1 /* 2 * linux/fs/namei.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * Some corrections by tytso. 9 */ 10 11 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname 12 * lookup logic. 13 */ 14 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture. 15 */ 16 17 #include <linux/init.h> 18 #include <linux/module.h> 19 #include <linux/slab.h> 20 #include <linux/fs.h> 21 #include <linux/namei.h> 22 #include <linux/pagemap.h> 23 #include <linux/fsnotify.h> 24 #include <linux/personality.h> 25 #include <linux/security.h> 26 #include <linux/ima.h> 27 #include <linux/syscalls.h> 28 #include <linux/mount.h> 29 #include <linux/audit.h> 30 #include <linux/capability.h> 31 #include <linux/file.h> 32 #include <linux/fcntl.h> 33 #include <linux/device_cgroup.h> 34 #include <linux/fs_struct.h> 35 #include <linux/posix_acl.h> 36 #include <asm/uaccess.h> 37 38 #include "internal.h" 39 40 /* [Feb-1997 T. Schoebel-Theuer] 41 * Fundamental changes in the pathname lookup mechanisms (namei) 42 * were necessary because of omirr. The reason is that omirr needs 43 * to know the _real_ pathname, not the user-supplied one, in case 44 * of symlinks (and also when transname replacements occur). 45 * 46 * The new code replaces the old recursive symlink resolution with 47 * an iterative one (in case of non-nested symlink chains). It does 48 * this with calls to <fs>_follow_link(). 49 * As a side effect, dir_namei(), _namei() and follow_link() are now 50 * replaced with a single function lookup_dentry() that can handle all 51 * the special cases of the former code. 52 * 53 * With the new dcache, the pathname is stored at each inode, at least as 54 * long as the refcount of the inode is positive. As a side effect, the 55 * size of the dcache depends on the inode cache and thus is dynamic. 56 * 57 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink 58 * resolution to correspond with current state of the code. 59 * 60 * Note that the symlink resolution is not *completely* iterative. 61 * There is still a significant amount of tail- and mid- recursion in 62 * the algorithm. Also, note that <fs>_readlink() is not used in 63 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink() 64 * may return different results than <fs>_follow_link(). Many virtual 65 * filesystems (including /proc) exhibit this behavior. 66 */ 67 68 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation: 69 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL 70 * and the name already exists in form of a symlink, try to create the new 71 * name indicated by the symlink. The old code always complained that the 72 * name already exists, due to not following the symlink even if its target 73 * is nonexistent. The new semantics affects also mknod() and link() when 74 * the name is a symlink pointing to a non-existent name. 75 * 76 * I don't know which semantics is the right one, since I have no access 77 * to standards. But I found by trial that HP-UX 9.0 has the full "new" 78 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the 79 * "old" one. Personally, I think the new semantics is much more logical. 80 * Note that "ln old new" where "new" is a symlink pointing to a non-existing 81 * file does succeed in both HP-UX and SunOs, but not in Solaris 82 * and in the old Linux semantics. 83 */ 84 85 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink 86 * semantics. See the comments in "open_namei" and "do_link" below. 87 * 88 * [10-Sep-98 Alan Modra] Another symlink change. 89 */ 90 91 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks: 92 * inside the path - always follow. 93 * in the last component in creation/removal/renaming - never follow. 94 * if LOOKUP_FOLLOW passed - follow. 95 * if the pathname has trailing slashes - follow. 96 * otherwise - don't follow. 97 * (applied in that order). 98 * 99 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT 100 * restored for 2.4. This is the last surviving part of old 4.2BSD bug. 101 * During the 2.4 we need to fix the userland stuff depending on it - 102 * hopefully we will be able to get rid of that wart in 2.5. So far only 103 * XEmacs seems to be relying on it... 104 */ 105 /* 106 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland) 107 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives 108 * any extra contention... 109 */ 110 111 /* In order to reduce some races, while at the same time doing additional 112 * checking and hopefully speeding things up, we copy filenames to the 113 * kernel data space before using them.. 114 * 115 * POSIX.1 2.4: an empty pathname is invalid (ENOENT). 116 * PATH_MAX includes the nul terminator --RR. 117 */ 118 static int do_getname(const char __user *filename, char *page) 119 { 120 int retval; 121 unsigned long len = PATH_MAX; 122 123 if (!segment_eq(get_fs(), KERNEL_DS)) { 124 if ((unsigned long) filename >= TASK_SIZE) 125 return -EFAULT; 126 if (TASK_SIZE - (unsigned long) filename < PATH_MAX) 127 len = TASK_SIZE - (unsigned long) filename; 128 } 129 130 retval = strncpy_from_user(page, filename, len); 131 if (retval > 0) { 132 if (retval < len) 133 return 0; 134 return -ENAMETOOLONG; 135 } else if (!retval) 136 retval = -ENOENT; 137 return retval; 138 } 139 140 static char *getname_flags(const char __user * filename, int flags) 141 { 142 char *tmp, *result; 143 144 result = ERR_PTR(-ENOMEM); 145 tmp = __getname(); 146 if (tmp) { 147 int retval = do_getname(filename, tmp); 148 149 result = tmp; 150 if (retval < 0) { 151 if (retval != -ENOENT || !(flags & LOOKUP_EMPTY)) { 152 __putname(tmp); 153 result = ERR_PTR(retval); 154 } 155 } 156 } 157 audit_getname(result); 158 return result; 159 } 160 161 char *getname(const char __user * filename) 162 { 163 return getname_flags(filename, 0); 164 } 165 166 #ifdef CONFIG_AUDITSYSCALL 167 void putname(const char *name) 168 { 169 if (unlikely(!audit_dummy_context())) 170 audit_putname(name); 171 else 172 __putname(name); 173 } 174 EXPORT_SYMBOL(putname); 175 #endif 176 177 static int check_acl(struct inode *inode, int mask) 178 { 179 #ifdef CONFIG_FS_POSIX_ACL 180 struct posix_acl *acl; 181 182 if (mask & MAY_NOT_BLOCK) { 183 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS); 184 if (!acl) 185 return -EAGAIN; 186 /* no ->get_acl() calls in RCU mode... */ 187 if (acl == ACL_NOT_CACHED) 188 return -ECHILD; 189 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK); 190 } 191 192 acl = get_cached_acl(inode, ACL_TYPE_ACCESS); 193 194 /* 195 * A filesystem can force a ACL callback by just never filling the 196 * ACL cache. But normally you'd fill the cache either at inode 197 * instantiation time, or on the first ->get_acl call. 198 * 199 * If the filesystem doesn't have a get_acl() function at all, we'll 200 * just create the negative cache entry. 201 */ 202 if (acl == ACL_NOT_CACHED) { 203 if (inode->i_op->get_acl) { 204 acl = inode->i_op->get_acl(inode, ACL_TYPE_ACCESS); 205 if (IS_ERR(acl)) 206 return PTR_ERR(acl); 207 } else { 208 set_cached_acl(inode, ACL_TYPE_ACCESS, NULL); 209 return -EAGAIN; 210 } 211 } 212 213 if (acl) { 214 int error = posix_acl_permission(inode, acl, mask); 215 posix_acl_release(acl); 216 return error; 217 } 218 #endif 219 220 return -EAGAIN; 221 } 222 223 /* 224 * This does basic POSIX ACL permission checking 225 */ 226 static int acl_permission_check(struct inode *inode, int mask) 227 { 228 unsigned int mode = inode->i_mode; 229 230 mask &= MAY_READ | MAY_WRITE | MAY_EXEC | MAY_NOT_BLOCK; 231 232 if (current_user_ns() != inode_userns(inode)) 233 goto other_perms; 234 235 if (likely(current_fsuid() == inode->i_uid)) 236 mode >>= 6; 237 else { 238 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { 239 int error = check_acl(inode, mask); 240 if (error != -EAGAIN) 241 return error; 242 } 243 244 if (in_group_p(inode->i_gid)) 245 mode >>= 3; 246 } 247 248 other_perms: 249 /* 250 * If the DACs are ok we don't need any capability check. 251 */ 252 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0) 253 return 0; 254 return -EACCES; 255 } 256 257 /** 258 * generic_permission - check for access rights on a Posix-like filesystem 259 * @inode: inode to check access rights for 260 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 261 * 262 * Used to check for read/write/execute permissions on a file. 263 * We use "fsuid" for this, letting us set arbitrary permissions 264 * for filesystem access without changing the "normal" uids which 265 * are used for other things. 266 * 267 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk 268 * request cannot be satisfied (eg. requires blocking or too much complexity). 269 * It would then be called again in ref-walk mode. 270 */ 271 int generic_permission(struct inode *inode, int mask) 272 { 273 int ret; 274 275 /* 276 * Do the basic POSIX ACL permission checks. 277 */ 278 ret = acl_permission_check(inode, mask); 279 if (ret != -EACCES) 280 return ret; 281 282 if (S_ISDIR(inode->i_mode)) { 283 /* DACs are overridable for directories */ 284 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE)) 285 return 0; 286 if (!(mask & MAY_WRITE)) 287 if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH)) 288 return 0; 289 return -EACCES; 290 } 291 /* 292 * Read/write DACs are always overridable. 293 * Executable DACs are overridable when there is 294 * at least one exec bit set. 295 */ 296 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 297 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE)) 298 return 0; 299 300 /* 301 * Searching includes executable on directories, else just read. 302 */ 303 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 304 if (mask == MAY_READ) 305 if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH)) 306 return 0; 307 308 return -EACCES; 309 } 310 311 /* 312 * We _really_ want to just do "generic_permission()" without 313 * even looking at the inode->i_op values. So we keep a cache 314 * flag in inode->i_opflags, that says "this has not special 315 * permission function, use the fast case". 316 */ 317 static inline int do_inode_permission(struct inode *inode, int mask) 318 { 319 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) { 320 if (likely(inode->i_op->permission)) 321 return inode->i_op->permission(inode, mask); 322 323 /* This gets set once for the inode lifetime */ 324 spin_lock(&inode->i_lock); 325 inode->i_opflags |= IOP_FASTPERM; 326 spin_unlock(&inode->i_lock); 327 } 328 return generic_permission(inode, mask); 329 } 330 331 /** 332 * inode_permission - check for access rights to a given inode 333 * @inode: inode to check permission on 334 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 335 * 336 * Used to check for read/write/execute permissions on an inode. 337 * We use "fsuid" for this, letting us set arbitrary permissions 338 * for filesystem access without changing the "normal" uids which 339 * are used for other things. 340 */ 341 int inode_permission(struct inode *inode, int mask) 342 { 343 int retval; 344 345 if (unlikely(mask & MAY_WRITE)) { 346 umode_t mode = inode->i_mode; 347 348 /* 349 * Nobody gets write access to a read-only fs. 350 */ 351 if (IS_RDONLY(inode) && 352 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) 353 return -EROFS; 354 355 /* 356 * Nobody gets write access to an immutable file. 357 */ 358 if (IS_IMMUTABLE(inode)) 359 return -EACCES; 360 } 361 362 retval = do_inode_permission(inode, mask); 363 if (retval) 364 return retval; 365 366 retval = devcgroup_inode_permission(inode, mask); 367 if (retval) 368 return retval; 369 370 return security_inode_permission(inode, mask); 371 } 372 373 /** 374 * path_get - get a reference to a path 375 * @path: path to get the reference to 376 * 377 * Given a path increment the reference count to the dentry and the vfsmount. 