1 /* 2 * linux/fs/namei.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * Some corrections by tytso. 9 */ 10 11 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname 12 * lookup logic. 13 */ 14 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture. 15 */ 16 17 #include <linux/init.h> 18 #include <linux/export.h> 19 #include <linux/kernel.h> 20 #include <linux/slab.h> 21 #include <linux/fs.h> 22 #include <linux/namei.h> 23 #include <linux/pagemap.h> 24 #include <linux/fsnotify.h> 25 #include <linux/personality.h> 26 #include <linux/security.h> 27 #include <linux/ima.h> 28 #include <linux/syscalls.h> 29 #include <linux/mount.h> 30 #include <linux/audit.h> 31 #include <linux/capability.h> 32 #include <linux/file.h> 33 #include <linux/fcntl.h> 34 #include <linux/device_cgroup.h> 35 #include <linux/fs_struct.h> 36 #include <linux/posix_acl.h> 37 #include <linux/hash.h> 38 #include <asm/uaccess.h> 39 40 #include "internal.h" 41 #include "mount.h" 42 43 /* [Feb-1997 T. Schoebel-Theuer] 44 * Fundamental changes in the pathname lookup mechanisms (namei) 45 * were necessary because of omirr. The reason is that omirr needs 46 * to know the _real_ pathname, not the user-supplied one, in case 47 * of symlinks (and also when transname replacements occur). 48 * 49 * The new code replaces the old recursive symlink resolution with 50 * an iterative one (in case of non-nested symlink chains). It does 51 * this with calls to <fs>_follow_link(). 52 * As a side effect, dir_namei(), _namei() and follow_link() are now 53 * replaced with a single function lookup_dentry() that can handle all 54 * the special cases of the former code. 55 * 56 * With the new dcache, the pathname is stored at each inode, at least as 57 * long as the refcount of the inode is positive. As a side effect, the 58 * size of the dcache depends on the inode cache and thus is dynamic. 59 * 60 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink 61 * resolution to correspond with current state of the code. 62 * 63 * Note that the symlink resolution is not *completely* iterative. 64 * There is still a significant amount of tail- and mid- recursion in 65 * the algorithm. Also, note that <fs>_readlink() is not used in 66 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink() 67 * may return different results than <fs>_follow_link(). Many virtual 68 * filesystems (including /proc) exhibit this behavior. 69 */ 70 71 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation: 72 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL 73 * and the name already exists in form of a symlink, try to create the new 74 * name indicated by the symlink. The old code always complained that the 75 * name already exists, due to not following the symlink even if its target 76 * is nonexistent. The new semantics affects also mknod() and link() when 77 * the name is a symlink pointing to a non-existent name. 78 * 79 * I don't know which semantics is the right one, since I have no access 80 * to standards. But I found by trial that HP-UX 9.0 has the full "new" 81 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the 82 * "old" one. Personally, I think the new semantics is much more logical. 83 * Note that "ln old new" where "new" is a symlink pointing to a non-existing 84 * file does succeed in both HP-UX and SunOs, but not in Solaris 85 * and in the old Linux semantics. 86 */ 87 88 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink 89 * semantics. See the comments in "open_namei" and "do_link" below. 90 * 91 * [10-Sep-98 Alan Modra] Another symlink change. 92 */ 93 94 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks: 95 * inside the path - always follow. 96 * in the last component in creation/removal/renaming - never follow. 97 * if LOOKUP_FOLLOW passed - follow. 98 * if the pathname has trailing slashes - follow. 99 * otherwise - don't follow. 100 * (applied in that order). 101 * 102 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT 103 * restored for 2.4. This is the last surviving part of old 4.2BSD bug. 104 * During the 2.4 we need to fix the userland stuff depending on it - 105 * hopefully we will be able to get rid of that wart in 2.5. So far only 106 * XEmacs seems to be relying on it... 107 */ 108 /* 109 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland) 110 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives 111 * any extra contention... 112 */ 113 114 /* In order to reduce some races, while at the same time doing additional 115 * checking and hopefully speeding things up, we copy filenames to the 116 * kernel data space before using them.. 117 * 118 * POSIX.1 2.4: an empty pathname is invalid (ENOENT). 119 * PATH_MAX includes the nul terminator --RR. 120 */ 121 122 #define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname)) 123 124 struct filename * 125 getname_flags(const char __user *filename, int flags, int *empty) 126 { 127 struct filename *result; 128 char *kname; 129 int len; 130 131 result = audit_reusename(filename); 132 if (result) 133 return result; 134 135 result = __getname(); 136 if (unlikely(!result)) 137 return ERR_PTR(-ENOMEM); 138 139 /* 140 * First, try to embed the struct filename inside the names_cache 141 * allocation 142 */ 143 kname = (char *)result->iname; 144 result->name = kname; 145 146 len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX); 147 if (unlikely(len < 0)) { 148 __putname(result); 149 return ERR_PTR(len); 150 } 151 152 /* 153 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a 154 * separate struct filename so we can dedicate the entire 155 * names_cache allocation for the pathname, and re-do the copy from 156 * userland. 157 */ 158 if (unlikely(len == EMBEDDED_NAME_MAX)) { 159 const size_t size = offsetof(struct filename, iname[1]); 160 kname = (char *)result; 161 162 /* 163 * size is chosen that way we to guarantee that 164 * result->iname[0] is within the same object and that 165 * kname can't be equal to result->iname, no matter what. 166 */ 167 result = kzalloc(size, GFP_KERNEL); 168 if (unlikely(!result)) { 169 __putname(kname); 170 return ERR_PTR(-ENOMEM); 171 } 172 result->name = kname; 173 len = strncpy_from_user(kname, filename, PATH_MAX); 174 if (unlikely(len < 0)) { 175 __putname(kname); 176 kfree(result); 177 return ERR_PTR(len); 178 } 179 if (unlikely(len == PATH_MAX)) { 180 __putname(kname); 181 kfree(result); 182 return ERR_PTR(-ENAMETOOLONG); 183 } 184 } 185 186 result->refcnt = 1; 187 /* The empty path is special. */ 188 if (unlikely(!len)) { 189 if (empty) 190 *empty = 1; 191 if (!(flags & LOOKUP_EMPTY)) { 192 putname(result); 193 return ERR_PTR(-ENOENT); 194 } 195 } 196 197 result->uptr = filename; 198 result->aname = NULL; 199 audit_getname(result); 200 return result; 201 } 202 203 struct filename * 204 getname(const char __user * filename) 205 { 206 return getname_flags(filename, 0, NULL); 207 } 208 209 struct filename * 210 getname_kernel(const char * filename) 211 { 212 struct filename *result; 213 int len = strlen(filename) + 1; 214 215 result = __getname(); 216 if (unlikely(!result)) 217 return ERR_PTR(-ENOMEM); 218 219 if (len <= EMBEDDED_NAME_MAX) { 220 result->name = (char *)result->iname; 221 } else if (len <= PATH_MAX) { 222 struct filename *tmp; 223 224 tmp = kmalloc(sizeof(*tmp), GFP_KERNEL); 225 if (unlikely(!tmp)) { 226 __putname(result); 227 return ERR_PTR(-ENOMEM); 228 } 229 tmp->name = (char *)result; 230 result = tmp; 231 } else { 232 __putname(result); 233 return ERR_PTR(-ENAMETOOLONG); 234 } 235 memcpy((char *)result->name, filename, len); 236 result->uptr = NULL; 237 result->aname = NULL; 238 result->refcnt = 1; 239 audit_getname(result); 240 241 return result; 242 } 243 244 void putname(struct filename *name) 245 { 246 BUG_ON(name->refcnt <= 0); 247 248 if (--name->refcnt > 0) 249 return; 250 251 if (name->name != name->iname) { 252 __putname(name->name); 253 kfree(name); 254 } else 255 __putname(name); 256 } 257 258 static int check_acl(struct inode *inode, int mask) 259 { 260 #ifdef CONFIG_FS_POSIX_ACL 261 struct posix_acl *acl; 262 263 if (mask & MAY_NOT_BLOCK) { 264 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS); 265 if (!acl) 266 return -EAGAIN; 267 /* no ->get_acl() calls in RCU mode... */ 268 if (acl == ACL_NOT_CACHED) 269 return -ECHILD; 270 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK); 271 } 272 273 acl = get_acl(inode, ACL_TYPE_ACCESS); 274 if (IS_ERR(acl)) 275 return PTR_ERR(acl); 276 if (acl) { 277 int error = posix_acl_permission(inode, acl, mask); 278 posix_acl_release(acl); 279 return error; 280 } 281 #endif 282 283 return -EAGAIN; 284 } 285 286 /* 287 * This does the basic permission checking 288 */ 289 static int acl_permission_check(struct inode *inode, int mask) 290 { 291 unsigned int mode = inode->i_mode; 292 293 if (likely(uid_eq(current_fsuid(), inode->i_uid))) 294 mode >>= 6; 295 else { 296 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { 297 int error = check_acl(inode, mask); 298 if (error != -EAGAIN) 299 return error; 300 } 301 302 if (in_group_p(inode->i_gid)) 303 mode >>= 3; 304 } 305 306 /* 307 * If the DACs are ok we don't need any capability check. 308 */ 309 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0) 310 return 0; 311 return -EACCES; 312 } 313 314 /** 315 * generic_permission - check for access rights on a Posix-like filesystem 316 * @inode: inode to check access rights for 317 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...) 318 * 319 * Used to check for read/write/execute permissions on a file. 320 * We use "fsuid" for this, letting us set arbitrary permissions 321 * for filesystem access without changing the "normal" uids which 322 * are used for other things. 323 * 324 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk 325 * request cannot be satisfied (eg. requires blocking or too much complexity). 326 * It would then be called again in ref-walk mode. 327 */ 328 int generic_permission(struct inode *inode, int mask) 329 { 330 int ret; 331 332 /* 333 * Do the basic permission checks. 334 */ 335 ret = acl_permission_check(inode, mask); 336 if (ret != -EACCES) 337 return ret; 338 339 if (S_ISDIR(inode->i_mode)) { 340 /* DACs are overridable for directories */ 341 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) 342 return 0; 343 if (!(mask & MAY_WRITE)) 344 if (capable_wrt_inode_uidgid(inode, 345 CAP_DAC_READ_SEARCH)) 346 return 0; 347 return -EACCES; 348 } 349 /* 350 * Read/write DACs are always overridable. 351 * Executable DACs are overridable when there is 352 * at least one exec bit set. 353 */ 354 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 355 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) 356 return 0; 357 358 /* 359 * Searching includes executable on directories, else just read. 360 */ 361 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 362 if (mask == MAY_READ) 363 if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH)) 364 return 0; 365 366 return -EACCES; 367 } 368 EXPORT_SYMBOL(generic_permission); 369 370 /* 371 * We _really_ want to just do "generic_permission()" without 372 * even looking at the inode->i_op values. So we keep a cache 373 * flag in inode->i_opflags, that says "this has not special 374 * permission function, use the fast case". 375 */ 376 static inline int do_inode_permission(struct inode *inode, int mask) 377 { 378 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) { 379 if (likely(inode->i_op->permission)) 380 return inode->i_op->permission(inode, mask); 381 382 /* This gets set once for the inode lifetime */ 383 spin_lock(&inode->i_lock); 384 inode->i_opflags |= IOP_FASTPERM; 385 spin_unlock(&inode->i_lock); 386 } 387 return generic_permission(inode, mask); 388 } 389 390 /** 391 * __inode_permission - Check for access rights to a given inode 392 * @inode: Inode to check permission on 393 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 394 * 395 * Check for read/write/execute permissions on an inode. 396 * 397 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 398 * 399 * This does not check for a read-only file system. You probably want 400 * inode_permission(). 401 */ 402 int __inode_permission(struct inode *inode, int mask) 403 { 404 int retval; 405 406 if (unlikely(mask & MAY_WRITE)) { 407 /* 408 * Nobody gets write access to an immutable file. 409 */ 410 if (IS_IMMUTABLE(inode)) 411 return -EACCES; 412 } 413 414 retval = do_inode_permission(inode, mask); 415 if (retval) 416 return retval; 417 418 retval = devcgroup_inode_permission(inode, mask); 419 if (retval) 420 return retval; 421 422 return security_inode_permission(inode, mask); 423 } 424 EXPORT_SYMBOL(__inode_permission); 425 426 /** 427 * sb_permission - Check superblock-level permissions 428 * @sb: Superblock of inode to check permission on 429 * @inode: Inode to check permission on 430 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 431 * 432 * Separate out file-system wide checks from inode-specific permission checks. 433 */ 434 static int sb_permission(struct super_block *sb, struct inode *inode, int mask) 435 { 436 if (unlikely(mask & MAY_WRITE)) { 437 umode_t mode = inode->i_mode; 438 439 /* Nobody gets write access to a read-only fs. */ 440 if ((sb->s_flags & MS_RDONLY) && 441 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) 442 return -EROFS; 443 } 444 return 0; 445 } 446 447 /** 448 * inode_permission - Check for access rights to a given inode 449 * @inode: Inode to check permission on 450 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 451 * 452 * Check for read/write/execute permissions on an inode. We use fs[ug]id for 453 * this, letting us set arbitrary permissions for filesystem access without 454 * changing the "normal" UIDs which are used for other things. 455 * 456 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 457 */ 458 int inode_permission(struct inode *inode, int mask) 459 { 460 int retval; 461 462 retval = sb_permission(inode->i_sb, inode, mask); 463 if (retval) 464 return retval; 465 return __inode_permission(inode, mask); 466 } 467 EXPORT_SYMBOL(inode_permission); 468 469 /** 470 * path_get - get a reference to a path 471 * @path: path to get the reference to 472 * 473 * Given a path increment the reference count to the dentry and the vfsmount. 474 */ 475 void path_get(const struct path *path) 476 { 477 mntget(path->mnt); 478 dget(path->dentry); 479 } 480 EXPORT_SYMBOL(path_get); 481 482 /** 483 * path_put - put a reference to a path 484 * @path: path to put the reference to 485 * 486 * Given a path decrement the reference count to the dentry and the vfsmount. 487 */ 488 void path_put(const struct path *path) 489 { 490 dput(path->dentry); 491 mntput(path->mnt); 492 } 493 EXPORT_SYMBOL(path_put); 494 495 #define EMBEDDED_LEVELS 2 496 struct nameidata { 497 struct path path; 498 struct qstr last; 499 struct path root; 500 struct inode *inode; /* path.dentry.d_inode */ 501 unsigned int flags; 502 unsigned seq, m_seq; 503 int last_type; 504 unsigned depth; 505 int total_link_count; 506 struct saved { 507 struct path link; 508 void *cookie; 509 const char *name; 510 struct inode *inode; 511 unsigned seq; 512 } *stack, internal[EMBEDDED_LEVELS]; 513 struct filename *name; 514 struct nameidata *saved; 515 unsigned root_seq; 516 int dfd; 517 }; 518 519 static void set_nameidata(struct nameidata *p, int dfd, struct filename *name) 520 { 521 struct nameidata *old = current->nameidata; 522 p->stack = p->internal; 523 p->dfd = dfd; 524 p->name = name; 525 p->total_link_count = old ? old->total_link_count : 0; 526 p->saved = old; 527 current->nameidata = p; 528 } 529 530 static void restore_nameidata(void) 531 { 532 struct nameidata *now = current->nameidata, *old = now->saved; 533 534 current->nameidata = old; 535 if (old) 536 old->total_link_count = now->total_link_count; 537 if (now->stack != now->internal) { 538 kfree(now->stack); 539 now->stack = now->internal; 540 } 541 } 542 543 static int __nd_alloc_stack(struct nameidata *nd) 544 { 545 struct saved *p; 546 547 if (nd->flags & LOOKUP_RCU) { 548 p= kmalloc(MAXSYMLINKS * sizeof(struct saved), 549 GFP_ATOMIC); 550 if (unlikely(!p)) 551 return -ECHILD; 552 } else { 553 p= kmalloc(MAXSYMLINKS * sizeof(struct saved), 554 GFP_KERNEL); 555 if (unlikely(!p)) 556 return -ENOMEM; 557 } 558 memcpy(p, nd->internal, sizeof(nd->internal)); 559 nd->stack = p; 560 return 0; 561 } 562 563 /** 564 * path_connected - Verify that a path->dentry is below path->mnt.mnt_root 565 * @path: nameidate to verify 566 * 567 * Rename can sometimes move a file or directory outside of a bind 568 * mount, path_connected allows those cases to be detected. 