1 /* 2 * linux/fs/namei.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * Some corrections by tytso. 9 */ 10 11 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname 12 * lookup logic. 13 */ 14 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture. 15 */ 16 17 #include <linux/init.h> 18 #include <linux/export.h> 19 #include <linux/kernel.h> 20 #include <linux/slab.h> 21 #include <linux/fs.h> 22 #include <linux/namei.h> 23 #include <linux/pagemap.h> 24 #include <linux/fsnotify.h> 25 #include <linux/personality.h> 26 #include <linux/security.h> 27 #include <linux/ima.h> 28 #include <linux/syscalls.h> 29 #include <linux/mount.h> 30 #include <linux/audit.h> 31 #include <linux/capability.h> 32 #include <linux/file.h> 33 #include <linux/fcntl.h> 34 #include <linux/device_cgroup.h> 35 #include <linux/fs_struct.h> 36 #include <linux/posix_acl.h> 37 #include <linux/hash.h> 38 #include <asm/uaccess.h> 39 40 #include "internal.h" 41 #include "mount.h" 42 43 /* [Feb-1997 T. Schoebel-Theuer] 44 * Fundamental changes in the pathname lookup mechanisms (namei) 45 * were necessary because of omirr. The reason is that omirr needs 46 * to know the _real_ pathname, not the user-supplied one, in case 47 * of symlinks (and also when transname replacements occur). 48 * 49 * The new code replaces the old recursive symlink resolution with 50 * an iterative one (in case of non-nested symlink chains). It does 51 * this with calls to <fs>_follow_link(). 52 * As a side effect, dir_namei(), _namei() and follow_link() are now 53 * replaced with a single function lookup_dentry() that can handle all 54 * the special cases of the former code. 55 * 56 * With the new dcache, the pathname is stored at each inode, at least as 57 * long as the refcount of the inode is positive. As a side effect, the 58 * size of the dcache depends on the inode cache and thus is dynamic. 59 * 60 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink 61 * resolution to correspond with current state of the code. 62 * 63 * Note that the symlink resolution is not *completely* iterative. 64 * There is still a significant amount of tail- and mid- recursion in 65 * the algorithm. Also, note that <fs>_readlink() is not used in 66 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink() 67 * may return different results than <fs>_follow_link(). Many virtual 68 * filesystems (including /proc) exhibit this behavior. 69 */ 70 71 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation: 72 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL 73 * and the name already exists in form of a symlink, try to create the new 74 * name indicated by the symlink. The old code always complained that the 75 * name already exists, due to not following the symlink even if its target 76 * is nonexistent. The new semantics affects also mknod() and link() when 77 * the name is a symlink pointing to a non-existent name. 78 * 79 * I don't know which semantics is the right one, since I have no access 80 * to standards. But I found by trial that HP-UX 9.0 has the full "new" 81 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the 82 * "old" one. Personally, I think the new semantics is much more logical. 83 * Note that "ln old new" where "new" is a symlink pointing to a non-existing 84 * file does succeed in both HP-UX and SunOs, but not in Solaris 85 * and in the old Linux semantics. 86 */ 87 88 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink 89 * semantics. See the comments in "open_namei" and "do_link" below. 90 * 91 * [10-Sep-98 Alan Modra] Another symlink change. 92 */ 93 94 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks: 95 * inside the path - always follow. 96 * in the last component in creation/removal/renaming - never follow. 97 * if LOOKUP_FOLLOW passed - follow. 98 * if the pathname has trailing slashes - follow. 99 * otherwise - don't follow. 100 * (applied in that order). 101 * 102 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT 103 * restored for 2.4. This is the last surviving part of old 4.2BSD bug. 104 * During the 2.4 we need to fix the userland stuff depending on it - 105 * hopefully we will be able to get rid of that wart in 2.5. So far only 106 * XEmacs seems to be relying on it... 107 */ 108 /* 109 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland) 110 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives 111 * any extra contention... 112 */ 113 114 /* In order to reduce some races, while at the same time doing additional 115 * checking and hopefully speeding things up, we copy filenames to the 116 * kernel data space before using them.. 117 * 118 * POSIX.1 2.4: an empty pathname is invalid (ENOENT). 119 * PATH_MAX includes the nul terminator --RR. 120 */ 121 void final_putname(struct filename *name) 122 { 123 if (name->separate) { 124 __putname(name->name); 125 kfree(name); 126 } else { 127 __putname(name); 128 } 129 } 130 131 #define EMBEDDED_NAME_MAX (PATH_MAX - sizeof(struct filename)) 132 133 static struct filename * 134 getname_flags(const char __user *filename, int flags, int *empty) 135 { 136 struct filename *result, *err; 137 int len; 138 long max; 139 char *kname; 140 141 result = audit_reusename(filename); 142 if (result) 143 return result; 144 145 result = __getname(); 146 if (unlikely(!result)) 147 return ERR_PTR(-ENOMEM); 148 149 /* 150 * First, try to embed the struct filename inside the names_cache 151 * allocation 152 */ 153 kname = (char *)result + sizeof(*result); 154 result->name = kname; 155 result->separate = false; 156 max = EMBEDDED_NAME_MAX; 157 158 recopy: 159 len = strncpy_from_user(kname, filename, max); 160 if (unlikely(len < 0)) { 161 err = ERR_PTR(len); 162 goto error; 163 } 164 165 /* 166 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a 167 * separate struct filename so we can dedicate the entire 168 * names_cache allocation for the pathname, and re-do the copy from 169 * userland. 170 */ 171 if (len == EMBEDDED_NAME_MAX && max == EMBEDDED_NAME_MAX) { 172 kname = (char *)result; 173 174 result = kzalloc(sizeof(*result), GFP_KERNEL); 175 if (!result) { 176 err = ERR_PTR(-ENOMEM); 177 result = (struct filename *)kname; 178 goto error; 179 } 180 result->name = kname; 181 result->separate = true; 182 max = PATH_MAX; 183 goto recopy; 184 } 185 186 /* The empty path is special. */ 187 if (unlikely(!len)) { 188 if (empty) 189 *empty = 1; 190 err = ERR_PTR(-ENOENT); 191 if (!(flags & LOOKUP_EMPTY)) 192 goto error; 193 } 194 195 err = ERR_PTR(-ENAMETOOLONG); 196 if (unlikely(len >= PATH_MAX)) 197 goto error; 198 199 result->uptr = filename; 200 result->aname = NULL; 201 audit_getname(result); 202 return result; 203 204 error: 205 final_putname(result); 206 return err; 207 } 208 209 struct filename * 210 getname(const char __user * filename) 211 { 212 return getname_flags(filename, 0, NULL); 213 } 214 215 /* 216 * The "getname_kernel()" interface doesn't do pathnames longer 217 * than EMBEDDED_NAME_MAX. Deal with it - you're a kernel user. 218 */ 219 struct filename * 220 getname_kernel(const char * filename) 221 { 222 struct filename *result; 223 char *kname; 224 int len; 225 226 len = strlen(filename); 227 if (len >= EMBEDDED_NAME_MAX) 228 return ERR_PTR(-ENAMETOOLONG); 229 230 result = __getname(); 231 if (unlikely(!result)) 232 return ERR_PTR(-ENOMEM); 233 234 kname = (char *)result + sizeof(*result); 235 result->name = kname; 236 result->uptr = NULL; 237 result->aname = NULL; 238 result->separate = false; 239 240 strlcpy(kname, filename, EMBEDDED_NAME_MAX); 241 return result; 242 } 243 244 #ifdef CONFIG_AUDITSYSCALL 245 void putname(struct filename *name) 246 { 247 if (unlikely(!audit_dummy_context())) 248 return audit_putname(name); 249 final_putname(name); 250 } 251 #endif 252 253 static int check_acl(struct inode *inode, int mask) 254 { 255 #ifdef CONFIG_FS_POSIX_ACL 256 struct posix_acl *acl; 257 258 if (mask & MAY_NOT_BLOCK) { 259 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS); 260 if (!acl) 261 return -EAGAIN; 262 /* no ->get_acl() calls in RCU mode... */ 263 if (acl == ACL_NOT_CACHED) 264 return -ECHILD; 265 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK); 266 } 267 268 acl = get_acl(inode, ACL_TYPE_ACCESS); 269 if (IS_ERR(acl)) 270 return PTR_ERR(acl); 271 if (acl) { 272 int error = posix_acl_permission(inode, acl, mask); 273 posix_acl_release(acl); 274 return error; 275 } 276 #endif 277 278 return -EAGAIN; 279 } 280 281 /* 282 * This does the basic permission checking 283 */ 284 static int acl_permission_check(struct inode *inode, int mask) 285 { 286 unsigned int mode = inode->i_mode; 287 288 if (likely(uid_eq(current_fsuid(), inode->i_uid))) 289 mode >>= 6; 290 else { 291 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { 292 int error = check_acl(inode, mask); 293 if (error != -EAGAIN) 294 return error; 295 } 296 297 if (in_group_p(inode->i_gid)) 298 mode >>= 3; 299 } 300 301 /* 302 * If the DACs are ok we don't need any capability check. 303 */ 304 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0) 305 return 0; 306 return -EACCES; 307 } 308 309 /** 310 * generic_permission - check for access rights on a Posix-like filesystem 311 * @inode: inode to check access rights for 312 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...) 313 * 314 * Used to check for read/write/execute permissions on a file. 315 * We use "fsuid" for this, letting us set arbitrary permissions 316 * for filesystem access without changing the "normal" uids which 317 * are used for other things. 318 * 319 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk 320 * request cannot be satisfied (eg. requires blocking or too much complexity). 321 * It would then be called again in ref-walk mode. 322 */ 323 int generic_permission(struct inode *inode, int mask) 324 { 325 int ret; 326 327 /* 328 * Do the basic permission checks. 329 */ 330 ret = acl_permission_check(inode, mask); 331 if (ret != -EACCES) 332 return ret; 333 334 if (S_ISDIR(inode->i_mode)) { 335 /* DACs are overridable for directories */ 336 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) 337 return 0; 338 if (!(mask & MAY_WRITE)) 339 if (capable_wrt_inode_uidgid(inode, 340 CAP_DAC_READ_SEARCH)) 341 return 0; 342 return -EACCES; 343 } 344 /* 345 * Read/write DACs are always overridable. 346 * Executable DACs are overridable when there is 347 * at least one exec bit set. 348 */ 349 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 350 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) 351 return 0; 352 353 /* 354 * Searching includes executable on directories, else just read. 355 */ 356 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 357 if (mask == MAY_READ) 358 if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH)) 359 return 0; 360 361 return -EACCES; 362 } 363 EXPORT_SYMBOL(generic_permission); 364 365 /* 366 * We _really_ want to just do "generic_permission()" without 367 * even looking at the inode->i_op values. So we keep a cache 368 * flag in inode->i_opflags, that says "this has not special 369 * permission function, use the fast case". 370 */ 371 static inline int do_inode_permission(struct inode *inode, int mask) 372 { 373 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) { 374 if (likely(inode->i_op->permission)) 375 return inode->i_op->permission(inode, mask); 376 377 /* This gets set once for the inode lifetime */ 378 spin_lock(&inode->i_lock); 379 inode->i_opflags |= IOP_FASTPERM; 380 spin_unlock(&inode->i_lock); 381 } 382 return generic_permission(inode, mask); 383 } 384 385 /** 386 * __inode_permission - Check for access rights to a given inode 387 * @inode: Inode to check permission on 388 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 389 * 390 * Check for read/write/execute permissions on an inode. 391 * 392 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 393 * 394 * This does not check for a read-only file system. You probably want 395 * inode_permission(). 396 */ 397 int __inode_permission(struct inode *inode, int mask) 398 { 399 int retval; 400 401 if (unlikely(mask & MAY_WRITE)) { 402 /* 403 * Nobody gets write access to an immutable file. 404 */ 405 if (IS_IMMUTABLE(inode)) 406 return -EACCES; 407 } 408 409 retval = do_inode_permission(inode, mask); 410 if (retval) 411 return retval; 412 413 retval = devcgroup_inode_permission(inode, mask); 414 if (retval) 415 return retval; 416 417 return security_inode_permission(inode, mask); 418 } 419 420 /** 421 * sb_permission - Check superblock-level permissions 422 * @sb: Superblock of inode to check permission on 423 * @inode: Inode to check permission on 424 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 425 * 426 * Separate out file-system wide checks from inode-specific permission checks. 427 */ 428 static int sb_permission(struct super_block *sb, struct inode *inode, int mask) 429 { 430 if (unlikely(mask & MAY_WRITE)) { 431 umode_t mode = inode->i_mode; 432 433 /* Nobody gets write access to a read-only fs. */ 434 if ((sb->s_flags & MS_RDONLY) && 435 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) 436 return -EROFS; 437 } 438 return 0; 439 } 440 441 /** 442 * inode_permission - Check for access rights to a given inode 443 * @inode: Inode to check permission on 444 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 445 * 446 * Check for read/write/execute permissions on an inode. We use fs[ug]id for 447 * this, letting us set arbitrary permissions for filesystem access without 448 * changing the "normal" UIDs which are used for other things. 449 * 450 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 451 */ 452 int inode_permission(struct inode *inode, int mask) 453 { 454 int retval; 455 456 retval = sb_permission(inode->i_sb, inode, mask); 457 if (retval) 458 return retval; 459 return __inode_permission(inode, mask); 460 } 461 EXPORT_SYMBOL(inode_permission); 462 463 /** 464 * path_get - get a reference to a path 465 * @path: path to get the reference to 466 * 467 * Given a path increment the reference count to the dentry and the vfsmount. 468 */ 469 void path_get(const struct path *path) 470 { 471 mntget(path->mnt); 472 dget(path->dentry); 473 } 474 EXPORT_SYMBOL(path_get); 475 476 /** 477 * path_put - put a reference to a path 478 * @path: path to put the reference to 479 * 480 * Given a path decrement the reference count to the dentry and the vfsmount. 481 */ 482 void path_put(const struct path *path) 483 { 484 dput(path->dentry); 485 mntput(path->mnt); 486 } 487 EXPORT_SYMBOL(path_put); 488 489 /* 490 * Path walking has 2 modes, rcu-walk and ref-walk (see 491 * Documentation/filesystems/path-lookup.txt). In situations when we can't 492 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab 493 * normal reference counts on dentries and vfsmounts to transition to rcu-walk 494 * mode. Refcounts are grabbed at the last known good point before rcu-walk 495 * got stuck, so ref-walk may continue from there. If this is not successful 496 * (eg. a seqcount has changed), then failure is returned and it's up to caller 497 * to restart the path walk from the beginning in ref-walk mode. 498 */ 499 500 /** 501 * unlazy_walk - try to switch to ref-walk mode. 502 * @nd: nameidata pathwalk data 503 * @dentry: child of nd->path.dentry or NULL 504 * Returns: 0 on success, -ECHILD on failure 505 * 506 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry 507 * for ref-walk mode. @dentry must be a path found by a do_lookup call on 508 * @nd or NULL. Must be called from rcu-walk context. 509 */ 510 static int unlazy_walk(struct nameidata *nd, struct dentry *dentry) 511 { 512 struct fs_struct *fs = current->fs; 513 struct dentry *parent = nd->path.dentry; 514 515 BUG_ON(!