namespace.c 99 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * linux/fs/namespace.c
  4. *
  5. * (C) Copyright Al Viro 2000, 2001
  6. *
  7. * Based on code from fs/super.c, copyright Linus Torvalds and others.
  8. * Heavily rewritten.
  9. */
  10. #include <linux/syscalls.h>
  11. #include <linux/export.h>
  12. #include <linux/capability.h>
  13. #include <linux/mnt_namespace.h>
  14. #include <linux/user_namespace.h>
  15. #include <linux/namei.h>
  16. #include <linux/security.h>
  17. #include <linux/cred.h>
  18. #include <linux/idr.h>
  19. #include <linux/init.h> /* init_rootfs */
  20. #include <linux/fs_struct.h> /* get_fs_root et.al. */
  21. #include <linux/fsnotify.h> /* fsnotify_vfsmount_delete */
  22. #include <linux/file.h>
  23. #include <linux/uaccess.h>
  24. #include <linux/proc_ns.h>
  25. #include <linux/magic.h>
  26. #include <linux/memblock.h>
  27. #include <linux/task_work.h>
  28. #include <linux/sched/task.h>
  29. #include <uapi/linux/mount.h>
  30. #include <linux/fs_context.h>
  31. #include <linux/shmem_fs.h>
  32. #include "pnode.h"
  33. #include "internal.h"
  34. /* Maximum number of mounts in a mount namespace */
  35. unsigned int sysctl_mount_max __read_mostly = 100000;
  36. static unsigned int m_hash_mask __read_mostly;
  37. static unsigned int m_hash_shift __read_mostly;
  38. static unsigned int mp_hash_mask __read_mostly;
  39. static unsigned int mp_hash_shift __read_mostly;
  40. static __initdata unsigned long mhash_entries;
  41. static int __init set_mhash_entries(char *str)
  42. {
  43. if (!str)
  44. return 0;
  45. mhash_entries = simple_strtoul(str, &str, 0);
  46. return 1;
  47. }
  48. __setup("mhash_entries=", set_mhash_entries);
  49. static __initdata unsigned long mphash_entries;
  50. static int __init set_mphash_entries(char *str)
  51. {
  52. if (!str)
  53. return 0;
  54. mphash_entries = simple_strtoul(str, &str, 0);
  55. return 1;
  56. }
  57. __setup("mphash_entries=", set_mphash_entries);
  58. static u64 event;
  59. static DEFINE_IDA(mnt_id_ida);
  60. static DEFINE_IDA(mnt_group_ida);
  61. static struct hlist_head *mount_hashtable __read_mostly;
  62. static struct hlist_head *mountpoint_hashtable __read_mostly;
  63. static struct kmem_cache *mnt_cache __read_mostly;
  64. static DECLARE_RWSEM(namespace_sem);
  65. static HLIST_HEAD(unmounted); /* protected by namespace_sem */
  66. static LIST_HEAD(ex_mountpoints); /* protected by namespace_sem */
  67. /* /sys/fs */
  68. struct kobject *fs_kobj;
  69. EXPORT_SYMBOL_GPL(fs_kobj);
  70. /*
  71. * vfsmount lock may be taken for read to prevent changes to the
  72. * vfsmount hash, ie. during mountpoint lookups or walking back
  73. * up the tree.
  74. *
  75. * It should be taken for write in all cases where the vfsmount
  76. * tree or hash is modified or when a vfsmount structure is modified.
  77. */
  78. __cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock);
  79. static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry)
  80. {
  81. unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES);
  82. tmp += ((unsigned long)dentry / L1_CACHE_BYTES);
  83. tmp = tmp + (tmp >> m_hash_shift);
  84. return &mount_hashtable[tmp & m_hash_mask];
  85. }
  86. static inline struct hlist_head *mp_hash(struct dentry *dentry)
  87. {
  88. unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES);
  89. tmp = tmp + (tmp >> mp_hash_shift);
  90. return &mountpoint_hashtable[tmp & mp_hash_mask];
  91. }
  92. static int mnt_alloc_id(struct mount *mnt)
  93. {
  94. int res = ida_alloc(&mnt_id_ida, GFP_KERNEL);
  95. if (res < 0)
  96. return res;
  97. mnt->mnt_id = res;
  98. return 0;
  99. }
  100. static void mnt_free_id(struct mount *mnt)
  101. {
  102. ida_free(&mnt_id_ida, mnt->mnt_id);
  103. }
  104. /*
  105. * Allocate a new peer group ID
  106. */
  107. static int mnt_alloc_group_id(struct mount *mnt)
  108. {
  109. int res = ida_alloc_min(&mnt_group_ida, 1, GFP_KERNEL);
  110. if (res < 0)
  111. return res;
  112. mnt->mnt_group_id = res;
  113. return 0;
  114. }
  115. /*
  116. * Release a peer group ID
  117. */
  118. void mnt_release_group_id(struct mount *mnt)
  119. {
  120. ida_free(&mnt_group_ida, mnt->mnt_group_id);
  121. mnt->mnt_group_id = 0;
  122. }
  123. /*
  124. * vfsmount lock must be held for read
  125. */
  126. static inline void mnt_add_count(struct mount *mnt, int n)
  127. {
  128. #ifdef CONFIG_SMP
  129. this_cpu_add(mnt->mnt_pcp->mnt_count, n);
  130. #else
  131. preempt_disable();
  132. mnt->mnt_count += n;
  133. preempt_enable();
  134. #endif
  135. }
  136. /*
  137. * vfsmount lock must be held for write
  138. */
  139. int mnt_get_count(struct mount *mnt)
  140. {
  141. #ifdef CONFIG_SMP
  142. int count = 0;
  143. int cpu;
  144. for_each_possible_cpu(cpu) {
  145. count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_count;
  146. }
  147. return count;
  148. #else
  149. return mnt->mnt_count;
  150. #endif
  151. }
  152. static struct mount *alloc_vfsmnt(const char *name)
  153. {
  154. struct mount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL);
  155. if (mnt) {
  156. int err;
  157. err = mnt_alloc_id(mnt);
  158. if (err)
  159. goto out_free_cache;
  160. if (name) {
  161. mnt->mnt_devname = kstrdup_const(name, GFP_KERNEL);
  162. if (!mnt->mnt_devname)
  163. goto out_free_id;
  164. }
  165. #ifdef CONFIG_SMP
  166. mnt->mnt_pcp = alloc_percpu(struct mnt_pcp);
  167. if (!mnt->mnt_pcp)
  168. goto out_free_devname;
  169. this_cpu_add(mnt->mnt_pcp->mnt_count, 1);
  170. #else
  171. mnt->mnt_count = 1;
  172. mnt->mnt_writers = 0;
  173. #endif
  174. INIT_HLIST_NODE(&mnt->mnt_hash);
  175. INIT_LIST_HEAD(&mnt->mnt_child);
  176. INIT_LIST_HEAD(&mnt->mnt_mounts);
  177. INIT_LIST_HEAD(&mnt->mnt_list);
  178. INIT_LIST_HEAD(&mnt->mnt_expire);
  179. INIT_LIST_HEAD(&mnt->mnt_share);
  180. INIT_LIST_HEAD(&mnt->mnt_slave_list);
  181. INIT_LIST_HEAD(&mnt->mnt_slave);
  182. INIT_HLIST_NODE(&mnt->mnt_mp_list);
  183. INIT_LIST_HEAD(&mnt->mnt_umounting);
  184. INIT_HLIST_HEAD(&mnt->mnt_stuck_children);
  185. }
  186. return mnt;
  187. #ifdef CONFIG_SMP
  188. out_free_devname:
  189. kfree_const(mnt->mnt_devname);
  190. #endif
  191. out_free_id:
  192. mnt_free_id(mnt);
  193. out_free_cache:
  194. kmem_cache_free(mnt_cache, mnt);
  195. return NULL;
  196. }
  197. /*
  198. * Most r/o checks on a fs are for operations that take
  199. * discrete amounts of time, like a write() or unlink().
  200. * We must keep track of when those operations start
  201. * (for permission checks) and when they end, so that
  202. * we can determine when writes are able to occur to
  203. * a filesystem.
  204. */
  205. /*
  206. * __mnt_is_readonly: check whether a mount is read-only
  207. * @mnt: the mount to check for its write status
  208. *
  209. * This shouldn't be used directly ouside of the VFS.
  210. * It does not guarantee that the filesystem will stay
  211. * r/w, just that it is right *now*. This can not and
  212. * should not be used in place of IS_RDONLY(inode).
  213. * mnt_want/drop_write() will _keep_ the filesystem
  214. * r/w.
  215. */
  216. bool __mnt_is_readonly(struct vfsmount *mnt)
  217. {
  218. return (mnt->mnt_flags & MNT_READONLY) || sb_rdonly(mnt->mnt_sb);
  219. }
  220. EXPORT_SYMBOL_GPL(__mnt_is_readonly);
  221. static inline void mnt_inc_writers(struct mount *mnt)
  222. {
  223. #ifdef CONFIG_SMP
  224. this_cpu_inc(mnt->mnt_pcp->mnt_writers);
  225. #else
  226. mnt->mnt_writers++;
  227. #endif
  228. }
  229. static inline void mnt_dec_writers(struct mount *mnt)
  230. {
  231. #ifdef CONFIG_SMP
  232. this_cpu_dec(mnt->mnt_pcp->mnt_writers);
  233. #else
  234. mnt->mnt_writers--;
  235. #endif
  236. }
  237. static unsigned int mnt_get_writers(struct mount *mnt)
  238. {
  239. #ifdef CONFIG_SMP
  240. unsigned int count = 0;
  241. int cpu;
  242. for_each_possible_cpu(cpu) {
  243. count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers;
  244. }
  245. return count;
  246. #else
  247. return mnt->mnt_writers;
  248. #endif
  249. }
  250. static int mnt_is_readonly(struct vfsmount *mnt)
  251. {
  252. if (mnt->mnt_sb->s_readonly_remount)
  253. return 1;
  254. /* Order wrt setting s_flags/s_readonly_remount in do_remount() */
  255. smp_rmb();
  256. return __mnt_is_readonly(mnt);
  257. }
  258. /*
  259. * Most r/o & frozen checks on a fs are for operations that take discrete
  260. * amounts of time, like a write() or unlink(). We must keep track of when
  261. * those operations start (for permission checks) and when they end, so that we
  262. * can determine when writes are able to occur to a filesystem.
  263. */
  264. /**
  265. * __mnt_want_write - get write access to a mount without freeze protection
  266. * @m: the mount on which to take a write
  267. *
  268. * This tells the low-level filesystem that a write is about to be performed to
  269. * it, and makes sure that writes are allowed (mnt it read-write) before
  270. * returning success. This operation does not protect against filesystem being
  271. * frozen. When the write operation is finished, __mnt_drop_write() must be
  272. * called. This is effectively a refcount.
  273. */
  274. int __mnt_want_write(struct vfsmount *m)
  275. {
  276. struct mount *mnt = real_mount(m);
  277. int ret = 0;
  278. preempt_disable();
  279. mnt_inc_writers(mnt);
  280. /*
  281. * The store to mnt_inc_writers must be visible before we pass
  282. * MNT_WRITE_HOLD loop below, so that the slowpath can see our
  283. * incremented count after it has set MNT_WRITE_HOLD.
  284. */
  285. smp_mb();
  286. while (READ_ONCE(mnt->mnt.mnt_flags) & MNT_WRITE_HOLD)
  287. cpu_relax();
  288. /*
  289. * After the slowpath clears MNT_WRITE_HOLD, mnt_is_readonly will
  290. * be set to match its requirements. So we must not load that until
  291. * MNT_WRITE_HOLD is cleared.
  292. */
  293. smp_rmb();
  294. if (mnt_is_readonly(m)) {
  295. mnt_dec_writers(mnt);
  296. ret = -EROFS;
  297. }
  298. preempt_enable();
  299. return ret;
  300. }
  301. /**
  302. * mnt_want_write - get write access to a mount
  303. * @m: the mount on which to take a write
  304. *
  305. * This tells the low-level filesystem that a write is about to be performed to
  306. * it, and makes sure that writes are allowed (mount is read-write, filesystem
  307. * is not frozen) before returning success. When the write operation is
  308. * finished, mnt_drop_write() must be called. This is effectively a refcount.
  309. */
  310. int mnt_want_write(struct vfsmount *m)
  311. {
  312. int ret;
  313. sb_start_write(m->mnt_sb);
  314. ret = __mnt_want_write(m);
  315. if (ret)
  316. sb_end_write(m->mnt_sb);
  317. return ret;
  318. }
  319. EXPORT_SYMBOL_GPL(mnt_want_write);
  320. /**
  321. * mnt_clone_write - get write access to a mount
  322. * @mnt: the mount on which to take a write
  323. *
  324. * This is effectively like mnt_want_write, except
  325. * it must only be used to take an extra write reference
  326. * on a mountpoint that we already know has a write reference
  327. * on it. This allows some optimisation.
  328. *
  329. * After finished, mnt_drop_write must be called as usual to
  330. * drop the reference.
  331. */
  332. int mnt_clone_write(struct vfsmount *mnt)
  333. {
  334. /* superblock may be r/o */
  335. if (__mnt_is_readonly(mnt))
  336. return -EROFS;
  337. preempt_disable();
  338. mnt_inc_writers(real_mount(mnt));
  339. preempt_enable();
  340. return 0;
  341. }
  342. EXPORT_SYMBOL_GPL(mnt_clone_write);
  343. /**
  344. * __mnt_want_write_file - get write access to a file's mount
  345. * @file: the file who's mount on which to take a write
  346. *
  347. * This is like __mnt_want_write, but it takes a file and can
  348. * do some optimisations if the file is open for write already
  349. */
  350. int __mnt_want_write_file(struct file *file)
  351. {
  352. if (!(file->f_mode & FMODE_WRITER))
  353. return __mnt_want_write(file->f_path.mnt);
  354. else
  355. return mnt_clone_write(file->f_path.mnt);
  356. }
  357. /**
  358. * mnt_want_write_file - get write access to a file's mount
  359. * @file: the file who's mount on which to take a write
  360. *
  361. * This is like mnt_want_write, but it takes a file and can
  362. * do some optimisations if the file is open for write already
  363. */
  364. int mnt_want_write_file(struct file *file)
  365. {
  366. int ret;
  367. sb_start_write(file_inode(file)->i_sb);
  368. ret = __mnt_want_write_file(file);
  369. if (ret)
  370. sb_end_write(file_inode(file)->i_sb);
  371. return ret;
  372. }
  373. EXPORT_SYMBOL_NS_GPL(mnt_want_write_file, ANDROID_GKI_VFS_EXPORT_ONLY);
  374. /**
  375. * __mnt_drop_write - give up write access to a mount
  376. * @mnt: the mount on which to give up write access
  377. *
  378. * Tells the low-level filesystem that we are done
  379. * performing writes to it. Must be matched with
  380. * __mnt_want_write() call above.
  381. */
  382. void __mnt_drop_write(struct vfsmount *mnt)
  383. {
  384. preempt_disable();
  385. mnt_dec_writers(real_mount(mnt));
  386. preempt_enable();
  387. }
  388. /**
  389. * mnt_drop_write - give up write access to a mount
  390. * @mnt: the mount on which to give up write access
  391. *
  392. * Tells the low-level filesystem that we are done performing writes to it and
  393. * also allows filesystem to be frozen again. Must be matched with
  394. * mnt_want_write() call above.
  395. */
  396. void mnt_drop_write(struct vfsmount *mnt)
  397. {
  398. __mnt_drop_write(mnt);
  399. sb_end_write(mnt->mnt_sb);
  400. }
  401. EXPORT_SYMBOL_GPL(mnt_drop_write);
  402. void __mnt_drop_write_file(struct file *file)
  403. {
  404. __mnt_drop_write(file->f_path.mnt);
  405. }
  406. void mnt_drop_write_file(struct file *file)
  407. {
  408. __mnt_drop_write_file(file);
  409. sb_end_write(file_inode(file)->i_sb);
  410. }
  411. EXPORT_SYMBOL_NS(mnt_drop_write_file, ANDROID_GKI_VFS_EXPORT_ONLY);
  412. static int mnt_make_readonly(struct mount *mnt)
  413. {
  414. int ret = 0;
  415. lock_mount_hash();
  416. mnt->mnt.mnt_flags |= MNT_WRITE_HOLD;
  417. /*
  418. * After storing MNT_WRITE_HOLD, we'll read the counters. This store
  419. * should be visible before we do.
  420. */
  421. smp_mb();
  422. /*
  423. * With writers on hold, if this value is zero, then there are
  424. * definitely no active writers (although held writers may subsequently
  425. * increment the count, they'll have to wait, and decrement it after
  426. * seeing MNT_READONLY).
  427. *
  428. * It is OK to have counter incremented on one CPU and decremented on
  429. * another: the sum will add up correctly. The danger would be when we
  430. * sum up each counter, if we read a counter before it is incremented,
  431. * but then read another CPU's count which it has been subsequently
  432. * decremented from -- we would see more decrements than we should.
  433. * MNT_WRITE_HOLD protects against this scenario, because
  434. * mnt_want_write first increments count, then smp_mb, then spins on
  435. * MNT_WRITE_HOLD, so it can't be decremented by another CPU while
  436. * we're counting up here.
  437. */
  438. if (mnt_get_writers(mnt) > 0)
  439. ret = -EBUSY;
  440. else
  441. mnt->mnt.mnt_flags |= MNT_READONLY;
  442. /*
  443. * MNT_READONLY must become visible before ~MNT_WRITE_HOLD, so writers
  444. * that become unheld will see MNT_READONLY.
