xref: /openbmc/linux/fs/namei.c (revision ef836204)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  *  linux/fs/namei.c
4  *
5  *  Copyright (C) 1991, 1992  Linus Torvalds
6  */
7 
8 /*
9  * Some corrections by tytso.
10  */
11 
12 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
13  * lookup logic.
14  */
15 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
16  */
17 
18 #include <linux/init.h>
19 #include <linux/export.h>
20 #include <linux/kernel.h>
21 #include <linux/slab.h>
22 #include <linux/fs.h>
23 #include <linux/filelock.h>
24 #include <linux/namei.h>
25 #include <linux/pagemap.h>
26 #include <linux/sched/mm.h>
27 #include <linux/fsnotify.h>
28 #include <linux/personality.h>
29 #include <linux/security.h>
30 #include <linux/ima.h>
31 #include <linux/syscalls.h>
32 #include <linux/mount.h>
33 #include <linux/audit.h>
34 #include <linux/capability.h>
35 #include <linux/file.h>
36 #include <linux/fcntl.h>
37 #include <linux/device_cgroup.h>
38 #include <linux/fs_struct.h>
39 #include <linux/posix_acl.h>
40 #include <linux/hash.h>
41 #include <linux/bitops.h>
42 #include <linux/init_task.h>
43 #include <linux/uaccess.h>
44 
45 #include "internal.h"
46 #include "mount.h"
47 
48 /* [Feb-1997 T. Schoebel-Theuer]
49  * Fundamental changes in the pathname lookup mechanisms (namei)
50  * were necessary because of omirr.  The reason is that omirr needs
51  * to know the _real_ pathname, not the user-supplied one, in case
52  * of symlinks (and also when transname replacements occur).
53  *
54  * The new code replaces the old recursive symlink resolution with
55  * an iterative one (in case of non-nested symlink chains).  It does
56  * this with calls to <fs>_follow_link().
57  * As a side effect, dir_namei(), _namei() and follow_link() are now
58  * replaced with a single function lookup_dentry() that can handle all
59  * the special cases of the former code.
60  *
61  * With the new dcache, the pathname is stored at each inode, at least as
62  * long as the refcount of the inode is positive.  As a side effect, the
63  * size of the dcache depends on the inode cache and thus is dynamic.
64  *
65  * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
66  * resolution to correspond with current state of the code.
67  *
68  * Note that the symlink resolution is not *completely* iterative.
69  * There is still a significant amount of tail- and mid- recursion in
70  * the algorithm.  Also, note that <fs>_readlink() is not used in
71  * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
72  * may return different results than <fs>_follow_link().  Many virtual
73  * filesystems (including /proc) exhibit this behavior.
74  */
75 
76 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
77  * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
78  * and the name already exists in form of a symlink, try to create the new
79  * name indicated by the symlink. The old code always complained that the
80  * name already exists, due to not following the symlink even if its target
81  * is nonexistent.  The new semantics affects also mknod() and link() when
82  * the name is a symlink pointing to a non-existent name.
83  *
84  * I don't know which semantics is the right one, since I have no access
85  * to standards. But I found by trial that HP-UX 9.0 has the full "new"
86  * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
87  * "old" one. Personally, I think the new semantics is much more logical.
88  * Note that "ln old new" where "new" is a symlink pointing to a non-existing
89  * file does succeed in both HP-UX and SunOs, but not in Solaris
90  * and in the old Linux semantics.
91  */
92 
93 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
94  * semantics.  See the comments in "open_namei" and "do_link" below.
95  *
96  * [10-Sep-98 Alan Modra] Another symlink change.
97  */
98 
99 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
100  *	inside the path - always follow.
101  *	in the last component in creation/removal/renaming - never follow.
102  *	if LOOKUP_FOLLOW passed - follow.
103  *	if the pathname has trailing slashes - follow.
104  *	otherwise - don't follow.
105  * (applied in that order).
106  *
107  * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
108  * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
109  * During the 2.4 we need to fix the userland stuff depending on it -
110  * hopefully we will be able to get rid of that wart in 2.5. So far only
111  * XEmacs seems to be relying on it...
112  */
113 /*
114  * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
115  * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
116  * any extra contention...
117  */
118 
119 /* In order to reduce some races, while at the same time doing additional
120  * checking and hopefully speeding things up, we copy filenames to the
121  * kernel data space before using them..
122  *
123  * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
124  * PATH_MAX includes the nul terminator --RR.
125  */
126 
127 #define EMBEDDED_NAME_MAX	(PATH_MAX - offsetof(struct filename, iname))
128 
129 struct filename *
getname_flags(const char __user * filename,int flags,int * empty)130 getname_flags(const char __user *filename, int flags, int *empty)
131 {
132 	struct filename *result;
133 	char *kname;
134 	int len;
135 
136 	result = audit_reusename(filename);
137 	if (result)
138 		return result;
139 
140 	result = __getname();
141 	if (unlikely(!result))
142 		return ERR_PTR(-ENOMEM);
143 
144 	/*
145 	 * First, try to embed the struct filename inside the names_cache
146 	 * allocation
147 	 */
148 	kname = (char *)result->iname;
149 	result->name = kname;
150 
151 	len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
152 	if (unlikely(len < 0)) {
153 		__putname(result);
154 		return ERR_PTR(len);
155 	}
156 
157 	/*
158 	 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
159 	 * separate struct filename so we can dedicate the entire
160 	 * names_cache allocation for the pathname, and re-do the copy from
161 	 * userland.
162 	 */
163 	if (unlikely(len == EMBEDDED_NAME_MAX)) {
164 		const size_t size = offsetof(struct filename, iname[1]);
165 		kname = (char *)result;
166 
167 		/*
168 		 * size is chosen that way we to guarantee that
169 		 * result->iname[0] is within the same object and that
170 		 * kname can't be equal to result->iname, no matter what.
171 		 */
172 		result = kzalloc(size, GFP_KERNEL);
173 		if (unlikely(!result)) {
174 			__putname(kname);
175 			return ERR_PTR(-ENOMEM);
176 		}
177 		result->name = kname;
178 		len = strncpy_from_user(kname, filename, PATH_MAX);
179 		if (unlikely(len < 0)) {
180 			__putname(kname);
181 			kfree(result);
182 			return ERR_PTR(len);
183 		}
184 		if (unlikely(len == PATH_MAX)) {
185 			__putname(kname);
186 			kfree(result);
187 			return ERR_PTR(-ENAMETOOLONG);
188 		}
189 	}
190 
191 	atomic_set(&result->refcnt, 1);
192 	/* The empty path is special. */
193 	if (unlikely(!len)) {
194 		if (empty)
195 			*empty = 1;
196 		if (!(flags & LOOKUP_EMPTY)) {
197 			putname(result);
198 			return ERR_PTR(-ENOENT);
199 		}
200 	}
201 
202 	result->uptr = filename;
203 	result->aname = NULL;
204 	audit_getname(result);
205 	return result;
206 }
207 
208 struct filename *
getname_uflags(const char __user * filename,int uflags)209 getname_uflags(const char __user *filename, int uflags)
210 {
211 	int flags = (uflags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0;
212 
213 	return getname_flags(filename, flags, NULL);
214 }
215 
216 struct filename *
getname(const char __user * filename)217 getname(const char __user * filename)
218 {
219 	return getname_flags(filename, 0, NULL);
220 }
221 
222 struct filename *
getname_kernel(const char * filename)223 getname_kernel(const char * filename)
224 {
225 	struct filename *result;
226 	int len = strlen(filename) + 1;
227 
228 	result = __getname();
229 	if (unlikely(!result))
230 		return ERR_PTR(-ENOMEM);
231 
232 	if (len <= EMBEDDED_NAME_MAX) {
233 		result->name = (char *)result->iname;
234 	} else if (len <= PATH_MAX) {
235 		const size_t size = offsetof(struct filename, iname[1]);
236 		struct filename *tmp;
237 
238 		tmp = kmalloc(size, GFP_KERNEL);
239 		if (unlikely(!tmp)) {
240 			__putname(result);
241 			return ERR_PTR(-ENOMEM);
242 		}
243 		tmp->name = (char *)result;
244 		result = tmp;
245 	} else {
246 		__putname(result);
247 		return ERR_PTR(-ENAMETOOLONG);
248 	}
249 	memcpy((char *)result->name, filename, len);
250 	result->uptr = NULL;
251 	result->aname = NULL;
252 	atomic_set(&result->refcnt, 1);
253 	audit_getname(result);
254 
255 	return result;
256 }
257 EXPORT_SYMBOL(getname_kernel);
258 
putname(struct filename * name)259 void putname(struct filename *name)
260 {
261 	if (IS_ERR(name))
262 		return;
263 
264 	if (WARN_ON_ONCE(!atomic_read(&name->refcnt)))
265 		return;
266 
267 	if (!atomic_dec_and_test(&name->refcnt))
268 		return;
269 
270 	if (name->name != name->iname) {
271 		__putname(name->name);
272 		kfree(name);
273 	} else
274 		__putname(name);
275 }
276 EXPORT_SYMBOL(putname);
277 
278 /**
279  * check_acl - perform ACL permission checking
280  * @idmap:	idmap of the mount the inode was found from
281  * @inode:	inode to check permissions on
282  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...)
283  *
284  * This function performs the ACL permission checking. Since this function
285  * retrieve POSIX acls it needs to know whether it is called from a blocking or
286  * non-blocking context and thus cares about the MAY_NOT_BLOCK bit.
287  *
288  * If the inode has been found through an idmapped mount the idmap of
289  * the vfsmount must be passed through @idmap. This function will then take
290  * care to map the inode according to @idmap before checking permissions.
291  * On non-idmapped mounts or if permission checking is to be performed on the
292  * raw inode simply passs @nop_mnt_idmap.
293  */
check_acl(struct mnt_idmap * idmap,struct inode * inode,int mask)294 static int check_acl(struct mnt_idmap *idmap,
295 		     struct inode *inode, int mask)
296 {
297 #ifdef CONFIG_FS_POSIX_ACL
298 	struct posix_acl *acl;
299 
300 	if (mask & MAY_NOT_BLOCK) {
301 		acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
302 	        if (!acl)
303 	                return -EAGAIN;
304 		/* no ->get_inode_acl() calls in RCU mode... */
305 		if (is_uncached_acl(acl))
306 			return -ECHILD;
307 	        return posix_acl_permission(idmap, inode, acl, mask);
308 	}
309 
310 	acl = get_inode_acl(inode, ACL_TYPE_ACCESS);
311 	if (IS_ERR(acl))
312 		return PTR_ERR(acl);
313 	if (acl) {
314 	        int error = posix_acl_permission(idmap, inode, acl, mask);
315 	        posix_acl_release(acl);
316 	        return error;
317 	}
318 #endif
319 
320 	return -EAGAIN;
321 }
322 
323 /**
324  * acl_permission_check - perform basic UNIX permission checking
325  * @idmap:	idmap of the mount the inode was found from
326  * @inode:	inode to check permissions on
327  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...)
328  *
329  * This function performs the basic UNIX permission checking. Since this
330  * function may retrieve POSIX acls it needs to know whether it is called from a
331  * blocking or non-blocking context and thus cares about the MAY_NOT_BLOCK bit.
332  *
333  * If the inode has been found through an idmapped mount the idmap of
334  * the vfsmount must be passed through @idmap. This function will then take
335  * care to map the inode according to @idmap before checking permissions.
336  * On non-idmapped mounts or if permission checking is to be performed on the
337  * raw inode simply passs @nop_mnt_idmap.
338  */
acl_permission_check(struct mnt_idmap * idmap,struct inode * inode,int mask)339 static int acl_permission_check(struct mnt_idmap *idmap,
340 				struct inode *inode, int mask)
341 {
342 	unsigned int mode = inode->i_mode;
343 	vfsuid_t vfsuid;
344 
345 	/* Are we the owner? If so, ACL's don't matter */
346 	vfsuid = i_uid_into_vfsuid(idmap, inode);
347 	if (likely(vfsuid_eq_kuid(vfsuid, current_fsuid()))) {
348 		mask &= 7;
349 		mode >>= 6;
350 		return (mask & ~mode) ? -EACCES : 0;
351 	}
352 
353 	/* Do we have ACL's? */
354 	if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
355 		int error = check_acl(idmap, inode, mask);
356 		if (error != -EAGAIN)
357 			return error;
358 	}
359 
360 	/* Only RWX matters for group/other mode bits */
361 	mask &= 7;
362 
363 	/*
364 	 * Are the group permissions different from
365 	 * the other permissions in the bits we care
366 	 * about? Need to check group ownership if so.
367 	 */
368 	if (mask & (mode ^ (mode >> 3))) {
369 		vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode);
370 		if (vfsgid_in_group_p(vfsgid))
371 			mode >>= 3;
372 	}
373 
374 	/* Bits in 'mode' clear that we require? */
375 	return (mask & ~mode) ? -EACCES : 0;
376 }
377 
378 /**
379  * generic_permission -  check for access rights on a Posix-like filesystem
380  * @idmap:	idmap of the mount the inode was found from
381  * @inode:	inode to check access rights for
382  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC,
383  *		%MAY_NOT_BLOCK ...)
384  *
385  * Used to check for read/write/execute permissions on a file.
386  * We use "fsuid" for this, letting us set arbitrary permissions
387  * for filesystem access without changing the "normal" uids which
388  * are used for other things.
389  *
390  * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
391  * request cannot be satisfied (eg. requires blocking or too much complexity).
392  * It would then be called again in ref-walk mode.
393  *
394  * If the inode has been found through an idmapped mount the idmap of
395  * the vfsmount must be passed through @idmap. This function will then take
396  * care to map the inode according to @idmap before checking permissions.
397  * On non-idmapped mounts or if permission checking is to be performed on the
398  * raw inode simply passs @nop_mnt_idmap.
399  */
generic_permission(struct mnt_idmap * idmap,struct inode * inode,int mask)400 int generic_permission(struct mnt_idmap *idmap, struct inode *inode,
401 		       int mask)
402 {
403 	int ret;
404 
405 	/*
406 	 * Do the basic permission checks.
407 	 */
408 	ret = acl_permission_check(idmap, inode, mask);
409 	if (ret != -EACCES)
410 		return ret;
411 
412 	if (S_ISDIR(inode->i_mode)) {
413 		/* DACs are overridable for directories */
414 		if (!(mask & MAY_WRITE))
415 			if (capable_wrt_inode_uidgid(idmap, inode,
416 						     CAP_DAC_READ_SEARCH))
417 				return 0;
418 		if (capable_wrt_inode_uidgid(idmap, inode,
419 					     CAP_DAC_OVERRIDE))
420 			return 0;
421 		return -EACCES;
422 	}
423 
424 	/*
425 	 * Searching includes executable on directories, else just read.
426 	 */
427 	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
428 	if (mask == MAY_READ)
429 		if (capable_wrt_inode_uidgid(idmap, inode,
430 					     CAP_DAC_READ_SEARCH))
431 			return 0;
432 	/*
433 	 * Read/write DACs are always overridable.
434 	 * Executable DACs are overridable when there is
435 	 * at least one exec bit set.
436 	 */
437 	if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
438 		if (capable_wrt_inode_uidgid(idmap, inode,
439 					     CAP_DAC_OVERRIDE))
440 			return 0;
441 
442 	return -EACCES;
443 }
444 EXPORT_SYMBOL(generic_permission);
445 
446 /**
447  * do_inode_permission - UNIX permission checking
448  * @idmap:	idmap of the mount the inode was found from
449  * @inode:	inode to check permissions on
450  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...)
451  *
452  * We _really_ want to just do "generic_permission()" without
453  * even looking at the inode->i_op values. So we keep a cache
454  * flag in inode->i_opflags, that says "this has not special
455  * permission function, use the fast case".
456  */
do_inode_permission(struct mnt_idmap * idmap,struct inode * inode,int mask)457 static inline int do_inode_permission(struct mnt_idmap *idmap,
458 				      struct inode *inode, int mask)
459 {
460 	if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
461 		if (likely(inode->i_op->permission))
462 			return inode->i_op->permission(idmap, inode, mask);
463 
464 		/* This gets set once for the inode lifetime */
465 		spin_lock(&inode->i_lock);
466 		inode->i_opflags |= IOP_FASTPERM;
467 		spin_unlock(&inode->i_lock);
468 	}
469 	return generic_permission(idmap, inode, mask);
470 }
471 
472 /**
473  * sb_permission - Check superblock-level permissions
474  * @sb: Superblock of inode to check permission on
475  * @inode: Inode to check permission on
476  * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
477  *
478  * Separate out file-system wide checks from inode-specific permission checks.
479  */
sb_permission(struct super_block * sb,struct inode * inode,int mask)480 static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
481 {
482 	if (unlikely(mask & MAY_WRITE)) {
483 		umode_t mode = inode->i_mode;
484 
485 		/* Nobody gets write access to a read-only fs. */
486 		if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
487 			return -EROFS;
488 	}
489 	return 0;
490 }
491 
492 /**
493  * inode_permission - Check for access rights to a given inode
494  * @idmap:	idmap of the mount the inode was found from
495  * @inode:	Inode to check permission on
496  * @mask:	Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
497  *
498  * Check for read/write/execute permissions on an inode.  We use fs[ug]id for
499  * this, letting us set arbitrary permissions for filesystem access without
500  * changing the "normal" UIDs which are used for other things.
501  *
502  * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
503  */
inode_permission(struct mnt_idmap * idmap,struct inode * inode,int mask)504 int inode_permission(struct mnt_idmap *idmap,
505 		     struct inode *inode, int mask)
506 {
507 	int retval;
508 
509 	retval = sb_permission(inode->i_sb, inode, mask);
510 	if (retval)
511 		return retval;
512 
513 	if (unlikely(mask & MAY_WRITE)) {
514 		/*
515 		 * Nobody gets write access to an immutable file.
516 		 */
517 		if (IS_IMMUTABLE(inode))
518 			return -EPERM;
519 
520 		/*
521 		 * Updating mtime will likely cause i_uid and i_gid to be
522 		 * written back improperly if their true value is unknown
523 		 * to the vfs.
524 		 */
525 		if (HAS_UNMAPPED_ID(idmap, inode))
526 			return -EACCES;
527 	}
528 
529 	retval = do_inode_permission(idmap, inode, mask);
530 	if (retval)
531 		return retval;
532 
533 	retval = devcgroup_inode_permission(inode, mask);
534 	if (retval)
535 		return retval;
536 
537 	return security_inode_permission(inode, mask);
538 }
539 EXPORT_SYMBOL(inode_permission);
540 
541 /**
542  * path_get - get a reference to a path
543  * @path: path to get the reference to
544  *
545  * Given a path increment the reference count to the dentry and the vfsmount.
546  */
path_get(const struct path * path)547 void path_get(const struct path *path)
548 {
549 	mntget(path->mnt);
550 	dget(path->dentry);
551 }
552 EXPORT_SYMBOL(path_get);
553 
554 /**
555  * path_put - put a reference to a path
556  * @path: path to put the reference to
557  *
558  * Given a path decrement the reference count to the dentry and the vfsmount.
559  */
path_put(const struct path * path)560 void path_put(const struct path *path)
561 {
562 	dput(path->dentry);
563 	mntput(path->mnt);
564 }
565 EXPORT_SYMBOL(path_put);
566 
567 #define EMBEDDED_LEVELS 2
568 struct nameidata {
569 	struct path	path;
570 	struct qstr	last;
571 	struct path	root;
572 	struct inode	*inode; /* path.dentry.d_inode */
573 	unsigned int	flags, state;
574 	unsigned	seq, next_seq, m_seq, r_seq;
575 	int		last_type;
576 	unsigned	depth;
577 	int		total_link_count;
578 	struct saved {
579 		struct path link;
580 		struct delayed_call done;
581 		const char *name;
582 		unsigned seq;
583 	} *stack, internal[EMBEDDED_LEVELS];
584 	struct filename	*name;
585 	struct nameidata *saved;
586 	unsigned	root_seq;
587 	int		dfd;
588 	vfsuid_t	dir_vfsuid;
589 	umode_t		dir_mode;
590 } __randomize_layout;
591 
592 #define ND_ROOT_PRESET 1
593 #define ND_ROOT_GRABBED 2
594 #define ND_JUMPED 4
595 
__set_nameidata(struct nameidata * p,int dfd,struct filename * name)596 static void __set_nameidata(struct nameidata *p, int dfd, struct filename *name)
597 {
598 	struct nameidata *old = current->nameidata;
599 	p->stack = p->internal;
600 	p->depth = 0;
601 	p->dfd = dfd;
602 	p->name = name;
603 	p->path.mnt = NULL;
604 	p->path.dentry = NULL;
605 	p->total_link_count = old ? old->total_link_count : 0;
606 	p->saved = old;
607 	current->nameidata = p;
608 }
609 
set_nameidata(struct nameidata * p,int dfd,struct filename * name,const struct path * root)610 static inline void set_nameidata(struct nameidata *p, int dfd, struct filename *name,
611 			  const struct path *root)
612 {
613 	__set_nameidata(p, dfd, name);
614 	p->state = 0;
615 	if (unlikely(root)) {
616 		p->state = ND_ROOT_PRESET;
617 		p->root = *root;
618 	}
619 }
620 
restore_nameidata(void)621 static void restore_nameidata(void)
622 {
623 	struct nameidata *now = current->nameidata, *old = now->saved;
624 
625 	current->nameidata = old;
626 	if (old)
627 		old->total_link_count = now->total_link_count;
628 	if (now->stack != now->internal)
629 		kfree(now->stack);
630 }
631 
nd_alloc_stack(struct nameidata * nd)632 static bool nd_alloc_stack(struct nameidata *nd)
633 {
634 	struct saved *p;
635 
636 	p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
637 			 nd->flags & LOOKUP_RCU ? GFP_ATOMIC : GFP_KERNEL);
638 	if (unlikely(!p))
639 		return false;
640 	memcpy(p, nd->internal, sizeof(nd->internal));
641 	nd->stack = p;
642 	return true;
643 }
644 
645 /**
646  * path_connected - Verify that a dentry is below mnt.mnt_root
647  * @mnt: The mountpoint to check.
648  * @dentry: The dentry to check.
649  *
650  * Rename can sometimes move a file or directory outside of a bind
651  * mount, path_connected allows those cases to be detected.
652  */
path_connected(struct vfsmount * mnt,struct dentry * dentry)653 static bool path_connected(struct vfsmount *mnt, struct dentry *dentry)
654 {
655 	struct super_block *sb = mnt->mnt_sb;
656 
657 	/* Bind mounts can have disconnected paths */
658 	if (mnt->mnt_root == sb->s_root)
659 		return true;
660 
661 	return is_subdir(dentry, mnt->mnt_root);
662 }
663 
drop_links(struct nameidata * nd)664 static void drop_links(struct nameidata *nd)
665 {
666 	int i = nd->depth;
667 	while (i--) {
668 		struct saved *last = nd->stack + i;
669 		do_delayed_call(&last->done);
670 		clear_delayed_call(&last->done);
671 	}
672 }
673 
leave_rcu(struct nameidata * nd)674 static void leave_rcu(struct nameidata *nd)
675 {
676 	nd->flags &= ~LOOKUP_RCU;
677 	nd->seq = nd->next_seq = 0;
678 	rcu_read_unlock();
679 }
680 
terminate_walk(struct nameidata * nd)681 static void terminate_walk(struct nameidata *nd)
682 {
683 	drop_links(nd);
684 	if (!(nd->flags & LOOKUP_RCU)) {
685 		int i;
686 		path_put(&nd->path);
687 		for (i = 0; i < nd->depth; i++)
688 			path_put(&nd->stack[i].link);
689 		if (nd->state & ND_ROOT_GRABBED) {
690 			path_put(&nd->root);
691 			nd->state &= ~ND_ROOT_GRABBED;
692 		}
693 	} else {
694 		leave_rcu(nd);
695 	}
696 	nd->depth = 0;
697 	nd->path.mnt = NULL;
698 	nd->path.dentry = NULL;
699 }
700 
701 /* path_put is needed afterwards regardless of success or failure */
__legitimize_path(struct path * path,unsigned seq,unsigned mseq)702 static bool __legitimize_path(struct path *path, unsigned seq, unsigned mseq)
703 {
704 	int res = __legitimize_mnt(path->mnt, mseq);
705 	if (unlikely(res)) {
706 		if (res > 0)
707 			path->mnt = NULL;
708 		path->dentry = NULL;
709 		return false;
710 	}
711 	if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
712 		path->dentry = NULL;
713 		return false;
714 	}
715 	return !read_seqcount_retry(&path->dentry->d_seq, seq);
716 }
717 
legitimize_path(struct nameidata * nd,struct path * path,unsigned seq)718 static inline bool legitimize_path(struct nameidata *nd,
719 			    struct path *path, unsigned seq)
720 {
721 	return __legitimize_path(path, seq, nd->m_seq);
722 }
723 
legitimize_links(struct nameidata * nd)724 static bool legitimize_links(struct nameidata *nd)
725 {
726 	int i;
727 	if (unlikely(nd->flags & LOOKUP_CACHED)) {
728 		drop_links(nd);
729 		nd->depth = 0;
730 		return false;
731 	}
732 	for (i = 0; i < nd->depth; i++) {
733 		struct saved *last = nd->stack + i;
734 		if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
735 			drop_links(nd);
736 			nd->depth = i + 1;
737 			return false;
738 		}
739 	}
740 	return true;
741 }
742 
legitimize_root(struct nameidata * nd)743 static bool legitimize_root(struct nameidata *nd)
744 {
745 	/* Nothing to do if nd->root is zero or is managed by the VFS user. */
746 	if (!nd->root.mnt || (nd->state & ND_ROOT_PRESET))
747 		return true;
748 	nd->state |= ND_ROOT_GRABBED;
749 	return legitimize_path(nd, &nd->root, nd->root_seq);
750 }
751 
752 /*
753  * Path walking has 2 modes, rcu-walk and ref-walk (see
754  * Documentation/filesystems/path-lookup.txt).  In situations when we can't
755  * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
756  * normal reference counts on dentries and vfsmounts to transition to ref-walk
757  * mode.  Refcounts are grabbed at the last known good point before rcu-walk
758  * got stuck, so ref-walk may continue from there. If this is not successful
759  * (eg. a seqcount has changed), then failure is returned and it's up to caller
760  * to restart the path walk from the beginning in ref-walk mode.
