xref: /openbmc/linux/fs/namespace.c (revision c82ea72d)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  linux/fs/namespace.c
4  *
5  * (C) Copyright Al Viro 2000, 2001
6  *
7  * Based on code from fs/super.c, copyright Linus Torvalds and others.
8  * Heavily rewritten.
9  */
10 
11 #include <linux/syscalls.h>
12 #include <linux/export.h>
13 #include <linux/capability.h>
14 #include <linux/mnt_namespace.h>
15 #include <linux/user_namespace.h>
16 #include <linux/namei.h>
17 #include <linux/security.h>
18 #include <linux/cred.h>
19 #include <linux/idr.h>
20 #include <linux/init.h>		/* init_rootfs */
21 #include <linux/fs_struct.h>	/* get_fs_root et.al. */
22 #include <linux/fsnotify.h>	/* fsnotify_vfsmount_delete */
23 #include <linux/file.h>
24 #include <linux/uaccess.h>
25 #include <linux/proc_ns.h>
26 #include <linux/magic.h>
27 #include <linux/memblock.h>
28 #include <linux/proc_fs.h>
29 #include <linux/task_work.h>
30 #include <linux/sched/task.h>
31 #include <uapi/linux/mount.h>
32 #include <linux/fs_context.h>
33 #include <linux/shmem_fs.h>
34 #include <linux/mnt_idmapping.h>
35 
36 #include "pnode.h"
37 #include "internal.h"
38 
39 /* Maximum number of mounts in a mount namespace */
40 static unsigned int sysctl_mount_max __read_mostly = 100000;
41 
42 static unsigned int m_hash_mask __read_mostly;
43 static unsigned int m_hash_shift __read_mostly;
44 static unsigned int mp_hash_mask __read_mostly;
45 static unsigned int mp_hash_shift __read_mostly;
46 
47 static __initdata unsigned long mhash_entries;
set_mhash_entries(char * str)48 static int __init set_mhash_entries(char *str)
49 {
50 	if (!str)
51 		return 0;
52 	mhash_entries = simple_strtoul(str, &str, 0);
53 	return 1;
54 }
55 __setup("mhash_entries=", set_mhash_entries);
56 
57 static __initdata unsigned long mphash_entries;
set_mphash_entries(char * str)58 static int __init set_mphash_entries(char *str)
59 {
60 	if (!str)
61 		return 0;
62 	mphash_entries = simple_strtoul(str, &str, 0);
63 	return 1;
64 }
65 __setup("mphash_entries=", set_mphash_entries);
66 
67 static u64 event;
68 static DEFINE_IDA(mnt_id_ida);
69 static DEFINE_IDA(mnt_group_ida);
70 
71 static struct hlist_head *mount_hashtable __read_mostly;
72 static struct hlist_head *mountpoint_hashtable __read_mostly;
73 static struct kmem_cache *mnt_cache __read_mostly;
74 static DECLARE_RWSEM(namespace_sem);
75 static HLIST_HEAD(unmounted);	/* protected by namespace_sem */
76 static LIST_HEAD(ex_mountpoints); /* protected by namespace_sem */
77 
78 struct mount_kattr {
79 	unsigned int attr_set;
80 	unsigned int attr_clr;
81 	unsigned int propagation;
82 	unsigned int lookup_flags;
83 	bool recurse;
84 	struct user_namespace *mnt_userns;
85 	struct mnt_idmap *mnt_idmap;
86 };
87 
88 /* /sys/fs */
89 struct kobject *fs_kobj;
90 EXPORT_SYMBOL_GPL(fs_kobj);
91 
92 /*
93  * vfsmount lock may be taken for read to prevent changes to the
94  * vfsmount hash, ie. during mountpoint lookups or walking back
95  * up the tree.
96  *
97  * It should be taken for write in all cases where the vfsmount
98  * tree or hash is modified or when a vfsmount structure is modified.
99  */
100 __cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock);
101 
lock_mount_hash(void)102 static inline void lock_mount_hash(void)
103 {
104 	write_seqlock(&mount_lock);
105 }
106 
unlock_mount_hash(void)107 static inline void unlock_mount_hash(void)
108 {
109 	write_sequnlock(&mount_lock);
110 }
111 
m_hash(struct vfsmount * mnt,struct dentry * dentry)112 static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry)
113 {
114 	unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES);
115 	tmp += ((unsigned long)dentry / L1_CACHE_BYTES);
116 	tmp = tmp + (tmp >> m_hash_shift);
117 	return &mount_hashtable[tmp & m_hash_mask];
118 }
119 
mp_hash(struct dentry * dentry)120 static inline struct hlist_head *mp_hash(struct dentry *dentry)
121 {
122 	unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES);
123 	tmp = tmp + (tmp >> mp_hash_shift);
124 	return &mountpoint_hashtable[tmp & mp_hash_mask];
125 }
126 
mnt_alloc_id(struct mount * mnt)127 static int mnt_alloc_id(struct mount *mnt)
128 {
129 	int res = ida_alloc(&mnt_id_ida, GFP_KERNEL);
130 
131 	if (res < 0)
132 		return res;
133 	mnt->mnt_id = res;
134 	return 0;
135 }
136 
mnt_free_id(struct mount * mnt)137 static void mnt_free_id(struct mount *mnt)
138 {
139 	ida_free(&mnt_id_ida, mnt->mnt_id);
140 }
141 
142 /*
143  * Allocate a new peer group ID
144  */
mnt_alloc_group_id(struct mount * mnt)145 static int mnt_alloc_group_id(struct mount *mnt)
146 {
147 	int res = ida_alloc_min(&mnt_group_ida, 1, GFP_KERNEL);
148 
149 	if (res < 0)
150 		return res;
151 	mnt->mnt_group_id = res;
152 	return 0;
153 }
154 
155 /*
156  * Release a peer group ID
157  */
mnt_release_group_id(struct mount * mnt)158 void mnt_release_group_id(struct mount *mnt)
159 {
160 	ida_free(&mnt_group_ida, mnt->mnt_group_id);
161 	mnt->mnt_group_id = 0;
162 }
163 
164 /*
165  * vfsmount lock must be held for read
166  */
mnt_add_count(struct mount * mnt,int n)167 static inline void mnt_add_count(struct mount *mnt, int n)
168 {
169 #ifdef CONFIG_SMP
170 	this_cpu_add(mnt->mnt_pcp->mnt_count, n);
171 #else
172 	preempt_disable();
173 	mnt->mnt_count += n;
174 	preempt_enable();
175 #endif
176 }
177 
178 /*
179  * vfsmount lock must be held for write
180  */
mnt_get_count(struct mount * mnt)181 int mnt_get_count(struct mount *mnt)
182 {
183 #ifdef CONFIG_SMP
184 	int count = 0;
185 	int cpu;
186 
187 	for_each_possible_cpu(cpu) {
188 		count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_count;
189 	}
190 
191 	return count;
192 #else
193 	return mnt->mnt_count;
194 #endif
195 }
196 
alloc_vfsmnt(const char * name)197 static struct mount *alloc_vfsmnt(const char *name)
198 {
199 	struct mount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL);
200 	if (mnt) {
201 		int err;
202 
203 		err = mnt_alloc_id(mnt);
204 		if (err)
205 			goto out_free_cache;
206 
207 		if (name) {
208 			mnt->mnt_devname = kstrdup_const(name,
209 							 GFP_KERNEL_ACCOUNT);
210 			if (!mnt->mnt_devname)
211 				goto out_free_id;
212 		}
213 
214 #ifdef CONFIG_SMP
215 		mnt->mnt_pcp = alloc_percpu(struct mnt_pcp);
216 		if (!mnt->mnt_pcp)
217 			goto out_free_devname;
218 
219 		this_cpu_add(mnt->mnt_pcp->mnt_count, 1);
220 #else
221 		mnt->mnt_count = 1;
222 		mnt->mnt_writers = 0;
223 #endif
224 
225 		INIT_HLIST_NODE(&mnt->mnt_hash);
226 		INIT_LIST_HEAD(&mnt->mnt_child);
227 		INIT_LIST_HEAD(&mnt->mnt_mounts);
228 		INIT_LIST_HEAD(&mnt->mnt_list);
229 		INIT_LIST_HEAD(&mnt->mnt_expire);
230 		INIT_LIST_HEAD(&mnt->mnt_share);
231 		INIT_LIST_HEAD(&mnt->mnt_slave_list);
232 		INIT_LIST_HEAD(&mnt->mnt_slave);
233 		INIT_HLIST_NODE(&mnt->mnt_mp_list);
234 		INIT_LIST_HEAD(&mnt->mnt_umounting);
235 		INIT_HLIST_HEAD(&mnt->mnt_stuck_children);
236 		mnt->mnt.mnt_idmap = &nop_mnt_idmap;
237 	}
238 	return mnt;
239 
240 #ifdef CONFIG_SMP
241 out_free_devname:
242 	kfree_const(mnt->mnt_devname);
243 #endif
244 out_free_id:
245 	mnt_free_id(mnt);
246 out_free_cache:
247 	kmem_cache_free(mnt_cache, mnt);
248 	return NULL;
249 }
250 
251 /*
252  * Most r/o checks on a fs are for operations that take
253  * discrete amounts of time, like a write() or unlink().
254  * We must keep track of when those operations start
255  * (for permission checks) and when they end, so that
256  * we can determine when writes are able to occur to
257  * a filesystem.
258  */
259 /*
260  * __mnt_is_readonly: check whether a mount is read-only
261  * @mnt: the mount to check for its write status
262  *
263  * This shouldn't be used directly ouside of the VFS.
264  * It does not guarantee that the filesystem will stay
265  * r/w, just that it is right *now*.  This can not and
266  * should not be used in place of IS_RDONLY(inode).
267  * mnt_want/drop_write() will _keep_ the filesystem
268  * r/w.
269  */
__mnt_is_readonly(struct vfsmount * mnt)270 bool __mnt_is_readonly(struct vfsmount *mnt)
271 {
272 	return (mnt->mnt_flags & MNT_READONLY) || sb_rdonly(mnt->mnt_sb);
273 }
274 EXPORT_SYMBOL_GPL(__mnt_is_readonly);
275 
mnt_inc_writers(struct mount * mnt)276 static inline void mnt_inc_writers(struct mount *mnt)
277 {
278 #ifdef CONFIG_SMP
279 	this_cpu_inc(mnt->mnt_pcp->mnt_writers);
280 #else
281 	mnt->mnt_writers++;
282 #endif
283 }
284 
mnt_dec_writers(struct mount * mnt)285 static inline void mnt_dec_writers(struct mount *mnt)
286 {
287 #ifdef CONFIG_SMP
288 	this_cpu_dec(mnt->mnt_pcp->mnt_writers);
289 #else
290 	mnt->mnt_writers--;
291 #endif
292 }
293 
mnt_get_writers(struct mount * mnt)294 static unsigned int mnt_get_writers(struct mount *mnt)
295 {
296 #ifdef CONFIG_SMP
297 	unsigned int count = 0;
298 	int cpu;
299 
300 	for_each_possible_cpu(cpu) {
301 		count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers;
302 	}
303 
304 	return count;
305 #else
306 	return mnt->mnt_writers;
307 #endif
308 }
309 
mnt_is_readonly(struct vfsmount * mnt)310 static int mnt_is_readonly(struct vfsmount *mnt)
311 {
312 	if (READ_ONCE(mnt->mnt_sb->s_readonly_remount))
313 		return 1;
314 	/*
315 	 * The barrier pairs with the barrier in sb_start_ro_state_change()
316 	 * making sure if we don't see s_readonly_remount set yet, we also will
317 	 * not see any superblock / mount flag changes done by remount.
318 	 * It also pairs with the barrier in sb_end_ro_state_change()
319 	 * assuring that if we see s_readonly_remount already cleared, we will
320 	 * see the values of superblock / mount flags updated by remount.
321 	 */
322 	smp_rmb();
323 	return __mnt_is_readonly(mnt);
324 }
325 
326 /*
327  * Most r/o & frozen checks on a fs are for operations that take discrete
328  * amounts of time, like a write() or unlink().  We must keep track of when
329  * those operations start (for permission checks) and when they end, so that we
330  * can determine when writes are able to occur to a filesystem.
331  */
332 /**
333  * __mnt_want_write - get write access to a mount without freeze protection
334  * @m: the mount on which to take a write
335  *
336  * This tells the low-level filesystem that a write is about to be performed to
337  * it, and makes sure that writes are allowed (mnt it read-write) before
338  * returning success. This operation does not protect against filesystem being
339  * frozen. When the write operation is finished, __mnt_drop_write() must be
340  * called. This is effectively a refcount.
341  */
__mnt_want_write(struct vfsmount * m)342 int __mnt_want_write(struct vfsmount *m)
343 {
344 	struct mount *mnt = real_mount(m);
345 	int ret = 0;
346 
347 	preempt_disable();
348 	mnt_inc_writers(mnt);
349 	/*
350 	 * The store to mnt_inc_writers must be visible before we pass
351 	 * MNT_WRITE_HOLD loop below, so that the slowpath can see our
352 	 * incremented count after it has set MNT_WRITE_HOLD.
353 	 */
354 	smp_mb();
355 	might_lock(&mount_lock.lock);
356 	while (READ_ONCE(mnt->mnt.mnt_flags) & MNT_WRITE_HOLD) {
357 		if (!IS_ENABLED(CONFIG_PREEMPT_RT)) {
358 			cpu_relax();
359 		} else {
360 			/*
361 			 * This prevents priority inversion, if the task
362 			 * setting MNT_WRITE_HOLD got preempted on a remote
363 			 * CPU, and it prevents life lock if the task setting
364 			 * MNT_WRITE_HOLD has a lower priority and is bound to
365 			 * the same CPU as the task that is spinning here.
366 			 */
367 			preempt_enable();
368 			lock_mount_hash();
369 			unlock_mount_hash();
370 			preempt_disable();
371 		}
372 	}
373 	/*
374 	 * The barrier pairs with the barrier sb_start_ro_state_change() making
375 	 * sure that if we see MNT_WRITE_HOLD cleared, we will also see
376 	 * s_readonly_remount set (or even SB_RDONLY / MNT_READONLY flags) in
377 	 * mnt_is_readonly() and bail in case we are racing with remount
378 	 * read-only.
379 	 */
380 	smp_rmb();
381 	if (mnt_is_readonly(m)) {
382 		mnt_dec_writers(mnt);
383 		ret = -EROFS;
384 	}
385 	preempt_enable();
386 
387 	return ret;
388 }
389 
390 /**
391  * mnt_want_write - get write access to a mount
392  * @m: the mount on which to take a write
393  *
394  * This tells the low-level filesystem that a write is about to be performed to
395  * it, and makes sure that writes are allowed (mount is read-write, filesystem
396  * is not frozen) before returning success.  When the write operation is
397  * finished, mnt_drop_write() must be called.  This is effectively a refcount.
398  */
mnt_want_write(struct vfsmount * m)399 int mnt_want_write(struct vfsmount *m)
400 {
401 	int ret;
402 
403 	sb_start_write(m->mnt_sb);
404 	ret = __mnt_want_write(m);
405 	if (ret)
406 		sb_end_write(m->mnt_sb);
407 	return ret;
408 }
409 EXPORT_SYMBOL_GPL(mnt_want_write);
410 
411 /**
412  * __mnt_want_write_file - get write access to a file's mount
413  * @file: the file who's mount on which to take a write
414  *
415  * This is like __mnt_want_write, but if the file is already open for writing it
416  * skips incrementing mnt_writers (since the open file already has a reference)
417  * and instead only does the check for emergency r/o remounts.  This must be
418  * paired with __mnt_drop_write_file.
419  */
__mnt_want_write_file(struct file * file)420 int __mnt_want_write_file(struct file *file)
421 {
422 	if (file->f_mode & FMODE_WRITER) {
423 		/*
424 		 * Superblock may have become readonly while there are still
425 		 * writable fd's, e.g. due to a fs error with errors=remount-ro
426 		 */
427 		if (__mnt_is_readonly(file->f_path.mnt))
428 			return -EROFS;
429 		return 0;
430 	}
431 	return __mnt_want_write(file->f_path.mnt);
432 }
433 
434 /**
435  * mnt_want_write_file - get write access to a file's mount
436  * @file: the file who's mount on which to take a write
437  *
438  * This is like mnt_want_write, but if the file is already open for writing it
439  * skips incrementing mnt_writers (since the open file already has a reference)
440  * and instead only does the freeze protection and the check for emergency r/o
441  * remounts.  This must be paired with mnt_drop_write_file.
442  */
mnt_want_write_file(struct file * file)443 int mnt_want_write_file(struct file *file)
444 {
445 	int ret;
446 
447 	sb_start_write(file_inode(file)->i_sb);
448 	ret = __mnt_want_write_file(file);
449 	if (ret)
450 		sb_end_write(file_inode(file)->i_sb);
451 	return ret;
452 }
453 EXPORT_SYMBOL_GPL(mnt_want_write_file);
454 
455 /**
456  * __mnt_drop_write - give up write access to a mount
457  * @mnt: the mount on which to give up write access
458  *
459  * Tells the low-level filesystem that we are done
460  * performing writes to it.  Must be matched with
461  * __mnt_want_write() call above.
462  */
__mnt_drop_write(struct vfsmount * mnt)463 void __mnt_drop_write(struct vfsmount *mnt)
464 {
465 	preempt_disable();
466 	mnt_dec_writers(real_mount(mnt));
467 	preempt_enable();
468 }
469 
470 /**
471  * mnt_drop_write - give up write access to a mount
472  * @mnt: the mount on which to give up write access
473  *
474  * Tells the low-level filesystem that we are done performing writes to it and
475  * also allows filesystem to be frozen again.  Must be matched with
476  * mnt_want_write() call above.
477  */
mnt_drop_write(struct vfsmount * mnt)478 void mnt_drop_write(struct vfsmount *mnt)
479 {
480 	__mnt_drop_write(mnt);
481 	sb_end_write(mnt->mnt_sb);
482 }
483 EXPORT_SYMBOL_GPL(mnt_drop_write);
484 
__mnt_drop_write_file(struct file * file)485 void __mnt_drop_write_file(struct file *file)
486 {
487 	if (!(file->f_mode & FMODE_WRITER))
488 		__mnt_drop_write(file->f_path.mnt);
489 }
490 
mnt_drop_write_file(struct file * file)491 void mnt_drop_write_file(struct file *file)
492 {
493 	__mnt_drop_write_file(file);
494 	sb_end_write(file_inode(file)->i_sb);
495 }
496 EXPORT_SYMBOL(mnt_drop_write_file);
497 
498 /**
499  * mnt_hold_writers - prevent write access to the given mount
500  * @mnt: mnt to prevent write access to
501  *
502  * Prevents write access to @mnt if there are no active writers for @mnt.
503  * This function needs to be called and return successfully before changing
504  * properties of @mnt that need to remain stable for callers with write access
505  * to @mnt.
506  *
507  * After this functions has been called successfully callers must pair it with
508  * a call to mnt_unhold_writers() in order to stop preventing write access to
509  * @mnt.
510  *
511  * Context: This function expects lock_mount_hash() to be held serializing
512  *          setting MNT_WRITE_HOLD.
513  * Return: On success 0 is returned.
514  *	   On error, -EBUSY is returned.
515  */
mnt_hold_writers(struct mount * mnt)516 static inline int mnt_hold_writers(struct mount *mnt)
517 {
518 	mnt->mnt.mnt_flags |= MNT_WRITE_HOLD;
519 	/*
520 	 * After storing MNT_WRITE_HOLD, we'll read the counters. This store
521 	 * should be visible before we do.
522 	 */
523 	smp_mb();
524 
525 	/*
526 	 * With writers on hold, if this value is zero, then there are
527 	 * definitely no active writers (although held writers may subsequently
528 	 * increment the count, they'll have to wait, and decrement it after
529 	 * seeing MNT_READONLY).
530 	 *
531 	 * It is OK to have counter incremented on one CPU and decremented on
532 	 * another: the sum will add up correctly. The danger would be when we
533 	 * sum up each counter, if we read a counter before it is incremented,
534 	 * but then read another CPU's count which it has been subsequently
535 	 * decremented from -- we would see more decrements than we should.
536 	 * MNT_WRITE_HOLD protects against this scenario, because
537 	 * mnt_want_write first increments count, then smp_mb, then spins on
538 	 * MNT_WRITE_HOLD, so it can't be decremented by another CPU while
539 	 * we're counting up here.
540 	 */
541 	if (mnt_get_writers(mnt) > 0)
542 		return -EBUSY;
543 
544 	return 0;
545 }
546 
547 /**
548  * mnt_unhold_writers - stop preventing write access to the given mount
549  * @mnt: mnt to stop preventing write access to
550  *
551  * Stop preventing write access to @mnt allowing callers to gain write access
552  * to @mnt again.
553  *
554  * This function can only be called after a successful call to
555  * mnt_hold_writers().
556  *
557  * Context: This function expects lock_mount_hash() to be held.
558  */
mnt_unhold_writers(struct mount * mnt)559 static inline void mnt_unhold_writers(struct mount *mnt)
560 {
561 	/*
562 	 * MNT_READONLY must become visible before ~MNT_WRITE_HOLD, so writers
563 	 * that become unheld will see MNT_READONLY.
564 	 */
565 	smp_wmb();
566 	mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD;
567 }
568 
mnt_make_readonly(struct mount * mnt)569 static int mnt_make_readonly(struct mount *mnt)
570 {
571 	int ret;
572 
573 	ret = mnt_hold_writers(mnt);
574 	if (!ret)
575 		mnt->mnt.mnt_flags |= MNT_READONLY;
576 	mnt_unhold_writers(mnt);
577 	return ret;
578 }
579 
sb_prepare_remount_readonly(struct super_block * sb)580 int sb_prepare_remount_readonly(struct super_block *sb)
581 {
582 	struct mount *mnt;
583 	int err = 0;
584 
585 	/* Racy optimization.  Recheck the counter under MNT_WRITE_HOLD */
586 	if (atomic_long_read(&sb->s_remove_count))
587 		return -EBUSY;
588 
589 	lock_mount_hash();
590 	list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) {
591 		if (!(mnt->mnt.mnt_flags & MNT_READONLY)) {
592 			err = mnt_hold_writers(mnt);
593 			if (err)
594 				break;
595 		}
596 	}
597 	if (!err && atomic_long_read(&sb->s_remove_count))
598 		err = -EBUSY;
599 
600 	if (!err)
601 		sb_start_ro_state_change(sb);
602 	list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) {
603 		if (mnt->mnt.mnt_flags & MNT_WRITE_HOLD)
604 			mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD;
605 	}
606 	unlock_mount_hash();
607 
608 	return err;
609 }
610 
free_vfsmnt(struct mount * mnt)611 static void free_vfsmnt(struct mount *mnt)
612 {
613 	mnt_idmap_put(mnt_idmap(&mnt->mnt));
614 	kfree_const(mnt->mnt_devname);
615 #ifdef CONFIG_SMP
616 	free_percpu(mnt->mnt_pcp);
617 #endif
618 	kmem_cache_free(mnt_cache, mnt);
619 }
620 
delayed_free_vfsmnt(struct rcu_head * head)621 static void delayed_free_vfsmnt(struct rcu_head *head)
622 {
623 	free_vfsmnt(container_of(head, struct mount, mnt_rcu));
624 }
625 
626 /* call under rcu_read_lock */
__legitimize_mnt(struct vfsmount * bastard,unsigned seq)627 int __legitimize_mnt(struct vfsmount *bastard, unsigned seq)
628 {
629 	struct mount *mnt;
630 	if (read_seqretry(&mount_lock, seq))
631 		return 1;
632 	if (bastard == NULL)
633 		return 0;
634 	mnt = real_mount(bastard);
635 	mnt_add_count(mnt, 1);
636 	smp_mb();			// see mntput_no_expire()
637 	if (likely(!read_seqretry(&mount_lock, seq)))
638 		return 0;
639 	if (bastard->mnt_flags & MNT_SYNC_UMOUNT) {
640 		mnt_add_count(mnt, -1);
641 		return 1;
642 	}
643 	lock_mount_hash();
644 	if (unlikely(bastard->mnt_flags & MNT_DOOMED)) {
645 		mnt_add_count(mnt, -1);
646 		unlock_mount_hash();
647 		return 1;
648 	}
649 	unlock_mount_hash();
650 	/* caller will mntput() */
651 	return -1;
652 }
653 
654 /* call under rcu_read_lock */
legitimize_mnt(struct vfsmount * bastard,unsigned seq)655 static bool legitimize_mnt(struct vfsmount *bastard, unsigned seq)
656 {
657 	int res = __legitimize_mnt(bastard, seq);
658 	if (likely(!res))
659 		return true;
660 	if (unlikely(res < 0)) {
661 		rcu_read_unlock();
662 		mntput(bastard);
663 		rcu_read_lock();
664 	}
665 	return false;
666 }
667 
668 /**
669  * __lookup_mnt - find first child mount
670  * @mnt:	parent mount
671  * @dentry:	mountpoint
672  *
673  * If @mnt has a child mount @c mounted @dentry find and return it.
