1 /* 2 * linux/fs/namei.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * Some corrections by tytso. 9 */ 10 11 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname 12 * lookup logic. 13 */ 14 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture. 15 */ 16 17 #include <linux/init.h> 18 #include <linux/export.h> 19 #include <linux/kernel.h> 20 #include <linux/slab.h> 21 #include <linux/fs.h> 22 #include <linux/namei.h> 23 #include <linux/pagemap.h> 24 #include <linux/fsnotify.h> 25 #include <linux/personality.h> 26 #include <linux/security.h> 27 #include <linux/ima.h> 28 #include <linux/syscalls.h> 29 #include <linux/mount.h> 30 #include <linux/audit.h> 31 #include <linux/capability.h> 32 #include <linux/file.h> 33 #include <linux/fcntl.h> 34 #include <linux/device_cgroup.h> 35 #include <linux/fs_struct.h> 36 #include <linux/posix_acl.h> 37 #include <linux/hash.h> 38 #include <linux/bitops.h> 39 #include <linux/init_task.h> 40 #include <linux/uaccess.h> 41 42 #include "internal.h" 43 #include "mount.h" 44 45 /* [Feb-1997 T. Schoebel-Theuer] 46 * Fundamental changes in the pathname lookup mechanisms (namei) 47 * were necessary because of omirr. The reason is that omirr needs 48 * to know the _real_ pathname, not the user-supplied one, in case 49 * of symlinks (and also when transname replacements occur). 50 * 51 * The new code replaces the old recursive symlink resolution with 52 * an iterative one (in case of non-nested symlink chains). It does 53 * this with calls to <fs>_follow_link(). 54 * As a side effect, dir_namei(), _namei() and follow_link() are now 55 * replaced with a single function lookup_dentry() that can handle all 56 * the special cases of the former code. 57 * 58 * With the new dcache, the pathname is stored at each inode, at least as 59 * long as the refcount of the inode is positive. As a side effect, the 60 * size of the dcache depends on the inode cache and thus is dynamic. 61 * 62 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink 63 * resolution to correspond with current state of the code. 64 * 65 * Note that the symlink resolution is not *completely* iterative. 66 * There is still a significant amount of tail- and mid- recursion in 67 * the algorithm. Also, note that <fs>_readlink() is not used in 68 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink() 69 * may return different results than <fs>_follow_link(). Many virtual 70 * filesystems (including /proc) exhibit this behavior. 71 */ 72 73 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation: 74 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL 75 * and the name already exists in form of a symlink, try to create the new 76 * name indicated by the symlink. The old code always complained that the 77 * name already exists, due to not following the symlink even if its target 78 * is nonexistent. The new semantics affects also mknod() and link() when 79 * the name is a symlink pointing to a non-existent name. 80 * 81 * I don't know which semantics is the right one, since I have no access 82 * to standards. But I found by trial that HP-UX 9.0 has the full "new" 83 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the 84 * "old" one. Personally, I think the new semantics is much more logical. 85 * Note that "ln old new" where "new" is a symlink pointing to a non-existing 86 * file does succeed in both HP-UX and SunOs, but not in Solaris 87 * and in the old Linux semantics. 88 */ 89 90 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink 91 * semantics. See the comments in "open_namei" and "do_link" below. 92 * 93 * [10-Sep-98 Alan Modra] Another symlink change. 94 */ 95 96 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks: 97 * inside the path - always follow. 98 * in the last component in creation/removal/renaming - never follow. 99 * if LOOKUP_FOLLOW passed - follow. 100 * if the pathname has trailing slashes - follow. 101 * otherwise - don't follow. 102 * (applied in that order). 103 * 104 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT 105 * restored for 2.4. This is the last surviving part of old 4.2BSD bug. 106 * During the 2.4 we need to fix the userland stuff depending on it - 107 * hopefully we will be able to get rid of that wart in 2.5. So far only 108 * XEmacs seems to be relying on it... 109 */ 110 /* 111 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland) 112 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives 113 * any extra contention... 114 */ 115 116 /* In order to reduce some races, while at the same time doing additional 117 * checking and hopefully speeding things up, we copy filenames to the 118 * kernel data space before using them.. 119 * 120 * POSIX.1 2.4: an empty pathname is invalid (ENOENT). 121 * PATH_MAX includes the nul terminator --RR. 122 */ 123 124 #define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname)) 125 126 struct filename * 127 getname_flags(const char __user *filename, int flags, int *empty) 128 { 129 struct filename *result; 130 char *kname; 131 int len; 132 133 result = audit_reusename(filename); 134 if (result) 135 return result; 136 137 result = __getname(); 138 if (unlikely(!result)) 139 return ERR_PTR(-ENOMEM); 140 141 /* 142 * First, try to embed the struct filename inside the names_cache 143 * allocation 144 */ 145 kname = (char *)result->iname; 146 result->name = kname; 147 148 len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX); 149 if (unlikely(len < 0)) { 150 __putname(result); 151 return ERR_PTR(len); 152 } 153 154 /* 155 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a 156 * separate struct filename so we can dedicate the entire 157 * names_cache allocation for the pathname, and re-do the copy from 158 * userland. 159 */ 160 if (unlikely(len == EMBEDDED_NAME_MAX)) { 161 const size_t size = offsetof(struct filename, iname[1]); 162 kname = (char *)result; 163 164 /* 165 * size is chosen that way we to guarantee that 166 * result->iname[0] is within the same object and that 167 * kname can't be equal to result->iname, no matter what. 168 */ 169 result = kzalloc(size, GFP_KERNEL); 170 if (unlikely(!result)) { 171 __putname(kname); 172 return ERR_PTR(-ENOMEM); 173 } 174 result->name = kname; 175 len = strncpy_from_user(kname, filename, PATH_MAX); 176 if (unlikely(len < 0)) { 177 __putname(kname); 178 kfree(result); 179 return ERR_PTR(len); 180 } 181 if (unlikely(len == PATH_MAX)) { 182 __putname(kname); 183 kfree(result); 184 return ERR_PTR(-ENAMETOOLONG); 185 } 186 } 187 188 result->refcnt = 1; 189 /* The empty path is special. */ 190 if (unlikely(!len)) { 191 if (empty) 192 *empty = 1; 193 if (!(flags & LOOKUP_EMPTY)) { 194 putname(result); 195 return ERR_PTR(-ENOENT); 196 } 197 } 198 199 result->uptr = filename; 200 result->aname = NULL; 201 audit_getname(result); 202 return result; 203 } 204 205 struct filename * 206 getname(const char __user * filename) 207 { 208 return getname_flags(filename, 0, NULL); 209 } 210 211 struct filename * 212 getname_kernel(const char * filename) 213 { 214 struct filename *result; 215 int len = strlen(filename) + 1; 216 217 result = __getname(); 218 if (unlikely(!result)) 219 return ERR_PTR(-ENOMEM); 220 221 if (len <= EMBEDDED_NAME_MAX) { 222 result->name = (char *)result->iname; 223 } else if (len <= PATH_MAX) { 224 struct filename *tmp; 225 226 tmp = kmalloc(sizeof(*tmp), GFP_KERNEL); 227 if (unlikely(!tmp)) { 228 __putname(result); 229 return ERR_PTR(-ENOMEM); 230 } 231 tmp->name = (char *)result; 232 result = tmp; 233 } else { 234 __putname(result); 235 return ERR_PTR(-ENAMETOOLONG); 236 } 237 memcpy((char *)result->name, filename, len); 238 result->uptr = NULL; 239 result->aname = NULL; 240 result->refcnt = 1; 241 audit_getname(result); 242 243 return result; 244 } 245 246 void putname(struct filename *name) 247 { 248 BUG_ON(name->refcnt <= 0); 249 250 if (--name->refcnt > 0) 251 return; 252 253 if (name->name != name->iname) { 254 __putname(name->name); 255 kfree(name); 256 } else 257 __putname(name); 258 } 259 260 static int check_acl(struct inode *inode, int mask) 261 { 262 #ifdef CONFIG_FS_POSIX_ACL 263 struct posix_acl *acl; 264 265 if (mask & MAY_NOT_BLOCK) { 266 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS); 267 if (!acl) 268 return -EAGAIN; 269 /* no ->get_acl() calls in RCU mode... */ 270 if (is_uncached_acl(acl)) 271 return -ECHILD; 272 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK); 273 } 274 275 acl = get_acl(inode, ACL_TYPE_ACCESS); 276 if (IS_ERR(acl)) 277 return PTR_ERR(acl); 278 if (acl) { 279 int error = posix_acl_permission(inode, acl, mask); 280 posix_acl_release(acl); 281 return error; 282 } 283 #endif 284 285 return -EAGAIN; 286 } 287 288 /* 289 * This does the basic permission checking 290 */ 291 static int acl_permission_check(struct inode *inode, int mask) 292 { 293 unsigned int mode = inode->i_mode; 294 295 if (likely(uid_eq(current_fsuid(), inode->i_uid))) 296 mode >>= 6; 297 else { 298 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { 299 int error = check_acl(inode, mask); 300 if (error != -EAGAIN) 301 return error; 302 } 303 304 if (in_group_p(inode->i_gid)) 305 mode >>= 3; 306 } 307 308 /* 309 * If the DACs are ok we don't need any capability check. 310 */ 311 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0) 312 return 0; 313 return -EACCES; 314 } 315 316 /** 317 * generic_permission - check for access rights on a Posix-like filesystem 318 * @inode: inode to check access rights for 319 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...) 320 * 321 * Used to check for read/write/execute permissions on a file. 322 * We use "fsuid" for this, letting us set arbitrary permissions 323 * for filesystem access without changing the "normal" uids which 324 * are used for other things. 325 * 326 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk 327 * request cannot be satisfied (eg. requires blocking or too much complexity). 328 * It would then be called again in ref-walk mode. 329 */ 330 int generic_permission(struct inode *inode, int mask) 331 { 332 int ret; 333 334 /* 335 * Do the basic permission checks. 336 */ 337 ret = acl_permission_check(inode, mask); 338 if (ret != -EACCES) 339 return ret; 340 341 if (S_ISDIR(inode->i_mode)) { 342 /* DACs are overridable for directories */ 343 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) 344 return 0; 345 if (!(mask & MAY_WRITE)) 346 if (capable_wrt_inode_uidgid(inode, 347 CAP_DAC_READ_SEARCH)) 348 return 0; 349 return -EACCES; 350 } 351 /* 352 * Read/write DACs are always overridable. 353 * Executable DACs are overridable when there is 354 * at least one exec bit set. 355 */ 356 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 357 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) 358 return 0; 359 360 /* 361 * Searching includes executable on directories, else just read. 362 */ 363 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 364 if (mask == MAY_READ) 365 if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH)) 366 return 0; 367 368 return -EACCES; 369 } 370 EXPORT_SYMBOL(generic_permission); 371 372 /* 373 * We _really_ want to just do "generic_permission()" without 374 * even looking at the inode->i_op values. So we keep a cache 375 * flag in inode->i_opflags, that says "this has not special 376 * permission function, use the fast case". 377 */ 378 static inline int do_inode_permission(struct inode *inode, int mask) 379 { 380 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) { 381 if (likely(inode->i_op->permission)) 382 return inode->i_op->permission(inode, mask); 383 384 /* This gets set once for the inode lifetime */ 385 spin_lock(&inode->i_lock); 386 inode->i_opflags |= IOP_FASTPERM; 387 spin_unlock(&inode->i_lock); 388 } 389 return generic_permission(inode, mask); 390 } 391 392 /** 393 * __inode_permission - Check for access rights to a given inode 394 * @inode: Inode to check permission on 395 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 396 * 397 * Check for read/write/execute permissions on an inode. 398 * 399 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 400 * 401 * This does not check for a read-only file system. You probably want 402 * inode_permission(). 403 */ 404 int __inode_permission(struct inode *inode, int mask) 405 { 406 int retval; 407 408 if (unlikely(mask & MAY_WRITE)) { 409 /* 410 * Nobody gets write access to an immutable file. 411 */ 412 if (IS_IMMUTABLE(inode)) 413 return -EPERM; 414 415 /* 416 * Updating mtime will likely cause i_uid and i_gid to be 417 * written back improperly if their true value is unknown 418 * to the vfs. 419 */ 420 if (HAS_UNMAPPED_ID(inode)) 421 return -EACCES; 422 } 423 424 retval = do_inode_permission(inode, mask); 425 if (retval) 426 return retval; 427 428 retval = devcgroup_inode_permission(inode, mask); 429 if (retval) 430 return retval; 431 432 return security_inode_permission(inode, mask); 433 } 434 EXPORT_SYMBOL(__inode_permission); 435 436 /** 437 * sb_permission - Check superblock-level permissions 438 * @sb: Superblock of inode to check permission on 439 * @inode: Inode to check permission on 440 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 441 * 442 * Separate out file-system wide checks from inode-specific permission checks. 443 */ 444 static int sb_permission(struct super_block *sb, struct inode *inode, int mask) 445 { 446 if (unlikely(mask & MAY_WRITE)) { 447 umode_t mode = inode->i_mode; 448 449 /* Nobody gets write access to a read-only fs. */ 450 if ((sb->s_flags & MS_RDONLY) && 451 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) 452 return -EROFS; 453 } 454 return 0; 455 } 456 457 /** 458 * inode_permission - Check for access rights to a given inode 459 * @inode: Inode to check permission on 460 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 461 * 462 * Check for read/write/execute permissions on an inode. We use fs[ug]id for 463 * this, letting us set arbitrary permissions for filesystem access without 464 * changing the "normal" UIDs which are used for other things. 465 * 466 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 467 */ 468 int inode_permission(struct inode *inode, int mask) 469 { 470 int retval; 471 472 retval = sb_permission(inode->i_sb, inode, mask); 473 if (retval) 474 return retval; 475 return __inode_permission(inode, mask); 476 } 477 EXPORT_SYMBOL(inode_permission); 478 479 /** 480 * path_get - get a reference to a path 481 * @path: path to get the reference to 482 * 483 * Given a path increment the reference count to the dentry and the vfsmount. 484 */ 485 void path_get(const struct path *path) 486 { 487 mntget(path->mnt); 488 dget(path->dentry); 489 } 490 EXPORT_SYMBOL(path_get); 491 492 /** 493 * path_put - put a reference to a path 494 * @path: path to put the reference to 495 * 496 * Given a path decrement the reference count to the dentry and the vfsmount. 497 */ 498 void path_put(const struct path *path) 499 { 500 dput(path->dentry); 501 mntput(path->mnt); 502 } 503 EXPORT_SYMBOL(path_put); 504 505 #define EMBEDDED_LEVELS 2 506 struct nameidata { 507 struct path path; 508 struct qstr last; 509 struct path root; 510 struct inode *inode; /* path.dentry.d_inode */ 511 unsigned int flags; 512 unsigned seq, m_seq; 513 int last_type; 514 unsigned depth; 515 int total_link_count; 516 struct saved { 517 struct path link; 518 struct delayed_call done; 519 const char *name; 520 unsigned seq; 521 } *stack, internal[EMBEDDED_LEVELS]; 522 struct filename *name; 523 struct nameidata *saved; 524 struct inode *link_inode; 525 unsigned root_seq; 526 int dfd; 527 }; 528 529 static void set_nameidata(struct nameidata *p, int dfd, struct filename *name) 530 { 531 struct nameidata *old = current->nameidata; 532 p->stack = p->internal; 533 p->dfd = dfd; 534 p->name = name; 535 p->total_link_count = old ? old->total_link_count : 0; 536 p->saved = old; 537 current->nameidata = p; 538 } 539 540 static void restore_nameidata(void) 541 { 542 struct nameidata *now = current->nameidata, *old = now->saved; 543 544 current->nameidata = old; 545 if (old) 546 old->total_link_count = now->total_link_count; 547 if (now->stack != now->internal) 548 kfree(now->stack); 549 } 550 551 static int __nd_alloc_stack(struct nameidata *nd) 552 { 553 struct saved *p; 554 555 if (nd->flags & LOOKUP_RCU) { 556 p= kmalloc(MAXSYMLINKS * sizeof(struct saved), 557 GFP_ATOMIC); 558 if (unlikely(!p)) 559 return -ECHILD; 560 } else { 561 p= kmalloc(MAXSYMLINKS * sizeof(struct saved), 562 GFP_KERNEL); 563 if (unlikely(!p)) 564 return -ENOMEM; 565 } 566 memcpy(p, nd->internal, sizeof(nd->internal)); 567 nd->stack = p; 568 return 0; 569 } 570 571 /** 572 * path_connected - Verify that a path->dentry is below path->mnt.mnt_root 573 * @path: nameidate to verify 574 * 575 * Rename can sometimes move a file or directory outside of a bind 576 * mount, path_connected allows those cases to be detected. 