761  */
762 
763 /**
764  * try_to_unlazy - try to switch to ref-walk mode.
765  * @nd: nameidata pathwalk data
766  * Returns: true on success, false on failure
767  *
768  * try_to_unlazy attempts to legitimize the current nd->path and nd->root
769  * for ref-walk mode.
770  * Must be called from rcu-walk context.
771  * Nothing should touch nameidata between try_to_unlazy() failure and
772  * terminate_walk().
773  */
try_to_unlazy(struct nameidata * nd)774 static bool try_to_unlazy(struct nameidata *nd)
775 {
776 	struct dentry *parent = nd->path.dentry;
777 
778 	BUG_ON(!(nd->flags & LOOKUP_RCU));
779 
780 	if (unlikely(!legitimize_links(nd)))
781 		goto out1;
782 	if (unlikely(!legitimize_path(nd, &nd->path, nd->seq)))
783 		goto out;
784 	if (unlikely(!legitimize_root(nd)))
785 		goto out;
786 	leave_rcu(nd);
787 	BUG_ON(nd->inode != parent->d_inode);
788 	return true;
789 
790 out1:
791 	nd->path.mnt = NULL;
792 	nd->path.dentry = NULL;
793 out:
794 	leave_rcu(nd);
795 	return false;
796 }
797 
798 /**
799  * try_to_unlazy_next - try to switch to ref-walk mode.
800  * @nd: nameidata pathwalk data
801  * @dentry: next dentry to step into
802  * Returns: true on success, false on failure
803  *
804  * Similar to try_to_unlazy(), but here we have the next dentry already
805  * picked by rcu-walk and want to legitimize that in addition to the current
806  * nd->path and nd->root for ref-walk mode.  Must be called from rcu-walk context.
807  * Nothing should touch nameidata between try_to_unlazy_next() failure and
808  * terminate_walk().
809  */
try_to_unlazy_next(struct nameidata * nd,struct dentry * dentry)810 static bool try_to_unlazy_next(struct nameidata *nd, struct dentry *dentry)
811 {
812 	int res;
813 	BUG_ON(!(nd->flags & LOOKUP_RCU));
814 
815 	if (unlikely(!legitimize_links(nd)))
816 		goto out2;
817 	res = __legitimize_mnt(nd->path.mnt, nd->m_seq);
818 	if (unlikely(res)) {
819 		if (res > 0)
820 			goto out2;
821 		goto out1;
822 	}
823 	if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref)))
824 		goto out1;
825 
826 	/*
827 	 * We need to move both the parent and the dentry from the RCU domain
828 	 * to be properly refcounted. And the sequence number in the dentry
829 	 * validates *both* dentry counters, since we checked the sequence
830 	 * number of the parent after we got the child sequence number. So we
831 	 * know the parent must still be valid if the child sequence number is
832 	 */
833 	if (unlikely(!lockref_get_not_dead(&dentry->d_lockref)))
834 		goto out;
835 	if (read_seqcount_retry(&dentry->d_seq, nd->next_seq))
836 		goto out_dput;
837 	/*
838 	 * Sequence counts matched. Now make sure that the root is
839 	 * still valid and get it if required.
840 	 */
841 	if (unlikely(!legitimize_root(nd)))
842 		goto out_dput;
843 	leave_rcu(nd);
844 	return true;
845 
846 out2:
847 	nd->path.mnt = NULL;
848 out1:
849 	nd->path.dentry = NULL;
850 out:
851 	leave_rcu(nd);
852 	return false;
853 out_dput:
854 	leave_rcu(nd);
855 	dput(dentry);
856 	return false;
857 }
858 
d_revalidate(struct dentry * dentry,unsigned int flags)859 static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
860 {
861 	if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
862 		return dentry->d_op->d_revalidate(dentry, flags);
863 	else
864 		return 1;
865 }
866 
867 /**
868  * complete_walk - successful completion of path walk
869  * @nd:  pointer nameidata
870  *
871  * If we had been in RCU mode, drop out of it and legitimize nd->path.
872  * Revalidate the final result, unless we'd already done that during
873  * the path walk or the filesystem doesn't ask for it.  Return 0 on
874  * success, -error on failure.  In case of failure caller does not
875  * need to drop nd->path.
876  */
complete_walk(struct nameidata * nd)877 static int complete_walk(struct nameidata *nd)
878 {
879 	struct dentry *dentry = nd->path.dentry;
880 	int status;
881 
882 	if (nd->flags & LOOKUP_RCU) {
883 		/*
884 		 * We don't want to zero nd->root for scoped-lookups or
885 		 * externally-managed nd->root.
886 		 */
887 		if (!(nd->state & ND_ROOT_PRESET))
888 			if (!(nd->flags & LOOKUP_IS_SCOPED))
889 				nd->root.mnt = NULL;
890 		nd->flags &= ~LOOKUP_CACHED;
891 		if (!try_to_unlazy(nd))
892 			return -ECHILD;
893 	}
894 
895 	if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
896 		/*
897 		 * While the guarantee of LOOKUP_IS_SCOPED is (roughly) "don't
898 		 * ever step outside the root during lookup" and should already
899 		 * be guaranteed by the rest of namei, we want to avoid a namei
900 		 * BUG resulting in userspace being given a path that was not
901 		 * scoped within the root at some point during the lookup.
902 		 *
903 		 * So, do a final sanity-check to make sure that in the
904 		 * worst-case scenario (a complete bypass of LOOKUP_IS_SCOPED)
905 		 * we won't silently return an fd completely outside of the
906 		 * requested root to userspace.
907 		 *
908 		 * Userspace could move the path outside the root after this
909 		 * check, but as discussed elsewhere this is not a concern (the
910 		 * resolved file was inside the root at some point).
911 		 */
912 		if (!path_is_under(&nd->path, &nd->root))
913 			return -EXDEV;
914 	}
915 
916 	if (likely(!(nd->state & ND_JUMPED)))
917 		return 0;
918 
919 	if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
920 		return 0;
921 
922 	status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
923 	if (status > 0)
924 		return 0;
925 
926 	if (!status)
927 		status = -ESTALE;
928 
929 	return status;
930 }
931 
set_root(struct nameidata * nd)932 static int set_root(struct nameidata *nd)
933 {
934 	struct fs_struct *fs = current->fs;
935 
936 	/*
937 	 * Jumping to the real root in a scoped-lookup is a BUG in namei, but we
938 	 * still have to ensure it doesn't happen because it will cause a breakout
939 	 * from the dirfd.
940 	 */
941 	if (WARN_ON(nd->flags & LOOKUP_IS_SCOPED))
942 		return -ENOTRECOVERABLE;
943 
944 	if (nd->flags & LOOKUP_RCU) {
945 		unsigned seq;
946 
947 		do {
948 			seq = read_seqcount_begin(&fs->seq);
949 			nd->root = fs->root;
950 			nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
951 		} while (read_seqcount_retry(&fs->seq, seq));
952 	} else {
953 		get_fs_root(fs, &nd->root);
954 		nd->state |= ND_ROOT_GRABBED;
955 	}
956 	return 0;
957 }
958 
nd_jump_root(struct nameidata * nd)959 static int nd_jump_root(struct nameidata *nd)
960 {
961 	if (unlikely(nd->flags & LOOKUP_BENEATH))
962 		return -EXDEV;
963 	if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
964 		/* Absolute path arguments to path_init() are allowed. */
965 		if (nd->path.mnt != NULL && nd->path.mnt != nd->root.mnt)
966 			return -EXDEV;
967 	}
968 	if (!nd->root.mnt) {
969 		int error = set_root(nd);
970 		if (error)
971 			return error;
972 	}
973 	if (nd->flags & LOOKUP_RCU) {
974 		struct dentry *d;
975 		nd->path = nd->root;
976 		d = nd->path.dentry;
977 		nd->inode = d->d_inode;
978 		nd->seq = nd->root_seq;
979 		if (read_seqcount_retry(&d->d_seq, nd->seq))
980 			return -ECHILD;
981 	} else {
982 		path_put(&nd->path);
983 		nd->path = nd->root;
984 		path_get(&nd->path);
985 		nd->inode = nd->path.dentry->d_inode;
986 	}
987 	nd->state |= ND_JUMPED;
988 	return 0;
989 }
990 
991 /*
992  * Helper to directly jump to a known parsed path from ->get_link,
993  * caller must have taken a reference to path beforehand.
994  */
nd_jump_link(const struct path * path)995 int nd_jump_link(const struct path *path)
996 {
997 	int error = -ELOOP;
998 	struct nameidata *nd = current->nameidata;
999 
1000 	if (unlikely(nd->flags & LOOKUP_NO_MAGICLINKS))
1001 		goto err;
1002 
1003 	error = -EXDEV;
1004 	if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
1005 		if (nd->path.mnt != path->mnt)
1006 			goto err;
1007 	}
1008 	/* Not currently safe for scoped-lookups. */
1009 	if (unlikely(nd->flags & LOOKUP_IS_SCOPED))
1010 		goto err;
1011 
1012 	path_put(&nd->path);
1013 	nd->path = *path;
1014 	nd->inode = nd->path.dentry->d_inode;
1015 	nd->state |= ND_JUMPED;
1016 	return 0;
1017 
1018 err:
1019 	path_put(path);
1020 	return error;
1021 }
1022 
put_link(struct nameidata * nd)1023 static inline void put_link(struct nameidata *nd)
1024 {
1025 	struct saved *last = nd->stack + --nd->depth;
1026 	do_delayed_call(&last->done);
1027 	if (!(nd->flags & LOOKUP_RCU))
1028 		path_put(&last->link);
1029 }
1030 
1031 static int sysctl_protected_symlinks __read_mostly;
1032 static int sysctl_protected_hardlinks __read_mostly;
1033 static int sysctl_protected_fifos __read_mostly;
1034 static int sysctl_protected_regular __read_mostly;
1035 
1036 #ifdef CONFIG_SYSCTL
1037 static struct ctl_table namei_sysctls[] = {
1038 	{
1039 		.procname	= "protected_symlinks",
1040 		.data		= &sysctl_protected_symlinks,
1041 		.maxlen		= sizeof(int),
1042 		.mode		= 0644,
1043 		.proc_handler	= proc_dointvec_minmax,
1044 		.extra1		= SYSCTL_ZERO,
1045 		.extra2		= SYSCTL_ONE,
1046 	},
1047 	{
1048 		.procname	= "protected_hardlinks",
1049 		.data		= &sysctl_protected_hardlinks,
1050 		.maxlen		= sizeof(int),
1051 		.mode		= 0644,
1052 		.proc_handler	= proc_dointvec_minmax,
1053 		.extra1		= SYSCTL_ZERO,
1054 		.extra2		= SYSCTL_ONE,
1055 	},
1056 	{
1057 		.procname	= "protected_fifos",
1058 		.data		= &sysctl_protected_fifos,
1059 		.maxlen		= sizeof(int),
1060 		.mode		= 0644,
1061 		.proc_handler	= proc_dointvec_minmax,
1062 		.extra1		= SYSCTL_ZERO,
1063 		.extra2		= SYSCTL_TWO,
1064 	},
1065 	{
1066 		.procname	= "protected_regular",
1067 		.data		= &sysctl_protected_regular,
1068 		.maxlen		= sizeof(int),
1069 		.mode		= 0644,
1070 		.proc_handler	= proc_dointvec_minmax,
1071 		.extra1		= SYSCTL_ZERO,
1072 		.extra2		= SYSCTL_TWO,
1073 	},
1074 	{ }
1075 };
1076 
init_fs_namei_sysctls(void)1077 static int __init init_fs_namei_sysctls(void)
1078 {
1079 	register_sysctl_init("fs", namei_sysctls);
1080 	return 0;
1081 }
1082 fs_initcall(init_fs_namei_sysctls);
1083 
1084 #endif /* CONFIG_SYSCTL */
1085 
1086 /**
1087  * may_follow_link - Check symlink following for unsafe situations
1088  * @nd: nameidata pathwalk data
1089  * @inode: Used for idmapping.
1090  *
1091  * In the case of the sysctl_protected_symlinks sysctl being enabled,
1092  * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
1093  * in a sticky world-writable directory. This is to protect privileged
1094  * processes from failing races against path names that may change out
1095  * from under them by way of other users creating malicious symlinks.
1096  * It will permit symlinks to be followed only when outside a sticky
1097  * world-writable directory, or when the uid of the symlink and follower
1098  * match, or when the directory owner matches the symlink's owner.
1099  *
1100  * Returns 0 if following the symlink is allowed, -ve on error.
1101  */
may_follow_link(struct nameidata * nd,const struct inode * inode)1102 static inline int may_follow_link(struct nameidata *nd, const struct inode *inode)
1103 {
1104 	struct mnt_idmap *idmap;
1105 	vfsuid_t vfsuid;
1106 
1107 	if (!sysctl_protected_symlinks)
1108 		return 0;
1109 
1110 	idmap = mnt_idmap(nd->path.mnt);
1111 	vfsuid = i_uid_into_vfsuid(idmap, inode);
1112 	/* Allowed if owner and follower match. */
1113 	if (vfsuid_eq_kuid(vfsuid, current_fsuid()))
1114 		return 0;
1115 
1116 	/* Allowed if parent directory not sticky and world-writable. */
1117 	if ((nd->dir_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
1118 		return 0;
1119 
1120 	/* Allowed if parent directory and link owner match. */
1121 	if (vfsuid_valid(nd->dir_vfsuid) && vfsuid_eq(nd->dir_vfsuid, vfsuid))
1122 		return 0;
1123 
1124 	if (nd->flags & LOOKUP_RCU)
1125 		return -ECHILD;
1126 
1127 	audit_inode(nd->name, nd->stack[0].link.dentry, 0);
1128 	audit_log_path_denied(AUDIT_ANOM_LINK, "follow_link");
1129 	return -EACCES;
1130 }
1131 
1132 /**
1133  * safe_hardlink_source - Check for safe hardlink conditions
1134  * @idmap: idmap of the mount the inode was found from
1135  * @inode: the source inode to hardlink from
1136  *
1137  * Return false if at least one of the following conditions:
1138  *    - inode is not a regular file
1139  *    - inode is setuid
1140  *    - inode is setgid and group-exec
1141  *    - access failure for read and write
1142  *
1143  * Otherwise returns true.
1144  */
safe_hardlink_source(struct mnt_idmap * idmap,struct inode * inode)1145 static bool safe_hardlink_source(struct mnt_idmap *idmap,
1146 				 struct inode *inode)
1147 {
1148 	umode_t mode = inode->i_mode;
1149 
1150 	/* Special files should not get pinned to the filesystem. */
1151 	if (!S_ISREG(mode))
1152 		return false;
1153 
1154 	/* Setuid files should not get pinned to the filesystem. */
1155 	if (mode & S_ISUID)
1156 		return false;
1157 
1158 	/* Executable setgid files should not get pinned to the filesystem. */
1159 	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
1160 		return false;
1161 
1162 	/* Hardlinking to unreadable or unwritable sources is dangerous. */
1163 	if (inode_permission(idmap, inode, MAY_READ | MAY_WRITE))
1164 		return false;
1165 
1166 	return true;
1167 }
1168 
1169 /**
1170  * may_linkat - Check permissions for creating a hardlink
1171  * @idmap: idmap of the mount the inode was found from
1172  * @link:  the source to hardlink from
1173  *
1174  * Block hardlink when all of:
1175  *  - sysctl_protected_hardlinks enabled
1176  *  - fsuid does not match inode
1177  *  - hardlink source is unsafe (see safe_hardlink_source() above)
1178  *  - not CAP_FOWNER in a namespace with the inode owner uid mapped
1179  *
1180  * If the inode has been found through an idmapped mount the idmap of
1181  * the vfsmount must be passed through @idmap. This function will then take
1182  * care to map the inode according to @idmap before checking permissions.
1183  * On non-idmapped mounts or if permission checking is to be performed on the
1184  * raw inode simply pass @nop_mnt_idmap.
1185  *
1186  * Returns 0 if successful, -ve on error.
1187  */
may_linkat(struct mnt_idmap * idmap,const struct path * link)1188 int may_linkat(struct mnt_idmap *idmap, const struct path *link)
1189 {
1190 	struct inode *inode = link->dentry->d_inode;
1191 
1192 	/* Inode writeback is not safe when the uid or gid are invalid. */
1193 	if (!vfsuid_valid(i_uid_into_vfsuid(idmap, inode)) ||
1194 	    !vfsgid_valid(i_gid_into_vfsgid(idmap, inode)))
1195 		return -EOVERFLOW;
1196 
1197 	if (!sysctl_protected_hardlinks)
1198 		return 0;
1199 
1200 	/* Source inode owner (or CAP_FOWNER) can hardlink all they like,
1201 	 * otherwise, it must be a safe source.
1202 	 */
1203 	if (safe_hardlink_source(idmap, inode) ||
1204 	    inode_owner_or_capable(idmap, inode))
1205 		return 0;
1206 
1207 	audit_log_path_denied(AUDIT_ANOM_LINK, "linkat");
1208 	return -EPERM;
1209 }
1210 
1211 /**
1212  * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
1213  *			  should be allowed, or not, on files that already
1214  *			  exist.
1215  * @idmap: idmap of the mount the inode was found from
1216  * @nd: nameidata pathwalk data
1217  * @inode: the inode of the file to open
1218  *
1219  * Block an O_CREAT open of a FIFO (or a regular file) when:
1220  *   - sysctl_protected_fifos (or sysctl_protected_regular) is enabled
1221  *   - the file already exists
1222  *   - we are in a sticky directory
1223  *   - we don't own the file
1224  *   - the owner of the directory doesn't own the file
1225  *   - the directory is world writable
1226  * If the sysctl_protected_fifos (or sysctl_protected_regular) is set to 2
1227  * the directory doesn't have to be world writable: being group writable will
1228  * be enough.
1229  *
1230  * If the inode has been found through an idmapped mount the idmap of
1231  * the vfsmount must be passed through @idmap. This function will then take
1232  * care to map the inode according to @idmap before checking permissions.
1233  * On non-idmapped mounts or if permission checking is to be performed on the
1234  * raw inode simply pass @nop_mnt_idmap.
1235  *
1236  * Returns 0 if the open is allowed, -ve on error.
1237  */
may_create_in_sticky(struct mnt_idmap * idmap,struct nameidata * nd,struct inode * const inode)1238 static int may_create_in_sticky(struct mnt_idmap *idmap,
1239 				struct nameidata *nd, struct inode *const inode)
1240 {
1241 	umode_t dir_mode = nd->dir_mode;
1242 	vfsuid_t dir_vfsuid = nd->dir_vfsuid;
1243 
1244 	if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
1245 	    (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
1246 	    likely(!(dir_mode & S_ISVTX)) ||
1247 	    vfsuid_eq(i_uid_into_vfsuid(idmap, inode), dir_vfsuid) ||
1248 	    vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), current_fsuid()))
1249 		return 0;
1250 
1251 	if (likely(dir_mode & 0002) ||
1252 	    (dir_mode & 0020 &&
1253 	     ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
1254 	      (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
1255 		const char *operation = S_ISFIFO(inode->i_mode) ?
1256 					"sticky_create_fifo" :
1257 					"sticky_create_regular";
1258 		audit_log_path_denied(AUDIT_ANOM_CREAT, operation);
1259 		return -EACCES;
1260 	}
1261 	return 0;
1262 }
1263 
1264 /*
1265  * follow_up - Find the mountpoint of path's vfsmount
1266  *
1267  * Given a path, find the mountpoint of its source file system.
1268  * Replace @path with the path of the mountpoint in the parent mount.
1269  * Up is towards /.
1270  *
1271  * Return 1 if we went up a level and 0 if we were already at the
1272  * root.
1273  */
follow_up(struct path * path)1274 int follow_up(struct path *path)
1275 {
1276 	struct mount *mnt = real_mount(path->mnt);
1277 	struct mount *parent;
1278 	struct dentry *mountpoint;
1279 
1280 	read_seqlock_excl(&mount_lock);
1281 	parent = mnt->mnt_parent;
1282 	if (parent == mnt) {
1283 		read_sequnlock_excl(&mount_lock);
1284 		return 0;
1285 	}
1286 	mntget(&parent->mnt);
1287 	mountpoint = dget(mnt->mnt_mountpoint);
1288 	read_sequnlock_excl(&mount_lock);
1289 	dput(path->dentry);
1290 	path->dentry = mountpoint;
1291 	mntput(path->mnt);
1292 	path->mnt = &parent->mnt;
1293 	return 1;
1294 }
1295 EXPORT_SYMBOL(follow_up);
1296 
choose_mountpoint_rcu(struct mount * m,const struct path * root,struct path * path,unsigned * seqp)1297 static bool choose_mountpoint_rcu(struct mount *m, const struct path *root,
1298 				  struct path *path, unsigned *seqp)
1299 {
1300 	while (mnt_has_parent(m)) {
1301 		struct dentry *mountpoint = m->mnt_mountpoint;
1302 
1303 		m = m->mnt_parent;
1304 		if (unlikely(root->dentry == mountpoint &&
1305 			     root->mnt == &m->mnt))
1306 			break;
1307 		if (mountpoint != m->mnt.mnt_root) {
1308 			path->mnt = &m->mnt;
1309 			path->dentry = mountpoint;
1310 			*seqp = read_seqcount_begin(&mountpoint->d_seq);
1311 			return true;
1312 		}
1313 	}
1314 	return false;
1315 }
1316 
choose_mountpoint(struct mount * m,const struct path * root,struct path * path)1317 static bool choose_mountpoint(struct mount *m, const struct path *root,
1318 			      struct path *path)
1319 {
1320 	bool found;
1321 
1322 	rcu_read_lock();
1323 	while (1) {
1324 		unsigned seq, mseq = read_seqbegin(&mount_lock);
1325 
1326 		found = choose_mountpoint_rcu(m, root, path, &seq);
1327 		if (unlikely(!found)) {
1328 			if (!read_seqretry(&mount_lock, mseq))
1329 				break;
1330 		} else {
1331 			if (likely(__legitimize_path(path, seq, mseq)))
1332 				break;
1333 			rcu_read_unlock();
1334 			path_put(path);
1335 			rcu_read_lock();
1336 		}
1337 	}
1338 	rcu_read_unlock();
1339 	return found;
1340 }
1341 
1342 /*
1343  * Perform an automount
1344  * - return -EISDIR to tell follow_managed() to stop and return the path we
1345  *   were called with.
1346  */
follow_automount(struct path * path,int * count,unsigned lookup_flags)1347 static int follow_automount(struct path *path, int *count, unsigned lookup_flags)
1348 {
1349 	struct dentry *dentry = path->dentry;
1350 
1351 	/* We don't want to mount if someone's just doing a stat -
1352 	 * unless they're stat'ing a directory and appended a '/' to
1353 	 * the name.
1354 	 *
1355 	 * We do, however, want to mount if someone wants to open or
1356 	 * create a file of any type under the mountpoint, wants to
1357 	 * traverse through the mountpoint or wants to open the
1358 	 * mounted directory.  Also, autofs may mark negative dentries
1359 	 * as being automount points.  These will need the attentions
1360 	 * of the daemon to instantiate them before they can be used.
1361 	 */
1362 	if (!(lookup_flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
1363 			   LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
1364 	    dentry->d_inode)
1365 		return -EISDIR;
1366 
1367 	if (count && (*count)++ >= MAXSYMLINKS)
1368 		return -ELOOP;
1369 
1370 	return finish_automount(dentry->d_op->d_automount(path), path);
1371 }
1372 
1373 /*
1374  * mount traversal - out-of-line part.  One note on ->d_flags accesses -
1375  * dentries are pinned but not locked here, so negative dentry can go
1376  * positive right under us.  Use of smp_load_acquire() provides a barrier
1377  * sufficient for ->d_inode and ->d_flags consistency.