674  *
675  * Note that the child mount @c need not be unique. There are cases
676  * where shadow mounts are created. For example, during mount
677  * propagation when a source mount @mnt whose root got overmounted by a
678  * mount @o after path lookup but before @namespace_sem could be
679  * acquired gets copied and propagated. So @mnt gets copied including
680  * @o. When @mnt is propagated to a destination mount @d that already
681  * has another mount @n mounted at the same mountpoint then the source
682  * mount @mnt will be tucked beneath @n, i.e., @n will be mounted on
683  * @mnt and @mnt mounted on @d. Now both @n and @o are mounted at @mnt
684  * on @dentry.
685  *
686  * Return: The first child of @mnt mounted @dentry or NULL.
687  */
__lookup_mnt(struct vfsmount * mnt,struct dentry * dentry)688 struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
689 {
690 	struct hlist_head *head = m_hash(mnt, dentry);
691 	struct mount *p;
692 
693 	hlist_for_each_entry_rcu(p, head, mnt_hash)
694 		if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry)
695 			return p;
696 	return NULL;
697 }
698 
699 /*
700  * lookup_mnt - Return the first child mount mounted at path
701  *
702  * "First" means first mounted chronologically.  If you create the
703  * following mounts:
704  *
705  * mount /dev/sda1 /mnt
706  * mount /dev/sda2 /mnt
707  * mount /dev/sda3 /mnt
708  *
709  * Then lookup_mnt() on the base /mnt dentry in the root mount will
710  * return successively the root dentry and vfsmount of /dev/sda1, then
711  * /dev/sda2, then /dev/sda3, then NULL.
712  *
713  * lookup_mnt takes a reference to the found vfsmount.
714  */
lookup_mnt(const struct path * path)715 struct vfsmount *lookup_mnt(const struct path *path)
716 {
717 	struct mount *child_mnt;
718 	struct vfsmount *m;
719 	unsigned seq;
720 
721 	rcu_read_lock();
722 	do {
723 		seq = read_seqbegin(&mount_lock);
724 		child_mnt = __lookup_mnt(path->mnt, path->dentry);
725 		m = child_mnt ? &child_mnt->mnt : NULL;
726 	} while (!legitimize_mnt(m, seq));
727 	rcu_read_unlock();
728 	return m;
729 }
730 
lock_ns_list(struct mnt_namespace * ns)731 static inline void lock_ns_list(struct mnt_namespace *ns)
732 {
733 	spin_lock(&ns->ns_lock);
734 }
735 
unlock_ns_list(struct mnt_namespace * ns)736 static inline void unlock_ns_list(struct mnt_namespace *ns)
737 {
738 	spin_unlock(&ns->ns_lock);
739 }
740 
mnt_is_cursor(struct mount * mnt)741 static inline bool mnt_is_cursor(struct mount *mnt)
742 {
743 	return mnt->mnt.mnt_flags & MNT_CURSOR;
744 }
745 
746 /*
747  * __is_local_mountpoint - Test to see if dentry is a mountpoint in the
748  *                         current mount namespace.
749  *
750  * The common case is dentries are not mountpoints at all and that
751  * test is handled inline.  For the slow case when we are actually
752  * dealing with a mountpoint of some kind, walk through all of the
753  * mounts in the current mount namespace and test to see if the dentry
754  * is a mountpoint.
755  *
756  * The mount_hashtable is not usable in the context because we
757  * need to identify all mounts that may be in the current mount
758  * namespace not just a mount that happens to have some specified
759  * parent mount.
760  */
__is_local_mountpoint(struct dentry * dentry)761 bool __is_local_mountpoint(struct dentry *dentry)
762 {
763 	struct mnt_namespace *ns = current->nsproxy->mnt_ns;
764 	struct mount *mnt;
765 	bool is_covered = false;
766 
767 	down_read(&namespace_sem);
768 	lock_ns_list(ns);
769 	list_for_each_entry(mnt, &ns->list, mnt_list) {
770 		if (mnt_is_cursor(mnt))
771 			continue;
772 		is_covered = (mnt->mnt_mountpoint == dentry);
773 		if (is_covered)
774 			break;
775 	}
776 	unlock_ns_list(ns);
777 	up_read(&namespace_sem);
778 
779 	return is_covered;
780 }
781 
lookup_mountpoint(struct dentry * dentry)782 static struct mountpoint *lookup_mountpoint(struct dentry *dentry)
783 {
784 	struct hlist_head *chain = mp_hash(dentry);
785 	struct mountpoint *mp;
786 
787 	hlist_for_each_entry(mp, chain, m_hash) {
788 		if (mp->m_dentry == dentry) {
789 			mp->m_count++;
790 			return mp;
791 		}
792 	}
793 	return NULL;
794 }
795 
get_mountpoint(struct dentry * dentry)796 static struct mountpoint *get_mountpoint(struct dentry *dentry)
797 {
798 	struct mountpoint *mp, *new = NULL;
799 	int ret;
800 
801 	if (d_mountpoint(dentry)) {
802 		/* might be worth a WARN_ON() */
803 		if (d_unlinked(dentry))
804 			return ERR_PTR(-ENOENT);
805 mountpoint:
806 		read_seqlock_excl(&mount_lock);
807 		mp = lookup_mountpoint(dentry);
808 		read_sequnlock_excl(&mount_lock);
809 		if (mp)
810 			goto done;
811 	}
812 
813 	if (!new)
814 		new = kmalloc(sizeof(struct mountpoint), GFP_KERNEL);
815 	if (!new)
816 		return ERR_PTR(-ENOMEM);
817 
818 
819 	/* Exactly one processes may set d_mounted */
820 	ret = d_set_mounted(dentry);
821 
822 	/* Someone else set d_mounted? */
823 	if (ret == -EBUSY)
824 		goto mountpoint;
825 
826 	/* The dentry is not available as a mountpoint? */
827 	mp = ERR_PTR(ret);
828 	if (ret)
829 		goto done;
830 
831 	/* Add the new mountpoint to the hash table */
832 	read_seqlock_excl(&mount_lock);
833 	new->m_dentry = dget(dentry);
834 	new->m_count = 1;
835 	hlist_add_head(&new->m_hash, mp_hash(dentry));
836 	INIT_HLIST_HEAD(&new->m_list);
837 	read_sequnlock_excl(&mount_lock);
838 
839 	mp = new;
840 	new = NULL;
841 done:
842 	kfree(new);
843 	return mp;
844 }
845 
846 /*
847  * vfsmount lock must be held.  Additionally, the caller is responsible
848  * for serializing calls for given disposal list.
849  */
__put_mountpoint(struct mountpoint * mp,struct list_head * list)850 static void __put_mountpoint(struct mountpoint *mp, struct list_head *list)
851 {
852 	if (!--mp->m_count) {
853 		struct dentry *dentry = mp->m_dentry;
854 		BUG_ON(!hlist_empty(&mp->m_list));
855 		spin_lock(&dentry->d_lock);
856 		dentry->d_flags &= ~DCACHE_MOUNTED;
857 		spin_unlock(&dentry->d_lock);
858 		dput_to_list(dentry, list);
859 		hlist_del(&mp->m_hash);
860 		kfree(mp);
861 	}
862 }
863 
864 /* called with namespace_lock and vfsmount lock */
put_mountpoint(struct mountpoint * mp)865 static void put_mountpoint(struct mountpoint *mp)
866 {
867 	__put_mountpoint(mp, &ex_mountpoints);
868 }
869 
check_mnt(struct mount * mnt)870 static inline int check_mnt(struct mount *mnt)
871 {
872 	return mnt->mnt_ns == current->nsproxy->mnt_ns;
873 }
874 
875 /*
876  * vfsmount lock must be held for write
877  */
touch_mnt_namespace(struct mnt_namespace * ns)878 static void touch_mnt_namespace(struct mnt_namespace *ns)
879 {
880 	if (ns) {
881 		ns->event = ++event;
882 		wake_up_interruptible(&ns->poll);
883 	}
884 }
885 
886 /*
887  * vfsmount lock must be held for write
888  */
__touch_mnt_namespace(struct mnt_namespace * ns)889 static void __touch_mnt_namespace(struct mnt_namespace *ns)
890 {
891 	if (ns && ns->event != event) {
892 		ns->event = event;
893 		wake_up_interruptible(&ns->poll);
894 	}
895 }
896 
897 /*
898  * vfsmount lock must be held for write
899  */
unhash_mnt(struct mount * mnt)900 static struct mountpoint *unhash_mnt(struct mount *mnt)
901 {
902 	struct mountpoint *mp;
903 	mnt->mnt_parent = mnt;
904 	mnt->mnt_mountpoint = mnt->mnt.mnt_root;
905 	list_del_init(&mnt->mnt_child);
906 	hlist_del_init_rcu(&mnt->mnt_hash);
907 	hlist_del_init(&mnt->mnt_mp_list);
908 	mp = mnt->mnt_mp;
909 	mnt->mnt_mp = NULL;
910 	return mp;
911 }
912 
913 /*
914  * vfsmount lock must be held for write
915  */
umount_mnt(struct mount * mnt)916 static void umount_mnt(struct mount *mnt)
917 {
918 	put_mountpoint(unhash_mnt(mnt));
919 }
920 
921 /*
922  * vfsmount lock must be held for write
923  */
mnt_set_mountpoint(struct mount * mnt,struct mountpoint * mp,struct mount * child_mnt)924 void mnt_set_mountpoint(struct mount *mnt,
925 			struct mountpoint *mp,
926 			struct mount *child_mnt)
927 {
928 	mp->m_count++;
929 	mnt_add_count(mnt, 1);	/* essentially, that's mntget */
930 	child_mnt->mnt_mountpoint = mp->m_dentry;
931 	child_mnt->mnt_parent = mnt;
932 	child_mnt->mnt_mp = mp;
933 	hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list);
934 }
935 
936 /**
937  * mnt_set_mountpoint_beneath - mount a mount beneath another one
938  *
939  * @new_parent: the source mount
940  * @top_mnt:    the mount beneath which @new_parent is mounted
941  * @new_mp:     the new mountpoint of @top_mnt on @new_parent
942  *
943  * Remove @top_mnt from its current mountpoint @top_mnt->mnt_mp and
944  * parent @top_mnt->mnt_parent and mount it on top of @new_parent at
945  * @new_mp. And mount @new_parent on the old parent and old
946  * mountpoint of @top_mnt.
947  *
948  * Context: This function expects namespace_lock() and lock_mount_hash()
949  *          to have been acquired in that order.
950  */
mnt_set_mountpoint_beneath(struct mount * new_parent,struct mount * top_mnt,struct mountpoint * new_mp)951 static void mnt_set_mountpoint_beneath(struct mount *new_parent,
952 				       struct mount *top_mnt,
953 				       struct mountpoint *new_mp)
954 {
955 	struct mount *old_top_parent = top_mnt->mnt_parent;
956 	struct mountpoint *old_top_mp = top_mnt->mnt_mp;
957 
958 	mnt_set_mountpoint(old_top_parent, old_top_mp, new_parent);
959 	mnt_change_mountpoint(new_parent, new_mp, top_mnt);
960 }
961 
962 
__attach_mnt(struct mount * mnt,struct mount * parent)963 static void __attach_mnt(struct mount *mnt, struct mount *parent)
964 {
965 	hlist_add_head_rcu(&mnt->mnt_hash,
966 			   m_hash(&parent->mnt, mnt->mnt_mountpoint));
967 	list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
968 }
969 
970 /**
971  * attach_mnt - mount a mount, attach to @mount_hashtable and parent's
972  *              list of child mounts
973  * @parent:  the parent
974  * @mnt:     the new mount
975  * @mp:      the new mountpoint
976  * @beneath: whether to mount @mnt beneath or on top of @parent
977  *
978  * If @beneath is false, mount @mnt at @mp on @parent. Then attach @mnt
979  * to @parent's child mount list and to @mount_hashtable.
980  *
981  * If @beneath is true, remove @mnt from its current parent and
982  * mountpoint and mount it on @mp on @parent, and mount @parent on the
983  * old parent and old mountpoint of @mnt. Finally, attach @parent to
984  * @mnt_hashtable and @parent->mnt_parent->mnt_mounts.
985  *
986  * Note, when __attach_mnt() is called @mnt->mnt_parent already points
987  * to the correct parent.
988  *
989  * Context: This function expects namespace_lock() and lock_mount_hash()
990  *          to have been acquired in that order.
991  */
attach_mnt(struct mount * mnt,struct mount * parent,struct mountpoint * mp,bool beneath)992 static void attach_mnt(struct mount *mnt, struct mount *parent,
993 		       struct mountpoint *mp, bool beneath)
994 {
995 	if (beneath)
996 		mnt_set_mountpoint_beneath(mnt, parent, mp);
997 	else
998 		mnt_set_mountpoint(parent, mp, mnt);
999 	/*
1000 	 * Note, @mnt->mnt_parent has to be used. If @mnt was mounted
1001 	 * beneath @parent then @mnt will need to be attached to
1002 	 * @parent's old parent, not @parent. IOW, @mnt->mnt_parent
1003 	 * isn't the same mount as @parent.
1004 	 */
1005 	__attach_mnt(mnt, mnt->mnt_parent);
1006 }
1007 
mnt_change_mountpoint(struct mount * parent,struct mountpoint * mp,struct mount * mnt)1008 void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct mount *mnt)
1009 {
1010 	struct mountpoint *old_mp = mnt->mnt_mp;
1011 	struct mount *old_parent = mnt->mnt_parent;
1012 
1013 	list_del_init(&mnt->mnt_child);
1014 	hlist_del_init(&mnt->mnt_mp_list);
1015 	hlist_del_init_rcu(&mnt->mnt_hash);
1016 
1017 	attach_mnt(mnt, parent, mp, false);
1018 
1019 	put_mountpoint(old_mp);
1020 	mnt_add_count(old_parent, -1);
1021 }
1022 
1023 /*
1024  * vfsmount lock must be held for write
1025  */
commit_tree(struct mount * mnt)1026 static void commit_tree(struct mount *mnt)
1027 {
1028 	struct mount *parent = mnt->mnt_parent;
1029 	struct mount *m;
1030 	LIST_HEAD(head);
1031 	struct mnt_namespace *n = parent->mnt_ns;
1032 
1033 	BUG_ON(parent == mnt);
1034 
1035 	list_add_tail(&head, &mnt->mnt_list);
1036 	list_for_each_entry(m, &head, mnt_list)
1037 		m->mnt_ns = n;
1038 
1039 	list_splice(&head, n->list.prev);
1040 
1041 	n->mounts += n->pending_mounts;
1042 	n->pending_mounts = 0;
1043 
1044 	__attach_mnt(mnt, parent);
1045 	touch_mnt_namespace(n);
1046 }
1047 
next_mnt(struct mount * p,struct mount * root)1048 static struct mount *next_mnt(struct mount *p, struct mount *root)
1049 {
1050 	struct list_head *next = p->mnt_mounts.next;
1051 	if (next == &p->mnt_mounts) {
1052 		while (1) {
1053 			if (p == root)
1054 				return NULL;
1055 			next = p->mnt_child.next;
1056 			if (next != &p->mnt_parent->mnt_mounts)
1057 				break;
1058 			p = p->mnt_parent;
1059 		}
1060 	}
1061 	return list_entry(next, struct mount, mnt_child);
1062 }
1063 
skip_mnt_tree(struct mount * p)1064 static struct mount *skip_mnt_tree(struct mount *p)
1065 {
1066 	struct list_head *prev = p->mnt_mounts.prev;
1067 	while (prev != &p->mnt_mounts) {
1068 		p = list_entry(prev, struct mount, mnt_child);
1069 		prev = p->mnt_mounts.prev;
1070 	}
1071 	return p;
1072 }
1073 
1074 /**
1075  * vfs_create_mount - Create a mount for a configured superblock
1076  * @fc: The configuration context with the superblock attached
1077  *
1078  * Create a mount to an already configured superblock.  If necessary, the
1079  * caller should invoke vfs_get_tree() before calling this.
1080  *
1081  * Note that this does not attach the mount to anything.
1082  */
vfs_create_mount(struct fs_context * fc)1083 struct vfsmount *vfs_create_mount(struct fs_context *fc)
1084 {
1085 	struct mount *mnt;
1086 
1087 	if (!fc->root)
1088 		return ERR_PTR(-EINVAL);
1089 
1090 	mnt = alloc_vfsmnt(fc->source ?: "none");
1091 	if (!mnt)
1092 		return ERR_PTR(-ENOMEM);
1093 
1094 	if (fc->sb_flags & SB_KERNMOUNT)
1095 		mnt->mnt.mnt_flags = MNT_INTERNAL;
1096 
1097 	atomic_inc(&fc->root->d_sb->s_active);
1098 	mnt->mnt.mnt_sb		= fc->root->d_sb;
1099 	mnt->mnt.mnt_root	= dget(fc->root);
1100 	mnt->mnt_mountpoint	= mnt->mnt.mnt_root;
1101 	mnt->mnt_parent		= mnt;
1102 
1103 	lock_mount_hash();
1104 	list_add_tail(&mnt->mnt_instance, &mnt->mnt.mnt_sb->s_mounts);
1105 	unlock_mount_hash();
1106 	return &mnt->mnt;
1107 }
1108 EXPORT_SYMBOL(vfs_create_mount);
1109 
fc_mount(struct fs_context * fc)1110 struct vfsmount *fc_mount(struct fs_context *fc)
1111 {
1112 	int err = vfs_get_tree(fc);
1113 	if (!err) {
1114 		up_write(&fc->root->d_sb->s_umount);
1115 		return vfs_create_mount(fc);
1116 	}
1117 	return ERR_PTR(err);
1118 }
1119 EXPORT_SYMBOL(fc_mount);
1120 
vfs_kern_mount(struct file_system_type * type,int flags,const char * name,void * data)1121 struct vfsmount *vfs_kern_mount(struct file_system_type *type,
1122 				int flags, const char *name,
1123 				void *data)
1124 {
1125 	struct fs_context *fc;
1126 	struct vfsmount *mnt;
1127 	int ret = 0;
1128 
1129 	if (!type)
1130 		return ERR_PTR(-EINVAL);
1131 
1132 	fc = fs_context_for_mount(type, flags);
1133 	if (IS_ERR(fc))
1134 		return ERR_CAST(fc);
1135 
1136 	if (name)
1137 		ret = vfs_parse_fs_string(fc, "source",
1138 					  name, strlen(name));
1139 	if (!ret)
1140 		ret = parse_monolithic_mount_data(fc, data);
1141 	if (!ret)
1142 		mnt = fc_mount(fc);
1143 	else
1144 		mnt = ERR_PTR(ret);
1145 
1146 	put_fs_context(fc);
1147 	return mnt;
1148 }
1149 EXPORT_SYMBOL_GPL(vfs_kern_mount);
1150 
1151 struct vfsmount *
vfs_submount(const struct dentry * mountpoint,struct file_system_type * type,const char * name,void * data)1152 vfs_submount(const struct dentry *mountpoint, struct file_system_type *type,
1153 	     const char *name, void *data)
1154 {
1155 	/* Until it is worked out how to pass the user namespace
1156 	 * through from the parent mount to the submount don't support
1157 	 * unprivileged mounts with submounts.
1158 	 */
1159 	if (mountpoint->d_sb->s_user_ns != &init_user_ns)
1160 		return ERR_PTR(-EPERM);
1161 
1162 	return vfs_kern_mount(type, SB_SUBMOUNT, name, data);
1163 }
1164 EXPORT_SYMBOL_GPL(vfs_submount);
1165 
clone_mnt(struct mount * old,struct dentry * root,int flag)1166 static struct mount *clone_mnt(struct mount *old, struct dentry *root,
1167 					int flag)
1168 {
1169 	struct super_block *sb = old->mnt.mnt_sb;
1170 	struct mount *mnt;
1171 	int err;
1172 
1173 	mnt = alloc_vfsmnt(old->mnt_devname);
1174 	if (!mnt)
1175 		return ERR_PTR(-ENOMEM);
1176 
1177 	if (flag & (CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE))
1178 		mnt->mnt_group_id = 0; /* not a peer of original */
1179 	else
1180 		mnt->mnt_group_id = old->mnt_group_id;
1181 
1182 	if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) {
1183 		err = mnt_alloc_group_id(mnt);
1184 		if (err)
1185 			goto out_free;
1186 	}
1187 
1188 	mnt->mnt.mnt_flags = old->mnt.mnt_flags;
1189 	mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL);
1190 
1191 	atomic_inc(&sb->s_active);
1192 	mnt->mnt.mnt_idmap = mnt_idmap_get(mnt_idmap(&old->mnt));
1193 
1194 	mnt->mnt.mnt_sb = sb;
1195 	mnt->mnt.mnt_root = dget(root);
1196 	mnt->mnt_mountpoint = mnt->mnt.mnt_root;
1197 	mnt->mnt_parent = mnt;
1198 	lock_mount_hash();
1199 	list_add_tail(&mnt->mnt_instance, &sb->s_mounts);
1200 	unlock_mount_hash();
1201 
1202 	if ((flag & CL_SLAVE) ||
1203 	    ((flag & CL_SHARED_TO_SLAVE) && IS_MNT_SHARED(old))) {
1204 		list_add(&mnt->mnt_slave, &old->mnt_slave_list);
1205 		mnt->mnt_master = old;
1206 		CLEAR_MNT_SHARED(mnt);
1207 	} else if (!(flag & CL_PRIVATE)) {
1208 		if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old))
1209 			list_add(&mnt->mnt_share, &old->mnt_share);
1210 		if (IS_MNT_SLAVE(old))
1211 			list_add(&mnt->mnt_slave, &old->mnt_slave);
1212 		mnt->mnt_master = old->mnt_master;
1213 	} else {
1214 		CLEAR_MNT_SHARED(mnt);
1215 	}
1216 	if (flag & CL_MAKE_SHARED)
1217 		set_mnt_shared(mnt);
1218 
1219 	/* stick the duplicate mount on the same expiry list
1220 	 * as the original if that was on one */
1221 	if (flag & CL_EXPIRE) {
1222 		if (!list_empty(&old->mnt_expire))
1223 			list_add(&mnt->mnt_expire, &old->mnt_expire);
1224 	}
1225 
1226 	return mnt;
1227 
1228  out_free:
1229 	mnt_free_id(mnt);
1230 	free_vfsmnt(mnt);
1231 	return ERR_PTR(err);
1232 }
1233 
cleanup_mnt(struct mount * mnt)1234 static void cleanup_mnt(struct mount *mnt)
1235 {
1236 	struct hlist_node *p;
1237 	struct mount *m;
1238 	/*
1239 	 * The warning here probably indicates that somebody messed
1240 	 * up a mnt_want/drop_write() pair.  If this happens, the
1241 	 * filesystem was probably unable to make r/w->r/o transitions.
1242 	 * The locking used to deal with mnt_count decrement provides barriers,
1243 	 * so mnt_get_writers() below is safe.
1244 	 */
1245 	WARN_ON(mnt_get_writers(mnt));
1246 	if (unlikely(mnt->mnt_pins.first))
1247 		mnt_pin_kill(mnt);
1248 	hlist_for_each_entry_safe(m, p, &mnt->mnt_stuck_children, mnt_umount) {
1249 		hlist_del(&m->mnt_umount);
1250 		mntput(&m->mnt);
1251 	}
1252 	fsnotify_vfsmount_delete(&mnt->mnt);
1253 	dput(mnt->mnt.mnt_root);
1254 	deactivate_super(mnt->mnt.mnt_sb);
1255 	mnt_free_id(mnt);
1256 	call_rcu(&mnt->mnt_rcu, delayed_free_vfsmnt);
1257 }
1258 
__cleanup_mnt(struct rcu_head * head)1259 static void __cleanup_mnt(struct rcu_head *head)
1260 {
1261 	cleanup_mnt(container_of(head, struct mount, mnt_rcu));
1262 }
1263 
1264 static LLIST_HEAD(delayed_mntput_list);
delayed_mntput(struct work_struct * unused)1265 static void delayed_mntput(struct work_struct *unused)
1266 {
1267 	struct llist_node *node = llist_del_all(&delayed_mntput_list);
1268 	struct mount *m, *t;
1269 
1270 	llist_for_each_entry_safe(m, t, node, mnt_llist)
1271 		cleanup_mnt(m);
1272 }
1273 static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput);
1274 
mntput_no_expire(struct mount * mnt)1275 static void mntput_no_expire(struct mount *mnt)
1276 {
1277 	LIST_HEAD(list);
1278 	int count;
1279 
1280 	rcu_read_lock();
1281 	if (likely(READ_ONCE(mnt->mnt_ns))) {
1282 		/*
1283 		 * Since we don't do lock_mount_hash() here,
1284 		 * ->mnt_ns can change under us.  However, if it's
1285 		 * non-NULL, then there's a reference that won't
1286 		 * be dropped until after an RCU delay done after
1287 		 * turning ->mnt_ns NULL.  So if we observe it
1288 		 * non-NULL under rcu_read_lock(), the reference
1289 		 * we are dropping is not the final one.
