1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2011 Novell Inc. 4 * Copyright (C) 2016 Red Hat, Inc. 5 */ 6 7 #include <linux/fs.h> 8 #include <linux/mount.h> 9 #include <linux/slab.h> 10 #include <linux/cred.h> 11 #include <linux/xattr.h> 12 #include <linux/exportfs.h> 13 #include <linux/file.h> 14 #include <linux/fileattr.h> 15 #include <linux/uuid.h> 16 #include <linux/namei.h> 17 #include <linux/ratelimit.h> 18 #include "overlayfs.h" 19 20 int ovl_want_write(struct dentry *dentry) 21 { 22 struct ovl_fs *ofs = dentry->d_sb->s_fs_info; 23 return mnt_want_write(ovl_upper_mnt(ofs)); 24 } 25 26 void ovl_drop_write(struct dentry *dentry) 27 { 28 struct ovl_fs *ofs = dentry->d_sb->s_fs_info; 29 mnt_drop_write(ovl_upper_mnt(ofs)); 30 } 31 32 struct dentry *ovl_workdir(struct dentry *dentry) 33 { 34 struct ovl_fs *ofs = dentry->d_sb->s_fs_info; 35 return ofs->workdir; 36 } 37 38 const struct cred *ovl_override_creds(struct super_block *sb) 39 { 40 struct ovl_fs *ofs = sb->s_fs_info; 41 42 return override_creds(ofs->creator_cred); 43 } 44 45 /* 46 * Check if underlying fs supports file handles and try to determine encoding 47 * type, in order to deduce maximum inode number used by fs. 48 * 49 * Return 0 if file handles are not supported. 50 * Return 1 (FILEID_INO32_GEN) if fs uses the default 32bit inode encoding. 51 * Return -1 if fs uses a non default encoding with unknown inode size. 52 */ 53 int ovl_can_decode_fh(struct super_block *sb) 54 { 55 if (!capable(CAP_DAC_READ_SEARCH)) 56 return 0; 57 58 if (!sb->s_export_op || !sb->s_export_op->fh_to_dentry) 59 return 0; 60 61 return sb->s_export_op->encode_fh ? -1 : FILEID_INO32_GEN; 62 } 63 64 struct dentry *ovl_indexdir(struct super_block *sb) 65 { 66 struct ovl_fs *ofs = sb->s_fs_info; 67 68 return ofs->indexdir; 69 } 70 71 /* Index all files on copy up. For now only enabled for NFS export */ 72 bool ovl_index_all(struct super_block *sb) 73 { 74 struct ovl_fs *ofs = sb->s_fs_info; 75 76 return ofs->config.nfs_export && ofs->config.index; 77 } 78 79 /* Verify lower origin on lookup. For now only enabled for NFS export */ 80 bool ovl_verify_lower(struct super_block *sb) 81 { 82 struct ovl_fs *ofs = sb->s_fs_info; 83 84 return ofs->config.nfs_export && ofs->config.index; 85 } 86 87 struct ovl_path *ovl_stack_alloc(unsigned int n) 88 { 89 return kcalloc(n, sizeof(struct ovl_path), GFP_KERNEL); 90 } 91 92 void ovl_stack_cpy(struct ovl_path *dst, struct ovl_path *src, unsigned int n) 93 { 94 unsigned int i; 95 96 memcpy(dst, src, sizeof(struct ovl_path) * n); 97 for (i = 0; i < n; i++) 98 dget(src[i].dentry); 99 } 100 101 void ovl_stack_put(struct ovl_path *stack, unsigned int n) 102 { 103 unsigned int i; 104 105 for (i = 0; stack && i < n; i++) 106 dput(stack[i].dentry); 107 } 108 109 void ovl_stack_free(struct ovl_path *stack, unsigned int n) 110 { 111 ovl_stack_put(stack, n); 112 kfree(stack); 113 } 114 115 struct ovl_entry *ovl_alloc_entry(unsigned int numlower) 116 { 117 size_t size = offsetof(struct ovl_entry, __lowerstack[numlower]); 118 struct ovl_entry *oe = kzalloc(size, GFP_KERNEL); 119 120 if (oe) 121 oe->__numlower = numlower; 122 123 return oe; 124 } 125 126 void ovl_free_entry(struct ovl_entry *oe) 127 { 128 ovl_stack_put(ovl_lowerstack(oe), ovl_numlower(oe)); 129 kfree(oe); 130 } 131 132 #define OVL_D_REVALIDATE (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE) 133 134 bool ovl_dentry_remote(struct dentry *dentry) 135 { 136 return dentry->d_flags & OVL_D_REVALIDATE; 137 } 138 139 void ovl_dentry_update_reval(struct dentry *dentry, struct dentry *realdentry) 140 { 141 if (!ovl_dentry_remote(realdentry)) 142 return; 143 144 spin_lock(&dentry->d_lock); 145 dentry->d_flags |= realdentry->d_flags & OVL_D_REVALIDATE; 146 spin_unlock(&dentry->d_lock); 147 } 148 149 void ovl_dentry_init_reval(struct dentry *dentry, struct dentry *upperdentry, 150 struct ovl_entry *oe) 151 { 152 return ovl_dentry_init_flags(dentry, upperdentry, oe, OVL_D_REVALIDATE); 153 } 154 155 void ovl_dentry_init_flags(struct dentry *dentry, struct dentry *upperdentry, 156 struct ovl_entry *oe, unsigned int mask) 157 { 158 struct ovl_path *lowerstack = ovl_lowerstack(oe); 159 unsigned int i, flags = 0; 160 161 if (upperdentry) 162 flags |= upperdentry->d_flags; 163 for (i = 0; i < ovl_numlower(oe) && lowerstack[i].dentry; i++) 164 flags |= lowerstack[i].dentry->d_flags; 165 166 spin_lock(&dentry->d_lock); 167 dentry->d_flags &= ~mask; 168 dentry->d_flags |= flags & mask; 169 spin_unlock(&dentry->d_lock); 170 } 171 172 bool ovl_dentry_weird(struct dentry *dentry) 173 { 174 return dentry->d_flags & (DCACHE_NEED_AUTOMOUNT | 175 DCACHE_MANAGE_TRANSIT | 176 DCACHE_OP_HASH | 177 DCACHE_OP_COMPARE); 178 } 179 180 enum ovl_path_type ovl_path_type(struct dentry *dentry) 181 { 182 struct ovl_entry *oe = OVL_E(dentry); 183 enum ovl_path_type type = 0; 184 185 if (ovl_dentry_upper(dentry)) { 186 type = __OVL_PATH_UPPER; 187 188 /* 189 * Non-dir dentry can hold lower dentry of its copy up origin. 