1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18#include <linux/init.h>
19#include <linux/export.h>
20#include <linux/kernel.h>
21#include <linux/slab.h>
22#include <linux/fs.h>
23#include <linux/namei.h>
24#include <linux/pagemap.h>
25#include <linux/fsnotify.h>
26#include <linux/personality.h>
27#include <linux/security.h>
28#include <linux/ima.h>
29#include <linux/syscalls.h>
30#include <linux/mount.h>
31#include <linux/audit.h>
32#include <linux/capability.h>
33#include <linux/file.h>
34#include <linux/fcntl.h>
35#include <linux/device_cgroup.h>
36#include <linux/fs_struct.h>
37#include <linux/posix_acl.h>
38#include <linux/hash.h>
39#include <linux/bitops.h>
40#include <linux/init_task.h>
41#include <linux/uaccess.h>
42
43#include "internal.h"
44#include "mount.h"
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125#define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname))
126
127struct filename *
128getname_flags(const char __user *filename, int flags, int *empty)
129{
130 struct filename *result;
131 char *kname;
132 int len;
133
134 result = audit_reusename(filename);
135 if (result)
136 return result;
137
138 result = __getname();
139 if (unlikely(!result))
140 return ERR_PTR(-ENOMEM);
141
142
143
144
145
146 kname = (char *)result->iname;
147 result->name = kname;
148
149 len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
150 if (unlikely(len < 0)) {
151 __putname(result);
152 return ERR_PTR(len);
153 }
154
155
156
157
158
159
160
161 if (unlikely(len == EMBEDDED_NAME_MAX)) {
162 const size_t size = offsetof(struct filename, iname[1]);
163 kname = (char *)result;
164
165
166
167
168
169
170 result = kzalloc(size, GFP_KERNEL);
171 if (unlikely(!result)) {
172 __putname(kname);
173 return ERR_PTR(-ENOMEM);
174 }
175 result->name = kname;
176 len = strncpy_from_user(kname, filename, PATH_MAX);
177 if (unlikely(len < 0)) {
178 __putname(kname);
179 kfree(result);
180 return ERR_PTR(len);
181 }
182 if (unlikely(len == PATH_MAX)) {
183 __putname(kname);
184 kfree(result);
185 return ERR_PTR(-ENAMETOOLONG);
186 }
187 }
188
189 result->refcnt = 1;
190
191 if (unlikely(!len)) {
192 if (empty)
193 *empty = 1;
194 if (!(flags & LOOKUP_EMPTY)) {
195 putname(result);
196 return ERR_PTR(-ENOENT);
197 }
198 }
199
200 result->uptr = filename;
201 result->aname = NULL;
202 audit_getname(result);
203 return result;
204}
205
206struct filename *
207getname_uflags(const char __user *filename, int uflags)
208{
209 int flags = (uflags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0;
210
211 return getname_flags(filename, flags, NULL);
212}
213
214struct filename *
215getname(const char __user * filename)
216{
217 return getname_flags(filename, 0, NULL);
218}
219
220struct filename *
221getname_kernel(const char * filename)
222{
223 struct filename *result;
224 int len = strlen(filename) + 1;
225
226 result = __getname();
227 if (unlikely(!result))
228 return ERR_PTR(-ENOMEM);
229
230 if (len <= EMBEDDED_NAME_MAX) {
231 result->name = (char *)result->iname;
232 } else if (len <= PATH_MAX) {
233 const size_t size = offsetof(struct filename, iname[1]);
234 struct filename *tmp;
235
236 tmp = kmalloc(size, GFP_KERNEL);
237 if (unlikely(!tmp)) {
238 __putname(result);
239 return ERR_PTR(-ENOMEM);
240 }
241 tmp->name = (char *)result;
242 result = tmp;
243 } else {
244 __putname(result);
245 return ERR_PTR(-ENAMETOOLONG);
246 }
247 memcpy((char *)result->name, filename, len);
248 result->uptr = NULL;
249 result->aname = NULL;
250 result->refcnt = 1;
251 audit_getname(result);
252
253 return result;
254}
255
256void putname(struct filename *name)
257{
258 if (IS_ERR(name))
259 return;
260
261 BUG_ON(name->refcnt <= 0);
262
263 if (--name->refcnt > 0)
264 return;
265
266 if (name->name != name->iname) {
267 __putname(name->name);
268 kfree(name);
269 } else
270 __putname(name);
271}
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289static int check_acl(struct user_namespace *mnt_userns,
290 struct inode *inode, int mask)
291{
292#ifdef CONFIG_FS_POSIX_ACL
293 struct posix_acl *acl;
294
295 if (mask & MAY_NOT_BLOCK) {
296 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
297 if (!acl)
298 return -EAGAIN;
299
300 if (is_uncached_acl(acl))
301 return -ECHILD;
302 return posix_acl_permission(mnt_userns, inode, acl, mask);
303 }
304
305 acl = get_acl(inode, ACL_TYPE_ACCESS);
306 if (IS_ERR(acl))
307 return PTR_ERR(acl);
308 if (acl) {
309 int error = posix_acl_permission(mnt_userns, inode, acl, mask);
310 posix_acl_release(acl);
311 return error;
312 }
313#endif
314
315 return -EAGAIN;
316}
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334static int acl_permission_check(struct user_namespace *mnt_userns,
335 struct inode *inode, int mask)
336{
337 unsigned int mode = inode->i_mode;
338 kuid_t i_uid;
339
340
341 i_uid = i_uid_into_mnt(mnt_userns, inode);
342 if (likely(uid_eq(current_fsuid(), i_uid))) {
343 mask &= 7;
344 mode >>= 6;
345 return (mask & ~mode) ? -EACCES : 0;
346 }
347
348
349 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
350 int error = check_acl(mnt_userns, inode, mask);
351 if (error != -EAGAIN)
352 return error;
353 }
354
355
356 mask &= 7;
357
358
359
360
361
362
363 if (mask & (mode ^ (mode >> 3))) {
364 kgid_t kgid = i_gid_into_mnt(mnt_userns, inode);
365 if (in_group_p(kgid))
366 mode >>= 3;
367 }
368
369
370 return (mask & ~mode) ? -EACCES : 0;
371}
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395int generic_permission(struct user_namespace *mnt_userns, struct inode *inode,
396 int mask)
397{
398 int ret;
399
400
401
402
403 ret = acl_permission_check(mnt_userns, inode, mask);
404 if (ret != -EACCES)
405 return ret;
406
407 if (S_ISDIR(inode->i_mode)) {
408
409 if (!(mask & MAY_WRITE))
410 if (capable_wrt_inode_uidgid(mnt_userns, inode,
411 CAP_DAC_READ_SEARCH))
412 return 0;
413 if (capable_wrt_inode_uidgid(mnt_userns, inode,
414 CAP_DAC_OVERRIDE))
415 return 0;
416 return -EACCES;
417 }
418
419
420
421
422 mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
423 if (mask == MAY_READ)
424 if (capable_wrt_inode_uidgid(mnt_userns, inode,
425 CAP_DAC_READ_SEARCH))
426 return 0;
427
428
429
430
431
432 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
433 if (capable_wrt_inode_uidgid(mnt_userns, inode,
434 CAP_DAC_OVERRIDE))
435 return 0;
436
437 return -EACCES;
438}
439EXPORT_SYMBOL(generic_permission);
440
441
442
443
444
445
446
447
448
449
450
451
452static inline int do_inode_permission(struct user_namespace *mnt_userns,
453 struct inode *inode, int mask)
454{
455 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
456 if (likely(inode->i_op->permission))
457 return inode->i_op->permission(mnt_userns, inode, mask);
458
459
460 spin_lock(&inode->i_lock);
461 inode->i_opflags |= IOP_FASTPERM;
462 spin_unlock(&inode->i_lock);
463 }
464 return generic_permission(mnt_userns, inode, mask);
465}
466
467
468
469
470
471
472
473
474
475static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
476{
477 if (unlikely(mask & MAY_WRITE)) {
478 umode_t mode = inode->i_mode;
479
480
481 if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
482 return -EROFS;
483 }
484 return 0;
485}
486
487
488
489
490
491
492
493
494
495
496
497
498
499int inode_permission(struct user_namespace *mnt_userns,
500 struct inode *inode, int mask)
501{
502 int retval;
503
504 retval = sb_permission(inode->i_sb, inode, mask);
505 if (retval)
506 return retval;
507
508 if (unlikely(mask & MAY_WRITE)) {
509
510
511
512 if (IS_IMMUTABLE(inode))
