1 /* 2 * linux/fs/namei.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * Some corrections by tytso. 9 */ 10 11 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname 12 * lookup logic. 13 */ 14 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture. 15 */ 16 17 #include <linux/init.h> 18 #include <linux/export.h> 19 #include <linux/kernel.h> 20 #include <linux/slab.h> 21 #include <linux/fs.h> 22 #include <linux/namei.h> 23 #include <linux/pagemap.h> 24 #include <linux/fsnotify.h> 25 #include <linux/personality.h> 26 #include <linux/security.h> 27 #include <linux/ima.h> 28 #include <linux/syscalls.h> 29 #include <linux/mount.h> 30 #include <linux/audit.h> 31 #include <linux/capability.h> 32 #include <linux/file.h> 33 #include <linux/fcntl.h> 34 #include <linux/device_cgroup.h> 35 #include <linux/fs_struct.h> 36 #include <linux/posix_acl.h> 37 #include <asm/uaccess.h> 38 39 #include "internal.h" 40 #include "mount.h" 41 42 /* [Feb-1997 T. Schoebel-Theuer] 43 * Fundamental changes in the pathname lookup mechanisms (namei) 44 * were necessary because of omirr. The reason is that omirr needs 45 * to know the _real_ pathname, not the user-supplied one, in case 46 * of symlinks (and also when transname replacements occur). 47 * 48 * The new code replaces the old recursive symlink resolution with 49 * an iterative one (in case of non-nested symlink chains). It does 50 * this with calls to <fs>_follow_link(). 51 * As a side effect, dir_namei(), _namei() and follow_link() are now 52 * replaced with a single function lookup_dentry() that can handle all 53 * the special cases of the former code. 54 * 55 * With the new dcache, the pathname is stored at each inode, at least as 56 * long as the refcount of the inode is positive. As a side effect, the 57 * size of the dcache depends on the inode cache and thus is dynamic. 58 * 59 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink 60 * resolution to correspond with current state of the code. 61 * 62 * Note that the symlink resolution is not *completely* iterative. 63 * There is still a significant amount of tail- and mid- recursion in 64 * the algorithm. Also, note that <fs>_readlink() is not used in 65 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink() 66 * may return different results than <fs>_follow_link(). Many virtual 67 * filesystems (including /proc) exhibit this behavior. 68 */ 69 70 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation: 71 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL 72 * and the name already exists in form of a symlink, try to create the new 73 * name indicated by the symlink. The old code always complained that the 74 * name already exists, due to not following the symlink even if its target 75 * is nonexistent. The new semantics affects also mknod() and link() when 76 * the name is a symlink pointing to a non-existent name. 77 * 78 * I don't know which semantics is the right one, since I have no access 79 * to standards. But I found by trial that HP-UX 9.0 has the full "new" 80 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the 81 * "old" one. Personally, I think the new semantics is much more logical. 82 * Note that "ln old new" where "new" is a symlink pointing to a non-existing 83 * file does succeed in both HP-UX and SunOs, but not in Solaris 84 * and in the old Linux semantics. 85 */ 86 87 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink 88 * semantics. See the comments in "open_namei" and "do_link" below. 89 * 90 * [10-Sep-98 Alan Modra] Another symlink change. 91 */ 92 93 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks: 94 * inside the path - always follow. 95 * in the last component in creation/removal/renaming - never follow. 96 * if LOOKUP_FOLLOW passed - follow. 97 * if the pathname has trailing slashes - follow. 98 * otherwise - don't follow. 99 * (applied in that order). 100 * 101 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT 102 * restored for 2.4. This is the last surviving part of old 4.2BSD bug. 103 * During the 2.4 we need to fix the userland stuff depending on it - 104 * hopefully we will be able to get rid of that wart in 2.5. So far only 105 * XEmacs seems to be relying on it... 106 */ 107 /* 108 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland) 109 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives 110 * any extra contention... 111 */ 112 113 /* In order to reduce some races, while at the same time doing additional 114 * checking and hopefully speeding things up, we copy filenames to the 115 * kernel data space before using them.. 116 * 117 * POSIX.1 2.4: an empty pathname is invalid (ENOENT). 118 * PATH_MAX includes the nul terminator --RR. 119 */ 120 void final_putname(struct filename *name) 121 { 122 if (name->separate) { 123 __putname(name->name); 124 kfree(name); 125 } else { 126 __putname(name); 127 } 128 } 129 130 #define EMBEDDED_NAME_MAX (PATH_MAX - sizeof(struct filename)) 131 132 static struct filename * 133 getname_flags(const char __user *filename, int flags, int *empty) 134 { 135 struct filename *result, *err; 136 int len; 137 long max; 138 char *kname; 139 140 result = audit_reusename(filename); 141 if (result) 142 return result; 143 144 result = __getname(); 145 if (unlikely(!result)) 146 return ERR_PTR(-ENOMEM); 147 148 /* 149 * First, try to embed the struct filename inside the names_cache 150 * allocation 151 */ 152 kname = (char *)result + sizeof(*result); 153 result->name = kname; 154 result->separate = false; 155 max = EMBEDDED_NAME_MAX; 156 157 recopy: 158 len = strncpy_from_user(kname, filename, max); 159 if (unlikely(len < 0)) { 160 err = ERR_PTR(len); 161 goto error; 162 } 163 164 /* 165 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a 166 * separate struct filename so we can dedicate the entire 167 * names_cache allocation for the pathname, and re-do the copy from 168 * userland. 169 */ 170 if (len == EMBEDDED_NAME_MAX && max == EMBEDDED_NAME_MAX) { 171 kname = (char *)result; 172 173 result = kzalloc(sizeof(*result), GFP_KERNEL); 174 if (!result) { 175 err = ERR_PTR(-ENOMEM); 176 result = (struct filename *)kname; 177 goto error; 178 } 179 result->name = kname; 180 result->separate = true; 181 max = PATH_MAX; 182 goto recopy; 183 } 184 185 /* The empty path is special. */ 186 if (unlikely(!len)) { 187 if (empty) 188 *empty = 1; 189 err = ERR_PTR(-ENOENT); 190 if (!(flags & LOOKUP_EMPTY)) 191 goto error; 192 } 193 194 err = ERR_PTR(-ENAMETOOLONG); 195 if (unlikely(len >= PATH_MAX)) 196 goto error; 197 198 result->uptr = filename; 199 result->aname = NULL; 200 audit_getname(result); 201 return result; 202 203 error: 204 final_putname(result); 205 return err; 206 } 207 208 struct filename * 209 getname(const char __user * filename) 210 { 211 return getname_flags(filename, 0, NULL); 212 } 213 214 /* 215 * The "getname_kernel()" interface doesn't do pathnames longer 216 * than EMBEDDED_NAME_MAX. Deal with it - you're a kernel user. 217 */ 218 struct filename * 219 getname_kernel(const char * filename) 220 { 221 struct filename *result; 222 char *kname; 223 int len; 224 225 len = strlen(filename); 226 if (len >= EMBEDDED_NAME_MAX) 227 return ERR_PTR(-ENAMETOOLONG); 228 229 result = __getname(); 230 if (unlikely(!result)) 231 return ERR_PTR(-ENOMEM); 232 233 kname = (char *)result + sizeof(*result); 234 result->name = kname; 235 result->uptr = NULL; 236 result->aname = NULL; 237 result->separate = false; 238 239 strlcpy(kname, filename, EMBEDDED_NAME_MAX); 240 return result; 241 } 242 243 #ifdef CONFIG_AUDITSYSCALL 244 void putname(struct filename *name) 245 { 246 if (unlikely(!audit_dummy_context())) 247 return audit_putname(name); 248 final_putname(name); 249 } 250 #endif 251 252 static int check_acl(struct inode *inode, int mask) 253 { 254 #ifdef CONFIG_FS_POSIX_ACL 255 struct posix_acl *acl; 256 257 if (mask & MAY_NOT_BLOCK) { 258 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS); 259 if (!acl) 260 return -EAGAIN; 261 /* no ->get_acl() calls in RCU mode... */ 262 if (acl == ACL_NOT_CACHED) 263 return -ECHILD; 264 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK); 265 } 266 267 acl = get_acl(inode, ACL_TYPE_ACCESS); 268 if (IS_ERR(acl)) 269 return PTR_ERR(acl); 270 if (acl) { 271 int error = posix_acl_permission(inode, acl, mask); 272 posix_acl_release(acl); 273 return error; 274 } 275 #endif 276 277 return -EAGAIN; 278 } 279 280 /* 281 * This does the basic permission checking 282 */ 283 static int acl_permission_check(struct inode *inode, int mask) 284 { 285 unsigned int mode = inode->i_mode; 286 287 if (likely(uid_eq(current_fsuid(), inode->i_uid))) 288 mode >>= 6; 289 else { 290 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { 291 int error = check_acl(inode, mask); 292 if (error != -EAGAIN) 293 return error; 294 } 295 296 if (in_group_p(inode->i_gid)) 297 mode >>= 3; 298 } 299 300 /* 301 * If the DACs are ok we don't need any capability check. 302 */ 303 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0) 304 return 0; 305 return -EACCES; 306 } 307 308 /** 309 * generic_permission - check for access rights on a Posix-like filesystem 310 * @inode: inode to check access rights for 311 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...) 312 * 313 * Used to check for read/write/execute permissions on a file. 314 * We use "fsuid" for this, letting us set arbitrary permissions 315 * for filesystem access without changing the "normal" uids which 316 * are used for other things. 317 * 318 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk 319 * request cannot be satisfied (eg. requires blocking or too much complexity). 320 * It would then be called again in ref-walk mode. 321 */ 322 int generic_permission(struct inode *inode, int mask) 323 { 324 int ret; 325 326 /* 327 * Do the basic permission checks. 328 */ 329 ret = acl_permission_check(inode, mask); 330 if (ret != -EACCES) 331 return ret; 332 333 if (S_ISDIR(inode->i_mode)) { 334 /* DACs are overridable for directories */ 335 if (inode_capable(inode, CAP_DAC_OVERRIDE)) 336 return 0; 337 if (!(mask & MAY_WRITE)) 338 if (inode_capable(inode, CAP_DAC_READ_SEARCH)) 339 return 0; 340 return -EACCES; 341 } 342 /* 343 * Read/write DACs are always overridable. 344 * Executable DACs are overridable when there is 345 * at least one exec bit set. 346 */ 347 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 348 if (inode_capable(inode, CAP_DAC_OVERRIDE)) 349 return 0; 350 351 /* 352 * Searching includes executable on directories, else just read. 353 */ 354 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 355 if (mask == MAY_READ) 356 if (inode_capable(inode, CAP_DAC_READ_SEARCH)) 357 return 0; 358 359 return -EACCES; 360 } 361 362 /* 363 * We _really_ want to just do "generic_permission()" without 364 * even looking at the inode->i_op values. So we keep a cache 365 * flag in inode->i_opflags, that says "this has not special 366 * permission function, use the fast case". 367 */ 368 static inline int do_inode_permission(struct inode *inode, int mask) 369 { 370 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) { 371 if (likely(inode->i_op->permission)) 372 return inode->i_op->permission(inode, mask); 373 374 /* This gets set once for the inode lifetime */ 375 spin_lock(&inode->i_lock); 376 inode->i_opflags |= IOP_FASTPERM; 377 spin_unlock(&inode->i_lock); 378 } 379 return generic_permission(inode, mask); 380 } 381 382 /** 383 * __inode_permission - Check for access rights to a given inode 384 * @inode: Inode to check permission on 385 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 386 * 387 * Check for read/write/execute permissions on an inode. 388 * 389 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 390 * 391 * This does not check for a read-only file system. You probably want 392 * inode_permission(). 393 */ 394 int __inode_permission(struct inode *inode, int mask) 395 { 396 int retval; 397 398 if (unlikely(mask & MAY_WRITE)) { 399 /* 400 * Nobody gets write access to an immutable file. 401 */ 402 if (IS_IMMUTABLE(inode)) 403 return -EACCES; 404 } 405 406 retval = do_inode_permission(inode, mask); 407 if (retval) 408 return retval; 409 410 retval = devcgroup_inode_permission(inode, mask); 411 if (retval) 412 return retval; 413 414 return security_inode_permission(inode, mask); 415 } 416 417 /** 418 * sb_permission - Check superblock-level permissions 419 * @sb: Superblock of inode to check permission on 420 * @inode: Inode to check permission on 421 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 422 * 423 * Separate out file-system wide checks from inode-specific permission checks. 424 */ 425 static int sb_permission(struct super_block *sb, struct inode *inode, int mask) 426 { 427 if (unlikely(mask & MAY_WRITE)) { 428 umode_t mode = inode->i_mode; 429 430 /* Nobody gets write access to a read-only fs. */ 431 if ((sb->s_flags & MS_RDONLY) && 432 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) 433 return -EROFS; 434 } 435 return 0; 436 } 437 438 /** 439 * inode_permission - Check for access rights to a given inode 440 * @inode: Inode to check permission on 441 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC) 442 * 443 * Check for read/write/execute permissions on an inode. We use fs[ug]id for 444 * this, letting us set arbitrary permissions for filesystem access without 445 * changing the "normal" UIDs which are used for other things. 446 * 447 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask. 448 */ 449 int inode_permission(struct inode *inode, int mask) 450 { 451 int retval; 452 453 retval = sb_permission(inode->i_sb, inode, mask); 454 if (retval) 455 return retval; 456 return __inode_permission(inode, mask); 457 } 458 459 /** 460 * path_get - get a reference to a path 461 * @path: path to get the reference to 462 * 463 * Given a path increment the reference count to the dentry and the vfsmount. 464 */ 465 void path_get(const struct path *path) 466 { 467 mntget(path->mnt); 468 dget(path->dentry); 469 } 470 EXPORT_SYMBOL(path_get); 471 472 /** 473 * path_put - put a reference to a path 474 * @path: path to put the reference to 475 * 476 * Given a path decrement the reference count to the dentry and the vfsmount. 477 */ 478 void path_put(const struct path *path) 479 { 480 dput(path->dentry); 481 mntput(path->mnt); 482 } 483 EXPORT_SYMBOL(path_put); 484 485 /* 486 * Path walking has 2 modes, rcu-walk and ref-walk (see 487 * Documentation/filesystems/path-lookup.txt). In situations when we can't 488 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab 489 * normal reference counts on dentries and vfsmounts to transition to rcu-walk 490 * mode. Refcounts are grabbed at the last known good point before rcu-walk 491 * got stuck, so ref-walk may continue from there. If this is not successful 492 * (eg. a seqcount has changed), then failure is returned and it's up to caller 493 * to restart the path walk from the beginning in ref-walk mode. 494 */ 495 496 /** 497 * unlazy_walk - try to switch to ref-walk mode. 498 * @nd: nameidata pathwalk data 499 * @dentry: child of nd->path.dentry or NULL 500 * Returns: 0 on success, -ECHILD on failure 501 * 502 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry 503 * for ref-walk mode. @dentry must be a path found by a do_lookup call on 504 * @nd or NULL. Must be called from rcu-walk context. 505 */ 506 static int unlazy_walk(struct nameidata *nd, struct dentry *dentry) 507 { 508 struct fs_struct *fs = current->fs; 509 struct dentry *parent = nd->path.dentry; 510 511 BUG_ON(!