569 */ 570 static bool path_connected(const struct path *path) 571 { 572 struct vfsmount *mnt = path->mnt; 573 574 /* Only bind mounts can have disconnected paths */ 575 if (mnt->mnt_root == mnt->mnt_sb->s_root) 576 return true; 577 578 return is_subdir(path->dentry, mnt->mnt_root); 579 } 580 581 static inline int nd_alloc_stack(struct nameidata *nd) 582 { 583 if (likely(nd->depth != EMBEDDED_LEVELS)) 584 return 0; 585 if (likely(nd->stack != nd->internal)) 586 return 0; 587 return __nd_alloc_stack(nd); 588 } 589 590 static void drop_links(struct nameidata *nd) 591 { 592 int i = nd->depth; 593 while (i--) { 594 struct saved *last = nd->stack + i; 595 struct inode *inode = last->inode; 596 if (last->cookie && inode->i_op->put_link) { 597 inode->i_op->put_link(inode, last->cookie); 598 last->cookie = NULL; 599 } 600 } 601 } 602 603 static void terminate_walk(struct nameidata *nd) 604 { 605 drop_links(nd); 606 if (!(nd->flags & LOOKUP_RCU)) { 607 int i; 608 path_put(&nd->path); 609 for (i = 0; i < nd->depth; i++) 610 path_put(&nd->stack[i].link); 611 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 612 path_put(&nd->root); 613 nd->root.mnt = NULL; 614 } 615 } else { 616 nd->flags &= ~LOOKUP_RCU; 617 if (!(nd->flags & LOOKUP_ROOT)) 618 nd->root.mnt = NULL; 619 rcu_read_unlock(); 620 } 621 nd->depth = 0; 622 } 623 624 /* path_put is needed afterwards regardless of success or failure */ 625 static bool legitimize_path(struct nameidata *nd, 626 struct path *path, unsigned seq) 627 { 628 int res = __legitimize_mnt(path->mnt, nd->m_seq); 629 if (unlikely(res)) { 630 if (res > 0) 631 path->mnt = NULL; 632 path->dentry = NULL; 633 return false; 634 } 635 if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) { 636 path->dentry = NULL; 637 return false; 638 } 639 return !read_seqcount_retry(&path->dentry->d_seq, seq); 640 } 641 642 static bool legitimize_links(struct nameidata *nd) 643 { 644 int i; 645 for (i = 0; i < nd->depth; i++) { 646 struct saved *last = nd->stack + i; 647 if (unlikely(!legitimize_path(nd, &last->link, last->seq))) { 648 drop_links(nd); 649 nd->depth = i + 1; 650 return false; 651 } 652 } 653 return true; 654 } 655 656 /* 657 * Path walking has 2 modes, rcu-walk and ref-walk (see 658 * Documentation/filesystems/path-lookup.txt). In situations when we can't 659 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab 660 * normal reference counts on dentries and vfsmounts to transition to rcu-walk 661 * mode. Refcounts are grabbed at the last known good point before rcu-walk 662 * got stuck, so ref-walk may continue from there. If this is not successful 663 * (eg. a seqcount has changed), then failure is returned and it's up to caller 664 * to restart the path walk from the beginning in ref-walk mode. 665 */ 666 667 /** 668 * unlazy_walk - try to switch to ref-walk mode. 669 * @nd: nameidata pathwalk data 670 * @dentry: child of nd->path.dentry or NULL 671 * @seq: seq number to check dentry against 672 * Returns: 0 on success, -ECHILD on failure 673 * 674 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry 675 * for ref-walk mode. @dentry must be a path found by a do_lookup call on 676 * @nd or NULL. Must be called from rcu-walk context. 677 * Nothing should touch nameidata between unlazy_walk() failure and 678 * terminate_walk(). 679 */ 680 static int unlazy_walk(struct nameidata *nd, struct dentry *dentry, unsigned seq) 681 { 682 struct dentry *parent = nd->path.dentry; 683 684 BUG_ON(!(nd->flags & LOOKUP_RCU)); 685 686 nd->flags &= ~LOOKUP_RCU; 687 if (unlikely(!legitimize_links(nd))) 688 goto out2; 689 if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq))) 690 goto out2; 691 if (unlikely(!lockref_get_not_dead(&parent->d_lockref))) 692 goto out1; 693 694 /* 695 * For a negative lookup, the lookup sequence point is the parents 696 * sequence point, and it only needs to revalidate the parent dentry. 697 * 698 * For a positive lookup, we need to move both the parent and the 699 * dentry from the RCU domain to be properly refcounted. And the 700 * sequence number in the dentry validates *both* dentry counters, 701 * since we checked the sequence number of the parent after we got 702 * the child sequence number. So we know the parent must still 703 * be valid if the child sequence number is still valid. 704 */ 705 if (!dentry) { 706 if (read_seqcount_retry(&parent->d_seq, nd->seq)) 707 goto out; 708 BUG_ON(nd->inode != parent->d_inode); 709 } else { 710 if (!lockref_get_not_dead(&dentry->d_lockref)) 711 goto out; 712 if (read_seqcount_retry(&dentry->d_seq, seq)) 713 goto drop_dentry; 714 } 715 716 /* 717 * Sequence counts matched. Now make sure that the root is 718 * still valid and get it if required. 719 */ 720 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 721 if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq))) { 722 rcu_read_unlock(); 723 dput(dentry); 724 return -ECHILD; 725 } 726 } 727 728 rcu_read_unlock(); 729 return 0; 730 731 drop_dentry: 732 rcu_read_unlock(); 733 dput(dentry); 734 goto drop_root_mnt; 735 out2: 736 nd->path.mnt = NULL; 737 out1: 738 nd->path.dentry = NULL; 739 out: 740 rcu_read_unlock(); 741 drop_root_mnt: 742 if (!(nd->flags & LOOKUP_ROOT)) 743 nd->root.mnt = NULL; 744 return -ECHILD; 745 } 746 747 static int unlazy_link(struct nameidata *nd, struct path *link, unsigned seq) 748 { 749 if (unlikely(!legitimize_path(nd, link, seq))) { 750 drop_links(nd); 751 nd->depth = 0; 752 nd->flags &= ~LOOKUP_RCU; 753 nd->path.mnt = NULL; 754 nd->path.dentry = NULL; 755 if (!(nd->flags & LOOKUP_ROOT)) 756 nd->root.mnt = NULL; 757 rcu_read_unlock(); 758 } else if (likely(unlazy_walk(nd, NULL, 0)) == 0) { 759 return 0; 760 } 761 path_put(link); 762 return -ECHILD; 763 } 764 765 static inline int d_revalidate(struct dentry *dentry, unsigned int flags) 766 { 767 return dentry->d_op->d_revalidate(dentry, flags); 768 } 769 770 /** 771 * complete_walk - successful completion of path walk 772 * @nd: pointer nameidata 773 * 774 * If we had been in RCU mode, drop out of it and legitimize nd->path. 775 * Revalidate the final result, unless we'd already done that during 776 * the path walk or the filesystem doesn't ask for it. Return 0 on 777 * success, -error on failure. In case of failure caller does not 778 * need to drop nd->path. 779 */ 780 static int complete_walk(struct nameidata *nd) 781 { 782 struct dentry *dentry = nd->path.dentry; 783 int status; 784 785 if (nd->flags & LOOKUP_RCU) { 786 if (!(nd->flags & LOOKUP_ROOT)) 787 nd->root.mnt = NULL; 788 if (unlikely(unlazy_walk(nd, NULL, 0))) 789 return -ECHILD; 790 } 791 792 if (likely(!(nd->flags & LOOKUP_JUMPED))) 793 return 0; 794 795 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE))) 796 return 0; 797 798 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags); 799 if (status > 0) 800 return 0; 801 802 if (!status) 803 status = -ESTALE; 804 805 return status; 806 } 807 808 static void set_root(struct nameidata *nd) 809 { 810 get_fs_root(current->fs, &nd->root); 811 } 812 813 static void set_root_rcu(struct nameidata *nd) 814 { 815 struct fs_struct *fs = current->fs; 816 unsigned seq; 817 818 do { 819 seq = read_seqcount_begin(&fs->seq); 820 nd->root = fs->root; 821 nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq); 822 } while (read_seqcount_retry(&fs->seq, seq)); 823 } 824 825 static void path_put_conditional(struct path *path, struct nameidata *nd) 826 { 827 dput(path->dentry); 828 if (path->mnt != nd->path.mnt) 829 mntput(path->mnt); 830 } 831 832 static inline void path_to_nameidata(const struct path *path, 833 struct nameidata *nd) 834 { 835 if (!(nd->flags & LOOKUP_RCU)) { 836 dput(nd->path.dentry); 837 if (nd->path.mnt != path->mnt) 838 mntput(nd->path.mnt); 839 } 840 nd->path.mnt = path->mnt; 841 nd->path.dentry = path->dentry; 842 } 843 844 /* 845 * Helper to directly jump to a known parsed path from ->follow_link, 846 * caller must have taken a reference to path beforehand. 847 */ 848 void nd_jump_link(struct path *path) 849 { 850 struct nameidata *nd = current->nameidata; 851 path_put(&nd->path); 852 853 nd->path = *path; 854 nd->inode = nd->path.dentry->d_inode; 855 nd->flags |= LOOKUP_JUMPED; 856 } 857 858 static inline void put_link(struct nameidata *nd) 859 { 860 struct saved *last = nd->stack + --nd->depth; 861 struct inode *inode = last->inode; 862 if (last->cookie && inode->i_op->put_link) 863 inode->i_op->put_link(inode, last->cookie); 864 if (!(nd->flags & LOOKUP_RCU)) 865 path_put(&last->link); 866 } 867 868 int sysctl_protected_symlinks __read_mostly = 0; 869 int sysctl_protected_hardlinks __read_mostly = 0; 870 871 /** 872 * may_follow_link - Check symlink following for unsafe situations 873 * @nd: nameidata pathwalk data 874 * 875 * In the case of the sysctl_protected_symlinks sysctl being enabled, 876 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is 877 * in a sticky world-writable directory. This is to protect privileged 878 * processes from failing races against path names that may change out 879 * from under them by way of other users creating malicious symlinks. 880 * It will permit symlinks to be followed only when outside a sticky 881 * world-writable directory, or when the uid of the symlink and follower 882 * match, or when the directory owner matches the symlink's owner. 883 * 884 * Returns 0 if following the symlink is allowed, -ve on error. 885 */ 886 static inline int may_follow_link(struct nameidata *nd) 887 { 888 const struct inode *inode; 889 const struct inode *parent; 890 891 if (!sysctl_protected_symlinks) 892 return 0; 893 894 /* Allowed if owner and follower match. */ 895 inode = nd->stack[0].inode; 896 if (uid_eq(current_cred()->fsuid, inode->i_uid)) 897 return 0; 898 899 /* Allowed if parent directory not sticky and world-writable. */ 900 parent = nd->inode; 901 if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH)) 902 return 0; 903 904 /* Allowed if parent directory and link owner match. */ 905 if (uid_eq(parent->i_uid, inode->i_uid)) 906 return 0; 907 908 if (nd->flags & LOOKUP_RCU) 909 return -ECHILD; 910 911 audit_log_link_denied("follow_link", &nd->stack[0].link); 912 return -EACCES; 913 } 914 915 /** 916 * safe_hardlink_source - Check for safe hardlink conditions 917 * @inode: the source inode to hardlink from 918 * 919 * Return false if at least one of the following conditions: 920 * - inode is not a regular file 921 * - inode is setuid 922 * - inode is setgid and group-exec 923 * - access failure for read and write 924 * 925 * Otherwise returns true. 926 */ 927 static bool safe_hardlink_source(struct inode *inode) 928 { 929 umode_t mode = inode->i_mode; 930 931 /* Special files should not get pinned to the filesystem. */ 932 if (!S_ISREG(mode)) 933 return false; 934 935 /* Setuid files should not get pinned to the filesystem. */ 936 if (mode & S_ISUID) 937 return false; 938 939 /* Executable setgid files should not get pinned to the filesystem. */ 940 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) 941 return false; 942 943 /* Hardlinking to unreadable or unwritable sources is dangerous. */ 944 if (inode_permission(inode, MAY_READ | MAY_WRITE)) 945 return false; 946 947 return true; 948 } 949 950 /** 951 * may_linkat - Check permissions for creating a hardlink 952 * @link: the source to hardlink from 953 * 954 * Block hardlink when all of: 955 * - sysctl_protected_hardlinks enabled 956 * - fsuid does not match inode 957 * - hardlink source is unsafe (see safe_hardlink_source() above) 958 * - not CAP_FOWNER in a namespace with the inode owner uid mapped 959 * 960 * Returns 0 if successful, -ve on error. 961 */ 962 static int may_linkat(struct path *link) 963 { 964 struct inode *inode; 965 966 if (!sysctl_protected_hardlinks) 967 return 0; 968 969 inode = link->dentry->d_inode; 970 971 /* Source inode owner (or CAP_FOWNER) can hardlink all they like, 972 * otherwise, it must be a safe source. 973 */ 974 if (inode_owner_or_capable(inode) || safe_hardlink_source(inode)) 975 return 0; 976 977 audit_log_link_denied("linkat", link); 978 return -EPERM; 979 } 980 981 static __always_inline 982 const char *get_link(struct nameidata *nd) 983 { 984 struct saved *last = nd->stack + nd->depth - 1; 985 struct dentry *dentry = last->link.dentry; 986 struct inode *inode = last->inode; 987 int error; 988 const char *res; 989 990 if (!(nd->flags & LOOKUP_RCU)) { 991 touch_atime(&last->link); 992 cond_resched(); 993 } else if (atime_needs_update(&last->link, inode)) { 994 if (unlikely(unlazy_walk(nd, NULL, 0))) 995 return ERR_PTR(-ECHILD); 996 touch_atime(&last->link); 997 } 998 999 error = security_inode_follow_link(dentry, inode, 1000 nd->flags & LOOKUP_RCU); 1001 if (unlikely(error)) 1002 return ERR_PTR(error); 1003 1004 nd->last_type = LAST_BIND; 1005 res = inode->i_link; 1006 if (!res) { 1007 if (nd->flags & LOOKUP_RCU) { 1008 if (unlikely(unlazy_walk(nd, NULL, 0))) 1009 return ERR_PTR(-ECHILD); 1010 } 1011 res = inode->i_op->follow_link(dentry, &last->cookie); 1012 if (IS_ERR_OR_NULL(res)) { 1013 last->cookie = NULL; 1014 return res; 1015 } 1016 } 1017 if (*res == '/') { 1018 if (nd->flags & LOOKUP_RCU) { 1019 struct dentry *d; 1020 if (!nd->root.mnt) 1021 set_root_rcu(nd); 1022 nd->path = nd->root; 1023 d = nd->path.dentry; 1024 nd->inode = d->d_inode; 1025 nd->seq = nd->root_seq; 1026 if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq))) 1027 return ERR_PTR(-ECHILD); 1028 } else { 1029 if (!nd->root.mnt) 1030 set_root(nd); 1031 path_put(&nd->path); 1032 nd->path = nd->root; 1033 path_get(&nd->root); 1034 nd->inode = nd->path.dentry->d_inode; 1035 } 1036 nd->flags |= LOOKUP_JUMPED; 1037 while (unlikely(*++res == '/')) 1038 ; 1039 } 1040 if (!*res) 1041 res = NULL; 1042 return res; 1043 } 1044 1045 /* 1046 * follow_up - Find the mountpoint of path's vfsmount 1047 * 1048 * Given a path, find the mountpoint of its source file system. 1049 * Replace @path with the path of the mountpoint in the parent mount. 1050 * Up is towards /. 1051 * 1052 * Return 1 if we went up a level and 0 if we were already at the 1053 * root. 1054 */ 1055 int follow_up(struct path *path) 1056 { 1057 struct mount *mnt = real_mount(path->mnt); 1058 struct mount *parent; 1059 struct dentry *mountpoint; 1060 1061 read_seqlock_excl(&mount_lock); 1062 parent = mnt->mnt_parent; 1063 if (parent == mnt) { 1064 read_sequnlock_excl(&mount_lock); 1065 return 0; 1066 } 1067 mntget(&parent->mnt); 1068 mountpoint = dget(mnt->mnt_mountpoint); 1069 read_sequnlock_excl(&mount_lock); 1070 dput(path->dentry); 1071 path->dentry = mountpoint; 1072 mntput(path->mnt); 1073 path->mnt = &parent->mnt; 1074 return 1; 1075 } 1076 EXPORT_SYMBOL(follow_up); 1077 1078 /* 1079 * Perform an automount 1080 * - return -EISDIR to tell follow_managed() to stop and return the path we 1081 * were called with. 1082 */ 1083 static int follow_automount(struct path *path, struct nameidata *nd, 1084 bool *need_mntput) 1085 { 1086 struct vfsmount *mnt; 1087 int err; 1088 1089 if (!path->dentry->d_op || !path->dentry->d_op->d_automount) 1090 return -EREMOTE; 1091 1092 /* We don't want to mount if someone's just doing a stat - 1093 * unless they're stat'ing a directory and appended a '/' to 1094 * the name. 1095 * 1096 * We do, however, want to mount if someone wants to open or 1097 * create a file of any type under the mountpoint, wants to 1098 * traverse through the mountpoint or wants to open the 1099 * mounted directory. Also, autofs may mark negative dentries 1100 * as being automount points. These will need the attentions 1101 * of the daemon to instantiate them before they can be used. 1102 */ 1103 if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | 1104 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) && 1105 path->dentry->d_inode) 1106 return -EISDIR; 1107 1108 nd->total_link_count++; 1109 if (nd->total_link_count >= 40) 1110 return -ELOOP; 1111 1112 mnt = path->dentry->d_op->d_automount(path); 1113 if (IS_ERR(mnt)) { 1114 /* 1115 * The filesystem is allowed to return -EISDIR here to indicate 1116 * it doesn't want to automount. For instance, autofs would do 1117 * this so that its userspace daemon can mount on this dentry. 