1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17#include <linux/init.h>
18#include <linux/export.h>
19#include <linux/kernel.h>
20#include <linux/slab.h>
21#include <linux/fs.h>
22#include <linux/namei.h>
23#include <linux/pagemap.h>
24#include <linux/fsnotify.h>
25#include <linux/personality.h>
26#include <linux/security.h>
27#include <linux/ima.h>
28#include <linux/syscalls.h>
29#include <linux/mount.h>
30#include <linux/audit.h>
31#include <linux/capability.h>
32#include <linux/file.h>
33#include <linux/fcntl.h>
34#include <linux/device_cgroup.h>
35#include <linux/fs_struct.h>
36#include <linux/posix_acl.h>
37#include <asm/uaccess.h>
38
39#include "internal.h"
40#include "mount.h"
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120void final_putname(struct filename *name)
121{
122 if (name->separate) {
123 __putname(name->name);
124 kfree(name);
125 } else {
126 __putname(name);
127 }
128}
129
130#define EMBEDDED_NAME_MAX (PATH_MAX - sizeof(struct filename))
131
132static struct filename *
133getname_flags(const char __user *filename, int flags, int *empty)
134{
135 struct filename *result, *err;
136 int len;
137 long max;
138 char *kname;
139
140 result = audit_reusename(filename);
141 if (result)
142 return result;
143
144 result = __getname();
145 if (unlikely(!result))
146 return ERR_PTR(-ENOMEM);
147
148
149
150
151
152 kname = (char *)result + sizeof(*result);
153 result->name = kname;
154 result->separate = false;
155 max = EMBEDDED_NAME_MAX;
156
157recopy:
158 len = strncpy_from_user(kname, filename, max);
159 if (unlikely(len < 0)) {
160 err = ERR_PTR(len);
161 goto error;
162 }
163
164
165
166
167
168
169
170 if (len == EMBEDDED_NAME_MAX && max == EMBEDDED_NAME_MAX) {
171 kname = (char *)result;
172
173 result = kzalloc(sizeof(*result), GFP_KERNEL);
174 if (!result) {
175 err = ERR_PTR(-ENOMEM);
176 result = (struct filename *)kname;
177 goto error;
178 }
179 result->name = kname;
180 result->separate = true;
181 max = PATH_MAX;
182 goto recopy;
183 }
184
185
186 if (unlikely(!len)) {
187 if (empty)
188 *empty = 1;
189 err = ERR_PTR(-ENOENT);
190 if (!(flags & LOOKUP_EMPTY))
191 goto error;
192 }
193
194 err = ERR_PTR(-ENAMETOOLONG);
195 if (unlikely(len >= PATH_MAX))
196 goto error;
197
198 result->uptr = filename;
199 audit_getname(result);
200 return result;
201
202error:
203 final_putname(result);
204 return err;
205}
206
207struct filename *
208getname(const char __user * filename)
209{
210 return getname_flags(filename, 0, NULL);
211}
212EXPORT_SYMBOL(getname);
213
214#ifdef CONFIG_AUDITSYSCALL
215void putname(struct filename *name)
216{
217 if (unlikely(!audit_dummy_context()))
218 return audit_putname(name);
219 final_putname(name);
220}
221#endif
222
223static int check_acl(struct inode *inode, int mask)
224{
225#ifdef CONFIG_FS_POSIX_ACL
226 struct posix_acl *acl;
227
228 if (mask & MAY_NOT_BLOCK) {
229 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
230 if (!acl)
231 return -EAGAIN;
232
233 if (acl == ACL_NOT_CACHED)
234 return -ECHILD;
235 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
236 }
237
238 acl = get_cached_acl(inode, ACL_TYPE_ACCESS);
239
240
241
242
243
244
245
246
247
248 if (acl == ACL_NOT_CACHED) {
249 if (inode->i_op->get_acl) {
250 acl = inode->i_op->get_acl(inode, ACL_TYPE_ACCESS);
251 if (IS_ERR(acl))
252 return PTR_ERR(acl);
253 } else {
254 set_cached_acl(inode, ACL_TYPE_ACCESS, NULL);
255 return -EAGAIN;
256 }
257 }
258
259 if (acl) {
260 int error = posix_acl_permission(inode, acl, mask);
261 posix_acl_release(acl);
262 return error;
263 }
264#endif
265
266 return -EAGAIN;
267}
268
269
270
271
272static int acl_permission_check(struct inode *inode, int mask)
273{
274 unsigned int mode = inode->i_mode;
275
276 if (likely(uid_eq(current_fsuid(), inode->i_uid)))
277 mode >>= 6;
278 else {
279 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
280 int error = check_acl(inode, mask);
281 if (error != -EAGAIN)
282 return error;
283 }
284
285 if (in_group_p(inode->i_gid))
286 mode >>= 3;
287 }
288
289
290
291
292 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
293 return 0;
294 return -EACCES;
295}
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311int generic_permission(struct inode *inode, int mask)
312{
313 int ret;
314
315
316
317
318 ret = acl_permission_check(inode, mask);
319 if (ret != -EACCES)
320 return ret;
321
322 if (S_ISDIR(inode->i_mode)) {
323
324 if (inode_capable(inode, CAP_DAC_OVERRIDE))
325 return 0;
326 if (!(mask & MAY_WRITE))
327 if (inode_capable(inode, CAP_DAC_READ_SEARCH))
328 return 0;
329 return -EACCES;
330 }
331
332
333
334
335
336 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
337 if (inode_capable(inode, CAP_DAC_OVERRIDE))
338 return 0;
339
340
341
342
343 mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
344 if (mask == MAY_READ)
345 if (inode_capable(inode, CAP_DAC_READ_SEARCH))
346 return 0;
347
348 return -EACCES;
349}
350
351
352
353
354
355
356
357static inline int do_inode_permission(struct inode *inode, int mask)
358{
359 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
360 if (likely(inode->i_op->permission))
361 return inode->i_op->permission(inode, mask);
362
363
364 spin_lock(&inode->i_lock);
365 inode->i_opflags |= IOP_FASTPERM;
366 spin_unlock(&inode->i_lock);
367 }
368 return generic_permission(inode, mask);
369}
370
371
372
373
374
375
376
377
378
379
380
381
382
383int __inode_permission(struct inode *inode, int mask)
384{
385 int retval;
386
387 if (unlikely(mask & MAY_WRITE)) {
388
389
390
391 if (IS_IMMUTABLE(inode))
392 return -EACCES;
393 }
394
395 retval = do_inode_permission(inode, mask);
396 if (retval)
397 return retval;
398
399 retval = devcgroup_inode_permission(inode, mask);
400 if (retval)
401 return retval;
402
403 return security_inode_permission(inode, mask);
404}
405
406
407
408
409
410
411
412
413
414static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
415{
416 if (unlikely(mask & MAY_WRITE)) {
417 umode_t mode = inode->i_mode;
418
419
420 if ((sb->s_flags & MS_RDONLY) &&
421 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
422 return -EROFS;
423 }
424 return 0;
425}
426
427
428
429
430
431
432
433
434
435
436
437
438int inode_permission(struct inode *inode, int mask)
439{
440 int retval;
441
442 retval = sb_permission(inode->i_sb, inode, mask);
443 if (retval)
444 return retval;
445 return __inode_permission(inode, mask);
446}
447
448
449
450
451
452
453
454void path_get(const struct path *path)
455{
456 mntget(path->mnt);
457 dget(path->dentry);
458}
459EXPORT_SYMBOL(path_get);
460
461
462
463
464
465
466
467void path_put(const struct path *path)
468{
469 dput(path->dentry);
470 mntput(path->mnt);
471}
472EXPORT_SYMBOL(path_put);
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
496{
497 struct fs_struct *fs = current->fs;
498 struct dentry *parent = nd->path.dentry;
499
500 BUG_ON(!(nd->flags & LOOKUP_RCU));
501
502
503
504
505
506
507
508
509
510 if (!legitimize_mnt(nd->path.mnt, nd->m_seq))
511 return -ECHILD;
512 nd->flags &= ~LOOKUP_RCU;
513
514 if (!lockref_get_not_dead(&parent->d_lockref)) {
515 nd->path.dentry = NULL;
516 goto out;
517 }
518
519
520
521
522
523
524
525
526
527
528
529
530 if (!dentry) {
531 if (read_seqcount_retry(&parent->d_seq, nd->seq))
532 goto out;
533 BUG_ON(nd->inode != parent->d_inode);
534 } else {
535 if (!lockref_get_not_dead(&dentry->d_lockref))
536 goto out;
537 if (read_seqcount_retry(&dentry->d_seq, nd->seq))
538 goto drop_dentry;
539 }
540
541
542
543
544
545 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
546 spin_lock(&fs->lock);
547 if (nd->root.mnt != fs->root.mnt || nd->root.dentry != fs->root.dentry)
548 goto unlock_and_drop_dentry;
549 path_get(&nd->root);
550 spin_unlock(&fs->lock);
551 }
552
553 rcu_read_unlock();
554 return 0;
555
556unlock_and_drop_dentry:
557 spin_unlock(&fs->lock);
558drop_dentry:
559 rcu_read_unlock();
560 dput(dentry);
561 goto drop_root_mnt;
562out:
563 rcu_read_unlock();
564drop_root_mnt:
565 if (!(nd->flags & LOOKUP_ROOT))
566 nd->root.mnt = NULL;
567 return -ECHILD;
568}
569
570static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
571{
572 return dentry->d_op->d_revalidate(dentry, flags);
573}
574
575
576
577
578
579
580
581
582
583
584
585static int complete_walk(struct nameidata *nd)
586{
587 struct dentry *dentry = nd->path.dentry;
588 int status;
589
590 if (nd->flags & LOOKUP_RCU) {
591 nd->flags &= ~LOOKUP_RCU;
592 if (!(nd->flags & LOOKUP_ROOT))
593 nd->root.mnt = NULL;
594
595 if (!legitimize_mnt(nd->path.mnt, nd->m_seq)) {
596 rcu_read_unlock();
597 return -ECHILD;
598 }
599 if (unlikely(!lockref_get_not_dead(&dentry->d_lockref))) {
600 rcu_read_unlock();
601 mntput(nd->path.mnt);
602 return -ECHILD;
603 }
604 if (read_seqcount_retry(&dentry->d_seq, nd->seq)) {
605 rcu_read_unlock();
606 dput(dentry);
607 mntput(nd->path.mnt);
608 return -ECHILD;
609 }
610 rcu_read_unlock();
611 }
612
613 if (likely(!(nd->flags & LOOKUP_JUMPED)))
614 return 0;
615
616 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
617 return 0;
618
619 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
620 if (status > 0)
621 return 0;
622
623 if (!status)
624 status = -ESTALE;
625
626 path_put(&nd->path);
627 return status;
628}
629
630static __always_inline void set_root(struct nameidata *nd)
631{
632 if (!nd->root.mnt)
633 get_fs_root(current->fs, &nd->root);
634}
635
636static int link_path_walk(const char *, struct nameidata *);
637
638static __always_inline void set_root_rcu(struct nameidata *nd)
639{
640 if (!nd->root.mnt) {
641 struct fs_struct *fs = current->fs;
642 unsigned seq;
643
644 do {
645 seq = read_seqcount_begin(&fs->seq);
646 nd->root = fs->root;
647 nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
648 } while (read_seqcount_retry(&fs->seq, seq));
649 }
650}
651
652static void path_put_conditional(struct path *path, struct nameidata *nd)
653{
654 dput(path->dentry);
655 if (path->mnt != nd->path.mnt)
656 mntput(path->mnt);
657}
658
659static inline void path_to_nameidata(const struct path *path,
660 struct nameidata *nd)
661{
662 if (!(nd->flags & LOOKUP_RCU)) {
663 dput(nd->path.dentry);
664 if (nd->path.mnt != path->mnt)
665 mntput(nd->path.mnt);
666 }
667 nd->path.mnt = path->mnt;
668 nd->path.dentry = path->dentry;
669}
670
671
672
673
674
675void nd_jump_link(struct nameidata *nd, struct path *path)
676{
677 path_put(&nd->path);
678
679 nd->path = *path;
680 nd->inode = nd->path.dentry->d_inode;
681 nd->flags |= LOOKUP_JUMPED;
682}
683
684static inline void put_link(struct nameidata *nd, struct path *link, void *cookie)
685{
686 struct inode *inode = link->dentry->d_inode;
687 if (inode->i_op->put_link)
688 inode->i_op->put_link(link->dentry, nd, cookie);
689 path_put(link);
690}
691
692int sysctl_protected_symlinks __read_mostly = 0;
693int sysctl_protected_hardlinks __read_mostly = 0;
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711static inline int may_follow_link(struct path *link, struct nameidata *nd)
712{
713 const struct inode *inode;
714 const struct inode *parent;
715
716 if (!sysctl_protected_symlinks)
717 return 0;
718
719
720 inode = link->dentry->d_inode;
721 if (uid_eq(current_cred()->fsuid, inode->i_uid))
722 return 0;
723
724
725 parent = nd->path.dentry->d_inode;
726 if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
727 return 0;
728