378 */ 379 void path_get(struct path *path) 380 { 381 mntget(path->mnt); 382 dget(path->dentry); 383 } 384 EXPORT_SYMBOL(path_get); 385 386 /** 387 * path_put - put a reference to a path 388 * @path: path to put the reference to 389 * 390 * Given a path decrement the reference count to the dentry and the vfsmount. 391 */ 392 void path_put(struct path *path) 393 { 394 dput(path->dentry); 395 mntput(path->mnt); 396 } 397 EXPORT_SYMBOL(path_put); 398 399 /* 400 * Path walking has 2 modes, rcu-walk and ref-walk (see 401 * Documentation/filesystems/path-lookup.txt). In situations when we can't 402 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab 403 * normal reference counts on dentries and vfsmounts to transition to rcu-walk 404 * mode. Refcounts are grabbed at the last known good point before rcu-walk 405 * got stuck, so ref-walk may continue from there. If this is not successful 406 * (eg. a seqcount has changed), then failure is returned and it's up to caller 407 * to restart the path walk from the beginning in ref-walk mode. 408 */ 409 410 /** 411 * unlazy_walk - try to switch to ref-walk mode. 412 * @nd: nameidata pathwalk data 413 * @dentry: child of nd->path.dentry or NULL 414 * Returns: 0 on success, -ECHILD on failure 415 * 416 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry 417 * for ref-walk mode. @dentry must be a path found by a do_lookup call on 418 * @nd or NULL. Must be called from rcu-walk context. 419 */ 420 static int unlazy_walk(struct nameidata *nd, struct dentry *dentry) 421 { 422 struct fs_struct *fs = current->fs; 423 struct dentry *parent = nd->path.dentry; 424 int want_root = 0; 425 426 BUG_ON(!(nd->flags & LOOKUP_RCU)); 427 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 428 want_root = 1; 429 spin_lock(&fs->lock); 430 if (nd->root.mnt != fs->root.mnt || 431 nd->root.dentry != fs->root.dentry) 432 goto err_root; 433 } 434 spin_lock(&parent->d_lock); 435 if (!dentry) { 436 if (!__d_rcu_to_refcount(parent, nd->seq)) 437 goto err_parent; 438 BUG_ON(nd->inode != parent->d_inode); 439 } else { 440 if (dentry->d_parent != parent) 441 goto err_parent; 442 spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); 443 if (!__d_rcu_to_refcount(dentry, nd->seq)) 444 goto err_child; 445 /* 446 * If the sequence check on the child dentry passed, then 447 * the child has not been removed from its parent. This 448 * means the parent dentry must be valid and able to take 449 * a reference at this point. 450 */ 451 BUG_ON(!IS_ROOT(dentry) && dentry->d_parent != parent); 452 BUG_ON(!parent->d_count); 453 parent->d_count++; 454 spin_unlock(&dentry->d_lock); 455 } 456 spin_unlock(&parent->d_lock); 457 if (want_root) { 458 path_get(&nd->root); 459 spin_unlock(&fs->lock); 460 } 461 mntget(nd->path.mnt); 462 463 rcu_read_unlock(); 464 br_read_unlock(vfsmount_lock); 465 nd->flags &= ~LOOKUP_RCU; 466 return 0; 467 468 err_child: 469 spin_unlock(&dentry->d_lock); 470 err_parent: 471 spin_unlock(&parent->d_lock); 472 err_root: 473 if (want_root) 474 spin_unlock(&fs->lock); 475 return -ECHILD; 476 } 477 478 /** 479 * release_open_intent - free up open intent resources 480 * @nd: pointer to nameidata 481 */ 482 void release_open_intent(struct nameidata *nd) 483 { 484 struct file *file = nd->intent.open.file; 485 486 if (file && !IS_ERR(file)) { 487 if (file->f_path.dentry == NULL) 488 put_filp(file); 489 else 490 fput(file); 491 } 492 } 493 494 static inline int d_revalidate(struct dentry *dentry, struct nameidata *nd) 495 { 496 return dentry->d_op->d_revalidate(dentry, nd); 497 } 498 499 /** 500 * complete_walk - successful completion of path walk 501 * @nd: pointer nameidata 502 * 503 * If we had been in RCU mode, drop out of it and legitimize nd->path. 504 * Revalidate the final result, unless we'd already done that during 505 * the path walk or the filesystem doesn't ask for it. Return 0 on 506 * success, -error on failure. In case of failure caller does not 507 * need to drop nd->path. 508 */ 509 static int complete_walk(struct nameidata *nd) 510 { 511 struct dentry *dentry = nd->path.dentry; 512 int status; 513 514 if (nd->flags & LOOKUP_RCU) { 515 nd->flags &= ~LOOKUP_RCU; 516 if (!(nd->flags & LOOKUP_ROOT)) 517 nd->root.mnt = NULL; 518 spin_lock(&dentry->d_lock); 519 if (unlikely(!__d_rcu_to_refcount(dentry, nd->seq))) { 520 spin_unlock(&dentry->d_lock); 521 rcu_read_unlock(); 522 br_read_unlock(vfsmount_lock); 523 return -ECHILD; 524 } 525 BUG_ON(nd->inode != dentry->d_inode); 526 spin_unlock(&dentry->d_lock); 527 mntget(nd->path.mnt); 528 rcu_read_unlock(); 529 br_read_unlock(vfsmount_lock); 530 } 531 532 if (likely(!(nd->flags & LOOKUP_JUMPED))) 533 return 0; 534 535 if (likely(!(dentry->d_flags & DCACHE_OP_REVALIDATE))) 536 return 0; 537 538 if (likely(!(dentry->d_sb->s_type->fs_flags & FS_REVAL_DOT))) 539 return 0; 540 541 /* Note: we do not d_invalidate() */ 542 status = d_revalidate(dentry, nd); 543 if (status > 0) 544 return 0; 545 546 if (!status) 547 status = -ESTALE; 548 549 path_put(&nd->path); 550 return status; 551 } 552 553 static __always_inline void set_root(struct nameidata *nd) 554 { 555 if (!nd->root.mnt) 556 get_fs_root(current->fs, &nd->root); 557 } 558 559 static int link_path_walk(const char *, struct nameidata *); 560 561 static __always_inline void set_root_rcu(struct nameidata *nd) 562 { 563 if (!nd->root.mnt) { 564 struct fs_struct *fs = current->fs; 565 unsigned seq; 566 567 do { 568 seq = read_seqcount_begin(&fs->seq); 569 nd->root = fs->root; 570 nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq); 571 } while (read_seqcount_retry(&fs->seq, seq)); 572 } 573 } 574 575 static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link) 576 { 577 int ret; 578 579 if (IS_ERR(link)) 580 goto fail; 581 582 if (*link == '/') { 583 set_root(nd); 584 path_put(&nd->path); 585 nd->path = nd->root; 586 path_get(&nd->root); 587 nd->flags |= LOOKUP_JUMPED; 588 } 589 nd->inode = nd->path.dentry->d_inode; 590 591 ret = link_path_walk(link, nd); 592 return ret; 593 fail: 594 path_put(&nd->path); 595 return PTR_ERR(link); 596 } 597 598 static void path_put_conditional(struct path *path, struct nameidata *nd) 599 { 600 dput(path->dentry); 601 if (path->mnt != nd->path.mnt) 602 mntput(path->mnt); 603 } 604 605 static inline void path_to_nameidata(const struct path *path, 606 struct nameidata *nd) 607 { 608 if (!(nd->flags & LOOKUP_RCU)) { 609 dput(nd->path.dentry); 610 if (nd->path.mnt != path->mnt) 611 mntput(nd->path.mnt); 612 } 613 nd->path.mnt = path->mnt; 614 nd->path.dentry = path->dentry; 615 } 616 617 static inline void put_link(struct nameidata *nd, struct path *link, void *cookie) 618 { 619 struct inode *inode = link->dentry->d_inode; 620 if (!IS_ERR(cookie) && inode->i_op->put_link) 621 inode->i_op->put_link(link->dentry, nd, cookie); 622 path_put(link); 623 } 624 625 static __always_inline int 626 follow_link(struct path *link, struct nameidata *nd, void **p) 627 { 628 int error; 629 struct dentry *dentry = link->dentry; 630 631 BUG_ON(nd->flags & LOOKUP_RCU); 632 633 if (link->mnt == nd->path.mnt) 634 mntget(link->mnt); 635 636 if (unlikely(current->total_link_count >= 40)) { 637 *p = ERR_PTR(-ELOOP); /* no ->put_link(), please */ 638 path_put(&nd->path); 639 return -ELOOP; 640 } 641 cond_resched(); 642 current->total_link_count++; 643 644 touch_atime(link->mnt, dentry); 645 nd_set_link(nd, NULL); 646 647 error = security_inode_follow_link(link->dentry, nd); 648 if (error) { 649 *p = ERR_PTR(error); /* no ->put_link(), please */ 650 path_put(&nd->path); 651 return error; 652 } 653 654 nd->last_type = LAST_BIND; 655 *p = dentry->d_inode->i_op->follow_link(dentry, nd); 656 error = PTR_ERR(*p); 657 if (!IS_ERR(*p)) { 658 char *s = nd_get_link(nd); 659 error = 0; 660 if (s) 661 error = __vfs_follow_link(nd, s); 662 else if (nd->last_type == LAST_BIND) { 663 nd->flags |= LOOKUP_JUMPED; 664 nd->inode = nd->path.dentry->d_inode; 665 if (nd->inode->i_op->follow_link) { 666 /* stepped on a _really_ weird one */ 667 path_put(&nd->path); 668 error = -ELOOP; 669 } 670 } 671 } 672 return error; 673 } 674 675 static int follow_up_rcu(struct path *path) 676 { 677 struct vfsmount *parent; 678 struct dentry *mountpoint; 679 680 parent = path->mnt->mnt_parent; 681 if (parent == path->mnt) 682 return 0; 683 mountpoint = path->mnt->mnt_mountpoint; 684 path->dentry = mountpoint; 685 path->mnt = parent; 686 return 1; 687 } 688 689 int follow_up(struct path *path) 690 { 691 struct vfsmount *parent; 692 struct dentry *mountpoint; 693 694 br_read_lock(vfsmount_lock); 695 parent = path->mnt->mnt_parent; 696 if (parent == path->mnt) { 697 br_read_unlock(vfsmount_lock); 698 return 0; 699 } 700 mntget(parent); 701 mountpoint = dget(path->mnt->mnt_mountpoint); 702 br_read_unlock(vfsmount_lock); 703 dput(path->dentry); 704 path->dentry = mountpoint; 705 mntput(path->mnt); 706 path->mnt = parent; 707 return 1; 708 } 709 710 /* 711 * Perform an automount 712 * - return -EISDIR to tell follow_managed() to stop and return the path we 713 * were called with. 714 */ 715 static int follow_automount(struct path *path, unsigned flags, 716 bool *need_mntput) 717 { 718 struct vfsmount *mnt; 719 int err; 720 721 if (!path->dentry->d_op || !path->dentry->d_op->d_automount) 722 return -EREMOTE; 723 724 /* We don't want to mount if someone supplied AT_NO_AUTOMOUNT 725 * and this is the terminal part of the path. 726 */ 727 if ((flags & LOOKUP_NO_AUTOMOUNT) && !(flags & LOOKUP_PARENT)) 728 return -EISDIR; /* we actually want to stop here */ 729 730 /* We don't want to mount if someone's just doing a stat - 731 * unless they're stat'ing a directory and appended a '/' to 732 * the name. 733 * 734 * We do, however, want to mount if someone wants to open or 735 * create a file of any type under the mountpoint, wants to 736 * traverse through the mountpoint or wants to open the 737 * mounted directory. Also, autofs may mark negative dentries 738 * as being automount points. These will need the attentions 739 * of the daemon to instantiate them before they can be used. 740 */ 741 if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | 742 LOOKUP_OPEN | LOOKUP_CREATE)) && 743 path->dentry->d_inode) 744 return -EISDIR; 745 746 current->total_link_count++; 747 if (current->total_link_count >= 40) 748 return -ELOOP; 749 750 mnt = path->dentry->d_op->d_automount(path); 751 if (IS_ERR(mnt)) { 752 /* 753 * The filesystem is allowed to return -EISDIR here to indicate 754 * it doesn't want to automount. For instance, autofs would do 755 * this so that its userspace daemon can mount on this dentry. 756 * 757 * However, we can only permit this if it's a terminal point in 758 * the path being looked up; if it wasn't then the remainder of 759 * the path is inaccessible and we should say so. 760 */ 761 if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT)) 762 return -EREMOTE; 763 return PTR_ERR(mnt); 764 } 765 766 if (!mnt) /* mount collision */ 767 return 0; 768 769 if (!