xref: /openbmc/linux/fs/xattr.c (revision b9ddb2500e7e544410f38476ab928fc2fe01e381)
1  // SPDX-License-Identifier: GPL-2.0-only
2  /*
3    File: fs/xattr.c
4  
5    Extended attribute handling.
6  
7    Copyright (C) 2001 by Andreas Gruenbacher <a.gruenbacher@computer.org>
8    Copyright (C) 2001 SGI - Silicon Graphics, Inc <linux-xfs@oss.sgi.com>
9    Copyright (c) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
10   */
11  #include <linux/fs.h>
12  #include <linux/slab.h>
13  #include <linux/file.h>
14  #include <linux/xattr.h>
15  #include <linux/mount.h>
16  #include <linux/namei.h>
17  #include <linux/security.h>
18  #include <linux/evm.h>
19  #include <linux/syscalls.h>
20  #include <linux/export.h>
21  #include <linux/fsnotify.h>
22  #include <linux/audit.h>
23  #include <linux/vmalloc.h>
24  #include <linux/posix_acl_xattr.h>
25  
26  #include <linux/uaccess.h>
27  
28  static const char *
29  strcmp_prefix(const char *a, const char *a_prefix)
30  {
31  	while (*a_prefix && *a == *a_prefix) {
32  		a++;
33  		a_prefix++;
34  	}
35  	return *a_prefix ? NULL : a;
36  }
37  
38  /*
39   * In order to implement different sets of xattr operations for each xattr
40   * prefix, a filesystem should create a null-terminated array of struct
41   * xattr_handler (one for each prefix) and hang a pointer to it off of the
42   * s_xattr field of the superblock.
43   */
44  #define for_each_xattr_handler(handlers, handler)		\
45  	if (handlers)						\
46  		for ((handler) = *(handlers)++;			\
47  			(handler) != NULL;			\
48  			(handler) = *(handlers)++)
49  
50  /*
51   * Find the xattr_handler with the matching prefix.
52   */
53  static const struct xattr_handler *
54  xattr_resolve_name(struct inode *inode, const char **name)
55  {
56  	const struct xattr_handler **handlers = inode->i_sb->s_xattr;
57  	const struct xattr_handler *handler;
58  
59  	if (!(inode->i_opflags & IOP_XATTR)) {
60  		if (unlikely(is_bad_inode(inode)))
61  			return ERR_PTR(-EIO);
62  		return ERR_PTR(-EOPNOTSUPP);
63  	}
64  	for_each_xattr_handler(handlers, handler) {
65  		const char *n;
66  
67  		n = strcmp_prefix(*name, xattr_prefix(handler));
68  		if (n) {
69  			if (!handler->prefix ^ !*n) {
70  				if (*n)
71  					continue;
72  				return ERR_PTR(-EINVAL);
73  			}
74  			*name = n;
75  			return handler;
76  		}
77  	}
78  	return ERR_PTR(-EOPNOTSUPP);
79  }
80  
81  /*
82   * Check permissions for extended attribute access.  This is a bit complicated
83   * because different namespaces have very different rules.
84   */
85  static int
86  xattr_permission(struct inode *inode, const char *name, int mask)
87  {
88  	/*
89  	 * We can never set or remove an extended attribute on a read-only
90  	 * filesystem  or on an immutable / append-only inode.
91  	 */
92  	if (mask & MAY_WRITE) {
93  		if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
94  			return -EPERM;
95  		/*
96  		 * Updating an xattr will likely cause i_uid and i_gid
97  		 * to be writen back improperly if their true value is
98  		 * unknown to the vfs.
99  		 */
100  		if (HAS_UNMAPPED_ID(inode))
101  			return -EPERM;
102  	}
103  
104  	/*
105  	 * No restriction for security.* and system.* from the VFS.  Decision
106  	 * on these is left to the underlying filesystem / security module.
107  	 */
108  	if (!strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) ||
109  	    !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
110  		return 0;
111  
112  	/*
113  	 * The trusted.* namespace can only be accessed by privileged users.
114  	 */
115  	if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN)) {
116  		if (!capable(CAP_SYS_ADMIN))
117  			return (mask & MAY_WRITE) ? -EPERM : -ENODATA;
118  		return 0;
119  	}
120  
121  	/*
122  	 * In the user.* namespace, only regular files and directories can have
123  	 * extended attributes. For sticky directories, only the owner and
124  	 * privileged users can write attributes.
