1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/fs/readdir.c 4 * 5 * Copyright (C) 1995 Linus Torvalds 6 */ 7 8 #include <linux/stddef.h> 9 #include <linux/kernel.h> 10 #include <linux/export.h> 11 #include <linux/time.h> 12 #include <linux/mm.h> 13 #include <linux/errno.h> 14 #include <linux/stat.h> 15 #include <linux/file.h> 16 #include <linux/fs.h> 17 #include <linux/fsnotify.h> 18 #include <linux/dirent.h> 19 #include <linux/security.h> 20 #include <linux/syscalls.h> 21 #include <linux/unistd.h> 22 #include <linux/compat.h> 23 #include <linux/uaccess.h> 24 25 #include <asm/unaligned.h> 26 27 /* 28 * Note the "unsafe_put_user() semantics: we goto a 29 * label for errors. 30 */ 31 #define unsafe_copy_dirent_name(_dst, _src, _len, label) do { \ 32 char __user *dst = (_dst); \ 33 const char *src = (_src); \ 34 size_t len = (_len); \ 35 unsafe_put_user(0, dst+len, label); \ 36 unsafe_copy_to_user(dst, src, len, label); \ 37 } while (0) 38 39 40 int iterate_dir(struct file *file, struct dir_context *ctx) 41 { 42 struct inode *inode = file_inode(file); 43 bool shared = false; 44 int res = -ENOTDIR; 45 if (file->f_op->iterate_shared) 46 shared = true; 47 else if (!file->f_op->iterate) 48 goto out; 49 50 res = security_file_permission(file, MAY_READ); 51 if (res) 52 goto out; 53 54 if (shared) 55 res = down_read_killable(&inode->i_rwsem); 56 else 57 res = down_write_killable(&inode->i_rwsem); 58 if (res) 59 goto out; 60 61 res = -ENOENT; 62 if (!IS_DEADDIR(inode)) { 63 ctx->pos = file->f_pos; 64 if (shared) 65 res = file->f_op->iterate_shared(file, ctx); 66 else 67 res = file->f_op->iterate(file, ctx); 68 file->f_pos = ctx->pos; 69 fsnotify_access(file); 70 file_accessed(file); 71 } 72 if (shared) 73 inode_unlock_shared(inode); 74 else 75 inode_unlock(inode); 76 out: 77 return res; 78 } 79 EXPORT_SYMBOL(iterate_dir); 80 81 /* 82 * POSIX says that a dirent name cannot contain NULL or a '/'. 83 * 84 * It's not 100% clear what we should really do in this case. 85 * The filesystem is clearly corrupted, but returning a hard 86 * error means that you now don't see any of the other names 87 * either, so that isn't a perfect alternative. 88 * 89 * And if you return an error, what error do you use? Several 90 * filesystems seem to have decided on EUCLEAN being the error 91 * code for EFSCORRUPTED, and that may be the error to use. Or 92 * just EIO, which is perhaps more obvious to users. 93 * 94 * In order to see the other file names in the directory, the 95 * caller might want to make this a "soft" error: skip the 96 * entry, and return the error at the end instead. 97 * 98 * Note that this should likely do a "memchr(name, 0, len)" 99 * check too, since that would be filesystem corruption as 100 * well. However, that case can't actually confuse user space, 101 * which has to do a strlen() on the name anyway to find the 102 * filename length, and the above "soft error" worry means 103 * that it's probably better left alone until we have that 104 * issue clarified. 105 * 106 * Note the PATH_MAX check - it's arbitrary but the real 107 * kernel limit on a possible path component, not NAME_MAX, 108 * which is the technical standard limit. 109 */ 110 static int verify_dirent_name(const char *name, int len) 111 { 112 if (len <= 0 || len >= PATH_MAX) 113 return -EIO; 114 if (memchr(name, '/', len)) 115 return -EIO; 116 return 0; 117 } 118 119 /* 120 * Traditional linux readdir() handling.. 121 * 122 * "count=1" is a special case, meaning that the buffer is one 123 * dirent-structure in size and that the code can't handle more 124 * anyway. Thus the special "fillonedir()" function for that 125 * case (the low-level handlers don't need to care about this). 