(nd->flags & LOOKUP_RCU)); 512 513 /* 514 * After legitimizing the bastards, terminate_walk() 515 * will do the right thing for non-RCU mode, and all our 516 * subsequent exit cases should rcu_read_unlock() 517 * before returning. Do vfsmount first; if dentry 518 * can't be legitimized, just set nd->path.dentry to NULL 519 * and rely on dput(NULL) being a no-op. 520 */ 521 if (!legitimize_mnt(nd->path.mnt, nd->m_seq)) 522 return -ECHILD; 523 nd->flags &= ~LOOKUP_RCU; 524 525 if (!lockref_get_not_dead(&parent->d_lockref)) { 526 nd->path.dentry = NULL; 527 goto out; 528 } 529 530 /* 531 * For a negative lookup, the lookup sequence point is the parents 532 * sequence point, and it only needs to revalidate the parent dentry. 533 * 534 * For a positive lookup, we need to move both the parent and the 535 * dentry from the RCU domain to be properly refcounted. And the 536 * sequence number in the dentry validates *both* dentry counters, 537 * since we checked the sequence number of the parent after we got 538 * the child sequence number. So we know the parent must still 539 * be valid if the child sequence number is still valid. 540 */ 541 if (!dentry) { 542 if (read_seqcount_retry(&parent->d_seq, nd->seq)) 543 goto out; 544 BUG_ON(nd->inode != parent->d_inode); 545 } else { 546 if (!lockref_get_not_dead(&dentry->d_lockref)) 547 goto out; 548 if (read_seqcount_retry(&dentry->d_seq, nd->seq)) 549 goto drop_dentry; 550 } 551 552 /* 553 * Sequence counts matched. Now make sure that the root is 554 * still valid and get it if required. 555 */ 556 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 557 spin_lock(&fs->lock); 558 if (nd->root.mnt != fs->root.mnt || nd->root.dentry != fs->root.dentry) 559 goto unlock_and_drop_dentry; 560 path_get(&nd->root); 561 spin_unlock(&fs->lock); 562 } 563 564 rcu_read_unlock(); 565 return 0; 566 567 unlock_and_drop_dentry: 568 spin_unlock(&fs->lock); 569 drop_dentry: 570 rcu_read_unlock(); 571 dput(dentry); 572 goto drop_root_mnt; 573 out: 574 rcu_read_unlock(); 575 drop_root_mnt: 576 if (!(nd->flags & LOOKUP_ROOT)) 577 nd->root.mnt = NULL; 578 return -ECHILD; 579 } 580 581 static inline int d_revalidate(struct dentry *dentry, unsigned int flags) 582 { 583 return dentry->d_op->d_revalidate(dentry, flags); 584 } 585 586 /** 587 * complete_walk - successful completion of path walk 588 * @nd: pointer nameidata 589 * 590 * If we had been in RCU mode, drop out of it and legitimize nd->path. 591 * Revalidate the final result, unless we'd already done that during 592 * the path walk or the filesystem doesn't ask for it. Return 0 on 593 * success, -error on failure. In case of failure caller does not 594 * need to drop nd->path. 595 */ 596 static int complete_walk(struct nameidata *nd) 597 { 598 struct dentry *dentry = nd->path.dentry; 599 int status; 600 601 if (nd->flags & LOOKUP_RCU) { 602 nd->flags &= ~LOOKUP_RCU; 603 if (!(nd->flags & LOOKUP_ROOT)) 604 nd->root.mnt = NULL; 605 606 if (!legitimize_mnt(nd->path.mnt, nd->m_seq)) { 607 rcu_read_unlock(); 608 return -ECHILD; 609 } 610 if (unlikely(!lockref_get_not_dead(&dentry->d_lockref))) { 611 rcu_read_unlock(); 612 mntput(nd->path.mnt); 613 return -ECHILD; 614 } 615 if (read_seqcount_retry(&dentry->d_seq, nd->seq)) { 616 rcu_read_unlock(); 617 dput(dentry); 618 mntput(nd->path.mnt); 619 return -ECHILD; 620 } 621 rcu_read_unlock(); 622 } 623 624 if (likely(!(nd->flags & LOOKUP_JUMPED))) 625 return 0; 626 627 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE))) 628 return 0; 629 630 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags); 631 if (status > 0) 632 return 0; 633 634 if (!status) 635 status = -ESTALE; 636 637 path_put(&nd->path); 638 return status; 639 } 640 641 static __always_inline void set_root(struct nameidata *nd) 642 { 643 if (!nd->root.mnt) 644 get_fs_root(current->fs, &nd->root); 645 } 646 647 static int link_path_walk(const char *, struct nameidata *); 648 649 static __always_inline void set_root_rcu(struct nameidata *nd) 650 { 651 if (!nd->root.mnt) { 652 struct fs_struct *fs = current->fs; 653 unsigned seq; 654 655 do { 656 seq = read_seqcount_begin(&fs->seq); 657 nd->root = fs->root; 658 nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq); 659 } while (read_seqcount_retry(&fs->seq, seq)); 660 } 661 } 662 663 static void path_put_conditional(struct path *path, struct nameidata *nd) 664 { 665 dput(path->dentry); 666 if (path->mnt != nd->path.mnt) 667 mntput(path->mnt); 668 } 669 670 static inline void path_to_nameidata(const struct path *path, 671 struct nameidata *nd) 672 { 673 if (!(nd->flags & LOOKUP_RCU)) { 674 dput(nd->path.dentry); 675 if (nd->path.mnt != path->mnt) 676 mntput(nd->path.mnt); 677 } 678 nd->path.mnt = path->mnt; 679 nd->path.dentry = path->dentry; 680 } 681 682 /* 683 * Helper to directly jump to a known parsed path from ->follow_link, 684 * caller must have taken a reference to path beforehand. 685 */ 686 void nd_jump_link(struct nameidata *nd, struct path *path) 687 { 688 path_put(&nd->path); 689 690 nd->path = *path; 691 nd->inode = nd->path.dentry->d_inode; 692 nd->flags |= LOOKUP_JUMPED; 693 } 694 695 static inline void put_link(struct nameidata *nd, struct path *link, void *cookie) 696 { 697 struct inode *inode = link->dentry->d_inode; 698 if (inode->i_op->put_link) 699 inode->i_op->put_link(link->dentry, nd, cookie); 700 path_put(link); 701 } 702 703 int sysctl_protected_symlinks __read_mostly = 0; 704 int sysctl_protected_hardlinks __read_mostly = 0; 705 706 /** 707 * may_follow_link - Check symlink following for unsafe situations 708 * @link: The path of the symlink 709 * @nd: nameidata pathwalk data 710 * 711 * In the case of the sysctl_protected_symlinks sysctl being enabled, 712 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is 713 * in a sticky world-writable directory. This is to protect privileged 714 * processes from failing races against path names that may change out 715 * from under them by way of other users creating malicious symlinks. 716 * It will permit symlinks to be followed only when outside a sticky 717 * world-writable directory, or when the uid of the symlink and follower 718 * match, or when the directory owner matches the symlink's owner. 719 * 720 * Returns 0 if following the symlink is allowed, -ve on error. 721 */ 722 static inline int may_follow_link(struct path *link, struct nameidata *nd) 723 { 724 const struct inode *inode; 725 const struct inode *parent; 726 727 if (!sysctl_protected_symlinks) 728 return 0; 729 730 /* Allowed if owner and follower match. */ 731 inode = link->dentry->d_inode; 732 if (uid_eq(current_cred()->fsuid, inode->i_uid)) 733 return 0; 734 735 /* Allowed if parent directory not sticky and world-writable. */ 736 parent = nd->path.dentry->d_inode; 737 if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH)) 738 return 0; 739 740 /* Allowed if parent directory and link owner match. */ 741 if (uid_eq(parent->i_uid, inode->i_uid)) 742 return 0; 743 744 audit_log_link_denied("follow_link", link); 745 path_put_conditional(link, nd); 746 path_put(&nd->path); 747 return -EACCES; 748 } 749 750 /** 751 * safe_hardlink_source - Check for safe hardlink conditions 752 * @inode: the source inode to hardlink from 753 * 754 * Return false if at least one of the following conditions: 755 * - inode is not a regular file 756 * - inode is setuid 757 * - inode is setgid and group-exec 758 * - access failure for read and write 759 * 760 * Otherwise returns true. 761 */ 762 static bool safe_hardlink_source(struct inode *inode) 763 { 764 umode_t mode = inode->i_mode; 765 766 /* Special files should not get pinned to the filesystem. */ 767 if (!S_ISREG(mode)) 768 return false; 769 770 /* Setuid files should not get pinned to the filesystem. */ 771 if (mode & S_ISUID) 772 return false; 773 774 /* Executable setgid files should not get pinned to the filesystem. */ 775 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) 776 return false; 777 778 /* Hardlinking to unreadable or unwritable sources is dangerous. */ 779 if (inode_permission(inode, MAY_READ | MAY_WRITE)) 780 return false; 781 782 return true; 783 } 784 785 /** 786 * may_linkat - Check permissions for creating a hardlink 787 * @link: the source to hardlink from 788 * 789 * Block hardlink when all of: 790 * - sysctl_protected_hardlinks enabled 791 * - fsuid does not match inode 792 * - hardlink source is unsafe (see safe_hardlink_source() above) 793 * - not CAP_FOWNER 794 * 795 * Returns 0 if successful, -ve on error. 796 */ 797 static int may_linkat(struct path *link) 798 { 799 const struct cred *cred; 800 struct inode *inode; 801 802 if (!sysctl_protected_hardlinks) 803 return 0; 804 805 cred = current_cred(); 806 inode = link->dentry->d_inode; 807 808 /* Source inode owner (or CAP_FOWNER) can hardlink all they like, 809 * otherwise, it must be a safe source. 810 */ 811 if (uid_eq(cred->fsuid, inode->i_uid) || safe_hardlink_source(inode) || 812 capable(CAP_FOWNER)) 813 return 0; 814 815 audit_log_link_denied("linkat", link); 816 return -EPERM; 817 } 818 819 static __always_inline int 820 follow_link(struct path *link, struct nameidata *nd, void **p) 821 { 822 struct dentry *dentry = link->dentry; 823 int error; 824 char *s; 825 826 BUG_ON(nd->flags & LOOKUP_RCU); 827 828 if (link->mnt == nd->path.mnt) 829 mntget(link->mnt); 830 831 error = -ELOOP; 832 if (unlikely(current->total_link_count >= 40)) 833 goto out_put_nd_path; 834 835 cond_resched(); 836 current->total_link_count++; 837 838 touch_atime(link); 839 nd_set_link(nd, NULL); 840 841 error = security_inode_follow_link(link->dentry, nd); 842 if (error) 843 goto out_put_nd_path; 844 845 nd->last_type = LAST_BIND; 846 *p = dentry->d_inode->i_op->follow_link(dentry, nd); 847 error = PTR_ERR(*p); 848 if (IS_ERR(*p)) 849 goto out_put_nd_path; 850 851 error = 0; 852 s = nd_get_link(nd); 853 if (s) { 854 if (unlikely(IS_ERR(s))) { 855 path_put(&nd->path); 856 put_link(nd, link, *p); 857 return PTR_ERR(s); 858 } 859 if (*s == '/') { 860 set_root(nd); 861 path_put(&nd->path); 862 nd->path = nd->root; 863 path_get(&nd->root); 864 nd->flags |= LOOKUP_JUMPED; 865 } 866 nd->inode = nd->path.dentry->d_inode; 867 error = link_path_walk(s, nd); 868 if (unlikely(error)) 869 put_link(nd, link, *p); 870 } 871 872 return error; 873 874 out_put_nd_path: 875 *p = NULL; 876 path_put(&nd->path); 877 path_put(link); 878 return error; 879 } 880 881 static int follow_up_rcu(struct path *path) 882 { 883 struct mount *mnt = real_mount(path->mnt); 884 struct mount *parent; 885 struct dentry *mountpoint; 886 887 parent = mnt->mnt_parent; 888 if (&parent->mnt == path->mnt) 889 return 0; 890 mountpoint = mnt->mnt_mountpoint; 891 path->dentry = mountpoint; 892 path->mnt = &parent->mnt; 893 return 1; 894 } 895 896 /* 897 * follow_up - Find the mountpoint of path's vfsmount 898 * 899 * Given a path, find the mountpoint of its source file system. 900 * Replace @path with the path of the mountpoint in the parent mount. 901 * Up is towards /. 902 * 903 * Return 1 if we went up a level and 0 if we were already at the 904 * root. 905 */ 906 int follow_up(struct path *path) 907 { 908 struct mount *mnt = real_mount(path->mnt); 909 struct mount *parent; 910 struct dentry *mountpoint; 911 912 read_seqlock_excl(&mount_lock); 913 parent = mnt->mnt_parent; 914 if (parent == mnt) { 915 read_sequnlock_excl(&mount_lock); 916 return 0; 917 } 918 mntget(&parent->mnt); 919 mountpoint = dget(mnt->mnt_mountpoint); 920 read_sequnlock_excl(&mount_lock); 921 dput(path->dentry); 922 path->dentry = mountpoint; 923 mntput(path->mnt); 924 path->mnt = &parent->mnt; 925 return 1; 926 } 927 928 /* 929 * Perform an automount 930 * - return -EISDIR to tell follow_managed() to stop and return the path we 931 * were called with. 932 */ 933 static int follow_automount(struct path *path, unsigned flags, 934 bool *need_mntput) 935 { 936 struct vfsmount *mnt; 937 int err; 938 939 if (!path->dentry->d_op || !path->dentry->d_op->d_automount) 940 return -EREMOTE; 941 942 /* We don't want to mount if someone's just doing a stat - 943 * unless they're stat'ing a directory and appended a '/' to 944 * the name. 945 * 946 * We do, however, want to mount if someone wants to open or 947 * create a file of any type under the mountpoint, wants to 948 * traverse through the mountpoint or wants to open the 949 * mounted directory. Also, autofs may mark negative dentries 950 * as being automount points. These will need the attentions 951 * of the daemon to instantiate them before they can be used. 952 */ 953 if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY | 954 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) && 955 path->dentry->d_inode) 956 return -EISDIR; 957 958 current->total_link_count++; 959 if (current->total_link_count >= 40) 960 return -ELOOP; 961 962 mnt = path->dentry->d_op->d_automount(path); 963 if (IS_ERR(mnt)) { 964 /* 965 * The filesystem is allowed to return -EISDIR here to indicate 966 * it doesn't want to automount. For instance, autofs would do 967 * this so that its userspace daemon can mount on this dentry. 968 * 969 * However, we can only permit this if it's a terminal point in 970 * the path being looked up; if it wasn't then the remainder of 971 * the path is inaccessible and we should say so. 972 */ 973 if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT)) 974 return -EREMOTE; 975 return PTR_ERR(mnt); 976 } 977 978 if (!mnt) /* mount collision */ 979 return 0; 980 981 if (!*need_mntput) { 982 /* lock_mount() may release path->mnt on error */ 983 mntget(path->mnt); 984 *need_mntput = true; 985 } 986 err = finish_automount(mnt, path); 987 988 switch (err) { 989 case -EBUSY: 990 /* Someone else made a mount here whilst we were busy */ 991 return 0; 992 case 0: 993 path_put(path); 994 path->mnt = mnt; 995 path->dentry = dget(mnt->mnt_root); 996 return 0; 997 default: 998 return err; 999 } 1000 1001 } 1002 1003 /* 1004 * Handle a dentry that is managed in some way. 1005 * - Flagged for transit management (autofs) 1006 * - Flagged as mountpoint 1007 * - Flagged as automount point 1008 * 1009 * This may only be called in refwalk mode. 1010 * 1011 * Serialization is taken care of in namespace.c 1012 */ 1013 static int follow_managed(struct path *path, unsigned flags) 1014 { 1015 struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */ 1016 unsigned managed; 1017 bool need_mntput = false; 1018 int ret = 0; 1019 1020 /* Given that we're not holding a lock here, we retain the value in a 1021 * local variable for each dentry as we look at it so that we don't see 1022 * the components of that value change under us */ 1023 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1024 managed &= DCACHE_MANAGED_DENTRY, 1025 unlikely(managed != 0)) { 1026 /* Allow the filesystem to manage the transit without i_mutex 1027 * being held. */ 1028 if (managed & DCACHE_MANAGE_TRANSIT) { 1029 BUG_ON(!path->dentry->d_op); 1030 BUG_ON(!path->dentry->d_op->d_manage); 1031 ret = path->dentry->d_op->d_manage(path->dentry, false); 1032 if (ret < 0) 1033 break; 1034 } 1035 1036 /* Transit to a mounted filesystem. */ 1037 if (managed & DCACHE_MOUNTED) { 1038 struct vfsmount *mounted = lookup_mnt(path); 1039 if (mounted) { 1040 dput(path->dentry); 1041 if (need_mntput) 1042 mntput(path->mnt); 1043 path->mnt = mounted; 1044 path->dentry = dget(mounted->mnt_root); 1045 need_mntput = true; 1046 continue; 1047 } 1048 1049 /* Something is mounted on this dentry in another 1050 * namespace and/or whatever was mounted there in this 1051 * namespace got unmounted before lookup_mnt() could 1052 * get it */ 1053 } 1054 1055 /* Handle an automount point */ 1056 if (managed & DCACHE_NEED_AUTOMOUNT) { 1057 ret = follow_automount(path, flags, &need_mntput); 1058 if (ret < 0) 1059 break; 1060 continue; 1061 } 1062 1063 /* We didn't change the current path point */ 1064 break; 1065 } 1066 1067 if (need_mntput && path->mnt == mnt) 1068 mntput(path->mnt); 1069 if (ret == -EISDIR) 1070 ret = 0; 1071 return ret < 0 ? ret : need_mntput; 1072 } 1073 1074 int follow_down_one(struct path *path) 1075 { 1076 struct vfsmount *mounted; 1077 1078 mounted = lookup_mnt(path); 1079 if (mounted) { 1080 dput(path->dentry); 1081 mntput(path->mnt); 1082 path->mnt = mounted; 1083 path->dentry = dget(mounted->mnt_root); 1084 return 1; 1085 } 1086 return 0; 1087 } 1088 1089 static inline bool managed_dentry_might_block(struct dentry *dentry) 1090 { 1091 return (dentry->d_flags & DCACHE_MANAGE_TRANSIT && 1092 dentry->d_op->d_manage(dentry, true) < 0); 1093 } 1094 1095 /* 1096 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if 1097 * we meet a managed dentry that would need blocking. 