1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * 4 * Copyright (C) 2011 Novell Inc. 5 */ 6 7 #include <linux/fs.h> 8 #include <linux/slab.h> 9 #include <linux/cred.h> 10 #include <linux/xattr.h> 11 #include <linux/posix_acl.h> 12 #include <linux/ratelimit.h> 13 #include <linux/fiemap.h> 14 #include <linux/fileattr.h> 15 #include <linux/security.h> 16 #include <linux/namei.h> 17 #include <linux/posix_acl.h> 18 #include <linux/posix_acl_xattr.h> 19 #include "overlayfs.h" 20 21 22 int ovl_setattr(struct mnt_idmap *idmap, struct dentry *dentry, 23 struct iattr *attr) 24 { 25 int err; 26 struct ovl_fs *ofs = OVL_FS(dentry->d_sb); 27 bool full_copy_up = false; 28 struct dentry *upperdentry; 29 const struct cred *old_cred; 30 31 err = setattr_prepare(&nop_mnt_idmap, dentry, attr); 32 if (err) 33 return err; 34 35 err = ovl_want_write(dentry); 36 if (err) 37 goto out; 38 39 if (attr->ia_valid & ATTR_SIZE) { 40 /* Truncate should trigger data copy up as well */ 41 full_copy_up = true; 42 } 43 44 if (!full_copy_up) 45 err = ovl_copy_up(dentry); 46 else 47 err = ovl_copy_up_with_data(dentry); 48 if (!err) { 49 struct inode *winode = NULL; 50 51 upperdentry = ovl_dentry_upper(dentry); 52 53 if (attr->ia_valid & ATTR_SIZE) { 54 winode = d_inode(upperdentry); 55 err = get_write_access(winode); 56 if (err) 57 goto out_drop_write; 58 } 59 60 if (attr->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) 61 attr->ia_valid &= ~ATTR_MODE; 62 63 /* 64 * We might have to translate ovl file into real file object 65 * once use cases emerge. For now, simply don't let underlying 66 * filesystem rely on attr->ia_file 67 */ 68 attr->ia_valid &= ~ATTR_FILE; 69 70 /* 71 * If open(O_TRUNC) is done, VFS calls ->setattr with ATTR_OPEN 72 * set. Overlayfs does not pass O_TRUNC flag to underlying 73 * filesystem during open -> do not pass ATTR_OPEN. This 74 * disables optimization in fuse which assumes open(O_TRUNC) 75 * already set file size to 0. But we never passed O_TRUNC to 76 * fuse. So by clearing ATTR_OPEN, fuse will be forced to send 77 * setattr request to server. 78 */ 79 attr->ia_valid &= ~ATTR_OPEN; 80 81 inode_lock(upperdentry->d_inode); 82 old_cred = ovl_override_creds(dentry->d_sb); 83 err = ovl_do_notify_change(ofs, upperdentry, attr); 84 revert_creds(old_cred); 85 if (!err) 86 ovl_copyattr(dentry->d_inode); 87 inode_unlock(upperdentry->d_inode); 88 89 if (winode) 90 put_write_access(winode); 91 } 92 out_drop_write: 93 ovl_drop_write(dentry); 94 out: 95 return err; 96 } 97 98 static void ovl_map_dev_ino(struct dentry *dentry, struct kstat *stat, int fsid) 99 { 100 bool samefs = ovl_same_fs(dentry->d_sb); 101 unsigned int xinobits = ovl_xino_bits(dentry->d_sb); 102 unsigned int xinoshift = 64 - xinobits; 103 104 if (samefs) { 105 /* 106 * When all layers are on the same fs, all real inode 107 * number are unique, so we use the overlay st_dev, 108 * which is friendly to du -x. 109 */ 110 stat->dev = dentry->d_sb->s_dev; 111 return; 112 } else if (xinobits) { 113 /* 114 * All inode numbers of underlying fs should not be using the 115 * high xinobits, so we use high xinobits to partition the 116 * overlay st_ino address space. The high bits holds the fsid 117 * (upper fsid is 0). The lowest xinobit is reserved for mapping 118 * the non-persistent inode numbers range in case of overflow. 119 * This way all overlay inode numbers are unique and use the 120 * overlay st_dev. 121 */ 122 if (likely(!(stat->ino >> xinoshift))) { 123 stat->ino |= ((u64)fsid) << (xinoshift + 1); 124 stat->dev = dentry->d_sb->s_dev; 125 return; 126 } else if (ovl_xino_warn(dentry->d_sb)) { 127 pr_warn_ratelimited("inode number too big (%pd2, ino=%llu, xinobits=%d)\n", 128 dentry, stat->ino, xinobits); 129 } 130 } 131 132 /* The inode could not be mapped to a unified st_ino address space */ 133 if (S_ISDIR(dentry->d_inode->i_mode)) { 134 /* 135 * Always use the overlay st_dev for directories, so 'find 136 * -xdev' will scan the entire overlay mount and won't cross the 137 * overlay mount boundaries. 138 * 139 * If not all layers are on the same fs the pair {real st_ino; 140 * overlay st_dev} is not unique, so use the non persistent 141 * overlay st_ino for directories. 142 */ 143 stat->dev = dentry->d_sb->s_dev; 144 stat->ino = dentry->d_inode->i_ino; 145 } else { 146 /* 147 * For non-samefs setup, if we cannot map all layers st_ino 148 * to a unified address space, we need to make sure that st_dev 149 * is unique per underlying fs, so we use the unique anonymous 150 * bdev assigned to the underlying fs. 151 */ 152 stat->dev = OVL_FS(dentry->d_sb)->fs[fsid].pseudo_dev; 153 } 154 } 155 156 int ovl_getattr(struct mnt_idmap *idmap, const struct path *path, 157 struct kstat *stat, u32 request_mask, unsigned int flags) 158 { 159 struct dentry *dentry = path->dentry; 160 enum ovl_path_type type; 161 struct path realpath; 162 const struct cred *old_cred; 163 struct inode *inode = d_inode(dentry); 164 bool is_dir = S_ISDIR(inode->i_mode); 165 int fsid = 0; 166 int err; 167 bool metacopy_blocks = false; 168 169 metacopy_blocks = ovl_is_metacopy_dentry(dentry); 170 171 type = ovl_path_real(dentry, &realpath); 172 old_cred = ovl_override_creds(dentry->d_sb); 173 err = vfs_getattr(&realpath, stat, request_mask, flags); 174 if (err) 175 goto out; 176 177 /* Report the effective immutable/append-only STATX flags */ 178 generic_fill_statx_attr(inode, stat); 179 180 /* 181 * For non-dir or same fs, we use st_ino of the copy up origin. 