729
730 if (uid_eq(parent->i_uid, inode->i_uid))
731 return 0;
732
733 audit_log_link_denied("follow_link", link);
734 path_put_conditional(link, nd);
735 path_put(&nd->path);
736 return -EACCES;
737}
738
739
740
741
742
743
744
745
746
747
748
749
750
751static bool safe_hardlink_source(struct inode *inode)
752{
753 umode_t mode = inode->i_mode;
754
755
756 if (!S_ISREG(mode))
757 return false;
758
759
760 if (mode & S_ISUID)
761 return false;
762
763
764 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
765 return false;
766
767
768 if (inode_permission(inode, MAY_READ | MAY_WRITE))
769 return false;
770
771 return true;
772}
773
774
775
776
777
778
779
780
781
782
783
784
785
786static int may_linkat(struct path *link)
787{
788 const struct cred *cred;
789 struct inode *inode;
790
791 if (!sysctl_protected_hardlinks)
792 return 0;
793
794 cred = current_cred();
795 inode = link->dentry->d_inode;
796
797
798
799
800 if (uid_eq(cred->fsuid, inode->i_uid) || safe_hardlink_source(inode) ||
801 capable(CAP_FOWNER))
802 return 0;
803
804 audit_log_link_denied("linkat", link);
805 return -EPERM;
806}
807
808static __always_inline int
809follow_link(struct path *link, struct nameidata *nd, void **p)
810{
811 struct dentry *dentry = link->dentry;
812 int error;
813 char *s;
814
815 BUG_ON(nd->flags & LOOKUP_RCU);
816
817 if (link->mnt == nd->path.mnt)
818 mntget(link->mnt);
819
820 error = -ELOOP;
821 if (unlikely(current->total_link_count >= 40))
822 goto out_put_nd_path;
823
824 cond_resched();
825 current->total_link_count++;
826
827 touch_atime(link);
828 nd_set_link(nd, NULL);
829
830 error = security_inode_follow_link(link->dentry, nd);
831 if (error)
832 goto out_put_nd_path;
833
834 nd->last_type = LAST_BIND;
835 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
836 error = PTR_ERR(*p);
837 if (IS_ERR(*p))
838 goto out_put_nd_path;
839
840 error = 0;
841 s = nd_get_link(nd);
842 if (s) {
843 if (unlikely(IS_ERR(s))) {
844 path_put(&nd->path);
845 put_link(nd, link, *p);
846 return PTR_ERR(s);
847 }
848 if (*s == '/') {
849 set_root(nd);
850 path_put(&nd->path);
851 nd->path = nd->root;
852 path_get(&nd->root);
853 nd->flags |= LOOKUP_JUMPED;
854 }
855 nd->inode = nd->path.dentry->d_inode;
856 error = link_path_walk(s, nd);
857 if (unlikely(error))
858 put_link(nd, link, *p);
859 }
860
861 return error;
862
863out_put_nd_path:
864 *p = NULL;
865 path_put(&nd->path);
866 path_put(link);
867 return error;
868}
869
870static int follow_up_rcu(struct path *path)
871{
872 struct mount *mnt = real_mount(path->mnt);
873 struct mount *parent;
874 struct dentry *mountpoint;
875
876 parent = mnt->mnt_parent;
877 if (&parent->mnt == path->mnt)
878 return 0;
879 mountpoint = mnt->mnt_mountpoint;
880 path->dentry = mountpoint;
881 path->mnt = &parent->mnt;
882 return 1;
883}
884
885
886
887
888
889
890
891
892
893
894
895int follow_up(struct path *path)
896{
897 struct mount *mnt = real_mount(path->mnt);
898 struct mount *parent;
899 struct dentry *mountpoint;
900
901 read_seqlock_excl(&mount_lock);
902 parent = mnt->mnt_parent;
903 if (parent == mnt) {
904 read_sequnlock_excl(&mount_lock);
905 return 0;
906 }
907 mntget(&parent->mnt);
908 mountpoint = dget(mnt->mnt_mountpoint);
909 read_sequnlock_excl(&mount_lock);
910 dput(path->dentry);
911 path->dentry = mountpoint;
912 mntput(path->mnt);
913 path->mnt = &parent->mnt;
914 return 1;
915}
916
917
918
919
920
921
922static int follow_automount(struct path *path, unsigned flags,
923 bool *need_mntput)
924{
925 struct vfsmount *mnt;
926 int err;
927
928 if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
929 return -EREMOTE;
930
931
932
933
934
935
936
937
938
939
940
941
942 if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
943 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
944 path->dentry->d_inode)
945 return -EISDIR;
946
947 current->total_link_count++;
948 if (current->total_link_count >= 40)
949 return -ELOOP;
950
951 mnt = path->dentry->d_op->d_automount(path);
952 if (IS_ERR(mnt)) {
953
954
955
956
957
958
959
960
961
962 if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT))
963 return -EREMOTE;
964 return PTR_ERR(mnt);
965 }
966
967 if (!mnt)
968 return 0;
969
970 if (!*need_mntput) {
971
972 mntget(path->mnt);
973 *need_mntput = true;
974 }
975 err = finish_automount(mnt, path);
976
977 switch (err) {
978 case -EBUSY:
979
980 return 0;
981 case 0:
982 path_put(path);
983 path->mnt = mnt;
984 path->dentry = dget(mnt->mnt_root);
985 return 0;
986 default:
987 return err;
988 }
989
990}
991
992
993
994
995
996
997
998
999
1000
1001
1002static int follow_managed(struct path *path, unsigned flags)
1003{
1004 struct vfsmount *mnt = path->mnt;
1005 unsigned managed;
1006 bool need_mntput = false;
1007 int ret = 0;
1008
1009
1010
1011
1012 while (managed = ACCESS_ONCE(path->dentry->d_flags),
1013 managed &= DCACHE_MANAGED_DENTRY,
1014 unlikely(managed != 0)) {
1015
1016
1017 if (managed & DCACHE_MANAGE_TRANSIT) {
1018 BUG_ON(!path->dentry->d_op);
1019 BUG_ON(!path->dentry->d_op->d_manage);
1020 ret = path->dentry->d_op->d_manage(path->dentry, false);
1021 if (ret < 0)
1022 break;
1023 }
1024
1025
1026 if (managed & DCACHE_MOUNTED) {
1027 struct vfsmount *mounted = lookup_mnt(path);
1028 if (mounted) {
1029 dput(path->dentry);
1030 if (need_mntput)
1031 mntput(path->mnt);
1032 path->mnt = mounted;
1033 path->dentry = dget(mounted->mnt_root);
1034 need_mntput = true;
1035 continue;
1036 }
1037
1038
1039
1040
1041
1042 }
1043
1044
1045 if (managed & DCACHE_NEED_AUTOMOUNT) {
1046 ret = follow_automount(path, flags, &need_mntput);
1047 if (ret < 0)
1048 break;
1049 continue;
1050 }
1051
1052
1053 break;
1054 }
1055
1056 if (need_mntput && path->mnt == mnt)
1057 mntput(path->mnt);
1058 if (ret == -EISDIR)
1059 ret = 0;
1060 return ret < 0 ? ret : need_mntput;
1061}
1062
1063int follow_down_one(struct path *path)
1064{
1065 struct vfsmount *mounted;
1066
1067 mounted = lookup_mnt(path);
1068 if (mounted) {
1069 dput(path->dentry);
1070 mntput(path->mnt);
1071 path->mnt = mounted;
1072 path->dentry = dget(mounted->mnt_root);
1073 return 1;
1074 }
1075 return 0;
1076}
1077
1078static inline bool managed_dentry_might_block(struct dentry *dentry)
1079{
1080 return (dentry->d_flags & DCACHE_MANAGE_TRANSIT &&
1081 dentry->d_op->d_manage(dentry, true) < 0);
1082}
1083
1084
1085
1086
1087
1088static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1089 struct inode **inode)
1090{
1091 for (;;) {
1092 struct mount *mounted;
1093
1094
1095
1096
1097 if (unlikely(managed_dentry_might_block(path->dentry)))
1098 return false;
1099
1100 if (!d_mountpoint(path->dentry))
1101 break;
1102
1103 mounted = __lookup_mnt(path->mnt, path->dentry);
1104 if (!mounted)
1105 break;
1106 path->mnt = &mounted->mnt;
1107 path->dentry = mounted->mnt.mnt_root;
1108 nd->flags |= LOOKUP_JUMPED;
1109 nd->seq = read_seqcount_begin(&path->dentry->d_seq);
1110
1111
1112
1113
1114
1115 *inode = path->dentry->d_inode;
1116 }
1117 return true;
1118}
1119
1120static void follow_mount_rcu(struct nameidata *nd)
1121{
1122 while (d_mountpoint(nd->path.dentry)) {
1123 struct mount *mounted;
1124 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
1125 if (!mounted)
1126 break;
1127 nd->path.mnt = &mounted->mnt;
1128 nd->path.dentry = mounted->mnt.mnt_root;
1129 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
1130 }
1131}
1132
1133static int follow_dotdot_rcu(struct nameidata *nd)
1134{
1135 set_root_rcu(nd);
1136
1137 while (1) {
1138 if (nd->path.dentry == nd->root.dentry &&
1139 nd->path.mnt == nd->root.mnt) {
1140 break;
1141 }
1142 if (nd->path.dentry != nd->path.mnt->mnt_root) {
1143 struct dentry *old = nd->path.dentry;
1144 struct dentry *parent = old->d_parent;
1145 unsigned seq;
1146
1147 seq = read_seqcount_begin(&parent->d_seq);
1148 if (read_seqcount_retry(&old->d_seq, nd->seq))
1149 goto failed;
1150 nd->path.dentry = parent;
1151 nd->seq = seq;
1152 break;
1153 }
1154 if (!follow_up_rcu(&nd->path))
1155 break;
1156 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
1157 }
1158 follow_mount_rcu(nd);
1159 nd->inode = nd->path.dentry->d_inode;
1160 return 0;
1161
1162failed:
1163 nd->flags &= ~LOOKUP_RCU;
1164 if (!(nd->flags & LOOKUP_ROOT))
1165 nd->root.mnt = NULL;
1166 rcu_read_unlock();
1167 return -ECHILD;
1168}
1169
1170
1171
1172
1173
1174
1175int follow_down(struct path *path)
1176{
1177 unsigned managed;
1178 int ret;
1179
1180 while (managed = ACCESS_ONCE(path->dentry->d_flags),
1181 unlikely(managed & DCACHE_MANAGED_DENTRY)) {
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192 if (managed & DCACHE_MANAGE_TRANSIT) {
1193 BUG_ON(!path->dentry->d_op);
1194 BUG_ON(!path->dentry->d_op->d_manage);
1195 ret = path->dentry->d_op->d_manage(
1196 path->dentry, false);
1197 if (ret < 0)
1198 return ret == -EISDIR ? 0 : ret;
1199 }
1200
1201
1202 if (managed & DCACHE_MOUNTED) {
1203 struct vfsmount *mounted = lookup_mnt(path);
1204 if (!mounted)
1205 break;
1206 dput(path->dentry);
1207 mntput(path->mnt);
1208 path->mnt = mounted;
1209 path->dentry = dget(mounted->mnt_root);
1210 continue;
1211 }
1212
1213
1214 break;
1215 }
1216 return 0;
1217}
1218
1219
1220
1221
1222static void follow_mount(struct path *path)
1223{
1224 while (d_mountpoint(path->dentry)) {
1225 struct vfsmount *mounted = lookup_mnt(path);
1226 if (!mounted)
1227 break;
1228 dput(path->dentry);
1229 mntput(path->mnt);
1230 path->mnt = mounted;
1231 path->dentry = dget(mounted->mnt_root);
1232 }
1233}
1234
1235static void follow_dotdot(struct nameidata *nd)
1236{
1237 set_root(nd);
1238
1239 while(1) {
1240 struct dentry *old = nd->path.dentry;
1241
1242 if (nd->path.dentry == nd->root.dentry &&
1243 nd->path.mnt == nd->root.mnt) {
1244 break;
1245 }
1246 if (nd->path.dentry != nd->path.mnt->mnt_root) {
1247
1248 nd->path.dentry = dget_parent(nd->path.dentry);
1249 dput(old);
1250 break;
1251 }
1252 if (!follow_up(&nd->path))
1253 break;
1254 }
1255 follow_mount(&nd->path);
1256 nd->inode = nd->path.dentry->d_inode;
1257}
1258
1259
1260
1261
1262
1263
1264
1265
1266static struct dentry *lookup_dcache(struct qstr *name, struct dentry *dir,
1267 unsigned int flags, bool *need_lookup)
1268{
1269 struct dentry *dentry;
1270 int error;
1271
1272 *need_lookup = false;
1273 dentry = d_lookup(dir, name);
1274 if (dentry) {
1275 if (dentry->d_flags & DCACHE_OP_REVALIDATE) {
1276 error = d_revalidate(dentry, flags);
1277 if (unlikely(error <= 0)) {
1278 if (error < 0) {
1279 dput(dentry);
1280 return ERR_PTR(error);
1281 } else if (!d_invalidate(dentry)) {
1282 dput(dentry);
1283 dentry = NULL;
1284 }
1285 }
1286 }
1287 }
1288
1289 if (!dentry) {
1290 dentry = d_alloc(dir, name);
1291 if (unlikely(!dentry))
1292 return ERR_PTR(-ENOMEM);
1293
1294 *need_lookup = true;
1295 }
1296 return dentry;
1297}
1298
1299
1300
1301
1302
1303
1304
1305static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry,
1306 unsigned int flags)
1307{
1308 struct dentry *old;
1309
1310
1311 if (unlikely(IS_DEADDIR(dir))) {
1312 dput(dentry);
1313 return ERR_PTR(-ENOENT);
1314 }
1315
1316 old = dir->i_op->lookup(dir, dentry, flags);
1317 if (unlikely(old)) {
1318 dput(dentry);
1319 dentry = old;
1320 }
1321 return dentry;
1322}
1323
1324static struct dentry *__lookup_hash(struct qstr *name,
1325 struct dentry *base, unsigned int flags)
1326{
1327 bool need_lookup;
