1 /* 2 * linux/fs/namei.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * Some corrections by tytso. 9 */ 10 11 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname 12 * lookup logic. 13 */ 14 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture. 15 */ 16 17 #include <linux/init.h> 18 #include <linux/export.h> 19 #include <linux/kernel.h> 20 #include <linux/slab.h> 21 #include <linux/fs.h> 22 #include <linux/namei.h> 23 #include <linux/pagemap.h> 24 #include <linux/fsnotify.h> 25 #include <linux/personality.h> 26 #include <linux/security.h> 27 #include <linux/ima.h> 28 #include <linux/syscalls.h> 29 #include <linux/mount.h> 30 #include <linux/audit.h> 31 #include <linux/capability.h> 32 #include <linux/file.h> 33 #include <linux/fcntl.h> 34 #include <linux/device_cgroup.h> 35 #include <linux/fs_struct.h> 36 #include <linux/posix_acl.h> 37 #include <linux/hash.h> 38 #include <asm/uaccess.h> 39 40 #include "internal.h" 41 #include "mount.h" 42 43 /* [Feb-1997 T. Schoebel-Theuer] 44 * Fundamental changes in the pathname lookup mechanisms (namei) 45 * were necessary because of omirr. The reason is that omirr needs 46 * to know the _real_ pathname, not the user-supplied one, in case 47 * of symlinks (and also when transname replacements occur). 48 * 49 * The new code replaces the old recursive symlink resolution with 50 * an iterative one (in case of non-nested symlink chains). It does 51 * this with calls to <fs>_follow_link(). 52 * As a side effect, dir_namei(), _namei() and follow_link() are now 53 * replaced with a single function lookup_dentry() that can handle all 54 * the special cases of the former code. 55 * 56 * With the new dcache, the pathname is stored at each inode, at least as 57 * long as the refcount of the inode is positive. As a side effect, the 58 * size of the dcache depends on the inode cache and thus is dynamic. 59 * 60 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink 61 * resolution to correspond with current state of the code. 62 * 63 * Note that the symlink resolution is not *completely* iterative. 64 * There is still a significant amount of tail- and mid- recursion in 65 * the algorithm. Also, note that <fs>_readlink() is not used in 66 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink() 67 * may return different results than <fs>_follow_link(). Many virtual 68 * filesystems (including /proc) exhibit this behavior. 69 */ 70 71 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation: 72 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL 73 * and the name already exists in form of a symlink, try to create the new 74 * name indicated by the symlink. The old code always complained that the 75 * name already exists, due to not following the symlink even if its target 76 * is nonexistent. The new semantics affects also mknod() and link() when 77 * the name is a symlink pointing to a non-existent name. 78 * 79 * I don't know which semantics is the right one, since I have no access 80 * to standards. But I found by trial that HP-UX 9.0 has the full "new" 81 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the 82 * "old" one. Personally, I think the new semantics is much more logical. 83 * Note that "ln old new" where "new" is a symlink pointing to a non-existing 84 * file does succeed in both HP-UX and SunOs, but not in Solaris 85 * and in the old Linux semantics. 86 */ 87 88 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink 89 * semantics. See the comments in "open_namei" and "do_link" below. 90 * 91 * [10-Sep-98 Alan Modra] Another symlink change. 92 */ 93 94 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks: 95 * inside the path - always follow. 96 * in the last component in creation/removal/renaming - never follow. 97 * if LOOKUP_FOLLOW passed - follow. 98 * if the pathname has trailing slashes - follow. 99 * otherwise - don't follow. 100 * (applied in that order). 101 * 102 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT 103 * restored for 2.4. This is the last surviving part of old 4.2BSD bug. 104 * During the 2.4 we need to fix the userland stuff depending on it - 105 * hopefully we will be able to get rid of that wart in 2.5. So far only 106 * XEmacs seems to be relying on it... 107 */ 108 /* 109 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland) 110 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives 111 * any extra contention... 112 */ 113 114 /* In order to reduce some races, while at the same time doing additional 115 * checking and hopefully speeding things up, we copy filenames to the 116 * kernel data space before using them.. 117 * 118 * POSIX.1 2.4: an empty pathname is invalid (ENOENT). 119 * PATH_MAX includes the nul terminator --RR. 120 */ 121 122 #define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname)) 123 124 struct filename * 125 getname_flags(const char __user *filename, int flags, int *empty) 126 { 127 struct filename *result; 128 char *kname; 129 int len; 130 131 result = audit_reusename(filename); 132 if (result) 133 return result; 134 135 result = __getname(); 136 if (unlikely(!result)) 137 return ERR_PTR(-ENOMEM); 138 139 /* 140 * First, try to embed the struct filename inside the names_cache 141 * allocation 142 */ 143 kname = (char *)result->iname; 144 result->name = kname; 145 146 len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX); 147 if (unlikely(len < 0)) { 148 __putname(result); 149 return ERR_PTR(len); 150 } 151 152 /* 153 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a 154 * separate struct filename so we can dedicate the entire 155 * names_cache allocation for the pathname, and re-do the copy from 156 * userland. 157 */ 158 if (unlikely(len == EMBEDDED_NAME_MAX)) { 159 const size_t size = offsetof(struct filename, iname[1]); 160 kname = (char *)result; 161 162 /* 163 * size is chosen that way we to guarantee that 164 * result->iname[0] is within the same object and that 165 * kname can't be equal to result->iname, no matter what. 166 */ 167 result = kzalloc(size, GFP_KERNEL); 168 if (unlikely(!result)) { 169 __putname(kname); 170 return ERR_PTR(-ENOMEM); 171 } 172 result->name = kname; 173 len = strncpy_from_user(kname, filename, PATH_MAX); 174 if (unlikely(len < 0)) { 175 __putname(kname); 176 kfree(result); 177 return ERR_PTR(len); 178 } 179 if (unlikely(len == PATH_MAX)) { 180 __putname(kname); 181 kfree(result); 182 return ERR_PTR(-ENAMETOOLONG); 183 } 184 } 185 186 result->refcnt = 1; 187 /* The empty path is special. */ 188 if (unlikely(!len)) { 189 if (empty) 190 *empty = 1; 191 if (!(flags & LOOKUP_EMPTY)) { 192 putname(result); 193 return ERR_PTR(-ENOENT); 194 } 195 } 196 197 result->uptr = filename; 198 result->aname = NULL; 199 audit_getname(result); 200 return result; 201 } 202 203 struct filename * 204 getname(const char __user * filename) 205 { 206 return getname_flags(filename, 0, NULL); 207 } 208 209 struct filename * 210 getname_kernel(const char * filename) 211 { 212 struct filename *result; 213 int len = strlen(filename) + 1; 214 215 result = __getname(); 216 if (unlikely(!result)) 217 return ERR_PTR(-ENOMEM); 218 219 if (len <= EMBEDDED_NAME_MAX) { 220 result->name = (char *)result->iname; 221 } else if (len <= PATH_MAX) { 222 struct filename *tmp; 223 224 tmp = kmalloc(sizeof(*tmp), GFP_KERNEL); 225 if (unlikely(!tmp)) { 226 __putname(result); 227 return ERR_PTR(-ENOMEM); 228 } 229 tmp->name = (char *)result; 230 result = tmp; 231 } else { 232 __putname(result); 233 return ERR_PTR(-ENAMETOOLONG); 234 } 235 memcpy((char *)result->name, filename, len); 236 result->uptr = NULL; 237 result->aname = NULL; 238 result->refcnt = 1; 239 audit_getname(result); 240 241 return result; 242 } 243 244 void putname(struct filename *name) 245 { 246 BUG_ON(name->refcnt <= 0); 247 248 if (--name->refcnt > 0) 249 return; 250 251 if (name->name != name->iname) { 252 __putname(name->name); 253 kfree(name); 254 } else 255 __putname(name); 256 } 257 258 static int check_acl(struct inode *inode, int mask) 259 { 260 #ifdef CONFIG_FS_POSIX_ACL 261 struct posix_acl *acl; 262 263 if (mask & MAY_NOT_BLOCK) { 264 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS); 265 if (!acl) 266 return -EAGAIN; 267 /* no ->get_acl() calls in RCU mode... */ 268 if (acl == ACL_NOT_CACHED) 269 return -ECHILD; 270 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK); 271 } 272 273 acl = get_acl(inode, ACL_TYPE_ACCESS); 274 if (IS_ERR(acl)) 275 return PTR_ERR(acl); 276 if (acl) { 277 int error = posix_acl_permission(inode, acl, mask); 278 posix_acl_release(acl); 279 return error; 280 } 281 #endif 282 283 return -EAGAIN; 284 } 285 286 /* 287 * This does the basic permission checking 288 */ 289 static int acl_permission_check(struct inode *inode, int mask) 290 { 291 unsigned int mode = inode->i_mode; 292 293 if (likely(uid_eq(current_fsuid(), inode->i_uid))) 294 mode >>= 6; 295 else { 296 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { 297 int error = check_acl(inode, mask); 298 if (error != -EAGAIN) 299 return error; 300 } 301 302 if (in_group_p(inode->i_gid)) 303 mode >>= 3; 304 } 305 306 /* 307 * If the DACs are ok we don't need any capability check. 308 */ 309 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0) 310 return 0; 311 return -EACCES; 312 } 313 314 /** 315 * generic_permission - check for access rights on a Posix-like filesystem 316 * @inode: inode to check access rights for 317 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...) 318 * 319 * Used to check for read/write/execute permissions on a file. 320 * We use "fsuid" for this, letting us set arbitrary permissions 321 * for filesystem access without changing the "normal" uids which 322 * are used for other things. 323 * 324 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk 325 * request cannot be satisfied (eg. requires blocking or too much complexity). 326 * It would then be called again in ref-walk mode. 327 */ 328 int generic_permission(struct inode *inode, int mask) 329 { 330 int ret; 331 332 /* 333 * Do the basic permission checks. 334 */ 335 ret = acl_permission_check(inode, mask); 336 if (ret != -EACCES) 337 return ret; 338 339 if (S_ISDIR(inode->i_mode)) { 340 /* DACs are overridable for directories */ 341 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) 342 return 0; 343 if (!(mask & MAY_WRITE)) 344 if (capable_wrt_inode_uidgid(inode, 345 CAP_DAC_READ_SEARCH)) 346 return 0; 347 return -EACCES; 348 } 349 /* 350 * Read/write DACs are always overridable. 351 * Executable DACs are overridable when there is 352 * at least one exec bit set. 353 */ 354 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 355 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) 356 return 0; 357 358 /* 359 * Searching includes executable on directories, else just read. 360 */ 361 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 362 if (mask == MAY_READ) 363 if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH)) 364 return 0; 365 366 return -EACCES; 367 } 368 EXPORT_SYMBOL(generic_permission); 369 370 /* 371 * We _really_ want to just do "generic_permission()" without 372 * even looking at the inode->i_op values. So we keep a cache 373 * flag in inode->i_opflags, that says "this has not special 374 * permission function, use the fast case". 375 */ 376 static inline int do_inode_permission(struct inode *inode, int mask) 377 { 378 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) { 379 if (likely(inode->i_op->permission)) 380 return inode->i_op->permission(inode, mask); 381 382 /* This gets set once for the inode lifetime */ 383 spin_lock(&inode->i_lock); 384 inode->i_opflags |= IOP_FASTPERM; 385 spin_unlock(&inode->i_lock); 386 } 387 return generic_permission(inode, mask); 388 } 389 390 /** 391 * __inode_permission - Check for access rights to a given inode 392 * @inode: Inode to check permission on 393 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 394 * 395 * Check for read/write/execute permissions on an inode. 396 * 397 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 398 * 399 * This does not check for a read-only file system. You probably want 400 * inode_permission(). 401 */ 402 int __inode_permission(struct inode *inode, int mask) 403 { 404 int retval; 405 406 if (unlikely(mask & MAY_WRITE)) { 407 /* 408 * Nobody gets write access to an immutable file. 409 */ 410 if (IS_IMMUTABLE(inode)) 411 return -EACCES; 412 } 413 414 retval = do_inode_permission(inode, mask); 415 if (retval) 416 return retval; 417 418 retval = devcgroup_inode_permission(inode, mask); 419 if (retval) 420 return retval; 421 422 return security_inode_permission(inode, mask); 423 } 424 EXPORT_SYMBOL(__inode_permission); 425 426 /** 427 * sb_permission - Check superblock-level permissions 428 * @sb: Superblock of inode to check permission on 429 * @inode: Inode to check permission on 430 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 431 * 432 * Separate out file-system wide checks from inode-specific permission checks. 433 */ 434 static int sb_permission(struct super_block *sb, struct inode *inode, int mask) 435 { 436 if (unlikely(mask & MAY_WRITE)) { 437 umode_t mode = inode->i_mode; 438 439 /* Nobody gets write access to a read-only fs. */ 440 if ((sb->s_flags & MS_RDONLY) && 441 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) 442 return -EROFS; 443 } 444 return 0; 445 } 446 447 /** 448 * inode_permission - Check for access rights to a given inode 449 * @inode: Inode to check permission on 450 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 451 * 452 * Check for read/write/execute permissions on an inode. We use fs[ug]id for 453 * this, letting us set arbitrary permissions for filesystem access without 454 * changing the "normal" UIDs which are used for other things. 455 * 456 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 457 */ 458 int inode_permission(struct inode *inode, int mask) 459 { 460 int retval; 461 462 retval = sb_permission(inode->i_sb, inode, mask); 463 if (retval) 464 return retval; 465 return __inode_permission(inode, mask); 466 } 467 EXPORT_SYMBOL(inode_permission); 468 469 /** 470 * path_get - get a reference to a path 471 * @path: path to get the reference to 472 * 473 * Given a path increment the reference count to the dentry and the vfsmount. 474 */ 475 void path_get(const struct path *path) 476 { 477 mntget(path->mnt); 478 dget(path->dentry); 479 } 480 EXPORT_SYMBOL(path_get); 481 482 /** 483 * path_put - put a reference to a path 484 * @path: path to put the reference to 485 * 486 * Given a path decrement the reference count to the dentry and the vfsmount. 487 */ 488 void path_put(const struct path *path) 489 { 490 dput(path->dentry); 491 mntput(path->mnt); 492 } 493 EXPORT_SYMBOL(path_put); 494 495 #define EMBEDDED_LEVELS 2 496 struct nameidata { 497 struct path path; 498 struct qstr last; 499 struct path root; 500 struct inode *inode; /* path.dentry.d_inode */ 501 unsigned int flags; 502 unsigned seq, m_seq; 503 int last_type; 504 unsigned depth; 505 int total_link_count; 506 struct saved { 507 struct path link; 508 struct delayed_call done; 509 const char *name; 510 unsigned seq; 511 } *stack, internal[EMBEDDED_LEVELS]; 512 struct filename *name; 513 struct nameidata *saved; 514 struct inode *link_inode; 515 unsigned root_seq; 516 int dfd; 517 }; 518 519 static void set_nameidata(struct nameidata *p, int dfd, struct filename *name) 520 { 521 struct nameidata *old = current->nameidata; 522 p->stack = p->internal; 523 p->dfd = dfd; 524 p->name = name; 525 p->total_link_count = old ? old->total_link_count : 0; 526 p->saved = old; 527 current->nameidata = p; 528 } 529 530 static void restore_nameidata(void) 531 { 532 struct nameidata *now = current->nameidata, *old = now->saved; 533 534 current->nameidata = old; 535 if (old) 536 old->total_link_count = now->total_link_count; 537 if (now->stack != now->internal) 538 kfree(now->stack); 539 } 540 541 static int __nd_alloc_stack(struct nameidata *nd) 542 { 543 struct saved *p; 544 545 if (nd->flags & LOOKUP_RCU) { 546 p= kmalloc(MAXSYMLINKS * sizeof(struct saved), 547 GFP_ATOMIC); 548 if (unlikely(!p)) 549 return -ECHILD; 550 } else { 551 p= kmalloc(MAXSYMLINKS * sizeof(struct saved), 552 GFP_KERNEL); 553 if (unlikely(!p)) 554 return -ENOMEM; 555 } 556 memcpy(p, nd->internal, sizeof(nd->internal)); 557 nd->stack = p; 558 return 0; 559 } 560 561 /** 562 * path_connected - Verify that a path->dentry is below path->mnt.mnt_root 563 * @path: nameidate to verify 564 * 565 * Rename can sometimes move a file or directory outside of a bind 566 * mount, path_connected allows those cases to be detected. 