(nd->flags & LOOKUP_RCU)); 516 517 /* 518 * After legitimizing the bastards, terminate_walk() 519 * will do the right thing for non-RCU mode, and all our 520 * subsequent exit cases should rcu_read_unlock() 521 * before returning. Do vfsmount first; if dentry 522 * can't be legitimized, just set nd->path.dentry to NULL 523 * and rely on dput(NULL) being a no-op. 524 */ 525 if (!legitimize_mnt(nd->path.mnt, nd->m_seq)) 526 return -ECHILD; 527 nd->flags &= ~LOOKUP_RCU; 528 529 if (!lockref_get_not_dead(&parent->d_lockref)) { 530 nd->path.dentry = NULL; 531 goto out; 532 } 533 534 /* 535 * For a negative lookup, the lookup sequence point is the parents 536 * sequence point, and it only needs to revalidate the parent dentry. 537 * 538 * For a positive lookup, we need to move both the parent and the 539 * dentry from the RCU domain to be properly refcounted. And the 540 * sequence number in the dentry validates *both* dentry counters, 541 * since we checked the sequence number of the parent after we got 542 * the child sequence number. So we know the parent must still 543 * be valid if the child sequence number is still valid. 544 */ 545 if (!dentry) { 546 if (read_seqcount_retry(&parent->d_seq, nd->seq)) 547 goto out; 548 BUG_ON(nd->inode != parent->d_inode); 549 } else { 550 if (!lockref_get_not_dead(&dentry->d_lockref)) 551 goto out; 552 if (read_seqcount_retry(&dentry->d_seq, nd->seq)) 553 goto drop_dentry; 554 } 555 556 /* 557 * Sequence counts matched. Now make sure that the root is 558 * still valid and get it if required. 559 */ 560 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 561 spin_lock(&fs->lock); 562 if (nd->root.mnt != fs->root.mnt || nd->root.dentry != fs->root.dentry) 563 goto unlock_and_drop_dentry; 564 path_get(&nd->root); 565 spin_unlock(&fs->lock); 566 } 567 568 rcu_read_unlock(); 569 return 0; 570 571 unlock_and_drop_dentry: 572 spin_unlock(&fs->lock); 573 drop_dentry: 574 rcu_read_unlock(); 575 dput(dentry); 576 goto drop_root_mnt; 577 out: 578 rcu_read_unlock(); 579 drop_root_mnt: 580 if (!(nd->flags & LOOKUP_ROOT)) 581 nd->root.mnt = NULL; 582 return -ECHILD; 583 } 584 585 static inline int d_revalidate(struct dentry *dentry, unsigned int flags) 586 { 587 return dentry->d_op->d_revalidate(dentry, flags); 588 } 589 590 /** 591 * complete_walk - successful completion of path walk 592 * @nd: pointer nameidata 593 * 594 * If we had been in RCU mode, drop out of it and legitimize nd->path. 595 * Revalidate the final result, unless we'd already done that during 596 * the path walk or the filesystem doesn't ask for it. Return 0 on 597 * success, -error on failure. In case of failure caller does not 598 * need to drop nd->path. 599 */ 600 static int complete_walk(struct nameidata *nd) 601 { 602 struct dentry *dentry = nd->path.dentry; 603 int status; 604 605 if (nd->flags & LOOKUP_RCU) { 606 nd->flags &= ~LOOKUP_RCU; 607 if (!(nd->flags & LOOKUP_ROOT)) 608 nd->root.mnt = NULL; 609 610 if (!legitimize_mnt(nd->path.mnt, nd->m_seq)) { 611 rcu_read_unlock(); 612 return -ECHILD; 613 } 614 if (unlikely(!lockref_get_not_dead(&dentry->d_lockref))) { 615 rcu_read_unlock(); 616 mntput(nd->path.mnt); 617 return -ECHILD; 618 } 619 if (read_seqcount_retry(&dentry->d_seq, nd->seq)) { 620 rcu_read_unlock(); 621 dput(dentry); 622 mntput(nd->path.mnt); 623 return -ECHILD; 624 } 625 rcu_read_unlock(); 626 } 627 628 if (likely(!(nd->flags & LOOKUP_JUMPED))) 629 return 0; 630 631 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE))) 632 return 0; 633 634 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags); 635 if (status > 0) 636 return 0; 637 638 if (!status) 639 status = -ESTALE; 640 641 path_put(&nd->path); 642 return status; 643 } 644 645 static __always_inline void set_root(struct nameidata *nd) 646 { 647 get_fs_root(current->fs, &nd->root); 648 } 649 650 static int link_path_walk(const char *, struct nameidata *); 651 652 static __always_inline unsigned set_root_rcu(struct nameidata *nd) 653 { 654 struct fs_struct *fs = current->fs; 655 unsigned seq, res; 656 657 do { 658 seq = read_seqcount_begin(&fs->seq); 659 nd->root = fs->root; 660 res = __read_seqcount_begin(&nd->root.dentry->d_seq); 661 } while (read_seqcount_retry(&fs->seq, seq)); 662 return res; 663 } 664 665 static void path_put_conditional(struct path *path, struct nameidata *nd) 666 { 667 dput(path->dentry); 668 if (path->mnt != nd->path.mnt) 669 mntput(path->mnt); 670 } 671 672 static inline void path_to_nameidata(const struct path *path, 673 struct nameidata *nd) 674 { 675 if (!(nd->flags & LOOKUP_RCU)) { 676 dput(nd->path.dentry); 677 if (nd->path.mnt != path->mnt) 678 mntput(nd->path.mnt); 679 } 680 nd->path.mnt = path->mnt; 681 nd->path.dentry = path->dentry; 682 } 683 684 /* 685 * Helper to directly jump to a known parsed path from ->follow_link, 686 * caller must have taken a reference to path beforehand. 687 */ 688 void nd_jump_link(struct nameidata *nd, struct path *path) 689 { 690 path_put(&nd->path); 691 692 nd->path = *path; 693 nd->inode = nd->path.dentry->d_inode; 694 nd->flags |= LOOKUP_JUMPED; 695 } 696 697 static inline void put_link(struct nameidata *nd, struct path *link, void *cookie) 698 { 699 struct inode *inode = link->dentry->d_inode; 700 if (inode->i_op->put_link) 701 inode->i_op->put_link(link->dentry, nd, cookie); 702 path_put(link); 703 } 704 705 int sysctl_protected_symlinks __read_mostly = 0; 706 int sysctl_protected_hardlinks __read_mostly = 0; 707 708 /** 709 * may_follow_link - Check symlink following for unsafe situations 710 * @link: The path of the symlink 711 * @nd: nameidata pathwalk data 712 * 713 * In the case of the sysctl_protected_symlinks sysctl being enabled, 714 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is 715 * in a sticky world-writable directory. This is to protect privileged 716 * processes from failing races against path names that may change out 717 * from under them by way of other users creating malicious symlinks. 718 * It will permit symlinks to be followed only when outside a sticky 719 * world-writable directory, or when the uid of the symlink and follower 720 * match, or when the directory owner matches the symlink's owner. 721 * 722 * Returns 0 if following the symlink is allowed, -ve on error. 723 */ 724 static inline int may_follow_link(struct path *link, struct nameidata *nd) 725 { 726 const struct inode *inode; 727 const struct inode *parent; 728 729 if (!sysctl_protected_symlinks) 730 return 0; 731 732 /* Allowed if owner and follower match. */ 733 inode = link->dentry->d_inode; 734 if (uid_eq(current_cred()->fsuid, inode->i_uid)) 735 return 0; 736 737 /* Allowed if parent directory not sticky and world-writable. */ 738 parent = nd->path.dentry->d_inode; 739 if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH)) 740 return 0; 741 742 /* Allowed if parent directory and link owner match. */ 743 if (uid_eq(parent->i_uid, inode->i_uid)) 744 return 0; 745 746 audit_log_link_denied("follow_link", link); 747 path_put_conditional(link, nd); 748 path_put(&nd->path); 749 return -EACCES; 750 } 751 752 /** 753 * safe_hardlink_source - Check for safe hardlink conditions 754 * @inode: the source inode to hardlink from 755 * 756 * Return false if at least one of the following conditions: 757 * - inode is not a regular file 758 * - inode is setuid 759 * - inode is setgid and group-exec 760 * - access failure for read and write 761 * 762 * Otherwise returns true. 763 */ 764 static bool safe_hardlink_source(struct inode *inode) 765 { 766 umode_t mode = inode->i_mode; 767 768 /* Special files should not get pinned to the filesystem. */ 769 if (!S_ISREG(mode)) 770 return false; 771 772 /* Setuid files should not get pinned to the filesystem. */ 773 if (mode & S_ISUID) 774 return false; 775 776 /* Executable setgid files should not get pinned to the filesystem. */ 777 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) 778 return false; 779 780 /* Hardlinking to unreadable or unwritable sources is dangerous. */ 781 if (inode_permission(inode, MAY_READ | MAY_WRITE)) 782 return false; 783 784 return true; 785 } 786 787 /** 788 * may_linkat - Check permissions for creating a hardlink 789 * @link: the source to hardlink from 790 * 791 * Block hardlink when all of: 792 * - sysctl_protected_hardlinks enabled 793 * - fsuid does not match inode 794 * - hardlink source is unsafe (see safe_hardlink_source() above) 795 * - not CAP_FOWNER 796 * 797 * Returns 0 if successful, -ve on error. 798 */ 799 static int may_linkat(struct path *link) 800 { 801 const struct cred *cred; 802 struct inode *inode; 803 804 if (!sysctl_protected_hardlinks) 805 return 0; 806 807 cred = current_cred(); 808 inode = link->dentry->d_inode; 809 810 /* Source inode owner (or CAP_FOWNER) can hardlink all they like, 811 * otherwise, it must be a safe source. 812 */ 813 if (uid_eq(cred->fsuid, inode->i_uid) || safe_hardlink_source(inode) || 814 capable(CAP_FOWNER)) 815 return 0; 816 817 audit_log_link_denied("linkat", link); 818 return -EPERM; 819 } 820 821 static __always_inline int 822 follow_link(struct path *link, struct nameidata *nd, void **p) 823 { 824 struct dentry *dentry = link->dentry; 825 int error; 826 char *s; 827 828 BUG_ON(nd->flags & LOOKUP_RCU); 829 830 if (link->mnt == nd->path.mnt) 831 mntget(link->mnt); 832 833 error = -ELOOP; 834 if (unlikely(current->total_link_count >= 40)) 835 goto out_put_nd_path; 836 837 cond_resched(); 838 current->total_link_count++; 839 840 touch_atime(link); 841 nd_set_link(nd, NULL); 842 843 error = security_inode_follow_link(link->dentry, nd); 844 if (error) 845 goto out_put_nd_path; 846 847 nd->last_type = LAST_BIND; 848 *p = dentry->d_inode->i_op->follow_link(dentry, nd); 849 error = PTR_ERR(*p); 850 if (IS_ERR(*p)) 851 goto out_put_nd_path; 852 853 error = 0; 854 s = nd_get_link(nd); 855 if (s) { 856 if (unlikely(IS_ERR(s))) { 857 path_put(&nd->path); 858 put_link(nd, link, *p); 859 return PTR_ERR(s); 860 } 861 if (*s == '/') { 862 if (!nd->root.mnt) 863 set_root(nd); 864 path_put(&nd->path); 865 nd->path = nd->root; 866 path_get(&nd->root); 867 nd->flags |= LOOKUP_JUMPED; 868 } 869 nd->inode = nd->path.dentry->d_inode; 870 error = link_path_walk(s, nd); 871 if (unlikely(error)) 872 put_link(nd, link, *p); 873 } 874 875 return error; 876 877 out_put_nd_path: 878 *p = NULL; 879 path_put(&nd->path); 880 path_put(link); 881 return error; 882 } 883 884 static int follow_up_rcu(struct path *path) 885 { 886 struct mount *mnt = real_mount(path->mnt); 887 struct mount *parent; 888 struct dentry *mountpoint; 889 890 parent = mnt->mnt_parent; 891 if (&parent->mnt == path->mnt) 892 return 0; 893 mountpoint = mnt->mnt_mountpoint; 894 path->dentry = mountpoint; 895 path->mnt = &parent->mnt; 896 return 1; 897 } 898 899 /* 900 * follow_up - Find the mountpoint of path's vfsmount 901 * 902 * Given a path, find the mountpoint of its source file system. 903 * Replace @path with the path of the mountpoint in the parent mount. 904 * Up is towards /. 905 * 906 * Return 1 if we went up a level and 0 if we were already at the 907 * root. 908 */ 909 int follow_up(struct path *path) 910 { 911 struct mount *mnt = real_mount(path->mnt); 912 struct mount *parent; 913 struct dentry *mountpoint; 914 915 read_seqlock_excl(&mount_lock); 916 parent = mnt->mnt_parent; 917 if (parent == mnt) { 918 read_sequnlock_excl(&mount_lock); 919 return 0; 920 } 921 mntget(&parent->mnt); 922 mountpoint = dget(mnt->mnt_mountpoint); 923 read_sequnlock_excl(&mount_lock); 924 dput(path->dentry); 925 path->dentry = mountpoint; 926 mntput(path->mnt); 927 path->mnt = &parent->mnt; 928 return 1; 929 } 930 EXPORT_SYMBOL(follow_up); 931 932 /* 933 * Perform an automount 934 * - return -EISDIR to tell follow_managed() to stop and return the path we 935 * were called with. 936 */ 937 static int follow_automount(struct path *path, unsigned flags, 938 bool *need_mntput) 939 { 940 struct vfsmount *mnt; 941 int err; 942 943 if (!path->dentry->d_op || !path->dentry->d_op->d_automount) 944 return -EREMOTE; 945 946 /* We don't want to mount if someone's just doing a stat - 947 * unless they're stat'ing a directory and appended a '/' to 948 * the name. 949 * 950 * We do, however, want to mount if someone wants to open or 951 * create a file of any type under the mountpoint, wants to 952 * traverse through the mountpoint or wants to open the 953 * mounted directory. Also, autofs may mark negative dentries 954 * as being automount points. These will need the attentions 955 * of the daemon to instantiate them before they can be used. 956 */ 957 if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | 958 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) && 959 path->dentry->d_inode) 960 return -EISDIR; 961 962 current->total_link_count++; 963 if (current->total_link_count >= 40) 964 return -ELOOP; 965 966 mnt = path->dentry->d_op->d_automount(path); 967 if (IS_ERR(mnt)) { 968 /* 969 * The filesystem is allowed to return -EISDIR here to indicate 970 * it doesn't want to automount. For instance, autofs would do 971 * this so that its userspace daemon can mount on this dentry. 972 * 973 * However, we can only permit this if it's a terminal point in 974 * the path being looked up; if it wasn't then the remainder of 975 * the path is inaccessible and we should say so. 976 */ 977 if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT)) 978 return -EREMOTE; 979 return PTR_ERR(mnt); 980 } 981 982 if (!mnt) /* mount collision */ 983 return 0; 984 985 if (!*need_mntput) { 986 /* lock_mount() may release path->mnt on error */ 987 mntget(path->mnt); 988 *need_mntput = true; 989 } 990 err = finish_automount(mnt, path); 991 992 switch (err) { 993 case -EBUSY: 994 /* Someone else made a mount here whilst we were busy */ 995 return 0; 996 case 0: 997 path_put(path); 998 path->mnt = mnt; 999 path->dentry = dget(mnt->mnt_root); 1000 return 0; 1001 default: 1002 return err; 1003 } 1004 1005 } 1006 1007 /* 1008 * Handle a dentry that is managed in some way. 1009 * - Flagged for transit management (autofs) 1010 * - Flagged as mountpoint 1011 * - Flagged as automount point 1012 * 1013 * This may only be called in refwalk mode. 1014 * 1015 * Serialization is taken care of in namespace.c 1016 */ 1017 static int follow_managed(struct path *path, unsigned flags) 1018 { 1019 struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */ 1020 unsigned managed; 1021 bool need_mntput = false; 1022 int ret = 0; 1023 1024 /* Given that we're not holding a lock here, we retain the value in a 1025 * local variable for each dentry as we look at it so that we don't see 1026 * the components of that value change under us */ 1027 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1028 managed &= DCACHE_MANAGED_DENTRY, 1029 unlikely(managed != 0)) { 1030 /* Allow the filesystem to manage the transit without i_mutex 1031 * being held. */ 1032 if (managed & DCACHE_MANAGE_TRANSIT) { 1033 BUG_ON(!path->dentry->d_op); 1034 BUG_ON(!path->dentry->d_op->d_manage); 1035 ret = path->dentry->d_op->d_manage(path->dentry, false); 1036 if (ret < 0) 1037 break; 1038 } 1039 1040 /* Transit to a mounted filesystem. */ 1041 if (managed & DCACHE_MOUNTED) { 1042 struct vfsmount *mounted = lookup_mnt(path); 1043 if (mounted) { 1044 dput(path->dentry); 1045 if (need_mntput) 1046 mntput(path->mnt); 1047 path->mnt = mounted; 1048 path->dentry = dget(mounted->mnt_root); 1049 need_mntput = true; 1050 continue; 1051 } 1052 1053 /* Something is mounted on this dentry in another 1054 * namespace and/or whatever was mounted there in this 1055 * namespace got unmounted before lookup_mnt() could 1056 * get it */ 1057 } 1058 1059 /* Handle an automount point */ 1060 if (managed & DCACHE_NEED_AUTOMOUNT) { 1061 ret = follow_automount(path, flags, &need_mntput); 1062 if (ret < 0) 1063 break; 1064 continue; 1065 } 1066 1067 /* We didn't change the current path point */ 1068 break; 1069 } 1070 1071 if (need_mntput && path->mnt == mnt) 1072 mntput(path->mnt); 1073 if (ret == -EISDIR) 1074 ret = 0; 1075 return ret < 0 ? ret : need_mntput; 1076 } 1077 1078 int follow_down_one(struct path *path) 1079 { 1080 struct vfsmount *mounted; 1081 1082 mounted = lookup_mnt(path); 1083 if (mounted) { 1084 dput(path->dentry); 1085 mntput(path->mnt); 1086 path->mnt = mounted; 1087 path->dentry = dget(mounted->mnt_root); 1088 return 1; 1089 } 1090 return 0; 1091 } 1092 EXPORT_SYMBOL(follow_down_one); 1093 1094 static inline int managed_dentry_rcu(struct dentry *dentry) 1095 { 1096 return (dentry->d_flags & DCACHE_MANAGE_TRANSIT) ? 