*need_mntput) { 770 /* lock_mount() may release path->mnt on error */ 771 mntget(path->mnt); 772 *need_mntput = true; 773 } 774 err = finish_automount(mnt, path); 775 776 switch (err) { 777 case -EBUSY: 778 /* Someone else made a mount here whilst we were busy */ 779 return 0; 780 case 0: 781 path_put(path); 782 path->mnt = mnt; 783 path->dentry = dget(mnt->mnt_root); 784 return 0; 785 default: 786 return err; 787 } 788 789 } 790 791 /* 792 * Handle a dentry that is managed in some way. 793 * - Flagged for transit management (autofs) 794 * - Flagged as mountpoint 795 * - Flagged as automount point 796 * 797 * This may only be called in refwalk mode. 798 * 799 * Serialization is taken care of in namespace.c 800 */ 801 static int follow_managed(struct path *path, unsigned flags) 802 { 803 struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */ 804 unsigned managed; 805 bool need_mntput = false; 806 int ret = 0; 807 808 /* Given that we're not holding a lock here, we retain the value in a 809 * local variable for each dentry as we look at it so that we don't see 810 * the components of that value change under us */ 811 while (managed = ACCESS_ONCE(path->dentry->d_flags), 812 managed &= DCACHE_MANAGED_DENTRY, 813 unlikely(managed != 0)) { 814 /* Allow the filesystem to manage the transit without i_mutex 815 * being held. */ 816 if (managed & DCACHE_MANAGE_TRANSIT) { 817 BUG_ON(!path->dentry->d_op); 818 BUG_ON(!path->dentry->d_op->d_manage); 819 ret = path->dentry->d_op->d_manage(path->dentry, false); 820 if (ret < 0) 821 break; 822 } 823 824 /* Transit to a mounted filesystem. */ 825 if (managed & DCACHE_MOUNTED) { 826 struct vfsmount *mounted = lookup_mnt(path); 827 if (mounted) { 828 dput(path->dentry); 829 if (need_mntput) 830 mntput(path->mnt); 831 path->mnt = mounted; 832 path->dentry = dget(mounted->mnt_root); 833 need_mntput = true; 834 continue; 835 } 836 837 /* Something is mounted on this dentry in another 838 * namespace and/or whatever was mounted there in this 839 * namespace got unmounted before we managed to get the 840 * vfsmount_lock */ 841 } 842 843 /* Handle an automount point */ 844 if (managed & DCACHE_NEED_AUTOMOUNT) { 845 ret = follow_automount(path, flags, &need_mntput); 846 if (ret < 0) 847 break; 848 continue; 849 } 850 851 /* We didn't change the current path point */ 852 break; 853 } 854 855 if (need_mntput && path->mnt == mnt) 856 mntput(path->mnt); 857 if (ret == -EISDIR) 858 ret = 0; 859 return ret; 860 } 861 862 int follow_down_one(struct path *path) 863 { 864 struct vfsmount *mounted; 865 866 mounted = lookup_mnt(path); 867 if (mounted) { 868 dput(path->dentry); 869 mntput(path->mnt); 870 path->mnt = mounted; 871 path->dentry = dget(mounted->mnt_root); 872 return 1; 873 } 874 return 0; 875 } 876 877 static inline bool managed_dentry_might_block(struct dentry *dentry) 878 { 879 return (dentry->d_flags & DCACHE_MANAGE_TRANSIT && 880 dentry->d_op->d_manage(dentry, true) < 0); 881 } 882 883 /* 884 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if 885 * we meet a managed dentry that would need blocking. 886 */ 887 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, 888 struct inode **inode) 889 { 890 for (;;) { 891 struct vfsmount *mounted; 892 /* 893 * Don't forget we might have a non-mountpoint managed dentry 894 * that wants to block transit. 895 */ 896 if (unlikely(managed_dentry_might_block(path->dentry))) 897 return false; 898 899 if (!d_mountpoint(path->dentry)) 900 break; 901 902 mounted = __lookup_mnt(path->mnt, path->dentry, 1); 903 if (!mounted) 904 break; 905 path->mnt = mounted; 906 path->dentry = mounted->mnt_root; 907 nd->seq = read_seqcount_begin(&path->dentry->d_seq); 908 /* 909 * Update the inode too. We don't need to re-check the 910 * dentry sequence number here after this d_inode read, 911 * because a mount-point is always pinned. 912 */ 913 *inode = path->dentry->d_inode; 914 } 915 return true; 916 } 917 918 static void follow_mount_rcu(struct nameidata *nd) 919 { 920 while (d_mountpoint(nd->path.dentry)) { 921 struct vfsmount *mounted; 922 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry, 1); 923 if (!mounted) 924 break; 925 nd->path.mnt = mounted; 926 nd->path.dentry = mounted->mnt_root; 927 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 928 } 929 } 930 931 static int follow_dotdot_rcu(struct nameidata *nd) 932 { 933 set_root_rcu(nd); 934 935 while (1) { 936 if (nd->path.dentry == nd->root.dentry && 937 nd->path.mnt == nd->root.mnt) { 938 break; 939 } 940 if (nd->path.dentry != nd->path.mnt->mnt_root) { 941 struct dentry *old = nd->path.dentry; 942 struct dentry *parent = old->d_parent; 943 unsigned seq; 944 945 seq = read_seqcount_begin(&parent->d_seq); 946 if (read_seqcount_retry(&old->d_seq, nd->seq)) 947 goto failed; 948 nd->path.dentry = parent; 949 nd->seq = seq; 950 break; 951 } 952 if (!follow_up_rcu(&nd->path)) 953 break; 954 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 955 } 956 follow_mount_rcu(nd); 957 nd->inode = nd->path.dentry->d_inode; 958 return 0; 959 960 failed: 961 nd->flags &= ~LOOKUP_RCU; 962 if (!(nd->flags & LOOKUP_ROOT)) 963 nd->root.mnt = NULL; 964 rcu_read_unlock(); 965 br_read_unlock(vfsmount_lock); 966 return -ECHILD; 967 } 968 969 /* 970 * Follow down to the covering mount currently visible to userspace. At each 971 * point, the filesystem owning that dentry may be queried as to whether the 972 * caller is permitted to proceed or not. 973 */ 974 int follow_down(struct path *path) 975 { 976 unsigned managed; 977 int ret; 978 979 while (managed = ACCESS_ONCE(path->dentry->d_flags), 980 unlikely(managed & DCACHE_MANAGED_DENTRY)) { 981 /* Allow the filesystem to manage the transit without i_mutex 982 * being held. 983 * 984 * We indicate to the filesystem if someone is trying to mount 985 * something here. This gives autofs the chance to deny anyone 986 * other than its daemon the right to mount on its 987 * superstructure. 988 * 989 * The filesystem may sleep at this point. 990 */ 991 if (managed & DCACHE_MANAGE_TRANSIT) { 992 BUG_ON(!path->dentry->d_op); 993 BUG_ON(!path->dentry->d_op->d_manage); 994 ret = path->dentry->d_op->d_manage( 995 path->dentry, false); 996 if (ret < 0) 997 return ret == -EISDIR ? 0 : ret; 998 } 999 1000 /* Transit to a mounted filesystem. */ 1001 if (managed & DCACHE_MOUNTED) { 1002 struct vfsmount *mounted = lookup_mnt(path); 1003 if (!mounted) 1004 break; 1005 dput(path->dentry); 1006 mntput(path->mnt); 1007 path->mnt = mounted; 1008 path->dentry = dget(mounted->mnt_root); 1009 continue; 1010 } 1011 1012 /* Don't handle automount points here */ 1013 break; 1014 } 1015 return 0; 1016 } 1017 1018 /* 1019 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot() 1020 */ 1021 static void follow_mount(struct path *path) 1022 { 1023 while (d_mountpoint(path->dentry)) { 1024 struct vfsmount *mounted = lookup_mnt(path); 1025 if (!mounted) 1026 break; 1027 dput(path->dentry); 1028 mntput(path->mnt); 1029 path->mnt = mounted; 1030 path->dentry = dget(mounted->mnt_root); 1031 } 1032 } 1033 1034 static void follow_dotdot(struct nameidata *nd) 1035 { 1036 set_root(nd); 1037 1038 while(1) { 1039 struct dentry *old = nd->path.dentry; 1040 1041 if (nd->path.dentry == nd->root.dentry && 1042 nd->path.mnt == nd->root.mnt) { 1043 break; 1044 } 1045 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1046 /* rare case of legitimate dget_parent()... */ 1047 nd->path.dentry = dget_parent(nd->path.dentry); 1048 dput(old); 1049 break; 1050 } 1051 if (!follow_up(&nd->path)) 1052 break; 1053 } 1054 follow_mount(&nd->path); 1055 nd->inode = nd->path.dentry->d_inode; 1056 } 1057 1058 /* 1059 * Allocate a dentry with name and parent, and perform a parent 1060 * directory ->lookup on it. Returns the new dentry, or ERR_PTR 1061 * on error. parent->d_inode->i_mutex must be held. d_lookup must 1062 * have verified that no child exists while under i_mutex. 1063 */ 1064 static struct dentry *d_alloc_and_lookup(struct dentry *parent, 1065 struct qstr *name, struct nameidata *nd) 1066 { 1067 struct inode *inode = parent->d_inode; 1068 struct dentry *dentry; 1069 struct dentry *old; 1070 1071 /* Don't create child dentry for a dead directory. */ 1072 if (unlikely(IS_DEADDIR(inode))) 1073 return ERR_PTR(-ENOENT); 1074 1075 dentry = d_alloc(parent, name); 1076 if (unlikely(!dentry)) 1077 return ERR_PTR(-ENOMEM); 1078 1079 old = inode->i_op->lookup(inode, dentry, nd); 1080 if (unlikely(old)) { 1081 dput(dentry); 1082 dentry = old; 1083 } 1084 return dentry; 1085 } 1086 1087 /* 1088 * We already have a dentry, but require a lookup to be performed on the parent 1089 * directory to fill in d_inode. Returns the new dentry, or ERR_PTR on error. 1090 * parent->d_inode->i_mutex must be held. d_lookup must have verified that no 1091 * child exists while under i_mutex. 1092 */ 1093 static struct dentry *d_inode_lookup(struct dentry *parent, struct dentry *dentry, 1094 struct nameidata *nd) 1095 { 1096 struct inode *inode = parent->d_inode; 1097 struct dentry *old; 1098 1099 /* Don't create child dentry for a dead directory. */ 1100 if (unlikely(IS_DEADDIR(inode))) 1101 return ERR_PTR(-ENOENT); 1102 1103 old = inode->i_op->lookup(inode, dentry, nd); 1104 if (unlikely(old)) { 1105 dput(dentry); 1106 dentry = old; 1107 } 1108 return dentry; 1109 } 1110 1111 /* 1112 * It's more convoluted than I'd like it to be, but... it's still fairly 1113 * small and for now I'd prefer to have fast path as straight as possible. 1114 * It _is_ time-critical. 1115 */ 1116 static int do_lookup(struct nameidata *nd, struct qstr *name, 1117 struct path *path, struct inode **inode) 1118 { 1119 struct vfsmount *mnt = nd->path.mnt; 1120 struct dentry *dentry, *parent = nd->path.dentry; 1121 int need_reval = 1; 1122 int status = 1; 1123 int err; 1124 1125 /* 1126 * Rename seqlock is not required here because in the off chance 1127 * of a false negative due to a concurrent rename, we're going to 1128 * do the non-racy lookup, below. 1129 */ 1130 if (nd->flags & LOOKUP_RCU) { 1131 unsigned seq; 1132 *inode = nd->inode; 1133 dentry = __d_lookup_rcu(parent, name, &seq, inode); 1134 if (!dentry) 1135 goto unlazy; 1136 1137 /* Memory barrier in read_seqcount_begin of child is enough */ 1138 if (__read_seqcount_retry(&parent->d_seq, nd->seq)) 1139 return -ECHILD; 1140 nd->seq = seq; 1141 1142 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) { 1143 status = d_revalidate(dentry, nd); 1144 if (unlikely(status <= 0)) { 1145 if (status != -ECHILD) 1146 need_reval = 0; 1147 goto unlazy; 1148 } 1149 } 1150 if (unlikely(d_need_lookup(dentry))) 1151 goto unlazy; 1152 path->mnt = mnt; 1153 path->dentry = dentry; 1154 if (unlikely(!__follow_mount_rcu(nd, path, inode))) 1155 goto unlazy; 1156 if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT)) 1157 goto unlazy; 1158 return 0; 1159 unlazy: 1160 if (unlazy_walk(nd, dentry)) 1161 return -ECHILD; 1162 } else { 1163 dentry = __d_lookup(parent, name); 1164 } 1165 1166 if (dentry && unlikely(d_need_lookup(dentry))) { 1167 dput(dentry); 1168 dentry = NULL; 1169 } 1170 retry: 1171 if (unlikely(!dentry)) { 1172 struct inode *dir = parent->d_inode; 1173 BUG_ON(nd->inode != dir); 1174 1175 mutex_lock(&dir->i_mutex); 1176 dentry = d_lookup(parent, name); 1177 if (likely(!dentry)) { 1178 dentry = d_alloc_and_lookup(parent, name, nd); 1179 if (IS_ERR(dentry)) { 1180 mutex_unlock(&dir->i_mutex); 1181 return PTR_ERR(dentry); 1182 } 1183 /* known good */ 1184 need_reval = 0; 1185 status = 1; 1186 } else if (unlikely(d_need_lookup(dentry))) { 1187 dentry = d_inode_lookup(parent, dentry, nd); 1188 if (IS_ERR(dentry)) { 1189 mutex_unlock(&dir->i_mutex); 1190 return PTR_ERR(dentry); 1191 } 1192 /* known good */ 1193 need_reval = 0; 1194 status = 1; 1195 } 1196 mutex_unlock(&dir->i_mutex); 1197 } 1198 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval) 1199 status = d_revalidate(dentry, nd); 1200 if (unlikely(status <= 0)) { 1201 if (status < 0) { 1202 dput(dentry); 1203 return status; 1204 } 1205 if (!d_invalidate(dentry)) { 1206 dput(dentry); 1207 dentry = NULL; 1208 need_reval = 1; 1209 goto retry; 1210 } 1211 } 1212 1213 path->mnt = mnt; 1214 path->dentry = dentry; 1215 err = follow_managed(path, nd->flags); 1216 if (unlikely(err < 0)) { 1217 path_put_conditional(path, nd); 1218 return err; 1219 } 1220 *inode = path->dentry->d_inode; 1221 return 0; 1222 } 1223 1224 static inline int may_lookup(struct nameidata *nd) 1225 { 1226 if (nd->flags & LOOKUP_RCU) { 1227 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK); 1228 if (err != -ECHILD) 1229 return err; 1230 if (unlazy_walk(nd, NULL)) 1231 return -ECHILD; 1232 } 1233 return inode_permission(nd->inode, MAY_EXEC); 1234 } 1235 1236 static inline int handle_dots(struct nameidata *nd, int type) 1237 { 1238 if (type == LAST_DOTDOT) { 1239 if (nd->flags & LOOKUP_RCU) { 1240 if (follow_dotdot_rcu(nd)) 1241 return -ECHILD; 1242 } else 1243 follow_dotdot(nd); 1244 } 1245 return 0; 1246 } 1247 1248 static void terminate_walk(struct nameidata *nd) 1249 { 1250 if (!