182 * This guaranties constant st_dev/st_ino across copy up. 183 * With xino feature and non-samefs, we use st_ino of the copy up 184 * origin masked with high bits that represent the layer id. 185 * 186 * If lower filesystem supports NFS file handles, this also guaranties 187 * persistent st_ino across mount cycle. 188 */ 189 if (!is_dir || ovl_same_dev(dentry->d_sb)) { 190 if (!OVL_TYPE_UPPER(type)) { 191 fsid = ovl_layer_lower(dentry)->fsid; 192 } else if (OVL_TYPE_ORIGIN(type)) { 193 struct kstat lowerstat; 194 u32 lowermask = STATX_INO | STATX_BLOCKS | 195 (!is_dir ? STATX_NLINK : 0); 196 197 ovl_path_lower(dentry, &realpath); 198 err = vfs_getattr(&realpath, &lowerstat, 199 lowermask, flags); 200 if (err) 201 goto out; 202 203 /* 204 * Lower hardlinks may be broken on copy up to different 205 * upper files, so we cannot use the lower origin st_ino 206 * for those different files, even for the same fs case. 207 * 208 * Similarly, several redirected dirs can point to the 209 * same dir on a lower layer. With the "verify_lower" 210 * feature, we do not use the lower origin st_ino, if 211 * we haven't verified that this redirect is unique. 212 * 213 * With inodes index enabled, it is safe to use st_ino 214 * of an indexed origin. The index validates that the 215 * upper hardlink is not broken and that a redirected 216 * dir is the only redirect to that origin. 217 */ 218 if (ovl_test_flag(OVL_INDEX, d_inode(dentry)) || 219 (!ovl_verify_lower(dentry->d_sb) && 220 (is_dir || lowerstat.nlink == 1))) { 221 fsid = ovl_layer_lower(dentry)->fsid; 222 stat->ino = lowerstat.ino; 223 } 224 225 /* 226 * If we are querying a metacopy dentry and lower 227 * dentry is data dentry, then use the blocks we 228 * queried just now. We don't have to do additional 229 * vfs_getattr(). If lower itself is metacopy, then 230 * additional vfs_getattr() is unavoidable. 231 */ 232 if (metacopy_blocks && 233 realpath.dentry == ovl_dentry_lowerdata(dentry)) { 234 stat->blocks = lowerstat.blocks; 235 metacopy_blocks = false; 236 } 237 } 238 239 if (metacopy_blocks) { 240 /* 241 * If lower is not same as lowerdata or if there was 242 * no origin on upper, we can end up here. 243 * With lazy lowerdata lookup, guess lowerdata blocks 244 * from size to avoid lowerdata lookup on stat(2). 245 */ 246 struct kstat lowerdatastat; 247 u32 lowermask = STATX_BLOCKS; 248 249 ovl_path_lowerdata(dentry, &realpath); 250 if (realpath.dentry) { 251 err = vfs_getattr(&realpath, &lowerdatastat, 252 lowermask, flags); 253 if (err) 254 goto out; 255 } else { 256 lowerdatastat.blocks = 257 round_up(stat->size, stat->blksize) >> 9; 258 } 259 stat->blocks = lowerdatastat.blocks; 260 } 261 } 262 263 ovl_map_dev_ino(dentry, stat, fsid); 264 265 /* 266 * It's probably not worth it to count subdirs to get the 267 * correct link count. nlink=1 seems to pacify 'find' and 268 * other utilities. 269 */ 270 if (is_dir && OVL_TYPE_MERGE(type)) 271 stat->nlink = 1; 272 273 /* 274 * Return the overlay inode nlinks for indexed upper inodes. 275 * Overlay inode nlink counts the union of the upper hardlinks 276 * and non-covered lower hardlinks. It does not include the upper 277 * index hardlink. 278 */ 279 if (!is_dir && ovl_test_flag(OVL_INDEX, d_inode(dentry))) 280 stat->nlink = dentry->d_inode->i_nlink; 281 282 out: 283 revert_creds(old_cred); 284 285 return err; 286 } 287 288 int ovl_permission(struct mnt_idmap *idmap, 289 struct inode *inode, int mask) 290 { 291 struct inode *upperinode = ovl_inode_upper(inode); 292 struct inode *realinode; 293 struct path realpath; 294 const struct cred *old_cred; 295 int err; 296 297 /* Careful in RCU walk mode */ 298 realinode = ovl_i_path_real(inode, &realpath); 299 if (!realinode) { 300 WARN_ON(!(mask & MAY_NOT_BLOCK)); 301 return -ECHILD; 302 } 303 304 /* 305 * Check overlay inode with the creds of task and underlying inode 306 * with creds of mounter 307 */ 308 err = generic_permission(&nop_mnt_idmap, inode, mask); 309 if (err) 310 return err; 311 312 old_cred = ovl_override_creds(inode->i_sb); 313 if (!upperinode && 314 !special_file(realinode->i_mode) && mask & MAY_WRITE) { 315 mask &= ~(MAY_WRITE | MAY_APPEND); 316 /* Make sure mounter can read file for copy up later */ 317 mask |= MAY_READ; 318 } 319 err = inode_permission(mnt_idmap(realpath.mnt), realinode, mask); 320 revert_creds(old_cred); 321 322 return err; 323 } 324 325 static const char *ovl_get_link(struct dentry *dentry, 326 struct inode *inode, 327 struct delayed_call *done) 328 { 329 const struct cred *old_cred; 330 const char *p; 331 332 if (!dentry) 333 return ERR_PTR(-ECHILD); 334 335 old_cred = ovl_override_creds(dentry->d_sb); 336 p = vfs_get_link(ovl_dentry_real(dentry), done); 337 revert_creds(old_cred); 338 return p; 339 } 340 341 bool ovl_is_private_xattr(struct super_block *sb, const char *name) 342 { 343 struct ovl_fs *ofs = sb->s_fs_info; 344 345 if (ofs->config.userxattr) 346 return strncmp(name, OVL_XATTR_USER_PREFIX, 347 sizeof(OVL_XATTR_USER_PREFIX) - 1) == 0; 348 else 349 return strncmp(name, OVL_XATTR_TRUSTED_PREFIX, 350 sizeof(OVL_XATTR_TRUSTED_PREFIX) - 1) == 0; 351 } 352 353 int ovl_xattr_set(struct dentry *dentry, struct inode *inode, const char *name, 354 const void *value, size_t size, int flags) 355 { 356 int err; 357 struct ovl_fs *ofs = OVL_FS(dentry->d_sb); 358 struct dentry *upperdentry = ovl_i_dentry_upper(inode); 359 struct dentry *realdentry = upperdentry ?: ovl_dentry_lower(dentry); 360 struct path realpath; 361 const struct cred *old_cred; 362 363 err = ovl_want_write(dentry); 364 if (err) 365 goto out; 366 367 if (!value && !upperdentry) { 368 ovl_path_lower(dentry, &realpath); 369 old_cred = ovl_override_creds(dentry->d_sb); 370 err = vfs_getxattr(mnt_idmap(realpath.mnt), realdentry, name, NULL, 0); 371 revert_creds(old_cred); 372 if (err < 0) 373 goto out_drop_write; 374 } 375 376 if (!upperdentry) { 377 err = ovl_copy_up(dentry); 378 if (err) 379 goto out_drop_write; 380 381 realdentry = ovl_dentry_upper(dentry); 382 } 383 384 old_cred = ovl_override_creds(dentry->d_sb); 385 if (value) { 386 err = ovl_do_setxattr(ofs, realdentry, name, value, size, 387 flags); 388 } else { 389 WARN_ON(flags != XATTR_REPLACE); 390 err = ovl_do_removexattr(ofs, realdentry, name); 391 } 392 revert_creds(old_cred); 393 394 /* copy c/mtime */ 395 ovl_copyattr(inode); 396 397 out_drop_write: 398 ovl_drop_write(dentry); 399 out: 400 return err; 401 } 402 403 int ovl_xattr_get(struct dentry *dentry, struct inode *inode, const char *name, 404 void *value, size_t size) 405 { 406 ssize_t res; 407 const struct cred *old_cred; 408 struct path realpath; 409 410 ovl_i_path_real(inode, &realpath); 411 old_cred = ovl_override_creds(dentry->d_sb); 412 res = vfs_getxattr(mnt_idmap(realpath.mnt), realpath.dentry, name, value, size); 413 revert_creds(old_cred); 414 return res; 415 } 416 417 static bool ovl_can_list(struct super_block *sb, const char *s) 418 { 419 /* Never list private (.overlay) */ 420 if (ovl_is_private_xattr(sb, s)) 421 return false; 422 423 /* List all non-trusted xattrs */ 424 if (strncmp(s, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) != 0) 425 return true; 426 427 /* list other trusted for superuser only */ 428 return ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN); 429 } 430 431 ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size) 432 { 433 struct dentry *realdentry = ovl_dentry_real(dentry); 434 ssize_t res; 435 size_t len; 436 char *s; 437 const struct cred *old_cred; 438 439 old_cred = ovl_override_creds(dentry->d_sb); 440 res = vfs_listxattr(realdentry, list, size); 441 revert_creds(old_cred); 442 if (res <= 0 || size == 0) 443 return res; 444 445 /* filter out private xattrs */ 446 for (s = list, len = res; len;) { 447 size_t slen = strnlen(s, len) + 1; 448 449 /* underlying fs providing us with an broken xattr list? */ 450 if (WARN_ON(slen > len)) 451 return -EIO; 452 453 len -= slen; 454 if (!ovl_can_list(dentry->d_sb, s)) { 455 res -= slen; 456 memmove(s, s + slen, len); 457 } else { 458 s += slen; 459 } 460 } 461 462 return res; 463 } 464 465 #ifdef CONFIG_FS_POSIX_ACL 466 /* 467 * Apply the idmapping of the layer to POSIX ACLs. The caller must pass a clone 468 * of the POSIX ACLs retrieved from the lower layer to this function to not 469 * alter the POSIX ACLs for the underlying filesystem. 470 */ 471 static void ovl_idmap_posix_acl(const struct inode *realinode, 472 struct mnt_idmap *idmap, 473 struct posix_acl *acl) 474 { 475 struct user_namespace *fs_userns = i_user_ns(realinode); 476 477 for (unsigned int i = 0; i < acl->a_count; i++) { 478 vfsuid_t vfsuid; 479 vfsgid_t vfsgid; 480 481 struct posix_acl_entry *e = &acl->a_entries[i]; 482 switch (e->e_tag) { 483 case ACL_USER: 484 vfsuid = make_vfsuid(idmap, fs_userns, e->e_uid); 485 e->e_uid = vfsuid_into_kuid(vfsuid); 486 break; 487 case ACL_GROUP: 488 vfsgid = make_vfsgid(idmap, fs_userns, e->e_gid); 489 e->e_gid = vfsgid_into_kgid(vfsgid); 490 break; 491 } 492 } 493 } 494 495 /* 496 * The @noperm argument is used to skip permission checking and is a temporary 497 * measure. Quoting Miklos from an earlier discussion: 498 * 499 * > So there are two paths to getting an acl: 500 * > 1) permission checking and 2) retrieving the value via getxattr(2). 501 * > This is a similar situation as reading a symlink vs. following it. 502 * > When following a symlink overlayfs always reads the link on the 503 * > underlying fs just as if it was a readlink(2) call, calling 504 * > security_inode_readlink() instead of security_inode_follow_link(). 505 * > This is logical: we are reading the link from the underlying storage, 506 * > and following it on overlayfs. 507 * > 508 * > Applying the same logic to acl: we do need to call the 509 * > security_inode_getxattr() on the underlying fs, even if just want to 510 * > check permissions on overlay. This is currently not done, which is an 511 * > inconsistency. 512 * > 513 * > Maybe adding the check to ovl_get_acl() is the right way to go, but 514 * > I'm a little afraid of a performance regression. Will look into that. 515 * 516 * Until we have made a decision allow this helper to take the @noperm 517 * argument. We should hopefully be able to remove it soon. 518 */ 519 struct posix_acl *ovl_get_acl_path(const struct path *path, 520 const char *acl_name, bool noperm) 521 { 522 struct posix_acl *real_acl, *clone; 523 struct mnt_idmap *idmap; 524 struct inode *realinode = d_inode(path->dentry); 525 526 idmap = mnt_idmap(path->mnt); 527 528 if (noperm) 529 real_acl = get_inode_acl(realinode, posix_acl_type(acl_name)); 530 else 531 real_acl = vfs_get_acl(idmap, path->dentry, acl_name); 532 if (IS_ERR_OR_NULL(real_acl)) 533 return real_acl; 534 535 if (!is_idmapped_mnt(path->mnt)) 536 return real_acl; 537 538 /* 539 * We cannot alter the ACLs returned from the relevant layer as that 540 * would alter the cached values filesystem wide for the lower 541 * filesystem. Instead we can clone the ACLs and then apply the 542 * relevant idmapping of the layer. 