513 return -EPERM;
514
515
516
517
518
519
520 if (HAS_UNMAPPED_ID(mnt_userns, inode))
521 return -EACCES;
522 }
523
524 retval = do_inode_permission(mnt_userns, inode, mask);
525 if (retval)
526 return retval;
527
528 retval = devcgroup_inode_permission(inode, mask);
529 if (retval)
530 return retval;
531
532 return security_inode_permission(inode, mask);
533}
534EXPORT_SYMBOL(inode_permission);
535
536
537
538
539
540
541
542void path_get(const struct path *path)
543{
544 mntget(path->mnt);
545 dget(path->dentry);
546}
547EXPORT_SYMBOL(path_get);
548
549
550
551
552
553
554
555void path_put(const struct path *path)
556{
557 dput(path->dentry);
558 mntput(path->mnt);
559}
560EXPORT_SYMBOL(path_put);
561
562#define EMBEDDED_LEVELS 2
563struct nameidata {
564 struct path path;
565 struct qstr last;
566 struct path root;
567 struct inode *inode;
568 unsigned int flags, state;
569 unsigned seq, m_seq, r_seq;
570 int last_type;
571 unsigned depth;
572 int total_link_count;
573 struct saved {
574 struct path link;
575 struct delayed_call done;
576 const char *name;
577 unsigned seq;
578 } *stack, internal[EMBEDDED_LEVELS];
579 struct filename *name;
580 struct nameidata *saved;
581 unsigned root_seq;
582 int dfd;
583 kuid_t dir_uid;
584 umode_t dir_mode;
585} __randomize_layout;
586
587#define ND_ROOT_PRESET 1
588#define ND_ROOT_GRABBED 2
589#define ND_JUMPED 4
590
591static void __set_nameidata(struct nameidata *p, int dfd, struct filename *name)
592{
593 struct nameidata *old = current->nameidata;
594 p->stack = p->internal;
595 p->depth = 0;
596 p->dfd = dfd;
597 p->name = name;
598 p->path.mnt = NULL;
599 p->path.dentry = NULL;
600 p->total_link_count = old ? old->total_link_count : 0;
601 p->saved = old;
602 current->nameidata = p;
603}
604
605static inline void set_nameidata(struct nameidata *p, int dfd, struct filename *name,
606 const struct path *root)
607{
608 __set_nameidata(p, dfd, name);
609 p->state = 0;
610 if (unlikely(root)) {
611 p->state = ND_ROOT_PRESET;
612 p->root = *root;
613 }
614}
615
616static void restore_nameidata(void)
617{
618 struct nameidata *now = current->nameidata, *old = now->saved;
619
620 current->nameidata = old;
621 if (old)
622 old->total_link_count = now->total_link_count;
623 if (now->stack != now->internal)
624 kfree(now->stack);
625}
626
627static bool nd_alloc_stack(struct nameidata *nd)
628{
629 struct saved *p;
630
631 p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
632 nd->flags & LOOKUP_RCU ? GFP_ATOMIC : GFP_KERNEL);
633 if (unlikely(!p))
634 return false;
635 memcpy(p, nd->internal, sizeof(nd->internal));
636 nd->stack = p;
637 return true;
638}
639
640
641
642
643
644
645
646static bool path_connected(struct vfsmount *mnt, struct dentry *dentry)
647{
648 struct super_block *sb = mnt->mnt_sb;
649
650
651 if (mnt->mnt_root == sb->s_root)
652 return true;
653
654 return is_subdir(dentry, mnt->mnt_root);
655}
656
657static void drop_links(struct nameidata *nd)
658{
659 int i = nd->depth;
660 while (i--) {
661 struct saved *last = nd->stack + i;
662 do_delayed_call(&last->done);
663 clear_delayed_call(&last->done);
664 }
665}
666
667static void terminate_walk(struct nameidata *nd)
668{
669 drop_links(nd);
670 if (!(nd->flags & LOOKUP_RCU)) {
671 int i;
672 path_put(&nd->path);
673 for (i = 0; i < nd->depth; i++)
674 path_put(&nd->stack[i].link);
675 if (nd->state & ND_ROOT_GRABBED) {
676 path_put(&nd->root);
677 nd->state &= ~ND_ROOT_GRABBED;
678 }
679 } else {
680 nd->flags &= ~LOOKUP_RCU;
681 rcu_read_unlock();
682 }
683 nd->depth = 0;
684 nd->path.mnt = NULL;
685 nd->path.dentry = NULL;
686}
687
688
689static bool __legitimize_path(struct path *path, unsigned seq, unsigned mseq)
690{
691 int res = __legitimize_mnt(path->mnt, mseq);
692 if (unlikely(res)) {
693 if (res > 0)
694 path->mnt = NULL;
695 path->dentry = NULL;
696 return false;
697 }
698 if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
699 path->dentry = NULL;
700 return false;
701 }
702 return !read_seqcount_retry(&path->dentry->d_seq, seq);
703}
704
705static inline bool legitimize_path(struct nameidata *nd,
706 struct path *path, unsigned seq)
707{
708 return __legitimize_path(path, seq, nd->m_seq);
709}
710
711static bool legitimize_links(struct nameidata *nd)
712{
713 int i;
714 if (unlikely(nd->flags & LOOKUP_CACHED)) {
715 drop_links(nd);
716 nd->depth = 0;
717 return false;
718 }
719 for (i = 0; i < nd->depth; i++) {
720 struct saved *last = nd->stack + i;
721 if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
722 drop_links(nd);
723 nd->depth = i + 1;
724 return false;
725 }
726 }
727 return true;
728}
729
730static bool legitimize_root(struct nameidata *nd)
731{
732
733
734
735
736
737 if (!nd->root.mnt && (nd->flags & LOOKUP_IS_SCOPED))
738 return false;
739
740 if (!nd->root.mnt || (nd->state & ND_ROOT_PRESET))
741 return true;
742 nd->state |= ND_ROOT_GRABBED;
743 return legitimize_path(nd, &nd->root, nd->root_seq);
744}
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768static bool try_to_unlazy(struct nameidata *nd)
769{
770 struct dentry *parent = nd->path.dentry;
771
772 BUG_ON(!(nd->flags & LOOKUP_RCU));
773
774 nd->flags &= ~LOOKUP_RCU;
775 if (unlikely(!legitimize_links(nd)))
776 goto out1;
777 if (unlikely(!legitimize_path(nd, &nd->path, nd->seq)))
778 goto out;
779 if (unlikely(!legitimize_root(nd)))
780 goto out;
781 rcu_read_unlock();
782 BUG_ON(nd->inode != parent->d_inode);
783 return true;
784
785out1:
786 nd->path.mnt = NULL;
787 nd->path.dentry = NULL;
788out:
789 rcu_read_unlock();
790 return false;
791}
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806static bool try_to_unlazy_next(struct nameidata *nd, struct dentry *dentry, unsigned seq)
807{
808 BUG_ON(!(nd->flags & LOOKUP_RCU));
809
810 nd->flags &= ~LOOKUP_RCU;
811 if (unlikely(!legitimize_links(nd)))
812 goto out2;
813 if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq)))
814 goto out2;
815 if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref)))
816 goto out1;
817
818
819
820
821
822
823
824
825 if (unlikely(!lockref_get_not_dead(&dentry->d_lockref)))
826 goto out;
827 if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
828 goto out_dput;
829
830
831
832
833 if (unlikely(!legitimize_root(nd)))
834 goto out_dput;
835 rcu_read_unlock();
836 return true;
837
838out2:
839 nd->path.mnt = NULL;
840out1:
841 nd->path.dentry = NULL;
842out:
843 rcu_read_unlock();
844 return false;
845out_dput:
846 rcu_read_unlock();
847 dput(dentry);
848 return false;
849}
850
851static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
852{
853 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
854 return dentry->d_op->d_revalidate(dentry, flags);
855 else
856 return 1;
857}
858
859
860
861
862
863
864
865
866
867
868
869static int complete_walk(struct nameidata *nd)
870{
871 struct dentry *dentry = nd->path.dentry;
872 int status;
873
874 if (nd->flags & LOOKUP_RCU) {
875
876
877
878
879 if (!(nd->state & ND_ROOT_PRESET))
880 if (!(nd->flags & LOOKUP_IS_SCOPED))
881 nd->root.mnt = NULL;
882 nd->flags &= ~LOOKUP_CACHED;
883 if (!try_to_unlazy(nd))
884 return -ECHILD;
885 }
886
887 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904 if (!path_is_under(&nd->path, &nd->root))
905 return -EXDEV;
906 }
907
908 if (likely(!(nd->state & ND_JUMPED)))
909 return 0;
910
911 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
912 return 0;
913
914 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
915 if (status > 0)
916 return 0;
917
918 if (!status)
919 status = -ESTALE;
