개념 설명 전체 · v6.18.37 / fs/namei.c
1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/fs/namei.c 4 * 5 * Copyright (C) 1991, 1992 Linus Torvalds 6 */ 7 8 /* 9 * Some corrections by tytso. 10 */ 11 12 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname 13 * lookup logic. 14 */ 15 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture. 16 */ 17 18 #include <linux/init.h> 19 #include <linux/export.h> 20 #include <linux/slab.h> 21 #include <linux/wordpart.h> 22 #include <linux/fs.h> 23 #include <linux/filelock.h> 24 #include <linux/namei.h> 25 #include <linux/pagemap.h> 26 #include <linux/sched/mm.h> 27 #include <linux/fsnotify.h> 28 #include <linux/personality.h> 29 #include <linux/security.h> 30 #include <linux/syscalls.h> 31 #include <linux/mount.h> 32 #include <linux/audit.h> 33 #include <linux/capability.h> 34 #include <linux/file.h> 35 #include <linux/fcntl.h> 36 #include <linux/device_cgroup.h> 37 #include <linux/fs_struct.h> 38 #include <linux/posix_acl.h> 39 #include <linux/hash.h> 40 #include <linux/bitops.h> 41 #include <linux/init_task.h> 42 #include <linux/uaccess.h> 43 44 #include "internal.h" 45 #include "mount.h" 46 47 /* [Feb-1997 T. Schoebel-Theuer] 48 * Fundamental changes in the pathname lookup mechanisms (namei) 49 * were necessary because of omirr. The reason is that omirr needs 50 * to know the _real_ pathname, not the user-supplied one, in case 51 * of symlinks (and also when transname replacements occur). 52 * 53 * The new code replaces the old recursive symlink resolution with 54 * an iterative one (in case of non-nested symlink chains). It does 55 * this with calls to <fs>_follow_link(). 56 * As a side effect, dir_namei(), _namei() and follow_link() are now 57 * replaced with a single function lookup_dentry() that can handle all 58 * the special cases of the former code. 59 * 60 * With the new dcache, the pathname is stored at each inode, at least as 61 * long as the refcount of the inode is positive. As a side effect, the 62 * size of the dcache depends on the inode cache and thus is dynamic. 63 * 64 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink 65 * resolution to correspond with current state of the code. 66 * 67 * Note that the symlink resolution is not *completely* iterative. 68 * There is still a significant amount of tail- and mid- recursion in 69 * the algorithm. Also, note that <fs>_readlink() is not used in 70 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink() 71 * may return different results than <fs>_follow_link(). Many virtual 72 * filesystems (including /proc) exhibit this behavior. 73 */ 74 75 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation: 76 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL 77 * and the name already exists in form of a symlink, try to create the new 78 * name indicated by the symlink. The old code always complained that the 79 * name already exists, due to not following the symlink even if its target 80 * is nonexistent. The new semantics affects also mknod() and link() when 81 * the name is a symlink pointing to a non-existent name. 82 * 83 * I don't know which semantics is the right one, since I have no access 84 * to standards. But I found by trial that HP-UX 9.0 has the full "new" 85 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the 86 * "old" one. Personally, I think the new semantics is much more logical. 87 * Note that "ln old new" where "new" is a symlink pointing to a non-existing 88 * file does succeed in both HP-UX and SunOs, but not in Solaris 89 * and in the old Linux semantics. 90 */ 91 92 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink 93 * semantics. See the comments in "open_namei" and "do_link" below. 94 * 95 * [10-Sep-98 Alan Modra] Another symlink change. 96 */ 97 98 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks: 99 * inside the path - always follow. 100 * in the last component in creation/removal/renaming - never follow. 101 * if LOOKUP_FOLLOW passed - follow. 102 * if the pathname has trailing slashes - follow. 103 * otherwise - don't follow. 104 * (applied in that order). 105 * 106 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT 107 * restored for 2.4. This is the last surviving part of old 4.2BSD bug. 108 * During the 2.4 we need to fix the userland stuff depending on it - 109 * hopefully we will be able to get rid of that wart in 2.5. So far only 110 * XEmacs seems to be relying on it... 111 */ 112 /* 113 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland) 114 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives 115 * any extra contention... 116 */ 117 118 /* In order to reduce some races, while at the same time doing additional 119 * checking and hopefully speeding things up, we copy filenames to the 120 * kernel data space before using them.. 121 * 122 * POSIX.1 2.4: an empty pathname is invalid (ENOENT). 123 * PATH_MAX includes the nul terminator --RR. 124 */ 125 126 #define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname)) 127 128 static inline void initname(struct filename *name, const char __user *uptr) 129 { 130 name->uptr = uptr; 131 name->aname = NULL; 132 atomic_set(&name->refcnt, 1); 133 } 134 135 struct filename * 136 getname_flags(const char __user *filename, int flags) 137 { 138 struct filename *result; 139 char *kname; 140 int len; 141 142 result = audit_reusename(filename); 143 if (result) 144 return result; 145 146 result = __getname(); 147 if (unlikely(!result)) 148 return ERR_PTR(-ENOMEM); 149 150 /* 151 * First, try to embed the struct filename inside the names_cache 152 * allocation 153 */ 154 kname = (char *)result->iname; 155 result->name = kname; 156 157 len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX); 158 /* 159 * Handle both empty path and copy failure in one go. 160 */ 161 if (unlikely(len <= 0)) { 162 if (unlikely(len < 0)) { 163 __putname(result); 164 return ERR_PTR(len); 165 } 166 167 /* The empty path is special. */ 168 if (!(flags & LOOKUP_EMPTY)) { 169 __putname(result); 170 return ERR_PTR(-ENOENT); 171 } 172 } 173 174 /* 175 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a 176 * separate struct filename so we can dedicate the entire 177 * names_cache allocation for the pathname, and re-do the copy from 178 * userland. 179 */ 180 if (unlikely(len == EMBEDDED_NAME_MAX)) { 181 const size_t size = offsetof(struct filename, iname[1]); 182 kname = (char *)result; 183 184 /* 185 * size is chosen that way we to guarantee that 186 * result->iname[0] is within the same object and that 187 * kname can't be equal to result->iname, no matter what. 188 */ 189 result = kzalloc(size, GFP_KERNEL); 190 if (unlikely(!result)) { 191 __putname(kname); 192 return ERR_PTR(-ENOMEM); 193 } 194 result->name = kname; 195 len = strncpy_from_user(kname, filename, PATH_MAX); 196 if (unlikely(len < 0)) { 197 __putname(kname); 198 kfree(result); 199 return ERR_PTR(len); 200 } 201 /* The empty path is special. */ 202 if (unlikely(!len) && !(flags & LOOKUP_EMPTY)) { 203 __putname(kname); 204 kfree(result); 205 return ERR_PTR(-ENOENT); 206 } 207 if (unlikely(len == PATH_MAX)) { 208 __putname(kname); 209 kfree(result); 210 return ERR_PTR(-ENAMETOOLONG); 211 } 212 } 213 initname(result, filename); 214 audit_getname(result); 215 return result; 216 } 217 218 struct filename *getname_uflags(const char __user *filename, int uflags) 219 { 220 int flags = (uflags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0; 221 222 return getname_flags(filename, flags); 223 } 224 225 struct filename *__getname_maybe_null(const char __user *pathname) 226 { 227 struct filename *name; 228 char c; 229 230 /* try to save on allocations; loss on um, though */ 231 if (get_user(c, pathname)) 232 return ERR_PTR(-EFAULT); 233 if (!c) 234 return NULL; 235 236 name = getname_flags(pathname, LOOKUP_EMPTY); 237 if (!IS_ERR(name) && !(name->name[0])) { 238 putname(name); 239 name = NULL; 240 } 241 return name; 242 } 243 244 struct filename *getname_kernel(const char * filename) 245 { 246 struct filename *result; 247 int len = strlen(filename) + 1; 248 249 result = __getname(); 250 if (unlikely(!result)) 251 return ERR_PTR(-ENOMEM); 252 253 if (len <= EMBEDDED_NAME_MAX) { 254 result->name = (char *)result->iname; 255 } else if (len <= PATH_MAX) { 256 const size_t size = offsetof(struct filename, iname[1]); 257 struct filename *tmp; 258 259 tmp = kmalloc(size, GFP_KERNEL); 260 if (unlikely(!tmp)) { 261 __putname(result); 262 return ERR_PTR(-ENOMEM); 263 } 264 tmp->name = (char *)result; 265 result = tmp; 266 } else { 267 __putname(result); 268 return ERR_PTR(-ENAMETOOLONG); 269 } 270 memcpy((char *)result->name, filename, len); 271 initname(result, NULL); 272 audit_getname(result); 273 return result; 274 } 275 EXPORT_SYMBOL(getname_kernel); 276 277 void putname(struct filename *name) 278 { 279 int refcnt; 280 281 if (IS_ERR_OR_NULL(name)) 282 return; 283 284 refcnt = atomic_read(&name->refcnt); 285 if (refcnt != 1) { 286 if (WARN_ON_ONCE(!refcnt)) 287 return; 288 289 if (!atomic_dec_and_test(&name->refcnt)) 290 return; 291 } 292 293 if (name->name != name->iname) { 294 __putname(name->name); 295 kfree(name); 296 } else 297 __putname(name); 298 } 299 EXPORT_SYMBOL(putname); 300 301 /** 302 * check_acl - perform ACL permission checking 303 * @idmap: idmap of the mount the inode was found from 304 * @inode: inode to check permissions on 305 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...) 306 * 307 * This function performs the ACL permission checking. Since this function 308 * retrieve POSIX acls it needs to know whether it is called from a blocking or 309 * non-blocking context and thus cares about the MAY_NOT_BLOCK bit. 310 * 311 * If the inode has been found through an idmapped mount the idmap of 312 * the vfsmount must be passed through @idmap. This function will then take 313 * care to map the inode according to @idmap before checking permissions. 314 * On non-idmapped mounts or if permission checking is to be performed on the 315 * raw inode simply pass @nop_mnt_idmap. 316 */ 317 static int check_acl(struct mnt_idmap *idmap, 318 struct inode *inode, int mask) 319 { 320 #ifdef CONFIG_FS_POSIX_ACL 321 struct posix_acl *acl; 322 323 if (mask & MAY_NOT_BLOCK) { 324 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS); 325 if (!acl) 326 return -EAGAIN; 327 /* no ->get_inode_acl() calls in RCU mode... */ 328 if (is_uncached_acl(acl)) 329 return -ECHILD; 330 return posix_acl_permission(idmap, inode, acl, mask); 331 } 332 333 acl = get_inode_acl(inode, ACL_TYPE_ACCESS); 334 if (IS_ERR(acl)) 335 return PTR_ERR(acl); 336 if (acl) { 337 int error = posix_acl_permission(idmap, inode, acl, mask); 338 posix_acl_release(acl); 339 return error; 340 } 341 #endif 342 343 return -EAGAIN; 344 } 345 346 /* 347 * Very quick optimistic "we know we have no ACL's" check. 348 * 349 * Note that this is purely for ACL_TYPE_ACCESS, and purely 350 * for the "we have cached that there are no ACLs" case. 351 * 352 * If this returns true, we know there are no ACLs. But if 353 * it returns false, we might still not have ACLs (it could 354 * be the is_uncached_acl() case). 355 */ 356 static inline bool no_acl_inode(struct inode *inode) 357 { 358 #ifdef CONFIG_FS_POSIX_ACL 359 return likely(!READ_ONCE(inode->i_acl)); 360 #else 361 return true; 362 #endif 363 } 364 365 /** 366 * acl_permission_check - perform basic UNIX permission checking 367 * @idmap: idmap of the mount the inode was found from 368 * @inode: inode to check permissions on 369 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...) 370 * 371 * This function performs the basic UNIX permission checking. Since this 372 * function may retrieve POSIX acls it needs to know whether it is called from a 373 * blocking or non-blocking context and thus cares about the MAY_NOT_BLOCK bit. 374 * 375 * If the inode has been found through an idmapped mount the idmap of 376 * the vfsmount must be passed through @idmap. This function will then take 377 * care to map the inode according to @idmap before checking permissions. 378 * On non-idmapped mounts or if permission checking is to be performed on the 379 * raw inode simply pass @nop_mnt_idmap. 380 */ 381 static int acl_permission_check(struct mnt_idmap *idmap, 382 struct inode *inode, int mask) 383 { 384 unsigned int mode = inode->i_mode; 385 vfsuid_t vfsuid; 386 387 /* 388 * Common cheap case: everybody has the requested 389 * rights, and there are no ACLs to check. No need 390 * to do any owner/group checks in that case. 391 * 392 * - 'mask&7' is the requested permission bit set 393 * - multiplying by 0111 spreads them out to all of ugo 394 * - '& ~mode' looks for missing inode permission bits 395 * - the '!' is for "no missing permissions" 396 * 397 * After that, we just need to check that there are no 398 * ACL's on the inode - do the 'IS_POSIXACL()' check last 399 * because it will dereference the ->i_sb pointer and we 400 * want to avoid that if at all possible. 401 */ 402 if (!((mask & 7) * 0111 & ~mode)) { 403 if (no_acl_inode(inode)) 404 return 0; 405 if (!IS_POSIXACL(inode)) 406 return 0; 407 } 408 409 /* Are we the owner? If so, ACL's don't matter */ 410 vfsuid = i_uid_into_vfsuid(idmap, inode); 411 if (likely(vfsuid_eq_kuid(vfsuid, current_fsuid()))) { 412 mask &= 7; 413 mode >>= 6; 414 return (mask & ~mode) ? -EACCES : 0; 415 } 416 417 /* Do we have ACL's? */ 418 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { 419 int error = check_acl(idmap, inode, mask); 420 if (error != -EAGAIN) 421 return error; 422 } 423 424 /* Only RWX matters for group/other mode bits */ 425 mask &= 7; 426 427 /* 428 * Are the group permissions different from 429 * the other permissions in the bits we care 430 * about? Need to check group ownership if so. 431 */ 432 if (mask & (mode ^ (mode >> 3))) { 433 vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode); 434 if (vfsgid_in_group_p(vfsgid)) 435 mode >>= 3; 436 } 437 438 /* Bits in 'mode' clear that we require? */ 439 return (mask & ~mode) ? -EACCES : 0; 440 } 441 442 /** 443 * generic_permission - check for access rights on a Posix-like filesystem 444 * @idmap: idmap of the mount the inode was found from 445 * @inode: inode to check access rights for 446 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, 447 * %MAY_NOT_BLOCK ...) 448 * 449 * Used to check for read/write/execute permissions on a file. 450 * We use "fsuid" for this, letting us set arbitrary permissions 451 * for filesystem access without changing the "normal" uids which 452 * are used for other things. 453 * 454 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk 455 * request cannot be satisfied (eg. requires blocking or too much complexity). 456 * It would then be called again in ref-walk mode. 457 * 458 * If the inode has been found through an idmapped mount the idmap of 459 * the vfsmount must be passed through @idmap. This function will then take 460 * care to map the inode according to @idmap before checking permissions. 461 * On non-idmapped mounts or if permission checking is to be performed on the 462 * raw inode simply pass @nop_mnt_idmap. 463 */ 464 int generic_permission(struct mnt_idmap *idmap, struct inode *inode, 465 int mask) 466 { 467 int ret; 468 469 /* 470 * Do the basic permission checks. 471 */ 472 ret = acl_permission_check(idmap, inode, mask); 473 if (ret != -EACCES) 474 return ret; 475 476 if (S_ISDIR(inode->i_mode)) { 477 /* DACs are overridable for directories */ 478 if (!(mask & MAY_WRITE)) 479 if (capable_wrt_inode_uidgid(idmap, inode, 480 CAP_DAC_READ_SEARCH)) 481 return 0; 482 if (capable_wrt_inode_uidgid(idmap, inode, 483 CAP_DAC_OVERRIDE)) 484 return 0; 485 return -EACCES; 486 } 487 488 /* 489 * Searching includes executable on directories, else just read. 490 */ 491 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 492 if (mask == MAY_READ) 493 if (capable_wrt_inode_uidgid(idmap, inode, 494 CAP_DAC_READ_SEARCH)) 495 return 0; 496 /* 497 * Read/write DACs are always overridable. 498 * Executable DACs are overridable when there is 499 * at least one exec bit set. 500 */ 501 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 502 if (capable_wrt_inode_uidgid(idmap, inode, 503 CAP_DAC_OVERRIDE)) 504 return 0; 505 506 return -EACCES; 507 } 508 EXPORT_SYMBOL(generic_permission); 509 510 /** 511 * do_inode_permission - UNIX permission checking 512 * @idmap: idmap of the mount the inode was found from 513 * @inode: inode to check permissions on 514 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...) 515 * 516 * We _really_ want to just do "generic_permission()" without 517 * even looking at the inode->i_op values. So we keep a cache 518 * flag in inode->i_opflags, that says "this has not special 519 * permission function, use the fast case". 520 */ 521 static inline int do_inode_permission(struct mnt_idmap *idmap, 522 struct inode *inode, int mask) 523 { 524 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) { 525 if (likely(inode->i_op->permission)) 526 return inode->i_op->permission(idmap, inode, mask); 527 528 /* This gets set once for the inode lifetime */ 529 spin_lock(&inode->i_lock); 530 inode->i_opflags |= IOP_FASTPERM; 531 spin_unlock(&inode->i_lock); 532 } 533 return generic_permission(idmap, inode, mask); 534 } 535 536 /** 537 * sb_permission - Check superblock-level permissions 538 * @sb: Superblock of inode to check permission on 539 * @inode: Inode to check permission on 540 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 541 * 542 * Separate out file-system wide checks from inode-specific permission checks. 543 */ 544 static int sb_permission(struct super_block *sb, struct inode *inode, int mask) 545 { 546 if (unlikely(mask & MAY_WRITE)) { 547 umode_t mode = inode->i_mode; 548 549 /* Nobody gets write access to a read-only fs. */ 550 if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) 551 return -EROFS; 552 } 553 return 0; 554 } 555 556 /** 557 * inode_permission - Check for access rights to a given inode 558 * @idmap: idmap of the mount the inode was found from 559 * @inode: Inode to check permission on 560 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 561 * 562 * Check for read/write/execute permissions on an inode. We use fs[ug]id for 563 * this, letting us set arbitrary permissions for filesystem access without 564 * changing the "normal" UIDs which are used for other things. 565 * 566 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 567 */ 568 int inode_permission(struct mnt_idmap *idmap, 569 struct inode *inode, int mask) 570 { 571 int retval; 572 573 retval = sb_permission(inode->i_sb, inode, mask); 574 if (unlikely(retval)) 575 return retval; 576 577 if (unlikely(mask & MAY_WRITE)) { 578 /* 579 * Nobody gets write access to an immutable file. 580 */ 581 if (unlikely(IS_IMMUTABLE(inode))) 582 return -EPERM; 583 584 /* 585 * Updating mtime will likely cause i_uid and i_gid to be 586 * written back improperly if their true value is unknown 587 * to the vfs. 588 */ 589 if (unlikely(HAS_UNMAPPED_ID(idmap, inode))) 590 return -EACCES; 591 } 592 593 retval = do_inode_permission(idmap, inode, mask); 594 if (unlikely(retval)) 595 return retval; 596 597 retval = devcgroup_inode_permission(inode, mask); 598 if (unlikely(retval)) 599 return retval; 600 601 return security_inode_permission(inode, mask); 602 } 603 EXPORT_SYMBOL(inode_permission); 604 605 /** 606 * path_get - get a reference to a path 607 * @path: path to get the reference to 608 * 609 * Given a path increment the reference count to the dentry and the vfsmount. 610 */ 611 void path_get(const struct path *path) 612 { 613 mntget(path->mnt); 614 dget(path->dentry); 615 } 616 EXPORT_SYMBOL(path_get); 617 618 /** 619 * path_put - put a reference to a path 620 * @path: path to put the reference to 621 * 622 * Given a path decrement the reference count to the dentry and the vfsmount. 623 */ 624 void path_put(const struct path *path) 625 { 626 dput(path->dentry); 627 mntput(path->mnt); 628 } 629 EXPORT_SYMBOL(path_put); 630 631 #define EMBEDDED_LEVELS 2 632 struct nameidata { 633 struct path path; 634 struct qstr last; 635 struct path root; 636 struct inode *inode; /* path.dentry.d_inode */ 637 unsigned int flags, state; 638 unsigned seq, next_seq, m_seq, r_seq; 639 int last_type; 640 unsigned depth; 641 int total_link_count; 642 struct saved { 643 struct path link; 644 struct delayed_call done; 645 const char *name; 646 unsigned seq; 647 } *stack, internal[EMBEDDED_LEVELS]; 648 struct filename *name; 649 const char *pathname; 650 struct nameidata *saved; 651 unsigned root_seq; 652 int dfd; 653 vfsuid_t dir_vfsuid; 654 umode_t dir_mode; 655 } __randomize_layout; 656 657 #define ND_ROOT_PRESET 1 658 #define ND_ROOT_GRABBED 2 659 #define ND_JUMPED 4 660 661 static void __set_nameidata(struct nameidata *p, int dfd, struct filename *name) 662 { 663 struct nameidata *old = current->nameidata; 664 p->stack = p->internal; 665 p->depth = 0; 666 p->dfd = dfd; 667 p->name = name; 668 p->pathname = likely(name) ? name->name : ""; 669 p->path.mnt = NULL; 670 p->path.dentry = NULL; 671 p->total_link_count = old ? old->total_link_count : 0; 672 p->saved = old; 673 current->nameidata = p; 674 } 675 676 static inline void set_nameidata(struct nameidata *p, int dfd, struct filename *name, 677 const struct path *root) 678 { 679 __set_nameidata(p, dfd, name); 680 p->state = 0; 681 if (unlikely(root)) { 682 p->state = ND_ROOT_PRESET; 683 p->root = *root; 684 } 685 } 686 687 static void restore_nameidata(void) 688 { 689 struct nameidata *now = current->nameidata, *old = now->saved; 690 691 current->nameidata = old; 692 if (old) 693 old->total_link_count = now->total_link_count; 694 if (now->stack != now->internal) 695 kfree(now->stack); 696 } 697 698 static bool nd_alloc_stack(struct nameidata *nd) 699 { 700 struct saved *p; 701 702 p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved), 703 nd->flags & LOOKUP_RCU ? GFP_ATOMIC : GFP_KERNEL); 704 if (unlikely(!p)) 705 return false; 706 memcpy(p, nd->internal, sizeof(nd->internal)); 707 nd->stack = p; 708 return true; 709 } 710 711 /** 712 * path_connected - Verify that a dentry is below mnt.mnt_root 713 * @mnt: The mountpoint to check. 