1 /* 2 * linux/fs/namei.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * Some corrections by tytso. 9 */ 10 11 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname 12 * lookup logic. 13 */ 14 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture. 15 */ 16 17 #include <linux/init.h> 18 #include <linux/export.h> 19 #include <linux/kernel.h> 20 #include <linux/slab.h> 21 #include <linux/fs.h> 22 #include <linux/namei.h> 23 #include <linux/pagemap.h> 24 #include <linux/fsnotify.h> 25 #include <linux/personality.h> 26 #include <linux/security.h> 27 #include <linux/ima.h> 28 #include <linux/syscalls.h> 29 #include <linux/mount.h> 30 #include <linux/audit.h> 31 #include <linux/capability.h> 32 #include <linux/file.h> 33 #include <linux/fcntl.h> 34 #include <linux/device_cgroup.h> 35 #include <linux/fs_struct.h> 36 #include <linux/posix_acl.h> 37 #include <asm/uaccess.h> 38 39 #include "internal.h" 40 #include "mount.h" 41 42 /* [Feb-1997 T. Schoebel-Theuer] 43 * Fundamental changes in the pathname lookup mechanisms (namei) 44 * were necessary because of omirr. The reason is that omirr needs 45 * to know the _real_ pathname, not the user-supplied one, in case 46 * of symlinks (and also when transname replacements occur). 47 * 48 * The new code replaces the old recursive symlink resolution with 49 * an iterative one (in case of non-nested symlink chains). It does 50 * this with calls to <fs>_follow_link(). 51 * As a side effect, dir_namei(), _namei() and follow_link() are now 52 * replaced with a single function lookup_dentry() that can handle all 53 * the special cases of the former code. 54 * 55 * With the new dcache, the pathname is stored at each inode, at least as 56 * long as the refcount of the inode is positive. As a side effect, the 57 * size of the dcache depends on the inode cache and thus is dynamic. 58 * 59 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink 60 * resolution to correspond with current state of the code. 61 * 62 * Note that the symlink resolution is not *completely* iterative. 63 * There is still a significant amount of tail- and mid- recursion in 64 * the algorithm. Also, note that <fs>_readlink() is not used in 65 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink() 66 * may return different results than <fs>_follow_link(). Many virtual 67 * filesystems (including /proc) exhibit this behavior. 68 */ 69 70 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation: 71 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL 72 * and the name already exists in form of a symlink, try to create the new 73 * name indicated by the symlink. The old code always complained that the 74 * name already exists, due to not following the symlink even if its target 75 * is nonexistent. The new semantics affects also mknod() and link() when 76 * the name is a symlink pointing to a non-existent name. 77 * 78 * I don't know which semantics is the right one, since I have no access 79 * to standards. But I found by trial that HP-UX 9.0 has the full "new" 80 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the 81 * "old" one. Personally, I think the new semantics is much more logical. 82 * Note that "ln old new" where "new" is a symlink pointing to a non-existing 83 * file does succeed in both HP-UX and SunOs, but not in Solaris 84 * and in the old Linux semantics. 85 */ 86 87 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink 88 * semantics. See the comments in "open_namei" and "do_link" below. 89 * 90 * [10-Sep-98 Alan Modra] Another symlink change. 91 */ 92 93 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks: 94 * inside the path - always follow. 95 * in the last component in creation/removal/renaming - never follow. 96 * if LOOKUP_FOLLOW passed - follow. 97 * if the pathname has trailing slashes - follow. 98 * otherwise - don't follow. 99 * (applied in that order). 100 * 101 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT 102 * restored for 2.4. This is the last surviving part of old 4.2BSD bug. 103 * During the 2.4 we need to fix the userland stuff depending on it - 104 * hopefully we will be able to get rid of that wart in 2.5. So far only 105 * XEmacs seems to be relying on it... 106 */ 107 /* 108 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland) 109 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives 110 * any extra contention... 111 */ 112 113 /* In order to reduce some races, while at the same time doing additional 114 * checking and hopefully speeding things up, we copy filenames to the 115 * kernel data space before using them.. 116 * 117 * POSIX.1 2.4: an empty pathname is invalid (ENOENT). 118 * PATH_MAX includes the nul terminator --RR. 119 */ 120 void final_putname(struct filename *name) 121 { 122 if (name->separate) { 123 __putname(name->name); 124 kfree(name); 125 } else { 126 __putname(name); 127 } 128 } 129 130 #define EMBEDDED_NAME_MAX (PATH_MAX - sizeof(struct filename)) 131 132 static struct filename * 133 getname_flags(const char __user *filename, int flags, int *empty) 134 { 135 struct filename *result, *err; 136 int len; 137 long max; 138 char *kname; 139 140 result = audit_reusename(filename); 141 if (result) 142 return result; 143 144 result = __getname(); 145 if (unlikely(!result)) 146 return ERR_PTR(-ENOMEM); 147 148 /* 149 * First, try to embed the struct filename inside the names_cache 150 * allocation 151 */ 152 kname = (char *)result + sizeof(*result); 153 result->name = kname; 154 result->separate = false; 155 max = EMBEDDED_NAME_MAX; 156 157 recopy: 158 len = strncpy_from_user(kname, filename, max); 159 if (unlikely(len < 0)) { 160 err = ERR_PTR(len); 161 goto error; 162 } 163 164 /* 165 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a 166 * separate struct filename so we can dedicate the entire 167 * names_cache allocation for the pathname, and re-do the copy from 168 * userland. 169 */ 170 if (len == EMBEDDED_NAME_MAX && max == EMBEDDED_NAME_MAX) { 171 kname = (char *)result; 172 173 result = kzalloc(sizeof(*result), GFP_KERNEL); 174 if (!result) { 175 err = ERR_PTR(-ENOMEM); 176 result = (struct filename *)kname; 177 goto error; 178 } 179 result->name = kname; 180 result->separate = true; 181 max = PATH_MAX; 182 goto recopy; 183 } 184 185 /* The empty path is special. */ 186 if (unlikely(!len)) { 187 if (empty) 188 *empty = 1; 189 err = ERR_PTR(-ENOENT); 190 if (!(flags & LOOKUP_EMPTY)) 191 goto error; 192 } 193 194 err = ERR_PTR(-ENAMETOOLONG); 195 if (unlikely(len >= PATH_MAX)) 196 goto error; 197 198 result->uptr = filename; 199 audit_getname(result); 200 return result; 201 202 error: 203 final_putname(result); 204 return err; 205 } 206 207 struct filename * 208 getname(const char __user * filename) 209 { 210 return getname_flags(filename, 0, NULL); 211 } 212 EXPORT_SYMBOL(getname); 213 214 #ifdef CONFIG_AUDITSYSCALL 215 void putname(struct filename *name) 216 { 217 if (unlikely(!audit_dummy_context())) 218 return audit_putname(name); 219 final_putname(name); 220 } 221 #endif 222 223 static int check_acl(struct inode *inode, int mask) 224 { 225 #ifdef CONFIG_FS_POSIX_ACL 226 struct posix_acl *acl; 227 228 if (mask & MAY_NOT_BLOCK) { 229 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS); 230 if (!acl) 231 return -EAGAIN; 232 /* no ->get_acl() calls in RCU mode... */ 233 if (acl == ACL_NOT_CACHED) 234 return -ECHILD; 235 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK); 236 } 237 238 acl = get_cached_acl(inode, ACL_TYPE_ACCESS); 239 240 /* 241 * A filesystem can force a ACL callback by just never filling the 242 * ACL cache. But normally you'd fill the cache either at inode 243 * instantiation time, or on the first ->get_acl call. 244 * 245 * If the filesystem doesn't have a get_acl() function at all, we'll 246 * just create the negative cache entry. 247 */ 248 if (acl == ACL_NOT_CACHED) { 249 if (inode->i_op->get_acl) { 250 acl = inode->i_op->get_acl(inode, ACL_TYPE_ACCESS); 251 if (IS_ERR(acl)) 252 return PTR_ERR(acl); 253 } else { 254 set_cached_acl(inode, ACL_TYPE_ACCESS, NULL); 255 return -EAGAIN; 256 } 257 } 258 259 if (acl) { 260 int error = posix_acl_permission(inode, acl, mask); 261 posix_acl_release(acl); 262 return error; 263 } 264 #endif 265 266 return -EAGAIN; 267 } 268 269 /* 270 * This does the basic permission checking 271 */ 272 static int acl_permission_check(struct inode *inode, int mask) 273 { 274 unsigned int mode = inode->i_mode; 275 276 if (likely(uid_eq(current_fsuid(), inode->i_uid))) 277 mode >>= 6; 278 else { 279 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { 280 int error = check_acl(inode, mask); 281 if (error != -EAGAIN) 282 return error; 283 } 284 285 if (in_group_p(inode->i_gid)) 286 mode >>= 3; 287 } 288 289 /* 290 * If the DACs are ok we don't need any capability check. 291 */ 292 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0) 293 return 0; 294 return -EACCES; 295 } 296 297 /** 298 * generic_permission - check for access rights on a Posix-like filesystem 299 * @inode: inode to check access rights for 300 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...) 301 * 302 * Used to check for read/write/execute permissions on a file. 303 * We use "fsuid" for this, letting us set arbitrary permissions 304 * for filesystem access without changing the "normal" uids which 305 * are used for other things. 306 * 307 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk 308 * request cannot be satisfied (eg. requires blocking or too much complexity). 309 * It would then be called again in ref-walk mode. 310 */ 311 int generic_permission(struct inode *inode, int mask) 312 { 313 int ret; 314 315 /* 316 * Do the basic permission checks. 317 */ 318 ret = acl_permission_check(inode, mask); 319 if (ret != -EACCES) 320 return ret; 321 322 if (S_ISDIR(inode->i_mode)) { 323 /* DACs are overridable for directories */ 324 if (inode_capable(inode, CAP_DAC_OVERRIDE)) 325 return 0; 326 if (!(mask & MAY_WRITE)) 327 if (inode_capable(inode, CAP_DAC_READ_SEARCH)) 328 return 0; 329 return -EACCES; 330 } 331 /* 332 * Read/write DACs are always overridable. 333 * Executable DACs are overridable when there is 334 * at least one exec bit set. 335 */ 336 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 337 if (inode_capable(inode, CAP_DAC_OVERRIDE)) 338 return 0; 339 340 /* 341 * Searching includes executable on directories, else just read. 342 */ 343 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 344 if (mask == MAY_READ) 345 if (inode_capable(inode, CAP_DAC_READ_SEARCH)) 346 return 0; 347 348 return -EACCES; 349 } 350 351 /* 352 * We _really_ want to just do "generic_permission()" without 353 * even looking at the inode->i_op values. So we keep a cache 354 * flag in inode->i_opflags, that says "this has not special 355 * permission function, use the fast case". 356 */ 357 static inline int do_inode_permission(struct inode *inode, int mask) 358 { 359 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) { 360 if (likely(inode->i_op->permission)) 361 return inode->i_op->permission(inode, mask); 362 363 /* This gets set once for the inode lifetime */ 364 spin_lock(&inode->i_lock); 365 inode->i_opflags |= IOP_FASTPERM; 366 spin_unlock(&inode->i_lock); 367 } 368 return generic_permission(inode, mask); 369 } 370 371 /** 372 * __inode_permission - Check for access rights to a given inode 373 * @inode: Inode to check permission on 374 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 375 * 376 * Check for read/write/execute permissions on an inode. 377 * 378 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 379 * 380 * This does not check for a read-only file system. You probably want 381 * inode_permission(). 382 */ 383 int __inode_permission(struct inode *inode, int mask) 384 { 385 int retval; 386 387 if (unlikely(mask & MAY_WRITE)) { 388 /* 389 * Nobody gets write access to an immutable file. 390 */ 391 if (IS_IMMUTABLE(inode)) 392 return -EACCES; 393 } 394 395 retval = do_inode_permission(inode, mask); 396 if (retval) 397 return retval; 398 399 retval = devcgroup_inode_permission(inode, mask); 400 if (retval) 401 return retval; 402 403 return security_inode_permission(inode, mask); 404 } 405 406 /** 407 * sb_permission - Check superblock-level permissions 408 * @sb: Superblock of inode to check permission on 409 * @inode: Inode to check permission on 410 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 411 * 412 * Separate out file-system wide checks from inode-specific permission checks. 413 */ 414 static int sb_permission(struct super_block *sb, struct inode *inode, int mask) 415 { 416 if (unlikely(mask & MAY_WRITE)) { 417 umode_t mode = inode->i_mode; 418 419 /* Nobody gets write access to a read-only fs. */ 420 if ((sb->s_flags & MS_RDONLY) && 421 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) 422 return -EROFS; 423 } 424 return 0; 425 } 426 427 /** 428 * inode_permission - Check for access rights to a given inode 429 * @inode: Inode to check permission on 430 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 431 * 432 * Check for read/write/execute permissions on an inode. We use fs[ug]id for 433 * this, letting us set arbitrary permissions for filesystem access without 434 * changing the "normal" UIDs which are used for other things. 435 * 436 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 437 */ 438 int inode_permission(struct inode *inode, int mask) 439 { 440 int retval; 441 442 retval = sb_permission(inode->i_sb, inode, mask); 443 if (retval) 444 return retval; 445 return __inode_permission(inode, mask); 446 } 447 448 /** 449 * path_get - get a reference to a path 450 * @path: path to get the reference to 451 * 452 * Given a path increment the reference count to the dentry and the vfsmount. 453 */ 454 void path_get(const struct path *path) 455 { 456 mntget(path->mnt); 457 dget(path->dentry); 458 } 459 EXPORT_SYMBOL(path_get); 460 461 /** 462 * path_put - put a reference to a path 463 * @path: path to put the reference to 464 * 465 * Given a path decrement the reference count to the dentry and the vfsmount. 466 */ 467 void path_put(const struct path *path) 468 { 469 dput(path->dentry); 470 mntput(path->mnt); 471 } 472 EXPORT_SYMBOL(path_put); 473 474 /* 475 * Path walking has 2 modes, rcu-walk and ref-walk (see 476 * Documentation/filesystems/path-lookup.txt). In situations when we can't 477 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab 478 * normal reference counts on dentries and vfsmounts to transition to rcu-walk 479 * mode. Refcounts are grabbed at the last known good point before rcu-walk 480 * got stuck, so ref-walk may continue from there. If this is not successful 481 * (eg. a seqcount has changed), then failure is returned and it's up to caller 482 * to restart the path walk from the beginning in ref-walk mode. 483 */ 484 485 /** 486 * unlazy_walk - try to switch to ref-walk mode. 487 * @nd: nameidata pathwalk data 488 * @dentry: child of nd->path.dentry or NULL 489 * Returns: 0 on success, -ECHILD on failure 490 * 491 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry 492 * for ref-walk mode. @dentry must be a path found by a do_lookup call on 493 * @nd or NULL. Must be called from rcu-walk context. 494 */ 495 static int unlazy_walk(struct nameidata *nd, struct dentry *dentry) 496 { 497 struct fs_struct *fs = current->fs; 498 struct dentry *parent = nd->path.dentry; 499 500 BUG_ON(!(nd->flags & LOOKUP_RCU)); 501 502 /* 503 * After legitimizing the bastards, terminate_walk() 504 * will do the right thing for non-RCU mode, and all our 505 * subsequent exit cases should rcu_read_unlock() 506 * before returning. Do vfsmount first; if dentry 507 * can't be legitimized, just set nd->path.dentry to NULL 508 * and rely on dput(NULL) being a no-op. 509 */ 510 if (!legitimize_mnt(nd->path.mnt, nd->m_seq)) 511 return -ECHILD; 512 nd->flags &= ~LOOKUP_RCU; 513 514 if (!lockref_get_not_dead(&parent->d_lockref)) { 515 nd->path.dentry = NULL; 516 goto out; 517 } 518 519 /* 520 * For a negative lookup, the lookup sequence point is the parents 521 * sequence point, and it only needs to revalidate the parent dentry. 522 * 523 * For a positive lookup, we need to move both the parent and the 524 * dentry from the RCU domain to be properly refcounted. And the 525 * sequence number in the dentry validates *both* dentry counters, 526 * since we checked the sequence number of the parent after we got 527 * the child sequence number. So we know the parent must still 528 * be valid if the child sequence number is still valid. 529 */ 530 if (!dentry) { 531 if (read_seqcount_retry(&parent->d_seq, nd->seq)) 532 goto out; 533 BUG_ON(nd->inode != parent->d_inode); 534 } else { 535 if (!lockref_get_not_dead(&dentry->d_lockref)) 536 goto out; 537 if (read_seqcount_retry(&dentry->d_seq, nd->seq)) 538 goto drop_dentry; 539 } 540 541 /* 542 * Sequence counts matched. Now make sure that the root is 543 * still valid and get it if required. 544 */ 545 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 546 spin_lock(&fs->lock); 547 if (nd->root.mnt != fs->root.mnt || nd->root.dentry != fs->root.dentry) 548 goto unlock_and_drop_dentry; 549 path_get(&nd->root); 550 spin_unlock(&fs->lock); 551 } 552 553 rcu_read_unlock(); 554 return 0; 555 556 unlock_and_drop_dentry: 557 spin_unlock(&fs->lock); 558 drop_dentry: 559 rcu_read_unlock(); 560 dput(dentry); 561 goto drop_root_mnt; 562 out: 563 rcu_read_unlock(); 564 drop_root_mnt: 565 if (!(nd->flags & LOOKUP_ROOT)) 566 nd->root.mnt = NULL; 567 return -ECHILD; 568 } 569 570 static inline int d_revalidate(struct dentry *dentry, unsigned int flags) 571 { 572 return dentry->d_op->d_revalidate(dentry, flags); 573 } 574 575 /** 576 * complete_walk - successful completion of path walk 577 * @nd: pointer nameidata 578 * 579 * If we had been in RCU mode, drop out of it and legitimize nd->path. 580 * Revalidate the final result, unless we'd already done that during 581 * the path walk or the filesystem doesn't ask for it. Return 0 on 582 * success, -error on failure. In case of failure caller does not 583 * need to drop nd->path. 584 */ 585 static int complete_walk(struct nameidata *nd) 586 { 587 struct dentry *dentry = nd->path.dentry; 588 int status; 589 590 if (nd->flags & LOOKUP_RCU) { 591 nd->flags &= ~LOOKUP_RCU; 592 if (!(nd->flags & LOOKUP_ROOT)) 593 nd->root.mnt = NULL; 594 595 if (!legitimize_mnt(nd->path.mnt, nd->m_seq)) { 596 rcu_read_unlock(); 597 return -ECHILD; 598 } 599 if (unlikely(!lockref_get_not_dead(&dentry->d_lockref))) { 600 rcu_read_unlock(); 601 mntput(nd->path.mnt); 602 return -ECHILD; 603 } 604 if (read_seqcount_retry(&dentry->d_seq, nd->seq)) { 605 rcu_read_unlock(); 606 dput(dentry); 607 mntput(nd->path.mnt); 608 return -ECHILD; 609 } 610 rcu_read_unlock(); 611 } 612 613 if (likely(!(nd->flags & LOOKUP_JUMPED))) 614 return 0; 615 616 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE))) 617 return 0; 618 619 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags); 620 if (status > 0) 621 return 0; 622 623 if (!status) 624 status = -ESTALE; 625 626 path_put(&nd->path); 627 return status; 628 } 629 630 static __always_inline void set_root(struct nameidata *nd) 631 { 632 if (!nd->root.mnt) 633 get_fs_root(current->fs, &nd->root); 634 } 635 636 static int link_path_walk(const char *, struct nameidata *); 637 638 static __always_inline void set_root_rcu(struct nameidata *nd) 639 { 640 if (!nd->root.mnt) { 641 struct fs_struct *fs = current->fs; 642 unsigned seq; 643 644 do { 645 seq = read_seqcount_begin(&fs->seq); 646 nd->root = fs->root; 647 nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq); 648 } while (read_seqcount_retry(&fs->seq, seq)); 649 } 650 } 651 652 static void path_put_conditional(struct path *path, struct nameidata *nd) 653 { 654 dput(path->dentry); 655 if (path->mnt != nd->path.mnt) 656 mntput(path->mnt); 657 } 658 659 static inline void path_to_nameidata(const struct path *path, 660 struct nameidata *nd) 661 { 662 if (!(nd->flags & LOOKUP_RCU)) { 663 dput(nd->path.dentry); 664 if (nd->path.mnt != path->mnt) 665 mntput(nd->path.mnt); 666 } 667 nd->path.mnt = path->mnt; 668 nd->path.dentry = path->dentry; 669 } 670 671 /* 672 * Helper to directly jump to a known parsed path from ->follow_link, 673 * caller must have taken a reference to path beforehand. 674 */ 675 void nd_jump_link(struct nameidata *nd, struct path *path) 676 { 677 path_put(&nd->path); 678 679 nd->path = *path; 680 nd->inode = nd->path.dentry->d_inode; 681 nd->flags |= LOOKUP_JUMPED; 682 } 683 684 static inline void put_link(struct nameidata *nd, struct path *link, void *cookie) 685 { 686 struct inode *inode = link->dentry->d_inode; 687 if (inode->i_op->put_link) 688 inode->i_op->put_link(link->dentry, nd, cookie); 689 path_put(link); 690 } 691 692 int sysctl_protected_symlinks __read_mostly = 0; 693 int sysctl_protected_hardlinks __read_mostly = 0; 694 695 /** 696 * may_follow_link - Check symlink following for unsafe situations 697 * @link: The path of the symlink 698 * @nd: nameidata pathwalk data 699 * 700 * In the case of the sysctl_protected_symlinks sysctl being enabled, 701 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is 702 * in a sticky world-writable directory. This is to protect privileged 703 * processes from failing races against path names that may change out 704 * from under them by way of other users creating malicious symlinks. 705 * It will permit symlinks to be followed only when outside a sticky 706 * world-writable directory, or when the uid of the symlink and follower 707 * match, or when the directory owner matches the symlink's owner. 708 * 709 * Returns 0 if following the symlink is allowed, -ve on error. 710 */ 711 static inline int may_follow_link(struct path *link, struct nameidata *nd) 712 { 713 const struct inode *inode; 714 const struct inode *parent; 715 716 if (!sysctl_protected_symlinks) 717 return 0; 718 719 /* Allowed if owner and follower match. */ 720 inode = link->dentry->d_inode; 721 if (uid_eq(current_cred()->fsuid, inode->i_uid)) 722 return 0; 723 724 /* Allowed if parent directory not sticky and world-writable. */ 725 parent = nd->path.dentry->d_inode; 726 if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH)) 727 return 0; 728 729 /* Allowed if parent directory and link owner match. */ 730 if (uid_eq(parent->i_uid, inode->i_uid)) 731 return 0; 732 733 audit_log_link_denied("follow_link", link); 734 path_put_conditional(link, nd); 735 path_put(&nd->path); 736 return -EACCES; 737 } 738 739 /** 740 * safe_hardlink_source - Check for safe hardlink conditions 741 * @inode: the source inode to hardlink from 742 * 743 * Return false if at least one of the following conditions: 744 * - inode is not a regular file 745 * - inode is setuid 746 * - inode is setgid and group-exec 747 * - access failure for read and write 748 * 749 * Otherwise returns true. 750 */ 751 static bool safe_hardlink_source(struct inode *inode) 752 { 753 umode_t mode = inode->i_mode; 754 755 /* Special files should not get pinned to the filesystem. */ 756 if (!S_ISREG(mode)) 757 return false; 758 759 /* Setuid files should not get pinned to the filesystem. */ 760 if (mode & S_ISUID) 761 return false; 762 763 /* Executable setgid files should not get pinned to the filesystem. */ 764 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) 765 return false; 766 767 /* Hardlinking to unreadable or unwritable sources is dangerous. */ 768 if (inode_permission(inode, MAY_READ | MAY_WRITE)) 769 return false; 770 771 return true; 772 } 773 774 /** 775 * may_linkat - Check permissions for creating a hardlink 776 * @link: the source to hardlink from 777 * 778 * Block hardlink when all of: 779 * - sysctl_protected_hardlinks enabled 780 * - fsuid does not match inode 781 * - hardlink source is unsafe (see safe_hardlink_source() above) 782 * - not CAP_FOWNER 783 * 784 * Returns 0 if successful, -ve on error. 785 */ 786 static int may_linkat(struct path *link) 787 { 788 const struct cred *cred; 789 struct inode *inode; 790 791 if (!sysctl_protected_hardlinks) 792 return 0; 793 794 cred = current_cred(); 795 inode = link->dentry->d_inode; 796 797 /* Source inode owner (or CAP_FOWNER) can hardlink all they like, 798 * otherwise, it must be a safe source. 799 */ 800 if (uid_eq(cred->fsuid, inode->i_uid) || safe_hardlink_source(inode) || 801 capable(CAP_FOWNER)) 802 return 0; 803 804 audit_log_link_denied("linkat", link); 805 return -EPERM; 806 } 807 808 static __always_inline int 809 follow_link(struct path *link, struct nameidata *nd, void **p) 810 { 811 struct dentry *dentry = link->dentry; 812 int error; 813 char *s; 814 815 BUG_ON(nd->flags & LOOKUP_RCU); 816 817 if (link->mnt == nd->path.mnt) 818 mntget(link->mnt); 819 820 error = -ELOOP; 821 if (unlikely(current->total_link_count >= 40)) 822 goto out_put_nd_path; 823 824 cond_resched(); 825 current->total_link_count++; 826 827 touch_atime(link); 828 nd_set_link(nd, NULL); 829 830 error = security_inode_follow_link(link->dentry, nd); 831 if (error) 832 goto out_put_nd_path; 833 834 nd->last_type = LAST_BIND; 835 *p = dentry->d_inode->i_op->follow_link(dentry, nd); 836 error = PTR_ERR(*p); 837 if (IS_ERR(*p)) 838 goto out_put_nd_path; 839 840 error = 0; 841 s = nd_get_link(nd); 842 if (s) { 843 if (unlikely(IS_ERR(s))) { 844 path_put(&nd->path); 845 put_link(nd, link, *p); 846 return PTR_ERR(s); 847 } 848 if (*s == '/') { 849 set_root(nd); 850 path_put(&nd->path); 851 nd->path = nd->root; 852 path_get(&nd->root); 853 nd->flags |= LOOKUP_JUMPED; 854 } 855 nd->inode = nd->path.dentry->d_inode; 856 error = link_path_walk(s, nd); 857 if (unlikely(error)) 858 put_link(nd, link, *p); 859 } 860 861 return error; 862 863 out_put_nd_path: 864 *p = NULL; 865 path_put(&nd->path); 866 path_put(link); 867 return error; 868 } 869 870 static int follow_up_rcu(struct path *path) 871 { 872 struct mount *mnt = real_mount(path->mnt); 873 struct mount *parent; 874 struct dentry *mountpoint; 875 876 parent = mnt->mnt_parent; 877 if (&parent->mnt == path->mnt) 878 return 0; 879 mountpoint = mnt->mnt_mountpoint; 880 path->dentry = mountpoint; 881 path->mnt = &parent->mnt; 882 return 1; 883 } 884 885 /* 886 * follow_up - Find the mountpoint of path's vfsmount 887 * 888 * Given a path, find the mountpoint of its source file system. 889 * Replace @path with the path of the mountpoint in the parent mount. 890 * Up is towards /. 891 * 892 * Return 1 if we went up a level and 0 if we were already at the 893 * root. 894 */ 895 int follow_up(struct path *path) 896 { 897 struct mount *mnt = real_mount(path->mnt); 898 struct mount *parent; 899 struct dentry *mountpoint; 900 901 read_seqlock_excl(&mount_lock); 902 parent = mnt->mnt_parent; 903 if (parent == mnt) { 904 read_sequnlock_excl(&mount_lock); 905 return 0; 906 } 907 mntget(&parent->mnt); 908 mountpoint = dget(mnt->mnt_mountpoint); 909 read_sequnlock_excl(&mount_lock); 910 dput(path->dentry); 911 path->dentry = mountpoint; 912 mntput(path->mnt); 913 path->mnt = &parent->mnt; 914 return 1; 915 } 916 917 /* 918 * Perform an automount 919 * - return -EISDIR to tell follow_managed() to stop and return the path we 920 * were called with. 921 */ 922 static int follow_automount(struct path *path, unsigned flags, 923 bool *need_mntput) 924 { 925 struct vfsmount *mnt; 926 int err; 927 928 if (!path->dentry->d_op || !path->dentry->d_op->d_automount) 929 return -EREMOTE; 930 931 /* We don't want to mount if someone's just doing a stat - 932 * unless they're stat'ing a directory and appended a '/' to 933 * the name. 934 * 935 * We do, however, want to mount if someone wants to open or 936 * create a file of any type under the mountpoint, wants to 937 * traverse through the mountpoint or wants to open the 938 * mounted directory. Also, autofs may mark negative dentries 939 * as being automount points. These will need the attentions 940 * of the daemon to instantiate them before they can be used. 941 */ 942 if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | 943 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) && 944 path->dentry->d_inode) 945 return -EISDIR; 946 947 current->total_link_count++; 948 if (current->total_link_count >= 40) 949 return -ELOOP; 950 951 mnt = path->dentry->d_op->d_automount(path); 952 if (IS_ERR(mnt)) { 953 /* 954 * The filesystem is allowed to return -EISDIR here to indicate 955 * it doesn't want to automount. For instance, autofs would do 956 * this so that its userspace daemon can mount on this dentry. 957 * 958 * However, we can only permit this if it's a terminal point in 959 * the path being looked up; if it wasn't then the remainder of 960 * the path is inaccessible and we should say so. 961 */ 962 if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT)) 963 return -EREMOTE; 964 return PTR_ERR(mnt); 965 } 966 967 if (!mnt) /* mount collision */ 968 return 0; 969 970 if (!*need_mntput) { 971 /* lock_mount() may release path->mnt on error */ 972 mntget(path->mnt); 973 *need_mntput = true; 974 } 975 err = finish_automount(mnt, path); 976 977 switch (err) { 978 case -EBUSY: 979 /* Someone else made a mount here whilst we were busy */ 980 return 0; 981 case 0: 982 path_put(path); 983 path->mnt = mnt; 984 path->dentry = dget(mnt->mnt_root); 985 return 0; 986 default: 987 return err; 988 } 989 990 } 991 992 /* 993 * Handle a dentry that is managed in some way. 994 * - Flagged for transit management (autofs) 995 * - Flagged as mountpoint 996 * - Flagged as automount point 997 * 998 * This may only be called in refwalk mode. 999 * 1000 * Serialization is taken care of in namespace.c 1001 */ 1002 static int follow_managed(struct path *path, unsigned flags) 1003 { 1004 struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */ 1005 unsigned managed; 1006 bool need_mntput = false; 1007 int ret = 0; 1008 1009 /* Given that we're not holding a lock here, we retain the value in a 1010 * local variable for each dentry as we look at it so that we don't see 1011 * the components of that value change under us */ 1012 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1013 managed &= DCACHE_MANAGED_DENTRY, 1014 unlikely(managed != 0)) { 1015 /* Allow the filesystem to manage the transit without i_mutex 1016 * being held. */ 1017 if (managed & DCACHE_MANAGE_TRANSIT) { 1018 BUG_ON(!path->dentry->d_op); 1019 BUG_ON(!path->dentry->d_op->d_manage); 1020 ret = path->dentry->d_op->d_manage(path->dentry, false); 1021 if (ret < 0) 1022 break; 1023 } 1024 1025 /* Transit to a mounted filesystem. */ 1026 if (managed & DCACHE_MOUNTED) { 1027 struct vfsmount *mounted = lookup_mnt(path); 1028 if (mounted) { 1029 dput(path->dentry); 1030 if (need_mntput) 1031 mntput(path->mnt); 1032 path->mnt = mounted; 1033 path->dentry = dget(mounted->mnt_root); 1034 need_mntput = true; 1035 continue; 1036 } 1037 1038 /* Something is mounted on this dentry in another 1039 * namespace and/or whatever was mounted there in this 1040 * namespace got unmounted before lookup_mnt() could 1041 * get it */ 1042 } 1043 1044 /* Handle an automount point */ 1045 if (managed & DCACHE_NEED_AUTOMOUNT) { 1046 ret = follow_automount(path, flags, &need_mntput); 1047 if (ret < 0) 1048 break; 1049 continue; 1050 } 1051 1052 /* We didn't change the current path point */ 1053 break; 1054 } 1055 1056 if (need_mntput && path->mnt == mnt) 1057 mntput(path->mnt); 1058 if (ret == -EISDIR) 1059 ret = 0; 1060 return ret < 0 ? ret : need_mntput; 1061 } 1062 1063 int follow_down_one(struct path *path) 1064 { 1065 struct vfsmount *mounted; 1066 1067 mounted = lookup_mnt(path); 1068 if (mounted) { 1069 dput(path->dentry); 1070 mntput(path->mnt); 1071 path->mnt = mounted; 1072 path->dentry = dget(mounted->mnt_root); 1073 return 1; 1074 } 1075 return 0; 1076 } 1077 1078 static inline bool managed_dentry_might_block(struct dentry *dentry) 1079 { 1080 return (dentry->d_flags & DCACHE_MANAGE_TRANSIT && 1081 dentry->d_op->d_manage(dentry, true) < 0); 1082 } 1083 1084 /* 1085 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if 1086 * we meet a managed dentry that would need blocking. 1087 */ 1088 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, 1089 struct inode **inode) 1090 { 1091 for (;;) { 1092 struct mount *mounted; 1093 /* 1094 * Don't forget we might have a non-mountpoint managed dentry 1095 * that wants to block transit. 1096 */ 1097 if (unlikely(managed_dentry_might_block(path->dentry))) 1098 return false; 1099 1100 if (!d_mountpoint(path->dentry)) 1101 break; 1102 1103 mounted = __lookup_mnt(path->mnt, path->dentry); 1104 if (!mounted) 1105 break; 1106 path->mnt = &mounted->mnt; 1107 path->dentry = mounted->mnt.mnt_root; 1108 nd->flags |= LOOKUP_JUMPED; 1109 nd->seq = read_seqcount_begin(&path->dentry->d_seq); 1110 /* 1111 * Update the inode too. We don't need to re-check the 1112 * dentry sequence number here after this d_inode read, 1113 * because a mount-point is always pinned. 1114 */ 1115 *inode = path->dentry->d_inode; 1116 } 1117 return true; 1118 } 1119 1120 static void follow_mount_rcu(struct nameidata *nd) 1121 { 1122 while (d_mountpoint(nd->path.dentry)) { 1123 struct mount *mounted; 1124 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry); 1125 if (!mounted) 1126 break; 1127 nd->path.mnt = &mounted->mnt; 1128 nd->path.dentry = mounted->mnt.mnt_root; 1129 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 1130 } 1131 } 1132 1133 static int follow_dotdot_rcu(struct nameidata *nd) 1134 { 1135 set_root_rcu(nd); 1136 1137 while (1) { 1138 if (nd->path.dentry == nd->root.dentry && 1139 nd->path.mnt == nd->root.mnt) { 1140 break; 1141 } 1142 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1143 struct dentry *old = nd->path.dentry; 1144 struct dentry *parent = old->d_parent; 1145 unsigned seq; 1146 1147 seq = read_seqcount_begin(&parent->d_seq); 1148 if (read_seqcount_retry(&old->d_seq, nd->seq)) 1149 goto failed; 1150 nd->path.dentry = parent; 1151 nd->seq = seq; 1152 break; 1153 } 1154 if (!follow_up_rcu(&nd->path)) 1155 break; 1156 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 1157 } 1158 follow_mount_rcu(nd); 1159 nd->inode = nd->path.dentry->d_inode; 1160 return 0; 1161 1162 failed: 1163 nd->flags &= ~LOOKUP_RCU; 1164 if (!(nd->flags & LOOKUP_ROOT)) 1165 nd->root.mnt = NULL; 1166 rcu_read_unlock(); 1167 return -ECHILD; 1168 } 1169 1170 /* 1171 * Follow down to the covering mount currently visible to userspace. At each 1172 * point, the filesystem owning that dentry may be queried as to whether the 1173 * caller is permitted to proceed or not. 1174 */ 1175 int follow_down(struct path *path) 1176 { 1177 unsigned managed; 1178 int ret; 1179 1180 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1181 unlikely(managed & DCACHE_MANAGED_DENTRY)) { 1182 /* Allow the filesystem to manage the transit without i_mutex 1183 * being held. 1184 * 1185 * We indicate to the filesystem if someone is trying to mount 1186 * something here. This gives autofs the chance to deny anyone 1187 * other than its daemon the right to mount on its 1188 * superstructure. 1189 * 1190 * The filesystem may sleep at this point. 1191 */ 1192 if (managed & DCACHE_MANAGE_TRANSIT) { 1193 BUG_ON(!path->dentry->d_op); 1194 BUG_ON(!path->dentry->d_op->d_manage); 1195 ret = path->dentry->d_op->d_manage( 1196 path->dentry, false); 1197 if (ret < 0) 1198 return ret == -EISDIR ? 0 : ret; 1199 } 1200 1201 /* Transit to a mounted filesystem. */ 1202 if (managed & DCACHE_MOUNTED) { 1203 struct vfsmount *mounted = lookup_mnt(path); 1204 if (!mounted) 1205 break; 1206 dput(path->dentry); 1207 mntput(path->mnt); 1208 path->mnt = mounted; 1209 path->dentry = dget(mounted->mnt_root); 1210 continue; 1211 } 1212 1213 /* Don't handle automount points here */ 1214 break; 1215 } 1216 return 0; 1217 } 1218 1219 /* 1220 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot() 1221 */ 1222 static void follow_mount(struct path *path) 1223 { 1224 while (d_mountpoint(path->dentry)) { 1225 struct vfsmount *mounted = lookup_mnt(path); 1226 if (!mounted) 1227 break; 1228 dput(path->dentry); 1229 mntput(path->mnt); 1230 path->mnt = mounted; 1231 path->dentry = dget(mounted->mnt_root); 1232 } 1233 } 1234 1235 static void follow_dotdot(struct nameidata *nd) 1236 { 1237 set_root(nd); 1238 1239 while(1) { 1240 struct dentry *old = nd->path.dentry; 1241 1242 if (nd->path.dentry == nd->root.dentry && 1243 nd->path.mnt == nd->root.mnt) { 1244 break; 1245 } 1246 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1247 /* rare case of legitimate dget_parent()... */ 1248 nd->path.dentry = dget_parent(nd->path.dentry); 1249 dput(old); 1250 break; 1251 } 1252 if (!follow_up(&nd->path)) 1253 break; 1254 } 1255 follow_mount(&nd->path); 1256 nd->inode = nd->path.dentry->d_inode; 1257 } 1258 1259 /* 1260 * This looks up the name in dcache, possibly revalidates the old dentry and 1261 * allocates a new one if not found or not valid. In the need_lookup argument 1262 * returns whether i_op->lookup is necessary. 1263 * 1264 * dir->d_inode->i_mutex must be held 1265 */ 1266 static struct dentry *lookup_dcache(struct qstr *name, struct dentry *dir, 1267 unsigned int flags, bool *need_lookup) 1268 { 1269 struct dentry *dentry; 1270 int error; 1271 1272 *need_lookup = false; 1273 dentry = d_lookup(dir, name); 1274 if (dentry) { 1275 if (dentry->d_flags & DCACHE_OP_REVALIDATE) { 1276 error = d_revalidate(dentry, flags); 1277 if (unlikely(error <= 0)) { 1278 if (error < 0) { 1279 dput(dentry); 1280 return ERR_PTR(error); 1281 } else if (!d_invalidate(dentry)) { 1282 dput(dentry); 1283 dentry = NULL; 1284 } 1285 } 1286 } 1287 } 1288 1289 if (!dentry) { 1290 dentry = d_alloc(dir, name); 1291 if (unlikely(!dentry)) 1292 return ERR_PTR(-ENOMEM); 1293 1294 *need_lookup = true; 1295 } 1296 return dentry; 1297 } 1298 1299 /* 1300 * Call i_op->lookup on the dentry. The dentry must be negative and 1301 * unhashed. 1302 * 1303 * dir->d_inode->i_mutex must be held 1304 */ 1305 static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry, 1306 unsigned int flags) 1307 { 1308 struct dentry *old; 1309 1310 /* Don't create child dentry for a dead directory. */ 1311 if (unlikely(IS_DEADDIR(dir))) { 1312 dput(dentry); 1313 return ERR_PTR(-ENOENT); 1314 } 1315 1316 old = dir->i_op->lookup(dir, dentry, flags); 1317 if (unlikely(old)) { 1318 dput(dentry); 1319 dentry = old; 1320 } 1321 return dentry; 1322 } 1323 1324 static struct dentry *__lookup_hash(struct qstr *name, 1325 struct dentry *base, unsigned int flags) 1326 { 1327 bool need_lookup; 1328 struct dentry *dentry; 1329 1330 dentry = lookup_dcache(name, base, flags, &need_lookup); 1331 if (!need_lookup) 1332 return dentry; 1333 1334 return lookup_real(base->d_inode, dentry, flags); 1335 } 1336 1337 /* 1338 * It's more convoluted than I'd like it to be, but... it's still fairly 1339 * small and for now I'd prefer to have fast path as straight as possible. 1340 * It _is_ time-critical. 1341 */ 1342 static int lookup_fast(struct nameidata *nd, 1343 struct path *path, struct inode **inode) 1344 { 1345 struct vfsmount *mnt = nd->path.mnt; 1346 struct dentry *dentry, *parent = nd->path.dentry; 1347 int need_reval = 1; 1348 int status = 1; 1349 int err; 1350 1351 /* 1352 * Rename seqlock is not required here because in the off chance 1353 * of a false negative due to a concurrent rename, we're going to 1354 * do the non-racy lookup, below. 1355 */ 1356 if (nd->flags & LOOKUP_RCU) { 1357 unsigned seq; 1358 dentry = __d_lookup_rcu(parent, &nd->last, &seq); 1359 if (!dentry) 1360 goto unlazy; 1361 1362 /* 1363 * This sequence count validates that the inode matches 1364 * the dentry name information from lookup. 1365 */ 1366 *inode = dentry->d_inode; 1367 if (read_seqcount_retry(&dentry->d_seq, seq)) 1368 return -ECHILD; 1369 1370 /* 1371 * This sequence count validates that the parent had no 1372 * changes while we did the lookup of the dentry above. 1373 * 1374 * The memory barrier in read_seqcount_begin of child is 1375 * enough, we can use __read_seqcount_retry here. 1376 */ 1377 if (__read_seqcount_retry(&parent->d_seq, nd->seq)) 1378 return -ECHILD; 1379 nd->seq = seq; 1380 1381 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) { 1382 status = d_revalidate(dentry, nd->flags); 1383 if (unlikely(status <= 0)) { 1384 if (status != -ECHILD) 1385 need_reval = 0; 1386 goto unlazy; 1387 } 1388 } 1389 path->mnt = mnt; 1390 path->dentry = dentry; 1391 if (unlikely(!__follow_mount_rcu(nd, path, inode))) 1392 goto unlazy; 1393 if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT)) 1394 goto unlazy; 1395 return 0; 1396 unlazy: 1397 if (unlazy_walk(nd, dentry)) 1398 return -ECHILD; 1399 } else { 1400 dentry = __d_lookup(parent, &nd->last); 1401 } 1402 1403 if (unlikely(!dentry)) 1404 goto need_lookup; 1405 1406 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval) 1407 status = d_revalidate(dentry, nd->flags); 1408 if (unlikely(status <= 0)) { 1409 if (status < 0) { 1410 dput(dentry); 1411 return status; 1412 } 1413 if (!d_invalidate(dentry)) { 1414 dput(dentry); 1415 goto need_lookup; 1416 } 1417 } 1418 1419 path->mnt = mnt; 1420 path->dentry = dentry; 1421 err = follow_managed(path, nd->flags); 1422 if (unlikely(err < 0)) { 1423 path_put_conditional(path, nd); 1424 return err; 1425 } 1426 if (err) 1427 nd->flags |= LOOKUP_JUMPED; 1428 *inode = path->dentry->d_inode; 1429 return 0; 1430 1431 need_lookup: 1432 return 1; 1433 } 1434 1435 /* Fast lookup failed, do it the slow way */ 1436 static int lookup_slow(struct nameidata *nd, struct path *path) 1437 { 1438 struct dentry *dentry, *parent; 1439 int err; 1440 1441 parent = nd->path.dentry; 1442 BUG_ON(nd->inode != parent->d_inode); 1443 1444 mutex_lock(&parent->d_inode->i_mutex); 1445 dentry = __lookup_hash(&nd->last, parent, nd->flags); 1446 mutex_unlock(&parent->d_inode->i_mutex); 1447 if (IS_ERR(dentry)) 1448 return PTR_ERR(dentry); 1449 path->mnt = nd->path.mnt; 1450 path->dentry = dentry; 1451 err = follow_managed(path, nd->flags); 1452 if (unlikely(err < 0)) { 1453 path_put_conditional(path, nd); 1454 return err; 1455 } 1456 if (err) 1457 nd->flags |= LOOKUP_JUMPED; 1458 return 0; 1459 } 1460 1461 static inline int may_lookup(struct nameidata *nd) 1462 { 1463 if (nd->flags & LOOKUP_RCU) { 1464 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK); 1465 if (err != -ECHILD) 1466 return err; 1467 if (unlazy_walk(nd, NULL)) 1468 return -ECHILD; 1469 } 1470 return inode_permission(nd->inode, MAY_EXEC); 1471 } 1472 1473 static inline int handle_dots(struct nameidata *nd, int type) 1474 { 1475 if (type == LAST_DOTDOT) { 1476 if (nd->flags & LOOKUP_RCU) { 1477 if (follow_dotdot_rcu(nd)) 1478 return -ECHILD; 1479 } else 1480 follow_dotdot(nd); 1481 } 1482 return 0; 1483 } 1484 1485 static void terminate_walk(struct nameidata *nd) 1486 { 1487 if (!(nd->flags & LOOKUP_RCU)) { 1488 path_put(&nd->path); 1489 } else { 1490 nd->flags &= ~LOOKUP_RCU; 1491 if (!(nd->flags & LOOKUP_ROOT)) 1492 nd->root.mnt = NULL; 1493 rcu_read_unlock(); 1494 } 1495 } 1496 1497 /* 1498 * Do we need to follow links? We _really_ want to be able 1499 * to do this check without having to look at inode->i_op, 1500 * so we keep a cache of "no, this doesn't need follow_link" 1501 * for the common case. 1502 */ 1503 static inline int should_follow_link(struct dentry *dentry, int follow) 1504 { 1505 return unlikely(d_is_symlink(dentry)) ? follow : 0; 1506 } 1507 1508 static inline int walk_component(struct nameidata *nd, struct path *path, 1509 int follow) 1510 { 1511 struct inode *inode; 1512 int err; 1513 /* 1514 * "." and ".." are special - ".." especially so because it has 1515 * to be able to know about the current root directory and 1516 * parent relationships. 1517 */ 1518 if (unlikely(nd->last_type != LAST_NORM)) 1519 return handle_dots(nd, nd->last_type); 1520 err = lookup_fast(nd, path, &inode); 1521 if (unlikely(err)) { 1522 if (err < 0) 1523 goto out_err; 1524 1525 err = lookup_slow(nd, path); 1526 if (err < 0) 1527 goto out_err; 1528 1529 inode = path->dentry->d_inode; 1530 } 1531 err = -ENOENT; 1532 if (!inode) 1533 goto out_path_put; 1534 1535 if (should_follow_link(path->dentry, follow)) { 1536 if (nd->flags & LOOKUP_RCU) { 1537 if (unlikely(unlazy_walk(nd, path->dentry))) { 1538 err = -ECHILD; 1539 goto out_err; 1540 } 1541 } 1542 BUG_ON(inode != path->dentry->d_inode); 1543 return 1; 1544 } 1545 path_to_nameidata(path, nd); 1546 nd->inode = inode; 1547 return 0; 1548 1549 out_path_put: 1550 path_to_nameidata(path, nd); 1551 out_err: 1552 terminate_walk(nd); 1553 return err; 1554 } 1555 1556 /* 1557 * This limits recursive symlink follows to 8, while 1558 * limiting consecutive symlinks to 40. 1559 * 1560 * Without that kind of total limit, nasty chains of consecutive 1561 * symlinks can cause almost arbitrarily long lookups. 1562 */ 1563 static inline int nested_symlink(struct path *path, struct nameidata *nd) 1564 { 1565 int res; 1566 1567 if (unlikely(current->link_count >= MAX_NESTED_LINKS)) { 1568 path_put_conditional(path, nd); 1569 path_put(&nd->path); 1570 return -ELOOP; 1571 } 1572 BUG_ON(nd->depth >= MAX_NESTED_LINKS); 1573 1574 nd->depth++; 1575 current->link_count++; 1576 1577 do { 1578 struct path link = *path; 1579 void *cookie; 1580 1581 res = follow_link(&link, nd, &cookie); 1582 if (res) 1583 break; 1584 res = walk_component(nd, path, LOOKUP_FOLLOW); 1585 put_link(nd, &link, cookie); 1586 } while (res > 0); 1587 1588 current->link_count--; 1589 nd->depth--; 1590 return res; 1591 } 1592 1593 /* 1594 * We can do the critical dentry name comparison and hashing 1595 * operations one word at a time, but we are limited to: 1596 * 1597 * - Architectures with fast unaligned word accesses. We could 1598 * do a "get_unaligned()" if this helps and is sufficiently 1599 * fast. 1600 * 1601 * - Little-endian machines (so that we can generate the mask 1602 * of low bytes efficiently). Again, we *could* do a byte 1603 * swapping load on big-endian architectures if that is not 1604 * expensive enough to make the optimization worthless. 1605 * 1606 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we 1607 * do not trap on the (extremely unlikely) case of a page 1608 * crossing operation. 1609 * 1610 * - Furthermore, we need an efficient 64-bit compile for the 1611 * 64-bit case in order to generate the "number of bytes in 1612 * the final mask". Again, that could be replaced with a 1613 * efficient population count instruction or similar. 1614 */ 1615 #ifdef CONFIG_DCACHE_WORD_ACCESS 1616 1617 #include <asm/word-at-a-time.h> 1618 1619 #ifdef CONFIG_64BIT 1620 1621 static inline unsigned int fold_hash(unsigned long hash) 1622 { 1623 hash += hash >> (8*sizeof(int)); 1624 return hash; 1625 } 1626 1627 #else /* 32-bit case */ 1628 1629 #define fold_hash(x) (x) 1630 1631 #endif 1632 1633 unsigned int full_name_hash(const unsigned char *name, unsigned int len) 1634 { 1635 unsigned long a, mask; 1636 unsigned long hash = 0; 1637 1638 for (;;) { 1639 a = load_unaligned_zeropad(name); 1640 if (len < sizeof(unsigned long)) 1641 break; 1642 hash += a; 1643 hash *= 9; 1644 name += sizeof(unsigned long); 1645 len -= sizeof(unsigned long); 1646 if (!len) 1647 goto done; 1648 } 1649 mask = ~(~0ul << len*8); 1650 hash += mask & a; 1651 done: 1652 return fold_hash(hash); 1653 } 1654 EXPORT_SYMBOL(full_name_hash); 1655 1656 /* 1657 * Calculate the length and hash of the path component, and 1658 * return the length of the component; 1659 */ 1660 static inline unsigned long hash_name(const char *name, unsigned int *hashp) 1661 { 1662 unsigned long a, b, adata, bdata, mask, hash, len; 1663 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 1664 1665 hash = a = 0; 1666 len = -sizeof(unsigned long); 1667 do { 1668 hash = (hash + a) * 9; 1669 len += sizeof(unsigned long); 1670 a = load_unaligned_zeropad(name+len); 1671 b = a ^ REPEAT_BYTE('/'); 1672 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants))); 1673 1674 adata = prep_zero_mask(a, adata, &constants); 1675 bdata = prep_zero_mask(b, bdata, &constants); 1676 1677 mask = create_zero_mask(adata | bdata); 1678 1679 hash += a & zero_bytemask(mask); 1680 *hashp = fold_hash(hash); 1681 1682 return len + find_zero(mask); 1683 } 1684 1685 #else 1686 1687 unsigned int full_name_hash(const unsigned char *name, unsigned int len) 1688 { 1689 unsigned long hash = init_name_hash(); 1690 while (len--) 1691 hash = partial_name_hash(*name++, hash); 1692 return end_name_hash(hash); 1693 } 1694 EXPORT_SYMBOL(full_name_hash); 1695 1696 /* 1697 * We know there's a real path component here of at least 1698 * one character. 1699 */ 1700 static inline unsigned long hash_name(const char *name, unsigned int *hashp) 1701 { 1702 unsigned long hash = init_name_hash(); 1703 unsigned long len = 0, c; 1704 1705 c = (unsigned char)*name; 1706 do { 1707 len++; 1708 hash = partial_name_hash(c, hash); 1709 c = (unsigned char)name[len]; 1710 } while (c && c != '/'); 1711 *hashp = end_name_hash(hash); 1712 return len; 1713 } 1714 1715 #endif 1716 1717 /* 1718 * Name resolution. 1719 * This is the basic name resolution function, turning a pathname into 1720 * the final dentry. We expect 'base' to be positive and a directory. 1721 * 1722 * Returns 0 and nd will have valid dentry and mnt on success. 1723 * Returns error and drops reference to input namei data on failure. 1724 */ 1725 static int link_path_walk(const char *name, struct nameidata *nd) 1726 { 1727 struct path next; 1728 int err; 1729 1730 while (*name=='/') 1731 name++; 1732 if (!*name) 1733 return 0; 1734 1735 /* At this point we know we have a real path component. */ 1736 for(;;) { 1737 struct qstr this; 1738 long len; 1739 int type; 1740 1741 err = may_lookup(nd); 1742 if (err) 1743 break; 1744 1745 len = hash_name(name, &this.hash); 1746 this.name = name; 1747 this.len = len; 1748 1749 type = LAST_NORM; 1750 if (name[0] == '.') switch (len) { 1751 case 2: 1752 if (name[1] == '.') { 1753 type = LAST_DOTDOT; 1754 nd->flags |= LOOKUP_JUMPED; 1755 } 1756 break; 1757 case 1: 1758 type = LAST_DOT; 1759 } 1760 if (likely(type == LAST_NORM)) { 1761 struct dentry *parent = nd->path.dentry; 1762 nd->flags &= ~LOOKUP_JUMPED; 1763 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { 1764 err = parent->d_op->d_hash(parent, &this); 1765 if (err < 0) 1766 break; 1767 } 1768 } 1769 1770 nd->last = this; 1771 nd->last_type = type; 1772 1773 if (!name[len]) 1774 return 0; 1775 /* 1776 * If it wasn't NUL, we know it was '/'. Skip that 1777 * slash, and continue until no more slashes. 1778 */ 1779 do { 1780 len++; 1781 } while (unlikely(name[len] == '/')); 1782 if (!name[len]) 1783 return 0; 1784 1785 name += len; 1786 1787 err = walk_component(nd, &next, LOOKUP_FOLLOW); 1788 if (err < 0) 1789 return err; 1790 1791 if (err) { 1792 err = nested_symlink(&next, nd); 1793 if (err) 1794 return err; 1795 } 1796 if (!d_is_directory(nd->path.dentry)) { 1797 err = -ENOTDIR; 1798 break; 1799 } 1800 } 1801 terminate_walk(nd); 1802 return err; 1803 } 1804 1805 static int path_init(int dfd, const char *name, unsigned int flags, 1806 struct nameidata *nd, struct file **fp) 1807 { 1808 int retval = 0; 1809 1810 nd->last_type = LAST_ROOT; /* if there are only slashes... */ 1811 nd->flags = flags | LOOKUP_JUMPED; 1812 nd->depth = 0; 1813 if (flags & LOOKUP_ROOT) { 1814 struct dentry *root = nd->root.dentry; 1815 struct inode *inode = root->d_inode; 1816 if (*name) { 1817 if (!d_is_directory(root)) 1818 return -ENOTDIR; 1819 retval = inode_permission(inode, MAY_EXEC); 1820 if (retval) 1821 return retval; 1822 } 1823 nd->path = nd->root; 1824 nd->inode = inode; 1825 if (flags & LOOKUP_RCU) { 1826 rcu_read_lock(); 1827 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1828 nd->m_seq = read_seqbegin(&mount_lock); 1829 } else { 1830 path_get(&nd->path); 1831 } 1832 return 0; 1833 } 1834 1835 nd->root.mnt = NULL; 1836 1837 nd->m_seq = read_seqbegin(&mount_lock); 1838 if (*name=='/') { 1839 if (flags & LOOKUP_RCU) { 1840 rcu_read_lock(); 1841 set_root_rcu(nd); 1842 } else { 1843 set_root(nd); 1844 path_get(&nd->root); 1845 } 1846 nd->path = nd->root; 1847 } else if (dfd == AT_FDCWD) { 1848 if (flags & LOOKUP_RCU) { 1849 struct fs_struct *fs = current->fs; 1850 unsigned seq; 1851 1852 rcu_read_lock(); 1853 1854 do { 1855 seq = read_seqcount_begin(&fs->seq); 1856 nd->path = fs->pwd; 1857 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1858 } while (read_seqcount_retry(&fs->seq, seq)); 1859 } else { 1860 get_fs_pwd(current->fs, &nd->path); 1861 } 1862 } else { 1863 /* Caller must check execute permissions on the starting path component */ 1864 struct fd f = fdget_raw(dfd); 1865 struct dentry *dentry; 1866 1867 if (!f.file) 1868 return -EBADF; 1869 1870 dentry = f.file->f_path.dentry; 1871 1872 if (*name) { 1873 if (!d_is_directory(dentry)) { 1874 fdput(f); 1875 return -ENOTDIR; 1876 } 1877 } 1878 1879 nd->path = f.file->f_path; 1880 if (flags & LOOKUP_RCU) { 1881 if (f.need_put) 1882 *fp = f.file; 1883 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1884 rcu_read_lock(); 1885 } else { 1886 path_get(&nd->path); 1887 fdput(f); 1888 } 1889 } 1890 1891 nd->inode = nd->path.dentry->d_inode; 1892 return 0; 1893 } 1894 1895 static inline int lookup_last(struct nameidata *nd, struct path *path) 1896 { 1897 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len]) 1898 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 1899 1900 nd->flags &= ~LOOKUP_PARENT; 1901 return walk_component(nd, path, nd->flags & LOOKUP_FOLLOW); 1902 } 1903 1904 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 1905 static int path_lookupat(int dfd, const char *name, 1906 unsigned int flags, struct nameidata *nd) 1907 { 1908 struct file *base = NULL; 1909 struct path path; 1910 int err; 1911 1912 /* 1913 * Path walking is largely split up into 2 different synchronisation 1914 * schemes, rcu-walk and ref-walk (explained in 1915 * Documentation/filesystems/path-lookup.txt). These share much of the 1916 * path walk code, but some things particularly setup, cleanup, and 1917 * following mounts are sufficiently divergent that functions are 1918 * duplicated. Typically there is a function foo(), and its RCU 1919 * analogue, foo_rcu(). 1920 * 1921 * -ECHILD is the error number of choice (just to avoid clashes) that 1922 * is returned if some aspect of an rcu-walk fails. Such an error must 1923 * be handled by restarting a traditional ref-walk (which will always 1924 * be able to complete). 1925 */ 1926 err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base); 1927 1928 if (unlikely(err)) 1929 return err; 1930 1931 current->total_link_count = 0; 1932 err = link_path_walk(name, nd); 1933 1934 if (!err && !(flags & LOOKUP_PARENT)) { 1935 err = lookup_last(nd, &path); 1936 while (err > 0) { 1937 void *cookie; 1938 struct path link = path; 1939 err = may_follow_link(&link, nd); 1940 if (unlikely(err)) 1941 break; 1942 nd->flags |= LOOKUP_PARENT; 1943 err = follow_link(&link, nd, &cookie); 1944 if (err) 1945 break; 1946 err = lookup_last(nd, &path); 1947 put_link(nd, &link, cookie); 1948 } 1949 } 1950 1951 if (!err) 1952 err = complete_walk(nd); 1953 1954 if (!err && nd->flags & LOOKUP_DIRECTORY) { 1955 if (!d_is_directory(nd->path.dentry)) { 1956 path_put(&nd->path); 1957 err = -ENOTDIR; 1958 } 1959 } 1960 1961 if (base) 1962 fput(base); 1963 1964 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 1965 path_put(&nd->root); 1966 nd->root.mnt = NULL; 1967 } 1968 return err; 1969 } 1970 1971 static int filename_lookup(int dfd, struct filename *name, 1972 unsigned int flags, struct nameidata *nd) 1973 { 1974 int retval = path_lookupat(dfd, name->name, flags | LOOKUP_RCU, nd); 1975 if (unlikely(retval == -ECHILD)) 1976 retval = path_lookupat(dfd, name->name, flags, nd); 1977 if (unlikely(retval == -ESTALE)) 1978 retval = path_lookupat(dfd, name->name, 1979 flags | LOOKUP_REVAL, nd); 1980 1981 if (likely(!retval)) 1982 audit_inode(name, nd->path.dentry, flags & LOOKUP_PARENT); 1983 return retval; 1984 } 1985 1986 static int do_path_lookup(int dfd, const char *name, 1987 unsigned int flags, struct nameidata *nd) 1988 { 1989 struct filename filename = { .name = name }; 1990 1991 return filename_lookup(dfd, &filename, flags, nd); 1992 } 1993 1994 /* does lookup, returns the object with parent locked */ 1995 struct dentry *kern_path_locked(const char *name, struct path *path) 1996 { 1997 struct nameidata nd; 1998 struct dentry *d; 1999 int err = do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, &nd); 2000 if (err) 2001 return ERR_PTR(err); 2002 if (nd.last_type != LAST_NORM) { 2003 path_put(&nd.path); 2004 return ERR_PTR(-EINVAL); 2005 } 2006 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 2007 d = __lookup_hash(&nd.last, nd.path.dentry, 0); 2008 if (IS_ERR(d)) { 2009 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 2010 path_put(&nd.path); 2011 return d; 2012 } 2013 *path = nd.path; 2014 return d; 2015 } 2016 2017 int kern_path(const char *name, unsigned int flags, struct path *path) 2018 { 2019 struct nameidata nd; 2020 int res = do_path_lookup(AT_FDCWD, name, flags, &nd); 2021 if (!res) 2022 *path = nd.path; 2023 return res; 2024 } 2025 2026 /** 2027 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair 2028 * @dentry: pointer to dentry of the base directory 2029 * @mnt: pointer to vfs mount of the base directory 2030 * @name: pointer to file name 2031 * @flags: lookup flags 2032 * @path: pointer to struct path to fill 2033 */ 2034 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, 2035 const char *name, unsigned int flags, 2036 struct path *path) 2037 { 2038 struct nameidata nd; 2039 int err; 2040 nd.root.dentry = dentry; 2041 nd.root.mnt = mnt; 2042 BUG_ON(flags & LOOKUP_PARENT); 2043 /* the first argument of do_path_lookup() is ignored with LOOKUP_ROOT */ 2044 err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd); 2045 if (!err) 2046 *path = nd.path; 2047 return err; 2048 } 2049 2050 /* 2051 * Restricted form of lookup. Doesn't follow links, single-component only, 2052 * needs parent already locked. Doesn't follow mounts. 2053 * SMP-safe. 2054 */ 2055 static struct dentry *lookup_hash(struct nameidata *nd) 2056 { 2057 return __lookup_hash(&nd->last, nd->path.dentry, nd->flags); 2058 } 2059 2060 /** 2061 * lookup_one_len - filesystem helper to lookup single pathname component 2062 * @name: pathname component to lookup 2063 * @base: base directory to lookup from 2064 * @len: maximum length @len should be interpreted to 2065 * 2066 * Note that this routine is purely a helper for filesystem usage and should 2067 * not be called by generic code. Also note that by using this function the 2068 * nameidata argument is passed to the filesystem methods and a filesystem 2069 * using this helper needs to be prepared for that. 2070 */ 2071 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len) 2072 { 2073 struct qstr this; 2074 unsigned int c; 2075 int err; 2076 2077 WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex)); 2078 2079 this.name = name; 2080 this.len = len; 2081 this.hash = full_name_hash(name, len); 2082 if (!len) 2083 return ERR_PTR(-EACCES); 2084 2085 if (unlikely(name[0] == '.')) { 2086 if (len < 2 || (len == 2 && name[1] == '.')) 2087 return ERR_PTR(-EACCES); 2088 } 2089 2090 while (len--) { 2091 c = *(const unsigned char *)name++; 2092 if (c == '/' || c == '\0') 2093 return ERR_PTR(-EACCES); 2094 } 2095 /* 2096 * See if the low-level filesystem might want 2097 * to use its own hash.. 2098 */ 2099 if (base->d_flags & DCACHE_OP_HASH) { 2100 int err = base->d_op->d_hash(base, &this); 2101 if (err < 0) 2102 return ERR_PTR(err); 2103 } 2104 2105 err = inode_permission(base->d_inode, MAY_EXEC); 2106 if (err) 2107 return ERR_PTR(err); 2108 2109 return __lookup_hash(&this, base, 0); 2110 } 2111 2112 int user_path_at_empty(int dfd, const char __user *name, unsigned flags, 2113 struct path *path, int *empty) 2114 { 2115 struct nameidata nd; 2116 struct filename *tmp = getname_flags(name, flags, empty); 2117 int err = PTR_ERR(tmp); 2118 if (!IS_ERR(tmp)) { 2119 2120 BUG_ON(flags & LOOKUP_PARENT); 2121 2122 err = filename_lookup(dfd, tmp, flags, &nd); 2123 putname(tmp); 2124 if (!err) 2125 *path = nd.path; 2126 } 2127 return err; 2128 } 2129 2130 int user_path_at(int dfd, const char __user *name, unsigned flags, 2131 struct path *path) 2132 { 2133 return user_path_at_empty(dfd, name, flags, path, NULL); 2134 } 2135 2136 /* 2137 * NB: most callers don't do anything directly with the reference to the 2138 * to struct filename, but the nd->last pointer points into the name string 2139 * allocated by getname. So we must hold the reference to it until all 2140 * path-walking is complete. 2141 */ 2142 static struct filename * 2143 user_path_parent(int dfd, const char __user *path, struct nameidata *nd, 2144 unsigned int flags) 2145 { 2146 struct filename *s = getname(path); 2147 int error; 2148 2149 /* only LOOKUP_REVAL is allowed in extra flags */ 2150 flags &= LOOKUP_REVAL; 2151 2152 if (IS_ERR(s)) 2153 return s; 2154 2155 error = filename_lookup(dfd, s, flags | LOOKUP_PARENT, nd); 2156 if (error) { 2157 putname(s); 2158 return ERR_PTR(error); 2159 } 2160 2161 return s; 2162 } 2163 2164 /** 2165 * mountpoint_last - look up last component for umount 2166 * @nd: pathwalk nameidata - currently pointing at parent directory of "last" 2167 * @path: pointer to container for result 2168 * 2169 * This is a special lookup_last function just for umount. In this case, we 2170 * need to resolve the path without doing any revalidation. 2171 * 2172 * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since 2173 * mountpoints are always pinned in the dcache, their ancestors are too. Thus, 2174 * in almost all cases, this lookup will be served out of the dcache. The only 2175 * cases where it won't are if nd->last refers to a symlink or the path is 2176 * bogus and it doesn't exist. 2177 * 2178 * Returns: 2179 * -error: if there was an error during lookup. This includes -ENOENT if the 2180 * lookup found a negative dentry. The nd->path reference will also be 2181 * put in this case. 2182 * 2183 * 0: if we successfully resolved nd->path and found it to not to be a 2184 * symlink that needs to be followed. "path" will also be populated. 2185 * The nd->path reference will also be put. 2186 * 2187 * 1: if we successfully resolved nd->last and found it to be a symlink 2188 * that needs to be followed. "path" will be populated with the path 2189 * to the link, and nd->path will *not* be put. 2190 */ 2191 static int 2192 mountpoint_last(struct nameidata *nd, struct path *path) 2193 { 2194 int error = 0; 2195 struct dentry *dentry; 2196 struct dentry *dir = nd->path.dentry; 2197 2198 /* If we're in rcuwalk, drop out of it to handle last component */ 2199 if (nd->flags & LOOKUP_RCU) { 2200 if (unlazy_walk(nd, NULL)) { 2201 error = -ECHILD; 2202 goto out; 2203 } 2204 } 2205 2206 nd->flags &= ~LOOKUP_PARENT; 2207 2208 if (unlikely(nd->last_type != LAST_NORM)) { 2209 error = handle_dots(nd, nd->last_type); 2210 if (error) 2211 goto out; 2212 dentry = dget(nd->path.dentry); 2213 goto done; 2214 } 2215 2216 mutex_lock(&dir->d_inode->i_mutex); 2217 dentry = d_lookup(dir, &nd->last); 2218 if (!dentry) { 2219 /* 2220 * No cached dentry. Mounted dentries are pinned in the cache, 2221 * so that means that this dentry is probably a symlink or the 2222 * path doesn't actually point to a mounted dentry. 2223 */ 2224 dentry = d_alloc(dir, &nd->last); 2225 if (!dentry) { 2226 error = -ENOMEM; 2227 mutex_unlock(&dir->d_inode->i_mutex); 2228 goto out; 2229 } 2230 dentry = lookup_real(dir->d_inode, dentry, nd->flags); 2231 error = PTR_ERR(dentry); 2232 if (IS_ERR(dentry)) { 2233 mutex_unlock(&dir->d_inode->i_mutex); 2234 goto out; 2235 } 2236 } 2237 mutex_unlock(&dir->d_inode->i_mutex); 2238 2239 done: 2240 if (!dentry->d_inode) { 2241 error = -ENOENT; 2242 dput(dentry); 2243 goto out; 2244 } 2245 path->dentry = dentry; 2246 path->mnt = mntget(nd->path.mnt); 2247 if (should_follow_link(dentry, nd->flags & LOOKUP_FOLLOW)) 2248 return 1; 2249 follow_mount(path); 2250 error = 0; 2251 out: 2252 terminate_walk(nd); 2253 return error; 2254 } 2255 2256 /** 2257 * path_mountpoint - look up a path to be umounted 2258 * @dfd: directory file descriptor to start walk from 2259 * @name: full pathname to walk 2260 * @path: pointer to container for result 2261 * @flags: lookup flags 2262 * 2263 * Look up the given name, but don't attempt to revalidate the last component. 2264 * Returns 0 and "path" will be valid on success; Returns error otherwise. 2265 */ 2266 static int 2267 path_mountpoint(int dfd, const char *name, struct path *path, unsigned int flags) 2268 { 2269 struct file *base = NULL; 2270 struct nameidata nd; 2271 int err; 2272 2273 err = path_init(dfd, name, flags | LOOKUP_PARENT, &nd, &base); 2274 if (unlikely(err)) 2275 return err; 2276 2277 current->total_link_count = 0; 2278 err = link_path_walk(name, &nd); 2279 if (err) 2280 goto out; 2281 2282 err = mountpoint_last(&nd, path); 2283 while (err > 0) { 2284 void *cookie; 2285 struct path link = *path; 2286 err = may_follow_link(&link, &nd); 2287 if (unlikely(err)) 2288 break; 2289 nd.flags |= LOOKUP_PARENT; 2290 err = follow_link(&link, &nd, &cookie); 2291 if (err) 2292 break; 2293 err = mountpoint_last(&nd, path); 2294 put_link(&nd, &link, cookie); 2295 } 2296 out: 2297 if (base) 2298 fput(base); 2299 2300 if (nd.root.mnt && !(nd.flags & LOOKUP_ROOT)) 2301 path_put(&nd.root); 2302 2303 return err; 2304 } 2305 2306 static int 2307 filename_mountpoint(int dfd, struct filename *s, struct path *path, 2308 unsigned int flags) 2309 { 2310 int error = path_mountpoint(dfd, s->name, path, flags | LOOKUP_RCU); 2311 if (unlikely(error == -ECHILD)) 2312 error = path_mountpoint(dfd, s->name, path, flags); 2313 if (unlikely(error == -ESTALE)) 2314 error = path_mountpoint(dfd, s->name, path, flags | LOOKUP_REVAL); 2315 if (likely(!error)) 2316 audit_inode(s, path->dentry, 0); 2317 return error; 2318 } 2319 2320 /** 2321 * user_path_mountpoint_at - lookup a path from userland in order to umount it 2322 * @dfd: directory file descriptor 2323 * @name: pathname from userland 2324 * @flags: lookup flags 2325 * @path: pointer to container to hold result 2326 * 2327 * A umount is a special case for path walking. We're not actually interested 2328 * in the inode in this situation, and ESTALE errors can be a problem. We 2329 * simply want track down the dentry and vfsmount attached at the mountpoint 2330 * and avoid revalidating the last component. 2331 * 2332 * Returns 0 and populates "path" on success. 2333 */ 2334 int 2335 user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags, 2336 struct path *path) 2337 { 2338 struct filename *s = getname(name); 2339 int error; 2340 if (IS_ERR(s)) 2341 return PTR_ERR(s); 2342 error = filename_mountpoint(dfd, s, path, flags); 2343 putname(s); 2344 return error; 2345 } 2346 2347 int 2348 kern_path_mountpoint(int dfd, const char *name, struct path *path, 2349 unsigned int flags) 2350 { 2351 struct filename s = {.name = name}; 2352 return filename_mountpoint(dfd, &s, path, flags); 2353 } 2354 EXPORT_SYMBOL(kern_path_mountpoint); 2355 2356 /* 2357 * It's inline, so penalty for filesystems that don't use sticky bit is 2358 * minimal. 2359 */ 2360 static inline int check_sticky(struct inode *dir, struct inode *inode) 2361 { 2362 kuid_t fsuid = current_fsuid(); 2363 2364 if (!(dir->i_mode & S_ISVTX)) 2365 return 0; 2366 if (uid_eq(inode->i_uid, fsuid)) 2367 return 0; 2368 if (uid_eq(dir->i_uid, fsuid)) 2369 return 0; 2370 return !inode_capable(inode, CAP_FOWNER); 2371 } 2372 2373 /* 2374 * Check whether we can remove a link victim from directory dir, check 2375 * whether the type of victim is right. 2376 * 1. We can't do it if dir is read-only (done in permission()) 2377 * 2. We should have write and exec permissions on dir 2378 * 3. We can't remove anything from append-only dir 2379 * 4. We can't do anything with immutable dir (done in permission()) 2380 * 5. If the sticky bit on dir is set we should either 2381 * a. be owner of dir, or 2382 * b. be owner of victim, or 2383 * c. have CAP_FOWNER capability 2384 * 6. If the victim is append-only or immutable we can't do antyhing with 2385 * links pointing to it. 2386 * 7. If we were asked to remove a directory and victim isn't one - ENOTDIR. 2387 * 8. If we were asked to remove a non-directory and victim isn't one - EISDIR. 2388 * 9. We can't remove a root or mountpoint. 2389 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by 2390 * nfs_async_unlink(). 2391 */ 2392 static int may_delete(struct inode *dir, struct dentry *victim, bool isdir) 2393 { 2394 struct inode *inode = victim->d_inode; 2395 int error; 2396 2397 if (d_is_negative(victim)) 2398 return -ENOENT; 2399 BUG_ON(!inode); 2400 2401 BUG_ON(victim->d_parent->d_inode != dir); 2402 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE); 2403 2404 error = inode_permission(dir, MAY_WRITE | MAY_EXEC); 2405 if (error) 2406 return error; 2407 if (IS_APPEND(dir)) 2408 return -EPERM; 2409 2410 if (check_sticky(dir, inode) || IS_APPEND(inode) || 2411 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode)) 2412 return -EPERM; 2413 if (isdir) { 2414 if (!d_is_directory(victim) && !d_is_autodir(victim)) 2415 return -ENOTDIR; 2416 if (IS_ROOT(victim)) 2417 return -EBUSY; 2418 } else if (d_is_directory(victim) || d_is_autodir(victim)) 2419 return -EISDIR; 2420 if (IS_DEADDIR(dir)) 2421 return -ENOENT; 2422 if (victim->d_flags & DCACHE_NFSFS_RENAMED) 2423 return -EBUSY; 2424 return 0; 2425 } 2426 2427 /* Check whether we can create an object with dentry child in directory 2428 * dir. 2429 * 1. We can't do it if child already exists (open has special treatment for 2430 * this case, but since we are inlined it's OK) 2431 * 2. We can't do it if dir is read-only (done in permission()) 2432 * 3. We should have write and exec permissions on dir 2433 * 4. We can't do it if dir is immutable (done in permission()) 2434 */ 2435 static inline int may_create(struct inode *dir, struct dentry *child) 2436 { 2437 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE); 2438 if (child->d_inode) 2439 return -EEXIST; 2440 if (IS_DEADDIR(dir)) 2441 return -ENOENT; 2442 return inode_permission(dir, MAY_WRITE | MAY_EXEC); 2443 } 2444 2445 /* 2446 * p1 and p2 should be directories on the same fs. 2447 */ 2448 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) 2449 { 2450 struct dentry *p; 2451 2452 if (p1 == p2) { 2453 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2454 return NULL; 2455 } 2456 2457 mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 2458 2459 p = d_ancestor(p2, p1); 2460 if (p) { 2461 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT); 2462 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD); 2463 return p; 2464 } 2465 2466 p = d_ancestor(p1, p2); 2467 if (p) { 2468 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2469 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 2470 return p; 2471 } 2472 2473 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2474 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 2475 return NULL; 2476 } 2477 2478 void unlock_rename(struct dentry *p1, struct dentry *p2) 2479 { 2480 mutex_unlock(&p1->d_inode->i_mutex); 2481 if (p1 != p2) { 2482 mutex_unlock(&p2->d_inode->i_mutex); 2483 mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 2484 } 2485 } 2486 2487 int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, 2488 bool want_excl) 2489 { 2490 int error = may_create(dir, dentry); 2491 if (error) 2492 return error; 2493 2494 if (!dir->i_op->create) 2495 return -EACCES; /* shouldn't it be ENOSYS? */ 2496 mode &= S_IALLUGO; 2497 mode |= S_IFREG; 2498 error = security_inode_create(dir, dentry, mode); 2499 if (error) 2500 return error; 2501 error = dir->i_op->create(dir, dentry, mode, want_excl); 2502 if (!error) 2503 fsnotify_create(dir, dentry); 2504 return error; 2505 } 2506 2507 static int may_open(struct path *path, int acc_mode, int flag) 2508 { 2509 struct dentry *dentry = path->dentry; 2510 struct inode *inode = dentry->d_inode; 2511 int error; 2512 2513 /* O_PATH? */ 2514 if (!acc_mode) 2515 return 0; 2516 2517 if (!inode) 2518 return -ENOENT; 2519 2520 switch (inode->i_mode & S_IFMT) { 2521 case S_IFLNK: 2522 return -ELOOP; 2523 case S_IFDIR: 2524 if (acc_mode & MAY_WRITE) 2525 return -EISDIR; 2526 break; 2527 case S_IFBLK: 2528 case S_IFCHR: 2529 if (path->mnt->mnt_flags & MNT_NODEV) 2530 return -EACCES; 2531 /*FALLTHRU*/ 2532 case S_IFIFO: 2533 case S_IFSOCK: 2534 flag &= ~O_TRUNC; 2535 break; 2536 } 2537 2538 error = inode_permission(inode, acc_mode); 2539 if (error) 2540 return error; 2541 2542 /* 2543 * An append-only file must be opened in append mode for writing. 2544 */ 2545 if (IS_APPEND(inode)) { 2546 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND)) 2547 return -EPERM; 2548 if (flag & O_TRUNC) 2549 return -EPERM; 2550 } 2551 2552 /* O_NOATIME can only be set by the owner or superuser */ 2553 if (flag & O_NOATIME && !inode_owner_or_capable(inode)) 2554 return -EPERM; 2555 2556 return 0; 2557 } 2558 2559 static int handle_truncate(struct file *filp) 2560 { 2561 struct path *path = &filp->f_path; 2562 struct inode *inode = path->dentry->d_inode; 2563 int error = get_write_access(inode); 2564 if (error) 2565 return error; 2566 /* 2567 * Refuse to truncate files with mandatory locks held on them. 2568 */ 2569 error = locks_verify_locked(inode); 2570 if (!error) 2571 error = security_path_truncate(path); 2572 if (!error) { 2573 error = do_truncate(path->dentry, 0, 2574 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN, 2575 filp); 2576 } 2577 put_write_access(inode); 2578 return error; 2579 } 2580 2581 static inline int open_to_namei_flags(int flag) 2582 { 2583 if ((flag & O_ACCMODE) == 3) 2584 flag--; 2585 return flag; 2586 } 2587 2588 static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode) 2589 { 2590 int error = security_path_mknod(dir, dentry, mode, 0); 2591 if (error) 2592 return error; 2593 2594 error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC); 2595 if (error) 2596 return error; 2597 2598 return security_inode_create(dir->dentry->d_inode, dentry, mode); 2599 } 2600 2601 /* 2602 * Attempt to atomically look up, create and open a file from a negative 2603 * dentry. 2604 * 2605 * Returns 0 if successful. The file will have been created and attached to 2606 * @file by the filesystem calling finish_open(). 2607 * 2608 * Returns 1 if the file was looked up only or didn't need creating. The 2609 * caller will need to perform the open themselves. @path will have been 2610 * updated to point to the new dentry. This may be negative. 2611 * 2612 * Returns an error code otherwise. 2613 */ 2614 static int atomic_open(struct nameidata *nd, struct dentry *dentry, 2615 struct path *path, struct file *file, 2616 const struct open_flags *op, 2617 bool got_write, bool need_lookup, 2618 int *opened) 2619 { 2620 struct inode *dir = nd->path.dentry->d_inode; 2621 unsigned open_flag = open_to_namei_flags(op->open_flag); 2622 umode_t mode; 2623 int error; 2624 int acc_mode; 2625 int create_error = 0; 2626 struct dentry *const DENTRY_NOT_SET = (void *) -1UL; 2627 bool excl; 2628 2629 BUG_ON(dentry->d_inode); 2630 2631 /* Don't create child dentry for a dead directory. */ 2632 if (unlikely(IS_DEADDIR(dir))) { 2633 error = -ENOENT; 2634 goto out; 2635 } 2636 2637 mode = op->mode; 2638 if ((open_flag & O_CREAT) && !IS_POSIXACL(dir)) 2639 mode &= ~current_umask(); 2640 2641 excl = (open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT); 2642 if (excl) 2643 open_flag &= ~O_TRUNC; 2644 2645 /* 2646 * Checking write permission is tricky, bacuse we don't know if we are 2647 * going to actually need it: O_CREAT opens should work as long as the 2648 * file exists. But checking existence breaks atomicity. The trick is 2649 * to check access and if not granted clear O_CREAT from the flags. 2650 * 2651 * Another problem is returing the "right" error value (e.g. for an 2652 * O_EXCL open we want to return EEXIST not EROFS). 2653 */ 2654 if (((open_flag & (O_CREAT | O_TRUNC)) || 2655 (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) { 2656 if (!(open_flag & O_CREAT)) { 2657 /* 2658 * No O_CREATE -> atomicity not a requirement -> fall 2659 * back to lookup + open 2660 */ 2661 goto no_open; 2662 } else if (open_flag & (O_EXCL | O_TRUNC)) { 2663 /* Fall back and fail with the right error */ 2664 create_error = -EROFS; 2665 goto no_open; 2666 } else { 2667 /* No side effects, safe to clear O_CREAT */ 2668 create_error = -EROFS; 2669 open_flag &= ~O_CREAT; 2670 } 2671 } 2672 2673 if (open_flag & O_CREAT) { 2674 error = may_o_create(&nd->path, dentry, mode); 2675 if (error) { 2676 create_error = error; 2677 if (open_flag & O_EXCL) 2678 goto no_open; 2679 open_flag &= ~O_CREAT; 2680 } 2681 } 2682 2683 if (nd->flags & LOOKUP_DIRECTORY) 2684 open_flag |= O_DIRECTORY; 2685 2686 file->f_path.dentry = DENTRY_NOT_SET; 2687 file->f_path.mnt = nd->path.mnt; 2688 error = dir->i_op->atomic_open(dir, dentry, file, open_flag, mode, 2689 opened); 2690 if (error < 0) { 2691 if (create_error && error == -ENOENT) 2692 error = create_error; 2693 goto out; 2694 } 2695 2696 if (error) { /* returned 1, that is */ 2697 if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) { 2698 error = -EIO; 2699 goto out; 2700 } 2701 if (file->f_path.dentry) { 2702 dput(dentry); 2703 dentry = file->f_path.dentry; 2704 } 2705 if (*opened & FILE_CREATED) 2706 fsnotify_create(dir, dentry); 2707 if (!dentry->d_inode) { 2708 WARN_ON(*opened & FILE_CREATED); 2709 if (create_error) { 2710 error = create_error; 2711 goto out; 2712 } 2713 } else { 2714 if (excl && !(*opened & FILE_CREATED)) { 2715 error = -EEXIST; 2716 goto out; 2717 } 2718 } 2719 goto looked_up; 2720 } 2721 2722 /* 2723 * We didn't have the inode before the open, so check open permission 2724 * here. 2725 */ 2726 acc_mode = op->acc_mode; 2727 if (*opened & FILE_CREATED) { 2728 WARN_ON(!(open_flag & O_CREAT)); 2729 fsnotify_create(dir, dentry); 2730 acc_mode = MAY_OPEN; 2731 } 2732 error = may_open(&file->f_path, acc_mode, open_flag); 2733 if (error) 2734 fput(file); 2735 2736 out: 2737 dput(dentry); 2738 return error; 2739 2740 no_open: 2741 if (need_lookup) { 2742 dentry = lookup_real(dir, dentry, nd->flags); 2743 if (IS_ERR(dentry)) 2744 return PTR_ERR(dentry); 2745 2746 if (create_error) { 2747 int open_flag = op->open_flag; 2748 2749 error = create_error; 2750 if ((open_flag & O_EXCL)) { 2751 if (!dentry->d_inode) 2752 goto out; 2753 } else if (!dentry->d_inode) { 2754 goto out; 2755 } else if ((open_flag & O_TRUNC) && 2756 S_ISREG(dentry->d_inode->i_mode)) { 2757 goto out; 2758 } 2759 /* will fail later, go on to get the right error */ 2760 } 2761 } 2762 looked_up: 2763 path->dentry = dentry; 2764 path->mnt = nd->path.mnt; 2765 return 1; 2766 } 2767 2768 /* 2769 * Look up and maybe create and open the last component. 2770 * 2771 * Must be called with i_mutex held on parent. 2772 * 2773 * Returns 0 if the file was successfully atomically created (if necessary) and 2774 * opened. In this case the file will be returned attached to @file. 2775 * 2776 * Returns 1 if the file was not completely opened at this time, though lookups 2777 * and creations will have been performed and the dentry returned in @path will 2778 * be positive upon return if O_CREAT was specified. If O_CREAT wasn't 2779 * specified then a negative dentry may be returned. 2780 * 2781 * An error code is returned otherwise. 2782 * 2783 * FILE_CREATE will be set in @*opened if the dentry was created and will be 2784 * cleared otherwise prior to returning. 2785 */ 2786 static int lookup_open(struct nameidata *nd, struct path *path, 2787 struct file *file, 2788 const struct open_flags *op, 2789 bool got_write, int *opened) 2790 { 2791 struct dentry *dir = nd->path.dentry; 2792 struct inode *dir_inode = dir->d_inode; 2793 struct dentry *dentry; 2794 int error; 2795 bool need_lookup; 2796 2797 *opened &= ~FILE_CREATED; 2798 dentry = lookup_dcache(&nd->last, dir, nd->flags, &need_lookup); 2799 if (IS_ERR(dentry)) 2800 return PTR_ERR(dentry); 2801 2802 /* Cached positive dentry: will open in f_op->open */ 2803 if (!need_lookup && dentry->d_inode) 2804 goto out_no_open; 2805 2806 if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) { 2807 return atomic_open(nd, dentry, path, file, op, got_write, 2808 need_lookup, opened); 2809 } 2810 2811 if (need_lookup) { 2812 BUG_ON(dentry->d_inode); 2813 2814 dentry = lookup_real(dir_inode, dentry, nd->flags); 2815 if (IS_ERR(dentry)) 2816 return PTR_ERR(dentry); 2817 } 2818 2819 /* Negative dentry, just create the file */ 2820 if (!dentry->d_inode && (op->open_flag & O_CREAT)) { 2821 umode_t mode = op->mode; 2822 if (!IS_POSIXACL(dir->d_inode)) 2823 mode &= ~current_umask(); 2824 /* 2825 * This write is needed to ensure that a 2826 * rw->ro transition does not occur between 2827 * the time when the file is created and when 2828 * a permanent write count is taken through 2829 * the 'struct file' in finish_open(). 2830 */ 2831 if (!got_write) { 2832 error = -EROFS; 2833 goto out_dput; 2834 } 2835 *opened |= FILE_CREATED; 2836 error = security_path_mknod(&nd->path, dentry, mode, 0); 2837 if (error) 2838 goto out_dput; 2839 error = vfs_create(dir->d_inode, dentry, mode, 2840 nd->flags & LOOKUP_EXCL); 2841 if (error) 2842 goto out_dput; 2843 } 2844 out_no_open: 2845 path->dentry = dentry; 2846 path->mnt = nd->path.mnt; 2847 return 1; 2848 2849 out_dput: 2850 dput(dentry); 2851 return error; 2852 } 2853 2854 /* 2855 * Handle the last step of open() 2856 */ 2857 static int do_last(struct nameidata *nd, struct path *path, 2858 struct file *file, const struct open_flags *op, 2859 int *opened, struct filename *name) 2860 { 2861 struct dentry *dir = nd->path.dentry; 2862 int open_flag = op->open_flag; 2863 bool will_truncate = (open_flag & O_TRUNC) != 0; 2864 bool got_write = false; 2865 int acc_mode = op->acc_mode; 2866 struct inode *inode; 2867 bool symlink_ok = false; 2868 struct path save_parent = { .dentry = NULL, .mnt = NULL }; 2869 bool retried = false; 2870 int error; 2871 2872 nd->flags &= ~LOOKUP_PARENT; 2873 nd->flags |= op->intent; 2874 2875 if (nd->last_type != LAST_NORM) { 2876 error = handle_dots(nd, nd->last_type); 2877 if (error) 2878 return error; 2879 goto finish_open; 2880 } 2881 2882 if (!(open_flag & O_CREAT)) { 2883 if (nd->last.name[nd->last.len]) 2884 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 2885 if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW)) 2886 symlink_ok = true; 2887 /* we _can_ be in RCU mode here */ 2888 error = lookup_fast(nd, path, &inode); 2889 if (likely(!error)) 2890 goto finish_lookup; 2891 2892 if (error < 0) 2893 goto out; 2894 2895 BUG_ON(nd->inode != dir->d_inode); 2896 } else { 2897 /* create side of things */ 2898 /* 2899 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED 2900 * has been cleared when we got to the last component we are 2901 * about to look up 2902 */ 2903 error = complete_walk(nd); 2904 if (error) 2905 return error; 2906 2907 audit_inode(name, dir, LOOKUP_PARENT); 2908 error = -EISDIR; 2909 /* trailing slashes? */ 2910 if (nd->last.name[nd->last.len]) 2911 goto out; 2912 } 2913 2914 retry_lookup: 2915 if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) { 2916 error = mnt_want_write(nd->path.mnt); 2917 if (!error) 2918 got_write = true; 2919 /* 2920 * do _not_ fail yet - we might not need that or fail with 2921 * a different error; let lookup_open() decide; we'll be 2922 * dropping this one anyway. 2923 */ 2924 } 2925 mutex_lock(&dir->d_inode->i_mutex); 2926 error = lookup_open(nd, path, file, op, got_write, opened); 2927 mutex_unlock(&dir->d_inode->i_mutex); 2928 2929 if (error <= 0) { 2930 if (error) 2931 goto out; 2932 2933 if ((*opened & FILE_CREATED) || 2934 !S_ISREG(file_inode(file)->i_mode)) 2935 will_truncate = false; 2936 2937 audit_inode(name, file->f_path.dentry, 0); 2938 goto opened; 2939 } 2940 2941 if (*opened & FILE_CREATED) { 2942 /* Don't check for write permission, don't truncate */ 2943 open_flag &= ~O_TRUNC; 2944 will_truncate = false; 2945 acc_mode = MAY_OPEN; 2946 path_to_nameidata(path, nd); 2947 goto finish_open_created; 2948 } 2949 2950 /* 2951 * create/update audit record if it already exists. 2952 */ 2953 if (d_is_positive(path->dentry)) 2954 audit_inode(name, path->dentry, 0); 2955 2956 /* 2957 * If atomic_open() acquired write access it is dropped now due to 2958 * possible mount and symlink following (this might be optimized away if 2959 * necessary...) 2960 */ 2961 if (got_write) { 2962 mnt_drop_write(nd->path.mnt); 2963 got_write = false; 2964 } 2965 2966 error = -EEXIST; 2967 if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT)) 2968 goto exit_dput; 2969 2970 error = follow_managed(path, nd->flags); 2971 if (error < 0) 2972 goto exit_dput; 2973 2974 if (error) 2975 nd->flags |= LOOKUP_JUMPED; 2976 2977 BUG_ON(nd->flags & LOOKUP_RCU); 2978 inode = path->dentry->d_inode; 2979 finish_lookup: 2980 /* we _can_ be in RCU mode here */ 2981 error = -ENOENT; 2982 if (d_is_negative(path->dentry)) { 2983 path_to_nameidata(path, nd); 2984 goto out; 2985 } 2986 2987 if (should_follow_link(path->dentry, !symlink_ok)) { 2988 if (nd->flags & LOOKUP_RCU) { 2989 if (unlikely(unlazy_walk(nd, path->dentry))) { 2990 error = -ECHILD; 2991 goto out; 2992 } 2993 } 2994 BUG_ON(inode != path->dentry->d_inode); 2995 return 1; 2996 } 2997 2998 if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path->mnt) { 2999 path_to_nameidata(path, nd); 3000 } else { 3001 save_parent.dentry = nd->path.dentry; 3002 save_parent.mnt = mntget(path->mnt); 3003 nd->path.dentry = path->dentry; 3004 3005 } 3006 nd->inode = inode; 3007 /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */ 3008 finish_open: 3009 error = complete_walk(nd); 3010 if (error) { 3011 path_put(&save_parent); 3012 return error; 3013 } 3014 audit_inode(name, nd->path.dentry, 0); 3015 error = -EISDIR; 3016 if ((open_flag & O_CREAT) && 3017 (d_is_directory(nd->path.dentry) || d_is_autodir(nd->path.dentry))) 3018 goto out; 3019 error = -ENOTDIR; 3020 if ((nd->flags & LOOKUP_DIRECTORY) && !d_is_directory(nd->path.dentry)) 3021 goto out; 3022 if (!S_ISREG(nd->inode->i_mode)) 3023 will_truncate = false; 3024 3025 if (will_truncate) { 3026 error = mnt_want_write(nd->path.mnt); 3027 if (error) 3028 goto out; 3029 got_write = true; 3030 } 3031 finish_open_created: 3032 error = may_open(&nd->path, acc_mode, open_flag); 3033 if (error) 3034 goto out; 3035 file->f_path.mnt = nd->path.mnt; 3036 error = finish_open(file, nd->path.dentry, NULL, opened); 3037 if (error) { 3038 if (error == -EOPENSTALE) 3039 goto stale_open; 3040 goto out; 3041 } 3042 opened: 3043 error = open_check_o_direct(file); 3044 if (error) 3045 goto exit_fput; 3046 error = ima_file_check(file, op->acc_mode); 3047 if (error) 3048 goto exit_fput; 3049 3050 if (will_truncate) { 3051 error = handle_truncate(file); 3052 if (error) 3053 goto exit_fput; 3054 } 3055 out: 3056 if (got_write) 3057 mnt_drop_write(nd->path.mnt); 3058 path_put(&save_parent); 3059 terminate_walk(nd); 3060 return error; 3061 3062 exit_dput: 3063 path_put_conditional(path, nd); 3064 goto out; 3065 exit_fput: 3066 fput(file); 3067 goto out; 3068 3069 stale_open: 3070 /* If no saved parent or already retried then can't retry */ 3071 if (!save_parent.dentry || retried) 3072 goto out; 3073 3074 BUG_ON(save_parent.dentry != dir); 3075 path_put(&nd->path); 3076 nd->path = save_parent; 3077 nd->inode = dir->d_inode; 3078 save_parent.mnt = NULL; 3079 save_parent.dentry = NULL; 3080 if (got_write) { 3081 mnt_drop_write(nd->path.mnt); 3082 got_write = false; 3083 } 3084 retried = true; 3085 goto retry_lookup; 3086 } 3087 3088 static int do_tmpfile(int dfd, struct filename *pathname, 3089 struct nameidata *nd, int flags, 3090 const struct open_flags *op, 3091 struct file *file, int *opened) 3092 { 3093 static const struct qstr name = QSTR_INIT("/", 1); 3094 struct dentry *dentry, *child; 3095 struct inode *dir; 3096 int error = path_lookupat(dfd, pathname->name, 3097 flags | LOOKUP_DIRECTORY, nd); 3098 if (unlikely(error)) 3099 return error; 3100 error = mnt_want_write(nd->path.mnt); 3101 if (unlikely(error)) 3102 goto out; 3103 /* we want directory to be writable */ 3104 error = inode_permission(nd->inode, MAY_WRITE | MAY_EXEC); 3105 if (error) 3106 goto out2; 3107 dentry = nd->path.dentry; 3108 dir = dentry->d_inode; 3109 if (!dir->i_op->tmpfile) { 3110 error = -EOPNOTSUPP; 3111 goto out2; 3112 } 3113 child = d_alloc(dentry, &name); 3114 if (unlikely(!child)) { 3115 error = -ENOMEM; 3116 goto out2; 3117 } 3118 nd->flags &= ~LOOKUP_DIRECTORY; 3119 nd->flags |= op->intent; 3120 dput(nd->path.dentry); 3121 nd->path.dentry = child; 3122 error = dir->i_op->tmpfile(dir, nd->path.dentry, op->mode); 3123 if (error) 3124 goto out2; 3125 audit_inode(pathname, nd->path.dentry, 0); 3126 error = may_open(&nd->path, op->acc_mode, op->open_flag); 3127 if (error) 3128 goto out2; 3129 file->f_path.mnt = nd->path.mnt; 3130 error = finish_open(file, nd->path.dentry, NULL, opened); 3131 if (error) 3132 goto out2; 3133 error = open_check_o_direct(file); 3134 if (error) { 3135 fput(file); 3136 } else if (!(op->open_flag & O_EXCL)) { 3137 struct inode *inode = file_inode(file); 3138 spin_lock(&inode->i_lock); 3139 inode->i_state |= I_LINKABLE; 3140 spin_unlock(&inode->i_lock); 3141 } 3142 out2: 3143 mnt_drop_write(nd->path.mnt); 3144 out: 3145 path_put(&nd->path); 3146 return error; 3147 } 3148 3149 static struct file *path_openat(int dfd, struct filename *pathname, 3150 struct nameidata *nd, const struct open_flags *op, int flags) 3151 { 3152 struct file *base = NULL; 3153 struct file *file; 3154 struct path path; 3155 int opened = 0; 3156 int error; 3157 3158 file = get_empty_filp(); 3159 if (IS_ERR(file)) 3160 return file; 3161 3162 file->f_flags = op->open_flag; 3163 3164 if (unlikely(file->f_flags & __O_TMPFILE)) { 3165 error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened); 3166 goto out; 3167 } 3168 3169 error = path_init(dfd, pathname->name, flags | LOOKUP_PARENT, nd, &base); 3170 if (unlikely(error)) 3171 goto out; 3172 3173 current->total_link_count = 0; 3174 error = link_path_walk(pathname->name, nd); 3175 if (unlikely(error)) 3176 goto out; 3177 3178 error = do_last(nd, &path, file, op, &opened, pathname); 3179 while (unlikely(error > 0)) { /* trailing symlink */ 3180 struct path link = path; 3181 void *cookie; 3182 if (!(nd->flags & LOOKUP_FOLLOW)) { 3183 path_put_conditional(&path, nd); 3184 path_put(&nd->path); 3185 error = -ELOOP; 3186 break; 3187 } 3188 error = may_follow_link(&link, nd); 3189 if (unlikely(error)) 3190 break; 3191 nd->flags |= LOOKUP_PARENT; 3192 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL); 3193 error = follow_link(&link, nd, &cookie); 3194 if (unlikely(error)) 3195 break; 3196 error = do_last(nd, &path, file, op, &opened, pathname); 3197 put_link(nd, &link, cookie); 3198 } 3199 out: 3200 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) 3201 path_put(&nd->root); 3202 if (base) 3203 fput(base); 3204 if (!(opened & FILE_OPENED)) { 3205 BUG_ON(!error); 3206 put_filp(file); 3207 } 3208 if (unlikely(error)) { 3209 if (error == -EOPENSTALE) { 3210 if (flags & LOOKUP_RCU) 3211 error = -ECHILD; 3212 else 3213 error = -ESTALE; 3214 } 3215 file = ERR_PTR(error); 3216 } 3217 return file; 3218 } 3219 3220 struct file *do_filp_open(int dfd, struct filename *pathname, 3221 const struct open_flags *op) 3222 { 3223 struct nameidata nd; 3224 int flags = op->lookup_flags; 3225 struct file *filp; 3226 3227 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU); 3228 if (unlikely(filp == ERR_PTR(-ECHILD))) 3229 filp = path_openat(dfd, pathname, &nd, op, flags); 3230 if (unlikely(filp == ERR_PTR(-ESTALE))) 3231 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL); 3232 return filp; 3233 } 3234 3235 struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt, 3236 const char *name, const struct open_flags *op) 3237 { 3238 struct nameidata nd; 3239 struct file *file; 3240 struct filename filename = { .name = name }; 3241 int flags = op->lookup_flags | LOOKUP_ROOT; 3242 3243 nd.root.mnt = mnt; 3244 nd.root.dentry = dentry; 3245 3246 if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN) 3247 return ERR_PTR(-ELOOP); 3248 3249 file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_RCU); 3250 if (unlikely(file == ERR_PTR(-ECHILD))) 3251 file = path_openat(-1, &filename, &nd, op, flags); 3252 if (unlikely(file == ERR_PTR(-ESTALE))) 3253 file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_REVAL); 3254 return file; 3255 } 3256 3257 struct dentry *kern_path_create(int dfd, const char *pathname, 3258 struct path *path, unsigned int lookup_flags) 3259 { 3260 struct dentry *dentry = ERR_PTR(-EEXIST); 3261 struct nameidata nd; 3262 int err2; 3263 int error; 3264 bool is_dir = (lookup_flags & LOOKUP_DIRECTORY); 3265 3266 /* 3267 * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any 3268 * other flags passed in are ignored! 3269 */ 3270 lookup_flags &= LOOKUP_REVAL; 3271 3272 error = do_path_lookup(dfd, pathname, LOOKUP_PARENT|lookup_flags, &nd); 3273 if (error) 3274 return ERR_PTR(error); 3275 3276 /* 3277 * Yucky last component or no last component at all? 3278 * (foo/., foo/.., /////) 3279 */ 3280 if (nd.last_type != LAST_NORM) 3281 goto out; 3282 nd.flags &= ~LOOKUP_PARENT; 3283 nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL; 3284 3285 /* don't fail immediately if it's r/o, at least try to report other errors */ 3286 err2 = mnt_want_write(nd.path.mnt); 3287 /* 3288 * Do the final lookup. 3289 */ 3290 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3291 dentry = lookup_hash(&nd); 3292 if (IS_ERR(dentry)) 3293 goto unlock; 3294 3295 error = -EEXIST; 3296 if (d_is_positive(dentry)) 3297 goto fail; 3298 3299 /* 3300 * Special case - lookup gave negative, but... we had foo/bar/ 3301 * From the vfs_mknod() POV we just have a negative dentry - 3302 * all is fine. Let's be bastards - you had / on the end, you've 3303 * been asking for (non-existent) directory. -ENOENT for you. 3304 */ 3305 if (unlikely(!is_dir && nd.last.name[nd.last.len])) { 3306 error = -ENOENT; 3307 goto fail; 3308 } 3309 if (unlikely(err2)) { 3310 error = err2; 3311 goto fail; 3312 } 3313 *path = nd.path; 3314 return dentry; 3315 fail: 3316 dput(dentry); 3317 dentry = ERR_PTR(error); 3318 unlock: 3319 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 3320 if (!err2) 3321 mnt_drop_write(nd.path.mnt); 3322 out: 3323 path_put(&nd.path); 3324 return dentry; 3325 } 3326 EXPORT_SYMBOL(kern_path_create); 3327 3328 void done_path_create(struct path *path, struct dentry *dentry) 3329 { 3330 dput(dentry); 3331 mutex_unlock(&path->dentry->d_inode->i_mutex); 3332 mnt_drop_write(path->mnt); 3333 path_put(path); 3334 } 3335 EXPORT_SYMBOL(done_path_create); 3336 3337 struct dentry *user_path_create(int dfd, const char __user *pathname, 3338 struct path *path, unsigned int lookup_flags) 3339 { 3340 struct filename *tmp = getname(pathname); 3341 struct dentry *res; 3342 if (IS_ERR(tmp)) 3343 return ERR_CAST(tmp); 3344 res = kern_path_create(dfd, tmp->name, path, lookup_flags); 3345 putname(tmp); 3346 return res; 3347 } 3348 EXPORT_SYMBOL(user_path_create); 3349 3350 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) 3351 { 3352 int error = may_create(dir, dentry); 3353 3354 if (error) 3355 return error; 3356 3357 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD)) 3358 return -EPERM; 3359 3360 if (!dir->i_op->mknod) 3361 return -EPERM; 3362 3363 error = devcgroup_inode_mknod(mode, dev); 3364 if (error) 3365 return error; 3366 3367 error = security_inode_mknod(dir, dentry, mode, dev); 3368 if (error) 3369 return error; 3370 3371 error = dir->i_op->mknod(dir, dentry, mode, dev); 3372 if (!error) 3373 fsnotify_create(dir, dentry); 3374 return error; 3375 } 3376 3377 static int may_mknod(umode_t mode) 3378 { 3379 switch (mode & S_IFMT) { 3380 case S_IFREG: 3381 case S_IFCHR: 3382 case S_IFBLK: 3383 case S_IFIFO: 3384 case S_IFSOCK: 3385 case 0: /* zero mode translates to S_IFREG */ 3386 return 0; 3387 case S_IFDIR: 3388 return -EPERM; 3389 default: 3390 return -EINVAL; 3391 } 3392 } 3393 3394 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, 3395 unsigned, dev) 3396 { 3397 struct dentry *dentry; 3398 struct path path; 3399 int error; 3400 unsigned int lookup_flags = 0; 3401 3402 error = may_mknod(mode); 3403 if (error) 3404 return error; 3405 retry: 3406 dentry = user_path_create(dfd, filename, &path, lookup_flags); 3407 if (IS_ERR(dentry)) 3408 return PTR_ERR(dentry); 3409 3410 if (!IS_POSIXACL(path.dentry->d_inode)) 3411 mode &= ~current_umask(); 3412 error = security_path_mknod(&path, dentry, mode, dev); 3413 if (error) 3414 goto out; 3415 switch (mode & S_IFMT) { 3416 case 0: case S_IFREG: 3417 error = vfs_create(path.dentry->d_inode,dentry,mode,true); 3418 break; 3419 case S_IFCHR: case S_IFBLK: 3420 error = vfs_mknod(path.dentry->d_inode,dentry,mode, 3421 new_decode_dev(dev)); 3422 break; 3423 case S_IFIFO: case S_IFSOCK: 3424 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0); 3425 break; 3426 } 3427 out: 3428 done_path_create(&path, dentry); 3429 if (retry_estale(error, lookup_flags)) { 3430 lookup_flags |= LOOKUP_REVAL; 3431 goto retry; 3432 } 3433 return error; 3434 } 3435 3436 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev) 3437 { 3438 return sys_mknodat(AT_FDCWD, filename, mode, dev); 3439 } 3440 3441 int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 3442 { 3443 int error = may_create(dir, dentry); 3444 unsigned max_links = dir->i_sb->s_max_links; 3445 3446 if (error) 3447 return error; 3448 3449 if (!dir->i_op->mkdir) 3450 return -EPERM; 3451 3452 mode &= (S_IRWXUGO|S_ISVTX); 3453 error = security_inode_mkdir(dir, dentry, mode); 3454 if (error) 3455 return error; 3456 3457 if (max_links && dir->i_nlink >= max_links) 3458 return -EMLINK; 3459 3460 error = dir->i_op->mkdir(dir, dentry, mode); 3461 if (!error) 3462 fsnotify_mkdir(dir, dentry); 3463 return error; 3464 } 3465 3466 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) 3467 { 3468 struct dentry *dentry; 3469 struct path path; 3470 int error; 3471 unsigned int lookup_flags = LOOKUP_DIRECTORY; 3472 3473 retry: 3474 dentry = user_path_create(dfd, pathname, &path, lookup_flags); 3475 if (IS_ERR(dentry)) 3476 return PTR_ERR(dentry); 3477 3478 if (!IS_POSIXACL(path.dentry->d_inode)) 3479 mode &= ~current_umask(); 3480 error = security_path_mkdir(&path, dentry, mode); 3481 if (!error) 3482 error = vfs_mkdir(path.dentry->d_inode, dentry, mode); 3483 done_path_create(&path, dentry); 3484 if (retry_estale(error, lookup_flags)) { 3485 lookup_flags |= LOOKUP_REVAL; 3486 goto retry; 3487 } 3488 return error; 3489 } 3490 3491 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode) 3492 { 3493 return sys_mkdirat(AT_FDCWD, pathname, mode); 3494 } 3495 3496 /* 3497 * The dentry_unhash() helper will try to drop the dentry early: we 3498 * should have a usage count of 1 if we're the only user of this 3499 * dentry, and if that is true (possibly after pruning the dcache), 3500 * then we drop the dentry now. 3501 * 3502 * A low-level filesystem can, if it choses, legally 3503 * do a 3504 * 3505 * if (!d_unhashed(dentry)) 3506 * return -EBUSY; 3507 * 3508 * if it cannot handle the case of removing a directory 3509 * that is still in use by something else.. 3510 */ 3511 void dentry_unhash(struct dentry *dentry) 3512 { 3513 shrink_dcache_parent(dentry); 3514 spin_lock(&dentry->d_lock); 3515 if (dentry->d_lockref.count == 1) 3516 __d_drop(dentry); 3517 spin_unlock(&dentry->d_lock); 3518 } 3519 3520 int vfs_rmdir(struct inode *dir, struct dentry *dentry) 3521 { 3522 int error = may_delete(dir, dentry, 1); 3523 3524 if (error) 3525 return error; 3526 3527 if (!dir->i_op->rmdir) 3528 return -EPERM; 3529 3530 dget(dentry); 3531 mutex_lock(&dentry->d_inode->i_mutex); 3532 3533 error = -EBUSY; 3534 if (d_mountpoint(dentry)) 3535 goto out; 3536 3537 error = security_inode_rmdir(dir, dentry); 3538 if (error) 3539 goto out; 3540 3541 shrink_dcache_parent(dentry); 3542 error = dir->i_op->rmdir(dir, dentry); 3543 if (error) 3544 goto out; 3545 3546 dentry->d_inode->i_flags |= S_DEAD; 3547 dont_mount(dentry); 3548 3549 out: 3550 mutex_unlock(&dentry->d_inode->i_mutex); 3551 dput(dentry); 3552 if (!error) 3553 d_delete(dentry); 3554 return error; 3555 } 3556 3557 static long do_rmdir(int dfd, const char __user *pathname) 3558 { 3559 int error = 0; 3560 struct filename *name; 3561 struct dentry *dentry; 3562 struct nameidata nd; 3563 unsigned int lookup_flags = 0; 3564 retry: 3565 name = user_path_parent(dfd, pathname, &nd, lookup_flags); 3566 if (IS_ERR(name)) 3567 return PTR_ERR(name); 3568 3569 switch(nd.last_type) { 3570 case LAST_DOTDOT: 3571 error = -ENOTEMPTY; 3572 goto exit1; 3573 case LAST_DOT: 3574 error = -EINVAL; 3575 goto exit1; 3576 case LAST_ROOT: 3577 error = -EBUSY; 3578 goto exit1; 3579 } 3580 3581 nd.flags &= ~LOOKUP_PARENT; 3582 error = mnt_want_write(nd.path.mnt); 3583 if (error) 3584 goto exit1; 3585 3586 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3587 dentry = lookup_hash(&nd); 3588 error = PTR_ERR(dentry); 3589 if (IS_ERR(dentry)) 3590 goto exit2; 3591 if (!dentry->d_inode) { 3592 error = -ENOENT; 3593 goto exit3; 3594 } 3595 error = security_path_rmdir(&nd.path, dentry); 3596 if (error) 3597 goto exit3; 3598 error = vfs_rmdir(nd.path.dentry->d_inode, dentry); 3599 exit3: 3600 dput(dentry); 3601 exit2: 3602 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 3603 mnt_drop_write(nd.path.mnt); 3604 exit1: 3605 path_put(&nd.path); 3606 putname(name); 3607 if (retry_estale(error, lookup_flags)) { 3608 lookup_flags |= LOOKUP_REVAL; 3609 goto retry; 3610 } 3611 return error; 3612 } 3613 3614 SYSCALL_DEFINE1(rmdir, const char __user *, pathname) 3615 { 3616 return do_rmdir(AT_FDCWD, pathname); 3617 } 3618 3619 /** 3620 * vfs_unlink - unlink a filesystem object 3621 * @dir: parent directory 3622 * @dentry: victim 3623 * @delegated_inode: returns victim inode, if the inode is delegated. 3624 * 3625 * The caller must hold dir->i_mutex. 3626 * 3627 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and 3628 * return a reference to the inode in delegated_inode. The caller 3629 * should then break the delegation on that inode and retry. Because 3630 * breaking a delegation may take a long time, the caller should drop 3631 * dir->i_mutex before doing so. 3632 * 3633 * Alternatively, a caller may pass NULL for delegated_inode. This may 3634 * be appropriate for callers that expect the underlying filesystem not 3635 * to be NFS exported. 3636 */ 3637 int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode) 3638 { 3639 struct inode *target = dentry->d_inode; 3640 int error = may_delete(dir, dentry, 0); 3641 3642 if (error) 3643 return error; 3644 3645 if (!dir->i_op->unlink) 3646 return -EPERM; 3647 3648 mutex_lock(&target->i_mutex); 3649 if (d_mountpoint(dentry)) 3650 error = -EBUSY; 3651 else { 3652 error = security_inode_unlink(dir, dentry); 3653 if (!error) { 3654 error = try_break_deleg(target, delegated_inode); 3655 if (error) 3656 goto out; 3657 error = dir->i_op->unlink(dir, dentry); 3658 if (!error) 3659 dont_mount(dentry); 3660 } 3661 } 3662 out: 3663 mutex_unlock(&target->i_mutex); 3664 3665 /* We don't d_delete() NFS sillyrenamed files--they still exist. */ 3666 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) { 3667 fsnotify_link_count(target); 3668 d_delete(dentry); 3669 } 3670 3671 return error; 3672 } 3673 3674 /* 3675 * Make sure that the actual truncation of the file will occur outside its 3676 * directory's i_mutex. Truncate can take a long time if there is a lot of 3677 * writeout happening, and we don't want to prevent access to the directory 3678 * while waiting on the I/O. 3679 */ 3680 static long do_unlinkat(int dfd, const char __user *pathname) 3681 { 3682 int error; 3683 struct filename *name; 3684 struct dentry *dentry; 3685 struct nameidata nd; 3686 struct inode *inode = NULL; 3687 struct inode *delegated_inode = NULL; 3688 unsigned int lookup_flags = 0; 3689 retry: 3690 name = user_path_parent(dfd, pathname, &nd, lookup_flags); 3691 if (IS_ERR(name)) 3692 return PTR_ERR(name); 3693 3694 error = -EISDIR; 3695 if (nd.last_type != LAST_NORM) 3696 goto exit1; 3697 3698 nd.flags &= ~LOOKUP_PARENT; 3699 error = mnt_want_write(nd.path.mnt); 3700 if (error) 3701 goto exit1; 3702 retry_deleg: 3703 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3704 dentry = lookup_hash(&nd); 3705 error = PTR_ERR(dentry); 3706 if (!IS_ERR(dentry)) { 3707 /* Why not before? Because we want correct error value */ 3708 if (nd.last.name[nd.last.len]) 3709 goto slashes; 3710 inode = dentry->d_inode; 3711 if (d_is_negative(dentry)) 3712 goto slashes; 3713 ihold(inode); 3714 error = security_path_unlink(&nd.path, dentry); 3715 if (error) 3716 goto exit2; 3717 error = vfs_unlink(nd.path.dentry->d_inode, dentry, &delegated_inode); 3718 exit2: 3719 dput(dentry); 3720 } 3721 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 3722 if (inode) 3723 iput(inode); /* truncate the inode here */ 3724 inode = NULL; 3725 if (delegated_inode) { 3726 error = break_deleg_wait(&delegated_inode); 3727 if (!error) 3728 goto retry_deleg; 3729 } 3730 mnt_drop_write(nd.path.mnt); 3731 exit1: 3732 path_put(&nd.path); 3733 putname(name); 3734 if (retry_estale(error, lookup_flags)) { 3735 lookup_flags |= LOOKUP_REVAL; 3736 inode = NULL; 3737 goto retry; 3738 } 3739 return error; 3740 3741 slashes: 3742 if (d_is_negative(dentry)) 3743 error = -ENOENT; 3744 else if (d_is_directory(dentry) || d_is_autodir(dentry)) 3745 error = -EISDIR; 3746 else 3747 error = -ENOTDIR; 3748 goto exit2; 3749 } 3750 3751 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) 3752 { 3753 if ((flag & ~AT_REMOVEDIR) != 0) 3754 return -EINVAL; 3755 3756 if (flag & AT_REMOVEDIR) 3757 return do_rmdir(dfd, pathname); 3758 3759 return do_unlinkat(dfd, pathname); 3760 } 3761 3762 SYSCALL_DEFINE1(unlink, const char __user *, pathname) 3763 { 3764 return do_unlinkat(AT_FDCWD, pathname); 3765 } 3766 3767 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname) 3768 { 3769 int error = may_create(dir, dentry); 3770 3771 if (error) 3772 return error; 3773 3774 if (!dir->i_op->symlink) 3775 return -EPERM; 3776 3777 error = security_inode_symlink(dir, dentry, oldname); 3778 if (error) 3779 return error; 3780 3781 error = dir->i_op->symlink(dir, dentry, oldname); 3782 if (!error) 3783 fsnotify_create(dir, dentry); 3784 return error; 3785 } 3786 3787 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, 3788 int, newdfd, const char __user *, newname) 3789 { 3790 int error; 3791 struct filename *from; 3792 struct dentry *dentry; 3793 struct path path; 3794 unsigned int lookup_flags = 0; 3795 3796 from = getname(oldname); 3797 if (IS_ERR(from)) 3798 return PTR_ERR(from); 3799 retry: 3800 dentry = user_path_create(newdfd, newname, &path, lookup_flags); 3801 error = PTR_ERR(dentry); 3802 if (IS_ERR(dentry)) 3803 goto out_putname; 3804 3805 error = security_path_symlink(&path, dentry, from->name); 3806 if (!error) 3807 error = vfs_symlink(path.dentry->d_inode, dentry, from->name); 3808 done_path_create(&path, dentry); 3809 if (retry_estale(error, lookup_flags)) { 3810 lookup_flags |= LOOKUP_REVAL; 3811 goto retry; 3812 } 3813 out_putname: 3814 putname(from); 3815 return error; 3816 } 3817 3818 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) 3819 { 3820 return sys_symlinkat(oldname, AT_FDCWD, newname); 3821 } 3822 3823 /** 3824 * vfs_link - create a new link 3825 * @old_dentry: object to be linked 3826 * @dir: new parent 3827 * @new_dentry: where to create the new link 3828 * @delegated_inode: returns inode needing a delegation break 3829 * 3830 * The caller must hold dir->i_mutex 3831 * 3832 * If vfs_link discovers a delegation on the to-be-linked file in need 3833 * of breaking, it will return -EWOULDBLOCK and return a reference to the 3834 * inode in delegated_inode. The caller should then break the delegation 3835 * and retry. Because breaking a delegation may take a long time, the 3836 * caller should drop the i_mutex before doing so. 3837 * 3838 * Alternatively, a caller may pass NULL for delegated_inode. This may 3839 * be appropriate for callers that expect the underlying filesystem not 3840 * to be NFS exported. 3841 */ 3842 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode) 3843 { 3844 struct inode *inode = old_dentry->d_inode; 3845 unsigned max_links = dir->i_sb->s_max_links; 3846 int error; 3847 3848 if (!inode) 3849 return -ENOENT; 3850 3851 error = may_create(dir, new_dentry); 3852 if (error) 3853 return error; 3854 3855 if (dir->i_sb != inode->i_sb) 3856 return -EXDEV; 3857 3858 /* 3859 * A link to an append-only or immutable file cannot be created. 3860 */ 3861 if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) 3862 return -EPERM; 3863 if (!dir->i_op->link) 3864 return -EPERM; 3865 if (S_ISDIR(inode->i_mode)) 3866 return -EPERM; 3867 3868 error = security_inode_link(old_dentry, dir, new_dentry); 3869 if (error) 3870 return error; 3871 3872 mutex_lock(&inode->i_mutex); 3873 /* Make sure we don't allow creating hardlink to an unlinked file */ 3874 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE)) 3875 error = -ENOENT; 3876 else if (max_links && inode->i_nlink >= max_links) 3877 error = -EMLINK; 3878 else { 3879 error = try_break_deleg(inode, delegated_inode); 3880 if (!error) 3881 error = dir->i_op->link(old_dentry, dir, new_dentry); 3882 } 3883 3884 if (!error && (inode->i_state & I_LINKABLE)) { 3885 spin_lock(&inode->i_lock); 3886 inode->i_state &= ~I_LINKABLE; 3887 spin_unlock(&inode->i_lock); 3888 } 3889 mutex_unlock(&inode->i_mutex); 3890 if (!error) 3891 fsnotify_link(dir, inode, new_dentry); 3892 return error; 3893 } 3894 3895 /* 3896 * Hardlinks are often used in delicate situations. We avoid 3897 * security-related surprises by not following symlinks on the 3898 * newname. --KAB 3899 * 3900 * We don't follow them on the oldname either to be compatible 3901 * with linux 2.0, and to avoid hard-linking to directories 3902 * and other special files. --ADM 3903 */ 3904 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, 3905 int, newdfd, const char __user *, newname, int, flags) 3906 { 3907 struct dentry *new_dentry; 3908 struct path old_path, new_path; 3909 struct inode *delegated_inode = NULL; 3910 int how = 0; 3911 int error; 3912 3913 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) 3914 return -EINVAL; 3915 /* 3916 * To use null names we require CAP_DAC_READ_SEARCH 3917 * This ensures that not everyone will be able to create 3918 * handlink using the passed filedescriptor. 3919 */ 3920 if (flags & AT_EMPTY_PATH) { 3921 if (!capable(CAP_DAC_READ_SEARCH)) 3922 return -ENOENT; 3923 how = LOOKUP_EMPTY; 3924 } 3925 3926 if (flags & AT_SYMLINK_FOLLOW) 3927 how |= LOOKUP_FOLLOW; 3928 retry: 3929 error = user_path_at(olddfd, oldname, how, &old_path); 3930 if (error) 3931 return error; 3932 3933 new_dentry = user_path_create(newdfd, newname, &new_path, 3934 (how & LOOKUP_REVAL)); 3935 error = PTR_ERR(new_dentry); 3936 if (IS_ERR(new_dentry)) 3937 goto out; 3938 3939 error = -EXDEV; 3940 if (old_path.mnt != new_path.mnt) 3941 goto out_dput; 3942 error = may_linkat(&old_path); 3943 if (unlikely(error)) 3944 goto out_dput; 3945 error = security_path_link(old_path.dentry, &new_path, new_dentry); 3946 if (error) 3947 goto out_dput; 3948 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode); 3949 out_dput: 3950 done_path_create(&new_path, new_dentry); 3951 if (delegated_inode) { 3952 error = break_deleg_wait(&delegated_inode); 3953 if (!error) 3954 goto retry; 3955 } 3956 if (retry_estale(error, how)) { 3957 how |= LOOKUP_REVAL; 3958 goto retry; 3959 } 3960 out: 3961 path_put(&old_path); 3962 3963 return error; 3964 } 3965 3966 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) 3967 { 3968 return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 3969 } 3970 3971 /* 3972 * The worst of all namespace operations - renaming directory. "Perverted" 3973 * doesn't even start to describe it. Somebody in UCB had a heck of a trip... 3974 * Problems: 3975 * a) we can get into loop creation. Check is done in is_subdir(). 3976 * b) race potential - two innocent renames can create a loop together. 3977 * That's where 4.4 screws up. Current fix: serialization on 3978 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another 3979 * story. 3980 * c) we have to lock _four_ objects - parents and victim (if it exists), 3981 * and source (if it is not a directory). 3982 * And that - after we got ->i_mutex on parents (until then we don't know 3983 * whether the target exists). Solution: try to be smart with locking 3984 * order for inodes. We rely on the fact that tree topology may change 3985 * only under ->s_vfs_rename_mutex _and_ that parent of the object we 3986 * move will be locked. Thus we can rank directories by the tree 3987 * (ancestors first) and rank all non-directories after them. 3988 * That works since everybody except rename does "lock parent, lookup, 3989 * lock child" and rename is under ->s_vfs_rename_mutex. 3990 * HOWEVER, it relies on the assumption that any object with ->lookup() 3991 * has no more than 1 dentry. If "hybrid" objects will ever appear, 3992 * we'd better make sure that there's no link(2) for them. 3993 * d) conversion from fhandle to dentry may come in the wrong moment - when 3994 * we are removing the target. Solution: we will have to grab ->i_mutex 3995 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on 3996 * ->i_mutex on parents, which works but leads to some truly excessive 3997 * locking]. 3998 */ 3999 static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry, 4000 struct inode *new_dir, struct dentry *new_dentry) 4001 { 4002 int error = 0; 4003 struct inode *target = new_dentry->d_inode; 4004 unsigned max_links = new_dir->i_sb->s_max_links; 4005 4006 /* 4007 * If we are going to change the parent - check write permissions, 4008 * we'll need to flip '..'. 4009 */ 4010 if (new_dir != old_dir) { 4011 error = inode_permission(old_dentry->d_inode, MAY_WRITE); 4012 if (error) 4013 return error; 4014 } 4015 4016 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry); 4017 if (error) 4018 return error; 4019 4020 dget(new_dentry); 4021 if (target) 4022 mutex_lock(&target->i_mutex); 4023 4024 error = -EBUSY; 4025 if (d_mountpoint(old_dentry) || d_mountpoint(new_dentry)) 4026 goto out; 4027 4028 error = -EMLINK; 4029 if (max_links && !target && new_dir != old_dir && 4030 new_dir->i_nlink >= max_links) 4031 goto out; 4032 4033 if (target) 4034 shrink_dcache_parent(new_dentry); 4035 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry); 4036 if (error) 4037 goto out; 4038 4039 if (target) { 4040 target->i_flags |= S_DEAD; 4041 dont_mount(new_dentry); 4042 } 4043 out: 4044 if (target) 4045 mutex_unlock(&target->i_mutex); 4046 dput(new_dentry); 4047 if (!error) 4048 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) 4049 d_move(old_dentry,new_dentry); 4050 return error; 4051 } 4052 4053 static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry, 4054 struct inode *new_dir, struct dentry *new_dentry, 4055 struct inode **delegated_inode) 4056 { 4057 struct inode *target = new_dentry->d_inode; 4058 struct inode *source = old_dentry->d_inode; 4059 int error; 4060 4061 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry); 4062 if (error) 4063 return error; 4064 4065 dget(new_dentry); 4066 lock_two_nondirectories(source, target); 4067 4068 error = -EBUSY; 4069 if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry)) 4070 goto out; 4071 4072 error = try_break_deleg(source, delegated_inode); 4073 if (error) 4074 goto out; 4075 if (target) { 4076 error = try_break_deleg(target, delegated_inode); 4077 if (error) 4078 goto out; 4079 } 4080 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry); 4081 if (error) 4082 goto out; 4083 4084 if (target) 4085 dont_mount(new_dentry); 4086 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) 4087 d_move(old_dentry, new_dentry); 4088 out: 4089 unlock_two_nondirectories(source, target); 4090 dput(new_dentry); 4091 return error; 4092 } 4093 4094 /** 4095 * vfs_rename - rename a filesystem object 4096 * @old_dir: parent of source 4097 * @old_dentry: source 4098 * @new_dir: parent of destination 4099 * @new_dentry: destination 4100 * @delegated_inode: returns an inode needing a delegation break 4101 * 4102 * The caller must hold multiple mutexes--see lock_rename()). 4103 * 4104 * If vfs_rename discovers a delegation in need of breaking at either 4105 * the source or destination, it will return -EWOULDBLOCK and return a 4106 * reference to the inode in delegated_inode. The caller should then 4107 * break the delegation and retry. Because breaking a delegation may 4108 * take a long time, the caller should drop all locks before doing 4109 * so. 4110 * 4111 * Alternatively, a caller may pass NULL for delegated_inode. This may 4112 * be appropriate for callers that expect the underlying filesystem not 4113 * to be NFS exported. 4114 */ 4115 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, 4116 struct inode *new_dir, struct dentry *new_dentry, 4117 struct inode **delegated_inode) 4118 { 4119 int error; 4120 int is_dir = d_is_directory(old_dentry) || d_is_autodir(old_dentry); 4121 const unsigned char *old_name; 4122 4123 if (old_dentry->d_inode == new_dentry->d_inode) 4124 return 0; 4125 4126 error = may_delete(old_dir, old_dentry, is_dir); 4127 if (error) 4128 return error; 4129 4130 if (!new_dentry->d_inode) 4131 error = may_create(new_dir, new_dentry); 4132 else 4133 error = may_delete(new_dir, new_dentry, is_dir); 4134 if (error) 4135 return error; 4136 4137 if (!old_dir->i_op->rename) 4138 return -EPERM; 4139 4140 old_name = fsnotify_oldname_init(old_dentry->d_name.name); 4141 4142 if (is_dir) 4143 error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry); 4144 else 4145 error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry,delegated_inode); 4146 if (!error) 4147 fsnotify_move(old_dir, new_dir, old_name, is_dir, 4148 new_dentry->d_inode, old_dentry); 4149 fsnotify_oldname_free(old_name); 4150 4151 return error; 4152 } 4153 4154 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, 4155 int, newdfd, const char __user *, newname) 4156 { 4157 struct dentry *old_dir, *new_dir; 4158 struct dentry *old_dentry, *new_dentry; 4159 struct dentry *trap; 4160 struct nameidata oldnd, newnd; 4161 struct inode *delegated_inode = NULL; 4162 struct filename *from; 4163 struct filename *to; 4164 unsigned int lookup_flags = 0; 4165 bool should_retry = false; 4166 int error; 4167 retry: 4168 from = user_path_parent(olddfd, oldname, &oldnd, lookup_flags); 4169 if (IS_ERR(from)) { 4170 error = PTR_ERR(from); 4171 goto exit; 4172 } 4173 4174 to = user_path_parent(newdfd, newname, &newnd, lookup_flags); 4175 if (IS_ERR(to)) { 4176 error = PTR_ERR(to); 4177 goto exit1; 4178 } 4179 4180 error = -EXDEV; 4181 if (oldnd.path.mnt != newnd.path.mnt) 4182 goto exit2; 4183 4184 old_dir = oldnd.path.dentry; 4185 error = -EBUSY; 4186 if (oldnd.last_type != LAST_NORM) 4187 goto exit2; 4188 4189 new_dir = newnd.path.dentry; 4190 if (newnd.last_type != LAST_NORM) 4191 goto exit2; 4192 4193 error = mnt_want_write(oldnd.path.mnt); 4194 if (error) 4195 goto exit2; 4196 4197 oldnd.flags &= ~LOOKUP_PARENT; 4198 newnd.flags &= ~LOOKUP_PARENT; 4199 newnd.flags |= LOOKUP_RENAME_TARGET; 4200 4201 retry_deleg: 4202 trap = lock_rename(new_dir, old_dir); 4203 4204 old_dentry = lookup_hash(&oldnd); 4205 error = PTR_ERR(old_dentry); 4206 if (IS_ERR(old_dentry)) 4207 goto exit3; 4208 /* source must exist */ 4209 error = -ENOENT; 4210 if (d_is_negative(old_dentry)) 4211 goto exit4; 4212 /* unless the source is a directory trailing slashes give -ENOTDIR */ 4213 if (!d_is_directory(old_dentry) && !d_is_autodir(old_dentry)) { 4214 error = -ENOTDIR; 4215 if (oldnd.last.name[oldnd.last.len]) 4216 goto exit4; 4217 if (newnd.last.name[newnd.last.len]) 4218 goto exit4; 4219 } 4220 /* source should not be ancestor of target */ 4221 error = -EINVAL; 4222 if (old_dentry == trap) 4223 goto exit4; 4224 new_dentry = lookup_hash(&newnd); 4225 error = PTR_ERR(new_dentry); 4226 if (IS_ERR(new_dentry)) 4227 goto exit4; 4228 /* target should not be an ancestor of source */ 4229 error = -ENOTEMPTY; 4230 if (new_dentry == trap) 4231 goto exit5; 4232 4233 error = security_path_rename(&oldnd.path, old_dentry, 4234 &newnd.path, new_dentry); 4235 if (error) 4236 goto exit5; 4237 error = vfs_rename(old_dir->d_inode, old_dentry, 4238 new_dir->d_inode, new_dentry, 4239 &delegated_inode); 4240 exit5: 4241 dput(new_dentry); 4242 exit4: 4243 dput(old_dentry); 4244 exit3: 4245 unlock_rename(new_dir, old_dir); 4246 if (delegated_inode) { 4247 error = break_deleg_wait(&delegated_inode); 4248 if (!error) 4249 goto retry_deleg; 4250 } 4251 mnt_drop_write(oldnd.path.mnt); 4252 exit2: 4253 if (retry_estale(error, lookup_flags)) 4254 should_retry = true; 4255 path_put(&newnd.path); 4256 putname(to); 4257 exit1: 4258 path_put(&oldnd.path); 4259 putname(from); 4260 if (should_retry) { 4261 should_retry = false; 4262 lookup_flags |= LOOKUP_REVAL; 4263 goto retry; 4264 } 4265 exit: 4266 return error; 4267 } 4268 4269 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) 4270 { 4271 return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname); 4272 } 4273 4274 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link) 4275 { 4276 int len; 4277 4278 len = PTR_ERR(link); 4279 if (IS_ERR(link)) 4280 goto out; 4281 4282 len = strlen(link); 4283 if (len > (unsigned) buflen) 4284 len = buflen; 4285 if (copy_to_user(buffer, link, len)) 4286 len = -EFAULT; 4287 out: 4288 return len; 4289 } 4290 4291 /* 4292 * A helper for ->readlink(). This should be used *ONLY* for symlinks that 4293 * have ->follow_link() touching nd only in nd_set_link(). Using (or not 4294 * using) it for any given inode is up to filesystem. 4295 */ 4296 int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4297 { 4298 struct nameidata nd; 4299 void *cookie; 4300 int res; 4301 4302 nd.depth = 0; 4303 cookie = dentry->d_inode->i_op->follow_link(dentry, &nd); 4304 if (IS_ERR(cookie)) 4305 return PTR_ERR(cookie); 4306 4307 res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd)); 4308 if (dentry->d_inode->i_op->put_link) 4309 dentry->d_inode->i_op->put_link(dentry, &nd, cookie); 4310 return res; 4311 } 4312 4313 /* get the link contents into pagecache */ 4314 static char *page_getlink(struct dentry * dentry, struct page **ppage) 4315 { 4316 char *kaddr; 4317 struct page *page; 4318 struct address_space *mapping = dentry->d_inode->i_mapping; 4319 page = read_mapping_page(mapping, 0, NULL); 4320 if (IS_ERR(page)) 4321 return (char*)page; 4322 *ppage = page; 4323 kaddr = kmap(page); 4324 nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1); 4325 return kaddr; 4326 } 4327 4328 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4329 { 4330 struct page *page = NULL; 4331 char *s = page_getlink(dentry, &page); 4332 int res = vfs_readlink(dentry,buffer,buflen,s); 4333 if (page) { 4334 kunmap(page); 4335 page_cache_release(page); 4336 } 4337 return res; 4338 } 4339 4340 void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd) 4341 { 4342 struct page *page = NULL; 4343 nd_set_link(nd, page_getlink(dentry, &page)); 4344 return page; 4345 } 4346 4347 void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie) 4348 { 4349 struct page *page = cookie; 4350 4351 if (page) { 4352 kunmap(page); 4353 page_cache_release(page); 4354 } 4355 } 4356 4357 /* 4358 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS 4359 */ 4360 int __page_symlink(struct inode *inode, const char *symname, int len, int nofs) 4361 { 4362 struct address_space *mapping = inode->i_mapping; 4363 struct page *page; 4364 void *fsdata; 4365 int err; 4366 char *kaddr; 4367 unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE; 4368 if (nofs) 4369 flags |= AOP_FLAG_NOFS; 4370 4371 retry: 4372 err = pagecache_write_begin(NULL, mapping, 0, len-1, 4373 flags, &page, &fsdata); 4374 if (err) 4375 goto fail; 4376 4377 kaddr = kmap_atomic(page); 4378 memcpy(kaddr, symname, len-1); 4379 kunmap_atomic(kaddr); 4380 4381 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1, 4382 page, fsdata); 4383 if (err < 0) 4384 goto fail; 4385 if (err < len-1) 4386 goto retry; 4387 4388 mark_inode_dirty(inode); 4389 return 0; 4390 fail: 4391 return err; 4392 } 4393 4394 int page_symlink(struct inode *inode, const char *symname, int len) 4395 { 4396 return __page_symlink(inode, symname, len, 4397 !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS)); 4398 } 4399 4400 const struct inode_operations page_symlink_inode_operations = { 4401 .readlink = generic_readlink, 4402 .follow_link = page_follow_link_light, 4403 .put_link = page_put_link, 4404 }; 4405 4406 EXPORT_SYMBOL(user_path_at); 4407 EXPORT_SYMBOL(follow_down_one); 4408 EXPORT_SYMBOL(follow_down); 4409 EXPORT_SYMBOL(follow_up); 4410 EXPORT_SYMBOL(get_write_access); /* nfsd */ 4411 EXPORT_SYMBOL(lock_rename); 4412 EXPORT_SYMBOL(lookup_one_len); 4413 EXPORT_SYMBOL(page_follow_link_light); 4414 EXPORT_SYMBOL(page_put_link); 4415 EXPORT_SYMBOL(page_readlink); 4416 EXPORT_SYMBOL(__page_symlink); 4417 EXPORT_SYMBOL(page_symlink); 4418 EXPORT_SYMBOL(page_symlink_inode_operations); 4419 EXPORT_SYMBOL(kern_path); 4420 EXPORT_SYMBOL(vfs_path_lookup); 4421 EXPORT_SYMBOL(inode_permission); 4422 EXPORT_SYMBOL(unlock_rename); 4423 EXPORT_SYMBOL(vfs_create); 4424 EXPORT_SYMBOL(vfs_link); 4425 EXPORT_SYMBOL(vfs_mkdir); 4426 EXPORT_SYMBOL(vfs_mknod); 4427 EXPORT_SYMBOL(generic_permission); 4428 EXPORT_SYMBOL(vfs_readlink); 4429 EXPORT_SYMBOL(vfs_rename); 4430 EXPORT_SYMBOL(vfs_rmdir); 4431 EXPORT_SYMBOL(vfs_symlink); 4432 EXPORT_SYMBOL(vfs_unlink); 4433 EXPORT_SYMBOL(dentry_unhash); 4434 EXPORT_SYMBOL(generic_readlink); 4435