1098 */ 1099 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, 1100 struct inode **inode) 1101 { 1102 for (;;) { 1103 struct mount *mounted; 1104 /* 1105 * Don't forget we might have a non-mountpoint managed dentry 1106 * that wants to block transit. 1107 */ 1108 if (unlikely(managed_dentry_might_block(path->dentry))) 1109 return false; 1110 1111 if (!d_mountpoint(path->dentry)) 1112 break; 1113 1114 mounted = __lookup_mnt(path->mnt, path->dentry); 1115 if (!mounted) 1116 break; 1117 path->mnt = &mounted->mnt; 1118 path->dentry = mounted->mnt.mnt_root; 1119 nd->flags |= LOOKUP_JUMPED; 1120 nd->seq = read_seqcount_begin(&path->dentry->d_seq); 1121 /* 1122 * Update the inode too. We don't need to re-check the 1123 * dentry sequence number here after this d_inode read, 1124 * because a mount-point is always pinned. 1125 */ 1126 *inode = path->dentry->d_inode; 1127 } 1128 return true; 1129 } 1130 1131 static void follow_mount_rcu(struct nameidata *nd) 1132 { 1133 while (d_mountpoint(nd->path.dentry)) { 1134 struct mount *mounted; 1135 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry); 1136 if (!mounted) 1137 break; 1138 nd->path.mnt = &mounted->mnt; 1139 nd->path.dentry = mounted->mnt.mnt_root; 1140 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 1141 } 1142 } 1143 1144 static int follow_dotdot_rcu(struct nameidata *nd) 1145 { 1146 set_root_rcu(nd); 1147 1148 while (1) { 1149 if (nd->path.dentry == nd->root.dentry && 1150 nd->path.mnt == nd->root.mnt) { 1151 break; 1152 } 1153 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1154 struct dentry *old = nd->path.dentry; 1155 struct dentry *parent = old->d_parent; 1156 unsigned seq; 1157 1158 seq = read_seqcount_begin(&parent->d_seq); 1159 if (read_seqcount_retry(&old->d_seq, nd->seq)) 1160 goto failed; 1161 nd->path.dentry = parent; 1162 nd->seq = seq; 1163 break; 1164 } 1165 if (!follow_up_rcu(&nd->path)) 1166 break; 1167 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); 1168 } 1169 follow_mount_rcu(nd); 1170 nd->inode = nd->path.dentry->d_inode; 1171 return 0; 1172 1173 failed: 1174 nd->flags &= ~LOOKUP_RCU; 1175 if (!(nd->flags & LOOKUP_ROOT)) 1176 nd->root.mnt = NULL; 1177 rcu_read_unlock(); 1178 return -ECHILD; 1179 } 1180 1181 /* 1182 * Follow down to the covering mount currently visible to userspace. At each 1183 * point, the filesystem owning that dentry may be queried as to whether the 1184 * caller is permitted to proceed or not. 1185 */ 1186 int follow_down(struct path *path) 1187 { 1188 unsigned managed; 1189 int ret; 1190 1191 while (managed = ACCESS_ONCE(path->dentry->d_flags), 1192 unlikely(managed & DCACHE_MANAGED_DENTRY)) { 1193 /* Allow the filesystem to manage the transit without i_mutex 1194 * being held. 1195 * 1196 * We indicate to the filesystem if someone is trying to mount 1197 * something here. This gives autofs the chance to deny anyone 1198 * other than its daemon the right to mount on its 1199 * superstructure. 1200 * 1201 * The filesystem may sleep at this point. 1202 */ 1203 if (managed & DCACHE_MANAGE_TRANSIT) { 1204 BUG_ON(!path->dentry->d_op); 1205 BUG_ON(!path->dentry->d_op->d_manage); 1206 ret = path->dentry->d_op->d_manage( 1207 path->dentry, false); 1208 if (ret < 0) 1209 return ret == -EISDIR ? 0 : ret; 1210 } 1211 1212 /* Transit to a mounted filesystem. */ 1213 if (managed & DCACHE_MOUNTED) { 1214 struct vfsmount *mounted = lookup_mnt(path); 1215 if (!mounted) 1216 break; 1217 dput(path->dentry); 1218 mntput(path->mnt); 1219 path->mnt = mounted; 1220 path->dentry = dget(mounted->mnt_root); 1221 continue; 1222 } 1223 1224 /* Don't handle automount points here */ 1225 break; 1226 } 1227 return 0; 1228 } 1229 1230 /* 1231 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot() 1232 */ 1233 static void follow_mount(struct path *path) 1234 { 1235 while (d_mountpoint(path->dentry)) { 1236 struct vfsmount *mounted = lookup_mnt(path); 1237 if (!mounted) 1238 break; 1239 dput(path->dentry); 1240 mntput(path->mnt); 1241 path->mnt = mounted; 1242 path->dentry = dget(mounted->mnt_root); 1243 } 1244 } 1245 1246 static void follow_dotdot(struct nameidata *nd) 1247 { 1248 set_root(nd); 1249 1250 while(1) { 1251 struct dentry *old = nd->path.dentry; 1252 1253 if (nd->path.dentry == nd->root.dentry && 1254 nd->path.mnt == nd->root.mnt) { 1255 break; 1256 } 1257 if (nd->path.dentry != nd->path.mnt->mnt_root) { 1258 /* rare case of legitimate dget_parent()... */ 1259 nd->path.dentry = dget_parent(nd->path.dentry); 1260 dput(old); 1261 break; 1262 } 1263 if (!follow_up(&nd->path)) 1264 break; 1265 } 1266 follow_mount(&nd->path); 1267 nd->inode = nd->path.dentry->d_inode; 1268 } 1269 1270 /* 1271 * This looks up the name in dcache, possibly revalidates the old dentry and 1272 * allocates a new one if not found or not valid. In the need_lookup argument 1273 * returns whether i_op->lookup is necessary. 1274 * 1275 * dir->d_inode->i_mutex must be held 1276 */ 1277 static struct dentry *lookup_dcache(struct qstr *name, struct dentry *dir, 1278 unsigned int flags, bool *need_lookup) 1279 { 1280 struct dentry *dentry; 1281 int error; 1282 1283 *need_lookup = false; 1284 dentry = d_lookup(dir, name); 1285 if (dentry) { 1286 if (dentry->d_flags & DCACHE_OP_REVALIDATE) { 1287 error = d_revalidate(dentry, flags); 1288 if (unlikely(error <= 0)) { 1289 if (error < 0) { 1290 dput(dentry); 1291 return ERR_PTR(error); 1292 } else if (!d_invalidate(dentry)) { 1293 dput(dentry); 1294 dentry = NULL; 1295 } 1296 } 1297 } 1298 } 1299 1300 if (!dentry) { 1301 dentry = d_alloc(dir, name); 1302 if (unlikely(!dentry)) 1303 return ERR_PTR(-ENOMEM); 1304 1305 *need_lookup = true; 1306 } 1307 return dentry; 1308 } 1309 1310 /* 1311 * Call i_op->lookup on the dentry. The dentry must be negative and 1312 * unhashed. 1313 * 1314 * dir->d_inode->i_mutex must be held 1315 */ 1316 static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry, 1317 unsigned int flags) 1318 { 1319 struct dentry *old; 1320 1321 /* Don't create child dentry for a dead directory. */ 1322 if (unlikely(IS_DEADDIR(dir))) { 1323 dput(dentry); 1324 return ERR_PTR(-ENOENT); 1325 } 1326 1327 old = dir->i_op->lookup(dir, dentry, flags); 1328 if (unlikely(old)) { 1329 dput(dentry); 1330 dentry = old; 1331 } 1332 return dentry; 1333 } 1334 1335 static struct dentry *__lookup_hash(struct qstr *name, 1336 struct dentry *base, unsigned int flags) 1337 { 1338 bool need_lookup; 1339 struct dentry *dentry; 1340 1341 dentry = lookup_dcache(name, base, flags, &need_lookup); 1342 if (!need_lookup) 1343 return dentry; 1344 1345 return lookup_real(base->d_inode, dentry, flags); 1346 } 1347 1348 /* 1349 * It's more convoluted than I'd like it to be, but... it's still fairly 1350 * small and for now I'd prefer to have fast path as straight as possible. 1351 * It _is_ time-critical. 1352 */ 1353 static int lookup_fast(struct nameidata *nd, 1354 struct path *path, struct inode **inode) 1355 { 1356 struct vfsmount *mnt = nd->path.mnt; 1357 struct dentry *dentry, *parent = nd->path.dentry; 1358 int need_reval = 1; 1359 int status = 1; 1360 int err; 1361 1362 /* 1363 * Rename seqlock is not required here because in the off chance 1364 * of a false negative due to a concurrent rename, we're going to 1365 * do the non-racy lookup, below. 1366 */ 1367 if (nd->flags & LOOKUP_RCU) { 1368 unsigned seq; 1369 dentry = __d_lookup_rcu(parent, &nd->last, &seq); 1370 if (!dentry) 1371 goto unlazy; 1372 1373 /* 1374 * This sequence count validates that the inode matches 1375 * the dentry name information from lookup. 1376 */ 1377 *inode = dentry->d_inode; 1378 if (read_seqcount_retry(&dentry->d_seq, seq)) 1379 return -ECHILD; 1380 1381 /* 1382 * This sequence count validates that the parent had no 1383 * changes while we did the lookup of the dentry above. 1384 * 1385 * The memory barrier in read_seqcount_begin of child is 1386 * enough, we can use __read_seqcount_retry here. 1387 */ 1388 if (__read_seqcount_retry(&parent->d_seq, nd->seq)) 1389 return -ECHILD; 1390 nd->seq = seq; 1391 1392 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) { 1393 status = d_revalidate(dentry, nd->flags); 1394 if (unlikely(status <= 0)) { 1395 if (status != -ECHILD) 1396 need_reval = 0; 1397 goto unlazy; 1398 } 1399 } 1400 path->mnt = mnt; 1401 path->dentry = dentry; 1402 if (unlikely(!__follow_mount_rcu(nd, path, inode))) 1403 goto unlazy; 1404 if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT)) 1405 goto unlazy; 1406 return 0; 1407 unlazy: 1408 if (unlazy_walk(nd, dentry)) 1409 return -ECHILD; 1410 } else { 1411 dentry = __d_lookup(parent, &nd->last); 1412 } 1413 1414 if (unlikely(!dentry)) 1415 goto need_lookup; 1416 1417 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval) 1418 status = d_revalidate(dentry, nd->flags); 1419 if (unlikely(status <= 0)) { 1420 if (status < 0) { 1421 dput(dentry); 1422 return status; 1423 } 1424 if (!d_invalidate(dentry)) { 1425 dput(dentry); 1426 goto need_lookup; 1427 } 1428 } 1429 1430 path->mnt = mnt; 1431 path->dentry = dentry; 1432 err = follow_managed(path, nd->flags); 1433 if (unlikely(err < 0)) { 1434 path_put_conditional(path, nd); 1435 return err; 1436 } 1437 if (err) 1438 nd->flags |= LOOKUP_JUMPED; 1439 *inode = path->dentry->d_inode; 1440 return 0; 1441 1442 need_lookup: 1443 return 1; 1444 } 1445 1446 /* Fast lookup failed, do it the slow way */ 1447 static int lookup_slow(struct nameidata *nd, struct path *path) 1448 { 1449 struct dentry *dentry, *parent; 1450 int err; 1451 1452 parent = nd->path.dentry; 1453 BUG_ON(nd->inode != parent->d_inode); 1454 1455 mutex_lock(&parent->d_inode->i_mutex); 1456 dentry = __lookup_hash(&nd->last, parent, nd->flags); 1457 mutex_unlock(&parent->d_inode->i_mutex); 1458 if (IS_ERR(dentry)) 1459 return PTR_ERR(dentry); 1460 path->mnt = nd->path.mnt; 1461 path->dentry = dentry; 1462 err = follow_managed(path, nd->flags); 1463 if (unlikely(err < 0)) { 1464 path_put_conditional(path, nd); 1465 return err; 1466 } 1467 if (err) 1468 nd->flags |= LOOKUP_JUMPED; 1469 return 0; 1470 } 1471 1472 static inline int may_lookup(struct nameidata *nd) 1473 { 1474 if (nd->flags & LOOKUP_RCU) { 1475 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK); 1476 if (err != -ECHILD) 1477 return err; 1478 if (unlazy_walk(nd, NULL)) 1479 return -ECHILD; 1480 } 1481 return inode_permission(nd->inode, MAY_EXEC); 1482 } 1483 1484 static inline int handle_dots(struct nameidata *nd, int type) 1485 { 1486 if (type == LAST_DOTDOT) { 1487 if (nd->flags & LOOKUP_RCU) { 1488 if (follow_dotdot_rcu(nd)) 1489 return -ECHILD; 1490 } else 1491 follow_dotdot(nd); 1492 } 1493 return 0; 1494 } 1495 1496 static void terminate_walk(struct nameidata *nd) 1497 { 1498 if (!(nd->flags & LOOKUP_RCU)) { 1499 path_put(&nd->path); 1500 } else { 1501 nd->flags &= ~LOOKUP_RCU; 1502 if (!(nd->flags & LOOKUP_ROOT)) 1503 nd->root.mnt = NULL; 1504 rcu_read_unlock(); 1505 } 1506 } 1507 1508 /* 1509 * Do we need to follow links? We _really_ want to be able 1510 * to do this check without having to look at inode->i_op, 1511 * so we keep a cache of "no, this doesn't need follow_link" 1512 * for the common case. 1513 */ 1514 static inline int should_follow_link(struct dentry *dentry, int follow) 1515 { 1516 return unlikely(d_is_symlink(dentry)) ? follow : 0; 1517 } 1518 1519 static inline int walk_component(struct nameidata *nd, struct path *path, 1520 int follow) 1521 { 1522 struct inode *inode; 1523 int err; 1524 /* 1525 * "." and ".." are special - ".." especially so because it has 1526 * to be able to know about the current root directory and 1527 * parent relationships. 1528 */ 1529 if (unlikely(nd->last_type != LAST_NORM)) 1530 return handle_dots(nd, nd->last_type); 1531 err = lookup_fast(nd, path, &inode); 1532 if (unlikely(err)) { 1533 if (err < 0) 1534 goto out_err; 1535 1536 err = lookup_slow(nd, path); 1537 if (err < 0) 1538 goto out_err; 1539 1540 inode = path->dentry->d_inode; 1541 } 1542 err = -ENOENT; 1543 if (!inode) 1544 goto out_path_put; 1545 1546 if (should_follow_link(path->dentry, follow)) { 1547 if (nd->flags & LOOKUP_RCU) { 1548 if (unlikely(unlazy_walk(nd, path->dentry))) { 1549 err = -ECHILD; 1550 goto out_err; 1551 } 1552 } 1553 BUG_ON(inode != path->dentry->d_inode); 1554 return 1; 1555 } 1556 path_to_nameidata(path, nd); 1557 nd->inode = inode; 1558 return 0; 1559 1560 out_path_put: 1561 path_to_nameidata(path, nd); 1562 out_err: 1563 terminate_walk(nd); 1564 return err; 1565 } 1566 1567 /* 1568 * This limits recursive symlink follows to 8, while 1569 * limiting consecutive symlinks to 40. 1570 * 1571 * Without that kind of total limit, nasty chains of consecutive 1572 * symlinks can cause almost arbitrarily long lookups. 1573 */ 1574 static inline int nested_symlink(struct path *path, struct nameidata *nd) 1575 { 1576 int res; 1577 1578 if (unlikely(current->link_count >= MAX_NESTED_LINKS)) { 1579 path_put_conditional(path, nd); 1580 path_put(&nd->path); 1581 return -ELOOP; 1582 } 1583 BUG_ON(nd->depth >= MAX_NESTED_LINKS); 1584 1585 nd->depth++; 1586 current->link_count++; 1587 1588 do { 1589 struct path link = *path; 1590 void *cookie; 1591 1592 res = follow_link(&link, nd, &cookie); 1593 if (res) 1594 break; 1595 res = walk_component(nd, path, LOOKUP_FOLLOW); 1596 put_link(nd, &link, cookie); 1597 } while (res > 0); 1598 1599 current->link_count--; 1600 nd->depth--; 1601 return res; 1602 } 1603 1604 /* 1605 * We can do the critical dentry name comparison and hashing 1606 * operations one word at a time, but we are limited to: 1607 * 1608 * - Architectures with fast unaligned word accesses. We could 1609 * do a "get_unaligned()" if this helps and is sufficiently 1610 * fast. 1611 * 1612 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we 1613 * do not trap on the (extremely unlikely) case of a page 1614 * crossing operation. 1615 * 1616 * - Furthermore, we need an efficient 64-bit compile for the 1617 * 64-bit case in order to generate the "number of bytes in 1618 * the final mask". Again, that could be replaced with a 1619 * efficient population count instruction or similar. 