1290 		 */
1291 		mnt_add_count(mnt, -1);
1292 		rcu_read_unlock();
1293 		return;
1294 	}
1295 	lock_mount_hash();
1296 	/*
1297 	 * make sure that if __legitimize_mnt() has not seen us grab
1298 	 * mount_lock, we'll see their refcount increment here.
1299 	 */
1300 	smp_mb();
1301 	mnt_add_count(mnt, -1);
1302 	count = mnt_get_count(mnt);
1303 	if (count != 0) {
1304 		WARN_ON(count < 0);
1305 		rcu_read_unlock();
1306 		unlock_mount_hash();
1307 		return;
1308 	}
1309 	if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) {
1310 		rcu_read_unlock();
1311 		unlock_mount_hash();
1312 		return;
1313 	}
1314 	mnt->mnt.mnt_flags |= MNT_DOOMED;
1315 	rcu_read_unlock();
1316 
1317 	list_del(&mnt->mnt_instance);
1318 
1319 	if (unlikely(!list_empty(&mnt->mnt_mounts))) {
1320 		struct mount *p, *tmp;
1321 		list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts,  mnt_child) {
1322 			__put_mountpoint(unhash_mnt(p), &list);
1323 			hlist_add_head(&p->mnt_umount, &mnt->mnt_stuck_children);
1324 		}
1325 	}
1326 	unlock_mount_hash();
1327 	shrink_dentry_list(&list);
1328 
1329 	if (likely(!(mnt->mnt.mnt_flags & MNT_INTERNAL))) {
1330 		struct task_struct *task = current;
1331 		if (likely(!(task->flags & PF_KTHREAD))) {
1332 			init_task_work(&mnt->mnt_rcu, __cleanup_mnt);
1333 			if (!task_work_add(task, &mnt->mnt_rcu, TWA_RESUME))
1334 				return;
1335 		}
1336 		if (llist_add(&mnt->mnt_llist, &delayed_mntput_list))
1337 			schedule_delayed_work(&delayed_mntput_work, 1);
1338 		return;
1339 	}
1340 	cleanup_mnt(mnt);
1341 }
1342 
mntput(struct vfsmount * mnt)1343 void mntput(struct vfsmount *mnt)
1344 {
1345 	if (mnt) {
1346 		struct mount *m = real_mount(mnt);
1347 		/* avoid cacheline pingpong, hope gcc doesn't get "smart" */
1348 		if (unlikely(m->mnt_expiry_mark))
1349 			m->mnt_expiry_mark = 0;
1350 		mntput_no_expire(m);
1351 	}
1352 }
1353 EXPORT_SYMBOL(mntput);
1354 
mntget(struct vfsmount * mnt)1355 struct vfsmount *mntget(struct vfsmount *mnt)
1356 {
1357 	if (mnt)
1358 		mnt_add_count(real_mount(mnt), 1);
1359 	return mnt;
1360 }
1361 EXPORT_SYMBOL(mntget);
1362 
1363 /*
1364  * Make a mount point inaccessible to new lookups.
1365  * Because there may still be current users, the caller MUST WAIT
1366  * for an RCU grace period before destroying the mount point.
1367  */
mnt_make_shortterm(struct vfsmount * mnt)1368 void mnt_make_shortterm(struct vfsmount *mnt)
1369 {
1370 	if (mnt)
1371 		real_mount(mnt)->mnt_ns = NULL;
1372 }
1373 
1374 /**
1375  * path_is_mountpoint() - Check if path is a mount in the current namespace.
1376  * @path: path to check
1377  *
1378  *  d_mountpoint() can only be used reliably to establish if a dentry is
1379  *  not mounted in any namespace and that common case is handled inline.
1380  *  d_mountpoint() isn't aware of the possibility there may be multiple
1381  *  mounts using a given dentry in a different namespace. This function
1382  *  checks if the passed in path is a mountpoint rather than the dentry
1383  *  alone.
1384  */
path_is_mountpoint(const struct path * path)1385 bool path_is_mountpoint(const struct path *path)
1386 {
1387 	unsigned seq;
1388 	bool res;
1389 
1390 	if (!d_mountpoint(path->dentry))
1391 		return false;
1392 
1393 	rcu_read_lock();
1394 	do {
1395 		seq = read_seqbegin(&mount_lock);
1396 		res = __path_is_mountpoint(path);
1397 	} while (read_seqretry(&mount_lock, seq));
1398 	rcu_read_unlock();
1399 
1400 	return res;
1401 }
1402 EXPORT_SYMBOL(path_is_mountpoint);
1403 
mnt_clone_internal(const struct path * path)1404 struct vfsmount *mnt_clone_internal(const struct path *path)
1405 {
1406 	struct mount *p;
1407 	p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE);
1408 	if (IS_ERR(p))
1409 		return ERR_CAST(p);
1410 	p->mnt.mnt_flags |= MNT_INTERNAL;
1411 	return &p->mnt;
1412 }
1413 
1414 #ifdef CONFIG_PROC_FS
mnt_list_next(struct mnt_namespace * ns,struct list_head * p)1415 static struct mount *mnt_list_next(struct mnt_namespace *ns,
1416 				   struct list_head *p)
1417 {
1418 	struct mount *mnt, *ret = NULL;
1419 
1420 	lock_ns_list(ns);
1421 	list_for_each_continue(p, &ns->list) {
1422 		mnt = list_entry(p, typeof(*mnt), mnt_list);
1423 		if (!mnt_is_cursor(mnt)) {
1424 			ret = mnt;
1425 			break;
1426 		}
1427 	}
1428 	unlock_ns_list(ns);
1429 
1430 	return ret;
1431 }
1432 
1433 /* iterator; we want it to have access to namespace_sem, thus here... */
m_start(struct seq_file * m,loff_t * pos)1434 static void *m_start(struct seq_file *m, loff_t *pos)
1435 {
1436 	struct proc_mounts *p = m->private;
1437 	struct list_head *prev;
1438 
1439 	down_read(&namespace_sem);
1440 	if (!*pos) {
1441 		prev = &p->ns->list;
1442 	} else {
1443 		prev = &p->cursor.mnt_list;
1444 
1445 		/* Read after we'd reached the end? */
1446 		if (list_empty(prev))
1447 			return NULL;
1448 	}
1449 
1450 	return mnt_list_next(p->ns, prev);
1451 }
1452 
m_next(struct seq_file * m,void * v,loff_t * pos)1453 static void *m_next(struct seq_file *m, void *v, loff_t *pos)
1454 {
1455 	struct proc_mounts *p = m->private;
1456 	struct mount *mnt = v;
1457 
1458 	++*pos;
1459 	return mnt_list_next(p->ns, &mnt->mnt_list);
1460 }
1461 
m_stop(struct seq_file * m,void * v)1462 static void m_stop(struct seq_file *m, void *v)
1463 {
1464 	struct proc_mounts *p = m->private;
1465 	struct mount *mnt = v;
1466 
1467 	lock_ns_list(p->ns);
1468 	if (mnt)
1469 		list_move_tail(&p->cursor.mnt_list, &mnt->mnt_list);
1470 	else
1471 		list_del_init(&p->cursor.mnt_list);
1472 	unlock_ns_list(p->ns);
1473 	up_read(&namespace_sem);
1474 }
1475 
m_show(struct seq_file * m,void * v)1476 static int m_show(struct seq_file *m, void *v)
1477 {
1478 	struct proc_mounts *p = m->private;
1479 	struct mount *r = v;
1480 	return p->show(m, &r->mnt);
1481 }
1482 
1483 const struct seq_operations mounts_op = {
1484 	.start	= m_start,
1485 	.next	= m_next,
1486 	.stop	= m_stop,
1487 	.show	= m_show,
1488 };
1489 
mnt_cursor_del(struct mnt_namespace * ns,struct mount * cursor)1490 void mnt_cursor_del(struct mnt_namespace *ns, struct mount *cursor)
1491 {
1492 	down_read(&namespace_sem);
1493 	lock_ns_list(ns);
1494 	list_del(&cursor->mnt_list);
1495 	unlock_ns_list(ns);
1496 	up_read(&namespace_sem);
1497 }
1498 #endif  /* CONFIG_PROC_FS */
1499 
1500 /**
1501  * may_umount_tree - check if a mount tree is busy
1502  * @m: root of mount tree
1503  *
1504  * This is called to check if a tree of mounts has any
1505  * open files, pwds, chroots or sub mounts that are
1506  * busy.
1507  */
may_umount_tree(struct vfsmount * m)1508 int may_umount_tree(struct vfsmount *m)
1509 {
1510 	struct mount *mnt = real_mount(m);
1511 	int actual_refs = 0;
1512 	int minimum_refs = 0;
1513 	struct mount *p;
1514 	BUG_ON(!m);
1515 
1516 	/* write lock needed for mnt_get_count */
1517 	lock_mount_hash();
1518 	for (p = mnt; p; p = next_mnt(p, mnt)) {
1519 		actual_refs += mnt_get_count(p);
1520 		minimum_refs += 2;
1521 	}
1522 	unlock_mount_hash();
1523 
1524 	if (actual_refs > minimum_refs)
1525 		return 0;
1526 
1527 	return 1;
1528 }
1529 
1530 EXPORT_SYMBOL(may_umount_tree);
1531 
1532 /**
1533  * may_umount - check if a mount point is busy
1534  * @mnt: root of mount
1535  *
1536  * This is called to check if a mount point has any
1537  * open files, pwds, chroots or sub mounts. If the
1538  * mount has sub mounts this will return busy
1539  * regardless of whether the sub mounts are busy.
1540  *
1541  * Doesn't take quota and stuff into account. IOW, in some cases it will
1542  * give false negatives. The main reason why it's here is that we need
1543  * a non-destructive way to look for easily umountable filesystems.
1544  */
may_umount(struct vfsmount * mnt)1545 int may_umount(struct vfsmount *mnt)
1546 {
1547 	int ret = 1;
1548 	down_read(&namespace_sem);
1549 	lock_mount_hash();
1550 	if (propagate_mount_busy(real_mount(mnt), 2))
1551 		ret = 0;
1552 	unlock_mount_hash();
1553 	up_read(&namespace_sem);
1554 	return ret;
1555 }
1556 
1557 EXPORT_SYMBOL(may_umount);
1558 
namespace_unlock(void)1559 static void namespace_unlock(void)
1560 {
1561 	struct hlist_head head;
1562 	struct hlist_node *p;
1563 	struct mount *m;
1564 	LIST_HEAD(list);
1565 
1566 	hlist_move_list(&unmounted, &head);
1567 	list_splice_init(&ex_mountpoints, &list);
1568 
1569 	up_write(&namespace_sem);
1570 
1571 	shrink_dentry_list(&list);
1572 
1573 	if (likely(hlist_empty(&head)))
1574 		return;
1575 
1576 	synchronize_rcu_expedited();
1577 
1578 	hlist_for_each_entry_safe(m, p, &head, mnt_umount) {
1579 		hlist_del(&m->mnt_umount);
1580 		mntput(&m->mnt);
1581 	}
1582 }
1583 
namespace_lock(void)1584 static inline void namespace_lock(void)
1585 {
1586 	down_write(&namespace_sem);
1587 }
1588 
1589 enum umount_tree_flags {
1590 	UMOUNT_SYNC = 1,
1591 	UMOUNT_PROPAGATE = 2,
1592 	UMOUNT_CONNECTED = 4,
1593 };
1594 
disconnect_mount(struct mount * mnt,enum umount_tree_flags how)1595 static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
1596 {
1597 	/* Leaving mounts connected is only valid for lazy umounts */
1598 	if (how & UMOUNT_SYNC)
1599 		return true;
1600 
1601 	/* A mount without a parent has nothing to be connected to */
1602 	if (!mnt_has_parent(mnt))
1603 		return true;
1604 
1605 	/* Because the reference counting rules change when mounts are
1606 	 * unmounted and connected, umounted mounts may not be
1607 	 * connected to mounted mounts.
1608 	 */
1609 	if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
1610 		return true;
1611 
1612 	/* Has it been requested that the mount remain connected? */
1613 	if (how & UMOUNT_CONNECTED)
1614 		return false;
1615 
1616 	/* Is the mount locked such that it needs to remain connected? */
1617 	if (IS_MNT_LOCKED(mnt))
1618 		return false;
1619 
1620 	/* By default disconnect the mount */
1621 	return true;
1622 }
1623 
1624 /*
1625  * mount_lock must be held
1626  * namespace_sem must be held for write
1627  */
umount_tree(struct mount * mnt,enum umount_tree_flags how)1628 static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
1629 {
1630 	LIST_HEAD(tmp_list);
1631 	struct mount *p;
1632 
1633 	if (how & UMOUNT_PROPAGATE)
1634 		propagate_mount_unlock(mnt);
1635 
1636 	/* Gather the mounts to umount */
1637 	for (p = mnt; p; p = next_mnt(p, mnt)) {
1638 		p->mnt.mnt_flags |= MNT_UMOUNT;
1639 		list_move(&p->mnt_list, &tmp_list);
1640 	}
1641 
1642 	/* Hide the mounts from mnt_mounts */
1643 	list_for_each_entry(p, &tmp_list, mnt_list) {
1644 		list_del_init(&p->mnt_child);
1645 	}
1646 
1647 	/* Add propogated mounts to the tmp_list */
1648 	if (how & UMOUNT_PROPAGATE)
1649 		propagate_umount(&tmp_list);
1650 
1651 	while (!list_empty(&tmp_list)) {
1652 		struct mnt_namespace *ns;
1653 		bool disconnect;
1654 		p = list_first_entry(&tmp_list, struct mount, mnt_list);
1655 		list_del_init(&p->mnt_expire);
1656 		list_del_init(&p->mnt_list);
1657 		ns = p->mnt_ns;
1658 		if (ns) {
1659 			ns->mounts--;
1660 			__touch_mnt_namespace(ns);
1661 		}
1662 		p->mnt_ns = NULL;
1663 		if (how & UMOUNT_SYNC)
1664 			p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
1665 
1666 		disconnect = disconnect_mount(p, how);
1667 		if (mnt_has_parent(p)) {
1668 			mnt_add_count(p->mnt_parent, -1);
1669 			if (!disconnect) {
1670 				/* Don't forget about p */
1671 				list_add_tail(&p->mnt_child, &p->mnt_parent->mnt_mounts);
1672 			} else {
1673 				umount_mnt(p);
1674 			}
1675 		}
1676 		change_mnt_propagation(p, MS_PRIVATE);
1677 		if (disconnect)
1678 			hlist_add_head(&p->mnt_umount, &unmounted);
1679 	}
1680 }
1681 
1682 static void shrink_submounts(struct mount *mnt);
1683 
do_umount_root(struct super_block * sb)1684 static int do_umount_root(struct super_block *sb)
1685 {
1686 	int ret = 0;
1687 
1688 	down_write(&sb->s_umount);
1689 	if (!sb_rdonly(sb)) {
1690 		struct fs_context *fc;
1691 
1692 		fc = fs_context_for_reconfigure(sb->s_root, SB_RDONLY,
1693 						SB_RDONLY);
1694 		if (IS_ERR(fc)) {
1695 			ret = PTR_ERR(fc);
1696 		} else {
1697 			ret = parse_monolithic_mount_data(fc, NULL);
1698 			if (!ret)
1699 				ret = reconfigure_super(fc);
1700 			put_fs_context(fc);
1701 		}
1702 	}
1703 	up_write(&sb->s_umount);
1704 	return ret;
1705 }
1706 
do_umount(struct mount * mnt,int flags)1707 static int do_umount(struct mount *mnt, int flags)
1708 {
1709 	struct super_block *sb = mnt->mnt.mnt_sb;
1710 	int retval;
1711 
1712 	retval = security_sb_umount(&mnt->mnt, flags);
1713 	if (retval)
1714 		return retval;
1715 
1716 	/*
1717 	 * Allow userspace to request a mountpoint be expired rather than
1718 	 * unmounting unconditionally. Unmount only happens if:
1719 	 *  (1) the mark is already set (the mark is cleared by mntput())
1720 	 *  (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount]
1721 	 */
1722 	if (flags & MNT_EXPIRE) {
1723 		if (&mnt->mnt == current->fs->root.mnt ||
1724 		    flags & (MNT_FORCE | MNT_DETACH))
1725 			return -EINVAL;
1726 
1727 		/*
1728 		 * probably don't strictly need the lock here if we examined
1729 		 * all race cases, but it's a slowpath.
1730 		 */
1731 		lock_mount_hash();
1732 		if (mnt_get_count(mnt) != 2) {
1733 			unlock_mount_hash();
1734 			return -EBUSY;
1735 		}
1736 		unlock_mount_hash();
1737 
1738 		if (!xchg(&mnt->mnt_expiry_mark, 1))
1739 			return -EAGAIN;
1740 	}
1741 
1742 	/*
1743 	 * If we may have to abort operations to get out of this
1744 	 * mount, and they will themselves hold resources we must
1745 	 * allow the fs to do things. In the Unix tradition of
1746 	 * 'Gee thats tricky lets do it in userspace' the umount_begin
1747 	 * might fail to complete on the first run through as other tasks
1748 	 * must return, and the like. Thats for the mount program to worry
1749 	 * about for the moment.
1750 	 */
1751 
1752 	if (flags & MNT_FORCE && sb->s_op->umount_begin) {
1753 		sb->s_op->umount_begin(sb);
1754 	}
1755 
1756 	/*
1757 	 * No sense to grab the lock for this test, but test itself looks
1758 	 * somewhat bogus. Suggestions for better replacement?
1759 	 * Ho-hum... In principle, we might treat that as umount + switch
1760 	 * to rootfs. GC would eventually take care of the old vfsmount.
1761 	 * Actually it makes sense, especially if rootfs would contain a
1762 	 * /reboot - static binary that would close all descriptors and
1763 	 * call reboot(9). Then init(8) could umount root and exec /reboot.
1764 	 */
1765 	if (&mnt->mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) {
1766 		/*
1767 		 * Special case for "unmounting" root ...
1768 		 * we just try to remount it readonly.
1769 		 */
1770 		if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))
1771 			return -EPERM;
1772 		return do_umount_root(sb);
1773 	}
1774 
1775 	namespace_lock();
1776 	lock_mount_hash();
1777 
1778 	/* Recheck MNT_LOCKED with the locks held */
1779 	retval = -EINVAL;
1780 	if (mnt->mnt.mnt_flags & MNT_LOCKED)
1781 		goto out;
1782 
1783 	event++;
1784 	if (flags & MNT_DETACH) {
1785 		if (!list_empty(&mnt->mnt_list))
1786 			umount_tree(mnt, UMOUNT_PROPAGATE);
1787 		retval = 0;
1788 	} else {
1789 		shrink_submounts(mnt);
1790 		retval = -EBUSY;
1791 		if (!propagate_mount_busy(mnt, 2)) {
1792 			if (!list_empty(&mnt->mnt_list))
1793 				umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
1794 			retval = 0;
1795 		}
1796 	}
1797 out:
1798 	unlock_mount_hash();
1799 	namespace_unlock();
1800 	return retval;
1801 }
1802 
1803 /*
1804  * __detach_mounts - lazily unmount all mounts on the specified dentry
1805  *
1806  * During unlink, rmdir, and d_drop it is possible to loose the path
1807  * to an existing mountpoint, and wind up leaking the mount.
1808  * detach_mounts allows lazily unmounting those mounts instead of
1809  * leaking them.
1810  *
1811  * The caller may hold dentry->d_inode->i_mutex.
1812  */
__detach_mounts(struct dentry * dentry)1813 void __detach_mounts(struct dentry *dentry)
1814 {
1815 	struct mountpoint *mp;
1816 	struct mount *mnt;
1817 
1818 	namespace_lock();
1819 	lock_mount_hash();
1820 	mp = lookup_mountpoint(dentry);
1821 	if (!mp)
1822 		goto out_unlock;
1823 
1824 	event++;
1825 	while (!hlist_empty(&mp->m_list)) {
1826 		mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
1827 		if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
1828 			umount_mnt(mnt);
1829 			hlist_add_head(&mnt->mnt_umount, &unmounted);
1830 		}
1831 		else umount_tree(mnt, UMOUNT_CONNECTED);
1832 	}
1833 	put_mountpoint(mp);
1834 out_unlock:
1835 	unlock_mount_hash();
1836 	namespace_unlock();
1837 }
1838 
1839 /*
1840  * Is the caller allowed to modify his namespace?
1841  */
may_mount(void)1842 bool may_mount(void)
1843 {
1844 	return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
1845 }
1846 
1847 /**
1848  * path_mounted - check whether path is mounted
1849  * @path: path to check
1850  *
1851  * Determine whether @path refers to the root of a mount.
1852  *
1853  * Return: true if @path is the root of a mount, false if not.
1854  */
path_mounted(const struct path * path)1855 static inline bool path_mounted(const struct path *path)
1856 {
1857 	return path->mnt->mnt_root == path->dentry;
1858 }
1859 
warn_mandlock(void)1860 static void warn_mandlock(void)
1861 {
1862 	pr_warn_once("=======================================================\n"
1863 		     "WARNING: The mand mount option has been deprecated and\n"
1864 		     "         and is ignored by this kernel. Remove the mand\n"
1865 		     "         option from the mount to silence this warning.\n"
1866 		     "=======================================================\n");
1867 }
1868 
can_umount(const struct path * path,int flags)1869 static int can_umount(const struct path *path, int flags)
1870 {
1871 	struct mount *mnt = real_mount(path->mnt);
1872 
1873 	if (!may_mount())
1874 		return -EPERM;
1875 	if (!path_mounted(path))
1876 		return -EINVAL;
1877 	if (!check_mnt(mnt))
1878 		return -EINVAL;
1879 	if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */
1880 		return -EINVAL;
1881 	if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN))
1882 		return -EPERM;
1883 	return 0;
1884 }
1885 
1886 // caller is responsible for flags being sane
path_umount(struct path * path,int flags)1887 int path_umount(struct path *path, int flags)
1888 {
1889 	struct mount *mnt = real_mount(path->mnt);
1890 	int ret;
1891 
1892 	ret = can_umount(path, flags);
1893 	if (!ret)
1894 		ret = do_umount(mnt, flags);
1895 
1896 	/* we mustn't call path_put() as that would clear mnt_expiry_mark */
1897 	dput(path->dentry);
1898 	mntput_no_expire(mnt);
1899 	return ret;
1900 }
1901 
ksys_umount(char __user * name,int flags)1902 static int ksys_umount(char __user *name, int flags)
1903 {
1904 	int lookup_flags = LOOKUP_MOUNTPOINT;
1905 	struct path path;
1906 	int ret;
1907 
1908 	// basic validity checks done first
1909 	if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
1910 		return -EINVAL;
1911 
1912 	if (!(flags & UMOUNT_NOFOLLOW))
1913 		lookup_flags |= LOOKUP_FOLLOW;
1914 	ret = user_path_at(AT_FDCWD, name, lookup_flags, &path);
1915 	if (ret)
1916 		return ret;
1917 	return path_umount(&path, flags);
1918 }
1919 
SYSCALL_DEFINE2(umount,char __user *,name,int,flags)1920 SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
1921 {
1922 	return ksys_umount(name, flags);
1923 }
1924 
1925 #ifdef __ARCH_WANT_SYS_OLDUMOUNT
1926 
1927 /*
1928  *	The 2.0 compatible umount. No flags.