714 * @dentry: The dentry to check. 715 * 716 * Rename can sometimes move a file or directory outside of a bind 717 * mount, path_connected allows those cases to be detected. 718 */ 719 static bool path_connected(struct vfsmount *mnt, struct dentry *dentry) 720 { 721 struct super_block *sb = mnt->mnt_sb; 722 723 /* Bind mounts can have disconnected paths */ 724 if (mnt->mnt_root == sb->s_root) 725 return true; 726 727 return is_subdir(dentry, mnt->mnt_root); 728 } 729 730 static void drop_links(struct nameidata *nd) 731 { 732 int i = nd->depth; 733 while (i--) { 734 struct saved *last = nd->stack + i; 735 do_delayed_call(&last->done); 736 clear_delayed_call(&last->done); 737 } 738 } 739 740 static void leave_rcu(struct nameidata *nd) 741 { 742 nd->flags &= ~LOOKUP_RCU; 743 nd->seq = nd->next_seq = 0; 744 rcu_read_unlock(); 745 } 746 747 static void terminate_walk(struct nameidata *nd) 748 { 749 drop_links(nd); 750 if (!(nd->flags & LOOKUP_RCU)) { 751 int i; 752 path_put(&nd->path); 753 for (i = 0; i < nd->depth; i++) 754 path_put(&nd->stack[i].link); 755 if (nd->state & ND_ROOT_GRABBED) { 756 path_put(&nd->root); 757 nd->state &= ~ND_ROOT_GRABBED; 758 } 759 } else { 760 leave_rcu(nd); 761 } 762 nd->depth = 0; 763 nd->path.mnt = NULL; 764 nd->path.dentry = NULL; 765 } 766 767 /* path_put is needed afterwards regardless of success or failure */ 768 static bool __legitimize_path(struct path *path, unsigned seq, unsigned mseq) 769 { 770 int res = __legitimize_mnt(path->mnt, mseq); 771 if (unlikely(res)) { 772 if (res > 0) 773 path->mnt = NULL; 774 path->dentry = NULL; 775 return false; 776 } 777 if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) { 778 path->dentry = NULL; 779 return false; 780 } 781 return !read_seqcount_retry(&path->dentry->d_seq, seq); 782 } 783 784 static inline bool legitimize_path(struct nameidata *nd, 785 struct path *path, unsigned seq) 786 { 787 return __legitimize_path(path, seq, nd->m_seq); 788 } 789 790 static bool legitimize_links(struct nameidata *nd) 791 { 792 int i; 793 if (unlikely(nd->flags & LOOKUP_CACHED)) { 794 drop_links(nd); 795 nd->depth = 0; 796 return false; 797 } 798 for (i = 0; i < nd->depth; i++) { 799 struct saved *last = nd->stack + i; 800 if (unlikely(!legitimize_path(nd, &last->link, last->seq))) { 801 drop_links(nd); 802 nd->depth = i + 1; 803 return false; 804 } 805 } 806 return true; 807 } 808 809 static bool legitimize_root(struct nameidata *nd) 810 { 811 /* Nothing to do if nd->root is zero or is managed by the VFS user. */ 812 if (!nd->root.mnt || (nd->state & ND_ROOT_PRESET)) 813 return true; 814 nd->state |= ND_ROOT_GRABBED; 815 return legitimize_path(nd, &nd->root, nd->root_seq); 816 } 817 818 /* 819 * Path walking has 2 modes, rcu-walk and ref-walk (see 820 * Documentation/filesystems/path-lookup.txt). In situations when we can't 821 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab 822 * normal reference counts on dentries and vfsmounts to transition to ref-walk 823 * mode. Refcounts are grabbed at the last known good point before rcu-walk 824 * got stuck, so ref-walk may continue from there. If this is not successful 825 * (eg. a seqcount has changed), then failure is returned and it's up to caller 826 * to restart the path walk from the beginning in ref-walk mode. 827 */ 828 829 /** 830 * try_to_unlazy - try to switch to ref-walk mode. 831 * @nd: nameidata pathwalk data 832 * Returns: true on success, false on failure 833 * 834 * try_to_unlazy attempts to legitimize the current nd->path and nd->root 835 * for ref-walk mode. 836 * Must be called from rcu-walk context. 837 * Nothing should touch nameidata between try_to_unlazy() failure and 838 * terminate_walk(). 839 */ 840 static bool try_to_unlazy(struct nameidata *nd) 841 { 842 struct dentry *parent = nd->path.dentry; 843 844 BUG_ON(!(nd->flags & LOOKUP_RCU)); 845 846 if (unlikely(!legitimize_links(nd))) 847 goto out1; 848 if (unlikely(!legitimize_path(nd, &nd->path, nd->seq))) 849 goto out; 850 if (unlikely(!legitimize_root(nd))) 851 goto out; 852 leave_rcu(nd); 853 BUG_ON(nd->inode != parent->d_inode); 854 return true; 855 856 out1: 857 nd->path.mnt = NULL; 858 nd->path.dentry = NULL; 859 out: 860 leave_rcu(nd); 861 return false; 862 } 863 864 /** 865 * try_to_unlazy_next - try to switch to ref-walk mode. 866 * @nd: nameidata pathwalk data 867 * @dentry: next dentry to step into 868 * Returns: true on success, false on failure 869 * 870 * Similar to try_to_unlazy(), but here we have the next dentry already 871 * picked by rcu-walk and want to legitimize that in addition to the current 872 * nd->path and nd->root for ref-walk mode. Must be called from rcu-walk context. 873 * Nothing should touch nameidata between try_to_unlazy_next() failure and 874 * terminate_walk(). 875 */ 876 static bool try_to_unlazy_next(struct nameidata *nd, struct dentry *dentry) 877 { 878 int res; 879 BUG_ON(!(nd->flags & LOOKUP_RCU)); 880 881 if (unlikely(!legitimize_links(nd))) 882 goto out2; 883 res = __legitimize_mnt(nd->path.mnt, nd->m_seq); 884 if (unlikely(res)) { 885 if (res > 0) 886 goto out2; 887 goto out1; 888 } 889 if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref))) 890 goto out1; 891 892 /* 893 * We need to move both the parent and the dentry from the RCU domain 894 * to be properly refcounted. And the sequence number in the dentry 895 * validates *both* dentry counters, since we checked the sequence 896 * number of the parent after we got the child sequence number. So we 897 * know the parent must still be valid if the child sequence number is 898 */ 899 if (unlikely(!lockref_get_not_dead(&dentry->d_lockref))) 900 goto out; 901 if (read_seqcount_retry(&dentry->d_seq, nd->next_seq)) 902 goto out_dput; 903 /* 904 * Sequence counts matched. Now make sure that the root is 905 * still valid and get it if required. 906 */ 907 if (unlikely(!legitimize_root(nd))) 908 goto out_dput; 909 leave_rcu(nd); 910 return true; 911 912 out2: 913 nd->path.mnt = NULL; 914 out1: 915 nd->path.dentry = NULL; 916 out: 917 leave_rcu(nd); 918 return false; 919 out_dput: 920 leave_rcu(nd); 921 dput(dentry); 922 return false; 923 } 924 925 static inline int d_revalidate(struct inode *dir, const struct qstr *name, 926 struct dentry *dentry, unsigned int flags) 927 { 928 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) 929 return dentry->d_op->d_revalidate(dir, name, dentry, flags); 930 else 931 return 1; 932 } 933 934 /** 935 * complete_walk - successful completion of path walk 936 * @nd: pointer nameidata 937 * 938 * If we had been in RCU mode, drop out of it and legitimize nd->path. 939 * Revalidate the final result, unless we'd already done that during 940 * the path walk or the filesystem doesn't ask for it. Return 0 on 941 * success, -error on failure. In case of failure caller does not 942 * need to drop nd->path. 943 */ 944 static int complete_walk(struct nameidata *nd) 945 { 946 struct dentry *dentry = nd->path.dentry; 947 int status; 948 949 if (nd->flags & LOOKUP_RCU) { 950 /* 951 * We don't want to zero nd->root for scoped-lookups or 952 * externally-managed nd->root. 953 */ 954 if (!(nd->state & ND_ROOT_PRESET)) 955 if (!(nd->flags & LOOKUP_IS_SCOPED)) 956 nd->root.mnt = NULL; 957 nd->flags &= ~LOOKUP_CACHED; 958 if (!try_to_unlazy(nd)) 959 return -ECHILD; 960 } 961 962 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) { 963 /* 964 * While the guarantee of LOOKUP_IS_SCOPED is (roughly) "don't 965 * ever step outside the root during lookup" and should already 966 * be guaranteed by the rest of namei, we want to avoid a namei 967 * BUG resulting in userspace being given a path that was not 968 * scoped within the root at some point during the lookup. 969 * 970 * So, do a final sanity-check to make sure that in the 971 * worst-case scenario (a complete bypass of LOOKUP_IS_SCOPED) 972 * we won't silently return an fd completely outside of the 973 * requested root to userspace. 974 * 975 * Userspace could move the path outside the root after this 976 * check, but as discussed elsewhere this is not a concern (the 977 * resolved file was inside the root at some point). 978 */ 979 if (!path_is_under(&nd->path, &nd->root)) 980 return -EXDEV; 981 } 982 983 if (likely(!(nd->state & ND_JUMPED))) 984 return 0; 985 986 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE))) 987 return 0; 988 989 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags); 990 if (status > 0) 991 return 0; 992 993 if (!status) 994 status = -ESTALE; 995 996 return status; 997 } 998 999 static int set_root(struct nameidata *nd) 1000 { 1001 struct fs_struct *fs = current->fs; 1002 1003 /* 1004 * Jumping to the real root in a scoped-lookup is a BUG in namei, but we 1005 * still have to ensure it doesn't happen because it will cause a breakout 1006 * from the dirfd. 1007 */ 1008 if (WARN_ON(nd->flags & LOOKUP_IS_SCOPED)) 1009 return -ENOTRECOVERABLE; 1010 1011 if (nd->flags & LOOKUP_RCU) { 1012 unsigned seq; 1013 1014 do { 1015 seq = read_seqbegin(&fs->seq); 1016 nd->root = fs->root; 1017 nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq); 1018 } while (read_seqretry(&fs->seq, seq)); 1019 } else { 1020 get_fs_root(fs, &nd->root); 1021 nd->state |= ND_ROOT_GRABBED; 1022 } 1023 return 0; 1024 } 1025 1026 static int nd_jump_root(struct nameidata *nd) 1027 { 1028 if (unlikely(nd->flags & LOOKUP_BENEATH)) 1029 return -EXDEV; 1030 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) { 1031 /* Absolute path arguments to path_init() are allowed. */ 1032 if (nd->path.mnt != NULL && nd->path.mnt != nd->root.mnt) 1033 return -EXDEV; 1034 } 1035 if (!nd->root.mnt) { 1036 int error = set_root(nd); 1037 if (error) 1038 return error; 1039 } 1040 if (nd->flags & LOOKUP_RCU) { 1041 struct dentry *d; 1042 nd->path = nd->root; 1043 d = nd->path.dentry; 1044 nd->inode = d->d_inode; 1045 nd->seq = nd->root_seq; 1046 if (read_seqcount_retry(&d->d_seq, nd->seq)) 1047 return -ECHILD; 1048 } else { 1049 path_put(&nd->path); 1050 nd->path = nd->root; 1051 path_get(&nd->path); 1052 nd->inode = nd->path.dentry->d_inode; 1053 } 1054 nd->state |= ND_JUMPED; 1055 return 0; 1056 } 1057 1058 /* 1059 * Helper to directly jump to a known parsed path from ->get_link, 1060 * caller must have taken a reference to path beforehand. 1061 */ 1062 int nd_jump_link(const struct path *path) 1063 { 1064 int error = -ELOOP; 1065 struct nameidata *nd = current->nameidata; 1066 1067 if (unlikely(nd->flags & LOOKUP_NO_MAGICLINKS)) 1068 goto err; 1069 1070 error = -EXDEV; 1071 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) { 1072 if (nd->path.mnt != path->mnt) 1073 goto err; 1074 } 1075 /* Not currently safe for scoped-lookups. */ 1076 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) 1077 goto err; 1078 1079 path_put(&nd->path); 1080 nd->path = *path; 1081 nd->inode = nd->path.dentry->d_inode; 1082 nd->state |= ND_JUMPED; 1083 return 0; 1084 1085 err: 1086 path_put(path); 1087 return error; 1088 } 1089 1090 static inline void put_link(struct nameidata *nd) 1091 { 1092 struct saved *last = nd->stack + --nd->depth; 1093 do_delayed_call(&last->done); 1094 if (!(nd->flags & LOOKUP_RCU)) 1095 path_put(&last->link); 1096 } 1097 1098 static int sysctl_protected_symlinks __read_mostly; 1099 static int sysctl_protected_hardlinks __read_mostly; 1100 static int sysctl_protected_fifos __read_mostly; 1101 static int sysctl_protected_regular __read_mostly; 1102 1103 #ifdef CONFIG_SYSCTL 1104 static const struct ctl_table namei_sysctls[] = { 1105 { 1106 .procname = "protected_symlinks", 1107 .data = &sysctl_protected_symlinks, 1108 .maxlen = sizeof(int), 1109 .mode = 0644, 1110 .proc_handler = proc_dointvec_minmax, 1111 .extra1 = SYSCTL_ZERO, 1112 .extra2 = SYSCTL_ONE, 1113 }, 1114 { 1115 .procname = "protected_hardlinks", 1116 .data = &sysctl_protected_hardlinks, 1117 .maxlen = sizeof(int), 1118 .mode = 0644, 1119 .proc_handler = proc_dointvec_minmax, 1120 .extra1 = SYSCTL_ZERO, 1121 .extra2 = SYSCTL_ONE, 1122 }, 1123 { 1124 .procname = "protected_fifos", 1125 .data = &sysctl_protected_fifos, 1126 .maxlen = sizeof(int), 1127 .mode = 0644, 1128 .proc_handler = proc_dointvec_minmax, 1129 .extra1 = SYSCTL_ZERO, 1130 .extra2 = SYSCTL_TWO, 1131 }, 1132 { 1133 .procname = "protected_regular", 1134 .data = &sysctl_protected_regular, 1135 .maxlen = sizeof(int), 1136 .mode = 0644, 1137 .proc_handler = proc_dointvec_minmax, 1138 .extra1 = SYSCTL_ZERO, 1139 .extra2 = SYSCTL_TWO, 1140 }, 1141 }; 1142 1143 static int __init init_fs_namei_sysctls(void) 1144 { 1145 register_sysctl_init("fs", namei_sysctls); 1146 return 0; 1147 } 1148 fs_initcall(init_fs_namei_sysctls); 1149 1150 #endif /* CONFIG_SYSCTL */ 1151 1152 /** 1153 * may_follow_link - Check symlink following for unsafe situations 1154 * @nd: nameidata pathwalk data 1155 * @inode: Used for idmapping. 1156 * 1157 * In the case of the sysctl_protected_symlinks sysctl being enabled, 1158 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is 1159 * in a sticky world-writable directory. This is to protect privileged 1160 * processes from failing races against path names that may change out 1161 * from under them by way of other users creating malicious symlinks. 1162 * It will permit symlinks to be followed only when outside a sticky 1163 * world-writable directory, or when the uid of the symlink and follower 1164 * match, or when the directory owner matches the symlink's owner. 1165 * 1166 * Returns 0 if following the symlink is allowed, -ve on error. 1167 */ 1168 static inline int may_follow_link(struct nameidata *nd, const struct inode *inode) 1169 { 1170 struct mnt_idmap *idmap; 1171 vfsuid_t vfsuid; 1172 1173 if (!sysctl_protected_symlinks) 1174 return 0; 1175 1176 idmap = mnt_idmap(nd->path.mnt); 1177 vfsuid = i_uid_into_vfsuid(idmap, inode); 1178 /* Allowed if owner and follower match. */ 1179 if (vfsuid_eq_kuid(vfsuid, current_fsuid())) 1180 return 0; 1181 1182 /* Allowed if parent directory not sticky and world-writable. */ 1183 if ((nd->dir_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH)) 1184 return 0; 1185 1186 /* Allowed if parent directory and link owner match. */ 1187 if (vfsuid_valid(nd->dir_vfsuid) && vfsuid_eq(nd->dir_vfsuid, vfsuid)) 1188 return 0; 1189 1190 if (nd->flags & LOOKUP_RCU) 1191 return -ECHILD; 1192 1193 audit_inode(nd->name, nd->stack[0].link.dentry, 0); 1194 audit_log_path_denied(AUDIT_ANOM_LINK, "follow_link"); 1195 return -EACCES; 1196 } 1197 1198 /** 1199 * safe_hardlink_source - Check for safe hardlink conditions 1200 * @idmap: idmap of the mount the inode was found from 1201 * @inode: the source inode to hardlink from 1202 * 1203 * Return false if at least one of the following conditions: 1204 * - inode is not a regular file 1205 * - inode is setuid 1206 * - inode is setgid and group-exec 1207 * - access failure for read and write 1208 * 1209 * Otherwise returns true. 1210 */ 1211 static bool safe_hardlink_source(struct mnt_idmap *idmap, 1212 struct inode *inode) 1213 { 1214 umode_t mode = inode->i_mode; 1215 1216 /* Special files should not get pinned to the filesystem. */ 1217 if (!S_ISREG(mode)) 1218 return false; 1219 1220 /* Setuid files should not get pinned to the filesystem. */ 1221 if (mode & S_ISUID) 1222 return false; 1223 1224 /* Executable setgid files should not get pinned to the filesystem. */ 1225 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) 1226 return false; 1227 1228 /* Hardlinking to unreadable or unwritable sources is dangerous. */ 1229 if (inode_permission(idmap, inode, MAY_READ | MAY_WRITE)) 1230 return false; 1231 1232 return true; 1233 } 1234 1235 /** 1236 * may_linkat - Check permissions for creating a hardlink 1237 * @idmap: idmap of the mount the inode was found from 1238 * @link: the source to hardlink from 1239 * 1240 * Block hardlink when all of: 1241 * - sysctl_protected_hardlinks enabled 1242 * - fsuid does not match inode 1243 * - hardlink source is unsafe (see safe_hardlink_source() above) 1244 * - not CAP_FOWNER in a namespace with the inode owner uid mapped 1245 * 1246 * If the inode has been found through an idmapped mount the idmap of 1247 * the vfsmount must be passed through @idmap. This function will then take 1248 * care to map the inode according to @idmap before checking permissions. 1249 * On non-idmapped mounts or if permission checking is to be performed on the 1250 * raw inode simply pass @nop_mnt_idmap. 1251 * 1252 * Returns 0 if successful, -ve on error. 1253 */ 1254 int may_linkat(struct mnt_idmap *idmap, const struct path *link) 1255 { 1256 struct inode *inode = link->dentry->d_inode; 1257 1258 /* Inode writeback is not safe when the uid or gid are invalid. */ 1259 if (!vfsuid_valid(i_uid_into_vfsuid(idmap, inode)) || 1260 !vfsgid_valid(i_gid_into_vfsgid(idmap, inode))) 1261 return -EOVERFLOW; 1262 1263 if (!sysctl_protected_hardlinks) 1264 return 0; 1265 1266 /* Source inode owner (or CAP_FOWNER) can hardlink all they like, 1267 * otherwise, it must be a safe source. 1268 */ 1269 if (safe_hardlink_source(idmap, inode) || 1270 inode_owner_or_capable(idmap, inode)) 1271 return 0; 1272 1273 audit_log_path_denied(AUDIT_ANOM_LINK, "linkat"); 1274 return -EPERM; 1275 } 1276 1277 /** 1278 * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory 1279 * should be allowed, or not, on files that already 1280 * exist. 1281 * @idmap: idmap of the mount the inode was found from 1282 * @nd: nameidata pathwalk data 1283 * @inode: the inode of the file to open 1284 * 1285 * Block an O_CREAT open of a FIFO (or a regular file) when: 1286 * - sysctl_protected_fifos (or sysctl_protected_regular) is enabled 1287 * - the file already exists 1288 * - we are in a sticky directory 1289 * - we don't own the file 1290 * - the owner of the directory doesn't own the file 1291 * - the directory is world writable 1292 * If the sysctl_protected_fifos (or sysctl_protected_regular) is set to 2 1293 * the directory doesn't have to be world writable: being group writable will 1294 * be enough. 1295 * 1296 * If the inode has been found through an idmapped mount the idmap of 1297 * the vfsmount must be passed through @idmap. This function will then take 1298 * care to map the inode according to @idmap before checking permissions. 1299 * On non-idmapped mounts or if permission checking is to be performed on the 1300 * raw inode simply pass @nop_mnt_idmap. 1301 * 1302 * Returns 0 if the open is allowed, -ve on error. 1303 */ 1304 static int may_create_in_sticky(struct mnt_idmap *idmap, struct nameidata *nd, 1305 struct inode *const inode) 1306 { 1307 umode_t dir_mode = nd->dir_mode; 1308 vfsuid_t dir_vfsuid = nd->dir_vfsuid, i_vfsuid; 1309 1310 if (likely(!(dir_mode & S_ISVTX))) 1311 return 0; 1312 1313 if (S_ISREG(inode->i_mode) && !sysctl_protected_regular) 1314 return 0; 1315 1316 if (S_ISFIFO(inode->i_mode) && !sysctl_protected_fifos) 1317 return 0; 1318 1319 i_vfsuid = i_uid_into_vfsuid(idmap, inode); 1320 1321 if (vfsuid_eq(i_vfsuid, dir_vfsuid)) 1322 return 0; 1323 1324 if (vfsuid_eq_kuid(i_vfsuid, current_fsuid())) 1325 return 0; 1326 1327 if (likely(dir_mode & 0002)) { 1328 audit_log_path_denied(AUDIT_ANOM_CREAT, "sticky_create"); 1329 return -EACCES; 1330 } 1331 1332 if (dir_mode & 0020) { 1333 if (sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) { 1334 audit_log_path_denied(AUDIT_ANOM_CREAT, 1335 "sticky_create_fifo"); 1336 return -EACCES; 1337 } 1338 1339 if (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode)) { 1340 audit_log_path_denied(AUDIT_ANOM_CREAT, 1341 "sticky_create_regular"); 1342 return -EACCES; 1343 } 1344 } 1345 1346 return 0; 1347 } 1348 1349 /* 1350 * follow_up - Find the mountpoint of path's vfsmount 1351 * 1352 * Given a path, find the mountpoint of its source file system. 1353 * Replace @path with the path of the mountpoint in the parent mount. 1354 * Up is towards /. 