xref: /openbmc/linux/fs/namei.c (revision cfdfc14e)
1  // SPDX-License-Identifier: GPL-2.0
2  /*
3   *  linux/fs/namei.c
4   *
5   *  Copyright (C) 1991, 1992  Linus Torvalds
6   */
7  
8  /*
9   * Some corrections by tytso.
10   */
11  
12  /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
13   * lookup logic.
14   */
15  /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
16   */
17  
18  #include <linux/init.h>
19  #include <linux/export.h>
20  #include <linux/kernel.h>
21  #include <linux/slab.h>
22  #include <linux/fs.h>
23  #include <linux/namei.h>
24  #include <linux/pagemap.h>
25  #include <linux/fsnotify.h>
26  #include <linux/personality.h>
27  #include <linux/security.h>
28  #include <linux/ima.h>
29  #include <linux/syscalls.h>
30  #include <linux/mount.h>
31  #include <linux/audit.h>
32  #include <linux/capability.h>
33  #include <linux/file.h>
34  #include <linux/fcntl.h>
35  #include <linux/device_cgroup.h>
36  #include <linux/fs_struct.h>
37  #include <linux/posix_acl.h>
38  #include <linux/hash.h>
39  #include <linux/bitops.h>
40  #include <linux/init_task.h>
41  #include <linux/uaccess.h>
42  #include <linux/build_bug.h>
43  
44  #include "internal.h"
45  #include "mount.h"
46  
47  /* [Feb-1997 T. Schoebel-Theuer]
48   * Fundamental changes in the pathname lookup mechanisms (namei)
49   * were necessary because of omirr.  The reason is that omirr needs
50   * to know the _real_ pathname, not the user-supplied one, in case
51   * of symlinks (and also when transname replacements occur).
52   *
53   * The new code replaces the old recursive symlink resolution with
54   * an iterative one (in case of non-nested symlink chains).  It does
55   * this with calls to <fs>_follow_link().
56   * As a side effect, dir_namei(), _namei() and follow_link() are now
57   * replaced with a single function lookup_dentry() that can handle all
58   * the special cases of the former code.
59   *
60   * With the new dcache, the pathname is stored at each inode, at least as
61   * long as the refcount of the inode is positive.  As a side effect, the
62   * size of the dcache depends on the inode cache and thus is dynamic.
63   *
64   * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
65   * resolution to correspond with current state of the code.
66   *
67   * Note that the symlink resolution is not *completely* iterative.
68   * There is still a significant amount of tail- and mid- recursion in
69   * the algorithm.  Also, note that <fs>_readlink() is not used in
70   * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
71   * may return different results than <fs>_follow_link().  Many virtual
72   * filesystems (including /proc) exhibit this behavior.
73   */
74  
75  /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
76   * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
77   * and the name already exists in form of a symlink, try to create the new
78   * name indicated by the symlink. The old code always complained that the
79   * name already exists, due to not following the symlink even if its target
80   * is nonexistent.  The new semantics affects also mknod() and link() when
81   * the name is a symlink pointing to a non-existent name.
82   *
83   * I don't know which semantics is the right one, since I have no access
84   * to standards. But I found by trial that HP-UX 9.0 has the full "new"
85   * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
86   * "old" one. Personally, I think the new semantics is much more logical.
87   * Note that "ln old new" where "new" is a symlink pointing to a non-existing
88   * file does succeed in both HP-UX and SunOs, but not in Solaris
89   * and in the old Linux semantics.
90   */
91  
92  /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
93   * semantics.  See the comments in "open_namei" and "do_link" below.
94   *
95   * [10-Sep-98 Alan Modra] Another symlink change.
96   */
97  
98  /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
99   *	inside the path - always follow.
100   *	in the last component in creation/removal/renaming - never follow.
101   *	if LOOKUP_FOLLOW passed - follow.
102   *	if the pathname has trailing slashes - follow.
103   *	otherwise - don't follow.
104   * (applied in that order).
105   *
106   * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
107   * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
108   * During the 2.4 we need to fix the userland stuff depending on it -
109   * hopefully we will be able to get rid of that wart in 2.5. So far only
110   * XEmacs seems to be relying on it...
111   */
112  /*
113   * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
114   * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
115   * any extra contention...
116   */
117  
118  /* In order to reduce some races, while at the same time doing additional
119   * checking and hopefully speeding things up, we copy filenames to the
120   * kernel data space before using them..
121   *
122   * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
123   * PATH_MAX includes the nul terminator --RR.
124   */
125  
126  #define EMBEDDED_NAME_MAX	(PATH_MAX - offsetof(struct filename, iname))
127  
128  struct filename *
129  getname_flags(const char __user *filename, int flags, int *empty)
130  {
131  	struct filename *result;
132  	char *kname;
133  	int len;
134  	BUILD_BUG_ON(offsetof(struct filename, iname) % sizeof(long) != 0);
135  
136  	result = audit_reusename(filename);
137  	if (result)
138  		return result;
139  
140  	result = __getname();
141  	if (unlikely(!result))
142  		return ERR_PTR(-ENOMEM);
143  
144  	/*
145  	 * First, try to embed the struct filename inside the names_cache
146  	 * allocation
147  	 */
148  	kname = (char *)result->iname;
149  	result->name = kname;
150  
151  	len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
152  	if (unlikely(len < 0)) {
153  		__putname(result);
154  		return ERR_PTR(len);
155  	}
156  
157  	/*
158  	 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
159  	 * separate struct filename so we can dedicate the entire
160  	 * names_cache allocation for the pathname, and re-do the copy from
161  	 * userland.
162  	 */
163  	if (unlikely(len == EMBEDDED_NAME_MAX)) {
164  		const size_t size = offsetof(struct filename, iname[1]);
165  		kname = (char *)result;
166  
167  		/*
168  		 * size is chosen that way we to guarantee that
169  		 * result->iname[0] is within the same object and that
170  		 * kname can't be equal to result->iname, no matter what.
171  		 */
172  		result = kzalloc(size, GFP_KERNEL);
173  		if (unlikely(!result)) {
174  			__putname(kname);
175  			return ERR_PTR(-ENOMEM);
176  		}
177  		result->name = kname;
178  		len = strncpy_from_user(kname, filename, PATH_MAX);
179  		if (unlikely(len < 0)) {
180  			__putname(kname);
181  			kfree(result);
182  			return ERR_PTR(len);
183  		}
184  		if (unlikely(len == PATH_MAX)) {
185  			__putname(kname);
186  			kfree(result);
187  			return ERR_PTR(-ENAMETOOLONG);
188  		}
189  	}
190  
191  	result->refcnt = 1;
192  	/* The empty path is special. */
193  	if (unlikely(!len)) {
194  		if (empty)
195  			*empty = 1;
196  		if (!(flags & LOOKUP_EMPTY)) {
197  			putname(result);
198  			return ERR_PTR(-ENOENT);
199  		}
200  	}
201  
202  	result->uptr = filename;
203  	result->aname = NULL;
204  	audit_getname(result);
205  	return result;
206  }
207  
208  struct filename *
209  getname(const char __user * filename)
210  {
211  	return getname_flags(filename, 0, NULL);
212  }
213  
214  struct filename *
215  getname_kernel(const char * filename)
216  {
217  	struct filename *result;
218  	int len = strlen(filename) + 1;
219  
220  	result = __getname();
221  	if (unlikely(!result))
222  		return ERR_PTR(-ENOMEM);
223  
224  	if (len <= EMBEDDED_NAME_MAX) {
225  		result->name = (char *)result->iname;
226  	} else if (len <= PATH_MAX) {
227  		const size_t size = offsetof(struct filename, iname[1]);
228  		struct filename *tmp;
229  
230  		tmp = kmalloc(size, GFP_KERNEL);
231  		if (unlikely(!tmp)) {
232  			__putname(result);
233  			return ERR_PTR(-ENOMEM);
234  		}
235  		tmp->name = (char *)result;
236  		result = tmp;
237  	} else {
238  		__putname(result);
239  		return ERR_PTR(-ENAMETOOLONG);
240  	}
241  	memcpy((char *)result->name, filename, len);
242  	result->uptr = NULL;
243  	result->aname = NULL;
244  	result->refcnt = 1;
245  	audit_getname(result);
246  
247  	return result;
248  }
249  
250  void putname(struct filename *name)
251  {
252  	BUG_ON(name->refcnt <= 0);
253  
254  	if (--name->refcnt > 0)
255  		return;
256  
257  	if (name->name != name->iname) {
258  		__putname(name->name);
259  		kfree(name);
260  	} else
261  		__putname(name);
262  }
263  
264  static int check_acl(struct inode *inode, int mask)
265  {
266  #ifdef CONFIG_FS_POSIX_ACL
267  	struct posix_acl *acl;
268  
269  	if (mask & MAY_NOT_BLOCK) {
270  		acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
271  	        if (!acl)
272  	                return -EAGAIN;
273  		/* no ->get_acl() calls in RCU mode... */
274  		if (is_uncached_acl(acl))
275  			return -ECHILD;
276  	        return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
277  	}
278  
279  	acl = get_acl(inode, ACL_TYPE_ACCESS);
280  	if (IS_ERR(acl))
281  		return PTR_ERR(acl);
282  	if (acl) {
283  	        int error = posix_acl_permission(inode, acl, mask);
284  	        posix_acl_release(acl);
285  	        return error;
286  	}
287  #endif
288  
289  	return -EAGAIN;
290  }
291  
292  /*
293   * This does the basic permission checking
294   */
295  static int acl_permission_check(struct inode *inode, int mask)
296  {
297  	unsigned int mode = inode->i_mode;
298  
299  	if (likely(uid_eq(current_fsuid(), inode->i_uid)))
300  		mode >>= 6;
301  	else {
302  		if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
303  			int error = check_acl(inode, mask);
304  			if (error != -EAGAIN)
305  				return error;
306  		}
307  
308  		if (in_group_p(inode->i_gid))
309  			mode >>= 3;
310  	}
311  
312  	/*
313  	 * If the DACs are ok we don't need any capability check.
314  	 */
315  	if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
316  		return 0;
317  	return -EACCES;
318  }
319  
320  /**
321   * generic_permission -  check for access rights on a Posix-like filesystem
322   * @inode:	inode to check access rights for
323   * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...)
324   *
325   * Used to check for read/write/execute permissions on a file.
326   * We use "fsuid" for this, letting us set arbitrary permissions
327   * for filesystem access without changing the "normal" uids which
328   * are used for other things.
329   *
330   * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
331   * request cannot be satisfied (eg. requires blocking or too much complexity).
332   * It would then be called again in ref-walk mode.
333   */
334  int generic_permission(struct inode *inode, int mask)
335  {
336  	int ret;
337  
338  	/*
339  	 * Do the basic permission checks.
340  	 */
341  	ret = acl_permission_check(inode, mask);
342  	if (ret != -EACCES)
343  		return ret;
344  
345  	if (S_ISDIR(inode->i_mode)) {
346  		/* DACs are overridable for directories */
347  		if (!(mask & MAY_WRITE))
348  			if (capable_wrt_inode_uidgid(inode,
349  						     CAP_DAC_READ_SEARCH))
350  				return 0;
351  		if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
352  			return 0;
353  		return -EACCES;
354  	}
355  
356  	/*
357  	 * Searching includes executable on directories, else just read.
358  	 */
359  	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
360  	if (mask == MAY_READ)
361  		if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))
362  			return 0;
363  	/*
364  	 * Read/write DACs are always overridable.
365  	 * Executable DACs are overridable when there is
366  	 * at least one exec bit set.
367  	 */
368  	if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
369  		if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
370  			return 0;
371  
372  	return -EACCES;
373  }
374  EXPORT_SYMBOL(generic_permission);
375  
376  /*
377   * We _really_ want to just do "generic_permission()" without
378   * even looking at the inode->i_op values. So we keep a cache
379   * flag in inode->i_opflags, that says "this has not special
380   * permission function, use the fast case".
381   */
382  static inline int do_inode_permission(struct inode *inode, int mask)
383  {
384  	if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
385  		if (likely(inode->i_op->permission))
386  			return inode->i_op->permission(inode, mask);
387  
388  		/* This gets set once for the inode lifetime */
389  		spin_lock(&inode->i_lock);
390  		inode->i_opflags |= IOP_FASTPERM;
391  		spin_unlock(&inode->i_lock);
392  	}
393  	return generic_permission(inode, mask);
394  }
395  
396  /**
397   * sb_permission - Check superblock-level permissions
398   * @sb: Superblock of inode to check permission on
399   * @inode: Inode to check permission on
400   * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
401   *
402   * Separate out file-system wide checks from inode-specific permission checks.
403   */
404  static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
405  {
406  	if (unlikely(mask & MAY_WRITE)) {
407  		umode_t mode = inode->i_mode;
408  
409  		/* Nobody gets write access to a read-only fs. */
410  		if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
411  			return -EROFS;
412  	}
413  	return 0;
414  }
415  
416  /**
417   * inode_permission - Check for access rights to a given inode
418   * @inode: Inode to check permission on
419   * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
420   *
421   * Check for read/write/execute permissions on an inode.  We use fs[ug]id for
422   * this, letting us set arbitrary permissions for filesystem access without
423   * changing the "normal" UIDs which are used for other things.
424   *
425   * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
426   */
427  int inode_permission(struct inode *inode, int mask)
428  {
429  	int retval;
430  
431  	retval = sb_permission(inode->i_sb, inode, mask);
432  	if (retval)
433  		return retval;
434  
435  	if (unlikely(mask & MAY_WRITE)) {
436  		/*
437  		 * Nobody gets write access to an immutable file.
438  		 */
439  		if (IS_IMMUTABLE(inode))
440  			return -EPERM;
441  
442  		/*
443  		 * Updating mtime will likely cause i_uid and i_gid to be
444  		 * written back improperly if their true value is unknown
445  		 * to the vfs.
446  		 */
447  		if (HAS_UNMAPPED_ID(inode))
448  			return -EACCES;
449  	}
450  
451  	retval = do_inode_permission(inode, mask);
452  	if (retval)
453  		return retval;
454  
455  	retval = devcgroup_inode_permission(inode, mask);
456  	if (retval)
457  		return retval;
458  
459  	return security_inode_permission(inode, mask);
460  }
461  EXPORT_SYMBOL(inode_permission);
462  
463  /**
464   * path_get - get a reference to a path
465   * @path: path to get the reference to
466   *
467   * Given a path increment the reference count to the dentry and the vfsmount.
468   */
469  void path_get(const struct path *path)
470  {
471  	mntget(path->mnt);
472  	dget(path->dentry);
473  }
474  EXPORT_SYMBOL(path_get);
475  
476  /**
477   * path_put - put a reference to a path
478   * @path: path to put the reference to
479   *
480   * Given a path decrement the reference count to the dentry and the vfsmount.
481   */
482  void path_put(const struct path *path)
483  {
484  	dput(path->dentry);
485  	mntput(path->mnt);
486  }
487  EXPORT_SYMBOL(path_put);
488  
489  #define EMBEDDED_LEVELS 2
490  struct nameidata {
491  	struct path	path;
492  	struct qstr	last;
493  	struct path	root;
494  	struct inode	*inode; /* path.dentry.d_inode */
495  	unsigned int	flags;
496  	unsigned	seq, m_seq;
497  	int		last_type;
498  	unsigned	depth;
499  	int		total_link_count;
500  	struct saved {
501  		struct path link;
502  		struct delayed_call done;
503  		const char *name;
504  		unsigned seq;
505  	} *stack, internal[EMBEDDED_LEVELS];
506  	struct filename	*name;
507  	struct nameidata *saved;
508  	struct inode	*link_inode;
509  	unsigned	root_seq;
510  	int		dfd;
511  } __randomize_layout;
512  
513  static void set_nameidata(struct nameidata *p, int dfd, struct filename *name)
514  {
515  	struct nameidata *old = current->nameidata;
516  	p->stack = p->internal;
517  	p->dfd = dfd;
518  	p->name = name;
519  	p->total_link_count = old ? old->total_link_count : 0;
520  	p->saved = old;
521  	current->nameidata = p;
522  }
523  
524  static void restore_nameidata(void)
525  {
526  	struct nameidata *now = current->nameidata, *old = now->saved;
527  
528  	current->nameidata = old;
529  	if (old)
530  		old->total_link_count = now->total_link_count;
531  	if (now->stack != now->internal)
532  		kfree(now->stack);
533  }
534  
535  static int __nd_alloc_stack(struct nameidata *nd)
536  {
537  	struct saved *p;
538  
539  	if (nd->flags & LOOKUP_RCU) {
540  		p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
541  				  GFP_ATOMIC);
542  		if (unlikely(!p))
543  			return -ECHILD;
544  	} else {
545  		p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
546  				  GFP_KERNEL);
547  		if (unlikely(!p))
548  			return -ENOMEM;
549  	}
550  	memcpy(p, nd->internal, sizeof(nd->internal));
551  	nd->stack = p;
552  	return 0;
553  }
554  
555  /**
556   * path_connected - Verify that a path->dentry is below path->mnt.mnt_root
557   * @path: nameidate to verify
558   *
559   * Rename can sometimes move a file or directory outside of a bind
560   * mount, path_connected allows those cases to be detected.
561   */
562  static bool path_connected(const struct path *path)
563  {
564  	struct vfsmount *mnt = path->mnt;
565  	struct super_block *sb = mnt->mnt_sb;
566  
567  	/* Bind mounts and multi-root filesystems can have disconnected paths */
568  	if (!(sb->s_iflags & SB_I_MULTIROOT) && (mnt->mnt_root == sb->s_root))
569  		return true;
570  
571  	return is_subdir(path->dentry, mnt->mnt_root);
572  }
573  
574  static inline int nd_alloc_stack(struct nameidata *nd)
575  {
576  	if (likely(nd->depth != EMBEDDED_LEVELS))
577  		return 0;
578  	if (likely(nd->stack != nd->internal))
579  		return 0;
580  	return __nd_alloc_stack(nd);
581  }
582  
583  static void drop_links(struct nameidata *nd)
584  {
585  	int i = nd->depth;
586  	while (i--) {
587  		struct saved *last = nd->stack + i;
588  		do_delayed_call(&last->done);
589  		clear_delayed_call(&last->done);
590  	}
591  }
592  
593  static void terminate_walk(struct nameidata *nd)
594  {
595  	drop_links(nd);
596  	if (!(nd->flags & LOOKUP_RCU)) {
597  		int i;
598  		path_put(&nd->path);
599  		for (i = 0; i < nd->depth; i++)
600  			path_put(&nd->stack[i].link);
601  		if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
602  			path_put(&nd->root);
603  			nd->root.mnt = NULL;
604  		}
605  	} else {
606  		nd->flags &= ~LOOKUP_RCU;
607  		if (!(nd->flags & LOOKUP_ROOT))
608  			nd->root.mnt = NULL;
609  		rcu_read_unlock();
610  	}
611  	nd->depth = 0;
612  }
613  
614  /* path_put is needed afterwards regardless of success or failure */
615  static bool legitimize_path(struct nameidata *nd,
616  			    struct path *path, unsigned seq)
617  {
618  	int res = __legitimize_mnt(path->mnt, nd->m_seq);
619  	if (unlikely(res)) {
620  		if (res > 0)
621  			path->mnt = NULL;
622  		path->dentry = NULL;
623  		return false;
624  	}
625  	if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
626  		path->dentry = NULL;
627  		return false;
628  	}
629  	return !read_seqcount_retry(&path->dentry->d_seq, seq);
630  }
631  
632  static bool legitimize_links(struct nameidata *nd)
633  {
634  	int i;
635  	for (i = 0; i < nd->depth; i++) {
636  		struct saved *last = nd->stack + i;
637  		if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
638  			drop_links(nd);
639  			nd->depth = i + 1;
640  			return false;
641  		}
642  	}
643  	return true;
644  }
645  
646  /*
647   * Path walking has 2 modes, rcu-walk and ref-walk (see
648   * Documentation/filesystems/path-lookup.txt).  In situations when we can't
649   * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
650   * normal reference counts on dentries and vfsmounts to transition to ref-walk
651   * mode.  Refcounts are grabbed at the last known good point before rcu-walk
652   * got stuck, so ref-walk may continue from there. If this is not successful
653   * (eg. a seqcount has changed), then failure is returned and it's up to caller
654   * to restart the path walk from the beginning in ref-walk mode.
655   */
656  
657  /**
658   * unlazy_walk - try to switch to ref-walk mode.
659   * @nd: nameidata pathwalk data
660   * Returns: 0 on success, -ECHILD on failure
661   *
662   * unlazy_walk attempts to legitimize the current nd->path and nd->root
663   * for ref-walk mode.
664   * Must be called from rcu-walk context.
665   * Nothing should touch nameidata between unlazy_walk() failure and
666   * terminate_walk().
