namei.c 122 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037403840394040404140424043404440454046404740484049405040514052405340544055405640574058405940604061406240634064406540664067406840694070407140724073407440754076407740784079408040814082408340844085408640874088408940904091409240934094409540964097409840994100410141024103410441054106410741084109411041114112411341144115411641174118411941204121412241234124412541264127412841294130413141324133413441354136413741384139414041414142414341444145414641474148414941504151415241534154415541564157415841594160416141624163416441654166416741684169417041714172417341744175417641774178417941804181418241834184418541864187418841894190419141924193419441954196419741984199420042014202420342044205420642074208420942104211421242134214421542164217421842194220422142224223422442254226422742284229423042314232423342344235423642374238423942404241424242434244424542464247424842494250425142524253425442554256425742584259426042614262426342644265426642674268426942704271427242734274427542764277427842794280428142824283428442854286428742884289429042914292429342944295429642974298429943004301430243034304430543064307430843094310431143124313431443154316431743184319432043214322432343244325432643274328432943304331433243334334433543364337433843394340434143424343434443454346434743484349435043514352435343544355435643574358435943604361436243634364436543664367436843694370437143724373437443754376437743784379438043814382438343844385438643874388438943904391439243934394439543964397439843994400440144024403440444054406440744084409441044114412441344144415441644174418441944204421442244234424442544264427442844294430443144324433443444354436443744384439444044414442444344444445444644474448444944504451445244534454445544564457445844594460446144624463446444654466446744684469447044714472447344744475447644774478447944804481448244834484448544864487448844894490449144924493449444954496449744984499450045014502450345044505450645074508450945104511451245134514451545164517451845194520452145224523452445254526452745284529453045314532453345344535453645374538453945404541454245434544454545464547454845494550455145524553455445554556455745584559456045614562456345644565456645674568456945704571457245734574457545764577457845794580458145824583458445854586458745884589459045914592459345944595459645974598459946004601460246034604460546064607460846094610461146124613461446154616461746184619462046214622462346244625462646274628462946304631463246334634463546364637463846394640464146424643464446454646464746484649465046514652465346544655465646574658465946604661466246634664466546664667466846694670467146724673467446754676467746784679468046814682468346844685468646874688468946904691469246934694469546964697469846994700470147024703470447054706470747084709471047114712471347144715471647174718471947204721472247234724472547264727472847294730473147324733473447354736473747384739474047414742474347444745474647474748474947504751475247534754
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * linux/fs/namei.c
  4. *
  5. * Copyright (C) 1991, 1992 Linus Torvalds
  6. */
  7. /*
  8. * Some corrections by tytso.
  9. */
  10. /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
  11. * lookup logic.
  12. */
  13. /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
  14. */
  15. #include <linux/init.h>
  16. #include <linux/export.h>
  17. #include <linux/kernel.h>
  18. #include <linux/slab.h>
  19. #include <linux/fs.h>
  20. #include <linux/namei.h>
  21. #include <linux/pagemap.h>
  22. #include <linux/fsnotify.h>
  23. #include <linux/personality.h>
  24. #include <linux/security.h>
  25. #include <linux/ima.h>
  26. #include <linux/syscalls.h>
  27. #include <linux/mount.h>
  28. #include <linux/audit.h>
  29. #include <linux/capability.h>
  30. #include <linux/file.h>
  31. #include <linux/fcntl.h>
  32. #include <linux/device_cgroup.h>
  33. #include <linux/fs_struct.h>
  34. #include <linux/posix_acl.h>
  35. #include <linux/hash.h>
  36. #include <linux/bitops.h>
  37. #include <linux/init_task.h>
  38. #include <linux/uaccess.h>
  39. #include "internal.h"
  40. #include "mount.h"
  41. #define CREATE_TRACE_POINTS
  42. #include <trace/events/namei.h>
  43. /* [Feb-1997 T. Schoebel-Theuer]
  44. * Fundamental changes in the pathname lookup mechanisms (namei)
  45. * were necessary because of omirr. The reason is that omirr needs
  46. * to know the _real_ pathname, not the user-supplied one, in case
  47. * of symlinks (and also when transname replacements occur).
  48. *
  49. * The new code replaces the old recursive symlink resolution with
  50. * an iterative one (in case of non-nested symlink chains). It does
  51. * this with calls to <fs>_follow_link().
  52. * As a side effect, dir_namei(), _namei() and follow_link() are now
  53. * replaced with a single function lookup_dentry() that can handle all
  54. * the special cases of the former code.
  55. *
  56. * With the new dcache, the pathname is stored at each inode, at least as
  57. * long as the refcount of the inode is positive. As a side effect, the
  58. * size of the dcache depends on the inode cache and thus is dynamic.
  59. *
  60. * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
  61. * resolution to correspond with current state of the code.
  62. *
  63. * Note that the symlink resolution is not *completely* iterative.
  64. * There is still a significant amount of tail- and mid- recursion in
  65. * the algorithm. Also, note that <fs>_readlink() is not used in
  66. * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
  67. * may return different results than <fs>_follow_link(). Many virtual
  68. * filesystems (including /proc) exhibit this behavior.
  69. */
  70. /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
  71. * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
  72. * and the name already exists in form of a symlink, try to create the new
  73. * name indicated by the symlink. The old code always complained that the
  74. * name already exists, due to not following the symlink even if its target
  75. * is nonexistent. The new semantics affects also mknod() and link() when
  76. * the name is a symlink pointing to a non-existent name.
  77. *
  78. * I don't know which semantics is the right one, since I have no access
  79. * to standards. But I found by trial that HP-UX 9.0 has the full "new"
  80. * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
  81. * "old" one. Personally, I think the new semantics is much more logical.
  82. * Note that "ln old new" where "new" is a symlink pointing to a non-existing
  83. * file does succeed in both HP-UX and SunOs, but not in Solaris
  84. * and in the old Linux semantics.
  85. */
  86. /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
  87. * semantics. See the comments in "open_namei" and "do_link" below.
  88. *
  89. * [10-Sep-98 Alan Modra] Another symlink change.
  90. */
  91. /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
  92. * inside the path - always follow.
  93. * in the last component in creation/removal/renaming - never follow.
  94. * if LOOKUP_FOLLOW passed - follow.
  95. * if the pathname has trailing slashes - follow.
  96. * otherwise - don't follow.
  97. * (applied in that order).
  98. *
  99. * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
  100. * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
  101. * During the 2.4 we need to fix the userland stuff depending on it -
  102. * hopefully we will be able to get rid of that wart in 2.5. So far only
  103. * XEmacs seems to be relying on it...
  104. */
  105. /*
  106. * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
  107. * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives
  108. * any extra contention...
  109. */
  110. /* In order to reduce some races, while at the same time doing additional
  111. * checking and hopefully speeding things up, we copy filenames to the
  112. * kernel data space before using them..
  113. *
  114. * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
  115. * PATH_MAX includes the nul terminator --RR.
  116. */
  117. #define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname))
  118. struct filename *
  119. getname_flags(const char __user *filename, int flags, int *empty)
  120. {
  121. struct filename *result;
  122. char *kname;
  123. int len;
  124. result = audit_reusename(filename);
  125. if (result)
  126. return result;
  127. result = __getname();
  128. if (unlikely(!result))
  129. return ERR_PTR(-ENOMEM);
  130. /*
  131. * First, try to embed the struct filename inside the names_cache
  132. * allocation
  133. */
  134. kname = (char *)result->iname;
  135. result->name = kname;
  136. len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
  137. if (unlikely(len < 0)) {
  138. __putname(result);
  139. return ERR_PTR(len);
  140. }
  141. /*
  142. * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
  143. * separate struct filename so we can dedicate the entire
  144. * names_cache allocation for the pathname, and re-do the copy from
  145. * userland.
  146. */
  147. if (unlikely(len == EMBEDDED_NAME_MAX)) {
  148. const size_t size = offsetof(struct filename, iname[1]);
  149. kname = (char *)result;
  150. /*
  151. * size is chosen that way we to guarantee that
  152. * result->iname[0] is within the same object and that
  153. * kname can't be equal to result->iname, no matter what.
  154. */
  155. result = kzalloc(size, GFP_KERNEL);
  156. if (unlikely(!result)) {
  157. __putname(kname);
  158. return ERR_PTR(-ENOMEM);
  159. }
  160. result->name = kname;
  161. len = strncpy_from_user(kname, filename, PATH_MAX);
  162. if (unlikely(len < 0)) {
  163. __putname(kname);
  164. kfree(result);
  165. return ERR_PTR(len);
  166. }
  167. if (unlikely(len == PATH_MAX)) {
  168. __putname(kname);
  169. kfree(result);
  170. return ERR_PTR(-ENAMETOOLONG);
  171. }
  172. }
  173. result->refcnt = 1;
  174. /* The empty path is special. */
  175. if (unlikely(!len)) {
  176. if (empty)
  177. *empty = 1;
  178. if (!(flags & LOOKUP_EMPTY)) {
  179. putname(result);
  180. return ERR_PTR(-ENOENT);
  181. }
  182. }
  183. result->uptr = filename;
  184. result->aname = NULL;
  185. audit_getname(result);
  186. return result;
  187. }
  188. struct filename *
  189. getname(const char __user * filename)
  190. {
  191. return getname_flags(filename, 0, NULL);
  192. }
  193. struct filename *
  194. getname_kernel(const char * filename)
  195. {
  196. struct filename *result;
  197. int len = strlen(filename) + 1;
  198. result = __getname();
  199. if (unlikely(!result))
  200. return ERR_PTR(-ENOMEM);
  201. if (len <= EMBEDDED_NAME_MAX) {
  202. result->name = (char *)result->iname;
  203. } else if (len <= PATH_MAX) {
  204. const size_t size = offsetof(struct filename, iname[1]);
  205. struct filename *tmp;
  206. tmp = kmalloc(size, GFP_KERNEL);
  207. if (unlikely(!tmp)) {
  208. __putname(result);
  209. return ERR_PTR(-ENOMEM);
  210. }
  211. tmp->name = (char *)result;
  212. result = tmp;
  213. } else {
  214. __putname(result);
  215. return ERR_PTR(-ENAMETOOLONG);
  216. }
  217. memcpy((char *)result->name, filename, len);
  218. result->uptr = NULL;
  219. result->aname = NULL;
  220. result->refcnt = 1;
  221. audit_getname(result);
  222. return result;
  223. }
  224. void putname(struct filename *name)
  225. {
  226. BUG_ON(name->refcnt <= 0);
  227. if (--name->refcnt > 0)
  228. return;
  229. if (name->name != name->iname) {
  230. __putname(name->name);
  231. kfree(name);
  232. } else
  233. __putname(name);
  234. }
  235. static int check_acl(struct inode *inode, int mask)
  236. {
  237. #ifdef CONFIG_FS_POSIX_ACL
  238. struct posix_acl *acl;
  239. if (mask & MAY_NOT_BLOCK) {
  240. acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
  241. if (!acl)
  242. return -EAGAIN;
  243. /* no ->get_acl() calls in RCU mode... */
  244. if (is_uncached_acl(acl))
  245. return -ECHILD;
  246. return posix_acl_permission(inode, acl, mask);
  247. }
  248. acl = get_acl(inode, ACL_TYPE_ACCESS);
  249. if (IS_ERR(acl))
  250. return PTR_ERR(acl);
  251. if (acl) {
  252. int error = posix_acl_permission(inode, acl, mask);
  253. posix_acl_release(acl);
  254. return error;
  255. }
  256. #endif
  257. return -EAGAIN;
  258. }
  259. /*
  260. * This does the basic UNIX permission checking.
  261. *
  262. * Note that the POSIX ACL check cares about the MAY_NOT_BLOCK bit,
  263. * for RCU walking.
  264. */
  265. static int acl_permission_check(struct inode *inode, int mask)
  266. {
  267. unsigned int mode = inode->i_mode;
  268. /* Are we the owner? If so, ACL's don't matter */
  269. if (likely(uid_eq(current_fsuid(), inode->i_uid))) {
  270. mask &= 7;
  271. mode >>= 6;
  272. return (mask & ~mode) ? -EACCES : 0;
  273. }
  274. /* Do we have ACL's? */
  275. if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
  276. int error = check_acl(inode, mask);
  277. if (error != -EAGAIN)
  278. return error;
  279. }
  280. /* Only RWX matters for group/other mode bits */
  281. mask &= 7;
  282. /*
  283. * Are the group permissions different from
  284. * the other permissions in the bits we care
  285. * about? Need to check group ownership if so.
  286. */
  287. if (mask & (mode ^ (mode >> 3))) {
  288. if (in_group_p(inode->i_gid))
  289. mode >>= 3;
  290. }
  291. /* Bits in 'mode' clear that we require? */
  292. return (mask & ~mode) ? -EACCES : 0;
  293. }
  294. /**
  295. * generic_permission - check for access rights on a Posix-like filesystem
  296. * @inode: inode to check access rights for
  297. * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC,
  298. * %MAY_NOT_BLOCK ...)
  299. *
  300. * Used to check for read/write/execute permissions on a file.
  301. * We use "fsuid" for this, letting us set arbitrary permissions
  302. * for filesystem access without changing the "normal" uids which
  303. * are used for other things.
  304. *
  305. * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
  306. * request cannot be satisfied (eg. requires blocking or too much complexity).
  307. * It would then be called again in ref-walk mode.
  308. */
  309. int generic_permission(struct inode *inode, int mask)
  310. {
  311. int ret;
  312. /*
  313. * Do the basic permission checks.
  314. */
  315. ret = acl_permission_check(inode, mask);
  316. if (ret != -EACCES)
  317. return ret;
  318. if (S_ISDIR(inode->i_mode)) {
  319. /* DACs are overridable for directories */
  320. if (!(mask & MAY_WRITE))
  321. if (capable_wrt_inode_uidgid(inode,
  322. CAP_DAC_READ_SEARCH))
  323. return 0;
  324. if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
  325. return 0;
  326. return -EACCES;
  327. }
  328. /*
  329. * Searching includes executable on directories, else just read.
  330. */
  331. mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
  332. if (mask == MAY_READ)
  333. if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))
  334. return 0;
  335. /*
  336. * Read/write DACs are always overridable.
  337. * Executable DACs are overridable when there is
  338. * at least one exec bit set.
  339. */
  340. if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
  341. if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
  342. return 0;
  343. return -EACCES;
  344. }
  345. EXPORT_SYMBOL(generic_permission);
  346. /*
  347. * We _really_ want to just do "generic_permission()" without
  348. * even looking at the inode->i_op values. So we keep a cache
  349. * flag in inode->i_opflags, that says "this has not special
  350. * permission function, use the fast case".
  351. */
  352. static inline int do_inode_permission(struct inode *inode, int mask)
  353. {
  354. if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
  355. if (likely(inode->i_op->permission))
  356. return inode->i_op->permission(inode, mask);
  357. /* This gets set once for the inode lifetime */
  358. spin_lock(&inode->i_lock);
  359. inode->i_opflags |= IOP_FASTPERM;
  360. spin_unlock(&inode->i_lock);
  361. }
  362. return generic_permission(inode, mask);
  363. }
  364. /**
  365. * sb_permission - Check superblock-level permissions
  366. * @sb: Superblock of inode to check permission on
  367. * @inode: Inode to check permission on
  368. * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
  369. *
  370. * Separate out file-system wide checks from inode-specific permission checks.
  371. */
  372. static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
  373. {
  374. if (unlikely(mask & MAY_WRITE)) {
  375. umode_t mode = inode->i_mode;
  376. /* Nobody gets write access to a read-only fs. */
  377. if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
  378. return -EROFS;
  379. }
  380. return 0;
  381. }
  382. /**
  383. * inode_permission - Check for access rights to a given inode
  384. * @inode: Inode to check permission on
  385. * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
  386. *
  387. * Check for read/write/execute permissions on an inode. We use fs[ug]id for
  388. * this, letting us set arbitrary permissions for filesystem access without
  389. * changing the "normal" UIDs which are used for other things.
  390. *
  391. * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
  392. */
  393. int inode_permission(struct inode *inode, int mask)
  394. {
  395. int retval;
  396. retval = sb_permission(inode->i_sb, inode, mask);
  397. if (retval)
  398. return retval;
  399. if (unlikely(mask & MAY_WRITE)) {
  400. /*
  401. * Nobody gets write access to an immutable file.
  402. */
  403. if (IS_IMMUTABLE(inode))
  404. return -EPERM;
  405. /*
  406. * Updating mtime will likely cause i_uid and i_gid to be
  407. * written back improperly if their true value is unknown
  408. * to the vfs.
  409. */
  410. if (HAS_UNMAPPED_ID(inode))
  411. return -EACCES;
  412. }
  413. retval = do_inode_permission(inode, mask);
  414. if (retval)
  415. return retval;
  416. retval = devcgroup_inode_permission(inode, mask);
  417. if (retval)
  418. return retval;
  419. return security_inode_permission(inode, mask);
  420. }
  421. EXPORT_SYMBOL(inode_permission);
  422. /**
  423. * path_get - get a reference to a path
  424. * @path: path to get the reference to
  425. *
  426. * Given a path increment the reference count to the dentry and the vfsmount.
  427. */
  428. void path_get(const struct path *path)
  429. {
  430. mntget(path->mnt);
  431. dget(path->dentry);
  432. }
  433. EXPORT_SYMBOL(path_get);
  434. /**
  435. * path_put - put a reference to a path
  436. * @path: path to put the reference to
  437. *
  438. * Given a path decrement the reference count to the dentry and the vfsmount.
  439. */
  440. void path_put(const struct path *path)
  441. {
  442. dput(path->dentry);
  443. mntput(path->mnt);
  444. }
  445. EXPORT_SYMBOL(path_put);
  446. #define EMBEDDED_LEVELS 2
  447. struct nameidata {
  448. struct path path;
  449. struct qstr last;
  450. struct path root;
  451. struct inode *inode; /* path.dentry.d_inode */
  452. unsigned int flags;
  453. unsigned seq, m_seq, r_seq;
  454. int last_type;
  455. unsigned depth;
  456. int total_link_count;
  457. struct saved {
  458. struct path link;
  459. struct delayed_call done;
  460. const char *name;
  461. unsigned seq;
  462. } *stack, internal[EMBEDDED_LEVELS];
  463. struct filename *name;
  464. struct nameidata *saved;
  465. unsigned root_seq;
  466. int dfd;
  467. kuid_t dir_uid;
  468. umode_t dir_mode;
  469. } __randomize_layout;
  470. static void set_nameidata(struct nameidata *p, int dfd, struct filename *name)
  471. {
  472. struct nameidata *old = current->nameidata;
  473. p->stack = p->internal;
  474. p->dfd = dfd;
  475. p->name = name;
  476. p->total_link_count = old ? old->total_link_count : 0;
  477. p->saved = old;
  478. current->nameidata = p;
  479. }
  480. static void restore_nameidata(void)
  481. {
  482. struct nameidata *now = current->nameidata, *old = now->saved;
  483. current->nameidata = old;
  484. if (old)
  485. old->total_link_count = now->total_link_count;
  486. if (now->stack != now->internal)
  487. kfree(now->stack);
  488. }
  489. static bool nd_alloc_stack(struct nameidata *nd)
  490. {
  491. struct saved *p;
  492. p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
  493. nd->flags & LOOKUP_RCU ? GFP_ATOMIC : GFP_KERNEL);
  494. if (unlikely(!p))
  495. return false;
  496. memcpy(p, nd->internal, sizeof(nd->internal));
  497. nd->stack = p;
  498. return true;
  499. }
  500. /**
  501. * path_connected - Verify that a dentry is below mnt.mnt_root
  502. *
  503. * Rename can sometimes move a file or directory outside of a bind
  504. * mount, path_connected allows those cases to be detected.