1929  */
SYSCALL_DEFINE1(oldumount,char __user *,name)1930 SYSCALL_DEFINE1(oldumount, char __user *, name)
1931 {
1932 	return ksys_umount(name, 0);
1933 }
1934 
1935 #endif
1936 
is_mnt_ns_file(struct dentry * dentry)1937 static bool is_mnt_ns_file(struct dentry *dentry)
1938 {
1939 	/* Is this a proxy for a mount namespace? */
1940 	return dentry->d_op == &ns_dentry_operations &&
1941 	       dentry->d_fsdata == &mntns_operations;
1942 }
1943 
to_mnt_ns(struct ns_common * ns)1944 static struct mnt_namespace *to_mnt_ns(struct ns_common *ns)
1945 {
1946 	return container_of(ns, struct mnt_namespace, ns);
1947 }
1948 
from_mnt_ns(struct mnt_namespace * mnt)1949 struct ns_common *from_mnt_ns(struct mnt_namespace *mnt)
1950 {
1951 	return &mnt->ns;
1952 }
1953 
mnt_ns_loop(struct dentry * dentry)1954 static bool mnt_ns_loop(struct dentry *dentry)
1955 {
1956 	/* Could bind mounting the mount namespace inode cause a
1957 	 * mount namespace loop?
1958 	 */
1959 	struct mnt_namespace *mnt_ns;
1960 	if (!is_mnt_ns_file(dentry))
1961 		return false;
1962 
1963 	mnt_ns = to_mnt_ns(get_proc_ns(dentry->d_inode));
1964 	return current->nsproxy->mnt_ns->seq >= mnt_ns->seq;
1965 }
1966 
copy_tree(struct mount * mnt,struct dentry * dentry,int flag)1967 struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
1968 					int flag)
1969 {
1970 	struct mount *res, *p, *q, *r, *parent;
1971 
1972 	if (!(flag & CL_COPY_UNBINDABLE) && IS_MNT_UNBINDABLE(mnt))
1973 		return ERR_PTR(-EINVAL);
1974 
1975 	if (!(flag & CL_COPY_MNT_NS_FILE) && is_mnt_ns_file(dentry))
1976 		return ERR_PTR(-EINVAL);
1977 
1978 	res = q = clone_mnt(mnt, dentry, flag);
1979 	if (IS_ERR(q))
1980 		return q;
1981 
1982 	q->mnt_mountpoint = mnt->mnt_mountpoint;
1983 
1984 	p = mnt;
1985 	list_for_each_entry(r, &mnt->mnt_mounts, mnt_child) {
1986 		struct mount *s;
1987 		if (!is_subdir(r->mnt_mountpoint, dentry))
1988 			continue;
1989 
1990 		for (s = r; s; s = next_mnt(s, r)) {
1991 			if (!(flag & CL_COPY_UNBINDABLE) &&
1992 			    IS_MNT_UNBINDABLE(s)) {
1993 				if (s->mnt.mnt_flags & MNT_LOCKED) {
1994 					/* Both unbindable and locked. */
1995 					q = ERR_PTR(-EPERM);
1996 					goto out;
1997 				} else {
1998 					s = skip_mnt_tree(s);
1999 					continue;
2000 				}
2001 			}
2002 			if (!(flag & CL_COPY_MNT_NS_FILE) &&
2003 			    is_mnt_ns_file(s->mnt.mnt_root)) {
2004 				s = skip_mnt_tree(s);
2005 				continue;
2006 			}
2007 			while (p != s->mnt_parent) {
2008 				p = p->mnt_parent;
2009 				q = q->mnt_parent;
2010 			}
2011 			p = s;
2012 			parent = q;
2013 			q = clone_mnt(p, p->mnt.mnt_root, flag);
2014 			if (IS_ERR(q))
2015 				goto out;
2016 			lock_mount_hash();
2017 			list_add_tail(&q->mnt_list, &res->mnt_list);
2018 			attach_mnt(q, parent, p->mnt_mp, false);
2019 			unlock_mount_hash();
2020 		}
2021 	}
2022 	return res;
2023 out:
2024 	if (res) {
2025 		lock_mount_hash();
2026 		umount_tree(res, UMOUNT_SYNC);
2027 		unlock_mount_hash();
2028 	}
2029 	return q;
2030 }
2031 
2032 /* Caller should check returned pointer for errors */
2033 
collect_mounts(const struct path * path)2034 struct vfsmount *collect_mounts(const struct path *path)
2035 {
2036 	struct mount *tree;
2037 	namespace_lock();
2038 	if (!check_mnt(real_mount(path->mnt)))
2039 		tree = ERR_PTR(-EINVAL);
2040 	else
2041 		tree = copy_tree(real_mount(path->mnt), path->dentry,
2042 				 CL_COPY_ALL | CL_PRIVATE);
2043 	namespace_unlock();
2044 	if (IS_ERR(tree))
2045 		return ERR_CAST(tree);
2046 	return &tree->mnt;
2047 }
2048 
2049 static void free_mnt_ns(struct mnt_namespace *);
2050 static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *, bool);
2051 
dissolve_on_fput(struct vfsmount * mnt)2052 void dissolve_on_fput(struct vfsmount *mnt)
2053 {
2054 	struct mnt_namespace *ns;
2055 	namespace_lock();
2056 	lock_mount_hash();
2057 	ns = real_mount(mnt)->mnt_ns;
2058 	if (ns) {
2059 		if (is_anon_ns(ns))
2060 			umount_tree(real_mount(mnt), UMOUNT_CONNECTED);
2061 		else
2062 			ns = NULL;
2063 	}
2064 	unlock_mount_hash();
2065 	namespace_unlock();
2066 	if (ns)
2067 		free_mnt_ns(ns);
2068 }
2069 
drop_collected_mounts(struct vfsmount * mnt)2070 void drop_collected_mounts(struct vfsmount *mnt)
2071 {
2072 	namespace_lock();
2073 	lock_mount_hash();
2074 	umount_tree(real_mount(mnt), 0);
2075 	unlock_mount_hash();
2076 	namespace_unlock();
2077 }
2078 
has_locked_children(struct mount * mnt,struct dentry * dentry)2079 static bool has_locked_children(struct mount *mnt, struct dentry *dentry)
2080 {
2081 	struct mount *child;
2082 
2083 	list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
2084 		if (!is_subdir(child->mnt_mountpoint, dentry))
2085 			continue;
2086 
2087 		if (child->mnt.mnt_flags & MNT_LOCKED)
2088 			return true;
2089 	}
2090 	return false;
2091 }
2092 
2093 /**
2094  * clone_private_mount - create a private clone of a path
2095  * @path: path to clone
2096  *
2097  * This creates a new vfsmount, which will be the clone of @path.  The new mount
2098  * will not be attached anywhere in the namespace and will be private (i.e.
2099  * changes to the originating mount won't be propagated into this).
2100  *
2101  * Release with mntput().
2102  */
clone_private_mount(const struct path * path)2103 struct vfsmount *clone_private_mount(const struct path *path)
2104 {
2105 	struct mount *old_mnt = real_mount(path->mnt);
2106 	struct mount *new_mnt;
2107 
2108 	down_read(&namespace_sem);
2109 	if (IS_MNT_UNBINDABLE(old_mnt))
2110 		goto invalid;
2111 
2112 	if (!check_mnt(old_mnt))
2113 		goto invalid;
2114 
2115 	if (has_locked_children(old_mnt, path->dentry))
2116 		goto invalid;
2117 
2118 	new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
2119 	up_read(&namespace_sem);
2120 
2121 	if (IS_ERR(new_mnt))
2122 		return ERR_CAST(new_mnt);
2123 
2124 	/* Longterm mount to be removed by kern_unmount*() */
2125 	new_mnt->mnt_ns = MNT_NS_INTERNAL;
2126 
2127 	return &new_mnt->mnt;
2128 
2129 invalid:
2130 	up_read(&namespace_sem);
2131 	return ERR_PTR(-EINVAL);
2132 }
2133 EXPORT_SYMBOL_GPL(clone_private_mount);
2134 
iterate_mounts(int (* f)(struct vfsmount *,void *),void * arg,struct vfsmount * root)2135 int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg,
2136 		   struct vfsmount *root)
2137 {
2138 	struct mount *mnt;
2139 	int res = f(root, arg);
2140 	if (res)
2141 		return res;
2142 	list_for_each_entry(mnt, &real_mount(root)->mnt_list, mnt_list) {
2143 		res = f(&mnt->mnt, arg);
2144 		if (res)
2145 			return res;
2146 	}
2147 	return 0;
2148 }
2149 
lock_mnt_tree(struct mount * mnt)2150 static void lock_mnt_tree(struct mount *mnt)
2151 {
2152 	struct mount *p;
2153 
2154 	for (p = mnt; p; p = next_mnt(p, mnt)) {
2155 		int flags = p->mnt.mnt_flags;
2156 		/* Don't allow unprivileged users to change mount flags */
2157 		flags |= MNT_LOCK_ATIME;
2158 
2159 		if (flags & MNT_READONLY)
2160 			flags |= MNT_LOCK_READONLY;
2161 
2162 		if (flags & MNT_NODEV)
2163 			flags |= MNT_LOCK_NODEV;
2164 
2165 		if (flags & MNT_NOSUID)
2166 			flags |= MNT_LOCK_NOSUID;
2167 
2168 		if (flags & MNT_NOEXEC)
2169 			flags |= MNT_LOCK_NOEXEC;
2170 		/* Don't allow unprivileged users to reveal what is under a mount */
2171 		if (list_empty(&p->mnt_expire))
2172 			flags |= MNT_LOCKED;
2173 		p->mnt.mnt_flags = flags;
2174 	}
2175 }
2176 
cleanup_group_ids(struct mount * mnt,struct mount * end)2177 static void cleanup_group_ids(struct mount *mnt, struct mount *end)
2178 {
2179 	struct mount *p;
2180 
2181 	for (p = mnt; p != end; p = next_mnt(p, mnt)) {
2182 		if (p->mnt_group_id && !IS_MNT_SHARED(p))
2183 			mnt_release_group_id(p);
2184 	}
2185 }
2186 
invent_group_ids(struct mount * mnt,bool recurse)2187 static int invent_group_ids(struct mount *mnt, bool recurse)
2188 {
2189 	struct mount *p;
2190 
2191 	for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) {
2192 		if (!p->mnt_group_id && !IS_MNT_SHARED(p)) {
2193 			int err = mnt_alloc_group_id(p);
2194 			if (err) {
2195 				cleanup_group_ids(mnt, p);
2196 				return err;
2197 			}
2198 		}
2199 	}
2200 
2201 	return 0;
2202 }
2203 
count_mounts(struct mnt_namespace * ns,struct mount * mnt)2204 int count_mounts(struct mnt_namespace *ns, struct mount *mnt)
2205 {
2206 	unsigned int max = READ_ONCE(sysctl_mount_max);
2207 	unsigned int mounts = 0;
2208 	struct mount *p;
2209 
2210 	if (ns->mounts >= max)
2211 		return -ENOSPC;
2212 	max -= ns->mounts;
2213 	if (ns->pending_mounts >= max)
2214 		return -ENOSPC;
2215 	max -= ns->pending_mounts;
2216 
2217 	for (p = mnt; p; p = next_mnt(p, mnt))
2218 		mounts++;
2219 
2220 	if (mounts > max)
2221 		return -ENOSPC;
2222 
2223 	ns->pending_mounts += mounts;
2224 	return 0;
2225 }
2226 
2227 enum mnt_tree_flags_t {
2228 	MNT_TREE_MOVE = BIT(0),
2229 	MNT_TREE_BENEATH = BIT(1),
2230 };
2231 
2232 /**
2233  * attach_recursive_mnt - attach a source mount tree
2234  * @source_mnt: mount tree to be attached
2235  * @top_mnt:    mount that @source_mnt will be mounted on or mounted beneath
2236  * @dest_mp:    the mountpoint @source_mnt will be mounted at
2237  * @flags:      modify how @source_mnt is supposed to be attached
2238  *
2239  *  NOTE: in the table below explains the semantics when a source mount
2240  *  of a given type is attached to a destination mount of a given type.
2241  * ---------------------------------------------------------------------------
2242  * |         BIND MOUNT OPERATION                                            |
2243  * |**************************************************************************
2244  * | source-->| shared        |       private  |       slave    | unbindable |
2245  * | dest     |               |                |                |            |
2246  * |   |      |               |                |                |            |
2247  * |   v      |               |                |                |            |
2248  * |**************************************************************************
2249  * |  shared  | shared (++)   |     shared (+) |     shared(+++)|  invalid   |
2250  * |          |               |                |                |            |
2251  * |non-shared| shared (+)    |      private   |      slave (*) |  invalid   |
2252  * ***************************************************************************
2253  * A bind operation clones the source mount and mounts the clone on the
2254  * destination mount.
2255  *
2256  * (++)  the cloned mount is propagated to all the mounts in the propagation
2257  * 	 tree of the destination mount and the cloned mount is added to
2258  * 	 the peer group of the source mount.
2259  * (+)   the cloned mount is created under the destination mount and is marked
2260  *       as shared. The cloned mount is added to the peer group of the source
2261  *       mount.
2262  * (+++) the mount is propagated to all the mounts in the propagation tree
2263  *       of the destination mount and the cloned mount is made slave
2264  *       of the same master as that of the source mount. The cloned mount
2265  *       is marked as 'shared and slave'.
2266  * (*)   the cloned mount is made a slave of the same master as that of the
2267  * 	 source mount.
2268  *
2269  * ---------------------------------------------------------------------------
2270  * |         		MOVE MOUNT OPERATION                                 |
2271  * |**************************************************************************
2272  * | source-->| shared        |       private  |       slave    | unbindable |
2273  * | dest     |               |                |                |            |
2274  * |   |      |               |                |                |            |
2275  * |   v      |               |                |                |            |
2276  * |**************************************************************************
2277  * |  shared  | shared (+)    |     shared (+) |    shared(+++) |  invalid   |
2278  * |          |               |                |                |            |
2279  * |non-shared| shared (+*)   |      private   |    slave (*)   | unbindable |
2280  * ***************************************************************************
2281  *
2282  * (+)  the mount is moved to the destination. And is then propagated to
2283  * 	all the mounts in the propagation tree of the destination mount.
2284  * (+*)  the mount is moved to the destination.
2285  * (+++)  the mount is moved to the destination and is then propagated to
2286  * 	all the mounts belonging to the destination mount's propagation tree.
2287  * 	the mount is marked as 'shared and slave'.
2288  * (*)	the mount continues to be a slave at the new location.
2289  *
2290  * if the source mount is a tree, the operations explained above is
2291  * applied to each mount in the tree.
2292  * Must be called without spinlocks held, since this function can sleep
2293  * in allocations.
2294  *
2295  * Context: The function expects namespace_lock() to be held.
2296  * Return: If @source_mnt was successfully attached 0 is returned.
2297  *         Otherwise a negative error code is returned.
2298  */
attach_recursive_mnt(struct mount * source_mnt,struct mount * top_mnt,struct mountpoint * dest_mp,enum mnt_tree_flags_t flags)2299 static int attach_recursive_mnt(struct mount *source_mnt,
2300 				struct mount *top_mnt,
2301 				struct mountpoint *dest_mp,
2302 				enum mnt_tree_flags_t flags)
2303 {
2304 	struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
2305 	HLIST_HEAD(tree_list);
2306 	struct mnt_namespace *ns = top_mnt->mnt_ns;
2307 	struct mountpoint *smp;
2308 	struct mount *child, *dest_mnt, *p;
2309 	struct hlist_node *n;
2310 	int err = 0;
2311 	bool moving = flags & MNT_TREE_MOVE, beneath = flags & MNT_TREE_BENEATH;
2312 
2313 	/*
2314 	 * Preallocate a mountpoint in case the new mounts need to be
2315 	 * mounted beneath mounts on the same mountpoint.
2316 	 */
2317 	smp = get_mountpoint(source_mnt->mnt.mnt_root);
2318 	if (IS_ERR(smp))
2319 		return PTR_ERR(smp);
2320 
2321 	/* Is there space to add these mounts to the mount namespace? */
2322 	if (!moving) {
2323 		err = count_mounts(ns, source_mnt);
2324 		if (err)
2325 			goto out;
2326 	}
2327 
2328 	if (beneath)
2329 		dest_mnt = top_mnt->mnt_parent;
2330 	else
2331 		dest_mnt = top_mnt;
2332 
2333 	if (IS_MNT_SHARED(dest_mnt)) {
2334 		err = invent_group_ids(source_mnt, true);
2335 		if (err)
2336 			goto out;
2337 		err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list);
2338 	}
2339 	lock_mount_hash();
2340 	if (err)
2341 		goto out_cleanup_ids;
2342 
2343 	if (IS_MNT_SHARED(dest_mnt)) {
2344 		for (p = source_mnt; p; p = next_mnt(p, source_mnt))
2345 			set_mnt_shared(p);
2346 	}
2347 
2348 	if (moving) {
2349 		if (beneath)
2350 			dest_mp = smp;
2351 		unhash_mnt(source_mnt);
2352 		attach_mnt(source_mnt, top_mnt, dest_mp, beneath);
2353 		touch_mnt_namespace(source_mnt->mnt_ns);
2354 	} else {
2355 		if (source_mnt->mnt_ns) {
2356 			/* move from anon - the caller will destroy */
2357 			list_del_init(&source_mnt->mnt_ns->list);
2358 		}
2359 		if (beneath)
2360 			mnt_set_mountpoint_beneath(source_mnt, top_mnt, smp);
2361 		else
2362 			mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt);
2363 		commit_tree(source_mnt);
2364 	}
2365 
2366 	hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) {
2367 		struct mount *q;
2368 		hlist_del_init(&child->mnt_hash);
2369 		q = __lookup_mnt(&child->mnt_parent->mnt,
2370 				 child->mnt_mountpoint);
2371 		if (q)
2372 			mnt_change_mountpoint(child, smp, q);
2373 		/* Notice when we are propagating across user namespaces */
2374 		if (child->mnt_parent->mnt_ns->user_ns != user_ns)
2375 			lock_mnt_tree(child);
2376 		child->mnt.mnt_flags &= ~MNT_LOCKED;
2377 		commit_tree(child);
2378 	}
2379 	put_mountpoint(smp);
2380 	unlock_mount_hash();
2381 
2382 	return 0;
2383 
2384  out_cleanup_ids:
2385 	while (!hlist_empty(&tree_list)) {
2386 		child = hlist_entry(tree_list.first, struct mount, mnt_hash);
2387 		child->mnt_parent->mnt_ns->pending_mounts = 0;
2388 		umount_tree(child, UMOUNT_SYNC);
2389 	}
2390 	unlock_mount_hash();
2391 	cleanup_group_ids(source_mnt, NULL);
2392  out:
2393 	ns->pending_mounts = 0;
2394 
2395 	read_seqlock_excl(&mount_lock);
2396 	put_mountpoint(smp);
2397 	read_sequnlock_excl(&mount_lock);
2398 
2399 	return err;
2400 }
2401 
2402 /**
2403  * do_lock_mount - lock mount and mountpoint
2404  * @path:    target path
2405  * @beneath: whether the intention is to mount beneath @path
2406  *
2407  * Follow the mount stack on @path until the top mount @mnt is found. If
2408  * the initial @path->{mnt,dentry} is a mountpoint lookup the first
2409  * mount stacked on top of it. Then simply follow @{mnt,mnt->mnt_root}
2410  * until nothing is stacked on top of it anymore.
2411  *
2412  * Acquire the inode_lock() on the top mount's ->mnt_root to protect
2413  * against concurrent removal of the new mountpoint from another mount
2414  * namespace.
2415  *
2416  * If @beneath is requested, acquire inode_lock() on @mnt's mountpoint
2417  * @mp on @mnt->mnt_parent must be acquired. This protects against a
2418  * concurrent unlink of @mp->mnt_dentry from another mount namespace
2419  * where @mnt doesn't have a child mount mounted @mp. A concurrent
2420  * removal of @mnt->mnt_root doesn't matter as nothing will be mounted
2421  * on top of it for @beneath.
2422  *
2423  * In addition, @beneath needs to make sure that @mnt hasn't been
2424  * unmounted or moved from its current mountpoint in between dropping
2425  * @mount_lock and acquiring @namespace_sem. For the !@beneath case @mnt
2426  * being unmounted would be detected later by e.g., calling
2427  * check_mnt(mnt) in the function it's called from. For the @beneath
2428  * case however, it's useful to detect it directly in do_lock_mount().
2429  * If @mnt hasn't been unmounted then @mnt->mnt_mountpoint still points
2430  * to @mnt->mnt_mp->m_dentry. But if @mnt has been unmounted it will
2431  * point to @mnt->mnt_root and @mnt->mnt_mp will be NULL.
2432  *
2433  * Return: Either the target mountpoint on the top mount or the top
2434  *         mount's mountpoint.
2435  */
do_lock_mount(struct path * path,bool beneath)2436 static struct mountpoint *do_lock_mount(struct path *path, bool beneath)
2437 {
2438 	struct vfsmount *mnt = path->mnt;
2439 	struct dentry *dentry;
2440 	struct mountpoint *mp = ERR_PTR(-ENOENT);
2441 
2442 	for (;;) {
2443 		struct mount *m;
2444 
2445 		if (beneath) {
2446 			m = real_mount(mnt);
2447 			read_seqlock_excl(&mount_lock);
2448 			dentry = dget(m->mnt_mountpoint);
2449 			read_sequnlock_excl(&mount_lock);
2450 		} else {
2451 			dentry = path->dentry;
2452 		}
2453 
2454 		inode_lock(dentry->d_inode);
2455 		if (unlikely(cant_mount(dentry))) {
2456 			inode_unlock(dentry->d_inode);
2457 			goto out;
2458 		}
2459 
2460 		namespace_lock();
2461 
2462 		if (beneath && (!is_mounted(mnt) || m->mnt_mountpoint != dentry)) {
2463 			namespace_unlock();
2464 			inode_unlock(dentry->d_inode);
2465 			goto out;
2466 		}
2467 
2468 		mnt = lookup_mnt(path);
2469 		if (likely(!mnt))
2470 			break;
2471 
2472 		namespace_unlock();
2473 		inode_unlock(dentry->d_inode);
2474 		if (beneath)
2475 			dput(dentry);
2476 		path_put(path);
2477 		path->mnt = mnt;
2478 		path->dentry = dget(mnt->mnt_root);
2479 	}
2480 
2481 	mp = get_mountpoint(dentry);
2482 	if (IS_ERR(mp)) {
2483 		namespace_unlock();
2484 		inode_unlock(dentry->d_inode);
2485 	}
2486 
2487 out:
2488 	if (beneath)
2489 		dput(dentry);
2490 
2491 	return mp;
2492 }
2493 
lock_mount(struct path * path)2494 static inline struct mountpoint *lock_mount(struct path *path)
2495 {
2496 	return do_lock_mount(path, false);
2497 }
2498 
unlock_mount(struct mountpoint * where)2499 static void unlock_mount(struct mountpoint *where)
2500 {
2501 	struct dentry *dentry = where->m_dentry;
2502 
2503 	read_seqlock_excl(&mount_lock);
2504 	put_mountpoint(where);
2505 	read_sequnlock_excl(&mount_lock);
2506 
2507 	namespace_unlock();
2508 	inode_unlock(dentry->d_inode);
2509 }
2510 
graft_tree(struct mount * mnt,struct mount * p,struct mountpoint * mp)2511 static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp)
2512 {
2513 	if (mnt->mnt.mnt_sb->s_flags & SB_NOUSER)
2514 		return -EINVAL;
2515 
2516 	if (d_is_dir(mp->m_dentry) !=
2517 	      d_is_dir(mnt->mnt.mnt_root))
2518 		return -ENOTDIR;
2519 
2520 	return attach_recursive_mnt(mnt, p, mp, 0);
2521 }
2522 
2523 /*
2524  * Sanity check the flags to change_mnt_propagation.
2525  */
2526 
flags_to_propagation_type(int ms_flags)2527 static int flags_to_propagation_type(int ms_flags)
2528 {
2529 	int type = ms_flags & ~(MS_REC | MS_SILENT);
2530 
2531 	/* Fail if any non-propagation flags are set */
2532 	if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
2533 		return 0;
2534 	/* Only one propagation flag should be set */
2535 	if (!is_power_of_2(type))
2536 		return 0;
2537 	return type;
2538 }
2539 
2540 /*
2541  * recursively change the type of the mountpoint.