577 */ 578 static bool path_connected(const struct path *path) 579 { 580 struct vfsmount *mnt = path->mnt; 581 582 /* Only bind mounts can have disconnected paths */ 583 if (mnt->mnt_root == mnt->mnt_sb->s_root) 584 return true; 585 586 return is_subdir(path->dentry, mnt->mnt_root); 587 } 588 589 static inline int nd_alloc_stack(struct nameidata *nd) 590 { 591 if (likely(nd->depth != EMBEDDED_LEVELS)) 592 return 0; 593 if (likely(nd->stack != nd->internal)) 594 return 0; 595 return __nd_alloc_stack(nd); 596 } 597 598 static void drop_links(struct nameidata *nd) 599 { 600 int i = nd->depth; 601 while (i--) { 602 struct saved *last = nd->stack + i; 603 do_delayed_call(&last->done); 604 clear_delayed_call(&last->done); 605 } 606 } 607 608 static void terminate_walk(struct nameidata *nd) 609 { 610 drop_links(nd); 611 if (!(nd->flags & LOOKUP_RCU)) { 612 int i; 613 path_put(&nd->path); 614 for (i = 0; i < nd->depth; i++) 615 path_put(&nd->stack[i].link); 616 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 617 path_put(&nd->root); 618 nd->root.mnt = NULL; 619 } 620 } else { 621 nd->flags &= ~LOOKUP_RCU; 622 if (!(nd->flags & LOOKUP_ROOT)) 623 nd->root.mnt = NULL; 624 rcu_read_unlock(); 625 } 626 nd->depth = 0; 627 } 628 629 /* path_put is needed afterwards regardless of success or failure */ 630 static bool legitimize_path(struct nameidata *nd, 631 struct path *path, unsigned seq) 632 { 633 int res = __legitimize_mnt(path->mnt, nd->m_seq); 634 if (unlikely(res)) { 635 if (res > 0) 636 path->mnt = NULL; 637 path->dentry = NULL; 638 return false; 639 } 640 if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) { 641 path->dentry = NULL; 642 return false; 643 } 644 return !read_seqcount_retry(&path->dentry->d_seq, seq); 645 } 646 647 static bool legitimize_links(struct nameidata *nd) 648 { 649 int i; 650 for (i = 0; i < nd->depth; i++) { 651 struct saved *last = nd->stack + i; 652 if (unlikely(!legitimize_path(nd, &last->link, last->seq))) { 653 drop_links(nd); 654 nd->depth = i + 1; 655 return false; 656 } 657 } 658 return true; 659 } 660 661 /* 662 * Path walking has 2 modes, rcu-walk and ref-walk (see 663 * Documentation/filesystems/path-lookup.txt). In situations when we can't 664 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab 665 * normal reference counts on dentries and vfsmounts to transition to ref-walk 666 * mode. Refcounts are grabbed at the last known good point before rcu-walk 667 * got stuck, so ref-walk may continue from there. If this is not successful 668 * (eg. a seqcount has changed), then failure is returned and it's up to caller 669 * to restart the path walk from the beginning in ref-walk mode. 670 */ 671 672 /** 673 * unlazy_walk - try to switch to ref-walk mode. 674 * @nd: nameidata pathwalk data 675 * @dentry: child of nd->path.dentry or NULL 676 * @seq: seq number to check dentry against 677 * Returns: 0 on success, -ECHILD on failure 678 * 679 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry 680 * for ref-walk mode. @dentry must be a path found by a do_lookup call on 681 * @nd or NULL. Must be called from rcu-walk context. 682 * Nothing should touch nameidata between unlazy_walk() failure and 683 * terminate_walk(). 684 */ 685 static int unlazy_walk(struct nameidata *nd, struct dentry *dentry, unsigned seq) 686 { 687 struct dentry *parent = nd->path.dentry; 688 689 BUG_ON(!(nd->flags & LOOKUP_RCU)); 690 691 nd->flags &= ~LOOKUP_RCU; 692 if (unlikely(!legitimize_links(nd))) 693 goto out2; 694 if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq))) 695 goto out2; 696 if (unlikely(!lockref_get_not_dead(&parent->d_lockref))) 697 goto out1; 698 699 /* 700 * For a negative lookup, the lookup sequence point is the parents 701 * sequence point, and it only needs to revalidate the parent dentry. 702 * 703 * For a positive lookup, we need to move both the parent and the 704 * dentry from the RCU domain to be properly refcounted. And the 705 * sequence number in the dentry validates *both* dentry counters, 706 * since we checked the sequence number of the parent after we got 707 * the child sequence number. So we know the parent must still 708 * be valid if the child sequence number is still valid. 709 */ 710 if (!dentry) { 711 if (read_seqcount_retry(&parent->d_seq, nd->seq)) 712 goto out; 713 BUG_ON(nd->inode != parent->d_inode); 714 } else { 715 if (!lockref_get_not_dead(&dentry->d_lockref)) 716 goto out; 717 if (read_seqcount_retry(&dentry->d_seq, seq)) 718 goto drop_dentry; 719 } 720 721 /* 722 * Sequence counts matched. Now make sure that the root is 723 * still valid and get it if required. 724 */ 725 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 726 if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq))) { 727 rcu_read_unlock(); 728 dput(dentry); 729 return -ECHILD; 730 } 731 } 732 733 rcu_read_unlock(); 734 return 0; 735 736 drop_dentry: 737 rcu_read_unlock(); 738 dput(dentry); 739 goto drop_root_mnt; 740 out2: 741 nd->path.mnt = NULL; 742 out1: 743 nd->path.dentry = NULL; 744 out: 745 rcu_read_unlock(); 746 drop_root_mnt: 747 if (!(nd->flags & LOOKUP_ROOT)) 748 nd->root.mnt = NULL; 749 return -ECHILD; 750 } 751 752 static int unlazy_link(struct nameidata *nd, struct path *link, unsigned seq) 753 { 754 if (unlikely(!legitimize_path(nd, link, seq))) { 755 drop_links(nd); 756 nd->depth = 0; 757 nd->flags &= ~LOOKUP_RCU; 758 nd->path.mnt = NULL; 759 nd->path.dentry = NULL; 760 if (!(nd->flags & LOOKUP_ROOT)) 761 nd->root.mnt = NULL; 762 rcu_read_unlock(); 763 } else if (likely(unlazy_walk(nd, NULL, 0)) == 0) { 764 return 0; 765 } 766 path_put(link); 767 return -ECHILD; 768 } 769 770 static inline int d_revalidate(struct dentry *dentry, unsigned int flags) 771 { 772 return dentry->d_op->d_revalidate(dentry, flags); 773 } 774 775 /** 776 * complete_walk - successful completion of path walk 777 * @nd: pointer nameidata 778 * 779 * If we had been in RCU mode, drop out of it and legitimize nd->path. 780 * Revalidate the final result, unless we'd already done that during 781 * the path walk or the filesystem doesn't ask for it. Return 0 on 782 * success, -error on failure. In case of failure caller does not 783 * need to drop nd->path. 784 */ 785 static int complete_walk(struct nameidata *nd) 786 { 787 struct dentry *dentry = nd->path.dentry; 788 int status; 789 790 if (nd->flags & LOOKUP_RCU) { 791 if (!(nd->flags & LOOKUP_ROOT)) 792 nd->root.mnt = NULL; 793 if (unlikely(unlazy_walk(nd, NULL, 0))) 794 return -ECHILD; 795 } 796 797 if (likely(!(nd->flags & LOOKUP_JUMPED))) 798 return 0; 799 800 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE))) 801 return 0; 802 803 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags); 804 if (status > 0) 805 return 0; 806 807 if (!status) 808 status = -ESTALE; 809 810 return status; 811 } 812 813 static void set_root(struct nameidata *nd) 814 { 815 struct fs_struct *fs = current->fs; 816 817 if (nd->flags & LOOKUP_RCU) { 818 unsigned seq; 819 820 do { 821 seq = read_seqcount_begin(&fs->seq); 822 nd->root = fs->root; 823 nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq); 824 } while (read_seqcount_retry(&fs->seq, seq)); 825 } else { 826 get_fs_root(fs, &nd->root); 827 } 828 } 829 830 static void path_put_conditional(struct path *path, struct nameidata *nd) 831 { 832 dput(path->dentry); 833 if (path->mnt != nd->path.mnt) 834 mntput(path->mnt); 835 } 836 837 static inline void path_to_nameidata(const struct path *path, 838 struct nameidata *nd) 839 { 840 if (!(nd->flags & LOOKUP_RCU)) { 841 dput(nd->path.dentry); 842 if (nd->path.mnt != path->mnt) 843 mntput(nd->path.mnt); 844 } 845 nd->path.mnt = path->mnt; 846 nd->path.dentry = path->dentry; 847 } 848 849 static int nd_jump_root(struct nameidata *nd) 850 { 851 if (nd->flags & LOOKUP_RCU) { 852 struct dentry *d; 853 nd->path = nd->root; 854 d = nd->path.dentry; 855 nd->inode = d->d_inode; 856 nd->seq = nd->root_seq; 857 if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq))) 858 return -ECHILD; 859 } else { 860 path_put(&nd->path); 861 nd->path = nd->root; 862 path_get(&nd->path); 863 nd->inode = nd->path.dentry->d_inode; 864 } 865 nd->flags |= LOOKUP_JUMPED; 866 return 0; 867 } 868 869 /* 870 * Helper to directly jump to a known parsed path from ->get_link, 871 * caller must have taken a reference to path beforehand. 872 */ 873 void nd_jump_link(struct path *path) 874 { 875 struct nameidata *nd = current->nameidata; 876 path_put(&nd->path); 877 878 nd->path = *path; 879 nd->inode = nd->path.dentry->d_inode; 880 nd->flags |= LOOKUP_JUMPED; 881 } 882 883 static inline void put_link(struct nameidata *nd) 884 { 885 struct saved *last = nd->stack + --nd->depth; 886 do_delayed_call(&last->done); 887 if (!(nd->flags & LOOKUP_RCU)) 888 path_put(&last->link); 889 } 890 891 int sysctl_protected_symlinks __read_mostly = 0; 892 int sysctl_protected_hardlinks __read_mostly = 0; 893 894 /** 895 * may_follow_link - Check symlink following for unsafe situations 896 * @nd: nameidata pathwalk data 897 * 898 * In the case of the sysctl_protected_symlinks sysctl being enabled, 899 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is 900 * in a sticky world-writable directory. This is to protect privileged 901 * processes from failing races against path names that may change out 902 * from under them by way of other users creating malicious symlinks. 903 * It will permit symlinks to be followed only when outside a sticky 904 * world-writable directory, or when the uid of the symlink and follower 905 * match, or when the directory owner matches the symlink's owner. 906 * 907 * Returns 0 if following the symlink is allowed, -ve on error. 908 */ 909 static inline int may_follow_link(struct nameidata *nd) 910 { 911 const struct inode *inode; 912 const struct inode *parent; 913 kuid_t puid; 914 915 if (!sysctl_protected_symlinks) 916 return 0; 917 918 /* Allowed if owner and follower match. */ 919 inode = nd->link_inode; 920 if (uid_eq(current_cred()->fsuid, inode->i_uid)) 921 return 0; 922 923 /* Allowed if parent directory not sticky and world-writable. */ 924 parent = nd->inode; 925 if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH)) 926 return 0; 927 928 /* Allowed if parent directory and link owner match. */ 929 puid = parent->i_uid; 930 if (uid_valid(puid) && uid_eq(puid, inode->i_uid)) 931 return 0; 932 933 if (nd->flags & LOOKUP_RCU) 934 return -ECHILD; 935 936 audit_log_link_denied("follow_link", &nd->stack[0].link); 937 return -EACCES; 938 } 939 940 /** 941 * safe_hardlink_source - Check for safe hardlink conditions 942 * @inode: the source inode to hardlink from 943 * 944 * Return false if at least one of the following conditions: 945 * - inode is not a regular file 946 * - inode is setuid 947 * - inode is setgid and group-exec 948 * - access failure for read and write 949 * 950 * Otherwise returns true. 951 */ 952 static bool safe_hardlink_source(struct inode *inode) 953 { 954 umode_t mode = inode->i_mode; 955 956 /* Special files should not get pinned to the filesystem. */ 957 if (!S_ISREG(mode)) 958 return false; 959 960 /* Setuid files should not get pinned to the filesystem. */ 961 if (mode & S_ISUID) 962 return false; 963 964 /* Executable setgid files should not get pinned to the filesystem. */ 965 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) 966 return false; 967 968 /* Hardlinking to unreadable or unwritable sources is dangerous. */ 969 if (inode_permission(inode, MAY_READ | MAY_WRITE)) 970 return false; 971 972 return true; 973 } 974 975 /** 976 * may_linkat - Check permissions for creating a hardlink 977 * @link: the source to hardlink from 978 * 979 * Block hardlink when all of: 980 * - sysctl_protected_hardlinks enabled 981 * - fsuid does not match inode 982 * - hardlink source is unsafe (see safe_hardlink_source() above) 983 * - not CAP_FOWNER in a namespace with the inode owner uid mapped 984 * 985 * Returns 0 if successful, -ve on error. 986 */ 987 static int may_linkat(struct path *link) 988 { 989 struct inode *inode; 990 991 if (!sysctl_protected_hardlinks) 992 return 0; 993 994 inode = link->dentry->d_inode; 995 996 /* Source inode owner (or CAP_FOWNER) can hardlink all they like, 997 * otherwise, it must be a safe source. 998 */ 999 if (inode_owner_or_capable(inode) || safe_hardlink_source(inode)) 1000 return 0; 1001 1002 audit_log_link_denied("linkat", link); 1003 return -EPERM; 1004 } 1005 1006 static __always_inline 1007 const char *get_link(struct nameidata *nd) 1008 { 1009 struct saved *last = nd->stack + nd->depth - 1; 1010 struct dentry *dentry = last->link.dentry; 1011 struct inode *inode = nd->link_inode; 1012 int error; 1013 const char *res; 1014 1015 if (!(nd->flags & LOOKUP_RCU)) { 1016 touch_atime(&last->link); 1017 cond_resched(); 1018 } else if (atime_needs_update_rcu(&last->link, inode)) { 1019 if (unlikely(unlazy_walk(nd, NULL, 0))) 1020 return ERR_PTR(-ECHILD); 1021 touch_atime(&last->link); 1022 } 1023 1024 error = security_inode_follow_link(dentry, inode, 1025 nd->flags & LOOKUP_RCU); 1026 if (unlikely(error)) 1027 return ERR_PTR(error); 1028 1029 nd->last_type = LAST_BIND; 1030 res = inode->i_link; 1031 if (!res) { 1032 const char * (*get)(struct dentry *, struct inode *, 1033 struct delayed_call *); 1034 get = inode->i_op->get_link; 1035 if (nd->flags & LOOKUP_RCU) { 1036 res = get(NULL, inode, &last->done); 1037 if (res == ERR_PTR(-ECHILD)) { 1038 if (unlikely(unlazy_walk(nd, NULL, 0))) 1039 return ERR_PTR(-ECHILD); 1040 res = get(dentry, inode, &last->done); 1041 } 1042 } else { 1043 res = get(dentry, inode, &last->done); 1044 } 1045 if (IS_ERR_OR_NULL(res)) 1046 return res; 1047 } 1048 if (*res == '/') { 1049 if (!nd->root.mnt) 1050 set_root(nd); 1051 if (unlikely(nd_jump_root(nd))) 1052 return ERR_PTR(-ECHILD); 1053 while (unlikely(*++res == '/')) 1054 ; 1055 } 1056 if (!*res) 1057 res = NULL; 1058 return res; 1059 } 1060 1061 /* 1062 * follow_up - Find the mountpoint of path's vfsmount 1063 * 1064 * Given a path, find the mountpoint of its source file system. 1065 * Replace @path with the path of the mountpoint in the parent mount. 1066 * Up is towards /. 1067 * 1068 * Return 1 if we went up a level and 0 if we were already at the 1069 * root. 1070 */ 1071 int follow_up(struct path *path) 1072 { 1073 struct mount *mnt = real_mount(path->mnt); 1074 struct mount *parent; 1075 struct dentry *mountpoint; 1076 1077 read_seqlock_excl(&mount_lock); 1078 parent = mnt->mnt_parent; 1079 if (parent == mnt) { 1080 read_sequnlock_excl(&mount_lock); 1081 return 0; 1082 } 1083 mntget(&parent->mnt); 1084 mountpoint = dget(mnt->mnt_mountpoint); 1085 read_sequnlock_excl(&mount_lock); 1086 dput(path->dentry); 1087 path->dentry = mountpoint; 1088 mntput(path->mnt); 1089 path->mnt = &parent->mnt; 1090 return 1; 1091 } 1092 EXPORT_SYMBOL(follow_up); 1093 1094 /* 1095 * Perform an automount 1096 * - return -EISDIR to tell follow_managed() to stop and return the path we 1097 * were called with. 1098 */ 1099 static int follow_automount(struct path *path, struct nameidata *nd, 1100 bool *need_mntput) 1101 { 1102 struct vfsmount *mnt; 1103 int err; 1104 1105 if (!path->dentry->d_op || !path->dentry->d_op->d_automount) 1106 return -EREMOTE; 1107 1108 /* We don't want to mount if someone's just doing a stat - 1109 * unless they're stat'ing a directory and appended a '/' to 1110 * the name. 1111 * 1112 * We do, however, want to mount if someone wants to open or 1113 * create a file of any type under the mountpoint, wants to 1114 * traverse through the mountpoint or wants to open the 1115 * mounted directory. Also, autofs may mark negative dentries 1116 * as being automount points. These will need the attentions 1117 * of the daemon to instantiate them before they can be used. 1118 */ 1119 if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | 1120 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) && 1121 path->dentry->d_inode) 1122 return -EISDIR; 1123 1124 if (path->dentry->d_sb->s_user_ns != &init_user_ns) 1125 return -EACCES; 1126 1127 nd->total_link_count++; 1128 if (nd->total_link_count >= 40) 1129 return -ELOOP; 1130 1131 mnt = path->dentry->d_op->d_automount(path); 1132 if (IS_ERR(mnt)) { 1133 /* 1134 * The filesystem is allowed to return -EISDIR here to indicate 1135 * it doesn't want to automount. For instance, autofs would do 1136 * this so that its userspace daemon can mount on this dentry. 1137 * 1138 * However, we can only permit this if it's a terminal point in 1139 * the path being looked up; if it wasn't then the remainder of 1140 * the path is inaccessible and we should say so. 1141 */ 1142 if (PTR_ERR(mnt) == -EISDIR && (nd->flags & LOOKUP_PARENT)) 1143 return -EREMOTE; 1144 return PTR_ERR(mnt); 1145 } 1146 1147 if (!mnt) /* mount collision */ 1148 return 0; 1149 1150 if (!