1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18#include <linux/init.h>
19#include <linux/export.h>
20#include <linux/kernel.h>
21#include <linux/slab.h>
22#include <linux/fs.h>
23#include <linux/namei.h>
24#include <linux/pagemap.h>
25#include <linux/fsnotify.h>
26#include <linux/personality.h>
27#include <linux/security.h>
28#include <linux/ima.h>
29#include <linux/syscalls.h>
30#include <linux/mount.h>
31#include <linux/audit.h>
32#include <linux/capability.h>
33#include <linux/file.h>
34#include <linux/fcntl.h>
35#include <linux/device_cgroup.h>
36#include <linux/fs_struct.h>
37#include <linux/posix_acl.h>
38#include <linux/hash.h>
39#include <linux/bitops.h>
40#include <linux/init_task.h>
41#include <linux/uaccess.h>
42#include <linux/build_bug.h>
43
44#include "internal.h"
45#include "mount.h"
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126#define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname))
127
128struct filename *
129getname_flags(const char __user *filename, int flags, int *empty)
130{
131 struct filename *result;
132 char *kname;
133 int len;
134 BUILD_BUG_ON(offsetof(struct filename, iname) % sizeof(long) != 0);
135
136 result = audit_reusename(filename);
137 if (result)
138 return result;
139
140 result = __getname();
141 if (unlikely(!result))
142 return ERR_PTR(-ENOMEM);
143
144
145
146
147
148 kname = (char *)result->iname;
149 result->name = kname;
150
151 len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
152 if (unlikely(len < 0)) {
153 __putname(result);
154 return ERR_PTR(len);
155 }
156
157
158
159
160
161
162
163 if (unlikely(len == EMBEDDED_NAME_MAX)) {
164 const size_t size = offsetof(struct filename, iname[1]);
165 kname = (char *)result;
166
167
168
169
170
171
172 result = kzalloc(size, GFP_KERNEL);
173 if (unlikely(!result)) {
174 __putname(kname);
175 return ERR_PTR(-ENOMEM);
176 }
177 result->name = kname;
178 len = strncpy_from_user(kname, filename, PATH_MAX);
179 if (unlikely(len < 0)) {
180 __putname(kname);
181 kfree(result);
182 return ERR_PTR(len);
183 }
184 if (unlikely(len == PATH_MAX)) {
185 __putname(kname);
186 kfree(result);
187 return ERR_PTR(-ENAMETOOLONG);
188 }
189 }
190
191 result->refcnt = 1;
192
193 if (unlikely(!len)) {
194 if (empty)
195 *empty = 1;
196 if (!(flags & LOOKUP_EMPTY)) {
197 putname(result);
198 return ERR_PTR(-ENOENT);
199 }
200 }
201
202 result->uptr = filename;
203 result->aname = NULL;
204 audit_getname(result);
205 return result;
206}
207
208struct filename *
209getname(const char __user * filename)
210{
211 return getname_flags(filename, 0, NULL);
212}
213
214struct filename *
215getname_kernel(const char * filename)
216{
217 struct filename *result;
218 int len = strlen(filename) + 1;
219
220 result = __getname();
221 if (unlikely(!result))
222 return ERR_PTR(-ENOMEM);
223
224 if (len <= EMBEDDED_NAME_MAX) {
225 result->name = (char *)result->iname;
226 } else if (len <= PATH_MAX) {
227 const size_t size = offsetof(struct filename, iname[1]);
228 struct filename *tmp;
229
230 tmp = kmalloc(size, GFP_KERNEL);
231 if (unlikely(!tmp)) {
232 __putname(result);
233 return ERR_PTR(-ENOMEM);
234 }
235 tmp->name = (char *)result;
236 result = tmp;
237 } else {
238 __putname(result);
239 return ERR_PTR(-ENAMETOOLONG);
240 }
241 memcpy((char *)result->name, filename, len);
242 result->uptr = NULL;
243 result->aname = NULL;
244 result->refcnt = 1;
245 audit_getname(result);
246
247 return result;
248}
249
250void putname(struct filename *name)
251{
252 BUG_ON(name->refcnt <= 0);
253
254 if (--name->refcnt > 0)
255 return;
256
257 if (name->name != name->iname) {
258 __putname(name->name);
259 kfree(name);
260 } else
261 __putname(name);
262}
263
264static int check_acl(struct inode *inode, int mask)
265{
266#ifdef CONFIG_FS_POSIX_ACL
267 struct posix_acl *acl;
268
269 if (mask & MAY_NOT_BLOCK) {
270 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
271 if (!acl)
272 return -EAGAIN;
273
274 if (is_uncached_acl(acl))
275 return -ECHILD;
276 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
277 }
278
279 acl = get_acl(inode, ACL_TYPE_ACCESS);
280 if (IS_ERR(acl))
281 return PTR_ERR(acl);
282 if (acl) {
283 int error = posix_acl_permission(inode, acl, mask);
284 posix_acl_release(acl);
285 return error;
286 }
287#endif
288
289 return -EAGAIN;
290}
291
292
293
294
295static int acl_permission_check(struct inode *inode, int mask)
296{
297 unsigned int mode = inode->i_mode;
298
299 if (likely(uid_eq(current_fsuid(), inode->i_uid)))
300 mode >>= 6;
301 else {
302 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
303 int error = check_acl(inode, mask);
304 if (error != -EAGAIN)
305 return error;
306 }
307
308 if (in_group_p(inode->i_gid))
309 mode >>= 3;
310 }
311
312
313
314
315 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
316 return 0;
317 return -EACCES;
318}
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334int generic_permission(struct inode *inode, int mask)
335{
336 int ret;
337
338
339
340
341 ret = acl_permission_check(inode, mask);
342 if (ret != -EACCES)
343 return ret;
344
345 if (S_ISDIR(inode->i_mode)) {
346
347 if (!(mask & MAY_WRITE))
348 if (capable_wrt_inode_uidgid(inode,
349 CAP_DAC_READ_SEARCH))
350 return 0;
351 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
352 return 0;
353 return -EACCES;
354 }
355
356
357
358
359 mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
360 if (mask == MAY_READ)
361 if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))
362 return 0;
363
364
365
366
367
368 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
369 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
370 return 0;
371
372 return -EACCES;
373}
374EXPORT_SYMBOL(generic_permission);
375
376
377
378
379
380
381
382static inline int do_inode_permission(struct inode *inode, int mask)
383{
384 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
385 if (likely(inode->i_op->permission))
386 return inode->i_op->permission(inode, mask);
387
388
389 spin_lock(&inode->i_lock);
390 inode->i_opflags |= IOP_FASTPERM;
391 spin_unlock(&inode->i_lock);
392 }
393 return generic_permission(inode, mask);
394}
395
396
397
398
399
400
401
402
403
404static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
405{
406 if (unlikely(mask & MAY_WRITE)) {
407 umode_t mode = inode->i_mode;
408
409
410 if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
411 return -EROFS;
412 }
413 return 0;
414}
415
416
417
418
419
420
421
422
423
424
425
426
427int inode_permission(struct inode *inode, int mask)
428{
429 int retval;
430
431 retval = sb_permission(inode->i_sb, inode, mask);
432 if (retval)
433 return retval;
434
435 if (unlikely(mask & MAY_WRITE)) {
436
437
438
439 if (IS_IMMUTABLE(inode))
440 return -EPERM;
441
442
443
444
445
446
447 if (HAS_UNMAPPED_ID(inode))
448 return -EACCES;
449 }
450
451 retval = do_inode_permission(inode, mask);
452 if (retval)
453 return retval;
454
455 retval = devcgroup_inode_permission(inode, mask);
456 if (retval)
457 return retval;
458
459 return security_inode_permission(inode, mask);
460}
461EXPORT_SYMBOL(inode_permission);
462
463
464
465
466
467
468
469void path_get(const struct path *path)
470{
471 mntget(path->mnt);
472 dget(path->dentry);
473}
474EXPORT_SYMBOL(path_get);
475
476
477
478
479
480
481
482void path_put(const struct path *path)
483{
484 dput(path->dentry);
485 mntput(path->mnt);
486}
487EXPORT_SYMBOL(path_put);
488
489#define EMBEDDED_LEVELS 2
490struct nameidata {
491 struct path path;
492 struct qstr last;
493 struct path root;
494 struct inode *inode;
495 unsigned int flags;
496 unsigned seq, m_seq;
497 int last_type;
498 unsigned depth;
499 int total_link_count;
500 struct saved {
501 struct path link;
502 struct delayed_call done;
503 const char *name;
504 unsigned seq;
505 } *stack, internal[EMBEDDED_LEVELS];
506 struct filename *name;
507 struct nameidata *saved;
508 struct inode *link_inode;
509 unsigned root_seq;
510 int dfd;
511} __randomize_layout;
512
513static void set_nameidata(struct nameidata *p, int dfd, struct filename *name)
514{
515 struct nameidata *old = current->nameidata;
516 p->stack = p->internal;
517 p->dfd = dfd;
518 p->name = name;
519 p->total_link_count = old ? old->total_link_count : 0;
520 p->saved = old;
521 current->nameidata = p;
522}
523
524static void restore_nameidata(void)
525{
526 struct nameidata *now = current->nameidata, *old = now->saved;
527
528 current->nameidata = old;
529 if (old)
530 old->total_link_count = now->total_link_count;
531 if (now->stack != now->internal)
532 kfree(now->stack);
533}
534
535static int __nd_alloc_stack(struct nameidata *nd)
536{
537 struct saved *p;
538
539 if (nd->flags & LOOKUP_RCU) {
540 p= kmalloc(MAXSYMLINKS * sizeof(struct saved),
541 GFP_ATOMIC);
542 if (unlikely(!p))
543 return -ECHILD;
544 } else {
545 p= kmalloc(MAXSYMLINKS * sizeof(struct saved),
546 GFP_KERNEL);
547 if (unlikely(!p))
548 return -ENOMEM;
549 }
550 memcpy(p, nd->internal, sizeof(nd->internal));
551 nd->stack = p;
552 return 0;
553}
554
555
556
557
558
559
560
561
562static bool path_connected(const struct path *path)
563{
564 struct vfsmount *mnt = path->mnt;
565 struct super_block *sb = mnt->mnt_sb;
566
567
568 if (!(sb->s_iflags & SB_I_MULTIROOT) && (mnt->mnt_root == sb->s_root))
569 return true;
570
571 return is_subdir(path->dentry, mnt->mnt_root);
572}
573
574static inline int nd_alloc_stack(struct nameidata *nd)
575{
576 if (likely(nd->depth != EMBEDDED_LEVELS))
577 return 0;
578 if (likely(nd->stack != nd->internal))
579 return 0;
580 return __nd_alloc_stack(nd);
581}
582
583static void drop_links(struct nameidata *nd)
584{
585 int i = nd->depth;
586 while (i--) {
587 struct saved *last = nd->stack + i;
588 do_delayed_call(&last->done);
589 clear_delayed_call(&last->done);
590 }
591}
592
593static void terminate_walk(struct nameidata *nd)
594{
595 drop_links(nd);
596 if (!(nd->flags & LOOKUP_RCU)) {
597 int i;
598 path_put(&nd->path);
599 for (i = 0; i < nd->depth; i++)
600 path_put(&nd->stack[i].link);
601 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
602 path_put(&nd->root);
603 nd->root.mnt = NULL;
604 }
605 } else {
606 nd->flags &= ~LOOKUP_RCU;
607 if (!(nd->flags & LOOKUP_ROOT))
608 nd->root.mnt = NULL;
609 rcu_read_unlock();
610 }
611 nd->depth = 0;
612}
613
614
615static bool legitimize_path(struct nameidata *nd,
616 struct path *path, unsigned seq)
617{
618 int res = __legitimize_mnt(path->mnt, nd->m_seq);
619 if (unlikely(res)) {
620 if (res > 0)
621 path->mnt = NULL;
622 path->dentry = NULL;
623 return false;
624 }
625 if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
626 path->dentry = NULL;
627 return false;
628 }
629 return !read_seqcount_retry(&path->dentry->d_seq, seq);
630}
631
632static bool legitimize_links(struct nameidata *nd)
633{
634 int i;
635 for (i = 0; i < nd->depth; i++) {
636 struct saved *last = nd->stack + i;
637 if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
638 drop_links(nd);
639 nd->depth = i + 1;
640 return false;
641 }
642 }
643 return true;
644}
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668static int unlazy_walk(struct nameidata *nd)
669{
670 struct dentry *parent = nd->path.dentry;
671
672 BUG_ON(!(nd->flags & LOOKUP_RCU));
673
674 nd->flags &= ~LOOKUP_RCU;
675 if (unlikely(!legitimize_links(nd)))
676 goto out2;
677 if (unlikely(!legitimize_path(nd, &nd->path, nd->seq)))
678 goto out1;
679 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
680 if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq)))
681 goto out;
682 }
683 rcu_read_unlock();
684 BUG_ON(nd->inode != parent->d_inode);
685 return 0;
686
687out2:
688 nd->path.mnt = NULL;
689 nd->path.dentry = NULL;
690out1:
691 if (!(nd->flags & LOOKUP_ROOT))
692 nd->root.mnt = NULL;
693out:
694 rcu_read_unlock();
695 return -ECHILD;
696}
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711static int unlazy_child(struct nameidata *nd, struct dentry *dentry, unsigned seq)
712{
713 BUG_ON(!(nd->flags & LOOKUP_RCU));
714
715 nd->flags &= ~LOOKUP_RCU;
716 if (unlikely(!legitimize_links(nd)))
717 goto out2;
718 if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq)))