1378  */
__traverse_mounts(struct path * path,unsigned flags,bool * jumped,int * count,unsigned lookup_flags)1379 static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped,
1380 			     int *count, unsigned lookup_flags)
1381 {
1382 	struct vfsmount *mnt = path->mnt;
1383 	bool need_mntput = false;
1384 	int ret = 0;
1385 
1386 	while (flags & DCACHE_MANAGED_DENTRY) {
1387 		/* Allow the filesystem to manage the transit without i_mutex
1388 		 * being held. */
1389 		if (flags & DCACHE_MANAGE_TRANSIT) {
1390 			ret = path->dentry->d_op->d_manage(path, false);
1391 			flags = smp_load_acquire(&path->dentry->d_flags);
1392 			if (ret < 0)
1393 				break;
1394 		}
1395 
1396 		if (flags & DCACHE_MOUNTED) {	// something's mounted on it..
1397 			struct vfsmount *mounted = lookup_mnt(path);
1398 			if (mounted) {		// ... in our namespace
1399 				dput(path->dentry);
1400 				if (need_mntput)
1401 					mntput(path->mnt);
1402 				path->mnt = mounted;
1403 				path->dentry = dget(mounted->mnt_root);
1404 				// here we know it's positive
1405 				flags = path->dentry->d_flags;
1406 				need_mntput = true;
1407 				continue;
1408 			}
1409 		}
1410 
1411 		if (!(flags & DCACHE_NEED_AUTOMOUNT))
1412 			break;
1413 
1414 		// uncovered automount point
1415 		ret = follow_automount(path, count, lookup_flags);
1416 		flags = smp_load_acquire(&path->dentry->d_flags);
1417 		if (ret < 0)
1418 			break;
1419 	}
1420 
1421 	if (ret == -EISDIR)
1422 		ret = 0;
1423 	// possible if you race with several mount --move
1424 	if (need_mntput && path->mnt == mnt)
1425 		mntput(path->mnt);
1426 	if (!ret && unlikely(d_flags_negative(flags)))
1427 		ret = -ENOENT;
1428 	*jumped = need_mntput;
1429 	return ret;
1430 }
1431 
traverse_mounts(struct path * path,bool * jumped,int * count,unsigned lookup_flags)1432 static inline int traverse_mounts(struct path *path, bool *jumped,
1433 				  int *count, unsigned lookup_flags)
1434 {
1435 	unsigned flags = smp_load_acquire(&path->dentry->d_flags);
1436 
1437 	/* fastpath */
1438 	if (likely(!(flags & DCACHE_MANAGED_DENTRY))) {
1439 		*jumped = false;
1440 		if (unlikely(d_flags_negative(flags)))
1441 			return -ENOENT;
1442 		return 0;
1443 	}
1444 	return __traverse_mounts(path, flags, jumped, count, lookup_flags);
1445 }
1446 
follow_down_one(struct path * path)1447 int follow_down_one(struct path *path)
1448 {
1449 	struct vfsmount *mounted;
1450 
1451 	mounted = lookup_mnt(path);
1452 	if (mounted) {
1453 		dput(path->dentry);
1454 		mntput(path->mnt);
1455 		path->mnt = mounted;
1456 		path->dentry = dget(mounted->mnt_root);
1457 		return 1;
1458 	}
1459 	return 0;
1460 }
1461 EXPORT_SYMBOL(follow_down_one);
1462 
1463 /*
1464  * Follow down to the covering mount currently visible to userspace.  At each
1465  * point, the filesystem owning that dentry may be queried as to whether the
1466  * caller is permitted to proceed or not.
1467  */
follow_down(struct path * path,unsigned int flags)1468 int follow_down(struct path *path, unsigned int flags)
1469 {
1470 	struct vfsmount *mnt = path->mnt;
1471 	bool jumped;
1472 	int ret = traverse_mounts(path, &jumped, NULL, flags);
1473 
1474 	if (path->mnt != mnt)
1475 		mntput(mnt);
1476 	return ret;
1477 }
1478 EXPORT_SYMBOL(follow_down);
1479 
1480 /*
1481  * Try to skip to top of mountpoint pile in rcuwalk mode.  Fail if
1482  * we meet a managed dentry that would need blocking.
1483  */
__follow_mount_rcu(struct nameidata * nd,struct path * path)1484 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path)
1485 {
1486 	struct dentry *dentry = path->dentry;
1487 	unsigned int flags = dentry->d_flags;
1488 
1489 	if (likely(!(flags & DCACHE_MANAGED_DENTRY)))
1490 		return true;
1491 
1492 	if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1493 		return false;
1494 
1495 	for (;;) {
1496 		/*
1497 		 * Don't forget we might have a non-mountpoint managed dentry
1498 		 * that wants to block transit.
1499 		 */
1500 		if (unlikely(flags & DCACHE_MANAGE_TRANSIT)) {
1501 			int res = dentry->d_op->d_manage(path, true);
1502 			if (res)
1503 				return res == -EISDIR;
1504 			flags = dentry->d_flags;
1505 		}
1506 
1507 		if (flags & DCACHE_MOUNTED) {
1508 			struct mount *mounted = __lookup_mnt(path->mnt, dentry);
1509 			if (mounted) {
1510 				path->mnt = &mounted->mnt;
1511 				dentry = path->dentry = mounted->mnt.mnt_root;
1512 				nd->state |= ND_JUMPED;
1513 				nd->next_seq = read_seqcount_begin(&dentry->d_seq);
1514 				flags = dentry->d_flags;
1515 				// makes sure that non-RCU pathwalk could reach
1516 				// this state.
1517 				if (read_seqretry(&mount_lock, nd->m_seq))
1518 					return false;
1519 				continue;
1520 			}
1521 			if (read_seqretry(&mount_lock, nd->m_seq))
1522 				return false;
1523 		}
1524 		return !(flags & DCACHE_NEED_AUTOMOUNT);
1525 	}
1526 }
1527 
handle_mounts(struct nameidata * nd,struct dentry * dentry,struct path * path)1528 static inline int handle_mounts(struct nameidata *nd, struct dentry *dentry,
1529 			  struct path *path)
1530 {
1531 	bool jumped;
1532 	int ret;
1533 
1534 	path->mnt = nd->path.mnt;
1535 	path->dentry = dentry;
1536 	if (nd->flags & LOOKUP_RCU) {
1537 		unsigned int seq = nd->next_seq;
1538 		if (likely(__follow_mount_rcu(nd, path)))
1539 			return 0;
1540 		// *path and nd->next_seq might've been clobbered
1541 		path->mnt = nd->path.mnt;
1542 		path->dentry = dentry;
1543 		nd->next_seq = seq;
1544 		if (!try_to_unlazy_next(nd, dentry))
1545 			return -ECHILD;
1546 	}
1547 	ret = traverse_mounts(path, &jumped, &nd->total_link_count, nd->flags);
1548 	if (jumped) {
1549 		if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1550 			ret = -EXDEV;
1551 		else
1552 			nd->state |= ND_JUMPED;
1553 	}
1554 	if (unlikely(ret)) {
1555 		dput(path->dentry);
1556 		if (path->mnt != nd->path.mnt)
1557 			mntput(path->mnt);
1558 	}
1559 	return ret;
1560 }
1561 
1562 /*
1563  * This looks up the name in dcache and possibly revalidates the found dentry.
1564  * NULL is returned if the dentry does not exist in the cache.
1565  */
lookup_dcache(const struct qstr * name,struct dentry * dir,unsigned int flags)1566 static struct dentry *lookup_dcache(const struct qstr *name,
1567 				    struct dentry *dir,
1568 				    unsigned int flags)
1569 {
1570 	struct dentry *dentry = d_lookup(dir, name);
1571 	if (dentry) {
1572 		int error = d_revalidate(dentry, flags);
1573 		if (unlikely(error <= 0)) {
1574 			if (!error)
1575 				d_invalidate(dentry);
1576 			dput(dentry);
1577 			return ERR_PTR(error);
1578 		}
1579 	}
1580 	return dentry;
1581 }
1582 
1583 /*
1584  * Parent directory has inode locked exclusive.  This is one
1585  * and only case when ->lookup() gets called on non in-lookup
1586  * dentries - as the matter of fact, this only gets called
1587  * when directory is guaranteed to have no in-lookup children
1588  * at all.
1589  */
lookup_one_qstr_excl(const struct qstr * name,struct dentry * base,unsigned int flags)1590 struct dentry *lookup_one_qstr_excl(const struct qstr *name,
1591 				    struct dentry *base,
1592 				    unsigned int flags)
1593 {
1594 	struct dentry *dentry = lookup_dcache(name, base, flags);
1595 	struct dentry *old;
1596 	struct inode *dir = base->d_inode;
1597 
1598 	if (dentry)
1599 		return dentry;
1600 
1601 	/* Don't create child dentry for a dead directory. */
1602 	if (unlikely(IS_DEADDIR(dir)))
1603 		return ERR_PTR(-ENOENT);
1604 
1605 	dentry = d_alloc(base, name);
1606 	if (unlikely(!dentry))
1607 		return ERR_PTR(-ENOMEM);
1608 
1609 	old = dir->i_op->lookup(dir, dentry, flags);
1610 	if (unlikely(old)) {
1611 		dput(dentry);
1612 		dentry = old;
1613 	}
1614 	return dentry;
1615 }
1616 EXPORT_SYMBOL(lookup_one_qstr_excl);
1617 
lookup_fast(struct nameidata * nd)1618 static struct dentry *lookup_fast(struct nameidata *nd)
1619 {
1620 	struct dentry *dentry, *parent = nd->path.dentry;
1621 	int status = 1;
1622 
1623 	/*
1624 	 * Rename seqlock is not required here because in the off chance
1625 	 * of a false negative due to a concurrent rename, the caller is
1626 	 * going to fall back to non-racy lookup.
1627 	 */
1628 	if (nd->flags & LOOKUP_RCU) {
1629 		dentry = __d_lookup_rcu(parent, &nd->last, &nd->next_seq);
1630 		if (unlikely(!dentry)) {
1631 			if (!try_to_unlazy(nd))
1632 				return ERR_PTR(-ECHILD);
1633 			return NULL;
1634 		}
1635 
1636 		/*
1637 		 * This sequence count validates that the parent had no
1638 		 * changes while we did the lookup of the dentry above.
1639 		 */
1640 		if (read_seqcount_retry(&parent->d_seq, nd->seq))
1641 			return ERR_PTR(-ECHILD);
1642 
1643 		status = d_revalidate(dentry, nd->flags);
1644 		if (likely(status > 0))
1645 			return dentry;
1646 		if (!try_to_unlazy_next(nd, dentry))
1647 			return ERR_PTR(-ECHILD);
1648 		if (status == -ECHILD)
1649 			/* we'd been told to redo it in non-rcu mode */
1650 			status = d_revalidate(dentry, nd->flags);
1651 	} else {
1652 		dentry = __d_lookup(parent, &nd->last);
1653 		if (unlikely(!dentry))
1654 			return NULL;
1655 		status = d_revalidate(dentry, nd->flags);
1656 	}
1657 	if (unlikely(status <= 0)) {
1658 		if (!status)
1659 			d_invalidate(dentry);
1660 		dput(dentry);
1661 		return ERR_PTR(status);
1662 	}
1663 	return dentry;
1664 }
1665 
1666 /* Fast lookup failed, do it the slow way */
__lookup_slow(const struct qstr * name,struct dentry * dir,unsigned int flags)1667 static struct dentry *__lookup_slow(const struct qstr *name,
1668 				    struct dentry *dir,
1669 				    unsigned int flags)
1670 {
1671 	struct dentry *dentry, *old;
1672 	struct inode *inode = dir->d_inode;
1673 	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
1674 
1675 	/* Don't go there if it's already dead */
1676 	if (unlikely(IS_DEADDIR(inode)))
1677 		return ERR_PTR(-ENOENT);
1678 again:
1679 	dentry = d_alloc_parallel(dir, name, &wq);
1680 	if (IS_ERR(dentry))
1681 		return dentry;
1682 	if (unlikely(!d_in_lookup(dentry))) {
1683 		int error = d_revalidate(dentry, flags);
1684 		if (unlikely(error <= 0)) {
1685 			if (!error) {
1686 				d_invalidate(dentry);
1687 				dput(dentry);
1688 				goto again;
1689 			}
1690 			dput(dentry);
1691 			dentry = ERR_PTR(error);
1692 		}
1693 	} else {
1694 		old = inode->i_op->lookup(inode, dentry, flags);
1695 		d_lookup_done(dentry);
1696 		if (unlikely(old)) {
1697 			dput(dentry);
1698 			dentry = old;
1699 		}
1700 	}
1701 	return dentry;
1702 }
1703 
lookup_slow(const struct qstr * name,struct dentry * dir,unsigned int flags)1704 static struct dentry *lookup_slow(const struct qstr *name,
1705 				  struct dentry *dir,
1706 				  unsigned int flags)
1707 {
1708 	struct inode *inode = dir->d_inode;
1709 	struct dentry *res;
1710 	inode_lock_shared(inode);
1711 	res = __lookup_slow(name, dir, flags);
1712 	inode_unlock_shared(inode);
1713 	return res;
1714 }
1715 
may_lookup(struct mnt_idmap * idmap,struct nameidata * nd)1716 static inline int may_lookup(struct mnt_idmap *idmap,
1717 			     struct nameidata *nd)
1718 {
1719 	if (nd->flags & LOOKUP_RCU) {
1720 		int err = inode_permission(idmap, nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1721 		if (err != -ECHILD || !try_to_unlazy(nd))
1722 			return err;
1723 	}
1724 	return inode_permission(idmap, nd->inode, MAY_EXEC);
1725 }
1726 
reserve_stack(struct nameidata * nd,struct path * link)1727 static int reserve_stack(struct nameidata *nd, struct path *link)
1728 {
1729 	if (unlikely(nd->total_link_count++ >= MAXSYMLINKS))
1730 		return -ELOOP;
1731 
1732 	if (likely(nd->depth != EMBEDDED_LEVELS))
1733 		return 0;
1734 	if (likely(nd->stack != nd->internal))
1735 		return 0;
1736 	if (likely(nd_alloc_stack(nd)))
1737 		return 0;
1738 
1739 	if (nd->flags & LOOKUP_RCU) {
1740 		// we need to grab link before we do unlazy.  And we can't skip
1741 		// unlazy even if we fail to grab the link - cleanup needs it
1742 		bool grabbed_link = legitimize_path(nd, link, nd->next_seq);
1743 
1744 		if (!try_to_unlazy(nd) || !grabbed_link)
1745 			return -ECHILD;
1746 
1747 		if (nd_alloc_stack(nd))
1748 			return 0;
1749 	}
1750 	return -ENOMEM;
1751 }
1752 
1753 enum {WALK_TRAILING = 1, WALK_MORE = 2, WALK_NOFOLLOW = 4};
1754 
pick_link(struct nameidata * nd,struct path * link,struct inode * inode,int flags)1755 static const char *pick_link(struct nameidata *nd, struct path *link,
1756 		     struct inode *inode, int flags)
1757 {
1758 	struct saved *last;
1759 	const char *res;
1760 	int error = reserve_stack(nd, link);
1761 
1762 	if (unlikely(error)) {
1763 		if (!(nd->flags & LOOKUP_RCU))
1764 			path_put(link);
1765 		return ERR_PTR(error);
1766 	}
1767 	last = nd->stack + nd->depth++;
1768 	last->link = *link;
1769 	clear_delayed_call(&last->done);
1770 	last->seq = nd->next_seq;
1771 
1772 	if (flags & WALK_TRAILING) {
1773 		error = may_follow_link(nd, inode);
1774 		if (unlikely(error))
1775 			return ERR_PTR(error);
1776 	}
1777 
1778 	if (unlikely(nd->flags & LOOKUP_NO_SYMLINKS) ||
1779 			unlikely(link->mnt->mnt_flags & MNT_NOSYMFOLLOW))
1780 		return ERR_PTR(-ELOOP);
1781 
1782 	if (!(nd->flags & LOOKUP_RCU)) {
1783 		touch_atime(&last->link);
1784 		cond_resched();
1785 	} else if (atime_needs_update(&last->link, inode)) {
1786 		if (!try_to_unlazy(nd))
1787 			return ERR_PTR(-ECHILD);
1788 		touch_atime(&last->link);
1789 	}
1790 
1791 	error = security_inode_follow_link(link->dentry, inode,
1792 					   nd->flags & LOOKUP_RCU);
1793 	if (unlikely(error))
1794 		return ERR_PTR(error);
1795 
1796 	res = READ_ONCE(inode->i_link);
1797 	if (!res) {
1798 		const char * (*get)(struct dentry *, struct inode *,
1799 				struct delayed_call *);
1800 		get = inode->i_op->get_link;
1801 		if (nd->flags & LOOKUP_RCU) {
1802 			res = get(NULL, inode, &last->done);
1803 			if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd))
1804 				res = get(link->dentry, inode, &last->done);
1805 		} else {
1806 			res = get(link->dentry, inode, &last->done);
1807 		}
1808 		if (!res)
1809 			goto all_done;
1810 		if (IS_ERR(res))
1811 			return res;
1812 	}
1813 	if (*res == '/') {
1814 		error = nd_jump_root(nd);
1815 		if (unlikely(error))
1816 			return ERR_PTR(error);
1817 		while (unlikely(*++res == '/'))
1818 			;
1819 	}
1820 	if (*res)
1821 		return res;
1822 all_done: // pure jump
1823 	put_link(nd);
1824 	return NULL;
1825 }
1826 
1827 /*
1828  * Do we need to follow links? We _really_ want to be able
1829  * to do this check without having to look at inode->i_op,
1830  * so we keep a cache of "no, this doesn't need follow_link"
1831  * for the common case.
1832  *
1833  * NOTE: dentry must be what nd->next_seq had been sampled from.
1834  */
step_into(struct nameidata * nd,int flags,struct dentry * dentry)1835 static const char *step_into(struct nameidata *nd, int flags,
1836 		     struct dentry *dentry)
1837 {
1838 	struct path path;
1839 	struct inode *inode;
1840 	int err = handle_mounts(nd, dentry, &path);
1841 
1842 	if (err < 0)
1843 		return ERR_PTR(err);
1844 	inode = path.dentry->d_inode;
1845 	if (likely(!d_is_symlink(path.dentry)) ||
1846 	   ((flags & WALK_TRAILING) && !(nd->flags & LOOKUP_FOLLOW)) ||
1847 	   (flags & WALK_NOFOLLOW)) {
1848 		/* not a symlink or should not follow */
1849 		if (nd->flags & LOOKUP_RCU) {
1850 			if (read_seqcount_retry(&path.dentry->d_seq, nd->next_seq))
1851 				return ERR_PTR(-ECHILD);
1852 			if (unlikely(!inode))
1853 				return ERR_PTR(-ENOENT);
1854 		} else {
1855 			dput(nd->path.dentry);
1856 			if (nd->path.mnt != path.mnt)
1857 				mntput(nd->path.mnt);
1858 		}
1859 		nd->path = path;
1860 		nd->inode = inode;
1861 		nd->seq = nd->next_seq;
1862 		return NULL;
1863 	}
1864 	if (nd->flags & LOOKUP_RCU) {
1865 		/* make sure that d_is_symlink above matches inode */
1866 		if (read_seqcount_retry(&path.dentry->d_seq, nd->next_seq))
1867 			return ERR_PTR(-ECHILD);
1868 	} else {
1869 		if (path.mnt == nd->path.mnt)
1870 			mntget(path.mnt);
1871 	}
1872 	return pick_link(nd, &path, inode, flags);
1873 }
1874 
follow_dotdot_rcu(struct nameidata * nd)1875 static struct dentry *follow_dotdot_rcu(struct nameidata *nd)
1876 {
1877 	struct dentry *parent, *old;
1878 
1879 	if (path_equal(&nd->path, &nd->root))
1880 		goto in_root;
1881 	if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
1882 		struct path path;
1883 		unsigned seq;
1884 		if (!choose_mountpoint_rcu(real_mount(nd->path.mnt),
1885 					   &nd->root, &path, &seq))
1886 			goto in_root;
1887 		if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1888 			return ERR_PTR(-ECHILD);
1889 		nd->path = path;
1890 		nd->inode = path.dentry->d_inode;
1891 		nd->seq = seq;
1892 		// makes sure that non-RCU pathwalk could reach this state
1893 		if (read_seqretry(&mount_lock, nd->m_seq))
1894 			return ERR_PTR(-ECHILD);
1895 		/* we know that mountpoint was pinned */
1896 	}
1897 	old = nd->path.dentry;
1898 	parent = old->d_parent;
1899 	nd->next_seq = read_seqcount_begin(&parent->d_seq);
1900 	// makes sure that non-RCU pathwalk could reach this state
1901 	if (read_seqcount_retry(&old->d_seq, nd->seq))
1902 		return ERR_PTR(-ECHILD);
1903 	if (unlikely(!path_connected(nd->path.mnt, parent)))
1904 		return ERR_PTR(-ECHILD);
1905 	return parent;
1906 in_root:
1907 	if (read_seqretry(&mount_lock, nd->m_seq))
1908 		return ERR_PTR(-ECHILD);
1909 	if (unlikely(nd->flags & LOOKUP_BENEATH))
1910 		return ERR_PTR(-ECHILD);
1911 	nd->next_seq = nd->seq;
1912 	return nd->path.dentry;
1913 }
1914 
follow_dotdot(struct nameidata * nd)1915 static struct dentry *follow_dotdot(struct nameidata *nd)
1916 {
1917 	struct dentry *parent;
1918 
1919 	if (path_equal(&nd->path, &nd->root))
1920 		goto in_root;
1921 	if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
1922 		struct path path;
1923 
1924 		if (!choose_mountpoint(real_mount(nd->path.mnt),
1925 				       &nd->root, &path))
1926 			goto in_root;
1927 		path_put(&nd->path);
1928 		nd->path = path;
1929 		nd->inode = path.dentry->d_inode;
1930 		if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1931 			return ERR_PTR(-EXDEV);
1932 	}
1933 	/* rare case of legitimate dget_parent()... */
1934 	parent = dget_parent(nd->path.dentry);
1935 	if (unlikely(!path_connected(nd->path.mnt, parent))) {
1936 		dput(parent);
1937 		return ERR_PTR(-ENOENT);
1938 	}
1939 	return parent;
1940 
1941 in_root:
1942 	if (unlikely(nd->flags & LOOKUP_BENEATH))
1943 		return ERR_PTR(-EXDEV);
1944 	return dget(nd->path.dentry);
1945 }
1946 
handle_dots(struct nameidata * nd,int type)1947 static const char *handle_dots(struct nameidata *nd, int type)
1948 {
1949 	if (type == LAST_DOTDOT) {
1950 		const char *error = NULL;
1951 		struct dentry *parent;
1952 
1953 		if (!nd->root.mnt) {
1954 			error = ERR_PTR(set_root(nd));
1955 			if (error)
1956 				return error;
1957 		}
1958 		if (nd->flags & LOOKUP_RCU)
1959 			parent = follow_dotdot_rcu(nd);
1960 		else
1961 			parent = follow_dotdot(nd);
1962 		if (IS_ERR(parent))
1963 			return ERR_CAST(parent);
1964 		error = step_into(nd, WALK_NOFOLLOW, parent);
1965 		if (unlikely(error))
1966 			return error;
1967 
1968 		if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
1969 			/*
1970 			 * If there was a racing rename or mount along our
1971 			 * path, then we can't be sure that ".." hasn't jumped
1972 			 * above nd->root (and so userspace should retry or use
1973 			 * some fallback).
1974 			 */
1975 			smp_rmb();
1976 			if (__read_seqcount_retry(&mount_lock.seqcount, nd->m_seq))
1977 				return ERR_PTR(-EAGAIN);
1978 			if (__read_seqcount_retry(&rename_lock.seqcount, nd->r_seq))
1979 				return ERR_PTR(-EAGAIN);
1980 		}
1981 	}
1982 	return NULL;
1983 }
1984 
walk_component(struct nameidata * nd,int flags)1985 static const char *walk_component(struct nameidata *nd, int flags)
1986 {
1987 	struct dentry *dentry;
1988 	/*
1989 	 * "." and ".." are special - ".." especially so because it has
1990 	 * to be able to know about the current root directory and
1991 	 * parent relationships.
1992 	 */
1993 	if (unlikely(nd->last_type != LAST_NORM)) {
1994 		if (!(flags & WALK_MORE) && nd->depth)
1995 			put_link(nd);
1996 		return handle_dots(nd, nd->last_type);
1997 	}
1998 	dentry = lookup_fast(nd);
1999 	if (IS_ERR(dentry))
2000 		return ERR_CAST(dentry);
2001 	if (unlikely(!dentry)) {
2002 		dentry = lookup_slow(&nd->last, nd->path.dentry, nd->flags);
2003 		if (IS_ERR(dentry))
2004 			return ERR_CAST(dentry);
2005 	}
2006 	if (!(flags & WALK_MORE) && nd->depth)
2007 		put_link(nd);
2008 	return step_into(nd, flags, dentry);
2009 }
2010 
2011 /*
2012  * We can do the critical dentry name comparison and hashing
2013  * operations one word at a time, but we are limited to:
2014  *
2015  * - Architectures with fast unaligned word accesses. We could
2016  *   do a "get_unaligned()" if this helps and is sufficiently
2017  *   fast.