667   */
668  static int unlazy_walk(struct nameidata *nd)
669  {
670  	struct dentry *parent = nd->path.dentry;
671  
672  	BUG_ON(!(nd->flags & LOOKUP_RCU));
673  
674  	nd->flags &= ~LOOKUP_RCU;
675  	if (unlikely(!legitimize_links(nd)))
676  		goto out2;
677  	if (unlikely(!legitimize_path(nd, &nd->path, nd->seq)))
678  		goto out1;
679  	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
680  		if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq)))
681  			goto out;
682  	}
683  	rcu_read_unlock();
684  	BUG_ON(nd->inode != parent->d_inode);
685  	return 0;
686  
687  out2:
688  	nd->path.mnt = NULL;
689  	nd->path.dentry = NULL;
690  out1:
691  	if (!(nd->flags & LOOKUP_ROOT))
692  		nd->root.mnt = NULL;
693  out:
694  	rcu_read_unlock();
695  	return -ECHILD;
696  }
697  
698  /**
699   * unlazy_child - try to switch to ref-walk mode.
700   * @nd: nameidata pathwalk data
701   * @dentry: child of nd->path.dentry
702   * @seq: seq number to check dentry against
703   * Returns: 0 on success, -ECHILD on failure
704   *
705   * unlazy_child attempts to legitimize the current nd->path, nd->root and dentry
706   * for ref-walk mode.  @dentry must be a path found by a do_lookup call on
707   * @nd.  Must be called from rcu-walk context.
708   * Nothing should touch nameidata between unlazy_child() failure and
709   * terminate_walk().
710   */
711  static int unlazy_child(struct nameidata *nd, struct dentry *dentry, unsigned seq)
712  {
713  	BUG_ON(!(nd->flags & LOOKUP_RCU));
714  
715  	nd->flags &= ~LOOKUP_RCU;
716  	if (unlikely(!legitimize_links(nd)))
717  		goto out2;
718  	if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq)))
719  		goto out2;
720  	if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref)))
721  		goto out1;
722  
723  	/*
724  	 * We need to move both the parent and the dentry from the RCU domain
725  	 * to be properly refcounted. And the sequence number in the dentry
726  	 * validates *both* dentry counters, since we checked the sequence
727  	 * number of the parent after we got the child sequence number. So we
728  	 * know the parent must still be valid if the child sequence number is
729  	 */
730  	if (unlikely(!lockref_get_not_dead(&dentry->d_lockref)))
731  		goto out;
732  	if (unlikely(read_seqcount_retry(&dentry->d_seq, seq))) {
733  		rcu_read_unlock();
734  		dput(dentry);
735  		goto drop_root_mnt;
736  	}
737  	/*
738  	 * Sequence counts matched. Now make sure that the root is
739  	 * still valid and get it if required.
740  	 */
741  	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
742  		if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq))) {
743  			rcu_read_unlock();
744  			dput(dentry);
745  			return -ECHILD;
746  		}
747  	}
748  
749  	rcu_read_unlock();
750  	return 0;
751  
752  out2:
753  	nd->path.mnt = NULL;
754  out1:
755  	nd->path.dentry = NULL;
756  out:
757  	rcu_read_unlock();
758  drop_root_mnt:
759  	if (!(nd->flags & LOOKUP_ROOT))
760  		nd->root.mnt = NULL;
761  	return -ECHILD;
762  }
763  
764  static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
765  {
766  	if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
767  		return dentry->d_op->d_revalidate(dentry, flags);
768  	else
769  		return 1;
770  }
771  
772  /**
773   * complete_walk - successful completion of path walk
774   * @nd:  pointer nameidata
775   *
776   * If we had been in RCU mode, drop out of it and legitimize nd->path.
777   * Revalidate the final result, unless we'd already done that during
778   * the path walk or the filesystem doesn't ask for it.  Return 0 on
779   * success, -error on failure.  In case of failure caller does not
780   * need to drop nd->path.
781   */
782  static int complete_walk(struct nameidata *nd)
783  {
784  	struct dentry *dentry = nd->path.dentry;
785  	int status;
786  
787  	if (nd->flags & LOOKUP_RCU) {
788  		if (!(nd->flags & LOOKUP_ROOT))
789  			nd->root.mnt = NULL;
790  		if (unlikely(unlazy_walk(nd)))
791  			return -ECHILD;
792  	}
793  
794  	if (likely(!(nd->flags & LOOKUP_JUMPED)))
795  		return 0;
796  
797  	if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
798  		return 0;
799  
800  	status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
801  	if (status > 0)
802  		return 0;
803  
804  	if (!status)
805  		status = -ESTALE;
806  
807  	return status;
808  }
809  
810  static void set_root(struct nameidata *nd)
811  {
812  	struct fs_struct *fs = current->fs;
813  
814  	if (nd->flags & LOOKUP_RCU) {
815  		unsigned seq;
816  
817  		do {
818  			seq = read_seqcount_begin(&fs->seq);
819  			nd->root = fs->root;
820  			nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
821  		} while (read_seqcount_retry(&fs->seq, seq));
822  	} else {
823  		get_fs_root(fs, &nd->root);
824  	}
825  }
826  
827  static void path_put_conditional(struct path *path, struct nameidata *nd)
828  {
829  	dput(path->dentry);
830  	if (path->mnt != nd->path.mnt)
831  		mntput(path->mnt);
832  }
833  
834  static inline void path_to_nameidata(const struct path *path,
835  					struct nameidata *nd)
836  {
837  	if (!(nd->flags & LOOKUP_RCU)) {
838  		dput(nd->path.dentry);
839  		if (nd->path.mnt != path->mnt)
840  			mntput(nd->path.mnt);
841  	}
842  	nd->path.mnt = path->mnt;
843  	nd->path.dentry = path->dentry;
844  }
845  
846  static int nd_jump_root(struct nameidata *nd)
847  {
848  	if (nd->flags & LOOKUP_RCU) {
849  		struct dentry *d;
850  		nd->path = nd->root;
851  		d = nd->path.dentry;
852  		nd->inode = d->d_inode;
853  		nd->seq = nd->root_seq;
854  		if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq)))
855  			return -ECHILD;
856  	} else {
857  		path_put(&nd->path);
858  		nd->path = nd->root;
859  		path_get(&nd->path);
860  		nd->inode = nd->path.dentry->d_inode;
861  	}
862  	nd->flags |= LOOKUP_JUMPED;
863  	return 0;
864  }
865  
866  /*
867   * Helper to directly jump to a known parsed path from ->get_link,
868   * caller must have taken a reference to path beforehand.
869   */
870  void nd_jump_link(struct path *path)
871  {
872  	struct nameidata *nd = current->nameidata;
873  	path_put(&nd->path);
874  
875  	nd->path = *path;
876  	nd->inode = nd->path.dentry->d_inode;
877  	nd->flags |= LOOKUP_JUMPED;
878  }
879  
880  static inline void put_link(struct nameidata *nd)
881  {
882  	struct saved *last = nd->stack + --nd->depth;
883  	do_delayed_call(&last->done);
884  	if (!(nd->flags & LOOKUP_RCU))
885  		path_put(&last->link);
886  }
887  
888  int sysctl_protected_symlinks __read_mostly = 0;
889  int sysctl_protected_hardlinks __read_mostly = 0;
890  
891  /**
892   * may_follow_link - Check symlink following for unsafe situations
893   * @nd: nameidata pathwalk data
894   *
895   * In the case of the sysctl_protected_symlinks sysctl being enabled,
896   * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
897   * in a sticky world-writable directory. This is to protect privileged
898   * processes from failing races against path names that may change out
899   * from under them by way of other users creating malicious symlinks.
900   * It will permit symlinks to be followed only when outside a sticky
901   * world-writable directory, or when the uid of the symlink and follower
902   * match, or when the directory owner matches the symlink's owner.
903   *
904   * Returns 0 if following the symlink is allowed, -ve on error.
905   */
906  static inline int may_follow_link(struct nameidata *nd)
907  {
908  	const struct inode *inode;
909  	const struct inode *parent;
910  	kuid_t puid;
911  
912  	if (!sysctl_protected_symlinks)
913  		return 0;
914  
915  	/* Allowed if owner and follower match. */
916  	inode = nd->link_inode;
917  	if (uid_eq(current_cred()->fsuid, inode->i_uid))
918  		return 0;
919  
920  	/* Allowed if parent directory not sticky and world-writable. */
921  	parent = nd->inode;
922  	if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
923  		return 0;
924  
925  	/* Allowed if parent directory and link owner match. */
926  	puid = parent->i_uid;
927  	if (uid_valid(puid) && uid_eq(puid, inode->i_uid))
928  		return 0;
929  
930  	if (nd->flags & LOOKUP_RCU)
931  		return -ECHILD;
932  
933  	audit_inode(nd->name, nd->stack[0].link.dentry, 0);
934  	audit_log_link_denied("follow_link");
935  	return -EACCES;
936  }
937  
938  /**
939   * safe_hardlink_source - Check for safe hardlink conditions
940   * @inode: the source inode to hardlink from
941   *
942   * Return false if at least one of the following conditions:
943   *    - inode is not a regular file
944   *    - inode is setuid
945   *    - inode is setgid and group-exec
946   *    - access failure for read and write
947   *
948   * Otherwise returns true.
949   */
950  static bool safe_hardlink_source(struct inode *inode)
951  {
952  	umode_t mode = inode->i_mode;
953  
954  	/* Special files should not get pinned to the filesystem. */
955  	if (!S_ISREG(mode))
956  		return false;
957  
958  	/* Setuid files should not get pinned to the filesystem. */
959  	if (mode & S_ISUID)
960  		return false;
961  
962  	/* Executable setgid files should not get pinned to the filesystem. */
963  	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
964  		return false;
965  
966  	/* Hardlinking to unreadable or unwritable sources is dangerous. */
967  	if (inode_permission(inode, MAY_READ | MAY_WRITE))
968  		return false;
969  
970  	return true;
971  }
972  
973  /**
974   * may_linkat - Check permissions for creating a hardlink
975   * @link: the source to hardlink from
976   *
977   * Block hardlink when all of:
978   *  - sysctl_protected_hardlinks enabled
979   *  - fsuid does not match inode
980   *  - hardlink source is unsafe (see safe_hardlink_source() above)
981   *  - not CAP_FOWNER in a namespace with the inode owner uid mapped
982   *
983   * Returns 0 if successful, -ve on error.
984   */
985  static int may_linkat(struct path *link)
986  {
987  	struct inode *inode = link->dentry->d_inode;
988  
989  	/* Inode writeback is not safe when the uid or gid are invalid. */
990  	if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
991  		return -EOVERFLOW;
992  
993  	if (!sysctl_protected_hardlinks)
994  		return 0;
995  
996  	/* Source inode owner (or CAP_FOWNER) can hardlink all they like,
997  	 * otherwise, it must be a safe source.
998  	 */
999  	if (safe_hardlink_source(inode) || inode_owner_or_capable(inode))
1000  		return 0;
1001  
1002  	audit_log_link_denied("linkat");
1003  	return -EPERM;
1004  }
1005  
1006  static __always_inline
1007  const char *get_link(struct nameidata *nd)
1008  {
1009  	struct saved *last = nd->stack + nd->depth - 1;
1010  	struct dentry *dentry = last->link.dentry;
1011  	struct inode *inode = nd->link_inode;
1012  	int error;
1013  	const char *res;
1014  
1015  	if (!(nd->flags & LOOKUP_RCU)) {
1016  		touch_atime(&last->link);
1017  		cond_resched();
1018  	} else if (atime_needs_update_rcu(&last->link, inode)) {
1019  		if (unlikely(unlazy_walk(nd)))
1020  			return ERR_PTR(-ECHILD);
1021  		touch_atime(&last->link);
1022  	}
1023  
1024  	error = security_inode_follow_link(dentry, inode,
1025  					   nd->flags & LOOKUP_RCU);
1026  	if (unlikely(error))
1027  		return ERR_PTR(error);
1028  
1029  	nd->last_type = LAST_BIND;
1030  	res = inode->i_link;
1031  	if (!res) {
1032  		const char * (*get)(struct dentry *, struct inode *,
1033  				struct delayed_call *);
1034  		get = inode->i_op->get_link;
1035  		if (nd->flags & LOOKUP_RCU) {
1036  			res = get(NULL, inode, &last->done);
1037  			if (res == ERR_PTR(-ECHILD)) {
1038  				if (unlikely(unlazy_walk(nd)))
1039  					return ERR_PTR(-ECHILD);
1040  				res = get(dentry, inode, &last->done);
1041  			}
1042  		} else {
1043  			res = get(dentry, inode, &last->done);
1044  		}
1045  		if (IS_ERR_OR_NULL(res))
1046  			return res;
1047  	}
1048  	if (*res == '/') {
1049  		if (!nd->root.mnt)
1050  			set_root(nd);
1051  		if (unlikely(nd_jump_root(nd)))
1052  			return ERR_PTR(-ECHILD);
1053  		while (unlikely(*++res == '/'))
1054  			;
1055  	}
1056  	if (!*res)
1057  		res = NULL;
1058  	return res;
1059  }
1060  
1061  /*
1062   * follow_up - Find the mountpoint of path's vfsmount
1063   *
1064   * Given a path, find the mountpoint of its source file system.
1065   * Replace @path with the path of the mountpoint in the parent mount.
1066   * Up is towards /.
1067   *
1068   * Return 1 if we went up a level and 0 if we were already at the
1069   * root.
1070   */
1071  int follow_up(struct path *path)
1072  {
1073  	struct mount *mnt = real_mount(path->mnt);
1074  	struct mount *parent;
1075  	struct dentry *mountpoint;
1076  
1077  	read_seqlock_excl(&mount_lock);
1078  	parent = mnt->mnt_parent;
1079  	if (parent == mnt) {
1080  		read_sequnlock_excl(&mount_lock);
1081  		return 0;
1082  	}
1083  	mntget(&parent->mnt);
1084  	mountpoint = dget(mnt->mnt_mountpoint);
1085  	read_sequnlock_excl(&mount_lock);
1086  	dput(path->dentry);
1087  	path->dentry = mountpoint;
1088  	mntput(path->mnt);
1089  	path->mnt = &parent->mnt;
1090  	return 1;
1091  }
1092  EXPORT_SYMBOL(follow_up);
1093  
1094  /*
1095   * Perform an automount
1096   * - return -EISDIR to tell follow_managed() to stop and return the path we
1097   *   were called with.
1098   */
1099  static int follow_automount(struct path *path, struct nameidata *nd,
1100  			    bool *need_mntput)
1101  {
1102  	struct vfsmount *mnt;
1103  	int err;
1104  
1105  	if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
1106  		return -EREMOTE;
1107  
1108  	/* We don't want to mount if someone's just doing a stat -
1109  	 * unless they're stat'ing a directory and appended a '/' to
1110  	 * the name.
1111  	 *
1112  	 * We do, however, want to mount if someone wants to open or
1113  	 * create a file of any type under the mountpoint, wants to
1114  	 * traverse through the mountpoint or wants to open the
1115  	 * mounted directory.  Also, autofs may mark negative dentries
1116  	 * as being automount points.  These will need the attentions
1117  	 * of the daemon to instantiate them before they can be used.
1118  	 */
1119  	if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
1120  			   LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
1121  	    path->dentry->d_inode)
1122  		return -EISDIR;
1123  
1124  	nd->total_link_count++;
1125  	if (nd->total_link_count >= 40)
1126  		return -ELOOP;
1127  
1128  	mnt = path->dentry->d_op->d_automount(path);
1129  	if (IS_ERR(mnt)) {
1130  		/*
1131  		 * The filesystem is allowed to return -EISDIR here to indicate
1132  		 * it doesn't want to automount.  For instance, autofs would do
1133  		 * this so that its userspace daemon can mount on this dentry.
1134  		 *
1135  		 * However, we can only permit this if it's a terminal point in
1136  		 * the path being looked up; if it wasn't then the remainder of
1137  		 * the path is inaccessible and we should say so.
1138  		 */
1139  		if (PTR_ERR(mnt) == -EISDIR && (nd->flags & LOOKUP_PARENT))
1140  			return -EREMOTE;
1141  		return PTR_ERR(mnt);
1142  	}
1143  
1144  	if (!mnt) /* mount collision */
1145  		return 0;
1146  
1147  	if (!*need_mntput) {
1148  		/* lock_mount() may release path->mnt on error */
1149  		mntget(path->mnt);
1150  		*need_mntput = true;
1151  	}
1152  	err = finish_automount(mnt, path);
1153  
1154  	switch (err) {
1155  	case -EBUSY:
1156  		/* Someone else made a mount here whilst we were busy */
1157  		return 0;
1158  	case 0:
1159  		path_put(path);
1160  		path->mnt = mnt;
1161  		path->dentry = dget(mnt->mnt_root);
1162  		return 0;
1163  	default:
1164  		return err;
1165  	}
1166  
1167  }
1168  
1169  /*
1170   * Handle a dentry that is managed in some way.
1171   * - Flagged for transit management (autofs)
1172   * - Flagged as mountpoint
1173   * - Flagged as automount point
1174   *
1175   * This may only be called in refwalk mode.
1176   *
1177   * Serialization is taken care of in namespace.c
1178   */
1179  static int follow_managed(struct path *path, struct nameidata *nd)
1180  {
1181  	struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */
1182  	unsigned managed;
1183  	bool need_mntput = false;
1184  	int ret = 0;
1185  
1186  	/* Given that we're not holding a lock here, we retain the value in a
1187  	 * local variable for each dentry as we look at it so that we don't see
1188  	 * the components of that value change under us */
1189  	while (managed = READ_ONCE(path->dentry->d_flags),
1190  	       managed &= DCACHE_MANAGED_DENTRY,
1191  	       unlikely(managed != 0)) {
1192  		/* Allow the filesystem to manage the transit without i_mutex
1193  		 * being held. */
1194  		if (managed & DCACHE_MANAGE_TRANSIT) {
1195  			BUG_ON(!path->dentry->d_op);
1196  			BUG_ON(!path->dentry->d_op->d_manage);
1197  			ret = path->dentry->d_op->d_manage(path, false);
1198  			if (ret < 0)
1199  				break;
1200  		}
1201  
1202  		/* Transit to a mounted filesystem. */
1203  		if (managed & DCACHE_MOUNTED) {
1204  			struct vfsmount *mounted = lookup_mnt(path);
1205  			if (mounted) {
1206  				dput(path->dentry);
1207  				if (need_mntput)
1208  					mntput(path->mnt);
1209  				path->mnt = mounted;
1210  				path->dentry = dget(mounted->mnt_root);
1211  				need_mntput = true;
1212  				continue;
1213  			}
1214  
1215  			/* Something is mounted on this dentry in another
1216  			 * namespace and/or whatever was mounted there in this
1217  			 * namespace got unmounted before lookup_mnt() could
1218  			 * get it */
1219  		}
1220  
1221  		/* Handle an automount point */
1222  		if (managed & DCACHE_NEED_AUTOMOUNT) {
1223  			ret = follow_automount(path, nd, &need_mntput);
1224  			if (ret < 0)
1225  				break;
1226  			continue;
1227  		}
1228  
1229  		/* We didn't change the current path point */
1230  		break;
1231  	}
1232  
1233  	if (need_mntput && path->mnt == mnt)
1234  		mntput(path->mnt);
1235  	if (ret == -EISDIR || !ret)
1236  		ret = 1;
1237  	if (need_mntput)
1238  		nd->flags |= LOOKUP_JUMPED;
1239  	if (unlikely(ret < 0))
1240  		path_put_conditional(path, nd);
1241  	return ret;
1242  }
1243  
1244  int follow_down_one(struct path *path)
1245  {
1246  	struct vfsmount *mounted;
1247  
1248  	mounted = lookup_mnt(path);
1249  	if (mounted) {
1250  		dput(path->dentry);
1251  		mntput(path->mnt);
1252  		path->mnt = mounted;
1253  		path->dentry = dget(mounted->mnt_root);
1254  		return 1;
1255  	}
1256  	return 0;
1257  }
1258  EXPORT_SYMBOL(follow_down_one);
1259  
1260  static inline int managed_dentry_rcu(const struct path *path)
1261  {
1262  	return (path->dentry->d_flags & DCACHE_MANAGE_TRANSIT) ?
1263  		path->dentry->d_op->d_manage(path, true) : 0;
1264  }
1265  
1266  /*
1267   * Try to skip to top of mountpoint pile in rcuwalk mode.  Fail if
1268   * we meet a managed dentry that would need blocking.
1269   */
1270  static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1271  			       struct inode **inode, unsigned *seqp)
1272  {
1273  	for (;;) {
1274  		struct mount *mounted;
1275  		/*
1276  		 * Don't forget we might have a non-mountpoint managed dentry
1277  		 * that wants to block transit.