125  	 */
126  	if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
127  		if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
128  			return (mask & MAY_WRITE) ? -EPERM : -ENODATA;
129  		if (S_ISDIR(inode->i_mode) && (inode->i_mode & S_ISVTX) &&
130  		    (mask & MAY_WRITE) && !inode_owner_or_capable(inode))
131  			return -EPERM;
132  	}
133  
134  	return inode_permission(inode, mask);
135  }
136  
137  /*
138   * Look for any handler that deals with the specified namespace.
139   */
140  int
141  xattr_supported_namespace(struct inode *inode, const char *prefix)
142  {
143  	const struct xattr_handler **handlers = inode->i_sb->s_xattr;
144  	const struct xattr_handler *handler;
145  	size_t preflen;
146  
147  	if (!(inode->i_opflags & IOP_XATTR)) {
148  		if (unlikely(is_bad_inode(inode)))
149  			return -EIO;
150  		return -EOPNOTSUPP;
151  	}
152  
153  	preflen = strlen(prefix);
154  
155  	for_each_xattr_handler(handlers, handler) {
156  		if (!strncmp(xattr_prefix(handler), prefix, preflen))
157  			return 0;
158  	}
159  
160  	return -EOPNOTSUPP;
161  }
162  EXPORT_SYMBOL(xattr_supported_namespace);
163  
164  int
165  __vfs_setxattr(struct dentry *dentry, struct inode *inode, const char *name,
166  	       const void *value, size_t size, int flags)
167  {
168  	const struct xattr_handler *handler;
169  
170  	handler = xattr_resolve_name(inode, &name);
171  	if (IS_ERR(handler))
172  		return PTR_ERR(handler);
173  	if (!handler->set)
174  		return -EOPNOTSUPP;
175  	if (size == 0)
176  		value = "";  /* empty EA, do not remove */
177  	return handler->set(handler, dentry, inode, name, value, size, flags);
178  }
179  EXPORT_SYMBOL(__vfs_setxattr);
180  
181  /**
182   *  __vfs_setxattr_noperm - perform setxattr operation without performing
183   *  permission checks.
184   *
185   *  @dentry - object to perform setxattr on
186   *  @name - xattr name to set
187   *  @value - value to set @name to
188   *  @size - size of @value
189   *  @flags - flags to pass into filesystem operations
190   *
191   *  returns the result of the internal setxattr or setsecurity operations.
192   *
193   *  This function requires the caller to lock the inode's i_mutex before it
194   *  is executed. It also assumes that the caller will make the appropriate
195   *  permission checks.
196   */
197  int __vfs_setxattr_noperm(struct dentry *dentry, const char *name,
198  		const void *value, size_t size, int flags)
199  {
200  	struct inode *inode = dentry->d_inode;
201  	int error = -EAGAIN;
202  	int issec = !strncmp(name, XATTR_SECURITY_PREFIX,
203  				   XATTR_SECURITY_PREFIX_LEN);
204  
205  	if (issec)
206  		inode->i_flags &= ~S_NOSEC;
207  	if (inode->i_opflags & IOP_XATTR) {
208  		error = __vfs_setxattr(dentry, inode, name, value, size, flags);
209  		if (!error) {
210  			fsnotify_xattr(dentry);
211  			security_inode_post_setxattr(dentry, name, value,
212  						     size, flags);
213  		}
214  	} else {
215  		if (unlikely(is_bad_inode(inode)))
216  			return -EIO;
217  	}
218  	if (error == -EAGAIN) {
219  		error = -EOPNOTSUPP;
220  
221  		if (issec) {
222  			const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
223  
224  			error = security_inode_setsecurity(inode, suffix, value,
225  							   size, flags);
226  			if (!error)
227  				fsnotify_xattr(dentry);
228  		}
229  	}
230  
231  	return error;
232  }
233  
234  /**
235   * __vfs_setxattr_locked - set an extended attribute while holding the inode
236   * lock
237   *
238   *  @dentry: object to perform setxattr on
239   *  @name: xattr name to set
240   *  @value: value to set @name to
241   *  @size: size of @value
242   *  @flags: flags to pass into filesystem operations
243   *  @delegated_inode: on return, will contain an inode pointer that
244   *  a delegation was broken on, NULL if none.