719 goto out2;
720 if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref)))
721 goto out1;
722
723
724
725
726
727
728
729
730 if (unlikely(!lockref_get_not_dead(&dentry->d_lockref)))
731 goto out;
732 if (unlikely(read_seqcount_retry(&dentry->d_seq, seq))) {
733 rcu_read_unlock();
734 dput(dentry);
735 goto drop_root_mnt;
736 }
737
738
739
740
741 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
742 if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq))) {
743 rcu_read_unlock();
744 dput(dentry);
745 return -ECHILD;
746 }
747 }
748
749 rcu_read_unlock();
750 return 0;
751
752out2:
753 nd->path.mnt = NULL;
754out1:
755 nd->path.dentry = NULL;
756out:
757 rcu_read_unlock();
758drop_root_mnt:
759 if (!(nd->flags & LOOKUP_ROOT))
760 nd->root.mnt = NULL;
761 return -ECHILD;
762}
763
764static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
765{
766 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
767 return dentry->d_op->d_revalidate(dentry, flags);
768 else
769 return 1;
770}
771
772
773
774
775
776
777
778
779
780
781
782static int complete_walk(struct nameidata *nd)
783{
784 struct dentry *dentry = nd->path.dentry;
785 int status;
786
787 if (nd->flags & LOOKUP_RCU) {
788 if (!(nd->flags & LOOKUP_ROOT))
789 nd->root.mnt = NULL;
790 if (unlikely(unlazy_walk(nd)))
791 return -ECHILD;
792 }
793
794 if (likely(!(nd->flags & LOOKUP_JUMPED)))
795 return 0;
796
797 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
798 return 0;
799
800 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
801 if (status > 0)
802 return 0;
803
804 if (!status)
805 status = -ESTALE;
806
807 return status;
808}
809
810static void set_root(struct nameidata *nd)
811{
812 struct fs_struct *fs = current->fs;
813
814 if (nd->flags & LOOKUP_RCU) {
815 unsigned seq;
816
817 do {
818 seq = read_seqcount_begin(&fs->seq);
819 nd->root = fs->root;
820 nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
821 } while (read_seqcount_retry(&fs->seq, seq));
822 } else {
823 get_fs_root(fs, &nd->root);
824 }
825}
826
827static void path_put_conditional(struct path *path, struct nameidata *nd)
828{
829 dput(path->dentry);
830 if (path->mnt != nd->path.mnt)
831 mntput(path->mnt);
832}
833
834static inline void path_to_nameidata(const struct path *path,
835 struct nameidata *nd)
836{
837 if (!(nd->flags & LOOKUP_RCU)) {
838 dput(nd->path.dentry);
839 if (nd->path.mnt != path->mnt)
840 mntput(nd->path.mnt);
841 }
842 nd->path.mnt = path->mnt;
843 nd->path.dentry = path->dentry;
844}
845
846static int nd_jump_root(struct nameidata *nd)
847{
848 if (nd->flags & LOOKUP_RCU) {
849 struct dentry *d;
850 nd->path = nd->root;
851 d = nd->path.dentry;
852 nd->inode = d->d_inode;
853 nd->seq = nd->root_seq;
854 if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq)))
855 return -ECHILD;
856 } else {
857 path_put(&nd->path);
858 nd->path = nd->root;
859 path_get(&nd->path);
860 nd->inode = nd->path.dentry->d_inode;
861 }
862 nd->flags |= LOOKUP_JUMPED;
863 return 0;
864}
865
866
867
868
869
870void nd_jump_link(struct path *path)
871{
872 struct nameidata *nd = current->nameidata;
873 path_put(&nd->path);
874
875 nd->path = *path;
876 nd->inode = nd->path.dentry->d_inode;
877 nd->flags |= LOOKUP_JUMPED;
878}
879
880static inline void put_link(struct nameidata *nd)
881{
882 struct saved *last = nd->stack + --nd->depth;
883 do_delayed_call(&last->done);
884 if (!(nd->flags & LOOKUP_RCU))
885 path_put(&last->link);
886}
887
888int sysctl_protected_symlinks __read_mostly = 0;
889int sysctl_protected_hardlinks __read_mostly = 0;
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906static inline int may_follow_link(struct nameidata *nd)
907{
908 const struct inode *inode;
909 const struct inode *parent;
910 kuid_t puid;
911
912 if (!sysctl_protected_symlinks)
913 return 0;
914
915
916 inode = nd->link_inode;
917 if (uid_eq(current_cred()->fsuid, inode->i_uid))
918 return 0;
919
920
921 parent = nd->inode;
922 if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
923 return 0;
924
925
926 puid = parent->i_uid;
927 if (uid_valid(puid) && uid_eq(puid, inode->i_uid))
928 return 0;
929
930 if (nd->flags & LOOKUP_RCU)
931 return -ECHILD;
932
933 audit_inode(nd->name, nd->stack[0].link.dentry, 0);
934 audit_log_link_denied("follow_link");
935 return -EACCES;
936}
937
938
939
940
941
942
943
944
945
946
947
948
949
950static bool safe_hardlink_source(struct inode *inode)
951{
952 umode_t mode = inode->i_mode;
953
954
955 if (!S_ISREG(mode))
956 return false;
957
958
959 if (mode & S_ISUID)
960 return false;
961
962
963 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
964 return false;
965
966
967 if (inode_permission(inode, MAY_READ | MAY_WRITE))
968 return false;
969
970 return true;
971}
972
973
974
975
976
977
978
979
980
981
982
983
984
985static int may_linkat(struct path *link)
986{
987 struct inode *inode;
988
989 if (!sysctl_protected_hardlinks)
990 return 0;
991
992 inode = link->dentry->d_inode;
993
994
995
996
997 if (safe_hardlink_source(inode) || inode_owner_or_capable(inode))
998 return 0;
999
1000 audit_log_link_denied("linkat");
1001 return -EPERM;
1002}
1003
1004static __always_inline
1005const char *get_link(struct nameidata *nd)
1006{
1007 struct saved *last = nd->stack + nd->depth - 1;
1008 struct dentry *dentry = last->link.dentry;
1009 struct inode *inode = nd->link_inode;
1010 int error;
1011 const char *res;
1012
1013 if (!(nd->flags & LOOKUP_RCU)) {
1014 touch_atime(&last->link);
1015 cond_resched();
1016 } else if (atime_needs_update_rcu(&last->link, inode)) {
1017 if (unlikely(unlazy_walk(nd)))
1018 return ERR_PTR(-ECHILD);
1019 touch_atime(&last->link);
1020 }
1021
1022 error = security_inode_follow_link(dentry, inode,
1023 nd->flags & LOOKUP_RCU);
1024 if (unlikely(error))
1025 return ERR_PTR(error);
1026
1027 nd->last_type = LAST_BIND;
1028 res = inode->i_link;
1029 if (!res) {
1030 const char * (*get)(struct dentry *, struct inode *,
1031 struct delayed_call *);
1032 get = inode->i_op->get_link;
1033 if (nd->flags & LOOKUP_RCU) {
1034 res = get(NULL, inode, &last->done);
1035 if (res == ERR_PTR(-ECHILD)) {
1036 if (unlikely(unlazy_walk(nd)))
1037 return ERR_PTR(-ECHILD);
1038 res = get(dentry, inode, &last->done);
1039 }
1040 } else {
1041 res = get(dentry, inode, &last->done);
1042 }
1043 if (IS_ERR_OR_NULL(res))
1044 return res;
1045 }
1046 if (*res == '/') {
1047 if (!nd->root.mnt)
1048 set_root(nd);
1049 if (unlikely(nd_jump_root(nd)))
1050 return ERR_PTR(-ECHILD);
1051 while (unlikely(*++res == '/'))
1052 ;
1053 }
1054 if (!*res)
1055 res = NULL;
1056 return res;
1057}
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069int follow_up(struct path *path)
1070{
1071 struct mount *mnt = real_mount(path->mnt);
1072 struct mount *parent;
1073 struct dentry *mountpoint;
1074
1075 read_seqlock_excl(&mount_lock);
1076 parent = mnt->mnt_parent;
1077 if (parent == mnt) {
1078 read_sequnlock_excl(&mount_lock);
1079 return 0;
1080 }
1081 mntget(&parent->mnt);
1082 mountpoint = dget(mnt->mnt_mountpoint);
1083 read_sequnlock_excl(&mount_lock);
1084 dput(path->dentry);
1085 path->dentry = mountpoint;
1086 mntput(path->mnt);
1087 path->mnt = &parent->mnt;
1088 return 1;
1089}
1090EXPORT_SYMBOL(follow_up);
1091
1092
1093
1094
1095
1096
1097static int follow_automount(struct path *path, struct nameidata *nd,
1098 bool *need_mntput)
1099{
1100 struct vfsmount *mnt;
1101 int err;
1102
1103 if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
1104 return -EREMOTE;
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117 if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
1118 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
1119 path->dentry->d_inode)
1120 return -EISDIR;
1121
1122 nd->total_link_count++;
1123 if (nd->total_link_count >= 40)
1124 return -ELOOP;
1125
1126 mnt = path->dentry->d_op->d_automount(path);
1127 if (IS_ERR(mnt)) {
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137 if (PTR_ERR(mnt) == -EISDIR && (nd->flags & LOOKUP_PARENT))
1138 return -EREMOTE;
1139 return PTR_ERR(mnt);
1140 }
1141
1142 if (!mnt)
1143 return 0;
1144
1145 if (!*need_mntput) {
1146
1147 mntget(path->mnt);
1148 *need_mntput = true;
1149 }
1150 err = finish_automount(mnt, path);
1151
1152 switch (err) {
1153 case -EBUSY:
1154
1155 return 0;
1156 case 0:
1157 path_put(path);
1158 path->mnt = mnt;
1159 path->dentry = dget(mnt->mnt_root);
1160 return 0;
1161 default:
1162 return err;
1163 }
1164
1165}
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177static int follow_managed(struct path *path, struct nameidata *nd)
1178{
1179 struct vfsmount *mnt = path->mnt;
1180 unsigned managed;
1181 bool need_mntput = false;
1182 int ret = 0;
1183
1184
1185
1186
1187 while (managed = READ_ONCE(path->dentry->d_flags),
1188 managed &= DCACHE_MANAGED_DENTRY,
1189 unlikely(managed != 0)) {
1190
1191
1192 if (managed & DCACHE_MANAGE_TRANSIT) {
1193 BUG_ON(!path->dentry->d_op);
1194 BUG_ON(!path->dentry->d_op->d_manage);
1195 ret = path->dentry->d_op->d_manage(path, false);
1196 if (ret < 0)
1197 break;
1198 }
1199
1200
1201 if (managed & DCACHE_MOUNTED) {
1202 struct vfsmount *mounted = lookup_mnt(path);
1203 if (mounted) {
1204 dput(path->dentry);
1205 if (need_mntput)
1206 mntput(path->mnt);
1207 path->mnt = mounted;
1208 path->dentry = dget(mounted->mnt_root);
1209 need_mntput = true;
1210 continue;
1211 }
1212
1213
1214
1215
1216
1217 }
1218
1219
1220 if (managed & DCACHE_NEED_AUTOMOUNT) {
1221 ret = follow_automount(path, nd, &need_mntput);
1222 if (ret < 0)
1223 break;
1224 continue;
1225 }
1226
1227
1228 break;
1229 }
1230
1231 if (need_mntput && path->mnt == mnt)
1232 mntput(path->mnt);
1233 if (ret == -EISDIR || !ret)
1234 ret = 1;
1235 if (need_mntput)
1236 nd->flags |= LOOKUP_JUMPED;
1237 if (unlikely(ret < 0))
1238 path_put_conditional(path, nd);
1239 return ret;
1240}
1241
1242int follow_down_one(struct path *path)
1243{
1244 struct vfsmount *mounted;
1245
1246 mounted = lookup_mnt(path);
1247 if (mounted) {
1248 dput(path->dentry);
1249 mntput(path->mnt);
1250 path->mnt = mounted;
1251 path->dentry = dget(mounted->mnt_root);
1252 return 1;
1253 }
1254 return 0;
1255}
1256EXPORT_SYMBOL(follow_down_one);
1257
1258static inline int managed_dentry_rcu(const struct path *path)
1259{
1260 return (path->dentry->d_flags & DCACHE_MANAGE_TRANSIT) ?
1261 path->dentry->d_op->d_manage(path, true) : 0;
1262}
1263
1264
1265
1266
1267
1268static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1269 struct inode **inode, unsigned *seqp)
1270{
1271 for (;;) {
1272 struct mount *mounted;
1273
1274
1275
1276
1277 switch (managed_dentry_rcu(path)) {
1278 case -ECHILD:
1279 default:
1280 return false;
1281 case -EISDIR:
1282 return true;
1283 case 0:
1284 break;
1285 }
1286
1287 if (!d_mountpoint(path->dentry))
1288 return !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
1289
1290 mounted = __lookup_mnt(path->mnt, path->dentry);
1291 if (!mounted)
1292 break;
1293 path->mnt = &mounted->mnt;
1294 path->dentry = mounted->mnt.mnt_root;
1295 nd->flags |= LOOKUP_JUMPED;
1296 *seqp = read_seqcount_begin(&path->dentry->d_seq);
1297
1298
1299
1300
1301
1302 *inode = path->dentry->d_inode;
1303 }
1304 return !read_seqretry(&mount_lock, nd->m_seq) &&
1305 !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
1306}
1307
1308static int follow_dotdot_rcu(struct nameidata *nd)
1309{
1310 struct inode *inode = nd->inode;
1311
1312 while (1) {
1313 if (path_equal(&nd->path, &nd->root))
1314 break;
1315 if (nd->path.dentry != nd->path.mnt->mnt_root) {
1316 struct dentry *old = nd->path.dentry;
1317 struct dentry *parent = old->d_parent;
1318 unsigned seq;
1319
1320 inode = parent->d_inode;
1321 seq = read_seqcount_begin(&parent->d_seq);
1322 if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq)))
1323 return -ECHILD;
1324 nd->path.dentry = parent;
1325 nd->seq = seq;
1326 if (unlikely(!path_connected(&nd->path)))
1327 return -ENOENT;
1328 break;
1329 } else {
1330 struct mount *mnt = real_mount(nd->path.mnt);
1331 struct mount *mparent = mnt->mnt_parent;
1332 struct dentry *mountpoint = mnt->mnt_mountpoint;
