fs/overlayfs/namei.c

1 // SPDX-License-Identifier: GPL-2.0-only
38 	struct ovl_fs *ofs = OVL_FS(d->sb);
40 	d->absolute_redirect = false;
46 		d->absolute_redirect = true;
50 		 * that will stop further lookup in lower layers (d->stop=true)
52 		 * element and that should force continue lookup in lower
53 		 * layers (reset d->stop).
55 		d->stop = false;
59 		memcpy(buf, d->name.name, prelen);
63 	kfree(d->redirect);
64 	d->redirect = buf;
65 	d->name.name = d->redirect;
66 	d->name.len = strlen(d->redirect);
74 	 * A non-dir origin may be disconnected, which is fine, because
85 	return is_subdir(dentry, ((struct vfsmount *)ctx)->mnt_root);
92  * Return -ENODATA for "origin unknown".
97 	if (fb_len < sizeof(struct ovl_fb) || fb_len < fb->len)
98 		return -EINVAL;
100 	if (fb->magic != OVL_FH_MAGIC)
101 		return -EINVAL;
104 	if (fb->version > OVL_FH_VERSION || fb->flags & ~OVL_FH_FLAG_ALL)
105 		return -ENODATA;
108 	if (!(fb->flags & OVL_FH_FLAG_ANY_ENDIAN) &&
109 	    (fb->flags & OVL_FH_FLAG_BIG_ENDIAN) != OVL_FH_FLAG_CPU_ENDIAN)
110 		return -ENODATA;
123 		if (res == -ENODATA || res == -EOPNOTSUPP)
133 		return ERR_PTR(-ENOMEM);
135 	res = ovl_getxattr_upper(ofs, upperdentry, ox, fh->buf, res);
139 	err = ovl_check_fb_len(&fh->fb, res);
141 		if (err == -ENODATA)
170 	 * Make sure that the stored uuid matches the uuid of the lower
172 	 * In case of uuid=off option just make sure that stored uuid is null.
175 	    !uuid_equal(&fh->fb.uuid, &mnt->mnt_sb->s_uuid) :
176 	    !uuid_is_null(&fh->fb.uuid))
179 	bytes = (fh->fb.len - offsetof(struct ovl_fb, fid));
180 	real = exportfs_decode_fh(mnt, (struct fid *)fh->fb.fid,
181 				  bytes >> 2, (int)fh->fb.type,
185 		 * Treat stale file handle to lower file as "origin unknown".
190 		if (real == ERR_PTR(-ESTALE) &&
191 		    !(fh->fb.flags & OVL_FH_FLAG_PATH_UPPER))
214 	struct dentry *ret = lookup_one_unlocked(mnt_idmap(d->mnt), name, base, len);
216 	if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) {
217 		if (drop_negative && ret->d_lockref.count == 1) {
218 			spin_lock(&ret->d_lock);
220 			if (d_is_negative(ret) && ret->d_lockref.count == 1)
222 			spin_unlock(&ret->d_lock);
225 		ret = ERR_PTR(-ENOENT);
244 		if (err == -ENOENT || err == -ENAMETOOLONG)
251 		err = -EREMOTE;
255 		d->stop = d->opaque = true;
262 	if (last_element && d->metacopy && !d_is_reg(this)) {
263 		d->stop = true;
268 	path.mnt = d->mnt;
270 		if (d->is_dir || !last_element) {
271 			d->stop = true;
274 		err = ovl_check_metacopy_xattr(OVL_FS(d->sb), &path, NULL);
278 		d->metacopy = err;
279 		d->stop = !d->metacopy;
280 		if (!d->metacopy || d->last)
283 		if (ovl_lookup_trap_inode(d->sb, this)) {
285 			err = -ELOOP;
290 			d->is_dir = true;
291 		if (d->last)
294 		if (ovl_is_opaquedir(OVL_FS(d->sb), &path)) {
295 			d->stop = true;
297 				d->opaque = true;
322 	size_t rem = d->name.len - 1;
326 	if (d->name.name[0] != '/')
327 		return ovl_lookup_single(base, d, d->name.name, d->name.len,
331 		const char *s = d->name.name + d->name.len - rem;
333 		size_t thislen = next - s;
337 		if (WARN_ON(s[-1] != '/'))
338 			return -EIO;
341 					d->name.len - rem, next, &base,
350 		rem -= thislen + 1;
352 		if (WARN_ON(rem >= d->name.len))
353 			return -EIO;
365 	err = vfs_path_lookup(layer->mnt->mnt_root, layer->mnt, redirect,
369 		 dentry, redirect, layer->idx, err);
374 	err = -EREMOTE;
375 	if (ovl_dentry_weird(datapath->dentry))
378 	err = -ENOENT;
379 	/* Only regular file is acceptable as lower data */
380 	if (!d_is_reg(datapath->dentry))
391 /* Lookup in data-only layers by absolute redirect to layer root */
395 	struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
398 	int err = -ENOENT;
401 	layer = &ofs->layers[ofs->numlayer - ofs->numdatalayer];
402 	for (i = 0; i < ofs->numdatalayer; i++, layer++) {
406 			lowerdata->dentry = datapath.dentry;
407 			lowerdata->layer = layer;
423 		 * If lower fs uuid is not unique among lower fs we cannot match
424 		 * fh->uuid to layer.