*need_mntput) { 1151 /* lock_mount() may release path->mnt on error */ 1152 mntget(path->mnt); 1153 *need_mntput = true; 1154 } 1155 err = finish_automount(mnt, path); 1156 1157 switch (err) { 1158 case -EBUSY: 1159 /* Someone else made a mount here whilst we were busy */ 1160 return 0; 1161 case 0: 1162 path_put(path); 1163 path->mnt = mnt; 1164 path->dentry = dget(mnt->mnt_root); 1165 return 0; 1166 default: 1167 return err; 1168 } 1169 1170 } 1171 1172 /* 1173 * Handle a dentry that is managed in some way. 1174 * - Flagged for transit management (autofs) 1175 * - Flagged as mountpoint 1176 * - Flagged as automount point 1177 * 1178 * This may only be called in refwalk mode. 1179 * 1180 * Serialization is taken care of in namespace.c 1181 */ 1182 static int follow_managed(struct path *path, struct nameidata *nd) 1183 { 1184 struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */ 1185 unsigned managed; 1186 bool need_mntput = false; 1187 int ret = 0; 1188 1189 /* Given that we're not holding a lock here, we retain the value in a 1190 * local variable for each dentry as we look at it so that we don't see 1191 * the components of that value change under us */ 1192 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1193 managed &= DCACHE_MANAGED_DENTRY, 1194 unlikely(managed != 0)) { 1195 /* Allow the filesystem to manage the transit without i_mutex 1196 * being held. */ 1197 if (managed & DCACHE_MANAGE_TRANSIT) { 1198 BUG_ON(!path->dentry->d_op); 1199 BUG_ON(!path->dentry->d_op->d_manage); 1200 ret = path->dentry->d_op->d_manage(path, false); 1201 if (ret < 0) 1202 break; 1203 } 1204 1205 /* Transit to a mounted filesystem. */ 1206 if (managed & DCACHE_MOUNTED) { 1207 struct vfsmount *mounted = lookup_mnt(path); 1208 if (mounted) { 1209 dput(path->dentry); 1210 if (need_mntput) 1211 mntput(path->mnt); 1212 path->mnt = mounted; 1213 path->dentry = dget(mounted->mnt_root); 1214 need_mntput = true; 1215 continue; 1216 } 1217 1218 /* Something is mounted on this dentry in another 1219 * namespace and/or whatever was mounted there in this 1220 * namespace got unmounted before lookup_mnt() could 1221 * get it */ 1222 } 1223 1224 /* Handle an automount point */ 1225 if (managed & DCACHE_NEED_AUTOMOUNT) { 1226 ret = follow_automount(path, nd, &need_mntput); 1227 if (ret < 0) 1228 break; 1229 continue; 1230 } 1231 1232 /* We didn't change the current path point */ 1233 break; 1234 } 1235 1236 if (need_mntput && path->mnt == mnt) 1237 mntput(path->mnt); 1238 if (ret == -EISDIR || !ret) 1239 ret = 1; 1240 if (need_mntput) 1241 nd->flags |= LOOKUP_JUMPED; 1242 if (unlikely(ret < 0)) 1243 path_put_conditional(path, nd); 1244 return ret; 1245 } 1246 1247 int follow_down_one(struct path *path) 1248 { 1249 struct vfsmount *mounted; 1250 1251 mounted = lookup_mnt(path); 1252 if (mounted) { 1253 dput(path->dentry); 1254 mntput(path->mnt); 1255 path->mnt = mounted; 1256 path->dentry = dget(mounted->mnt_root); 1257 return 1; 1258 } 1259 return 0; 1260 } 1261 EXPORT_SYMBOL(follow_down_one); 1262 1263 static inline int managed_dentry_rcu(const struct path *path) 1264 { 1265 return (path->dentry->d_flags & DCACHE_MANAGE_TRANSIT) ? 1266 path->dentry->d_op->d_manage(path, true) : 0; 1267 } 1268 1269 /* 1270 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if 1271 * we meet a managed dentry that would need blocking. 1272 */ 1273 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, 1274 struct inode **inode, unsigned *seqp) 1275 { 1276 for (;;) { 1277 struct mount *mounted; 1278 /* 1279 * Don't forget we might have a non-mountpoint managed dentry 1280 * that wants to block transit. 1281 */ 1282 switch (managed_dentry_rcu(path)) { 1283 case -ECHILD: 1284 default: 1285 return false; 1286 case -EISDIR: 1287 return true; 1288 case 0: 1289 break; 1290 } 1291 1292 if (!d_mountpoint(path->dentry)) 1293 return !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT); 1294 1295 mounted = __lookup_mnt(path->mnt, path->dentry); 1296 if (!mounted) 1297 break; 1298 path->mnt = &mounted->mnt; 1299 path->dentry = mounted->mnt.mnt_root; 1300 nd->flags |= LOOKUP_JUMPED; 1301 *seqp = read_seqcount_begin(&path->dentry->d_seq); 1302 /* 1303 * Update the inode too. We don't need to re-check the 1304 * dentry sequence number here after this d_inode read, 1305 * because a mount-point is always pinned. 1306 */ 1307 *inode = path->dentry->d_inode; 1308 } 1309 return !read_seqretry(&mount_lock, nd->m_seq) && 1310 !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT); 1311 } 1312 1313 static int follow_dotdot_rcu(struct nameidata *nd) 1314 { 1315 struct inode *inode = nd->inode; 1316 1317 while (1) { 1318 if (path_equal(&nd->path, &nd->root)) 1319 break; 1320 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1321 struct dentry *old = nd->path.dentry; 1322 struct dentry *parent = old->d_parent; 1323 unsigned seq; 1324 1325 inode = parent->d_inode; 1326 seq = read_seqcount_begin(&parent->d_seq); 1327 if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq))) 1328 return -ECHILD; 1329 nd->path.dentry = parent; 1330 nd->seq = seq; 1331 if (unlikely(!path_connected(&nd->path))) 1332 return -ENOENT; 1333 break; 1334 } else { 1335 struct mount *mnt = real_mount(nd->path.mnt); 1336 struct mount *mparent = mnt->mnt_parent; 1337 struct dentry *mountpoint = mnt->mnt_mountpoint; 1338 struct inode *inode2 = mountpoint->d_inode; 1339 unsigned seq = read_seqcount_begin(&mountpoint->d_seq); 1340 if (unlikely(read_seqretry(&mount_lock, nd->m_seq))) 1341 return -ECHILD; 1342 if (&mparent->mnt == nd->path.mnt) 1343 break; 1344 /* we know that mountpoint was pinned */ 1345 nd->path.dentry = mountpoint; 1346 nd->path.mnt = &mparent->mnt; 1347 inode = inode2; 1348 nd->seq = seq; 1349 } 1350 } 1351 while (unlikely(d_mountpoint(nd->path.dentry))) { 1352 struct mount *mounted; 1353 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry); 1354 if (unlikely(read_seqretry(&mount_lock, nd->m_seq))) 1355 return -ECHILD; 1356 if (!mounted) 1357 break; 1358 nd->path.mnt = &mounted->mnt; 1359 nd->path.dentry = mounted->mnt.mnt_root; 1360 inode = nd->path.dentry->d_inode; 1361 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 1362 } 1363 nd->inode = inode; 1364 return 0; 1365 } 1366 1367 /* 1368 * Follow down to the covering mount currently visible to userspace. At each 1369 * point, the filesystem owning that dentry may be queried as to whether the 1370 * caller is permitted to proceed or not. 1371 */ 1372 int follow_down(struct path *path) 1373 { 1374 unsigned managed; 1375 int ret; 1376 1377 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1378 unlikely(managed & DCACHE_MANAGED_DENTRY)) { 1379 /* Allow the filesystem to manage the transit without i_mutex 1380 * being held. 1381 * 1382 * We indicate to the filesystem if someone is trying to mount 1383 * something here. This gives autofs the chance to deny anyone 1384 * other than its daemon the right to mount on its 1385 * superstructure. 1386 * 1387 * The filesystem may sleep at this point. 1388 */ 1389 if (managed & DCACHE_MANAGE_TRANSIT) { 1390 BUG_ON(!path->dentry->d_op); 1391 BUG_ON(!path->dentry->d_op->d_manage); 1392 ret = path->dentry->d_op->d_manage(path, false); 1393 if (ret < 0) 1394 return ret == -EISDIR ? 0 : ret; 1395 } 1396 1397 /* Transit to a mounted filesystem. */ 1398 if (managed & DCACHE_MOUNTED) { 1399 struct vfsmount *mounted = lookup_mnt(path); 1400 if (!mounted) 1401 break; 1402 dput(path->dentry); 1403 mntput(path->mnt); 1404 path->mnt = mounted; 1405 path->dentry = dget(mounted->mnt_root); 1406 continue; 1407 } 1408 1409 /* Don't handle automount points here */ 1410 break; 1411 } 1412 return 0; 1413 } 1414 EXPORT_SYMBOL(follow_down); 1415 1416 /* 1417 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot() 1418 */ 1419 static void follow_mount(struct path *path) 1420 { 1421 while (d_mountpoint(path->dentry)) { 1422 struct vfsmount *mounted = lookup_mnt(path); 1423 if (!mounted) 1424 break; 1425 dput(path->dentry); 1426 mntput(path->mnt); 1427 path->mnt = mounted; 1428 path->dentry = dget(mounted->mnt_root); 1429 } 1430 } 1431 1432 static int path_parent_directory(struct path *path) 1433 { 1434 struct dentry *old = path->dentry; 1435 /* rare case of legitimate dget_parent()... */ 1436 path->dentry = dget_parent(path->dentry); 1437 dput(old); 1438 if (unlikely(!path_connected(path))) 1439 return -ENOENT; 1440 return 0; 1441 } 1442 1443 static int follow_dotdot(struct nameidata *nd) 1444 { 1445 while(1) { 1446 if (nd->path.dentry == nd->root.dentry && 1447 nd->path.mnt == nd->root.mnt) { 1448 break; 1449 } 1450 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1451 int ret = path_parent_directory(&nd->path); 1452 if (ret) 1453 return ret; 1454 break; 1455 } 1456 if (!follow_up(&nd->path)) 1457 break; 1458 } 1459 follow_mount(&nd->path); 1460 nd->inode = nd->path.dentry->d_inode; 1461 return 0; 1462 } 1463 1464 /* 1465 * This looks up the name in dcache and possibly revalidates the found dentry. 1466 * NULL is returned if the dentry does not exist in the cache. 1467 */ 1468 static struct dentry *lookup_dcache(const struct qstr *name, 1469 struct dentry *dir, 1470 unsigned int flags) 1471 { 1472 struct dentry *dentry; 1473 int error; 1474 1475 dentry = d_lookup(dir, name); 1476 if (dentry) { 1477 if (dentry->d_flags & DCACHE_OP_REVALIDATE) { 1478 error = d_revalidate(dentry, flags); 1479 if (unlikely(error <= 0)) { 1480 if (!error) 1481 d_invalidate(dentry); 1482 dput(dentry); 1483 return ERR_PTR(error); 1484 } 1485 } 1486 } 1487 return dentry; 1488 } 1489 1490 /* 1491 * Call i_op->lookup on the dentry. The dentry must be negative and 1492 * unhashed. 1493 * 1494 * dir->d_inode->i_mutex must be held 1495 */ 1496 static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry, 1497 unsigned int flags) 1498 { 1499 struct dentry *old; 1500 1501 /* Don't create child dentry for a dead directory. */ 1502 if (unlikely(IS_DEADDIR(dir))) { 1503 dput(dentry); 1504 return ERR_PTR(-ENOENT); 1505 } 1506 1507 old = dir->i_op->lookup(dir, dentry, flags); 1508 if (unlikely(old)) { 1509 dput(dentry); 1510 dentry = old; 1511 } 1512 return dentry; 1513 } 1514 1515 static struct dentry *__lookup_hash(const struct qstr *name, 1516 struct dentry *base, unsigned int flags) 1517 { 1518 struct dentry *dentry = lookup_dcache(name, base, flags); 1519 1520 if (dentry) 1521 return dentry; 1522 1523 dentry = d_alloc(base, name); 1524 if (unlikely(!dentry)) 1525 return ERR_PTR(-ENOMEM); 1526 1527 return lookup_real(base->d_inode, dentry, flags); 1528 } 1529 1530 static int lookup_fast(struct nameidata *nd, 1531 struct path *path, struct inode **inode, 1532 unsigned *seqp) 1533 { 1534 struct vfsmount *mnt = nd->path.mnt; 1535 struct dentry *dentry, *parent = nd->path.dentry; 1536 int status = 1; 1537 int err; 1538 1539 /* 1540 * Rename seqlock is not required here because in the off chance 1541 * of a false negative due to a concurrent rename, the caller is 1542 * going to fall back to non-racy lookup. 1543 */ 1544 if (nd->flags & LOOKUP_RCU) { 1545 unsigned seq; 1546 bool negative; 1547 dentry = __d_lookup_rcu(parent, &nd->last, &seq); 1548 if (unlikely(!dentry)) { 1549 if (unlazy_walk(nd, NULL, 0)) 1550 return -ECHILD; 1551 return 0; 1552 } 1553 1554 /* 1555 * This sequence count validates that the inode matches 1556 * the dentry name information from lookup. 1557 */ 1558 *inode = d_backing_inode(dentry); 1559 negative = d_is_negative(dentry); 1560 if (unlikely(read_seqcount_retry(&dentry->d_seq, seq))) 1561 return -ECHILD; 1562 1563 /* 1564 * This sequence count validates that the parent had no 1565 * changes while we did the lookup of the dentry above. 1566 * 1567 * The memory barrier in read_seqcount_begin of child is 1568 * enough, we can use __read_seqcount_retry here. 1569 */ 1570 if (unlikely(__read_seqcount_retry(&parent->d_seq, nd->seq))) 1571 return -ECHILD; 1572 1573 *seqp = seq; 1574 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) 1575 status = d_revalidate(dentry, nd->flags); 1576 if (unlikely(status <= 0)) { 1577 if (unlazy_walk(nd, dentry, seq)) 1578 return -ECHILD; 1579 if (status == -ECHILD) 1580 status = d_revalidate(dentry, nd->flags); 1581 } else { 1582 /* 1583 * Note: do negative dentry check after revalidation in 1584 * case that drops it. 1585 */ 1586 if (unlikely(negative)) 1587 return -ENOENT; 1588 path->mnt = mnt; 1589 path->dentry = dentry; 1590 if (likely(__follow_mount_rcu(nd, path, inode, seqp))) 1591 return 1; 1592 if (unlazy_walk(nd, dentry, seq)) 1593 return -ECHILD; 1594 } 1595 } else { 1596 dentry = __d_lookup(parent, &nd->last); 1597 if (unlikely(!dentry)) 1598 return 0; 1599 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) 1600 status = d_revalidate(dentry, nd->flags); 1601 } 1602 if (unlikely(status <= 0)) { 1603 if (!status) 1604 d_invalidate(dentry); 1605 dput(dentry); 1606 return status; 1607 } 1608 if (unlikely(d_is_negative(dentry))) { 1609 dput(dentry); 1610 return -ENOENT; 1611 } 1612 1613 path->mnt = mnt; 1614 path->dentry = dentry; 1615 err = follow_managed(path, nd); 1616 if (likely(err > 0)) 1617 *inode = d_backing_inode(path->dentry); 1618 return err; 1619 } 1620 1621 /* Fast lookup failed, do it the slow way */ 1622 static struct dentry *lookup_slow(const struct qstr *name, 1623 struct dentry *dir, 1624 unsigned int flags) 1625 { 1626 struct dentry *dentry = ERR_PTR(-ENOENT), *old; 1627 struct inode *inode = dir->d_inode; 1628 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq); 1629 1630 inode_lock_shared(inode); 1631 /* Don't go there if it's already dead */ 1632 if (unlikely(IS_DEADDIR(inode))) 1633 goto out; 1634 again: 1635 dentry = d_alloc_parallel(dir, name, &wq); 1636 if (IS_ERR(dentry)) 1637 goto out; 1638 if (unlikely(!d_in_lookup(dentry))) { 1639 if ((dentry->d_flags & DCACHE_OP_REVALIDATE) && 1640 !(flags & LOOKUP_NO_REVAL)) { 1641 int error = d_revalidate(dentry, flags); 1642 if (unlikely(error <= 0)) { 1643 if (!error) { 1644 d_invalidate(dentry); 1645 dput(dentry); 1646 goto again; 1647 } 1648 dput(dentry); 1649 dentry = ERR_PTR(error); 1650 } 1651 } 1652 } else { 1653 old = inode->i_op->lookup(inode, dentry, flags); 1654 d_lookup_done(dentry); 1655 if (unlikely(old)) { 1656 dput(dentry); 1657 dentry = old; 1658 } 1659 } 1660 out: 1661 inode_unlock_shared(inode); 1662 return dentry; 1663 } 1664 1665 static inline int may_lookup(struct nameidata *nd) 1666 { 1667 if (nd->flags & LOOKUP_RCU) { 1668 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK); 1669 if (err != -ECHILD) 1670 return err; 1671 if (unlazy_walk(nd, NULL, 0)) 1672 return -ECHILD; 1673 } 1674 return inode_permission(nd->inode, MAY_EXEC); 1675 } 1676 1677 static inline int handle_dots(struct nameidata *nd, int type) 1678 { 1679 if (type == LAST_DOTDOT) { 1680 if (!nd->root.mnt) 1681 set_root(nd); 1682 if (nd->flags & LOOKUP_RCU) { 1683 return follow_dotdot_rcu(nd); 1684 } else 1685 return follow_dotdot(nd); 1686 } 1687 return 0; 1688 } 1689 1690 static int pick_link(struct nameidata *nd, struct path *link, 1691 struct inode *inode, unsigned seq) 1692 { 1693 int error; 1694 struct saved *last; 1695 if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) { 1696 path_to_nameidata(link, nd); 1697 return -ELOOP; 1698 } 1699 if (!(nd->flags & LOOKUP_RCU)) { 1700 if (link->mnt == nd->path.mnt) 1701 mntget(link->mnt); 1702 } 1703 error = nd_alloc_stack(nd); 1704 if (unlikely(error)) { 1705 if (error == -ECHILD) { 1706 if (unlikely(unlazy_link(nd, link, seq))) 1707 return -ECHILD; 1708 error = nd_alloc_stack(nd); 1709 } 1710 if (error) { 1711 path_put(link); 1712 return error; 1713 } 1714 } 1715 1716 last = nd->stack + nd->depth++; 1717 last->link = *link; 1718 clear_delayed_call(&last->done); 1719 nd->link_inode = inode; 1720 last->seq = seq; 1721 return 1; 1722 } 1723 1724 enum {WALK_FOLLOW = 1, WALK_MORE = 2}; 1725 1726 /* 1727 * Do we need to follow links? We _really_ want to be able 1728 * to do this check without having to look at inode->i_op, 1729 * so we keep a cache of "no, this doesn't need follow_link" 1730 * for the common case. 1731 */ 1732 static inline int step_into(struct nameidata *nd, struct path *path, 1733 int flags, struct inode *inode, unsigned seq) 1734 { 1735 if (!(flags & WALK_MORE) && nd->depth) 1736 put_link(nd); 1737 if (likely(!d_is_symlink(path->dentry)) || 1738 !(flags & WALK_FOLLOW || nd->flags & LOOKUP_FOLLOW)) { 1739 /* not a symlink or should not follow */ 1740 path_to_nameidata(path, nd); 1741 nd->inode = inode; 1742 nd->seq = seq; 1743 return 0; 1744 } 1745 /* make sure that d_is_symlink above matches inode */ 1746 if (nd->flags & LOOKUP_RCU) { 1747 if (read_seqcount_retry(&path->dentry->d_seq, seq)) 1748 return -ECHILD; 1749 } 1750 return pick_link(nd, path, inode, seq); 1751 } 1752 1753 static int walk_component(struct nameidata *nd, int flags) 1754 { 1755 struct path path; 1756 struct inode *inode; 1757 unsigned seq; 1758 int err; 1759 /* 1760 * "." and ".." are special - ".." especially so because it has 1761 * to be able to know about the current root directory and 1762 * parent relationships. 1763 */ 1764 if (unlikely(nd->last_type != LAST_NORM)) { 1765 err = handle_dots(nd, nd->last_type); 1766 if (!