567 */ 568 static bool path_connected(const struct path *path) 569 { 570 struct vfsmount *mnt = path->mnt; 571 572 /* Only bind mounts can have disconnected paths */ 573 if (mnt->mnt_root == mnt->mnt_sb->s_root) 574 return true; 575 576 return is_subdir(path->dentry, mnt->mnt_root); 577 } 578 579 static inline int nd_alloc_stack(struct nameidata *nd) 580 { 581 if (likely(nd->depth != EMBEDDED_LEVELS)) 582 return 0; 583 if (likely(nd->stack != nd->internal)) 584 return 0; 585 return __nd_alloc_stack(nd); 586 } 587 588 static void drop_links(struct nameidata *nd) 589 { 590 int i = nd->depth; 591 while (i--) { 592 struct saved *last = nd->stack + i; 593 do_delayed_call(&last->done); 594 clear_delayed_call(&last->done); 595 } 596 } 597 598 static void terminate_walk(struct nameidata *nd) 599 { 600 drop_links(nd); 601 if (!(nd->flags & LOOKUP_RCU)) { 602 int i; 603 path_put(&nd->path); 604 for (i = 0; i < nd->depth; i++) 605 path_put(&nd->stack[i].link); 606 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 607 path_put(&nd->root); 608 nd->root.mnt = NULL; 609 } 610 } else { 611 nd->flags &= ~LOOKUP_RCU; 612 if (!(nd->flags & LOOKUP_ROOT)) 613 nd->root.mnt = NULL; 614 rcu_read_unlock(); 615 } 616 nd->depth = 0; 617 } 618 619 /* path_put is needed afterwards regardless of success or failure */ 620 static bool legitimize_path(struct nameidata *nd, 621 struct path *path, unsigned seq) 622 { 623 int res = __legitimize_mnt(path->mnt, nd->m_seq); 624 if (unlikely(res)) { 625 if (res > 0) 626 path->mnt = NULL; 627 path->dentry = NULL; 628 return false; 629 } 630 if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) { 631 path->dentry = NULL; 632 return false; 633 } 634 return !read_seqcount_retry(&path->dentry->d_seq, seq); 635 } 636 637 static bool legitimize_links(struct nameidata *nd) 638 { 639 int i; 640 for (i = 0; i < nd->depth; i++) { 641 struct saved *last = nd->stack + i; 642 if (unlikely(!legitimize_path(nd, &last->link, last->seq))) { 643 drop_links(nd); 644 nd->depth = i + 1; 645 return false; 646 } 647 } 648 return true; 649 } 650 651 /* 652 * Path walking has 2 modes, rcu-walk and ref-walk (see 653 * Documentation/filesystems/path-lookup.txt). In situations when we can't 654 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab 655 * normal reference counts on dentries and vfsmounts to transition to ref-walk 656 * mode. Refcounts are grabbed at the last known good point before rcu-walk 657 * got stuck, so ref-walk may continue from there. If this is not successful 658 * (eg. a seqcount has changed), then failure is returned and it's up to caller 659 * to restart the path walk from the beginning in ref-walk mode. 660 */ 661 662 /** 663 * unlazy_walk - try to switch to ref-walk mode. 664 * @nd: nameidata pathwalk data 665 * @dentry: child of nd->path.dentry or NULL 666 * @seq: seq number to check dentry against 667 * Returns: 0 on success, -ECHILD on failure 668 * 669 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry 670 * for ref-walk mode. @dentry must be a path found by a do_lookup call on 671 * @nd or NULL. Must be called from rcu-walk context. 672 * Nothing should touch nameidata between unlazy_walk() failure and 673 * terminate_walk(). 674 */ 675 static int unlazy_walk(struct nameidata *nd, struct dentry *dentry, unsigned seq) 676 { 677 struct dentry *parent = nd->path.dentry; 678 679 BUG_ON(!(nd->flags & LOOKUP_RCU)); 680 681 nd->flags &= ~LOOKUP_RCU; 682 if (unlikely(!legitimize_links(nd))) 683 goto out2; 684 if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq))) 685 goto out2; 686 if (unlikely(!lockref_get_not_dead(&parent->d_lockref))) 687 goto out1; 688 689 /* 690 * For a negative lookup, the lookup sequence point is the parents 691 * sequence point, and it only needs to revalidate the parent dentry. 692 * 693 * For a positive lookup, we need to move both the parent and the 694 * dentry from the RCU domain to be properly refcounted. And the 695 * sequence number in the dentry validates *both* dentry counters, 696 * since we checked the sequence number of the parent after we got 697 * the child sequence number. So we know the parent must still 698 * be valid if the child sequence number is still valid. 699 */ 700 if (!dentry) { 701 if (read_seqcount_retry(&parent->d_seq, nd->seq)) 702 goto out; 703 BUG_ON(nd->inode != parent->d_inode); 704 } else { 705 if (!lockref_get_not_dead(&dentry->d_lockref)) 706 goto out; 707 if (read_seqcount_retry(&dentry->d_seq, seq)) 708 goto drop_dentry; 709 } 710 711 /* 712 * Sequence counts matched. Now make sure that the root is 713 * still valid and get it if required. 714 */ 715 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 716 if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq))) { 717 rcu_read_unlock(); 718 dput(dentry); 719 return -ECHILD; 720 } 721 } 722 723 rcu_read_unlock(); 724 return 0; 725 726 drop_dentry: 727 rcu_read_unlock(); 728 dput(dentry); 729 goto drop_root_mnt; 730 out2: 731 nd->path.mnt = NULL; 732 out1: 733 nd->path.dentry = NULL; 734 out: 735 rcu_read_unlock(); 736 drop_root_mnt: 737 if (!(nd->flags & LOOKUP_ROOT)) 738 nd->root.mnt = NULL; 739 return -ECHILD; 740 } 741 742 static int unlazy_link(struct nameidata *nd, struct path *link, unsigned seq) 743 { 744 if (unlikely(!legitimize_path(nd, link, seq))) { 745 drop_links(nd); 746 nd->depth = 0; 747 nd->flags &= ~LOOKUP_RCU; 748 nd->path.mnt = NULL; 749 nd->path.dentry = NULL; 750 if (!(nd->flags & LOOKUP_ROOT)) 751 nd->root.mnt = NULL; 752 rcu_read_unlock(); 753 } else if (likely(unlazy_walk(nd, NULL, 0)) == 0) { 754 return 0; 755 } 756 path_put(link); 757 return -ECHILD; 758 } 759 760 static inline int d_revalidate(struct dentry *dentry, unsigned int flags) 761 { 762 return dentry->d_op->d_revalidate(dentry, flags); 763 } 764 765 /** 766 * complete_walk - successful completion of path walk 767 * @nd: pointer nameidata 768 * 769 * If we had been in RCU mode, drop out of it and legitimize nd->path. 770 * Revalidate the final result, unless we'd already done that during 771 * the path walk or the filesystem doesn't ask for it. Return 0 on 772 * success, -error on failure. In case of failure caller does not 773 * need to drop nd->path. 774 */ 775 static int complete_walk(struct nameidata *nd) 776 { 777 struct dentry *dentry = nd->path.dentry; 778 int status; 779 780 if (nd->flags & LOOKUP_RCU) { 781 if (!(nd->flags & LOOKUP_ROOT)) 782 nd->root.mnt = NULL; 783 if (unlikely(unlazy_walk(nd, NULL, 0))) 784 return -ECHILD; 785 } 786 787 if (likely(!(nd->flags & LOOKUP_JUMPED))) 788 return 0; 789 790 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE))) 791 return 0; 792 793 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags); 794 if (status > 0) 795 return 0; 796 797 if (!status) 798 status = -ESTALE; 799 800 return status; 801 } 802 803 static void set_root(struct nameidata *nd) 804 { 805 struct fs_struct *fs = current->fs; 806 807 if (nd->flags & LOOKUP_RCU) { 808 unsigned seq; 809 810 do { 811 seq = read_seqcount_begin(&fs->seq); 812 nd->root = fs->root; 813 nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq); 814 } while (read_seqcount_retry(&fs->seq, seq)); 815 } else { 816 get_fs_root(fs, &nd->root); 817 } 818 } 819 820 static void path_put_conditional(struct path *path, struct nameidata *nd) 821 { 822 dput(path->dentry); 823 if (path->mnt != nd->path.mnt) 824 mntput(path->mnt); 825 } 826 827 static inline void path_to_nameidata(const struct path *path, 828 struct nameidata *nd) 829 { 830 if (!(nd->flags & LOOKUP_RCU)) { 831 dput(nd->path.dentry); 832 if (nd->path.mnt != path->mnt) 833 mntput(nd->path.mnt); 834 } 835 nd->path.mnt = path->mnt; 836 nd->path.dentry = path->dentry; 837 } 838 839 static int nd_jump_root(struct nameidata *nd) 840 { 841 if (nd->flags & LOOKUP_RCU) { 842 struct dentry *d; 843 nd->path = nd->root; 844 d = nd->path.dentry; 845 nd->inode = d->d_inode; 846 nd->seq = nd->root_seq; 847 if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq))) 848 return -ECHILD; 849 } else { 850 path_put(&nd->path); 851 nd->path = nd->root; 852 path_get(&nd->path); 853 nd->inode = nd->path.dentry->d_inode; 854 } 855 nd->flags |= LOOKUP_JUMPED; 856 return 0; 857 } 858 859 /* 860 * Helper to directly jump to a known parsed path from ->get_link, 861 * caller must have taken a reference to path beforehand. 862 */ 863 void nd_jump_link(struct path *path) 864 { 865 struct nameidata *nd = current->nameidata; 866 path_put(&nd->path); 867 868 nd->path = *path; 869 nd->inode = nd->path.dentry->d_inode; 870 nd->flags |= LOOKUP_JUMPED; 871 } 872 873 static inline void put_link(struct nameidata *nd) 874 { 875 struct saved *last = nd->stack + --nd->depth; 876 do_delayed_call(&last->done); 877 if (!(nd->flags & LOOKUP_RCU)) 878 path_put(&last->link); 879 } 880 881 int sysctl_protected_symlinks __read_mostly = 0; 882 int sysctl_protected_hardlinks __read_mostly = 0; 883 884 /** 885 * may_follow_link - Check symlink following for unsafe situations 886 * @nd: nameidata pathwalk data 887 * 888 * In the case of the sysctl_protected_symlinks sysctl being enabled, 889 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is 890 * in a sticky world-writable directory. This is to protect privileged 891 * processes from failing races against path names that may change out 892 * from under them by way of other users creating malicious symlinks. 893 * It will permit symlinks to be followed only when outside a sticky 894 * world-writable directory, or when the uid of the symlink and follower 895 * match, or when the directory owner matches the symlink's owner. 896 * 897 * Returns 0 if following the symlink is allowed, -ve on error. 898 */ 899 static inline int may_follow_link(struct nameidata *nd) 900 { 901 const struct inode *inode; 902 const struct inode *parent; 903 904 if (!sysctl_protected_symlinks) 905 return 0; 906 907 /* Allowed if owner and follower match. */ 908 inode = nd->link_inode; 909 if (uid_eq(current_cred()->fsuid, inode->i_uid)) 910 return 0; 911 912 /* Allowed if parent directory not sticky and world-writable. */ 913 parent = nd->inode; 914 if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH)) 915 return 0; 916 917 /* Allowed if parent directory and link owner match. */ 918 if (uid_eq(parent->i_uid, inode->i_uid)) 919 return 0; 920 921 if (nd->flags & LOOKUP_RCU) 922 return -ECHILD; 923 924 audit_log_link_denied("follow_link", &nd->stack[0].link); 925 return -EACCES; 926 } 927 928 /** 929 * safe_hardlink_source - Check for safe hardlink conditions 930 * @inode: the source inode to hardlink from 931 * 932 * Return false if at least one of the following conditions: 933 * - inode is not a regular file 934 * - inode is setuid 935 * - inode is setgid and group-exec 936 * - access failure for read and write 937 * 938 * Otherwise returns true. 939 */ 940 static bool safe_hardlink_source(struct inode *inode) 941 { 942 umode_t mode = inode->i_mode; 943 944 /* Special files should not get pinned to the filesystem. */ 945 if (!S_ISREG(mode)) 946 return false; 947 948 /* Setuid files should not get pinned to the filesystem. */ 949 if (mode & S_ISUID) 950 return false; 951 952 /* Executable setgid files should not get pinned to the filesystem. */ 953 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) 954 return false; 955 956 /* Hardlinking to unreadable or unwritable sources is dangerous. */ 957 if (inode_permission(inode, MAY_READ | MAY_WRITE)) 958 return false; 959 960 return true; 961 } 962 963 /** 964 * may_linkat - Check permissions for creating a hardlink 965 * @link: the source to hardlink from 966 * 967 * Block hardlink when all of: 968 * - sysctl_protected_hardlinks enabled 969 * - fsuid does not match inode 970 * - hardlink source is unsafe (see safe_hardlink_source() above) 971 * - not CAP_FOWNER in a namespace with the inode owner uid mapped 972 * 973 * Returns 0 if successful, -ve on error. 974 */ 975 static int may_linkat(struct path *link) 976 { 977 struct inode *inode; 978 979 if (!sysctl_protected_hardlinks) 980 return 0; 981 982 inode = link->dentry->d_inode; 983 984 /* Source inode owner (or CAP_FOWNER) can hardlink all they like, 985 * otherwise, it must be a safe source. 986 */ 987 if (inode_owner_or_capable(inode) || safe_hardlink_source(inode)) 988 return 0; 989 990 audit_log_link_denied("linkat", link); 991 return -EPERM; 992 } 993 994 static __always_inline 995 const char *get_link(struct nameidata *nd) 996 { 997 struct saved *last = nd->stack + nd->depth - 1; 998 struct dentry *dentry = last->link.dentry; 999 struct inode *inode = nd->link_inode; 1000 int error; 1001 const char *res; 1002 1003 if (!(nd->flags & LOOKUP_RCU)) { 1004 touch_atime(&last->link); 1005 cond_resched(); 1006 } else if (atime_needs_update(&last->link, inode)) { 1007 if (unlikely(unlazy_walk(nd, NULL, 0))) 1008 return ERR_PTR(-ECHILD); 1009 touch_atime(&last->link); 1010 } 1011 1012 error = security_inode_follow_link(dentry, inode, 1013 nd->flags & LOOKUP_RCU); 1014 if (unlikely(error)) 1015 return ERR_PTR(error); 1016 1017 nd->last_type = LAST_BIND; 1018 res = inode->i_link; 1019 if (!res) { 1020 const char * (*get)(struct dentry *, struct inode *, 1021 struct delayed_call *); 1022 get = inode->i_op->get_link; 1023 if (nd->flags & LOOKUP_RCU) { 1024 res = get(NULL, inode, &last->done); 1025 if (res == ERR_PTR(-ECHILD)) { 1026 if (unlikely(unlazy_walk(nd, NULL, 0))) 1027 return ERR_PTR(-ECHILD); 1028 res = get(dentry, inode, &last->done); 1029 } 1030 } else { 1031 res = get(dentry, inode, &last->done); 1032 } 1033 if (IS_ERR_OR_NULL(res)) 1034 return res; 1035 } 1036 if (*res == '/') { 1037 if (!nd->root.mnt) 1038 set_root(nd); 1039 if (unlikely(nd_jump_root(nd))) 1040 return ERR_PTR(-ECHILD); 1041 while (unlikely(*++res == '/')) 1042 ; 1043 } 1044 if (!*res) 1045 res = NULL; 1046 return res; 1047 } 1048 1049 /* 1050 * follow_up - Find the mountpoint of path's vfsmount 1051 * 1052 * Given a path, find the mountpoint of its source file system. 1053 * Replace @path with the path of the mountpoint in the parent mount. 1054 * Up is towards /. 1055 * 1056 * Return 1 if we went up a level and 0 if we were already at the 1057 * root. 1058 */ 1059 int follow_up(struct path *path) 1060 { 1061 struct mount *mnt = real_mount(path->mnt); 1062 struct mount *parent; 1063 struct dentry *mountpoint; 1064 1065 read_seqlock_excl(&mount_lock); 1066 parent = mnt->mnt_parent; 1067 if (parent == mnt) { 1068 read_sequnlock_excl(&mount_lock); 1069 return 0; 1070 } 1071 mntget(&parent->mnt); 1072 mountpoint = dget(mnt->mnt_mountpoint); 1073 read_sequnlock_excl(&mount_lock); 1074 dput(path->dentry); 1075 path->dentry = mountpoint; 1076 mntput(path->mnt); 1077 path->mnt = &parent->mnt; 1078 return 1; 1079 } 1080 EXPORT_SYMBOL(follow_up); 1081 1082 /* 1083 * Perform an automount 1084 * - return -EISDIR to tell follow_managed() to stop and return the path we 1085 * were called with. 1086 */ 1087 static int follow_automount(struct path *path, struct nameidata *nd, 1088 bool *need_mntput) 1089 { 1090 struct vfsmount *mnt; 1091 int err; 1092 1093 if (!path->dentry->d_op || !path->dentry->d_op->d_automount) 1094 return -EREMOTE; 1095 1096 /* We don't want to mount if someone's just doing a stat - 1097 * unless they're stat'ing a directory and appended a '/' to 1098 * the name. 1099 * 1100 * We do, however, want to mount if someone wants to open or 1101 * create a file of any type under the mountpoint, wants to 1102 * traverse through the mountpoint or wants to open the 1103 * mounted directory. Also, autofs may mark negative dentries 1104 * as being automount points. These will need the attentions 1105 * of the daemon to instantiate them before they can be used. 1106 */ 1107 if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | 1108 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) && 1109 path->dentry->d_inode) 1110 return -EISDIR; 1111 1112 nd->total_link_count++; 1113 if (nd->total_link_count >= 40) 1114 return -ELOOP; 1115 1116 mnt = path->dentry->d_op->d_automount(path); 1117 if (IS_ERR(mnt)) { 1118 /* 1119 * The filesystem is allowed to return -EISDIR here to indicate 1120 * it doesn't want to automount. For instance, autofs would do 1121 * this so that its userspace daemon can mount on this dentry. 