  505. */
  506. static bool path_connected(struct vfsmount *mnt, struct dentry *dentry)
  507. {
  508. struct super_block *sb = mnt->mnt_sb;
  509. /* Bind mounts can have disconnected paths */
  510. if (mnt->mnt_root == sb->s_root)
  511. return true;
  512. return is_subdir(dentry, mnt->mnt_root);
  513. }
  514. static void drop_links(struct nameidata *nd)
  515. {
  516. int i = nd->depth;
  517. while (i--) {
  518. struct saved *last = nd->stack + i;
  519. do_delayed_call(&last->done);
  520. clear_delayed_call(&last->done);
  521. }
  522. }
  523. static void terminate_walk(struct nameidata *nd)
  524. {
  525. drop_links(nd);
  526. if (!(nd->flags & LOOKUP_RCU)) {
  527. int i;
  528. path_put(&nd->path);
  529. for (i = 0; i < nd->depth; i++)
  530. path_put(&nd->stack[i].link);
  531. if (nd->flags & LOOKUP_ROOT_GRABBED) {
  532. path_put(&nd->root);
  533. nd->flags &= ~LOOKUP_ROOT_GRABBED;
  534. }
  535. } else {
  536. nd->flags &= ~LOOKUP_RCU;
  537. rcu_read_unlock();
  538. }
  539. nd->depth = 0;
  540. }
  541. /* path_put is needed afterwards regardless of success or failure */
  542. static bool __legitimize_path(struct path *path, unsigned seq, unsigned mseq)
  543. {
  544. int res = __legitimize_mnt(path->mnt, mseq);
  545. if (unlikely(res)) {
  546. if (res > 0)
  547. path->mnt = NULL;
  548. path->dentry = NULL;
  549. return false;
  550. }
  551. if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
  552. path->dentry = NULL;
  553. return false;
  554. }
  555. return !read_seqcount_retry(&path->dentry->d_seq, seq);
  556. }
  557. static inline bool legitimize_path(struct nameidata *nd,
  558. struct path *path, unsigned seq)
  559. {
  560. return __legitimize_path(path, seq, nd->m_seq);
  561. }
  562. static bool legitimize_links(struct nameidata *nd)
  563. {
  564. int i;
  565. for (i = 0; i < nd->depth; i++) {
  566. struct saved *last = nd->stack + i;
  567. if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
  568. drop_links(nd);
  569. nd->depth = i + 1;
  570. return false;
  571. }
  572. }
  573. return true;
  574. }
  575. static bool legitimize_root(struct nameidata *nd)
  576. {
  577. /*
  578. * For scoped-lookups (where nd->root has been zeroed), we need to
  579. * restart the whole lookup from scratch -- because set_root() is wrong
  580. * for these lookups (nd->dfd is the root, not the filesystem root).
  581. */
  582. if (!nd->root.mnt && (nd->flags & LOOKUP_IS_SCOPED))
  583. return false;
  584. /* Nothing to do if nd->root is zero or is managed by the VFS user. */
  585. if (!nd->root.mnt || (nd->flags & LOOKUP_ROOT))
  586. return true;
  587. nd->flags |= LOOKUP_ROOT_GRABBED;
  588. return legitimize_path(nd, &nd->root, nd->root_seq);
  589. }
  590. /*
  591. * Path walking has 2 modes, rcu-walk and ref-walk (see
  592. * Documentation/filesystems/path-lookup.txt). In situations when we can't
  593. * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
  594. * normal reference counts on dentries and vfsmounts to transition to ref-walk
  595. * mode. Refcounts are grabbed at the last known good point before rcu-walk
  596. * got stuck, so ref-walk may continue from there. If this is not successful
  597. * (eg. a seqcount has changed), then failure is returned and it's up to caller
  598. * to restart the path walk from the beginning in ref-walk mode.
  599. */
  600. /**
  601. * try_to_unlazy - try to switch to ref-walk mode.
  602. * @nd: nameidata pathwalk data
  603. * Returns: true on success, false on failure
  604. *
  605. * try_to_unlazy attempts to legitimize the current nd->path and nd->root
  606. * for ref-walk mode.
  607. * Must be called from rcu-walk context.
  608. * Nothing should touch nameidata between try_to_unlazy() failure and
  609. * terminate_walk().
  610. */
  611. static bool try_to_unlazy(struct nameidata *nd)
  612. {
  613. struct dentry *parent = nd->path.dentry;
  614. BUG_ON(!(nd->flags & LOOKUP_RCU));
  615. nd->flags &= ~LOOKUP_RCU;
  616. if (unlikely(!legitimize_links(nd)))
  617. goto out1;
  618. if (unlikely(!legitimize_path(nd, &nd->path, nd->seq)))
  619. goto out;
  620. if (unlikely(!legitimize_root(nd)))
  621. goto out;
  622. rcu_read_unlock();
  623. BUG_ON(nd->inode != parent->d_inode);
  624. return true;
  625. out1:
  626. nd->path.mnt = NULL;
  627. nd->path.dentry = NULL;
  628. out:
  629. rcu_read_unlock();
  630. return false;
  631. }
  632. /**
  633. * unlazy_child - try to switch to ref-walk mode.
  634. * @nd: nameidata pathwalk data
  635. * @dentry: child of nd->path.dentry
  636. * @seq: seq number to check dentry against
  637. * Returns: 0 on success, -ECHILD on failure
  638. *
  639. * unlazy_child attempts to legitimize the current nd->path, nd->root and dentry
  640. * for ref-walk mode. @dentry must be a path found by a do_lookup call on
  641. * @nd. Must be called from rcu-walk context.
  642. * Nothing should touch nameidata between unlazy_child() failure and
  643. * terminate_walk().
  644. */
  645. static int unlazy_child(struct nameidata *nd, struct dentry *dentry, unsigned seq)
  646. {
  647. BUG_ON(!(nd->flags & LOOKUP_RCU));
  648. nd->flags &= ~LOOKUP_RCU;
  649. if (unlikely(!legitimize_links(nd)))
  650. goto out2;
  651. if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq)))
  652. goto out2;
  653. if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref)))
  654. goto out1;
  655. /*
  656. * We need to move both the parent and the dentry from the RCU domain
  657. * to be properly refcounted. And the sequence number in the dentry
  658. * validates *both* dentry counters, since we checked the sequence
  659. * number of the parent after we got the child sequence number. So we
  660. * know the parent must still be valid if the child sequence number is
  661. */
  662. if (unlikely(!lockref_get_not_dead(&dentry->d_lockref)))
  663. goto out;
  664. if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
  665. goto out_dput;
  666. /*
  667. * Sequence counts matched. Now make sure that the root is
  668. * still valid and get it if required.
  669. */
  670. if (unlikely(!legitimize_root(nd)))
  671. goto out_dput;
  672. rcu_read_unlock();
  673. return 0;
  674. out2:
  675. nd->path.mnt = NULL;
  676. out1:
  677. nd->path.dentry = NULL;
  678. out:
  679. rcu_read_unlock();
  680. return -ECHILD;
  681. out_dput:
  682. rcu_read_unlock();
  683. dput(dentry);
  684. return -ECHILD;
  685. }
  686. static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
  687. {
  688. if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
  689. return dentry->d_op->d_revalidate(dentry, flags);
  690. else
  691. return 1;
  692. }
  693. #define INIT_PATH_SIZE 64
  694. static void success_walk_trace(struct nameidata *nd)
  695. {
  696. struct path *pt = &nd->path;
  697. struct inode *i = nd->inode;
  698. char buf[INIT_PATH_SIZE], *try_buf;
  699. int cur_path_size;
  700. char *p;
  701. /* When eBPF/ tracepoint is disabled, keep overhead low. */
  702. if (!trace_inodepath_enabled())
  703. return;
  704. /* First try stack allocated buffer. */
  705. try_buf = buf;
  706. cur_path_size = INIT_PATH_SIZE;
  707. while (cur_path_size <= PATH_MAX) {
  708. /* Free previous heap allocation if we are now trying
  709. * a second or later heap allocation.
  710. */
  711. if (try_buf != buf)
  712. kfree(try_buf);
  713. /* All but the first alloc are on the heap. */
  714. if (cur_path_size != INIT_PATH_SIZE) {
  715. try_buf = kmalloc(cur_path_size, GFP_KERNEL);
  716. if (!try_buf) {
  717. try_buf = buf;
  718. sprintf(try_buf, "error:buf_alloc_failed");
  719. break;
  720. }
  721. }
  722. p = d_path(pt, try_buf, cur_path_size);
  723. if (!IS_ERR(p)) {
  724. char *end = mangle_path(try_buf, p, "\n");
  725. if (end) {
  726. try_buf[end - try_buf] = 0;
  727. break;
  728. } else {
  729. /* On mangle errors, double path size
  730. * till PATH_MAX.
  731. */
  732. cur_path_size = cur_path_size << 1;
  733. continue;
  734. }
  735. }
  736. if (PTR_ERR(p) == -ENAMETOOLONG) {
  737. /* If d_path complains that name is too long,
  738. * then double path size till PATH_MAX.
  739. */
  740. cur_path_size = cur_path_size << 1;
  741. continue;
  742. }
  743. sprintf(try_buf, "error:d_path_failed_%lu",
  744. -1 * PTR_ERR(p));
  745. break;
  746. }
  747. if (cur_path_size > PATH_MAX)
  748. sprintf(try_buf, "error:d_path_name_too_long");
  749. trace_inodepath(i, try_buf);
  750. if (try_buf != buf)
  751. kfree(try_buf);
  752. return;
  753. }
  754. /**
  755. * complete_walk - successful completion of path walk
  756. * @nd: pointer nameidata
  757. *
  758. * If we had been in RCU mode, drop out of it and legitimize nd->path.
  759. * Revalidate the final result, unless we'd already done that during
  760. * the path walk or the filesystem doesn't ask for it. Return 0 on
  761. * success, -error on failure. In case of failure caller does not
  762. * need to drop nd->path.
  763. */
  764. static int complete_walk(struct nameidata *nd)
  765. {
  766. struct dentry *dentry = nd->path.dentry;
  767. int status;
  768. if (nd->flags & LOOKUP_RCU) {
  769. /*
  770. * We don't want to zero nd->root for scoped-lookups or
  771. * externally-managed nd->root.
  772. */
  773. if (!(nd->flags & (LOOKUP_ROOT | LOOKUP_IS_SCOPED)))
  774. nd->root.mnt = NULL;
  775. if (!try_to_unlazy(nd))
  776. return -ECHILD;
  777. }
  778. if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
  779. /*
  780. * While the guarantee of LOOKUP_IS_SCOPED is (roughly) "don't
  781. * ever step outside the root during lookup" and should already
  782. * be guaranteed by the rest of namei, we want to avoid a namei
  783. * BUG resulting in userspace being given a path that was not
  784. * scoped within the root at some point during the lookup.
  785. *
  786. * So, do a final sanity-check to make sure that in the
  787. * worst-case scenario (a complete bypass of LOOKUP_IS_SCOPED)
  788. * we won't silently return an fd completely outside of the
  789. * requested root to userspace.
  790. *
  791. * Userspace could move the path outside the root after this
  792. * check, but as discussed elsewhere this is not a concern (the
  793. * resolved file was inside the root at some point).
  794. */
  795. if (!path_is_under(&nd->path, &nd->root))
  796. return -EXDEV;
  797. }
  798. if (likely(!(nd->flags & LOOKUP_JUMPED))) {
  799. success_walk_trace(nd);
  800. return 0;
  801. }
  802. if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE))) {
  803. success_walk_trace(nd);
  804. return 0;
  805. }
  806. status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
  807. if (status > 0) {
  808. success_walk_trace(nd);
  809. return 0;
  810. }
  811. if (!status)
  812. status = -ESTALE;
  813. return status;
  814. }
  815. static int set_root(struct nameidata *nd)
  816. {
  817. struct fs_struct *fs = current->fs;
  818. /*
  819. * Jumping to the real root in a scoped-lookup is a BUG in namei, but we
  820. * still have to ensure it doesn't happen because it will cause a breakout
  821. * from the dirfd.
  822. */
  823. if (WARN_ON(nd->flags & LOOKUP_IS_SCOPED))
  824. return -ENOTRECOVERABLE;
  825. if (nd->flags & LOOKUP_RCU) {
  826. unsigned seq;
  827. do {
  828. seq = read_seqcount_begin(&fs->seq);
  829. nd->root = fs->root;
  830. nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
  831. } while (read_seqcount_retry(&fs->seq, seq));
  832. } else {
  833. get_fs_root(fs, &nd->root);
  834. nd->flags |= LOOKUP_ROOT_GRABBED;
  835. }
  836. return 0;
  837. }
  838. static int nd_jump_root(struct nameidata *nd)
  839. {
  840. if (unlikely(nd->flags & LOOKUP_BENEATH))
  841. return -EXDEV;
  842. if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
  843. /* Absolute path arguments to path_init() are allowed. */
  844. if (nd->path.mnt != NULL && nd->path.mnt != nd->root.mnt)
  845. return -EXDEV;
  846. }
  847. if (!nd->root.mnt) {
  848. int error = set_root(nd);
  849. if (error)
  850. return error;
  851. }
  852. if (nd->flags & LOOKUP_RCU) {
  853. struct dentry *d;
  854. nd->path = nd->root;
  855. d = nd->path.dentry;
  856. nd->inode = d->d_inode;
  857. nd->seq = nd->root_seq;
  858. if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq)))
  859. return -ECHILD;
  860. } else {
  861. path_put(&nd->path);
  862. nd->path = nd->root;
  863. path_get(&nd->path);
  864. nd->inode = nd->path.dentry->d_inode;
  865. }
  866. nd->flags |= LOOKUP_JUMPED;
  867. return 0;
  868. }
  869. /*
  870. * Helper to directly jump to a known parsed path from ->get_link,
  871. * caller must have taken a reference to path beforehand.
  872. */
  873. int nd_jump_link(struct path *path)
  874. {
  875. int error = -ELOOP;
  876. struct nameidata *nd = current->nameidata;
  877. if (unlikely(nd->flags & LOOKUP_NO_MAGICLINKS))
  878. goto err;
  879. error = -EXDEV;
  880. if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
  881. if (nd->path.mnt != path->mnt)
  882. goto err;
  883. }
  884. /* Not currently safe for scoped-lookups. */
  885. if (unlikely(nd->flags & LOOKUP_IS_SCOPED))
  886. goto err;
  887. path_put(&nd->path);
  888. nd->path = *path;
  889. nd->inode = nd->path.dentry->d_inode;
  890. nd->flags |= LOOKUP_JUMPED;
  891. return 0;
  892. err:
  893. path_put(path);
  894. return error;
  895. }
  896. static inline void put_link(struct nameidata *nd)
  897. {
  898. struct saved *last = nd->stack + --nd->depth;
  899. do_delayed_call(&last->done);
  900. if (!(nd->flags & LOOKUP_RCU))
  901. path_put(&last->link);
  902. }
  903. int sysctl_protected_symlinks __read_mostly = 0;
  904. int sysctl_protected_hardlinks __read_mostly = 0;
  905. int sysctl_protected_fifos __read_mostly;
  906. int sysctl_protected_regular __read_mostly;
  907. /**
  908. * may_follow_link - Check symlink following for unsafe situations
  909. * @nd: nameidata pathwalk data
  910. *
  911. * In the case of the sysctl_protected_symlinks sysctl being enabled,
  912. * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
  913. * in a sticky world-writable directory. This is to protect privileged
  914. * processes from failing races against path names that may change out
  915. * from under them by way of other users creating malicious symlinks.
  916. * It will permit symlinks to be followed only when outside a sticky
  917. * world-writable directory, or when the uid of the symlink and follower
  918. * match, or when the directory owner matches the symlink's owner.
  919. *
  920. * Returns 0 if following the symlink is allowed, -ve on error.
  921. */
  922. static inline int may_follow_link(struct nameidata *nd, const struct inode *inode)
  923. {
  924. if (!sysctl_protected_symlinks)
  925. return 0;
  926. /* Allowed if owner and follower match. */
  927. if (uid_eq(current_cred()->fsuid, inode->i_uid))
  928. return 0;
  929. /* Allowed if parent directory not sticky and world-writable. */
  930. if ((nd->dir_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
  931. return 0;
  932. /* Allowed if parent directory and link owner match. */
  933. if (uid_valid(nd->dir_uid) && uid_eq(nd->dir_uid, inode->i_uid))
  934. return 0;
  935. if (nd->flags & LOOKUP_RCU)
  936. return -ECHILD;
  937. audit_inode(nd->name, nd->stack[0].link.dentry, 0);
  938. audit_log_path_denied(AUDIT_ANOM_LINK, "follow_link");
  939. return -EACCES;
  940. }
  941. /**
  942. * safe_hardlink_source - Check for safe hardlink conditions
  943. * @inode: the source inode to hardlink from
  944. *
  945. * Return false if at least one of the following conditions:
  946. * - inode is not a regular file
  947. * - inode is setuid
  948. * - inode is setgid and group-exec
  949. * - access failure for read and write
  950. *
  951. * Otherwise returns true.
  952. */
  953. static bool safe_hardlink_source(struct inode *inode)
  954. {
  955. umode_t mode = inode->i_mode;
  956. /* Special files should not get pinned to the filesystem. */
  957. if (!S_ISREG(mode))
  958. return false;
  959. /* Setuid files should not get pinned to the filesystem. */
  960. if (mode & S_ISUID)
  961. return false;
  962. /* Executable setgid files should not get pinned to the filesystem. */
  963. if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
  964. return false;
  965. /* Hardlinking to unreadable or unwritable sources is dangerous. */
  966. if (inode_permission(inode, MAY_READ | MAY_WRITE))
  967. return false;
  968. return true;
  969. }
  970. /**
  971. * may_linkat - Check permissions for creating a hardlink
  972. * @link: the source to hardlink from
  973. *
  974. * Block hardlink when all of:
  975. * - sysctl_protected_hardlinks enabled
  976. * - fsuid does not match inode
  977. * - hardlink source is unsafe (see safe_hardlink_source() above)
  978. * - not CAP_FOWNER in a namespace with the inode owner uid mapped
  979. *
  980. * Returns 0 if successful, -ve on error.
  981. */
  982. int may_linkat(struct path *link)
  983. {
  984. struct inode *inode = link->dentry->d_inode;
  985. /* Inode writeback is not safe when the uid or gid are invalid. */
  986. if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
  987. return -EOVERFLOW;
  988. if (!sysctl_protected_hardlinks)
  989. return 0;
  990. /* Source inode owner (or CAP_FOWNER) can hardlink all they like,
  991. * otherwise, it must be a safe source.
  992. */
  993. if (safe_hardlink_source(inode) || inode_owner_or_capable(inode))
  994. return 0;
  995. audit_log_path_denied(AUDIT_ANOM_LINK, "linkat");
  996. return -EPERM;
  997. }
  998. /**
  999. * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
  1000. * should be allowed, or not, on files that already
  1001. * exist.
  1002. * @dir_mode: mode bits of directory
  1003. * @dir_uid: owner of directory
  1004. * @inode: the inode of the file to open
  1005. *
  1006. * Block an O_CREAT open of a FIFO (or a regular file) when:
  1007. * - sysctl_protected_fifos (or sysctl_protected_regular) is enabled
  1008. * - the file already exists
  1009. * - we are in a sticky directory
  1010. * - we don't own the file
  1011. * - the owner of the directory doesn't own the file
  1012. * - the directory is world writable
  1013. * If the sysctl_protected_fifos (or sysctl_protected_regular) is set to 2
  1014. * the directory doesn't have to be world writable: being group writable will
  1015. * be enough.
  1016. *
  1017. * Returns 0 if the open is allowed, -ve on error.
  1018. */
  1019. static int may_create_in_sticky(umode_t dir_mode, kuid_t dir_uid,
  1020. struct inode * const inode)
  1021. {
  1022. if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
  1023. (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
  1024. likely(!(dir_mode & S_ISVTX)) ||
  1025. uid_eq(inode->i_uid, dir_uid) ||
  1026. uid_eq(current_fsuid(), inode->i_uid))
  1027. return 0;
  1028. if (likely(dir_mode & 0002) ||
  1029. (dir_mode & 0020 &&
  1030. ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
  1031. (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
  1032. const char *operation = S_ISFIFO(inode->i_mode) ?
  1033. "sticky_create_fifo" :
  1034. "sticky_create_regular";
  1035. audit_log_path_denied(AUDIT_ANOM_CREAT, operation);
  1036. return -EACCES;
  1037. }
  1038. return 0;
  1039. }
  1040. /*
  1041. * follow_up - Find the mountpoint of path's vfsmount
  1042. *
  1043. * Given a path, find the mountpoint of its source file system.
  1044. * Replace @path with the path of the mountpoint in the parent mount.
  1045. * Up is towards /.
  1046. *
  1047. * Return 1 if we went up a level and 0 if we were already at the
  1048. * root.