(flags & WALK_MORE) && nd->depth) 1767 put_link(nd); 1768 return err; 1769 } 1770 err = lookup_fast(nd, &path, &inode, &seq); 1771 if (unlikely(err <= 0)) { 1772 if (err < 0) 1773 return err; 1774 path.dentry = lookup_slow(&nd->last, nd->path.dentry, 1775 nd->flags); 1776 if (IS_ERR(path.dentry)) 1777 return PTR_ERR(path.dentry); 1778 1779 path.mnt = nd->path.mnt; 1780 err = follow_managed(&path, nd); 1781 if (unlikely(err < 0)) 1782 return err; 1783 1784 if (unlikely(d_is_negative(path.dentry))) { 1785 path_to_nameidata(&path, nd); 1786 return -ENOENT; 1787 } 1788 1789 seq = 0; /* we are already out of RCU mode */ 1790 inode = d_backing_inode(path.dentry); 1791 } 1792 1793 return step_into(nd, &path, flags, inode, seq); 1794 } 1795 1796 /* 1797 * We can do the critical dentry name comparison and hashing 1798 * operations one word at a time, but we are limited to: 1799 * 1800 * - Architectures with fast unaligned word accesses. We could 1801 * do a "get_unaligned()" if this helps and is sufficiently 1802 * fast. 1803 * 1804 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we 1805 * do not trap on the (extremely unlikely) case of a page 1806 * crossing operation. 1807 * 1808 * - Furthermore, we need an efficient 64-bit compile for the 1809 * 64-bit case in order to generate the "number of bytes in 1810 * the final mask". Again, that could be replaced with a 1811 * efficient population count instruction or similar. 1812 */ 1813 #ifdef CONFIG_DCACHE_WORD_ACCESS 1814 1815 #include <asm/word-at-a-time.h> 1816 1817 #ifdef HASH_MIX 1818 1819 /* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */ 1820 1821 #elif defined(CONFIG_64BIT) 1822 /* 1823 * Register pressure in the mixing function is an issue, particularly 1824 * on 32-bit x86, but almost any function requires one state value and 1825 * one temporary. Instead, use a function designed for two state values 1826 * and no temporaries. 1827 * 1828 * This function cannot create a collision in only two iterations, so 1829 * we have two iterations to achieve avalanche. In those two iterations, 1830 * we have six layers of mixing, which is enough to spread one bit's 1831 * influence out to 2^6 = 64 state bits. 1832 * 1833 * Rotate constants are scored by considering either 64 one-bit input 1834 * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the 1835 * probability of that delta causing a change to each of the 128 output 1836 * bits, using a sample of random initial states. 1837 * 1838 * The Shannon entropy of the computed probabilities is then summed 1839 * to produce a score. Ideally, any input change has a 50% chance of 1840 * toggling any given output bit. 1841 * 1842 * Mixing scores (in bits) for (12,45): 1843 * Input delta: 1-bit 2-bit 1844 * 1 round: 713.3 42542.6 1845 * 2 rounds: 2753.7 140389.8 1846 * 3 rounds: 5954.1 233458.2 1847 * 4 rounds: 7862.6 256672.2 1848 * Perfect: 8192 258048 1849 * (64*128) (64*63/2 * 128) 1850 */ 1851 #define HASH_MIX(x, y, a) \ 1852 ( x ^= (a), \ 1853 y ^= x, x = rol64(x,12),\ 1854 x += y, y = rol64(y,45),\ 1855 y *= 9 ) 1856 1857 /* 1858 * Fold two longs into one 32-bit hash value. This must be fast, but 1859 * latency isn't quite as critical, as there is a fair bit of additional 1860 * work done before the hash value is used. 1861 */ 1862 static inline unsigned int fold_hash(unsigned long x, unsigned long y) 1863 { 1864 y ^= x * GOLDEN_RATIO_64; 1865 y *= GOLDEN_RATIO_64; 1866 return y >> 32; 1867 } 1868 1869 #else /* 32-bit case */ 1870 1871 /* 1872 * Mixing scores (in bits) for (7,20): 1873 * Input delta: 1-bit 2-bit 1874 * 1 round: 330.3 9201.6 1875 * 2 rounds: 1246.4 25475.4 1876 * 3 rounds: 1907.1 31295.1 1877 * 4 rounds: 2042.3 31718.6 1878 * Perfect: 2048 31744 1879 * (32*64) (32*31/2 * 64) 1880 */ 1881 #define HASH_MIX(x, y, a) \ 1882 ( x ^= (a), \ 1883 y ^= x, x = rol32(x, 7),\ 1884 x += y, y = rol32(y,20),\ 1885 y *= 9 ) 1886 1887 static inline unsigned int fold_hash(unsigned long x, unsigned long y) 1888 { 1889 /* Use arch-optimized multiply if one exists */ 1890 return __hash_32(y ^ __hash_32(x)); 1891 } 1892 1893 #endif 1894 1895 /* 1896 * Return the hash of a string of known length. This is carfully 1897 * designed to match hash_name(), which is the more critical function. 1898 * In particular, we must end by hashing a final word containing 0..7 1899 * payload bytes, to match the way that hash_name() iterates until it 1900 * finds the delimiter after the name. 1901 */ 1902 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len) 1903 { 1904 unsigned long a, x = 0, y = (unsigned long)salt; 1905 1906 for (;;) { 1907 if (!len) 1908 goto done; 1909 a = load_unaligned_zeropad(name); 1910 if (len < sizeof(unsigned long)) 1911 break; 1912 HASH_MIX(x, y, a); 1913 name += sizeof(unsigned long); 1914 len -= sizeof(unsigned long); 1915 } 1916 x ^= a & bytemask_from_count(len); 1917 done: 1918 return fold_hash(x, y); 1919 } 1920 EXPORT_SYMBOL(full_name_hash); 1921 1922 /* Return the "hash_len" (hash and length) of a null-terminated string */ 1923 u64 hashlen_string(const void *salt, const char *name) 1924 { 1925 unsigned long a = 0, x = 0, y = (unsigned long)salt; 1926 unsigned long adata, mask, len; 1927 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 1928 1929 len = 0; 1930 goto inside; 1931 1932 do { 1933 HASH_MIX(x, y, a); 1934 len += sizeof(unsigned long); 1935 inside: 1936 a = load_unaligned_zeropad(name+len); 1937 } while (!has_zero(a, &adata, &constants)); 1938 1939 adata = prep_zero_mask(a, adata, &constants); 1940 mask = create_zero_mask(adata); 1941 x ^= a & zero_bytemask(mask); 1942 1943 return hashlen_create(fold_hash(x, y), len + find_zero(mask)); 1944 } 1945 EXPORT_SYMBOL(hashlen_string); 1946 1947 /* 1948 * Calculate the length and hash of the path component, and 1949 * return the "hash_len" as the result. 1950 */ 1951 static inline u64 hash_name(const void *salt, const char *name) 1952 { 1953 unsigned long a = 0, b, x = 0, y = (unsigned long)salt; 1954 unsigned long adata, bdata, mask, len; 1955 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 1956 1957 len = 0; 1958 goto inside; 1959 1960 do { 1961 HASH_MIX(x, y, a); 1962 len += sizeof(unsigned long); 1963 inside: 1964 a = load_unaligned_zeropad(name+len); 1965 b = a ^ REPEAT_BYTE('/'); 1966 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants))); 1967 1968 adata = prep_zero_mask(a, adata, &constants); 1969 bdata = prep_zero_mask(b, bdata, &constants); 1970 mask = create_zero_mask(adata | bdata); 1971 x ^= a & zero_bytemask(mask); 1972 1973 return hashlen_create(fold_hash(x, y), len + find_zero(mask)); 1974 } 1975 1976 #else /* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */ 1977 1978 /* Return the hash of a string of known length */ 1979 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len) 1980 { 1981 unsigned long hash = init_name_hash(salt); 1982 while (len--) 1983 hash = partial_name_hash((unsigned char)*name++, hash); 1984 return end_name_hash(hash); 1985 } 1986 EXPORT_SYMBOL(full_name_hash); 1987 1988 /* Return the "hash_len" (hash and length) of a null-terminated string */ 1989 u64 hashlen_string(const void *salt, const char *name) 1990 { 1991 unsigned long hash = init_name_hash(salt); 1992 unsigned long len = 0, c; 1993 1994 c = (unsigned char)*name; 1995 while (c) { 1996 len++; 1997 hash = partial_name_hash(c, hash); 1998 c = (unsigned char)name[len]; 1999 } 2000 return hashlen_create(end_name_hash(hash), len); 2001 } 2002 EXPORT_SYMBOL(hashlen_string); 2003 2004 /* 2005 * We know there's a real path component here of at least 2006 * one character. 2007 */ 2008 static inline u64 hash_name(const void *salt, const char *name) 2009 { 2010 unsigned long hash = init_name_hash(salt); 2011 unsigned long len = 0, c; 2012 2013 c = (unsigned char)*name; 2014 do { 2015 len++; 2016 hash = partial_name_hash(c, hash); 2017 c = (unsigned char)name[len]; 2018 } while (c && c != '/'); 2019 return hashlen_create(end_name_hash(hash), len); 2020 } 2021 2022 #endif 2023 2024 /* 2025 * Name resolution. 2026 * This is the basic name resolution function, turning a pathname into 2027 * the final dentry. We expect 'base' to be positive and a directory. 2028 * 2029 * Returns 0 and nd will have valid dentry and mnt on success. 2030 * Returns error and drops reference to input namei data on failure. 2031 */ 2032 static int link_path_walk(const char *name, struct nameidata *nd) 2033 { 2034 int err; 2035 2036 while (*name=='/') 2037 name++; 2038 if (!*name) 2039 return 0; 2040 2041 /* At this point we know we have a real path component. */ 2042 for(;;) { 2043 u64 hash_len; 2044 int type; 2045 2046 err = may_lookup(nd); 2047 if (err) 2048 return err; 2049 2050 hash_len = hash_name(nd->path.dentry, name); 2051 2052 type = LAST_NORM; 2053 if (name[0] == '.') switch (hashlen_len(hash_len)) { 2054 case 2: 2055 if (name[1] == '.') { 2056 type = LAST_DOTDOT; 2057 nd->flags |= LOOKUP_JUMPED; 2058 } 2059 break; 2060 case 1: 2061 type = LAST_DOT; 2062 } 2063 if (likely(type == LAST_NORM)) { 2064 struct dentry *parent = nd->path.dentry; 2065 nd->flags &= ~LOOKUP_JUMPED; 2066 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { 2067 struct qstr this = { { .hash_len = hash_len }, .name = name }; 2068 err = parent->d_op->d_hash(parent, &this); 2069 if (err < 0) 2070 return err; 2071 hash_len = this.hash_len; 2072 name = this.name; 2073 } 2074 } 2075 2076 nd->last.hash_len = hash_len; 2077 nd->last.name = name; 2078 nd->last_type = type; 2079 2080 name += hashlen_len(hash_len); 2081 if (!*name) 2082 goto OK; 2083 /* 2084 * If it wasn't NUL, we know it was '/'. Skip that 2085 * slash, and continue until no more slashes. 2086 */ 2087 do { 2088 name++; 2089 } while (unlikely(*name == '/')); 2090 if (unlikely(!*name)) { 2091 OK: 2092 /* pathname body, done */ 2093 if (!nd->depth) 2094 return 0; 2095 name = nd->stack[nd->depth - 1].name; 2096 /* trailing symlink, done */ 2097 if (!name) 2098 return 0; 2099 /* last component of nested symlink */ 2100 err = walk_component(nd, WALK_FOLLOW); 2101 } else { 2102 /* not the last component */ 2103 err = walk_component(nd, WALK_FOLLOW | WALK_MORE); 2104 } 2105 if (err < 0) 2106 return err; 2107 2108 if (err) { 2109 const char *s = get_link(nd); 2110 2111 if (IS_ERR(s)) 2112 return PTR_ERR(s); 2113 err = 0; 2114 if (unlikely(!s)) { 2115 /* jumped */ 2116 put_link(nd); 2117 } else { 2118 nd->stack[nd->depth - 1].name = name; 2119 name = s; 2120 continue; 2121 } 2122 } 2123 if (unlikely(!d_can_lookup(nd->path.dentry))) { 2124 if (nd->flags & LOOKUP_RCU) { 2125 if (unlazy_walk(nd, NULL, 0)) 2126 return -ECHILD; 2127 } 2128 return -ENOTDIR; 2129 } 2130 } 2131 } 2132 2133 static const char *path_init(struct nameidata *nd, unsigned flags) 2134 { 2135 int retval = 0; 2136 const char *s = nd->name->name; 2137 2138 nd->last_type = LAST_ROOT; /* if there are only slashes... */ 2139 nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT; 2140 nd->depth = 0; 2141 if (flags & LOOKUP_ROOT) { 2142 struct dentry *root = nd->root.dentry; 2143 struct inode *inode = root->d_inode; 2144 if (*s) { 2145 if (!d_can_lookup(root)) 2146 return ERR_PTR(-ENOTDIR); 2147 retval = inode_permission(inode, MAY_EXEC); 2148 if (retval) 2149 return ERR_PTR(retval); 2150 } 2151 nd->path = nd->root; 2152 nd->inode = inode; 2153 if (flags & LOOKUP_RCU) { 2154 rcu_read_lock(); 2155 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 2156 nd->root_seq = nd->seq; 2157 nd->m_seq = read_seqbegin(&mount_lock); 2158 } else { 2159 path_get(&nd->path); 2160 } 2161 return s; 2162 } 2163 2164 nd->root.mnt = NULL; 2165 nd->path.mnt = NULL; 2166 nd->path.dentry = NULL; 2167 2168 nd->m_seq = read_seqbegin(&mount_lock); 2169 if (*s == '/') { 2170 if (flags & LOOKUP_RCU) 2171 rcu_read_lock(); 2172 set_root(nd); 2173 if (likely(!nd_jump_root(nd))) 2174 return s; 2175 nd->root.mnt = NULL; 2176 rcu_read_unlock(); 2177 return ERR_PTR(-ECHILD); 2178 } else if (nd->dfd == AT_FDCWD) { 2179 if (flags & LOOKUP_RCU) { 2180 struct fs_struct *fs = current->fs; 2181 unsigned seq; 2182 2183 rcu_read_lock(); 2184 2185 do { 2186 seq = read_seqcount_begin(&fs->seq); 2187 nd->path = fs->pwd; 2188 nd->inode = nd->path.dentry->d_inode; 2189 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 2190 } while (read_seqcount_retry(&fs->seq, seq)); 2191 } else { 2192 get_fs_pwd(current->fs, &nd->path); 2193 nd->inode = nd->path.dentry->d_inode; 2194 } 2195 return s; 2196 } else { 2197 /* Caller must check execute permissions on the starting path component */ 2198 struct fd f = fdget_raw(nd->dfd); 2199 struct dentry *dentry; 2200 2201 if (!f.file) 2202 return ERR_PTR(-EBADF); 2203 2204 dentry = f.file->f_path.dentry; 2205 2206 if (*s) { 2207 if (!d_can_lookup(dentry)) { 2208 fdput(f); 2209 return ERR_PTR(-ENOTDIR); 2210 } 2211 } 2212 2213 nd->path = f.file->f_path; 2214 if (flags & LOOKUP_RCU) { 2215 rcu_read_lock(); 2216 nd->inode = nd->path.dentry->d_inode; 2217 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 2218 } else { 2219 path_get(&nd->path); 2220 nd->inode = nd->path.dentry->d_inode; 2221 } 2222 fdput(f); 2223 return s; 2224 } 2225 } 2226 2227 static const char *trailing_symlink(struct nameidata *nd) 2228 { 2229 const char *s; 2230 int error = may_follow_link(nd); 2231 if (unlikely(error)) 2232 return ERR_PTR(error); 2233 nd->flags |= LOOKUP_PARENT; 2234 nd->stack[0].name = NULL; 2235 s = get_link(nd); 2236 return s ? s : ""; 2237 } 2238 2239 static inline int lookup_last(struct nameidata *nd) 2240 { 2241 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len]) 2242 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 2243 2244 nd->flags &= ~LOOKUP_PARENT; 2245 return walk_component(nd, 0); 2246 } 2247 2248 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 2249 static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path) 2250 { 2251 const char *s = path_init(nd, flags); 2252 int err; 2253 2254 if (IS_ERR(s)) 2255 return PTR_ERR(s); 2256 while (!(err = link_path_walk(s, nd)) 2257 && ((err = lookup_last(nd)) > 0)) { 2258 s = trailing_symlink(nd); 2259 if (IS_ERR(s)) { 2260 err = PTR_ERR(s); 2261 break; 2262 } 2263 } 2264 if (!err) 2265 err = complete_walk(nd); 2266 2267 if (!err && nd->flags & LOOKUP_DIRECTORY) 2268 if (!d_can_lookup(nd->path.dentry)) 2269 err = -ENOTDIR; 2270 if (!err) { 2271 *path = nd->path; 2272 nd->path.mnt = NULL; 2273 nd->path.dentry = NULL; 2274 } 2275 terminate_walk(nd); 2276 return err; 2277 } 2278 2279 static int filename_lookup(int dfd, struct filename *name, unsigned flags, 2280 struct path *path, struct path *root) 2281 { 2282 int retval; 2283 struct nameidata nd; 2284 if (IS_ERR(name)) 2285 return PTR_ERR(name); 2286 if (unlikely(root)) { 2287 nd.root = *root; 2288 flags |= LOOKUP_ROOT; 2289 } 2290 set_nameidata(&nd, dfd, name); 2291 retval = path_lookupat(&nd, flags | LOOKUP_RCU, path); 2292 if (unlikely(retval == -ECHILD)) 2293 retval = path_lookupat(&nd, flags, path); 2294 if (unlikely(retval == -ESTALE)) 2295 retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path); 2296 2297 if (likely(!retval)) 2298 audit_inode(name, path->dentry, flags & LOOKUP_PARENT); 2299 restore_nameidata(); 2300 putname(name); 2301 return retval; 2302 } 2303 2304 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 2305 static int path_parentat(struct nameidata *nd, unsigned flags, 2306 struct path *parent) 2307 { 2308 const char *s = path_init(nd, flags); 2309 int err; 2310 if (IS_ERR(s)) 2311 return PTR_ERR(s); 2312 err = link_path_walk(s, nd); 2313 if (!err) 2314 err = complete_walk(nd); 2315 if (!err) { 2316 *parent = nd->path; 2317 nd->path.mnt = NULL; 2318 nd->path.dentry = NULL; 2319 } 2320 terminate_walk(nd); 2321 return err; 2322 } 2323 2324 static struct filename *filename_parentat(int dfd, struct filename *name, 2325 unsigned int flags, struct path *parent, 2326 struct qstr *last, int *type) 2327 { 2328 int retval; 2329 struct nameidata nd; 2330 2331 if (IS_ERR(name)) 2332 return name; 2333 set_nameidata(&nd, dfd, name); 2334 retval = path_parentat(&nd, flags | LOOKUP_RCU, parent); 2335 if (unlikely(retval == -ECHILD)) 2336 retval = path_parentat(&nd, flags, parent); 2337 if (unlikely(retval == -ESTALE)) 2338 retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent); 2339 if (likely(!retval)) { 2340 *last = nd.last; 2341 *type = nd.last_type; 2342 audit_inode(name, parent->dentry, LOOKUP_PARENT); 2343 } else { 2344 putname(name); 2345 name = ERR_PTR(retval); 2346 } 2347 restore_nameidata(); 2348 return name; 2349 } 2350 2351 /* does lookup, returns the object with parent locked */ 2352 struct dentry *kern_path_locked(const char *name, struct path *path) 2353 { 2354 struct filename *filename; 2355 struct dentry *d; 2356 struct qstr last; 2357 int type; 2358 2359 filename = filename_parentat(AT_FDCWD, getname_kernel(name), 0, path, 2360 &last, &type); 2361 if (IS_ERR(filename)) 2362 return ERR_CAST(filename); 2363 if (unlikely(type != LAST_NORM)) { 2364 path_put(path); 2365 putname(filename); 2366 return ERR_PTR(-EINVAL); 2367 } 2368 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT); 2369 d = __lookup_hash(&last, path->dentry, 0); 2370 if (IS_ERR(d)) { 2371 inode_unlock(path->dentry->d_inode); 2372 path_put(path); 2373 } 2374 putname(filename); 2375 return d; 2376 } 2377 2378 int kern_path(const char *name, unsigned int flags, struct path *path) 2379 { 2380 return filename_lookup(AT_FDCWD, getname_kernel(name), 2381 flags, path, NULL); 2382 } 2383 EXPORT_SYMBOL(kern_path); 2384 2385 /** 2386 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair 2387 * @dentry: pointer to dentry of the base directory 2388 * @mnt: pointer to vfs mount of the base directory 2389 * @name: pointer to file name 2390 * @flags: lookup flags 2391 * @path: pointer to struct path to fill 2392 */ 2393 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, 2394 const char *name, unsigned int flags, 2395 struct path *path) 2396 { 2397 struct path root = {.mnt = mnt, .dentry = dentry}; 2398 /* the first argument of filename_lookup() is ignored with root */ 2399 return filename_lookup(AT_FDCWD, getname_kernel(name), 2400 flags , path, &root); 2401 } 2402 EXPORT_SYMBOL(vfs_path_lookup); 2403 2404 /** 2405 * lookup_one_len - filesystem helper to lookup single pathname component 2406 * @name: pathname component to lookup 2407 * @base: base directory to lookup from 2408 * @len: maximum length @len should be interpreted to 2409 * 2410 * Note that this routine is purely a helper for filesystem usage and should 2411 * not be called by generic code. 2412 * 2413 * The caller must hold base->i_mutex. 