1355 * 1356 * Return 1 if we went up a level and 0 if we were already at the 1357 * root. 1358 */ 1359 int follow_up(struct path *path) 1360 { 1361 struct mount *mnt = real_mount(path->mnt); 1362 struct mount *parent; 1363 struct dentry *mountpoint; 1364 1365 read_seqlock_excl(&mount_lock); 1366 parent = mnt->mnt_parent; 1367 if (parent == mnt) { 1368 read_sequnlock_excl(&mount_lock); 1369 return 0; 1370 } 1371 mntget(&parent->mnt); 1372 mountpoint = dget(mnt->mnt_mountpoint); 1373 read_sequnlock_excl(&mount_lock); 1374 dput(path->dentry); 1375 path->dentry = mountpoint; 1376 mntput(path->mnt); 1377 path->mnt = &parent->mnt; 1378 return 1; 1379 } 1380 EXPORT_SYMBOL(follow_up); 1381 1382 static bool choose_mountpoint_rcu(struct mount *m, const struct path *root, 1383 struct path *path, unsigned *seqp) 1384 { 1385 while (mnt_has_parent(m)) { 1386 struct dentry *mountpoint = m->mnt_mountpoint; 1387 1388 m = m->mnt_parent; 1389 if (unlikely(root->dentry == mountpoint && 1390 root->mnt == &m->mnt)) 1391 break; 1392 if (mountpoint != m->mnt.mnt_root) { 1393 path->mnt = &m->mnt; 1394 path->dentry = mountpoint; 1395 *seqp = read_seqcount_begin(&mountpoint->d_seq); 1396 return true; 1397 } 1398 } 1399 return false; 1400 } 1401 1402 static bool choose_mountpoint(struct mount *m, const struct path *root, 1403 struct path *path) 1404 { 1405 bool found; 1406 1407 rcu_read_lock(); 1408 while (1) { 1409 unsigned seq, mseq = read_seqbegin(&mount_lock); 1410 1411 found = choose_mountpoint_rcu(m, root, path, &seq); 1412 if (unlikely(!found)) { 1413 if (!read_seqretry(&mount_lock, mseq)) 1414 break; 1415 } else { 1416 if (likely(__legitimize_path(path, seq, mseq))) 1417 break; 1418 rcu_read_unlock(); 1419 path_put(path); 1420 rcu_read_lock(); 1421 } 1422 } 1423 rcu_read_unlock(); 1424 return found; 1425 } 1426 1427 /* 1428 * Perform an automount 1429 * - return -EISDIR to tell follow_managed() to stop and return the path we 1430 * were called with. 1431 */ 1432 static int follow_automount(struct path *path, int *count, unsigned lookup_flags) 1433 { 1434 struct dentry *dentry = path->dentry; 1435 1436 /* We don't want to mount if someone's just doing a stat - 1437 * unless they're stat'ing a directory and appended a '/' to 1438 * the name. 1439 * 1440 * We do, however, want to mount if someone wants to open or 1441 * create a file of any type under the mountpoint, wants to 1442 * traverse through the mountpoint or wants to open the 1443 * mounted directory. Also, autofs may mark negative dentries 1444 * as being automount points. These will need the attentions 1445 * of the daemon to instantiate them before they can be used. 1446 */ 1447 if (!(lookup_flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | 1448 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) && 1449 dentry->d_inode) 1450 return -EISDIR; 1451 1452 /* No need to trigger automounts if mountpoint crossing is disabled. */ 1453 if (lookup_flags & LOOKUP_NO_XDEV) 1454 return -EXDEV; 1455 1456 if (count && (*count)++ >= MAXSYMLINKS) 1457 return -ELOOP; 1458 1459 return finish_automount(dentry->d_op->d_automount(path), path); 1460 } 1461 1462 /* 1463 * mount traversal - out-of-line part. One note on ->d_flags accesses - 1464 * dentries are pinned but not locked here, so negative dentry can go 1465 * positive right under us. Use of smp_load_acquire() provides a barrier 1466 * sufficient for ->d_inode and ->d_flags consistency. 1467 */ 1468 static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped, 1469 int *count, unsigned lookup_flags) 1470 { 1471 struct vfsmount *mnt = path->mnt; 1472 bool need_mntput = false; 1473 int ret = 0; 1474 1475 while (flags & DCACHE_MANAGED_DENTRY) { 1476 /* Allow the filesystem to manage the transit without i_rwsem 1477 * being held. */ 1478 if (flags & DCACHE_MANAGE_TRANSIT) { 1479 if (lookup_flags & LOOKUP_NO_XDEV) { 1480 ret = -EXDEV; 1481 break; 1482 } 1483 ret = path->dentry->d_op->d_manage(path, false); 1484 flags = smp_load_acquire(&path->dentry->d_flags); 1485 if (ret < 0) 1486 break; 1487 } 1488 1489 if (flags & DCACHE_MOUNTED) { // something's mounted on it.. 1490 struct vfsmount *mounted = lookup_mnt(path); 1491 if (mounted) { // ... in our namespace 1492 dput(path->dentry); 1493 if (need_mntput) 1494 mntput(path->mnt); 1495 path->mnt = mounted; 1496 path->dentry = dget(mounted->mnt_root); 1497 // here we know it's positive 1498 flags = path->dentry->d_flags; 1499 need_mntput = true; 1500 if (unlikely(lookup_flags & LOOKUP_NO_XDEV)) { 1501 ret = -EXDEV; 1502 break; 1503 } 1504 continue; 1505 } 1506 } 1507 1508 if (!(flags & DCACHE_NEED_AUTOMOUNT)) 1509 break; 1510 1511 // uncovered automount point 1512 ret = follow_automount(path, count, lookup_flags); 1513 flags = smp_load_acquire(&path->dentry->d_flags); 1514 if (ret < 0) 1515 break; 1516 } 1517 1518 if (ret == -EISDIR) 1519 ret = 0; 1520 // possible if you race with several mount --move 1521 if (need_mntput && path->mnt == mnt) 1522 mntput(path->mnt); 1523 if (!ret && unlikely(d_flags_negative(flags))) 1524 ret = -ENOENT; 1525 *jumped = need_mntput; 1526 return ret; 1527 } 1528 1529 static inline int traverse_mounts(struct path *path, bool *jumped, 1530 int *count, unsigned lookup_flags) 1531 { 1532 unsigned flags = smp_load_acquire(&path->dentry->d_flags); 1533 1534 /* fastpath */ 1535 if (likely(!(flags & DCACHE_MANAGED_DENTRY))) { 1536 *jumped = false; 1537 if (unlikely(d_flags_negative(flags))) 1538 return -ENOENT; 1539 return 0; 1540 } 1541 return __traverse_mounts(path, flags, jumped, count, lookup_flags); 1542 } 1543 1544 int follow_down_one(struct path *path) 1545 { 1546 struct vfsmount *mounted; 1547 1548 mounted = lookup_mnt(path); 1549 if (mounted) { 1550 dput(path->dentry); 1551 mntput(path->mnt); 1552 path->mnt = mounted; 1553 path->dentry = dget(mounted->mnt_root); 1554 return 1; 1555 } 1556 return 0; 1557 } 1558 EXPORT_SYMBOL(follow_down_one); 1559 1560 /* 1561 * Follow down to the covering mount currently visible to userspace. At each 1562 * point, the filesystem owning that dentry may be queried as to whether the 1563 * caller is permitted to proceed or not. 1564 */ 1565 int follow_down(struct path *path, unsigned int flags) 1566 { 1567 struct vfsmount *mnt = path->mnt; 1568 bool jumped; 1569 int ret = traverse_mounts(path, &jumped, NULL, flags); 1570 1571 if (path->mnt != mnt) 1572 mntput(mnt); 1573 return ret; 1574 } 1575 EXPORT_SYMBOL(follow_down); 1576 1577 /* 1578 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if 1579 * we meet a managed dentry that would need blocking. 1580 */ 1581 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path) 1582 { 1583 struct dentry *dentry = path->dentry; 1584 unsigned int flags = dentry->d_flags; 1585 1586 if (likely(!(flags & DCACHE_MANAGED_DENTRY))) 1587 return true; 1588 1589 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) 1590 return false; 1591 1592 for (;;) { 1593 /* 1594 * Don't forget we might have a non-mountpoint managed dentry 1595 * that wants to block transit. 1596 */ 1597 if (unlikely(flags & DCACHE_MANAGE_TRANSIT)) { 1598 int res = dentry->d_op->d_manage(path, true); 1599 if (res) 1600 return res == -EISDIR; 1601 flags = dentry->d_flags; 1602 } 1603 1604 if (flags & DCACHE_MOUNTED) { 1605 struct mount *mounted = __lookup_mnt(path->mnt, dentry); 1606 if (mounted) { 1607 path->mnt = &mounted->mnt; 1608 dentry = path->dentry = mounted->mnt.mnt_root; 1609 nd->state |= ND_JUMPED; 1610 nd->next_seq = read_seqcount_begin(&dentry->d_seq); 1611 flags = dentry->d_flags; 1612 // makes sure that non-RCU pathwalk could reach 1613 // this state. 1614 if (read_seqretry(&mount_lock, nd->m_seq)) 1615 return false; 1616 continue; 1617 } 1618 if (read_seqretry(&mount_lock, nd->m_seq)) 1619 return false; 1620 } 1621 return !(flags & DCACHE_NEED_AUTOMOUNT); 1622 } 1623 } 1624 1625 static inline int handle_mounts(struct nameidata *nd, struct dentry *dentry, 1626 struct path *path) 1627 { 1628 bool jumped; 1629 int ret; 1630 1631 path->mnt = nd->path.mnt; 1632 path->dentry = dentry; 1633 if (nd->flags & LOOKUP_RCU) { 1634 unsigned int seq = nd->next_seq; 1635 if (likely(__follow_mount_rcu(nd, path))) 1636 return 0; 1637 // *path and nd->next_seq might've been clobbered 1638 path->mnt = nd->path.mnt; 1639 path->dentry = dentry; 1640 nd->next_seq = seq; 1641 if (!try_to_unlazy_next(nd, dentry)) 1642 return -ECHILD; 1643 } 1644 ret = traverse_mounts(path, &jumped, &nd->total_link_count, nd->flags); 1645 if (jumped) 1646 nd->state |= ND_JUMPED; 1647 if (unlikely(ret)) { 1648 dput(path->dentry); 1649 if (path->mnt != nd->path.mnt) 1650 mntput(path->mnt); 1651 } 1652 return ret; 1653 } 1654 1655 /* 1656 * This looks up the name in dcache and possibly revalidates the found dentry. 1657 * NULL is returned if the dentry does not exist in the cache. 1658 */ 1659 static struct dentry *lookup_dcache(const struct qstr *name, 1660 struct dentry *dir, 1661 unsigned int flags) 1662 { 1663 struct dentry *dentry = d_lookup(dir, name); 1664 if (dentry) { 1665 int error = d_revalidate(dir->d_inode, name, dentry, flags); 1666 if (unlikely(error <= 0)) { 1667 if (!error) 1668 d_invalidate(dentry); 1669 dput(dentry); 1670 return ERR_PTR(error); 1671 } 1672 } 1673 return dentry; 1674 } 1675 1676 /* 1677 * Parent directory has inode locked exclusive. This is one 1678 * and only case when ->lookup() gets called on non in-lookup 1679 * dentries - as the matter of fact, this only gets called 1680 * when directory is guaranteed to have no in-lookup children 1681 * at all. 1682 * Will return -ENOENT if name isn't found and LOOKUP_CREATE wasn't passed. 1683 * Will return -EEXIST if name is found and LOOKUP_EXCL was passed. 1684 */ 1685 struct dentry *lookup_one_qstr_excl(const struct qstr *name, 1686 struct dentry *base, unsigned int flags) 1687 { 1688 struct dentry *dentry; 1689 struct dentry *old; 1690 struct inode *dir; 1691 1692 dentry = lookup_dcache(name, base, flags); 1693 if (dentry) 1694 goto found; 1695 1696 /* Don't create child dentry for a dead directory. */ 1697 dir = base->d_inode; 1698 if (unlikely(IS_DEADDIR(dir))) 1699 return ERR_PTR(-ENOENT); 1700 1701 dentry = d_alloc(base, name); 1702 if (unlikely(!dentry)) 1703 return ERR_PTR(-ENOMEM); 1704 1705 old = dir->i_op->lookup(dir, dentry, flags); 1706 if (unlikely(old)) { 1707 dput(dentry); 1708 dentry = old; 1709 } 1710 found: 1711 if (IS_ERR(dentry)) 1712 return dentry; 1713 if (d_is_negative(dentry) && !(flags & LOOKUP_CREATE)) { 1714 dput(dentry); 1715 return ERR_PTR(-ENOENT); 1716 } 1717 if (d_is_positive(dentry) && (flags & LOOKUP_EXCL)) { 1718 dput(dentry); 1719 return ERR_PTR(-EEXIST); 1720 } 1721 return dentry; 1722 } 1723 EXPORT_SYMBOL(lookup_one_qstr_excl); 1724 1725 /** 1726 * lookup_fast - do fast lockless (but racy) lookup of a dentry 1727 * @nd: current nameidata 1728 * 1729 * Do a fast, but racy lookup in the dcache for the given dentry, and 1730 * revalidate it. Returns a valid dentry pointer or NULL if one wasn't 1731 * found. On error, an ERR_PTR will be returned. 1732 * 1733 * If this function returns a valid dentry and the walk is no longer 1734 * lazy, the dentry will carry a reference that must later be put. If 1735 * RCU mode is still in force, then this is not the case and the dentry 1736 * must be legitimized before use. If this returns NULL, then the walk 1737 * will no longer be in RCU mode. 1738 */ 1739 static struct dentry *lookup_fast(struct nameidata *nd) 1740 { 1741 struct dentry *dentry, *parent = nd->path.dentry; 1742 int status = 1; 1743 1744 /* 1745 * Rename seqlock is not required here because in the off chance 1746 * of a false negative due to a concurrent rename, the caller is 1747 * going to fall back to non-racy lookup. 1748 */ 1749 if (nd->flags & LOOKUP_RCU) { 1750 dentry = __d_lookup_rcu(parent, &nd->last, &nd->next_seq); 1751 if (unlikely(!dentry)) { 1752 if (!try_to_unlazy(nd)) 1753 return ERR_PTR(-ECHILD); 1754 return NULL; 1755 } 1756 1757 /* 1758 * This sequence count validates that the parent had no 1759 * changes while we did the lookup of the dentry above. 1760 */ 1761 if (read_seqcount_retry(&parent->d_seq, nd->seq)) 1762 return ERR_PTR(-ECHILD); 1763 1764 status = d_revalidate(nd->inode, &nd->last, dentry, nd->flags); 1765 if (likely(status > 0)) 1766 return dentry; 1767 if (!try_to_unlazy_next(nd, dentry)) 1768 return ERR_PTR(-ECHILD); 1769 if (status == -ECHILD) 1770 /* we'd been told to redo it in non-rcu mode */ 1771 status = d_revalidate(nd->inode, &nd->last, 1772 dentry, nd->flags); 1773 } else { 1774 dentry = __d_lookup(parent, &nd->last); 1775 if (unlikely(!dentry)) 1776 return NULL; 1777 status = d_revalidate(nd->inode, &nd->last, dentry, nd->flags); 1778 } 1779 if (unlikely(status <= 0)) { 1780 if (!status) 1781 d_invalidate(dentry); 1782 dput(dentry); 1783 return ERR_PTR(status); 1784 } 1785 return dentry; 1786 } 1787 1788 /* Fast lookup failed, do it the slow way */ 1789 static struct dentry *__lookup_slow(const struct qstr *name, 1790 struct dentry *dir, 1791 unsigned int flags) 1792 { 1793 struct dentry *dentry, *old; 1794 struct inode *inode = dir->d_inode; 1795 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq); 1796 1797 /* Don't go there if it's already dead */ 1798 if (unlikely(IS_DEADDIR(inode))) 1799 return ERR_PTR(-ENOENT); 1800 again: 1801 dentry = d_alloc_parallel(dir, name, &wq); 1802 if (IS_ERR(dentry)) 1803 return dentry; 1804 if (unlikely(!d_in_lookup(dentry))) { 1805 int error = d_revalidate(inode, name, dentry, flags); 1806 if (unlikely(error <= 0)) { 1807 if (!error) { 1808 d_invalidate(dentry); 1809 dput(dentry); 1810 goto again; 1811 } 1812 dput(dentry); 1813 dentry = ERR_PTR(error); 1814 } 1815 } else { 1816 old = inode->i_op->lookup(inode, dentry, flags); 1817 d_lookup_done(dentry); 1818 if (unlikely(old)) { 1819 dput(dentry); 1820 dentry = old; 1821 } 1822 } 1823 return dentry; 1824 } 1825 1826 static struct dentry *lookup_slow(const struct qstr *name, 1827 struct dentry *dir, 1828 unsigned int flags) 1829 { 1830 struct inode *inode = dir->d_inode; 1831 struct dentry *res; 1832 inode_lock_shared(inode); 1833 res = __lookup_slow(name, dir, flags); 1834 inode_unlock_shared(inode); 1835 return res; 1836 } 1837 1838 static struct dentry *lookup_slow_killable(const struct qstr *name, 1839 struct dentry *dir, 1840 unsigned int flags) 1841 { 1842 struct inode *inode = dir->d_inode; 1843 struct dentry *res; 1844 1845 if (inode_lock_shared_killable(inode)) 1846 return ERR_PTR(-EINTR); 1847 res = __lookup_slow(name, dir, flags); 1848 inode_unlock_shared(inode); 1849 return res; 1850 } 1851 1852 static inline int may_lookup(struct mnt_idmap *idmap, 1853 struct nameidata *restrict nd) 1854 { 1855 int err, mask; 1856 1857 mask = nd->flags & LOOKUP_RCU ? MAY_NOT_BLOCK : 0; 1858 err = inode_permission(idmap, nd->inode, mask | MAY_EXEC); 1859 if (likely(!err)) 1860 return 0; 1861 1862 // If we failed, and we weren't in LOOKUP_RCU, it's final 1863 if (!(nd->flags & LOOKUP_RCU)) 1864 return err; 1865 1866 // Drop out of RCU mode to make sure it wasn't transient 1867 if (!try_to_unlazy(nd)) 1868 return -ECHILD; // redo it all non-lazy 1869 1870 if (err != -ECHILD) // hard error 1871 return err; 1872 1873 return inode_permission(idmap, nd->inode, MAY_EXEC); 1874 } 1875 1876 static int reserve_stack(struct nameidata *nd, struct path *link) 1877 { 1878 if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) 1879 return -ELOOP; 1880 1881 if (likely(nd->depth != EMBEDDED_LEVELS)) 1882 return 0; 1883 if (likely(nd->stack != nd->internal)) 1884 return 0; 1885 if (likely(nd_alloc_stack(nd))) 1886 return 0; 1887 1888 if (nd->flags & LOOKUP_RCU) { 1889 // we need to grab link before we do unlazy. And we can't skip 1890 // unlazy even if we fail to grab the link - cleanup needs it 1891 bool grabbed_link = legitimize_path(nd, link, nd->next_seq); 1892 1893 if (!try_to_unlazy(nd) || !grabbed_link) 1894 return -ECHILD; 1895 1896 if (nd_alloc_stack(nd)) 1897 return 0; 1898 } 1899 return -ENOMEM; 1900 } 1901 1902 enum {WALK_TRAILING = 1, WALK_MORE = 2, WALK_NOFOLLOW = 4}; 1903 1904 static const char *pick_link(struct nameidata *nd, struct path *link, 1905 struct inode *inode, int flags) 1906 { 1907 struct saved *last; 1908 const char *res; 1909 int error = reserve_stack(nd, link); 1910 1911 if (unlikely(error)) { 1912 if (!(nd->flags & LOOKUP_RCU)) 1913 path_put(link); 1914 return ERR_PTR(error); 1915 } 1916 last = nd->stack + nd->depth++; 1917 last->link = *link; 1918 clear_delayed_call(&last->done); 1919 last->seq = nd->next_seq; 1920 1921 if (flags & WALK_TRAILING) { 1922 error = may_follow_link(nd, inode); 1923 if (unlikely(error)) 1924 return ERR_PTR(error); 1925 } 1926 1927 if (unlikely(nd->flags & LOOKUP_NO_SYMLINKS) || 1928 unlikely(link->mnt->mnt_flags & MNT_NOSYMFOLLOW)) 1929 return ERR_PTR(-ELOOP); 1930 1931 if (unlikely(atime_needs_update(&last->link, inode))) { 1932 if (nd->flags & LOOKUP_RCU) { 1933 if (!try_to_unlazy(nd)) 1934 return ERR_PTR(-ECHILD); 1935 } 1936 touch_atime(&last->link); 1937 cond_resched(); 1938 } 1939 1940 error = security_inode_follow_link(link->dentry, inode, 1941 nd->flags & LOOKUP_RCU); 1942 if (unlikely(error)) 1943 return ERR_PTR(error); 1944 1945 res = READ_ONCE(inode->i_link); 1946 if (!res) { 1947 const char * (*get)(struct dentry *, struct inode *, 1948 struct delayed_call *); 1949 get = inode->i_op->get_link; 1950 if (nd->flags & LOOKUP_RCU) { 1951 res = get(NULL, inode, &last->done); 1952 if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd)) 1953 res = get(link->dentry, inode, &last->done); 1954 } else { 1955 res = get(link->dentry, inode, &last->done); 1956 } 1957 if (!res) 1958 goto all_done; 1959 if (IS_ERR(res)) 1960 return res; 1961 } 1962 if (*res == '/') { 1963 error = nd_jump_root(nd); 1964 if (unlikely(error)) 1965 return ERR_PTR(error); 1966 while (unlikely(*++res == '/')) 1967 ; 1968 } 1969 if (*res) 1970 return res; 1971 all_done: // pure jump 1972 put_link(nd); 1973 return NULL; 1974 } 1975 1976 /* 1977 * Do we need to follow links? We _really_ want to be able 1978 * to do this check without having to look at inode->i_op, 1979 * so we keep a cache of "no, this doesn't need follow_link" 1980 * for the common case. 1981 * 1982 * NOTE: dentry must be what nd->next_seq had been sampled from. 1983 */ 1984 static const char *step_into(struct nameidata *nd, int flags, 1985 struct dentry *dentry) 1986 { 1987 struct path path; 1988 struct inode *inode; 1989 int err = handle_mounts(nd, dentry, &path); 1990 1991 if (err < 0) 1992 return ERR_PTR(err); 1993 inode = path.dentry->d_inode; 1994 if (likely(!d_is_symlink(path.dentry)) || 1995 ((flags & WALK_TRAILING) && !(nd->flags & LOOKUP_FOLLOW)) || 1996 (flags & WALK_NOFOLLOW)) { 1997 /* not a symlink or should not follow */ 1998 if (nd->flags & LOOKUP_RCU) { 1999 if (read_seqcount_retry(&path.dentry->d_seq, nd->next_seq)) 2000 return ERR_PTR(-ECHILD); 2001 if (unlikely(!inode)) 2002 return ERR_PTR(-ENOENT); 2003 } else { 2004 dput(nd->path.dentry); 2005 if (nd->path.mnt != path.mnt) 2006 mntput(nd->path.mnt); 2007 } 2008 nd->path = path; 2009 nd->inode = inode; 2010 nd->seq = nd->next_seq; 2011 return NULL; 2012 } 2013 if (nd->flags & LOOKUP_RCU) { 2014 /* make sure that d_is_symlink above matches inode */ 2015 if (read_seqcount_retry(&path.dentry->d_seq, nd->next_seq)) 2016 return ERR_PTR(-ECHILD); 2017 } else { 2018 if (path.mnt == nd->path.mnt) 2019 mntget(path.mnt); 2020 } 2021 return pick_link(nd, &path, inode, flags); 2022 } 2023 2024 static struct dentry *follow_dotdot_rcu(struct nameidata *nd) 2025 { 2026 struct dentry *parent, *old; 2027 2028 if (path_equal(&nd->path, &nd->root)) 2029 goto in_root; 2030 if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) { 2031 struct path path; 2032 unsigned seq; 2033 if (!choose_mountpoint_rcu(real_mount(nd->path.mnt), 2034 &nd->root, &path, &seq)) 2035 goto in_root; 2036 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) 2037 return ERR_PTR(-ECHILD); 2038 nd->path = path; 2039 nd->inode = path.dentry->d_inode; 2040 nd->seq = seq; 2041 // makes sure that non-RCU pathwalk could reach this state 2042 if (read_seqretry(&mount_lock, nd->m_seq)) 2043 return ERR_PTR(-ECHILD); 2044 /* we know that mountpoint was pinned */ 2045 } 2046 old = nd->path.dentry; 2047 parent = old->d_parent; 2048 nd->next_seq = read_seqcount_begin(&parent->d_seq); 2049 // makes sure that non-RCU pathwalk could reach this state 2050 if (read_seqcount_retry(&old->d_seq, nd->seq)) 2051 return ERR_PTR(-ECHILD); 2052 if (unlikely(!path_connected(nd->path.mnt, parent))) 2053 return ERR_PTR(-ECHILD); 2054 return parent; 2055 in_root: 2056 if (read_seqretry(&mount_lock, nd->m_seq)) 2057 return ERR_PTR(-ECHILD); 2058 if (unlikely(nd->flags & LOOKUP_BENEATH)) 2059 return ERR_PTR(-ECHILD); 2060 nd->next_seq = nd->seq; 2061 return nd->path.dentry; 2062 } 2063 2064 static struct dentry *follow_dotdot(struct nameidata *nd) 2065 { 2066 struct dentry *parent; 2067 2068 if (path_equal(&nd->path, &nd->root)) 2069 goto in_root; 2070 if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) { 2071 struct path path; 2072 2073 if (!choose_mountpoint(real_mount(nd->path.mnt), 2074 &nd->root, &path)) 2075 goto in_root; 2076 path_put(&nd->path); 2077 nd->path = path; 2078 nd->inode = path.dentry->d_inode; 2079 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) 2080 return ERR_PTR(-EXDEV); 2081 } 2082 /* rare case of legitimate dget_parent()... */ 2083 parent = dget_parent(nd->path.dentry); 2084 if (unlikely(!path_connected(nd->path.mnt, parent))) { 2085 dput(parent); 2086 return ERR_PTR(-ENOENT); 2087 } 2088 return parent; 2089 2090 in_root: 2091 if (unlikely(nd->flags & LOOKUP_BENEATH)) 2092 return ERR_PTR(-EXDEV); 2093 return dget(nd->path.dentry); 2094 } 2095 2096 static const char *handle_dots(struct nameidata *nd, int type) 2097 { 2098 if (type == LAST_DOTDOT) { 2099 const char *error = NULL; 2100 struct dentry *parent; 2101 2102 if (!nd->root.mnt) { 2103 error = ERR_PTR(set_root(nd)); 2104 if (error) 2105 return error; 2106 } 2107 if (nd->flags & LOOKUP_RCU) 2108 parent = follow_dotdot_rcu(nd); 2109 else 2110 parent = follow_dotdot(nd); 2111 if (IS_ERR(parent)) 2112 return ERR_CAST(parent); 2113 error = step_into(nd, WALK_NOFOLLOW, parent); 2114 if (unlikely(error)) 2115 return error; 2116 2117 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) { 2118 /* 2119 * If there was a racing rename or mount along our 2120 * path, then we can't be sure that ".." hasn't jumped 2121 * above nd->root (and so userspace should retry or use 2122 * some fallback). 