1097 dentry->d_op->d_manage(dentry, true) : 0; 1098 } 1099 1100 /* 1101 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if 1102 * we meet a managed dentry that would need blocking. 1103 */ 1104 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, 1105 struct inode **inode) 1106 { 1107 for (;;) { 1108 struct mount *mounted; 1109 /* 1110 * Don't forget we might have a non-mountpoint managed dentry 1111 * that wants to block transit. 1112 */ 1113 switch (managed_dentry_rcu(path->dentry)) { 1114 case -ECHILD: 1115 default: 1116 return false; 1117 case -EISDIR: 1118 return true; 1119 case 0: 1120 break; 1121 } 1122 1123 if (!d_mountpoint(path->dentry)) 1124 return !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT); 1125 1126 mounted = __lookup_mnt(path->mnt, path->dentry); 1127 if (!mounted) 1128 break; 1129 path->mnt = &mounted->mnt; 1130 path->dentry = mounted->mnt.mnt_root; 1131 nd->flags |= LOOKUP_JUMPED; 1132 nd->seq = read_seqcount_begin(&path->dentry->d_seq); 1133 /* 1134 * Update the inode too. We don't need to re-check the 1135 * dentry sequence number here after this d_inode read, 1136 * because a mount-point is always pinned. 1137 */ 1138 *inode = path->dentry->d_inode; 1139 } 1140 return !read_seqretry(&mount_lock, nd->m_seq) && 1141 !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT); 1142 } 1143 1144 static int follow_dotdot_rcu(struct nameidata *nd) 1145 { 1146 struct inode *inode = nd->inode; 1147 if (!nd->root.mnt) 1148 set_root_rcu(nd); 1149 1150 while (1) { 1151 if (nd->path.dentry == nd->root.dentry && 1152 nd->path.mnt == nd->root.mnt) { 1153 break; 1154 } 1155 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1156 struct dentry *old = nd->path.dentry; 1157 struct dentry *parent = old->d_parent; 1158 unsigned seq; 1159 1160 inode = parent->d_inode; 1161 seq = read_seqcount_begin(&parent->d_seq); 1162 if (read_seqcount_retry(&old->d_seq, nd->seq)) 1163 goto failed; 1164 nd->path.dentry = parent; 1165 nd->seq = seq; 1166 break; 1167 } 1168 if (!follow_up_rcu(&nd->path)) 1169 break; 1170 inode = nd->path.dentry->d_inode; 1171 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 1172 } 1173 while (d_mountpoint(nd->path.dentry)) { 1174 struct mount *mounted; 1175 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry); 1176 if (!mounted) 1177 break; 1178 nd->path.mnt = &mounted->mnt; 1179 nd->path.dentry = mounted->mnt.mnt_root; 1180 inode = nd->path.dentry->d_inode; 1181 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 1182 if (read_seqretry(&mount_lock, nd->m_seq)) 1183 goto failed; 1184 } 1185 nd->inode = inode; 1186 return 0; 1187 1188 failed: 1189 nd->flags &= ~LOOKUP_RCU; 1190 if (!(nd->flags & LOOKUP_ROOT)) 1191 nd->root.mnt = NULL; 1192 rcu_read_unlock(); 1193 return -ECHILD; 1194 } 1195 1196 /* 1197 * Follow down to the covering mount currently visible to userspace. At each 1198 * point, the filesystem owning that dentry may be queried as to whether the 1199 * caller is permitted to proceed or not. 1200 */ 1201 int follow_down(struct path *path) 1202 { 1203 unsigned managed; 1204 int ret; 1205 1206 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1207 unlikely(managed & DCACHE_MANAGED_DENTRY)) { 1208 /* Allow the filesystem to manage the transit without i_mutex 1209 * being held. 1210 * 1211 * We indicate to the filesystem if someone is trying to mount 1212 * something here. This gives autofs the chance to deny anyone 1213 * other than its daemon the right to mount on its 1214 * superstructure. 1215 * 1216 * The filesystem may sleep at this point. 1217 */ 1218 if (managed & DCACHE_MANAGE_TRANSIT) { 1219 BUG_ON(!path->dentry->d_op); 1220 BUG_ON(!path->dentry->d_op->d_manage); 1221 ret = path->dentry->d_op->d_manage( 1222 path->dentry, false); 1223 if (ret < 0) 1224 return ret == -EISDIR ? 0 : ret; 1225 } 1226 1227 /* Transit to a mounted filesystem. */ 1228 if (managed & DCACHE_MOUNTED) { 1229 struct vfsmount *mounted = lookup_mnt(path); 1230 if (!mounted) 1231 break; 1232 dput(path->dentry); 1233 mntput(path->mnt); 1234 path->mnt = mounted; 1235 path->dentry = dget(mounted->mnt_root); 1236 continue; 1237 } 1238 1239 /* Don't handle automount points here */ 1240 break; 1241 } 1242 return 0; 1243 } 1244 EXPORT_SYMBOL(follow_down); 1245 1246 /* 1247 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot() 1248 */ 1249 static void follow_mount(struct path *path) 1250 { 1251 while (d_mountpoint(path->dentry)) { 1252 struct vfsmount *mounted = lookup_mnt(path); 1253 if (!mounted) 1254 break; 1255 dput(path->dentry); 1256 mntput(path->mnt); 1257 path->mnt = mounted; 1258 path->dentry = dget(mounted->mnt_root); 1259 } 1260 } 1261 1262 static void follow_dotdot(struct nameidata *nd) 1263 { 1264 if (!nd->root.mnt) 1265 set_root(nd); 1266 1267 while(1) { 1268 struct dentry *old = nd->path.dentry; 1269 1270 if (nd->path.dentry == nd->root.dentry && 1271 nd->path.mnt == nd->root.mnt) { 1272 break; 1273 } 1274 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1275 /* rare case of legitimate dget_parent()... */ 1276 nd->path.dentry = dget_parent(nd->path.dentry); 1277 dput(old); 1278 break; 1279 } 1280 if (!follow_up(&nd->path)) 1281 break; 1282 } 1283 follow_mount(&nd->path); 1284 nd->inode = nd->path.dentry->d_inode; 1285 } 1286 1287 /* 1288 * This looks up the name in dcache, possibly revalidates the old dentry and 1289 * allocates a new one if not found or not valid. In the need_lookup argument 1290 * returns whether i_op->lookup is necessary. 1291 * 1292 * dir->d_inode->i_mutex must be held 1293 */ 1294 static struct dentry *lookup_dcache(struct qstr *name, struct dentry *dir, 1295 unsigned int flags, bool *need_lookup) 1296 { 1297 struct dentry *dentry; 1298 int error; 1299 1300 *need_lookup = false; 1301 dentry = d_lookup(dir, name); 1302 if (dentry) { 1303 if (dentry->d_flags & DCACHE_OP_REVALIDATE) { 1304 error = d_revalidate(dentry, flags); 1305 if (unlikely(error <= 0)) { 1306 if (error < 0) { 1307 dput(dentry); 1308 return ERR_PTR(error); 1309 } else if (!d_invalidate(dentry)) { 1310 dput(dentry); 1311 dentry = NULL; 1312 } 1313 } 1314 } 1315 } 1316 1317 if (!dentry) { 1318 dentry = d_alloc(dir, name); 1319 if (unlikely(!dentry)) 1320 return ERR_PTR(-ENOMEM); 1321 1322 *need_lookup = true; 1323 } 1324 return dentry; 1325 } 1326 1327 /* 1328 * Call i_op->lookup on the dentry. The dentry must be negative and 1329 * unhashed. 1330 * 1331 * dir->d_inode->i_mutex must be held 1332 */ 1333 static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry, 1334 unsigned int flags) 1335 { 1336 struct dentry *old; 1337 1338 /* Don't create child dentry for a dead directory. */ 1339 if (unlikely(IS_DEADDIR(dir))) { 1340 dput(dentry); 1341 return ERR_PTR(-ENOENT); 1342 } 1343 1344 old = dir->i_op->lookup(dir, dentry, flags); 1345 if (unlikely(old)) { 1346 dput(dentry); 1347 dentry = old; 1348 } 1349 return dentry; 1350 } 1351 1352 static struct dentry *__lookup_hash(struct qstr *name, 1353 struct dentry *base, unsigned int flags) 1354 { 1355 bool need_lookup; 1356 struct dentry *dentry; 1357 1358 dentry = lookup_dcache(name, base, flags, &need_lookup); 1359 if (!need_lookup) 1360 return dentry; 1361 1362 return lookup_real(base->d_inode, dentry, flags); 1363 } 1364 1365 /* 1366 * It's more convoluted than I'd like it to be, but... it's still fairly 1367 * small and for now I'd prefer to have fast path as straight as possible. 1368 * It _is_ time-critical. 1369 */ 1370 static int lookup_fast(struct nameidata *nd, 1371 struct path *path, struct inode **inode) 1372 { 1373 struct vfsmount *mnt = nd->path.mnt; 1374 struct dentry *dentry, *parent = nd->path.dentry; 1375 int need_reval = 1; 1376 int status = 1; 1377 int err; 1378 1379 /* 1380 * Rename seqlock is not required here because in the off chance 1381 * of a false negative due to a concurrent rename, we're going to 1382 * do the non-racy lookup, below. 1383 */ 1384 if (nd->flags & LOOKUP_RCU) { 1385 unsigned seq; 1386 dentry = __d_lookup_rcu(parent, &nd->last, &seq); 1387 if (!dentry) 1388 goto unlazy; 1389 1390 /* 1391 * This sequence count validates that the inode matches 1392 * the dentry name information from lookup. 1393 */ 1394 *inode = dentry->d_inode; 1395 if (read_seqcount_retry(&dentry->d_seq, seq)) 1396 return -ECHILD; 1397 1398 /* 1399 * This sequence count validates that the parent had no 1400 * changes while we did the lookup of the dentry above. 1401 * 1402 * The memory barrier in read_seqcount_begin of child is 1403 * enough, we can use __read_seqcount_retry here. 1404 */ 1405 if (__read_seqcount_retry(&parent->d_seq, nd->seq)) 1406 return -ECHILD; 1407 nd->seq = seq; 1408 1409 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) { 1410 status = d_revalidate(dentry, nd->flags); 1411 if (unlikely(status <= 0)) { 1412 if (status != -ECHILD) 1413 need_reval = 0; 1414 goto unlazy; 1415 } 1416 } 1417 path->mnt = mnt; 1418 path->dentry = dentry; 1419 if (likely(__follow_mount_rcu(nd, path, inode))) 1420 return 0; 1421 unlazy: 1422 if (unlazy_walk(nd, dentry)) 1423 return -ECHILD; 1424 } else { 1425 dentry = __d_lookup(parent, &nd->last); 1426 } 1427 1428 if (unlikely(!dentry)) 1429 goto need_lookup; 1430 1431 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval) 1432 status = d_revalidate(dentry, nd->flags); 1433 if (unlikely(status <= 0)) { 1434 if (status < 0) { 1435 dput(dentry); 1436 return status; 1437 } 1438 if (!d_invalidate(dentry)) { 1439 dput(dentry); 1440 goto need_lookup; 1441 } 1442 } 1443 1444 path->mnt = mnt; 1445 path->dentry = dentry; 1446 err = follow_managed(path, nd->flags); 1447 if (unlikely(err < 0)) { 1448 path_put_conditional(path, nd); 1449 return err; 1450 } 1451 if (err) 1452 nd->flags |= LOOKUP_JUMPED; 1453 *inode = path->dentry->d_inode; 1454 return 0; 1455 1456 need_lookup: 1457 return 1; 1458 } 1459 1460 /* Fast lookup failed, do it the slow way */ 1461 static int lookup_slow(struct nameidata *nd, struct path *path) 1462 { 1463 struct dentry *dentry, *parent; 1464 int err; 1465 1466 parent = nd->path.dentry; 1467 BUG_ON(nd->inode != parent->d_inode); 1468 1469 mutex_lock(&parent->d_inode->i_mutex); 1470 dentry = __lookup_hash(&nd->last, parent, nd->flags); 1471 mutex_unlock(&parent->d_inode->i_mutex); 1472 if (IS_ERR(dentry)) 1473 return PTR_ERR(dentry); 1474 path->mnt = nd->path.mnt; 1475 path->dentry = dentry; 1476 err = follow_managed(path, nd->flags); 1477 if (unlikely(err < 0)) { 1478 path_put_conditional(path, nd); 1479 return err; 1480 } 1481 if (err) 1482 nd->flags |= LOOKUP_JUMPED; 1483 return 0; 1484 } 1485 1486 static inline int may_lookup(struct nameidata *nd) 1487 { 1488 if (nd->flags & LOOKUP_RCU) { 1489 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK); 1490 if (err != -ECHILD) 1491 return err; 1492 if (unlazy_walk(nd, NULL)) 1493 return -ECHILD; 1494 } 1495 return inode_permission(nd->inode, MAY_EXEC); 1496 } 1497 1498 static inline int handle_dots(struct nameidata *nd, int type) 1499 { 1500 if (type == LAST_DOTDOT) { 1501 if (nd->flags & LOOKUP_RCU) { 1502 if (follow_dotdot_rcu(nd)) 1503 return -ECHILD; 1504 } else 1505 follow_dotdot(nd); 1506 } 1507 return 0; 1508 } 1509 1510 static void terminate_walk(struct nameidata *nd) 1511 { 1512 if (!(nd->flags & LOOKUP_RCU)) { 1513 path_put(&nd->path); 1514 } else { 1515 nd->flags &= ~LOOKUP_RCU; 1516 if (!(nd->flags & LOOKUP_ROOT)) 1517 nd->root.mnt = NULL; 1518 rcu_read_unlock(); 1519 } 1520 } 1521 1522 /* 1523 * Do we need to follow links? We _really_ want to be able 1524 * to do this check without having to look at inode->i_op, 1525 * so we keep a cache of "no, this doesn't need follow_link" 1526 * for the common case. 1527 */ 1528 static inline int should_follow_link(struct dentry *dentry, int follow) 1529 { 1530 return unlikely(d_is_symlink(dentry)) ? follow : 0; 1531 } 1532 1533 static inline int walk_component(struct nameidata *nd, struct path *path, 1534 int follow) 1535 { 1536 struct inode *inode; 1537 int err; 1538 /* 1539 * "." and ".." are special - ".." especially so because it has 1540 * to be able to know about the current root directory and 1541 * parent relationships. 1542 */ 1543 if (unlikely(nd->last_type != LAST_NORM)) 1544 return handle_dots(nd, nd->last_type); 1545 err = lookup_fast(nd, path, &inode); 1546 if (unlikely(err)) { 1547 if (err < 0) 1548 goto out_err; 1549 1550 err = lookup_slow(nd, path); 1551 if (err < 0) 1552 goto out_err; 1553 1554 inode = path->dentry->d_inode; 1555 } 1556 err = -ENOENT; 1557 if (!inode || d_is_negative(path->dentry)) 1558 goto out_path_put; 1559 1560 if (should_follow_link(path->dentry, follow)) { 1561 if (nd->flags & LOOKUP_RCU) { 1562 if (unlikely(unlazy_walk(nd, path->dentry))) { 1563 err = -ECHILD; 1564 goto out_err; 1565 } 1566 } 1567 BUG_ON(inode != path->dentry->d_inode); 1568 return 1; 1569 } 1570 path_to_nameidata(path, nd); 1571 nd->inode = inode; 1572 return 0; 1573 1574 out_path_put: 1575 path_to_nameidata(path, nd); 1576 out_err: 1577 terminate_walk(nd); 1578 return err; 1579 } 1580 1581 /* 1582 * This limits recursive symlink follows to 8, while 1583 * limiting consecutive symlinks to 40. 1584 * 1585 * Without that kind of total limit, nasty chains of consecutive 1586 * symlinks can cause almost arbitrarily long lookups. 1587 */ 1588 static inline int nested_symlink(struct path *path, struct nameidata *nd) 1589 { 1590 int res; 1591 1592 if (unlikely(current->link_count >= MAX_NESTED_LINKS)) { 1593 path_put_conditional(path, nd); 1594 path_put(&nd->path); 1595 return -ELOOP; 1596 } 1597 BUG_ON(nd->depth >= MAX_NESTED_LINKS); 1598 1599 nd->depth++; 1600 current->link_count++; 1601 1602 do { 1603 struct path link = *path; 1604 void *cookie; 1605 1606 res = follow_link(&link, nd, &cookie); 1607 if (res) 1608 break; 1609 res = walk_component(nd, path, LOOKUP_FOLLOW); 1610 put_link(nd, &link, cookie); 1611 } while (res > 0); 1612 1613 current->link_count--; 1614 nd->depth--; 1615 return res; 1616 } 1617 1618 /* 1619 * We can do the critical dentry name comparison and hashing 1620 * operations one word at a time, but we are limited to: 1621 * 1622 * - Architectures with fast unaligned word accesses. We could 1623 * do a "get_unaligned()" if this helps and is sufficiently 1624 * fast. 1625 * 1626 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we 1627 * do not trap on the (extremely unlikely) case of a page 1628 * crossing operation. 1629 * 1630 * - Furthermore, we need an efficient 64-bit compile for the 1631 * 64-bit case in order to generate the "number of bytes in 1632 * the final mask". Again, that could be replaced with a 1633 * efficient population count instruction or similar. 1634 */ 1635 #ifdef CONFIG_DCACHE_WORD_ACCESS 1636 1637 #include <asm/word-at-a-time.h> 1638 1639 #ifdef CONFIG_64BIT 1640 1641 static inline unsigned int fold_hash(unsigned long hash) 1642 { 1643 return hash_64(hash, 32); 1644 } 1645 1646 #else /* 32-bit case */ 1647 1648 #define fold_hash(x) (x) 1649 1650 #endif 1651 1652 unsigned int full_name_hash(const unsigned char *name, unsigned int len) 1653 { 1654 unsigned long a, mask; 1655 unsigned long hash = 0; 1656 1657 for (;;) { 1658 a = load_unaligned_zeropad(name); 1659 if (len < sizeof(unsigned long)) 1660 break; 1661 hash += a; 1662 hash *= 9; 1663 name += sizeof(unsigned long); 1664 len -= sizeof(unsigned long); 1665 if (!len) 1666 goto done; 1667 } 1668 mask = bytemask_from_count(len); 1669 hash += mask & a; 1670 done: 1671 return fold_hash(hash); 1672 } 1673 EXPORT_SYMBOL(full_name_hash); 1674 1675 /* 1676 * Calculate the length and hash of the path component, and 1677 * return the "hash_len" as the result. 