1333 struct inode *inode2 = mountpoint->d_inode;
1334 unsigned seq = read_seqcount_begin(&mountpoint->d_seq);
1335 if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
1336 return -ECHILD;
1337 if (&mparent->mnt == nd->path.mnt)
1338 break;
1339
1340 nd->path.dentry = mountpoint;
1341 nd->path.mnt = &mparent->mnt;
1342 inode = inode2;
1343 nd->seq = seq;
1344 }
1345 }
1346 while (unlikely(d_mountpoint(nd->path.dentry))) {
1347 struct mount *mounted;
1348 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
1349 if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
1350 return -ECHILD;
1351 if (!mounted)
1352 break;
1353 nd->path.mnt = &mounted->mnt;
1354 nd->path.dentry = mounted->mnt.mnt_root;
1355 inode = nd->path.dentry->d_inode;
1356 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
1357 }
1358 nd->inode = inode;
1359 return 0;
1360}
1361
1362
1363
1364
1365
1366
1367int follow_down(struct path *path)
1368{
1369 unsigned managed;
1370 int ret;
1371
1372 while (managed = READ_ONCE(path->dentry->d_flags),
1373 unlikely(managed & DCACHE_MANAGED_DENTRY)) {
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384 if (managed & DCACHE_MANAGE_TRANSIT) {
1385 BUG_ON(!path->dentry->d_op);
1386 BUG_ON(!path->dentry->d_op->d_manage);
1387 ret = path->dentry->d_op->d_manage(path, false);
1388 if (ret < 0)
1389 return ret == -EISDIR ? 0 : ret;
1390 }
1391
1392
1393 if (managed & DCACHE_MOUNTED) {
1394 struct vfsmount *mounted = lookup_mnt(path);
1395 if (!mounted)
1396 break;
1397 dput(path->dentry);
1398 mntput(path->mnt);
1399 path->mnt = mounted;
1400 path->dentry = dget(mounted->mnt_root);
1401 continue;
1402 }
1403
1404
1405 break;
1406 }
1407 return 0;
1408}
1409EXPORT_SYMBOL(follow_down);
1410
1411
1412
1413
1414static void follow_mount(struct path *path)
1415{
1416 while (d_mountpoint(path->dentry)) {
1417 struct vfsmount *mounted = lookup_mnt(path);
1418 if (!mounted)
1419 break;
1420 dput(path->dentry);
1421 mntput(path->mnt);
1422 path->mnt = mounted;
1423 path->dentry = dget(mounted->mnt_root);
1424 }
1425}
1426
1427static int path_parent_directory(struct path *path)
1428{
1429 struct dentry *old = path->dentry;
1430
1431 path->dentry = dget_parent(path->dentry);
1432 dput(old);
1433 if (unlikely(!path_connected(path)))
1434 return -ENOENT;
1435 return 0;
1436}
1437
1438static int follow_dotdot(struct nameidata *nd)
1439{
1440 while(1) {
1441 if (nd->path.dentry == nd->root.dentry &&
1442 nd->path.mnt == nd->root.mnt) {
1443 break;
1444 }
1445 if (nd->path.dentry != nd->path.mnt->mnt_root) {
1446 int ret = path_parent_directory(&nd->path);
1447 if (ret)
1448 return ret;
1449 break;
1450 }
1451 if (!follow_up(&nd->path))
1452 break;
1453 }
1454 follow_mount(&nd->path);
1455 nd->inode = nd->path.dentry->d_inode;
1456 return 0;
1457}
1458
1459
1460
1461
1462
1463static struct dentry *lookup_dcache(const struct qstr *name,
1464 struct dentry *dir,
1465 unsigned int flags)
1466{
1467 struct dentry *dentry = d_lookup(dir, name);
1468 if (dentry) {
1469 int error = d_revalidate(dentry, flags);
1470 if (unlikely(error <= 0)) {
1471 if (!error)
1472 d_invalidate(dentry);
1473 dput(dentry);
1474 return ERR_PTR(error);
1475 }
1476 }
1477 return dentry;
1478}
1479
1480
1481
1482
1483
1484
1485
1486
1487static struct dentry *__lookup_hash(const struct qstr *name,
1488 struct dentry *base, unsigned int flags)
1489{
1490 struct dentry *dentry = lookup_dcache(name, base, flags);
1491 struct dentry *old;
1492 struct inode *dir = base->d_inode;
1493
1494 if (dentry)
1495 return dentry;
1496
1497
1498 if (unlikely(IS_DEADDIR(dir)))
1499 return ERR_PTR(-ENOENT);
1500
1501 dentry = d_alloc(base, name);
1502 if (unlikely(!dentry))
1503 return ERR_PTR(-ENOMEM);
1504
1505 old = dir->i_op->lookup(dir, dentry, flags);
1506 if (unlikely(old)) {
1507 dput(dentry);
1508 dentry = old;
1509 }
1510 return dentry;
1511}
1512
1513static int lookup_fast(struct nameidata *nd,
1514 struct path *path, struct inode **inode,
1515 unsigned *seqp)
1516{
1517 struct vfsmount *mnt = nd->path.mnt;
1518 struct dentry *dentry, *parent = nd->path.dentry;
1519 int status = 1;
1520 int err;
1521
1522
1523
1524
1525
1526
1527 if (nd->flags & LOOKUP_RCU) {
1528 unsigned seq;
1529 bool negative;
1530 dentry = __d_lookup_rcu(parent, &nd->last, &seq);
1531 if (unlikely(!dentry)) {
1532 if (unlazy_walk(nd))
1533 return -ECHILD;
1534 return 0;
1535 }
1536
1537
1538
1539
1540
1541 *inode = d_backing_inode(dentry);
1542 negative = d_is_negative(dentry);
1543 if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
1544 return -ECHILD;
1545
1546
1547
1548
1549
1550
1551
1552
1553 if (unlikely(__read_seqcount_retry(&parent->d_seq, nd->seq)))
1554 return -ECHILD;
1555
1556 *seqp = seq;
1557 status = d_revalidate(dentry, nd->flags);
1558 if (likely(status > 0)) {
1559
1560
1561
1562
1563 if (unlikely(negative))
1564 return -ENOENT;
1565 path->mnt = mnt;
1566 path->dentry = dentry;
1567 if (likely(__follow_mount_rcu(nd, path, inode, seqp)))
1568 return 1;
1569 }
1570 if (unlazy_child(nd, dentry, seq))
1571 return -ECHILD;
1572 if (unlikely(status == -ECHILD))
1573
1574 status = d_revalidate(dentry, nd->flags);
1575 } else {
1576 dentry = __d_lookup(parent, &nd->last);
1577 if (unlikely(!dentry))
1578 return 0;
1579 status = d_revalidate(dentry, nd->flags);
1580 }
1581 if (unlikely(status <= 0)) {
1582 if (!status)
1583 d_invalidate(dentry);
1584 dput(dentry);
1585 return status;
1586 }
1587 if (unlikely(d_is_negative(dentry))) {
1588 dput(dentry);
1589 return -ENOENT;
1590 }
1591
1592 path->mnt = mnt;
1593 path->dentry = dentry;
1594 err = follow_managed(path, nd);
1595 if (likely(err > 0))
1596 *inode = d_backing_inode(path->dentry);
1597 return err;
1598}
1599
1600
1601static struct dentry *__lookup_slow(const struct qstr *name,
1602 struct dentry *dir,
1603 unsigned int flags)
1604{
1605 struct dentry *dentry, *old;
1606 struct inode *inode = dir->d_inode;
1607 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
1608
1609
1610 if (unlikely(IS_DEADDIR(inode)))
1611 return ERR_PTR(-ENOENT);
1612again:
1613 dentry = d_alloc_parallel(dir, name, &wq);
1614 if (IS_ERR(dentry))
1615 return dentry;
1616 if (unlikely(!d_in_lookup(dentry))) {
1617 if (!(flags & LOOKUP_NO_REVAL)) {
1618 int error = d_revalidate(dentry, flags);
1619 if (unlikely(error <= 0)) {
1620 if (!error) {
1621 d_invalidate(dentry);
1622 dput(dentry);
1623 goto again;
1624 }
1625 dput(dentry);
1626 dentry = ERR_PTR(error);
1627 }
1628 }
1629 } else {
1630 old = inode->i_op->lookup(inode, dentry, flags);
1631 d_lookup_done(dentry);
1632 if (unlikely(old)) {
1633 dput(dentry);
1634 dentry = old;
1635 }
1636 }
1637 return dentry;
1638}
1639
1640static struct dentry *lookup_slow(const struct qstr *name,
1641 struct dentry *dir,
1642 unsigned int flags)
1643{
1644 struct inode *inode = dir->d_inode;
1645 struct dentry *res;
1646 inode_lock_shared(inode);
1647 res = __lookup_slow(name, dir, flags);
1648 inode_unlock_shared(inode);
1649 return res;
1650}
1651
1652static inline int may_lookup(struct nameidata *nd)
1653{
1654 if (nd->flags & LOOKUP_RCU) {
1655 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1656 if (err != -ECHILD)
1657 return err;
1658 if (unlazy_walk(nd))
1659 return -ECHILD;
1660 }
1661 return inode_permission(nd->inode, MAY_EXEC);
1662}
1663
1664static inline int handle_dots(struct nameidata *nd, int type)
1665{
1666 if (type == LAST_DOTDOT) {
1667 if (!nd->root.mnt)
1668 set_root(nd);
1669 if (nd->flags & LOOKUP_RCU) {
1670 return follow_dotdot_rcu(nd);
1671 } else
1672 return follow_dotdot(nd);
1673 }
1674 return 0;
1675}
1676
1677static int pick_link(struct nameidata *nd, struct path *link,
1678 struct inode *inode, unsigned seq)
1679{
1680 int error;
1681 struct saved *last;
1682 if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) {
1683 path_to_nameidata(link, nd);
1684 return -ELOOP;
1685 }
1686 if (!(nd->flags & LOOKUP_RCU)) {
1687 if (link->mnt == nd->path.mnt)
1688 mntget(link->mnt);
1689 }
1690 error = nd_alloc_stack(nd);
1691 if (unlikely(error)) {
1692 if (error == -ECHILD) {
1693 if (unlikely(!legitimize_path(nd, link, seq))) {
1694 drop_links(nd);
1695 nd->depth = 0;
1696 nd->flags &= ~LOOKUP_RCU;
1697 nd->path.mnt = NULL;
1698 nd->path.dentry = NULL;
1699 if (!(nd->flags & LOOKUP_ROOT))
1700 nd->root.mnt = NULL;
1701 rcu_read_unlock();
1702 } else if (likely(unlazy_walk(nd)) == 0)
1703 error = nd_alloc_stack(nd);
1704 }
1705 if (error) {
1706 path_put(link);
1707 return error;
1708 }
1709 }
1710
1711 last = nd->stack + nd->depth++;
1712 last->link = *link;
1713 clear_delayed_call(&last->done);
1714 nd->link_inode = inode;
1715 last->seq = seq;
1716 return 1;
1717}
1718
1719enum {WALK_FOLLOW = 1, WALK_MORE = 2};
1720
1721
1722
1723
1724
1725
1726
1727static inline int step_into(struct nameidata *nd, struct path *path,
1728 int flags, struct inode *inode, unsigned seq)
1729{
1730 if (!(flags & WALK_MORE) && nd->depth)
1731 put_link(nd);
1732 if (likely(!d_is_symlink(path->dentry)) ||
1733 !(flags & WALK_FOLLOW || nd->flags & LOOKUP_FOLLOW)) {
1734
1735 path_to_nameidata(path, nd);
1736 nd->inode = inode;
1737 nd->seq = seq;
1738 return 0;
1739 }
1740
1741 if (nd->flags & LOOKUP_RCU) {
1742 if (read_seqcount_retry(&path->dentry->d_seq, seq))
1743 return -ECHILD;
1744 }
1745 return pick_link(nd, path, inode, seq);
1746}
1747
1748static int walk_component(struct nameidata *nd, int flags)
1749{
1750 struct path path;
1751 struct inode *inode;
1752 unsigned seq;
1753 int err;
1754
1755
1756
1757
1758
1759 if (unlikely(nd->last_type != LAST_NORM)) {
1760 err = handle_dots(nd, nd->last_type);
1761 if (!(flags & WALK_MORE) && nd->depth)
1762 put_link(nd);
1763 return err;
1764 }
1765 err = lookup_fast(nd, &path, &inode, &seq);
1766 if (unlikely(err <= 0)) {
1767 if (err < 0)
1768 return err;
1769 path.dentry = lookup_slow(&nd->last, nd->path.dentry,
1770 nd->flags);
1771 if (IS_ERR(path.dentry))
1772 return PTR_ERR(path.dentry);
1773
1774 path.mnt = nd->path.mnt;
1775 err = follow_managed(&path, nd);
1776 if (unlikely(err < 0))
1777 return err;
1778
1779 if (unlikely(d_is_negative(path.dentry))) {
1780 path_to_nameidata(&path, nd);
1781 return -ENOENT;
1782 }
1783
1784 seq = 0;
1785 inode = d_backing_inode(path.dentry);
1786 }
1787
1788 return step_into(nd, &path, flags, inode, seq);
1789}
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808#ifdef CONFIG_DCACHE_WORD_ACCESS
1809
1810#include <asm/word-at-a-time.h>
1811
1812#ifdef HASH_MIX
1813
1814
1815
1816#elif defined(CONFIG_64BIT)
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846#define HASH_MIX(x, y, a) \
1847 ( x ^= (a), \
1848 y ^= x, x = rol64(x,12),\
1849 x += y, y = rol64(y,45),\
1850 y *= 9 )
1851
1852
1853
1854
1855
1856
1857static inline unsigned int fold_hash(unsigned long x, unsigned long y)
1858{
1859 y ^= x * GOLDEN_RATIO_64;
1860 y *= GOLDEN_RATIO_64;
1861 return y >> 32;
1862}
1863
1864#else
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876#define HASH_MIX(x, y, a) \
1877 ( x ^= (a), \
1878 y ^= x, x = rol32(x, 7),\
1879 x += y, y = rol32(y,20),\
1880 y *= 9 )
1881
1882static inline unsigned int fold_hash(unsigned long x, unsigned long y)
1883{
1884
1885 return __hash_32(y ^ __hash_32(x));
1886}
1887
1888#endif
1889
1890
1891
1892
1893
1894
1895
1896
1897unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
1898{
1899 unsigned long a, x = 0, y = (unsigned long)salt;
1900
1901 for (;;) {
1902 if (!len)
1903 goto done;
1904 a = load_unaligned_zeropad(name);
1905 if (len < sizeof(unsigned long))
1906 break;
1907 HASH_MIX(x, y, a);
1908 name += sizeof(unsigned long);
1909 len -= sizeof(unsigned long);
1910 }
1911 x ^= a & bytemask_from_count(len);
1912done:
1913 return fold_hash(x, y);
1914}
1915EXPORT_SYMBOL(full_name_hash);
1916
1917
1918u64 hashlen_string(const void *salt, const char *name)
1919{
1920 unsigned long a = 0, x = 0, y = (unsigned long)salt;
1921 unsigned long adata, mask, len;
1922 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1923
1924 len = 0;
1925 goto inside;
1926
1927 do {
1928 HASH_MIX(x, y, a);
1929 len += sizeof(unsigned long);
1930inside:
1931 a = load_unaligned_zeropad(name+len);
1932 } while (!has_zero(a, &adata, &constants));
1933
1934 adata = prep_zero_mask(a, adata, &constants);
1935 mask = create_zero_mask(adata);
1936 x ^= a & zero_bytemask(mask);
1937
1938 return hashlen_create(fold_hash(x, y), len + find_zero(mask));
1939}
1940EXPORT_SYMBOL(hashlen_string);
1941
1942
1943
1944
1945
1946static inline u64 hash_name(const void *salt, const char *name)
1947{
1948 unsigned long a = 0, b, x = 0, y = (unsigned long)salt;
1949 unsigned long adata, bdata, mask, len;
1950 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1951
1952 len = 0;
1953 goto inside;
1954
1955 do {
1956 HASH_MIX(x, y, a);
1957 len += sizeof(unsigned long);
1958inside:
1959 a = load_unaligned_zeropad(name+len);
1960 b = a ^ REPEAT_BYTE('/');
1961 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
1962
1963 adata = prep_zero_mask(a, adata, &constants);
1964 bdata = prep_zero_mask(b, bdata, &constants);
1965 mask = create_zero_mask(adata | bdata);
1966 x ^= a & zero_bytemask(mask);
1967
1968 return hashlen_create(fold_hash(x, y), len + find_zero(mask));
1969}
1970
1971#else
1972
1973
1974unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
1975{
1976 unsigned long hash = init_name_hash(salt);
1977 while (len--)
1978 hash = partial_name_hash((unsigned char)*name++, hash);
1979 return end_name_hash(hash);
1980}
1981EXPORT_SYMBOL(full_name_hash);
1982
1983
1984u64 hashlen_string(const void *salt, const char *name)
1985{
1986 unsigned long hash = init_name_hash(salt);
1987 unsigned long len = 0, c;
1988
1989 c = (unsigned char)*name;
1990 while (c) {
1991 len++;
1992 hash = partial_name_hash(c, hash);
1993 c = (unsigned char)name[len];
1994 }
1995 return hashlen_create(end_name_hash(hash), len);
1996}
1997EXPORT_SYMBOL(hashlen_string);
1998
1999
2000
2001
2002
2003static inline u64 hash_name(const void *salt, const char *name)
2004{
2005 unsigned long hash = init_name_hash(salt);
2006 unsigned long len = 0, c;
2007
2008 c = (unsigned char)*name;
2009 do {
2010 len++;
2011 hash = partial_name_hash(c, hash);
2012 c = (unsigned char)name[len];
2013 } while (c && c != '/');
2014 return hashlen_create(end_name_hash(hash), len);
2015}
2016
2017#endif
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027static int link_path_walk(const char *name, struct nameidata *nd)
2028{
2029 int err;
2030
2031 while (*name=='/')
2032 name++;
2033 if (!*name)
2034 return 0;
2035
2036
2037 for(;;) {
2038 u64 hash_len;
2039 int type;
2040
2041 err = may_lookup(nd);
2042 if (err)
2043 return err;
2044
2045 hash_len = hash_name(nd->path.dentry, name);
2046
2047 type = LAST_NORM;
2048 if (name[0] == '.') switch (hashlen_len(hash_len)) {
2049 case 2:
2050 if (name[1] == '.') {
2051 type = LAST_DOTDOT;
2052 nd->flags |= LOOKUP_JUMPED;
2053 }
2054 break;
2055 case 1:
2056 type = LAST_DOT;
2057 }
2058 if (likely(type == LAST_NORM)) {
2059 struct dentry *parent = nd->path.dentry;
2060 nd->flags &= ~LOOKUP_JUMPED;
2061 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
2062 struct qstr this = { { .hash_len = hash_len }, .name = name };
2063 err = parent->d_op->d_hash(parent, &this);
2064 if (err < 0)
2065 return err;
2066 hash_len = this.hash_len;
2067 name = this.name;
2068 }
2069 }
2070
2071 nd->last.hash_len = hash_len;
2072 nd->last.name = name;
2073 nd->last_type = type;
2074
2075 name += hashlen_len(hash_len);
2076 if (!*name)
2077 goto OK;
2078
2079
2080
2081
2082 do {
2083 name++;
2084 } while (unlikely(*name == '/'));
2085 if (unlikely(!*name)) {
2086OK:
2087
2088 if (!nd->depth)
2089 return 0;
2090 name = nd->stack[nd->depth - 1].name;
2091
2092 if (!name)
2093 return 0;
2094
2095 err = walk_component(nd, WALK_FOLLOW);
2096 } else {
2097
2098 err = walk_component(nd, WALK_FOLLOW | WALK_MORE);
2099 }
2100 if (err < 0)
2101 return err;
2102
2103 if (err) {
2104 const char *s = get_link(nd);
2105
2106 if (IS_ERR(s))
2107 return PTR_ERR(s);
2108 err = 0;
2109 if (unlikely(!s)) {
2110
2111 put_link(nd);
2112 } else {
2113 nd->stack[nd->depth - 1].name = name;
2114 name = s;
2115 continue;
2116 }
2117 }
2118 if (unlikely(!d_can_lookup(nd->path.dentry))) {
2119 if (nd->flags & LOOKUP_RCU) {
2120 if (unlazy_walk(nd))
2121 return -ECHILD;
2122 }
2123 return -ENOTDIR;
2124 }
2125 }
2126}
2127
2128static const char *path_init(struct nameidata *nd, unsigned flags)
2129{
2130 const char *s = nd->name->name;
2131
2132 if (!*s)
2133 flags &= ~LOOKUP_RCU;
2134
2135 nd->last_type = LAST_ROOT;
2136 nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT;
2137 nd->depth = 0;
2138 if (flags & LOOKUP_ROOT) {
2139 struct dentry *root = nd->root.dentry;
2140 struct inode *inode = root->d_inode;
2141 if (*s && unlikely(!d_can_lookup(root)))
2142 return ERR_PTR(-ENOTDIR);
2143 nd->path = nd->root;
2144 nd->inode = inode;
2145 if (flags & LOOKUP_RCU) {
2146 rcu_read_lock();
2147 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2148 nd->root_seq = nd->seq;
2149 nd->m_seq = read_seqbegin(&mount_lock);
2150 } else {
2151 path_get(&nd->path);
2152 }
2153 return s;
2154 }
2155
2156 nd->root.mnt = NULL;
2157 nd->path.mnt = NULL;
2158 nd->path.dentry = NULL;
2159
2160 nd->m_seq = read_seqbegin(&mount_lock);
2161 if (*s == '/') {
2162 if (flags & LOOKUP_RCU)
2163 rcu_read_lock();
2164 set_root(nd);
2165 if (likely(!nd_jump_root(nd)))
2166 return s;
2167 nd->root.mnt = NULL;
2168 rcu_read_unlock();
2169 return ERR_PTR(-ECHILD);
2170 } else if (nd->dfd == AT_FDCWD) {
2171 if (flags & LOOKUP_RCU) {
2172 struct fs_struct *fs = current->fs;
2173 unsigned seq;
2174
2175 rcu_read_lock();
2176
2177 do {
2178 seq = read_seqcount_begin(&fs->seq);
2179 nd->path = fs->pwd;
2180 nd->inode = nd->path.dentry->d_inode;
2181 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2182 } while (read_seqcount_retry(&fs->seq, seq));
2183 } else {
2184 get_fs_pwd(current->fs, &nd->path);
2185 nd->inode = nd->path.dentry->d_inode;
2186 }
2187 return s;
2188 } else {
2189
2190 struct fd f = fdget_raw(nd->dfd);
2191 struct dentry *dentry;
2192
2193 if (!f.file)
2194 return ERR_PTR(-EBADF);
2195
2196 dentry = f.file->f_path.dentry;
2197
2198 if (*s) {
2199 if (!d_can_lookup(dentry)) {
2200 fdput(f);
2201 return ERR_PTR(-ENOTDIR);
2202 }
2203 }
2204
2205 nd->path = f.file->f_path;
2206 if (flags & LOOKUP_RCU) {
2207 rcu_read_lock();
2208 nd->inode = nd->path.dentry->d_inode;
2209 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2210 } else {
2211 path_get(&nd->path);
2212 nd->inode = nd->path.dentry->d_inode;
2213 }
2214 fdput(f);
2215 return s;
2216 }
2217}
2218
2219static const char *trailing_symlink(struct nameidata *nd)
2220{
2221 const char *s;
2222 int error = may_follow_link(nd);
2223 if (unlikely(error))
2224 return ERR_PTR(error);
2225 nd->flags |= LOOKUP_PARENT;
2226 nd->stack[0].name = NULL;
2227 s = get_link(nd);
2228 return s ? s : "";
2229}
2230
2231static inline int lookup_last(struct nameidata *nd)
2232{
2233 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
2234 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2235
2236 nd->flags &= ~LOOKUP_PARENT;
2237 return walk_component(nd, 0);
2238}
2239
2240static int handle_lookup_down(struct nameidata *nd)
2241{
2242 struct path path = nd->path;
2243 struct inode *inode = nd->inode;
2244 unsigned seq = nd->seq;
2245 int err;
2246
2247 if (nd->flags & LOOKUP_RCU) {
2248
2249
2250
2251
2252
2253 if (unlikely(!__follow_mount_rcu(nd, &path, &inode, &seq)))
2254 return -ECHILD;
2255 } else {
2256 dget(path.dentry);
2257 err = follow_managed(&path, nd);
2258 if (unlikely(err < 0))
2259 return err;
2260 inode = d_backing_inode(path.dentry);
2261 seq = 0;
2262 }
2263 path_to_nameidata(&path, nd);
2264 nd->inode = inode;
2265 nd->seq = seq;
2266 return 0;
2267}
2268
2269
2270static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2271{
2272 const char *s = path_init(nd, flags);
2273 int err;
2274
2275 if (IS_ERR(s))
2276 return PTR_ERR(s);
2277
2278 if (unlikely(flags & LOOKUP_DOWN)) {
2279 err = handle_lookup_down(nd);
2280 if (unlikely(err < 0)) {
2281 terminate_walk(nd);
2282 return err;
2283 }
2284 }
2285
2286 while (!(err = link_path_walk(s, nd))
2287 && ((err = lookup_last(nd)) > 0)) {
2288 s = trailing_symlink(nd);
2289 if (IS_ERR(s)) {
2290 err = PTR_ERR(s);
2291 break;
2292 }
2293 }
2294 if (!err)
2295 err = complete_walk(nd);
2296
2297 if (!err && nd->flags & LOOKUP_DIRECTORY)
2298 if (!d_can_lookup(nd->path.dentry))
2299 err = -ENOTDIR;
2300 if (!err) {
2301 *path = nd->path;
2302 nd->path.mnt = NULL;
2303 nd->path.dentry = NULL;
2304 }
2305 terminate_walk(nd);
2306 return err;
2307}
2308
2309static int filename_lookup(int dfd, struct filename *name, unsigned flags,
2310 struct path *path, struct path *root)
2311{
2312 int retval;
2313 struct nameidata nd;
2314 if (IS_ERR(name))
2315 return PTR_ERR(name);
2316 if (unlikely(root)) {
2317 nd.root = *root;
2318 flags |= LOOKUP_ROOT;
2319 }
2320 set_nameidata(&nd, dfd, name);
2321 retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
2322 if (unlikely(retval == -ECHILD))
2323 retval = path_lookupat(&nd, flags, path);
2324 if (unlikely(retval == -ESTALE))
2325 retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
2326
2327 if (likely(!retval))
2328 audit_inode(name, path->dentry, flags & LOOKUP_PARENT);
2329 restore_nameidata();
2330 putname(name);
2331 return retval;
2332}
2333
2334
2335static int path_parentat(struct nameidata *nd, unsigned flags,
2336 struct path *parent)
2337{
2338 const char *s = path_init(nd, flags);
2339 int err;
2340 if (IS_ERR(s))
2341 return PTR_ERR(s);
2342 err = link_path_walk(s, nd);
2343 if (!err)
2344 err = complete_walk(nd);
2345 if (!err) {
2346 *parent = nd->path;
2347 nd->path.mnt = NULL;
2348 nd->path.dentry = NULL;
2349 }
2350 terminate_walk(nd);
2351 return err;
2352}
2353
2354static struct filename *filename_parentat(int dfd, struct filename *name,
2355 unsigned int flags, struct path *parent,
2356 struct qstr *last, int *type)
2357{
2358 int retval;
2359 struct nameidata nd;
2360
2361 if (IS_ERR(name))
2362 return name;
2363 set_nameidata(&nd, dfd, name);
2364 retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
2365 if (unlikely(retval == -ECHILD))
2366 retval = path_parentat(&nd, flags, parent);
2367 if (unlikely(retval == -ESTALE))
2368 retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
2369 if (likely(!retval)) {
2370 *last = nd.last;
2371 *type = nd.last_type;
2372 audit_inode(name, parent->dentry, LOOKUP_PARENT);
2373 } else {
2374 putname(name);
2375 name = ERR_PTR(retval);
2376 }
2377 restore_nameidata();
2378 return name;
2379}
2380
2381
2382struct dentry *kern_path_locked(const char *name, struct path *path)
2383{
2384 struct filename *filename;
2385 struct dentry *d;
2386 struct qstr last;
2387 int type;
2388
2389 filename = filename_parentat(AT_FDCWD, getname_kernel(name), 0, path,
2390 &last, &type);
2391 if (IS_ERR(filename))
2392 return ERR_CAST(filename);
2393 if (unlikely(type != LAST_NORM)) {
2394 path_put(path);
2395 putname(filename);
2396 return ERR_PTR(-EINVAL);
2397 }
2398 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
2399 d = __lookup_hash(&last, path->dentry, 0);
2400 if (IS_ERR(d)) {
2401 inode_unlock(path->dentry->d_inode);
2402 path_put(path);
2403 }
2404 putname(filename);
2405 return d;
2406}
2407
2408int kern_path(const char *name, unsigned int flags, struct path *path)
2409{
2410 return filename_lookup(AT_FDCWD, getname_kernel(name),
2411 flags, path, NULL);
2412}
2413EXPORT_SYMBOL(kern_path);
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
2424 const char *name, unsigned int flags,
2425 struct path *path)
2426{
2427 struct path root = {.mnt = mnt, .dentry = dentry};
2428
2429 return filename_lookup(AT_FDCWD, getname_kernel(name),
2430 flags , path, &root);
2431}
2432EXPORT_SYMBOL(vfs_path_lookup);
2433
2434static int lookup_one_len_common(const char *name, struct dentry *base,
2435 int len, struct qstr *this)
2436{
2437 this->name = name;
2438 this->len = len;
2439 this->hash = full_name_hash(base, name, len);
2440 if (!len)
2441 return -EACCES;
2442
2443 if (unlikely(name[0] == '.')) {
2444 if (len < 2 || (len == 2 && name[1] == '.'))