920
921 return status;
922}
923
924static int set_root(struct nameidata *nd)
925{
926 struct fs_struct *fs = current->fs;
927
928
929
930
931
932
933 if (WARN_ON(nd->flags & LOOKUP_IS_SCOPED))
934 return -ENOTRECOVERABLE;
935
936 if (nd->flags & LOOKUP_RCU) {
937 unsigned seq;
938
939 do {
940 seq = read_seqcount_begin(&fs->seq);
941 nd->root = fs->root;
942 nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
943 } while (read_seqcount_retry(&fs->seq, seq));
944 } else {
945 get_fs_root(fs, &nd->root);
946 nd->state |= ND_ROOT_GRABBED;
947 }
948 return 0;
949}
950
951static int nd_jump_root(struct nameidata *nd)
952{
953 if (unlikely(nd->flags & LOOKUP_BENEATH))
954 return -EXDEV;
955 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
956
957 if (nd->path.mnt != NULL && nd->path.mnt != nd->root.mnt)
958 return -EXDEV;
959 }
960 if (!nd->root.mnt) {
961 int error = set_root(nd);
962 if (error)
963 return error;
964 }
965 if (nd->flags & LOOKUP_RCU) {
966 struct dentry *d;
967 nd->path = nd->root;
968 d = nd->path.dentry;
969 nd->inode = d->d_inode;
970 nd->seq = nd->root_seq;
971 if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq)))
972 return -ECHILD;
973 } else {
974 path_put(&nd->path);
975 nd->path = nd->root;
976 path_get(&nd->path);
977 nd->inode = nd->path.dentry->d_inode;
978 }
979 nd->state |= ND_JUMPED;
980 return 0;
981}
982
983
984
985
986
987int nd_jump_link(struct path *path)
988{
989 int error = -ELOOP;
990 struct nameidata *nd = current->nameidata;
991
992 if (unlikely(nd->flags & LOOKUP_NO_MAGICLINKS))
993 goto err;
994
995 error = -EXDEV;
996 if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
997 if (nd->path.mnt != path->mnt)
998 goto err;
999 }
1000
1001 if (unlikely(nd->flags & LOOKUP_IS_SCOPED))
1002 goto err;
1003
1004 path_put(&nd->path);
1005 nd->path = *path;
1006 nd->inode = nd->path.dentry->d_inode;
1007 nd->state |= ND_JUMPED;
1008 return 0;
1009
1010err:
1011 path_put(path);
1012 return error;
1013}
1014
1015static inline void put_link(struct nameidata *nd)
1016{
1017 struct saved *last = nd->stack + --nd->depth;
1018 do_delayed_call(&last->done);
1019 if (!(nd->flags & LOOKUP_RCU))
1020 path_put(&last->link);
1021}
1022
1023int sysctl_protected_symlinks __read_mostly = 0;
1024int sysctl_protected_hardlinks __read_mostly = 0;
1025int sysctl_protected_fifos __read_mostly;
1026int sysctl_protected_regular __read_mostly;
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043static inline int may_follow_link(struct nameidata *nd, const struct inode *inode)
1044{
1045 struct user_namespace *mnt_userns;
1046 kuid_t i_uid;
1047
1048 if (!sysctl_protected_symlinks)
1049 return 0;
1050
1051 mnt_userns = mnt_user_ns(nd->path.mnt);
1052 i_uid = i_uid_into_mnt(mnt_userns, inode);
1053
1054 if (uid_eq(current_cred()->fsuid, i_uid))
1055 return 0;
1056
1057
1058 if ((nd->dir_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
1059 return 0;
1060
1061
1062 if (uid_valid(nd->dir_uid) && uid_eq(nd->dir_uid, i_uid))
1063 return 0;
1064
1065 if (nd->flags & LOOKUP_RCU)
1066 return -ECHILD;
1067
1068 audit_inode(nd->name, nd->stack[0].link.dentry, 0);
1069 audit_log_path_denied(AUDIT_ANOM_LINK, "follow_link");
1070 return -EACCES;
1071}
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086static bool safe_hardlink_source(struct user_namespace *mnt_userns,
1087 struct inode *inode)
1088{
1089 umode_t mode = inode->i_mode;
1090
1091
1092 if (!S_ISREG(mode))
1093 return false;
1094
1095
1096 if (mode & S_ISUID)
1097 return false;
1098
1099
1100 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
1101 return false;
1102
1103
1104 if (inode_permission(mnt_userns, inode, MAY_READ | MAY_WRITE))
1105 return false;
1106
1107 return true;
1108}
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129int may_linkat(struct user_namespace *mnt_userns, struct path *link)
1130{
1131 struct inode *inode = link->dentry->d_inode;
1132
1133
1134 if (!uid_valid(i_uid_into_mnt(mnt_userns, inode)) ||
1135 !gid_valid(i_gid_into_mnt(mnt_userns, inode)))
1136 return -EOVERFLOW;
1137
1138 if (!sysctl_protected_hardlinks)
1139 return 0;
1140
1141
1142
1143
1144 if (safe_hardlink_source(mnt_userns, inode) ||
1145 inode_owner_or_capable(mnt_userns, inode))
1146 return 0;
1147
1148 audit_log_path_denied(AUDIT_ANOM_LINK, "linkat");
1149 return -EPERM;
1150}
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179static int may_create_in_sticky(struct user_namespace *mnt_userns,
1180 struct nameidata *nd, struct inode *const inode)
1181{
1182 umode_t dir_mode = nd->dir_mode;
1183 kuid_t dir_uid = nd->dir_uid;
1184
1185 if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
1186 (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
1187 likely(!(dir_mode & S_ISVTX)) ||
1188 uid_eq(i_uid_into_mnt(mnt_userns, inode), dir_uid) ||
1189 uid_eq(current_fsuid(), i_uid_into_mnt(mnt_userns, inode)))
1190 return 0;
1191
1192 if (likely(dir_mode & 0002) ||
1193 (dir_mode & 0020 &&
1194 ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
1195 (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
1196 const char *operation = S_ISFIFO(inode->i_mode) ?
1197 "sticky_create_fifo" :
1198 "sticky_create_regular";
1199 audit_log_path_denied(AUDIT_ANOM_CREAT, operation);
1200 return -EACCES;
1201 }
1202 return 0;
1203}
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215int follow_up(struct path *path)
1216{
1217 struct mount *mnt = real_mount(path->mnt);
1218 struct mount *parent;
1219 struct dentry *mountpoint;
1220
1221 read_seqlock_excl(&mount_lock);
1222 parent = mnt->mnt_parent;
1223 if (parent == mnt) {
1224 read_sequnlock_excl(&mount_lock);
1225 return 0;
1226 }
1227 mntget(&parent->mnt);
1228 mountpoint = dget(mnt->mnt_mountpoint);
1229 read_sequnlock_excl(&mount_lock);
1230 dput(path->dentry);
1231 path->dentry = mountpoint;
1232 mntput(path->mnt);
1233 path->mnt = &parent->mnt;
1234 return 1;
1235}
1236EXPORT_SYMBOL(follow_up);
1237
1238static bool choose_mountpoint_rcu(struct mount *m, const struct path *root,
1239 struct path *path, unsigned *seqp)
1240{
1241 while (mnt_has_parent(m)) {
1242 struct dentry *mountpoint = m->mnt_mountpoint;
1243
1244 m = m->mnt_parent;
1245 if (unlikely(root->dentry == mountpoint &&
1246 root->mnt == &m->mnt))
1247 break;
1248 if (mountpoint != m->mnt.mnt_root) {
1249 path->mnt = &m->mnt;
1250 path->dentry = mountpoint;
1251 *seqp = read_seqcount_begin(&mountpoint->d_seq);
1252 return true;
1253 }
1254 }
1255 return false;
1256}
1257
1258static bool choose_mountpoint(struct mount *m, const struct path *root,
1259 struct path *path)
1260{
1261 bool found;
1262
1263 rcu_read_lock();
1264 while (1) {
1265 unsigned seq, mseq = read_seqbegin(&mount_lock);
1266
1267 found = choose_mountpoint_rcu(m, root, path, &seq);
1268 if (unlikely(!found)) {
1269 if (!read_seqretry(&mount_lock, mseq))
1270 break;
1271 } else {
1272 if (likely(__legitimize_path(path, seq, mseq)))
1273 break;
1274 rcu_read_unlock();
1275 path_put(path);
1276 rcu_read_lock();
1277 }
1278 }
1279 rcu_read_unlock();
1280 return found;
1281}
1282
1283
1284
1285
1286
1287
1288static int follow_automount(struct path *path, int *count, unsigned lookup_flags)
1289{
1290 struct dentry *dentry = path->dentry;
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303 if (!(lookup_flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
1304 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
1305 dentry->d_inode)
1306 return -EISDIR;
1307
1308 if (count && (*count)++ >= MAXSYMLINKS)
1309 return -ELOOP;
