xref: /openbmc/linux/fs/exportfs/expfs.c (revision 0ad53fe3)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) Neil Brown 2002
4  * Copyright (C) Christoph Hellwig 2007
5  *
6  * This file contains the code mapping from inodes to NFS file handles,
7  * and for mapping back from file handles to dentries.
8  *
9  * For details on why we do all the strange and hairy things in here
10  * take a look at Documentation/filesystems/nfs/exporting.rst.
11  */
12 #include <linux/exportfs.h>
13 #include <linux/fs.h>
14 #include <linux/file.h>
15 #include <linux/module.h>
16 #include <linux/mount.h>
17 #include <linux/namei.h>
18 #include <linux/sched.h>
19 #include <linux/cred.h>
20 
21 #define dprintk(fmt, args...) do{}while(0)
22 
23 
24 static int get_name(const struct path *path, char *name, struct dentry *child);
25 
26 
27 static int exportfs_get_name(struct vfsmount *mnt, struct dentry *dir,
28 		char *name, struct dentry *child)
29 {
30 	const struct export_operations *nop = dir->d_sb->s_export_op;
31 	struct path path = {.mnt = mnt, .dentry = dir};
32 
33 	if (nop->get_name)
34 		return nop->get_name(dir, name, child);
35 	else
36 		return get_name(&path, name, child);
37 }
38 
39 /*
40  * Check if the dentry or any of it's aliases is acceptable.
41  */
42 static struct dentry *
43 find_acceptable_alias(struct dentry *result,
44 		int (*acceptable)(void *context, struct dentry *dentry),
45 		void *context)
46 {
47 	struct dentry *dentry, *toput = NULL;
48 	struct inode *inode;
49 
50 	if (acceptable(context, result))
51 		return result;
52 
53 	inode = result->d_inode;
54 	spin_lock(&inode->i_lock);
55 	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
56 		dget(dentry);
57 		spin_unlock(&inode->i_lock);
58 		if (toput)
59 			dput(toput);
60 		if (dentry != result && acceptable(context, dentry)) {
61 			dput(result);
62 			return dentry;
63 		}
64 		spin_lock(&inode->i_lock);
65 		toput = dentry;
66 	}
67 	spin_unlock(&inode->i_lock);
68 
69 	if (toput)
70 		dput(toput);
71 	return NULL;
72 }
73 
74 static bool dentry_connected(struct dentry *dentry)
75 {
76 	dget(dentry);
77 	while (dentry->d_flags & DCACHE_DISCONNECTED) {
78 		struct dentry *parent = dget_parent(dentry);
79 
80 		dput(dentry);
81 		if (dentry == parent) {
82 			dput(parent);
83 			return false;
84 		}
85 		dentry = parent;
86 	}
87 	dput(dentry);
88 	return true;
89 }
90 
91 static void clear_disconnected(struct dentry *dentry)
92 {
93 	dget(dentry);
94 	while (dentry->d_flags & DCACHE_DISCONNECTED) {
95 		struct dentry *parent = dget_parent(dentry);
96 
97 		WARN_ON_ONCE(IS_ROOT(dentry));
98 
99 		spin_lock(&dentry->d_lock);
100 		dentry->d_flags &= ~DCACHE_DISCONNECTED;
101 		spin_unlock(&dentry->d_lock);
102 
103 		dput(dentry);
104 		dentry = parent;
105 	}
106 	dput(dentry);
107 }
108 
109 /*
110  * Reconnect a directory dentry with its parent.
111  *
112  * This can return a dentry, or NULL, or an error.
113  *
114  * In the first case the returned dentry is the parent of the given
115  * dentry, and may itself need to be reconnected to its parent.
116  *
117  * In the NULL case, a concurrent VFS operation has either renamed or
118  * removed this directory.  The concurrent operation has reconnected our
119  * dentry, so we no longer need to.