543 */ 544 clone = posix_acl_clone(real_acl, GFP_KERNEL); 545 posix_acl_release(real_acl); /* release original acl */ 546 if (!clone) 547 return ERR_PTR(-ENOMEM); 548 549 ovl_idmap_posix_acl(realinode, idmap, clone); 550 return clone; 551 } 552 553 /* 554 * When the relevant layer is an idmapped mount we need to take the idmapping 555 * of the layer into account and translate any ACL_{GROUP,USER} values 556 * according to the idmapped mount. 557 * 558 * We cannot alter the ACLs returned from the relevant layer as that would 559 * alter the cached values filesystem wide for the lower filesystem. Instead we 560 * can clone the ACLs and then apply the relevant idmapping of the layer. 561 * 562 * This is obviously only relevant when idmapped layers are used. 563 */ 564 struct posix_acl *do_ovl_get_acl(struct mnt_idmap *idmap, 565 struct inode *inode, int type, 566 bool rcu, bool noperm) 567 { 568 struct inode *realinode; 569 struct posix_acl *acl; 570 struct path realpath; 571 572 /* Careful in RCU walk mode */ 573 realinode = ovl_i_path_real(inode, &realpath); 574 if (!realinode) { 575 WARN_ON(!rcu); 576 return ERR_PTR(-ECHILD); 577 } 578 579 if (!IS_POSIXACL(realinode)) 580 return NULL; 581 582 if (rcu) { 583 /* 584 * If the layer is idmapped drop out of RCU path walk 585 * so we can clone the ACLs. 586 */ 587 if (is_idmapped_mnt(realpath.mnt)) 588 return ERR_PTR(-ECHILD); 589 590 acl = get_cached_acl_rcu(realinode, type); 591 } else { 592 const struct cred *old_cred; 593 594 old_cred = ovl_override_creds(inode->i_sb); 595 acl = ovl_get_acl_path(&realpath, posix_acl_xattr_name(type), noperm); 596 revert_creds(old_cred); 597 } 598 599 return acl; 600 } 601 602 static int ovl_set_or_remove_acl(struct dentry *dentry, struct inode *inode, 603 struct posix_acl *acl, int type) 604 { 605 int err; 606 struct path realpath; 607 const char *acl_name; 608 const struct cred *old_cred; 609 struct ovl_fs *ofs = OVL_FS(dentry->d_sb); 610 struct dentry *upperdentry = ovl_dentry_upper(dentry); 611 struct dentry *realdentry = upperdentry ?: ovl_dentry_lower(dentry); 612 613 err = ovl_want_write(dentry); 614 if (err) 615 return err; 616 617 /* 618 * If ACL is to be removed from a lower file, check if it exists in 619 * the first place before copying it up. 620 */ 621 acl_name = posix_acl_xattr_name(type); 622 if (!acl && !upperdentry) { 623 struct posix_acl *real_acl; 624 625 ovl_path_lower(dentry, &realpath); 626 old_cred = ovl_override_creds(dentry->d_sb); 627 real_acl = vfs_get_acl(mnt_idmap(realpath.mnt), realdentry, 628 acl_name); 629 revert_creds(old_cred); 630 if (IS_ERR(real_acl)) { 631 err = PTR_ERR(real_acl); 632 goto out_drop_write; 633 } 634 posix_acl_release(real_acl); 635 } 636 637 if (!upperdentry) { 638 err = ovl_copy_up(dentry); 639 if (err) 640 goto out_drop_write; 641 642 realdentry = ovl_dentry_upper(dentry); 643 } 644 645 old_cred = ovl_override_creds(dentry->d_sb); 646 if (acl) 647 err = ovl_do_set_acl(ofs, realdentry, acl_name, acl); 648 else 649 err = ovl_do_remove_acl(ofs, realdentry, acl_name); 650 revert_creds(old_cred); 651 652 /* copy c/mtime */ 653 ovl_copyattr(inode); 654 655 out_drop_write: 656 ovl_drop_write(dentry); 657 return err; 658 } 659 660 int ovl_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, 661 struct posix_acl *acl, int type) 662 { 663 int err; 664 struct inode *inode = d_inode(dentry); 665 struct dentry *workdir = ovl_workdir(dentry); 666 struct inode *realinode = ovl_inode_real(inode); 667 668 if (!IS_POSIXACL(d_inode(workdir))) 669 return -EOPNOTSUPP; 670 if (!realinode->i_op->set_acl) 671 return -EOPNOTSUPP; 672 if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) 673 return acl ? -EACCES : 0; 674 if (!inode_owner_or_capable(&nop_mnt_idmap, inode)) 675 return -EPERM; 676 677 /* 678 * Check if sgid bit needs to be cleared (actual setacl operation will 679 * be done with mounter's capabilities and so that won't do it for us). 680 */ 681 if (unlikely(inode->i_mode & S_ISGID) && type == ACL_TYPE_ACCESS && 682 !in_group_p(inode->i_gid) && 683 !capable_wrt_inode_uidgid(&nop_mnt_idmap, inode, CAP_FSETID)) { 684 struct iattr iattr = { .ia_valid = ATTR_KILL_SGID }; 685 686 err = ovl_setattr(&nop_mnt_idmap, dentry, &iattr); 687 if (err) 688 return err; 689 } 690 691 return ovl_set_or_remove_acl(dentry, inode, acl, type); 692 } 693 #endif 694 695 int ovl_update_time(struct inode *inode, struct timespec64 *ts, int flags) 696 { 697 if (flags & S_ATIME) { 698 struct ovl_fs *ofs = inode->i_sb->s_fs_info; 699 struct path upperpath = { 700 .mnt = ovl_upper_mnt(ofs), 701 .dentry = ovl_upperdentry_dereference(OVL_I(inode)), 702 }; 703 704 if (upperpath.dentry) { 705 touch_atime(&upperpath); 706 inode->i_atime = d_inode(upperpath.dentry)->i_atime; 707 } 708 } 709 return 0; 710 } 711 712 static int ovl_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, 713 u64 start, u64 len) 714 { 715 int err; 716 struct inode *realinode = ovl_inode_realdata(inode); 717 const struct cred *old_cred; 718 719 if (!realinode) 720 return -EIO; 721 722 if (!realinode->i_op->fiemap) 723 return -EOPNOTSUPP; 724 725 old_cred = ovl_override_creds(inode->i_sb); 726 err = realinode->i_op->fiemap(realinode, fieinfo, start, len); 727 revert_creds(old_cred); 728 729 return err; 730 } 731 732 /* 733 * Work around the fact that security_file_ioctl() takes a file argument. 