  445. */
  446. smp_wmb();
  447. mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD;
  448. unlock_mount_hash();
  449. return ret;
  450. }
  451. static int __mnt_unmake_readonly(struct mount *mnt)
  452. {
  453. lock_mount_hash();
  454. mnt->mnt.mnt_flags &= ~MNT_READONLY;
  455. unlock_mount_hash();
  456. return 0;
  457. }
  458. int sb_prepare_remount_readonly(struct super_block *sb)
  459. {
  460. struct mount *mnt;
  461. int err = 0;
  462. /* Racy optimization. Recheck the counter under MNT_WRITE_HOLD */
  463. if (atomic_long_read(&sb->s_remove_count))
  464. return -EBUSY;
  465. lock_mount_hash();
  466. list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) {
  467. if (!(mnt->mnt.mnt_flags & MNT_READONLY)) {
  468. mnt->mnt.mnt_flags |= MNT_WRITE_HOLD;
  469. smp_mb();
  470. if (mnt_get_writers(mnt) > 0) {
  471. err = -EBUSY;
  472. break;
  473. }
  474. }
  475. }
  476. if (!err && atomic_long_read(&sb->s_remove_count))
  477. err = -EBUSY;
  478. if (!err) {
  479. sb->s_readonly_remount = 1;
  480. smp_wmb();
  481. }
  482. list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) {
  483. if (mnt->mnt.mnt_flags & MNT_WRITE_HOLD)
  484. mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD;
  485. }
  486. unlock_mount_hash();
  487. return err;
  488. }
  489. static void free_vfsmnt(struct mount *mnt)
  490. {
  491. kfree_const(mnt->mnt_devname);
  492. #ifdef CONFIG_SMP
  493. free_percpu(mnt->mnt_pcp);
  494. #endif
  495. kmem_cache_free(mnt_cache, mnt);
  496. }
  497. static void delayed_free_vfsmnt(struct rcu_head *head)
  498. {
  499. free_vfsmnt(container_of(head, struct mount, mnt_rcu));
  500. }
  501. /* call under rcu_read_lock */
  502. int __legitimize_mnt(struct vfsmount *bastard, unsigned seq)
  503. {
  504. struct mount *mnt;
  505. if (read_seqretry(&mount_lock, seq))
  506. return 1;
  507. if (bastard == NULL)
  508. return 0;
  509. mnt = real_mount(bastard);
  510. mnt_add_count(mnt, 1);
  511. smp_mb(); // see mntput_no_expire()
  512. if (likely(!read_seqretry(&mount_lock, seq)))
  513. return 0;
  514. if (bastard->mnt_flags & MNT_SYNC_UMOUNT) {
  515. mnt_add_count(mnt, -1);
  516. return 1;
  517. }
  518. lock_mount_hash();
  519. if (unlikely(bastard->mnt_flags & MNT_DOOMED)) {
  520. mnt_add_count(mnt, -1);
  521. unlock_mount_hash();
  522. return 1;
  523. }
  524. unlock_mount_hash();
  525. /* caller will mntput() */
  526. return -1;
  527. }
  528. /* call under rcu_read_lock */
  529. bool legitimize_mnt(struct vfsmount *bastard, unsigned seq)
  530. {
  531. int res = __legitimize_mnt(bastard, seq);
  532. if (likely(!res))
  533. return true;
  534. if (unlikely(res < 0)) {
  535. rcu_read_unlock();
  536. mntput(bastard);
  537. rcu_read_lock();
  538. }
  539. return false;
  540. }
  541. /*
  542. * find the first mount at @dentry on vfsmount @mnt.
  543. * call under rcu_read_lock()
  544. */
  545. struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
  546. {
  547. struct hlist_head *head = m_hash(mnt, dentry);
  548. struct mount *p;
  549. hlist_for_each_entry_rcu(p, head, mnt_hash)
  550. if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry)
  551. return p;
  552. return NULL;
  553. }
  554. /*
  555. * lookup_mnt - Return the first child mount mounted at path
  556. *
  557. * "First" means first mounted chronologically. If you create the
  558. * following mounts:
  559. *
  560. * mount /dev/sda1 /mnt
  561. * mount /dev/sda2 /mnt
  562. * mount /dev/sda3 /mnt
  563. *
  564. * Then lookup_mnt() on the base /mnt dentry in the root mount will
  565. * return successively the root dentry and vfsmount of /dev/sda1, then
  566. * /dev/sda2, then /dev/sda3, then NULL.
  567. *
  568. * lookup_mnt takes a reference to the found vfsmount.
  569. */
  570. struct vfsmount *lookup_mnt(const struct path *path)
  571. {
  572. struct mount *child_mnt;
  573. struct vfsmount *m;
  574. unsigned seq;
  575. rcu_read_lock();
  576. do {
  577. seq = read_seqbegin(&mount_lock);
  578. child_mnt = __lookup_mnt(path->mnt, path->dentry);
  579. m = child_mnt ? &child_mnt->mnt : NULL;
  580. } while (!legitimize_mnt(m, seq));
  581. rcu_read_unlock();
  582. return m;
  583. }
  584. static inline void lock_ns_list(struct mnt_namespace *ns)
  585. {
  586. spin_lock(&ns->ns_lock);
  587. }
  588. static inline void unlock_ns_list(struct mnt_namespace *ns)
  589. {
  590. spin_unlock(&ns->ns_lock);
  591. }
  592. static inline bool mnt_is_cursor(struct mount *mnt)
  593. {
  594. return mnt->mnt.mnt_flags & MNT_CURSOR;
  595. }
  596. /*
  597. * __is_local_mountpoint - Test to see if dentry is a mountpoint in the
  598. * current mount namespace.
  599. *
  600. * The common case is dentries are not mountpoints at all and that
  601. * test is handled inline. For the slow case when we are actually
  602. * dealing with a mountpoint of some kind, walk through all of the
  603. * mounts in the current mount namespace and test to see if the dentry
  604. * is a mountpoint.
  605. *
  606. * The mount_hashtable is not usable in the context because we
  607. * need to identify all mounts that may be in the current mount
  608. * namespace not just a mount that happens to have some specified
  609. * parent mount.
  610. */
  611. bool __is_local_mountpoint(struct dentry *dentry)
  612. {
  613. struct mnt_namespace *ns = current->nsproxy->mnt_ns;
  614. struct mount *mnt;
  615. bool is_covered = false;
  616. down_read(&namespace_sem);
  617. lock_ns_list(ns);
  618. list_for_each_entry(mnt, &ns->list, mnt_list) {
  619. if (mnt_is_cursor(mnt))
  620. continue;
  621. is_covered = (mnt->mnt_mountpoint == dentry);
  622. if (is_covered)
  623. break;
  624. }
  625. unlock_ns_list(ns);
  626. up_read(&namespace_sem);
  627. return is_covered;
  628. }
  629. static struct mountpoint *lookup_mountpoint(struct dentry *dentry)
  630. {
  631. struct hlist_head *chain = mp_hash(dentry);
  632. struct mountpoint *mp;
  633. hlist_for_each_entry(mp, chain, m_hash) {
  634. if (mp->m_dentry == dentry) {
  635. mp->m_count++;
  636. return mp;
  637. }
  638. }
  639. return NULL;
  640. }
  641. static struct mountpoint *get_mountpoint(struct dentry *dentry)
  642. {
  643. struct mountpoint *mp, *new = NULL;
  644. int ret;
  645. if (d_mountpoint(dentry)) {
  646. /* might be worth a WARN_ON() */
  647. if (d_unlinked(dentry))
  648. return ERR_PTR(-ENOENT);
  649. mountpoint:
  650. read_seqlock_excl(&mount_lock);
  651. mp = lookup_mountpoint(dentry);
  652. read_sequnlock_excl(&mount_lock);
  653. if (mp)
  654. goto done;
  655. }
  656. if (!new)
  657. new = kmalloc(sizeof(struct mountpoint), GFP_KERNEL);
  658. if (!new)
  659. return ERR_PTR(-ENOMEM);
  660. /* Exactly one processes may set d_mounted */
  661. ret = d_set_mounted(dentry);
  662. /* Someone else set d_mounted? */
  663. if (ret == -EBUSY)
  664. goto mountpoint;
  665. /* The dentry is not available as a mountpoint? */
  666. mp = ERR_PTR(ret);
  667. if (ret)
  668. goto done;
  669. /* Add the new mountpoint to the hash table */
  670. read_seqlock_excl(&mount_lock);
  671. new->m_dentry = dget(dentry);
  672. new->m_count = 1;
  673. hlist_add_head(&new->m_hash, mp_hash(dentry));
  674. INIT_HLIST_HEAD(&new->m_list);
  675. read_sequnlock_excl(&mount_lock);
  676. mp = new;
  677. new = NULL;
  678. done:
  679. kfree(new);
  680. return mp;
  681. }
  682. /*
  683. * vfsmount lock must be held. Additionally, the caller is responsible
  684. * for serializing calls for given disposal list.
  685. */
  686. static void __put_mountpoint(struct mountpoint *mp, struct list_head *list)
  687. {
  688. if (!--mp->m_count) {
  689. struct dentry *dentry = mp->m_dentry;
  690. BUG_ON(!hlist_empty(&mp->m_list));
  691. spin_lock(&dentry->d_lock);
  692. dentry->d_flags &= ~DCACHE_MOUNTED;
  693. spin_unlock(&dentry->d_lock);
  694. dput_to_list(dentry, list);
  695. hlist_del(&mp->m_hash);
  696. kfree(mp);
  697. }
  698. }
  699. /* called with namespace_lock and vfsmount lock */
  700. static void put_mountpoint(struct mountpoint *mp)
  701. {
  702. __put_mountpoint(mp, &ex_mountpoints);
  703. }
  704. static inline int check_mnt(struct mount *mnt)
  705. {
  706. return mnt->mnt_ns == current->nsproxy->mnt_ns;
  707. }
  708. /*
  709. * vfsmount lock must be held for write
  710. */
  711. static void touch_mnt_namespace(struct mnt_namespace *ns)
  712. {
  713. if (ns) {
  714. ns->event = ++event;
  715. wake_up_interruptible(&ns->poll);
  716. }
  717. }
  718. /*
  719. * vfsmount lock must be held for write
  720. */
  721. static void __touch_mnt_namespace(struct mnt_namespace *ns)
  722. {
  723. if (ns && ns->event != event) {
  724. ns->event = event;
  725. wake_up_interruptible(&ns->poll);
  726. }
  727. }
  728. /*
  729. * vfsmount lock must be held for write
  730. */
  731. static struct mountpoint *unhash_mnt(struct mount *mnt)
  732. {
  733. struct mountpoint *mp;
  734. mnt->mnt_parent = mnt;
  735. mnt->mnt_mountpoint = mnt->mnt.mnt_root;
  736. list_del_init(&mnt->mnt_child);
  737. hlist_del_init_rcu(&mnt->mnt_hash);
  738. hlist_del_init(&mnt->mnt_mp_list);
  739. mp = mnt->mnt_mp;
  740. mnt->mnt_mp = NULL;
  741. return mp;
  742. }
  743. /*
  744. * vfsmount lock must be held for write
  745. */
  746. static void umount_mnt(struct mount *mnt)
  747. {
  748. put_mountpoint(unhash_mnt(mnt));
  749. }
  750. /*
  751. * vfsmount lock must be held for write
  752. */
  753. void mnt_set_mountpoint(struct mount *mnt,
  754. struct mountpoint *mp,
  755. struct mount *child_mnt)
  756. {
  757. mp->m_count++;
  758. mnt_add_count(mnt, 1); /* essentially, that's mntget */
  759. child_mnt->mnt_mountpoint = mp->m_dentry;
  760. child_mnt->mnt_parent = mnt;
  761. child_mnt->mnt_mp = mp;
  762. hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list);
  763. }
  764. static void __attach_mnt(struct mount *mnt, struct mount *parent)
  765. {
  766. hlist_add_head_rcu(&mnt->mnt_hash,
  767. m_hash(&parent->mnt, mnt->mnt_mountpoint));
  768. list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
  769. }
  770. /*
  771. * vfsmount lock must be held for write
  772. */
  773. static void attach_mnt(struct mount *mnt,
  774. struct mount *parent,
  775. struct mountpoint *mp)
  776. {
  777. mnt_set_mountpoint(parent, mp, mnt);
  778. __attach_mnt(mnt, parent);
  779. }
  780. void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct mount *mnt)
  781. {
  782. struct mountpoint *old_mp = mnt->mnt_mp;
  783. struct mount *old_parent = mnt->mnt_parent;
  784. list_del_init(&mnt->mnt_child);
  785. hlist_del_init(&mnt->mnt_mp_list);
  786. hlist_del_init_rcu(&mnt->mnt_hash);
  787. attach_mnt(mnt, parent, mp);
  788. put_mountpoint(old_mp);
  789. mnt_add_count(old_parent, -1);
  790. }
  791. /*
  792. * vfsmount lock must be held for write
  793. */
  794. static void commit_tree(struct mount *mnt)
  795. {
  796. struct mount *parent = mnt->mnt_parent;
  797. struct mount *m;
  798. LIST_HEAD(head);
  799. struct mnt_namespace *n = parent->mnt_ns;
  800. BUG_ON(parent == mnt);
  801. list_add_tail(&head, &mnt->mnt_list);
  802. list_for_each_entry(m, &head, mnt_list)
  803. m->mnt_ns = n;
  804. list_splice(&head, n->list.prev);
  805. n->mounts += n->pending_mounts;
  806. n->pending_mounts = 0;
  807. __attach_mnt(mnt, parent);
  808. touch_mnt_namespace(n);
  809. }
  810. static struct mount *next_mnt(struct mount *p, struct mount *root)
  811. {
  812. struct list_head *next = p->mnt_mounts.next;
  813. if (next == &p->mnt_mounts) {
  814. while (1) {
  815. if (p == root)
  816. return NULL;
  817. next = p->mnt_child.next;
  818. if (next != &p->mnt_parent->mnt_mounts)
  819. break;
  820. p = p->mnt_parent;
  821. }
  822. }
  823. return list_entry(next, struct mount, mnt_child);
  824. }
  825. static struct mount *skip_mnt_tree(struct mount *p)
  826. {
  827. struct list_head *prev = p->mnt_mounts.prev;
  828. while (prev != &p->mnt_mounts) {
  829. p = list_entry(prev, struct mount, mnt_child);
  830. prev = p->mnt_mounts.prev;
  831. }
  832. return p;
  833. }
  834. /**
  835. * vfs_create_mount - Create a mount for a configured superblock
  836. * @fc: The configuration context with the superblock attached
  837. *
  838. * Create a mount to an already configured superblock. If necessary, the
  839. * caller should invoke vfs_get_tree() before calling this.
  840. *
  841. * Note that this does not attach the mount to anything.
  842. */
  843. struct vfsmount *vfs_create_mount(struct fs_context *fc)
  844. {
  845. struct mount *mnt;
  846. if (!fc->root)
  847. return ERR_PTR(-EINVAL);
  848. mnt = alloc_vfsmnt(fc->source ?: "none");
  849. if (!mnt)
  850. return ERR_PTR(-ENOMEM);
  851. if (fc->sb_flags & SB_KERNMOUNT)
  852. mnt->mnt.mnt_flags = MNT_INTERNAL;
  853. atomic_inc(&fc->root->d_sb->s_active);
  854. mnt->mnt.mnt_sb = fc->root->d_sb;
  855. mnt->mnt.mnt_root = dget(fc->root);
  856. mnt->mnt_mountpoint = mnt->mnt.mnt_root;
  857. mnt->mnt_parent = mnt;
  858. lock_mount_hash();
  859. list_add_tail(&mnt->mnt_instance, &mnt->mnt.mnt_sb->s_mounts);
  860. unlock_mount_hash();
  861. return &mnt->mnt;
  862. }
  863. EXPORT_SYMBOL(vfs_create_mount);
  864. struct vfsmount *fc_mount(struct fs_context *fc)
  865. {
  866. int err = vfs_get_tree(fc);
  867. if (!err) {
  868. up_write(&fc->root->d_sb->s_umount);
  869. return vfs_create_mount(fc);
  870. }
  871. return ERR_PTR(err);
  872. }
  873. EXPORT_SYMBOL(fc_mount);
  874. struct vfsmount *vfs_kern_mount(struct file_system_type *type,
  875. int flags, const char *name,
  876. void *data)
  877. {
  878. struct fs_context *fc;
  879. struct vfsmount *mnt;
  880. int ret = 0;
  881. if (!type)
  882. return ERR_PTR(-EINVAL);
  883. fc = fs_context_for_mount(type, flags);
  884. if (IS_ERR(fc))
  885. return ERR_CAST(fc);
  886. if (name)
  887. ret = vfs_parse_fs_string(fc, "source",
  888. name, strlen(name));
  889. if (!ret)
  890. ret = parse_monolithic_mount_data(fc, data);
  891. if (!ret)
  892. mnt = fc_mount(fc);
  893. else
  894. mnt = ERR_PTR(ret);
  895. put_fs_context(fc);
  896. return mnt;
  897. }
  898. EXPORT_SYMBOL_GPL(vfs_kern_mount);
  899. struct vfsmount *
  900. vfs_submount(const struct dentry *mountpoint, struct file_system_type *type,
  901. const char *name, void *data)
  902. {
  903. /* Until it is worked out how to pass the user namespace
  904. * through from the parent mount to the submount don't support
  905. * unprivileged mounts with submounts.
