1 /* 2 * 3 * Copyright (C) 2011 Novell Inc. 4 * 5 * This program is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 as published by 7 * the Free Software Foundation. 8 */ 9 10 #include <linux/module.h> 11 #include <linux/fs.h> 12 #include <linux/slab.h> 13 #include <linux/file.h> 14 #include <linux/splice.h> 15 #include <linux/xattr.h> 16 #include <linux/security.h> 17 #include <linux/uaccess.h> 18 #include <linux/sched/signal.h> 19 #include <linux/cred.h> 20 #include <linux/namei.h> 21 #include <linux/fdtable.h> 22 #include <linux/ratelimit.h> 23 #include <linux/exportfs.h> 24 #include "overlayfs.h" 25 #include "ovl_entry.h" 26 27 #define OVL_COPY_UP_CHUNK_SIZE (1 << 20) 28 29 static bool __read_mostly ovl_check_copy_up; 30 module_param_named(check_copy_up, ovl_check_copy_up, bool, 31 S_IWUSR | S_IRUGO); 32 MODULE_PARM_DESC(ovl_check_copy_up, 33 "Warn on copy-up when causing process also has a R/O fd open"); 34 35 static int ovl_check_fd(const void *data, struct file *f, unsigned int fd) 36 { 37 const struct dentry *dentry = data; 38 39 if (file_inode(f) == d_inode(dentry)) 40 pr_warn_ratelimited("overlayfs: Warning: Copying up %pD, but open R/O on fd %u which will cease to be coherent [pid=%d %s]\n", 41 f, fd, current->pid, current->comm); 42 return 0; 43 } 44 45 /* 46 * Check the fds open by this process and warn if something like the following 47 * scenario is about to occur: 48 * 49 * fd1 = open("foo", O_RDONLY); 50 * fd2 = open("foo", O_RDWR); 51 */ 52 static void ovl_do_check_copy_up(struct dentry *dentry) 53 { 54 if (ovl_check_copy_up) 55 iterate_fd(current->files, 0, ovl_check_fd, dentry); 56 } 57 58 int ovl_copy_xattr(struct dentry *old, struct dentry *new) 59 { 60 ssize_t list_size, size, value_size = 0; 61 char *buf, *name, *value = NULL; 62 int uninitialized_var(error); 63 size_t slen; 64 65 if (!(old->d_inode->i_opflags & IOP_XATTR) || 66 !(new->d_inode->i_opflags & IOP_XATTR)) 67 return 0; 68 69 list_size = vfs_listxattr(old, NULL, 0); 70 if (list_size <= 0) { 71 if (list_size == -EOPNOTSUPP) 72 return 0; 73 return list_size; 74 } 75 76 buf = kzalloc(list_size, GFP_KERNEL); 77 if (!buf) 78 return -ENOMEM; 79 80 list_size = vfs_listxattr(old, buf, list_size); 81 if (list_size <= 0) { 82 error = list_size; 83 goto out; 84 } 85 86 for (name = buf; list_size; name += slen) { 87 slen = strnlen(name, list_size) + 1; 88 89 /* underlying fs providing us with an broken xattr list? */ 90 if (WARN_ON(slen > list_size)) { 91 error = -EIO; 92 break; 93 } 94 list_size -= slen; 95 96 if (ovl_is_private_xattr(name)) 97 continue; 98 retry: 99 size = vfs_getxattr(old, name, value, value_size); 100 if (size == -ERANGE) 101 size = vfs_getxattr(old, name, NULL, 0); 102 103 if (size < 0) { 104 error = size; 105 break; 106 } 107 108 if (size > value_size) { 109 void *new; 110 111 new = krealloc(value, size, GFP_KERNEL); 112 if (!new) { 113 error = -ENOMEM; 114 break; 115 } 116 value = new; 117 value_size = size; 118 goto retry; 119 } 120 121 error = security_inode_copy_up_xattr(name); 122 if (error < 0 && error != -EOPNOTSUPP) 123 break; 124 if (error == 1) { 125 error = 0; 126 continue; /* Discard */ 127 } 128 error = vfs_setxattr(new, name, value, size, 0); 129 if (error) 130 break; 131 } 132 kfree(value); 133 out: 134 kfree(buf); 135 return error; 136 } 137 138 static int ovl_copy_up_data(struct path *old, struct path *new, loff_t len) 139 { 140 struct file *old_file; 141 struct file *new_file; 142 loff_t old_pos = 0; 143 loff_t new_pos = 0; 144 int error = 0; 145 146 if (len == 0) 147 return 0; 148 149 old_file = ovl_path_open(old, O_LARGEFILE | O_RDONLY); 150 if (IS_ERR(old_file)) 151 return PTR_ERR(old_file); 152 153 new_file = ovl_path_open(new, O_LARGEFILE | O_WRONLY); 154 if (IS_ERR(new_file)) { 155 error = PTR_ERR(new_file); 156 goto out_fput; 157 } 158 159 /* Try to use clone_file_range to clone up within the same fs */ 160 error = vfs_clone_file_range(old_file, 0, new_file, 0, len); 161 if (!error) 162 goto out; 163 /* Couldn't clone, so now we try to copy the data */ 164 error = 0; 165 166 /* FIXME: copy up sparse files efficiently */ 167 while (len) { 168 size_t this_len = OVL_COPY_UP_CHUNK_SIZE; 169 long bytes; 170 171 if (len < this_len) 172 this_len = len; 173 174 if (signal_pending_state(TASK_KILLABLE, current)) { 175 error = -EINTR; 176 break; 177 } 178 179 bytes = do_splice_direct(old_file, &old_pos, 180 new_file, &new_pos, 181 this_len, SPLICE_F_MOVE); 182 if (bytes <= 0) { 183 error = bytes; 184 break; 185 } 186 WARN_ON(old_pos != new_pos); 187 188 len -= bytes; 189 } 190 out: 191 if (!error) 192 error = vfs_fsync(new_file, 0); 193 fput(new_file); 194 out_fput: 195 fput(old_file); 196 return error; 197 } 198 199 static int ovl_set_timestamps(struct dentry *upperdentry, struct kstat *stat) 200 { 201 struct iattr attr = { 202 .ia_valid = 203 ATTR_ATIME | ATTR_MTIME | ATTR_ATIME_SET | ATTR_MTIME_SET, 204 .ia_atime = stat->atime, 205 .ia_mtime = stat->mtime, 206 }; 207 208 return notify_change(upperdentry, &attr, NULL); 209 } 210 211 int ovl_set_attr(struct dentry *upperdentry, struct kstat *stat) 212 { 213 int err = 0; 214 215 if (!S_ISLNK(stat->mode)) { 216 struct iattr attr = { 217 .ia_valid = ATTR_MODE, 218 .ia_mode = stat->mode, 219 }; 220 err = notify_change(upperdentry, &attr, NULL); 221 } 222 if (!err) { 223 struct iattr attr = { 224 .ia_valid = ATTR_UID | ATTR_GID, 225 .ia_uid = stat->uid, 226 .ia_gid = stat->gid, 227 }; 228 err = notify_change(upperdentry, &attr, NULL); 229 } 230 if (!err) 231 ovl_set_timestamps(upperdentry, stat); 232 233 return err; 234 } 235 236 static struct ovl_fh *ovl_encode_fh(struct dentry *lower, uuid_be *uuid) 237 { 238 struct ovl_fh *fh; 239 int fh_type, fh_len, dwords; 240 void *buf; 241 int buflen = MAX_HANDLE_SZ; 242 243 buf = kmalloc(buflen, GFP_TEMPORARY); 244 if (!buf) 245 return ERR_PTR(-ENOMEM); 246 247 /* 248 * We encode a non-connectable file handle for non-dir, because we 249 * only need to find the lower inode number and we don't want to pay 250 * the price or reconnecting the dentry. 251 */ 252 dwords = buflen >> 2; 253 fh_type = exportfs_encode_fh(lower, buf, &dwords, 0); 254 buflen = (dwords << 2); 255 256 fh = ERR_PTR(-EIO); 257 if (WARN_ON(fh_type < 0) || 258 WARN_ON(buflen > MAX_HANDLE_SZ) || 259 WARN_ON(fh_type == FILEID_INVALID)) 260 goto out; 261 262 BUILD_BUG_ON(MAX_HANDLE_SZ + offsetof(struct ovl_fh, fid) > 255); 263 fh_len = offsetof(struct ovl_fh, fid) + buflen; 264 fh = kmalloc(fh_len, GFP_KERNEL); 265 if (!fh) { 266 fh = ERR_PTR(-ENOMEM); 267 goto out; 268 } 269 270 fh->version = OVL_FH_VERSION; 271 fh->magic = OVL_FH_MAGIC; 272 fh->type = fh_type; 273 fh->flags = OVL_FH_FLAG_CPU_ENDIAN; 274 fh->len = fh_len; 275 fh->uuid = *uuid; 276 memcpy(fh->fid, buf, buflen); 277 278 out: 279 kfree(buf); 280 return fh; 281 } 282 283 static int ovl_set_origin(struct dentry *dentry, struct dentry *lower, 284 struct dentry *upper) 285 { 286 struct super_block *sb = lower->d_sb; 287 uuid_be *uuid = (uuid_be *) &sb->s_uuid; 288 const struct ovl_fh *fh = NULL; 289 int err; 290 291 /* 292 * When lower layer doesn't support export operations store a 'null' fh, 293 * so we can use the overlay.origin xattr to distignuish between a copy 294 * up and a pure upper inode. 