734 * Introducing security_inode_fileattr_get/set() hooks would solve this issue 735 * properly. 736 */ 737 static int ovl_security_fileattr(const struct path *realpath, struct fileattr *fa, 738 bool set) 739 { 740 struct file *file; 741 unsigned int cmd; 742 int err; 743 744 file = dentry_open(realpath, O_RDONLY, current_cred()); 745 if (IS_ERR(file)) 746 return PTR_ERR(file); 747 748 if (set) 749 cmd = fa->fsx_valid ? FS_IOC_FSSETXATTR : FS_IOC_SETFLAGS; 750 else 751 cmd = fa->fsx_valid ? FS_IOC_FSGETXATTR : FS_IOC_GETFLAGS; 752 753 err = security_file_ioctl(file, cmd, 0); 754 fput(file); 755 756 return err; 757 } 758 759 int ovl_real_fileattr_set(const struct path *realpath, struct fileattr *fa) 760 { 761 int err; 762 763 err = ovl_security_fileattr(realpath, fa, true); 764 if (err) 765 return err; 766 767 return vfs_fileattr_set(mnt_idmap(realpath->mnt), realpath->dentry, fa); 768 } 769 770 int ovl_fileattr_set(struct mnt_idmap *idmap, 771 struct dentry *dentry, struct fileattr *fa) 772 { 773 struct inode *inode = d_inode(dentry); 774 struct path upperpath; 775 const struct cred *old_cred; 776 unsigned int flags; 777 int err; 778 779 err = ovl_want_write(dentry); 780 if (err) 781 goto out; 782 783 err = ovl_copy_up(dentry); 784 if (!err) { 785 ovl_path_real(dentry, &upperpath); 786 787 old_cred = ovl_override_creds(inode->i_sb); 788 /* 789 * Store immutable/append-only flags in xattr and clear them 790 * in upper fileattr (in case they were set by older kernel) 791 * so children of "ovl-immutable" directories lower aliases of 792 * "ovl-immutable" hardlinks could be copied up. 793 * Clear xattr when flags are cleared. 794 */ 795 err = ovl_set_protattr(inode, upperpath.dentry, fa); 796 if (!err) 797 err = ovl_real_fileattr_set(&upperpath, fa); 798 revert_creds(old_cred); 799 800 /* 801 * Merge real inode flags with inode flags read from 802 * overlay.protattr xattr 803 */ 804 flags = ovl_inode_real(inode)->i_flags & OVL_COPY_I_FLAGS_MASK; 805 806 BUILD_BUG_ON(OVL_PROT_I_FLAGS_MASK & ~OVL_COPY_I_FLAGS_MASK); 807 flags |= inode->i_flags & OVL_PROT_I_FLAGS_MASK; 808 inode_set_flags(inode, flags, OVL_COPY_I_FLAGS_MASK); 809 810 /* Update ctime */ 811 ovl_copyattr(inode); 812 } 813 ovl_drop_write(dentry); 814 out: 815 return err; 816 } 817 818 /* Convert inode protection flags to fileattr flags */ 819 static void ovl_fileattr_prot_flags(struct inode *inode, struct fileattr *fa) 820 { 821 BUILD_BUG_ON(OVL_PROT_FS_FLAGS_MASK & ~FS_COMMON_FL); 822 BUILD_BUG_ON(OVL_PROT_FSX_FLAGS_MASK & ~FS_XFLAG_COMMON); 823 824 if (inode->i_flags & S_APPEND) { 825 fa->flags |= FS_APPEND_FL; 826 fa->fsx_xflags |= FS_XFLAG_APPEND; 827 } 828 if (inode->i_flags & S_IMMUTABLE) { 829 fa->flags |= FS_IMMUTABLE_FL; 830 fa->fsx_xflags |= FS_XFLAG_IMMUTABLE; 831 } 832 } 833 834 int ovl_real_fileattr_get(const struct path *realpath, struct fileattr *fa) 835 { 836 int err; 837 838 err = ovl_security_fileattr(realpath, fa, false); 839 if (err) 840 return err; 841 842 err = vfs_fileattr_get(realpath->dentry, fa); 843 if (err == -ENOIOCTLCMD) 844 err = -ENOTTY; 845 return err; 846 } 847 848 int ovl_fileattr_get(struct dentry *dentry, struct fileattr *fa) 849 { 850 struct inode *inode = d_inode(dentry); 851 struct path realpath; 852 const struct cred *old_cred; 853 int err; 854 855 ovl_path_real(dentry, &realpath); 856 857 old_cred = ovl_override_creds(inode->i_sb); 858 err = ovl_real_fileattr_get(&realpath, fa); 859 ovl_fileattr_prot_flags(inode, fa); 860 revert_creds(old_cred); 861 862 return err; 863 } 864 865 static const struct inode_operations ovl_file_inode_operations = { 866 .setattr = ovl_setattr, 867 .permission = ovl_permission, 868 .getattr = ovl_getattr, 869 .listxattr = ovl_listxattr, 870 .get_inode_acl = ovl_get_inode_acl, 871 .get_acl = ovl_get_acl, 872 .set_acl = ovl_set_acl, 873 .update_time = ovl_update_time, 874 .fiemap = ovl_fiemap, 875 .fileattr_get = ovl_fileattr_get, 876 .fileattr_set = ovl_fileattr_set, 877 }; 878 879 static const struct inode_operations ovl_symlink_inode_operations = { 880 .setattr = ovl_setattr, 881 .get_link = ovl_get_link, 882 .getattr = ovl_getattr, 883 .listxattr = ovl_listxattr, 884 .update_time = ovl_update_time, 885 }; 886 887 static const struct inode_operations ovl_special_inode_operations = { 888 .setattr = ovl_setattr, 889 .permission = ovl_permission, 890 .getattr = ovl_getattr, 891 .listxattr = ovl_listxattr, 892 .get_inode_acl = ovl_get_inode_acl, 893 .get_acl = ovl_get_acl, 894 .set_acl = ovl_set_acl, 895 .update_time = ovl_update_time, 896 }; 897 898 static const struct address_space_operations ovl_aops = { 899 /* For O_DIRECT dentry_open() checks f_mapping->a_ops->direct_IO */ 900 .direct_IO = noop_direct_IO, 901 }; 902 903 /* 904 * It is possible to stack overlayfs instance on top of another 905 * overlayfs instance as lower layer. We need to annotate the 906 * stackable i_mutex locks according to stack level of the super 907 * block instance. An overlayfs instance can never be in stack 908 * depth 0 (there is always a real fs below it). An overlayfs 909 * inode lock will use the lockdep annotation ovl_i_mutex_key[depth]. 