2414 */ 2415 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len) 2416 { 2417 struct qstr this; 2418 unsigned int c; 2419 int err; 2420 2421 WARN_ON_ONCE(!inode_is_locked(base->d_inode)); 2422 2423 this.name = name; 2424 this.len = len; 2425 this.hash = full_name_hash(base, name, len); 2426 if (!len) 2427 return ERR_PTR(-EACCES); 2428 2429 if (unlikely(name[0] == '.')) { 2430 if (len < 2 || (len == 2 && name[1] == '.')) 2431 return ERR_PTR(-EACCES); 2432 } 2433 2434 while (len--) { 2435 c = *(const unsigned char *)name++; 2436 if (c == '/' || c == '\0') 2437 return ERR_PTR(-EACCES); 2438 } 2439 /* 2440 * See if the low-level filesystem might want 2441 * to use its own hash.. 2442 */ 2443 if (base->d_flags & DCACHE_OP_HASH) { 2444 int err = base->d_op->d_hash(base, &this); 2445 if (err < 0) 2446 return ERR_PTR(err); 2447 } 2448 2449 err = inode_permission(base->d_inode, MAY_EXEC); 2450 if (err) 2451 return ERR_PTR(err); 2452 2453 return __lookup_hash(&this, base, 0); 2454 } 2455 EXPORT_SYMBOL(lookup_one_len); 2456 2457 /** 2458 * lookup_one_len_unlocked - filesystem helper to lookup single pathname component 2459 * @name: pathname component to lookup 2460 * @base: base directory to lookup from 2461 * @len: maximum length @len should be interpreted to 2462 * 2463 * Note that this routine is purely a helper for filesystem usage and should 2464 * not be called by generic code. 2465 * 2466 * Unlike lookup_one_len, it should be called without the parent 2467 * i_mutex held, and will take the i_mutex itself if necessary. 2468 */ 2469 struct dentry *lookup_one_len_unlocked(const char *name, 2470 struct dentry *base, int len) 2471 { 2472 struct qstr this; 2473 unsigned int c; 2474 int err; 2475 struct dentry *ret; 2476 2477 this.name = name; 2478 this.len = len; 2479 this.hash = full_name_hash(base, name, len); 2480 if (!len) 2481 return ERR_PTR(-EACCES); 2482 2483 if (unlikely(name[0] == '.')) { 2484 if (len < 2 || (len == 2 && name[1] == '.')) 2485 return ERR_PTR(-EACCES); 2486 } 2487 2488 while (len--) { 2489 c = *(const unsigned char *)name++; 2490 if (c == '/' || c == '\0') 2491 return ERR_PTR(-EACCES); 2492 } 2493 /* 2494 * See if the low-level filesystem might want 2495 * to use its own hash.. 2496 */ 2497 if (base->d_flags & DCACHE_OP_HASH) { 2498 int err = base->d_op->d_hash(base, &this); 2499 if (err < 0) 2500 return ERR_PTR(err); 2501 } 2502 2503 err = inode_permission(base->d_inode, MAY_EXEC); 2504 if (err) 2505 return ERR_PTR(err); 2506 2507 ret = lookup_dcache(&this, base, 0); 2508 if (!ret) 2509 ret = lookup_slow(&this, base, 0); 2510 return ret; 2511 } 2512 EXPORT_SYMBOL(lookup_one_len_unlocked); 2513 2514 #ifdef CONFIG_UNIX98_PTYS 2515 int path_pts(struct path *path) 2516 { 2517 /* Find something mounted on "pts" in the same directory as 2518 * the input path. 2519 */ 2520 struct dentry *child, *parent; 2521 struct qstr this; 2522 int ret; 2523 2524 ret = path_parent_directory(path); 2525 if (ret) 2526 return ret; 2527 2528 parent = path->dentry; 2529 this.name = "pts"; 2530 this.len = 3; 2531 child = d_hash_and_lookup(parent, &this); 2532 if (!child) 2533 return -ENOENT; 2534 2535 path->dentry = child; 2536 dput(parent); 2537 follow_mount(path); 2538 return 0; 2539 } 2540 #endif 2541 2542 int user_path_at_empty(int dfd, const char __user *name, unsigned flags, 2543 struct path *path, int *empty) 2544 { 2545 return filename_lookup(dfd, getname_flags(name, flags, empty), 2546 flags, path, NULL); 2547 } 2548 EXPORT_SYMBOL(user_path_at_empty); 2549 2550 /** 2551 * mountpoint_last - look up last component for umount 2552 * @nd: pathwalk nameidata - currently pointing at parent directory of "last" 2553 * 2554 * This is a special lookup_last function just for umount. In this case, we 2555 * need to resolve the path without doing any revalidation. 2556 * 2557 * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since 2558 * mountpoints are always pinned in the dcache, their ancestors are too. Thus, 2559 * in almost all cases, this lookup will be served out of the dcache. The only 2560 * cases where it won't are if nd->last refers to a symlink or the path is 2561 * bogus and it doesn't exist. 2562 * 2563 * Returns: 2564 * -error: if there was an error during lookup. This includes -ENOENT if the 2565 * lookup found a negative dentry. 2566 * 2567 * 0: if we successfully resolved nd->last and found it to not to be a 2568 * symlink that needs to be followed. 2569 * 2570 * 1: if we successfully resolved nd->last and found it to be a symlink 2571 * that needs to be followed. 2572 */ 2573 static int 2574 mountpoint_last(struct nameidata *nd) 2575 { 2576 int error = 0; 2577 struct dentry *dir = nd->path.dentry; 2578 struct path path; 2579 2580 /* If we're in rcuwalk, drop out of it to handle last component */ 2581 if (nd->flags & LOOKUP_RCU) { 2582 if (unlazy_walk(nd, NULL, 0)) 2583 return -ECHILD; 2584 } 2585 2586 nd->flags &= ~LOOKUP_PARENT; 2587 2588 if (unlikely(nd->last_type != LAST_NORM)) { 2589 error = handle_dots(nd, nd->last_type); 2590 if (error) 2591 return error; 2592 path.dentry = dget(nd->path.dentry); 2593 } else { 2594 path.dentry = d_lookup(dir, &nd->last); 2595 if (!path.dentry) { 2596 /* 2597 * No cached dentry. Mounted dentries are pinned in the 2598 * cache, so that means that this dentry is probably 2599 * a symlink or the path doesn't actually point 2600 * to a mounted dentry. 2601 */ 2602 path.dentry = lookup_slow(&nd->last, dir, 2603 nd->flags | LOOKUP_NO_REVAL); 2604 if (IS_ERR(path.dentry)) 2605 return PTR_ERR(path.dentry); 2606 } 2607 } 2608 if (d_is_negative(path.dentry)) { 2609 dput(path.dentry); 2610 return -ENOENT; 2611 } 2612 path.mnt = nd->path.mnt; 2613 return step_into(nd, &path, 0, d_backing_inode(path.dentry), 0); 2614 } 2615 2616 /** 2617 * path_mountpoint - look up a path to be umounted 2618 * @nd: lookup context 2619 * @flags: lookup flags 2620 * @path: pointer to container for result 2621 * 2622 * Look up the given name, but don't attempt to revalidate the last component. 2623 * Returns 0 and "path" will be valid on success; Returns error otherwise. 2624 */ 2625 static int 2626 path_mountpoint(struct nameidata *nd, unsigned flags, struct path *path) 2627 { 2628 const char *s = path_init(nd, flags); 2629 int err; 2630 if (IS_ERR(s)) 2631 return PTR_ERR(s); 2632 while (!(err = link_path_walk(s, nd)) && 2633 (err = mountpoint_last(nd)) > 0) { 2634 s = trailing_symlink(nd); 2635 if (IS_ERR(s)) { 2636 err = PTR_ERR(s); 2637 break; 2638 } 2639 } 2640 if (!err) { 2641 *path = nd->path; 2642 nd->path.mnt = NULL; 2643 nd->path.dentry = NULL; 2644 follow_mount(path); 2645 } 2646 terminate_walk(nd); 2647 return err; 2648 } 2649 2650 static int 2651 filename_mountpoint(int dfd, struct filename *name, struct path *path, 2652 unsigned int flags) 2653 { 2654 struct nameidata nd; 2655 int error; 2656 if (IS_ERR(name)) 2657 return PTR_ERR(name); 2658 set_nameidata(&nd, dfd, name); 2659 error = path_mountpoint(&nd, flags | LOOKUP_RCU, path); 2660 if (unlikely(error == -ECHILD)) 2661 error = path_mountpoint(&nd, flags, path); 2662 if (unlikely(error == -ESTALE)) 2663 error = path_mountpoint(&nd, flags | LOOKUP_REVAL, path); 2664 if (likely(!error)) 2665 audit_inode(name, path->dentry, 0); 2666 restore_nameidata(); 2667 putname(name); 2668 return error; 2669 } 2670 2671 /** 2672 * user_path_mountpoint_at - lookup a path from userland in order to umount it 2673 * @dfd: directory file descriptor 2674 * @name: pathname from userland 2675 * @flags: lookup flags 2676 * @path: pointer to container to hold result 2677 * 2678 * A umount is a special case for path walking. We're not actually interested 2679 * in the inode in this situation, and ESTALE errors can be a problem. We 2680 * simply want track down the dentry and vfsmount attached at the mountpoint 2681 * and avoid revalidating the last component. 2682 * 2683 * Returns 0 and populates "path" on success. 2684 */ 2685 int 2686 user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags, 2687 struct path *path) 2688 { 2689 return filename_mountpoint(dfd, getname(name), path, flags); 2690 } 2691 2692 int 2693 kern_path_mountpoint(int dfd, const char *name, struct path *path, 2694 unsigned int flags) 2695 { 2696 return filename_mountpoint(dfd, getname_kernel(name), path, flags); 2697 } 2698 EXPORT_SYMBOL(kern_path_mountpoint); 2699 2700 int __check_sticky(struct inode *dir, struct inode *inode) 2701 { 2702 kuid_t fsuid = current_fsuid(); 2703 2704 if (uid_eq(inode->i_uid, fsuid)) 2705 return 0; 2706 if (uid_eq(dir->i_uid, fsuid)) 2707 return 0; 2708 return !capable_wrt_inode_uidgid(inode, CAP_FOWNER); 2709 } 2710 EXPORT_SYMBOL(__check_sticky); 2711 2712 /* 2713 * Check whether we can remove a link victim from directory dir, check 2714 * whether the type of victim is right. 2715 * 1. We can't do it if dir is read-only (done in permission()) 2716 * 2. We should have write and exec permissions on dir 2717 * 3. We can't remove anything from append-only dir 2718 * 4. We can't do anything with immutable dir (done in permission()) 2719 * 5. If the sticky bit on dir is set we should either 2720 * a. be owner of dir, or 2721 * b. be owner of victim, or 2722 * c. have CAP_FOWNER capability 2723 * 6. If the victim is append-only or immutable we can't do antyhing with 2724 * links pointing to it. 2725 * 7. If the victim has an unknown uid or gid we can't change the inode. 2726 * 8. If we were asked to remove a directory and victim isn't one - ENOTDIR. 2727 * 9. If we were asked to remove a non-directory and victim isn't one - EISDIR. 2728 * 10. We can't remove a root or mountpoint. 2729 * 11. We don't allow removal of NFS sillyrenamed files; it's handled by 2730 * nfs_async_unlink(). 2731 */ 2732 static int may_delete(struct inode *dir, struct dentry *victim, bool isdir) 2733 { 2734 struct inode *inode = d_backing_inode(victim); 2735 int error; 2736 2737 if (d_is_negative(victim)) 2738 return -ENOENT; 2739 BUG_ON(!inode); 2740 2741 BUG_ON(victim->d_parent->d_inode != dir); 2742 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE); 2743 2744 error = inode_permission(dir, MAY_WRITE | MAY_EXEC); 2745 if (error) 2746 return error; 2747 if (IS_APPEND(dir)) 2748 return -EPERM; 2749 2750 if (check_sticky(dir, inode) || IS_APPEND(inode) || 2751 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) || HAS_UNMAPPED_ID(inode)) 2752 return -EPERM; 2753 if (isdir) { 2754 if (!d_is_dir(victim)) 2755 return -ENOTDIR; 2756 if (IS_ROOT(victim)) 2757 return -EBUSY; 2758 } else if (d_is_dir(victim)) 2759 return -EISDIR; 2760 if (IS_DEADDIR(dir)) 2761 return -ENOENT; 2762 if (victim->d_flags & DCACHE_NFSFS_RENAMED) 2763 return -EBUSY; 2764 return 0; 2765 } 2766 2767 /* Check whether we can create an object with dentry child in directory 2768 * dir. 2769 * 1. We can't do it if child already exists (open has special treatment for 2770 * this case, but since we are inlined it's OK) 2771 * 2. We can't do it if dir is read-only (done in permission()) 2772 * 3. We can't do it if the fs can't represent the fsuid or fsgid. 2773 * 4. We should have write and exec permissions on dir 2774 * 5. We can't do it if dir is immutable (done in permission()) 2775 */ 2776 static inline int may_create(struct inode *dir, struct dentry *child) 2777 { 2778 struct user_namespace *s_user_ns; 2779 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE); 2780 if (child->d_inode) 2781 return -EEXIST; 2782 if (IS_DEADDIR(dir)) 2783 return -ENOENT; 2784 s_user_ns = dir->i_sb->s_user_ns; 2785 if (!kuid_has_mapping(s_user_ns, current_fsuid()) || 2786 !kgid_has_mapping(s_user_ns, current_fsgid())) 2787 return -EOVERFLOW; 2788 return inode_permission(dir, MAY_WRITE | MAY_EXEC); 2789 } 2790 2791 /* 2792 * p1 and p2 should be directories on the same fs. 2793 */ 2794 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) 2795 { 2796 struct dentry *p; 2797 2798 if (p1 == p2) { 2799 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 2800 return NULL; 2801 } 2802 2803 mutex_lock(&p1->d_sb->s_vfs_rename_mutex); 2804 2805 p = d_ancestor(p2, p1); 2806 if (p) { 2807 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); 2808 inode_lock_nested(p1->d_inode, I_MUTEX_CHILD); 2809 return p; 2810 } 2811 2812 p = d_ancestor(p1, p2); 2813 if (p) { 2814 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 2815 inode_lock_nested(p2->d_inode, I_MUTEX_CHILD); 2816 return p; 2817 } 2818 2819 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 2820 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2); 2821 return NULL; 2822 } 2823 EXPORT_SYMBOL(lock_rename); 2824 2825 void unlock_rename(struct dentry *p1, struct dentry *p2) 2826 { 2827 inode_unlock(p1->d_inode); 2828 if (p1 != p2) { 2829 inode_unlock(p2->d_inode); 2830 mutex_unlock(&p1->d_sb->s_vfs_rename_mutex); 2831 } 2832 } 2833 EXPORT_SYMBOL(unlock_rename); 2834 2835 int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, 2836 bool want_excl) 2837 { 2838 int error = may_create(dir, dentry); 2839 if (error) 2840 return error; 2841 2842 if (!dir->i_op->create) 2843 return -EACCES; /* shouldn't it be ENOSYS? */ 2844 mode &= S_IALLUGO; 2845 mode |= S_IFREG; 2846 error = security_inode_create(dir, dentry, mode); 2847 if (error) 2848 return error; 2849 error = dir->i_op->create(dir, dentry, mode, want_excl); 2850 if (!error) 2851 fsnotify_create(dir, dentry); 2852 return error; 2853 } 2854 EXPORT_SYMBOL(vfs_create); 2855 2856 bool may_open_dev(const struct path *path) 2857 { 2858 return !(path->mnt->mnt_flags & MNT_NODEV) && 2859 !(path->mnt->mnt_sb->s_iflags & SB_I_NODEV); 2860 } 2861 2862 static int may_open(const struct path *path, int acc_mode, int flag) 2863 { 2864 struct dentry *dentry = path->dentry; 2865 struct inode *inode = dentry->d_inode; 2866 int error; 2867 2868 if (!inode) 2869 return -ENOENT; 2870 2871 switch (inode->i_mode & S_IFMT) { 2872 case S_IFLNK: 2873 return -ELOOP; 2874 case S_IFDIR: 2875 if (acc_mode & MAY_WRITE) 2876 return -EISDIR; 2877 break; 2878 case S_IFBLK: 2879 case S_IFCHR: 2880 if (!may_open_dev(path)) 2881 return -EACCES; 2882 /*FALLTHRU*/ 2883 case S_IFIFO: 2884 case S_IFSOCK: 2885 flag &= ~O_TRUNC; 2886 break; 2887 } 2888 2889 error = inode_permission(inode, MAY_OPEN | acc_mode); 2890 if (error) 2891 return error; 2892 2893 /* 2894 * An append-only file must be opened in append mode for writing. 2895 */ 2896 if (IS_APPEND(inode)) { 2897 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND)) 2898 return -EPERM; 2899 if (flag & O_TRUNC) 2900 return -EPERM; 2901 } 2902 2903 /* O_NOATIME can only be set by the owner or superuser */ 2904 if (flag & O_NOATIME && !inode_owner_or_capable(inode)) 2905 return -EPERM; 2906 2907 return 0; 2908 } 2909 2910 static int handle_truncate(struct file *filp) 2911 { 2912 const struct path *path = &filp->f_path; 2913 struct inode *inode = path->dentry->d_inode; 2914 int error = get_write_access(inode); 2915 if (error) 2916 return error; 2917 /* 2918 * Refuse to truncate files with mandatory locks held on them. 2919 */ 2920 error = locks_verify_locked(filp); 2921 if (!error) 2922 error = security_path_truncate(path); 2923 if (!error) { 2924 error = do_truncate(path->dentry, 0, 2925 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN, 2926 filp); 2927 } 2928 put_write_access(inode); 2929 return error; 2930 } 2931 2932 static inline int open_to_namei_flags(int flag) 2933 { 2934 if ((flag & O_ACCMODE) == 3) 2935 flag--; 2936 return flag; 2937 } 2938 2939 static int may_o_create(const struct path *dir, struct dentry *dentry, umode_t mode) 2940 { 2941 struct user_namespace *s_user_ns; 2942 int error = security_path_mknod(dir, dentry, mode, 0); 2943 if (error) 2944 return error; 2945 2946 s_user_ns = dir->dentry->d_sb->s_user_ns; 2947 if (!kuid_has_mapping(s_user_ns, current_fsuid()) || 2948 !kgid_has_mapping(s_user_ns, current_fsgid())) 2949 return -EOVERFLOW; 2950 2951 error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC); 2952 if (error) 2953 return error; 2954 2955 return security_inode_create(dir->dentry->d_inode, dentry, mode); 2956 } 2957 2958 /* 2959 * Attempt to atomically look up, create and open a file from a negative 2960 * dentry. 