2018  *
2019  * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
2020  *   do not trap on the (extremely unlikely) case of a page
2021  *   crossing operation.
2022  *
2023  * - Furthermore, we need an efficient 64-bit compile for the
2024  *   64-bit case in order to generate the "number of bytes in
2025  *   the final mask". Again, that could be replaced with a
2026  *   efficient population count instruction or similar.
2027  */
2028 #ifdef CONFIG_DCACHE_WORD_ACCESS
2029 
2030 #include <asm/word-at-a-time.h>
2031 
2032 #ifdef HASH_MIX
2033 
2034 /* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */
2035 
2036 #elif defined(CONFIG_64BIT)
2037 /*
2038  * Register pressure in the mixing function is an issue, particularly
2039  * on 32-bit x86, but almost any function requires one state value and
2040  * one temporary.  Instead, use a function designed for two state values
2041  * and no temporaries.
2042  *
2043  * This function cannot create a collision in only two iterations, so
2044  * we have two iterations to achieve avalanche.  In those two iterations,
2045  * we have six layers of mixing, which is enough to spread one bit's
2046  * influence out to 2^6 = 64 state bits.
2047  *
2048  * Rotate constants are scored by considering either 64 one-bit input
2049  * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the
2050  * probability of that delta causing a change to each of the 128 output
2051  * bits, using a sample of random initial states.
2052  *
2053  * The Shannon entropy of the computed probabilities is then summed
2054  * to produce a score.  Ideally, any input change has a 50% chance of
2055  * toggling any given output bit.
2056  *
2057  * Mixing scores (in bits) for (12,45):
2058  * Input delta: 1-bit      2-bit
2059  * 1 round:     713.3    42542.6
2060  * 2 rounds:   2753.7   140389.8
2061  * 3 rounds:   5954.1   233458.2
2062  * 4 rounds:   7862.6   256672.2
2063  * Perfect:    8192     258048
2064  *            (64*128) (64*63/2 * 128)
2065  */
2066 #define HASH_MIX(x, y, a)	\
2067 	(	x ^= (a),	\
2068 	y ^= x,	x = rol64(x,12),\
2069 	x += y,	y = rol64(y,45),\
2070 	y *= 9			)
2071 
2072 /*
2073  * Fold two longs into one 32-bit hash value.  This must be fast, but
2074  * latency isn't quite as critical, as there is a fair bit of additional
2075  * work done before the hash value is used.
2076  */
fold_hash(unsigned long x,unsigned long y)2077 static inline unsigned int fold_hash(unsigned long x, unsigned long y)
2078 {
2079 	y ^= x * GOLDEN_RATIO_64;
2080 	y *= GOLDEN_RATIO_64;
2081 	return y >> 32;
2082 }
2083 
2084 #else	/* 32-bit case */
2085 
2086 /*
2087  * Mixing scores (in bits) for (7,20):
2088  * Input delta: 1-bit      2-bit
2089  * 1 round:     330.3     9201.6
2090  * 2 rounds:   1246.4    25475.4
2091  * 3 rounds:   1907.1    31295.1
2092  * 4 rounds:   2042.3    31718.6
2093  * Perfect:    2048      31744
2094  *            (32*64)   (32*31/2 * 64)
2095  */
2096 #define HASH_MIX(x, y, a)	\
2097 	(	x ^= (a),	\
2098 	y ^= x,	x = rol32(x, 7),\
2099 	x += y,	y = rol32(y,20),\
2100 	y *= 9			)
2101 
fold_hash(unsigned long x,unsigned long y)2102 static inline unsigned int fold_hash(unsigned long x, unsigned long y)
2103 {
2104 	/* Use arch-optimized multiply if one exists */
2105 	return __hash_32(y ^ __hash_32(x));
2106 }
2107 
2108 #endif
2109 
2110 /*
2111  * Return the hash of a string of known length.  This is carfully
2112  * designed to match hash_name(), which is the more critical function.
2113  * In particular, we must end by hashing a final word containing 0..7
2114  * payload bytes, to match the way that hash_name() iterates until it
2115  * finds the delimiter after the name.
2116  */
full_name_hash(const void * salt,const char * name,unsigned int len)2117 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2118 {
2119 	unsigned long a, x = 0, y = (unsigned long)salt;
2120 
2121 	for (;;) {
2122 		if (!len)
2123 			goto done;
2124 		a = load_unaligned_zeropad(name);
2125 		if (len < sizeof(unsigned long))
2126 			break;
2127 		HASH_MIX(x, y, a);
2128 		name += sizeof(unsigned long);
2129 		len -= sizeof(unsigned long);
2130 	}
2131 	x ^= a & bytemask_from_count(len);
2132 done:
2133 	return fold_hash(x, y);
2134 }
2135 EXPORT_SYMBOL(full_name_hash);
2136 
2137 /* Return the "hash_len" (hash and length) of a null-terminated string */
hashlen_string(const void * salt,const char * name)2138 u64 hashlen_string(const void *salt, const char *name)
2139 {
2140 	unsigned long a = 0, x = 0, y = (unsigned long)salt;
2141 	unsigned long adata, mask, len;
2142 	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
2143 
2144 	len = 0;
2145 	goto inside;
2146 
2147 	do {
2148 		HASH_MIX(x, y, a);
2149 		len += sizeof(unsigned long);
2150 inside:
2151 		a = load_unaligned_zeropad(name+len);
2152 	} while (!has_zero(a, &adata, &constants));
2153 
2154 	adata = prep_zero_mask(a, adata, &constants);
2155 	mask = create_zero_mask(adata);
2156 	x ^= a & zero_bytemask(mask);
2157 
2158 	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2159 }
2160 EXPORT_SYMBOL(hashlen_string);
2161 
2162 /*
2163  * Calculate the length and hash of the path component, and
2164  * return the "hash_len" as the result.
2165  */
hash_name(const void * salt,const char * name)2166 static inline u64 hash_name(const void *salt, const char *name)
2167 {
2168 	unsigned long a = 0, b, x = 0, y = (unsigned long)salt;
2169 	unsigned long adata, bdata, mask, len;
2170 	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
2171 
2172 	len = 0;
2173 	goto inside;
2174 
2175 	do {
2176 		HASH_MIX(x, y, a);
2177 		len += sizeof(unsigned long);
2178 inside:
2179 		a = load_unaligned_zeropad(name+len);
2180 		b = a ^ REPEAT_BYTE('/');
2181 	} while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
2182 
2183 	adata = prep_zero_mask(a, adata, &constants);
2184 	bdata = prep_zero_mask(b, bdata, &constants);
2185 	mask = create_zero_mask(adata | bdata);
2186 	x ^= a & zero_bytemask(mask);
2187 
2188 	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2189 }
2190 
2191 #else	/* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */
2192 
2193 /* Return the hash of a string of known length */
full_name_hash(const void * salt,const char * name,unsigned int len)2194 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2195 {
2196 	unsigned long hash = init_name_hash(salt);
2197 	while (len--)
2198 		hash = partial_name_hash((unsigned char)*name++, hash);
2199 	return end_name_hash(hash);
2200 }
2201 EXPORT_SYMBOL(full_name_hash);
2202 
2203 /* Return the "hash_len" (hash and length) of a null-terminated string */
hashlen_string(const void * salt,const char * name)2204 u64 hashlen_string(const void *salt, const char *name)
2205 {
2206 	unsigned long hash = init_name_hash(salt);
2207 	unsigned long len = 0, c;
2208 
2209 	c = (unsigned char)*name;
2210 	while (c) {
2211 		len++;
2212 		hash = partial_name_hash(c, hash);
2213 		c = (unsigned char)name[len];
2214 	}
2215 	return hashlen_create(end_name_hash(hash), len);
2216 }
2217 EXPORT_SYMBOL(hashlen_string);
2218 
2219 /*
2220  * We know there's a real path component here of at least
2221  * one character.
2222  */
hash_name(const void * salt,const char * name)2223 static inline u64 hash_name(const void *salt, const char *name)
2224 {
2225 	unsigned long hash = init_name_hash(salt);
2226 	unsigned long len = 0, c;
2227 
2228 	c = (unsigned char)*name;
2229 	do {
2230 		len++;
2231 		hash = partial_name_hash(c, hash);
2232 		c = (unsigned char)name[len];
2233 	} while (c && c != '/');
2234 	return hashlen_create(end_name_hash(hash), len);
2235 }
2236 
2237 #endif
2238 
2239 /*
2240  * Name resolution.
2241  * This is the basic name resolution function, turning a pathname into
2242  * the final dentry. We expect 'base' to be positive and a directory.
2243  *
2244  * Returns 0 and nd will have valid dentry and mnt on success.
2245  * Returns error and drops reference to input namei data on failure.
2246  */
link_path_walk(const char * name,struct nameidata * nd)2247 static int link_path_walk(const char *name, struct nameidata *nd)
2248 {
2249 	int depth = 0; // depth <= nd->depth
2250 	int err;
2251 
2252 	nd->last_type = LAST_ROOT;
2253 	nd->flags |= LOOKUP_PARENT;
2254 	if (IS_ERR(name))
2255 		return PTR_ERR(name);
2256 	while (*name=='/')
2257 		name++;
2258 	if (!*name) {
2259 		nd->dir_mode = 0; // short-circuit the 'hardening' idiocy
2260 		return 0;
2261 	}
2262 
2263 	/* At this point we know we have a real path component. */
2264 	for(;;) {
2265 		struct mnt_idmap *idmap;
2266 		const char *link;
2267 		u64 hash_len;
2268 		int type;
2269 
2270 		idmap = mnt_idmap(nd->path.mnt);
2271 		err = may_lookup(idmap, nd);
2272 		if (err)
2273 			return err;
2274 
2275 		hash_len = hash_name(nd->path.dentry, name);
2276 
2277 		type = LAST_NORM;
2278 		if (name[0] == '.') switch (hashlen_len(hash_len)) {
2279 			case 2:
2280 				if (name[1] == '.') {
2281 					type = LAST_DOTDOT;
2282 					nd->state |= ND_JUMPED;
2283 				}
2284 				break;
2285 			case 1:
2286 				type = LAST_DOT;
2287 		}
2288 		if (likely(type == LAST_NORM)) {
2289 			struct dentry *parent = nd->path.dentry;
2290 			nd->state &= ~ND_JUMPED;
2291 			if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
2292 				struct qstr this = { { .hash_len = hash_len }, .name = name };
2293 				err = parent->d_op->d_hash(parent, &this);
2294 				if (err < 0)
2295 					return err;
2296 				hash_len = this.hash_len;
2297 				name = this.name;
2298 			}
2299 		}
2300 
2301 		nd->last.hash_len = hash_len;
2302 		nd->last.name = name;
2303 		nd->last_type = type;
2304 
2305 		name += hashlen_len(hash_len);
2306 		if (!*name)
2307 			goto OK;
2308 		/*
2309 		 * If it wasn't NUL, we know it was '/'. Skip that
2310 		 * slash, and continue until no more slashes.
2311 		 */
2312 		do {
2313 			name++;
2314 		} while (unlikely(*name == '/'));
2315 		if (unlikely(!*name)) {
2316 OK:
2317 			/* pathname or trailing symlink, done */
2318 			if (!depth) {
2319 				nd->dir_vfsuid = i_uid_into_vfsuid(idmap, nd->inode);
2320 				nd->dir_mode = nd->inode->i_mode;
2321 				nd->flags &= ~LOOKUP_PARENT;
2322 				return 0;
2323 			}
2324 			/* last component of nested symlink */
2325 			name = nd->stack[--depth].name;
2326 			link = walk_component(nd, 0);
2327 		} else {
2328 			/* not the last component */
2329 			link = walk_component(nd, WALK_MORE);
2330 		}
2331 		if (unlikely(link)) {
2332 			if (IS_ERR(link))
2333 				return PTR_ERR(link);
2334 			/* a symlink to follow */
2335 			nd->stack[depth++].name = name;
2336 			name = link;
2337 			continue;
2338 		}
2339 		if (unlikely(!d_can_lookup(nd->path.dentry))) {
2340 			if (nd->flags & LOOKUP_RCU) {
2341 				if (!try_to_unlazy(nd))
2342 					return -ECHILD;
2343 			}
2344 			return -ENOTDIR;
2345 		}
2346 	}
2347 }
2348 
2349 /* must be paired with terminate_walk() */
path_init(struct nameidata * nd,unsigned flags)2350 static const char *path_init(struct nameidata *nd, unsigned flags)
2351 {
2352 	int error;
2353 	const char *s = nd->name->name;
2354 
2355 	/* LOOKUP_CACHED requires RCU, ask caller to retry */
2356 	if ((flags & (LOOKUP_RCU | LOOKUP_CACHED)) == LOOKUP_CACHED)
2357 		return ERR_PTR(-EAGAIN);
2358 
2359 	if (!*s)
2360 		flags &= ~LOOKUP_RCU;
2361 	if (flags & LOOKUP_RCU)
2362 		rcu_read_lock();
2363 	else
2364 		nd->seq = nd->next_seq = 0;
2365 
2366 	nd->flags = flags;
2367 	nd->state |= ND_JUMPED;
2368 
2369 	nd->m_seq = __read_seqcount_begin(&mount_lock.seqcount);
2370 	nd->r_seq = __read_seqcount_begin(&rename_lock.seqcount);
2371 	smp_rmb();
2372 
2373 	if (nd->state & ND_ROOT_PRESET) {
2374 		struct dentry *root = nd->root.dentry;
2375 		struct inode *inode = root->d_inode;
2376 		if (*s && unlikely(!d_can_lookup(root)))
2377 			return ERR_PTR(-ENOTDIR);
2378 		nd->path = nd->root;
2379 		nd->inode = inode;
2380 		if (flags & LOOKUP_RCU) {
2381 			nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2382 			nd->root_seq = nd->seq;
2383 		} else {
2384 			path_get(&nd->path);
2385 		}
2386 		return s;
2387 	}
2388 
2389 	nd->root.mnt = NULL;
2390 
2391 	/* Absolute pathname -- fetch the root (LOOKUP_IN_ROOT uses nd->dfd). */
2392 	if (*s == '/' && !(flags & LOOKUP_IN_ROOT)) {
2393 		error = nd_jump_root(nd);
2394 		if (unlikely(error))
2395 			return ERR_PTR(error);
2396 		return s;
2397 	}
2398 
2399 	/* Relative pathname -- get the starting-point it is relative to. */
2400 	if (nd->dfd == AT_FDCWD) {
2401 		if (flags & LOOKUP_RCU) {
2402 			struct fs_struct *fs = current->fs;
2403 			unsigned seq;
2404 
2405 			do {
2406 				seq = read_seqcount_begin(&fs->seq);
2407 				nd->path = fs->pwd;
2408 				nd->inode = nd->path.dentry->d_inode;
2409 				nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2410 			} while (read_seqcount_retry(&fs->seq, seq));
2411 		} else {
2412 			get_fs_pwd(current->fs, &nd->path);
2413 			nd->inode = nd->path.dentry->d_inode;
2414 		}
2415 	} else {
2416 		/* Caller must check execute permissions on the starting path component */
2417 		struct fd f = fdget_raw(nd->dfd);
2418 		struct dentry *dentry;
2419 
2420 		if (!f.file)
2421 			return ERR_PTR(-EBADF);
2422 
2423 		dentry = f.file->f_path.dentry;
2424 
2425 		if (*s && unlikely(!d_can_lookup(dentry))) {
2426 			fdput(f);
2427 			return ERR_PTR(-ENOTDIR);
2428 		}
2429 
2430 		nd->path = f.file->f_path;
2431 		if (flags & LOOKUP_RCU) {
2432 			nd->inode = nd->path.dentry->d_inode;
2433 			nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2434 		} else {
2435 			path_get(&nd->path);
2436 			nd->inode = nd->path.dentry->d_inode;
2437 		}
2438 		fdput(f);
2439 	}
2440 
2441 	/* For scoped-lookups we need to set the root to the dirfd as well. */
2442 	if (flags & LOOKUP_IS_SCOPED) {
2443 		nd->root = nd->path;
2444 		if (flags & LOOKUP_RCU) {
2445 			nd->root_seq = nd->seq;
2446 		} else {
2447 			path_get(&nd->root);
2448 			nd->state |= ND_ROOT_GRABBED;
2449 		}
2450 	}
2451 	return s;
2452 }
2453 
lookup_last(struct nameidata * nd)2454 static inline const char *lookup_last(struct nameidata *nd)
2455 {
2456 	if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
2457 		nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2458 
2459 	return walk_component(nd, WALK_TRAILING);
2460 }
2461 
handle_lookup_down(struct nameidata * nd)2462 static int handle_lookup_down(struct nameidata *nd)
2463 {
2464 	if (!(nd->flags & LOOKUP_RCU))
2465 		dget(nd->path.dentry);
2466 	nd->next_seq = nd->seq;
2467 	return PTR_ERR(step_into(nd, WALK_NOFOLLOW, nd->path.dentry));
2468 }
2469 
2470 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
path_lookupat(struct nameidata * nd,unsigned flags,struct path * path)2471 static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2472 {
2473 	const char *s = path_init(nd, flags);
2474 	int err;
2475 
2476 	if (unlikely(flags & LOOKUP_DOWN) && !IS_ERR(s)) {
2477 		err = handle_lookup_down(nd);
2478 		if (unlikely(err < 0))
2479 			s = ERR_PTR(err);
2480 	}
2481 
2482 	while (!(err = link_path_walk(s, nd)) &&
2483 	       (s = lookup_last(nd)) != NULL)
2484 		;
2485 	if (!err && unlikely(nd->flags & LOOKUP_MOUNTPOINT)) {
2486 		err = handle_lookup_down(nd);
2487 		nd->state &= ~ND_JUMPED; // no d_weak_revalidate(), please...
2488 	}
2489 	if (!err)
2490 		err = complete_walk(nd);
2491 
2492 	if (!err && nd->flags & LOOKUP_DIRECTORY)
2493 		if (!d_can_lookup(nd->path.dentry))
2494 			err = -ENOTDIR;
2495 	if (!err) {
2496 		*path = nd->path;
2497 		nd->path.mnt = NULL;
2498 		nd->path.dentry = NULL;
2499 	}
2500 	terminate_walk(nd);
2501 	return err;
2502 }
2503 
filename_lookup(int dfd,struct filename * name,unsigned flags,struct path * path,struct path * root)2504 int filename_lookup(int dfd, struct filename *name, unsigned flags,
2505 		    struct path *path, struct path *root)
2506 {
2507 	int retval;
2508 	struct nameidata nd;
2509 	if (IS_ERR(name))
2510 		return PTR_ERR(name);
2511 	set_nameidata(&nd, dfd, name, root);
2512 	retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
2513 	if (unlikely(retval == -ECHILD))
2514 		retval = path_lookupat(&nd, flags, path);
2515 	if (unlikely(retval == -ESTALE))
2516 		retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
2517 
2518 	if (likely(!retval))
2519 		audit_inode(name, path->dentry,
2520 			    flags & LOOKUP_MOUNTPOINT ? AUDIT_INODE_NOEVAL : 0);
2521 	restore_nameidata();
2522 	return retval;
2523 }
2524 
2525 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
path_parentat(struct nameidata * nd,unsigned flags,struct path * parent)2526 static int path_parentat(struct nameidata *nd, unsigned flags,
2527 				struct path *parent)
2528 {
2529 	const char *s = path_init(nd, flags);
2530 	int err = link_path_walk(s, nd);
2531 	if (!err)
2532 		err = complete_walk(nd);
2533 	if (!err) {
2534 		*parent = nd->path;
2535 		nd->path.mnt = NULL;
2536 		nd->path.dentry = NULL;
2537 	}
2538 	terminate_walk(nd);
2539 	return err;
2540 }
2541 
2542 /* Note: this does not consume "name" */
__filename_parentat(int dfd,struct filename * name,unsigned int flags,struct path * parent,struct qstr * last,int * type,const struct path * root)2543 static int __filename_parentat(int dfd, struct filename *name,
2544 			       unsigned int flags, struct path *parent,
2545 			       struct qstr *last, int *type,
2546 			       const struct path *root)
2547 {
2548 	int retval;
2549 	struct nameidata nd;
2550 
2551 	if (IS_ERR(name))
2552 		return PTR_ERR(name);
2553 	set_nameidata(&nd, dfd, name, root);
2554 	retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
2555 	if (unlikely(retval == -ECHILD))
2556 		retval = path_parentat(&nd, flags, parent);
2557 	if (unlikely(retval == -ESTALE))
2558 		retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
2559 	if (likely(!retval)) {
2560 		*last = nd.last;
2561 		*type = nd.last_type;
2562 		audit_inode(name, parent->dentry, AUDIT_INODE_PARENT);
2563 	}
2564 	restore_nameidata();
2565 	return retval;
2566 }
2567 
filename_parentat(int dfd,struct filename * name,unsigned int flags,struct path * parent,struct qstr * last,int * type)2568 static int filename_parentat(int dfd, struct filename *name,
2569 			     unsigned int flags, struct path *parent,
2570 			     struct qstr *last, int *type)
2571 {
2572 	return __filename_parentat(dfd, name, flags, parent, last, type, NULL);
2573 }
2574 
2575 /* does lookup, returns the object with parent locked */
__kern_path_locked(struct filename * name,struct path * path)2576 static struct dentry *__kern_path_locked(struct filename *name, struct path *path)
2577 {
2578 	struct dentry *d;
2579 	struct qstr last;
2580 	int type, error;
2581 
2582 	error = filename_parentat(AT_FDCWD, name, 0, path, &last, &type);
2583 	if (error)
2584 		return ERR_PTR(error);
2585 	if (unlikely(type != LAST_NORM)) {
2586 		path_put(path);
2587 		return ERR_PTR(-EINVAL);
2588 	}
2589 	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
2590 	d = lookup_one_qstr_excl(&last, path->dentry, 0);
2591 	if (IS_ERR(d)) {
2592 		inode_unlock(path->dentry->d_inode);
2593 		path_put(path);
2594 	}
2595 	return d;
2596 }
2597 
kern_path_locked(const char * name,struct path * path)2598 struct dentry *kern_path_locked(const char *name, struct path *path)
2599 {
2600 	struct filename *filename = getname_kernel(name);
2601 	struct dentry *res = __kern_path_locked(filename, path);
2602 
2603 	putname(filename);
2604 	return res;
2605 }
2606 
kern_path(const char * name,unsigned int flags,struct path * path)2607 int kern_path(const char *name, unsigned int flags, struct path *path)
2608 {
2609 	struct filename *filename = getname_kernel(name);
2610 	int ret = filename_lookup(AT_FDCWD, filename, flags, path, NULL);
2611 
2612 	putname(filename);
2613 	return ret;
2614 
2615 }
2616 EXPORT_SYMBOL(kern_path);
2617 
2618 /**
2619  * vfs_path_parent_lookup - lookup a parent path relative to a dentry-vfsmount pair
2620  * @filename: filename structure
2621  * @flags: lookup flags
2622  * @parent: pointer to struct path to fill
2623  * @last: last component
2624  * @type: type of the last component
2625  * @root: pointer to struct path of the base directory
2626  */
vfs_path_parent_lookup(struct filename * filename,unsigned int flags,struct path * parent,struct qstr * last,int * type,const struct path * root)2627 int vfs_path_parent_lookup(struct filename *filename, unsigned int flags,
2628 			   struct path *parent, struct qstr *last, int *type,
2629 			   const struct path *root)
2630 {
2631 	return  __filename_parentat(AT_FDCWD, filename, flags, parent, last,
2632 				    type, root);
2633 }
2634 EXPORT_SYMBOL(vfs_path_parent_lookup);
2635 
2636 /**
2637  * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
2638  * @dentry:  pointer to dentry of the base directory
2639  * @mnt: pointer to vfs mount of the base directory
2640  * @name: pointer to file name
2641  * @flags: lookup flags
2642  * @path: pointer to struct path to fill
2643  */
vfs_path_lookup(struct dentry * dentry,struct vfsmount * mnt,const char * name,unsigned int flags,struct path * path)2644 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
2645 		    const char *name, unsigned int flags,
2646 		    struct path *path)
2647 {
2648 	struct filename *filename;
2649 	struct path root = {.mnt = mnt, .dentry = dentry};
2650 	int ret;
2651 
2652 	filename = getname_kernel(name);
2653 	/* the first argument of filename_lookup() is ignored with root */
2654 	ret = filename_lookup(AT_FDCWD, filename, flags, path, &root);
2655 	putname(filename);
2656 	return ret;
2657 }
2658 EXPORT_SYMBOL(vfs_path_lookup);
2659 
lookup_one_common(struct mnt_idmap * idmap,const char * name,struct dentry * base,int len,struct qstr * this)2660 static int lookup_one_common(struct mnt_idmap *idmap,
2661 			     const char *name, struct dentry *base, int len,
2662 			     struct qstr *this)
2663 {
2664 	this->name = name;
2665 	this->len = len;
2666 	this->hash = full_name_hash(base, name, len);
2667 	if (!len)
2668 		return -EACCES;
2669 
2670 	if (is_dot_dotdot(name, len))
2671 		return -EACCES;
2672 
2673 	while (len--) {
2674 		unsigned int c = *(const unsigned char *)name++;
2675 		if (c == '/' || c == '\0')
2676 			return -EACCES;
2677 	}
2678 	/*
2679 	 * See if the low-level filesystem might want
2680 	 * to use its own hash..
