1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17#include <linux/init.h>
18#include <linux/export.h>
19#include <linux/kernel.h>
20#include <linux/slab.h>
21#include <linux/fs.h>
22#include <linux/namei.h>
23#include <linux/pagemap.h>
24#include <linux/fsnotify.h>
25#include <linux/personality.h>
26#include <linux/security.h>
27#include <linux/ima.h>
28#include <linux/syscalls.h>
29#include <linux/mount.h>
30#include <linux/audit.h>
31#include <linux/capability.h>
32#include <linux/file.h>
33#include <linux/fcntl.h>
34#include <linux/device_cgroup.h>
35#include <linux/fs_struct.h>
36#include <linux/posix_acl.h>
37#include <asm/uaccess.h>
38
39#include "internal.h"
40#include "mount.h"
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120void final_putname(struct filename *name)
121{
122 if (name->separate) {
123 __putname(name->name);
124 kfree(name);
125 } else {
126 __putname(name);
127 }
128}
129
130#define EMBEDDED_NAME_MAX (PATH_MAX - sizeof(struct filename))
131
132static struct filename *
133getname_flags(const char __user *filename, int flags, int *empty)
134{
135 struct filename *result, *err;
136 int len;
137 long max;
138 char *kname;
139
140 result = audit_reusename(filename);
141 if (result)
142 return result;
143
144 result = __getname();
145 if (unlikely(!result))
146 return ERR_PTR(-ENOMEM);
147
148
149
150
151
152 kname = (char *)result + sizeof(*result);
153 result->name = kname;
154 result->separate = false;
155 max = EMBEDDED_NAME_MAX;
156
157recopy:
158 len = strncpy_from_user(kname, filename, max);
159 if (unlikely(len < 0)) {
160 err = ERR_PTR(len);
161 goto error;
162 }
163
164
165
166
167
168
169
170 if (len == EMBEDDED_NAME_MAX && max == EMBEDDED_NAME_MAX) {
171 kname = (char *)result;
172
173 result = kzalloc(sizeof(*result), GFP_KERNEL);
174 if (!result) {
175 err = ERR_PTR(-ENOMEM);
176 result = (struct filename *)kname;
177 goto error;
178 }
179 result->name = kname;
180 result->separate = true;
181 max = PATH_MAX;
182 goto recopy;
183 }
184
185
186 if (unlikely(!len)) {
187 if (empty)
188 *empty = 1;
189 err = ERR_PTR(-ENOENT);
190 if (!(flags & LOOKUP_EMPTY))
191 goto error;
192 }
193
194 err = ERR_PTR(-ENAMETOOLONG);
195 if (unlikely(len >= PATH_MAX))
196 goto error;
197
198 result->uptr = filename;
199 audit_getname(result);
200 return result;
201
202error:
203 final_putname(result);
204 return err;
205}
206
207struct filename *
208getname(const char __user * filename)
209{
210 return getname_flags(filename, 0, NULL);
211}
212EXPORT_SYMBOL(getname);
213
214#ifdef CONFIG_AUDITSYSCALL
215void putname(struct filename *name)
216{
217 if (unlikely(!audit_dummy_context()))
218 return audit_putname(name);
219 final_putname(name);
220}
221#endif
222
223static int check_acl(struct inode *inode, int mask)
224{
225#ifdef CONFIG_FS_POSIX_ACL
226 struct posix_acl *acl;
227
228 if (mask & MAY_NOT_BLOCK) {
229 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
230 if (!acl)
231 return -EAGAIN;
232
233 if (acl == ACL_NOT_CACHED)
234 return -ECHILD;
235 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
236 }
237
238 acl = get_cached_acl(inode, ACL_TYPE_ACCESS);
239
240
241
242
243
244
245
246
247
248 if (acl == ACL_NOT_CACHED) {
249 if (inode->i_op->get_acl) {
250 acl = inode->i_op->get_acl(inode, ACL_TYPE_ACCESS);
251 if (IS_ERR(acl))
252 return PTR_ERR(acl);
253 } else {
254 set_cached_acl(inode, ACL_TYPE_ACCESS, NULL);
255 return -EAGAIN;
256 }
257 }
258
259 if (acl) {
260 int error = posix_acl_permission(inode, acl, mask);
261 posix_acl_release(acl);
262 return error;
263 }
264#endif
265
266 return -EAGAIN;
267}
268
269
270
271
272static int acl_permission_check(struct inode *inode, int mask)
273{
274 unsigned int mode = inode->i_mode;
275
276 if (likely(uid_eq(current_fsuid(), inode->i_uid)))
277 mode >>= 6;
278 else {
279 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
280 int error = check_acl(inode, mask);
281 if (error != -EAGAIN)
282 return error;
283 }
284
285 if (in_group_p(inode->i_gid))
286 mode >>= 3;
287 }
288
289
290
291
292 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
293 return 0;
294 return -EACCES;
295}
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311int generic_permission(struct inode *inode, int mask)
312{
313 int ret;
314
315
316
317
318 ret = acl_permission_check(inode, mask);
319 if (ret != -EACCES)
320 return ret;
321
322 if (S_ISDIR(inode->i_mode)) {
323
324 if (inode_capable(inode, CAP_DAC_OVERRIDE))
325 return 0;
326 if (!(mask & MAY_WRITE))
327 if (inode_capable(inode, CAP_DAC_READ_SEARCH))
328 return 0;
329 return -EACCES;
330 }
331
332
333
334
335
336 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
337 if (inode_capable(inode, CAP_DAC_OVERRIDE))
338 return 0;
339
340
341
342
343 mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
344 if (mask == MAY_READ)
345 if (inode_capable(inode, CAP_DAC_READ_SEARCH))
346 return 0;
347
348 return -EACCES;
349}
350
351
352
353
354
355
356
357static inline int do_inode_permission(struct inode *inode, int mask)
358{
359 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
360 if (likely(inode->i_op->permission))
361 return inode->i_op->permission(inode, mask);
362
363
364 spin_lock(&inode->i_lock);
365 inode->i_opflags |= IOP_FASTPERM;
366 spin_unlock(&inode->i_lock);
367 }
368 return generic_permission(inode, mask);
369}
370
371
372
373
374
375
376
377
378
379
380
381
382
383int __inode_permission(struct inode *inode, int mask)
384{
385 int retval;
386
387 if (unlikely(mask & MAY_WRITE)) {
388
389
390
391 if (IS_IMMUTABLE(inode))
392 return -EACCES;
393 }
394
395 retval = do_inode_permission(inode, mask);
396 if (retval)
397 return retval;
398
399 retval = devcgroup_inode_permission(inode, mask);
400 if (retval)
401 return retval;
402
403 return security_inode_permission(inode, mask);
404}
405
406
407
408
409
410
411
412
413
414static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
415{
416 if (unlikely(mask & MAY_WRITE)) {
417 umode_t mode = inode->i_mode;
418
419
420 if ((sb->s_flags & MS_RDONLY) &&
421 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
422 return -EROFS;
423 }
424 return 0;
425}
426
427
428
429
430
431
432
433
434
435
436
437
438int inode_permission(struct inode *inode, int mask)
439{
440 int retval;
441
442 retval = sb_permission(inode->i_sb, inode, mask);
443 if (retval)
444 return retval;
445 return __inode_permission(inode, mask);
446}
447
448
449
450
451
452
453
454void path_get(const struct path *path)
455{
456 mntget(path->mnt);
457 dget(path->dentry);
458}
459EXPORT_SYMBOL(path_get);
460
461
462
463
464
465
466
467void path_put(const struct path *path)
468{
469 dput(path->dentry);
470 mntput(path->mnt);
471}
472EXPORT_SYMBOL(path_put);
473
474
475
476
477
478
479
480
481
482
483
484
485static inline void lock_rcu_walk(void)
486{
487 br_read_lock(&vfsmount_lock);
488 rcu_read_lock();
489}
490
491static inline void unlock_rcu_walk(void)
492{
493 rcu_read_unlock();
494 br_read_unlock(&vfsmount_lock);
495}
496
497
498
499
500
501
502
503
504
505
506
507static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
508{
509 struct fs_struct *fs = current->fs;
510 struct dentry *parent = nd->path.dentry;
511 int want_root = 0;
512
513 BUG_ON(!(nd->flags & LOOKUP_RCU));
514 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
515 want_root = 1;
516 spin_lock(&fs->lock);
517 if (nd->root.mnt != fs->root.mnt ||
518 nd->root.dentry != fs->root.dentry)
519 goto err_root;
520 }
521 spin_lock(&parent->d_lock);
522 if (!dentry) {
523 if (!__d_rcu_to_refcount(parent, nd->seq))
524 goto err_parent;
525 BUG_ON(nd->inode != parent->d_inode);
526 } else {
527 if (dentry->d_parent != parent)
528 goto err_parent;
529 spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
530 if (!__d_rcu_to_refcount(dentry, nd->seq))
531 goto err_child;
532
533
534
535
536
537
538 BUG_ON(!IS_ROOT(dentry) && dentry->d_parent != parent);
539 BUG_ON(!parent->d_count);
540 parent->d_count++;
541 spin_unlock(&dentry->d_lock);
542 }
543 spin_unlock(&parent->d_lock);
544 if (want_root) {
545 path_get(&nd->root);
546 spin_unlock(&fs->lock);
547 }
548 mntget(nd->path.mnt);
549
550 unlock_rcu_walk();
551 nd->flags &= ~LOOKUP_RCU;
552 return 0;
553
554err_child:
555 spin_unlock(&dentry->d_lock);
556err_parent:
557 spin_unlock(&parent->d_lock);
558err_root:
559 if (want_root)
560 spin_unlock(&fs->lock);
561 return -ECHILD;
562}
563
564static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
565{
566 return dentry->d_op->d_revalidate(dentry, flags);
567}
568
569
570
571
572
573
574
575
576
577
578
579static int complete_walk(struct nameidata *nd)
580{
581 struct dentry *dentry = nd->path.dentry;
582 int status;
583
584 if (nd->flags & LOOKUP_RCU) {
585 nd->flags &= ~LOOKUP_RCU;
586 if (!(nd->flags & LOOKUP_ROOT))
587 nd->root.mnt = NULL;
588 spin_lock(&dentry->d_lock);
589 if (unlikely(!__d_rcu_to_refcount(dentry, nd->seq))) {
590 spin_unlock(&dentry->d_lock);
591 unlock_rcu_walk();
592 return -ECHILD;
593 }
594 BUG_ON(nd->inode != dentry->d_inode);
595 spin_unlock(&dentry->d_lock);
596 mntget(nd->path.mnt);
597 unlock_rcu_walk();
598 }
599
600 if (likely(!(nd->flags & LOOKUP_JUMPED)))
601 return 0;
602
603 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
604 return 0;
605
606 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
607 if (status > 0)
608 return 0;
609
610 if (!status)
611 status = -ESTALE;
612
613 path_put(&nd->path);
614 return status;
615}
616
617static __always_inline void set_root(struct nameidata *nd)
618{
619 if (!nd->root.mnt)
620 get_fs_root(current->fs, &nd->root);
621}
622
623static int link_path_walk(const char *, struct nameidata *);
624
625static __always_inline void set_root_rcu(struct nameidata *nd)
626{
627 if (!nd->root.mnt) {
628 struct fs_struct *fs = current->fs;
629 unsigned seq;