1310
1311 return finish_automount(dentry->d_op->d_automount(path), path);
1312}
1313
1314
1315
1316
1317
1318
1319
1320static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped,
1321 int *count, unsigned lookup_flags)
1322{
1323 struct vfsmount *mnt = path->mnt;
1324 bool need_mntput = false;
1325 int ret = 0;
1326
1327 while (flags & DCACHE_MANAGED_DENTRY) {
1328
1329
1330 if (flags & DCACHE_MANAGE_TRANSIT) {
1331 ret = path->dentry->d_op->d_manage(path, false);
1332 flags = smp_load_acquire(&path->dentry->d_flags);
1333 if (ret < 0)
1334 break;
1335 }
1336
1337 if (flags & DCACHE_MOUNTED) {
1338 struct vfsmount *mounted = lookup_mnt(path);
1339 if (mounted) {
1340 dput(path->dentry);
1341 if (need_mntput)
1342 mntput(path->mnt);
1343 path->mnt = mounted;
1344 path->dentry = dget(mounted->mnt_root);
1345
1346 flags = path->dentry->d_flags;
1347 need_mntput = true;
1348 continue;
1349 }
1350 }
1351
1352 if (!(flags & DCACHE_NEED_AUTOMOUNT))
1353 break;
1354
1355
1356 ret = follow_automount(path, count, lookup_flags);
1357 flags = smp_load_acquire(&path->dentry->d_flags);
1358 if (ret < 0)
1359 break;
1360 }
1361
1362 if (ret == -EISDIR)
1363 ret = 0;
1364
1365 if (need_mntput && path->mnt == mnt)
1366 mntput(path->mnt);
1367 if (!ret && unlikely(d_flags_negative(flags)))
1368 ret = -ENOENT;
1369 *jumped = need_mntput;
1370 return ret;
1371}
1372
1373static inline int traverse_mounts(struct path *path, bool *jumped,
1374 int *count, unsigned lookup_flags)
1375{
1376 unsigned flags = smp_load_acquire(&path->dentry->d_flags);
1377
1378
1379 if (likely(!(flags & DCACHE_MANAGED_DENTRY))) {
1380 *jumped = false;
1381 if (unlikely(d_flags_negative(flags)))
1382 return -ENOENT;
1383 return 0;
1384 }
1385 return __traverse_mounts(path, flags, jumped, count, lookup_flags);
1386}
1387
1388int follow_down_one(struct path *path)
1389{
1390 struct vfsmount *mounted;
1391
1392 mounted = lookup_mnt(path);
1393 if (mounted) {
1394 dput(path->dentry);
1395 mntput(path->mnt);
1396 path->mnt = mounted;
1397 path->dentry = dget(mounted->mnt_root);
1398 return 1;
1399 }
1400 return 0;
1401}
1402EXPORT_SYMBOL(follow_down_one);
1403
1404
1405
1406
1407
1408
1409int follow_down(struct path *path)
1410{
1411 struct vfsmount *mnt = path->mnt;
1412 bool jumped;
1413 int ret = traverse_mounts(path, &jumped, NULL, 0);
1414
1415 if (path->mnt != mnt)
1416 mntput(mnt);
1417 return ret;
1418}
1419EXPORT_SYMBOL(follow_down);
1420
1421
1422
1423
1424
1425static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1426 struct inode **inode, unsigned *seqp)
1427{
1428 struct dentry *dentry = path->dentry;
1429 unsigned int flags = dentry->d_flags;
1430
1431 if (likely(!(flags & DCACHE_MANAGED_DENTRY)))
1432 return true;
1433
1434 if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1435 return false;
1436
1437 for (;;) {
1438
1439
1440
1441
1442 if (unlikely(flags & DCACHE_MANAGE_TRANSIT)) {
1443 int res = dentry->d_op->d_manage(path, true);
1444 if (res)
1445 return res == -EISDIR;
1446 flags = dentry->d_flags;
1447 }
1448
1449 if (flags & DCACHE_MOUNTED) {
1450 struct mount *mounted = __lookup_mnt(path->mnt, dentry);
1451 if (mounted) {
1452 path->mnt = &mounted->mnt;
1453 dentry = path->dentry = mounted->mnt.mnt_root;
1454 nd->state |= ND_JUMPED;
1455 *seqp = read_seqcount_begin(&dentry->d_seq);
1456 *inode = dentry->d_inode;
1457
1458
1459
1460
1461
1462
1463 flags = dentry->d_flags;
1464 continue;
1465 }
1466 if (read_seqretry(&mount_lock, nd->m_seq))
1467 return false;
1468 }
1469 return !(flags & DCACHE_NEED_AUTOMOUNT);
1470 }
1471}
1472
1473static inline int handle_mounts(struct nameidata *nd, struct dentry *dentry,
1474 struct path *path, struct inode **inode,
1475 unsigned int *seqp)
1476{
1477 bool jumped;
1478 int ret;
1479
1480 path->mnt = nd->path.mnt;
1481 path->dentry = dentry;
1482 if (nd->flags & LOOKUP_RCU) {
1483 unsigned int seq = *seqp;
1484 if (unlikely(!*inode))
1485 return -ENOENT;
1486 if (likely(__follow_mount_rcu(nd, path, inode, seqp)))
1487 return 0;
1488 if (!try_to_unlazy_next(nd, dentry, seq))
1489 return -ECHILD;
1490
1491 path->mnt = nd->path.mnt;
1492 path->dentry = dentry;
1493 }
1494 ret = traverse_mounts(path, &jumped, &nd->total_link_count, nd->flags);
1495 if (jumped) {
1496 if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1497 ret = -EXDEV;
1498 else
1499 nd->state |= ND_JUMPED;
1500 }
1501 if (unlikely(ret)) {
1502 dput(path->dentry);
1503 if (path->mnt != nd->path.mnt)
1504 mntput(path->mnt);
1505 } else {
1506 *inode = d_backing_inode(path->dentry);
1507 *seqp = 0;
1508 }
1509 return ret;
1510}
1511
1512
1513
1514
1515
1516static struct dentry *lookup_dcache(const struct qstr *name,
1517 struct dentry *dir,
1518 unsigned int flags)
1519{
1520 struct dentry *dentry = d_lookup(dir, name);
1521 if (dentry) {
1522 int error = d_revalidate(dentry, flags);
1523 if (unlikely(error <= 0)) {
1524 if (!error)
1525 d_invalidate(dentry);
1526 dput(dentry);
1527 return ERR_PTR(error);
1528 }
1529 }
1530 return dentry;
1531}
1532
1533
1534
1535
1536
1537
1538
1539
1540static struct dentry *__lookup_hash(const struct qstr *name,
1541 struct dentry *base, unsigned int flags)
1542{
1543 struct dentry *dentry = lookup_dcache(name, base, flags);
1544 struct dentry *old;
1545 struct inode *dir = base->d_inode;
1546
1547 if (dentry)
1548 return dentry;
1549
1550
1551 if (unlikely(IS_DEADDIR(dir)))
1552 return ERR_PTR(-ENOENT);
1553
1554 dentry = d_alloc(base, name);
1555 if (unlikely(!dentry))
1556 return ERR_PTR(-ENOMEM);
1557
1558 old = dir->i_op->lookup(dir, dentry, flags);
1559 if (unlikely(old)) {
1560 dput(dentry);
1561 dentry = old;
1562 }
1563 return dentry;
1564}
1565
1566static struct dentry *lookup_fast(struct nameidata *nd,
1567 struct inode **inode,
1568 unsigned *seqp)
1569{
1570 struct dentry *dentry, *parent = nd->path.dentry;
1571 int status = 1;
1572
1573
1574
1575
1576
1577
1578 if (nd->flags & LOOKUP_RCU) {
1579 unsigned seq;
1580 dentry = __d_lookup_rcu(parent, &nd->last, &seq);
1581 if (unlikely(!dentry)) {
1582 if (!try_to_unlazy(nd))
1583 return ERR_PTR(-ECHILD);
1584 return NULL;
1585 }
1586
1587
1588
1589
1590
1591 *inode = d_backing_inode(dentry);
1592 if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
1593 return ERR_PTR(-ECHILD);
1594
1595
1596
1597
1598
1599
1600
1601
1602 if (unlikely(__read_seqcount_retry(&parent->d_seq, nd->seq)))
1603 return ERR_PTR(-ECHILD);
1604
1605 *seqp = seq;
1606 status = d_revalidate(dentry, nd->flags);
1607 if (likely(status > 0))
1608 return dentry;
1609 if (!try_to_unlazy_next(nd, dentry, seq))
1610 return ERR_PTR(-ECHILD);
1611 if (status == -ECHILD)
1612
1613 status = d_revalidate(dentry, nd->flags);
1614 } else {
1615 dentry = __d_lookup(parent, &nd->last);
1616 if (unlikely(!dentry))
1617 return NULL;
1618 status = d_revalidate(dentry, nd->flags);
1619 }
1620 if (unlikely(status <= 0)) {
1621 if (!status)
1622 d_invalidate(dentry);
1623 dput(dentry);
1624 return ERR_PTR(status);
1625 }
1626 return dentry;
1627}
1628
1629
1630static struct dentry *__lookup_slow(const struct qstr *name,
1631 struct dentry *dir,
1632 unsigned int flags)
1633{
1634 struct dentry *dentry, *old;
1635 struct inode *inode = dir->d_inode;
1636 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
1637
1638
1639 if (unlikely(IS_DEADDIR(inode)))
1640 return ERR_PTR(-ENOENT);
1641again:
1642 dentry = d_alloc_parallel(dir, name, &wq);
1643 if (IS_ERR(dentry))
1644 return dentry;
1645 if (unlikely(!d_in_lookup(dentry))) {