1678 */ 1679 static inline u64 hash_name(const char *name) 1680 { 1681 unsigned long a, b, adata, bdata, mask, hash, len; 1682 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 1683 1684 hash = a = 0; 1685 len = -sizeof(unsigned long); 1686 do { 1687 hash = (hash + a) * 9; 1688 len += sizeof(unsigned long); 1689 a = load_unaligned_zeropad(name+len); 1690 b = a ^ REPEAT_BYTE('/'); 1691 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants))); 1692 1693 adata = prep_zero_mask(a, adata, &constants); 1694 bdata = prep_zero_mask(b, bdata, &constants); 1695 1696 mask = create_zero_mask(adata | bdata); 1697 1698 hash += a & zero_bytemask(mask); 1699 len += find_zero(mask); 1700 return hashlen_create(fold_hash(hash), len); 1701 } 1702 1703 #else 1704 1705 unsigned int full_name_hash(const unsigned char *name, unsigned int len) 1706 { 1707 unsigned long hash = init_name_hash(); 1708 while (len--) 1709 hash = partial_name_hash(*name++, hash); 1710 return end_name_hash(hash); 1711 } 1712 EXPORT_SYMBOL(full_name_hash); 1713 1714 /* 1715 * We know there's a real path component here of at least 1716 * one character. 1717 */ 1718 static inline u64 hash_name(const char *name) 1719 { 1720 unsigned long hash = init_name_hash(); 1721 unsigned long len = 0, c; 1722 1723 c = (unsigned char)*name; 1724 do { 1725 len++; 1726 hash = partial_name_hash(c, hash); 1727 c = (unsigned char)name[len]; 1728 } while (c && c != '/'); 1729 return hashlen_create(end_name_hash(hash), len); 1730 } 1731 1732 #endif 1733 1734 /* 1735 * Name resolution. 1736 * This is the basic name resolution function, turning a pathname into 1737 * the final dentry. We expect 'base' to be positive and a directory. 1738 * 1739 * Returns 0 and nd will have valid dentry and mnt on success. 1740 * Returns error and drops reference to input namei data on failure. 1741 */ 1742 static int link_path_walk(const char *name, struct nameidata *nd) 1743 { 1744 struct path next; 1745 int err; 1746 1747 while (*name=='/') 1748 name++; 1749 if (!*name) 1750 return 0; 1751 1752 /* At this point we know we have a real path component. */ 1753 for(;;) { 1754 u64 hash_len; 1755 int type; 1756 1757 err = may_lookup(nd); 1758 if (err) 1759 break; 1760 1761 hash_len = hash_name(name); 1762 1763 type = LAST_NORM; 1764 if (name[0] == '.') switch (hashlen_len(hash_len)) { 1765 case 2: 1766 if (name[1] == '.') { 1767 type = LAST_DOTDOT; 1768 nd->flags |= LOOKUP_JUMPED; 1769 } 1770 break; 1771 case 1: 1772 type = LAST_DOT; 1773 } 1774 if (likely(type == LAST_NORM)) { 1775 struct dentry *parent = nd->path.dentry; 1776 nd->flags &= ~LOOKUP_JUMPED; 1777 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { 1778 struct qstr this = { { .hash_len = hash_len }, .name = name }; 1779 err = parent->d_op->d_hash(parent, &this); 1780 if (err < 0) 1781 break; 1782 hash_len = this.hash_len; 1783 name = this.name; 1784 } 1785 } 1786 1787 nd->last.hash_len = hash_len; 1788 nd->last.name = name; 1789 nd->last_type = type; 1790 1791 name += hashlen_len(hash_len); 1792 if (!*name) 1793 return 0; 1794 /* 1795 * If it wasn't NUL, we know it was '/'. Skip that 1796 * slash, and continue until no more slashes. 1797 */ 1798 do { 1799 name++; 1800 } while (unlikely(*name == '/')); 1801 if (!*name) 1802 return 0; 1803 1804 err = walk_component(nd, &next, LOOKUP_FOLLOW); 1805 if (err < 0) 1806 return err; 1807 1808 if (err) { 1809 err = nested_symlink(&next, nd); 1810 if (err) 1811 return err; 1812 } 1813 if (!d_can_lookup(nd->path.dentry)) { 1814 err = -ENOTDIR; 1815 break; 1816 } 1817 } 1818 terminate_walk(nd); 1819 return err; 1820 } 1821 1822 static int path_init(int dfd, const char *name, unsigned int flags, 1823 struct nameidata *nd, struct file **fp) 1824 { 1825 int retval = 0; 1826 1827 nd->last_type = LAST_ROOT; /* if there are only slashes... */ 1828 nd->flags = flags | LOOKUP_JUMPED; 1829 nd->depth = 0; 1830 if (flags & LOOKUP_ROOT) { 1831 struct dentry *root = nd->root.dentry; 1832 struct inode *inode = root->d_inode; 1833 if (*name) { 1834 if (!d_can_lookup(root)) 1835 return -ENOTDIR; 1836 retval = inode_permission(inode, MAY_EXEC); 1837 if (retval) 1838 return retval; 1839 } 1840 nd->path = nd->root; 1841 nd->inode = inode; 1842 if (flags & LOOKUP_RCU) { 1843 rcu_read_lock(); 1844 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1845 nd->m_seq = read_seqbegin(&mount_lock); 1846 } else { 1847 path_get(&nd->path); 1848 } 1849 return 0; 1850 } 1851 1852 nd->root.mnt = NULL; 1853 1854 nd->m_seq = read_seqbegin(&mount_lock); 1855 if (*name=='/') { 1856 if (flags & LOOKUP_RCU) { 1857 rcu_read_lock(); 1858 nd->seq = set_root_rcu(nd); 1859 } else { 1860 set_root(nd); 1861 path_get(&nd->root); 1862 } 1863 nd->path = nd->root; 1864 } else if (dfd == AT_FDCWD) { 1865 if (flags & LOOKUP_RCU) { 1866 struct fs_struct *fs = current->fs; 1867 unsigned seq; 1868 1869 rcu_read_lock(); 1870 1871 do { 1872 seq = read_seqcount_begin(&fs->seq); 1873 nd->path = fs->pwd; 1874 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1875 } while (read_seqcount_retry(&fs->seq, seq)); 1876 } else { 1877 get_fs_pwd(current->fs, &nd->path); 1878 } 1879 } else { 1880 /* Caller must check execute permissions on the starting path component */ 1881 struct fd f = fdget_raw(dfd); 1882 struct dentry *dentry; 1883 1884 if (!f.file) 1885 return -EBADF; 1886 1887 dentry = f.file->f_path.dentry; 1888 1889 if (*name) { 1890 if (!d_can_lookup(dentry)) { 1891 fdput(f); 1892 return -ENOTDIR; 1893 } 1894 } 1895 1896 nd->path = f.file->f_path; 1897 if (flags & LOOKUP_RCU) { 1898 if (f.flags & FDPUT_FPUT) 1899 *fp = f.file; 1900 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1901 rcu_read_lock(); 1902 } else { 1903 path_get(&nd->path); 1904 fdput(f); 1905 } 1906 } 1907 1908 nd->inode = nd->path.dentry->d_inode; 1909 if (!(flags & LOOKUP_RCU)) 1910 return 0; 1911 if (likely(!read_seqcount_retry(&nd->path.dentry->d_seq, nd->seq))) 1912 return 0; 1913 if (!(nd->flags & LOOKUP_ROOT)) 1914 nd->root.mnt = NULL; 1915 rcu_read_unlock(); 1916 return -ECHILD; 1917 } 1918 1919 static inline int lookup_last(struct nameidata *nd, struct path *path) 1920 { 1921 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len]) 1922 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 1923 1924 nd->flags &= ~LOOKUP_PARENT; 1925 return walk_component(nd, path, nd->flags & LOOKUP_FOLLOW); 1926 } 1927 1928 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 1929 static int path_lookupat(int dfd, const char *name, 1930 unsigned int flags, struct nameidata *nd) 1931 { 1932 struct file *base = NULL; 1933 struct path path; 1934 int err; 1935 1936 /* 1937 * Path walking is largely split up into 2 different synchronisation 1938 * schemes, rcu-walk and ref-walk (explained in 1939 * Documentation/filesystems/path-lookup.txt). These share much of the 1940 * path walk code, but some things particularly setup, cleanup, and 1941 * following mounts are sufficiently divergent that functions are 1942 * duplicated. Typically there is a function foo(), and its RCU 1943 * analogue, foo_rcu(). 1944 * 1945 * -ECHILD is the error number of choice (just to avoid clashes) that 1946 * is returned if some aspect of an rcu-walk fails. Such an error must 1947 * be handled by restarting a traditional ref-walk (which will always 1948 * be able to complete). 1949 */ 1950 err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base); 1951 1952 if (unlikely(err)) 1953 return err; 1954 1955 current->total_link_count = 0; 1956 err = link_path_walk(name, nd); 1957 1958 if (!err && !(flags & LOOKUP_PARENT)) { 1959 err = lookup_last(nd, &path); 1960 while (err > 0) { 1961 void *cookie; 1962 struct path link = path; 1963 err = may_follow_link(&link, nd); 1964 if (unlikely(err)) 1965 break; 1966 nd->flags |= LOOKUP_PARENT; 1967 err = follow_link(&link, nd, &cookie); 1968 if (err) 1969 break; 1970 err = lookup_last(nd, &path); 1971 put_link(nd, &link, cookie); 1972 } 1973 } 1974 1975 if (!err) 1976 err = complete_walk(nd); 1977 1978 if (!err && nd->flags & LOOKUP_DIRECTORY) { 1979 if (!d_can_lookup(nd->path.dentry)) { 1980 path_put(&nd->path); 1981 err = -ENOTDIR; 1982 } 1983 } 1984 1985 if (base) 1986 fput(base); 1987 1988 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 1989 path_put(&nd->root); 1990 nd->root.mnt = NULL; 1991 } 1992 return err; 1993 } 1994 1995 static int filename_lookup(int dfd, struct filename *name, 1996 unsigned int flags, struct nameidata *nd) 1997 { 1998 int retval = path_lookupat(dfd, name->name, flags | LOOKUP_RCU, nd); 1999 if (unlikely(retval == -ECHILD)) 2000 retval = path_lookupat(dfd, name->name, flags, nd); 2001 if (unlikely(retval == -ESTALE)) 2002 retval = path_lookupat(dfd, name->name, 2003 flags | LOOKUP_REVAL, nd); 2004 2005 if (likely(!retval)) 2006 audit_inode(name, nd->path.dentry, flags & LOOKUP_PARENT); 2007 return retval; 2008 } 2009 2010 static int do_path_lookup(int dfd, const char *name, 2011 unsigned int flags, struct nameidata *nd) 2012 { 2013 struct filename filename = { .name = name }; 2014 2015 return filename_lookup(dfd, &filename, flags, nd); 2016 } 2017 2018 /* does lookup, returns the object with parent locked */ 2019 struct dentry *kern_path_locked(const char *name, struct path *path) 2020 { 2021 struct nameidata nd; 2022 struct dentry *d; 2023 int err = do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, &nd); 2024 if (err) 2025 return ERR_PTR(err); 2026 if (nd.last_type != LAST_NORM) { 2027 path_put(&nd.path); 2028 return ERR_PTR(-EINVAL); 2029 } 2030 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 2031 d = __lookup_hash(&nd.last, nd.path.dentry, 0); 2032 if (IS_ERR(d)) { 2033 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 2034 path_put(&nd.path); 2035 return d; 2036 } 2037 *path = nd.path; 2038 return d; 2039 } 2040 2041 int kern_path(const char *name, unsigned int flags, struct path *path) 2042 { 2043 struct nameidata nd; 2044 int res = do_path_lookup(AT_FDCWD, name, flags, &nd); 2045 if (!res) 2046 *path = nd.path; 2047 return res; 2048 } 2049 EXPORT_SYMBOL(kern_path); 2050 2051 /** 2052 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair 2053 * @dentry: pointer to dentry of the base directory 2054 * @mnt: pointer to vfs mount of the base directory 2055 * @name: pointer to file name 2056 * @flags: lookup flags 2057 * @path: pointer to struct path to fill 2058 */ 2059 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, 2060 const char *name, unsigned int flags, 2061 struct path *path) 2062 { 2063 struct nameidata nd; 2064 int err; 2065 nd.root.dentry = dentry; 2066 nd.root.mnt = mnt; 2067 BUG_ON(flags & LOOKUP_PARENT); 2068 /* the first argument of do_path_lookup() is ignored with LOOKUP_ROOT */ 2069 err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd); 2070 if (!err) 2071 *path = nd.path; 2072 return err; 2073 } 2074 EXPORT_SYMBOL(vfs_path_lookup); 2075 2076 /* 2077 * Restricted form of lookup. Doesn't follow links, single-component only, 2078 * needs parent already locked. Doesn't follow mounts. 2079 * SMP-safe. 2080 */ 2081 static struct dentry *lookup_hash(struct nameidata *nd) 2082 { 2083 return __lookup_hash(&nd->last, nd->path.dentry, nd->flags); 2084 } 2085 2086 /** 2087 * lookup_one_len - filesystem helper to lookup single pathname component 2088 * @name: pathname component to lookup 2089 * @base: base directory to lookup from 2090 * @len: maximum length @len should be interpreted to 2091 * 2092 * Note that this routine is purely a helper for filesystem usage and should 2093 * not be called by generic code. Also note that by using this function the 2094 * nameidata argument is passed to the filesystem methods and a filesystem 2095 * using this helper needs to be prepared for that. 2096 */ 2097 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len) 2098 { 2099 struct qstr this; 2100 unsigned int c; 2101 int err; 2102 2103 WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex)); 2104 2105 this.name = name; 2106 this.len = len; 2107 this.hash = full_name_hash(name, len); 2108 if (!len) 2109 return ERR_PTR(-EACCES); 2110 2111 if (unlikely(name[0] == '.')) { 2112 if (len < 2 || (len == 2 && name[1] == '.')) 2113 return ERR_PTR(-EACCES); 2114 } 2115 2116 while (len--) { 2117 c = *(const unsigned char *)name++; 2118 if (c == '/' || c == '\0') 2119 return ERR_PTR(-EACCES); 2120 } 2121 /* 2122 * See if the low-level filesystem might want 2123 * to use its own hash.. 2124 */ 2125 if (base->d_flags & DCACHE_OP_HASH) { 2126 int err = base->d_op->d_hash(base, &this); 2127 if (err < 0) 2128 return ERR_PTR(err); 2129 } 2130 2131 err = inode_permission(base->d_inode, MAY_EXEC); 2132 if (err) 2133 return ERR_PTR(err); 2134 2135 return __lookup_hash(&this, base, 0); 2136 } 2137 EXPORT_SYMBOL(lookup_one_len); 2138 2139 int user_path_at_empty(int dfd, const char __user *name, unsigned flags, 2140 struct path *path, int *empty) 2141 { 2142 struct nameidata nd; 2143 struct filename *tmp = getname_flags(name, flags, empty); 2144 int err = PTR_ERR(tmp); 2145 if (!IS_ERR(tmp)) { 2146 2147 BUG_ON(flags & LOOKUP_PARENT); 2148 2149 err = filename_lookup(dfd, tmp, flags, &nd); 2150 putname(tmp); 2151 if (!err) 2152 *path = nd.path; 2153 } 2154 return err; 2155 } 2156 2157 int user_path_at(int dfd, const char __user *name, unsigned flags, 2158 struct path *path) 2159 { 2160 return user_path_at_empty(dfd, name, flags, path, NULL); 2161 } 2162 EXPORT_SYMBOL(user_path_at); 2163 2164 /* 2165 * NB: most callers don't do anything directly with the reference to the 2166 * to struct filename, but the nd->last pointer points into the name string 2167 * allocated by getname. So we must hold the reference to it until all 2168 * path-walking is complete. 2169 */ 2170 static struct filename * 2171 user_path_parent(int dfd, const char __user *path, struct nameidata *nd, 2172 unsigned int flags) 2173 { 2174 struct filename *s = getname(path); 2175 int error; 2176 2177 /* only LOOKUP_REVAL is allowed in extra flags */ 2178 flags &= LOOKUP_REVAL; 2179 2180 if (IS_ERR(s)) 2181 return s; 2182 2183 error = filename_lookup(dfd, s, flags | LOOKUP_PARENT, nd); 2184 if (error) { 2185 putname(s); 2186 return ERR_PTR(error); 2187 } 2188 2189 return s; 2190 } 2191 2192 /** 2193 * mountpoint_last - look up last component for umount 2194 * @nd: pathwalk nameidata - currently pointing at parent directory of "last" 2195 * @path: pointer to container for result 2196 * 2197 * This is a special lookup_last function just for umount. In this case, we 2198 * need to resolve the path without doing any revalidation. 2199 * 2200 * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since 2201 * mountpoints are always pinned in the dcache, their ancestors are too. Thus, 2202 * in almost all cases, this lookup will be served out of the dcache. The only 2203 * cases where it won't are if nd->last refers to a symlink or the path is 2204 * bogus and it doesn't exist. 2205 * 2206 * Returns: 2207 * -error: if there was an error during lookup. This includes -ENOENT if the 2208 * lookup found a negative dentry. The nd->path reference will also be 2209 * put in this case. 2210 * 2211 * 0: if we successfully resolved nd->path and found it to not to be a 2212 * symlink that needs to be followed. "path" will also be populated. 2213 * The nd->path reference will also be put. 2214 * 2215 * 1: if we successfully resolved nd->last and found it to be a symlink 2216 * that needs to be followed. "path" will be populated with the path 2217 * to the link, and nd->path will *not* be put. 2218 */ 2219 static int 2220 mountpoint_last(struct nameidata *nd, struct path *path) 2221 { 2222 int error = 0; 2223 struct dentry *dentry; 2224 struct dentry *dir = nd->path.dentry; 2225 2226 /* If we're in rcuwalk, drop out of it to handle last component */ 2227 if (nd->flags & LOOKUP_RCU) { 2228 if (unlazy_walk(nd, NULL)) { 2229 error = -ECHILD; 2230 goto out; 2231 } 2232 } 2233 2234 nd->flags &= ~LOOKUP_PARENT; 2235 2236 if (unlikely(nd->last_type != LAST_NORM)) { 2237 error = handle_dots(nd, nd->last_type); 2238 if (error) 2239 goto out; 2240 dentry = dget(nd->path.dentry); 2241 goto done; 2242 } 2243 2244 mutex_lock(&dir->d_inode->i_mutex); 2245 dentry = d_lookup(dir, &nd->last); 2246 if (!dentry) { 2247 /* 2248 * No cached dentry. Mounted dentries are pinned in the cache, 2249 * so that means that this dentry is probably a symlink or the 2250 * path doesn't actually point to a mounted dentry. 