1118 * 1119 * However, we can only permit this if it's a terminal point in 1120 * the path being looked up; if it wasn't then the remainder of 1121 * the path is inaccessible and we should say so. 1122 */ 1123 if (PTR_ERR(mnt) == -EISDIR && (nd->flags & LOOKUP_PARENT)) 1124 return -EREMOTE; 1125 return PTR_ERR(mnt); 1126 } 1127 1128 if (!mnt) /* mount collision */ 1129 return 0; 1130 1131 if (!*need_mntput) { 1132 /* lock_mount() may release path->mnt on error */ 1133 mntget(path->mnt); 1134 *need_mntput = true; 1135 } 1136 err = finish_automount(mnt, path); 1137 1138 switch (err) { 1139 case -EBUSY: 1140 /* Someone else made a mount here whilst we were busy */ 1141 return 0; 1142 case 0: 1143 path_put(path); 1144 path->mnt = mnt; 1145 path->dentry = dget(mnt->mnt_root); 1146 return 0; 1147 default: 1148 return err; 1149 } 1150 1151 } 1152 1153 /* 1154 * Handle a dentry that is managed in some way. 1155 * - Flagged for transit management (autofs) 1156 * - Flagged as mountpoint 1157 * - Flagged as automount point 1158 * 1159 * This may only be called in refwalk mode. 1160 * 1161 * Serialization is taken care of in namespace.c 1162 */ 1163 static int follow_managed(struct path *path, struct nameidata *nd) 1164 { 1165 struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */ 1166 unsigned managed; 1167 bool need_mntput = false; 1168 int ret = 0; 1169 1170 /* Given that we're not holding a lock here, we retain the value in a 1171 * local variable for each dentry as we look at it so that we don't see 1172 * the components of that value change under us */ 1173 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1174 managed &= DCACHE_MANAGED_DENTRY, 1175 unlikely(managed != 0)) { 1176 /* Allow the filesystem to manage the transit without i_mutex 1177 * being held. */ 1178 if (managed & DCACHE_MANAGE_TRANSIT) { 1179 BUG_ON(!path->dentry->d_op); 1180 BUG_ON(!path->dentry->d_op->d_manage); 1181 ret = path->dentry->d_op->d_manage(path->dentry, false); 1182 if (ret < 0) 1183 break; 1184 } 1185 1186 /* Transit to a mounted filesystem. */ 1187 if (managed & DCACHE_MOUNTED) { 1188 struct vfsmount *mounted = lookup_mnt(path); 1189 if (mounted) { 1190 dput(path->dentry); 1191 if (need_mntput) 1192 mntput(path->mnt); 1193 path->mnt = mounted; 1194 path->dentry = dget(mounted->mnt_root); 1195 need_mntput = true; 1196 continue; 1197 } 1198 1199 /* Something is mounted on this dentry in another 1200 * namespace and/or whatever was mounted there in this 1201 * namespace got unmounted before lookup_mnt() could 1202 * get it */ 1203 } 1204 1205 /* Handle an automount point */ 1206 if (managed & DCACHE_NEED_AUTOMOUNT) { 1207 ret = follow_automount(path, nd, &need_mntput); 1208 if (ret < 0) 1209 break; 1210 continue; 1211 } 1212 1213 /* We didn't change the current path point */ 1214 break; 1215 } 1216 1217 if (need_mntput && path->mnt == mnt) 1218 mntput(path->mnt); 1219 if (ret == -EISDIR) 1220 ret = 0; 1221 if (need_mntput) 1222 nd->flags |= LOOKUP_JUMPED; 1223 if (unlikely(ret < 0)) 1224 path_put_conditional(path, nd); 1225 return ret; 1226 } 1227 1228 int follow_down_one(struct path *path) 1229 { 1230 struct vfsmount *mounted; 1231 1232 mounted = lookup_mnt(path); 1233 if (mounted) { 1234 dput(path->dentry); 1235 mntput(path->mnt); 1236 path->mnt = mounted; 1237 path->dentry = dget(mounted->mnt_root); 1238 return 1; 1239 } 1240 return 0; 1241 } 1242 EXPORT_SYMBOL(follow_down_one); 1243 1244 static inline int managed_dentry_rcu(struct dentry *dentry) 1245 { 1246 return (dentry->d_flags & DCACHE_MANAGE_TRANSIT) ? 1247 dentry->d_op->d_manage(dentry, true) : 0; 1248 } 1249 1250 /* 1251 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if 1252 * we meet a managed dentry that would need blocking. 1253 */ 1254 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, 1255 struct inode **inode, unsigned *seqp) 1256 { 1257 for (;;) { 1258 struct mount *mounted; 1259 /* 1260 * Don't forget we might have a non-mountpoint managed dentry 1261 * that wants to block transit. 1262 */ 1263 switch (managed_dentry_rcu(path->dentry)) { 1264 case -ECHILD: 1265 default: 1266 return false; 1267 case -EISDIR: 1268 return true; 1269 case 0: 1270 break; 1271 } 1272 1273 if (!d_mountpoint(path->dentry)) 1274 return !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT); 1275 1276 mounted = __lookup_mnt(path->mnt, path->dentry); 1277 if (!mounted) 1278 break; 1279 path->mnt = &mounted->mnt; 1280 path->dentry = mounted->mnt.mnt_root; 1281 nd->flags |= LOOKUP_JUMPED; 1282 *seqp = read_seqcount_begin(&path->dentry->d_seq); 1283 /* 1284 * Update the inode too. We don't need to re-check the 1285 * dentry sequence number here after this d_inode read, 1286 * because a mount-point is always pinned. 1287 */ 1288 *inode = path->dentry->d_inode; 1289 } 1290 return !read_seqretry(&mount_lock, nd->m_seq) && 1291 !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT); 1292 } 1293 1294 static int follow_dotdot_rcu(struct nameidata *nd) 1295 { 1296 struct inode *inode = nd->inode; 1297 if (!nd->root.mnt) 1298 set_root_rcu(nd); 1299 1300 while (1) { 1301 if (path_equal(&nd->path, &nd->root)) 1302 break; 1303 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1304 struct dentry *old = nd->path.dentry; 1305 struct dentry *parent = old->d_parent; 1306 unsigned seq; 1307 1308 inode = parent->d_inode; 1309 seq = read_seqcount_begin(&parent->d_seq); 1310 if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq))) 1311 return -ECHILD; 1312 nd->path.dentry = parent; 1313 nd->seq = seq; 1314 if (unlikely(!path_connected(&nd->path))) 1315 return -ENOENT; 1316 break; 1317 } else { 1318 struct mount *mnt = real_mount(nd->path.mnt); 1319 struct mount *mparent = mnt->mnt_parent; 1320 struct dentry *mountpoint = mnt->mnt_mountpoint; 1321 struct inode *inode2 = mountpoint->d_inode; 1322 unsigned seq = read_seqcount_begin(&mountpoint->d_seq); 1323 if (unlikely(read_seqretry(&mount_lock, nd->m_seq))) 1324 return -ECHILD; 1325 if (&mparent->mnt == nd->path.mnt) 1326 break; 1327 /* we know that mountpoint was pinned */ 1328 nd->path.dentry = mountpoint; 1329 nd->path.mnt = &mparent->mnt; 1330 inode = inode2; 1331 nd->seq = seq; 1332 } 1333 } 1334 while (unlikely(d_mountpoint(nd->path.dentry))) { 1335 struct mount *mounted; 1336 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry); 1337 if (unlikely(read_seqretry(&mount_lock, nd->m_seq))) 1338 return -ECHILD; 1339 if (!mounted) 1340 break; 1341 nd->path.mnt = &mounted->mnt; 1342 nd->path.dentry = mounted->mnt.mnt_root; 1343 inode = nd->path.dentry->d_inode; 1344 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 1345 } 1346 nd->inode = inode; 1347 return 0; 1348 } 1349 1350 /* 1351 * Follow down to the covering mount currently visible to userspace. At each 1352 * point, the filesystem owning that dentry may be queried as to whether the 1353 * caller is permitted to proceed or not. 1354 */ 1355 int follow_down(struct path *path) 1356 { 1357 unsigned managed; 1358 int ret; 1359 1360 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1361 unlikely(managed & DCACHE_MANAGED_DENTRY)) { 1362 /* Allow the filesystem to manage the transit without i_mutex 1363 * being held. 1364 * 1365 * We indicate to the filesystem if someone is trying to mount 1366 * something here. This gives autofs the chance to deny anyone 1367 * other than its daemon the right to mount on its 1368 * superstructure. 1369 * 1370 * The filesystem may sleep at this point. 1371 */ 1372 if (managed & DCACHE_MANAGE_TRANSIT) { 1373 BUG_ON(!path->dentry->d_op); 1374 BUG_ON(!path->dentry->d_op->d_manage); 1375 ret = path->dentry->d_op->d_manage( 1376 path->dentry, false); 1377 if (ret < 0) 1378 return ret == -EISDIR ? 0 : ret; 1379 } 1380 1381 /* Transit to a mounted filesystem. */ 1382 if (managed & DCACHE_MOUNTED) { 1383 struct vfsmount *mounted = lookup_mnt(path); 1384 if (!mounted) 1385 break; 1386 dput(path->dentry); 1387 mntput(path->mnt); 1388 path->mnt = mounted; 1389 path->dentry = dget(mounted->mnt_root); 1390 continue; 1391 } 1392 1393 /* Don't handle automount points here */ 1394 break; 1395 } 1396 return 0; 1397 } 1398 EXPORT_SYMBOL(follow_down); 1399 1400 /* 1401 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot() 1402 */ 1403 static void follow_mount(struct path *path) 1404 { 1405 while (d_mountpoint(path->dentry)) { 1406 struct vfsmount *mounted = lookup_mnt(path); 1407 if (!mounted) 1408 break; 1409 dput(path->dentry); 1410 mntput(path->mnt); 1411 path->mnt = mounted; 1412 path->dentry = dget(mounted->mnt_root); 1413 } 1414 } 1415 1416 static int follow_dotdot(struct nameidata *nd) 1417 { 1418 if (!nd->root.mnt) 1419 set_root(nd); 1420 1421 while(1) { 1422 struct dentry *old = nd->path.dentry; 1423 1424 if (nd->path.dentry == nd->root.dentry && 1425 nd->path.mnt == nd->root.mnt) { 1426 break; 1427 } 1428 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1429 /* rare case of legitimate dget_parent()... */ 1430 nd->path.dentry = dget_parent(nd->path.dentry); 1431 dput(old); 1432 if (unlikely(!path_connected(&nd->path))) 1433 return -ENOENT; 1434 break; 1435 } 1436 if (!follow_up(&nd->path)) 1437 break; 1438 } 1439 follow_mount(&nd->path); 1440 nd->inode = nd->path.dentry->d_inode; 1441 return 0; 1442 } 1443 1444 /* 1445 * This looks up the name in dcache, possibly revalidates the old dentry and 1446 * allocates a new one if not found or not valid. In the need_lookup argument 1447 * returns whether i_op->lookup is necessary. 1448 * 1449 * dir->d_inode->i_mutex must be held 1450 */ 1451 static struct dentry *lookup_dcache(struct qstr *name, struct dentry *dir, 1452 unsigned int flags, bool *need_lookup) 1453 { 1454 struct dentry *dentry; 1455 int error; 1456 1457 *need_lookup = false; 1458 dentry = d_lookup(dir, name); 1459 if (dentry) { 1460 if (dentry->d_flags & DCACHE_OP_REVALIDATE) { 1461 error = d_revalidate(dentry, flags); 1462 if (unlikely(error <= 0)) { 1463 if (error < 0) { 1464 dput(dentry); 1465 return ERR_PTR(error); 1466 } else { 1467 d_invalidate(dentry); 1468 dput(dentry); 1469 dentry = NULL; 1470 } 1471 } 1472 } 1473 } 1474 1475 if (!dentry) { 1476 dentry = d_alloc(dir, name); 1477 if (unlikely(!dentry)) 1478 return ERR_PTR(-ENOMEM); 1479 1480 *need_lookup = true; 1481 } 1482 return dentry; 1483 } 1484 1485 /* 1486 * Call i_op->lookup on the dentry. The dentry must be negative and 1487 * unhashed. 1488 * 1489 * dir->d_inode->i_mutex must be held 1490 */ 1491 static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry, 1492 unsigned int flags) 1493 { 1494 struct dentry *old; 1495 1496 /* Don't create child dentry for a dead directory. */ 1497 if (unlikely(IS_DEADDIR(dir))) { 1498 dput(dentry); 1499 return ERR_PTR(-ENOENT); 1500 } 1501 1502 old = dir->i_op->lookup(dir, dentry, flags); 1503 if (unlikely(old)) { 1504 dput(dentry); 1505 dentry = old; 1506 } 1507 return dentry; 1508 } 1509 1510 static struct dentry *__lookup_hash(struct qstr *name, 1511 struct dentry *base, unsigned int flags) 1512 { 1513 bool need_lookup; 1514 struct dentry *dentry; 1515 1516 dentry = lookup_dcache(name, base, flags, &need_lookup); 1517 if (!need_lookup) 1518 return dentry; 1519 1520 return lookup_real(base->d_inode, dentry, flags); 1521 } 1522 1523 /* 1524 * It's more convoluted than I'd like it to be, but... it's still fairly 1525 * small and for now I'd prefer to have fast path as straight as possible. 1526 * It _is_ time-critical. 1527 */ 1528 static int lookup_fast(struct nameidata *nd, 1529 struct path *path, struct inode **inode, 1530 unsigned *seqp) 1531 { 1532 struct vfsmount *mnt = nd->path.mnt; 1533 struct dentry *dentry, *parent = nd->path.dentry; 1534 int need_reval = 1; 1535 int status = 1; 1536 int err; 1537 1538 /* 1539 * Rename seqlock is not required here because in the off chance 1540 * of a false negative due to a concurrent rename, we're going to 1541 * do the non-racy lookup, below. 1542 */ 1543 if (nd->flags & LOOKUP_RCU) { 1544 unsigned seq; 1545 bool negative; 1546 dentry = __d_lookup_rcu(parent, &nd->last, &seq); 1547 if (!dentry) 1548 goto unlazy; 1549 1550 /* 1551 * This sequence count validates that the inode matches 1552 * the dentry name information from lookup. 1553 */ 1554 *inode = d_backing_inode(dentry); 1555 negative = d_is_negative(dentry); 1556 if (read_seqcount_retry(&dentry->d_seq, seq)) 1557 return -ECHILD; 1558 1559 /* 1560 * This sequence count validates that the parent had no 1561 * changes while we did the lookup of the dentry above. 1562 * 1563 * The memory barrier in read_seqcount_begin of child is 1564 * enough, we can use __read_seqcount_retry here. 1565 */ 1566 if (__read_seqcount_retry(&parent->d_seq, nd->seq)) 1567 return -ECHILD; 1568 1569 *seqp = seq; 1570 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) { 1571 status = d_revalidate(dentry, nd->flags); 1572 if (unlikely(status <= 0)) { 1573 if (status != -ECHILD) 1574 need_reval = 0; 1575 goto unlazy; 1576 } 1577 } 1578 /* 1579 * Note: do negative dentry check after revalidation in 1580 * case that drops it. 1581 */ 1582 if (negative) 1583 return -ENOENT; 1584 path->mnt = mnt; 1585 path->dentry = dentry; 1586 if (likely(__follow_mount_rcu(nd, path, inode, seqp))) 1587 return 0; 1588 unlazy: 1589 if (unlazy_walk(nd, dentry, seq)) 1590 return -ECHILD; 1591 } else { 1592 dentry = __d_lookup(parent, &nd->last); 1593 } 1594 1595 if (unlikely(!dentry)) 1596 goto need_lookup; 1597 1598 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval) 1599 status = d_revalidate(dentry, nd->flags); 1600 if (unlikely(status <= 0)) { 1601 if (status < 0) { 1602 dput(dentry); 1603 return status; 1604 } 1605 d_invalidate(dentry); 1606 dput(dentry); 1607 goto need_lookup; 1608 } 1609 1610 if (unlikely(d_is_negative(dentry))) { 1611 dput(dentry); 1612 return -ENOENT; 1613 } 1614 path->mnt = mnt; 1615 path->dentry = dentry; 1616 err = follow_managed(path, nd); 1617 if (likely(!err)) 1618 *inode = d_backing_inode(path->dentry); 1619 return err; 1620 1621 need_lookup: 1622 return 1; 1623 } 1624 1625 /* Fast lookup failed, do it the slow way */ 1626 static int lookup_slow(struct nameidata *nd, struct path *path) 1627 { 1628 struct dentry *dentry, *parent; 1629 1630 parent = nd->path.dentry; 1631 BUG_ON(nd->inode != parent->d_inode); 1632 1633 mutex_lock(&parent->d_inode->i_mutex); 1634 dentry = __lookup_hash(&nd->last, parent, nd->flags); 1635 mutex_unlock(&parent->d_inode->i_mutex); 1636 if (IS_ERR(dentry)) 1637 return PTR_ERR(dentry); 1638 path->mnt = nd->path.mnt; 1639 path->dentry = dentry; 1640 return follow_managed(path, nd); 1641 } 1642 1643 static inline int may_lookup(struct nameidata *nd) 1644 { 1645 if (nd->flags & LOOKUP_RCU) { 1646 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK); 1647 if (err != -ECHILD) 1648 return err; 1649 if (unlazy_walk(nd, NULL, 0)) 1650 return -ECHILD; 1651 } 1652 return inode_permission(nd->inode, MAY_EXEC); 1653 } 1654 1655 static inline int handle_dots(struct nameidata *nd, int type) 1656 { 1657 if (type == LAST_DOTDOT) { 1658 if (nd->flags & LOOKUP_RCU) { 1659 return follow_dotdot_rcu(nd); 1660 } else 1661 return follow_dotdot(nd); 1662 } 1663 return 0; 1664 } 1665 1666 static int pick_link(struct nameidata *nd, struct path *link, 1667 struct inode *inode, unsigned seq) 1668 { 1669 int error; 1670 struct saved *last; 1671 if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) { 1672 path_to_nameidata(link, nd); 1673 return -ELOOP; 1674 } 1675 if (!(nd->flags & LOOKUP_RCU)) { 1676 if (link->mnt == nd->path.mnt) 1677 mntget(link->mnt); 1678 } 1679 error = nd_alloc_stack(nd); 1680 if (unlikely(error)) { 1681 if (error == -ECHILD) { 1682 if (unlikely(unlazy_link(nd, link, seq))) 1683 return -ECHILD; 1684 error = nd_alloc_stack(nd); 1685 } 1686 if (error) { 1687 path_put(link); 1688 return error; 1689 } 1690 } 1691 1692 last = nd->stack + nd->depth++; 1693 last->link = *link; 1694 last->cookie = NULL; 1695 last->inode = inode; 1696 last->seq = seq; 1697 return 1; 1698 } 1699 1700 /* 1701 * Do we need to follow links? We _really_ want to be able 1702 * to do this check without having to look at inode->i_op, 1703 * so we keep a cache of "no, this doesn't need follow_link" 1704 * for the common case. 1705 */ 1706 static inline int should_follow_link(struct nameidata *nd, struct path *link, 1707 int follow, 1708 struct inode *inode, unsigned seq) 1709 { 1710 if (likely(!d_is_symlink(link->dentry))) 1711 return 0; 1712 if (!follow) 1713 return 0; 1714 return pick_link(nd, link, inode, seq); 1715 } 1716 1717 enum {WALK_GET = 1, WALK_PUT = 2}; 1718 1719 static int walk_component(struct nameidata *nd, int flags) 1720 { 1721 struct path path; 1722 struct inode *inode; 1723 unsigned seq; 1724 int err; 1725 /* 1726 * "." and ".." are special - ".." especially so because it has 1727 * to be able to know about the current root directory and 1728 * parent relationships. 