(nd->flags & LOOKUP_RCU)) { 1251 path_put(&nd->path); 1252 } else { 1253 nd->flags &= ~LOOKUP_RCU; 1254 if (!(nd->flags & LOOKUP_ROOT)) 1255 nd->root.mnt = NULL; 1256 rcu_read_unlock(); 1257 br_read_unlock(vfsmount_lock); 1258 } 1259 } 1260 1261 /* 1262 * Do we need to follow links? We _really_ want to be able 1263 * to do this check without having to look at inode->i_op, 1264 * so we keep a cache of "no, this doesn't need follow_link" 1265 * for the common case. 1266 */ 1267 static inline int should_follow_link(struct inode *inode, int follow) 1268 { 1269 if (unlikely(!(inode->i_opflags & IOP_NOFOLLOW))) { 1270 if (likely(inode->i_op->follow_link)) 1271 return follow; 1272 1273 /* This gets set once for the inode lifetime */ 1274 spin_lock(&inode->i_lock); 1275 inode->i_opflags |= IOP_NOFOLLOW; 1276 spin_unlock(&inode->i_lock); 1277 } 1278 return 0; 1279 } 1280 1281 static inline int walk_component(struct nameidata *nd, struct path *path, 1282 struct qstr *name, int type, int follow) 1283 { 1284 struct inode *inode; 1285 int err; 1286 /* 1287 * "." and ".." are special - ".." especially so because it has 1288 * to be able to know about the current root directory and 1289 * parent relationships. 1290 */ 1291 if (unlikely(type != LAST_NORM)) 1292 return handle_dots(nd, type); 1293 err = do_lookup(nd, name, path, &inode); 1294 if (unlikely(err)) { 1295 terminate_walk(nd); 1296 return err; 1297 } 1298 if (!inode) { 1299 path_to_nameidata(path, nd); 1300 terminate_walk(nd); 1301 return -ENOENT; 1302 } 1303 if (should_follow_link(inode, follow)) { 1304 if (nd->flags & LOOKUP_RCU) { 1305 if (unlikely(unlazy_walk(nd, path->dentry))) { 1306 terminate_walk(nd); 1307 return -ECHILD; 1308 } 1309 } 1310 BUG_ON(inode != path->dentry->d_inode); 1311 return 1; 1312 } 1313 path_to_nameidata(path, nd); 1314 nd->inode = inode; 1315 return 0; 1316 } 1317 1318 /* 1319 * This limits recursive symlink follows to 8, while 1320 * limiting consecutive symlinks to 40. 1321 * 1322 * Without that kind of total limit, nasty chains of consecutive 1323 * symlinks can cause almost arbitrarily long lookups. 1324 */ 1325 static inline int nested_symlink(struct path *path, struct nameidata *nd) 1326 { 1327 int res; 1328 1329 if (unlikely(current->link_count >= MAX_NESTED_LINKS)) { 1330 path_put_conditional(path, nd); 1331 path_put(&nd->path); 1332 return -ELOOP; 1333 } 1334 BUG_ON(nd->depth >= MAX_NESTED_LINKS); 1335 1336 nd->depth++; 1337 current->link_count++; 1338 1339 do { 1340 struct path link = *path; 1341 void *cookie; 1342 1343 res = follow_link(&link, nd, &cookie); 1344 if (!res) 1345 res = walk_component(nd, path, &nd->last, 1346 nd->last_type, LOOKUP_FOLLOW); 1347 put_link(nd, &link, cookie); 1348 } while (res > 0); 1349 1350 current->link_count--; 1351 nd->depth--; 1352 return res; 1353 } 1354 1355 /* 1356 * We really don't want to look at inode->i_op->lookup 1357 * when we don't have to. So we keep a cache bit in 1358 * the inode ->i_opflags field that says "yes, we can 1359 * do lookup on this inode". 1360 */ 1361 static inline int can_lookup(struct inode *inode) 1362 { 1363 if (likely(inode->i_opflags & IOP_LOOKUP)) 1364 return 1; 1365 if (likely(!inode->i_op->lookup)) 1366 return 0; 1367 1368 /* We do this once for the lifetime of the inode */ 1369 spin_lock(&inode->i_lock); 1370 inode->i_opflags |= IOP_LOOKUP; 1371 spin_unlock(&inode->i_lock); 1372 return 1; 1373 } 1374 1375 /* 1376 * Name resolution. 1377 * This is the basic name resolution function, turning a pathname into 1378 * the final dentry. We expect 'base' to be positive and a directory. 1379 * 1380 * Returns 0 and nd will have valid dentry and mnt on success. 1381 * Returns error and drops reference to input namei data on failure. 1382 */ 1383 static int link_path_walk(const char *name, struct nameidata *nd) 1384 { 1385 struct path next; 1386 int err; 1387 1388 while (*name=='/') 1389 name++; 1390 if (!*name) 1391 return 0; 1392 1393 /* At this point we know we have a real path component. */ 1394 for(;;) { 1395 unsigned long hash; 1396 struct qstr this; 1397 unsigned int c; 1398 int type; 1399 1400 err = may_lookup(nd); 1401 if (err) 1402 break; 1403 1404 this.name = name; 1405 c = *(const unsigned char *)name; 1406 1407 hash = init_name_hash(); 1408 do { 1409 name++; 1410 hash = partial_name_hash(c, hash); 1411 c = *(const unsigned char *)name; 1412 } while (c && (c != '/')); 1413 this.len = name - (const char *) this.name; 1414 this.hash = end_name_hash(hash); 1415 1416 type = LAST_NORM; 1417 if (this.name[0] == '.') switch (this.len) { 1418 case 2: 1419 if (this.name[1] == '.') { 1420 type = LAST_DOTDOT; 1421 nd->flags |= LOOKUP_JUMPED; 1422 } 1423 break; 1424 case 1: 1425 type = LAST_DOT; 1426 } 1427 if (likely(type == LAST_NORM)) { 1428 struct dentry *parent = nd->path.dentry; 1429 nd->flags &= ~LOOKUP_JUMPED; 1430 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { 1431 err = parent->d_op->d_hash(parent, nd->inode, 1432 &this); 1433 if (err < 0) 1434 break; 1435 } 1436 } 1437 1438 /* remove trailing slashes? */ 1439 if (!c) 1440 goto last_component; 1441 while (*++name == '/'); 1442 if (!*name) 1443 goto last_component; 1444 1445 err = walk_component(nd, &next, &this, type, LOOKUP_FOLLOW); 1446 if (err < 0) 1447 return err; 1448 1449 if (err) { 1450 err = nested_symlink(&next, nd); 1451 if (err) 1452 return err; 1453 } 1454 if (can_lookup(nd->inode)) 1455 continue; 1456 err = -ENOTDIR; 1457 break; 1458 /* here ends the main loop */ 1459 1460 last_component: 1461 nd->last = this; 1462 nd->last_type = type; 1463 return 0; 1464 } 1465 terminate_walk(nd); 1466 return err; 1467 } 1468 1469 static int path_init(int dfd, const char *name, unsigned int flags, 1470 struct nameidata *nd, struct file **fp) 1471 { 1472 int retval = 0; 1473 int fput_needed; 1474 struct file *file; 1475 1476 nd->last_type = LAST_ROOT; /* if there are only slashes... */ 1477 nd->flags = flags | LOOKUP_JUMPED; 1478 nd->depth = 0; 1479 if (flags & LOOKUP_ROOT) { 1480 struct inode *inode = nd->root.dentry->d_inode; 1481 if (*name) { 1482 if (!inode->i_op->lookup) 1483 return -ENOTDIR; 1484 retval = inode_permission(inode, MAY_EXEC); 1485 if (retval) 1486 return retval; 1487 } 1488 nd->path = nd->root; 1489 nd->inode = inode; 1490 if (flags & LOOKUP_RCU) { 1491 br_read_lock(vfsmount_lock); 1492 rcu_read_lock(); 1493 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1494 } else { 1495 path_get(&nd->path); 1496 } 1497 return 0; 1498 } 1499 1500 nd->root.mnt = NULL; 1501 1502 if (*name=='/') { 1503 if (flags & LOOKUP_RCU) { 1504 br_read_lock(vfsmount_lock); 1505 rcu_read_lock(); 1506 set_root_rcu(nd); 1507 } else { 1508 set_root(nd); 1509 path_get(&nd->root); 1510 } 1511 nd->path = nd->root; 1512 } else if (dfd == AT_FDCWD) { 1513 if (flags & LOOKUP_RCU) { 1514 struct fs_struct *fs = current->fs; 1515 unsigned seq; 1516 1517 br_read_lock(vfsmount_lock); 1518 rcu_read_lock(); 1519 1520 do { 1521 seq = read_seqcount_begin(&fs->seq); 1522 nd->path = fs->pwd; 1523 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1524 } while (read_seqcount_retry(&fs->seq, seq)); 1525 } else { 1526 get_fs_pwd(current->fs, &nd->path); 1527 } 1528 } else { 1529 struct dentry *dentry; 1530 1531 file = fget_raw_light(dfd, &fput_needed); 1532 retval = -EBADF; 1533 if (!file) 1534 goto out_fail; 1535 1536 dentry = file->f_path.dentry; 1537 1538 if (*name) { 1539 retval = -ENOTDIR; 1540 if (!S_ISDIR(dentry->d_inode->i_mode)) 1541 goto fput_fail; 1542 1543 retval = inode_permission(dentry->d_inode, MAY_EXEC); 1544 if (retval) 1545 goto fput_fail; 1546 } 1547 1548 nd->path = file->f_path; 1549 if (flags & LOOKUP_RCU) { 1550 if (fput_needed) 1551 *fp = file; 1552 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1553 br_read_lock(vfsmount_lock); 1554 rcu_read_lock(); 1555 } else { 1556 path_get(&file->f_path); 1557 fput_light(file, fput_needed); 1558 } 1559 } 1560 1561 nd->inode = nd->path.dentry->d_inode; 1562 return 0; 1563 1564 fput_fail: 1565 fput_light(file, fput_needed); 1566 out_fail: 1567 return retval; 1568 } 1569 1570 static inline int lookup_last(struct nameidata *nd, struct path *path) 1571 { 1572 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len]) 1573 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 1574 1575 nd->flags &= ~LOOKUP_PARENT; 1576 return walk_component(nd, path, &nd->last, nd->last_type, 1577 nd->flags & LOOKUP_FOLLOW); 1578 } 1579 1580 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 1581 static int path_lookupat(int dfd, const char *name, 1582 unsigned int flags, struct nameidata *nd) 1583 { 1584 struct file *base = NULL; 1585 struct path path; 1586 int err; 1587 1588 /* 1589 * Path walking is largely split up into 2 different synchronisation 1590 * schemes, rcu-walk and ref-walk (explained in 1591 * Documentation/filesystems/path-lookup.txt). These share much of the 1592 * path walk code, but some things particularly setup, cleanup, and 1593 * following mounts are sufficiently divergent that functions are 1594 * duplicated. Typically there is a function foo(), and its RCU 1595 * analogue, foo_rcu(). 1596 * 1597 * -ECHILD is the error number of choice (just to avoid clashes) that 1598 * is returned if some aspect of an rcu-walk fails. Such an error must 1599 * be handled by restarting a traditional ref-walk (which will always 1600 * be able to complete). 1601 */ 1602 err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base); 1603 1604 if (unlikely(err)) 1605 return err; 1606 1607 current->total_link_count = 0; 1608 err = link_path_walk(name, nd); 1609 1610 if (!err && !(flags & LOOKUP_PARENT)) { 1611 err = lookup_last(nd, &path); 1612 while (err > 0) { 1613 void *cookie; 1614 struct path link = path; 1615 nd->flags |= LOOKUP_PARENT; 1616 err = follow_link(&link, nd, &cookie); 1617 if (!err) 1618 err = lookup_last(nd, &path); 1619 put_link(nd, &link, cookie); 1620 } 1621 } 1622 1623 if (!err) 1624 err = complete_walk(nd); 1625 1626 if (!err && nd->flags & LOOKUP_DIRECTORY) { 1627 if (!nd->inode->i_op->lookup) { 1628 path_put(&nd->path); 1629 err = -ENOTDIR; 1630 } 1631 } 1632 1633 if (base) 1634 fput(base); 1635 1636 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 1637 path_put(&nd->root); 1638 nd->root.mnt = NULL; 1639 } 1640 return err; 1641 } 1642 1643 static int do_path_lookup(int dfd, const char *name, 1644 unsigned int flags, struct nameidata *nd) 1645 { 1646 int retval = path_lookupat(dfd, name, flags | LOOKUP_RCU, nd); 1647 if (unlikely(retval == -ECHILD)) 1648 retval = path_lookupat(dfd, name, flags, nd); 1649 if (unlikely(retval == -ESTALE)) 1650 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd); 1651 1652 if (likely(!retval)) { 1653 if (unlikely(!audit_dummy_context())) { 1654 if (nd->path.dentry && nd->inode) 1655 audit_inode(name, nd->path.dentry); 1656 } 1657 } 1658 return retval; 1659 } 1660 1661 int kern_path_parent(const char *name, struct nameidata *nd) 1662 { 1663 return do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, nd); 1664 } 1665 1666 int kern_path(const char *name, unsigned int flags, struct path *path) 1667 { 1668 struct nameidata nd; 1669 int res = do_path_lookup(AT_FDCWD, name, flags, &nd); 1670 if (!res) 1671 *path = nd.path; 1672 return res; 1673 } 1674 1675 /** 1676 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair 1677 * @dentry: pointer to dentry of the base directory 1678 * @mnt: pointer to vfs mount of the base directory 1679 * @name: pointer to file name 1680 * @flags: lookup flags 1681 * @path: pointer to struct path to fill 1682 */ 1683 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, 1684 const char *name, unsigned int flags, 1685 struct path *path) 1686 { 1687 struct nameidata nd; 1688 int err; 1689 nd.root.dentry = dentry; 1690 nd.root.mnt = mnt; 1691 BUG_ON(flags & LOOKUP_PARENT); 1692 /* the first argument of do_path_lookup() is ignored with LOOKUP_ROOT */ 1693 err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd); 1694 if (!err) 1695 *path = nd.path; 1696 return err; 1697 } 1698 1699 static struct dentry *__lookup_hash(struct qstr *name, 1700 struct dentry *base, struct nameidata *nd) 1701 { 1702 struct inode *inode = base->d_inode; 1703 struct dentry *dentry; 1704 int err; 1705 1706 err = inode_permission(inode, MAY_EXEC); 1707 if (err) 1708 return ERR_PTR(err); 1709 1710 /* 1711 * Don't bother with __d_lookup: callers are for creat as 1712 * well as unlink, so a lot of the time it would cost 1713 * a double lookup. 