630
631 do {
632 seq = read_seqcount_begin(&fs->seq);
633 nd->root = fs->root;
634 nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
635 } while (read_seqcount_retry(&fs->seq, seq));
636 }
637}
638
639static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
640{
641 int ret;
642
643 if (IS_ERR(link))
644 goto fail;
645
646 if (*link == '/') {
647 set_root(nd);
648 path_put(&nd->path);
649 nd->path = nd->root;
650 path_get(&nd->root);
651 nd->flags |= LOOKUP_JUMPED;
652 }
653 nd->inode = nd->path.dentry->d_inode;
654
655 ret = link_path_walk(link, nd);
656 return ret;
657fail:
658 path_put(&nd->path);
659 return PTR_ERR(link);
660}
661
662static void path_put_conditional(struct path *path, struct nameidata *nd)
663{
664 dput(path->dentry);
665 if (path->mnt != nd->path.mnt)
666 mntput(path->mnt);
667}
668
669static inline void path_to_nameidata(const struct path *path,
670 struct nameidata *nd)
671{
672 if (!(nd->flags & LOOKUP_RCU)) {
673 dput(nd->path.dentry);
674 if (nd->path.mnt != path->mnt)
675 mntput(nd->path.mnt);
676 }
677 nd->path.mnt = path->mnt;
678 nd->path.dentry = path->dentry;
679}
680
681
682
683
684
685void nd_jump_link(struct nameidata *nd, struct path *path)
686{
687 path_put(&nd->path);
688
689 nd->path = *path;
690 nd->inode = nd->path.dentry->d_inode;
691 nd->flags |= LOOKUP_JUMPED;
692}
693
694static inline void put_link(struct nameidata *nd, struct path *link, void *cookie)
695{
696 struct inode *inode = link->dentry->d_inode;
697 if (inode->i_op->put_link)
698 inode->i_op->put_link(link->dentry, nd, cookie);
699 path_put(link);
700}
701
702int sysctl_protected_symlinks __read_mostly = 0;
703int sysctl_protected_hardlinks __read_mostly = 0;
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721static inline int may_follow_link(struct path *link, struct nameidata *nd)
722{
723 const struct inode *inode;
724 const struct inode *parent;
725
726 if (!sysctl_protected_symlinks)
727 return 0;
728
729
730 inode = link->dentry->d_inode;
731 if (uid_eq(current_cred()->fsuid, inode->i_uid))
732 return 0;
733
734
735 parent = nd->path.dentry->d_inode;
736 if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
737 return 0;
738
739
740 if (uid_eq(parent->i_uid, inode->i_uid))
741 return 0;
742
743 audit_log_link_denied("follow_link", link);
744 path_put_conditional(link, nd);
745 path_put(&nd->path);
746 return -EACCES;
747}
748
749
750
751
752
753
754
755
756
757
758
759
760
761static bool safe_hardlink_source(struct inode *inode)
762{
763 umode_t mode = inode->i_mode;
764
765
766 if (!S_ISREG(mode))
767 return false;
768
769
770 if (mode & S_ISUID)
771 return false;
772
773
774 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
775 return false;
776
777
778 if (inode_permission(inode, MAY_READ | MAY_WRITE))
779 return false;
780
781 return true;
782}
783
784
785
786
787
788
789
790
791
792
793
794
795
796static int may_linkat(struct path *link)
797{
798 const struct cred *cred;
799 struct inode *inode;
800
801 if (!sysctl_protected_hardlinks)
802 return 0;
803
804 cred = current_cred();
805 inode = link->dentry->d_inode;
806
807
808
809
810 if (uid_eq(cred->fsuid, inode->i_uid) || safe_hardlink_source(inode) ||
811 capable(CAP_FOWNER))
812 return 0;
813
814 audit_log_link_denied("linkat", link);
815 return -EPERM;
816}
817
818static __always_inline int
819follow_link(struct path *link, struct nameidata *nd, void **p)
820{
821 struct dentry *dentry = link->dentry;
822 int error;
823 char *s;
824
825 BUG_ON(nd->flags & LOOKUP_RCU);
826
827 if (link->mnt == nd->path.mnt)
828 mntget(link->mnt);
829
830 error = -ELOOP;
831 if (unlikely(current->total_link_count >= 40))
832 goto out_put_nd_path;
833
834 cond_resched();
835 current->total_link_count++;
836
837 touch_atime(link);
838 nd_set_link(nd, NULL);
839
840 error = security_inode_follow_link(link->dentry, nd);
841 if (error)
842 goto out_put_nd_path;
843
844 nd->last_type = LAST_BIND;
845 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
846 error = PTR_ERR(*p);
847 if (IS_ERR(*p))
848 goto out_put_nd_path;
849
850 error = 0;
851 s = nd_get_link(nd);
852 if (s) {
853 error = __vfs_follow_link(nd, s);
854 if (unlikely(error))
855 put_link(nd, link, *p);
856 }
857
858 return error;
859
860out_put_nd_path:
861 *p = NULL;
862 path_put(&nd->path);
863 path_put(link);
864 return error;
865}
866
867static int follow_up_rcu(struct path *path)
868{
869 struct mount *mnt = real_mount(path->mnt);
870 struct mount *parent;
871 struct dentry *mountpoint;
872
873 parent = mnt->mnt_parent;
874 if (&parent->mnt == path->mnt)
875 return 0;
876 mountpoint = mnt->mnt_mountpoint;
877 path->dentry = mountpoint;
878 path->mnt = &parent->mnt;
879 return 1;
880}
881
882
883
884
885
886
887
888
889
890
891
892int follow_up(struct path *path)
893{
894 struct mount *mnt = real_mount(path->mnt);
895 struct mount *parent;
896 struct dentry *mountpoint;
897
898 br_read_lock(&vfsmount_lock);
899 parent = mnt->mnt_parent;
900 if (parent == mnt) {
901 br_read_unlock(&vfsmount_lock);
902 return 0;
903 }
904 mntget(&parent->mnt);
905 mountpoint = dget(mnt->mnt_mountpoint);
906 br_read_unlock(&vfsmount_lock);
907 dput(path->dentry);
908 path->dentry = mountpoint;
909 mntput(path->mnt);
910 path->mnt = &parent->mnt;
911 return 1;
912}
913
914
915
916
917
918
919static int follow_automount(struct path *path, unsigned flags,
920 bool *need_mntput)
921{
922 struct vfsmount *mnt;
923 int err;
924
925 if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
926 return -EREMOTE;
927
928
929
930
931
932
933
934
935
936
937
938
939 if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
940 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
941 path->dentry->d_inode)
942 return -EISDIR;
943
944 current->total_link_count++;
945 if (current->total_link_count >= 40)
946 return -ELOOP;
947
948 mnt = path->dentry->d_op->d_automount(path);
949 if (IS_ERR(mnt)) {
950
951
952
953
954
955
956
957
958
959 if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT))
960 return -EREMOTE;
961 return PTR_ERR(mnt);
962 }
963
964 if (!mnt)
965 return 0;
966
967 if (!*need_mntput) {
968
969 mntget(path->mnt);
970 *need_mntput = true;
971 }
972 err = finish_automount(mnt, path);
973
974 switch (err) {
975 case -EBUSY:
976
977 return 0;
978 case 0:
979 path_put(path);
980 path->mnt = mnt;
981 path->dentry = dget(mnt->mnt_root);
982 return 0;
983 default:
984 return err;
985 }
986
987}
988
989
990
991
992
993
994
995
996
997
998
999static int follow_managed(struct path *path, unsigned flags)
1000{
1001 struct vfsmount *mnt = path->mnt;
1002 unsigned managed;
1003 bool need_mntput = false;
1004 int ret = 0;
1005
1006
1007
1008
1009 while (managed = ACCESS_ONCE(path->dentry->d_flags),
1010 managed &= DCACHE_MANAGED_DENTRY,
1011 unlikely(managed != 0)) {
1012
1013
1014 if (managed & DCACHE_MANAGE_TRANSIT) {
1015 BUG_ON(!path->dentry->d_op);
1016 BUG_ON(!path->dentry->d_op->d_manage);
1017 ret = path->dentry->d_op->d_manage(path->dentry, false);
1018 if (ret < 0)
1019 break;
1020 }
1021
1022
1023 if (managed & DCACHE_MOUNTED) {
1024 struct vfsmount *mounted = lookup_mnt(path);
1025 if (mounted) {
1026 dput(path->dentry);
1027 if (need_mntput)
1028 mntput(path->mnt);
1029 path->mnt = mounted;
1030 path->dentry = dget(mounted->mnt_root);
1031 need_mntput = true;
1032 continue;
1033 }
1034
1035
1036
1037
1038
1039 }
1040
1041
1042 if (managed & DCACHE_NEED_AUTOMOUNT) {
1043 ret = follow_automount(path, flags, &need_mntput);
1044 if (ret < 0)
1045 break;
1046 continue;
1047 }
1048
1049
1050 break;
1051 }
1052
1053 if (need_mntput && path->mnt == mnt)
1054 mntput(path->mnt);
1055 if (ret == -EISDIR)
1056 ret = 0;
1057 return ret < 0 ? ret : need_mntput;
1058}
1059
1060int follow_down_one(struct path *path)
1061{
1062 struct vfsmount *mounted;
1063
1064 mounted = lookup_mnt(path);
1065 if (mounted) {
1066 dput(path->dentry);
1067 mntput(path->mnt);
1068 path->mnt = mounted;
1069 path->dentry = dget(mounted->mnt_root);
1070 return 1;
1071 }
1072 return 0;
1073}
1074
1075static inline bool managed_dentry_might_block(struct dentry *dentry)
1076{
1077 return (dentry->d_flags & DCACHE_MANAGE_TRANSIT &&
1078 dentry->d_op->d_manage(dentry, true) < 0);
1079}
1080
1081
1082
1083
1084
1085static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1086 struct inode **inode)
1087{
1088 for (;;) {
1089 struct mount *mounted;
1090
1091
1092
1093
1094 if (unlikely(managed_dentry_might_block(path->dentry)))
1095 return false;
1096
1097 if (!d_mountpoint(path->dentry))
1098 break;
1099
1100 mounted = __lookup_mnt(path->mnt, path->dentry, 1);
1101 if (!mounted)
1102 break;
1103 path->mnt = &mounted->mnt;
1104 path->dentry = mounted->mnt.mnt_root;
1105 nd->flags |= LOOKUP_JUMPED;
1106 nd->seq = read_seqcount_begin(&path->dentry->d_seq);
1107
1108
1109
1110
1111
1112 *inode = path->dentry->d_inode;
1113 }
1114 return true;
1115}
1116
1117static void follow_mount_rcu(struct nameidata *nd)
1118{
1119 while (d_mountpoint(nd->path.dentry)) {
1120 struct mount *mounted;
1121 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry, 1);
1122 if (!mounted)
1123 break;
1124 nd->path.mnt = &mounted->mnt;
1125 nd->path.dentry = mounted->mnt.mnt_root;
1126 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
1127 }
1128}
1129
1130static int follow_dotdot_rcu(struct nameidata *nd)
1131{
1132 set_root_rcu(nd);
1133
1134 while (1) {
1135 if (nd->path.dentry == nd->root.dentry &&
1136 nd->path.mnt == nd->root.mnt) {
1137 break;
1138 }
1139 if (nd->path.dentry != nd->path.mnt->mnt_root) {
1140 struct dentry *old = nd->path.dentry;
1141 struct dentry *parent = old->d_parent;
1142 unsigned seq;
1143
1144 seq = read_seqcount_begin(&parent->d_seq);
1145 if (read_seqcount_retry(&old->d_seq, nd->seq))
1146 goto failed;
1147 nd->path.dentry = parent;
1148 nd->seq = seq;