1620 */ 1621 #ifdef CONFIG_DCACHE_WORD_ACCESS 1622 1623 #include <asm/word-at-a-time.h> 1624 1625 #ifdef CONFIG_64BIT 1626 1627 static inline unsigned int fold_hash(unsigned long hash) 1628 { 1629 hash += hash >> (8*sizeof(int)); 1630 return hash; 1631 } 1632 1633 #else /* 32-bit case */ 1634 1635 #define fold_hash(x) (x) 1636 1637 #endif 1638 1639 unsigned int full_name_hash(const unsigned char *name, unsigned int len) 1640 { 1641 unsigned long a, mask; 1642 unsigned long hash = 0; 1643 1644 for (;;) { 1645 a = load_unaligned_zeropad(name); 1646 if (len < sizeof(unsigned long)) 1647 break; 1648 hash += a; 1649 hash *= 9; 1650 name += sizeof(unsigned long); 1651 len -= sizeof(unsigned long); 1652 if (!len) 1653 goto done; 1654 } 1655 mask = bytemask_from_count(len); 1656 hash += mask & a; 1657 done: 1658 return fold_hash(hash); 1659 } 1660 EXPORT_SYMBOL(full_name_hash); 1661 1662 /* 1663 * Calculate the length and hash of the path component, and 1664 * return the length of the component; 1665 */ 1666 static inline unsigned long hash_name(const char *name, unsigned int *hashp) 1667 { 1668 unsigned long a, b, adata, bdata, mask, hash, len; 1669 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; 1670 1671 hash = a = 0; 1672 len = -sizeof(unsigned long); 1673 do { 1674 hash = (hash + a) * 9; 1675 len += sizeof(unsigned long); 1676 a = load_unaligned_zeropad(name+len); 1677 b = a ^ REPEAT_BYTE('/'); 1678 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants))); 1679 1680 adata = prep_zero_mask(a, adata, &constants); 1681 bdata = prep_zero_mask(b, bdata, &constants); 1682 1683 mask = create_zero_mask(adata | bdata); 1684 1685 hash += a & zero_bytemask(mask); 1686 *hashp = fold_hash(hash); 1687 1688 return len + find_zero(mask); 1689 } 1690 1691 #else 1692 1693 unsigned int full_name_hash(const unsigned char *name, unsigned int len) 1694 { 1695 unsigned long hash = init_name_hash(); 1696 while (len--) 1697 hash = partial_name_hash(*name++, hash); 1698 return end_name_hash(hash); 1699 } 1700 EXPORT_SYMBOL(full_name_hash); 1701 1702 /* 1703 * We know there's a real path component here of at least 1704 * one character. 1705 */ 1706 static inline unsigned long hash_name(const char *name, unsigned int *hashp) 1707 { 1708 unsigned long hash = init_name_hash(); 1709 unsigned long len = 0, c; 1710 1711 c = (unsigned char)*name; 1712 do { 1713 len++; 1714 hash = partial_name_hash(c, hash); 1715 c = (unsigned char)name[len]; 1716 } while (c && c != '/'); 1717 *hashp = end_name_hash(hash); 1718 return len; 1719 } 1720 1721 #endif 1722 1723 /* 1724 * Name resolution. 1725 * This is the basic name resolution function, turning a pathname into 1726 * the final dentry. We expect 'base' to be positive and a directory. 1727 * 1728 * Returns 0 and nd will have valid dentry and mnt on success. 1729 * Returns error and drops reference to input namei data on failure. 1730 */ 1731 static int link_path_walk(const char *name, struct nameidata *nd) 1732 { 1733 struct path next; 1734 int err; 1735 1736 while (*name=='/') 1737 name++; 1738 if (!*name) 1739 return 0; 1740 1741 /* At this point we know we have a real path component. */ 1742 for(;;) { 1743 struct qstr this; 1744 long len; 1745 int type; 1746 1747 err = may_lookup(nd); 1748 if (err) 1749 break; 1750 1751 len = hash_name(name, &this.hash); 1752 this.name = name; 1753 this.len = len; 1754 1755 type = LAST_NORM; 1756 if (name[0] == '.') switch (len) { 1757 case 2: 1758 if (name[1] == '.') { 1759 type = LAST_DOTDOT; 1760 nd->flags |= LOOKUP_JUMPED; 1761 } 1762 break; 1763 case 1: 1764 type = LAST_DOT; 1765 } 1766 if (likely(type == LAST_NORM)) { 1767 struct dentry *parent = nd->path.dentry; 1768 nd->flags &= ~LOOKUP_JUMPED; 1769 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { 1770 err = parent->d_op->d_hash(parent, &this); 1771 if (err < 0) 1772 break; 1773 } 1774 } 1775 1776 nd->last = this; 1777 nd->last_type = type; 1778 1779 if (!name[len]) 1780 return 0; 1781 /* 1782 * If it wasn't NUL, we know it was '/'. Skip that 1783 * slash, and continue until no more slashes. 1784 */ 1785 do { 1786 len++; 1787 } while (unlikely(name[len] == '/')); 1788 if (!name[len]) 1789 return 0; 1790 1791 name += len; 1792 1793 err = walk_component(nd, &next, LOOKUP_FOLLOW); 1794 if (err < 0) 1795 return err; 1796 1797 if (err) { 1798 err = nested_symlink(&next, nd); 1799 if (err) 1800 return err; 1801 } 1802 if (!d_is_directory(nd->path.dentry)) { 1803 err = -ENOTDIR; 1804 break; 1805 } 1806 } 1807 terminate_walk(nd); 1808 return err; 1809 } 1810 1811 static int path_init(int dfd, const char *name, unsigned int flags, 1812 struct nameidata *nd, struct file **fp) 1813 { 1814 int retval = 0; 1815 1816 nd->last_type = LAST_ROOT; /* if there are only slashes... */ 1817 nd->flags = flags | LOOKUP_JUMPED; 1818 nd->depth = 0; 1819 if (flags & LOOKUP_ROOT) { 1820 struct dentry *root = nd->root.dentry; 1821 struct inode *inode = root->d_inode; 1822 if (*name) { 1823 if (!d_is_directory(root)) 1824 return -ENOTDIR; 1825 retval = inode_permission(inode, MAY_EXEC); 1826 if (retval) 1827 return retval; 1828 } 1829 nd->path = nd->root; 1830 nd->inode = inode; 1831 if (flags & LOOKUP_RCU) { 1832 rcu_read_lock(); 1833 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1834 nd->m_seq = read_seqbegin(&mount_lock); 1835 } else { 1836 path_get(&nd->path); 1837 } 1838 return 0; 1839 } 1840 1841 nd->root.mnt = NULL; 1842 1843 nd->m_seq = read_seqbegin(&mount_lock); 1844 if (*name=='/') { 1845 if (flags & LOOKUP_RCU) { 1846 rcu_read_lock(); 1847 set_root_rcu(nd); 1848 } else { 1849 set_root(nd); 1850 path_get(&nd->root); 1851 } 1852 nd->path = nd->root; 1853 } else if (dfd == AT_FDCWD) { 1854 if (flags & LOOKUP_RCU) { 1855 struct fs_struct *fs = current->fs; 1856 unsigned seq; 1857 1858 rcu_read_lock(); 1859 1860 do { 1861 seq = read_seqcount_begin(&fs->seq); 1862 nd->path = fs->pwd; 1863 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1864 } while (read_seqcount_retry(&fs->seq, seq)); 1865 } else { 1866 get_fs_pwd(current->fs, &nd->path); 1867 } 1868 } else { 1869 /* Caller must check execute permissions on the starting path component */ 1870 struct fd f = fdget_raw(dfd); 1871 struct dentry *dentry; 1872 1873 if (!f.file) 1874 return -EBADF; 1875 1876 dentry = f.file->f_path.dentry; 1877 1878 if (*name) { 1879 if (!d_is_directory(dentry)) { 1880 fdput(f); 1881 return -ENOTDIR; 1882 } 1883 } 1884 1885 nd->path = f.file->f_path; 1886 if (flags & LOOKUP_RCU) { 1887 if (f.need_put) 1888 *fp = f.file; 1889 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq); 1890 rcu_read_lock(); 1891 } else { 1892 path_get(&nd->path); 1893 fdput(f); 1894 } 1895 } 1896 1897 nd->inode = nd->path.dentry->d_inode; 1898 return 0; 1899 } 1900 1901 static inline int lookup_last(struct nameidata *nd, struct path *path) 1902 { 1903 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len]) 1904 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 1905 1906 nd->flags &= ~LOOKUP_PARENT; 1907 return walk_component(nd, path, nd->flags & LOOKUP_FOLLOW); 1908 } 1909 1910 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ 1911 static int path_lookupat(int dfd, const char *name, 1912 unsigned int flags, struct nameidata *nd) 1913 { 1914 struct file *base = NULL; 1915 struct path path; 1916 int err; 1917 1918 /* 1919 * Path walking is largely split up into 2 different synchronisation 1920 * schemes, rcu-walk and ref-walk (explained in 1921 * Documentation/filesystems/path-lookup.txt). These share much of the 1922 * path walk code, but some things particularly setup, cleanup, and 1923 * following mounts are sufficiently divergent that functions are 1924 * duplicated. Typically there is a function foo(), and its RCU 1925 * analogue, foo_rcu(). 1926 * 1927 * -ECHILD is the error number of choice (just to avoid clashes) that 1928 * is returned if some aspect of an rcu-walk fails. Such an error must 1929 * be handled by restarting a traditional ref-walk (which will always 1930 * be able to complete). 1931 */ 1932 err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base); 1933 1934 if (unlikely(err)) 1935 return err; 1936 1937 current->total_link_count = 0; 1938 err = link_path_walk(name, nd); 1939 1940 if (!err && !(flags & LOOKUP_PARENT)) { 1941 err = lookup_last(nd, &path); 1942 while (err > 0) { 1943 void *cookie; 1944 struct path link = path; 1945 err = may_follow_link(&link, nd); 1946 if (unlikely(err)) 1947 break; 1948 nd->flags |= LOOKUP_PARENT; 1949 err = follow_link(&link, nd, &cookie); 1950 if (err) 1951 break; 1952 err = lookup_last(nd, &path); 1953 put_link(nd, &link, cookie); 1954 } 1955 } 1956 1957 if (!err) 1958 err = complete_walk(nd); 1959 1960 if (!err && nd->flags & LOOKUP_DIRECTORY) { 1961 if (!d_is_directory(nd->path.dentry)) { 1962 path_put(&nd->path); 1963 err = -ENOTDIR; 1964 } 1965 } 1966 1967 if (base) 1968 fput(base); 1969 1970 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { 1971 path_put(&nd->root); 1972 nd->root.mnt = NULL; 1973 } 1974 return err; 1975 } 1976 1977 static int filename_lookup(int dfd, struct filename *name, 1978 unsigned int flags, struct nameidata *nd) 1979 { 1980 int retval = path_lookupat(dfd, name->name, flags | LOOKUP_RCU, nd); 1981 if (unlikely(retval == -ECHILD)) 1982 retval = path_lookupat(dfd, name->name, flags, nd); 1983 if (unlikely(retval == -ESTALE)) 1984 retval = path_lookupat(dfd, name->name, 1985 flags | LOOKUP_REVAL, nd); 1986 1987 if (likely(!retval)) 1988 audit_inode(name, nd->path.dentry, flags & LOOKUP_PARENT); 1989 return retval; 1990 } 1991 1992 static int do_path_lookup(int dfd, const char *name, 1993 unsigned int flags, struct nameidata *nd) 1994 { 1995 struct filename filename = { .name = name }; 1996 1997 return filename_lookup(dfd, &filename, flags, nd); 1998 } 1999 2000 /* does lookup, returns the object with parent locked */ 2001 struct dentry *kern_path_locked(const char *name, struct path *path) 2002 { 2003 struct nameidata nd; 2004 struct dentry *d; 2005 int err = do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, &nd); 2006 if (err) 2007 return ERR_PTR(err); 2008 if (nd.last_type != LAST_NORM) { 2009 path_put(&nd.path); 2010 return ERR_PTR(-EINVAL); 2011 } 2012 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 2013 d = __lookup_hash(&nd.last, nd.path.dentry, 0); 2014 if (IS_ERR(d)) { 2015 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 2016 path_put(&nd.path); 2017 return d; 2018 } 2019 *path = nd.path; 2020 return d; 2021 } 2022 2023 int kern_path(const char *name, unsigned int flags, struct path *path) 2024 { 2025 struct nameidata nd; 2026 int res = do_path_lookup(AT_FDCWD, name, flags, &nd); 2027 if (!res) 2028 *path = nd.path; 2029 return res; 2030 } 2031 2032 /** 2033 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair 2034 * @dentry: pointer to dentry of the base directory 2035 * @mnt: pointer to vfs mount of the base directory 2036 * @name: pointer to file name 2037 * @flags: lookup flags 2038 * @path: pointer to struct path to fill 2039 */ 2040 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt, 2041 const char *name, unsigned int flags, 2042 struct path *path) 2043 { 2044 struct nameidata nd; 2045 int err; 2046 nd.root.dentry = dentry; 2047 nd.root.mnt = mnt; 2048 BUG_ON(flags & LOOKUP_PARENT); 2049 /* the first argument of do_path_lookup() is ignored with LOOKUP_ROOT */ 2050 err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd); 2051 if (!err) 2052 *path = nd.path; 2053 return err; 2054 } 2055 2056 /* 2057 * Restricted form of lookup. Doesn't follow links, single-component only, 2058 * needs parent already locked. Doesn't follow mounts. 2059 * SMP-safe. 2060 */ 2061 static struct dentry *lookup_hash(struct nameidata *nd) 2062 { 2063 return __lookup_hash(&nd->last, nd->path.dentry, nd->flags); 2064 } 2065 2066 /** 2067 * lookup_one_len - filesystem helper to lookup single pathname component 2068 * @name: pathname component to lookup 2069 * @base: base directory to lookup from 2070 * @len: maximum length @len should be interpreted to 2071 * 2072 * Note that this routine is purely a helper for filesystem usage and should 2073 * not be called by generic code. Also note that by using this function the 2074 * nameidata argument is passed to the filesystem methods and a filesystem 2075 * using this helper needs to be prepared for that. 2076 */ 2077 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len) 2078 { 2079 struct qstr this; 2080 unsigned int c; 2081 int err; 2082 2083 WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex)); 2084 2085 this.name = name; 2086 this.len = len; 2087 this.hash = full_name_hash(name, len); 2088 if (!len) 2089 return ERR_PTR(-EACCES); 2090 2091 if (unlikely(name[0] == '.')) { 2092 if (len < 2 || (len == 2 && name[1] == '.')) 2093 return ERR_PTR(-EACCES); 2094 } 2095 2096 while (len--) { 2097 c = *(const unsigned char *)name++; 2098 if (c == '/' || c == '\0') 2099 return ERR_PTR(-EACCES); 2100 } 2101 /* 2102 * See if the low-level filesystem might want 2103 * to use its own hash.. 2104 */ 2105 if (base->d_flags & DCACHE_OP_HASH) { 2106 int err = base->d_op->d_hash(base, &this); 2107 if (err < 0) 2108 return ERR_PTR(err); 2109 } 2110 2111 err = inode_permission(base->d_inode, MAY_EXEC); 2112 if (err) 2113 return ERR_PTR(err); 2114 2115 return __lookup_hash(&this, base, 0); 2116 } 2117 2118 int user_path_at_empty(int dfd, const char __user *name, unsigned flags, 2119 struct path *path, int *empty) 2120 { 2121 struct nameidata nd; 2122 struct filename *tmp = getname_flags(name, flags, empty); 2123 int err = PTR_ERR(tmp); 2124 if (!IS_ERR(tmp)) { 2125 2126 BUG_ON(flags & LOOKUP_PARENT); 2127 2128 err = filename_lookup(dfd, tmp, flags, &nd); 2129 putname(tmp); 2130 if (!err) 2131 *path = nd.path; 2132 } 2133 return err; 2134 } 2135 2136 int user_path_at(int dfd, const char __user *name, unsigned flags, 2137 struct path *path) 2138 { 2139 return user_path_at_empty(dfd, name, flags, path, NULL); 2140 } 2141 2142 /* 2143 * NB: most callers don't do anything directly with the reference to the 2144 * to struct filename, but the nd->last pointer points into the name string 2145 * allocated by getname. So we must hold the reference to it until all 2146 * path-walking is complete. 2147 */ 2148 static struct filename * 2149 user_path_parent(int dfd, const char __user *path, struct nameidata *nd, 2150 unsigned int flags) 2151 { 2152 struct filename *s = getname(path); 2153 int error; 2154 2155 /* only LOOKUP_REVAL is allowed in extra flags */ 2156 flags &= LOOKUP_REVAL; 2157 2158 if (IS_ERR(s)) 2159 return s; 2160 2161 error = filename_lookup(dfd, s, flags | LOOKUP_PARENT, nd); 2162 if (error) { 2163 putname(s); 2164 return ERR_PTR(error); 2165 } 2166 2167 return s; 2168 } 2169 2170 /** 2171 * mountpoint_last - look up last component for umount 2172 * @nd: pathwalk nameidata - currently pointing at parent directory of "last" 2173 * @path: pointer to container for result 2174 * 2175 * This is a special lookup_last function just for umount. In this case, we 2176 * need to resolve the path without doing any revalidation. 2177 * 2178 * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since 2179 * mountpoints are always pinned in the dcache, their ancestors are too. Thus, 2180 * in almost all cases, this lookup will be served out of the dcache. The only 2181 * cases where it won't are if nd->last refers to a symlink or the path is 2182 * bogus and it doesn't exist. 2183 * 2184 * Returns: 2185 * -error: if there was an error during lookup. This includes -ENOENT if the 2186 * lookup found a negative dentry. The nd->path reference will also be 2187 * put in this case. 2188 * 2189 * 0: if we successfully resolved nd->path and found it to not to be a 2190 * symlink that needs to be followed. "path" will also be populated. 2191 * The nd->path reference will also be put. 2192 * 2193 * 1: if we successfully resolved nd->last and found it to be a symlink 2194 * that needs to be followed. "path" will be populated with the path 2195 * to the link, and nd->path will *not* be put. 2196 */ 2197 static int 2198 mountpoint_last(struct nameidata *nd, struct path *path) 2199 { 2200 int error = 0; 2201 struct dentry *dentry; 2202 struct dentry *dir = nd->path.dentry; 2203 2204 /* If we're in rcuwalk, drop out of it to handle last component */ 2205 if (nd->flags & LOOKUP_RCU) { 2206 if (unlazy_walk(nd, NULL)) { 2207 error = -ECHILD; 2208 goto out; 2209 } 2210 } 2211 2212 nd->flags &= ~LOOKUP_PARENT; 2213 2214 if (unlikely(nd->last_type != LAST_NORM)) { 2215 error = handle_dots(nd, nd->last_type); 2216 if (error) 2217 goto out; 2218 dentry = dget(nd->path.dentry); 2219 goto done; 2220 } 2221 2222 mutex_lock(&dir->d_inode->i_mutex); 2223 dentry = d_lookup(dir, &nd->last); 2224 if (!dentry) { 2225 /* 2226 * No cached dentry. Mounted dentries are pinned in the cache, 2227 * so that means that this dentry is probably a symlink or the 2228 * path doesn't actually point to a mounted dentry. 