190 */ 191 if (ovl_numlower(oe)) { 192 if (ovl_test_flag(OVL_CONST_INO, d_inode(dentry))) 193 type |= __OVL_PATH_ORIGIN; 194 if (d_is_dir(dentry) || 195 !ovl_has_upperdata(d_inode(dentry))) 196 type |= __OVL_PATH_MERGE; 197 } 198 } else { 199 if (ovl_numlower(oe) > 1) 200 type |= __OVL_PATH_MERGE; 201 } 202 return type; 203 } 204 205 void ovl_path_upper(struct dentry *dentry, struct path *path) 206 { 207 struct ovl_fs *ofs = dentry->d_sb->s_fs_info; 208 209 path->mnt = ovl_upper_mnt(ofs); 210 path->dentry = ovl_dentry_upper(dentry); 211 } 212 213 void ovl_path_lower(struct dentry *dentry, struct path *path) 214 { 215 struct ovl_entry *oe = OVL_E(dentry); 216 struct ovl_path *lowerpath = ovl_lowerstack(oe); 217 218 if (ovl_numlower(oe)) { 219 path->mnt = lowerpath->layer->mnt; 220 path->dentry = lowerpath->dentry; 221 } else { 222 *path = (struct path) { }; 223 } 224 } 225 226 void ovl_path_lowerdata(struct dentry *dentry, struct path *path) 227 { 228 struct ovl_entry *oe = OVL_E(dentry); 229 struct ovl_path *lowerdata = ovl_lowerdata(oe); 230 struct dentry *lowerdata_dentry = ovl_lowerdata_dentry(oe); 231 232 if (lowerdata_dentry) { 233 path->dentry = lowerdata_dentry; 234 /* 235 * Pairs with smp_wmb() in ovl_dentry_set_lowerdata(). 236 * Make sure that if lowerdata->dentry is visible, then 237 * datapath->layer is visible as well. 238 */ 239 smp_rmb(); 240 path->mnt = READ_ONCE(lowerdata->layer)->mnt; 241 } else { 242 *path = (struct path) { }; 243 } 244 } 245 246 enum ovl_path_type ovl_path_real(struct dentry *dentry, struct path *path) 247 { 248 enum ovl_path_type type = ovl_path_type(dentry); 249 250 if (!OVL_TYPE_UPPER(type)) 251 ovl_path_lower(dentry, path); 252 else 253 ovl_path_upper(dentry, path); 254 255 return type; 256 } 257 258 enum ovl_path_type ovl_path_realdata(struct dentry *dentry, struct path *path) 259 { 260 enum ovl_path_type type = ovl_path_type(dentry); 261 262 WARN_ON_ONCE(d_is_dir(dentry)); 263 264 if (!OVL_TYPE_UPPER(type) || OVL_TYPE_MERGE(type)) 265 ovl_path_lowerdata(dentry, path); 266 else 267 ovl_path_upper(dentry, path); 268 269 return type; 270 } 271 272 struct dentry *ovl_dentry_upper(struct dentry *dentry) 273 { 274 return ovl_upperdentry_dereference(OVL_I(d_inode(dentry))); 275 } 276 277 struct dentry *ovl_dentry_lower(struct dentry *dentry) 278 { 279 struct ovl_entry *oe = OVL_E(dentry); 280 281 return ovl_numlower(oe) ? ovl_lowerstack(oe)->dentry : NULL; 282 } 283 284 const struct ovl_layer *ovl_layer_lower(struct dentry *dentry) 285 { 286 struct ovl_entry *oe = OVL_E(dentry); 287 288 return ovl_numlower(oe) ? ovl_lowerstack(oe)->layer : NULL; 289 } 290 291 /* 292 * ovl_dentry_lower() could return either a data dentry or metacopy dentry 293 * depending on what is stored in lowerstack[0]. At times we need to find 294 * lower dentry which has data (and not metacopy dentry). This helper 295 * returns the lower data dentry. 296 */ 297 struct dentry *ovl_dentry_lowerdata(struct dentry *dentry) 298 { 299 return ovl_lowerdata_dentry(OVL_E(dentry)); 300 } 301 302 int ovl_dentry_set_lowerdata(struct dentry *dentry, struct ovl_path *datapath) 303 { 304 struct ovl_entry *oe = OVL_E(dentry); 305 struct ovl_path *lowerdata = ovl_lowerdata(oe); 306 struct dentry *datadentry = datapath->dentry; 307 308 if (WARN_ON_ONCE(ovl_numlower(oe) <= 1)) 309 return -EIO; 310 311 WRITE_ONCE(lowerdata->layer, datapath->layer); 312 /* 313 * Pairs with smp_rmb() in ovl_path_lowerdata(). 314 * Make sure that if lowerdata->dentry is visible, then 315 * lowerdata->layer is visible as well. 316 */ 317 smp_wmb(); 318 WRITE_ONCE(lowerdata->dentry, dget(datadentry)); 319 320 ovl_dentry_update_reval(dentry, datadentry); 321 322 return 0; 323 } 324 325 struct dentry *ovl_dentry_real(struct dentry *dentry) 326 { 327 return ovl_dentry_upper(dentry) ?: ovl_dentry_lower(dentry); 328 } 329 330 struct dentry *ovl_i_dentry_upper(struct inode *inode) 331 { 332 return ovl_upperdentry_dereference(OVL_I(inode)); 333 } 334 335 struct inode *ovl_i_path_real(struct inode *inode, struct path *path) 336 { 337 struct ovl_path *lowerpath = ovl_lowerpath(OVL_I_E(inode)); 338 339 path->dentry = ovl_i_dentry_upper(inode); 340 if (!path->dentry) { 341 path->dentry = lowerpath->dentry; 342 path->mnt = lowerpath->layer->mnt; 343 } else { 344 path->mnt = ovl_upper_mnt(OVL_FS(inode->i_sb)); 345 } 346 347 return path->dentry ? d_inode_rcu(path->dentry) : NULL; 348 } 349 350 struct inode *ovl_inode_upper(struct inode *inode) 351 { 352 struct dentry *upperdentry = ovl_i_dentry_upper(inode); 