2681 	 */
2682 	if (base->d_flags & DCACHE_OP_HASH) {
2683 		int err = base->d_op->d_hash(base, this);
2684 		if (err < 0)
2685 			return err;
2686 	}
2687 
2688 	return inode_permission(idmap, base->d_inode, MAY_EXEC);
2689 }
2690 
2691 /**
2692  * try_lookup_one_len - filesystem helper to lookup single pathname component
2693  * @name:	pathname component to lookup
2694  * @base:	base directory to lookup from
2695  * @len:	maximum length @len should be interpreted to
2696  *
2697  * Look up a dentry by name in the dcache, returning NULL if it does not
2698  * currently exist.  The function does not try to create a dentry.
2699  *
2700  * Note that this routine is purely a helper for filesystem usage and should
2701  * not be called by generic code.
2702  *
2703  * The caller must hold base->i_mutex.
2704  */
try_lookup_one_len(const char * name,struct dentry * base,int len)2705 struct dentry *try_lookup_one_len(const char *name, struct dentry *base, int len)
2706 {
2707 	struct qstr this;
2708 	int err;
2709 
2710 	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2711 
2712 	err = lookup_one_common(&nop_mnt_idmap, name, base, len, &this);
2713 	if (err)
2714 		return ERR_PTR(err);
2715 
2716 	return lookup_dcache(&this, base, 0);
2717 }
2718 EXPORT_SYMBOL(try_lookup_one_len);
2719 
2720 /**
2721  * lookup_one_len - filesystem helper to lookup single pathname component
2722  * @name:	pathname component to lookup
2723  * @base:	base directory to lookup from
2724  * @len:	maximum length @len should be interpreted to
2725  *
2726  * Note that this routine is purely a helper for filesystem usage and should
2727  * not be called by generic code.
2728  *
2729  * The caller must hold base->i_mutex.
2730  */
lookup_one_len(const char * name,struct dentry * base,int len)2731 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
2732 {
2733 	struct dentry *dentry;
2734 	struct qstr this;
2735 	int err;
2736 
2737 	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2738 
2739 	err = lookup_one_common(&nop_mnt_idmap, name, base, len, &this);
2740 	if (err)
2741 		return ERR_PTR(err);
2742 
2743 	dentry = lookup_dcache(&this, base, 0);
2744 	return dentry ? dentry : __lookup_slow(&this, base, 0);
2745 }
2746 EXPORT_SYMBOL(lookup_one_len);
2747 
2748 /**
2749  * lookup_one - filesystem helper to lookup single pathname component
2750  * @idmap:	idmap of the mount the lookup is performed from
2751  * @name:	pathname component to lookup
2752  * @base:	base directory to lookup from
2753  * @len:	maximum length @len should be interpreted to
2754  *
2755  * Note that this routine is purely a helper for filesystem usage and should
2756  * not be called by generic code.
2757  *
2758  * The caller must hold base->i_mutex.
2759  */
lookup_one(struct mnt_idmap * idmap,const char * name,struct dentry * base,int len)2760 struct dentry *lookup_one(struct mnt_idmap *idmap, const char *name,
2761 			  struct dentry *base, int len)
2762 {
2763 	struct dentry *dentry;
2764 	struct qstr this;
2765 	int err;
2766 
2767 	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2768 
2769 	err = lookup_one_common(idmap, name, base, len, &this);
2770 	if (err)
2771 		return ERR_PTR(err);
2772 
2773 	dentry = lookup_dcache(&this, base, 0);
2774 	return dentry ? dentry : __lookup_slow(&this, base, 0);
2775 }
2776 EXPORT_SYMBOL(lookup_one);
2777 
2778 /**
2779  * lookup_one_unlocked - filesystem helper to lookup single pathname component
2780  * @idmap:	idmap of the mount the lookup is performed from
2781  * @name:	pathname component to lookup
2782  * @base:	base directory to lookup from
2783  * @len:	maximum length @len should be interpreted to
2784  *
2785  * Note that this routine is purely a helper for filesystem usage and should
2786  * not be called by generic code.
2787  *
2788  * Unlike lookup_one_len, it should be called without the parent
2789  * i_mutex held, and will take the i_mutex itself if necessary.
2790  */
lookup_one_unlocked(struct mnt_idmap * idmap,const char * name,struct dentry * base,int len)2791 struct dentry *lookup_one_unlocked(struct mnt_idmap *idmap,
2792 				   const char *name, struct dentry *base,
2793 				   int len)
2794 {
2795 	struct qstr this;
2796 	int err;
2797 	struct dentry *ret;
2798 
2799 	err = lookup_one_common(idmap, name, base, len, &this);
2800 	if (err)
2801 		return ERR_PTR(err);
2802 
2803 	ret = lookup_dcache(&this, base, 0);
2804 	if (!ret)
2805 		ret = lookup_slow(&this, base, 0);
2806 	return ret;
2807 }
2808 EXPORT_SYMBOL(lookup_one_unlocked);
2809 
2810 /**
2811  * lookup_one_positive_unlocked - filesystem helper to lookup single
2812  *				  pathname component
2813  * @idmap:	idmap of the mount the lookup is performed from
2814  * @name:	pathname component to lookup
2815  * @base:	base directory to lookup from
2816  * @len:	maximum length @len should be interpreted to
2817  *
2818  * This helper will yield ERR_PTR(-ENOENT) on negatives. The helper returns
2819  * known positive or ERR_PTR(). This is what most of the users want.
2820  *
2821  * Note that pinned negative with unlocked parent _can_ become positive at any
2822  * time, so callers of lookup_one_unlocked() need to be very careful; pinned
2823  * positives have >d_inode stable, so this one avoids such problems.
2824  *
2825  * Note that this routine is purely a helper for filesystem usage and should
2826  * not be called by generic code.
2827  *
2828  * The helper should be called without i_mutex held.
2829  */
lookup_one_positive_unlocked(struct mnt_idmap * idmap,const char * name,struct dentry * base,int len)2830 struct dentry *lookup_one_positive_unlocked(struct mnt_idmap *idmap,
2831 					    const char *name,
2832 					    struct dentry *base, int len)
2833 {
2834 	struct dentry *ret = lookup_one_unlocked(idmap, name, base, len);
2835 
2836 	if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) {
2837 		dput(ret);
2838 		ret = ERR_PTR(-ENOENT);
2839 	}
2840 	return ret;
2841 }
2842 EXPORT_SYMBOL(lookup_one_positive_unlocked);
2843 
2844 /**
2845  * lookup_one_len_unlocked - filesystem helper to lookup single pathname component
2846  * @name:	pathname component to lookup
2847  * @base:	base directory to lookup from
2848  * @len:	maximum length @len should be interpreted to
2849  *
2850  * Note that this routine is purely a helper for filesystem usage and should
2851  * not be called by generic code.
2852  *
2853  * Unlike lookup_one_len, it should be called without the parent
2854  * i_mutex held, and will take the i_mutex itself if necessary.
2855  */
lookup_one_len_unlocked(const char * name,struct dentry * base,int len)2856 struct dentry *lookup_one_len_unlocked(const char *name,
2857 				       struct dentry *base, int len)
2858 {
2859 	return lookup_one_unlocked(&nop_mnt_idmap, name, base, len);
2860 }
2861 EXPORT_SYMBOL(lookup_one_len_unlocked);
2862 
2863 /*
2864  * Like lookup_one_len_unlocked(), except that it yields ERR_PTR(-ENOENT)
2865  * on negatives.  Returns known positive or ERR_PTR(); that's what
2866  * most of the users want.  Note that pinned negative with unlocked parent
2867  * _can_ become positive at any time, so callers of lookup_one_len_unlocked()
2868  * need to be very careful; pinned positives have ->d_inode stable, so
2869  * this one avoids such problems.
2870  */
lookup_positive_unlocked(const char * name,struct dentry * base,int len)2871 struct dentry *lookup_positive_unlocked(const char *name,
2872 				       struct dentry *base, int len)
2873 {
2874 	return lookup_one_positive_unlocked(&nop_mnt_idmap, name, base, len);
2875 }
2876 EXPORT_SYMBOL(lookup_positive_unlocked);
2877 
2878 #ifdef CONFIG_UNIX98_PTYS
path_pts(struct path * path)2879 int path_pts(struct path *path)
2880 {
2881 	/* Find something mounted on "pts" in the same directory as
2882 	 * the input path.
2883 	 */
2884 	struct dentry *parent = dget_parent(path->dentry);
2885 	struct dentry *child;
2886 	struct qstr this = QSTR_INIT("pts", 3);
2887 
2888 	if (unlikely(!path_connected(path->mnt, parent))) {
2889 		dput(parent);
2890 		return -ENOENT;
2891 	}
2892 	dput(path->dentry);
2893 	path->dentry = parent;
2894 	child = d_hash_and_lookup(parent, &this);
2895 	if (IS_ERR_OR_NULL(child))
2896 		return -ENOENT;
2897 
2898 	path->dentry = child;
2899 	dput(parent);
2900 	follow_down(path, 0);
2901 	return 0;
2902 }
2903 #endif
2904 
user_path_at_empty(int dfd,const char __user * name,unsigned flags,struct path * path,int * empty)2905 int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
2906 		 struct path *path, int *empty)
2907 {
2908 	struct filename *filename = getname_flags(name, flags, empty);
2909 	int ret = filename_lookup(dfd, filename, flags, path, NULL);
2910 
2911 	putname(filename);
2912 	return ret;
2913 }
2914 EXPORT_SYMBOL(user_path_at_empty);
2915 
__check_sticky(struct mnt_idmap * idmap,struct inode * dir,struct inode * inode)2916 int __check_sticky(struct mnt_idmap *idmap, struct inode *dir,
2917 		   struct inode *inode)
2918 {
2919 	kuid_t fsuid = current_fsuid();
2920 
2921 	if (vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), fsuid))
2922 		return 0;
2923 	if (vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, dir), fsuid))
2924 		return 0;
2925 	return !capable_wrt_inode_uidgid(idmap, inode, CAP_FOWNER);
2926 }
2927 EXPORT_SYMBOL(__check_sticky);
2928 
2929 /*
2930  *	Check whether we can remove a link victim from directory dir, check
2931  *  whether the type of victim is right.
2932  *  1. We can't do it if dir is read-only (done in permission())
2933  *  2. We should have write and exec permissions on dir
2934  *  3. We can't remove anything from append-only dir
2935  *  4. We can't do anything with immutable dir (done in permission())
2936  *  5. If the sticky bit on dir is set we should either
2937  *	a. be owner of dir, or
2938  *	b. be owner of victim, or
2939  *	c. have CAP_FOWNER capability
2940  *  6. If the victim is append-only or immutable we can't do antyhing with
2941  *     links pointing to it.
2942  *  7. If the victim has an unknown uid or gid we can't change the inode.
2943  *  8. If we were asked to remove a directory and victim isn't one - ENOTDIR.
2944  *  9. If we were asked to remove a non-directory and victim isn't one - EISDIR.
2945  * 10. We can't remove a root or mountpoint.
2946  * 11. We don't allow removal of NFS sillyrenamed files; it's handled by
2947  *     nfs_async_unlink().
2948  */
may_delete(struct mnt_idmap * idmap,struct inode * dir,struct dentry * victim,bool isdir)2949 static int may_delete(struct mnt_idmap *idmap, struct inode *dir,
2950 		      struct dentry *victim, bool isdir)
2951 {
2952 	struct inode *inode = d_backing_inode(victim);
2953 	int error;
2954 
2955 	if (d_is_negative(victim))
2956 		return -ENOENT;
2957 	BUG_ON(!inode);
2958 
2959 	BUG_ON(victim->d_parent->d_inode != dir);
2960 
2961 	/* Inode writeback is not safe when the uid or gid are invalid. */
2962 	if (!vfsuid_valid(i_uid_into_vfsuid(idmap, inode)) ||
2963 	    !vfsgid_valid(i_gid_into_vfsgid(idmap, inode)))
2964 		return -EOVERFLOW;
2965 
2966 	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2967 
2968 	error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC);
2969 	if (error)
2970 		return error;
2971 	if (IS_APPEND(dir))
2972 		return -EPERM;
2973 
2974 	if (check_sticky(idmap, dir, inode) || IS_APPEND(inode) ||
2975 	    IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) ||
2976 	    HAS_UNMAPPED_ID(idmap, inode))
2977 		return -EPERM;
2978 	if (isdir) {
2979 		if (!d_is_dir(victim))
2980 			return -ENOTDIR;
2981 		if (IS_ROOT(victim))
2982 			return -EBUSY;
2983 	} else if (d_is_dir(victim))
2984 		return -EISDIR;
2985 	if (IS_DEADDIR(dir))
2986 		return -ENOENT;
2987 	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
2988 		return -EBUSY;
2989 	return 0;
2990 }
2991 
2992 /*	Check whether we can create an object with dentry child in directory
2993  *  dir.
2994  *  1. We can't do it if child already exists (open has special treatment for
2995  *     this case, but since we are inlined it's OK)
2996  *  2. We can't do it if dir is read-only (done in permission())
2997  *  3. We can't do it if the fs can't represent the fsuid or fsgid.
2998  *  4. We should have write and exec permissions on dir
2999  *  5. We can't do it if dir is immutable (done in permission())
3000  */
may_create(struct mnt_idmap * idmap,struct inode * dir,struct dentry * child)3001 static inline int may_create(struct mnt_idmap *idmap,
3002 			     struct inode *dir, struct dentry *child)
3003 {
3004 	audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
3005 	if (child->d_inode)
3006 		return -EEXIST;
3007 	if (IS_DEADDIR(dir))
3008 		return -ENOENT;
3009 	if (!fsuidgid_has_mapping(dir->i_sb, idmap))
3010 		return -EOVERFLOW;
3011 
3012 	return inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC);
3013 }
3014 
lock_two_directories(struct dentry * p1,struct dentry * p2)3015 static struct dentry *lock_two_directories(struct dentry *p1, struct dentry *p2)
3016 {
3017 	struct dentry *p;
3018 
3019 	p = d_ancestor(p2, p1);
3020 	if (p) {
3021 		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
3022 		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT2);
3023 		return p;
3024 	}
3025 
3026 	p = d_ancestor(p1, p2);
3027 	inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
3028 	inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
3029 	return p;
3030 }
3031 
3032 /*
3033  * p1 and p2 should be directories on the same fs.
3034  */
lock_rename(struct dentry * p1,struct dentry * p2)3035 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
3036 {
3037 	if (p1 == p2) {
3038 		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
3039 		return NULL;
3040 	}
3041 
3042 	mutex_lock(&p1->d_sb->s_vfs_rename_mutex);
3043 	return lock_two_directories(p1, p2);
3044 }
3045 EXPORT_SYMBOL(lock_rename);
3046 
3047 /*
3048  * c1 and p2 should be on the same fs.
3049  */
lock_rename_child(struct dentry * c1,struct dentry * p2)3050 struct dentry *lock_rename_child(struct dentry *c1, struct dentry *p2)
3051 {
3052 	if (READ_ONCE(c1->d_parent) == p2) {
3053 		/*
3054 		 * hopefully won't need to touch ->s_vfs_rename_mutex at all.
3055 		 */
3056 		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
3057 		/*
3058 		 * now that p2 is locked, nobody can move in or out of it,
3059 		 * so the test below is safe.
3060 		 */
3061 		if (likely(c1->d_parent == p2))
3062 			return NULL;
3063 
3064 		/*
3065 		 * c1 got moved out of p2 while we'd been taking locks;
3066 		 * unlock and fall back to slow case.
3067 		 */
3068 		inode_unlock(p2->d_inode);
3069 	}
3070 
3071 	mutex_lock(&c1->d_sb->s_vfs_rename_mutex);
3072 	/*
3073 	 * nobody can move out of any directories on this fs.
3074 	 */
3075 	if (likely(c1->d_parent != p2))
3076 		return lock_two_directories(c1->d_parent, p2);
3077 
3078 	/*
3079 	 * c1 got moved into p2 while we were taking locks;
3080 	 * we need p2 locked and ->s_vfs_rename_mutex unlocked,
3081 	 * for consistency with lock_rename().
3082 	 */
3083 	inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
3084 	mutex_unlock(&c1->d_sb->s_vfs_rename_mutex);
3085 	return NULL;
3086 }
3087 EXPORT_SYMBOL(lock_rename_child);
3088 
unlock_rename(struct dentry * p1,struct dentry * p2)3089 void unlock_rename(struct dentry *p1, struct dentry *p2)
3090 {
3091 	inode_unlock(p1->d_inode);
3092 	if (p1 != p2) {
3093 		inode_unlock(p2->d_inode);
3094 		mutex_unlock(&p1->d_sb->s_vfs_rename_mutex);
3095 	}
3096 }
3097 EXPORT_SYMBOL(unlock_rename);
3098 
3099 /**
3100  * mode_strip_umask - handle vfs umask stripping
3101  * @dir:	parent directory of the new inode
3102  * @mode:	mode of the new inode to be created in @dir
3103  *
3104  * Umask stripping depends on whether or not the filesystem supports POSIX
3105  * ACLs. If the filesystem doesn't support it umask stripping is done directly
3106  * in here. If the filesystem does support POSIX ACLs umask stripping is
3107  * deferred until the filesystem calls posix_acl_create().
3108  *
3109  * Returns: mode
3110  */
mode_strip_umask(const struct inode * dir,umode_t mode)3111 static inline umode_t mode_strip_umask(const struct inode *dir, umode_t mode)
3112 {
3113 	if (!IS_POSIXACL(dir))
3114 		mode &= ~current_umask();
3115 	return mode;
3116 }
3117 
3118 /**
3119  * vfs_prepare_mode - prepare the mode to be used for a new inode
3120  * @idmap:	idmap of the mount the inode was found from
3121  * @dir:	parent directory of the new inode
3122  * @mode:	mode of the new inode
3123  * @mask_perms:	allowed permission by the vfs
3124  * @type:	type of file to be created
3125  *
3126  * This helper consolidates and enforces vfs restrictions on the @mode of a new
3127  * object to be created.
3128  *
3129  * Umask stripping depends on whether the filesystem supports POSIX ACLs (see
3130  * the kernel documentation for mode_strip_umask()). Moving umask stripping
3131  * after setgid stripping allows the same ordering for both non-POSIX ACL and
3132  * POSIX ACL supporting filesystems.
3133  *
3134  * Note that it's currently valid for @type to be 0 if a directory is created.
3135  * Filesystems raise that flag individually and we need to check whether each
3136  * filesystem can deal with receiving S_IFDIR from the vfs before we enforce a
3137  * non-zero type.
3138  *
3139  * Returns: mode to be passed to the filesystem
3140  */
vfs_prepare_mode(struct mnt_idmap * idmap,const struct inode * dir,umode_t mode,umode_t mask_perms,umode_t type)3141 static inline umode_t vfs_prepare_mode(struct mnt_idmap *idmap,
3142 				       const struct inode *dir, umode_t mode,
3143 				       umode_t mask_perms, umode_t type)
3144 {
3145 	mode = mode_strip_sgid(idmap, dir, mode);
3146 	mode = mode_strip_umask(dir, mode);
3147 
3148 	/*
3149 	 * Apply the vfs mandated allowed permission mask and set the type of
3150 	 * file to be created before we call into the filesystem.
3151 	 */
3152 	mode &= (mask_perms & ~S_IFMT);
3153 	mode |= (type & S_IFMT);
3154 
3155 	return mode;
3156 }
3157 
3158 /**
3159  * vfs_create - create new file
3160  * @idmap:	idmap of the mount the inode was found from
3161  * @dir:	inode of @dentry
3162  * @dentry:	pointer to dentry of the base directory
3163  * @mode:	mode of the new file
3164  * @want_excl:	whether the file must not yet exist
3165  *
3166  * Create a new file.
3167  *
3168  * If the inode has been found through an idmapped mount the idmap of
3169  * the vfsmount must be passed through @idmap. This function will then take
3170  * care to map the inode according to @idmap before checking permissions.
3171  * On non-idmapped mounts or if permission checking is to be performed on the
3172  * raw inode simply passs @nop_mnt_idmap.
3173  */
vfs_create(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry,umode_t mode,bool want_excl)3174 int vfs_create(struct mnt_idmap *idmap, struct inode *dir,
3175 	       struct dentry *dentry, umode_t mode, bool want_excl)
3176 {
3177 	int error;
3178 
3179 	error = may_create(idmap, dir, dentry);
3180 	if (error)
3181 		return error;
3182 
3183 	if (!dir->i_op->create)
3184 		return -EACCES;	/* shouldn't it be ENOSYS? */
3185 
3186 	mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG);
3187 	error = security_inode_create(dir, dentry, mode);
3188 	if (error)
3189 		return error;
3190 	error = dir->i_op->create(idmap, dir, dentry, mode, want_excl);
3191 	if (!error)
3192 		fsnotify_create(dir, dentry);
3193 	return error;
3194 }
3195 EXPORT_SYMBOL(vfs_create);
3196 
vfs_mkobj(struct dentry * dentry,umode_t mode,int (* f)(struct dentry *,umode_t,void *),void * arg)3197 int vfs_mkobj(struct dentry *dentry, umode_t mode,
3198 		int (*f)(struct dentry *, umode_t, void *),
3199 		void *arg)
3200 {
3201 	struct inode *dir = dentry->d_parent->d_inode;
3202 	int error = may_create(&nop_mnt_idmap, dir, dentry);
3203 	if (error)
3204 		return error;
3205 
3206 	mode &= S_IALLUGO;
3207 	mode |= S_IFREG;
3208 	error = security_inode_create(dir, dentry, mode);
3209 	if (error)
3210 		return error;
3211 	error = f(dentry, mode, arg);
3212 	if (!error)
3213 		fsnotify_create(dir, dentry);
3214 	return error;
3215 }
3216 EXPORT_SYMBOL(vfs_mkobj);
3217 
may_open_dev(const struct path * path)3218 bool may_open_dev(const struct path *path)
3219 {
3220 	return !(path->mnt->mnt_flags & MNT_NODEV) &&
3221 		!(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
3222 }
3223 
may_open(struct mnt_idmap * idmap,const struct path * path,int acc_mode,int flag)3224 static int may_open(struct mnt_idmap *idmap, const struct path *path,
3225 		    int acc_mode, int flag)
3226 {
3227 	struct dentry *dentry = path->dentry;
3228 	struct inode *inode = dentry->d_inode;
3229 	int error;
3230 
3231 	if (!inode)
3232 		return -ENOENT;
3233 
3234 	switch (inode->i_mode & S_IFMT) {
3235 	case S_IFLNK:
3236 		return -ELOOP;
3237 	case S_IFDIR:
3238 		if (acc_mode & MAY_WRITE)
3239 			return -EISDIR;
3240 		if (acc_mode & MAY_EXEC)
3241 			return -EACCES;
3242 		break;
3243 	case S_IFBLK:
3244 	case S_IFCHR:
3245 		if (!may_open_dev(path))
3246 			return -EACCES;
3247 		fallthrough;
3248 	case S_IFIFO:
3249 	case S_IFSOCK:
3250 		if (acc_mode & MAY_EXEC)
3251 			return -EACCES;
3252 		flag &= ~O_TRUNC;
3253 		break;
3254 	case S_IFREG:
3255 		if ((acc_mode & MAY_EXEC) && path_noexec(path))
3256 			return -EACCES;
3257 		break;
3258 	}
3259 
3260 	error = inode_permission(idmap, inode, MAY_OPEN | acc_mode);
3261 	if (error)
3262 		return error;
3263 
3264 	/*
3265 	 * An append-only file must be opened in append mode for writing.