1122 * 1123 * However, we can only permit this if it's a terminal point in 1124 * the path being looked up; if it wasn't then the remainder of 1125 * the path is inaccessible and we should say so. 1126 */ 1127 if (PTR_ERR(mnt) == -EISDIR && (nd->flags & LOOKUP_PARENT)) 1128 return -EREMOTE; 1129 return PTR_ERR(mnt); 1130 } 1131 1132 if (!mnt) /* mount collision */ 1133 return 0; 1134 1135 if (!*need_mntput) { 1136 /* lock_mount() may release path->mnt on error */ 1137 mntget(path->mnt); 1138 *need_mntput = true; 1139 } 1140 err = finish_automount(mnt, path); 1141 1142 switch (err) { 1143 case -EBUSY: 1144 /* Someone else made a mount here whilst we were busy */ 1145 return 0; 1146 case 0: 1147 path_put(path); 1148 path->mnt = mnt; 1149 path->dentry = dget(mnt->mnt_root); 1150 return 0; 1151 default: 1152 return err; 1153 } 1154 1155 } 1156 1157 /* 1158 * Handle a dentry that is managed in some way. 1159 * - Flagged for transit management (autofs) 1160 * - Flagged as mountpoint 1161 * - Flagged as automount point 1162 * 1163 * This may only be called in refwalk mode. 1164 * 1165 * Serialization is taken care of in namespace.c 1166 */ 1167 static int follow_managed(struct path *path, struct nameidata *nd) 1168 { 1169 struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */ 1170 unsigned managed; 1171 bool need_mntput = false; 1172 int ret = 0; 1173 1174 /* Given that we're not holding a lock here, we retain the value in a 1175 * local variable for each dentry as we look at it so that we don't see 1176 * the components of that value change under us */ 1177 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1178 managed &= DCACHE_MANAGED_DENTRY, 1179 unlikely(managed != 0)) { 1180 /* Allow the filesystem to manage the transit without i_mutex 1181 * being held. */ 1182 if (managed & DCACHE_MANAGE_TRANSIT) { 1183 BUG_ON(!path->dentry->d_op); 1184 BUG_ON(!path->dentry->d_op->d_manage); 1185 ret = path->dentry->d_op->d_manage(path->dentry, false); 1186 if (ret < 0) 1187 break; 1188 } 1189 1190 /* Transit to a mounted filesystem. */ 1191 if (managed & DCACHE_MOUNTED) { 1192 struct vfsmount *mounted = lookup_mnt(path); 1193 if (mounted) { 1194 dput(path->dentry); 1195 if (need_mntput) 1196 mntput(path->mnt); 1197 path->mnt = mounted; 1198 path->dentry = dget(mounted->mnt_root); 1199 need_mntput = true; 1200 continue; 1201 } 1202 1203 /* Something is mounted on this dentry in another 1204 * namespace and/or whatever was mounted there in this 1205 * namespace got unmounted before lookup_mnt() could 1206 * get it */ 1207 } 1208 1209 /* Handle an automount point */ 1210 if (managed & DCACHE_NEED_AUTOMOUNT) { 1211 ret = follow_automount(path, nd, &need_mntput); 1212 if (ret < 0) 1213 break; 1214 continue; 1215 } 1216 1217 /* We didn't change the current path point */ 1218 break; 1219 } 1220 1221 if (need_mntput && path->mnt == mnt) 1222 mntput(path->mnt); 1223 if (ret == -EISDIR || !ret) 1224 ret = 1; 1225 if (need_mntput) 1226 nd->flags |= LOOKUP_JUMPED; 1227 if (unlikely(ret < 0)) 1228 path_put_conditional(path, nd); 1229 return ret; 1230 } 1231 1232 int follow_down_one(struct path *path) 1233 { 1234 struct vfsmount *mounted; 1235 1236 mounted = lookup_mnt(path); 1237 if (mounted) { 1238 dput(path->dentry); 1239 mntput(path->mnt); 1240 path->mnt = mounted; 1241 path->dentry = dget(mounted->mnt_root); 1242 return 1; 1243 } 1244 return 0; 1245 } 1246 EXPORT_SYMBOL(follow_down_one); 1247 1248 static inline int managed_dentry_rcu(struct dentry *dentry) 1249 { 1250 return (dentry->d_flags & DCACHE_MANAGE_TRANSIT) ? 1251 dentry->d_op->d_manage(dentry, true) : 0; 1252 } 1253 1254 /* 1255 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if 1256 * we meet a managed dentry that would need blocking. 1257 */ 1258 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, 1259 struct inode **inode, unsigned *seqp) 1260 { 1261 for (;;) { 1262 struct mount *mounted; 1263 /* 1264 * Don't forget we might have a non-mountpoint managed dentry 1265 * that wants to block transit. 1266 */ 1267 switch (managed_dentry_rcu(path->dentry)) { 1268 case -ECHILD: 1269 default: 1270 return false; 1271 case -EISDIR: 1272 return true; 1273 case 0: 1274 break; 1275 } 1276 1277 if (!d_mountpoint(path->dentry)) 1278 return !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT); 1279 1280 mounted = __lookup_mnt(path->mnt, path->dentry); 1281 if (!mounted) 1282 break; 1283 path->mnt = &mounted->mnt; 1284 path->dentry = mounted->mnt.mnt_root; 1285 nd->flags |= LOOKUP_JUMPED; 1286 *seqp = read_seqcount_begin(&path->dentry->d_seq); 1287 /* 1288 * Update the inode too. We don't need to re-check the 1289 * dentry sequence number here after this d_inode read, 1290 * because a mount-point is always pinned. 1291 */ 1292 *inode = path->dentry->d_inode; 1293 } 1294 return !read_seqretry(&mount_lock, nd->m_seq) && 1295 !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT); 1296 } 1297 1298 static int follow_dotdot_rcu(struct nameidata *nd) 1299 { 1300 struct inode *inode = nd->inode; 1301 1302 while (1) { 1303 if (path_equal(&nd->path, &nd->root)) 1304 break; 1305 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1306 struct dentry *old = nd->path.dentry; 1307 struct dentry *parent = old->d_parent; 1308 unsigned seq; 1309 1310 inode = parent->d_inode; 1311 seq = read_seqcount_begin(&parent->d_seq); 1312 if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq))) 1313 return -ECHILD; 1314 nd->path.dentry = parent; 1315 nd->seq = seq; 1316 if (unlikely(!path_connected(&nd->path))) 1317 return -ENOENT; 1318 break; 1319 } else { 1320 struct mount *mnt = real_mount(nd->path.mnt); 1321 struct mount *mparent = mnt->mnt_parent; 1322 struct dentry *mountpoint = mnt->mnt_mountpoint; 1323 struct inode *inode2 = mountpoint->d_inode; 1324 unsigned seq = read_seqcount_begin(&mountpoint->d_seq); 1325 if (unlikely(read_seqretry(&mount_lock, nd->m_seq))) 1326 return -ECHILD; 1327 if (&mparent->mnt == nd->path.mnt) 1328 break; 1329 /* we know that mountpoint was pinned */ 1330 nd->path.dentry = mountpoint; 1331 nd->path.mnt = &mparent->mnt; 1332 inode = inode2; 1333 nd->seq = seq; 1334 } 1335 } 1336 while (unlikely(d_mountpoint(nd->path.dentry))) { 1337 struct mount *mounted; 1338 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry); 1339 if (unlikely(read_seqretry(&mount_lock, nd->m_seq))) 1340 return -ECHILD; 1341 if (!mounted) 1342 break; 1343 nd->path.mnt = &mounted->mnt; 1344 nd->path.dentry = mounted->mnt.mnt_root; 1345 inode = nd->path.dentry->d_inode; 1346 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 1347 } 1348 nd->inode = inode; 1349 return 0; 1350 } 1351 1352 /* 1353 * Follow down to the covering mount currently visible to userspace. At each 1354 * point, the filesystem owning that dentry may be queried as to whether the 1355 * caller is permitted to proceed or not. 1356 */ 1357 int follow_down(struct path *path) 1358 { 1359 unsigned managed; 1360 int ret; 1361 1362 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1363 unlikely(managed & DCACHE_MANAGED_DENTRY)) { 1364 /* Allow the filesystem to manage the transit without i_mutex 1365 * being held. 1366 * 1367 * We indicate to the filesystem if someone is trying to mount 1368 * something here. This gives autofs the chance to deny anyone 1369 * other than its daemon the right to mount on its 1370 * superstructure. 1371 * 1372 * The filesystem may sleep at this point. 1373 */ 1374 if (managed & DCACHE_MANAGE_TRANSIT) { 1375 BUG_ON(!path->dentry->d_op); 1376 BUG_ON(!path->dentry->d_op->d_manage); 1377 ret = path->dentry->d_op->d_manage( 1378 path->dentry, false); 1379 if (ret < 0) 1380 return ret == -EISDIR ? 0 : ret; 1381 } 1382 1383 /* Transit to a mounted filesystem. */ 1384 if (managed & DCACHE_MOUNTED) { 1385 struct vfsmount *mounted = lookup_mnt(path); 1386 if (!mounted) 1387 break; 1388 dput(path->dentry); 1389 mntput(path->mnt); 1390 path->mnt = mounted; 1391 path->dentry = dget(mounted->mnt_root); 1392 continue; 1393 } 1394 1395 /* Don't handle automount points here */ 1396 break; 1397 } 1398 return 0; 1399 } 1400 EXPORT_SYMBOL(follow_down); 1401 1402 /* 1403 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot() 1404 */ 1405 static void follow_mount(struct path *path) 1406 { 1407 while (d_mountpoint(path->dentry)) { 1408 struct vfsmount *mounted = lookup_mnt(path); 1409 if (!mounted) 1410 break; 1411 dput(path->dentry); 1412 mntput(path->mnt); 1413 path->mnt = mounted; 1414 path->dentry = dget(mounted->mnt_root); 1415 } 1416 } 1417 1418 static int follow_dotdot(struct nameidata *nd) 1419 { 1420 while(1) { 1421 struct dentry *old = nd->path.dentry; 1422 1423 if (nd->path.dentry == nd->root.dentry && 1424 nd->path.mnt == nd->root.mnt) { 1425 break; 1426 } 1427 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1428 /* rare case of legitimate dget_parent()... */ 1429 nd->path.dentry = dget_parent(nd->path.dentry); 1430 dput(old); 1431 if (unlikely(!path_connected(&nd->path))) 1432 return -ENOENT; 1433 break; 1434 } 1435 if (!follow_up(&nd->path)) 1436 break; 1437 } 1438 follow_mount(&nd->path); 1439 nd->inode = nd->path.dentry->d_inode; 1440 return 0; 1441 } 1442 1443 /* 1444 * This looks up the name in dcache, possibly revalidates the old dentry and 1445 * allocates a new one if not found or not valid. In the need_lookup argument 1446 * returns whether i_op->lookup is necessary. 1447 */ 1448 static struct dentry *lookup_dcache(const struct qstr *name, 1449 struct dentry *dir, 1450 unsigned int flags) 1451 { 1452 struct dentry *dentry; 1453 int error; 1454 1455 dentry = d_lookup(dir, name); 1456 if (dentry) { 1457 if (dentry->d_flags & DCACHE_OP_REVALIDATE) { 1458 error = d_revalidate(dentry, flags); 1459 if (unlikely(error <= 0)) { 1460 if (!error) 1461 d_invalidate(dentry); 1462 dput(dentry); 1463 return ERR_PTR(error); 1464 } 1465 } 1466 } 1467 return dentry; 1468 } 1469 1470 /* 1471 * Call i_op->lookup on the dentry. The dentry must be negative and 1472 * unhashed. 1473 * 1474 * dir->d_inode->i_mutex must be held 1475 */ 1476 static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry, 1477 unsigned int flags) 1478 { 1479 struct dentry *old; 1480 1481 /* Don't create child dentry for a dead directory. */ 1482 if (unlikely(IS_DEADDIR(dir))) { 1483 dput(dentry); 1484 return ERR_PTR(-ENOENT); 1485 } 1486 1487 old = dir->i_op->lookup(dir, dentry, flags); 1488 if (unlikely(old)) { 1489 dput(dentry); 1490 dentry = old; 1491 } 1492 return dentry; 1493 } 1494 1495 static struct dentry *__lookup_hash(const struct qstr *name, 1496 struct dentry *base, unsigned int flags) 1497 { 1498 struct dentry *dentry = lookup_dcache(name, base, flags); 1499 1500 if (dentry) 1501 return dentry; 1502 1503 dentry = d_alloc(base, name); 1504 if (unlikely(!dentry)) 1505 return ERR_PTR(-ENOMEM); 1506 1507 return lookup_real(base->d_inode, dentry, flags); 1508 } 1509 1510 static int lookup_fast(struct nameidata *nd, 1511 struct path *path, struct inode **inode, 1512 unsigned *seqp) 1513 { 1514 struct vfsmount *mnt = nd->path.mnt; 1515 struct dentry *dentry, *parent = nd->path.dentry; 1516 int status = 1; 1517 int err; 1518 1519 /* 1520 * Rename seqlock is not required here because in the off chance 1521 * of a false negative due to a concurrent rename, the caller is 1522 * going to fall back to non-racy lookup. 1523 */ 1524 if (nd->flags & LOOKUP_RCU) { 1525 unsigned seq; 1526 bool negative; 1527 dentry = __d_lookup_rcu(parent, &nd->last, &seq); 1528 if (unlikely(!dentry)) { 1529 if (unlazy_walk(nd, NULL, 0)) 1530 return -ECHILD; 1531 return 0; 1532 } 1533 1534 /* 1535 * This sequence count validates that the inode matches 1536 * the dentry name information from lookup. 1537 */ 1538 *inode = d_backing_inode(dentry); 1539 negative = d_is_negative(dentry); 1540 if (unlikely(read_seqcount_retry(&dentry->d_seq, seq))) 1541 return -ECHILD; 1542 1543 /* 1544 * This sequence count validates that the parent had no 1545 * changes while we did the lookup of the dentry above. 1546 * 1547 * The memory barrier in read_seqcount_begin of child is 1548 * enough, we can use __read_seqcount_retry here. 1549 */ 1550 if (unlikely(__read_seqcount_retry(&parent->d_seq, nd->seq))) 1551 return -ECHILD; 1552 1553 *seqp = seq; 1554 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) 1555 status = d_revalidate(dentry, nd->flags); 1556 if (unlikely(status <= 0)) { 1557 if (unlazy_walk(nd, dentry, seq)) 1558 return -ECHILD; 1559 if (status == -ECHILD) 1560 status = d_revalidate(dentry, nd->flags); 1561 } else { 1562 /* 1563 * Note: do negative dentry check after revalidation in 1564 * case that drops it. 1565 */ 1566 if (unlikely(negative)) 1567 return -ENOENT; 1568 path->mnt = mnt; 1569 path->dentry = dentry; 1570 if (likely(__follow_mount_rcu(nd, path, inode, seqp))) 1571 return 1; 1572 if (unlazy_walk(nd, dentry, seq)) 1573 return -ECHILD; 1574 } 1575 } else { 1576 dentry = __d_lookup(parent, &nd->last); 1577 if (unlikely(!dentry)) 1578 return 0; 1579 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) 1580 status = d_revalidate(dentry, nd->flags); 1581 } 1582 if (unlikely(status <= 0)) { 1583 if (!status) 1584 d_invalidate(dentry); 1585 dput(dentry); 1586 return status; 1587 } 1588 if (unlikely(d_is_negative(dentry))) { 1589 dput(dentry); 1590 return -ENOENT; 1591 } 1592 1593 path->mnt = mnt; 1594 path->dentry = dentry; 1595 err = follow_managed(path, nd); 1596 if (likely(err > 0)) 1597 *inode = d_backing_inode(path->dentry); 1598 return err; 1599 } 1600 1601 /* Fast lookup failed, do it the slow way */ 1602 static struct dentry *lookup_slow(const struct qstr *name, 1603 struct dentry *dir, 1604 unsigned int flags) 1605 { 1606 struct dentry *dentry; 1607 inode_lock(dir->d_inode); 1608 dentry = d_lookup(dir, name); 1609 if (unlikely(dentry)) { 1610 if ((dentry->d_flags & DCACHE_OP_REVALIDATE) && 1611 !(flags & LOOKUP_NO_REVAL)) { 1612 int error = d_revalidate(dentry, flags); 1613 if (unlikely(error <= 0)) { 1614 if (!error) 1615 d_invalidate(dentry); 1616 dput(dentry); 1617 dentry = ERR_PTR(error); 1618 } 1619 } 1620 if (dentry) { 1621 inode_unlock(dir->d_inode); 1622 return dentry; 1623 } 1624 } 1625 dentry = d_alloc(dir, name); 1626 if (unlikely(!dentry)) { 1627 inode_unlock(dir->d_inode); 1628 return ERR_PTR(-ENOMEM); 1629 } 1630 dentry = lookup_real(dir->d_inode, dentry, flags); 1631 inode_unlock(dir->d_inode); 1632 return dentry; 1633 } 1634 1635 static inline int may_lookup(struct nameidata *nd) 1636 { 1637 if (nd->flags & LOOKUP_RCU) { 1638 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK); 1639 if (err != -ECHILD) 1640 return err; 1641 if (unlazy_walk(nd, NULL, 0)) 1642 return -ECHILD; 1643 } 1644 return inode_permission(nd->inode, MAY_EXEC); 1645 } 1646 1647 static inline int handle_dots(struct nameidata *nd, int type) 1648 { 1649 if (type == LAST_DOTDOT) { 1650 if (!nd->root.mnt) 1651 set_root(nd); 1652 if (nd->flags & LOOKUP_RCU) { 1653 return follow_dotdot_rcu(nd); 1654 } else 1655 return follow_dotdot(nd); 1656 } 1657 return 0; 1658 } 1659 1660 static int pick_link(struct nameidata *nd, struct path *link, 1661 struct inode *inode, unsigned seq) 1662 { 1663 int error; 1664 struct saved *last; 1665 if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) { 1666 path_to_nameidata(link, nd); 1667 return -ELOOP; 1668 } 1669 if (!(nd->flags & LOOKUP_RCU)) { 1670 if (link->mnt == nd->path.mnt) 1671 mntget(link->mnt); 1672 } 1673 error = nd_alloc_stack(nd); 1674 if (unlikely(error)) { 1675 if (error == -ECHILD) { 1676 if (unlikely(unlazy_link(nd, link, seq))) 1677 return -ECHILD; 1678 error = nd_alloc_stack(nd); 1679 } 1680 if (error) { 1681 path_put(link); 1682 return error; 1683 } 1684 } 1685 1686 last = nd->stack + nd->depth++; 1687 last->link = *link; 1688 clear_delayed_call(&last->done); 1689 nd->link_inode = inode; 1690 last->seq = seq; 1691 return 1; 1692 } 1693 1694 /* 1695 * Do we need to follow links? We _really_ want to be able 1696 * to do this check without having to look at inode->i_op, 1697 * so we keep a cache of "no, this doesn't need follow_link" 1698 * for the common case. 1699 */ 1700 static inline int should_follow_link(struct nameidata *nd, struct path *link, 1701 int follow, 1702 struct inode *inode, unsigned seq) 1703 { 1704 if (likely(!d_is_symlink(link->dentry))) 1705 return 0; 1706 if (!follow) 1707 return 0; 1708 /* make sure that d_is_symlink above matches inode */ 1709 if (nd->flags & LOOKUP_RCU) { 1710 if (read_seqcount_retry(&link->dentry->d_seq, seq)) 1711 return -ECHILD; 1712 } 1713 return pick_link(nd, link, inode, seq); 1714 } 1715 1716 enum {WALK_GET = 1, WALK_PUT = 2}; 1717 1718 static int walk_component(struct nameidata *nd, int flags) 1719 { 1720 struct path path; 1721 struct inode *inode; 1722 unsigned seq; 1723 int err; 1724 /* 1725 * "." and ".." are special - ".." especially so because it has 1726 * to be able to know about the current root directory and 1727 * parent relationships. 