2229 */ 2230 dentry = d_alloc(dir, &nd->last); 2231 if (!dentry) { 2232 error = -ENOMEM; 2233 mutex_unlock(&dir->d_inode->i_mutex); 2234 goto out; 2235 } 2236 dentry = lookup_real(dir->d_inode, dentry, nd->flags); 2237 error = PTR_ERR(dentry); 2238 if (IS_ERR(dentry)) { 2239 mutex_unlock(&dir->d_inode->i_mutex); 2240 goto out; 2241 } 2242 } 2243 mutex_unlock(&dir->d_inode->i_mutex); 2244 2245 done: 2246 if (!dentry->d_inode) { 2247 error = -ENOENT; 2248 dput(dentry); 2249 goto out; 2250 } 2251 path->dentry = dentry; 2252 path->mnt = mntget(nd->path.mnt); 2253 if (should_follow_link(dentry, nd->flags & LOOKUP_FOLLOW)) 2254 return 1; 2255 follow_mount(path); 2256 error = 0; 2257 out: 2258 terminate_walk(nd); 2259 return error; 2260 } 2261 2262 /** 2263 * path_mountpoint - look up a path to be umounted 2264 * @dfd: directory file descriptor to start walk from 2265 * @name: full pathname to walk 2266 * @path: pointer to container for result 2267 * @flags: lookup flags 2268 * 2269 * Look up the given name, but don't attempt to revalidate the last component. 2270 * Returns 0 and "path" will be valid on success; Returns error otherwise. 2271 */ 2272 static int 2273 path_mountpoint(int dfd, const char *name, struct path *path, unsigned int flags) 2274 { 2275 struct file *base = NULL; 2276 struct nameidata nd; 2277 int err; 2278 2279 err = path_init(dfd, name, flags | LOOKUP_PARENT, &nd, &base); 2280 if (unlikely(err)) 2281 return err; 2282 2283 current->total_link_count = 0; 2284 err = link_path_walk(name, &nd); 2285 if (err) 2286 goto out; 2287 2288 err = mountpoint_last(&nd, path); 2289 while (err > 0) { 2290 void *cookie; 2291 struct path link = *path; 2292 err = may_follow_link(&link, &nd); 2293 if (unlikely(err)) 2294 break; 2295 nd.flags |= LOOKUP_PARENT; 2296 err = follow_link(&link, &nd, &cookie); 2297 if (err) 2298 break; 2299 err = mountpoint_last(&nd, path); 2300 put_link(&nd, &link, cookie); 2301 } 2302 out: 2303 if (base) 2304 fput(base); 2305 2306 if (nd.root.mnt && !(nd.flags & LOOKUP_ROOT)) 2307 path_put(&nd.root); 2308 2309 return err; 2310 } 2311 2312 static int 2313 filename_mountpoint(int dfd, struct filename *s, struct path *path, 2314 unsigned int flags) 2315 { 2316 int error = path_mountpoint(dfd, s->name, path, flags | LOOKUP_RCU); 2317 if (unlikely(error == -ECHILD)) 2318 error = path_mountpoint(dfd, s->name, path, flags); 2319 if (unlikely(error == -ESTALE)) 2320 error = path_mountpoint(dfd, s->name, path, flags | LOOKUP_REVAL); 2321 if (likely(!error)) 2322 audit_inode(s, path->dentry, 0); 2323 return error; 2324 } 2325 2326 /** 2327 * user_path_mountpoint_at - lookup a path from userland in order to umount it 2328 * @dfd: directory file descriptor 2329 * @name: pathname from userland 2330 * @flags: lookup flags 2331 * @path: pointer to container to hold result 2332 * 2333 * A umount is a special case for path walking. We're not actually interested 2334 * in the inode in this situation, and ESTALE errors can be a problem. We 2335 * simply want track down the dentry and vfsmount attached at the mountpoint 2336 * and avoid revalidating the last component. 2337 * 2338 * Returns 0 and populates "path" on success. 2339 */ 2340 int 2341 user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags, 2342 struct path *path) 2343 { 2344 struct filename *s = getname(name); 2345 int error; 2346 if (IS_ERR(s)) 2347 return PTR_ERR(s); 2348 error = filename_mountpoint(dfd, s, path, flags); 2349 putname(s); 2350 return error; 2351 } 2352 2353 int 2354 kern_path_mountpoint(int dfd, const char *name, struct path *path, 2355 unsigned int flags) 2356 { 2357 struct filename s = {.name = name}; 2358 return filename_mountpoint(dfd, &s, path, flags); 2359 } 2360 EXPORT_SYMBOL(kern_path_mountpoint); 2361 2362 /* 2363 * It's inline, so penalty for filesystems that don't use sticky bit is 2364 * minimal. 2365 */ 2366 static inline int check_sticky(struct inode *dir, struct inode *inode) 2367 { 2368 kuid_t fsuid = current_fsuid(); 2369 2370 if (!(dir->i_mode & S_ISVTX)) 2371 return 0; 2372 if (uid_eq(inode->i_uid, fsuid)) 2373 return 0; 2374 if (uid_eq(dir->i_uid, fsuid)) 2375 return 0; 2376 return !inode_capable(inode, CAP_FOWNER); 2377 } 2378 2379 /* 2380 * Check whether we can remove a link victim from directory dir, check 2381 * whether the type of victim is right. 2382 * 1. We can't do it if dir is read-only (done in permission()) 2383 * 2. We should have write and exec permissions on dir 2384 * 3. We can't remove anything from append-only dir 2385 * 4. We can't do anything with immutable dir (done in permission()) 2386 * 5. If the sticky bit on dir is set we should either 2387 * a. be owner of dir, or 2388 * b. be owner of victim, or 2389 * c. have CAP_FOWNER capability 2390 * 6. If the victim is append-only or immutable we can't do antyhing with 2391 * links pointing to it. 2392 * 7. If we were asked to remove a directory and victim isn't one - ENOTDIR. 2393 * 8. If we were asked to remove a non-directory and victim isn't one - EISDIR. 2394 * 9. We can't remove a root or mountpoint. 2395 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by 2396 * nfs_async_unlink(). 2397 */ 2398 static int may_delete(struct inode *dir, struct dentry *victim, bool isdir) 2399 { 2400 struct inode *inode = victim->d_inode; 2401 int error; 2402 2403 if (d_is_negative(victim)) 2404 return -ENOENT; 2405 BUG_ON(!inode); 2406 2407 BUG_ON(victim->d_parent->d_inode != dir); 2408 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE); 2409 2410 error = inode_permission(dir, MAY_WRITE | MAY_EXEC); 2411 if (error) 2412 return error; 2413 if (IS_APPEND(dir)) 2414 return -EPERM; 2415 2416 if (check_sticky(dir, inode) || IS_APPEND(inode) || 2417 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode)) 2418 return -EPERM; 2419 if (isdir) { 2420 if (!d_is_directory(victim) && !d_is_autodir(victim)) 2421 return -ENOTDIR; 2422 if (IS_ROOT(victim)) 2423 return -EBUSY; 2424 } else if (d_is_directory(victim) || d_is_autodir(victim)) 2425 return -EISDIR; 2426 if (IS_DEADDIR(dir)) 2427 return -ENOENT; 2428 if (victim->d_flags & DCACHE_NFSFS_RENAMED) 2429 return -EBUSY; 2430 return 0; 2431 } 2432 2433 /* Check whether we can create an object with dentry child in directory 2434 * dir. 2435 * 1. We can't do it if child already exists (open has special treatment for 2436 * this case, but since we are inlined it's OK) 2437 * 2. We can't do it if dir is read-only (done in permission()) 2438 * 3. We should have write and exec permissions on dir 2439 * 4. We can't do it if dir is immutable (done in permission()) 2440 */ 2441 static inline int may_create(struct inode *dir, struct dentry *child) 2442 { 2443 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE); 2444 if (child->d_inode) 2445 return -EEXIST; 2446 if (IS_DEADDIR(dir)) 2447 return -ENOENT; 2448 return inode_permission(dir, MAY_WRITE | MAY_EXEC); 2449 } 2450 2451 /* 2452 * p1 and p2 should be directories on the same fs. 2453 */ 2454 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) 2455 { 2456 struct dentry *p; 2457 2458 if (p1 == p2) { 2459 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2460 return NULL; 2461 } 2462 2463 mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 2464 2465 p = d_ancestor(p2, p1); 2466 if (p) { 2467 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT); 2468 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD); 2469 return p; 2470 } 2471 2472 p = d_ancestor(p1, p2); 2473 if (p) { 2474 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2475 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 2476 return p; 2477 } 2478 2479 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT); 2480 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD); 2481 return NULL; 2482 } 2483 2484 void unlock_rename(struct dentry *p1, struct dentry *p2) 2485 { 2486 mutex_unlock(&p1->d_inode->i_mutex); 2487 if (p1 != p2) { 2488 mutex_unlock(&p2->d_inode->i_mutex); 2489 mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex); 2490 } 2491 } 2492 2493 int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, 2494 bool want_excl) 2495 { 2496 int error = may_create(dir, dentry); 2497 if (error) 2498 return error; 2499 2500 if (!dir->i_op->create) 2501 return -EACCES; /* shouldn't it be ENOSYS? */ 2502 mode &= S_IALLUGO; 2503 mode |= S_IFREG; 2504 error = security_inode_create(dir, dentry, mode); 2505 if (error) 2506 return error; 2507 error = dir->i_op->create(dir, dentry, mode, want_excl); 2508 if (!error) 2509 fsnotify_create(dir, dentry); 2510 return error; 2511 } 2512 2513 static int may_open(struct path *path, int acc_mode, int flag) 2514 { 2515 struct dentry *dentry = path->dentry; 2516 struct inode *inode = dentry->d_inode; 2517 int error; 2518 2519 /* O_PATH? */ 2520 if (!acc_mode) 2521 return 0; 2522 2523 if (!inode) 2524 return -ENOENT; 2525 2526 switch (inode->i_mode & S_IFMT) { 2527 case S_IFLNK: 2528 return -ELOOP; 2529 case S_IFDIR: 2530 if (acc_mode & MAY_WRITE) 2531 return -EISDIR; 2532 break; 2533 case S_IFBLK: 2534 case S_IFCHR: 2535 if (path->mnt->mnt_flags & MNT_NODEV) 2536 return -EACCES; 2537 /*FALLTHRU*/ 2538 case S_IFIFO: 2539 case S_IFSOCK: 2540 flag &= ~O_TRUNC; 2541 break; 2542 } 2543 2544 error = inode_permission(inode, acc_mode); 2545 if (error) 2546 return error; 2547 2548 /* 2549 * An append-only file must be opened in append mode for writing. 2550 */ 2551 if (IS_APPEND(inode)) { 2552 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND)) 2553 return -EPERM; 2554 if (flag & O_TRUNC) 2555 return -EPERM; 2556 } 2557 2558 /* O_NOATIME can only be set by the owner or superuser */ 2559 if (flag & O_NOATIME && !inode_owner_or_capable(inode)) 2560 return -EPERM; 2561 2562 return 0; 2563 } 2564 2565 static int handle_truncate(struct file *filp) 2566 { 2567 struct path *path = &filp->f_path; 2568 struct inode *inode = path->dentry->d_inode; 2569 int error = get_write_access(inode); 2570 if (error) 2571 return error; 2572 /* 2573 * Refuse to truncate files with mandatory locks held on them. 2574 */ 2575 error = locks_verify_locked(inode); 2576 if (!error) 2577 error = security_path_truncate(path); 2578 if (!error) { 2579 error = do_truncate(path->dentry, 0, 2580 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN, 2581 filp); 2582 } 2583 put_write_access(inode); 2584 return error; 2585 } 2586 2587 static inline int open_to_namei_flags(int flag) 2588 { 2589 if ((flag & O_ACCMODE) == 3) 2590 flag--; 2591 return flag; 2592 } 2593 2594 static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode) 2595 { 2596 int error = security_path_mknod(dir, dentry, mode, 0); 2597 if (error) 2598 return error; 2599 2600 error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC); 2601 if (error) 2602 return error; 2603 2604 return security_inode_create(dir->dentry->d_inode, dentry, mode); 2605 } 2606 2607 /* 2608 * Attempt to atomically look up, create and open a file from a negative 2609 * dentry. 2610 * 2611 * Returns 0 if successful. The file will have been created and attached to 2612 * @file by the filesystem calling finish_open(). 2613 * 2614 * Returns 1 if the file was looked up only or didn't need creating. The 2615 * caller will need to perform the open themselves. @path will have been 2616 * updated to point to the new dentry. This may be negative. 2617 * 2618 * Returns an error code otherwise. 2619 */ 2620 static int atomic_open(struct nameidata *nd, struct dentry *dentry, 2621 struct path *path, struct file *file, 2622 const struct open_flags *op, 2623 bool got_write, bool need_lookup, 2624 int *opened) 2625 { 2626 struct inode *dir = nd->path.dentry->d_inode; 2627 unsigned open_flag = open_to_namei_flags(op->open_flag); 2628 umode_t mode; 2629 int error; 2630 int acc_mode; 2631 int create_error = 0; 2632 struct dentry *const DENTRY_NOT_SET = (void *) -1UL; 2633 bool excl; 2634 2635 BUG_ON(dentry->d_inode); 2636 2637 /* Don't create child dentry for a dead directory. */ 2638 if (unlikely(IS_DEADDIR(dir))) { 2639 error = -ENOENT; 2640 goto out; 2641 } 2642 2643 mode = op->mode; 2644 if ((open_flag & O_CREAT) && !IS_POSIXACL(dir)) 2645 mode &= ~current_umask(); 2646 2647 excl = (open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT); 2648 if (excl) 2649 open_flag &= ~O_TRUNC; 2650 2651 /* 2652 * Checking write permission is tricky, bacuse we don't know if we are 2653 * going to actually need it: O_CREAT opens should work as long as the 2654 * file exists. But checking existence breaks atomicity. The trick is 2655 * to check access and if not granted clear O_CREAT from the flags. 2656 * 2657 * Another problem is returing the "right" error value (e.g. for an 2658 * O_EXCL open we want to return EEXIST not EROFS). 2659 */ 2660 if (((open_flag & (O_CREAT | O_TRUNC)) || 2661 (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) { 2662 if (!(open_flag & O_CREAT)) { 2663 /* 2664 * No O_CREATE -> atomicity not a requirement -> fall 2665 * back to lookup + open 2666 */ 2667 goto no_open; 2668 } else if (open_flag & (O_EXCL | O_TRUNC)) { 2669 /* Fall back and fail with the right error */ 2670 create_error = -EROFS; 2671 goto no_open; 2672 } else { 2673 /* No side effects, safe to clear O_CREAT */ 2674 create_error = -EROFS; 2675 open_flag &= ~O_CREAT; 2676 } 2677 } 2678 2679 if (open_flag & O_CREAT) { 2680 error = may_o_create(&nd->path, dentry, mode); 2681 if (error) { 2682 create_error = error; 2683 if (open_flag & O_EXCL) 2684 goto no_open; 2685 open_flag &= ~O_CREAT; 2686 } 2687 } 2688 2689 if (nd->flags & LOOKUP_DIRECTORY) 2690 open_flag |= O_DIRECTORY; 2691 2692 file->f_path.dentry = DENTRY_NOT_SET; 2693 file->f_path.mnt = nd->path.mnt; 2694 error = dir->i_op->atomic_open(dir, dentry, file, open_flag, mode, 2695 opened); 2696 if (error < 0) { 2697 if (create_error && error == -ENOENT) 2698 error = create_error; 2699 goto out; 2700 } 2701 2702 if (error) { /* returned 1, that is */ 2703 if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) { 2704 error = -EIO; 2705 goto out; 2706 } 2707 if (file->f_path.dentry) { 2708 dput(dentry); 2709 dentry = file->f_path.dentry; 2710 } 2711 if (*opened & FILE_CREATED) 2712 fsnotify_create(dir, dentry); 2713 if (!dentry->d_inode) { 2714 WARN_ON(*opened & FILE_CREATED); 2715 if (create_error) { 2716 error = create_error; 2717 goto out; 2718 } 2719 } else { 2720 if (excl && !(*opened & FILE_CREATED)) { 2721 error = -EEXIST; 2722 goto out; 2723 } 2724 } 2725 goto looked_up; 2726 } 2727 2728 /* 2729 * We didn't have the inode before the open, so check open permission 2730 * here. 2731 */ 2732 acc_mode = op->acc_mode; 2733 if (*opened & FILE_CREATED) { 2734 WARN_ON(!(open_flag & O_CREAT)); 2735 fsnotify_create(dir, dentry); 2736 acc_mode = MAY_OPEN; 2737 } 2738 error = may_open(&file->f_path, acc_mode, open_flag); 2739 if (error) 2740 fput(file); 2741 2742 out: 2743 dput(dentry); 2744 return error; 2745 2746 no_open: 2747 if (need_lookup) { 2748 dentry = lookup_real(dir, dentry, nd->flags); 2749 if (IS_ERR(dentry)) 2750 return PTR_ERR(dentry); 2751 2752 if (create_error) { 2753 int open_flag = op->open_flag; 2754 2755 error = create_error; 2756 if ((open_flag & O_EXCL)) { 2757 if (!dentry->d_inode) 2758 goto out; 2759 } else if (!dentry->d_inode) { 2760 goto out; 2761 } else if ((open_flag & O_TRUNC) && 2762 S_ISREG(dentry->d_inode->i_mode)) { 2763 goto out; 2764 } 2765 /* will fail later, go on to get the right error */ 2766 } 2767 } 2768 looked_up: 2769 path->dentry = dentry; 2770 path->mnt = nd->path.mnt; 2771 return 1; 2772 } 2773 2774 /* 2775 * Look up and maybe create and open the last component. 