1729 */ 1730 if (unlikely(nd->last_type != LAST_NORM)) { 1731 err = handle_dots(nd, nd->last_type); 1732 if (flags & WALK_PUT) 1733 put_link(nd); 1734 return err; 1735 } 1736 err = lookup_fast(nd, &path, &inode, &seq); 1737 if (unlikely(err)) { 1738 if (err < 0) 1739 return err; 1740 1741 err = lookup_slow(nd, &path); 1742 if (err < 0) 1743 return err; 1744 1745 inode = d_backing_inode(path.dentry); 1746 seq = 0; /* we are already out of RCU mode */ 1747 err = -ENOENT; 1748 if (d_is_negative(path.dentry)) 1749 goto out_path_put; 1750 } 1751 1752 if (flags & WALK_PUT) 1753 put_link(nd); 1754 err = should_follow_link(nd, &path, flags & WALK_GET, inode, seq); 1755 if (unlikely(err)) 1756 return err; 1757 path_to_nameidata(&path, nd); 1758 nd->inode = inode; 1759 nd->seq = seq; 1760 return 0; 1761 1762 out_path_put: 1763 path_to_nameidata(&path, nd); 1764 return err; 1765 } 1766 1767 /* 1768 * We can do the critical dentry name comparison and hashing 1769 * operations one word at a time, but we are limited to: 1770 * 1771 * - Architectures with fast unaligned word accesses. We could 1772 * do a "get_unaligned()" if this helps and is sufficiently 1773 * fast. 1774 * 1775 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we 1776 * do not trap on the (extremely unlikely) case of a page 1777 * crossing operation. 1778 * 1779 * - Furthermore, we need an efficient 64-bit compile for the 1780 * 64-bit case in order to generate the "number of bytes in 1781 * the final mask". Again, that could be replaced with a 1782 * efficient population count instruction or similar. 1783 */ 1784 #ifdef CONFIG_DCACHE_WORD_ACCESS 1785 1786 #include <asm/word-at-a-time.h> 1787 1788 #ifdef CONFIG_64BIT 1789 1790 static inline unsigned int fold_hash(unsigned long hash) 1791 { 1792 return hash_64(hash, 32); 1793 } 1794 1795 #else /* 32-bit case */ 1796 1797 #define fold_hash(x) (x) 1798 1799 #endif 1800 1801 unsigned int full_name_hash(const unsigned char *name, unsigned int len) 1802 { 1803 unsigned long a, mask; 1804 unsigned long hash = 0; 1805 1806 for (;;) { 1807 a = load_unaligned_zeropad(name); 1808 if (len < sizeof(unsigned long)) 1809 break; 1810 hash += a; 1811 hash *= 9; 1812 name += sizeof(unsigned long); 1813 len -= sizeof(unsigned long); 1814 if (!len) 1815 goto done; 1816 } 1817 mask = bytemask_from_count(len); 1818 hash += mask & a; 1819 done: 1820 return fold_hash(hash); 1821 } 1822 EXPORT_SYMBOL(full_name_hash); 1823 1824 /* 1825 * Calculate the length and hash of the path component, and 1826 * return the "hash_len" as the result. 1827 */ 1828 static inline u64 hash_name(const char *name) 1829 { 1830 unsigned long a, b, adata, bdata, mask, hash, len; 1831 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 1832 1833 hash = a = 0; 1834 len = -sizeof(unsigned long); 1835 do { 1836 hash = (hash + a) * 9; 1837 len += sizeof(unsigned long); 1838 a = load_unaligned_zeropad(name+len); 1839 b = a ^ REPEAT_BYTE('/'); 1840 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants))); 1841 1842 adata = prep_zero_mask(a, adata, &constants); 1843 bdata = prep_zero_mask(b, bdata, &constants); 1844 1845 mask = create_zero_mask(adata | bdata); 1846 1847 hash += a & zero_bytemask(mask); 1848 len += find_zero(mask); 1849 return hashlen_create(fold_hash(hash), len); 1850 } 1851 1852 #else 1853 1854 unsigned int full_name_hash(const unsigned char *name, unsigned int len) 1855 { 1856 unsigned long hash = init_name_hash(); 1857 while (len--) 1858 hash = partial_name_hash(*name++, hash); 1859 return end_name_hash(hash); 1860 } 1861 EXPORT_SYMBOL(full_name_hash); 1862 1863 /* 1864 * We know there's a real path component here of at least 1865 * one character. 1866 */ 1867 static inline u64 hash_name(const char *name) 1868 { 1869 unsigned long hash = init_name_hash(); 1870 unsigned long len = 0, c; 1871 1872 c = (unsigned char)*name; 1873 do { 1874 len++; 1875 hash = partial_name_hash(c, hash); 1876 c = (unsigned char)name[len]; 1877 } while (c && c != '/'); 1878 return hashlen_create(end_name_hash(hash), len); 1879 } 1880 1881 #endif 1882 1883 /* 1884 * Name resolution. 1885 * This is the basic name resolution function, turning a pathname into 1886 * the final dentry. We expect 'base' to be positive and a directory. 1887 * 1888 * Returns 0 and nd will have valid dentry and mnt on success. 1889 * Returns error and drops reference to input namei data on failure. 1890 */ 1891 static int link_path_walk(const char *name, struct nameidata *nd) 1892 { 1893 int err; 1894 1895 while (*name=='/') 1896 name++; 1897 if (!*name) 1898 return 0; 1899 1900 /* At this point we know we have a real path component. */ 1901 for(;;) { 1902 u64 hash_len; 1903 int type; 1904 1905 err = may_lookup(nd); 1906 if (err) 1907 return err; 1908 1909 hash_len = hash_name(name); 1910 1911 type = LAST_NORM; 1912 if (name[0] == '.') switch (hashlen_len(hash_len)) { 1913 case 2: 1914 if (name[1] == '.') { 1915 type = LAST_DOTDOT; 1916 nd->flags |= LOOKUP_JUMPED; 1917 } 1918 break; 1919 case 1: 1920 type = LAST_DOT; 1921 } 1922 if (likely(type == LAST_NORM)) { 1923 struct dentry *parent = nd->path.dentry; 1924 nd->flags &= ~LOOKUP_JUMPED; 1925 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { 1926 struct qstr this = { { .hash_len = hash_len }, .name = name }; 1927 err = parent->d_op->d_hash(parent, &this); 1928 if (err < 0) 1929 return err; 1930 hash_len = this.hash_len; 1931 name = this.name; 1932 } 1933 } 1934 1935 nd->last.hash_len = hash_len; 1936 nd->last.name = name; 1937 nd->last_type = type; 1938 1939 name += hashlen_len(hash_len); 1940 if (!*name) 1941 goto OK; 1942 /* 1943 * If it wasn't NUL, we know it was '/'. Skip that 1944 * slash, and continue until no more slashes. 1945 */ 1946 do { 1947 name++; 1948 } while (unlikely(*name == '/')); 1949 if (unlikely(!*name)) { 1950 OK: 1951 /* pathname body, done */ 1952 if (!nd->depth) 1953 return 0; 1954 name = nd->stack[nd->depth - 1].name; 1955 /* trailing symlink, done */ 1956 if (!name) 1957 return 0; 1958 /* last component of nested symlink */ 1959 err = walk_component(nd, WALK_GET | WALK_PUT); 1960 } else { 1961 err = walk_component(nd, WALK_GET); 1962 } 1963 if (err < 0) 1964 return err; 1965 1966 if (err) { 1967 const char *s = get_link(nd); 1968 1969 if (IS_ERR(s)) 1970 return PTR_ERR(s); 1971 err = 0; 1972 if (unlikely(!s)) { 1973 /* jumped */ 1974 put_link(nd); 1975 } else { 1976 nd->stack[nd->depth - 1].name = name; 1977 name = s; 1978 continue; 1979 } 1980 } 1981 if (unlikely(!d_can_lookup(nd->path.dentry))) { 1982 if (nd->flags & LOOKUP_RCU) { 1983 if (unlazy_walk(nd, NULL, 0)) 1984 return -ECHILD; 1985 } 1986 return -ENOTDIR; 1987 } 1988 } 1989 } 1990 1991 static const char *path_init(struct nameidata *nd, unsigned flags) 1992 { 1993 int retval = 0; 1994 const char *s = nd->name->name; 1995 1996 nd->last_type = LAST_ROOT; /* if there are only slashes... */ 1997 nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT; 1998 nd->depth = 0; 1999 if (flags & LOOKUP_ROOT) { 2000 struct dentry *root = nd->root.dentry; 2001 struct inode *inode = root->d_inode; 2002 if (*s) { 2003 if (!d_can_lookup(root)) 2004 return ERR_PTR(-ENOTDIR); 2005 retval = inode_permission(inode, MAY_EXEC); 2006 if (retval) 2007 return ERR_PTR(retval); 2008 } 2009 nd->path = nd->root; 2010 nd->inode = inode; 2011 if (flags & LOOKUP_RCU) { 2012 rcu_read_lock(); 2013 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 2014 nd->root_seq = nd->seq; 2015 nd->m_seq = read_seqbegin(&mount_lock); 2016 } else { 2017 path_get(&nd->path); 2018 } 2019 return s; 2020 } 2021 2022 nd->root.mnt = NULL; 2023 2024 nd->m_seq = read_seqbegin(&mount_lock); 2025 if (*s == '/') { 2026 if (flags & LOOKUP_RCU) { 2027 rcu_read_lock(); 2028 set_root_rcu(nd); 2029 nd->seq = nd->root_seq; 2030 } else { 2031 set_root(nd); 2032 path_get(&nd->root); 2033 } 2034 nd->path = nd->root; 2035 } else if (nd->dfd == AT_FDCWD) { 2036 if (flags & LOOKUP_RCU) { 2037 struct fs_struct *fs = current->fs; 2038 unsigned seq; 2039 2040 rcu_read_lock(); 2041 2042 do { 2043 seq = read_seqcount_begin(&fs->seq); 2044 nd->path = fs->pwd; 2045 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 2046 } while (read_seqcount_retry(&fs->seq, seq)); 2047 } else { 2048 get_fs_pwd(current->fs, &nd->path); 2049 } 2050 } else { 2051 /* Caller must check execute permissions on the starting path component */ 2052 struct fd f = fdget_raw(nd->dfd); 2053 struct dentry *dentry; 2054 2055 if (!f.file) 2056 return ERR_PTR(-EBADF); 2057 2058 dentry = f.file->f_path.dentry; 2059 2060 if (*s) { 2061 if (!d_can_lookup(dentry)) { 2062 fdput(f); 2063 return ERR_PTR(-ENOTDIR); 2064 } 2065 } 2066 2067 nd->path = f.file->f_path; 2068 if (flags & LOOKUP_RCU) { 2069 rcu_read_lock(); 2070 nd->inode = nd->path.dentry->d_inode; 2071 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 2072 } else { 2073 path_get(&nd->path); 2074 nd->inode = nd->path.dentry->d_inode; 2075 } 2076 fdput(f); 2077 return s; 2078 } 2079 2080 nd->inode = nd->path.dentry->d_inode; 2081 if (!(flags & LOOKUP_RCU)) 2082 return s; 2083 if (likely(!read_seqcount_retry(&nd->path.dentry->d_seq, nd->seq))) 2084 return s; 2085 if (!(nd->flags & LOOKUP_ROOT)) 2086 nd->root.mnt = NULL; 2087 rcu_read_unlock(); 2088 return ERR_PTR(-ECHILD); 2089 } 2090 2091 static const char *trailing_symlink(struct nameidata *nd) 2092 { 2093 const char *s; 2094 int error = may_follow_link(nd); 2095 if (unlikely(error)) 2096 return ERR_PTR(error); 2097 nd->flags |= LOOKUP_PARENT; 2098 nd->stack[0].name = NULL; 2099 s = get_link(nd); 2100 return s ? s : ""; 2101 } 2102 2103 static inline int lookup_last(struct nameidata *nd) 2104 { 2105 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len]) 2106 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 2107 2108 nd->flags &= ~LOOKUP_PARENT; 2109 return walk_component(nd, 2110 nd->flags & LOOKUP_FOLLOW 2111 ? nd->depth 2112 ? WALK_PUT | WALK_GET 2113 : WALK_GET 2114 : 0); 2115 } 2116 2117 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 2118 static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path) 2119 { 2120 const char *s = path_init(nd, flags); 2121 int err; 2122 2123 if (IS_ERR(s)) 2124 return PTR_ERR(s); 2125 while (!(err = link_path_walk(s, nd)) 2126 && ((err = lookup_last(nd)) > 0)) { 2127 s = trailing_symlink(nd); 2128 if (IS_ERR(s)) { 2129 err = PTR_ERR(s); 2130 break; 2131 } 2132 } 2133 if (!err) 2134 err = complete_walk(nd); 2135 2136 if (!err && nd->flags & LOOKUP_DIRECTORY) 2137 if (!d_can_lookup(nd->path.dentry)) 2138 err = -ENOTDIR; 2139 if (!err) { 2140 *path = nd->path; 2141 nd->path.mnt = NULL; 2142 nd->path.dentry = NULL; 2143 } 2144 terminate_walk(nd); 2145 return err; 2146 } 2147 2148 static int filename_lookup(int dfd, struct filename *name, unsigned flags, 2149 struct path *path, struct path *root) 2150 { 2151 int retval; 2152 struct nameidata nd; 2153 if (IS_ERR(name)) 2154 return PTR_ERR(name); 2155 if (unlikely(root)) { 2156 nd.root = *root; 2157 flags |= LOOKUP_ROOT; 2158 } 2159 set_nameidata(&nd, dfd, name); 2160 retval = path_lookupat(&nd, flags | LOOKUP_RCU, path); 2161 if (unlikely(retval == -ECHILD)) 2162 retval = path_lookupat(&nd, flags, path); 2163 if (unlikely(retval == -ESTALE)) 2164 retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path); 2165 2166 if (likely(!retval)) 2167 audit_inode(name, path->dentry, flags & LOOKUP_PARENT); 2168 restore_nameidata(); 2169 putname(name); 2170 return retval; 2171 } 2172 2173 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 2174 static int path_parentat(struct nameidata *nd, unsigned flags, 2175 struct path *parent) 2176 { 2177 const char *s = path_init(nd, flags); 2178 int err; 2179 if (IS_ERR(s)) 2180 return PTR_ERR(s); 2181 err = link_path_walk(s, nd); 2182 if (!err) 2183 err = complete_walk(nd); 2184 if (!err) { 2185 *parent = nd->path; 2186 nd->path.mnt = NULL; 2187 nd->path.dentry = NULL; 2188 } 2189 terminate_walk(nd); 2190 return err; 2191 } 2192 2193 static struct filename *filename_parentat(int dfd, struct filename *name, 2194 unsigned int flags, struct path *parent, 2195 struct qstr *last, int *type) 2196 { 2197 int retval; 2198 struct nameidata nd; 2199 2200 if (IS_ERR(name)) 2201 return name; 2202 set_nameidata(&nd, dfd, name); 2203 retval = path_parentat(&nd, flags | LOOKUP_RCU, parent); 2204 if (unlikely(retval == -ECHILD)) 2205 retval = path_parentat(&nd, flags, parent); 2206 if (unlikely(retval == -ESTALE)) 2207 retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent); 2208 if (likely(!retval)) { 2209 *last = nd.last; 2210 *type = nd.last_type; 2211 audit_inode(name, parent->dentry, LOOKUP_PARENT); 2212 } else { 2213 putname(name); 2214 name = ERR_PTR(retval); 2215 } 2216 restore_nameidata(); 2217 return name; 2218 } 2219 2220 /* does lookup, returns the object with parent locked */ 2221 struct dentry *kern_path_locked(const char *name, struct path *path) 2222 { 2223 struct filename *filename; 2224 struct dentry *d; 2225 struct qstr last; 2226 int type; 2227 2228 filename = filename_parentat(AT_FDCWD, getname_kernel(name), 0, path, 2229 &last, &type); 2230 if (IS_ERR(filename)) 2231 return ERR_CAST(filename); 2232 if (unlikely(type != LAST_NORM)) { 2233 path_put(path); 2234 putname(filename); 2235 return ERR_PTR(-EINVAL); 2236 } 2237 mutex_lock_nested(&path->dentry->d_inode->i_mutex, I_MUTEX_PARENT); 2238 d = __lookup_hash(&last, path->dentry, 0); 2239 if (IS_ERR(d)) { 2240 mutex_unlock(&path->dentry->d_inode->i_mutex); 2241 path_put(path); 2242 } 2243 putname(filename); 2244 return d; 2245 } 2246 2247 int kern_path(const char *name, unsigned int flags, struct path *path) 2248 { 2249 return filename_lookup(AT_FDCWD, getname_kernel(name), 2250 flags, path, NULL); 2251 } 2252 EXPORT_SYMBOL(kern_path); 2253 2254 /** 2255 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair 2256 * @dentry: pointer to dentry of the base directory 2257 * @mnt: pointer to vfs mount of the base directory 2258 * @name: pointer to file name 2259 * @flags: lookup flags 2260 * @path: pointer to struct path to fill 2261 */ 2262 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, 2263 const char *name, unsigned int flags, 2264 struct path *path) 2265 { 2266 struct path root = {.mnt = mnt, .dentry = dentry}; 2267 /* the first argument of filename_lookup() is ignored with root */ 2268 return filename_lookup(AT_FDCWD, getname_kernel(name), 2269 flags , path, &root); 2270 } 2271 EXPORT_SYMBOL(vfs_path_lookup); 2272 2273 /** 2274 * lookup_one_len - filesystem helper to lookup single pathname component 2275 * @name: pathname component to lookup 2276 * @base: base directory to lookup from 2277 * @len: maximum length @len should be interpreted to 2278 * 2279 * Note that this routine is purely a helper for filesystem usage and should 2280 * not be called by generic code. 2281 */ 2282 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len) 2283 { 2284 struct qstr this; 2285 unsigned int c; 2286 int err; 2287 2288 WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex)); 2289 2290 this.name = name; 2291 this.len = len; 2292 this.hash = full_name_hash(name, len); 2293 if (!len) 2294 return ERR_PTR(-EACCES); 2295 2296 if (unlikely(name[0] == '.')) { 2297 if (len < 2 || (len == 2 && name[1] == '.')) 2298 return ERR_PTR(-EACCES); 2299 } 2300 2301 while (len--) { 2302 c = *(const unsigned char *)name++; 2303 if (c == '/' || c == '\0') 2304 return ERR_PTR(-EACCES); 2305 } 2306 /* 2307 * See if the low-level filesystem might want 2308 * to use its own hash.. 2309 */ 2310 if (base->d_flags & DCACHE_OP_HASH) { 2311 int err = base->d_op->d_hash(base, &this); 2312 if (err < 0) 2313 return ERR_PTR(err); 2314 } 2315 2316 err = inode_permission(base->d_inode, MAY_EXEC); 2317 if (err) 2318 return ERR_PTR(err); 2319 2320 return __lookup_hash(&this, base, 0); 2321 } 2322 EXPORT_SYMBOL(lookup_one_len); 2323 2324 int user_path_at_empty(int dfd, const char __user *name, unsigned flags, 2325 struct path *path, int *empty) 2326 { 2327 return filename_lookup(dfd, getname_flags(name, flags, empty), 2328 flags, path, NULL); 2329 } 2330 EXPORT_SYMBOL(user_path_at_empty); 2331 2332 /* 2333 * NB: most callers don't do anything directly with the reference to the 2334 * to struct filename, but the nd->last pointer points into the name string 2335 * allocated by getname. So we must hold the reference to it until all 2336 * path-walking is complete. 