1149 break;
1150 }
1151 if (!follow_up_rcu(&nd->path))
1152 break;
1153 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
1154 }
1155 follow_mount_rcu(nd);
1156 nd->inode = nd->path.dentry->d_inode;
1157 return 0;
1158
1159failed:
1160 nd->flags &= ~LOOKUP_RCU;
1161 if (!(nd->flags & LOOKUP_ROOT))
1162 nd->root.mnt = NULL;
1163 unlock_rcu_walk();
1164 return -ECHILD;
1165}
1166
1167
1168
1169
1170
1171
1172int follow_down(struct path *path)
1173{
1174 unsigned managed;
1175 int ret;
1176
1177 while (managed = ACCESS_ONCE(path->dentry->d_flags),
1178 unlikely(managed & DCACHE_MANAGED_DENTRY)) {
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189 if (managed & DCACHE_MANAGE_TRANSIT) {
1190 BUG_ON(!path->dentry->d_op);
1191 BUG_ON(!path->dentry->d_op->d_manage);
1192 ret = path->dentry->d_op->d_manage(
1193 path->dentry, false);
1194 if (ret < 0)
1195 return ret == -EISDIR ? 0 : ret;
1196 }
1197
1198
1199 if (managed & DCACHE_MOUNTED) {
1200 struct vfsmount *mounted = lookup_mnt(path);
1201 if (!mounted)
1202 break;
1203 dput(path->dentry);
1204 mntput(path->mnt);
1205 path->mnt = mounted;
1206 path->dentry = dget(mounted->mnt_root);
1207 continue;
1208 }
1209
1210
1211 break;
1212 }
1213 return 0;
1214}
1215
1216
1217
1218
1219static void follow_mount(struct path *path)
1220{
1221 while (d_mountpoint(path->dentry)) {
1222 struct vfsmount *mounted = lookup_mnt(path);
1223 if (!mounted)
1224 break;
1225 dput(path->dentry);
1226 mntput(path->mnt);
1227 path->mnt = mounted;
1228 path->dentry = dget(mounted->mnt_root);
1229 }
1230}
1231
1232static void follow_dotdot(struct nameidata *nd)
1233{
1234 set_root(nd);
1235
1236 while(1) {
1237 struct dentry *old = nd->path.dentry;
1238
1239 if (nd->path.dentry == nd->root.dentry &&
1240 nd->path.mnt == nd->root.mnt) {
1241 break;
1242 }
1243 if (nd->path.dentry != nd->path.mnt->mnt_root) {
1244
1245 nd->path.dentry = dget_parent(nd->path.dentry);
1246 dput(old);
1247 break;
1248 }
1249 if (!follow_up(&nd->path))
1250 break;
1251 }
1252 follow_mount(&nd->path);
1253 nd->inode = nd->path.dentry->d_inode;
1254}
1255
1256
1257
1258
1259
1260
1261
1262
1263static struct dentry *lookup_dcache(struct qstr *name, struct dentry *dir,
1264 unsigned int flags, bool *need_lookup)
1265{
1266 struct dentry *dentry;
1267 int error;
1268
1269 *need_lookup = false;
1270 dentry = d_lookup(dir, name);
1271 if (dentry) {
1272 if (dentry->d_flags & DCACHE_OP_REVALIDATE) {
1273 error = d_revalidate(dentry, flags);
1274 if (unlikely(error <= 0)) {
1275 if (error < 0) {
1276 dput(dentry);
1277 return ERR_PTR(error);
1278 } else if (!d_invalidate(dentry)) {
1279 dput(dentry);
1280 dentry = NULL;
1281 }
1282 }
1283 }
1284 }
1285
1286 if (!dentry) {
1287 dentry = d_alloc(dir, name);
1288 if (unlikely(!dentry))
1289 return ERR_PTR(-ENOMEM);
1290
1291 *need_lookup = true;
1292 }
1293 return dentry;
1294}
1295
1296
1297
1298
1299
1300
1301
1302static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry,
1303 unsigned int flags)
1304{
1305 struct dentry *old;
1306
1307
1308 if (unlikely(IS_DEADDIR(dir))) {
1309 dput(dentry);
1310 return ERR_PTR(-ENOENT);
1311 }
1312
1313 old = dir->i_op->lookup(dir, dentry, flags);
1314 if (unlikely(old)) {
1315 dput(dentry);
1316 dentry = old;
1317 }
1318 return dentry;
1319}
1320
1321static struct dentry *__lookup_hash(struct qstr *name,
1322 struct dentry *base, unsigned int flags)
1323{
1324 bool need_lookup;
1325 struct dentry *dentry;
1326
1327 dentry = lookup_dcache(name, base, flags, &need_lookup);
1328 if (!need_lookup)
1329 return dentry;
1330
1331 return lookup_real(base->d_inode, dentry, flags);
1332}
1333
1334
1335
1336
1337
1338
1339static int lookup_fast(struct nameidata *nd,
1340 struct path *path, struct inode **inode)
1341{
1342 struct vfsmount *mnt = nd->path.mnt;
1343 struct dentry *dentry, *parent = nd->path.dentry;
1344 int need_reval = 1;
1345 int status = 1;
1346 int err;
1347
1348
1349
1350
1351
1352
1353 if (nd->flags & LOOKUP_RCU) {
1354 unsigned seq;
1355 dentry = __d_lookup_rcu(parent, &nd->last, &seq, nd->inode);
1356 if (!dentry)
1357 goto unlazy;
1358
1359
1360
1361
1362
1363 *inode = dentry->d_inode;
1364 if (read_seqcount_retry(&dentry->d_seq, seq))
1365 return -ECHILD;
1366
1367
1368
1369
1370
1371
1372
1373
1374 if (__read_seqcount_retry(&parent->d_seq, nd->seq))
1375 return -ECHILD;
1376 nd->seq = seq;
1377
1378 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) {
1379 status = d_revalidate(dentry, nd->flags);
1380 if (unlikely(status <= 0)) {
1381 if (status != -ECHILD)
1382 need_reval = 0;
1383 goto unlazy;
1384 }
1385 }
1386 path->mnt = mnt;
1387 path->dentry = dentry;
1388 if (unlikely(!__follow_mount_rcu(nd, path, inode)))
1389 goto unlazy;
1390 if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT))
1391 goto unlazy;
1392 return 0;
1393unlazy:
1394 if (unlazy_walk(nd, dentry))
1395 return -ECHILD;
1396 } else {
1397 dentry = __d_lookup(parent, &nd->last);
1398 }
1399
1400 if (unlikely(!dentry))
1401 goto need_lookup;
1402
1403 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval)
1404 status = d_revalidate(dentry, nd->flags);
1405 if (unlikely(status <= 0)) {
1406 if (status < 0) {
1407 dput(dentry);
1408 return status;
1409 }
1410 if (!d_invalidate(dentry)) {
1411 dput(dentry);
1412 goto need_lookup;
1413 }
1414 }
1415
1416 path->mnt = mnt;
1417 path->dentry = dentry;
1418 err = follow_managed(path, nd->flags);
1419 if (unlikely(err < 0)) {
1420 path_put_conditional(path, nd);
1421 return err;
1422 }
1423 if (err)
1424 nd->flags |= LOOKUP_JUMPED;
1425 *inode = path->dentry->d_inode;
1426 return 0;
1427
1428need_lookup:
1429 return 1;
1430}
1431
1432
1433static int lookup_slow(struct nameidata *nd, struct path *path)
1434{
1435 struct dentry *dentry, *parent;
1436 int err;
1437
1438 parent = nd->path.dentry;
1439 BUG_ON(nd->inode != parent->d_inode);
1440
1441 mutex_lock(&parent->d_inode->i_mutex);
1442 dentry = __lookup_hash(&nd->last, parent, nd->flags);
1443 mutex_unlock(&parent->d_inode->i_mutex);
1444 if (IS_ERR(dentry))
1445 return PTR_ERR(dentry);
1446 path->mnt = nd->path.mnt;
1447 path->dentry = dentry;
1448 err = follow_managed(path, nd->flags);
1449 if (unlikely(err < 0)) {
1450 path_put_conditional(path, nd);
1451 return err;
1452 }
1453 if (err)
1454 nd->flags |= LOOKUP_JUMPED;
1455 return 0;
1456}
1457
1458static inline int may_lookup(struct nameidata *nd)
1459{
1460 if (nd->flags & LOOKUP_RCU) {
1461 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1462 if (err != -ECHILD)
1463 return err;
1464 if (unlazy_walk(nd, NULL))
1465 return -ECHILD;
1466 }
1467 return inode_permission(nd->inode, MAY_EXEC);
1468}
1469
1470static inline int handle_dots(struct nameidata *nd, int type)
1471{
1472 if (type == LAST_DOTDOT) {
1473 if (nd->flags & LOOKUP_RCU) {
1474 if (follow_dotdot_rcu(nd))
1475 return -ECHILD;
1476 } else
1477 follow_dotdot(nd);
1478 }
1479 return 0;
1480}
1481
1482static void terminate_walk(struct nameidata *nd)
1483{
1484 if (!(nd->flags & LOOKUP_RCU)) {
1485 path_put(&nd->path);
1486 } else {
1487 nd->flags &= ~LOOKUP_RCU;
1488 if (!(nd->flags & LOOKUP_ROOT))
1489 nd->root.mnt = NULL;
1490 unlock_rcu_walk();
1491 }
1492}
1493
1494
1495
1496
1497
1498
1499
1500static inline int should_follow_link(struct inode *inode, int follow)
1501{
1502 if (unlikely(!(inode->i_opflags & IOP_NOFOLLOW))) {
1503 if (likely(inode->i_op->follow_link))
1504 return follow;
1505
1506
1507 spin_lock(&inode->i_lock);
1508 inode->i_opflags |= IOP_NOFOLLOW;
1509 spin_unlock(&inode->i_lock);
1510 }
1511 return 0;
1512}
1513
1514static inline int walk_component(struct nameidata *nd, struct path *path,
1515 int follow)
1516{
1517 struct inode *inode;
1518 int err;
1519
1520
1521
1522
1523
1524 if (unlikely(nd->last_type != LAST_NORM))
1525 return handle_dots(nd, nd->last_type);
1526 err = lookup_fast(nd, path, &inode);
1527 if (unlikely(err)) {
1528 if (err < 0)
1529 goto out_err;
1530
1531 err = lookup_slow(nd, path);
1532 if (err < 0)
1533 goto out_err;
1534
1535 inode = path->dentry->d_inode;
1536 }
1537 err = -ENOENT;
1538 if (!inode)
1539 goto out_path_put;
1540
1541 if (should_follow_link(inode, follow)) {
1542 if (nd->flags & LOOKUP_RCU) {
1543 if (unlikely(unlazy_walk(nd, path->dentry))) {
1544 err = -ECHILD;
1545 goto out_err;
1546 }
1547 }
1548 BUG_ON(inode != path->dentry->d_inode);
1549 return 1;
1550 }
1551 path_to_nameidata(path, nd);
1552 nd->inode = inode;
1553 return 0;
1554
1555out_path_put:
1556 path_to_nameidata(path, nd);
1557out_err:
1558 terminate_walk(nd);
1559 return err;
1560}
1561
1562
1563
1564
1565
1566
1567
1568
1569static inline int nested_symlink(struct path *path, struct nameidata *nd)
1570{
1571 int res;
1572
1573 if (unlikely(current->link_count >= MAX_NESTED_LINKS)) {
1574 path_put_conditional(path, nd);
1575 path_put(&nd->path);
1576 return -ELOOP;
1577 }
1578 BUG_ON(nd->depth >= MAX_NESTED_LINKS);
1579
1580 nd->depth++;
1581 current->link_count++;
1582
1583 do {
1584 struct path link = *path;
1585 void *cookie;
1586
1587 res = follow_link(&link, nd, &cookie);
1588 if (res)
1589 break;
1590 res = walk_component(nd, path, LOOKUP_FOLLOW);
1591 put_link(nd, &link, cookie);
1592 } while (res > 0);
1593
1594 current->link_count--;
1595 nd->depth--;
1596 return res;
1597}
1598
1599
1600
1601
1602
1603
1604
1605static inline int can_lookup(struct inode *inode)
1606{
1607 if (likely(inode->i_opflags & IOP_LOOKUP))
1608 return 1;
1609 if (likely(!inode->i_op->lookup))
1610 return 0;
1611
1612
1613 spin_lock(&inode->i_lock);
1614 inode->i_opflags |= IOP_LOOKUP;
1615 spin_unlock(&inode->i_lock);
1616 return 1;
1617}
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641#ifdef CONFIG_DCACHE_WORD_ACCESS
1642
1643#include <asm/word-at-a-time.h>
1644
1645#ifdef CONFIG_64BIT
1646