2251 */ 2252 dentry = d_alloc(dir, &nd->last); 2253 if (!dentry) { 2254 error = -ENOMEM; 2255 mutex_unlock(&dir->d_inode->i_mutex); 2256 goto out; 2257 } 2258 dentry = lookup_real(dir->d_inode, dentry, nd->flags); 2259 error = PTR_ERR(dentry); 2260 if (IS_ERR(dentry)) { 2261 mutex_unlock(&dir->d_inode->i_mutex); 2262 goto out; 2263 } 2264 } 2265 mutex_unlock(&dir->d_inode->i_mutex); 2266 2267 done: 2268 if (!dentry->d_inode || d_is_negative(dentry)) { 2269 error = -ENOENT; 2270 dput(dentry); 2271 goto out; 2272 } 2273 path->dentry = dentry; 2274 path->mnt = nd->path.mnt; 2275 if (should_follow_link(dentry, nd->flags & LOOKUP_FOLLOW)) 2276 return 1; 2277 mntget(path->mnt); 2278 follow_mount(path); 2279 error = 0; 2280 out: 2281 terminate_walk(nd); 2282 return error; 2283 } 2284 2285 /** 2286 * path_mountpoint - look up a path to be umounted 2287 * @dfd: directory file descriptor to start walk from 2288 * @name: full pathname to walk 2289 * @path: pointer to container for result 2290 * @flags: lookup flags 2291 * 2292 * Look up the given name, but don't attempt to revalidate the last component. 2293 * Returns 0 and "path" will be valid on success; Returns error otherwise. 2294 */ 2295 static int 2296 path_mountpoint(int dfd, const char *name, struct path *path, unsigned int flags) 2297 { 2298 struct file *base = NULL; 2299 struct nameidata nd; 2300 int err; 2301 2302 err = path_init(dfd, name, flags | LOOKUP_PARENT, &nd, &base); 2303 if (unlikely(err)) 2304 return err; 2305 2306 current->total_link_count = 0; 2307 err = link_path_walk(name, &nd); 2308 if (err) 2309 goto out; 2310 2311 err = mountpoint_last(&nd, path); 2312 while (err > 0) { 2313 void *cookie; 2314 struct path link = *path; 2315 err = may_follow_link(&link, &nd); 2316 if (unlikely(err)) 2317 break; 2318 nd.flags |= LOOKUP_PARENT; 2319 err = follow_link(&link, &nd, &cookie); 2320 if (err) 2321 break; 2322 err = mountpoint_last(&nd, path); 2323 put_link(&nd, &link, cookie); 2324 } 2325 out: 2326 if (base) 2327 fput(base); 2328 2329 if (nd.root.mnt && !(nd.flags & LOOKUP_ROOT)) 2330 path_put(&nd.root); 2331 2332 return err; 2333 } 2334 2335 static int 2336 filename_mountpoint(int dfd, struct filename *s, struct path *path, 2337 unsigned int flags) 2338 { 2339 int error = path_mountpoint(dfd, s->name, path, flags | LOOKUP_RCU); 2340 if (unlikely(error == -ECHILD)) 2341 error = path_mountpoint(dfd, s->name, path, flags); 2342 if (unlikely(error == -ESTALE)) 2343 error = path_mountpoint(dfd, s->name, path, flags | LOOKUP_REVAL); 2344 if (likely(!error)) 2345 audit_inode(s, path->dentry, 0); 2346 return error; 2347 } 2348 2349 /** 2350 * user_path_mountpoint_at - lookup a path from userland in order to umount it 2351 * @dfd: directory file descriptor 2352 * @name: pathname from userland 2353 * @flags: lookup flags 2354 * @path: pointer to container to hold result 2355 * 2356 * A umount is a special case for path walking. We're not actually interested 2357 * in the inode in this situation, and ESTALE errors can be a problem. We 2358 * simply want track down the dentry and vfsmount attached at the mountpoint 2359 * and avoid revalidating the last component. 2360 * 2361 * Returns 0 and populates "path" on success. 2362 */ 2363 int 2364 user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags, 2365 struct path *path) 2366 { 2367 struct filename *s = getname(name); 2368 int error; 2369 if (IS_ERR(s)) 2370 return PTR_ERR(s); 2371 error = filename_mountpoint(dfd, s, path, flags); 2372 putname(s); 2373 return error; 2374 } 2375 2376 int 2377 kern_path_mountpoint(int dfd, const char *name, struct path *path, 2378 unsigned int flags) 2379 { 2380 struct filename s = {.name = name}; 2381 return filename_mountpoint(dfd, &s, path, flags); 2382 } 2383 EXPORT_SYMBOL(kern_path_mountpoint); 2384 2385 /* 2386 * It's inline, so penalty for filesystems that don't use sticky bit is 2387 * minimal. 2388 */ 2389 static inline int check_sticky(struct inode *dir, struct inode *inode) 2390 { 2391 kuid_t fsuid = current_fsuid(); 2392 2393 if (!(dir->i_mode & S_ISVTX)) 2394 return 0; 2395 if (uid_eq(inode->i_uid, fsuid)) 2396 return 0; 2397 if (uid_eq(dir->i_uid, fsuid)) 2398 return 0; 2399 return !capable_wrt_inode_uidgid(inode, CAP_FOWNER); 2400 } 2401 2402 /* 2403 * Check whether we can remove a link victim from directory dir, check 2404 * whether the type of victim is right. 2405 * 1. We can't do it if dir is read-only (done in permission()) 2406 * 2. We should have write and exec permissions on dir 2407 * 3. We can't remove anything from append-only dir 2408 * 4. We can't do anything with immutable dir (done in permission()) 2409 * 5. If the sticky bit on dir is set we should either 2410 * a. be owner of dir, or 2411 * b. be owner of victim, or 2412 * c. have CAP_FOWNER capability 2413 * 6. If the victim is append-only or immutable we can't do antyhing with 2414 * links pointing to it. 2415 * 7. If we were asked to remove a directory and victim isn't one - ENOTDIR. 2416 * 8. If we were asked to remove a non-directory and victim isn't one - EISDIR. 2417 * 9. We can't remove a root or mountpoint. 2418 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by 2419 * nfs_async_unlink(). 2420 */ 2421 static int may_delete(struct inode *dir, struct dentry *victim, bool isdir) 2422 { 2423 struct inode *inode = victim->d_inode; 2424 int error; 2425 2426 if (d_is_negative(victim)) 2427 return -ENOENT; 2428 BUG_ON(!inode); 2429 2430 BUG_ON(victim->d_parent->d_inode != dir); 2431 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE); 2432 2433 error = inode_permission(dir, MAY_WRITE | MAY_EXEC); 2434 if (error) 2435 return error; 2436 if (IS_APPEND(dir)) 2437 return -EPERM; 2438 2439 if (check_sticky(dir, inode) || IS_APPEND(inode) || 2440 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode)) 2441 return -EPERM; 2442 if (isdir) { 2443 if (!d_is_dir(victim)) 2444 return -ENOTDIR; 2445 if (IS_ROOT(victim)) 2446 return -EBUSY; 2447 } else if (d_is_dir(victim)) 2448 return -EISDIR; 2449 if (IS_DEADDIR(dir)) 2450 return -ENOENT; 2451 if (victim->d_flags & DCACHE_NFSFS_RENAMED) 2452 return -EBUSY; 2453 return 0; 2454 } 2455 2456 /* Check whether we can create an object with dentry child in directory 2457 * dir. 2458 * 1. We can't do it if child already exists (open has special treatment for 2459 * this case, but since we are inlined it's OK) 2460 * 2. We can't do it if dir is read-only (done in permission()) 2461 * 3. We should have write and exec permissions on dir 2462 * 4. We can't do it if dir is immutable (done in permission()) 2463 */ 2464 static inline int may_create(struct inode *dir, struct dentry *child) 2465 { 2466 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE); 2467 if (child->d_inode) 2468 return -EEXIST; 2469 if (IS_DEADDIR(dir)) 2470 return -ENOENT; 2471 return inode_permission(dir, MAY_WRITE | MAY_EXEC); 2472 } 2473 2474 /* 2475 * p1 and p2 should be directories on the same fs. 2476 */ 2477 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) 2478 { 2479 struct dentry *p; 2480 2481 if (p1 == p2) { 2482 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2483 return NULL; 2484 } 2485 2486 mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 2487 2488 p = d_ancestor(p2, p1); 2489 if (p) { 2490 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT); 2491 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD); 2492 return p; 2493 } 2494 2495 p = d_ancestor(p1, p2); 2496 if (p) { 2497 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2498 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 2499 return p; 2500 } 2501 2502 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2503 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 2504 return NULL; 2505 } 2506 EXPORT_SYMBOL(lock_rename); 2507 2508 void unlock_rename(struct dentry *p1, struct dentry *p2) 2509 { 2510 mutex_unlock(&p1->d_inode->i_mutex); 2511 if (p1 != p2) { 2512 mutex_unlock(&p2->d_inode->i_mutex); 2513 mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 2514 } 2515 } 2516 EXPORT_SYMBOL(unlock_rename); 2517 2518 int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, 2519 bool want_excl) 2520 { 2521 int error = may_create(dir, dentry); 2522 if (error) 2523 return error; 2524 2525 if (!dir->i_op->create) 2526 return -EACCES; /* shouldn't it be ENOSYS? */ 2527 mode &= S_IALLUGO; 2528 mode |= S_IFREG; 2529 error = security_inode_create(dir, dentry, mode); 2530 if (error) 2531 return error; 2532 error = dir->i_op->create(dir, dentry, mode, want_excl); 2533 if (!error) 2534 fsnotify_create(dir, dentry); 2535 return error; 2536 } 2537 EXPORT_SYMBOL(vfs_create); 2538 2539 static int may_open(struct path *path, int acc_mode, int flag) 2540 { 2541 struct dentry *dentry = path->dentry; 2542 struct inode *inode = dentry->d_inode; 2543 int error; 2544 2545 /* O_PATH? */ 2546 if (!acc_mode) 2547 return 0; 2548 2549 if (!inode) 2550 return -ENOENT; 2551 2552 switch (inode->i_mode & S_IFMT) { 2553 case S_IFLNK: 2554 return -ELOOP; 2555 case S_IFDIR: 2556 if (acc_mode & MAY_WRITE) 2557 return -EISDIR; 2558 break; 2559 case S_IFBLK: 2560 case S_IFCHR: 2561 if (path->mnt->mnt_flags & MNT_NODEV) 2562 return -EACCES; 2563 /*FALLTHRU*/ 2564 case S_IFIFO: 2565 case S_IFSOCK: 2566 flag &= ~O_TRUNC; 2567 break; 2568 } 2569 2570 error = inode_permission(inode, acc_mode); 2571 if (error) 2572 return error; 2573 2574 /* 2575 * An append-only file must be opened in append mode for writing. 2576 */ 2577 if (IS_APPEND(inode)) { 2578 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND)) 2579 return -EPERM; 2580 if (flag & O_TRUNC) 2581 return -EPERM; 2582 } 2583 2584 /* O_NOATIME can only be set by the owner or superuser */ 2585 if (flag & O_NOATIME && !inode_owner_or_capable(inode)) 2586 return -EPERM; 2587 2588 return 0; 2589 } 2590 2591 static int handle_truncate(struct file *filp) 2592 { 2593 struct path *path = &filp->f_path; 2594 struct inode *inode = path->dentry->d_inode; 2595 int error = get_write_access(inode); 2596 if (error) 2597 return error; 2598 /* 2599 * Refuse to truncate files with mandatory locks held on them. 2600 */ 2601 error = locks_verify_locked(filp); 2602 if (!error) 2603 error = security_path_truncate(path); 2604 if (!error) { 2605 error = do_truncate(path->dentry, 0, 2606 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN, 2607 filp); 2608 } 2609 put_write_access(inode); 2610 return error; 2611 } 2612 2613 static inline int open_to_namei_flags(int flag) 2614 { 2615 if ((flag & O_ACCMODE) == 3) 2616 flag--; 2617 return flag; 2618 } 2619 2620 static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode) 2621 { 2622 int error = security_path_mknod(dir, dentry, mode, 0); 2623 if (error) 2624 return error; 2625 2626 error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC); 2627 if (error) 2628 return error; 2629 2630 return security_inode_create(dir->dentry->d_inode, dentry, mode); 2631 } 2632 2633 /* 2634 * Attempt to atomically look up, create and open a file from a negative 2635 * dentry. 2636 * 2637 * Returns 0 if successful. The file will have been created and attached to 2638 * @file by the filesystem calling finish_open(). 2639 * 2640 * Returns 1 if the file was looked up only or didn't need creating. The 2641 * caller will need to perform the open themselves. @path will have been 2642 * updated to point to the new dentry. This may be negative. 2643 * 2644 * Returns an error code otherwise. 2645 */ 2646 static int atomic_open(struct nameidata *nd, struct dentry *dentry, 2647 struct path *path, struct file *file, 2648 const struct open_flags *op, 2649 bool got_write, bool need_lookup, 2650 int *opened) 2651 { 2652 struct inode *dir = nd->path.dentry->d_inode; 2653 unsigned open_flag = open_to_namei_flags(op->open_flag); 2654 umode_t mode; 2655 int error; 2656 int acc_mode; 2657 int create_error = 0; 2658 struct dentry *const DENTRY_NOT_SET = (void *) -1UL; 2659 bool excl; 2660 2661 BUG_ON(dentry->d_inode); 2662 2663 /* Don't create child dentry for a dead directory. */ 2664 if (unlikely(IS_DEADDIR(dir))) { 2665 error = -ENOENT; 2666 goto out; 2667 } 2668 2669 mode = op->mode; 2670 if ((open_flag & O_CREAT) && !IS_POSIXACL(dir)) 2671 mode &= ~current_umask(); 2672 2673 excl = (open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT); 2674 if (excl) 2675 open_flag &= ~O_TRUNC; 2676 2677 /* 2678 * Checking write permission is tricky, bacuse we don't know if we are 2679 * going to actually need it: O_CREAT opens should work as long as the 2680 * file exists. But checking existence breaks atomicity. The trick is 2681 * to check access and if not granted clear O_CREAT from the flags. 2682 * 2683 * Another problem is returing the "right" error value (e.g. for an 2684 * O_EXCL open we want to return EEXIST not EROFS). 2685 */ 2686 if (((open_flag & (O_CREAT | O_TRUNC)) || 2687 (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) { 2688 if (!(open_flag & O_CREAT)) { 2689 /* 2690 * No O_CREATE -> atomicity not a requirement -> fall 2691 * back to lookup + open 2692 */ 2693 goto no_open; 2694 } else if (open_flag & (O_EXCL | O_TRUNC)) { 2695 /* Fall back and fail with the right error */ 2696 create_error = -EROFS; 2697 goto no_open; 2698 } else { 2699 /* No side effects, safe to clear O_CREAT */ 2700 create_error = -EROFS; 2701 open_flag &= ~O_CREAT; 2702 } 2703 } 2704 2705 if (open_flag & O_CREAT) { 2706 error = may_o_create(&nd->path, dentry, mode); 2707 if (error) { 2708 create_error = error; 2709 if (open_flag & O_EXCL) 2710 goto no_open; 2711 open_flag &= ~O_CREAT; 2712 } 2713 } 2714 2715 if (nd->flags & LOOKUP_DIRECTORY) 2716 open_flag |= O_DIRECTORY; 2717 2718 file->f_path.dentry = DENTRY_NOT_SET; 2719 file->f_path.mnt = nd->path.mnt; 2720 error = dir->i_op->atomic_open(dir, dentry, file, open_flag, mode, 2721 opened); 2722 if (error < 0) { 2723 if (create_error && error == -ENOENT) 2724 error = create_error; 2725 goto out; 2726 } 2727 2728 if (error) { /* returned 1, that is */ 2729 if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) { 2730 error = -EIO; 2731 goto out; 2732 } 2733 if (file->f_path.dentry) { 2734 dput(dentry); 2735 dentry = file->f_path.dentry; 2736 } 2737 if (*opened & FILE_CREATED) 2738 fsnotify_create(dir, dentry); 2739 if (!dentry->d_inode) { 2740 WARN_ON(*opened & FILE_CREATED); 2741 if (create_error) { 2742 error = create_error; 2743 goto out; 2744 } 2745 } else { 2746 if (excl && !(*opened & FILE_CREATED)) { 2747 error = -EEXIST; 2748 goto out; 2749 } 2750 } 2751 goto looked_up; 2752 } 2753 2754 /* 2755 * We didn't have the inode before the open, so check open permission 2756 * here. 2757 */ 2758 acc_mode = op->acc_mode; 2759 if (*opened & FILE_CREATED) { 2760 WARN_ON(!(open_flag & O_CREAT)); 2761 fsnotify_create(dir, dentry); 2762 acc_mode = MAY_OPEN; 2763 } 2764 error = may_open(&file->f_path, acc_mode, open_flag); 2765 if (error) 2766 fput(file); 2767 2768 out: 2769 dput(dentry); 2770 return error; 2771 2772 no_open: 2773 if (need_lookup) { 2774 dentry = lookup_real(dir, dentry, nd->flags); 2775 if (IS_ERR(dentry)) 2776 return PTR_ERR(dentry); 2777 2778 if (create_error) { 2779 int open_flag = op->open_flag; 2780 2781 error = create_error; 2782 if ((open_flag & O_EXCL)) { 2783 if (!dentry->d_inode) 2784 goto out; 2785 } else if (!dentry->d_inode) { 2786 goto out; 2787 } else if ((open_flag & O_TRUNC) && 2788 S_ISREG(dentry->d_inode->i_mode)) { 2789 goto out; 2790 } 2791 /* will fail later, go on to get the right error */ 2792 } 2793 } 2794 looked_up: 2795 path->dentry = dentry; 2796 path->mnt = nd->path.mnt; 2797 return 1; 2798 } 2799 2800 /* 2801 * Look up and maybe create and open the last component. 