353 354 return upperdentry ? d_inode(upperdentry) : NULL; 355 } 356 357 struct inode *ovl_inode_lower(struct inode *inode) 358 { 359 struct ovl_path *lowerpath = ovl_lowerpath(OVL_I_E(inode)); 360 361 return lowerpath ? d_inode(lowerpath->dentry) : NULL; 362 } 363 364 struct inode *ovl_inode_real(struct inode *inode) 365 { 366 return ovl_inode_upper(inode) ?: ovl_inode_lower(inode); 367 } 368 369 /* Return inode which contains lower data. Do not return metacopy */ 370 struct inode *ovl_inode_lowerdata(struct inode *inode) 371 { 372 struct dentry *lowerdata = ovl_lowerdata_dentry(OVL_I_E(inode)); 373 374 if (WARN_ON(!S_ISREG(inode->i_mode))) 375 return NULL; 376 377 return lowerdata ? d_inode(lowerdata) : NULL; 378 } 379 380 /* Return real inode which contains data. Does not return metacopy inode */ 381 struct inode *ovl_inode_realdata(struct inode *inode) 382 { 383 struct inode *upperinode; 384 385 upperinode = ovl_inode_upper(inode); 386 if (upperinode && ovl_has_upperdata(inode)) 387 return upperinode; 388 389 return ovl_inode_lowerdata(inode); 390 } 391 392 const char *ovl_lowerdata_redirect(struct inode *inode) 393 { 394 return inode && S_ISREG(inode->i_mode) ? 395 OVL_I(inode)->lowerdata_redirect : NULL; 396 } 397 398 struct ovl_dir_cache *ovl_dir_cache(struct inode *inode) 399 { 400 return inode && S_ISDIR(inode->i_mode) ? OVL_I(inode)->cache : NULL; 401 } 402 403 void ovl_set_dir_cache(struct inode *inode, struct ovl_dir_cache *cache) 404 { 405 OVL_I(inode)->cache = cache; 406 } 407 408 void ovl_dentry_set_flag(unsigned long flag, struct dentry *dentry) 409 { 410 set_bit(flag, OVL_E_FLAGS(dentry)); 411 } 412 413 void ovl_dentry_clear_flag(unsigned long flag, struct dentry *dentry) 414 { 415 clear_bit(flag, OVL_E_FLAGS(dentry)); 416 } 417 418 bool ovl_dentry_test_flag(unsigned long flag, struct dentry *dentry) 419 { 420 return test_bit(flag, OVL_E_FLAGS(dentry)); 421 } 422 423 bool ovl_dentry_is_opaque(struct dentry *dentry) 424 { 425 return ovl_dentry_test_flag(OVL_E_OPAQUE, dentry); 426 } 427 428 bool ovl_dentry_is_whiteout(struct dentry *dentry) 429 { 430 return !dentry->d_inode && ovl_dentry_is_opaque(dentry); 431 } 432 433 void ovl_dentry_set_opaque(struct dentry *dentry) 434 { 435 ovl_dentry_set_flag(OVL_E_OPAQUE, dentry); 436 } 437 438 /* 439 * For hard links and decoded file handles, it's possible for ovl_dentry_upper() 440 * to return positive, while there's no actual upper alias for the inode. 441 * Copy up code needs to know about the existence of the upper alias, so it 442 * can't use ovl_dentry_upper(). 443 */ 444 bool ovl_dentry_has_upper_alias(struct dentry *dentry) 445 { 446 return ovl_dentry_test_flag(OVL_E_UPPER_ALIAS, dentry); 447 } 448 449 void ovl_dentry_set_upper_alias(struct dentry *dentry) 450 { 451 ovl_dentry_set_flag(OVL_E_UPPER_ALIAS, dentry); 452 } 453 454 static bool ovl_should_check_upperdata(struct inode *inode) 455 { 456 if (!S_ISREG(inode->i_mode)) 457 return false; 458 459 if (!ovl_inode_lower(inode)) 460 return false; 461 462 return true; 463 } 464 465 bool ovl_has_upperdata(struct inode *inode) 466 { 467 if (!ovl_should_check_upperdata(inode)) 468 return true; 469 470 if (!ovl_test_flag(OVL_UPPERDATA, inode)) 471 return false; 472 /* 473 * Pairs with smp_wmb() in ovl_set_upperdata(). Main user of 474 * ovl_has_upperdata() is ovl_copy_up_meta_inode_data(). Make sure 475 * if setting of OVL_UPPERDATA is visible, then effects of writes 476 * before that are visible too. 477 */ 478 smp_rmb(); 479 return true; 480 } 481 482 void ovl_set_upperdata(struct inode *inode) 483 { 484 /* 485 * Pairs with smp_rmb() in ovl_has_upperdata(). Make sure 486 * if OVL_UPPERDATA flag is visible, then effects of write operations 487 * before it are visible as well. 488 */ 489 smp_wmb(); 490 ovl_set_flag(OVL_UPPERDATA, inode); 491 } 492 493 /* Caller should hold ovl_inode->lock */ 494 bool ovl_dentry_needs_data_copy_up_locked(struct dentry *dentry, int flags) 495 { 496 if (!ovl_open_flags_need_copy_up(flags)) 497 return false; 498 499 return !ovl_test_flag(OVL_UPPERDATA, d_inode(dentry)); 500 } 501 502 bool ovl_dentry_needs_data_copy_up(struct dentry *dentry, int flags) 503 { 504 if (!ovl_open_flags_need_copy_up(flags)) 505 return false; 506 507 return !ovl_has_upperdata(d_inode(dentry)); 508 } 509 510 const char *ovl_dentry_get_redirect(struct dentry *dentry) 511 { 512 return OVL_I(d_inode(dentry))->redirect; 513 } 514 515 void ovl_dentry_set_redirect(struct dentry *dentry, const char *redirect) 516 { 517 struct ovl_inode *oi = OVL_I(d_inode(dentry)); 518 519 kfree(oi->redirect); 520 oi->redirect = redirect; 521 } 522 523 void ovl_inode_update(struct inode *inode, struct dentry *upperdentry) 524 { 525 struct inode *upperinode = d_inode(upperdentry); 526 527 WARN_ON(OVL_I(inode)->__upperdentry); 528 529 /* 530 * Make sure upperdentry is consistent before making it visible 531 */ 532 smp_wmb(); 533 OVL_I(inode)->__upperdentry = upperdentry; 534 if (inode_unhashed(inode)) { 535 inode->i_private = upperinode; 536 __insert_inode_hash(inode, (unsigned long) upperinode); 537 } 538 } 539 540 static void ovl_dir_version_inc(struct dentry *dentry, bool impurity) 541 { 542 struct inode *inode = d_inode(dentry); 543 544 WARN_ON(!inode_is_locked(inode)); 545 WARN_ON(!d_is_dir(dentry)); 546 /* 547 * Version is used by readdir code to keep cache consistent. 