  1049. */
  1050. int follow_up(struct path *path)
  1051. {
  1052. struct mount *mnt = real_mount(path->mnt);
  1053. struct mount *parent;
  1054. struct dentry *mountpoint;
  1055. read_seqlock_excl(&mount_lock);
  1056. parent = mnt->mnt_parent;
  1057. if (parent == mnt) {
  1058. read_sequnlock_excl(&mount_lock);
  1059. return 0;
  1060. }
  1061. mntget(&parent->mnt);
  1062. mountpoint = dget(mnt->mnt_mountpoint);
  1063. read_sequnlock_excl(&mount_lock);
  1064. dput(path->dentry);
  1065. path->dentry = mountpoint;
  1066. mntput(path->mnt);
  1067. path->mnt = &parent->mnt;
  1068. return 1;
  1069. }
  1070. EXPORT_SYMBOL(follow_up);
  1071. static bool choose_mountpoint_rcu(struct mount *m, const struct path *root,
  1072. struct path *path, unsigned *seqp)
  1073. {
  1074. while (mnt_has_parent(m)) {
  1075. struct dentry *mountpoint = m->mnt_mountpoint;
  1076. m = m->mnt_parent;
  1077. if (unlikely(root->dentry == mountpoint &&
  1078. root->mnt == &m->mnt))
  1079. break;
  1080. if (mountpoint != m->mnt.mnt_root) {
  1081. path->mnt = &m->mnt;
  1082. path->dentry = mountpoint;
  1083. *seqp = read_seqcount_begin(&mountpoint->d_seq);
  1084. return true;
  1085. }
  1086. }
  1087. return false;
  1088. }
  1089. static bool choose_mountpoint(struct mount *m, const struct path *root,
  1090. struct path *path)
  1091. {
  1092. bool found;
  1093. rcu_read_lock();
  1094. while (1) {
  1095. unsigned seq, mseq = read_seqbegin(&mount_lock);
  1096. found = choose_mountpoint_rcu(m, root, path, &seq);
  1097. if (unlikely(!found)) {
  1098. if (!read_seqretry(&mount_lock, mseq))
  1099. break;
  1100. } else {
  1101. if (likely(__legitimize_path(path, seq, mseq)))
  1102. break;
  1103. rcu_read_unlock();
  1104. path_put(path);
  1105. rcu_read_lock();
  1106. }
  1107. }
  1108. rcu_read_unlock();
  1109. return found;
  1110. }
  1111. /*
  1112. * Perform an automount
  1113. * - return -EISDIR to tell follow_managed() to stop and return the path we
  1114. * were called with.
  1115. */
  1116. static int follow_automount(struct path *path, int *count, unsigned lookup_flags)
  1117. {
  1118. struct dentry *dentry = path->dentry;
  1119. /* We don't want to mount if someone's just doing a stat -
  1120. * unless they're stat'ing a directory and appended a '/' to
  1121. * the name.
  1122. *
  1123. * We do, however, want to mount if someone wants to open or
  1124. * create a file of any type under the mountpoint, wants to
  1125. * traverse through the mountpoint or wants to open the
  1126. * mounted directory. Also, autofs may mark negative dentries
  1127. * as being automount points. These will need the attentions
  1128. * of the daemon to instantiate them before they can be used.
  1129. */
  1130. if (!(lookup_flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
  1131. LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
  1132. dentry->d_inode)
  1133. return -EISDIR;
  1134. if (count && (*count)++ >= MAXSYMLINKS)
  1135. return -ELOOP;
  1136. return finish_automount(dentry->d_op->d_automount(path), path);
  1137. }
  1138. /*
  1139. * mount traversal - out-of-line part. One note on ->d_flags accesses -
  1140. * dentries are pinned but not locked here, so negative dentry can go
  1141. * positive right under us. Use of smp_load_acquire() provides a barrier
  1142. * sufficient for ->d_inode and ->d_flags consistency.
  1143. */
  1144. static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped,
  1145. int *count, unsigned lookup_flags)
  1146. {
  1147. struct vfsmount *mnt = path->mnt;
  1148. bool need_mntput = false;
  1149. int ret = 0;
  1150. while (flags & DCACHE_MANAGED_DENTRY) {
  1151. /* Allow the filesystem to manage the transit without i_mutex
  1152. * being held. */
  1153. if (flags & DCACHE_MANAGE_TRANSIT) {
  1154. ret = path->dentry->d_op->d_manage(path, false);
  1155. flags = smp_load_acquire(&path->dentry->d_flags);
  1156. if (ret < 0)
  1157. break;
  1158. }
  1159. if (flags & DCACHE_MOUNTED) { // something's mounted on it..
  1160. struct vfsmount *mounted = lookup_mnt(path);
  1161. if (mounted) { // ... in our namespace
  1162. dput(path->dentry);
  1163. if (need_mntput)
  1164. mntput(path->mnt);
  1165. path->mnt = mounted;
  1166. path->dentry = dget(mounted->mnt_root);
  1167. // here we know it's positive
  1168. flags = path->dentry->d_flags;
  1169. need_mntput = true;
  1170. continue;
  1171. }
  1172. }
  1173. if (!(flags & DCACHE_NEED_AUTOMOUNT))
  1174. break;
  1175. // uncovered automount point
  1176. ret = follow_automount(path, count, lookup_flags);
  1177. flags = smp_load_acquire(&path->dentry->d_flags);
  1178. if (ret < 0)
  1179. break;
  1180. }
  1181. if (ret == -EISDIR)
  1182. ret = 0;
  1183. // possible if you race with several mount --move
  1184. if (need_mntput && path->mnt == mnt)
  1185. mntput(path->mnt);
  1186. if (!ret && unlikely(d_flags_negative(flags)))
  1187. ret = -ENOENT;
  1188. *jumped = need_mntput;
  1189. return ret;
  1190. }
  1191. static inline int traverse_mounts(struct path *path, bool *jumped,
  1192. int *count, unsigned lookup_flags)
  1193. {
  1194. unsigned flags = smp_load_acquire(&path->dentry->d_flags);
  1195. /* fastpath */
  1196. if (likely(!(flags & DCACHE_MANAGED_DENTRY))) {
  1197. *jumped = false;
  1198. if (unlikely(d_flags_negative(flags)))
  1199. return -ENOENT;
  1200. return 0;
  1201. }
  1202. return __traverse_mounts(path, flags, jumped, count, lookup_flags);
  1203. }
  1204. int follow_down_one(struct path *path)
  1205. {
  1206. struct vfsmount *mounted;
  1207. mounted = lookup_mnt(path);
  1208. if (mounted) {
  1209. dput(path->dentry);
  1210. mntput(path->mnt);
  1211. path->mnt = mounted;
  1212. path->dentry = dget(mounted->mnt_root);
  1213. return 1;
  1214. }
  1215. return 0;
  1216. }
  1217. EXPORT_SYMBOL(follow_down_one);
  1218. /*
  1219. * Follow down to the covering mount currently visible to userspace. At each
  1220. * point, the filesystem owning that dentry may be queried as to whether the
  1221. * caller is permitted to proceed or not.
  1222. */
  1223. int follow_down(struct path *path)
  1224. {
  1225. struct vfsmount *mnt = path->mnt;
  1226. bool jumped;
  1227. int ret = traverse_mounts(path, &jumped, NULL, 0);
  1228. if (path->mnt != mnt)
  1229. mntput(mnt);
  1230. return ret;
  1231. }
  1232. EXPORT_SYMBOL(follow_down);
  1233. /*
  1234. * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if
  1235. * we meet a managed dentry that would need blocking.
  1236. */
  1237. static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
  1238. struct inode **inode, unsigned *seqp)
  1239. {
  1240. struct dentry *dentry = path->dentry;
  1241. unsigned int flags = dentry->d_flags;
  1242. if (likely(!(flags & DCACHE_MANAGED_DENTRY)))
  1243. return true;
  1244. if (unlikely(nd->flags & LOOKUP_NO_XDEV))
  1245. return false;
  1246. for (;;) {
  1247. /*
  1248. * Don't forget we might have a non-mountpoint managed dentry
  1249. * that wants to block transit.
  1250. */
  1251. if (unlikely(flags & DCACHE_MANAGE_TRANSIT)) {
  1252. int res = dentry->d_op->d_manage(path, true);
  1253. if (res)
  1254. return res == -EISDIR;
  1255. flags = dentry->d_flags;
  1256. }
  1257. if (flags & DCACHE_MOUNTED) {
  1258. struct mount *mounted = __lookup_mnt(path->mnt, dentry);
  1259. if (mounted) {
  1260. path->mnt = &mounted->mnt;
  1261. dentry = path->dentry = mounted->mnt.mnt_root;
  1262. nd->flags |= LOOKUP_JUMPED;
  1263. *seqp = read_seqcount_begin(&dentry->d_seq);
  1264. *inode = dentry->d_inode;
  1265. /*
  1266. * We don't need to re-check ->d_seq after this
  1267. * ->d_inode read - there will be an RCU delay
  1268. * between mount hash removal and ->mnt_root
  1269. * becoming unpinned.
  1270. */
  1271. flags = dentry->d_flags;
  1272. continue;
  1273. }
  1274. if (read_seqretry(&mount_lock, nd->m_seq))
  1275. return false;
  1276. }
  1277. return !(flags & DCACHE_NEED_AUTOMOUNT);
  1278. }
  1279. }
  1280. static inline int handle_mounts(struct nameidata *nd, struct dentry *dentry,
  1281. struct path *path, struct inode **inode,
  1282. unsigned int *seqp)
  1283. {
  1284. bool jumped;
  1285. int ret;
  1286. path->mnt = nd->path.mnt;
  1287. path->dentry = dentry;
  1288. if (nd->flags & LOOKUP_RCU) {
  1289. unsigned int seq = *seqp;
  1290. if (unlikely(!*inode))
  1291. return -ENOENT;
  1292. if (likely(__follow_mount_rcu(nd, path, inode, seqp)))
  1293. return 0;
  1294. if (unlazy_child(nd, dentry, seq))
  1295. return -ECHILD;
  1296. // *path might've been clobbered by __follow_mount_rcu()
  1297. path->mnt = nd->path.mnt;
  1298. path->dentry = dentry;
  1299. }
  1300. ret = traverse_mounts(path, &jumped, &nd->total_link_count, nd->flags);
  1301. if (jumped) {
  1302. if (unlikely(nd->flags & LOOKUP_NO_XDEV))
  1303. ret = -EXDEV;
  1304. else
  1305. nd->flags |= LOOKUP_JUMPED;
  1306. }
  1307. if (unlikely(ret)) {
  1308. dput(path->dentry);
  1309. if (path->mnt != nd->path.mnt)
  1310. mntput(path->mnt);
  1311. } else {
  1312. *inode = d_backing_inode(path->dentry);
  1313. *seqp = 0; /* out of RCU mode, so the value doesn't matter */
  1314. }
  1315. return ret;
  1316. }
  1317. /*
  1318. * This looks up the name in dcache and possibly revalidates the found dentry.
  1319. * NULL is returned if the dentry does not exist in the cache.
  1320. */
  1321. static struct dentry *lookup_dcache(const struct qstr *name,
  1322. struct dentry *dir,
  1323. unsigned int flags)
  1324. {
  1325. struct dentry *dentry = d_lookup(dir, name);
  1326. if (dentry) {
  1327. int error = d_revalidate(dentry, flags);
  1328. if (unlikely(error <= 0)) {
  1329. if (!error)
  1330. d_invalidate(dentry);
  1331. dput(dentry);
  1332. return ERR_PTR(error);
  1333. }
  1334. }
  1335. return dentry;
  1336. }
  1337. /*
  1338. * Parent directory has inode locked exclusive. This is one
  1339. * and only case when ->lookup() gets called on non in-lookup
  1340. * dentries - as the matter of fact, this only gets called
  1341. * when directory is guaranteed to have no in-lookup children
  1342. * at all.
  1343. */
  1344. static struct dentry *__lookup_hash(const struct qstr *name,
  1345. struct dentry *base, unsigned int flags)
  1346. {
  1347. struct dentry *dentry = lookup_dcache(name, base, flags);
  1348. struct dentry *old;
  1349. struct inode *dir = base->d_inode;
  1350. if (dentry)
  1351. return dentry;
  1352. /* Don't create child dentry for a dead directory. */
  1353. if (unlikely(IS_DEADDIR(dir)))
  1354. return ERR_PTR(-ENOENT);
  1355. dentry = d_alloc(base, name);
  1356. if (unlikely(!dentry))
  1357. return ERR_PTR(-ENOMEM);
  1358. old = dir->i_op->lookup(dir, dentry, flags);
  1359. if (unlikely(old)) {
  1360. dput(dentry);
  1361. dentry = old;
  1362. }
  1363. return dentry;
  1364. }
  1365. static struct dentry *lookup_fast(struct nameidata *nd,
  1366. struct inode **inode,
  1367. unsigned *seqp)
  1368. {
  1369. struct dentry *dentry, *parent = nd->path.dentry;
  1370. int status = 1;
  1371. /*
  1372. * Rename seqlock is not required here because in the off chance
  1373. * of a false negative due to a concurrent rename, the caller is
  1374. * going to fall back to non-racy lookup.
  1375. */
  1376. if (nd->flags & LOOKUP_RCU) {
  1377. unsigned seq;
  1378. dentry = __d_lookup_rcu(parent, &nd->last, &seq);
  1379. if (unlikely(!dentry)) {
  1380. if (!try_to_unlazy(nd))
  1381. return ERR_PTR(-ECHILD);
  1382. return NULL;
  1383. }
  1384. /*
  1385. * This sequence count validates that the inode matches
  1386. * the dentry name information from lookup.
  1387. */
  1388. *inode = d_backing_inode(dentry);
  1389. if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
  1390. return ERR_PTR(-ECHILD);
  1391. /*
  1392. * This sequence count validates that the parent had no
  1393. * changes while we did the lookup of the dentry above.
  1394. *
  1395. * The memory barrier in read_seqcount_begin of child is
  1396. * enough, we can use __read_seqcount_retry here.
  1397. */
  1398. if (unlikely(__read_seqcount_retry(&parent->d_seq, nd->seq)))
  1399. return ERR_PTR(-ECHILD);
  1400. *seqp = seq;
  1401. status = d_revalidate(dentry, nd->flags);
  1402. if (likely(status > 0))
  1403. return dentry;
  1404. if (unlazy_child(nd, dentry, seq))
  1405. return ERR_PTR(-ECHILD);
  1406. if (unlikely(status == -ECHILD))
  1407. /* we'd been told to redo it in non-rcu mode */
  1408. status = d_revalidate(dentry, nd->flags);
  1409. } else {
  1410. dentry = __d_lookup(parent, &nd->last);
  1411. if (unlikely(!dentry))
  1412. return NULL;
  1413. status = d_revalidate(dentry, nd->flags);
  1414. }
  1415. if (unlikely(status <= 0)) {
  1416. if (!status)
  1417. d_invalidate(dentry);
  1418. dput(dentry);
  1419. return ERR_PTR(status);
  1420. }
  1421. return dentry;
  1422. }
  1423. /* Fast lookup failed, do it the slow way */
  1424. static struct dentry *__lookup_slow(const struct qstr *name,
  1425. struct dentry *dir,
  1426. unsigned int flags)
  1427. {
  1428. struct dentry *dentry, *old;
  1429. struct inode *inode = dir->d_inode;
  1430. DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
  1431. /* Don't go there if it's already dead */
  1432. if (unlikely(IS_DEADDIR(inode)))
  1433. return ERR_PTR(-ENOENT);
  1434. again:
  1435. dentry = d_alloc_parallel(dir, name, &wq);
  1436. if (IS_ERR(dentry))
  1437. return dentry;
  1438. if (unlikely(!d_in_lookup(dentry))) {
  1439. int error = d_revalidate(dentry, flags);
  1440. if (unlikely(error <= 0)) {
  1441. if (!error) {
  1442. d_invalidate(dentry);
  1443. dput(dentry);
  1444. goto again;
  1445. }
  1446. dput(dentry);
  1447. dentry = ERR_PTR(error);
  1448. }
  1449. } else {
  1450. old = inode->i_op->lookup(inode, dentry, flags);
  1451. d_lookup_done(dentry);
  1452. if (unlikely(old)) {
  1453. dput(dentry);
  1454. dentry = old;
  1455. }
  1456. }
  1457. return dentry;
  1458. }
  1459. static struct dentry *lookup_slow(const struct qstr *name,
  1460. struct dentry *dir,
  1461. unsigned int flags)
  1462. {
  1463. struct inode *inode = dir->d_inode;
  1464. struct dentry *res;
  1465. inode_lock_shared(inode);
  1466. res = __lookup_slow(name, dir, flags);
  1467. inode_unlock_shared(inode);
  1468. return res;
  1469. }
  1470. static inline int may_lookup(struct nameidata *nd)
  1471. {
  1472. if (nd->flags & LOOKUP_RCU) {
  1473. int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
  1474. if (err != -ECHILD || !try_to_unlazy(nd))
  1475. return err;
  1476. }
  1477. return inode_permission(nd->inode, MAY_EXEC);
  1478. }
  1479. static int reserve_stack(struct nameidata *nd, struct path *link, unsigned seq)
  1480. {
  1481. if (unlikely(nd->total_link_count++ >= MAXSYMLINKS))
  1482. return -ELOOP;
  1483. if (likely(nd->depth != EMBEDDED_LEVELS))
  1484. return 0;
  1485. if (likely(nd->stack != nd->internal))
  1486. return 0;
  1487. if (likely(nd_alloc_stack(nd)))
  1488. return 0;
  1489. if (nd->flags & LOOKUP_RCU) {
  1490. // we need to grab link before we do unlazy. And we can't skip
  1491. // unlazy even if we fail to grab the link - cleanup needs it
  1492. bool grabbed_link = legitimize_path(nd, link, seq);
  1493. if (!try_to_unlazy(nd) != 0 || !grabbed_link)
  1494. return -ECHILD;
  1495. if (nd_alloc_stack(nd))
  1496. return 0;
  1497. }
  1498. return -ENOMEM;
  1499. }
  1500. enum {WALK_TRAILING = 1, WALK_MORE = 2, WALK_NOFOLLOW = 4};
  1501. static const char *pick_link(struct nameidata *nd, struct path *link,
  1502. struct inode *inode, unsigned seq, int flags)
  1503. {
  1504. struct saved *last;
  1505. const char *res;
  1506. int error = reserve_stack(nd, link, seq);
  1507. if (unlikely(error)) {
  1508. if (!(nd->flags & LOOKUP_RCU))
  1509. path_put(link);
  1510. return ERR_PTR(error);
  1511. }
  1512. last = nd->stack + nd->depth++;
  1513. last->link = *link;
  1514. clear_delayed_call(&last->done);
  1515. last->seq = seq;
  1516. if (flags & WALK_TRAILING) {
  1517. error = may_follow_link(nd, inode);
  1518. if (unlikely(error))
  1519. return ERR_PTR(error);
  1520. }
  1521. if (unlikely(nd->flags & LOOKUP_NO_SYMLINKS) ||
  1522. unlikely(link->mnt->mnt_flags & MNT_NOSYMFOLLOW))
  1523. return ERR_PTR(-ELOOP);
  1524. if (!(nd->flags & LOOKUP_RCU)) {
  1525. touch_atime(&last->link);
  1526. cond_resched();
  1527. } else if (atime_needs_update(&last->link, inode)) {
  1528. if (!try_to_unlazy(nd))
  1529. return ERR_PTR(-ECHILD);
  1530. touch_atime(&last->link);
  1531. }
  1532. error = security_inode_follow_link(link->dentry, inode,
  1533. nd->flags & LOOKUP_RCU);
  1534. if (unlikely(error))
  1535. return ERR_PTR(error);
  1536. res = READ_ONCE(inode->i_link);
  1537. if (!res) {
  1538. const char * (*get)(struct dentry *, struct inode *,
  1539. struct delayed_call *);
  1540. get = inode->i_op->get_link;
  1541. if (nd->flags & LOOKUP_RCU) {
  1542. res = get(NULL, inode, &last->done);
  1543. if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd))
  1544. res = get(link->dentry, inode, &last->done);
  1545. } else {
  1546. res = get(link->dentry, inode, &last->done);
  1547. }
  1548. if (!res)
  1549. goto all_done;
  1550. if (IS_ERR(res))
  1551. return res;
  1552. }
  1553. if (*res == '/') {
  1554. error = nd_jump_root(nd);
  1555. if (unlikely(error))
  1556. return ERR_PTR(error);
  1557. while (unlikely(*++res == '/'))
  1558. ;
  1559. }
  1560. if (*res)
  1561. return res;
  1562. all_done: // pure jump
  1563. put_link(nd);
  1564. return NULL;
  1565. }
  1566. /*
  1567. * Do we need to follow links? We _really_ want to be able
  1568. * to do this check without having to look at inode->i_op,
  1569. * so we keep a cache of "no, this doesn't need follow_link"
  1570. * for the common case.