2802 * 2803 * Must be called with i_mutex held on parent. 2804 * 2805 * Returns 0 if the file was successfully atomically created (if necessary) and 2806 * opened. In this case the file will be returned attached to @file. 2807 * 2808 * Returns 1 if the file was not completely opened at this time, though lookups 2809 * and creations will have been performed and the dentry returned in @path will 2810 * be positive upon return if O_CREAT was specified. If O_CREAT wasn't 2811 * specified then a negative dentry may be returned. 2812 * 2813 * An error code is returned otherwise. 2814 * 2815 * FILE_CREATE will be set in @*opened if the dentry was created and will be 2816 * cleared otherwise prior to returning. 2817 */ 2818 static int lookup_open(struct nameidata *nd, struct path *path, 2819 struct file *file, 2820 const struct open_flags *op, 2821 bool got_write, int *opened) 2822 { 2823 struct dentry *dir = nd->path.dentry; 2824 struct inode *dir_inode = dir->d_inode; 2825 struct dentry *dentry; 2826 int error; 2827 bool need_lookup; 2828 2829 *opened &= ~FILE_CREATED; 2830 dentry = lookup_dcache(&nd->last, dir, nd->flags, &need_lookup); 2831 if (IS_ERR(dentry)) 2832 return PTR_ERR(dentry); 2833 2834 /* Cached positive dentry: will open in f_op->open */ 2835 if (!need_lookup && dentry->d_inode) 2836 goto out_no_open; 2837 2838 if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) { 2839 return atomic_open(nd, dentry, path, file, op, got_write, 2840 need_lookup, opened); 2841 } 2842 2843 if (need_lookup) { 2844 BUG_ON(dentry->d_inode); 2845 2846 dentry = lookup_real(dir_inode, dentry, nd->flags); 2847 if (IS_ERR(dentry)) 2848 return PTR_ERR(dentry); 2849 } 2850 2851 /* Negative dentry, just create the file */ 2852 if (!dentry->d_inode && (op->open_flag & O_CREAT)) { 2853 umode_t mode = op->mode; 2854 if (!IS_POSIXACL(dir->d_inode)) 2855 mode &= ~current_umask(); 2856 /* 2857 * This write is needed to ensure that a 2858 * rw->ro transition does not occur between 2859 * the time when the file is created and when 2860 * a permanent write count is taken through 2861 * the 'struct file' in finish_open(). 2862 */ 2863 if (!got_write) { 2864 error = -EROFS; 2865 goto out_dput; 2866 } 2867 *opened |= FILE_CREATED; 2868 error = security_path_mknod(&nd->path, dentry, mode, 0); 2869 if (error) 2870 goto out_dput; 2871 error = vfs_create(dir->d_inode, dentry, mode, 2872 nd->flags & LOOKUP_EXCL); 2873 if (error) 2874 goto out_dput; 2875 } 2876 out_no_open: 2877 path->dentry = dentry; 2878 path->mnt = nd->path.mnt; 2879 return 1; 2880 2881 out_dput: 2882 dput(dentry); 2883 return error; 2884 } 2885 2886 /* 2887 * Handle the last step of open() 2888 */ 2889 static int do_last(struct nameidata *nd, struct path *path, 2890 struct file *file, const struct open_flags *op, 2891 int *opened, struct filename *name) 2892 { 2893 struct dentry *dir = nd->path.dentry; 2894 int open_flag = op->open_flag; 2895 bool will_truncate = (open_flag & O_TRUNC) != 0; 2896 bool got_write = false; 2897 int acc_mode = op->acc_mode; 2898 struct inode *inode; 2899 bool symlink_ok = false; 2900 struct path save_parent = { .dentry = NULL, .mnt = NULL }; 2901 bool retried = false; 2902 int error; 2903 2904 nd->flags &= ~LOOKUP_PARENT; 2905 nd->flags |= op->intent; 2906 2907 if (nd->last_type != LAST_NORM) { 2908 error = handle_dots(nd, nd->last_type); 2909 if (error) 2910 return error; 2911 goto finish_open; 2912 } 2913 2914 if (!(open_flag & O_CREAT)) { 2915 if (nd->last.name[nd->last.len]) 2916 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 2917 if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW)) 2918 symlink_ok = true; 2919 /* we _can_ be in RCU mode here */ 2920 error = lookup_fast(nd, path, &inode); 2921 if (likely(!error)) 2922 goto finish_lookup; 2923 2924 if (error < 0) 2925 goto out; 2926 2927 BUG_ON(nd->inode != dir->d_inode); 2928 } else { 2929 /* create side of things */ 2930 /* 2931 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED 2932 * has been cleared when we got to the last component we are 2933 * about to look up 2934 */ 2935 error = complete_walk(nd); 2936 if (error) 2937 return error; 2938 2939 audit_inode(name, dir, LOOKUP_PARENT); 2940 error = -EISDIR; 2941 /* trailing slashes? */ 2942 if (nd->last.name[nd->last.len]) 2943 goto out; 2944 } 2945 2946 retry_lookup: 2947 if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) { 2948 error = mnt_want_write(nd->path.mnt); 2949 if (!error) 2950 got_write = true; 2951 /* 2952 * do _not_ fail yet - we might not need that or fail with 2953 * a different error; let lookup_open() decide; we'll be 2954 * dropping this one anyway. 2955 */ 2956 } 2957 mutex_lock(&dir->d_inode->i_mutex); 2958 error = lookup_open(nd, path, file, op, got_write, opened); 2959 mutex_unlock(&dir->d_inode->i_mutex); 2960 2961 if (error <= 0) { 2962 if (error) 2963 goto out; 2964 2965 if ((*opened & FILE_CREATED) || 2966 !S_ISREG(file_inode(file)->i_mode)) 2967 will_truncate = false; 2968 2969 audit_inode(name, file->f_path.dentry, 0); 2970 goto opened; 2971 } 2972 2973 if (*opened & FILE_CREATED) { 2974 /* Don't check for write permission, don't truncate */ 2975 open_flag &= ~O_TRUNC; 2976 will_truncate = false; 2977 acc_mode = MAY_OPEN; 2978 path_to_nameidata(path, nd); 2979 goto finish_open_created; 2980 } 2981 2982 /* 2983 * create/update audit record if it already exists. 2984 */ 2985 if (d_is_positive(path->dentry)) 2986 audit_inode(name, path->dentry, 0); 2987 2988 /* 2989 * If atomic_open() acquired write access it is dropped now due to 2990 * possible mount and symlink following (this might be optimized away if 2991 * necessary...) 2992 */ 2993 if (got_write) { 2994 mnt_drop_write(nd->path.mnt); 2995 got_write = false; 2996 } 2997 2998 error = -EEXIST; 2999 if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT)) 3000 goto exit_dput; 3001 3002 error = follow_managed(path, nd->flags); 3003 if (error < 0) 3004 goto exit_dput; 3005 3006 if (error) 3007 nd->flags |= LOOKUP_JUMPED; 3008 3009 BUG_ON(nd->flags & LOOKUP_RCU); 3010 inode = path->dentry->d_inode; 3011 finish_lookup: 3012 /* we _can_ be in RCU mode here */ 3013 error = -ENOENT; 3014 if (!inode || d_is_negative(path->dentry)) { 3015 path_to_nameidata(path, nd); 3016 goto out; 3017 } 3018 3019 if (should_follow_link(path->dentry, !symlink_ok)) { 3020 if (nd->flags & LOOKUP_RCU) { 3021 if (unlikely(unlazy_walk(nd, path->dentry))) { 3022 error = -ECHILD; 3023 goto out; 3024 } 3025 } 3026 BUG_ON(inode != path->dentry->d_inode); 3027 return 1; 3028 } 3029 3030 if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path->mnt) { 3031 path_to_nameidata(path, nd); 3032 } else { 3033 save_parent.dentry = nd->path.dentry; 3034 save_parent.mnt = mntget(path->mnt); 3035 nd->path.dentry = path->dentry; 3036 3037 } 3038 nd->inode = inode; 3039 /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */ 3040 finish_open: 3041 error = complete_walk(nd); 3042 if (error) { 3043 path_put(&save_parent); 3044 return error; 3045 } 3046 audit_inode(name, nd->path.dentry, 0); 3047 error = -EISDIR; 3048 if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) 3049 goto out; 3050 error = -ENOTDIR; 3051 if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry)) 3052 goto out; 3053 if (!S_ISREG(nd->inode->i_mode)) 3054 will_truncate = false; 3055 3056 if (will_truncate) { 3057 error = mnt_want_write(nd->path.mnt); 3058 if (error) 3059 goto out; 3060 got_write = true; 3061 } 3062 finish_open_created: 3063 error = may_open(&nd->path, acc_mode, open_flag); 3064 if (error) 3065 goto out; 3066 file->f_path.mnt = nd->path.mnt; 3067 error = finish_open(file, nd->path.dentry, NULL, opened); 3068 if (error) { 3069 if (error == -EOPENSTALE) 3070 goto stale_open; 3071 goto out; 3072 } 3073 opened: 3074 error = open_check_o_direct(file); 3075 if (error) 3076 goto exit_fput; 3077 error = ima_file_check(file, op->acc_mode); 3078 if (error) 3079 goto exit_fput; 3080 3081 if (will_truncate) { 3082 error = handle_truncate(file); 3083 if (error) 3084 goto exit_fput; 3085 } 3086 out: 3087 if (got_write) 3088 mnt_drop_write(nd->path.mnt); 3089 path_put(&save_parent); 3090 terminate_walk(nd); 3091 return error; 3092 3093 exit_dput: 3094 path_put_conditional(path, nd); 3095 goto out; 3096 exit_fput: 3097 fput(file); 3098 goto out; 3099 3100 stale_open: 3101 /* If no saved parent or already retried then can't retry */ 3102 if (!save_parent.dentry || retried) 3103 goto out; 3104 3105 BUG_ON(save_parent.dentry != dir); 3106 path_put(&nd->path); 3107 nd->path = save_parent; 3108 nd->inode = dir->d_inode; 3109 save_parent.mnt = NULL; 3110 save_parent.dentry = NULL; 3111 if (got_write) { 3112 mnt_drop_write(nd->path.mnt); 3113 got_write = false; 3114 } 3115 retried = true; 3116 goto retry_lookup; 3117 } 3118 3119 static int do_tmpfile(int dfd, struct filename *pathname, 3120 struct nameidata *nd, int flags, 3121 const struct open_flags *op, 3122 struct file *file, int *opened) 3123 { 3124 static const struct qstr name = QSTR_INIT("/", 1); 3125 struct dentry *dentry, *child; 3126 struct inode *dir; 3127 int error = path_lookupat(dfd, pathname->name, 3128 flags | LOOKUP_DIRECTORY, nd); 3129 if (unlikely(error)) 3130 return error; 3131 error = mnt_want_write(nd->path.mnt); 3132 if (unlikely(error)) 3133 goto out; 3134 /* we want directory to be writable */ 3135 error = inode_permission(nd->inode, MAY_WRITE | MAY_EXEC); 3136 if (error) 3137 goto out2; 3138 dentry = nd->path.dentry; 3139 dir = dentry->d_inode; 3140 if (!dir->i_op->tmpfile) { 3141 error = -EOPNOTSUPP; 3142 goto out2; 3143 } 3144 child = d_alloc(dentry, &name); 3145 if (unlikely(!child)) { 3146 error = -ENOMEM; 3147 goto out2; 3148 } 3149 nd->flags &= ~LOOKUP_DIRECTORY; 3150 nd->flags |= op->intent; 3151 dput(nd->path.dentry); 3152 nd->path.dentry = child; 3153 error = dir->i_op->tmpfile(dir, nd->path.dentry, op->mode); 3154 if (error) 3155 goto out2; 3156 audit_inode(pathname, nd->path.dentry, 0); 3157 error = may_open(&nd->path, op->acc_mode, op->open_flag); 3158 if (error) 3159 goto out2; 3160 file->f_path.mnt = nd->path.mnt; 3161 error = finish_open(file, nd->path.dentry, NULL, opened); 3162 if (error) 3163 goto out2; 3164 error = open_check_o_direct(file); 3165 if (error) { 3166 fput(file); 3167 } else if (!(op->open_flag & O_EXCL)) { 3168 struct inode *inode = file_inode(file); 3169 spin_lock(&inode->i_lock); 3170 inode->i_state |= I_LINKABLE; 3171 spin_unlock(&inode->i_lock); 3172 } 3173 out2: 3174 mnt_drop_write(nd->path.mnt); 3175 out: 3176 path_put(&nd->path); 3177 return error; 3178 } 3179 3180 static struct file *path_openat(int dfd, struct filename *pathname, 3181 struct nameidata *nd, const struct open_flags *op, int flags) 3182 { 3183 struct file *base = NULL; 3184 struct file *file; 3185 struct path path; 3186 int opened = 0; 3187 int error; 3188 3189 file = get_empty_filp(); 3190 if (IS_ERR(file)) 3191 return file; 3192 3193 file->f_flags = op->open_flag; 3194 3195 if (unlikely(file->f_flags & __O_TMPFILE)) { 3196 error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened); 3197 goto out; 3198 } 3199 3200 error = path_init(dfd, pathname->name, flags | LOOKUP_PARENT, nd, &base); 3201 if (unlikely(error)) 3202 goto out; 3203 3204 current->total_link_count = 0; 3205 error = link_path_walk(pathname->name, nd); 3206 if (unlikely(error)) 3207 goto out; 3208 3209 error = do_last(nd, &path, file, op, &opened, pathname); 3210 while (unlikely(error > 0)) { /* trailing symlink */ 3211 struct path link = path; 3212 void *cookie; 3213 if (!(nd->flags & LOOKUP_FOLLOW)) { 3214 path_put_conditional(&path, nd); 3215 path_put(&nd->path); 3216 error = -ELOOP; 3217 break; 3218 } 3219 error = may_follow_link(&link, nd); 3220 if (unlikely(error)) 3221 break; 3222 nd->flags |= LOOKUP_PARENT; 3223 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL); 3224 error = follow_link(&link, nd, &cookie); 3225 if (unlikely(error)) 3226 break; 3227 error = do_last(nd, &path, file, op, &opened, pathname); 3228 put_link(nd, &link, cookie); 3229 } 3230 out: 3231 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) 3232 path_put(&nd->root); 3233 if (base) 3234 fput(base); 3235 if (!(opened & FILE_OPENED)) { 3236 BUG_ON(!error); 3237 put_filp(file); 3238 } 3239 if (unlikely(error)) { 3240 if (error == -EOPENSTALE) { 3241 if (flags & LOOKUP_RCU) 3242 error = -ECHILD; 3243 else 3244 error = -ESTALE; 3245 } 3246 file = ERR_PTR(error); 3247 } 3248 return file; 3249 } 3250 3251 struct file *do_filp_open(int dfd, struct filename *pathname, 3252 const struct open_flags *op) 3253 { 3254 struct nameidata nd; 3255 int flags = op->lookup_flags; 3256 struct file *filp; 3257 3258 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU); 3259 if (unlikely(filp == ERR_PTR(-ECHILD))) 3260 filp = path_openat(dfd, pathname, &nd, op, flags); 3261 if (unlikely(filp == ERR_PTR(-ESTALE))) 3262 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL); 3263 return filp; 3264 } 3265 3266 struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt, 3267 const char *name, const struct open_flags *op) 3268 { 3269 struct nameidata nd; 3270 struct file *file; 3271 struct filename filename = { .name = name }; 3272 int flags = op->lookup_flags | LOOKUP_ROOT; 3273 3274 nd.root.mnt = mnt; 3275 nd.root.dentry = dentry; 3276 3277 if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN) 3278 return ERR_PTR(-ELOOP); 3279 3280 file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_RCU); 3281 if (unlikely(file == ERR_PTR(-ECHILD))) 3282 file = path_openat(-1, &filename, &nd, op, flags); 3283 if (unlikely(file == ERR_PTR(-ESTALE))) 3284 file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_REVAL); 3285 return file; 3286 } 3287 3288 struct dentry *kern_path_create(int dfd, const char *pathname, 3289 struct path *path, unsigned int lookup_flags) 3290 { 3291 struct dentry *dentry = ERR_PTR(-EEXIST); 3292 struct nameidata nd; 3293 int err2; 3294 int error; 3295 bool is_dir = (lookup_flags & LOOKUP_DIRECTORY); 3296 3297 /* 3298 * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any 3299 * other flags passed in are ignored! 3300 */ 3301 lookup_flags &= LOOKUP_REVAL; 3302 3303 error = do_path_lookup(dfd, pathname, LOOKUP_PARENT|lookup_flags, &nd); 3304 if (error) 3305 return ERR_PTR(error); 3306 3307 /* 3308 * Yucky last component or no last component at all? 3309 * (foo/., foo/.., /////) 3310 */ 3311 if (nd.last_type != LAST_NORM) 3312 goto out; 3313 nd.flags &= ~LOOKUP_PARENT; 3314 nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL; 3315 3316 /* don't fail immediately if it's r/o, at least try to report other errors */ 3317 err2 = mnt_want_write(nd.path.mnt); 3318 /* 3319 * Do the final lookup. 