1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18#include <linux/init.h>
19#include <linux/export.h>
20#include <linux/kernel.h>
21#include <linux/slab.h>
22#include <linux/fs.h>
23#include <linux/namei.h>
24#include <linux/pagemap.h>
25#include <linux/fsnotify.h>
26#include <linux/personality.h>
27#include <linux/security.h>
28#include <linux/ima.h>
29#include <linux/syscalls.h>
30#include <linux/mount.h>
31#include <linux/audit.h>
32#include <linux/capability.h>
33#include <linux/file.h>
34#include <linux/fcntl.h>
35#include <linux/device_cgroup.h>
36#include <linux/fs_struct.h>
37#include <linux/posix_acl.h>
38#include <linux/hash.h>
39#include <linux/bitops.h>
40#include <linux/init_task.h>
41#include <linux/uaccess.h>
42
43#include "internal.h"
44#include "mount.h"
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125#define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname))
126
127struct filename *
128getname_flags(const char __user *filename, int flags, int *empty)
129{
130 struct filename *result;
131 char *kname;
132 int len;
133
134 result = audit_reusename(filename);
135 if (result)
136 return result;
137
138 result = __getname();
139 if (unlikely(!result))
140 return ERR_PTR(-ENOMEM);
141
142
143
144
145
146 kname = (char *)result->iname;
147 result->name = kname;
148
149 len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
150 if (unlikely(len < 0)) {
151 __putname(result);
152 return ERR_PTR(len);
153 }
154
155
156
157
158
159
160
161 if (unlikely(len == EMBEDDED_NAME_MAX)) {
162 const size_t size = offsetof(struct filename, iname[1]);
163 kname = (char *)result;
164
165
166
167
168
169
170 result = kzalloc(size, GFP_KERNEL);
171 if (unlikely(!result)) {
172 __putname(kname);
173 return ERR_PTR(-ENOMEM);
174 }
175 result->name = kname;
176 len = strncpy_from_user(kname, filename, PATH_MAX);
177 if (unlikely(len < 0)) {
178 __putname(kname);
179 kfree(result);
180 return ERR_PTR(len);
181 }
182 if (unlikely(len == PATH_MAX)) {
183 __putname(kname);
184 kfree(result);
185 return ERR_PTR(-ENAMETOOLONG);
186 }
187 }
188
189 result->refcnt = 1;
190
191 if (unlikely(!len)) {
192 if (empty)
193 *empty = 1;
194 if (!(flags & LOOKUP_EMPTY)) {
195 putname(result);
196 return ERR_PTR(-ENOENT);
197 }
198 }
199
200 result->uptr = filename;
201 result->aname = NULL;
202 audit_getname(result);
203 return result;
204}
205
206struct filename *
207getname(const char __user * filename)
208{
209 return getname_flags(filename, 0, NULL);
210}
211
212struct filename *
213getname_kernel(const char * filename)
214{
215 struct filename *result;
216 int len = strlen(filename) + 1;
217
218 result = __getname();
219 if (unlikely(!result))
220 return ERR_PTR(-ENOMEM);
221
222 if (len <= EMBEDDED_NAME_MAX) {
223 result->name = (char *)result->iname;
224 } else if (len <= PATH_MAX) {
225 const size_t size = offsetof(struct filename, iname[1]);
226 struct filename *tmp;
227
228 tmp = kmalloc(size, GFP_KERNEL);
229 if (unlikely(!tmp)) {
230 __putname(result);
231 return ERR_PTR(-ENOMEM);
232 }
233 tmp->name = (char *)result;
234 result = tmp;
235 } else {
236 __putname(result);
237 return ERR_PTR(-ENAMETOOLONG);
238 }
239 memcpy((char *)result->name, filename, len);
240 result->uptr = NULL;
241 result->aname = NULL;
242 result->refcnt = 1;
243 audit_getname(result);
244
245 return result;
246}
247
248void putname(struct filename *name)
249{
250 BUG_ON(name->refcnt <= 0);
251
252 if (--name->refcnt > 0)
253 return;
254
255 if (name->name != name->iname) {
256 __putname(name->name);
257 kfree(name);
258 } else
259 __putname(name);
260}
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278static int check_acl(struct user_namespace *mnt_userns,
279 struct inode *inode, int mask)
280{
281#ifdef CONFIG_FS_POSIX_ACL
282 struct posix_acl *acl;
283
284 if (mask & MAY_NOT_BLOCK) {
285 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
286 if (!acl)
287 return -EAGAIN;
288
289 if (is_uncached_acl(acl))
290 return -ECHILD;
291 return posix_acl_permission(mnt_userns, inode, acl, mask);
292 }
293
294 acl = get_acl(inode, ACL_TYPE_ACCESS);
295 if (IS_ERR(acl))
296 return PTR_ERR(acl);
297 if (acl) {
298 int error = posix_acl_permission(mnt_userns, inode, acl, mask);
299 posix_acl_release(acl);
300 return error;
301 }
302#endif
303
304 return -EAGAIN;
305}
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323static int acl_permission_check(struct user_namespace *mnt_userns,
324 struct inode *inode, int mask)
325{
326 unsigned int mode = inode->i_mode;
327 kuid_t i_uid;
328
329
330 i_uid = i_uid_into_mnt(mnt_userns, inode);
331 if (likely(uid_eq(current_fsuid(), i_uid))) {
332 mask &= 7;
333 mode >>= 6;
334 return (mask & ~mode) ? -EACCES : 0;
335 }
336
337
338 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
339 int error = check_acl(mnt_userns, inode, mask);
340 if (error != -EAGAIN)
341 return error;
342 }
343
344
345 mask &= 7;
346
347
348
349
350
351
352 if (mask & (mode ^ (mode >> 3))) {
353 kgid_t kgid = i_gid_into_mnt(mnt_userns, inode);
354 if (in_group_p(kgid))
355 mode >>= 3;
356 }
357
358
359 return (mask & ~mode) ? -EACCES : 0;
360}
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384int generic_permission(struct user_namespace *mnt_userns, struct inode *inode,
385 int mask)
386{
387 int ret;
388
389
390
391
392 ret = acl_permission_check(mnt_userns, inode, mask);
393 if (ret != -EACCES)
394 return ret;
395
396 if (S_ISDIR(inode->i_mode)) {
397
398 if (!(mask & MAY_WRITE))
399 if (capable_wrt_inode_uidgid(mnt_userns, inode,
400 CAP_DAC_READ_SEARCH))
401 return 0;
402 if (capable_wrt_inode_uidgid(mnt_userns, inode,
403 CAP_DAC_OVERRIDE))
404 return 0;
405 return -EACCES;
406 }
407
408
409
410
411 mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
412 if (mask == MAY_READ)
413 if (capable_wrt_inode_uidgid(mnt_userns, inode,
414 CAP_DAC_READ_SEARCH))
415 return 0;
416
417
418
419
420
421 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
422 if (capable_wrt_inode_uidgid(mnt_userns, inode,
423 CAP_DAC_OVERRIDE))
424 return 0;
425
426 return -EACCES;
427}
428EXPORT_SYMBOL(generic_permission);
429
430
431
432
433
434
435
436
437
438
439
440
441static inline int do_inode_permission(struct user_namespace *mnt_userns,
442 struct inode *inode, int mask)
443{
444 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
445 if (likely(inode->i_op->permission))
446 return inode->i_op->permission(mnt_userns, inode, mask);
447
448
449 spin_lock(&inode->i_lock);
450 inode->i_opflags |= IOP_FASTPERM;
451 spin_unlock(&inode->i_lock);
452 }
453 return generic_permission(mnt_userns, inode, mask);
454}
455
456
457
458
459
460
461
462
463
464static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
465{
466 if (unlikely(mask & MAY_WRITE)) {
467 umode_t mode = inode->i_mode;
468
469
470 if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
471 return -EROFS;
472 }
473 return 0;
474}
475
476
477
478
479
480
481
482
483
484
485
486
487
488int inode_permission(struct user_namespace *mnt_userns,
489 struct inode *inode, int mask)
490{
491 int retval;
492
493 retval = sb_permission(inode->i_sb, inode, mask);
494 if (retval)
495 return retval;
496
497 if (unlikely(mask & MAY_WRITE)) {
498
499
500
501 if (IS_IMMUTABLE(inode))
502 return -EPERM;
503
504
505
506
507
508
509 if (HAS_UNMAPPED_ID(mnt_userns, inode))
510 return -EACCES;
511 }
512
513 retval = do_inode_permission(mnt_userns, inode, mask);
514 if (retval)
515 return retval;
516
517 retval = devcgroup_inode_permission(inode, mask);
518 if (retval)
519 return retval;
520
521 return security_inode_permission(inode, mask);
522}
523EXPORT_SYMBOL(inode_permission);
524
525
526
527
528
529
530
531void path_get(const struct path *path)
532{
533 mntget(path->mnt);
534 dget(path->dentry);
535}
536EXPORT_SYMBOL(path_get);
537
538
539
540
541
542
543
544void path_put(const struct path *path)
545{
546 dput(path->dentry);
547 mntput(path->mnt);
548}
549EXPORT_SYMBOL(path_put);
550
551#define EMBEDDED_LEVELS 2
552struct nameidata {
553 struct path path;
554 struct qstr last;
555 struct path root;
556 struct inode *inode;
557 unsigned int flags, state;
558 unsigned seq, m_seq, r_seq;
559 int last_type;
560 unsigned depth;
561 int total_link_count;
562 struct saved {
563 struct path link;
564 struct delayed_call done;
565 const char *name;
566 unsigned seq;
567 } *stack, internal[EMBEDDED_LEVELS];
568 struct filename *name;
569 struct nameidata *saved;
570 unsigned root_seq;
571 int dfd;
572 kuid_t dir_uid;
573 umode_t dir_mode;
574} __randomize_layout;
575
576#define ND_ROOT_PRESET 1
577#define ND_ROOT_GRABBED 2
578#define ND_JUMPED 4
579
580static void __set_nameidata(struct nameidata *p, int dfd, struct filename *name)
581{
582 struct nameidata *old = current->nameidata;
583 p->stack = p->internal;
584 p->depth = 0;
585 p->dfd = dfd;
586 p->name = name;
587 p->path.mnt = NULL;
588 p->path.dentry = NULL;
589 p->total_link_count = old ? old->total_link_count : 0;
590 p->saved = old;
591 current->nameidata = p;
592}
593
594static inline void set_nameidata(struct nameidata *p, int dfd, struct filename *name,
595 const struct path *root)
596{
597 __set_nameidata(p, dfd, name);
598 p->state = 0;
599 if (unlikely(root)) {
600 p->state = ND_ROOT_PRESET;
601 p->root = *root;
602 }
603}
604
605static void restore_nameidata(void)
606{
607 struct nameidata *now = current->nameidata, *old = now->saved;
608
609 current->nameidata = old;
610 if (old)
611 old->total_link_count = now->total_link_count;
612 if (now->stack != now->internal)
613 kfree(now->stack);
614}
615
616static bool nd_alloc_stack(struct nameidata *nd)
617{
618 struct saved *p;
619
620 p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
621 nd->flags & LOOKUP_RCU ? GFP_ATOMIC : GFP_KERNEL);
622 if (unlikely(!p))
623 return false;
624 memcpy(p, nd->internal, sizeof(nd->internal));
625 nd->stack = p;
626 return true;
627}
628
629
630
631
632
633
634
635static bool path_connected(struct vfsmount *mnt, struct dentry *dentry)
636{
637 struct super_block *sb = mnt->mnt_sb;
638
639
640 if (mnt->mnt_root == sb->s_root)
641 return true;
642
643 return is_subdir(dentry, mnt->mnt_root);
644}
645
646static void drop_links(struct nameidata *nd)
647{
648 int i = nd->depth;
649 while (i--) {
650 struct saved *last = nd->stack + i;
651 do_delayed_call(&last->done);
652 clear_delayed_call(&last->done);
653 }
654}
655
656static void terminate_walk(struct nameidata *nd)
657{
658 drop_links(nd);
659 if (!(nd->flags & LOOKUP_RCU)) {
660 int i;
661 path_put(&nd->path);
662 for (i = 0; i < nd->depth; i++)
663 path_put(&nd->stack[i].link);
664 if (nd->state & ND_ROOT_GRABBED) {
665 path_put(&nd->root);
666 nd->state &= ~ND_ROOT_GRABBED;
667 }
668 } else {
669 nd->flags &= ~LOOKUP_RCU;
670 rcu_read_unlock();
671 }
672 nd->depth = 0;
673 nd->path.mnt = NULL;
674 nd->path.dentry = NULL;
675}
676
677
678static bool __legitimize_path(struct path *path, unsigned seq, unsigned mseq)
679{
680 int res = __legitimize_mnt(path->mnt, mseq);
681 if (unlikely(res)) {
682 if (res > 0)
683 path->mnt = NULL;
684 path->dentry = NULL;
685 return false;
686 }
687 if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
688 path->dentry = NULL;
689 return false;
690 }
691 return !read_seqcount_retry(&path->dentry->d_seq, seq);
692}
693
694static inline bool legitimize_path(struct nameidata *nd,
695 struct path *path, unsigned seq)
696{
697 return __legitimize_path(path, seq, nd->m_seq);
698}
699
700static bool legitimize_links(struct nameidata *nd)
701{
702 int i;
703 if (unlikely(nd->flags & LOOKUP_CACHED)) {
704 drop_links(nd);
705 nd->depth = 0;
706 return false;
707 }
708 for (i = 0; i < nd->depth; i++) {
709 struct saved *last = nd->stack + i;
710 if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
711 drop_links(nd);
712 nd->depth = i + 1;
713 return false;
714 }
715 }
716 return true;
717}
718
719static bool legitimize_root(struct nameidata *nd)
720{
721
722
723
724
725
726 if (!nd->root.mnt && (nd->flags & LOOKUP_IS_SCOPED))
727 return false;
728
729 if (!nd->root.mnt || (nd->state & ND_ROOT_PRESET))
730 return true;
731 nd->state |= ND_ROOT_GRABBED;
732 return legitimize_path(nd, &nd->root, nd->root_seq);
733}
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757static bool try_to_unlazy(struct nameidata *nd)
758{
759 struct dentry *parent = nd->path.dentry;
760
761 BUG_ON(!(nd->flags & LOOKUP_RCU));
762
763 nd->flags &= ~LOOKUP_RCU;
764 if (unlikely(!legitimize_links(nd)))
765 goto out1;
766 if (unlikely(!legitimize_path(nd, &nd->path, nd->seq)))
767 goto out;
768 if (unlikely(!legitimize_root(nd)))
769 goto out;
770 rcu_read_unlock();
771 BUG_ON(nd->inode != parent->d_inode);
772 return true;
773
774out1:
775 nd->path.mnt = NULL;
776 nd->path.dentry = NULL;
777out:
778 rcu_read_unlock();
779 return false;
780}
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795static bool try_to_unlazy_next(struct nameidata *nd, struct dentry *dentry, unsigned seq)
796{
797 BUG_ON(!(nd->flags & LOOKUP_RCU));
798