2776 * 2777 * Must be called with i_mutex held on parent. 2778 * 2779 * Returns 0 if the file was successfully atomically created (if necessary) and 2780 * opened. In this case the file will be returned attached to @file. 2781 * 2782 * Returns 1 if the file was not completely opened at this time, though lookups 2783 * and creations will have been performed and the dentry returned in @path will 2784 * be positive upon return if O_CREAT was specified. If O_CREAT wasn't 2785 * specified then a negative dentry may be returned. 2786 * 2787 * An error code is returned otherwise. 2788 * 2789 * FILE_CREATE will be set in @*opened if the dentry was created and will be 2790 * cleared otherwise prior to returning. 2791 */ 2792 static int lookup_open(struct nameidata *nd, struct path *path, 2793 struct file *file, 2794 const struct open_flags *op, 2795 bool got_write, int *opened) 2796 { 2797 struct dentry *dir = nd->path.dentry; 2798 struct inode *dir_inode = dir->d_inode; 2799 struct dentry *dentry; 2800 int error; 2801 bool need_lookup; 2802 2803 *opened &= ~FILE_CREATED; 2804 dentry = lookup_dcache(&nd->last, dir, nd->flags, &need_lookup); 2805 if (IS_ERR(dentry)) 2806 return PTR_ERR(dentry); 2807 2808 /* Cached positive dentry: will open in f_op->open */ 2809 if (!need_lookup && dentry->d_inode) 2810 goto out_no_open; 2811 2812 if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) { 2813 return atomic_open(nd, dentry, path, file, op, got_write, 2814 need_lookup, opened); 2815 } 2816 2817 if (need_lookup) { 2818 BUG_ON(dentry->d_inode); 2819 2820 dentry = lookup_real(dir_inode, dentry, nd->flags); 2821 if (IS_ERR(dentry)) 2822 return PTR_ERR(dentry); 2823 } 2824 2825 /* Negative dentry, just create the file */ 2826 if (!dentry->d_inode && (op->open_flag & O_CREAT)) { 2827 umode_t mode = op->mode; 2828 if (!IS_POSIXACL(dir->d_inode)) 2829 mode &= ~current_umask(); 2830 /* 2831 * This write is needed to ensure that a 2832 * rw->ro transition does not occur between 2833 * the time when the file is created and when 2834 * a permanent write count is taken through 2835 * the 'struct file' in finish_open(). 2836 */ 2837 if (!got_write) { 2838 error = -EROFS; 2839 goto out_dput; 2840 } 2841 *opened |= FILE_CREATED; 2842 error = security_path_mknod(&nd->path, dentry, mode, 0); 2843 if (error) 2844 goto out_dput; 2845 error = vfs_create(dir->d_inode, dentry, mode, 2846 nd->flags & LOOKUP_EXCL); 2847 if (error) 2848 goto out_dput; 2849 } 2850 out_no_open: 2851 path->dentry = dentry; 2852 path->mnt = nd->path.mnt; 2853 return 1; 2854 2855 out_dput: 2856 dput(dentry); 2857 return error; 2858 } 2859 2860 /* 2861 * Handle the last step of open() 2862 */ 2863 static int do_last(struct nameidata *nd, struct path *path, 2864 struct file *file, const struct open_flags *op, 2865 int *opened, struct filename *name) 2866 { 2867 struct dentry *dir = nd->path.dentry; 2868 int open_flag = op->open_flag; 2869 bool will_truncate = (open_flag & O_TRUNC) != 0; 2870 bool got_write = false; 2871 int acc_mode = op->acc_mode; 2872 struct inode *inode; 2873 bool symlink_ok = false; 2874 struct path save_parent = { .dentry = NULL, .mnt = NULL }; 2875 bool retried = false; 2876 int error; 2877 2878 nd->flags &= ~LOOKUP_PARENT; 2879 nd->flags |= op->intent; 2880 2881 if (nd->last_type != LAST_NORM) { 2882 error = handle_dots(nd, nd->last_type); 2883 if (error) 2884 return error; 2885 goto finish_open; 2886 } 2887 2888 if (!(open_flag & O_CREAT)) { 2889 if (nd->last.name[nd->last.len]) 2890 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 2891 if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW)) 2892 symlink_ok = true; 2893 /* we _can_ be in RCU mode here */ 2894 error = lookup_fast(nd, path, &inode); 2895 if (likely(!error)) 2896 goto finish_lookup; 2897 2898 if (error < 0) 2899 goto out; 2900 2901 BUG_ON(nd->inode != dir->d_inode); 2902 } else { 2903 /* create side of things */ 2904 /* 2905 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED 2906 * has been cleared when we got to the last component we are 2907 * about to look up 2908 */ 2909 error = complete_walk(nd); 2910 if (error) 2911 return error; 2912 2913 audit_inode(name, dir, LOOKUP_PARENT); 2914 error = -EISDIR; 2915 /* trailing slashes? */ 2916 if (nd->last.name[nd->last.len]) 2917 goto out; 2918 } 2919 2920 retry_lookup: 2921 if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) { 2922 error = mnt_want_write(nd->path.mnt); 2923 if (!error) 2924 got_write = true; 2925 /* 2926 * do _not_ fail yet - we might not need that or fail with 2927 * a different error; let lookup_open() decide; we'll be 2928 * dropping this one anyway. 2929 */ 2930 } 2931 mutex_lock(&dir->d_inode->i_mutex); 2932 error = lookup_open(nd, path, file, op, got_write, opened); 2933 mutex_unlock(&dir->d_inode->i_mutex); 2934 2935 if (error <= 0) { 2936 if (error) 2937 goto out; 2938 2939 if ((*opened & FILE_CREATED) || 2940 !S_ISREG(file_inode(file)->i_mode)) 2941 will_truncate = false; 2942 2943 audit_inode(name, file->f_path.dentry, 0); 2944 goto opened; 2945 } 2946 2947 if (*opened & FILE_CREATED) { 2948 /* Don't check for write permission, don't truncate */ 2949 open_flag &= ~O_TRUNC; 2950 will_truncate = false; 2951 acc_mode = MAY_OPEN; 2952 path_to_nameidata(path, nd); 2953 goto finish_open_created; 2954 } 2955 2956 /* 2957 * create/update audit record if it already exists. 2958 */ 2959 if (d_is_positive(path->dentry)) 2960 audit_inode(name, path->dentry, 0); 2961 2962 /* 2963 * If atomic_open() acquired write access it is dropped now due to 2964 * possible mount and symlink following (this might be optimized away if 2965 * necessary...) 2966 */ 2967 if (got_write) { 2968 mnt_drop_write(nd->path.mnt); 2969 got_write = false; 2970 } 2971 2972 error = -EEXIST; 2973 if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT)) 2974 goto exit_dput; 2975 2976 error = follow_managed(path, nd->flags); 2977 if (error < 0) 2978 goto exit_dput; 2979 2980 if (error) 2981 nd->flags |= LOOKUP_JUMPED; 2982 2983 BUG_ON(nd->flags & LOOKUP_RCU); 2984 inode = path->dentry->d_inode; 2985 finish_lookup: 2986 /* we _can_ be in RCU mode here */ 2987 error = -ENOENT; 2988 if (d_is_negative(path->dentry)) { 2989 path_to_nameidata(path, nd); 2990 goto out; 2991 } 2992 2993 if (should_follow_link(path->dentry, !symlink_ok)) { 2994 if (nd->flags & LOOKUP_RCU) { 2995 if (unlikely(unlazy_walk(nd, path->dentry))) { 2996 error = -ECHILD; 2997 goto out; 2998 } 2999 } 3000 BUG_ON(inode != path->dentry->d_inode); 3001 return 1; 3002 } 3003 3004 if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path->mnt) { 3005 path_to_nameidata(path, nd); 3006 } else { 3007 save_parent.dentry = nd->path.dentry; 3008 save_parent.mnt = mntget(path->mnt); 3009 nd->path.dentry = path->dentry; 3010 3011 } 3012 nd->inode = inode; 3013 /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */ 3014 finish_open: 3015 error = complete_walk(nd); 3016 if (error) { 3017 path_put(&save_parent); 3018 return error; 3019 } 3020 audit_inode(name, nd->path.dentry, 0); 3021 error = -EISDIR; 3022 if ((open_flag & O_CREAT) && 3023 (d_is_directory(nd->path.dentry) || d_is_autodir(nd->path.dentry))) 3024 goto out; 3025 error = -ENOTDIR; 3026 if ((nd->flags & LOOKUP_DIRECTORY) && !d_is_directory(nd->path.dentry)) 3027 goto out; 3028 if (!S_ISREG(nd->inode->i_mode)) 3029 will_truncate = false; 3030 3031 if (will_truncate) { 3032 error = mnt_want_write(nd->path.mnt); 3033 if (error) 3034 goto out; 3035 got_write = true; 3036 } 3037 finish_open_created: 3038 error = may_open(&nd->path, acc_mode, open_flag); 3039 if (error) 3040 goto out; 3041 file->f_path.mnt = nd->path.mnt; 3042 error = finish_open(file, nd->path.dentry, NULL, opened); 3043 if (error) { 3044 if (error == -EOPENSTALE) 3045 goto stale_open; 3046 goto out; 3047 } 3048 opened: 3049 error = open_check_o_direct(file); 3050 if (error) 3051 goto exit_fput; 3052 error = ima_file_check(file, op->acc_mode); 3053 if (error) 3054 goto exit_fput; 3055 3056 if (will_truncate) { 3057 error = handle_truncate(file); 3058 if (error) 3059 goto exit_fput; 3060 } 3061 out: 3062 if (got_write) 3063 mnt_drop_write(nd->path.mnt); 3064 path_put(&save_parent); 3065 terminate_walk(nd); 3066 return error; 3067 3068 exit_dput: 3069 path_put_conditional(path, nd); 3070 goto out; 3071 exit_fput: 3072 fput(file); 3073 goto out; 3074 3075 stale_open: 3076 /* If no saved parent or already retried then can't retry */ 3077 if (!save_parent.dentry || retried) 3078 goto out; 3079 3080 BUG_ON(save_parent.dentry != dir); 3081 path_put(&nd->path); 3082 nd->path = save_parent; 3083 nd->inode = dir->d_inode; 3084 save_parent.mnt = NULL; 3085 save_parent.dentry = NULL; 3086 if (got_write) { 3087 mnt_drop_write(nd->path.mnt); 3088 got_write = false; 3089 } 3090 retried = true; 3091 goto retry_lookup; 3092 } 3093 3094 static int do_tmpfile(int dfd, struct filename *pathname, 3095 struct nameidata *nd, int flags, 3096 const struct open_flags *op, 3097 struct file *file, int *opened) 3098 { 3099 static const struct qstr name = QSTR_INIT("/", 1); 3100 struct dentry *dentry, *child; 3101 struct inode *dir; 3102 int error = path_lookupat(dfd, pathname->name, 3103 flags | LOOKUP_DIRECTORY, nd); 3104 if (unlikely(error)) 3105 return error; 3106 error = mnt_want_write(nd->path.mnt); 3107 if (unlikely(error)) 3108 goto out; 3109 /* we want directory to be writable */ 3110 error = inode_permission(nd->inode, MAY_WRITE | MAY_EXEC); 3111 if (error) 3112 goto out2; 3113 dentry = nd->path.dentry; 3114 dir = dentry->d_inode; 3115 if (!dir->i_op->tmpfile) { 3116 error = -EOPNOTSUPP; 3117 goto out2; 3118 } 3119 child = d_alloc(dentry, &name); 3120 if (unlikely(!child)) { 3121 error = -ENOMEM; 3122 goto out2; 3123 } 3124 nd->flags &= ~LOOKUP_DIRECTORY; 3125 nd->flags |= op->intent; 3126 dput(nd->path.dentry); 3127 nd->path.dentry = child; 3128 error = dir->i_op->tmpfile(dir, nd->path.dentry, op->mode); 3129 if (error) 3130 goto out2; 3131 audit_inode(pathname, nd->path.dentry, 0); 3132 error = may_open(&nd->path, op->acc_mode, op->open_flag); 3133 if (error) 3134 goto out2; 3135 file->f_path.mnt = nd->path.mnt; 3136 error = finish_open(file, nd->path.dentry, NULL, opened); 3137 if (error) 3138 goto out2; 3139 error = open_check_o_direct(file); 3140 if (error) { 3141 fput(file); 3142 } else if (!(op->open_flag & O_EXCL)) { 3143 struct inode *inode = file_inode(file); 3144 spin_lock(&inode->i_lock); 3145 inode->i_state |= I_LINKABLE; 3146 spin_unlock(&inode->i_lock); 3147 } 3148 out2: 3149 mnt_drop_write(nd->path.mnt); 3150 out: 3151 path_put(&nd->path); 3152 return error; 3153 } 3154 3155 static struct file *path_openat(int dfd, struct filename *pathname, 3156 struct nameidata *nd, const struct open_flags *op, int flags) 3157 { 3158 struct file *base = NULL; 3159 struct file *file; 3160 struct path path; 3161 int opened = 0; 3162 int error; 3163 3164 file = get_empty_filp(); 3165 if (IS_ERR(file)) 3166 return file; 3167 3168 file->f_flags = op->open_flag; 3169 3170 if (unlikely(file->f_flags & __O_TMPFILE)) { 3171 error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened); 3172 goto out; 3173 } 3174 3175 error = path_init(dfd, pathname->name, flags | LOOKUP_PARENT, nd, &base); 3176 if (unlikely(error)) 3177 goto out; 3178 3179 current->total_link_count = 0; 3180 error = link_path_walk(pathname->name, nd); 3181 if (unlikely(error)) 3182 goto out; 3183 3184 error = do_last(nd, &path, file, op, &opened, pathname); 3185 while (unlikely(error > 0)) { /* trailing symlink */ 3186 struct path link = path; 3187 void *cookie; 3188 if (!(nd->flags & LOOKUP_FOLLOW)) { 3189 path_put_conditional(&path, nd); 3190 path_put(&nd->path); 3191 error = -ELOOP; 3192 break; 3193 } 3194 error = may_follow_link(&link, nd); 3195 if (unlikely(error)) 3196 break; 3197 nd->flags |= LOOKUP_PARENT; 3198 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL); 3199 error = follow_link(&link, nd, &cookie); 3200 if (unlikely(error)) 3201 break; 3202 error = do_last(nd, &path, file, op, &opened, pathname); 3203 put_link(nd, &link, cookie); 3204 } 3205 out: 3206 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) 3207 path_put(&nd->root); 3208 if (base) 3209 fput(base); 3210 if (!(opened & FILE_OPENED)) { 3211 BUG_ON(!error); 3212 put_filp(file); 3213 } 3214 if (unlikely(error)) { 3215 if (error == -EOPENSTALE) { 3216 if (flags & LOOKUP_RCU) 3217 error = -ECHILD; 3218 else 3219 error = -ESTALE; 3220 } 3221 file = ERR_PTR(error); 3222 } 3223 return file; 3224 } 3225 3226 struct file *do_filp_open(int dfd, struct filename *pathname, 3227 const struct open_flags *op) 3228 { 3229 struct nameidata nd; 3230 int flags = op->lookup_flags; 3231 struct file *filp; 3232 3233 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU); 3234 if (unlikely(filp == ERR_PTR(-ECHILD))) 3235 filp = path_openat(dfd, pathname, &nd, op, flags); 3236 if (unlikely(filp == ERR_PTR(-ESTALE))) 3237 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL); 3238 return filp; 3239 } 3240 3241 struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt, 3242 const char *name, const struct open_flags *op) 3243 { 3244 struct nameidata nd; 3245 struct file *file; 3246 struct filename filename = { .name = name }; 3247 int flags = op->lookup_flags | LOOKUP_ROOT; 3248 3249 nd.root.mnt = mnt; 3250 nd.root.dentry = dentry; 3251 3252 if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN) 3253 return ERR_PTR(-ELOOP); 3254 3255 file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_RCU); 3256 if (unlikely(file == ERR_PTR(-ECHILD))) 3257 file = path_openat(-1, &filename, &nd, op, flags); 3258 if (unlikely(file == ERR_PTR(-ESTALE))) 3259 file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_REVAL); 3260 return file; 3261 } 3262 3263 struct dentry *kern_path_create(int dfd, const char *pathname, 3264 struct path *path, unsigned int lookup_flags) 3265 { 3266 struct dentry *dentry = ERR_PTR(-EEXIST); 3267 struct nameidata nd; 3268 int err2; 3269 int error; 3270 bool is_dir = (lookup_flags & LOOKUP_DIRECTORY); 3271 3272 /* 3273 * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any 3274 * other flags passed in are ignored! 3275 */ 3276 lookup_flags &= LOOKUP_REVAL; 3277 3278 error = do_path_lookup(dfd, pathname, LOOKUP_PARENT|lookup_flags, &nd); 3279 if (error) 3280 return ERR_PTR(error); 3281 3282 /* 3283 * Yucky last component or no last component at all? 3284 * (foo/., foo/.., /////) 3285 */ 3286 if (nd.last_type != LAST_NORM) 3287 goto out; 3288 nd.flags &= ~LOOKUP_PARENT; 3289 nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL; 3290 3291 /* don't fail immediately if it's r/o, at least try to report other errors */ 3292 err2 = mnt_want_write(nd.path.mnt); 3293 /* 3294 * Do the final lookup. 