2542  */
do_change_type(struct path * path,int ms_flags)2543 static int do_change_type(struct path *path, int ms_flags)
2544 {
2545 	struct mount *m;
2546 	struct mount *mnt = real_mount(path->mnt);
2547 	int recurse = ms_flags & MS_REC;
2548 	int type;
2549 	int err = 0;
2550 
2551 	if (!path_mounted(path))
2552 		return -EINVAL;
2553 
2554 	type = flags_to_propagation_type(ms_flags);
2555 	if (!type)
2556 		return -EINVAL;
2557 
2558 	namespace_lock();
2559 	if (type == MS_SHARED) {
2560 		err = invent_group_ids(mnt, recurse);
2561 		if (err)
2562 			goto out_unlock;
2563 	}
2564 
2565 	lock_mount_hash();
2566 	for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL))
2567 		change_mnt_propagation(m, type);
2568 	unlock_mount_hash();
2569 
2570  out_unlock:
2571 	namespace_unlock();
2572 	return err;
2573 }
2574 
__do_loopback(struct path * old_path,int recurse)2575 static struct mount *__do_loopback(struct path *old_path, int recurse)
2576 {
2577 	struct mount *mnt = ERR_PTR(-EINVAL), *old = real_mount(old_path->mnt);
2578 
2579 	if (IS_MNT_UNBINDABLE(old))
2580 		return mnt;
2581 
2582 	if (!check_mnt(old) && old_path->dentry->d_op != &ns_dentry_operations)
2583 		return mnt;
2584 
2585 	if (!recurse && has_locked_children(old, old_path->dentry))
2586 		return mnt;
2587 
2588 	if (recurse)
2589 		mnt = copy_tree(old, old_path->dentry, CL_COPY_MNT_NS_FILE);
2590 	else
2591 		mnt = clone_mnt(old, old_path->dentry, 0);
2592 
2593 	if (!IS_ERR(mnt))
2594 		mnt->mnt.mnt_flags &= ~MNT_LOCKED;
2595 
2596 	return mnt;
2597 }
2598 
2599 /*
2600  * do loopback mount.
2601  */
do_loopback(struct path * path,const char * old_name,int recurse)2602 static int do_loopback(struct path *path, const char *old_name,
2603 				int recurse)
2604 {
2605 	struct path old_path;
2606 	struct mount *mnt = NULL, *parent;
2607 	struct mountpoint *mp;
2608 	int err;
2609 	if (!old_name || !*old_name)
2610 		return -EINVAL;
2611 	err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
2612 	if (err)
2613 		return err;
2614 
2615 	err = -EINVAL;
2616 	if (mnt_ns_loop(old_path.dentry))
2617 		goto out;
2618 
2619 	mp = lock_mount(path);
2620 	if (IS_ERR(mp)) {
2621 		err = PTR_ERR(mp);
2622 		goto out;
2623 	}
2624 
2625 	parent = real_mount(path->mnt);
2626 	if (!check_mnt(parent))
2627 		goto out2;
2628 
2629 	mnt = __do_loopback(&old_path, recurse);
2630 	if (IS_ERR(mnt)) {
2631 		err = PTR_ERR(mnt);
2632 		goto out2;
2633 	}
2634 
2635 	err = graft_tree(mnt, parent, mp);
2636 	if (err) {
2637 		lock_mount_hash();
2638 		umount_tree(mnt, UMOUNT_SYNC);
2639 		unlock_mount_hash();
2640 	}
2641 out2:
2642 	unlock_mount(mp);
2643 out:
2644 	path_put(&old_path);
2645 	return err;
2646 }
2647 
open_detached_copy(struct path * path,bool recursive)2648 static struct file *open_detached_copy(struct path *path, bool recursive)
2649 {
2650 	struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
2651 	struct mnt_namespace *ns = alloc_mnt_ns(user_ns, true);
2652 	struct mount *mnt, *p;
2653 	struct file *file;
2654 
2655 	if (IS_ERR(ns))
2656 		return ERR_CAST(ns);
2657 
2658 	namespace_lock();
2659 	mnt = __do_loopback(path, recursive);
2660 	if (IS_ERR(mnt)) {
2661 		namespace_unlock();
2662 		free_mnt_ns(ns);
2663 		return ERR_CAST(mnt);
2664 	}
2665 
2666 	lock_mount_hash();
2667 	for (p = mnt; p; p = next_mnt(p, mnt)) {
2668 		p->mnt_ns = ns;
2669 		ns->mounts++;
2670 	}
2671 	ns->root = mnt;
2672 	list_add_tail(&ns->list, &mnt->mnt_list);
2673 	mntget(&mnt->mnt);
2674 	unlock_mount_hash();
2675 	namespace_unlock();
2676 
2677 	mntput(path->mnt);
2678 	path->mnt = &mnt->mnt;
2679 	file = dentry_open(path, O_PATH, current_cred());
2680 	if (IS_ERR(file))
2681 		dissolve_on_fput(path->mnt);
2682 	else
2683 		file->f_mode |= FMODE_NEED_UNMOUNT;
2684 	return file;
2685 }
2686 
SYSCALL_DEFINE3(open_tree,int,dfd,const char __user *,filename,unsigned,flags)2687 SYSCALL_DEFINE3(open_tree, int, dfd, const char __user *, filename, unsigned, flags)
2688 {
2689 	struct file *file;
2690 	struct path path;
2691 	int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW;
2692 	bool detached = flags & OPEN_TREE_CLONE;
2693 	int error;
2694 	int fd;
2695 
2696 	BUILD_BUG_ON(OPEN_TREE_CLOEXEC != O_CLOEXEC);
2697 
2698 	if (flags & ~(AT_EMPTY_PATH | AT_NO_AUTOMOUNT | AT_RECURSIVE |
2699 		      AT_SYMLINK_NOFOLLOW | OPEN_TREE_CLONE |
2700 		      OPEN_TREE_CLOEXEC))
2701 		return -EINVAL;
2702 
2703 	if ((flags & (AT_RECURSIVE | OPEN_TREE_CLONE)) == AT_RECURSIVE)
2704 		return -EINVAL;
2705 
2706 	if (flags & AT_NO_AUTOMOUNT)
2707 		lookup_flags &= ~LOOKUP_AUTOMOUNT;
2708 	if (flags & AT_SYMLINK_NOFOLLOW)
2709 		lookup_flags &= ~LOOKUP_FOLLOW;
2710 	if (flags & AT_EMPTY_PATH)
2711 		lookup_flags |= LOOKUP_EMPTY;
2712 
2713 	if (detached && !may_mount())
2714 		return -EPERM;
2715 
2716 	fd = get_unused_fd_flags(flags & O_CLOEXEC);
2717 	if (fd < 0)
2718 		return fd;
2719 
2720 	error = user_path_at(dfd, filename, lookup_flags, &path);
2721 	if (unlikely(error)) {
2722 		file = ERR_PTR(error);
2723 	} else {
2724 		if (detached)
2725 			file = open_detached_copy(&path, flags & AT_RECURSIVE);
2726 		else
2727 			file = dentry_open(&path, O_PATH, current_cred());
2728 		path_put(&path);
2729 	}
2730 	if (IS_ERR(file)) {
2731 		put_unused_fd(fd);
2732 		return PTR_ERR(file);
2733 	}
2734 	fd_install(fd, file);
2735 	return fd;
2736 }
2737 
2738 /*
2739  * Don't allow locked mount flags to be cleared.
2740  *
2741  * No locks need to be held here while testing the various MNT_LOCK
2742  * flags because those flags can never be cleared once they are set.
2743  */
can_change_locked_flags(struct mount * mnt,unsigned int mnt_flags)2744 static bool can_change_locked_flags(struct mount *mnt, unsigned int mnt_flags)
2745 {
2746 	unsigned int fl = mnt->mnt.mnt_flags;
2747 
2748 	if ((fl & MNT_LOCK_READONLY) &&
2749 	    !(mnt_flags & MNT_READONLY))
2750 		return false;
2751 
2752 	if ((fl & MNT_LOCK_NODEV) &&
2753 	    !(mnt_flags & MNT_NODEV))
2754 		return false;
2755 
2756 	if ((fl & MNT_LOCK_NOSUID) &&
2757 	    !(mnt_flags & MNT_NOSUID))
2758 		return false;
2759 
2760 	if ((fl & MNT_LOCK_NOEXEC) &&
2761 	    !(mnt_flags & MNT_NOEXEC))
2762 		return false;
2763 
2764 	if ((fl & MNT_LOCK_ATIME) &&
2765 	    ((fl & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK)))
2766 		return false;
2767 
2768 	return true;
2769 }
2770 
change_mount_ro_state(struct mount * mnt,unsigned int mnt_flags)2771 static int change_mount_ro_state(struct mount *mnt, unsigned int mnt_flags)
2772 {
2773 	bool readonly_request = (mnt_flags & MNT_READONLY);
2774 
2775 	if (readonly_request == __mnt_is_readonly(&mnt->mnt))
2776 		return 0;
2777 
2778 	if (readonly_request)
2779 		return mnt_make_readonly(mnt);
2780 
2781 	mnt->mnt.mnt_flags &= ~MNT_READONLY;
2782 	return 0;
2783 }
2784 
set_mount_attributes(struct mount * mnt,unsigned int mnt_flags)2785 static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags)
2786 {
2787 	mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK;
2788 	mnt->mnt.mnt_flags = mnt_flags;
2789 	touch_mnt_namespace(mnt->mnt_ns);
2790 }
2791 
mnt_warn_timestamp_expiry(struct path * mountpoint,struct vfsmount * mnt)2792 static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *mnt)
2793 {
2794 	struct super_block *sb = mnt->mnt_sb;
2795 
2796 	if (!__mnt_is_readonly(mnt) &&
2797 	   (!(sb->s_iflags & SB_I_TS_EXPIRY_WARNED)) &&
2798 	   (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
2799 		char *buf, *mntpath;
2800 
2801 		buf = (char *)__get_free_page(GFP_KERNEL);
2802 		if (buf)
2803 			mntpath = d_path(mountpoint, buf, PAGE_SIZE);
2804 		else
2805 			mntpath = ERR_PTR(-ENOMEM);
2806 		if (IS_ERR(mntpath))
2807 			mntpath = "(unknown)";
2808 
2809 		pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n",
2810 			sb->s_type->name,
2811 			is_mounted(mnt) ? "remounted" : "mounted",
2812 			mntpath, &sb->s_time_max,
2813 			(unsigned long long)sb->s_time_max);
2814 
2815 		sb->s_iflags |= SB_I_TS_EXPIRY_WARNED;
2816 		if (buf)
2817 			free_page((unsigned long)buf);
2818 	}
2819 }
2820 
2821 /*
2822  * Handle reconfiguration of the mountpoint only without alteration of the
2823  * superblock it refers to.  This is triggered by specifying MS_REMOUNT|MS_BIND
2824  * to mount(2).
2825  */
do_reconfigure_mnt(struct path * path,unsigned int mnt_flags)2826 static int do_reconfigure_mnt(struct path *path, unsigned int mnt_flags)
2827 {
2828 	struct super_block *sb = path->mnt->mnt_sb;
2829 	struct mount *mnt = real_mount(path->mnt);
2830 	int ret;
2831 
2832 	if (!check_mnt(mnt))
2833 		return -EINVAL;
2834 
2835 	if (!path_mounted(path))
2836 		return -EINVAL;
2837 
2838 	if (!can_change_locked_flags(mnt, mnt_flags))
2839 		return -EPERM;
2840 
2841 	/*
2842 	 * We're only checking whether the superblock is read-only not
2843 	 * changing it, so only take down_read(&sb->s_umount).
2844 	 */
2845 	down_read(&sb->s_umount);
2846 	lock_mount_hash();
2847 	ret = change_mount_ro_state(mnt, mnt_flags);
2848 	if (ret == 0)
2849 		set_mount_attributes(mnt, mnt_flags);
2850 	unlock_mount_hash();
2851 	up_read(&sb->s_umount);
2852 
2853 	mnt_warn_timestamp_expiry(path, &mnt->mnt);
2854 
2855 	return ret;
2856 }
2857 
2858 /*
2859  * change filesystem flags. dir should be a physical root of filesystem.
2860  * If you've mounted a non-root directory somewhere and want to do remount
2861  * on it - tough luck.
2862  */
do_remount(struct path * path,int ms_flags,int sb_flags,int mnt_flags,void * data)2863 static int do_remount(struct path *path, int ms_flags, int sb_flags,
2864 		      int mnt_flags, void *data)
2865 {
2866 	int err;
2867 	struct super_block *sb = path->mnt->mnt_sb;
2868 	struct mount *mnt = real_mount(path->mnt);
2869 	struct fs_context *fc;
2870 
2871 	if (!check_mnt(mnt))
2872 		return -EINVAL;
2873 
2874 	if (!path_mounted(path))
2875 		return -EINVAL;
2876 
2877 	if (!can_change_locked_flags(mnt, mnt_flags))
2878 		return -EPERM;
2879 
2880 	fc = fs_context_for_reconfigure(path->dentry, sb_flags, MS_RMT_MASK);
2881 	if (IS_ERR(fc))
2882 		return PTR_ERR(fc);
2883 
2884 	/*
2885 	 * Indicate to the filesystem that the remount request is coming
2886 	 * from the legacy mount system call.
2887 	 */
2888 	fc->oldapi = true;
2889 
2890 	err = parse_monolithic_mount_data(fc, data);
2891 	if (!err) {
2892 		down_write(&sb->s_umount);
2893 		err = -EPERM;
2894 		if (ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) {
2895 			err = reconfigure_super(fc);
2896 			if (!err) {
2897 				lock_mount_hash();
2898 				set_mount_attributes(mnt, mnt_flags);
2899 				unlock_mount_hash();
2900 			}
2901 		}
2902 		up_write(&sb->s_umount);
2903 	}
2904 
2905 	mnt_warn_timestamp_expiry(path, &mnt->mnt);
2906 
2907 	put_fs_context(fc);
2908 	return err;
2909 }
2910 
tree_contains_unbindable(struct mount * mnt)2911 static inline int tree_contains_unbindable(struct mount *mnt)
2912 {
2913 	struct mount *p;
2914 	for (p = mnt; p; p = next_mnt(p, mnt)) {
2915 		if (IS_MNT_UNBINDABLE(p))
2916 			return 1;
2917 	}
2918 	return 0;
2919 }
2920 
2921 /*
2922  * Check that there aren't references to earlier/same mount namespaces in the
2923  * specified subtree.  Such references can act as pins for mount namespaces
2924  * that aren't checked by the mount-cycle checking code, thereby allowing
2925  * cycles to be made.
2926  */
check_for_nsfs_mounts(struct mount * subtree)2927 static bool check_for_nsfs_mounts(struct mount *subtree)
2928 {
2929 	struct mount *p;
2930 	bool ret = false;
2931 
2932 	lock_mount_hash();
2933 	for (p = subtree; p; p = next_mnt(p, subtree))
2934 		if (mnt_ns_loop(p->mnt.mnt_root))
2935 			goto out;
2936 
2937 	ret = true;
2938 out:
2939 	unlock_mount_hash();
2940 	return ret;
2941 }
2942 
do_set_group(struct path * from_path,struct path * to_path)2943 static int do_set_group(struct path *from_path, struct path *to_path)
2944 {
2945 	struct mount *from, *to;
2946 	int err;
2947 
2948 	from = real_mount(from_path->mnt);
2949 	to = real_mount(to_path->mnt);
2950 
2951 	namespace_lock();
2952 
2953 	err = -EINVAL;
2954 	/* To and From must be mounted */
2955 	if (!is_mounted(&from->mnt))
2956 		goto out;
2957 	if (!is_mounted(&to->mnt))
2958 		goto out;
2959 
2960 	err = -EPERM;
2961 	/* We should be allowed to modify mount namespaces of both mounts */
2962 	if (!ns_capable(from->mnt_ns->user_ns, CAP_SYS_ADMIN))
2963 		goto out;
2964 	if (!ns_capable(to->mnt_ns->user_ns, CAP_SYS_ADMIN))
2965 		goto out;
2966 
2967 	err = -EINVAL;
2968 	/* To and From paths should be mount roots */
2969 	if (!path_mounted(from_path))
2970 		goto out;
2971 	if (!path_mounted(to_path))
2972 		goto out;
2973 
2974 	/* Setting sharing groups is only allowed across same superblock */
2975 	if (from->mnt.mnt_sb != to->mnt.mnt_sb)
2976 		goto out;
2977 
2978 	/* From mount root should be wider than To mount root */
2979 	if (!is_subdir(to->mnt.mnt_root, from->mnt.mnt_root))
2980 		goto out;
2981 
2982 	/* From mount should not have locked children in place of To's root */
2983 	if (has_locked_children(from, to->mnt.mnt_root))
2984 		goto out;
2985 
2986 	/* Setting sharing groups is only allowed on private mounts */
2987 	if (IS_MNT_SHARED(to) || IS_MNT_SLAVE(to))
2988 		goto out;
2989 
2990 	/* From should not be private */
2991 	if (!IS_MNT_SHARED(from) && !IS_MNT_SLAVE(from))
2992 		goto out;
2993 
2994 	if (IS_MNT_SLAVE(from)) {
2995 		struct mount *m = from->mnt_master;
2996 
2997 		list_add(&to->mnt_slave, &m->mnt_slave_list);
2998 		to->mnt_master = m;
2999 	}
3000 
3001 	if (IS_MNT_SHARED(from)) {
3002 		to->mnt_group_id = from->mnt_group_id;
3003 		list_add(&to->mnt_share, &from->mnt_share);
3004 		lock_mount_hash();
3005 		set_mnt_shared(to);
3006 		unlock_mount_hash();
3007 	}
3008 
3009 	err = 0;
3010 out:
3011 	namespace_unlock();
3012 	return err;
3013 }
3014 
3015 /**
3016  * path_overmounted - check if path is overmounted
3017  * @path: path to check
3018  *
3019  * Check if path is overmounted, i.e., if there's a mount on top of
3020  * @path->mnt with @path->dentry as mountpoint.
3021  *
3022  * Context: This function expects namespace_lock() to be held.
3023  * Return: If path is overmounted true is returned, false if not.
3024  */
path_overmounted(const struct path * path)3025 static inline bool path_overmounted(const struct path *path)
3026 {
3027 	rcu_read_lock();
3028 	if (unlikely(__lookup_mnt(path->mnt, path->dentry))) {
3029 		rcu_read_unlock();
3030 		return true;
3031 	}
3032 	rcu_read_unlock();
3033 	return false;
3034 }
3035 
3036 /**
3037  * can_move_mount_beneath - check that we can mount beneath the top mount
3038  * @from: mount to mount beneath
3039  * @to:   mount under which to mount
3040  *
3041  * - Make sure that @to->dentry is actually the root of a mount under
3042  *   which we can mount another mount.
3043  * - Make sure that nothing can be mounted beneath the caller's current
3044  *   root or the rootfs of the namespace.
3045  * - Make sure that the caller can unmount the topmost mount ensuring
3046  *   that the caller could reveal the underlying mountpoint.
3047  * - Ensure that nothing has been mounted on top of @from before we
3048  *   grabbed @namespace_sem to avoid creating pointless shadow mounts.
3049  * - Prevent mounting beneath a mount if the propagation relationship
3050  *   between the source mount, parent mount, and top mount would lead to
3051  *   nonsensical mount trees.
3052  *
3053  * Context: This function expects namespace_lock() to be held.
3054  * Return: On success 0, and on error a negative error code is returned.
3055  */
can_move_mount_beneath(const struct path * from,const struct path * to,const struct mountpoint * mp)3056 static int can_move_mount_beneath(const struct path *from,
3057 				  const struct path *to,
3058 				  const struct mountpoint *mp)
3059 {
3060 	struct mount *mnt_from = real_mount(from->mnt),
3061 		     *mnt_to = real_mount(to->mnt),
3062 		     *parent_mnt_to = mnt_to->mnt_parent;
3063 
3064 	if (!mnt_has_parent(mnt_to))
3065 		return -EINVAL;
3066 
3067 	if (!path_mounted(to))
3068 		return -EINVAL;
3069 
3070 	if (IS_MNT_LOCKED(mnt_to))
3071 		return -EINVAL;
3072 
3073 	/* Avoid creating shadow mounts during mount propagation. */
3074 	if (path_overmounted(from))
3075 		return -EINVAL;
3076 
3077 	/*
3078 	 * Mounting beneath the rootfs only makes sense when the
3079 	 * semantics of pivot_root(".", ".") are used.
3080 	 */
3081 	if (&mnt_to->mnt == current->fs->root.mnt)
3082 		return -EINVAL;
3083 	if (parent_mnt_to == current->nsproxy->mnt_ns->root)
3084 		return -EINVAL;
3085 
3086 	for (struct mount *p = mnt_from; mnt_has_parent(p); p = p->mnt_parent)
3087 		if (p == mnt_to)
3088 			return -EINVAL;
3089 
3090 	/*
3091 	 * If the parent mount propagates to the child mount this would
3092 	 * mean mounting @mnt_from on @mnt_to->mnt_parent and then
3093 	 * propagating a copy @c of @mnt_from on top of @mnt_to. This
3094 	 * defeats the whole purpose of mounting beneath another mount.
3095 	 */
3096 	if (propagation_would_overmount(parent_mnt_to, mnt_to, mp))
3097 		return -EINVAL;
3098 
3099 	/*
3100 	 * If @mnt_to->mnt_parent propagates to @mnt_from this would
3101 	 * mean propagating a copy @c of @mnt_from on top of @mnt_from.
3102 	 * Afterwards @mnt_from would be mounted on top of
3103 	 * @mnt_to->mnt_parent and @mnt_to would be unmounted from
3104 	 * @mnt->mnt_parent and remounted on @mnt_from. But since @c is
3105 	 * already mounted on @mnt_from, @mnt_to would ultimately be
3106 	 * remounted on top of @c. Afterwards, @mnt_from would be
3107 	 * covered by a copy @c of @mnt_from and @c would be covered by
3108 	 * @mnt_from itself. This defeats the whole purpose of mounting
3109 	 * @mnt_from beneath @mnt_to.
3110 	 */
3111 	if (propagation_would_overmount(parent_mnt_to, mnt_from, mp))
3112 		return -EINVAL;
3113 
3114 	return 0;
3115 }
3116 
do_move_mount(struct path * old_path,struct path * new_path,bool beneath)3117 static int do_move_mount(struct path *old_path, struct path *new_path,
3118 			 bool beneath)
3119 {
3120 	struct mnt_namespace *ns;
3121 	struct mount *p;
3122 	struct mount *old;
3123 	struct mount *parent;
3124 	struct mountpoint *mp, *old_mp;
3125 	int err;
3126 	bool attached;
3127 	enum mnt_tree_flags_t flags = 0;
3128 
3129 	mp = do_lock_mount(new_path, beneath);
3130 	if (IS_ERR(mp))
3131 		return PTR_ERR(mp);
3132 
3133 	old = real_mount(old_path->mnt);
3134 	p = real_mount(new_path->mnt);
3135 	parent = old->mnt_parent;
3136 	attached = mnt_has_parent(old);
3137 	if (attached)
3138 		flags |= MNT_TREE_MOVE;
3139 	old_mp = old->mnt_mp;
3140 	ns = old->mnt_ns;
3141 
3142 	err = -EINVAL;
3143 	/* The mountpoint must be in our namespace. */
3144 	if (!check_mnt(p))
3145 		goto out;
3146 
3147 	/* The thing moved must be mounted... */
3148 	if (!is_mounted(&old->mnt))
3149 		goto out;
3150 
3151 	/* ... and either ours or the root of anon namespace */
3152 	if (!(attached ? check_mnt(old) : is_anon_ns(ns)))
3153 		goto out;
3154 
3155 	if (old->mnt.mnt_flags & MNT_LOCKED)
3156 		goto out;
3157 
3158 	if (!path_mounted(old_path))
3159 		goto out;
3160 
3161 	if (d_is_dir(new_path->dentry) !=
3162 	    d_is_dir(old_path->dentry))
3163 		goto out;
3164 	/*
3165 	 * Don't move a mount residing in a shared parent.
3166 	 */
3167 	if (attached && IS_MNT_SHARED(parent))
3168 		goto out;
3169 
3170 	if (beneath) {
3171 		err = can_move_mount_beneath(old_path, new_path, mp);
3172 		if (err)
3173 			goto out;
3174 
3175 		err = -EINVAL;
3176 		p = p->mnt_parent;
3177 		flags |= MNT_TREE_BENEATH;
3178 	}
3179 
3180 	/*
3181 	 * Don't move a mount tree containing unbindable mounts to a destination
3182 	 * mount which is shared.