295 */ 296 if (sb->s_export_op && sb->s_export_op->fh_to_dentry && 297 uuid_be_cmp(*uuid, NULL_UUID_BE)) { 298 fh = ovl_encode_fh(lower, uuid); 299 if (IS_ERR(fh)) 300 return PTR_ERR(fh); 301 } 302 303 err = ovl_do_setxattr(upper, OVL_XATTR_ORIGIN, fh, fh ? fh->len : 0, 0); 304 kfree(fh); 305 306 return err; 307 } 308 309 static int ovl_copy_up_locked(struct dentry *workdir, struct dentry *upperdir, 310 struct dentry *dentry, struct path *lowerpath, 311 struct kstat *stat, const char *link, 312 struct kstat *pstat, bool tmpfile) 313 { 314 struct inode *wdir = workdir->d_inode; 315 struct inode *udir = upperdir->d_inode; 316 struct dentry *newdentry = NULL; 317 struct dentry *upper = NULL; 318 struct dentry *temp = NULL; 319 int err; 320 const struct cred *old_creds = NULL; 321 struct cred *new_creds = NULL; 322 struct cattr cattr = { 323 /* Can't properly set mode on creation because of the umask */ 324 .mode = stat->mode & S_IFMT, 325 .rdev = stat->rdev, 326 .link = link 327 }; 328 329 upper = lookup_one_len(dentry->d_name.name, upperdir, 330 dentry->d_name.len); 331 err = PTR_ERR(upper); 332 if (IS_ERR(upper)) 333 goto out; 334 335 err = security_inode_copy_up(dentry, &new_creds); 336 if (err < 0) 337 goto out1; 338 339 if (new_creds) 340 old_creds = override_creds(new_creds); 341 342 if (tmpfile) 343 temp = ovl_do_tmpfile(upperdir, stat->mode); 344 else 345 temp = ovl_lookup_temp(workdir, dentry); 346 err = PTR_ERR(temp); 347 if (IS_ERR(temp)) 348 goto out1; 349 350 err = 0; 351 if (!tmpfile) 352 err = ovl_create_real(wdir, temp, &cattr, NULL, true); 353 354 if (new_creds) { 355 revert_creds(old_creds); 356 put_cred(new_creds); 357 } 358 359 if (err) 360 goto out2; 361 362 if (S_ISREG(stat->mode)) { 363 struct path upperpath; 364 365 ovl_path_upper(dentry, &upperpath); 366 BUG_ON(upperpath.dentry != NULL); 367 upperpath.dentry = temp; 368 369 if (tmpfile) { 370 inode_unlock(udir); 371 err = ovl_copy_up_data(lowerpath, &upperpath, 372 stat->size); 373 inode_lock_nested(udir, I_MUTEX_PARENT); 374 } else { 375 err = ovl_copy_up_data(lowerpath, &upperpath, 376 stat->size); 377 } 378 379 if (err) 380 goto out_cleanup; 381 } 382 383 err = ovl_copy_xattr(lowerpath->dentry, temp); 384 if (err) 385 goto out_cleanup; 386 387 inode_lock(temp->d_inode); 388 err = ovl_set_attr(temp, stat); 389 inode_unlock(temp->d_inode); 390 if (err) 391 goto out_cleanup; 392 393 /* 394 * Store identifier of lower inode in upper inode xattr to 395 * allow lookup of the copy up origin inode. 396 */ 397 err = ovl_set_origin(dentry, lowerpath->dentry, temp); 398 if (err) 399 goto out_cleanup; 400 401 if (tmpfile) 402 err = ovl_do_link(temp, udir, upper, true); 403 else 404 err = ovl_do_rename(wdir, temp, udir, upper, 0); 405 if (err) 406 goto out_cleanup; 407 408 newdentry = dget(tmpfile ? upper : temp); 409 ovl_dentry_update(dentry, newdentry); 410 ovl_inode_update(d_inode(dentry), d_inode(newdentry)); 411 412 /* Restore timestamps on parent (best effort) */ 413 ovl_set_timestamps(upperdir, pstat); 414 out2: 415 dput(temp); 416 out1: 417 dput(upper); 418 out: 419 return err; 420 421 out_cleanup: 422 if (!tmpfile) 423 ovl_cleanup(wdir, temp); 424 goto out2; 425 } 426 427 /* 428 * Copy up a single dentry 429 * 430 * All renames start with copy up of source if necessary. The actual 431 * rename will only proceed once the copy up was successful. Copy up uses 432 * upper parent i_mutex for exclusion. Since rename can change d_parent it 433 * is possible that the copy up will lock the old parent. At that point 434 * the file will have already been copied up anyway. 