1728 */ 1729 if (unlikely(nd->last_type != LAST_NORM)) { 1730 err = handle_dots(nd, nd->last_type); 1731 if (flags & WALK_PUT) 1732 put_link(nd); 1733 return err; 1734 } 1735 err = lookup_fast(nd, &path, &inode, &seq); 1736 if (unlikely(err <= 0)) { 1737 if (err < 0) 1738 return err; 1739 path.dentry = lookup_slow(&nd->last, nd->path.dentry, 1740 nd->flags); 1741 if (IS_ERR(path.dentry)) 1742 return PTR_ERR(path.dentry); 1743 if (unlikely(d_is_negative(path.dentry))) { 1744 dput(path.dentry); 1745 return -ENOENT; 1746 } 1747 path.mnt = nd->path.mnt; 1748 err = follow_managed(&path, nd); 1749 if (unlikely(err < 0)) 1750 return err; 1751 1752 seq = 0; /* we are already out of RCU mode */ 1753 inode = d_backing_inode(path.dentry); 1754 } 1755 1756 if (flags & WALK_PUT) 1757 put_link(nd); 1758 err = should_follow_link(nd, &path, flags & WALK_GET, inode, seq); 1759 if (unlikely(err)) 1760 return err; 1761 path_to_nameidata(&path, nd); 1762 nd->inode = inode; 1763 nd->seq = seq; 1764 return 0; 1765 } 1766 1767 /* 1768 * We can do the critical dentry name comparison and hashing 1769 * operations one word at a time, but we are limited to: 1770 * 1771 * - Architectures with fast unaligned word accesses. We could 1772 * do a "get_unaligned()" if this helps and is sufficiently 1773 * fast. 1774 * 1775 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we 1776 * do not trap on the (extremely unlikely) case of a page 1777 * crossing operation. 1778 * 1779 * - Furthermore, we need an efficient 64-bit compile for the 1780 * 64-bit case in order to generate the "number of bytes in 1781 * the final mask". Again, that could be replaced with a 1782 * efficient population count instruction or similar. 1783 */ 1784 #ifdef CONFIG_DCACHE_WORD_ACCESS 1785 1786 #include <asm/word-at-a-time.h> 1787 1788 #ifdef CONFIG_64BIT 1789 1790 static inline unsigned int fold_hash(unsigned long hash) 1791 { 1792 return hash_64(hash, 32); 1793 } 1794 1795 #else /* 32-bit case */ 1796 1797 #define fold_hash(x) (x) 1798 1799 #endif 1800 1801 unsigned int full_name_hash(const unsigned char *name, unsigned int len) 1802 { 1803 unsigned long a, mask; 1804 unsigned long hash = 0; 1805 1806 for (;;) { 1807 a = load_unaligned_zeropad(name); 1808 if (len < sizeof(unsigned long)) 1809 break; 1810 hash += a; 1811 hash *= 9; 1812 name += sizeof(unsigned long); 1813 len -= sizeof(unsigned long); 1814 if (!len) 1815 goto done; 1816 } 1817 mask = bytemask_from_count(len); 1818 hash += mask & a; 1819 done: 1820 return fold_hash(hash); 1821 } 1822 EXPORT_SYMBOL(full_name_hash); 1823 1824 /* 1825 * Calculate the length and hash of the path component, and 1826 * return the "hash_len" as the result. 1827 */ 1828 static inline u64 hash_name(const char *name) 1829 { 1830 unsigned long a, b, adata, bdata, mask, hash, len; 1831 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 1832 1833 hash = a = 0; 1834 len = -sizeof(unsigned long); 1835 do { 1836 hash = (hash + a) * 9; 1837 len += sizeof(unsigned long); 1838 a = load_unaligned_zeropad(name+len); 1839 b = a ^ REPEAT_BYTE('/'); 1840 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants))); 1841 1842 adata = prep_zero_mask(a, adata, &constants); 1843 bdata = prep_zero_mask(b, bdata, &constants); 1844 1845 mask = create_zero_mask(adata | bdata); 1846 1847 hash += a & zero_bytemask(mask); 1848 len += find_zero(mask); 1849 return hashlen_create(fold_hash(hash), len); 1850 } 1851 1852 #else 1853 1854 unsigned int full_name_hash(const unsigned char *name, unsigned int len) 1855 { 1856 unsigned long hash = init_name_hash(); 1857 while (len--) 1858 hash = partial_name_hash(*name++, hash); 1859 return end_name_hash(hash); 1860 } 1861 EXPORT_SYMBOL(full_name_hash); 1862 1863 /* 1864 * We know there's a real path component here of at least 1865 * one character. 1866 */ 1867 static inline u64 hash_name(const char *name) 1868 { 1869 unsigned long hash = init_name_hash(); 1870 unsigned long len = 0, c; 1871 1872 c = (unsigned char)*name; 1873 do { 1874 len++; 1875 hash = partial_name_hash(c, hash); 1876 c = (unsigned char)name[len]; 1877 } while (c && c != '/'); 1878 return hashlen_create(end_name_hash(hash), len); 1879 } 1880 1881 #endif 1882 1883 /* 1884 * Name resolution. 1885 * This is the basic name resolution function, turning a pathname into 1886 * the final dentry. We expect 'base' to be positive and a directory. 1887 * 1888 * Returns 0 and nd will have valid dentry and mnt on success. 1889 * Returns error and drops reference to input namei data on failure. 1890 */ 1891 static int link_path_walk(const char *name, struct nameidata *nd) 1892 { 1893 int err; 1894 1895 while (*name=='/') 1896 name++; 1897 if (!*name) 1898 return 0; 1899 1900 /* At this point we know we have a real path component. */ 1901 for(;;) { 1902 u64 hash_len; 1903 int type; 1904 1905 err = may_lookup(nd); 1906 if (err) 1907 return err; 1908 1909 hash_len = hash_name(name); 1910 1911 type = LAST_NORM; 1912 if (name[0] == '.') switch (hashlen_len(hash_len)) { 1913 case 2: 1914 if (name[1] == '.') { 1915 type = LAST_DOTDOT; 1916 nd->flags |= LOOKUP_JUMPED; 1917 } 1918 break; 1919 case 1: 1920 type = LAST_DOT; 1921 } 1922 if (likely(type == LAST_NORM)) { 1923 struct dentry *parent = nd->path.dentry; 1924 nd->flags &= ~LOOKUP_JUMPED; 1925 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { 1926 struct qstr this = { { .hash_len = hash_len }, .name = name }; 1927 err = parent->d_op->d_hash(parent, &this); 1928 if (err < 0) 1929 return err; 1930 hash_len = this.hash_len; 1931 name = this.name; 1932 } 1933 } 1934 1935 nd->last.hash_len = hash_len; 1936 nd->last.name = name; 1937 nd->last_type = type; 1938 1939 name += hashlen_len(hash_len); 1940 if (!*name) 1941 goto OK; 1942 /* 1943 * If it wasn't NUL, we know it was '/'. Skip that 1944 * slash, and continue until no more slashes. 1945 */ 1946 do { 1947 name++; 1948 } while (unlikely(*name == '/')); 1949 if (unlikely(!*name)) { 1950 OK: 1951 /* pathname body, done */ 1952 if (!nd->depth) 1953 return 0; 1954 name = nd->stack[nd->depth - 1].name; 1955 /* trailing symlink, done */ 1956 if (!name) 1957 return 0; 1958 /* last component of nested symlink */ 1959 err = walk_component(nd, WALK_GET | WALK_PUT); 1960 } else { 1961 err = walk_component(nd, WALK_GET); 1962 } 1963 if (err < 0) 1964 return err; 1965 1966 if (err) { 1967 const char *s = get_link(nd); 1968 1969 if (IS_ERR(s)) 1970 return PTR_ERR(s); 1971 err = 0; 1972 if (unlikely(!s)) { 1973 /* jumped */ 1974 put_link(nd); 1975 } else { 1976 nd->stack[nd->depth - 1].name = name; 1977 name = s; 1978 continue; 1979 } 1980 } 1981 if (unlikely(!d_can_lookup(nd->path.dentry))) { 1982 if (nd->flags & LOOKUP_RCU) { 1983 if (unlazy_walk(nd, NULL, 0)) 1984 return -ECHILD; 1985 } 1986 return -ENOTDIR; 1987 } 1988 } 1989 } 1990 1991 static const char *path_init(struct nameidata *nd, unsigned flags) 1992 { 1993 int retval = 0; 1994 const char *s = nd->name->name; 1995 1996 nd->last_type = LAST_ROOT; /* if there are only slashes... */ 1997 nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT; 1998 nd->depth = 0; 1999 if (flags & LOOKUP_ROOT) { 2000 struct dentry *root = nd->root.dentry; 2001 struct inode *inode = root->d_inode; 2002 if (*s) { 2003 if (!d_can_lookup(root)) 2004 return ERR_PTR(-ENOTDIR); 2005 retval = inode_permission(inode, MAY_EXEC); 2006 if (retval) 2007 return ERR_PTR(retval); 2008 } 2009 nd->path = nd->root; 2010 nd->inode = inode; 2011 if (flags & LOOKUP_RCU) { 2012 rcu_read_lock(); 2013 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 2014 nd->root_seq = nd->seq; 2015 nd->m_seq = read_seqbegin(&mount_lock); 2016 } else { 2017 path_get(&nd->path); 2018 } 2019 return s; 2020 } 2021 2022 nd->root.mnt = NULL; 2023 nd->path.mnt = NULL; 2024 nd->path.dentry = NULL; 2025 2026 nd->m_seq = read_seqbegin(&mount_lock); 2027 if (*s == '/') { 2028 if (flags & LOOKUP_RCU) 2029 rcu_read_lock(); 2030 set_root(nd); 2031 if (likely(!nd_jump_root(nd))) 2032 return s; 2033 nd->root.mnt = NULL; 2034 rcu_read_unlock(); 2035 return ERR_PTR(-ECHILD); 2036 } else if (nd->dfd == AT_FDCWD) { 2037 if (flags & LOOKUP_RCU) { 2038 struct fs_struct *fs = current->fs; 2039 unsigned seq; 2040 2041 rcu_read_lock(); 2042 2043 do { 2044 seq = read_seqcount_begin(&fs->seq); 2045 nd->path = fs->pwd; 2046 nd->inode = nd->path.dentry->d_inode; 2047 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 2048 } while (read_seqcount_retry(&fs->seq, seq)); 2049 } else { 2050 get_fs_pwd(current->fs, &nd->path); 2051 nd->inode = nd->path.dentry->d_inode; 2052 } 2053 return s; 2054 } else { 2055 /* Caller must check execute permissions on the starting path component */ 2056 struct fd f = fdget_raw(nd->dfd); 2057 struct dentry *dentry; 2058 2059 if (!f.file) 2060 return ERR_PTR(-EBADF); 2061 2062 dentry = f.file->f_path.dentry; 2063 2064 if (*s) { 2065 if (!d_can_lookup(dentry)) { 2066 fdput(f); 2067 return ERR_PTR(-ENOTDIR); 2068 } 2069 } 2070 2071 nd->path = f.file->f_path; 2072 if (flags & LOOKUP_RCU) { 2073 rcu_read_lock(); 2074 nd->inode = nd->path.dentry->d_inode; 2075 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 2076 } else { 2077 path_get(&nd->path); 2078 nd->inode = nd->path.dentry->d_inode; 2079 } 2080 fdput(f); 2081 return s; 2082 } 2083 } 2084 2085 static const char *trailing_symlink(struct nameidata *nd) 2086 { 2087 const char *s; 2088 int error = may_follow_link(nd); 2089 if (unlikely(error)) 2090 return ERR_PTR(error); 2091 nd->flags |= LOOKUP_PARENT; 2092 nd->stack[0].name = NULL; 2093 s = get_link(nd); 2094 return s ? s : ""; 2095 } 2096 2097 static inline int lookup_last(struct nameidata *nd) 2098 { 2099 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len]) 2100 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 2101 2102 nd->flags &= ~LOOKUP_PARENT; 2103 return walk_component(nd, 2104 nd->flags & LOOKUP_FOLLOW 2105 ? nd->depth 2106 ? WALK_PUT | WALK_GET 2107 : WALK_GET 2108 : 0); 2109 } 2110 2111 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 2112 static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path) 2113 { 2114 const char *s = path_init(nd, flags); 2115 int err; 2116 2117 if (IS_ERR(s)) 2118 return PTR_ERR(s); 2119 while (!(err = link_path_walk(s, nd)) 2120 && ((err = lookup_last(nd)) > 0)) { 2121 s = trailing_symlink(nd); 2122 if (IS_ERR(s)) { 2123 err = PTR_ERR(s); 2124 break; 2125 } 2126 } 2127 if (!err) 2128 err = complete_walk(nd); 2129 2130 if (!err && nd->flags & LOOKUP_DIRECTORY) 2131 if (!d_can_lookup(nd->path.dentry)) 2132 err = -ENOTDIR; 2133 if (!err) { 2134 *path = nd->path; 2135 nd->path.mnt = NULL; 2136 nd->path.dentry = NULL; 2137 } 2138 terminate_walk(nd); 2139 return err; 2140 } 2141 2142 static int filename_lookup(int dfd, struct filename *name, unsigned flags, 2143 struct path *path, struct path *root) 2144 { 2145 int retval; 2146 struct nameidata nd; 2147 if (IS_ERR(name)) 2148 return PTR_ERR(name); 2149 if (unlikely(root)) { 2150 nd.root = *root; 2151 flags |= LOOKUP_ROOT; 2152 } 2153 set_nameidata(&nd, dfd, name); 2154 retval = path_lookupat(&nd, flags | LOOKUP_RCU, path); 2155 if (unlikely(retval == -ECHILD)) 2156 retval = path_lookupat(&nd, flags, path); 2157 if (unlikely(retval == -ESTALE)) 2158 retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path); 2159 2160 if (likely(!retval)) 2161 audit_inode(name, path->dentry, flags & LOOKUP_PARENT); 2162 restore_nameidata(); 2163 putname(name); 2164 return retval; 2165 } 2166 2167 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 2168 static int path_parentat(struct nameidata *nd, unsigned flags, 2169 struct path *parent) 2170 { 2171 const char *s = path_init(nd, flags); 2172 int err; 2173 if (IS_ERR(s)) 2174 return PTR_ERR(s); 2175 err = link_path_walk(s, nd); 2176 if (!err) 2177 err = complete_walk(nd); 2178 if (!err) { 2179 *parent = nd->path; 2180 nd->path.mnt = NULL; 2181 nd->path.dentry = NULL; 2182 } 2183 terminate_walk(nd); 2184 return err; 2185 } 2186 2187 static struct filename *filename_parentat(int dfd, struct filename *name, 2188 unsigned int flags, struct path *parent, 2189 struct qstr *last, int *type) 2190 { 2191 int retval; 2192 struct nameidata nd; 2193 2194 if (IS_ERR(name)) 2195 return name; 2196 set_nameidata(&nd, dfd, name); 2197 retval = path_parentat(&nd, flags | LOOKUP_RCU, parent); 2198 if (unlikely(retval == -ECHILD)) 2199 retval = path_parentat(&nd, flags, parent); 2200 if (unlikely(retval == -ESTALE)) 2201 retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent); 2202 if (likely(!retval)) { 2203 *last = nd.last; 2204 *type = nd.last_type; 2205 audit_inode(name, parent->dentry, LOOKUP_PARENT); 2206 } else { 2207 putname(name); 2208 name = ERR_PTR(retval); 2209 } 2210 restore_nameidata(); 2211 return name; 2212 } 2213 2214 /* does lookup, returns the object with parent locked */ 2215 struct dentry *kern_path_locked(const char *name, struct path *path) 2216 { 2217 struct filename *filename; 2218 struct dentry *d; 2219 struct qstr last; 2220 int type; 2221 2222 filename = filename_parentat(AT_FDCWD, getname_kernel(name), 0, path, 2223 &last, &type); 2224 if (IS_ERR(filename)) 2225 return ERR_CAST(filename); 2226 if (unlikely(type != LAST_NORM)) { 2227 path_put(path); 2228 putname(filename); 2229 return ERR_PTR(-EINVAL); 2230 } 2231 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT); 2232 d = __lookup_hash(&last, path->dentry, 0); 2233 if (IS_ERR(d)) { 2234 inode_unlock(path->dentry->d_inode); 2235 path_put(path); 2236 } 2237 putname(filename); 2238 return d; 2239 } 2240 2241 int kern_path(const char *name, unsigned int flags, struct path *path) 2242 { 2243 return filename_lookup(AT_FDCWD, getname_kernel(name), 2244 flags, path, NULL); 2245 } 2246 EXPORT_SYMBOL(kern_path); 2247 2248 /** 2249 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair 2250 * @dentry: pointer to dentry of the base directory 2251 * @mnt: pointer to vfs mount of the base directory 2252 * @name: pointer to file name 2253 * @flags: lookup flags 2254 * @path: pointer to struct path to fill 2255 */ 2256 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, 2257 const char *name, unsigned int flags, 2258 struct path *path) 2259 { 2260 struct path root = {.mnt = mnt, .dentry = dentry}; 2261 /* the first argument of filename_lookup() is ignored with root */ 2262 return filename_lookup(AT_FDCWD, getname_kernel(name), 2263 flags , path, &root); 2264 } 2265 EXPORT_SYMBOL(vfs_path_lookup); 2266 2267 /** 2268 * lookup_one_len - filesystem helper to lookup single pathname component 2269 * @name: pathname component to lookup 2270 * @base: base directory to lookup from 2271 * @len: maximum length @len should be interpreted to 2272 * 2273 * Note that this routine is purely a helper for filesystem usage and should 2274 * not be called by generic code. 2275 * 2276 * The caller must hold base->i_mutex. 2277 */ 2278 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len) 2279 { 2280 struct qstr this; 2281 unsigned int c; 2282 int err; 2283 2284 WARN_ON_ONCE(!inode_is_locked(base->d_inode)); 2285 2286 this.name = name; 2287 this.len = len; 2288 this.hash = full_name_hash(name, len); 2289 if (!len) 2290 return ERR_PTR(-EACCES); 2291 2292 if (unlikely(name[0] == '.')) { 2293 if (len < 2 || (len == 2 && name[1] == '.')) 2294 return ERR_PTR(-EACCES); 2295 } 2296 2297 while (len--) { 2298 c = *(const unsigned char *)name++; 2299 if (c == '/' || c == '\0') 2300 return ERR_PTR(-EACCES); 2301 } 2302 /* 2303 * See if the low-level filesystem might want 2304 * to use its own hash.. 2305 */ 2306 if (base->d_flags & DCACHE_OP_HASH) { 2307 int err = base->d_op->d_hash(base, &this); 2308 if (err < 0) 2309 return ERR_PTR(err); 2310 } 2311 2312 err = inode_permission(base->d_inode, MAY_EXEC); 2313 if (err) 2314 return ERR_PTR(err); 2315 2316 return __lookup_hash(&this, base, 0); 2317 } 2318 EXPORT_SYMBOL(lookup_one_len); 2319 2320 /** 2321 * lookup_one_len_unlocked - filesystem helper to lookup single pathname component 2322 * @name: pathname component to lookup 2323 * @base: base directory to lookup from 2324 * @len: maximum length @len should be interpreted to 2325 * 2326 * Note that this routine is purely a helper for filesystem usage and should 2327 * not be called by generic code. 2328 * 2329 * Unlike lookup_one_len, it should be called without the parent 2330 * i_mutex held, and will take the i_mutex itself if necessary. 