3320 */ 3321 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3322 dentry = lookup_hash(&nd); 3323 if (IS_ERR(dentry)) 3324 goto unlock; 3325 3326 error = -EEXIST; 3327 if (d_is_positive(dentry)) 3328 goto fail; 3329 3330 /* 3331 * Special case - lookup gave negative, but... we had foo/bar/ 3332 * From the vfs_mknod() POV we just have a negative dentry - 3333 * all is fine. Let's be bastards - you had / on the end, you've 3334 * been asking for (non-existent) directory. -ENOENT for you. 3335 */ 3336 if (unlikely(!is_dir && nd.last.name[nd.last.len])) { 3337 error = -ENOENT; 3338 goto fail; 3339 } 3340 if (unlikely(err2)) { 3341 error = err2; 3342 goto fail; 3343 } 3344 *path = nd.path; 3345 return dentry; 3346 fail: 3347 dput(dentry); 3348 dentry = ERR_PTR(error); 3349 unlock: 3350 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 3351 if (!err2) 3352 mnt_drop_write(nd.path.mnt); 3353 out: 3354 path_put(&nd.path); 3355 return dentry; 3356 } 3357 EXPORT_SYMBOL(kern_path_create); 3358 3359 void done_path_create(struct path *path, struct dentry *dentry) 3360 { 3361 dput(dentry); 3362 mutex_unlock(&path->dentry->d_inode->i_mutex); 3363 mnt_drop_write(path->mnt); 3364 path_put(path); 3365 } 3366 EXPORT_SYMBOL(done_path_create); 3367 3368 struct dentry *user_path_create(int dfd, const char __user *pathname, 3369 struct path *path, unsigned int lookup_flags) 3370 { 3371 struct filename *tmp = getname(pathname); 3372 struct dentry *res; 3373 if (IS_ERR(tmp)) 3374 return ERR_CAST(tmp); 3375 res = kern_path_create(dfd, tmp->name, path, lookup_flags); 3376 putname(tmp); 3377 return res; 3378 } 3379 EXPORT_SYMBOL(user_path_create); 3380 3381 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) 3382 { 3383 int error = may_create(dir, dentry); 3384 3385 if (error) 3386 return error; 3387 3388 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD)) 3389 return -EPERM; 3390 3391 if (!dir->i_op->mknod) 3392 return -EPERM; 3393 3394 error = devcgroup_inode_mknod(mode, dev); 3395 if (error) 3396 return error; 3397 3398 error = security_inode_mknod(dir, dentry, mode, dev); 3399 if (error) 3400 return error; 3401 3402 error = dir->i_op->mknod(dir, dentry, mode, dev); 3403 if (!error) 3404 fsnotify_create(dir, dentry); 3405 return error; 3406 } 3407 EXPORT_SYMBOL(vfs_mknod); 3408 3409 static int may_mknod(umode_t mode) 3410 { 3411 switch (mode & S_IFMT) { 3412 case S_IFREG: 3413 case S_IFCHR: 3414 case S_IFBLK: 3415 case S_IFIFO: 3416 case S_IFSOCK: 3417 case 0: /* zero mode translates to S_IFREG */ 3418 return 0; 3419 case S_IFDIR: 3420 return -EPERM; 3421 default: 3422 return -EINVAL; 3423 } 3424 } 3425 3426 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, 3427 unsigned, dev) 3428 { 3429 struct dentry *dentry; 3430 struct path path; 3431 int error; 3432 unsigned int lookup_flags = 0; 3433 3434 error = may_mknod(mode); 3435 if (error) 3436 return error; 3437 retry: 3438 dentry = user_path_create(dfd, filename, &path, lookup_flags); 3439 if (IS_ERR(dentry)) 3440 return PTR_ERR(dentry); 3441 3442 if (!IS_POSIXACL(path.dentry->d_inode)) 3443 mode &= ~current_umask(); 3444 error = security_path_mknod(&path, dentry, mode, dev); 3445 if (error) 3446 goto out; 3447 switch (mode & S_IFMT) { 3448 case 0: case S_IFREG: 3449 error = vfs_create(path.dentry->d_inode,dentry,mode,true); 3450 break; 3451 case S_IFCHR: case S_IFBLK: 3452 error = vfs_mknod(path.dentry->d_inode,dentry,mode, 3453 new_decode_dev(dev)); 3454 break; 3455 case S_IFIFO: case S_IFSOCK: 3456 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0); 3457 break; 3458 } 3459 out: 3460 done_path_create(&path, dentry); 3461 if (retry_estale(error, lookup_flags)) { 3462 lookup_flags |= LOOKUP_REVAL; 3463 goto retry; 3464 } 3465 return error; 3466 } 3467 3468 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev) 3469 { 3470 return sys_mknodat(AT_FDCWD, filename, mode, dev); 3471 } 3472 3473 int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 3474 { 3475 int error = may_create(dir, dentry); 3476 unsigned max_links = dir->i_sb->s_max_links; 3477 3478 if (error) 3479 return error; 3480 3481 if (!dir->i_op->mkdir) 3482 return -EPERM; 3483 3484 mode &= (S_IRWXUGO|S_ISVTX); 3485 error = security_inode_mkdir(dir, dentry, mode); 3486 if (error) 3487 return error; 3488 3489 if (max_links && dir->i_nlink >= max_links) 3490 return -EMLINK; 3491 3492 error = dir->i_op->mkdir(dir, dentry, mode); 3493 if (!error) 3494 fsnotify_mkdir(dir, dentry); 3495 return error; 3496 } 3497 EXPORT_SYMBOL(vfs_mkdir); 3498 3499 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) 3500 { 3501 struct dentry *dentry; 3502 struct path path; 3503 int error; 3504 unsigned int lookup_flags = LOOKUP_DIRECTORY; 3505 3506 retry: 3507 dentry = user_path_create(dfd, pathname, &path, lookup_flags); 3508 if (IS_ERR(dentry)) 3509 return PTR_ERR(dentry); 3510 3511 if (!IS_POSIXACL(path.dentry->d_inode)) 3512 mode &= ~current_umask(); 3513 error = security_path_mkdir(&path, dentry, mode); 3514 if (!error) 3515 error = vfs_mkdir(path.dentry->d_inode, dentry, mode); 3516 done_path_create(&path, dentry); 3517 if (retry_estale(error, lookup_flags)) { 3518 lookup_flags |= LOOKUP_REVAL; 3519 goto retry; 3520 } 3521 return error; 3522 } 3523 3524 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode) 3525 { 3526 return sys_mkdirat(AT_FDCWD, pathname, mode); 3527 } 3528 3529 /* 3530 * The dentry_unhash() helper will try to drop the dentry early: we 3531 * should have a usage count of 1 if we're the only user of this 3532 * dentry, and if that is true (possibly after pruning the dcache), 3533 * then we drop the dentry now. 3534 * 3535 * A low-level filesystem can, if it choses, legally 3536 * do a 3537 * 3538 * if (!d_unhashed(dentry)) 3539 * return -EBUSY; 3540 * 3541 * if it cannot handle the case of removing a directory 3542 * that is still in use by something else.. 3543 */ 3544 void dentry_unhash(struct dentry *dentry) 3545 { 3546 shrink_dcache_parent(dentry); 3547 spin_lock(&dentry->d_lock); 3548 if (dentry->d_lockref.count == 1) 3549 __d_drop(dentry); 3550 spin_unlock(&dentry->d_lock); 3551 } 3552 EXPORT_SYMBOL(dentry_unhash); 3553 3554 int vfs_rmdir(struct inode *dir, struct dentry *dentry) 3555 { 3556 int error = may_delete(dir, dentry, 1); 3557 3558 if (error) 3559 return error; 3560 3561 if (!dir->i_op->rmdir) 3562 return -EPERM; 3563 3564 dget(dentry); 3565 mutex_lock(&dentry->d_inode->i_mutex); 3566 3567 error = -EBUSY; 3568 if (d_mountpoint(dentry)) 3569 goto out; 3570 3571 error = security_inode_rmdir(dir, dentry); 3572 if (error) 3573 goto out; 3574 3575 shrink_dcache_parent(dentry); 3576 error = dir->i_op->rmdir(dir, dentry); 3577 if (error) 3578 goto out; 3579 3580 dentry->d_inode->i_flags |= S_DEAD; 3581 dont_mount(dentry); 3582 3583 out: 3584 mutex_unlock(&dentry->d_inode->i_mutex); 3585 dput(dentry); 3586 if (!error) 3587 d_delete(dentry); 3588 return error; 3589 } 3590 EXPORT_SYMBOL(vfs_rmdir); 3591 3592 static long do_rmdir(int dfd, const char __user *pathname) 3593 { 3594 int error = 0; 3595 struct filename *name; 3596 struct dentry *dentry; 3597 struct nameidata nd; 3598 unsigned int lookup_flags = 0; 3599 retry: 3600 name = user_path_parent(dfd, pathname, &nd, lookup_flags); 3601 if (IS_ERR(name)) 3602 return PTR_ERR(name); 3603 3604 switch(nd.last_type) { 3605 case LAST_DOTDOT: 3606 error = -ENOTEMPTY; 3607 goto exit1; 3608 case LAST_DOT: 3609 error = -EINVAL; 3610 goto exit1; 3611 case LAST_ROOT: 3612 error = -EBUSY; 3613 goto exit1; 3614 } 3615 3616 nd.flags &= ~LOOKUP_PARENT; 3617 error = mnt_want_write(nd.path.mnt); 3618 if (error) 3619 goto exit1; 3620 3621 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3622 dentry = lookup_hash(&nd); 3623 error = PTR_ERR(dentry); 3624 if (IS_ERR(dentry)) 3625 goto exit2; 3626 if (!dentry->d_inode) { 3627 error = -ENOENT; 3628 goto exit3; 3629 } 3630 error = security_path_rmdir(&nd.path, dentry); 3631 if (error) 3632 goto exit3; 3633 error = vfs_rmdir(nd.path.dentry->d_inode, dentry); 3634 exit3: 3635 dput(dentry); 3636 exit2: 3637 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 3638 mnt_drop_write(nd.path.mnt); 3639 exit1: 3640 path_put(&nd.path); 3641 putname(name); 3642 if (retry_estale(error, lookup_flags)) { 3643 lookup_flags |= LOOKUP_REVAL; 3644 goto retry; 3645 } 3646 return error; 3647 } 3648 3649 SYSCALL_DEFINE1(rmdir, const char __user *, pathname) 3650 { 3651 return do_rmdir(AT_FDCWD, pathname); 3652 } 3653 3654 /** 3655 * vfs_unlink - unlink a filesystem object 3656 * @dir: parent directory 3657 * @dentry: victim 3658 * @delegated_inode: returns victim inode, if the inode is delegated. 3659 * 3660 * The caller must hold dir->i_mutex. 3661 * 3662 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and 3663 * return a reference to the inode in delegated_inode. The caller 3664 * should then break the delegation on that inode and retry. Because 3665 * breaking a delegation may take a long time, the caller should drop 3666 * dir->i_mutex before doing so. 3667 * 3668 * Alternatively, a caller may pass NULL for delegated_inode. This may 3669 * be appropriate for callers that expect the underlying filesystem not 3670 * to be NFS exported. 3671 */ 3672 int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode) 3673 { 3674 struct inode *target = dentry->d_inode; 3675 int error = may_delete(dir, dentry, 0); 3676 3677 if (error) 3678 return error; 3679 3680 if (!dir->i_op->unlink) 3681 return -EPERM; 3682 3683 mutex_lock(&target->i_mutex); 3684 if (d_mountpoint(dentry)) 3685 error = -EBUSY; 3686 else { 3687 error = security_inode_unlink(dir, dentry); 3688 if (!error) { 3689 error = try_break_deleg(target, delegated_inode); 3690 if (error) 3691 goto out; 3692 error = dir->i_op->unlink(dir, dentry); 3693 if (!error) 3694 dont_mount(dentry); 3695 } 3696 } 3697 out: 3698 mutex_unlock(&target->i_mutex); 3699 3700 /* We don't d_delete() NFS sillyrenamed files--they still exist. */ 3701 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) { 3702 fsnotify_link_count(target); 3703 d_delete(dentry); 3704 } 3705 3706 return error; 3707 } 3708 EXPORT_SYMBOL(vfs_unlink); 3709 3710 /* 3711 * Make sure that the actual truncation of the file will occur outside its 3712 * directory's i_mutex. Truncate can take a long time if there is a lot of 3713 * writeout happening, and we don't want to prevent access to the directory 3714 * while waiting on the I/O. 3715 */ 3716 static long do_unlinkat(int dfd, const char __user *pathname) 3717 { 3718 int error; 3719 struct filename *name; 3720 struct dentry *dentry; 3721 struct nameidata nd; 3722 struct inode *inode = NULL; 3723 struct inode *delegated_inode = NULL; 3724 unsigned int lookup_flags = 0; 3725 retry: 3726 name = user_path_parent(dfd, pathname, &nd, lookup_flags); 3727 if (IS_ERR(name)) 3728 return PTR_ERR(name); 3729 3730 error = -EISDIR; 3731 if (nd.last_type != LAST_NORM) 3732 goto exit1; 3733 3734 nd.flags &= ~LOOKUP_PARENT; 3735 error = mnt_want_write(nd.path.mnt); 3736 if (error) 3737 goto exit1; 3738 retry_deleg: 3739 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3740 dentry = lookup_hash(&nd); 3741 error = PTR_ERR(dentry); 3742 if (!IS_ERR(dentry)) { 3743 /* Why not before? Because we want correct error value */ 3744 if (nd.last.name[nd.last.len]) 3745 goto slashes; 3746 inode = dentry->d_inode; 3747 if (d_is_negative(dentry)) 3748 goto slashes; 3749 ihold(inode); 3750 error = security_path_unlink(&nd.path, dentry); 3751 if (error) 3752 goto exit2; 3753 error = vfs_unlink(nd.path.dentry->d_inode, dentry, &delegated_inode); 3754 exit2: 3755 dput(dentry); 3756 } 3757 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 3758 if (inode) 3759 iput(inode); /* truncate the inode here */ 3760 inode = NULL; 3761 if (delegated_inode) { 3762 error = break_deleg_wait(&delegated_inode); 3763 if (!error) 3764 goto retry_deleg; 3765 } 3766 mnt_drop_write(nd.path.mnt); 3767 exit1: 3768 path_put(&nd.path); 3769 putname(name); 3770 if (retry_estale(error, lookup_flags)) { 3771 lookup_flags |= LOOKUP_REVAL; 3772 inode = NULL; 3773 goto retry; 3774 } 3775 return error; 3776 3777 slashes: 3778 if (d_is_negative(dentry)) 3779 error = -ENOENT; 3780 else if (d_is_dir(dentry)) 3781 error = -EISDIR; 3782 else 3783 error = -ENOTDIR; 3784 goto exit2; 3785 } 3786 3787 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) 3788 { 3789 if ((flag & ~AT_REMOVEDIR) != 0) 3790 return -EINVAL; 3791 3792 if (flag & AT_REMOVEDIR) 3793 return do_rmdir(dfd, pathname); 3794 3795 return do_unlinkat(dfd, pathname); 3796 } 3797 3798 SYSCALL_DEFINE1(unlink, const char __user *, pathname) 3799 { 3800 return do_unlinkat(AT_FDCWD, pathname); 3801 } 3802 3803 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname) 3804 { 3805 int error = may_create(dir, dentry); 3806 3807 if (error) 3808 return error; 3809 3810 if (!dir->i_op->symlink) 3811 return -EPERM; 3812 3813 error = security_inode_symlink(dir, dentry, oldname); 3814 if (error) 3815 return error; 3816 3817 error = dir->i_op->symlink(dir, dentry, oldname); 3818 if (!error) 3819 fsnotify_create(dir, dentry); 3820 return error; 3821 } 3822 EXPORT_SYMBOL(vfs_symlink); 3823 3824 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, 3825 int, newdfd, const char __user *, newname) 3826 { 3827 int error; 3828 struct filename *from; 3829 struct dentry *dentry; 3830 struct path path; 3831 unsigned int lookup_flags = 0; 3832 3833 from = getname(oldname); 3834 if (IS_ERR(from)) 3835 return PTR_ERR(from); 3836 retry: 3837 dentry = user_path_create(newdfd, newname, &path, lookup_flags); 3838 error = PTR_ERR(dentry); 3839 if (IS_ERR(dentry)) 3840 goto out_putname; 3841 3842 error = security_path_symlink(&path, dentry, from->name); 3843 if (!error) 3844 error = vfs_symlink(path.dentry->d_inode, dentry, from->name); 3845 done_path_create(&path, dentry); 3846 if (retry_estale(error, lookup_flags)) { 3847 lookup_flags |= LOOKUP_REVAL; 3848 goto retry; 3849 } 3850 out_putname: 3851 putname(from); 3852 return error; 3853 } 3854 3855 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) 3856 { 3857 return sys_symlinkat(oldname, AT_FDCWD, newname); 3858 } 3859 3860 /** 3861 * vfs_link - create a new link 3862 * @old_dentry: object to be linked 3863 * @dir: new parent 3864 * @new_dentry: where to create the new link 3865 * @delegated_inode: returns inode needing a delegation break 3866 * 3867 * The caller must hold dir->i_mutex 3868 * 3869 * If vfs_link discovers a delegation on the to-be-linked file in need 3870 * of breaking, it will return -EWOULDBLOCK and return a reference to the 3871 * inode in delegated_inode. The caller should then break the delegation 3872 * and retry. Because breaking a delegation may take a long time, the 3873 * caller should drop the i_mutex before doing so. 3874 * 3875 * Alternatively, a caller may pass NULL for delegated_inode. This may 3876 * be appropriate for callers that expect the underlying filesystem not 3877 * to be NFS exported. 3878 */ 3879 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode) 3880 { 3881 struct inode *inode = old_dentry->d_inode; 3882 unsigned max_links = dir->i_sb->s_max_links; 3883 int error; 3884 3885 if (!inode) 3886 return -ENOENT; 3887 3888 error = may_create(dir, new_dentry); 3889 if (error) 3890 return error; 3891 3892 if (dir->i_sb != inode->i_sb) 3893 return -EXDEV; 3894 3895 /* 3896 * A link to an append-only or immutable file cannot be created. 3897 */ 3898 if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) 3899 return -EPERM; 3900 if (!dir->i_op->link) 3901 return -EPERM; 3902 if (S_ISDIR(inode->i_mode)) 3903 return -EPERM; 3904 3905 error = security_inode_link(old_dentry, dir, new_dentry); 3906 if (error) 3907 return error; 3908 3909 mutex_lock(&inode->i_mutex); 3910 /* Make sure we don't allow creating hardlink to an unlinked file */ 3911 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE)) 3912 error = -ENOENT; 3913 else if (max_links && inode->i_nlink >= max_links) 3914 error = -EMLINK; 3915 else { 3916 error = try_break_deleg(inode, delegated_inode); 3917 if (!error) 3918 error = dir->i_op->link(old_dentry, dir, new_dentry); 3919 } 3920 3921 if (!error && (inode->i_state & I_LINKABLE)) { 3922 spin_lock(&inode->i_lock); 3923 inode->i_state &= ~I_LINKABLE; 3924 spin_unlock(&inode->i_lock); 3925 } 3926 mutex_unlock(&inode->i_mutex); 3927 if (!error) 3928 fsnotify_link(dir, inode, new_dentry); 3929 return error; 3930 } 3931 EXPORT_SYMBOL(vfs_link); 3932 3933 /* 3934 * Hardlinks are often used in delicate situations. We avoid 3935 * security-related surprises by not following symlinks on the 3936 * newname. --KAB 3937 * 3938 * We don't follow them on the oldname either to be compatible 3939 * with linux 2.0, and to avoid hard-linking to directories 3940 * and other special files. --ADM 3941 */ 3942 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, 3943 int, newdfd, const char __user *, newname, int, flags) 3944 { 3945 struct dentry *new_dentry; 3946 struct path old_path, new_path; 3947 struct inode *delegated_inode = NULL; 3948 int how = 0; 3949 int error; 3950 3951 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) 3952 return -EINVAL; 3953 /* 3954 * To use null names we require CAP_DAC_READ_SEARCH 3955 * This ensures that not everyone will be able to create 3956 * handlink using the passed filedescriptor. 