3266 	 */
3267 	if (IS_APPEND(inode)) {
3268 		if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
3269 			return -EPERM;
3270 		if (flag & O_TRUNC)
3271 			return -EPERM;
3272 	}
3273 
3274 	/* O_NOATIME can only be set by the owner or superuser */
3275 	if (flag & O_NOATIME && !inode_owner_or_capable(idmap, inode))
3276 		return -EPERM;
3277 
3278 	return 0;
3279 }
3280 
handle_truncate(struct mnt_idmap * idmap,struct file * filp)3281 static int handle_truncate(struct mnt_idmap *idmap, struct file *filp)
3282 {
3283 	const struct path *path = &filp->f_path;
3284 	struct inode *inode = path->dentry->d_inode;
3285 	int error = get_write_access(inode);
3286 	if (error)
3287 		return error;
3288 
3289 	error = security_file_truncate(filp);
3290 	if (!error) {
3291 		error = do_truncate(idmap, path->dentry, 0,
3292 				    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
3293 				    filp);
3294 	}
3295 	put_write_access(inode);
3296 	return error;
3297 }
3298 
open_to_namei_flags(int flag)3299 static inline int open_to_namei_flags(int flag)
3300 {
3301 	if ((flag & O_ACCMODE) == 3)
3302 		flag--;
3303 	return flag;
3304 }
3305 
may_o_create(struct mnt_idmap * idmap,const struct path * dir,struct dentry * dentry,umode_t mode)3306 static int may_o_create(struct mnt_idmap *idmap,
3307 			const struct path *dir, struct dentry *dentry,
3308 			umode_t mode)
3309 {
3310 	int error = security_path_mknod(dir, dentry, mode, 0);
3311 	if (error)
3312 		return error;
3313 
3314 	if (!fsuidgid_has_mapping(dir->dentry->d_sb, idmap))
3315 		return -EOVERFLOW;
3316 
3317 	error = inode_permission(idmap, dir->dentry->d_inode,
3318 				 MAY_WRITE | MAY_EXEC);
3319 	if (error)
3320 		return error;
3321 
3322 	return security_inode_create(dir->dentry->d_inode, dentry, mode);
3323 }
3324 
3325 /*
3326  * Attempt to atomically look up, create and open a file from a negative
3327  * dentry.
3328  *
3329  * Returns 0 if successful.  The file will have been created and attached to
3330  * @file by the filesystem calling finish_open().
3331  *
3332  * If the file was looked up only or didn't need creating, FMODE_OPENED won't
3333  * be set.  The caller will need to perform the open themselves.  @path will
3334  * have been updated to point to the new dentry.  This may be negative.
3335  *
3336  * Returns an error code otherwise.
3337  */
atomic_open(struct nameidata * nd,struct dentry * dentry,struct file * file,int open_flag,umode_t mode)3338 static struct dentry *atomic_open(struct nameidata *nd, struct dentry *dentry,
3339 				  struct file *file,
3340 				  int open_flag, umode_t mode)
3341 {
3342 	struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
3343 	struct inode *dir =  nd->path.dentry->d_inode;
3344 	int error;
3345 
3346 	if (nd->flags & LOOKUP_DIRECTORY)
3347 		open_flag |= O_DIRECTORY;
3348 
3349 	file->f_path.dentry = DENTRY_NOT_SET;
3350 	file->f_path.mnt = nd->path.mnt;
3351 	error = dir->i_op->atomic_open(dir, dentry, file,
3352 				       open_to_namei_flags(open_flag), mode);
3353 	d_lookup_done(dentry);
3354 	if (!error) {
3355 		if (file->f_mode & FMODE_OPENED) {
3356 			if (unlikely(dentry != file->f_path.dentry)) {
3357 				dput(dentry);
3358 				dentry = dget(file->f_path.dentry);
3359 			}
3360 		} else if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
3361 			error = -EIO;
3362 		} else {
3363 			if (file->f_path.dentry) {
3364 				dput(dentry);
3365 				dentry = file->f_path.dentry;
3366 			}
3367 			if (unlikely(d_is_negative(dentry)))
3368 				error = -ENOENT;
3369 		}
3370 	}
3371 	if (error) {
3372 		dput(dentry);
3373 		dentry = ERR_PTR(error);
3374 	}
3375 	return dentry;
3376 }
3377 
3378 /*
3379  * Look up and maybe create and open the last component.
3380  *
3381  * Must be called with parent locked (exclusive in O_CREAT case).
3382  *
3383  * Returns 0 on success, that is, if
3384  *  the file was successfully atomically created (if necessary) and opened, or
3385  *  the file was not completely opened at this time, though lookups and
3386  *  creations were performed.
3387  * These case are distinguished by presence of FMODE_OPENED on file->f_mode.
3388  * In the latter case dentry returned in @path might be negative if O_CREAT
3389  * hadn't been specified.
3390  *
3391  * An error code is returned on failure.
3392  */
lookup_open(struct nameidata * nd,struct file * file,const struct open_flags * op,bool got_write)3393 static struct dentry *lookup_open(struct nameidata *nd, struct file *file,
3394 				  const struct open_flags *op,
3395 				  bool got_write)
3396 {
3397 	struct mnt_idmap *idmap;
3398 	struct dentry *dir = nd->path.dentry;
3399 	struct inode *dir_inode = dir->d_inode;
3400 	int open_flag = op->open_flag;
3401 	struct dentry *dentry;
3402 	int error, create_error = 0;
3403 	umode_t mode = op->mode;
3404 	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
3405 
3406 	if (unlikely(IS_DEADDIR(dir_inode)))
3407 		return ERR_PTR(-ENOENT);
3408 
3409 	file->f_mode &= ~FMODE_CREATED;
3410 	dentry = d_lookup(dir, &nd->last);
3411 	for (;;) {
3412 		if (!dentry) {
3413 			dentry = d_alloc_parallel(dir, &nd->last, &wq);
3414 			if (IS_ERR(dentry))
3415 				return dentry;
3416 		}
3417 		if (d_in_lookup(dentry))
3418 			break;
3419 
3420 		error = d_revalidate(dentry, nd->flags);
3421 		if (likely(error > 0))
3422 			break;
3423 		if (error)
3424 			goto out_dput;
3425 		d_invalidate(dentry);
3426 		dput(dentry);
3427 		dentry = NULL;
3428 	}
3429 	if (dentry->d_inode) {
3430 		/* Cached positive dentry: will open in f_op->open */
3431 		return dentry;
3432 	}
3433 
3434 	/*
3435 	 * Checking write permission is tricky, bacuse we don't know if we are
3436 	 * going to actually need it: O_CREAT opens should work as long as the
3437 	 * file exists.  But checking existence breaks atomicity.  The trick is
3438 	 * to check access and if not granted clear O_CREAT from the flags.
3439 	 *
3440 	 * Another problem is returing the "right" error value (e.g. for an
3441 	 * O_EXCL open we want to return EEXIST not EROFS).
3442 	 */
3443 	if (unlikely(!got_write))
3444 		open_flag &= ~O_TRUNC;
3445 	idmap = mnt_idmap(nd->path.mnt);
3446 	if (open_flag & O_CREAT) {
3447 		if (open_flag & O_EXCL)
3448 			open_flag &= ~O_TRUNC;
3449 		mode = vfs_prepare_mode(idmap, dir->d_inode, mode, mode, mode);
3450 		if (likely(got_write))
3451 			create_error = may_o_create(idmap, &nd->path,
3452 						    dentry, mode);
3453 		else
3454 			create_error = -EROFS;
3455 	}
3456 	if (create_error)
3457 		open_flag &= ~O_CREAT;
3458 	if (dir_inode->i_op->atomic_open) {
3459 		dentry = atomic_open(nd, dentry, file, open_flag, mode);
3460 		if (unlikely(create_error) && dentry == ERR_PTR(-ENOENT))
3461 			dentry = ERR_PTR(create_error);
3462 		return dentry;
3463 	}
3464 
3465 	if (d_in_lookup(dentry)) {
3466 		struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry,
3467 							     nd->flags);
3468 		d_lookup_done(dentry);
3469 		if (unlikely(res)) {
3470 			if (IS_ERR(res)) {
3471 				error = PTR_ERR(res);
3472 				goto out_dput;
3473 			}
3474 			dput(dentry);
3475 			dentry = res;
3476 		}
3477 	}
3478 
3479 	/* Negative dentry, just create the file */
3480 	if (!dentry->d_inode && (open_flag & O_CREAT)) {
3481 		file->f_mode |= FMODE_CREATED;
3482 		audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
3483 		if (!dir_inode->i_op->create) {
3484 			error = -EACCES;
3485 			goto out_dput;
3486 		}
3487 
3488 		error = dir_inode->i_op->create(idmap, dir_inode, dentry,
3489 						mode, open_flag & O_EXCL);
3490 		if (error)
3491 			goto out_dput;
3492 	}
3493 	if (unlikely(create_error) && !dentry->d_inode) {
3494 		error = create_error;
3495 		goto out_dput;
3496 	}
3497 	return dentry;
3498 
3499 out_dput:
3500 	dput(dentry);
3501 	return ERR_PTR(error);
3502 }
3503 
open_last_lookups(struct nameidata * nd,struct file * file,const struct open_flags * op)3504 static const char *open_last_lookups(struct nameidata *nd,
3505 		   struct file *file, const struct open_flags *op)
3506 {
3507 	struct dentry *dir = nd->path.dentry;
3508 	int open_flag = op->open_flag;
3509 	bool got_write = false;
3510 	struct dentry *dentry;
3511 	const char *res;
3512 
3513 	nd->flags |= op->intent;
3514 
3515 	if (nd->last_type != LAST_NORM) {
3516 		if (nd->depth)
3517 			put_link(nd);
3518 		return handle_dots(nd, nd->last_type);
3519 	}
3520 
3521 	if (!(open_flag & O_CREAT)) {
3522 		if (nd->last.name[nd->last.len])
3523 			nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
3524 		/* we _can_ be in RCU mode here */
3525 		dentry = lookup_fast(nd);
3526 		if (IS_ERR(dentry))
3527 			return ERR_CAST(dentry);
3528 		if (likely(dentry))
3529 			goto finish_lookup;
3530 
3531 		BUG_ON(nd->flags & LOOKUP_RCU);
3532 	} else {
3533 		/* create side of things */
3534 		if (nd->flags & LOOKUP_RCU) {
3535 			if (!try_to_unlazy(nd))
3536 				return ERR_PTR(-ECHILD);
3537 		}
3538 		audit_inode(nd->name, dir, AUDIT_INODE_PARENT);
3539 		/* trailing slashes? */
3540 		if (unlikely(nd->last.name[nd->last.len]))
3541 			return ERR_PTR(-EISDIR);
3542 	}
3543 
3544 	if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
3545 		got_write = !mnt_want_write(nd->path.mnt);
3546 		/*
3547 		 * do _not_ fail yet - we might not need that or fail with
3548 		 * a different error; let lookup_open() decide; we'll be
3549 		 * dropping this one anyway.
3550 		 */
3551 	}
3552 	if (open_flag & O_CREAT)
3553 		inode_lock(dir->d_inode);
3554 	else
3555 		inode_lock_shared(dir->d_inode);
3556 	dentry = lookup_open(nd, file, op, got_write);
3557 	if (!IS_ERR(dentry) && (file->f_mode & FMODE_CREATED))
3558 		fsnotify_create(dir->d_inode, dentry);
3559 	if (open_flag & O_CREAT)
3560 		inode_unlock(dir->d_inode);
3561 	else
3562 		inode_unlock_shared(dir->d_inode);
3563 
3564 	if (got_write)
3565 		mnt_drop_write(nd->path.mnt);
3566 
3567 	if (IS_ERR(dentry))
3568 		return ERR_CAST(dentry);
3569 
3570 	if (file->f_mode & (FMODE_OPENED | FMODE_CREATED)) {
3571 		dput(nd->path.dentry);
3572 		nd->path.dentry = dentry;
3573 		return NULL;
3574 	}
3575 
3576 finish_lookup:
3577 	if (nd->depth)
3578 		put_link(nd);
3579 	res = step_into(nd, WALK_TRAILING, dentry);
3580 	if (unlikely(res))
3581 		nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3582 	return res;
3583 }
3584 
3585 /*
3586  * Handle the last step of open()
3587  */
do_open(struct nameidata * nd,struct file * file,const struct open_flags * op)3588 static int do_open(struct nameidata *nd,
3589 		   struct file *file, const struct open_flags *op)
3590 {
3591 	struct mnt_idmap *idmap;
3592 	int open_flag = op->open_flag;
3593 	bool do_truncate;
3594 	int acc_mode;
3595 	int error;
3596 
3597 	if (!(file->f_mode & (FMODE_OPENED | FMODE_CREATED))) {
3598 		error = complete_walk(nd);
3599 		if (error)
3600 			return error;
3601 	}
3602 	if (!(file->f_mode & FMODE_CREATED))
3603 		audit_inode(nd->name, nd->path.dentry, 0);
3604 	idmap = mnt_idmap(nd->path.mnt);
3605 	if (open_flag & O_CREAT) {
3606 		if ((open_flag & O_EXCL) && !(file->f_mode & FMODE_CREATED))
3607 			return -EEXIST;
3608 		if (d_is_dir(nd->path.dentry))
3609 			return -EISDIR;
3610 		error = may_create_in_sticky(idmap, nd,
3611 					     d_backing_inode(nd->path.dentry));
3612 		if (unlikely(error))
3613 			return error;
3614 	}
3615 	if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
3616 		return -ENOTDIR;
3617 
3618 	do_truncate = false;
3619 	acc_mode = op->acc_mode;
3620 	if (file->f_mode & FMODE_CREATED) {
3621 		/* Don't check for write permission, don't truncate */
3622 		open_flag &= ~O_TRUNC;
3623 		acc_mode = 0;
3624 	} else if (d_is_reg(nd->path.dentry) && open_flag & O_TRUNC) {
3625 		error = mnt_want_write(nd->path.mnt);
3626 		if (error)
3627 			return error;
3628 		do_truncate = true;
3629 	}
3630 	error = may_open(idmap, &nd->path, acc_mode, open_flag);
3631 	if (!error && !(file->f_mode & FMODE_OPENED))
3632 		error = vfs_open(&nd->path, file);
3633 	if (!error)
3634 		error = ima_file_check(file, op->acc_mode);
3635 	if (!error && do_truncate)
3636 		error = handle_truncate(idmap, file);
3637 	if (unlikely(error > 0)) {
3638 		WARN_ON(1);
3639 		error = -EINVAL;
3640 	}
3641 	if (do_truncate)
3642 		mnt_drop_write(nd->path.mnt);
3643 	return error;
3644 }
3645 
3646 /**
3647  * vfs_tmpfile - create tmpfile
3648  * @idmap:	idmap of the mount the inode was found from
3649  * @parentpath:	pointer to the path of the base directory
3650  * @file:	file descriptor of the new tmpfile
3651  * @mode:	mode of the new tmpfile
3652  *
3653  * Create a temporary file.
3654  *
3655  * If the inode has been found through an idmapped mount the idmap of
3656  * the vfsmount must be passed through @idmap. This function will then take
3657  * care to map the inode according to @idmap before checking permissions.
3658  * On non-idmapped mounts or if permission checking is to be performed on the
3659  * raw inode simply passs @nop_mnt_idmap.
3660  */
vfs_tmpfile(struct mnt_idmap * idmap,const struct path * parentpath,struct file * file,umode_t mode)3661 static int vfs_tmpfile(struct mnt_idmap *idmap,
3662 		       const struct path *parentpath,
3663 		       struct file *file, umode_t mode)
3664 {
3665 	struct dentry *child;
3666 	struct inode *dir = d_inode(parentpath->dentry);
3667 	struct inode *inode;
3668 	int error;
3669 	int open_flag = file->f_flags;
3670 
3671 	/* we want directory to be writable */
3672 	error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC);
3673 	if (error)
3674 		return error;
3675 	if (!dir->i_op->tmpfile)
3676 		return -EOPNOTSUPP;
3677 	child = d_alloc(parentpath->dentry, &slash_name);
3678 	if (unlikely(!child))
3679 		return -ENOMEM;
3680 	file->f_path.mnt = parentpath->mnt;
3681 	file->f_path.dentry = child;
3682 	mode = vfs_prepare_mode(idmap, dir, mode, mode, mode);
3683 	error = dir->i_op->tmpfile(idmap, dir, file, mode);
3684 	dput(child);
3685 	if (error)
3686 		return error;
3687 	/* Don't check for other permissions, the inode was just created */
3688 	error = may_open(idmap, &file->f_path, 0, file->f_flags);
3689 	if (error)
3690 		return error;
3691 	inode = file_inode(file);
3692 	if (!(open_flag & O_EXCL)) {
3693 		spin_lock(&inode->i_lock);
3694 		inode->i_state |= I_LINKABLE;
3695 		spin_unlock(&inode->i_lock);
3696 	}
3697 	ima_post_create_tmpfile(idmap, inode);
3698 	return 0;
3699 }
3700 
3701 /**
3702  * kernel_tmpfile_open - open a tmpfile for kernel internal use
3703  * @idmap:	idmap of the mount the inode was found from
3704  * @parentpath:	path of the base directory
3705  * @mode:	mode of the new tmpfile
3706  * @open_flag:	flags
3707  * @cred:	credentials for open
3708  *
3709  * Create and open a temporary file.  The file is not accounted in nr_files,
3710  * hence this is only for kernel internal use, and must not be installed into
3711  * file tables or such.
3712  */
kernel_tmpfile_open(struct mnt_idmap * idmap,const struct path * parentpath,umode_t mode,int open_flag,const struct cred * cred)3713 struct file *kernel_tmpfile_open(struct mnt_idmap *idmap,
3714 				 const struct path *parentpath,
3715 				 umode_t mode, int open_flag,
3716 				 const struct cred *cred)
3717 {
3718 	struct file *file;
3719 	int error;
3720 
3721 	file = alloc_empty_file_noaccount(open_flag, cred);
3722 	if (IS_ERR(file))
3723 		return file;
3724 
3725 	error = vfs_tmpfile(idmap, parentpath, file, mode);
3726 	if (error) {
3727 		fput(file);
3728 		file = ERR_PTR(error);
3729 	}
3730 	return file;
3731 }
3732 EXPORT_SYMBOL(kernel_tmpfile_open);
3733 
do_tmpfile(struct nameidata * nd,unsigned flags,const struct open_flags * op,struct file * file)3734 static int do_tmpfile(struct nameidata *nd, unsigned flags,
3735 		const struct open_flags *op,
3736 		struct file *file)
3737 {
3738 	struct path path;
3739 	int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
3740 
3741 	if (unlikely(error))
3742 		return error;
3743 	error = mnt_want_write(path.mnt);
3744 	if (unlikely(error))
3745 		goto out;
3746 	error = vfs_tmpfile(mnt_idmap(path.mnt), &path, file, op->mode);
3747 	if (error)
3748 		goto out2;
3749 	audit_inode(nd->name, file->f_path.dentry, 0);
3750 out2:
3751 	mnt_drop_write(path.mnt);
3752 out:
3753 	path_put(&path);
3754 	return error;
3755 }
3756 
do_o_path(struct nameidata * nd,unsigned flags,struct file * file)3757 static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file)
3758 {
3759 	struct path path;
3760 	int error = path_lookupat(nd, flags, &path);
3761 	if (!error) {
3762 		audit_inode(nd->name, path.dentry, 0);
3763 		error = vfs_open(&path, file);
3764 		path_put(&path);
3765 	}
3766 	return error;
3767 }
3768 
path_openat(struct nameidata * nd,const struct open_flags * op,unsigned flags)3769 static struct file *path_openat(struct nameidata *nd,
3770 			const struct open_flags *op, unsigned flags)
3771 {
3772 	struct file *file;
3773 	int error;
3774 
3775 	file = alloc_empty_file(op->open_flag, current_cred());
3776 	if (IS_ERR(file))
3777 		return file;
3778 
3779 	if (unlikely(file->f_flags & __O_TMPFILE)) {
3780 		error = do_tmpfile(nd, flags, op, file);
3781 	} else if (unlikely(file->f_flags & O_PATH)) {
3782 		error = do_o_path(nd, flags, file);
3783 	} else {
3784 		const char *s = path_init(nd, flags);
3785 		while (!(error = link_path_walk(s, nd)) &&
3786 		       (s = open_last_lookups(nd, file, op)) != NULL)
3787 			;
3788 		if (!error)
3789 			error = do_open(nd, file, op);
3790 		terminate_walk(nd);
3791 	}
3792 	if (likely(!error)) {
3793 		if (likely(file->f_mode & FMODE_OPENED))
3794 			return file;
3795 		WARN_ON(1);
3796 		error = -EINVAL;
3797 	}
3798 	fput(file);
3799 	if (error == -EOPENSTALE) {
3800 		if (flags & LOOKUP_RCU)
3801 			error = -ECHILD;
3802 		else
3803 			error = -ESTALE;
3804 	}
3805 	return ERR_PTR(error);
3806 }
3807 
do_filp_open(int dfd,struct filename * pathname,const struct open_flags * op)3808 struct file *do_filp_open(int dfd, struct filename *pathname,
3809 		const struct open_flags *op)
3810 {
3811 	struct nameidata nd;
3812 	int flags = op->lookup_flags;
3813 	struct file *filp;
3814 
3815 	set_nameidata(&nd, dfd, pathname, NULL);
3816 	filp = path_openat(&nd, op, flags | LOOKUP_RCU);
3817 	if (unlikely(filp == ERR_PTR(-ECHILD)))
3818 		filp = path_openat(&nd, op, flags);
3819 	if (unlikely(filp == ERR_PTR(-ESTALE)))
3820 		filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
3821 	restore_nameidata();
3822 	return filp;
3823 }
3824 
do_file_open_root(const struct path * root,const char * name,const struct open_flags * op)3825 struct file *do_file_open_root(const struct path *root,
3826 		const char *name, const struct open_flags *op)
3827 {
3828 	struct nameidata nd;
3829 	struct file *file;
3830 	struct filename *filename;
3831 	int flags = op->lookup_flags;
3832 
3833 	if (d_is_symlink(root->dentry) && op->intent & LOOKUP_OPEN)
3834 		return ERR_PTR(-ELOOP);
3835 
3836 	filename = getname_kernel(name);
3837 	if (IS_ERR(filename))
3838 		return ERR_CAST(filename);
3839 
3840 	set_nameidata(&nd, -1, filename, root);
3841 	file = path_openat(&nd, op, flags | LOOKUP_RCU);
3842 	if (unlikely(file == ERR_PTR(-ECHILD)))
3843 		file = path_openat(&nd, op, flags);
3844 	if (unlikely(file == ERR_PTR(-ESTALE)))
3845 		file = path_openat(&nd, op, flags | LOOKUP_REVAL);
3846 	restore_nameidata();
3847 	putname(filename);
3848 	return file;
3849 }
3850 
filename_create(int dfd,struct filename * name,struct path * path,unsigned int lookup_flags)3851 static struct dentry *filename_create(int dfd, struct filename *name,
3852 				      struct path *path, unsigned int lookup_flags)
3853 {
3854 	struct dentry *dentry = ERR_PTR(-EEXIST);
3855 	struct qstr last;
3856 	bool want_dir = lookup_flags & LOOKUP_DIRECTORY;
3857 	unsigned int reval_flag = lookup_flags & LOOKUP_REVAL;
3858 	unsigned int create_flags = LOOKUP_CREATE | LOOKUP_EXCL;
3859 	int type;
3860 	int err2;
3861 	int error;
3862 
3863 	error = filename_parentat(dfd, name, reval_flag, path, &last, &type);
3864 	if (error)
3865 		return ERR_PTR(error);
3866 
3867 	/*
3868 	 * Yucky last component or no last component at all?
3869 	 * (foo/., foo/.., /////)
3870 	 */
3871 	if (unlikely(type != LAST_NORM))
3872 		goto out;
3873 
3874 	/* don't fail immediately if it's r/o, at least try to report other errors */
3875 	err2 = mnt_want_write(path->mnt);
3876 	/*
3877 	 * Do the final lookup.  Suppress 'create' if there is a trailing
3878 	 * '/', and a directory wasn't requested.
3879 	 */
3880 	if (last.name[last.len] && !want_dir)
3881 		create_flags = 0;
3882 	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
3883 	dentry = lookup_one_qstr_excl(&last, path->dentry,
3884 				      reval_flag | create_flags);
3885 	if (IS_ERR(dentry))
3886 		goto unlock;
3887 
3888 	error = -EEXIST;
3889 	if (d_is_positive(dentry))
3890 		goto fail;
3891 
3892 	/*
3893 	 * Special case - lookup gave negative, but... we had foo/bar/
3894 	 * From the vfs_mknod() POV we just have a negative dentry -
3895 	 * all is fine. Let's be bastards - you had / on the end, you've
3896 	 * been asking for (non-existent) directory. -ENOENT for you.