245   */
246  int
247  __vfs_setxattr_locked(struct dentry *dentry, const char *name,
248  		const void *value, size_t size, int flags,
249  		struct inode **delegated_inode)
250  {
251  	struct inode *inode = dentry->d_inode;
252  	int error;
253  
254  	error = xattr_permission(inode, name, MAY_WRITE);
255  	if (error)
256  		return error;
257  
258  	error = security_inode_setxattr(dentry, name, value, size, flags);
259  	if (error)
260  		goto out;
261  
262  	error = try_break_deleg(inode, delegated_inode);
263  	if (error)
264  		goto out;
265  
266  	error = __vfs_setxattr_noperm(dentry, name, value, size, flags);
267  
268  out:
269  	return error;
270  }
271  EXPORT_SYMBOL_GPL(__vfs_setxattr_locked);
272  
273  int
274  vfs_setxattr(struct dentry *dentry, const char *name, const void *value,
275  		size_t size, int flags)
276  {
277  	struct inode *inode = dentry->d_inode;
278  	struct inode *delegated_inode = NULL;
279  	const void  *orig_value = value;
280  	int error;
281  
282  	if (size && strcmp(name, XATTR_NAME_CAPS) == 0) {
283  		error = cap_convert_nscap(dentry, &value, size);
284  		if (error < 0)
285  			return error;
286  		size = error;
287  	}
288  
289  retry_deleg:
290  	inode_lock(inode);
291  	error = __vfs_setxattr_locked(dentry, name, value, size, flags,
292  	    &delegated_inode);
293  	inode_unlock(inode);
294  
295  	if (delegated_inode) {
296  		error = break_deleg_wait(&delegated_inode);
297  		if (!error)
298  			goto retry_deleg;
299  	}
300  	if (value != orig_value)
301  		kfree(value);
302  
303  	return error;
304  }
305  EXPORT_SYMBOL_GPL(vfs_setxattr);
306  
307  static ssize_t
308  xattr_getsecurity(struct inode *inode, const char *name, void *value,
309  			size_t size)
310  {
311  	void *buffer = NULL;
312  	ssize_t len;
313  
314  	if (!value || !size) {
315  		len = security_inode_getsecurity(inode, name, &buffer, false);
316  		goto out_noalloc;
317  	}
318  
319  	len = security_inode_getsecurity(inode, name, &buffer, true);
320  	if (len < 0)
321  		return len;
322  	if (size < len) {
323  		len = -ERANGE;
324  		goto out;
325  	}
326  	memcpy(value, buffer, len);
327  out:
328  	kfree(buffer);
329  out_noalloc:
330  	return len;
331  }
332  
333  /*
334   * vfs_getxattr_alloc - allocate memory, if necessary, before calling getxattr
335   *
336   * Allocate memory, if not already allocated, or re-allocate correct size,
337   * before retrieving the extended attribute.
338   *
339   * Returns the result of alloc, if failed, or the getxattr operation.
340   */
341  ssize_t
342  vfs_getxattr_alloc(struct dentry *dentry, const char *name, char **xattr_value,
343  		   size_t xattr_size, gfp_t flags)
344  {
345  	const struct xattr_handler *handler;
346  	struct inode *inode = dentry->d_inode;
347  	char *value = *xattr_value;
348  	int error;
349  
350  	error = xattr_permission(inode, name, MAY_READ);
351  	if (error)
352  		return error;
353  
354  	handler = xattr_resolve_name(inode, &name);
355  	if (IS_ERR(handler))
356  		return PTR_ERR(handler);
357  	if (!handler->get)
358  		return -EOPNOTSUPP;
359  	error = handler->get(handler, dentry, inode, name, NULL, 0);
360  	if (error < 0)
361  		return error;
362  
363  	if (!value || (error > xattr_size)) {
364  		value = krealloc(*xattr_value, error + 1, flags);
365  		if (!value)
366  			return -ENOMEM;
367  		memset(value, 0, error + 1);
368  	}
369  
370  	error = handler->get(handler, dentry, inode, name, value, error);
371  	*xattr_value = value;
372  	return error;
373  }
374  
375  ssize_t
376  __vfs_getxattr(struct dentry *dentry, struct inode *inode, const char *name,
377  	       void *value, size_t size)
378  {
379  	const struct xattr_handler *handler;
380  
381  	handler = xattr_resolve_name(inode, &name);
382  	if (IS_ERR(handler))
383  		return PTR_ERR(handler);
384  	if (!handler->get)
385  		return -EOPNOTSUPP;
386  	return handler->get(handler, dentry, inode, name, value, size);
387  }
388  EXPORT_SYMBOL(__vfs_getxattr);
389  
390  ssize_t
391  vfs_getxattr(struct dentry *dentry, const char *name, void *value, size_t size)
392  {
393  	struct inode *inode = dentry->d_inode;
394  	int error;
395  
396  	error = xattr_permission(inode, name, MAY_READ);
397  	if (error)
398  		return error;
399  
400  	error = security_inode_getxattr(dentry, name);
401  	if (error)
402  		return error;
403  
404  	if (!strncmp(name, XATTR_SECURITY_PREFIX,
405  				XATTR_SECURITY_PREFIX_LEN)) {
406  		const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
407  		int ret = xattr_getsecurity(inode, suffix, value, size);
408  		/*
409  		 * Only overwrite the return value if a security module
410  		 * is actually active.