3183 	 */
3184 	if (IS_MNT_SHARED(p) && tree_contains_unbindable(old))
3185 		goto out;
3186 	err = -ELOOP;
3187 	if (!check_for_nsfs_mounts(old))
3188 		goto out;
3189 	for (; mnt_has_parent(p); p = p->mnt_parent)
3190 		if (p == old)
3191 			goto out;
3192 
3193 	err = attach_recursive_mnt(old, real_mount(new_path->mnt), mp, flags);
3194 	if (err)
3195 		goto out;
3196 
3197 	/* if the mount is moved, it should no longer be expire
3198 	 * automatically */
3199 	list_del_init(&old->mnt_expire);
3200 	if (attached)
3201 		put_mountpoint(old_mp);
3202 out:
3203 	unlock_mount(mp);
3204 	if (!err) {
3205 		if (attached)
3206 			mntput_no_expire(parent);
3207 		else
3208 			free_mnt_ns(ns);
3209 	}
3210 	return err;
3211 }
3212 
do_move_mount_old(struct path * path,const char * old_name)3213 static int do_move_mount_old(struct path *path, const char *old_name)
3214 {
3215 	struct path old_path;
3216 	int err;
3217 
3218 	if (!old_name || !*old_name)
3219 		return -EINVAL;
3220 
3221 	err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
3222 	if (err)
3223 		return err;
3224 
3225 	err = do_move_mount(&old_path, path, false);
3226 	path_put(&old_path);
3227 	return err;
3228 }
3229 
3230 /*
3231  * add a mount into a namespace's mount tree
3232  */
do_add_mount(struct mount * newmnt,struct mountpoint * mp,const struct path * path,int mnt_flags)3233 static int do_add_mount(struct mount *newmnt, struct mountpoint *mp,
3234 			const struct path *path, int mnt_flags)
3235 {
3236 	struct mount *parent = real_mount(path->mnt);
3237 
3238 	mnt_flags &= ~MNT_INTERNAL_FLAGS;
3239 
3240 	if (unlikely(!check_mnt(parent))) {
3241 		/* that's acceptable only for automounts done in private ns */
3242 		if (!(mnt_flags & MNT_SHRINKABLE))
3243 			return -EINVAL;
3244 		/* ... and for those we'd better have mountpoint still alive */
3245 		if (!parent->mnt_ns)
3246 			return -EINVAL;
3247 	}
3248 
3249 	/* Refuse the same filesystem on the same mount point */
3250 	if (path->mnt->mnt_sb == newmnt->mnt.mnt_sb && path_mounted(path))
3251 		return -EBUSY;
3252 
3253 	if (d_is_symlink(newmnt->mnt.mnt_root))
3254 		return -EINVAL;
3255 
3256 	newmnt->mnt.mnt_flags = mnt_flags;
3257 	return graft_tree(newmnt, parent, mp);
3258 }
3259 
3260 static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags);
3261 
3262 /*
3263  * Create a new mount using a superblock configuration and request it
3264  * be added to the namespace tree.
3265  */
do_new_mount_fc(struct fs_context * fc,struct path * mountpoint,unsigned int mnt_flags)3266 static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint,
3267 			   unsigned int mnt_flags)
3268 {
3269 	struct vfsmount *mnt;
3270 	struct mountpoint *mp;
3271 	struct super_block *sb = fc->root->d_sb;
3272 	int error;
3273 
3274 	error = security_sb_kern_mount(sb);
3275 	if (!error && mount_too_revealing(sb, &mnt_flags))
3276 		error = -EPERM;
3277 
3278 	if (unlikely(error)) {
3279 		fc_drop_locked(fc);
3280 		return error;
3281 	}
3282 
3283 	up_write(&sb->s_umount);
3284 
3285 	mnt = vfs_create_mount(fc);
3286 	if (IS_ERR(mnt))
3287 		return PTR_ERR(mnt);
3288 
3289 	mnt_warn_timestamp_expiry(mountpoint, mnt);
3290 
3291 	mp = lock_mount(mountpoint);
3292 	if (IS_ERR(mp)) {
3293 		mntput(mnt);
3294 		return PTR_ERR(mp);
3295 	}
3296 	error = do_add_mount(real_mount(mnt), mp, mountpoint, mnt_flags);
3297 	unlock_mount(mp);
3298 	if (error < 0)
3299 		mntput(mnt);
3300 	return error;
3301 }
3302 
3303 /*
3304  * create a new mount for userspace and request it to be added into the
3305  * namespace's tree
3306  */
do_new_mount(struct path * path,const char * fstype,int sb_flags,int mnt_flags,const char * name,void * data)3307 static int do_new_mount(struct path *path, const char *fstype, int sb_flags,
3308 			int mnt_flags, const char *name, void *data)
3309 {
3310 	struct file_system_type *type;
3311 	struct fs_context *fc;
3312 	const char *subtype = NULL;
3313 	int err = 0;
3314 
3315 	if (!fstype)
3316 		return -EINVAL;
3317 
3318 	type = get_fs_type(fstype);
3319 	if (!type)
3320 		return -ENODEV;
3321 
3322 	if (type->fs_flags & FS_HAS_SUBTYPE) {
3323 		subtype = strchr(fstype, '.');
3324 		if (subtype) {
3325 			subtype++;
3326 			if (!*subtype) {
3327 				put_filesystem(type);
3328 				return -EINVAL;
3329 			}
3330 		}
3331 	}
3332 
3333 	fc = fs_context_for_mount(type, sb_flags);
3334 	put_filesystem(type);
3335 	if (IS_ERR(fc))
3336 		return PTR_ERR(fc);
3337 
3338 	/*
3339 	 * Indicate to the filesystem that the mount request is coming
3340 	 * from the legacy mount system call.
3341 	 */
3342 	fc->oldapi = true;
3343 
3344 	if (subtype)
3345 		err = vfs_parse_fs_string(fc, "subtype",
3346 					  subtype, strlen(subtype));
3347 	if (!err && name)
3348 		err = vfs_parse_fs_string(fc, "source", name, strlen(name));
3349 	if (!err)
3350 		err = parse_monolithic_mount_data(fc, data);
3351 	if (!err && !mount_capable(fc))
3352 		err = -EPERM;
3353 	if (!err)
3354 		err = vfs_get_tree(fc);
3355 	if (!err)
3356 		err = do_new_mount_fc(fc, path, mnt_flags);
3357 
3358 	put_fs_context(fc);
3359 	return err;
3360 }
3361 
finish_automount(struct vfsmount * m,const struct path * path)3362 int finish_automount(struct vfsmount *m, const struct path *path)
3363 {
3364 	struct dentry *dentry = path->dentry;
3365 	struct mountpoint *mp;
3366 	struct mount *mnt;
3367 	int err;
3368 
3369 	if (!m)
3370 		return 0;
3371 	if (IS_ERR(m))
3372 		return PTR_ERR(m);
3373 
3374 	mnt = real_mount(m);
3375 	/* The new mount record should have at least 2 refs to prevent it being
3376 	 * expired before we get a chance to add it
3377 	 */
3378 	BUG_ON(mnt_get_count(mnt) < 2);
3379 
3380 	if (m->mnt_sb == path->mnt->mnt_sb &&
3381 	    m->mnt_root == dentry) {
3382 		err = -ELOOP;
3383 		goto discard;
3384 	}
3385 
3386 	/*
3387 	 * we don't want to use lock_mount() - in this case finding something
3388 	 * that overmounts our mountpoint to be means "quitely drop what we've
3389 	 * got", not "try to mount it on top".
3390 	 */
3391 	inode_lock(dentry->d_inode);
3392 	namespace_lock();
3393 	if (unlikely(cant_mount(dentry))) {
3394 		err = -ENOENT;
3395 		goto discard_locked;
3396 	}
3397 	if (path_overmounted(path)) {
3398 		err = 0;
3399 		goto discard_locked;
3400 	}
3401 	mp = get_mountpoint(dentry);
3402 	if (IS_ERR(mp)) {
3403 		err = PTR_ERR(mp);
3404 		goto discard_locked;
3405 	}
3406 
3407 	err = do_add_mount(mnt, mp, path, path->mnt->mnt_flags | MNT_SHRINKABLE);
3408 	unlock_mount(mp);
3409 	if (unlikely(err))
3410 		goto discard;
3411 	mntput(m);
3412 	return 0;
3413 
3414 discard_locked:
3415 	namespace_unlock();
3416 	inode_unlock(dentry->d_inode);
3417 discard:
3418 	/* remove m from any expiration list it may be on */
3419 	if (!list_empty(&mnt->mnt_expire)) {
3420 		namespace_lock();
3421 		list_del_init(&mnt->mnt_expire);
3422 		namespace_unlock();
3423 	}
3424 	mntput(m);
3425 	mntput(m);
3426 	return err;
3427 }
3428 
3429 /**
3430  * mnt_set_expiry - Put a mount on an expiration list
3431  * @mnt: The mount to list.
3432  * @expiry_list: The list to add the mount to.
3433  */
mnt_set_expiry(struct vfsmount * mnt,struct list_head * expiry_list)3434 void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list)
3435 {
3436 	namespace_lock();
3437 
3438 	list_add_tail(&real_mount(mnt)->mnt_expire, expiry_list);
3439 
3440 	namespace_unlock();
3441 }
3442 EXPORT_SYMBOL(mnt_set_expiry);
3443 
3444 /*
3445  * process a list of expirable mountpoints with the intent of discarding any
3446  * mountpoints that aren't in use and haven't been touched since last we came
3447  * here
3448  */
mark_mounts_for_expiry(struct list_head * mounts)3449 void mark_mounts_for_expiry(struct list_head *mounts)
3450 {
3451 	struct mount *mnt, *next;
3452 	LIST_HEAD(graveyard);
3453 
3454 	if (list_empty(mounts))
3455 		return;
3456 
3457 	namespace_lock();
3458 	lock_mount_hash();
3459 
3460 	/* extract from the expiration list every vfsmount that matches the
3461 	 * following criteria:
3462 	 * - only referenced by its parent vfsmount
3463 	 * - still marked for expiry (marked on the last call here; marks are
3464 	 *   cleared by mntput())
3465 	 */
3466 	list_for_each_entry_safe(mnt, next, mounts, mnt_expire) {
3467 		if (!xchg(&mnt->mnt_expiry_mark, 1) ||
3468 			propagate_mount_busy(mnt, 1))
3469 			continue;
3470 		list_move(&mnt->mnt_expire, &graveyard);
3471 	}
3472 	while (!list_empty(&graveyard)) {
3473 		mnt = list_first_entry(&graveyard, struct mount, mnt_expire);
3474 		touch_mnt_namespace(mnt->mnt_ns);
3475 		umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
3476 	}
3477 	unlock_mount_hash();
3478 	namespace_unlock();
3479 }
3480 
3481 EXPORT_SYMBOL_GPL(mark_mounts_for_expiry);
3482 
3483 /*
3484  * Ripoff of 'select_parent()'
3485  *
3486  * search the list of submounts for a given mountpoint, and move any
3487  * shrinkable submounts to the 'graveyard' list.
3488  */
select_submounts(struct mount * parent,struct list_head * graveyard)3489 static int select_submounts(struct mount *parent, struct list_head *graveyard)
3490 {
3491 	struct mount *this_parent = parent;
3492 	struct list_head *next;
3493 	int found = 0;
3494 
3495 repeat:
3496 	next = this_parent->mnt_mounts.next;
3497 resume:
3498 	while (next != &this_parent->mnt_mounts) {
3499 		struct list_head *tmp = next;
3500 		struct mount *mnt = list_entry(tmp, struct mount, mnt_child);
3501 
3502 		next = tmp->next;
3503 		if (!(mnt->mnt.mnt_flags & MNT_SHRINKABLE))
3504 			continue;
3505 		/*
3506 		 * Descend a level if the d_mounts list is non-empty.
3507 		 */
3508 		if (!list_empty(&mnt->mnt_mounts)) {
3509 			this_parent = mnt;
3510 			goto repeat;
3511 		}
3512 
3513 		if (!propagate_mount_busy(mnt, 1)) {
3514 			list_move_tail(&mnt->mnt_expire, graveyard);
3515 			found++;
3516 		}
3517 	}
3518 	/*
3519 	 * All done at this level ... ascend and resume the search
3520 	 */
3521 	if (this_parent != parent) {
3522 		next = this_parent->mnt_child.next;
3523 		this_parent = this_parent->mnt_parent;
3524 		goto resume;
3525 	}
3526 	return found;
3527 }
3528 
3529 /*
3530  * process a list of expirable mountpoints with the intent of discarding any
3531  * submounts of a specific parent mountpoint
3532  *
3533  * mount_lock must be held for write
3534  */
shrink_submounts(struct mount * mnt)3535 static void shrink_submounts(struct mount *mnt)
3536 {
3537 	LIST_HEAD(graveyard);
3538 	struct mount *m;
3539 
3540 	/* extract submounts of 'mountpoint' from the expiration list */
3541 	while (select_submounts(mnt, &graveyard)) {
3542 		while (!list_empty(&graveyard)) {
3543 			m = list_first_entry(&graveyard, struct mount,
3544 						mnt_expire);
3545 			touch_mnt_namespace(m->mnt_ns);
3546 			umount_tree(m, UMOUNT_PROPAGATE|UMOUNT_SYNC);
3547 		}
3548 	}
3549 }
3550 
copy_mount_options(const void __user * data)3551 static void *copy_mount_options(const void __user * data)
3552 {
3553 	char *copy;
3554 	unsigned left, offset;
3555 
3556 	if (!data)
3557 		return NULL;
3558 
3559 	copy = kmalloc(PAGE_SIZE, GFP_KERNEL);
3560 	if (!copy)
3561 		return ERR_PTR(-ENOMEM);
3562 
3563 	left = copy_from_user(copy, data, PAGE_SIZE);
3564 
3565 	/*
3566 	 * Not all architectures have an exact copy_from_user(). Resort to
3567 	 * byte at a time.
3568 	 */
3569 	offset = PAGE_SIZE - left;
3570 	while (left) {
3571 		char c;
3572 		if (get_user(c, (const char __user *)data + offset))
3573 			break;
3574 		copy[offset] = c;
3575 		left--;
3576 		offset++;
3577 	}
3578 
3579 	if (left == PAGE_SIZE) {
3580 		kfree(copy);
3581 		return ERR_PTR(-EFAULT);
3582 	}
3583 
3584 	return copy;
3585 }
3586 
copy_mount_string(const void __user * data)3587 static char *copy_mount_string(const void __user *data)
3588 {
3589 	return data ? strndup_user(data, PATH_MAX) : NULL;
3590 }
3591 
3592 /*
3593  * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to
3594  * be given to the mount() call (ie: read-only, no-dev, no-suid etc).
3595  *
3596  * data is a (void *) that can point to any structure up to
3597  * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent
3598  * information (or be NULL).
3599  *
3600  * Pre-0.97 versions of mount() didn't have a flags word.
3601  * When the flags word was introduced its top half was required
3602  * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9.
3603  * Therefore, if this magic number is present, it carries no information
3604  * and must be discarded.
3605  */
path_mount(const char * dev_name,struct path * path,const char * type_page,unsigned long flags,void * data_page)3606 int path_mount(const char *dev_name, struct path *path,
3607 		const char *type_page, unsigned long flags, void *data_page)
3608 {
3609 	unsigned int mnt_flags = 0, sb_flags;
3610 	int ret;
3611 
3612 	/* Discard magic */
3613 	if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
3614 		flags &= ~MS_MGC_MSK;
3615 
3616 	/* Basic sanity checks */
3617 	if (data_page)
3618 		((char *)data_page)[PAGE_SIZE - 1] = 0;
3619 
3620 	if (flags & MS_NOUSER)
3621 		return -EINVAL;
3622 
3623 	ret = security_sb_mount(dev_name, path, type_page, flags, data_page);
3624 	if (ret)
3625 		return ret;
3626 	if (!may_mount())
3627 		return -EPERM;
3628 	if (flags & SB_MANDLOCK)
3629 		warn_mandlock();
3630 
3631 	/* Default to relatime unless overriden */
3632 	if (!(flags & MS_NOATIME))
3633 		mnt_flags |= MNT_RELATIME;
3634 
3635 	/* Separate the per-mountpoint flags */
3636 	if (flags & MS_NOSUID)
3637 		mnt_flags |= MNT_NOSUID;
3638 	if (flags & MS_NODEV)
3639 		mnt_flags |= MNT_NODEV;
3640 	if (flags & MS_NOEXEC)
3641 		mnt_flags |= MNT_NOEXEC;
3642 	if (flags & MS_NOATIME)
3643 		mnt_flags |= MNT_NOATIME;
3644 	if (flags & MS_NODIRATIME)
3645 		mnt_flags |= MNT_NODIRATIME;
3646 	if (flags & MS_STRICTATIME)
3647 		mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME);
3648 	if (flags & MS_RDONLY)
3649 		mnt_flags |= MNT_READONLY;
3650 	if (flags & MS_NOSYMFOLLOW)
3651 		mnt_flags |= MNT_NOSYMFOLLOW;
3652 
3653 	/* The default atime for remount is preservation */
3654 	if ((flags & MS_REMOUNT) &&
3655 	    ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME |
3656 		       MS_STRICTATIME)) == 0)) {
3657 		mnt_flags &= ~MNT_ATIME_MASK;
3658 		mnt_flags |= path->mnt->mnt_flags & MNT_ATIME_MASK;
3659 	}
3660 
3661 	sb_flags = flags & (SB_RDONLY |
3662 			    SB_SYNCHRONOUS |
3663 			    SB_MANDLOCK |
3664 			    SB_DIRSYNC |
3665 			    SB_SILENT |
3666 			    SB_POSIXACL |
3667 			    SB_LAZYTIME |
3668 			    SB_I_VERSION);
3669 
3670 	if ((flags & (MS_REMOUNT | MS_BIND)) == (MS_REMOUNT | MS_BIND))
3671 		return do_reconfigure_mnt(path, mnt_flags);
3672 	if (flags & MS_REMOUNT)
3673 		return do_remount(path, flags, sb_flags, mnt_flags, data_page);
3674 	if (flags & MS_BIND)
3675 		return do_loopback(path, dev_name, flags & MS_REC);
3676 	if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
3677 		return do_change_type(path, flags);
3678 	if (flags & MS_MOVE)
3679 		return do_move_mount_old(path, dev_name);
3680 
3681 	return do_new_mount(path, type_page, sb_flags, mnt_flags, dev_name,
3682 			    data_page);
3683 }
3684 
do_mount(const char * dev_name,const char __user * dir_name,const char * type_page,unsigned long flags,void * data_page)3685 long do_mount(const char *dev_name, const char __user *dir_name,
3686 		const char *type_page, unsigned long flags, void *data_page)
3687 {
3688 	struct path path;
3689 	int ret;
3690 
3691 	ret = user_path_at(AT_FDCWD, dir_name, LOOKUP_FOLLOW, &path);
3692 	if (ret)
3693 		return ret;
3694 	ret = path_mount(dev_name, &path, type_page, flags, data_page);
3695 	path_put(&path);
3696 	return ret;
3697 }
3698 
inc_mnt_namespaces(struct user_namespace * ns)3699 static struct ucounts *inc_mnt_namespaces(struct user_namespace *ns)
3700 {
3701 	return inc_ucount(ns, current_euid(), UCOUNT_MNT_NAMESPACES);
3702 }
3703 
dec_mnt_namespaces(struct ucounts * ucounts)3704 static void dec_mnt_namespaces(struct ucounts *ucounts)
3705 {
3706 	dec_ucount(ucounts, UCOUNT_MNT_NAMESPACES);
3707 }
3708 
free_mnt_ns(struct mnt_namespace * ns)3709 static void free_mnt_ns(struct mnt_namespace *ns)
3710 {
3711 	if (!is_anon_ns(ns))
3712 		ns_free_inum(&ns->ns);
3713 	dec_mnt_namespaces(ns->ucounts);
3714 	put_user_ns(ns->user_ns);
3715 	kfree(ns);
3716 }
3717 
3718 /*
3719  * Assign a sequence number so we can detect when we attempt to bind
3720  * mount a reference to an older mount namespace into the current
3721  * mount namespace, preventing reference counting loops.  A 64bit
3722  * number incrementing at 10Ghz will take 12,427 years to wrap which
3723  * is effectively never, so we can ignore the possibility.
3724  */
3725 static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1);
3726 
alloc_mnt_ns(struct user_namespace * user_ns,bool anon)3727 static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns, bool anon)
3728 {
3729 	struct mnt_namespace *new_ns;
3730 	struct ucounts *ucounts;
3731 	int ret;
3732 
3733 	ucounts = inc_mnt_namespaces(user_ns);
3734 	if (!ucounts)
3735 		return ERR_PTR(-ENOSPC);
3736 
3737 	new_ns = kzalloc(sizeof(struct mnt_namespace), GFP_KERNEL_ACCOUNT);
3738 	if (!new_ns) {
3739 		dec_mnt_namespaces(ucounts);
3740 		return ERR_PTR(-ENOMEM);
3741 	}
3742 	if (!anon) {
3743 		ret = ns_alloc_inum(&new_ns->ns);
3744 		if (ret) {
3745 			kfree(new_ns);
3746 			dec_mnt_namespaces(ucounts);
3747 			return ERR_PTR(ret);
3748 		}
3749 	}
3750 	new_ns->ns.ops = &mntns_operations;
3751 	if (!anon)
3752 		new_ns->seq = atomic64_add_return(1, &mnt_ns_seq);
3753 	refcount_set(&new_ns->ns.count, 1);
3754 	INIT_LIST_HEAD(&new_ns->list);
3755 	init_waitqueue_head(&new_ns->poll);
3756 	spin_lock_init(&new_ns->ns_lock);
3757 	new_ns->user_ns = get_user_ns(user_ns);
3758 	new_ns->ucounts = ucounts;
3759 	return new_ns;
3760 }
3761 
3762 __latent_entropy
copy_mnt_ns(unsigned long flags,struct mnt_namespace * ns,struct user_namespace * user_ns,struct fs_struct * new_fs)3763 struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
3764 		struct user_namespace *user_ns, struct fs_struct *new_fs)
3765 {
3766 	struct mnt_namespace *new_ns;
3767 	struct vfsmount *rootmnt = NULL, *pwdmnt = NULL;
3768 	struct mount *p, *q;
3769 	struct mount *old;
3770 	struct mount *new;
3771 	int copy_flags;
3772 
3773 	BUG_ON(!ns);
3774 
3775 	if (likely(!(flags & CLONE_NEWNS))) {
3776 		get_mnt_ns(ns);
3777 		return ns;
3778 	}
3779 
3780 	old = ns->root;
3781 
3782 	new_ns = alloc_mnt_ns(user_ns, false);
3783 	if (IS_ERR(new_ns))
3784 		return new_ns;
3785 
3786 	namespace_lock();
3787 	/* First pass: copy the tree topology */
3788 	copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE;
3789 	if (user_ns != ns->user_ns)
3790 		copy_flags |= CL_SHARED_TO_SLAVE;
3791 	new = copy_tree(old, old->mnt.mnt_root, copy_flags);
3792 	if (IS_ERR(new)) {
3793 		namespace_unlock();
3794 		free_mnt_ns(new_ns);
3795 		return ERR_CAST(new);
3796 	}
3797 	if (user_ns != ns->user_ns) {
3798 		lock_mount_hash();
3799 		lock_mnt_tree(new);
3800 		unlock_mount_hash();
3801 	}
3802 	new_ns->root = new;
3803 	list_add_tail(&new_ns->list, &new->mnt_list);
3804 
3805 	/*
3806 	 * Second pass: switch the tsk->fs->* elements and mark new vfsmounts
3807 	 * as belonging to new namespace.  We have already acquired a private
3808 	 * fs_struct, so tsk->fs->lock is not needed.
3809 	 */
3810 	p = old;
3811 	q = new;
3812 	while (p) {
3813 		q->mnt_ns = new_ns;
3814 		new_ns->mounts++;
3815 		if (new_fs) {
3816 			if (&p->mnt == new_fs->root.mnt) {
3817 				new_fs->root.mnt = mntget(&q->mnt);
3818 				rootmnt = &p->mnt;
3819 			}
3820 			if (&p->mnt == new_fs->pwd.mnt) {
3821 				new_fs->pwd.mnt = mntget(&q->mnt);
3822 				pwdmnt = &p->mnt;
3823 			}
3824 		}
3825 		p = next_mnt(p, old);
3826 		q = next_mnt(q, new);
3827 		if (!q)
3828 			break;
3829 		// an mntns binding we'd skipped?