548 * For merge dirs (or dirs with origin) all changes need to be noted. 549 * For non-merge dirs, cache contains only impure entries (i.e. ones 550 * which have been copied up and have origins), so only need to note 551 * changes to impure entries. 552 */ 553 if (!ovl_dir_is_real(inode) || impurity) 554 OVL_I(inode)->version++; 555 } 556 557 void ovl_dir_modified(struct dentry *dentry, bool impurity) 558 { 559 /* Copy mtime/ctime */ 560 ovl_copyattr(d_inode(dentry)); 561 562 ovl_dir_version_inc(dentry, impurity); 563 } 564 565 u64 ovl_inode_version_get(struct inode *inode) 566 { 567 WARN_ON(!inode_is_locked(inode)); 568 return OVL_I(inode)->version; 569 } 570 571 bool ovl_is_whiteout(struct dentry *dentry) 572 { 573 struct inode *inode = dentry->d_inode; 574 575 return inode && IS_WHITEOUT(inode); 576 } 577 578 struct file *ovl_path_open(const struct path *path, int flags) 579 { 580 struct inode *inode = d_inode(path->dentry); 581 struct mnt_idmap *real_idmap = mnt_idmap(path->mnt); 582 int err, acc_mode; 583 584 if (flags & ~(O_ACCMODE | O_LARGEFILE)) 585 BUG(); 586 587 switch (flags & O_ACCMODE) { 588 case O_RDONLY: 589 acc_mode = MAY_READ; 590 break; 591 case O_WRONLY: 592 acc_mode = MAY_WRITE; 593 break; 594 default: 595 BUG(); 596 } 597 598 err = inode_permission(real_idmap, inode, acc_mode | MAY_OPEN); 599 if (err) 600 return ERR_PTR(err); 601 602 /* O_NOATIME is an optimization, don't fail if not permitted */ 603 if (inode_owner_or_capable(real_idmap, inode)) 604 flags |= O_NOATIME; 605 606 return dentry_open(path, flags, current_cred()); 607 } 608 609 /* Caller should hold ovl_inode->lock */ 610 static bool ovl_already_copied_up_locked(struct dentry *dentry, int flags) 611 { 612 bool disconnected = dentry->d_flags & DCACHE_DISCONNECTED; 613 614 if (ovl_dentry_upper(dentry) && 615 (ovl_dentry_has_upper_alias(dentry) || disconnected) && 616 !ovl_dentry_needs_data_copy_up_locked(dentry, flags)) 617 return true; 618 619 return false; 620 } 621 622 bool ovl_already_copied_up(struct dentry *dentry, int flags) 623 { 624 bool disconnected = dentry->d_flags & DCACHE_DISCONNECTED; 625 626 /* 627 * Check if copy-up has happened as well as for upper alias (in 628 * case of hard links) is there. 629 * 630 * Both checks are lockless: 631 * - false negatives: will recheck under oi->lock 632 * - false positives: 633 * + ovl_dentry_upper() uses memory barriers to ensure the 634 * upper dentry is up-to-date 635 * + ovl_dentry_has_upper_alias() relies on locking of 636 * upper parent i_rwsem to prevent reordering copy-up 637 * with rename. 638 */ 639 if (ovl_dentry_upper(dentry) && 640 (ovl_dentry_has_upper_alias(dentry) || disconnected) && 641 !ovl_dentry_needs_data_copy_up(dentry, flags)) 642 return true; 643 644 return false; 645 } 646 647 int ovl_copy_up_start(struct dentry *dentry, int flags) 648 { 649 struct inode *inode = d_inode(dentry); 650 int err; 651 652 err = ovl_inode_lock_interruptible(inode); 653 if (!err && ovl_already_copied_up_locked(dentry, flags)) { 654 err = 1; /* Already copied up */ 655 ovl_inode_unlock(inode); 656 } 657 658 return err; 659 } 660 661 void ovl_copy_up_end(struct dentry *dentry) 662 { 663 ovl_inode_unlock(d_inode(dentry)); 664 } 665 666 bool ovl_path_check_origin_xattr(struct ovl_fs *ofs, const struct path *path) 667 { 668 int res; 669 670 res = ovl_path_getxattr(ofs, path, OVL_XATTR_ORIGIN, NULL, 0); 671 672 /* Zero size value means "copied up but origin unknown" */ 673 if (res >= 0) 674 return true; 675 676 return false; 677 } 678 679 bool ovl_path_check_dir_xattr(struct ovl_fs *ofs, const struct path *path, 680 enum ovl_xattr ox) 681 { 682 int res; 683 char val; 684 685 if (!d_is_dir(path->dentry)) 686 return false; 687 688 res = ovl_path_getxattr(ofs, path, ox, &val, 1); 689 if (res == 1 && val == 'y') 690 return true; 691 692 return false; 693 } 694 695 #define OVL_XATTR_OPAQUE_POSTFIX "opaque" 696 #define OVL_XATTR_REDIRECT_POSTFIX "redirect" 697 #define OVL_XATTR_ORIGIN_POSTFIX "origin" 698 #define OVL_XATTR_IMPURE_POSTFIX "impure" 699 #define OVL_XATTR_NLINK_POSTFIX "nlink" 700 #define OVL_XATTR_UPPER_POSTFIX "upper" 701 #define OVL_XATTR_METACOPY_POSTFIX "metacopy" 702 #define OVL_XATTR_PROTATTR_POSTFIX "protattr" 703 704 #define OVL_XATTR_TAB_ENTRY(x) \ 705 [x] = { [false] = OVL_XATTR_TRUSTED_PREFIX x ## _POSTFIX, \ 706 [true] = OVL_XATTR_USER_PREFIX x ## _POSTFIX } 707 708 const char *const ovl_xattr_table[][2] = { 709 OVL_XATTR_TAB_ENTRY(OVL_XATTR_OPAQUE), 710 OVL_XATTR_TAB_ENTRY(OVL_XATTR_REDIRECT), 711 OVL_XATTR_TAB_ENTRY(OVL_XATTR_ORIGIN), 712 OVL_XATTR_TAB_ENTRY(OVL_XATTR_IMPURE), 713 OVL_XATTR_TAB_ENTRY(OVL_XATTR_NLINK), 714 OVL_XATTR_TAB_ENTRY(OVL_XATTR_UPPER), 715 OVL_XATTR_TAB_ENTRY(OVL_XATTR_METACOPY), 716 OVL_XATTR_TAB_ENTRY(OVL_XATTR_PROTATTR), 717 }; 718 719 int ovl_check_setxattr(struct ovl_fs *ofs, struct dentry *upperdentry, 720 enum ovl_xattr ox, const void *value, size_t size, 721 int xerr) 722 { 723 int err; 724 725 if (ofs->noxattr) 726 return xerr; 727 728 err = ovl_setxattr(ofs, upperdentry, ox, value, size); 729 730 if (err == -EOPNOTSUPP) { 731 pr_warn("cannot set %s xattr on upper\n", ovl_xattr(ofs, ox)); 732 ofs->noxattr = true; 733 return xerr; 734 } 735 736 return err; 737 } 738 739 int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry) 740 { 741 struct ovl_fs *ofs = OVL_FS(dentry->d_sb); 742 int err; 743 744 if (ovl_test_flag(OVL_IMPURE, d_inode(dentry))) 745 return 0; 746 747 /* 748 * Do not fail when upper doesn't support xattrs. 749 * Upper inodes won't have origin nor redirect xattr anyway. 750 */ 751 err = ovl_check_setxattr(ofs, upperdentry, OVL_XATTR_IMPURE, "y", 1, 0); 752 if (!err) 753 ovl_set_flag(OVL_IMPURE, d_inode(dentry)); 754 755 return err; 756 } 757 758 759 #define OVL_PROTATTR_MAX 32 /* Reserved for future flags */ 760 761 void ovl_check_protattr(struct inode *inode, struct dentry *upper) 762 { 763 struct ovl_fs *ofs = OVL_FS(inode->i_sb); 764 u32 iflags = inode->i_flags & OVL_PROT_I_FLAGS_MASK; 765 char buf[OVL_PROTATTR_MAX+1]; 766 int res, n; 767 768 res = ovl_getxattr_upper(ofs, upper, OVL_XATTR_PROTATTR, buf, 769 OVL_PROTATTR_MAX); 770 if (res < 0) 771 return; 772 773 /* 774 * Initialize inode flags from overlay.protattr xattr and upper inode 775 * flags. If upper inode has those fileattr flags set (i.e. from old 776 * kernel), we do not clear them on ovl_get_inode(), but we will clear 777 * them on next fileattr_set(). 778 */ 779 for (n = 0; n < res; n++) { 780 if (buf[n] == 'a') 781 iflags |= S_APPEND; 782 else if (buf[n] == 'i') 783 iflags |= S_IMMUTABLE; 784 else 785 break; 786 } 787 788 if (!res || n < res) { 789 pr_warn_ratelimited("incompatible overlay.protattr format (%pd2, len=%d)\n", 790 upper, res); 791 } else { 792 inode_set_flags(inode, iflags, OVL_PROT_I_FLAGS_MASK); 793 } 794 } 795 796 int ovl_set_protattr(struct inode *inode, struct dentry *upper, 797 struct fileattr *fa) 798 { 799 struct ovl_fs *ofs = OVL_FS(inode->i_sb); 800 char buf[OVL_PROTATTR_MAX]; 801 int len = 0, err = 0; 802 u32 iflags = 0; 803 804 BUILD_BUG_ON(HWEIGHT32(OVL_PROT_FS_FLAGS_MASK) > OVL_PROTATTR_MAX); 805 806 if (fa->flags & FS_APPEND_FL) { 807 buf[len++] = 'a'; 808 iflags |= S_APPEND; 809 } 810 if (fa->flags & FS_IMMUTABLE_FL) { 811 buf[len++] = 'i'; 812 iflags |= S_IMMUTABLE; 813 } 814 815 /* 816 * Do not allow to set protection flags when upper doesn't support 817 * xattrs, because we do not set those fileattr flags on upper inode. 818 * Remove xattr if it exist and all protection flags are cleared. 819 */ 820 if (len) { 821 err = ovl_check_setxattr(ofs, upper, OVL_XATTR_PROTATTR, 822 buf, len, -EPERM); 823 } else if (inode->i_flags & OVL_PROT_I_FLAGS_MASK) { 824 err = ovl_removexattr(ofs, upper, OVL_XATTR_PROTATTR); 825 if (err == -EOPNOTSUPP || err == -ENODATA) 826 err = 0; 827 } 828 if (err) 829 return err; 830 831 inode_set_flags(inode, iflags, OVL_PROT_I_FLAGS_MASK); 832 833 /* Mask out the fileattr flags that should not be set in upper inode */ 834 fa->flags &= ~OVL_PROT_FS_FLAGS_MASK; 835 fa->fsx_xflags &= ~OVL_PROT_FSX_FLAGS_MASK; 836 837 return 0; 838 } 839 840 /** 841 * Caller must hold a reference to inode to prevent it from being freed while 842 * it is marked inuse. 843 */ 844 bool ovl_inuse_trylock(struct dentry *dentry) 845 { 846 struct inode *inode = d_inode(dentry); 847 bool locked = false; 848 849 spin_lock(&inode->i_lock); 850 if (!(inode->i_state & I_OVL_INUSE)) { 851 inode->i_state |= I_OVL_INUSE; 852 locked = true; 853 } 854 spin_unlock(&inode->i_lock); 855 856 return locked; 857 } 858 859 void ovl_inuse_unlock(struct dentry *dentry) 860 { 861 if (dentry) { 862 struct inode *inode = d_inode(dentry); 863 864 spin_lock(&inode->i_lock); 865 WARN_ON(!