  906. */
  907. if (mountpoint->d_sb->s_user_ns != &init_user_ns)
  908. return ERR_PTR(-EPERM);
  909. return vfs_kern_mount(type, SB_SUBMOUNT, name, data);
  910. }
  911. EXPORT_SYMBOL_GPL(vfs_submount);
  912. static struct mount *clone_mnt(struct mount *old, struct dentry *root,
  913. int flag)
  914. {
  915. struct super_block *sb = old->mnt.mnt_sb;
  916. struct mount *mnt;
  917. int err;
  918. mnt = alloc_vfsmnt(old->mnt_devname);
  919. if (!mnt)
  920. return ERR_PTR(-ENOMEM);
  921. if (flag & (CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE))
  922. mnt->mnt_group_id = 0; /* not a peer of original */
  923. else
  924. mnt->mnt_group_id = old->mnt_group_id;
  925. if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) {
  926. err = mnt_alloc_group_id(mnt);
  927. if (err)
  928. goto out_free;
  929. }
  930. mnt->mnt.mnt_flags = old->mnt.mnt_flags;
  931. mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL);
  932. atomic_inc(&sb->s_active);
  933. mnt->mnt.mnt_sb = sb;
  934. mnt->mnt.mnt_root = dget(root);
  935. mnt->mnt_mountpoint = mnt->mnt.mnt_root;
  936. mnt->mnt_parent = mnt;
  937. lock_mount_hash();
  938. list_add_tail(&mnt->mnt_instance, &sb->s_mounts);
  939. unlock_mount_hash();
  940. if ((flag & CL_SLAVE) ||
  941. ((flag & CL_SHARED_TO_SLAVE) && IS_MNT_SHARED(old))) {
  942. list_add(&mnt->mnt_slave, &old->mnt_slave_list);
  943. mnt->mnt_master = old;
  944. CLEAR_MNT_SHARED(mnt);
  945. } else if (!(flag & CL_PRIVATE)) {
  946. if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old))
  947. list_add(&mnt->mnt_share, &old->mnt_share);
  948. if (IS_MNT_SLAVE(old))
  949. list_add(&mnt->mnt_slave, &old->mnt_slave);
  950. mnt->mnt_master = old->mnt_master;
  951. } else {
  952. CLEAR_MNT_SHARED(mnt);
  953. }
  954. if (flag & CL_MAKE_SHARED)
  955. set_mnt_shared(mnt);
  956. /* stick the duplicate mount on the same expiry list
  957. * as the original if that was on one */
  958. if (flag & CL_EXPIRE) {
  959. if (!list_empty(&old->mnt_expire))
  960. list_add(&mnt->mnt_expire, &old->mnt_expire);
  961. }
  962. return mnt;
  963. out_free:
  964. mnt_free_id(mnt);
  965. free_vfsmnt(mnt);
  966. return ERR_PTR(err);
  967. }
  968. static void cleanup_mnt(struct mount *mnt)
  969. {
  970. struct hlist_node *p;
  971. struct mount *m;
  972. /*
  973. * The warning here probably indicates that somebody messed
  974. * up a mnt_want/drop_write() pair. If this happens, the
  975. * filesystem was probably unable to make r/w->r/o transitions.
  976. * The locking used to deal with mnt_count decrement provides barriers,
  977. * so mnt_get_writers() below is safe.
  978. */
  979. WARN_ON(mnt_get_writers(mnt));
  980. if (unlikely(mnt->mnt_pins.first))
  981. mnt_pin_kill(mnt);
  982. hlist_for_each_entry_safe(m, p, &mnt->mnt_stuck_children, mnt_umount) {
  983. hlist_del(&m->mnt_umount);
  984. mntput(&m->mnt);
  985. }
  986. fsnotify_vfsmount_delete(&mnt->mnt);
  987. dput(mnt->mnt.mnt_root);
  988. deactivate_super(mnt->mnt.mnt_sb);
  989. mnt_free_id(mnt);
  990. call_rcu(&mnt->mnt_rcu, delayed_free_vfsmnt);
  991. }
  992. static void __cleanup_mnt(struct rcu_head *head)
  993. {
  994. cleanup_mnt(container_of(head, struct mount, mnt_rcu));
  995. }
  996. static LLIST_HEAD(delayed_mntput_list);
  997. static void delayed_mntput(struct work_struct *unused)
  998. {
  999. struct llist_node *node = llist_del_all(&delayed_mntput_list);
  1000. struct mount *m, *t;
  1001. llist_for_each_entry_safe(m, t, node, mnt_llist)
  1002. cleanup_mnt(m);
  1003. }
  1004. static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput);
  1005. static void mntput_no_expire(struct mount *mnt)
  1006. {
  1007. LIST_HEAD(list);
  1008. int count;
  1009. rcu_read_lock();
  1010. if (likely(READ_ONCE(mnt->mnt_ns))) {
  1011. /*
  1012. * Since we don't do lock_mount_hash() here,
  1013. * ->mnt_ns can change under us. However, if it's
  1014. * non-NULL, then there's a reference that won't
  1015. * be dropped until after an RCU delay done after
  1016. * turning ->mnt_ns NULL. So if we observe it
  1017. * non-NULL under rcu_read_lock(), the reference
  1018. * we are dropping is not the final one.
  1019. */
  1020. mnt_add_count(mnt, -1);
  1021. rcu_read_unlock();
  1022. return;
  1023. }
  1024. lock_mount_hash();
  1025. /*
  1026. * make sure that if __legitimize_mnt() has not seen us grab
  1027. * mount_lock, we'll see their refcount increment here.
  1028. */
  1029. smp_mb();
  1030. mnt_add_count(mnt, -1);
  1031. count = mnt_get_count(mnt);
  1032. if (count != 0) {
  1033. WARN_ON(count < 0);
  1034. rcu_read_unlock();
  1035. unlock_mount_hash();
  1036. return;
  1037. }
  1038. if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) {
  1039. rcu_read_unlock();
  1040. unlock_mount_hash();
  1041. return;
  1042. }
  1043. mnt->mnt.mnt_flags |= MNT_DOOMED;
  1044. rcu_read_unlock();
  1045. list_del(&mnt->mnt_instance);
  1046. if (unlikely(!list_empty(&mnt->mnt_mounts))) {
  1047. struct mount *p, *tmp;
  1048. list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts, mnt_child) {
  1049. __put_mountpoint(unhash_mnt(p), &list);
  1050. hlist_add_head(&p->mnt_umount, &mnt->mnt_stuck_children);
  1051. }
  1052. }
  1053. unlock_mount_hash();
  1054. shrink_dentry_list(&list);
  1055. if (likely(!(mnt->mnt.mnt_flags & MNT_INTERNAL))) {
  1056. struct task_struct *task = current;
  1057. if (likely(!(task->flags & PF_KTHREAD))) {
  1058. init_task_work(&mnt->mnt_rcu, __cleanup_mnt);
  1059. if (!task_work_add(task, &mnt->mnt_rcu, TWA_RESUME))
  1060. return;
  1061. }
  1062. if (llist_add(&mnt->mnt_llist, &delayed_mntput_list))
  1063. schedule_delayed_work(&delayed_mntput_work, 1);
  1064. return;
  1065. }
  1066. cleanup_mnt(mnt);
  1067. }
  1068. void mntput(struct vfsmount *mnt)
  1069. {
  1070. if (mnt) {
  1071. struct mount *m = real_mount(mnt);
  1072. /* avoid cacheline pingpong, hope gcc doesn't get "smart" */
  1073. if (unlikely(m->mnt_expiry_mark))
  1074. m->mnt_expiry_mark = 0;
  1075. mntput_no_expire(m);
  1076. }
  1077. }
  1078. EXPORT_SYMBOL(mntput);
  1079. struct vfsmount *mntget(struct vfsmount *mnt)
  1080. {
  1081. if (mnt)
  1082. mnt_add_count(real_mount(mnt), 1);
  1083. return mnt;
  1084. }
  1085. EXPORT_SYMBOL(mntget);
  1086. /* path_is_mountpoint() - Check if path is a mount in the current
  1087. * namespace.
  1088. *
  1089. * d_mountpoint() can only be used reliably to establish if a dentry is
  1090. * not mounted in any namespace and that common case is handled inline.
  1091. * d_mountpoint() isn't aware of the possibility there may be multiple
  1092. * mounts using a given dentry in a different namespace. This function
  1093. * checks if the passed in path is a mountpoint rather than the dentry
  1094. * alone.
  1095. */
  1096. bool path_is_mountpoint(const struct path *path)
  1097. {
  1098. unsigned seq;
  1099. bool res;
  1100. if (!d_mountpoint(path->dentry))
  1101. return false;
  1102. rcu_read_lock();
  1103. do {
  1104. seq = read_seqbegin(&mount_lock);
  1105. res = __path_is_mountpoint(path);
  1106. } while (read_seqretry(&mount_lock, seq));
  1107. rcu_read_unlock();
  1108. return res;
  1109. }
  1110. EXPORT_SYMBOL(path_is_mountpoint);
  1111. struct vfsmount *mnt_clone_internal(const struct path *path)
  1112. {
  1113. struct mount *p;
  1114. p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE);
  1115. if (IS_ERR(p))
  1116. return ERR_CAST(p);
  1117. p->mnt.mnt_flags |= MNT_INTERNAL;
  1118. return &p->mnt;
  1119. }
  1120. #ifdef CONFIG_PROC_FS
  1121. static struct mount *mnt_list_next(struct mnt_namespace *ns,
  1122. struct list_head *p)
  1123. {
  1124. struct mount *mnt, *ret = NULL;
  1125. lock_ns_list(ns);
  1126. list_for_each_continue(p, &ns->list) {
  1127. mnt = list_entry(p, typeof(*mnt), mnt_list);
  1128. if (!mnt_is_cursor(mnt)) {
  1129. ret = mnt;
  1130. break;
  1131. }
  1132. }
  1133. unlock_ns_list(ns);
  1134. return ret;
  1135. }
  1136. /* iterator; we want it to have access to namespace_sem, thus here... */
  1137. static void *m_start(struct seq_file *m, loff_t *pos)
  1138. {
  1139. struct proc_mounts *p = m->private;
  1140. struct list_head *prev;
  1141. down_read(&namespace_sem);
  1142. if (!*pos) {
  1143. prev = &p->ns->list;
  1144. } else {
  1145. prev = &p->cursor.mnt_list;
  1146. /* Read after we'd reached the end? */
  1147. if (list_empty(prev))
  1148. return NULL;
  1149. }
  1150. return mnt_list_next(p->ns, prev);
  1151. }
  1152. static void *m_next(struct seq_file *m, void *v, loff_t *pos)
  1153. {
  1154. struct proc_mounts *p = m->private;
  1155. struct mount *mnt = v;
  1156. ++*pos;
  1157. return mnt_list_next(p->ns, &mnt->mnt_list);
  1158. }
  1159. static void m_stop(struct seq_file *m, void *v)
  1160. {
  1161. struct proc_mounts *p = m->private;
  1162. struct mount *mnt = v;
  1163. lock_ns_list(p->ns);
  1164. if (mnt)
  1165. list_move_tail(&p->cursor.mnt_list, &mnt->mnt_list);
  1166. else
  1167. list_del_init(&p->cursor.mnt_list);
  1168. unlock_ns_list(p->ns);
  1169. up_read(&namespace_sem);
  1170. }
  1171. static int m_show(struct seq_file *m, void *v)
  1172. {
  1173. struct proc_mounts *p = m->private;
  1174. struct mount *r = v;
  1175. return p->show(m, &r->mnt);
  1176. }
  1177. const struct seq_operations mounts_op = {
  1178. .start = m_start,
  1179. .next = m_next,
  1180. .stop = m_stop,
  1181. .show = m_show,
  1182. };
  1183. void mnt_cursor_del(struct mnt_namespace *ns, struct mount *cursor)
  1184. {
  1185. down_read(&namespace_sem);
  1186. lock_ns_list(ns);
  1187. list_del(&cursor->mnt_list);
  1188. unlock_ns_list(ns);
  1189. up_read(&namespace_sem);
  1190. }
  1191. #endif /* CONFIG_PROC_FS */
  1192. /**
  1193. * may_umount_tree - check if a mount tree is busy
  1194. * @mnt: root of mount tree
  1195. *
  1196. * This is called to check if a tree of mounts has any
  1197. * open files, pwds, chroots or sub mounts that are
  1198. * busy.
  1199. */
  1200. int may_umount_tree(struct vfsmount *m)
  1201. {
  1202. struct mount *mnt = real_mount(m);
  1203. int actual_refs = 0;
  1204. int minimum_refs = 0;
  1205. struct mount *p;
  1206. BUG_ON(!m);
  1207. /* write lock needed for mnt_get_count */
  1208. lock_mount_hash();
  1209. for (p = mnt; p; p = next_mnt(p, mnt)) {
  1210. actual_refs += mnt_get_count(p);
  1211. minimum_refs += 2;
  1212. }
  1213. unlock_mount_hash();
  1214. if (actual_refs > minimum_refs)
  1215. return 0;
  1216. return 1;
  1217. }
  1218. EXPORT_SYMBOL(may_umount_tree);
  1219. /**
  1220. * may_umount - check if a mount point is busy
  1221. * @mnt: root of mount
  1222. *
  1223. * This is called to check if a mount point has any
  1224. * open files, pwds, chroots or sub mounts. If the
  1225. * mount has sub mounts this will return busy
  1226. * regardless of whether the sub mounts are busy.
  1227. *
  1228. * Doesn't take quota and stuff into account. IOW, in some cases it will
  1229. * give false negatives. The main reason why it's here is that we need
  1230. * a non-destructive way to look for easily umountable filesystems.
  1231. */
  1232. int may_umount(struct vfsmount *mnt)
  1233. {
  1234. int ret = 1;
  1235. down_read(&namespace_sem);
  1236. lock_mount_hash();
  1237. if (propagate_mount_busy(real_mount(mnt), 2))
  1238. ret = 0;
  1239. unlock_mount_hash();
  1240. up_read(&namespace_sem);
  1241. return ret;
  1242. }
  1243. EXPORT_SYMBOL(may_umount);
  1244. static void namespace_unlock(void)
  1245. {
  1246. struct hlist_head head;
  1247. struct hlist_node *p;
  1248. struct mount *m;
  1249. LIST_HEAD(list);
  1250. hlist_move_list(&unmounted, &head);
  1251. list_splice_init(&ex_mountpoints, &list);
  1252. up_write(&namespace_sem);
  1253. shrink_dentry_list(&list);
  1254. if (likely(hlist_empty(&head)))
  1255. return;
  1256. synchronize_rcu_expedited();
  1257. hlist_for_each_entry_safe(m, p, &head, mnt_umount) {
  1258. hlist_del(&m->mnt_umount);
  1259. mntput(&m->mnt);
  1260. }
  1261. }
  1262. static inline void namespace_lock(void)
  1263. {
  1264. down_write(&namespace_sem);
  1265. }
  1266. enum umount_tree_flags {
  1267. UMOUNT_SYNC = 1,
  1268. UMOUNT_PROPAGATE = 2,
  1269. UMOUNT_CONNECTED = 4,
  1270. };
  1271. static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
  1272. {
  1273. /* Leaving mounts connected is only valid for lazy umounts */
  1274. if (how & UMOUNT_SYNC)
  1275. return true;
  1276. /* A mount without a parent has nothing to be connected to */
  1277. if (!mnt_has_parent(mnt))
  1278. return true;
  1279. /* Because the reference counting rules change when mounts are
  1280. * unmounted and connected, umounted mounts may not be
  1281. * connected to mounted mounts.
  1282. */
  1283. if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
  1284. return true;
  1285. /* Has it been requested that the mount remain connected? */
  1286. if (how & UMOUNT_CONNECTED)
  1287. return false;
  1288. /* Is the mount locked such that it needs to remain connected? */
  1289. if (IS_MNT_LOCKED(mnt))
  1290. return false;
  1291. /* By default disconnect the mount */
  1292. return true;
  1293. }
  1294. /*
  1295. * mount_lock must be held
  1296. * namespace_sem must be held for write
  1297. */
  1298. static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
  1299. {
  1300. LIST_HEAD(tmp_list);
  1301. struct mount *p;
  1302. if (how & UMOUNT_PROPAGATE)
  1303. propagate_mount_unlock(mnt);
  1304. /* Gather the mounts to umount */
  1305. for (p = mnt; p; p = next_mnt(p, mnt)) {
  1306. p->mnt.mnt_flags |= MNT_UMOUNT;
  1307. list_move(&p->mnt_list, &tmp_list);
  1308. }
  1309. /* Hide the mounts from mnt_mounts */
  1310. list_for_each_entry(p, &tmp_list, mnt_list) {
  1311. list_del_init(&p->mnt_child);
  1312. }
  1313. /* Add propogated mounts to the tmp_list */
  1314. if (how & UMOUNT_PROPAGATE)
  1315. propagate_umount(&tmp_list);
  1316. while (!list_empty(&tmp_list)) {
  1317. struct mnt_namespace *ns;
  1318. bool disconnect;
  1319. p = list_first_entry(&tmp_list, struct mount, mnt_list);
  1320. list_del_init(&p->mnt_expire);
  1321. list_del_init(&p->mnt_list);
  1322. ns = p->mnt_ns;
  1323. if (ns) {
  1324. ns->mounts--;
  1325. __touch_mnt_namespace(ns);
  1326. }
  1327. p->mnt_ns = NULL;
  1328. if (how & UMOUNT_SYNC)
  1329. p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
  1330. disconnect = disconnect_mount(p, how);
  1331. if (mnt_has_parent(p)) {
  1332. mnt_add_count(p->mnt_parent, -1);
  1333. if (!disconnect) {
  1334. /* Don't forget about p */
  1335. list_add_tail(&p->mnt_child, &p->mnt_parent->mnt_mounts);
  1336. } else {
  1337. umount_mnt(p);
  1338. }
  1339. }
  1340. change_mnt_propagation(p, MS_PRIVATE);
  1341. if (disconnect)
  1342. hlist_add_head(&p->mnt_umount, &unmounted);
  1343. }
  1344. }
  1345. static void shrink_submounts(struct mount *mnt);
  1346. static int do_umount_root(struct super_block *sb)
  1347. {
  1348. int ret = 0;
  1349. down_write(&sb->s_umount);
  1350. if (!sb_rdonly(sb)) {
  1351. struct fs_context *fc;
  1352. fc = fs_context_for_reconfigure(sb->s_root, SB_RDONLY,
  1353. SB_RDONLY);
  1354. if (IS_ERR(fc)) {
  1355. ret = PTR_ERR(fc);
  1356. } else {
  1357. ret = parse_monolithic_mount_data(fc, NULL);
  1358. if (!ret)
  1359. ret = reconfigure_super(fc);
  1360. put_fs_context(fc);
  1361. }
  1362. }
  1363. up_write(&sb->s_umount);
  1364. return ret;
  1365. }
  1366. static int do_umount(struct mount *mnt, int flags)
  1367. {
  1368. struct super_block *sb = mnt->mnt.mnt_sb;
  1369. int retval;
  1370. retval = security_sb_umount(&mnt->mnt, flags);
  1371. if (retval)
  1372. return retval;
  1373. /*
  1374. * Allow userspace to request a mountpoint be expired rather than
  1375. * unmounting unconditionally. Unmount only happens if:
  1376. * (1) the mark is already set (the mark is cleared by mntput())
  1377. * (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount]
  1378. */
  1379. if (flags & MNT_EXPIRE) {
  1380. if (&mnt->mnt == current->fs->root.mnt ||
  1381. flags & (MNT_FORCE | MNT_DETACH))
  1382. return -EINVAL;
  1383. /*
  1384. * probably don't strictly need the lock here if we examined
  1385. * all race cases, but it's a slowpath.