2123 */ 2124 smp_rmb(); 2125 if (__read_seqcount_retry(&mount_lock.seqcount, nd->m_seq)) 2126 return ERR_PTR(-EAGAIN); 2127 if (__read_seqcount_retry(&rename_lock.seqcount, nd->r_seq)) 2128 return ERR_PTR(-EAGAIN); 2129 } 2130 } 2131 return NULL; 2132 } 2133 2134 static const char *walk_component(struct nameidata *nd, int flags) 2135 { 2136 struct dentry *dentry; 2137 /* 2138 * "." and ".." are special - ".." especially so because it has 2139 * to be able to know about the current root directory and 2140 * parent relationships. 2141 */ 2142 if (unlikely(nd->last_type != LAST_NORM)) { 2143 if (!(flags & WALK_MORE) && nd->depth) 2144 put_link(nd); 2145 return handle_dots(nd, nd->last_type); 2146 } 2147 dentry = lookup_fast(nd); 2148 if (IS_ERR(dentry)) 2149 return ERR_CAST(dentry); 2150 if (unlikely(!dentry)) { 2151 dentry = lookup_slow(&nd->last, nd->path.dentry, nd->flags); 2152 if (IS_ERR(dentry)) 2153 return ERR_CAST(dentry); 2154 } 2155 if (!(flags & WALK_MORE) && nd->depth) 2156 put_link(nd); 2157 return step_into(nd, flags, dentry); 2158 } 2159 2160 /* 2161 * We can do the critical dentry name comparison and hashing 2162 * operations one word at a time, but we are limited to: 2163 * 2164 * - Architectures with fast unaligned word accesses. We could 2165 * do a "get_unaligned()" if this helps and is sufficiently 2166 * fast. 2167 * 2168 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we 2169 * do not trap on the (extremely unlikely) case of a page 2170 * crossing operation. 2171 * 2172 * - Furthermore, we need an efficient 64-bit compile for the 2173 * 64-bit case in order to generate the "number of bytes in 2174 * the final mask". Again, that could be replaced with a 2175 * efficient population count instruction or similar. 2176 */ 2177 #ifdef CONFIG_DCACHE_WORD_ACCESS 2178 2179 #include <asm/word-at-a-time.h> 2180 2181 #ifdef HASH_MIX 2182 2183 /* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */ 2184 2185 #elif defined(CONFIG_64BIT) 2186 /* 2187 * Register pressure in the mixing function is an issue, particularly 2188 * on 32-bit x86, but almost any function requires one state value and 2189 * one temporary. Instead, use a function designed for two state values 2190 * and no temporaries. 2191 * 2192 * This function cannot create a collision in only two iterations, so 2193 * we have two iterations to achieve avalanche. In those two iterations, 2194 * we have six layers of mixing, which is enough to spread one bit's 2195 * influence out to 2^6 = 64 state bits. 2196 * 2197 * Rotate constants are scored by considering either 64 one-bit input 2198 * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the 2199 * probability of that delta causing a change to each of the 128 output 2200 * bits, using a sample of random initial states. 2201 * 2202 * The Shannon entropy of the computed probabilities is then summed 2203 * to produce a score. Ideally, any input change has a 50% chance of 2204 * toggling any given output bit. 2205 * 2206 * Mixing scores (in bits) for (12,45): 2207 * Input delta: 1-bit 2-bit 2208 * 1 round: 713.3 42542.6 2209 * 2 rounds: 2753.7 140389.8 2210 * 3 rounds: 5954.1 233458.2 2211 * 4 rounds: 7862.6 256672.2 2212 * Perfect: 8192 258048 2213 * (64*128) (64*63/2 * 128) 2214 */ 2215 #define HASH_MIX(x, y, a) \ 2216 ( x ^= (a), \ 2217 y ^= x, x = rol64(x,12),\ 2218 x += y, y = rol64(y,45),\ 2219 y *= 9 ) 2220 2221 /* 2222 * Fold two longs into one 32-bit hash value. This must be fast, but 2223 * latency isn't quite as critical, as there is a fair bit of additional 2224 * work done before the hash value is used. 2225 */ 2226 static inline unsigned int fold_hash(unsigned long x, unsigned long y) 2227 { 2228 y ^= x * GOLDEN_RATIO_64; 2229 y *= GOLDEN_RATIO_64; 2230 return y >> 32; 2231 } 2232 2233 #else /* 32-bit case */ 2234 2235 /* 2236 * Mixing scores (in bits) for (7,20): 2237 * Input delta: 1-bit 2-bit 2238 * 1 round: 330.3 9201.6 2239 * 2 rounds: 1246.4 25475.4 2240 * 3 rounds: 1907.1 31295.1 2241 * 4 rounds: 2042.3 31718.6 2242 * Perfect: 2048 31744 2243 * (32*64) (32*31/2 * 64) 2244 */ 2245 #define HASH_MIX(x, y, a) \ 2246 ( x ^= (a), \ 2247 y ^= x, x = rol32(x, 7),\ 2248 x += y, y = rol32(y,20),\ 2249 y *= 9 ) 2250 2251 static inline unsigned int fold_hash(unsigned long x, unsigned long y) 2252 { 2253 /* Use arch-optimized multiply if one exists */ 2254 return __hash_32(y ^ __hash_32(x)); 2255 } 2256 2257 #endif 2258 2259 /* 2260 * Return the hash of a string of known length. This is carfully 2261 * designed to match hash_name(), which is the more critical function. 2262 * In particular, we must end by hashing a final word containing 0..7 2263 * payload bytes, to match the way that hash_name() iterates until it 2264 * finds the delimiter after the name. 2265 */ 2266 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len) 2267 { 2268 unsigned long a, x = 0, y = (unsigned long)salt; 2269 2270 for (;;) { 2271 if (!len) 2272 goto done; 2273 a = load_unaligned_zeropad(name); 2274 if (len < sizeof(unsigned long)) 2275 break; 2276 HASH_MIX(x, y, a); 2277 name += sizeof(unsigned long); 2278 len -= sizeof(unsigned long); 2279 } 2280 x ^= a & bytemask_from_count(len); 2281 done: 2282 return fold_hash(x, y); 2283 } 2284 EXPORT_SYMBOL(full_name_hash); 2285 2286 /* Return the "hash_len" (hash and length) of a null-terminated string */ 2287 u64 hashlen_string(const void *salt, const char *name) 2288 { 2289 unsigned long a = 0, x = 0, y = (unsigned long)salt; 2290 unsigned long adata, mask, len; 2291 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 2292 2293 len = 0; 2294 goto inside; 2295 2296 do { 2297 HASH_MIX(x, y, a); 2298 len += sizeof(unsigned long); 2299 inside: 2300 a = load_unaligned_zeropad(name+len); 2301 } while (!has_zero(a, &adata, &constants)); 2302 2303 adata = prep_zero_mask(a, adata, &constants); 2304 mask = create_zero_mask(adata); 2305 x ^= a & zero_bytemask(mask); 2306 2307 return hashlen_create(fold_hash(x, y), len + find_zero(mask)); 2308 } 2309 EXPORT_SYMBOL(hashlen_string); 2310 2311 /* 2312 * Calculate the length and hash of the path component, and 2313 * return the length as the result. 2314 */ 2315 static inline const char *hash_name(struct nameidata *nd, 2316 const char *name, 2317 unsigned long *lastword) 2318 { 2319 unsigned long a, b, x, y = (unsigned long)nd->path.dentry; 2320 unsigned long adata, bdata, mask, len; 2321 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 2322 2323 /* 2324 * The first iteration is special, because it can result in 2325 * '.' and '..' and has no mixing other than the final fold. 2326 */ 2327 a = load_unaligned_zeropad(name); 2328 b = a ^ REPEAT_BYTE('/'); 2329 if (has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)) { 2330 adata = prep_zero_mask(a, adata, &constants); 2331 bdata = prep_zero_mask(b, bdata, &constants); 2332 mask = create_zero_mask(adata | bdata); 2333 a &= zero_bytemask(mask); 2334 *lastword = a; 2335 len = find_zero(mask); 2336 nd->last.hash = fold_hash(a, y); 2337 nd->last.len = len; 2338 return name + len; 2339 } 2340 2341 len = 0; 2342 x = 0; 2343 do { 2344 HASH_MIX(x, y, a); 2345 len += sizeof(unsigned long); 2346 a = load_unaligned_zeropad(name+len); 2347 b = a ^ REPEAT_BYTE('/'); 2348 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants))); 2349 2350 adata = prep_zero_mask(a, adata, &constants); 2351 bdata = prep_zero_mask(b, bdata, &constants); 2352 mask = create_zero_mask(adata | bdata); 2353 a &= zero_bytemask(mask); 2354 x ^= a; 2355 len += find_zero(mask); 2356 *lastword = 0; // Multi-word components cannot be DOT or DOTDOT 2357 2358 nd->last.hash = fold_hash(x, y); 2359 nd->last.len = len; 2360 return name + len; 2361 } 2362 2363 /* 2364 * Note that the 'last' word is always zero-masked, but 2365 * was loaded as a possibly big-endian word. 2366 */ 2367 #ifdef __BIG_ENDIAN 2368 #define LAST_WORD_IS_DOT (0x2eul << (BITS_PER_LONG-8)) 2369 #define LAST_WORD_IS_DOTDOT (0x2e2eul << (BITS_PER_LONG-16)) 2370 #endif 2371 2372 #else /* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */ 2373 2374 /* Return the hash of a string of known length */ 2375 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len) 2376 { 2377 unsigned long hash = init_name_hash(salt); 2378 while (len--) 2379 hash = partial_name_hash((unsigned char)*name++, hash); 2380 return end_name_hash(hash); 2381 } 2382 EXPORT_SYMBOL(full_name_hash); 2383 2384 /* Return the "hash_len" (hash and length) of a null-terminated string */ 2385 u64 hashlen_string(const void *salt, const char *name) 2386 { 2387 unsigned long hash = init_name_hash(salt); 2388 unsigned long len = 0, c; 2389 2390 c = (unsigned char)*name; 2391 while (c) { 2392 len++; 2393 hash = partial_name_hash(c, hash); 2394 c = (unsigned char)name[len]; 2395 } 2396 return hashlen_create(end_name_hash(hash), len); 2397 } 2398 EXPORT_SYMBOL(hashlen_string); 2399 2400 /* 2401 * We know there's a real path component here of at least 2402 * one character. 2403 */ 2404 static inline const char *hash_name(struct nameidata *nd, const char *name, unsigned long *lastword) 2405 { 2406 unsigned long hash = init_name_hash(nd->path.dentry); 2407 unsigned long len = 0, c, last = 0; 2408 2409 c = (unsigned char)*name; 2410 do { 2411 last = (last << 8) + c; 2412 len++; 2413 hash = partial_name_hash(c, hash); 2414 c = (unsigned char)name[len]; 2415 } while (c && c != '/'); 2416 2417 // This is reliable for DOT or DOTDOT, since the component 2418 // cannot contain NUL characters - top bits being zero means 2419 // we cannot have had any other pathnames. 2420 *lastword = last; 2421 nd->last.hash = end_name_hash(hash); 2422 nd->last.len = len; 2423 return name + len; 2424 } 2425 2426 #endif 2427 2428 #ifndef LAST_WORD_IS_DOT 2429 #define LAST_WORD_IS_DOT 0x2e 2430 #define LAST_WORD_IS_DOTDOT 0x2e2e 2431 #endif 2432 2433 /* 2434 * Name resolution. 2435 * This is the basic name resolution function, turning a pathname into 2436 * the final dentry. We expect 'base' to be positive and a directory. 2437 * 2438 * Returns 0 and nd will have valid dentry and mnt on success. 2439 * Returns error and drops reference to input namei data on failure. 2440 */ 2441 static int link_path_walk(const char *name, struct nameidata *nd) 2442 { 2443 int depth = 0; // depth <= nd->depth 2444 int err; 2445 2446 nd->last_type = LAST_ROOT; 2447 nd->flags |= LOOKUP_PARENT; 2448 if (IS_ERR(name)) 2449 return PTR_ERR(name); 2450 if (*name == '/') { 2451 do { 2452 name++; 2453 } while (unlikely(*name == '/')); 2454 } 2455 if (unlikely(!*name)) { 2456 nd->dir_mode = 0; // short-circuit the 'hardening' idiocy 2457 return 0; 2458 } 2459 2460 /* At this point we know we have a real path component. */ 2461 for(;;) { 2462 struct mnt_idmap *idmap; 2463 const char *link; 2464 unsigned long lastword; 2465 2466 idmap = mnt_idmap(nd->path.mnt); 2467 err = may_lookup(idmap, nd); 2468 if (unlikely(err)) 2469 return err; 2470 2471 nd->last.name = name; 2472 name = hash_name(nd, name, &lastword); 2473 2474 switch(lastword) { 2475 case LAST_WORD_IS_DOTDOT: 2476 nd->last_type = LAST_DOTDOT; 2477 nd->state |= ND_JUMPED; 2478 break; 2479 2480 case LAST_WORD_IS_DOT: 2481 nd->last_type = LAST_DOT; 2482 break; 2483 2484 default: 2485 nd->last_type = LAST_NORM; 2486 nd->state &= ~ND_JUMPED; 2487 2488 struct dentry *parent = nd->path.dentry; 2489 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { 2490 err = parent->d_op->d_hash(parent, &nd->last); 2491 if (err < 0) 2492 return err; 2493 } 2494 } 2495 2496 if (!*name) 2497 goto OK; 2498 /* 2499 * If it wasn't NUL, we know it was '/'. Skip that 2500 * slash, and continue until no more slashes. 2501 */ 2502 do { 2503 name++; 2504 } while (unlikely(*name == '/')); 2505 if (unlikely(!*name)) { 2506 OK: 2507 /* pathname or trailing symlink, done */ 2508 if (!depth) { 2509 nd->dir_vfsuid = i_uid_into_vfsuid(idmap, nd->inode); 2510 nd->dir_mode = nd->inode->i_mode; 2511 nd->flags &= ~LOOKUP_PARENT; 2512 return 0; 2513 } 2514 /* last component of nested symlink */ 2515 name = nd->stack[--depth].name; 2516 link = walk_component(nd, 0); 2517 } else { 2518 /* not the last component */ 2519 link = walk_component(nd, WALK_MORE); 2520 } 2521 if (unlikely(link)) { 2522 if (IS_ERR(link)) 2523 return PTR_ERR(link); 2524 /* a symlink to follow */ 2525 nd->stack[depth++].name = name; 2526 name = link; 2527 continue; 2528 } 2529 if (unlikely(!d_can_lookup(nd->path.dentry))) { 2530 if (nd->flags & LOOKUP_RCU) { 2531 if (!try_to_unlazy(nd)) 2532 return -ECHILD; 2533 } 2534 return -ENOTDIR; 2535 } 2536 } 2537 } 2538 2539 /* must be paired with terminate_walk() */ 2540 static const char *path_init(struct nameidata *nd, unsigned flags) 2541 { 2542 int error; 2543 const char *s = nd->pathname; 2544 2545 /* LOOKUP_CACHED requires RCU, ask caller to retry */ 2546 if ((flags & (LOOKUP_RCU | LOOKUP_CACHED)) == LOOKUP_CACHED) 2547 return ERR_PTR(-EAGAIN); 2548 2549 if (!*s) 2550 flags &= ~LOOKUP_RCU; 2551 if (flags & LOOKUP_RCU) 2552 rcu_read_lock(); 2553 else 2554 nd->seq = nd->next_seq = 0; 2555 2556 nd->flags = flags; 2557 nd->state |= ND_JUMPED; 2558 2559 nd->m_seq = __read_seqcount_begin(&mount_lock.seqcount); 2560 nd->r_seq = __read_seqcount_begin(&rename_lock.seqcount); 2561 smp_rmb(); 2562 2563 if (nd->state & ND_ROOT_PRESET) { 2564 struct dentry *root = nd->root.dentry; 2565 struct inode *inode = root->d_inode; 2566 if (*s && unlikely(!d_can_lookup(root))) 2567 return ERR_PTR(-ENOTDIR); 2568 nd->path = nd->root; 2569 nd->inode = inode; 2570 if (flags & LOOKUP_RCU) { 2571 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 2572 nd->root_seq = nd->seq; 2573 } else { 2574 path_get(&nd->path); 2575 } 2576 return s; 2577 } 2578 2579 nd->root.mnt = NULL; 2580 2581 /* Absolute pathname -- fetch the root (LOOKUP_IN_ROOT uses nd->dfd). */ 2582 if (*s == '/' && !(flags & LOOKUP_IN_ROOT)) { 2583 error = nd_jump_root(nd); 2584 if (unlikely(error)) 2585 return ERR_PTR(error); 2586 return s; 2587 } 2588 2589 /* Relative pathname -- get the starting-point it is relative to. */ 2590 if (nd->dfd == AT_FDCWD) { 2591 if (flags & LOOKUP_RCU) { 2592 struct fs_struct *fs = current->fs; 2593 unsigned seq; 2594 2595 do { 2596 seq = read_seqbegin(&fs->seq); 2597 nd->path = fs->pwd; 2598 nd->inode = nd->path.dentry->d_inode; 2599 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 2600 } while (read_seqretry(&fs->seq, seq)); 2601 } else { 2602 get_fs_pwd(current->fs, &nd->path); 2603 nd->inode = nd->path.dentry->d_inode; 2604 } 2605 } else { 2606 /* Caller must check execute permissions on the starting path component */ 2607 CLASS(fd_raw, f)(nd->dfd); 2608 struct dentry *dentry; 2609 2610 if (fd_empty(f)) 2611 return ERR_PTR(-EBADF); 2612 2613 if (flags & LOOKUP_LINKAT_EMPTY) { 2614 if (fd_file(f)->f_cred != current_cred() && 2615 !ns_capable(fd_file(f)->f_cred->user_ns, CAP_DAC_READ_SEARCH)) 2616 return ERR_PTR(-ENOENT); 2617 } 2618 2619 dentry = fd_file(f)->f_path.dentry; 2620 2621 if (*s && unlikely(!d_can_lookup(dentry))) 2622 return ERR_PTR(-ENOTDIR); 2623 2624 nd->path = fd_file(f)->f_path; 2625 if (flags & LOOKUP_RCU) { 2626 nd->inode = nd->path.dentry->d_inode; 2627 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 2628 } else { 2629 path_get(&nd->path); 2630 nd->inode = nd->path.dentry->d_inode; 2631 } 2632 } 2633 2634 /* For scoped-lookups we need to set the root to the dirfd as well. */ 2635 if (flags & LOOKUP_IS_SCOPED) { 2636 nd->root = nd->path; 2637 if (flags & LOOKUP_RCU) { 2638 nd->root_seq = nd->seq; 2639 } else { 2640 path_get(&nd->root); 2641 nd->state |= ND_ROOT_GRABBED; 2642 } 2643 } 2644 return s; 2645 } 2646 2647 static inline const char *lookup_last(struct nameidata *nd) 2648 { 2649 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len]) 2650 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 2651 2652 return walk_component(nd, WALK_TRAILING); 2653 } 2654 2655 static int handle_lookup_down(struct nameidata *nd) 2656 { 2657 if (!(nd->flags & LOOKUP_RCU)) 2658 dget(nd->path.dentry); 2659 nd->next_seq = nd->seq; 2660 return PTR_ERR(step_into(nd, WALK_NOFOLLOW, nd->path.dentry)); 2661 } 2662 2663 /* Returns 0 and nd will be valid on success; Returns error, otherwise. */ 2664 static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path) 2665 { 2666 const char *s = path_init(nd, flags); 2667 int err; 2668 2669 if (unlikely(flags & LOOKUP_DOWN) && !IS_ERR(s)) { 2670 err = handle_lookup_down(nd); 2671 if (unlikely(err < 0)) 2672 s = ERR_PTR(err); 2673 } 2674 2675 while (!(err = link_path_walk(s, nd)) && 2676 (s = lookup_last(nd)) != NULL) 2677 ; 2678 if (!err && unlikely(nd->flags & LOOKUP_MOUNTPOINT)) { 2679 err = handle_lookup_down(nd); 2680 nd->state &= ~ND_JUMPED; // no d_weak_revalidate(), please... 2681 } 2682 if (!err) 2683 err = complete_walk(nd); 2684 2685 if (!err && nd->flags & LOOKUP_DIRECTORY) 2686 if (!d_can_lookup(nd->path.dentry)) 2687 err = -ENOTDIR; 2688 if (!err) { 2689 *path = nd->path; 2690 nd->path.mnt = NULL; 2691 nd->path.dentry = NULL; 2692 } 2693 terminate_walk(nd); 2694 return err; 2695 } 2696 2697 int filename_lookup(int dfd, struct filename *name, unsigned flags, 2698 struct path *path, const struct path *root) 2699 { 2700 int retval; 2701 struct nameidata nd; 2702 if (IS_ERR(name)) 2703 return PTR_ERR(name); 2704 set_nameidata(&nd, dfd, name, root); 2705 retval = path_lookupat(&nd, flags | LOOKUP_RCU, path); 2706 if (unlikely(retval == -ECHILD)) 2707 retval = path_lookupat(&nd, flags, path); 2708 if (unlikely(retval == -ESTALE)) 2709 retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path); 2710 2711 if (likely(!retval)) 2712 audit_inode(name, path->dentry, 2713 flags & LOOKUP_MOUNTPOINT ? AUDIT_INODE_NOEVAL : 0); 2714 restore_nameidata(); 2715 return retval; 2716 } 2717 2718 /* Returns 0 and nd will be valid on success; Returns error, otherwise. */ 2719 static int path_parentat(struct nameidata *nd, unsigned flags, 2720 struct path *parent) 2721 { 2722 const char *s = path_init(nd, flags); 2723 int err = link_path_walk(s, nd); 2724 if (!err) 2725 err = complete_walk(nd); 2726 if (!err) { 2727 *parent = nd->path; 2728 nd->path.mnt = NULL; 2729 nd->path.dentry = NULL; 2730 } 2731 terminate_walk(nd); 2732 return err; 2733 } 2734 2735 /* Note: this does not consume "name" */ 2736 static int __filename_parentat(int dfd, struct filename *name, 2737 unsigned int flags, struct path *parent, 2738 struct qstr *last, int *type, 2739 const struct path *root) 2740 { 2741 int retval; 2742 struct nameidata nd; 2743 2744 if (IS_ERR(name)) 2745 return PTR_ERR(name); 2746 set_nameidata(&nd, dfd, name, root); 2747 retval = path_parentat(&nd, flags | LOOKUP_RCU, parent); 2748 if (unlikely(retval == -ECHILD)) 2749 retval = path_parentat(&nd, flags, parent); 2750 if (unlikely(retval == -ESTALE)) 2751 retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent); 2752 if (likely(!retval)) { 2753 *last = nd.last; 2754 *type = nd.last_type; 2755 audit_inode(name, parent->dentry, AUDIT_INODE_PARENT); 2756 } 2757 restore_nameidata(); 2758 return retval; 2759 } 2760 2761 static int filename_parentat(int dfd, struct filename *name, 2762 unsigned int flags, struct path *parent, 2763 struct qstr *last, int *type) 2764 { 2765 return __filename_parentat(dfd, name, flags, parent, last, type, NULL); 2766 } 2767 2768 /* does lookup, returns the object with parent locked */ 2769 static struct dentry *__start_removing_path(int dfd, struct filename *name, 2770 struct path *path) 2771 { 2772 struct path parent_path __free(path_put) = {}; 2773 struct dentry *d; 2774 struct qstr last; 2775 int type, error; 2776 2777 error = filename_parentat(dfd, name, 0, &parent_path, &last, &type); 2778 if (error) 2779 return ERR_PTR(error); 2780 if (unlikely(type != LAST_NORM)) 2781 return ERR_PTR(-EINVAL); 2782 /* don't fail immediately if it's r/o, at least try to report other errors */ 2783 error = mnt_want_write(parent_path.mnt); 2784 inode_lock_nested(parent_path.dentry->d_inode, I_MUTEX_PARENT); 2785 d = lookup_one_qstr_excl(&last, parent_path.dentry, 0); 2786 if (IS_ERR(d)) 2787 goto unlock; 2788 if (error) 2789 goto fail; 2790 path->dentry = no_free_ptr(parent_path.dentry); 2791 path->mnt = no_free_ptr(parent_path.mnt); 2792 return d; 2793 2794 fail: 2795 dput(d); 2796 d = ERR_PTR(error); 2797 unlock: 2798 inode_unlock(parent_path.dentry->d_inode); 2799 if (!error) 2800 mnt_drop_write(parent_path.mnt); 2801 return d; 2802 } 2803 2804 /** 2805 * kern_path_parent: lookup path returning parent and target 2806 * @name: path name 2807 * @path: path to store parent in 2808 * 2809 * The path @name should end with a normal component, not "." or ".." or "/". 2810 * A lookup is performed and if successful the parent information 2811 * is store in @parent and the dentry is returned. 2812 * 2813 * The dentry maybe negative, the parent will be positive. 2814 * 2815 * Returns: dentry or error. 