411  		 */
412  		if (ret == -EOPNOTSUPP)
413  			goto nolsm;
414  		return ret;
415  	}
416  nolsm:
417  	return __vfs_getxattr(dentry, inode, name, value, size);
418  }
419  EXPORT_SYMBOL_GPL(vfs_getxattr);
420  
421  ssize_t
422  vfs_listxattr(struct dentry *dentry, char *list, size_t size)
423  {
424  	struct inode *inode = d_inode(dentry);
425  	ssize_t error;
426  
427  	error = security_inode_listxattr(dentry);
428  	if (error)
429  		return error;
430  	if (inode->i_op->listxattr && (inode->i_opflags & IOP_XATTR)) {
431  		error = inode->i_op->listxattr(dentry, list, size);
432  	} else {
433  		error = security_inode_listsecurity(inode, list, size);
434  		if (size && error > size)
435  			error = -ERANGE;
436  	}
437  	return error;
438  }
439  EXPORT_SYMBOL_GPL(vfs_listxattr);
440  
441  int
442  __vfs_removexattr(struct dentry *dentry, const char *name)
443  {
444  	struct inode *inode = d_inode(dentry);
445  	const struct xattr_handler *handler;
446  
447  	handler = xattr_resolve_name(inode, &name);
448  	if (IS_ERR(handler))
449  		return PTR_ERR(handler);
450  	if (!handler->set)
451  		return -EOPNOTSUPP;
452  	return handler->set(handler, dentry, inode, name, NULL, 0, XATTR_REPLACE);
453  }
454  EXPORT_SYMBOL(__vfs_removexattr);
455  
456  /**
457   * __vfs_removexattr_locked - set an extended attribute while holding the inode
458   * lock
459   *
460   *  @dentry: object to perform setxattr on
461   *  @name: name of xattr to remove
462   *  @delegated_inode: on return, will contain an inode pointer that
463   *  a delegation was broken on, NULL if none.
464   */
465  int
466  __vfs_removexattr_locked(struct dentry *dentry, const char *name,
467  		struct inode **delegated_inode)
468  {
469  	struct inode *inode = dentry->d_inode;
470  	int error;
471  
472  	error = xattr_permission(inode, name, MAY_WRITE);
473  	if (error)
474  		return error;
475  
476  	error = security_inode_removexattr(dentry, name);
477  	if (error)
478  		goto out;
479  
480  	error = try_break_deleg(inode, delegated_inode);
481  	if (error)
482  		goto out;
483  
484  	error = __vfs_removexattr(dentry, name);
485  
486  	if (!error) {
487  		fsnotify_xattr(dentry);
488  		evm_inode_post_removexattr(dentry, name);
489  	}
490  
491  out:
492  	return error;
493  }
494  EXPORT_SYMBOL_GPL(__vfs_removexattr_locked);
495  
496  int
497  vfs_removexattr(struct dentry *dentry, const char *name)
498  {
499  	struct inode *inode = dentry->d_inode;
500  	struct inode *delegated_inode = NULL;
501  	int error;
502  
503  retry_deleg:
504  	inode_lock(inode);
505  	error = __vfs_removexattr_locked(dentry, name, &delegated_inode);
506  	inode_unlock(inode);
507  
508  	if (delegated_inode) {
509  		error = break_deleg_wait(&delegated_inode);
510  		if (!error)
511  			goto retry_deleg;
512  	}
513  
514  	return error;
515  }
516  EXPORT_SYMBOL_GPL(vfs_removexattr);
517  
518  /*
519   * Extended attribute SET operations
520   */
521  static long
522  setxattr(struct dentry *d, const char __user *name, const void __user *value,
523  	 size_t size, int flags)
524  {
525  	int error;
526  	void *kvalue = NULL;
527  	char kname[XATTR_NAME_MAX + 1];
528  
529  	if (flags & ~(XATTR_CREATE|XATTR_REPLACE))
530  		return -EINVAL;
531  
532  	error = strncpy_from_user(kname, name, sizeof(kname));
533  	if (error == 0 || error == sizeof(kname))
534  		error = -ERANGE;
535  	if (error < 0)
536  		return error;
537  
538  	if (size) {
539  		if (size > XATTR_SIZE_MAX)
540  			return -E2BIG;
541  		kvalue = kvmalloc(size, GFP_KERNEL);
542  		if (!kvalue)
543  			return -ENOMEM;
544  		if (copy_from_user(kvalue, value, size)) {
545  			error = -EFAULT;
546  			goto out;
547  		}
548  		if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
549  		    (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0))
550  			posix_acl_fix_xattr_from_user(kvalue, size);
551  	}
552  
553  	error = vfs_setxattr(d, kname, kvalue, size, flags);
554  out:
555  	kvfree(kvalue);
556  
557  	return error;
558  }
559  
560  static int path_setxattr(const char __user *pathname,