  1386. */
  1387. lock_mount_hash();
  1388. if (mnt_get_count(mnt) != 2) {
  1389. unlock_mount_hash();
  1390. return -EBUSY;
  1391. }
  1392. unlock_mount_hash();
  1393. if (!xchg(&mnt->mnt_expiry_mark, 1))
  1394. return -EAGAIN;
  1395. }
  1396. /*
  1397. * If we may have to abort operations to get out of this
  1398. * mount, and they will themselves hold resources we must
  1399. * allow the fs to do things. In the Unix tradition of
  1400. * 'Gee thats tricky lets do it in userspace' the umount_begin
  1401. * might fail to complete on the first run through as other tasks
  1402. * must return, and the like. Thats for the mount program to worry
  1403. * about for the moment.
  1404. */
  1405. if (flags & MNT_FORCE && sb->s_op->umount_begin) {
  1406. sb->s_op->umount_begin(sb);
  1407. }
  1408. /*
  1409. * No sense to grab the lock for this test, but test itself looks
  1410. * somewhat bogus. Suggestions for better replacement?
  1411. * Ho-hum... In principle, we might treat that as umount + switch
  1412. * to rootfs. GC would eventually take care of the old vfsmount.
  1413. * Actually it makes sense, especially if rootfs would contain a
  1414. * /reboot - static binary that would close all descriptors and
  1415. * call reboot(9). Then init(8) could umount root and exec /reboot.
  1416. */
  1417. if (&mnt->mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) {
  1418. /*
  1419. * Special case for "unmounting" root ...
  1420. * we just try to remount it readonly.
  1421. */
  1422. if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))
  1423. return -EPERM;
  1424. return do_umount_root(sb);
  1425. }
  1426. namespace_lock();
  1427. lock_mount_hash();
  1428. /* Recheck MNT_LOCKED with the locks held */
  1429. retval = -EINVAL;
  1430. if (mnt->mnt.mnt_flags & MNT_LOCKED)
  1431. goto out;
  1432. event++;
  1433. if (flags & MNT_DETACH) {
  1434. if (!list_empty(&mnt->mnt_list))
  1435. umount_tree(mnt, UMOUNT_PROPAGATE);
  1436. retval = 0;
  1437. } else {
  1438. shrink_submounts(mnt);
  1439. retval = -EBUSY;
  1440. if (!propagate_mount_busy(mnt, 2)) {
  1441. if (!list_empty(&mnt->mnt_list))
  1442. umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
  1443. retval = 0;
  1444. }
  1445. }
  1446. out:
  1447. unlock_mount_hash();
  1448. namespace_unlock();
  1449. return retval;
  1450. }
  1451. /*
  1452. * __detach_mounts - lazily unmount all mounts on the specified dentry
  1453. *
  1454. * During unlink, rmdir, and d_drop it is possible to loose the path
  1455. * to an existing mountpoint, and wind up leaking the mount.
  1456. * detach_mounts allows lazily unmounting those mounts instead of
  1457. * leaking them.
  1458. *
  1459. * The caller may hold dentry->d_inode->i_mutex.
  1460. */
  1461. void __detach_mounts(struct dentry *dentry)
  1462. {
  1463. struct mountpoint *mp;
  1464. struct mount *mnt;
  1465. namespace_lock();
  1466. lock_mount_hash();
  1467. mp = lookup_mountpoint(dentry);
  1468. if (!mp)
  1469. goto out_unlock;
  1470. event++;
  1471. while (!hlist_empty(&mp->m_list)) {
  1472. mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
  1473. if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
  1474. umount_mnt(mnt);
  1475. hlist_add_head(&mnt->mnt_umount, &unmounted);
  1476. }
  1477. else umount_tree(mnt, UMOUNT_CONNECTED);
  1478. }
  1479. put_mountpoint(mp);
  1480. out_unlock:
  1481. unlock_mount_hash();
  1482. namespace_unlock();
  1483. }
  1484. /*
  1485. * Is the caller allowed to modify his namespace?
  1486. */
  1487. static inline bool may_mount(void)
  1488. {
  1489. return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
  1490. }
  1491. #ifdef CONFIG_MANDATORY_FILE_LOCKING
  1492. static bool may_mandlock(void)
  1493. {
  1494. pr_warn_once("======================================================\n"
  1495. "WARNING: the mand mount option is being deprecated and\n"
  1496. " will be removed in v5.15!\n"
  1497. "======================================================\n");
  1498. return capable(CAP_SYS_ADMIN);
  1499. }
  1500. #else
  1501. static inline bool may_mandlock(void)
  1502. {
  1503. pr_warn("VFS: \"mand\" mount option not supported");
  1504. return false;
  1505. }
  1506. #endif
  1507. static int can_umount(const struct path *path, int flags)
  1508. {
  1509. struct mount *mnt = real_mount(path->mnt);
  1510. if (!may_mount())
  1511. return -EPERM;
  1512. if (path->dentry != path->mnt->mnt_root)
  1513. return -EINVAL;
  1514. if (!check_mnt(mnt))
  1515. return -EINVAL;
  1516. if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */
  1517. return -EINVAL;
  1518. if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN))
  1519. return -EPERM;
  1520. return 0;
  1521. }
  1522. // caller is responsible for flags being sane
  1523. int path_umount(struct path *path, int flags)
  1524. {
  1525. struct mount *mnt = real_mount(path->mnt);
  1526. int ret;
  1527. ret = can_umount(path, flags);
  1528. if (!ret)
  1529. ret = do_umount(mnt, flags);
  1530. /* we mustn't call path_put() as that would clear mnt_expiry_mark */
  1531. dput(path->dentry);
  1532. mntput_no_expire(mnt);
  1533. return ret;
  1534. }
  1535. static int ksys_umount(char __user *name, int flags)
  1536. {
  1537. int lookup_flags = LOOKUP_MOUNTPOINT;
  1538. struct path path;
  1539. int ret;
  1540. // basic validity checks done first
  1541. if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
  1542. return -EINVAL;
  1543. if (!(flags & UMOUNT_NOFOLLOW))
  1544. lookup_flags |= LOOKUP_FOLLOW;
  1545. ret = user_path_at(AT_FDCWD, name, lookup_flags, &path);
  1546. if (ret)
  1547. return ret;
  1548. return path_umount(&path, flags);
  1549. }
  1550. SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
  1551. {
  1552. return ksys_umount(name, flags);
  1553. }
  1554. #ifdef __ARCH_WANT_SYS_OLDUMOUNT
  1555. /*
  1556. * The 2.0 compatible umount. No flags.
  1557. */
  1558. SYSCALL_DEFINE1(oldumount, char __user *, name)
  1559. {
  1560. return ksys_umount(name, 0);
  1561. }
  1562. #endif
  1563. static bool is_mnt_ns_file(struct dentry *dentry)
  1564. {
  1565. /* Is this a proxy for a mount namespace? */
  1566. return dentry->d_op == &ns_dentry_operations &&
  1567. dentry->d_fsdata == &mntns_operations;
  1568. }
  1569. static struct mnt_namespace *to_mnt_ns(struct ns_common *ns)
  1570. {
  1571. return container_of(ns, struct mnt_namespace, ns);
  1572. }
  1573. struct ns_common *from_mnt_ns(struct mnt_namespace *mnt)
  1574. {
  1575. return &mnt->ns;
  1576. }
  1577. static bool mnt_ns_loop(struct dentry *dentry)
  1578. {
  1579. /* Could bind mounting the mount namespace inode cause a
  1580. * mount namespace loop?
  1581. */
  1582. struct mnt_namespace *mnt_ns;
  1583. if (!is_mnt_ns_file(dentry))
  1584. return false;
  1585. mnt_ns = to_mnt_ns(get_proc_ns(dentry->d_inode));
  1586. return current->nsproxy->mnt_ns->seq >= mnt_ns->seq;
  1587. }
  1588. struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
  1589. int flag)
  1590. {
  1591. struct mount *res, *p, *q, *r, *parent;
  1592. if (!(flag & CL_COPY_UNBINDABLE) && IS_MNT_UNBINDABLE(mnt))
  1593. return ERR_PTR(-EINVAL);
  1594. if (!(flag & CL_COPY_MNT_NS_FILE) && is_mnt_ns_file(dentry))
  1595. return ERR_PTR(-EINVAL);
  1596. res = q = clone_mnt(mnt, dentry, flag);
  1597. if (IS_ERR(q))
  1598. return q;
  1599. q->mnt_mountpoint = mnt->mnt_mountpoint;
  1600. p = mnt;
  1601. list_for_each_entry(r, &mnt->mnt_mounts, mnt_child) {
  1602. struct mount *s;
  1603. if (!is_subdir(r->mnt_mountpoint, dentry))
  1604. continue;
  1605. for (s = r; s; s = next_mnt(s, r)) {
  1606. if (!(flag & CL_COPY_UNBINDABLE) &&
  1607. IS_MNT_UNBINDABLE(s)) {
  1608. if (s->mnt.mnt_flags & MNT_LOCKED) {
  1609. /* Both unbindable and locked. */
  1610. q = ERR_PTR(-EPERM);
  1611. goto out;
  1612. } else {
  1613. s = skip_mnt_tree(s);
  1614. continue;
  1615. }
  1616. }
  1617. if (!(flag & CL_COPY_MNT_NS_FILE) &&
  1618. is_mnt_ns_file(s->mnt.mnt_root)) {
  1619. s = skip_mnt_tree(s);
  1620. continue;
  1621. }
  1622. while (p != s->mnt_parent) {
  1623. p = p->mnt_parent;
  1624. q = q->mnt_parent;
  1625. }
  1626. p = s;
  1627. parent = q;
  1628. q = clone_mnt(p, p->mnt.mnt_root, flag);
  1629. if (IS_ERR(q))
  1630. goto out;
  1631. lock_mount_hash();
  1632. list_add_tail(&q->mnt_list, &res->mnt_list);
  1633. attach_mnt(q, parent, p->mnt_mp);
  1634. unlock_mount_hash();
  1635. }
  1636. }
  1637. return res;
  1638. out:
  1639. if (res) {
  1640. lock_mount_hash();
  1641. umount_tree(res, UMOUNT_SYNC);
  1642. unlock_mount_hash();
  1643. }
  1644. return q;
  1645. }
  1646. /* Caller should check returned pointer for errors */
  1647. struct vfsmount *collect_mounts(const struct path *path)
  1648. {
  1649. struct mount *tree;
  1650. namespace_lock();
  1651. if (!check_mnt(real_mount(path->mnt)))
  1652. tree = ERR_PTR(-EINVAL);
  1653. else
  1654. tree = copy_tree(real_mount(path->mnt), path->dentry,
  1655. CL_COPY_ALL | CL_PRIVATE);
  1656. namespace_unlock();
  1657. if (IS_ERR(tree))
  1658. return ERR_CAST(tree);
  1659. return &tree->mnt;
  1660. }
  1661. static void free_mnt_ns(struct mnt_namespace *);
  1662. static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *, bool);
  1663. void dissolve_on_fput(struct vfsmount *mnt)
  1664. {
  1665. struct mnt_namespace *ns;
  1666. namespace_lock();
  1667. lock_mount_hash();
  1668. ns = real_mount(mnt)->mnt_ns;
  1669. if (ns) {
  1670. if (is_anon_ns(ns))
  1671. umount_tree(real_mount(mnt), UMOUNT_CONNECTED);
  1672. else
  1673. ns = NULL;
  1674. }
  1675. unlock_mount_hash();
  1676. namespace_unlock();
  1677. if (ns)
  1678. free_mnt_ns(ns);
  1679. }
  1680. void drop_collected_mounts(struct vfsmount *mnt)
  1681. {
  1682. namespace_lock();
  1683. lock_mount_hash();
  1684. umount_tree(real_mount(mnt), 0);
  1685. unlock_mount_hash();
  1686. namespace_unlock();
  1687. }
  1688. static bool has_locked_children(struct mount *mnt, struct dentry *dentry)
  1689. {
  1690. struct mount *child;
  1691. list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
  1692. if (!is_subdir(child->mnt_mountpoint, dentry))
  1693. continue;
  1694. if (child->mnt.mnt_flags & MNT_LOCKED)
  1695. return true;
  1696. }
  1697. return false;
  1698. }
  1699. /**
  1700. * clone_private_mount - create a private clone of a path
  1701. *
  1702. * This creates a new vfsmount, which will be the clone of @path. The new will
  1703. * not be attached anywhere in the namespace and will be private (i.e. changes
  1704. * to the originating mount won't be propagated into this).
  1705. *
  1706. * Release with mntput().
  1707. */
  1708. struct vfsmount *clone_private_mount(const struct path *path)
  1709. {
  1710. struct mount *old_mnt = real_mount(path->mnt);
  1711. struct mount *new_mnt;
  1712. down_read(&namespace_sem);
  1713. if (IS_MNT_UNBINDABLE(old_mnt))
  1714. goto invalid;
  1715. if (!check_mnt(old_mnt))
  1716. goto invalid;
  1717. if (has_locked_children(old_mnt, path->dentry))
  1718. goto invalid;
  1719. new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
  1720. up_read(&namespace_sem);
  1721. if (IS_ERR(new_mnt))
  1722. return ERR_CAST(new_mnt);
  1723. /* Longterm mount to be removed by kern_unmount*() */
  1724. new_mnt->mnt_ns = MNT_NS_INTERNAL;
  1725. return &new_mnt->mnt;
  1726. invalid:
  1727. up_read(&namespace_sem);
  1728. return ERR_PTR(-EINVAL);
  1729. }
  1730. EXPORT_SYMBOL_GPL(clone_private_mount);
  1731. int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg,
  1732. struct vfsmount *root)
  1733. {
  1734. struct mount *mnt;
  1735. int res = f(root, arg);
  1736. if (res)
  1737. return res;
  1738. list_for_each_entry(mnt, &real_mount(root)->mnt_list, mnt_list) {
  1739. res = f(&mnt->mnt, arg);
  1740. if (res)
  1741. return res;
  1742. }
  1743. return 0;
  1744. }
  1745. static void lock_mnt_tree(struct mount *mnt)
  1746. {
  1747. struct mount *p;
  1748. for (p = mnt; p; p = next_mnt(p, mnt)) {
  1749. int flags = p->mnt.mnt_flags;
  1750. /* Don't allow unprivileged users to change mount flags */
  1751. flags |= MNT_LOCK_ATIME;
  1752. if (flags & MNT_READONLY)
  1753. flags |= MNT_LOCK_READONLY;
  1754. if (flags & MNT_NODEV)
  1755. flags |= MNT_LOCK_NODEV;
  1756. if (flags & MNT_NOSUID)
  1757. flags |= MNT_LOCK_NOSUID;
  1758. if (flags & MNT_NOEXEC)
  1759. flags |= MNT_LOCK_NOEXEC;
  1760. /* Don't allow unprivileged users to reveal what is under a mount */
  1761. if (list_empty(&p->mnt_expire))
  1762. flags |= MNT_LOCKED;
  1763. p->mnt.mnt_flags = flags;
  1764. }
  1765. }
  1766. static void cleanup_group_ids(struct mount *mnt, struct mount *end)
  1767. {
  1768. struct mount *p;
  1769. for (p = mnt; p != end; p = next_mnt(p, mnt)) {
  1770. if (p->mnt_group_id && !IS_MNT_SHARED(p))
  1771. mnt_release_group_id(p);
  1772. }
  1773. }
  1774. static int invent_group_ids(struct mount *mnt, bool recurse)
  1775. {
  1776. struct mount *p;
  1777. for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) {
  1778. if (!p->mnt_group_id && !IS_MNT_SHARED(p)) {
  1779. int err = mnt_alloc_group_id(p);
  1780. if (err) {
  1781. cleanup_group_ids(mnt, p);
  1782. return err;
  1783. }
  1784. }
  1785. }
  1786. return 0;
  1787. }
  1788. int count_mounts(struct mnt_namespace *ns, struct mount *mnt)
  1789. {
  1790. unsigned int max = READ_ONCE(sysctl_mount_max);
  1791. unsigned int mounts = 0, old, pending, sum;
  1792. struct mount *p;
  1793. for (p = mnt; p; p = next_mnt(p, mnt))
  1794. mounts++;
  1795. old = ns->mounts;
  1796. pending = ns->pending_mounts;
  1797. sum = old + pending;
  1798. if ((old > sum) ||
  1799. (pending > sum) ||
  1800. (max < sum) ||
  1801. (mounts > (max - sum)))
  1802. return -ENOSPC;
  1803. ns->pending_mounts = pending + mounts;
  1804. return 0;
  1805. }
  1806. /*
  1807. * @source_mnt : mount tree to be attached
  1808. * @nd : place the mount tree @source_mnt is attached
  1809. * @parent_nd : if non-null, detach the source_mnt from its parent and
  1810. * store the parent mount and mountpoint dentry.
  1811. * (done when source_mnt is moved)
  1812. *
  1813. * NOTE: in the table below explains the semantics when a source mount
  1814. * of a given type is attached to a destination mount of a given type.
  1815. * ---------------------------------------------------------------------------
  1816. * | BIND MOUNT OPERATION |
  1817. * |**************************************************************************
  1818. * | source-->| shared | private | slave | unbindable |
  1819. * | dest | | | | |
  1820. * | | | | | | |
  1821. * | v | | | | |
  1822. * |**************************************************************************
  1823. * | shared | shared (++) | shared (+) | shared(+++)| invalid |
  1824. * | | | | | |
  1825. * |non-shared| shared (+) | private | slave (*) | invalid |
  1826. * ***************************************************************************
  1827. * A bind operation clones the source mount and mounts the clone on the
  1828. * destination mount.
  1829. *
  1830. * (++) the cloned mount is propagated to all the mounts in the propagation
  1831. * tree of the destination mount and the cloned mount is added to
  1832. * the peer group of the source mount.
  1833. * (+) the cloned mount is created under the destination mount and is marked
  1834. * as shared. The cloned mount is added to the peer group of the source
  1835. * mount.
  1836. * (+++) the mount is propagated to all the mounts in the propagation tree
  1837. * of the destination mount and the cloned mount is made slave
  1838. * of the same master as that of the source mount. The cloned mount
  1839. * is marked as 'shared and slave'.