2816 */ 2817 struct dentry *kern_path_parent(const char *name, struct path *path) 2818 { 2819 struct path parent_path __free(path_put) = {}; 2820 struct filename *filename __free(putname) = getname_kernel(name); 2821 struct dentry *d; 2822 struct qstr last; 2823 int type, error; 2824 2825 error = filename_parentat(AT_FDCWD, filename, 0, &parent_path, &last, &type); 2826 if (error) 2827 return ERR_PTR(error); 2828 if (unlikely(type != LAST_NORM)) 2829 return ERR_PTR(-EINVAL); 2830 2831 d = lookup_noperm_unlocked(&last, parent_path.dentry); 2832 if (IS_ERR(d)) 2833 return d; 2834 path->dentry = no_free_ptr(parent_path.dentry); 2835 path->mnt = no_free_ptr(parent_path.mnt); 2836 return d; 2837 } 2838 2839 struct dentry *start_removing_path(const char *name, struct path *path) 2840 { 2841 struct filename *filename = getname_kernel(name); 2842 struct dentry *res = __start_removing_path(AT_FDCWD, filename, path); 2843 2844 putname(filename); 2845 return res; 2846 } 2847 2848 struct dentry *start_removing_user_path_at(int dfd, 2849 const char __user *name, 2850 struct path *path) 2851 { 2852 struct filename *filename = getname(name); 2853 struct dentry *res = __start_removing_path(dfd, filename, path); 2854 2855 putname(filename); 2856 return res; 2857 } 2858 EXPORT_SYMBOL(start_removing_user_path_at); 2859 2860 int kern_path(const char *name, unsigned int flags, struct path *path) 2861 { 2862 struct filename *filename = getname_kernel(name); 2863 int ret = filename_lookup(AT_FDCWD, filename, flags, path, NULL); 2864 2865 putname(filename); 2866 return ret; 2867 2868 } 2869 EXPORT_SYMBOL(kern_path); 2870 2871 /** 2872 * vfs_path_parent_lookup - lookup a parent path relative to a dentry-vfsmount pair 2873 * @filename: filename structure 2874 * @flags: lookup flags 2875 * @parent: pointer to struct path to fill 2876 * @last: last component 2877 * @type: type of the last component 2878 * @root: pointer to struct path of the base directory 2879 */ 2880 int vfs_path_parent_lookup(struct filename *filename, unsigned int flags, 2881 struct path *parent, struct qstr *last, int *type, 2882 const struct path *root) 2883 { 2884 return __filename_parentat(AT_FDCWD, filename, flags, parent, last, 2885 type, root); 2886 } 2887 EXPORT_SYMBOL(vfs_path_parent_lookup); 2888 2889 /** 2890 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair 2891 * @dentry: pointer to dentry of the base directory 2892 * @mnt: pointer to vfs mount of the base directory 2893 * @name: pointer to file name 2894 * @flags: lookup flags 2895 * @path: pointer to struct path to fill 2896 */ 2897 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, 2898 const char *name, unsigned int flags, 2899 struct path *path) 2900 { 2901 struct filename *filename; 2902 struct path root = {.mnt = mnt, .dentry = dentry}; 2903 int ret; 2904 2905 filename = getname_kernel(name); 2906 /* the first argument of filename_lookup() is ignored with root */ 2907 ret = filename_lookup(AT_FDCWD, filename, flags, path, &root); 2908 putname(filename); 2909 return ret; 2910 } 2911 EXPORT_SYMBOL(vfs_path_lookup); 2912 2913 static int lookup_noperm_common(struct qstr *qname, struct dentry *base) 2914 { 2915 const char *name = qname->name; 2916 u32 len = qname->len; 2917 2918 qname->hash = full_name_hash(base, name, len); 2919 if (!len) 2920 return -EACCES; 2921 2922 if (is_dot_dotdot(name, len)) 2923 return -EACCES; 2924 2925 while (len--) { 2926 unsigned int c = *(const unsigned char *)name++; 2927 if (c == '/' || c == '\0') 2928 return -EACCES; 2929 } 2930 /* 2931 * See if the low-level filesystem might want 2932 * to use its own hash.. 2933 */ 2934 if (base->d_flags & DCACHE_OP_HASH) { 2935 int err = base->d_op->d_hash(base, qname); 2936 if (err < 0) 2937 return err; 2938 } 2939 return 0; 2940 } 2941 2942 static int lookup_one_common(struct mnt_idmap *idmap, 2943 struct qstr *qname, struct dentry *base) 2944 { 2945 int err; 2946 err = lookup_noperm_common(qname, base); 2947 if (err < 0) 2948 return err; 2949 return inode_permission(idmap, base->d_inode, MAY_EXEC); 2950 } 2951 2952 /** 2953 * try_lookup_noperm - filesystem helper to lookup single pathname component 2954 * @name: qstr storing pathname component to lookup 2955 * @base: base directory to lookup from 2956 * 2957 * Look up a dentry by name in the dcache, returning NULL if it does not 2958 * currently exist. The function does not try to create a dentry and if one 2959 * is found it doesn't try to revalidate it. 2960 * 2961 * Note that this routine is purely a helper for filesystem usage and should 2962 * not be called by generic code. It does no permission checking. 2963 * 2964 * No locks need be held - only a counted reference to @base is needed. 2965 * 2966 */ 2967 struct dentry *try_lookup_noperm(struct qstr *name, struct dentry *base) 2968 { 2969 int err; 2970 2971 err = lookup_noperm_common(name, base); 2972 if (err) 2973 return ERR_PTR(err); 2974 2975 return d_lookup(base, name); 2976 } 2977 EXPORT_SYMBOL(try_lookup_noperm); 2978 2979 /** 2980 * lookup_noperm - filesystem helper to lookup single pathname component 2981 * @name: qstr storing pathname component to lookup 2982 * @base: base directory to lookup from 2983 * 2984 * Note that this routine is purely a helper for filesystem usage and should 2985 * not be called by generic code. It does no permission checking. 2986 * 2987 * The caller must hold base->i_rwsem. 2988 */ 2989 struct dentry *lookup_noperm(struct qstr *name, struct dentry *base) 2990 { 2991 struct dentry *dentry; 2992 int err; 2993 2994 WARN_ON_ONCE(!inode_is_locked(base->d_inode)); 2995 2996 err = lookup_noperm_common(name, base); 2997 if (err) 2998 return ERR_PTR(err); 2999 3000 dentry = lookup_dcache(name, base, 0); 3001 return dentry ? dentry : __lookup_slow(name, base, 0); 3002 } 3003 EXPORT_SYMBOL(lookup_noperm); 3004 3005 /** 3006 * lookup_one - lookup single pathname component 3007 * @idmap: idmap of the mount the lookup is performed from 3008 * @name: qstr holding pathname component to lookup 3009 * @base: base directory to lookup from 3010 * 3011 * This can be used for in-kernel filesystem clients such as file servers. 3012 * 3013 * The caller must hold base->i_rwsem. 3014 */ 3015 struct dentry *lookup_one(struct mnt_idmap *idmap, struct qstr *name, 3016 struct dentry *base) 3017 { 3018 struct dentry *dentry; 3019 int err; 3020 3021 WARN_ON_ONCE(!inode_is_locked(base->d_inode)); 3022 3023 err = lookup_one_common(idmap, name, base); 3024 if (err) 3025 return ERR_PTR(err); 3026 3027 dentry = lookup_dcache(name, base, 0); 3028 return dentry ? dentry : __lookup_slow(name, base, 0); 3029 } 3030 EXPORT_SYMBOL(lookup_one); 3031 3032 /** 3033 * lookup_one_unlocked - lookup single pathname component 3034 * @idmap: idmap of the mount the lookup is performed from 3035 * @name: qstr olding pathname component to lookup 3036 * @base: base directory to lookup from 3037 * 3038 * This can be used for in-kernel filesystem clients such as file servers. 3039 * 3040 * Unlike lookup_one, it should be called without the parent 3041 * i_rwsem held, and will take the i_rwsem itself if necessary. 3042 */ 3043 struct dentry *lookup_one_unlocked(struct mnt_idmap *idmap, struct qstr *name, 3044 struct dentry *base) 3045 { 3046 int err; 3047 struct dentry *ret; 3048 3049 err = lookup_one_common(idmap, name, base); 3050 if (err) 3051 return ERR_PTR(err); 3052 3053 ret = lookup_dcache(name, base, 0); 3054 if (!ret) 3055 ret = lookup_slow(name, base, 0); 3056 return ret; 3057 } 3058 EXPORT_SYMBOL(lookup_one_unlocked); 3059 3060 /** 3061 * lookup_one_positive_killable - lookup single pathname component 3062 * @idmap: idmap of the mount the lookup is performed from 3063 * @name: qstr olding pathname component to lookup 3064 * @base: base directory to lookup from 3065 * 3066 * This helper will yield ERR_PTR(-ENOENT) on negatives. The helper returns 3067 * known positive or ERR_PTR(). This is what most of the users want. 3068 * 3069 * Note that pinned negative with unlocked parent _can_ become positive at any 3070 * time, so callers of lookup_one_unlocked() need to be very careful; pinned 3071 * positives have >d_inode stable, so this one avoids such problems. 3072 * 3073 * This can be used for in-kernel filesystem clients such as file servers. 3074 * 3075 * It should be called without the parent i_rwsem held, and will take 3076 * the i_rwsem itself if necessary. If a fatal signal is pending or 3077 * delivered, it will return %-EINTR if the lock is needed. 3078 */ 3079 struct dentry *lookup_one_positive_killable(struct mnt_idmap *idmap, 3080 struct qstr *name, 3081 struct dentry *base) 3082 { 3083 int err; 3084 struct dentry *ret; 3085 3086 err = lookup_one_common(idmap, name, base); 3087 if (err) 3088 return ERR_PTR(err); 3089 3090 ret = lookup_dcache(name, base, 0); 3091 if (!ret) 3092 ret = lookup_slow_killable(name, base, 0); 3093 if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) { 3094 dput(ret); 3095 ret = ERR_PTR(-ENOENT); 3096 } 3097 return ret; 3098 } 3099 EXPORT_SYMBOL(lookup_one_positive_killable); 3100 3101 /** 3102 * lookup_one_positive_unlocked - lookup single pathname component 3103 * @idmap: idmap of the mount the lookup is performed from 3104 * @name: qstr holding pathname component to lookup 3105 * @base: base directory to lookup from 3106 * 3107 * This helper will yield ERR_PTR(-ENOENT) on negatives. The helper returns 3108 * known positive or ERR_PTR(). This is what most of the users want. 3109 * 3110 * Note that pinned negative with unlocked parent _can_ become positive at any 3111 * time, so callers of lookup_one_unlocked() need to be very careful; pinned 3112 * positives have >d_inode stable, so this one avoids such problems. 3113 * 3114 * This can be used for in-kernel filesystem clients such as file servers. 3115 * 3116 * The helper should be called without i_rwsem held. 3117 */ 3118 struct dentry *lookup_one_positive_unlocked(struct mnt_idmap *idmap, 3119 struct qstr *name, 3120 struct dentry *base) 3121 { 3122 struct dentry *ret = lookup_one_unlocked(idmap, name, base); 3123 3124 if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) { 3125 dput(ret); 3126 ret = ERR_PTR(-ENOENT); 3127 } 3128 return ret; 3129 } 3130 EXPORT_SYMBOL(lookup_one_positive_unlocked); 3131 3132 /** 3133 * lookup_noperm_unlocked - filesystem helper to lookup single pathname component 3134 * @name: pathname component to lookup 3135 * @base: base directory to lookup from 3136 * 3137 * Note that this routine is purely a helper for filesystem usage and should 3138 * not be called by generic code. It does no permission checking. 3139 * 3140 * Unlike lookup_noperm(), it should be called without the parent 3141 * i_rwsem held, and will take the i_rwsem itself if necessary. 3142 * 3143 * Unlike try_lookup_noperm() it *does* revalidate the dentry if it already 3144 * existed. 3145 */ 3146 struct dentry *lookup_noperm_unlocked(struct qstr *name, struct dentry *base) 3147 { 3148 struct dentry *ret; 3149 int err; 3150 3151 err = lookup_noperm_common(name, base); 3152 if (err) 3153 return ERR_PTR(err); 3154 3155 ret = lookup_dcache(name, base, 0); 3156 if (!ret) 3157 ret = lookup_slow(name, base, 0); 3158 return ret; 3159 } 3160 EXPORT_SYMBOL(lookup_noperm_unlocked); 3161 3162 /* 3163 * Like lookup_noperm_unlocked(), except that it yields ERR_PTR(-ENOENT) 3164 * on negatives. Returns known positive or ERR_PTR(); that's what 3165 * most of the users want. Note that pinned negative with unlocked parent 3166 * _can_ become positive at any time, so callers of lookup_noperm_unlocked() 3167 * need to be very careful; pinned positives have ->d_inode stable, so 3168 * this one avoids such problems. 3169 */ 3170 struct dentry *lookup_noperm_positive_unlocked(struct qstr *name, 3171 struct dentry *base) 3172 { 3173 struct dentry *ret; 3174 3175 ret = lookup_noperm_unlocked(name, base); 3176 if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) { 3177 dput(ret); 3178 ret = ERR_PTR(-ENOENT); 3179 } 3180 return ret; 3181 } 3182 EXPORT_SYMBOL(lookup_noperm_positive_unlocked); 3183 3184 #ifdef CONFIG_UNIX98_PTYS 3185 int path_pts(struct path *path) 3186 { 3187 /* Find something mounted on "pts" in the same directory as 3188 * the input path. 3189 */ 3190 struct dentry *parent = dget_parent(path->dentry); 3191 struct dentry *child; 3192 struct qstr this = QSTR_INIT("pts", 3); 3193 3194 if (unlikely(!path_connected(path->mnt, parent))) { 3195 dput(parent); 3196 return -ENOENT; 3197 } 3198 dput(path->dentry); 3199 path->dentry = parent; 3200 child = d_hash_and_lookup(parent, &this); 3201 if (IS_ERR_OR_NULL(child)) 3202 return -ENOENT; 3203 3204 path->dentry = child; 3205 dput(parent); 3206 follow_down(path, 0); 3207 return 0; 3208 } 3209 #endif 3210 3211 int user_path_at(int dfd, const char __user *name, unsigned flags, 3212 struct path *path) 3213 { 3214 struct filename *filename = getname_flags(name, flags); 3215 int ret = filename_lookup(dfd, filename, flags, path, NULL); 3216 3217 putname(filename); 3218 return ret; 3219 } 3220 EXPORT_SYMBOL(user_path_at); 3221 3222 int __check_sticky(struct mnt_idmap *idmap, struct inode *dir, 3223 struct inode *inode) 3224 { 3225 kuid_t fsuid = current_fsuid(); 3226 3227 if (vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), fsuid)) 3228 return 0; 3229 if (vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, dir), fsuid)) 3230 return 0; 3231 return !capable_wrt_inode_uidgid(idmap, inode, CAP_FOWNER); 3232 } 3233 EXPORT_SYMBOL(__check_sticky); 3234 3235 /* 3236 * Check whether we can remove a link victim from directory dir, check 3237 * whether the type of victim is right. 3238 * 1. We can't do it if dir is read-only (done in permission()) 3239 * 2. We should have write and exec permissions on dir 3240 * 3. We can't remove anything from append-only dir 3241 * 4. We can't do anything with immutable dir (done in permission()) 3242 * 5. If the sticky bit on dir is set we should either 3243 * a. be owner of dir, or 3244 * b. be owner of victim, or 3245 * c. have CAP_FOWNER capability 3246 * 6. If the victim is append-only or immutable we can't do antyhing with 3247 * links pointing to it. 3248 * 7. If the victim has an unknown uid or gid we can't change the inode. 3249 * 8. If we were asked to remove a directory and victim isn't one - ENOTDIR. 3250 * 9. If we were asked to remove a non-directory and victim isn't one - EISDIR. 3251 * 10. We can't remove a root or mountpoint. 3252 * 11. We don't allow removal of NFS sillyrenamed files; it's handled by 3253 * nfs_async_unlink(). 3254 */ 3255 static int may_delete(struct mnt_idmap *idmap, struct inode *dir, 3256 struct dentry *victim, bool isdir) 3257 { 3258 struct inode *inode = d_backing_inode(victim); 3259 int error; 3260 3261 if (d_is_negative(victim)) 3262 return -ENOENT; 3263 BUG_ON(!inode); 3264 3265 BUG_ON(victim->d_parent->d_inode != dir); 3266 3267 /* Inode writeback is not safe when the uid or gid are invalid. */ 3268 if (!vfsuid_valid(i_uid_into_vfsuid(idmap, inode)) || 3269 !vfsgid_valid(i_gid_into_vfsgid(idmap, inode))) 3270 return -EOVERFLOW; 3271 3272 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE); 3273 3274 error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC); 3275 if (error) 3276 return error; 3277 if (IS_APPEND(dir)) 3278 return -EPERM; 3279 3280 if (check_sticky(idmap, dir, inode) || IS_APPEND(inode) || 3281 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) || 3282 HAS_UNMAPPED_ID(idmap, inode)) 3283 return -EPERM; 3284 if (isdir) { 3285 if (!d_is_dir(victim)) 3286 return -ENOTDIR; 3287 if (IS_ROOT(victim)) 3288 return -EBUSY; 3289 } else if (d_is_dir(victim)) 3290 return -EISDIR; 3291 if (IS_DEADDIR(dir)) 3292 return -ENOENT; 3293 if (victim->d_flags & DCACHE_NFSFS_RENAMED) 3294 return -EBUSY; 3295 return 0; 3296 } 3297 3298 /* Check whether we can create an object with dentry child in directory 3299 * dir. 3300 * 1. We can't do it if child already exists (open has special treatment for 3301 * this case, but since we are inlined it's OK) 3302 * 2. We can't do it if dir is read-only (done in permission()) 3303 * 3. We can't do it if the fs can't represent the fsuid or fsgid. 3304 * 4. We should have write and exec permissions on dir 3305 * 5. We can't do it if dir is immutable (done in permission()) 3306 */ 3307 static inline int may_create(struct mnt_idmap *idmap, 3308 struct inode *dir, struct dentry *child) 3309 { 3310 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE); 3311 if (child->d_inode) 3312 return -EEXIST; 3313 if (IS_DEADDIR(dir)) 3314 return -ENOENT; 3315 if (!fsuidgid_has_mapping(dir->i_sb, idmap)) 3316 return -EOVERFLOW; 3317 3318 return inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC); 3319 } 3320 3321 // p1 != p2, both are on the same filesystem, ->s_vfs_rename_mutex is held 3322 static struct dentry *lock_two_directories(struct dentry *p1, struct dentry *p2) 3323 { 3324 struct dentry *p = p1, *q = p2, *r; 3325 3326 while ((r = p->d_parent) != p2 && r != p) 3327 p = r; 3328 if (r == p2) { 3329 // p is a child of p2 and an ancestor of p1 or p1 itself 3330 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); 3331 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT2); 3332 return p; 3333 } 3334 // p is the root of connected component that contains p1 3335 // p2 does not occur on the path from p to p1 3336 while ((r = q->d_parent) != p1 && r != p && r != q) 3337 q = r; 3338 if (r == p1) { 3339 // q is a child of p1 and an ancestor of p2 or p2 itself 3340 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 3341 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2); 3342 return q; 3343 } else if (likely(r == p)) { 3344 // both p2 and p1 are descendents of p 3345 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 3346 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2); 3347 return NULL; 3348 } else { // no common ancestor at the time we'd been called 3349 mutex_unlock(&p1->d_sb->s_vfs_rename_mutex); 3350 return ERR_PTR(-EXDEV); 3351 } 3352 } 3353 3354 /* 3355 * p1 and p2 should be directories on the same fs. 3356 */ 3357 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) 3358 { 3359 if (p1 == p2) { 3360 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 3361 return NULL; 3362 } 3363 3364 mutex_lock(&p1->d_sb->s_vfs_rename_mutex); 3365 return lock_two_directories(p1, p2); 3366 } 3367 EXPORT_SYMBOL(lock_rename); 3368 3369 /* 3370 * c1 and p2 should be on the same fs. 3371 */ 3372 struct dentry *lock_rename_child(struct dentry *c1, struct dentry *p2) 3373 { 3374 if (READ_ONCE(c1->d_parent) == p2) { 3375 /* 3376 * hopefully won't need to touch ->s_vfs_rename_mutex at all. 3377 */ 3378 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); 3379 /* 3380 * now that p2 is locked, nobody can move in or out of it, 3381 * so the test below is safe. 3382 */ 3383 if (likely(c1->d_parent == p2)) 3384 return NULL; 3385 3386 /* 3387 * c1 got moved out of p2 while we'd been taking locks; 3388 * unlock and fall back to slow case. 3389 */ 3390 inode_unlock(p2->d_inode); 3391 } 3392 3393 mutex_lock(&c1->d_sb->s_vfs_rename_mutex); 3394 /* 3395 * nobody can move out of any directories on this fs. 3396 */ 3397 if (likely(c1->d_parent != p2)) 3398 return lock_two_directories(c1->d_parent, p2); 3399 3400 /* 3401 * c1 got moved into p2 while we were taking locks; 3402 * we need p2 locked and ->s_vfs_rename_mutex unlocked, 3403 * for consistency with lock_rename(). 3404 */ 3405 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); 3406 mutex_unlock(&c1->d_sb->s_vfs_rename_mutex); 3407 return NULL; 3408 } 3409 EXPORT_SYMBOL(lock_rename_child); 3410 3411 void unlock_rename(struct dentry *p1, struct dentry *p2) 3412 { 3413 inode_unlock(p1->d_inode); 3414 if (p1 != p2) { 3415 inode_unlock(p2->d_inode); 3416 mutex_unlock(&p1->d_sb->s_vfs_rename_mutex); 3417 } 3418 } 3419 EXPORT_SYMBOL(unlock_rename); 3420 3421 /** 3422 * vfs_prepare_mode - prepare the mode to be used for a new inode 3423 * @idmap: idmap of the mount the inode was found from 3424 * @dir: parent directory of the new inode 3425 * @mode: mode of the new inode 3426 * @mask_perms: allowed permission by the vfs 3427 * @type: type of file to be created 3428 * 3429 * This helper consolidates and enforces vfs restrictions on the @mode of a new 3430 * object to be created. 3431 * 3432 * Umask stripping depends on whether the filesystem supports POSIX ACLs (see 3433 * the kernel documentation for mode_strip_umask()). Moving umask stripping 3434 * after setgid stripping allows the same ordering for both non-POSIX ACL and 3435 * POSIX ACL supporting filesystems. 3436 * 3437 * Note that it's currently valid for @type to be 0 if a directory is created. 3438 * Filesystems raise that flag individually and we need to check whether each 3439 * filesystem can deal with receiving S_IFDIR from the vfs before we enforce a 3440 * non-zero type. 3441 * 3442 * Returns: mode to be passed to the filesystem 3443 */ 3444 static inline umode_t vfs_prepare_mode(struct mnt_idmap *idmap, 3445 const struct inode *dir, umode_t mode, 3446 umode_t mask_perms, umode_t type) 3447 { 3448 mode = mode_strip_sgid(idmap, dir, mode); 3449 mode = mode_strip_umask(dir, mode); 3450 3451 /* 3452 * Apply the vfs mandated allowed permission mask and set the type of 3453 * file to be created before we call into the filesystem. 3454 */ 3455 mode &= (mask_perms & ~S_IFMT); 3456 mode |= (type & S_IFMT); 3457 3458 return mode; 3459 } 3460 3461 /** 3462 * vfs_create - create new file 3463 * @idmap: idmap of the mount the inode was found from 3464 * @dir: inode of the parent directory 3465 * @dentry: dentry of the child file 3466 * @mode: mode of the child file 3467 * @want_excl: whether the file must not yet exist 3468 * 3469 * Create a new file. 3470 * 3471 * If the inode has been found through an idmapped mount the idmap of 3472 * the vfsmount must be passed through @idmap. This function will then take 3473 * care to map the inode according to @idmap before checking permissions. 