1714 */ 1715 dentry = d_lookup(base, name); 1716 1717 if (dentry && d_need_lookup(dentry)) { 1718 /* 1719 * __lookup_hash is called with the parent dir's i_mutex already 1720 * held, so we are good to go here. 1721 */ 1722 dentry = d_inode_lookup(base, dentry, nd); 1723 if (IS_ERR(dentry)) 1724 return dentry; 1725 } 1726 1727 if (dentry && (dentry->d_flags & DCACHE_OP_REVALIDATE)) { 1728 int status = d_revalidate(dentry, nd); 1729 if (unlikely(status <= 0)) { 1730 /* 1731 * The dentry failed validation. 1732 * If d_revalidate returned 0 attempt to invalidate 1733 * the dentry otherwise d_revalidate is asking us 1734 * to return a fail status. 1735 */ 1736 if (status < 0) { 1737 dput(dentry); 1738 return ERR_PTR(status); 1739 } else if (!d_invalidate(dentry)) { 1740 dput(dentry); 1741 dentry = NULL; 1742 } 1743 } 1744 } 1745 1746 if (!dentry) 1747 dentry = d_alloc_and_lookup(base, name, nd); 1748 1749 return dentry; 1750 } 1751 1752 /* 1753 * Restricted form of lookup. Doesn't follow links, single-component only, 1754 * needs parent already locked. Doesn't follow mounts. 1755 * SMP-safe. 1756 */ 1757 static struct dentry *lookup_hash(struct nameidata *nd) 1758 { 1759 return __lookup_hash(&nd->last, nd->path.dentry, nd); 1760 } 1761 1762 /** 1763 * lookup_one_len - filesystem helper to lookup single pathname component 1764 * @name: pathname component to lookup 1765 * @base: base directory to lookup from 1766 * @len: maximum length @len should be interpreted to 1767 * 1768 * Note that this routine is purely a helper for filesystem usage and should 1769 * not be called by generic code. Also note that by using this function the 1770 * nameidata argument is passed to the filesystem methods and a filesystem 1771 * using this helper needs to be prepared for that. 1772 */ 1773 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len) 1774 { 1775 struct qstr this; 1776 unsigned long hash; 1777 unsigned int c; 1778 1779 WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex)); 1780 1781 this.name = name; 1782 this.len = len; 1783 if (!len) 1784 return ERR_PTR(-EACCES); 1785 1786 hash = init_name_hash(); 1787 while (len--) { 1788 c = *(const unsigned char *)name++; 1789 if (c == '/' || c == '\0') 1790 return ERR_PTR(-EACCES); 1791 hash = partial_name_hash(c, hash); 1792 } 1793 this.hash = end_name_hash(hash); 1794 /* 1795 * See if the low-level filesystem might want 1796 * to use its own hash.. 1797 */ 1798 if (base->d_flags & DCACHE_OP_HASH) { 1799 int err = base->d_op->d_hash(base, base->d_inode, &this); 1800 if (err < 0) 1801 return ERR_PTR(err); 1802 } 1803 1804 return __lookup_hash(&this, base, NULL); 1805 } 1806 1807 int user_path_at(int dfd, const char __user *name, unsigned flags, 1808 struct path *path) 1809 { 1810 struct nameidata nd; 1811 char *tmp = getname_flags(name, flags); 1812 int err = PTR_ERR(tmp); 1813 if (!IS_ERR(tmp)) { 1814 1815 BUG_ON(flags & LOOKUP_PARENT); 1816 1817 err = do_path_lookup(dfd, tmp, flags, &nd); 1818 putname(tmp); 1819 if (!err) 1820 *path = nd.path; 1821 } 1822 return err; 1823 } 1824 1825 static int user_path_parent(int dfd, const char __user *path, 1826 struct nameidata *nd, char **name) 1827 { 1828 char *s = getname(path); 1829 int error; 1830 1831 if (IS_ERR(s)) 1832 return PTR_ERR(s); 1833 1834 error = do_path_lookup(dfd, s, LOOKUP_PARENT, nd); 1835 if (error) 1836 putname(s); 1837 else 1838 *name = s; 1839 1840 return error; 1841 } 1842 1843 /* 1844 * It's inline, so penalty for filesystems that don't use sticky bit is 1845 * minimal. 1846 */ 1847 static inline int check_sticky(struct inode *dir, struct inode *inode) 1848 { 1849 uid_t fsuid = current_fsuid(); 1850 1851 if (!(dir->i_mode & S_ISVTX)) 1852 return 0; 1853 if (current_user_ns() != inode_userns(inode)) 1854 goto other_userns; 1855 if (inode->i_uid == fsuid) 1856 return 0; 1857 if (dir->i_uid == fsuid) 1858 return 0; 1859 1860 other_userns: 1861 return !ns_capable(inode_userns(inode), CAP_FOWNER); 1862 } 1863 1864 /* 1865 * Check whether we can remove a link victim from directory dir, check 1866 * whether the type of victim is right. 1867 * 1. We can't do it if dir is read-only (done in permission()) 1868 * 2. We should have write and exec permissions on dir 1869 * 3. We can't remove anything from append-only dir 1870 * 4. We can't do anything with immutable dir (done in permission()) 1871 * 5. If the sticky bit on dir is set we should either 1872 * a. be owner of dir, or 1873 * b. be owner of victim, or 1874 * c. have CAP_FOWNER capability 1875 * 6. If the victim is append-only or immutable we can't do antyhing with 1876 * links pointing to it. 1877 * 7. If we were asked to remove a directory and victim isn't one - ENOTDIR. 1878 * 8. If we were asked to remove a non-directory and victim isn't one - EISDIR. 1879 * 9. We can't remove a root or mountpoint. 1880 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by 1881 * nfs_async_unlink(). 1882 */ 1883 static int may_delete(struct inode *dir,struct dentry *victim,int isdir) 1884 { 1885 int error; 1886 1887 if (!victim->d_inode) 1888 return -ENOENT; 1889 1890 BUG_ON(victim->d_parent->d_inode != dir); 1891 audit_inode_child(victim, dir); 1892 1893 error = inode_permission(dir, MAY_WRITE | MAY_EXEC); 1894 if (error) 1895 return error; 1896 if (IS_APPEND(dir)) 1897 return -EPERM; 1898 if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)|| 1899 IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode)) 1900 return -EPERM; 1901 if (isdir) { 1902 if (!S_ISDIR(victim->d_inode->i_mode)) 1903 return -ENOTDIR; 1904 if (IS_ROOT(victim)) 1905 return -EBUSY; 1906 } else if (S_ISDIR(victim->d_inode->i_mode)) 1907 return -EISDIR; 1908 if (IS_DEADDIR(dir)) 1909 return -ENOENT; 1910 if (victim->d_flags & DCACHE_NFSFS_RENAMED) 1911 return -EBUSY; 1912 return 0; 1913 } 1914 1915 /* Check whether we can create an object with dentry child in directory 1916 * dir. 1917 * 1. We can't do it if child already exists (open has special treatment for 1918 * this case, but since we are inlined it's OK) 1919 * 2. We can't do it if dir is read-only (done in permission()) 1920 * 3. We should have write and exec permissions on dir 1921 * 4. We can't do it if dir is immutable (done in permission()) 1922 */ 1923 static inline int may_create(struct inode *dir, struct dentry *child) 1924 { 1925 if (child->d_inode) 1926 return -EEXIST; 1927 if (IS_DEADDIR(dir)) 1928 return -ENOENT; 1929 return inode_permission(dir, MAY_WRITE | MAY_EXEC); 1930 } 1931 1932 /* 1933 * p1 and p2 should be directories on the same fs. 1934 */ 1935 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) 1936 { 1937 struct dentry *p; 1938 1939 if (p1 == p2) { 1940 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 1941 return NULL; 1942 } 1943 1944 mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 1945 1946 p = d_ancestor(p2, p1); 1947 if (p) { 1948 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT); 1949 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD); 1950 return p; 1951 } 1952 1953 p = d_ancestor(p1, p2); 1954 if (p) { 1955 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 1956 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 1957 return p; 1958 } 1959 1960 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 1961 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 1962 return NULL; 1963 } 1964 1965 void unlock_rename(struct dentry *p1, struct dentry *p2) 1966 { 1967 mutex_unlock(&p1->d_inode->i_mutex); 1968 if (p1 != p2) { 1969 mutex_unlock(&p2->d_inode->i_mutex); 1970 mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 1971 } 1972 } 1973 1974 int vfs_create(struct inode *dir, struct dentry *dentry, int mode, 1975 struct nameidata *nd) 1976 { 1977 int error = may_create(dir, dentry); 1978 1979 if (error) 1980 return error; 1981 1982 if (!dir->i_op->create) 1983 return -EACCES; /* shouldn't it be ENOSYS? */ 1984 mode &= S_IALLUGO; 1985 mode |= S_IFREG; 1986 error = security_inode_create(dir, dentry, mode); 1987 if (error) 1988 return error; 1989 error = dir->i_op->create(dir, dentry, mode, nd); 1990 if (!error) 1991 fsnotify_create(dir, dentry); 1992 return error; 1993 } 1994 1995 static int may_open(struct path *path, int acc_mode, int flag) 1996 { 1997 struct dentry *dentry = path->dentry; 1998 struct inode *inode = dentry->d_inode; 1999 int error; 2000 2001 /* O_PATH? */ 2002 if (!acc_mode) 2003 return 0; 2004 2005 if (!inode) 2006 return -ENOENT; 2007 2008 switch (inode->i_mode & S_IFMT) { 2009 case S_IFLNK: 2010 return -ELOOP; 2011 case S_IFDIR: 2012 if (acc_mode & MAY_WRITE) 2013 return -EISDIR; 2014 break; 2015 case S_IFBLK: 2016 case S_IFCHR: 2017 if (path->mnt->mnt_flags & MNT_NODEV) 2018 return -EACCES; 2019 /*FALLTHRU*/ 2020 case S_IFIFO: 2021 case S_IFSOCK: 2022 flag &= ~O_TRUNC; 2023 break; 2024 } 2025 2026 error = inode_permission(inode, acc_mode); 2027 if (error) 2028 return error; 2029 2030 /* 2031 * An append-only file must be opened in append mode for writing. 2032 */ 2033 if (IS_APPEND(inode)) { 2034 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND)) 2035 return -EPERM; 2036 if (flag & O_TRUNC) 2037 return -EPERM; 2038 } 2039 2040 /* O_NOATIME can only be set by the owner or superuser */ 2041 if (flag & O_NOATIME && !inode_owner_or_capable(inode)) 2042 return -EPERM; 2043 2044 /* 2045 * Ensure there are no outstanding leases on the file. 2046 */ 2047 return break_lease(inode, flag); 2048 } 2049 2050 static int handle_truncate(struct file *filp) 2051 { 2052 struct path *path = &filp->f_path; 2053 struct inode *inode = path->dentry->d_inode; 2054 int error = get_write_access(inode); 2055 if (error) 2056 return error; 2057 /* 2058 * Refuse to truncate files with mandatory locks held on them. 2059 */ 2060 error = locks_verify_locked(inode); 2061 if (!error) 2062 error = security_path_truncate(path); 2063 if (!error) { 2064 error = do_truncate(path->dentry, 0, 2065 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN, 2066 filp); 2067 } 2068 put_write_access(inode); 2069 return error; 2070 } 2071 2072 static inline int open_to_namei_flags(int flag) 2073 { 2074 if ((flag & O_ACCMODE) == 3) 2075 flag--; 2076 return flag; 2077 } 2078 2079 /* 2080 * Handle the last step of open() 2081 */ 2082 static struct file *do_last(struct nameidata *nd, struct path *path, 2083 const struct open_flags *op, const char *pathname) 2084 { 2085 struct dentry *dir = nd->path.dentry; 2086 struct dentry *dentry; 2087 int open_flag = op->open_flag; 2088 int will_truncate = open_flag & O_TRUNC; 2089 int want_write = 0; 2090 int acc_mode = op->acc_mode; 2091 struct file *filp; 2092 int error; 2093 2094 nd->flags &= ~LOOKUP_PARENT; 2095 nd->flags |= op->intent; 2096 2097 switch (nd->last_type) { 2098 case LAST_DOTDOT: 2099 case LAST_DOT: 2100 error = handle_dots(nd, nd->last_type); 2101 if (error) 2102 return ERR_PTR(error); 2103 /* fallthrough */ 2104 case LAST_ROOT: 2105 error = complete_walk(nd); 2106 if (error) 2107 return ERR_PTR(error); 2108 audit_inode(pathname, nd->path.dentry); 2109 if (open_flag & O_CREAT) { 2110 error = -EISDIR; 2111 goto exit; 2112 } 2113 goto ok; 2114 case LAST_BIND: 2115 error = complete_walk(nd); 2116 if (error) 2117 return ERR_PTR(error); 2118 audit_inode(pathname, dir); 2119 goto ok; 2120 } 2121 2122 if (!