  1840. * (*) the cloned mount is made a slave of the same master as that of the
  1841. * source mount.
  1842. *
  1843. * ---------------------------------------------------------------------------
  1844. * | MOVE MOUNT OPERATION |
  1845. * |**************************************************************************
  1846. * | source-->| shared | private | slave | unbindable |
  1847. * | dest | | | | |
  1848. * | | | | | | |
  1849. * | v | | | | |
  1850. * |**************************************************************************
  1851. * | shared | shared (+) | shared (+) | shared(+++) | invalid |
  1852. * | | | | | |
  1853. * |non-shared| shared (+*) | private | slave (*) | unbindable |
  1854. * ***************************************************************************
  1855. *
  1856. * (+) the mount is moved to the destination. And is then propagated to
  1857. * all the mounts in the propagation tree of the destination mount.
  1858. * (+*) the mount is moved to the destination.
  1859. * (+++) the mount is moved to the destination and is then propagated to
  1860. * all the mounts belonging to the destination mount's propagation tree.
  1861. * the mount is marked as 'shared and slave'.
  1862. * (*) the mount continues to be a slave at the new location.
  1863. *
  1864. * if the source mount is a tree, the operations explained above is
  1865. * applied to each mount in the tree.
  1866. * Must be called without spinlocks held, since this function can sleep
  1867. * in allocations.
  1868. */
  1869. static int attach_recursive_mnt(struct mount *source_mnt,
  1870. struct mount *dest_mnt,
  1871. struct mountpoint *dest_mp,
  1872. bool moving)
  1873. {
  1874. struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
  1875. HLIST_HEAD(tree_list);
  1876. struct mnt_namespace *ns = dest_mnt->mnt_ns;
  1877. struct mountpoint *smp;
  1878. struct mount *child, *p;
  1879. struct hlist_node *n;
  1880. int err;
  1881. /* Preallocate a mountpoint in case the new mounts need
  1882. * to be tucked under other mounts.
  1883. */
  1884. smp = get_mountpoint(source_mnt->mnt.mnt_root);
  1885. if (IS_ERR(smp))
  1886. return PTR_ERR(smp);
  1887. /* Is there space to add these mounts to the mount namespace? */
  1888. if (!moving) {
  1889. err = count_mounts(ns, source_mnt);
  1890. if (err)
  1891. goto out;
  1892. }
  1893. if (IS_MNT_SHARED(dest_mnt)) {
  1894. err = invent_group_ids(source_mnt, true);
  1895. if (err)
  1896. goto out;
  1897. err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list);
  1898. lock_mount_hash();
  1899. if (err)
  1900. goto out_cleanup_ids;
  1901. for (p = source_mnt; p; p = next_mnt(p, source_mnt))
  1902. set_mnt_shared(p);
  1903. } else {
  1904. lock_mount_hash();
  1905. }
  1906. if (moving) {
  1907. unhash_mnt(source_mnt);
  1908. attach_mnt(source_mnt, dest_mnt, dest_mp);
  1909. touch_mnt_namespace(source_mnt->mnt_ns);
  1910. } else {
  1911. if (source_mnt->mnt_ns) {
  1912. /* move from anon - the caller will destroy */
  1913. list_del_init(&source_mnt->mnt_ns->list);
  1914. }
  1915. mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt);
  1916. commit_tree(source_mnt);
  1917. }
  1918. hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) {
  1919. struct mount *q;
  1920. hlist_del_init(&child->mnt_hash);
  1921. q = __lookup_mnt(&child->mnt_parent->mnt,
  1922. child->mnt_mountpoint);
  1923. if (q)
  1924. mnt_change_mountpoint(child, smp, q);
  1925. /* Notice when we are propagating across user namespaces */
  1926. if (child->mnt_parent->mnt_ns->user_ns != user_ns)
  1927. lock_mnt_tree(child);
  1928. child->mnt.mnt_flags &= ~MNT_LOCKED;
  1929. commit_tree(child);
  1930. }
  1931. put_mountpoint(smp);
  1932. unlock_mount_hash();
  1933. return 0;
  1934. out_cleanup_ids:
  1935. while (!hlist_empty(&tree_list)) {
  1936. child = hlist_entry(tree_list.first, struct mount, mnt_hash);
  1937. child->mnt_parent->mnt_ns->pending_mounts = 0;
  1938. umount_tree(child, UMOUNT_SYNC);
  1939. }
  1940. unlock_mount_hash();
  1941. cleanup_group_ids(source_mnt, NULL);
  1942. out:
  1943. ns->pending_mounts = 0;
  1944. read_seqlock_excl(&mount_lock);
  1945. put_mountpoint(smp);
  1946. read_sequnlock_excl(&mount_lock);
  1947. return err;
  1948. }
  1949. static struct mountpoint *lock_mount(struct path *path)
  1950. {
  1951. struct vfsmount *mnt;
  1952. struct dentry *dentry = path->dentry;
  1953. retry:
  1954. inode_lock(dentry->d_inode);
  1955. if (unlikely(cant_mount(dentry))) {
  1956. inode_unlock(dentry->d_inode);
  1957. return ERR_PTR(-ENOENT);
  1958. }
  1959. namespace_lock();
  1960. mnt = lookup_mnt(path);
  1961. if (likely(!mnt)) {
  1962. struct mountpoint *mp = get_mountpoint(dentry);
  1963. if (IS_ERR(mp)) {
  1964. namespace_unlock();
  1965. inode_unlock(dentry->d_inode);
  1966. return mp;
  1967. }
  1968. return mp;
  1969. }
  1970. namespace_unlock();
  1971. inode_unlock(path->dentry->d_inode);
  1972. path_put(path);
  1973. path->mnt = mnt;
  1974. dentry = path->dentry = dget(mnt->mnt_root);
  1975. goto retry;
  1976. }
  1977. static void unlock_mount(struct mountpoint *where)
  1978. {
  1979. struct dentry *dentry = where->m_dentry;
  1980. read_seqlock_excl(&mount_lock);
  1981. put_mountpoint(where);
  1982. read_sequnlock_excl(&mount_lock);
  1983. namespace_unlock();
  1984. inode_unlock(dentry->d_inode);
  1985. }
  1986. static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp)
  1987. {
  1988. if (mnt->mnt.mnt_sb->s_flags & SB_NOUSER)
  1989. return -EINVAL;
  1990. if (d_is_dir(mp->m_dentry) !=
  1991. d_is_dir(mnt->mnt.mnt_root))
  1992. return -ENOTDIR;
  1993. return attach_recursive_mnt(mnt, p, mp, false);
  1994. }
  1995. /*
  1996. * Sanity check the flags to change_mnt_propagation.
  1997. */
  1998. static int flags_to_propagation_type(int ms_flags)
  1999. {
  2000. int type = ms_flags & ~(MS_REC | MS_SILENT);
  2001. /* Fail if any non-propagation flags are set */
  2002. if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
  2003. return 0;
  2004. /* Only one propagation flag should be set */
  2005. if (!is_power_of_2(type))
  2006. return 0;
  2007. return type;
  2008. }
  2009. /*
  2010. * recursively change the type of the mountpoint.
  2011. */
  2012. static int do_change_type(struct path *path, int ms_flags)
  2013. {
  2014. struct mount *m;
  2015. struct mount *mnt = real_mount(path->mnt);
  2016. int recurse = ms_flags & MS_REC;
  2017. int type;
  2018. int err = 0;
  2019. if (path->dentry != path->mnt->mnt_root)
  2020. return -EINVAL;
  2021. type = flags_to_propagation_type(ms_flags);
  2022. if (!type)
  2023. return -EINVAL;
  2024. namespace_lock();
  2025. if (type == MS_SHARED) {
  2026. err = invent_group_ids(mnt, recurse);
  2027. if (err)
  2028. goto out_unlock;
  2029. }
  2030. lock_mount_hash();
  2031. for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL))
  2032. change_mnt_propagation(m, type);
  2033. unlock_mount_hash();
  2034. out_unlock:
  2035. namespace_unlock();
  2036. return err;
  2037. }
  2038. static struct mount *__do_loopback(struct path *old_path, int recurse)
  2039. {
  2040. struct mount *mnt = ERR_PTR(-EINVAL), *old = real_mount(old_path->mnt);
  2041. if (IS_MNT_UNBINDABLE(old))
  2042. return mnt;
  2043. if (!check_mnt(old) && old_path->dentry->d_op != &ns_dentry_operations)
  2044. return mnt;
  2045. if (!recurse && has_locked_children(old, old_path->dentry))
  2046. return mnt;
  2047. if (recurse)
  2048. mnt = copy_tree(old, old_path->dentry, CL_COPY_MNT_NS_FILE);
  2049. else
  2050. mnt = clone_mnt(old, old_path->dentry, 0);
  2051. if (!IS_ERR(mnt))
  2052. mnt->mnt.mnt_flags &= ~MNT_LOCKED;
  2053. return mnt;
  2054. }
  2055. /*
  2056. * do loopback mount.
  2057. */
  2058. static int do_loopback(struct path *path, const char *old_name,
  2059. int recurse)
  2060. {
  2061. struct path old_path;
  2062. struct mount *mnt = NULL, *parent;
  2063. struct mountpoint *mp;
  2064. int err;
  2065. if (!old_name || !*old_name)
  2066. return -EINVAL;
  2067. err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
  2068. if (err)
  2069. return err;
  2070. err = -EINVAL;
  2071. if (mnt_ns_loop(old_path.dentry))
  2072. goto out;
  2073. mp = lock_mount(path);
  2074. if (IS_ERR(mp)) {
  2075. err = PTR_ERR(mp);
  2076. goto out;
  2077. }
  2078. parent = real_mount(path->mnt);
  2079. if (!check_mnt(parent))
  2080. goto out2;
  2081. mnt = __do_loopback(&old_path, recurse);
  2082. if (IS_ERR(mnt)) {
  2083. err = PTR_ERR(mnt);
  2084. goto out2;
  2085. }
  2086. err = graft_tree(mnt, parent, mp);
  2087. if (err) {
  2088. lock_mount_hash();
  2089. umount_tree(mnt, UMOUNT_SYNC);
  2090. unlock_mount_hash();
  2091. }
  2092. out2:
  2093. unlock_mount(mp);
  2094. out:
  2095. path_put(&old_path);
  2096. return err;
  2097. }
  2098. static struct file *open_detached_copy(struct path *path, bool recursive)
  2099. {
  2100. struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
  2101. struct mnt_namespace *ns = alloc_mnt_ns(user_ns, true);
  2102. struct mount *mnt, *p;
  2103. struct file *file;
  2104. if (IS_ERR(ns))
  2105. return ERR_CAST(ns);
  2106. namespace_lock();
  2107. mnt = __do_loopback(path, recursive);
  2108. if (IS_ERR(mnt)) {
  2109. namespace_unlock();
  2110. free_mnt_ns(ns);
  2111. return ERR_CAST(mnt);
  2112. }
  2113. lock_mount_hash();
  2114. for (p = mnt; p; p = next_mnt(p, mnt)) {
  2115. p->mnt_ns = ns;
  2116. ns->mounts++;
  2117. }
  2118. ns->root = mnt;
  2119. list_add_tail(&ns->list, &mnt->mnt_list);
  2120. mntget(&mnt->mnt);
  2121. unlock_mount_hash();
  2122. namespace_unlock();
  2123. mntput(path->mnt);
  2124. path->mnt = &mnt->mnt;
  2125. file = dentry_open(path, O_PATH, current_cred());
  2126. if (IS_ERR(file))
  2127. dissolve_on_fput(path->mnt);
  2128. else
  2129. file->f_mode |= FMODE_NEED_UNMOUNT;
  2130. return file;
  2131. }
  2132. SYSCALL_DEFINE3(open_tree, int, dfd, const char __user *, filename, unsigned, flags)
  2133. {
  2134. struct file *file;
  2135. struct path path;
  2136. int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW;
  2137. bool detached = flags & OPEN_TREE_CLONE;
  2138. int error;
  2139. int fd;
  2140. BUILD_BUG_ON(OPEN_TREE_CLOEXEC != O_CLOEXEC);
  2141. if (flags & ~(AT_EMPTY_PATH | AT_NO_AUTOMOUNT | AT_RECURSIVE |
  2142. AT_SYMLINK_NOFOLLOW | OPEN_TREE_CLONE |
  2143. OPEN_TREE_CLOEXEC))
  2144. return -EINVAL;
  2145. if ((flags & (AT_RECURSIVE | OPEN_TREE_CLONE)) == AT_RECURSIVE)
  2146. return -EINVAL;
  2147. if (flags & AT_NO_AUTOMOUNT)
  2148. lookup_flags &= ~LOOKUP_AUTOMOUNT;
  2149. if (flags & AT_SYMLINK_NOFOLLOW)
  2150. lookup_flags &= ~LOOKUP_FOLLOW;
  2151. if (flags & AT_EMPTY_PATH)
  2152. lookup_flags |= LOOKUP_EMPTY;
  2153. if (detached && !may_mount())
  2154. return -EPERM;
  2155. fd = get_unused_fd_flags(flags & O_CLOEXEC);
  2156. if (fd < 0)
  2157. return fd;
  2158. error = user_path_at(dfd, filename, lookup_flags, &path);
  2159. if (unlikely(error)) {
  2160. file = ERR_PTR(error);
  2161. } else {
  2162. if (detached)
  2163. file = open_detached_copy(&path, flags & AT_RECURSIVE);
  2164. else
  2165. file = dentry_open(&path, O_PATH, current_cred());
  2166. path_put(&path);
  2167. }
  2168. if (IS_ERR(file)) {
  2169. put_unused_fd(fd);
  2170. return PTR_ERR(file);
  2171. }
  2172. fd_install(fd, file);
  2173. return fd;
  2174. }
  2175. /*
  2176. * Don't allow locked mount flags to be cleared.
  2177. *
  2178. * No locks need to be held here while testing the various MNT_LOCK
  2179. * flags because those flags can never be cleared once they are set.
  2180. */
  2181. static bool can_change_locked_flags(struct mount *mnt, unsigned int mnt_flags)
  2182. {
  2183. unsigned int fl = mnt->mnt.mnt_flags;
  2184. if ((fl & MNT_LOCK_READONLY) &&
  2185. !(mnt_flags & MNT_READONLY))
  2186. return false;
  2187. if ((fl & MNT_LOCK_NODEV) &&
  2188. !(mnt_flags & MNT_NODEV))
  2189. return false;
  2190. if ((fl & MNT_LOCK_NOSUID) &&
  2191. !(mnt_flags & MNT_NOSUID))
  2192. return false;
  2193. if ((fl & MNT_LOCK_NOEXEC) &&
  2194. !(mnt_flags & MNT_NOEXEC))
  2195. return false;
  2196. if ((fl & MNT_LOCK_ATIME) &&
  2197. ((fl & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK)))
  2198. return false;
  2199. return true;
  2200. }
  2201. static int change_mount_ro_state(struct mount *mnt, unsigned int mnt_flags)
  2202. {
  2203. bool readonly_request = (mnt_flags & MNT_READONLY);
  2204. if (readonly_request == __mnt_is_readonly(&mnt->mnt))
  2205. return 0;
  2206. if (readonly_request)
  2207. return mnt_make_readonly(mnt);
  2208. return __mnt_unmake_readonly(mnt);
  2209. }
  2210. /*
  2211. * Update the user-settable attributes on a mount. The caller must hold
  2212. * sb->s_umount for writing.
  2213. */
  2214. static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags)
  2215. {
  2216. lock_mount_hash();
  2217. mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK;
  2218. mnt->mnt.mnt_flags = mnt_flags;
  2219. touch_mnt_namespace(mnt->mnt_ns);
  2220. unlock_mount_hash();
  2221. }
  2222. static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *mnt)
  2223. {
  2224. struct super_block *sb = mnt->mnt_sb;
  2225. if (!__mnt_is_readonly(mnt) &&
  2226. (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
  2227. char *buf = (char *)__get_free_page(GFP_KERNEL);
  2228. char *mntpath = buf ? d_path(mountpoint, buf, PAGE_SIZE) : ERR_PTR(-ENOMEM);
  2229. struct tm tm;
  2230. time64_to_tm(sb->s_time_max, 0, &tm);
  2231. pr_warn("%s filesystem being %s at %s supports timestamps until %04ld (0x%llx)\n",
  2232. sb->s_type->name,
  2233. is_mounted(mnt) ? "remounted" : "mounted",
  2234. mntpath,
  2235. tm.tm_year+1900, (unsigned long long)sb->s_time_max);
  2236. free_page((unsigned long)buf);
  2237. }
  2238. }
  2239. /*
  2240. * Handle reconfiguration of the mountpoint only without alteration of the
  2241. * superblock it refers to. This is triggered by specifying MS_REMOUNT|MS_BIND
  2242. * to mount(2).
  2243. */
  2244. static int do_reconfigure_mnt(struct path *path, unsigned int mnt_flags)
  2245. {
  2246. struct super_block *sb = path->mnt->mnt_sb;
  2247. struct mount *mnt = real_mount(path->mnt);
  2248. int ret;
  2249. if (!check_mnt(mnt))
  2250. return -EINVAL;
  2251. if (path->dentry != mnt->mnt.mnt_root)
  2252. return -EINVAL;
  2253. if (!can_change_locked_flags(mnt, mnt_flags))
  2254. return -EPERM;
  2255. down_write(&sb->s_umount);
  2256. ret = change_mount_ro_state(mnt, mnt_flags);
  2257. if (ret == 0)
  2258. set_mount_attributes(mnt, mnt_flags);
  2259. up_write(&sb->s_umount);
  2260. mnt_warn_timestamp_expiry(path, &mnt->mnt);
  2261. return ret;
  2262. }
  2263. /*
  2264. * change filesystem flags. dir should be a physical root of filesystem.
  2265. * If you've mounted a non-root directory somewhere and want to do remount
  2266. * on it - tough luck.