1647static inline unsigned int fold_hash(unsigned long hash)
1648{
1649 hash += hash >> (8*sizeof(int));
1650 return hash;
1651}
1652
1653#else
1654
1655#define fold_hash(x) (x)
1656
1657#endif
1658
1659unsigned int full_name_hash(const unsigned char *name, unsigned int len)
1660{
1661 unsigned long a, mask;
1662 unsigned long hash = 0;
1663
1664 for (;;) {
1665 a = load_unaligned_zeropad(name);
1666 if (len < sizeof(unsigned long))
1667 break;
1668 hash += a;
1669 hash *= 9;
1670 name += sizeof(unsigned long);
1671 len -= sizeof(unsigned long);
1672 if (!len)
1673 goto done;
1674 }
1675 mask = ~(~0ul << len*8);
1676 hash += mask & a;
1677done:
1678 return fold_hash(hash);
1679}
1680EXPORT_SYMBOL(full_name_hash);
1681
1682
1683
1684
1685
1686static inline unsigned long hash_name(const char *name, unsigned int *hashp)
1687{
1688 unsigned long a, b, adata, bdata, mask, hash, len;
1689 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1690
1691 hash = a = 0;
1692 len = -sizeof(unsigned long);
1693 do {
1694 hash = (hash + a) * 9;
1695 len += sizeof(unsigned long);
1696 a = load_unaligned_zeropad(name+len);
1697 b = a ^ REPEAT_BYTE('/');
1698 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
1699
1700 adata = prep_zero_mask(a, adata, &constants);
1701 bdata = prep_zero_mask(b, bdata, &constants);
1702
1703 mask = create_zero_mask(adata | bdata);
1704
1705 hash += a & zero_bytemask(mask);
1706 *hashp = fold_hash(hash);
1707
1708 return len + find_zero(mask);
1709}
1710
1711#else
1712
1713unsigned int full_name_hash(const unsigned char *name, unsigned int len)
1714{
1715 unsigned long hash = init_name_hash();
1716 while (len--)
1717 hash = partial_name_hash(*name++, hash);
1718 return end_name_hash(hash);
1719}
1720EXPORT_SYMBOL(full_name_hash);
1721
1722
1723
1724
1725
1726static inline unsigned long hash_name(const char *name, unsigned int *hashp)
1727{
1728 unsigned long hash = init_name_hash();
1729 unsigned long len = 0, c;
1730
1731 c = (unsigned char)*name;
1732 do {
1733 len++;
1734 hash = partial_name_hash(c, hash);
1735 c = (unsigned char)name[len];
1736 } while (c && c != '/');
1737 *hashp = end_name_hash(hash);
1738 return len;
1739}
1740
1741#endif
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751static int link_path_walk(const char *name, struct nameidata *nd)
1752{
1753 struct path next;
1754 int err;
1755
1756 while (*name=='/')
1757 name++;
1758 if (!*name)
1759 return 0;
1760
1761
1762 for(;;) {
1763 struct qstr this;
1764 long len;
1765 int type;
1766
1767 err = may_lookup(nd);
1768 if (err)
1769 break;
1770
1771 len = hash_name(name, &this.hash);
1772 this.name = name;
1773 this.len = len;
1774
1775 type = LAST_NORM;
1776 if (name[0] == '.') switch (len) {
1777 case 2:
1778 if (name[1] == '.') {
1779 type = LAST_DOTDOT;
1780 nd->flags |= LOOKUP_JUMPED;
1781 }
1782 break;
1783 case 1:
1784 type = LAST_DOT;
1785 }
1786 if (likely(type == LAST_NORM)) {
1787 struct dentry *parent = nd->path.dentry;
1788 nd->flags &= ~LOOKUP_JUMPED;
1789 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
1790 err = parent->d_op->d_hash(parent, nd->inode,
1791 &this);
1792 if (err < 0)
1793 break;
1794 }
1795 }
1796
1797 nd->last = this;
1798 nd->last_type = type;
1799
1800 if (!name[len])
1801 return 0;
1802
1803
1804
1805
1806 do {
1807 len++;
1808 } while (unlikely(name[len] == '/'));
1809 if (!name[len])
1810 return 0;
1811
1812 name += len;
1813
1814 err = walk_component(nd, &next, LOOKUP_FOLLOW);
1815 if (err < 0)
1816 return err;
1817
1818 if (err) {
1819 err = nested_symlink(&next, nd);
1820 if (err)
1821 return err;
1822 }
1823 if (!can_lookup(nd->inode)) {
1824 err = -ENOTDIR;
1825 break;
1826 }
1827 }
1828 terminate_walk(nd);
1829 return err;
1830}
1831
1832static int path_init(int dfd, const char *name, unsigned int flags,
1833 struct nameidata *nd, struct file **fp)
1834{
1835 int retval = 0;
1836
1837 nd->last_type = LAST_ROOT;
1838 nd->flags = flags | LOOKUP_JUMPED;
1839 nd->depth = 0;
1840 if (flags & LOOKUP_ROOT) {
1841 struct inode *inode = nd->root.dentry->d_inode;
1842 if (*name) {
1843 if (!can_lookup(inode))
1844 return -ENOTDIR;
1845 retval = inode_permission(inode, MAY_EXEC);
1846 if (retval)
1847 return retval;
1848 }
1849 nd->path = nd->root;
1850 nd->inode = inode;
1851 if (flags & LOOKUP_RCU) {
1852 lock_rcu_walk();
1853 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
1854 } else {
1855 path_get(&nd->path);
1856 }
1857 return 0;
1858 }
1859
1860 nd->root.mnt = NULL;
1861
1862 if (*name=='/') {
1863 if (flags & LOOKUP_RCU) {
1864 lock_rcu_walk();
1865 set_root_rcu(nd);
1866 } else {
1867 set_root(nd);
1868 path_get(&nd->root);
1869 }
1870 nd->path = nd->root;
1871 } else if (dfd == AT_FDCWD) {
1872 if (flags & LOOKUP_RCU) {
1873 struct fs_struct *fs = current->fs;
1874 unsigned seq;
1875
1876 lock_rcu_walk();
1877
1878 do {
1879 seq = read_seqcount_begin(&fs->seq);
1880 nd->path = fs->pwd;
1881 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
1882 } while (read_seqcount_retry(&fs->seq, seq));
1883 } else {
1884 get_fs_pwd(current->fs, &nd->path);
1885 }
1886 } else {
1887
1888 struct fd f = fdget_raw(dfd);
1889 struct dentry *dentry;
1890
1891 if (!f.file)
1892 return -EBADF;
1893
1894 dentry = f.file->f_path.dentry;
1895
1896 if (*name) {
1897 if (!can_lookup(dentry->d_inode)) {
1898 fdput(f);
1899 return -ENOTDIR;
1900 }
1901 }
1902
1903 nd->path = f.file->f_path;
1904 if (flags & LOOKUP_RCU) {
1905 if (f.need_put)
1906 *fp = f.file;
1907 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
1908 lock_rcu_walk();
1909 } else {
1910 path_get(&nd->path);
1911 fdput(f);
1912 }
1913 }
1914
1915 nd->inode = nd->path.dentry->d_inode;
1916 return 0;
1917}
1918
1919static inline int lookup_last(struct nameidata *nd, struct path *path)
1920{
1921 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
1922 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
1923
1924 nd->flags &= ~LOOKUP_PARENT;
1925 return walk_component(nd, path, nd->flags & LOOKUP_FOLLOW);
1926}
1927
1928
1929static int path_lookupat(int dfd, const char *name,
1930 unsigned int flags, struct nameidata *nd)
1931{
1932 struct file *base = NULL;
1933 struct path path;
1934 int err;
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950 err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base);
1951
1952 if (unlikely(err))
1953 return err;
1954
1955 current->total_link_count = 0;
1956 err = link_path_walk(name, nd);
1957
1958 if (!err && !(flags & LOOKUP_PARENT)) {
1959 err = lookup_last(nd, &path);
1960 while (err > 0) {
1961 void *cookie;
1962 struct path link = path;
1963 err = may_follow_link(&link, nd);
1964 if (unlikely(err))
1965 break;
1966 nd->flags |= LOOKUP_PARENT;
1967 err = follow_link(&link, nd, &cookie);
1968 if (err)
1969 break;
1970 err = lookup_last(nd, &path);
1971 put_link(nd, &link, cookie);
1972 }
1973 }
1974
1975 if (!err)
1976 err = complete_walk(nd);
1977
1978 if (!err && nd->flags & LOOKUP_DIRECTORY) {
1979 if (!can_lookup(nd->inode)) {
1980 path_put(&nd->path);
1981 err = -ENOTDIR;
1982 }
1983 }
1984
1985 if (base)
1986 fput(base);
1987
1988 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
1989 path_put(&nd->root);
1990 nd->root.mnt = NULL;
1991 }
1992 return err;
1993}
1994
1995static int filename_lookup(int dfd, struct filename *name,
1996 unsigned int flags, struct nameidata *nd)
1997{
1998 int retval = path_lookupat(dfd, name->name, flags | LOOKUP_RCU, nd);
1999 if (unlikely(retval == -ECHILD))
2000 retval = path_lookupat(dfd, name->name, flags, nd);
2001 if (unlikely(retval == -ESTALE))
2002 retval = path_lookupat(dfd, name->name,
2003 flags | LOOKUP_REVAL, nd);
2004
2005 if (likely(!retval))
2006 audit_inode(name, nd->path.dentry, flags & LOOKUP_PARENT);
2007 return retval;
2008}
2009
2010static int do_path_lookup(int dfd, const char *name,
2011 unsigned int flags, struct nameidata *nd)
2012{
2013 struct filename filename = { .name = name };
2014
2015 return filename_lookup(dfd, &filename, flags, nd);
2016}
2017
2018
2019struct dentry *kern_path_locked(const char *name, struct path *path)
2020{
2021 struct nameidata nd;
2022 struct dentry *d;
2023 int err = do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, &nd);
2024 if (err)
2025 return ERR_PTR(err);
2026 if (nd.last_type != LAST_NORM) {
2027 path_put(&nd.path);
2028 return ERR_PTR(-EINVAL);
2029 }
2030 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2031 d = __lookup_hash(&nd.last, nd.path.dentry, 0);
2032 if (IS_ERR(d)) {
2033 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
2034 path_put(&nd.path);
2035 return d;
2036 }
2037 *path = nd.path;
2038 return d;
2039}
2040
2041int kern_path(const char *name, unsigned int flags, struct path *path)
2042{
2043 struct nameidata nd;
2044 int res = do_path_lookup(AT_FDCWD, name, flags, &nd);
2045 if (!res)
2046 *path = nd.path;
2047 return res;
2048}
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
2059 const char *name, unsigned int flags,
2060 struct path *path)
2061{
2062 struct nameidata nd;
2063 int err;
2064 nd.root.dentry = dentry;
2065 nd.root.mnt = mnt;
2066 BUG_ON(flags & LOOKUP_PARENT);
2067
2068 err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd);
2069 if (!err)
2070 *path = nd.path;
2071 return err;
2072}
2073
2074
2075
2076
2077
2078
2079static struct dentry *lookup_hash(struct nameidata *nd)
2080{
2081 return __lookup_hash(&nd->last, nd->path.dentry, nd->flags);
2082}
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
2096{
2097 struct qstr this;
2098 unsigned int c;
2099 int err;
2100
2101 WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));
2102
2103 this.name = name;
2104 this.len = len;
2105 this.hash = full_name_hash(name, len);
2106 if (!len)
2107 return ERR_PTR(-EACCES);
2108
2109 if (unlikely(name[0] == '.')) {
2110 if (len < 2 || (len == 2 && name[1] == '.'))