(open_flag & O_CREAT)) { 2123 int symlink_ok = 0; 2124 if (nd->last.name[nd->last.len]) 2125 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 2126 if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW)) 2127 symlink_ok = 1; 2128 /* we _can_ be in RCU mode here */ 2129 error = walk_component(nd, path, &nd->last, LAST_NORM, 2130 !symlink_ok); 2131 if (error < 0) 2132 return ERR_PTR(error); 2133 if (error) /* symlink */ 2134 return NULL; 2135 /* sayonara */ 2136 error = complete_walk(nd); 2137 if (error) 2138 return ERR_PTR(-ECHILD); 2139 2140 error = -ENOTDIR; 2141 if (nd->flags & LOOKUP_DIRECTORY) { 2142 if (!nd->inode->i_op->lookup) 2143 goto exit; 2144 } 2145 audit_inode(pathname, nd->path.dentry); 2146 goto ok; 2147 } 2148 2149 /* create side of things */ 2150 error = complete_walk(nd); 2151 if (error) 2152 return ERR_PTR(error); 2153 2154 audit_inode(pathname, dir); 2155 error = -EISDIR; 2156 /* trailing slashes? */ 2157 if (nd->last.name[nd->last.len]) 2158 goto exit; 2159 2160 mutex_lock(&dir->d_inode->i_mutex); 2161 2162 dentry = lookup_hash(nd); 2163 error = PTR_ERR(dentry); 2164 if (IS_ERR(dentry)) { 2165 mutex_unlock(&dir->d_inode->i_mutex); 2166 goto exit; 2167 } 2168 2169 path->dentry = dentry; 2170 path->mnt = nd->path.mnt; 2171 2172 /* Negative dentry, just create the file */ 2173 if (!dentry->d_inode) { 2174 int mode = op->mode; 2175 if (!IS_POSIXACL(dir->d_inode)) 2176 mode &= ~current_umask(); 2177 /* 2178 * This write is needed to ensure that a 2179 * rw->ro transition does not occur between 2180 * the time when the file is created and when 2181 * a permanent write count is taken through 2182 * the 'struct file' in nameidata_to_filp(). 2183 */ 2184 error = mnt_want_write(nd->path.mnt); 2185 if (error) 2186 goto exit_mutex_unlock; 2187 want_write = 1; 2188 /* Don't check for write permission, don't truncate */ 2189 open_flag &= ~O_TRUNC; 2190 will_truncate = 0; 2191 acc_mode = MAY_OPEN; 2192 error = security_path_mknod(&nd->path, dentry, mode, 0); 2193 if (error) 2194 goto exit_mutex_unlock; 2195 error = vfs_create(dir->d_inode, dentry, mode, nd); 2196 if (error) 2197 goto exit_mutex_unlock; 2198 mutex_unlock(&dir->d_inode->i_mutex); 2199 dput(nd->path.dentry); 2200 nd->path.dentry = dentry; 2201 goto common; 2202 } 2203 2204 /* 2205 * It already exists. 2206 */ 2207 mutex_unlock(&dir->d_inode->i_mutex); 2208 audit_inode(pathname, path->dentry); 2209 2210 error = -EEXIST; 2211 if (open_flag & O_EXCL) 2212 goto exit_dput; 2213 2214 error = follow_managed(path, nd->flags); 2215 if (error < 0) 2216 goto exit_dput; 2217 2218 error = -ENOENT; 2219 if (!path->dentry->d_inode) 2220 goto exit_dput; 2221 2222 if (path->dentry->d_inode->i_op->follow_link) 2223 return NULL; 2224 2225 path_to_nameidata(path, nd); 2226 nd->inode = path->dentry->d_inode; 2227 error = -EISDIR; 2228 if (S_ISDIR(nd->inode->i_mode)) 2229 goto exit; 2230 ok: 2231 if (!S_ISREG(nd->inode->i_mode)) 2232 will_truncate = 0; 2233 2234 if (will_truncate) { 2235 error = mnt_want_write(nd->path.mnt); 2236 if (error) 2237 goto exit; 2238 want_write = 1; 2239 } 2240 common: 2241 error = may_open(&nd->path, acc_mode, open_flag); 2242 if (error) 2243 goto exit; 2244 filp = nameidata_to_filp(nd); 2245 if (!IS_ERR(filp)) { 2246 error = ima_file_check(filp, op->acc_mode); 2247 if (error) { 2248 fput(filp); 2249 filp = ERR_PTR(error); 2250 } 2251 } 2252 if (!IS_ERR(filp)) { 2253 if (will_truncate) { 2254 error = handle_truncate(filp); 2255 if (error) { 2256 fput(filp); 2257 filp = ERR_PTR(error); 2258 } 2259 } 2260 } 2261 out: 2262 if (want_write) 2263 mnt_drop_write(nd->path.mnt); 2264 path_put(&nd->path); 2265 return filp; 2266 2267 exit_mutex_unlock: 2268 mutex_unlock(&dir->d_inode->i_mutex); 2269 exit_dput: 2270 path_put_conditional(path, nd); 2271 exit: 2272 filp = ERR_PTR(error); 2273 goto out; 2274 } 2275 2276 static struct file *path_openat(int dfd, const char *pathname, 2277 struct nameidata *nd, const struct open_flags *op, int flags) 2278 { 2279 struct file *base = NULL; 2280 struct file *filp; 2281 struct path path; 2282 int error; 2283 2284 filp = get_empty_filp(); 2285 if (!filp) 2286 return ERR_PTR(-ENFILE); 2287 2288 filp->f_flags = op->open_flag; 2289 nd->intent.open.file = filp; 2290 nd->intent.open.flags = open_to_namei_flags(op->open_flag); 2291 nd->intent.open.create_mode = op->mode; 2292 2293 error = path_init(dfd, pathname, flags | LOOKUP_PARENT, nd, &base); 2294 if (unlikely(error)) 2295 goto out_filp; 2296 2297 current->total_link_count = 0; 2298 error = link_path_walk(pathname, nd); 2299 if (unlikely(error)) 2300 goto out_filp; 2301 2302 filp = do_last(nd, &path, op, pathname); 2303 while (unlikely(!filp)) { /* trailing symlink */ 2304 struct path link = path; 2305 void *cookie; 2306 if (!(nd->flags & LOOKUP_FOLLOW)) { 2307 path_put_conditional(&path, nd); 2308 path_put(&nd->path); 2309 filp = ERR_PTR(-ELOOP); 2310 break; 2311 } 2312 nd->flags |= LOOKUP_PARENT; 2313 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL); 2314 error = follow_link(&link, nd, &cookie); 2315 if (unlikely(error)) 2316 filp = ERR_PTR(error); 2317 else 2318 filp = do_last(nd, &path, op, pathname); 2319 put_link(nd, &link, cookie); 2320 } 2321 out: 2322 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) 2323 path_put(&nd->root); 2324 if (base) 2325 fput(base); 2326 release_open_intent(nd); 2327 return filp; 2328 2329 out_filp: 2330 filp = ERR_PTR(error); 2331 goto out; 2332 } 2333 2334 struct file *do_filp_open(int dfd, const char *pathname, 2335 const struct open_flags *op, int flags) 2336 { 2337 struct nameidata nd; 2338 struct file *filp; 2339 2340 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU); 2341 if (unlikely(filp == ERR_PTR(-ECHILD))) 2342 filp = path_openat(dfd, pathname, &nd, op, flags); 2343 if (unlikely(filp == ERR_PTR(-ESTALE))) 2344 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL); 2345 return filp; 2346 } 2347 2348 struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt, 2349 const char *name, const struct open_flags *op, int flags) 2350 { 2351 struct nameidata nd; 2352 struct file *file; 2353 2354 nd.root.mnt = mnt; 2355 nd.root.dentry = dentry; 2356 2357 flags |= LOOKUP_ROOT; 2358 2359 if (dentry->d_inode->i_op->follow_link && op->intent & LOOKUP_OPEN) 2360 return ERR_PTR(-ELOOP); 2361 2362 file = path_openat(-1, name, &nd, op, flags | LOOKUP_RCU); 2363 if (unlikely(file == ERR_PTR(-ECHILD))) 2364 file = path_openat(-1, name, &nd, op, flags); 2365 if (unlikely(file == ERR_PTR(-ESTALE))) 2366 file = path_openat(-1, name, &nd, op, flags | LOOKUP_REVAL); 2367 return file; 2368 } 2369 2370 struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path, int is_dir) 2371 { 2372 struct dentry *dentry = ERR_PTR(-EEXIST); 2373 struct nameidata nd; 2374 int error = do_path_lookup(dfd, pathname, LOOKUP_PARENT, &nd); 2375 if (error) 2376 return ERR_PTR(error); 2377 2378 /* 2379 * Yucky last component or no last component at all? 2380 * (foo/., foo/.., /////) 2381 */ 2382 if (nd.last_type != LAST_NORM) 2383 goto out; 2384 nd.flags &= ~LOOKUP_PARENT; 2385 nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL; 2386 nd.intent.open.flags = O_EXCL; 2387 2388 /* 2389 * Do the final lookup. 2390 */ 2391 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 2392 dentry = lookup_hash(&nd); 2393 if (IS_ERR(dentry)) 2394 goto fail; 2395 2396 if (dentry->d_inode) 2397 goto eexist; 2398 /* 2399 * Special case - lookup gave negative, but... we had foo/bar/ 2400 * From the vfs_mknod() POV we just have a negative dentry - 2401 * all is fine. Let's be bastards - you had / on the end, you've 2402 * been asking for (non-existent) directory. -ENOENT for you. 2403 */ 2404 if (unlikely(!is_dir && nd.last.name[nd.last.len])) { 2405 dput(dentry); 2406 dentry = ERR_PTR(-ENOENT); 2407 goto fail; 2408 } 2409 *path = nd.path; 2410 return dentry; 2411 eexist: 2412 dput(dentry); 2413 dentry = ERR_PTR(-EEXIST); 2414 fail: 2415 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 2416 out: 2417 path_put(&nd.path); 2418 return dentry; 2419 } 2420 EXPORT_SYMBOL(kern_path_create); 2421 2422 struct dentry *user_path_create(int dfd, const char __user *pathname, struct path *path, int is_dir) 2423 { 2424 char *tmp = getname(pathname); 2425 struct dentry *res; 2426 if (IS_ERR(tmp)) 2427 return ERR_CAST(tmp); 2428 res = kern_path_create(dfd, tmp, path, is_dir); 2429 putname(tmp); 2430 return res; 2431 } 2432 EXPORT_SYMBOL(user_path_create); 2433 2434 int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev) 2435 { 2436 int error = may_create(dir, dentry); 2437 2438 if (error) 2439 return error; 2440 2441 if ((S_ISCHR(mode) || S_ISBLK(mode)) && 2442 !ns_capable(inode_userns(dir), CAP_MKNOD)) 2443 return -EPERM; 2444 2445 if (!dir->i_op->mknod) 2446 return -EPERM; 2447 2448 error = devcgroup_inode_mknod(mode, dev); 2449 if (error) 2450 return error; 2451 2452 error = security_inode_mknod(dir, dentry, mode, dev); 2453 if (error) 2454 return error; 2455 2456 error = dir->i_op->mknod(dir, dentry, mode, dev); 2457 if (!error) 2458 fsnotify_create(dir, dentry); 2459 return error; 2460 } 2461 2462 static int may_mknod(mode_t mode) 2463 { 2464 switch (mode & S_IFMT) { 2465 case S_IFREG: 2466 case S_IFCHR: 2467 case S_IFBLK: 2468 case S_IFIFO: 2469 case S_IFSOCK: 2470 case 0: /* zero mode translates to S_IFREG */ 2471 return 0; 2472 case S_IFDIR: 2473 return -EPERM; 2474 default: 2475 return -EINVAL; 2476 } 2477 } 2478 2479 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode, 2480 unsigned, dev) 2481 { 2482 struct dentry *dentry; 2483 struct path path; 2484 int error; 2485 2486 if (S_ISDIR(mode)) 2487 return -EPERM; 2488 2489 dentry = user_path_create(dfd, filename, &path, 0); 2490 if (IS_ERR(dentry)) 2491 return PTR_ERR(dentry); 2492 2493 if (!IS_POSIXACL(path.dentry->d_inode)) 2494 mode &= ~current_umask(); 2495 error = may_mknod(mode); 2496 if (error) 2497 goto out_dput; 2498 error = mnt_want_write(path.mnt); 2499 if (error) 2500 goto out_dput; 2501 error = security_path_mknod(&path, dentry, mode, dev); 2502 if (error) 2503 goto out_drop_write; 2504 switch (mode & S_IFMT) { 2505 case 0: case S_IFREG: 2506 error = vfs_create(path.dentry->d_inode,dentry,mode,NULL); 2507 break; 2508 case S_IFCHR: case S_IFBLK: 2509 error = vfs_mknod(path.dentry->d_inode,dentry,mode, 2510 new_decode_dev(dev)); 2511 break; 2512 case S_IFIFO: case S_IFSOCK: 2513 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0); 2514 break; 2515 } 2516 out_drop_write: 2517 mnt_drop_write(path.mnt); 2518 out_dput: 2519 dput(dentry); 2520 mutex_unlock(&path.dentry->d_inode->i_mutex); 2521 path_put(&path); 2522 2523 return error; 2524 } 2525 2526 SYSCALL_DEFINE3(mknod, const char __user *, filename, int, mode, unsigned, dev) 2527 { 2528 return sys_mknodat(AT_FDCWD, filename, mode, dev); 2529 } 2530 2531 int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode) 2532 { 2533 int error = may_create(dir, dentry); 2534 2535 if (error) 2536 return error; 2537 2538 if (!dir->i_op->mkdir) 2539 return -EPERM; 2540 2541 mode &= (S_IRWXUGO|S_ISVTX); 2542 error = security_inode_mkdir(dir, dentry, mode); 2543 if (error) 2544 return error; 2545 2546 error = dir->i_op->mkdir(dir, dentry, mode); 2547 if (!error) 2548 fsnotify_mkdir(dir, dentry); 2549 return error; 2550 } 2551 2552 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode) 2553 { 2554 struct dentry *dentry; 2555 struct path path; 2556 int error; 2557 2558 dentry = user_path_create(dfd, pathname, &path, 1); 2559 if (IS_ERR(dentry)) 2560 return PTR_ERR(dentry); 2561 2562 if (!IS_POSIXACL(path.dentry->d_inode)) 2563 mode &= ~current_umask(); 2564 error = mnt_want_write(path.mnt); 2565 if (error) 2566 goto out_dput; 2567 error = security_path_mkdir(&path, dentry, mode); 2568 if (error) 2569 goto out_drop_write; 2570 error = vfs_mkdir(path.dentry->d_inode, dentry, mode); 2571 out_drop_write: 2572 mnt_drop_write(path.mnt); 2573 out_dput: 2574 dput(dentry); 2575 mutex_unlock(&path.dentry->d_inode->i_mutex); 2576 path_put(&path); 2577 return error; 2578 } 2579 2580 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, int, mode) 2581 { 2582 return sys_mkdirat(AT_FDCWD, pathname, mode); 2583 } 2584 2585 /* 2586 * The dentry_unhash() helper will try to drop the dentry early: we 2587 * should have a usage count of 2 if we're the only user of this 2588 * dentry, and if that is true (possibly after pruning the dcache), 2589 * then we drop the dentry now. 2590 * 2591 * A low-level filesystem can, if it choses, legally 2592 * do a 2593 * 2594 * if (!d_unhashed(dentry)) 2595 * return -EBUSY; 2596 * 2597 * if it cannot handle the case of removing a directory 2598 * that is still in use by something else.. 2599 */ 2600 void dentry_unhash(struct dentry *dentry) 2601 { 2602 shrink_dcache_parent(dentry); 2603 spin_lock(&dentry->d_lock); 2604 if (dentry->d_count == 1) 2605 __d_drop(dentry); 2606 spin_unlock(&dentry->d_lock); 2607 } 2608 2609 int vfs_rmdir(struct inode *dir, struct dentry *dentry) 2610 { 2611 int error = may_delete(dir, dentry, 1); 2612 2613 if (error) 2614 return error; 2615 2616 if (!dir->i_op->rmdir) 2617 return -EPERM; 2618 2619 dget(dentry); 2620 mutex_lock(&dentry->d_inode->i_mutex); 2621 2622 error = -EBUSY; 2623 if (d_mountpoint(dentry)) 2624 goto out; 2625 2626 error = security_inode_rmdir(dir, dentry); 2627 if (error) 2628 goto out; 2629 2630 shrink_dcache_parent(dentry); 2631 error = dir->i_op->rmdir(dir, dentry); 2632 if (error) 2633 goto out; 2634 2635 dentry->d_inode->i_flags |= S_DEAD; 2636 dont_mount(dentry); 2637 2638 out: 2639 mutex_unlock(&dentry->d_inode->i_mutex); 2640 dput(dentry); 2641 if (!error) 2642 d_delete(dentry); 2643 return error; 2644 } 2645 2646 static long do_rmdir(int dfd, const char __user *pathname) 2647 { 2648 int error = 0; 2649 char * name; 2650 struct dentry *dentry; 2651 struct nameidata nd; 2652 2653 error = user_path_parent(dfd, pathname, &nd, &name); 2654 if (error) 2655 return error; 2656 2657 switch(nd.last_type) { 2658 case LAST_DOTDOT: 2659 error = -ENOTEMPTY; 2660 goto exit1; 2661 case LAST_DOT: 2662 error = -EINVAL; 2663 goto exit1; 2664 case LAST_ROOT: 2665 error = -EBUSY; 2666 goto exit1; 2667 } 2668 2669 nd.flags &= ~LOOKUP_PARENT; 2670 2671 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 2672 dentry = lookup_hash(&nd); 2673 error = PTR_ERR(dentry); 2674 if (IS_ERR(dentry)) 2675 goto exit2; 2676 if (!dentry->d_inode) { 2677 error = -ENOENT; 2678 goto exit3; 2679 } 2680 error = mnt_want_write(nd.path.mnt); 2681 if (error) 2682 goto exit3; 2683 error = security_path_rmdir(&nd.path, dentry); 2684 if (error) 2685 goto exit4; 2686 error = vfs_rmdir(nd.path.dentry->d_inode, dentry); 2687 exit4: 2688 mnt_drop_write(nd.path.mnt); 2689 exit3: 2690 dput(dentry); 2691 exit2: 2692 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 2693 exit1: 2694 path_put(&nd.path); 2695 putname(name); 2696 return error; 2697 } 2698 2699 SYSCALL_DEFINE1(rmdir, const char __user *, pathname) 2700 { 2701 return do_rmdir(AT_FDCWD, pathname); 2702 } 2703 2704 int vfs_unlink(struct inode *dir, struct dentry *dentry) 2705 { 2706 int error = may_delete(dir, dentry, 0); 2707 2708 if (error) 2709 return error; 2710 2711 if (!dir->i_op->unlink) 2712 return -EPERM; 2713 2714 mutex_lock(&dentry->d_inode->i_mutex); 2715 if (d_mountpoint(dentry)) 2716 error = -EBUSY; 2717 else { 2718 error = security_inode_unlink(dir, dentry); 2719 if (!error) { 2720 error = dir->i_op->unlink(dir, dentry); 2721 if (!error) 2722 dont_mount(dentry); 2723 } 2724 } 2725 mutex_unlock(&dentry->d_inode->i_mutex); 2726 2727 /* We don't d_delete() NFS sillyrenamed files--they still exist. */ 2728 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) { 2729 fsnotify_link_count(dentry->d_inode); 2730 d_delete(dentry); 2731 } 2732 2733 return error; 2734 } 2735 2736 /* 2737 * Make sure that the actual truncation of the file will occur outside its 2738 * directory's i_mutex. Truncate can take a long time if there is a lot of 2739 * writeout happening, and we don't want to prevent access to the directory 2740 * while waiting on the I/O. 2741 */ 2742 static long do_unlinkat(int dfd, const char __user *pathname) 2743 { 2744 int error; 2745 char *name; 2746 struct dentry *dentry; 2747 struct nameidata nd; 2748 struct inode *inode = NULL; 2749 2750 error = user_path_parent(dfd, pathname, &nd, &name); 2751 if (error) 2752 return error; 2753 2754 error = -EISDIR; 2755 if (nd.last_type != LAST_NORM) 2756 goto exit1; 2757 2758 nd.flags &= ~LOOKUP_PARENT; 2759 2760 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 2761 dentry = lookup_hash(&nd); 2762 error = PTR_ERR(dentry); 2763 if (!IS_ERR(dentry)) { 2764 /* Why not before? Because we want correct error value */ 2765 if (nd.last.name[nd.last.len]) 2766 goto slashes; 2767 inode = dentry->d_inode; 2768 if (!inode) 2769 goto slashes; 2770 ihold(inode); 2771 error = mnt_want_write(nd.path.mnt); 2772 if (error) 2773 goto exit2; 2774 error = security_path_unlink(&nd.path, dentry); 2775 if (error) 2776 goto exit3; 2777 error = vfs_unlink(nd.path.dentry->d_inode, dentry); 2778 exit3: 2779 mnt_drop_write(nd.path.mnt); 2780 exit2: 2781 dput(dentry); 2782 } 2783 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 2784 if (inode) 2785 iput(inode); /* truncate the inode here */ 2786 exit1: 2787 path_put(&nd.path); 2788 putname(name); 2789 return error; 2790 2791 slashes: 2792 error = !dentry->d_inode ? -ENOENT : 2793 S_ISDIR(dentry->d_inode->i_mode) ? -EISDIR : -ENOTDIR; 2794 goto exit2; 2795 } 2796 2797 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) 2798 { 2799 if ((flag & ~AT_REMOVEDIR) != 0) 2800 return -EINVAL; 2801 2802 if (flag & AT_REMOVEDIR) 2803 return do_rmdir(dfd, pathname); 2804 2805 return do_unlinkat(dfd, pathname); 2806 } 2807 2808 SYSCALL_DEFINE1(unlink, const char __user *, pathname) 2809 { 2810 return do_unlinkat(AT_FDCWD, pathname); 2811 } 2812 2813 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname) 2814 { 2815 int error = may_create(dir, dentry); 2816 2817 if (error) 2818 return error; 2819 2820 if (!dir->i_op->symlink) 2821 return -EPERM; 2822 2823 error = security_inode_symlink(dir, dentry, oldname); 2824 if (error) 2825 return error; 2826 2827 error = dir->i_op->symlink(dir, dentry, oldname); 2828 if (!error) 2829 fsnotify_create(dir, dentry); 2830 return error; 2831 } 2832 2833 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, 2834 int, newdfd, const char __user *, newname) 2835 { 2836 int error; 2837 char *from; 2838 struct dentry *dentry; 2839 struct path path; 2840 2841 from = getname(oldname); 2842 if (IS_ERR(from)) 2843 return PTR_ERR(from); 2844 2845 dentry = user_path_create(newdfd, newname, &path, 0); 2846 error = PTR_ERR(dentry); 2847 if (IS_ERR(dentry)) 2848 goto out_putname; 2849 2850 error = mnt_want_write(path.mnt); 2851 if (error) 2852 goto out_dput; 2853 error = security_path_symlink(&path, dentry, from); 2854 if (error) 2855 goto out_drop_write; 2856 error = vfs_symlink(path.dentry->d_inode, dentry, from); 2857 out_drop_write: 2858 mnt_drop_write(path.mnt); 2859 out_dput: 2860 dput(dentry); 2861 mutex_unlock(&path.dentry->d_inode->i_mutex); 2862 path_put(&path); 2863 out_putname: 2864 putname(from); 2865 return error; 2866 } 2867 2868 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) 2869 { 2870 return sys_symlinkat(oldname, AT_FDCWD, newname); 2871 } 2872 2873 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry) 2874 { 2875 struct inode *inode = old_dentry->d_inode; 2876 int error; 2877 2878 if (!inode) 2879 return -ENOENT; 2880 2881 error = may_create(dir, new_dentry); 2882 if (error) 2883 return error; 2884 2885 if (dir->i_sb != inode->i_sb) 2886 return -EXDEV; 2887 2888 /* 2889 * A link to an append-only or immutable file cannot be created. 2890 */ 2891 if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) 2892 return -EPERM; 2893 if (!dir->i_op->link) 2894 return -EPERM; 2895 if (S_ISDIR(inode->i_mode)) 2896 return -EPERM; 2897 2898 error = security_inode_link(old_dentry, dir, new_dentry); 2899 if (error) 2900 return error; 2901 2902 mutex_lock(&inode->i_mutex); 2903 /* Make sure we don't allow creating hardlink to an unlinked file */ 2904 if (inode->i_nlink == 0) 2905 error = -ENOENT; 2906 else 2907 error = dir->i_op->link(old_dentry, dir, new_dentry); 2908 mutex_unlock(&inode->i_mutex); 2909 if (!error) 2910 fsnotify_link(dir, inode, new_dentry); 2911 return error; 2912 } 2913 2914 /* 2915 * Hardlinks are often used in delicate situations. We avoid 2916 * security-related surprises by not following symlinks on the 2917 * newname. --KAB 2918 * 2919 * We don't follow them on the oldname either to be compatible 2920 * with linux 2.0, and to avoid hard-linking to directories 2921 * and other special files. --ADM 2922 */ 2923 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, 2924 int, newdfd, const char __user *, newname, int, flags) 2925 { 2926 struct dentry *new_dentry; 2927 struct path old_path, new_path; 2928 int how = 0; 2929 int error; 2930 2931 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) 2932 return -EINVAL; 2933 /* 2934 * To use null names we require CAP_DAC_READ_SEARCH 2935 * This ensures that not everyone will be able to create 2936 * handlink using the passed filedescriptor. 2937 */ 2938 if (flags & AT_EMPTY_PATH) { 2939 if (!capable(CAP_DAC_READ_SEARCH)) 2940 return -ENOENT; 2941 how = LOOKUP_EMPTY; 2942 } 2943 2944 if (flags & AT_SYMLINK_FOLLOW) 2945 how |= LOOKUP_FOLLOW; 2946 2947 error = user_path_at(olddfd, oldname, how, &old_path); 2948 if (error) 2949 return error; 2950 2951 new_dentry = user_path_create(newdfd, newname, &new_path, 0); 2952 error = PTR_ERR(new_dentry); 2953 if (IS_ERR(new_dentry)) 2954 goto out; 2955 2956 error = -EXDEV; 2957 if (old_path.mnt != new_path.mnt) 2958 goto out_dput; 2959 error = mnt_want_write(new_path.mnt); 2960 if (error) 2961 goto out_dput; 2962 error = security_path_link(old_path.dentry, &new_path, new_dentry); 2963 if (error) 2964 goto out_drop_write; 2965 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry); 2966 out_drop_write: 2967 mnt_drop_write(new_path.mnt); 2968 out_dput: 2969 dput(new_dentry); 2970 mutex_unlock(&new_path.dentry->d_inode->i_mutex); 2971 path_put(&new_path); 2972 out: 2973 path_put(&old_path); 2974 2975 return error; 2976 } 2977 2978 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) 2979 { 2980 return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 2981 } 2982 2983 /* 2984 * The worst of all namespace operations - renaming directory. "Perverted" 2985 * doesn't even start to describe it. Somebody in UCB had a heck of a trip... 2986 * Problems: 2987 * a) we can get into loop creation. Check is done in is_subdir(). 2988 * b) race potential - two innocent renames can create a loop together. 