3830 		while (p->mnt.mnt_root != q->mnt.mnt_root)
3831 			p = next_mnt(skip_mnt_tree(p), old);
3832 	}
3833 	namespace_unlock();
3834 
3835 	if (rootmnt)
3836 		mntput(rootmnt);
3837 	if (pwdmnt)
3838 		mntput(pwdmnt);
3839 
3840 	return new_ns;
3841 }
3842 
mount_subtree(struct vfsmount * m,const char * name)3843 struct dentry *mount_subtree(struct vfsmount *m, const char *name)
3844 {
3845 	struct mount *mnt = real_mount(m);
3846 	struct mnt_namespace *ns;
3847 	struct super_block *s;
3848 	struct path path;
3849 	int err;
3850 
3851 	ns = alloc_mnt_ns(&init_user_ns, true);
3852 	if (IS_ERR(ns)) {
3853 		mntput(m);
3854 		return ERR_CAST(ns);
3855 	}
3856 	mnt->mnt_ns = ns;
3857 	ns->root = mnt;
3858 	ns->mounts++;
3859 	list_add(&mnt->mnt_list, &ns->list);
3860 
3861 	err = vfs_path_lookup(m->mnt_root, m,
3862 			name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
3863 
3864 	put_mnt_ns(ns);
3865 
3866 	if (err)
3867 		return ERR_PTR(err);
3868 
3869 	/* trade a vfsmount reference for active sb one */
3870 	s = path.mnt->mnt_sb;
3871 	atomic_inc(&s->s_active);
3872 	mntput(path.mnt);
3873 	/* lock the sucker */
3874 	down_write(&s->s_umount);
3875 	/* ... and return the root of (sub)tree on it */
3876 	return path.dentry;
3877 }
3878 EXPORT_SYMBOL(mount_subtree);
3879 
SYSCALL_DEFINE5(mount,char __user *,dev_name,char __user *,dir_name,char __user *,type,unsigned long,flags,void __user *,data)3880 SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
3881 		char __user *, type, unsigned long, flags, void __user *, data)
3882 {
3883 	int ret;
3884 	char *kernel_type;
3885 	char *kernel_dev;
3886 	void *options;
3887 
3888 	kernel_type = copy_mount_string(type);
3889 	ret = PTR_ERR(kernel_type);
3890 	if (IS_ERR(kernel_type))
3891 		goto out_type;
3892 
3893 	kernel_dev = copy_mount_string(dev_name);
3894 	ret = PTR_ERR(kernel_dev);
3895 	if (IS_ERR(kernel_dev))
3896 		goto out_dev;
3897 
3898 	options = copy_mount_options(data);
3899 	ret = PTR_ERR(options);
3900 	if (IS_ERR(options))
3901 		goto out_data;
3902 
3903 	ret = do_mount(kernel_dev, dir_name, kernel_type, flags, options);
3904 
3905 	kfree(options);
3906 out_data:
3907 	kfree(kernel_dev);
3908 out_dev:
3909 	kfree(kernel_type);
3910 out_type:
3911 	return ret;
3912 }
3913 
3914 #define FSMOUNT_VALID_FLAGS                                                    \
3915 	(MOUNT_ATTR_RDONLY | MOUNT_ATTR_NOSUID | MOUNT_ATTR_NODEV |            \
3916 	 MOUNT_ATTR_NOEXEC | MOUNT_ATTR__ATIME | MOUNT_ATTR_NODIRATIME |       \
3917 	 MOUNT_ATTR_NOSYMFOLLOW)
3918 
3919 #define MOUNT_SETATTR_VALID_FLAGS (FSMOUNT_VALID_FLAGS | MOUNT_ATTR_IDMAP)
3920 
3921 #define MOUNT_SETATTR_PROPAGATION_FLAGS \
3922 	(MS_UNBINDABLE | MS_PRIVATE | MS_SLAVE | MS_SHARED)
3923 
attr_flags_to_mnt_flags(u64 attr_flags)3924 static unsigned int attr_flags_to_mnt_flags(u64 attr_flags)
3925 {
3926 	unsigned int mnt_flags = 0;
3927 
3928 	if (attr_flags & MOUNT_ATTR_RDONLY)
3929 		mnt_flags |= MNT_READONLY;
3930 	if (attr_flags & MOUNT_ATTR_NOSUID)
3931 		mnt_flags |= MNT_NOSUID;
3932 	if (attr_flags & MOUNT_ATTR_NODEV)
3933 		mnt_flags |= MNT_NODEV;
3934 	if (attr_flags & MOUNT_ATTR_NOEXEC)
3935 		mnt_flags |= MNT_NOEXEC;
3936 	if (attr_flags & MOUNT_ATTR_NODIRATIME)
3937 		mnt_flags |= MNT_NODIRATIME;
3938 	if (attr_flags & MOUNT_ATTR_NOSYMFOLLOW)
3939 		mnt_flags |= MNT_NOSYMFOLLOW;
3940 
3941 	return mnt_flags;
3942 }
3943 
3944 /*
3945  * Create a kernel mount representation for a new, prepared superblock
3946  * (specified by fs_fd) and attach to an open_tree-like file descriptor.
3947  */
SYSCALL_DEFINE3(fsmount,int,fs_fd,unsigned int,flags,unsigned int,attr_flags)3948 SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
3949 		unsigned int, attr_flags)
3950 {
3951 	struct mnt_namespace *ns;
3952 	struct fs_context *fc;
3953 	struct file *file;
3954 	struct path newmount;
3955 	struct mount *mnt;
3956 	struct fd f;
3957 	unsigned int mnt_flags = 0;
3958 	long ret;
3959 
3960 	if (!may_mount())
3961 		return -EPERM;
3962 
3963 	if ((flags & ~(FSMOUNT_CLOEXEC)) != 0)
3964 		return -EINVAL;
3965 
3966 	if (attr_flags & ~FSMOUNT_VALID_FLAGS)
3967 		return -EINVAL;
3968 
3969 	mnt_flags = attr_flags_to_mnt_flags(attr_flags);
3970 
3971 	switch (attr_flags & MOUNT_ATTR__ATIME) {
3972 	case MOUNT_ATTR_STRICTATIME:
3973 		break;
3974 	case MOUNT_ATTR_NOATIME:
3975 		mnt_flags |= MNT_NOATIME;
3976 		break;
3977 	case MOUNT_ATTR_RELATIME:
3978 		mnt_flags |= MNT_RELATIME;
3979 		break;
3980 	default:
3981 		return -EINVAL;
3982 	}
3983 
3984 	f = fdget(fs_fd);
3985 	if (!f.file)
3986 		return -EBADF;
3987 
3988 	ret = -EINVAL;
3989 	if (f.file->f_op != &fscontext_fops)
3990 		goto err_fsfd;
3991 
3992 	fc = f.file->private_data;
3993 
3994 	ret = mutex_lock_interruptible(&fc->uapi_mutex);
3995 	if (ret < 0)
3996 		goto err_fsfd;
3997 
3998 	/* There must be a valid superblock or we can't mount it */
3999 	ret = -EINVAL;
4000 	if (!fc->root)
4001 		goto err_unlock;
4002 
4003 	ret = -EPERM;
4004 	if (mount_too_revealing(fc->root->d_sb, &mnt_flags)) {
4005 		pr_warn("VFS: Mount too revealing\n");
4006 		goto err_unlock;
4007 	}
4008 
4009 	ret = -EBUSY;
4010 	if (fc->phase != FS_CONTEXT_AWAITING_MOUNT)
4011 		goto err_unlock;
4012 
4013 	if (fc->sb_flags & SB_MANDLOCK)
4014 		warn_mandlock();
4015 
4016 	newmount.mnt = vfs_create_mount(fc);
4017 	if (IS_ERR(newmount.mnt)) {
4018 		ret = PTR_ERR(newmount.mnt);
4019 		goto err_unlock;
4020 	}
4021 	newmount.dentry = dget(fc->root);
4022 	newmount.mnt->mnt_flags = mnt_flags;
4023 
4024 	/* We've done the mount bit - now move the file context into more or
4025 	 * less the same state as if we'd done an fspick().  We don't want to
4026 	 * do any memory allocation or anything like that at this point as we
4027 	 * don't want to have to handle any errors incurred.
4028 	 */
4029 	vfs_clean_context(fc);
4030 
4031 	ns = alloc_mnt_ns(current->nsproxy->mnt_ns->user_ns, true);
4032 	if (IS_ERR(ns)) {
4033 		ret = PTR_ERR(ns);
4034 		goto err_path;
4035 	}
4036 	mnt = real_mount(newmount.mnt);
4037 	mnt->mnt_ns = ns;
4038 	ns->root = mnt;
4039 	ns->mounts = 1;
4040 	list_add(&mnt->mnt_list, &ns->list);
4041 	mntget(newmount.mnt);
4042 
4043 	/* Attach to an apparent O_PATH fd with a note that we need to unmount
4044 	 * it, not just simply put it.
4045 	 */
4046 	file = dentry_open(&newmount, O_PATH, fc->cred);
4047 	if (IS_ERR(file)) {
4048 		dissolve_on_fput(newmount.mnt);
4049 		ret = PTR_ERR(file);
4050 		goto err_path;
4051 	}
4052 	file->f_mode |= FMODE_NEED_UNMOUNT;
4053 
4054 	ret = get_unused_fd_flags((flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0);
4055 	if (ret >= 0)
4056 		fd_install(ret, file);
4057 	else
4058 		fput(file);
4059 
4060 err_path:
4061 	path_put(&newmount);
4062 err_unlock:
4063 	mutex_unlock(&fc->uapi_mutex);
4064 err_fsfd:
4065 	fdput(f);
4066 	return ret;
4067 }
4068 
4069 /*
4070  * Move a mount from one place to another.  In combination with
4071  * fsopen()/fsmount() this is used to install a new mount and in combination
4072  * with open_tree(OPEN_TREE_CLONE [| AT_RECURSIVE]) it can be used to copy
4073  * a mount subtree.
4074  *
4075  * Note the flags value is a combination of MOVE_MOUNT_* flags.
4076  */
SYSCALL_DEFINE5(move_mount,int,from_dfd,const char __user *,from_pathname,int,to_dfd,const char __user *,to_pathname,unsigned int,flags)4077 SYSCALL_DEFINE5(move_mount,
4078 		int, from_dfd, const char __user *, from_pathname,
4079 		int, to_dfd, const char __user *, to_pathname,
4080 		unsigned int, flags)
4081 {
4082 	struct path from_path, to_path;
4083 	unsigned int lflags;
4084 	int ret = 0;
4085 
4086 	if (!may_mount())
4087 		return -EPERM;
4088 
4089 	if (flags & ~MOVE_MOUNT__MASK)
4090 		return -EINVAL;
4091 
4092 	if ((flags & (MOVE_MOUNT_BENEATH | MOVE_MOUNT_SET_GROUP)) ==
4093 	    (MOVE_MOUNT_BENEATH | MOVE_MOUNT_SET_GROUP))
4094 		return -EINVAL;
4095 
4096 	/* If someone gives a pathname, they aren't permitted to move
4097 	 * from an fd that requires unmount as we can't get at the flag
4098 	 * to clear it afterwards.
4099 	 */
4100 	lflags = 0;
4101 	if (flags & MOVE_MOUNT_F_SYMLINKS)	lflags |= LOOKUP_FOLLOW;
4102 	if (flags & MOVE_MOUNT_F_AUTOMOUNTS)	lflags |= LOOKUP_AUTOMOUNT;
4103 	if (flags & MOVE_MOUNT_F_EMPTY_PATH)	lflags |= LOOKUP_EMPTY;
4104 
4105 	ret = user_path_at(from_dfd, from_pathname, lflags, &from_path);
4106 	if (ret < 0)
4107 		return ret;
4108 
4109 	lflags = 0;
4110 	if (flags & MOVE_MOUNT_T_SYMLINKS)	lflags |= LOOKUP_FOLLOW;
4111 	if (flags & MOVE_MOUNT_T_AUTOMOUNTS)	lflags |= LOOKUP_AUTOMOUNT;
4112 	if (flags & MOVE_MOUNT_T_EMPTY_PATH)	lflags |= LOOKUP_EMPTY;
4113 
4114 	ret = user_path_at(to_dfd, to_pathname, lflags, &to_path);
4115 	if (ret < 0)
4116 		goto out_from;
4117 
4118 	ret = security_move_mount(&from_path, &to_path);
4119 	if (ret < 0)
4120 		goto out_to;
4121 
4122 	if (flags & MOVE_MOUNT_SET_GROUP)
4123 		ret = do_set_group(&from_path, &to_path);
4124 	else
4125 		ret = do_move_mount(&from_path, &to_path,
4126 				    (flags & MOVE_MOUNT_BENEATH));
4127 
4128 out_to:
4129 	path_put(&to_path);
4130 out_from:
4131 	path_put(&from_path);
4132 	return ret;
4133 }
4134 
4135 /*
4136  * Return true if path is reachable from root
4137  *
4138  * namespace_sem or mount_lock is held
4139  */
is_path_reachable(struct mount * mnt,struct dentry * dentry,const struct path * root)4140 bool is_path_reachable(struct mount *mnt, struct dentry *dentry,
4141 			 const struct path *root)
4142 {
4143 	while (&mnt->mnt != root->mnt && mnt_has_parent(mnt)) {
4144 		dentry = mnt->mnt_mountpoint;
4145 		mnt = mnt->mnt_parent;
4146 	}
4147 	return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry);
4148 }
4149 
path_is_under(const struct path * path1,const struct path * path2)4150 bool path_is_under(const struct path *path1, const struct path *path2)
4151 {
4152 	bool res;
4153 	read_seqlock_excl(&mount_lock);
4154 	res = is_path_reachable(real_mount(path1->mnt), path1->dentry, path2);
4155 	read_sequnlock_excl(&mount_lock);
4156 	return res;
4157 }
4158 EXPORT_SYMBOL(path_is_under);
4159 
4160 /*
4161  * pivot_root Semantics:
4162  * Moves the root file system of the current process to the directory put_old,
4163  * makes new_root as the new root file system of the current process, and sets
4164  * root/cwd of all processes which had them on the current root to new_root.
4165  *
4166  * Restrictions:
4167  * The new_root and put_old must be directories, and  must not be on the
4168  * same file  system as the current process root. The put_old  must  be
4169  * underneath new_root,  i.e. adding a non-zero number of /.. to the string
4170  * pointed to by put_old must yield the same directory as new_root. No other
4171  * file system may be mounted on put_old. After all, new_root is a mountpoint.
4172  *
4173  * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem.
4174  * See Documentation/filesystems/ramfs-rootfs-initramfs.rst for alternatives
4175  * in this situation.
4176  *
4177  * Notes:
4178  *  - we don't move root/cwd if they are not at the root (reason: if something
4179  *    cared enough to change them, it's probably wrong to force them elsewhere)
4180  *  - it's okay to pick a root that isn't the root of a file system, e.g.
4181  *    /nfs/my_root where /nfs is the mount point. It must be a mountpoint,
4182  *    though, so you may need to say mount --bind /nfs/my_root /nfs/my_root
4183  *    first.
4184  */
SYSCALL_DEFINE2(pivot_root,const char __user *,new_root,const char __user *,put_old)4185 SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
4186 		const char __user *, put_old)
4187 {
4188 	struct path new, old, root;
4189 	struct mount *new_mnt, *root_mnt, *old_mnt, *root_parent, *ex_parent;
4190 	struct mountpoint *old_mp, *root_mp;
4191 	int error;
4192 
4193 	if (!may_mount())
4194 		return -EPERM;
4195 
4196 	error = user_path_at(AT_FDCWD, new_root,
4197 			     LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &new);
4198 	if (error)
4199 		goto out0;
4200 
4201 	error = user_path_at(AT_FDCWD, put_old,
4202 			     LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &old);
4203 	if (error)
4204 		goto out1;
4205 
4206 	error = security_sb_pivotroot(&old, &new);
4207 	if (error)
4208 		goto out2;
4209 
4210 	get_fs_root(current->fs, &root);
4211 	old_mp = lock_mount(&old);
4212 	error = PTR_ERR(old_mp);
4213 	if (IS_ERR(old_mp))
4214 		goto out3;
4215 
4216 	error = -EINVAL;
4217 	new_mnt = real_mount(new.mnt);
4218 	root_mnt = real_mount(root.mnt);
4219 	old_mnt = real_mount(old.mnt);
4220 	ex_parent = new_mnt->mnt_parent;
4221 	root_parent = root_mnt->mnt_parent;
4222 	if (IS_MNT_SHARED(old_mnt) ||
4223 		IS_MNT_SHARED(ex_parent) ||
4224 		IS_MNT_SHARED(root_parent))
4225 		goto out4;
4226 	if (!check_mnt(root_mnt) || !check_mnt(new_mnt))
4227 		goto out4;
4228 	if (new_mnt->mnt.mnt_flags & MNT_LOCKED)
4229 		goto out4;
4230 	error = -ENOENT;
4231 	if (d_unlinked(new.dentry))
4232 		goto out4;
4233 	error = -EBUSY;
4234 	if (new_mnt == root_mnt || old_mnt == root_mnt)
4235 		goto out4; /* loop, on the same file system  */
4236 	error = -EINVAL;
4237 	if (!path_mounted(&root))
4238 		goto out4; /* not a mountpoint */
4239 	if (!mnt_has_parent(root_mnt))
4240 		goto out4; /* not attached */
4241 	if (!path_mounted(&new))
4242 		goto out4; /* not a mountpoint */
4243 	if (!mnt_has_parent(new_mnt))
4244 		goto out4; /* not attached */
4245 	/* make sure we can reach put_old from new_root */
4246 	if (!is_path_reachable(old_mnt, old.dentry, &new))
4247 		goto out4;
4248 	/* make certain new is below the root */
4249 	if (!is_path_reachable(new_mnt, new.dentry, &root))
4250 		goto out4;
4251 	lock_mount_hash();
4252 	umount_mnt(new_mnt);
4253 	root_mp = unhash_mnt(root_mnt);  /* we'll need its mountpoint */
4254 	if (root_mnt->mnt.mnt_flags & MNT_LOCKED) {
4255 		new_mnt->mnt.mnt_flags |= MNT_LOCKED;
4256 		root_mnt->mnt.mnt_flags &= ~MNT_LOCKED;
4257 	}
4258 	/* mount old root on put_old */
4259 	attach_mnt(root_mnt, old_mnt, old_mp, false);
4260 	/* mount new_root on / */
4261 	attach_mnt(new_mnt, root_parent, root_mp, false);
4262 	mnt_add_count(root_parent, -1);
4263 	touch_mnt_namespace(current->nsproxy->mnt_ns);
4264 	/* A moved mount should not expire automatically */
4265 	list_del_init(&new_mnt->mnt_expire);
4266 	put_mountpoint(root_mp);
4267 	unlock_mount_hash();
4268 	chroot_fs_refs(&root, &new);
4269 	error = 0;
4270 out4:
4271 	unlock_mount(old_mp);
4272 	if (!error)
4273 		mntput_no_expire(ex_parent);
4274 out3:
4275 	path_put(&root);
4276 out2:
4277 	path_put(&old);
4278 out1:
4279 	path_put(&new);
4280 out0:
4281 	return error;
4282 }
4283 
recalc_flags(struct mount_kattr * kattr,struct mount * mnt)4284 static unsigned int recalc_flags(struct mount_kattr *kattr, struct mount *mnt)
4285 {
4286 	unsigned int flags = mnt->mnt.mnt_flags;
4287 
4288 	/*  flags to clear */
4289 	flags &= ~kattr->attr_clr;
4290 	/* flags to raise */
4291 	flags |= kattr->attr_set;
4292 
4293 	return flags;
4294 }
4295 
can_idmap_mount(const struct mount_kattr * kattr,struct mount * mnt)4296 static int can_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
4297 {
4298 	struct vfsmount *m = &mnt->mnt;
4299 	struct user_namespace *fs_userns = m->mnt_sb->s_user_ns;
4300 
4301 	if (!kattr->mnt_idmap)
4302 		return 0;
4303 
4304 	/*
4305 	 * Creating an idmapped mount with the filesystem wide idmapping
4306 	 * doesn't make sense so block that. We don't allow mushy semantics.
4307 	 */
4308 	if (!check_fsmapping(kattr->mnt_idmap, m->mnt_sb))
4309 		return -EINVAL;
4310 
4311 	/*
4312 	 * Once a mount has been idmapped we don't allow it to change its
4313 	 * mapping. It makes things simpler and callers can just create
4314 	 * another bind-mount they can idmap if they want to.
4315 	 */
4316 	if (is_idmapped_mnt(m))
4317 		return -EPERM;
4318 
4319 	/* The underlying filesystem doesn't support idmapped mounts yet. */
4320 	if (!(m->mnt_sb->s_type->fs_flags & FS_ALLOW_IDMAP))
4321 		return -EINVAL;
4322 
4323 	/* We're not controlling the superblock. */
4324 	if (!ns_capable(fs_userns, CAP_SYS_ADMIN))
4325 		return -EPERM;
4326 
4327 	/* Mount has already been visible in the filesystem hierarchy. */
4328 	if (!is_anon_ns(mnt->mnt_ns))
4329 		return -EINVAL;
4330 
4331 	return 0;
4332 }
4333 
4334 /**
4335  * mnt_allow_writers() - check whether the attribute change allows writers
4336  * @kattr: the new mount attributes
4337  * @mnt: the mount to which @kattr will be applied
4338  *
4339  * Check whether thew new mount attributes in @kattr allow concurrent writers.
4340  *
4341  * Return: true if writers need to be held, false if not
4342  */
mnt_allow_writers(const struct mount_kattr * kattr,const struct mount * mnt)4343 static inline bool mnt_allow_writers(const struct mount_kattr *kattr,
4344 				     const struct mount *mnt)
4345 {
4346 	return (!(kattr->attr_set & MNT_READONLY) ||
4347 		(mnt->mnt.mnt_flags & MNT_READONLY)) &&
4348 	       !kattr->mnt_idmap;
4349 }
4350 
mount_setattr_prepare(struct mount_kattr * kattr,struct mount * mnt)4351 static int mount_setattr_prepare(struct mount_kattr *kattr, struct mount *mnt)
4352 {
4353 	struct mount *m;
4354 	int err;
4355 
4356 	for (m = mnt; m; m = next_mnt(m, mnt)) {
4357 		if (!can_change_locked_flags(m, recalc_flags(kattr, m))) {
4358 			err = -EPERM;
4359 			break;
4360 		}
4361 
4362 		err = can_idmap_mount(kattr, m);
4363 		if (err)
4364 			break;
4365 
4366 		if (!mnt_allow_writers(kattr, m)) {
4367 			err = mnt_hold_writers(m);
4368 			if (err)
4369 				break;
4370 		}
4371 
4372 		if (!kattr->recurse)
4373 			return 0;
4374 	}
4375 
4376 	if (err) {
4377 		struct mount *p;
4378 
4379 		/*
4380 		 * If we had to call mnt_hold_writers() MNT_WRITE_HOLD will
4381 		 * be set in @mnt_flags. The loop unsets MNT_WRITE_HOLD for all
4382 		 * mounts and needs to take care to include the first mount.
4383 		 */
4384 		for (p = mnt; p; p = next_mnt(p, mnt)) {
4385 			/* If we had to hold writers unblock them. */
4386 			if (p->mnt.mnt_flags & MNT_WRITE_HOLD)
4387 				mnt_unhold_writers(p);
4388 
4389 			/*
4390 			 * We're done once the first mount we changed got
4391 			 * MNT_WRITE_HOLD unset.
4392 			 */
4393 			if (p == m)
4394 				break;
4395 		}
4396 	}
4397 	return err;
4398 }
4399 
do_idmap_mount(const struct mount_kattr * kattr,struct mount * mnt)4400 static void do_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
4401 {
4402 	if (!kattr->mnt_idmap)
4403 		return;
4404 
4405 	/*
4406 	 * Pairs with smp_load_acquire() in mnt_idmap().
4407 	 *
4408 	 * Since we only allow a mount to change the idmapping once and
4409 	 * verified this in can_idmap_mount() we know that the mount has
4410 	 * @nop_mnt_idmap attached to it. So there's no need to drop any
4411 	 * references.