1328 struct dentry *dentry;
1329
1330 dentry = lookup_dcache(name, base, flags, &need_lookup);
1331 if (!need_lookup)
1332 return dentry;
1333
1334 return lookup_real(base->d_inode, dentry, flags);
1335}
1336
1337
1338
1339
1340
1341
1342static int lookup_fast(struct nameidata *nd,
1343 struct path *path, struct inode **inode)
1344{
1345 struct vfsmount *mnt = nd->path.mnt;
1346 struct dentry *dentry, *parent = nd->path.dentry;
1347 int need_reval = 1;
1348 int status = 1;
1349 int err;
1350
1351
1352
1353
1354
1355
1356 if (nd->flags & LOOKUP_RCU) {
1357 unsigned seq;
1358 dentry = __d_lookup_rcu(parent, &nd->last, &seq);
1359 if (!dentry)
1360 goto unlazy;
1361
1362
1363
1364
1365
1366 *inode = dentry->d_inode;
1367 if (read_seqcount_retry(&dentry->d_seq, seq))
1368 return -ECHILD;
1369
1370
1371
1372
1373
1374
1375
1376
1377 if (__read_seqcount_retry(&parent->d_seq, nd->seq))
1378 return -ECHILD;
1379 nd->seq = seq;
1380
1381 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) {
1382 status = d_revalidate(dentry, nd->flags);
1383 if (unlikely(status <= 0)) {
1384 if (status != -ECHILD)
1385 need_reval = 0;
1386 goto unlazy;
1387 }
1388 }
1389 path->mnt = mnt;
1390 path->dentry = dentry;
1391 if (unlikely(!__follow_mount_rcu(nd, path, inode)))
1392 goto unlazy;
1393 if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT))
1394 goto unlazy;
1395 return 0;
1396unlazy:
1397 if (unlazy_walk(nd, dentry))
1398 return -ECHILD;
1399 } else {
1400 dentry = __d_lookup(parent, &nd->last);
1401 }
1402
1403 if (unlikely(!dentry))
1404 goto need_lookup;
1405
1406 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval)
1407 status = d_revalidate(dentry, nd->flags);
1408 if (unlikely(status <= 0)) {
1409 if (status < 0) {
1410 dput(dentry);
1411 return status;
1412 }
1413 if (!d_invalidate(dentry)) {
1414 dput(dentry);
1415 goto need_lookup;
1416 }
1417 }
1418
1419 path->mnt = mnt;
1420 path->dentry = dentry;
1421 err = follow_managed(path, nd->flags);
1422 if (unlikely(err < 0)) {
1423 path_put_conditional(path, nd);
1424 return err;
1425 }
1426 if (err)
1427 nd->flags |= LOOKUP_JUMPED;
1428 *inode = path->dentry->d_inode;
1429 return 0;
1430
1431need_lookup:
1432 return 1;
1433}
1434
1435
1436static int lookup_slow(struct nameidata *nd, struct path *path)
1437{
1438 struct dentry *dentry, *parent;
1439 int err;
1440
1441 parent = nd->path.dentry;
1442 BUG_ON(nd->inode != parent->d_inode);
1443
1444 mutex_lock(&parent->d_inode->i_mutex);
1445 dentry = __lookup_hash(&nd->last, parent, nd->flags);
1446 mutex_unlock(&parent->d_inode->i_mutex);
1447 if (IS_ERR(dentry))
1448 return PTR_ERR(dentry);
1449 path->mnt = nd->path.mnt;
1450 path->dentry = dentry;
1451 err = follow_managed(path, nd->flags);
1452 if (unlikely(err < 0)) {
1453 path_put_conditional(path, nd);
1454 return err;
1455 }
1456 if (err)
1457 nd->flags |= LOOKUP_JUMPED;
1458 return 0;
1459}
1460
1461static inline int may_lookup(struct nameidata *nd)
1462{
1463 if (nd->flags & LOOKUP_RCU) {
1464 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1465 if (err != -ECHILD)
1466 return err;
1467 if (unlazy_walk(nd, NULL))
1468 return -ECHILD;
1469 }
1470 return inode_permission(nd->inode, MAY_EXEC);
1471}
1472
1473static inline int handle_dots(struct nameidata *nd, int type)
1474{
1475 if (type == LAST_DOTDOT) {
1476 if (nd->flags & LOOKUP_RCU) {
1477 if (follow_dotdot_rcu(nd))
1478 return -ECHILD;
1479 } else
1480 follow_dotdot(nd);
1481 }
1482 return 0;
1483}
1484
1485static void terminate_walk(struct nameidata *nd)
1486{
1487 if (!(nd->flags & LOOKUP_RCU)) {
1488 path_put(&nd->path);
1489 } else {
1490 nd->flags &= ~LOOKUP_RCU;
1491 if (!(nd->flags & LOOKUP_ROOT))
1492 nd->root.mnt = NULL;
1493 rcu_read_unlock();
1494 }
1495}
1496
1497
1498
1499
1500
1501
1502
1503static inline int should_follow_link(struct dentry *dentry, int follow)
1504{
1505 return unlikely(d_is_symlink(dentry)) ? follow : 0;
1506}
1507
1508static inline int walk_component(struct nameidata *nd, struct path *path,
1509 int follow)
1510{
1511 struct inode *inode;
1512 int err;
1513
1514
1515
1516
1517
1518 if (unlikely(nd->last_type != LAST_NORM))
1519 return handle_dots(nd, nd->last_type);
1520 err = lookup_fast(nd, path, &inode);
1521 if (unlikely(err)) {
1522 if (err < 0)
1523 goto out_err;
1524
1525 err = lookup_slow(nd, path);
1526 if (err < 0)
1527 goto out_err;
1528
1529 inode = path->dentry->d_inode;
1530 }
1531 err = -ENOENT;
1532 if (!inode)
1533 goto out_path_put;
1534
1535 if (should_follow_link(path->dentry, follow)) {
1536 if (nd->flags & LOOKUP_RCU) {
1537 if (unlikely(unlazy_walk(nd, path->dentry))) {
1538 err = -ECHILD;
1539 goto out_err;
1540 }
1541 }
1542 BUG_ON(inode != path->dentry->d_inode);
1543 return 1;
1544 }
1545 path_to_nameidata(path, nd);
1546 nd->inode = inode;
1547 return 0;
1548
1549out_path_put:
1550 path_to_nameidata(path, nd);
1551out_err:
1552 terminate_walk(nd);
1553 return err;
1554}
1555
1556
1557
1558
1559
1560
1561
1562
1563static inline int nested_symlink(struct path *path, struct nameidata *nd)
1564{
1565 int res;
1566
1567 if (unlikely(current->link_count >= MAX_NESTED_LINKS)) {
1568 path_put_conditional(path, nd);
1569 path_put(&nd->path);
1570 return -ELOOP;
1571 }
1572 BUG_ON(nd->depth >= MAX_NESTED_LINKS);
1573
1574 nd->depth++;
1575 current->link_count++;
1576
1577 do {
1578 struct path link = *path;
1579 void *cookie;
1580
1581 res = follow_link(&link, nd, &cookie);
1582 if (res)
1583 break;
1584 res = walk_component(nd, path, LOOKUP_FOLLOW);
1585 put_link(nd, &link, cookie);
1586 } while (res > 0);
1587
1588 current->link_count--;
1589 nd->depth--;
1590 return res;
1591}
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610#ifdef CONFIG_DCACHE_WORD_ACCESS
1611
1612#include <asm/word-at-a-time.h>
1613
1614#ifdef CONFIG_64BIT
1615
1616static inline unsigned int fold_hash(unsigned long hash)
1617{
1618 hash += hash >> (8*sizeof(int));
1619 return hash;
1620}
1621
1622#else
1623
1624#define fold_hash(x) (x)
1625
1626#endif
1627
1628unsigned int full_name_hash(const unsigned char *name, unsigned int len)
1629{
1630 unsigned long a, mask;
1631 unsigned long hash = 0;
1632
1633 for (;;) {
1634 a = load_unaligned_zeropad(name);
1635 if (len < sizeof(unsigned long))
1636 break;
1637 hash += a;
1638 hash *= 9;
1639 name += sizeof(unsigned long);
1640 len -= sizeof(unsigned long);
1641 if (!len)
1642 goto done;
1643 }
1644 mask = bytemask_from_count(len);
1645 hash += mask & a;
1646done:
1647 return fold_hash(hash);
1648}
1649EXPORT_SYMBOL(full_name_hash);
1650
1651
1652
1653
1654
1655static inline unsigned long hash_name(const char *name, unsigned int *hashp)
1656{
1657 unsigned long a, b, adata, bdata, mask, hash, len;
1658 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1659
1660 hash = a = 0;
1661 len = -sizeof(unsigned long);
1662 do {
1663 hash = (hash + a) * 9;
1664 len += sizeof(unsigned long);
1665 a = load_unaligned_zeropad(name+len);
1666 b = a ^ REPEAT_BYTE('/');
1667 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
1668
1669 adata = prep_zero_mask(a, adata, &constants);
1670 bdata = prep_zero_mask(b, bdata, &constants);
1671
1672 mask = create_zero_mask(adata | bdata);
1673
1674 hash += a & zero_bytemask(mask);
1675 *hashp = fold_hash(hash);
1676
1677 return len + find_zero(mask);
1678}
1679
1680#else
1681
1682unsigned int full_name_hash(const unsigned char *name, unsigned int len)
1683{
1684 unsigned long hash = init_name_hash();
1685 while (len--)
1686 hash = partial_name_hash(*name++, hash);
1687 return end_name_hash(hash);
1688}
1689EXPORT_SYMBOL(full_name_hash);
1690
1691
1692
1693
1694
1695static inline unsigned long hash_name(const char *name, unsigned int *hashp)
1696{
1697 unsigned long hash = init_name_hash();
1698 unsigned long len = 0, c;
1699
1700 c = (unsigned char)*name;
1701 do {
1702 len++;
1703 hash = partial_name_hash(c, hash);
1704 c = (unsigned char)name[len];
1705 } while (c && c != '/');
1706 *hashp = end_name_hash(hash);
1707 return len;
1708}
1709
1710#endif
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720static int link_path_walk(const char *name, struct nameidata *nd)
1721{
1722 struct path next;
1723 int err;
1724
1725 while (*name=='/')
1726 name++;
1727 if (!*name)
1728 return 0;
1729
1730
1731 for(;;) {
1732 struct qstr this;
1733 long len;
1734 int type;
1735
1736 err = may_lookup(nd);
1737 if (err)
1738 break;
1739
1740 len = hash_name(name, &this.hash);
1741 this.name = name;
1742 this.len = len;
1743
1744 type = LAST_NORM;
1745 if (name[0] == '.') switch (len) {
1746 case 2:
1747 if (name[1] == '.') {
1748 type = LAST_DOTDOT;
1749 nd->flags |= LOOKUP_JUMPED;
1750 }
1751 break;
1752 case 1:
1753 type = LAST_DOT;
1754 }
1755 if (likely(type == LAST_NORM)) {
1756 struct dentry *parent = nd->path.dentry;
1757 nd->flags &= ~LOOKUP_JUMPED;
1758 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
1759 err = parent->d_op->d_hash(parent, &this);
1760 if (err < 0)
1761 break;
1762 }
1763 }
1764
1765 nd->last = this;
1766 nd->last_type = type;
1767
1768 if (!name[len])
1769 return 0;
1770
1771
1772
1773
1774 do {
1775 len++;
1776 } while (unlikely(name[len] == '/'));
1777 if (!name[len])
1778 return 0;
1779
1780 name += len;
1781
1782 err = walk_component(nd, &next, LOOKUP_FOLLOW);
1783 if (err < 0)
1784 return err;
1785
1786 if (err) {
1787 err = nested_symlink(&next, nd);
1788 if (err)
1789 return err;
1790 }
1791 if (!d_is_directory(nd->path.dentry)) {
1792 err = -ENOTDIR;
1793 break;
1794 }
1795 }
1796 terminate_walk(nd);
1797 return err;
1798}
1799
1800static int path_init(int dfd, const char *name, unsigned int flags,
1801 struct nameidata *nd, struct file **fp)
1802{
1803 int retval = 0;
1804
1805 nd->last_type = LAST_ROOT;
1806 nd->flags = flags | LOOKUP_JUMPED;
1807 nd->depth = 0;
1808 if (flags & LOOKUP_ROOT) {
1809 struct dentry *root = nd->root.dentry;
1810 struct inode *inode = root->d_inode;
1811 if (*name) {
1812 if (!d_is_directory(root))
1813 return -ENOTDIR;
1814 retval = inode_permission(inode, MAY_EXEC);
1815 if (retval)
1816 return retval;
1817 }
1818 nd->path = nd->root;
1819 nd->inode = inode;
1820 if (flags & LOOKUP_RCU) {
1821 rcu_read_lock();
1822 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
1823 nd->m_seq = read_seqbegin(&mount_lock);
1824 } else {
1825 path_get(&nd->path);
1826 }
1827 return 0;
1828 }
1829
1830 nd->root.mnt = NULL;
1831
1832 nd->m_seq = read_seqbegin(&mount_lock);
1833 if (*name=='/') {
1834 if (flags & LOOKUP_RCU) {
1835 rcu_read_lock();
1836 set_root_rcu(nd);
1837 } else {
1838 set_root(nd);
1839 path_get(&nd->root);
1840 }
1841 nd->path = nd->root;
1842 } else if (dfd == AT_FDCWD) {
1843 if (flags & LOOKUP_RCU) {
1844 struct fs_struct *fs = current->fs;
1845 unsigned seq;
1846
1847 rcu_read_lock();
1848
1849 do {
1850 seq = read_seqcount_begin(&fs->seq);
1851 nd->path = fs->pwd;
1852 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
1853 } while (read_seqcount_retry(&fs->seq, seq));
1854 } else {
1855 get_fs_pwd(current->fs, &nd->path);
1856 }
1857 } else {
1858
1859 struct fd f = fdget_raw(dfd);
1860 struct dentry *dentry;
1861
1862 if (!f.file)
1863 return -EBADF;
1864
1865 dentry = f.file->f_path.dentry;
1866
1867 if (*name) {
1868 if (!d_is_directory(dentry)) {
1869 fdput(f);
1870 return -ENOTDIR;
1871 }
1872 }
1873
1874 nd->path = f.file->f_path;