561  			 const char __user *name, const void __user *value,
562  			 size_t size, int flags, unsigned int lookup_flags)
563  {
564  	struct path path;
565  	int error;
566  retry:
567  	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
568  	if (error)
569  		return error;
570  	error = mnt_want_write(path.mnt);
571  	if (!error) {
572  		error = setxattr(path.dentry, name, value, size, flags);
573  		mnt_drop_write(path.mnt);
574  	}
575  	path_put(&path);
576  	if (retry_estale(error, lookup_flags)) {
577  		lookup_flags |= LOOKUP_REVAL;
578  		goto retry;
579  	}
580  	return error;
581  }
582  
583  SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
584  		const char __user *, name, const void __user *, value,
585  		size_t, size, int, flags)
586  {
587  	return path_setxattr(pathname, name, value, size, flags, LOOKUP_FOLLOW);
588  }
589  
590  SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
591  		const char __user *, name, const void __user *, value,
592  		size_t, size, int, flags)
593  {
594  	return path_setxattr(pathname, name, value, size, flags, 0);
595  }
596  
597  SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
598  		const void __user *,value, size_t, size, int, flags)
599  {
600  	struct fd f = fdget(fd);
601  	int error = -EBADF;
602  
603  	if (!f.file)
604  		return error;
605  	audit_file(f.file);
606  	error = mnt_want_write_file(f.file);
607  	if (!error) {
608  		error = setxattr(f.file->f_path.dentry, name, value, size, flags);
609  		mnt_drop_write_file(f.file);
610  	}
611  	fdput(f);
612  	return error;
613  }
614  
615  /*
616   * Extended attribute GET operations
617   */
618  static ssize_t
619  getxattr(struct dentry *d, const char __user *name, void __user *value,
620  	 size_t size)
621  {
622  	ssize_t error;
623  	void *kvalue = NULL;
624  	char kname[XATTR_NAME_MAX + 1];
625  
626  	error = strncpy_from_user(kname, name, sizeof(kname));
627  	if (error == 0 || error == sizeof(kname))
628  		error = -ERANGE;
629  	if (error < 0)
630  		return error;
631  
632  	if (size) {
633  		if (size > XATTR_SIZE_MAX)
634  			size = XATTR_SIZE_MAX;
635  		kvalue = kvzalloc(size, GFP_KERNEL);
636  		if (!kvalue)
637  			return -ENOMEM;
638  	}
639  
640  	error = vfs_getxattr(d, kname, kvalue, size);
641  	if (error > 0) {
642  		if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
643  		    (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0))
644  			posix_acl_fix_xattr_to_user(kvalue, error);
645  		if (size && copy_to_user(value, kvalue, error))
646  			error = -EFAULT;
647  	} else if (error == -ERANGE && size >= XATTR_SIZE_MAX) {
648  		/* The file system tried to returned a value bigger
649  		   than XATTR_SIZE_MAX bytes. Not possible. */
650  		error = -E2BIG;
651  	}
652  
653  	kvfree(kvalue);
654  
655  	return error;
656  }
657  
658  static ssize_t path_getxattr(const char __user *pathname,
659  			     const char __user *name, void __user *value,
660  			     size_t size, unsigned int lookup_flags)
661  {
662  	struct path path;
663  	ssize_t error;
664  retry:
665  	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
666  	if (error)
667  		return error;
668  	error = getxattr(path.dentry, name, value, size);
669  	path_put(&path);
670  	if (retry_estale(error, lookup_flags)) {
671  		lookup_flags |= LOOKUP_REVAL;
672  		goto retry;
673  	}
674  	return error;
675  }
676  
677  SYSCALL_DEFINE4(getxattr, const char __user *, pathname,
678  		const char __user *, name, void __user *, value, size_t, size)
679  {
680  	return path_getxattr(pathname, name, value, size, LOOKUP_FOLLOW);
681  }
682  
683  SYSCALL_DEFINE4(lgetxattr, const char __user *, pathname,
684  		const char __user *, name, void __user *, value, size_t, size)
685  {
686  	return path_getxattr(pathname, name, value, size, 0);
687  }
688  
689  SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name,
690  		void __user *, value, size_t, size)
691  {
692  	struct fd f = fdget(fd);
693  	ssize_t error = -EBADF;
694  
695  	if (!f.file)