3474 * On non-idmapped mounts or if permission checking is to be performed on the 3475 * raw inode simply pass @nop_mnt_idmap. 3476 */ 3477 int vfs_create(struct mnt_idmap *idmap, struct inode *dir, 3478 struct dentry *dentry, umode_t mode, bool want_excl) 3479 { 3480 int error; 3481 3482 error = may_create(idmap, dir, dentry); 3483 if (error) 3484 return error; 3485 3486 if (!dir->i_op->create) 3487 return -EACCES; /* shouldn't it be ENOSYS? */ 3488 3489 mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG); 3490 error = security_inode_create(dir, dentry, mode); 3491 if (error) 3492 return error; 3493 error = dir->i_op->create(idmap, dir, dentry, mode, want_excl); 3494 if (!error) 3495 fsnotify_create(dir, dentry); 3496 return error; 3497 } 3498 EXPORT_SYMBOL(vfs_create); 3499 3500 int vfs_mkobj(struct dentry *dentry, umode_t mode, 3501 int (*f)(struct dentry *, umode_t, void *), 3502 void *arg) 3503 { 3504 struct inode *dir = dentry->d_parent->d_inode; 3505 int error = may_create(&nop_mnt_idmap, dir, dentry); 3506 if (error) 3507 return error; 3508 3509 mode &= S_IALLUGO; 3510 mode |= S_IFREG; 3511 error = security_inode_create(dir, dentry, mode); 3512 if (error) 3513 return error; 3514 error = f(dentry, mode, arg); 3515 if (!error) 3516 fsnotify_create(dir, dentry); 3517 return error; 3518 } 3519 EXPORT_SYMBOL(vfs_mkobj); 3520 3521 bool may_open_dev(const struct path *path) 3522 { 3523 return !(path->mnt->mnt_flags & MNT_NODEV) && 3524 !(path->mnt->mnt_sb->s_iflags & SB_I_NODEV); 3525 } 3526 3527 static int may_open(struct mnt_idmap *idmap, const struct path *path, 3528 int acc_mode, int flag) 3529 { 3530 struct dentry *dentry = path->dentry; 3531 struct inode *inode = dentry->d_inode; 3532 int error; 3533 3534 if (!inode) 3535 return -ENOENT; 3536 3537 switch (inode->i_mode & S_IFMT) { 3538 case S_IFLNK: 3539 return -ELOOP; 3540 case S_IFDIR: 3541 if (acc_mode & MAY_WRITE) 3542 return -EISDIR; 3543 if (acc_mode & MAY_EXEC) 3544 return -EACCES; 3545 break; 3546 case S_IFBLK: 3547 case S_IFCHR: 3548 if (!may_open_dev(path)) 3549 return -EACCES; 3550 fallthrough; 3551 case S_IFIFO: 3552 case S_IFSOCK: 3553 if (acc_mode & MAY_EXEC) 3554 return -EACCES; 3555 flag &= ~O_TRUNC; 3556 break; 3557 case S_IFREG: 3558 if ((acc_mode & MAY_EXEC) && path_noexec(path)) 3559 return -EACCES; 3560 break; 3561 default: 3562 VFS_BUG_ON_INODE(!IS_ANON_FILE(inode), inode); 3563 } 3564 3565 error = inode_permission(idmap, inode, MAY_OPEN | acc_mode); 3566 if (error) 3567 return error; 3568 3569 /* 3570 * An append-only file must be opened in append mode for writing. 3571 */ 3572 if (IS_APPEND(inode)) { 3573 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND)) 3574 return -EPERM; 3575 if (flag & O_TRUNC) 3576 return -EPERM; 3577 } 3578 3579 /* O_NOATIME can only be set by the owner or superuser */ 3580 if (flag & O_NOATIME && !inode_owner_or_capable(idmap, inode)) 3581 return -EPERM; 3582 3583 return 0; 3584 } 3585 3586 static int handle_truncate(struct mnt_idmap *idmap, struct file *filp) 3587 { 3588 const struct path *path = &filp->f_path; 3589 struct inode *inode = path->dentry->d_inode; 3590 int error = get_write_access(inode); 3591 if (error) 3592 return error; 3593 3594 error = security_file_truncate(filp); 3595 if (!error) { 3596 error = do_truncate(idmap, path->dentry, 0, 3597 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN, 3598 filp); 3599 } 3600 put_write_access(inode); 3601 return error; 3602 } 3603 3604 static inline int open_to_namei_flags(int flag) 3605 { 3606 if ((flag & O_ACCMODE) == 3) 3607 flag--; 3608 return flag; 3609 } 3610 3611 static int may_o_create(struct mnt_idmap *idmap, 3612 const struct path *dir, struct dentry *dentry, 3613 umode_t mode) 3614 { 3615 int error = security_path_mknod(dir, dentry, mode, 0); 3616 if (error) 3617 return error; 3618 3619 if (!fsuidgid_has_mapping(dir->dentry->d_sb, idmap)) 3620 return -EOVERFLOW; 3621 3622 error = inode_permission(idmap, dir->dentry->d_inode, 3623 MAY_WRITE | MAY_EXEC); 3624 if (error) 3625 return error; 3626 3627 return security_inode_create(dir->dentry->d_inode, dentry, mode); 3628 } 3629 3630 /* 3631 * Attempt to atomically look up, create and open a file from a negative 3632 * dentry. 3633 * 3634 * Returns 0 if successful. The file will have been created and attached to 3635 * @file by the filesystem calling finish_open(). 3636 * 3637 * If the file was looked up only or didn't need creating, FMODE_OPENED won't 3638 * be set. The caller will need to perform the open themselves. @path will 3639 * have been updated to point to the new dentry. This may be negative. 3640 * 3641 * Returns an error code otherwise. 3642 */ 3643 static struct dentry *atomic_open(struct nameidata *nd, struct dentry *dentry, 3644 struct file *file, 3645 int open_flag, umode_t mode) 3646 { 3647 struct dentry *const DENTRY_NOT_SET = (void *) -1UL; 3648 struct inode *dir = nd->path.dentry->d_inode; 3649 int error; 3650 3651 if (nd->flags & LOOKUP_DIRECTORY) 3652 open_flag |= O_DIRECTORY; 3653 3654 file->__f_path.dentry = DENTRY_NOT_SET; 3655 file->__f_path.mnt = nd->path.mnt; 3656 error = dir->i_op->atomic_open(dir, dentry, file, 3657 open_to_namei_flags(open_flag), mode); 3658 d_lookup_done(dentry); 3659 if (!error) { 3660 if (file->f_mode & FMODE_OPENED) { 3661 if (unlikely(dentry != file->f_path.dentry)) { 3662 dput(dentry); 3663 dentry = dget(file->f_path.dentry); 3664 } 3665 } else if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) { 3666 error = -EIO; 3667 } else { 3668 if (file->f_path.dentry) { 3669 dput(dentry); 3670 dentry = file->f_path.dentry; 3671 } 3672 if (unlikely(d_is_negative(dentry))) 3673 error = -ENOENT; 3674 } 3675 } 3676 if (error) { 3677 dput(dentry); 3678 dentry = ERR_PTR(error); 3679 } 3680 return dentry; 3681 } 3682 3683 /* 3684 * Look up and maybe create and open the last component. 3685 * 3686 * Must be called with parent locked (exclusive in O_CREAT case). 3687 * 3688 * Returns 0 on success, that is, if 3689 * the file was successfully atomically created (if necessary) and opened, or 3690 * the file was not completely opened at this time, though lookups and 3691 * creations were performed. 3692 * These case are distinguished by presence of FMODE_OPENED on file->f_mode. 3693 * In the latter case dentry returned in @path might be negative if O_CREAT 3694 * hadn't been specified. 3695 * 3696 * An error code is returned on failure. 3697 */ 3698 static struct dentry *lookup_open(struct nameidata *nd, struct file *file, 3699 const struct open_flags *op, 3700 bool got_write) 3701 { 3702 struct mnt_idmap *idmap; 3703 struct dentry *dir = nd->path.dentry; 3704 struct inode *dir_inode = dir->d_inode; 3705 int open_flag = op->open_flag; 3706 struct dentry *dentry; 3707 int error, create_error = 0; 3708 umode_t mode = op->mode; 3709 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq); 3710 3711 if (unlikely(IS_DEADDIR(dir_inode))) 3712 return ERR_PTR(-ENOENT); 3713 3714 file->f_mode &= ~FMODE_CREATED; 3715 dentry = d_lookup(dir, &nd->last); 3716 for (;;) { 3717 if (!dentry) { 3718 dentry = d_alloc_parallel(dir, &nd->last, &wq); 3719 if (IS_ERR(dentry)) 3720 return dentry; 3721 } 3722 if (d_in_lookup(dentry)) 3723 break; 3724 3725 error = d_revalidate(dir_inode, &nd->last, dentry, nd->flags); 3726 if (likely(error > 0)) 3727 break; 3728 if (error) 3729 goto out_dput; 3730 d_invalidate(dentry); 3731 dput(dentry); 3732 dentry = NULL; 3733 } 3734 if (dentry->d_inode) { 3735 /* Cached positive dentry: will open in f_op->open */ 3736 return dentry; 3737 } 3738 3739 if (open_flag & O_CREAT) 3740 audit_inode(nd->name, dir, AUDIT_INODE_PARENT); 3741 3742 /* 3743 * Checking write permission is tricky, bacuse we don't know if we are 3744 * going to actually need it: O_CREAT opens should work as long as the 3745 * file exists. But checking existence breaks atomicity. The trick is 3746 * to check access and if not granted clear O_CREAT from the flags. 3747 * 3748 * Another problem is returing the "right" error value (e.g. for an 3749 * O_EXCL open we want to return EEXIST not EROFS). 3750 */ 3751 if (unlikely(!got_write)) 3752 open_flag &= ~O_TRUNC; 3753 idmap = mnt_idmap(nd->path.mnt); 3754 if (open_flag & O_CREAT) { 3755 if (open_flag & O_EXCL) 3756 open_flag &= ~O_TRUNC; 3757 mode = vfs_prepare_mode(idmap, dir->d_inode, mode, mode, mode); 3758 if (likely(got_write)) 3759 create_error = may_o_create(idmap, &nd->path, 3760 dentry, mode); 3761 else 3762 create_error = -EROFS; 3763 } 3764 if (create_error) 3765 open_flag &= ~O_CREAT; 3766 if (dir_inode->i_op->atomic_open) { 3767 dentry = atomic_open(nd, dentry, file, open_flag, mode); 3768 if (unlikely(create_error) && dentry == ERR_PTR(-ENOENT)) 3769 dentry = ERR_PTR(create_error); 3770 return dentry; 3771 } 3772 3773 if (d_in_lookup(dentry)) { 3774 struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry, 3775 nd->flags); 3776 d_lookup_done(dentry); 3777 if (unlikely(res)) { 3778 if (IS_ERR(res)) { 3779 error = PTR_ERR(res); 3780 goto out_dput; 3781 } 3782 dput(dentry); 3783 dentry = res; 3784 } 3785 } 3786 3787 /* Negative dentry, just create the file */ 3788 if (!dentry->d_inode && (open_flag & O_CREAT)) { 3789 file->f_mode |= FMODE_CREATED; 3790 audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE); 3791 if (!dir_inode->i_op->create) { 3792 error = -EACCES; 3793 goto out_dput; 3794 } 3795 3796 error = dir_inode->i_op->create(idmap, dir_inode, dentry, 3797 mode, open_flag & O_EXCL); 3798 if (error) 3799 goto out_dput; 3800 } 3801 if (unlikely(create_error) && !dentry->d_inode) { 3802 error = create_error; 3803 goto out_dput; 3804 } 3805 return dentry; 3806 3807 out_dput: 3808 dput(dentry); 3809 return ERR_PTR(error); 3810 } 3811 3812 static inline bool trailing_slashes(struct nameidata *nd) 3813 { 3814 return (bool)nd->last.name[nd->last.len]; 3815 } 3816 3817 static struct dentry *lookup_fast_for_open(struct nameidata *nd, int open_flag) 3818 { 3819 struct dentry *dentry; 3820 3821 if (open_flag & O_CREAT) { 3822 if (trailing_slashes(nd)) 3823 return ERR_PTR(-EISDIR); 3824 3825 /* Don't bother on an O_EXCL create */ 3826 if (open_flag & O_EXCL) 3827 return NULL; 3828 } 3829 3830 if (trailing_slashes(nd)) 3831 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 3832 3833 dentry = lookup_fast(nd); 3834 if (IS_ERR_OR_NULL(dentry)) 3835 return dentry; 3836 3837 if (open_flag & O_CREAT) { 3838 /* Discard negative dentries. Need inode_lock to do the create */ 3839 if (!dentry->d_inode) { 3840 if (!(nd->flags & LOOKUP_RCU)) 3841 dput(dentry); 3842 dentry = NULL; 3843 } 3844 } 3845 return dentry; 3846 } 3847 3848 static const char *open_last_lookups(struct nameidata *nd, 3849 struct file *file, const struct open_flags *op) 3850 { 3851 struct dentry *dir = nd->path.dentry; 3852 int open_flag = op->open_flag; 3853 bool got_write = false; 3854 struct dentry *dentry; 3855 const char *res; 3856 3857 nd->flags |= op->intent; 3858 3859 if (nd->last_type != LAST_NORM) { 3860 if (nd->depth) 3861 put_link(nd); 3862 return handle_dots(nd, nd->last_type); 3863 } 3864 3865 /* We _can_ be in RCU mode here */ 3866 dentry = lookup_fast_for_open(nd, open_flag); 3867 if (IS_ERR(dentry)) 3868 return ERR_CAST(dentry); 3869 3870 if (likely(dentry)) 3871 goto finish_lookup; 3872 3873 if (!(open_flag & O_CREAT)) { 3874 if (WARN_ON_ONCE(nd->flags & LOOKUP_RCU)) 3875 return ERR_PTR(-ECHILD); 3876 } else { 3877 if (nd->flags & LOOKUP_RCU) { 3878 if (!try_to_unlazy(nd)) 3879 return ERR_PTR(-ECHILD); 3880 } 3881 } 3882 3883 if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) { 3884 got_write = !mnt_want_write(nd->path.mnt); 3885 /* 3886 * do _not_ fail yet - we might not need that or fail with 3887 * a different error; let lookup_open() decide; we'll be 3888 * dropping this one anyway. 3889 */ 3890 } 3891 if (open_flag & O_CREAT) 3892 inode_lock(dir->d_inode); 3893 else 3894 inode_lock_shared(dir->d_inode); 3895 dentry = lookup_open(nd, file, op, got_write); 3896 if (!IS_ERR(dentry)) { 3897 if (file->f_mode & FMODE_CREATED) 3898 fsnotify_create(dir->d_inode, dentry); 3899 if (file->f_mode & FMODE_OPENED) 3900 fsnotify_open(file); 3901 } 3902 if (open_flag & O_CREAT) 3903 inode_unlock(dir->d_inode); 3904 else 3905 inode_unlock_shared(dir->d_inode); 3906 3907 if (got_write) 3908 mnt_drop_write(nd->path.mnt); 3909 3910 if (IS_ERR(dentry)) 3911 return ERR_CAST(dentry); 3912 3913 if (file->f_mode & (FMODE_OPENED | FMODE_CREATED)) { 3914 dput(nd->path.dentry); 3915 nd->path.dentry = dentry; 3916 return NULL; 3917 } 3918 3919 finish_lookup: 3920 if (nd->depth) 3921 put_link(nd); 3922 res = step_into(nd, WALK_TRAILING, dentry); 3923 if (unlikely(res)) 3924 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL); 3925 return res; 3926 } 3927 3928 /* 3929 * Handle the last step of open() 3930 */ 3931 static int do_open(struct nameidata *nd, 3932 struct file *file, const struct open_flags *op) 3933 { 3934 struct mnt_idmap *idmap; 3935 int open_flag = op->open_flag; 3936 bool do_truncate; 3937 int acc_mode; 3938 int error; 3939 3940 if (!(file->f_mode & (FMODE_OPENED | FMODE_CREATED))) { 3941 error = complete_walk(nd); 3942 if (error) 3943 return error; 3944 } 3945 if (!(file->f_mode & FMODE_CREATED)) 3946 audit_inode(nd->name, nd->path.dentry, 0); 3947 idmap = mnt_idmap(nd->path.mnt); 3948 if (open_flag & O_CREAT) { 3949 if ((open_flag & O_EXCL) && !(file->f_mode & FMODE_CREATED)) 3950 return -EEXIST; 3951 if (d_is_dir(nd->path.dentry)) 3952 return -EISDIR; 3953 error = may_create_in_sticky(idmap, nd, 3954 d_backing_inode(nd->path.dentry)); 3955 if (unlikely(error)) 3956 return error; 3957 } 3958 if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry)) 3959 return -ENOTDIR; 3960 3961 do_truncate = false; 3962 acc_mode = op->acc_mode; 3963 if (file->f_mode & FMODE_CREATED) { 3964 /* Don't check for write permission, don't truncate */ 3965 open_flag &= ~O_TRUNC; 3966 acc_mode = 0; 3967 } else if (d_is_reg(nd->path.dentry) && open_flag & O_TRUNC) { 3968 error = mnt_want_write(nd->path.mnt); 3969 if (error) 3970 return error; 3971 do_truncate = true; 3972 } 3973 error = may_open(idmap, &nd->path, acc_mode, open_flag); 3974 if (!error && !(file->f_mode & FMODE_OPENED)) 3975 error = vfs_open(&nd->path, file); 3976 if (!error) 3977 error = security_file_post_open(file, op->acc_mode); 3978 if (!error && do_truncate) 3979 error = handle_truncate(idmap, file); 3980 if (unlikely(error > 0)) { 3981 WARN_ON(1); 3982 error = -EINVAL; 3983 } 3984 if (do_truncate) 3985 mnt_drop_write(nd->path.mnt); 3986 return error; 3987 } 3988 3989 /** 3990 * vfs_tmpfile - create tmpfile 3991 * @idmap: idmap of the mount the inode was found from 3992 * @parentpath: pointer to the path of the base directory 3993 * @file: file descriptor of the new tmpfile 3994 * @mode: mode of the new tmpfile 3995 * 3996 * Create a temporary file. 3997 * 3998 * If the inode has been found through an idmapped mount the idmap of 3999 * the vfsmount must be passed through @idmap. This function will then take 4000 * care to map the inode according to @idmap before checking permissions. 4001 * On non-idmapped mounts or if permission checking is to be performed on the 4002 * raw inode simply pass @nop_mnt_idmap. 4003 */ 4004 int vfs_tmpfile(struct mnt_idmap *idmap, 4005 const struct path *parentpath, 4006 struct file *file, umode_t mode) 4007 { 4008 struct dentry *child; 4009 struct inode *dir = d_inode(parentpath->dentry); 4010 struct inode *inode; 4011 int error; 4012 int open_flag = file->f_flags; 4013 4014 /* we want directory to be writable */ 4015 error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC); 4016 if (error) 4017 return error; 4018 if (!dir->i_op->tmpfile) 4019 return -EOPNOTSUPP; 4020 child = d_alloc(parentpath->dentry, &slash_name); 4021 if (unlikely(!child)) 4022 return -ENOMEM; 4023 file->__f_path.mnt = parentpath->mnt; 4024 file->__f_path.dentry = child; 4025 mode = vfs_prepare_mode(idmap, dir, mode, mode, mode); 4026 error = dir->i_op->tmpfile(idmap, dir, file, mode); 4027 dput(child); 4028 if (file->f_mode & FMODE_OPENED) 4029 fsnotify_open(file); 4030 if (error) 4031 return error; 4032 /* Don't check for other permissions, the inode was just created */ 4033 error = may_open(idmap, &file->f_path, 0, file->f_flags); 4034 if (error) 4035 return error; 4036 inode = file_inode(file); 4037 if (!(open_flag & O_EXCL)) { 4038 spin_lock(&inode->i_lock); 4039 inode->i_state |= I_LINKABLE; 4040 spin_unlock(&inode->i_lock); 4041 } 4042 security_inode_post_create_tmpfile(idmap, inode); 4043 return 0; 4044 } 4045 4046 /** 4047 * kernel_tmpfile_open - open a tmpfile for kernel internal use 4048 * @idmap: idmap of the mount the inode was found from 4049 * @parentpath: path of the base directory 4050 * @mode: mode of the new tmpfile 4051 * @open_flag: flags 4052 * @cred: credentials for open 4053 * 4054 * Create and open a temporary file. The file is not accounted in nr_files, 4055 * hence this is only for kernel internal use, and must not be installed into 4056 * file tables or such. 4057 */ 4058 struct file *kernel_tmpfile_open(struct mnt_idmap *idmap, 4059 const struct path *parentpath, 4060 umode_t mode, int open_flag, 4061 const struct cred *cred) 4062 { 4063 struct file *file; 4064 int error; 4065 4066 file = alloc_empty_file_noaccount(open_flag, cred); 4067 if (IS_ERR(file)) 4068 return file; 4069 4070 error = vfs_tmpfile(idmap, parentpath, file, mode); 4071 if (error) { 4072 fput(file); 4073 file = ERR_PTR(error); 4074 } 4075 return file; 4076 } 4077 EXPORT_SYMBOL(kernel_tmpfile_open); 4078 4079 static int do_tmpfile(struct nameidata *nd, unsigned flags, 4080 const struct open_flags *op, 4081 struct file *file) 4082 { 4083 struct path path; 4084 int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path); 4085 4086 if (unlikely(error)) 4087 return error; 4088 error = mnt_want_write(path.mnt); 4089 if (unlikely(error)) 4090 goto out; 4091 error = vfs_tmpfile(mnt_idmap(path.mnt), &path, file, op->mode); 4092 if (error) 4093 goto out2; 4094 audit_inode(nd->name, file->f_path.dentry, 0); 4095 out2: 4096 mnt_drop_write(path.mnt); 4097 out: 4098 path_put(&path); 4099 return error; 4100 } 4101 4102 static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file) 4103 { 4104 struct path path; 4105 int error = path_lookupat(nd, flags, &path); 4106 if (!error) { 4107 audit_inode(nd->name, path.dentry, 0); 4108 error = vfs_open(&path, file); 4109 path_put(&path); 4110 } 4111 return error; 4112 } 4113 4114 static struct file *path_openat(struct nameidata *nd, 4115 const struct open_flags *op, unsigned flags) 4116 { 4117 struct file *file; 4118 int error; 4119 4120 file = alloc_empty_file(op->open_flag, current_cred()); 4121 if (IS_ERR(file)) 4122 return file; 4123 4124 if (unlikely(file->f_flags & __O_TMPFILE)) { 4125 error = do_tmpfile(nd, flags, op, file); 4126 } else if (unlikely(file->f_flags & O_PATH)) { 4127 error = do_o_path(nd, flags, file); 4128 } else { 4129 const char *s = path_init(nd, flags); 4130 while (!(error = link_path_walk(s, nd)) && 4131 (s = open_last_lookups(nd, file, op)) != NULL) 4132 ; 4133 if (!error) 4134 error = do_open(nd, file, op); 4135 terminate_walk(nd); 4136 } 4137 if (likely(!error)) { 4138 if (likely(file->f_mode & FMODE_OPENED)) 4139 return file; 4140 WARN_ON(1); 4141 error = -EINVAL; 4142 } 4143 fput_close(file); 4144 if (error == -EOPENSTALE) { 4145 if (flags & LOOKUP_RCU) 4146 error = -ECHILD; 4147 else 4148 error = -ESTALE; 4149 } 4150 return ERR_PTR(error); 4151 } 4152 4153 struct file *do_filp_open(int dfd, struct filename *pathname, 4154 const struct open_flags *op) 4155 { 4156 struct nameidata nd; 4157 int flags = op->lookup_flags; 4158 struct file *filp; 4159 4160 set_nameidata(&nd, dfd, pathname, NULL); 4161 filp = path_openat(&nd, op, flags | LOOKUP_RCU); 4162 if (unlikely(filp == ERR_PTR(-ECHILD))) 4163 filp = path_openat(&nd, op, flags); 4164 if (unlikely(filp == ERR_PTR(-ESTALE))) 4165 filp = path_openat(&nd, op, flags | LOOKUP_REVAL); 4166 restore_nameidata(); 4167 return filp; 4168 } 4169 4170 struct file *do_file_open_root(const struct path *root, 4171 const char *name, const struct open_flags *op) 4172 { 4173 struct nameidata nd; 4174 struct file *file; 4175 struct filename *filename; 4176 int flags = op->lookup_flags; 4177 4178 if (d_is_symlink(root->dentry) && op->intent & LOOKUP_OPEN) 4179 return ERR_PTR(-ELOOP); 4180 4181 filename = getname_kernel(name); 4182 if (IS_ERR(filename)) 4183 return ERR_CAST(filename); 4184 4185 set_nameidata(&nd, -1, filename, root); 4186 file = path_openat(&nd, op, flags | LOOKUP_RCU); 4187 if (unlikely(file == ERR_PTR(-ECHILD))) 4188 file = path_openat(&nd, op, flags); 4189 if (unlikely(file == ERR_PTR(-ESTALE))) 4190 file = path_openat(&nd, op, flags | LOOKUP_REVAL); 4191 restore_nameidata(); 4192 putname(filename); 4193 return file; 4194 } 4195 4196 static struct dentry *filename_create(int dfd, struct filename *name, 4197 struct path *path, unsigned int lookup_flags) 4198 { 4199 struct dentry *dentry = ERR_PTR(-EEXIST); 4200 struct qstr last; 4201 bool want_dir = lookup_flags & LOOKUP_DIRECTORY; 4202 unsigned int reval_flag = lookup_flags & LOOKUP_REVAL; 4203 unsigned int create_flags = LOOKUP_CREATE | LOOKUP_EXCL; 4204 int type; 4205 int error; 4206 4207 error = filename_parentat(dfd, name, reval_flag, path, &last, &type); 4208 if (error) 4209 return ERR_PTR(error); 4210 4211 /* 4212 * Yucky last component or no last component at all? 4213 * (foo/., foo/.., /////) 4214 */ 4215 if (unlikely(type != LAST_NORM)) 4216 goto out; 4217 4218 /* don't fail immediately if it's r/o, at least try to report other errors */ 4219 error = mnt_want_write(path->mnt); 4220 /* 4221 * Do the final lookup. Suppress 'create' if there is a trailing 4222 * '/', and a directory wasn't requested. 