799 nd->flags &= ~LOOKUP_RCU;
800 if (unlikely(!legitimize_links(nd)))
801 goto out2;
802 if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq)))
803 goto out2;
804 if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref)))
805 goto out1;
806
807
808
809
810
811
812
813
814 if (unlikely(!lockref_get_not_dead(&dentry->d_lockref)))
815 goto out;
816 if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
817 goto out_dput;
818
819
820
821
822 if (unlikely(!legitimize_root(nd)))
823 goto out_dput;
824 rcu_read_unlock();
825 return true;
826
827out2:
828 nd->path.mnt = NULL;
829out1:
830 nd->path.dentry = NULL;
831out:
832 rcu_read_unlock();
833 return false;
834out_dput:
835 rcu_read_unlock();
836 dput(dentry);
837 return false;
838}
839
840static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
841{
842 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
843 return dentry->d_op->d_revalidate(dentry, flags);
844 else
845 return 1;
846}
847
848
849
850
851
852
853
854
855
856
857
858static int complete_walk(struct nameidata *nd)
859{
860 struct dentry *dentry = nd->path.dentry;
861 int status;
862
863 if (nd->flags & LOOKUP_RCU) {
864
865
866
867
868 if (!(nd->state & ND_ROOT_PRESET))
869 if (!(nd->flags & LOOKUP_IS_SCOPED))
870 nd->root.mnt = NULL;
871 nd->flags &= ~LOOKUP_CACHED;
872 if (!try_to_unlazy(nd))
873 return -ECHILD;
874 }
875
876 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893 if (!path_is_under(&nd->path, &nd->root))
894 return -EXDEV;
895 }
896
897 if (likely(!(nd->state & ND_JUMPED)))
898 return 0;
899
900 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
901 return 0;
902
903 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
904 if (status > 0)
905 return 0;
906
907 if (!status)
908 status = -ESTALE;
909
910 return status;
911}
912
913static int set_root(struct nameidata *nd)
914{
915 struct fs_struct *fs = current->fs;
916
917
918
919
920
921
922 if (WARN_ON(nd->flags & LOOKUP_IS_SCOPED))
923 return -ENOTRECOVERABLE;
924
925 if (nd->flags & LOOKUP_RCU) {
926 unsigned seq;
927
928 do {
929 seq = read_seqcount_begin(&fs->seq);
930 nd->root = fs->root;
931 nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
932 } while (read_seqcount_retry(&fs->seq, seq));
933 } else {
934 get_fs_root(fs, &nd->root);
935 nd->state |= ND_ROOT_GRABBED;
936 }
937 return 0;
938}
939
940static int nd_jump_root(struct nameidata *nd)
941{
942 if (unlikely(nd->flags & LOOKUP_BENEATH))
943 return -EXDEV;
944 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
945
946 if (nd->path.mnt != NULL && nd->path.mnt != nd->root.mnt)
947 return -EXDEV;
948 }
949 if (!nd->root.mnt) {
950 int error = set_root(nd);
951 if (error)
952 return error;
953 }
954 if (nd->flags & LOOKUP_RCU) {
955 struct dentry *d;
956 nd->path = nd->root;
957 d = nd->path.dentry;
958 nd->inode = d->d_inode;
959 nd->seq = nd->root_seq;
960 if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq)))
961 return -ECHILD;
962 } else {
963 path_put(&nd->path);
964 nd->path = nd->root;
965 path_get(&nd->path);
966 nd->inode = nd->path.dentry->d_inode;
967 }
968 nd->state |= ND_JUMPED;
969 return 0;
970}
971
972
973
974
975
976int nd_jump_link(struct path *path)
977{
978 int error = -ELOOP;
979 struct nameidata *nd = current->nameidata;
980
981 if (unlikely(nd->flags & LOOKUP_NO_MAGICLINKS))
982 goto err;
983
984 error = -EXDEV;
985 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
986 if (nd->path.mnt != path->mnt)
987 goto err;
988 }
989
990 if (unlikely(nd->flags & LOOKUP_IS_SCOPED))
991 goto err;
992
993 path_put(&nd->path);
994 nd->path = *path;
995 nd->inode = nd->path.dentry->d_inode;
996 nd->state |= ND_JUMPED;
997 return 0;
998
999err:
1000 path_put(path);
1001 return error;
1002}
1003
1004static inline void put_link(struct nameidata *nd)
1005{
1006 struct saved *last = nd->stack + --nd->depth;
1007 do_delayed_call(&last->done);
1008 if (!(nd->flags & LOOKUP_RCU))
1009 path_put(&last->link);
1010}
1011
1012int sysctl_protected_symlinks __read_mostly = 0;
1013int sysctl_protected_hardlinks __read_mostly = 0;
1014int sysctl_protected_fifos __read_mostly;
1015int sysctl_protected_regular __read_mostly;
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032static inline int may_follow_link(struct nameidata *nd, const struct inode *inode)
1033{
1034 struct user_namespace *mnt_userns;
1035 kuid_t i_uid;
1036
1037 if (!sysctl_protected_symlinks)
1038 return 0;
1039
1040 mnt_userns = mnt_user_ns(nd->path.mnt);
1041 i_uid = i_uid_into_mnt(mnt_userns, inode);
1042
1043 if (uid_eq(current_cred()->fsuid, i_uid))
1044 return 0;
1045
1046
1047 if ((nd->dir_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
1048 return 0;
1049
1050
1051 if (uid_valid(nd->dir_uid) && uid_eq(nd->dir_uid, i_uid))
1052 return 0;
1053
1054 if (nd->flags & LOOKUP_RCU)
1055 return -ECHILD;
1056
1057 audit_inode(nd->name, nd->stack[0].link.dentry, 0);
1058 audit_log_path_denied(AUDIT_ANOM_LINK, "follow_link");
1059 return -EACCES;
1060}
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075static bool safe_hardlink_source(struct user_namespace *mnt_userns,
1076 struct inode *inode)
1077{
1078 umode_t mode = inode->i_mode;
1079
1080
1081 if (!S_ISREG(mode))
1082 return false;
1083
1084
1085 if (mode & S_ISUID)
1086 return false;
1087
1088
1089 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
1090 return false;
1091
1092
1093 if (inode_permission(mnt_userns, inode, MAY_READ | MAY_WRITE))
1094 return false;
1095
1096 return true;
1097}
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118int may_linkat(struct user_namespace *mnt_userns, struct path *link)
1119{
1120 struct inode *inode = link->dentry->d_inode;
1121
1122
1123 if (!uid_valid(i_uid_into_mnt(mnt_userns, inode)) ||
1124 !gid_valid(i_gid_into_mnt(mnt_userns, inode)))
1125 return -EOVERFLOW;
1126
1127 if (!sysctl_protected_hardlinks)
1128 return 0;
1129
1130
1131
1132
1133 if (safe_hardlink_source(mnt_userns, inode) ||
1134 inode_owner_or_capable(mnt_userns, inode))
1135 return 0;
1136
1137 audit_log_path_denied(AUDIT_ANOM_LINK, "linkat");
1138 return -EPERM;
1139}
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168static int may_create_in_sticky(struct user_namespace *mnt_userns,
1169 struct nameidata *nd, struct inode *const inode)
1170{
1171 umode_t dir_mode = nd->dir_mode;
1172 kuid_t dir_uid = nd->dir_uid;
1173
1174 if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
1175 (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
1176 likely(!(dir_mode & S_ISVTX)) ||
1177 uid_eq(i_uid_into_mnt(mnt_userns, inode), dir_uid) ||
1178 uid_eq(current_fsuid(), i_uid_into_mnt(mnt_userns, inode)))
1179 return 0;
1180
1181 if (likely(dir_mode & 0002) ||
1182 (dir_mode & 0020 &&
1183 ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
1184 (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
1185 const char *operation = S_ISFIFO(inode->i_mode) ?
1186 "sticky_create_fifo" :
1187 "sticky_create_regular";
1188 audit_log_path_denied(AUDIT_ANOM_CREAT, operation);
1189 return -EACCES;
1190 }
1191 return 0;
1192}
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204int follow_up(struct path *path)
1205{
1206 struct mount *mnt = real_mount(path->mnt);
1207 struct mount *parent;
1208 struct dentry *mountpoint;
1209
1210 read_seqlock_excl(&mount_lock);
1211 parent = mnt->mnt_parent;
1212 if (parent == mnt) {
1213 read_sequnlock_excl(&mount_lock);
1214 return 0;
1215 }
1216 mntget(&parent->mnt);
1217 mountpoint = dget(mnt->mnt_mountpoint);
1218 read_sequnlock_excl(&mount_lock);
1219 dput(path->dentry);
1220 path->dentry = mountpoint;
1221 mntput(path->mnt);
1222 path->mnt = &parent->mnt;
1223 return 1;
1224}
1225EXPORT_SYMBOL(follow_up);
1226
1227static bool choose_mountpoint_rcu(struct mount *m, const struct path *root,
1228 struct path *path, unsigned *seqp)
1229{
1230 while (mnt_has_parent(m)) {
1231 struct dentry *mountpoint = m->mnt_mountpoint;
1232
1233 m = m->mnt_parent;
1234 if (unlikely(root->dentry == mountpoint &&
1235 root->mnt == &m->mnt))
1236 break;
1237 if (mountpoint != m->mnt.mnt_root) {
1238 path->mnt = &m->mnt;
1239 path->dentry = mountpoint;
1240 *seqp = read_seqcount_begin(&mountpoint->d_seq);
1241 return true;
1242 }
1243 }
1244 return false;
1245}
1246
1247static bool choose_mountpoint(struct mount *m, const struct path *root,
1248 struct path *path)
1249{
1250 bool found;
1251
1252 rcu_read_lock();
1253 while (1) {
1254 unsigned seq, mseq = read_seqbegin(&mount_lock);
1255
1256 found = choose_mountpoint_rcu(m, root, path, &seq);
1257 if (unlikely(!found)) {
1258 if (!read_seqretry(&mount_lock, mseq))
1259 break;
1260 } else {
1261 if (likely(__legitimize_path(path, seq, mseq)))
1262 break;
1263 rcu_read_unlock();
1264 path_put(path);
1265 rcu_read_lock();
1266 }
1267 }
1268 rcu_read_unlock();
1269 return found;
1270}
1271
1272
1273
1274
1275
1276
1277static int follow_automount(struct path *path, int *count, unsigned lookup_flags)
1278{
1279 struct dentry *dentry = path->dentry;
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292 if (!(lookup_flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
1293 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
1294 dentry->d_inode)
1295 return -EISDIR;
1296
1297 if (count && (*count)++ >= MAXSYMLINKS)
1298 return -ELOOP;
1299
1300 return finish_automount(dentry->d_op->d_automount(path), path);
1301}
1302
1303
1304
1305
1306
1307
1308
1309static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped,
1310 int *count, unsigned lookup_flags)
1311{
1312 struct vfsmount *mnt = path->mnt;
1313 bool need_mntput = false;
1314 int ret = 0;
1315
1316 while (flags & DCACHE_MANAGED_DENTRY) {
1317
1318
1319 if (flags & DCACHE_MANAGE_TRANSIT) {
1320 ret = path->dentry->d_op->d_manage(path, false);
1321 flags = smp_load_acquire(&path->dentry->d_flags);
1322 if (ret < 0)
1323 break;
1324 }
1325
1326 if (flags & DCACHE_MOUNTED) {
1327 struct vfsmount *mounted = lookup_mnt(path);
1328 if (mounted) {
1329 dput(path->dentry);
1330 if (need_mntput)
1331 mntput(path->mnt);
1332 path->mnt = mounted;
1333 path->dentry = dget(mounted->mnt_root);
1334
1335 flags = path->dentry->d_flags;
1336 need_mntput = true;
1337 continue;
1338 }
1339 }
1340
1341 if (!(flags & DCACHE_NEED_AUTOMOUNT))
1342 break;
1343
1344
1345 ret = follow_automount(path, count, lookup_flags);
1346 flags = smp_load_acquire(&path->dentry->d_flags);
1347 if (ret < 0)
1348 break;
1349 }
1350
1351 if (ret == -EISDIR)
1352 ret = 0;
1353
1354 if (need_mntput && path->mnt == mnt)
1355 mntput(path->mnt);
1356 if (!ret && unlikely(d_flags_negative(flags)))
1357 ret = -ENOENT;
1358 *jumped = need_mntput;
1359 return ret;
1360}
1361
1362static inline int traverse_mounts(struct path *path, bool *jumped,
1363 int *count, unsigned lookup_flags)
1364{
1365 unsigned flags = smp_load_acquire(&path->dentry->d_flags);
1366
1367
1368 if (likely(!(flags & DCACHE_MANAGED_DENTRY))) {
1369 *jumped = false;
1370 if (unlikely(d_flags_negative(flags)))
1371 return -ENOENT;
1372 return 0;
1373 }
1374 return __traverse_mounts(path, flags, jumped, count, lookup_flags);
1375}
1376
1377int follow_down_one(struct path *path)
1378{
1379 struct vfsmount *mounted;
1380
1381 mounted = lookup_mnt(path);
1382 if (mounted) {
1383 dput(path->dentry);
1384 mntput(path->mnt);
1385 path->mnt = mounted;
1386 path->dentry = dget(mounted->mnt_root);
1387 return 1;
1388 }
1389 return 0;
1390}
1391EXPORT_SYMBOL(follow_down_one);
1392
1393
1394
1395
1396
1397
1398int follow_down(struct path *path)
1399{
1400 struct vfsmount *mnt = path->mnt;
1401 bool jumped;
1402 int ret = traverse_mounts(path, &jumped, NULL, 0);
1403
1404 if (path->mnt != mnt)
1405 mntput(mnt);
1406 return ret;
1407}
1408EXPORT_SYMBOL(follow_down);
1409
1410
1411
1412
1413
1414static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1415 struct inode **inode, unsigned *seqp)
1416{
1417 struct dentry *dentry = path->dentry;
1418 unsigned int flags = dentry->d_flags;
1419
1420 if (likely(!(flags & DCACHE_MANAGED_DENTRY)))
1421 return true;
1422
1423 if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1424 return false;
1425
1426 for (;;) {
1427
1428
1429
1430
1431 if (unlikely(flags & DCACHE_MANAGE_TRANSIT)) {
1432 int res = dentry->d_op->d_manage(path, true);
1433 if (res)
1434 return res == -EISDIR;
1435 flags = dentry->d_flags;
1436 }
1437
1438 if (flags & DCACHE_MOUNTED) {
1439 struct mount *mounted = __lookup_mnt(path->mnt, dentry);
1440 if (mounted) {
1441 path->mnt = &mounted->mnt;
1442 dentry = path->dentry = mounted->mnt.mnt_root;
1443 nd->state |= ND_JUMPED;
1444 *seqp = read_seqcount_begin(&dentry->d_seq);
1445 *inode = dentry->d_inode;
1446
1447
1448
1449
1450
1451
1452 flags = dentry->d_flags;
1453 continue;
1454 }
1455 if (read_seqretry(&mount_lock, nd->m_seq))
1456 return false;
1457 }
1458 return !(flags & DCACHE_NEED_AUTOMOUNT);
1459 }
1460}
1461
1462static inline int handle_mounts(struct nameidata *nd, struct dentry *dentry,
1463 struct path *path, struct inode **inode,
1464 unsigned int *seqp)
1465{