2445 return -EACCES;
2446 }
2447
2448 while (len--) {
2449 unsigned int c = *(const unsigned char *)name++;
2450 if (c == '/' || c == '\0')
2451 return -EACCES;
2452 }
2453
2454
2455
2456
2457 if (base->d_flags & DCACHE_OP_HASH) {
2458 int err = base->d_op->d_hash(base, this);
2459 if (err < 0)
2460 return err;
2461 }
2462
2463 return inode_permission(base->d_inode, MAY_EXEC);
2464}
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
2478{
2479 struct dentry *dentry;
2480 struct qstr this;
2481 int err;
2482
2483 WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2484
2485 err = lookup_one_len_common(name, base, len, &this);
2486 if (err)
2487 return ERR_PTR(err);
2488
2489 dentry = lookup_dcache(&this, base, 0);
2490 return dentry ? dentry : __lookup_slow(&this, base, 0);
2491}
2492EXPORT_SYMBOL(lookup_one_len);
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506struct dentry *lookup_one_len_unlocked(const char *name,
2507 struct dentry *base, int len)
2508{
2509 struct qstr this;
2510 int err;
2511 struct dentry *ret;
2512
2513 err = lookup_one_len_common(name, base, len, &this);
2514 if (err)
2515 return ERR_PTR(err);
2516
2517 ret = lookup_dcache(&this, base, 0);
2518 if (!ret)
2519 ret = lookup_slow(&this, base, 0);
2520 return ret;
2521}
2522EXPORT_SYMBOL(lookup_one_len_unlocked);
2523
2524#ifdef CONFIG_UNIX98_PTYS
2525int path_pts(struct path *path)
2526{
2527
2528
2529
2530 struct dentry *child, *parent;
2531 struct qstr this;
2532 int ret;
2533
2534 ret = path_parent_directory(path);
2535 if (ret)
2536 return ret;
2537
2538 parent = path->dentry;
2539 this.name = "pts";
2540 this.len = 3;
2541 child = d_hash_and_lookup(parent, &this);
2542 if (!child)
2543 return -ENOENT;
2544
2545 path->dentry = child;
2546 dput(parent);
2547 follow_mount(path);
2548 return 0;
2549}
2550#endif
2551
2552int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
2553 struct path *path, int *empty)
2554{
2555 return filename_lookup(dfd, getname_flags(name, flags, empty),
2556 flags, path, NULL);
2557}
2558EXPORT_SYMBOL(user_path_at_empty);
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583static int
2584mountpoint_last(struct nameidata *nd)
2585{
2586 int error = 0;
2587 struct dentry *dir = nd->path.dentry;
2588 struct path path;
2589
2590
2591 if (nd->flags & LOOKUP_RCU) {
2592 if (unlazy_walk(nd))
2593 return -ECHILD;
2594 }
2595
2596 nd->flags &= ~LOOKUP_PARENT;
2597
2598 if (unlikely(nd->last_type != LAST_NORM)) {
2599 error = handle_dots(nd, nd->last_type);
2600 if (error)
2601 return error;
2602 path.dentry = dget(nd->path.dentry);
2603 } else {
2604 path.dentry = d_lookup(dir, &nd->last);
2605 if (!path.dentry) {
2606
2607
2608
2609
2610
2611
2612 path.dentry = lookup_slow(&nd->last, dir,
2613 nd->flags | LOOKUP_NO_REVAL);
2614 if (IS_ERR(path.dentry))
2615 return PTR_ERR(path.dentry);
2616 }
2617 }
2618 if (d_is_negative(path.dentry)) {
2619 dput(path.dentry);
2620 return -ENOENT;
2621 }
2622 path.mnt = nd->path.mnt;
2623 return step_into(nd, &path, 0, d_backing_inode(path.dentry), 0);
2624}
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635static int
2636path_mountpoint(struct nameidata *nd, unsigned flags, struct path *path)
2637{
2638 const char *s = path_init(nd, flags);
2639 int err;
2640 if (IS_ERR(s))
2641 return PTR_ERR(s);
2642 while (!(err = link_path_walk(s, nd)) &&
2643 (err = mountpoint_last(nd)) > 0) {
2644 s = trailing_symlink(nd);
2645 if (IS_ERR(s)) {
2646 err = PTR_ERR(s);
2647 break;
2648 }
2649 }
2650 if (!err) {
2651 *path = nd->path;
2652 nd->path.mnt = NULL;
2653 nd->path.dentry = NULL;
2654 follow_mount(path);
2655 }
2656 terminate_walk(nd);
2657 return err;
2658}
2659
2660static int
2661filename_mountpoint(int dfd, struct filename *name, struct path *path,
2662 unsigned int flags)
2663{
2664 struct nameidata nd;
2665 int error;
2666 if (IS_ERR(name))
2667 return PTR_ERR(name);
2668 set_nameidata(&nd, dfd, name);
2669 error = path_mountpoint(&nd, flags | LOOKUP_RCU, path);
2670 if (unlikely(error == -ECHILD))
2671 error = path_mountpoint(&nd, flags, path);
2672 if (unlikely(error == -ESTALE))
2673 error = path_mountpoint(&nd, flags | LOOKUP_REVAL, path);
2674 if (likely(!error))
2675 audit_inode(name, path->dentry, 0);
2676 restore_nameidata();
2677 putname(name);
2678 return error;
2679}
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695int
2696user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags,
2697 struct path *path)
2698{
2699 return filename_mountpoint(dfd, getname(name), path, flags);
2700}
2701
2702int
2703kern_path_mountpoint(int dfd, const char *name, struct path *path,
2704 unsigned int flags)
2705{
2706 return filename_mountpoint(dfd, getname_kernel(name), path, flags);
2707}
2708EXPORT_SYMBOL(kern_path_mountpoint);
2709
2710int __check_sticky(struct inode *dir, struct inode *inode)
2711{
2712 kuid_t fsuid = current_fsuid();
2713
2714 if (uid_eq(inode->i_uid, fsuid))
2715 return 0;
2716 if (uid_eq(dir->i_uid, fsuid))
2717 return 0;
2718 return !capable_wrt_inode_uidgid(inode, CAP_FOWNER);
2719}
2720EXPORT_SYMBOL(__check_sticky);
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742static int may_delete(struct inode *dir, struct dentry *victim, bool isdir)
2743{
2744 struct inode *inode = d_backing_inode(victim);
2745 int error;
2746
2747 if (d_is_negative(victim))
2748 return -ENOENT;
2749 BUG_ON(!inode);
2750
2751 BUG_ON(victim->d_parent->d_inode != dir);
2752 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2753
2754 error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
2755 if (error)
2756 return error;
2757 if (IS_APPEND(dir))
2758 return -EPERM;
2759
2760 if (check_sticky(dir, inode) || IS_APPEND(inode) ||
2761 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) || HAS_UNMAPPED_ID(inode))
2762 return -EPERM;
2763 if (isdir) {
2764 if (!d_is_dir(victim))
2765 return -ENOTDIR;
2766 if (IS_ROOT(victim))
2767 return -EBUSY;
2768 } else if (d_is_dir(victim))
2769 return -EISDIR;
2770 if (IS_DEADDIR(dir))
2771 return -ENOENT;
2772 if (victim->d_flags & DCACHE_NFSFS_RENAMED)
2773 return -EBUSY;
2774 return 0;
2775}
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786static inline int may_create(struct inode *dir, struct dentry *child)
2787{
2788 struct user_namespace *s_user_ns;
2789 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
2790 if (child->d_inode)
2791 return -EEXIST;
2792 if (IS_DEADDIR(dir))
2793 return -ENOENT;
2794 s_user_ns = dir->i_sb->s_user_ns;
2795 if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||
2796 !kgid_has_mapping(s_user_ns, current_fsgid()))
2797 return -EOVERFLOW;
2798 return inode_permission(dir, MAY_WRITE | MAY_EXEC);
2799}
2800
2801
2802
2803
2804struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
2805{
2806 struct dentry *p;
2807
2808 if (p1 == p2) {
2809 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2810 return NULL;
2811 }
2812
2813 mutex_lock(&p1->d_sb->s_vfs_rename_mutex);
2814
2815 p = d_ancestor(p2, p1);
2816 if (p) {
2817 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
2818 inode_lock_nested(p1->d_inode, I_MUTEX_CHILD);
2819 return p;
2820 }
2821
2822 p = d_ancestor(p1, p2);
2823 if (p) {
2824 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2825 inode_lock_nested(p2->d_inode, I_MUTEX_CHILD);
2826 return p;
2827 }
2828
2829 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2830 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
2831 return NULL;
2832}
2833EXPORT_SYMBOL(lock_rename);
2834
2835void unlock_rename(struct dentry *p1, struct dentry *p2)
2836{
2837 inode_unlock(p1->d_inode);
2838 if (p1 != p2) {
2839 inode_unlock(p2->d_inode);
2840 mutex_unlock(&p1->d_sb->s_vfs_rename_mutex);
2841 }
2842}
2843EXPORT_SYMBOL(unlock_rename);
2844
2845int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
2846 bool want_excl)
2847{
2848 int error = may_create(dir, dentry);
2849 if (error)
2850 return error;
2851
2852 if (!dir->i_op->create)
2853 return -EACCES;
2854 mode &= S_IALLUGO;
2855 mode |= S_IFREG;
2856 error = security_inode_create(dir, dentry, mode);
2857 if (error)
2858 return error;
2859 error = dir->i_op->create(dir, dentry, mode, want_excl);
2860 if (!error)
2861 fsnotify_create(dir, dentry);
2862 return error;
2863}
2864EXPORT_SYMBOL(vfs_create);
2865
2866int vfs_mkobj(struct dentry *dentry, umode_t mode,
2867 int (*f)(struct dentry *, umode_t, void *),
2868 void *arg)
2869{
2870 struct inode *dir = dentry->d_parent->d_inode;
2871 int error = may_create(dir, dentry);
2872 if (error)
2873 return error;
2874
2875 mode &= S_IALLUGO;
2876 mode |= S_IFREG;
2877 error = security_inode_create(dir, dentry, mode);
2878 if (error)
2879 return error;
2880 error = f(dentry, mode, arg);
2881 if (!error)
2882 fsnotify_create(dir, dentry);
2883 return error;
2884}
2885EXPORT_SYMBOL(vfs_mkobj);
2886
2887bool may_open_dev(const struct path *path)
2888{
2889 return !(path->mnt->mnt_flags & MNT_NODEV) &&
2890 !(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
2891}
2892
2893static int may_open(const struct path *path, int acc_mode, int flag)
2894{
2895 struct dentry *dentry = path->dentry;
2896 struct inode *inode = dentry->d_inode;
2897 int error;
2898
2899 if (!inode)
2900 return -ENOENT;
2901
2902 switch (inode->i_mode & S_IFMT) {
2903 case S_IFLNK:
2904 return -ELOOP;
2905 case S_IFDIR:
2906 if (acc_mode & MAY_WRITE)
2907 return -EISDIR;
2908 break;
2909 case S_IFBLK:
2910 case S_IFCHR:
2911 if (!may_open_dev(path))
2912 return -EACCES;
2913
2914 case S_IFIFO:
2915 case S_IFSOCK:
2916 flag &= ~O_TRUNC;
2917 break;
2918 }
2919
2920 error = inode_permission(inode, MAY_OPEN | acc_mode);
2921 if (error)
2922 return error;
2923
2924
2925
2926
2927 if (IS_APPEND(inode)) {
2928 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
2929 return -EPERM;
2930 if (flag & O_TRUNC)
2931 return -EPERM;
2932 }
2933
2934
2935 if (flag & O_NOATIME && !inode_owner_or_capable(inode))
2936 return -EPERM;
2937
2938 return 0;
2939}
2940
2941static int handle_truncate(struct file *filp)
2942{
2943 const struct path *path = &filp->f_path;
2944 struct inode *inode = path->dentry->d_inode;
2945 int error = get_write_access(inode);
2946 if (error)
2947 return error;
2948
2949
2950
2951 error = locks_verify_locked(filp);
2952 if (!error)
2953 error = security_path_truncate(path);
2954 if (!error) {
2955 error = do_truncate(path->dentry, 0,
2956 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
2957 filp);
2958 }
2959 put_write_access(inode);
2960 return error;
2961}
2962
2963static inline int open_to_namei_flags(int flag)
2964{
2965 if ((flag & O_ACCMODE) == 3)
2966 flag--;
2967 return flag;
2968}
2969
2970static int may_o_create(const struct path *dir, struct dentry *dentry, umode_t mode)
2971{
2972 struct user_namespace *s_user_ns;
2973 int error = security_path_mknod(dir, dentry, mode, 0);
2974 if (error)
2975 return error;
2976
2977 s_user_ns = dir->dentry->d_sb->s_user_ns;
2978 if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||
2979 !kgid_has_mapping(s_user_ns, current_fsgid()))
2980 return -EOVERFLOW;
2981
2982 error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
2983 if (error)
2984 return error;
2985
2986 return security_inode_create(dir->dentry->d_inode, dentry, mode);
2987}
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002static int atomic_open(struct nameidata *nd, struct dentry *dentry,
3003 struct path *path, struct file *file,
3004 const struct open_flags *op,
3005 int open_flag, umode_t mode,
3006 int *opened)
3007{
3008 struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
3009 struct inode *dir = nd->path.dentry->d_inode;
3010 int error;
3011
3012 if (!(~open_flag & (O_EXCL | O_CREAT)))
3013 open_flag &= ~O_TRUNC;
3014
3015 if (nd->flags & LOOKUP_DIRECTORY)
3016 open_flag |= O_DIRECTORY;
3017
3018 file->f_path.dentry = DENTRY_NOT_SET;
3019 file->f_path.mnt = nd->path.mnt;
3020 error = dir->i_op->atomic_open(dir, dentry, file,
3021 open_to_namei_flags(open_flag),
3022 mode, opened);
3023 d_lookup_done(dentry);
3024 if (!error) {
3025
3026
3027
3028
3029 int acc_mode = op->acc_mode;
3030 if (*opened & FILE_CREATED) {
3031 WARN_ON(!(open_flag & O_CREAT));
3032 fsnotify_create(dir, dentry);
3033 acc_mode = 0;
3034 }
3035 error = may_open(&file->f_path, acc_mode, open_flag);
3036 if (WARN_ON(error > 0))
3037 error = -EINVAL;
3038 } else if (error > 0) {
3039 if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
3040 error = -EIO;
3041 } else {
3042 if (file->f_path.dentry) {
3043 dput(dentry);
3044 dentry = file->f_path.dentry;
3045 }
3046 if (*opened & FILE_CREATED)
3047 fsnotify_create(dir, dentry);
3048 if (unlikely(d_is_negative(dentry))) {
3049 error = -ENOENT;
3050 } else {
3051 path->dentry = dentry;
3052 path->mnt = nd->path.mnt;
3053 return 1;
3054 }
3055 }
3056 }
3057 dput(dentry);
3058 return error;
3059}
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077
3078
3079static int lookup_open(struct nameidata *nd, struct path *path,
3080 struct file *file,
3081 const struct open_flags *op,
3082 bool got_write, int *opened)
3083{
3084 struct dentry *dir = nd->path.dentry;
3085 struct inode *dir_inode = dir->d_inode;
3086 int open_flag = op->open_flag;
3087 struct dentry *dentry;
3088 int error, create_error = 0;
3089 umode_t mode = op->mode;
3090 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
3091
3092 if (unlikely(IS_DEADDIR(dir_inode)))
3093 return -ENOENT;
3094
3095 *opened &= ~FILE_CREATED;
3096 dentry = d_lookup(dir, &nd->last);
3097 for (;;) {
3098 if (!dentry) {