  1571. */
  1572. static const char *step_into(struct nameidata *nd, int flags,
  1573. struct dentry *dentry, struct inode *inode, unsigned seq)
  1574. {
  1575. struct path path;
  1576. int err = handle_mounts(nd, dentry, &path, &inode, &seq);
  1577. if (err < 0)
  1578. return ERR_PTR(err);
  1579. if (likely(!d_is_symlink(path.dentry)) ||
  1580. ((flags & WALK_TRAILING) && !(nd->flags & LOOKUP_FOLLOW)) ||
  1581. (flags & WALK_NOFOLLOW)) {
  1582. /* not a symlink or should not follow */
  1583. if (!(nd->flags & LOOKUP_RCU)) {
  1584. dput(nd->path.dentry);
  1585. if (nd->path.mnt != path.mnt)
  1586. mntput(nd->path.mnt);
  1587. }
  1588. nd->path = path;
  1589. nd->inode = inode;
  1590. nd->seq = seq;
  1591. return NULL;
  1592. }
  1593. if (nd->flags & LOOKUP_RCU) {
  1594. /* make sure that d_is_symlink above matches inode */
  1595. if (read_seqcount_retry(&path.dentry->d_seq, seq))
  1596. return ERR_PTR(-ECHILD);
  1597. } else {
  1598. if (path.mnt == nd->path.mnt)
  1599. mntget(path.mnt);
  1600. }
  1601. return pick_link(nd, &path, inode, seq, flags);
  1602. }
  1603. static struct dentry *follow_dotdot_rcu(struct nameidata *nd,
  1604. struct inode **inodep,
  1605. unsigned *seqp)
  1606. {
  1607. struct dentry *parent, *old;
  1608. if (path_equal(&nd->path, &nd->root))
  1609. goto in_root;
  1610. if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
  1611. struct path path;
  1612. unsigned seq;
  1613. if (!choose_mountpoint_rcu(real_mount(nd->path.mnt),
  1614. &nd->root, &path, &seq))
  1615. goto in_root;
  1616. if (unlikely(nd->flags & LOOKUP_NO_XDEV))
  1617. return ERR_PTR(-ECHILD);
  1618. nd->path = path;
  1619. nd->inode = path.dentry->d_inode;
  1620. nd->seq = seq;
  1621. if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
  1622. return ERR_PTR(-ECHILD);
  1623. /* we know that mountpoint was pinned */
  1624. }
  1625. old = nd->path.dentry;
  1626. parent = old->d_parent;
  1627. *inodep = parent->d_inode;
  1628. *seqp = read_seqcount_begin(&parent->d_seq);
  1629. if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq)))
  1630. return ERR_PTR(-ECHILD);
  1631. if (unlikely(!path_connected(nd->path.mnt, parent)))
  1632. return ERR_PTR(-ECHILD);
  1633. return parent;
  1634. in_root:
  1635. if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
  1636. return ERR_PTR(-ECHILD);
  1637. if (unlikely(nd->flags & LOOKUP_BENEATH))
  1638. return ERR_PTR(-ECHILD);
  1639. return NULL;
  1640. }
  1641. static struct dentry *follow_dotdot(struct nameidata *nd,
  1642. struct inode **inodep,
  1643. unsigned *seqp)
  1644. {
  1645. struct dentry *parent;
  1646. if (path_equal(&nd->path, &nd->root))
  1647. goto in_root;
  1648. if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
  1649. struct path path;
  1650. if (!choose_mountpoint(real_mount(nd->path.mnt),
  1651. &nd->root, &path))
  1652. goto in_root;
  1653. path_put(&nd->path);
  1654. nd->path = path;
  1655. nd->inode = path.dentry->d_inode;
  1656. if (unlikely(nd->flags & LOOKUP_NO_XDEV))
  1657. return ERR_PTR(-EXDEV);
  1658. }
  1659. /* rare case of legitimate dget_parent()... */
  1660. parent = dget_parent(nd->path.dentry);
  1661. if (unlikely(!path_connected(nd->path.mnt, parent))) {
  1662. dput(parent);
  1663. return ERR_PTR(-ENOENT);
  1664. }
  1665. *seqp = 0;
  1666. *inodep = parent->d_inode;
  1667. return parent;
  1668. in_root:
  1669. if (unlikely(nd->flags & LOOKUP_BENEATH))
  1670. return ERR_PTR(-EXDEV);
  1671. dget(nd->path.dentry);
  1672. return NULL;
  1673. }
  1674. static const char *handle_dots(struct nameidata *nd, int type)
  1675. {
  1676. if (type == LAST_DOTDOT) {
  1677. const char *error = NULL;
  1678. struct dentry *parent;
  1679. struct inode *inode;
  1680. unsigned seq;
  1681. if (!nd->root.mnt) {
  1682. error = ERR_PTR(set_root(nd));
  1683. if (error)
  1684. return error;
  1685. }
  1686. if (nd->flags & LOOKUP_RCU)
  1687. parent = follow_dotdot_rcu(nd, &inode, &seq);
  1688. else
  1689. parent = follow_dotdot(nd, &inode, &seq);
  1690. if (IS_ERR(parent))
  1691. return ERR_CAST(parent);
  1692. if (unlikely(!parent))
  1693. error = step_into(nd, WALK_NOFOLLOW,
  1694. nd->path.dentry, nd->inode, nd->seq);
  1695. else
  1696. error = step_into(nd, WALK_NOFOLLOW,
  1697. parent, inode, seq);
  1698. if (unlikely(error))
  1699. return error;
  1700. if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
  1701. /*
  1702. * If there was a racing rename or mount along our
  1703. * path, then we can't be sure that ".." hasn't jumped
  1704. * above nd->root (and so userspace should retry or use
  1705. * some fallback).
  1706. */
  1707. smp_rmb();
  1708. if (unlikely(__read_seqcount_retry(&mount_lock.seqcount, nd->m_seq)))
  1709. return ERR_PTR(-EAGAIN);
  1710. if (unlikely(__read_seqcount_retry(&rename_lock.seqcount, nd->r_seq)))
  1711. return ERR_PTR(-EAGAIN);
  1712. }
  1713. }
  1714. return NULL;
  1715. }
  1716. static const char *walk_component(struct nameidata *nd, int flags)
  1717. {
  1718. struct dentry *dentry;
  1719. struct inode *inode;
  1720. unsigned seq;
  1721. /*
  1722. * "." and ".." are special - ".." especially so because it has
  1723. * to be able to know about the current root directory and
  1724. * parent relationships.
  1725. */
  1726. if (unlikely(nd->last_type != LAST_NORM)) {
  1727. if (!(flags & WALK_MORE) && nd->depth)
  1728. put_link(nd);
  1729. return handle_dots(nd, nd->last_type);
  1730. }
  1731. dentry = lookup_fast(nd, &inode, &seq);
  1732. if (IS_ERR(dentry))
  1733. return ERR_CAST(dentry);
  1734. if (unlikely(!dentry)) {
  1735. dentry = lookup_slow(&nd->last, nd->path.dentry, nd->flags);
  1736. if (IS_ERR(dentry))
  1737. return ERR_CAST(dentry);
  1738. }
  1739. if (!(flags & WALK_MORE) && nd->depth)
  1740. put_link(nd);
  1741. return step_into(nd, flags, dentry, inode, seq);
  1742. }
  1743. /*
  1744. * We can do the critical dentry name comparison and hashing
  1745. * operations one word at a time, but we are limited to:
  1746. *
  1747. * - Architectures with fast unaligned word accesses. We could
  1748. * do a "get_unaligned()" if this helps and is sufficiently
  1749. * fast.
  1750. *
  1751. * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
  1752. * do not trap on the (extremely unlikely) case of a page
  1753. * crossing operation.
  1754. *
  1755. * - Furthermore, we need an efficient 64-bit compile for the
  1756. * 64-bit case in order to generate the "number of bytes in
  1757. * the final mask". Again, that could be replaced with a
  1758. * efficient population count instruction or similar.
  1759. */
  1760. #ifdef CONFIG_DCACHE_WORD_ACCESS
  1761. #include <asm/word-at-a-time.h>
  1762. #ifdef HASH_MIX
  1763. /* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */
  1764. #elif defined(CONFIG_64BIT)
  1765. /*
  1766. * Register pressure in the mixing function is an issue, particularly
  1767. * on 32-bit x86, but almost any function requires one state value and
  1768. * one temporary. Instead, use a function designed for two state values
  1769. * and no temporaries.
  1770. *
  1771. * This function cannot create a collision in only two iterations, so
  1772. * we have two iterations to achieve avalanche. In those two iterations,
  1773. * we have six layers of mixing, which is enough to spread one bit's
  1774. * influence out to 2^6 = 64 state bits.
  1775. *
  1776. * Rotate constants are scored by considering either 64 one-bit input
  1777. * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the
  1778. * probability of that delta causing a change to each of the 128 output
  1779. * bits, using a sample of random initial states.
  1780. *
  1781. * The Shannon entropy of the computed probabilities is then summed
  1782. * to produce a score. Ideally, any input change has a 50% chance of
  1783. * toggling any given output bit.
  1784. *
  1785. * Mixing scores (in bits) for (12,45):
  1786. * Input delta: 1-bit 2-bit
  1787. * 1 round: 713.3 42542.6
  1788. * 2 rounds: 2753.7 140389.8
  1789. * 3 rounds: 5954.1 233458.2
  1790. * 4 rounds: 7862.6 256672.2
  1791. * Perfect: 8192 258048
  1792. * (64*128) (64*63/2 * 128)
  1793. */
  1794. #define HASH_MIX(x, y, a) \
  1795. ( x ^= (a), \
  1796. y ^= x, x = rol64(x,12),\
  1797. x += y, y = rol64(y,45),\
  1798. y *= 9 )
  1799. /*
  1800. * Fold two longs into one 32-bit hash value. This must be fast, but
  1801. * latency isn't quite as critical, as there is a fair bit of additional
  1802. * work done before the hash value is used.
  1803. */
  1804. static inline unsigned int fold_hash(unsigned long x, unsigned long y)
  1805. {
  1806. y ^= x * GOLDEN_RATIO_64;
  1807. y *= GOLDEN_RATIO_64;
  1808. return y >> 32;
  1809. }
  1810. #else /* 32-bit case */
  1811. /*
  1812. * Mixing scores (in bits) for (7,20):
  1813. * Input delta: 1-bit 2-bit
  1814. * 1 round: 330.3 9201.6
  1815. * 2 rounds: 1246.4 25475.4
  1816. * 3 rounds: 1907.1 31295.1
  1817. * 4 rounds: 2042.3 31718.6
  1818. * Perfect: 2048 31744
  1819. * (32*64) (32*31/2 * 64)
  1820. */
  1821. #define HASH_MIX(x, y, a) \
  1822. ( x ^= (a), \
  1823. y ^= x, x = rol32(x, 7),\
  1824. x += y, y = rol32(y,20),\
  1825. y *= 9 )
  1826. static inline unsigned int fold_hash(unsigned long x, unsigned long y)
  1827. {
  1828. /* Use arch-optimized multiply if one exists */
  1829. return __hash_32(y ^ __hash_32(x));
  1830. }
  1831. #endif
  1832. /*
  1833. * Return the hash of a string of known length. This is carfully
  1834. * designed to match hash_name(), which is the more critical function.
  1835. * In particular, we must end by hashing a final word containing 0..7
  1836. * payload bytes, to match the way that hash_name() iterates until it
  1837. * finds the delimiter after the name.
  1838. */
  1839. unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
  1840. {
  1841. unsigned long a, x = 0, y = (unsigned long)salt;
  1842. for (;;) {
  1843. if (!len)
  1844. goto done;
  1845. a = load_unaligned_zeropad(name);
  1846. if (len < sizeof(unsigned long))
  1847. break;
  1848. HASH_MIX(x, y, a);
  1849. name += sizeof(unsigned long);
  1850. len -= sizeof(unsigned long);
  1851. }
  1852. x ^= a & bytemask_from_count(len);
  1853. done:
  1854. return fold_hash(x, y);
  1855. }
  1856. EXPORT_SYMBOL(full_name_hash);
  1857. /* Return the "hash_len" (hash and length) of a null-terminated string */
  1858. u64 hashlen_string(const void *salt, const char *name)
  1859. {
  1860. unsigned long a = 0, x = 0, y = (unsigned long)salt;
  1861. unsigned long adata, mask, len;
  1862. const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
  1863. len = 0;
  1864. goto inside;
  1865. do {
  1866. HASH_MIX(x, y, a);
  1867. len += sizeof(unsigned long);
  1868. inside:
  1869. a = load_unaligned_zeropad(name+len);
  1870. } while (!has_zero(a, &adata, &constants));
  1871. adata = prep_zero_mask(a, adata, &constants);
  1872. mask = create_zero_mask(adata);
  1873. x ^= a & zero_bytemask(mask);
  1874. return hashlen_create(fold_hash(x, y), len + find_zero(mask));
  1875. }
  1876. EXPORT_SYMBOL(hashlen_string);
  1877. /*
  1878. * Calculate the length and hash of the path component, and
  1879. * return the "hash_len" as the result.
  1880. */
  1881. static inline u64 hash_name(const void *salt, const char *name)
  1882. {
  1883. unsigned long a = 0, b, x = 0, y = (unsigned long)salt;
  1884. unsigned long adata, bdata, mask, len;
  1885. const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
  1886. len = 0;
  1887. goto inside;
  1888. do {
  1889. HASH_MIX(x, y, a);
  1890. len += sizeof(unsigned long);
  1891. inside:
  1892. a = load_unaligned_zeropad(name+len);
  1893. b = a ^ REPEAT_BYTE('/');
  1894. } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
  1895. adata = prep_zero_mask(a, adata, &constants);
  1896. bdata = prep_zero_mask(b, bdata, &constants);
  1897. mask = create_zero_mask(adata | bdata);
  1898. x ^= a & zero_bytemask(mask);
  1899. return hashlen_create(fold_hash(x, y), len + find_zero(mask));
  1900. }
  1901. #else /* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */
  1902. /* Return the hash of a string of known length */
  1903. unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
  1904. {
  1905. unsigned long hash = init_name_hash(salt);
  1906. while (len--)
  1907. hash = partial_name_hash((unsigned char)*name++, hash);
  1908. return end_name_hash(hash);
  1909. }
  1910. EXPORT_SYMBOL(full_name_hash);
  1911. /* Return the "hash_len" (hash and length) of a null-terminated string */
  1912. u64 hashlen_string(const void *salt, const char *name)
  1913. {
  1914. unsigned long hash = init_name_hash(salt);
  1915. unsigned long len = 0, c;
  1916. c = (unsigned char)*name;
  1917. while (c) {
  1918. len++;
  1919. hash = partial_name_hash(c, hash);
  1920. c = (unsigned char)name[len];
  1921. }
  1922. return hashlen_create(end_name_hash(hash), len);
  1923. }
  1924. EXPORT_SYMBOL(hashlen_string);
  1925. /*
  1926. * We know there's a real path component here of at least
  1927. * one character.
  1928. */
  1929. static inline u64 hash_name(const void *salt, const char *name)
  1930. {
  1931. unsigned long hash = init_name_hash(salt);
  1932. unsigned long len = 0, c;
  1933. c = (unsigned char)*name;
  1934. do {
  1935. len++;
  1936. hash = partial_name_hash(c, hash);
  1937. c = (unsigned char)name[len];
  1938. } while (c && c != '/');
  1939. return hashlen_create(end_name_hash(hash), len);
  1940. }
  1941. #endif
  1942. /*
  1943. * Name resolution.
  1944. * This is the basic name resolution function, turning a pathname into
  1945. * the final dentry. We expect 'base' to be positive and a directory.
  1946. *
  1947. * Returns 0 and nd will have valid dentry and mnt on success.
  1948. * Returns error and drops reference to input namei data on failure.
  1949. */
  1950. static int link_path_walk(const char *name, struct nameidata *nd)
  1951. {
  1952. int depth = 0; // depth <= nd->depth
  1953. int err;
  1954. nd->last_type = LAST_ROOT;
  1955. nd->flags |= LOOKUP_PARENT;
  1956. if (IS_ERR(name))
  1957. return PTR_ERR(name);
  1958. while (*name=='/')
  1959. name++;
  1960. if (!*name)
  1961. return 0;
  1962. /* At this point we know we have a real path component. */
  1963. for(;;) {
  1964. const char *link;
  1965. u64 hash_len;
  1966. int type;
  1967. err = may_lookup(nd);
  1968. if (err)
  1969. return err;
  1970. hash_len = hash_name(nd->path.dentry, name);
  1971. type = LAST_NORM;
  1972. if (name[0] == '.') switch (hashlen_len(hash_len)) {
  1973. case 2:
  1974. if (name[1] == '.') {
  1975. type = LAST_DOTDOT;
  1976. nd->flags |= LOOKUP_JUMPED;
  1977. }
  1978. break;
  1979. case 1:
  1980. type = LAST_DOT;
  1981. }
  1982. if (likely(type == LAST_NORM)) {
  1983. struct dentry *parent = nd->path.dentry;
  1984. nd->flags &= ~LOOKUP_JUMPED;
  1985. if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
  1986. struct qstr this = { { .hash_len = hash_len }, .name = name };
  1987. err = parent->d_op->d_hash(parent, &this);
  1988. if (err < 0)
  1989. return err;
  1990. hash_len = this.hash_len;
  1991. name = this.name;
  1992. }
  1993. }
  1994. nd->last.hash_len = hash_len;
  1995. nd->last.name = name;
  1996. nd->last_type = type;
  1997. name += hashlen_len(hash_len);
  1998. if (!*name)
  1999. goto OK;
  2000. /*
  2001. * If it wasn't NUL, we know it was '/'. Skip that
  2002. * slash, and continue until no more slashes.
  2003. */
  2004. do {
  2005. name++;
  2006. } while (unlikely(*name == '/'));
  2007. if (unlikely(!*name)) {
  2008. OK:
  2009. /* pathname or trailing symlink, done */
  2010. if (!depth) {
  2011. nd->dir_uid = nd->inode->i_uid;
  2012. nd->dir_mode = nd->inode->i_mode;
  2013. nd->flags &= ~LOOKUP_PARENT;
  2014. return 0;
  2015. }
  2016. /* last component of nested symlink */
  2017. name = nd->stack[--depth].name;
  2018. link = walk_component(nd, 0);
  2019. } else {
  2020. /* not the last component */
  2021. link = walk_component(nd, WALK_MORE);
  2022. }
  2023. if (unlikely(link)) {
  2024. if (IS_ERR(link))
  2025. return PTR_ERR(link);
  2026. /* a symlink to follow */
  2027. nd->stack[depth++].name = name;
  2028. name = link;
  2029. continue;
  2030. }
  2031. if (unlikely(!d_can_lookup(nd->path.dentry))) {
  2032. if (nd->flags & LOOKUP_RCU) {
  2033. if (!try_to_unlazy(nd))
  2034. return -ECHILD;
  2035. }
  2036. return -ENOTDIR;
  2037. }
  2038. }
  2039. }
  2040. /* must be paired with terminate_walk() */
  2041. static const char *path_init(struct nameidata *nd, unsigned flags)
  2042. {
  2043. int error;
  2044. const char *s = nd->name->name;
  2045. if (!*s)
  2046. flags &= ~LOOKUP_RCU;
  2047. if (flags & LOOKUP_RCU)
  2048. rcu_read_lock();
  2049. nd->flags = flags | LOOKUP_JUMPED;
  2050. nd->depth = 0;
  2051. nd->m_seq = __read_seqcount_begin(&mount_lock.seqcount);
  2052. nd->r_seq = __read_seqcount_begin(&rename_lock.seqcount);
  2053. smp_rmb();
  2054. if (flags & LOOKUP_ROOT) {
  2055. struct dentry *root = nd->root.dentry;
  2056. struct inode *inode = root->d_inode;
  2057. if (*s && unlikely(!d_can_lookup(root)))
  2058. return ERR_PTR(-ENOTDIR);
  2059. nd->path = nd->root;
  2060. nd->inode = inode;
  2061. if (flags & LOOKUP_RCU) {
  2062. nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
  2063. nd->root_seq = nd->seq;
  2064. } else {
  2065. path_get(&nd->path);
  2066. }
  2067. return s;
  2068. }
  2069. nd->root.mnt = NULL;
  2070. nd->path.mnt = NULL;
  2071. nd->path.dentry = NULL;
  2072. /* Absolute pathname -- fetch the root (LOOKUP_IN_ROOT uses nd->dfd). */
  2073. if (*s == '/' && !(flags & LOOKUP_IN_ROOT)) {
  2074. error = nd_jump_root(nd);
  2075. if (unlikely(error))
  2076. return ERR_PTR(error);
  2077. return s;
  2078. }
  2079. /* Relative pathname -- get the starting-point it is relative to. */
  2080. if (nd->dfd == AT_FDCWD) {
  2081. if (flags & LOOKUP_RCU) {
  2082. struct fs_struct *fs = current->fs;
  2083. unsigned seq;
  2084. do {
  2085. seq = read_seqcount_begin(&fs->seq);
  2086. nd->path = fs->pwd;
  2087. nd->inode = nd->path.dentry->d_inode;
  2088. nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
  2089. } while (read_seqcount_retry(&fs->seq, seq));
  2090. } else {
  2091. get_fs_pwd(current->fs, &nd->path);
  2092. nd->inode = nd->path.dentry->d_inode;
  2093. }
  2094. } else {
  2095. /* Caller must check execute permissions on the starting path component */
  2096. struct fd f = fdget_raw(nd->dfd);
  2097. struct dentry *dentry;
  2098. if (!f.file)
  2099. return ERR_PTR(-EBADF);
  2100. dentry = f.file->f_path.dentry;
  2101. if (*s && unlikely(!d_can_lookup(dentry))) {
  2102. fdput(f);
  2103. return ERR_PTR(-ENOTDIR);
  2104. }
  2105. nd->path = f.file->f_path;
  2106. if (flags & LOOKUP_RCU) {
  2107. nd->inode = nd->path.dentry->d_inode;
  2108. nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
  2109. } else {
  2110. path_get(&nd->path);
  2111. nd->inode = nd->path.dentry->d_inode;
  2112. }
  2113. fdput(f);
  2114. }
  2115. /* For scoped-lookups we need to set the root to the dirfd as well. */
  2116. if (flags & LOOKUP_IS_SCOPED) {
  2117. nd->root = nd->path;
  2118. if (flags & LOOKUP_RCU) {
  2119. nd->root_seq = nd->seq;
  2120. } else {
  2121. path_get(&nd->root);
  2122. nd->flags |= LOOKUP_ROOT_GRABBED;
  2123. }
  2124. }
  2125. return s;
  2126. }
  2127. static inline const char *lookup_last(struct nameidata *nd)
  2128. {
  2129. if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
  2130. nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
  2131. return walk_component(nd, WALK_TRAILING);
  2132. }
  2133. static int handle_lookup_down(struct nameidata *nd)
  2134. {
  2135. if (!(nd->flags & LOOKUP_RCU))
  2136. dget(nd->path.dentry);
  2137. return PTR_ERR(step_into(nd, WALK_NOFOLLOW,
  2138. nd->path.dentry, nd->inode, nd->seq));
  2139. }
  2140. /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
  2141. static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
  2142. {
  2143. const char *s = path_init(nd, flags);
  2144. int err;
  2145. if (unlikely(flags & LOOKUP_DOWN) && !IS_ERR(s)) {
  2146. err = handle_lookup_down(nd);
  2147. if (unlikely(err < 0))
  2148. s = ERR_PTR(err);
  2149. }
  2150. while (!(err = link_path_walk(s, nd)) &&
  2151. (s = lookup_last(nd)) != NULL)
  2152. ;
  2153. if (!err && unlikely(nd->flags & LOOKUP_MOUNTPOINT)) {
  2154. err = handle_lookup_down(nd);
  2155. nd->flags &= ~LOOKUP_JUMPED; // no d_weak_revalidate(), please...