(inode->i_state & I_OVL_INUSE)); 866 inode->i_state &= ~I_OVL_INUSE; 867 spin_unlock(&inode->i_lock); 868 } 869 } 870 871 bool ovl_is_inuse(struct dentry *dentry) 872 { 873 struct inode *inode = d_inode(dentry); 874 bool inuse; 875 876 spin_lock(&inode->i_lock); 877 inuse = (inode->i_state & I_OVL_INUSE); 878 spin_unlock(&inode->i_lock); 879 880 return inuse; 881 } 882 883 /* 884 * Does this overlay dentry need to be indexed on copy up? 885 */ 886 bool ovl_need_index(struct dentry *dentry) 887 { 888 struct dentry *lower = ovl_dentry_lower(dentry); 889 890 if (!lower || !ovl_indexdir(dentry->d_sb)) 891 return false; 892 893 /* Index all files for NFS export and consistency verification */ 894 if (ovl_index_all(dentry->d_sb)) 895 return true; 896 897 /* Index only lower hardlinks on copy up */ 898 if (!d_is_dir(lower) && d_inode(lower)->i_nlink > 1) 899 return true; 900 901 return false; 902 } 903 904 /* Caller must hold OVL_I(inode)->lock */ 905 static void ovl_cleanup_index(struct dentry *dentry) 906 { 907 struct ovl_fs *ofs = OVL_FS(dentry->d_sb); 908 struct dentry *indexdir = ovl_indexdir(dentry->d_sb); 909 struct inode *dir = indexdir->d_inode; 910 struct dentry *lowerdentry = ovl_dentry_lower(dentry); 911 struct dentry *upperdentry = ovl_dentry_upper(dentry); 912 struct dentry *index = NULL; 913 struct inode *inode; 914 struct qstr name = { }; 915 int err; 916 917 err = ovl_get_index_name(ofs, lowerdentry, &name); 918 if (err) 919 goto fail; 920 921 inode = d_inode(upperdentry); 922 if (!S_ISDIR(inode->i_mode) && inode->i_nlink != 1) { 923 pr_warn_ratelimited("cleanup linked index (%pd2, ino=%lu, nlink=%u)\n", 924 upperdentry, inode->i_ino, inode->i_nlink); 925 /* 926 * We either have a bug with persistent union nlink or a lower 927 * hardlink was added while overlay is mounted. Adding a lower 928 * hardlink and then unlinking all overlay hardlinks would drop 929 * overlay nlink to zero before all upper inodes are unlinked. 930 * As a safety measure, when that situation is detected, set 931 * the overlay nlink to the index inode nlink minus one for the 932 * index entry itself. 933 */ 934 set_nlink(d_inode(dentry), inode->i_nlink - 1); 935 ovl_set_nlink_upper(dentry); 936 goto out; 937 } 938 939 inode_lock_nested(dir, I_MUTEX_PARENT); 940 index = ovl_lookup_upper(ofs, name.name, indexdir, name.len); 941 err = PTR_ERR(index); 942 if (IS_ERR(index)) { 943 index = NULL; 944 } else if (ovl_index_all(dentry->d_sb)) { 945 /* Whiteout orphan index to block future open by handle */ 946 err = ovl_cleanup_and_whiteout(OVL_FS(dentry->d_sb), 947 dir, index); 948 } else { 949 /* Cleanup orphan index entries */ 950 err = ovl_cleanup(ofs, dir, index); 951 } 952 953 inode_unlock(dir); 954 if (err) 955 goto fail; 956 957 out: 958 kfree(name.name); 959 dput(index); 960 return; 961 962 fail: 963 pr_err("cleanup index of '%pd2' failed (%i)\n", dentry, err); 964 goto out; 965 } 966 967 /* 968 * Operations that change overlay inode and upper inode nlink need to be 969 * synchronized with copy up for persistent nlink accounting. 970 */ 971 int ovl_nlink_start(struct dentry *dentry) 972 { 973 struct inode *inode = d_inode(dentry); 974 const struct cred *old_cred; 975 int err; 976 977 if (WARN_ON(!inode)) 978 return -ENOENT; 979 980 /* 981 * With inodes index is enabled, we store the union overlay nlink 982 * in an xattr on the index inode. When whiting out an indexed lower, 983 * we need to decrement the overlay persistent nlink, but before the 984 * first copy up, we have no upper index inode to store the xattr. 985 * 986 * As a workaround, before whiteout/rename over an indexed lower, 987 * copy up to create the upper index. Creating the upper index will 988 * initialize the overlay nlink, so it could be dropped if unlink 989 * or rename succeeds. 990 * 991 * TODO: implement metadata only index copy up when called with 992 * ovl_copy_up_flags(dentry, O_PATH). 993 */ 994 if (ovl_need_index(dentry) && !ovl_dentry_has_upper_alias(dentry)) { 995 err = ovl_copy_up(dentry); 996 if (err) 997 return err; 998 } 999 1000 err = ovl_inode_lock_interruptible(inode); 1001 if (err) 1002 return err; 1003 1004 if (d_is_dir(dentry) || !ovl_test_flag(OVL_INDEX, inode)) 1005 goto out; 1006 1007 old_cred = ovl_override_creds(dentry->d_sb); 1008 /* 1009 * The overlay inode nlink should be incremented/decremented IFF the 1010 * upper operation succeeds, along with nlink change of upper inode. 1011 * Therefore, before link/unlink/rename, we store the union nlink 1012 * value relative to the upper inode nlink in an upper inode xattr. 