126 */ 127 128 #ifdef __ARCH_WANT_OLD_READDIR 129 130 struct old_linux_dirent { 131 unsigned long d_ino; 132 unsigned long d_offset; 133 unsigned short d_namlen; 134 char d_name[1]; 135 }; 136 137 struct readdir_callback { 138 struct dir_context ctx; 139 struct old_linux_dirent __user * dirent; 140 int result; 141 }; 142 143 static int fillonedir(struct dir_context *ctx, const char *name, int namlen, 144 loff_t offset, u64 ino, unsigned int d_type) 145 { 146 struct readdir_callback *buf = 147 container_of(ctx, struct readdir_callback, ctx); 148 struct old_linux_dirent __user * dirent; 149 unsigned long d_ino; 150 151 if (buf->result) 152 return -EINVAL; 153 d_ino = ino; 154 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) { 155 buf->result = -EOVERFLOW; 156 return -EOVERFLOW; 157 } 158 buf->result++; 159 dirent = buf->dirent; 160 if (!user_write_access_begin(dirent, 161 (unsigned long)(dirent->d_name + namlen + 1) - 162 (unsigned long)dirent)) 163 goto efault; 164 unsafe_put_user(d_ino, &dirent->d_ino, efault_end); 165 unsafe_put_user(offset, &dirent->d_offset, efault_end); 166 unsafe_put_user(namlen, &dirent->d_namlen, efault_end); 167 unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end); 168 user_write_access_end(); 169 return 0; 170 efault_end: 171 user_write_access_end(); 172 efault: 173 buf->result = -EFAULT; 174 return -EFAULT; 175 } 176 177 SYSCALL_DEFINE3(old_readdir, unsigned int, fd, 178 struct old_linux_dirent __user *, dirent, unsigned int, count) 179 { 180 int error; 181 struct fd f = fdget_pos(fd); 182 struct readdir_callback buf = { 183 .ctx.actor = fillonedir, 184 .dirent = dirent 185 }; 186 187 if (!f.file) 188 return -EBADF; 189 190 error = iterate_dir(f.file, &buf.ctx); 191 if (buf.result) 192 error = buf.result; 193 194 fdput_pos(f); 195 return error; 196 } 197 198 #endif /* __ARCH_WANT_OLD_READDIR */ 199 200 /* 201 * New, all-improved, singing, dancing, iBCS2-compliant getdents() 202 * interface. 203 */ 204 struct linux_dirent { 205 unsigned long d_ino; 206 unsigned long d_off; 207 unsigned short d_reclen; 208 char d_name[1]; 209 }; 210 211 struct getdents_callback { 212 struct dir_context ctx; 213 struct linux_dirent __user * current_dir; 214 int prev_reclen; 215 int count; 216 int error; 217 }; 218 219 static int filldir(struct dir_context *ctx, const char *name, int namlen, 220 loff_t offset, u64 ino, unsigned int d_type) 221 { 222 struct linux_dirent __user *dirent, *prev; 223 struct getdents_callback *buf = 224 container_of(ctx, struct getdents_callback, ctx); 225 unsigned long d_ino; 226 int reclen = ALIGN(offsetof(struct linux_dirent, d_name) + namlen + 2, 227 sizeof(long)); 228 int prev_reclen; 229 230 buf->error = verify_dirent_name(name, namlen); 231 if (unlikely(buf->error)) 232 return buf->error; 233 buf->error = -EINVAL; /* only used if we fail.. */ 234 if (reclen > buf->count) 235 return -EINVAL; 236 d_ino = ino; 237 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) { 238 buf->error = -EOVERFLOW; 239 return -EOVERFLOW; 240 } 241 prev_reclen = buf->prev_reclen; 242 if (prev_reclen && signal_pending(current)) 243 return -EINTR; 244 dirent = buf->current_dir; 245 prev = (void __user *) dirent - prev_reclen; 246 if (!user_write_access_begin(prev, reclen + prev_reclen)) 247 goto efault; 248 249 /* This might be 'dirent->d_off', but if so it will get overwritten */ 250 unsafe_put_user(offset, &prev->d_off, efault_end); 251 unsafe_put_user(d_ino, &dirent->d_ino, efault_end); 252 unsafe_put_user(reclen, &dirent->d_reclen, efault_end); 253 unsafe_put_user(d_type, (char __user *) dirent + reclen - 1, efault_end); 254 unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end); 255 user_write_access_end(); 256 257 buf->current_dir = (void __user *)dirent + reclen; 258 buf->prev_reclen = reclen; 259 buf->count -= reclen; 260 return 0; 261 efault_end: 262 user_write_access_end(); 263 efault: 264 buf->error = -EFAULT; 265 return -EFAULT; 266 } 267 268 SYSCALL_DEFINE3(getdents, unsigned int, fd, 269 struct linux_dirent __user *, dirent, unsigned int, count) 270 { 271 struct