1466 bool jumped;
1467 int ret;
1468
1469 path->mnt = nd->path.mnt;
1470 path->dentry = dentry;
1471 if (nd->flags & LOOKUP_RCU) {
1472 unsigned int seq = *seqp;
1473 if (unlikely(!*inode))
1474 return -ENOENT;
1475 if (likely(__follow_mount_rcu(nd, path, inode, seqp)))
1476 return 0;
1477 if (!try_to_unlazy_next(nd, dentry, seq))
1478 return -ECHILD;
1479
1480 path->mnt = nd->path.mnt;
1481 path->dentry = dentry;
1482 }
1483 ret = traverse_mounts(path, &jumped, &nd->total_link_count, nd->flags);
1484 if (jumped) {
1485 if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1486 ret = -EXDEV;
1487 else
1488 nd->state |= ND_JUMPED;
1489 }
1490 if (unlikely(ret)) {
1491 dput(path->dentry);
1492 if (path->mnt != nd->path.mnt)
1493 mntput(path->mnt);
1494 } else {
1495 *inode = d_backing_inode(path->dentry);
1496 *seqp = 0;
1497 }
1498 return ret;
1499}
1500
1501
1502
1503
1504
1505static struct dentry *lookup_dcache(const struct qstr *name,
1506 struct dentry *dir,
1507 unsigned int flags)
1508{
1509 struct dentry *dentry = d_lookup(dir, name);
1510 if (dentry) {
1511 int error = d_revalidate(dentry, flags);
1512 if (unlikely(error <= 0)) {
1513 if (!error)
1514 d_invalidate(dentry);
1515 dput(dentry);
1516 return ERR_PTR(error);
1517 }
1518 }
1519 return dentry;
1520}
1521
1522
1523
1524
1525
1526
1527
1528
1529static struct dentry *__lookup_hash(const struct qstr *name,
1530 struct dentry *base, unsigned int flags)
1531{
1532 struct dentry *dentry = lookup_dcache(name, base, flags);
1533 struct dentry *old;
1534 struct inode *dir = base->d_inode;
1535
1536 if (dentry)
1537 return dentry;
1538
1539
1540 if (unlikely(IS_DEADDIR(dir)))
1541 return ERR_PTR(-ENOENT);
1542
1543 dentry = d_alloc(base, name);
1544 if (unlikely(!dentry))
1545 return ERR_PTR(-ENOMEM);
1546
1547 old = dir->i_op->lookup(dir, dentry, flags);
1548 if (unlikely(old)) {
1549 dput(dentry);
1550 dentry = old;
1551 }
1552 return dentry;
1553}
1554
1555static struct dentry *lookup_fast(struct nameidata *nd,
1556 struct inode **inode,
1557 unsigned *seqp)
1558{
1559 struct dentry *dentry, *parent = nd->path.dentry;
1560 int status = 1;
1561
1562
1563
1564
1565
1566
1567 if (nd->flags & LOOKUP_RCU) {
1568 unsigned seq;
1569 dentry = __d_lookup_rcu(parent, &nd->last, &seq);
1570 if (unlikely(!dentry)) {
1571 if (!try_to_unlazy(nd))
1572 return ERR_PTR(-ECHILD);
1573 return NULL;
1574 }
1575
1576
1577
1578
1579
1580 *inode = d_backing_inode(dentry);
1581 if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
1582 return ERR_PTR(-ECHILD);
1583
1584
1585
1586
1587
1588
1589
1590
1591 if (unlikely(__read_seqcount_retry(&parent->d_seq, nd->seq)))
1592 return ERR_PTR(-ECHILD);
1593
1594 *seqp = seq;
1595 status = d_revalidate(dentry, nd->flags);
1596 if (likely(status > 0))
1597 return dentry;
1598 if (!try_to_unlazy_next(nd, dentry, seq))
1599 return ERR_PTR(-ECHILD);
1600 if (status == -ECHILD)
1601
1602 status = d_revalidate(dentry, nd->flags);
1603 } else {
1604 dentry = __d_lookup(parent, &nd->last);
1605 if (unlikely(!dentry))
1606 return NULL;
1607 status = d_revalidate(dentry, nd->flags);
1608 }
1609 if (unlikely(status <= 0)) {
1610 if (!status)
1611 d_invalidate(dentry);
1612 dput(dentry);
1613 return ERR_PTR(status);
1614 }
1615 return dentry;
1616}
1617
1618
1619static struct dentry *__lookup_slow(const struct qstr *name,
1620 struct dentry *dir,
1621 unsigned int flags)
1622{
1623 struct dentry *dentry, *old;
1624 struct inode *inode = dir->d_inode;
1625 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
1626
1627
1628 if (unlikely(IS_DEADDIR(inode)))
1629 return ERR_PTR(-ENOENT);
1630again:
1631 dentry = d_alloc_parallel(dir, name, &wq);
1632 if (IS_ERR(dentry))
1633 return dentry;
1634 if (unlikely(!d_in_lookup(dentry))) {
1635 int error = d_revalidate(dentry, flags);
1636 if (unlikely(error <= 0)) {
1637 if (!error) {
1638 d_invalidate(dentry);
1639 dput(dentry);
1640 goto again;
1641 }
1642 dput(dentry);
1643 dentry = ERR_PTR(error);
1644 }
1645 } else {
1646 old = inode->i_op->lookup(inode, dentry, flags);
1647 d_lookup_done(dentry);
1648 if (unlikely(old)) {
1649 dput(dentry);
1650 dentry = old;
1651 }
1652 }
1653 return dentry;
1654}
1655
1656static struct dentry *lookup_slow(const struct qstr *name,
1657 struct dentry *dir,
1658 unsigned int flags)
1659{
1660 struct inode *inode = dir->d_inode;
1661 struct dentry *res;
1662 inode_lock_shared(inode);
1663 res = __lookup_slow(name, dir, flags);
1664 inode_unlock_shared(inode);
1665 return res;
1666}
1667
1668static inline int may_lookup(struct user_namespace *mnt_userns,
1669 struct nameidata *nd)
1670{
1671 if (nd->flags & LOOKUP_RCU) {
1672 int err = inode_permission(mnt_userns, nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1673 if (err != -ECHILD || !try_to_unlazy(nd))
1674 return err;
1675 }
1676 return inode_permission(mnt_userns, nd->inode, MAY_EXEC);
1677}
1678
1679static int reserve_stack(struct nameidata *nd, struct path *link, unsigned seq)
1680{
1681 if (unlikely(nd->total_link_count++ >= MAXSYMLINKS))
1682 return -ELOOP;
1683
1684 if (likely(nd->depth != EMBEDDED_LEVELS))
1685 return 0;
1686 if (likely(nd->stack != nd->internal))
1687 return 0;
1688 if (likely(nd_alloc_stack(nd)))
1689 return 0;
1690
1691 if (nd->flags & LOOKUP_RCU) {
1692
1693
1694 bool grabbed_link = legitimize_path(nd, link, seq);
1695
1696 if (!try_to_unlazy(nd) != 0 || !grabbed_link)
1697 return -ECHILD;
1698
1699 if (nd_alloc_stack(nd))
1700 return 0;
1701 }
1702 return -ENOMEM;
1703}
1704
1705enum {WALK_TRAILING = 1, WALK_MORE = 2, WALK_NOFOLLOW = 4};
1706
1707static const char *pick_link(struct nameidata *nd, struct path *link,
1708 struct inode *inode, unsigned seq, int flags)
1709{
1710 struct saved *last;
1711 const char *res;
1712 int error = reserve_stack(nd, link, seq);
1713
1714 if (unlikely(error)) {
1715 if (!(nd->flags & LOOKUP_RCU))
1716 path_put(link);
1717 return ERR_PTR(error);
1718 }
1719 last = nd->stack + nd->depth++;
1720 last->link = *link;
1721 clear_delayed_call(&last->done);
1722 last->seq = seq;
1723
1724 if (flags & WALK_TRAILING) {
1725 error = may_follow_link(nd, inode);
1726 if (unlikely(error))
1727 return ERR_PTR(error);
1728 }
1729
1730 if (unlikely(nd->flags & LOOKUP_NO_SYMLINKS) ||
1731 unlikely(link->mnt->mnt_flags & MNT_NOSYMFOLLOW))
1732 return ERR_PTR(-ELOOP);
1733
1734 if (!(nd->flags & LOOKUP_RCU)) {
1735 touch_atime(&last->link);
1736 cond_resched();
1737 } else if (atime_needs_update(&last->link, inode)) {
1738 if (!try_to_unlazy(nd))
1739 return ERR_PTR(-ECHILD);
1740 touch_atime(&last->link);
1741 }
1742
1743 error = security_inode_follow_link(link->dentry, inode,
1744 nd->flags & LOOKUP_RCU);
1745 if (unlikely(error))
1746 return ERR_PTR(error);
1747
1748 res = READ_ONCE(inode->i_link);
1749 if (!res) {
1750 const char * (*get)(struct dentry *, struct inode *,
1751 struct delayed_call *);
1752 get = inode->i_op->get_link;
1753 if (nd->flags & LOOKUP_RCU) {
1754 res = get(NULL, inode, &last->done);
1755 if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd))
1756 res = get(link->dentry, inode, &last->done);
1757 } else {
1758 res = get(link->dentry, inode, &last->done);
1759 }
1760 if (!res)
1761 goto all_done;
1762 if (IS_ERR(res))
1763 return res;
1764 }
1765 if (*res == '/') {
1766 error = nd_jump_root(nd);
1767 if (unlikely(error))
1768 return ERR_PTR(error);
1769 while (unlikely(*++res == '/'))
1770 ;
1771 }
1772 if (*res)
1773 return res;
1774all_done:
1775 put_link(nd);
1776 return NULL;
1777}
1778
1779
1780
1781
1782
1783
1784
1785static const char *step_into(struct nameidata *nd, int flags,
1786 struct dentry *dentry, struct inode *inode, unsigned seq)
1787{
1788 struct path path;
1789 int err = handle_mounts(nd, dentry, &path, &inode, &seq);
1790
1791 if (err < 0)
1792 return ERR_PTR(err);
1793 if (likely(!d_is_symlink(path.dentry)) ||
1794 ((flags & WALK_TRAILING) && !(nd->flags & LOOKUP_FOLLOW)) ||
1795 (flags & WALK_NOFOLLOW)) {
1796
1797 if (!(nd->flags & LOOKUP_RCU)) {
1798 dput(nd->path.dentry);
1799 if (nd->path.mnt != path.mnt)
1800 mntput(nd->path.mnt);
1801 }
1802 nd->path = path;
1803 nd->inode = inode;
1804 nd->seq = seq;
1805 return NULL;
1806 }
1807 if (nd->flags & LOOKUP_RCU) {
1808
1809 if (read_seqcount_retry(&path.dentry->d_seq, seq))
1810 return ERR_PTR(-ECHILD);
1811 } else {
1812 if (path.mnt == nd->path.mnt)
1813 mntget(path.mnt);
1814 }
1815 return pick_link(nd, &path, inode, seq, flags);
1816}
1817
1818static struct dentry *follow_dotdot_rcu(struct nameidata *nd,
1819 struct inode **inodep,
1820 unsigned *seqp)
1821{
1822 struct dentry *parent, *old;
1823
1824 if (path_equal(&nd->path, &nd->root))
1825 goto in_root;
1826 if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
1827 struct path path;
1828 unsigned seq;
1829 if (!choose_mountpoint_rcu(real_mount(nd->path.mnt),
1830 &nd->root, &path, &seq))
1831 goto in_root;
1832 if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1833 return ERR_PTR(-ECHILD);
1834 nd->path = path;
1835 nd->inode = path.dentry->d_inode;
1836 nd->seq = seq;
1837 if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
1838 return ERR_PTR(-ECHILD);
1839
1840 }
1841 old = nd->path.dentry;
1842 parent = old->d_parent;
1843 *inodep = parent->d_inode;
1844 *seqp = read_seqcount_begin(&parent->d_seq);
1845 if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq)))
1846 return ERR_PTR(-ECHILD);
1847 if (unlikely(!path_connected(nd->path.mnt, parent)))
1848 return ERR_PTR(-ECHILD);
1849 return parent;
1850in_root:
1851 if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
1852 return ERR_PTR(-ECHILD);
1853 if (unlikely(nd->flags & LOOKUP_BENEATH))
1854 return ERR_PTR(-ECHILD);
1855 return NULL;
1856}
1857
1858static struct dentry *follow_dotdot(struct nameidata *nd,
1859 struct inode **inodep,
1860 unsigned *seqp)
1861{
1862 struct dentry *parent;
1863
1864 if (path_equal(&nd->path, &nd->root))
1865 goto in_root;
1866 if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
1867 struct path path;
1868
1869 if (!choose_mountpoint(real_mount(nd->path.mnt),
1870 &nd->root, &path))
1871 goto in_root;
1872 path_put(&nd->path);
1873 nd->path = path;
1874 nd->inode = path.dentry->d_inode;
1875 if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1876 return ERR_PTR(-EXDEV);
1877 }
1878
1879 parent = dget_parent(nd->path.dentry);
1880 if (unlikely(!path_connected(nd->path.mnt, parent))) {
1881 dput(parent);
1882 return ERR_PTR(-ENOENT);
1883 }
1884 *seqp = 0;
1885 *inodep = parent->d_inode;
1886 return parent;
1887
1888in_root:
1889 if (unlikely(nd->flags & LOOKUP_BENEATH))
1890 return ERR_PTR(-EXDEV);
1891 dget(nd->path.dentry);
1892 return NULL;
1893}
1894
1895static const char *handle_dots(struct nameidata *nd, int type)
1896{
1897 if (type == LAST_DOTDOT) {
1898 const char *error = NULL;
1899 struct dentry *parent;
1900 struct inode *inode;
1901 unsigned seq;
1902
1903 if (!nd->root.mnt) {
1904 error = ERR_PTR(set_root(nd));
1905 if (error)
1906 return error;
1907 }
1908 if (nd->flags & LOOKUP_RCU)
1909 parent = follow_dotdot_rcu(nd, &inode, &seq);
1910 else
1911 parent = follow_dotdot(nd, &inode, &seq);
1912 if (IS_ERR(parent))
1913 return ERR_CAST(parent);
1914 if (unlikely(!parent))
1915 error = step_into(nd, WALK_NOFOLLOW,
1916 nd->path.dentry, nd->inode, nd->seq);
1917 else
1918 error = step_into(nd, WALK_NOFOLLOW,
1919 parent, inode, seq);
1920 if (unlikely(error))
1921 return error;
1922
1923 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
1924
1925
1926
1927
1928
1929
1930 smp_rmb();
1931 if (unlikely(__read_seqcount_retry(&mount_lock.seqcount, nd->m_seq)))
1932 return ERR_PTR(-EAGAIN);
1933 if (unlikely(__read_seqcount_retry(&rename_lock.seqcount, nd->r_seq)))
1934 return ERR_PTR(-EAGAIN);
1935 }
1936 }
1937 return NULL;
1938}
1939
1940static const char *walk_component(struct nameidata *nd, int flags)
1941{
1942 struct dentry *dentry;
1943 struct inode *inode;
1944 unsigned seq;
1945
1946
1947
1948
1949
1950 if (unlikely(nd->last_type != LAST_NORM)) {
1951 if (!(flags & WALK_MORE) && nd->depth)
1952 put_link(nd);
1953 return handle_dots(nd, nd->last_type);
1954 }
1955 dentry = lookup_fast(nd, &inode, &seq);
1956 if (IS_ERR(dentry))
1957 return ERR_CAST(dentry);
1958 if (unlikely(!dentry)) {
1959 dentry = lookup_slow(&nd->last, nd->path.dentry, nd->flags);
1960 if (IS_ERR(dentry))
1961 return ERR_CAST(dentry);
1962 }
1963 if (!(flags & WALK_MORE) && nd->depth)
1964 put_link(nd);
1965 return step_into(nd, flags, dentry, inode, seq);
1966}
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985#ifdef CONFIG_DCACHE_WORD_ACCESS
1986
1987#include <asm/word-at-a-time.h>
1988
1989#ifdef HASH_MIX
1990
1991
1992
1993#elif defined(CONFIG_64BIT)
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023#define HASH_MIX(x, y, a) \
2024 ( x ^= (a), \
2025 y ^= x, x = rol64(x,12),\
2026 x += y, y = rol64(y,45),\
2027 y *= 9 )
2028
2029
2030
2031
2032
2033
2034static inline unsigned int fold_hash(unsigned long x, unsigned long y)
2035{
2036 y ^= x * GOLDEN_RATIO_64;