1278  		 */
1279  		switch (managed_dentry_rcu(path)) {
1280  		case -ECHILD:
1281  		default:
1282  			return false;
1283  		case -EISDIR:
1284  			return true;
1285  		case 0:
1286  			break;
1287  		}
1288  
1289  		if (!d_mountpoint(path->dentry))
1290  			return !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
1291  
1292  		mounted = __lookup_mnt(path->mnt, path->dentry);
1293  		if (!mounted)
1294  			break;
1295  		path->mnt = &mounted->mnt;
1296  		path->dentry = mounted->mnt.mnt_root;
1297  		nd->flags |= LOOKUP_JUMPED;
1298  		*seqp = read_seqcount_begin(&path->dentry->d_seq);
1299  		/*
1300  		 * Update the inode too. We don't need to re-check the
1301  		 * dentry sequence number here after this d_inode read,
1302  		 * because a mount-point is always pinned.
1303  		 */
1304  		*inode = path->dentry->d_inode;
1305  	}
1306  	return !read_seqretry(&mount_lock, nd->m_seq) &&
1307  		!(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
1308  }
1309  
1310  static int follow_dotdot_rcu(struct nameidata *nd)
1311  {
1312  	struct inode *inode = nd->inode;
1313  
1314  	while (1) {
1315  		if (path_equal(&nd->path, &nd->root))
1316  			break;
1317  		if (nd->path.dentry != nd->path.mnt->mnt_root) {
1318  			struct dentry *old = nd->path.dentry;
1319  			struct dentry *parent = old->d_parent;
1320  			unsigned seq;
1321  
1322  			inode = parent->d_inode;
1323  			seq = read_seqcount_begin(&parent->d_seq);
1324  			if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq)))
1325  				return -ECHILD;
1326  			nd->path.dentry = parent;
1327  			nd->seq = seq;
1328  			if (unlikely(!path_connected(&nd->path)))
1329  				return -ENOENT;
1330  			break;
1331  		} else {
1332  			struct mount *mnt = real_mount(nd->path.mnt);
1333  			struct mount *mparent = mnt->mnt_parent;
1334  			struct dentry *mountpoint = mnt->mnt_mountpoint;
1335  			struct inode *inode2 = mountpoint->d_inode;
1336  			unsigned seq = read_seqcount_begin(&mountpoint->d_seq);
1337  			if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
1338  				return -ECHILD;
1339  			if (&mparent->mnt == nd->path.mnt)
1340  				break;
1341  			/* we know that mountpoint was pinned */
1342  			nd->path.dentry = mountpoint;
1343  			nd->path.mnt = &mparent->mnt;
1344  			inode = inode2;
1345  			nd->seq = seq;
1346  		}
1347  	}
1348  	while (unlikely(d_mountpoint(nd->path.dentry))) {
1349  		struct mount *mounted;
1350  		mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
1351  		if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
1352  			return -ECHILD;
1353  		if (!mounted)
1354  			break;
1355  		nd->path.mnt = &mounted->mnt;
1356  		nd->path.dentry = mounted->mnt.mnt_root;
1357  		inode = nd->path.dentry->d_inode;
1358  		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
1359  	}
1360  	nd->inode = inode;
1361  	return 0;
1362  }
1363  
1364  /*
1365   * Follow down to the covering mount currently visible to userspace.  At each
1366   * point, the filesystem owning that dentry may be queried as to whether the
1367   * caller is permitted to proceed or not.
1368   */
1369  int follow_down(struct path *path)
1370  {
1371  	unsigned managed;
1372  	int ret;
1373  
1374  	while (managed = READ_ONCE(path->dentry->d_flags),
1375  	       unlikely(managed & DCACHE_MANAGED_DENTRY)) {
1376  		/* Allow the filesystem to manage the transit without i_mutex
1377  		 * being held.
1378  		 *
1379  		 * We indicate to the filesystem if someone is trying to mount
1380  		 * something here.  This gives autofs the chance to deny anyone
1381  		 * other than its daemon the right to mount on its
1382  		 * superstructure.
1383  		 *
1384  		 * The filesystem may sleep at this point.
1385  		 */
1386  		if (managed & DCACHE_MANAGE_TRANSIT) {
1387  			BUG_ON(!path->dentry->d_op);
1388  			BUG_ON(!path->dentry->d_op->d_manage);
1389  			ret = path->dentry->d_op->d_manage(path, false);
1390  			if (ret < 0)
1391  				return ret == -EISDIR ? 0 : ret;
1392  		}
1393  
1394  		/* Transit to a mounted filesystem. */
1395  		if (managed & DCACHE_MOUNTED) {
1396  			struct vfsmount *mounted = lookup_mnt(path);
1397  			if (!mounted)
1398  				break;
1399  			dput(path->dentry);
1400  			mntput(path->mnt);
1401  			path->mnt = mounted;
1402  			path->dentry = dget(mounted->mnt_root);
1403  			continue;
1404  		}
1405  
1406  		/* Don't handle automount points here */
1407  		break;
1408  	}
1409  	return 0;
1410  }
1411  EXPORT_SYMBOL(follow_down);
1412  
1413  /*
1414   * Skip to top of mountpoint pile in refwalk mode for follow_dotdot()
1415   */
1416  static void follow_mount(struct path *path)
1417  {
1418  	while (d_mountpoint(path->dentry)) {
1419  		struct vfsmount *mounted = lookup_mnt(path);
1420  		if (!mounted)
1421  			break;
1422  		dput(path->dentry);
1423  		mntput(path->mnt);
1424  		path->mnt = mounted;
1425  		path->dentry = dget(mounted->mnt_root);
1426  	}
1427  }
1428  
1429  static int path_parent_directory(struct path *path)
1430  {
1431  	struct dentry *old = path->dentry;
1432  	/* rare case of legitimate dget_parent()... */
1433  	path->dentry = dget_parent(path->dentry);
1434  	dput(old);
1435  	if (unlikely(!path_connected(path)))
1436  		return -ENOENT;
1437  	return 0;
1438  }
1439  
1440  static int follow_dotdot(struct nameidata *nd)
1441  {
1442  	while(1) {
1443  		if (path_equal(&nd->path, &nd->root))
1444  			break;
1445  		if (nd->path.dentry != nd->path.mnt->mnt_root) {
1446  			int ret = path_parent_directory(&nd->path);
1447  			if (ret)
1448  				return ret;
1449  			break;
1450  		}
1451  		if (!follow_up(&nd->path))
1452  			break;
1453  	}
1454  	follow_mount(&nd->path);
1455  	nd->inode = nd->path.dentry->d_inode;
1456  	return 0;
1457  }
1458  
1459  /*
1460   * This looks up the name in dcache and possibly revalidates the found dentry.
1461   * NULL is returned if the dentry does not exist in the cache.
1462   */
1463  static struct dentry *lookup_dcache(const struct qstr *name,
1464  				    struct dentry *dir,
1465  				    unsigned int flags)
1466  {
1467  	struct dentry *dentry = d_lookup(dir, name);
1468  	if (dentry) {
1469  		int error = d_revalidate(dentry, flags);
1470  		if (unlikely(error <= 0)) {
1471  			if (!error)
1472  				d_invalidate(dentry);
1473  			dput(dentry);
1474  			return ERR_PTR(error);
1475  		}
1476  	}
1477  	return dentry;
1478  }
1479  
1480  /*
1481   * Parent directory has inode locked exclusive.  This is one
1482   * and only case when ->lookup() gets called on non in-lookup
1483   * dentries - as the matter of fact, this only gets called
1484   * when directory is guaranteed to have no in-lookup children
1485   * at all.
1486   */
1487  static struct dentry *__lookup_hash(const struct qstr *name,
1488  		struct dentry *base, unsigned int flags)
1489  {
1490  	struct dentry *dentry = lookup_dcache(name, base, flags);
1491  	struct dentry *old;
1492  	struct inode *dir = base->d_inode;
1493  
1494  	if (dentry)
1495  		return dentry;
1496  
1497  	/* Don't create child dentry for a dead directory. */
1498  	if (unlikely(IS_DEADDIR(dir)))
1499  		return ERR_PTR(-ENOENT);
1500  
1501  	dentry = d_alloc(base, name);
1502  	if (unlikely(!dentry))
1503  		return ERR_PTR(-ENOMEM);
1504  
1505  	old = dir->i_op->lookup(dir, dentry, flags);
1506  	if (unlikely(old)) {
1507  		dput(dentry);
1508  		dentry = old;
1509  	}
1510  	return dentry;
1511  }
1512  
1513  static int lookup_fast(struct nameidata *nd,
1514  		       struct path *path, struct inode **inode,
1515  		       unsigned *seqp)
1516  {
1517  	struct vfsmount *mnt = nd->path.mnt;
1518  	struct dentry *dentry, *parent = nd->path.dentry;
1519  	int status = 1;
1520  	int err;
1521  
1522  	/*
1523  	 * Rename seqlock is not required here because in the off chance
1524  	 * of a false negative due to a concurrent rename, the caller is
1525  	 * going to fall back to non-racy lookup.
1526  	 */
1527  	if (nd->flags & LOOKUP_RCU) {
1528  		unsigned seq;
1529  		bool negative;
1530  		dentry = __d_lookup_rcu(parent, &nd->last, &seq);
1531  		if (unlikely(!dentry)) {
1532  			if (unlazy_walk(nd))
1533  				return -ECHILD;
1534  			return 0;
1535  		}
1536  
1537  		/*
1538  		 * This sequence count validates that the inode matches
1539  		 * the dentry name information from lookup.
1540  		 */
1541  		*inode = d_backing_inode(dentry);
1542  		negative = d_is_negative(dentry);
1543  		if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
1544  			return -ECHILD;
1545  
1546  		/*
1547  		 * This sequence count validates that the parent had no
1548  		 * changes while we did the lookup of the dentry above.
1549  		 *
1550  		 * The memory barrier in read_seqcount_begin of child is
1551  		 *  enough, we can use __read_seqcount_retry here.
1552  		 */
1553  		if (unlikely(__read_seqcount_retry(&parent->d_seq, nd->seq)))
1554  			return -ECHILD;
1555  
1556  		*seqp = seq;
1557  		status = d_revalidate(dentry, nd->flags);
1558  		if (likely(status > 0)) {
1559  			/*
1560  			 * Note: do negative dentry check after revalidation in
1561  			 * case that drops it.
1562  			 */
1563  			if (unlikely(negative))
1564  				return -ENOENT;
1565  			path->mnt = mnt;
1566  			path->dentry = dentry;
1567  			if (likely(__follow_mount_rcu(nd, path, inode, seqp)))
1568  				return 1;
1569  		}
1570  		if (unlazy_child(nd, dentry, seq))
1571  			return -ECHILD;
1572  		if (unlikely(status == -ECHILD))
1573  			/* we'd been told to redo it in non-rcu mode */
1574  			status = d_revalidate(dentry, nd->flags);
1575  	} else {
1576  		dentry = __d_lookup(parent, &nd->last);
1577  		if (unlikely(!dentry))
1578  			return 0;
1579  		status = d_revalidate(dentry, nd->flags);
1580  	}
1581  	if (unlikely(status <= 0)) {
1582  		if (!status)
1583  			d_invalidate(dentry);
1584  		dput(dentry);
1585  		return status;
1586  	}
1587  	if (unlikely(d_is_negative(dentry))) {
1588  		dput(dentry);
1589  		return -ENOENT;
1590  	}
1591  
1592  	path->mnt = mnt;
1593  	path->dentry = dentry;
1594  	err = follow_managed(path, nd);
1595  	if (likely(err > 0))
1596  		*inode = d_backing_inode(path->dentry);
1597  	return err;
1598  }
1599  
1600  /* Fast lookup failed, do it the slow way */
1601  static struct dentry *__lookup_slow(const struct qstr *name,
1602  				    struct dentry *dir,
1603  				    unsigned int flags)
1604  {
1605  	struct dentry *dentry, *old;
1606  	struct inode *inode = dir->d_inode;
1607  	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
1608  
1609  	/* Don't go there if it's already dead */
1610  	if (unlikely(IS_DEADDIR(inode)))
1611  		return ERR_PTR(-ENOENT);
1612  again:
1613  	dentry = d_alloc_parallel(dir, name, &wq);
1614  	if (IS_ERR(dentry))
1615  		return dentry;
1616  	if (unlikely(!d_in_lookup(dentry))) {
1617  		if (!(flags & LOOKUP_NO_REVAL)) {
1618  			int error = d_revalidate(dentry, flags);
1619  			if (unlikely(error <= 0)) {
1620  				if (!error) {
1621  					d_invalidate(dentry);
1622  					dput(dentry);
1623  					goto again;
1624  				}
1625  				dput(dentry);
1626  				dentry = ERR_PTR(error);
1627  			}
1628  		}
1629  	} else {
1630  		old = inode->i_op->lookup(inode, dentry, flags);
1631  		d_lookup_done(dentry);
1632  		if (unlikely(old)) {
1633  			dput(dentry);
1634  			dentry = old;
1635  		}
1636  	}
1637  	return dentry;
1638  }
1639  
1640  static struct dentry *lookup_slow(const struct qstr *name,
1641  				  struct dentry *dir,
1642  				  unsigned int flags)
1643  {
1644  	struct inode *inode = dir->d_inode;
1645  	struct dentry *res;
1646  	inode_lock_shared(inode);
1647  	res = __lookup_slow(name, dir, flags);
1648  	inode_unlock_shared(inode);
1649  	return res;
1650  }
1651  
1652  static inline int may_lookup(struct nameidata *nd)
1653  {
1654  	if (nd->flags & LOOKUP_RCU) {
1655  		int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1656  		if (err != -ECHILD)
1657  			return err;
1658  		if (unlazy_walk(nd))
1659  			return -ECHILD;
1660  	}
1661  	return inode_permission(nd->inode, MAY_EXEC);
1662  }
1663  
1664  static inline int handle_dots(struct nameidata *nd, int type)
1665  {
1666  	if (type == LAST_DOTDOT) {
1667  		if (!nd->root.mnt)
1668  			set_root(nd);
1669  		if (nd->flags & LOOKUP_RCU) {
1670  			return follow_dotdot_rcu(nd);
1671  		} else
1672  			return follow_dotdot(nd);
1673  	}
1674  	return 0;
1675  }
1676  
1677  static int pick_link(struct nameidata *nd, struct path *link,
1678  		     struct inode *inode, unsigned seq)
1679  {
1680  	int error;
1681  	struct saved *last;
1682  	if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) {
1683  		path_to_nameidata(link, nd);
1684  		return -ELOOP;
1685  	}
1686  	if (!(nd->flags & LOOKUP_RCU)) {
1687  		if (link->mnt == nd->path.mnt)
1688  			mntget(link->mnt);
1689  	}
1690  	error = nd_alloc_stack(nd);
1691  	if (unlikely(error)) {
1692  		if (error == -ECHILD) {
1693  			if (unlikely(!legitimize_path(nd, link, seq))) {
1694  				drop_links(nd);
1695  				nd->depth = 0;
1696  				nd->flags &= ~LOOKUP_RCU;
1697  				nd->path.mnt = NULL;
1698  				nd->path.dentry = NULL;
1699  				if (!(nd->flags & LOOKUP_ROOT))
1700  					nd->root.mnt = NULL;
1701  				rcu_read_unlock();
1702  			} else if (likely(unlazy_walk(nd)) == 0)
1703  				error = nd_alloc_stack(nd);
1704  		}
1705  		if (error) {
1706  			path_put(link);
1707  			return error;
1708  		}
1709  	}
1710  
1711  	last = nd->stack + nd->depth++;
1712  	last->link = *link;
1713  	clear_delayed_call(&last->done);
1714  	nd->link_inode = inode;
1715  	last->seq = seq;
1716  	return 1;
1717  }
1718  
1719  enum {WALK_FOLLOW = 1, WALK_MORE = 2};
1720  
1721  /*
1722   * Do we need to follow links? We _really_ want to be able
1723   * to do this check without having to look at inode->i_op,
1724   * so we keep a cache of "no, this doesn't need follow_link"
1725   * for the common case.
1726   */
1727  static inline int step_into(struct nameidata *nd, struct path *path,
1728  			    int flags, struct inode *inode, unsigned seq)
1729  {
1730  	if (!(flags & WALK_MORE) && nd->depth)
1731  		put_link(nd);
1732  	if (likely(!d_is_symlink(path->dentry)) ||
1733  	   !(flags & WALK_FOLLOW || nd->flags & LOOKUP_FOLLOW)) {
1734  		/* not a symlink or should not follow */
1735  		path_to_nameidata(path, nd);
1736  		nd->inode = inode;
1737  		nd->seq = seq;
1738  		return 0;
1739  	}
1740  	/* make sure that d_is_symlink above matches inode */
1741  	if (nd->flags & LOOKUP_RCU) {
1742  		if (read_seqcount_retry(&path->dentry->d_seq, seq))
1743  			return -ECHILD;
1744  	}
1745  	return pick_link(nd, path, inode, seq);
1746  }
1747  
1748  static int walk_component(struct nameidata *nd, int flags)
1749  {
1750  	struct path path;
1751  	struct inode *inode;
1752  	unsigned seq;
1753  	int err;
1754  	/*
1755  	 * "." and ".." are special - ".." especially so because it has
1756  	 * to be able to know about the current root directory and
1757  	 * parent relationships.
1758  	 */
1759  	if (unlikely(nd->last_type != LAST_NORM)) {
1760  		err = handle_dots(nd, nd->last_type);
1761  		if (!(flags & WALK_MORE) && nd->depth)
1762  			put_link(nd);
1763  		return err;
1764  	}
1765  	err = lookup_fast(nd, &path, &inode, &seq);
1766  	if (unlikely(err <= 0)) {
1767  		if (err < 0)
1768  			return err;
1769  		path.dentry = lookup_slow(&nd->last, nd->path.dentry,
1770  					  nd->flags);
1771  		if (IS_ERR(path.dentry))
1772  			return PTR_ERR(path.dentry);
1773  
1774  		path.mnt = nd->path.mnt;
1775  		err = follow_managed(&path, nd);
1776  		if (unlikely(err < 0))
1777  			return err;
1778  
1779  		if (unlikely(d_is_negative(path.dentry))) {
1780  			path_to_nameidata(&path, nd);
1781  			return -ENOENT;
1782  		}
1783  
1784  		seq = 0;	/* we are already out of RCU mode */
1785  		inode = d_backing_inode(path.dentry);
1786  	}
1787  
1788  	return step_into(nd, &path, flags, inode, seq);
1789  }
1790  
1791  /*
1792   * We can do the critical dentry name comparison and hashing
1793   * operations one word at a time, but we are limited to:
1794   *
1795   * - Architectures with fast unaligned word accesses. We could
1796   *   do a "get_unaligned()" if this helps and is sufficiently
1797   *   fast.
1798   *
1799   * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
1800   *   do not trap on the (extremely unlikely) case of a page
1801   *   crossing operation.
1802   *
1803   * - Furthermore, we need an efficient 64-bit compile for the
1804   *   64-bit case in order to generate the "number of bytes in
1805   *   the final mask". Again, that could be replaced with a
1806   *   efficient population count instruction or similar.
1807   */
1808  #ifdef CONFIG_DCACHE_WORD_ACCESS
1809  
1810  #include <asm/word-at-a-time.h>
1811  
1812  #ifdef HASH_MIX
1813  
1814  /* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */
1815  
1816  #elif defined(CONFIG_64BIT)
1817  /*
1818   * Register pressure in the mixing function is an issue, particularly
1819   * on 32-bit x86, but almost any function requires one state value and
1820   * one temporary.  Instead, use a function designed for two state values
1821   * and no temporaries.
1822   *
1823   * This function cannot create a collision in only two iterations, so
1824   * we have two iterations to achieve avalanche.  In those two iterations,
1825   * we have six layers of mixing, which is enough to spread one bit's
1826   * influence out to 2^6 = 64 state bits.
1827   *
1828   * Rotate constants are scored by considering either 64 one-bit input
1829   * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the
1830   * probability of that delta causing a change to each of the 128 output
1831   * bits, using a sample of random initial states.
1832   *
1833   * The Shannon entropy of the computed probabilities is then summed
1834   * to produce a score.  Ideally, any input change has a 50% chance of
1835   * toggling any given output bit.
1836   *
1837   * Mixing scores (in bits) for (12,45):
1838   * Input delta: 1-bit      2-bit
1839   * 1 round:     713.3    42542.6
1840   * 2 rounds:   2753.7   140389.8
1841   * 3 rounds:   5954.1   233458.2
1842   * 4 rounds:   7862.6   256672.2
1843   * Perfect:    8192     258048
1844   *            (64*128) (64*63/2 * 128)
1845   */
1846  #define HASH_MIX(x, y, a)	\
1847  	(	x ^= (a),	\
1848  	y ^= x,	x = rol64(x,12),\
1849  	x += y,	y = rol64(y,45),\
1850  	y *= 9			)
1851  
1852  /*
1853   * Fold two longs into one 32-bit hash value.  This must be fast, but
1854   * latency isn't quite as critical, as there is a fair bit of additional
1855   * work done before the hash value is used.