3099 dentry = d_alloc_parallel(dir, &nd->last, &wq);
3100 if (IS_ERR(dentry))
3101 return PTR_ERR(dentry);
3102 }
3103 if (d_in_lookup(dentry))
3104 break;
3105
3106 error = d_revalidate(dentry, nd->flags);
3107 if (likely(error > 0))
3108 break;
3109 if (error)
3110 goto out_dput;
3111 d_invalidate(dentry);
3112 dput(dentry);
3113 dentry = NULL;
3114 }
3115 if (dentry->d_inode) {
3116
3117 goto out_no_open;
3118 }
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129 if (open_flag & O_CREAT) {
3130 if (!IS_POSIXACL(dir->d_inode))
3131 mode &= ~current_umask();
3132 if (unlikely(!got_write)) {
3133 create_error = -EROFS;
3134 open_flag &= ~O_CREAT;
3135 if (open_flag & (O_EXCL | O_TRUNC))
3136 goto no_open;
3137
3138 } else {
3139 create_error = may_o_create(&nd->path, dentry, mode);
3140 if (create_error) {
3141 open_flag &= ~O_CREAT;
3142 if (open_flag & O_EXCL)
3143 goto no_open;
3144 }
3145 }
3146 } else if ((open_flag & (O_TRUNC|O_WRONLY|O_RDWR)) &&
3147 unlikely(!got_write)) {
3148
3149
3150
3151
3152 goto no_open;
3153 }
3154
3155 if (dir_inode->i_op->atomic_open) {
3156 error = atomic_open(nd, dentry, path, file, op, open_flag,
3157 mode, opened);
3158 if (unlikely(error == -ENOENT) && create_error)
3159 error = create_error;
3160 return error;
3161 }
3162
3163no_open:
3164 if (d_in_lookup(dentry)) {
3165 struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry,
3166 nd->flags);
3167 d_lookup_done(dentry);
3168 if (unlikely(res)) {
3169 if (IS_ERR(res)) {
3170 error = PTR_ERR(res);
3171 goto out_dput;
3172 }
3173 dput(dentry);
3174 dentry = res;
3175 }
3176 }
3177
3178
3179 if (!dentry->d_inode && (open_flag & O_CREAT)) {
3180 *opened |= FILE_CREATED;
3181 audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
3182 if (!dir_inode->i_op->create) {
3183 error = -EACCES;
3184 goto out_dput;
3185 }
3186 error = dir_inode->i_op->create(dir_inode, dentry, mode,
3187 open_flag & O_EXCL);
3188 if (error)
3189 goto out_dput;
3190 fsnotify_create(dir_inode, dentry);
3191 }
3192 if (unlikely(create_error) && !dentry->d_inode) {
3193 error = create_error;
3194 goto out_dput;
3195 }
3196out_no_open:
3197 path->dentry = dentry;
3198 path->mnt = nd->path.mnt;
3199 return 1;
3200
3201out_dput:
3202 dput(dentry);
3203 return error;
3204}
3205
3206
3207
3208
3209static int do_last(struct nameidata *nd,
3210 struct file *file, const struct open_flags *op,
3211 int *opened)
3212{
3213 struct dentry *dir = nd->path.dentry;
3214 int open_flag = op->open_flag;
3215 bool will_truncate = (open_flag & O_TRUNC) != 0;
3216 bool got_write = false;
3217 int acc_mode = op->acc_mode;
3218 unsigned seq;
3219 struct inode *inode;
3220 struct path path;
3221 int error;
3222
3223 nd->flags &= ~LOOKUP_PARENT;
3224 nd->flags |= op->intent;
3225
3226 if (nd->last_type != LAST_NORM) {
3227 error = handle_dots(nd, nd->last_type);
3228 if (unlikely(error))
3229 return error;
3230 goto finish_open;
3231 }
3232
3233 if (!(open_flag & O_CREAT)) {
3234 if (nd->last.name[nd->last.len])
3235 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
3236
3237 error = lookup_fast(nd, &path, &inode, &seq);
3238 if (likely(error > 0))
3239 goto finish_lookup;
3240
3241 if (error < 0)
3242 return error;
3243
3244 BUG_ON(nd->inode != dir->d_inode);
3245 BUG_ON(nd->flags & LOOKUP_RCU);
3246 } else {
3247
3248
3249
3250
3251
3252
3253 error = complete_walk(nd);
3254 if (error)
3255 return error;
3256
3257 audit_inode(nd->name, dir, LOOKUP_PARENT);
3258
3259 if (unlikely(nd->last.name[nd->last.len]))
3260 return -EISDIR;
3261 }
3262
3263 if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
3264 error = mnt_want_write(nd->path.mnt);
3265 if (!error)
3266 got_write = true;
3267
3268
3269
3270
3271
3272 }
3273 if (open_flag & O_CREAT)
3274 inode_lock(dir->d_inode);
3275 else
3276 inode_lock_shared(dir->d_inode);
3277 error = lookup_open(nd, &path, file, op, got_write, opened);
3278 if (open_flag & O_CREAT)
3279 inode_unlock(dir->d_inode);
3280 else
3281 inode_unlock_shared(dir->d_inode);
3282
3283 if (error <= 0) {
3284 if (error)
3285 goto out;
3286
3287 if ((*opened & FILE_CREATED) ||
3288 !S_ISREG(file_inode(file)->i_mode))
3289 will_truncate = false;
3290
3291 audit_inode(nd->name, file->f_path.dentry, 0);
3292 goto opened;
3293 }
3294
3295 if (*opened & FILE_CREATED) {
3296
3297 open_flag &= ~O_TRUNC;
3298 will_truncate = false;
3299 acc_mode = 0;
3300 path_to_nameidata(&path, nd);
3301 goto finish_open_created;
3302 }
3303
3304
3305
3306
3307
3308
3309 if (got_write) {
3310 mnt_drop_write(nd->path.mnt);
3311 got_write = false;
3312 }
3313
3314 error = follow_managed(&path, nd);
3315 if (unlikely(error < 0))
3316 return error;
3317
3318 if (unlikely(d_is_negative(path.dentry))) {
3319 path_to_nameidata(&path, nd);
3320 return -ENOENT;
3321 }
3322
3323
3324
3325
3326 audit_inode(nd->name, path.dentry, 0);
3327
3328 if (unlikely((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))) {
3329 path_to_nameidata(&path, nd);
3330 return -EEXIST;
3331 }
3332
3333 seq = 0;
3334 inode = d_backing_inode(path.dentry);
3335finish_lookup:
3336 error = step_into(nd, &path, 0, inode, seq);
3337 if (unlikely(error))
3338 return error;
3339finish_open:
3340
3341 error = complete_walk(nd);
3342 if (error)
3343 return error;
3344 audit_inode(nd->name, nd->path.dentry, 0);
3345 error = -EISDIR;
3346 if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry))
3347 goto out;
3348 error = -ENOTDIR;
3349 if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
3350 goto out;
3351 if (!d_is_reg(nd->path.dentry))
3352 will_truncate = false;
3353
3354 if (will_truncate) {
3355 error = mnt_want_write(nd->path.mnt);
3356 if (error)
3357 goto out;
3358 got_write = true;
3359 }
3360finish_open_created:
3361 error = may_open(&nd->path, acc_mode, open_flag);
3362 if (error)
3363 goto out;
3364 BUG_ON(*opened & FILE_OPENED);
3365 error = vfs_open(&nd->path, file, current_cred());
3366 if (error)
3367 goto out;
3368 *opened |= FILE_OPENED;
3369opened:
3370 error = open_check_o_direct(file);
3371 if (!error)
3372 error = ima_file_check(file, op->acc_mode, *opened);
3373 if (!error && will_truncate)
3374 error = handle_truncate(file);
3375out:
3376 if (unlikely(error) && (*opened & FILE_OPENED))
3377 fput(file);
3378 if (unlikely(error > 0)) {
3379 WARN_ON(1);
3380 error = -EINVAL;
3381 }
3382 if (got_write)
3383 mnt_drop_write(nd->path.mnt);
3384 return error;
3385}
3386
3387struct dentry *vfs_tmpfile(struct dentry *dentry, umode_t mode, int open_flag)
3388{
3389 struct dentry *child = NULL;
3390 struct inode *dir = dentry->d_inode;
3391 struct inode *inode;
3392 int error;
3393
3394
3395 error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
3396 if (error)
3397 goto out_err;
3398 error = -EOPNOTSUPP;
3399 if (!dir->i_op->tmpfile)
3400 goto out_err;
3401 error = -ENOMEM;
3402 child = d_alloc(dentry, &slash_name);
3403 if (unlikely(!child))
3404 goto out_err;
3405 error = dir->i_op->tmpfile(dir, child, mode);
3406 if (error)
3407 goto out_err;
3408 error = -ENOENT;
3409 inode = child->d_inode;
3410 if (unlikely(!inode))
3411 goto out_err;
3412 if (!(open_flag & O_EXCL)) {
3413 spin_lock(&inode->i_lock);
3414 inode->i_state |= I_LINKABLE;
3415 spin_unlock(&inode->i_lock);
3416 }
3417 return child;
3418
3419out_err:
3420 dput(child);
3421 return ERR_PTR(error);
3422}
3423EXPORT_SYMBOL(vfs_tmpfile);
3424
3425static int do_tmpfile(struct nameidata *nd, unsigned flags,
3426 const struct open_flags *op,
3427 struct file *file, int *opened)
3428{
3429 struct dentry *child;
3430 struct path path;
3431 int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
3432 if (unlikely(error))
3433 return error;
3434 error = mnt_want_write(path.mnt);
3435 if (unlikely(error))
3436 goto out;
3437 child = vfs_tmpfile(path.dentry, op->mode, op->open_flag);
3438 error = PTR_ERR(child);
3439 if (IS_ERR(child))
3440 goto out2;
3441 dput(path.dentry);
3442 path.dentry = child;
3443 audit_inode(nd->name, child, 0);
3444
3445 error = may_open(&path, 0, op->open_flag);
3446 if (error)
3447 goto out2;
3448 file->f_path.mnt = path.mnt;
3449 error = finish_open(file, child, NULL, opened);
3450 if (error)
3451 goto out2;
3452 error = open_check_o_direct(file);
3453 if (error)
3454 fput(file);
3455out2:
3456 mnt_drop_write(path.mnt);
3457out:
3458 path_put(&path);
3459 return error;
3460}
3461
3462static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file)
3463{
3464 struct path path;
3465 int error = path_lookupat(nd, flags, &path);
3466 if (!error) {
3467 audit_inode(nd->name, path.dentry, 0);
3468 error = vfs_open(&path, file, current_cred());
3469 path_put(&path);
3470 }
3471 return error;
3472}
3473
3474static struct file *path_openat(struct nameidata *nd,
3475 const struct open_flags *op, unsigned flags)
3476{
3477 const char *s;
3478 struct file *file;
3479 int opened = 0;
3480 int error;
3481
3482 file = get_empty_filp();
3483 if (IS_ERR(file))
3484 return file;
3485
3486 file->f_flags = op->open_flag;
3487
3488 if (unlikely(file->f_flags & __O_TMPFILE)) {
3489 error = do_tmpfile(nd, flags, op, file, &opened);
3490 goto out2;
3491 }
3492
3493 if (unlikely(file->f_flags & O_PATH)) {
3494 error = do_o_path(nd, flags, file);
3495 if (!error)
3496 opened |= FILE_OPENED;
3497 goto out2;
3498 }
3499
3500 s = path_init(nd, flags);
3501 if (IS_ERR(s)) {
3502 put_filp(file);
3503 return ERR_CAST(s);
3504 }
3505 while (!(error = link_path_walk(s, nd)) &&
3506 (error = do_last(nd, file, op, &opened)) > 0) {
3507 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3508 s = trailing_symlink(nd);
3509 if (IS_ERR(s)) {
3510 error = PTR_ERR(s);
3511 break;
3512 }
3513 }
3514 terminate_walk(nd);
3515out2:
3516 if (!(opened & FILE_OPENED)) {
3517 BUG_ON(!error);
3518 put_filp(file);
3519 }
3520 if (unlikely(error)) {
3521 if (error == -EOPENSTALE) {
3522 if (flags & LOOKUP_RCU)
3523 error = -ECHILD;
3524 else
3525 error = -ESTALE;
3526 }
3527 file = ERR_PTR(error);
3528 }
3529 return file;
3530}
3531
3532struct file *do_filp_open(int dfd, struct filename *pathname,
3533 const struct open_flags *op)
3534{
3535 struct nameidata nd;
3536 int flags = op->lookup_flags;
3537 struct file *filp;
3538
3539 set_nameidata(&nd, dfd, pathname);
3540 filp = path_openat(&nd, op, flags | LOOKUP_RCU);
3541 if (unlikely(filp == ERR_PTR(-ECHILD)))
3542 filp = path_openat(&nd, op, flags);
3543 if (unlikely(filp == ERR_PTR(-ESTALE)))
3544 filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
3545 restore_nameidata();
3546 return filp;
3547}
3548
3549struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
3550 const char *name, const struct open_flags *op)
3551{
3552 struct nameidata nd;
3553 struct file *file;
3554 struct filename *filename;
3555 int flags = op->lookup_flags | LOOKUP_ROOT;
3556
3557 nd.root.mnt = mnt;
3558 nd.root.dentry = dentry;
3559
3560 if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN)
3561 return ERR_PTR(-ELOOP);
3562
3563 filename = getname_kernel(name);
3564 if (IS_ERR(filename))
3565 return ERR_CAST(filename);
3566
3567 set_nameidata(&nd, -1, filename);
3568 file = path_openat(&nd, op, flags | LOOKUP_RCU);
3569 if (unlikely(file == ERR_PTR(-ECHILD)))
3570 file = path_openat(&nd, op, flags);
3571 if (unlikely(file == ERR_PTR(-ESTALE)))
3572 file = path_openat(&nd, op, flags | LOOKUP_REVAL);
3573 restore_nameidata();
3574 putname(filename);
3575 return file;
3576}
3577
3578static struct dentry *filename_create(int dfd, struct filename *name,
3579 struct path *path, unsigned int lookup_flags)
3580{
3581 struct dentry *dentry = ERR_PTR(-EEXIST);
3582 struct qstr last;
3583 int type;
3584 int err2;
3585 int error;
3586 bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);
3587
3588
3589
3590
3591
3592 lookup_flags &= LOOKUP_REVAL;
3593
3594 name = filename_parentat(dfd, name, lookup_flags, path, &last, &type);
3595 if (IS_ERR(name))
3596 return ERR_CAST(name);
3597
3598
3599
3600
3601
3602 if (unlikely(type != LAST_NORM))
3603 goto out;
3604
3605
3606 err2 = mnt_want_write(path->mnt);
3607
3608
3609
3610 lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL;
3611 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
3612 dentry = __lookup_hash(&last, path->dentry, lookup_flags);
3613 if (IS_ERR(dentry))
3614 goto unlock;
3615
3616 error = -EEXIST;
3617 if (d_is_positive(dentry))
3618 goto fail;
3619
3620
3621
3622
3623
3624
3625
3626 if (unlikely(!is_dir && last.name[last.len])) {
3627 error = -ENOENT;
3628 goto fail;
3629 }
3630 if (unlikely(err2)) {
3631 error = err2;
3632 goto fail;
3633 }
3634 putname(name);
3635 return dentry;
3636fail:
3637 dput(dentry);
3638 dentry = ERR_PTR(error);
3639unlock:
3640 inode_unlock(path->dentry->d_inode);
3641 if (!err2)
3642 mnt_drop_write(path->mnt);
3643out:
3644 path_put(path);
3645 putname(name);
3646 return dentry;
3647}
3648
3649struct dentry *kern_path_create(int dfd, const char *pathname,
3650 struct path *path, unsigned int lookup_flags)
3651{
3652 return filename_create(dfd, getname_kernel(pathname),
3653 path, lookup_flags);
3654}
3655EXPORT_SYMBOL(kern_path_create);
3656
3657void done_path_create(struct path *path, struct dentry *dentry)
3658{
3659 dput(dentry);
3660 inode_unlock(path->dentry->d_inode);
3661 mnt_drop_write(path->mnt);
3662 path_put(path);
3663}
3664EXPORT_SYMBOL(done_path_create);
3665
3666inline struct dentry *user_path_create(int dfd, const char __user *pathname,
3667 struct path *path, unsigned int lookup_flags)
3668{
3669 return filename_create(dfd, getname(pathname), path, lookup_flags);