1013 */ 1014 err = ovl_set_nlink_upper(dentry); 1015 revert_creds(old_cred); 1016 1017 out: 1018 if (err) 1019 ovl_inode_unlock(inode); 1020 1021 return err; 1022 } 1023 1024 void ovl_nlink_end(struct dentry *dentry) 1025 { 1026 struct inode *inode = d_inode(dentry); 1027 1028 if (ovl_test_flag(OVL_INDEX, inode) && inode->i_nlink == 0) { 1029 const struct cred *old_cred; 1030 1031 old_cred = ovl_override_creds(dentry->d_sb); 1032 ovl_cleanup_index(dentry); 1033 revert_creds(old_cred); 1034 } 1035 1036 ovl_inode_unlock(inode); 1037 } 1038 1039 int ovl_lock_rename_workdir(struct dentry *workdir, struct dentry *upperdir) 1040 { 1041 /* Workdir should not be the same as upperdir */ 1042 if (workdir == upperdir) 1043 goto err; 1044 1045 /* Workdir should not be subdir of upperdir and vice versa */ 1046 if (lock_rename(workdir, upperdir) != NULL) 1047 goto err_unlock; 1048 1049 return 0; 1050 1051 err_unlock: 1052 unlock_rename(workdir, upperdir); 1053 err: 1054 pr_err("failed to lock workdir+upperdir\n"); 1055 return -EIO; 1056 } 1057 1058 /* 1059 * err < 0, 0 if no metacopy xattr, metacopy data size if xattr found. 1060 * an empty xattr returns OVL_METACOPY_MIN_SIZE to distinguish from no xattr value. 1061 */ 1062 int ovl_check_metacopy_xattr(struct ovl_fs *ofs, const struct path *path, 1063 struct ovl_metacopy *data) 1064 { 1065 int res; 1066 1067 /* Only regular files can have metacopy xattr */ 1068 if (!S_ISREG(d_inode(path->dentry)->i_mode)) 1069 return 0; 1070 1071 res = ovl_path_getxattr(ofs, path, OVL_XATTR_METACOPY, 1072 data, data ? OVL_METACOPY_MAX_SIZE : 0); 1073 if (res < 0) { 1074 if (res == -ENODATA || res == -EOPNOTSUPP) 1075 return 0; 1076 /* 1077 * getxattr on user.* may fail with EACCES in case there's no 1078 * read permission on the inode. Not much we can do, other than 1079 * tell the caller that this is not a metacopy inode. 1080 */ 1081 if (ofs->config.userxattr && res == -EACCES) 1082 return 0; 1083 goto out; 1084 } 1085 1086 if (res == 0) { 1087 /* Emulate empty data for zero size metacopy xattr */ 1088 res = OVL_METACOPY_MIN_SIZE; 1089 if (data) { 1090 memset(data, 0, res); 1091 data->len = res; 1092 } 1093 } else if (res < OVL_METACOPY_MIN_SIZE) { 1094 pr_warn_ratelimited("metacopy file '%pd' has too small xattr\n", 1095 path->dentry); 1096 return -EIO; 1097 } else if (data) { 1098 if (data->version != 0) { 1099 pr_warn_ratelimited("metacopy file '%pd' has unsupported version\n", 1100 path->dentry); 1101 return -EIO; 1102 } 1103 if (res != data->len) { 1104 pr_warn_ratelimited("metacopy file '%pd' has invalid xattr size\n", 1105 path->dentry); 1106 return -EIO; 1107 } 1108 } 1109 1110 return res; 1111 out: 1112 pr_warn_ratelimited("failed to get metacopy (%i)\n", res); 1113 return res; 1114 } 1115 1116 int ovl_set_metacopy_xattr(struct ovl_fs *ofs, struct dentry *d, struct ovl_metacopy *metacopy) 1117 { 1118 size_t len = metacopy->len; 1119 1120 /* If no flags or digest fall back to empty metacopy file */ 1121 if (metacopy->version == 0 && metacopy->flags == 0 && metacopy->digest_algo == 0) 1122 len = 0; 1123 1124 return ovl_check_setxattr(ofs, d, OVL_XATTR_METACOPY, 1125 metacopy, len, -EOPNOTSUPP); 1126 } 1127 1128 bool ovl_is_metacopy_dentry(struct dentry *dentry) 1129 { 1130 struct ovl_entry *oe = OVL_E(dentry); 1131 1132 if (!d_is_reg(dentry)) 1133 return false; 1134 1135 if (ovl_dentry_upper(dentry)) { 1136 if (!ovl_has_upperdata(d_inode(dentry))) 1137 return true; 1138 return false; 1139 } 1140 1141 return (ovl_numlower(oe) > 1); 1142 } 1143 1144 char *ovl_get_redirect_xattr(struct ovl_fs *ofs, const struct path *path, int padding) 1145 { 1146 int res; 1147 char *s, *next, *buf = NULL; 1148 1149 res = ovl_path_getxattr(ofs, path, OVL_XATTR_REDIRECT, NULL, 0); 1150 if (res == -ENODATA || res == -EOPNOTSUPP) 1151 return NULL; 1152 if (res < 0) 1153 goto fail; 1154 if (res == 0) 1155 goto invalid; 1156 1157 buf = kzalloc(res + padding + 1, GFP_KERNEL); 1158 if (!buf) 1159 return ERR_PTR(-ENOMEM); 1160 1161 res = ovl_path_getxattr(ofs, path, OVL_XATTR_REDIRECT, buf, res); 1162 if (res < 0) 1163 goto fail; 1164 if (res == 0) 1165 goto invalid; 1166 1167 if (buf[0] == '/') { 1168 for (s = buf; *s++ == '/'; s = next) { 1169 next = strchrnul(s, '/'); 1170 if (s == next) 1171 goto invalid; 1172 } 1173 } else { 1174 if (strchr(buf, '/') != NULL) 1175 goto invalid; 1176 } 1177 1178 return buf; 1179 invalid: 1180 pr_warn_ratelimited("invalid redirect (%s)\n", buf); 1181 res = -EINVAL; 1182 goto err_free; 1183 fail: 1184 pr_warn_ratelimited("failed to get redirect (%i)\n", res); 1185 err_free: 1186 kfree(buf); 1187 return ERR_PTR(res); 1188 } 1189 1190 /* Call with mounter creds as it may open the file */ 1191 int ovl_ensure_verity_loaded(struct path *datapath) 1192 { 1193 struct inode *inode = d_inode(datapath->dentry); 1194 struct file *filp; 1195 1196 if (!fsverity_active(inode) && IS_VERITY(inode)) { 1197 /* 1198 * If this inode was not yet opened, the verity info hasn't been 1199 * loaded yet, so we need to do that here to force it into memory. 