1646 int error = d_revalidate(dentry, flags);
1647 if (unlikely(error <= 0)) {
1648 if (!error) {
1649 d_invalidate(dentry);
1650 dput(dentry);
1651 goto again;
1652 }
1653 dput(dentry);
1654 dentry = ERR_PTR(error);
1655 }
1656 } else {
1657 old = inode->i_op->lookup(inode, dentry, flags);
1658 d_lookup_done(dentry);
1659 if (unlikely(old)) {
1660 dput(dentry);
1661 dentry = old;
1662 }
1663 }
1664 return dentry;
1665}
1666
1667static struct dentry *lookup_slow(const struct qstr *name,
1668 struct dentry *dir,
1669 unsigned int flags)
1670{
1671 struct inode *inode = dir->d_inode;
1672 struct dentry *res;
1673 inode_lock_shared(inode);
1674 res = __lookup_slow(name, dir, flags);
1675 inode_unlock_shared(inode);
1676 return res;
1677}
1678
1679static inline int may_lookup(struct user_namespace *mnt_userns,
1680 struct nameidata *nd)
1681{
1682 if (nd->flags & LOOKUP_RCU) {
1683 int err = inode_permission(mnt_userns, nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1684 if (err != -ECHILD || !try_to_unlazy(nd))
1685 return err;
1686 }
1687 return inode_permission(mnt_userns, nd->inode, MAY_EXEC);
1688}
1689
1690static int reserve_stack(struct nameidata *nd, struct path *link, unsigned seq)
1691{
1692 if (unlikely(nd->total_link_count++ >= MAXSYMLINKS))
1693 return -ELOOP;
1694
1695 if (likely(nd->depth != EMBEDDED_LEVELS))
1696 return 0;
1697 if (likely(nd->stack != nd->internal))
1698 return 0;
1699 if (likely(nd_alloc_stack(nd)))
1700 return 0;
1701
1702 if (nd->flags & LOOKUP_RCU) {
1703
1704
1705 bool grabbed_link = legitimize_path(nd, link, seq);
1706
1707 if (!try_to_unlazy(nd) != 0 || !grabbed_link)
1708 return -ECHILD;
1709
1710 if (nd_alloc_stack(nd))
1711 return 0;
1712 }
1713 return -ENOMEM;
1714}
1715
1716enum {WALK_TRAILING = 1, WALK_MORE = 2, WALK_NOFOLLOW = 4};
1717
1718static const char *pick_link(struct nameidata *nd, struct path *link,
1719 struct inode *inode, unsigned seq, int flags)
1720{
1721 struct saved *last;
1722 const char *res;
1723 int error = reserve_stack(nd, link, seq);
1724
1725 if (unlikely(error)) {
1726 if (!(nd->flags & LOOKUP_RCU))
1727 path_put(link);
1728 return ERR_PTR(error);
1729 }
1730 last = nd->stack + nd->depth++;
1731 last->link = *link;
1732 clear_delayed_call(&last->done);
1733 last->seq = seq;
1734
1735 if (flags & WALK_TRAILING) {
1736 error = may_follow_link(nd, inode);
1737 if (unlikely(error))
1738 return ERR_PTR(error);
1739 }
1740
1741 if (unlikely(nd->flags & LOOKUP_NO_SYMLINKS) ||
1742 unlikely(link->mnt->mnt_flags & MNT_NOSYMFOLLOW))
1743 return ERR_PTR(-ELOOP);
1744
1745 if (!(nd->flags & LOOKUP_RCU)) {
1746 touch_atime(&last->link);
1747 cond_resched();
1748 } else if (atime_needs_update(&last->link, inode)) {
1749 if (!try_to_unlazy(nd))
1750 return ERR_PTR(-ECHILD);
1751 touch_atime(&last->link);
1752 }
1753
1754 error = security_inode_follow_link(link->dentry, inode,
1755 nd->flags & LOOKUP_RCU);
1756 if (unlikely(error))
1757 return ERR_PTR(error);
1758
1759 res = READ_ONCE(inode->i_link);
1760 if (!res) {
1761 const char * (*get)(struct dentry *, struct inode *,
1762 struct delayed_call *);
1763 get = inode->i_op->get_link;
1764 if (nd->flags & LOOKUP_RCU) {
1765 res = get(NULL, inode, &last->done);
1766 if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd))
1767 res = get(link->dentry, inode, &last->done);
1768 } else {
1769 res = get(link->dentry, inode, &last->done);
1770 }
1771 if (!res)
1772 goto all_done;
1773 if (IS_ERR(res))
1774 return res;
1775 }
1776 if (*res == '/') {
1777 error = nd_jump_root(nd);
1778 if (unlikely(error))
1779 return ERR_PTR(error);
1780 while (unlikely(*++res == '/'))
1781 ;
1782 }
1783 if (*res)
1784 return res;
1785all_done:
1786 put_link(nd);
1787 return NULL;
1788}
1789
1790
1791
1792
1793
1794
1795
1796static const char *step_into(struct nameidata *nd, int flags,
1797 struct dentry *dentry, struct inode *inode, unsigned seq)
1798{
1799 struct path path;
1800 int err = handle_mounts(nd, dentry, &path, &inode, &seq);
1801
1802 if (err < 0)
1803 return ERR_PTR(err);
1804 if (likely(!d_is_symlink(path.dentry)) ||
1805 ((flags & WALK_TRAILING) && !(nd->flags & LOOKUP_FOLLOW)) ||
1806 (flags & WALK_NOFOLLOW)) {
1807
1808 if (!(nd->flags & LOOKUP_RCU)) {
1809 dput(nd->path.dentry);
1810 if (nd->path.mnt != path.mnt)
1811 mntput(nd->path.mnt);
1812 }
1813 nd->path = path;
1814 nd->inode = inode;
1815 nd->seq = seq;
1816 return NULL;
1817 }
1818 if (nd->flags & LOOKUP_RCU) {
1819
1820 if (read_seqcount_retry(&path.dentry->d_seq, seq))
1821 return ERR_PTR(-ECHILD);
1822 } else {
1823 if (path.mnt == nd->path.mnt)
1824 mntget(path.mnt);
1825 }
1826 return pick_link(nd, &path, inode, seq, flags);
1827}
1828
1829static struct dentry *follow_dotdot_rcu(struct nameidata *nd,
1830 struct inode **inodep,
1831 unsigned *seqp)
1832{
1833 struct dentry *parent, *old;
1834
1835 if (path_equal(&nd->path, &nd->root))
1836 goto in_root;
1837 if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
1838 struct path path;
1839 unsigned seq;
1840 if (!choose_mountpoint_rcu(real_mount(nd->path.mnt),
1841 &nd->root, &path, &seq))
1842 goto in_root;
1843 if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1844 return ERR_PTR(-ECHILD);
1845 nd->path = path;
1846 nd->inode = path.dentry->d_inode;
1847 nd->seq = seq;
1848 if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
1849 return ERR_PTR(-ECHILD);
1850
1851 }
1852 old = nd->path.dentry;
1853 parent = old->d_parent;
1854 *inodep = parent->d_inode;
1855 *seqp = read_seqcount_begin(&parent->d_seq);
1856 if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq)))
1857 return ERR_PTR(-ECHILD);
1858 if (unlikely(!path_connected(nd->path.mnt, parent)))
1859 return ERR_PTR(-ECHILD);
1860 return parent;
1861in_root:
1862 if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
1863 return ERR_PTR(-ECHILD);
1864 if (unlikely(nd->flags & LOOKUP_BENEATH))
1865 return ERR_PTR(-ECHILD);
1866 return NULL;
1867}
1868
1869static struct dentry *follow_dotdot(struct nameidata *nd,
1870 struct inode **inodep,
1871 unsigned *seqp)
1872{
1873 struct dentry *parent;
1874
1875 if (path_equal(&nd->path, &nd->root))
1876 goto in_root;
1877 if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
1878 struct path path;
1879
1880 if (!choose_mountpoint(real_mount(nd->path.mnt),
1881 &nd->root, &path))
1882 goto in_root;
1883 path_put(&nd->path);
1884 nd->path = path;
1885 nd->inode = path.dentry->d_inode;
1886 if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1887 return ERR_PTR(-EXDEV);
1888 }
1889
1890 parent = dget_parent(nd->path.dentry);
1891 if (unlikely(!path_connected(nd->path.mnt, parent))) {
1892 dput(parent);
1893 return ERR_PTR(-ENOENT);
1894 }
1895 *seqp = 0;
1896 *inodep = parent->d_inode;
1897 return parent;
1898
1899in_root:
1900 if (unlikely(nd->flags & LOOKUP_BENEATH))
1901 return ERR_PTR(-EXDEV);
1902 dget(nd->path.dentry);
1903 return NULL;
1904}
1905
1906static const char *handle_dots(struct nameidata *nd, int type)
1907{
1908 if (type == LAST_DOTDOT) {
1909 const char *error = NULL;
1910 struct dentry *parent;
1911 struct inode *inode;
1912 unsigned seq;
1913
1914 if (!nd->root.mnt) {
1915 error = ERR_PTR(set_root(nd));
1916 if (error)
1917 return error;
1918 }
1919 if (nd->flags & LOOKUP_RCU)
1920 parent = follow_dotdot_rcu(nd, &inode, &seq);
1921 else
1922 parent = follow_dotdot(nd, &inode, &seq);
1923 if (IS_ERR(parent))
1924 return ERR_CAST(parent);
1925 if (unlikely(!parent))
1926 error = step_into(nd, WALK_NOFOLLOW,
1927 nd->path.dentry, nd->inode, nd->seq);