120  */
121 static struct dentry *reconnect_one(struct vfsmount *mnt,
122 		struct dentry *dentry, char *nbuf)
123 {
124 	struct dentry *parent;
125 	struct dentry *tmp;
126 	int err;
127 
128 	parent = ERR_PTR(-EACCES);
129 	inode_lock(dentry->d_inode);
130 	if (mnt->mnt_sb->s_export_op->get_parent)
131 		parent = mnt->mnt_sb->s_export_op->get_parent(dentry);
132 	inode_unlock(dentry->d_inode);
133 
134 	if (IS_ERR(parent)) {
135 		dprintk("%s: get_parent of %ld failed, err %d\n",
136 			__func__, dentry->d_inode->i_ino, PTR_ERR(parent));
137 		return parent;
138 	}
139 
140 	dprintk("%s: find name of %lu in %lu\n", __func__,
141 		dentry->d_inode->i_ino, parent->d_inode->i_ino);
142 	err = exportfs_get_name(mnt, parent, nbuf, dentry);
143 	if (err == -ENOENT)
144 		goto out_reconnected;
145 	if (err)
146 		goto out_err;
147 	dprintk("%s: found name: %s\n", __func__, nbuf);
148 	tmp = lookup_one_len_unlocked(nbuf, parent, strlen(nbuf));
149 	if (IS_ERR(tmp)) {
150 		dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp));
151 		err = PTR_ERR(tmp);
152 		goto out_err;
153 	}
154 	if (tmp != dentry) {
155 		/*
156 		 * Somebody has renamed it since exportfs_get_name();
157 		 * great, since it could've only been renamed if it
158 		 * got looked up and thus connected, and it would
159 		 * remain connected afterwards.  We are done.
160 		 */
161 		dput(tmp);
162 		goto out_reconnected;
163 	}
164 	dput(tmp);
165 	if (IS_ROOT(dentry)) {
166 		err = -ESTALE;
167 		goto out_err;
168 	}
169 	return parent;
170 
171 out_err:
172 	dput(parent);
173 	return ERR_PTR(err);
174 out_reconnected:
175 	dput(parent);
176 	/*
177 	 * Someone must have renamed our entry into another parent, in
178 	 * which case it has been reconnected by the rename.
179 	 *
180 	 * Or someone removed it entirely, in which case filehandle
181 	 * lookup will succeed but the directory is now IS_DEAD and
182 	 * subsequent operations on it will fail.
183 	 *
184 	 * Alternatively, maybe there was no race at all, and the
185 	 * filesystem is just corrupt and gave us a parent that doesn't
186 	 * actually contain any entry pointing to this inode.  So,
187 	 * double check that this worked and return -ESTALE if not:
188 	 */
189 	if (!dentry_connected(dentry))
190 		return ERR_PTR(-ESTALE);
191 	return NULL;
192 }
193 
194 /*
195  * Make sure target_dir is fully connected to the dentry tree.
196  *
197  * On successful return, DCACHE_DISCONNECTED will be cleared on
198  * target_dir, and target_dir->d_parent->...->d_parent will reach the
199  * root of the filesystem.
200  *
201  * Whenever DCACHE_DISCONNECTED is unset, target_dir is fully connected.
202  * But the converse is not true: target_dir may have DCACHE_DISCONNECTED
203  * set but already be connected.  In that case we'll verify the
204  * connection to root and then clear the flag.
205  *
206  * Note that target_dir could be removed by a concurrent operation.  In
207  * that case reconnect_path may still succeed with target_dir fully
208  * connected, but further operations using the filehandle will fail when
209  * necessary (due to S_DEAD being set on the directory).
210  */
211 static int
212 reconnect_path(struct vfsmount *mnt, struct dentry *target_dir, char *nbuf)
213 {
214 	struct dentry *dentry, *parent;
215 
216 	dentry = dget(target_dir);
217 
218 	while (dentry->d_flags & DCACHE_DISCONNECTED) {
219 		BUG_ON(dentry == mnt->mnt_sb->s_root);
220 
221 		if (IS_ROOT(dentry))
222 			parent = reconnect_one(mnt, dentry, nbuf);
223 		else
224 			parent = dget_parent(dentry);
225 
226 		if (!parent)
227 			break;
228 		dput(dentry);
229 		if (IS_ERR(parent))
230 			return PTR_ERR(parent);
231 		dentry = parent;
232 	}
233 	dput(dentry);
234 	clear_disconnected(target_dir);
235 	return 0;
236 }
237 
238 struct getdents_callback {
239 	struct dir_context ctx;
240 	char *name;		/* name that was found. It already points to a
241 				   buffer NAME_MAX+1 is size */
242 	u64 ino;		/* the inum we are looking for */
243 	int found;		/* inode matched? */
244 	int sequence;		/* sequence counter */
245 };
246 
247 /*
248  * A rather strange filldir function to capture
249  * the name matching the specified inode number.