2331 */ 2332 struct dentry *lookup_one_len_unlocked(const char *name, 2333 struct dentry *base, int len) 2334 { 2335 struct qstr this; 2336 unsigned int c; 2337 int err; 2338 struct dentry *ret; 2339 2340 this.name = name; 2341 this.len = len; 2342 this.hash = full_name_hash(name, len); 2343 if (!len) 2344 return ERR_PTR(-EACCES); 2345 2346 if (unlikely(name[0] == '.')) { 2347 if (len < 2 || (len == 2 && name[1] == '.')) 2348 return ERR_PTR(-EACCES); 2349 } 2350 2351 while (len--) { 2352 c = *(const unsigned char *)name++; 2353 if (c == '/' || c == '\0') 2354 return ERR_PTR(-EACCES); 2355 } 2356 /* 2357 * See if the low-level filesystem might want 2358 * to use its own hash.. 2359 */ 2360 if (base->d_flags & DCACHE_OP_HASH) { 2361 int err = base->d_op->d_hash(base, &this); 2362 if (err < 0) 2363 return ERR_PTR(err); 2364 } 2365 2366 err = inode_permission(base->d_inode, MAY_EXEC); 2367 if (err) 2368 return ERR_PTR(err); 2369 2370 ret = lookup_dcache(&this, base, 0); 2371 if (!ret) 2372 ret = lookup_slow(&this, base, 0); 2373 return ret; 2374 } 2375 EXPORT_SYMBOL(lookup_one_len_unlocked); 2376 2377 int user_path_at_empty(int dfd, const char __user *name, unsigned flags, 2378 struct path *path, int *empty) 2379 { 2380 return filename_lookup(dfd, getname_flags(name, flags, empty), 2381 flags, path, NULL); 2382 } 2383 EXPORT_SYMBOL(user_path_at_empty); 2384 2385 /* 2386 * NB: most callers don't do anything directly with the reference to the 2387 * to struct filename, but the nd->last pointer points into the name string 2388 * allocated by getname. So we must hold the reference to it until all 2389 * path-walking is complete. 2390 */ 2391 static inline struct filename * 2392 user_path_parent(int dfd, const char __user *path, 2393 struct path *parent, 2394 struct qstr *last, 2395 int *type, 2396 unsigned int flags) 2397 { 2398 /* only LOOKUP_REVAL is allowed in extra flags */ 2399 return filename_parentat(dfd, getname(path), flags & LOOKUP_REVAL, 2400 parent, last, type); 2401 } 2402 2403 /** 2404 * mountpoint_last - look up last component for umount 2405 * @nd: pathwalk nameidata - currently pointing at parent directory of "last" 2406 * @path: pointer to container for result 2407 * 2408 * This is a special lookup_last function just for umount. In this case, we 2409 * need to resolve the path without doing any revalidation. 2410 * 2411 * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since 2412 * mountpoints are always pinned in the dcache, their ancestors are too. Thus, 2413 * in almost all cases, this lookup will be served out of the dcache. The only 2414 * cases where it won't are if nd->last refers to a symlink or the path is 2415 * bogus and it doesn't exist. 2416 * 2417 * Returns: 2418 * -error: if there was an error during lookup. This includes -ENOENT if the 2419 * lookup found a negative dentry. The nd->path reference will also be 2420 * put in this case. 2421 * 2422 * 0: if we successfully resolved nd->path and found it to not to be a 2423 * symlink that needs to be followed. "path" will also be populated. 2424 * The nd->path reference will also be put. 2425 * 2426 * 1: if we successfully resolved nd->last and found it to be a symlink 2427 * that needs to be followed. "path" will be populated with the path 2428 * to the link, and nd->path will *not* be put. 2429 */ 2430 static int 2431 mountpoint_last(struct nameidata *nd, struct path *path) 2432 { 2433 int error = 0; 2434 struct dentry *dentry; 2435 struct dentry *dir = nd->path.dentry; 2436 2437 /* If we're in rcuwalk, drop out of it to handle last component */ 2438 if (nd->flags & LOOKUP_RCU) { 2439 if (unlazy_walk(nd, NULL, 0)) 2440 return -ECHILD; 2441 } 2442 2443 nd->flags &= ~LOOKUP_PARENT; 2444 2445 if (unlikely(nd->last_type != LAST_NORM)) { 2446 error = handle_dots(nd, nd->last_type); 2447 if (error) 2448 return error; 2449 dentry = dget(nd->path.dentry); 2450 } else { 2451 dentry = d_lookup(dir, &nd->last); 2452 if (!dentry) { 2453 /* 2454 * No cached dentry. Mounted dentries are pinned in the 2455 * cache, so that means that this dentry is probably 2456 * a symlink or the path doesn't actually point 2457 * to a mounted dentry. 2458 */ 2459 dentry = lookup_slow(&nd->last, dir, 2460 nd->flags | LOOKUP_NO_REVAL); 2461 if (IS_ERR(dentry)) 2462 return PTR_ERR(dentry); 2463 } 2464 } 2465 if (d_is_negative(dentry)) { 2466 dput(dentry); 2467 return -ENOENT; 2468 } 2469 if (nd->depth) 2470 put_link(nd); 2471 path->dentry = dentry; 2472 path->mnt = nd->path.mnt; 2473 error = should_follow_link(nd, path, nd->flags & LOOKUP_FOLLOW, 2474 d_backing_inode(dentry), 0); 2475 if (unlikely(error)) 2476 return error; 2477 mntget(path->mnt); 2478 follow_mount(path); 2479 return 0; 2480 } 2481 2482 /** 2483 * path_mountpoint - look up a path to be umounted 2484 * @nd: lookup context 2485 * @flags: lookup flags 2486 * @path: pointer to container for result 2487 * 2488 * Look up the given name, but don't attempt to revalidate the last component. 2489 * Returns 0 and "path" will be valid on success; Returns error otherwise. 2490 */ 2491 static int 2492 path_mountpoint(struct nameidata *nd, unsigned flags, struct path *path) 2493 { 2494 const char *s = path_init(nd, flags); 2495 int err; 2496 if (IS_ERR(s)) 2497 return PTR_ERR(s); 2498 while (!(err = link_path_walk(s, nd)) && 2499 (err = mountpoint_last(nd, path)) > 0) { 2500 s = trailing_symlink(nd); 2501 if (IS_ERR(s)) { 2502 err = PTR_ERR(s); 2503 break; 2504 } 2505 } 2506 terminate_walk(nd); 2507 return err; 2508 } 2509 2510 static int 2511 filename_mountpoint(int dfd, struct filename *name, struct path *path, 2512 unsigned int flags) 2513 { 2514 struct nameidata nd; 2515 int error; 2516 if (IS_ERR(name)) 2517 return PTR_ERR(name); 2518 set_nameidata(&nd, dfd, name); 2519 error = path_mountpoint(&nd, flags | LOOKUP_RCU, path); 2520 if (unlikely(error == -ECHILD)) 2521 error = path_mountpoint(&nd, flags, path); 2522 if (unlikely(error == -ESTALE)) 2523 error = path_mountpoint(&nd, flags | LOOKUP_REVAL, path); 2524 if (likely(!error)) 2525 audit_inode(name, path->dentry, 0); 2526 restore_nameidata(); 2527 putname(name); 2528 return error; 2529 } 2530 2531 /** 2532 * user_path_mountpoint_at - lookup a path from userland in order to umount it 2533 * @dfd: directory file descriptor 2534 * @name: pathname from userland 2535 * @flags: lookup flags 2536 * @path: pointer to container to hold result 2537 * 2538 * A umount is a special case for path walking. We're not actually interested 2539 * in the inode in this situation, and ESTALE errors can be a problem. We 2540 * simply want track down the dentry and vfsmount attached at the mountpoint 2541 * and avoid revalidating the last component. 2542 * 2543 * Returns 0 and populates "path" on success. 2544 */ 2545 int 2546 user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags, 2547 struct path *path) 2548 { 2549 return filename_mountpoint(dfd, getname(name), path, flags); 2550 } 2551 2552 int 2553 kern_path_mountpoint(int dfd, const char *name, struct path *path, 2554 unsigned int flags) 2555 { 2556 return filename_mountpoint(dfd, getname_kernel(name), path, flags); 2557 } 2558 EXPORT_SYMBOL(kern_path_mountpoint); 2559 2560 int __check_sticky(struct inode *dir, struct inode *inode) 2561 { 2562 kuid_t fsuid = current_fsuid(); 2563 2564 if (uid_eq(inode->i_uid, fsuid)) 2565 return 0; 2566 if (uid_eq(dir->i_uid, fsuid)) 2567 return 0; 2568 return !capable_wrt_inode_uidgid(inode, CAP_FOWNER); 2569 } 2570 EXPORT_SYMBOL(__check_sticky); 2571 2572 /* 2573 * Check whether we can remove a link victim from directory dir, check 2574 * whether the type of victim is right. 2575 * 1. We can't do it if dir is read-only (done in permission()) 2576 * 2. We should have write and exec permissions on dir 2577 * 3. We can't remove anything from append-only dir 2578 * 4. We can't do anything with immutable dir (done in permission()) 2579 * 5. If the sticky bit on dir is set we should either 2580 * a. be owner of dir, or 2581 * b. be owner of victim, or 2582 * c. have CAP_FOWNER capability 2583 * 6. If the victim is append-only or immutable we can't do antyhing with 2584 * links pointing to it. 2585 * 7. If we were asked to remove a directory and victim isn't one - ENOTDIR. 2586 * 8. If we were asked to remove a non-directory and victim isn't one - EISDIR. 2587 * 9. We can't remove a root or mountpoint. 2588 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by 2589 * nfs_async_unlink(). 2590 */ 2591 static int may_delete(struct inode *dir, struct dentry *victim, bool isdir) 2592 { 2593 struct inode *inode = d_backing_inode(victim); 2594 int error; 2595 2596 if (d_is_negative(victim)) 2597 return -ENOENT; 2598 BUG_ON(!inode); 2599 2600 BUG_ON(victim->d_parent->d_inode != dir); 2601 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE); 2602 2603 error = inode_permission(dir, MAY_WRITE | MAY_EXEC); 2604 if (error) 2605 return error; 2606 if (IS_APPEND(dir)) 2607 return -EPERM; 2608 2609 if (check_sticky(dir, inode) || IS_APPEND(inode) || 2610 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode)) 2611 return -EPERM; 2612 if (isdir) { 2613 if (!d_is_dir(victim)) 2614 return -ENOTDIR; 2615 if (IS_ROOT(victim)) 2616 return -EBUSY; 2617 } else if (d_is_dir(victim)) 2618 return -EISDIR; 2619 if (IS_DEADDIR(dir)) 2620 return -ENOENT; 2621 if (victim->d_flags & DCACHE_NFSFS_RENAMED) 2622 return -EBUSY; 2623 return 0; 2624 } 2625 2626 /* Check whether we can create an object with dentry child in directory 2627 * dir. 2628 * 1. We can't do it if child already exists (open has special treatment for 2629 * this case, but since we are inlined it's OK) 2630 * 2. We can't do it if dir is read-only (done in permission()) 2631 * 3. We should have write and exec permissions on dir 2632 * 4. We can't do it if dir is immutable (done in permission()) 2633 */ 2634 static inline int may_create(struct inode *dir, struct dentry *child) 2635 { 2636 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE); 2637 if (child->d_inode) 2638 return -EEXIST; 2639 if (IS_DEADDIR(dir)) 2640 return -ENOENT; 2641 return inode_permission(dir, MAY_WRITE | MAY_EXEC); 2642 } 2643 2644 /* 2645 * p1 and p2 should be directories on the same fs. 2646 */ 2647 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) 2648 { 2649 struct dentry *p; 2650 2651 if (p1 == p2) { 2652 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 2653 return NULL; 2654 } 2655 2656 mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 2657 2658 p = d_ancestor(p2, p1); 2659 if (p) { 2660 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); 2661 inode_lock_nested(p1->d_inode, I_MUTEX_CHILD); 2662 return p; 2663 } 2664 2665 p = d_ancestor(p1, p2); 2666 if (p) { 2667 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 2668 inode_lock_nested(p2->d_inode, I_MUTEX_CHILD); 2669 return p; 2670 } 2671 2672 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); 2673 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2); 2674 return NULL; 2675 } 2676 EXPORT_SYMBOL(lock_rename); 2677 2678 void unlock_rename(struct dentry *p1, struct dentry *p2) 2679 { 2680 inode_unlock(p1->d_inode); 2681 if (p1 != p2) { 2682 inode_unlock(p2->d_inode); 2683 mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 2684 } 2685 } 2686 EXPORT_SYMBOL(unlock_rename); 2687 2688 int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, 2689 bool want_excl) 2690 { 2691 int error = may_create(dir, dentry); 2692 if (error) 2693 return error; 2694 2695 if (!dir->i_op->create) 2696 return -EACCES; /* shouldn't it be ENOSYS? */ 2697 mode &= S_IALLUGO; 2698 mode |= S_IFREG; 2699 error = security_inode_create(dir, dentry, mode); 2700 if (error) 2701 return error; 2702 error = dir->i_op->create(dir, dentry, mode, want_excl); 2703 if (!error) 2704 fsnotify_create(dir, dentry); 2705 return error; 2706 } 2707 EXPORT_SYMBOL(vfs_create); 2708 2709 static int may_open(struct path *path, int acc_mode, int flag) 2710 { 2711 struct dentry *dentry = path->dentry; 2712 struct inode *inode = dentry->d_inode; 2713 int error; 2714 2715 if (!inode) 2716 return -ENOENT; 2717 2718 switch (inode->i_mode & S_IFMT) { 2719 case S_IFLNK: 2720 return -ELOOP; 2721 case S_IFDIR: 2722 if (acc_mode & MAY_WRITE) 2723 return -EISDIR; 2724 break; 2725 case S_IFBLK: 2726 case S_IFCHR: 2727 if (path->mnt->mnt_flags & MNT_NODEV) 2728 return -EACCES; 2729 /*FALLTHRU*/ 2730 case S_IFIFO: 2731 case S_IFSOCK: 2732 flag &= ~O_TRUNC; 2733 break; 2734 } 2735 2736 error = inode_permission(inode, MAY_OPEN | acc_mode); 2737 if (error) 2738 return error; 2739 2740 /* 2741 * An append-only file must be opened in append mode for writing. 2742 */ 2743 if (IS_APPEND(inode)) { 2744 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND)) 2745 return -EPERM; 2746 if (flag & O_TRUNC) 2747 return -EPERM; 2748 } 2749 2750 /* O_NOATIME can only be set by the owner or superuser */ 2751 if (flag & O_NOATIME && !inode_owner_or_capable(inode)) 2752 return -EPERM; 2753 2754 return 0; 2755 } 2756 2757 static int handle_truncate(struct file *filp) 2758 { 2759 struct path *path = &filp->f_path; 2760 struct inode *inode = path->dentry->d_inode; 2761 int error = get_write_access(inode); 2762 if (error) 2763 return error; 2764 /* 2765 * Refuse to truncate files with mandatory locks held on them. 2766 */ 2767 error = locks_verify_locked(filp); 2768 if (!error) 2769 error = security_path_truncate(path); 2770 if (!error) { 2771 error = do_truncate(path->dentry, 0, 2772 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN, 2773 filp); 2774 } 2775 put_write_access(inode); 2776 return error; 2777 } 2778 2779 static inline int open_to_namei_flags(int flag) 2780 { 2781 if ((flag & O_ACCMODE) == 3) 2782 flag--; 2783 return flag; 2784 } 2785 2786 static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode) 2787 { 2788 int error = security_path_mknod(dir, dentry, mode, 0); 2789 if (error) 2790 return error; 2791 2792 error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC); 2793 if (error) 2794 return error; 2795 2796 return security_inode_create(dir->dentry->d_inode, dentry, mode); 2797 } 2798 2799 /* 2800 * Attempt to atomically look up, create and open a file from a negative 2801 * dentry. 2802 * 2803 * Returns 0 if successful. The file will have been created and attached to 2804 * @file by the filesystem calling finish_open(). 2805 * 2806 * Returns 1 if the file was looked up only or didn't need creating. The 2807 * caller will need to perform the open themselves. @path will have been 2808 * updated to point to the new dentry. This may be negative. 2809 * 2810 * Returns an error code otherwise. 2811 */ 2812 static int atomic_open(struct nameidata *nd, struct dentry *dentry, 2813 struct path *path, struct file *file, 2814 const struct open_flags *op, 2815 bool got_write, bool need_lookup, 2816 int *opened) 2817 { 2818 struct inode *dir = nd->path.dentry->d_inode; 2819 unsigned open_flag = open_to_namei_flags(op->open_flag); 2820 umode_t mode; 2821 int error; 2822 int acc_mode; 2823 int create_error = 0; 2824 struct dentry *const DENTRY_NOT_SET = (void *) -1UL; 2825 bool excl; 2826 2827 BUG_ON(dentry->d_inode); 2828 2829 /* Don't create child dentry for a dead directory. */ 2830 if (unlikely(IS_DEADDIR(dir))) { 2831 error = -ENOENT; 2832 goto out; 2833 } 2834 2835 mode = op->mode; 2836 if ((open_flag & O_CREAT) && !IS_POSIXACL(dir)) 2837 mode &= ~current_umask(); 2838 2839 excl = (open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT); 2840 if (excl) 2841 open_flag &= ~O_TRUNC; 2842 2843 /* 2844 * Checking write permission is tricky, bacuse we don't know if we are 2845 * going to actually need it: O_CREAT opens should work as long as the 2846 * file exists. But checking existence breaks atomicity. The trick is 2847 * to check access and if not granted clear O_CREAT from the flags. 2848 * 2849 * Another problem is returing the "right" error value (e.g. for an 2850 * O_EXCL open we want to return EEXIST not EROFS). 2851 */ 2852 if (((open_flag & (O_CREAT | O_TRUNC)) || 2853 (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) { 2854 if (!