  2156. }
  2157. if (!err)
  2158. err = complete_walk(nd);
  2159. if (!err && nd->flags & LOOKUP_DIRECTORY)
  2160. if (!d_can_lookup(nd->path.dentry))
  2161. err = -ENOTDIR;
  2162. if (!err) {
  2163. *path = nd->path;
  2164. nd->path.mnt = NULL;
  2165. nd->path.dentry = NULL;
  2166. }
  2167. terminate_walk(nd);
  2168. return err;
  2169. }
  2170. int filename_lookup(int dfd, struct filename *name, unsigned flags,
  2171. struct path *path, struct path *root)
  2172. {
  2173. int retval;
  2174. struct nameidata nd;
  2175. if (IS_ERR(name))
  2176. return PTR_ERR(name);
  2177. if (unlikely(root)) {
  2178. nd.root = *root;
  2179. flags |= LOOKUP_ROOT;
  2180. }
  2181. set_nameidata(&nd, dfd, name);
  2182. retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
  2183. if (unlikely(retval == -ECHILD))
  2184. retval = path_lookupat(&nd, flags, path);
  2185. if (unlikely(retval == -ESTALE))
  2186. retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
  2187. if (likely(!retval))
  2188. audit_inode(name, path->dentry,
  2189. flags & LOOKUP_MOUNTPOINT ? AUDIT_INODE_NOEVAL : 0);
  2190. restore_nameidata();
  2191. putname(name);
  2192. return retval;
  2193. }
  2194. /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
  2195. static int path_parentat(struct nameidata *nd, unsigned flags,
  2196. struct path *parent)
  2197. {
  2198. const char *s = path_init(nd, flags);
  2199. int err = link_path_walk(s, nd);
  2200. if (!err)
  2201. err = complete_walk(nd);
  2202. if (!err) {
  2203. *parent = nd->path;
  2204. nd->path.mnt = NULL;
  2205. nd->path.dentry = NULL;
  2206. }
  2207. terminate_walk(nd);
  2208. return err;
  2209. }
  2210. static struct filename *filename_parentat(int dfd, struct filename *name,
  2211. unsigned int flags, struct path *parent,
  2212. struct qstr *last, int *type)
  2213. {
  2214. int retval;
  2215. struct nameidata nd;
  2216. if (IS_ERR(name))
  2217. return name;
  2218. set_nameidata(&nd, dfd, name);
  2219. retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
  2220. if (unlikely(retval == -ECHILD))
  2221. retval = path_parentat(&nd, flags, parent);
  2222. if (unlikely(retval == -ESTALE))
  2223. retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
  2224. if (likely(!retval)) {
  2225. *last = nd.last;
  2226. *type = nd.last_type;
  2227. audit_inode(name, parent->dentry, AUDIT_INODE_PARENT);
  2228. } else {
  2229. putname(name);
  2230. name = ERR_PTR(retval);
  2231. }
  2232. restore_nameidata();
  2233. return name;
  2234. }
  2235. /* does lookup, returns the object with parent locked */
  2236. struct dentry *kern_path_locked(const char *name, struct path *path)
  2237. {
  2238. struct filename *filename;
  2239. struct dentry *d;
  2240. struct qstr last;
  2241. int type;
  2242. filename = filename_parentat(AT_FDCWD, getname_kernel(name), 0, path,
  2243. &last, &type);
  2244. if (IS_ERR(filename))
  2245. return ERR_CAST(filename);
  2246. if (unlikely(type != LAST_NORM)) {
  2247. path_put(path);
  2248. putname(filename);
  2249. return ERR_PTR(-EINVAL);
  2250. }
  2251. inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
  2252. d = __lookup_hash(&last, path->dentry, 0);
  2253. if (IS_ERR(d)) {
  2254. inode_unlock(path->dentry->d_inode);
  2255. path_put(path);
  2256. }
  2257. putname(filename);
  2258. return d;
  2259. }
  2260. int kern_path(const char *name, unsigned int flags, struct path *path)
  2261. {
  2262. return filename_lookup(AT_FDCWD, getname_kernel(name),
  2263. flags, path, NULL);
  2264. }
  2265. EXPORT_SYMBOL(kern_path);
  2266. /**
  2267. * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
  2268. * @dentry: pointer to dentry of the base directory
  2269. * @mnt: pointer to vfs mount of the base directory
  2270. * @name: pointer to file name
  2271. * @flags: lookup flags
  2272. * @path: pointer to struct path to fill
  2273. */
  2274. int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
  2275. const char *name, unsigned int flags,
  2276. struct path *path)
  2277. {
  2278. struct path root = {.mnt = mnt, .dentry = dentry};
  2279. /* the first argument of filename_lookup() is ignored with root */
  2280. return filename_lookup(AT_FDCWD, getname_kernel(name),
  2281. flags , path, &root);
  2282. }
  2283. EXPORT_SYMBOL(vfs_path_lookup);
  2284. static int lookup_one_len_common(const char *name, struct dentry *base,
  2285. int len, struct qstr *this)
  2286. {
  2287. this->name = name;
  2288. this->len = len;
  2289. this->hash = full_name_hash(base, name, len);
  2290. if (!len)
  2291. return -EACCES;
  2292. if (unlikely(name[0] == '.')) {
  2293. if (len < 2 || (len == 2 && name[1] == '.'))
  2294. return -EACCES;
  2295. }
  2296. while (len--) {
  2297. unsigned int c = *(const unsigned char *)name++;
  2298. if (c == '/' || c == '\0')
  2299. return -EACCES;
  2300. }
  2301. /*
  2302. * See if the low-level filesystem might want
  2303. * to use its own hash..
  2304. */
  2305. if (base->d_flags & DCACHE_OP_HASH) {
  2306. int err = base->d_op->d_hash(base, this);
  2307. if (err < 0)
  2308. return err;
  2309. }
  2310. return inode_permission(base->d_inode, MAY_EXEC);
  2311. }
  2312. /**
  2313. * try_lookup_one_len - filesystem helper to lookup single pathname component
  2314. * @name: pathname component to lookup
  2315. * @base: base directory to lookup from
  2316. * @len: maximum length @len should be interpreted to
  2317. *
  2318. * Look up a dentry by name in the dcache, returning NULL if it does not
  2319. * currently exist. The function does not try to create a dentry.
  2320. *
  2321. * Note that this routine is purely a helper for filesystem usage and should
  2322. * not be called by generic code.
  2323. *
  2324. * The caller must hold base->i_mutex.
  2325. */
  2326. struct dentry *try_lookup_one_len(const char *name, struct dentry *base, int len)
  2327. {
  2328. struct qstr this;
  2329. int err;
  2330. WARN_ON_ONCE(!inode_is_locked(base->d_inode));
  2331. err = lookup_one_len_common(name, base, len, &this);
  2332. if (err)
  2333. return ERR_PTR(err);
  2334. return lookup_dcache(&this, base, 0);
  2335. }
  2336. EXPORT_SYMBOL(try_lookup_one_len);
  2337. /**
  2338. * lookup_one_len - filesystem helper to lookup single pathname component
  2339. * @name: pathname component to lookup
  2340. * @base: base directory to lookup from
  2341. * @len: maximum length @len should be interpreted to
  2342. *
  2343. * Note that this routine is purely a helper for filesystem usage and should
  2344. * not be called by generic code.
  2345. *
  2346. * The caller must hold base->i_mutex.
  2347. */
  2348. struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
  2349. {
  2350. struct dentry *dentry;
  2351. struct qstr this;
  2352. int err;
  2353. WARN_ON_ONCE(!inode_is_locked(base->d_inode));
  2354. err = lookup_one_len_common(name, base, len, &this);
  2355. if (err)
  2356. return ERR_PTR(err);
  2357. dentry = lookup_dcache(&this, base, 0);
  2358. return dentry ? dentry : __lookup_slow(&this, base, 0);
  2359. }
  2360. EXPORT_SYMBOL(lookup_one_len);
  2361. /**
  2362. * lookup_one_len_unlocked - filesystem helper to lookup single pathname component
  2363. * @name: pathname component to lookup
  2364. * @base: base directory to lookup from
  2365. * @len: maximum length @len should be interpreted to
  2366. *
  2367. * Note that this routine is purely a helper for filesystem usage and should
  2368. * not be called by generic code.
  2369. *
  2370. * Unlike lookup_one_len, it should be called without the parent
  2371. * i_mutex held, and will take the i_mutex itself if necessary.
  2372. */
  2373. struct dentry *lookup_one_len_unlocked(const char *name,
  2374. struct dentry *base, int len)
  2375. {
  2376. struct qstr this;
  2377. int err;
  2378. struct dentry *ret;
  2379. err = lookup_one_len_common(name, base, len, &this);
  2380. if (err)
  2381. return ERR_PTR(err);
  2382. ret = lookup_dcache(&this, base, 0);
  2383. if (!ret)
  2384. ret = lookup_slow(&this, base, 0);
  2385. return ret;
  2386. }
  2387. EXPORT_SYMBOL(lookup_one_len_unlocked);
  2388. /*
  2389. * Like lookup_one_len_unlocked(), except that it yields ERR_PTR(-ENOENT)
  2390. * on negatives. Returns known positive or ERR_PTR(); that's what
  2391. * most of the users want. Note that pinned negative with unlocked parent
  2392. * _can_ become positive at any time, so callers of lookup_one_len_unlocked()
  2393. * need to be very careful; pinned positives have ->d_inode stable, so
  2394. * this one avoids such problems.
  2395. */
  2396. struct dentry *lookup_positive_unlocked(const char *name,
  2397. struct dentry *base, int len)
  2398. {
  2399. struct dentry *ret = lookup_one_len_unlocked(name, base, len);
  2400. if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) {
  2401. dput(ret);
  2402. ret = ERR_PTR(-ENOENT);
  2403. }
  2404. return ret;
  2405. }
  2406. EXPORT_SYMBOL(lookup_positive_unlocked);
  2407. #ifdef CONFIG_UNIX98_PTYS
  2408. int path_pts(struct path *path)
  2409. {
  2410. /* Find something mounted on "pts" in the same directory as
  2411. * the input path.
  2412. */
  2413. struct dentry *parent = dget_parent(path->dentry);
  2414. struct dentry *child;
  2415. struct qstr this = QSTR_INIT("pts", 3);
  2416. if (unlikely(!path_connected(path->mnt, parent))) {
  2417. dput(parent);
  2418. return -ENOENT;
  2419. }
  2420. dput(path->dentry);
  2421. path->dentry = parent;
  2422. child = d_hash_and_lookup(parent, &this);
  2423. if (!child)
  2424. return -ENOENT;
  2425. path->dentry = child;
  2426. dput(parent);
  2427. follow_down(path);
  2428. return 0;
  2429. }
  2430. #endif
  2431. int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
  2432. struct path *path, int *empty)
  2433. {
  2434. return filename_lookup(dfd, getname_flags(name, flags, empty),
  2435. flags, path, NULL);
  2436. }
  2437. EXPORT_SYMBOL(user_path_at_empty);
  2438. int __check_sticky(struct inode *dir, struct inode *inode)
  2439. {
  2440. kuid_t fsuid = current_fsuid();
  2441. if (uid_eq(inode->i_uid, fsuid))
  2442. return 0;
  2443. if (uid_eq(dir->i_uid, fsuid))
  2444. return 0;
  2445. return !capable_wrt_inode_uidgid(inode, CAP_FOWNER);
  2446. }
  2447. EXPORT_SYMBOL(__check_sticky);
  2448. /*
  2449. * Check whether we can remove a link victim from directory dir, check
  2450. * whether the type of victim is right.
  2451. * 1. We can't do it if dir is read-only (done in permission())
  2452. * 2. We should have write and exec permissions on dir
  2453. * 3. We can't remove anything from append-only dir
  2454. * 4. We can't do anything with immutable dir (done in permission())
  2455. * 5. If the sticky bit on dir is set we should either
  2456. * a. be owner of dir, or
  2457. * b. be owner of victim, or
  2458. * c. have CAP_FOWNER capability
  2459. * 6. If the victim is append-only or immutable we can't do antyhing with
  2460. * links pointing to it.
  2461. * 7. If the victim has an unknown uid or gid we can't change the inode.
  2462. * 8. If we were asked to remove a directory and victim isn't one - ENOTDIR.
  2463. * 9. If we were asked to remove a non-directory and victim isn't one - EISDIR.
  2464. * 10. We can't remove a root or mountpoint.
  2465. * 11. We don't allow removal of NFS sillyrenamed files; it's handled by
  2466. * nfs_async_unlink().
  2467. */
  2468. static int may_delete(struct inode *dir, struct dentry *victim, bool isdir)
  2469. {
  2470. struct inode *inode = d_backing_inode(victim);
  2471. int error;
  2472. if (d_is_negative(victim))
  2473. return -ENOENT;
  2474. BUG_ON(!inode);
  2475. BUG_ON(victim->d_parent->d_inode != dir);
  2476. /* Inode writeback is not safe when the uid or gid are invalid. */
  2477. if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
  2478. return -EOVERFLOW;
  2479. audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
  2480. error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
  2481. if (error)
  2482. return error;
  2483. if (IS_APPEND(dir))
  2484. return -EPERM;
  2485. if (check_sticky(dir, inode) || IS_APPEND(inode) ||
  2486. IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) || HAS_UNMAPPED_ID(inode))
  2487. return -EPERM;
  2488. if (isdir) {
  2489. if (!d_is_dir(victim))
  2490. return -ENOTDIR;
  2491. if (IS_ROOT(victim))
  2492. return -EBUSY;
  2493. } else if (d_is_dir(victim))
  2494. return -EISDIR;
  2495. if (IS_DEADDIR(dir))
  2496. return -ENOENT;
  2497. if (victim->d_flags & DCACHE_NFSFS_RENAMED)
  2498. return -EBUSY;
  2499. return 0;
  2500. }
  2501. /* Check whether we can create an object with dentry child in directory
  2502. * dir.
  2503. * 1. We can't do it if child already exists (open has special treatment for
  2504. * this case, but since we are inlined it's OK)
  2505. * 2. We can't do it if dir is read-only (done in permission())
  2506. * 3. We can't do it if the fs can't represent the fsuid or fsgid.
  2507. * 4. We should have write and exec permissions on dir
  2508. * 5. We can't do it if dir is immutable (done in permission())
  2509. */
  2510. static inline int may_create(struct inode *dir, struct dentry *child)
  2511. {
  2512. struct user_namespace *s_user_ns;
  2513. audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
  2514. if (child->d_inode)
  2515. return -EEXIST;
  2516. if (IS_DEADDIR(dir))
  2517. return -ENOENT;
  2518. s_user_ns = dir->i_sb->s_user_ns;
  2519. if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||
  2520. !kgid_has_mapping(s_user_ns, current_fsgid()))
  2521. return -EOVERFLOW;
  2522. return inode_permission(dir, MAY_WRITE | MAY_EXEC);
  2523. }
  2524. /*
  2525. * p1 and p2 should be directories on the same fs.
  2526. */
  2527. struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
  2528. {
  2529. struct dentry *p;
  2530. if (p1 == p2) {
  2531. inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
  2532. return NULL;
  2533. }
  2534. mutex_lock(&p1->d_sb->s_vfs_rename_mutex);
  2535. p = d_ancestor(p2, p1);
  2536. if (p) {
  2537. inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
  2538. inode_lock_nested(p1->d_inode, I_MUTEX_CHILD);
  2539. return p;
  2540. }
  2541. p = d_ancestor(p1, p2);
  2542. if (p) {
  2543. inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
  2544. inode_lock_nested(p2->d_inode, I_MUTEX_CHILD);
  2545. return p;
  2546. }
  2547. inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
  2548. inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
  2549. return NULL;
  2550. }
  2551. EXPORT_SYMBOL(lock_rename);
  2552. void unlock_rename(struct dentry *p1, struct dentry *p2)
  2553. {
  2554. inode_unlock(p1->d_inode);
  2555. if (p1 != p2) {
  2556. inode_unlock(p2->d_inode);
  2557. mutex_unlock(&p1->d_sb->s_vfs_rename_mutex);
  2558. }
  2559. }
  2560. EXPORT_SYMBOL(unlock_rename);
  2561. int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
  2562. bool want_excl)
  2563. {
  2564. int error = may_create(dir, dentry);
  2565. if (error)
  2566. return error;
  2567. if (!dir->i_op->create)
  2568. return -EACCES; /* shouldn't it be ENOSYS? */
  2569. mode &= S_IALLUGO;
  2570. mode |= S_IFREG;
  2571. error = security_inode_create(dir, dentry, mode);
  2572. if (error)
  2573. return error;
  2574. error = dir->i_op->create(dir, dentry, mode, want_excl);
  2575. if (!error)
  2576. fsnotify_create(dir, dentry);
  2577. return error;
  2578. }
  2579. EXPORT_SYMBOL_NS(vfs_create, ANDROID_GKI_VFS_EXPORT_ONLY);
  2580. int vfs_mkobj(struct dentry *dentry, umode_t mode,
  2581. int (*f)(struct dentry *, umode_t, void *),
  2582. void *arg)
  2583. {
  2584. struct inode *dir = dentry->d_parent->d_inode;
  2585. int error = may_create(dir, dentry);
  2586. if (error)
  2587. return error;
  2588. mode &= S_IALLUGO;
  2589. mode |= S_IFREG;
  2590. error = security_inode_create(dir, dentry, mode);
  2591. if (error)
  2592. return error;
  2593. error = f(dentry, mode, arg);
  2594. if (!error)
  2595. fsnotify_create(dir, dentry);
  2596. return error;
  2597. }
  2598. EXPORT_SYMBOL(vfs_mkobj);
  2599. bool may_open_dev(const struct path *path)
  2600. {
  2601. return !(path->mnt->mnt_flags & MNT_NODEV) &&
  2602. !(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
  2603. }
  2604. static int may_open(const struct path *path, int acc_mode, int flag)
  2605. {
  2606. struct dentry *dentry = path->dentry;
  2607. struct inode *inode = dentry->d_inode;
  2608. int error;
  2609. if (!inode)
  2610. return -ENOENT;
  2611. switch (inode->i_mode & S_IFMT) {
  2612. case S_IFLNK:
  2613. return -ELOOP;
  2614. case S_IFDIR:
  2615. if (acc_mode & MAY_WRITE)
  2616. return -EISDIR;
  2617. if (acc_mode & MAY_EXEC)
  2618. return -EACCES;
  2619. break;
  2620. case S_IFBLK:
  2621. case S_IFCHR:
  2622. if (!may_open_dev(path))
  2623. return -EACCES;
  2624. fallthrough;
  2625. case S_IFIFO:
  2626. case S_IFSOCK:
  2627. if (acc_mode & MAY_EXEC)
  2628. return -EACCES;
  2629. flag &= ~O_TRUNC;
  2630. break;
  2631. case S_IFREG:
  2632. if ((acc_mode & MAY_EXEC) && path_noexec(path))
  2633. return -EACCES;
  2634. break;
  2635. }
  2636. error = inode_permission(inode, MAY_OPEN | acc_mode);
  2637. if (error)
  2638. return error;
  2639. /*
  2640. * An append-only file must be opened in append mode for writing.