1200 */ 1201 filp = kernel_file_open(datapath, O_RDONLY, inode, current_cred()); 1202 if (IS_ERR(filp)) 1203 return PTR_ERR(filp); 1204 fput(filp); 1205 } 1206 1207 return 0; 1208 } 1209 1210 int ovl_validate_verity(struct ovl_fs *ofs, 1211 struct path *metapath, 1212 struct path *datapath) 1213 { 1214 struct ovl_metacopy metacopy_data; 1215 u8 actual_digest[FS_VERITY_MAX_DIGEST_SIZE]; 1216 int xattr_digest_size, digest_size; 1217 int xattr_size, err; 1218 u8 verity_algo; 1219 1220 if (!ofs->config.verity_mode || 1221 /* Verity only works on regular files */ 1222 !S_ISREG(d_inode(metapath->dentry)->i_mode)) 1223 return 0; 1224 1225 xattr_size = ovl_check_metacopy_xattr(ofs, metapath, &metacopy_data); 1226 if (xattr_size < 0) 1227 return xattr_size; 1228 1229 if (!xattr_size || !metacopy_data.digest_algo) { 1230 if (ofs->config.verity_mode == OVL_VERITY_REQUIRE) { 1231 pr_warn_ratelimited("metacopy file '%pd' has no digest specified\n", 1232 metapath->dentry); 1233 return -EIO; 1234 } 1235 return 0; 1236 } 1237 1238 xattr_digest_size = ovl_metadata_digest_size(&metacopy_data); 1239 1240 err = ovl_ensure_verity_loaded(datapath); 1241 if (err < 0) { 1242 pr_warn_ratelimited("lower file '%pd' failed to load fs-verity info\n", 1243 datapath->dentry); 1244 return -EIO; 1245 } 1246 1247 digest_size = fsverity_get_digest(d_inode(datapath->dentry), actual_digest, 1248 &verity_algo, NULL); 1249 if (digest_size == 0) { 1250 pr_warn_ratelimited("lower file '%pd' has no fs-verity digest\n", datapath->dentry); 1251 return -EIO; 1252 } 1253 1254 if (xattr_digest_size != digest_size || 1255 metacopy_data.digest_algo != verity_algo || 1256 memcmp(metacopy_data.digest, actual_digest, xattr_digest_size) != 0) { 1257 pr_warn_ratelimited("lower file '%pd' has the wrong fs-verity digest\n", 1258 datapath->dentry); 1259 return -EIO; 1260 } 1261 1262 return 0; 1263 } 1264 1265 int ovl_get_verity_digest(struct ovl_fs *ofs, struct path *src, 1266 struct ovl_metacopy *metacopy) 1267 { 1268 int err, digest_size; 1269 1270 if (!ofs->config.verity_mode || !S_ISREG(d_inode(src->dentry)->i_mode)) 1271 return 0; 1272 1273 err = ovl_ensure_verity_loaded(src); 1274 if (err < 0) { 1275 pr_warn_ratelimited("lower file '%pd' failed to load fs-verity info\n", 1276 src->dentry); 1277 return -EIO; 1278 } 1279 1280 digest_size = fsverity_get_digest(d_inode(src->dentry), 1281 metacopy->digest, &metacopy->digest_algo, NULL); 1282 if (digest_size == 0 || 1283 WARN_ON_ONCE(digest_size > FS_VERITY_MAX_DIGEST_SIZE)) { 1284 if (ofs->config.verity_mode == OVL_VERITY_REQUIRE) { 1285 pr_warn_ratelimited("lower file '%pd' has no fs-verity digest\n", 1286 src->dentry); 1287 return -EIO; 1288 } 1289 return 0; 1290 } 1291 1292 metacopy->len += digest_size; 1293 return 0; 1294 } 1295 1296 /* 1297 * ovl_sync_status() - Check fs sync status for volatile mounts 1298 * 1299 * Returns 1 if this is not a volatile mount and a real sync is required. 1300 * 1301 * Returns 0 if syncing can be skipped because mount is volatile, and no errors 1302 * have occurred on the upperdir since the mount. 1303 * 1304 * Returns -errno if it is a volatile mount, and the error that occurred since 1305 * the last mount. If the error code changes, it'll return the latest error 1306 * code. 1307 */ 1308 1309 int ovl_sync_status(struct ovl_fs *ofs) 1310 { 1311 struct vfsmount *mnt; 1312 1313 if (ovl_should_sync(ofs)) 1314 return 1; 1315 1316 mnt = ovl_upper_mnt(ofs); 1317 if (!mnt) 1318 return 0; 1319 1320 return errseq_check(&mnt->mnt_sb->s_wb_err, ofs->errseq); 1321 } 1322 1323 /* 1324 * ovl_copyattr() - copy inode attributes from layer to ovl inode 1325 * 1326 * When overlay copies inode information from an upper or lower layer to the 1327 * relevant overlay inode it will apply the idmapping of the upper or lower 1328 * layer when doing so ensuring that the ovl inode ownership will correctly 1329 * reflect the ownership of the idmapped upper or lower layer. For example, an 1330 * idmapped upper or lower layer mapping id 1001 to id 1000 will take care to 1331 * map any lower or upper inode owned by id 1001 to id 1000. These mapping 1332 * helpers are nops when the relevant layer isn't idmapped. 1333 */ 1334 void ovl_copyattr(struct inode *inode) 1335 { 1336 struct path realpath; 1337 struct inode *realinode; 1338 struct mnt_idmap *real_idmap; 1339 vfsuid_t vfsuid; 1340 vfsgid_t vfsgid; 1341 1342 realinode = ovl_i_path_real(inode, &realpath); 1343 real_idmap = mnt_idmap(realpath.mnt); 1344 1345 vfsuid = i_uid_into_vfsuid(real_idmap, realinode); 1346 vfsgid = i_gid_into_vfsgid(real_idmap, realinode); 1347 1348 inode->i_uid = vfsuid_into_kuid(vfsuid); 1349 inode->i_gid = vfsgid_into_kgid(vfsgid); 1350 inode->i_mode = realinode->i_mode; 1351 inode->i_atime = realinode->i_atime; 1352 inode->i_mtime = realinode->i_mtime; 1353 inode->i_ctime = realinode->i_ctime; 1354 i_size_write(inode, i_size_read(realinode)); 1355 } 1356