2337 */ 2338 static inline struct filename * 2339 user_path_parent(int dfd, const char __user *path, 2340 struct path *parent, 2341 struct qstr *last, 2342 int *type, 2343 unsigned int flags) 2344 { 2345 /* only LOOKUP_REVAL is allowed in extra flags */ 2346 return filename_parentat(dfd, getname(path), flags & LOOKUP_REVAL, 2347 parent, last, type); 2348 } 2349 2350 /** 2351 * mountpoint_last - look up last component for umount 2352 * @nd: pathwalk nameidata - currently pointing at parent directory of "last" 2353 * @path: pointer to container for result 2354 * 2355 * This is a special lookup_last function just for umount. In this case, we 2356 * need to resolve the path without doing any revalidation. 2357 * 2358 * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since 2359 * mountpoints are always pinned in the dcache, their ancestors are too. Thus, 2360 * in almost all cases, this lookup will be served out of the dcache. The only 2361 * cases where it won't are if nd->last refers to a symlink or the path is 2362 * bogus and it doesn't exist. 2363 * 2364 * Returns: 2365 * -error: if there was an error during lookup. This includes -ENOENT if the 2366 * lookup found a negative dentry. The nd->path reference will also be 2367 * put in this case. 2368 * 2369 * 0: if we successfully resolved nd->path and found it to not to be a 2370 * symlink that needs to be followed. "path" will also be populated. 2371 * The nd->path reference will also be put. 2372 * 2373 * 1: if we successfully resolved nd->last and found it to be a symlink 2374 * that needs to be followed. "path" will be populated with the path 2375 * to the link, and nd->path will *not* be put. 2376 */ 2377 static int 2378 mountpoint_last(struct nameidata *nd, struct path *path) 2379 { 2380 int error = 0; 2381 struct dentry *dentry; 2382 struct dentry *dir = nd->path.dentry; 2383 2384 /* If we're in rcuwalk, drop out of it to handle last component */ 2385 if (nd->flags & LOOKUP_RCU) { 2386 if (unlazy_walk(nd, NULL, 0)) 2387 return -ECHILD; 2388 } 2389 2390 nd->flags &= ~LOOKUP_PARENT; 2391 2392 if (unlikely(nd->last_type != LAST_NORM)) { 2393 error = handle_dots(nd, nd->last_type); 2394 if (error) 2395 return error; 2396 dentry = dget(nd->path.dentry); 2397 goto done; 2398 } 2399 2400 mutex_lock(&dir->d_inode->i_mutex); 2401 dentry = d_lookup(dir, &nd->last); 2402 if (!dentry) { 2403 /* 2404 * No cached dentry. Mounted dentries are pinned in the cache, 2405 * so that means that this dentry is probably a symlink or the 2406 * path doesn't actually point to a mounted dentry. 2407 */ 2408 dentry = d_alloc(dir, &nd->last); 2409 if (!dentry) { 2410 mutex_unlock(&dir->d_inode->i_mutex); 2411 return -ENOMEM; 2412 } 2413 dentry = lookup_real(dir->d_inode, dentry, nd->flags); 2414 if (IS_ERR(dentry)) { 2415 mutex_unlock(&dir->d_inode->i_mutex); 2416 return PTR_ERR(dentry); 2417 } 2418 } 2419 mutex_unlock(&dir->d_inode->i_mutex); 2420 2421 done: 2422 if (d_is_negative(dentry)) { 2423 dput(dentry); 2424 return -ENOENT; 2425 } 2426 if (nd->depth) 2427 put_link(nd); 2428 path->dentry = dentry; 2429 path->mnt = nd->path.mnt; 2430 error = should_follow_link(nd, path, nd->flags & LOOKUP_FOLLOW, 2431 d_backing_inode(dentry), 0); 2432 if (unlikely(error)) 2433 return error; 2434 mntget(path->mnt); 2435 follow_mount(path); 2436 return 0; 2437 } 2438 2439 /** 2440 * path_mountpoint - look up a path to be umounted 2441 * @nd: lookup context 2442 * @flags: lookup flags 2443 * @path: pointer to container for result 2444 * 2445 * Look up the given name, but don't attempt to revalidate the last component. 2446 * Returns 0 and "path" will be valid on success; Returns error otherwise. 2447 */ 2448 static int 2449 path_mountpoint(struct nameidata *nd, unsigned flags, struct path *path) 2450 { 2451 const char *s = path_init(nd, flags); 2452 int err; 2453 if (IS_ERR(s)) 2454 return PTR_ERR(s); 2455 while (!(err = link_path_walk(s, nd)) && 2456 (err = mountpoint_last(nd, path)) > 0) { 2457 s = trailing_symlink(nd); 2458 if (IS_ERR(s)) { 2459 err = PTR_ERR(s); 2460 break; 2461 } 2462 } 2463 terminate_walk(nd); 2464 return err; 2465 } 2466 2467 static int 2468 filename_mountpoint(int dfd, struct filename *name, struct path *path, 2469 unsigned int flags) 2470 { 2471 struct nameidata nd; 2472 int error; 2473 if (IS_ERR(name)) 2474 return PTR_ERR(name); 2475 set_nameidata(&nd, dfd, name); 2476 error = path_mountpoint(&nd, flags | LOOKUP_RCU, path); 2477 if (unlikely(error == -ECHILD)) 2478 error = path_mountpoint(&nd, flags, path); 2479 if (unlikely(error == -ESTALE)) 2480 error = path_mountpoint(&nd, flags | LOOKUP_REVAL, path); 2481 if (likely(!error)) 2482 audit_inode(name, path->dentry, 0); 2483 restore_nameidata(); 2484 putname(name); 2485 return error; 2486 } 2487 2488 /** 2489 * user_path_mountpoint_at - lookup a path from userland in order to umount it 2490 * @dfd: directory file descriptor 2491 * @name: pathname from userland 2492 * @flags: lookup flags 2493 * @path: pointer to container to hold result 2494 * 2495 * A umount is a special case for path walking. We're not actually interested 2496 * in the inode in this situation, and ESTALE errors can be a problem. We 2497 * simply want track down the dentry and vfsmount attached at the mountpoint 2498 * and avoid revalidating the last component. 2499 * 2500 * Returns 0 and populates "path" on success. 2501 */ 2502 int 2503 user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags, 2504 struct path *path) 2505 { 2506 return filename_mountpoint(dfd, getname(name), path, flags); 2507 } 2508 2509 int 2510 kern_path_mountpoint(int dfd, const char *name, struct path *path, 2511 unsigned int flags) 2512 { 2513 return filename_mountpoint(dfd, getname_kernel(name), path, flags); 2514 } 2515 EXPORT_SYMBOL(kern_path_mountpoint); 2516 2517 int __check_sticky(struct inode *dir, struct inode *inode) 2518 { 2519 kuid_t fsuid = current_fsuid(); 2520 2521 if (uid_eq(inode->i_uid, fsuid)) 2522 return 0; 2523 if (uid_eq(dir->i_uid, fsuid)) 2524 return 0; 2525 return !capable_wrt_inode_uidgid(inode, CAP_FOWNER); 2526 } 2527 EXPORT_SYMBOL(__check_sticky); 2528 2529 /* 2530 * Check whether we can remove a link victim from directory dir, check 2531 * whether the type of victim is right. 2532 * 1. We can't do it if dir is read-only (done in permission()) 2533 * 2. We should have write and exec permissions on dir 2534 * 3. We can't remove anything from append-only dir 2535 * 4. We can't do anything with immutable dir (done in permission()) 2536 * 5. If the sticky bit on dir is set we should either 2537 * a. be owner of dir, or 2538 * b. be owner of victim, or 2539 * c. have CAP_FOWNER capability 2540 * 6. If the victim is append-only or immutable we can't do antyhing with 2541 * links pointing to it. 2542 * 7. If we were asked to remove a directory and victim isn't one - ENOTDIR. 2543 * 8. If we were asked to remove a non-directory and victim isn't one - EISDIR. 2544 * 9. We can't remove a root or mountpoint. 2545 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by 2546 * nfs_async_unlink(). 2547 */ 2548 static int may_delete(struct inode *dir, struct dentry *victim, bool isdir) 2549 { 2550 struct inode *inode = d_backing_inode(victim); 2551 int error; 2552 2553 if (d_is_negative(victim)) 2554 return -ENOENT; 2555 BUG_ON(!inode); 2556 2557 BUG_ON(victim->d_parent->d_inode != dir); 2558 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE); 2559 2560 error = inode_permission(dir, MAY_WRITE | MAY_EXEC); 2561 if (error) 2562 return error; 2563 if (IS_APPEND(dir)) 2564 return -EPERM; 2565 2566 if (check_sticky(dir, inode) || IS_APPEND(inode) || 2567 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode)) 2568 return -EPERM; 2569 if (isdir) { 2570 if (!d_is_dir(victim)) 2571 return -ENOTDIR; 2572 if (IS_ROOT(victim)) 2573 return -EBUSY; 2574 } else if (d_is_dir(victim)) 2575 return -EISDIR; 2576 if (IS_DEADDIR(dir)) 2577 return -ENOENT; 2578 if (victim->d_flags & DCACHE_NFSFS_RENAMED) 2579 return -EBUSY; 2580 return 0; 2581 } 2582 2583 /* Check whether we can create an object with dentry child in directory 2584 * dir. 2585 * 1. We can't do it if child already exists (open has special treatment for 2586 * this case, but since we are inlined it's OK) 2587 * 2. We can't do it if dir is read-only (done in permission()) 2588 * 3. We should have write and exec permissions on dir 2589 * 4. We can't do it if dir is immutable (done in permission()) 2590 */ 2591 static inline int may_create(struct inode *dir, struct dentry *child) 2592 { 2593 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE); 2594 if (child->d_inode) 2595 return -EEXIST; 2596 if (IS_DEADDIR(dir)) 2597 return -ENOENT; 2598 return inode_permission(dir, MAY_WRITE | MAY_EXEC); 2599 } 2600 2601 /* 2602 * p1 and p2 should be directories on the same fs. 2603 */ 2604 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) 2605 { 2606 struct dentry *p; 2607 2608 if (p1 == p2) { 2609 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2610 return NULL; 2611 } 2612 2613 mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 2614 2615 p = d_ancestor(p2, p1); 2616 if (p) { 2617 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT); 2618 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD); 2619 return p; 2620 } 2621 2622 p = d_ancestor(p1, p2); 2623 if (p) { 2624 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2625 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 2626 return p; 2627 } 2628 2629 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2630 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT2); 2631 return NULL; 2632 } 2633 EXPORT_SYMBOL(lock_rename); 2634 2635 void unlock_rename(struct dentry *p1, struct dentry *p2) 2636 { 2637 mutex_unlock(&p1->d_inode->i_mutex); 2638 if (p1 != p2) { 2639 mutex_unlock(&p2->d_inode->i_mutex); 2640 mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 2641 } 2642 } 2643 EXPORT_SYMBOL(unlock_rename); 2644 2645 int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, 2646 bool want_excl) 2647 { 2648 int error = may_create(dir, dentry); 2649 if (error) 2650 return error; 2651 2652 if (!dir->i_op->create) 2653 return -EACCES; /* shouldn't it be ENOSYS? */ 2654 mode &= S_IALLUGO; 2655 mode |= S_IFREG; 2656 error = security_inode_create(dir, dentry, mode); 2657 if (error) 2658 return error; 2659 error = dir->i_op->create(dir, dentry, mode, want_excl); 2660 if (!error) 2661 fsnotify_create(dir, dentry); 2662 return error; 2663 } 2664 EXPORT_SYMBOL(vfs_create); 2665 2666 static int may_open(struct path *path, int acc_mode, int flag) 2667 { 2668 struct dentry *dentry = path->dentry; 2669 struct inode *inode = dentry->d_inode; 2670 int error; 2671 2672 /* O_PATH? */ 2673 if (!acc_mode) 2674 return 0; 2675 2676 if (!inode) 2677 return -ENOENT; 2678 2679 switch (inode->i_mode & S_IFMT) { 2680 case S_IFLNK: 2681 return -ELOOP; 2682 case S_IFDIR: 2683 if (acc_mode & MAY_WRITE) 2684 return -EISDIR; 2685 break; 2686 case S_IFBLK: 2687 case S_IFCHR: 2688 if (path->mnt->mnt_flags & MNT_NODEV) 2689 return -EACCES; 2690 /*FALLTHRU*/ 2691 case S_IFIFO: 2692 case S_IFSOCK: 2693 flag &= ~O_TRUNC; 2694 break; 2695 } 2696 2697 error = inode_permission(inode, acc_mode); 2698 if (error) 2699 return error; 2700 2701 /* 2702 * An append-only file must be opened in append mode for writing. 2703 */ 2704 if (IS_APPEND(inode)) { 2705 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND)) 2706 return -EPERM; 2707 if (flag & O_TRUNC) 2708 return -EPERM; 2709 } 2710 2711 /* O_NOATIME can only be set by the owner or superuser */ 2712 if (flag & O_NOATIME && !inode_owner_or_capable(inode)) 2713 return -EPERM; 2714 2715 return 0; 2716 } 2717 2718 static int handle_truncate(struct file *filp) 2719 { 2720 struct path *path = &filp->f_path; 2721 struct inode *inode = path->dentry->d_inode; 2722 int error = get_write_access(inode); 2723 if (error) 2724 return error; 2725 /* 2726 * Refuse to truncate files with mandatory locks held on them. 2727 */ 2728 error = locks_verify_locked(filp); 2729 if (!error) 2730 error = security_path_truncate(path); 2731 if (!error) { 2732 error = do_truncate(path->dentry, 0, 2733 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN, 2734 filp); 2735 } 2736 put_write_access(inode); 2737 return error; 2738 } 2739 2740 static inline int open_to_namei_flags(int flag) 2741 { 2742 if ((flag & O_ACCMODE) == 3) 2743 flag--; 2744 return flag; 2745 } 2746 2747 static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode) 2748 { 2749 int error = security_path_mknod(dir, dentry, mode, 0); 2750 if (error) 2751 return error; 2752 2753 error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC); 2754 if (error) 2755 return error; 2756 2757 return security_inode_create(dir->dentry->d_inode, dentry, mode); 2758 } 2759 2760 /* 2761 * Attempt to atomically look up, create and open a file from a negative 2762 * dentry. 2763 * 2764 * Returns 0 if successful. The file will have been created and attached to 2765 * @file by the filesystem calling finish_open(). 2766 * 2767 * Returns 1 if the file was looked up only or didn't need creating. The 2768 * caller will need to perform the open themselves. @path will have been 2769 * updated to point to the new dentry. This may be negative. 2770 * 2771 * Returns an error code otherwise. 2772 */ 2773 static int atomic_open(struct nameidata *nd, struct dentry *dentry, 2774 struct path *path, struct file *file, 2775 const struct open_flags *op, 2776 bool got_write, bool need_lookup, 2777 int *opened) 2778 { 2779 struct inode *dir = nd->path.dentry->d_inode; 2780 unsigned open_flag = open_to_namei_flags(op->open_flag); 2781 umode_t mode; 2782 int error; 2783 int acc_mode; 2784 int create_error = 0; 2785 struct dentry *const DENTRY_NOT_SET = (void *) -1UL; 2786 bool excl; 2787 2788 BUG_ON(dentry->d_inode); 2789 2790 /* Don't create child dentry for a dead directory. */ 2791 if (unlikely(IS_DEADDIR(dir))) { 2792 error = -ENOENT; 2793 goto out; 2794 } 2795 2796 mode = op->mode; 2797 if ((open_flag & O_CREAT) && !IS_POSIXACL(dir)) 2798 mode &= ~current_umask(); 2799 2800 excl = (open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT); 2801 if (excl) 2802 open_flag &= ~O_TRUNC; 2803 2804 /* 2805 * Checking write permission is tricky, bacuse we don't know if we are 2806 * going to actually need it: O_CREAT opens should work as long as the 2807 * file exists. But checking existence breaks atomicity. The trick is 2808 * to check access and if not granted clear O_CREAT from the flags. 2809 * 2810 * Another problem is returing the "right" error value (e.g. for an 2811 * O_EXCL open we want to return EEXIST not EROFS). 2812 */ 2813 if (((open_flag & (O_CREAT | O_TRUNC)) || 2814 (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) { 2815 if (!(open_flag & O_CREAT)) { 2816 /* 2817 * No O_CREATE -> atomicity not a requirement -> fall 2818 * back to lookup + open 2819 */ 2820 goto no_open; 2821 } else if (open_flag & (O_EXCL | O_TRUNC)) { 2822 /* Fall back and fail with the right error */ 2823 create_error = -EROFS; 2824 goto no_open; 2825 } else { 2826 /* No side effects, safe to clear O_CREAT */ 2827 create_error = -EROFS; 2828 open_flag &= ~O_CREAT; 2829 } 2830 } 2831 2832 if (open_flag & O_CREAT) { 2833 error = may_o_create(&nd->path, dentry, mode); 2834 if (error) { 2835 create_error = error; 2836 if (open_flag & O_EXCL) 2837 goto no_open; 2838 open_flag &= ~O_CREAT; 2839 } 2840 } 2841 2842 if (nd->flags & LOOKUP_DIRECTORY) 2843 open_flag |= O_DIRECTORY; 2844 2845 file->f_path.dentry = DENTRY_NOT_SET; 2846 file->f_path.mnt = nd->path.mnt; 2847 error = dir->i_op->atomic_open(dir, dentry, file, open_flag, mode, 2848 opened); 2849 if (error < 0) { 2850 if (create_error && error == -ENOENT) 2851 error = create_error; 2852 goto out; 2853 } 2854 2855 if (error) { /* returned 1, that is */ 2856 if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) { 2857 error = -EIO; 2858 goto out; 2859 } 2860 if (file->f_path.dentry) { 2861 dput(dentry); 2862 dentry = file->f_path.dentry; 2863 } 2864 if (*opened & FILE_CREATED) 2865 fsnotify_create(dir, dentry); 2866 if (!dentry->d_inode) { 2867 WARN_ON(*opened & FILE_CREATED); 2868 if (create_error) { 2869 error = create_error; 2870 goto out; 2871 } 2872 } else { 2873 if (excl && !