1875 if (flags & LOOKUP_RCU) {
1876 if (f.need_put)
1877 *fp = f.file;
1878 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
1879 rcu_read_lock();
1880 } else {
1881 path_get(&nd->path);
1882 fdput(f);
1883 }
1884 }
1885
1886 nd->inode = nd->path.dentry->d_inode;
1887 return 0;
1888}
1889
1890static inline int lookup_last(struct nameidata *nd, struct path *path)
1891{
1892 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
1893 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
1894
1895 nd->flags &= ~LOOKUP_PARENT;
1896 return walk_component(nd, path, nd->flags & LOOKUP_FOLLOW);
1897}
1898
1899
1900static int path_lookupat(int dfd, const char *name,
1901 unsigned int flags, struct nameidata *nd)
1902{
1903 struct file *base = NULL;
1904 struct path path;
1905 int err;
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921 err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base);
1922
1923 if (unlikely(err))
1924 return err;
1925
1926 current->total_link_count = 0;
1927 err = link_path_walk(name, nd);
1928
1929 if (!err && !(flags & LOOKUP_PARENT)) {
1930 err = lookup_last(nd, &path);
1931 while (err > 0) {
1932 void *cookie;
1933 struct path link = path;
1934 err = may_follow_link(&link, nd);
1935 if (unlikely(err))
1936 break;
1937 nd->flags |= LOOKUP_PARENT;
1938 err = follow_link(&link, nd, &cookie);
1939 if (err)
1940 break;
1941 err = lookup_last(nd, &path);
1942 put_link(nd, &link, cookie);
1943 }
1944 }
1945
1946 if (!err)
1947 err = complete_walk(nd);
1948
1949 if (!err && nd->flags & LOOKUP_DIRECTORY) {
1950 if (!d_is_directory(nd->path.dentry)) {
1951 path_put(&nd->path);
1952 err = -ENOTDIR;
1953 }
1954 }
1955
1956 if (base)
1957 fput(base);
1958
1959 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
1960 path_put(&nd->root);
1961 nd->root.mnt = NULL;
1962 }
1963 return err;
1964}
1965
1966static int filename_lookup(int dfd, struct filename *name,
1967 unsigned int flags, struct nameidata *nd)
1968{
1969 int retval = path_lookupat(dfd, name->name, flags | LOOKUP_RCU, nd);
1970 if (unlikely(retval == -ECHILD))
1971 retval = path_lookupat(dfd, name->name, flags, nd);
1972 if (unlikely(retval == -ESTALE))
1973 retval = path_lookupat(dfd, name->name,
1974 flags | LOOKUP_REVAL, nd);
1975
1976 if (likely(!retval))
1977 audit_inode(name, nd->path.dentry, flags & LOOKUP_PARENT);
1978 return retval;
1979}
1980
1981static int do_path_lookup(int dfd, const char *name,
1982 unsigned int flags, struct nameidata *nd)
1983{
1984 struct filename filename = { .name = name };
1985
1986 return filename_lookup(dfd, &filename, flags, nd);
1987}
1988
1989
1990struct dentry *kern_path_locked(const char *name, struct path *path)
1991{
1992 struct nameidata nd;
1993 struct dentry *d;
1994 int err = do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, &nd);
1995 if (err)
1996 return ERR_PTR(err);
1997 if (nd.last_type != LAST_NORM) {
1998 path_put(&nd.path);
1999 return ERR_PTR(-EINVAL);
2000 }
2001 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2002 d = __lookup_hash(&nd.last, nd.path.dentry, 0);
2003 if (IS_ERR(d)) {
2004 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
2005 path_put(&nd.path);
2006 return d;
2007 }
2008 *path = nd.path;
2009 return d;
2010}
2011
2012int kern_path(const char *name, unsigned int flags, struct path *path)
2013{
2014 struct nameidata nd;
2015 int res = do_path_lookup(AT_FDCWD, name, flags, &nd);
2016 if (!res)
2017 *path = nd.path;
2018 return res;
2019}
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
2030 const char *name, unsigned int flags,
2031 struct path *path)
2032{
2033 struct nameidata nd;
2034 int err;
2035 nd.root.dentry = dentry;
2036 nd.root.mnt = mnt;
2037 BUG_ON(flags & LOOKUP_PARENT);
2038
2039 err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd);
2040 if (!err)
2041 *path = nd.path;
2042 return err;
2043}
2044
2045
2046
2047
2048
2049
2050static struct dentry *lookup_hash(struct nameidata *nd)
2051{
2052 return __lookup_hash(&nd->last, nd->path.dentry, nd->flags);
2053}
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
2067{
2068 struct qstr this;
2069 unsigned int c;
2070 int err;
2071
2072 WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));
2073
2074 this.name = name;
2075 this.len = len;
2076 this.hash = full_name_hash(name, len);
2077 if (!len)
2078 return ERR_PTR(-EACCES);
2079
2080 if (unlikely(name[0] == '.')) {
2081 if (len < 2 || (len == 2 && name[1] == '.'))
2082 return ERR_PTR(-EACCES);
2083 }
2084
2085 while (len--) {
2086 c = *(const unsigned char *)name++;
2087 if (c == '/' || c == '\0')
2088 return ERR_PTR(-EACCES);
2089 }
2090
2091
2092
2093
2094 if (base->d_flags & DCACHE_OP_HASH) {
2095 int err = base->d_op->d_hash(base, &this);
2096 if (err < 0)
2097 return ERR_PTR(err);
2098 }
2099
2100 err = inode_permission(base->d_inode, MAY_EXEC);
2101 if (err)
2102 return ERR_PTR(err);
2103
2104 return __lookup_hash(&this, base, 0);
2105}
2106
2107int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
2108 struct path *path, int *empty)
2109{
2110 struct nameidata nd;
2111 struct filename *tmp = getname_flags(name, flags, empty);
2112 int err = PTR_ERR(tmp);
2113 if (!IS_ERR(tmp)) {
2114
2115 BUG_ON(flags & LOOKUP_PARENT);
2116
2117 err = filename_lookup(dfd, tmp, flags, &nd);
2118 putname(tmp);
2119 if (!err)
2120 *path = nd.path;
2121 }
2122 return err;
2123}
2124
2125int user_path_at(int dfd, const char __user *name, unsigned flags,
2126 struct path *path)
2127{
2128 return user_path_at_empty(dfd, name, flags, path, NULL);
2129}
2130
2131
2132
2133
2134
2135
2136
2137static struct filename *
2138user_path_parent(int dfd, const char __user *path, struct nameidata *nd,
2139 unsigned int flags)
2140{
2141 struct filename *s = getname(path);
2142 int error;
2143
2144
2145 flags &= LOOKUP_REVAL;
2146
2147 if (IS_ERR(s))
2148 return s;
2149
2150 error = filename_lookup(dfd, s, flags | LOOKUP_PARENT, nd);
2151 if (error) {
2152 putname(s);
2153 return ERR_PTR(error);
2154 }
2155
2156 return s;
2157}
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186static int
2187mountpoint_last(struct nameidata *nd, struct path *path)
2188{
2189 int error = 0;
2190 struct dentry *dentry;
2191 struct dentry *dir = nd->path.dentry;
2192
2193
2194 if (nd->flags & LOOKUP_RCU) {
2195 if (unlazy_walk(nd, NULL)) {
2196 error = -ECHILD;
2197 goto out;
2198 }
2199 }
2200
2201 nd->flags &= ~LOOKUP_PARENT;
2202
2203 if (unlikely(nd->last_type != LAST_NORM)) {
2204 error = handle_dots(nd, nd->last_type);
2205 if (error)
2206 goto out;
2207 dentry = dget(nd->path.dentry);
2208 goto done;
2209 }
2210
2211 mutex_lock(&dir->d_inode->i_mutex);
2212 dentry = d_lookup(dir, &nd->last);
2213 if (!dentry) {
2214
2215
2216
2217
2218
2219 dentry = d_alloc(dir, &nd->last);
2220 if (!dentry) {
2221 error = -ENOMEM;
2222 mutex_unlock(&dir->d_inode->i_mutex);
2223 goto out;
2224 }
2225 dentry = lookup_real(dir->d_inode, dentry, nd->flags);
2226 error = PTR_ERR(dentry);
2227 if (IS_ERR(dentry)) {
2228 mutex_unlock(&dir->d_inode->i_mutex);
2229 goto out;
2230 }
2231 }
2232 mutex_unlock(&dir->d_inode->i_mutex);
2233
2234done:
2235 if (!dentry->d_inode) {
2236 error = -ENOENT;
2237 dput(dentry);
2238 goto out;
2239 }
2240 path->dentry = dentry;
2241 path->mnt = mntget(nd->path.mnt);
2242 if (should_follow_link(dentry, nd->flags & LOOKUP_FOLLOW))
2243 return 1;
2244 follow_mount(path);
2245 error = 0;
2246out:
2247 terminate_walk(nd);
2248 return error;
2249}
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261static int
2262path_mountpoint(int dfd, const char *name, struct path *path, unsigned int flags)
2263{
2264 struct file *base = NULL;
2265 struct nameidata nd;
2266 int err;
2267
2268 err = path_init(dfd, name, flags | LOOKUP_PARENT, &nd, &base);
2269 if (unlikely(err))
2270 return err;
2271
2272 current->total_link_count = 0;
2273 err = link_path_walk(name, &nd);
2274 if (err)
2275 goto out;
2276
2277 err = mountpoint_last(&nd, path);
2278 while (err > 0) {
2279 void *cookie;
2280 struct path link = *path;
2281 err = may_follow_link(&link, &nd);
2282 if (unlikely(err))
2283 break;
2284 nd.flags |= LOOKUP_PARENT;
2285 err = follow_link(&link, &nd, &cookie);
2286 if (err)
2287 break;
2288 err = mountpoint_last(&nd, path);
2289 put_link(&nd, &link, cookie);
2290 }
2291out:
2292 if (base)
2293 fput(base);
2294
2295 if (nd.root.mnt && !(nd.flags & LOOKUP_ROOT))
2296 path_put(&nd.root);
2297
2298 return err;
2299}
2300
2301static int
2302filename_mountpoint(int dfd, struct filename *s, struct path *path,
2303 unsigned int flags)
2304{
2305 int error = path_mountpoint(dfd, s->name, path, flags | LOOKUP_RCU);
2306 if (unlikely(error == -ECHILD))
2307 error = path_mountpoint(dfd, s->name, path, flags);
2308 if (unlikely(error == -ESTALE))
2309 error = path_mountpoint(dfd, s->name, path, flags | LOOKUP_REVAL);
2310 if (likely(!error))
2311 audit_inode(s, path->dentry, 0);
2312 return error;
2313}
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329int
2330user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags,
2331 struct path *path)
2332{
2333 struct filename *s = getname(name);
2334 int error;
2335 if (IS_ERR(s))
2336 return PTR_ERR(s);
2337 error = filename_mountpoint(dfd, s, path, flags);
2338 putname(s);
2339 return error;
2340}
2341
2342int
2343kern_path_mountpoint(int dfd, const char *name, struct path *path,
2344 unsigned int flags)
2345{
2346 struct filename s = {.name = name};
2347 return filename_mountpoint(dfd, &s, path, flags);
2348}
2349EXPORT_SYMBOL(kern_path_mountpoint);
2350
2351
2352
2353
2354
2355static inline int check_sticky(struct inode *dir, struct inode *inode)
2356{
2357 kuid_t fsuid = current_fsuid();
2358
2359 if (!(dir->i_mode & S_ISVTX))
2360 return 0;
2361 if (uid_eq(inode->i_uid, fsuid))
2362 return 0;
2363 if (uid_eq(dir->i_uid, fsuid))
2364 return 0;
2365 return !inode_capable(inode, CAP_FOWNER);
2366}
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387static int may_delete(struct inode *dir, struct dentry *victim, bool isdir)
2388{
2389 struct inode *inode = victim->d_inode;
2390 int error;
2391
2392 if (d_is_negative(victim))
2393 return -ENOENT;
2394 BUG_ON(!inode);
2395
2396 BUG_ON(victim->d_parent->d_inode != dir);
2397 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2398
2399 error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
2400 if (error)
2401 return error;
2402 if (IS_APPEND(dir))
2403 return -EPERM;
2404
2405 if (check_sticky(dir, inode) || IS_APPEND(inode) ||
2406 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode))
2407 return -EPERM;
2408 if (isdir) {
2409 if (!d_is_directory(victim) && !d_is_autodir(victim))
2410 return -ENOTDIR;
2411 if (IS_ROOT(victim))
2412 return -EBUSY;
2413 } else if (d_is_directory(victim) || d_is_autodir(victim))
2414 return -EISDIR;
2415 if (IS_DEADDIR(dir))
2416 return -ENOENT;
2417 if (victim->d_flags & DCACHE_NFSFS_RENAMED)
2418 return -EBUSY;
2419 return 0;
2420}
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430static inline int may_create(struct inode *dir, struct dentry *child)
2431{
2432 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
2433 if (child->d_inode)
2434 return -EEXIST;
2435 if (IS_DEADDIR(dir))
2436 return -ENOENT;
2437 return inode_permission(dir, MAY_WRITE | MAY_EXEC);
2438}
2439
2440
2441
2442
2443struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
2444{