426 		if (ofs->layers[i].fsid &&
427 		    ofs->layers[i].fs->bad_uuid)
430 		origin = ovl_decode_real_fh(ofs, fh, ofs->layers[i].mnt,
437 		return -ESTALE;
442 	    inode_wrong_type(d_inode(upperdentry), d_inode(origin)->i_mode))
449 		return -ENOMEM;
453 		.layer = &ofs->layers[i]
460 			    upperdentry, d_inode(upperdentry)->i_mode & S_IFMT,
461 			    d_inode(origin)->i_mode & S_IFMT);
463 	return -ESTALE;
479 		if (err == -ESTALE)
489  * Return 0 on match, -ESTALE on mismatch, < 0 on error.
498 		return -ENODATA;
503 	if (fh->fb.len != ofh->fb.len || memcmp(&fh->fb, &ofh->fb, fh->fb.len))
504 		err = -ESTALE;
516  * Return 0 on match, -ESTALE on mismatch, -ENODATA on no xattr, < 0 on error.
534 	if (set && err == -ENODATA)
535 		err = ovl_setxattr(ofs, dentry, ox, fh->buf, fh->fb.len);
547 			    inode ? inode->i_ino : 0, err);
569 		return upper ?: ERR_PTR(-ESTALE);
575 		return ERR_PTR(-EIO);
583  * OVL_XATTR_ORIGIN and that origin file handle can be decoded to lower path.
584  * Return 0 on match, -ESTALE on mismatch or stale origin, < 0 on error.
598 	err = -EINVAL;
599 	if (index->d_name.len < sizeof(struct ovl_fb)*2)
602 	err = -ENOMEM;
603 	len = index->d_name.len / 2;
608 	err = -EINVAL;
609 	if (hex2bin(fh->buf, index->d_name.name, len))
612 	err = ovl_check_fb_len(&fh->fb, len);
628 	if (d_is_dir(index) && !ofs->config.nfs_export)
633 	 * real upper dir. Non-dir index entries are hardlinks to the upper
634 	 * real inode. For non-dir index, we can read the copy up origin xattr
647 		if (err == -ESTALE)
650 			err = -ESTALE;
659 	/* Check if non-dir index is orphan and don't warn before cleaning it */
660 	if (!d_is_dir(index) && d_inode(index)->i_nlink == 1) {
676 			    index, d_inode(index)->i_mode & S_IFMT, err);
681 			    index, d_inode(index)->i_mode & S_IFMT,
682 			    d_inode(index)->i_nlink);
683 	err = -ENOENT;
691 	n = kcalloc(fh->fb.len, 2, GFP_KERNEL);
693 		return -ENOMEM;
695 	s  = bin2hex(n, fh->buf, fh->fb.len);
696 	*name = (struct qstr) QSTR_INIT(n, s - n);
703  * Lookup in indexdir for the index entry of a lower real inode or a copy up
704  * origin inode. The index entry name is the hex representation of the lower
707  * If the index dentry in negative, then either no lower aliases have been
744 	index = lookup_positive_unlocked(name.name, ofs->indexdir, name.len);
747 		if (PTR_ERR(index) == -ENOENT)
753 		err = -ESTALE;
755 		err = -EIO;
777 					     ofs->indexdir, name.len);
780 		if (err == -ENOENT) {
785 				    "overlayfs: mount with '-o index=off' to disable inodes index.\n",
786 				    d_inode(origin)->i_ino, name.len, name.name,
800 		index = ERR_PTR(-ESTALE);
803 		   inode_wrong_type(inode, d_inode(origin)->i_mode)) {
806 		 * except for the case of a whiteout index. A whiteout
807 		 * index should only exist if all lower aliases have been
808 		 * unlinked, which means that finding a lower origin on lookup
812 				    index, d_inode(index)->i_mode & S_IFMT,
813 				    d_inode(origin)->i_mode & S_IFMT);
825 			if (err == -ESTALE) {
845 	index = ERR_PTR(-EIO);
851  * Returns -1 if this is the last layer.