2111 return ERR_PTR(-EACCES);
2112 }
2113
2114 while (len--) {
2115 c = *(const unsigned char *)name++;
2116 if (c == '/' || c == '\0')
2117 return ERR_PTR(-EACCES);
2118 }
2119
2120
2121
2122
2123 if (base->d_flags & DCACHE_OP_HASH) {
2124 int err = base->d_op->d_hash(base, base->d_inode, &this);
2125 if (err < 0)
2126 return ERR_PTR(err);
2127 }
2128
2129 err = inode_permission(base->d_inode, MAY_EXEC);
2130 if (err)
2131 return ERR_PTR(err);
2132
2133 return __lookup_hash(&this, base, 0);
2134}
2135
2136int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
2137 struct path *path, int *empty)
2138{
2139 struct nameidata nd;
2140 struct filename *tmp = getname_flags(name, flags, empty);
2141 int err = PTR_ERR(tmp);
2142 if (!IS_ERR(tmp)) {
2143
2144 BUG_ON(flags & LOOKUP_PARENT);
2145
2146 err = filename_lookup(dfd, tmp, flags, &nd);
2147 putname(tmp);
2148 if (!err)
2149 *path = nd.path;
2150 }
2151 return err;
2152}
2153
2154int user_path_at(int dfd, const char __user *name, unsigned flags,
2155 struct path *path)
2156{
2157 return user_path_at_empty(dfd, name, flags, path, NULL);
2158}
2159
2160
2161
2162
2163
2164
2165
2166static struct filename *
2167user_path_parent(int dfd, const char __user *path, struct nameidata *nd,
2168 unsigned int flags)
2169{
2170 struct filename *s = getname(path);
2171 int error;
2172
2173
2174 flags &= LOOKUP_REVAL;
2175
2176 if (IS_ERR(s))
2177 return s;
2178
2179 error = filename_lookup(dfd, s, flags | LOOKUP_PARENT, nd);
2180 if (error) {
2181 putname(s);
2182 return ERR_PTR(error);
2183 }
2184
2185 return s;
2186}
2187
2188
2189
2190
2191
2192static inline int check_sticky(struct inode *dir, struct inode *inode)
2193{
2194 kuid_t fsuid = current_fsuid();
2195
2196 if (!(dir->i_mode & S_ISVTX))
2197 return 0;
2198 if (uid_eq(inode->i_uid, fsuid))
2199 return 0;
2200 if (uid_eq(dir->i_uid, fsuid))
2201 return 0;
2202 return !inode_capable(inode, CAP_FOWNER);
2203}
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
2225{
2226 int error;
2227
2228 if (!victim->d_inode)
2229 return -ENOENT;
2230
2231 BUG_ON(victim->d_parent->d_inode != dir);
2232 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2233
2234 error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
2235 if (error)
2236 return error;
2237 if (IS_APPEND(dir))
2238 return -EPERM;
2239 if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
2240 IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
2241 return -EPERM;
2242 if (isdir) {
2243 if (!S_ISDIR(victim->d_inode->i_mode))
2244 return -ENOTDIR;
2245 if (IS_ROOT(victim))
2246 return -EBUSY;
2247 } else if (S_ISDIR(victim->d_inode->i_mode))
2248 return -EISDIR;
2249 if (IS_DEADDIR(dir))
2250 return -ENOENT;
2251 if (victim->d_flags & DCACHE_NFSFS_RENAMED)
2252 return -EBUSY;
2253 return 0;
2254}
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264static inline int may_create(struct inode *dir, struct dentry *child)
2265{
2266 if (child->d_inode)
2267 return -EEXIST;
2268 if (IS_DEADDIR(dir))
2269 return -ENOENT;
2270 return inode_permission(dir, MAY_WRITE | MAY_EXEC);
2271}
2272
2273
2274
2275
2276struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
2277{
2278 struct dentry *p;
2279
2280 if (p1 == p2) {
2281 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
2282 return NULL;
2283 }
2284
2285 mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
2286
2287 p = d_ancestor(p2, p1);
2288 if (p) {
2289 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT);
2290 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD);
2291 return p;
2292 }
2293
2294 p = d_ancestor(p1, p2);
2295 if (p) {
2296 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
2297 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
2298 return p;
2299 }
2300
2301 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
2302 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
2303 return NULL;
2304}
2305
2306void unlock_rename(struct dentry *p1, struct dentry *p2)
2307{
2308 mutex_unlock(&p1->d_inode->i_mutex);
2309 if (p1 != p2) {
2310 mutex_unlock(&p2->d_inode->i_mutex);
2311 mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
2312 }
2313}
2314
2315int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
2316 bool want_excl)
2317{
2318 int error = may_create(dir, dentry);
2319 if (error)
2320 return error;
2321
2322 if (!dir->i_op->create)
2323 return -EACCES;
2324 mode &= S_IALLUGO;
2325 mode |= S_IFREG;
2326 error = security_inode_create(dir, dentry, mode);
2327 if (error)
2328 return error;
2329 error = dir->i_op->create(dir, dentry, mode, want_excl);
2330 if (!error)
2331 fsnotify_create(dir, dentry);
2332 return error;
2333}
2334
2335static int may_open(struct path *path, int acc_mode, int flag)
2336{
2337 struct dentry *dentry = path->dentry;
2338 struct inode *inode = dentry->d_inode;
2339 int error;
2340
2341
2342 if (!acc_mode)
2343 return 0;
2344
2345 if (!inode)
2346 return -ENOENT;
2347
2348 switch (inode->i_mode & S_IFMT) {
2349 case S_IFLNK:
2350 return -ELOOP;
2351 case S_IFDIR:
2352 if (acc_mode & MAY_WRITE)
2353 return -EISDIR;
2354 break;
2355 case S_IFBLK:
2356 case S_IFCHR:
2357 if (path->mnt->mnt_flags & MNT_NODEV)
2358 return -EACCES;
2359
2360 case S_IFIFO:
2361 case S_IFSOCK:
2362 flag &= ~O_TRUNC;
2363 break;
2364 }
2365
2366 error = inode_permission(inode, acc_mode);
2367 if (error)
2368 return error;
2369
2370
2371
2372
2373 if (IS_APPEND(inode)) {
2374 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
2375 return -EPERM;
2376 if (flag & O_TRUNC)
2377 return -EPERM;
2378 }
2379
2380
2381 if (flag & O_NOATIME && !inode_owner_or_capable(inode))
2382 return -EPERM;
2383
2384 return 0;
2385}
2386
2387static int handle_truncate(struct file *filp)
2388{
2389 struct path *path = &filp->f_path;
2390 struct inode *inode = path->dentry->d_inode;
2391 int error = get_write_access(inode);
2392 if (error)
2393 return error;
2394
2395
2396
2397 error = locks_verify_locked(inode);
2398 if (!error)
2399 error = security_path_truncate(path);
2400 if (!error) {
2401 error = do_truncate(path->dentry, 0,
2402 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
2403 filp);
2404 }
2405 put_write_access(inode);
2406 return error;
2407}
2408
2409static inline int open_to_namei_flags(int flag)
2410{
2411 if ((flag & O_ACCMODE) == 3)
2412 flag--;
2413 return flag;
2414}
2415
2416static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode)
2417{
2418 int error = security_path_mknod(dir, dentry, mode, 0);
2419 if (error)
2420 return error;
2421
2422 error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
2423 if (error)
2424 return error;
2425
2426 return security_inode_create(dir->dentry->d_inode, dentry, mode);
2427}
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442static int atomic_open(struct nameidata *nd, struct dentry *dentry,
2443 struct path *path, struct file *file,
2444 const struct open_flags *op,
2445 bool got_write, bool need_lookup,
2446 int *opened)
2447{
2448 struct inode *dir = nd->path.dentry->d_inode;
2449 unsigned open_flag = open_to_namei_flags(op->open_flag);
2450 umode_t mode;
2451 int error;
2452 int acc_mode;
2453 int create_error = 0;
2454 struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
2455
2456 BUG_ON(dentry->d_inode);
2457
2458
2459 if (unlikely(IS_DEADDIR(dir))) {
2460 error = -ENOENT;
2461 goto out;
2462 }
2463
2464 mode = op->mode;
2465 if ((open_flag & O_CREAT) && !IS_POSIXACL(dir))
2466 mode &= ~current_umask();
2467
2468 if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT)) {
2469 open_flag &= ~O_TRUNC;
2470 *opened |= FILE_CREATED;
2471 }
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482 if (((open_flag & (O_CREAT | O_TRUNC)) ||
2483 (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) {
2484 if (!(open_flag & O_CREAT)) {
2485
2486
2487
2488
2489 goto no_open;
2490 } else if (open_flag & (O_EXCL | O_TRUNC)) {
2491
2492 create_error = -EROFS;
2493 goto no_open;
2494 } else {
2495
2496 create_error = -EROFS;
2497 open_flag &= ~O_CREAT;
2498 }
2499 }
2500
2501 if (open_flag & O_CREAT) {
2502 error = may_o_create(&nd->path, dentry, mode);
2503 if (error) {
2504 create_error = error;
2505 if (open_flag & O_EXCL)
2506 goto no_open;
2507 open_flag &= ~O_CREAT;
2508 }
2509 }
2510
2511 if (nd->flags & LOOKUP_DIRECTORY)
2512 open_flag |= O_DIRECTORY;
2513
2514 file->f_path.dentry = DENTRY_NOT_SET;
2515 file->f_path.mnt = nd->path.mnt;
2516 error = dir->i_op->atomic_open(dir, dentry, file, open_flag, mode,
2517 opened);
2518 if (error < 0) {
2519 if (create_error && error == -ENOENT)
2520 error = create_error;
2521 goto out;
2522 }
2523
2524 acc_mode = op->acc_mode;
2525 if (*opened & FILE_CREATED) {
2526 fsnotify_create(dir, dentry);
2527 acc_mode = MAY_OPEN;
2528 }
2529
2530 if (error) {
2531 if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
2532 error = -EIO;
2533 goto out;
2534 }
2535 if (file->f_path.dentry) {
2536 dput(dentry);
2537 dentry = file->f_path.dentry;
2538 }
2539 if (create_error && dentry->d_inode == NULL) {
2540 error = create_error;
2541 goto out;
2542 }
2543 goto looked_up;
2544 }
2545
2546
2547
2548
2549
2550 error = may_open(&file->f_path, acc_mode, open_flag);
2551 if (error)
2552 fput(file);
2553
2554out:
2555 dput(dentry);
2556 return error;
2557
2558no_open:
2559 if (need_lookup) {
2560 dentry = lookup_real(dir, dentry, nd->flags);
2561 if (IS_ERR(dentry))
2562 return PTR_ERR(dentry);
2563
2564 if (create_error) {
2565 int open_flag = op->open_flag;
2566
2567 error = create_error;
2568 if ((open_flag & O_EXCL)) {
2569 if (!dentry->d_inode)
2570 goto out;
2571 } else if (!dentry->d_inode) {
2572 goto out;
2573 } else if ((open_flag & O_TRUNC) &&
2574 S_ISREG(dentry->d_inode->i_mode)) {
2575 goto out;
2576 }
2577
2578 }
2579 }
2580looked_up:
2581 path->dentry = dentry;
2582 path->mnt = nd->path.mnt;
2583 return 1;
2584}
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604static int lookup_open(struct nameidata *nd, struct path *path,
2605 struct file *file,
2606 const struct open_flags *op,
2607 bool got_write, int *opened)
2608{
2609 struct dentry *dir = nd->path.dentry;
2610 struct inode *dir_inode = dir->d_inode;
2611 struct dentry *dentry;
2612 int error;
2613 bool need_lookup;
2614
2615 *opened &= ~FILE_CREATED;
2616 dentry = lookup_dcache(&nd->last, dir, nd->flags, &need_lookup);
2617 if (IS_ERR(dentry))
2618 return PTR_ERR(dentry);
2619
2620
2621 if (!need_lookup && dentry->d_inode)
2622 goto out_no_open;
2623
2624 if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) {
2625 return atomic_open(nd, dentry, path, file, op, got_write,
2626 need_lookup, opened);
2627 }
2628
2629 if (need_lookup) {
2630 BUG_ON(dentry->d_inode);
2631
2632 dentry = lookup_real(dir_inode, dentry, nd->flags);
2633 if (IS_ERR(dentry))
2634 return PTR_ERR(dentry);
2635 }
2636
2637
2638 if (!dentry->d_inode && (op->open_flag & O_CREAT)) {
2639 umode_t mode = op->mode;
2640 if (!IS_POSIXACL(dir->d_inode))
2641 mode &= ~current_umask();
2642
2643
2644
2645
2646
2647
2648
2649 if (!got_write) {
2650 error = -EROFS;
2651 goto out_dput;
2652 }
2653 *opened |= FILE_CREATED;
2654 error = security_path_mknod(&nd->path, dentry, mode, 0);
2655 if (error)
2656 goto out_dput;
2657 error = vfs_create(dir->d_inode, dentry, mode,
2658 nd->flags & LOOKUP_EXCL);