3295 */ 3296 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3297 dentry = lookup_hash(&nd); 3298 if (IS_ERR(dentry)) 3299 goto unlock; 3300 3301 error = -EEXIST; 3302 if (d_is_positive(dentry)) 3303 goto fail; 3304 3305 /* 3306 * Special case - lookup gave negative, but... we had foo/bar/ 3307 * From the vfs_mknod() POV we just have a negative dentry - 3308 * all is fine. Let's be bastards - you had / on the end, you've 3309 * been asking for (non-existent) directory. -ENOENT for you. 3310 */ 3311 if (unlikely(!is_dir && nd.last.name[nd.last.len])) { 3312 error = -ENOENT; 3313 goto fail; 3314 } 3315 if (unlikely(err2)) { 3316 error = err2; 3317 goto fail; 3318 } 3319 *path = nd.path; 3320 return dentry; 3321 fail: 3322 dput(dentry); 3323 dentry = ERR_PTR(error); 3324 unlock: 3325 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 3326 if (!err2) 3327 mnt_drop_write(nd.path.mnt); 3328 out: 3329 path_put(&nd.path); 3330 return dentry; 3331 } 3332 EXPORT_SYMBOL(kern_path_create); 3333 3334 void done_path_create(struct path *path, struct dentry *dentry) 3335 { 3336 dput(dentry); 3337 mutex_unlock(&path->dentry->d_inode->i_mutex); 3338 mnt_drop_write(path->mnt); 3339 path_put(path); 3340 } 3341 EXPORT_SYMBOL(done_path_create); 3342 3343 struct dentry *user_path_create(int dfd, const char __user *pathname, 3344 struct path *path, unsigned int lookup_flags) 3345 { 3346 struct filename *tmp = getname(pathname); 3347 struct dentry *res; 3348 if (IS_ERR(tmp)) 3349 return ERR_CAST(tmp); 3350 res = kern_path_create(dfd, tmp->name, path, lookup_flags); 3351 putname(tmp); 3352 return res; 3353 } 3354 EXPORT_SYMBOL(user_path_create); 3355 3356 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) 3357 { 3358 int error = may_create(dir, dentry); 3359 3360 if (error) 3361 return error; 3362 3363 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD)) 3364 return -EPERM; 3365 3366 if (!dir->i_op->mknod) 3367 return -EPERM; 3368 3369 error = devcgroup_inode_mknod(mode, dev); 3370 if (error) 3371 return error; 3372 3373 error = security_inode_mknod(dir, dentry, mode, dev); 3374 if (error) 3375 return error; 3376 3377 error = dir->i_op->mknod(dir, dentry, mode, dev); 3378 if (!error) 3379 fsnotify_create(dir, dentry); 3380 return error; 3381 } 3382 3383 static int may_mknod(umode_t mode) 3384 { 3385 switch (mode & S_IFMT) { 3386 case S_IFREG: 3387 case S_IFCHR: 3388 case S_IFBLK: 3389 case S_IFIFO: 3390 case S_IFSOCK: 3391 case 0: /* zero mode translates to S_IFREG */ 3392 return 0; 3393 case S_IFDIR: 3394 return -EPERM; 3395 default: 3396 return -EINVAL; 3397 } 3398 } 3399 3400 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, 3401 unsigned, dev) 3402 { 3403 struct dentry *dentry; 3404 struct path path; 3405 int error; 3406 unsigned int lookup_flags = 0; 3407 3408 error = may_mknod(mode); 3409 if (error) 3410 return error; 3411 retry: 3412 dentry = user_path_create(dfd, filename, &path, lookup_flags); 3413 if (IS_ERR(dentry)) 3414 return PTR_ERR(dentry); 3415 3416 if (!IS_POSIXACL(path.dentry->d_inode)) 3417 mode &= ~current_umask(); 3418 error = security_path_mknod(&path, dentry, mode, dev); 3419 if (error) 3420 goto out; 3421 switch (mode & S_IFMT) { 3422 case 0: case S_IFREG: 3423 error = vfs_create(path.dentry->d_inode,dentry,mode,true); 3424 break; 3425 case S_IFCHR: case S_IFBLK: 3426 error = vfs_mknod(path.dentry->d_inode,dentry,mode, 3427 new_decode_dev(dev)); 3428 break; 3429 case S_IFIFO: case S_IFSOCK: 3430 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0); 3431 break; 3432 } 3433 out: 3434 done_path_create(&path, dentry); 3435 if (retry_estale(error, lookup_flags)) { 3436 lookup_flags |= LOOKUP_REVAL; 3437 goto retry; 3438 } 3439 return error; 3440 } 3441 3442 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev) 3443 { 3444 return sys_mknodat(AT_FDCWD, filename, mode, dev); 3445 } 3446 3447 int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 3448 { 3449 int error = may_create(dir, dentry); 3450 unsigned max_links = dir->i_sb->s_max_links; 3451 3452 if (error) 3453 return error; 3454 3455 if (!dir->i_op->mkdir) 3456 return -EPERM; 3457 3458 mode &= (S_IRWXUGO|S_ISVTX); 3459 error = security_inode_mkdir(dir, dentry, mode); 3460 if (error) 3461 return error; 3462 3463 if (max_links && dir->i_nlink >= max_links) 3464 return -EMLINK; 3465 3466 error = dir->i_op->mkdir(dir, dentry, mode); 3467 if (!error) 3468 fsnotify_mkdir(dir, dentry); 3469 return error; 3470 } 3471 3472 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) 3473 { 3474 struct dentry *dentry; 3475 struct path path; 3476 int error; 3477 unsigned int lookup_flags = LOOKUP_DIRECTORY; 3478 3479 retry: 3480 dentry = user_path_create(dfd, pathname, &path, lookup_flags); 3481 if (IS_ERR(dentry)) 3482 return PTR_ERR(dentry); 3483 3484 if (!IS_POSIXACL(path.dentry->d_inode)) 3485 mode &= ~current_umask(); 3486 error = security_path_mkdir(&path, dentry, mode); 3487 if (!error) 3488 error = vfs_mkdir(path.dentry->d_inode, dentry, mode); 3489 done_path_create(&path, dentry); 3490 if (retry_estale(error, lookup_flags)) { 3491 lookup_flags |= LOOKUP_REVAL; 3492 goto retry; 3493 } 3494 return error; 3495 } 3496 3497 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode) 3498 { 3499 return sys_mkdirat(AT_FDCWD, pathname, mode); 3500 } 3501 3502 /* 3503 * The dentry_unhash() helper will try to drop the dentry early: we 3504 * should have a usage count of 1 if we're the only user of this 3505 * dentry, and if that is true (possibly after pruning the dcache), 3506 * then we drop the dentry now. 3507 * 3508 * A low-level filesystem can, if it choses, legally 3509 * do a 3510 * 3511 * if (!d_unhashed(dentry)) 3512 * return -EBUSY; 3513 * 3514 * if it cannot handle the case of removing a directory 3515 * that is still in use by something else.. 3516 */ 3517 void dentry_unhash(struct dentry *dentry) 3518 { 3519 shrink_dcache_parent(dentry); 3520 spin_lock(&dentry->d_lock); 3521 if (dentry->d_lockref.count == 1) 3522 __d_drop(dentry); 3523 spin_unlock(&dentry->d_lock); 3524 } 3525 3526 int vfs_rmdir(struct inode *dir, struct dentry *dentry) 3527 { 3528 int error = may_delete(dir, dentry, 1); 3529 3530 if (error) 3531 return error; 3532 3533 if (!dir->i_op->rmdir) 3534 return -EPERM; 3535 3536 dget(dentry); 3537 mutex_lock(&dentry->d_inode->i_mutex); 3538 3539 error = -EBUSY; 3540 if (d_mountpoint(dentry)) 3541 goto out; 3542 3543 error = security_inode_rmdir(dir, dentry); 3544 if (error) 3545 goto out; 3546 3547 shrink_dcache_parent(dentry); 3548 error = dir->i_op->rmdir(dir, dentry); 3549 if (error) 3550 goto out; 3551 3552 dentry->d_inode->i_flags |= S_DEAD; 3553 dont_mount(dentry); 3554 3555 out: 3556 mutex_unlock(&dentry->d_inode->i_mutex); 3557 dput(dentry); 3558 if (!error) 3559 d_delete(dentry); 3560 return error; 3561 } 3562 3563 static long do_rmdir(int dfd, const char __user *pathname) 3564 { 3565 int error = 0; 3566 struct filename *name; 3567 struct dentry *dentry; 3568 struct nameidata nd; 3569 unsigned int lookup_flags = 0; 3570 retry: 3571 name = user_path_parent(dfd, pathname, &nd, lookup_flags); 3572 if (IS_ERR(name)) 3573 return PTR_ERR(name); 3574 3575 switch(nd.last_type) { 3576 case LAST_DOTDOT: 3577 error = -ENOTEMPTY; 3578 goto exit1; 3579 case LAST_DOT: 3580 error = -EINVAL; 3581 goto exit1; 3582 case LAST_ROOT: 3583 error = -EBUSY; 3584 goto exit1; 3585 } 3586 3587 nd.flags &= ~LOOKUP_PARENT; 3588 error = mnt_want_write(nd.path.mnt); 3589 if (error) 3590 goto exit1; 3591 3592 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3593 dentry = lookup_hash(&nd); 3594 error = PTR_ERR(dentry); 3595 if (IS_ERR(dentry)) 3596 goto exit2; 3597 if (!dentry->d_inode) { 3598 error = -ENOENT; 3599 goto exit3; 3600 } 3601 error = security_path_rmdir(&nd.path, dentry); 3602 if (error) 3603 goto exit3; 3604 error = vfs_rmdir(nd.path.dentry->d_inode, dentry); 3605 exit3: 3606 dput(dentry); 3607 exit2: 3608 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 3609 mnt_drop_write(nd.path.mnt); 3610 exit1: 3611 path_put(&nd.path); 3612 putname(name); 3613 if (retry_estale(error, lookup_flags)) { 3614 lookup_flags |= LOOKUP_REVAL; 3615 goto retry; 3616 } 3617 return error; 3618 } 3619 3620 SYSCALL_DEFINE1(rmdir, const char __user *, pathname) 3621 { 3622 return do_rmdir(AT_FDCWD, pathname); 3623 } 3624 3625 /** 3626 * vfs_unlink - unlink a filesystem object 3627 * @dir: parent directory 3628 * @dentry: victim 3629 * @delegated_inode: returns victim inode, if the inode is delegated. 3630 * 3631 * The caller must hold dir->i_mutex. 3632 * 3633 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and 3634 * return a reference to the inode in delegated_inode. The caller 3635 * should then break the delegation on that inode and retry. Because 3636 * breaking a delegation may take a long time, the caller should drop 3637 * dir->i_mutex before doing so. 3638 * 3639 * Alternatively, a caller may pass NULL for delegated_inode. This may 3640 * be appropriate for callers that expect the underlying filesystem not 3641 * to be NFS exported. 3642 */ 3643 int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode) 3644 { 3645 struct inode *target = dentry->d_inode; 3646 int error = may_delete(dir, dentry, 0); 3647 3648 if (error) 3649 return error; 3650 3651 if (!dir->i_op->unlink) 3652 return -EPERM; 3653 3654 mutex_lock(&target->i_mutex); 3655 if (d_mountpoint(dentry)) 3656 error = -EBUSY; 3657 else { 3658 error = security_inode_unlink(dir, dentry); 3659 if (!error) { 3660 error = try_break_deleg(target, delegated_inode); 3661 if (error) 3662 goto out; 3663 error = dir->i_op->unlink(dir, dentry); 3664 if (!error) 3665 dont_mount(dentry); 3666 } 3667 } 3668 out: 3669 mutex_unlock(&target->i_mutex); 3670 3671 /* We don't d_delete() NFS sillyrenamed files--they still exist. */ 3672 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) { 3673 fsnotify_link_count(target); 3674 d_delete(dentry); 3675 } 3676 3677 return error; 3678 } 3679 3680 /* 3681 * Make sure that the actual truncation of the file will occur outside its 3682 * directory's i_mutex. Truncate can take a long time if there is a lot of 3683 * writeout happening, and we don't want to prevent access to the directory 3684 * while waiting on the I/O. 3685 */ 3686 static long do_unlinkat(int dfd, const char __user *pathname) 3687 { 3688 int error; 3689 struct filename *name; 3690 struct dentry *dentry; 3691 struct nameidata nd; 3692 struct inode *inode = NULL; 3693 struct inode *delegated_inode = NULL; 3694 unsigned int lookup_flags = 0; 3695 retry: 3696 name = user_path_parent(dfd, pathname, &nd, lookup_flags); 3697 if (IS_ERR(name)) 3698 return PTR_ERR(name); 3699 3700 error = -EISDIR; 3701 if (nd.last_type != LAST_NORM) 3702 goto exit1; 3703 3704 nd.flags &= ~LOOKUP_PARENT; 3705 error = mnt_want_write(nd.path.mnt); 3706 if (error) 3707 goto exit1; 3708 retry_deleg: 3709 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT); 3710 dentry = lookup_hash(&nd); 3711 error = PTR_ERR(dentry); 3712 if (!IS_ERR(dentry)) { 3713 /* Why not before? Because we want correct error value */ 3714 if (nd.last.name[nd.last.len]) 3715 goto slashes; 3716 inode = dentry->d_inode; 3717 if (d_is_negative(dentry)) 3718 goto slashes; 3719 ihold(inode); 3720 error = security_path_unlink(&nd.path, dentry); 3721 if (error) 3722 goto exit2; 3723 error = vfs_unlink(nd.path.dentry->d_inode, dentry, &delegated_inode); 3724 exit2: 3725 dput(dentry); 3726 } 3727 mutex_unlock(&nd.path.dentry->d_inode->i_mutex); 3728 if (inode) 3729 iput(inode); /* truncate the inode here */ 3730 inode = NULL; 3731 if (delegated_inode) { 3732 error = break_deleg_wait(&delegated_inode); 3733 if (!error) 3734 goto retry_deleg; 3735 } 3736 mnt_drop_write(nd.path.mnt); 3737 exit1: 3738 path_put(&nd.path); 3739 putname(name); 3740 if (retry_estale(error, lookup_flags)) { 3741 lookup_flags |= LOOKUP_REVAL; 3742 inode = NULL; 3743 goto retry; 3744 } 3745 return error; 3746 3747 slashes: 3748 if (d_is_negative(dentry)) 3749 error = -ENOENT; 3750 else if (d_is_directory(dentry) || d_is_autodir(dentry)) 3751 error = -EISDIR; 3752 else 3753 error = -ENOTDIR; 3754 goto exit2; 3755 } 3756 3757 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) 3758 { 3759 if ((flag & ~AT_REMOVEDIR) != 0) 3760 return -EINVAL; 3761 3762 if (flag & AT_REMOVEDIR) 3763 return do_rmdir(dfd, pathname); 3764 3765 return do_unlinkat(dfd, pathname); 3766 } 3767 3768 SYSCALL_DEFINE1(unlink, const char __user *, pathname) 3769 { 3770 return do_unlinkat(AT_FDCWD, pathname); 3771 } 3772 3773 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname) 3774 { 3775 int error = may_create(dir, dentry); 3776 3777 if (error) 3778 return error; 3779 3780 if (!dir->i_op->symlink) 3781 return -EPERM; 3782 3783 error = security_inode_symlink(dir, dentry, oldname); 3784 if (error) 3785 return error; 3786 3787 error = dir->i_op->symlink(dir, dentry, oldname); 3788 if (!error) 3789 fsnotify_create(dir, dentry); 3790 return error; 3791 } 3792 3793 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, 3794 int, newdfd, const char __user *, newname) 3795 { 3796 int error; 3797 struct filename *from; 3798 struct dentry *dentry; 3799 struct path path; 3800 unsigned int lookup_flags = 0; 3801 3802 from = getname(oldname); 3803 if (IS_ERR(from)) 3804 return PTR_ERR(from); 3805 retry: 3806 dentry = user_path_create(newdfd, newname, &path, lookup_flags); 3807 error = PTR_ERR(dentry); 3808 if (IS_ERR(dentry)) 3809 goto out_putname; 3810 3811 error = security_path_symlink(&path, dentry, from->name); 3812 if (!error) 3813 error = vfs_symlink(path.dentry->d_inode, dentry, from->name); 3814 done_path_create(&path, dentry); 3815 if (retry_estale(error, lookup_flags)) { 3816 lookup_flags |= LOOKUP_REVAL; 3817 goto retry; 3818 } 3819 out_putname: 3820 putname(from); 3821 return error; 3822 } 3823 3824 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname) 3825 { 3826 return sys_symlinkat(oldname, AT_FDCWD, newname); 3827 } 3828 3829 /** 3830 * vfs_link - create a new link 3831 * @old_dentry: object to be linked 3832 * @dir: new parent 3833 * @new_dentry: where to create the new link 3834 * @delegated_inode: returns inode needing a delegation break 3835 * 3836 * The caller must hold dir->i_mutex 3837 * 3838 * If vfs_link discovers a delegation on the to-be-linked file in need 3839 * of breaking, it will return -EWOULDBLOCK and return a reference to the 3840 * inode in delegated_inode. The caller should then break the delegation 3841 * and retry. Because breaking a delegation may take a long time, the 3842 * caller should drop the i_mutex before doing so. 3843 * 3844 * Alternatively, a caller may pass NULL for delegated_inode. This may 3845 * be appropriate for callers that expect the underlying filesystem not 3846 * to be NFS exported. 3847 */ 3848 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode) 3849 { 3850 struct inode *inode = old_dentry->d_inode; 3851 unsigned max_links = dir->i_sb->s_max_links; 3852 int error; 3853 3854 if (!inode) 3855 return -ENOENT; 3856 3857 error = may_create(dir, new_dentry); 3858 if (error) 3859 return error; 3860 3861 if (dir->i_sb != inode->i_sb) 3862 return -EXDEV; 3863 3864 /* 3865 * A link to an append-only or immutable file cannot be created. 3866 */ 3867 if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) 3868 return -EPERM; 3869 if (!dir->i_op->link) 3870 return -EPERM; 3871 if (S_ISDIR(inode->i_mode)) 3872 return -EPERM; 3873 3874 error = security_inode_link(old_dentry, dir, new_dentry); 3875 if (error) 3876 return error; 3877 3878 mutex_lock(&inode->i_mutex); 3879 /* Make sure we don't allow creating hardlink to an unlinked file */ 3880 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE)) 3881 error = -ENOENT; 3882 else if (max_links && inode->i_nlink >= max_links) 3883 error = -EMLINK; 3884 else { 3885 error = try_break_deleg(inode, delegated_inode); 3886 if (!error) 3887 error = dir->i_op->link(old_dentry, dir, new_dentry); 3888 } 3889 3890 if (!error && (inode->i_state & I_LINKABLE)) { 3891 spin_lock(&inode->i_lock); 3892 inode->i_state &= ~I_LINKABLE; 3893 spin_unlock(&inode->i_lock); 3894 } 3895 mutex_unlock(&inode->i_mutex); 3896 if (!error) 3897 fsnotify_link(dir, inode, new_dentry); 3898 return error; 3899 } 3900 3901 /* 3902 * Hardlinks are often used in delicate situations. We avoid 3903 * security-related surprises by not following symlinks on the 3904 * newname. --KAB 3905 * 3906 * We don't follow them on the oldname either to be compatible 3907 * with linux 2.0, and to avoid hard-linking to directories 3908 * and other special files. --ADM 3909 */ 3910 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, 3911 int, newdfd, const char __user *, newname, int, flags) 3912 { 3913 struct dentry *new_dentry; 3914 struct path old_path, new_path; 3915 struct inode *delegated_inode = NULL; 3916 int how = 0; 3917 int error; 3918 3919 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) 3920 return -EINVAL; 3921 /* 3922 * To use null names we require CAP_DAC_READ_SEARCH 3923 * This ensures that not everyone will be able to create 3924 * handlink using the passed filedescriptor. 