910 * 911 * For example, here is a snip from /proc/lockdep_chains after 912 * dir_iterate of nested overlayfs: 913 * 914 * [...] &ovl_i_mutex_dir_key[depth] (stack_depth=2) 915 * [...] &ovl_i_mutex_dir_key[depth]#2 (stack_depth=1) 916 * [...] &type->i_mutex_dir_key (stack_depth=0) 917 * 918 * Locking order w.r.t ovl_want_write() is important for nested overlayfs. 919 * 920 * This chain is valid: 921 * - inode->i_rwsem (inode_lock[2]) 922 * - upper_mnt->mnt_sb->s_writers (ovl_want_write[0]) 923 * - OVL_I(inode)->lock (ovl_inode_lock[2]) 924 * - OVL_I(lowerinode)->lock (ovl_inode_lock[1]) 925 * 926 * And this chain is valid: 927 * - inode->i_rwsem (inode_lock[2]) 928 * - OVL_I(inode)->lock (ovl_inode_lock[2]) 929 * - lowerinode->i_rwsem (inode_lock[1]) 930 * - OVL_I(lowerinode)->lock (ovl_inode_lock[1]) 931 * 932 * But lowerinode->i_rwsem SHOULD NOT be acquired while ovl_want_write() is 933 * held, because it is in reverse order of the non-nested case using the same 934 * upper fs: 935 * - inode->i_rwsem (inode_lock[1]) 936 * - upper_mnt->mnt_sb->s_writers (ovl_want_write[0]) 937 * - OVL_I(inode)->lock (ovl_inode_lock[1]) 938 */ 939 #define OVL_MAX_NESTING FILESYSTEM_MAX_STACK_DEPTH 940 941 static inline void ovl_lockdep_annotate_inode_mutex_key(struct inode *inode) 942 { 943 #ifdef CONFIG_LOCKDEP 944 static struct lock_class_key ovl_i_mutex_key[OVL_MAX_NESTING]; 945 static struct lock_class_key ovl_i_mutex_dir_key[OVL_MAX_NESTING]; 946 static struct lock_class_key ovl_i_lock_key[OVL_MAX_NESTING]; 947 948 int depth = inode->i_sb->s_stack_depth - 1; 949 950 if (WARN_ON_ONCE(depth < 0 || depth >= OVL_MAX_NESTING)) 951 depth = 0; 952 953 if (S_ISDIR(inode->i_mode)) 954 lockdep_set_class(&inode->i_rwsem, &ovl_i_mutex_dir_key[depth]); 955 else 956 lockdep_set_class(&inode->i_rwsem, &ovl_i_mutex_key[depth]); 957 958 lockdep_set_class(&OVL_I(inode)->lock, &ovl_i_lock_key[depth]); 959 #endif 960 } 961 962 static void ovl_next_ino(struct inode *inode) 963 { 964 struct ovl_fs *ofs = inode->i_sb->s_fs_info; 965 966 inode->i_ino = atomic_long_inc_return(&ofs->last_ino); 967 if (unlikely(!inode->i_ino)) 968 inode->i_ino = atomic_long_inc_return(&ofs->last_ino); 969 } 970 971 static void ovl_map_ino(struct inode *inode, unsigned long ino, int fsid) 972 { 973 int xinobits = ovl_xino_bits(inode->i_sb); 974 unsigned int xinoshift = 64 - xinobits; 975 976 /* 977 * When d_ino is consistent with st_ino (samefs or i_ino has enough 978 * bits to encode layer), set the same value used for st_ino to i_ino, 979 * so inode number exposed via /proc/locks and a like will be 980 * consistent with d_ino and st_ino values. An i_ino value inconsistent 981 * with d_ino also causes nfsd readdirplus to fail. 982 */ 983 inode->i_ino = ino; 984 if (ovl_same_fs(inode->i_sb)) { 985 return; 986 } else if (xinobits && likely(!(ino >> xinoshift))) { 987 inode->i_ino |= (unsigned long)fsid << (xinoshift + 1); 988 return; 989 } 990 991 /* 992 * For directory inodes on non-samefs with xino disabled or xino 993 * overflow, we allocate a non-persistent inode number, to be used for 994 * resolving st_ino collisions in ovl_map_dev_ino(). 995 * 996 * To avoid ino collision with legitimate xino values from upper 997 * layer (fsid 0), use the lowest xinobit to map the non 998 * persistent inode numbers to the unified st_ino address space. 999 */ 1000 if (S_ISDIR(inode->i_mode)) { 1001 ovl_next_ino(inode); 1002 if (xinobits) { 1003 inode->i_ino &= ~0UL >> xinobits; 1004 inode->i_ino |= 1UL << xinoshift; 1005 } 1006 } 1007 } 1008 1009 void ovl_inode_init(struct inode *inode, struct ovl_inode_params *oip, 1010 unsigned long ino, int fsid) 1011 { 1012 struct inode *realinode; 1013 struct ovl_inode *oi = OVL_I(inode); 1014 1015 oi->__upperdentry = oip->upperdentry; 1016 oi->oe = oip->oe; 1017 oi->redirect = oip->redirect; 1018 oi->lowerdata_redirect = oip->lowerdata_redirect; 1019 1020 realinode = ovl_inode_real(inode); 1021 ovl_copyattr(inode); 1022 ovl_copyflags(realinode, inode); 1023 ovl_map_ino(inode, ino, fsid); 1024 } 1025 1026 static void ovl_fill_inode(struct inode *inode, umode_t mode, dev_t rdev) 1027 { 1028 inode->i_mode = mode; 1029 inode->i_flags |= S_NOCMTIME; 1030 #ifdef CONFIG_FS_POSIX_ACL 1031 inode->i_acl = inode->i_default_acl = ACL_DONT_CACHE; 1032 #endif 1033 1034 ovl_lockdep_annotate_inode_mutex_key(inode); 1035 1036 switch (mode & S_IFMT) { 1037 case S_IFREG: 1038 inode->i_op = &ovl_file_inode_operations; 1039 inode->i_fop = &ovl_file_operations; 1040 inode->i_mapping->a_ops = &ovl_aops; 1041 break; 1042 1043 case S_IFDIR: 1044 inode->i_op = &ovl_dir_inode_operations; 1045 inode->i_fop = &ovl_dir_operations; 1046 break; 1047 1048 case S_IFLNK: 1049 inode->i_op = &ovl_symlink_inode_operations; 1050 break; 1051 1052 default: 1053 inode->i_op = &ovl_special_inode_operations; 1054 init_special_inode(inode, mode, rdev); 1055 break; 1056 } 1057 } 1058 1059 /* 1060 * With inodes index enabled, an overlay inode nlink counts the union of upper 1061 * hardlinks and non-covered lower hardlinks. During the lifetime of a non-pure 1062 * upper inode, the following nlink modifying operations can happen: 1063 * 1064 * 1. Lower hardlink copy up 1065 * 2. Upper hardlink created, unlinked or renamed over 1066 * 3. Lower hardlink whiteout or renamed over 1067 * 1068 * For the first, copy up case, the union nlink does not change, whether the 1069 * operation succeeds or fails, but the upper inode nlink may change. 