696  		return error;
697  	audit_file(f.file);
698  	error = getxattr(f.file->f_path.dentry, name, value, size);
699  	fdput(f);
700  	return error;
701  }
702  
703  /*
704   * Extended attribute LIST operations
705   */
706  static ssize_t
707  listxattr(struct dentry *d, char __user *list, size_t size)
708  {
709  	ssize_t error;
710  	char *klist = NULL;
711  
712  	if (size) {
713  		if (size > XATTR_LIST_MAX)
714  			size = XATTR_LIST_MAX;
715  		klist = kvmalloc(size, GFP_KERNEL);
716  		if (!klist)
717  			return -ENOMEM;
718  	}
719  
720  	error = vfs_listxattr(d, klist, size);
721  	if (error > 0) {
722  		if (size && copy_to_user(list, klist, error))
723  			error = -EFAULT;
724  	} else if (error == -ERANGE && size >= XATTR_LIST_MAX) {
725  		/* The file system tried to returned a list bigger
726  		   than XATTR_LIST_MAX bytes. Not possible. */
727  		error = -E2BIG;
728  	}
729  
730  	kvfree(klist);
731  
732  	return error;
733  }
734  
735  static ssize_t path_listxattr(const char __user *pathname, char __user *list,
736  			      size_t size, unsigned int lookup_flags)
737  {
738  	struct path path;
739  	ssize_t error;
740  retry:
741  	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
742  	if (error)
743  		return error;
744  	error = listxattr(path.dentry, list, size);
745  	path_put(&path);
746  	if (retry_estale(error, lookup_flags)) {
747  		lookup_flags |= LOOKUP_REVAL;
748  		goto retry;
749  	}
750  	return error;
751  }
752  
753  SYSCALL_DEFINE3(listxattr, const char __user *, pathname, char __user *, list,
754  		size_t, size)
755  {
756  	return path_listxattr(pathname, list, size, LOOKUP_FOLLOW);
757  }
758  
759  SYSCALL_DEFINE3(llistxattr, const char __user *, pathname, char __user *, list,
760  		size_t, size)
761  {
762  	return path_listxattr(pathname, list, size, 0);
763  }
764  
765  SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size)
766  {
767  	struct fd f = fdget(fd);
768  	ssize_t error = -EBADF;
769  
770  	if (!f.file)
771  		return error;
772  	audit_file(f.file);
773  	error = listxattr(f.file->f_path.dentry, list, size);
774  	fdput(f);
775  	return error;
776  }
777  
778  /*
779   * Extended attribute REMOVE operations
780   */
781  static long
782  removexattr(struct dentry *d, const char __user *name)
783  {
784  	int error;
785  	char kname[XATTR_NAME_MAX + 1];
786  
787  	error = strncpy_from_user(kname, name, sizeof(kname));
788  	if (error == 0 || error == sizeof(kname))
789  		error = -ERANGE;
790  	if (error < 0)
791  		return error;
792  
793  	return vfs_removexattr(d, kname);
794  }
795  
796  static int path_removexattr(const char __user *pathname,
797  			    const char __user *name, unsigned int lookup_flags)
798  {
799  	struct path path;
800  	int error;
801  retry:
802  	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
803  	if (error)
804  		return error;
805  	error = mnt_want_write(path.mnt);
806  	if (!error) {
807  		error = removexattr(path.dentry, name);
808  		mnt_drop_write(path.mnt);
809  	}
810  	path_put(&path);
811  	if (retry_estale(error, lookup_flags)) {
812  		lookup_flags |= LOOKUP_REVAL;
813  		goto retry;
814  	}
815  	return error;
816  }
817  
818  SYSCALL_DEFINE2(removexattr, const char __user *, pathname,
819  		const char __user *, name)
820  {
821  	return path_removexattr(pathname, name, LOOKUP_FOLLOW);
822  }
823  
824  SYSCALL_DEFINE2(lremovexattr, const char __user *, pathname,
825  		const char __user *, name)
826  {
827  	return path_removexattr(pathname, name, 0);
828  }
829  
830  SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name)
831  {
832  	struct fd f = fdget(fd);
833  	int error = -EBADF;
834  
835  	if (!f.file)
836  		return error;
837  	audit_file(f.file);
838  	error = mnt_want_write_file(f.file);
839  	if (!error) {
840  		error = removexattr(f.file->f_path.dentry, name);
841  		mnt_drop_write_file(f.file);
842  	}
843  	fdput(f);
844  	return error;
845  }
846  
847  /*
848   * Combine the results of the list() operation from every xattr_handler in the
849   * list.