2037 y *= GOLDEN_RATIO_64;
2038 return y >> 32;
2039}
2040
2041#else
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053#define HASH_MIX(x, y, a) \
2054 ( x ^= (a), \
2055 y ^= x, x = rol32(x, 7),\
2056 x += y, y = rol32(y,20),\
2057 y *= 9 )
2058
2059static inline unsigned int fold_hash(unsigned long x, unsigned long y)
2060{
2061
2062 return __hash_32(y ^ __hash_32(x));
2063}
2064
2065#endif
2066
2067
2068
2069
2070
2071
2072
2073
2074unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2075{
2076 unsigned long a, x = 0, y = (unsigned long)salt;
2077
2078 for (;;) {
2079 if (!len)
2080 goto done;
2081 a = load_unaligned_zeropad(name);
2082 if (len < sizeof(unsigned long))
2083 break;
2084 HASH_MIX(x, y, a);
2085 name += sizeof(unsigned long);
2086 len -= sizeof(unsigned long);
2087 }
2088 x ^= a & bytemask_from_count(len);
2089done:
2090 return fold_hash(x, y);
2091}
2092EXPORT_SYMBOL(full_name_hash);
2093
2094
2095u64 hashlen_string(const void *salt, const char *name)
2096{
2097 unsigned long a = 0, x = 0, y = (unsigned long)salt;
2098 unsigned long adata, mask, len;
2099 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
2100
2101 len = 0;
2102 goto inside;
2103
2104 do {
2105 HASH_MIX(x, y, a);
2106 len += sizeof(unsigned long);
2107inside:
2108 a = load_unaligned_zeropad(name+len);
2109 } while (!has_zero(a, &adata, &constants));
2110
2111 adata = prep_zero_mask(a, adata, &constants);
2112 mask = create_zero_mask(adata);
2113 x ^= a & zero_bytemask(mask);
2114
2115 return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2116}
2117EXPORT_SYMBOL(hashlen_string);
2118
2119
2120
2121
2122
2123static inline u64 hash_name(const void *salt, const char *name)
2124{
2125 unsigned long a = 0, b, x = 0, y = (unsigned long)salt;
2126 unsigned long adata, bdata, mask, len;
2127 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
2128
2129 len = 0;
2130 goto inside;
2131
2132 do {
2133 HASH_MIX(x, y, a);
2134 len += sizeof(unsigned long);
2135inside:
2136 a = load_unaligned_zeropad(name+len);
2137 b = a ^ REPEAT_BYTE('/');
2138 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
2139
2140 adata = prep_zero_mask(a, adata, &constants);
2141 bdata = prep_zero_mask(b, bdata, &constants);
2142 mask = create_zero_mask(adata | bdata);
2143 x ^= a & zero_bytemask(mask);
2144
2145 return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2146}
2147
2148#else
2149
2150
2151unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2152{
2153 unsigned long hash = init_name_hash(salt);
2154 while (len--)
2155 hash = partial_name_hash((unsigned char)*name++, hash);
2156 return end_name_hash(hash);
2157}
2158EXPORT_SYMBOL(full_name_hash);
2159
2160
2161u64 hashlen_string(const void *salt, const char *name)
2162{
2163 unsigned long hash = init_name_hash(salt);
2164 unsigned long len = 0, c;
2165
2166 c = (unsigned char)*name;
2167 while (c) {
2168 len++;
2169 hash = partial_name_hash(c, hash);
2170 c = (unsigned char)name[len];
2171 }
2172 return hashlen_create(end_name_hash(hash), len);
2173}
2174EXPORT_SYMBOL(hashlen_string);
2175
2176
2177
2178
2179
2180static inline u64 hash_name(const void *salt, const char *name)
2181{
2182 unsigned long hash = init_name_hash(salt);
2183 unsigned long len = 0, c;
2184
2185 c = (unsigned char)*name;
2186 do {
2187 len++;
2188 hash = partial_name_hash(c, hash);
2189 c = (unsigned char)name[len];
2190 } while (c && c != '/');
2191 return hashlen_create(end_name_hash(hash), len);
2192}
2193
2194#endif
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204static int link_path_walk(const char *name, struct nameidata *nd)
2205{
2206 int depth = 0;
2207 int err;
2208
2209 nd->last_type = LAST_ROOT;
2210 nd->flags |= LOOKUP_PARENT;
2211 if (IS_ERR(name))
2212 return PTR_ERR(name);
2213 while (*name=='/')
2214 name++;
2215 if (!*name) {
2216 nd->dir_mode = 0;
2217 return 0;
2218 }
2219
2220
2221 for(;;) {
2222 struct user_namespace *mnt_userns;
2223 const char *link;
2224 u64 hash_len;
2225 int type;
2226
2227 mnt_userns = mnt_user_ns(nd->path.mnt);
2228 err = may_lookup(mnt_userns, nd);
2229 if (err)
2230 return err;
2231
2232 hash_len = hash_name(nd->path.dentry, name);
2233
2234 type = LAST_NORM;
2235 if (name[0] == '.') switch (hashlen_len(hash_len)) {
2236 case 2:
2237 if (name[1] == '.') {
2238 type = LAST_DOTDOT;
2239 nd->state |= ND_JUMPED;
2240 }
2241 break;
2242 case 1:
2243 type = LAST_DOT;
2244 }
2245 if (likely(type == LAST_NORM)) {
2246 struct dentry *parent = nd->path.dentry;
2247 nd->state &= ~ND_JUMPED;
2248 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
2249 struct qstr this = { { .hash_len = hash_len }, .name = name };
2250 err = parent->d_op->d_hash(parent, &this);
2251 if (err < 0)
2252 return err;
2253 hash_len = this.hash_len;
2254 name = this.name;
2255 }
2256 }
2257
2258 nd->last.hash_len = hash_len;
2259 nd->last.name = name;
2260 nd->last_type = type;
2261
2262 name += hashlen_len(hash_len);
2263 if (!*name)
2264 goto OK;
2265
2266
2267
2268
2269 do {
2270 name++;
2271 } while (unlikely(*name == '/'));
2272 if (unlikely(!*name)) {
2273OK:
2274
2275 if (!depth) {
2276 nd->dir_uid = i_uid_into_mnt(mnt_userns, nd->inode);
2277 nd->dir_mode = nd->inode->i_mode;
2278 nd->flags &= ~LOOKUP_PARENT;
2279 return 0;
2280 }
2281
2282 name = nd->stack[--depth].name;
2283 link = walk_component(nd, 0);
2284 } else {
2285
2286 link = walk_component(nd, WALK_MORE);
2287 }
2288 if (unlikely(link)) {
2289 if (IS_ERR(link))
2290 return PTR_ERR(link);
2291
2292 nd->stack[depth++].name = name;
2293 name = link;
2294 continue;
2295 }
2296 if (unlikely(!d_can_lookup(nd->path.dentry))) {
2297 if (nd->flags & LOOKUP_RCU) {
2298 if (!try_to_unlazy(nd))
2299 return -ECHILD;
2300 }
2301 return -ENOTDIR;
2302 }
2303 }
2304}
2305
2306
2307static const char *path_init(struct nameidata *nd, unsigned flags)
2308{
2309 int error;
2310 const char *s = nd->name->name;
2311
2312
2313 if ((flags & (LOOKUP_RCU | LOOKUP_CACHED)) == LOOKUP_CACHED)
2314 return ERR_PTR(-EAGAIN);
2315
2316 if (!*s)
2317 flags &= ~LOOKUP_RCU;
2318 if (flags & LOOKUP_RCU)
2319 rcu_read_lock();
2320
2321 nd->flags = flags;
2322 nd->state |= ND_JUMPED;
2323
2324 nd->m_seq = __read_seqcount_begin(&mount_lock.seqcount);
2325 nd->r_seq = __read_seqcount_begin(&rename_lock.seqcount);
2326 smp_rmb();
2327
2328 if (nd->state & ND_ROOT_PRESET) {
2329 struct dentry *root = nd->root.dentry;
2330 struct inode *inode = root->d_inode;
2331 if (*s && unlikely(!d_can_lookup(root)))
2332 return ERR_PTR(-ENOTDIR);
2333 nd->path = nd->root;
2334 nd->inode = inode;
2335 if (flags & LOOKUP_RCU) {
2336 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2337 nd->root_seq = nd->seq;
2338 } else {
2339 path_get(&nd->path);
2340 }
2341 return s;
2342 }
2343
2344 nd->root.mnt = NULL;
2345
2346
2347 if (*s == '/' && !(flags & LOOKUP_IN_ROOT)) {
2348 error = nd_jump_root(nd);
2349 if (unlikely(error))
2350 return ERR_PTR(error);
2351 return s;
2352 }
2353
2354
2355 if (nd->dfd == AT_FDCWD) {
2356 if (flags & LOOKUP_RCU) {
2357 struct fs_struct *fs = current->fs;
2358 unsigned seq;
2359
2360 do {
2361 seq = read_seqcount_begin(&fs->seq);
2362 nd->path = fs->pwd;
2363 nd->inode = nd->path.dentry->d_inode;
2364 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2365 } while (read_seqcount_retry(&fs->seq, seq));
2366 } else {
2367 get_fs_pwd(current->fs, &nd->path);
2368 nd->inode = nd->path.dentry->d_inode;
2369 }
2370 } else {
2371
2372 struct fd f = fdget_raw(nd->dfd);
2373 struct dentry *dentry;
2374
2375 if (!f.file)
2376 return ERR_PTR(-EBADF);
2377
2378 dentry = f.file->f_path.dentry;
2379
2380 if (*s && unlikely(!d_can_lookup(dentry))) {
2381 fdput(f);
2382 return ERR_PTR(-ENOTDIR);
2383 }
2384
2385 nd->path = f.file->f_path;
2386 if (flags & LOOKUP_RCU) {
2387 nd->inode = nd->path.dentry->d_inode;
2388 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2389 } else {
2390 path_get(&nd->path);
2391 nd->inode = nd->path.dentry->d_inode;
2392 }
2393 fdput(f);
2394 }
2395
2396
2397 if (flags & LOOKUP_IS_SCOPED) {
2398 nd->root = nd->path;
2399 if (flags & LOOKUP_RCU) {
2400 nd->root_seq = nd->seq;
2401 } else {
2402 path_get(&nd->root);
2403 nd->state |= ND_ROOT_GRABBED;
2404 }
2405 }
2406 return s;
2407}
2408
2409static inline const char *lookup_last(struct nameidata *nd)
2410{
2411 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
2412 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2413
2414 return walk_component(nd, WALK_TRAILING);
2415}
2416
2417static int handle_lookup_down(struct nameidata *nd)
2418{
2419 if (!(nd->flags & LOOKUP_RCU))
2420 dget(nd->path.dentry);
2421 return PTR_ERR(step_into(nd, WALK_NOFOLLOW,
2422 nd->path.dentry, nd->inode, nd->seq));
2423}
2424
2425
2426static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2427{
2428 const char *s = path_init(nd, flags);
2429 int err;
2430
2431 if (unlikely(flags & LOOKUP_DOWN) && !IS_ERR(s)) {
2432 err = handle_lookup_down(nd);
2433 if (unlikely(err < 0))
2434 s = ERR_PTR(err);
2435 }
2436
2437 while (!(err = link_path_walk(s, nd)) &&
2438 (s = lookup_last(nd)) != NULL)
2439 ;
2440 if (!err && unlikely(nd->flags & LOOKUP_MOUNTPOINT)) {
2441 err = handle_lookup_down(nd);
2442 nd->state &= ~ND_JUMPED;
2443 }
2444 if (!err)
2445 err = complete_walk(nd);
2446
2447 if (!err && nd->flags & LOOKUP_DIRECTORY)
2448 if (!d_can_lookup(nd->path.dentry))
2449 err = -ENOTDIR;
2450 if (!err) {
2451 *path = nd->path;
2452 nd->path.mnt = NULL;
2453 nd->path.dentry = NULL;
2454 }
2455 terminate_walk(nd);
2456 return err;
2457}
2458
2459int filename_lookup(int dfd, struct filename *name, unsigned flags,
2460 struct path *path, struct path *root)
2461{
2462 int retval;
2463 struct nameidata nd;
2464 if (IS_ERR(name))
2465 return PTR_ERR(name);
2466 set_nameidata(&nd, dfd, name, root);
2467 retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
2468 if (unlikely(retval == -ECHILD))
2469 retval = path_lookupat(&nd, flags, path);
2470 if (unlikely(retval == -ESTALE))
2471 retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
2472
2473 if (likely(!retval))
2474 audit_inode(name, path->dentry,
2475 flags & LOOKUP_MOUNTPOINT ? AUDIT_INODE_NOEVAL : 0);
2476 restore_nameidata();
2477 putname(name);
2478 return retval;
2479}
2480
2481
2482static int path_parentat(struct nameidata *nd, unsigned flags,
2483 struct path *parent)
2484{
2485 const char *s = path_init(nd, flags);
2486 int err = link_path_walk(s, nd);
2487 if (!err)
2488 err = complete_walk(nd);
2489 if (!err) {
2490 *parent = nd->path;
2491 nd->path.mnt = NULL;
2492 nd->path.dentry = NULL;
2493 }
2494 terminate_walk(nd);
2495 return err;
2496}
2497
2498static struct filename *filename_parentat(int dfd, struct filename *name,
2499 unsigned int flags, struct path *parent,
2500 struct qstr *last, int *type)
2501{
2502 int retval;
2503 struct nameidata nd;
2504
2505 if (IS_ERR(name))
2506 return name;
2507 set_nameidata(&nd, dfd, name, NULL);
2508 retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
2509 if (unlikely(retval == -ECHILD))
2510 retval = path_parentat(&nd, flags, parent);
2511 if (unlikely(retval == -ESTALE))
2512 retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
2513 if (likely(!retval)) {
2514 *last = nd.last;
2515 *type = nd.last_type;
2516 audit_inode(name, parent->dentry, AUDIT_INODE_PARENT);
2517 } else {
2518 putname(name);
2519 name = ERR_PTR(retval);
2520 }
2521 restore_nameidata();
2522 return name;
2523}
2524
2525
2526struct dentry *kern_path_locked(const char *name, struct path *path)
2527{
2528 struct filename *filename;
2529 struct dentry *d;
2530 struct qstr last;
2531 int type;
2532
2533 filename = filename_parentat(AT_FDCWD, getname_kernel(name), 0, path,
2534 &last, &type);
2535 if (IS_ERR(filename))
2536 return ERR_CAST(filename);
2537 if (unlikely(type != LAST_NORM)) {
2538 path_put(path);
2539 putname(filename);
2540 return ERR_PTR(-EINVAL);
2541 }
2542 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
2543 d = __lookup_hash(&last, path->dentry, 0);
2544 if (IS_ERR(d)) {
2545 inode_unlock(path->dentry->d_inode);
2546 path_put(path);
2547 }
2548 putname(filename);
2549 return d;
2550}
2551
2552int kern_path(const char *name, unsigned int flags, struct path *path)
2553{
2554 return filename_lookup(AT_FDCWD, getname_kernel(name),
2555 flags, path, NULL);
2556}
2557EXPORT_SYMBOL(kern_path);
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
2568 const char *name, unsigned int flags,
2569 struct path *path)
2570{
2571 struct path root = {.mnt = mnt, .dentry = dentry};
2572
2573 return filename_lookup(AT_FDCWD, getname_kernel(name),
2574 flags , path, &root);
2575}
2576EXPORT_SYMBOL(vfs_path_lookup);
2577
2578static int lookup_one_len_common(const char *name, struct dentry *base,
2579 int len, struct qstr *this)
2580{
2581 this->name = name;
2582 this->len = len;
2583 this->hash = full_name_hash(base, name, len);
2584 if (!len)
2585 return -EACCES;
2586
2587 if (unlikely(name[0] == '.')) {
2588 if (len < 2 || (len == 2 && name[1] == '.'))