3925 */ 3926 if (flags & AT_EMPTY_PATH) { 3927 if (!capable(CAP_DAC_READ_SEARCH)) 3928 return -ENOENT; 3929 how = LOOKUP_EMPTY; 3930 } 3931 3932 if (flags & AT_SYMLINK_FOLLOW) 3933 how |= LOOKUP_FOLLOW; 3934 retry: 3935 error = user_path_at(olddfd, oldname, how, &old_path); 3936 if (error) 3937 return error; 3938 3939 new_dentry = user_path_create(newdfd, newname, &new_path, 3940 (how & LOOKUP_REVAL)); 3941 error = PTR_ERR(new_dentry); 3942 if (IS_ERR(new_dentry)) 3943 goto out; 3944 3945 error = -EXDEV; 3946 if (old_path.mnt != new_path.mnt) 3947 goto out_dput; 3948 error = may_linkat(&old_path); 3949 if (unlikely(error)) 3950 goto out_dput; 3951 error = security_path_link(old_path.dentry, &new_path, new_dentry); 3952 if (error) 3953 goto out_dput; 3954 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode); 3955 out_dput: 3956 done_path_create(&new_path, new_dentry); 3957 if (delegated_inode) { 3958 error = break_deleg_wait(&delegated_inode); 3959 if (!error) { 3960 path_put(&old_path); 3961 goto retry; 3962 } 3963 } 3964 if (retry_estale(error, how)) { 3965 path_put(&old_path); 3966 how |= LOOKUP_REVAL; 3967 goto retry; 3968 } 3969 out: 3970 path_put(&old_path); 3971 3972 return error; 3973 } 3974 3975 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname) 3976 { 3977 return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0); 3978 } 3979 3980 /* 3981 * The worst of all namespace operations - renaming directory. "Perverted" 3982 * doesn't even start to describe it. Somebody in UCB had a heck of a trip... 3983 * Problems: 3984 * a) we can get into loop creation. Check is done in is_subdir(). 3985 * b) race potential - two innocent renames can create a loop together. 3986 * That's where 4.4 screws up. Current fix: serialization on 3987 * sb->s_vfs_rename_mutex. We might be more accurate, but that's another 3988 * story. 3989 * c) we have to lock _four_ objects - parents and victim (if it exists), 3990 * and source (if it is not a directory). 3991 * And that - after we got ->i_mutex on parents (until then we don't know 3992 * whether the target exists). Solution: try to be smart with locking 3993 * order for inodes. We rely on the fact that tree topology may change 3994 * only under ->s_vfs_rename_mutex _and_ that parent of the object we 3995 * move will be locked. Thus we can rank directories by the tree 3996 * (ancestors first) and rank all non-directories after them. 3997 * That works since everybody except rename does "lock parent, lookup, 3998 * lock child" and rename is under ->s_vfs_rename_mutex. 3999 * HOWEVER, it relies on the assumption that any object with ->lookup() 4000 * has no more than 1 dentry. If "hybrid" objects will ever appear, 4001 * we'd better make sure that there's no link(2) for them. 4002 * d) conversion from fhandle to dentry may come in the wrong moment - when 4003 * we are removing the target. Solution: we will have to grab ->i_mutex 4004 * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on 4005 * ->i_mutex on parents, which works but leads to some truly excessive 4006 * locking]. 4007 */ 4008 static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry, 4009 struct inode *new_dir, struct dentry *new_dentry) 4010 { 4011 int error = 0; 4012 struct inode *target = new_dentry->d_inode; 4013 unsigned max_links = new_dir->i_sb->s_max_links; 4014 4015 /* 4016 * If we are going to change the parent - check write permissions, 4017 * we'll need to flip '..'. 4018 */ 4019 if (new_dir != old_dir) { 4020 error = inode_permission(old_dentry->d_inode, MAY_WRITE); 4021 if (error) 4022 return error; 4023 } 4024 4025 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry); 4026 if (error) 4027 return error; 4028 4029 dget(new_dentry); 4030 if (target) 4031 mutex_lock(&target->i_mutex); 4032 4033 error = -EBUSY; 4034 if (d_mountpoint(old_dentry) || d_mountpoint(new_dentry)) 4035 goto out; 4036 4037 error = -EMLINK; 4038 if (max_links && !target && new_dir != old_dir && 4039 new_dir->i_nlink >= max_links) 4040 goto out; 4041 4042 if (target) 4043 shrink_dcache_parent(new_dentry); 4044 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry); 4045 if (error) 4046 goto out; 4047 4048 if (target) { 4049 target->i_flags |= S_DEAD; 4050 dont_mount(new_dentry); 4051 } 4052 out: 4053 if (target) 4054 mutex_unlock(&target->i_mutex); 4055 dput(new_dentry); 4056 if (!error) 4057 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) 4058 d_move(old_dentry,new_dentry); 4059 return error; 4060 } 4061 4062 static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry, 4063 struct inode *new_dir, struct dentry *new_dentry, 4064 struct inode **delegated_inode) 4065 { 4066 struct inode *target = new_dentry->d_inode; 4067 struct inode *source = old_dentry->d_inode; 4068 int error; 4069 4070 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry); 4071 if (error) 4072 return error; 4073 4074 dget(new_dentry); 4075 lock_two_nondirectories(source, target); 4076 4077 error = -EBUSY; 4078 if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry)) 4079 goto out; 4080 4081 error = try_break_deleg(source, delegated_inode); 4082 if (error) 4083 goto out; 4084 if (target) { 4085 error = try_break_deleg(target, delegated_inode); 4086 if (error) 4087 goto out; 4088 } 4089 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry); 4090 if (error) 4091 goto out; 4092 4093 if (target) 4094 dont_mount(new_dentry); 4095 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) 4096 d_move(old_dentry, new_dentry); 4097 out: 4098 unlock_two_nondirectories(source, target); 4099 dput(new_dentry); 4100 return error; 4101 } 4102 4103 /** 4104 * vfs_rename - rename a filesystem object 4105 * @old_dir: parent of source 4106 * @old_dentry: source 4107 * @new_dir: parent of destination 4108 * @new_dentry: destination 4109 * @delegated_inode: returns an inode needing a delegation break 4110 * 4111 * The caller must hold multiple mutexes--see lock_rename()). 4112 * 4113 * If vfs_rename discovers a delegation in need of breaking at either 4114 * the source or destination, it will return -EWOULDBLOCK and return a 4115 * reference to the inode in delegated_inode. The caller should then 4116 * break the delegation and retry. Because breaking a delegation may 4117 * take a long time, the caller should drop all locks before doing 4118 * so. 4119 * 4120 * Alternatively, a caller may pass NULL for delegated_inode. This may 4121 * be appropriate for callers that expect the underlying filesystem not 4122 * to be NFS exported. 4123 */ 4124 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, 4125 struct inode *new_dir, struct dentry *new_dentry, 4126 struct inode **delegated_inode) 4127 { 4128 int error; 4129 int is_dir = d_is_directory(old_dentry) || d_is_autodir(old_dentry); 4130 const unsigned char *old_name; 4131 4132 if (old_dentry->d_inode == new_dentry->d_inode) 4133 return 0; 4134 4135 error = may_delete(old_dir, old_dentry, is_dir); 4136 if (error) 4137 return error; 4138 4139 if (!new_dentry->d_inode) 4140 error = may_create(new_dir, new_dentry); 4141 else 4142 error = may_delete(new_dir, new_dentry, is_dir); 4143 if (error) 4144 return error; 4145 4146 if (!old_dir->i_op->rename) 4147 return -EPERM; 4148 4149 old_name = fsnotify_oldname_init(old_dentry->d_name.name); 4150 4151 if (is_dir) 4152 error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry); 4153 else 4154 error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry,delegated_inode); 4155 if (!error) 4156 fsnotify_move(old_dir, new_dir, old_name, is_dir, 4157 new_dentry->d_inode, old_dentry); 4158 fsnotify_oldname_free(old_name); 4159 4160 return error; 4161 } 4162 4163 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, 4164 int, newdfd, const char __user *, newname) 4165 { 4166 struct dentry *old_dir, *new_dir; 4167 struct dentry *old_dentry, *new_dentry; 4168 struct dentry *trap; 4169 struct nameidata oldnd, newnd; 4170 struct inode *delegated_inode = NULL; 4171 struct filename *from; 4172 struct filename *to; 4173 unsigned int lookup_flags = 0; 4174 bool should_retry = false; 4175 int error; 4176 retry: 4177 from = user_path_parent(olddfd, oldname, &oldnd, lookup_flags); 4178 if (IS_ERR(from)) { 4179 error = PTR_ERR(from); 4180 goto exit; 4181 } 4182 4183 to = user_path_parent(newdfd, newname, &newnd, lookup_flags); 4184 if (IS_ERR(to)) { 4185 error = PTR_ERR(to); 4186 goto exit1; 4187 } 4188 4189 error = -EXDEV; 4190 if (oldnd.path.mnt != newnd.path.mnt) 4191 goto exit2; 4192 4193 old_dir = oldnd.path.dentry; 4194 error = -EBUSY; 4195 if (oldnd.last_type != LAST_NORM) 4196 goto exit2; 4197 4198 new_dir = newnd.path.dentry; 4199 if (newnd.last_type != LAST_NORM) 4200 goto exit2; 4201 4202 error = mnt_want_write(oldnd.path.mnt); 4203 if (error) 4204 goto exit2; 4205 4206 oldnd.flags &= ~LOOKUP_PARENT; 4207 newnd.flags &= ~LOOKUP_PARENT; 4208 newnd.flags |= LOOKUP_RENAME_TARGET; 4209 4210 retry_deleg: 4211 trap = lock_rename(new_dir, old_dir); 4212 4213 old_dentry = lookup_hash(&oldnd); 4214 error = PTR_ERR(old_dentry); 4215 if (IS_ERR(old_dentry)) 4216 goto exit3; 4217 /* source must exist */ 4218 error = -ENOENT; 4219 if (d_is_negative(old_dentry)) 4220 goto exit4; 4221 /* unless the source is a directory trailing slashes give -ENOTDIR */ 4222 if (!d_is_directory(old_dentry) && !d_is_autodir(old_dentry)) { 4223 error = -ENOTDIR; 4224 if (oldnd.last.name[oldnd.last.len]) 4225 goto exit4; 4226 if (newnd.last.name[newnd.last.len]) 4227 goto exit4; 4228 } 4229 /* source should not be ancestor of target */ 4230 error = -EINVAL; 4231 if (old_dentry == trap) 4232 goto exit4; 4233 new_dentry = lookup_hash(&newnd); 4234 error = PTR_ERR(new_dentry); 4235 if (IS_ERR(new_dentry)) 4236 goto exit4; 4237 /* target should not be an ancestor of source */ 4238 error = -ENOTEMPTY; 4239 if (new_dentry == trap) 4240 goto exit5; 4241 4242 error = security_path_rename(&oldnd.path, old_dentry, 4243 &newnd.path, new_dentry); 4244 if (error) 4245 goto exit5; 4246 error = vfs_rename(old_dir->d_inode, old_dentry, 4247 new_dir->d_inode, new_dentry, 4248 &delegated_inode); 4249 exit5: 4250 dput(new_dentry); 4251 exit4: 4252 dput(old_dentry); 4253 exit3: 4254 unlock_rename(new_dir, old_dir); 4255 if (delegated_inode) { 4256 error = break_deleg_wait(&delegated_inode); 4257 if (!error) 4258 goto retry_deleg; 4259 } 4260 mnt_drop_write(oldnd.path.mnt); 4261 exit2: 4262 if (retry_estale(error, lookup_flags)) 4263 should_retry = true; 4264 path_put(&newnd.path); 4265 putname(to); 4266 exit1: 4267 path_put(&oldnd.path); 4268 putname(from); 4269 if (should_retry) { 4270 should_retry = false; 4271 lookup_flags |= LOOKUP_REVAL; 4272 goto retry; 4273 } 4274 exit: 4275 return error; 4276 } 4277 4278 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname) 4279 { 4280 return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname); 4281 } 4282 4283 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link) 4284 { 4285 int len; 4286 4287 len = PTR_ERR(link); 4288 if (IS_ERR(link)) 4289 goto out; 4290 4291 len = strlen(link); 4292 if (len > (unsigned) buflen) 4293 len = buflen; 4294 if (copy_to_user(buffer, link, len)) 4295 len = -EFAULT; 4296 out: 4297 return len; 4298 } 4299 4300 /* 4301 * A helper for ->readlink(). This should be used *ONLY* for symlinks that 4302 * have ->follow_link() touching nd only in nd_set_link(). Using (or not 4303 * using) it for any given inode is up to filesystem. 4304 */ 4305 int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4306 { 4307 struct nameidata nd; 4308 void *cookie; 4309 int res; 4310 4311 nd.depth = 0; 4312 cookie = dentry->d_inode->i_op->follow_link(dentry, &nd); 4313 if (IS_ERR(cookie)) 4314 return PTR_ERR(cookie); 4315 4316 res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd)); 4317 if (dentry->d_inode->i_op->put_link) 4318 dentry->d_inode->i_op->put_link(dentry, &nd, cookie); 4319 return res; 4320 } 4321 4322 /* get the link contents into pagecache */ 4323 static char *page_getlink(struct dentry * dentry, struct page **ppage) 4324 { 4325 char *kaddr; 4326 struct page *page; 4327 struct address_space *mapping = dentry->d_inode->i_mapping; 4328 page = read_mapping_page(mapping, 0, NULL); 4329 if (IS_ERR(page)) 4330 return (char*)page; 4331 *ppage = page; 4332 kaddr = kmap(page); 4333 nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1); 4334 return kaddr; 4335 } 4336 4337 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen) 4338 { 4339 struct page *page = NULL; 4340 char *s = page_getlink(dentry, &page); 4341 int res = vfs_readlink(dentry,buffer,buflen,s); 4342 if (page) { 4343 kunmap(page); 4344 page_cache_release(page); 4345 } 4346 return res; 4347 } 4348 4349 void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd) 4350 { 4351 struct page *page = NULL; 4352 nd_set_link(nd, page_getlink(dentry, &page)); 4353 return page; 4354 } 4355 4356 void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie) 4357 { 4358 struct page *page = cookie; 4359 4360 if (page) { 4361 kunmap(page); 4362 page_cache_release(page); 4363 } 4364 } 4365 4366 /* 4367 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS 4368 */ 4369 int __page_symlink(struct inode *inode, const char *symname, int len, int nofs) 4370 { 4371 struct address_space *mapping = inode->i_mapping; 4372 struct page *page; 4373 void *fsdata; 4374 int err; 4375 char *kaddr; 4376 unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE; 4377 if (nofs) 4378 flags |= AOP_FLAG_NOFS; 4379 4380 retry: 4381 err = pagecache_write_begin(NULL, mapping, 0, len-1, 4382 flags, &page, &fsdata); 4383 if (err) 4384 goto fail; 4385 4386 kaddr = kmap_atomic(page); 4387 memcpy(kaddr, symname, len-1); 4388 kunmap_atomic(kaddr); 4389 4390 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1, 4391 page, fsdata); 4392 if (err < 0) 4393 goto fail; 4394 if (err < len-1) 4395 goto retry; 4396 4397 mark_inode_dirty(inode); 4398 return 0; 4399 fail: 4400 return err; 4401 } 4402 4403 int page_symlink(struct inode *inode, const char *symname, int len) 4404 { 4405 return __page_symlink(inode, symname, len, 4406 !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS)); 4407 } 4408 4409 const struct inode_operations page_symlink_inode_operations = { 4410 .readlink = generic_readlink, 4411 .follow_link = page_follow_link_light, 4412 .put_link = page_put_link, 4413 }; 4414 4415 EXPORT_SYMBOL(user_path_at); 4416 EXPORT_SYMBOL(follow_down_one); 4417 EXPORT_SYMBOL(follow_down); 4418 EXPORT_SYMBOL(follow_up); 4419 EXPORT_SYMBOL(get_write_access); /* nfsd */ 4420 EXPORT_SYMBOL(lock_rename); 4421 EXPORT_SYMBOL(lookup_one_len); 4422 EXPORT_SYMBOL(page_follow_link_light); 4423 EXPORT_SYMBOL(page_put_link); 4424 EXPORT_SYMBOL(page_readlink); 4425 EXPORT_SYMBOL(__page_symlink); 4426 EXPORT_SYMBOL(page_symlink); 4427 EXPORT_SYMBOL(page_symlink_inode_operations); 4428 EXPORT_SYMBOL(kern_path); 4429 EXPORT_SYMBOL(vfs_path_lookup); 4430 EXPORT_SYMBOL(inode_permission); 4431 EXPORT_SYMBOL(unlock_rename); 4432 EXPORT_SYMBOL(vfs_create); 4433 EXPORT_SYMBOL(vfs_link); 4434 EXPORT_SYMBOL(vfs_mkdir); 4435 EXPORT_SYMBOL(vfs_mknod); 4436 EXPORT_SYMBOL(generic_permission); 4437 EXPORT_SYMBOL(vfs_readlink); 4438 EXPORT_SYMBOL(vfs_rename); 4439 EXPORT_SYMBOL(vfs_rmdir); 4440 EXPORT_SYMBOL(vfs_symlink); 4441 EXPORT_SYMBOL(vfs_unlink); 4442 EXPORT_SYMBOL(dentry_unhash); 4443 EXPORT_SYMBOL(generic_readlink); 4444