4223 */ 4224 if (last.name[last.len] && !want_dir) 4225 create_flags &= ~LOOKUP_CREATE; 4226 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT); 4227 dentry = lookup_one_qstr_excl(&last, path->dentry, 4228 reval_flag | create_flags); 4229 if (IS_ERR(dentry)) 4230 goto unlock; 4231 4232 if (unlikely(error)) 4233 goto fail; 4234 4235 return dentry; 4236 fail: 4237 dput(dentry); 4238 dentry = ERR_PTR(error); 4239 unlock: 4240 inode_unlock(path->dentry->d_inode); 4241 if (!error) 4242 mnt_drop_write(path->mnt); 4243 out: 4244 path_put(path); 4245 return dentry; 4246 } 4247 4248 struct dentry *start_creating_path(int dfd, const char *pathname, 4249 struct path *path, unsigned int lookup_flags) 4250 { 4251 struct filename *filename = getname_kernel(pathname); 4252 struct dentry *res = filename_create(dfd, filename, path, lookup_flags); 4253 4254 putname(filename); 4255 return res; 4256 } 4257 EXPORT_SYMBOL(start_creating_path); 4258 4259 void end_creating_path(const struct path *path, struct dentry *dentry) 4260 { 4261 if (!IS_ERR(dentry)) 4262 dput(dentry); 4263 inode_unlock(path->dentry->d_inode); 4264 mnt_drop_write(path->mnt); 4265 path_put(path); 4266 } 4267 EXPORT_SYMBOL(end_creating_path); 4268 4269 inline struct dentry *start_creating_user_path( 4270 int dfd, const char __user *pathname, 4271 struct path *path, unsigned int lookup_flags) 4272 { 4273 struct filename *filename = getname(pathname); 4274 struct dentry *res = filename_create(dfd, filename, path, lookup_flags); 4275 4276 putname(filename); 4277 return res; 4278 } 4279 EXPORT_SYMBOL(start_creating_user_path); 4280 4281 /** 4282 * vfs_mknod - create device node or file 4283 * @idmap: idmap of the mount the inode was found from 4284 * @dir: inode of the parent directory 4285 * @dentry: dentry of the child device node 4286 * @mode: mode of the child device node 4287 * @dev: device number of device to create 4288 * 4289 * Create a device node or file. 4290 * 4291 * If the inode has been found through an idmapped mount the idmap of 4292 * the vfsmount must be passed through @idmap. This function will then take 4293 * care to map the inode according to @idmap before checking permissions. 4294 * On non-idmapped mounts or if permission checking is to be performed on the 4295 * raw inode simply pass @nop_mnt_idmap. 4296 */ 4297 int vfs_mknod(struct mnt_idmap *idmap, struct inode *dir, 4298 struct dentry *dentry, umode_t mode, dev_t dev) 4299 { 4300 bool is_whiteout = S_ISCHR(mode) && dev == WHITEOUT_DEV; 4301 int error = may_create(idmap, dir, dentry); 4302 4303 if (error) 4304 return error; 4305 4306 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !is_whiteout && 4307 !capable(CAP_MKNOD)) 4308 return -EPERM; 4309 4310 if (!dir->i_op->mknod) 4311 return -EPERM; 4312 4313 mode = vfs_prepare_mode(idmap, dir, mode, mode, mode); 4314 error = devcgroup_inode_mknod(mode, dev); 4315 if (error) 4316 return error; 4317 4318 error = security_inode_mknod(dir, dentry, mode, dev); 4319 if (error) 4320 return error; 4321 4322 error = dir->i_op->mknod(idmap, dir, dentry, mode, dev); 4323 if (!error) 4324 fsnotify_create(dir, dentry); 4325 return error; 4326 } 4327 EXPORT_SYMBOL(vfs_mknod); 4328 4329 static int may_mknod(umode_t mode) 4330 { 4331 switch (mode & S_IFMT) { 4332 case S_IFREG: 4333 case S_IFCHR: 4334 case S_IFBLK: 4335 case S_IFIFO: 4336 case S_IFSOCK: 4337 case 0: /* zero mode translates to S_IFREG */ 4338 return 0; 4339 case S_IFDIR: 4340 return -EPERM; 4341 default: 4342 return -EINVAL; 4343 } 4344 } 4345 4346 static int do_mknodat(int dfd, struct filename *name, umode_t mode, 4347 unsigned int dev) 4348 { 4349 struct mnt_idmap *idmap; 4350 struct dentry *dentry; 4351 struct path path; 4352 int error; 4353 unsigned int lookup_flags = 0; 4354 4355 error = may_mknod(mode); 4356 if (error) 4357 goto out1; 4358 retry: 4359 dentry = filename_create(dfd, name, &path, lookup_flags); 4360 error = PTR_ERR(dentry); 4361 if (IS_ERR(dentry)) 4362 goto out1; 4363 4364 error = security_path_mknod(&path, dentry, 4365 mode_strip_umask(path.dentry->d_inode, mode), dev); 4366 if (error) 4367 goto out2; 4368 4369 idmap = mnt_idmap(path.mnt); 4370 switch (mode & S_IFMT) { 4371 case 0: case S_IFREG: 4372 error = vfs_create(idmap, path.dentry->d_inode, 4373 dentry, mode, true); 4374 if (!error) 4375 security_path_post_mknod(idmap, dentry); 4376 break; 4377 case S_IFCHR: case S_IFBLK: 4378 error = vfs_mknod(idmap, path.dentry->d_inode, 4379 dentry, mode, new_decode_dev(dev)); 4380 break; 4381 case S_IFIFO: case S_IFSOCK: 4382 error = vfs_mknod(idmap, path.dentry->d_inode, 4383 dentry, mode, 0); 4384 break; 4385 } 4386 out2: 4387 end_creating_path(&path, dentry); 4388 if (retry_estale(error, lookup_flags)) { 4389 lookup_flags |= LOOKUP_REVAL; 4390 goto retry; 4391 } 4392 out1: 4393 putname(name); 4394 return error; 4395 } 4396 4397 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, 4398 unsigned int, dev) 4399 { 4400 return do_mknodat(dfd, getname(filename), mode, dev); 4401 } 4402 4403 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev) 4404 { 4405 return do_mknodat(AT_FDCWD, getname(filename), mode, dev); 4406 } 4407 4408 /** 4409 * vfs_mkdir - create directory returning correct dentry if possible 4410 * @idmap: idmap of the mount the inode was found from 4411 * @dir: inode of the parent directory 4412 * @dentry: dentry of the child directory 4413 * @mode: mode of the child directory 4414 * 4415 * Create a directory. 4416 * 4417 * If the inode has been found through an idmapped mount the idmap of 4418 * the vfsmount must be passed through @idmap. This function will then take 4419 * care to map the inode according to @idmap before checking permissions. 4420 * On non-idmapped mounts or if permission checking is to be performed on the 4421 * raw inode simply pass @nop_mnt_idmap. 4422 * 4423 * In the event that the filesystem does not use the *@dentry but leaves it 4424 * negative or unhashes it and possibly splices a different one returning it, 4425 * the original dentry is dput() and the alternate is returned. 4426 * 4427 * In case of an error the dentry is dput() and an ERR_PTR() is returned. 4428 */ 4429 struct dentry *vfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, 4430 struct dentry *dentry, umode_t mode) 4431 { 4432 int error; 4433 unsigned max_links = dir->i_sb->s_max_links; 4434 struct dentry *de; 4435 4436 error = may_create(idmap, dir, dentry); 4437 if (error) 4438 goto err; 4439 4440 error = -EPERM; 4441 if (!dir->i_op->mkdir) 4442 goto err; 4443 4444 mode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO | S_ISVTX, 0); 4445 error = security_inode_mkdir(dir, dentry, mode); 4446 if (error) 4447 goto err; 4448 4449 error = -EMLINK; 4450 if (max_links && dir->i_nlink >= max_links) 4451 goto err; 4452 4453 de = dir->i_op->mkdir(idmap, dir, dentry, mode); 4454 error = PTR_ERR(de); 4455 if (IS_ERR(de)) 4456 goto err; 4457 if (de) { 4458 dput(dentry); 4459 dentry = de; 4460 } 4461 fsnotify_mkdir(dir, dentry); 4462 return dentry; 4463 4464 err: 4465 dput(dentry); 4466 return ERR_PTR(error); 4467 } 4468 EXPORT_SYMBOL(vfs_mkdir); 4469 4470 int do_mkdirat(int dfd, struct filename *name, umode_t mode) 4471 { 4472 struct dentry *dentry; 4473 struct path path; 4474 int error; 4475 unsigned int lookup_flags = LOOKUP_DIRECTORY; 4476 4477 retry: 4478 dentry = filename_create(dfd, name, &path, lookup_flags); 4479 error = PTR_ERR(dentry); 4480 if (IS_ERR(dentry)) 4481 goto out_putname; 4482 4483 error = security_path_mkdir(&path, dentry, 4484 mode_strip_umask(path.dentry->d_inode, mode)); 4485 if (!error) { 4486 dentry = vfs_mkdir(mnt_idmap(path.mnt), path.dentry->d_inode, 4487 dentry, mode); 4488 if (IS_ERR(dentry)) 4489 error = PTR_ERR(dentry); 4490 } 4491 end_creating_path(&path, dentry); 4492 if (retry_estale(error, lookup_flags)) { 4493 lookup_flags |= LOOKUP_REVAL; 4494 goto retry; 4495 } 4496 out_putname: 4497 putname(name); 4498 return error; 4499 } 4500 4501 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) 4502 { 4503 return do_mkdirat(dfd, getname(pathname), mode); 4504 } 4505 4506 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode) 4507 { 4508 return do_mkdirat(AT_FDCWD, getname(pathname), mode); 4509 } 4510 4511 /** 4512 * vfs_rmdir - remove directory 4513 * @idmap: idmap of the mount the inode was found from 4514 * @dir: inode of the parent directory 4515 * @dentry: dentry of the child directory 4516 * 4517 * Remove a directory. 4518 * 4519 * If the inode has been found through an idmapped mount the idmap of 4520 * the vfsmount must be passed through @idmap. This function will then take 4521 * care to map the inode according to @idmap before checking permissions. 4522 * On non-idmapped mounts or if permission checking is to be performed on the 4523 * raw inode simply pass @nop_mnt_idmap. 4524 */ 4525 int vfs_rmdir(struct mnt_idmap *idmap, struct inode *dir, 4526 struct dentry *dentry) 4527 { 4528 int error = may_delete(idmap, dir, dentry, 1); 4529 4530 if (error) 4531 return error; 4532 4533 if (!dir->i_op->rmdir) 4534 return -EPERM; 4535 4536 dget(dentry); 4537 inode_lock(dentry->d_inode); 4538 4539 error = -EBUSY; 4540 if (is_local_mountpoint(dentry) || 4541 (dentry->d_inode->i_flags & S_KERNEL_FILE)) 4542 goto out; 4543 4544 error = security_inode_rmdir(dir, dentry); 4545 if (error) 4546 goto out; 4547 4548 error = dir->i_op->rmdir(dir, dentry); 4549 if (error) 4550 goto out; 4551 4552 shrink_dcache_parent(dentry); 4553 dentry->d_inode->i_flags |= S_DEAD; 4554 dont_mount(dentry); 4555 detach_mounts(dentry); 4556 4557 out: 4558 inode_unlock(dentry->d_inode); 4559 dput(dentry); 4560 if (!error) 4561 d_delete_notify(dir, dentry); 4562 return error; 4563 } 4564 EXPORT_SYMBOL(vfs_rmdir); 4565 4566 int do_rmdir(int dfd, struct filename *name) 4567 { 4568 int error; 4569 struct dentry *dentry; 4570 struct path path; 4571 struct qstr last; 4572 int type; 4573 unsigned int lookup_flags = 0; 4574 retry: 4575 error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type); 4576 if (error) 4577 goto exit1; 4578 4579 switch (type) { 4580 case LAST_DOTDOT: 4581 error = -ENOTEMPTY; 4582 goto exit2; 4583 case LAST_DOT: 4584 error = -EINVAL; 4585 goto exit2; 4586 case LAST_ROOT: 4587 error = -EBUSY; 4588 goto exit2; 4589 } 4590 4591 error = mnt_want_write(path.mnt); 4592 if (error) 4593 goto exit2; 4594 4595 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT); 4596 dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags); 4597 error = PTR_ERR(dentry); 4598 if (IS_ERR(dentry)) 4599 goto exit3; 4600 error = security_path_rmdir(&path, dentry); 4601 if (error) 4602 goto exit4; 4603 error = vfs_rmdir(mnt_idmap(path.mnt), path.dentry->d_inode, dentry); 4604 exit4: 4605 dput(dentry); 4606 exit3: 4607 inode_unlock(path.dentry->d_inode); 4608 mnt_drop_write(path.mnt); 4609 exit2: 4610 path_put(&path); 4611 if (retry_estale(error, lookup_flags)) { 4612 lookup_flags |= LOOKUP_REVAL; 4613 goto retry; 4614 } 4615 exit1: 4616 putname(name); 4617 return error; 4618 } 4619 4620 SYSCALL_DEFINE1(rmdir, const char __user *, pathname) 4621 { 4622 return do_rmdir(AT_FDCWD, getname(pathname)); 4623 } 4624 4625 /** 4626 * vfs_unlink - unlink a filesystem object 4627 * @idmap: idmap of the mount the inode was found from 4628 * @dir: parent directory 4629 * @dentry: victim 4630 * @delegated_inode: returns victim inode, if the inode is delegated. 4631 * 4632 * The caller must hold dir->i_rwsem exclusively. 4633 * 4634 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and 4635 * return a reference to the inode in delegated_inode. The caller 4636 * should then break the delegation on that inode and retry. Because 4637 * breaking a delegation may take a long time, the caller should drop 4638 * dir->i_rwsem before doing so. 4639 * 4640 * Alternatively, a caller may pass NULL for delegated_inode. This may 4641 * be appropriate for callers that expect the underlying filesystem not 4642 * to be NFS exported. 4643 * 4644 * If the inode has been found through an idmapped mount the idmap of 4645 * the vfsmount must be passed through @idmap. This function will then take 4646 * care to map the inode according to @idmap before checking permissions. 4647 * On non-idmapped mounts or if permission checking is to be performed on the 4648 * raw inode simply pass @nop_mnt_idmap. 4649 */ 4650 int vfs_unlink(struct mnt_idmap *idmap, struct inode *dir, 4651 struct dentry *dentry, struct inode **delegated_inode) 4652 { 4653 struct inode *target = dentry->d_inode; 4654 int error = may_delete(idmap, dir, dentry, 0); 4655 4656 if (error) 4657 return error; 4658 4659 if (!dir->i_op->unlink) 4660 return -EPERM; 4661 4662 inode_lock(target); 4663 if (IS_SWAPFILE(target)) 4664 error = -EPERM; 4665 else if (is_local_mountpoint(dentry)) 4666 error = -EBUSY; 4667 else { 4668 error = security_inode_unlink(dir, dentry); 4669 if (!error) { 4670 error = try_break_deleg(target, delegated_inode); 4671 if (error) 4672 goto out; 4673 error = dir->i_op->unlink(dir, dentry); 4674 if (!error) { 4675 dont_mount(dentry); 4676 detach_mounts(dentry); 4677 } 4678 } 4679 } 4680 out: 4681 inode_unlock(target); 4682 4683 /* We don't d_delete() NFS sillyrenamed files--they still exist. */ 4684 if (!error && dentry->d_flags & DCACHE_NFSFS_RENAMED) { 4685 fsnotify_unlink(dir, dentry); 4686 } else if (!error) { 4687 fsnotify_link_count(target); 4688 d_delete_notify(dir, dentry); 4689 } 4690 4691 return error; 4692 } 4693 EXPORT_SYMBOL(vfs_unlink); 4694 4695 /* 4696 * Make sure that the actual truncation of the file will occur outside its 4697 * directory's i_rwsem. Truncate can take a long time if there is a lot of 4698 * writeout happening, and we don't want to prevent access to the directory 4699 * while waiting on the I/O. 4700 */ 4701 int do_unlinkat(int dfd, struct filename *name) 4702 { 4703 int error; 4704 struct dentry *dentry; 4705 struct path path; 4706 struct qstr last; 4707 int type; 4708 struct inode *inode = NULL; 4709 struct inode *delegated_inode = NULL; 4710 unsigned int lookup_flags = 0; 4711 retry: 4712 error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type); 4713 if (error) 4714 goto exit1; 4715 4716 error = -EISDIR; 4717 if (type != LAST_NORM) 4718 goto exit2; 4719 4720 error = mnt_want_write(path.mnt); 4721 if (error) 4722 goto exit2; 4723 retry_deleg: 4724 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT); 4725 dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags); 4726 error = PTR_ERR(dentry); 4727 if (!IS_ERR(dentry)) { 4728 4729 /* Why not before? Because we want correct error value */ 4730 if (last.name[last.len]) 4731 goto slashes; 4732 inode = dentry->d_inode; 4733 ihold(inode); 4734 error = security_path_unlink(&path, dentry); 4735 if (error) 4736 goto exit3; 4737 error = vfs_unlink(mnt_idmap(path.mnt), path.dentry->d_inode, 4738 dentry, &delegated_inode); 4739 exit3: 4740 dput(dentry); 4741 } 4742 inode_unlock(path.dentry->d_inode); 4743 if (inode) 4744 iput(inode); /* truncate the inode here */ 4745 inode = NULL; 4746 if (delegated_inode) { 4747 error = break_deleg_wait(&delegated_inode); 4748 if (!error) 4749 goto retry_deleg; 4750 } 4751 mnt_drop_write(path.mnt); 4752 exit2: 4753 path_put(&path); 4754 if (retry_estale(error, lookup_flags)) { 4755 lookup_flags |= LOOKUP_REVAL; 4756 inode = NULL; 4757 goto retry; 4758 } 4759 exit1: 4760 putname(name); 4761 return error; 4762 4763 slashes: 4764 if (d_is_dir(dentry)) 4765 error = -EISDIR; 4766 else 4767 error = -ENOTDIR; 4768 goto exit3; 4769 } 4770 4771 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) 4772 { 4773 if ((flag & ~AT_REMOVEDIR) != 0) 4774 return -EINVAL; 4775 4776 if (flag & AT_REMOVEDIR) 4777 return do_rmdir(dfd, getname(pathname)); 4778 return do_unlinkat(dfd, getname(pathname)); 4779 } 4780 4781 SYSCALL_DEFINE1(unlink, const char __user *, pathname) 4782 { 4783 return do_unlinkat(AT_FDCWD, getname(pathname)); 4784 } 4785 4786 /** 4787 * vfs_symlink - create symlink 4788 * @idmap: idmap of the mount the inode was found from 4789 * @dir: inode of the parent directory 4790 * @dentry: dentry of the child symlink file 4791 * @oldname: name of the file to link to 4792 * 4793 * Create a symlink. 4794 * 4795 * If the inode has been found through an idmapped mount the idmap of 4796 * the vfsmount must be passed through @idmap. This function will then take 4797 * care to map the inode according to @idmap before checking permissions. 4798 * On non-idmapped mounts or if permission checking is to be performed on the 4799 * raw inode simply pass @nop_mnt_idmap. 4800 */ 4801 int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir, 4802 struct dentry *dentry, const char *oldname) 4803 { 4804 int error; 4805 4806 error = may_create(idmap, dir, dentry); 4807 if (error) 4808 return error; 4809 4810 if (!dir->i_op->symlink) 4811 return -EPERM; 4812 4813 error = security_inode_symlink(dir, dentry, oldname); 4814 if (error) 4815 return error; 4816 4817 error = dir->i_op->symlink(idmap, dir, dentry, oldname); 4818 if (!error) 4819 fsnotify_create(dir, dentry); 4820 return error; 4821 } 4822 EXPORT_SYMBOL(vfs_symlink); 4823 4824 int do_symlinkat(struct filename *from, int newdfd, struct filename *to) 4825 { 4826 int error; 4827 struct dentry *dentry; 4828 struct path path; 4829 unsigned int lookup_flags = 0; 4830 4831 if (IS_ERR(from)) { 4832 error = PTR_ERR(from); 4833 goto out_putnames; 4834 } 4835 retry: 4836 dentry = filename_create(newdfd, to, &path, lookup_flags); 4837 error = PTR_ERR(dentry); 4838 if (IS_ERR(dentry)) 4839 goto out_putnames; 4840 4841 error = security_path_symlink(&path, dentry, from->name); 4842 if (!error) 4843 error = vfs_symlink(mnt_idmap(path.mnt), path.dentry->d_inode, 4844 dentry, from->name); 4845 end_creating_path(&path, dentry); 4846 if (retry_estale(error, lookup_flags)) { 4847 lookup_flags |= LOOKUP_REVAL; 4848 goto retry; 4849 } 4850 out_putnames: 4851 putname(to); 4852 putname(from); 4853 return error; 4854 } 4855 4856 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, 4857 int, newdfd, const char __user *, newname) 4858 { 4859 return do_symlinkat(getname(oldname), newdfd, getname(newname)); 4860 } 4861 4862 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) 4863 { 4864 return do_symlinkat(getname(oldname), AT_FDCWD, getname(newname)); 4865 } 4866 4867 /** 4868 * vfs_link - create a new link 4869 * @old_dentry: object to be linked 4870 * @idmap: idmap of the mount 4871 * @dir: new parent 4872 * @new_dentry: where to create the new link 4873 * @delegated_inode: returns inode needing a delegation break 4874 * 4875 * The caller must hold dir->i_rwsem exclusively. 4876 * 4877 * If vfs_link discovers a delegation on the to-be-linked file in need 4878 * of breaking, it will return -EWOULDBLOCK and return a reference to the 4879 * inode in delegated_inode. The caller should then break the delegation 4880 * and retry. Because breaking a delegation may take a long time, the 4881 * caller should drop the i_rwsem before doing so. 4882 * 4883 * Alternatively, a caller may pass NULL for delegated_inode. This may 4884 * be appropriate for callers that expect the underlying filesystem not 4885 * to be NFS exported. 4886 * 4887 * If the inode has been found through an idmapped mount the idmap of 4888 * the vfsmount must be passed through @idmap. This function will then take 4889 * care to map the inode according to @idmap before checking permissions. 4890 * On non-idmapped mounts or if permission checking is to be performed on the 4891 * raw inode simply pass @nop_mnt_idmap. 4892 */ 4893 int vfs_link(struct dentry *old_dentry, struct mnt_idmap *idmap, 4894 struct inode *dir, struct dentry *new_dentry, 4895 struct inode **delegated_inode) 4896 { 4897 struct inode *inode = old_dentry->d_inode; 4898 unsigned max_links = dir->i_sb->s_max_links; 4899 int error; 4900 4901 if (!inode) 4902 return -ENOENT; 4903 4904 error = may_create(idmap, dir, new_dentry); 4905 if (error) 4906 return error; 4907 4908 if (dir->i_sb != inode->i_sb) 4909 return -EXDEV; 4910 4911 /* 4912 * A link to an append-only or immutable file cannot be created. 