  2267. */
  2268. static int do_remount(struct path *path, int ms_flags, int sb_flags,
  2269. int mnt_flags, void *data)
  2270. {
  2271. int err;
  2272. struct super_block *sb = path->mnt->mnt_sb;
  2273. struct mount *mnt = real_mount(path->mnt);
  2274. struct fs_context *fc;
  2275. if (!check_mnt(mnt))
  2276. return -EINVAL;
  2277. if (path->dentry != path->mnt->mnt_root)
  2278. return -EINVAL;
  2279. if (!can_change_locked_flags(mnt, mnt_flags))
  2280. return -EPERM;
  2281. fc = fs_context_for_reconfigure(path->dentry, sb_flags, MS_RMT_MASK);
  2282. if (IS_ERR(fc))
  2283. return PTR_ERR(fc);
  2284. fc->oldapi = true;
  2285. err = parse_monolithic_mount_data(fc, data);
  2286. if (!err) {
  2287. down_write(&sb->s_umount);
  2288. err = -EPERM;
  2289. if (ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) {
  2290. err = reconfigure_super(fc);
  2291. if (!err)
  2292. set_mount_attributes(mnt, mnt_flags);
  2293. }
  2294. up_write(&sb->s_umount);
  2295. }
  2296. mnt_warn_timestamp_expiry(path, &mnt->mnt);
  2297. put_fs_context(fc);
  2298. return err;
  2299. }
  2300. static inline int tree_contains_unbindable(struct mount *mnt)
  2301. {
  2302. struct mount *p;
  2303. for (p = mnt; p; p = next_mnt(p, mnt)) {
  2304. if (IS_MNT_UNBINDABLE(p))
  2305. return 1;
  2306. }
  2307. return 0;
  2308. }
  2309. /*
  2310. * Check that there aren't references to earlier/same mount namespaces in the
  2311. * specified subtree. Such references can act as pins for mount namespaces
  2312. * that aren't checked by the mount-cycle checking code, thereby allowing
  2313. * cycles to be made.
  2314. */
  2315. static bool check_for_nsfs_mounts(struct mount *subtree)
  2316. {
  2317. struct mount *p;
  2318. bool ret = false;
  2319. lock_mount_hash();
  2320. for (p = subtree; p; p = next_mnt(p, subtree))
  2321. if (mnt_ns_loop(p->mnt.mnt_root))
  2322. goto out;
  2323. ret = true;
  2324. out:
  2325. unlock_mount_hash();
  2326. return ret;
  2327. }
  2328. static int do_move_mount(struct path *old_path, struct path *new_path)
  2329. {
  2330. struct mnt_namespace *ns;
  2331. struct mount *p;
  2332. struct mount *old;
  2333. struct mount *parent;
  2334. struct mountpoint *mp, *old_mp;
  2335. int err;
  2336. bool attached;
  2337. mp = lock_mount(new_path);
  2338. if (IS_ERR(mp))
  2339. return PTR_ERR(mp);
  2340. old = real_mount(old_path->mnt);
  2341. p = real_mount(new_path->mnt);
  2342. parent = old->mnt_parent;
  2343. attached = mnt_has_parent(old);
  2344. old_mp = old->mnt_mp;
  2345. ns = old->mnt_ns;
  2346. err = -EINVAL;
  2347. /* The mountpoint must be in our namespace. */
  2348. if (!check_mnt(p))
  2349. goto out;
  2350. /* The thing moved must be mounted... */
  2351. if (!is_mounted(&old->mnt))
  2352. goto out;
  2353. /* ... and either ours or the root of anon namespace */
  2354. if (!(attached ? check_mnt(old) : is_anon_ns(ns)))
  2355. goto out;
  2356. if (old->mnt.mnt_flags & MNT_LOCKED)
  2357. goto out;
  2358. if (old_path->dentry != old_path->mnt->mnt_root)
  2359. goto out;
  2360. if (d_is_dir(new_path->dentry) !=
  2361. d_is_dir(old_path->dentry))
  2362. goto out;
  2363. /*
  2364. * Don't move a mount residing in a shared parent.
  2365. */
  2366. if (attached && IS_MNT_SHARED(parent))
  2367. goto out;
  2368. /*
  2369. * Don't move a mount tree containing unbindable mounts to a destination
  2370. * mount which is shared.
  2371. */
  2372. if (IS_MNT_SHARED(p) && tree_contains_unbindable(old))
  2373. goto out;
  2374. err = -ELOOP;
  2375. if (!check_for_nsfs_mounts(old))
  2376. goto out;
  2377. for (; mnt_has_parent(p); p = p->mnt_parent)
  2378. if (p == old)
  2379. goto out;
  2380. err = attach_recursive_mnt(old, real_mount(new_path->mnt), mp,
  2381. attached);
  2382. if (err)
  2383. goto out;
  2384. /* if the mount is moved, it should no longer be expire
  2385. * automatically */
  2386. list_del_init(&old->mnt_expire);
  2387. if (attached)
  2388. put_mountpoint(old_mp);
  2389. out:
  2390. unlock_mount(mp);
  2391. if (!err) {
  2392. if (attached)
  2393. mntput_no_expire(parent);
  2394. else
  2395. free_mnt_ns(ns);
  2396. }
  2397. return err;
  2398. }
  2399. static int do_move_mount_old(struct path *path, const char *old_name)
  2400. {
  2401. struct path old_path;
  2402. int err;
  2403. if (!old_name || !*old_name)
  2404. return -EINVAL;
  2405. err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
  2406. if (err)
  2407. return err;
  2408. err = do_move_mount(&old_path, path);
  2409. path_put(&old_path);
  2410. return err;
  2411. }
  2412. /*
  2413. * add a mount into a namespace's mount tree
  2414. */
  2415. static int do_add_mount(struct mount *newmnt, struct mountpoint *mp,
  2416. struct path *path, int mnt_flags)
  2417. {
  2418. struct mount *parent = real_mount(path->mnt);
  2419. mnt_flags &= ~MNT_INTERNAL_FLAGS;
  2420. if (unlikely(!check_mnt(parent))) {
  2421. /* that's acceptable only for automounts done in private ns */
  2422. if (!(mnt_flags & MNT_SHRINKABLE))
  2423. return -EINVAL;
  2424. /* ... and for those we'd better have mountpoint still alive */
  2425. if (!parent->mnt_ns)
  2426. return -EINVAL;
  2427. }
  2428. /* Refuse the same filesystem on the same mount point */
  2429. if (path->mnt->mnt_sb == newmnt->mnt.mnt_sb &&
  2430. path->mnt->mnt_root == path->dentry)
  2431. return -EBUSY;
  2432. if (d_is_symlink(newmnt->mnt.mnt_root))
  2433. return -EINVAL;
  2434. newmnt->mnt.mnt_flags = mnt_flags;
  2435. return graft_tree(newmnt, parent, mp);
  2436. }
  2437. static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags);
  2438. /*
  2439. * Create a new mount using a superblock configuration and request it
  2440. * be added to the namespace tree.
  2441. */
  2442. static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint,
  2443. unsigned int mnt_flags)
  2444. {
  2445. struct vfsmount *mnt;
  2446. struct mountpoint *mp;
  2447. struct super_block *sb = fc->root->d_sb;
  2448. int error;
  2449. error = security_sb_kern_mount(sb);
  2450. if (!error && mount_too_revealing(sb, &mnt_flags))
  2451. error = -EPERM;
  2452. if (unlikely(error)) {
  2453. fc_drop_locked(fc);
  2454. return error;
  2455. }
  2456. up_write(&sb->s_umount);
  2457. mnt = vfs_create_mount(fc);
  2458. if (IS_ERR(mnt))
  2459. return PTR_ERR(mnt);
  2460. mnt_warn_timestamp_expiry(mountpoint, mnt);
  2461. mp = lock_mount(mountpoint);
  2462. if (IS_ERR(mp)) {
  2463. mntput(mnt);
  2464. return PTR_ERR(mp);
  2465. }
  2466. error = do_add_mount(real_mount(mnt), mp, mountpoint, mnt_flags);
  2467. unlock_mount(mp);
  2468. if (error < 0)
  2469. mntput(mnt);
  2470. return error;
  2471. }
  2472. /*
  2473. * create a new mount for userspace and request it to be added into the
  2474. * namespace's tree
  2475. */
  2476. static int do_new_mount(struct path *path, const char *fstype, int sb_flags,
  2477. int mnt_flags, const char *name, void *data)
  2478. {
  2479. struct file_system_type *type;
  2480. struct fs_context *fc;
  2481. const char *subtype = NULL;
  2482. int err = 0;
  2483. if (!fstype)
  2484. return -EINVAL;
  2485. type = get_fs_type(fstype);
  2486. if (!type)
  2487. return -ENODEV;
  2488. if (type->fs_flags & FS_HAS_SUBTYPE) {
  2489. subtype = strchr(fstype, '.');
  2490. if (subtype) {
  2491. subtype++;
  2492. if (!*subtype) {
  2493. put_filesystem(type);
  2494. return -EINVAL;
  2495. }
  2496. }
  2497. }
  2498. fc = fs_context_for_mount(type, sb_flags);
  2499. put_filesystem(type);
  2500. if (IS_ERR(fc))
  2501. return PTR_ERR(fc);
  2502. if (subtype)
  2503. err = vfs_parse_fs_string(fc, "subtype",
  2504. subtype, strlen(subtype));
  2505. if (!err && name)
  2506. err = vfs_parse_fs_string(fc, "source", name, strlen(name));
  2507. if (!err)
  2508. err = parse_monolithic_mount_data(fc, data);
  2509. if (!err && !mount_capable(fc))
  2510. err = -EPERM;
  2511. if (!err)
  2512. err = vfs_get_tree(fc);
  2513. if (!err)
  2514. err = do_new_mount_fc(fc, path, mnt_flags);
  2515. put_fs_context(fc);
  2516. return err;
  2517. }
  2518. int finish_automount(struct vfsmount *m, struct path *path)
  2519. {
  2520. struct dentry *dentry = path->dentry;
  2521. struct mountpoint *mp;
  2522. struct mount *mnt;
  2523. int err;
  2524. if (!m)
  2525. return 0;
  2526. if (IS_ERR(m))
  2527. return PTR_ERR(m);
  2528. mnt = real_mount(m);
  2529. /* The new mount record should have at least 2 refs to prevent it being
  2530. * expired before we get a chance to add it
  2531. */
  2532. BUG_ON(mnt_get_count(mnt) < 2);
  2533. if (m->mnt_sb == path->mnt->mnt_sb &&
  2534. m->mnt_root == dentry) {
  2535. err = -ELOOP;
  2536. goto discard;
  2537. }
  2538. /*
  2539. * we don't want to use lock_mount() - in this case finding something
  2540. * that overmounts our mountpoint to be means "quitely drop what we've
  2541. * got", not "try to mount it on top".
  2542. */
  2543. inode_lock(dentry->d_inode);
  2544. namespace_lock();
  2545. if (unlikely(cant_mount(dentry))) {
  2546. err = -ENOENT;
  2547. goto discard_locked;
  2548. }
  2549. rcu_read_lock();
  2550. if (unlikely(__lookup_mnt(path->mnt, dentry))) {
  2551. rcu_read_unlock();
  2552. err = 0;
  2553. goto discard_locked;
  2554. }
  2555. rcu_read_unlock();
  2556. mp = get_mountpoint(dentry);
  2557. if (IS_ERR(mp)) {
  2558. err = PTR_ERR(mp);
  2559. goto discard_locked;
  2560. }
  2561. err = do_add_mount(mnt, mp, path, path->mnt->mnt_flags | MNT_SHRINKABLE);
  2562. unlock_mount(mp);
  2563. if (unlikely(err))
  2564. goto discard;
  2565. mntput(m);
  2566. return 0;
  2567. discard_locked:
  2568. namespace_unlock();
  2569. inode_unlock(dentry->d_inode);
  2570. discard:
  2571. /* remove m from any expiration list it may be on */
  2572. if (!list_empty(&mnt->mnt_expire)) {
  2573. namespace_lock();
  2574. list_del_init(&mnt->mnt_expire);
  2575. namespace_unlock();
  2576. }
  2577. mntput(m);
  2578. mntput(m);
  2579. return err;
  2580. }
  2581. /**
  2582. * mnt_set_expiry - Put a mount on an expiration list
  2583. * @mnt: The mount to list.
  2584. * @expiry_list: The list to add the mount to.
  2585. */
  2586. void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list)
  2587. {
  2588. namespace_lock();
  2589. list_add_tail(&real_mount(mnt)->mnt_expire, expiry_list);
  2590. namespace_unlock();
  2591. }
  2592. EXPORT_SYMBOL(mnt_set_expiry);
  2593. /*
  2594. * process a list of expirable mountpoints with the intent of discarding any
  2595. * mountpoints that aren't in use and haven't been touched since last we came
  2596. * here
  2597. */
  2598. void mark_mounts_for_expiry(struct list_head *mounts)
  2599. {
  2600. struct mount *mnt, *next;
  2601. LIST_HEAD(graveyard);
  2602. if (list_empty(mounts))
  2603. return;
  2604. namespace_lock();
  2605. lock_mount_hash();
  2606. /* extract from the expiration list every vfsmount that matches the
  2607. * following criteria:
  2608. * - only referenced by its parent vfsmount
  2609. * - still marked for expiry (marked on the last call here; marks are
  2610. * cleared by mntput())
  2611. */
  2612. list_for_each_entry_safe(mnt, next, mounts, mnt_expire) {
  2613. if (!xchg(&mnt->mnt_expiry_mark, 1) ||
  2614. propagate_mount_busy(mnt, 1))
  2615. continue;
  2616. list_move(&mnt->mnt_expire, &graveyard);
  2617. }
  2618. while (!list_empty(&graveyard)) {
  2619. mnt = list_first_entry(&graveyard, struct mount, mnt_expire);
  2620. touch_mnt_namespace(mnt->mnt_ns);
  2621. umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
  2622. }
  2623. unlock_mount_hash();
  2624. namespace_unlock();
  2625. }
  2626. EXPORT_SYMBOL_GPL(mark_mounts_for_expiry);
  2627. /*
  2628. * Ripoff of 'select_parent()'
  2629. *
  2630. * search the list of submounts for a given mountpoint, and move any
  2631. * shrinkable submounts to the 'graveyard' list.
  2632. */
  2633. static int select_submounts(struct mount *parent, struct list_head *graveyard)
  2634. {
  2635. struct mount *this_parent = parent;
  2636. struct list_head *next;
  2637. int found = 0;
  2638. repeat:
  2639. next = this_parent->mnt_mounts.next;
  2640. resume:
  2641. while (next != &this_parent->mnt_mounts) {
  2642. struct list_head *tmp = next;
  2643. struct mount *mnt = list_entry(tmp, struct mount, mnt_child);
  2644. next = tmp->next;
  2645. if (!(mnt->mnt.mnt_flags & MNT_SHRINKABLE))
  2646. continue;
  2647. /*
  2648. * Descend a level if the d_mounts list is non-empty.
  2649. */
  2650. if (!list_empty(&mnt->mnt_mounts)) {
  2651. this_parent = mnt;
  2652. goto repeat;
  2653. }
  2654. if (!propagate_mount_busy(mnt, 1)) {
  2655. list_move_tail(&mnt->mnt_expire, graveyard);
  2656. found++;
  2657. }
  2658. }
  2659. /*
  2660. * All done at this level ... ascend and resume the search
  2661. */
  2662. if (this_parent != parent) {
  2663. next = this_parent->mnt_child.next;
  2664. this_parent = this_parent->mnt_parent;
  2665. goto resume;
  2666. }
  2667. return found;
  2668. }
  2669. /*
  2670. * process a list of expirable mountpoints with the intent of discarding any
  2671. * submounts of a specific parent mountpoint
  2672. *
  2673. * mount_lock must be held for write
  2674. */
  2675. static void shrink_submounts(struct mount *mnt)
  2676. {
  2677. LIST_HEAD(graveyard);
  2678. struct mount *m;
  2679. /* extract submounts of 'mountpoint' from the expiration list */
  2680. while (select_submounts(mnt, &graveyard)) {
  2681. while (!list_empty(&graveyard)) {
  2682. m = list_first_entry(&graveyard, struct mount,
  2683. mnt_expire);
  2684. touch_mnt_namespace(m->mnt_ns);
  2685. umount_tree(m, UMOUNT_PROPAGATE|UMOUNT_SYNC);
  2686. }
  2687. }
  2688. }
  2689. static void *copy_mount_options(const void __user * data)
  2690. {
  2691. char *copy;
  2692. unsigned left, offset;
  2693. if (!data)
  2694. return NULL;
  2695. copy = kmalloc(PAGE_SIZE, GFP_KERNEL);
  2696. if (!copy)
  2697. return ERR_PTR(-ENOMEM);
  2698. left = copy_from_user(copy, data, PAGE_SIZE);
  2699. /*
  2700. * Not all architectures have an exact copy_from_user(). Resort to
  2701. * byte at a time.
  2702. */
  2703. offset = PAGE_SIZE - left;
  2704. while (left) {
  2705. char c;
  2706. if (get_user(c, (const char __user *)data + offset))
  2707. break;
  2708. copy[offset] = c;
  2709. left--;
  2710. offset++;
  2711. }
  2712. if (left == PAGE_SIZE) {
  2713. kfree(copy);
  2714. return ERR_PTR(-EFAULT);
  2715. }
  2716. return copy;
  2717. }
  2718. static char *copy_mount_string(const void __user *data)
  2719. {
  2720. return data ? strndup_user(data, PATH_MAX) : NULL;
  2721. }
  2722. /*
  2723. * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to
  2724. * be given to the mount() call (ie: read-only, no-dev, no-suid etc).
  2725. *
  2726. * data is a (void *) that can point to any structure up to
  2727. * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent
  2728. * information (or be NULL).
  2729. *
  2730. * Pre-0.97 versions of mount() didn't have a flags word.
  2731. * When the flags word was introduced its top half was required
  2732. * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9.
  2733. * Therefore, if this magic number is present, it carries no information
  2734. * and must be discarded.