2445 struct dentry *p;
2446
2447 if (p1 == p2) {
2448 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
2449 return NULL;
2450 }
2451
2452 mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
2453
2454 p = d_ancestor(p2, p1);
2455 if (p) {
2456 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT);
2457 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD);
2458 return p;
2459 }
2460
2461 p = d_ancestor(p1, p2);
2462 if (p) {
2463 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
2464 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
2465 return p;
2466 }
2467
2468 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
2469 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
2470 return NULL;
2471}
2472
2473void unlock_rename(struct dentry *p1, struct dentry *p2)
2474{
2475 mutex_unlock(&p1->d_inode->i_mutex);
2476 if (p1 != p2) {
2477 mutex_unlock(&p2->d_inode->i_mutex);
2478 mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
2479 }
2480}
2481
2482int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
2483 bool want_excl)
2484{
2485 int error = may_create(dir, dentry);
2486 if (error)
2487 return error;
2488
2489 if (!dir->i_op->create)
2490 return -EACCES;
2491 mode &= S_IALLUGO;
2492 mode |= S_IFREG;
2493 error = security_inode_create(dir, dentry, mode);
2494 if (error)
2495 return error;
2496 error = dir->i_op->create(dir, dentry, mode, want_excl);
2497 if (!error)
2498 fsnotify_create(dir, dentry);
2499 return error;
2500}
2501
2502static int may_open(struct path *path, int acc_mode, int flag)
2503{
2504 struct dentry *dentry = path->dentry;
2505 struct inode *inode = dentry->d_inode;
2506 int error;
2507
2508
2509 if (!acc_mode)
2510 return 0;
2511
2512 if (!inode)
2513 return -ENOENT;
2514
2515 switch (inode->i_mode & S_IFMT) {
2516 case S_IFLNK:
2517 return -ELOOP;
2518 case S_IFDIR:
2519 if (acc_mode & MAY_WRITE)
2520 return -EISDIR;
2521 break;
2522 case S_IFBLK:
2523 case S_IFCHR:
2524 if (path->mnt->mnt_flags & MNT_NODEV)
2525 return -EACCES;
2526
2527 case S_IFIFO:
2528 case S_IFSOCK:
2529 flag &= ~O_TRUNC;
2530 break;
2531 }
2532
2533 error = inode_permission(inode, acc_mode);
2534 if (error)
2535 return error;
2536
2537
2538
2539
2540 if (IS_APPEND(inode)) {
2541 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
2542 return -EPERM;
2543 if (flag & O_TRUNC)
2544 return -EPERM;
2545 }
2546
2547
2548 if (flag & O_NOATIME && !inode_owner_or_capable(inode))
2549 return -EPERM;
2550
2551 return 0;
2552}
2553
2554static int handle_truncate(struct file *filp)
2555{
2556 struct path *path = &filp->f_path;
2557 struct inode *inode = path->dentry->d_inode;
2558 int error = get_write_access(inode);
2559 if (error)
2560 return error;
2561
2562
2563
2564 error = locks_verify_locked(inode);
2565 if (!error)
2566 error = security_path_truncate(path);
2567 if (!error) {
2568 error = do_truncate(path->dentry, 0,
2569 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
2570 filp);
2571 }
2572 put_write_access(inode);
2573 return error;
2574}
2575
2576static inline int open_to_namei_flags(int flag)
2577{
2578 if ((flag & O_ACCMODE) == 3)
2579 flag--;
2580 return flag;
2581}
2582
2583static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode)
2584{
2585 int error = security_path_mknod(dir, dentry, mode, 0);
2586 if (error)
2587 return error;
2588
2589 error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
2590 if (error)
2591 return error;
2592
2593 return security_inode_create(dir->dentry->d_inode, dentry, mode);
2594}
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609static int atomic_open(struct nameidata *nd, struct dentry *dentry,
2610 struct path *path, struct file *file,
2611 const struct open_flags *op,
2612 bool got_write, bool need_lookup,
2613 int *opened)
2614{
2615 struct inode *dir = nd->path.dentry->d_inode;
2616 unsigned open_flag = open_to_namei_flags(op->open_flag);
2617 umode_t mode;
2618 int error;
2619 int acc_mode;
2620 int create_error = 0;
2621 struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
2622 bool excl;
2623
2624 BUG_ON(dentry->d_inode);
2625
2626
2627 if (unlikely(IS_DEADDIR(dir))) {
2628 error = -ENOENT;
2629 goto out;
2630 }
2631
2632 mode = op->mode;
2633 if ((open_flag & O_CREAT) && !IS_POSIXACL(dir))
2634 mode &= ~current_umask();
2635
2636 excl = (open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT);
2637 if (excl)
2638 open_flag &= ~O_TRUNC;
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649 if (((open_flag & (O_CREAT | O_TRUNC)) ||
2650 (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) {
2651 if (!(open_flag & O_CREAT)) {
2652
2653
2654
2655
2656 goto no_open;
2657 } else if (open_flag & (O_EXCL | O_TRUNC)) {
2658
2659 create_error = -EROFS;
2660 goto no_open;
2661 } else {
2662
2663 create_error = -EROFS;
2664 open_flag &= ~O_CREAT;
2665 }
2666 }
2667
2668 if (open_flag & O_CREAT) {
2669 error = may_o_create(&nd->path, dentry, mode);
2670 if (error) {
2671 create_error = error;
2672 if (open_flag & O_EXCL)
2673 goto no_open;
2674 open_flag &= ~O_CREAT;
2675 }
2676 }
2677
2678 if (nd->flags & LOOKUP_DIRECTORY)
2679 open_flag |= O_DIRECTORY;
2680
2681 file->f_path.dentry = DENTRY_NOT_SET;
2682 file->f_path.mnt = nd->path.mnt;
2683 error = dir->i_op->atomic_open(dir, dentry, file, open_flag, mode,
2684 opened);
2685 if (error < 0) {
2686 if (create_error && error == -ENOENT)
2687 error = create_error;
2688 goto out;
2689 }
2690
2691 if (error) {
2692 if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
2693 error = -EIO;
2694 goto out;
2695 }
2696 if (file->f_path.dentry) {
2697 dput(dentry);
2698 dentry = file->f_path.dentry;
2699 }
2700 if (*opened & FILE_CREATED)
2701 fsnotify_create(dir, dentry);
2702 if (!dentry->d_inode) {
2703 WARN_ON(*opened & FILE_CREATED);
2704 if (create_error) {
2705 error = create_error;
2706 goto out;
2707 }
2708 } else {
2709 if (excl && !(*opened & FILE_CREATED)) {
2710 error = -EEXIST;
2711 goto out;
2712 }
2713 }
2714 goto looked_up;
2715 }
2716
2717
2718
2719
2720
2721 acc_mode = op->acc_mode;
2722 if (*opened & FILE_CREATED) {
2723 WARN_ON(!(open_flag & O_CREAT));
2724 fsnotify_create(dir, dentry);
2725 acc_mode = MAY_OPEN;
2726 }
2727 error = may_open(&file->f_path, acc_mode, open_flag);
2728 if (error)
2729 fput(file);
2730
2731out:
2732 dput(dentry);
2733 return error;
2734
2735no_open:
2736 if (need_lookup) {
2737 dentry = lookup_real(dir, dentry, nd->flags);
2738 if (IS_ERR(dentry))
2739 return PTR_ERR(dentry);
2740
2741 if (create_error) {
2742 int open_flag = op->open_flag;
2743
2744 error = create_error;
2745 if ((open_flag & O_EXCL)) {
2746 if (!dentry->d_inode)
2747 goto out;
2748 } else if (!dentry->d_inode) {
2749 goto out;
2750 } else if ((open_flag & O_TRUNC) &&
2751 S_ISREG(dentry->d_inode->i_mode)) {
2752 goto out;
2753 }
2754
2755 }
2756 }
2757looked_up:
2758 path->dentry = dentry;
2759 path->mnt = nd->path.mnt;
2760 return 1;
2761}
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781static int lookup_open(struct nameidata *nd, struct path *path,
2782 struct file *file,
2783 const struct open_flags *op,
2784 bool got_write, int *opened)
2785{
2786 struct dentry *dir = nd->path.dentry;
2787 struct inode *dir_inode = dir->d_inode;
2788 struct dentry *dentry;
2789 int error;
2790 bool need_lookup;
2791
2792 *opened &= ~FILE_CREATED;
2793 dentry = lookup_dcache(&nd->last, dir, nd->flags, &need_lookup);
2794 if (IS_ERR(dentry))
2795 return PTR_ERR(dentry);
2796
2797
2798 if (!need_lookup && dentry->d_inode)
2799 goto out_no_open;
2800
2801 if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) {
2802 return atomic_open(nd, dentry, path, file, op, got_write,
2803 need_lookup, opened);
2804 }
2805
2806 if (need_lookup) {
2807 BUG_ON(dentry->d_inode);
2808
2809 dentry = lookup_real(dir_inode, dentry, nd->flags);
2810 if (IS_ERR(dentry))
2811 return PTR_ERR(dentry);
2812 }
2813
2814
2815 if (!dentry->d_inode && (op->open_flag & O_CREAT)) {
2816 umode_t mode = op->mode;
2817 if (!IS_POSIXACL(dir->d_inode))
2818 mode &= ~current_umask();
2819
2820
2821
2822
2823
2824
2825
2826 if (!got_write) {
2827 error = -EROFS;
2828 goto out_dput;
2829 }
2830 *opened |= FILE_CREATED;
2831 error = security_path_mknod(&nd->path, dentry, mode, 0);
2832 if (error)
2833 goto out_dput;
2834 error = vfs_create(dir->d_inode, dentry, mode,
2835 nd->flags & LOOKUP_EXCL);
2836 if (error)
2837 goto out_dput;
2838 }
2839out_no_open:
2840 path->dentry = dentry;
2841 path->mnt = nd->path.mnt;
2842 return 1;
2843
2844out_dput:
2845 dput(dentry);
2846 return error;
2847}
2848
2849
2850
2851
2852static int do_last(struct nameidata *nd, struct path *path,
2853 struct file *file, const struct open_flags *op,
2854 int *opened, struct filename *name)
2855{
2856 struct dentry *dir = nd->path.dentry;
2857 int open_flag = op->open_flag;
2858 bool will_truncate = (open_flag & O_TRUNC) != 0;
2859 bool got_write = false;
2860 int acc_mode = op->acc_mode;
2861 struct inode *inode;
2862 bool symlink_ok = false;
2863 struct path save_parent = { .dentry = NULL, .mnt = NULL };
2864 bool retried = false;
2865 int error;
2866
2867 nd->flags &= ~LOOKUP_PARENT;
2868 nd->flags |= op->intent;
2869
2870 if (nd->last_type != LAST_NORM) {
2871 error = handle_dots(nd, nd->last_type);
2872 if (error)
2873 return error;
2874 goto finish_open;
2875 }
2876
2877 if (!(open_flag & O_CREAT)) {
2878 if (nd->last.name[nd->last.len])
2879 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2880 if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW))
2881 symlink_ok = true;
2882
2883 error = lookup_fast(nd, path, &inode);
2884 if (likely(!error))
2885 goto finish_lookup;
2886
2887 if (error < 0)
2888 goto out;
2889
2890 BUG_ON(nd->inode != dir->d_inode);
2891 } else {
2892
2893
2894
2895
2896
2897
2898 error = complete_walk(nd);
2899 if (error)
2900 return error;
2901
2902 audit_inode(name, dir, LOOKUP_PARENT);
2903 error = -EISDIR;
2904
2905 if (nd->last.name[nd->last.len])
2906 goto out;
2907 }
2908
2909retry_lookup:
2910 if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
2911 error = mnt_want_write(nd->path.mnt);
2912 if (!error)
2913 got_write = true;
2914
2915
2916
2917
2918
2919 }
2920 mutex_lock(&dir->d_inode->i_mutex);
2921 error = lookup_open(nd, path, file, op, got_write, opened);
2922 mutex_unlock(&dir->d_inode->i_mutex);
2923
2924 if (error <= 0) {
2925 if (error)
2926 goto out;
2927
2928 if ((*opened & FILE_CREATED) ||
2929 !S_ISREG(file_inode(file)->i_mode))
2930 will_truncate = false;
2931
2932 audit_inode(name, file->f_path.dentry, 0);
2933 goto opened;
2934 }
2935
2936 if (*opened & FILE_CREATED) {
2937
2938 open_flag &= ~O_TRUNC;
2939 will_truncate = false;
2940 acc_mode = MAY_OPEN;
2941 path_to_nameidata(path, nd);
2942 goto finish_open_created;
2943 }
2944
2945
2946
2947
2948 if (d_is_positive(path->dentry))
2949 audit_inode(name, path->dentry, 0);
2950
2951
2952
2953
2954
2955
2956 if (got_write) {
2957 mnt_drop_write(nd->path.mnt);
2958 got_write = false;
2959 }
2960
2961 error = -EEXIST;
2962 if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))
2963 goto exit_dput;
2964
2965 error = follow_managed(path, nd->flags);
2966 if (error < 0)
2967 goto exit_dput;
2968
2969 if (error)
2970 nd->flags |= LOOKUP_JUMPED;
2971
2972 BUG_ON(nd->flags & LOOKUP_RCU);
2973 inode = path->dentry->d_inode;
2974finish_lookup:
2975
2976 error = -ENOENT;