3897 	 */
3898 	if (unlikely(!create_flags)) {
3899 		error = -ENOENT;
3900 		goto fail;
3901 	}
3902 	if (unlikely(err2)) {
3903 		error = err2;
3904 		goto fail;
3905 	}
3906 	return dentry;
3907 fail:
3908 	dput(dentry);
3909 	dentry = ERR_PTR(error);
3910 unlock:
3911 	inode_unlock(path->dentry->d_inode);
3912 	if (!err2)
3913 		mnt_drop_write(path->mnt);
3914 out:
3915 	path_put(path);
3916 	return dentry;
3917 }
3918 
kern_path_create(int dfd,const char * pathname,struct path * path,unsigned int lookup_flags)3919 struct dentry *kern_path_create(int dfd, const char *pathname,
3920 				struct path *path, unsigned int lookup_flags)
3921 {
3922 	struct filename *filename = getname_kernel(pathname);
3923 	struct dentry *res = filename_create(dfd, filename, path, lookup_flags);
3924 
3925 	putname(filename);
3926 	return res;
3927 }
3928 EXPORT_SYMBOL(kern_path_create);
3929 
done_path_create(struct path * path,struct dentry * dentry)3930 void done_path_create(struct path *path, struct dentry *dentry)
3931 {
3932 	dput(dentry);
3933 	inode_unlock(path->dentry->d_inode);
3934 	mnt_drop_write(path->mnt);
3935 	path_put(path);
3936 }
3937 EXPORT_SYMBOL(done_path_create);
3938 
user_path_create(int dfd,const char __user * pathname,struct path * path,unsigned int lookup_flags)3939 inline struct dentry *user_path_create(int dfd, const char __user *pathname,
3940 				struct path *path, unsigned int lookup_flags)
3941 {
3942 	struct filename *filename = getname(pathname);
3943 	struct dentry *res = filename_create(dfd, filename, path, lookup_flags);
3944 
3945 	putname(filename);
3946 	return res;
3947 }
3948 EXPORT_SYMBOL(user_path_create);
3949 
3950 /**
3951  * vfs_mknod - create device node or file
3952  * @idmap:	idmap of the mount the inode was found from
3953  * @dir:	inode of @dentry
3954  * @dentry:	pointer to dentry of the base directory
3955  * @mode:	mode of the new device node or file
3956  * @dev:	device number of device to create
3957  *
3958  * Create a device node or file.
3959  *
3960  * If the inode has been found through an idmapped mount the idmap of
3961  * the vfsmount must be passed through @idmap. This function will then take
3962  * care to map the inode according to @idmap before checking permissions.
3963  * On non-idmapped mounts or if permission checking is to be performed on the
3964  * raw inode simply passs @nop_mnt_idmap.
3965  */
vfs_mknod(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry,umode_t mode,dev_t dev)3966 int vfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
3967 	      struct dentry *dentry, umode_t mode, dev_t dev)
3968 {
3969 	bool is_whiteout = S_ISCHR(mode) && dev == WHITEOUT_DEV;
3970 	int error = may_create(idmap, dir, dentry);
3971 
3972 	if (error)
3973 		return error;
3974 
3975 	if ((S_ISCHR(mode) || S_ISBLK(mode)) && !is_whiteout &&
3976 	    !capable(CAP_MKNOD))
3977 		return -EPERM;
3978 
3979 	if (!dir->i_op->mknod)
3980 		return -EPERM;
3981 
3982 	mode = vfs_prepare_mode(idmap, dir, mode, mode, mode);
3983 	error = devcgroup_inode_mknod(mode, dev);
3984 	if (error)
3985 		return error;
3986 
3987 	error = security_inode_mknod(dir, dentry, mode, dev);
3988 	if (error)
3989 		return error;
3990 
3991 	error = dir->i_op->mknod(idmap, dir, dentry, mode, dev);
3992 	if (!error)
3993 		fsnotify_create(dir, dentry);
3994 	return error;
3995 }
3996 EXPORT_SYMBOL(vfs_mknod);
3997 
may_mknod(umode_t mode)3998 static int may_mknod(umode_t mode)
3999 {
4000 	switch (mode & S_IFMT) {
4001 	case S_IFREG:
4002 	case S_IFCHR:
4003 	case S_IFBLK:
4004 	case S_IFIFO:
4005 	case S_IFSOCK:
4006 	case 0: /* zero mode translates to S_IFREG */
4007 		return 0;
4008 	case S_IFDIR:
4009 		return -EPERM;
4010 	default:
4011 		return -EINVAL;
4012 	}
4013 }
4014 
do_mknodat(int dfd,struct filename * name,umode_t mode,unsigned int dev)4015 static int do_mknodat(int dfd, struct filename *name, umode_t mode,
4016 		unsigned int dev)
4017 {
4018 	struct mnt_idmap *idmap;
4019 	struct dentry *dentry;
4020 	struct path path;
4021 	int error;
4022 	unsigned int lookup_flags = 0;
4023 
4024 	error = may_mknod(mode);
4025 	if (error)
4026 		goto out1;
4027 retry:
4028 	dentry = filename_create(dfd, name, &path, lookup_flags);
4029 	error = PTR_ERR(dentry);
4030 	if (IS_ERR(dentry))
4031 		goto out1;
4032 
4033 	error = security_path_mknod(&path, dentry,
4034 			mode_strip_umask(path.dentry->d_inode, mode), dev);
4035 	if (error)
4036 		goto out2;
4037 
4038 	idmap = mnt_idmap(path.mnt);
4039 	switch (mode & S_IFMT) {
4040 		case 0: case S_IFREG:
4041 			error = vfs_create(idmap, path.dentry->d_inode,
4042 					   dentry, mode, true);
4043 			if (!error)
4044 				ima_post_path_mknod(idmap, dentry);
4045 			break;
4046 		case S_IFCHR: case S_IFBLK:
4047 			error = vfs_mknod(idmap, path.dentry->d_inode,
4048 					  dentry, mode, new_decode_dev(dev));
4049 			break;
4050 		case S_IFIFO: case S_IFSOCK:
4051 			error = vfs_mknod(idmap, path.dentry->d_inode,
4052 					  dentry, mode, 0);
4053 			break;
4054 	}
4055 out2:
4056 	done_path_create(&path, dentry);
4057 	if (retry_estale(error, lookup_flags)) {
4058 		lookup_flags |= LOOKUP_REVAL;
4059 		goto retry;
4060 	}
4061 out1:
4062 	putname(name);
4063 	return error;
4064 }
4065 
SYSCALL_DEFINE4(mknodat,int,dfd,const char __user *,filename,umode_t,mode,unsigned int,dev)4066 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
4067 		unsigned int, dev)
4068 {
4069 	return do_mknodat(dfd, getname(filename), mode, dev);
4070 }
4071 
SYSCALL_DEFINE3(mknod,const char __user *,filename,umode_t,mode,unsigned,dev)4072 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
4073 {
4074 	return do_mknodat(AT_FDCWD, getname(filename), mode, dev);
4075 }
4076 
4077 /**
4078  * vfs_mkdir - create directory
4079  * @idmap:	idmap of the mount the inode was found from
4080  * @dir:	inode of @dentry
4081  * @dentry:	pointer to dentry of the base directory
4082  * @mode:	mode of the new directory
4083  *
4084  * Create a directory.
4085  *
4086  * If the inode has been found through an idmapped mount the idmap of
4087  * the vfsmount must be passed through @idmap. This function will then take
4088  * care to map the inode according to @idmap before checking permissions.
4089  * On non-idmapped mounts or if permission checking is to be performed on the
4090  * raw inode simply passs @nop_mnt_idmap.
4091  */
vfs_mkdir(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry,umode_t mode)4092 int vfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
4093 	      struct dentry *dentry, umode_t mode)
4094 {
4095 	int error;
4096 	unsigned max_links = dir->i_sb->s_max_links;
4097 
4098 	error = may_create(idmap, dir, dentry);
4099 	if (error)
4100 		return error;
4101 
4102 	if (!dir->i_op->mkdir)
4103 		return -EPERM;
4104 
4105 	mode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO | S_ISVTX, 0);
4106 	error = security_inode_mkdir(dir, dentry, mode);
4107 	if (error)
4108 		return error;
4109 
4110 	if (max_links && dir->i_nlink >= max_links)
4111 		return -EMLINK;
4112 
4113 	error = dir->i_op->mkdir(idmap, dir, dentry, mode);
4114 	if (!error)
4115 		fsnotify_mkdir(dir, dentry);
4116 	return error;
4117 }
4118 EXPORT_SYMBOL(vfs_mkdir);
4119 
do_mkdirat(int dfd,struct filename * name,umode_t mode)4120 int do_mkdirat(int dfd, struct filename *name, umode_t mode)
4121 {
4122 	struct dentry *dentry;
4123 	struct path path;
4124 	int error;
4125 	unsigned int lookup_flags = LOOKUP_DIRECTORY;
4126 
4127 retry:
4128 	dentry = filename_create(dfd, name, &path, lookup_flags);
4129 	error = PTR_ERR(dentry);
4130 	if (IS_ERR(dentry))
4131 		goto out_putname;
4132 
4133 	error = security_path_mkdir(&path, dentry,
4134 			mode_strip_umask(path.dentry->d_inode, mode));
4135 	if (!error) {
4136 		error = vfs_mkdir(mnt_idmap(path.mnt), path.dentry->d_inode,
4137 				  dentry, mode);
4138 	}
4139 	done_path_create(&path, dentry);
4140 	if (retry_estale(error, lookup_flags)) {
4141 		lookup_flags |= LOOKUP_REVAL;
4142 		goto retry;
4143 	}
4144 out_putname:
4145 	putname(name);
4146 	return error;
4147 }
4148 
SYSCALL_DEFINE3(mkdirat,int,dfd,const char __user *,pathname,umode_t,mode)4149 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
4150 {
4151 	return do_mkdirat(dfd, getname(pathname), mode);
4152 }
4153 
SYSCALL_DEFINE2(mkdir,const char __user *,pathname,umode_t,mode)4154 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
4155 {
4156 	return do_mkdirat(AT_FDCWD, getname(pathname), mode);
4157 }
4158 
4159 /**
4160  * vfs_rmdir - remove directory
4161  * @idmap:	idmap of the mount the inode was found from
4162  * @dir:	inode of @dentry
4163  * @dentry:	pointer to dentry of the base directory
4164  *
4165  * Remove a directory.
4166  *
4167  * If the inode has been found through an idmapped mount the idmap of
4168  * the vfsmount must be passed through @idmap. This function will then take
4169  * care to map the inode according to @idmap before checking permissions.
4170  * On non-idmapped mounts or if permission checking is to be performed on the
4171  * raw inode simply passs @nop_mnt_idmap.
4172  */
vfs_rmdir(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry)4173 int vfs_rmdir(struct mnt_idmap *idmap, struct inode *dir,
4174 		     struct dentry *dentry)
4175 {
4176 	int error = may_delete(idmap, dir, dentry, 1);
4177 
4178 	if (error)
4179 		return error;
4180 
4181 	if (!dir->i_op->rmdir)
4182 		return -EPERM;
4183 
4184 	dget(dentry);
4185 	inode_lock(dentry->d_inode);
4186 
4187 	error = -EBUSY;
4188 	if (is_local_mountpoint(dentry) ||
4189 	    (dentry->d_inode->i_flags & S_KERNEL_FILE))
4190 		goto out;
4191 
4192 	error = security_inode_rmdir(dir, dentry);
4193 	if (error)
4194 		goto out;
4195 
4196 	error = dir->i_op->rmdir(dir, dentry);
4197 	if (error)
4198 		goto out;
4199 
4200 	shrink_dcache_parent(dentry);
4201 	dentry->d_inode->i_flags |= S_DEAD;
4202 	dont_mount(dentry);
4203 	detach_mounts(dentry);
4204 
4205 out:
4206 	inode_unlock(dentry->d_inode);
4207 	dput(dentry);
4208 	if (!error)
4209 		d_delete_notify(dir, dentry);
4210 	return error;
4211 }
4212 EXPORT_SYMBOL(vfs_rmdir);
4213 
do_rmdir(int dfd,struct filename * name)4214 int do_rmdir(int dfd, struct filename *name)
4215 {
4216 	int error;
4217 	struct dentry *dentry;
4218 	struct path path;
4219 	struct qstr last;
4220 	int type;
4221 	unsigned int lookup_flags = 0;
4222 retry:
4223 	error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4224 	if (error)
4225 		goto exit1;
4226 
4227 	switch (type) {
4228 	case LAST_DOTDOT:
4229 		error = -ENOTEMPTY;
4230 		goto exit2;
4231 	case LAST_DOT:
4232 		error = -EINVAL;
4233 		goto exit2;
4234 	case LAST_ROOT:
4235 		error = -EBUSY;
4236 		goto exit2;
4237 	}
4238 
4239 	error = mnt_want_write(path.mnt);
4240 	if (error)
4241 		goto exit2;
4242 
4243 	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4244 	dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags);
4245 	error = PTR_ERR(dentry);
4246 	if (IS_ERR(dentry))
4247 		goto exit3;
4248 	if (!dentry->d_inode) {
4249 		error = -ENOENT;
4250 		goto exit4;
4251 	}
4252 	error = security_path_rmdir(&path, dentry);
4253 	if (error)
4254 		goto exit4;
4255 	error = vfs_rmdir(mnt_idmap(path.mnt), path.dentry->d_inode, dentry);
4256 exit4:
4257 	dput(dentry);
4258 exit3:
4259 	inode_unlock(path.dentry->d_inode);
4260 	mnt_drop_write(path.mnt);
4261 exit2:
4262 	path_put(&path);
4263 	if (retry_estale(error, lookup_flags)) {
4264 		lookup_flags |= LOOKUP_REVAL;
4265 		goto retry;
4266 	}
4267 exit1:
4268 	putname(name);
4269 	return error;
4270 }
4271 
SYSCALL_DEFINE1(rmdir,const char __user *,pathname)4272 SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
4273 {
4274 	return do_rmdir(AT_FDCWD, getname(pathname));
4275 }
4276 
4277 /**
4278  * vfs_unlink - unlink a filesystem object
4279  * @idmap:	idmap of the mount the inode was found from
4280  * @dir:	parent directory
4281  * @dentry:	victim
4282  * @delegated_inode: returns victim inode, if the inode is delegated.
4283  *
4284  * The caller must hold dir->i_mutex.
4285  *
4286  * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and
4287  * return a reference to the inode in delegated_inode.  The caller
4288  * should then break the delegation on that inode and retry.  Because
4289  * breaking a delegation may take a long time, the caller should drop
4290  * dir->i_mutex before doing so.
4291  *
4292  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4293  * be appropriate for callers that expect the underlying filesystem not
4294  * to be NFS exported.
4295  *
4296  * If the inode has been found through an idmapped mount the idmap of
4297  * the vfsmount must be passed through @idmap. This function will then take
4298  * care to map the inode according to @idmap before checking permissions.
4299  * On non-idmapped mounts or if permission checking is to be performed on the
4300  * raw inode simply passs @nop_mnt_idmap.
4301  */
vfs_unlink(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry,struct inode ** delegated_inode)4302 int vfs_unlink(struct mnt_idmap *idmap, struct inode *dir,
4303 	       struct dentry *dentry, struct inode **delegated_inode)
4304 {
4305 	struct inode *target = dentry->d_inode;
4306 	int error = may_delete(idmap, dir, dentry, 0);
4307 
4308 	if (error)
4309 		return error;
4310 
4311 	if (!dir->i_op->unlink)
4312 		return -EPERM;
4313 
4314 	inode_lock(target);
4315 	if (IS_SWAPFILE(target))
4316 		error = -EPERM;
4317 	else if (is_local_mountpoint(dentry))
4318 		error = -EBUSY;
4319 	else {
4320 		error = security_inode_unlink(dir, dentry);
4321 		if (!error) {
4322 			error = try_break_deleg(target, delegated_inode);
4323 			if (error)
4324 				goto out;
4325 			error = dir->i_op->unlink(dir, dentry);
4326 			if (!error) {
4327 				dont_mount(dentry);
4328 				detach_mounts(dentry);
4329 			}
4330 		}
4331 	}
4332 out:
4333 	inode_unlock(target);
4334 
4335 	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
4336 	if (!error && dentry->d_flags & DCACHE_NFSFS_RENAMED) {
4337 		fsnotify_unlink(dir, dentry);
4338 	} else if (!error) {
4339 		fsnotify_link_count(target);
4340 		d_delete_notify(dir, dentry);
4341 	}
4342 
4343 	return error;
4344 }
4345 EXPORT_SYMBOL(vfs_unlink);
4346 
4347 /*
4348  * Make sure that the actual truncation of the file will occur outside its
4349  * directory's i_mutex.  Truncate can take a long time if there is a lot of
4350  * writeout happening, and we don't want to prevent access to the directory
4351  * while waiting on the I/O.
4352  */
do_unlinkat(int dfd,struct filename * name)4353 int do_unlinkat(int dfd, struct filename *name)
4354 {
4355 	int error;
4356 	struct dentry *dentry;
4357 	struct path path;
4358 	struct qstr last;
4359 	int type;
4360 	struct inode *inode = NULL;
4361 	struct inode *delegated_inode = NULL;
4362 	unsigned int lookup_flags = 0;
4363 retry:
4364 	error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4365 	if (error)
4366 		goto exit1;
4367 
4368 	error = -EISDIR;
4369 	if (type != LAST_NORM)
4370 		goto exit2;
4371 
4372 	error = mnt_want_write(path.mnt);
4373 	if (error)
4374 		goto exit2;
4375 retry_deleg:
4376 	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4377 	dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags);
4378 	error = PTR_ERR(dentry);
4379 	if (!IS_ERR(dentry)) {
4380 
4381 		/* Why not before? Because we want correct error value */
4382 		if (last.name[last.len])
4383 			goto slashes;
4384 		inode = dentry->d_inode;
4385 		if (d_is_negative(dentry))
4386 			goto slashes;
4387 		ihold(inode);
4388 		error = security_path_unlink(&path, dentry);
4389 		if (error)
4390 			goto exit3;
4391 		error = vfs_unlink(mnt_idmap(path.mnt), path.dentry->d_inode,
4392 				   dentry, &delegated_inode);
4393 exit3:
4394 		dput(dentry);
4395 	}
4396 	inode_unlock(path.dentry->d_inode);
4397 	if (inode)
4398 		iput(inode);	/* truncate the inode here */
4399 	inode = NULL;
4400 	if (delegated_inode) {
4401 		error = break_deleg_wait(&delegated_inode);
4402 		if (!error)
4403 			goto retry_deleg;
4404 	}
4405 	mnt_drop_write(path.mnt);
4406 exit2:
4407 	path_put(&path);
4408 	if (retry_estale(error, lookup_flags)) {
4409 		lookup_flags |= LOOKUP_REVAL;
4410 		inode = NULL;
4411 		goto retry;
4412 	}
4413 exit1:
4414 	putname(name);
4415 	return error;
4416 
4417 slashes:
4418 	if (d_is_negative(dentry))
4419 		error = -ENOENT;
4420 	else if (d_is_dir(dentry))
4421 		error = -EISDIR;
4422 	else
4423 		error = -ENOTDIR;
4424 	goto exit3;
4425 }
4426 
SYSCALL_DEFINE3(unlinkat,int,dfd,const char __user *,pathname,int,flag)4427 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
4428 {
4429 	if ((flag & ~AT_REMOVEDIR) != 0)
4430 		return -EINVAL;
4431 
4432 	if (flag & AT_REMOVEDIR)
4433 		return do_rmdir(dfd, getname(pathname));
4434 	return do_unlinkat(dfd, getname(pathname));
4435 }
4436 
SYSCALL_DEFINE1(unlink,const char __user *,pathname)4437 SYSCALL_DEFINE1(unlink, const char __user *, pathname)
4438 {
4439 	return do_unlinkat(AT_FDCWD, getname(pathname));
4440 }
4441 
4442 /**
4443  * vfs_symlink - create symlink
4444  * @idmap:	idmap of the mount the inode was found from
4445  * @dir:	inode of @dentry
4446  * @dentry:	pointer to dentry of the base directory
4447  * @oldname:	name of the file to link to
4448  *
4449  * Create a symlink.
4450  *
4451  * If the inode has been found through an idmapped mount the idmap of
4452  * the vfsmount must be passed through @idmap. This function will then take
4453  * care to map the inode according to @idmap before checking permissions.
4454  * On non-idmapped mounts or if permission checking is to be performed on the
4455  * raw inode simply passs @nop_mnt_idmap.
4456  */
vfs_symlink(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry,const char * oldname)4457 int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
4458 		struct dentry *dentry, const char *oldname)
4459 {
4460 	int error;
4461 
4462 	error = may_create(idmap, dir, dentry);
4463 	if (error)
4464 		return error;
4465 
4466 	if (!dir->i_op->symlink)
4467 		return -EPERM;
4468 
4469 	error = security_inode_symlink(dir, dentry, oldname);
4470 	if (error)
4471 		return error;
4472 
4473 	error = dir->i_op->symlink(idmap, dir, dentry, oldname);
4474 	if (!error)
4475 		fsnotify_create(dir, dentry);
4476 	return error;
4477 }
4478 EXPORT_SYMBOL(vfs_symlink);
4479 
do_symlinkat(struct filename * from,int newdfd,struct filename * to)4480 int do_symlinkat(struct filename *from, int newdfd, struct filename *to)
4481 {
4482 	int error;
4483 	struct dentry *dentry;
4484 	struct path path;
4485 	unsigned int lookup_flags = 0;
4486 
4487 	if (IS_ERR(from)) {
4488 		error = PTR_ERR(from);
4489 		goto out_putnames;
4490 	}
4491 retry:
4492 	dentry = filename_create(newdfd, to, &path, lookup_flags);
4493 	error = PTR_ERR(dentry);
4494 	if (IS_ERR(dentry))
4495 		goto out_putnames;
4496 
4497 	error = security_path_symlink(&path, dentry, from->name);
4498 	if (!error)
4499 		error = vfs_symlink(mnt_idmap(path.mnt), path.dentry->d_inode,
4500 				    dentry, from->name);
4501 	done_path_create(&path, dentry);
4502 	if (retry_estale(error, lookup_flags)) {
4503 		lookup_flags |= LOOKUP_REVAL;
4504 		goto retry;
4505 	}
4506 out_putnames:
4507 	putname(to);
4508 	putname(from);
4509 	return error;
4510 }
4511 
SYSCALL_DEFINE3(symlinkat,const char __user *,oldname,int,newdfd,const char __user *,newname)4512 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
4513 		int, newdfd, const char __user *, newname)
4514 {
4515 	return do_symlinkat(getname(oldname), newdfd, getname(newname));
4516 }
4517 
SYSCALL_DEFINE2(symlink,const char __user *,oldname,const char __user *,newname)4518 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
4519 {
4520 	return do_symlinkat(getname(oldname), AT_FDCWD, getname(newname));
4521 }
4522 
4523 /**
4524  * vfs_link - create a new link
4525  * @old_dentry:	object to be linked
4526  * @idmap:	idmap of the mount
4527  * @dir:	new parent
4528  * @new_dentry:	where to create the new link
4529  * @delegated_inode: returns inode needing a delegation break
4530  *
4531  * The caller must hold dir->i_mutex
4532  *
4533  * If vfs_link discovers a delegation on the to-be-linked file in need
4534  * of breaking, it will return -EWOULDBLOCK and return a reference to the
4535  * inode in delegated_inode.  The caller should then break the delegation
4536  * and retry.  Because breaking a delegation may take a long time, the
4537  * caller should drop the i_mutex before doing so.
4538  *
4539  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4540  * be appropriate for callers that expect the underlying filesystem not
4541  * to be NFS exported.
4542  *
4543  * If the inode has been found through an idmapped mount the idmap of
4544  * the vfsmount must be passed through @idmap. This function will then take
4545  * care to map the inode according to @idmap before checking permissions.
4546  * On non-idmapped mounts or if permission checking is to be performed on the
4547  * raw inode simply passs @nop_mnt_idmap.
4548  */
vfs_link(struct dentry * old_dentry,struct mnt_idmap * idmap,struct inode * dir,struct dentry * new_dentry,struct inode ** delegated_inode)4549 int vfs_link(struct dentry *old_dentry, struct mnt_idmap *idmap,
4550 	     struct inode *dir, struct dentry *new_dentry,
4551 	     struct inode **delegated_inode)
4552 {
4553 	struct inode *inode = old_dentry->d_inode;
4554 	unsigned max_links = dir->i_sb->s_max_links;
4555 	int error;
4556 
4557 	if (!inode)
4558 		return -ENOENT;
4559 
4560 	error = may_create(idmap, dir, new_dentry);
4561 	if (error)
4562 		return error;
4563 
4564 	if (dir->i_sb != inode->i_sb)
4565 		return -EXDEV;
4566 
4567 	/*
4568 	 * A link to an append-only or immutable file cannot be created.
4569 	 */
4570 	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
4571 		return -EPERM;
4572 	/*
4573 	 * Updating the link count will likely cause i_uid and i_gid to
4574 	 * be writen back improperly if their true value is unknown to
4575 	 * the vfs.