250  */
251 static int filldir_one(struct dir_context *ctx, const char *name, int len,
252 			loff_t pos, u64 ino, unsigned int d_type)
253 {
254 	struct getdents_callback *buf =
255 		container_of(ctx, struct getdents_callback, ctx);
256 	int result = 0;
257 
258 	buf->sequence++;
259 	if (buf->ino == ino && len <= NAME_MAX) {
260 		memcpy(buf->name, name, len);
261 		buf->name[len] = '\0';
262 		buf->found = 1;
263 		result = -1;
264 	}
265 	return result;
266 }
267 
268 /**
269  * get_name - default export_operations->get_name function
270  * @path:   the directory in which to find a name
271  * @name:   a pointer to a %NAME_MAX+1 char buffer to store the name
272  * @child:  the dentry for the child directory.
273  *
274  * calls readdir on the parent until it finds an entry with
275  * the same inode number as the child, and returns that.
276  */
277 static int get_name(const struct path *path, char *name, struct dentry *child)
278 {
279 	const struct cred *cred = current_cred();
280 	struct inode *dir = path->dentry->d_inode;
281 	int error;
282 	struct file *file;
283 	struct kstat stat;
284 	struct path child_path = {
285 		.mnt = path->mnt,
286 		.dentry = child,
287 	};
288 	struct getdents_callback buffer = {
289 		.ctx.actor = filldir_one,
290 		.name = name,
291 	};
292 
293 	error = -ENOTDIR;
294 	if (!dir || !S_ISDIR(dir->i_mode))
295 		goto out;
296 	error = -EINVAL;
297 	if (!dir->i_fop)
298 		goto out;
299 	/*
300 	 * inode->i_ino is unsigned long, kstat->ino is u64, so the
301 	 * former would be insufficient on 32-bit hosts when the
302 	 * filesystem supports 64-bit inode numbers.  So we need to
303 	 * actually call ->getattr, not just read i_ino:
304 	 */
305 	error = vfs_getattr_nosec(&child_path, &stat,
306 				  STATX_INO, AT_STATX_SYNC_AS_STAT);
307 	if (error)
308 		return error;
309 	buffer.ino = stat.ino;
310 	/*
311 	 * Open the directory ...
312 	 */
313 	file = dentry_open(path, O_RDONLY, cred);
314 	error = PTR_ERR(file);
315 	if (IS_ERR(file))
316 		goto out;
317 
318 	error = -EINVAL;
319 	if (!file->f_op->iterate && !file->f_op->iterate_shared)
320 		goto out_close;
321 
322 	buffer.sequence = 0;
323 	while (1) {
324 		int old_seq = buffer.sequence;
325 
326 		error = iterate_dir(file, &buffer.ctx);
327 		if (buffer.found) {
328 			error = 0;
329 			break;
330 		}
331 
332 		if (error < 0)
333 			break;
334 
335 		error = -ENOENT;
336 		if (old_seq == buffer.sequence)
337 			break;
338 	}
339 
340 out_close:
341 	fput(file);
342 out:
343 	return error;
344 }
345 
346 /**
347  * export_encode_fh - default export_operations->encode_fh function
348  * @inode:   the object to encode
349  * @fid:     where to store the file handle fragment
350  * @max_len: maximum length to store there
351  * @parent:  parent directory inode, if wanted
352  *
353  * This default encode_fh function assumes that the 32 inode number
354  * is suitable for locating an inode, and that the generation number
355  * can be used to check that it is still valid.  It places them in the
356  * filehandle fragment where export_decode_fh expects to find them.