(open_flag & O_CREAT)) { 2855 /* 2856 * No O_CREATE -> atomicity not a requirement -> fall 2857 * back to lookup + open 2858 */ 2859 goto no_open; 2860 } else if (open_flag & (O_EXCL | O_TRUNC)) { 2861 /* Fall back and fail with the right error */ 2862 create_error = -EROFS; 2863 goto no_open; 2864 } else { 2865 /* No side effects, safe to clear O_CREAT */ 2866 create_error = -EROFS; 2867 open_flag &= ~O_CREAT; 2868 } 2869 } 2870 2871 if (open_flag & O_CREAT) { 2872 error = may_o_create(&nd->path, dentry, mode); 2873 if (error) { 2874 create_error = error; 2875 if (open_flag & O_EXCL) 2876 goto no_open; 2877 open_flag &= ~O_CREAT; 2878 } 2879 } 2880 2881 if (nd->flags & LOOKUP_DIRECTORY) 2882 open_flag |= O_DIRECTORY; 2883 2884 file->f_path.dentry = DENTRY_NOT_SET; 2885 file->f_path.mnt = nd->path.mnt; 2886 error = dir->i_op->atomic_open(dir, dentry, file, open_flag, mode, 2887 opened); 2888 if (error < 0) { 2889 if (create_error && error == -ENOENT) 2890 error = create_error; 2891 goto out; 2892 } 2893 2894 if (error) { /* returned 1, that is */ 2895 if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) { 2896 error = -EIO; 2897 goto out; 2898 } 2899 if (file->f_path.dentry) { 2900 dput(dentry); 2901 dentry = file->f_path.dentry; 2902 } 2903 if (*opened & FILE_CREATED) 2904 fsnotify_create(dir, dentry); 2905 if (!dentry->d_inode) { 2906 WARN_ON(*opened & FILE_CREATED); 2907 if (create_error) { 2908 error = create_error; 2909 goto out; 2910 } 2911 } else { 2912 if (excl && !(*opened & FILE_CREATED)) { 2913 error = -EEXIST; 2914 goto out; 2915 } 2916 } 2917 goto looked_up; 2918 } 2919 2920 /* 2921 * We didn't have the inode before the open, so check open permission 2922 * here. 2923 */ 2924 acc_mode = op->acc_mode; 2925 if (*opened & FILE_CREATED) { 2926 WARN_ON(!(open_flag & O_CREAT)); 2927 fsnotify_create(dir, dentry); 2928 acc_mode = 0; 2929 } 2930 error = may_open(&file->f_path, acc_mode, open_flag); 2931 if (error) 2932 fput(file); 2933 2934 out: 2935 dput(dentry); 2936 return error; 2937 2938 no_open: 2939 if (need_lookup) { 2940 dentry = lookup_real(dir, dentry, nd->flags); 2941 if (IS_ERR(dentry)) 2942 return PTR_ERR(dentry); 2943 2944 if (create_error) { 2945 int open_flag = op->open_flag; 2946 2947 error = create_error; 2948 if ((open_flag & O_EXCL)) { 2949 if (!dentry->d_inode) 2950 goto out; 2951 } else if (!dentry->d_inode) { 2952 goto out; 2953 } else if ((open_flag & O_TRUNC) && 2954 d_is_reg(dentry)) { 2955 goto out; 2956 } 2957 /* will fail later, go on to get the right error */ 2958 } 2959 } 2960 looked_up: 2961 path->dentry = dentry; 2962 path->mnt = nd->path.mnt; 2963 return 1; 2964 } 2965 2966 /* 2967 * Look up and maybe create and open the last component. 2968 * 2969 * Must be called with i_mutex held on parent. 2970 * 2971 * Returns 0 if the file was successfully atomically created (if necessary) and 2972 * opened. In this case the file will be returned attached to @file. 2973 * 2974 * Returns 1 if the file was not completely opened at this time, though lookups 2975 * and creations will have been performed and the dentry returned in @path will 2976 * be positive upon return if O_CREAT was specified. If O_CREAT wasn't 2977 * specified then a negative dentry may be returned. 2978 * 2979 * An error code is returned otherwise. 2980 * 2981 * FILE_CREATE will be set in @*opened if the dentry was created and will be 2982 * cleared otherwise prior to returning. 2983 */ 2984 static int lookup_open(struct nameidata *nd, struct path *path, 2985 struct file *file, 2986 const struct open_flags *op, 2987 bool got_write, int *opened) 2988 { 2989 struct dentry *dir = nd->path.dentry; 2990 struct inode *dir_inode = dir->d_inode; 2991 struct dentry *dentry; 2992 int error; 2993 bool need_lookup = false; 2994 2995 *opened &= ~FILE_CREATED; 2996 dentry = lookup_dcache(&nd->last, dir, nd->flags); 2997 if (IS_ERR(dentry)) 2998 return PTR_ERR(dentry); 2999 3000 if (!dentry) { 3001 dentry = d_alloc(dir, &nd->last); 3002 if (unlikely(!dentry)) 3003 return -ENOMEM; 3004 need_lookup = true; 3005 } else if (dentry->d_inode) { 3006 /* Cached positive dentry: will open in f_op->open */ 3007 goto out_no_open; 3008 } 3009 3010 if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) { 3011 return atomic_open(nd, dentry, path, file, op, got_write, 3012 need_lookup, opened); 3013 } 3014 3015 if (need_lookup) { 3016 BUG_ON(dentry->d_inode); 3017 3018 dentry = lookup_real(dir_inode, dentry, nd->flags); 3019 if (IS_ERR(dentry)) 3020 return PTR_ERR(dentry); 3021 } 3022 3023 /* Negative dentry, just create the file */ 3024 if (!dentry->d_inode && (op->open_flag & O_CREAT)) { 3025 umode_t mode = op->mode; 3026 if (!IS_POSIXACL(dir->d_inode)) 3027 mode &= ~current_umask(); 3028 /* 3029 * This write is needed to ensure that a 3030 * rw->ro transition does not occur between 3031 * the time when the file is created and when 3032 * a permanent write count is taken through 3033 * the 'struct file' in finish_open(). 3034 */ 3035 if (!got_write) { 3036 error = -EROFS; 3037 goto out_dput; 3038 } 3039 *opened |= FILE_CREATED; 3040 error = security_path_mknod(&nd->path, dentry, mode, 0); 3041 if (error) 3042 goto out_dput; 3043 error = vfs_create(dir->d_inode, dentry, mode, 3044 nd->flags & LOOKUP_EXCL); 3045 if (error) 3046 goto out_dput; 3047 } 3048 out_no_open: 3049 path->dentry = dentry; 3050 path->mnt = nd->path.mnt; 3051 return 1; 3052 3053 out_dput: 3054 dput(dentry); 3055 return error; 3056 } 3057 3058 /* 3059 * Handle the last step of open() 3060 */ 3061 static int do_last(struct nameidata *nd, 3062 struct file *file, const struct open_flags *op, 3063 int *opened) 3064 { 3065 struct dentry *dir = nd->path.dentry; 3066 int open_flag = op->open_flag; 3067 bool will_truncate = (open_flag & O_TRUNC) != 0; 3068 bool got_write = false; 3069 int acc_mode = op->acc_mode; 3070 unsigned seq; 3071 struct inode *inode; 3072 struct path save_parent = { .dentry = NULL, .mnt = NULL }; 3073 struct path path; 3074 bool retried = false; 3075 int error; 3076 3077 nd->flags &= ~LOOKUP_PARENT; 3078 nd->flags |= op->intent; 3079 3080 if (nd->last_type != LAST_NORM) { 3081 error = handle_dots(nd, nd->last_type); 3082 if (unlikely(error)) 3083 return error; 3084 goto finish_open; 3085 } 3086 3087 if (!(open_flag & O_CREAT)) { 3088 if (nd->last.name[nd->last.len]) 3089 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 3090 /* we _can_ be in RCU mode here */ 3091 error = lookup_fast(nd, &path, &inode, &seq); 3092 if (likely(error > 0)) 3093 goto finish_lookup; 3094 3095 if (error < 0) 3096 return error; 3097 3098 BUG_ON(nd->inode != dir->d_inode); 3099 BUG_ON(nd->flags & LOOKUP_RCU); 3100 } else { 3101 /* create side of things */ 3102 /* 3103 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED 3104 * has been cleared when we got to the last component we are 3105 * about to look up 3106 */ 3107 error = complete_walk(nd); 3108 if (error) 3109 return error; 3110 3111 audit_inode(nd->name, dir, LOOKUP_PARENT); 3112 /* trailing slashes? */ 3113 if (unlikely(nd->last.name[nd->last.len])) 3114 return -EISDIR; 3115 } 3116 3117 retry_lookup: 3118 if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) { 3119 error = mnt_want_write(nd->path.mnt); 3120 if (!error) 3121 got_write = true; 3122 /* 3123 * do _not_ fail yet - we might not need that or fail with 3124 * a different error; let lookup_open() decide; we'll be 3125 * dropping this one anyway. 3126 */ 3127 } 3128 inode_lock(dir->d_inode); 3129 error = lookup_open(nd, &path, file, op, got_write, opened); 3130 inode_unlock(dir->d_inode); 3131 3132 if (error <= 0) { 3133 if (error) 3134 goto out; 3135 3136 if ((*opened & FILE_CREATED) || 3137 !S_ISREG(file_inode(file)->i_mode)) 3138 will_truncate = false; 3139 3140 audit_inode(nd->name, file->f_path.dentry, 0); 3141 goto opened; 3142 } 3143 3144 if (*opened & FILE_CREATED) { 3145 /* Don't check for write permission, don't truncate */ 3146 open_flag &= ~O_TRUNC; 3147 will_truncate = false; 3148 acc_mode = 0; 3149 path_to_nameidata(&path, nd); 3150 goto finish_open_created; 3151 } 3152 3153 /* 3154 * If atomic_open() acquired write access it is dropped now due to 3155 * possible mount and symlink following (this might be optimized away if 3156 * necessary...) 3157 */ 3158 if (got_write) { 3159 mnt_drop_write(nd->path.mnt); 3160 got_write = false; 3161 } 3162 3163 if (unlikely(d_is_negative(path.dentry))) { 3164 path_to_nameidata(&path, nd); 3165 return -ENOENT; 3166 } 3167 3168 /* 3169 * create/update audit record if it already exists. 3170 */ 3171 audit_inode(nd->name, path.dentry, 0); 3172 3173 if (unlikely((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))) { 3174 path_to_nameidata(&path, nd); 3175 return -EEXIST; 3176 } 3177 3178 error = follow_managed(&path, nd); 3179 if (unlikely(error < 0)) 3180 return error; 3181 3182 seq = 0; /* out of RCU mode, so the value doesn't matter */ 3183 inode = d_backing_inode(path.dentry); 3184 finish_lookup: 3185 if (nd->depth) 3186 put_link(nd); 3187 error = should_follow_link(nd, &path, nd->flags & LOOKUP_FOLLOW, 3188 inode, seq); 3189 if (unlikely(error)) 3190 return error; 3191 3192 if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path.mnt) { 3193 path_to_nameidata(&path, nd); 3194 } else { 3195 save_parent.dentry = nd->path.dentry; 3196 save_parent.mnt = mntget(path.mnt); 3197 nd->path.dentry = path.dentry; 3198 3199 } 3200 nd->inode = inode; 3201 nd->seq = seq; 3202 /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */ 3203 finish_open: 3204 error = complete_walk(nd); 3205 if (error) { 3206 path_put(&save_parent); 3207 return error; 3208 } 3209 audit_inode(nd->name, nd->path.dentry, 0); 3210 if (unlikely(d_is_symlink(nd->path.dentry)) && !(open_flag & O_PATH)) { 3211 error = -ELOOP; 3212 goto out; 3213 } 3214 error = -EISDIR; 3215 if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) 3216 goto out; 3217 error = -ENOTDIR; 3218 if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry)) 3219 goto out; 3220 if (!d_is_reg(nd->path.dentry)) 3221 will_truncate = false; 3222 3223 if (will_truncate) { 3224 error = mnt_want_write(nd->path.mnt); 3225 if (error) 3226 goto out; 3227 got_write = true; 3228 } 3229 finish_open_created: 3230 if (likely(!(open_flag & O_PATH))) { 3231 error = may_open(&nd->path, acc_mode, open_flag); 3232 if (error) 3233 goto out; 3234 } 3235 BUG_ON(*opened & FILE_OPENED); /* once it's opened, it's opened */ 3236 error = vfs_open(&nd->path, file, current_cred()); 3237 if (!error) { 3238 *opened |= FILE_OPENED; 3239 } else { 3240 if (error == -EOPENSTALE) 3241 goto stale_open; 3242 goto out; 3243 } 3244 opened: 3245 error = open_check_o_direct(file); 3246 if (error) 3247 goto exit_fput; 3248 error = ima_file_check(file, op->acc_mode, *opened); 3249 if (error) 3250 goto exit_fput; 3251 3252 if (will_truncate) { 3253 error = handle_truncate(file); 3254 if (error) 3255 goto exit_fput; 3256 } 3257 out: 3258 if (unlikely(error > 0)) { 3259 WARN_ON(1); 3260 error = -EINVAL; 3261 } 3262 if (got_write) 3263 mnt_drop_write(nd->path.mnt); 3264 path_put(&save_parent); 3265 return error; 3266 3267 exit_fput: 3268 fput(file); 3269 goto out; 3270 3271 stale_open: 3272 /* If no saved parent or already retried then can't retry */ 3273 if (!save_parent.dentry || retried) 3274 goto out; 3275 3276 BUG_ON(save_parent.dentry != dir); 3277 path_put(&nd->path); 3278 nd->path = save_parent; 3279 nd->inode = dir->d_inode; 3280 save_parent.mnt = NULL; 3281 save_parent.dentry = NULL; 3282 if (got_write) { 3283 mnt_drop_write(nd->path.mnt); 3284 got_write = false; 3285 } 3286 retried = true; 3287 goto retry_lookup; 3288 } 3289 3290 static int do_tmpfile(struct nameidata *nd, unsigned flags, 3291 const struct open_flags *op, 3292 struct file *file, int *opened) 3293 { 3294 static const struct qstr name = QSTR_INIT("/", 1); 3295 struct dentry *child; 3296 struct inode *dir; 3297 struct path path; 3298 int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path); 3299 if (unlikely(error)) 3300 return error; 3301 error = mnt_want_write(path.mnt); 3302 if (unlikely(error)) 3303 goto out; 3304 dir = path.dentry->d_inode; 3305 /* we want directory to be writable */ 3306 error = inode_permission(dir, MAY_WRITE | MAY_EXEC); 3307 if (error) 3308 goto out2; 3309 if (!dir->i_op->tmpfile) { 3310 error = -EOPNOTSUPP; 3311 goto out2; 3312 } 3313 child = d_alloc(path.dentry, &name); 3314 if (unlikely(!child)) { 3315 error = -ENOMEM; 3316 goto out2; 3317 } 3318 dput(path.dentry); 3319 path.dentry = child; 3320 error = dir->i_op->tmpfile(dir, child, op->mode); 3321 if (error) 3322 goto out2; 3323 audit_inode(nd->name, child, 0); 3324 /* Don't check for other permissions, the inode was just created */ 3325 error = may_open(&path, 0, op->open_flag); 3326 if (error) 3327 goto out2; 3328 file->f_path.mnt = path.mnt; 3329 error = finish_open(file, child, NULL, opened); 3330 if (error) 3331 goto out2; 3332 error = open_check_o_direct(file); 3333 if (error) { 3334 fput(file); 3335 } else if (!(op->open_flag & O_EXCL)) { 3336 struct inode *inode = file_inode(file); 3337 spin_lock(&inode->i_lock); 3338 inode->i_state |= I_LINKABLE; 3339 spin_unlock(&inode->i_lock); 3340 } 3341 out2: 3342 mnt_drop_write(path.mnt); 3343 out: 3344 path_put(&path); 3345 return error; 3346 } 3347 3348 static struct file *path_openat(struct nameidata *nd, 3349 const struct open_flags *op, unsigned flags) 3350 { 3351 const char *s; 3352 struct file *file; 3353 int opened = 0; 3354 int error; 3355 3356 file = get_empty_filp(); 3357 if (IS_ERR(file)) 3358 return file; 3359 3360 file->f_flags = op->open_flag; 3361 3362 if (unlikely(file->f_flags & __O_TMPFILE)) { 3363 error = do_tmpfile(nd, flags, op, file, &opened); 3364 goto out2; 3365 } 3366 3367 s = path_init(nd, flags); 3368 if (IS_ERR(s)) { 3369 put_filp(file); 3370 return ERR_CAST(s); 3371 } 3372 while (!(error = link_path_walk(s, nd)) && 3373 (error = do_last(nd, file, op, &opened)) > 0) { 3374 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL); 3375 s = trailing_symlink(nd); 3376 if (IS_ERR(s)) { 3377 error = PTR_ERR(s); 3378 break; 3379 } 3380 } 3381 terminate_walk(nd); 3382 out2: 3383 if (!(opened & FILE_OPENED)) { 3384 BUG_ON(!error); 3385 put_filp(file); 3386 } 3387 if (unlikely(error)) { 3388 if (error == -EOPENSTALE) { 3389 if (flags & LOOKUP_RCU) 3390 error = -ECHILD; 3391 else 3392 error = -ESTALE; 3393 } 3394 file = ERR_PTR(error); 3395 } 3396 return file; 3397 } 3398 3399 struct file *do_filp_open(int dfd, struct filename *pathname, 3400 const struct open_flags *op) 3401 { 3402 struct nameidata nd; 3403 int flags = op->lookup_flags; 3404 struct file *filp; 3405 3406 set_nameidata(&nd, dfd, pathname); 3407 filp = path_openat(&nd, op, flags | LOOKUP_RCU); 3408 if (unlikely(filp == ERR_PTR(-ECHILD))) 3409 filp = path_openat(&nd, op, flags); 3410 if (unlikely(filp == ERR_PTR(-ESTALE))) 3411 filp = path_openat(&nd, op, flags | LOOKUP_REVAL); 3412 restore_nameidata(); 3413 return filp; 3414 } 3415 3416 struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt, 3417 const char *name, const struct open_flags *op) 3418 { 3419 struct nameidata nd; 3420 struct file *file; 3421 struct filename *filename; 3422 int flags = op->lookup_flags | LOOKUP_ROOT; 3423 3424 nd.root.mnt = mnt; 3425 nd.root.dentry = dentry; 3426 3427 if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN) 3428 return ERR_PTR(-ELOOP); 3429 3430 filename = getname_kernel(name); 3431 if (IS_ERR(filename)) 3432 return ERR_CAST(filename); 3433 3434 set_nameidata(&nd, -1, filename); 3435 file = path_openat(&nd, op, flags | LOOKUP_RCU); 3436 if (unlikely(file == ERR_PTR(-ECHILD))) 3437 file = path_openat(&nd, op, flags); 3438 if (unlikely(file == ERR_PTR(-ESTALE))) 3439 file = path_openat(&nd, op, flags | LOOKUP_REVAL); 3440 restore_nameidata(); 3441 putname(filename); 3442 return file; 3443 } 3444 3445 static struct dentry *filename_create(int dfd, struct filename *name, 3446 struct path *path, unsigned int lookup_flags) 3447 { 3448 struct dentry *dentry = ERR_PTR(-EEXIST); 3449 struct qstr last; 3450 int type; 3451 int err2; 3452 int error; 3453 bool is_dir = (lookup_flags & LOOKUP_DIRECTORY); 3454 3455 /* 3456 * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any 3457 * other flags passed in are ignored! 3458 */ 3459 lookup_flags &= LOOKUP_REVAL; 3460 3461 name = filename_parentat(dfd, name, lookup_flags, path, &last, &type); 3462 if (IS_ERR(name)) 3463 return ERR_CAST(name); 3464 3465 /* 3466 * Yucky last component or no last component at all? 3467 * (foo/., foo/.., /////) 3468 */ 3469 if (unlikely(type != LAST_NORM)) 3470 goto out; 3471 3472 /* don't fail immediately if it's r/o, at least try to report other errors */ 3473 err2 = mnt_want_write(path->mnt); 3474 /* 3475 * Do the final lookup. 