2989 * That's where 4.4 screws up. Current fix: serialization on 2990 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another 2991 * story. 2992 * c) we have to lock _three_ objects - parents and victim (if it exists). 2993 * And that - after we got ->i_mutex on parents (until then we don't know 2994 * whether the target exists). Solution: try to be smart with locking 2995 * order for inodes. We rely on the fact that tree topology may change 2996 * only under ->s_vfs_rename_mutex _and_ that parent of the object we 2997 * move will be locked. Thus we can rank directories by the tree 2998 * (ancestors first) and rank all non-directories after them. 2999 * That works since everybody except rename does "lock parent, lookup, 3000 * lock child" and rename is under ->s_vfs_rename_mutex. 3001 * HOWEVER, it relies on the assumption that any object with ->lookup() 3002 * has no more than 1 dentry. If "hybrid" objects will ever appear, 3003 * we'd better make sure that there's no link(2) for them. 3004 * d) conversion from fhandle to dentry may come in the wrong moment - when 3005 * we are removing the target. Solution: we will have to grab ->i_mutex 3006 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on 3007 * ->i_mutex on parents, which works but leads to some truly excessive 3008 * locking]. 3009 */ 3010 static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry, 3011 struct inode *new_dir, struct dentry *new_dentry) 3012 { 3013 int error = 0; 3014 struct inode *target = new_dentry->d_inode; 3015 3016 /* 3017 * If we are going to change the parent - check write permissions, 3018 * we'll need to flip '..'. 3019 */ 3020 if (new_dir != old_dir) { 3021 error = inode_permission(old_dentry->d_inode, MAY_WRITE); 3022 if (error) 3023 return error; 3024 } 3025 3026 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry); 3027 if (error) 3028 return error; 3029 3030 dget(new_dentry); 3031 if (target) 3032 mutex_lock(&target->i_mutex); 3033 3034 error = -EBUSY; 3035 if (d_mountpoint(old_dentry) || d_mountpoint(new_dentry)) 3036 goto out; 3037 3038 if (target) 3039 shrink_dcache_parent(new_dentry); 3040 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry); 3041 if (error) 3042 goto out; 3043 3044 if (target) { 3045 target->i_flags |= S_DEAD; 3046 dont_mount(new_dentry); 3047 } 3048 out: 3049 if (target) 3050 mutex_unlock(&target->i_mutex); 3051 dput(new_dentry); 3052 if (!error) 3053 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) 3054 d_move(old_dentry,new_dentry); 3055 return error; 3056 } 3057 3058 static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry, 3059 struct inode *new_dir, struct dentry *new_dentry) 3060 { 3061 struct inode *target = new_dentry->d_inode; 3062 int error; 3063 3064 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry); 3065 if (error) 3066 return error; 3067 3068 dget(new_dentry); 3069 if (target) 3070 mutex_lock(&target->i_mutex); 3071 3072 error = -EBUSY; 3073 if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry)) 3074 goto out; 3075 3076 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry); 3077 if (error) 3078 goto out; 3079 3080 if (target) 3081 dont_mount(new_dentry); 3082 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) 3083 d_move(old_dentry, new_dentry); 3084 out: 3085 if (target) 3086 mutex_unlock(&target->i_mutex); 3087 dput(new_dentry); 3088 return error; 3089 } 3090 3091 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, 3092 struct inode *new_dir, struct dentry *new_dentry) 3093 { 3094 int error; 3095 int is_dir = S_ISDIR(old_dentry->d_inode->i_mode); 3096 const unsigned char *old_name; 3097 3098 if (old_dentry->d_inode == new_dentry->d_inode) 3099 return 0; 3100 3101 error = may_delete(old_dir, old_dentry, is_dir); 3102 if (error) 3103 return error; 3104 3105 if (!new_dentry->d_inode) 3106 error = may_create(new_dir, new_dentry); 3107 else 3108 error = may_delete(new_dir, new_dentry, is_dir); 3109 if (error) 3110 return error; 3111 3112 if (!old_dir->i_op->rename) 3113 return -EPERM; 3114 3115 old_name = fsnotify_oldname_init(old_dentry->d_name.name); 3116 3117 if (is_dir) 3118 error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry); 3119 else 3120 error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry); 3121 if (!error) 3122 fsnotify_move(old_dir, new_dir, old_name, is_dir, 3123 new_dentry->d_inode, old_dentry); 3124 fsnotify_oldname_free(old_name); 3125 3126 return error; 3127 } 3128 3129 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, 3130 int, newdfd, const char __user *, newname) 3131 { 3132 struct dentry *old_dir, *new_dir; 3133 struct dentry *old_dentry, *new_dentry; 3134 struct dentry *trap; 3135 struct nameidata oldnd, newnd; 3136 char *from; 3137 char *to; 3138 int error; 3139 3140 error = user_path_parent(olddfd, oldname, &oldnd, &from); 3141 if (error) 3142 goto exit; 3143 3144 error = user_path_parent(newdfd, newname, &newnd, &to); 3145 if (error) 3146 goto exit1; 3147 3148 error = -EXDEV; 3149 if (oldnd.path.mnt != newnd.path.mnt) 3150 goto exit2; 3151 3152 old_dir = oldnd.path.dentry; 3153 error = -EBUSY; 3154 if (oldnd.last_type != LAST_NORM) 3155 goto exit2; 3156 3157 new_dir = newnd.path.dentry; 3158 if (newnd.last_type != LAST_NORM) 3159 goto exit2; 3160 3161 oldnd.flags &= ~LOOKUP_PARENT; 3162 newnd.flags &= ~LOOKUP_PARENT; 3163 newnd.flags |= LOOKUP_RENAME_TARGET; 3164 3165 trap = lock_rename(new_dir, old_dir); 3166 3167 old_dentry = lookup_hash(&oldnd); 3168 error = PTR_ERR(old_dentry); 3169 if (IS_ERR(old_dentry)) 3170 goto exit3; 3171 /* source must exist */ 3172 error = -ENOENT; 3173 if (!old_dentry->d_inode) 3174 goto exit4; 3175 /* unless the source is a directory trailing slashes give -ENOTDIR */ 3176 if (!S_ISDIR(old_dentry->d_inode->i_mode)) { 3177 error = -ENOTDIR; 3178 if (oldnd.last.name[oldnd.last.len]) 3179 goto exit4; 3180 if (newnd.last.name[newnd.last.len]) 3181 goto exit4; 3182 } 3183 /* source should not be ancestor of target */ 3184 error = -EINVAL; 3185 if (old_dentry == trap) 3186 goto exit4; 3187 new_dentry = lookup_hash(&newnd); 3188 error = PTR_ERR(new_dentry); 3189 if (IS_ERR(new_dentry)) 3190 goto exit4; 3191 /* target should not be an ancestor of source */ 3192 error = -ENOTEMPTY; 3193 if (new_dentry == trap) 3194 goto exit5; 3195 3196 error = mnt_want_write(oldnd.path.mnt); 3197 if (error) 3198 goto exit5; 3199 error = security_path_rename(&oldnd.path, old_dentry, 3200 &newnd.path, new_dentry); 3201 if (error) 3202 goto exit6; 3203 error = vfs_rename(old_dir->d_inode, old_dentry, 3204 new_dir->d_inode, new_dentry); 3205 exit6: 3206 mnt_drop_write(oldnd.path.mnt); 3207 exit5: 3208 dput(new_dentry); 3209 exit4: 3210 dput(old_dentry); 3211 exit3: 3212 unlock_rename(new_dir, old_dir); 3213 exit2: 3214 path_put(&newnd.path); 3215 putname(to); 3216 exit1: 3217 path_put(&oldnd.path); 3218 putname(from); 3219 exit: 3220 return error; 3221 } 3222 3223 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) 3224 { 3225 return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname); 3226 } 3227 3228 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link) 3229 { 3230 int len; 3231 3232 len = PTR_ERR(link); 3233 if (IS_ERR(link)) 3234 goto out; 3235 3236 len = strlen(link); 3237 if (len > (unsigned) buflen) 3238 len = buflen; 3239 if (copy_to_user(buffer, link, len)) 3240 len = -EFAULT; 3241 out: 3242 return len; 3243 } 3244 3245 /* 3246 * A helper for ->readlink(). This should be used *ONLY* for symlinks that 3247 * have ->follow_link() touching nd only in nd_set_link(). Using (or not 3248 * using) it for any given inode is up to filesystem. 3249 */ 3250 int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen) 3251 { 3252 struct nameidata nd; 3253 void *cookie; 3254 int res; 3255 3256 nd.depth = 0; 3257 cookie = dentry->d_inode->i_op->follow_link(dentry, &nd); 3258 if (IS_ERR(cookie)) 3259 return PTR_ERR(cookie); 3260 3261 res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd)); 3262 if (dentry->d_inode->i_op->put_link) 3263 dentry->d_inode->i_op->put_link(dentry, &nd, cookie); 3264 return res; 3265 } 3266 3267 int vfs_follow_link(struct nameidata *nd, const char *link) 3268 { 3269 return __vfs_follow_link(nd, link); 3270 } 3271 3272 /* get the link contents into pagecache */ 3273 static char *page_getlink(struct dentry * dentry, struct page **ppage) 3274 { 3275 char *kaddr; 3276 struct page *page; 3277 struct address_space *mapping = dentry->d_inode->i_mapping; 3278 page = read_mapping_page(mapping, 0, NULL); 3279 if (IS_ERR(page)) 3280 return (char*)page; 3281 *ppage = page; 3282 kaddr = kmap(page); 3283 nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1); 3284 return kaddr; 3285 } 3286 3287 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen) 3288 { 3289 struct page *page = NULL; 3290 char *s = page_getlink(dentry, &page); 3291 int res = vfs_readlink(dentry,buffer,buflen,s); 3292 if (page) { 3293 kunmap(page); 3294 page_cache_release(page); 3295 } 3296 return res; 3297 } 3298 3299 void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd) 3300 { 3301 struct page *page = NULL; 3302 nd_set_link(nd, page_getlink(dentry, &page)); 3303 return page; 3304 } 3305 3306 void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie) 3307 { 3308 struct page *page = cookie; 3309 3310 if (page) { 3311 kunmap(page); 3312 page_cache_release(page); 3313 } 3314 } 3315 3316 /* 3317 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS 3318 */ 3319 int __page_symlink(struct inode *inode, const char *symname, int len, int nofs) 3320 { 3321 struct address_space *mapping = inode->i_mapping; 3322 struct page *page; 3323 void *fsdata; 3324 int err; 3325 char *kaddr; 3326 unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE; 3327 if (nofs) 3328 flags |= AOP_FLAG_NOFS; 3329 3330 retry: 3331 err = pagecache_write_begin(NULL, mapping, 0, len-1, 3332 flags, &page, &fsdata); 3333 if (err) 3334 goto fail; 3335 3336 kaddr = kmap_atomic(page, KM_USER0); 3337 memcpy(kaddr, symname, len-1); 3338 kunmap_atomic(kaddr, KM_USER0); 3339 3340 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1, 3341 page, fsdata); 3342 if (err < 0) 3343 goto fail; 3344 if (err < len-1) 3345 goto retry; 3346 3347 mark_inode_dirty(inode); 3348 return 0; 3349 fail: 3350 return err; 3351 } 3352 3353 int page_symlink(struct inode *inode, const char *symname, int len) 3354 { 3355 return __page_symlink(inode, symname, len, 3356 !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS)); 3357 } 3358 3359 const struct inode_operations page_symlink_inode_operations = { 3360 .readlink = generic_readlink, 3361 .follow_link = page_follow_link_light, 3362 .put_link = page_put_link, 3363 }; 3364 3365 EXPORT_SYMBOL(user_path_at); 3366 EXPORT_SYMBOL(follow_down_one); 3367 EXPORT_SYMBOL(follow_down); 3368 EXPORT_SYMBOL(follow_up); 3369 EXPORT_SYMBOL(get_write_access); /* binfmt_aout */ 3370 EXPORT_SYMBOL(getname); 3371 EXPORT_SYMBOL(lock_rename); 3372 EXPORT_SYMBOL(lookup_one_len); 3373 EXPORT_SYMBOL(page_follow_link_light); 3374 EXPORT_SYMBOL(page_put_link); 3375 EXPORT_SYMBOL(page_readlink); 3376 EXPORT_SYMBOL(__page_symlink); 3377 EXPORT_SYMBOL(page_symlink); 3378 EXPORT_SYMBOL(page_symlink_inode_operations); 3379 EXPORT_SYMBOL(kern_path); 3380 EXPORT_SYMBOL(vfs_path_lookup); 3381 EXPORT_SYMBOL(inode_permission); 3382 EXPORT_SYMBOL(unlock_rename); 3383 EXPORT_SYMBOL(vfs_create); 3384 EXPORT_SYMBOL(vfs_follow_link); 3385 EXPORT_SYMBOL(vfs_link); 3386 EXPORT_SYMBOL(vfs_mkdir); 3387 EXPORT_SYMBOL(vfs_mknod); 3388 EXPORT_SYMBOL(generic_permission); 3389 EXPORT_SYMBOL(vfs_readlink); 3390 EXPORT_SYMBOL(vfs_rename); 3391 EXPORT_SYMBOL(vfs_rmdir); 3392 EXPORT_SYMBOL(vfs_symlink); 3393 EXPORT_SYMBOL(vfs_unlink); 3394 EXPORT_SYMBOL(dentry_unhash); 3395 EXPORT_SYMBOL(generic_readlink); 3396