  2641. */
  2642. if (IS_APPEND(inode)) {
  2643. if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
  2644. return -EPERM;
  2645. if (flag & O_TRUNC)
  2646. return -EPERM;
  2647. }
  2648. /* O_NOATIME can only be set by the owner or superuser */
  2649. if (flag & O_NOATIME && !inode_owner_or_capable(inode))
  2650. return -EPERM;
  2651. return 0;
  2652. }
  2653. static int handle_truncate(struct file *filp)
  2654. {
  2655. const struct path *path = &filp->f_path;
  2656. struct inode *inode = path->dentry->d_inode;
  2657. int error = get_write_access(inode);
  2658. if (error)
  2659. return error;
  2660. /*
  2661. * Refuse to truncate files with mandatory locks held on them.
  2662. */
  2663. error = locks_verify_locked(filp);
  2664. if (!error)
  2665. error = security_path_truncate(path);
  2666. if (!error) {
  2667. error = do_truncate(path->dentry, 0,
  2668. ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
  2669. filp);
  2670. }
  2671. put_write_access(inode);
  2672. return error;
  2673. }
  2674. static inline int open_to_namei_flags(int flag)
  2675. {
  2676. if ((flag & O_ACCMODE) == 3)
  2677. flag--;
  2678. return flag;
  2679. }
  2680. static int may_o_create(const struct path *dir, struct dentry *dentry, umode_t mode)
  2681. {
  2682. struct user_namespace *s_user_ns;
  2683. int error = security_path_mknod(dir, dentry, mode, 0);
  2684. if (error)
  2685. return error;
  2686. s_user_ns = dir->dentry->d_sb->s_user_ns;
  2687. if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||
  2688. !kgid_has_mapping(s_user_ns, current_fsgid()))
  2689. return -EOVERFLOW;
  2690. error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
  2691. if (error)
  2692. return error;
  2693. return security_inode_create(dir->dentry->d_inode, dentry, mode);
  2694. }
  2695. /*
  2696. * Attempt to atomically look up, create and open a file from a negative
  2697. * dentry.
  2698. *
  2699. * Returns 0 if successful. The file will have been created and attached to
  2700. * @file by the filesystem calling finish_open().
  2701. *
  2702. * If the file was looked up only or didn't need creating, FMODE_OPENED won't
  2703. * be set. The caller will need to perform the open themselves. @path will
  2704. * have been updated to point to the new dentry. This may be negative.
  2705. *
  2706. * Returns an error code otherwise.
  2707. */
  2708. static struct dentry *atomic_open(struct nameidata *nd, struct dentry *dentry,
  2709. struct file *file,
  2710. int open_flag, umode_t mode)
  2711. {
  2712. struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
  2713. struct inode *dir = nd->path.dentry->d_inode;
  2714. int error;
  2715. if (nd->flags & LOOKUP_DIRECTORY)
  2716. open_flag |= O_DIRECTORY;
  2717. file->f_path.dentry = DENTRY_NOT_SET;
  2718. file->f_path.mnt = nd->path.mnt;
  2719. error = dir->i_op->atomic_open(dir, dentry, file,
  2720. open_to_namei_flags(open_flag), mode);
  2721. d_lookup_done(dentry);
  2722. if (!error) {
  2723. if (file->f_mode & FMODE_OPENED) {
  2724. if (unlikely(dentry != file->f_path.dentry)) {
  2725. dput(dentry);
  2726. dentry = dget(file->f_path.dentry);
  2727. }
  2728. } else if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
  2729. error = -EIO;
  2730. } else {
  2731. if (file->f_path.dentry) {
  2732. dput(dentry);
  2733. dentry = file->f_path.dentry;
  2734. }
  2735. if (unlikely(d_is_negative(dentry)))
  2736. error = -ENOENT;
  2737. }
  2738. }
  2739. if (error) {
  2740. dput(dentry);
  2741. dentry = ERR_PTR(error);
  2742. }
  2743. return dentry;
  2744. }
  2745. /*
  2746. * Look up and maybe create and open the last component.
  2747. *
  2748. * Must be called with parent locked (exclusive in O_CREAT case).
  2749. *
  2750. * Returns 0 on success, that is, if
  2751. * the file was successfully atomically created (if necessary) and opened, or
  2752. * the file was not completely opened at this time, though lookups and
  2753. * creations were performed.
  2754. * These case are distinguished by presence of FMODE_OPENED on file->f_mode.
  2755. * In the latter case dentry returned in @path might be negative if O_CREAT
  2756. * hadn't been specified.
  2757. *
  2758. * An error code is returned on failure.
  2759. */
  2760. static struct dentry *lookup_open(struct nameidata *nd, struct file *file,
  2761. const struct open_flags *op,
  2762. bool got_write)
  2763. {
  2764. struct dentry *dir = nd->path.dentry;
  2765. struct inode *dir_inode = dir->d_inode;
  2766. int open_flag = op->open_flag;
  2767. struct dentry *dentry;
  2768. int error, create_error = 0;
  2769. umode_t mode = op->mode;
  2770. DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
  2771. if (unlikely(IS_DEADDIR(dir_inode)))
  2772. return ERR_PTR(-ENOENT);
  2773. file->f_mode &= ~FMODE_CREATED;
  2774. dentry = d_lookup(dir, &nd->last);
  2775. for (;;) {
  2776. if (!dentry) {
  2777. dentry = d_alloc_parallel(dir, &nd->last, &wq);
  2778. if (IS_ERR(dentry))
  2779. return dentry;
  2780. }
  2781. if (d_in_lookup(dentry))
  2782. break;
  2783. error = d_revalidate(dentry, nd->flags);
  2784. if (likely(error > 0))
  2785. break;
  2786. if (error)
  2787. goto out_dput;
  2788. d_invalidate(dentry);
  2789. dput(dentry);
  2790. dentry = NULL;
  2791. }
  2792. if (dentry->d_inode) {
  2793. /* Cached positive dentry: will open in f_op->open */
  2794. return dentry;
  2795. }
  2796. /*
  2797. * Checking write permission is tricky, bacuse we don't know if we are
  2798. * going to actually need it: O_CREAT opens should work as long as the
  2799. * file exists. But checking existence breaks atomicity. The trick is
  2800. * to check access and if not granted clear O_CREAT from the flags.
  2801. *
  2802. * Another problem is returing the "right" error value (e.g. for an
  2803. * O_EXCL open we want to return EEXIST not EROFS).
  2804. */
  2805. if (unlikely(!got_write))
  2806. open_flag &= ~O_TRUNC;
  2807. if (open_flag & O_CREAT) {
  2808. if (open_flag & O_EXCL)
  2809. open_flag &= ~O_TRUNC;
  2810. if (!IS_POSIXACL(dir->d_inode))
  2811. mode &= ~current_umask();
  2812. if (likely(got_write))
  2813. create_error = may_o_create(&nd->path, dentry, mode);
  2814. else
  2815. create_error = -EROFS;
  2816. }
  2817. if (create_error)
  2818. open_flag &= ~O_CREAT;
  2819. if (dir_inode->i_op->atomic_open) {
  2820. dentry = atomic_open(nd, dentry, file, open_flag, mode);
  2821. if (unlikely(create_error) && dentry == ERR_PTR(-ENOENT))
  2822. dentry = ERR_PTR(create_error);
  2823. return dentry;
  2824. }
  2825. if (d_in_lookup(dentry)) {
  2826. struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry,
  2827. nd->flags);
  2828. d_lookup_done(dentry);
  2829. if (unlikely(res)) {
  2830. if (IS_ERR(res)) {
  2831. error = PTR_ERR(res);
  2832. goto out_dput;
  2833. }
  2834. dput(dentry);
  2835. dentry = res;
  2836. }
  2837. }
  2838. /* Negative dentry, just create the file */
  2839. if (!dentry->d_inode && (open_flag & O_CREAT)) {
  2840. file->f_mode |= FMODE_CREATED;
  2841. audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
  2842. if (!dir_inode->i_op->create) {
  2843. error = -EACCES;
  2844. goto out_dput;
  2845. }
  2846. error = dir_inode->i_op->create(dir_inode, dentry, mode,
  2847. open_flag & O_EXCL);
  2848. if (error)
  2849. goto out_dput;
  2850. }
  2851. if (unlikely(create_error) && !dentry->d_inode) {
  2852. error = create_error;
  2853. goto out_dput;
  2854. }
  2855. return dentry;
  2856. out_dput:
  2857. dput(dentry);
  2858. return ERR_PTR(error);
  2859. }
  2860. static const char *open_last_lookups(struct nameidata *nd,
  2861. struct file *file, const struct open_flags *op)
  2862. {
  2863. struct dentry *dir = nd->path.dentry;
  2864. int open_flag = op->open_flag;
  2865. bool got_write = false;
  2866. unsigned seq;
  2867. struct inode *inode;
  2868. struct dentry *dentry;
  2869. const char *res;
  2870. nd->flags |= op->intent;
  2871. if (nd->last_type != LAST_NORM) {
  2872. if (nd->depth)
  2873. put_link(nd);
  2874. return handle_dots(nd, nd->last_type);
  2875. }
  2876. if (!(open_flag & O_CREAT)) {
  2877. if (nd->last.name[nd->last.len])
  2878. nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
  2879. /* we _can_ be in RCU mode here */
  2880. dentry = lookup_fast(nd, &inode, &seq);
  2881. if (IS_ERR(dentry))
  2882. return ERR_CAST(dentry);
  2883. if (likely(dentry))
  2884. goto finish_lookup;
  2885. BUG_ON(nd->flags & LOOKUP_RCU);
  2886. } else {
  2887. /* create side of things */
  2888. if (nd->flags & LOOKUP_RCU) {
  2889. if (!try_to_unlazy(nd))
  2890. return ERR_PTR(-ECHILD);
  2891. }
  2892. audit_inode(nd->name, dir, AUDIT_INODE_PARENT);
  2893. /* trailing slashes? */
  2894. if (unlikely(nd->last.name[nd->last.len]))
  2895. return ERR_PTR(-EISDIR);
  2896. }
  2897. if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
  2898. got_write = !mnt_want_write(nd->path.mnt);
  2899. /*
  2900. * do _not_ fail yet - we might not need that or fail with
  2901. * a different error; let lookup_open() decide; we'll be
  2902. * dropping this one anyway.
  2903. */
  2904. }
  2905. if (open_flag & O_CREAT)
  2906. inode_lock(dir->d_inode);
  2907. else
  2908. inode_lock_shared(dir->d_inode);
  2909. dentry = lookup_open(nd, file, op, got_write);
  2910. if (!IS_ERR(dentry) && (file->f_mode & FMODE_CREATED))
  2911. fsnotify_create(dir->d_inode, dentry);
  2912. if (open_flag & O_CREAT)
  2913. inode_unlock(dir->d_inode);
  2914. else
  2915. inode_unlock_shared(dir->d_inode);
  2916. if (got_write)
  2917. mnt_drop_write(nd->path.mnt);
  2918. if (IS_ERR(dentry))
  2919. return ERR_CAST(dentry);
  2920. if (file->f_mode & (FMODE_OPENED | FMODE_CREATED)) {
  2921. dput(nd->path.dentry);
  2922. nd->path.dentry = dentry;
  2923. return NULL;
  2924. }
  2925. finish_lookup:
  2926. if (nd->depth)
  2927. put_link(nd);
  2928. res = step_into(nd, WALK_TRAILING, dentry, inode, seq);
  2929. if (unlikely(res))
  2930. nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
  2931. return res;
  2932. }
  2933. /*
  2934. * Handle the last step of open()
  2935. */
  2936. static int do_open(struct nameidata *nd,
  2937. struct file *file, const struct open_flags *op)
  2938. {
  2939. int open_flag = op->open_flag;
  2940. bool do_truncate;
  2941. int acc_mode;
  2942. int error;
  2943. if (!(file->f_mode & (FMODE_OPENED | FMODE_CREATED))) {
  2944. error = complete_walk(nd);
  2945. if (error)
  2946. return error;
  2947. }
  2948. if (!(file->f_mode & FMODE_CREATED))
  2949. audit_inode(nd->name, nd->path.dentry, 0);
  2950. if (open_flag & O_CREAT) {
  2951. if ((open_flag & O_EXCL) && !(file->f_mode & FMODE_CREATED))
  2952. return -EEXIST;
  2953. if (d_is_dir(nd->path.dentry))
  2954. return -EISDIR;
  2955. error = may_create_in_sticky(nd->dir_mode, nd->dir_uid,
  2956. d_backing_inode(nd->path.dentry));
  2957. if (unlikely(error))
  2958. return error;
  2959. }
  2960. if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
  2961. return -ENOTDIR;
  2962. do_truncate = false;
  2963. acc_mode = op->acc_mode;
  2964. if (file->f_mode & FMODE_CREATED) {
  2965. /* Don't check for write permission, don't truncate */
  2966. open_flag &= ~O_TRUNC;
  2967. acc_mode = 0;
  2968. } else if (d_is_reg(nd->path.dentry) && open_flag & O_TRUNC) {
  2969. error = mnt_want_write(nd->path.mnt);
  2970. if (error)
  2971. return error;
  2972. do_truncate = true;
  2973. }
  2974. error = may_open(&nd->path, acc_mode, open_flag);
  2975. if (!error && !(file->f_mode & FMODE_OPENED))
  2976. error = vfs_open(&nd->path, file);
  2977. if (!error)
  2978. error = ima_file_check(file, op->acc_mode);
  2979. if (!error && do_truncate)
  2980. error = handle_truncate(file);
  2981. if (unlikely(error > 0)) {
  2982. WARN_ON(1);
  2983. error = -EINVAL;
  2984. }
  2985. if (do_truncate)
  2986. mnt_drop_write(nd->path.mnt);
  2987. return error;
  2988. }
  2989. struct dentry *vfs_tmpfile(struct dentry *dentry, umode_t mode, int open_flag)
  2990. {
  2991. struct dentry *child = NULL;
  2992. struct inode *dir = dentry->d_inode;
  2993. struct inode *inode;
  2994. int error;
  2995. /* we want directory to be writable */
  2996. error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
  2997. if (error)
  2998. goto out_err;
  2999. error = -EOPNOTSUPP;
  3000. if (!dir->i_op->tmpfile)
  3001. goto out_err;
  3002. error = -ENOMEM;
  3003. child = d_alloc(dentry, &slash_name);
  3004. if (unlikely(!child))
  3005. goto out_err;
  3006. error = dir->i_op->tmpfile(dir, child, mode);
  3007. if (error)
  3008. goto out_err;
  3009. error = -ENOENT;
  3010. inode = child->d_inode;
  3011. if (unlikely(!inode))
  3012. goto out_err;
  3013. if (!(open_flag & O_EXCL)) {
  3014. spin_lock(&inode->i_lock);
  3015. inode->i_state |= I_LINKABLE;
  3016. spin_unlock(&inode->i_lock);
  3017. }
  3018. ima_post_create_tmpfile(inode);
  3019. return child;
  3020. out_err:
  3021. dput(child);
  3022. return ERR_PTR(error);
  3023. }
  3024. EXPORT_SYMBOL(vfs_tmpfile);
  3025. static int do_tmpfile(struct nameidata *nd, unsigned flags,
  3026. const struct open_flags *op,
  3027. struct file *file)
  3028. {
  3029. struct dentry *child;
  3030. struct path path;
  3031. int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
  3032. if (unlikely(error))
  3033. return error;
  3034. error = mnt_want_write(path.mnt);
  3035. if (unlikely(error))
  3036. goto out;
  3037. child = vfs_tmpfile(path.dentry, op->mode, op->open_flag);
  3038. error = PTR_ERR(child);
  3039. if (IS_ERR(child))
  3040. goto out2;
  3041. dput(path.dentry);
  3042. path.dentry = child;
  3043. audit_inode(nd->name, child, 0);
  3044. /* Don't check for other permissions, the inode was just created */
  3045. error = may_open(&path, 0, op->open_flag);
  3046. if (error)
  3047. goto out2;
  3048. file->f_path.mnt = path.mnt;
  3049. error = finish_open(file, child, NULL);
  3050. out2:
  3051. mnt_drop_write(path.mnt);
  3052. out:
  3053. path_put(&path);
  3054. return error;
  3055. }
  3056. static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file)
  3057. {
  3058. struct path path;
  3059. int error = path_lookupat(nd, flags, &path);
  3060. if (!error) {
  3061. audit_inode(nd->name, path.dentry, 0);
  3062. error = vfs_open(&path, file);
  3063. path_put(&path);
  3064. }
  3065. return error;
  3066. }
  3067. static struct file *path_openat(struct nameidata *nd,
  3068. const struct open_flags *op, unsigned flags)
  3069. {
  3070. struct file *file;
  3071. int error;
  3072. file = alloc_empty_file(op->open_flag, current_cred());
  3073. if (IS_ERR(file))
  3074. return file;
  3075. if (unlikely(file->f_flags & __O_TMPFILE)) {
  3076. error = do_tmpfile(nd, flags, op, file);
  3077. } else if (unlikely(file->f_flags & O_PATH)) {
  3078. error = do_o_path(nd, flags, file);
  3079. } else {
  3080. const char *s = path_init(nd, flags);
  3081. while (!(error = link_path_walk(s, nd)) &&
  3082. (s = open_last_lookups(nd, file, op)) != NULL)
  3083. ;
  3084. if (!error)
  3085. error = do_open(nd, file, op);
  3086. terminate_walk(nd);
  3087. }
  3088. if (likely(!error)) {
  3089. if (likely(file->f_mode & FMODE_OPENED))
  3090. return file;
  3091. WARN_ON(1);
  3092. error = -EINVAL;
  3093. }
  3094. fput(file);
  3095. if (error == -EOPENSTALE) {
  3096. if (flags & LOOKUP_RCU)
  3097. error = -ECHILD;
  3098. else
  3099. error = -ESTALE;
  3100. }
  3101. return ERR_PTR(error);
  3102. }
  3103. struct file *do_filp_open(int dfd, struct filename *pathname,
  3104. const struct open_flags *op)
  3105. {
  3106. struct nameidata nd;
  3107. int flags = op->lookup_flags;
  3108. struct file *filp;
  3109. set_nameidata(&nd, dfd, pathname);
  3110. filp = path_openat(&nd, op, flags | LOOKUP_RCU);
  3111. if (unlikely(filp == ERR_PTR(-ECHILD)))
  3112. filp = path_openat(&nd, op, flags);
  3113. if (unlikely(filp == ERR_PTR(-ESTALE)))
  3114. filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
  3115. restore_nameidata();
  3116. return filp;
  3117. }
  3118. struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
  3119. const char *name, const struct open_flags *op)
  3120. {
  3121. struct nameidata nd;
  3122. struct file *file;
  3123. struct filename *filename;
  3124. int flags = op->lookup_flags | LOOKUP_ROOT;
  3125. nd.root.mnt = mnt;
  3126. nd.root.dentry = dentry;
  3127. if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN)
  3128. return ERR_PTR(-ELOOP);
  3129. filename = getname_kernel(name);
  3130. if (IS_ERR(filename))
  3131. return ERR_CAST(filename);
  3132. set_nameidata(&nd, -1, filename);
  3133. file = path_openat(&nd, op, flags | LOOKUP_RCU);
  3134. if (unlikely(file == ERR_PTR(-ECHILD)))
  3135. file = path_openat(&nd, op, flags);
  3136. if (unlikely(file == ERR_PTR(-ESTALE)))
  3137. file = path_openat(&nd, op, flags | LOOKUP_REVAL);
  3138. restore_nameidata();
  3139. putname(filename);
  3140. return file;
  3141. }
  3142. static struct dentry *filename_create(int dfd, struct filename *name,
  3143. struct path *path, unsigned int lookup_flags)
  3144. {
  3145. struct dentry *dentry = ERR_PTR(-EEXIST);
  3146. struct qstr last;
  3147. int type;
  3148. int err2;
  3149. int error;
  3150. bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);
  3151. /*
  3152. * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any
  3153. * other flags passed in are ignored!