(*opened & FILE_CREATED)) { 2874 error = -EEXIST; 2875 goto out; 2876 } 2877 } 2878 goto looked_up; 2879 } 2880 2881 /* 2882 * We didn't have the inode before the open, so check open permission 2883 * here. 2884 */ 2885 acc_mode = op->acc_mode; 2886 if (*opened & FILE_CREATED) { 2887 WARN_ON(!(open_flag & O_CREAT)); 2888 fsnotify_create(dir, dentry); 2889 acc_mode = MAY_OPEN; 2890 } 2891 error = may_open(&file->f_path, acc_mode, open_flag); 2892 if (error) 2893 fput(file); 2894 2895 out: 2896 dput(dentry); 2897 return error; 2898 2899 no_open: 2900 if (need_lookup) { 2901 dentry = lookup_real(dir, dentry, nd->flags); 2902 if (IS_ERR(dentry)) 2903 return PTR_ERR(dentry); 2904 2905 if (create_error) { 2906 int open_flag = op->open_flag; 2907 2908 error = create_error; 2909 if ((open_flag & O_EXCL)) { 2910 if (!dentry->d_inode) 2911 goto out; 2912 } else if (!dentry->d_inode) { 2913 goto out; 2914 } else if ((open_flag & O_TRUNC) && 2915 d_is_reg(dentry)) { 2916 goto out; 2917 } 2918 /* will fail later, go on to get the right error */ 2919 } 2920 } 2921 looked_up: 2922 path->dentry = dentry; 2923 path->mnt = nd->path.mnt; 2924 return 1; 2925 } 2926 2927 /* 2928 * Look up and maybe create and open the last component. 2929 * 2930 * Must be called with i_mutex held on parent. 2931 * 2932 * Returns 0 if the file was successfully atomically created (if necessary) and 2933 * opened. In this case the file will be returned attached to @file. 2934 * 2935 * Returns 1 if the file was not completely opened at this time, though lookups 2936 * and creations will have been performed and the dentry returned in @path will 2937 * be positive upon return if O_CREAT was specified. If O_CREAT wasn't 2938 * specified then a negative dentry may be returned. 2939 * 2940 * An error code is returned otherwise. 2941 * 2942 * FILE_CREATE will be set in @*opened if the dentry was created and will be 2943 * cleared otherwise prior to returning. 2944 */ 2945 static int lookup_open(struct nameidata *nd, struct path *path, 2946 struct file *file, 2947 const struct open_flags *op, 2948 bool got_write, int *opened) 2949 { 2950 struct dentry *dir = nd->path.dentry; 2951 struct inode *dir_inode = dir->d_inode; 2952 struct dentry *dentry; 2953 int error; 2954 bool need_lookup; 2955 2956 *opened &= ~FILE_CREATED; 2957 dentry = lookup_dcache(&nd->last, dir, nd->flags, &need_lookup); 2958 if (IS_ERR(dentry)) 2959 return PTR_ERR(dentry); 2960 2961 /* Cached positive dentry: will open in f_op->open */ 2962 if (!need_lookup && dentry->d_inode) 2963 goto out_no_open; 2964 2965 if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) { 2966 return atomic_open(nd, dentry, path, file, op, got_write, 2967 need_lookup, opened); 2968 } 2969 2970 if (need_lookup) { 2971 BUG_ON(dentry->d_inode); 2972 2973 dentry = lookup_real(dir_inode, dentry, nd->flags); 2974 if (IS_ERR(dentry)) 2975 return PTR_ERR(dentry); 2976 } 2977 2978 /* Negative dentry, just create the file */ 2979 if (!dentry->d_inode && (op->open_flag & O_CREAT)) { 2980 umode_t mode = op->mode; 2981 if (!IS_POSIXACL(dir->d_inode)) 2982 mode &= ~current_umask(); 2983 /* 2984 * This write is needed to ensure that a 2985 * rw->ro transition does not occur between 2986 * the time when the file is created and when 2987 * a permanent write count is taken through 2988 * the 'struct file' in finish_open(). 2989 */ 2990 if (!got_write) { 2991 error = -EROFS; 2992 goto out_dput; 2993 } 2994 *opened |= FILE_CREATED; 2995 error = security_path_mknod(&nd->path, dentry, mode, 0); 2996 if (error) 2997 goto out_dput; 2998 error = vfs_create(dir->d_inode, dentry, mode, 2999 nd->flags & LOOKUP_EXCL); 3000 if (error) 3001 goto out_dput; 3002 } 3003 out_no_open: 3004 path->dentry = dentry; 3005 path->mnt = nd->path.mnt; 3006 return 1; 3007 3008 out_dput: 3009 dput(dentry); 3010 return error; 3011 } 3012 3013 /* 3014 * Handle the last step of open() 3015 */ 3016 static int do_last(struct nameidata *nd, 3017 struct file *file, const struct open_flags *op, 3018 int *opened) 3019 { 3020 struct dentry *dir = nd->path.dentry; 3021 int open_flag = op->open_flag; 3022 bool will_truncate = (open_flag & O_TRUNC) != 0; 3023 bool got_write = false; 3024 int acc_mode = op->acc_mode; 3025 unsigned seq; 3026 struct inode *inode; 3027 struct path save_parent = { .dentry = NULL, .mnt = NULL }; 3028 struct path path; 3029 bool retried = false; 3030 int error; 3031 3032 nd->flags &= ~LOOKUP_PARENT; 3033 nd->flags |= op->intent; 3034 3035 if (nd->last_type != LAST_NORM) { 3036 error = handle_dots(nd, nd->last_type); 3037 if (unlikely(error)) 3038 return error; 3039 goto finish_open; 3040 } 3041 3042 if (!(open_flag & O_CREAT)) { 3043 if (nd->last.name[nd->last.len]) 3044 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 3045 /* we _can_ be in RCU mode here */ 3046 error = lookup_fast(nd, &path, &inode, &seq); 3047 if (likely(!error)) 3048 goto finish_lookup; 3049 3050 if (error < 0) 3051 return error; 3052 3053 BUG_ON(nd->inode != dir->d_inode); 3054 } else { 3055 /* create side of things */ 3056 /* 3057 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED 3058 * has been cleared when we got to the last component we are 3059 * about to look up 3060 */ 3061 error = complete_walk(nd); 3062 if (error) 3063 return error; 3064 3065 audit_inode(nd->name, dir, LOOKUP_PARENT); 3066 /* trailing slashes? */ 3067 if (unlikely(nd->last.name[nd->last.len])) 3068 return -EISDIR; 3069 } 3070 3071 retry_lookup: 3072 if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) { 3073 error = mnt_want_write(nd->path.mnt); 3074 if (!error) 3075 got_write = true; 3076 /* 3077 * do _not_ fail yet - we might not need that or fail with 3078 * a different error; let lookup_open() decide; we'll be 3079 * dropping this one anyway. 3080 */ 3081 } 3082 mutex_lock(&dir->d_inode->i_mutex); 3083 error = lookup_open(nd, &path, file, op, got_write, opened); 3084 mutex_unlock(&dir->d_inode->i_mutex); 3085 3086 if (error <= 0) { 3087 if (error) 3088 goto out; 3089 3090 if ((*opened & FILE_CREATED) || 3091 !S_ISREG(file_inode(file)->i_mode)) 3092 will_truncate = false; 3093 3094 audit_inode(nd->name, file->f_path.dentry, 0); 3095 goto opened; 3096 } 3097 3098 if (*opened & FILE_CREATED) { 3099 /* Don't check for write permission, don't truncate */ 3100 open_flag &= ~O_TRUNC; 3101 will_truncate = false; 3102 acc_mode = MAY_OPEN; 3103 path_to_nameidata(&path, nd); 3104 goto finish_open_created; 3105 } 3106 3107 /* 3108 * create/update audit record if it already exists. 3109 */ 3110 if (d_is_positive(path.dentry)) 3111 audit_inode(nd->name, path.dentry, 0); 3112 3113 /* 3114 * If atomic_open() acquired write access it is dropped now due to 3115 * possible mount and symlink following (this might be optimized away if 3116 * necessary...) 3117 */ 3118 if (got_write) { 3119 mnt_drop_write(nd->path.mnt); 3120 got_write = false; 3121 } 3122 3123 if (unlikely((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))) { 3124 path_to_nameidata(&path, nd); 3125 return -EEXIST; 3126 } 3127 3128 error = follow_managed(&path, nd); 3129 if (unlikely(error < 0)) 3130 return error; 3131 3132 BUG_ON(nd->flags & LOOKUP_RCU); 3133 inode = d_backing_inode(path.dentry); 3134 seq = 0; /* out of RCU mode, so the value doesn't matter */ 3135 if (unlikely(d_is_negative(path.dentry))) { 3136 path_to_nameidata(&path, nd); 3137 return -ENOENT; 3138 } 3139 finish_lookup: 3140 if (nd->depth) 3141 put_link(nd); 3142 error = should_follow_link(nd, &path, nd->flags & LOOKUP_FOLLOW, 3143 inode, seq); 3144 if (unlikely(error)) 3145 return error; 3146 3147 if (unlikely(d_is_symlink(path.dentry)) && !(open_flag & O_PATH)) { 3148 path_to_nameidata(&path, nd); 3149 return -ELOOP; 3150 } 3151 3152 if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path.mnt) { 3153 path_to_nameidata(&path, nd); 3154 } else { 3155 save_parent.dentry = nd->path.dentry; 3156 save_parent.mnt = mntget(path.mnt); 3157 nd->path.dentry = path.dentry; 3158 3159 } 3160 nd->inode = inode; 3161 nd->seq = seq; 3162 /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */ 3163 finish_open: 3164 error = complete_walk(nd); 3165 if (error) { 3166 path_put(&save_parent); 3167 return error; 3168 } 3169 audit_inode(nd->name, nd->path.dentry, 0); 3170 error = -EISDIR; 3171 if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) 3172 goto out; 3173 error = -ENOTDIR; 3174 if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry)) 3175 goto out; 3176 if (!d_is_reg(nd->path.dentry)) 3177 will_truncate = false; 3178 3179 if (will_truncate) { 3180 error = mnt_want_write(nd->path.mnt); 3181 if (error) 3182 goto out; 3183 got_write = true; 3184 } 3185 finish_open_created: 3186 error = may_open(&nd->path, acc_mode, open_flag); 3187 if (error) 3188 goto out; 3189 3190 BUG_ON(*opened & FILE_OPENED); /* once it's opened, it's opened */ 3191 error = vfs_open(&nd->path, file, current_cred()); 3192 if (!error) { 3193 *opened |= FILE_OPENED; 3194 } else { 3195 if (error == -EOPENSTALE) 3196 goto stale_open; 3197 goto out; 3198 } 3199 opened: 3200 error = open_check_o_direct(file); 3201 if (error) 3202 goto exit_fput; 3203 error = ima_file_check(file, op->acc_mode, *opened); 3204 if (error) 3205 goto exit_fput; 3206 3207 if (will_truncate) { 3208 error = handle_truncate(file); 3209 if (error) 3210 goto exit_fput; 3211 } 3212 out: 3213 if (got_write) 3214 mnt_drop_write(nd->path.mnt); 3215 path_put(&save_parent); 3216 return error; 3217 3218 exit_fput: 3219 fput(file); 3220 goto out; 3221 3222 stale_open: 3223 /* If no saved parent or already retried then can't retry */ 3224 if (!save_parent.dentry || retried) 3225 goto out; 3226 3227 BUG_ON(save_parent.dentry != dir); 3228 path_put(&nd->path); 3229 nd->path = save_parent; 3230 nd->inode = dir->d_inode; 3231 save_parent.mnt = NULL; 3232 save_parent.dentry = NULL; 3233 if (got_write) { 3234 mnt_drop_write(nd->path.mnt); 3235 got_write = false; 3236 } 3237 retried = true; 3238 goto retry_lookup; 3239 } 3240 3241 static int do_tmpfile(struct nameidata *nd, unsigned flags, 3242 const struct open_flags *op, 3243 struct file *file, int *opened) 3244 { 3245 static const struct qstr name = QSTR_INIT("/", 1); 3246 struct dentry *child; 3247 struct inode *dir; 3248 struct path path; 3249 int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path); 3250 if (unlikely(error)) 3251 return error; 3252 error = mnt_want_write(path.mnt); 3253 if (unlikely(error)) 3254 goto out; 3255 dir = path.dentry->d_inode; 3256 /* we want directory to be writable */ 3257 error = inode_permission(dir, MAY_WRITE | MAY_EXEC); 3258 if (error) 3259 goto out2; 3260 if (!dir->i_op->tmpfile) { 3261 error = -EOPNOTSUPP; 3262 goto out2; 3263 } 3264 child = d_alloc(path.dentry, &name); 3265 if (unlikely(!child)) { 3266 error = -ENOMEM; 3267 goto out2; 3268 } 3269 dput(path.dentry); 3270 path.dentry = child; 3271 error = dir->i_op->tmpfile(dir, child, op->mode); 3272 if (error) 3273 goto out2; 3274 audit_inode(nd->name, child, 0); 3275 /* Don't check for other permissions, the inode was just created */ 3276 error = may_open(&path, MAY_OPEN, op->open_flag); 3277 if (error) 3278 goto out2; 3279 file->f_path.mnt = path.mnt; 3280 error = finish_open(file, child, NULL, opened); 3281 if (error) 3282 goto out2; 3283 error = open_check_o_direct(file); 3284 if (error) { 3285 fput(file); 3286 } else if (!(op->open_flag & O_EXCL)) { 3287 struct inode *inode = file_inode(file); 3288 spin_lock(&inode->i_lock); 3289 inode->i_state |= I_LINKABLE; 3290 spin_unlock(&inode->i_lock); 3291 } 3292 out2: 3293 mnt_drop_write(path.mnt); 3294 out: 3295 path_put(&path); 3296 return error; 3297 } 3298 3299 static struct file *path_openat(struct nameidata *nd, 3300 const struct open_flags *op, unsigned flags) 3301 { 3302 const char *s; 3303 struct file *file; 3304 int opened = 0; 3305 int error; 3306 3307 file = get_empty_filp(); 3308 if (IS_ERR(file)) 3309 return file; 3310 3311 file->f_flags = op->open_flag; 3312 3313 if (unlikely(file->f_flags & __O_TMPFILE)) { 3314 error = do_tmpfile(nd, flags, op, file, &opened); 3315 goto out2; 3316 } 3317 3318 s = path_init(nd, flags); 3319 if (IS_ERR(s)) { 3320 put_filp(file); 3321 return ERR_CAST(s); 3322 } 3323 while (!(error = link_path_walk(s, nd)) && 3324 (error = do_last(nd, file, op, &opened)) > 0) { 3325 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL); 3326 s = trailing_symlink(nd); 3327 if (IS_ERR(s)) { 3328 error = PTR_ERR(s); 3329 break; 3330 } 3331 } 3332 terminate_walk(nd); 3333 out2: 3334 if (!(opened & FILE_OPENED)) { 3335 BUG_ON(!error); 3336 put_filp(file); 3337 } 3338 if (unlikely(error)) { 3339 if (error == -EOPENSTALE) { 3340 if (flags & LOOKUP_RCU) 3341 error = -ECHILD; 3342 else 3343 error = -ESTALE; 3344 } 3345 file = ERR_PTR(error); 3346 } 3347 return file; 3348 } 3349 3350 struct file *do_filp_open(int dfd, struct filename *pathname, 3351 const struct open_flags *op) 3352 { 3353 struct nameidata nd; 3354 int flags = op->lookup_flags; 3355 struct file *filp; 3356 3357 set_nameidata(&nd, dfd, pathname); 3358 filp = path_openat(&nd, op, flags | LOOKUP_RCU); 3359 if (unlikely(filp == ERR_PTR(-ECHILD))) 3360 filp = path_openat(&nd, op, flags); 3361 if (unlikely(filp == ERR_PTR(-ESTALE))) 3362 filp = path_openat(&nd, op, flags | LOOKUP_REVAL); 3363 restore_nameidata(); 3364 return filp; 3365 } 3366 3367 struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt, 3368 const char *name, const struct open_flags *op) 3369 { 3370 struct nameidata nd; 3371 struct file *file; 3372 struct filename *filename; 3373 int flags = op->lookup_flags | LOOKUP_ROOT; 3374 3375 nd.root.mnt = mnt; 3376 nd.root.dentry = dentry; 3377 3378 if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN) 3379 return ERR_PTR(-ELOOP); 3380 3381 filename = getname_kernel(name); 3382 if (IS_ERR(filename)) 3383 return ERR_CAST(filename); 3384 3385 set_nameidata(&nd, -1, filename); 3386 file = path_openat(&nd, op, flags | LOOKUP_RCU); 3387 if (unlikely(file == ERR_PTR(-ECHILD))) 3388 file = path_openat(&nd, op, flags); 3389 if (unlikely(file == ERR_PTR(-ESTALE))) 3390 file = path_openat(&nd, op, flags | LOOKUP_REVAL); 3391 restore_nameidata(); 3392 putname(filename); 3393 return file; 3394 } 3395 3396 static struct dentry *filename_create(int dfd, struct filename *name, 3397 struct path *path, unsigned int lookup_flags) 3398 { 3399 struct dentry *dentry = ERR_PTR(-EEXIST); 3400 struct qstr last; 3401 int type; 3402 int err2; 3403 int error; 3404 bool is_dir = (lookup_flags & LOOKUP_DIRECTORY); 3405 3406 /* 3407 * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any 3408 * other flags passed in are ignored! 3409 */ 3410 lookup_flags &= LOOKUP_REVAL; 3411 3412 name = filename_parentat(dfd, name, lookup_flags, path, &last, &type); 3413 if (IS_ERR(name)) 3414 return ERR_CAST(name); 3415 3416 /* 3417 * Yucky last component or no last component at all? 3418 * (foo/., foo/.., /////) 3419 */ 3420 if (unlikely(type != LAST_NORM)) 3421 goto out; 3422 3423 /* don't fail immediately if it's r/o, at least try to report other errors */ 3424 err2 = mnt_want_write(path->mnt); 3425 /* 3426 * Do the final lookup. 