1928 else
1929 error = step_into(nd, WALK_NOFOLLOW,
1930 parent, inode, seq);
1931 if (unlikely(error))
1932 return error;
1933
1934 if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
1935
1936
1937
1938
1939
1940
1941 smp_rmb();
1942 if (unlikely(__read_seqcount_retry(&mount_lock.seqcount, nd->m_seq)))
1943 return ERR_PTR(-EAGAIN);
1944 if (unlikely(__read_seqcount_retry(&rename_lock.seqcount, nd->r_seq)))
1945 return ERR_PTR(-EAGAIN);
1946 }
1947 }
1948 return NULL;
1949}
1950
1951static const char *walk_component(struct nameidata *nd, int flags)
1952{
1953 struct dentry *dentry;
1954 struct inode *inode;
1955 unsigned seq;
1956
1957
1958
1959
1960
1961 if (unlikely(nd->last_type != LAST_NORM)) {
1962 if (!(flags & WALK_MORE) && nd->depth)
1963 put_link(nd);
1964 return handle_dots(nd, nd->last_type);
1965 }
1966 dentry = lookup_fast(nd, &inode, &seq);
1967 if (IS_ERR(dentry))
1968 return ERR_CAST(dentry);
1969 if (unlikely(!dentry)) {
1970 dentry = lookup_slow(&nd->last, nd->path.dentry, nd->flags);
1971 if (IS_ERR(dentry))
1972 return ERR_CAST(dentry);
1973 }
1974 if (!(flags & WALK_MORE) && nd->depth)
1975 put_link(nd);
1976 return step_into(nd, flags, dentry, inode, seq);
1977}
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996#ifdef CONFIG_DCACHE_WORD_ACCESS
1997
1998#include <asm/word-at-a-time.h>
1999
2000#ifdef HASH_MIX
2001
2002
2003
2004#elif defined(CONFIG_64BIT)
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034#define HASH_MIX(x, y, a) \
2035 ( x ^= (a), \
2036 y ^= x, x = rol64(x,12),\
2037 x += y, y = rol64(y,45),\
2038 y *= 9 )
2039
2040
2041
2042
2043
2044
2045static inline unsigned int fold_hash(unsigned long x, unsigned long y)
2046{
2047 y ^= x * GOLDEN_RATIO_64;
2048 y *= GOLDEN_RATIO_64;
2049 return y >> 32;
2050}
2051
2052#else
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064#define HASH_MIX(x, y, a) \
2065 ( x ^= (a), \
2066 y ^= x, x = rol32(x, 7),\
2067 x += y, y = rol32(y,20),\
2068 y *= 9 )
2069
2070static inline unsigned int fold_hash(unsigned long x, unsigned long y)
2071{
2072
2073 return __hash_32(y ^ __hash_32(x));
2074}
2075
2076#endif
2077
2078
2079
2080
2081
2082
2083
2084
2085unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2086{
2087 unsigned long a, x = 0, y = (unsigned long)salt;
2088
2089 for (;;) {
2090 if (!len)
2091 goto done;
2092 a = load_unaligned_zeropad(name);
2093 if (len < sizeof(unsigned long))
2094 break;
2095 HASH_MIX(x, y, a);
2096 name += sizeof(unsigned long);
2097 len -= sizeof(unsigned long);
2098 }
2099 x ^= a & bytemask_from_count(len);
2100done:
2101 return fold_hash(x, y);
2102}
2103EXPORT_SYMBOL(full_name_hash);
2104
2105
2106u64 hashlen_string(const void *salt, const char *name)
2107{
2108 unsigned long a = 0, x = 0, y = (unsigned long)salt;
2109 unsigned long adata, mask, len;
2110 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
2111
2112 len = 0;
2113 goto inside;
2114
2115 do {
2116 HASH_MIX(x, y, a);
2117 len += sizeof(unsigned long);
2118inside:
2119 a = load_unaligned_zeropad(name+len);
2120 } while (!has_zero(a, &adata, &constants));
2121
2122 adata = prep_zero_mask(a, adata, &constants);
2123 mask = create_zero_mask(adata);
2124 x ^= a & zero_bytemask(mask);
2125
2126 return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2127}
2128EXPORT_SYMBOL(hashlen_string);
2129
2130
2131
2132
2133
2134static inline u64 hash_name(const void *salt, const char *name)
2135{
2136 unsigned long a = 0, b, x = 0, y = (unsigned long)salt;
2137 unsigned long adata, bdata, mask, len;
2138 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
2139
2140 len = 0;
2141 goto inside;
2142
2143 do {
2144 HASH_MIX(x, y, a);
2145 len += sizeof(unsigned long);
2146inside:
2147 a = load_unaligned_zeropad(name+len);
2148 b = a ^ REPEAT_BYTE('/');
2149 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
2150
2151 adata = prep_zero_mask(a, adata, &constants);
2152 bdata = prep_zero_mask(b, bdata, &constants);
2153 mask = create_zero_mask(adata | bdata);
2154 x ^= a & zero_bytemask(mask);
2155
2156 return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2157}
2158
2159#else
2160
2161
2162unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2163{
2164 unsigned long hash = init_name_hash(salt);
2165 while (len--)
2166 hash = partial_name_hash((unsigned char)*name++, hash);
2167 return end_name_hash(hash);
2168}
2169EXPORT_SYMBOL(full_name_hash);
2170
2171
2172u64 hashlen_string(const void *salt, const char *name)
2173{
2174 unsigned long hash = init_name_hash(salt);
2175 unsigned long len = 0, c;
2176
2177 c = (unsigned char)*name;
2178 while (c) {
2179 len++;
2180 hash = partial_name_hash(c, hash);
2181 c = (unsigned char)name[len];
2182 }
2183 return hashlen_create(end_name_hash(hash), len);
2184}
2185EXPORT_SYMBOL(hashlen_string);
2186
2187
2188
2189
2190
2191static inline u64 hash_name(const void *salt, const char *name)
2192{
2193 unsigned long hash = init_name_hash(salt);
2194 unsigned long len = 0, c;
2195
2196 c = (unsigned char)*name;
2197 do {
2198 len++;
2199 hash = partial_name_hash(c, hash);
2200 c = (unsigned char)name[len];
2201 } while (c && c != '/');
2202 return hashlen_create(end_name_hash(hash), len);
2203}
2204
2205#endif
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215static int link_path_walk(const char *name, struct nameidata *nd)
2216{
2217 int depth = 0;
2218 int err;
2219
2220 nd->last_type = LAST_ROOT;
2221 nd->flags |= LOOKUP_PARENT;
2222 if (IS_ERR(name))
2223 return PTR_ERR(name);
2224 while (*name=='/')
2225 name++;
2226 if (!*name) {
2227 nd->dir_mode = 0;
2228 return 0;
2229 }
2230
2231
2232 for(;;) {
2233 struct user_namespace *mnt_userns;
2234 const char *link;
2235 u64 hash_len;
2236 int type;
2237
2238 mnt_userns = mnt_user_ns(nd->path.mnt);
2239 err = may_lookup(mnt_userns, nd);
2240 if (err)
2241 return err;
2242
2243 hash_len = hash_name(nd->path.dentry, name);
2244
2245 type = LAST_NORM;
2246 if (name[0] == '.') switch (hashlen_len(hash_len)) {
2247 case 2:
2248 if (name[1] == '.') {
2249 type = LAST_DOTDOT;
2250 nd->state |= ND_JUMPED;
2251 }
2252 break;
2253 case 1:
2254 type = LAST_DOT;
2255 }
2256 if (likely(type == LAST_NORM)) {
2257 struct dentry *parent = nd->path.dentry;
2258 nd->state &= ~ND_JUMPED;
2259 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
2260 struct qstr this = { { .hash_len = hash_len }, .name = name };
2261 err = parent->d_op->d_hash(parent, &this);
2262 if (err < 0)
2263 return err;
2264 hash_len = this.hash_len;
2265 name = this.name;
2266 }
2267 }
2268
2269 nd->last.hash_len = hash_len;
2270 nd->last.name = name;
2271 nd->last_type = type;
2272
2273 name += hashlen_len(hash_len);
2274 if (!*name)
2275 goto OK;
2276
2277
2278
2279
2280 do {
2281 name++;
2282 } while (unlikely(*name == '/'));
2283 if (unlikely(!*name)) {
2284OK:
2285
2286 if (!depth) {
2287 nd->dir_uid = i_uid_into_mnt(mnt_userns, nd->inode);
2288 nd->dir_mode = nd->inode->i_mode;
2289 nd->flags &= ~LOOKUP_PARENT;
2290 return 0;
2291 }
2292
2293 name = nd->stack[--depth].name;
2294 link = walk_component(nd, 0);
2295 } else {
2296
2297 link = walk_component(nd, WALK_MORE);
2298 }
2299 if (unlikely(link)) {
2300 if (IS_ERR(link))
2301 return PTR_ERR(link);
2302
2303 nd->stack[depth++].name = name;
2304 name = link;
2305 continue;
2306 }
2307 if (unlikely(!d_can_lookup(nd->path.dentry))) {
2308 if (nd->flags & LOOKUP_RCU) {
2309 if (!try_to_unlazy(nd))
2310 return -ECHILD;
2311 }
2312 return -ENOTDIR;
2313 }
2314 }
2315}
2316
2317