2961 * 2962 * Returns 0 if successful. The file will have been created and attached to 2963 * @file by the filesystem calling finish_open(). 2964 * 2965 * Returns 1 if the file was looked up only or didn't need creating. The 2966 * caller will need to perform the open themselves. @path will have been 2967 * updated to point to the new dentry. This may be negative. 2968 * 2969 * Returns an error code otherwise. 2970 */ 2971 static int atomic_open(struct nameidata *nd, struct dentry *dentry, 2972 struct path *path, struct file *file, 2973 const struct open_flags *op, 2974 int open_flag, umode_t mode, 2975 int *opened) 2976 { 2977 struct dentry *const DENTRY_NOT_SET = (void *) -1UL; 2978 struct inode *dir = nd->path.dentry->d_inode; 2979 int error; 2980 2981 if (!(~open_flag & (O_EXCL | O_CREAT))) /* both O_EXCL and O_CREAT */ 2982 open_flag &= ~O_TRUNC; 2983 2984 if (nd->flags & LOOKUP_DIRECTORY) 2985 open_flag |= O_DIRECTORY; 2986 2987 file->f_path.dentry = DENTRY_NOT_SET; 2988 file->f_path.mnt = nd->path.mnt; 2989 error = dir->i_op->atomic_open(dir, dentry, file, 2990 open_to_namei_flags(open_flag), 2991 mode, opened); 2992 d_lookup_done(dentry); 2993 if (!error) { 2994 /* 2995 * We didn't have the inode before the open, so check open 2996 * permission here. 2997 */ 2998 int acc_mode = op->acc_mode; 2999 if (*opened & FILE_CREATED) { 3000 WARN_ON(!(open_flag & O_CREAT)); 3001 fsnotify_create(dir, dentry); 3002 acc_mode = 0; 3003 } 3004 error = may_open(&file->f_path, acc_mode, open_flag); 3005 if (WARN_ON(error > 0)) 3006 error = -EINVAL; 3007 } else if (error > 0) { 3008 if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) { 3009 error = -EIO; 3010 } else { 3011 if (file->f_path.dentry) { 3012 dput(dentry); 3013 dentry = file->f_path.dentry; 3014 } 3015 if (*opened & FILE_CREATED) 3016 fsnotify_create(dir, dentry); 3017 if (unlikely(d_is_negative(dentry))) { 3018 error = -ENOENT; 3019 } else { 3020 path->dentry = dentry; 3021 path->mnt = nd->path.mnt; 3022 return 1; 3023 } 3024 } 3025 } 3026 dput(dentry); 3027 return error; 3028 } 3029 3030 /* 3031 * Look up and maybe create and open the last component. 3032 * 3033 * Must be called with i_mutex held on parent. 3034 * 3035 * Returns 0 if the file was successfully atomically created (if necessary) and 3036 * opened. In this case the file will be returned attached to @file. 3037 * 3038 * Returns 1 if the file was not completely opened at this time, though lookups 3039 * and creations will have been performed and the dentry returned in @path will 3040 * be positive upon return if O_CREAT was specified. If O_CREAT wasn't 3041 * specified then a negative dentry may be returned. 3042 * 3043 * An error code is returned otherwise. 3044 * 3045 * FILE_CREATE will be set in @*opened if the dentry was created and will be 3046 * cleared otherwise prior to returning. 3047 */ 3048 static int lookup_open(struct nameidata *nd, struct path *path, 3049 struct file *file, 3050 const struct open_flags *op, 3051 bool got_write, int *opened) 3052 { 3053 struct dentry *dir = nd->path.dentry; 3054 struct inode *dir_inode = dir->d_inode; 3055 int open_flag = op->open_flag; 3056 struct dentry *dentry; 3057 int error, create_error = 0; 3058 umode_t mode = op->mode; 3059 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq); 3060 3061 if (unlikely(IS_DEADDIR(dir_inode))) 3062 return -ENOENT; 3063 3064 *opened &= ~FILE_CREATED; 3065 dentry = d_lookup(dir, &nd->last); 3066 for (;;) { 3067 if (!dentry) { 3068 dentry = d_alloc_parallel(dir, &nd->last, &wq); 3069 if (IS_ERR(dentry)) 3070 return PTR_ERR(dentry); 3071 } 3072 if (d_in_lookup(dentry)) 3073 break; 3074 3075 if (!(dentry->d_flags & DCACHE_OP_REVALIDATE)) 3076 break; 3077 3078 error = d_revalidate(dentry, nd->flags); 3079 if (likely(error > 0)) 3080 break; 3081 if (error) 3082 goto out_dput; 3083 d_invalidate(dentry); 3084 dput(dentry); 3085 dentry = NULL; 3086 } 3087 if (dentry->d_inode) { 3088 /* Cached positive dentry: will open in f_op->open */ 3089 goto out_no_open; 3090 } 3091 3092 /* 3093 * Checking write permission is tricky, bacuse we don't know if we are 3094 * going to actually need it: O_CREAT opens should work as long as the 3095 * file exists. But checking existence breaks atomicity. The trick is 3096 * to check access and if not granted clear O_CREAT from the flags. 3097 * 3098 * Another problem is returing the "right" error value (e.g. for an 3099 * O_EXCL open we want to return EEXIST not EROFS). 3100 */ 3101 if (open_flag & O_CREAT) { 3102 if (!IS_POSIXACL(dir->d_inode)) 3103 mode &= ~current_umask(); 3104 if (unlikely(!got_write)) { 3105 create_error = -EROFS; 3106 open_flag &= ~O_CREAT; 3107 if (open_flag & (O_EXCL | O_TRUNC)) 3108 goto no_open; 3109 /* No side effects, safe to clear O_CREAT */ 3110 } else { 3111 create_error = may_o_create(&nd->path, dentry, mode); 3112 if (create_error) { 3113 open_flag &= ~O_CREAT; 3114 if (open_flag & O_EXCL) 3115 goto no_open; 3116 } 3117 } 3118 } else if ((open_flag & (O_TRUNC|O_WRONLY|O_RDWR)) && 3119 unlikely(!got_write)) { 3120 /* 3121 * No O_CREATE -> atomicity not a requirement -> fall 3122 * back to lookup + open 3123 */ 3124 goto no_open; 3125 } 3126 3127 if (dir_inode->i_op->atomic_open) { 3128 error = atomic_open(nd, dentry, path, file, op, open_flag, 3129 mode, opened); 3130 if (unlikely(error == -ENOENT) && create_error) 3131 error = create_error; 3132 return error; 3133 } 3134 3135 no_open: 3136 if (d_in_lookup(dentry)) { 3137 struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry, 3138 nd->flags); 3139 d_lookup_done(dentry); 3140 if (unlikely(res)) { 3141 if (IS_ERR(res)) { 3142 error = PTR_ERR(res); 3143 goto out_dput; 3144 } 3145 dput(dentry); 3146 dentry = res; 3147 } 3148 } 3149 3150 /* Negative dentry, just create the file */ 3151 if (!dentry->d_inode && (open_flag & O_CREAT)) { 3152 *opened |= FILE_CREATED; 3153 audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE); 3154 if (!dir_inode->i_op->create) { 3155 error = -EACCES; 3156 goto out_dput; 3157 } 3158 error = dir_inode->i_op->create(dir_inode, dentry, mode, 3159 open_flag & O_EXCL); 3160 if (error) 3161 goto out_dput; 3162 fsnotify_create(dir_inode, dentry); 3163 } 3164 if (unlikely(create_error) && !dentry->d_inode) { 3165 error = create_error; 3166 goto out_dput; 3167 } 3168 out_no_open: 3169 path->dentry = dentry; 3170 path->mnt = nd->path.mnt; 3171 return 1; 3172 3173 out_dput: 3174 dput(dentry); 3175 return error; 3176 } 3177 3178 /* 3179 * Handle the last step of open() 3180 */ 3181 static int do_last(struct nameidata *nd, 3182 struct file *file, const struct open_flags *op, 3183 int *opened) 3184 { 3185 struct dentry *dir = nd->path.dentry; 3186 int open_flag = op->open_flag; 3187 bool will_truncate = (open_flag & O_TRUNC) != 0; 3188 bool got_write = false; 3189 int acc_mode = op->acc_mode; 3190 unsigned seq; 3191 struct inode *inode; 3192 struct path path; 3193 int error; 3194 3195 nd->flags &= ~LOOKUP_PARENT; 3196 nd->flags |= op->intent; 3197 3198 if (nd->last_type != LAST_NORM) { 3199 error = handle_dots(nd, nd->last_type); 3200 if (unlikely(error)) 3201 return error; 3202 goto finish_open; 3203 } 3204 3205 if (!(open_flag & O_CREAT)) { 3206 if (nd->last.name[nd->last.len]) 3207 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 3208 /* we _can_ be in RCU mode here */ 3209 error = lookup_fast(nd, &path, &inode, &seq); 3210 if (likely(error > 0)) 3211 goto finish_lookup; 3212 3213 if (error < 0) 3214 return error; 3215 3216 BUG_ON(nd->inode != dir->d_inode); 3217 BUG_ON(nd->flags & LOOKUP_RCU); 3218 } else { 3219 /* create side of things */ 3220 /* 3221 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED 3222 * has been cleared when we got to the last component we are 3223 * about to look up 3224 */ 3225 error = complete_walk(nd); 3226 if (error) 3227 return error; 3228 3229 audit_inode(nd->name, dir, LOOKUP_PARENT); 3230 /* trailing slashes? */ 3231 if (unlikely(nd->last.name[nd->last.len])) 3232 return -EISDIR; 3233 } 3234 3235 if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) { 3236 error = mnt_want_write(nd->path.mnt); 3237 if (!error) 3238 got_write = true; 3239 /* 3240 * do _not_ fail yet - we might not need that or fail with 3241 * a different error; let lookup_open() decide; we'll be 3242 * dropping this one anyway. 3243 */ 3244 } 3245 if (open_flag & O_CREAT) 3246 inode_lock(dir->d_inode); 3247 else 3248 inode_lock_shared(dir->d_inode); 3249 error = lookup_open(nd, &path, file, op, got_write, opened); 3250 if (open_flag & O_CREAT) 3251 inode_unlock(dir->d_inode); 3252 else 3253 inode_unlock_shared(dir->d_inode); 3254 3255 if (error <= 0) { 3256 if (error) 3257 goto out; 3258 3259 if ((*opened & FILE_CREATED) || 3260 !S_ISREG(file_inode(file)->i_mode)) 3261 will_truncate = false; 3262 3263 audit_inode(nd->name, file->f_path.dentry, 0); 3264 goto opened; 3265 } 3266 3267 if (*opened & FILE_CREATED) { 3268 /* Don't check for write permission, don't truncate */ 3269 open_flag &= ~O_TRUNC; 3270 will_truncate = false; 3271 acc_mode = 0; 3272 path_to_nameidata(&path, nd); 3273 goto finish_open_created; 3274 } 3275 3276 /* 3277 * If atomic_open() acquired write access it is dropped now due to 3278 * possible mount and symlink following (this might be optimized away if 3279 * necessary...) 3280 */ 3281 if (got_write) { 3282 mnt_drop_write(nd->path.mnt); 3283 got_write = false; 3284 } 3285 3286 error = follow_managed(&path, nd); 3287 if (unlikely(error < 0)) 3288 return error; 3289 3290 if (unlikely(d_is_negative(path.dentry))) { 3291 path_to_nameidata(&path, nd); 3292 return -ENOENT; 3293 } 3294 3295 /* 3296 * create/update audit record if it already exists. 3297 */ 3298 audit_inode(nd->name, path.dentry, 0); 3299 3300 if (unlikely((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))) { 3301 path_to_nameidata(&path, nd); 3302 return -EEXIST; 3303 } 3304 3305 seq = 0; /* out of RCU mode, so the value doesn't matter */ 3306 inode = d_backing_inode(path.dentry); 3307 finish_lookup: 3308 error = step_into(nd, &path, 0, inode, seq); 3309 if (unlikely(error)) 3310 return error; 3311 finish_open: 3312 /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */ 3313 error = complete_walk(nd); 3314 if (error) 3315 return error; 3316 audit_inode(nd->name, nd->path.dentry, 0); 3317 error = -EISDIR; 3318 if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) 3319 goto out; 3320 error = -ENOTDIR; 3321 if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry)) 3322 goto out; 3323 if (!d_is_reg(nd->path.dentry)) 3324 will_truncate = false; 3325 3326 if (will_truncate) { 3327 error = mnt_want_write(nd->path.mnt); 3328 if (error) 3329 goto out; 3330 got_write = true; 3331 } 3332 finish_open_created: 3333 error = may_open(&nd->path, acc_mode, open_flag); 3334 if (error) 3335 goto out; 3336 BUG_ON(*opened & FILE_OPENED); /* once it's opened, it's opened */ 3337 error = vfs_open(&nd->path, file, current_cred()); 3338 if (error) 3339 goto out; 3340 *opened |= FILE_OPENED; 3341 opened: 3342 error = open_check_o_direct(file); 3343 if (!error) 3344 error = ima_file_check(file, op->acc_mode, *opened); 3345 if (!error && will_truncate) 3346 error = handle_truncate(file); 3347 out: 3348 if (unlikely(error) && (*opened & FILE_OPENED)) 3349 fput(file); 3350 if (unlikely(error > 0)) { 3351 WARN_ON(1); 3352 error = -EINVAL; 3353 } 3354 if (got_write) 3355 mnt_drop_write(nd->path.mnt); 3356 return error; 3357 } 3358 3359 static int do_tmpfile(struct nameidata *nd, unsigned flags, 3360 const struct open_flags *op, 3361 struct file *file, int *opened) 3362 { 3363 static const struct qstr name = QSTR_INIT("/", 1); 3364 struct dentry *child; 3365 struct inode *dir; 3366 struct path path; 3367 int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path); 3368 if (unlikely(error)) 3369 return error; 3370 error = mnt_want_write(path.mnt); 3371 if (unlikely(error)) 3372 goto out; 3373 dir = path.dentry->d_inode; 3374 /* we want directory to be writable */ 3375 error = inode_permission(dir, MAY_WRITE | MAY_EXEC); 3376 if (error) 3377 goto out2; 3378 if (!dir->i_op->tmpfile) { 3379 error = -EOPNOTSUPP; 3380 goto out2; 3381 } 3382 child = d_alloc(path.dentry, &name); 3383 if (unlikely(!child)) { 3384 error = -ENOMEM; 3385 goto out2; 3386 } 3387 dput(path.dentry); 3388 path.dentry = child; 3389 error = dir->i_op->tmpfile(dir, child, op->mode); 3390 if (error) 3391 goto out2; 3392 audit_inode(nd->name, child, 0); 3393 /* Don't check for other permissions, the inode was just created */ 3394 error = may_open(&path, 0, op->open_flag); 3395 if (error) 3396 goto out2; 3397 file->f_path.mnt = path.mnt; 3398 error = finish_open(file, child, NULL, opened); 3399 if (error) 3400 goto out2; 3401 error = open_check_o_direct(file); 3402 if (error) { 3403 fput(file); 3404 } else if (!(op->open_flag & O_EXCL)) { 3405 struct inode *inode = file_inode(file); 3406 spin_lock(&inode->i_lock); 3407 inode->i_state |= I_LINKABLE; 3408 spin_unlock(&inode->i_lock); 3409 } 3410 out2: 3411 mnt_drop_write(path.mnt); 3412 out: 3413 path_put(&path); 3414 return error; 3415 } 3416 3417 static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file) 3418 { 3419 struct path path; 3420 int error = path_lookupat(nd, flags, &path); 3421 if (!error) { 3422 audit_inode(nd->name, path.dentry, 0); 3423 error = vfs_open(&path, file, current_cred()); 3424 path_put(&path); 3425 } 3426 return error; 3427 } 3428 3429 static struct file *path_openat(struct nameidata *nd, 3430 const struct open_flags *op, unsigned flags) 3431 { 3432 const char *s; 3433 struct file *file; 3434 int opened = 0; 3435 int error; 3436 3437 file = get_empty_filp(); 3438 if (IS_ERR(file)) 3439 return file; 3440 3441 file->f_flags = op->open_flag; 3442 3443 if (unlikely(file->f_flags & __O_TMPFILE)) { 3444 error = do_tmpfile(nd, flags, op, file, &opened); 3445 goto out2; 3446 } 3447 3448 if (unlikely(file->f_flags & O_PATH)) { 3449 error = do_o_path(nd, flags, file); 3450 if (!error) 3451 opened |= FILE_OPENED; 3452 goto out2; 3453 } 3454 3455 s = path_init(nd, flags); 3456 if (IS_ERR(s)) { 3457 put_filp(file); 3458 return ERR_CAST(s); 3459 } 3460 while (!(error = link_path_walk(s, nd)) && 3461 (error = do_last(nd, file, op, &opened)) > 0) { 3462 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL); 3463 s = trailing_symlink(nd); 3464 if (IS_ERR(s)) { 3465 error = PTR_ERR(s); 3466 break; 3467 } 3468 } 3469 terminate_walk(nd); 3470 out2: 3471 if (!(opened & FILE_OPENED)) { 3472 BUG_ON(!error); 3473 put_filp(file); 3474 } 3475 if (unlikely(error)) { 3476 if (error == -EOPENSTALE) { 3477 if (flags & LOOKUP_RCU) 3478 error = -ECHILD; 3479 else 3480 error = -ESTALE; 3481 } 3482 file = ERR_PTR(error); 3483 } 3484 return file; 3485 } 3486 3487 struct file *do_filp_open(int dfd, struct filename *pathname, 3488 const struct open_flags *op) 3489 { 3490 struct nameidata nd; 3491 int flags = op->lookup_flags; 3492 struct file *filp; 3493 3494 set_nameidata(&nd, dfd, pathname); 3495 filp = path_openat(&nd, op, flags | LOOKUP_RCU); 3496 if (unlikely(filp == ERR_PTR(-ECHILD))) 3497 filp = path_openat(&nd, op, flags); 3498 if (unlikely(filp == ERR_PTR(-ESTALE))) 3499 filp = path_openat(&nd, op, flags | LOOKUP_REVAL); 3500 restore_nameidata(); 3501 return filp; 3502 } 3503 3504 struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt, 3505 const char *name, const struct open_flags *op) 3506 { 3507 struct nameidata nd; 3508 struct file *file; 3509 struct filename *filename; 3510 int flags = op->lookup_flags | LOOKUP_ROOT; 3511 3512 nd.root.mnt = mnt; 3513 nd.root.dentry = dentry; 3514 3515 if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN) 3516 return ERR_PTR(-ELOOP); 3517 3518 filename = getname_kernel(name); 3519 if (IS_ERR(filename)) 3520 return ERR_CAST(filename); 3521 3522 set_nameidata(&nd, -1, filename); 3523 file = path_openat(&nd, op, flags | LOOKUP_RCU); 3524 if (unlikely(file == ERR_PTR(-ECHILD))) 3525 file = path_openat(&nd, op, flags); 3526 if (unlikely(file == ERR_PTR(-ESTALE))) 3527 file = path_openat(&nd, op, flags | LOOKUP_REVAL); 3528 restore_nameidata(); 3529 putname(filename); 3530 return file; 3531 } 3532 3533 static struct dentry *filename_create(int dfd, struct filename *name, 3534 struct path *path, unsigned int lookup_flags) 3535 { 3536 struct dentry *dentry = ERR_PTR(-EEXIST); 3537 struct qstr last; 3538 int type; 3539 int err2; 3540 int error; 3541 bool is_dir = (lookup_flags & LOOKUP_DIRECTORY); 3542 3543 /* 3544 * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any 3545 * other flags passed in are ignored! 3546 */ 3547 lookup_flags &= LOOKUP_REVAL; 3548 3549 name = filename_parentat(dfd, name, lookup_flags, path, &last, &type); 3550 if (IS_ERR(name)) 3551 return ERR_CAST(name); 3552 3553 /* 3554 * Yucky last component or no last component at all? 3555 * (foo/., foo/.., /////) 3556 */ 3557 if (unlikely(type != LAST_NORM)) 3558 goto out; 3559 3560 /* don't fail immediately if it's r/o, at least try to report other errors */ 3561 err2 = mnt_want_write(path->mnt); 3562 /* 3563 * Do the final lookup. 