  3154. */
  3155. lookup_flags &= LOOKUP_REVAL;
  3156. name = filename_parentat(dfd, name, lookup_flags, path, &last, &type);
  3157. if (IS_ERR(name))
  3158. return ERR_CAST(name);
  3159. /*
  3160. * Yucky last component or no last component at all?
  3161. * (foo/., foo/.., /////)
  3162. */
  3163. if (unlikely(type != LAST_NORM))
  3164. goto out;
  3165. /* don't fail immediately if it's r/o, at least try to report other errors */
  3166. err2 = mnt_want_write(path->mnt);
  3167. /*
  3168. * Do the final lookup.
  3169. */
  3170. lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL;
  3171. inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
  3172. dentry = __lookup_hash(&last, path->dentry, lookup_flags);
  3173. if (IS_ERR(dentry))
  3174. goto unlock;
  3175. error = -EEXIST;
  3176. if (d_is_positive(dentry))
  3177. goto fail;
  3178. /*
  3179. * Special case - lookup gave negative, but... we had foo/bar/
  3180. * From the vfs_mknod() POV we just have a negative dentry -
  3181. * all is fine. Let's be bastards - you had / on the end, you've
  3182. * been asking for (non-existent) directory. -ENOENT for you.
  3183. */
  3184. if (unlikely(!is_dir && last.name[last.len])) {
  3185. error = -ENOENT;
  3186. goto fail;
  3187. }
  3188. if (unlikely(err2)) {
  3189. error = err2;
  3190. goto fail;
  3191. }
  3192. putname(name);
  3193. return dentry;
  3194. fail:
  3195. dput(dentry);
  3196. dentry = ERR_PTR(error);
  3197. unlock:
  3198. inode_unlock(path->dentry->d_inode);
  3199. if (!err2)
  3200. mnt_drop_write(path->mnt);
  3201. out:
  3202. path_put(path);
  3203. putname(name);
  3204. return dentry;
  3205. }
  3206. struct dentry *kern_path_create(int dfd, const char *pathname,
  3207. struct path *path, unsigned int lookup_flags)
  3208. {
  3209. return filename_create(dfd, getname_kernel(pathname),
  3210. path, lookup_flags);
  3211. }
  3212. EXPORT_SYMBOL(kern_path_create);
  3213. void done_path_create(struct path *path, struct dentry *dentry)
  3214. {
  3215. dput(dentry);
  3216. inode_unlock(path->dentry->d_inode);
  3217. mnt_drop_write(path->mnt);
  3218. path_put(path);
  3219. }
  3220. EXPORT_SYMBOL(done_path_create);
  3221. inline struct dentry *user_path_create(int dfd, const char __user *pathname,
  3222. struct path *path, unsigned int lookup_flags)
  3223. {
  3224. return filename_create(dfd, getname(pathname), path, lookup_flags);
  3225. }
  3226. EXPORT_SYMBOL(user_path_create);
  3227. int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
  3228. {
  3229. bool is_whiteout = S_ISCHR(mode) && dev == WHITEOUT_DEV;
  3230. int error = may_create(dir, dentry);
  3231. if (error)
  3232. return error;
  3233. if ((S_ISCHR(mode) || S_ISBLK(mode)) && !is_whiteout &&
  3234. !capable(CAP_MKNOD))
  3235. return -EPERM;
  3236. if (!dir->i_op->mknod)
  3237. return -EPERM;
  3238. error = devcgroup_inode_mknod(mode, dev);
  3239. if (error)
  3240. return error;
  3241. error = security_inode_mknod(dir, dentry, mode, dev);
  3242. if (error)
  3243. return error;
  3244. error = dir->i_op->mknod(dir, dentry, mode, dev);
  3245. if (!error)
  3246. fsnotify_create(dir, dentry);
  3247. return error;
  3248. }
  3249. EXPORT_SYMBOL(vfs_mknod);
  3250. static int may_mknod(umode_t mode)
  3251. {
  3252. switch (mode & S_IFMT) {
  3253. case S_IFREG:
  3254. case S_IFCHR:
  3255. case S_IFBLK:
  3256. case S_IFIFO:
  3257. case S_IFSOCK:
  3258. case 0: /* zero mode translates to S_IFREG */
  3259. return 0;
  3260. case S_IFDIR:
  3261. return -EPERM;
  3262. default:
  3263. return -EINVAL;
  3264. }
  3265. }
  3266. static long do_mknodat(int dfd, const char __user *filename, umode_t mode,
  3267. unsigned int dev)
  3268. {
  3269. struct dentry *dentry;
  3270. struct path path;
  3271. int error;
  3272. unsigned int lookup_flags = 0;
  3273. error = may_mknod(mode);
  3274. if (error)
  3275. return error;
  3276. retry:
  3277. dentry = user_path_create(dfd, filename, &path, lookup_flags);
  3278. if (IS_ERR(dentry))
  3279. return PTR_ERR(dentry);
  3280. if (!IS_POSIXACL(path.dentry->d_inode))
  3281. mode &= ~current_umask();
  3282. error = security_path_mknod(&path, dentry, mode, dev);
  3283. if (error)
  3284. goto out;
  3285. switch (mode & S_IFMT) {
  3286. case 0: case S_IFREG:
  3287. error = vfs_create(path.dentry->d_inode,dentry,mode,true);
  3288. if (!error)
  3289. ima_post_path_mknod(dentry);
  3290. break;
  3291. case S_IFCHR: case S_IFBLK:
  3292. error = vfs_mknod(path.dentry->d_inode,dentry,mode,
  3293. new_decode_dev(dev));
  3294. break;
  3295. case S_IFIFO: case S_IFSOCK:
  3296. error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
  3297. break;
  3298. }
  3299. out:
  3300. done_path_create(&path, dentry);
  3301. if (retry_estale(error, lookup_flags)) {
  3302. lookup_flags |= LOOKUP_REVAL;
  3303. goto retry;
  3304. }
  3305. return error;
  3306. }
  3307. SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
  3308. unsigned int, dev)
  3309. {
  3310. return do_mknodat(dfd, filename, mode, dev);
  3311. }
  3312. SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
  3313. {
  3314. return do_mknodat(AT_FDCWD, filename, mode, dev);
  3315. }
  3316. int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
  3317. {
  3318. int error = may_create(dir, dentry);
  3319. unsigned max_links = dir->i_sb->s_max_links;
  3320. if (error)
  3321. return error;
  3322. if (!dir->i_op->mkdir)
  3323. return -EPERM;
  3324. mode &= (S_IRWXUGO|S_ISVTX);
  3325. error = security_inode_mkdir(dir, dentry, mode);
  3326. if (error)
  3327. return error;
  3328. if (max_links && dir->i_nlink >= max_links)
  3329. return -EMLINK;
  3330. error = dir->i_op->mkdir(dir, dentry, mode);
  3331. if (!error)
  3332. fsnotify_mkdir(dir, dentry);
  3333. return error;
  3334. }
  3335. EXPORT_SYMBOL_NS(vfs_mkdir, ANDROID_GKI_VFS_EXPORT_ONLY);
  3336. static long do_mkdirat(int dfd, const char __user *pathname, umode_t mode)
  3337. {
  3338. struct dentry *dentry;
  3339. struct path path;
  3340. int error;
  3341. unsigned int lookup_flags = LOOKUP_DIRECTORY;
  3342. retry:
  3343. dentry = user_path_create(dfd, pathname, &path, lookup_flags);
  3344. if (IS_ERR(dentry))
  3345. return PTR_ERR(dentry);
  3346. if (!IS_POSIXACL(path.dentry->d_inode))
  3347. mode &= ~current_umask();
  3348. error = security_path_mkdir(&path, dentry, mode);
  3349. if (!error)
  3350. error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
  3351. done_path_create(&path, dentry);
  3352. if (retry_estale(error, lookup_flags)) {
  3353. lookup_flags |= LOOKUP_REVAL;
  3354. goto retry;
  3355. }
  3356. return error;
  3357. }
  3358. SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
  3359. {
  3360. return do_mkdirat(dfd, pathname, mode);
  3361. }
  3362. SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
  3363. {
  3364. return do_mkdirat(AT_FDCWD, pathname, mode);
  3365. }
  3366. int vfs_rmdir(struct inode *dir, struct dentry *dentry)
  3367. {
  3368. int error = may_delete(dir, dentry, 1);
  3369. if (error)
  3370. return error;
  3371. if (!dir->i_op->rmdir)
  3372. return -EPERM;
  3373. dget(dentry);
  3374. inode_lock(dentry->d_inode);
  3375. error = -EBUSY;
  3376. if (is_local_mountpoint(dentry))
  3377. goto out;
  3378. error = security_inode_rmdir(dir, dentry);
  3379. if (error)
  3380. goto out;
  3381. error = dir->i_op->rmdir(dir, dentry);
  3382. if (error)
  3383. goto out;
  3384. shrink_dcache_parent(dentry);
  3385. dentry->d_inode->i_flags |= S_DEAD;
  3386. dont_mount(dentry);
  3387. detach_mounts(dentry);
  3388. out:
  3389. inode_unlock(dentry->d_inode);
  3390. dput(dentry);
  3391. if (!error)
  3392. d_delete_notify(dir, dentry);
  3393. return error;
  3394. }
  3395. EXPORT_SYMBOL_NS(vfs_rmdir, ANDROID_GKI_VFS_EXPORT_ONLY);
  3396. long do_rmdir(int dfd, struct filename *name)
  3397. {
  3398. int error = 0;
  3399. struct dentry *dentry;
  3400. struct path path;
  3401. struct qstr last;
  3402. int type;
  3403. unsigned int lookup_flags = 0;
  3404. retry:
  3405. name = filename_parentat(dfd, name, lookup_flags,
  3406. &path, &last, &type);
  3407. if (IS_ERR(name))
  3408. return PTR_ERR(name);
  3409. switch (type) {
  3410. case LAST_DOTDOT:
  3411. error = -ENOTEMPTY;
  3412. goto exit1;
  3413. case LAST_DOT:
  3414. error = -EINVAL;
  3415. goto exit1;
  3416. case LAST_ROOT:
  3417. error = -EBUSY;
  3418. goto exit1;
  3419. }
  3420. error = mnt_want_write(path.mnt);
  3421. if (error)
  3422. goto exit1;
  3423. inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
  3424. dentry = __lookup_hash(&last, path.dentry, lookup_flags);
  3425. error = PTR_ERR(dentry);
  3426. if (IS_ERR(dentry))
  3427. goto exit2;
  3428. if (!dentry->d_inode) {
  3429. error = -ENOENT;
  3430. goto exit3;
  3431. }
  3432. error = security_path_rmdir(&path, dentry);
  3433. if (error)
  3434. goto exit3;
  3435. error = vfs_rmdir(path.dentry->d_inode, dentry);
  3436. exit3:
  3437. dput(dentry);
  3438. exit2:
  3439. inode_unlock(path.dentry->d_inode);
  3440. mnt_drop_write(path.mnt);
  3441. exit1:
  3442. path_put(&path);
  3443. if (retry_estale(error, lookup_flags)) {
  3444. lookup_flags |= LOOKUP_REVAL;
  3445. goto retry;
  3446. }
  3447. putname(name);
  3448. return error;
  3449. }
  3450. SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
  3451. {
  3452. return do_rmdir(AT_FDCWD, getname(pathname));
  3453. }
  3454. /**
  3455. * vfs_unlink - unlink a filesystem object
  3456. * @dir: parent directory
  3457. * @dentry: victim
  3458. * @delegated_inode: returns victim inode, if the inode is delegated.
  3459. *
  3460. * The caller must hold dir->i_mutex.
  3461. *
  3462. * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and
  3463. * return a reference to the inode in delegated_inode. The caller
  3464. * should then break the delegation on that inode and retry. Because
  3465. * breaking a delegation may take a long time, the caller should drop
  3466. * dir->i_mutex before doing so.
  3467. *
  3468. * Alternatively, a caller may pass NULL for delegated_inode. This may
  3469. * be appropriate for callers that expect the underlying filesystem not
  3470. * to be NFS exported.
  3471. */
  3472. int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode)
  3473. {
  3474. struct inode *target = dentry->d_inode;
  3475. int error = may_delete(dir, dentry, 0);
  3476. if (error)
  3477. return error;
  3478. if (!dir->i_op->unlink)
  3479. return -EPERM;
  3480. inode_lock(target);
  3481. if (is_local_mountpoint(dentry))
  3482. error = -EBUSY;
  3483. else {
  3484. error = security_inode_unlink(dir, dentry);
  3485. if (!error) {
  3486. error = try_break_deleg(target, delegated_inode);
  3487. if (error)
  3488. goto out;
  3489. error = dir->i_op->unlink(dir, dentry);
  3490. if (!error) {
  3491. dont_mount(dentry);
  3492. detach_mounts(dentry);
  3493. }
  3494. }
  3495. }
  3496. out:
  3497. inode_unlock(target);
  3498. /* We don't d_delete() NFS sillyrenamed files--they still exist. */
  3499. if (!error && dentry->d_flags & DCACHE_NFSFS_RENAMED) {
  3500. fsnotify_unlink(dir, dentry);
  3501. } else if (!error) {
  3502. fsnotify_link_count(target);
  3503. d_delete_notify(dir, dentry);
  3504. }
  3505. return error;
  3506. }
  3507. EXPORT_SYMBOL_NS(vfs_unlink, ANDROID_GKI_VFS_EXPORT_ONLY);
  3508. /*
  3509. * Make sure that the actual truncation of the file will occur outside its
  3510. * directory's i_mutex. Truncate can take a long time if there is a lot of
  3511. * writeout happening, and we don't want to prevent access to the directory
  3512. * while waiting on the I/O.
  3513. */
  3514. long do_unlinkat(int dfd, struct filename *name)
  3515. {
  3516. int error;
  3517. struct dentry *dentry;
  3518. struct path path;
  3519. struct qstr last;
  3520. int type;
  3521. struct inode *inode = NULL;
  3522. struct inode *delegated_inode = NULL;
  3523. unsigned int lookup_flags = 0;
  3524. retry:
  3525. name = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
  3526. if (IS_ERR(name))
  3527. return PTR_ERR(name);
  3528. error = -EISDIR;
  3529. if (type != LAST_NORM)
  3530. goto exit1;
  3531. error = mnt_want_write(path.mnt);
  3532. if (error)
  3533. goto exit1;
  3534. retry_deleg:
  3535. inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
  3536. dentry = __lookup_hash(&last, path.dentry, lookup_flags);
  3537. error = PTR_ERR(dentry);
  3538. if (!IS_ERR(dentry)) {
  3539. /* Why not before? Because we want correct error value */
  3540. if (last.name[last.len])
  3541. goto slashes;
  3542. inode = dentry->d_inode;
  3543. if (d_is_negative(dentry))
  3544. goto slashes;
  3545. ihold(inode);
  3546. error = security_path_unlink(&path, dentry);
  3547. if (error)
  3548. goto exit2;
  3549. error = vfs_unlink(path.dentry->d_inode, dentry, &delegated_inode);
  3550. exit2:
  3551. dput(dentry);
  3552. }
  3553. inode_unlock(path.dentry->d_inode);
  3554. if (inode)
  3555. iput(inode); /* truncate the inode here */
  3556. inode = NULL;
  3557. if (delegated_inode) {
  3558. error = break_deleg_wait(&delegated_inode);
  3559. if (!error)
  3560. goto retry_deleg;
  3561. }
  3562. mnt_drop_write(path.mnt);
  3563. exit1:
  3564. path_put(&path);
  3565. if (retry_estale(error, lookup_flags)) {
  3566. lookup_flags |= LOOKUP_REVAL;
  3567. inode = NULL;
  3568. goto retry;
  3569. }
  3570. putname(name);
  3571. return error;
  3572. slashes:
  3573. if (d_is_negative(dentry))
  3574. error = -ENOENT;
  3575. else if (d_is_dir(dentry))
  3576. error = -EISDIR;
  3577. else
  3578. error = -ENOTDIR;
  3579. goto exit2;
  3580. }
  3581. SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
  3582. {
  3583. if ((flag & ~AT_REMOVEDIR) != 0)
  3584. return -EINVAL;
  3585. if (flag & AT_REMOVEDIR)
  3586. return do_rmdir(dfd, getname(pathname));
  3587. return do_unlinkat(dfd, getname(pathname));
  3588. }
  3589. SYSCALL_DEFINE1(unlink, const char __user *, pathname)
  3590. {
  3591. return do_unlinkat(AT_FDCWD, getname(pathname));
  3592. }
  3593. int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
  3594. {
  3595. int error = may_create(dir, dentry);
  3596. if (error)
  3597. return error;
  3598. if (!dir->i_op->symlink)
  3599. return -EPERM;
  3600. error = security_inode_symlink(dir, dentry, oldname);
  3601. if (error)
  3602. return error;
  3603. error = dir->i_op->symlink(dir, dentry, oldname);
  3604. if (!error)
  3605. fsnotify_create(dir, dentry);
  3606. return error;
  3607. }
  3608. EXPORT_SYMBOL(vfs_symlink);
  3609. static long do_symlinkat(const char __user *oldname, int newdfd,
  3610. const char __user *newname)
  3611. {
  3612. int error;
  3613. struct filename *from;
  3614. struct dentry *dentry;
  3615. struct path path;
  3616. unsigned int lookup_flags = 0;
  3617. from = getname(oldname);
  3618. if (IS_ERR(from))
  3619. return PTR_ERR(from);
  3620. retry:
  3621. dentry = user_path_create(newdfd, newname, &path, lookup_flags);
  3622. error = PTR_ERR(dentry);
  3623. if (IS_ERR(dentry))
  3624. goto out_putname;
  3625. error = security_path_symlink(&path, dentry, from->name);
  3626. if (!error)
  3627. error = vfs_symlink(path.dentry->d_inode, dentry, from->name);
  3628. done_path_create(&path, dentry);
  3629. if (retry_estale(error, lookup_flags)) {
  3630. lookup_flags |= LOOKUP_REVAL;
  3631. goto retry;
  3632. }
  3633. out_putname:
  3634. putname(from);
  3635. return error;
  3636. }
  3637. SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
  3638. int, newdfd, const char __user *, newname)
  3639. {
  3640. return do_symlinkat(oldname, newdfd, newname);
  3641. }
  3642. SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
  3643. {
  3644. return do_symlinkat(oldname, AT_FDCWD, newname);
  3645. }
  3646. /**
  3647. * vfs_link - create a new link
  3648. * @old_dentry: object to be linked
  3649. * @dir: new parent
  3650. * @new_dentry: where to create the new link
  3651. * @delegated_inode: returns inode needing a delegation break
  3652. *
  3653. * The caller must hold dir->i_mutex
  3654. *
  3655. * If vfs_link discovers a delegation on the to-be-linked file in need
  3656. * of breaking, it will return -EWOULDBLOCK and return a reference to the
  3657. * inode in delegated_inode. The caller should then break the delegation
  3658. * and retry. Because breaking a delegation may take a long time, the
  3659. * caller should drop the i_mutex before doing so.
  3660. *
  3661. * Alternatively, a caller may pass NULL for delegated_inode. This may
  3662. * be appropriate for callers that expect the underlying filesystem not
  3663. * to be NFS exported.
  3664. */
  3665. int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode)
  3666. {
  3667. struct inode *inode = old_dentry->d_inode;
  3668. unsigned max_links = dir->i_sb->s_max_links;
  3669. int error;
  3670. if (!inode)
  3671. return -ENOENT;
  3672. error = may_create(dir, new_dentry);
  3673. if (error)
  3674. return error;
  3675. if (dir->i_sb != inode->i_sb)
  3676. return -EXDEV;
  3677. /*
  3678. * A link to an append-only or immutable file cannot be created.
  3679. */
  3680. if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
  3681. return -EPERM;
  3682. /*
  3683. * Updating the link count will likely cause i_uid and i_gid to
  3684. * be writen back improperly if their true value is unknown to
  3685. * the vfs.