1856   */
1857  static inline unsigned int fold_hash(unsigned long x, unsigned long y)
1858  {
1859  	y ^= x * GOLDEN_RATIO_64;
1860  	y *= GOLDEN_RATIO_64;
1861  	return y >> 32;
1862  }
1863  
1864  #else	/* 32-bit case */
1865  
1866  /*
1867   * Mixing scores (in bits) for (7,20):
1868   * Input delta: 1-bit      2-bit
1869   * 1 round:     330.3     9201.6
1870   * 2 rounds:   1246.4    25475.4
1871   * 3 rounds:   1907.1    31295.1
1872   * 4 rounds:   2042.3    31718.6
1873   * Perfect:    2048      31744
1874   *            (32*64)   (32*31/2 * 64)
1875   */
1876  #define HASH_MIX(x, y, a)	\
1877  	(	x ^= (a),	\
1878  	y ^= x,	x = rol32(x, 7),\
1879  	x += y,	y = rol32(y,20),\
1880  	y *= 9			)
1881  
1882  static inline unsigned int fold_hash(unsigned long x, unsigned long y)
1883  {
1884  	/* Use arch-optimized multiply if one exists */
1885  	return __hash_32(y ^ __hash_32(x));
1886  }
1887  
1888  #endif
1889  
1890  /*
1891   * Return the hash of a string of known length.  This is carfully
1892   * designed to match hash_name(), which is the more critical function.
1893   * In particular, we must end by hashing a final word containing 0..7
1894   * payload bytes, to match the way that hash_name() iterates until it
1895   * finds the delimiter after the name.
1896   */
1897  unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
1898  {
1899  	unsigned long a, x = 0, y = (unsigned long)salt;
1900  
1901  	for (;;) {
1902  		if (!len)
1903  			goto done;
1904  		a = load_unaligned_zeropad(name);
1905  		if (len < sizeof(unsigned long))
1906  			break;
1907  		HASH_MIX(x, y, a);
1908  		name += sizeof(unsigned long);
1909  		len -= sizeof(unsigned long);
1910  	}
1911  	x ^= a & bytemask_from_count(len);
1912  done:
1913  	return fold_hash(x, y);
1914  }
1915  EXPORT_SYMBOL(full_name_hash);
1916  
1917  /* Return the "hash_len" (hash and length) of a null-terminated string */
1918  u64 hashlen_string(const void *salt, const char *name)
1919  {
1920  	unsigned long a = 0, x = 0, y = (unsigned long)salt;
1921  	unsigned long adata, mask, len;
1922  	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1923  
1924  	len = 0;
1925  	goto inside;
1926  
1927  	do {
1928  		HASH_MIX(x, y, a);
1929  		len += sizeof(unsigned long);
1930  inside:
1931  		a = load_unaligned_zeropad(name+len);
1932  	} while (!has_zero(a, &adata, &constants));
1933  
1934  	adata = prep_zero_mask(a, adata, &constants);
1935  	mask = create_zero_mask(adata);
1936  	x ^= a & zero_bytemask(mask);
1937  
1938  	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
1939  }
1940  EXPORT_SYMBOL(hashlen_string);
1941  
1942  /*
1943   * Calculate the length and hash of the path component, and
1944   * return the "hash_len" as the result.
1945   */
1946  static inline u64 hash_name(const void *salt, const char *name)
1947  {
1948  	unsigned long a = 0, b, x = 0, y = (unsigned long)salt;
1949  	unsigned long adata, bdata, mask, len;
1950  	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1951  
1952  	len = 0;
1953  	goto inside;
1954  
1955  	do {
1956  		HASH_MIX(x, y, a);
1957  		len += sizeof(unsigned long);
1958  inside:
1959  		a = load_unaligned_zeropad(name+len);
1960  		b = a ^ REPEAT_BYTE('/');
1961  	} while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
1962  
1963  	adata = prep_zero_mask(a, adata, &constants);
1964  	bdata = prep_zero_mask(b, bdata, &constants);
1965  	mask = create_zero_mask(adata | bdata);
1966  	x ^= a & zero_bytemask(mask);
1967  
1968  	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
1969  }
1970  
1971  #else	/* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */
1972  
1973  /* Return the hash of a string of known length */
1974  unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
1975  {
1976  	unsigned long hash = init_name_hash(salt);
1977  	while (len--)
1978  		hash = partial_name_hash((unsigned char)*name++, hash);
1979  	return end_name_hash(hash);
1980  }
1981  EXPORT_SYMBOL(full_name_hash);
1982  
1983  /* Return the "hash_len" (hash and length) of a null-terminated string */
1984  u64 hashlen_string(const void *salt, const char *name)
1985  {
1986  	unsigned long hash = init_name_hash(salt);
1987  	unsigned long len = 0, c;
1988  
1989  	c = (unsigned char)*name;
1990  	while (c) {
1991  		len++;
1992  		hash = partial_name_hash(c, hash);
1993  		c = (unsigned char)name[len];
1994  	}
1995  	return hashlen_create(end_name_hash(hash), len);
1996  }
1997  EXPORT_SYMBOL(hashlen_string);
1998  
1999  /*
2000   * We know there's a real path component here of at least
2001   * one character.
2002   */
2003  static inline u64 hash_name(const void *salt, const char *name)
2004  {
2005  	unsigned long hash = init_name_hash(salt);
2006  	unsigned long len = 0, c;
2007  
2008  	c = (unsigned char)*name;
2009  	do {
2010  		len++;
2011  		hash = partial_name_hash(c, hash);
2012  		c = (unsigned char)name[len];
2013  	} while (c && c != '/');
2014  	return hashlen_create(end_name_hash(hash), len);
2015  }
2016  
2017  #endif
2018  
2019  /*
2020   * Name resolution.
2021   * This is the basic name resolution function, turning a pathname into
2022   * the final dentry. We expect 'base' to be positive and a directory.
2023   *
2024   * Returns 0 and nd will have valid dentry and mnt on success.
2025   * Returns error and drops reference to input namei data on failure.
2026   */
2027  static int link_path_walk(const char *name, struct nameidata *nd)
2028  {
2029  	int err;
2030  
2031  	while (*name=='/')
2032  		name++;
2033  	if (!*name)
2034  		return 0;
2035  
2036  	/* At this point we know we have a real path component. */
2037  	for(;;) {
2038  		u64 hash_len;
2039  		int type;
2040  
2041  		err = may_lookup(nd);
2042  		if (err)
2043  			return err;
2044  
2045  		hash_len = hash_name(nd->path.dentry, name);
2046  
2047  		type = LAST_NORM;
2048  		if (name[0] == '.') switch (hashlen_len(hash_len)) {
2049  			case 2:
2050  				if (name[1] == '.') {
2051  					type = LAST_DOTDOT;
2052  					nd->flags |= LOOKUP_JUMPED;
2053  				}
2054  				break;
2055  			case 1:
2056  				type = LAST_DOT;
2057  		}
2058  		if (likely(type == LAST_NORM)) {
2059  			struct dentry *parent = nd->path.dentry;
2060  			nd->flags &= ~LOOKUP_JUMPED;
2061  			if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
2062  				struct qstr this = { { .hash_len = hash_len }, .name = name };
2063  				err = parent->d_op->d_hash(parent, &this);
2064  				if (err < 0)
2065  					return err;
2066  				hash_len = this.hash_len;
2067  				name = this.name;
2068  			}
2069  		}
2070  
2071  		nd->last.hash_len = hash_len;
2072  		nd->last.name = name;
2073  		nd->last_type = type;
2074  
2075  		name += hashlen_len(hash_len);
2076  		if (!*name)
2077  			goto OK;
2078  		/*
2079  		 * If it wasn't NUL, we know it was '/'. Skip that
2080  		 * slash, and continue until no more slashes.
2081  		 */
2082  		do {
2083  			name++;
2084  		} while (unlikely(*name == '/'));
2085  		if (unlikely(!*name)) {
2086  OK:
2087  			/* pathname body, done */
2088  			if (!nd->depth)
2089  				return 0;
2090  			name = nd->stack[nd->depth - 1].name;
2091  			/* trailing symlink, done */
2092  			if (!name)
2093  				return 0;
2094  			/* last component of nested symlink */
2095  			err = walk_component(nd, WALK_FOLLOW);
2096  		} else {
2097  			/* not the last component */
2098  			err = walk_component(nd, WALK_FOLLOW | WALK_MORE);
2099  		}
2100  		if (err < 0)
2101  			return err;
2102  
2103  		if (err) {
2104  			const char *s = get_link(nd);
2105  
2106  			if (IS_ERR(s))
2107  				return PTR_ERR(s);
2108  			err = 0;
2109  			if (unlikely(!s)) {
2110  				/* jumped */
2111  				put_link(nd);
2112  			} else {
2113  				nd->stack[nd->depth - 1].name = name;
2114  				name = s;
2115  				continue;
2116  			}
2117  		}
2118  		if (unlikely(!d_can_lookup(nd->path.dentry))) {
2119  			if (nd->flags & LOOKUP_RCU) {
2120  				if (unlazy_walk(nd))
2121  					return -ECHILD;
2122  			}
2123  			return -ENOTDIR;
2124  		}
2125  	}
2126  }
2127  
2128  static const char *path_init(struct nameidata *nd, unsigned flags)
2129  {
2130  	const char *s = nd->name->name;
2131  
2132  	if (!*s)
2133  		flags &= ~LOOKUP_RCU;
2134  
2135  	nd->last_type = LAST_ROOT; /* if there are only slashes... */
2136  	nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT;
2137  	nd->depth = 0;
2138  	if (flags & LOOKUP_ROOT) {
2139  		struct dentry *root = nd->root.dentry;
2140  		struct inode *inode = root->d_inode;
2141  		if (*s && unlikely(!d_can_lookup(root)))
2142  			return ERR_PTR(-ENOTDIR);
2143  		nd->path = nd->root;
2144  		nd->inode = inode;
2145  		if (flags & LOOKUP_RCU) {
2146  			rcu_read_lock();
2147  			nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2148  			nd->root_seq = nd->seq;
2149  			nd->m_seq = read_seqbegin(&mount_lock);
2150  		} else {
2151  			path_get(&nd->path);
2152  		}
2153  		return s;
2154  	}
2155  
2156  	nd->root.mnt = NULL;
2157  	nd->path.mnt = NULL;
2158  	nd->path.dentry = NULL;
2159  
2160  	nd->m_seq = read_seqbegin(&mount_lock);
2161  	if (*s == '/') {
2162  		if (flags & LOOKUP_RCU)
2163  			rcu_read_lock();
2164  		set_root(nd);
2165  		if (likely(!nd_jump_root(nd)))
2166  			return s;
2167  		nd->root.mnt = NULL;
2168  		rcu_read_unlock();
2169  		return ERR_PTR(-ECHILD);
2170  	} else if (nd->dfd == AT_FDCWD) {
2171  		if (flags & LOOKUP_RCU) {
2172  			struct fs_struct *fs = current->fs;
2173  			unsigned seq;
2174  
2175  			rcu_read_lock();
2176  
2177  			do {
2178  				seq = read_seqcount_begin(&fs->seq);
2179  				nd->path = fs->pwd;
2180  				nd->inode = nd->path.dentry->d_inode;
2181  				nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2182  			} while (read_seqcount_retry(&fs->seq, seq));
2183  		} else {
2184  			get_fs_pwd(current->fs, &nd->path);
2185  			nd->inode = nd->path.dentry->d_inode;
2186  		}
2187  		return s;
2188  	} else {
2189  		/* Caller must check execute permissions on the starting path component */
2190  		struct fd f = fdget_raw(nd->dfd);
2191  		struct dentry *dentry;
2192  
2193  		if (!f.file)
2194  			return ERR_PTR(-EBADF);
2195  
2196  		dentry = f.file->f_path.dentry;
2197  
2198  		if (*s) {
2199  			if (!d_can_lookup(dentry)) {
2200  				fdput(f);
2201  				return ERR_PTR(-ENOTDIR);
2202  			}
2203  		}
2204  
2205  		nd->path = f.file->f_path;
2206  		if (flags & LOOKUP_RCU) {
2207  			rcu_read_lock();
2208  			nd->inode = nd->path.dentry->d_inode;
2209  			nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2210  		} else {
2211  			path_get(&nd->path);
2212  			nd->inode = nd->path.dentry->d_inode;
2213  		}
2214  		fdput(f);
2215  		return s;
2216  	}
2217  }
2218  
2219  static const char *trailing_symlink(struct nameidata *nd)
2220  {
2221  	const char *s;
2222  	int error = may_follow_link(nd);
2223  	if (unlikely(error))
2224  		return ERR_PTR(error);
2225  	nd->flags |= LOOKUP_PARENT;
2226  	nd->stack[0].name = NULL;
2227  	s = get_link(nd);
2228  	return s ? s : "";
2229  }
2230  
2231  static inline int lookup_last(struct nameidata *nd)
2232  {
2233  	if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
2234  		nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2235  
2236  	nd->flags &= ~LOOKUP_PARENT;
2237  	return walk_component(nd, 0);
2238  }
2239  
2240  static int handle_lookup_down(struct nameidata *nd)
2241  {
2242  	struct path path = nd->path;
2243  	struct inode *inode = nd->inode;
2244  	unsigned seq = nd->seq;
2245  	int err;
2246  
2247  	if (nd->flags & LOOKUP_RCU) {
2248  		/*
2249  		 * don't bother with unlazy_walk on failure - we are
2250  		 * at the very beginning of walk, so we lose nothing
2251  		 * if we simply redo everything in non-RCU mode
2252  		 */
2253  		if (unlikely(!__follow_mount_rcu(nd, &path, &inode, &seq)))
2254  			return -ECHILD;
2255  	} else {
2256  		dget(path.dentry);
2257  		err = follow_managed(&path, nd);
2258  		if (unlikely(err < 0))
2259  			return err;
2260  		inode = d_backing_inode(path.dentry);
2261  		seq = 0;
2262  	}
2263  	path_to_nameidata(&path, nd);
2264  	nd->inode = inode;
2265  	nd->seq = seq;
2266  	return 0;
2267  }
2268  
2269  /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
2270  static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2271  {
2272  	const char *s = path_init(nd, flags);
2273  	int err;
2274  
2275  	if (IS_ERR(s))
2276  		return PTR_ERR(s);
2277  
2278  	if (unlikely(flags & LOOKUP_DOWN)) {
2279  		err = handle_lookup_down(nd);
2280  		if (unlikely(err < 0)) {
2281  			terminate_walk(nd);
2282  			return err;
2283  		}
2284  	}
2285  
2286  	while (!(err = link_path_walk(s, nd))
2287  		&& ((err = lookup_last(nd)) > 0)) {
2288  		s = trailing_symlink(nd);
2289  		if (IS_ERR(s)) {
2290  			err = PTR_ERR(s);
2291  			break;
2292  		}
2293  	}
2294  	if (!err)
2295  		err = complete_walk(nd);
2296  
2297  	if (!err && nd->flags & LOOKUP_DIRECTORY)
2298  		if (!d_can_lookup(nd->path.dentry))
2299  			err = -ENOTDIR;
2300  	if (!err) {
2301  		*path = nd->path;
2302  		nd->path.mnt = NULL;
2303  		nd->path.dentry = NULL;
2304  	}
2305  	terminate_walk(nd);
2306  	return err;
2307  }
2308  
2309  static int filename_lookup(int dfd, struct filename *name, unsigned flags,
2310  			   struct path *path, struct path *root)
2311  {
2312  	int retval;
2313  	struct nameidata nd;
2314  	if (IS_ERR(name))
2315  		return PTR_ERR(name);
2316  	if (unlikely(root)) {
2317  		nd.root = *root;
2318  		flags |= LOOKUP_ROOT;
2319  	}
2320  	set_nameidata(&nd, dfd, name);
2321  	retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
2322  	if (unlikely(retval == -ECHILD))
2323  		retval = path_lookupat(&nd, flags, path);
2324  	if (unlikely(retval == -ESTALE))
2325  		retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
2326  
2327  	if (likely(!retval))
2328  		audit_inode(name, path->dentry, flags & LOOKUP_PARENT);
2329  	restore_nameidata();
2330  	putname(name);
2331  	return retval;
2332  }
2333  
2334  /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
2335  static int path_parentat(struct nameidata *nd, unsigned flags,
2336  				struct path *parent)
2337  {
2338  	const char *s = path_init(nd, flags);
2339  	int err;
2340  	if (IS_ERR(s))
2341  		return PTR_ERR(s);
2342  	err = link_path_walk(s, nd);
2343  	if (!err)
2344  		err = complete_walk(nd);
2345  	if (!err) {
2346  		*parent = nd->path;
2347  		nd->path.mnt = NULL;
2348  		nd->path.dentry = NULL;
2349  	}
2350  	terminate_walk(nd);
2351  	return err;
2352  }
2353  
2354  static struct filename *filename_parentat(int dfd, struct filename *name,
2355  				unsigned int flags, struct path *parent,
2356  				struct qstr *last, int *type)
2357  {
2358  	int retval;
2359  	struct nameidata nd;
2360  
2361  	if (IS_ERR(name))
2362  		return name;
2363  	set_nameidata(&nd, dfd, name);
2364  	retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
2365  	if (unlikely(retval == -ECHILD))
2366  		retval = path_parentat(&nd, flags, parent);
2367  	if (unlikely(retval == -ESTALE))
2368  		retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
2369  	if (likely(!retval)) {
2370  		*last = nd.last;
2371  		*type = nd.last_type;
2372  		audit_inode(name, parent->dentry, LOOKUP_PARENT);
2373  	} else {
2374  		putname(name);
2375  		name = ERR_PTR(retval);
2376  	}
2377  	restore_nameidata();
2378  	return name;
2379  }
2380  
2381  /* does lookup, returns the object with parent locked */
2382  struct dentry *kern_path_locked(const char *name, struct path *path)
2383  {
2384  	struct filename *filename;
2385  	struct dentry *d;
2386  	struct qstr last;
2387  	int type;
2388  
2389  	filename = filename_parentat(AT_FDCWD, getname_kernel(name), 0, path,
2390  				    &last, &type);
2391  	if (IS_ERR(filename))
2392  		return ERR_CAST(filename);
2393  	if (unlikely(type != LAST_NORM)) {
2394  		path_put(path);
2395  		putname(filename);
2396  		return ERR_PTR(-EINVAL);
2397  	}
2398  	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
2399  	d = __lookup_hash(&last, path->dentry, 0);
2400  	if (IS_ERR(d)) {
2401  		inode_unlock(path->dentry->d_inode);
2402  		path_put(path);
2403  	}
2404  	putname(filename);
2405  	return d;
2406  }
2407  
2408  int kern_path(const char *name, unsigned int flags, struct path *path)
2409  {
2410  	return filename_lookup(AT_FDCWD, getname_kernel(name),
2411  			       flags, path, NULL);
2412  }
2413  EXPORT_SYMBOL(kern_path);
2414  
2415  /**
2416   * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
2417   * @dentry:  pointer to dentry of the base directory
2418   * @mnt: pointer to vfs mount of the base directory
2419   * @name: pointer to file name
2420   * @flags: lookup flags
2421   * @path: pointer to struct path to fill
2422   */
2423  int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
2424  		    const char *name, unsigned int flags,
2425  		    struct path *path)
2426  {
2427  	struct path root = {.mnt = mnt, .dentry = dentry};
2428  	/* the first argument of filename_lookup() is ignored with root */
2429  	return filename_lookup(AT_FDCWD, getname_kernel(name),
2430  			       flags , path, &root);
2431  }
2432  EXPORT_SYMBOL(vfs_path_lookup);
2433  
2434  static int lookup_one_len_common(const char *name, struct dentry *base,
2435  				 int len, struct qstr *this)
2436  {
2437  	this->name = name;
2438  	this->len = len;
2439  	this->hash = full_name_hash(base, name, len);
2440  	if (!len)
2441  		return -EACCES;
2442  
2443  	if (unlikely(name[0] == '.')) {
2444  		if (len < 2 || (len == 2 && name[1] == '.'))
2445  			return -EACCES;
2446  	}
2447  
2448  	while (len--) {
2449  		unsigned int c = *(const unsigned char *)name++;
2450  		if (c == '/' || c == '\0')
2451  			return -EACCES;
2452  	}
2453  	/*
2454  	 * See if the low-level filesystem might want
2455  	 * to use its own hash..