435 */ 436 static int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry, 437 struct path *lowerpath, struct kstat *stat) 438 { 439 DEFINE_DELAYED_CALL(done); 440 struct dentry *workdir = ovl_workdir(dentry); 441 int err; 442 struct kstat pstat; 443 struct path parentpath; 444 struct dentry *lowerdentry = lowerpath->dentry; 445 struct dentry *upperdir; 446 const char *link = NULL; 447 struct ovl_fs *ofs = dentry->d_sb->s_fs_info; 448 449 if (WARN_ON(!workdir)) 450 return -EROFS; 451 452 ovl_do_check_copy_up(lowerdentry); 453 454 ovl_path_upper(parent, &parentpath); 455 upperdir = parentpath.dentry; 456 457 err = vfs_getattr(&parentpath, &pstat, 458 STATX_ATIME | STATX_MTIME, AT_STATX_SYNC_AS_STAT); 459 if (err) 460 return err; 461 462 if (S_ISLNK(stat->mode)) { 463 link = vfs_get_link(lowerdentry, &done); 464 if (IS_ERR(link)) 465 return PTR_ERR(link); 466 } 467 468 /* Should we copyup with O_TMPFILE or with workdir? */ 469 if (S_ISREG(stat->mode) && ofs->tmpfile) { 470 err = ovl_copy_up_start(dentry); 471 /* err < 0: interrupted, err > 0: raced with another copy-up */ 472 if (unlikely(err)) { 473 pr_debug("ovl_copy_up_start(%pd2) = %i\n", dentry, err); 474 if (err > 0) 475 err = 0; 476 goto out_done; 477 } 478 479 inode_lock_nested(upperdir->d_inode, I_MUTEX_PARENT); 480 err = ovl_copy_up_locked(workdir, upperdir, dentry, lowerpath, 481 stat, link, &pstat, true); 482 inode_unlock(upperdir->d_inode); 483 ovl_copy_up_end(dentry); 484 goto out_done; 485 } 486 487 err = -EIO; 488 if (lock_rename(workdir, upperdir) != NULL) { 489 pr_err("overlayfs: failed to lock workdir+upperdir\n"); 490 goto out_unlock; 491 } 492 if (ovl_dentry_upper(dentry)) { 493 /* Raced with another copy-up? Nothing to do, then... */ 494 err = 0; 495 goto out_unlock; 496 } 497 498 err = ovl_copy_up_locked(workdir, upperdir, dentry, lowerpath, 499 stat, link, &pstat, false); 500 out_unlock: 501 unlock_rename(workdir, upperdir); 502 out_done: 503 do_delayed_call(&done); 504 505 return err; 506 } 507 508 int ovl_copy_up_flags(struct dentry *dentry, int flags) 509 { 510 int err = 0; 511 const struct cred *old_cred = ovl_override_creds(dentry->d_sb); 512 513 while (!err) { 514 struct dentry *next; 515 struct dentry *parent; 516 struct path lowerpath; 517 struct kstat stat; 518 enum ovl_path_type type = ovl_path_type(dentry); 519 520 if (OVL_TYPE_UPPER(type)) 521 break; 522 523 next = dget(dentry); 524 /* find the topmost dentry not yet copied up */ 525 for (;;) { 526 parent = dget_parent(next); 527 528 type = ovl_path_type(parent); 529 if (OVL_TYPE_UPPER(type)) 530 break; 531 532 dput(next); 533 next = parent; 534 } 535 536 ovl_path_lower(next, &lowerpath); 537 err = vfs_getattr(&lowerpath, &stat, 538 STATX_BASIC_STATS, AT_STATX_SYNC_AS_STAT); 539 /* maybe truncate regular file. this has no effect on dirs */ 540 if (flags & O_TRUNC) 541 stat.size = 0; 542 if (!err) 543 err = ovl_copy_up_one(parent, next, &lowerpath, &stat); 544 545 dput(parent); 546 dput(next); 547 } 548 revert_creds(old_cred); 549 550 return err; 551 } 552 553 int ovl_copy_up(struct dentry *dentry) 554 { 555 return ovl_copy_up_flags(dentry, 0); 556 } 557