861 		if (path->dentry)
862 			return ovl_numlower(oe) ? 1 : -1;
866 	path->dentry = lowerstack[idx - 1].dentry;
867 	path->mnt = lowerstack[idx - 1].layer->mnt;
869 	return (idx < ovl_numlower(oe)) ? idx + 1 : -1;
874 			  struct dentry *lower, struct dentry *upper)
885 	err = ovl_set_origin(ofs, lower, upper);
887 		err = ovl_set_impure(dentry->d_parent, upper->d_parent);
895 	struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
900 	if (!ofs->config.verity_mode ||
906 		if (ofs->config.verity_mode == OVL_VERITY_REQUIRE) {
909 			return -EIO;
916 		return -EIO;
920 		return -EIO;
929 		old_cred = ovl_override_creds(dentry->d_sb);
956 		return -EIO;
967 	old_cred = ovl_override_creds(dentry->d_sb);
1005 	struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
1006 	struct ovl_entry *poe = OVL_E(dentry->d_parent);
1007 	struct ovl_entry *roe = OVL_E(dentry->d_sb->s_root);
1022 		.sb = dentry->d_sb,
1023 		.name = dentry->d_name,
1032 	if (dentry->d_name.len > ofs->namelen)
1033 		return ERR_PTR(-ENAMETOOLONG);
1035 	old_cred = ovl_override_creds(dentry->d_sb);
1036 	upperdir = ovl_dentry_upper(dentry->d_parent);
1043 		if (upperdentry && upperdentry->d_flags & DCACHE_OP_REAL) {
1045 			err = -EREMOTE;
1054 			 * connected dentry, that is not under any of the lower
1056 			 * number - it's the same as if we held a reference
1057 			 * to a dentry in lower layer that was moved under us.
1069 			err = -ENOMEM;
1080 		err = -ENOMEM;
1081 		stack = ovl_stack_alloc(ofs->numlayer - 1);
1087 		struct ovl_path lower = ovl_lowerstack(poe)[i];
1090 			d.last = i == ovl_numlower(poe) - 1;
1091 		else if (d.is_dir || !ofs->numdatalayer)
1092 			d.last = lower.layer->idx == ovl_numlower(roe);
1094 		d.mnt = lower.layer->mnt;
1095 		err = ovl_lookup_layer(lower.dentry, &d, &this, false);
1102 		if ((uppermetacopy || d.metacopy) && !ofs->config.metacopy) {
1104 			err = -EPERM;
1111 		 * of lower dir and set upper parent "impure".
1113 		if (upperdentry && !ctr && !ofs->noxattr && d.is_dir) {
1123 		 * lower dir that does not match a stored origin xattr. In any
1124 		 * case, only verified origin is used for index lookup.
1126 		 * For non-dir dentry, if index=on, then ensure origin
1131 		    ((d.is_dir && ovl_verify_lower(dentry->d_sb)) ||
1132 		     (!d.is_dir && ofs->config.index && origin_path))) {
1149 			 * lower chain, except top most lower metacopy dentry.
1157 			stack[ctr].layer = lower.layer;
1163 		 * a symlink into the lower layer without the permission checks.
1165 		 * comes from an USB drive).  This can allow a non-readable file
1171 		err = -EPERM;
1184 			i = lower.layer->idx - 1;
1188 	/* Defer lookup of lowerdata in data-only layers to first access */
1189 	if (d.metacopy && ctr && ofs->numdatalayer && d.absolute_redirect) {
1195 	 * For regular non-metacopy upper dentries, there is no lower
1199 	 * For metacopy dentry, path based lookup will find lower dentries.
1203 		pr_warn_ratelimited("metacopy with no lower data found - abort lookup (%pd2)\n",
1205 		err = -EIO;
1209 			err = -EIO;
1214 		origin = origin_path->dentry;
1219 	 * Always lookup index if there is no-upperdentry.
1221 	 * For the case of upperdentry, we have set origin by now if it
1224 	 * For directories, lookup index by lower inode and verify it matches
1225 	 * upper inode. We only trust dir index if we verified that lower dir
1231 	 * based dentry lookup in lower in this case.
1240 	if (origin && ovl_indexdir(dentry->d_sb) &&
1241 	    (!d.is_dir || ovl_index_all(dentry->d_sb))) {
1252 		err = -ENOMEM;
1272 		 * assignment of happens only if upperdentry is non-NULL, and
1297 		if (ctr > 1 && !d.is_dir && !stack[ctr - 1].dentry) {
1301 		inode = ovl_get_inode(dentry->d_sb, &oip);
1316 		dput(origin_path->dentry);
1331 		dput(origin_path->dentry);
1344 	struct ovl_entry *poe = OVL_E(dentry->d_parent);
1345 	const struct qstr *name = &dentry->d_name;
1352 	 * If dentry is negative, then lower is positive iff this is a
1355 	if (!dentry->d_inode)
1358 	/* Negative upper -> positive lower */
1362 	old_cred = ovl_override_creds(dentry->d_sb);
1363 	/* Positive upper -> have to look up lower to see whether it exists */
1369 				mnt_idmap(parentpath->layer->mnt),
1370 				name->name, parentpath->dentry, name->len);
1373 			case -ENOENT:
1374 			case -ENAMETOOLONG: