1 /* 2 * linux/fs/namei.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * Some corrections by tytso. 9 */ 10 11 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname 12 * lookup logic. 13 */ 14 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture. 15 */ 16 17 #include <linux/init.h> 18 #include <linux/export.h> 19 #include <linux/kernel.h> 20 #include <linux/slab.h> 21 #include <linux/fs.h> 22 #include <linux/namei.h> 23 #include <linux/pagemap.h> 24 #include <linux/fsnotify.h> 25 #include <linux/personality.h> 26 #include <linux/security.h> 27 #include <linux/ima.h> 28 #include <linux/syscalls.h> 29 #include <linux/mount.h> 30 #include <linux/audit.h> 31 #include <linux/capability.h> 32 #include <linux/file.h> 33 #include <linux/fcntl.h> 34 #include <linux/device_cgroup.h> 35 #include <linux/fs_struct.h> 36 #include <linux/posix_acl.h> 37 #include <asm/uaccess.h> 38 39 #include "internal.h" 40 #include "mount.h" 41 42 /* [Feb-1997 T. Schoebel-Theuer] 43 * Fundamental changes in the pathname lookup mechanisms (namei) 44 * were necessary because of omirr. The reason is that omirr needs 45 * to know the _real_ pathname, not the user-supplied one, in case 46 * of symlinks (and also when transname replacements occur). 47 * 48 * The new code replaces the old recursive symlink resolution with 49 * an iterative one (in case of non-nested symlink chains). It does 50 * this with calls to <fs>_follow_link(). 51 * As a side effect, dir_namei(), _namei() and follow_link() are now 52 * replaced with a single function lookup_dentry() that can handle all 53 * the special cases of the former code. 54 * 55 * With the new dcache, the pathname is stored at each inode, at least as 56 * long as the refcount of the inode is positive. As a side effect, the 57 * size of the dcache depends on the inode cache and thus is dynamic. 58 * 59 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink 60 * resolution to correspond with current state of the code. 61 * 62 * Note that the symlink resolution is not *completely* iterative. 63 * There is still a significant amount of tail- and mid- recursion in 64 * the algorithm. Also, note that <fs>_readlink() is not used in 65 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink() 66 * may return different results than <fs>_follow_link(). Many virtual 67 * filesystems (including /proc) exhibit this behavior. 68 */ 69 70 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation: 71 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL 72 * and the name already exists in form of a symlink, try to create the new 73 * name indicated by the symlink. The old code always complained that the 74 * name already exists, due to not following the symlink even if its target 75 * is nonexistent. The new semantics affects also mknod() and link() when 76 * the name is a symlink pointing to a non-existent name. 77 * 78 * I don't know which semantics is the right one, since I have no access 79 * to standards. But I found by trial that HP-UX 9.0 has the full "new" 80 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the 81 * "old" one. Personally, I think the new semantics is much more logical. 82 * Note that "ln old new" where "new" is a symlink pointing to a non-existing 83 * file does succeed in both HP-UX and SunOs, but not in Solaris 84 * and in the old Linux semantics. 85 */ 86 87 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink 88 * semantics. See the comments in "open_namei" and "do_link" below. 89 * 90 * [10-Sep-98 Alan Modra] Another symlink change. 91 */ 92 93 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks: 94 * inside the path - always follow. 95 * in the last component in creation/removal/renaming - never follow. 96 * if LOOKUP_FOLLOW passed - follow. 97 * if the pathname has trailing slashes - follow. 98 * otherwise - don't follow. 99 * (applied in that order). 100 * 101 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT 102 * restored for 2.4. This is the last surviving part of old 4.2BSD bug. 103 * During the 2.4 we need to fix the userland stuff depending on it - 104 * hopefully we will be able to get rid of that wart in 2.5. So far only 105 * XEmacs seems to be relying on it... 106 */ 107 /* 108 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland) 109 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives 110 * any extra contention... 111 */ 112 113 /* In order to reduce some races, while at the same time doing additional 114 * checking and hopefully speeding things up, we copy filenames to the 115 * kernel data space before using them.. 116 * 117 * POSIX.1 2.4: an empty pathname is invalid (ENOENT). 118 * PATH_MAX includes the nul terminator --RR. 119 */ 120 void final_putname(struct filename *name) 121 { 122 if (name->separate) { 123 __putname(name->name); 124 kfree(name); 125 } else { 126 __putname(name); 127 } 128 } 129 130 #define EMBEDDED_NAME_MAX (PATH_MAX - sizeof(struct filename)) 131 132 static struct filename * 133 getname_flags(const char __user *filename, int flags, int *empty) 134 { 135 struct filename *result, *err; 136 int len; 137 long max; 138 char *kname; 139 140 result = audit_reusename(filename); 141 if (result) 142 return result; 143 144 result = __getname(); 145 if (unlikely(!result)) 146 return ERR_PTR(-ENOMEM); 147 148 /* 149 * First, try to embed the struct filename inside the names_cache 150 * allocation 151 */ 152 kname = (char *)result + sizeof(*result); 153 result->name = kname; 154 result->separate = false; 155 max = EMBEDDED_NAME_MAX; 156 157 recopy: 158 len = strncpy_from_user(kname, filename, max); 159 if (unlikely(len < 0)) { 160 err = ERR_PTR(len); 161 goto error; 162 } 163 164 /* 165 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a 166 * separate struct filename so we can dedicate the entire 167 * names_cache allocation for the pathname, and re-do the copy from 168 * userland. 169 */ 170 if (len == EMBEDDED_NAME_MAX && max == EMBEDDED_NAME_MAX) { 171 kname = (char *)result; 172 173 result = kzalloc(sizeof(*result), GFP_KERNEL); 174 if (!result) { 175 err = ERR_PTR(-ENOMEM); 176 result = (struct filename *)kname; 177 goto error; 178 } 179 result->name = kname; 180 result->separate = true; 181 max = PATH_MAX; 182 goto recopy; 183 } 184 185 /* The empty path is special. */ 186 if (unlikely(!len)) { 187 if (empty) 188 *empty = 1; 189 err = ERR_PTR(-ENOENT); 190 if (!(flags & LOOKUP_EMPTY)) 191 goto error; 192 } 193 194 err = ERR_PTR(-ENAMETOOLONG); 195 if (unlikely(len >= PATH_MAX)) 196 goto error; 197 198 result->uptr = filename; 199 result->aname = NULL; 200 audit_getname(result); 201 return result; 202 203 error: 204 final_putname(result); 205 return err; 206 } 207 208 struct filename * 209 getname(const char __user * filename) 210 { 211 return getname_flags(filename, 0, NULL); 212 } 213 214 /* 215 * The "getname_kernel()" interface doesn't do pathnames longer 216 * than EMBEDDED_NAME_MAX. Deal with it - you're a kernel user. 217 */ 218 struct filename * 219 getname_kernel(const char * filename) 220 { 221 struct filename *result; 222 char *kname; 223 int len; 224 225 len = strlen(filename); 226 if (len >= EMBEDDED_NAME_MAX) 227 return ERR_PTR(-ENAMETOOLONG); 228 229 result = __getname(); 230 if (unlikely(!result)) 231 return ERR_PTR(-ENOMEM); 232 233 kname = (char *)result + sizeof(*result); 234 result->name = kname; 235 result->uptr = NULL; 236 result->aname = NULL; 237 result->separate = false; 238 239 strlcpy(kname, filename, EMBEDDED_NAME_MAX); 240 return result; 241 } 242 243 #ifdef CONFIG_AUDITSYSCALL 244 void putname(struct filename *name) 245 { 246 if (unlikely(!audit_dummy_context())) 247 return audit_putname(name); 248 final_putname(name); 249 } 250 #endif 251 252 static int check_acl(struct inode *inode, int mask) 253 { 254 #ifdef CONFIG_FS_POSIX_ACL 255 struct posix_acl *acl; 256 257 if (mask & MAY_NOT_BLOCK) { 258 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS); 259 if (!acl) 260 return -EAGAIN; 261 /* no ->get_acl() calls in RCU mode... */ 262 if (acl == ACL_NOT_CACHED) 263 return -ECHILD; 264 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK); 265 } 266 267 acl = get_acl(inode, ACL_TYPE_ACCESS); 268 if (IS_ERR(acl)) 269 return PTR_ERR(acl); 270 if (acl) { 271 int error = posix_acl_permission(inode, acl, mask); 272 posix_acl_release(acl); 273 return error; 274 } 275 #endif 276 277 return -EAGAIN; 278 } 279 280 /* 281 * This does the basic permission checking 282 */ 283 static int acl_permission_check(struct inode *inode, int mask) 284 { 285 unsigned int mode = inode->i_mode; 286 287 if (likely(uid_eq(current_fsuid(), inode->i_uid))) 288 mode >>= 6; 289 else { 290 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { 291 int error = check_acl(inode, mask); 292 if (error != -EAGAIN) 293 return error; 294 } 295 296 if (in_group_p(inode->i_gid)) 297 mode >>= 3; 298 } 299 300 /* 301 * If the DACs are ok we don't need any capability check. 302 */ 303 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0) 304 return 0; 305 return -EACCES; 306 } 307 308 /** 309 * generic_permission - check for access rights on a Posix-like filesystem 310 * @inode: inode to check access rights for 311 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...) 312 * 313 * Used to check for read/write/execute permissions on a file. 314 * We use "fsuid" for this, letting us set arbitrary permissions 315 * for filesystem access without changing the "normal" uids which 316 * are used for other things. 317 * 318 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk 319 * request cannot be satisfied (eg. requires blocking or too much complexity). 320 * It would then be called again in ref-walk mode. 321 */ 322 int generic_permission(struct inode *inode, int mask) 323 { 324 int ret; 325 326 /* 327 * Do the basic permission checks. 328 */ 329 ret = acl_permission_check(inode, mask); 330 if (ret != -EACCES) 331 return ret; 332 333 if (S_ISDIR(inode->i_mode)) { 334 /* DACs are overridable for directories */ 335 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) 336 return 0; 337 if (!(mask & MAY_WRITE)) 338 if (capable_wrt_inode_uidgid(inode, 339 CAP_DAC_READ_SEARCH)) 340 return 0; 341 return -EACCES; 342 } 343 /* 344 * Read/write DACs are always overridable. 345 * Executable DACs are overridable when there is 346 * at least one exec bit set. 347 */ 348 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 349 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) 350 return 0; 351 352 /* 353 * Searching includes executable on directories, else just read. 354 */ 355 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 356 if (mask == MAY_READ) 357 if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH)) 358 return 0; 359 360 return -EACCES; 361 } 362 EXPORT_SYMBOL(generic_permission); 363 364 /* 365 * We _really_ want to just do "generic_permission()" without 366 * even looking at the inode->i_op values. So we keep a cache 367 * flag in inode->i_opflags, that says "this has not special 368 * permission function, use the fast case". 369 */ 370 static inline int do_inode_permission(struct inode *inode, int mask) 371 { 372 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) { 373 if (likely(inode->i_op->permission)) 374 return inode->i_op->permission(inode, mask); 375 376 /* This gets set once for the inode lifetime */ 377 spin_lock(&inode->i_lock); 378 inode->i_opflags |= IOP_FASTPERM; 379 spin_unlock(&inode->i_lock); 380 } 381 return generic_permission(inode, mask); 382 } 383 384 /** 385 * __inode_permission - Check for access rights to a given inode 386 * @inode: Inode to check permission on 387 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 388 * 389 * Check for read/write/execute permissions on an inode. 390 * 391 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 392 * 393 * This does not check for a read-only file system. You probably want 394 * inode_permission(). 395 */ 396 int __inode_permission(struct inode *inode, int mask) 397 { 398 int retval; 399 400 if (unlikely(mask & MAY_WRITE)) { 401 /* 402 * Nobody gets write access to an immutable file. 403 */ 404 if (IS_IMMUTABLE(inode)) 405 return -EACCES; 406 } 407 408 retval = do_inode_permission(inode, mask); 409 if (retval) 410 return retval; 411 412 retval = devcgroup_inode_permission(inode, mask); 413 if (retval) 414 return retval; 415 416 return security_inode_permission(inode, mask); 417 } 418 419 /** 420 * sb_permission - Check superblock-level permissions 421 * @sb: Superblock of inode to check permission on 422 * @inode: Inode to check permission on 423 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 424 * 425 * Separate out file-system wide checks from inode-specific permission checks. 426 */ 427 static int sb_permission(struct super_block *sb, struct inode *inode, int mask) 428 { 429 if (unlikely(mask & MAY_WRITE)) { 430 umode_t mode = inode->i_mode; 431 432 /* Nobody gets write access to a read-only fs. */ 433 if ((sb->s_flags & MS_RDONLY) && 434 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) 435 return -EROFS; 436 } 437 return 0; 438 } 439 440 /** 441 * inode_permission - Check for access rights to a given inode 442 * @inode: Inode to check permission on 443 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 444 * 445 * Check for read/write/execute permissions on an inode. We use fs[ug]id for 446 * this, letting us set arbitrary permissions for filesystem access without 447 * changing the "normal" UIDs which are used for other things. 448 * 449 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 450 */ 451 int inode_permission(struct inode *inode, int mask) 452 { 453 int retval; 454 455 retval = sb_permission(inode->i_sb, inode, mask); 456 if (retval) 457 return retval; 458 return __inode_permission(inode, mask); 459 } 460 EXPORT_SYMBOL(inode_permission); 461 462 /** 463 * path_get - get a reference to a path 464 * @path: path to get the reference to 465 * 466 * Given a path increment the reference count to the dentry and the vfsmount. 467 */ 468 void path_get(const struct path *path) 469 { 470 mntget(path->mnt); 471 dget(path->dentry); 472 } 473 EXPORT_SYMBOL(path_get); 474 475 /** 476 * path_put - put a reference to a path 477 * @path: path to put the reference to 478 * 479 * Given a path decrement the reference count to the dentry and the vfsmount. 480 */ 481 void path_put(const struct path *path) 482 { 483 dput(path->dentry); 484 mntput(path->mnt); 485 } 486 EXPORT_SYMBOL(path_put); 487 488 /* 489 * Path walking has 2 modes, rcu-walk and ref-walk (see 490 * Documentation/filesystems/path-lookup.txt). In situations when we can't 491 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab 492 * normal reference counts on dentries and vfsmounts to transition to rcu-walk 493 * mode. Refcounts are grabbed at the last known good point before rcu-walk 494 * got stuck, so ref-walk may continue from there. If this is not successful 495 * (eg. a seqcount has changed), then failure is returned and it's up to caller 496 * to restart the path walk from the beginning in ref-walk mode. 497 */ 498 499 /** 500 * unlazy_walk - try to switch to ref-walk mode. 501 * @nd: nameidata pathwalk data 502 * @dentry: child of nd->path.dentry or NULL 503 * Returns: 0 on success, -ECHILD on failure 504 * 505 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry 506 * for ref-walk mode. @dentry must be a path found by a do_lookup call on 507 * @nd or NULL. Must be called from rcu-walk context. 508 */ 509 static int unlazy_walk(struct nameidata *nd, struct dentry *dentry) 510 { 511 struct fs_struct *fs = current->fs; 512 struct dentry *parent = nd->path.dentry; 513 514 BUG_ON(!(nd->flags & LOOKUP_RCU)); 515 516 /* 517 * After legitimizing the bastards, terminate_walk() 518 * will do the right thing for non-RCU mode, and all our 519 * subsequent exit cases should rcu_read_unlock() 520 * before returning. Do vfsmount first; if dentry 521 * can't be legitimized, just set nd->path.dentry to NULL 522 * and rely on dput(NULL) being a no-op. 523 */ 524 if (!legitimize_mnt(nd->path.mnt, nd->m_seq)) 525 return -ECHILD; 526 nd->flags &= ~LOOKUP_RCU; 527 528 if (!lockref_get_not_dead(&parent->d_lockref)) { 529 nd->path.dentry = NULL; 530 goto out; 531 } 532 533 /* 534 * For a negative lookup, the lookup sequence point is the parents 535 * sequence point, and it only needs to revalidate the parent dentry. 536 * 537 * For a positive lookup, we need to move both the parent and the 538 * dentry from the RCU domain to be properly refcounted. And the 539 * sequence number in the dentry validates *both* dentry counters, 540 * since we checked the sequence number of the parent after we got 541 * the child sequence number. So we know the parent must still 542 * be valid if the child sequence number is still valid. 543 */ 544 if (!dentry) { 545 if (read_seqcount_retry(&parent->d_seq, nd->seq)) 546 goto out; 547 BUG_ON(nd->inode != parent->d_inode); 548 } else { 549 if (!lockref_get_not_dead(&dentry->d_lockref)) 550 goto out; 551 if (read_seqcount_retry(&dentry->d_seq, nd->seq)) 552 goto drop_dentry; 553 } 554 555 /* 556 * Sequence counts matched. Now make sure that the root is 557 * still valid and get it if required. 558 */ 559 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 560 spin_lock(&fs->lock); 561 if (nd->root.mnt != fs->root.mnt || nd->root.dentry != fs->root.dentry) 562 goto unlock_and_drop_dentry; 563 path_get(&nd->root); 564 spin_unlock(&fs->lock); 565 } 566 567 rcu_read_unlock(); 568 return 0; 569 570 unlock_and_drop_dentry: 571 spin_unlock(&fs->lock); 572 drop_dentry: 573 rcu_read_unlock(); 574 dput(dentry); 575 goto drop_root_mnt; 576 out: 577 rcu_read_unlock(); 578 drop_root_mnt: 579 if (!(nd->flags & LOOKUP_ROOT)) 580 nd->root.mnt = NULL; 581 return -ECHILD; 582 } 583 584 static inline int d_revalidate(struct dentry *dentry, unsigned int flags) 585 { 586 return dentry->d_op->d_revalidate(dentry, flags); 587 } 588 589 /** 590 * complete_walk - successful completion of path walk 591 * @nd: pointer nameidata 592 * 593 * If we had been in RCU mode, drop out of it and legitimize nd->path. 594 * Revalidate the final result, unless we'd already done that during 595 * the path walk or the filesystem doesn't ask for it. Return 0 on 596 * success, -error on failure. In case of failure caller does not 597 * need to drop nd->path. 598 */ 599 static int complete_walk(struct nameidata *nd) 600 { 601 struct dentry *dentry = nd->path.dentry; 602 int status; 603 604 if (nd->flags & LOOKUP_RCU) { 605 nd->flags &= ~LOOKUP_RCU; 606 if (!(nd->flags & LOOKUP_ROOT)) 607 nd->root.mnt = NULL; 608 609 if (!legitimize_mnt(nd->path.mnt, nd->m_seq)) { 610 rcu_read_unlock(); 611 return -ECHILD; 612 } 613 if (unlikely(!lockref_get_not_dead(&dentry->d_lockref))) { 614 rcu_read_unlock(); 615 mntput(nd->path.mnt); 616 return -ECHILD; 617 } 618 if (read_seqcount_retry(&dentry->d_seq, nd->seq)) { 619 rcu_read_unlock(); 620 dput(dentry); 621 mntput(nd->path.mnt); 622 return -ECHILD; 623 } 624 rcu_read_unlock(); 625 } 626 627 if (likely(!(nd->flags & LOOKUP_JUMPED))) 628 return 0; 629 630 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE))) 631 return 0; 632 633 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags); 634 if (status > 0) 635 return 0; 636 637 if (!status) 638 status = -ESTALE; 639 640 path_put(&nd->path); 641 return status; 642 } 643 644 static __always_inline void set_root(struct nameidata *nd) 645 { 646 if (!nd->root.mnt) 647 get_fs_root(current->fs, &nd->root); 648 } 649 650 static int link_path_walk(const char *, struct nameidata *); 651 652 static __always_inline void set_root_rcu(struct nameidata *nd) 653 { 654 if (!nd->root.mnt) { 655 struct fs_struct *fs = current->fs; 656 unsigned seq; 657 658 do { 659 seq = read_seqcount_begin(&fs->seq); 660 nd->root = fs->root; 661 nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq); 662 } while (read_seqcount_retry(&fs->seq, seq)); 663 } 664 } 665 666 static void path_put_conditional(struct path *path, struct nameidata *nd) 667 { 668 dput(path->dentry); 669 if (path->mnt != nd->path.mnt) 670 mntput(path->mnt); 671 } 672 673 static inline void path_to_nameidata(const struct path *path, 674 struct nameidata *nd) 675 { 676 if (!(nd->flags & LOOKUP_RCU)) { 677 dput(nd->path.dentry); 678 if (nd->path.mnt != path->mnt) 679 mntput(nd->path.mnt); 680 } 681 nd->path.mnt = path->mnt; 682 nd->path.dentry = path->dentry; 683 } 684 685 /* 686 * Helper to directly jump to a known parsed path from ->follow_link, 687 * caller must have taken a reference to path beforehand. 688 */ 689 void nd_jump_link(struct nameidata *nd, struct path *path) 690 { 691 path_put(&nd->path); 692 693 nd->path = *path; 694 nd->inode = nd->path.dentry->d_inode; 695 nd->flags |= LOOKUP_JUMPED; 696 } 697 698 static inline void put_link(struct nameidata *nd, struct path *link, void *cookie) 699 { 700 struct inode *inode = link->dentry->d_inode; 701 if (inode->i_op->put_link) 702 inode->i_op->put_link(link->dentry, nd, cookie); 703 path_put(link); 704 } 705 706 int sysctl_protected_symlinks __read_mostly = 0; 707 int sysctl_protected_hardlinks __read_mostly = 0; 708 709 /** 710 * may_follow_link - Check symlink following for unsafe situations 711 * @link: The path of the symlink 712 * @nd: nameidata pathwalk data 713 * 714 * In the case of the sysctl_protected_symlinks sysctl being enabled, 715 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is 716 * in a sticky world-writable directory. This is to protect privileged 717 * processes from failing races against path names that may change out 718 * from under them by way of other users creating malicious symlinks. 719 * It will permit symlinks to be followed only when outside a sticky 720 * world-writable directory, or when the uid of the symlink and follower 721 * match, or when the directory owner matches the symlink's owner. 722 * 723 * Returns 0 if following the symlink is allowed, -ve on error. 724 */ 725 static inline int may_follow_link(struct path *link, struct nameidata *nd) 726 { 727 const struct inode *inode; 728 const struct inode *parent; 729 730 if (!sysctl_protected_symlinks) 731 return 0; 732 733 /* Allowed if owner and follower match. */ 734 inode = link->dentry->d_inode; 735 if (uid_eq(current_cred()->fsuid, inode->i_uid)) 736 return 0; 737 738 /* Allowed if parent directory not sticky and world-writable. */ 739 parent = nd->path.dentry->d_inode; 740 if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH)) 741 return 0; 742 743 /* Allowed if parent directory and link owner match. */ 744 if (uid_eq(parent->i_uid, inode->i_uid)) 745 return 0; 746 747 audit_log_link_denied("follow_link", link); 748 path_put_conditional(link, nd); 749 path_put(&nd->path); 750 return -EACCES; 751 } 752 753 /** 754 * safe_hardlink_source - Check for safe hardlink conditions 755 * @inode: the source inode to hardlink from 756 * 757 * Return false if at least one of the following conditions: 758 * - inode is not a regular file 759 * - inode is setuid 760 * - inode is setgid and group-exec 761 * - access failure for read and write 762 * 763 * Otherwise returns true. 764 */ 765 static bool safe_hardlink_source(struct inode *inode) 766 { 767 umode_t mode = inode->i_mode; 768 769 /* Special files should not get pinned to the filesystem. */ 770 if (!S_ISREG(mode)) 771 return false; 772 773 /* Setuid files should not get pinned to the filesystem. */ 774 if (mode & S_ISUID) 775 return false; 776 777 /* Executable setgid files should not get pinned to the filesystem. */ 778 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) 779 return false; 780 781 /* Hardlinking to unreadable or unwritable sources is dangerous. */ 782 if (inode_permission(inode, MAY_READ | MAY_WRITE)) 783 return false; 784 785 return true; 786 } 787 788 /** 789 * may_linkat - Check permissions for creating a hardlink 790 * @link: the source to hardlink from 791 * 792 * Block hardlink when all of: 793 * - sysctl_protected_hardlinks enabled 794 * - fsuid does not match inode 795 * - hardlink source is unsafe (see safe_hardlink_source() above) 796 * - not CAP_FOWNER 797 * 798 * Returns 0 if successful, -ve on error. 799 */ 800 static int may_linkat(struct path *link) 801 { 802 const struct cred *cred; 803 struct inode *inode; 804 805 if (!sysctl_protected_hardlinks) 806 return 0; 807 808 cred = current_cred(); 809 inode = link->dentry->d_inode; 810 811 /* Source inode owner (or CAP_FOWNER) can hardlink all they like, 812 * otherwise, it must be a safe source. 813 */ 814 if (uid_eq(cred->fsuid, inode->i_uid) || safe_hardlink_source(inode) || 815 capable(CAP_FOWNER)) 816 return 0; 817 818 audit_log_link_denied("linkat", link); 819 return -EPERM; 820 } 821 822 static __always_inline int 823 follow_link(struct path *link, struct nameidata *nd, void **p) 824 { 825 struct dentry *dentry = link->dentry; 826 int error; 827 char *s; 828 829 BUG_ON(nd->flags & LOOKUP_RCU); 830 831 if (link->mnt == nd->path.mnt) 832 mntget(link->mnt); 833 834 error = -ELOOP; 835 if (unlikely(current->total_link_count >= 40)) 836 goto out_put_nd_path; 837 838 cond_resched(); 839 current->total_link_count++; 840 841 touch_atime(link); 842 nd_set_link(nd, NULL); 843 844 error = security_inode_follow_link(link->dentry, nd); 845 if (error) 846 goto out_put_nd_path; 847 848 nd->last_type = LAST_BIND; 849 *p = dentry->d_inode->i_op->follow_link(dentry, nd); 850 error = PTR_ERR(*p); 851 if (IS_ERR(*p)) 852 goto out_put_nd_path; 853 854 error = 0; 855 s = nd_get_link(nd); 856 if (s) { 857 if (unlikely(IS_ERR(s))) { 858 path_put(&nd->path); 859 put_link(nd, link, *p); 860 return PTR_ERR(s); 861 } 862 if (*s == '/') { 863 set_root(nd); 864 path_put(&nd->path); 865 nd->path = nd->root; 866 path_get(&nd->root); 867 nd->flags |= LOOKUP_JUMPED; 868 } 869 nd->inode = nd->path.dentry->d_inode; 870 error = link_path_walk(s, nd); 871 if (unlikely(error)) 872 put_link(nd, link, *p); 873 } 874 875 return error; 876 877 out_put_nd_path: 878 *p = NULL; 879 path_put(&nd->path); 880 path_put(link); 881 return error; 882 } 883 884 static int follow_up_rcu(struct path *path) 885 { 886 struct mount *mnt = real_mount(path->mnt); 887 struct mount *parent; 888 struct dentry *mountpoint; 889 890 parent = mnt->mnt_parent; 891 if (&parent->mnt == path->mnt) 892 return 0; 893 mountpoint = mnt->mnt_mountpoint; 894 path->dentry = mountpoint; 895 path->mnt = &parent->mnt; 896 return 1; 897 } 898 899 /* 900 * follow_up - Find the mountpoint of path's vfsmount 901 * 902 * Given a path, find the mountpoint of its source file system. 903 * Replace @path with the path of the mountpoint in the parent mount. 904 * Up is towards /. 905 * 906 * Return 1 if we went up a level and 0 if we were already at the 907 * root. 908 */ 909 int follow_up(struct path *path) 910 { 911 struct mount *mnt = real_mount(path->mnt); 912 struct mount *parent; 913 struct dentry *mountpoint; 914 915 read_seqlock_excl(&mount_lock); 916 parent = mnt->mnt_parent; 917 if (parent == mnt) { 918 read_sequnlock_excl(&mount_lock); 919 return 0; 920 } 921 mntget(&parent->mnt); 922 mountpoint = dget(mnt->mnt_mountpoint); 923 read_sequnlock_excl(&mount_lock); 924 dput(path->dentry); 925 path->dentry = mountpoint; 926 mntput(path->mnt); 927 path->mnt = &parent->mnt; 928 return 1; 929 } 930 EXPORT_SYMBOL(follow_up); 931 932 /* 933 * Perform an automount 934 * - return -EISDIR to tell follow_managed() to stop and return the path we 935 * were called with. 936 */ 937 static int follow_automount(struct path *path, unsigned flags, 938 bool *need_mntput) 939 { 940 struct vfsmount *mnt; 941 int err; 942 943 if (!path->dentry->d_op || !path->dentry->d_op->d_automount) 944 return -EREMOTE; 945 946 /* We don't want to mount if someone's just doing a stat - 947 * unless they're stat'ing a directory and appended a '/' to 948 * the name. 949 * 950 * We do, however, want to mount if someone wants to open or 951 * create a file of any type under the mountpoint, wants to 952 * traverse through the mountpoint or wants to open the 953 * mounted directory. Also, autofs may mark negative dentries 954 * as being automount points. These will need the attentions 955 * of the daemon to instantiate them before they can be used. 956 */ 957 if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | 958 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) && 959 path->dentry->d_inode) 960 return -EISDIR; 961 962 current->total_link_count++; 963 if (current->total_link_count >= 40) 964 return -ELOOP; 965 966 mnt = path->dentry->d_op->d_automount(path); 967 if (IS_ERR(mnt)) { 968 /* 969 * The filesystem is allowed to return -EISDIR here to indicate 970 * it doesn't want to automount. For instance, autofs would do 971 * this so that its userspace daemon can mount on this dentry. 972 * 973 * However, we can only permit this if it's a terminal point in 974 * the path being looked up; if it wasn't then the remainder of 975 * the path is inaccessible and we should say so. 976 */ 977 if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT)) 978 return -EREMOTE; 979 return PTR_ERR(mnt); 980 } 981 982 if (!mnt) /* mount collision */ 983 return 0; 984 985 if (!*need_mntput) { 986 /* lock_mount() may release path->mnt on error */ 987 mntget(path->mnt); 988 *need_mntput = true; 989 } 990 err = finish_automount(mnt, path); 991 992 switch (err) { 993 case -EBUSY: 994 /* Someone else made a mount here whilst we were busy */ 995 return 0; 996 case 0: 997 path_put(path); 998 path->mnt = mnt; 999 path->dentry = dget(mnt->mnt_root); 1000 return 0; 1001 default: 1002 return err; 1003 } 1004 1005 } 1006 1007 /* 1008 * Handle a dentry that is managed in some way. 1009 * - Flagged for transit management (autofs) 1010 * - Flagged as mountpoint 1011 * - Flagged as automount point 1012 * 1013 * This may only be called in refwalk mode. 1014 * 1015 * Serialization is taken care of in namespace.c 1016 */ 1017 static int follow_managed(struct path *path, unsigned flags) 1018 { 1019 struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */ 1020 unsigned managed; 1021 bool need_mntput = false; 1022 int ret = 0; 1023 1024 /* Given that we're not holding a lock here, we retain the value in a 1025 * local variable for each dentry as we look at it so that we don't see 1026 * the components of that value change under us */ 1027 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1028 managed &= DCACHE_MANAGED_DENTRY, 1029 unlikely(managed != 0)) { 1030 /* Allow the filesystem to manage the transit without i_mutex 1031 * being held. */ 1032 if (managed & DCACHE_MANAGE_TRANSIT) { 1033 BUG_ON(!path->dentry->d_op); 1034 BUG_ON(!path->dentry->d_op->d_manage); 1035 ret = path->dentry->d_op->d_manage(path->dentry, false); 1036 if (ret < 0) 1037 break; 1038 } 1039 1040 /* Transit to a mounted filesystem. */ 1041 if (managed & DCACHE_MOUNTED) { 1042 struct vfsmount *mounted = lookup_mnt(path); 1043 if (mounted) { 1044 dput(path->dentry); 1045 if (need_mntput) 1046 mntput(path->mnt); 1047 path->mnt = mounted; 1048 path->dentry = dget(mounted->mnt_root); 1049 need_mntput = true; 1050 continue; 1051 } 1052 1053 /* Something is mounted on this dentry in another 1054 * namespace and/or whatever was mounted there in this 1055 * namespace got unmounted before lookup_mnt() could 1056 * get it */ 1057 } 1058 1059 /* Handle an automount point */ 1060 if (managed & DCACHE_NEED_AUTOMOUNT) { 1061 ret = follow_automount(path, flags, &need_mntput); 1062 if (ret < 0) 1063 break; 1064 continue; 1065 } 1066 1067 /* We didn't change the current path point */ 1068 break; 1069 } 1070 1071 if (need_mntput && path->mnt == mnt) 1072 mntput(path->mnt); 1073 if (ret == -EISDIR) 1074 ret = 0; 1075 return ret < 0 ? ret : need_mntput; 1076 } 1077 1078 int follow_down_one(struct path *path) 1079 { 1080 struct vfsmount *mounted; 1081 1082 mounted = lookup_mnt(path); 1083 if (mounted) { 1084 dput(path->dentry); 1085 mntput(path->mnt); 1086 path->mnt = mounted; 1087 path->dentry = dget(mounted->mnt_root); 1088 return 1; 1089 } 1090 return 0; 1091 } 1092 EXPORT_SYMBOL(follow_down_one); 1093 1094 static inline bool managed_dentry_might_block(struct dentry *dentry) 1095 { 1096 return (dentry->d_flags & DCACHE_MANAGE_TRANSIT && 1097 dentry->d_op->d_manage(dentry, true) < 0); 1098 } 1099 1100 /* 1101 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if 1102 * we meet a managed dentry that would need blocking. 1103 */ 1104 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, 1105 struct inode **inode) 1106 { 1107 for (;;) { 1108 struct mount *mounted; 1109 /* 1110 * Don't forget we might have a non-mountpoint managed dentry 1111 * that wants to block transit. 1112 */ 1113 if (unlikely(managed_dentry_might_block(path->dentry))) 1114 return false; 1115 1116 if (!d_mountpoint(path->dentry)) 1117 return true; 1118 1119 mounted = __lookup_mnt(path->mnt, path->dentry); 1120 if (!mounted) 1121 break; 1122 path->mnt = &mounted->mnt; 1123 path->dentry = mounted->mnt.mnt_root; 1124 nd->flags |= LOOKUP_JUMPED; 1125 nd->seq = read_seqcount_begin(&path->dentry->d_seq); 1126 /* 1127 * Update the inode too. We don't need to re-check the 1128 * dentry sequence number here after this d_inode read, 1129 * because a mount-point is always pinned. 1130 */ 1131 *inode = path->dentry->d_inode; 1132 } 1133 return read_seqretry(&mount_lock, nd->m_seq); 1134 } 1135 1136 static int follow_dotdot_rcu(struct nameidata *nd) 1137 { 1138 set_root_rcu(nd); 1139 1140 while (1) { 1141 if (nd->path.dentry == nd->root.dentry && 1142 nd->path.mnt == nd->root.mnt) { 1143 break; 1144 } 1145 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1146 struct dentry *old = nd->path.dentry; 1147 struct dentry *parent = old->d_parent; 1148 unsigned seq; 1149 1150 seq = read_seqcount_begin(&parent->d_seq); 1151 if (read_seqcount_retry(&old->d_seq, nd->seq)) 1152 goto failed; 1153 nd->path.dentry = parent; 1154 nd->seq = seq; 1155 break; 1156 } 1157 if (!follow_up_rcu(&nd->path)) 1158 break; 1159 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 1160 } 1161 while (d_mountpoint(nd->path.dentry)) { 1162 struct mount *mounted; 1163 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry); 1164 if (!mounted) 1165 break; 1166 nd->path.mnt = &mounted->mnt; 1167 nd->path.dentry = mounted->mnt.mnt_root; 1168 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 1169 if (!read_seqretry(&mount_lock, nd->m_seq)) 1170 goto failed; 1171 } 1172 nd->inode = nd->path.dentry->d_inode; 1173 return 0; 1174 1175 failed: 1176 nd->flags &= ~LOOKUP_RCU; 1177 if (!(nd->flags & LOOKUP_ROOT)) 1178 nd->root.mnt = NULL; 1179 rcu_read_unlock(); 1180 return -ECHILD; 1181 } 1182 1183 /* 1184 * Follow down to the covering mount currently visible to userspace. At each 1185 * point, the filesystem owning that dentry may be queried as to whether the 1186 * caller is permitted to proceed or not. 1187 */ 1188 int follow_down(struct path *path) 1189 { 1190 unsigned managed; 1191 int ret; 1192 1193 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1194 unlikely(managed & DCACHE_MANAGED_DENTRY)) { 1195 /* Allow the filesystem to manage the transit without i_mutex 1196 * being held. 1197 * 1198 * We indicate to the filesystem if someone is trying to mount 1199 * something here. This gives autofs the chance to deny anyone 1200 * other than its daemon the right to mount on its 1201 * superstructure. 1202 * 1203 * The filesystem may sleep at this point. 1204 */ 1205 if (managed & DCACHE_MANAGE_TRANSIT) { 1206 BUG_ON(!path->dentry->d_op); 1207 BUG_ON(!path->dentry->d_op->d_manage); 1208 ret = path->dentry->d_op->d_manage( 1209 path->dentry, false); 1210 if (ret < 0) 1211 return ret == -EISDIR ? 0 : ret; 1212 } 1213 1214 /* Transit to a mounted filesystem. */ 1215 if (managed & DCACHE_MOUNTED) { 1216 struct vfsmount *mounted = lookup_mnt(path); 1217 if (!mounted) 1218 break; 1219 dput(path->dentry); 1220 mntput(path->mnt); 1221 path->mnt = mounted; 1222 path->dentry = dget(mounted->mnt_root); 1223 continue; 1224 } 1225 1226 /* Don't handle automount points here */ 1227 break; 1228 } 1229 return 0; 1230 } 1231 EXPORT_SYMBOL(follow_down); 1232 1233 /* 1234 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot() 1235 */ 1236 static void follow_mount(struct path *path) 1237 { 1238 while (d_mountpoint(path->dentry)) { 1239 struct vfsmount *mounted = lookup_mnt(path); 1240 if (!mounted) 1241 break; 1242 dput(path->dentry); 1243 mntput(path->mnt); 1244 path->mnt = mounted; 1245 path->dentry = dget(mounted->mnt_root); 1246 } 1247 } 1248 1249 static void follow_dotdot(struct nameidata *nd) 1250 { 1251 set_root(nd); 1252 1253 while(1) { 1254 struct dentry *old = nd->path.dentry; 1255 1256 if (nd->path.dentry == nd->root.dentry && 1257 nd->path.mnt == nd->root.mnt) { 1258 break; 1259 } 1260 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1261 /* rare case of legitimate dget_parent()... */ 1262 nd->path.dentry = dget_parent(nd->path.dentry); 1263 dput(old); 1264 break; 1265 } 1266 if (!follow_up(&nd->path)) 1267 break; 1268 } 1269 follow_mount(&nd->path); 1270 nd->inode = nd->path.dentry->d_inode; 1271 } 1272 1273 /* 1274 * This looks up the name in dcache, possibly revalidates the old dentry and 1275 * allocates a new one if not found or not valid. In the need_lookup argument 1276 * returns whether i_op->lookup is necessary. 1277 * 1278 * dir->d_inode->i_mutex must be held 1279 */ 1280 static struct dentry *lookup_dcache(struct qstr *name, struct dentry *dir, 1281 unsigned int flags, bool *need_lookup) 1282 { 1283 struct dentry *dentry; 1284 int error; 1285 1286 *need_lookup = false; 1287 dentry = d_lookup(dir, name); 1288 if (dentry) { 1289 if (dentry->d_flags & DCACHE_OP_REVALIDATE) { 1290 error = d_revalidate(dentry, flags); 1291 if (unlikely(error <= 0)) { 1292 if (error < 0) { 1293 dput(dentry); 1294 return ERR_PTR(error); 1295 } else if (!d_invalidate(dentry)) { 1296 dput(dentry); 1297 dentry = NULL; 1298 } 1299 } 1300 } 1301 } 1302 1303 if (!dentry) { 1304 dentry = d_alloc(dir, name); 1305 if (unlikely(!dentry)) 1306 return ERR_PTR(-ENOMEM); 1307 1308 *need_lookup = true; 1309 } 1310 return dentry; 1311 } 1312 1313 /* 1314 * Call i_op->lookup on the dentry. The dentry must be negative and 1315 * unhashed. 1316 * 1317 * dir->d_inode->i_mutex must be held 1318 */ 1319 static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry, 1320 unsigned int flags) 1321 { 1322 struct dentry *old; 1323 1324 /* Don't create child dentry for a dead directory. */ 1325 if (unlikely(IS_DEADDIR(dir))) { 1326 dput(dentry); 1327 return ERR_PTR(-ENOENT); 1328 } 1329 1330 old = dir->i_op->lookup(dir, dentry, flags); 1331 if (unlikely(old)) { 1332 dput(dentry); 1333 dentry = old; 1334 } 1335 return dentry; 1336 } 1337 1338 static struct dentry *__lookup_hash(struct qstr *name, 1339 struct dentry *base, unsigned int flags) 1340 { 1341 bool need_lookup; 1342 struct dentry *dentry; 1343 1344 dentry = lookup_dcache(name, base, flags, &need_lookup); 1345 if (!need_lookup) 1346 return dentry; 1347 1348 return lookup_real(base->d_inode, dentry, flags); 1349 } 1350 1351 /* 1352 * It's more convoluted than I'd like it to be, but... it's still fairly 1353 * small and for now I'd prefer to have fast path as straight as possible. 1354 * It _is_ time-critical. 1355 */ 1356 static int lookup_fast(struct nameidata *nd, 1357 struct path *path, struct inode **inode) 1358 { 1359 struct vfsmount *mnt = nd->path.mnt; 1360 struct dentry *dentry, *parent = nd->path.dentry; 1361 int need_reval = 1; 1362 int status = 1; 1363 int err; 1364 1365 /* 1366 * Rename seqlock is not required here because in the off chance 1367 * of a false negative due to a concurrent rename, we're going to 1368 * do the non-racy lookup, below. 1369 */ 1370 if (nd->flags & LOOKUP_RCU) { 1371 unsigned seq; 1372 dentry = __d_lookup_rcu(parent, &nd->last, &seq); 1373 if (!dentry) 1374 goto unlazy; 1375 1376 /* 1377 * This sequence count validates that the inode matches 1378 * the dentry name information from lookup. 1379 */ 1380 *inode = dentry->d_inode; 1381 if (read_seqcount_retry(&dentry->d_seq, seq)) 1382 return -ECHILD; 1383 1384 /* 1385 * This sequence count validates that the parent had no 1386 * changes while we did the lookup of the dentry above. 1387 * 1388 * The memory barrier in read_seqcount_begin of child is 1389 * enough, we can use __read_seqcount_retry here. 1390 */ 1391 if (__read_seqcount_retry(&parent->d_seq, nd->seq)) 1392 return -ECHILD; 1393 nd->seq = seq; 1394 1395 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) { 1396 status = d_revalidate(dentry, nd->flags); 1397 if (unlikely(status <= 0)) { 1398 if (status != -ECHILD) 1399 need_reval = 0; 1400 goto unlazy; 1401 } 1402 } 1403 path->mnt = mnt; 1404 path->dentry = dentry; 1405 if (unlikely(!__follow_mount_rcu(nd, path, inode))) 1406 goto unlazy; 1407 if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT)) 1408 goto unlazy; 1409 return 0; 1410 unlazy: 1411 if (unlazy_walk(nd, dentry)) 1412 return -ECHILD; 1413 } else { 1414 dentry = __d_lookup(parent, &nd->last); 1415 } 1416 1417 if (unlikely(!dentry)) 1418 goto need_lookup; 1419 1420 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval) 1421 status = d_revalidate(dentry, nd->flags); 1422 if (unlikely(status <= 0)) { 1423 if (status < 0) { 1424 dput(dentry); 1425 return status; 1426 } 1427 if (!d_invalidate(dentry)) { 1428 dput(dentry); 1429 goto need_lookup; 1430 } 1431 } 1432 1433 path->mnt = mnt; 1434 path->dentry = dentry; 1435 err = follow_managed(path, nd->flags); 1436 if (unlikely(err < 0)) { 1437 path_put_conditional(path, nd); 1438 return err; 1439 } 1440 if (err) 1441 nd->flags |= LOOKUP_JUMPED; 1442 *inode = path->dentry->d_inode; 1443 return 0; 1444 1445 need_lookup: 1446 return 1; 1447 } 1448 1449 /* Fast lookup failed, do it the slow way */ 1450 static int lookup_slow(struct nameidata *nd, struct path *path) 1451 { 1452 struct dentry *dentry, *parent; 1453 int err; 1454 1455 parent = nd->path.dentry; 1456 BUG_ON(nd->inode != parent->d_inode); 1457 1458 mutex_lock(&parent->d_inode->i_mutex); 1459 dentry = __lookup_hash(&nd->last, parent, nd->flags); 1460 mutex_unlock(&parent->d_inode->i_mutex); 1461 if (IS_ERR(dentry)) 1462 return PTR_ERR(dentry); 1463 path->mnt = nd->path.mnt; 1464 path->dentry = dentry; 1465 err = follow_managed(path, nd->flags); 1466 if (unlikely(err < 0)) { 1467 path_put_conditional(path, nd); 1468 return err; 1469 } 1470 if (err) 1471 nd->flags |= LOOKUP_JUMPED; 1472 return 0; 1473 } 1474 1475 static inline int may_lookup(struct nameidata *nd) 1476 { 1477 if (nd->flags & LOOKUP_RCU) { 1478 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK); 1479 if (err != -ECHILD) 1480 return err; 1481 if (unlazy_walk(nd, NULL)) 1482 return -ECHILD; 1483 } 1484 return inode_permission(nd->inode, MAY_EXEC); 1485 } 1486 1487 static inline int handle_dots(struct nameidata *nd, int type) 1488 { 1489 if (type == LAST_DOTDOT) { 1490 if (nd->flags & LOOKUP_RCU) { 1491 if (follow_dotdot_rcu(nd)) 1492 return -ECHILD; 1493 } else 1494 follow_dotdot(nd); 1495 } 1496 return 0; 1497 } 1498 1499 static void terminate_walk(struct nameidata *nd) 1500 { 1501 if (!(nd->flags & LOOKUP_RCU)) { 1502 path_put(&nd->path); 1503 } else { 1504 nd->flags &= ~LOOKUP_RCU; 1505 if (!(nd->flags & LOOKUP_ROOT)) 1506 nd->root.mnt = NULL; 1507 rcu_read_unlock(); 1508 } 1509 } 1510 1511 /* 1512 * Do we need to follow links? We _really_ want to be able 1513 * to do this check without having to look at inode->i_op, 1514 * so we keep a cache of "no, this doesn't need follow_link" 1515 * for the common case. 1516 */ 1517 static inline int should_follow_link(struct dentry *dentry, int follow) 1518 { 1519 return unlikely(d_is_symlink(dentry)) ? follow : 0; 1520 } 1521 1522 static inline int walk_component(struct nameidata *nd, struct path *path, 1523 int follow) 1524 { 1525 struct inode *inode; 1526 int err; 1527 /* 1528 * "." and ".." are special - ".." especially so because it has 1529 * to be able to know about the current root directory and 1530 * parent relationships. 1531 */ 1532 if (unlikely(nd->last_type != LAST_NORM)) 1533 return handle_dots(nd, nd->last_type); 1534 err = lookup_fast(nd, path, &inode); 1535 if (unlikely(err)) { 1536 if (err < 0) 1537 goto out_err; 1538 1539 err = lookup_slow(nd, path); 1540 if (err < 0) 1541 goto out_err; 1542 1543 inode = path->dentry->d_inode; 1544 } 1545 err = -ENOENT; 1546 if (!inode || d_is_negative(path->dentry)) 1547 goto out_path_put; 1548 1549 if (should_follow_link(path->dentry, follow)) { 1550 if (nd->flags & LOOKUP_RCU) { 1551 if (unlikely(unlazy_walk(nd, path->dentry))) { 1552 err = -ECHILD; 1553 goto out_err; 1554 } 1555 } 1556 BUG_ON(inode != path->dentry->d_inode); 1557 return 1; 1558 } 1559 path_to_nameidata(path, nd); 1560 nd->inode = inode; 1561 return 0; 1562 1563 out_path_put: 1564 path_to_nameidata(path, nd); 1565 out_err: 1566 terminate_walk(nd); 1567 return err; 1568 } 1569 1570 /* 1571 * This limits recursive symlink follows to 8, while 1572 * limiting consecutive symlinks to 40. 1573 * 1574 * Without that kind of total limit, nasty chains of consecutive 1575 * symlinks can cause almost arbitrarily long lookups. 1576 */ 1577 static inline int nested_symlink(struct path *path, struct nameidata *nd) 1578 { 1579 int res; 1580 1581 if (unlikely(current->link_count >= MAX_NESTED_LINKS)) { 1582 path_put_conditional(path, nd); 1583 path_put(&nd->path); 1584 return -ELOOP; 1585 } 1586 BUG_ON(nd->depth >= MAX_NESTED_LINKS); 1587 1588 nd->depth++; 1589 current->link_count++; 1590 1591 do { 1592 struct path link = *path; 1593 void *cookie; 1594 1595 res = follow_link(&link, nd, &cookie); 1596 if (res) 1597 break; 1598 res = walk_component(nd, path, LOOKUP_FOLLOW); 1599 put_link(nd, &link, cookie); 1600 } while (res > 0); 1601 1602 current->link_count--; 1603 nd->depth--; 1604 return res; 1605 } 1606 1607 /* 1608 * We can do the critical dentry name comparison and hashing 1609 * operations one word at a time, but we are limited to: 1610 * 1611 * - Architectures with fast unaligned word accesses. We could 1612 * do a "get_unaligned()" if this helps and is sufficiently 1613 * fast. 1614 * 1615 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we 1616 * do not trap on the (extremely unlikely) case of a page 1617 * crossing operation. 1618 * 1619 * - Furthermore, we need an efficient 64-bit compile for the 1620 * 64-bit case in order to generate the "number of bytes in 1621 * the final mask". Again, that could be replaced with a 1622 * efficient population count instruction or similar. 1623 */ 1624 #ifdef CONFIG_DCACHE_WORD_ACCESS 1625 1626 #include <asm/word-at-a-time.h> 1627 1628 #ifdef CONFIG_64BIT 1629 1630 static inline unsigned int fold_hash(unsigned long hash) 1631 { 1632 hash += hash >> (8*sizeof(int)); 1633 return hash; 1634 } 1635 1636 #else /* 32-bit case */ 1637 1638 #define fold_hash(x) (x) 1639 1640 #endif 1641 1642 unsigned int full_name_hash(const unsigned char *name, unsigned int len) 1643 { 1644 unsigned long a, mask; 1645 unsigned long hash = 0; 1646 1647 for (;;) { 1648 a = load_unaligned_zeropad(name); 1649 if (len < sizeof(unsigned long)) 1650 break; 1651 hash += a; 1652 hash *= 9; 1653 name += sizeof(unsigned long); 1654 len -= sizeof(unsigned long); 1655 if (!len) 1656 goto done; 1657 } 1658 mask = bytemask_from_count(len); 1659 hash += mask & a; 1660 done: 1661 return fold_hash(hash); 1662 } 1663 EXPORT_SYMBOL(full_name_hash); 1664 1665 /* 1666 * Calculate the length and hash of the path component, and 1667 * return the length of the component; 1668 */ 1669 static inline unsigned long hash_name(const char *name, unsigned int *hashp) 1670 { 1671 unsigned long a, b, adata, bdata, mask, hash, len; 1672 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 1673 1674 hash = a = 0; 1675 len = -sizeof(unsigned long); 1676 do { 1677 hash = (hash + a) * 9; 1678 len += sizeof(unsigned long); 1679 a = load_unaligned_zeropad(name+len); 1680 b = a ^ REPEAT_BYTE('/'); 1681 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants))); 1682 1683 adata = prep_zero_mask(a, adata, &constants); 1684 bdata = prep_zero_mask(b, bdata, &constants); 1685 1686 mask = create_zero_mask(adata | bdata); 1687 1688 hash += a & zero_bytemask(mask); 1689 *hashp = fold_hash(hash); 1690 1691 return len + find_zero(mask); 1692 } 1693 1694 #else 1695 1696 unsigned int full_name_hash(const unsigned char *name, unsigned int len) 1697 { 1698 unsigned long hash = init_name_hash(); 1699 while (len--) 1700 hash = partial_name_hash(*name++, hash); 1701 return end_name_hash(hash); 1702 } 1703 EXPORT_SYMBOL(full_name_hash); 1704 1705 /* 1706 * We know there's a real path component here of at least 1707 * one character. 1708 */ 1709 static inline unsigned long hash_name(const char *name, unsigned int *hashp) 1710 { 1711 unsigned long hash = init_name_hash(); 1712 unsigned long len = 0, c; 1713 1714 c = (unsigned char)*name; 1715 do { 1716 len++; 1717 hash = partial_name_hash(c, hash); 1718 c = (unsigned char)name[len]; 1719 } while (c && c != '/'); 1720 *hashp = end_name_hash(hash); 1721 return len; 1722 } 1723 1724 #endif 1725 1726 /* 1727 * Name resolution. 1728 * This is the basic name resolution function, turning a pathname into 1729 * the final dentry. We expect 'base' to be positive and a directory. 1730 * 1731 * Returns 0 and nd will have valid dentry and mnt on success. 1732 * Returns error and drops reference to input namei data on failure. 1733 */ 1734 static int link_path_walk(const char *name, struct nameidata *nd) 1735 { 1736 struct path next; 1737 int err; 1738 1739 while (*name=='/') 1740 name++; 1741 if (!*name) 1742 return 0; 1743 1744 /* At this point we know we have a real path component. */ 1745 for(;;) { 1746 struct qstr this; 1747 long len; 1748 int type; 1749 1750 err = may_lookup(nd); 1751 if (err) 1752 break; 1753 1754 len = hash_name(name, &this.hash); 1755 this.name = name; 1756 this.len = len; 1757 1758 type = LAST_NORM; 1759 if (name[0] == '.') switch (len) { 1760 case 2: 1761 if (name[1] == '.') { 1762 type = LAST_DOTDOT; 1763 nd->flags |= LOOKUP_JUMPED; 1764 } 1765 break; 1766 case 1: 1767 type = LAST_DOT; 1768 } 1769 if (likely(type == LAST_NORM)) { 1770 struct dentry *parent = nd->path.dentry; 1771 nd->flags &= ~LOOKUP_JUMPED; 1772 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { 1773 err = parent->d_op->d_hash(parent, &this); 1774 if (err < 0) 1775 break; 1776 } 1777 } 1778 1779 nd->last = this; 1780 nd->last_type = type; 1781 1782 if (!name[len]) 1783 return 0; 1784 /* 1785 * If it wasn't NUL, we know it was '/'. Skip that 1786 * slash, and continue until no more slashes. 1787 */ 1788 do { 1789 len++; 1790 } while (unlikely(name[len] == '/')); 1791 if (!name[len]) 1792 return 0; 1793 1794 name += len; 1795 1796 err = walk_component(nd, &next, LOOKUP_FOLLOW); 1797 if (err < 0) 1798 return err; 1799 1800 if (err) { 1801 err = nested_symlink(&next, nd); 1802 if (err) 1803 return err; 1804 } 1805 if (!d_can_lookup(nd->path.dentry)) { 1806 err = -ENOTDIR; 1807 break; 1808 } 1809 } 1810 terminate_walk(nd); 1811 return err; 1812 } 1813 1814 static int path_init(int dfd, const char *name, unsigned int flags, 1815 struct nameidata *nd, struct file **fp) 1816 { 1817 int retval = 0; 1818 1819 nd->last_type = LAST_ROOT; /* if there are only slashes... */ 1820 nd->flags = flags | LOOKUP_JUMPED; 1821 nd->depth = 0; 1822 if (flags & LOOKUP_ROOT) { 1823 struct dentry *root = nd->root.dentry; 1824 struct inode *inode = root->d_inode; 1825 if (*name) { 1826 if (!d_can_lookup(root)) 1827 return -ENOTDIR; 1828 retval = inode_permission(inode, MAY_EXEC); 1829 if (retval) 1830 return retval; 1831 } 1832 nd->path = nd->root; 1833 nd->inode = inode; 1834 if (flags & LOOKUP_RCU) { 1835 rcu_read_lock(); 1836 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1837 nd->m_seq = read_seqbegin(&mount_lock); 1838 } else { 1839 path_get(&nd->path); 1840 } 1841 return 0; 1842 } 1843 1844 nd->root.mnt = NULL; 1845 1846 nd->m_seq = read_seqbegin(&mount_lock); 1847 if (*name=='/') { 1848 if (flags & LOOKUP_RCU) { 1849 rcu_read_lock(); 1850 set_root_rcu(nd); 1851 } else { 1852 set_root(nd); 1853 path_get(&nd->root); 1854 } 1855 nd->path = nd->root; 1856 } else if (dfd == AT_FDCWD) { 1857 if (flags & LOOKUP_RCU) { 1858 struct fs_struct *fs = current->fs; 1859 unsigned seq; 1860 1861 rcu_read_lock(); 1862 1863 do { 1864 seq = read_seqcount_begin(&fs->seq); 1865 nd->path = fs->pwd; 1866 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1867 } while (read_seqcount_retry(&fs->seq, seq)); 1868 } else { 1869 get_fs_pwd(current->fs, &nd->path); 1870 } 1871 } else { 1872 /* Caller must check execute permissions on the starting path component */ 1873 struct fd f = fdget_raw(dfd); 1874 struct dentry *dentry; 1875 1876 if (!f.file) 1877 return -EBADF; 1878 1879 dentry = f.file->f_path.dentry; 1880 1881 if (*name) { 1882 if (!d_can_lookup(dentry)) { 1883 fdput(f); 1884 return -ENOTDIR; 1885 } 1886 } 1887 1888 nd->path = f.file->f_path; 1889 if (flags & LOOKUP_RCU) { 1890 if (f.flags & FDPUT_FPUT) 1891 *fp = f.file; 1892 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1893 rcu_read_lock(); 1894 } else { 1895 path_get(&nd->path); 1896 fdput(f); 1897 } 1898 } 1899 1900 nd->inode = nd->path.dentry->d_inode; 1901 return 0; 1902 } 1903 1904 static inline int lookup_last(struct nameidata *nd, struct path *path) 1905 { 1906 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len]) 1907 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 1908 1909 nd->flags &= ~LOOKUP_PARENT; 1910 return walk_component(nd, path, nd->flags & LOOKUP_FOLLOW); 1911 } 1912 1913 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 1914 static int path_lookupat(int dfd, const char *name, 1915 unsigned int flags, struct nameidata *nd) 1916 { 1917 struct file *base = NULL; 1918 struct path path; 1919 int err; 1920 1921 /* 1922 * Path walking is largely split up into 2 different synchronisation 1923 * schemes, rcu-walk and ref-walk (explained in 1924 * Documentation/filesystems/path-lookup.txt). These share much of the 1925 * path walk code, but some things particularly setup, cleanup, and 1926 * following mounts are sufficiently divergent that functions are 1927 * duplicated. Typically there is a function foo(), and its RCU 1928 * analogue, foo_rcu(). 1929 * 1930 * -ECHILD is the error number of choice (just to avoid clashes) that 1931 * is returned if some aspect of an rcu-walk fails. Such an error must 1932 * be handled by restarting a traditional ref-walk (which will always 1933 * be able to complete). 1934 */ 1935 err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base); 1936 1937 if (unlikely(err)) 1938 return err; 1939 1940 current->total_link_count = 0; 1941 err = link_path_walk(name, nd); 1942 1943 if (!err && !(flags & LOOKUP_PARENT)) { 1944 err = lookup_last(nd, &path); 1945 while (err > 0) { 1946 void *cookie; 1947 struct path link = path; 1948 err = may_follow_link(&link, nd); 1949 if (unlikely(err)) 1950 break; 1951 nd->flags |= LOOKUP_PARENT; 1952 err = follow_link(&link, nd, &cookie); 1953 if (err) 1954 break; 1955 err = lookup_last(nd, &path); 1956 put_link(nd, &link, cookie); 1957 } 1958 } 1959 1960 if (!err) 1961 err = complete_walk(nd); 1962 1963 if (!err && nd->flags & LOOKUP_DIRECTORY) { 1964 if (!d_can_lookup(nd->path.dentry)) { 1965 path_put(&nd->path); 1966 err = -ENOTDIR; 1967 } 1968 } 1969 1970 if (base) 1971 fput(base); 1972 1973 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 1974 path_put(&nd->root); 1975 nd->root.mnt = NULL; 1976 } 1977 return err; 1978 } 1979 1980 static int filename_lookup(int dfd, struct filename *name, 1981 unsigned int flags, struct nameidata *nd) 1982 { 1983 int retval = path_lookupat(dfd, name->name, flags | LOOKUP_RCU, nd); 1984 if (unlikely(retval == -ECHILD)) 1985 retval = path_lookupat(dfd, name->name, flags, nd); 1986 if (unlikely(retval == -ESTALE)) 1987 retval = path_lookupat(dfd, name->name, 1988 flags | LOOKUP_REVAL, nd); 1989 1990 if (likely(!retval)) 1991 audit_inode(name, nd->path.dentry, flags & LOOKUP_PARENT); 1992 return retval; 1993 } 1994 1995 static int do_path_lookup(int dfd, const char *name, 1996 unsigned int flags, struct nameidata *nd) 1997 { 1998 struct filename filename = { .name = name }; 1999 2000 return filename_lookup(dfd, &filename, flags, nd); 2001 } 2002 2003 /* does lookup, returns the object with parent locked */ 2004 struct dentry *kern_path_locked(const char *name, struct path *path) 2005 { 2006 struct nameidata nd; 2007 struct dentry *d; 2008 int err = do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, &nd); 2009 if (err) 2010 return ERR_PTR(err); 2011 if (nd.last_type != LAST_NORM) { 2012 path_put(&nd.path); 2013 return ERR_PTR(-EINVAL); 2014 } 2015 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 2016 d = __lookup_hash(&nd.last, nd.path.dentry, 0); 2017 if (IS_ERR(d)) { 2018 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 2019 path_put(&nd.path); 2020 return d; 2021 } 2022 *path = nd.path; 2023 return d; 2024 } 2025 2026 int kern_path(const char *name, unsigned int flags, struct path *path) 2027 { 2028 struct nameidata nd; 2029 int res = do_path_lookup(AT_FDCWD, name, flags, &nd); 2030 if (!res) 2031 *path = nd.path; 2032 return res; 2033 } 2034 EXPORT_SYMBOL(kern_path); 2035 2036 /** 2037 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair 2038 * @dentry: pointer to dentry of the base directory 2039 * @mnt: pointer to vfs mount of the base directory 2040 * @name: pointer to file name 2041 * @flags: lookup flags 2042 * @path: pointer to struct path to fill 2043 */ 2044 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, 2045 const char *name, unsigned int flags, 2046 struct path *path) 2047 { 2048 struct nameidata nd; 2049 int err; 2050 nd.root.dentry = dentry; 2051 nd.root.mnt = mnt; 2052 BUG_ON(flags & LOOKUP_PARENT); 2053 /* the first argument of do_path_lookup() is ignored with LOOKUP_ROOT */ 2054 err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd); 2055 if (!err) 2056 *path = nd.path; 2057 return err; 2058 } 2059 EXPORT_SYMBOL(vfs_path_lookup); 2060 2061 /* 2062 * Restricted form of lookup. Doesn't follow links, single-component only, 2063 * needs parent already locked. Doesn't follow mounts. 2064 * SMP-safe. 2065 */ 2066 static struct dentry *lookup_hash(struct nameidata *nd) 2067 { 2068 return __lookup_hash(&nd->last, nd->path.dentry, nd->flags); 2069 } 2070 2071 /** 2072 * lookup_one_len - filesystem helper to lookup single pathname component 2073 * @name: pathname component to lookup 2074 * @base: base directory to lookup from 2075 * @len: maximum length @len should be interpreted to 2076 * 2077 * Note that this routine is purely a helper for filesystem usage and should 2078 * not be called by generic code. Also note that by using this function the 2079 * nameidata argument is passed to the filesystem methods and a filesystem 2080 * using this helper needs to be prepared for that. 2081 */ 2082 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len) 2083 { 2084 struct qstr this; 2085 unsigned int c; 2086 int err; 2087 2088 WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex)); 2089 2090 this.name = name; 2091 this.len = len; 2092 this.hash = full_name_hash(name, len); 2093 if (!len) 2094 return ERR_PTR(-EACCES); 2095 2096 if (unlikely(name[0] == '.')) { 2097 if (len < 2 || (len == 2 && name[1] == '.')) 2098 return ERR_PTR(-EACCES); 2099 } 2100 2101 while (len--) { 2102 c = *(const unsigned char *)name++; 2103 if (c == '/' || c == '\0') 2104 return ERR_PTR(-EACCES); 2105 } 2106 /* 2107 * See if the low-level filesystem might want 2108 * to use its own hash.. 2109 */ 2110 if (base->d_flags & DCACHE_OP_HASH) { 2111 int err = base->d_op->d_hash(base, &this); 2112 if (err < 0) 2113 return ERR_PTR(err); 2114 } 2115 2116 err = inode_permission(base->d_inode, MAY_EXEC); 2117 if (err) 2118 return ERR_PTR(err); 2119 2120 return __lookup_hash(&this, base, 0); 2121 } 2122 EXPORT_SYMBOL(lookup_one_len); 2123 2124 int user_path_at_empty(int dfd, const char __user *name, unsigned flags, 2125 struct path *path, int *empty) 2126 { 2127 struct nameidata nd; 2128 struct filename *tmp = getname_flags(name, flags, empty); 2129 int err = PTR_ERR(tmp); 2130 if (!IS_ERR(tmp)) { 2131 2132 BUG_ON(flags & LOOKUP_PARENT); 2133 2134 err = filename_lookup(dfd, tmp, flags, &nd); 2135 putname(tmp); 2136 if (!err) 2137 *path = nd.path; 2138 } 2139 return err; 2140 } 2141 2142 int user_path_at(int dfd, const char __user *name, unsigned flags, 2143 struct path *path) 2144 { 2145 return user_path_at_empty(dfd, name, flags, path, NULL); 2146 } 2147 EXPORT_SYMBOL(user_path_at); 2148 2149 /* 2150 * NB: most callers don't do anything directly with the reference to the 2151 * to struct filename, but the nd->last pointer points into the name string 2152 * allocated by getname. So we must hold the reference to it until all 2153 * path-walking is complete. 2154 */ 2155 static struct filename * 2156 user_path_parent(int dfd, const char __user *path, struct nameidata *nd, 2157 unsigned int flags) 2158 { 2159 struct filename *s = getname(path); 2160 int error; 2161 2162 /* only LOOKUP_REVAL is allowed in extra flags */ 2163 flags &= LOOKUP_REVAL; 2164 2165 if (IS_ERR(s)) 2166 return s; 2167 2168 error = filename_lookup(dfd, s, flags | LOOKUP_PARENT, nd); 2169 if (error) { 2170 putname(s); 2171 return ERR_PTR(error); 2172 } 2173 2174 return s; 2175 } 2176 2177 /** 2178 * mountpoint_last - look up last component for umount 2179 * @nd: pathwalk nameidata - currently pointing at parent directory of "last" 2180 * @path: pointer to container for result 2181 * 2182 * This is a special lookup_last function just for umount. In this case, we 2183 * need to resolve the path without doing any revalidation. 2184 * 2185 * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since 2186 * mountpoints are always pinned in the dcache, their ancestors are too. Thus, 2187 * in almost all cases, this lookup will be served out of the dcache. The only 2188 * cases where it won't are if nd->last refers to a symlink or the path is 2189 * bogus and it doesn't exist. 2190 * 2191 * Returns: 2192 * -error: if there was an error during lookup. This includes -ENOENT if the 2193 * lookup found a negative dentry. The nd->path reference will also be 2194 * put in this case. 2195 * 2196 * 0: if we successfully resolved nd->path and found it to not to be a 2197 * symlink that needs to be followed. "path" will also be populated. 2198 * The nd->path reference will also be put. 2199 * 2200 * 1: if we successfully resolved nd->last and found it to be a symlink 2201 * that needs to be followed. "path" will be populated with the path 2202 * to the link, and nd->path will *not* be put. 2203 */ 2204 static int 2205 mountpoint_last(struct nameidata *nd, struct path *path) 2206 { 2207 int error = 0; 2208 struct dentry *dentry; 2209 struct dentry *dir = nd->path.dentry; 2210 2211 /* If we're in rcuwalk, drop out of it to handle last component */ 2212 if (nd->flags & LOOKUP_RCU) { 2213 if (unlazy_walk(nd, NULL)) { 2214 error = -ECHILD; 2215 goto out; 2216 } 2217 } 2218 2219 nd->flags &= ~LOOKUP_PARENT; 2220 2221 if (unlikely(nd->last_type != LAST_NORM)) { 2222 error = handle_dots(nd, nd->last_type); 2223 if (error) 2224 goto out; 2225 dentry = dget(nd->path.dentry); 2226 goto done; 2227 } 2228 2229 mutex_lock(&dir->d_inode->i_mutex); 2230 dentry = d_lookup(dir, &nd->last); 2231 if (!dentry) { 2232 /* 2233 * No cached dentry. Mounted dentries are pinned in the cache, 2234 * so that means that this dentry is probably a symlink or the 2235 * path doesn't actually point to a mounted dentry. 2236 */ 2237 dentry = d_alloc(dir, &nd->last); 2238 if (!dentry) { 2239 error = -ENOMEM; 2240 mutex_unlock(&dir->d_inode->i_mutex); 2241 goto out; 2242 } 2243 dentry = lookup_real(dir->d_inode, dentry, nd->flags); 2244 error = PTR_ERR(dentry); 2245 if (IS_ERR(dentry)) { 2246 mutex_unlock(&dir->d_inode->i_mutex); 2247 goto out; 2248 } 2249 } 2250 mutex_unlock(&dir->d_inode->i_mutex); 2251 2252 done: 2253 if (!dentry->d_inode || d_is_negative(dentry)) { 2254 error = -ENOENT; 2255 dput(dentry); 2256 goto out; 2257 } 2258 path->dentry = dentry; 2259 path->mnt = mntget(nd->path.mnt); 2260 if (should_follow_link(dentry, nd->flags & LOOKUP_FOLLOW)) 2261 return 1; 2262 follow_mount(path); 2263 error = 0; 2264 out: 2265 terminate_walk(nd); 2266 return error; 2267 } 2268 2269 /** 2270 * path_mountpoint - look up a path to be umounted 2271 * @dfd: directory file descriptor to start walk from 2272 * @name: full pathname to walk 2273 * @path: pointer to container for result 2274 * @flags: lookup flags 2275 * 2276 * Look up the given name, but don't attempt to revalidate the last component. 2277 * Returns 0 and "path" will be valid on success; Returns error otherwise. 2278 */ 2279 static int 2280 path_mountpoint(int dfd, const char *name, struct path *path, unsigned int flags) 2281 { 2282 struct file *base = NULL; 2283 struct nameidata nd; 2284 int err; 2285 2286 err = path_init(dfd, name, flags | LOOKUP_PARENT, &nd, &base); 2287 if (unlikely(err)) 2288 return err; 2289 2290 current->total_link_count = 0; 2291 err = link_path_walk(name, &nd); 2292 if (err) 2293 goto out; 2294 2295 err = mountpoint_last(&nd, path); 2296 while (err > 0) { 2297 void *cookie; 2298 struct path link = *path; 2299 err = may_follow_link(&link, &nd); 2300 if (unlikely(err)) 2301 break; 2302 nd.flags |= LOOKUP_PARENT; 2303 err = follow_link(&link, &nd, &cookie); 2304 if (err) 2305 break; 2306 err = mountpoint_last(&nd, path); 2307 put_link(&nd, &link, cookie); 2308 } 2309 out: 2310 if (base) 2311 fput(base); 2312 2313 if (nd.root.mnt && !(nd.flags & LOOKUP_ROOT)) 2314 path_put(&nd.root); 2315 2316 return err; 2317 } 2318 2319 static int 2320 filename_mountpoint(int dfd, struct filename *s, struct path *path, 2321 unsigned int flags) 2322 { 2323 int error = path_mountpoint(dfd, s->name, path, flags | LOOKUP_RCU); 2324 if (unlikely(error == -ECHILD)) 2325 error = path_mountpoint(dfd, s->name, path, flags); 2326 if (unlikely(error == -ESTALE)) 2327 error = path_mountpoint(dfd, s->name, path, flags | LOOKUP_REVAL); 2328 if (likely(!error)) 2329 audit_inode(s, path->dentry, 0); 2330 return error; 2331 } 2332 2333 /** 2334 * user_path_mountpoint_at - lookup a path from userland in order to umount it 2335 * @dfd: directory file descriptor 2336 * @name: pathname from userland 2337 * @flags: lookup flags 2338 * @path: pointer to container to hold result 2339 * 2340 * A umount is a special case for path walking. We're not actually interested 2341 * in the inode in this situation, and ESTALE errors can be a problem. We 2342 * simply want track down the dentry and vfsmount attached at the mountpoint 2343 * and avoid revalidating the last component. 2344 * 2345 * Returns 0 and populates "path" on success. 2346 */ 2347 int 2348 user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags, 2349 struct path *path) 2350 { 2351 struct filename *s = getname(name); 2352 int error; 2353 if (IS_ERR(s)) 2354 return PTR_ERR(s); 2355 error = filename_mountpoint(dfd, s, path, flags); 2356 putname(s); 2357 return error; 2358 } 2359 2360 int 2361 kern_path_mountpoint(int dfd, const char *name, struct path *path, 2362 unsigned int flags) 2363 { 2364 struct filename s = {.name = name}; 2365 return filename_mountpoint(dfd, &s, path, flags); 2366 } 2367 EXPORT_SYMBOL(kern_path_mountpoint); 2368 2369 /* 2370 * It's inline, so penalty for filesystems that don't use sticky bit is 2371 * minimal. 2372 */ 2373 static inline int check_sticky(struct inode *dir, struct inode *inode) 2374 { 2375 kuid_t fsuid = current_fsuid(); 2376 2377 if (!(dir->i_mode & S_ISVTX)) 2378 return 0; 2379 if (uid_eq(inode->i_uid, fsuid)) 2380 return 0; 2381 if (uid_eq(dir->i_uid, fsuid)) 2382 return 0; 2383 return !capable_wrt_inode_uidgid(inode, CAP_FOWNER); 2384 } 2385 2386 /* 2387 * Check whether we can remove a link victim from directory dir, check 2388 * whether the type of victim is right. 2389 * 1. We can't do it if dir is read-only (done in permission()) 2390 * 2. We should have write and exec permissions on dir 2391 * 3. We can't remove anything from append-only dir 2392 * 4. We can't do anything with immutable dir (done in permission()) 2393 * 5. If the sticky bit on dir is set we should either 2394 * a. be owner of dir, or 2395 * b. be owner of victim, or 2396 * c. have CAP_FOWNER capability 2397 * 6. If the victim is append-only or immutable we can't do antyhing with 2398 * links pointing to it. 2399 * 7. If we were asked to remove a directory and victim isn't one - ENOTDIR. 2400 * 8. If we were asked to remove a non-directory and victim isn't one - EISDIR. 2401 * 9. We can't remove a root or mountpoint. 2402 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by 2403 * nfs_async_unlink(). 2404 */ 2405 static int may_delete(struct inode *dir, struct dentry *victim, bool isdir) 2406 { 2407 struct inode *inode = victim->d_inode; 2408 int error; 2409 2410 if (d_is_negative(victim)) 2411 return -ENOENT; 2412 BUG_ON(!inode); 2413 2414 BUG_ON(victim->d_parent->d_inode != dir); 2415 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE); 2416 2417 error = inode_permission(dir, MAY_WRITE | MAY_EXEC); 2418 if (error) 2419 return error; 2420 if (IS_APPEND(dir)) 2421 return -EPERM; 2422 2423 if (check_sticky(dir, inode) || IS_APPEND(inode) || 2424 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode)) 2425 return -EPERM; 2426 if (isdir) { 2427 if (!d_is_dir(victim)) 2428 return -ENOTDIR; 2429 if (IS_ROOT(victim)) 2430 return -EBUSY; 2431 } else if (d_is_dir(victim)) 2432 return -EISDIR; 2433 if (IS_DEADDIR(dir)) 2434 return -ENOENT; 2435 if (victim->d_flags & DCACHE_NFSFS_RENAMED) 2436 return -EBUSY; 2437 return 0; 2438 } 2439 2440 /* Check whether we can create an object with dentry child in directory 2441 * dir. 2442 * 1. We can't do it if child already exists (open has special treatment for 2443 * this case, but since we are inlined it's OK) 2444 * 2. We can't do it if dir is read-only (done in permission()) 2445 * 3. We should have write and exec permissions on dir 2446 * 4. We can't do it if dir is immutable (done in permission()) 2447 */ 2448 static inline int may_create(struct inode *dir, struct dentry *child) 2449 { 2450 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE); 2451 if (child->d_inode) 2452 return -EEXIST; 2453 if (IS_DEADDIR(dir)) 2454 return -ENOENT; 2455 return inode_permission(dir, MAY_WRITE | MAY_EXEC); 2456 } 2457 2458 /* 2459 * p1 and p2 should be directories on the same fs. 2460 */ 2461 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) 2462 { 2463 struct dentry *p; 2464 2465 if (p1 == p2) { 2466 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2467 return NULL; 2468 } 2469 2470 mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 2471 2472 p = d_ancestor(p2, p1); 2473 if (p) { 2474 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT); 2475 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD); 2476 return p; 2477 } 2478 2479 p = d_ancestor(p1, p2); 2480 if (p) { 2481 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2482 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 2483 return p; 2484 } 2485 2486 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2487 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 2488 return NULL; 2489 } 2490 EXPORT_SYMBOL(lock_rename); 2491 2492 void unlock_rename(struct dentry *p1, struct dentry *p2) 2493 { 2494 mutex_unlock(&p1->d_inode->i_mutex); 2495 if (p1 != p2) { 2496 mutex_unlock(&p2->d_inode->i_mutex); 2497 mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 2498 } 2499 } 2500 EXPORT_SYMBOL(unlock_rename); 2501 2502 int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, 2503 bool want_excl) 2504 { 2505 int error = may_create(dir, dentry); 2506 if (error) 2507 return error; 2508 2509 if (!dir->i_op->create) 2510 return -EACCES; /* shouldn't it be ENOSYS? */ 2511 mode &= S_IALLUGO; 2512 mode |= S_IFREG; 2513 error = security_inode_create(dir, dentry, mode); 2514 if (error) 2515 return error; 2516 error = dir->i_op->create(dir, dentry, mode, want_excl); 2517 if (!error) 2518 fsnotify_create(dir, dentry); 2519 return error; 2520 } 2521 EXPORT_SYMBOL(vfs_create); 2522 2523 static int may_open(struct path *path, int acc_mode, int flag) 2524 { 2525 struct dentry *dentry = path->dentry; 2526 struct inode *inode = dentry->d_inode; 2527 int error; 2528 2529 /* O_PATH? */ 2530 if (!acc_mode) 2531 return 0; 2532 2533 if (!inode) 2534 return -ENOENT; 2535 2536 switch (inode->i_mode & S_IFMT) { 2537 case S_IFLNK: 2538 return -ELOOP; 2539 case S_IFDIR: 2540 if (acc_mode & MAY_WRITE) 2541 return -EISDIR; 2542 break; 2543 case S_IFBLK: 2544 case S_IFCHR: 2545 if (path->mnt->mnt_flags & MNT_NODEV) 2546 return -EACCES; 2547 /*FALLTHRU*/ 2548 case S_IFIFO: 2549 case S_IFSOCK: 2550 flag &= ~O_TRUNC; 2551 break; 2552 } 2553 2554 error = inode_permission(inode, acc_mode); 2555 if (error) 2556 return error; 2557 2558 /* 2559 * An append-only file must be opened in append mode for writing. 2560 */ 2561 if (IS_APPEND(inode)) { 2562 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND)) 2563 return -EPERM; 2564 if (flag & O_TRUNC) 2565 return -EPERM; 2566 } 2567 2568 /* O_NOATIME can only be set by the owner or superuser */ 2569 if (flag & O_NOATIME && !inode_owner_or_capable(inode)) 2570 return -EPERM; 2571 2572 return 0; 2573 } 2574 2575 static int handle_truncate(struct file *filp) 2576 { 2577 struct path *path = &filp->f_path; 2578 struct inode *inode = path->dentry->d_inode; 2579 int error = get_write_access(inode); 2580 if (error) 2581 return error; 2582 /* 2583 * Refuse to truncate files with mandatory locks held on them. 2584 */ 2585 error = locks_verify_locked(filp); 2586 if (!error) 2587 error = security_path_truncate(path); 2588 if (!error) { 2589 error = do_truncate(path->dentry, 0, 2590 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN, 2591 filp); 2592 } 2593 put_write_access(inode); 2594 return error; 2595 } 2596 2597 static inline int open_to_namei_flags(int flag) 2598 { 2599 if ((flag & O_ACCMODE) == 3) 2600 flag--; 2601 return flag; 2602 } 2603 2604 static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode) 2605 { 2606 int error = security_path_mknod(dir, dentry, mode, 0); 2607 if (error) 2608 return error; 2609 2610 error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC); 2611 if (error) 2612 return error; 2613 2614 return security_inode_create(dir->dentry->d_inode, dentry, mode); 2615 } 2616 2617 /* 2618 * Attempt to atomically look up, create and open a file from a negative 2619 * dentry. 2620 * 2621 * Returns 0 if successful. The file will have been created and attached to 2622 * @file by the filesystem calling finish_open(). 2623 * 2624 * Returns 1 if the file was looked up only or didn't need creating. The 2625 * caller will need to perform the open themselves. @path will have been 2626 * updated to point to the new dentry. This may be negative. 2627 * 2628 * Returns an error code otherwise. 2629 */ 2630 static int atomic_open(struct nameidata *nd, struct dentry *dentry, 2631 struct path *path, struct file *file, 2632 const struct open_flags *op, 2633 bool got_write, bool need_lookup, 2634 int *opened) 2635 { 2636 struct inode *dir = nd->path.dentry->d_inode; 2637 unsigned open_flag = open_to_namei_flags(op->open_flag); 2638 umode_t mode; 2639 int error; 2640 int acc_mode; 2641 int create_error = 0; 2642 struct dentry *const DENTRY_NOT_SET = (void *) -1UL; 2643 bool excl; 2644 2645 BUG_ON(dentry->d_inode); 2646 2647 /* Don't create child dentry for a dead directory. */ 2648 if (unlikely(IS_DEADDIR(dir))) { 2649 error = -ENOENT; 2650 goto out; 2651 } 2652 2653 mode = op->mode; 2654 if ((open_flag & O_CREAT) && !IS_POSIXACL(dir)) 2655 mode &= ~current_umask(); 2656 2657 excl = (open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT); 2658 if (excl) 2659 open_flag &= ~O_TRUNC; 2660 2661 /* 2662 * Checking write permission is tricky, bacuse we don't know if we are 2663 * going to actually need it: O_CREAT opens should work as long as the 2664 * file exists. But checking existence breaks atomicity. The trick is 2665 * to check access and if not granted clear O_CREAT from the flags. 2666 * 2667 * Another problem is returing the "right" error value (e.g. for an 2668 * O_EXCL open we want to return EEXIST not EROFS). 2669 */ 2670 if (((open_flag & (O_CREAT | O_TRUNC)) || 2671 (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) { 2672 if (!(open_flag & O_CREAT)) { 2673 /* 2674 * No O_CREATE -> atomicity not a requirement -> fall 2675 * back to lookup + open 2676 */ 2677 goto no_open; 2678 } else if (open_flag & (O_EXCL | O_TRUNC)) { 2679 /* Fall back and fail with the right error */ 2680 create_error = -EROFS; 2681 goto no_open; 2682 } else { 2683 /* No side effects, safe to clear O_CREAT */ 2684 create_error = -EROFS; 2685 open_flag &= ~O_CREAT; 2686 } 2687 } 2688 2689 if (open_flag & O_CREAT) { 2690 error = may_o_create(&nd->path, dentry, mode); 2691 if (error) { 2692 create_error = error; 2693 if (open_flag & O_EXCL) 2694 goto no_open; 2695 open_flag &= ~O_CREAT; 2696 } 2697 } 2698 2699 if (nd->flags & LOOKUP_DIRECTORY) 2700 open_flag |= O_DIRECTORY; 2701 2702 file->f_path.dentry = DENTRY_NOT_SET; 2703 file->f_path.mnt = nd->path.mnt; 2704 error = dir->i_op->atomic_open(dir, dentry, file, open_flag, mode, 2705 opened); 2706 if (error < 0) { 2707 if (create_error && error == -ENOENT) 2708 error = create_error; 2709 goto out; 2710 } 2711 2712 if (error) { /* returned 1, that is */ 2713 if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) { 2714 error = -EIO; 2715 goto out; 2716 } 2717 if (file->f_path.dentry) { 2718 dput(dentry); 2719 dentry = file->f_path.dentry; 2720 } 2721 if (*opened & FILE_CREATED) 2722 fsnotify_create(dir, dentry); 2723 if (!dentry->d_inode) { 2724 WARN_ON(*opened & FILE_CREATED); 2725 if (create_error) { 2726 error = create_error; 2727 goto out; 2728 } 2729 } else { 2730 if (excl && !(*opened & FILE_CREATED)) { 2731 error = -EEXIST; 2732 goto out; 2733 } 2734 } 2735 goto looked_up; 2736 } 2737 2738 /* 2739 * We didn't have the inode before the open, so check open permission 2740 * here. 2741 */ 2742 acc_mode = op->acc_mode; 2743 if (*opened & FILE_CREATED) { 2744 WARN_ON(!(open_flag & O_CREAT)); 2745 fsnotify_create(dir, dentry); 2746 acc_mode = MAY_OPEN; 2747 } 2748 error = may_open(&file->f_path, acc_mode, open_flag); 2749 if (error) 2750 fput(file); 2751 2752 out: 2753 dput(dentry); 2754 return error; 2755 2756 no_open: 2757 if (need_lookup) { 2758 dentry = lookup_real(dir, dentry, nd->flags); 2759 if (IS_ERR(dentry)) 2760 return PTR_ERR(dentry); 2761 2762 if (create_error) { 2763 int open_flag = op->open_flag; 2764 2765 error = create_error; 2766 if ((open_flag & O_EXCL)) { 2767 if (!dentry->d_inode) 2768 goto out; 2769 } else if (!dentry->d_inode) { 2770 goto out; 2771 } else if ((open_flag & O_TRUNC) && 2772 S_ISREG(dentry->d_inode->i_mode)) { 2773 goto out; 2774 } 2775 /* will fail later, go on to get the right error */ 2776 } 2777 } 2778 looked_up: 2779 path->dentry = dentry; 2780 path->mnt = nd->path.mnt; 2781 return 1; 2782 } 2783 2784 /* 2785 * Look up and maybe create and open the last component. 2786 * 2787 * Must be called with i_mutex held on parent. 2788 * 2789 * Returns 0 if the file was successfully atomically created (if necessary) and 2790 * opened. In this case the file will be returned attached to @file. 2791 * 2792 * Returns 1 if the file was not completely opened at this time, though lookups 2793 * and creations will have been performed and the dentry returned in @path will 2794 * be positive upon return if O_CREAT was specified. If O_CREAT wasn't 2795 * specified then a negative dentry may be returned. 2796 * 2797 * An error code is returned otherwise. 2798 * 2799 * FILE_CREATE will be set in @*opened if the dentry was created and will be 2800 * cleared otherwise prior to returning. 2801 */ 2802 static int lookup_open(struct nameidata *nd, struct path *path, 2803 struct file *file, 2804 const struct open_flags *op, 2805 bool got_write, int *opened) 2806 { 2807 struct dentry *dir = nd->path.dentry; 2808 struct inode *dir_inode = dir->d_inode; 2809 struct dentry *dentry; 2810 int error; 2811 bool need_lookup; 2812 2813 *opened &= ~FILE_CREATED; 2814 dentry = lookup_dcache(&nd->last, dir, nd->flags, &need_lookup); 2815 if (IS_ERR(dentry)) 2816 return PTR_ERR(dentry); 2817 2818 /* Cached positive dentry: will open in f_op->open */ 2819 if (!need_lookup && dentry->d_inode) 2820 goto out_no_open; 2821 2822 if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) { 2823 return atomic_open(nd, dentry, path, file, op, got_write, 2824 need_lookup, opened); 2825 } 2826 2827 if (need_lookup) { 2828 BUG_ON(dentry->d_inode); 2829 2830 dentry = lookup_real(dir_inode, dentry, nd->flags); 2831 if (IS_ERR(dentry)) 2832 return PTR_ERR(dentry); 2833 } 2834 2835 /* Negative dentry, just create the file */ 2836 if (!dentry->d_inode && (op->open_flag & O_CREAT)) { 2837 umode_t mode = op->mode; 2838 if (!IS_POSIXACL(dir->d_inode)) 2839 mode &= ~current_umask(); 2840 /* 2841 * This write is needed to ensure that a 2842 * rw->ro transition does not occur between 2843 * the time when the file is created and when 2844 * a permanent write count is taken through 2845 * the 'struct file' in finish_open(). 2846 */ 2847 if (!got_write) { 2848 error = -EROFS; 2849 goto out_dput; 2850 } 2851 *opened |= FILE_CREATED; 2852 error = security_path_mknod(&nd->path, dentry, mode, 0); 2853 if (error) 2854 goto out_dput; 2855 error = vfs_create(dir->d_inode, dentry, mode, 2856 nd->flags & LOOKUP_EXCL); 2857 if (error) 2858 goto out_dput; 2859 } 2860 out_no_open: 2861 path->dentry = dentry; 2862 path->mnt = nd->path.mnt; 2863 return 1; 2864 2865 out_dput: 2866 dput(dentry); 2867 return error; 2868 } 2869 2870 /* 2871 * Handle the last step of open() 2872 */ 2873 static int do_last(struct nameidata *nd, struct path *path, 2874 struct file *file, const struct open_flags *op, 2875 int *opened, struct filename *name) 2876 { 2877 struct dentry *dir = nd->path.dentry; 2878 int open_flag = op->open_flag; 2879 bool will_truncate = (open_flag & O_TRUNC) != 0; 2880 bool got_write = false; 2881 int acc_mode = op->acc_mode; 2882 struct inode *inode; 2883 bool symlink_ok = false; 2884 struct path save_parent = { .dentry = NULL, .mnt = NULL }; 2885 bool retried = false; 2886 int error; 2887 2888 nd->flags &= ~LOOKUP_PARENT; 2889 nd->flags |= op->intent; 2890 2891 if (nd->last_type != LAST_NORM) { 2892 error = handle_dots(nd, nd->last_type); 2893 if (error) 2894 return error; 2895 goto finish_open; 2896 } 2897 2898 if (!(open_flag & O_CREAT)) { 2899 if (nd->last.name[nd->last.len]) 2900 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 2901 if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW)) 2902 symlink_ok = true; 2903 /* we _can_ be in RCU mode here */ 2904 error = lookup_fast(nd, path, &inode); 2905 if (likely(!error)) 2906 goto finish_lookup; 2907 2908 if (error < 0) 2909 goto out; 2910 2911 BUG_ON(nd->inode != dir->d_inode); 2912 } else { 2913 /* create side of things */ 2914 /* 2915 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED 2916 * has been cleared when we got to the last component we are 2917 * about to look up 2918 */ 2919 error = complete_walk(nd); 2920 if (error) 2921 return error; 2922 2923 audit_inode(name, dir, LOOKUP_PARENT); 2924 error = -EISDIR; 2925 /* trailing slashes? */ 2926 if (nd->last.name[nd->last.len]) 2927 goto out; 2928 } 2929 2930 retry_lookup: 2931 if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) { 2932 error = mnt_want_write(nd->path.mnt); 2933 if (!error) 2934 got_write = true; 2935 /* 2936 * do _not_ fail yet - we might not need that or fail with 2937 * a different error; let lookup_open() decide; we'll be 2938 * dropping this one anyway. 2939 */ 2940 } 2941 mutex_lock(&dir->d_inode->i_mutex); 2942 error = lookup_open(nd, path, file, op, got_write, opened); 2943 mutex_unlock(&dir->d_inode->i_mutex); 2944 2945 if (error <= 0) { 2946 if (error) 2947 goto out; 2948 2949 if ((*opened & FILE_CREATED) || 2950 !S_ISREG(file_inode(file)->i_mode)) 2951 will_truncate = false; 2952 2953 audit_inode(name, file->f_path.dentry, 0); 2954 goto opened; 2955 } 2956 2957 if (*opened & FILE_CREATED) { 2958 /* Don't check for write permission, don't truncate */ 2959 open_flag &= ~O_TRUNC; 2960 will_truncate = false; 2961 acc_mode = MAY_OPEN; 2962 path_to_nameidata(path, nd); 2963 goto finish_open_created; 2964 } 2965 2966 /* 2967 * create/update audit record if it already exists. 2968 */ 2969 if (d_is_positive(path->dentry)) 2970 audit_inode(name, path->dentry, 0); 2971 2972 /* 2973 * If atomic_open() acquired write access it is dropped now due to 2974 * possible mount and symlink following (this might be optimized away if 2975 * necessary...) 2976 */ 2977 if (got_write) { 2978 mnt_drop_write(nd->path.mnt); 2979 got_write = false; 2980 } 2981 2982 error = -EEXIST; 2983 if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT)) 2984 goto exit_dput; 2985 2986 error = follow_managed(path, nd->flags); 2987 if (error < 0) 2988 goto exit_dput; 2989 2990 if (error) 2991 nd->flags |= LOOKUP_JUMPED; 2992 2993 BUG_ON(nd->flags & LOOKUP_RCU); 2994 inode = path->dentry->d_inode; 2995 finish_lookup: 2996 /* we _can_ be in RCU mode here */ 2997 error = -ENOENT; 2998 if (!inode || d_is_negative(path->dentry)) { 2999 path_to_nameidata(path, nd); 3000 goto out; 3001 } 3002 3003 if (should_follow_link(path->dentry, !symlink_ok)) { 3004 if (nd->flags & LOOKUP_RCU) { 3005 if (unlikely(unlazy_walk(nd, path->dentry))) { 3006 error = -ECHILD; 3007 goto out; 3008 } 3009 } 3010 BUG_ON(inode != path->dentry->d_inode); 3011 return 1; 3012 } 3013 3014 if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path->mnt) { 3015 path_to_nameidata(path, nd); 3016 } else { 3017 save_parent.dentry = nd->path.dentry; 3018 save_parent.mnt = mntget(path->mnt); 3019 nd->path.dentry = path->dentry; 3020 3021 } 3022 nd->inode = inode; 3023 /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */ 3024 finish_open: 3025 error = complete_walk(nd); 3026 if (error) { 3027 path_put(&save_parent); 3028 return error; 3029 } 3030 audit_inode(name, nd->path.dentry, 0); 3031 error = -EISDIR; 3032 if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) 3033 goto out; 3034 error = -ENOTDIR; 3035 if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry)) 3036 goto out; 3037 if (!S_ISREG(nd->inode->i_mode)) 3038 will_truncate = false; 3039 3040 if (will_truncate) { 3041 error = mnt_want_write(nd->path.mnt); 3042 if (error) 3043 goto out; 3044 got_write = true; 3045 } 3046 finish_open_created: 3047 error = may_open(&nd->path, acc_mode, open_flag); 3048 if (error) 3049 goto out; 3050 file->f_path.mnt = nd->path.mnt; 3051 error = finish_open(file, nd->path.dentry, NULL, opened); 3052 if (error) { 3053 if (error == -EOPENSTALE) 3054 goto stale_open; 3055 goto out; 3056 } 3057 opened: 3058 error = open_check_o_direct(file); 3059 if (error) 3060 goto exit_fput; 3061 error = ima_file_check(file, op->acc_mode); 3062 if (error) 3063 goto exit_fput; 3064 3065 if (will_truncate) { 3066 error = handle_truncate(file); 3067 if (error) 3068 goto exit_fput; 3069 } 3070 out: 3071 if (got_write) 3072 mnt_drop_write(nd->path.mnt); 3073 path_put(&save_parent); 3074 terminate_walk(nd); 3075 return error; 3076 3077 exit_dput: 3078 path_put_conditional(path, nd); 3079 goto out; 3080 exit_fput: 3081 fput(file); 3082 goto out; 3083 3084 stale_open: 3085 /* If no saved parent or already retried then can't retry */ 3086 if (!save_parent.dentry || retried) 3087 goto out; 3088 3089 BUG_ON(save_parent.dentry != dir); 3090 path_put(&nd->path); 3091 nd->path = save_parent; 3092 nd->inode = dir->d_inode; 3093 save_parent.mnt = NULL; 3094 save_parent.dentry = NULL; 3095 if (got_write) { 3096 mnt_drop_write(nd->path.mnt); 3097 got_write = false; 3098 } 3099 retried = true; 3100 goto retry_lookup; 3101 } 3102 3103 static int do_tmpfile(int dfd, struct filename *pathname, 3104 struct nameidata *nd, int flags, 3105 const struct open_flags *op, 3106 struct file *file, int *opened) 3107 { 3108 static const struct qstr name = QSTR_INIT("/", 1); 3109 struct dentry *dentry, *child; 3110 struct inode *dir; 3111 int error = path_lookupat(dfd, pathname->name, 3112 flags | LOOKUP_DIRECTORY, nd); 3113 if (unlikely(error)) 3114 return error; 3115 error = mnt_want_write(nd->path.mnt); 3116 if (unlikely(error)) 3117 goto out; 3118 /* we want directory to be writable */ 3119 error = inode_permission(nd->inode, MAY_WRITE | MAY_EXEC); 3120 if (error) 3121 goto out2; 3122 dentry = nd->path.dentry; 3123 dir = dentry->d_inode; 3124 if (!dir->i_op->tmpfile) { 3125 error = -EOPNOTSUPP; 3126 goto out2; 3127 } 3128 child = d_alloc(dentry, &name); 3129 if (unlikely(!child)) { 3130 error = -ENOMEM; 3131 goto out2; 3132 } 3133 nd->flags &= ~LOOKUP_DIRECTORY; 3134 nd->flags |= op->intent; 3135 dput(nd->path.dentry); 3136 nd->path.dentry = child; 3137 error = dir->i_op->tmpfile(dir, nd->path.dentry, op->mode); 3138 if (error) 3139 goto out2; 3140 audit_inode(pathname, nd->path.dentry, 0); 3141 error = may_open(&nd->path, op->acc_mode, op->open_flag); 3142 if (error) 3143 goto out2; 3144 file->f_path.mnt = nd->path.mnt; 3145 error = finish_open(file, nd->path.dentry, NULL, opened); 3146 if (error) 3147 goto out2; 3148 error = open_check_o_direct(file); 3149 if (error) { 3150 fput(file); 3151 } else if (!(op->open_flag & O_EXCL)) { 3152 struct inode *inode = file_inode(file); 3153 spin_lock(&inode->i_lock); 3154 inode->i_state |= I_LINKABLE; 3155 spin_unlock(&inode->i_lock); 3156 } 3157 out2: 3158 mnt_drop_write(nd->path.mnt); 3159 out: 3160 path_put(&nd->path); 3161 return error; 3162 } 3163 3164 static struct file *path_openat(int dfd, struct filename *pathname, 3165 struct nameidata *nd, const struct open_flags *op, int flags) 3166 { 3167 struct file *base = NULL; 3168 struct file *file; 3169 struct path path; 3170 int opened = 0; 3171 int error; 3172 3173 file = get_empty_filp(); 3174 if (IS_ERR(file)) 3175 return file; 3176 3177 file->f_flags = op->open_flag; 3178 3179 if (unlikely(file->f_flags & __O_TMPFILE)) { 3180 error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened); 3181 goto out; 3182 } 3183 3184 error = path_init(dfd, pathname->name, flags | LOOKUP_PARENT, nd, &base); 3185 if (unlikely(error)) 3186 goto out; 3187 3188 current->total_link_count = 0; 3189 error = link_path_walk(pathname->name, nd); 3190 if (unlikely(error)) 3191 goto out; 3192 3193 error = do_last(nd, &path, file, op, &opened, pathname); 3194 while (unlikely(error > 0)) { /* trailing symlink */ 3195 struct path link = path; 3196 void *cookie; 3197 if (!(nd->flags & LOOKUP_FOLLOW)) { 3198 path_put_conditional(&path, nd); 3199 path_put(&nd->path); 3200 error = -ELOOP; 3201 break; 3202 } 3203 error = may_follow_link(&link, nd); 3204 if (unlikely(error)) 3205 break; 3206 nd->flags |= LOOKUP_PARENT; 3207 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL); 3208 error = follow_link(&link, nd, &cookie); 3209 if (unlikely(error)) 3210 break; 3211 error = do_last(nd, &path, file, op, &opened, pathname); 3212 put_link(nd, &link, cookie); 3213 } 3214 out: 3215 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) 3216 path_put(&nd->root); 3217 if (base) 3218 fput(base); 3219 if (!(opened & FILE_OPENED)) { 3220 BUG_ON(!error); 3221 put_filp(file); 3222 } 3223 if (unlikely(error)) { 3224 if (error == -EOPENSTALE) { 3225 if (flags & LOOKUP_RCU) 3226 error = -ECHILD; 3227 else 3228 error = -ESTALE; 3229 } 3230 file = ERR_PTR(error); 3231 } 3232 return file; 3233 } 3234 3235 struct file *do_filp_open(int dfd, struct filename *pathname, 3236 const struct open_flags *op) 3237 { 3238 struct nameidata nd; 3239 int flags = op->lookup_flags; 3240 struct file *filp; 3241 3242 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU); 3243 if (unlikely(filp == ERR_PTR(-ECHILD))) 3244 filp = path_openat(dfd, pathname, &nd, op, flags); 3245 if (unlikely(filp == ERR_PTR(-ESTALE))) 3246 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL); 3247 return filp; 3248 } 3249 3250 struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt, 3251 const char *name, const struct open_flags *op) 3252 { 3253 struct nameidata nd; 3254 struct file *file; 3255 struct filename filename = { .name = name }; 3256 int flags = op->lookup_flags | LOOKUP_ROOT; 3257 3258 nd.root.mnt = mnt; 3259 nd.root.dentry = dentry; 3260 3261 if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN) 3262 return ERR_PTR(-ELOOP); 3263 3264 file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_RCU); 3265 if (unlikely(file == ERR_PTR(-ECHILD))) 3266 file = path_openat(-1, &filename, &nd, op, flags); 3267 if (unlikely(file == ERR_PTR(-ESTALE))) 3268 file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_REVAL); 3269 return file; 3270 } 3271 3272 struct dentry *kern_path_create(int dfd, const char *pathname, 3273 struct path *path, unsigned int lookup_flags) 3274 { 3275 struct dentry *dentry = ERR_PTR(-EEXIST); 3276 struct nameidata nd; 3277 int err2; 3278 int error; 3279 bool is_dir = (lookup_flags & LOOKUP_DIRECTORY); 3280 3281 /* 3282 * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any 3283 * other flags passed in are ignored! 3284 */ 3285 lookup_flags &= LOOKUP_REVAL; 3286 3287 error = do_path_lookup(dfd, pathname, LOOKUP_PARENT|lookup_flags, &nd); 3288 if (error) 3289 return ERR_PTR(error); 3290 3291 /* 3292 * Yucky last component or no last component at all? 3293 * (foo/., foo/.., /////) 3294 */ 3295 if (nd.last_type != LAST_NORM) 3296 goto out; 3297 nd.flags &= ~LOOKUP_PARENT; 3298 nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL; 3299 3300 /* don't fail immediately if it's r/o, at least try to report other errors */ 3301 err2 = mnt_want_write(nd.path.mnt); 3302 /* 3303 * Do the final lookup. 3304 */ 3305 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3306 dentry = lookup_hash(&nd); 3307 if (IS_ERR(dentry)) 3308 goto unlock; 3309 3310 error = -EEXIST; 3311 if (d_is_positive(dentry)) 3312 goto fail; 3313 3314 /* 3315 * Special case - lookup gave negative, but... we had foo/bar/ 3316 * From the vfs_mknod() POV we just have a negative dentry - 3317 * all is fine. Let's be bastards - you had / on the end, you've 3318 * been asking for (non-existent) directory. -ENOENT for you. 3319 */ 3320 if (unlikely(!is_dir && nd.last.name[nd.last.len])) { 3321 error = -ENOENT; 3322 goto fail; 3323 } 3324 if (unlikely(err2)) { 3325 error = err2; 3326 goto fail; 3327 } 3328 *path = nd.path; 3329 return dentry; 3330 fail: 3331 dput(dentry); 3332 dentry = ERR_PTR(error); 3333 unlock: 3334 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 3335 if (!err2) 3336 mnt_drop_write(nd.path.mnt); 3337 out: 3338 path_put(&nd.path); 3339 return dentry; 3340 } 3341 EXPORT_SYMBOL(kern_path_create); 3342 3343 void done_path_create(struct path *path, struct dentry *dentry) 3344 { 3345 dput(dentry); 3346 mutex_unlock(&path->dentry->d_inode->i_mutex); 3347 mnt_drop_write(path->mnt); 3348 path_put(path); 3349 } 3350 EXPORT_SYMBOL(done_path_create); 3351 3352 struct dentry *user_path_create(int dfd, const char __user *pathname, 3353 struct path *path, unsigned int lookup_flags) 3354 { 3355 struct filename *tmp = getname(pathname); 3356 struct dentry *res; 3357 if (IS_ERR(tmp)) 3358 return ERR_CAST(tmp); 3359 res = kern_path_create(dfd, tmp->name, path, lookup_flags); 3360 putname(tmp); 3361 return res; 3362 } 3363 EXPORT_SYMBOL(user_path_create); 3364 3365 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) 3366 { 3367 int error = may_create(dir, dentry); 3368 3369 if (error) 3370 return error; 3371 3372 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD)) 3373 return -EPERM; 3374 3375 if (!dir->i_op->mknod) 3376 return -EPERM; 3377 3378 error = devcgroup_inode_mknod(mode, dev); 3379 if (error) 3380 return error; 3381 3382 error = security_inode_mknod(dir, dentry, mode, dev); 3383 if (error) 3384 return error; 3385 3386 error = dir->i_op->mknod(dir, dentry, mode, dev); 3387 if (!error) 3388 fsnotify_create(dir, dentry); 3389 return error; 3390 } 3391 EXPORT_SYMBOL(vfs_mknod); 3392 3393 static int may_mknod(umode_t mode) 3394 { 3395 switch (mode & S_IFMT) { 3396 case S_IFREG: 3397 case S_IFCHR: 3398 case S_IFBLK: 3399 case S_IFIFO: 3400 case S_IFSOCK: 3401 case 0: /* zero mode translates to S_IFREG */ 3402 return 0; 3403 case S_IFDIR: 3404 return -EPERM; 3405 default: 3406 return -EINVAL; 3407 } 3408 } 3409 3410 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, 3411 unsigned, dev) 3412 { 3413 struct dentry *dentry; 3414 struct path path; 3415 int error; 3416 unsigned int lookup_flags = 0; 3417 3418 error = may_mknod(mode); 3419 if (error) 3420 return error; 3421 retry: 3422 dentry = user_path_create(dfd, filename, &path, lookup_flags); 3423 if (IS_ERR(dentry)) 3424 return PTR_ERR(dentry); 3425 3426 if (!IS_POSIXACL(path.dentry->d_inode)) 3427 mode &= ~current_umask(); 3428 error = security_path_mknod(&path, dentry, mode, dev); 3429 if (error) 3430 goto out; 3431 switch (mode & S_IFMT) { 3432 case 0: case S_IFREG: 3433 error = vfs_create(path.dentry->d_inode,dentry,mode,true); 3434 break; 3435 case S_IFCHR: case S_IFBLK: 3436 error = vfs_mknod(path.dentry->d_inode,dentry,mode, 3437 new_decode_dev(dev)); 3438 break; 3439 case S_IFIFO: case S_IFSOCK: 3440 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0); 3441 break; 3442 } 3443 out: 3444 done_path_create(&path, dentry); 3445 if (retry_estale(error, lookup_flags)) { 3446 lookup_flags |= LOOKUP_REVAL; 3447 goto retry; 3448 } 3449 return error; 3450 } 3451 3452 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev) 3453 { 3454 return sys_mknodat(AT_FDCWD, filename, mode, dev); 3455 } 3456 3457 int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 3458 { 3459 int error = may_create(dir, dentry); 3460 unsigned max_links = dir->i_sb->s_max_links; 3461 3462 if (error) 3463 return error; 3464 3465 if (!dir->i_op->mkdir) 3466 return -EPERM; 3467 3468 mode &= (S_IRWXUGO|S_ISVTX); 3469 error = security_inode_mkdir(dir, dentry, mode); 3470 if (error) 3471 return error; 3472 3473 if (max_links && dir->i_nlink >= max_links) 3474 return -EMLINK; 3475 3476 error = dir->i_op->mkdir(dir, dentry, mode); 3477 if (!error) 3478 fsnotify_mkdir(dir, dentry); 3479 return error; 3480 } 3481 EXPORT_SYMBOL(vfs_mkdir); 3482 3483 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) 3484 { 3485 struct dentry *dentry; 3486 struct path path; 3487 int error; 3488 unsigned int lookup_flags = LOOKUP_DIRECTORY; 3489 3490 retry: 3491 dentry = user_path_create(dfd, pathname, &path, lookup_flags); 3492 if (IS_ERR(dentry)) 3493 return PTR_ERR(dentry); 3494 3495 if (!IS_POSIXACL(path.dentry->d_inode)) 3496 mode &= ~current_umask(); 3497 error = security_path_mkdir(&path, dentry, mode); 3498 if (!error) 3499 error = vfs_mkdir(path.dentry->d_inode, dentry, mode); 3500 done_path_create(&path, dentry); 3501 if (retry_estale(error, lookup_flags)) { 3502 lookup_flags |= LOOKUP_REVAL; 3503 goto retry; 3504 } 3505 return error; 3506 } 3507 3508 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode) 3509 { 3510 return sys_mkdirat(AT_FDCWD, pathname, mode); 3511 } 3512 3513 /* 3514 * The dentry_unhash() helper will try to drop the dentry early: we 3515 * should have a usage count of 1 if we're the only user of this 3516 * dentry, and if that is true (possibly after pruning the dcache), 3517 * then we drop the dentry now. 3518 * 3519 * A low-level filesystem can, if it choses, legally 3520 * do a 3521 * 3522 * if (!d_unhashed(dentry)) 3523 * return -EBUSY; 3524 * 3525 * if it cannot handle the case of removing a directory 3526 * that is still in use by something else.. 3527 */ 3528 void dentry_unhash(struct dentry *dentry) 3529 { 3530 shrink_dcache_parent(dentry); 3531 spin_lock(&dentry->d_lock); 3532 if (dentry->d_lockref.count == 1) 3533 __d_drop(dentry); 3534 spin_unlock(&dentry->d_lock); 3535 } 3536 EXPORT_SYMBOL(dentry_unhash); 3537 3538 int vfs_rmdir(struct inode *dir, struct dentry *dentry) 3539 { 3540 int error = may_delete(dir, dentry, 1); 3541 3542 if (error) 3543 return error; 3544 3545 if (!dir->i_op->rmdir) 3546 return -EPERM; 3547 3548 dget(dentry); 3549 mutex_lock(&dentry->d_inode->i_mutex); 3550 3551 error = -EBUSY; 3552 if (d_mountpoint(dentry)) 3553 goto out; 3554 3555 error = security_inode_rmdir(dir, dentry); 3556 if (error) 3557 goto out; 3558 3559 shrink_dcache_parent(dentry); 3560 error = dir->i_op->rmdir(dir, dentry); 3561 if (error) 3562 goto out; 3563 3564 dentry->d_inode->i_flags |= S_DEAD; 3565 dont_mount(dentry); 3566 3567 out: 3568 mutex_unlock(&dentry->d_inode->i_mutex); 3569 dput(dentry); 3570 if (!error) 3571 d_delete(dentry); 3572 return error; 3573 } 3574 EXPORT_SYMBOL(vfs_rmdir); 3575 3576 static long do_rmdir(int dfd, const char __user *pathname) 3577 { 3578 int error = 0; 3579 struct filename *name; 3580 struct dentry *dentry; 3581 struct nameidata nd; 3582 unsigned int lookup_flags = 0; 3583 retry: 3584 name = user_path_parent(dfd, pathname, &nd, lookup_flags); 3585 if (IS_ERR(name)) 3586 return PTR_ERR(name); 3587 3588 switch(nd.last_type) { 3589 case LAST_DOTDOT: 3590 error = -ENOTEMPTY; 3591 goto exit1; 3592 case LAST_DOT: 3593 error = -EINVAL; 3594 goto exit1; 3595 case LAST_ROOT: 3596 error = -EBUSY; 3597 goto exit1; 3598 } 3599 3600 nd.flags &= ~LOOKUP_PARENT; 3601 error = mnt_want_write(nd.path.mnt); 3602 if (error) 3603 goto exit1; 3604 3605 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3606 dentry = lookup_hash(&nd); 3607 error = PTR_ERR(dentry); 3608 if (IS_ERR(dentry)) 3609 goto exit2; 3610 if (!dentry->d_inode) { 3611 error = -ENOENT; 3612 goto exit3; 3613 } 3614 error = security_path_rmdir(&nd.path, dentry); 3615 if (error) 3616 goto exit3; 3617 error = vfs_rmdir(nd.path.dentry->d_inode, dentry); 3618 exit3: 3619 dput(dentry); 3620 exit2: 3621 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 3622 mnt_drop_write(nd.path.mnt); 3623 exit1: 3624 path_put(&nd.path); 3625 putname(name); 3626 if (retry_estale(error, lookup_flags)) { 3627 lookup_flags |= LOOKUP_REVAL; 3628 goto retry; 3629 } 3630 return error; 3631 } 3632 3633 SYSCALL_DEFINE1(rmdir, const char __user *, pathname) 3634 { 3635 return do_rmdir(AT_FDCWD, pathname); 3636 } 3637 3638 /** 3639 * vfs_unlink - unlink a filesystem object 3640 * @dir: parent directory 3641 * @dentry: victim 3642 * @delegated_inode: returns victim inode, if the inode is delegated. 3643 * 3644 * The caller must hold dir->i_mutex. 3645 * 3646 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and 3647 * return a reference to the inode in delegated_inode. The caller 3648 * should then break the delegation on that inode and retry. Because 3649 * breaking a delegation may take a long time, the caller should drop 3650 * dir->i_mutex before doing so. 3651 * 3652 * Alternatively, a caller may pass NULL for delegated_inode. This may 3653 * be appropriate for callers that expect the underlying filesystem not 3654 * to be NFS exported. 3655 */ 3656 int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode) 3657 { 3658 struct inode *target = dentry->d_inode; 3659 int error = may_delete(dir, dentry, 0); 3660 3661 if (error) 3662 return error; 3663 3664 if (!dir->i_op->unlink) 3665 return -EPERM; 3666 3667 mutex_lock(&target->i_mutex); 3668 if (d_mountpoint(dentry)) 3669 error = -EBUSY; 3670 else { 3671 error = security_inode_unlink(dir, dentry); 3672 if (!error) { 3673 error = try_break_deleg(target, delegated_inode); 3674 if (error) 3675 goto out; 3676 error = dir->i_op->unlink(dir, dentry); 3677 if (!error) 3678 dont_mount(dentry); 3679 } 3680 } 3681 out: 3682 mutex_unlock(&target->i_mutex); 3683 3684 /* We don't d_delete() NFS sillyrenamed files--they still exist. */ 3685 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) { 3686 fsnotify_link_count(target); 3687 d_delete(dentry); 3688 } 3689 3690 return error; 3691 } 3692 EXPORT_SYMBOL(vfs_unlink); 3693 3694 /* 3695 * Make sure that the actual truncation of the file will occur outside its 3696 * directory's i_mutex. Truncate can take a long time if there is a lot of 3697 * writeout happening, and we don't want to prevent access to the directory 3698 * while waiting on the I/O. 3699 */ 3700 static long do_unlinkat(int dfd, const char __user *pathname) 3701 { 3702 int error; 3703 struct filename *name; 3704 struct dentry *dentry; 3705 struct nameidata nd; 3706 struct inode *inode = NULL; 3707 struct inode *delegated_inode = NULL; 3708 unsigned int lookup_flags = 0; 3709 retry: 3710 name = user_path_parent(dfd, pathname, &nd, lookup_flags); 3711 if (IS_ERR(name)) 3712 return PTR_ERR(name); 3713 3714 error = -EISDIR; 3715 if (nd.last_type != LAST_NORM) 3716 goto exit1; 3717 3718 nd.flags &= ~LOOKUP_PARENT; 3719 error = mnt_want_write(nd.path.mnt); 3720 if (error) 3721 goto exit1; 3722 retry_deleg: 3723 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3724 dentry = lookup_hash(&nd); 3725 error = PTR_ERR(dentry); 3726 if (!IS_ERR(dentry)) { 3727 /* Why not before? Because we want correct error value */ 3728 if (nd.last.name[nd.last.len]) 3729 goto slashes; 3730 inode = dentry->d_inode; 3731 if (d_is_negative(dentry)) 3732 goto slashes; 3733 ihold(inode); 3734 error = security_path_unlink(&nd.path, dentry); 3735 if (error) 3736 goto exit2; 3737 error = vfs_unlink(nd.path.dentry->d_inode, dentry, &delegated_inode); 3738 exit2: 3739 dput(dentry); 3740 } 3741 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 3742 if (inode) 3743 iput(inode); /* truncate the inode here */ 3744 inode = NULL; 3745 if (delegated_inode) { 3746 error = break_deleg_wait(&delegated_inode); 3747 if (!error) 3748 goto retry_deleg; 3749 } 3750 mnt_drop_write(nd.path.mnt); 3751 exit1: 3752 path_put(&nd.path); 3753 putname(name); 3754 if (retry_estale(error, lookup_flags)) { 3755 lookup_flags |= LOOKUP_REVAL; 3756 inode = NULL; 3757 goto retry; 3758 } 3759 return error; 3760 3761 slashes: 3762 if (d_is_negative(dentry)) 3763 error = -ENOENT; 3764 else if (d_is_dir(dentry)) 3765 error = -EISDIR; 3766 else 3767 error = -ENOTDIR; 3768 goto exit2; 3769 } 3770 3771 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) 3772 { 3773 if ((flag & ~AT_REMOVEDIR) != 0) 3774 return -EINVAL; 3775 3776 if (flag & AT_REMOVEDIR) 3777 return do_rmdir(dfd, pathname); 3778 3779 return do_unlinkat(dfd, pathname); 3780 } 3781 3782 SYSCALL_DEFINE1(unlink, const char __user *, pathname) 3783 { 3784 return do_unlinkat(AT_FDCWD, pathname); 3785 } 3786 3787 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname) 3788 { 3789 int error = may_create(dir, dentry); 3790 3791 if (error) 3792 return error; 3793 3794 if (!dir->i_op->symlink) 3795 return -EPERM; 3796 3797 error = security_inode_symlink(dir, dentry, oldname); 3798 if (error) 3799 return error; 3800 3801 error = dir->i_op->symlink(dir, dentry, oldname); 3802 if (!error) 3803 fsnotify_create(dir, dentry); 3804 return error; 3805 } 3806 EXPORT_SYMBOL(vfs_symlink); 3807 3808 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, 3809 int, newdfd, const char __user *, newname) 3810 { 3811 int error; 3812 struct filename *from; 3813 struct dentry *dentry; 3814 struct path path; 3815 unsigned int lookup_flags = 0; 3816 3817 from = getname(oldname); 3818 if (IS_ERR(from)) 3819 return PTR_ERR(from); 3820 retry: 3821 dentry = user_path_create(newdfd, newname, &path, lookup_flags); 3822 error = PTR_ERR(dentry); 3823 if (IS_ERR(dentry)) 3824 goto out_putname; 3825 3826 error = security_path_symlink(&path, dentry, from->name); 3827 if (!error) 3828 error = vfs_symlink(path.dentry->d_inode, dentry, from->name); 3829 done_path_create(&path, dentry); 3830 if (retry_estale(error, lookup_flags)) { 3831 lookup_flags |= LOOKUP_REVAL; 3832 goto retry; 3833 } 3834 out_putname: 3835 putname(from); 3836 return error; 3837 } 3838 3839 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) 3840 { 3841 return sys_symlinkat(oldname, AT_FDCWD, newname); 3842 } 3843 3844 /** 3845 * vfs_link - create a new link 3846 * @old_dentry: object to be linked 3847 * @dir: new parent 3848 * @new_dentry: where to create the new link 3849 * @delegated_inode: returns inode needing a delegation break 3850 * 3851 * The caller must hold dir->i_mutex 3852 * 3853 * If vfs_link discovers a delegation on the to-be-linked file in need 3854 * of breaking, it will return -EWOULDBLOCK and return a reference to the 3855 * inode in delegated_inode. The caller should then break the delegation 3856 * and retry. Because breaking a delegation may take a long time, the 3857 * caller should drop the i_mutex before doing so. 3858 * 3859 * Alternatively, a caller may pass NULL for delegated_inode. This may 3860 * be appropriate for callers that expect the underlying filesystem not 3861 * to be NFS exported. 3862 */ 3863 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode) 3864 { 3865 struct inode *inode = old_dentry->d_inode; 3866 unsigned max_links = dir->i_sb->s_max_links; 3867 int error; 3868 3869 if (!inode) 3870 return -ENOENT; 3871 3872 error = may_create(dir, new_dentry); 3873 if (error) 3874 return error; 3875 3876 if (dir->i_sb != inode->i_sb) 3877 return -EXDEV; 3878 3879 /* 3880 * A link to an append-only or immutable file cannot be created. 3881 */ 3882 if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) 3883 return -EPERM; 3884 if (!dir->i_op->link) 3885 return -EPERM; 3886 if (S_ISDIR(inode->i_mode)) 3887 return -EPERM; 3888 3889 error = security_inode_link(old_dentry, dir, new_dentry); 3890 if (error) 3891 return error; 3892 3893 mutex_lock(&inode->i_mutex); 3894 /* Make sure we don't allow creating hardlink to an unlinked file */ 3895 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE)) 3896 error = -ENOENT; 3897 else if (max_links && inode->i_nlink >= max_links) 3898 error = -EMLINK; 3899 else { 3900 error = try_break_deleg(inode, delegated_inode); 3901 if (!error) 3902 error = dir->i_op->link(old_dentry, dir, new_dentry); 3903 } 3904 3905 if (!error && (inode->i_state & I_LINKABLE)) { 3906 spin_lock(&inode->i_lock); 3907 inode->i_state &= ~I_LINKABLE; 3908 spin_unlock(&inode->i_lock); 3909 } 3910 mutex_unlock(&inode->i_mutex); 3911 if (!error) 3912 fsnotify_link(dir, inode, new_dentry); 3913 return error; 3914 } 3915 EXPORT_SYMBOL(vfs_link); 3916 3917 /* 3918 * Hardlinks are often used in delicate situations. We avoid 3919 * security-related surprises by not following symlinks on the 3920 * newname. --KAB 3921 * 3922 * We don't follow them on the oldname either to be compatible 3923 * with linux 2.0, and to avoid hard-linking to directories 3924 * and other special files. --ADM 3925 */ 3926 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, 3927 int, newdfd, const char __user *, newname, int, flags) 3928 { 3929 struct dentry *new_dentry; 3930 struct path old_path, new_path; 3931 struct inode *delegated_inode = NULL; 3932 int how = 0; 3933 int error; 3934 3935 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) 3936 return -EINVAL; 3937 /* 3938 * To use null names we require CAP_DAC_READ_SEARCH 3939 * This ensures that not everyone will be able to create 3940 * handlink using the passed filedescriptor. 3941 */ 3942 if (flags & AT_EMPTY_PATH) { 3943 if (!capable(CAP_DAC_READ_SEARCH)) 3944 return -ENOENT; 3945 how = LOOKUP_EMPTY; 3946 } 3947 3948 if (flags & AT_SYMLINK_FOLLOW) 3949 how |= LOOKUP_FOLLOW; 3950 retry: 3951 error = user_path_at(olddfd, oldname, how, &old_path); 3952 if (error) 3953 return error; 3954 3955 new_dentry = user_path_create(newdfd, newname, &new_path, 3956 (how & LOOKUP_REVAL)); 3957 error = PTR_ERR(new_dentry); 3958 if (IS_ERR(new_dentry)) 3959 goto out; 3960 3961 error = -EXDEV; 3962 if (old_path.mnt != new_path.mnt) 3963 goto out_dput; 3964 error = may_linkat(&old_path); 3965 if (unlikely(error)) 3966 goto out_dput; 3967 error = security_path_link(old_path.dentry, &new_path, new_dentry); 3968 if (error) 3969 goto out_dput; 3970 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode); 3971 out_dput: 3972 done_path_create(&new_path, new_dentry); 3973 if (delegated_inode) { 3974 error = break_deleg_wait(&delegated_inode); 3975 if (!error) { 3976 path_put(&old_path); 3977 goto retry; 3978 } 3979 } 3980 if (retry_estale(error, how)) { 3981 path_put(&old_path); 3982 how |= LOOKUP_REVAL; 3983 goto retry; 3984 } 3985 out: 3986 path_put(&old_path); 3987 3988 return error; 3989 } 3990 3991 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) 3992 { 3993 return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 3994 } 3995 3996 /** 3997 * vfs_rename - rename a filesystem object 3998 * @old_dir: parent of source 3999 * @old_dentry: source 4000 * @new_dir: parent of destination 4001 * @new_dentry: destination 4002 * @delegated_inode: returns an inode needing a delegation break 4003 * @flags: rename flags 4004 * 4005 * The caller must hold multiple mutexes--see lock_rename()). 4006 * 4007 * If vfs_rename discovers a delegation in need of breaking at either 4008 * the source or destination, it will return -EWOULDBLOCK and return a 4009 * reference to the inode in delegated_inode. The caller should then 4010 * break the delegation and retry. Because breaking a delegation may 4011 * take a long time, the caller should drop all locks before doing 4012 * so. 4013 * 4014 * Alternatively, a caller may pass NULL for delegated_inode. This may 4015 * be appropriate for callers that expect the underlying filesystem not 4016 * to be NFS exported. 4017 * 4018 * The worst of all namespace operations - renaming directory. "Perverted" 4019 * doesn't even start to describe it. Somebody in UCB had a heck of a trip... 4020 * Problems: 4021 * a) we can get into loop creation. Check is done in is_subdir(). 4022 * b) race potential - two innocent renames can create a loop together. 4023 * That's where 4.4 screws up. Current fix: serialization on 4024 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another 4025 * story. 4026 * c) we have to lock _four_ objects - parents and victim (if it exists), 4027 * and source (if it is not a directory). 4028 * And that - after we got ->i_mutex on parents (until then we don't know 4029 * whether the target exists). Solution: try to be smart with locking 4030 * order for inodes. We rely on the fact that tree topology may change 4031 * only under ->s_vfs_rename_mutex _and_ that parent of the object we 4032 * move will be locked. Thus we can rank directories by the tree 4033 * (ancestors first) and rank all non-directories after them. 4034 * That works since everybody except rename does "lock parent, lookup, 4035 * lock child" and rename is under ->s_vfs_rename_mutex. 4036 * HOWEVER, it relies on the assumption that any object with ->lookup() 4037 * has no more than 1 dentry. If "hybrid" objects will ever appear, 4038 * we'd better make sure that there's no link(2) for them. 4039 * d) conversion from fhandle to dentry may come in the wrong moment - when 4040 * we are removing the target. Solution: we will have to grab ->i_mutex 4041 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on 4042 * ->i_mutex on parents, which works but leads to some truly excessive 4043 * locking]. 4044 */ 4045 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, 4046 struct inode *new_dir, struct dentry *new_dentry, 4047 struct inode **delegated_inode, unsigned int flags) 4048 { 4049 int error; 4050 bool is_dir = d_is_dir(old_dentry); 4051 const unsigned char *old_name; 4052 struct inode *source = old_dentry->d_inode; 4053 struct inode *target = new_dentry->d_inode; 4054 bool new_is_dir = false; 4055 unsigned max_links = new_dir->i_sb->s_max_links; 4056 4057 if (source == target) 4058 return 0; 4059 4060 error = may_delete(old_dir, old_dentry, is_dir); 4061 if (error) 4062 return error; 4063 4064 if (!target) { 4065 error = may_create(new_dir, new_dentry); 4066 } else { 4067 new_is_dir = d_is_dir(new_dentry); 4068 4069 if (!(flags & RENAME_EXCHANGE)) 4070 error = may_delete(new_dir, new_dentry, is_dir); 4071 else 4072 error = may_delete(new_dir, new_dentry, new_is_dir); 4073 } 4074 if (error) 4075 return error; 4076 4077 if (!old_dir->i_op->rename) 4078 return -EPERM; 4079 4080 if (flags && !old_dir->i_op->rename2) 4081 return -EINVAL; 4082 4083 /* 4084 * If we are going to change the parent - check write permissions, 4085 * we'll need to flip '..'. 4086 */ 4087 if (new_dir != old_dir) { 4088 if (is_dir) { 4089 error = inode_permission(source, MAY_WRITE); 4090 if (error) 4091 return error; 4092 } 4093 if ((flags & RENAME_EXCHANGE) && new_is_dir) { 4094 error = inode_permission(target, MAY_WRITE); 4095 if (error) 4096 return error; 4097 } 4098 } 4099 4100 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry, 4101 flags); 4102 if (error) 4103 return error; 4104 4105 old_name = fsnotify_oldname_init(old_dentry->d_name.name); 4106 dget(new_dentry); 4107 if (!is_dir || (flags & RENAME_EXCHANGE)) 4108 lock_two_nondirectories(source, target); 4109 else if (target) 4110 mutex_lock(&target->i_mutex); 4111 4112 error = -EBUSY; 4113 if (d_mountpoint(old_dentry) || d_mountpoint(new_dentry)) 4114 goto out; 4115 4116 if (max_links && new_dir != old_dir) { 4117 error = -EMLINK; 4118 if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links) 4119 goto out; 4120 if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir && 4121 old_dir->i_nlink >= max_links) 4122 goto out; 4123 } 4124 if (is_dir && !(flags & RENAME_EXCHANGE) && target) 4125 shrink_dcache_parent(new_dentry); 4126 if (!is_dir) { 4127 error = try_break_deleg(source, delegated_inode); 4128 if (error) 4129 goto out; 4130 } 4131 if (target && !new_is_dir) { 4132 error = try_break_deleg(target, delegated_inode); 4133 if (error) 4134 goto out; 4135 } 4136 if (!flags) { 4137 error = old_dir->i_op->rename(old_dir, old_dentry, 4138 new_dir, new_dentry); 4139 } else { 4140 error = old_dir->i_op->rename2(old_dir, old_dentry, 4141 new_dir, new_dentry, flags); 4142 } 4143 if (error) 4144 goto out; 4145 4146 if (!(flags & RENAME_EXCHANGE) && target) { 4147 if (is_dir) 4148 target->i_flags |= S_DEAD; 4149 dont_mount(new_dentry); 4150 } 4151 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) { 4152 if (!(flags & RENAME_EXCHANGE)) 4153 d_move(old_dentry, new_dentry); 4154 else 4155 d_exchange(old_dentry, new_dentry); 4156 } 4157 out: 4158 if (!is_dir || (flags & RENAME_EXCHANGE)) 4159 unlock_two_nondirectories(source, target); 4160 else if (target) 4161 mutex_unlock(&target->i_mutex); 4162 dput(new_dentry); 4163 if (!error) { 4164 fsnotify_move(old_dir, new_dir, old_name, is_dir, 4165 !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry); 4166 if (flags & RENAME_EXCHANGE) { 4167 fsnotify_move(new_dir, old_dir, old_dentry->d_name.name, 4168 new_is_dir, NULL, new_dentry); 4169 } 4170 } 4171 fsnotify_oldname_free(old_name); 4172 4173 return error; 4174 } 4175 EXPORT_SYMBOL(vfs_rename); 4176 4177 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname, 4178 int, newdfd, const char __user *, newname, unsigned int, flags) 4179 { 4180 struct dentry *old_dir, *new_dir; 4181 struct dentry *old_dentry, *new_dentry; 4182 struct dentry *trap; 4183 struct nameidata oldnd, newnd; 4184 struct inode *delegated_inode = NULL; 4185 struct filename *from; 4186 struct filename *to; 4187 unsigned int lookup_flags = 0; 4188 bool should_retry = false; 4189 int error; 4190 4191 if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE)) 4192 return -EINVAL; 4193 4194 if ((flags & RENAME_NOREPLACE) && (flags & RENAME_EXCHANGE)) 4195 return -EINVAL; 4196 4197 retry: 4198 from = user_path_parent(olddfd, oldname, &oldnd, lookup_flags); 4199 if (IS_ERR(from)) { 4200 error = PTR_ERR(from); 4201 goto exit; 4202 } 4203 4204 to = user_path_parent(newdfd, newname, &newnd, lookup_flags); 4205 if (IS_ERR(to)) { 4206 error = PTR_ERR(to); 4207 goto exit1; 4208 } 4209 4210 error = -EXDEV; 4211 if (oldnd.path.mnt != newnd.path.mnt) 4212 goto exit2; 4213 4214 old_dir = oldnd.path.dentry; 4215 error = -EBUSY; 4216 if (oldnd.last_type != LAST_NORM) 4217 goto exit2; 4218 4219 new_dir = newnd.path.dentry; 4220 if (flags & RENAME_NOREPLACE) 4221 error = -EEXIST; 4222 if (newnd.last_type != LAST_NORM) 4223 goto exit2; 4224 4225 error = mnt_want_write(oldnd.path.mnt); 4226 if (error) 4227 goto exit2; 4228 4229 oldnd.flags &= ~LOOKUP_PARENT; 4230 newnd.flags &= ~LOOKUP_PARENT; 4231 if (!(flags & RENAME_EXCHANGE)) 4232 newnd.flags |= LOOKUP_RENAME_TARGET; 4233 4234 retry_deleg: 4235 trap = lock_rename(new_dir, old_dir); 4236 4237 old_dentry = lookup_hash(&oldnd); 4238 error = PTR_ERR(old_dentry); 4239 if (IS_ERR(old_dentry)) 4240 goto exit3; 4241 /* source must exist */ 4242 error = -ENOENT; 4243 if (d_is_negative(old_dentry)) 4244 goto exit4; 4245 new_dentry = lookup_hash(&newnd); 4246 error = PTR_ERR(new_dentry); 4247 if (IS_ERR(new_dentry)) 4248 goto exit4; 4249 error = -EEXIST; 4250 if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry)) 4251 goto exit5; 4252 if (flags & RENAME_EXCHANGE) { 4253 error = -ENOENT; 4254 if (d_is_negative(new_dentry)) 4255 goto exit5; 4256 4257 if (!d_is_dir(new_dentry)) { 4258 error = -ENOTDIR; 4259 if (newnd.last.name[newnd.last.len]) 4260 goto exit5; 4261 } 4262 } 4263 /* unless the source is a directory trailing slashes give -ENOTDIR */ 4264 if (!d_is_dir(old_dentry)) { 4265 error = -ENOTDIR; 4266 if (oldnd.last.name[oldnd.last.len]) 4267 goto exit5; 4268 if (!(flags & RENAME_EXCHANGE) && newnd.last.name[newnd.last.len]) 4269 goto exit5; 4270 } 4271 /* source should not be ancestor of target */ 4272 error = -EINVAL; 4273 if (old_dentry == trap) 4274 goto exit5; 4275 /* target should not be an ancestor of source */ 4276 if (!(flags & RENAME_EXCHANGE)) 4277 error = -ENOTEMPTY; 4278 if (new_dentry == trap) 4279 goto exit5; 4280 4281 error = security_path_rename(&oldnd.path, old_dentry, 4282 &newnd.path, new_dentry, flags); 4283 if (error) 4284 goto exit5; 4285 error = vfs_rename(old_dir->d_inode, old_dentry, 4286 new_dir->d_inode, new_dentry, 4287 &delegated_inode, flags); 4288 exit5: 4289 dput(new_dentry); 4290 exit4: 4291 dput(old_dentry); 4292 exit3: 4293 unlock_rename(new_dir, old_dir); 4294 if (delegated_inode) { 4295 error = break_deleg_wait(&delegated_inode); 4296 if (!error) 4297 goto retry_deleg; 4298 } 4299 mnt_drop_write(oldnd.path.mnt); 4300 exit2: 4301 if (retry_estale(error, lookup_flags)) 4302 should_retry = true; 4303 path_put(&newnd.path); 4304 putname(to); 4305 exit1: 4306 path_put(&oldnd.path); 4307 putname(from); 4308 if (should_retry) { 4309 should_retry = false; 4310 lookup_flags |= LOOKUP_REVAL; 4311 goto retry; 4312 } 4313 exit: 4314 return error; 4315 } 4316 4317 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, 4318 int, newdfd, const char __user *, newname) 4319 { 4320 return sys_renameat2(olddfd, oldname, newdfd, newname, 0); 4321 } 4322 4323 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) 4324 { 4325 return sys_renameat2(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 4326 } 4327 4328 int readlink_copy(char __user *buffer, int buflen, const char *link) 4329 { 4330 int len = PTR_ERR(link); 4331 if (IS_ERR(link)) 4332 goto out; 4333 4334 len = strlen(link); 4335 if (len > (unsigned) buflen) 4336 len = buflen; 4337 if (copy_to_user(buffer, link, len)) 4338 len = -EFAULT; 4339 out: 4340 return len; 4341 } 4342 EXPORT_SYMBOL(readlink_copy); 4343 4344 /* 4345 * A helper for ->readlink(). This should be used *ONLY* for symlinks that 4346 * have ->follow_link() touching nd only in nd_set_link(). Using (or not 4347 * using) it for any given inode is up to filesystem. 4348 */ 4349 int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4350 { 4351 struct nameidata nd; 4352 void *cookie; 4353 int res; 4354 4355 nd.depth = 0; 4356 cookie = dentry->d_inode->i_op->follow_link(dentry, &nd); 4357 if (IS_ERR(cookie)) 4358 return PTR_ERR(cookie); 4359 4360 res = readlink_copy(buffer, buflen, nd_get_link(&nd)); 4361 if (dentry->d_inode->i_op->put_link) 4362 dentry->d_inode->i_op->put_link(dentry, &nd, cookie); 4363 return res; 4364 } 4365 EXPORT_SYMBOL(generic_readlink); 4366 4367 /* get the link contents into pagecache */ 4368 static char *page_getlink(struct dentry * dentry, struct page **ppage) 4369 { 4370 char *kaddr; 4371 struct page *page; 4372 struct address_space *mapping = dentry->d_inode->i_mapping; 4373 page = read_mapping_page(mapping, 0, NULL); 4374 if (IS_ERR(page)) 4375 return (char*)page; 4376 *ppage = page; 4377 kaddr = kmap(page); 4378 nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1); 4379 return kaddr; 4380 } 4381 4382 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4383 { 4384 struct page *page = NULL; 4385 int res = readlink_copy(buffer, buflen, page_getlink(dentry, &page)); 4386 if (page) { 4387 kunmap(page); 4388 page_cache_release(page); 4389 } 4390 return res; 4391 } 4392 EXPORT_SYMBOL(page_readlink); 4393 4394 void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd) 4395 { 4396 struct page *page = NULL; 4397 nd_set_link(nd, page_getlink(dentry, &page)); 4398 return page; 4399 } 4400 EXPORT_SYMBOL(page_follow_link_light); 4401 4402 void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie) 4403 { 4404 struct page *page = cookie; 4405 4406 if (page) { 4407 kunmap(page); 4408 page_cache_release(page); 4409 } 4410 } 4411 EXPORT_SYMBOL(page_put_link); 4412 4413 /* 4414 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS 4415 */ 4416 int __page_symlink(struct inode *inode, const char *symname, int len, int nofs) 4417 { 4418 struct address_space *mapping = inode->i_mapping; 4419 struct page *page; 4420 void *fsdata; 4421 int err; 4422 char *kaddr; 4423 unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE; 4424 if (nofs) 4425 flags |= AOP_FLAG_NOFS; 4426 4427 retry: 4428 err = pagecache_write_begin(NULL, mapping, 0, len-1, 4429 flags, &page, &fsdata); 4430 if (err) 4431 goto fail; 4432 4433 kaddr = kmap_atomic(page); 4434 memcpy(kaddr, symname, len-1); 4435 kunmap_atomic(kaddr); 4436 4437 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1, 4438 page, fsdata); 4439 if (err < 0) 4440 goto fail; 4441 if (err < len-1) 4442 goto retry; 4443 4444 mark_inode_dirty(inode); 4445 return 0; 4446 fail: 4447 return err; 4448 } 4449 EXPORT_SYMBOL(__page_symlink); 4450 4451 int page_symlink(struct inode *inode, const char *symname, int len) 4452 { 4453 return __page_symlink(inode, symname, len, 4454 !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS)); 4455 } 4456 EXPORT_SYMBOL(page_symlink); 4457 4458 const struct inode_operations page_symlink_inode_operations = { 4459 .readlink = generic_readlink, 4460 .follow_link = page_follow_link_light, 4461 .put_link = page_put_link, 4462 }; 4463 EXPORT_SYMBOL(page_symlink_inode_operations); 4464