2456  	 */
2457  	if (base->d_flags & DCACHE_OP_HASH) {
2458  		int err = base->d_op->d_hash(base, this);
2459  		if (err < 0)
2460  			return err;
2461  	}
2462  
2463  	return inode_permission(base->d_inode, MAY_EXEC);
2464  }
2465  
2466  /**
2467   * try_lookup_one_len - filesystem helper to lookup single pathname component
2468   * @name:	pathname component to lookup
2469   * @base:	base directory to lookup from
2470   * @len:	maximum length @len should be interpreted to
2471   *
2472   * Look up a dentry by name in the dcache, returning NULL if it does not
2473   * currently exist.  The function does not try to create a dentry.
2474   *
2475   * Note that this routine is purely a helper for filesystem usage and should
2476   * not be called by generic code.
2477   *
2478   * The caller must hold base->i_mutex.
2479   */
2480  struct dentry *try_lookup_one_len(const char *name, struct dentry *base, int len)
2481  {
2482  	struct qstr this;
2483  	int err;
2484  
2485  	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2486  
2487  	err = lookup_one_len_common(name, base, len, &this);
2488  	if (err)
2489  		return ERR_PTR(err);
2490  
2491  	return lookup_dcache(&this, base, 0);
2492  }
2493  EXPORT_SYMBOL(try_lookup_one_len);
2494  
2495  /**
2496   * lookup_one_len - filesystem helper to lookup single pathname component
2497   * @name:	pathname component to lookup
2498   * @base:	base directory to lookup from
2499   * @len:	maximum length @len should be interpreted to
2500   *
2501   * Note that this routine is purely a helper for filesystem usage and should
2502   * not be called by generic code.
2503   *
2504   * The caller must hold base->i_mutex.
2505   */
2506  struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
2507  {
2508  	struct dentry *dentry;
2509  	struct qstr this;
2510  	int err;
2511  
2512  	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2513  
2514  	err = lookup_one_len_common(name, base, len, &this);
2515  	if (err)
2516  		return ERR_PTR(err);
2517  
2518  	dentry = lookup_dcache(&this, base, 0);
2519  	return dentry ? dentry : __lookup_slow(&this, base, 0);
2520  }
2521  EXPORT_SYMBOL(lookup_one_len);
2522  
2523  /**
2524   * lookup_one_len_unlocked - filesystem helper to lookup single pathname component
2525   * @name:	pathname component to lookup
2526   * @base:	base directory to lookup from
2527   * @len:	maximum length @len should be interpreted to
2528   *
2529   * Note that this routine is purely a helper for filesystem usage and should
2530   * not be called by generic code.
2531   *
2532   * Unlike lookup_one_len, it should be called without the parent
2533   * i_mutex held, and will take the i_mutex itself if necessary.
2534   */
2535  struct dentry *lookup_one_len_unlocked(const char *name,
2536  				       struct dentry *base, int len)
2537  {
2538  	struct qstr this;
2539  	int err;
2540  	struct dentry *ret;
2541  
2542  	err = lookup_one_len_common(name, base, len, &this);
2543  	if (err)
2544  		return ERR_PTR(err);
2545  
2546  	ret = lookup_dcache(&this, base, 0);
2547  	if (!ret)
2548  		ret = lookup_slow(&this, base, 0);
2549  	return ret;
2550  }
2551  EXPORT_SYMBOL(lookup_one_len_unlocked);
2552  
2553  #ifdef CONFIG_UNIX98_PTYS
2554  int path_pts(struct path *path)
2555  {
2556  	/* Find something mounted on "pts" in the same directory as
2557  	 * the input path.
2558  	 */
2559  	struct dentry *child, *parent;
2560  	struct qstr this;
2561  	int ret;
2562  
2563  	ret = path_parent_directory(path);
2564  	if (ret)
2565  		return ret;
2566  
2567  	parent = path->dentry;
2568  	this.name = "pts";
2569  	this.len = 3;
2570  	child = d_hash_and_lookup(parent, &this);
2571  	if (!child)
2572  		return -ENOENT;
2573  
2574  	path->dentry = child;
2575  	dput(parent);
2576  	follow_mount(path);
2577  	return 0;
2578  }
2579  #endif
2580  
2581  int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
2582  		 struct path *path, int *empty)
2583  {
2584  	return filename_lookup(dfd, getname_flags(name, flags, empty),
2585  			       flags, path, NULL);
2586  }
2587  EXPORT_SYMBOL(user_path_at_empty);
2588  
2589  /**
2590   * mountpoint_last - look up last component for umount
2591   * @nd:   pathwalk nameidata - currently pointing at parent directory of "last"
2592   *
2593   * This is a special lookup_last function just for umount. In this case, we
2594   * need to resolve the path without doing any revalidation.
2595   *
2596   * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since
2597   * mountpoints are always pinned in the dcache, their ancestors are too. Thus,
2598   * in almost all cases, this lookup will be served out of the dcache. The only
2599   * cases where it won't are if nd->last refers to a symlink or the path is
2600   * bogus and it doesn't exist.
2601   *
2602   * Returns:
2603   * -error: if there was an error during lookup. This includes -ENOENT if the
2604   *         lookup found a negative dentry.
2605   *
2606   * 0:      if we successfully resolved nd->last and found it to not to be a
2607   *         symlink that needs to be followed.
2608   *
2609   * 1:      if we successfully resolved nd->last and found it to be a symlink
2610   *         that needs to be followed.
2611   */
2612  static int
2613  mountpoint_last(struct nameidata *nd)
2614  {
2615  	int error = 0;
2616  	struct dentry *dir = nd->path.dentry;
2617  	struct path path;
2618  
2619  	/* If we're in rcuwalk, drop out of it to handle last component */
2620  	if (nd->flags & LOOKUP_RCU) {
2621  		if (unlazy_walk(nd))
2622  			return -ECHILD;
2623  	}
2624  
2625  	nd->flags &= ~LOOKUP_PARENT;
2626  
2627  	if (unlikely(nd->last_type != LAST_NORM)) {
2628  		error = handle_dots(nd, nd->last_type);
2629  		if (error)
2630  			return error;
2631  		path.dentry = dget(nd->path.dentry);
2632  	} else {
2633  		path.dentry = d_lookup(dir, &nd->last);
2634  		if (!path.dentry) {
2635  			/*
2636  			 * No cached dentry. Mounted dentries are pinned in the
2637  			 * cache, so that means that this dentry is probably
2638  			 * a symlink or the path doesn't actually point
2639  			 * to a mounted dentry.
2640  			 */
2641  			path.dentry = lookup_slow(&nd->last, dir,
2642  					     nd->flags | LOOKUP_NO_REVAL);
2643  			if (IS_ERR(path.dentry))
2644  				return PTR_ERR(path.dentry);
2645  		}
2646  	}
2647  	if (d_is_negative(path.dentry)) {
2648  		dput(path.dentry);
2649  		return -ENOENT;
2650  	}
2651  	path.mnt = nd->path.mnt;
2652  	return step_into(nd, &path, 0, d_backing_inode(path.dentry), 0);
2653  }
2654  
2655  /**
2656   * path_mountpoint - look up a path to be umounted
2657   * @nd:		lookup context
2658   * @flags:	lookup flags
2659   * @path:	pointer to container for result
2660   *
2661   * Look up the given name, but don't attempt to revalidate the last component.
2662   * Returns 0 and "path" will be valid on success; Returns error otherwise.
2663   */
2664  static int
2665  path_mountpoint(struct nameidata *nd, unsigned flags, struct path *path)
2666  {
2667  	const char *s = path_init(nd, flags);
2668  	int err;
2669  	if (IS_ERR(s))
2670  		return PTR_ERR(s);
2671  	while (!(err = link_path_walk(s, nd)) &&
2672  		(err = mountpoint_last(nd)) > 0) {
2673  		s = trailing_symlink(nd);
2674  		if (IS_ERR(s)) {
2675  			err = PTR_ERR(s);
2676  			break;
2677  		}
2678  	}
2679  	if (!err) {
2680  		*path = nd->path;
2681  		nd->path.mnt = NULL;
2682  		nd->path.dentry = NULL;
2683  		follow_mount(path);
2684  	}
2685  	terminate_walk(nd);
2686  	return err;
2687  }
2688  
2689  static int
2690  filename_mountpoint(int dfd, struct filename *name, struct path *path,
2691  			unsigned int flags)
2692  {
2693  	struct nameidata nd;
2694  	int error;
2695  	if (IS_ERR(name))
2696  		return PTR_ERR(name);
2697  	set_nameidata(&nd, dfd, name);
2698  	error = path_mountpoint(&nd, flags | LOOKUP_RCU, path);
2699  	if (unlikely(error == -ECHILD))
2700  		error = path_mountpoint(&nd, flags, path);
2701  	if (unlikely(error == -ESTALE))
2702  		error = path_mountpoint(&nd, flags | LOOKUP_REVAL, path);
2703  	if (likely(!error))
2704  		audit_inode(name, path->dentry, 0);
2705  	restore_nameidata();
2706  	putname(name);
2707  	return error;
2708  }
2709  
2710  /**
2711   * user_path_mountpoint_at - lookup a path from userland in order to umount it
2712   * @dfd:	directory file descriptor
2713   * @name:	pathname from userland
2714   * @flags:	lookup flags
2715   * @path:	pointer to container to hold result
2716   *
2717   * A umount is a special case for path walking. We're not actually interested
2718   * in the inode in this situation, and ESTALE errors can be a problem. We
2719   * simply want track down the dentry and vfsmount attached at the mountpoint
2720   * and avoid revalidating the last component.
2721   *
2722   * Returns 0 and populates "path" on success.
2723   */
2724  int
2725  user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags,
2726  			struct path *path)
2727  {
2728  	return filename_mountpoint(dfd, getname(name), path, flags);
2729  }
2730  
2731  int
2732  kern_path_mountpoint(int dfd, const char *name, struct path *path,
2733  			unsigned int flags)
2734  {
2735  	return filename_mountpoint(dfd, getname_kernel(name), path, flags);
2736  }
2737  EXPORT_SYMBOL(kern_path_mountpoint);
2738  
2739  int __check_sticky(struct inode *dir, struct inode *inode)
2740  {
2741  	kuid_t fsuid = current_fsuid();
2742  
2743  	if (uid_eq(inode->i_uid, fsuid))
2744  		return 0;
2745  	if (uid_eq(dir->i_uid, fsuid))
2746  		return 0;
2747  	return !capable_wrt_inode_uidgid(inode, CAP_FOWNER);
2748  }
2749  EXPORT_SYMBOL(__check_sticky);
2750  
2751  /*
2752   *	Check whether we can remove a link victim from directory dir, check
2753   *  whether the type of victim is right.
2754   *  1. We can't do it if dir is read-only (done in permission())
2755   *  2. We should have write and exec permissions on dir
2756   *  3. We can't remove anything from append-only dir
2757   *  4. We can't do anything with immutable dir (done in permission())
2758   *  5. If the sticky bit on dir is set we should either
2759   *	a. be owner of dir, or
2760   *	b. be owner of victim, or
2761   *	c. have CAP_FOWNER capability
2762   *  6. If the victim is append-only or immutable we can't do antyhing with
2763   *     links pointing to it.
2764   *  7. If the victim has an unknown uid or gid we can't change the inode.
2765   *  8. If we were asked to remove a directory and victim isn't one - ENOTDIR.
2766   *  9. If we were asked to remove a non-directory and victim isn't one - EISDIR.
2767   * 10. We can't remove a root or mountpoint.
2768   * 11. We don't allow removal of NFS sillyrenamed files; it's handled by
2769   *     nfs_async_unlink().
2770   */
2771  static int may_delete(struct inode *dir, struct dentry *victim, bool isdir)
2772  {
2773  	struct inode *inode = d_backing_inode(victim);
2774  	int error;
2775  
2776  	if (d_is_negative(victim))
2777  		return -ENOENT;
2778  	BUG_ON(!inode);
2779  
2780  	BUG_ON(victim->d_parent->d_inode != dir);
2781  
2782  	/* Inode writeback is not safe when the uid or gid are invalid. */
2783  	if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
2784  		return -EOVERFLOW;
2785  
2786  	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2787  
2788  	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
2789  	if (error)
2790  		return error;
2791  	if (IS_APPEND(dir))
2792  		return -EPERM;
2793  
2794  	if (check_sticky(dir, inode) || IS_APPEND(inode) ||
2795  	    IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) || HAS_UNMAPPED_ID(inode))
2796  		return -EPERM;
2797  	if (isdir) {
2798  		if (!d_is_dir(victim))
2799  			return -ENOTDIR;
2800  		if (IS_ROOT(victim))
2801  			return -EBUSY;
2802  	} else if (d_is_dir(victim))
2803  		return -EISDIR;
2804  	if (IS_DEADDIR(dir))
2805  		return -ENOENT;
2806  	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
2807  		return -EBUSY;
2808  	return 0;
2809  }
2810  
2811  /*	Check whether we can create an object with dentry child in directory
2812   *  dir.
2813   *  1. We can't do it if child already exists (open has special treatment for
2814   *     this case, but since we are inlined it's OK)
2815   *  2. We can't do it if dir is read-only (done in permission())
2816   *  3. We can't do it if the fs can't represent the fsuid or fsgid.
2817   *  4. We should have write and exec permissions on dir
2818   *  5. We can't do it if dir is immutable (done in permission())
2819   */
2820  static inline int may_create(struct inode *dir, struct dentry *child)
2821  {
2822  	struct user_namespace *s_user_ns;
2823  	audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
2824  	if (child->d_inode)
2825  		return -EEXIST;
2826  	if (IS_DEADDIR(dir))
2827  		return -ENOENT;
2828  	s_user_ns = dir->i_sb->s_user_ns;
2829  	if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||
2830  	    !kgid_has_mapping(s_user_ns, current_fsgid()))
2831  		return -EOVERFLOW;
2832  	return inode_permission(dir, MAY_WRITE | MAY_EXEC);
2833  }
2834  
2835  /*
2836   * p1 and p2 should be directories on the same fs.
2837   */
2838  struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
2839  {
2840  	struct dentry *p;
2841  
2842  	if (p1 == p2) {
2843  		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2844  		return NULL;
2845  	}
2846  
2847  	mutex_lock(&p1->d_sb->s_vfs_rename_mutex);
2848  
2849  	p = d_ancestor(p2, p1);
2850  	if (p) {
2851  		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
2852  		inode_lock_nested(p1->d_inode, I_MUTEX_CHILD);
2853  		return p;
2854  	}
2855  
2856  	p = d_ancestor(p1, p2);
2857  	if (p) {
2858  		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2859  		inode_lock_nested(p2->d_inode, I_MUTEX_CHILD);
2860  		return p;
2861  	}
2862  
2863  	inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2864  	inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
2865  	return NULL;
2866  }
2867  EXPORT_SYMBOL(lock_rename);
2868  
2869  void unlock_rename(struct dentry *p1, struct dentry *p2)
2870  {
2871  	inode_unlock(p1->d_inode);
2872  	if (p1 != p2) {
2873  		inode_unlock(p2->d_inode);
2874  		mutex_unlock(&p1->d_sb->s_vfs_rename_mutex);
2875  	}
2876  }
2877  EXPORT_SYMBOL(unlock_rename);
2878  
2879  int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
2880  		bool want_excl)
2881  {
2882  	int error = may_create(dir, dentry);
2883  	if (error)
2884  		return error;
2885  
2886  	if (!dir->i_op->create)
2887  		return -EACCES;	/* shouldn't it be ENOSYS? */
2888  	mode &= S_IALLUGO;
2889  	mode |= S_IFREG;
2890  	error = security_inode_create(dir, dentry, mode);
2891  	if (error)
2892  		return error;
2893  	error = dir->i_op->create(dir, dentry, mode, want_excl);
2894  	if (!error)
2895  		fsnotify_create(dir, dentry);
2896  	return error;
2897  }
2898  EXPORT_SYMBOL(vfs_create);
2899  
2900  int vfs_mkobj(struct dentry *dentry, umode_t mode,
2901  		int (*f)(struct dentry *, umode_t, void *),
2902  		void *arg)
2903  {
2904  	struct inode *dir = dentry->d_parent->d_inode;
2905  	int error = may_create(dir, dentry);
2906  	if (error)
2907  		return error;
2908  
2909  	mode &= S_IALLUGO;
2910  	mode |= S_IFREG;
2911  	error = security_inode_create(dir, dentry, mode);
2912  	if (error)
2913  		return error;
2914  	error = f(dentry, mode, arg);
2915  	if (!error)
2916  		fsnotify_create(dir, dentry);
2917  	return error;
2918  }
2919  EXPORT_SYMBOL(vfs_mkobj);
2920  
2921  bool may_open_dev(const struct path *path)
2922  {
2923  	return !(path->mnt->mnt_flags & MNT_NODEV) &&
2924  		!(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
2925  }
2926  
2927  static int may_open(const struct path *path, int acc_mode, int flag)
2928  {
2929  	struct dentry *dentry = path->dentry;
2930  	struct inode *inode = dentry->d_inode;
2931  	int error;
2932  
2933  	if (!inode)
2934  		return -ENOENT;
2935  
2936  	switch (inode->i_mode & S_IFMT) {
2937  	case S_IFLNK:
2938  		return -ELOOP;
2939  	case S_IFDIR:
2940  		if (acc_mode & MAY_WRITE)
2941  			return -EISDIR;
2942  		break;
2943  	case S_IFBLK:
2944  	case S_IFCHR:
2945  		if (!may_open_dev(path))
2946  			return -EACCES;
2947  		/*FALLTHRU*/
2948  	case S_IFIFO:
2949  	case S_IFSOCK:
2950  		flag &= ~O_TRUNC;
2951  		break;
2952  	}
2953  
2954  	error = inode_permission(inode, MAY_OPEN | acc_mode);
2955  	if (error)
2956  		return error;
2957  
2958  	/*
2959  	 * An append-only file must be opened in append mode for writing.
2960  	 */
2961  	if (IS_APPEND(inode)) {
2962  		if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
2963  			return -EPERM;
2964  		if (flag & O_TRUNC)
2965  			return -EPERM;
2966  	}
2967  
2968  	/* O_NOATIME can only be set by the owner or superuser */
2969  	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
2970  		return -EPERM;
2971  
2972  	return 0;
2973  }
2974  
2975  static int handle_truncate(struct file *filp)
2976  {
2977  	const struct path *path = &filp->f_path;
2978  	struct inode *inode = path->dentry->d_inode;
2979  	int error = get_write_access(inode);
2980  	if (error)
2981  		return error;
2982  	/*
2983  	 * Refuse to truncate files with mandatory locks held on them.
2984  	 */
2985  	error = locks_verify_locked(filp);
2986  	if (!error)
2987  		error = security_path_truncate(path);
2988  	if (!error) {
2989  		error = do_truncate(path->dentry, 0,
2990  				    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
2991  				    filp);
2992  	}
2993  	put_write_access(inode);
2994  	return error;
2995  }
2996  
2997  static inline int open_to_namei_flags(int flag)
2998  {
2999  	if ((flag & O_ACCMODE) == 3)
3000  		flag--;
3001  	return flag;
3002  }
3003  
3004  static int may_o_create(const struct path *dir, struct dentry *dentry, umode_t mode)
3005  {
3006  	struct user_namespace *s_user_ns;
3007  	int error = security_path_mknod(dir, dentry, mode, 0);
3008  	if (error)
3009  		return error;
3010  
3011  	s_user_ns = dir->dentry->d_sb->s_user_ns;
3012  	if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||
3013  	    !kgid_has_mapping(s_user_ns, current_fsgid()))
3014  		return -EOVERFLOW;
3015  
3016  	error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
3017  	if (error)
3018  		return error;
3019  
3020  	return security_inode_create(dir->dentry->d_inode, dentry, mode);
3021  }
3022  
3023  /*
3024   * Attempt to atomically look up, create and open a file from a negative
3025   * dentry.
3026   *
3027   * Returns 0 if successful.  The file will have been created and attached to
3028   * @file by the filesystem calling finish_open().
3029   *
3030   * Returns 1 if the file was looked up only or didn't need creating.  The
3031   * caller will need to perform the open themselves.  @path will have been
3032   * updated to point to the new dentry.  This may be negative.
3033   *
3034   * Returns an error code otherwise.
3035   */
3036  static int atomic_open(struct nameidata *nd, struct dentry *dentry,
3037  			struct path *path, struct file *file,
3038  			const struct open_flags *op,
3039  			int open_flag, umode_t mode,
3040  			int *opened)
3041  {
3042  	struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
3043  	struct inode *dir =  nd->path.dentry->d_inode;
3044  	int error;
3045  
3046  	if (!(~open_flag & (O_EXCL | O_CREAT)))	/* both O_EXCL and O_CREAT */
3047  		open_flag &= ~O_TRUNC;
3048  
3049  	if (nd->flags & LOOKUP_DIRECTORY)
3050  		open_flag |= O_DIRECTORY;
3051  
3052  	file->f_path.dentry = DENTRY_NOT_SET;
3053  	file->f_path.mnt = nd->path.mnt;
3054  	error = dir->i_op->atomic_open(dir, dentry, file,
3055  				       open_to_namei_flags(open_flag),
3056  				       mode, opened);
3057  	d_lookup_done(dentry);
3058  	if (!error) {
3059  		/*
3060  		 * We didn't have the inode before the open, so check open
3061  		 * permission here.