2589 return -EACCES;
2590 }
2591
2592 while (len--) {
2593 unsigned int c = *(const unsigned char *)name++;
2594 if (c == '/' || c == '\0')
2595 return -EACCES;
2596 }
2597
2598
2599
2600
2601 if (base->d_flags & DCACHE_OP_HASH) {
2602 int err = base->d_op->d_hash(base, this);
2603 if (err < 0)
2604 return err;
2605 }
2606
2607 return inode_permission(&init_user_ns, base->d_inode, MAY_EXEC);
2608}
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624struct dentry *try_lookup_one_len(const char *name, struct dentry *base, int len)
2625{
2626 struct qstr this;
2627 int err;
2628
2629 WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2630
2631 err = lookup_one_len_common(name, base, len, &this);
2632 if (err)
2633 return ERR_PTR(err);
2634
2635 return lookup_dcache(&this, base, 0);
2636}
2637EXPORT_SYMBOL(try_lookup_one_len);
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
2651{
2652 struct dentry *dentry;
2653 struct qstr this;
2654 int err;
2655
2656 WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2657
2658 err = lookup_one_len_common(name, base, len, &this);
2659 if (err)
2660 return ERR_PTR(err);
2661
2662 dentry = lookup_dcache(&this, base, 0);
2663 return dentry ? dentry : __lookup_slow(&this, base, 0);
2664}
2665EXPORT_SYMBOL(lookup_one_len);
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679struct dentry *lookup_one_len_unlocked(const char *name,
2680 struct dentry *base, int len)
2681{
2682 struct qstr this;
2683 int err;
2684 struct dentry *ret;
2685
2686 err = lookup_one_len_common(name, base, len, &this);
2687 if (err)
2688 return ERR_PTR(err);
2689
2690 ret = lookup_dcache(&this, base, 0);
2691 if (!ret)
2692 ret = lookup_slow(&this, base, 0);
2693 return ret;
2694}
2695EXPORT_SYMBOL(lookup_one_len_unlocked);
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705struct dentry *lookup_positive_unlocked(const char *name,
2706 struct dentry *base, int len)
2707{
2708 struct dentry *ret = lookup_one_len_unlocked(name, base, len);
2709 if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) {
2710 dput(ret);
2711 ret = ERR_PTR(-ENOENT);
2712 }
2713 return ret;
2714}
2715EXPORT_SYMBOL(lookup_positive_unlocked);
2716
2717#ifdef CONFIG_UNIX98_PTYS
2718int path_pts(struct path *path)
2719{
2720
2721
2722
2723 struct dentry *parent = dget_parent(path->dentry);
2724 struct dentry *child;
2725 struct qstr this = QSTR_INIT("pts", 3);
2726
2727 if (unlikely(!path_connected(path->mnt, parent))) {
2728 dput(parent);
2729 return -ENOENT;
2730 }
2731 dput(path->dentry);
2732 path->dentry = parent;
2733 child = d_hash_and_lookup(parent, &this);
2734 if (!child)
2735 return -ENOENT;
2736
2737 path->dentry = child;
2738 dput(parent);
2739 follow_down(path);
2740 return 0;
2741}
2742#endif
2743
2744int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
2745 struct path *path, int *empty)
2746{
2747 return filename_lookup(dfd, getname_flags(name, flags, empty),
2748 flags, path, NULL);
2749}
2750EXPORT_SYMBOL(user_path_at_empty);
2751
2752int __check_sticky(struct user_namespace *mnt_userns, struct inode *dir,
2753 struct inode *inode)
2754{
2755 kuid_t fsuid = current_fsuid();
2756
2757 if (uid_eq(i_uid_into_mnt(mnt_userns, inode), fsuid))
2758 return 0;
2759 if (uid_eq(i_uid_into_mnt(mnt_userns, dir), fsuid))
2760 return 0;
2761 return !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FOWNER);
2762}
2763EXPORT_SYMBOL(__check_sticky);
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785static int may_delete(struct user_namespace *mnt_userns, struct inode *dir,
2786 struct dentry *victim, bool isdir)
2787{
2788 struct inode *inode = d_backing_inode(victim);
2789 int error;
2790
2791 if (d_is_negative(victim))
2792 return -ENOENT;
2793 BUG_ON(!inode);
2794
2795 BUG_ON(victim->d_parent->d_inode != dir);
2796
2797
2798 if (!uid_valid(i_uid_into_mnt(mnt_userns, inode)) ||
2799 !gid_valid(i_gid_into_mnt(mnt_userns, inode)))
2800 return -EOVERFLOW;
2801
2802 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2803
2804 error = inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC);
2805 if (error)
2806 return error;
2807 if (IS_APPEND(dir))
2808 return -EPERM;
2809
2810 if (check_sticky(mnt_userns, dir, inode) || IS_APPEND(inode) ||
2811 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) ||
2812 HAS_UNMAPPED_ID(mnt_userns, inode))
2813 return -EPERM;
2814 if (isdir) {
2815 if (!d_is_dir(victim))
2816 return -ENOTDIR;
2817 if (IS_ROOT(victim))
2818 return -EBUSY;
2819 } else if (d_is_dir(victim))
2820 return -EISDIR;
2821 if (IS_DEADDIR(dir))
2822 return -ENOENT;
2823 if (victim->d_flags & DCACHE_NFSFS_RENAMED)
2824 return -EBUSY;
2825 return 0;
2826}
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837static inline int may_create(struct user_namespace *mnt_userns,
2838 struct inode *dir, struct dentry *child)
2839{
2840 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
2841 if (child->d_inode)
2842 return -EEXIST;
2843 if (IS_DEADDIR(dir))
2844 return -ENOENT;
2845 if (!fsuidgid_has_mapping(dir->i_sb, mnt_userns))
2846 return -EOVERFLOW;
2847
2848 return inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC);
2849}
2850
2851
2852
2853
2854struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
2855{
2856 struct dentry *p;
2857
2858 if (p1 == p2) {
2859 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2860 return NULL;
2861 }
2862
2863 mutex_lock(&p1->d_sb->s_vfs_rename_mutex);
2864
2865 p = d_ancestor(p2, p1);
2866 if (p) {
2867 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
2868 inode_lock_nested(p1->d_inode, I_MUTEX_CHILD);
2869 return p;
2870 }
2871
2872 p = d_ancestor(p1, p2);
2873 if (p) {
2874 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2875 inode_lock_nested(p2->d_inode, I_MUTEX_CHILD);
2876 return p;
2877 }
2878
2879 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2880 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
2881 return NULL;
2882}
2883EXPORT_SYMBOL(lock_rename);
2884
2885void unlock_rename(struct dentry *p1, struct dentry *p2)
2886{
2887 inode_unlock(p1->d_inode);
2888 if (p1 != p2) {
2889 inode_unlock(p2->d_inode);
2890 mutex_unlock(&p1->d_sb->s_vfs_rename_mutex);
2891 }
2892}
2893EXPORT_SYMBOL(unlock_rename);
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911int vfs_create(struct user_namespace *mnt_userns, struct inode *dir,
2912 struct dentry *dentry, umode_t mode, bool want_excl)
2913{
2914 int error = may_create(mnt_userns, dir, dentry);
2915 if (error)
2916 return error;
2917
2918 if (!dir->i_op->create)
2919 return -EACCES;
2920 mode &= S_IALLUGO;
2921 mode |= S_IFREG;
2922 error = security_inode_create(dir, dentry, mode);
2923 if (error)
2924 return error;
2925 error = dir->i_op->create(mnt_userns, dir, dentry, mode, want_excl);
2926 if (!error)
2927 fsnotify_create(dir, dentry);
2928 return error;
2929}
2930EXPORT_SYMBOL(vfs_create);
2931
2932int vfs_mkobj(struct dentry *dentry, umode_t mode,
2933 int (*f)(struct dentry *, umode_t, void *),
2934 void *arg)
2935{
2936 struct inode *dir = dentry->d_parent->d_inode;
2937 int error = may_create(&init_user_ns, dir, dentry);
2938 if (error)
2939 return error;
2940
2941 mode &= S_IALLUGO;
2942 mode |= S_IFREG;
2943 error = security_inode_create(dir, dentry, mode);
2944 if (error)
2945 return error;
2946 error = f(dentry, mode, arg);
2947 if (!error)
2948 fsnotify_create(dir, dentry);
2949 return error;
2950}
2951EXPORT_SYMBOL(vfs_mkobj);
2952
2953bool may_open_dev(const struct path *path)
2954{
2955 return !(path->mnt->mnt_flags & MNT_NODEV) &&
2956 !(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
2957}
2958
2959static int may_open(struct user_namespace *mnt_userns, const struct path *path,
2960 int acc_mode, int flag)
2961{
2962 struct dentry *dentry = path->dentry;
2963 struct inode *inode = dentry->d_inode;
2964 int error;
2965
2966 if (!inode)
2967 return -ENOENT;
2968
2969 switch (inode->i_mode & S_IFMT) {
2970 case S_IFLNK:
2971 return -ELOOP;
2972 case S_IFDIR:
2973 if (acc_mode & MAY_WRITE)
2974 return -EISDIR;
2975 if (acc_mode & MAY_EXEC)
2976 return -EACCES;
2977 break;
2978 case S_IFBLK:
2979 case S_IFCHR:
2980 if (!may_open_dev(path))
2981 return -EACCES;
2982 fallthrough;
2983 case S_IFIFO:
2984 case S_IFSOCK:
2985 if (acc_mode & MAY_EXEC)
2986 return -EACCES;
2987 flag &= ~O_TRUNC;
2988 break;
2989 case S_IFREG:
2990 if ((acc_mode & MAY_EXEC) && path_noexec(path))
2991 return -EACCES;
2992 break;
2993 }
2994
2995 error = inode_permission(mnt_userns, inode, MAY_OPEN | acc_mode);
2996 if (error)
2997 return error;
2998
2999
3000
3001
3002 if (IS_APPEND(inode)) {
3003 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
3004 return -EPERM;
3005 if (flag & O_TRUNC)
3006 return -EPERM;
3007 }
3008
3009
3010 if (flag & O_NOATIME && !inode_owner_or_capable(mnt_userns, inode))
3011 return -EPERM;
3012
3013 return 0;
3014}
3015
3016static int handle_truncate(struct user_namespace *mnt_userns, struct file *filp)
3017{
3018 const struct path *path = &filp->f_path;
3019 struct inode *inode = path->dentry->d_inode;
3020 int error = get_write_access(inode);
3021 if (error)
3022 return error;
3023
3024
3025
3026 error = locks_verify_locked(filp);
3027 if (!error)
3028 error = security_path_truncate(path);
3029 if (!error) {
3030 error = do_truncate(mnt_userns, path->dentry, 0,
3031 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
3032 filp);
3033 }
3034 put_write_access(inode);
3035 return error;
3036}
3037
3038static inline int open_to_namei_flags(int flag)
3039{
3040 if ((flag & O_ACCMODE) == 3)
3041 flag--;
3042 return flag;
3043}
3044
3045static int may_o_create(struct user_namespace *mnt_userns,
3046 const struct path *dir, struct dentry *dentry,
3047 umode_t mode)
3048{
3049 int error = security_path_mknod(dir, dentry, mode, 0);
3050 if (error)
3051 return error;
3052
3053 if (!fsuidgid_has_mapping(dir->dentry->d_sb, mnt_userns))
3054 return -EOVERFLOW;
3055
3056 error = inode_permission(mnt_userns, dir->dentry->d_inode,
3057 MAY_WRITE | MAY_EXEC);
3058 if (error)
3059 return error;
3060
3061 return security_inode_create(dir->dentry->d_inode, dentry, mode);
3062}
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077static struct dentry *atomic_open(struct nameidata *nd, struct dentry *dentry,
3078 struct file *file,
3079 int open_flag, umode_t mode)
3080{
3081 struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
3082 struct inode *dir = nd->path.dentry->d_inode;
3083 int error;
3084
3085 if (nd->flags & LOOKUP_DIRECTORY)
3086 open_flag |= O_DIRECTORY;
3087
3088 file->f_path.dentry = DENTRY_NOT_SET;
3089 file->f_path.mnt = nd->path.mnt;
3090 error = dir->i_op->atomic_open(dir, dentry, file,
3091 open_to_namei_flags(open_flag), mode);
3092 d_lookup_done(dentry);
3093 if (!error) {
3094 if (file->f_mode & FMODE_OPENED) {
3095 if (unlikely(dentry != file->f_path.dentry)) {
3096 dput(dentry);
3097 dentry = dget(file->f_path.dentry);
3098 }
3099 } else if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
3100 error = -EIO;
3101 } else {
3102 if (file->f_path.dentry) {
3103 dput(dentry);
3104 dentry = file->f_path.dentry;
3105 }
3106 if (unlikely(d_is_negative(dentry)))
3107 error = -ENOENT;
3108 }
3109 }
3110 if (error) {
3111 dput(dentry);
3112 dentry = ERR_PTR(error);
3113 }
3114 return dentry;
3115}
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132static struct dentry *lookup_open(struct nameidata *nd, struct file *file,
3133 const struct open_flags *op,
3134 bool got_write)
3135{
3136 struct user_namespace *mnt_userns;
3137 struct dentry *dir = nd->path.dentry;
3138 struct inode *dir_inode = dir->d_inode;
3139 int open_flag = op->open_flag;
3140 struct dentry *dentry;
3141 int error, create_error = 0;
3142 umode_t mode = op->mode;
3143 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
3144
3145 if (unlikely(IS_DEADDIR(dir_inode)))
3146 return ERR_PTR(-ENOENT);
3147
3148 file->f_mode &= ~FMODE_CREATED;
3149 dentry = d_lookup(dir, &nd->last);
3150 for (;;) {
3151 if (!dentry) {
3152 dentry = d_alloc_parallel(dir, &nd->last, &wq);
3153 if (IS_ERR(dentry))
3154 return dentry;
3155 }
3156 if (d_in_lookup(dentry))
3157 break;
3158
3159 error = d_revalidate(dentry, nd->flags);
3160 if (likely(error > 0))
3161 break;
3162 if (error)
3163 goto out_dput;
3164 d_invalidate(dentry);
3165 dput(dentry);
3166 dentry = NULL;
3167 }
3168 if (dentry->d_inode) {
3169
3170 return dentry;
3171 }
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182 if (unlikely(!got_write))
3183 open_flag &= ~O_TRUNC;
3184 mnt_userns = mnt_user_ns(nd->path.mnt);
3185 if (open_flag & O_CREAT) {
3186 if (open_flag & O_EXCL)
3187 open_flag &= ~O_TRUNC;
3188 if (!IS_POSIXACL(dir->d_inode))
3189 mode &= ~current_umask();
3190 if (likely(got_write))
3191 create_error = may_o_create(mnt_userns, &nd->path,
3192 dentry, mode);
3193 else
3194 create_error = -EROFS;
3195 }
3196 if (create_error)
3197 open_flag &= ~O_CREAT;
3198 if (dir_inode->i_op->atomic_open) {
3199 dentry = atomic_open(nd, dentry, file, open_flag, mode);
3200 if (unlikely(create_error) && dentry == ERR_PTR(-ENOENT))
3201 dentry = ERR_PTR(create_error);
3202 return dentry;
3203 }
3204
3205 if (d_in_lookup(dentry)) {
3206 struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry,
3207 nd->flags);
3208 d_lookup_done(dentry);
3209 if (unlikely(res)) {
3210 if (IS_ERR(res)) {