1070 * Therefore, before copy up, we store the union nlink value relative to the 1071 * lower inode nlink in the index inode xattr .overlay.nlink. 1072 * 1073 * For the second, upper hardlink case, the union nlink should be incremented 1074 * or decremented IFF the operation succeeds, aligned with nlink change of the 1075 * upper inode. Therefore, before link/unlink/rename, we store the union nlink 1076 * value relative to the upper inode nlink in the index inode. 1077 * 1078 * For the last, lower cover up case, we simplify things by preceding the 1079 * whiteout or cover up with copy up. This makes sure that there is an index 1080 * upper inode where the nlink xattr can be stored before the copied up upper 1081 * entry is unlink. 1082 */ 1083 #define OVL_NLINK_ADD_UPPER (1 << 0) 1084 1085 /* 1086 * On-disk format for indexed nlink: 1087 * 1088 * nlink relative to the upper inode - "U[+-]NUM" 1089 * nlink relative to the lower inode - "L[+-]NUM" 1090 */ 1091 1092 static int ovl_set_nlink_common(struct dentry *dentry, 1093 struct dentry *realdentry, const char *format) 1094 { 1095 struct inode *inode = d_inode(dentry); 1096 struct inode *realinode = d_inode(realdentry); 1097 char buf[13]; 1098 int len; 1099 1100 len = snprintf(buf, sizeof(buf), format, 1101 (int) (inode->i_nlink - realinode->i_nlink)); 1102 1103 if (WARN_ON(len >= sizeof(buf))) 1104 return -EIO; 1105 1106 return ovl_setxattr(OVL_FS(inode->i_sb), ovl_dentry_upper(dentry), 1107 OVL_XATTR_NLINK, buf, len); 1108 } 1109 1110 int ovl_set_nlink_upper(struct dentry *dentry) 1111 { 1112 return ovl_set_nlink_common(dentry, ovl_dentry_upper(dentry), "U%+i"); 1113 } 1114 1115 int ovl_set_nlink_lower(struct dentry *dentry) 1116 { 1117 return ovl_set_nlink_common(dentry, ovl_dentry_lower(dentry), "L%+i"); 1118 } 1119 1120 unsigned int ovl_get_nlink(struct ovl_fs *ofs, struct dentry *lowerdentry, 1121 struct dentry *upperdentry, 1122 unsigned int fallback) 1123 { 1124 int nlink_diff; 1125 int nlink; 1126 char buf[13]; 1127 int err; 1128 1129 if (!lowerdentry || !upperdentry || d_inode(lowerdentry)->i_nlink == 1) 1130 return fallback; 1131 1132 err = ovl_getxattr_upper(ofs, upperdentry, OVL_XATTR_NLINK, 1133 &buf, sizeof(buf) - 1); 1134 if (err < 0) 1135 goto fail; 1136 1137 buf[err] = '\0'; 1138 if ((buf[0] != 'L' && buf[0] != 'U') || 1139 (buf[1] != '+' && buf[1] != '-')) 1140 goto fail; 1141 1142 err = kstrtoint(buf + 1, 10, &nlink_diff); 1143 if (err < 0) 1144 goto fail; 1145 1146 nlink = d_inode(buf[0] == 'L' ? lowerdentry : upperdentry)->i_nlink; 1147 nlink += nlink_diff; 1148 1149 if (nlink <= 0) 1150 goto fail; 1151 1152 return nlink; 1153 1154 fail: 1155 pr_warn_ratelimited("failed to get index nlink (%pd2, err=%i)\n", 1156 upperdentry, err); 1157 return fallback; 1158 } 1159 1160 struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, dev_t rdev) 1161 { 1162 struct inode *inode; 1163 1164 inode = new_inode(sb); 1165 if (inode) 1166 ovl_fill_inode(inode, mode, rdev); 1167 1168 return inode; 1169 } 1170 1171 static int ovl_inode_test(struct inode *inode, void *data) 1172 { 1173 return inode->i_private == data; 1174 } 1175 1176 static int ovl_inode_set(struct inode *inode, void *data) 1177 { 1178 inode->i_private = data; 1179 return 0; 1180 } 1181 1182 static bool ovl_verify_inode(struct inode *inode, struct dentry *lowerdentry, 1183 struct dentry *upperdentry, bool strict) 1184 { 1185 /* 1186 * For directories, @strict verify from lookup path performs consistency 1187 * checks, so NULL lower/upper in dentry must match NULL lower/upper in 1188 * inode. Non @strict verify from NFS handle decode path passes NULL for 1189 * 'unknown' lower/upper. 1190 */ 1191 if (S_ISDIR(inode->i_mode) && strict) { 1192 /* Real lower dir moved to upper layer under us? */ 1193 if (!lowerdentry && ovl_inode_lower(inode)) 1194 return false; 1195 1196 /* Lookup of an uncovered redirect origin? */ 1197 if (!upperdentry && ovl_inode_upper(inode)) 1198 return false; 1199 } 1200 1201 /* 1202 * Allow non-NULL lower inode in ovl_inode even if lowerdentry is NULL. 1203 * This happens when finding a copied up overlay inode for a renamed 1204 * or hardlinked overlay dentry and lower dentry cannot be followed 1205 * by origin because lower fs does not support file handles. 1206 */ 1207 if (lowerdentry && ovl_inode_lower(inode) != d_inode(lowerdentry)) 1208 return false; 1209 1210 /* 1211 * Allow non-NULL __upperdentry in inode even if upperdentry is NULL. 1212 * This happens when finding a lower alias for a copied up hard link. 1213 */ 1214 if (upperdentry && ovl_inode_upper(inode) != d_inode(upperdentry)) 1215 return false; 1216 1217 return true; 1218 } 1219 1220 struct inode *ovl_lookup_inode(struct super_block *sb, struct dentry *real, 1221 bool is_upper) 1222 { 1223 struct inode *inode, *key = d_inode(real); 1224 1225 inode = ilookup5(sb, (unsigned long) key, ovl_inode_test, key); 1226 if (!inode) 1227 return NULL; 1228 1229 if (!ovl_verify_inode(inode, is_upper ? NULL : real, 1230 is_upper ? real : NULL, false)) { 1231 iput(inode); 1232 return ERR_PTR(-ESTALE); 1233 } 1234 1235 return inode; 1236 } 1237 1238 bool ovl_lookup_trap_inode(struct super_block *sb, struct dentry *dir) 1239 { 1240 struct inode *key = d_inode(dir); 1241 struct inode *trap; 1242 bool res; 1243 1244 trap = ilookup5(sb, (unsigned long) key, ovl_inode_test, key); 1245 if (!trap) 1246 return false; 1247 1248 res = IS_DEADDIR(trap) && !ovl_inode_upper(trap) && 1249 !ovl_inode_lower(trap); 1250 1251 iput(trap); 1252 return res; 1253 } 1254 1255 /* 1256 * Create an inode cache entry for layer root dir, that will intentionally 1257 * fail ovl_verify_inode(), so any lookup that will find some layer root 1258 * will fail. 1259 */ 1260 struct inode *ovl_get_trap_inode(struct super_block *sb, struct dentry *dir) 1261 { 1262 struct inode *key = d_inode(dir); 1263 struct inode *trap; 1264 1265 if (!d_is_dir(dir)) 1266 return ERR_PTR(-ENOTDIR); 1267 1268 trap = iget5_locked(sb, (unsigned long) key, ovl_inode_test, 1269 ovl_inode_set, key); 1270 if (!trap) 1271 return ERR_PTR(-ENOMEM); 1272 1273 if (!