3427 */ 3428 lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL; 3429 mutex_lock_nested(&path->dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3430 dentry = __lookup_hash(&last, path->dentry, lookup_flags); 3431 if (IS_ERR(dentry)) 3432 goto unlock; 3433 3434 error = -EEXIST; 3435 if (d_is_positive(dentry)) 3436 goto fail; 3437 3438 /* 3439 * Special case - lookup gave negative, but... we had foo/bar/ 3440 * From the vfs_mknod() POV we just have a negative dentry - 3441 * all is fine. Let's be bastards - you had / on the end, you've 3442 * been asking for (non-existent) directory. -ENOENT for you. 3443 */ 3444 if (unlikely(!is_dir && last.name[last.len])) { 3445 error = -ENOENT; 3446 goto fail; 3447 } 3448 if (unlikely(err2)) { 3449 error = err2; 3450 goto fail; 3451 } 3452 putname(name); 3453 return dentry; 3454 fail: 3455 dput(dentry); 3456 dentry = ERR_PTR(error); 3457 unlock: 3458 mutex_unlock(&path->dentry->d_inode->i_mutex); 3459 if (!err2) 3460 mnt_drop_write(path->mnt); 3461 out: 3462 path_put(path); 3463 putname(name); 3464 return dentry; 3465 } 3466 3467 struct dentry *kern_path_create(int dfd, const char *pathname, 3468 struct path *path, unsigned int lookup_flags) 3469 { 3470 return filename_create(dfd, getname_kernel(pathname), 3471 path, lookup_flags); 3472 } 3473 EXPORT_SYMBOL(kern_path_create); 3474 3475 void done_path_create(struct path *path, struct dentry *dentry) 3476 { 3477 dput(dentry); 3478 mutex_unlock(&path->dentry->d_inode->i_mutex); 3479 mnt_drop_write(path->mnt); 3480 path_put(path); 3481 } 3482 EXPORT_SYMBOL(done_path_create); 3483 3484 inline struct dentry *user_path_create(int dfd, const char __user *pathname, 3485 struct path *path, unsigned int lookup_flags) 3486 { 3487 return filename_create(dfd, getname(pathname), path, lookup_flags); 3488 } 3489 EXPORT_SYMBOL(user_path_create); 3490 3491 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) 3492 { 3493 int error = may_create(dir, dentry); 3494 3495 if (error) 3496 return error; 3497 3498 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD)) 3499 return -EPERM; 3500 3501 if (!dir->i_op->mknod) 3502 return -EPERM; 3503 3504 error = devcgroup_inode_mknod(mode, dev); 3505 if (error) 3506 return error; 3507 3508 error = security_inode_mknod(dir, dentry, mode, dev); 3509 if (error) 3510 return error; 3511 3512 error = dir->i_op->mknod(dir, dentry, mode, dev); 3513 if (!error) 3514 fsnotify_create(dir, dentry); 3515 return error; 3516 } 3517 EXPORT_SYMBOL(vfs_mknod); 3518 3519 static int may_mknod(umode_t mode) 3520 { 3521 switch (mode & S_IFMT) { 3522 case S_IFREG: 3523 case S_IFCHR: 3524 case S_IFBLK: 3525 case S_IFIFO: 3526 case S_IFSOCK: 3527 case 0: /* zero mode translates to S_IFREG */ 3528 return 0; 3529 case S_IFDIR: 3530 return -EPERM; 3531 default: 3532 return -EINVAL; 3533 } 3534 } 3535 3536 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, 3537 unsigned, dev) 3538 { 3539 struct dentry *dentry; 3540 struct path path; 3541 int error; 3542 unsigned int lookup_flags = 0; 3543 3544 error = may_mknod(mode); 3545 if (error) 3546 return error; 3547 retry: 3548 dentry = user_path_create(dfd, filename, &path, lookup_flags); 3549 if (IS_ERR(dentry)) 3550 return PTR_ERR(dentry); 3551 3552 if (!IS_POSIXACL(path.dentry->d_inode)) 3553 mode &= ~current_umask(); 3554 error = security_path_mknod(&path, dentry, mode, dev); 3555 if (error) 3556 goto out; 3557 switch (mode & S_IFMT) { 3558 case 0: case S_IFREG: 3559 error = vfs_create(path.dentry->d_inode,dentry,mode,true); 3560 break; 3561 case S_IFCHR: case S_IFBLK: 3562 error = vfs_mknod(path.dentry->d_inode,dentry,mode, 3563 new_decode_dev(dev)); 3564 break; 3565 case S_IFIFO: case S_IFSOCK: 3566 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0); 3567 break; 3568 } 3569 out: 3570 done_path_create(&path, dentry); 3571 if (retry_estale(error, lookup_flags)) { 3572 lookup_flags |= LOOKUP_REVAL; 3573 goto retry; 3574 } 3575 return error; 3576 } 3577 3578 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev) 3579 { 3580 return sys_mknodat(AT_FDCWD, filename, mode, dev); 3581 } 3582 3583 int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 3584 { 3585 int error = may_create(dir, dentry); 3586 unsigned max_links = dir->i_sb->s_max_links; 3587 3588 if (error) 3589 return error; 3590 3591 if (!dir->i_op->mkdir) 3592 return -EPERM; 3593 3594 mode &= (S_IRWXUGO|S_ISVTX); 3595 error = security_inode_mkdir(dir, dentry, mode); 3596 if (error) 3597 return error; 3598 3599 if (max_links && dir->i_nlink >= max_links) 3600 return -EMLINK; 3601 3602 error = dir->i_op->mkdir(dir, dentry, mode); 3603 if (!error) 3604 fsnotify_mkdir(dir, dentry); 3605 return error; 3606 } 3607 EXPORT_SYMBOL(vfs_mkdir); 3608 3609 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) 3610 { 3611 struct dentry *dentry; 3612 struct path path; 3613 int error; 3614 unsigned int lookup_flags = LOOKUP_DIRECTORY; 3615 3616 retry: 3617 dentry = user_path_create(dfd, pathname, &path, lookup_flags); 3618 if (IS_ERR(dentry)) 3619 return PTR_ERR(dentry); 3620 3621 if (!IS_POSIXACL(path.dentry->d_inode)) 3622 mode &= ~current_umask(); 3623 error = security_path_mkdir(&path, dentry, mode); 3624 if (!error) 3625 error = vfs_mkdir(path.dentry->d_inode, dentry, mode); 3626 done_path_create(&path, dentry); 3627 if (retry_estale(error, lookup_flags)) { 3628 lookup_flags |= LOOKUP_REVAL; 3629 goto retry; 3630 } 3631 return error; 3632 } 3633 3634 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode) 3635 { 3636 return sys_mkdirat(AT_FDCWD, pathname, mode); 3637 } 3638 3639 /* 3640 * The dentry_unhash() helper will try to drop the dentry early: we 3641 * should have a usage count of 1 if we're the only user of this 3642 * dentry, and if that is true (possibly after pruning the dcache), 3643 * then we drop the dentry now. 3644 * 3645 * A low-level filesystem can, if it choses, legally 3646 * do a 3647 * 3648 * if (!d_unhashed(dentry)) 3649 * return -EBUSY; 3650 * 3651 * if it cannot handle the case of removing a directory 3652 * that is still in use by something else.. 3653 */ 3654 void dentry_unhash(struct dentry *dentry) 3655 { 3656 shrink_dcache_parent(dentry); 3657 spin_lock(&dentry->d_lock); 3658 if (dentry->d_lockref.count == 1) 3659 __d_drop(dentry); 3660 spin_unlock(&dentry->d_lock); 3661 } 3662 EXPORT_SYMBOL(dentry_unhash); 3663 3664 int vfs_rmdir(struct inode *dir, struct dentry *dentry) 3665 { 3666 int error = may_delete(dir, dentry, 1); 3667 3668 if (error) 3669 return error; 3670 3671 if (!dir->i_op->rmdir) 3672 return -EPERM; 3673 3674 dget(dentry); 3675 mutex_lock(&dentry->d_inode->i_mutex); 3676 3677 error = -EBUSY; 3678 if (is_local_mountpoint(dentry)) 3679 goto out; 3680 3681 error = security_inode_rmdir(dir, dentry); 3682 if (error) 3683 goto out; 3684 3685 shrink_dcache_parent(dentry); 3686 error = dir->i_op->rmdir(dir, dentry); 3687 if (error) 3688 goto out; 3689 3690 dentry->d_inode->i_flags |= S_DEAD; 3691 dont_mount(dentry); 3692 detach_mounts(dentry); 3693 3694 out: 3695 mutex_unlock(&dentry->d_inode->i_mutex); 3696 dput(dentry); 3697 if (!error) 3698 d_delete(dentry); 3699 return error; 3700 } 3701 EXPORT_SYMBOL(vfs_rmdir); 3702 3703 static long do_rmdir(int dfd, const char __user *pathname) 3704 { 3705 int error = 0; 3706 struct filename *name; 3707 struct dentry *dentry; 3708 struct path path; 3709 struct qstr last; 3710 int type; 3711 unsigned int lookup_flags = 0; 3712 retry: 3713 name = user_path_parent(dfd, pathname, 3714 &path, &last, &type, lookup_flags); 3715 if (IS_ERR(name)) 3716 return PTR_ERR(name); 3717 3718 switch (type) { 3719 case LAST_DOTDOT: 3720 error = -ENOTEMPTY; 3721 goto exit1; 3722 case LAST_DOT: 3723 error = -EINVAL; 3724 goto exit1; 3725 case LAST_ROOT: 3726 error = -EBUSY; 3727 goto exit1; 3728 } 3729 3730 error = mnt_want_write(path.mnt); 3731 if (error) 3732 goto exit1; 3733 3734 mutex_lock_nested(&path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3735 dentry = __lookup_hash(&last, path.dentry, lookup_flags); 3736 error = PTR_ERR(dentry); 3737 if (IS_ERR(dentry)) 3738 goto exit2; 3739 if (!dentry->d_inode) { 3740 error = -ENOENT; 3741 goto exit3; 3742 } 3743 error = security_path_rmdir(&path, dentry); 3744 if (error) 3745 goto exit3; 3746 error = vfs_rmdir(path.dentry->d_inode, dentry); 3747 exit3: 3748 dput(dentry); 3749 exit2: 3750 mutex_unlock(&path.dentry->d_inode->i_mutex); 3751 mnt_drop_write(path.mnt); 3752 exit1: 3753 path_put(&path); 3754 putname(name); 3755 if (retry_estale(error, lookup_flags)) { 3756 lookup_flags |= LOOKUP_REVAL; 3757 goto retry; 3758 } 3759 return error; 3760 } 3761 3762 SYSCALL_DEFINE1(rmdir, const char __user *, pathname) 3763 { 3764 return do_rmdir(AT_FDCWD, pathname); 3765 } 3766 3767 /** 3768 * vfs_unlink - unlink a filesystem object 3769 * @dir: parent directory 3770 * @dentry: victim 3771 * @delegated_inode: returns victim inode, if the inode is delegated. 3772 * 3773 * The caller must hold dir->i_mutex. 3774 * 3775 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and 3776 * return a reference to the inode in delegated_inode. The caller 3777 * should then break the delegation on that inode and retry. Because 3778 * breaking a delegation may take a long time, the caller should drop 3779 * dir->i_mutex before doing so. 3780 * 3781 * Alternatively, a caller may pass NULL for delegated_inode. This may 3782 * be appropriate for callers that expect the underlying filesystem not 3783 * to be NFS exported. 3784 */ 3785 int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode) 3786 { 3787 struct inode *target = dentry->d_inode; 3788 int error = may_delete(dir, dentry, 0); 3789 3790 if (error) 3791 return error; 3792 3793 if (!dir->i_op->unlink) 3794 return -EPERM; 3795 3796 mutex_lock(&target->i_mutex); 3797 if (is_local_mountpoint(dentry)) 3798 error = -EBUSY; 3799 else { 3800 error = security_inode_unlink(dir, dentry); 3801 if (!error) { 3802 error = try_break_deleg(target, delegated_inode); 3803 if (error) 3804 goto out; 3805 error = dir->i_op->unlink(dir, dentry); 3806 if (!error) { 3807 dont_mount(dentry); 3808 detach_mounts(dentry); 3809 } 3810 } 3811 } 3812 out: 3813 mutex_unlock(&target->i_mutex); 3814 3815 /* We don't d_delete() NFS sillyrenamed files--they still exist. */ 3816 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) { 3817 fsnotify_link_count(target); 3818 d_delete(dentry); 3819 } 3820 3821 return error; 3822 } 3823 EXPORT_SYMBOL(vfs_unlink); 3824 3825 /* 3826 * Make sure that the actual truncation of the file will occur outside its 3827 * directory's i_mutex. Truncate can take a long time if there is a lot of 3828 * writeout happening, and we don't want to prevent access to the directory 3829 * while waiting on the I/O. 3830 */ 3831 static long do_unlinkat(int dfd, const char __user *pathname) 3832 { 3833 int error; 3834 struct filename *name; 3835 struct dentry *dentry; 3836 struct path path; 3837 struct qstr last; 3838 int type; 3839 struct inode *inode = NULL; 3840 struct inode *delegated_inode = NULL; 3841 unsigned int lookup_flags = 0; 3842 retry: 3843 name = user_path_parent(dfd, pathname, 3844 &path, &last, &type, lookup_flags); 3845 if (IS_ERR(name)) 3846 return PTR_ERR(name); 3847 3848 error = -EISDIR; 3849 if (type != LAST_NORM) 3850 goto exit1; 3851 3852 error = mnt_want_write(path.mnt); 3853 if (error) 3854 goto exit1; 3855 retry_deleg: 3856 mutex_lock_nested(&path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3857 dentry = __lookup_hash(&last, path.dentry, lookup_flags); 3858 error = PTR_ERR(dentry); 3859 if (!IS_ERR(dentry)) { 3860 /* Why not before? Because we want correct error value */ 3861 if (last.name[last.len]) 3862 goto slashes; 3863 inode = dentry->d_inode; 3864 if (d_is_negative(dentry)) 3865 goto slashes; 3866 ihold(inode); 3867 error = security_path_unlink(&path, dentry); 3868 if (error) 3869 goto exit2; 3870 error = vfs_unlink(path.dentry->d_inode, dentry, &delegated_inode); 3871 exit2: 3872 dput(dentry); 3873 } 3874 mutex_unlock(&path.dentry->d_inode->i_mutex); 3875 if (inode) 3876 iput(inode); /* truncate the inode here */ 3877 inode = NULL; 3878 if (delegated_inode) { 3879 error = break_deleg_wait(&delegated_inode); 3880 if (!error) 3881 goto retry_deleg; 3882 } 3883 mnt_drop_write(path.mnt); 3884 exit1: 3885 path_put(&path); 3886 putname(name); 3887 if (retry_estale(error, lookup_flags)) { 3888 lookup_flags |= LOOKUP_REVAL; 3889 inode = NULL; 3890 goto retry; 3891 } 3892 return error; 3893 3894 slashes: 3895 if (d_is_negative(dentry)) 3896 error = -ENOENT; 3897 else if (d_is_dir(dentry)) 3898 error = -EISDIR; 3899 else 3900 error = -ENOTDIR; 3901 goto exit2; 3902 } 3903 3904 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) 3905 { 3906 if ((flag & ~AT_REMOVEDIR) != 0) 3907 return -EINVAL; 3908 3909 if (flag & AT_REMOVEDIR) 3910 return do_rmdir(dfd, pathname); 3911 3912 return do_unlinkat(dfd, pathname); 3913 } 3914 3915 SYSCALL_DEFINE1(unlink, const char __user *, pathname) 3916 { 3917 return do_unlinkat(AT_FDCWD, pathname); 3918 } 3919 3920 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname) 3921 { 3922 int error = may_create(dir, dentry); 3923 3924 if (error) 3925 return error; 3926 3927 if (!dir->i_op->symlink) 3928 return -EPERM; 3929 3930 error = security_inode_symlink(dir, dentry, oldname); 3931 if (error) 3932 return error; 3933 3934 error = dir->i_op->symlink(dir, dentry, oldname); 3935 if (!error) 3936 fsnotify_create(dir, dentry); 3937 return error; 3938 } 3939 EXPORT_SYMBOL(vfs_symlink); 3940 3941 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, 3942 int, newdfd, const char __user *, newname) 3943 { 3944 int error; 3945 struct filename *from; 3946 struct dentry *dentry; 3947 struct path path; 3948 unsigned int lookup_flags = 0; 3949 3950 from = getname(oldname); 3951 if (IS_ERR(from)) 3952 return PTR_ERR(from); 3953 retry: 3954 dentry = user_path_create(newdfd, newname, &path, lookup_flags); 3955 error = PTR_ERR(dentry); 3956 if (IS_ERR(dentry)) 3957 goto out_putname; 3958 3959 error = security_path_symlink(&path, dentry, from->name); 3960 if (!error) 3961 error = vfs_symlink(path.dentry->d_inode, dentry, from->name); 3962 done_path_create(&path, dentry); 3963 if (retry_estale(error, lookup_flags)) { 3964 lookup_flags |= LOOKUP_REVAL; 3965 goto retry; 3966 } 3967 out_putname: 3968 putname(from); 3969 return error; 3970 } 3971 3972 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) 3973 { 3974 return sys_symlinkat(oldname, AT_FDCWD, newname); 3975 } 3976 3977 /** 3978 * vfs_link - create a new link 3979 * @old_dentry: object to be linked 3980 * @dir: new parent 3981 * @new_dentry: where to create the new link 3982 * @delegated_inode: returns inode needing a delegation break 3983 * 3984 * The caller must hold dir->i_mutex 3985 * 3986 * If vfs_link discovers a delegation on the to-be-linked file in need 3987 * of breaking, it will return -EWOULDBLOCK and return a reference to the 3988 * inode in delegated_inode. The caller should then break the delegation 3989 * and retry. Because breaking a delegation may take a long time, the 3990 * caller should drop the i_mutex before doing so. 3991 * 3992 * Alternatively, a caller may pass NULL for delegated_inode. This may 3993 * be appropriate for callers that expect the underlying filesystem not 3994 * to be NFS exported. 3995 */ 3996 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode) 3997 { 3998 struct inode *inode = old_dentry->d_inode; 3999 unsigned max_links = dir->i_sb->s_max_links; 4000 int error; 4001 4002 if (!inode) 4003 return -ENOENT; 4004 4005 error = may_create(dir, new_dentry); 4006 if (error) 4007 return error; 4008 4009 if (dir->i_sb != inode->i_sb) 4010 return -EXDEV; 4011 4012 /* 4013 * A link to an append-only or immutable file cannot be created. 4014 */ 4015 if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) 4016 return -EPERM; 4017 if (!dir->i_op->link) 4018 return -EPERM; 4019 if (S_ISDIR(inode->i_mode)) 4020 return -EPERM; 4021 4022 error = security_inode_link(old_dentry, dir, new_dentry); 4023 if (error) 4024 return error; 4025 4026 mutex_lock(&inode->i_mutex); 4027 /* Make sure we don't allow creating hardlink to an unlinked file */ 4028 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE)) 4029 error = -ENOENT; 4030 else if (max_links && inode->i_nlink >= max_links) 4031 error = -EMLINK; 4032 else { 4033 error = try_break_deleg(inode, delegated_inode); 4034 if (!error) 4035 error = dir->i_op->link(old_dentry, dir, new_dentry); 4036 } 4037 4038 if (!error && (inode->i_state & I_LINKABLE)) { 4039 spin_lock(&inode->i_lock); 4040 inode->i_state &= ~I_LINKABLE; 4041 spin_unlock(&inode->i_lock); 4042 } 4043 mutex_unlock(&inode->i_mutex); 4044 if (!error) 4045 fsnotify_link(dir, inode, new_dentry); 4046 return error; 4047 } 4048 EXPORT_SYMBOL(vfs_link); 4049 4050 /* 4051 * Hardlinks are often used in delicate situations. We avoid 4052 * security-related surprises by not following symlinks on the 4053 * newname. --KAB 4054 * 4055 * We don't follow them on the oldname either to be compatible 4056 * with linux 2.0, and to avoid hard-linking to directories 4057 * and other special files. --ADM 4058 */ 4059 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, 4060 int, newdfd, const char __user *, newname, int, flags) 4061 { 4062 struct dentry *new_dentry; 4063 struct path old_path, new_path; 4064 struct inode *delegated_inode = NULL; 4065 int how = 0; 4066 int error; 4067 4068 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) 4069 return -EINVAL; 4070 /* 4071 * To use null names we require CAP_DAC_READ_SEARCH 4072 * This ensures that not everyone will be able to create 4073 * handlink using the passed filedescriptor. 