3670}
3671EXPORT_SYMBOL(user_path_create);
3672
3673int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3674{
3675 int error = may_create(dir, dentry);
3676
3677 if (error)
3678 return error;
3679
3680 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
3681 return -EPERM;
3682
3683 if (!dir->i_op->mknod)
3684 return -EPERM;
3685
3686 error = devcgroup_inode_mknod(mode, dev);
3687 if (error)
3688 return error;
3689
3690 error = security_inode_mknod(dir, dentry, mode, dev);
3691 if (error)
3692 return error;
3693
3694 error = dir->i_op->mknod(dir, dentry, mode, dev);
3695 if (!error)
3696 fsnotify_create(dir, dentry);
3697 return error;
3698}
3699EXPORT_SYMBOL(vfs_mknod);
3700
3701static int may_mknod(umode_t mode)
3702{
3703 switch (mode & S_IFMT) {
3704 case S_IFREG:
3705 case S_IFCHR:
3706 case S_IFBLK:
3707 case S_IFIFO:
3708 case S_IFSOCK:
3709 case 0:
3710 return 0;
3711 case S_IFDIR:
3712 return -EPERM;
3713 default:
3714 return -EINVAL;
3715 }
3716}
3717
3718long do_mknodat(int dfd, const char __user *filename, umode_t mode,
3719 unsigned int dev)
3720{
3721 struct dentry *dentry;
3722 struct path path;
3723 int error;
3724 unsigned int lookup_flags = 0;
3725
3726 error = may_mknod(mode);
3727 if (error)
3728 return error;
3729retry:
3730 dentry = user_path_create(dfd, filename, &path, lookup_flags);
3731 if (IS_ERR(dentry))
3732 return PTR_ERR(dentry);
3733
3734 if (!IS_POSIXACL(path.dentry->d_inode))
3735 mode &= ~current_umask();
3736 error = security_path_mknod(&path, dentry, mode, dev);
3737 if (error)
3738 goto out;
3739 switch (mode & S_IFMT) {
3740 case 0: case S_IFREG:
3741 error = vfs_create(path.dentry->d_inode,dentry,mode,true);
3742 if (!error)
3743 ima_post_path_mknod(dentry);
3744 break;
3745 case S_IFCHR: case S_IFBLK:
3746 error = vfs_mknod(path.dentry->d_inode,dentry,mode,
3747 new_decode_dev(dev));
3748 break;
3749 case S_IFIFO: case S_IFSOCK:
3750 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
3751 break;
3752 }
3753out:
3754 done_path_create(&path, dentry);
3755 if (retry_estale(error, lookup_flags)) {
3756 lookup_flags |= LOOKUP_REVAL;
3757 goto retry;
3758 }
3759 return error;
3760}
3761
3762SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
3763 unsigned int, dev)
3764{
3765 return do_mknodat(dfd, filename, mode, dev);
3766}
3767
3768SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3769{
3770 return do_mknodat(AT_FDCWD, filename, mode, dev);
3771}
3772
3773int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
3774{
3775 int error = may_create(dir, dentry);
3776 unsigned max_links = dir->i_sb->s_max_links;
3777
3778 if (error)
3779 return error;
3780
3781 if (!dir->i_op->mkdir)
3782 return -EPERM;
3783
3784 mode &= (S_IRWXUGO|S_ISVTX);
3785 error = security_inode_mkdir(dir, dentry, mode);
3786 if (error)
3787 return error;
3788
3789 if (max_links && dir->i_nlink >= max_links)
3790 return -EMLINK;
3791
3792 error = dir->i_op->mkdir(dir, dentry, mode);
3793 if (!error)
3794 fsnotify_mkdir(dir, dentry);
3795 return error;
3796}
3797EXPORT_SYMBOL(vfs_mkdir);
3798
3799long do_mkdirat(int dfd, const char __user *pathname, umode_t mode)
3800{
3801 struct dentry *dentry;
3802 struct path path;
3803 int error;
3804 unsigned int lookup_flags = LOOKUP_DIRECTORY;
3805
3806retry:
3807 dentry = user_path_create(dfd, pathname, &path, lookup_flags);
3808 if (IS_ERR(dentry))
3809 return PTR_ERR(dentry);
3810
3811 if (!IS_POSIXACL(path.dentry->d_inode))
3812 mode &= ~current_umask();
3813 error = security_path_mkdir(&path, dentry, mode);
3814 if (!error)
3815 error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
3816 done_path_create(&path, dentry);
3817 if (retry_estale(error, lookup_flags)) {
3818 lookup_flags |= LOOKUP_REVAL;
3819 goto retry;
3820 }
3821 return error;
3822}
3823
3824SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
3825{
3826 return do_mkdirat(dfd, pathname, mode);
3827}
3828
3829SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
3830{
3831 return do_mkdirat(AT_FDCWD, pathname, mode);
3832}
3833
3834int vfs_rmdir(struct inode *dir, struct dentry *dentry)
3835{
3836 int error = may_delete(dir, dentry, 1);
3837
3838 if (error)
3839 return error;
3840
3841 if (!dir->i_op->rmdir)
3842 return -EPERM;
3843
3844 dget(dentry);
3845 inode_lock(dentry->d_inode);
3846
3847 error = -EBUSY;
3848 if (is_local_mountpoint(dentry))
3849 goto out;
3850
3851 error = security_inode_rmdir(dir, dentry);
3852 if (error)
3853 goto out;
3854
3855 shrink_dcache_parent(dentry);
3856 error = dir->i_op->rmdir(dir, dentry);
3857 if (error)
3858 goto out;
3859
3860 dentry->d_inode->i_flags |= S_DEAD;
3861 dont_mount(dentry);
3862 detach_mounts(dentry);
3863
3864out:
3865 inode_unlock(dentry->d_inode);
3866 dput(dentry);
3867 if (!error)
3868 d_delete(dentry);
3869 return error;
3870}
3871EXPORT_SYMBOL(vfs_rmdir);
3872
3873long do_rmdir(int dfd, const char __user *pathname)
3874{
3875 int error = 0;
3876 struct filename *name;
3877 struct dentry *dentry;
3878 struct path path;
3879 struct qstr last;
3880 int type;
3881 unsigned int lookup_flags = 0;
3882retry:
3883 name = filename_parentat(dfd, getname(pathname), lookup_flags,
3884 &path, &last, &type);
3885 if (IS_ERR(name))
3886 return PTR_ERR(name);
3887
3888 switch (type) {
3889 case LAST_DOTDOT:
3890 error = -ENOTEMPTY;
3891 goto exit1;
3892 case LAST_DOT:
3893 error = -EINVAL;
3894 goto exit1;
3895 case LAST_ROOT:
3896 error = -EBUSY;
3897 goto exit1;
3898 }
3899
3900 error = mnt_want_write(path.mnt);
3901 if (error)
3902 goto exit1;
3903
3904 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
3905 dentry = __lookup_hash(&last, path.dentry, lookup_flags);
3906 error = PTR_ERR(dentry);
3907 if (IS_ERR(dentry))
3908 goto exit2;
3909 if (!dentry->d_inode) {
3910 error = -ENOENT;
3911 goto exit3;
3912 }
3913 error = security_path_rmdir(&path, dentry);
3914 if (error)
3915 goto exit3;
3916 error = vfs_rmdir(path.dentry->d_inode, dentry);
3917exit3:
3918 dput(dentry);
3919exit2:
3920 inode_unlock(path.dentry->d_inode);
3921 mnt_drop_write(path.mnt);
3922exit1:
3923 path_put(&path);
3924 putname(name);
3925 if (retry_estale(error, lookup_flags)) {
3926 lookup_flags |= LOOKUP_REVAL;
3927 goto retry;
3928 }
3929 return error;
3930}
3931
3932SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
3933{
3934 return do_rmdir(AT_FDCWD, pathname);
3935}
3936
3937
3938
3939
3940
3941
3942
3943
3944
3945
3946
3947
3948
3949
3950
3951
3952
3953
3954
3955int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode)
3956{
3957 struct inode *target = dentry->d_inode;
3958 int error = may_delete(dir, dentry, 0);
3959
3960 if (error)
3961 return error;
3962
3963 if (!dir->i_op->unlink)
3964 return -EPERM;
3965
3966 inode_lock(target);
3967 if (is_local_mountpoint(dentry))
3968 error = -EBUSY;
3969 else {
3970 error = security_inode_unlink(dir, dentry);
3971 if (!error) {
3972 error = try_break_deleg(target, delegated_inode);
3973 if (error)
3974 goto out;
3975 error = dir->i_op->unlink(dir, dentry);
3976 if (!error) {
3977 dont_mount(dentry);
3978 detach_mounts(dentry);
3979 }
3980 }
3981 }
3982out:
3983 inode_unlock(target);
3984
3985
3986 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
3987 fsnotify_link_count(target);
3988 d_delete(dentry);
3989 }
3990
3991 return error;
3992}
3993EXPORT_SYMBOL(vfs_unlink);
3994
3995
3996
3997
3998
3999
4000
4001long do_unlinkat(int dfd, struct filename *name)
4002{
4003 int error;
4004 struct dentry *dentry;
4005 struct path path;
4006 struct qstr last;
4007 int type;
4008 struct inode *inode = NULL;
4009 struct inode *delegated_inode = NULL;
4010 unsigned int lookup_flags = 0;
4011retry:
4012 name = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4013 if (IS_ERR(name))
4014 return PTR_ERR(name);
4015
4016 error = -EISDIR;
4017 if (type != LAST_NORM)
4018 goto exit1;
4019
4020 error = mnt_want_write(path.mnt);
4021 if (error)
4022 goto exit1;
4023retry_deleg:
4024 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4025 dentry = __lookup_hash(&last, path.dentry, lookup_flags);
4026 error = PTR_ERR(dentry);
4027 if (!IS_ERR(dentry)) {
4028
4029 if (last.name[last.len])
4030 goto slashes;
4031 inode = dentry->d_inode;
4032 if (d_is_negative(dentry))
4033 goto slashes;
4034 ihold(inode);
4035 error = security_path_unlink(&path, dentry);
4036 if (error)
4037 goto exit2;
4038 error = vfs_unlink(path.dentry->d_inode, dentry, &delegated_inode);
4039exit2:
4040 dput(dentry);
4041 }
4042 inode_unlock(path.dentry->d_inode);
4043 if (inode)
4044 iput(inode);
4045 inode = NULL;
4046 if (delegated_inode) {
4047 error = break_deleg_wait(&delegated_inode);
4048 if (!error)
4049 goto retry_deleg;
4050 }
4051 mnt_drop_write(path.mnt);
4052exit1:
4053 path_put(&path);
4054 if (retry_estale(error, lookup_flags)) {
4055 lookup_flags |= LOOKUP_REVAL;
4056 inode = NULL;
4057 goto retry;
4058 }
4059 putname(name);
4060 return error;
4061
4062slashes:
4063 if (d_is_negative(dentry))
4064 error = -ENOENT;
4065 else if (d_is_dir(dentry))
4066 error = -EISDIR;
4067 else
4068 error = -ENOTDIR;
4069 goto exit2;
4070}
4071
4072SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
4073{
4074 if ((flag & ~AT_REMOVEDIR) != 0)
4075 return -EINVAL;
4076
4077 if (flag & AT_REMOVEDIR)
4078 return do_rmdir(dfd, pathname);
4079
4080 return do_unlinkat(dfd, getname(pathname));
4081}
4082
4083SYSCALL_DEFINE1(unlink, const char __user *, pathname)
4084{
4085 return do_unlinkat(AT_FDCWD, getname(pathname));
4086}
4087
4088int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
4089{
4090 int error = may_create(dir, dentry);
4091
4092 if (error)
4093 return error;
4094
4095 if (!dir->i_op->symlink)
4096 return -EPERM;
4097
4098 error = security_inode_symlink(dir, dentry, oldname);
4099 if (error)
4100 return error;
4101
4102 error = dir->i_op->symlink(dir, dentry, oldname);
4103 if (!error)
4104 fsnotify_create(dir, dentry);
4105 return error;
4106}
4107EXPORT_SYMBOL(vfs_symlink);
4108
4109long do_symlinkat(const char __user *oldname, int newdfd,
4110 const char __user *newname)
4111{
4112 int error;
4113 struct filename *from;
4114 struct dentry *dentry;
4115 struct path path;
4116 unsigned int lookup_flags = 0;
4117
4118 from = getname(oldname);
4119 if (IS_ERR(from))
4120 return PTR_ERR(from);
4121retry:
4122 dentry = user_path_create(newdfd, newname, &path, lookup_flags);
4123 error = PTR_ERR(dentry);
4124 if (IS_ERR(dentry))
4125 goto out_putname;
4126
4127 error = security_path_symlink(&path, dentry, from->name);
4128 if (!error)
4129 error = vfs_symlink(path.dentry->d_inode, dentry, from->name);
4130 done_path_create(&path, dentry);
4131 if (retry_estale(error, lookup_flags)) {
4132 lookup_flags |= LOOKUP_REVAL;
4133 goto retry;
4134 }
4135out_putname:
4136 putname(from);
4137 return error;
4138}
4139
4140SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
4141 int, newdfd, const char __user *, newname)
4142{
4143 return do_symlinkat(oldname, newdfd, newname);
4144}
4145
4146SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
4147{
4148 return do_symlinkat(oldname, AT_FDCWD, newname);
4149}
4150
4151
4152
4153
4154
4155
4156
4157
4158
4159
4160
4161
4162
4163
4164
4165
4166
4167
4168
4169
4170int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode)
4171{
4172 struct inode *inode = old_dentry->d_inode;
4173 unsigned max_links = dir->i_sb->s_max_links;
4174 int error;
4175
4176 if (!inode)
4177 return -ENOENT;
4178
4179 error = may_create(dir, new_dentry);
4180 if (error)
4181 return error;
4182
4183 if (dir->i_sb != inode->i_sb)
4184 return -EXDEV;
4185
4186
4187
4188
4189 if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
4190 return -EPERM;
4191
4192
4193
4194
4195
4196 if (HAS_UNMAPPED_ID(inode))
4197 return -EPERM;
4198 if (!dir->i_op->link)
4199 return -EPERM;
4200 if (S_ISDIR(inode->i_mode))
4201 return -EPERM;
4202
4203 error = security_inode_link(old_dentry, dir, new_dentry);
4204 if (error)
4205 return error;
4206
4207 inode_lock(inode);
4208
4209 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
4210 error = -ENOENT;
4211 else if (max_links && inode->i_nlink >= max_links)
4212 error = -EMLINK;
4213 else {
4214 error = try_break_deleg(inode, delegated_inode);
4215 if (!error)
4216 error = dir->i_op->link(old_dentry, dir, new_dentry);
4217 }
4218
4219 if (!error && (inode->i_state & I_LINKABLE)) {
4220 spin_lock(&inode->i_lock);
4221 inode->i_state &= ~I_LINKABLE;
4222 spin_unlock(&inode->i_lock);
4223 }
4224 inode_unlock(inode);
4225 if (!error)
4226 fsnotify_link(dir, inode, new_dentry);
4227 return error;
4228}
4229EXPORT_SYMBOL(vfs_link);
4230
4231
4232
4233
4234
4235
4236
4237
4238
4239
4240int do_linkat(int olddfd, const char __user *oldname, int newdfd,
4241 const char __user *newname, int flags)
4242{
4243 struct dentry *new_dentry;
4244 struct path old_path, new_path;
4245 struct inode *delegated_inode = NULL;
4246 int how = 0;
4247 int error;
4248
4249 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
4250 return -EINVAL;
4251
4252
4253
4254
4255
4256 if (flags & AT_EMPTY_PATH) {
4257 if (!capable(CAP_DAC_READ_SEARCH))
4258 return -ENOENT;
4259 how = LOOKUP_EMPTY;
4260 }
4261
4262 if (flags & AT_SYMLINK_FOLLOW)
4263 how |= LOOKUP_FOLLOW;
4264retry:
4265 error = user_path_at(olddfd, oldname, how, &old_path);
4266 if (error)
4267 return error;
4268
4269 new_dentry = user_path_create(newdfd, newname, &new_path,
4270 (how & LOOKUP_REVAL));
4271 error = PTR_ERR(new_dentry);
4272 if (IS_ERR(new_dentry))
4273 goto out;