(trap->i_state & I_NEW)) { 1274 /* Conflicting layer roots? */ 1275 iput(trap); 1276 return ERR_PTR(-ELOOP); 1277 } 1278 1279 trap->i_mode = S_IFDIR; 1280 trap->i_flags = S_DEAD; 1281 unlock_new_inode(trap); 1282 1283 return trap; 1284 } 1285 1286 /* 1287 * Does overlay inode need to be hashed by lower inode? 1288 */ 1289 static bool ovl_hash_bylower(struct super_block *sb, struct dentry *upper, 1290 struct dentry *lower, bool index) 1291 { 1292 struct ovl_fs *ofs = sb->s_fs_info; 1293 1294 /* No, if pure upper */ 1295 if (!lower) 1296 return false; 1297 1298 /* Yes, if already indexed */ 1299 if (index) 1300 return true; 1301 1302 /* Yes, if won't be copied up */ 1303 if (!ovl_upper_mnt(ofs)) 1304 return true; 1305 1306 /* No, if lower hardlink is or will be broken on copy up */ 1307 if ((upper || !ovl_indexdir(sb)) && 1308 !d_is_dir(lower) && d_inode(lower)->i_nlink > 1) 1309 return false; 1310 1311 /* No, if non-indexed upper with NFS export */ 1312 if (sb->s_export_op && upper) 1313 return false; 1314 1315 /* Otherwise, hash by lower inode for fsnotify */ 1316 return true; 1317 } 1318 1319 static struct inode *ovl_iget5(struct super_block *sb, struct inode *newinode, 1320 struct inode *key) 1321 { 1322 return newinode ? inode_insert5(newinode, (unsigned long) key, 1323 ovl_inode_test, ovl_inode_set, key) : 1324 iget5_locked(sb, (unsigned long) key, 1325 ovl_inode_test, ovl_inode_set, key); 1326 } 1327 1328 struct inode *ovl_get_inode(struct super_block *sb, 1329 struct ovl_inode_params *oip) 1330 { 1331 struct ovl_fs *ofs = OVL_FS(sb); 1332 struct dentry *upperdentry = oip->upperdentry; 1333 struct ovl_path *lowerpath = ovl_lowerpath(oip->oe); 1334 struct inode *realinode = upperdentry ? d_inode(upperdentry) : NULL; 1335 struct inode *inode; 1336 struct dentry *lowerdentry = lowerpath ? lowerpath->dentry : NULL; 1337 struct path realpath = { 1338 .dentry = upperdentry ?: lowerdentry, 1339 .mnt = upperdentry ? ovl_upper_mnt(ofs) : lowerpath->layer->mnt, 1340 }; 1341 bool bylower = ovl_hash_bylower(sb, upperdentry, lowerdentry, 1342 oip->index); 1343 int fsid = bylower ? lowerpath->layer->fsid : 0; 1344 bool is_dir; 1345 unsigned long ino = 0; 1346 int err = oip->newinode ? -EEXIST : -ENOMEM; 1347 1348 if (!realinode) 1349 realinode = d_inode(lowerdentry); 1350 1351 /* 1352 * Copy up origin (lower) may exist for non-indexed upper, but we must 1353 * not use lower as hash key if this is a broken hardlink. 1354 */ 1355 is_dir = S_ISDIR(realinode->i_mode); 1356 if (upperdentry || bylower) { 1357 struct inode *key = d_inode(bylower ? lowerdentry : 1358 upperdentry); 1359 unsigned int nlink = is_dir ? 1 : realinode->i_nlink; 1360 1361 inode = ovl_iget5(sb, oip->newinode, key); 1362 if (!inode) 1363 goto out_err; 1364 if (!(inode->i_state & I_NEW)) { 1365 /* 1366 * Verify that the underlying files stored in the inode 1367 * match those in the dentry. 1368 */ 1369 if (!ovl_verify_inode(inode, lowerdentry, upperdentry, 1370 true)) { 1371 iput(inode); 1372 err = -ESTALE; 1373 goto out_err; 1374 } 1375 1376 dput(upperdentry); 1377 ovl_free_entry(oip->oe); 1378 kfree(oip->redirect); 1379 kfree(oip->lowerdata_redirect); 1380 goto out; 1381 } 1382 1383 /* Recalculate nlink for non-dir due to indexing */ 1384 if (!is_dir) 1385 nlink = ovl_get_nlink(ofs, lowerdentry, upperdentry, 1386 nlink); 1387 set_nlink(inode, nlink); 1388 ino = key->i_ino; 1389 } else { 1390 /* Lower hardlink that will be broken on copy up */ 1391 inode = new_inode(sb); 1392 if (!inode) { 1393 err = -ENOMEM; 1394 goto out_err; 1395 } 1396 ino = realinode->i_ino; 1397 fsid = lowerpath->layer->fsid; 1398 } 1399 ovl_fill_inode(inode, realinode->i_mode, realinode->i_rdev); 1400 ovl_inode_init(inode, oip, ino, fsid); 1401 1402 if (upperdentry && ovl_is_impuredir(sb, upperdentry)) 1403 ovl_set_flag(OVL_IMPURE, inode); 1404 1405 if (oip->index) 1406 ovl_set_flag(OVL_INDEX, inode); 1407 1408 if (bylower) 1409 ovl_set_flag(OVL_CONST_INO, inode); 1410 1411 /* Check for non-merge dir that may have whiteouts */ 1412 if (is_dir) { 1413 if (((upperdentry && lowerdentry) || ovl_numlower(oip->oe) > 1) || 1414 ovl_path_check_origin_xattr(ofs, &realpath)) { 1415 ovl_set_flag(OVL_WHITEOUTS, inode); 1416 } 1417 } 1418 1419 /* Check for immutable/append-only inode flags in xattr */ 1420 if (upperdentry) 1421 ovl_check_protattr(inode, upperdentry); 1422 1423 if (inode->i_state & I_NEW) 1424 unlock_new_inode(inode); 1425 out: 1426 return inode; 1427 1428 out_err: 1429 pr_warn_ratelimited("failed to get inode (%i)\n", err); 1430 inode = ERR_PTR(err); 1431 goto out; 1432 } 1433