3476 */ 3477 lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL; 3478 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT); 3479 dentry = __lookup_hash(&last, path->dentry, lookup_flags); 3480 if (IS_ERR(dentry)) 3481 goto unlock; 3482 3483 error = -EEXIST; 3484 if (d_is_positive(dentry)) 3485 goto fail; 3486 3487 /* 3488 * Special case - lookup gave negative, but... we had foo/bar/ 3489 * From the vfs_mknod() POV we just have a negative dentry - 3490 * all is fine. Let's be bastards - you had / on the end, you've 3491 * been asking for (non-existent) directory. -ENOENT for you. 3492 */ 3493 if (unlikely(!is_dir && last.name[last.len])) { 3494 error = -ENOENT; 3495 goto fail; 3496 } 3497 if (unlikely(err2)) { 3498 error = err2; 3499 goto fail; 3500 } 3501 putname(name); 3502 return dentry; 3503 fail: 3504 dput(dentry); 3505 dentry = ERR_PTR(error); 3506 unlock: 3507 inode_unlock(path->dentry->d_inode); 3508 if (!err2) 3509 mnt_drop_write(path->mnt); 3510 out: 3511 path_put(path); 3512 putname(name); 3513 return dentry; 3514 } 3515 3516 struct dentry *kern_path_create(int dfd, const char *pathname, 3517 struct path *path, unsigned int lookup_flags) 3518 { 3519 return filename_create(dfd, getname_kernel(pathname), 3520 path, lookup_flags); 3521 } 3522 EXPORT_SYMBOL(kern_path_create); 3523 3524 void done_path_create(struct path *path, struct dentry *dentry) 3525 { 3526 dput(dentry); 3527 inode_unlock(path->dentry->d_inode); 3528 mnt_drop_write(path->mnt); 3529 path_put(path); 3530 } 3531 EXPORT_SYMBOL(done_path_create); 3532 3533 inline struct dentry *user_path_create(int dfd, const char __user *pathname, 3534 struct path *path, unsigned int lookup_flags) 3535 { 3536 return filename_create(dfd, getname(pathname), path, lookup_flags); 3537 } 3538 EXPORT_SYMBOL(user_path_create); 3539 3540 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) 3541 { 3542 int error = may_create(dir, dentry); 3543 3544 if (error) 3545 return error; 3546 3547 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD)) 3548 return -EPERM; 3549 3550 if (!dir->i_op->mknod) 3551 return -EPERM; 3552 3553 error = devcgroup_inode_mknod(mode, dev); 3554 if (error) 3555 return error; 3556 3557 error = security_inode_mknod(dir, dentry, mode, dev); 3558 if (error) 3559 return error; 3560 3561 error = dir->i_op->mknod(dir, dentry, mode, dev); 3562 if (!error) 3563 fsnotify_create(dir, dentry); 3564 return error; 3565 } 3566 EXPORT_SYMBOL(vfs_mknod); 3567 3568 static int may_mknod(umode_t mode) 3569 { 3570 switch (mode & S_IFMT) { 3571 case S_IFREG: 3572 case S_IFCHR: 3573 case S_IFBLK: 3574 case S_IFIFO: 3575 case S_IFSOCK: 3576 case 0: /* zero mode translates to S_IFREG */ 3577 return 0; 3578 case S_IFDIR: 3579 return -EPERM; 3580 default: 3581 return -EINVAL; 3582 } 3583 } 3584 3585 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, 3586 unsigned, dev) 3587 { 3588 struct dentry *dentry; 3589 struct path path; 3590 int error; 3591 unsigned int lookup_flags = 0; 3592 3593 error = may_mknod(mode); 3594 if (error) 3595 return error; 3596 retry: 3597 dentry = user_path_create(dfd, filename, &path, lookup_flags); 3598 if (IS_ERR(dentry)) 3599 return PTR_ERR(dentry); 3600 3601 if (!IS_POSIXACL(path.dentry->d_inode)) 3602 mode &= ~current_umask(); 3603 error = security_path_mknod(&path, dentry, mode, dev); 3604 if (error) 3605 goto out; 3606 switch (mode & S_IFMT) { 3607 case 0: case S_IFREG: 3608 error = vfs_create(path.dentry->d_inode,dentry,mode,true); 3609 break; 3610 case S_IFCHR: case S_IFBLK: 3611 error = vfs_mknod(path.dentry->d_inode,dentry,mode, 3612 new_decode_dev(dev)); 3613 break; 3614 case S_IFIFO: case S_IFSOCK: 3615 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0); 3616 break; 3617 } 3618 out: 3619 done_path_create(&path, dentry); 3620 if (retry_estale(error, lookup_flags)) { 3621 lookup_flags |= LOOKUP_REVAL; 3622 goto retry; 3623 } 3624 return error; 3625 } 3626 3627 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev) 3628 { 3629 return sys_mknodat(AT_FDCWD, filename, mode, dev); 3630 } 3631 3632 int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 3633 { 3634 int error = may_create(dir, dentry); 3635 unsigned max_links = dir->i_sb->s_max_links; 3636 3637 if (error) 3638 return error; 3639 3640 if (!dir->i_op->mkdir) 3641 return -EPERM; 3642 3643 mode &= (S_IRWXUGO|S_ISVTX); 3644 error = security_inode_mkdir(dir, dentry, mode); 3645 if (error) 3646 return error; 3647 3648 if (max_links && dir->i_nlink >= max_links) 3649 return -EMLINK; 3650 3651 error = dir->i_op->mkdir(dir, dentry, mode); 3652 if (!error) 3653 fsnotify_mkdir(dir, dentry); 3654 return error; 3655 } 3656 EXPORT_SYMBOL(vfs_mkdir); 3657 3658 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) 3659 { 3660 struct dentry *dentry; 3661 struct path path; 3662 int error; 3663 unsigned int lookup_flags = LOOKUP_DIRECTORY; 3664 3665 retry: 3666 dentry = user_path_create(dfd, pathname, &path, lookup_flags); 3667 if (IS_ERR(dentry)) 3668 return PTR_ERR(dentry); 3669 3670 if (!IS_POSIXACL(path.dentry->d_inode)) 3671 mode &= ~current_umask(); 3672 error = security_path_mkdir(&path, dentry, mode); 3673 if (!error) 3674 error = vfs_mkdir(path.dentry->d_inode, dentry, mode); 3675 done_path_create(&path, dentry); 3676 if (retry_estale(error, lookup_flags)) { 3677 lookup_flags |= LOOKUP_REVAL; 3678 goto retry; 3679 } 3680 return error; 3681 } 3682 3683 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode) 3684 { 3685 return sys_mkdirat(AT_FDCWD, pathname, mode); 3686 } 3687 3688 int vfs_rmdir(struct inode *dir, struct dentry *dentry) 3689 { 3690 int error = may_delete(dir, dentry, 1); 3691 3692 if (error) 3693 return error; 3694 3695 if (!dir->i_op->rmdir) 3696 return -EPERM; 3697 3698 dget(dentry); 3699 inode_lock(dentry->d_inode); 3700 3701 error = -EBUSY; 3702 if (is_local_mountpoint(dentry)) 3703 goto out; 3704 3705 error = security_inode_rmdir(dir, dentry); 3706 if (error) 3707 goto out; 3708 3709 shrink_dcache_parent(dentry); 3710 error = dir->i_op->rmdir(dir, dentry); 3711 if (error) 3712 goto out; 3713 3714 dentry->d_inode->i_flags |= S_DEAD; 3715 dont_mount(dentry); 3716 detach_mounts(dentry); 3717 3718 out: 3719 inode_unlock(dentry->d_inode); 3720 dput(dentry); 3721 if (!error) 3722 d_delete(dentry); 3723 return error; 3724 } 3725 EXPORT_SYMBOL(vfs_rmdir); 3726 3727 static long do_rmdir(int dfd, const char __user *pathname) 3728 { 3729 int error = 0; 3730 struct filename *name; 3731 struct dentry *dentry; 3732 struct path path; 3733 struct qstr last; 3734 int type; 3735 unsigned int lookup_flags = 0; 3736 retry: 3737 name = user_path_parent(dfd, pathname, 3738 &path, &last, &type, lookup_flags); 3739 if (IS_ERR(name)) 3740 return PTR_ERR(name); 3741 3742 switch (type) { 3743 case LAST_DOTDOT: 3744 error = -ENOTEMPTY; 3745 goto exit1; 3746 case LAST_DOT: 3747 error = -EINVAL; 3748 goto exit1; 3749 case LAST_ROOT: 3750 error = -EBUSY; 3751 goto exit1; 3752 } 3753 3754 error = mnt_want_write(path.mnt); 3755 if (error) 3756 goto exit1; 3757 3758 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT); 3759 dentry = __lookup_hash(&last, path.dentry, lookup_flags); 3760 error = PTR_ERR(dentry); 3761 if (IS_ERR(dentry)) 3762 goto exit2; 3763 if (!dentry->d_inode) { 3764 error = -ENOENT; 3765 goto exit3; 3766 } 3767 error = security_path_rmdir(&path, dentry); 3768 if (error) 3769 goto exit3; 3770 error = vfs_rmdir(path.dentry->d_inode, dentry); 3771 exit3: 3772 dput(dentry); 3773 exit2: 3774 inode_unlock(path.dentry->d_inode); 3775 mnt_drop_write(path.mnt); 3776 exit1: 3777 path_put(&path); 3778 putname(name); 3779 if (retry_estale(error, lookup_flags)) { 3780 lookup_flags |= LOOKUP_REVAL; 3781 goto retry; 3782 } 3783 return error; 3784 } 3785 3786 SYSCALL_DEFINE1(rmdir, const char __user *, pathname) 3787 { 3788 return do_rmdir(AT_FDCWD, pathname); 3789 } 3790 3791 /** 3792 * vfs_unlink - unlink a filesystem object 3793 * @dir: parent directory 3794 * @dentry: victim 3795 * @delegated_inode: returns victim inode, if the inode is delegated. 3796 * 3797 * The caller must hold dir->i_mutex. 3798 * 3799 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and 3800 * return a reference to the inode in delegated_inode. The caller 3801 * should then break the delegation on that inode and retry. Because 3802 * breaking a delegation may take a long time, the caller should drop 3803 * dir->i_mutex before doing so. 3804 * 3805 * Alternatively, a caller may pass NULL for delegated_inode. This may 3806 * be appropriate for callers that expect the underlying filesystem not 3807 * to be NFS exported. 3808 */ 3809 int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode) 3810 { 3811 struct inode *target = dentry->d_inode; 3812 int error = may_delete(dir, dentry, 0); 3813 3814 if (error) 3815 return error; 3816 3817 if (!dir->i_op->unlink) 3818 return -EPERM; 3819 3820 inode_lock(target); 3821 if (is_local_mountpoint(dentry)) 3822 error = -EBUSY; 3823 else { 3824 error = security_inode_unlink(dir, dentry); 3825 if (!error) { 3826 error = try_break_deleg(target, delegated_inode); 3827 if (error) 3828 goto out; 3829 error = dir->i_op->unlink(dir, dentry); 3830 if (!error) { 3831 dont_mount(dentry); 3832 detach_mounts(dentry); 3833 } 3834 } 3835 } 3836 out: 3837 inode_unlock(target); 3838 3839 /* We don't d_delete() NFS sillyrenamed files--they still exist. */ 3840 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) { 3841 fsnotify_link_count(target); 3842 d_delete(dentry); 3843 } 3844 3845 return error; 3846 } 3847 EXPORT_SYMBOL(vfs_unlink); 3848 3849 /* 3850 * Make sure that the actual truncation of the file will occur outside its 3851 * directory's i_mutex. Truncate can take a long time if there is a lot of 3852 * writeout happening, and we don't want to prevent access to the directory 3853 * while waiting on the I/O. 3854 */ 3855 static long do_unlinkat(int dfd, const char __user *pathname) 3856 { 3857 int error; 3858 struct filename *name; 3859 struct dentry *dentry; 3860 struct path path; 3861 struct qstr last; 3862 int type; 3863 struct inode *inode = NULL; 3864 struct inode *delegated_inode = NULL; 3865 unsigned int lookup_flags = 0; 3866 retry: 3867 name = user_path_parent(dfd, pathname, 3868 &path, &last, &type, lookup_flags); 3869 if (IS_ERR(name)) 3870 return PTR_ERR(name); 3871 3872 error = -EISDIR; 3873 if (type != LAST_NORM) 3874 goto exit1; 3875 3876 error = mnt_want_write(path.mnt); 3877 if (error) 3878 goto exit1; 3879 retry_deleg: 3880 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT); 3881 dentry = __lookup_hash(&last, path.dentry, lookup_flags); 3882 error = PTR_ERR(dentry); 3883 if (!IS_ERR(dentry)) { 3884 /* Why not before? Because we want correct error value */ 3885 if (last.name[last.len]) 3886 goto slashes; 3887 inode = dentry->d_inode; 3888 if (d_is_negative(dentry)) 3889 goto slashes; 3890 ihold(inode); 3891 error = security_path_unlink(&path, dentry); 3892 if (error) 3893 goto exit2; 3894 error = vfs_unlink(path.dentry->d_inode, dentry, &delegated_inode); 3895 exit2: 3896 dput(dentry); 3897 } 3898 inode_unlock(path.dentry->d_inode); 3899 if (inode) 3900 iput(inode); /* truncate the inode here */ 3901 inode = NULL; 3902 if (delegated_inode) { 3903 error = break_deleg_wait(&delegated_inode); 3904 if (!error) 3905 goto retry_deleg; 3906 } 3907 mnt_drop_write(path.mnt); 3908 exit1: 3909 path_put(&path); 3910 putname(name); 3911 if (retry_estale(error, lookup_flags)) { 3912 lookup_flags |= LOOKUP_REVAL; 3913 inode = NULL; 3914 goto retry; 3915 } 3916 return error; 3917 3918 slashes: 3919 if (d_is_negative(dentry)) 3920 error = -ENOENT; 3921 else if (d_is_dir(dentry)) 3922 error = -EISDIR; 3923 else 3924 error = -ENOTDIR; 3925 goto exit2; 3926 } 3927 3928 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) 3929 { 3930 if ((flag & ~AT_REMOVEDIR) != 0) 3931 return -EINVAL; 3932 3933 if (flag & AT_REMOVEDIR) 3934 return do_rmdir(dfd, pathname); 3935 3936 return do_unlinkat(dfd, pathname); 3937 } 3938 3939 SYSCALL_DEFINE1(unlink, const char __user *, pathname) 3940 { 3941 return do_unlinkat(AT_FDCWD, pathname); 3942 } 3943 3944 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname) 3945 { 3946 int error = may_create(dir, dentry); 3947 3948 if (error) 3949 return error; 3950 3951 if (!dir->i_op->symlink) 3952 return -EPERM; 3953 3954 error = security_inode_symlink(dir, dentry, oldname); 3955 if (error) 3956 return error; 3957 3958 error = dir->i_op->symlink(dir, dentry, oldname); 3959 if (!error) 3960 fsnotify_create(dir, dentry); 3961 return error; 3962 } 3963 EXPORT_SYMBOL(vfs_symlink); 3964 3965 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, 3966 int, newdfd, const char __user *, newname) 3967 { 3968 int error; 3969 struct filename *from; 3970 struct dentry *dentry; 3971 struct path path; 3972 unsigned int lookup_flags = 0; 3973 3974 from = getname(oldname); 3975 if (IS_ERR(from)) 3976 return PTR_ERR(from); 3977 retry: 3978 dentry = user_path_create(newdfd, newname, &path, lookup_flags); 3979 error = PTR_ERR(dentry); 3980 if (IS_ERR(dentry)) 3981 goto out_putname; 3982 3983 error = security_path_symlink(&path, dentry, from->name); 3984 if (!error) 3985 error = vfs_symlink(path.dentry->d_inode, dentry, from->name); 3986 done_path_create(&path, dentry); 3987 if (retry_estale(error, lookup_flags)) { 3988 lookup_flags |= LOOKUP_REVAL; 3989 goto retry; 3990 } 3991 out_putname: 3992 putname(from); 3993 return error; 3994 } 3995 3996 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) 3997 { 3998 return sys_symlinkat(oldname, AT_FDCWD, newname); 3999 } 4000 4001 /** 4002 * vfs_link - create a new link 4003 * @old_dentry: object to be linked 4004 * @dir: new parent 4005 * @new_dentry: where to create the new link 4006 * @delegated_inode: returns inode needing a delegation break 4007 * 4008 * The caller must hold dir->i_mutex 4009 * 4010 * If vfs_link discovers a delegation on the to-be-linked file in need 4011 * of breaking, it will return -EWOULDBLOCK and return a reference to the 4012 * inode in delegated_inode. The caller should then break the delegation 4013 * and retry. Because breaking a delegation may take a long time, the 4014 * caller should drop the i_mutex before doing so. 4015 * 4016 * Alternatively, a caller may pass NULL for delegated_inode. This may 4017 * be appropriate for callers that expect the underlying filesystem not 4018 * to be NFS exported. 4019 */ 4020 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode) 4021 { 4022 struct inode *inode = old_dentry->d_inode; 4023 unsigned max_links = dir->i_sb->s_max_links; 4024 int error; 4025 4026 if (!inode) 4027 return -ENOENT; 4028 4029 error = may_create(dir, new_dentry); 4030 if (error) 4031 return error; 4032 4033 if (dir->i_sb != inode->i_sb) 4034 return -EXDEV; 4035 4036 /* 4037 * A link to an append-only or immutable file cannot be created. 4038 */ 4039 if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) 4040 return -EPERM; 4041 if (!dir->i_op->link) 4042 return -EPERM; 4043 if (S_ISDIR(inode->i_mode)) 4044 return -EPERM; 4045 4046 error = security_inode_link(old_dentry, dir, new_dentry); 4047 if (error) 4048 return error; 4049 4050 inode_lock(inode); 4051 /* Make sure we don't allow creating hardlink to an unlinked file */ 4052 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE)) 4053 error = -ENOENT; 4054 else if (max_links && inode->i_nlink >= max_links) 4055 error = -EMLINK; 4056 else { 4057 error = try_break_deleg(inode, delegated_inode); 4058 if (!error) 4059 error = dir->i_op->link(old_dentry, dir, new_dentry); 4060 } 4061 4062 if (!error && (inode->i_state & I_LINKABLE)) { 4063 spin_lock(&inode->i_lock); 4064 inode->i_state &= ~I_LINKABLE; 4065 spin_unlock(&inode->i_lock); 4066 } 4067 inode_unlock(inode); 4068 if (!error) 4069 fsnotify_link(dir, inode, new_dentry); 4070 return error; 4071 } 4072 EXPORT_SYMBOL(vfs_link); 4073 4074 /* 4075 * Hardlinks are often used in delicate situations. We avoid 4076 * security-related surprises by not following symlinks on the 4077 * newname. --KAB 4078 * 4079 * We don't follow them on the oldname either to be compatible 4080 * with linux 2.0, and to avoid hard-linking to directories 4081 * and other special files. --ADM 4082 */ 4083 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, 4084 int, newdfd, const char __user *, newname, int, flags) 4085 { 4086 struct dentry *new_dentry; 4087 struct path old_path, new_path; 4088 struct inode *delegated_inode = NULL; 4089 int how = 0; 4090 int error; 4091 4092 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) 4093 return -EINVAL; 4094 /* 4095 * To use null names we require CAP_DAC_READ_SEARCH 4096 * This ensures that not everyone will be able to create 4097 * handlink using the passed filedescriptor. 