2659 if (error)
2660 goto out_dput;
2661 }
2662out_no_open:
2663 path->dentry = dentry;
2664 path->mnt = nd->path.mnt;
2665 return 1;
2666
2667out_dput:
2668 dput(dentry);
2669 return error;
2670}
2671
2672
2673
2674
2675static int do_last(struct nameidata *nd, struct path *path,
2676 struct file *file, const struct open_flags *op,
2677 int *opened, struct filename *name)
2678{
2679 struct dentry *dir = nd->path.dentry;
2680 int open_flag = op->open_flag;
2681 bool will_truncate = (open_flag & O_TRUNC) != 0;
2682 bool got_write = false;
2683 int acc_mode = op->acc_mode;
2684 struct inode *inode;
2685 bool symlink_ok = false;
2686 struct path save_parent = { .dentry = NULL, .mnt = NULL };
2687 bool retried = false;
2688 int error;
2689
2690 nd->flags &= ~LOOKUP_PARENT;
2691 nd->flags |= op->intent;
2692
2693 switch (nd->last_type) {
2694 case LAST_DOTDOT:
2695 case LAST_DOT:
2696 error = handle_dots(nd, nd->last_type);
2697 if (error)
2698 return error;
2699
2700 case LAST_ROOT:
2701 error = complete_walk(nd);
2702 if (error)
2703 return error;
2704 audit_inode(name, nd->path.dentry, 0);
2705 if (open_flag & O_CREAT) {
2706 error = -EISDIR;
2707 goto out;
2708 }
2709 goto finish_open;
2710 case LAST_BIND:
2711 error = complete_walk(nd);
2712 if (error)
2713 return error;
2714 audit_inode(name, dir, 0);
2715 goto finish_open;
2716 }
2717
2718 if (!(open_flag & O_CREAT)) {
2719 if (nd->last.name[nd->last.len])
2720 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2721 if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW))
2722 symlink_ok = true;
2723
2724 error = lookup_fast(nd, path, &inode);
2725 if (likely(!error))
2726 goto finish_lookup;
2727
2728 if (error < 0)
2729 goto out;
2730
2731 BUG_ON(nd->inode != dir->d_inode);
2732 } else {
2733
2734
2735
2736
2737
2738
2739 error = complete_walk(nd);
2740 if (error)
2741 return error;
2742
2743 audit_inode(name, dir, LOOKUP_PARENT);
2744 error = -EISDIR;
2745
2746 if (nd->last.name[nd->last.len])
2747 goto out;
2748 }
2749
2750retry_lookup:
2751 if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
2752 error = mnt_want_write(nd->path.mnt);
2753 if (!error)
2754 got_write = true;
2755
2756
2757
2758
2759
2760 }
2761 mutex_lock(&dir->d_inode->i_mutex);
2762 error = lookup_open(nd, path, file, op, got_write, opened);
2763 mutex_unlock(&dir->d_inode->i_mutex);
2764
2765 if (error <= 0) {
2766 if (error)
2767 goto out;
2768
2769 if ((*opened & FILE_CREATED) ||
2770 !S_ISREG(file_inode(file)->i_mode))
2771 will_truncate = false;
2772
2773 audit_inode(name, file->f_path.dentry, 0);
2774 goto opened;
2775 }
2776
2777 if (*opened & FILE_CREATED) {
2778
2779 open_flag &= ~O_TRUNC;
2780 will_truncate = false;
2781 acc_mode = MAY_OPEN;
2782 path_to_nameidata(path, nd);
2783 goto finish_open_created;
2784 }
2785
2786
2787
2788
2789 if (path->dentry->d_inode)
2790 audit_inode(name, path->dentry, 0);
2791
2792
2793
2794
2795
2796
2797 if (got_write) {
2798 mnt_drop_write(nd->path.mnt);
2799 got_write = false;
2800 }
2801
2802 error = -EEXIST;
2803 if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))
2804 goto exit_dput;
2805
2806 error = follow_managed(path, nd->flags);
2807 if (error < 0)
2808 goto exit_dput;
2809
2810 if (error)
2811 nd->flags |= LOOKUP_JUMPED;
2812
2813 BUG_ON(nd->flags & LOOKUP_RCU);
2814 inode = path->dentry->d_inode;
2815finish_lookup:
2816
2817 error = -ENOENT;
2818 if (!inode) {
2819 path_to_nameidata(path, nd);
2820 goto out;
2821 }
2822
2823 if (should_follow_link(inode, !symlink_ok)) {
2824 if (nd->flags & LOOKUP_RCU) {
2825 if (unlikely(unlazy_walk(nd, path->dentry))) {
2826 error = -ECHILD;
2827 goto out;
2828 }
2829 }
2830 BUG_ON(inode != path->dentry->d_inode);
2831 return 1;
2832 }
2833
2834 if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path->mnt) {
2835 path_to_nameidata(path, nd);
2836 } else {
2837 save_parent.dentry = nd->path.dentry;
2838 save_parent.mnt = mntget(path->mnt);
2839 nd->path.dentry = path->dentry;
2840
2841 }
2842 nd->inode = inode;
2843
2844 error = complete_walk(nd);
2845 if (error) {
2846 path_put(&save_parent);
2847 return error;
2848 }
2849 error = -EISDIR;
2850 if ((open_flag & O_CREAT) && S_ISDIR(nd->inode->i_mode))
2851 goto out;
2852 error = -ENOTDIR;
2853 if ((nd->flags & LOOKUP_DIRECTORY) && !can_lookup(nd->inode))
2854 goto out;
2855 audit_inode(name, nd->path.dentry, 0);
2856finish_open:
2857 if (!S_ISREG(nd->inode->i_mode))
2858 will_truncate = false;
2859
2860 if (will_truncate) {
2861 error = mnt_want_write(nd->path.mnt);
2862 if (error)
2863 goto out;
2864 got_write = true;
2865 }
2866finish_open_created:
2867 error = may_open(&nd->path, acc_mode, open_flag);
2868 if (error)
2869 goto out;
2870 file->f_path.mnt = nd->path.mnt;
2871 error = finish_open(file, nd->path.dentry, NULL, opened);
2872 if (error) {
2873 if (error == -EOPENSTALE)
2874 goto stale_open;
2875 goto out;
2876 }
2877opened:
2878 error = open_check_o_direct(file);
2879 if (error)
2880 goto exit_fput;
2881 error = ima_file_check(file, op->acc_mode);
2882 if (error)
2883 goto exit_fput;
2884
2885 if (will_truncate) {
2886 error = handle_truncate(file);
2887 if (error)
2888 goto exit_fput;
2889 }
2890out:
2891 if (got_write)
2892 mnt_drop_write(nd->path.mnt);
2893 path_put(&save_parent);
2894 terminate_walk(nd);
2895 return error;
2896
2897exit_dput:
2898 path_put_conditional(path, nd);
2899 goto out;
2900exit_fput:
2901 fput(file);
2902 goto out;
2903
2904stale_open:
2905
2906 if (!save_parent.dentry || retried)
2907 goto out;
2908
2909 BUG_ON(save_parent.dentry != dir);
2910 path_put(&nd->path);
2911 nd->path = save_parent;
2912 nd->inode = dir->d_inode;
2913 save_parent.mnt = NULL;
2914 save_parent.dentry = NULL;
2915 if (got_write) {
2916 mnt_drop_write(nd->path.mnt);
2917 got_write = false;
2918 }
2919 retried = true;
2920 goto retry_lookup;
2921}
2922
2923static struct file *path_openat(int dfd, struct filename *pathname,
2924 struct nameidata *nd, const struct open_flags *op, int flags)
2925{
2926 struct file *base = NULL;
2927 struct file *file;
2928 struct path path;
2929 int opened = 0;
2930 int error;
2931
2932 file = get_empty_filp();
2933 if (IS_ERR(file))
2934 return file;
2935
2936 file->f_flags = op->open_flag;
2937
2938 error = path_init(dfd, pathname->name, flags | LOOKUP_PARENT, nd, &base);
2939 if (unlikely(error))
2940 goto out;
2941
2942 current->total_link_count = 0;
2943 error = link_path_walk(pathname->name, nd);
2944 if (unlikely(error))
2945 goto out;
2946
2947 error = do_last(nd, &path, file, op, &opened, pathname);
2948 while (unlikely(error > 0)) {
2949 struct path link = path;
2950 void *cookie;
2951 if (!(nd->flags & LOOKUP_FOLLOW)) {
2952 path_put_conditional(&path, nd);
2953 path_put(&nd->path);
2954 error = -ELOOP;
2955 break;
2956 }
2957 error = may_follow_link(&link, nd);
2958 if (unlikely(error))
2959 break;
2960 nd->flags |= LOOKUP_PARENT;
2961 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
2962 error = follow_link(&link, nd, &cookie);
2963 if (unlikely(error))
2964 break;
2965 error = do_last(nd, &path, file, op, &opened, pathname);
2966 put_link(nd, &link, cookie);
2967 }
2968out:
2969 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT))
2970 path_put(&nd->root);
2971 if (base)
2972 fput(base);
2973 if (!(opened & FILE_OPENED)) {
2974 BUG_ON(!error);
2975 put_filp(file);
2976 }
2977 if (unlikely(error)) {
2978 if (error == -EOPENSTALE) {
2979 if (flags & LOOKUP_RCU)
2980 error = -ECHILD;
2981 else
2982 error = -ESTALE;
2983 }
2984 file = ERR_PTR(error);
2985 }
2986 return file;
2987}
2988
2989struct file *do_filp_open(int dfd, struct filename *pathname,
2990 const struct open_flags *op, int flags)
2991{
2992 struct nameidata nd;
2993 struct file *filp;
2994
2995 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU);
2996 if (unlikely(filp == ERR_PTR(-ECHILD)))
2997 filp = path_openat(dfd, pathname, &nd, op, flags);
2998 if (unlikely(filp == ERR_PTR(-ESTALE)))
2999 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL);
3000 return filp;
3001}
3002
3003struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
3004 const char *name, const struct open_flags *op, int flags)
3005{
3006 struct nameidata nd;
3007 struct file *file;
3008 struct filename filename = { .name = name };
3009
3010 nd.root.mnt = mnt;
3011 nd.root.dentry = dentry;
3012
3013 flags |= LOOKUP_ROOT;
3014
3015 if (dentry->d_inode->i_op->follow_link && op->intent & LOOKUP_OPEN)
3016 return ERR_PTR(-ELOOP);
3017
3018 file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_RCU);
3019 if (unlikely(file == ERR_PTR(-ECHILD)))
3020 file = path_openat(-1, &filename, &nd, op, flags);
3021 if (unlikely(file == ERR_PTR(-ESTALE)))
3022 file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_REVAL);
3023 return file;
3024}
3025
3026struct dentry *kern_path_create(int dfd, const char *pathname,
3027 struct path *path, unsigned int lookup_flags)
3028{
3029 struct dentry *dentry = ERR_PTR(-EEXIST);
3030 struct nameidata nd;
3031 int err2;
3032 int error;
3033 bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);
3034
3035
3036
3037
3038
3039 lookup_flags &= LOOKUP_REVAL;
3040
3041 error = do_path_lookup(dfd, pathname, LOOKUP_PARENT|lookup_flags, &nd);
3042 if (error)
3043 return ERR_PTR(error);
3044
3045
3046
3047
3048
3049 if (nd.last_type != LAST_NORM)
3050 goto out;
3051 nd.flags &= ~LOOKUP_PARENT;
3052 nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL;
3053
3054
3055 err2 = mnt_want_write(nd.path.mnt);
3056
3057
3058
3059 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
3060 dentry = lookup_hash(&nd);
3061 if (IS_ERR(dentry))
3062 goto unlock;
3063
3064 error = -EEXIST;
3065 if (dentry->d_inode)
3066 goto fail;
3067
3068
3069
3070
3071
3072
3073 if (unlikely(!is_dir && nd.last.name[nd.last.len])) {
3074 error = -ENOENT;
3075 goto fail;
3076 }
3077 if (unlikely(err2)) {
3078 error = err2;
3079 goto fail;
3080 }
3081 *path = nd.path;
3082 return dentry;
3083fail:
3084 dput(dentry);
3085 dentry = ERR_PTR(error);
3086unlock:
3087 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
3088 if (!err2)
3089 mnt_drop_write(nd.path.mnt);
3090out:
3091 path_put(&nd.path);
3092 return dentry;
3093}
3094EXPORT_SYMBOL(kern_path_create);
3095
3096void done_path_create(struct path *path, struct dentry *dentry)
3097{
3098 dput(dentry);
3099 mutex_unlock(&path->dentry->d_inode->i_mutex);
3100 mnt_drop_write(path->mnt);
3101 path_put(path);
3102}
3103EXPORT_SYMBOL(done_path_create);
3104
3105struct dentry *user_path_create(int dfd, const char __user *pathname,
3106 struct path *path, unsigned int lookup_flags)
3107{
3108 struct filename *tmp = getname(pathname);
3109 struct dentry *res;
3110 if (IS_ERR(tmp))
3111 return ERR_CAST(tmp);
3112 res = kern_path_create(dfd, tmp->name, path, lookup_flags);
3113 putname(tmp);
3114 return res;
3115}
3116EXPORT_SYMBOL(user_path_create);
3117
3118int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3119{
3120 int error = may_create(dir, dentry);
3121
3122 if (error)
3123 return error;
3124
3125 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
3126 return -EPERM;
3127
3128 if (!dir->i_op->mknod)
3129 return -EPERM;
3130
3131 error = devcgroup_inode_mknod(mode, dev);
3132 if (error)
3133 return error;
3134
3135 error = security_inode_mknod(dir, dentry, mode, dev);