3564 */ 3565 lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL; 3566 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT); 3567 dentry = __lookup_hash(&last, path->dentry, lookup_flags); 3568 if (IS_ERR(dentry)) 3569 goto unlock; 3570 3571 error = -EEXIST; 3572 if (d_is_positive(dentry)) 3573 goto fail; 3574 3575 /* 3576 * Special case - lookup gave negative, but... we had foo/bar/ 3577 * From the vfs_mknod() POV we just have a negative dentry - 3578 * all is fine. Let's be bastards - you had / on the end, you've 3579 * been asking for (non-existent) directory. -ENOENT for you. 3580 */ 3581 if (unlikely(!is_dir && last.name[last.len])) { 3582 error = -ENOENT; 3583 goto fail; 3584 } 3585 if (unlikely(err2)) { 3586 error = err2; 3587 goto fail; 3588 } 3589 putname(name); 3590 return dentry; 3591 fail: 3592 dput(dentry); 3593 dentry = ERR_PTR(error); 3594 unlock: 3595 inode_unlock(path->dentry->d_inode); 3596 if (!err2) 3597 mnt_drop_write(path->mnt); 3598 out: 3599 path_put(path); 3600 putname(name); 3601 return dentry; 3602 } 3603 3604 struct dentry *kern_path_create(int dfd, const char *pathname, 3605 struct path *path, unsigned int lookup_flags) 3606 { 3607 return filename_create(dfd, getname_kernel(pathname), 3608 path, lookup_flags); 3609 } 3610 EXPORT_SYMBOL(kern_path_create); 3611 3612 void done_path_create(struct path *path, struct dentry *dentry) 3613 { 3614 dput(dentry); 3615 inode_unlock(path->dentry->d_inode); 3616 mnt_drop_write(path->mnt); 3617 path_put(path); 3618 } 3619 EXPORT_SYMBOL(done_path_create); 3620 3621 inline struct dentry *user_path_create(int dfd, const char __user *pathname, 3622 struct path *path, unsigned int lookup_flags) 3623 { 3624 return filename_create(dfd, getname(pathname), path, lookup_flags); 3625 } 3626 EXPORT_SYMBOL(user_path_create); 3627 3628 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) 3629 { 3630 int error = may_create(dir, dentry); 3631 3632 if (error) 3633 return error; 3634 3635 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD)) 3636 return -EPERM; 3637 3638 if (!dir->i_op->mknod) 3639 return -EPERM; 3640 3641 error = devcgroup_inode_mknod(mode, dev); 3642 if (error) 3643 return error; 3644 3645 error = security_inode_mknod(dir, dentry, mode, dev); 3646 if (error) 3647 return error; 3648 3649 error = dir->i_op->mknod(dir, dentry, mode, dev); 3650 if (!error) 3651 fsnotify_create(dir, dentry); 3652 return error; 3653 } 3654 EXPORT_SYMBOL(vfs_mknod); 3655 3656 static int may_mknod(umode_t mode) 3657 { 3658 switch (mode & S_IFMT) { 3659 case S_IFREG: 3660 case S_IFCHR: 3661 case S_IFBLK: 3662 case S_IFIFO: 3663 case S_IFSOCK: 3664 case 0: /* zero mode translates to S_IFREG */ 3665 return 0; 3666 case S_IFDIR: 3667 return -EPERM; 3668 default: 3669 return -EINVAL; 3670 } 3671 } 3672 3673 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, 3674 unsigned, dev) 3675 { 3676 struct dentry *dentry; 3677 struct path path; 3678 int error; 3679 unsigned int lookup_flags = 0; 3680 3681 error = may_mknod(mode); 3682 if (error) 3683 return error; 3684 retry: 3685 dentry = user_path_create(dfd, filename, &path, lookup_flags); 3686 if (IS_ERR(dentry)) 3687 return PTR_ERR(dentry); 3688 3689 if (!IS_POSIXACL(path.dentry->d_inode)) 3690 mode &= ~current_umask(); 3691 error = security_path_mknod(&path, dentry, mode, dev); 3692 if (error) 3693 goto out; 3694 switch (mode & S_IFMT) { 3695 case 0: case S_IFREG: 3696 error = vfs_create(path.dentry->d_inode,dentry,mode,true); 3697 if (!error) 3698 ima_post_path_mknod(dentry); 3699 break; 3700 case S_IFCHR: case S_IFBLK: 3701 error = vfs_mknod(path.dentry->d_inode,dentry,mode, 3702 new_decode_dev(dev)); 3703 break; 3704 case S_IFIFO: case S_IFSOCK: 3705 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0); 3706 break; 3707 } 3708 out: 3709 done_path_create(&path, dentry); 3710 if (retry_estale(error, lookup_flags)) { 3711 lookup_flags |= LOOKUP_REVAL; 3712 goto retry; 3713 } 3714 return error; 3715 } 3716 3717 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev) 3718 { 3719 return sys_mknodat(AT_FDCWD, filename, mode, dev); 3720 } 3721 3722 int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 3723 { 3724 int error = may_create(dir, dentry); 3725 unsigned max_links = dir->i_sb->s_max_links; 3726 3727 if (error) 3728 return error; 3729 3730 if (!dir->i_op->mkdir) 3731 return -EPERM; 3732 3733 mode &= (S_IRWXUGO|S_ISVTX); 3734 error = security_inode_mkdir(dir, dentry, mode); 3735 if (error) 3736 return error; 3737 3738 if (max_links && dir->i_nlink >= max_links) 3739 return -EMLINK; 3740 3741 error = dir->i_op->mkdir(dir, dentry, mode); 3742 if (!error) 3743 fsnotify_mkdir(dir, dentry); 3744 return error; 3745 } 3746 EXPORT_SYMBOL(vfs_mkdir); 3747 3748 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) 3749 { 3750 struct dentry *dentry; 3751 struct path path; 3752 int error; 3753 unsigned int lookup_flags = LOOKUP_DIRECTORY; 3754 3755 retry: 3756 dentry = user_path_create(dfd, pathname, &path, lookup_flags); 3757 if (IS_ERR(dentry)) 3758 return PTR_ERR(dentry); 3759 3760 if (!IS_POSIXACL(path.dentry->d_inode)) 3761 mode &= ~current_umask(); 3762 error = security_path_mkdir(&path, dentry, mode); 3763 if (!error) 3764 error = vfs_mkdir(path.dentry->d_inode, dentry, mode); 3765 done_path_create(&path, dentry); 3766 if (retry_estale(error, lookup_flags)) { 3767 lookup_flags |= LOOKUP_REVAL; 3768 goto retry; 3769 } 3770 return error; 3771 } 3772 3773 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode) 3774 { 3775 return sys_mkdirat(AT_FDCWD, pathname, mode); 3776 } 3777 3778 int vfs_rmdir(struct inode *dir, struct dentry *dentry) 3779 { 3780 int error = may_delete(dir, dentry, 1); 3781 3782 if (error) 3783 return error; 3784 3785 if (!dir->i_op->rmdir) 3786 return -EPERM; 3787 3788 dget(dentry); 3789 inode_lock(dentry->d_inode); 3790 3791 error = -EBUSY; 3792 if (is_local_mountpoint(dentry)) 3793 goto out; 3794 3795 error = security_inode_rmdir(dir, dentry); 3796 if (error) 3797 goto out; 3798 3799 shrink_dcache_parent(dentry); 3800 error = dir->i_op->rmdir(dir, dentry); 3801 if (error) 3802 goto out; 3803 3804 dentry->d_inode->i_flags |= S_DEAD; 3805 dont_mount(dentry); 3806 detach_mounts(dentry); 3807 3808 out: 3809 inode_unlock(dentry->d_inode); 3810 dput(dentry); 3811 if (!error) 3812 d_delete(dentry); 3813 return error; 3814 } 3815 EXPORT_SYMBOL(vfs_rmdir); 3816 3817 static long do_rmdir(int dfd, const char __user *pathname) 3818 { 3819 int error = 0; 3820 struct filename *name; 3821 struct dentry *dentry; 3822 struct path path; 3823 struct qstr last; 3824 int type; 3825 unsigned int lookup_flags = 0; 3826 retry: 3827 name = filename_parentat(dfd, getname(pathname), lookup_flags, 3828 &path, &last, &type); 3829 if (IS_ERR(name)) 3830 return PTR_ERR(name); 3831 3832 switch (type) { 3833 case LAST_DOTDOT: 3834 error = -ENOTEMPTY; 3835 goto exit1; 3836 case LAST_DOT: 3837 error = -EINVAL; 3838 goto exit1; 3839 case LAST_ROOT: 3840 error = -EBUSY; 3841 goto exit1; 3842 } 3843 3844 error = mnt_want_write(path.mnt); 3845 if (error) 3846 goto exit1; 3847 3848 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT); 3849 dentry = __lookup_hash(&last, path.dentry, lookup_flags); 3850 error = PTR_ERR(dentry); 3851 if (IS_ERR(dentry)) 3852 goto exit2; 3853 if (!dentry->d_inode) { 3854 error = -ENOENT; 3855 goto exit3; 3856 } 3857 error = security_path_rmdir(&path, dentry); 3858 if (error) 3859 goto exit3; 3860 error = vfs_rmdir(path.dentry->d_inode, dentry); 3861 exit3: 3862 dput(dentry); 3863 exit2: 3864 inode_unlock(path.dentry->d_inode); 3865 mnt_drop_write(path.mnt); 3866 exit1: 3867 path_put(&path); 3868 putname(name); 3869 if (retry_estale(error, lookup_flags)) { 3870 lookup_flags |= LOOKUP_REVAL; 3871 goto retry; 3872 } 3873 return error; 3874 } 3875 3876 SYSCALL_DEFINE1(rmdir, const char __user *, pathname) 3877 { 3878 return do_rmdir(AT_FDCWD, pathname); 3879 } 3880 3881 /** 3882 * vfs_unlink - unlink a filesystem object 3883 * @dir: parent directory 3884 * @dentry: victim 3885 * @delegated_inode: returns victim inode, if the inode is delegated. 3886 * 3887 * The caller must hold dir->i_mutex. 3888 * 3889 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and 3890 * return a reference to the inode in delegated_inode. The caller 3891 * should then break the delegation on that inode and retry. Because 3892 * breaking a delegation may take a long time, the caller should drop 3893 * dir->i_mutex before doing so. 3894 * 3895 * Alternatively, a caller may pass NULL for delegated_inode. This may 3896 * be appropriate for callers that expect the underlying filesystem not 3897 * to be NFS exported. 3898 */ 3899 int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode) 3900 { 3901 struct inode *target = dentry->d_inode; 3902 int error = may_delete(dir, dentry, 0); 3903 3904 if (error) 3905 return error; 3906 3907 if (!dir->i_op->unlink) 3908 return -EPERM; 3909 3910 inode_lock(target); 3911 if (is_local_mountpoint(dentry)) 3912 error = -EBUSY; 3913 else { 3914 error = security_inode_unlink(dir, dentry); 3915 if (!error) { 3916 error = try_break_deleg(target, delegated_inode); 3917 if (error) 3918 goto out; 3919 error = dir->i_op->unlink(dir, dentry); 3920 if (!error) { 3921 dont_mount(dentry); 3922 detach_mounts(dentry); 3923 } 3924 } 3925 } 3926 out: 3927 inode_unlock(target); 3928 3929 /* We don't d_delete() NFS sillyrenamed files--they still exist. */ 3930 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) { 3931 fsnotify_link_count(target); 3932 d_delete(dentry); 3933 } 3934 3935 return error; 3936 } 3937 EXPORT_SYMBOL(vfs_unlink); 3938 3939 /* 3940 * Make sure that the actual truncation of the file will occur outside its 3941 * directory's i_mutex. Truncate can take a long time if there is a lot of 3942 * writeout happening, and we don't want to prevent access to the directory 3943 * while waiting on the I/O. 3944 */ 3945 static long do_unlinkat(int dfd, const char __user *pathname) 3946 { 3947 int error; 3948 struct filename *name; 3949 struct dentry *dentry; 3950 struct path path; 3951 struct qstr last; 3952 int type; 3953 struct inode *inode = NULL; 3954 struct inode *delegated_inode = NULL; 3955 unsigned int lookup_flags = 0; 3956 retry: 3957 name = filename_parentat(dfd, getname(pathname), lookup_flags, 3958 &path, &last, &type); 3959 if (IS_ERR(name)) 3960 return PTR_ERR(name); 3961 3962 error = -EISDIR; 3963 if (type != LAST_NORM) 3964 goto exit1; 3965 3966 error = mnt_want_write(path.mnt); 3967 if (error) 3968 goto exit1; 3969 retry_deleg: 3970 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT); 3971 dentry = __lookup_hash(&last, path.dentry, lookup_flags); 3972 error = PTR_ERR(dentry); 3973 if (!IS_ERR(dentry)) { 3974 /* Why not before? Because we want correct error value */ 3975 if (last.name[last.len]) 3976 goto slashes; 3977 inode = dentry->d_inode; 3978 if (d_is_negative(dentry)) 3979 goto slashes; 3980 ihold(inode); 3981 error = security_path_unlink(&path, dentry); 3982 if (error) 3983 goto exit2; 3984 error = vfs_unlink(path.dentry->d_inode, dentry, &delegated_inode); 3985 exit2: 3986 dput(dentry); 3987 } 3988 inode_unlock(path.dentry->d_inode); 3989 if (inode) 3990 iput(inode); /* truncate the inode here */ 3991 inode = NULL; 3992 if (delegated_inode) { 3993 error = break_deleg_wait(&delegated_inode); 3994 if (!error) 3995 goto retry_deleg; 3996 } 3997 mnt_drop_write(path.mnt); 3998 exit1: 3999 path_put(&path); 4000 putname(name); 4001 if (retry_estale(error, lookup_flags)) { 4002 lookup_flags |= LOOKUP_REVAL; 4003 inode = NULL; 4004 goto retry; 4005 } 4006 return error; 4007 4008 slashes: 4009 if (d_is_negative(dentry)) 4010 error = -ENOENT; 4011 else if (d_is_dir(dentry)) 4012 error = -EISDIR; 4013 else 4014 error = -ENOTDIR; 4015 goto exit2; 4016 } 4017 4018 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) 4019 { 4020 if ((flag & ~AT_REMOVEDIR) != 0) 4021 return -EINVAL; 4022 4023 if (flag & AT_REMOVEDIR) 4024 return do_rmdir(dfd, pathname); 4025 4026 return do_unlinkat(dfd, pathname); 4027 } 4028 4029 SYSCALL_DEFINE1(unlink, const char __user *, pathname) 4030 { 4031 return do_unlinkat(AT_FDCWD, pathname); 4032 } 4033 4034 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname) 4035 { 4036 int error = may_create(dir, dentry); 4037 4038 if (error) 4039 return error; 4040 4041 if (!dir->i_op->symlink) 4042 return -EPERM; 4043 4044 error = security_inode_symlink(dir, dentry, oldname); 4045 if (error) 4046 return error; 4047 4048 error = dir->i_op->symlink(dir, dentry, oldname); 4049 if (!error) 4050 fsnotify_create(dir, dentry); 4051 return error; 4052 } 4053 EXPORT_SYMBOL(vfs_symlink); 4054 4055 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, 4056 int, newdfd, const char __user *, newname) 4057 { 4058 int error; 4059 struct filename *from; 4060 struct dentry *dentry; 4061 struct path path; 4062 unsigned int lookup_flags = 0; 4063 4064 from = getname(oldname); 4065 if (IS_ERR(from)) 4066 return PTR_ERR(from); 4067 retry: 4068 dentry = user_path_create(newdfd, newname, &path, lookup_flags); 4069 error = PTR_ERR(dentry); 4070 if (IS_ERR(dentry)) 4071 goto out_putname; 4072 4073 error = security_path_symlink(&path, dentry, from->name); 4074 if (!error) 4075 error = vfs_symlink(path.dentry->d_inode, dentry, from->name); 4076 done_path_create(&path, dentry); 4077 if (retry_estale(error, lookup_flags)) { 4078 lookup_flags |= LOOKUP_REVAL; 4079 goto retry; 4080 } 4081 out_putname: 4082 putname(from); 4083 return error; 4084 } 4085 4086 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) 4087 { 4088 return sys_symlinkat(oldname, AT_FDCWD, newname); 4089 } 4090 4091 /** 4092 * vfs_link - create a new link 4093 * @old_dentry: object to be linked 4094 * @dir: new parent 4095 * @new_dentry: where to create the new link 4096 * @delegated_inode: returns inode needing a delegation break 4097 * 4098 * The caller must hold dir->i_mutex 4099 * 4100 * If vfs_link discovers a delegation on the to-be-linked file in need 4101 * of breaking, it will return -EWOULDBLOCK and return a reference to the 4102 * inode in delegated_inode. The caller should then break the delegation 4103 * and retry. Because breaking a delegation may take a long time, the 4104 * caller should drop the i_mutex before doing so. 4105 * 4106 * Alternatively, a caller may pass NULL for delegated_inode. This may 4107 * be appropriate for callers that expect the underlying filesystem not 4108 * to be NFS exported. 4109 */ 4110 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode) 4111 { 4112 struct inode *inode = old_dentry->d_inode; 4113 unsigned max_links = dir->i_sb->s_max_links; 4114 int error; 4115 4116 if (!inode) 4117 return -ENOENT; 4118 4119 error = may_create(dir, new_dentry); 4120 if (error) 4121 return error; 4122 4123 if (dir->i_sb != inode->i_sb) 4124 return -EXDEV; 4125 4126 /* 4127 * A link to an append-only or immutable file cannot be created. 4128 */ 4129 if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) 4130 return -EPERM; 4131 /* 4132 * Updating the link count will likely cause i_uid and i_gid to 4133 * be writen back improperly if their true value is unknown to 4134 * the vfs. 4135 */ 4136 if (HAS_UNMAPPED_ID(inode)) 4137 return -EPERM; 4138 if (!dir->i_op->link) 4139 return -EPERM; 4140 if (S_ISDIR(inode->i_mode)) 4141 return -EPERM; 4142 4143 error = security_inode_link(old_dentry, dir, new_dentry); 4144 if (error) 4145 return error; 4146 4147 inode_lock(inode); 4148 /* Make sure we don't allow creating hardlink to an unlinked file */ 4149 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE)) 4150 error = -ENOENT; 4151 else if (max_links && inode->i_nlink >= max_links) 4152 error = -EMLINK; 4153 else { 4154 error = try_break_deleg(inode, delegated_inode); 4155 if (!error) 4156 error = dir->i_op->link(old_dentry, dir, new_dentry); 4157 } 4158 4159 if (!error && (inode->i_state & I_LINKABLE)) { 4160 spin_lock(&inode->i_lock); 4161 inode->i_state &= ~I_LINKABLE; 4162 spin_unlock(&inode->i_lock); 4163 } 4164 inode_unlock(inode); 4165 if (!error) 4166 fsnotify_link(dir, inode, new_dentry); 4167 return error; 4168 } 4169 EXPORT_SYMBOL(vfs_link); 4170 4171 /* 4172 * Hardlinks are often used in delicate situations. We avoid 4173 * security-related surprises by not following symlinks on the 4174 * newname. --KAB 4175 * 4176 * We don't follow them on the oldname either to be compatible 4177 * with linux 2.0, and to avoid hard-linking to directories 4178 * and other special files. --ADM 4179 */ 4180 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, 4181 int, newdfd, const char __user *, newname, int, flags) 4182 { 4183 struct dentry *new_dentry; 4184 struct path old_path, new_path; 4185 struct inode *delegated_inode = NULL; 4186 int how = 0; 4187 int error; 4188 4189 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) 4190 return -EINVAL; 4191 /* 4192 * To use null names we require CAP_DAC_READ_SEARCH 4193 * This ensures that not everyone will be able to create 4194 * handlink using the passed filedescriptor. 