  2735. */
  2736. int path_mount(const char *dev_name, struct path *path,
  2737. const char *type_page, unsigned long flags, void *data_page)
  2738. {
  2739. unsigned int mnt_flags = 0, sb_flags;
  2740. int ret;
  2741. /* Discard magic */
  2742. if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
  2743. flags &= ~MS_MGC_MSK;
  2744. /* Basic sanity checks */
  2745. if (data_page)
  2746. ((char *)data_page)[PAGE_SIZE - 1] = 0;
  2747. if (flags & MS_NOUSER)
  2748. return -EINVAL;
  2749. ret = security_sb_mount(dev_name, path, type_page, flags, data_page);
  2750. if (ret)
  2751. return ret;
  2752. if (!may_mount())
  2753. return -EPERM;
  2754. if ((flags & SB_MANDLOCK) && !may_mandlock())
  2755. return -EPERM;
  2756. /* Default to relatime unless overriden */
  2757. if (!(flags & MS_NOATIME))
  2758. mnt_flags |= MNT_RELATIME;
  2759. /* Separate the per-mountpoint flags */
  2760. if (flags & MS_NOSUID)
  2761. mnt_flags |= MNT_NOSUID;
  2762. if (flags & MS_NODEV)
  2763. mnt_flags |= MNT_NODEV;
  2764. if (flags & MS_NOEXEC)
  2765. mnt_flags |= MNT_NOEXEC;
  2766. if (flags & MS_NOATIME)
  2767. mnt_flags |= MNT_NOATIME;
  2768. if (flags & MS_NODIRATIME)
  2769. mnt_flags |= MNT_NODIRATIME;
  2770. if (flags & MS_STRICTATIME)
  2771. mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME);
  2772. if (flags & MS_RDONLY)
  2773. mnt_flags |= MNT_READONLY;
  2774. if (flags & MS_NOSYMFOLLOW)
  2775. mnt_flags |= MNT_NOSYMFOLLOW;
  2776. /* The default atime for remount is preservation */
  2777. if ((flags & MS_REMOUNT) &&
  2778. ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME |
  2779. MS_STRICTATIME)) == 0)) {
  2780. mnt_flags &= ~MNT_ATIME_MASK;
  2781. mnt_flags |= path->mnt->mnt_flags & MNT_ATIME_MASK;
  2782. }
  2783. sb_flags = flags & (SB_RDONLY |
  2784. SB_SYNCHRONOUS |
  2785. SB_MANDLOCK |
  2786. SB_DIRSYNC |
  2787. SB_SILENT |
  2788. SB_POSIXACL |
  2789. SB_LAZYTIME |
  2790. SB_I_VERSION);
  2791. if ((flags & (MS_REMOUNT | MS_BIND)) == (MS_REMOUNT | MS_BIND))
  2792. return do_reconfigure_mnt(path, mnt_flags);
  2793. if (flags & MS_REMOUNT)
  2794. return do_remount(path, flags, sb_flags, mnt_flags, data_page);
  2795. if (flags & MS_BIND)
  2796. return do_loopback(path, dev_name, flags & MS_REC);
  2797. if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
  2798. return do_change_type(path, flags);
  2799. if (flags & MS_MOVE)
  2800. return do_move_mount_old(path, dev_name);
  2801. return do_new_mount(path, type_page, sb_flags, mnt_flags, dev_name,
  2802. data_page);
  2803. }
  2804. long do_mount(const char *dev_name, const char __user *dir_name,
  2805. const char *type_page, unsigned long flags, void *data_page)
  2806. {
  2807. struct path path;
  2808. int ret;
  2809. ret = user_path_at(AT_FDCWD, dir_name, LOOKUP_FOLLOW, &path);
  2810. if (ret)
  2811. return ret;
  2812. ret = path_mount(dev_name, &path, type_page, flags, data_page);
  2813. path_put(&path);
  2814. return ret;
  2815. }
  2816. static struct ucounts *inc_mnt_namespaces(struct user_namespace *ns)
  2817. {
  2818. return inc_ucount(ns, current_euid(), UCOUNT_MNT_NAMESPACES);
  2819. }
  2820. static void dec_mnt_namespaces(struct ucounts *ucounts)
  2821. {
  2822. dec_ucount(ucounts, UCOUNT_MNT_NAMESPACES);
  2823. }
  2824. static void free_mnt_ns(struct mnt_namespace *ns)
  2825. {
  2826. if (!is_anon_ns(ns))
  2827. ns_free_inum(&ns->ns);
  2828. dec_mnt_namespaces(ns->ucounts);
  2829. put_user_ns(ns->user_ns);
  2830. kfree(ns);
  2831. }
  2832. /*
  2833. * Assign a sequence number so we can detect when we attempt to bind
  2834. * mount a reference to an older mount namespace into the current
  2835. * mount namespace, preventing reference counting loops. A 64bit
  2836. * number incrementing at 10Ghz will take 12,427 years to wrap which
  2837. * is effectively never, so we can ignore the possibility.
  2838. */
  2839. static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1);
  2840. static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns, bool anon)
  2841. {
  2842. struct mnt_namespace *new_ns;
  2843. struct ucounts *ucounts;
  2844. int ret;
  2845. ucounts = inc_mnt_namespaces(user_ns);
  2846. if (!ucounts)
  2847. return ERR_PTR(-ENOSPC);
  2848. new_ns = kzalloc(sizeof(struct mnt_namespace), GFP_KERNEL);
  2849. if (!new_ns) {
  2850. dec_mnt_namespaces(ucounts);
  2851. return ERR_PTR(-ENOMEM);
  2852. }
  2853. if (!anon) {
  2854. ret = ns_alloc_inum(&new_ns->ns);
  2855. if (ret) {
  2856. kfree(new_ns);
  2857. dec_mnt_namespaces(ucounts);
  2858. return ERR_PTR(ret);
  2859. }
  2860. }
  2861. new_ns->ns.ops = &mntns_operations;
  2862. if (!anon)
  2863. new_ns->seq = atomic64_add_return(1, &mnt_ns_seq);
  2864. atomic_set(&new_ns->count, 1);
  2865. INIT_LIST_HEAD(&new_ns->list);
  2866. init_waitqueue_head(&new_ns->poll);
  2867. spin_lock_init(&new_ns->ns_lock);
  2868. new_ns->user_ns = get_user_ns(user_ns);
  2869. new_ns->ucounts = ucounts;
  2870. return new_ns;
  2871. }
  2872. __latent_entropy
  2873. struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
  2874. struct user_namespace *user_ns, struct fs_struct *new_fs)
  2875. {
  2876. struct mnt_namespace *new_ns;
  2877. struct vfsmount *rootmnt = NULL, *pwdmnt = NULL;
  2878. struct mount *p, *q;
  2879. struct mount *old;
  2880. struct mount *new;
  2881. int copy_flags;
  2882. BUG_ON(!ns);
  2883. if (likely(!(flags & CLONE_NEWNS))) {
  2884. get_mnt_ns(ns);
  2885. return ns;
  2886. }
  2887. old = ns->root;
  2888. new_ns = alloc_mnt_ns(user_ns, false);
  2889. if (IS_ERR(new_ns))
  2890. return new_ns;
  2891. namespace_lock();
  2892. /* First pass: copy the tree topology */
  2893. copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE;
  2894. if (user_ns != ns->user_ns)
  2895. copy_flags |= CL_SHARED_TO_SLAVE;
  2896. new = copy_tree(old, old->mnt.mnt_root, copy_flags);
  2897. if (IS_ERR(new)) {
  2898. namespace_unlock();
  2899. free_mnt_ns(new_ns);
  2900. return ERR_CAST(new);
  2901. }
  2902. if (user_ns != ns->user_ns) {
  2903. lock_mount_hash();
  2904. lock_mnt_tree(new);
  2905. unlock_mount_hash();
  2906. }
  2907. new_ns->root = new;
  2908. list_add_tail(&new_ns->list, &new->mnt_list);
  2909. /*
  2910. * Second pass: switch the tsk->fs->* elements and mark new vfsmounts
  2911. * as belonging to new namespace. We have already acquired a private
  2912. * fs_struct, so tsk->fs->lock is not needed.
  2913. */
  2914. p = old;
  2915. q = new;
  2916. while (p) {
  2917. q->mnt_ns = new_ns;
  2918. new_ns->mounts++;
  2919. if (new_fs) {
  2920. if (&p->mnt == new_fs->root.mnt) {
  2921. new_fs->root.mnt = mntget(&q->mnt);
  2922. rootmnt = &p->mnt;
  2923. }
  2924. if (&p->mnt == new_fs->pwd.mnt) {
  2925. new_fs->pwd.mnt = mntget(&q->mnt);
  2926. pwdmnt = &p->mnt;
  2927. }
  2928. }
  2929. p = next_mnt(p, old);
  2930. q = next_mnt(q, new);
  2931. if (!q)
  2932. break;
  2933. while (p->mnt.mnt_root != q->mnt.mnt_root)
  2934. p = next_mnt(p, old);
  2935. }
  2936. namespace_unlock();
  2937. if (rootmnt)
  2938. mntput(rootmnt);
  2939. if (pwdmnt)
  2940. mntput(pwdmnt);
  2941. return new_ns;
  2942. }
  2943. struct dentry *mount_subtree(struct vfsmount *m, const char *name)
  2944. {
  2945. struct mount *mnt = real_mount(m);
  2946. struct mnt_namespace *ns;
  2947. struct super_block *s;
  2948. struct path path;
  2949. int err;
  2950. ns = alloc_mnt_ns(&init_user_ns, true);
  2951. if (IS_ERR(ns)) {
  2952. mntput(m);
  2953. return ERR_CAST(ns);
  2954. }
  2955. mnt->mnt_ns = ns;
  2956. ns->root = mnt;
  2957. ns->mounts++;
  2958. list_add(&mnt->mnt_list, &ns->list);
  2959. err = vfs_path_lookup(m->mnt_root, m,
  2960. name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
  2961. put_mnt_ns(ns);
  2962. if (err)
  2963. return ERR_PTR(err);
  2964. /* trade a vfsmount reference for active sb one */
  2965. s = path.mnt->mnt_sb;
  2966. atomic_inc(&s->s_active);
  2967. mntput(path.mnt);
  2968. /* lock the sucker */
  2969. down_write(&s->s_umount);
  2970. /* ... and return the root of (sub)tree on it */
  2971. return path.dentry;
  2972. }
  2973. EXPORT_SYMBOL(mount_subtree);
  2974. SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
  2975. char __user *, type, unsigned long, flags, void __user *, data)
  2976. {
  2977. int ret;
  2978. char *kernel_type;
  2979. char *kernel_dev;
  2980. void *options;
  2981. kernel_type = copy_mount_string(type);
  2982. ret = PTR_ERR(kernel_type);
  2983. if (IS_ERR(kernel_type))
  2984. goto out_type;
  2985. kernel_dev = copy_mount_string(dev_name);
  2986. ret = PTR_ERR(kernel_dev);
  2987. if (IS_ERR(kernel_dev))
  2988. goto out_dev;
  2989. options = copy_mount_options(data);
  2990. ret = PTR_ERR(options);
  2991. if (IS_ERR(options))
  2992. goto out_data;
  2993. ret = do_mount(kernel_dev, dir_name, kernel_type, flags, options);
  2994. kfree(options);
  2995. out_data:
  2996. kfree(kernel_dev);
  2997. out_dev:
  2998. kfree(kernel_type);
  2999. out_type:
  3000. return ret;
  3001. }
  3002. /*
  3003. * Create a kernel mount representation for a new, prepared superblock
  3004. * (specified by fs_fd) and attach to an open_tree-like file descriptor.
  3005. */
  3006. SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
  3007. unsigned int, attr_flags)
  3008. {
  3009. struct mnt_namespace *ns;
  3010. struct fs_context *fc;
  3011. struct file *file;
  3012. struct path newmount;
  3013. struct mount *mnt;
  3014. struct fd f;
  3015. unsigned int mnt_flags = 0;
  3016. long ret;
  3017. if (!may_mount())
  3018. return -EPERM;
  3019. if ((flags & ~(FSMOUNT_CLOEXEC)) != 0)
  3020. return -EINVAL;
  3021. if (attr_flags & ~(MOUNT_ATTR_RDONLY |
  3022. MOUNT_ATTR_NOSUID |
  3023. MOUNT_ATTR_NODEV |
  3024. MOUNT_ATTR_NOEXEC |
  3025. MOUNT_ATTR__ATIME |
  3026. MOUNT_ATTR_NODIRATIME))
  3027. return -EINVAL;
  3028. if (attr_flags & MOUNT_ATTR_RDONLY)
  3029. mnt_flags |= MNT_READONLY;
  3030. if (attr_flags & MOUNT_ATTR_NOSUID)
  3031. mnt_flags |= MNT_NOSUID;
  3032. if (attr_flags & MOUNT_ATTR_NODEV)
  3033. mnt_flags |= MNT_NODEV;
  3034. if (attr_flags & MOUNT_ATTR_NOEXEC)
  3035. mnt_flags |= MNT_NOEXEC;
  3036. if (attr_flags & MOUNT_ATTR_NODIRATIME)
  3037. mnt_flags |= MNT_NODIRATIME;
  3038. switch (attr_flags & MOUNT_ATTR__ATIME) {
  3039. case MOUNT_ATTR_STRICTATIME:
  3040. break;
  3041. case MOUNT_ATTR_NOATIME:
  3042. mnt_flags |= MNT_NOATIME;
  3043. break;
  3044. case MOUNT_ATTR_RELATIME:
  3045. mnt_flags |= MNT_RELATIME;
  3046. break;
  3047. default:
  3048. return -EINVAL;
  3049. }
  3050. f = fdget(fs_fd);
  3051. if (!f.file)
  3052. return -EBADF;
  3053. ret = -EINVAL;
  3054. if (f.file->f_op != &fscontext_fops)
  3055. goto err_fsfd;
  3056. fc = f.file->private_data;
  3057. ret = mutex_lock_interruptible(&fc->uapi_mutex);
  3058. if (ret < 0)
  3059. goto err_fsfd;
  3060. /* There must be a valid superblock or we can't mount it */
  3061. ret = -EINVAL;
  3062. if (!fc->root)
  3063. goto err_unlock;
  3064. ret = -EPERM;
  3065. if (mount_too_revealing(fc->root->d_sb, &mnt_flags)) {
  3066. pr_warn("VFS: Mount too revealing\n");
  3067. goto err_unlock;
  3068. }
  3069. ret = -EBUSY;
  3070. if (fc->phase != FS_CONTEXT_AWAITING_MOUNT)
  3071. goto err_unlock;
  3072. ret = -EPERM;
  3073. if ((fc->sb_flags & SB_MANDLOCK) && !may_mandlock())
  3074. goto err_unlock;
  3075. newmount.mnt = vfs_create_mount(fc);
  3076. if (IS_ERR(newmount.mnt)) {
  3077. ret = PTR_ERR(newmount.mnt);
  3078. goto err_unlock;
  3079. }
  3080. newmount.dentry = dget(fc->root);
  3081. newmount.mnt->mnt_flags = mnt_flags;
  3082. /* We've done the mount bit - now move the file context into more or
  3083. * less the same state as if we'd done an fspick(). We don't want to
  3084. * do any memory allocation or anything like that at this point as we
  3085. * don't want to have to handle any errors incurred.
  3086. */
  3087. vfs_clean_context(fc);
  3088. ns = alloc_mnt_ns(current->nsproxy->mnt_ns->user_ns, true);
  3089. if (IS_ERR(ns)) {
  3090. ret = PTR_ERR(ns);
  3091. goto err_path;
  3092. }
  3093. mnt = real_mount(newmount.mnt);
  3094. mnt->mnt_ns = ns;
  3095. ns->root = mnt;
  3096. ns->mounts = 1;
  3097. list_add(&mnt->mnt_list, &ns->list);
  3098. mntget(newmount.mnt);
  3099. /* Attach to an apparent O_PATH fd with a note that we need to unmount
  3100. * it, not just simply put it.
  3101. */
  3102. file = dentry_open(&newmount, O_PATH, fc->cred);
  3103. if (IS_ERR(file)) {
  3104. dissolve_on_fput(newmount.mnt);
  3105. ret = PTR_ERR(file);
  3106. goto err_path;
  3107. }
  3108. file->f_mode |= FMODE_NEED_UNMOUNT;
  3109. ret = get_unused_fd_flags((flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0);
  3110. if (ret >= 0)
  3111. fd_install(ret, file);
  3112. else
  3113. fput(file);
  3114. err_path:
  3115. path_put(&newmount);
  3116. err_unlock:
  3117. mutex_unlock(&fc->uapi_mutex);
  3118. err_fsfd:
  3119. fdput(f);
  3120. return ret;
  3121. }
  3122. /*
  3123. * Move a mount from one place to another. In combination with
  3124. * fsopen()/fsmount() this is used to install a new mount and in combination
  3125. * with open_tree(OPEN_TREE_CLONE [| AT_RECURSIVE]) it can be used to copy
  3126. * a mount subtree.
  3127. *
  3128. * Note the flags value is a combination of MOVE_MOUNT_* flags.
  3129. */
  3130. SYSCALL_DEFINE5(move_mount,
  3131. int, from_dfd, const char __user *, from_pathname,
  3132. int, to_dfd, const char __user *, to_pathname,
  3133. unsigned int, flags)
  3134. {
  3135. struct path from_path, to_path;
  3136. unsigned int lflags;
  3137. int ret = 0;
  3138. if (!may_mount())
  3139. return -EPERM;
  3140. if (flags & ~MOVE_MOUNT__MASK)
  3141. return -EINVAL;
  3142. /* If someone gives a pathname, they aren't permitted to move
  3143. * from an fd that requires unmount as we can't get at the flag
  3144. * to clear it afterwards.