  3686. */
  3687. if (HAS_UNMAPPED_ID(inode))
  3688. return -EPERM;
  3689. if (!dir->i_op->link)
  3690. return -EPERM;
  3691. if (S_ISDIR(inode->i_mode))
  3692. return -EPERM;
  3693. error = security_inode_link(old_dentry, dir, new_dentry);
  3694. if (error)
  3695. return error;
  3696. inode_lock(inode);
  3697. /* Make sure we don't allow creating hardlink to an unlinked file */
  3698. if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
  3699. error = -ENOENT;
  3700. else if (max_links && inode->i_nlink >= max_links)
  3701. error = -EMLINK;
  3702. else {
  3703. error = try_break_deleg(inode, delegated_inode);
  3704. if (!error)
  3705. error = dir->i_op->link(old_dentry, dir, new_dentry);
  3706. }
  3707. if (!error && (inode->i_state & I_LINKABLE)) {
  3708. spin_lock(&inode->i_lock);
  3709. inode->i_state &= ~I_LINKABLE;
  3710. spin_unlock(&inode->i_lock);
  3711. }
  3712. inode_unlock(inode);
  3713. if (!error)
  3714. fsnotify_link(dir, inode, new_dentry);
  3715. return error;
  3716. }
  3717. EXPORT_SYMBOL_NS(vfs_link, ANDROID_GKI_VFS_EXPORT_ONLY);
  3718. /*
  3719. * Hardlinks are often used in delicate situations. We avoid
  3720. * security-related surprises by not following symlinks on the
  3721. * newname. --KAB
  3722. *
  3723. * We don't follow them on the oldname either to be compatible
  3724. * with linux 2.0, and to avoid hard-linking to directories
  3725. * and other special files. --ADM
  3726. */
  3727. static int do_linkat(int olddfd, const char __user *oldname, int newdfd,
  3728. const char __user *newname, int flags)
  3729. {
  3730. struct dentry *new_dentry;
  3731. struct path old_path, new_path;
  3732. struct inode *delegated_inode = NULL;
  3733. int how = 0;
  3734. int error;
  3735. if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
  3736. return -EINVAL;
  3737. /*
  3738. * To use null names we require CAP_DAC_READ_SEARCH
  3739. * This ensures that not everyone will be able to create
  3740. * handlink using the passed filedescriptor.
  3741. */
  3742. if (flags & AT_EMPTY_PATH) {
  3743. if (!capable(CAP_DAC_READ_SEARCH))
  3744. return -ENOENT;
  3745. how = LOOKUP_EMPTY;
  3746. }
  3747. if (flags & AT_SYMLINK_FOLLOW)
  3748. how |= LOOKUP_FOLLOW;
  3749. retry:
  3750. error = user_path_at(olddfd, oldname, how, &old_path);
  3751. if (error)
  3752. return error;
  3753. new_dentry = user_path_create(newdfd, newname, &new_path,
  3754. (how & LOOKUP_REVAL));
  3755. error = PTR_ERR(new_dentry);
  3756. if (IS_ERR(new_dentry))
  3757. goto out;
  3758. error = -EXDEV;
  3759. if (old_path.mnt != new_path.mnt)
  3760. goto out_dput;
  3761. error = may_linkat(&old_path);
  3762. if (unlikely(error))
  3763. goto out_dput;
  3764. error = security_path_link(old_path.dentry, &new_path, new_dentry);
  3765. if (error)
  3766. goto out_dput;
  3767. error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode);
  3768. out_dput:
  3769. done_path_create(&new_path, new_dentry);
  3770. if (delegated_inode) {
  3771. error = break_deleg_wait(&delegated_inode);
  3772. if (!error) {
  3773. path_put(&old_path);
  3774. goto retry;
  3775. }
  3776. }
  3777. if (retry_estale(error, how)) {
  3778. path_put(&old_path);
  3779. how |= LOOKUP_REVAL;
  3780. goto retry;
  3781. }
  3782. out:
  3783. path_put(&old_path);
  3784. return error;
  3785. }
  3786. SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  3787. int, newdfd, const char __user *, newname, int, flags)
  3788. {
  3789. return do_linkat(olddfd, oldname, newdfd, newname, flags);
  3790. }
  3791. SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
  3792. {
  3793. return do_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
  3794. }
  3795. /**
  3796. * vfs_rename - rename a filesystem object
  3797. * @old_dir: parent of source
  3798. * @old_dentry: source
  3799. * @new_dir: parent of destination
  3800. * @new_dentry: destination
  3801. * @delegated_inode: returns an inode needing a delegation break
  3802. * @flags: rename flags
  3803. *
  3804. * The caller must hold multiple mutexes--see lock_rename()).
  3805. *
  3806. * If vfs_rename discovers a delegation in need of breaking at either
  3807. * the source or destination, it will return -EWOULDBLOCK and return a
  3808. * reference to the inode in delegated_inode. The caller should then
  3809. * break the delegation and retry. Because breaking a delegation may
  3810. * take a long time, the caller should drop all locks before doing
  3811. * so.
  3812. *
  3813. * Alternatively, a caller may pass NULL for delegated_inode. This may
  3814. * be appropriate for callers that expect the underlying filesystem not
  3815. * to be NFS exported.
  3816. *
  3817. * The worst of all namespace operations - renaming directory. "Perverted"
  3818. * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
  3819. * Problems:
  3820. *
  3821. * a) we can get into loop creation.
  3822. * b) race potential - two innocent renames can create a loop together.
  3823. * That's where 4.4 screws up. Current fix: serialization on
  3824. * sb->s_vfs_rename_mutex. We might be more accurate, but that's another
  3825. * story.
  3826. * c) we have to lock _four_ objects - parents and victim (if it exists),
  3827. * and source (if it is not a directory).
  3828. * And that - after we got ->i_mutex on parents (until then we don't know
  3829. * whether the target exists). Solution: try to be smart with locking
  3830. * order for inodes. We rely on the fact that tree topology may change
  3831. * only under ->s_vfs_rename_mutex _and_ that parent of the object we
  3832. * move will be locked. Thus we can rank directories by the tree
  3833. * (ancestors first) and rank all non-directories after them.
  3834. * That works since everybody except rename does "lock parent, lookup,
  3835. * lock child" and rename is under ->s_vfs_rename_mutex.
  3836. * HOWEVER, it relies on the assumption that any object with ->lookup()
  3837. * has no more than 1 dentry. If "hybrid" objects will ever appear,
  3838. * we'd better make sure that there's no link(2) for them.
  3839. * d) conversion from fhandle to dentry may come in the wrong moment - when
  3840. * we are removing the target. Solution: we will have to grab ->i_mutex
  3841. * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
  3842. * ->i_mutex on parents, which works but leads to some truly excessive
  3843. * locking].
  3844. */
  3845. int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
  3846. struct inode *new_dir, struct dentry *new_dentry,
  3847. struct inode **delegated_inode, unsigned int flags)
  3848. {
  3849. int error;
  3850. bool is_dir = d_is_dir(old_dentry);
  3851. struct inode *source = old_dentry->d_inode;
  3852. struct inode *target = new_dentry->d_inode;
  3853. bool new_is_dir = false;
  3854. unsigned max_links = new_dir->i_sb->s_max_links;
  3855. struct name_snapshot old_name;
  3856. if (source == target)
  3857. return 0;
  3858. error = may_delete(old_dir, old_dentry, is_dir);
  3859. if (error)
  3860. return error;
  3861. if (!target) {
  3862. error = may_create(new_dir, new_dentry);
  3863. } else {
  3864. new_is_dir = d_is_dir(new_dentry);
  3865. if (!(flags & RENAME_EXCHANGE))
  3866. error = may_delete(new_dir, new_dentry, is_dir);
  3867. else
  3868. error = may_delete(new_dir, new_dentry, new_is_dir);
  3869. }
  3870. if (error)
  3871. return error;
  3872. if (!old_dir->i_op->rename)
  3873. return -EPERM;
  3874. /*
  3875. * If we are going to change the parent - check write permissions,
  3876. * we'll need to flip '..'.
  3877. */
  3878. if (new_dir != old_dir) {
  3879. if (is_dir) {
  3880. error = inode_permission(source, MAY_WRITE);
  3881. if (error)
  3882. return error;
  3883. }
  3884. if ((flags & RENAME_EXCHANGE) && new_is_dir) {
  3885. error = inode_permission(target, MAY_WRITE);
  3886. if (error)
  3887. return error;
  3888. }
  3889. }
  3890. error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
  3891. flags);
  3892. if (error)
  3893. return error;
  3894. take_dentry_name_snapshot(&old_name, old_dentry);
  3895. dget(new_dentry);
  3896. if (!is_dir || (flags & RENAME_EXCHANGE))
  3897. lock_two_nondirectories(source, target);
  3898. else if (target)
  3899. inode_lock(target);
  3900. error = -EBUSY;
  3901. if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
  3902. goto out;
  3903. if (max_links && new_dir != old_dir) {
  3904. error = -EMLINK;
  3905. if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
  3906. goto out;
  3907. if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
  3908. old_dir->i_nlink >= max_links)
  3909. goto out;
  3910. }
  3911. if (!is_dir) {
  3912. error = try_break_deleg(source, delegated_inode);
  3913. if (error)
  3914. goto out;
  3915. }
  3916. if (target && !new_is_dir) {
  3917. error = try_break_deleg(target, delegated_inode);
  3918. if (error)
  3919. goto out;
  3920. }
  3921. error = old_dir->i_op->rename(old_dir, old_dentry,
  3922. new_dir, new_dentry, flags);
  3923. if (error)
  3924. goto out;
  3925. if (!(flags & RENAME_EXCHANGE) && target) {
  3926. if (is_dir) {
  3927. shrink_dcache_parent(new_dentry);
  3928. target->i_flags |= S_DEAD;
  3929. }
  3930. dont_mount(new_dentry);
  3931. detach_mounts(new_dentry);
  3932. }
  3933. if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
  3934. if (!(flags & RENAME_EXCHANGE))
  3935. d_move(old_dentry, new_dentry);
  3936. else
  3937. d_exchange(old_dentry, new_dentry);
  3938. }
  3939. out:
  3940. if (!is_dir || (flags & RENAME_EXCHANGE))
  3941. unlock_two_nondirectories(source, target);
  3942. else if (target)
  3943. inode_unlock(target);
  3944. dput(new_dentry);
  3945. if (!error) {
  3946. fsnotify_move(old_dir, new_dir, &old_name.name, is_dir,
  3947. !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
  3948. if (flags & RENAME_EXCHANGE) {
  3949. fsnotify_move(new_dir, old_dir, &old_dentry->d_name,
  3950. new_is_dir, NULL, new_dentry);
  3951. }
  3952. }
  3953. release_dentry_name_snapshot(&old_name);
  3954. return error;
  3955. }
  3956. EXPORT_SYMBOL_NS(vfs_rename, ANDROID_GKI_VFS_EXPORT_ONLY);
  3957. static int do_renameat2(int olddfd, const char __user *oldname, int newdfd,
  3958. const char __user *newname, unsigned int flags)
  3959. {
  3960. struct dentry *old_dentry, *new_dentry;
  3961. struct dentry *trap;
  3962. struct path old_path, new_path;
  3963. struct qstr old_last, new_last;
  3964. int old_type, new_type;
  3965. struct inode *delegated_inode = NULL;
  3966. struct filename *from;
  3967. struct filename *to;
  3968. unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
  3969. bool should_retry = false;
  3970. int error;
  3971. if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
  3972. return -EINVAL;
  3973. if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
  3974. (flags & RENAME_EXCHANGE))
  3975. return -EINVAL;
  3976. if (flags & RENAME_EXCHANGE)
  3977. target_flags = 0;
  3978. retry:
  3979. from = filename_parentat(olddfd, getname(oldname), lookup_flags,
  3980. &old_path, &old_last, &old_type);
  3981. if (IS_ERR(from)) {
  3982. error = PTR_ERR(from);
  3983. goto exit;
  3984. }
  3985. to = filename_parentat(newdfd, getname(newname), lookup_flags,
  3986. &new_path, &new_last, &new_type);
  3987. if (IS_ERR(to)) {
  3988. error = PTR_ERR(to);
  3989. goto exit1;
  3990. }
  3991. error = -EXDEV;
  3992. if (old_path.mnt != new_path.mnt)
  3993. goto exit2;
  3994. error = -EBUSY;
  3995. if (old_type != LAST_NORM)
  3996. goto exit2;
  3997. if (flags & RENAME_NOREPLACE)
  3998. error = -EEXIST;
  3999. if (new_type != LAST_NORM)
  4000. goto exit2;
  4001. error = mnt_want_write(old_path.mnt);
  4002. if (error)
  4003. goto exit2;
  4004. retry_deleg:
  4005. trap = lock_rename(new_path.dentry, old_path.dentry);
  4006. old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags);
  4007. error = PTR_ERR(old_dentry);
  4008. if (IS_ERR(old_dentry))
  4009. goto exit3;
  4010. /* source must exist */
  4011. error = -ENOENT;
  4012. if (d_is_negative(old_dentry))
  4013. goto exit4;
  4014. new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags);
  4015. error = PTR_ERR(new_dentry);
  4016. if (IS_ERR(new_dentry))
  4017. goto exit4;
  4018. error = -EEXIST;
  4019. if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
  4020. goto exit5;
  4021. if (flags & RENAME_EXCHANGE) {
  4022. error = -ENOENT;
  4023. if (d_is_negative(new_dentry))
  4024. goto exit5;
  4025. if (!d_is_dir(new_dentry)) {
  4026. error = -ENOTDIR;
  4027. if (new_last.name[new_last.len])
  4028. goto exit5;
  4029. }
  4030. }
  4031. /* unless the source is a directory trailing slashes give -ENOTDIR */
  4032. if (!d_is_dir(old_dentry)) {
  4033. error = -ENOTDIR;
  4034. if (old_last.name[old_last.len])
  4035. goto exit5;
  4036. if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
  4037. goto exit5;
  4038. }
  4039. /* source should not be ancestor of target */
  4040. error = -EINVAL;
  4041. if (old_dentry == trap)
  4042. goto exit5;
  4043. /* target should not be an ancestor of source */
  4044. if (!(flags & RENAME_EXCHANGE))
  4045. error = -ENOTEMPTY;
  4046. if (new_dentry == trap)
  4047. goto exit5;
  4048. error = security_path_rename(&old_path, old_dentry,
  4049. &new_path, new_dentry, flags);
  4050. if (error)
  4051. goto exit5;
  4052. error = vfs_rename(old_path.dentry->d_inode, old_dentry,
  4053. new_path.dentry->d_inode, new_dentry,
  4054. &delegated_inode, flags);
  4055. exit5:
  4056. dput(new_dentry);
  4057. exit4:
  4058. dput(old_dentry);
  4059. exit3:
  4060. unlock_rename(new_path.dentry, old_path.dentry);
  4061. if (delegated_inode) {
  4062. error = break_deleg_wait(&delegated_inode);
  4063. if (!error)
  4064. goto retry_deleg;
  4065. }
  4066. mnt_drop_write(old_path.mnt);
  4067. exit2:
  4068. if (retry_estale(error, lookup_flags))
  4069. should_retry = true;
  4070. path_put(&new_path);
  4071. putname(to);
  4072. exit1:
  4073. path_put(&old_path);
  4074. putname(from);
  4075. if (should_retry) {
  4076. should_retry = false;
  4077. lookup_flags |= LOOKUP_REVAL;
  4078. goto retry;
  4079. }
  4080. exit:
  4081. return error;
  4082. }
  4083. SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
  4084. int, newdfd, const char __user *, newname, unsigned int, flags)
  4085. {
  4086. return do_renameat2(olddfd, oldname, newdfd, newname, flags);
  4087. }
  4088. SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
  4089. int, newdfd, const char __user *, newname)
  4090. {
  4091. return do_renameat2(olddfd, oldname, newdfd, newname, 0);
  4092. }
  4093. SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
  4094. {
  4095. return do_renameat2(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
  4096. }
  4097. int readlink_copy(char __user *buffer, int buflen, const char *link)
  4098. {
  4099. int len = PTR_ERR(link);
  4100. if (IS_ERR(link))
  4101. goto out;
  4102. len = strlen(link);
  4103. if (len > (unsigned) buflen)
  4104. len = buflen;
  4105. if (copy_to_user(buffer, link, len))
  4106. len = -EFAULT;
  4107. out:
  4108. return len;
  4109. }
  4110. /**
  4111. * vfs_readlink - copy symlink body into userspace buffer
  4112. * @dentry: dentry on which to get symbolic link
  4113. * @buffer: user memory pointer
  4114. * @buflen: size of buffer
  4115. *
  4116. * Does not touch atime. That's up to the caller if necessary
  4117. *
  4118. * Does not call security hook.
  4119. */
  4120. int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
  4121. {
  4122. struct inode *inode = d_inode(dentry);
  4123. DEFINE_DELAYED_CALL(done);
  4124. const char *link;
  4125. int res;
  4126. if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) {
  4127. if (unlikely(inode->i_op->readlink))
  4128. return inode->i_op->readlink(dentry, buffer, buflen);
  4129. if (!d_is_symlink(dentry))
  4130. return -EINVAL;
  4131. spin_lock(&inode->i_lock);
  4132. inode->i_opflags |= IOP_DEFAULT_READLINK;
  4133. spin_unlock(&inode->i_lock);
  4134. }
  4135. link = READ_ONCE(inode->i_link);
  4136. if (!link) {
  4137. link = inode->i_op->get_link(dentry, inode, &done);
  4138. if (IS_ERR(link))
  4139. return PTR_ERR(link);
  4140. }
  4141. res = readlink_copy(buffer, buflen, link);
  4142. do_delayed_call(&done);
  4143. return res;
  4144. }
  4145. EXPORT_SYMBOL(vfs_readlink);
  4146. /**
  4147. * vfs_get_link - get symlink body
  4148. * @dentry: dentry on which to get symbolic link
  4149. * @done: caller needs to free returned data with this
  4150. *
  4151. * Calls security hook and i_op->get_link() on the supplied inode.
  4152. *
  4153. * It does not touch atime. That's up to the caller if necessary.
  4154. *
  4155. * Does not work on "special" symlinks like /proc/$$/fd/N
  4156. */
  4157. const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
  4158. {
  4159. const char *res = ERR_PTR(-EINVAL);
  4160. struct inode *inode = d_inode(dentry);
  4161. if (d_is_symlink(dentry)) {
  4162. res = ERR_PTR(security_inode_readlink(dentry));
  4163. if (!res)
  4164. res = inode->i_op->get_link(dentry, inode, done);
  4165. }
  4166. return res;
  4167. }
  4168. EXPORT_SYMBOL(vfs_get_link);
  4169. /* get the link contents into pagecache */
  4170. const char *page_get_link(struct dentry *dentry, struct inode *inode,
  4171. struct delayed_call *callback)
  4172. {
  4173. char *kaddr;
  4174. struct page *page;
  4175. struct address_space *mapping = inode->i_mapping;
  4176. if (!dentry) {
  4177. page = find_get_page(mapping, 0);
  4178. if (!page)
  4179. return ERR_PTR(-ECHILD);
  4180. if (!PageUptodate(page)) {
  4181. put_page(page);
  4182. return ERR_PTR(-ECHILD);
  4183. }
  4184. } else {
  4185. page = read_mapping_page(mapping, 0, NULL);
  4186. if (IS_ERR(page))
  4187. return (char*)page;
  4188. }
  4189. set_delayed_call(callback, page_put_link, page);
  4190. BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
  4191. kaddr = page_address(page);
  4192. nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
  4193. return kaddr;
  4194. }
  4195. EXPORT_SYMBOL(page_get_link);
  4196. void page_put_link(void *arg)
  4197. {
  4198. put_page(arg);
  4199. }
  4200. EXPORT_SYMBOL(page_put_link);
  4201. int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
  4202. {
  4203. DEFINE_DELAYED_CALL(done);
  4204. int res = readlink_copy(buffer, buflen,
  4205. page_get_link(dentry, d_inode(dentry),
  4206. &done));
  4207. do_delayed_call(&done);
  4208. return res;
  4209. }
  4210. EXPORT_SYMBOL(page_readlink);
  4211. /*
  4212. * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
  4213. */
  4214. int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
  4215. {
  4216. struct address_space *mapping = inode->i_mapping;
  4217. struct page *page;
  4218. void *fsdata;
  4219. int err;
  4220. unsigned int flags = 0;
  4221. if (nofs)
  4222. flags |= AOP_FLAG_NOFS;
  4223. retry:
  4224. err = pagecache_write_begin(NULL, mapping, 0, len-1,
  4225. flags, &page, &fsdata);
  4226. if (err)
  4227. goto fail;
  4228. memcpy(page_address(page), symname, len-1);
  4229. err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
  4230. page, fsdata);
  4231. if (err < 0)
  4232. goto fail;
  4233. if (err < len-1)
  4234. goto retry;
  4235. mark_inode_dirty(inode);
  4236. return 0;
  4237. fail:
  4238. return err;
  4239. }
  4240. EXPORT_SYMBOL(__page_symlink);
  4241. int page_symlink(struct inode *inode, const char *symname, int len)
  4242. {
  4243. return __page_symlink(inode, symname, len,
  4244. !mapping_gfp_constraint(inode->i_mapping, __GFP_FS));
  4245. }
  4246. EXPORT_SYMBOL(page_symlink);
  4247. const struct inode_operations page_symlink_inode_operations = {
  4248. .get_link = page_get_link,
  4249. };
  4250. EXPORT_SYMBOL(page_symlink_inode_operations);