4412 	 */
4413 	smp_store_release(&mnt->mnt.mnt_idmap, mnt_idmap_get(kattr->mnt_idmap));
4414 }
4415 
mount_setattr_commit(struct mount_kattr * kattr,struct mount * mnt)4416 static void mount_setattr_commit(struct mount_kattr *kattr, struct mount *mnt)
4417 {
4418 	struct mount *m;
4419 
4420 	for (m = mnt; m; m = next_mnt(m, mnt)) {
4421 		unsigned int flags;
4422 
4423 		do_idmap_mount(kattr, m);
4424 		flags = recalc_flags(kattr, m);
4425 		WRITE_ONCE(m->mnt.mnt_flags, flags);
4426 
4427 		/* If we had to hold writers unblock them. */
4428 		if (m->mnt.mnt_flags & MNT_WRITE_HOLD)
4429 			mnt_unhold_writers(m);
4430 
4431 		if (kattr->propagation)
4432 			change_mnt_propagation(m, kattr->propagation);
4433 		if (!kattr->recurse)
4434 			break;
4435 	}
4436 	touch_mnt_namespace(mnt->mnt_ns);
4437 }
4438 
do_mount_setattr(struct path * path,struct mount_kattr * kattr)4439 static int do_mount_setattr(struct path *path, struct mount_kattr *kattr)
4440 {
4441 	struct mount *mnt = real_mount(path->mnt);
4442 	int err = 0;
4443 
4444 	if (!path_mounted(path))
4445 		return -EINVAL;
4446 
4447 	if (kattr->mnt_userns) {
4448 		struct mnt_idmap *mnt_idmap;
4449 
4450 		mnt_idmap = alloc_mnt_idmap(kattr->mnt_userns);
4451 		if (IS_ERR(mnt_idmap))
4452 			return PTR_ERR(mnt_idmap);
4453 		kattr->mnt_idmap = mnt_idmap;
4454 	}
4455 
4456 	if (kattr->propagation) {
4457 		/*
4458 		 * Only take namespace_lock() if we're actually changing
4459 		 * propagation.
4460 		 */
4461 		namespace_lock();
4462 		if (kattr->propagation == MS_SHARED) {
4463 			err = invent_group_ids(mnt, kattr->recurse);
4464 			if (err) {
4465 				namespace_unlock();
4466 				return err;
4467 			}
4468 		}
4469 	}
4470 
4471 	err = -EINVAL;
4472 	lock_mount_hash();
4473 
4474 	/* Ensure that this isn't anything purely vfs internal. */
4475 	if (!is_mounted(&mnt->mnt))
4476 		goto out;
4477 
4478 	/*
4479 	 * If this is an attached mount make sure it's located in the callers
4480 	 * mount namespace. If it's not don't let the caller interact with it.
4481 	 *
4482 	 * If this mount doesn't have a parent it's most often simply a
4483 	 * detached mount with an anonymous mount namespace. IOW, something
4484 	 * that's simply not attached yet. But there are apparently also users
4485 	 * that do change mount properties on the rootfs itself. That obviously
4486 	 * neither has a parent nor is it a detached mount so we cannot
4487 	 * unconditionally check for detached mounts.
4488 	 */
4489 	if ((mnt_has_parent(mnt) || !is_anon_ns(mnt->mnt_ns)) && !check_mnt(mnt))
4490 		goto out;
4491 
4492 	/*
4493 	 * First, we get the mount tree in a shape where we can change mount
4494 	 * properties without failure. If we succeeded to do so we commit all
4495 	 * changes and if we failed we clean up.
4496 	 */
4497 	err = mount_setattr_prepare(kattr, mnt);
4498 	if (!err)
4499 		mount_setattr_commit(kattr, mnt);
4500 
4501 out:
4502 	unlock_mount_hash();
4503 
4504 	if (kattr->propagation) {
4505 		if (err)
4506 			cleanup_group_ids(mnt, NULL);
4507 		namespace_unlock();
4508 	}
4509 
4510 	return err;
4511 }
4512 
build_mount_idmapped(const struct mount_attr * attr,size_t usize,struct mount_kattr * kattr,unsigned int flags)4513 static int build_mount_idmapped(const struct mount_attr *attr, size_t usize,
4514 				struct mount_kattr *kattr, unsigned int flags)
4515 {
4516 	int err = 0;
4517 	struct ns_common *ns;
4518 	struct user_namespace *mnt_userns;
4519 	struct fd f;
4520 
4521 	if (!((attr->attr_set | attr->attr_clr) & MOUNT_ATTR_IDMAP))
4522 		return 0;
4523 
4524 	/*
4525 	 * We currently do not support clearing an idmapped mount. If this ever
4526 	 * is a use-case we can revisit this but for now let's keep it simple
4527 	 * and not allow it.
4528 	 */
4529 	if (attr->attr_clr & MOUNT_ATTR_IDMAP)
4530 		return -EINVAL;
4531 
4532 	if (attr->userns_fd > INT_MAX)
4533 		return -EINVAL;
4534 
4535 	f = fdget(attr->userns_fd);
4536 	if (!f.file)
4537 		return -EBADF;
4538 
4539 	if (!proc_ns_file(f.file)) {
4540 		err = -EINVAL;
4541 		goto out_fput;
4542 	}
4543 
4544 	ns = get_proc_ns(file_inode(f.file));
4545 	if (ns->ops->type != CLONE_NEWUSER) {
4546 		err = -EINVAL;
4547 		goto out_fput;
4548 	}
4549 
4550 	/*
4551 	 * The initial idmapping cannot be used to create an idmapped
4552 	 * mount. We use the initial idmapping as an indicator of a mount
4553 	 * that is not idmapped. It can simply be passed into helpers that
4554 	 * are aware of idmapped mounts as a convenient shortcut. A user
4555 	 * can just create a dedicated identity mapping to achieve the same
4556 	 * result.
4557 	 */
4558 	mnt_userns = container_of(ns, struct user_namespace, ns);
4559 	if (mnt_userns == &init_user_ns) {
4560 		err = -EPERM;
4561 		goto out_fput;
4562 	}
4563 
4564 	/* We're not controlling the target namespace. */
4565 	if (!ns_capable(mnt_userns, CAP_SYS_ADMIN)) {
4566 		err = -EPERM;
4567 		goto out_fput;
4568 	}
4569 
4570 	kattr->mnt_userns = get_user_ns(mnt_userns);
4571 
4572 out_fput:
4573 	fdput(f);
4574 	return err;
4575 }
4576 
build_mount_kattr(const struct mount_attr * attr,size_t usize,struct mount_kattr * kattr,unsigned int flags)4577 static int build_mount_kattr(const struct mount_attr *attr, size_t usize,
4578 			     struct mount_kattr *kattr, unsigned int flags)
4579 {
4580 	unsigned int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW;
4581 
4582 	if (flags & AT_NO_AUTOMOUNT)
4583 		lookup_flags &= ~LOOKUP_AUTOMOUNT;
4584 	if (flags & AT_SYMLINK_NOFOLLOW)
4585 		lookup_flags &= ~LOOKUP_FOLLOW;
4586 	if (flags & AT_EMPTY_PATH)
4587 		lookup_flags |= LOOKUP_EMPTY;
4588 
4589 	*kattr = (struct mount_kattr) {
4590 		.lookup_flags	= lookup_flags,
4591 		.recurse	= !!(flags & AT_RECURSIVE),
4592 	};
4593 
4594 	if (attr->propagation & ~MOUNT_SETATTR_PROPAGATION_FLAGS)
4595 		return -EINVAL;
4596 	if (hweight32(attr->propagation & MOUNT_SETATTR_PROPAGATION_FLAGS) > 1)
4597 		return -EINVAL;
4598 	kattr->propagation = attr->propagation;
4599 
4600 	if ((attr->attr_set | attr->attr_clr) & ~MOUNT_SETATTR_VALID_FLAGS)
4601 		return -EINVAL;
4602 
4603 	kattr->attr_set = attr_flags_to_mnt_flags(attr->attr_set);
4604 	kattr->attr_clr = attr_flags_to_mnt_flags(attr->attr_clr);
4605 
4606 	/*
4607 	 * Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap,
4608 	 * users wanting to transition to a different atime setting cannot
4609 	 * simply specify the atime setting in @attr_set, but must also
4610 	 * specify MOUNT_ATTR__ATIME in the @attr_clr field.
4611 	 * So ensure that MOUNT_ATTR__ATIME can't be partially set in
4612 	 * @attr_clr and that @attr_set can't have any atime bits set if
4613 	 * MOUNT_ATTR__ATIME isn't set in @attr_clr.
4614 	 */
4615 	if (attr->attr_clr & MOUNT_ATTR__ATIME) {
4616 		if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME)
4617 			return -EINVAL;
4618 
4619 		/*
4620 		 * Clear all previous time settings as they are mutually
4621 		 * exclusive.
4622 		 */
4623 		kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME;
4624 		switch (attr->attr_set & MOUNT_ATTR__ATIME) {
4625 		case MOUNT_ATTR_RELATIME:
4626 			kattr->attr_set |= MNT_RELATIME;
4627 			break;
4628 		case MOUNT_ATTR_NOATIME:
4629 			kattr->attr_set |= MNT_NOATIME;
4630 			break;
4631 		case MOUNT_ATTR_STRICTATIME:
4632 			break;
4633 		default:
4634 			return -EINVAL;
4635 		}
4636 	} else {
4637 		if (attr->attr_set & MOUNT_ATTR__ATIME)
4638 			return -EINVAL;
4639 	}
4640 
4641 	return build_mount_idmapped(attr, usize, kattr, flags);
4642 }
4643 
finish_mount_kattr(struct mount_kattr * kattr)4644 static void finish_mount_kattr(struct mount_kattr *kattr)
4645 {
4646 	put_user_ns(kattr->mnt_userns);
4647 	kattr->mnt_userns = NULL;
4648 
4649 	if (kattr->mnt_idmap)
4650 		mnt_idmap_put(kattr->mnt_idmap);
4651 }
4652 
SYSCALL_DEFINE5(mount_setattr,int,dfd,const char __user *,path,unsigned int,flags,struct mount_attr __user *,uattr,size_t,usize)4653 SYSCALL_DEFINE5(mount_setattr, int, dfd, const char __user *, path,
4654 		unsigned int, flags, struct mount_attr __user *, uattr,
4655 		size_t, usize)
4656 {
4657 	int err;
4658 	struct path target;
4659 	struct mount_attr attr;
4660 	struct mount_kattr kattr;
4661 
4662 	BUILD_BUG_ON(sizeof(struct mount_attr) != MOUNT_ATTR_SIZE_VER0);
4663 
4664 	if (flags & ~(AT_EMPTY_PATH |
4665 		      AT_RECURSIVE |
4666 		      AT_SYMLINK_NOFOLLOW |
4667 		      AT_NO_AUTOMOUNT))
4668 		return -EINVAL;
4669 
4670 	if (unlikely(usize > PAGE_SIZE))
4671 		return -E2BIG;
4672 	if (unlikely(usize < MOUNT_ATTR_SIZE_VER0))
4673 		return -EINVAL;
4674 
4675 	if (!may_mount())
4676 		return -EPERM;
4677 
4678 	err = copy_struct_from_user(&attr, sizeof(attr), uattr, usize);
4679 	if (err)
4680 		return err;
4681 
4682 	/* Don't bother walking through the mounts if this is a nop. */
4683 	if (attr.attr_set == 0 &&
4684 	    attr.attr_clr == 0 &&
4685 	    attr.propagation == 0)
4686 		return 0;
4687 
4688 	err = build_mount_kattr(&attr, usize, &kattr, flags);
4689 	if (err)
4690 		return err;
4691 
4692 	err = user_path_at(dfd, path, kattr.lookup_flags, &target);
4693 	if (!err) {
4694 		err = do_mount_setattr(&target, &kattr);
4695 		path_put(&target);
4696 	}
4697 	finish_mount_kattr(&kattr);
4698 	return err;
4699 }
4700 
init_mount_tree(void)4701 static void __init init_mount_tree(void)
4702 {
4703 	struct vfsmount *mnt;
4704 	struct mount *m;
4705 	struct mnt_namespace *ns;
4706 	struct path root;
4707 
4708 	mnt = vfs_kern_mount(&rootfs_fs_type, 0, "rootfs", NULL);
4709 	if (IS_ERR(mnt))
4710 		panic("Can't create rootfs");
4711 
4712 	ns = alloc_mnt_ns(&init_user_ns, false);
4713 	if (IS_ERR(ns))
4714 		panic("Can't allocate initial namespace");
4715 	m = real_mount(mnt);
4716 	m->mnt_ns = ns;
4717 	ns->root = m;
4718 	ns->mounts = 1;
4719 	list_add(&m->mnt_list, &ns->list);
4720 	init_task.nsproxy->mnt_ns = ns;
4721 	get_mnt_ns(ns);
4722 
4723 	root.mnt = mnt;
4724 	root.dentry = mnt->mnt_root;
4725 	mnt->mnt_flags |= MNT_LOCKED;
4726 
4727 	set_fs_pwd(current->fs, &root);
4728 	set_fs_root(current->fs, &root);
4729 }
4730 
mnt_init(void)4731 void __init mnt_init(void)
4732 {
4733 	int err;
4734 
4735 	mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount),
4736 			0, SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, NULL);
4737 
4738 	mount_hashtable = alloc_large_system_hash("Mount-cache",
4739 				sizeof(struct hlist_head),
4740 				mhash_entries, 19,
4741 				HASH_ZERO,
4742 				&m_hash_shift, &m_hash_mask, 0, 0);
4743 	mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache",
4744 				sizeof(struct hlist_head),
4745 				mphash_entries, 19,
4746 				HASH_ZERO,
4747 				&mp_hash_shift, &mp_hash_mask, 0, 0);
4748 
4749 	if (!mount_hashtable || !mountpoint_hashtable)
4750 		panic("Failed to allocate mount hash table\n");
4751 
4752 	kernfs_init();
4753 
4754 	err = sysfs_init();
4755 	if (err)
4756 		printk(KERN_WARNING "%s: sysfs_init error: %d\n",
4757 			__func__, err);
4758 	fs_kobj = kobject_create_and_add("fs", NULL);
4759 	if (!fs_kobj)
4760 		printk(KERN_WARNING "%s: kobj create error\n", __func__);
4761 	shmem_init();
4762 	init_rootfs();
4763 	init_mount_tree();
4764 }
4765 
put_mnt_ns(struct mnt_namespace * ns)4766 void put_mnt_ns(struct mnt_namespace *ns)
4767 {
4768 	if (!refcount_dec_and_test(&ns->ns.count))
4769 		return;
4770 	drop_collected_mounts(&ns->root->mnt);
4771 	free_mnt_ns(ns);
4772 }
4773 
kern_mount(struct file_system_type * type)4774 struct vfsmount *kern_mount(struct file_system_type *type)
4775 {
4776 	struct vfsmount *mnt;
4777 	mnt = vfs_kern_mount(type, SB_KERNMOUNT, type->name, NULL);
4778 	if (!IS_ERR(mnt)) {
4779 		/*
4780 		 * it is a longterm mount, don't release mnt until
4781 		 * we unmount before file sys is unregistered
4782 		*/
4783 		real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL;
4784 	}
4785 	return mnt;
4786 }
4787 EXPORT_SYMBOL_GPL(kern_mount);
4788 
kern_unmount(struct vfsmount * mnt)4789 void kern_unmount(struct vfsmount *mnt)
4790 {
4791 	/* release long term mount so mount point can be released */
4792 	if (!IS_ERR(mnt)) {
4793 		mnt_make_shortterm(mnt);
4794 		synchronize_rcu();	/* yecchhh... */
4795 		mntput(mnt);
4796 	}
4797 }
4798 EXPORT_SYMBOL(kern_unmount);
4799 
kern_unmount_array(struct vfsmount * mnt[],unsigned int num)4800 void kern_unmount_array(struct vfsmount *mnt[], unsigned int num)
4801 {
4802 	unsigned int i;
4803 
4804 	for (i = 0; i < num; i++)
4805 		mnt_make_shortterm(mnt[i]);
4806 	synchronize_rcu_expedited();
4807 	for (i = 0; i < num; i++)
4808 		mntput(mnt[i]);
4809 }
4810 EXPORT_SYMBOL(kern_unmount_array);
4811 
our_mnt(struct vfsmount * mnt)4812 bool our_mnt(struct vfsmount *mnt)
4813 {
4814 	return check_mnt(real_mount(mnt));
4815 }
4816 
current_chrooted(void)4817 bool current_chrooted(void)
4818 {
4819 	/* Does the current process have a non-standard root */
4820 	struct path ns_root;
4821 	struct path fs_root;
4822 	bool chrooted;
4823 
4824 	/* Find the namespace root */
4825 	ns_root.mnt = &current->nsproxy->mnt_ns->root->mnt;
4826 	ns_root.dentry = ns_root.mnt->mnt_root;
4827 	path_get(&ns_root);
4828 	while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root))
4829 		;
4830 
4831 	get_fs_root(current->fs, &fs_root);
4832 
4833 	chrooted = !path_equal(&fs_root, &ns_root);
4834 
4835 	path_put(&fs_root);
4836 	path_put(&ns_root);
4837 
4838 	return chrooted;
4839 }
4840 
mnt_already_visible(struct mnt_namespace * ns,const struct super_block * sb,int * new_mnt_flags)4841 static bool mnt_already_visible(struct mnt_namespace *ns,
4842 				const struct super_block *sb,
4843 				int *new_mnt_flags)
4844 {
4845 	int new_flags = *new_mnt_flags;
4846 	struct mount *mnt;
4847 	bool visible = false;
4848 
4849 	down_read(&namespace_sem);
4850 	lock_ns_list(ns);
4851 	list_for_each_entry(mnt, &ns->list, mnt_list) {
4852 		struct mount *child;
4853 		int mnt_flags;
4854 
4855 		if (mnt_is_cursor(mnt))
4856 			continue;
4857 
4858 		if (mnt->mnt.mnt_sb->s_type != sb->s_type)
4859 			continue;
4860 
4861 		/* This mount is not fully visible if it's root directory
4862 		 * is not the root directory of the filesystem.
4863 		 */
4864 		if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
4865 			continue;
4866 
4867 		/* A local view of the mount flags */
4868 		mnt_flags = mnt->mnt.mnt_flags;
4869 
4870 		/* Don't miss readonly hidden in the superblock flags */
4871 		if (sb_rdonly(mnt->mnt.mnt_sb))
4872 			mnt_flags |= MNT_LOCK_READONLY;
4873 
4874 		/* Verify the mount flags are equal to or more permissive
4875 		 * than the proposed new mount.
4876 		 */
4877 		if ((mnt_flags & MNT_LOCK_READONLY) &&
4878 		    !(new_flags & MNT_READONLY))
4879 			continue;
4880 		if ((mnt_flags & MNT_LOCK_ATIME) &&
4881 		    ((mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK)))
4882 			continue;
4883 
4884 		/* This mount is not fully visible if there are any
4885 		 * locked child mounts that cover anything except for
4886 		 * empty directories.
4887 		 */
4888 		list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
4889 			struct inode *inode = child->mnt_mountpoint->d_inode;
4890 			/* Only worry about locked mounts */
4891 			if (!(child->mnt.mnt_flags & MNT_LOCKED))
4892 				continue;
4893 			/* Is the directory permanetly empty? */
4894 			if (!is_empty_dir_inode(inode))
4895 				goto next;
4896 		}
4897 		/* Preserve the locked attributes */
4898 		*new_mnt_flags |= mnt_flags & (MNT_LOCK_READONLY | \
4899 					       MNT_LOCK_ATIME);
4900 		visible = true;
4901 		goto found;
4902 	next:	;
4903 	}
4904 found:
4905 	unlock_ns_list(ns);
4906 	up_read(&namespace_sem);
4907 	return visible;
4908 }
4909 
mount_too_revealing(const struct super_block * sb,int * new_mnt_flags)4910 static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags)
4911 {
4912 	const unsigned long required_iflags = SB_I_NOEXEC | SB_I_NODEV;
4913 	struct mnt_namespace *ns = current->nsproxy->mnt_ns;
4914 	unsigned long s_iflags;
4915 
4916 	if (ns->user_ns == &init_user_ns)
4917 		return false;
4918 
4919 	/* Can this filesystem be too revealing? */
4920 	s_iflags = sb->s_iflags;
4921 	if (!(s_iflags & SB_I_USERNS_VISIBLE))
4922 		return false;
4923 
4924 	if ((s_iflags & required_iflags) != required_iflags) {
4925 		WARN_ONCE(1, "Expected s_iflags to contain 0x%lx\n",
4926 			  required_iflags);
4927 		return true;
4928 	}
4929 
4930 	return !mnt_already_visible(ns, sb, new_mnt_flags);
4931 }
4932 
mnt_may_suid(struct vfsmount * mnt)4933 bool mnt_may_suid(struct vfsmount *mnt)
4934 {
4935 	/*
4936 	 * Foreign mounts (accessed via fchdir or through /proc
4937 	 * symlinks) are always treated as if they are nosuid.  This
4938 	 * prevents namespaces from trusting potentially unsafe
4939 	 * suid/sgid bits, file caps, or security labels that originate
4940 	 * in other namespaces.
4941 	 */
4942 	return !(mnt->mnt_flags & MNT_NOSUID) && check_mnt(real_mount(mnt)) &&
4943 	       current_in_userns(mnt->mnt_sb->s_user_ns);
4944 }
4945 
mntns_get(struct task_struct * task)4946 static struct ns_common *mntns_get(struct task_struct *task)
4947 {
4948 	struct ns_common *ns = NULL;
4949 	struct nsproxy *nsproxy;
4950 
4951 	task_lock(task);
4952 	nsproxy = task->nsproxy;
4953 	if (nsproxy) {
4954 		ns = &nsproxy->mnt_ns->ns;
4955 		get_mnt_ns(to_mnt_ns(ns));
4956 	}
4957 	task_unlock(task);
4958 
4959 	return ns;
4960 }
4961 
mntns_put(struct ns_common * ns)4962 static void mntns_put(struct ns_common *ns)
4963 {
4964 	put_mnt_ns(to_mnt_ns(ns));
4965 }
4966 
mntns_install(struct nsset * nsset,struct ns_common * ns)4967 static int mntns_install(struct nsset *nsset, struct ns_common *ns)
4968 {
4969 	struct nsproxy *nsproxy = nsset->nsproxy;
4970 	struct fs_struct *fs = nsset->fs;
4971 	struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns;
4972 	struct user_namespace *user_ns = nsset->cred->user_ns;
4973 	struct path root;
4974 	int err;
4975 
4976 	if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
4977 	    !ns_capable(user_ns, CAP_SYS_CHROOT) ||
4978 	    !ns_capable(user_ns, CAP_SYS_ADMIN))
4979 		return -EPERM;
4980 
4981 	if (is_anon_ns(mnt_ns))
4982 		return -EINVAL;
4983 
4984 	if (fs->users != 1)
4985 		return -EINVAL;
4986 
4987 	get_mnt_ns(mnt_ns);
4988 	old_mnt_ns = nsproxy->mnt_ns;
4989 	nsproxy->mnt_ns = mnt_ns;
4990 
4991 	/* Find the root */
4992 	err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt,
4993 				"/", LOOKUP_DOWN, &root);
4994 	if (err) {
4995 		/* revert to old namespace */
4996 		nsproxy->mnt_ns = old_mnt_ns;
4997 		put_mnt_ns(mnt_ns);
4998 		return err;
4999 	}
5000 
5001 	put_mnt_ns(old_mnt_ns);
5002 
5003 	/* Update the pwd and root */
5004 	set_fs_pwd(fs, &root);
5005 	set_fs_root(fs, &root);
5006 
5007 	path_put(&root);
5008 	return 0;
5009 }
5010 
mntns_owner(struct ns_common * ns)5011 static struct user_namespace *mntns_owner(struct ns_common *ns)
5012 {
5013 	return to_mnt_ns(ns)->user_ns;
5014 }
5015 
5016 const struct proc_ns_operations mntns_operations = {
5017 	.name		= "mnt",
5018 	.type		= CLONE_NEWNS,
5019 	.get		= mntns_get,
5020 	.put		= mntns_put,
5021 	.install	= mntns_install,
5022 	.owner		= mntns_owner,
5023 };
5024 
5025 #ifdef CONFIG_SYSCTL
5026 static struct ctl_table fs_namespace_sysctls[] = {
5027 	{
5028 		.procname	= "mount-max",
5029 		.data		= &sysctl_mount_max,
5030 		.maxlen		= sizeof(unsigned int),
5031 		.mode		= 0644,
5032 		.proc_handler	= proc_dointvec_minmax,
5033 		.extra1		= SYSCTL_ONE,
5034 	},
5035 	{ }
5036 };
5037 
init_fs_namespace_sysctls(void)5038 static int __init init_fs_namespace_sysctls(void)
5039 {
5040 	register_sysctl_init("fs", fs_namespace_sysctls);
5041 	return 0;
5042 }
5043 fs_initcall(init_fs_namespace_sysctls);
5044 
5045 #endif /* CONFIG_SYSCTL */
5046