4913 */ 4914 if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) 4915 return -EPERM; 4916 /* 4917 * Updating the link count will likely cause i_uid and i_gid to 4918 * be written back improperly if their true value is unknown to 4919 * the vfs. 4920 */ 4921 if (HAS_UNMAPPED_ID(idmap, inode)) 4922 return -EPERM; 4923 if (!dir->i_op->link) 4924 return -EPERM; 4925 if (S_ISDIR(inode->i_mode)) 4926 return -EPERM; 4927 4928 error = security_inode_link(old_dentry, dir, new_dentry); 4929 if (error) 4930 return error; 4931 4932 inode_lock(inode); 4933 /* Make sure we don't allow creating hardlink to an unlinked file */ 4934 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE)) 4935 error = -ENOENT; 4936 else if (max_links && inode->i_nlink >= max_links) 4937 error = -EMLINK; 4938 else { 4939 error = try_break_deleg(inode, delegated_inode); 4940 if (!error) 4941 error = dir->i_op->link(old_dentry, dir, new_dentry); 4942 } 4943 4944 if (!error && (inode->i_state & I_LINKABLE)) { 4945 spin_lock(&inode->i_lock); 4946 inode->i_state &= ~I_LINKABLE; 4947 spin_unlock(&inode->i_lock); 4948 } 4949 inode_unlock(inode); 4950 if (!error) 4951 fsnotify_link(dir, inode, new_dentry); 4952 return error; 4953 } 4954 EXPORT_SYMBOL(vfs_link); 4955 4956 /* 4957 * Hardlinks are often used in delicate situations. We avoid 4958 * security-related surprises by not following symlinks on the 4959 * newname. --KAB 4960 * 4961 * We don't follow them on the oldname either to be compatible 4962 * with linux 2.0, and to avoid hard-linking to directories 4963 * and other special files. --ADM 4964 */ 4965 int do_linkat(int olddfd, struct filename *old, int newdfd, 4966 struct filename *new, int flags) 4967 { 4968 struct mnt_idmap *idmap; 4969 struct dentry *new_dentry; 4970 struct path old_path, new_path; 4971 struct inode *delegated_inode = NULL; 4972 int how = 0; 4973 int error; 4974 4975 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) { 4976 error = -EINVAL; 4977 goto out_putnames; 4978 } 4979 /* 4980 * To use null names we require CAP_DAC_READ_SEARCH or 4981 * that the open-time creds of the dfd matches current. 4982 * This ensures that not everyone will be able to create 4983 * a hardlink using the passed file descriptor. 4984 */ 4985 if (flags & AT_EMPTY_PATH) 4986 how |= LOOKUP_LINKAT_EMPTY; 4987 4988 if (flags & AT_SYMLINK_FOLLOW) 4989 how |= LOOKUP_FOLLOW; 4990 retry: 4991 error = filename_lookup(olddfd, old, how, &old_path, NULL); 4992 if (error) 4993 goto out_putnames; 4994 4995 new_dentry = filename_create(newdfd, new, &new_path, 4996 (how & LOOKUP_REVAL)); 4997 error = PTR_ERR(new_dentry); 4998 if (IS_ERR(new_dentry)) 4999 goto out_putpath; 5000 5001 error = -EXDEV; 5002 if (old_path.mnt != new_path.mnt) 5003 goto out_dput; 5004 idmap = mnt_idmap(new_path.mnt); 5005 error = may_linkat(idmap, &old_path); 5006 if (unlikely(error)) 5007 goto out_dput; 5008 error = security_path_link(old_path.dentry, &new_path, new_dentry); 5009 if (error) 5010 goto out_dput; 5011 error = vfs_link(old_path.dentry, idmap, new_path.dentry->d_inode, 5012 new_dentry, &delegated_inode); 5013 out_dput: 5014 end_creating_path(&new_path, new_dentry); 5015 if (delegated_inode) { 5016 error = break_deleg_wait(&delegated_inode); 5017 if (!error) { 5018 path_put(&old_path); 5019 goto retry; 5020 } 5021 } 5022 if (retry_estale(error, how)) { 5023 path_put(&old_path); 5024 how |= LOOKUP_REVAL; 5025 goto retry; 5026 } 5027 out_putpath: 5028 path_put(&old_path); 5029 out_putnames: 5030 putname(old); 5031 putname(new); 5032 5033 return error; 5034 } 5035 5036 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, 5037 int, newdfd, const char __user *, newname, int, flags) 5038 { 5039 return do_linkat(olddfd, getname_uflags(oldname, flags), 5040 newdfd, getname(newname), flags); 5041 } 5042 5043 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) 5044 { 5045 return do_linkat(AT_FDCWD, getname(oldname), AT_FDCWD, getname(newname), 0); 5046 } 5047 5048 /** 5049 * vfs_rename - rename a filesystem object 5050 * @rd: pointer to &struct renamedata info 5051 * 5052 * The caller must hold multiple mutexes--see lock_rename()). 5053 * 5054 * If vfs_rename discovers a delegation in need of breaking at either 5055 * the source or destination, it will return -EWOULDBLOCK and return a 5056 * reference to the inode in delegated_inode. The caller should then 5057 * break the delegation and retry. Because breaking a delegation may 5058 * take a long time, the caller should drop all locks before doing 5059 * so. 5060 * 5061 * Alternatively, a caller may pass NULL for delegated_inode. This may 5062 * be appropriate for callers that expect the underlying filesystem not 5063 * to be NFS exported. 5064 * 5065 * The worst of all namespace operations - renaming directory. "Perverted" 5066 * doesn't even start to describe it. Somebody in UCB had a heck of a trip... 5067 * Problems: 5068 * 5069 * a) we can get into loop creation. 5070 * b) race potential - two innocent renames can create a loop together. 5071 * That's where 4.4BSD screws up. Current fix: serialization on 5072 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another 5073 * story. 5074 * c) we may have to lock up to _four_ objects - parents and victim (if it exists), 5075 * and source (if it's a non-directory or a subdirectory that moves to 5076 * different parent). 5077 * And that - after we got ->i_rwsem on parents (until then we don't know 5078 * whether the target exists). Solution: try to be smart with locking 5079 * order for inodes. We rely on the fact that tree topology may change 5080 * only under ->s_vfs_rename_mutex _and_ that parent of the object we 5081 * move will be locked. Thus we can rank directories by the tree 5082 * (ancestors first) and rank all non-directories after them. 5083 * That works since everybody except rename does "lock parent, lookup, 5084 * lock child" and rename is under ->s_vfs_rename_mutex. 5085 * HOWEVER, it relies on the assumption that any object with ->lookup() 5086 * has no more than 1 dentry. If "hybrid" objects will ever appear, 5087 * we'd better make sure that there's no link(2) for them. 5088 * d) conversion from fhandle to dentry may come in the wrong moment - when 5089 * we are removing the target. Solution: we will have to grab ->i_rwsem 5090 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on 5091 * ->i_rwsem on parents, which works but leads to some truly excessive 5092 * locking]. 5093 */ 5094 int vfs_rename(struct renamedata *rd) 5095 { 5096 int error; 5097 struct inode *old_dir = d_inode(rd->old_parent); 5098 struct inode *new_dir = d_inode(rd->new_parent); 5099 struct dentry *old_dentry = rd->old_dentry; 5100 struct dentry *new_dentry = rd->new_dentry; 5101 struct inode **delegated_inode = rd->delegated_inode; 5102 unsigned int flags = rd->flags; 5103 bool is_dir = d_is_dir(old_dentry); 5104 struct inode *source = old_dentry->d_inode; 5105 struct inode *target = new_dentry->d_inode; 5106 bool new_is_dir = false; 5107 unsigned max_links = new_dir->i_sb->s_max_links; 5108 struct name_snapshot old_name; 5109 bool lock_old_subdir, lock_new_subdir; 5110 5111 if (source == target) 5112 return 0; 5113 5114 error = may_delete(rd->mnt_idmap, old_dir, old_dentry, is_dir); 5115 if (error) 5116 return error; 5117 5118 if (!target) { 5119 error = may_create(rd->mnt_idmap, new_dir, new_dentry); 5120 } else { 5121 new_is_dir = d_is_dir(new_dentry); 5122 5123 if (!(flags & RENAME_EXCHANGE)) 5124 error = may_delete(rd->mnt_idmap, new_dir, 5125 new_dentry, is_dir); 5126 else 5127 error = may_delete(rd->mnt_idmap, new_dir, 5128 new_dentry, new_is_dir); 5129 } 5130 if (error) 5131 return error; 5132 5133 if (!old_dir->i_op->rename) 5134 return -EPERM; 5135 5136 /* 5137 * If we are going to change the parent - check write permissions, 5138 * we'll need to flip '..'. 5139 */ 5140 if (new_dir != old_dir) { 5141 if (is_dir) { 5142 error = inode_permission(rd->mnt_idmap, source, 5143 MAY_WRITE); 5144 if (error) 5145 return error; 5146 } 5147 if ((flags & RENAME_EXCHANGE) && new_is_dir) { 5148 error = inode_permission(rd->mnt_idmap, target, 5149 MAY_WRITE); 5150 if (error) 5151 return error; 5152 } 5153 } 5154 5155 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry, 5156 flags); 5157 if (error) 5158 return error; 5159 5160 take_dentry_name_snapshot(&old_name, old_dentry); 5161 dget(new_dentry); 5162 /* 5163 * Lock children. 5164 * The source subdirectory needs to be locked on cross-directory 5165 * rename or cross-directory exchange since its parent changes. 5166 * The target subdirectory needs to be locked on cross-directory 5167 * exchange due to parent change and on any rename due to becoming 5168 * a victim. 5169 * Non-directories need locking in all cases (for NFS reasons); 5170 * they get locked after any subdirectories (in inode address order). 5171 * 5172 * NOTE: WE ONLY LOCK UNRELATED DIRECTORIES IN CROSS-DIRECTORY CASE. 5173 * NEVER, EVER DO THAT WITHOUT ->s_vfs_rename_mutex. 5174 */ 5175 lock_old_subdir = new_dir != old_dir; 5176 lock_new_subdir = new_dir != old_dir || !(flags & RENAME_EXCHANGE); 5177 if (is_dir) { 5178 if (lock_old_subdir) 5179 inode_lock_nested(source, I_MUTEX_CHILD); 5180 if (target && (!new_is_dir || lock_new_subdir)) 5181 inode_lock(target); 5182 } else if (new_is_dir) { 5183 if (lock_new_subdir) 5184 inode_lock_nested(target, I_MUTEX_CHILD); 5185 inode_lock(source); 5186 } else { 5187 lock_two_nondirectories(source, target); 5188 } 5189 5190 error = -EPERM; 5191 if (IS_SWAPFILE(source) || (target && IS_SWAPFILE(target))) 5192 goto out; 5193 5194 error = -EBUSY; 5195 if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry)) 5196 goto out; 5197 5198 if (max_links && new_dir != old_dir) { 5199 error = -EMLINK; 5200 if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links) 5201 goto out; 5202 if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir && 5203 old_dir->i_nlink >= max_links) 5204 goto out; 5205 } 5206 if (!is_dir) { 5207 error = try_break_deleg(source, delegated_inode); 5208 if (error) 5209 goto out; 5210 } 5211 if (target && !new_is_dir) { 5212 error = try_break_deleg(target, delegated_inode); 5213 if (error) 5214 goto out; 5215 } 5216 error = old_dir->i_op->rename(rd->mnt_idmap, old_dir, old_dentry, 5217 new_dir, new_dentry, flags); 5218 if (error) 5219 goto out; 5220 5221 if (!(flags & RENAME_EXCHANGE) && target) { 5222 if (is_dir) { 5223 shrink_dcache_parent(new_dentry); 5224 target->i_flags |= S_DEAD; 5225 } 5226 dont_mount(new_dentry); 5227 detach_mounts(new_dentry); 5228 } 5229 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) { 5230 if (!(flags & RENAME_EXCHANGE)) 5231 d_move(old_dentry, new_dentry); 5232 else 5233 d_exchange(old_dentry, new_dentry); 5234 } 5235 out: 5236 if (!is_dir || lock_old_subdir) 5237 inode_unlock(source); 5238 if (target && (!new_is_dir || lock_new_subdir)) 5239 inode_unlock(target); 5240 dput(new_dentry); 5241 if (!error) { 5242 fsnotify_move(old_dir, new_dir, &old_name.name, is_dir, 5243 !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry); 5244 if (flags & RENAME_EXCHANGE) { 5245 fsnotify_move(new_dir, old_dir, &old_dentry->d_name, 5246 new_is_dir, NULL, new_dentry); 5247 } 5248 } 5249 release_dentry_name_snapshot(&old_name); 5250 5251 return error; 5252 } 5253 EXPORT_SYMBOL(vfs_rename); 5254 5255 int do_renameat2(int olddfd, struct filename *from, int newdfd, 5256 struct filename *to, unsigned int flags) 5257 { 5258 struct renamedata rd; 5259 struct dentry *old_dentry, *new_dentry; 5260 struct dentry *trap; 5261 struct path old_path, new_path; 5262 struct qstr old_last, new_last; 5263 int old_type, new_type; 5264 struct inode *delegated_inode = NULL; 5265 unsigned int lookup_flags = 0, target_flags = 5266 LOOKUP_RENAME_TARGET | LOOKUP_CREATE; 5267 bool should_retry = false; 5268 int error = -EINVAL; 5269 5270 if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT)) 5271 goto put_names; 5272 5273 if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) && 5274 (flags & RENAME_EXCHANGE)) 5275 goto put_names; 5276 5277 if (flags & RENAME_EXCHANGE) 5278 target_flags = 0; 5279 if (flags & RENAME_NOREPLACE) 5280 target_flags |= LOOKUP_EXCL; 5281 5282 retry: 5283 error = filename_parentat(olddfd, from, lookup_flags, &old_path, 5284 &old_last, &old_type); 5285 if (error) 5286 goto put_names; 5287 5288 error = filename_parentat(newdfd, to, lookup_flags, &new_path, &new_last, 5289 &new_type); 5290 if (error) 5291 goto exit1; 5292 5293 error = -EXDEV; 5294 if (old_path.mnt != new_path.mnt) 5295 goto exit2; 5296 5297 error = -EBUSY; 5298 if (old_type != LAST_NORM) 5299 goto exit2; 5300 5301 if (flags & RENAME_NOREPLACE) 5302 error = -EEXIST; 5303 if (new_type != LAST_NORM) 5304 goto exit2; 5305 5306 error = mnt_want_write(old_path.mnt); 5307 if (error) 5308 goto exit2; 5309 5310 retry_deleg: 5311 trap = lock_rename(new_path.dentry, old_path.dentry); 5312 if (IS_ERR(trap)) { 5313 error = PTR_ERR(trap); 5314 goto exit_lock_rename; 5315 } 5316 5317 old_dentry = lookup_one_qstr_excl(&old_last, old_path.dentry, 5318 lookup_flags); 5319 error = PTR_ERR(old_dentry); 5320 if (IS_ERR(old_dentry)) 5321 goto exit3; 5322 new_dentry = lookup_one_qstr_excl(&new_last, new_path.dentry, 5323 lookup_flags | target_flags); 5324 error = PTR_ERR(new_dentry); 5325 if (IS_ERR(new_dentry)) 5326 goto exit4; 5327 if (flags & RENAME_EXCHANGE) { 5328 if (!d_is_dir(new_dentry)) { 5329 error = -ENOTDIR; 5330 if (new_last.name[new_last.len]) 5331 goto exit5; 5332 } 5333 } 5334 /* unless the source is a directory trailing slashes give -ENOTDIR */ 5335 if (!d_is_dir(old_dentry)) { 5336 error = -ENOTDIR; 5337 if (old_last.name[old_last.len]) 5338 goto exit5; 5339 if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len]) 5340 goto exit5; 5341 } 5342 /* source should not be ancestor of target */ 5343 error = -EINVAL; 5344 if (old_dentry == trap) 5345 goto exit5; 5346 /* target should not be an ancestor of source */ 5347 if (!(flags & RENAME_EXCHANGE)) 5348 error = -ENOTEMPTY; 5349 if (new_dentry == trap) 5350 goto exit5; 5351 5352 error = security_path_rename(&old_path, old_dentry, 5353 &new_path, new_dentry, flags); 5354 if (error) 5355 goto exit5; 5356 5357 rd.old_parent = old_path.dentry; 5358 rd.old_dentry = old_dentry; 5359 rd.mnt_idmap = mnt_idmap(old_path.mnt); 5360 rd.new_parent = new_path.dentry; 5361 rd.new_dentry = new_dentry; 5362 rd.delegated_inode = &delegated_inode; 5363 rd.flags = flags; 5364 error = vfs_rename(&rd); 5365 exit5: 5366 dput(new_dentry); 5367 exit4: 5368 dput(old_dentry); 5369 exit3: 5370 unlock_rename(new_path.dentry, old_path.dentry); 5371 exit_lock_rename: 5372 if (delegated_inode) { 5373 error = break_deleg_wait(&delegated_inode); 5374 if (!error) 5375 goto retry_deleg; 5376 } 5377 mnt_drop_write(old_path.mnt); 5378 exit2: 5379 if (retry_estale(error, lookup_flags)) 5380 should_retry = true; 5381 path_put(&new_path); 5382 exit1: 5383 path_put(&old_path); 5384 if (should_retry) { 5385 should_retry = false; 5386 lookup_flags |= LOOKUP_REVAL; 5387 goto retry; 5388 } 5389 put_names: 5390 putname(from); 5391 putname(to); 5392 return error; 5393 } 5394 5395 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname, 5396 int, newdfd, const char __user *, newname, unsigned int, flags) 5397 { 5398 return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname), 5399 flags); 5400 } 5401 5402 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, 5403 int, newdfd, const char __user *, newname) 5404 { 5405 return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname), 5406 0); 5407 } 5408 5409 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) 5410 { 5411 return do_renameat2(AT_FDCWD, getname(oldname), AT_FDCWD, 5412 getname(newname), 0); 5413 } 5414 5415 int readlink_copy(char __user *buffer, int buflen, const char *link, int linklen) 5416 { 5417 int copylen; 5418 5419 copylen = linklen; 5420 if (unlikely(copylen > (unsigned) buflen)) 5421 copylen = buflen; 5422 if (copy_to_user(buffer, link, copylen)) 5423 copylen = -EFAULT; 5424 return copylen; 5425 } 5426 5427 /** 5428 * vfs_readlink - copy symlink body into userspace buffer 5429 * @dentry: dentry on which to get symbolic link 5430 * @buffer: user memory pointer 5431 * @buflen: size of buffer 5432 * 5433 * Does not touch atime. That's up to the caller if necessary 5434 * 5435 * Does not call security hook. 5436 */ 5437 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen) 5438 { 5439 struct inode *inode = d_inode(dentry); 5440 DEFINE_DELAYED_CALL(done); 5441 const char *link; 5442 int res; 5443 5444 if (inode->i_opflags & IOP_CACHED_LINK) 5445 return readlink_copy(buffer, buflen, inode->i_link, inode->i_linklen); 5446 5447 if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) { 5448 if (unlikely(inode->i_op->readlink)) 5449 return inode->i_op->readlink(dentry, buffer, buflen); 5450 5451 if (!d_is_symlink(dentry)) 5452 return -EINVAL; 5453 5454 spin_lock(&inode->i_lock); 5455 inode->i_opflags |= IOP_DEFAULT_READLINK; 5456 spin_unlock(&inode->i_lock); 5457 } 5458 5459 link = READ_ONCE(inode->i_link); 5460 if (!link) { 5461 link = inode->i_op->get_link(dentry, inode, &done); 5462 if (IS_ERR(link)) 5463 return PTR_ERR(link); 5464 } 5465 res = readlink_copy(buffer, buflen, link, strlen(link)); 5466 do_delayed_call(&done); 5467 return res; 5468 } 5469 EXPORT_SYMBOL(vfs_readlink); 5470 5471 /** 5472 * vfs_get_link - get symlink body 5473 * @dentry: dentry on which to get symbolic link 5474 * @done: caller needs to free returned data with this 5475 * 5476 * Calls security hook and i_op->get_link() on the supplied inode. 5477 * 5478 * It does not touch atime. That's up to the caller if necessary. 5479 * 5480 * Does not work on "special" symlinks like /proc/$$/fd/N 5481 */ 5482 const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done) 5483 { 5484 const char *res = ERR_PTR(-EINVAL); 5485 struct inode *inode = d_inode(dentry); 5486 5487 if (d_is_symlink(dentry)) { 5488 res = ERR_PTR(security_inode_readlink(dentry)); 5489 if (!res) 5490 res = inode->i_op->get_link(dentry, inode, done); 5491 } 5492 return res; 5493 } 5494 EXPORT_SYMBOL(vfs_get_link); 5495 5496 /* get the link contents into pagecache */ 5497 static char *__page_get_link(struct dentry *dentry, struct inode *inode, 5498 struct delayed_call *callback) 5499 { 5500 struct folio *folio; 5501 struct address_space *mapping = inode->i_mapping; 5502 5503 if (!dentry) { 5504 folio = filemap_get_folio(mapping, 0); 5505 if (IS_ERR(folio)) 5506 return ERR_PTR(-ECHILD); 5507 if (!folio_test_uptodate(folio)) { 5508 folio_put(folio); 5509 return ERR_PTR(-ECHILD); 5510 } 5511 } else { 5512 folio = read_mapping_folio(mapping, 0, NULL); 5513 if (IS_ERR(folio)) 5514 return ERR_CAST(folio); 5515 } 5516 set_delayed_call(callback, page_put_link, folio); 5517 BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM); 5518 return folio_address(folio); 5519 } 5520 5521 const char *page_get_link_raw(struct dentry *dentry, struct inode *inode, 5522 struct delayed_call *callback) 5523 { 5524 return __page_get_link(dentry, inode, callback); 5525 } 5526 EXPORT_SYMBOL_GPL(page_get_link_raw); 5527 5528 /** 5529 * page_get_link() - An implementation of the get_link inode_operation. 5530 * @dentry: The directory entry which is the symlink. 5531 * @inode: The inode for the symlink. 5532 * @callback: Used to drop the reference to the symlink. 5533 * 5534 * Filesystems which store their symlinks in the page cache should use 5535 * this to implement the get_link() member of their inode_operations. 5536 * 5537 * Return: A pointer to the NUL-terminated symlink. 5538 */ 5539 const char *page_get_link(struct dentry *dentry, struct inode *inode, 5540 struct delayed_call *callback) 5541 { 5542 char *kaddr = __page_get_link(dentry, inode, callback); 5543 5544 if (!IS_ERR(kaddr)) 5545 nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1); 5546 return kaddr; 5547 } 5548 EXPORT_SYMBOL(page_get_link); 5549 5550 /** 5551 * page_put_link() - Drop the reference to the symlink. 5552 * @arg: The folio which contains the symlink. 5553 * 5554 * This is used internally by page_get_link(). It is exported for use 5555 * by filesystems which need to implement a variant of page_get_link() 5556 * themselves. Despite the apparent symmetry, filesystems which use 5557 * page_get_link() do not need to call page_put_link(). 5558 * 5559 * The argument, while it has a void pointer type, must be a pointer to 5560 * the folio which was retrieved from the page cache. The delayed_call 5561 * infrastructure is used to drop the reference count once the caller 5562 * is done with the symlink. 5563 */ 5564 void page_put_link(void *arg) 5565 { 5566 folio_put(arg); 5567 } 5568 EXPORT_SYMBOL(page_put_link); 5569 5570 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen) 5571 { 5572 const char *link; 5573 int res; 5574 5575 DEFINE_DELAYED_CALL(done); 5576 link = page_get_link(dentry, d_inode(dentry), &done); 5577 res = PTR_ERR(link); 5578 if (!IS_ERR(link)) 5579 res = readlink_copy(buffer, buflen, link, strlen(link)); 5580 do_delayed_call(&done); 5581 return res; 5582 } 5583 EXPORT_SYMBOL(page_readlink); 5584 5585 int page_symlink(struct inode *inode, const char *symname, int len) 5586 { 5587 struct address_space *mapping = inode->i_mapping; 5588 const struct address_space_operations *aops = mapping->a_ops; 5589 bool nofs = !mapping_gfp_constraint(mapping, __GFP_FS); 5590 struct folio *folio; 5591 void *fsdata = NULL; 5592 int err; 5593 unsigned int flags; 5594 5595 retry: 5596 if (nofs) 5597 flags = memalloc_nofs_save(); 5598 err = aops->write_begin(NULL, mapping, 0, len-1, &folio, &fsdata); 5599 if (nofs) 5600 memalloc_nofs_restore(flags); 5601 if (err) 5602 goto fail; 5603 5604 memcpy(folio_address(folio), symname, len - 1); 5605 5606 err = aops->write_end(NULL, mapping, 0, len - 1, len - 1, 5607 folio, fsdata); 5608 if (err < 0) 5609 goto fail; 5610 if (err < len-1) 5611 goto retry; 5612 5613 mark_inode_dirty(inode); 5614 return 0; 5615 fail: 5616 return err; 5617 } 5618 EXPORT_SYMBOL(page_symlink); 5619 5620 const struct inode_operations page_symlink_inode_operations = { 5621 .get_link = page_get_link, 5622 }; 5623 EXPORT_SYMBOL(page_symlink_inode_operations);