357  */
358 static int export_encode_fh(struct inode *inode, struct fid *fid,
359 		int *max_len, struct inode *parent)
360 {
361 	int len = *max_len;
362 	int type = FILEID_INO32_GEN;
363 
364 	if (parent && (len < 4)) {
365 		*max_len = 4;
366 		return FILEID_INVALID;
367 	} else if (len < 2) {
368 		*max_len = 2;
369 		return FILEID_INVALID;
370 	}
371 
372 	len = 2;
373 	fid->i32.ino = inode->i_ino;
374 	fid->i32.gen = inode->i_generation;
375 	if (parent) {
376 		fid->i32.parent_ino = parent->i_ino;
377 		fid->i32.parent_gen = parent->i_generation;
378 		len = 4;
379 		type = FILEID_INO32_GEN_PARENT;
380 	}
381 	*max_len = len;
382 	return type;
383 }
384 
385 int exportfs_encode_inode_fh(struct inode *inode, struct fid *fid,
386 			     int *max_len, struct inode *parent)
387 {
388 	const struct export_operations *nop = inode->i_sb->s_export_op;
389 
390 	if (nop && nop->encode_fh)
391 		return nop->encode_fh(inode, fid->raw, max_len, parent);
392 
393 	return export_encode_fh(inode, fid, max_len, parent);
394 }
395 EXPORT_SYMBOL_GPL(exportfs_encode_inode_fh);
396 
397 int exportfs_encode_fh(struct dentry *dentry, struct fid *fid, int *max_len,
398 		int connectable)
399 {
400 	int error;
401 	struct dentry *p = NULL;
402 	struct inode *inode = dentry->d_inode, *parent = NULL;
403 
404 	if (connectable && !S_ISDIR(inode->i_mode)) {
405 		p = dget_parent(dentry);
406 		/*
407 		 * note that while p might've ceased to be our parent already,
408 		 * it's still pinned by and still positive.
409 		 */
410 		parent = p->d_inode;
411 	}
412 
413 	error = exportfs_encode_inode_fh(inode, fid, max_len, parent);
414 	dput(p);
415 
416 	return error;
417 }
418 EXPORT_SYMBOL_GPL(exportfs_encode_fh);
419 
420 struct dentry *
421 exportfs_decode_fh_raw(struct vfsmount *mnt, struct fid *fid, int fh_len,
422 		       int fileid_type,
423 		       int (*acceptable)(void *, struct dentry *),
424 		       void *context)
425 {
426 	const struct export_operations *nop = mnt->mnt_sb->s_export_op;
427 	struct dentry *result, *alias;
428 	char nbuf[NAME_MAX+1];
429 	int err;
430 
431 	/*
432 	 * Try to get any dentry for the given file handle from the filesystem.
433 	 */
434 	if (!nop || !nop->fh_to_dentry)
435 		return ERR_PTR(-ESTALE);
436 	result = nop->fh_to_dentry(mnt->mnt_sb, fid, fh_len, fileid_type);
437 	if (IS_ERR_OR_NULL(result))
438 		return result;
439 
440 	/*
441 	 * If no acceptance criteria was specified by caller, a disconnected
442 	 * dentry is also accepatable. Callers may use this mode to query if
443 	 * file handle is stale or to get a reference to an inode without
444 	 * risking the high overhead caused by directory reconnect.
445 	 */
446 	if (!acceptable)
447 		return result;
448 
449 	if (d_is_dir(result)) {
450 		/*
451 		 * This request is for a directory.
452 		 *
453 		 * On the positive side there is only one dentry for each
454 		 * directory inode.  On the negative side this implies that we
455 		 * to ensure our dentry is connected all the way up to the
456 		 * filesystem root.
457 		 */
458 		if (result->d_flags & DCACHE_DISCONNECTED) {
459 			err = reconnect_path(mnt, result, nbuf);
460 			if (err)
461 				goto err_result;
462 		}
463 
464 		if (!acceptable(context, result)) {
465 			err = -EACCES;
466 			goto err_result;
467 		}
468 
469 		return result;
470 	} else {
471 		/*
472 		 * It's not a directory.  Life is a little more complicated.