  3145. */
  3146. lflags = 0;
  3147. if (flags & MOVE_MOUNT_F_SYMLINKS) lflags |= LOOKUP_FOLLOW;
  3148. if (flags & MOVE_MOUNT_F_AUTOMOUNTS) lflags |= LOOKUP_AUTOMOUNT;
  3149. if (flags & MOVE_MOUNT_F_EMPTY_PATH) lflags |= LOOKUP_EMPTY;
  3150. ret = user_path_at(from_dfd, from_pathname, lflags, &from_path);
  3151. if (ret < 0)
  3152. return ret;
  3153. lflags = 0;
  3154. if (flags & MOVE_MOUNT_T_SYMLINKS) lflags |= LOOKUP_FOLLOW;
  3155. if (flags & MOVE_MOUNT_T_AUTOMOUNTS) lflags |= LOOKUP_AUTOMOUNT;
  3156. if (flags & MOVE_MOUNT_T_EMPTY_PATH) lflags |= LOOKUP_EMPTY;
  3157. ret = user_path_at(to_dfd, to_pathname, lflags, &to_path);
  3158. if (ret < 0)
  3159. goto out_from;
  3160. ret = security_move_mount(&from_path, &to_path);
  3161. if (ret < 0)
  3162. goto out_to;
  3163. ret = do_move_mount(&from_path, &to_path);
  3164. out_to:
  3165. path_put(&to_path);
  3166. out_from:
  3167. path_put(&from_path);
  3168. return ret;
  3169. }
  3170. /*
  3171. * Return true if path is reachable from root
  3172. *
  3173. * namespace_sem or mount_lock is held
  3174. */
  3175. bool is_path_reachable(struct mount *mnt, struct dentry *dentry,
  3176. const struct path *root)
  3177. {
  3178. while (&mnt->mnt != root->mnt && mnt_has_parent(mnt)) {
  3179. dentry = mnt->mnt_mountpoint;
  3180. mnt = mnt->mnt_parent;
  3181. }
  3182. return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry);
  3183. }
  3184. bool path_is_under(const struct path *path1, const struct path *path2)
  3185. {
  3186. bool res;
  3187. read_seqlock_excl(&mount_lock);
  3188. res = is_path_reachable(real_mount(path1->mnt), path1->dentry, path2);
  3189. read_sequnlock_excl(&mount_lock);
  3190. return res;
  3191. }
  3192. EXPORT_SYMBOL(path_is_under);
  3193. /*
  3194. * pivot_root Semantics:
  3195. * Moves the root file system of the current process to the directory put_old,
  3196. * makes new_root as the new root file system of the current process, and sets
  3197. * root/cwd of all processes which had them on the current root to new_root.
  3198. *
  3199. * Restrictions:
  3200. * The new_root and put_old must be directories, and must not be on the
  3201. * same file system as the current process root. The put_old must be
  3202. * underneath new_root, i.e. adding a non-zero number of /.. to the string
  3203. * pointed to by put_old must yield the same directory as new_root. No other
  3204. * file system may be mounted on put_old. After all, new_root is a mountpoint.
  3205. *
  3206. * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem.
  3207. * See Documentation/filesystems/ramfs-rootfs-initramfs.rst for alternatives
  3208. * in this situation.
  3209. *
  3210. * Notes:
  3211. * - we don't move root/cwd if they are not at the root (reason: if something
  3212. * cared enough to change them, it's probably wrong to force them elsewhere)
  3213. * - it's okay to pick a root that isn't the root of a file system, e.g.
  3214. * /nfs/my_root where /nfs is the mount point. It must be a mountpoint,
  3215. * though, so you may need to say mount --bind /nfs/my_root /nfs/my_root
  3216. * first.
  3217. */
  3218. SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
  3219. const char __user *, put_old)
  3220. {
  3221. struct path new, old, root;
  3222. struct mount *new_mnt, *root_mnt, *old_mnt, *root_parent, *ex_parent;
  3223. struct mountpoint *old_mp, *root_mp;
  3224. int error;
  3225. if (!may_mount())
  3226. return -EPERM;
  3227. error = user_path_at(AT_FDCWD, new_root,
  3228. LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &new);
  3229. if (error)
  3230. goto out0;
  3231. error = user_path_at(AT_FDCWD, put_old,
  3232. LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &old);
  3233. if (error)
  3234. goto out1;
  3235. error = security_sb_pivotroot(&old, &new);
  3236. if (error)
  3237. goto out2;
  3238. get_fs_root(current->fs, &root);
  3239. old_mp = lock_mount(&old);
  3240. error = PTR_ERR(old_mp);
  3241. if (IS_ERR(old_mp))
  3242. goto out3;
  3243. error = -EINVAL;
  3244. new_mnt = real_mount(new.mnt);
  3245. root_mnt = real_mount(root.mnt);
  3246. old_mnt = real_mount(old.mnt);
  3247. ex_parent = new_mnt->mnt_parent;
  3248. root_parent = root_mnt->mnt_parent;
  3249. if (IS_MNT_SHARED(old_mnt) ||
  3250. IS_MNT_SHARED(ex_parent) ||
  3251. IS_MNT_SHARED(root_parent))
  3252. goto out4;
  3253. if (!check_mnt(root_mnt) || !check_mnt(new_mnt))
  3254. goto out4;
  3255. if (new_mnt->mnt.mnt_flags & MNT_LOCKED)
  3256. goto out4;
  3257. error = -ENOENT;
  3258. if (d_unlinked(new.dentry))
  3259. goto out4;
  3260. error = -EBUSY;
  3261. if (new_mnt == root_mnt || old_mnt == root_mnt)
  3262. goto out4; /* loop, on the same file system */
  3263. error = -EINVAL;
  3264. if (root.mnt->mnt_root != root.dentry)
  3265. goto out4; /* not a mountpoint */
  3266. if (!mnt_has_parent(root_mnt))
  3267. goto out4; /* not attached */
  3268. if (new.mnt->mnt_root != new.dentry)
  3269. goto out4; /* not a mountpoint */
  3270. if (!mnt_has_parent(new_mnt))
  3271. goto out4; /* not attached */
  3272. /* make sure we can reach put_old from new_root */
  3273. if (!is_path_reachable(old_mnt, old.dentry, &new))
  3274. goto out4;
  3275. /* make certain new is below the root */
  3276. if (!is_path_reachable(new_mnt, new.dentry, &root))
  3277. goto out4;
  3278. lock_mount_hash();
  3279. umount_mnt(new_mnt);
  3280. root_mp = unhash_mnt(root_mnt); /* we'll need its mountpoint */
  3281. if (root_mnt->mnt.mnt_flags & MNT_LOCKED) {
  3282. new_mnt->mnt.mnt_flags |= MNT_LOCKED;
  3283. root_mnt->mnt.mnt_flags &= ~MNT_LOCKED;
  3284. }
  3285. /* mount old root on put_old */
  3286. attach_mnt(root_mnt, old_mnt, old_mp);
  3287. /* mount new_root on / */
  3288. attach_mnt(new_mnt, root_parent, root_mp);
  3289. mnt_add_count(root_parent, -1);
  3290. touch_mnt_namespace(current->nsproxy->mnt_ns);
  3291. /* A moved mount should not expire automatically */
  3292. list_del_init(&new_mnt->mnt_expire);
  3293. put_mountpoint(root_mp);
  3294. unlock_mount_hash();
  3295. chroot_fs_refs(&root, &new);
  3296. error = 0;
  3297. out4:
  3298. unlock_mount(old_mp);
  3299. if (!error)
  3300. mntput_no_expire(ex_parent);
  3301. out3:
  3302. path_put(&root);
  3303. out2:
  3304. path_put(&old);
  3305. out1:
  3306. path_put(&new);
  3307. out0:
  3308. return error;
  3309. }
  3310. static void __init init_mount_tree(void)
  3311. {
  3312. struct vfsmount *mnt;
  3313. struct mount *m;
  3314. struct mnt_namespace *ns;
  3315. struct path root;
  3316. mnt = vfs_kern_mount(&rootfs_fs_type, 0, "rootfs", NULL);
  3317. if (IS_ERR(mnt))
  3318. panic("Can't create rootfs");
  3319. ns = alloc_mnt_ns(&init_user_ns, false);
  3320. if (IS_ERR(ns))
  3321. panic("Can't allocate initial namespace");
  3322. m = real_mount(mnt);
  3323. m->mnt_ns = ns;
  3324. ns->root = m;
  3325. ns->mounts = 1;
  3326. list_add(&m->mnt_list, &ns->list);
  3327. init_task.nsproxy->mnt_ns = ns;
  3328. get_mnt_ns(ns);
  3329. root.mnt = mnt;
  3330. root.dentry = mnt->mnt_root;
  3331. mnt->mnt_flags |= MNT_LOCKED;
  3332. set_fs_pwd(current->fs, &root);
  3333. set_fs_root(current->fs, &root);
  3334. }
  3335. void __init mnt_init(void)
  3336. {
  3337. int err;
  3338. mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount),
  3339. 0, SLAB_HWCACHE_ALIGN | SLAB_PANIC, NULL);
  3340. mount_hashtable = alloc_large_system_hash("Mount-cache",
  3341. sizeof(struct hlist_head),
  3342. mhash_entries, 19,
  3343. HASH_ZERO,
  3344. &m_hash_shift, &m_hash_mask, 0, 0);
  3345. mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache",
  3346. sizeof(struct hlist_head),
  3347. mphash_entries, 19,
  3348. HASH_ZERO,
  3349. &mp_hash_shift, &mp_hash_mask, 0, 0);
  3350. if (!mount_hashtable || !mountpoint_hashtable)
  3351. panic("Failed to allocate mount hash table\n");
  3352. kernfs_init();
  3353. err = sysfs_init();
  3354. if (err)
  3355. printk(KERN_WARNING "%s: sysfs_init error: %d\n",
  3356. __func__, err);
  3357. fs_kobj = kobject_create_and_add("fs", NULL);
  3358. if (!fs_kobj)
  3359. printk(KERN_WARNING "%s: kobj create error\n", __func__);
  3360. shmem_init();
  3361. init_rootfs();
  3362. init_mount_tree();
  3363. }
  3364. void put_mnt_ns(struct mnt_namespace *ns)
  3365. {
  3366. if (!atomic_dec_and_test(&ns->count))
  3367. return;
  3368. drop_collected_mounts(&ns->root->mnt);
  3369. free_mnt_ns(ns);
  3370. }
  3371. struct vfsmount *kern_mount(struct file_system_type *type)
  3372. {
  3373. struct vfsmount *mnt;
  3374. mnt = vfs_kern_mount(type, SB_KERNMOUNT, type->name, NULL);
  3375. if (!IS_ERR(mnt)) {
  3376. /*
  3377. * it is a longterm mount, don't release mnt until
  3378. * we unmount before file sys is unregistered
  3379. */
  3380. real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL;
  3381. }
  3382. return mnt;
  3383. }
  3384. EXPORT_SYMBOL_GPL(kern_mount);
  3385. void kern_unmount(struct vfsmount *mnt)
  3386. {
  3387. /* release long term mount so mount point can be released */
  3388. if (!IS_ERR_OR_NULL(mnt)) {
  3389. real_mount(mnt)->mnt_ns = NULL;
  3390. synchronize_rcu(); /* yecchhh... */
  3391. mntput(mnt);
  3392. }
  3393. }
  3394. EXPORT_SYMBOL(kern_unmount);
  3395. void kern_unmount_array(struct vfsmount *mnt[], unsigned int num)
  3396. {
  3397. unsigned int i;
  3398. for (i = 0; i < num; i++)
  3399. if (mnt[i])
  3400. real_mount(mnt[i])->mnt_ns = NULL;
  3401. synchronize_rcu_expedited();
  3402. for (i = 0; i < num; i++)
  3403. mntput(mnt[i]);
  3404. }
  3405. EXPORT_SYMBOL(kern_unmount_array);
  3406. bool our_mnt(struct vfsmount *mnt)
  3407. {
  3408. return check_mnt(real_mount(mnt));
  3409. }
  3410. bool current_chrooted(void)
  3411. {
  3412. /* Does the current process have a non-standard root */
  3413. struct path ns_root;
  3414. struct path fs_root;
  3415. bool chrooted;
  3416. /* Find the namespace root */
  3417. ns_root.mnt = &current->nsproxy->mnt_ns->root->mnt;
  3418. ns_root.dentry = ns_root.mnt->mnt_root;
  3419. path_get(&ns_root);
  3420. while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root))
  3421. ;
  3422. get_fs_root(current->fs, &fs_root);
  3423. chrooted = !path_equal(&fs_root, &ns_root);
  3424. path_put(&fs_root);
  3425. path_put(&ns_root);
  3426. return chrooted;
  3427. }
  3428. static bool mnt_already_visible(struct mnt_namespace *ns,
  3429. const struct super_block *sb,
  3430. int *new_mnt_flags)
  3431. {
  3432. int new_flags = *new_mnt_flags;
  3433. struct mount *mnt;
  3434. bool visible = false;
  3435. down_read(&namespace_sem);
  3436. lock_ns_list(ns);
  3437. list_for_each_entry(mnt, &ns->list, mnt_list) {
  3438. struct mount *child;
  3439. int mnt_flags;
  3440. if (mnt_is_cursor(mnt))
  3441. continue;
  3442. if (mnt->mnt.mnt_sb->s_type != sb->s_type)
  3443. continue;
  3444. /* This mount is not fully visible if it's root directory
  3445. * is not the root directory of the filesystem.
  3446. */
  3447. if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
  3448. continue;
  3449. /* A local view of the mount flags */
  3450. mnt_flags = mnt->mnt.mnt_flags;
  3451. /* Don't miss readonly hidden in the superblock flags */
  3452. if (sb_rdonly(mnt->mnt.mnt_sb))
  3453. mnt_flags |= MNT_LOCK_READONLY;
  3454. /* Verify the mount flags are equal to or more permissive
  3455. * than the proposed new mount.
  3456. */
  3457. if ((mnt_flags & MNT_LOCK_READONLY) &&
  3458. !(new_flags & MNT_READONLY))
  3459. continue;
  3460. if ((mnt_flags & MNT_LOCK_ATIME) &&
  3461. ((mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK)))
  3462. continue;
  3463. /* This mount is not fully visible if there are any
  3464. * locked child mounts that cover anything except for
  3465. * empty directories.
  3466. */
  3467. list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
  3468. struct inode *inode = child->mnt_mountpoint->d_inode;
  3469. /* Only worry about locked mounts */
  3470. if (!(child->mnt.mnt_flags & MNT_LOCKED))
  3471. continue;
  3472. /* Is the directory permanetly empty? */
  3473. if (!is_empty_dir_inode(inode))
  3474. goto next;
  3475. }
  3476. /* Preserve the locked attributes */
  3477. *new_mnt_flags |= mnt_flags & (MNT_LOCK_READONLY | \
  3478. MNT_LOCK_ATIME);
  3479. visible = true;
  3480. goto found;
  3481. next: ;
  3482. }
  3483. found:
  3484. unlock_ns_list(ns);
  3485. up_read(&namespace_sem);
  3486. return visible;
  3487. }
  3488. static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags)
  3489. {
  3490. const unsigned long required_iflags = SB_I_NOEXEC | SB_I_NODEV;
  3491. struct mnt_namespace *ns = current->nsproxy->mnt_ns;
  3492. unsigned long s_iflags;
  3493. if (ns->user_ns == &init_user_ns)
  3494. return false;
  3495. /* Can this filesystem be too revealing? */
  3496. s_iflags = sb->s_iflags;
  3497. if (!(s_iflags & SB_I_USERNS_VISIBLE))
  3498. return false;
  3499. if ((s_iflags & required_iflags) != required_iflags) {
  3500. WARN_ONCE(1, "Expected s_iflags to contain 0x%lx\n",
  3501. required_iflags);
  3502. return true;
  3503. }
  3504. return !mnt_already_visible(ns, sb, new_mnt_flags);
  3505. }
  3506. bool mnt_may_suid(struct vfsmount *mnt)
  3507. {
  3508. /*
  3509. * Foreign mounts (accessed via fchdir or through /proc
  3510. * symlinks) are always treated as if they are nosuid. This
  3511. * prevents namespaces from trusting potentially unsafe
  3512. * suid/sgid bits, file caps, or security labels that originate
  3513. * in other namespaces.
  3514. */
  3515. return !(mnt->mnt_flags & MNT_NOSUID) && check_mnt(real_mount(mnt)) &&
  3516. current_in_userns(mnt->mnt_sb->s_user_ns);
  3517. }
  3518. static struct ns_common *mntns_get(struct task_struct *task)
  3519. {
  3520. struct ns_common *ns = NULL;
  3521. struct nsproxy *nsproxy;
  3522. task_lock(task);
  3523. nsproxy = task->nsproxy;
  3524. if (nsproxy) {
  3525. ns = &nsproxy->mnt_ns->ns;
  3526. get_mnt_ns(to_mnt_ns(ns));
  3527. }
  3528. task_unlock(task);
  3529. return ns;
  3530. }
  3531. static void mntns_put(struct ns_common *ns)
  3532. {
  3533. put_mnt_ns(to_mnt_ns(ns));
  3534. }
  3535. static int mntns_install(struct nsset *nsset, struct ns_common *ns)
  3536. {
  3537. struct nsproxy *nsproxy = nsset->nsproxy;
  3538. struct fs_struct *fs = nsset->fs;
  3539. struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns;
  3540. struct user_namespace *user_ns = nsset->cred->user_ns;
  3541. struct path root;
  3542. int err;
  3543. if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
  3544. !ns_capable(user_ns, CAP_SYS_CHROOT) ||
  3545. !ns_capable(user_ns, CAP_SYS_ADMIN))
  3546. return -EPERM;
  3547. if (is_anon_ns(mnt_ns))
  3548. return -EINVAL;
  3549. if (fs->users != 1)
  3550. return -EINVAL;
  3551. get_mnt_ns(mnt_ns);
  3552. old_mnt_ns = nsproxy->mnt_ns;
  3553. nsproxy->mnt_ns = mnt_ns;
  3554. /* Find the root */
  3555. err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt,
  3556. "/", LOOKUP_DOWN, &root);
  3557. if (err) {
  3558. /* revert to old namespace */
  3559. nsproxy->mnt_ns = old_mnt_ns;
  3560. put_mnt_ns(mnt_ns);
  3561. return err;
  3562. }
  3563. put_mnt_ns(old_mnt_ns);
  3564. /* Update the pwd and root */
  3565. set_fs_pwd(fs, &root);
  3566. set_fs_root(fs, &root);
  3567. path_put(&root);
  3568. return 0;
  3569. }
  3570. static struct user_namespace *mntns_owner(struct ns_common *ns)
  3571. {
  3572. return to_mnt_ns(ns)->user_ns;
  3573. }
  3574. const struct proc_ns_operations mntns_operations = {
  3575. .name = "mnt",
  3576. .type = CLONE_NEWNS,
  3577. .get = mntns_get,
  3578. .put = mntns_put,
  3579. .install = mntns_install,
  3580. .owner = mntns_owner,
  3581. };