3211 error = PTR_ERR(res);
3212 goto out_dput;
3213 }
3214 dput(dentry);
3215 dentry = res;
3216 }
3217 }
3218
3219
3220 if (!dentry->d_inode && (open_flag & O_CREAT)) {
3221 file->f_mode |= FMODE_CREATED;
3222 audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
3223 if (!dir_inode->i_op->create) {
3224 error = -EACCES;
3225 goto out_dput;
3226 }
3227
3228 error = dir_inode->i_op->create(mnt_userns, dir_inode, dentry,
3229 mode, open_flag & O_EXCL);
3230 if (error)
3231 goto out_dput;
3232 }
3233 if (unlikely(create_error) && !dentry->d_inode) {
3234 error = create_error;
3235 goto out_dput;
3236 }
3237 return dentry;
3238
3239out_dput:
3240 dput(dentry);
3241 return ERR_PTR(error);
3242}
3243
3244static const char *open_last_lookups(struct nameidata *nd,
3245 struct file *file, const struct open_flags *op)
3246{
3247 struct dentry *dir = nd->path.dentry;
3248 int open_flag = op->open_flag;
3249 bool got_write = false;
3250 unsigned seq;
3251 struct inode *inode;
3252 struct dentry *dentry;
3253 const char *res;
3254
3255 nd->flags |= op->intent;
3256
3257 if (nd->last_type != LAST_NORM) {
3258 if (nd->depth)
3259 put_link(nd);
3260 return handle_dots(nd, nd->last_type);
3261 }
3262
3263 if (!(open_flag & O_CREAT)) {
3264 if (nd->last.name[nd->last.len])
3265 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
3266
3267 dentry = lookup_fast(nd, &inode, &seq);
3268 if (IS_ERR(dentry))
3269 return ERR_CAST(dentry);
3270 if (likely(dentry))
3271 goto finish_lookup;
3272
3273 BUG_ON(nd->flags & LOOKUP_RCU);
3274 } else {
3275
3276 if (nd->flags & LOOKUP_RCU) {
3277 if (!try_to_unlazy(nd))
3278 return ERR_PTR(-ECHILD);
3279 }
3280 audit_inode(nd->name, dir, AUDIT_INODE_PARENT);
3281
3282 if (unlikely(nd->last.name[nd->last.len]))
3283 return ERR_PTR(-EISDIR);
3284 }
3285
3286 if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
3287 got_write = !mnt_want_write(nd->path.mnt);
3288
3289
3290
3291
3292
3293 }
3294 if (open_flag & O_CREAT)
3295 inode_lock(dir->d_inode);
3296 else
3297 inode_lock_shared(dir->d_inode);
3298 dentry = lookup_open(nd, file, op, got_write);
3299 if (!IS_ERR(dentry) && (file->f_mode & FMODE_CREATED))
3300 fsnotify_create(dir->d_inode, dentry);
3301 if (open_flag & O_CREAT)
3302 inode_unlock(dir->d_inode);
3303 else
3304 inode_unlock_shared(dir->d_inode);
3305
3306 if (got_write)
3307 mnt_drop_write(nd->path.mnt);
3308
3309 if (IS_ERR(dentry))
3310 return ERR_CAST(dentry);
3311
3312 if (file->f_mode & (FMODE_OPENED | FMODE_CREATED)) {
3313 dput(nd->path.dentry);
3314 nd->path.dentry = dentry;
3315 return NULL;
3316 }
3317
3318finish_lookup:
3319 if (nd->depth)
3320 put_link(nd);
3321 res = step_into(nd, WALK_TRAILING, dentry, inode, seq);
3322 if (unlikely(res))
3323 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3324 return res;
3325}
3326
3327
3328
3329
3330static int do_open(struct nameidata *nd,
3331 struct file *file, const struct open_flags *op)
3332{
3333 struct user_namespace *mnt_userns;
3334 int open_flag = op->open_flag;
3335 bool do_truncate;
3336 int acc_mode;
3337 int error;
3338
3339 if (!(file->f_mode & (FMODE_OPENED | FMODE_CREATED))) {
3340 error = complete_walk(nd);
3341 if (error)
3342 return error;
3343 }
3344 if (!(file->f_mode & FMODE_CREATED))
3345 audit_inode(nd->name, nd->path.dentry, 0);
3346 mnt_userns = mnt_user_ns(nd->path.mnt);
3347 if (open_flag & O_CREAT) {
3348 if ((open_flag & O_EXCL) && !(file->f_mode & FMODE_CREATED))
3349 return -EEXIST;
3350 if (d_is_dir(nd->path.dentry))
3351 return -EISDIR;
3352 error = may_create_in_sticky(mnt_userns, nd,
3353 d_backing_inode(nd->path.dentry));
3354 if (unlikely(error))
3355 return error;
3356 }
3357 if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
3358 return -ENOTDIR;
3359
3360 do_truncate = false;
3361 acc_mode = op->acc_mode;
3362 if (file->f_mode & FMODE_CREATED) {
3363
3364 open_flag &= ~O_TRUNC;
3365 acc_mode = 0;
3366 } else if (d_is_reg(nd->path.dentry) && open_flag & O_TRUNC) {
3367 error = mnt_want_write(nd->path.mnt);
3368 if (error)
3369 return error;
3370 do_truncate = true;
3371 }
3372 error = may_open(mnt_userns, &nd->path, acc_mode, open_flag);
3373 if (!error && !(file->f_mode & FMODE_OPENED))
3374 error = vfs_open(&nd->path, file);
3375 if (!error)
3376 error = ima_file_check(file, op->acc_mode);
3377 if (!error && do_truncate)
3378 error = handle_truncate(mnt_userns, file);
3379 if (unlikely(error > 0)) {
3380 WARN_ON(1);
3381 error = -EINVAL;
3382 }
3383 if (do_truncate)
3384 mnt_drop_write(nd->path.mnt);
3385 return error;
3386}
3387
3388
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398
3399
3400
3401
3402
3403struct dentry *vfs_tmpfile(struct user_namespace *mnt_userns,
3404 struct dentry *dentry, umode_t mode, int open_flag)
3405{
3406 struct dentry *child = NULL;
3407 struct inode *dir = dentry->d_inode;
3408 struct inode *inode;
3409 int error;
3410
3411
3412 error = inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC);
3413 if (error)
3414 goto out_err;
3415 error = -EOPNOTSUPP;
3416 if (!dir->i_op->tmpfile)
3417 goto out_err;
3418 error = -ENOMEM;
3419 child = d_alloc(dentry, &slash_name);
3420 if (unlikely(!child))
3421 goto out_err;
3422 error = dir->i_op->tmpfile(mnt_userns, dir, child, mode);
3423 if (error)
3424 goto out_err;
3425 error = -ENOENT;
3426 inode = child->d_inode;
3427 if (unlikely(!inode))
3428 goto out_err;
3429 if (!(open_flag & O_EXCL)) {
3430 spin_lock(&inode->i_lock);
3431 inode->i_state |= I_LINKABLE;
3432 spin_unlock(&inode->i_lock);
3433 }
3434 ima_post_create_tmpfile(mnt_userns, inode);
3435 return child;
3436
3437out_err:
3438 dput(child);
3439 return ERR_PTR(error);
3440}
3441EXPORT_SYMBOL(vfs_tmpfile);
3442
3443static int do_tmpfile(struct nameidata *nd, unsigned flags,
3444 const struct open_flags *op,
3445 struct file *file)
3446{
3447 struct user_namespace *mnt_userns;
3448 struct dentry *child;
3449 struct path path;
3450 int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
3451 if (unlikely(error))
3452 return error;
3453 error = mnt_want_write(path.mnt);
3454 if (unlikely(error))
3455 goto out;
3456 mnt_userns = mnt_user_ns(path.mnt);
3457 child = vfs_tmpfile(mnt_userns, path.dentry, op->mode, op->open_flag);
3458 error = PTR_ERR(child);
3459 if (IS_ERR(child))
3460 goto out2;
3461 dput(path.dentry);
3462 path.dentry = child;
3463 audit_inode(nd->name, child, 0);
3464
3465 error = may_open(mnt_userns, &path, 0, op->open_flag);
3466 if (!error)
3467 error = vfs_open(&path, file);
3468out2:
3469 mnt_drop_write(path.mnt);
3470out:
3471 path_put(&path);
3472 return error;
3473}
3474
3475static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file)
3476{
3477 struct path path;
3478 int error = path_lookupat(nd, flags, &path);
3479 if (!error) {
3480 audit_inode(nd->name, path.dentry, 0);
3481 error = vfs_open(&path, file);
3482 path_put(&path);
3483 }
3484 return error;
3485}
3486
3487static struct file *path_openat(struct nameidata *nd,
3488 const struct open_flags *op, unsigned flags)
3489{
3490 struct file *file;
3491 int error;
3492
3493 file = alloc_empty_file(op->open_flag, current_cred());
3494 if (IS_ERR(file))
3495 return file;
3496
3497 if (unlikely(file->f_flags & __O_TMPFILE)) {
3498 error = do_tmpfile(nd, flags, op, file);
3499 } else if (unlikely(file->f_flags & O_PATH)) {
3500 error = do_o_path(nd, flags, file);
3501 } else {
3502 const char *s = path_init(nd, flags);
3503 while (!(error = link_path_walk(s, nd)) &&
3504 (s = open_last_lookups(nd, file, op)) != NULL)
3505 ;
3506 if (!error)
3507 error = do_open(nd, file, op);
3508 terminate_walk(nd);
3509 }
3510 if (likely(!error)) {
3511 if (likely(file->f_mode & FMODE_OPENED))
3512 return file;
3513 WARN_ON(1);
3514 error = -EINVAL;
3515 }
3516 fput(file);
3517 if (error == -EOPENSTALE) {
3518 if (flags & LOOKUP_RCU)
3519 error = -ECHILD;
3520 else
3521 error = -ESTALE;
3522 }
3523 return ERR_PTR(error);
3524}
3525
3526struct file *do_filp_open(int dfd, struct filename *pathname,
3527 const struct open_flags *op)
3528{
3529 struct nameidata nd;
3530 int flags = op->lookup_flags;
3531 struct file *filp;
3532
3533 set_nameidata(&nd, dfd, pathname, NULL);
3534 filp = path_openat(&nd, op, flags | LOOKUP_RCU);
3535 if (unlikely(filp == ERR_PTR(-ECHILD)))
3536 filp = path_openat(&nd, op, flags);
3537 if (unlikely(filp == ERR_PTR(-ESTALE)))
3538 filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
3539 restore_nameidata();
3540 return filp;
3541}
3542
3543struct file *do_file_open_root(const struct path *root,
3544 const char *name, const struct open_flags *op)
3545{
3546 struct nameidata nd;
3547 struct file *file;
3548 struct filename *filename;
3549 int flags = op->lookup_flags;
3550
3551 if (d_is_symlink(root->dentry) && op->intent & LOOKUP_OPEN)
3552 return ERR_PTR(-ELOOP);
3553
3554 filename = getname_kernel(name);
3555 if (IS_ERR(filename))
3556 return ERR_CAST(filename);
3557
3558 set_nameidata(&nd, -1, filename, root);
3559 file = path_openat(&nd, op, flags | LOOKUP_RCU);
3560 if (unlikely(file == ERR_PTR(-ECHILD)))
3561 file = path_openat(&nd, op, flags);
3562 if (unlikely(file == ERR_PTR(-ESTALE)))
3563 file = path_openat(&nd, op, flags | LOOKUP_REVAL);
3564 restore_nameidata();
3565 putname(filename);
3566 return file;
3567}
3568
3569static struct dentry *filename_create(int dfd, struct filename *name,
3570 struct path *path, unsigned int lookup_flags)
3571{
3572 struct dentry *dentry = ERR_PTR(-EEXIST);
3573 struct qstr last;
3574 int type;
3575 int err2;
3576 int error;
3577 bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);
3578
3579
3580
3581
3582
3583 lookup_flags &= LOOKUP_REVAL;
3584
3585 name = filename_parentat(dfd, name, lookup_flags, path, &last, &type);
3586 if (IS_ERR(name))
3587 return ERR_CAST(name);
3588
3589
3590
3591
3592
3593 if (unlikely(type != LAST_NORM))
3594 goto out;
3595
3596
3597 err2 = mnt_want_write(path->mnt);
3598
3599
3600
3601 lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL;
3602 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
3603 dentry = __lookup_hash(&last, path->dentry, lookup_flags);
3604 if (IS_ERR(dentry))
3605 goto unlock;
3606
3607 error = -EEXIST;
3608 if (d_is_positive(dentry))
3609 goto fail;
3610
3611
3612
3613
3614
3615
3616
3617 if (unlikely(!is_dir && last.name[last.len])) {
3618 error = -ENOENT;
3619 goto fail;
3620 }
3621 if (unlikely(err2)) {
3622 error = err2;
3623 goto fail;
3624 }
3625 putname(name);
3626 return dentry;
3627fail:
3628 dput(dentry);
3629 dentry = ERR_PTR(error);
3630unlock:
3631 inode_unlock(path->dentry->d_inode);
3632 if (!err2)
3633 mnt_drop_write(path->mnt);
3634out:
3635 path_put(path);
3636 putname(name);
3637 return dentry;
3638}
3639
3640struct dentry *kern_path_create(int dfd, const char *pathname,
3641 struct path *path, unsigned int lookup_flags)
3642{
3643 return filename_create(dfd, getname_kernel(pathname),
3644 path, lookup_flags);
3645}
3646EXPORT_SYMBOL(kern_path_create);
3647
3648void done_path_create(struct path *path, struct dentry *dentry)
3649{
3650 dput(dentry);
3651 inode_unlock(path->dentry->d_inode);
3652 mnt_drop_write(path->mnt);
3653 path_put(path);
3654}
3655EXPORT_SYMBOL(done_path_create);
3656
3657inline struct dentry *user_path_create(int dfd, const char __user *pathname,
3658 struct path *path, unsigned int lookup_flags)
3659{
3660 return filename_create(dfd, getname(pathname), path, lookup_flags);
3661}
3662EXPORT_SYMBOL(user_path_create);
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680int vfs_mknod(struct user_namespace *mnt_userns, struct inode *dir,
3681 struct dentry *dentry, umode_t mode, dev_t dev)
3682{
3683 bool is_whiteout = S_ISCHR(mode) && dev == WHITEOUT_DEV;
3684 int error = may_create(mnt_userns, dir, dentry);
3685
3686 if (error)
3687 return error;
3688
3689 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !is_whiteout &&
3690 !capable(CAP_MKNOD))
3691 return -EPERM;
3692
3693 if (!dir->i_op->mknod)
3694 return -EPERM;
3695
3696 error = devcgroup_inode_mknod(mode, dev);
3697 if (error)
3698 return error;
3699
3700 error = security_inode_mknod(dir, dentry, mode, dev);
3701 if (error)
3702 return error;
3703
3704 error = dir->i_op->mknod(mnt_userns, dir, dentry, mode, dev);
3705 if (!error)
3706 fsnotify_create(dir, dentry);
3707 return error;
3708}
3709EXPORT_SYMBOL(vfs_mknod);
3710
3711static int may_mknod(umode_t mode)
3712{
3713 switch (mode & S_IFMT) {
3714 case S_IFREG:
3715 case S_IFCHR:
3716 case S_IFBLK:
3717 case S_IFIFO:
3718 case S_IFSOCK:
3719 case 0:
3720 return 0;
3721 case S_IFDIR:
3722 return -EPERM;
3723 default:
3724 return -EINVAL;
3725 }
3726}
3727
3728static long do_mknodat(int dfd, const char __user *filename, umode_t mode,
3729 unsigned int dev)
3730{
3731 struct user_namespace *mnt_userns;
3732 struct dentry *dentry;
3733 struct path path;
3734 int error;
3735 unsigned int lookup_flags = 0;
3736
3737 error = may_mknod(mode);
3738 if (error)
3739 return error;
3740retry:
3741 dentry = user_path_create(dfd, filename, &path, lookup_flags);
3742 if (IS_ERR(dentry))
3743 return PTR_ERR(dentry);
3744
3745 if (!IS_POSIXACL(path.dentry->d_inode))
3746 mode &= ~current_umask();
3747 error = security_path_mknod(&path, dentry, mode, dev);
3748 if (error)
3749 goto out;
3750
3751 mnt_userns = mnt_user_ns(path.mnt);
3752 switch (mode & S_IFMT) {