2977 if (d_is_negative(path->dentry)) {
2978 path_to_nameidata(path, nd);
2979 goto out;
2980 }
2981
2982 if (should_follow_link(path->dentry, !symlink_ok)) {
2983 if (nd->flags & LOOKUP_RCU) {
2984 if (unlikely(unlazy_walk(nd, path->dentry))) {
2985 error = -ECHILD;
2986 goto out;
2987 }
2988 }
2989 BUG_ON(inode != path->dentry->d_inode);
2990 return 1;
2991 }
2992
2993 if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path->mnt) {
2994 path_to_nameidata(path, nd);
2995 } else {
2996 save_parent.dentry = nd->path.dentry;
2997 save_parent.mnt = mntget(path->mnt);
2998 nd->path.dentry = path->dentry;
2999
3000 }
3001 nd->inode = inode;
3002
3003finish_open:
3004 error = complete_walk(nd);
3005 if (error) {
3006 path_put(&save_parent);
3007 return error;
3008 }
3009 audit_inode(name, nd->path.dentry, 0);
3010 error = -EISDIR;
3011 if ((open_flag & O_CREAT) &&
3012 (d_is_directory(nd->path.dentry) || d_is_autodir(nd->path.dentry)))
3013 goto out;
3014 error = -ENOTDIR;
3015 if ((nd->flags & LOOKUP_DIRECTORY) && !d_is_directory(nd->path.dentry))
3016 goto out;
3017 if (!S_ISREG(nd->inode->i_mode))
3018 will_truncate = false;
3019
3020 if (will_truncate) {
3021 error = mnt_want_write(nd->path.mnt);
3022 if (error)
3023 goto out;
3024 got_write = true;
3025 }
3026finish_open_created:
3027 error = may_open(&nd->path, acc_mode, open_flag);
3028 if (error)
3029 goto out;
3030 file->f_path.mnt = nd->path.mnt;
3031 error = finish_open(file, nd->path.dentry, NULL, opened);
3032 if (error) {
3033 if (error == -EOPENSTALE)
3034 goto stale_open;
3035 goto out;
3036 }
3037opened:
3038 error = open_check_o_direct(file);
3039 if (error)
3040 goto exit_fput;
3041 error = ima_file_check(file, op->acc_mode);
3042 if (error)
3043 goto exit_fput;
3044
3045 if (will_truncate) {
3046 error = handle_truncate(file);
3047 if (error)
3048 goto exit_fput;
3049 }
3050out:
3051 if (got_write)
3052 mnt_drop_write(nd->path.mnt);
3053 path_put(&save_parent);
3054 terminate_walk(nd);
3055 return error;
3056
3057exit_dput:
3058 path_put_conditional(path, nd);
3059 goto out;
3060exit_fput:
3061 fput(file);
3062 goto out;
3063
3064stale_open:
3065
3066 if (!save_parent.dentry || retried)
3067 goto out;
3068
3069 BUG_ON(save_parent.dentry != dir);
3070 path_put(&nd->path);
3071 nd->path = save_parent;
3072 nd->inode = dir->d_inode;
3073 save_parent.mnt = NULL;
3074 save_parent.dentry = NULL;
3075 if (got_write) {
3076 mnt_drop_write(nd->path.mnt);
3077 got_write = false;
3078 }
3079 retried = true;
3080 goto retry_lookup;
3081}
3082
3083static int do_tmpfile(int dfd, struct filename *pathname,
3084 struct nameidata *nd, int flags,
3085 const struct open_flags *op,
3086 struct file *file, int *opened)
3087{
3088 static const struct qstr name = QSTR_INIT("/", 1);
3089 struct dentry *dentry, *child;
3090 struct inode *dir;
3091 int error = path_lookupat(dfd, pathname->name,
3092 flags | LOOKUP_DIRECTORY, nd);
3093 if (unlikely(error))
3094 return error;
3095 error = mnt_want_write(nd->path.mnt);
3096 if (unlikely(error))
3097 goto out;
3098
3099 error = inode_permission(nd->inode, MAY_WRITE | MAY_EXEC);
3100 if (error)
3101 goto out2;
3102 dentry = nd->path.dentry;
3103 dir = dentry->d_inode;
3104 if (!dir->i_op->tmpfile) {
3105 error = -EOPNOTSUPP;
3106 goto out2;
3107 }
3108 child = d_alloc(dentry, &name);
3109 if (unlikely(!child)) {
3110 error = -ENOMEM;
3111 goto out2;
3112 }
3113 nd->flags &= ~LOOKUP_DIRECTORY;
3114 nd->flags |= op->intent;
3115 dput(nd->path.dentry);
3116 nd->path.dentry = child;
3117 error = dir->i_op->tmpfile(dir, nd->path.dentry, op->mode);
3118 if (error)
3119 goto out2;
3120 audit_inode(pathname, nd->path.dentry, 0);
3121 error = may_open(&nd->path, op->acc_mode, op->open_flag);
3122 if (error)
3123 goto out2;
3124 file->f_path.mnt = nd->path.mnt;
3125 error = finish_open(file, nd->path.dentry, NULL, opened);
3126 if (error)
3127 goto out2;
3128 error = open_check_o_direct(file);
3129 if (error) {
3130 fput(file);
3131 } else if (!(op->open_flag & O_EXCL)) {
3132 struct inode *inode = file_inode(file);
3133 spin_lock(&inode->i_lock);
3134 inode->i_state |= I_LINKABLE;
3135 spin_unlock(&inode->i_lock);
3136 }
3137out2:
3138 mnt_drop_write(nd->path.mnt);
3139out:
3140 path_put(&nd->path);
3141 return error;
3142}
3143
3144static struct file *path_openat(int dfd, struct filename *pathname,
3145 struct nameidata *nd, const struct open_flags *op, int flags)
3146{
3147 struct file *base = NULL;
3148 struct file *file;
3149 struct path path;
3150 int opened = 0;
3151 int error;
3152
3153 file = get_empty_filp();
3154 if (IS_ERR(file))
3155 return file;
3156
3157 file->f_flags = op->open_flag;
3158
3159 if (unlikely(file->f_flags & __O_TMPFILE)) {
3160 error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened);
3161 goto out;
3162 }
3163
3164 error = path_init(dfd, pathname->name, flags | LOOKUP_PARENT, nd, &base);
3165 if (unlikely(error))
3166 goto out;
3167
3168 current->total_link_count = 0;
3169 error = link_path_walk(pathname->name, nd);
3170 if (unlikely(error))
3171 goto out;
3172
3173 error = do_last(nd, &path, file, op, &opened, pathname);
3174 while (unlikely(error > 0)) {
3175 struct path link = path;
3176 void *cookie;
3177 if (!(nd->flags & LOOKUP_FOLLOW)) {
3178 path_put_conditional(&path, nd);
3179 path_put(&nd->path);
3180 error = -ELOOP;
3181 break;
3182 }
3183 error = may_follow_link(&link, nd);
3184 if (unlikely(error))
3185 break;
3186 nd->flags |= LOOKUP_PARENT;
3187 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3188 error = follow_link(&link, nd, &cookie);
3189 if (unlikely(error))
3190 break;
3191 error = do_last(nd, &path, file, op, &opened, pathname);
3192 put_link(nd, &link, cookie);
3193 }
3194out:
3195 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT))
3196 path_put(&nd->root);
3197 if (base)
3198 fput(base);
3199 if (!(opened & FILE_OPENED)) {
3200 BUG_ON(!error);
3201 put_filp(file);
3202 }
3203 if (unlikely(error)) {
3204 if (error == -EOPENSTALE) {
3205 if (flags & LOOKUP_RCU)
3206 error = -ECHILD;
3207 else
3208 error = -ESTALE;
3209 }
3210 file = ERR_PTR(error);
3211 }
3212 return file;
3213}
3214
3215struct file *do_filp_open(int dfd, struct filename *pathname,
3216 const struct open_flags *op)
3217{
3218 struct nameidata nd;
3219 int flags = op->lookup_flags;
3220 struct file *filp;
3221
3222 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU);
3223 if (unlikely(filp == ERR_PTR(-ECHILD)))
3224 filp = path_openat(dfd, pathname, &nd, op, flags);
3225 if (unlikely(filp == ERR_PTR(-ESTALE)))
3226 filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL);
3227 return filp;
3228}
3229
3230struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
3231 const char *name, const struct open_flags *op)
3232{
3233 struct nameidata nd;
3234 struct file *file;
3235 struct filename filename = { .name = name };
3236 int flags = op->lookup_flags | LOOKUP_ROOT;
3237
3238 nd.root.mnt = mnt;
3239 nd.root.dentry = dentry;
3240
3241 if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN)
3242 return ERR_PTR(-ELOOP);
3243
3244 file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_RCU);
3245 if (unlikely(file == ERR_PTR(-ECHILD)))
3246 file = path_openat(-1, &filename, &nd, op, flags);
3247 if (unlikely(file == ERR_PTR(-ESTALE)))
3248 file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_REVAL);
3249 return file;
3250}
3251
3252struct dentry *kern_path_create(int dfd, const char *pathname,
3253 struct path *path, unsigned int lookup_flags)
3254{
3255 struct dentry *dentry = ERR_PTR(-EEXIST);
3256 struct nameidata nd;
3257 int err2;
3258 int error;
3259 bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);
3260
3261
3262
3263
3264
3265 lookup_flags &= LOOKUP_REVAL;
3266
3267 error = do_path_lookup(dfd, pathname, LOOKUP_PARENT|lookup_flags, &nd);
3268 if (error)
3269 return ERR_PTR(error);
3270
3271
3272
3273
3274
3275 if (nd.last_type != LAST_NORM)
3276 goto out;
3277 nd.flags &= ~LOOKUP_PARENT;
3278 nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL;
3279
3280
3281 err2 = mnt_want_write(nd.path.mnt);
3282
3283
3284
3285 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
3286 dentry = lookup_hash(&nd);
3287 if (IS_ERR(dentry))
3288 goto unlock;
3289
3290 error = -EEXIST;
3291 if (d_is_positive(dentry))
3292 goto fail;
3293
3294
3295
3296
3297
3298
3299
3300 if (unlikely(!is_dir && nd.last.name[nd.last.len])) {
3301 error = -ENOENT;
3302 goto fail;
3303 }
3304 if (unlikely(err2)) {
3305 error = err2;
3306 goto fail;
3307 }
3308 *path = nd.path;
3309 return dentry;
3310fail:
3311 dput(dentry);
3312 dentry = ERR_PTR(error);
3313unlock:
3314 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
3315 if (!err2)
3316 mnt_drop_write(nd.path.mnt);
3317out:
3318 path_put(&nd.path);
3319 return dentry;
3320}
3321EXPORT_SYMBOL(kern_path_create);
3322
3323void done_path_create(struct path *path, struct dentry *dentry)
3324{
3325 dput(dentry);
3326 mutex_unlock(&path->dentry->d_inode->i_mutex);
3327 mnt_drop_write(path->mnt);
3328 path_put(path);
3329}
3330EXPORT_SYMBOL(done_path_create);
3331
3332struct dentry *user_path_create(int dfd, const char __user *pathname,
3333 struct path *path, unsigned int lookup_flags)
3334{
3335 struct filename *tmp = getname(pathname);
3336 struct dentry *res;
3337 if (IS_ERR(tmp))
3338 return ERR_CAST(tmp);
3339 res = kern_path_create(dfd, tmp->name, path, lookup_flags);
3340 putname(tmp);
3341 return res;
3342}
3343EXPORT_SYMBOL(user_path_create);
3344
3345int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3346{
3347 int error = may_create(dir, dentry);
3348
3349 if (error)
3350 return error;
3351
3352 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
3353 return -EPERM;
3354
3355 if (!dir->i_op->mknod)
3356 return -EPERM;
3357
3358 error = devcgroup_inode_mknod(mode, dev);
3359 if (error)
3360 return error;
3361
3362 error = security_inode_mknod(dir, dentry, mode, dev);
3363 if (error)
3364 return error;
3365
3366 error = dir->i_op->mknod(dir, dentry, mode, dev);
3367 if (!error)
3368 fsnotify_create(dir, dentry);
3369 return error;
3370}
3371
3372static int may_mknod(umode_t mode)
3373{
3374 switch (mode & S_IFMT) {
3375 case S_IFREG:
3376 case S_IFCHR:
3377 case S_IFBLK:
3378 case S_IFIFO:
3379 case S_IFSOCK:
3380 case 0:
3381 return 0;
3382 case S_IFDIR:
3383 return -EPERM;
3384 default:
3385 return -EINVAL;
3386 }
3387}
3388
3389SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
3390 unsigned, dev)
3391{
3392 struct dentry *dentry;
3393 struct path path;
3394 int error;
3395 unsigned int lookup_flags = 0;
3396
3397 error = may_mknod(mode);
3398 if (error)
3399 return error;
3400retry:
3401 dentry = user_path_create(dfd, filename, &path, lookup_flags);
3402 if (IS_ERR(dentry))
3403 return PTR_ERR(dentry);
3404
3405 if (!IS_POSIXACL(path.dentry->d_inode))
3406 mode &= ~current_umask();
3407 error = security_path_mknod(&path, dentry, mode, dev);
3408 if (error)
3409 goto out;
3410 switch (mode & S_IFMT) {
3411 case 0: case S_IFREG:
3412 error = vfs_create(path.dentry->d_inode,dentry,mode,true);
3413 break;
3414 case S_IFCHR: case S_IFBLK:
3415 error = vfs_mknod(path.dentry->d_inode,dentry,mode,
3416 new_decode_dev(dev));
3417 break;
3418 case S_IFIFO: case S_IFSOCK:
3419 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
3420 break;
3421 }
3422out:
3423 done_path_create(&path, dentry);
3424 if (retry_estale(error, lookup_flags)) {
3425 lookup_flags |= LOOKUP_REVAL;
3426 goto retry;
3427 }
3428 return error;
3429}
3430
3431SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3432{
3433 return sys_mknodat(AT_FDCWD, filename, mode, dev);
3434}
3435
3436int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
3437{
3438 int error = may_create(dir, dentry);
3439 unsigned max_links = dir->i_sb->s_max_links;
3440
3441 if (error)
3442 return error;
3443
3444 if (!dir->i_op->mkdir)
3445 return -EPERM;
3446
3447 mode &= (S_IRWXUGO|S_ISVTX);
3448 error = security_inode_mkdir(dir, dentry, mode);
3449 if (error)
3450 return error;
3451
3452 if (max_links && dir->i_nlink >= max_links)
3453 return -EMLINK;
3454
3455 error = dir->i_op->mkdir(dir, dentry, mode);
3456 if (!error)
3457 fsnotify_mkdir(dir, dentry);
3458 return error;
3459}
3460
3461SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
3462{
3463 struct dentry *dentry;
3464 struct path path;
3465 int error;
3466 unsigned int lookup_flags = LOOKUP_DIRECTORY;
3467
3468retry:
3469 dentry = user_path_create(dfd, pathname, &path, lookup_flags);
3470 if (IS_ERR(dentry))
3471 return PTR_ERR(dentry);
3472
3473 if (!IS_POSIXACL(path.dentry->d_inode))
3474 mode &= ~current_umask();
3475 error = security_path_mkdir(&path, dentry, mode);
3476 if (!error)
3477 error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
3478 done_path_create(&path, dentry);
3479 if (retry_estale(error, lookup_flags)) {
3480 lookup_flags |= LOOKUP_REVAL;
3481 goto retry;
3482 }
3483 return error;
3484}
3485
3486SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
3487{
3488 return sys_mkdirat(AT_FDCWD, pathname, mode);
3489}
3490
3491
3492
3493
3494
3495
3496
3497
3498
3499
3500
3501
3502
3503
3504
3505
3506void dentry_unhash(struct dentry *dentry)
3507{
3508 shrink_dcache_parent(dentry);
3509 spin_lock(&dentry->d_lock);
3510 if (dentry->d_lockref.count == 1)
3511 __d_drop(dentry);
3512 spin_unlock(&dentry->d_lock);
3513}
3514
3515int vfs_rmdir(struct inode *dir, struct dentry *dentry)
3516{
3517 int error = may_delete(dir, dentry, 1);
3518
3519 if (error)
3520 return error;
3521
3522 if (!dir->i_op->rmdir)
3523 return -EPERM;
3524
3525 dget(dentry);
3526 mutex_lock(&dentry->d_inode->i_mutex);
3527
3528 error = -EBUSY;
3529 if (d_mountpoint(dentry))
3530 goto out;
3531
3532 error = security_inode_rmdir(dir, dentry);
3533 if (error)
3534 goto out;
3535
3536 shrink_dcache_parent(dentry);
3537 error = dir->i_op->rmdir(dir, dentry);
3538 if (error)
3539 goto out;
3540
3541 dentry->d_inode->i_flags |= S_DEAD;
3542 dont_mount(dentry);
3543
3544out:
3545 mutex_unlock(&dentry->d_inode->i_mutex);
3546 dput(dentry);
3547 if (!error)
3548 d_delete(dentry);
3549 return error;
3550}
3551
3552static long do_rmdir(int dfd, const char __user *pathname)
3553{
3554 int error = 0;
3555 struct filename *name;
3556 struct dentry *dentry;
3557 struct nameidata nd;
3558 unsigned int lookup_flags = 0;
3559retry:
3560 name = user_path_parent(dfd, pathname, &nd, lookup_flags);
3561 if (IS_ERR(name))
3562 return PTR_ERR(name);
3563
3564 switch(nd.last_type) {
3565 case LAST_DOTDOT:
3566 error = -ENOTEMPTY;
3567 goto exit1;
3568 case LAST_DOT:
3569 error = -EINVAL;
3570 goto exit1;
3571 case LAST_ROOT:
3572 error = -EBUSY;
3573 goto exit1;
3574 }
3575
3576 nd.flags &= ~LOOKUP_PARENT;
3577 error = mnt_want_write(nd.path.mnt);
3578 if (error)
3579 goto exit1;
3580
3581 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
3582 dentry = lookup_hash(&nd);
3583 error = PTR_ERR(dentry);
3584 if (IS_ERR(dentry))
3585 goto exit2;
3586 if (!dentry->d_inode) {
3587 error = -ENOENT;
3588 goto exit3;
3589 }
3590 error = security_path_rmdir(&nd.path, dentry);
3591 if (error)
3592 goto exit3;
3593 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
3594exit3:
3595 dput(dentry);
3596exit2:
3597 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
3598 mnt_drop_write(nd.path.mnt);
3599exit1:
3600 path_put(&nd.path);
3601 putname(name);
3602 if (retry_estale(error, lookup_flags)) {
3603 lookup_flags |= LOOKUP_REVAL;
3604 goto retry;
3605 }
3606 return error;
3607}
3608
3609SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
3610{
3611 return do_rmdir(AT_FDCWD, pathname);
3612}
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode)
3633{
3634 struct inode *target = dentry->d_inode;
3635 int error = may_delete(dir, dentry, 0);
3636
3637 if (error)
3638 return error;
3639
3640 if (!dir->i_op->unlink)
3641 return -EPERM;
3642
3643 mutex_lock(&target->i_mutex);
3644 if (d_mountpoint(dentry))
3645 error = -EBUSY;
3646 else {
3647 error = security_inode_unlink(dir, dentry);
3648 if (!error) {
3649 error = try_break_deleg(target, delegated_inode);
3650 if (error)
3651 goto out;
3652 error = dir->i_op->unlink(dir, dentry);
3653 if (!error)
3654 dont_mount(dentry);
3655 }
3656 }
3657out:
3658 mutex_unlock(&target->i_mutex);
3659
3660
3661 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
3662 fsnotify_link_count(target);
3663 d_delete(dentry);
3664 }
3665
3666 return error;
3667}
3668
3669
3670
3671
3672
3673
3674
3675static long do_unlinkat(int dfd, const char __user *pathname)
3676{
3677 int error;
3678 struct filename *name;
3679 struct dentry *dentry;
3680 struct nameidata nd;
3681 struct inode *inode = NULL;
3682 struct inode *delegated_inode = NULL;
3683 unsigned int lookup_flags = 0;
3684retry:
3685 name = user_path_parent(dfd, pathname, &nd, lookup_flags);
3686 if (IS_ERR(name))
3687 return PTR_ERR(name);
3688
3689 error = -EISDIR;
3690 if (nd.last_type != LAST_NORM)
3691 goto exit1;
3692
3693 nd.flags &= ~LOOKUP_PARENT;
3694 error = mnt_want_write(nd.path.mnt);
3695 if (error)
3696 goto exit1;
3697retry_deleg:
3698 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
3699 dentry = lookup_hash(&nd);
3700 error = PTR_ERR(dentry);
3701 if (!IS_ERR(dentry)) {
3702
3703 if (nd.last.name[nd.last.len])
3704 goto slashes;
3705 inode = dentry->d_inode;
3706 if (d_is_negative(dentry))
3707 goto slashes;
3708 ihold(inode);
3709 error = security_path_unlink(&nd.path, dentry);
3710 if (error)
3711 goto exit2;
3712 error = vfs_unlink(nd.path.dentry->d_inode, dentry, &delegated_inode);
3713exit2:
3714 dput(dentry);
3715 }
3716 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
3717 if (inode)
3718 iput(inode);
3719 inode = NULL;
3720 if (delegated_inode) {
3721 error = break_deleg_wait(&delegated_inode);
3722 if (!error)
3723 goto retry_deleg;
3724 }
3725 mnt_drop_write(nd.path.mnt);
3726exit1:
3727 path_put(&nd.path);
3728 putname(name);
3729 if (retry_estale(error, lookup_flags)) {
3730 lookup_flags |= LOOKUP_REVAL;
3731 inode = NULL;
3732 goto retry;
3733 }
3734 return error;
3735
3736slashes:
3737 if (d_is_negative(dentry))
3738 error = -ENOENT;
3739 else if (d_is_directory(dentry) || d_is_autodir(dentry))
3740 error = -EISDIR;
3741 else
3742 error = -ENOTDIR;
3743 goto exit2;
3744}
3745
3746SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
3747{
3748 if ((flag & ~AT_REMOVEDIR) != 0)
3749 return -EINVAL;
3750
3751 if (flag & AT_REMOVEDIR)
3752 return do_rmdir(dfd, pathname);
3753
3754 return do_unlinkat(dfd, pathname);
3755}
3756
3757SYSCALL_DEFINE1(unlink, const char __user *, pathname)
3758{
3759 return do_unlinkat(AT_FDCWD, pathname);
3760}
3761
3762int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
3763{
3764 int error = may_create(dir, dentry);
3765
3766 if (error)
3767 return error;
3768
3769 if (!dir->i_op->symlink)
3770 return -EPERM;
3771
3772 error = security_inode_symlink(dir, dentry, oldname);
3773 if (error)
3774 return error;
3775
3776 error = dir->i_op->symlink(dir, dentry, oldname);
3777 if (!error)
3778 fsnotify_create(dir, dentry);
3779 return error;
3780}
3781
3782SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
3783 int, newdfd, const char __user *, newname)
3784{
3785 int error;
3786 struct filename *from;
3787 struct dentry *dentry;
3788 struct path path;
3789 unsigned int lookup_flags = 0;
3790
3791 from = getname(oldname);
3792 if (IS_ERR(from))
3793 return PTR_ERR(from);
3794retry:
3795 dentry = user_path_create(newdfd, newname, &path, lookup_flags);
3796 error = PTR_ERR(dentry);
3797 if (IS_ERR(dentry))
3798 goto out_putname;
3799
3800 error = security_path_symlink(&path, dentry, from->name);
3801 if (!error)
3802 error = vfs_symlink(path.dentry->d_inode, dentry, from->name);
3803 done_path_create(&path, dentry);
3804 if (retry_estale(error, lookup_flags)) {
3805 lookup_flags |= LOOKUP_REVAL;
3806 goto retry;
3807 }
3808out_putname:
3809 putname(from);
3810 return error;
3811}
3812
3813SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
3814{
3815 return sys_symlinkat(oldname, AT_FDCWD, newname);
3816}
3817
3818
3819
3820
3821
3822
3823
3824
3825
3826
3827
3828
3829
3830
3831
3832
3833
3834
3835
3836
3837int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode)
3838{
3839 struct inode *inode = old_dentry->d_inode;
3840 unsigned max_links = dir->i_sb->s_max_links;
3841 int error;
3842
3843 if (!inode)
3844 return -ENOENT;
3845
3846 error = may_create(dir, new_dentry);
3847 if (error)
3848 return error;
3849
3850 if (dir->i_sb != inode->i_sb)
3851 return -EXDEV;
3852
3853
3854
3855
3856 if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
3857 return -EPERM;
3858 if (!dir->i_op->link)
3859 return -EPERM;
3860 if (S_ISDIR(inode->i_mode))
3861 return -EPERM;
3862
3863 error = security_inode_link(old_dentry, dir, new_dentry);
3864 if (error)
3865 return error;
3866
3867 mutex_lock(&inode->i_mutex);
3868
3869 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
3870 error = -ENOENT;
3871 else if (max_links && inode->i_nlink >= max_links)
3872 error = -EMLINK;
3873 else {
3874 error = try_break_deleg(inode, delegated_inode);
3875 if (!error)
3876 error = dir->i_op->link(old_dentry, dir, new_dentry);
3877 }
3878
3879 if (!error && (inode->i_state & I_LINKABLE)) {
3880 spin_lock(&inode->i_lock);
3881 inode->i_state &= ~I_LINKABLE;
3882 spin_unlock(&inode->i_lock);
3883 }
3884 mutex_unlock(&inode->i_mutex);
3885 if (!error)
3886 fsnotify_link(dir, inode, new_dentry);
3887 return error;
3888}
3889
3890
3891
3892
3893
3894
3895
3896
3897
3898
3899SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
3900 int, newdfd, const char __user *, newname, int, flags)
3901{
3902 struct dentry *new_dentry;
3903 struct path old_path, new_path;
3904 struct inode *delegated_inode = NULL;
3905 int how = 0;
3906 int error;
3907
3908 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
3909 return -EINVAL;
3910
3911
3912
3913
3914
3915 if (flags & AT_EMPTY_PATH) {
3916 if (!capable(CAP_DAC_READ_SEARCH))
3917 return -ENOENT;
3918 how = LOOKUP_EMPTY;
3919 }
3920
3921 if (flags & AT_SYMLINK_FOLLOW)
3922 how |= LOOKUP_FOLLOW;
3923retry:
3924 error = user_path_at(olddfd, oldname, how, &old_path);
3925 if (error)
3926 return error;
3927
3928 new_dentry = user_path_create(newdfd, newname, &new_path,
3929 (how & LOOKUP_REVAL));
3930 error = PTR_ERR(new_dentry);
3931 if (IS_ERR(new_dentry))
3932 goto out;
3933
3934 error = -EXDEV;
3935 if (old_path.mnt != new_path.mnt)
3936 goto out_dput;
3937 error = may_linkat(&old_path);
3938 if (unlikely(error))
3939 goto out_dput;
3940 error = security_path_link(old_path.dentry, &new_path, new_dentry);
3941 if (error)
3942 goto out_dput;
3943 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode);