3062  		 */
3063  		int acc_mode = op->acc_mode;
3064  		if (*opened & FILE_CREATED) {
3065  			WARN_ON(!(open_flag & O_CREAT));
3066  			fsnotify_create(dir, dentry);
3067  			acc_mode = 0;
3068  		}
3069  		error = may_open(&file->f_path, acc_mode, open_flag);
3070  		if (WARN_ON(error > 0))
3071  			error = -EINVAL;
3072  	} else if (error > 0) {
3073  		if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
3074  			error = -EIO;
3075  		} else {
3076  			if (file->f_path.dentry) {
3077  				dput(dentry);
3078  				dentry = file->f_path.dentry;
3079  			}
3080  			if (*opened & FILE_CREATED)
3081  				fsnotify_create(dir, dentry);
3082  			if (unlikely(d_is_negative(dentry))) {
3083  				error = -ENOENT;
3084  			} else {
3085  				path->dentry = dentry;
3086  				path->mnt = nd->path.mnt;
3087  				return 1;
3088  			}
3089  		}
3090  	}
3091  	dput(dentry);
3092  	return error;
3093  }
3094  
3095  /*
3096   * Look up and maybe create and open the last component.
3097   *
3098   * Must be called with i_mutex held on parent.
3099   *
3100   * Returns 0 if the file was successfully atomically created (if necessary) and
3101   * opened.  In this case the file will be returned attached to @file.
3102   *
3103   * Returns 1 if the file was not completely opened at this time, though lookups
3104   * and creations will have been performed and the dentry returned in @path will
3105   * be positive upon return if O_CREAT was specified.  If O_CREAT wasn't
3106   * specified then a negative dentry may be returned.
3107   *
3108   * An error code is returned otherwise.
3109   *
3110   * FILE_CREATE will be set in @*opened if the dentry was created and will be
3111   * cleared otherwise prior to returning.
3112   */
3113  static int lookup_open(struct nameidata *nd, struct path *path,
3114  			struct file *file,
3115  			const struct open_flags *op,
3116  			bool got_write, int *opened)
3117  {
3118  	struct dentry *dir = nd->path.dentry;
3119  	struct inode *dir_inode = dir->d_inode;
3120  	int open_flag = op->open_flag;
3121  	struct dentry *dentry;
3122  	int error, create_error = 0;
3123  	umode_t mode = op->mode;
3124  	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
3125  
3126  	if (unlikely(IS_DEADDIR(dir_inode)))
3127  		return -ENOENT;
3128  
3129  	*opened &= ~FILE_CREATED;
3130  	dentry = d_lookup(dir, &nd->last);
3131  	for (;;) {
3132  		if (!dentry) {
3133  			dentry = d_alloc_parallel(dir, &nd->last, &wq);
3134  			if (IS_ERR(dentry))
3135  				return PTR_ERR(dentry);
3136  		}
3137  		if (d_in_lookup(dentry))
3138  			break;
3139  
3140  		error = d_revalidate(dentry, nd->flags);
3141  		if (likely(error > 0))
3142  			break;
3143  		if (error)
3144  			goto out_dput;
3145  		d_invalidate(dentry);
3146  		dput(dentry);
3147  		dentry = NULL;
3148  	}
3149  	if (dentry->d_inode) {
3150  		/* Cached positive dentry: will open in f_op->open */
3151  		goto out_no_open;
3152  	}
3153  
3154  	/*
3155  	 * Checking write permission is tricky, bacuse we don't know if we are
3156  	 * going to actually need it: O_CREAT opens should work as long as the
3157  	 * file exists.  But checking existence breaks atomicity.  The trick is
3158  	 * to check access and if not granted clear O_CREAT from the flags.
3159  	 *
3160  	 * Another problem is returing the "right" error value (e.g. for an
3161  	 * O_EXCL open we want to return EEXIST not EROFS).
3162  	 */
3163  	if (open_flag & O_CREAT) {
3164  		if (!IS_POSIXACL(dir->d_inode))
3165  			mode &= ~current_umask();
3166  		if (unlikely(!got_write)) {
3167  			create_error = -EROFS;
3168  			open_flag &= ~O_CREAT;
3169  			if (open_flag & (O_EXCL | O_TRUNC))
3170  				goto no_open;
3171  			/* No side effects, safe to clear O_CREAT */
3172  		} else {
3173  			create_error = may_o_create(&nd->path, dentry, mode);
3174  			if (create_error) {
3175  				open_flag &= ~O_CREAT;
3176  				if (open_flag & O_EXCL)
3177  					goto no_open;
3178  			}
3179  		}
3180  	} else if ((open_flag & (O_TRUNC|O_WRONLY|O_RDWR)) &&
3181  		   unlikely(!got_write)) {
3182  		/*
3183  		 * No O_CREATE -> atomicity not a requirement -> fall
3184  		 * back to lookup + open
3185  		 */
3186  		goto no_open;
3187  	}
3188  
3189  	if (dir_inode->i_op->atomic_open) {
3190  		error = atomic_open(nd, dentry, path, file, op, open_flag,
3191  				    mode, opened);
3192  		if (unlikely(error == -ENOENT) && create_error)
3193  			error = create_error;
3194  		return error;
3195  	}
3196  
3197  no_open:
3198  	if (d_in_lookup(dentry)) {
3199  		struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry,
3200  							     nd->flags);
3201  		d_lookup_done(dentry);
3202  		if (unlikely(res)) {
3203  			if (IS_ERR(res)) {
3204  				error = PTR_ERR(res);
3205  				goto out_dput;
3206  			}
3207  			dput(dentry);
3208  			dentry = res;
3209  		}
3210  	}
3211  
3212  	/* Negative dentry, just create the file */
3213  	if (!dentry->d_inode && (open_flag & O_CREAT)) {
3214  		*opened |= FILE_CREATED;
3215  		audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
3216  		if (!dir_inode->i_op->create) {
3217  			error = -EACCES;
3218  			goto out_dput;
3219  		}
3220  		error = dir_inode->i_op->create(dir_inode, dentry, mode,
3221  						open_flag & O_EXCL);
3222  		if (error)
3223  			goto out_dput;
3224  		fsnotify_create(dir_inode, dentry);
3225  	}
3226  	if (unlikely(create_error) && !dentry->d_inode) {
3227  		error = create_error;
3228  		goto out_dput;
3229  	}
3230  out_no_open:
3231  	path->dentry = dentry;
3232  	path->mnt = nd->path.mnt;
3233  	return 1;
3234  
3235  out_dput:
3236  	dput(dentry);
3237  	return error;
3238  }
3239  
3240  /*
3241   * Handle the last step of open()
3242   */
3243  static int do_last(struct nameidata *nd,
3244  		   struct file *file, const struct open_flags *op,
3245  		   int *opened)
3246  {
3247  	struct dentry *dir = nd->path.dentry;
3248  	int open_flag = op->open_flag;
3249  	bool will_truncate = (open_flag & O_TRUNC) != 0;
3250  	bool got_write = false;
3251  	int acc_mode = op->acc_mode;
3252  	unsigned seq;
3253  	struct inode *inode;
3254  	struct path path;
3255  	int error;
3256  
3257  	nd->flags &= ~LOOKUP_PARENT;
3258  	nd->flags |= op->intent;
3259  
3260  	if (nd->last_type != LAST_NORM) {
3261  		error = handle_dots(nd, nd->last_type);
3262  		if (unlikely(error))
3263  			return error;
3264  		goto finish_open;
3265  	}
3266  
3267  	if (!(open_flag & O_CREAT)) {
3268  		if (nd->last.name[nd->last.len])
3269  			nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
3270  		/* we _can_ be in RCU mode here */
3271  		error = lookup_fast(nd, &path, &inode, &seq);
3272  		if (likely(error > 0))
3273  			goto finish_lookup;
3274  
3275  		if (error < 0)
3276  			return error;
3277  
3278  		BUG_ON(nd->inode != dir->d_inode);
3279  		BUG_ON(nd->flags & LOOKUP_RCU);
3280  	} else {
3281  		/* create side of things */
3282  		/*
3283  		 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED
3284  		 * has been cleared when we got to the last component we are
3285  		 * about to look up
3286  		 */
3287  		error = complete_walk(nd);
3288  		if (error)
3289  			return error;
3290  
3291  		audit_inode(nd->name, dir, LOOKUP_PARENT);
3292  		/* trailing slashes? */
3293  		if (unlikely(nd->last.name[nd->last.len]))
3294  			return -EISDIR;
3295  	}
3296  
3297  	if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
3298  		error = mnt_want_write(nd->path.mnt);
3299  		if (!error)
3300  			got_write = true;
3301  		/*
3302  		 * do _not_ fail yet - we might not need that or fail with
3303  		 * a different error; let lookup_open() decide; we'll be
3304  		 * dropping this one anyway.
3305  		 */
3306  	}
3307  	if (open_flag & O_CREAT)
3308  		inode_lock(dir->d_inode);
3309  	else
3310  		inode_lock_shared(dir->d_inode);
3311  	error = lookup_open(nd, &path, file, op, got_write, opened);
3312  	if (open_flag & O_CREAT)
3313  		inode_unlock(dir->d_inode);
3314  	else
3315  		inode_unlock_shared(dir->d_inode);
3316  
3317  	if (error <= 0) {
3318  		if (error)
3319  			goto out;
3320  
3321  		if ((*opened & FILE_CREATED) ||
3322  		    !S_ISREG(file_inode(file)->i_mode))
3323  			will_truncate = false;
3324  
3325  		audit_inode(nd->name, file->f_path.dentry, 0);
3326  		goto opened;
3327  	}
3328  
3329  	if (*opened & FILE_CREATED) {
3330  		/* Don't check for write permission, don't truncate */
3331  		open_flag &= ~O_TRUNC;
3332  		will_truncate = false;
3333  		acc_mode = 0;
3334  		path_to_nameidata(&path, nd);
3335  		goto finish_open_created;
3336  	}
3337  
3338  	/*
3339  	 * If atomic_open() acquired write access it is dropped now due to
3340  	 * possible mount and symlink following (this might be optimized away if
3341  	 * necessary...)
3342  	 */
3343  	if (got_write) {
3344  		mnt_drop_write(nd->path.mnt);
3345  		got_write = false;
3346  	}
3347  
3348  	error = follow_managed(&path, nd);
3349  	if (unlikely(error < 0))
3350  		return error;
3351  
3352  	if (unlikely(d_is_negative(path.dentry))) {
3353  		path_to_nameidata(&path, nd);
3354  		return -ENOENT;
3355  	}
3356  
3357  	/*
3358  	 * create/update audit record if it already exists.
3359  	 */
3360  	audit_inode(nd->name, path.dentry, 0);
3361  
3362  	if (unlikely((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))) {
3363  		path_to_nameidata(&path, nd);
3364  		return -EEXIST;
3365  	}
3366  
3367  	seq = 0;	/* out of RCU mode, so the value doesn't matter */
3368  	inode = d_backing_inode(path.dentry);
3369  finish_lookup:
3370  	error = step_into(nd, &path, 0, inode, seq);
3371  	if (unlikely(error))
3372  		return error;
3373  finish_open:
3374  	/* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
3375  	error = complete_walk(nd);
3376  	if (error)
3377  		return error;
3378  	audit_inode(nd->name, nd->path.dentry, 0);
3379  	error = -EISDIR;
3380  	if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry))
3381  		goto out;
3382  	error = -ENOTDIR;
3383  	if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
3384  		goto out;
3385  	if (!d_is_reg(nd->path.dentry))
3386  		will_truncate = false;
3387  
3388  	if (will_truncate) {
3389  		error = mnt_want_write(nd->path.mnt);
3390  		if (error)
3391  			goto out;
3392  		got_write = true;
3393  	}
3394  finish_open_created:
3395  	error = may_open(&nd->path, acc_mode, open_flag);
3396  	if (error)
3397  		goto out;
3398  	BUG_ON(*opened & FILE_OPENED); /* once it's opened, it's opened */
3399  	error = vfs_open(&nd->path, file, current_cred());
3400  	if (error)
3401  		goto out;
3402  	*opened |= FILE_OPENED;
3403  opened:
3404  	error = open_check_o_direct(file);
3405  	if (!error)
3406  		error = ima_file_check(file, op->acc_mode, *opened);
3407  	if (!error && will_truncate)
3408  		error = handle_truncate(file);
3409  out:
3410  	if (unlikely(error) && (*opened & FILE_OPENED))
3411  		fput(file);
3412  	if (unlikely(error > 0)) {
3413  		WARN_ON(1);
3414  		error = -EINVAL;
3415  	}
3416  	if (got_write)
3417  		mnt_drop_write(nd->path.mnt);
3418  	return error;
3419  }
3420  
3421  struct dentry *vfs_tmpfile(struct dentry *dentry, umode_t mode, int open_flag)
3422  {
3423  	struct dentry *child = NULL;
3424  	struct inode *dir = dentry->d_inode;
3425  	struct inode *inode;
3426  	int error;
3427  
3428  	/* we want directory to be writable */
3429  	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
3430  	if (error)
3431  		goto out_err;
3432  	error = -EOPNOTSUPP;
3433  	if (!dir->i_op->tmpfile)
3434  		goto out_err;
3435  	error = -ENOMEM;
3436  	child = d_alloc(dentry, &slash_name);
3437  	if (unlikely(!child))
3438  		goto out_err;
3439  	error = dir->i_op->tmpfile(dir, child, mode);
3440  	if (error)
3441  		goto out_err;
3442  	error = -ENOENT;
3443  	inode = child->d_inode;
3444  	if (unlikely(!inode))
3445  		goto out_err;
3446  	if (!(open_flag & O_EXCL)) {
3447  		spin_lock(&inode->i_lock);
3448  		inode->i_state |= I_LINKABLE;
3449  		spin_unlock(&inode->i_lock);
3450  	}
3451  	return child;
3452  
3453  out_err:
3454  	dput(child);
3455  	return ERR_PTR(error);
3456  }
3457  EXPORT_SYMBOL(vfs_tmpfile);
3458  
3459  static int do_tmpfile(struct nameidata *nd, unsigned flags,
3460  		const struct open_flags *op,
3461  		struct file *file, int *opened)
3462  {
3463  	struct dentry *child;
3464  	struct path path;
3465  	int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
3466  	if (unlikely(error))
3467  		return error;
3468  	error = mnt_want_write(path.mnt);
3469  	if (unlikely(error))
3470  		goto out;
3471  	child = vfs_tmpfile(path.dentry, op->mode, op->open_flag);
3472  	error = PTR_ERR(child);
3473  	if (IS_ERR(child))
3474  		goto out2;
3475  	dput(path.dentry);
3476  	path.dentry = child;
3477  	audit_inode(nd->name, child, 0);
3478  	/* Don't check for other permissions, the inode was just created */
3479  	error = may_open(&path, 0, op->open_flag);
3480  	if (error)
3481  		goto out2;
3482  	file->f_path.mnt = path.mnt;
3483  	error = finish_open(file, child, NULL, opened);
3484  	if (error)
3485  		goto out2;
3486  	error = open_check_o_direct(file);
3487  	if (error)
3488  		fput(file);
3489  out2:
3490  	mnt_drop_write(path.mnt);
3491  out:
3492  	path_put(&path);
3493  	return error;
3494  }
3495  
3496  static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file)
3497  {
3498  	struct path path;
3499  	int error = path_lookupat(nd, flags, &path);
3500  	if (!error) {
3501  		audit_inode(nd->name, path.dentry, 0);
3502  		error = vfs_open(&path, file, current_cred());
3503  		path_put(&path);
3504  	}
3505  	return error;
3506  }
3507  
3508  static struct file *path_openat(struct nameidata *nd,
3509  			const struct open_flags *op, unsigned flags)
3510  {
3511  	const char *s;
3512  	struct file *file;
3513  	int opened = 0;
3514  	int error;
3515  
3516  	file = get_empty_filp();
3517  	if (IS_ERR(file))
3518  		return file;
3519  
3520  	file->f_flags = op->open_flag;
3521  
3522  	if (unlikely(file->f_flags & __O_TMPFILE)) {
3523  		error = do_tmpfile(nd, flags, op, file, &opened);
3524  		goto out2;
3525  	}
3526  
3527  	if (unlikely(file->f_flags & O_PATH)) {
3528  		error = do_o_path(nd, flags, file);
3529  		if (!error)
3530  			opened |= FILE_OPENED;
3531  		goto out2;
3532  	}
3533  
3534  	s = path_init(nd, flags);
3535  	if (IS_ERR(s)) {
3536  		put_filp(file);
3537  		return ERR_CAST(s);
3538  	}
3539  	while (!(error = link_path_walk(s, nd)) &&
3540  		(error = do_last(nd, file, op, &opened)) > 0) {
3541  		nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3542  		s = trailing_symlink(nd);
3543  		if (IS_ERR(s)) {
3544  			error = PTR_ERR(s);
3545  			break;
3546  		}
3547  	}
3548  	terminate_walk(nd);
3549  out2:
3550  	if (!(opened & FILE_OPENED)) {
3551  		BUG_ON(!error);
3552  		put_filp(file);
3553  	}
3554  	if (unlikely(error)) {
3555  		if (error == -EOPENSTALE) {
3556  			if (flags & LOOKUP_RCU)
3557  				error = -ECHILD;
3558  			else
3559  				error = -ESTALE;
3560  		}
3561  		file = ERR_PTR(error);
3562  	}
3563  	return file;
3564  }
3565  
3566  struct file *do_filp_open(int dfd, struct filename *pathname,
3567  		const struct open_flags *op)
3568  {
3569  	struct nameidata nd;
3570  	int flags = op->lookup_flags;
3571  	struct file *filp;
3572  
3573  	set_nameidata(&nd, dfd, pathname);
3574  	filp = path_openat(&nd, op, flags | LOOKUP_RCU);
3575  	if (unlikely(filp == ERR_PTR(-ECHILD)))
3576  		filp = path_openat(&nd, op, flags);
3577  	if (unlikely(filp == ERR_PTR(-ESTALE)))
3578  		filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
3579  	restore_nameidata();
3580  	return filp;
3581  }
3582  
3583  struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
3584  		const char *name, const struct open_flags *op)
3585  {
3586  	struct nameidata nd;
3587  	struct file *file;
3588  	struct filename *filename;
3589  	int flags = op->lookup_flags | LOOKUP_ROOT;
3590  
3591  	nd.root.mnt = mnt;
3592  	nd.root.dentry = dentry;
3593  
3594  	if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN)
3595  		return ERR_PTR(-ELOOP);
3596  
3597  	filename = getname_kernel(name);
3598  	if (IS_ERR(filename))
3599  		return ERR_CAST(filename);
3600  
3601  	set_nameidata(&nd, -1, filename);
3602  	file = path_openat(&nd, op, flags | LOOKUP_RCU);
3603  	if (unlikely(file == ERR_PTR(-ECHILD)))
3604  		file = path_openat(&nd, op, flags);
3605  	if (unlikely(file == ERR_PTR(-ESTALE)))
3606  		file = path_openat(&nd, op, flags | LOOKUP_REVAL);
3607  	restore_nameidata();
3608  	putname(filename);
3609  	return file;
3610  }
3611  
3612  static struct dentry *filename_create(int dfd, struct filename *name,
3613  				struct path *path, unsigned int lookup_flags)
3614  {
3615  	struct dentry *dentry = ERR_PTR(-EEXIST);
3616  	struct qstr last;
3617  	int type;
3618  	int err2;
3619  	int error;
3620  	bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);
3621  
3622  	/*
3623  	 * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any
3624  	 * other flags passed in are ignored!
3625  	 */
3626  	lookup_flags &= LOOKUP_REVAL;
3627  
3628  	name = filename_parentat(dfd, name, lookup_flags, path, &last, &type);
3629  	if (IS_ERR(name))
3630  		return ERR_CAST(name);
3631  
3632  	/*
3633  	 * Yucky last component or no last component at all?
3634  	 * (foo/., foo/.., /////)
3635  	 */
3636  	if (unlikely(type != LAST_NORM))
3637  		goto out;
3638  
3639  	/* don't fail immediately if it's r/o, at least try to report other errors */
3640  	err2 = mnt_want_write(path->mnt);
3641  	/*
3642  	 * Do the final lookup.