fd f; 272 struct getdents_callback buf = { 273 .ctx.actor = filldir, 274 .count = count, 275 .current_dir = dirent 276 }; 277 int error; 278 279 if (!access_ok(dirent, count)) 280 return -EFAULT; 281 282 f = fdget_pos(fd); 283 if (!f.file) 284 return -EBADF; 285 286 error = iterate_dir(f.file, &buf.ctx); 287 if (error >= 0) 288 error = buf.error; 289 if (buf.prev_reclen) { 290 struct linux_dirent __user * lastdirent; 291 lastdirent = (void __user *)buf.current_dir - buf.prev_reclen; 292 293 if (put_user(buf.ctx.pos, &lastdirent->d_off)) 294 error = -EFAULT; 295 else 296 error = count - buf.count; 297 } 298 fdput_pos(f); 299 return error; 300 } 301 302 struct getdents_callback64 { 303 struct dir_context ctx; 304 struct linux_dirent64 __user * current_dir; 305 int prev_reclen; 306 int count; 307 int error; 308 }; 309 310 static int filldir64(struct dir_context *ctx, const char *name, int namlen, 311 loff_t offset, u64 ino, unsigned int d_type) 312 { 313 struct linux_dirent64 __user *dirent, *prev; 314 struct getdents_callback64 *buf = 315 container_of(ctx, struct getdents_callback64, ctx); 316 int reclen = ALIGN(offsetof(struct linux_dirent64, d_name) + namlen + 1, 317 sizeof(u64)); 318 int prev_reclen; 319 320 buf->error = verify_dirent_name(name, namlen); 321 if (unlikely(buf->error)) 322 return buf->error; 323 buf->error = -EINVAL; /* only used if we fail.. */ 324 if (reclen > buf->count) 325 return -EINVAL; 326 prev_reclen = buf->prev_reclen; 327 if (prev_reclen && signal_pending(current)) 328 return -EINTR; 329 dirent = buf->current_dir; 330 prev = (void __user *)dirent - prev_reclen; 331 if (!user_write_access_begin(prev, reclen + prev_reclen)) 332 goto efault; 333 334 /* This might be 'dirent->d_off', but if so it will get overwritten */ 335 unsafe_put_user(offset, &prev->d_off, efault_end); 336 unsafe_put_user(ino, &dirent->d_ino, efault_end); 337 unsafe_put_user(reclen, &dirent->d_reclen, efault_end); 338 unsafe_put_user(d_type, &dirent->d_type, efault_end); 339 unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end); 340 user_write_access_end(); 341 342 buf->prev_reclen = reclen; 343 buf->current_dir = (void __user *)dirent + reclen; 344 buf->count -= reclen; 345 return 0; 346 347 efault_end: 348 user_write_access_end(); 349 efault: 350 buf->error = -EFAULT; 351 return -EFAULT; 352 } 353 354 int ksys_getdents64(unsigned int fd, struct linux_dirent64 __user *dirent, 355 unsigned int count) 356 { 357 struct fd f; 358 struct getdents_callback64 buf = { 359 .ctx.actor = filldir64, 360 .count = count, 361 .current_dir = dirent 362 }; 363 int error; 364 365 if (!access_ok(dirent, count)) 366 return -EFAULT; 367 368 f = fdget_pos(fd); 369 if (!f.file) 370 return -EBADF; 371 372 error = iterate_dir(f.file, &buf.ctx); 373 if (error >= 0) 374 error = buf.error; 375 if (buf.prev_reclen) { 376 struct linux_dirent64 __user * lastdirent; 377 typeof(lastdirent->d_off) d_off = buf.ctx.pos; 378 379 lastdirent = (void __user *) buf.current_dir - buf.prev_reclen; 380 if (__put_user(d_off, &lastdirent->d_off)) 381 error = -EFAULT; 382 else 383 error = count - buf.count; 384 } 385 fdput_pos(f); 386 return error; 387 } 388 389 390 SYSCALL_DEFINE3(getdents64, unsigned int, fd, 391 struct linux_dirent64 __user *, dirent, unsigned int, count) 392 { 393 return ksys_getdents64(fd, dirent, count); 394 } 395 396 #ifdef CONFIG_COMPAT 397 struct compat_old_linux_dirent { 398 compat_ulong_t d_ino; 399 compat_ulong_t d_offset; 400 unsigned short d_namlen; 401 char d_name[1]; 402 }; 403 404 struct compat_readdir_callback { 405 struct dir_context ctx; 406 struct compat_old_linux_dirent __user *dirent; 407 int result; 408 }; 409 410 static int compat_fillonedir(struct dir_context *ctx, const char *name, 411 int namlen, loff_t offset, u64 ino, 412 unsigned int d_type) 413 { 414 struct compat_readdir_callback *buf = 415 container_of(ctx, struct