3944out_dput:
3945 done_path_create(&new_path, new_dentry);
3946 if (delegated_inode) {
3947 error = break_deleg_wait(&delegated_inode);
3948 if (!error)
3949 goto retry;
3950 }
3951 if (retry_estale(error, how)) {
3952 how |= LOOKUP_REVAL;
3953 goto retry;
3954 }
3955out:
3956 path_put(&old_path);
3957
3958 return error;
3959}
3960
3961SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
3962{
3963 return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
3964}
3965
3966
3967
3968
3969
3970
3971
3972
3973
3974
3975
3976
3977
3978
3979
3980
3981
3982
3983
3984
3985
3986
3987
3988
3989
3990
3991
3992
3993
3994static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
3995 struct inode *new_dir, struct dentry *new_dentry)
3996{
3997 int error = 0;
3998 struct inode *target = new_dentry->d_inode;
3999 unsigned max_links = new_dir->i_sb->s_max_links;
4000
4001
4002
4003
4004
4005 if (new_dir != old_dir) {
4006 error = inode_permission(old_dentry->d_inode, MAY_WRITE);
4007 if (error)
4008 return error;
4009 }
4010
4011 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
4012 if (error)
4013 return error;
4014
4015 dget(new_dentry);
4016 if (target)
4017 mutex_lock(&target->i_mutex);
4018
4019 error = -EBUSY;
4020 if (d_mountpoint(old_dentry) || d_mountpoint(new_dentry))
4021 goto out;
4022
4023 error = -EMLINK;
4024 if (max_links && !target && new_dir != old_dir &&
4025 new_dir->i_nlink >= max_links)
4026 goto out;
4027
4028 if (target)
4029 shrink_dcache_parent(new_dentry);
4030 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
4031 if (error)
4032 goto out;
4033
4034 if (target) {
4035 target->i_flags |= S_DEAD;
4036 dont_mount(new_dentry);
4037 }
4038out:
4039 if (target)
4040 mutex_unlock(&target->i_mutex);
4041 dput(new_dentry);
4042 if (!error)
4043 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
4044 d_move(old_dentry,new_dentry);
4045 return error;
4046}
4047
4048static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
4049 struct inode *new_dir, struct dentry *new_dentry,
4050 struct inode **delegated_inode)
4051{
4052 struct inode *target = new_dentry->d_inode;
4053 struct inode *source = old_dentry->d_inode;
4054 int error;
4055
4056 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
4057 if (error)
4058 return error;
4059
4060 dget(new_dentry);
4061 lock_two_nondirectories(source, target);
4062
4063 error = -EBUSY;
4064 if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
4065 goto out;
4066
4067 error = try_break_deleg(source, delegated_inode);
4068 if (error)
4069 goto out;
4070 if (target) {
4071 error = try_break_deleg(target, delegated_inode);
4072 if (error)
4073 goto out;
4074 }
4075 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
4076 if (error)
4077 goto out;
4078
4079 if (target)
4080 dont_mount(new_dentry);
4081 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
4082 d_move(old_dentry, new_dentry);
4083out:
4084 unlock_two_nondirectories(source, target);
4085 dput(new_dentry);
4086 return error;
4087}
4088
4089
4090
4091
4092
4093
4094
4095
4096
4097
4098
4099
4100
4101
4102
4103
4104
4105
4106
4107
4108
4109
4110int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
4111 struct inode *new_dir, struct dentry *new_dentry,
4112 struct inode **delegated_inode)
4113{
4114 int error;
4115 int is_dir = d_is_directory(old_dentry) || d_is_autodir(old_dentry);
4116 const unsigned char *old_name;
4117
4118 if (old_dentry->d_inode == new_dentry->d_inode)
4119 return 0;
4120
4121 error = may_delete(old_dir, old_dentry, is_dir);
4122 if (error)
4123 return error;
4124
4125 if (!new_dentry->d_inode)
4126 error = may_create(new_dir, new_dentry);
4127 else
4128 error = may_delete(new_dir, new_dentry, is_dir);
4129 if (error)
4130 return error;
4131
4132 if (!old_dir->i_op->rename)
4133 return -EPERM;
4134
4135 old_name = fsnotify_oldname_init(old_dentry->d_name.name);
4136
4137 if (is_dir)
4138 error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
4139 else
4140 error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry,delegated_inode);
4141 if (!error)
4142 fsnotify_move(old_dir, new_dir, old_name, is_dir,
4143 new_dentry->d_inode, old_dentry);
4144 fsnotify_oldname_free(old_name);
4145
4146 return error;
4147}
4148
4149SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
4150 int, newdfd, const char __user *, newname)
4151{
4152 struct dentry *old_dir, *new_dir;
4153 struct dentry *old_dentry, *new_dentry;
4154 struct dentry *trap;
4155 struct nameidata oldnd, newnd;
4156 struct inode *delegated_inode = NULL;
4157 struct filename *from;
4158 struct filename *to;
4159 unsigned int lookup_flags = 0;
4160 bool should_retry = false;
4161 int error;
4162retry:
4163 from = user_path_parent(olddfd, oldname, &oldnd, lookup_flags);
4164 if (IS_ERR(from)) {
4165 error = PTR_ERR(from);
4166 goto exit;
4167 }
4168
4169 to = user_path_parent(newdfd, newname, &newnd, lookup_flags);
4170 if (IS_ERR(to)) {
4171 error = PTR_ERR(to);
4172 goto exit1;
4173 }
4174
4175 error = -EXDEV;
4176 if (oldnd.path.mnt != newnd.path.mnt)
4177 goto exit2;
4178
4179 old_dir = oldnd.path.dentry;
4180 error = -EBUSY;
4181 if (oldnd.last_type != LAST_NORM)
4182 goto exit2;
4183
4184 new_dir = newnd.path.dentry;
4185 if (newnd.last_type != LAST_NORM)
4186 goto exit2;
4187
4188 error = mnt_want_write(oldnd.path.mnt);
4189 if (error)
4190 goto exit2;
4191
4192 oldnd.flags &= ~LOOKUP_PARENT;
4193 newnd.flags &= ~LOOKUP_PARENT;
4194 newnd.flags |= LOOKUP_RENAME_TARGET;
4195
4196retry_deleg:
4197 trap = lock_rename(new_dir, old_dir);
4198
4199 old_dentry = lookup_hash(&oldnd);
4200 error = PTR_ERR(old_dentry);
4201 if (IS_ERR(old_dentry))
4202 goto exit3;
4203
4204 error = -ENOENT;
4205 if (d_is_negative(old_dentry))
4206 goto exit4;
4207
4208 if (!d_is_directory(old_dentry) && !d_is_autodir(old_dentry)) {
4209 error = -ENOTDIR;
4210 if (oldnd.last.name[oldnd.last.len])
4211 goto exit4;
4212 if (newnd.last.name[newnd.last.len])
4213 goto exit4;
4214 }
4215
4216 error = -EINVAL;
4217 if (old_dentry == trap)
4218 goto exit4;
4219 new_dentry = lookup_hash(&newnd);
4220 error = PTR_ERR(new_dentry);
4221 if (IS_ERR(new_dentry))
4222 goto exit4;
4223
4224 error = -ENOTEMPTY;
4225 if (new_dentry == trap)
4226 goto exit5;
4227
4228 error = security_path_rename(&oldnd.path, old_dentry,
4229 &newnd.path, new_dentry);
4230 if (error)
4231 goto exit5;
4232 error = vfs_rename(old_dir->d_inode, old_dentry,
4233 new_dir->d_inode, new_dentry,
4234 &delegated_inode);
4235exit5:
4236 dput(new_dentry);
4237exit4:
4238 dput(old_dentry);
4239exit3:
4240 unlock_rename(new_dir, old_dir);
4241 if (delegated_inode) {
4242 error = break_deleg_wait(&delegated_inode);
4243 if (!error)
4244 goto retry_deleg;
4245 }
4246 mnt_drop_write(oldnd.path.mnt);
4247exit2:
4248 if (retry_estale(error, lookup_flags))
4249 should_retry = true;
4250 path_put(&newnd.path);
4251 putname(to);
4252exit1:
4253 path_put(&oldnd.path);
4254 putname(from);
4255 if (should_retry) {
4256 should_retry = false;
4257 lookup_flags |= LOOKUP_REVAL;
4258 goto retry;
4259 }
4260exit:
4261 return error;
4262}
4263
4264SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
4265{
4266 return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname);
4267}
4268
4269int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
4270{
4271 int len;
4272
4273 len = PTR_ERR(link);
4274 if (IS_ERR(link))
4275 goto out;
4276
4277 len = strlen(link);
4278 if (len > (unsigned) buflen)
4279 len = buflen;
4280 if (copy_to_user(buffer, link, len))
4281 len = -EFAULT;
4282out:
4283 return len;
4284}
4285
4286
4287
4288
4289
4290
4291int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4292{
4293 struct nameidata nd;
4294 void *cookie;
4295 int res;
4296
4297 nd.depth = 0;
4298 cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
4299 if (IS_ERR(cookie))
4300 return PTR_ERR(cookie);
4301
4302 res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
4303 if (dentry->d_inode->i_op->put_link)
4304 dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
4305 return res;
4306}
4307
4308
4309static char *page_getlink(struct dentry * dentry, struct page **ppage)
4310{
4311 char *kaddr;
4312 struct page *page;
4313 struct address_space *mapping = dentry->d_inode->i_mapping;
4314 page = read_mapping_page(mapping, 0, NULL);
4315 if (IS_ERR(page))
4316 return (char*)page;
4317 *ppage = page;
4318 kaddr = kmap(page);
4319 nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1);
4320 return kaddr;
4321}
4322
4323int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4324{
4325 struct page *page = NULL;
4326 char *s = page_getlink(dentry, &page);
4327 int res = vfs_readlink(dentry,buffer,buflen,s);
4328 if (page) {
4329 kunmap(page);
4330 page_cache_release(page);
4331 }
4332 return res;
4333}
4334
4335void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
4336{
4337 struct page *page = NULL;
4338 nd_set_link(nd, page_getlink(dentry, &page));
4339 return page;
4340}
4341
4342void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
4343{
4344 struct page *page = cookie;
4345
4346 if (page) {
4347 kunmap(page);
4348 page_cache_release(page);
4349 }
4350}
4351
4352
4353
4354
4355int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
4356{
4357 struct address_space *mapping = inode->i_mapping;
4358 struct page *page;
4359 void *fsdata;
4360 int err;
4361 char *kaddr;
4362 unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
4363 if (nofs)
4364 flags |= AOP_FLAG_NOFS;
4365
4366retry:
4367 err = pagecache_write_begin(NULL, mapping, 0, len-1,
4368 flags, &page, &fsdata);
4369 if (err)
4370 goto fail;
4371
4372 kaddr = kmap_atomic(page);
4373 memcpy(kaddr, symname, len-1);
4374 kunmap_atomic(kaddr);
4375
4376 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
4377 page, fsdata);
4378 if (err < 0)
4379 goto fail;
4380 if (err < len-1)
4381 goto retry;
4382
4383 mark_inode_dirty(inode);
4384 return 0;
4385fail:
4386 return err;
4387}
4388
4389int page_symlink(struct inode *inode, const char *symname, int len)
4390{
4391 return __page_symlink(inode, symname, len,
4392 !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS));
4393}
4394
4395const struct inode_operations page_symlink_inode_operations = {
4396 .readlink = generic_readlink,
4397 .follow_link = page_follow_link_light,
4398 .put_link = page_put_link,
4399};
4400
4401EXPORT_SYMBOL(user_path_at);
4402EXPORT_SYMBOL(follow_down_one);
4403EXPORT_SYMBOL(follow_down);
4404EXPORT_SYMBOL(follow_up);
4405EXPORT_SYMBOL(get_write_access);
4406EXPORT_SYMBOL(lock_rename);
4407EXPORT_SYMBOL(lookup_one_len);
4408EXPORT_SYMBOL(page_follow_link_light);
4409EXPORT_SYMBOL(page_put_link);
4410EXPORT_SYMBOL(page_readlink);
4411EXPORT_SYMBOL(__page_symlink);
4412EXPORT_SYMBOL(page_symlink);
4413EXPORT_SYMBOL(page_symlink_inode_operations);
4414EXPORT_SYMBOL(kern_path);
4415EXPORT_SYMBOL(vfs_path_lookup);
4416EXPORT_SYMBOL(inode_permission);
4417EXPORT_SYMBOL(unlock_rename);
4418EXPORT_SYMBOL(vfs_create);
4419EXPORT_SYMBOL(vfs_link);
4420EXPORT_SYMBOL(vfs_mkdir);
4421EXPORT_SYMBOL(vfs_mknod);
4422EXPORT_SYMBOL(generic_permission);
4423EXPORT_SYMBOL(vfs_readlink);
4424EXPORT_SYMBOL(vfs_rename);
4425EXPORT_SYMBOL(vfs_rmdir);
4426EXPORT_SYMBOL(vfs_symlink);
4427EXPORT_SYMBOL(vfs_unlink);
4428EXPORT_SYMBOL(dentry_unhash);
4429EXPORT_SYMBOL(generic_readlink);
4430