4576 	 */
4577 	if (HAS_UNMAPPED_ID(idmap, inode))
4578 		return -EPERM;
4579 	if (!dir->i_op->link)
4580 		return -EPERM;
4581 	if (S_ISDIR(inode->i_mode))
4582 		return -EPERM;
4583 
4584 	error = security_inode_link(old_dentry, dir, new_dentry);
4585 	if (error)
4586 		return error;
4587 
4588 	inode_lock(inode);
4589 	/* Make sure we don't allow creating hardlink to an unlinked file */
4590 	if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
4591 		error =  -ENOENT;
4592 	else if (max_links && inode->i_nlink >= max_links)
4593 		error = -EMLINK;
4594 	else {
4595 		error = try_break_deleg(inode, delegated_inode);
4596 		if (!error)
4597 			error = dir->i_op->link(old_dentry, dir, new_dentry);
4598 	}
4599 
4600 	if (!error && (inode->i_state & I_LINKABLE)) {
4601 		spin_lock(&inode->i_lock);
4602 		inode->i_state &= ~I_LINKABLE;
4603 		spin_unlock(&inode->i_lock);
4604 	}
4605 	inode_unlock(inode);
4606 	if (!error)
4607 		fsnotify_link(dir, inode, new_dentry);
4608 	return error;
4609 }
4610 EXPORT_SYMBOL(vfs_link);
4611 
4612 /*
4613  * Hardlinks are often used in delicate situations.  We avoid
4614  * security-related surprises by not following symlinks on the
4615  * newname.  --KAB
4616  *
4617  * We don't follow them on the oldname either to be compatible
4618  * with linux 2.0, and to avoid hard-linking to directories
4619  * and other special files.  --ADM
4620  */
do_linkat(int olddfd,struct filename * old,int newdfd,struct filename * new,int flags)4621 int do_linkat(int olddfd, struct filename *old, int newdfd,
4622 	      struct filename *new, int flags)
4623 {
4624 	struct mnt_idmap *idmap;
4625 	struct dentry *new_dentry;
4626 	struct path old_path, new_path;
4627 	struct inode *delegated_inode = NULL;
4628 	int how = 0;
4629 	int error;
4630 
4631 	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) {
4632 		error = -EINVAL;
4633 		goto out_putnames;
4634 	}
4635 	/*
4636 	 * To use null names we require CAP_DAC_READ_SEARCH
4637 	 * This ensures that not everyone will be able to create
4638 	 * handlink using the passed filedescriptor.
4639 	 */
4640 	if (flags & AT_EMPTY_PATH && !capable(CAP_DAC_READ_SEARCH)) {
4641 		error = -ENOENT;
4642 		goto out_putnames;
4643 	}
4644 
4645 	if (flags & AT_SYMLINK_FOLLOW)
4646 		how |= LOOKUP_FOLLOW;
4647 retry:
4648 	error = filename_lookup(olddfd, old, how, &old_path, NULL);
4649 	if (error)
4650 		goto out_putnames;
4651 
4652 	new_dentry = filename_create(newdfd, new, &new_path,
4653 					(how & LOOKUP_REVAL));
4654 	error = PTR_ERR(new_dentry);
4655 	if (IS_ERR(new_dentry))
4656 		goto out_putpath;
4657 
4658 	error = -EXDEV;
4659 	if (old_path.mnt != new_path.mnt)
4660 		goto out_dput;
4661 	idmap = mnt_idmap(new_path.mnt);
4662 	error = may_linkat(idmap, &old_path);
4663 	if (unlikely(error))
4664 		goto out_dput;
4665 	error = security_path_link(old_path.dentry, &new_path, new_dentry);
4666 	if (error)
4667 		goto out_dput;
4668 	error = vfs_link(old_path.dentry, idmap, new_path.dentry->d_inode,
4669 			 new_dentry, &delegated_inode);
4670 out_dput:
4671 	done_path_create(&new_path, new_dentry);
4672 	if (delegated_inode) {
4673 		error = break_deleg_wait(&delegated_inode);
4674 		if (!error) {
4675 			path_put(&old_path);
4676 			goto retry;
4677 		}
4678 	}
4679 	if (retry_estale(error, how)) {
4680 		path_put(&old_path);
4681 		how |= LOOKUP_REVAL;
4682 		goto retry;
4683 	}
4684 out_putpath:
4685 	path_put(&old_path);
4686 out_putnames:
4687 	putname(old);
4688 	putname(new);
4689 
4690 	return error;
4691 }
4692 
SYSCALL_DEFINE5(linkat,int,olddfd,const char __user *,oldname,int,newdfd,const char __user *,newname,int,flags)4693 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
4694 		int, newdfd, const char __user *, newname, int, flags)
4695 {
4696 	return do_linkat(olddfd, getname_uflags(oldname, flags),
4697 		newdfd, getname(newname), flags);
4698 }
4699 
SYSCALL_DEFINE2(link,const char __user *,oldname,const char __user *,newname)4700 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
4701 {
4702 	return do_linkat(AT_FDCWD, getname(oldname), AT_FDCWD, getname(newname), 0);
4703 }
4704 
4705 /**
4706  * vfs_rename - rename a filesystem object
4707  * @rd:		pointer to &struct renamedata info
4708  *
4709  * The caller must hold multiple mutexes--see lock_rename()).
4710  *
4711  * If vfs_rename discovers a delegation in need of breaking at either
4712  * the source or destination, it will return -EWOULDBLOCK and return a
4713  * reference to the inode in delegated_inode.  The caller should then
4714  * break the delegation and retry.  Because breaking a delegation may
4715  * take a long time, the caller should drop all locks before doing
4716  * so.
4717  *
4718  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4719  * be appropriate for callers that expect the underlying filesystem not
4720  * to be NFS exported.
4721  *
4722  * The worst of all namespace operations - renaming directory. "Perverted"
4723  * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
4724  * Problems:
4725  *
4726  *	a) we can get into loop creation.
4727  *	b) race potential - two innocent renames can create a loop together.
4728  *	   That's where 4.4BSD screws up. Current fix: serialization on
4729  *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
4730  *	   story.
4731  *	c) we may have to lock up to _four_ objects - parents and victim (if it exists),
4732  *	   and source (if it's a non-directory or a subdirectory that moves to
4733  *	   different parent).
4734  *	   And that - after we got ->i_mutex on parents (until then we don't know
4735  *	   whether the target exists).  Solution: try to be smart with locking
4736  *	   order for inodes.  We rely on the fact that tree topology may change
4737  *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
4738  *	   move will be locked.  Thus we can rank directories by the tree
4739  *	   (ancestors first) and rank all non-directories after them.
4740  *	   That works since everybody except rename does "lock parent, lookup,
4741  *	   lock child" and rename is under ->s_vfs_rename_mutex.
4742  *	   HOWEVER, it relies on the assumption that any object with ->lookup()
4743  *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
4744  *	   we'd better make sure that there's no link(2) for them.
4745  *	d) conversion from fhandle to dentry may come in the wrong moment - when
4746  *	   we are removing the target. Solution: we will have to grab ->i_mutex
4747  *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
4748  *	   ->i_mutex on parents, which works but leads to some truly excessive
4749  *	   locking].
4750  */
vfs_rename(struct renamedata * rd)4751 int vfs_rename(struct renamedata *rd)
4752 {
4753 	int error;
4754 	struct inode *old_dir = rd->old_dir, *new_dir = rd->new_dir;
4755 	struct dentry *old_dentry = rd->old_dentry;
4756 	struct dentry *new_dentry = rd->new_dentry;
4757 	struct inode **delegated_inode = rd->delegated_inode;
4758 	unsigned int flags = rd->flags;
4759 	bool is_dir = d_is_dir(old_dentry);
4760 	struct inode *source = old_dentry->d_inode;
4761 	struct inode *target = new_dentry->d_inode;
4762 	bool new_is_dir = false;
4763 	unsigned max_links = new_dir->i_sb->s_max_links;
4764 	struct name_snapshot old_name;
4765 	bool lock_old_subdir, lock_new_subdir;
4766 
4767 	if (source == target)
4768 		return 0;
4769 
4770 	error = may_delete(rd->old_mnt_idmap, old_dir, old_dentry, is_dir);
4771 	if (error)
4772 		return error;
4773 
4774 	if (!target) {
4775 		error = may_create(rd->new_mnt_idmap, new_dir, new_dentry);
4776 	} else {
4777 		new_is_dir = d_is_dir(new_dentry);
4778 
4779 		if (!(flags & RENAME_EXCHANGE))
4780 			error = may_delete(rd->new_mnt_idmap, new_dir,
4781 					   new_dentry, is_dir);
4782 		else
4783 			error = may_delete(rd->new_mnt_idmap, new_dir,
4784 					   new_dentry, new_is_dir);
4785 	}
4786 	if (error)
4787 		return error;
4788 
4789 	if (!old_dir->i_op->rename)
4790 		return -EPERM;
4791 
4792 	/*
4793 	 * If we are going to change the parent - check write permissions,
4794 	 * we'll need to flip '..'.
4795 	 */
4796 	if (new_dir != old_dir) {
4797 		if (is_dir) {
4798 			error = inode_permission(rd->old_mnt_idmap, source,
4799 						 MAY_WRITE);
4800 			if (error)
4801 				return error;
4802 		}
4803 		if ((flags & RENAME_EXCHANGE) && new_is_dir) {
4804 			error = inode_permission(rd->new_mnt_idmap, target,
4805 						 MAY_WRITE);
4806 			if (error)
4807 				return error;
4808 		}
4809 	}
4810 
4811 	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
4812 				      flags);
4813 	if (error)
4814 		return error;
4815 
4816 	take_dentry_name_snapshot(&old_name, old_dentry);
4817 	dget(new_dentry);
4818 	/*
4819 	 * Lock children.
4820 	 * The source subdirectory needs to be locked on cross-directory
4821 	 * rename or cross-directory exchange since its parent changes.
4822 	 * The target subdirectory needs to be locked on cross-directory
4823 	 * exchange due to parent change and on any rename due to becoming
4824 	 * a victim.
4825 	 * Non-directories need locking in all cases (for NFS reasons);
4826 	 * they get locked after any subdirectories (in inode address order).
4827 	 *
4828 	 * NOTE: WE ONLY LOCK UNRELATED DIRECTORIES IN CROSS-DIRECTORY CASE.
4829 	 * NEVER, EVER DO THAT WITHOUT ->s_vfs_rename_mutex.
4830 	 */
4831 	lock_old_subdir = new_dir != old_dir;
4832 	lock_new_subdir = new_dir != old_dir || !(flags & RENAME_EXCHANGE);
4833 	if (is_dir) {
4834 		if (lock_old_subdir)
4835 			inode_lock_nested(source, I_MUTEX_CHILD);
4836 		if (target && (!new_is_dir || lock_new_subdir))
4837 			inode_lock(target);
4838 	} else if (new_is_dir) {
4839 		if (lock_new_subdir)
4840 			inode_lock_nested(target, I_MUTEX_CHILD);
4841 		inode_lock(source);
4842 	} else {
4843 		lock_two_nondirectories(source, target);
4844 	}
4845 
4846 	error = -EPERM;
4847 	if (IS_SWAPFILE(source) || (target && IS_SWAPFILE(target)))
4848 		goto out;
4849 
4850 	error = -EBUSY;
4851 	if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
4852 		goto out;
4853 
4854 	if (max_links && new_dir != old_dir) {
4855 		error = -EMLINK;
4856 		if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
4857 			goto out;
4858 		if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
4859 		    old_dir->i_nlink >= max_links)
4860 			goto out;
4861 	}
4862 	if (!is_dir) {
4863 		error = try_break_deleg(source, delegated_inode);
4864 		if (error)
4865 			goto out;
4866 	}
4867 	if (target && !new_is_dir) {
4868 		error = try_break_deleg(target, delegated_inode);
4869 		if (error)
4870 			goto out;
4871 	}
4872 	error = old_dir->i_op->rename(rd->new_mnt_idmap, old_dir, old_dentry,
4873 				      new_dir, new_dentry, flags);
4874 	if (error)
4875 		goto out;
4876 
4877 	if (!(flags & RENAME_EXCHANGE) && target) {
4878 		if (is_dir) {
4879 			shrink_dcache_parent(new_dentry);
4880 			target->i_flags |= S_DEAD;
4881 		}
4882 		dont_mount(new_dentry);
4883 		detach_mounts(new_dentry);
4884 	}
4885 	if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
4886 		if (!(flags & RENAME_EXCHANGE))
4887 			d_move(old_dentry, new_dentry);
4888 		else
4889 			d_exchange(old_dentry, new_dentry);
4890 	}
4891 out:
4892 	if (!is_dir || lock_old_subdir)
4893 		inode_unlock(source);
4894 	if (target && (!new_is_dir || lock_new_subdir))
4895 		inode_unlock(target);
4896 	dput(new_dentry);
4897 	if (!error) {
4898 		fsnotify_move(old_dir, new_dir, &old_name.name, is_dir,
4899 			      !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
4900 		if (flags & RENAME_EXCHANGE) {
4901 			fsnotify_move(new_dir, old_dir, &old_dentry->d_name,
4902 				      new_is_dir, NULL, new_dentry);
4903 		}
4904 	}
4905 	release_dentry_name_snapshot(&old_name);
4906 
4907 	return error;
4908 }
4909 EXPORT_SYMBOL(vfs_rename);
4910 
do_renameat2(int olddfd,struct filename * from,int newdfd,struct filename * to,unsigned int flags)4911 int do_renameat2(int olddfd, struct filename *from, int newdfd,
4912 		 struct filename *to, unsigned int flags)
4913 {
4914 	struct renamedata rd;
4915 	struct dentry *old_dentry, *new_dentry;
4916 	struct dentry *trap;
4917 	struct path old_path, new_path;
4918 	struct qstr old_last, new_last;
4919 	int old_type, new_type;
4920 	struct inode *delegated_inode = NULL;
4921 	unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
4922 	bool should_retry = false;
4923 	int error = -EINVAL;
4924 
4925 	if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
4926 		goto put_names;
4927 
4928 	if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
4929 	    (flags & RENAME_EXCHANGE))
4930 		goto put_names;
4931 
4932 	if (flags & RENAME_EXCHANGE)
4933 		target_flags = 0;
4934 
4935 retry:
4936 	error = filename_parentat(olddfd, from, lookup_flags, &old_path,
4937 				  &old_last, &old_type);
4938 	if (error)
4939 		goto put_names;
4940 
4941 	error = filename_parentat(newdfd, to, lookup_flags, &new_path, &new_last,
4942 				  &new_type);
4943 	if (error)
4944 		goto exit1;
4945 
4946 	error = -EXDEV;
4947 	if (old_path.mnt != new_path.mnt)
4948 		goto exit2;
4949 
4950 	error = -EBUSY;
4951 	if (old_type != LAST_NORM)
4952 		goto exit2;
4953 
4954 	if (flags & RENAME_NOREPLACE)
4955 		error = -EEXIST;
4956 	if (new_type != LAST_NORM)
4957 		goto exit2;
4958 
4959 	error = mnt_want_write(old_path.mnt);
4960 	if (error)
4961 		goto exit2;
4962 
4963 retry_deleg:
4964 	trap = lock_rename(new_path.dentry, old_path.dentry);
4965 
4966 	old_dentry = lookup_one_qstr_excl(&old_last, old_path.dentry,
4967 					  lookup_flags);
4968 	error = PTR_ERR(old_dentry);
4969 	if (IS_ERR(old_dentry))
4970 		goto exit3;
4971 	/* source must exist */
4972 	error = -ENOENT;
4973 	if (d_is_negative(old_dentry))
4974 		goto exit4;
4975 	new_dentry = lookup_one_qstr_excl(&new_last, new_path.dentry,
4976 					  lookup_flags | target_flags);
4977 	error = PTR_ERR(new_dentry);
4978 	if (IS_ERR(new_dentry))
4979 		goto exit4;
4980 	error = -EEXIST;
4981 	if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
4982 		goto exit5;
4983 	if (flags & RENAME_EXCHANGE) {
4984 		error = -ENOENT;
4985 		if (d_is_negative(new_dentry))
4986 			goto exit5;
4987 
4988 		if (!d_is_dir(new_dentry)) {
4989 			error = -ENOTDIR;
4990 			if (new_last.name[new_last.len])
4991 				goto exit5;
4992 		}
4993 	}
4994 	/* unless the source is a directory trailing slashes give -ENOTDIR */
4995 	if (!d_is_dir(old_dentry)) {
4996 		error = -ENOTDIR;
4997 		if (old_last.name[old_last.len])
4998 			goto exit5;
4999 		if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
5000 			goto exit5;
5001 	}
5002 	/* source should not be ancestor of target */
5003 	error = -EINVAL;
5004 	if (old_dentry == trap)
5005 		goto exit5;
5006 	/* target should not be an ancestor of source */
5007 	if (!(flags & RENAME_EXCHANGE))
5008 		error = -ENOTEMPTY;
5009 	if (new_dentry == trap)
5010 		goto exit5;
5011 
5012 	error = security_path_rename(&old_path, old_dentry,
5013 				     &new_path, new_dentry, flags);
5014 	if (error)
5015 		goto exit5;
5016 
5017 	rd.old_dir	   = old_path.dentry->d_inode;
5018 	rd.old_dentry	   = old_dentry;
5019 	rd.old_mnt_idmap   = mnt_idmap(old_path.mnt);
5020 	rd.new_dir	   = new_path.dentry->d_inode;
5021 	rd.new_dentry	   = new_dentry;
5022 	rd.new_mnt_idmap   = mnt_idmap(new_path.mnt);
5023 	rd.delegated_inode = &delegated_inode;
5024 	rd.flags	   = flags;
5025 	error = vfs_rename(&rd);
5026 exit5:
5027 	dput(new_dentry);
5028 exit4:
5029 	dput(old_dentry);
5030 exit3:
5031 	unlock_rename(new_path.dentry, old_path.dentry);
5032 	if (delegated_inode) {
5033 		error = break_deleg_wait(&delegated_inode);
5034 		if (!error)
5035 			goto retry_deleg;
5036 	}
5037 	mnt_drop_write(old_path.mnt);
5038 exit2:
5039 	if (retry_estale(error, lookup_flags))
5040 		should_retry = true;
5041 	path_put(&new_path);
5042 exit1:
5043 	path_put(&old_path);
5044 	if (should_retry) {
5045 		should_retry = false;
5046 		lookup_flags |= LOOKUP_REVAL;
5047 		goto retry;
5048 	}
5049 put_names:
5050 	putname(from);
5051 	putname(to);
5052 	return error;
5053 }
5054 
SYSCALL_DEFINE5(renameat2,int,olddfd,const char __user *,oldname,int,newdfd,const char __user *,newname,unsigned int,flags)5055 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
5056 		int, newdfd, const char __user *, newname, unsigned int, flags)
5057 {
5058 	return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname),
5059 				flags);
5060 }
5061 
SYSCALL_DEFINE4(renameat,int,olddfd,const char __user *,oldname,int,newdfd,const char __user *,newname)5062 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
5063 		int, newdfd, const char __user *, newname)
5064 {
5065 	return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname),
5066 				0);
5067 }
5068 
SYSCALL_DEFINE2(rename,const char __user *,oldname,const char __user *,newname)5069 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
5070 {
5071 	return do_renameat2(AT_FDCWD, getname(oldname), AT_FDCWD,
5072 				getname(newname), 0);
5073 }
5074 
readlink_copy(char __user * buffer,int buflen,const char * link)5075 int readlink_copy(char __user *buffer, int buflen, const char *link)
5076 {
5077 	int len = PTR_ERR(link);
5078 	if (IS_ERR(link))
5079 		goto out;
5080 
5081 	len = strlen(link);
5082 	if (len > (unsigned) buflen)
5083 		len = buflen;
5084 	if (copy_to_user(buffer, link, len))
5085 		len = -EFAULT;
5086 out:
5087 	return len;
5088 }
5089 
5090 /**
5091  * vfs_readlink - copy symlink body into userspace buffer
5092  * @dentry: dentry on which to get symbolic link
5093  * @buffer: user memory pointer
5094  * @buflen: size of buffer
5095  *
5096  * Does not touch atime.  That's up to the caller if necessary
5097  *
5098  * Does not call security hook.
5099  */
vfs_readlink(struct dentry * dentry,char __user * buffer,int buflen)5100 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
5101 {
5102 	struct inode *inode = d_inode(dentry);
5103 	DEFINE_DELAYED_CALL(done);
5104 	const char *link;
5105 	int res;
5106 
5107 	if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) {
5108 		if (unlikely(inode->i_op->readlink))
5109 			return inode->i_op->readlink(dentry, buffer, buflen);
5110 
5111 		if (!d_is_symlink(dentry))
5112 			return -EINVAL;
5113 
5114 		spin_lock(&inode->i_lock);
5115 		inode->i_opflags |= IOP_DEFAULT_READLINK;
5116 		spin_unlock(&inode->i_lock);
5117 	}
5118 
5119 	link = READ_ONCE(inode->i_link);
5120 	if (!link) {
5121 		link = inode->i_op->get_link(dentry, inode, &done);
5122 		if (IS_ERR(link))
5123 			return PTR_ERR(link);
5124 	}
5125 	res = readlink_copy(buffer, buflen, link);
5126 	do_delayed_call(&done);
5127 	return res;
5128 }
5129 EXPORT_SYMBOL(vfs_readlink);
5130 
5131 /**
5132  * vfs_get_link - get symlink body
5133  * @dentry: dentry on which to get symbolic link
5134  * @done: caller needs to free returned data with this
5135  *
5136  * Calls security hook and i_op->get_link() on the supplied inode.
5137  *
5138  * It does not touch atime.  That's up to the caller if necessary.
5139  *
5140  * Does not work on "special" symlinks like /proc/$$/fd/N
5141  */
vfs_get_link(struct dentry * dentry,struct delayed_call * done)5142 const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
5143 {
5144 	const char *res = ERR_PTR(-EINVAL);
5145 	struct inode *inode = d_inode(dentry);
5146 
5147 	if (d_is_symlink(dentry)) {
5148 		res = ERR_PTR(security_inode_readlink(dentry));
5149 		if (!res)
5150 			res = inode->i_op->get_link(dentry, inode, done);
5151 	}
5152 	return res;
5153 }
5154 EXPORT_SYMBOL(vfs_get_link);
5155 
5156 /* get the link contents into pagecache */
page_get_link(struct dentry * dentry,struct inode * inode,struct delayed_call * callback)5157 const char *page_get_link(struct dentry *dentry, struct inode *inode,
5158 			  struct delayed_call *callback)
5159 {
5160 	char *kaddr;
5161 	struct page *page;
5162 	struct address_space *mapping = inode->i_mapping;
5163 
5164 	if (!dentry) {
5165 		page = find_get_page(mapping, 0);
5166 		if (!page)
5167 			return ERR_PTR(-ECHILD);
5168 		if (!PageUptodate(page)) {
5169 			put_page(page);
5170 			return ERR_PTR(-ECHILD);
5171 		}
5172 	} else {
5173 		page = read_mapping_page(mapping, 0, NULL);
5174 		if (IS_ERR(page))
5175 			return (char*)page;
5176 	}
5177 	set_delayed_call(callback, page_put_link, page);
5178 	BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
5179 	kaddr = page_address(page);
5180 	nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
5181 	return kaddr;
5182 }
5183 
5184 EXPORT_SYMBOL(page_get_link);
5185 
page_put_link(void * arg)5186 void page_put_link(void *arg)
5187 {
5188 	put_page(arg);
5189 }
5190 EXPORT_SYMBOL(page_put_link);
5191 
page_readlink(struct dentry * dentry,char __user * buffer,int buflen)5192 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
5193 {
5194 	DEFINE_DELAYED_CALL(done);
5195 	int res = readlink_copy(buffer, buflen,
5196 				page_get_link(dentry, d_inode(dentry),
5197 					      &done));
5198 	do_delayed_call(&done);
5199 	return res;
5200 }
5201 EXPORT_SYMBOL(page_readlink);
5202 
page_symlink(struct inode * inode,const char * symname,int len)5203 int page_symlink(struct inode *inode, const char *symname, int len)
5204 {
5205 	struct address_space *mapping = inode->i_mapping;
5206 	const struct address_space_operations *aops = mapping->a_ops;
5207 	bool nofs = !mapping_gfp_constraint(mapping, __GFP_FS);
5208 	struct page *page;
5209 	void *fsdata = NULL;
5210 	int err;
5211 	unsigned int flags;
5212 
5213 retry:
5214 	if (nofs)
5215 		flags = memalloc_nofs_save();
5216 	err = aops->write_begin(NULL, mapping, 0, len-1, &page, &fsdata);
5217 	if (nofs)
5218 		memalloc_nofs_restore(flags);
5219 	if (err)
5220 		goto fail;
5221 
5222 	memcpy(page_address(page), symname, len-1);
5223 
5224 	err = aops->write_end(NULL, mapping, 0, len-1, len-1,
5225 							page, fsdata);
5226 	if (err < 0)
5227 		goto fail;
5228 	if (err < len-1)
5229 		goto retry;
5230 
5231 	mark_inode_dirty(inode);
5232 	return 0;
5233 fail:
5234 	return err;
5235 }
5236 EXPORT_SYMBOL(page_symlink);
5237 
5238 const struct inode_operations page_symlink_inode_operations = {
5239 	.get_link	= page_get_link,
5240 };
5241 EXPORT_SYMBOL(page_symlink_inode_operations);
5242