4098 */ 4099 if (flags & AT_EMPTY_PATH) { 4100 if (!capable(CAP_DAC_READ_SEARCH)) 4101 return -ENOENT; 4102 how = LOOKUP_EMPTY; 4103 } 4104 4105 if (flags & AT_SYMLINK_FOLLOW) 4106 how |= LOOKUP_FOLLOW; 4107 retry: 4108 error = user_path_at(olddfd, oldname, how, &old_path); 4109 if (error) 4110 return error; 4111 4112 new_dentry = user_path_create(newdfd, newname, &new_path, 4113 (how & LOOKUP_REVAL)); 4114 error = PTR_ERR(new_dentry); 4115 if (IS_ERR(new_dentry)) 4116 goto out; 4117 4118 error = -EXDEV; 4119 if (old_path.mnt != new_path.mnt) 4120 goto out_dput; 4121 error = may_linkat(&old_path); 4122 if (unlikely(error)) 4123 goto out_dput; 4124 error = security_path_link(old_path.dentry, &new_path, new_dentry); 4125 if (error) 4126 goto out_dput; 4127 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode); 4128 out_dput: 4129 done_path_create(&new_path, new_dentry); 4130 if (delegated_inode) { 4131 error = break_deleg_wait(&delegated_inode); 4132 if (!error) { 4133 path_put(&old_path); 4134 goto retry; 4135 } 4136 } 4137 if (retry_estale(error, how)) { 4138 path_put(&old_path); 4139 how |= LOOKUP_REVAL; 4140 goto retry; 4141 } 4142 out: 4143 path_put(&old_path); 4144 4145 return error; 4146 } 4147 4148 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) 4149 { 4150 return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 4151 } 4152 4153 /** 4154 * vfs_rename - rename a filesystem object 4155 * @old_dir: parent of source 4156 * @old_dentry: source 4157 * @new_dir: parent of destination 4158 * @new_dentry: destination 4159 * @delegated_inode: returns an inode needing a delegation break 4160 * @flags: rename flags 4161 * 4162 * The caller must hold multiple mutexes--see lock_rename()). 4163 * 4164 * If vfs_rename discovers a delegation in need of breaking at either 4165 * the source or destination, it will return -EWOULDBLOCK and return a 4166 * reference to the inode in delegated_inode. The caller should then 4167 * break the delegation and retry. Because breaking a delegation may 4168 * take a long time, the caller should drop all locks before doing 4169 * so. 4170 * 4171 * Alternatively, a caller may pass NULL for delegated_inode. This may 4172 * be appropriate for callers that expect the underlying filesystem not 4173 * to be NFS exported. 4174 * 4175 * The worst of all namespace operations - renaming directory. "Perverted" 4176 * doesn't even start to describe it. Somebody in UCB had a heck of a trip... 4177 * Problems: 4178 * a) we can get into loop creation. 4179 * b) race potential - two innocent renames can create a loop together. 4180 * That's where 4.4 screws up. Current fix: serialization on 4181 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another 4182 * story. 4183 * c) we have to lock _four_ objects - parents and victim (if it exists), 4184 * and source (if it is not a directory). 4185 * And that - after we got ->i_mutex on parents (until then we don't know 4186 * whether the target exists). Solution: try to be smart with locking 4187 * order for inodes. We rely on the fact that tree topology may change 4188 * only under ->s_vfs_rename_mutex _and_ that parent of the object we 4189 * move will be locked. Thus we can rank directories by the tree 4190 * (ancestors first) and rank all non-directories after them. 4191 * That works since everybody except rename does "lock parent, lookup, 4192 * lock child" and rename is under ->s_vfs_rename_mutex. 4193 * HOWEVER, it relies on the assumption that any object with ->lookup() 4194 * has no more than 1 dentry. If "hybrid" objects will ever appear, 4195 * we'd better make sure that there's no link(2) for them. 4196 * d) conversion from fhandle to dentry may come in the wrong moment - when 4197 * we are removing the target. Solution: we will have to grab ->i_mutex 4198 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on 4199 * ->i_mutex on parents, which works but leads to some truly excessive 4200 * locking]. 4201 */ 4202 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, 4203 struct inode *new_dir, struct dentry *new_dentry, 4204 struct inode **delegated_inode, unsigned int flags) 4205 { 4206 int error; 4207 bool is_dir = d_is_dir(old_dentry); 4208 const unsigned char *old_name; 4209 struct inode *source = old_dentry->d_inode; 4210 struct inode *target = new_dentry->d_inode; 4211 bool new_is_dir = false; 4212 unsigned max_links = new_dir->i_sb->s_max_links; 4213 4214 if (source == target) 4215 return 0; 4216 4217 error = may_delete(old_dir, old_dentry, is_dir); 4218 if (error) 4219 return error; 4220 4221 if (!target) { 4222 error = may_create(new_dir, new_dentry); 4223 } else { 4224 new_is_dir = d_is_dir(new_dentry); 4225 4226 if (!(flags & RENAME_EXCHANGE)) 4227 error = may_delete(new_dir, new_dentry, is_dir); 4228 else 4229 error = may_delete(new_dir, new_dentry, new_is_dir); 4230 } 4231 if (error) 4232 return error; 4233 4234 if (!old_dir->i_op->rename && !old_dir->i_op->rename2) 4235 return -EPERM; 4236 4237 if (flags && !old_dir->i_op->rename2) 4238 return -EINVAL; 4239 4240 /* 4241 * If we are going to change the parent - check write permissions, 4242 * we'll need to flip '..'. 4243 */ 4244 if (new_dir != old_dir) { 4245 if (is_dir) { 4246 error = inode_permission(source, MAY_WRITE); 4247 if (error) 4248 return error; 4249 } 4250 if ((flags & RENAME_EXCHANGE) && new_is_dir) { 4251 error = inode_permission(target, MAY_WRITE); 4252 if (error) 4253 return error; 4254 } 4255 } 4256 4257 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry, 4258 flags); 4259 if (error) 4260 return error; 4261 4262 old_name = fsnotify_oldname_init(old_dentry->d_name.name); 4263 dget(new_dentry); 4264 if (!is_dir || (flags & RENAME_EXCHANGE)) 4265 lock_two_nondirectories(source, target); 4266 else if (target) 4267 inode_lock(target); 4268 4269 error = -EBUSY; 4270 if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry)) 4271 goto out; 4272 4273 if (max_links && new_dir != old_dir) { 4274 error = -EMLINK; 4275 if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links) 4276 goto out; 4277 if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir && 4278 old_dir->i_nlink >= max_links) 4279 goto out; 4280 } 4281 if (is_dir && !(flags & RENAME_EXCHANGE) && target) 4282 shrink_dcache_parent(new_dentry); 4283 if (!is_dir) { 4284 error = try_break_deleg(source, delegated_inode); 4285 if (error) 4286 goto out; 4287 } 4288 if (target && !new_is_dir) { 4289 error = try_break_deleg(target, delegated_inode); 4290 if (error) 4291 goto out; 4292 } 4293 if (!old_dir->i_op->rename2) { 4294 error = old_dir->i_op->rename(old_dir, old_dentry, 4295 new_dir, new_dentry); 4296 } else { 4297 WARN_ON(old_dir->i_op->rename != NULL); 4298 error = old_dir->i_op->rename2(old_dir, old_dentry, 4299 new_dir, new_dentry, flags); 4300 } 4301 if (error) 4302 goto out; 4303 4304 if (!(flags & RENAME_EXCHANGE) && target) { 4305 if (is_dir) 4306 target->i_flags |= S_DEAD; 4307 dont_mount(new_dentry); 4308 detach_mounts(new_dentry); 4309 } 4310 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) { 4311 if (!(flags & RENAME_EXCHANGE)) 4312 d_move(old_dentry, new_dentry); 4313 else 4314 d_exchange(old_dentry, new_dentry); 4315 } 4316 out: 4317 if (!is_dir || (flags & RENAME_EXCHANGE)) 4318 unlock_two_nondirectories(source, target); 4319 else if (target) 4320 inode_unlock(target); 4321 dput(new_dentry); 4322 if (!error) { 4323 fsnotify_move(old_dir, new_dir, old_name, is_dir, 4324 !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry); 4325 if (flags & RENAME_EXCHANGE) { 4326 fsnotify_move(new_dir, old_dir, old_dentry->d_name.name, 4327 new_is_dir, NULL, new_dentry); 4328 } 4329 } 4330 fsnotify_oldname_free(old_name); 4331 4332 return error; 4333 } 4334 EXPORT_SYMBOL(vfs_rename); 4335 4336 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname, 4337 int, newdfd, const char __user *, newname, unsigned int, flags) 4338 { 4339 struct dentry *old_dentry, *new_dentry; 4340 struct dentry *trap; 4341 struct path old_path, new_path; 4342 struct qstr old_last, new_last; 4343 int old_type, new_type; 4344 struct inode *delegated_inode = NULL; 4345 struct filename *from; 4346 struct filename *to; 4347 unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET; 4348 bool should_retry = false; 4349 int error; 4350 4351 if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT)) 4352 return -EINVAL; 4353 4354 if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) && 4355 (flags & RENAME_EXCHANGE)) 4356 return -EINVAL; 4357 4358 if ((flags & RENAME_WHITEOUT) && !capable(CAP_MKNOD)) 4359 return -EPERM; 4360 4361 if (flags & RENAME_EXCHANGE) 4362 target_flags = 0; 4363 4364 retry: 4365 from = user_path_parent(olddfd, oldname, 4366 &old_path, &old_last, &old_type, lookup_flags); 4367 if (IS_ERR(from)) { 4368 error = PTR_ERR(from); 4369 goto exit; 4370 } 4371 4372 to = user_path_parent(newdfd, newname, 4373 &new_path, &new_last, &new_type, lookup_flags); 4374 if (IS_ERR(to)) { 4375 error = PTR_ERR(to); 4376 goto exit1; 4377 } 4378 4379 error = -EXDEV; 4380 if (old_path.mnt != new_path.mnt) 4381 goto exit2; 4382 4383 error = -EBUSY; 4384 if (old_type != LAST_NORM) 4385 goto exit2; 4386 4387 if (flags & RENAME_NOREPLACE) 4388 error = -EEXIST; 4389 if (new_type != LAST_NORM) 4390 goto exit2; 4391 4392 error = mnt_want_write(old_path.mnt); 4393 if (error) 4394 goto exit2; 4395 4396 retry_deleg: 4397 trap = lock_rename(new_path.dentry, old_path.dentry); 4398 4399 old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags); 4400 error = PTR_ERR(old_dentry); 4401 if (IS_ERR(old_dentry)) 4402 goto exit3; 4403 /* source must exist */ 4404 error = -ENOENT; 4405 if (d_is_negative(old_dentry)) 4406 goto exit4; 4407 new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags); 4408 error = PTR_ERR(new_dentry); 4409 if (IS_ERR(new_dentry)) 4410 goto exit4; 4411 error = -EEXIST; 4412 if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry)) 4413 goto exit5; 4414 if (flags & RENAME_EXCHANGE) { 4415 error = -ENOENT; 4416 if (d_is_negative(new_dentry)) 4417 goto exit5; 4418 4419 if (!d_is_dir(new_dentry)) { 4420 error = -ENOTDIR; 4421 if (new_last.name[new_last.len]) 4422 goto exit5; 4423 } 4424 } 4425 /* unless the source is a directory trailing slashes give -ENOTDIR */ 4426 if (!d_is_dir(old_dentry)) { 4427 error = -ENOTDIR; 4428 if (old_last.name[old_last.len]) 4429 goto exit5; 4430 if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len]) 4431 goto exit5; 4432 } 4433 /* source should not be ancestor of target */ 4434 error = -EINVAL; 4435 if (old_dentry == trap) 4436 goto exit5; 4437 /* target should not be an ancestor of source */ 4438 if (!(flags & RENAME_EXCHANGE)) 4439 error = -ENOTEMPTY; 4440 if (new_dentry == trap) 4441 goto exit5; 4442 4443 error = security_path_rename(&old_path, old_dentry, 4444 &new_path, new_dentry, flags); 4445 if (error) 4446 goto exit5; 4447 error = vfs_rename(old_path.dentry->d_inode, old_dentry, 4448 new_path.dentry->d_inode, new_dentry, 4449 &delegated_inode, flags); 4450 exit5: 4451 dput(new_dentry); 4452 exit4: 4453 dput(old_dentry); 4454 exit3: 4455 unlock_rename(new_path.dentry, old_path.dentry); 4456 if (delegated_inode) { 4457 error = break_deleg_wait(&delegated_inode); 4458 if (!error) 4459 goto retry_deleg; 4460 } 4461 mnt_drop_write(old_path.mnt); 4462 exit2: 4463 if (retry_estale(error, lookup_flags)) 4464 should_retry = true; 4465 path_put(&new_path); 4466 putname(to); 4467 exit1: 4468 path_put(&old_path); 4469 putname(from); 4470 if (should_retry) { 4471 should_retry = false; 4472 lookup_flags |= LOOKUP_REVAL; 4473 goto retry; 4474 } 4475 exit: 4476 return error; 4477 } 4478 4479 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, 4480 int, newdfd, const char __user *, newname) 4481 { 4482 return sys_renameat2(olddfd, oldname, newdfd, newname, 0); 4483 } 4484 4485 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) 4486 { 4487 return sys_renameat2(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 4488 } 4489 4490 int vfs_whiteout(struct inode *dir, struct dentry *dentry) 4491 { 4492 int error = may_create(dir, dentry); 4493 if (error) 4494 return error; 4495 4496 if (!dir->i_op->mknod) 4497 return -EPERM; 4498 4499 return dir->i_op->mknod(dir, dentry, 4500 S_IFCHR | WHITEOUT_MODE, WHITEOUT_DEV); 4501 } 4502 EXPORT_SYMBOL(vfs_whiteout); 4503 4504 int readlink_copy(char __user *buffer, int buflen, const char *link) 4505 { 4506 int len = PTR_ERR(link); 4507 if (IS_ERR(link)) 4508 goto out; 4509 4510 len = strlen(link); 4511 if (len > (unsigned) buflen) 4512 len = buflen; 4513 if (copy_to_user(buffer, link, len)) 4514 len = -EFAULT; 4515 out: 4516 return len; 4517 } 4518 EXPORT_SYMBOL(readlink_copy); 4519 4520 /* 4521 * A helper for ->readlink(). This should be used *ONLY* for symlinks that 4522 * have ->get_link() not calling nd_jump_link(). Using (or not using) it 4523 * for any given inode is up to filesystem. 4524 */ 4525 int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4526 { 4527 DEFINE_DELAYED_CALL(done); 4528 struct inode *inode = d_inode(dentry); 4529 const char *link = inode->i_link; 4530 int res; 4531 4532 if (!link) { 4533 link = inode->i_op->get_link(dentry, inode, &done); 4534 if (IS_ERR(link)) 4535 return PTR_ERR(link); 4536 } 4537 res = readlink_copy(buffer, buflen, link); 4538 do_delayed_call(&done); 4539 return res; 4540 } 4541 EXPORT_SYMBOL(generic_readlink); 4542 4543 /* get the link contents into pagecache */ 4544 const char *page_get_link(struct dentry *dentry, struct inode *inode, 4545 struct delayed_call *callback) 4546 { 4547 char *kaddr; 4548 struct page *page; 4549 struct address_space *mapping = inode->i_mapping; 4550 4551 if (!dentry) { 4552 page = find_get_page(mapping, 0); 4553 if (!page) 4554 return ERR_PTR(-ECHILD); 4555 if (!PageUptodate(page)) { 4556 put_page(page); 4557 return ERR_PTR(-ECHILD); 4558 } 4559 } else { 4560 page = read_mapping_page(mapping, 0, NULL); 4561 if (IS_ERR(page)) 4562 return (char*)page; 4563 } 4564 set_delayed_call(callback, page_put_link, page); 4565 BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM); 4566 kaddr = page_address(page); 4567 nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1); 4568 return kaddr; 4569 } 4570 4571 EXPORT_SYMBOL(page_get_link); 4572 4573 void page_put_link(void *arg) 4574 { 4575 put_page(arg); 4576 } 4577 EXPORT_SYMBOL(page_put_link); 4578 4579 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4580 { 4581 DEFINE_DELAYED_CALL(done); 4582 int res = readlink_copy(buffer, buflen, 4583 page_get_link(dentry, d_inode(dentry), 4584 &done)); 4585 do_delayed_call(&done); 4586 return res; 4587 } 4588 EXPORT_SYMBOL(page_readlink); 4589 4590 /* 4591 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS 4592 */ 4593 int __page_symlink(struct inode *inode, const char *symname, int len, int nofs) 4594 { 4595 struct address_space *mapping = inode->i_mapping; 4596 struct page *page; 4597 void *fsdata; 4598 int err; 4599 unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE; 4600 if (nofs) 4601 flags |= AOP_FLAG_NOFS; 4602 4603 retry: 4604 err = pagecache_write_begin(NULL, mapping, 0, len-1, 4605 flags, &page, &fsdata); 4606 if (err) 4607 goto fail; 4608 4609 memcpy(page_address(page), symname, len-1); 4610 4611 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1, 4612 page, fsdata); 4613 if (err < 0) 4614 goto fail; 4615 if (err < len-1) 4616 goto retry; 4617 4618 mark_inode_dirty(inode); 4619 return 0; 4620 fail: 4621 return err; 4622 } 4623 EXPORT_SYMBOL(__page_symlink); 4624 4625 int page_symlink(struct inode *inode, const char *symname, int len) 4626 { 4627 return __page_symlink(inode, symname, len, 4628 !mapping_gfp_constraint(inode->i_mapping, __GFP_FS)); 4629 } 4630 EXPORT_SYMBOL(page_symlink); 4631 4632 const struct inode_operations page_symlink_inode_operations = { 4633 .readlink = generic_readlink, 4634 .get_link = page_get_link, 4635 }; 4636 EXPORT_SYMBOL(page_symlink_inode_operations); 4637