3136 if (error)
3137 return error;
3138
3139 error = dir->i_op->mknod(dir, dentry, mode, dev);
3140 if (!error)
3141 fsnotify_create(dir, dentry);
3142 return error;
3143}
3144
3145static int may_mknod(umode_t mode)
3146{
3147 switch (mode & S_IFMT) {
3148 case S_IFREG:
3149 case S_IFCHR:
3150 case S_IFBLK:
3151 case S_IFIFO:
3152 case S_IFSOCK:
3153 case 0:
3154 return 0;
3155 case S_IFDIR:
3156 return -EPERM;
3157 default:
3158 return -EINVAL;
3159 }
3160}
3161
3162SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
3163 unsigned, dev)
3164{
3165 struct dentry *dentry;
3166 struct path path;
3167 int error;
3168 unsigned int lookup_flags = 0;
3169
3170 error = may_mknod(mode);
3171 if (error)
3172 return error;
3173retry:
3174 dentry = user_path_create(dfd, filename, &path, lookup_flags);
3175 if (IS_ERR(dentry))
3176 return PTR_ERR(dentry);
3177
3178 if (!IS_POSIXACL(path.dentry->d_inode))
3179 mode &= ~current_umask();
3180 error = security_path_mknod(&path, dentry, mode, dev);
3181 if (error)
3182 goto out;
3183 switch (mode & S_IFMT) {
3184 case 0: case S_IFREG:
3185 error = vfs_create(path.dentry->d_inode,dentry,mode,true);
3186 break;
3187 case S_IFCHR: case S_IFBLK:
3188 error = vfs_mknod(path.dentry->d_inode,dentry,mode,
3189 new_decode_dev(dev));
3190 break;
3191 case S_IFIFO: case S_IFSOCK:
3192 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
3193 break;
3194 }
3195out:
3196 done_path_create(&path, dentry);
3197 if (retry_estale(error, lookup_flags)) {
3198 lookup_flags |= LOOKUP_REVAL;
3199 goto retry;
3200 }
3201 return error;
3202}
3203
3204SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3205{
3206 return sys_mknodat(AT_FDCWD, filename, mode, dev);
3207}
3208
3209int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
3210{
3211 int error = may_create(dir, dentry);
3212 unsigned max_links = dir->i_sb->s_max_links;
3213
3214 if (error)
3215 return error;
3216
3217 if (!dir->i_op->mkdir)
3218 return -EPERM;
3219
3220 mode &= (S_IRWXUGO|S_ISVTX);
3221 error = security_inode_mkdir(dir, dentry, mode);
3222 if (error)
3223 return error;
3224
3225 if (max_links && dir->i_nlink >= max_links)
3226 return -EMLINK;
3227
3228 error = dir->i_op->mkdir(dir, dentry, mode);
3229 if (!error)
3230 fsnotify_mkdir(dir, dentry);
3231 return error;
3232}
3233
3234SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
3235{
3236 struct dentry *dentry;
3237 struct path path;
3238 int error;
3239 unsigned int lookup_flags = LOOKUP_DIRECTORY;
3240
3241retry:
3242 dentry = user_path_create(dfd, pathname, &path, lookup_flags);
3243 if (IS_ERR(dentry))
3244 return PTR_ERR(dentry);
3245
3246 if (!IS_POSIXACL(path.dentry->d_inode))
3247 mode &= ~current_umask();
3248 error = security_path_mkdir(&path, dentry, mode);
3249 if (!error)
3250 error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
3251 done_path_create(&path, dentry);
3252 if (retry_estale(error, lookup_flags)) {
3253 lookup_flags |= LOOKUP_REVAL;
3254 goto retry;
3255 }
3256 return error;
3257}
3258
3259SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
3260{
3261 return sys_mkdirat(AT_FDCWD, pathname, mode);
3262}
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279void dentry_unhash(struct dentry *dentry)
3280{
3281 shrink_dcache_parent(dentry);
3282 spin_lock(&dentry->d_lock);
3283 if (dentry->d_count == 1)
3284 __d_drop(dentry);
3285 spin_unlock(&dentry->d_lock);
3286}
3287
3288int vfs_rmdir(struct inode *dir, struct dentry *dentry)
3289{
3290 int error = may_delete(dir, dentry, 1);
3291
3292 if (error)
3293 return error;
3294
3295 if (!dir->i_op->rmdir)
3296 return -EPERM;
3297
3298 dget(dentry);
3299 mutex_lock(&dentry->d_inode->i_mutex);
3300
3301 error = -EBUSY;
3302 if (d_mountpoint(dentry))
3303 goto out;
3304
3305 error = security_inode_rmdir(dir, dentry);
3306 if (error)
3307 goto out;
3308
3309 shrink_dcache_parent(dentry);
3310 error = dir->i_op->rmdir(dir, dentry);
3311 if (error)
3312 goto out;
3313
3314 dentry->d_inode->i_flags |= S_DEAD;
3315 dont_mount(dentry);
3316
3317out:
3318 mutex_unlock(&dentry->d_inode->i_mutex);
3319 dput(dentry);
3320 if (!error)
3321 d_delete(dentry);
3322 return error;
3323}
3324
3325static long do_rmdir(int dfd, const char __user *pathname)
3326{
3327 int error = 0;
3328 struct filename *name;
3329 struct dentry *dentry;
3330 struct nameidata nd;
3331 unsigned int lookup_flags = 0;
3332retry:
3333 name = user_path_parent(dfd, pathname, &nd, lookup_flags);
3334 if (IS_ERR(name))
3335 return PTR_ERR(name);
3336
3337 switch(nd.last_type) {
3338 case LAST_DOTDOT:
3339 error = -ENOTEMPTY;
3340 goto exit1;
3341 case LAST_DOT:
3342 error = -EINVAL;
3343 goto exit1;
3344 case LAST_ROOT:
3345 error = -EBUSY;
3346 goto exit1;
3347 }
3348
3349 nd.flags &= ~LOOKUP_PARENT;
3350 error = mnt_want_write(nd.path.mnt);
3351 if (error)
3352 goto exit1;
3353
3354 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
3355 dentry = lookup_hash(&nd);
3356 error = PTR_ERR(dentry);
3357 if (IS_ERR(dentry))
3358 goto exit2;
3359 if (!dentry->d_inode) {
3360 error = -ENOENT;
3361 goto exit3;
3362 }
3363 error = security_path_rmdir(&nd.path, dentry);
3364 if (error)
3365 goto exit3;
3366 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
3367exit3:
3368 dput(dentry);
3369exit2:
3370 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
3371 mnt_drop_write(nd.path.mnt);
3372exit1:
3373 path_put(&nd.path);
3374 putname(name);
3375 if (retry_estale(error, lookup_flags)) {
3376 lookup_flags |= LOOKUP_REVAL;
3377 goto retry;
3378 }
3379 return error;
3380}
3381
3382SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
3383{
3384 return do_rmdir(AT_FDCWD, pathname);
3385}
3386
3387int vfs_unlink(struct inode *dir, struct dentry *dentry)
3388{
3389 int error = may_delete(dir, dentry, 0);
3390
3391 if (error)
3392 return error;
3393
3394 if (!dir->i_op->unlink)
3395 return -EPERM;
3396
3397 mutex_lock(&dentry->d_inode->i_mutex);
3398 if (d_mountpoint(dentry))
3399 error = -EBUSY;
3400 else {
3401 error = security_inode_unlink(dir, dentry);
3402 if (!error) {
3403 error = dir->i_op->unlink(dir, dentry);
3404 if (!error)
3405 dont_mount(dentry);
3406 }
3407 }
3408 mutex_unlock(&dentry->d_inode->i_mutex);
3409
3410
3411 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
3412 fsnotify_link_count(dentry->d_inode);
3413 d_delete(dentry);
3414 }
3415
3416 return error;
3417}
3418
3419
3420
3421
3422
3423
3424
3425static long do_unlinkat(int dfd, const char __user *pathname)
3426{
3427 int error;
3428 struct filename *name;
3429 struct dentry *dentry;
3430 struct nameidata nd;
3431 struct inode *inode = NULL;
3432 unsigned int lookup_flags = 0;
3433retry:
3434 name = user_path_parent(dfd, pathname, &nd, lookup_flags);
3435 if (IS_ERR(name))
3436 return PTR_ERR(name);
3437
3438 error = -EISDIR;
3439 if (nd.last_type != LAST_NORM)
3440 goto exit1;
3441
3442 nd.flags &= ~LOOKUP_PARENT;
3443 error = mnt_want_write(nd.path.mnt);
3444 if (error)
3445 goto exit1;
3446
3447 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
3448 dentry = lookup_hash(&nd);
3449 error = PTR_ERR(dentry);
3450 if (!IS_ERR(dentry)) {
3451
3452 if (nd.last.name[nd.last.len])
3453 goto slashes;
3454 inode = dentry->d_inode;
3455 if (!inode)
3456 goto slashes;
3457 ihold(inode);
3458 error = security_path_unlink(&nd.path, dentry);
3459 if (error)
3460 goto exit2;
3461 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
3462exit2:
3463 dput(dentry);
3464 }
3465 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
3466 if (inode)
3467 iput(inode);
3468 mnt_drop_write(nd.path.mnt);
3469exit1:
3470 path_put(&nd.path);
3471 putname(name);
3472 if (retry_estale(error, lookup_flags)) {
3473 lookup_flags |= LOOKUP_REVAL;
3474 inode = NULL;
3475 goto retry;
3476 }
3477 return error;
3478
3479slashes:
3480 error = !dentry->d_inode ? -ENOENT :
3481 S_ISDIR(dentry->d_inode->i_mode) ? -EISDIR : -ENOTDIR;
3482 goto exit2;
3483}
3484
3485SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
3486{
3487 if ((flag & ~AT_REMOVEDIR) != 0)
3488 return -EINVAL;
3489
3490 if (flag & AT_REMOVEDIR)
3491 return do_rmdir(dfd, pathname);
3492
3493 return do_unlinkat(dfd, pathname);
3494}
3495
3496SYSCALL_DEFINE1(unlink, const char __user *, pathname)
3497{
3498 return do_unlinkat(AT_FDCWD, pathname);
3499}
3500
3501int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
3502{
3503 int error = may_create(dir, dentry);
3504
3505 if (error)
3506 return error;
3507
3508 if (!dir->i_op->symlink)
3509 return -EPERM;
3510
3511 error = security_inode_symlink(dir, dentry, oldname);
3512 if (error)
3513 return error;
3514
3515 error = dir->i_op->symlink(dir, dentry, oldname);
3516 if (!error)
3517 fsnotify_create(dir, dentry);
3518 return error;
3519}
3520
3521SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
3522 int, newdfd, const char __user *, newname)
3523{
3524 int error;
3525 struct filename *from;
3526 struct dentry *dentry;
3527 struct path path;
3528 unsigned int lookup_flags = 0;
3529
3530 from = getname(oldname);
3531 if (IS_ERR(from))
3532 return PTR_ERR(from);
3533retry:
3534 dentry = user_path_create(newdfd, newname, &path, lookup_flags);
3535 error = PTR_ERR(dentry);
3536 if (IS_ERR(dentry))
3537 goto out_putname;
3538
3539 error = security_path_symlink(&path, dentry, from->name);
3540 if (!error)
3541 error = vfs_symlink(path.dentry->d_inode, dentry, from->name);
3542 done_path_create(&path, dentry);
3543 if (retry_estale(error, lookup_flags)) {
3544 lookup_flags |= LOOKUP_REVAL;
3545 goto retry;
3546 }
3547out_putname:
3548 putname(from);
3549 return error;
3550}
3551
3552SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
3553{
3554 return sys_symlinkat(oldname, AT_FDCWD, newname);
3555}
3556
3557int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3558{
3559 struct inode *inode = old_dentry->d_inode;
3560 unsigned max_links = dir->i_sb->s_max_links;
3561 int error;
3562
3563 if (!inode)
3564 return -ENOENT;
3565
3566 error = may_create(dir, new_dentry);
3567 if (error)
3568 return error;
3569
3570 if (dir->i_sb != inode->i_sb)
3571 return -EXDEV;
3572
3573
3574
3575
3576 if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
3577 return -EPERM;
3578 if (!dir->i_op->link)
3579 return -EPERM;
3580 if (S_ISDIR(inode->i_mode))
3581 return -EPERM;
3582
3583 error = security_inode_link(old_dentry, dir, new_dentry);
3584 if (error)
3585 return error;
3586
3587 mutex_lock(&inode->i_mutex);
3588
3589 if (inode->i_nlink == 0)
3590 error = -ENOENT;
3591 else if (max_links && inode->i_nlink >= max_links)
3592 error = -EMLINK;
3593 else
3594 error = dir->i_op->link(old_dentry, dir, new_dentry);
3595 mutex_unlock(&inode->i_mutex);
3596 if (!error)
3597 fsnotify_link(dir, inode, new_dentry);
3598 return error;
3599}
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
3611 int, newdfd, const char __user *, newname, int, flags)
3612{
3613 struct dentry *new_dentry;
3614 struct path old_path, new_path;
3615 int how = 0;
3616 int error;
3617
3618 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
3619 return -EINVAL;
3620
3621
3622
3623
3624
3625 if (flags & AT_EMPTY_PATH) {
3626 if (!capable(CAP_DAC_READ_SEARCH))
3627 return -ENOENT;
3628 how = LOOKUP_EMPTY;
3629 }
3630
3631 if (flags & AT_SYMLINK_FOLLOW)