4074 */ 4075 if (flags & AT_EMPTY_PATH) { 4076 if (!capable(CAP_DAC_READ_SEARCH)) 4077 return -ENOENT; 4078 how = LOOKUP_EMPTY; 4079 } 4080 4081 if (flags & AT_SYMLINK_FOLLOW) 4082 how |= LOOKUP_FOLLOW; 4083 retry: 4084 error = user_path_at(olddfd, oldname, how, &old_path); 4085 if (error) 4086 return error; 4087 4088 new_dentry = user_path_create(newdfd, newname, &new_path, 4089 (how & LOOKUP_REVAL)); 4090 error = PTR_ERR(new_dentry); 4091 if (IS_ERR(new_dentry)) 4092 goto out; 4093 4094 error = -EXDEV; 4095 if (old_path.mnt != new_path.mnt) 4096 goto out_dput; 4097 error = may_linkat(&old_path); 4098 if (unlikely(error)) 4099 goto out_dput; 4100 error = security_path_link(old_path.dentry, &new_path, new_dentry); 4101 if (error) 4102 goto out_dput; 4103 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode); 4104 out_dput: 4105 done_path_create(&new_path, new_dentry); 4106 if (delegated_inode) { 4107 error = break_deleg_wait(&delegated_inode); 4108 if (!error) { 4109 path_put(&old_path); 4110 goto retry; 4111 } 4112 } 4113 if (retry_estale(error, how)) { 4114 path_put(&old_path); 4115 how |= LOOKUP_REVAL; 4116 goto retry; 4117 } 4118 out: 4119 path_put(&old_path); 4120 4121 return error; 4122 } 4123 4124 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) 4125 { 4126 return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 4127 } 4128 4129 /** 4130 * vfs_rename - rename a filesystem object 4131 * @old_dir: parent of source 4132 * @old_dentry: source 4133 * @new_dir: parent of destination 4134 * @new_dentry: destination 4135 * @delegated_inode: returns an inode needing a delegation break 4136 * @flags: rename flags 4137 * 4138 * The caller must hold multiple mutexes--see lock_rename()). 4139 * 4140 * If vfs_rename discovers a delegation in need of breaking at either 4141 * the source or destination, it will return -EWOULDBLOCK and return a 4142 * reference to the inode in delegated_inode. The caller should then 4143 * break the delegation and retry. Because breaking a delegation may 4144 * take a long time, the caller should drop all locks before doing 4145 * so. 4146 * 4147 * Alternatively, a caller may pass NULL for delegated_inode. This may 4148 * be appropriate for callers that expect the underlying filesystem not 4149 * to be NFS exported. 4150 * 4151 * The worst of all namespace operations - renaming directory. "Perverted" 4152 * doesn't even start to describe it. Somebody in UCB had a heck of a trip... 4153 * Problems: 4154 * a) we can get into loop creation. 4155 * b) race potential - two innocent renames can create a loop together. 4156 * That's where 4.4 screws up. Current fix: serialization on 4157 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another 4158 * story. 4159 * c) we have to lock _four_ objects - parents and victim (if it exists), 4160 * and source (if it is not a directory). 4161 * And that - after we got ->i_mutex on parents (until then we don't know 4162 * whether the target exists). Solution: try to be smart with locking 4163 * order for inodes. We rely on the fact that tree topology may change 4164 * only under ->s_vfs_rename_mutex _and_ that parent of the object we 4165 * move will be locked. Thus we can rank directories by the tree 4166 * (ancestors first) and rank all non-directories after them. 4167 * That works since everybody except rename does "lock parent, lookup, 4168 * lock child" and rename is under ->s_vfs_rename_mutex. 4169 * HOWEVER, it relies on the assumption that any object with ->lookup() 4170 * has no more than 1 dentry. If "hybrid" objects will ever appear, 4171 * we'd better make sure that there's no link(2) for them. 4172 * d) conversion from fhandle to dentry may come in the wrong moment - when 4173 * we are removing the target. Solution: we will have to grab ->i_mutex 4174 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on 4175 * ->i_mutex on parents, which works but leads to some truly excessive 4176 * locking]. 4177 */ 4178 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, 4179 struct inode *new_dir, struct dentry *new_dentry, 4180 struct inode **delegated_inode, unsigned int flags) 4181 { 4182 int error; 4183 bool is_dir = d_is_dir(old_dentry); 4184 const unsigned char *old_name; 4185 struct inode *source = old_dentry->d_inode; 4186 struct inode *target = new_dentry->d_inode; 4187 bool new_is_dir = false; 4188 unsigned max_links = new_dir->i_sb->s_max_links; 4189 4190 if (source == target) 4191 return 0; 4192 4193 error = may_delete(old_dir, old_dentry, is_dir); 4194 if (error) 4195 return error; 4196 4197 if (!target) { 4198 error = may_create(new_dir, new_dentry); 4199 } else { 4200 new_is_dir = d_is_dir(new_dentry); 4201 4202 if (!(flags & RENAME_EXCHANGE)) 4203 error = may_delete(new_dir, new_dentry, is_dir); 4204 else 4205 error = may_delete(new_dir, new_dentry, new_is_dir); 4206 } 4207 if (error) 4208 return error; 4209 4210 if (!old_dir->i_op->rename && !old_dir->i_op->rename2) 4211 return -EPERM; 4212 4213 if (flags && !old_dir->i_op->rename2) 4214 return -EINVAL; 4215 4216 /* 4217 * If we are going to change the parent - check write permissions, 4218 * we'll need to flip '..'. 4219 */ 4220 if (new_dir != old_dir) { 4221 if (is_dir) { 4222 error = inode_permission(source, MAY_WRITE); 4223 if (error) 4224 return error; 4225 } 4226 if ((flags & RENAME_EXCHANGE) && new_is_dir) { 4227 error = inode_permission(target, MAY_WRITE); 4228 if (error) 4229 return error; 4230 } 4231 } 4232 4233 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry, 4234 flags); 4235 if (error) 4236 return error; 4237 4238 old_name = fsnotify_oldname_init(old_dentry->d_name.name); 4239 dget(new_dentry); 4240 if (!is_dir || (flags & RENAME_EXCHANGE)) 4241 lock_two_nondirectories(source, target); 4242 else if (target) 4243 mutex_lock(&target->i_mutex); 4244 4245 error = -EBUSY; 4246 if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry)) 4247 goto out; 4248 4249 if (max_links && new_dir != old_dir) { 4250 error = -EMLINK; 4251 if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links) 4252 goto out; 4253 if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir && 4254 old_dir->i_nlink >= max_links) 4255 goto out; 4256 } 4257 if (is_dir && !(flags & RENAME_EXCHANGE) && target) 4258 shrink_dcache_parent(new_dentry); 4259 if (!is_dir) { 4260 error = try_break_deleg(source, delegated_inode); 4261 if (error) 4262 goto out; 4263 } 4264 if (target && !new_is_dir) { 4265 error = try_break_deleg(target, delegated_inode); 4266 if (error) 4267 goto out; 4268 } 4269 if (!old_dir->i_op->rename2) { 4270 error = old_dir->i_op->rename(old_dir, old_dentry, 4271 new_dir, new_dentry); 4272 } else { 4273 WARN_ON(old_dir->i_op->rename != NULL); 4274 error = old_dir->i_op->rename2(old_dir, old_dentry, 4275 new_dir, new_dentry, flags); 4276 } 4277 if (error) 4278 goto out; 4279 4280 if (!(flags & RENAME_EXCHANGE) && target) { 4281 if (is_dir) 4282 target->i_flags |= S_DEAD; 4283 dont_mount(new_dentry); 4284 detach_mounts(new_dentry); 4285 } 4286 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) { 4287 if (!(flags & RENAME_EXCHANGE)) 4288 d_move(old_dentry, new_dentry); 4289 else 4290 d_exchange(old_dentry, new_dentry); 4291 } 4292 out: 4293 if (!is_dir || (flags & RENAME_EXCHANGE)) 4294 unlock_two_nondirectories(source, target); 4295 else if (target) 4296 mutex_unlock(&target->i_mutex); 4297 dput(new_dentry); 4298 if (!error) { 4299 fsnotify_move(old_dir, new_dir, old_name, is_dir, 4300 !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry); 4301 if (flags & RENAME_EXCHANGE) { 4302 fsnotify_move(new_dir, old_dir, old_dentry->d_name.name, 4303 new_is_dir, NULL, new_dentry); 4304 } 4305 } 4306 fsnotify_oldname_free(old_name); 4307 4308 return error; 4309 } 4310 EXPORT_SYMBOL(vfs_rename); 4311 4312 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname, 4313 int, newdfd, const char __user *, newname, unsigned int, flags) 4314 { 4315 struct dentry *old_dentry, *new_dentry; 4316 struct dentry *trap; 4317 struct path old_path, new_path; 4318 struct qstr old_last, new_last; 4319 int old_type, new_type; 4320 struct inode *delegated_inode = NULL; 4321 struct filename *from; 4322 struct filename *to; 4323 unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET; 4324 bool should_retry = false; 4325 int error; 4326 4327 if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT)) 4328 return -EINVAL; 4329 4330 if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) && 4331 (flags & RENAME_EXCHANGE)) 4332 return -EINVAL; 4333 4334 if ((flags & RENAME_WHITEOUT) && !capable(CAP_MKNOD)) 4335 return -EPERM; 4336 4337 if (flags & RENAME_EXCHANGE) 4338 target_flags = 0; 4339 4340 retry: 4341 from = user_path_parent(olddfd, oldname, 4342 &old_path, &old_last, &old_type, lookup_flags); 4343 if (IS_ERR(from)) { 4344 error = PTR_ERR(from); 4345 goto exit; 4346 } 4347 4348 to = user_path_parent(newdfd, newname, 4349 &new_path, &new_last, &new_type, lookup_flags); 4350 if (IS_ERR(to)) { 4351 error = PTR_ERR(to); 4352 goto exit1; 4353 } 4354 4355 error = -EXDEV; 4356 if (old_path.mnt != new_path.mnt) 4357 goto exit2; 4358 4359 error = -EBUSY; 4360 if (old_type != LAST_NORM) 4361 goto exit2; 4362 4363 if (flags & RENAME_NOREPLACE) 4364 error = -EEXIST; 4365 if (new_type != LAST_NORM) 4366 goto exit2; 4367 4368 error = mnt_want_write(old_path.mnt); 4369 if (error) 4370 goto exit2; 4371 4372 retry_deleg: 4373 trap = lock_rename(new_path.dentry, old_path.dentry); 4374 4375 old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags); 4376 error = PTR_ERR(old_dentry); 4377 if (IS_ERR(old_dentry)) 4378 goto exit3; 4379 /* source must exist */ 4380 error = -ENOENT; 4381 if (d_is_negative(old_dentry)) 4382 goto exit4; 4383 new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags); 4384 error = PTR_ERR(new_dentry); 4385 if (IS_ERR(new_dentry)) 4386 goto exit4; 4387 error = -EEXIST; 4388 if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry)) 4389 goto exit5; 4390 if (flags & RENAME_EXCHANGE) { 4391 error = -ENOENT; 4392 if (d_is_negative(new_dentry)) 4393 goto exit5; 4394 4395 if (!d_is_dir(new_dentry)) { 4396 error = -ENOTDIR; 4397 if (new_last.name[new_last.len]) 4398 goto exit5; 4399 } 4400 } 4401 /* unless the source is a directory trailing slashes give -ENOTDIR */ 4402 if (!d_is_dir(old_dentry)) { 4403 error = -ENOTDIR; 4404 if (old_last.name[old_last.len]) 4405 goto exit5; 4406 if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len]) 4407 goto exit5; 4408 } 4409 /* source should not be ancestor of target */ 4410 error = -EINVAL; 4411 if (old_dentry == trap) 4412 goto exit5; 4413 /* target should not be an ancestor of source */ 4414 if (!(flags & RENAME_EXCHANGE)) 4415 error = -ENOTEMPTY; 4416 if (new_dentry == trap) 4417 goto exit5; 4418 4419 error = security_path_rename(&old_path, old_dentry, 4420 &new_path, new_dentry, flags); 4421 if (error) 4422 goto exit5; 4423 error = vfs_rename(old_path.dentry->d_inode, old_dentry, 4424 new_path.dentry->d_inode, new_dentry, 4425 &delegated_inode, flags); 4426 exit5: 4427 dput(new_dentry); 4428 exit4: 4429 dput(old_dentry); 4430 exit3: 4431 unlock_rename(new_path.dentry, old_path.dentry); 4432 if (delegated_inode) { 4433 error = break_deleg_wait(&delegated_inode); 4434 if (!error) 4435 goto retry_deleg; 4436 } 4437 mnt_drop_write(old_path.mnt); 4438 exit2: 4439 if (retry_estale(error, lookup_flags)) 4440 should_retry = true; 4441 path_put(&new_path); 4442 putname(to); 4443 exit1: 4444 path_put(&old_path); 4445 putname(from); 4446 if (should_retry) { 4447 should_retry = false; 4448 lookup_flags |= LOOKUP_REVAL; 4449 goto retry; 4450 } 4451 exit: 4452 return error; 4453 } 4454 4455 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, 4456 int, newdfd, const char __user *, newname) 4457 { 4458 return sys_renameat2(olddfd, oldname, newdfd, newname, 0); 4459 } 4460 4461 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) 4462 { 4463 return sys_renameat2(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 4464 } 4465 4466 int vfs_whiteout(struct inode *dir, struct dentry *dentry) 4467 { 4468 int error = may_create(dir, dentry); 4469 if (error) 4470 return error; 4471 4472 if (!dir->i_op->mknod) 4473 return -EPERM; 4474 4475 return dir->i_op->mknod(dir, dentry, 4476 S_IFCHR | WHITEOUT_MODE, WHITEOUT_DEV); 4477 } 4478 EXPORT_SYMBOL(vfs_whiteout); 4479 4480 int readlink_copy(char __user *buffer, int buflen, const char *link) 4481 { 4482 int len = PTR_ERR(link); 4483 if (IS_ERR(link)) 4484 goto out; 4485 4486 len = strlen(link); 4487 if (len > (unsigned) buflen) 4488 len = buflen; 4489 if (copy_to_user(buffer, link, len)) 4490 len = -EFAULT; 4491 out: 4492 return len; 4493 } 4494 EXPORT_SYMBOL(readlink_copy); 4495 4496 /* 4497 * A helper for ->readlink(). This should be used *ONLY* for symlinks that 4498 * have ->follow_link() touching nd only in nd_set_link(). Using (or not 4499 * using) it for any given inode is up to filesystem. 4500 */ 4501 int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4502 { 4503 void *cookie; 4504 struct inode *inode = d_inode(dentry); 4505 const char *link = inode->i_link; 4506 int res; 4507 4508 if (!link) { 4509 link = inode->i_op->follow_link(dentry, &cookie); 4510 if (IS_ERR(link)) 4511 return PTR_ERR(link); 4512 } 4513 res = readlink_copy(buffer, buflen, link); 4514 if (inode->i_op->put_link) 4515 inode->i_op->put_link(inode, cookie); 4516 return res; 4517 } 4518 EXPORT_SYMBOL(generic_readlink); 4519 4520 /* get the link contents into pagecache */ 4521 static char *page_getlink(struct dentry * dentry, struct page **ppage) 4522 { 4523 char *kaddr; 4524 struct page *page; 4525 struct address_space *mapping = dentry->d_inode->i_mapping; 4526 page = read_mapping_page(mapping, 0, NULL); 4527 if (IS_ERR(page)) 4528 return (char*)page; 4529 *ppage = page; 4530 kaddr = kmap(page); 4531 nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1); 4532 return kaddr; 4533 } 4534 4535 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4536 { 4537 struct page *page = NULL; 4538 int res = readlink_copy(buffer, buflen, page_getlink(dentry, &page)); 4539 if (page) { 4540 kunmap(page); 4541 page_cache_release(page); 4542 } 4543 return res; 4544 } 4545 EXPORT_SYMBOL(page_readlink); 4546 4547 const char *page_follow_link_light(struct dentry *dentry, void **cookie) 4548 { 4549 struct page *page = NULL; 4550 char *res = page_getlink(dentry, &page); 4551 if (!IS_ERR(res)) 4552 *cookie = page; 4553 return res; 4554 } 4555 EXPORT_SYMBOL(page_follow_link_light); 4556 4557 void page_put_link(struct inode *unused, void *cookie) 4558 { 4559 struct page *page = cookie; 4560 kunmap(page); 4561 page_cache_release(page); 4562 } 4563 EXPORT_SYMBOL(page_put_link); 4564 4565 /* 4566 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS 4567 */ 4568 int __page_symlink(struct inode *inode, const char *symname, int len, int nofs) 4569 { 4570 struct address_space *mapping = inode->i_mapping; 4571 struct page *page; 4572 void *fsdata; 4573 int err; 4574 char *kaddr; 4575 unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE; 4576 if (nofs) 4577 flags |= AOP_FLAG_NOFS; 4578 4579 retry: 4580 err = pagecache_write_begin(NULL, mapping, 0, len-1, 4581 flags, &page, &fsdata); 4582 if (err) 4583 goto fail; 4584 4585 kaddr = kmap_atomic(page); 4586 memcpy(kaddr, symname, len-1); 4587 kunmap_atomic(kaddr); 4588 4589 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1, 4590 page, fsdata); 4591 if (err < 0) 4592 goto fail; 4593 if (err < len-1) 4594 goto retry; 4595 4596 mark_inode_dirty(inode); 4597 return 0; 4598 fail: 4599 return err; 4600 } 4601 EXPORT_SYMBOL(__page_symlink); 4602 4603 int page_symlink(struct inode *inode, const char *symname, int len) 4604 { 4605 return __page_symlink(inode, symname, len, 4606 !mapping_gfp_constraint(inode->i_mapping, __GFP_FS)); 4607 } 4608 EXPORT_SYMBOL(page_symlink); 4609 4610 const struct inode_operations page_symlink_inode_operations = { 4611 .readlink = generic_readlink, 4612 .follow_link = page_follow_link_light, 4613 .put_link = page_put_link, 4614 }; 4615 EXPORT_SYMBOL(page_symlink_inode_operations); 4616