3643  	 */
3644  	lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL;
3645  	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
3646  	dentry = __lookup_hash(&last, path->dentry, lookup_flags);
3647  	if (IS_ERR(dentry))
3648  		goto unlock;
3649  
3650  	error = -EEXIST;
3651  	if (d_is_positive(dentry))
3652  		goto fail;
3653  
3654  	/*
3655  	 * Special case - lookup gave negative, but... we had foo/bar/
3656  	 * From the vfs_mknod() POV we just have a negative dentry -
3657  	 * all is fine. Let's be bastards - you had / on the end, you've
3658  	 * been asking for (non-existent) directory. -ENOENT for you.
3659  	 */
3660  	if (unlikely(!is_dir && last.name[last.len])) {
3661  		error = -ENOENT;
3662  		goto fail;
3663  	}
3664  	if (unlikely(err2)) {
3665  		error = err2;
3666  		goto fail;
3667  	}
3668  	putname(name);
3669  	return dentry;
3670  fail:
3671  	dput(dentry);
3672  	dentry = ERR_PTR(error);
3673  unlock:
3674  	inode_unlock(path->dentry->d_inode);
3675  	if (!err2)
3676  		mnt_drop_write(path->mnt);
3677  out:
3678  	path_put(path);
3679  	putname(name);
3680  	return dentry;
3681  }
3682  
3683  struct dentry *kern_path_create(int dfd, const char *pathname,
3684  				struct path *path, unsigned int lookup_flags)
3685  {
3686  	return filename_create(dfd, getname_kernel(pathname),
3687  				path, lookup_flags);
3688  }
3689  EXPORT_SYMBOL(kern_path_create);
3690  
3691  void done_path_create(struct path *path, struct dentry *dentry)
3692  {
3693  	dput(dentry);
3694  	inode_unlock(path->dentry->d_inode);
3695  	mnt_drop_write(path->mnt);
3696  	path_put(path);
3697  }
3698  EXPORT_SYMBOL(done_path_create);
3699  
3700  inline struct dentry *user_path_create(int dfd, const char __user *pathname,
3701  				struct path *path, unsigned int lookup_flags)
3702  {
3703  	return filename_create(dfd, getname(pathname), path, lookup_flags);
3704  }
3705  EXPORT_SYMBOL(user_path_create);
3706  
3707  int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3708  {
3709  	int error = may_create(dir, dentry);
3710  
3711  	if (error)
3712  		return error;
3713  
3714  	if ((S_ISCHR(mode) || S_ISBLK(mode)) &&
3715  	    !ns_capable(dentry->d_sb->s_user_ns, CAP_MKNOD))
3716  		return -EPERM;
3717  
3718  	if (!dir->i_op->mknod)
3719  		return -EPERM;
3720  
3721  	error = devcgroup_inode_mknod(mode, dev);
3722  	if (error)
3723  		return error;
3724  
3725  	error = security_inode_mknod(dir, dentry, mode, dev);
3726  	if (error)
3727  		return error;
3728  
3729  	error = dir->i_op->mknod(dir, dentry, mode, dev);
3730  	if (!error)
3731  		fsnotify_create(dir, dentry);
3732  	return error;
3733  }
3734  EXPORT_SYMBOL(vfs_mknod);
3735  
3736  static int may_mknod(umode_t mode)
3737  {
3738  	switch (mode & S_IFMT) {
3739  	case S_IFREG:
3740  	case S_IFCHR:
3741  	case S_IFBLK:
3742  	case S_IFIFO:
3743  	case S_IFSOCK:
3744  	case 0: /* zero mode translates to S_IFREG */
3745  		return 0;
3746  	case S_IFDIR:
3747  		return -EPERM;
3748  	default:
3749  		return -EINVAL;
3750  	}
3751  }
3752  
3753  long do_mknodat(int dfd, const char __user *filename, umode_t mode,
3754  		unsigned int dev)
3755  {
3756  	struct dentry *dentry;
3757  	struct path path;
3758  	int error;
3759  	unsigned int lookup_flags = 0;
3760  
3761  	error = may_mknod(mode);
3762  	if (error)
3763  		return error;
3764  retry:
3765  	dentry = user_path_create(dfd, filename, &path, lookup_flags);
3766  	if (IS_ERR(dentry))
3767  		return PTR_ERR(dentry);
3768  
3769  	if (!IS_POSIXACL(path.dentry->d_inode))
3770  		mode &= ~current_umask();
3771  	error = security_path_mknod(&path, dentry, mode, dev);
3772  	if (error)
3773  		goto out;
3774  	switch (mode & S_IFMT) {
3775  		case 0: case S_IFREG:
3776  			error = vfs_create(path.dentry->d_inode,dentry,mode,true);
3777  			if (!error)
3778  				ima_post_path_mknod(dentry);
3779  			break;
3780  		case S_IFCHR: case S_IFBLK:
3781  			error = vfs_mknod(path.dentry->d_inode,dentry,mode,
3782  					new_decode_dev(dev));
3783  			break;
3784  		case S_IFIFO: case S_IFSOCK:
3785  			error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
3786  			break;
3787  	}
3788  out:
3789  	done_path_create(&path, dentry);
3790  	if (retry_estale(error, lookup_flags)) {
3791  		lookup_flags |= LOOKUP_REVAL;
3792  		goto retry;
3793  	}
3794  	return error;
3795  }
3796  
3797  SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
3798  		unsigned int, dev)
3799  {
3800  	return do_mknodat(dfd, filename, mode, dev);
3801  }
3802  
3803  SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3804  {
3805  	return do_mknodat(AT_FDCWD, filename, mode, dev);
3806  }
3807  
3808  int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
3809  {
3810  	int error = may_create(dir, dentry);
3811  	unsigned max_links = dir->i_sb->s_max_links;
3812  
3813  	if (error)
3814  		return error;
3815  
3816  	if (!dir->i_op->mkdir)
3817  		return -EPERM;
3818  
3819  	mode &= (S_IRWXUGO|S_ISVTX);
3820  	error = security_inode_mkdir(dir, dentry, mode);
3821  	if (error)
3822  		return error;
3823  
3824  	if (max_links && dir->i_nlink >= max_links)
3825  		return -EMLINK;
3826  
3827  	error = dir->i_op->mkdir(dir, dentry, mode);
3828  	if (!error)
3829  		fsnotify_mkdir(dir, dentry);
3830  	return error;
3831  }
3832  EXPORT_SYMBOL(vfs_mkdir);
3833  
3834  long do_mkdirat(int dfd, const char __user *pathname, umode_t mode)
3835  {
3836  	struct dentry *dentry;
3837  	struct path path;
3838  	int error;
3839  	unsigned int lookup_flags = LOOKUP_DIRECTORY;
3840  
3841  retry:
3842  	dentry = user_path_create(dfd, pathname, &path, lookup_flags);
3843  	if (IS_ERR(dentry))
3844  		return PTR_ERR(dentry);
3845  
3846  	if (!IS_POSIXACL(path.dentry->d_inode))
3847  		mode &= ~current_umask();
3848  	error = security_path_mkdir(&path, dentry, mode);
3849  	if (!error)
3850  		error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
3851  	done_path_create(&path, dentry);
3852  	if (retry_estale(error, lookup_flags)) {
3853  		lookup_flags |= LOOKUP_REVAL;
3854  		goto retry;
3855  	}
3856  	return error;
3857  }
3858  
3859  SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
3860  {
3861  	return do_mkdirat(dfd, pathname, mode);
3862  }
3863  
3864  SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
3865  {
3866  	return do_mkdirat(AT_FDCWD, pathname, mode);
3867  }
3868  
3869  int vfs_rmdir(struct inode *dir, struct dentry *dentry)
3870  {
3871  	int error = may_delete(dir, dentry, 1);
3872  
3873  	if (error)
3874  		return error;
3875  
3876  	if (!dir->i_op->rmdir)
3877  		return -EPERM;
3878  
3879  	dget(dentry);
3880  	inode_lock(dentry->d_inode);
3881  
3882  	error = -EBUSY;
3883  	if (is_local_mountpoint(dentry))
3884  		goto out;
3885  
3886  	error = security_inode_rmdir(dir, dentry);
3887  	if (error)
3888  		goto out;
3889  
3890  	error = dir->i_op->rmdir(dir, dentry);
3891  	if (error)
3892  		goto out;
3893  
3894  	shrink_dcache_parent(dentry);
3895  	dentry->d_inode->i_flags |= S_DEAD;
3896  	dont_mount(dentry);
3897  	detach_mounts(dentry);
3898  
3899  out:
3900  	inode_unlock(dentry->d_inode);
3901  	dput(dentry);
3902  	if (!error)
3903  		d_delete(dentry);
3904  	return error;
3905  }
3906  EXPORT_SYMBOL(vfs_rmdir);
3907  
3908  long do_rmdir(int dfd, const char __user *pathname)
3909  {
3910  	int error = 0;
3911  	struct filename *name;
3912  	struct dentry *dentry;
3913  	struct path path;
3914  	struct qstr last;
3915  	int type;
3916  	unsigned int lookup_flags = 0;
3917  retry:
3918  	name = filename_parentat(dfd, getname(pathname), lookup_flags,
3919  				&path, &last, &type);
3920  	if (IS_ERR(name))
3921  		return PTR_ERR(name);
3922  
3923  	switch (type) {
3924  	case LAST_DOTDOT:
3925  		error = -ENOTEMPTY;
3926  		goto exit1;
3927  	case LAST_DOT:
3928  		error = -EINVAL;
3929  		goto exit1;
3930  	case LAST_ROOT:
3931  		error = -EBUSY;
3932  		goto exit1;
3933  	}
3934  
3935  	error = mnt_want_write(path.mnt);
3936  	if (error)
3937  		goto exit1;
3938  
3939  	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
3940  	dentry = __lookup_hash(&last, path.dentry, lookup_flags);
3941  	error = PTR_ERR(dentry);
3942  	if (IS_ERR(dentry))
3943  		goto exit2;
3944  	if (!dentry->d_inode) {
3945  		error = -ENOENT;
3946  		goto exit3;
3947  	}
3948  	error = security_path_rmdir(&path, dentry);
3949  	if (error)
3950  		goto exit3;
3951  	error = vfs_rmdir(path.dentry->d_inode, dentry);
3952  exit3:
3953  	dput(dentry);
3954  exit2:
3955  	inode_unlock(path.dentry->d_inode);
3956  	mnt_drop_write(path.mnt);
3957  exit1:
3958  	path_put(&path);
3959  	putname(name);
3960  	if (retry_estale(error, lookup_flags)) {
3961  		lookup_flags |= LOOKUP_REVAL;
3962  		goto retry;
3963  	}
3964  	return error;
3965  }
3966  
3967  SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
3968  {
3969  	return do_rmdir(AT_FDCWD, pathname);
3970  }
3971  
3972  /**
3973   * vfs_unlink - unlink a filesystem object
3974   * @dir:	parent directory
3975   * @dentry:	victim
3976   * @delegated_inode: returns victim inode, if the inode is delegated.
3977   *
3978   * The caller must hold dir->i_mutex.
3979   *
3980   * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and
3981   * return a reference to the inode in delegated_inode.  The caller
3982   * should then break the delegation on that inode and retry.  Because
3983   * breaking a delegation may take a long time, the caller should drop
3984   * dir->i_mutex before doing so.
3985   *
3986   * Alternatively, a caller may pass NULL for delegated_inode.  This may
3987   * be appropriate for callers that expect the underlying filesystem not
3988   * to be NFS exported.
3989   */
3990  int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode)
3991  {
3992  	struct inode *target = dentry->d_inode;
3993  	int error = may_delete(dir, dentry, 0);
3994  
3995  	if (error)
3996  		return error;
3997  
3998  	if (!dir->i_op->unlink)
3999  		return -EPERM;
4000  
4001  	inode_lock(target);
4002  	if (is_local_mountpoint(dentry))
4003  		error = -EBUSY;
4004  	else {
4005  		error = security_inode_unlink(dir, dentry);
4006  		if (!error) {
4007  			error = try_break_deleg(target, delegated_inode);
4008  			if (error)
4009  				goto out;
4010  			error = dir->i_op->unlink(dir, dentry);
4011  			if (!error) {
4012  				dont_mount(dentry);
4013  				detach_mounts(dentry);
4014  			}
4015  		}
4016  	}
4017  out:
4018  	inode_unlock(target);
4019  
4020  	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
4021  	if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
4022  		fsnotify_link_count(target);
4023  		d_delete(dentry);
4024  	}
4025  
4026  	return error;
4027  }
4028  EXPORT_SYMBOL(vfs_unlink);
4029  
4030  /*
4031   * Make sure that the actual truncation of the file will occur outside its
4032   * directory's i_mutex.  Truncate can take a long time if there is a lot of
4033   * writeout happening, and we don't want to prevent access to the directory
4034   * while waiting on the I/O.
4035   */
4036  long do_unlinkat(int dfd, struct filename *name)
4037  {
4038  	int error;
4039  	struct dentry *dentry;
4040  	struct path path;
4041  	struct qstr last;
4042  	int type;
4043  	struct inode *inode = NULL;
4044  	struct inode *delegated_inode = NULL;
4045  	unsigned int lookup_flags = 0;
4046  retry:
4047  	name = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4048  	if (IS_ERR(name))
4049  		return PTR_ERR(name);
4050  
4051  	error = -EISDIR;
4052  	if (type != LAST_NORM)
4053  		goto exit1;
4054  
4055  	error = mnt_want_write(path.mnt);
4056  	if (error)
4057  		goto exit1;
4058  retry_deleg:
4059  	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4060  	dentry = __lookup_hash(&last, path.dentry, lookup_flags);
4061  	error = PTR_ERR(dentry);
4062  	if (!IS_ERR(dentry)) {
4063  		/* Why not before? Because we want correct error value */
4064  		if (last.name[last.len])
4065  			goto slashes;
4066  		inode = dentry->d_inode;
4067  		if (d_is_negative(dentry))
4068  			goto slashes;
4069  		ihold(inode);
4070  		error = security_path_unlink(&path, dentry);
4071  		if (error)
4072  			goto exit2;
4073  		error = vfs_unlink(path.dentry->d_inode, dentry, &delegated_inode);
4074  exit2:
4075  		dput(dentry);
4076  	}
4077  	inode_unlock(path.dentry->d_inode);
4078  	if (inode)
4079  		iput(inode);	/* truncate the inode here */
4080  	inode = NULL;
4081  	if (delegated_inode) {
4082  		error = break_deleg_wait(&delegated_inode);
4083  		if (!error)
4084  			goto retry_deleg;
4085  	}
4086  	mnt_drop_write(path.mnt);
4087  exit1:
4088  	path_put(&path);
4089  	if (retry_estale(error, lookup_flags)) {
4090  		lookup_flags |= LOOKUP_REVAL;
4091  		inode = NULL;
4092  		goto retry;
4093  	}
4094  	putname(name);
4095  	return error;
4096  
4097  slashes:
4098  	if (d_is_negative(dentry))
4099  		error = -ENOENT;
4100  	else if (d_is_dir(dentry))
4101  		error = -EISDIR;
4102  	else
4103  		error = -ENOTDIR;
4104  	goto exit2;
4105  }
4106  
4107  SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
4108  {
4109  	if ((flag & ~AT_REMOVEDIR) != 0)
4110  		return -EINVAL;
4111  
4112  	if (flag & AT_REMOVEDIR)
4113  		return do_rmdir(dfd, pathname);
4114  
4115  	return do_unlinkat(dfd, getname(pathname));
4116  }
4117  
4118  SYSCALL_DEFINE1(unlink, const char __user *, pathname)
4119  {
4120  	return do_unlinkat(AT_FDCWD, getname(pathname));
4121  }
4122  
4123  int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
4124  {
4125  	int error = may_create(dir, dentry);
4126  
4127  	if (error)
4128  		return error;
4129  
4130  	if (!dir->i_op->symlink)
4131  		return -EPERM;
4132  
4133  	error = security_inode_symlink(dir, dentry, oldname);
4134  	if (error)
4135  		return error;
4136  
4137  	error = dir->i_op->symlink(dir, dentry, oldname);
4138  	if (!error)
4139  		fsnotify_create(dir, dentry);
4140  	return error;
4141  }
4142  EXPORT_SYMBOL(vfs_symlink);
4143  
4144  long do_symlinkat(const char __user *oldname, int newdfd,
4145  		  const char __user *newname)
4146  {
4147  	int error;
4148  	struct filename *from;
4149  	struct dentry *dentry;
4150  	struct path path;
4151  	unsigned int lookup_flags = 0;
4152  
4153  	from = getname(oldname);
4154  	if (IS_ERR(from))
4155  		return PTR_ERR(from);
4156  retry:
4157  	dentry = user_path_create(newdfd, newname, &path, lookup_flags);
4158  	error = PTR_ERR(dentry);
4159  	if (IS_ERR(dentry))
4160  		goto out_putname;
4161  
4162  	error = security_path_symlink(&path, dentry, from->name);
4163  	if (!error)
4164  		error = vfs_symlink(path.dentry->d_inode, dentry, from->name);
4165  	done_path_create(&path, dentry);
4166  	if (retry_estale(error, lookup_flags)) {
4167  		lookup_flags |= LOOKUP_REVAL;
4168  		goto retry;
4169  	}
4170  out_putname:
4171  	putname(from);
4172  	return error;
4173  }
4174  
4175  SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
4176  		int, newdfd, const char __user *, newname)
4177  {
4178  	return do_symlinkat(oldname, newdfd, newname);
4179  }
4180  
4181  SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
4182  {
4183  	return do_symlinkat(oldname, AT_FDCWD, newname);
4184  }
4185  
4186  /**
4187   * vfs_link - create a new link
4188   * @old_dentry:	object to be linked
4189   * @dir:	new parent
4190   * @new_dentry:	where to create the new link
4191   * @delegated_inode: returns inode needing a delegation break
4192   *
4193   * The caller must hold dir->i_mutex
4194   *
4195   * If vfs_link discovers a delegation on the to-be-linked file in need
4196   * of breaking, it will return -EWOULDBLOCK and return a reference to the
4197   * inode in delegated_inode.  The caller should then break the delegation
4198   * and retry.  Because breaking a delegation may take a long time, the
4199   * caller should drop the i_mutex before doing so.
4200   *
4201   * Alternatively, a caller may pass NULL for delegated_inode.  This may
4202   * be appropriate for callers that expect the underlying filesystem not
4203   * to be NFS exported.
4204   */
4205  int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode)
4206  {
4207  	struct inode *inode = old_dentry->d_inode;
4208  	unsigned max_links = dir->i_sb->s_max_links;
4209  	int error;
4210  
4211  	if (!inode)
4212  		return -ENOENT;
4213  
4214  	error = may_create(dir, new_dentry);
4215  	if (error)
4216  		return error;
4217  
4218  	if (dir->i_sb != inode->i_sb)
4219  		return -EXDEV;
4220  
4221  	/*
4222  	 * A link to an append-only or immutable file cannot be created.
4223  	 */
4224  	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
4225  		return -EPERM;
4226  	/*
4227  	 * Updating the link count will likely cause i_uid and i_gid to
4228  	 * be writen back improperly if their true value is unknown to
4229  	 * the vfs.
4230  	 */
4231  	if (HAS_UNMAPPED_ID(inode))
4232  		return -EPERM;
4233  	if (!dir->i_op->link)
4234  		return -EPERM;
4235  	if (S_ISDIR(inode->i_mode))
4236  		return -EPERM;
4237  
4238  	error = security_inode_link(old_dentry, dir, new_dentry);
4239  	if (error)
4240  		return error;
4241  
4242  	inode_lock(inode);
4243  	/* Make sure we don't allow creating hardlink to an unlinked file */
4244  	if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
4245  		error =  -ENOENT;
4246  	else if (max_links && inode->i_nlink >= max_links)
4247  		error = -EMLINK;
4248  	else {
4249  		error = try_break_deleg(inode, delegated_inode);
4250  		if (!error)
4251  			error = dir->i_op->link(old_dentry, dir, new_dentry);
4252  	}
4253  
4254  	if (!error && (inode->i_state & I_LINKABLE)) {
4255  		spin_lock(&inode->i_lock);
4256  		inode->i_state &= ~I_LINKABLE;
4257  		spin_unlock(&inode->i_lock);
4258  	}
4259  	inode_unlock(inode);
4260  	if (!error)
4261  		fsnotify_link(dir, inode, new_dentry);
4262  	return error;
4263  }
4264  EXPORT_SYMBOL(vfs_link);
4265  
4266  /*
4267   * Hardlinks are often used in delicate situations.  We avoid
4268   * security-related surprises by not following symlinks on the
4269   * newname.  --KAB
4270   *
4271   * We don't follow them on the oldname either to be compatible
4272   * with linux 2.0, and to avoid hard-linking to directories
4273   * and other special files.  --ADM
4274   */
4275  int do_linkat(int olddfd, const char __user *oldname, int newdfd,
4276  	      const char __user *newname, int flags)
4277  {
4278  	struct dentry *new_dentry;
4279  	struct path old_path, new_path;
4280  	struct inode *delegated_inode = NULL;
4281  	int how = 0;
4282  	int error;
4283  
4284  	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
4285  		return -EINVAL;
4286  	/*
4287  	 * To use null names we require CAP_DAC_READ_SEARCH
4288  	 * This ensures that not everyone will be able to create
4289  	 * handlink using the passed filedescriptor.