3632 how |= LOOKUP_FOLLOW;
3633retry:
3634 error = user_path_at(olddfd, oldname, how, &old_path);
3635 if (error)
3636 return error;
3637
3638 new_dentry = user_path_create(newdfd, newname, &new_path,
3639 (how & LOOKUP_REVAL));
3640 error = PTR_ERR(new_dentry);
3641 if (IS_ERR(new_dentry))
3642 goto out;
3643
3644 error = -EXDEV;
3645 if (old_path.mnt != new_path.mnt)
3646 goto out_dput;
3647 error = may_linkat(&old_path);
3648 if (unlikely(error))
3649 goto out_dput;
3650 error = security_path_link(old_path.dentry, &new_path, new_dentry);
3651 if (error)
3652 goto out_dput;
3653 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry);
3654out_dput:
3655 done_path_create(&new_path, new_dentry);
3656 if (retry_estale(error, how)) {
3657 how |= LOOKUP_REVAL;
3658 goto retry;
3659 }
3660out:
3661 path_put(&old_path);
3662
3663 return error;
3664}
3665
3666SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
3667{
3668 return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
3669}
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688
3689
3690
3691
3692
3693
3694
3695
3696
3697
3698static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
3699 struct inode *new_dir, struct dentry *new_dentry)
3700{
3701 int error = 0;
3702 struct inode *target = new_dentry->d_inode;
3703 unsigned max_links = new_dir->i_sb->s_max_links;
3704
3705
3706
3707
3708
3709 if (new_dir != old_dir) {
3710 error = inode_permission(old_dentry->d_inode, MAY_WRITE);
3711 if (error)
3712 return error;
3713 }
3714
3715 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
3716 if (error)
3717 return error;
3718
3719 dget(new_dentry);
3720 if (target)
3721 mutex_lock(&target->i_mutex);
3722
3723 error = -EBUSY;
3724 if (d_mountpoint(old_dentry) || d_mountpoint(new_dentry))
3725 goto out;
3726
3727 error = -EMLINK;
3728 if (max_links && !target && new_dir != old_dir &&
3729 new_dir->i_nlink >= max_links)
3730 goto out;
3731
3732 if (target)
3733 shrink_dcache_parent(new_dentry);
3734 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
3735 if (error)
3736 goto out;
3737
3738 if (target) {
3739 target->i_flags |= S_DEAD;
3740 dont_mount(new_dentry);
3741 }
3742out:
3743 if (target)
3744 mutex_unlock(&target->i_mutex);
3745 dput(new_dentry);
3746 if (!error)
3747 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
3748 d_move(old_dentry,new_dentry);
3749 return error;
3750}
3751
3752static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
3753 struct inode *new_dir, struct dentry *new_dentry)
3754{
3755 struct inode *target = new_dentry->d_inode;
3756 int error;
3757
3758 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
3759 if (error)
3760 return error;
3761
3762 dget(new_dentry);
3763 if (target)
3764 mutex_lock(&target->i_mutex);
3765
3766 error = -EBUSY;
3767 if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
3768 goto out;
3769
3770 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
3771 if (error)
3772 goto out;
3773
3774 if (target)
3775 dont_mount(new_dentry);
3776 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
3777 d_move(old_dentry, new_dentry);
3778out:
3779 if (target)
3780 mutex_unlock(&target->i_mutex);
3781 dput(new_dentry);
3782 return error;
3783}
3784
3785int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
3786 struct inode *new_dir, struct dentry *new_dentry)
3787{
3788 int error;
3789 int is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
3790 const unsigned char *old_name;
3791
3792 if (old_dentry->d_inode == new_dentry->d_inode)
3793 return 0;
3794
3795 error = may_delete(old_dir, old_dentry, is_dir);
3796 if (error)
3797 return error;
3798
3799 if (!new_dentry->d_inode)
3800 error = may_create(new_dir, new_dentry);
3801 else
3802 error = may_delete(new_dir, new_dentry, is_dir);
3803 if (error)
3804 return error;
3805
3806 if (!old_dir->i_op->rename)
3807 return -EPERM;
3808
3809 old_name = fsnotify_oldname_init(old_dentry->d_name.name);
3810
3811 if (is_dir)
3812 error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
3813 else
3814 error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
3815 if (!error)
3816 fsnotify_move(old_dir, new_dir, old_name, is_dir,
3817 new_dentry->d_inode, old_dentry);
3818 fsnotify_oldname_free(old_name);
3819
3820 return error;
3821}
3822
3823SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
3824 int, newdfd, const char __user *, newname)
3825{
3826 struct dentry *old_dir, *new_dir;
3827 struct dentry *old_dentry, *new_dentry;
3828 struct dentry *trap;
3829 struct nameidata oldnd, newnd;
3830 struct filename *from;
3831 struct filename *to;
3832 unsigned int lookup_flags = 0;
3833 bool should_retry = false;
3834 int error;
3835retry:
3836 from = user_path_parent(olddfd, oldname, &oldnd, lookup_flags);
3837 if (IS_ERR(from)) {
3838 error = PTR_ERR(from);
3839 goto exit;
3840 }
3841
3842 to = user_path_parent(newdfd, newname, &newnd, lookup_flags);
3843 if (IS_ERR(to)) {
3844 error = PTR_ERR(to);
3845 goto exit1;
3846 }
3847
3848 error = -EXDEV;
3849 if (oldnd.path.mnt != newnd.path.mnt)
3850 goto exit2;
3851
3852 old_dir = oldnd.path.dentry;
3853 error = -EBUSY;
3854 if (oldnd.last_type != LAST_NORM)
3855 goto exit2;
3856
3857 new_dir = newnd.path.dentry;
3858 if (newnd.last_type != LAST_NORM)
3859 goto exit2;
3860
3861 error = mnt_want_write(oldnd.path.mnt);
3862 if (error)
3863 goto exit2;
3864
3865 oldnd.flags &= ~LOOKUP_PARENT;
3866 newnd.flags &= ~LOOKUP_PARENT;
3867 newnd.flags |= LOOKUP_RENAME_TARGET;
3868
3869 trap = lock_rename(new_dir, old_dir);
3870
3871 old_dentry = lookup_hash(&oldnd);
3872 error = PTR_ERR(old_dentry);
3873 if (IS_ERR(old_dentry))
3874 goto exit3;
3875
3876 error = -ENOENT;
3877 if (!old_dentry->d_inode)
3878 goto exit4;
3879
3880 if (!S_ISDIR(old_dentry->d_inode->i_mode)) {
3881 error = -ENOTDIR;
3882 if (oldnd.last.name[oldnd.last.len])
3883 goto exit4;
3884 if (newnd.last.name[newnd.last.len])
3885 goto exit4;
3886 }
3887
3888 error = -EINVAL;
3889 if (old_dentry == trap)
3890 goto exit4;
3891 new_dentry = lookup_hash(&newnd);
3892 error = PTR_ERR(new_dentry);
3893 if (IS_ERR(new_dentry))
3894 goto exit4;
3895
3896 error = -ENOTEMPTY;
3897 if (new_dentry == trap)
3898 goto exit5;
3899
3900 error = security_path_rename(&oldnd.path, old_dentry,
3901 &newnd.path, new_dentry);
3902 if (error)
3903 goto exit5;
3904 error = vfs_rename(old_dir->d_inode, old_dentry,
3905 new_dir->d_inode, new_dentry);
3906exit5:
3907 dput(new_dentry);
3908exit4:
3909 dput(old_dentry);
3910exit3:
3911 unlock_rename(new_dir, old_dir);
3912 mnt_drop_write(oldnd.path.mnt);
3913exit2:
3914 if (retry_estale(error, lookup_flags))
3915 should_retry = true;
3916 path_put(&newnd.path);
3917 putname(to);
3918exit1:
3919 path_put(&oldnd.path);
3920 putname(from);
3921 if (should_retry) {
3922 should_retry = false;
3923 lookup_flags |= LOOKUP_REVAL;
3924 goto retry;
3925 }
3926exit:
3927 return error;
3928}
3929
3930SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
3931{
3932 return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname);
3933}
3934
3935int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
3936{
3937 int len;
3938
3939 len = PTR_ERR(link);
3940 if (IS_ERR(link))
3941 goto out;
3942
3943 len = strlen(link);
3944 if (len > (unsigned) buflen)
3945 len = buflen;
3946 if (copy_to_user(buffer, link, len))
3947 len = -EFAULT;
3948out:
3949 return len;
3950}
3951
3952
3953
3954
3955
3956
3957int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
3958{
3959 struct nameidata nd;
3960 void *cookie;
3961 int res;
3962
3963 nd.depth = 0;
3964 cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
3965 if (IS_ERR(cookie))
3966 return PTR_ERR(cookie);
3967
3968 res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
3969 if (dentry->d_inode->i_op->put_link)
3970 dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
3971 return res;
3972}
3973
3974int vfs_follow_link(struct nameidata *nd, const char *link)
3975{
3976 return __vfs_follow_link(nd, link);
3977}
3978
3979
3980static char *page_getlink(struct dentry * dentry, struct page **ppage)
3981{
3982 char *kaddr;
3983 struct page *page;
3984 struct address_space *mapping = dentry->d_inode->i_mapping;
3985 page = read_mapping_page(mapping, 0, NULL);
3986 if (IS_ERR(page))
3987 return (char*)page;
3988 *ppage = page;
3989 kaddr = kmap(page);
3990 nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1);
3991 return kaddr;
3992}
3993
3994int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
3995{
3996 struct page *page = NULL;
3997 char *s = page_getlink(dentry, &page);
3998 int res = vfs_readlink(dentry,buffer,buflen,s);
3999 if (page) {
4000 kunmap(page);
4001 page_cache_release(page);
4002 }
4003 return res;
4004}
4005
4006void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
4007{
4008 struct page *page = NULL;
4009 nd_set_link(nd, page_getlink(dentry, &page));
4010 return page;
4011}
4012
4013void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
4014{
4015 struct page *page = cookie;
4016
4017 if (page) {
4018 kunmap(page);
4019 page_cache_release(page);
4020 }
4021}
4022
4023
4024
4025
4026int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
4027{
4028 struct address_space *mapping = inode->i_mapping;
4029 struct page *page;
4030 void *fsdata;
4031 int err;
4032 char *kaddr;
4033 unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
4034 if (nofs)
4035 flags |= AOP_FLAG_NOFS;
4036
4037retry:
4038 err = pagecache_write_begin(NULL, mapping, 0, len-1,
4039 flags, &page, &fsdata);
4040 if (err)
4041 goto fail;
4042
4043 kaddr = kmap_atomic(page);
4044 memcpy(kaddr, symname, len-1);
4045 kunmap_atomic(kaddr);
4046
4047 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
4048 page, fsdata);
4049 if (err < 0)
4050 goto fail;
4051 if (err < len-1)
4052 goto retry;
4053
4054 mark_inode_dirty(inode);
4055 return 0;
4056fail:
4057 return err;
4058}
4059
4060int page_symlink(struct inode *inode, const char *symname, int len)
4061{
4062 return __page_symlink(inode, symname, len,
4063 !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS));
4064}
4065
4066const struct inode_operations page_symlink_inode_operations = {
4067 .readlink = generic_readlink,
4068 .follow_link = page_follow_link_light,
4069 .put_link = page_put_link,
4070};
4071
4072EXPORT_SYMBOL(user_path_at);
4073EXPORT_SYMBOL(follow_down_one);
4074EXPORT_SYMBOL(follow_down);
4075EXPORT_SYMBOL(follow_up);
4076EXPORT_SYMBOL(get_write_access);
4077EXPORT_SYMBOL(lock_rename);
4078EXPORT_SYMBOL(lookup_one_len);
4079EXPORT_SYMBOL(page_follow_link_light);
4080EXPORT_SYMBOL(page_put_link);
4081EXPORT_SYMBOL(page_readlink);
4082EXPORT_SYMBOL(__page_symlink);
4083EXPORT_SYMBOL(page_symlink);
4084EXPORT_SYMBOL(page_symlink_inode_operations);
4085EXPORT_SYMBOL(kern_path);
4086EXPORT_SYMBOL(vfs_path_lookup);
4087EXPORT_SYMBOL(inode_permission);
4088EXPORT_SYMBOL(unlock_rename);
4089EXPORT_SYMBOL(vfs_create);
4090EXPORT_SYMBOL(vfs_follow_link);
4091EXPORT_SYMBOL(vfs_link);
4092EXPORT_SYMBOL(vfs_mkdir);
4093EXPORT_SYMBOL(vfs_mknod);
4094EXPORT_SYMBOL(generic_permission);
4095EXPORT_SYMBOL(vfs_readlink);
4096EXPORT_SYMBOL(vfs_rename);
4097EXPORT_SYMBOL(vfs_rmdir);
4098EXPORT_SYMBOL(vfs_symlink);
4099EXPORT_SYMBOL(vfs_unlink);
4100EXPORT_SYMBOL(dentry_unhash);
4101EXPORT_SYMBOL(generic_readlink);
4102