2318static const char *path_init(struct nameidata *nd, unsigned flags)
2319{
2320 int error;
2321 const char *s = nd->name->name;
2322
2323
2324 if ((flags & (LOOKUP_RCU | LOOKUP_CACHED)) == LOOKUP_CACHED)
2325 return ERR_PTR(-EAGAIN);
2326
2327 if (!*s)
2328 flags &= ~LOOKUP_RCU;
2329 if (flags & LOOKUP_RCU)
2330 rcu_read_lock();
2331
2332 nd->flags = flags;
2333 nd->state |= ND_JUMPED;
2334
2335 nd->m_seq = __read_seqcount_begin(&mount_lock.seqcount);
2336 nd->r_seq = __read_seqcount_begin(&rename_lock.seqcount);
2337 smp_rmb();
2338
2339 if (nd->state & ND_ROOT_PRESET) {
2340 struct dentry *root = nd->root.dentry;
2341 struct inode *inode = root->d_inode;
2342 if (*s && unlikely(!d_can_lookup(root)))
2343 return ERR_PTR(-ENOTDIR);
2344 nd->path = nd->root;
2345 nd->inode = inode;
2346 if (flags & LOOKUP_RCU) {
2347 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2348 nd->root_seq = nd->seq;
2349 } else {
2350 path_get(&nd->path);
2351 }
2352 return s;
2353 }
2354
2355 nd->root.mnt = NULL;
2356
2357
2358 if (*s == '/' && !(flags & LOOKUP_IN_ROOT)) {
2359 error = nd_jump_root(nd);
2360 if (unlikely(error))
2361 return ERR_PTR(error);
2362 return s;
2363 }
2364
2365
2366 if (nd->dfd == AT_FDCWD) {
2367 if (flags & LOOKUP_RCU) {
2368 struct fs_struct *fs = current->fs;
2369 unsigned seq;
2370
2371 do {
2372 seq = read_seqcount_begin(&fs->seq);
2373 nd->path = fs->pwd;
2374 nd->inode = nd->path.dentry->d_inode;
2375 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2376 } while (read_seqcount_retry(&fs->seq, seq));
2377 } else {
2378 get_fs_pwd(current->fs, &nd->path);
2379 nd->inode = nd->path.dentry->d_inode;
2380 }
2381 } else {
2382
2383 struct fd f = fdget_raw(nd->dfd);
2384 struct dentry *dentry;
2385
2386 if (!f.file)
2387 return ERR_PTR(-EBADF);
2388
2389 dentry = f.file->f_path.dentry;
2390
2391 if (*s && unlikely(!d_can_lookup(dentry))) {
2392 fdput(f);
2393 return ERR_PTR(-ENOTDIR);
2394 }
2395
2396 nd->path = f.file->f_path;
2397 if (flags & LOOKUP_RCU) {
2398 nd->inode = nd->path.dentry->d_inode;
2399 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2400 } else {
2401 path_get(&nd->path);
2402 nd->inode = nd->path.dentry->d_inode;
2403 }
2404 fdput(f);
2405 }
2406
2407
2408 if (flags & LOOKUP_IS_SCOPED) {
2409 nd->root = nd->path;
2410 if (flags & LOOKUP_RCU) {
2411 nd->root_seq = nd->seq;
2412 } else {
2413 path_get(&nd->root);
2414 nd->state |= ND_ROOT_GRABBED;
2415 }
2416 }
2417 return s;
2418}
2419
2420static inline const char *lookup_last(struct nameidata *nd)
2421{
2422 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
2423 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2424
2425 return walk_component(nd, WALK_TRAILING);
2426}
2427
2428static int handle_lookup_down(struct nameidata *nd)
2429{
2430 if (!(nd->flags & LOOKUP_RCU))
2431 dget(nd->path.dentry);
2432 return PTR_ERR(step_into(nd, WALK_NOFOLLOW,
2433 nd->path.dentry, nd->inode, nd->seq));
2434}
2435
2436
2437static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2438{
2439 const char *s = path_init(nd, flags);
2440 int err;
2441
2442 if (unlikely(flags & LOOKUP_DOWN) && !IS_ERR(s)) {
2443 err = handle_lookup_down(nd);
2444 if (unlikely(err < 0))
2445 s = ERR_PTR(err);
2446 }
2447
2448 while (!(err = link_path_walk(s, nd)) &&
2449 (s = lookup_last(nd)) != NULL)
2450 ;
2451 if (!err && unlikely(nd->flags & LOOKUP_MOUNTPOINT)) {
2452 err = handle_lookup_down(nd);
2453 nd->state &= ~ND_JUMPED;
2454 }
2455 if (!err)
2456 err = complete_walk(nd);
2457
2458 if (!err && nd->flags & LOOKUP_DIRECTORY)
2459 if (!d_can_lookup(nd->path.dentry))
2460 err = -ENOTDIR;
2461 if (!err) {
2462 *path = nd->path;
2463 nd->path.mnt = NULL;
2464 nd->path.dentry = NULL;
2465 }
2466 terminate_walk(nd);
2467 return err;
2468}
2469
2470int filename_lookup(int dfd, struct filename *name, unsigned flags,
2471 struct path *path, struct path *root)
2472{
2473 int retval;
2474 struct nameidata nd;
2475 if (IS_ERR(name))
2476 return PTR_ERR(name);
2477 set_nameidata(&nd, dfd, name, root);
2478 retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
2479 if (unlikely(retval == -ECHILD))
2480 retval = path_lookupat(&nd, flags, path);
2481 if (unlikely(retval == -ESTALE))
2482 retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
2483
2484 if (likely(!retval))
2485 audit_inode(name, path->dentry,
2486 flags & LOOKUP_MOUNTPOINT ? AUDIT_INODE_NOEVAL : 0);
2487 restore_nameidata();
2488 return retval;
2489}
2490
2491
2492static int path_parentat(struct nameidata *nd, unsigned flags,
2493 struct path *parent)
2494{
2495 const char *s = path_init(nd, flags);
2496 int err = link_path_walk(s, nd);
2497 if (!err)
2498 err = complete_walk(nd);
2499 if (!err) {
2500 *parent = nd->path;
2501 nd->path.mnt = NULL;
2502 nd->path.dentry = NULL;
2503 }
2504 terminate_walk(nd);
2505 return err;
2506}
2507
2508
2509static int filename_parentat(int dfd, struct filename *name,
2510 unsigned int flags, struct path *parent,
2511 struct qstr *last, int *type)
2512{
2513 int retval;
2514 struct nameidata nd;
2515
2516 if (IS_ERR(name))
2517 return PTR_ERR(name);
2518 set_nameidata(&nd, dfd, name, NULL);
2519 retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
2520 if (unlikely(retval == -ECHILD))
2521 retval = path_parentat(&nd, flags, parent);
2522 if (unlikely(retval == -ESTALE))
2523 retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
2524 if (likely(!retval)) {
2525 *last = nd.last;
2526 *type = nd.last_type;
2527 audit_inode(name, parent->dentry, AUDIT_INODE_PARENT);
2528 }
2529 restore_nameidata();
2530 return retval;
2531}
2532
2533
2534static struct dentry *__kern_path_locked(struct filename *name, struct path *path)
2535{
2536 struct dentry *d;
2537 struct qstr last;
2538 int type, error;
2539
2540 error = filename_parentat(AT_FDCWD, name, 0, path, &last, &type);
2541 if (error)
2542 return ERR_PTR(error);
2543 if (unlikely(type != LAST_NORM)) {
2544 path_put(path);
2545 return ERR_PTR(-EINVAL);
2546 }
2547 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
2548 d = __lookup_hash(&last, path->dentry, 0);
2549 if (IS_ERR(d)) {
2550 inode_unlock(path->dentry->d_inode);
2551 path_put(path);
2552 }
2553 return d;
2554}
2555
2556struct dentry *kern_path_locked(const char *name, struct path *path)
2557{
2558 struct filename *filename = getname_kernel(name);
2559 struct dentry *res = __kern_path_locked(filename, path);
2560
2561 putname(filename);
2562 return res;
2563}
2564
2565int kern_path(const char *name, unsigned int flags, struct path *path)
2566{
2567 struct filename *filename = getname_kernel(name);
2568 int ret = filename_lookup(AT_FDCWD, filename, flags, path, NULL);
2569
2570 putname(filename);
2571 return ret;
2572
2573}
2574EXPORT_SYMBOL(kern_path);
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
2585 const char *name, unsigned int flags,
2586 struct path *path)
2587{
2588 struct filename *filename;
2589 struct path root = {.mnt = mnt, .dentry = dentry};
2590 int ret;
2591
2592 filename = getname_kernel(name);
2593
2594 ret = filename_lookup(AT_FDCWD, filename, flags, path, &root);
2595 putname(filename);
2596 return ret;
2597}
2598EXPORT_SYMBOL(vfs_path_lookup);
2599
2600static int lookup_one_common(struct user_namespace *mnt_userns,
2601 const char *name, struct dentry *base, int len,
2602 struct qstr *this)
2603{
2604 this->name = name;
2605 this->len = len;
2606 this->hash = full_name_hash(base, name, len);
2607 if (!len)
2608 return -EACCES;
2609
2610 if (unlikely(name[0] == '.')) {
2611 if (len < 2 || (len == 2 && name[1] == '.'))