3957 */ 3958 if (flags & AT_EMPTY_PATH) { 3959 if (!capable(CAP_DAC_READ_SEARCH)) 3960 return -ENOENT; 3961 how = LOOKUP_EMPTY; 3962 } 3963 3964 if (flags & AT_SYMLINK_FOLLOW) 3965 how |= LOOKUP_FOLLOW; 3966 retry: 3967 error = user_path_at(olddfd, oldname, how, &old_path); 3968 if (error) 3969 return error; 3970 3971 new_dentry = user_path_create(newdfd, newname, &new_path, 3972 (how & LOOKUP_REVAL)); 3973 error = PTR_ERR(new_dentry); 3974 if (IS_ERR(new_dentry)) 3975 goto out; 3976 3977 error = -EXDEV; 3978 if (old_path.mnt != new_path.mnt) 3979 goto out_dput; 3980 error = may_linkat(&old_path); 3981 if (unlikely(error)) 3982 goto out_dput; 3983 error = security_path_link(old_path.dentry, &new_path, new_dentry); 3984 if (error) 3985 goto out_dput; 3986 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode); 3987 out_dput: 3988 done_path_create(&new_path, new_dentry); 3989 if (delegated_inode) { 3990 error = break_deleg_wait(&delegated_inode); 3991 if (!error) { 3992 path_put(&old_path); 3993 goto retry; 3994 } 3995 } 3996 if (retry_estale(error, how)) { 3997 path_put(&old_path); 3998 how |= LOOKUP_REVAL; 3999 goto retry; 4000 } 4001 out: 4002 path_put(&old_path); 4003 4004 return error; 4005 } 4006 4007 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) 4008 { 4009 return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 4010 } 4011 4012 /** 4013 * vfs_rename - rename a filesystem object 4014 * @old_dir: parent of source 4015 * @old_dentry: source 4016 * @new_dir: parent of destination 4017 * @new_dentry: destination 4018 * @delegated_inode: returns an inode needing a delegation break 4019 * @flags: rename flags 4020 * 4021 * The caller must hold multiple mutexes--see lock_rename()). 4022 * 4023 * If vfs_rename discovers a delegation in need of breaking at either 4024 * the source or destination, it will return -EWOULDBLOCK and return a 4025 * reference to the inode in delegated_inode. The caller should then 4026 * break the delegation and retry. Because breaking a delegation may 4027 * take a long time, the caller should drop all locks before doing 4028 * so. 4029 * 4030 * Alternatively, a caller may pass NULL for delegated_inode. This may 4031 * be appropriate for callers that expect the underlying filesystem not 4032 * to be NFS exported. 4033 * 4034 * The worst of all namespace operations - renaming directory. "Perverted" 4035 * doesn't even start to describe it. Somebody in UCB had a heck of a trip... 4036 * Problems: 4037 * a) we can get into loop creation. 4038 * b) race potential - two innocent renames can create a loop together. 4039 * That's where 4.4 screws up. Current fix: serialization on 4040 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another 4041 * story. 4042 * c) we have to lock _four_ objects - parents and victim (if it exists), 4043 * and source (if it is not a directory). 4044 * And that - after we got ->i_mutex on parents (until then we don't know 4045 * whether the target exists). Solution: try to be smart with locking 4046 * order for inodes. We rely on the fact that tree topology may change 4047 * only under ->s_vfs_rename_mutex _and_ that parent of the object we 4048 * move will be locked. Thus we can rank directories by the tree 4049 * (ancestors first) and rank all non-directories after them. 4050 * That works since everybody except rename does "lock parent, lookup, 4051 * lock child" and rename is under ->s_vfs_rename_mutex. 4052 * HOWEVER, it relies on the assumption that any object with ->lookup() 4053 * has no more than 1 dentry. If "hybrid" objects will ever appear, 4054 * we'd better make sure that there's no link(2) for them. 4055 * d) conversion from fhandle to dentry may come in the wrong moment - when 4056 * we are removing the target. Solution: we will have to grab ->i_mutex 4057 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on 4058 * ->i_mutex on parents, which works but leads to some truly excessive 4059 * locking]. 4060 */ 4061 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, 4062 struct inode *new_dir, struct dentry *new_dentry, 4063 struct inode **delegated_inode, unsigned int flags) 4064 { 4065 int error; 4066 bool is_dir = d_is_dir(old_dentry); 4067 const unsigned char *old_name; 4068 struct inode *source = old_dentry->d_inode; 4069 struct inode *target = new_dentry->d_inode; 4070 bool new_is_dir = false; 4071 unsigned max_links = new_dir->i_sb->s_max_links; 4072 4073 if (source == target) 4074 return 0; 4075 4076 error = may_delete(old_dir, old_dentry, is_dir); 4077 if (error) 4078 return error; 4079 4080 if (!target) { 4081 error = may_create(new_dir, new_dentry); 4082 } else { 4083 new_is_dir = d_is_dir(new_dentry); 4084 4085 if (!(flags & RENAME_EXCHANGE)) 4086 error = may_delete(new_dir, new_dentry, is_dir); 4087 else 4088 error = may_delete(new_dir, new_dentry, new_is_dir); 4089 } 4090 if (error) 4091 return error; 4092 4093 if (!old_dir->i_op->rename && !old_dir->i_op->rename2) 4094 return -EPERM; 4095 4096 if (flags && !old_dir->i_op->rename2) 4097 return -EINVAL; 4098 4099 /* 4100 * If we are going to change the parent - check write permissions, 4101 * we'll need to flip '..'. 4102 */ 4103 if (new_dir != old_dir) { 4104 if (is_dir) { 4105 error = inode_permission(source, MAY_WRITE); 4106 if (error) 4107 return error; 4108 } 4109 if ((flags & RENAME_EXCHANGE) && new_is_dir) { 4110 error = inode_permission(target, MAY_WRITE); 4111 if (error) 4112 return error; 4113 } 4114 } 4115 4116 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry, 4117 flags); 4118 if (error) 4119 return error; 4120 4121 old_name = fsnotify_oldname_init(old_dentry->d_name.name); 4122 dget(new_dentry); 4123 if (!is_dir || (flags & RENAME_EXCHANGE)) 4124 lock_two_nondirectories(source, target); 4125 else if (target) 4126 mutex_lock(&target->i_mutex); 4127 4128 error = -EBUSY; 4129 if (d_mountpoint(old_dentry) || d_mountpoint(new_dentry)) 4130 goto out; 4131 4132 if (max_links && new_dir != old_dir) { 4133 error = -EMLINK; 4134 if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links) 4135 goto out; 4136 if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir && 4137 old_dir->i_nlink >= max_links) 4138 goto out; 4139 } 4140 if (is_dir && !(flags & RENAME_EXCHANGE) && target) 4141 shrink_dcache_parent(new_dentry); 4142 if (!is_dir) { 4143 error = try_break_deleg(source, delegated_inode); 4144 if (error) 4145 goto out; 4146 } 4147 if (target && !new_is_dir) { 4148 error = try_break_deleg(target, delegated_inode); 4149 if (error) 4150 goto out; 4151 } 4152 if (!old_dir->i_op->rename2) { 4153 error = old_dir->i_op->rename(old_dir, old_dentry, 4154 new_dir, new_dentry); 4155 } else { 4156 WARN_ON(old_dir->i_op->rename != NULL); 4157 error = old_dir->i_op->rename2(old_dir, old_dentry, 4158 new_dir, new_dentry, flags); 4159 } 4160 if (error) 4161 goto out; 4162 4163 if (!(flags & RENAME_EXCHANGE) && target) { 4164 if (is_dir) 4165 target->i_flags |= S_DEAD; 4166 dont_mount(new_dentry); 4167 } 4168 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) { 4169 if (!(flags & RENAME_EXCHANGE)) 4170 d_move(old_dentry, new_dentry); 4171 else 4172 d_exchange(old_dentry, new_dentry); 4173 } 4174 out: 4175 if (!is_dir || (flags & RENAME_EXCHANGE)) 4176 unlock_two_nondirectories(source, target); 4177 else if (target) 4178 mutex_unlock(&target->i_mutex); 4179 dput(new_dentry); 4180 if (!error) { 4181 fsnotify_move(old_dir, new_dir, old_name, is_dir, 4182 !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry); 4183 if (flags & RENAME_EXCHANGE) { 4184 fsnotify_move(new_dir, old_dir, old_dentry->d_name.name, 4185 new_is_dir, NULL, new_dentry); 4186 } 4187 } 4188 fsnotify_oldname_free(old_name); 4189 4190 return error; 4191 } 4192 EXPORT_SYMBOL(vfs_rename); 4193 4194 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname, 4195 int, newdfd, const char __user *, newname, unsigned int, flags) 4196 { 4197 struct dentry *old_dir, *new_dir; 4198 struct dentry *old_dentry, *new_dentry; 4199 struct dentry *trap; 4200 struct nameidata oldnd, newnd; 4201 struct inode *delegated_inode = NULL; 4202 struct filename *from; 4203 struct filename *to; 4204 unsigned int lookup_flags = 0; 4205 bool should_retry = false; 4206 int error; 4207 4208 if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE)) 4209 return -EINVAL; 4210 4211 if ((flags & RENAME_NOREPLACE) && (flags & RENAME_EXCHANGE)) 4212 return -EINVAL; 4213 4214 retry: 4215 from = user_path_parent(olddfd, oldname, &oldnd, lookup_flags); 4216 if (IS_ERR(from)) { 4217 error = PTR_ERR(from); 4218 goto exit; 4219 } 4220 4221 to = user_path_parent(newdfd, newname, &newnd, lookup_flags); 4222 if (IS_ERR(to)) { 4223 error = PTR_ERR(to); 4224 goto exit1; 4225 } 4226 4227 error = -EXDEV; 4228 if (oldnd.path.mnt != newnd.path.mnt) 4229 goto exit2; 4230 4231 old_dir = oldnd.path.dentry; 4232 error = -EBUSY; 4233 if (oldnd.last_type != LAST_NORM) 4234 goto exit2; 4235 4236 new_dir = newnd.path.dentry; 4237 if (flags & RENAME_NOREPLACE) 4238 error = -EEXIST; 4239 if (newnd.last_type != LAST_NORM) 4240 goto exit2; 4241 4242 error = mnt_want_write(oldnd.path.mnt); 4243 if (error) 4244 goto exit2; 4245 4246 oldnd.flags &= ~LOOKUP_PARENT; 4247 newnd.flags &= ~LOOKUP_PARENT; 4248 if (!(flags & RENAME_EXCHANGE)) 4249 newnd.flags |= LOOKUP_RENAME_TARGET; 4250 4251 retry_deleg: 4252 trap = lock_rename(new_dir, old_dir); 4253 4254 old_dentry = lookup_hash(&oldnd); 4255 error = PTR_ERR(old_dentry); 4256 if (IS_ERR(old_dentry)) 4257 goto exit3; 4258 /* source must exist */ 4259 error = -ENOENT; 4260 if (d_is_negative(old_dentry)) 4261 goto exit4; 4262 new_dentry = lookup_hash(&newnd); 4263 error = PTR_ERR(new_dentry); 4264 if (IS_ERR(new_dentry)) 4265 goto exit4; 4266 error = -EEXIST; 4267 if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry)) 4268 goto exit5; 4269 if (flags & RENAME_EXCHANGE) { 4270 error = -ENOENT; 4271 if (d_is_negative(new_dentry)) 4272 goto exit5; 4273 4274 if (!d_is_dir(new_dentry)) { 4275 error = -ENOTDIR; 4276 if (newnd.last.name[newnd.last.len]) 4277 goto exit5; 4278 } 4279 } 4280 /* unless the source is a directory trailing slashes give -ENOTDIR */ 4281 if (!d_is_dir(old_dentry)) { 4282 error = -ENOTDIR; 4283 if (oldnd.last.name[oldnd.last.len]) 4284 goto exit5; 4285 if (!(flags & RENAME_EXCHANGE) && newnd.last.name[newnd.last.len]) 4286 goto exit5; 4287 } 4288 /* source should not be ancestor of target */ 4289 error = -EINVAL; 4290 if (old_dentry == trap) 4291 goto exit5; 4292 /* target should not be an ancestor of source */ 4293 if (!(flags & RENAME_EXCHANGE)) 4294 error = -ENOTEMPTY; 4295 if (new_dentry == trap) 4296 goto exit5; 4297 4298 error = security_path_rename(&oldnd.path, old_dentry, 4299 &newnd.path, new_dentry, flags); 4300 if (error) 4301 goto exit5; 4302 error = vfs_rename(old_dir->d_inode, old_dentry, 4303 new_dir->d_inode, new_dentry, 4304 &delegated_inode, flags); 4305 exit5: 4306 dput(new_dentry); 4307 exit4: 4308 dput(old_dentry); 4309 exit3: 4310 unlock_rename(new_dir, old_dir); 4311 if (delegated_inode) { 4312 error = break_deleg_wait(&delegated_inode); 4313 if (!error) 4314 goto retry_deleg; 4315 } 4316 mnt_drop_write(oldnd.path.mnt); 4317 exit2: 4318 if (retry_estale(error, lookup_flags)) 4319 should_retry = true; 4320 path_put(&newnd.path); 4321 putname(to); 4322 exit1: 4323 path_put(&oldnd.path); 4324 putname(from); 4325 if (should_retry) { 4326 should_retry = false; 4327 lookup_flags |= LOOKUP_REVAL; 4328 goto retry; 4329 } 4330 exit: 4331 return error; 4332 } 4333 4334 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, 4335 int, newdfd, const char __user *, newname) 4336 { 4337 return sys_renameat2(olddfd, oldname, newdfd, newname, 0); 4338 } 4339 4340 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) 4341 { 4342 return sys_renameat2(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 4343 } 4344 4345 int readlink_copy(char __user *buffer, int buflen, const char *link) 4346 { 4347 int len = PTR_ERR(link); 4348 if (IS_ERR(link)) 4349 goto out; 4350 4351 len = strlen(link); 4352 if (len > (unsigned) buflen) 4353 len = buflen; 4354 if (copy_to_user(buffer, link, len)) 4355 len = -EFAULT; 4356 out: 4357 return len; 4358 } 4359 EXPORT_SYMBOL(readlink_copy); 4360 4361 /* 4362 * A helper for ->readlink(). This should be used *ONLY* for symlinks that 4363 * have ->follow_link() touching nd only in nd_set_link(). Using (or not 4364 * using) it for any given inode is up to filesystem. 4365 */ 4366 int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4367 { 4368 struct nameidata nd; 4369 void *cookie; 4370 int res; 4371 4372 nd.depth = 0; 4373 cookie = dentry->d_inode->i_op->follow_link(dentry, &nd); 4374 if (IS_ERR(cookie)) 4375 return PTR_ERR(cookie); 4376 4377 res = readlink_copy(buffer, buflen, nd_get_link(&nd)); 4378 if (dentry->d_inode->i_op->put_link) 4379 dentry->d_inode->i_op->put_link(dentry, &nd, cookie); 4380 return res; 4381 } 4382 EXPORT_SYMBOL(generic_readlink); 4383 4384 /* get the link contents into pagecache */ 4385 static char *page_getlink(struct dentry * dentry, struct page **ppage) 4386 { 4387 char *kaddr; 4388 struct page *page; 4389 struct address_space *mapping = dentry->d_inode->i_mapping; 4390 page = read_mapping_page(mapping, 0, NULL); 4391 if (IS_ERR(page)) 4392 return (char*)page; 4393 *ppage = page; 4394 kaddr = kmap(page); 4395 nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1); 4396 return kaddr; 4397 } 4398 4399 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4400 { 4401 struct page *page = NULL; 4402 int res = readlink_copy(buffer, buflen, page_getlink(dentry, &page)); 4403 if (page) { 4404 kunmap(page); 4405 page_cache_release(page); 4406 } 4407 return res; 4408 } 4409 EXPORT_SYMBOL(page_readlink); 4410 4411 void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd) 4412 { 4413 struct page *page = NULL; 4414 nd_set_link(nd, page_getlink(dentry, &page)); 4415 return page; 4416 } 4417 EXPORT_SYMBOL(page_follow_link_light); 4418 4419 void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie) 4420 { 4421 struct page *page = cookie; 4422 4423 if (page) { 4424 kunmap(page); 4425 page_cache_release(page); 4426 } 4427 } 4428 EXPORT_SYMBOL(page_put_link); 4429 4430 /* 4431 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS 4432 */ 4433 int __page_symlink(struct inode *inode, const char *symname, int len, int nofs) 4434 { 4435 struct address_space *mapping = inode->i_mapping; 4436 struct page *page; 4437 void *fsdata; 4438 int err; 4439 char *kaddr; 4440 unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE; 4441 if (nofs) 4442 flags |= AOP_FLAG_NOFS; 4443 4444 retry: 4445 err = pagecache_write_begin(NULL, mapping, 0, len-1, 4446 flags, &page, &fsdata); 4447 if (err) 4448 goto fail; 4449 4450 kaddr = kmap_atomic(page); 4451 memcpy(kaddr, symname, len-1); 4452 kunmap_atomic(kaddr); 4453 4454 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1, 4455 page, fsdata); 4456 if (err < 0) 4457 goto fail; 4458 if (err < len-1) 4459 goto retry; 4460 4461 mark_inode_dirty(inode); 4462 return 0; 4463 fail: 4464 return err; 4465 } 4466 EXPORT_SYMBOL(__page_symlink); 4467 4468 int page_symlink(struct inode *inode, const char *symname, int len) 4469 { 4470 return __page_symlink(inode, symname, len, 4471 !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS)); 4472 } 4473 EXPORT_SYMBOL(page_symlink); 4474 4475 const struct inode_operations page_symlink_inode_operations = { 4476 .readlink = generic_readlink, 4477 .follow_link = page_follow_link_light, 4478 .put_link = page_put_link, 4479 }; 4480 EXPORT_SYMBOL(page_symlink_inode_operations); 4481