compat_readdir_callback, ctx); 416 struct compat_old_linux_dirent __user *dirent; 417 compat_ulong_t d_ino; 418 419 if (buf->result) 420 return -EINVAL; 421 d_ino = ino; 422 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) { 423 buf->result = -EOVERFLOW; 424 return -EOVERFLOW; 425 } 426 buf->result++; 427 dirent = buf->dirent; 428 if (!user_write_access_begin(dirent, 429 (unsigned long)(dirent->d_name + namlen + 1) - 430 (unsigned long)dirent)) 431 goto efault; 432 unsafe_put_user(d_ino, &dirent->d_ino, efault_end); 433 unsafe_put_user(offset, &dirent->d_offset, efault_end); 434 unsafe_put_user(namlen, &dirent->d_namlen, efault_end); 435 unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end); 436 user_write_access_end(); 437 return 0; 438 efault_end: 439 user_write_access_end(); 440 efault: 441 buf->result = -EFAULT; 442 return -EFAULT; 443 } 444 445 COMPAT_SYSCALL_DEFINE3(old_readdir, unsigned int, fd, 446 struct compat_old_linux_dirent __user *, dirent, unsigned int, count) 447 { 448 int error; 449 struct fd f = fdget_pos(fd); 450 struct compat_readdir_callback buf = { 451 .ctx.actor = compat_fillonedir, 452 .dirent = dirent 453 }; 454 455 if (!f.file) 456 return -EBADF; 457 458 error = iterate_dir(f.file, &buf.ctx); 459 if (buf.result) 460 error = buf.result; 461 462 fdput_pos(f); 463 return error; 464 } 465 466 struct compat_linux_dirent { 467 compat_ulong_t d_ino; 468 compat_ulong_t d_off; 469 unsigned short d_reclen; 470 char d_name[1]; 471 }; 472 473 struct compat_getdents_callback { 474 struct dir_context ctx; 475 struct compat_linux_dirent __user *current_dir; 476 struct compat_linux_dirent __user *previous; 477 int count; 478 int error; 479 }; 480 481 static int compat_filldir(struct dir_context *ctx, const char *name, int namlen, 482 loff_t offset, u64 ino, unsigned int d_type) 483 { 484 struct compat_linux_dirent __user * dirent; 485 struct compat_getdents_callback *buf = 486 container_of(ctx, struct compat_getdents_callback, ctx); 487 compat_ulong_t d_ino; 488 int reclen = ALIGN(offsetof(struct compat_linux_dirent, d_name) + 489 namlen + 2, sizeof(compat_long_t)); 490 491 buf->error = -EINVAL; /* only used if we fail.. */ 492 if (reclen > buf->count) 493 return -EINVAL; 494 d_ino = ino; 495 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) { 496 buf->error = -EOVERFLOW; 497 return -EOVERFLOW; 498 } 499 dirent = buf->previous; 500 if (dirent) { 501 if (signal_pending(current)) 502 return -EINTR; 503 if (__put_user(offset, &dirent->d_off)) 504 goto efault; 505 } 506 dirent = buf->current_dir; 507 if (__put_user(d_ino, &dirent->d_ino)) 508 goto efault; 509 if (__put_user(reclen, &dirent->d_reclen)) 510 goto efault; 511 if (copy_to_user(dirent->d_name, name, namlen)) 512 goto efault; 513 if (__put_user(0, dirent->d_name + namlen)) 514 goto efault; 515 if (__put_user(d_type, (char __user *) dirent + reclen - 1)) 516 goto efault; 517 buf->previous = dirent; 518 dirent = (void __user *)dirent + reclen; 519 buf->current_dir = dirent; 520 buf->count -= reclen; 521 return 0; 522 efault: 523 buf->error = -EFAULT; 524 return -EFAULT; 525 } 526 527 COMPAT_SYSCALL_DEFINE3(getdents, unsigned int, fd, 528 struct compat_linux_dirent __user *, dirent, unsigned int, count) 529 { 530 struct fd f; 531 struct compat_linux_dirent __user * lastdirent; 532 struct compat_getdents_callback buf = { 533 .ctx.actor = compat_filldir, 534 .current_dir = dirent, 535 .count = count 536 }; 537 int error; 538 539 if (!access_ok(dirent, count)) 540 return -EFAULT; 541 542 f = fdget_pos(fd); 543 if (!f.file) 544 return -EBADF; 545 546 error = iterate_dir(f.file, &buf.ctx); 547 if (error >= 0) 548 error = buf.error; 549 lastdirent = buf.previous; 550 if (lastdirent) { 551 if (put_user(buf.ctx.pos, &lastdirent->d_off)) 552 error = -EFAULT; 553 else 554 error = count - buf.count; 555 } 556 fdput_pos(f); 557 return error; 558 } 559 #endif 560