4195 */ 4196 if (flags & AT_EMPTY_PATH) { 4197 if (!capable(CAP_DAC_READ_SEARCH)) 4198 return -ENOENT; 4199 how = LOOKUP_EMPTY; 4200 } 4201 4202 if (flags & AT_SYMLINK_FOLLOW) 4203 how |= LOOKUP_FOLLOW; 4204 retry: 4205 error = user_path_at(olddfd, oldname, how, &old_path); 4206 if (error) 4207 return error; 4208 4209 new_dentry = user_path_create(newdfd, newname, &new_path, 4210 (how & LOOKUP_REVAL)); 4211 error = PTR_ERR(new_dentry); 4212 if (IS_ERR(new_dentry)) 4213 goto out; 4214 4215 error = -EXDEV; 4216 if (old_path.mnt != new_path.mnt) 4217 goto out_dput; 4218 error = may_linkat(&old_path); 4219 if (unlikely(error)) 4220 goto out_dput; 4221 error = security_path_link(old_path.dentry, &new_path, new_dentry); 4222 if (error) 4223 goto out_dput; 4224 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode); 4225 out_dput: 4226 done_path_create(&new_path, new_dentry); 4227 if (delegated_inode) { 4228 error = break_deleg_wait(&delegated_inode); 4229 if (!error) { 4230 path_put(&old_path); 4231 goto retry; 4232 } 4233 } 4234 if (retry_estale(error, how)) { 4235 path_put(&old_path); 4236 how |= LOOKUP_REVAL; 4237 goto retry; 4238 } 4239 out: 4240 path_put(&old_path); 4241 4242 return error; 4243 } 4244 4245 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) 4246 { 4247 return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 4248 } 4249 4250 /** 4251 * vfs_rename - rename a filesystem object 4252 * @old_dir: parent of source 4253 * @old_dentry: source 4254 * @new_dir: parent of destination 4255 * @new_dentry: destination 4256 * @delegated_inode: returns an inode needing a delegation break 4257 * @flags: rename flags 4258 * 4259 * The caller must hold multiple mutexes--see lock_rename()). 4260 * 4261 * If vfs_rename discovers a delegation in need of breaking at either 4262 * the source or destination, it will return -EWOULDBLOCK and return a 4263 * reference to the inode in delegated_inode. The caller should then 4264 * break the delegation and retry. Because breaking a delegation may 4265 * take a long time, the caller should drop all locks before doing 4266 * so. 4267 * 4268 * Alternatively, a caller may pass NULL for delegated_inode. This may 4269 * be appropriate for callers that expect the underlying filesystem not 4270 * to be NFS exported. 4271 * 4272 * The worst of all namespace operations - renaming directory. "Perverted" 4273 * doesn't even start to describe it. Somebody in UCB had a heck of a trip... 4274 * Problems: 4275 * a) we can get into loop creation. 4276 * b) race potential - two innocent renames can create a loop together. 4277 * That's where 4.4 screws up. Current fix: serialization on 4278 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another 4279 * story. 4280 * c) we have to lock _four_ objects - parents and victim (if it exists), 4281 * and source (if it is not a directory). 4282 * And that - after we got ->i_mutex on parents (until then we don't know 4283 * whether the target exists). Solution: try to be smart with locking 4284 * order for inodes. We rely on the fact that tree topology may change 4285 * only under ->s_vfs_rename_mutex _and_ that parent of the object we 4286 * move will be locked. Thus we can rank directories by the tree 4287 * (ancestors first) and rank all non-directories after them. 4288 * That works since everybody except rename does "lock parent, lookup, 4289 * lock child" and rename is under ->s_vfs_rename_mutex. 4290 * HOWEVER, it relies on the assumption that any object with ->lookup() 4291 * has no more than 1 dentry. If "hybrid" objects will ever appear, 4292 * we'd better make sure that there's no link(2) for them. 4293 * d) conversion from fhandle to dentry may come in the wrong moment - when 4294 * we are removing the target. Solution: we will have to grab ->i_mutex 4295 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on 4296 * ->i_mutex on parents, which works but leads to some truly excessive 4297 * locking]. 4298 */ 4299 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, 4300 struct inode *new_dir, struct dentry *new_dentry, 4301 struct inode **delegated_inode, unsigned int flags) 4302 { 4303 int error; 4304 bool is_dir = d_is_dir(old_dentry); 4305 const unsigned char *old_name; 4306 struct inode *source = old_dentry->d_inode; 4307 struct inode *target = new_dentry->d_inode; 4308 bool new_is_dir = false; 4309 unsigned max_links = new_dir->i_sb->s_max_links; 4310 4311 if (source == target) 4312 return 0; 4313 4314 error = may_delete(old_dir, old_dentry, is_dir); 4315 if (error) 4316 return error; 4317 4318 if (!target) { 4319 error = may_create(new_dir, new_dentry); 4320 } else { 4321 new_is_dir = d_is_dir(new_dentry); 4322 4323 if (!(flags & RENAME_EXCHANGE)) 4324 error = may_delete(new_dir, new_dentry, is_dir); 4325 else 4326 error = may_delete(new_dir, new_dentry, new_is_dir); 4327 } 4328 if (error) 4329 return error; 4330 4331 if (!old_dir->i_op->rename) 4332 return -EPERM; 4333 4334 /* 4335 * If we are going to change the parent - check write permissions, 4336 * we'll need to flip '..'. 4337 */ 4338 if (new_dir != old_dir) { 4339 if (is_dir) { 4340 error = inode_permission(source, MAY_WRITE); 4341 if (error) 4342 return error; 4343 } 4344 if ((flags & RENAME_EXCHANGE) && new_is_dir) { 4345 error = inode_permission(target, MAY_WRITE); 4346 if (error) 4347 return error; 4348 } 4349 } 4350 4351 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry, 4352 flags); 4353 if (error) 4354 return error; 4355 4356 old_name = fsnotify_oldname_init(old_dentry->d_name.name); 4357 dget(new_dentry); 4358 if (!is_dir || (flags & RENAME_EXCHANGE)) 4359 lock_two_nondirectories(source, target); 4360 else if (target) 4361 inode_lock(target); 4362 4363 error = -EBUSY; 4364 if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry)) 4365 goto out; 4366 4367 if (max_links && new_dir != old_dir) { 4368 error = -EMLINK; 4369 if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links) 4370 goto out; 4371 if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir && 4372 old_dir->i_nlink >= max_links) 4373 goto out; 4374 } 4375 if (is_dir && !(flags & RENAME_EXCHANGE) && target) 4376 shrink_dcache_parent(new_dentry); 4377 if (!is_dir) { 4378 error = try_break_deleg(source, delegated_inode); 4379 if (error) 4380 goto out; 4381 } 4382 if (target && !new_is_dir) { 4383 error = try_break_deleg(target, delegated_inode); 4384 if (error) 4385 goto out; 4386 } 4387 error = old_dir->i_op->rename(old_dir, old_dentry, 4388 new_dir, new_dentry, flags); 4389 if (error) 4390 goto out; 4391 4392 if (!(flags & RENAME_EXCHANGE) && target) { 4393 if (is_dir) 4394 target->i_flags |= S_DEAD; 4395 dont_mount(new_dentry); 4396 detach_mounts(new_dentry); 4397 } 4398 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) { 4399 if (!(flags & RENAME_EXCHANGE)) 4400 d_move(old_dentry, new_dentry); 4401 else 4402 d_exchange(old_dentry, new_dentry); 4403 } 4404 out: 4405 if (!is_dir || (flags & RENAME_EXCHANGE)) 4406 unlock_two_nondirectories(source, target); 4407 else if (target) 4408 inode_unlock(target); 4409 dput(new_dentry); 4410 if (!error) { 4411 fsnotify_move(old_dir, new_dir, old_name, is_dir, 4412 !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry); 4413 if (flags & RENAME_EXCHANGE) { 4414 fsnotify_move(new_dir, old_dir, old_dentry->d_name.name, 4415 new_is_dir, NULL, new_dentry); 4416 } 4417 } 4418 fsnotify_oldname_free(old_name); 4419 4420 return error; 4421 } 4422 EXPORT_SYMBOL(vfs_rename); 4423 4424 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname, 4425 int, newdfd, const char __user *, newname, unsigned int, flags) 4426 { 4427 struct dentry *old_dentry, *new_dentry; 4428 struct dentry *trap; 4429 struct path old_path, new_path; 4430 struct qstr old_last, new_last; 4431 int old_type, new_type; 4432 struct inode *delegated_inode = NULL; 4433 struct filename *from; 4434 struct filename *to; 4435 unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET; 4436 bool should_retry = false; 4437 int error; 4438 4439 if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT)) 4440 return -EINVAL; 4441 4442 if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) && 4443 (flags & RENAME_EXCHANGE)) 4444 return -EINVAL; 4445 4446 if ((flags & RENAME_WHITEOUT) && !capable(CAP_MKNOD)) 4447 return -EPERM; 4448 4449 if (flags & RENAME_EXCHANGE) 4450 target_flags = 0; 4451 4452 retry: 4453 from = filename_parentat(olddfd, getname(oldname), lookup_flags, 4454 &old_path, &old_last, &old_type); 4455 if (IS_ERR(from)) { 4456 error = PTR_ERR(from); 4457 goto exit; 4458 } 4459 4460 to = filename_parentat(newdfd, getname(newname), lookup_flags, 4461 &new_path, &new_last, &new_type); 4462 if (IS_ERR(to)) { 4463 error = PTR_ERR(to); 4464 goto exit1; 4465 } 4466 4467 error = -EXDEV; 4468 if (old_path.mnt != new_path.mnt) 4469 goto exit2; 4470 4471 error = -EBUSY; 4472 if (old_type != LAST_NORM) 4473 goto exit2; 4474 4475 if (flags & RENAME_NOREPLACE) 4476 error = -EEXIST; 4477 if (new_type != LAST_NORM) 4478 goto exit2; 4479 4480 error = mnt_want_write(old_path.mnt); 4481 if (error) 4482 goto exit2; 4483 4484 retry_deleg: 4485 trap = lock_rename(new_path.dentry, old_path.dentry); 4486 4487 old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags); 4488 error = PTR_ERR(old_dentry); 4489 if (IS_ERR(old_dentry)) 4490 goto exit3; 4491 /* source must exist */ 4492 error = -ENOENT; 4493 if (d_is_negative(old_dentry)) 4494 goto exit4; 4495 new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags); 4496 error = PTR_ERR(new_dentry); 4497 if (IS_ERR(new_dentry)) 4498 goto exit4; 4499 error = -EEXIST; 4500 if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry)) 4501 goto exit5; 4502 if (flags & RENAME_EXCHANGE) { 4503 error = -ENOENT; 4504 if (d_is_negative(new_dentry)) 4505 goto exit5; 4506 4507 if (!d_is_dir(new_dentry)) { 4508 error = -ENOTDIR; 4509 if (new_last.name[new_last.len]) 4510 goto exit5; 4511 } 4512 } 4513 /* unless the source is a directory trailing slashes give -ENOTDIR */ 4514 if (!d_is_dir(old_dentry)) { 4515 error = -ENOTDIR; 4516 if (old_last.name[old_last.len]) 4517 goto exit5; 4518 if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len]) 4519 goto exit5; 4520 } 4521 /* source should not be ancestor of target */ 4522 error = -EINVAL; 4523 if (old_dentry == trap) 4524 goto exit5; 4525 /* target should not be an ancestor of source */ 4526 if (!(flags & RENAME_EXCHANGE)) 4527 error = -ENOTEMPTY; 4528 if (new_dentry == trap) 4529 goto exit5; 4530 4531 error = security_path_rename(&old_path, old_dentry, 4532 &new_path, new_dentry, flags); 4533 if (error) 4534 goto exit5; 4535 error = vfs_rename(old_path.dentry->d_inode, old_dentry, 4536 new_path.dentry->d_inode, new_dentry, 4537 &delegated_inode, flags); 4538 exit5: 4539 dput(new_dentry); 4540 exit4: 4541 dput(old_dentry); 4542 exit3: 4543 unlock_rename(new_path.dentry, old_path.dentry); 4544 if (delegated_inode) { 4545 error = break_deleg_wait(&delegated_inode); 4546 if (!error) 4547 goto retry_deleg; 4548 } 4549 mnt_drop_write(old_path.mnt); 4550 exit2: 4551 if (retry_estale(error, lookup_flags)) 4552 should_retry = true; 4553 path_put(&new_path); 4554 putname(to); 4555 exit1: 4556 path_put(&old_path); 4557 putname(from); 4558 if (should_retry) { 4559 should_retry = false; 4560 lookup_flags |= LOOKUP_REVAL; 4561 goto retry; 4562 } 4563 exit: 4564 return error; 4565 } 4566 4567 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, 4568 int, newdfd, const char __user *, newname) 4569 { 4570 return sys_renameat2(olddfd, oldname, newdfd, newname, 0); 4571 } 4572 4573 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) 4574 { 4575 return sys_renameat2(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 4576 } 4577 4578 int vfs_whiteout(struct inode *dir, struct dentry *dentry) 4579 { 4580 int error = may_create(dir, dentry); 4581 if (error) 4582 return error; 4583 4584 if (!dir->i_op->mknod) 4585 return -EPERM; 4586 4587 return dir->i_op->mknod(dir, dentry, 4588 S_IFCHR | WHITEOUT_MODE, WHITEOUT_DEV); 4589 } 4590 EXPORT_SYMBOL(vfs_whiteout); 4591 4592 int readlink_copy(char __user *buffer, int buflen, const char *link) 4593 { 4594 int len = PTR_ERR(link); 4595 if (IS_ERR(link)) 4596 goto out; 4597 4598 len = strlen(link); 4599 if (len > (unsigned) buflen) 4600 len = buflen; 4601 if (copy_to_user(buffer, link, len)) 4602 len = -EFAULT; 4603 out: 4604 return len; 4605 } 4606 4607 /* 4608 * A helper for ->readlink(). This should be used *ONLY* for symlinks that 4609 * have ->get_link() not calling nd_jump_link(). Using (or not using) it 4610 * for any given inode is up to filesystem. 4611 */ 4612 static int generic_readlink(struct dentry *dentry, char __user *buffer, 4613 int buflen) 4614 { 4615 DEFINE_DELAYED_CALL(done); 4616 struct inode *inode = d_inode(dentry); 4617 const char *link = inode->i_link; 4618 int res; 4619 4620 if (!link) { 4621 link = inode->i_op->get_link(dentry, inode, &done); 4622 if (IS_ERR(link)) 4623 return PTR_ERR(link); 4624 } 4625 res = readlink_copy(buffer, buflen, link); 4626 do_delayed_call(&done); 4627 return res; 4628 } 4629 4630 /** 4631 * vfs_readlink - copy symlink body into userspace buffer 4632 * @dentry: dentry on which to get symbolic link 4633 * @buffer: user memory pointer 4634 * @buflen: size of buffer 4635 * 4636 * Does not touch atime. That's up to the caller if necessary 4637 * 4638 * Does not call security hook. 4639 */ 4640 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4641 { 4642 struct inode *inode = d_inode(dentry); 4643 4644 if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) { 4645 if (unlikely(inode->i_op->readlink)) 4646 return inode->i_op->readlink(dentry, buffer, buflen); 4647 4648 if (!d_is_symlink(dentry)) 4649 return -EINVAL; 4650 4651 spin_lock(&inode->i_lock); 4652 inode->i_opflags |= IOP_DEFAULT_READLINK; 4653 spin_unlock(&inode->i_lock); 4654 } 4655 4656 return generic_readlink(dentry, buffer, buflen); 4657 } 4658 EXPORT_SYMBOL(vfs_readlink); 4659 4660 /** 4661 * vfs_get_link - get symlink body 4662 * @dentry: dentry on which to get symbolic link 4663 * @done: caller needs to free returned data with this 4664 * 4665 * Calls security hook and i_op->get_link() on the supplied inode. 4666 * 4667 * It does not touch atime. That's up to the caller if necessary. 4668 * 4669 * Does not work on "special" symlinks like /proc/$$/fd/N 4670 */ 4671 const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done) 4672 { 4673 const char *res = ERR_PTR(-EINVAL); 4674 struct inode *inode = d_inode(dentry); 4675 4676 if (d_is_symlink(dentry)) { 4677 res = ERR_PTR(security_inode_readlink(dentry)); 4678 if (!res) 4679 res = inode->i_op->get_link(dentry, inode, done); 4680 } 4681 return res; 4682 } 4683 EXPORT_SYMBOL(vfs_get_link); 4684 4685 /* get the link contents into pagecache */ 4686 const char *page_get_link(struct dentry *dentry, struct inode *inode, 4687 struct delayed_call *callback) 4688 { 4689 char *kaddr; 4690 struct page *page; 4691 struct address_space *mapping = inode->i_mapping; 4692 4693 if (!dentry) { 4694 page = find_get_page(mapping, 0); 4695 if (!page) 4696 return ERR_PTR(-ECHILD); 4697 if (!PageUptodate(page)) { 4698 put_page(page); 4699 return ERR_PTR(-ECHILD); 4700 } 4701 } else { 4702 page = read_mapping_page(mapping, 0, NULL); 4703 if (IS_ERR(page)) 4704 return (char*)page; 4705 } 4706 set_delayed_call(callback, page_put_link, page); 4707 BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM); 4708 kaddr = page_address(page); 4709 nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1); 4710 return kaddr; 4711 } 4712 4713 EXPORT_SYMBOL(page_get_link); 4714 4715 void page_put_link(void *arg) 4716 { 4717 put_page(arg); 4718 } 4719 EXPORT_SYMBOL(page_put_link); 4720 4721 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4722 { 4723 DEFINE_DELAYED_CALL(done); 4724 int res = readlink_copy(buffer, buflen, 4725 page_get_link(dentry, d_inode(dentry), 4726 &done)); 4727 do_delayed_call(&done); 4728 return res; 4729 } 4730 EXPORT_SYMBOL(page_readlink); 4731 4732 /* 4733 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS 4734 */ 4735 int __page_symlink(struct inode *inode, const char *symname, int len, int nofs) 4736 { 4737 struct address_space *mapping = inode->i_mapping; 4738 struct page *page; 4739 void *fsdata; 4740 int err; 4741 unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE; 4742 if (nofs) 4743 flags |= AOP_FLAG_NOFS; 4744 4745 retry: 4746 err = pagecache_write_begin(NULL, mapping, 0, len-1, 4747 flags, &page, &fsdata); 4748 if (err) 4749 goto fail; 4750 4751 memcpy(page_address(page), symname, len-1); 4752 4753 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1, 4754 page, fsdata); 4755 if (err < 0) 4756 goto fail; 4757 if (err < len-1) 4758 goto retry; 4759 4760 mark_inode_dirty(inode); 4761 return 0; 4762 fail: 4763 return err; 4764 } 4765 EXPORT_SYMBOL(__page_symlink); 4766 4767 int page_symlink(struct inode *inode, const char *symname, int len) 4768 { 4769 return __page_symlink(inode, symname, len, 4770 !mapping_gfp_constraint(inode->i_mapping, __GFP_FS)); 4771 } 4772 EXPORT_SYMBOL(page_symlink); 4773 4774 const struct inode_operations page_symlink_inode_operations = { 4775 .get_link = page_get_link, 4776 }; 4777 EXPORT_SYMBOL(page_symlink_inode_operations); 4778