3753 case 0: case S_IFREG:
3754 error = vfs_create(mnt_userns, path.dentry->d_inode,
3755 dentry, mode, true);
3756 if (!error)
3757 ima_post_path_mknod(mnt_userns, dentry);
3758 break;
3759 case S_IFCHR: case S_IFBLK:
3760 error = vfs_mknod(mnt_userns, path.dentry->d_inode,
3761 dentry, mode, new_decode_dev(dev));
3762 break;
3763 case S_IFIFO: case S_IFSOCK:
3764 error = vfs_mknod(mnt_userns, path.dentry->d_inode,
3765 dentry, mode, 0);
3766 break;
3767 }
3768out:
3769 done_path_create(&path, dentry);
3770 if (retry_estale(error, lookup_flags)) {
3771 lookup_flags |= LOOKUP_REVAL;
3772 goto retry;
3773 }
3774 return error;
3775}
3776
3777SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
3778 unsigned int, dev)
3779{
3780 return do_mknodat(dfd, filename, mode, dev);
3781}
3782
3783SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3784{
3785 return do_mknodat(AT_FDCWD, filename, mode, dev);
3786}
3787
3788
3789
3790
3791
3792
3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803int vfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir,
3804 struct dentry *dentry, umode_t mode)
3805{
3806 int error = may_create(mnt_userns, dir, dentry);
3807 unsigned max_links = dir->i_sb->s_max_links;
3808
3809 if (error)
3810 return error;
3811
3812 if (!dir->i_op->mkdir)
3813 return -EPERM;
3814
3815 mode &= (S_IRWXUGO|S_ISVTX);
3816 error = security_inode_mkdir(dir, dentry, mode);
3817 if (error)
3818 return error;
3819
3820 if (max_links && dir->i_nlink >= max_links)
3821 return -EMLINK;
3822
3823 error = dir->i_op->mkdir(mnt_userns, dir, dentry, mode);
3824 if (!error)
3825 fsnotify_mkdir(dir, dentry);
3826 return error;
3827}
3828EXPORT_SYMBOL(vfs_mkdir);
3829
3830static long do_mkdirat(int dfd, const char __user *pathname, umode_t mode)
3831{
3832 struct dentry *dentry;
3833 struct path path;
3834 int error;
3835 unsigned int lookup_flags = LOOKUP_DIRECTORY;
3836
3837retry:
3838 dentry = user_path_create(dfd, pathname, &path, lookup_flags);
3839 if (IS_ERR(dentry))
3840 return PTR_ERR(dentry);
3841
3842 if (!IS_POSIXACL(path.dentry->d_inode))
3843 mode &= ~current_umask();
3844 error = security_path_mkdir(&path, dentry, mode);
3845 if (!error) {
3846 struct user_namespace *mnt_userns;
3847 mnt_userns = mnt_user_ns(path.mnt);
3848 error = vfs_mkdir(mnt_userns, path.dentry->d_inode, dentry,
3849 mode);
3850 }
3851 done_path_create(&path, dentry);
3852 if (retry_estale(error, lookup_flags)) {
3853 lookup_flags |= LOOKUP_REVAL;
3854 goto retry;
3855 }
3856 return error;
3857}
3858
3859SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
3860{
3861 return do_mkdirat(dfd, pathname, mode);
3862}
3863
3864SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
3865{
3866 return do_mkdirat(AT_FDCWD, pathname, mode);
3867}
3868
3869
3870
3871
3872
3873
3874
3875
3876
3877
3878
3879
3880
3881
3882
3883int vfs_rmdir(struct user_namespace *mnt_userns, struct inode *dir,
3884 struct dentry *dentry)
3885{
3886 int error = may_delete(mnt_userns, dir, dentry, 1);
3887
3888 if (error)
3889 return error;
3890
3891 if (!dir->i_op->rmdir)
3892 return -EPERM;
3893
3894 dget(dentry);
3895 inode_lock(dentry->d_inode);
3896
3897 error = -EBUSY;
3898 if (is_local_mountpoint(dentry))
3899 goto out;
3900
3901 error = security_inode_rmdir(dir, dentry);
3902 if (error)
3903 goto out;
3904
3905 error = dir->i_op->rmdir(dir, dentry);
3906 if (error)
3907 goto out;
3908
3909 shrink_dcache_parent(dentry);
3910 dentry->d_inode->i_flags |= S_DEAD;
3911 dont_mount(dentry);
3912 detach_mounts(dentry);
3913 fsnotify_rmdir(dir, dentry);
3914
3915out:
3916 inode_unlock(dentry->d_inode);
3917 dput(dentry);
3918 if (!error)
3919 d_delete(dentry);
3920 return error;
3921}
3922EXPORT_SYMBOL(vfs_rmdir);
3923
3924long do_rmdir(int dfd, struct filename *name)
3925{
3926 struct user_namespace *mnt_userns;
3927 int error = 0;
3928 struct dentry *dentry;
3929 struct path path;
3930 struct qstr last;
3931 int type;
3932 unsigned int lookup_flags = 0;
3933retry:
3934 name = filename_parentat(dfd, name, lookup_flags,
3935 &path, &last, &type);
3936 if (IS_ERR(name))
3937 return PTR_ERR(name);
3938
3939 switch (type) {
3940 case LAST_DOTDOT:
3941 error = -ENOTEMPTY;
3942 goto exit1;
3943 case LAST_DOT:
3944 error = -EINVAL;
3945 goto exit1;
3946 case LAST_ROOT:
3947 error = -EBUSY;
3948 goto exit1;
3949 }
3950
3951 error = mnt_want_write(path.mnt);
3952 if (error)
3953 goto exit1;
3954
3955 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
3956 dentry = __lookup_hash(&last, path.dentry, lookup_flags);
3957 error = PTR_ERR(dentry);
3958 if (IS_ERR(dentry))
3959 goto exit2;
3960 if (!dentry->d_inode) {
3961 error = -ENOENT;
3962 goto exit3;
3963 }
3964 error = security_path_rmdir(&path, dentry);
3965 if (error)
3966 goto exit3;
3967 mnt_userns = mnt_user_ns(path.mnt);
3968 error = vfs_rmdir(mnt_userns, path.dentry->d_inode, dentry);
3969exit3:
3970 dput(dentry);
3971exit2:
3972 inode_unlock(path.dentry->d_inode);
3973 mnt_drop_write(path.mnt);
3974exit1:
3975 path_put(&path);
3976 if (retry_estale(error, lookup_flags)) {
3977 lookup_flags |= LOOKUP_REVAL;
3978 goto retry;
3979 }
3980 putname(name);
3981 return error;
3982}
3983
3984SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
3985{
3986 return do_rmdir(AT_FDCWD, getname(pathname));
3987}
3988
3989
3990
3991
3992
3993
3994
3995
3996
3997
3998
3999
4000
4001
4002
4003
4004
4005
4006
4007
4008
4009
4010
4011
4012
4013
4014int vfs_unlink(struct user_namespace *mnt_userns, struct inode *dir,
4015 struct dentry *dentry, struct inode **delegated_inode)
4016{
4017 struct inode *target = dentry->d_inode;
4018 int error = may_delete(mnt_userns, dir, dentry, 0);
4019
4020 if (error)
4021 return error;
4022
4023 if (!dir->i_op->unlink)
4024 return -EPERM;
4025
4026 inode_lock(target);
4027 if (is_local_mountpoint(dentry))
4028 error = -EBUSY;
4029 else {
4030 error = security_inode_unlink(dir, dentry);
4031 if (!error) {
4032 error = try_break_deleg(target, delegated_inode);
4033 if (error)
4034 goto out;
4035 error = dir->i_op->unlink(dir, dentry);
4036 if (!error) {
4037 dont_mount(dentry);
4038 detach_mounts(dentry);
4039 fsnotify_unlink(dir, dentry);
4040 }
4041 }
4042 }
4043out:
4044 inode_unlock(target);
4045
4046
4047 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
4048 fsnotify_link_count(target);
4049 d_delete(dentry);
4050 }
4051
4052 return error;
4053}
4054EXPORT_SYMBOL(vfs_unlink);
4055
4056
4057
4058
4059
4060
4061
4062long do_unlinkat(int dfd, struct filename *name)
4063{
4064 int error;
4065 struct dentry *dentry;
4066 struct path path;
4067 struct qstr last;
4068 int type;
4069 struct inode *inode = NULL;
4070 struct inode *delegated_inode = NULL;
4071 unsigned int lookup_flags = 0;
4072retry:
4073 name = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4074 if (IS_ERR(name))
4075 return PTR_ERR(name);
4076
4077 error = -EISDIR;
4078 if (type != LAST_NORM)
4079 goto exit1;
4080
4081 error = mnt_want_write(path.mnt);
4082 if (error)
4083 goto exit1;
4084retry_deleg:
4085 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4086 dentry = __lookup_hash(&last, path.dentry, lookup_flags);
4087 error = PTR_ERR(dentry);
4088 if (!IS_ERR(dentry)) {
4089 struct user_namespace *mnt_userns;
4090
4091
4092 if (last.name[last.len])
4093 goto slashes;
4094 inode = dentry->d_inode;
4095 if (d_is_negative(dentry))
4096 goto slashes;
4097 ihold(inode);
4098 error = security_path_unlink(&path, dentry);
4099 if (error)
4100 goto exit2;
4101 mnt_userns = mnt_user_ns(path.mnt);
4102 error = vfs_unlink(mnt_userns, path.dentry->d_inode, dentry,
4103 &delegated_inode);
4104exit2:
4105 dput(dentry);
4106 }
4107 inode_unlock(path.dentry->d_inode);
4108 if (inode)
4109 iput(inode);
4110 inode = NULL;
4111 if (delegated_inode) {
4112 error = break_deleg_wait(&delegated_inode);
4113 if (!error)
4114 goto retry_deleg;
4115 }
4116 mnt_drop_write(path.mnt);
4117exit1:
4118 path_put(&path);
4119 if (retry_estale(error, lookup_flags)) {
4120 lookup_flags |= LOOKUP_REVAL;
4121 inode = NULL;
4122 goto retry;
4123 }
4124 putname(name);
4125 return error;
4126
4127slashes:
4128 if (d_is_negative(dentry))
4129 error = -ENOENT;
4130 else if (d_is_dir(dentry))
4131 error = -EISDIR;
4132 else
4133 error = -ENOTDIR;
4134 goto exit2;
4135}
4136
4137SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
4138{
4139 if ((flag & ~AT_REMOVEDIR) != 0)
4140 return -EINVAL;
4141
4142 if (flag & AT_REMOVEDIR)
4143 return do_rmdir(dfd, getname(pathname));
4144 return do_unlinkat(dfd, getname(pathname));
4145}
4146
4147SYSCALL_DEFINE1(unlink, const char __user *, pathname)
4148{
4149 return do_unlinkat(AT_FDCWD, getname(pathname));
4150}
4151
4152
4153
4154
4155
4156
4157
4158
4159
4160
4161
4162
4163
4164
4165
4166
4167int vfs_symlink(struct user_namespace *mnt_userns, struct inode *dir,
4168 struct dentry *dentry, const char *oldname)
4169{
4170 int error = may_create(mnt_userns, dir, dentry);
4171
4172 if (error)
4173 return error;
4174
4175 if (!dir->i_op->symlink)
4176 return -EPERM;
4177
4178 error = security_inode_symlink(dir, dentry, oldname);
4179 if (error)
4180 return error;
4181
4182 error = dir->i_op->symlink(mnt_userns, dir, dentry, oldname);
4183 if (!error)
4184 fsnotify_create(dir, dentry);
4185 return error;
4186}
4187EXPORT_SYMBOL(vfs_symlink);
4188
4189static long do_symlinkat(const char __user *oldname, int newdfd,
4190 const char __user *newname)
4191{
4192 int error;
4193 struct filename *from;
4194 struct dentry *dentry;
4195 struct path path;
4196 unsigned int lookup_flags = 0;
4197
4198 from = getname(oldname);
4199 if (IS_ERR(from))
4200 return PTR_ERR(from);
4201retry:
4202 dentry = user_path_create(newdfd, newname, &path, lookup_flags);
4203 error = PTR_ERR(dentry);
4204 if (IS_ERR(dentry))
4205 goto out_putname;
4206
4207 error = security_path_symlink(&path, dentry, from->name);
4208 if (!error) {
4209 struct user_namespace *mnt_userns;
4210
4211 mnt_userns = mnt_user_ns(path.mnt);
4212 error = vfs_symlink(mnt_userns, path.dentry->d_inode, dentry,
4213 from->name);
4214 }
4215 done_path_create(&path, dentry);
4216 if (retry_estale(error, lookup_flags)) {
4217 lookup_flags |= LOOKUP_REVAL;
4218 goto retry;
4219 }
4220out_putname:
4221 putname(from);
4222 return error;
4223}
4224
4225SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
4226 int, newdfd, const char __user *, newname)
4227{
4228 return do_symlinkat(oldname, newdfd, newname);
4229}
4230
4231SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
4232{
4233 return do_symlinkat(oldname, AT_FDCWD, newname);
4234}
4235
4236
4237
4238
4239
4240
4241
4242
4243
4244
4245
4246
4247
4248
4249
4250
4251
4252
4253
4254
4255
4256
4257
4258
4259
4260
4261
4262int vfs_link(struct dentry *old_dentry, struct user_namespace *mnt_userns,
4263 struct inode *dir, struct dentry *new_dentry,
4264 struct inode **delegated_inode)
4265{
4266 struct inode *inode = old_dentry->d_inode;
4267 unsigned max_links = dir->i_sb->s_max_links;
4268 int error;
4269
4270 if (!inode)
4271 return -ENOENT;
4272
4273 error = may_create(mnt_userns, dir, new_dentry);
4274 if (error)
4275 return error;
4276
4277 if (dir->i_sb != inode->i_sb)
4278 return -EXDEV;
4279
4280
4281
4282
4283 if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
4284 return -EPERM;
4285
4286
4287
4288
4289
4290 if (HAS_UNMAPPED_ID(mnt_userns, inode))
4291 return -EPERM;
4292 if (!dir->i_op->link)
4293 return -EPERM;
4294 if (S_ISDIR(inode->i_mode))
4295 return -EPERM;
4296
4297 error = security_inode_link(old_dentry, dir, new_dentry);
4298 if (error)
4299 return error;
4300
4301 inode_lock(inode);
4302
4303 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
4304 error = -ENOENT;
4305 else if (max_links && inode->i_nlink >= max_links)
4306 error = -EMLINK;
4307 else {
4308 error = try_break_deleg(inode, delegated_inode);
4309 if (!error)
4310 error = dir->i_op->link(old_dentry, dir, new_dentry);
4311 }
4312
4313 if (!error && (inode->i_state & I_LINKABLE)) {
4314 spin_lock(&inode->i_lock);
4315 inode->i_state &= ~I_LINKABLE;
4316 spin_unlock(&inode->i_lock);
4317 }
4318 inode_unlock(inode);
4319 if (!error)
4320 fsnotify_link(dir, inode, new_dentry);
4321 return error;
4322}
4323EXPORT_SYMBOL(vfs_link);
4324
4325
4326
4327
4328
4329
4330
4331
4332
4333
4334static int do_linkat(int olddfd, const char __user *oldname, int newdfd,
4335 const char __user *newname, int flags)
4336{
4337 struct user_namespace *mnt_userns;
4338 struct dentry *new_dentry;
4339 struct path old_path, new_path;
4340 struct inode *delegated_inode = NULL;
4341 int how = 0;
4342 int error;
4343
4344 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
4345 return -EINVAL;
4346
4347
4348
4349
4350
4351 if (flags & AT_EMPTY_PATH) {
4352 if (!capable(CAP_DAC_READ_SEARCH))
4353 return -ENOENT;
4354 how = LOOKUP_EMPTY;
4355 }
4356
4357 if (flags & AT_SYMLINK_FOLLOW)
4358 how |= LOOKUP_FOLLOW;
4359retry:
4360 error = user_path_at(olddfd, oldname, how, &old_path);
4361 if (error)
4362 return error;
4363
4364 new_dentry = user_path_create(newdfd, newname, &new_path,
4365 (how & LOOKUP_REVAL));
4366 error = PTR_ERR(new_dentry);
4367 if (IS_ERR(new_dentry))
4368 goto out;
4369
4370 error = -EXDEV;
4371 if (old_path.mnt != new_path.mnt)
4372 goto out_dput;
4373 mnt_userns = mnt_user_ns(new_path.mnt);