473 		 */
474 		struct dentry *target_dir, *nresult;
475 
476 		/*
477 		 * See if either the dentry we just got from the filesystem
478 		 * or any alias for it is acceptable.  This is always true
479 		 * if this filesystem is exported without the subtreecheck
480 		 * option.  If the filesystem is exported with the subtree
481 		 * check option there's a fair chance we need to look at
482 		 * the parent directory in the file handle and make sure
483 		 * it's connected to the filesystem root.
484 		 */
485 		alias = find_acceptable_alias(result, acceptable, context);
486 		if (alias)
487 			return alias;
488 
489 		/*
490 		 * Try to extract a dentry for the parent directory from the
491 		 * file handle.  If this fails we'll have to give up.
492 		 */
493 		err = -ESTALE;
494 		if (!nop->fh_to_parent)
495 			goto err_result;
496 
497 		target_dir = nop->fh_to_parent(mnt->mnt_sb, fid,
498 				fh_len, fileid_type);
499 		if (!target_dir)
500 			goto err_result;
501 		err = PTR_ERR(target_dir);
502 		if (IS_ERR(target_dir))
503 			goto err_result;
504 
505 		/*
506 		 * And as usual we need to make sure the parent directory is
507 		 * connected to the filesystem root.  The VFS really doesn't
508 		 * like disconnected directories..
509 		 */
510 		err = reconnect_path(mnt, target_dir, nbuf);
511 		if (err) {
512 			dput(target_dir);
513 			goto err_result;
514 		}
515 
516 		/*
517 		 * Now that we've got both a well-connected parent and a
518 		 * dentry for the inode we're after, make sure that our
519 		 * inode is actually connected to the parent.
520 		 */
521 		err = exportfs_get_name(mnt, target_dir, nbuf, result);
522 		if (err) {
523 			dput(target_dir);
524 			goto err_result;
525 		}
526 
527 		inode_lock(target_dir->d_inode);
528 		nresult = lookup_one_len(nbuf, target_dir, strlen(nbuf));
529 		if (!IS_ERR(nresult)) {
530 			if (unlikely(nresult->d_inode != result->d_inode)) {
531 				dput(nresult);
532 				nresult = ERR_PTR(-ESTALE);
533 			}
534 		}
535 		inode_unlock(target_dir->d_inode);
536 		/*
537 		 * At this point we are done with the parent, but it's pinned
538 		 * by the child dentry anyway.
539 		 */
540 		dput(target_dir);
541 
542 		if (IS_ERR(nresult)) {
543 			err = PTR_ERR(nresult);
544 			goto err_result;
545 		}
546 		dput(result);
547 		result = nresult;
548 
549 		/*
550 		 * And finally make sure the dentry is actually acceptable
551 		 * to NFSD.
552 		 */
553 		alias = find_acceptable_alias(result, acceptable, context);
554 		if (!alias) {
555 			err = -EACCES;
556 			goto err_result;
557 		}
558 
559 		return alias;
560 	}
561 
562  err_result:
563 	dput(result);
564 	return ERR_PTR(err);
565 }
566 EXPORT_SYMBOL_GPL(exportfs_decode_fh_raw);
567 
568 struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid,
569 				  int fh_len, int fileid_type,
570 				  int (*acceptable)(void *, struct dentry *),
571 				  void *context)
572 {
573 	struct dentry *ret;
574 
575 	ret = exportfs_decode_fh_raw(mnt, fid, fh_len, fileid_type,
576 				     acceptable, context);
577 	if (IS_ERR_OR_NULL(ret)) {
578 		if (ret == ERR_PTR(-ENOMEM))
579 			return ret;
580 		return ERR_PTR(-ESTALE);
581 	}
582 	return ret;
583 }
584 EXPORT_SYMBOL_GPL(exportfs_decode_fh);
585 
586 MODULE_LICENSE("GPL");
587