4290  	 */
4291  	if (flags & AT_EMPTY_PATH) {
4292  		if (!capable(CAP_DAC_READ_SEARCH))
4293  			return -ENOENT;
4294  		how = LOOKUP_EMPTY;
4295  	}
4296  
4297  	if (flags & AT_SYMLINK_FOLLOW)
4298  		how |= LOOKUP_FOLLOW;
4299  retry:
4300  	error = user_path_at(olddfd, oldname, how, &old_path);
4301  	if (error)
4302  		return error;
4303  
4304  	new_dentry = user_path_create(newdfd, newname, &new_path,
4305  					(how & LOOKUP_REVAL));
4306  	error = PTR_ERR(new_dentry);
4307  	if (IS_ERR(new_dentry))
4308  		goto out;
4309  
4310  	error = -EXDEV;
4311  	if (old_path.mnt != new_path.mnt)
4312  		goto out_dput;
4313  	error = may_linkat(&old_path);
4314  	if (unlikely(error))
4315  		goto out_dput;
4316  	error = security_path_link(old_path.dentry, &new_path, new_dentry);
4317  	if (error)
4318  		goto out_dput;
4319  	error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode);
4320  out_dput:
4321  	done_path_create(&new_path, new_dentry);
4322  	if (delegated_inode) {
4323  		error = break_deleg_wait(&delegated_inode);
4324  		if (!error) {
4325  			path_put(&old_path);
4326  			goto retry;
4327  		}
4328  	}
4329  	if (retry_estale(error, how)) {
4330  		path_put(&old_path);
4331  		how |= LOOKUP_REVAL;
4332  		goto retry;
4333  	}
4334  out:
4335  	path_put(&old_path);
4336  
4337  	return error;
4338  }
4339  
4340  SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
4341  		int, newdfd, const char __user *, newname, int, flags)
4342  {
4343  	return do_linkat(olddfd, oldname, newdfd, newname, flags);
4344  }
4345  
4346  SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
4347  {
4348  	return do_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4349  }
4350  
4351  /**
4352   * vfs_rename - rename a filesystem object
4353   * @old_dir:	parent of source
4354   * @old_dentry:	source
4355   * @new_dir:	parent of destination
4356   * @new_dentry:	destination
4357   * @delegated_inode: returns an inode needing a delegation break
4358   * @flags:	rename flags
4359   *
4360   * The caller must hold multiple mutexes--see lock_rename()).
4361   *
4362   * If vfs_rename discovers a delegation in need of breaking at either
4363   * the source or destination, it will return -EWOULDBLOCK and return a
4364   * reference to the inode in delegated_inode.  The caller should then
4365   * break the delegation and retry.  Because breaking a delegation may
4366   * take a long time, the caller should drop all locks before doing
4367   * so.
4368   *
4369   * Alternatively, a caller may pass NULL for delegated_inode.  This may
4370   * be appropriate for callers that expect the underlying filesystem not
4371   * to be NFS exported.
4372   *
4373   * The worst of all namespace operations - renaming directory. "Perverted"
4374   * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
4375   * Problems:
4376   *
4377   *	a) we can get into loop creation.
4378   *	b) race potential - two innocent renames can create a loop together.
4379   *	   That's where 4.4 screws up. Current fix: serialization on
4380   *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
4381   *	   story.
4382   *	c) we have to lock _four_ objects - parents and victim (if it exists),
4383   *	   and source (if it is not a directory).
4384   *	   And that - after we got ->i_mutex on parents (until then we don't know
4385   *	   whether the target exists).  Solution: try to be smart with locking
4386   *	   order for inodes.  We rely on the fact that tree topology may change
4387   *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
4388   *	   move will be locked.  Thus we can rank directories by the tree
4389   *	   (ancestors first) and rank all non-directories after them.
4390   *	   That works since everybody except rename does "lock parent, lookup,
4391   *	   lock child" and rename is under ->s_vfs_rename_mutex.
4392   *	   HOWEVER, it relies on the assumption that any object with ->lookup()
4393   *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
4394   *	   we'd better make sure that there's no link(2) for them.
4395   *	d) conversion from fhandle to dentry may come in the wrong moment - when
4396   *	   we are removing the target. Solution: we will have to grab ->i_mutex
4397   *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
4398   *	   ->i_mutex on parents, which works but leads to some truly excessive
4399   *	   locking].
4400   */
4401  int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
4402  	       struct inode *new_dir, struct dentry *new_dentry,
4403  	       struct inode **delegated_inode, unsigned int flags)
4404  {
4405  	int error;
4406  	bool is_dir = d_is_dir(old_dentry);
4407  	struct inode *source = old_dentry->d_inode;
4408  	struct inode *target = new_dentry->d_inode;
4409  	bool new_is_dir = false;
4410  	unsigned max_links = new_dir->i_sb->s_max_links;
4411  	struct name_snapshot old_name;
4412  
4413  	if (source == target)
4414  		return 0;
4415  
4416  	error = may_delete(old_dir, old_dentry, is_dir);
4417  	if (error)
4418  		return error;
4419  
4420  	if (!target) {
4421  		error = may_create(new_dir, new_dentry);
4422  	} else {
4423  		new_is_dir = d_is_dir(new_dentry);
4424  
4425  		if (!(flags & RENAME_EXCHANGE))
4426  			error = may_delete(new_dir, new_dentry, is_dir);
4427  		else
4428  			error = may_delete(new_dir, new_dentry, new_is_dir);
4429  	}
4430  	if (error)
4431  		return error;
4432  
4433  	if (!old_dir->i_op->rename)
4434  		return -EPERM;
4435  
4436  	/*
4437  	 * If we are going to change the parent - check write permissions,
4438  	 * we'll need to flip '..'.
4439  	 */
4440  	if (new_dir != old_dir) {
4441  		if (is_dir) {
4442  			error = inode_permission(source, MAY_WRITE);
4443  			if (error)
4444  				return error;
4445  		}
4446  		if ((flags & RENAME_EXCHANGE) && new_is_dir) {
4447  			error = inode_permission(target, MAY_WRITE);
4448  			if (error)
4449  				return error;
4450  		}
4451  	}
4452  
4453  	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
4454  				      flags);
4455  	if (error)
4456  		return error;
4457  
4458  	take_dentry_name_snapshot(&old_name, old_dentry);
4459  	dget(new_dentry);
4460  	if (!is_dir || (flags & RENAME_EXCHANGE))
4461  		lock_two_nondirectories(source, target);
4462  	else if (target)
4463  		inode_lock(target);
4464  
4465  	error = -EBUSY;
4466  	if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
4467  		goto out;
4468  
4469  	if (max_links && new_dir != old_dir) {
4470  		error = -EMLINK;
4471  		if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
4472  			goto out;
4473  		if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
4474  		    old_dir->i_nlink >= max_links)
4475  			goto out;
4476  	}
4477  	if (!is_dir) {
4478  		error = try_break_deleg(source, delegated_inode);
4479  		if (error)
4480  			goto out;
4481  	}
4482  	if (target && !new_is_dir) {
4483  		error = try_break_deleg(target, delegated_inode);
4484  		if (error)
4485  			goto out;
4486  	}
4487  	error = old_dir->i_op->rename(old_dir, old_dentry,
4488  				       new_dir, new_dentry, flags);
4489  	if (error)
4490  		goto out;
4491  
4492  	if (!(flags & RENAME_EXCHANGE) && target) {
4493  		if (is_dir) {
4494  			shrink_dcache_parent(new_dentry);
4495  			target->i_flags |= S_DEAD;
4496  		}
4497  		dont_mount(new_dentry);
4498  		detach_mounts(new_dentry);
4499  	}
4500  	if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
4501  		if (!(flags & RENAME_EXCHANGE))
4502  			d_move(old_dentry, new_dentry);
4503  		else
4504  			d_exchange(old_dentry, new_dentry);
4505  	}
4506  out:
4507  	if (!is_dir || (flags & RENAME_EXCHANGE))
4508  		unlock_two_nondirectories(source, target);
4509  	else if (target)
4510  		inode_unlock(target);
4511  	dput(new_dentry);
4512  	if (!error) {
4513  		fsnotify_move(old_dir, new_dir, old_name.name, is_dir,
4514  			      !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
4515  		if (flags & RENAME_EXCHANGE) {
4516  			fsnotify_move(new_dir, old_dir, old_dentry->d_name.name,
4517  				      new_is_dir, NULL, new_dentry);
4518  		}
4519  	}
4520  	release_dentry_name_snapshot(&old_name);
4521  
4522  	return error;
4523  }
4524  EXPORT_SYMBOL(vfs_rename);
4525  
4526  static int do_renameat2(int olddfd, const char __user *oldname, int newdfd,
4527  			const char __user *newname, unsigned int flags)
4528  {
4529  	struct dentry *old_dentry, *new_dentry;
4530  	struct dentry *trap;
4531  	struct path old_path, new_path;
4532  	struct qstr old_last, new_last;
4533  	int old_type, new_type;
4534  	struct inode *delegated_inode = NULL;
4535  	struct filename *from;
4536  	struct filename *to;
4537  	unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
4538  	bool should_retry = false;
4539  	int error;
4540  
4541  	if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
4542  		return -EINVAL;
4543  
4544  	if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
4545  	    (flags & RENAME_EXCHANGE))
4546  		return -EINVAL;
4547  
4548  	if ((flags & RENAME_WHITEOUT) && !capable(CAP_MKNOD))
4549  		return -EPERM;
4550  
4551  	if (flags & RENAME_EXCHANGE)
4552  		target_flags = 0;
4553  
4554  retry:
4555  	from = filename_parentat(olddfd, getname(oldname), lookup_flags,
4556  				&old_path, &old_last, &old_type);
4557  	if (IS_ERR(from)) {
4558  		error = PTR_ERR(from);
4559  		goto exit;
4560  	}
4561  
4562  	to = filename_parentat(newdfd, getname(newname), lookup_flags,
4563  				&new_path, &new_last, &new_type);
4564  	if (IS_ERR(to)) {
4565  		error = PTR_ERR(to);
4566  		goto exit1;
4567  	}
4568  
4569  	error = -EXDEV;
4570  	if (old_path.mnt != new_path.mnt)
4571  		goto exit2;
4572  
4573  	error = -EBUSY;
4574  	if (old_type != LAST_NORM)
4575  		goto exit2;
4576  
4577  	if (flags & RENAME_NOREPLACE)
4578  		error = -EEXIST;
4579  	if (new_type != LAST_NORM)
4580  		goto exit2;
4581  
4582  	error = mnt_want_write(old_path.mnt);
4583  	if (error)
4584  		goto exit2;
4585  
4586  retry_deleg:
4587  	trap = lock_rename(new_path.dentry, old_path.dentry);
4588  
4589  	old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags);
4590  	error = PTR_ERR(old_dentry);
4591  	if (IS_ERR(old_dentry))
4592  		goto exit3;
4593  	/* source must exist */
4594  	error = -ENOENT;
4595  	if (d_is_negative(old_dentry))
4596  		goto exit4;
4597  	new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags);
4598  	error = PTR_ERR(new_dentry);
4599  	if (IS_ERR(new_dentry))
4600  		goto exit4;
4601  	error = -EEXIST;
4602  	if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
4603  		goto exit5;
4604  	if (flags & RENAME_EXCHANGE) {
4605  		error = -ENOENT;
4606  		if (d_is_negative(new_dentry))
4607  			goto exit5;
4608  
4609  		if (!d_is_dir(new_dentry)) {
4610  			error = -ENOTDIR;
4611  			if (new_last.name[new_last.len])
4612  				goto exit5;
4613  		}
4614  	}
4615  	/* unless the source is a directory trailing slashes give -ENOTDIR */
4616  	if (!d_is_dir(old_dentry)) {
4617  		error = -ENOTDIR;
4618  		if (old_last.name[old_last.len])
4619  			goto exit5;
4620  		if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
4621  			goto exit5;
4622  	}
4623  	/* source should not be ancestor of target */
4624  	error = -EINVAL;
4625  	if (old_dentry == trap)
4626  		goto exit5;
4627  	/* target should not be an ancestor of source */
4628  	if (!(flags & RENAME_EXCHANGE))
4629  		error = -ENOTEMPTY;
4630  	if (new_dentry == trap)
4631  		goto exit5;
4632  
4633  	error = security_path_rename(&old_path, old_dentry,
4634  				     &new_path, new_dentry, flags);
4635  	if (error)
4636  		goto exit5;
4637  	error = vfs_rename(old_path.dentry->d_inode, old_dentry,
4638  			   new_path.dentry->d_inode, new_dentry,
4639  			   &delegated_inode, flags);
4640  exit5:
4641  	dput(new_dentry);
4642  exit4:
4643  	dput(old_dentry);
4644  exit3:
4645  	unlock_rename(new_path.dentry, old_path.dentry);
4646  	if (delegated_inode) {
4647  		error = break_deleg_wait(&delegated_inode);
4648  		if (!error)
4649  			goto retry_deleg;
4650  	}
4651  	mnt_drop_write(old_path.mnt);
4652  exit2:
4653  	if (retry_estale(error, lookup_flags))
4654  		should_retry = true;
4655  	path_put(&new_path);
4656  	putname(to);
4657  exit1:
4658  	path_put(&old_path);
4659  	putname(from);
4660  	if (should_retry) {
4661  		should_retry = false;
4662  		lookup_flags |= LOOKUP_REVAL;
4663  		goto retry;
4664  	}
4665  exit:
4666  	return error;
4667  }
4668  
4669  SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
4670  		int, newdfd, const char __user *, newname, unsigned int, flags)
4671  {
4672  	return do_renameat2(olddfd, oldname, newdfd, newname, flags);
4673  }
4674  
4675  SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
4676  		int, newdfd, const char __user *, newname)
4677  {
4678  	return do_renameat2(olddfd, oldname, newdfd, newname, 0);
4679  }
4680  
4681  SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
4682  {
4683  	return do_renameat2(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4684  }
4685  
4686  int vfs_whiteout(struct inode *dir, struct dentry *dentry)
4687  {
4688  	int error = may_create(dir, dentry);
4689  	if (error)
4690  		return error;
4691  
4692  	if (!dir->i_op->mknod)
4693  		return -EPERM;
4694  
4695  	return dir->i_op->mknod(dir, dentry,
4696  				S_IFCHR | WHITEOUT_MODE, WHITEOUT_DEV);
4697  }
4698  EXPORT_SYMBOL(vfs_whiteout);
4699  
4700  int readlink_copy(char __user *buffer, int buflen, const char *link)
4701  {
4702  	int len = PTR_ERR(link);
4703  	if (IS_ERR(link))
4704  		goto out;
4705  
4706  	len = strlen(link);
4707  	if (len > (unsigned) buflen)
4708  		len = buflen;
4709  	if (copy_to_user(buffer, link, len))
4710  		len = -EFAULT;
4711  out:
4712  	return len;
4713  }
4714  
4715  /*
4716   * A helper for ->readlink().  This should be used *ONLY* for symlinks that
4717   * have ->get_link() not calling nd_jump_link().  Using (or not using) it
4718   * for any given inode is up to filesystem.
4719   */
4720  static int generic_readlink(struct dentry *dentry, char __user *buffer,
4721  			    int buflen)
4722  {
4723  	DEFINE_DELAYED_CALL(done);
4724  	struct inode *inode = d_inode(dentry);
4725  	const char *link = inode->i_link;
4726  	int res;
4727  
4728  	if (!link) {
4729  		link = inode->i_op->get_link(dentry, inode, &done);
4730  		if (IS_ERR(link))
4731  			return PTR_ERR(link);
4732  	}
4733  	res = readlink_copy(buffer, buflen, link);
4734  	do_delayed_call(&done);
4735  	return res;
4736  }
4737  
4738  /**
4739   * vfs_readlink - copy symlink body into userspace buffer
4740   * @dentry: dentry on which to get symbolic link
4741   * @buffer: user memory pointer
4742   * @buflen: size of buffer
4743   *
4744   * Does not touch atime.  That's up to the caller if necessary
4745   *
4746   * Does not call security hook.
4747   */
4748  int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4749  {
4750  	struct inode *inode = d_inode(dentry);
4751  
4752  	if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) {
4753  		if (unlikely(inode->i_op->readlink))
4754  			return inode->i_op->readlink(dentry, buffer, buflen);
4755  
4756  		if (!d_is_symlink(dentry))
4757  			return -EINVAL;
4758  
4759  		spin_lock(&inode->i_lock);
4760  		inode->i_opflags |= IOP_DEFAULT_READLINK;
4761  		spin_unlock(&inode->i_lock);
4762  	}
4763  
4764  	return generic_readlink(dentry, buffer, buflen);
4765  }
4766  EXPORT_SYMBOL(vfs_readlink);
4767  
4768  /**
4769   * vfs_get_link - get symlink body
4770   * @dentry: dentry on which to get symbolic link
4771   * @done: caller needs to free returned data with this
4772   *
4773   * Calls security hook and i_op->get_link() on the supplied inode.
4774   *
4775   * It does not touch atime.  That's up to the caller if necessary.
4776   *
4777   * Does not work on "special" symlinks like /proc/$$/fd/N
4778   */
4779  const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
4780  {
4781  	const char *res = ERR_PTR(-EINVAL);
4782  	struct inode *inode = d_inode(dentry);
4783  
4784  	if (d_is_symlink(dentry)) {
4785  		res = ERR_PTR(security_inode_readlink(dentry));
4786  		if (!res)
4787  			res = inode->i_op->get_link(dentry, inode, done);
4788  	}
4789  	return res;
4790  }
4791  EXPORT_SYMBOL(vfs_get_link);
4792  
4793  /* get the link contents into pagecache */
4794  const char *page_get_link(struct dentry *dentry, struct inode *inode,
4795  			  struct delayed_call *callback)
4796  {
4797  	char *kaddr;
4798  	struct page *page;
4799  	struct address_space *mapping = inode->i_mapping;
4800  
4801  	if (!dentry) {
4802  		page = find_get_page(mapping, 0);
4803  		if (!page)
4804  			return ERR_PTR(-ECHILD);
4805  		if (!PageUptodate(page)) {
4806  			put_page(page);
4807  			return ERR_PTR(-ECHILD);
4808  		}
4809  	} else {
4810  		page = read_mapping_page(mapping, 0, NULL);
4811  		if (IS_ERR(page))
4812  			return (char*)page;
4813  	}
4814  	set_delayed_call(callback, page_put_link, page);
4815  	BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
4816  	kaddr = page_address(page);
4817  	nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
4818  	return kaddr;
4819  }
4820  
4821  EXPORT_SYMBOL(page_get_link);
4822  
4823  void page_put_link(void *arg)
4824  {
4825  	put_page(arg);
4826  }
4827  EXPORT_SYMBOL(page_put_link);
4828  
4829  int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4830  {
4831  	DEFINE_DELAYED_CALL(done);
4832  	int res = readlink_copy(buffer, buflen,
4833  				page_get_link(dentry, d_inode(dentry),
4834  					      &done));
4835  	do_delayed_call(&done);
4836  	return res;
4837  }
4838  EXPORT_SYMBOL(page_readlink);
4839  
4840  /*
4841   * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
4842   */
4843  int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
4844  {
4845  	struct address_space *mapping = inode->i_mapping;
4846  	struct page *page;
4847  	void *fsdata;
4848  	int err;
4849  	unsigned int flags = 0;
4850  	if (nofs)
4851  		flags |= AOP_FLAG_NOFS;
4852  
4853  retry:
4854  	err = pagecache_write_begin(NULL, mapping, 0, len-1,
4855  				flags, &page, &fsdata);
4856  	if (err)
4857  		goto fail;
4858  
4859  	memcpy(page_address(page), symname, len-1);
4860  
4861  	err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
4862  							page, fsdata);
4863  	if (err < 0)
4864  		goto fail;
4865  	if (err < len-1)
4866  		goto retry;
4867  
4868  	mark_inode_dirty(inode);
4869  	return 0;
4870  fail:
4871  	return err;
4872  }
4873  EXPORT_SYMBOL(__page_symlink);
4874  
4875  int page_symlink(struct inode *inode, const char *symname, int len)
4876  {
4877  	return __page_symlink(inode, symname, len,
4878  			!mapping_gfp_constraint(inode->i_mapping, __GFP_FS));
4879  }
4880  EXPORT_SYMBOL(page_symlink);
4881  
4882  const struct inode_operations page_symlink_inode_operations = {
4883  	.get_link	= page_get_link,
4884  };
4885  EXPORT_SYMBOL(page_symlink_inode_operations);
4886