850   */
851  ssize_t
852  generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
853  {
854  	const struct xattr_handler *handler, **handlers = dentry->d_sb->s_xattr;
855  	unsigned int size = 0;
856  
857  	if (!buffer) {
858  		for_each_xattr_handler(handlers, handler) {
859  			if (!handler->name ||
860  			    (handler->list && !handler->list(dentry)))
861  				continue;
862  			size += strlen(handler->name) + 1;
863  		}
864  	} else {
865  		char *buf = buffer;
866  		size_t len;
867  
868  		for_each_xattr_handler(handlers, handler) {
869  			if (!handler->name ||
870  			    (handler->list && !handler->list(dentry)))
871  				continue;
872  			len = strlen(handler->name);
873  			if (len + 1 > buffer_size)
874  				return -ERANGE;
875  			memcpy(buf, handler->name, len + 1);
876  			buf += len + 1;
877  			buffer_size -= len + 1;
878  		}
879  		size = buf - buffer;
880  	}
881  	return size;
882  }
883  EXPORT_SYMBOL(generic_listxattr);
884  
885  /**
886   * xattr_full_name  -  Compute full attribute name from suffix
887   *
888   * @handler:	handler of the xattr_handler operation
889   * @name:	name passed to the xattr_handler operation
890   *
891   * The get and set xattr handler operations are called with the remainder of
892   * the attribute name after skipping the handler's prefix: for example, "foo"
893   * is passed to the get operation of a handler with prefix "user." to get
894   * attribute "user.foo".  The full name is still "there" in the name though.
895   *
896   * Note: the list xattr handler operation when called from the vfs is passed a
897   * NULL name; some file systems use this operation internally, with varying
898   * semantics.
899   */
900  const char *xattr_full_name(const struct xattr_handler *handler,
901  			    const char *name)
902  {
903  	size_t prefix_len = strlen(xattr_prefix(handler));
904  
905  	return name - prefix_len;
906  }
907  EXPORT_SYMBOL(xattr_full_name);
908  
909  /*
910   * Allocate new xattr and copy in the value; but leave the name to callers.
911   */
912  struct simple_xattr *simple_xattr_alloc(const void *value, size_t size)
913  {
914  	struct simple_xattr *new_xattr;
915  	size_t len;
916  
917  	/* wrap around? */
918  	len = sizeof(*new_xattr) + size;
919  	if (len < sizeof(*new_xattr))
920  		return NULL;
921  
922  	new_xattr = kvmalloc(len, GFP_KERNEL);
923  	if (!new_xattr)
924  		return NULL;
925  
926  	new_xattr->size = size;
927  	memcpy(new_xattr->value, value, size);
928  	return new_xattr;
929  }
930  
931  /*
932   * xattr GET operation for in-memory/pseudo filesystems
933   */
934  int simple_xattr_get(struct simple_xattrs *xattrs, const char *name,
935  		     void *buffer, size_t size)
936  {
937  	struct simple_xattr *xattr;
938  	int ret = -ENODATA;
939  
940  	spin_lock(&xattrs->lock);
941  	list_for_each_entry(xattr, &xattrs->head, list) {
942  		if (strcmp(name, xattr->name))
943  			continue;
944  
945  		ret = xattr->size;
946  		if (buffer) {
947  			if (size < xattr->size)
948  				ret = -ERANGE;
949  			else
950  				memcpy(buffer, xattr->value, xattr->size);
951  		}
952  		break;
953  	}
954  	spin_unlock(&xattrs->lock);
955  	return ret;
956  }
957  
958  /**
959   * simple_xattr_set - xattr SET operation for in-memory/pseudo filesystems
960   * @xattrs: target simple_xattr list
961   * @name: name of the extended attribute
962   * @value: value of the xattr. If %NULL, will remove the attribute.
963   * @size: size of the new xattr
964   * @flags: %XATTR_{CREATE|REPLACE}
965   * @removed_size: returns size of the removed xattr, -1 if none removed
966   *
967   * %XATTR_CREATE is set, the xattr shouldn't exist already; otherwise fails
968   * with -EEXIST.  If %XATTR_REPLACE is set, the xattr should exist;
969   * otherwise, fails with -ENODATA.