4274
4275 error = -EXDEV;
4276 if (old_path.mnt != new_path.mnt)
4277 goto out_dput;
4278 error = may_linkat(&old_path);
4279 if (unlikely(error))
4280 goto out_dput;
4281 error = security_path_link(old_path.dentry, &new_path, new_dentry);
4282 if (error)
4283 goto out_dput;
4284 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode);
4285out_dput:
4286 done_path_create(&new_path, new_dentry);
4287 if (delegated_inode) {
4288 error = break_deleg_wait(&delegated_inode);
4289 if (!error) {
4290 path_put(&old_path);
4291 goto retry;
4292 }
4293 }
4294 if (retry_estale(error, how)) {
4295 path_put(&old_path);
4296 how |= LOOKUP_REVAL;
4297 goto retry;
4298 }
4299out:
4300 path_put(&old_path);
4301
4302 return error;
4303}
4304
4305SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
4306 int, newdfd, const char __user *, newname, int, flags)
4307{
4308 return do_linkat(olddfd, oldname, newdfd, newname, flags);
4309}
4310
4311SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
4312{
4313 return do_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4314}
4315
4316
4317
4318
4319
4320
4321
4322
4323
4324
4325
4326
4327
4328
4329
4330
4331
4332
4333
4334
4335
4336
4337
4338
4339
4340
4341
4342
4343
4344
4345
4346
4347
4348
4349
4350
4351
4352
4353
4354
4355
4356
4357
4358
4359
4360
4361
4362
4363
4364
4365
4366int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
4367 struct inode *new_dir, struct dentry *new_dentry,
4368 struct inode **delegated_inode, unsigned int flags)
4369{
4370 int error;
4371 bool is_dir = d_is_dir(old_dentry);
4372 struct inode *source = old_dentry->d_inode;
4373 struct inode *target = new_dentry->d_inode;
4374 bool new_is_dir = false;
4375 unsigned max_links = new_dir->i_sb->s_max_links;
4376 struct name_snapshot old_name;
4377
4378 if (source == target)
4379 return 0;
4380
4381 error = may_delete(old_dir, old_dentry, is_dir);
4382 if (error)
4383 return error;
4384
4385 if (!target) {
4386 error = may_create(new_dir, new_dentry);
4387 } else {
4388 new_is_dir = d_is_dir(new_dentry);
4389
4390 if (!(flags & RENAME_EXCHANGE))
4391 error = may_delete(new_dir, new_dentry, is_dir);
4392 else
4393 error = may_delete(new_dir, new_dentry, new_is_dir);
4394 }
4395 if (error)
4396 return error;
4397
4398 if (!old_dir->i_op->rename)
4399 return -EPERM;
4400
4401
4402
4403
4404
4405 if (new_dir != old_dir) {
4406 if (is_dir) {
4407 error = inode_permission(source, MAY_WRITE);
4408 if (error)
4409 return error;
4410 }
4411 if ((flags & RENAME_EXCHANGE) && new_is_dir) {
4412 error = inode_permission(target, MAY_WRITE);
4413 if (error)
4414 return error;
4415 }
4416 }
4417
4418 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
4419 flags);
4420 if (error)
4421 return error;
4422
4423 take_dentry_name_snapshot(&old_name, old_dentry);
4424 dget(new_dentry);
4425 if (!is_dir || (flags & RENAME_EXCHANGE))
4426 lock_two_nondirectories(source, target);
4427 else if (target)
4428 inode_lock(target);
4429
4430 error = -EBUSY;
4431 if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
4432 goto out;
4433
4434 if (max_links && new_dir != old_dir) {
4435 error = -EMLINK;
4436 if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
4437 goto out;
4438 if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
4439 old_dir->i_nlink >= max_links)
4440 goto out;
4441 }
4442 if (is_dir && !(flags & RENAME_EXCHANGE) && target)
4443 shrink_dcache_parent(new_dentry);
4444 if (!is_dir) {
4445 error = try_break_deleg(source, delegated_inode);
4446 if (error)
4447 goto out;
4448 }
4449 if (target && !new_is_dir) {
4450 error = try_break_deleg(target, delegated_inode);
4451 if (error)
4452 goto out;
4453 }
4454 error = old_dir->i_op->rename(old_dir, old_dentry,
4455 new_dir, new_dentry, flags);
4456 if (error)
4457 goto out;
4458
4459 if (!(flags & RENAME_EXCHANGE) && target) {
4460 if (is_dir)
4461 target->i_flags |= S_DEAD;
4462 dont_mount(new_dentry);
4463 detach_mounts(new_dentry);
4464 }
4465 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
4466 if (!(flags & RENAME_EXCHANGE))
4467 d_move(old_dentry, new_dentry);
4468 else
4469 d_exchange(old_dentry, new_dentry);
4470 }
4471out:
4472 if (!is_dir || (flags & RENAME_EXCHANGE))
4473 unlock_two_nondirectories(source, target);
4474 else if (target)
4475 inode_unlock(target);
4476 dput(new_dentry);
4477 if (!error) {
4478 fsnotify_move(old_dir, new_dir, old_name.name, is_dir,
4479 !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
4480 if (flags & RENAME_EXCHANGE) {
4481 fsnotify_move(new_dir, old_dir, old_dentry->d_name.name,
4482 new_is_dir, NULL, new_dentry);
4483 }
4484 }
4485 release_dentry_name_snapshot(&old_name);
4486
4487 return error;
4488}
4489EXPORT_SYMBOL(vfs_rename);
4490
4491static int do_renameat2(int olddfd, const char __user *oldname, int newdfd,
4492 const char __user *newname, unsigned int flags)
4493{
4494 struct dentry *old_dentry, *new_dentry;
4495 struct dentry *trap;
4496 struct path old_path, new_path;
4497 struct qstr old_last, new_last;
4498 int old_type, new_type;
4499 struct inode *delegated_inode = NULL;
4500 struct filename *from;
4501 struct filename *to;
4502 unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
4503 bool should_retry = false;
4504 int error;
4505
4506 if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
4507 return -EINVAL;
4508
4509 if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
4510 (flags & RENAME_EXCHANGE))
4511 return -EINVAL;
4512
4513 if ((flags & RENAME_WHITEOUT) && !capable(CAP_MKNOD))
4514 return -EPERM;
4515
4516 if (flags & RENAME_EXCHANGE)
4517 target_flags = 0;
4518
4519retry:
4520 from = filename_parentat(olddfd, getname(oldname), lookup_flags,
4521 &old_path, &old_last, &old_type);
4522 if (IS_ERR(from)) {
4523 error = PTR_ERR(from);
4524 goto exit;
4525 }
4526
4527 to = filename_parentat(newdfd, getname(newname), lookup_flags,
4528 &new_path, &new_last, &new_type);
4529 if (IS_ERR(to)) {
4530 error = PTR_ERR(to);
4531 goto exit1;
4532 }
4533
4534 error = -EXDEV;
4535 if (old_path.mnt != new_path.mnt)
4536 goto exit2;
4537
4538 error = -EBUSY;
4539 if (old_type != LAST_NORM)
4540 goto exit2;
4541
4542 if (flags & RENAME_NOREPLACE)
4543 error = -EEXIST;
4544 if (new_type != LAST_NORM)
4545 goto exit2;
4546
4547 error = mnt_want_write(old_path.mnt);
4548 if (error)
4549 goto exit2;
4550
4551retry_deleg:
4552 trap = lock_rename(new_path.dentry, old_path.dentry);
4553
4554 old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags);
4555 error = PTR_ERR(old_dentry);
4556 if (IS_ERR(old_dentry))
4557 goto exit3;
4558
4559 error = -ENOENT;
4560 if (d_is_negative(old_dentry))
4561 goto exit4;
4562 new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags);
4563 error = PTR_ERR(new_dentry);
4564 if (IS_ERR(new_dentry))
4565 goto exit4;
4566 error = -EEXIST;
4567 if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
4568 goto exit5;
4569 if (flags & RENAME_EXCHANGE) {
4570 error = -ENOENT;
4571 if (d_is_negative(new_dentry))
4572 goto exit5;
4573
4574 if (!d_is_dir(new_dentry)) {
4575 error = -ENOTDIR;
4576 if (new_last.name[new_last.len])
4577 goto exit5;
4578 }
4579 }
4580
4581 if (!d_is_dir(old_dentry)) {
4582 error = -ENOTDIR;
4583 if (old_last.name[old_last.len])
4584 goto exit5;
4585 if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
4586 goto exit5;
4587 }
4588
4589 error = -EINVAL;
4590 if (old_dentry == trap)
4591 goto exit5;
4592
4593 if (!(flags & RENAME_EXCHANGE))
4594 error = -ENOTEMPTY;
4595 if (new_dentry == trap)
4596 goto exit5;
4597
4598 error = security_path_rename(&old_path, old_dentry,
4599 &new_path, new_dentry, flags);
4600 if (error)
4601 goto exit5;
4602 error = vfs_rename(old_path.dentry->d_inode, old_dentry,
4603 new_path.dentry->d_inode, new_dentry,
4604 &delegated_inode, flags);
4605exit5:
4606 dput(new_dentry);
4607exit4:
4608 dput(old_dentry);
4609exit3:
4610 unlock_rename(new_path.dentry, old_path.dentry);
4611 if (delegated_inode) {
4612 error = break_deleg_wait(&delegated_inode);
4613 if (!error)
4614 goto retry_deleg;
4615 }
4616 mnt_drop_write(old_path.mnt);
4617exit2:
4618 if (retry_estale(error, lookup_flags))
4619 should_retry = true;
4620 path_put(&new_path);
4621 putname(to);
4622exit1:
4623 path_put(&old_path);
4624 putname(from);
4625 if (should_retry) {
4626 should_retry = false;
4627 lookup_flags |= LOOKUP_REVAL;
4628 goto retry;
4629 }
4630exit:
4631 return error;
4632}
4633
4634SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
4635 int, newdfd, const char __user *, newname, unsigned int, flags)
4636{
4637 return do_renameat2(olddfd, oldname, newdfd, newname, flags);
4638}
4639
4640SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
4641 int, newdfd, const char __user *, newname)
4642{
4643 return do_renameat2(olddfd, oldname, newdfd, newname, 0);
4644}
4645
4646SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
4647{
4648 return do_renameat2(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4649}
4650
4651int vfs_whiteout(struct inode *dir, struct dentry *dentry)
4652{
4653 int error = may_create(dir, dentry);
4654 if (error)
4655 return error;
4656
4657 if (!dir->i_op->mknod)
4658 return -EPERM;
4659
4660 return dir->i_op->mknod(dir, dentry,
4661 S_IFCHR | WHITEOUT_MODE, WHITEOUT_DEV);
4662}
4663EXPORT_SYMBOL(vfs_whiteout);
4664
4665int readlink_copy(char __user *buffer, int buflen, const char *link)
4666{
4667 int len = PTR_ERR(link);
4668 if (IS_ERR(link))
4669 goto out;
4670
4671 len = strlen(link);
4672 if (len > (unsigned) buflen)
4673 len = buflen;
4674 if (copy_to_user(buffer, link, len))
4675 len = -EFAULT;
4676out:
4677 return len;
4678}
4679
4680
4681
4682
4683
4684
4685static int generic_readlink(struct dentry *dentry, char __user *buffer,
4686 int buflen)
4687{
4688 DEFINE_DELAYED_CALL(done);
4689 struct inode *inode = d_inode(dentry);
4690 const char *link = inode->i_link;
4691 int res;
4692
4693 if (!link) {
4694 link = inode->i_op->get_link(dentry, inode, &done);
4695 if (IS_ERR(link))
4696 return PTR_ERR(link);
4697 }
4698 res = readlink_copy(buffer, buflen, link);
4699 do_delayed_call(&done);
4700 return res;
4701}
4702
4703
4704
4705
4706
4707
4708
4709
4710
4711
4712
4713int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4714{
4715 struct inode *inode = d_inode(dentry);
4716
4717 if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) {
4718 if (unlikely(inode->i_op->readlink))
4719 return inode->i_op->readlink(dentry, buffer, buflen);
4720
4721 if (!d_is_symlink(dentry))
4722 return -EINVAL;
4723
4724 spin_lock(&inode->i_lock);
4725 inode->i_opflags |= IOP_DEFAULT_READLINK;
4726 spin_unlock(&inode->i_lock);
4727 }
4728
4729 return generic_readlink(dentry, buffer, buflen);
4730}
4731EXPORT_SYMBOL(vfs_readlink);
4732
4733
4734
4735
4736
4737
4738
4739
4740
4741
4742
4743
4744const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
4745{
4746 const char *res = ERR_PTR(-EINVAL);
4747 struct inode *inode = d_inode(dentry);
4748
4749 if (d_is_symlink(dentry)) {
4750 res = ERR_PTR(security_inode_readlink(dentry));
4751 if (!res)
4752 res = inode->i_op->get_link(dentry, inode, done);
4753 }
4754 return res;
4755}
4756EXPORT_SYMBOL(vfs_get_link);
4757
4758
4759const char *page_get_link(struct dentry *dentry, struct inode *inode,
4760 struct delayed_call *callback)
4761{
4762 char *kaddr;
4763 struct page *page;
4764 struct address_space *mapping = inode->i_mapping;
4765
4766 if (!dentry) {
4767 page = find_get_page(mapping, 0);
4768 if (!page)
4769 return ERR_PTR(-ECHILD);
4770 if (!PageUptodate(page)) {
4771 put_page(page);
4772 return ERR_PTR(-ECHILD);
4773 }
4774 } else {
4775 page = read_mapping_page(mapping, 0, NULL);
4776 if (IS_ERR(page))
4777 return (char*)page;
4778 }
4779 set_delayed_call(callback, page_put_link, page);
4780 BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
4781 kaddr = page_address(page);
4782 nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
4783 return kaddr;
4784}
4785
4786EXPORT_SYMBOL(page_get_link);
4787
4788void page_put_link(void *arg)
4789{
4790 put_page(arg);
4791}
4792EXPORT_SYMBOL(page_put_link);
4793
4794int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4795{
4796 DEFINE_DELAYED_CALL(done);
4797 int res = readlink_copy(buffer, buflen,
4798 page_get_link(dentry, d_inode(dentry),
4799 &done));
4800 do_delayed_call(&done);
4801 return res;
4802}
4803EXPORT_SYMBOL(page_readlink);
4804
4805
4806
4807
4808int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
4809{
4810 struct address_space *mapping = inode->i_mapping;
4811 struct page *page;
4812 void *fsdata;
4813 int err;
4814 unsigned int flags = 0;
4815 if (nofs)
4816 flags |= AOP_FLAG_NOFS;
4817
4818retry:
4819 err = pagecache_write_begin(NULL, mapping, 0, len-1,
4820 flags, &page, &fsdata);
4821 if (err)
4822 goto fail;
4823
4824 memcpy(page_address(page), symname, len-1);
4825
4826 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
4827 page, fsdata);
4828 if (err < 0)
4829 goto fail;
4830 if (err < len-1)
4831 goto retry;
4832
4833 mark_inode_dirty(inode);
4834 return 0;
4835fail:
4836 return err;
4837}
4838EXPORT_SYMBOL(__page_symlink);
4839
4840int page_symlink(struct inode *inode, const char *symname, int len)
4841{
4842 return __page_symlink(inode, symname, len,
4843 !mapping_gfp_constraint(inode->i_mapping, __GFP_FS));
4844}
4845EXPORT_SYMBOL(page_symlink);
4846
4847const struct inode_operations page_symlink_inode_operations = {
4848 .get_link = page_get_link,
4849};
4850EXPORT_SYMBOL(page_symlink_inode_operations);
4851