 ovl_entry_stack_free(oe); 1835 kfree(oe); 1836 out_err: 1837 path_put(&upperpath); 1838 ovl_free_fs(ofs); 1839 out: 1840 return err; 1841 } 1842 1843 static struct dentry *ovl_mount(struct file_system_type *fs_type, int flags, 1844 const char *dev_name, void *raw_data) 1845 { 1846 return mount_nodev(fs_type, flags, raw_data, ovl_fill_super); 1847 } 1848 1849 static struct file_system_type ovl_fs_type = { 1850 .owner = THIS_MODULE, 1851 .name = "overlay", 1852 .mount = ovl_mount, 1853 .kill_sb = kill_anon_super, 1854 }; 1855 MODULE_ALIAS_FS("overlay"); 1856 1857 static void ovl_inode_init_once(void *foo) 1858 { 1859 struct ovl_inode *oi = foo; 1860 1861 inode_init_once(&oi->vfs_inode); 1862 } 1863 1864 static int __init ovl_init(void) 1865 { 1866 int err; 1867 1868 ovl_inode_cachep = kmem_cache_create("ovl_inode", 1869 sizeof(struct ovl_inode), 0, 1870 (SLAB_RECLAIM_ACCOUNT| 1871 SLAB_MEM_SPREAD|SLAB_ACCOUNT), 1872 ovl_inode_init_once); 1873 if (ovl_inode_cachep == NULL) 1874 return -ENOMEM; 1875 1876 err = ovl_aio_request_cache_init(); 1877 if (!err) { 1878 err = register_filesystem(&ovl_fs_type); 1879 if (!err) 1880 return 0; 1881 1882 ovl_aio_request_cache_destroy(); 1883 } 1884 kmem_cache_destroy(ovl_inode_cachep); 1885 1886 return err; 1887 } 1888 1889 static void __exit ovl_exit(void) 1890 { 1891 unregister_filesystem(&ovl_fs_type); 1892 1893 /* 1894 * Make sure all delayed rcu free inodes are flushed before we 1895 * destroy cache. 1896 */ 1897 rcu_barrier(); 1898 kmem_cache_destroy(ovl_inode_cachep); 1899 ovl_aio_request_cache_destroy(); 1900 } 1901 1902 module_init(ovl_init); 1903 module_exit(ovl_exit); 1904