970   *
971   * Returns 0 on success, -errno on failure.
972   */
973  int simple_xattr_set(struct simple_xattrs *xattrs, const char *name,
974  		     const void *value, size_t size, int flags,
975  		     ssize_t *removed_size)
976  {
977  	struct simple_xattr *xattr;
978  	struct simple_xattr *new_xattr = NULL;
979  	int err = 0;
980  
981  	if (removed_size)
982  		*removed_size = -1;
983  
984  	/* value == NULL means remove */
985  	if (value) {
986  		new_xattr = simple_xattr_alloc(value, size);
987  		if (!new_xattr)
988  			return -ENOMEM;
989  
990  		new_xattr->name = kstrdup(name, GFP_KERNEL);
991  		if (!new_xattr->name) {
992  			kvfree(new_xattr);
993  			return -ENOMEM;
994  		}
995  	}
996  
997  	spin_lock(&xattrs->lock);
998  	list_for_each_entry(xattr, &xattrs->head, list) {
999  		if (!strcmp(name, xattr->name)) {
1000  			if (flags & XATTR_CREATE) {
1001  				xattr = new_xattr;
1002  				err = -EEXIST;
1003  			} else if (new_xattr) {
1004  				list_replace(&xattr->list, &new_xattr->list);
1005  				if (removed_size)
1006  					*removed_size = xattr->size;
1007  			} else {
1008  				list_del(&xattr->list);
1009  				if (removed_size)
1010  					*removed_size = xattr->size;
1011  			}
1012  			goto out;
1013  		}
1014  	}
1015  	if (flags & XATTR_REPLACE) {
1016  		xattr = new_xattr;
1017  		err = -ENODATA;
1018  	} else {
1019  		list_add(&new_xattr->list, &xattrs->head);
1020  		xattr = NULL;
1021  	}
1022  out:
1023  	spin_unlock(&xattrs->lock);
1024  	if (xattr) {
1025  		kfree(xattr->name);
1026  		kvfree(xattr);
1027  	}
1028  	return err;
1029  
1030  }
1031  
1032  static bool xattr_is_trusted(const char *name)
1033  {
1034  	return !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN);
1035  }
1036  
1037  static int xattr_list_one(char **buffer, ssize_t *remaining_size,
1038  			  const char *name)
1039  {
1040  	size_t len = strlen(name) + 1;
1041  	if (*buffer) {
1042  		if (*remaining_size < len)
1043  			return -ERANGE;
1044  		memcpy(*buffer, name, len);
1045  		*buffer += len;
1046  	}
1047  	*remaining_size -= len;
1048  	return 0;
1049  }
1050  
1051  /*
1052   * xattr LIST operation for in-memory/pseudo filesystems
1053   */
1054  ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
1055  			  char *buffer, size_t size)
1056  {
1057  	bool trusted = capable(CAP_SYS_ADMIN);
1058  	struct simple_xattr *xattr;
1059  	ssize_t remaining_size = size;
1060  	int err = 0;
1061  
1062  #ifdef CONFIG_FS_POSIX_ACL
1063  	if (IS_POSIXACL(inode)) {
1064  		if (inode->i_acl) {
1065  			err = xattr_list_one(&buffer, &remaining_size,
1066  					     XATTR_NAME_POSIX_ACL_ACCESS);
1067  			if (err)
1068  				return err;
1069  		}
1070  		if (inode->i_default_acl) {
1071  			err = xattr_list_one(&buffer, &remaining_size,
1072  					     XATTR_NAME_POSIX_ACL_DEFAULT);
1073  			if (err)
1074  				return err;
1075  		}
1076  	}
1077  #endif
1078  
1079  	spin_lock(&xattrs->lock);
1080  	list_for_each_entry(xattr, &xattrs->head, list) {
1081  		/* skip "trusted." attributes for unprivileged callers */
1082  		if (!trusted && xattr_is_trusted(xattr->name))
1083  			continue;
1084  
1085  		err = xattr_list_one(&buffer, &remaining_size, xattr->name);
1086  		if (err)
1087  			break;
1088  	}
1089  	spin_unlock(&xattrs->lock);
1090  
1091  	return err ? err : size - remaining_size;
1092  }
1093  
1094  /*
1095   * Adds an extended attribute to the list
1096   */
1097  void simple_xattr_list_add(struct simple_xattrs *xattrs,
1098  			   struct simple_xattr *new_xattr)
1099  {
1100  	spin_lock(&xattrs->lock);
1101  	list_add(&new_xattr->list, &xattrs->head);
1102  	spin_unlock(&xattrs->lock);
1103  }
1104