4374 error = may_linkat(mnt_userns, &old_path);
4375 if (unlikely(error))
4376 goto out_dput;
4377 error = security_path_link(old_path.dentry, &new_path, new_dentry);
4378 if (error)
4379 goto out_dput;
4380 error = vfs_link(old_path.dentry, mnt_userns, new_path.dentry->d_inode,
4381 new_dentry, &delegated_inode);
4382out_dput:
4383 done_path_create(&new_path, new_dentry);
4384 if (delegated_inode) {
4385 error = break_deleg_wait(&delegated_inode);
4386 if (!error) {
4387 path_put(&old_path);
4388 goto retry;
4389 }
4390 }
4391 if (retry_estale(error, how)) {
4392 path_put(&old_path);
4393 how |= LOOKUP_REVAL;
4394 goto retry;
4395 }
4396out:
4397 path_put(&old_path);
4398
4399 return error;
4400}
4401
4402SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
4403 int, newdfd, const char __user *, newname, int, flags)
4404{
4405 return do_linkat(olddfd, oldname, newdfd, newname, flags);
4406}
4407
4408SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
4409{
4410 return do_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4411}
4412
4413
4414
4415
4416
4417
4418
4419
4420
4421
4422
4423
4424
4425
4426
4427
4428
4429
4430
4431
4432
4433
4434
4435
4436
4437
4438
4439
4440
4441
4442
4443
4444
4445
4446
4447
4448
4449
4450
4451
4452
4453
4454
4455
4456
4457
4458int vfs_rename(struct renamedata *rd)
4459{
4460 int error;
4461 struct inode *old_dir = rd->old_dir, *new_dir = rd->new_dir;
4462 struct dentry *old_dentry = rd->old_dentry;
4463 struct dentry *new_dentry = rd->new_dentry;
4464 struct inode **delegated_inode = rd->delegated_inode;
4465 unsigned int flags = rd->flags;
4466 bool is_dir = d_is_dir(old_dentry);
4467 struct inode *source = old_dentry->d_inode;
4468 struct inode *target = new_dentry->d_inode;
4469 bool new_is_dir = false;
4470 unsigned max_links = new_dir->i_sb->s_max_links;
4471 struct name_snapshot old_name;
4472
4473 if (source == target)
4474 return 0;
4475
4476 error = may_delete(rd->old_mnt_userns, old_dir, old_dentry, is_dir);
4477 if (error)
4478 return error;
4479
4480 if (!target) {
4481 error = may_create(rd->new_mnt_userns, new_dir, new_dentry);
4482 } else {
4483 new_is_dir = d_is_dir(new_dentry);
4484
4485 if (!(flags & RENAME_EXCHANGE))
4486 error = may_delete(rd->new_mnt_userns, new_dir,
4487 new_dentry, is_dir);
4488 else
4489 error = may_delete(rd->new_mnt_userns, new_dir,
4490 new_dentry, new_is_dir);
4491 }
4492 if (error)
4493 return error;
4494
4495 if (!old_dir->i_op->rename)
4496 return -EPERM;
4497
4498
4499
4500
4501
4502 if (new_dir != old_dir) {
4503 if (is_dir) {
4504 error = inode_permission(rd->old_mnt_userns, source,
4505 MAY_WRITE);
4506 if (error)
4507 return error;
4508 }
4509 if ((flags & RENAME_EXCHANGE) && new_is_dir) {
4510 error = inode_permission(rd->new_mnt_userns, target,
4511 MAY_WRITE);
4512 if (error)
4513 return error;
4514 }
4515 }
4516
4517 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
4518 flags);
4519 if (error)
4520 return error;
4521
4522 take_dentry_name_snapshot(&old_name, old_dentry);
4523 dget(new_dentry);
4524 if (!is_dir || (flags & RENAME_EXCHANGE))
4525 lock_two_nondirectories(source, target);
4526 else if (target)
4527 inode_lock(target);
4528
4529 error = -EBUSY;
4530 if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
4531 goto out;
4532
4533 if (max_links && new_dir != old_dir) {
4534 error = -EMLINK;
4535 if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
4536 goto out;
4537 if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
4538 old_dir->i_nlink >= max_links)
4539 goto out;
4540 }
4541 if (!is_dir) {
4542 error = try_break_deleg(source, delegated_inode);
4543 if (error)
4544 goto out;
4545 }
4546 if (target && !new_is_dir) {
4547 error = try_break_deleg(target, delegated_inode);
4548 if (error)
4549 goto out;
4550 }
4551 error = old_dir->i_op->rename(rd->new_mnt_userns, old_dir, old_dentry,
4552 new_dir, new_dentry, flags);
4553 if (error)
4554 goto out;
4555
4556 if (!(flags & RENAME_EXCHANGE) && target) {
4557 if (is_dir) {
4558 shrink_dcache_parent(new_dentry);
4559 target->i_flags |= S_DEAD;
4560 }
4561 dont_mount(new_dentry);
4562 detach_mounts(new_dentry);
4563 }
4564 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
4565 if (!(flags & RENAME_EXCHANGE))
4566 d_move(old_dentry, new_dentry);
4567 else
4568 d_exchange(old_dentry, new_dentry);
4569 }
4570out:
4571 if (!is_dir || (flags & RENAME_EXCHANGE))
4572 unlock_two_nondirectories(source, target);
4573 else if (target)
4574 inode_unlock(target);
4575 dput(new_dentry);
4576 if (!error) {
4577 fsnotify_move(old_dir, new_dir, &old_name.name, is_dir,
4578 !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
4579 if (flags & RENAME_EXCHANGE) {
4580 fsnotify_move(new_dir, old_dir, &old_dentry->d_name,
4581 new_is_dir, NULL, new_dentry);
4582 }
4583 }
4584 release_dentry_name_snapshot(&old_name);
4585
4586 return error;
4587}
4588EXPORT_SYMBOL(vfs_rename);
4589
4590int do_renameat2(int olddfd, struct filename *from, int newdfd,
4591 struct filename *to, unsigned int flags)
4592{
4593 struct renamedata rd;
4594 struct dentry *old_dentry, *new_dentry;
4595 struct dentry *trap;
4596 struct path old_path, new_path;
4597 struct qstr old_last, new_last;
4598 int old_type, new_type;
4599 struct inode *delegated_inode = NULL;
4600 unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
4601 bool should_retry = false;
4602 int error = -EINVAL;
4603
4604 if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
4605 goto put_both;
4606
4607 if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
4608 (flags & RENAME_EXCHANGE))
4609 goto put_both;
4610
4611 if (flags & RENAME_EXCHANGE)
4612 target_flags = 0;
4613
4614retry:
4615 from = filename_parentat(olddfd, from, lookup_flags, &old_path,
4616 &old_last, &old_type);
4617 if (IS_ERR(from)) {
4618 error = PTR_ERR(from);
4619 goto put_new;
4620 }
4621
4622 to = filename_parentat(newdfd, to, lookup_flags, &new_path, &new_last,
4623 &new_type);
4624 if (IS_ERR(to)) {
4625 error = PTR_ERR(to);
4626 goto exit1;
4627 }
4628
4629 error = -EXDEV;
4630 if (old_path.mnt != new_path.mnt)
4631 goto exit2;
4632
4633 error = -EBUSY;
4634 if (old_type != LAST_NORM)
4635 goto exit2;
4636
4637 if (flags & RENAME_NOREPLACE)
4638 error = -EEXIST;
4639 if (new_type != LAST_NORM)
4640 goto exit2;
4641
4642 error = mnt_want_write(old_path.mnt);
4643 if (error)
4644 goto exit2;
4645
4646retry_deleg:
4647 trap = lock_rename(new_path.dentry, old_path.dentry);
4648
4649 old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags);
4650 error = PTR_ERR(old_dentry);
4651 if (IS_ERR(old_dentry))
4652 goto exit3;
4653
4654 error = -ENOENT;
4655 if (d_is_negative(old_dentry))
4656 goto exit4;
4657 new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags);
4658 error = PTR_ERR(new_dentry);
4659 if (IS_ERR(new_dentry))
4660 goto exit4;
4661 error = -EEXIST;
4662 if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
4663 goto exit5;
4664 if (flags & RENAME_EXCHANGE) {
4665 error = -ENOENT;
4666 if (d_is_negative(new_dentry))
4667 goto exit5;
4668
4669 if (!d_is_dir(new_dentry)) {
4670 error = -ENOTDIR;
4671 if (new_last.name[new_last.len])
4672 goto exit5;
4673 }
4674 }
4675
4676 if (!d_is_dir(old_dentry)) {
4677 error = -ENOTDIR;
4678 if (old_last.name[old_last.len])
4679 goto exit5;
4680 if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
4681 goto exit5;
4682 }
4683
4684 error = -EINVAL;
4685 if (old_dentry == trap)
4686 goto exit5;
4687
4688 if (!(flags & RENAME_EXCHANGE))
4689 error = -ENOTEMPTY;
4690 if (new_dentry == trap)
4691 goto exit5;
4692
4693 error = security_path_rename(&old_path, old_dentry,
4694 &new_path, new_dentry, flags);
4695 if (error)
4696 goto exit5;
4697
4698 rd.old_dir = old_path.dentry->d_inode;
4699 rd.old_dentry = old_dentry;
4700 rd.old_mnt_userns = mnt_user_ns(old_path.mnt);
4701 rd.new_dir = new_path.dentry->d_inode;
4702 rd.new_dentry = new_dentry;
4703 rd.new_mnt_userns = mnt_user_ns(new_path.mnt);
4704 rd.delegated_inode = &delegated_inode;
4705 rd.flags = flags;
4706 error = vfs_rename(&rd);
4707exit5:
4708 dput(new_dentry);
4709exit4:
4710 dput(old_dentry);
4711exit3:
4712 unlock_rename(new_path.dentry, old_path.dentry);
4713 if (delegated_inode) {
4714 error = break_deleg_wait(&delegated_inode);
4715 if (!error)
4716 goto retry_deleg;
4717 }
4718 mnt_drop_write(old_path.mnt);
4719exit2:
4720 if (retry_estale(error, lookup_flags))
4721 should_retry = true;
4722 path_put(&new_path);
4723exit1:
4724 path_put(&old_path);
4725 if (should_retry) {
4726 should_retry = false;
4727 lookup_flags |= LOOKUP_REVAL;
4728 goto retry;
4729 }
4730put_both:
4731 if (!IS_ERR(from))
4732 putname(from);
4733put_new:
4734 if (!IS_ERR(to))
4735 putname(to);
4736 return error;
4737}
4738
4739SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
4740 int, newdfd, const char __user *, newname, unsigned int, flags)
4741{
4742 return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname),
4743 flags);
4744}
4745
4746SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
4747 int, newdfd, const char __user *, newname)
4748{
4749 return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname),
4750 0);
4751}
4752
4753SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
4754{
4755 return do_renameat2(AT_FDCWD, getname(oldname), AT_FDCWD,
4756 getname(newname), 0);
4757}
4758
4759int readlink_copy(char __user *buffer, int buflen, const char *link)
4760{
4761 int len = PTR_ERR(link);
4762 if (IS_ERR(link))
4763 goto out;
4764
4765 len = strlen(link);
4766 if (len > (unsigned) buflen)
4767 len = buflen;
4768 if (copy_to_user(buffer, link, len))
4769 len = -EFAULT;
4770out:
4771 return len;
4772}
4773
4774
4775
4776
4777
4778
4779
4780
4781
4782
4783
4784int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4785{
4786 struct inode *inode = d_inode(dentry);
4787 DEFINE_DELAYED_CALL(done);
4788 const char *link;
4789 int res;
4790
4791 if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) {
4792 if (unlikely(inode->i_op->readlink))
4793 return inode->i_op->readlink(dentry, buffer, buflen);
4794
4795 if (!d_is_symlink(dentry))
4796 return -EINVAL;
4797
4798 spin_lock(&inode->i_lock);
4799 inode->i_opflags |= IOP_DEFAULT_READLINK;
4800 spin_unlock(&inode->i_lock);
4801 }
4802
4803 link = READ_ONCE(inode->i_link);
4804 if (!link) {
4805 link = inode->i_op->get_link(dentry, inode, &done);
4806 if (IS_ERR(link))
4807 return PTR_ERR(link);
4808 }
4809 res = readlink_copy(buffer, buflen, link);
4810 do_delayed_call(&done);
4811 return res;
4812}
4813EXPORT_SYMBOL(vfs_readlink);
4814
4815
4816
4817
4818
4819
4820
4821
4822
4823
4824
4825
4826const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
4827{
4828 const char *res = ERR_PTR(-EINVAL);
4829 struct inode *inode = d_inode(dentry);
4830
4831 if (d_is_symlink(dentry)) {
4832 res = ERR_PTR(security_inode_readlink(dentry));
4833 if (!res)
4834 res = inode->i_op->get_link(dentry, inode, done);
4835 }
4836 return res;
4837}
4838EXPORT_SYMBOL(vfs_get_link);
4839
4840
4841const char *page_get_link(struct dentry *dentry, struct inode *inode,
4842 struct delayed_call *callback)
4843{
4844 char *kaddr;
4845 struct page *page;
4846 struct address_space *mapping = inode->i_mapping;
4847
4848 if (!dentry) {
4849 page = find_get_page(mapping, 0);
4850 if (!page)
4851 return ERR_PTR(-ECHILD);
4852 if (!PageUptodate(page)) {
4853 put_page(page);
4854 return ERR_PTR(-ECHILD);
4855 }
4856 } else {
4857 page = read_mapping_page(mapping, 0, NULL);
4858 if (IS_ERR(page))
4859 return (char*)page;
4860 }
4861 set_delayed_call(callback, page_put_link, page);
4862 BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
4863 kaddr = page_address(page);
4864 nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
4865 return kaddr;
4866}
4867
4868EXPORT_SYMBOL(page_get_link);
4869
4870void page_put_link(void *arg)
4871{
4872 put_page(arg);
4873}
4874EXPORT_SYMBOL(page_put_link);
4875
4876int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4877{
4878 DEFINE_DELAYED_CALL(done);
4879 int res = readlink_copy(buffer, buflen,
4880 page_get_link(dentry, d_inode(dentry),
4881 &done));
4882 do_delayed_call(&done);
4883 return res;
4884}
4885EXPORT_SYMBOL(page_readlink);
4886
4887
4888
4889
4890int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
4891{
4892 struct address_space *mapping = inode->i_mapping;
4893 struct page *page;
4894 void *fsdata;
4895 int err;
4896 unsigned int flags = 0;
4897 if (nofs)
4898 flags |= AOP_FLAG_NOFS;
4899
4900retry:
4901 err = pagecache_write_begin(NULL, mapping, 0, len-1,
4902 flags, &page, &fsdata);
4903 if (err)
4904 goto fail;
4905
4906 memcpy(page_address(page), symname, len-1);
4907
4908 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
4909 page, fsdata);
4910 if (err < 0)
4911 goto fail;
4912 if (err < len-1)
4913 goto retry;
4914
4915 mark_inode_dirty(inode);
4916 return 0;
4917fail:
4918 return err;
4919}
4920EXPORT_SYMBOL(__page_symlink);
4921
4922int page_symlink(struct inode *inode, const char *symname, int len)
4923{
4924 return __page_symlink(inode, symname, len,
4925 !mapping_gfp_constraint(inode->i_mapping, __GFP_FS));
4926}
4927EXPORT_SYMBOL(page_symlink);
4928
4929const struct inode_operations page_symlink_inode_operations = {
4930 .get_link = page_get_link,
4931};
4932EXPORT_SYMBOL(page_symlink_inode_operations);
4933