2612 return -EACCES;
2613 }
2614
2615 while (len--) {
2616 unsigned int c = *(const unsigned char *)name++;
2617 if (c == '/' || c == '\0')
2618 return -EACCES;
2619 }
2620
2621
2622
2623
2624 if (base->d_flags & DCACHE_OP_HASH) {
2625 int err = base->d_op->d_hash(base, this);
2626 if (err < 0)
2627 return err;
2628 }
2629
2630 return inode_permission(mnt_userns, base->d_inode, MAY_EXEC);
2631}
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647struct dentry *try_lookup_one_len(const char *name, struct dentry *base, int len)
2648{
2649 struct qstr this;
2650 int err;
2651
2652 WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2653
2654 err = lookup_one_common(&init_user_ns, name, base, len, &this);
2655 if (err)
2656 return ERR_PTR(err);
2657
2658 return lookup_dcache(&this, base, 0);
2659}
2660EXPORT_SYMBOL(try_lookup_one_len);
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
2674{
2675 struct dentry *dentry;
2676 struct qstr this;
2677 int err;
2678
2679 WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2680
2681 err = lookup_one_common(&init_user_ns, name, base, len, &this);
2682 if (err)
2683 return ERR_PTR(err);
2684
2685 dentry = lookup_dcache(&this, base, 0);
2686 return dentry ? dentry : __lookup_slow(&this, base, 0);
2687}
2688EXPORT_SYMBOL(lookup_one_len);
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702struct dentry *lookup_one(struct user_namespace *mnt_userns, const char *name,
2703 struct dentry *base, int len)
2704{
2705 struct dentry *dentry;
2706 struct qstr this;
2707 int err;
2708
2709 WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2710
2711 err = lookup_one_common(mnt_userns, name, base, len, &this);
2712 if (err)
2713 return ERR_PTR(err);
2714
2715 dentry = lookup_dcache(&this, base, 0);
2716 return dentry ? dentry : __lookup_slow(&this, base, 0);
2717}
2718EXPORT_SYMBOL(lookup_one);
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732struct dentry *lookup_one_len_unlocked(const char *name,
2733 struct dentry *base, int len)
2734{
2735 struct qstr this;
2736 int err;
2737 struct dentry *ret;
2738
2739 err = lookup_one_common(&init_user_ns, name, base, len, &this);
2740 if (err)
2741 return ERR_PTR(err);
2742
2743 ret = lookup_dcache(&this, base, 0);
2744 if (!ret)
2745 ret = lookup_slow(&this, base, 0);
2746 return ret;
2747}
2748EXPORT_SYMBOL(lookup_one_len_unlocked);
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758struct dentry *lookup_positive_unlocked(const char *name,
2759 struct dentry *base, int len)
2760{
2761 struct dentry *ret = lookup_one_len_unlocked(name, base, len);
2762 if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) {
2763 dput(ret);
2764 ret = ERR_PTR(-ENOENT);
2765 }
2766 return ret;
2767}
2768EXPORT_SYMBOL(lookup_positive_unlocked);
2769
2770#ifdef CONFIG_UNIX98_PTYS
2771int path_pts(struct path *path)
2772{
2773
2774
2775
2776 struct dentry *parent = dget_parent(path->dentry);
2777 struct dentry *child;
2778 struct qstr this = QSTR_INIT("pts", 3);
2779
2780 if (unlikely(!path_connected(path->mnt, parent))) {
2781 dput(parent);
2782 return -ENOENT;
2783 }
2784 dput(path->dentry);
2785 path->dentry = parent;
2786 child = d_hash_and_lookup(parent, &this);
2787 if (!child)
2788 return -ENOENT;
2789
2790 path->dentry = child;
2791 dput(parent);
2792 follow_down(path);
2793 return 0;
2794}
2795#endif
2796
2797int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
2798 struct path *path, int *empty)
2799{
2800 struct filename *filename = getname_flags(name, flags, empty);
2801 int ret = filename_lookup(dfd, filename, flags, path, NULL);
2802
2803 putname(filename);
2804 return ret;
2805}
2806EXPORT_SYMBOL(user_path_at_empty);
2807
2808int __check_sticky(struct user_namespace *mnt_userns, struct inode *dir,
2809 struct inode *inode)
2810{
2811 kuid_t fsuid = current_fsuid();
2812
2813 if (uid_eq(i_uid_into_mnt(mnt_userns, inode), fsuid))
2814 return 0;
2815 if (uid_eq(i_uid_into_mnt(mnt_userns, dir), fsuid))
2816 return 0;
2817 return !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FOWNER);
2818}
2819EXPORT_SYMBOL(__check_sticky);
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841static int may_delete(struct user_namespace *mnt_userns, struct inode *dir,
2842 struct dentry *victim, bool isdir)
2843{
2844 struct inode *inode = d_backing_inode(victim);
2845 int error;
2846
2847 if (d_is_negative(victim))
2848 return -ENOENT;
2849 BUG_ON(!inode);
2850
2851 BUG_ON(victim->d_parent->d_inode != dir);
2852
2853
2854 if (!uid_valid(i_uid_into_mnt(mnt_userns, inode)) ||
2855 !gid_valid(i_gid_into_mnt(mnt_userns, inode)))
2856 return -EOVERFLOW;
2857
2858 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2859
2860 error = inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC);
2861 if (error)
2862 return error;
2863 if (IS_APPEND(dir))
2864 return -EPERM;
2865
2866 if (check_sticky(mnt_userns, dir, inode) || IS_APPEND(inode) ||
2867 IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) ||
2868 HAS_UNMAPPED_ID(mnt_userns, inode))
2869 return -EPERM;
2870 if (isdir) {
2871 if (!d_is_dir(victim))
2872 return -ENOTDIR;
2873 if (IS_ROOT(victim))
2874 return -EBUSY;
2875 } else if (d_is_dir(victim))
2876 return -EISDIR;
2877 if (IS_DEADDIR(dir))
2878 return -ENOENT;
2879 if (victim->d_flags & DCACHE_NFSFS_RENAMED)
2880 return -EBUSY;
2881 return 0;
2882}
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893static inline int may_create(struct user_namespace *mnt_userns,
2894 struct inode *dir, struct dentry *child)
2895{
2896 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
2897 if (child->d_inode)
2898 return -EEXIST;
2899 if (IS_DEADDIR(dir))
2900 return -ENOENT;
2901 if (!fsuidgid_has_mapping(dir->i_sb, mnt_userns))
2902 return -EOVERFLOW;
2903
2904 return inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC);
2905}
2906
2907
2908
2909
2910struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
2911{
2912 struct dentry *p;
2913
2914 if (p1 == p2) {
2915 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2916 return NULL;
2917 }
2918
2919 mutex_lock(&p1->d_sb->s_vfs_rename_mutex);
2920
2921 p = d_ancestor(p2, p1);
2922 if (p) {
2923 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
2924 inode_lock_nested(p1->d_inode, I_MUTEX_CHILD);
2925 return p;
2926 }
2927
2928 p = d_ancestor(p1, p2);
2929 if (p) {
2930 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2931 inode_lock_nested(p2->d_inode, I_MUTEX_CHILD);
2932 return p;
2933 }
2934
2935 inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2936 inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
2937 return NULL;
2938}
2939EXPORT_SYMBOL(lock_rename);
2940
2941void unlock_rename(struct dentry *p1, struct dentry *p2)
2942{
2943 inode_unlock(p1->d_inode);
2944 if (p1 != p2) {
2945 inode_unlock(p2->d_inode);
2946 mutex_unlock(&p1->d_sb->s_vfs_rename_mutex);
2947 }
2948}
2949EXPORT_SYMBOL(unlock_rename);
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961
2962
2963
2964
2965
2966
2967int vfs_create(struct user_namespace *mnt_userns, struct inode *dir,
2968 struct dentry *dentry, umode_t mode, bool want_excl)
2969{
2970 int error = may_create(mnt_userns, dir, dentry);
2971 if (error)
2972 return error;
2973
2974 if (!dir->i_op->create)
2975 return -EACCES;
2976 mode &= S_IALLUGO;
2977 mode |= S_IFREG;
2978 error = security_inode_create(dir, dentry, mode);
2979 if (error)
2980 return error;
2981 error = dir->i_op->create(mnt_userns, dir, dentry, mode, want_excl);
2982 if (!error)
2983 fsnotify_create(dir, dentry);
2984 return error;
2985}
2986EXPORT_SYMBOL(vfs_create);
2987
2988int vfs_mkobj(struct dentry *dentry, umode_t mode,
2989 int (*f)(struct dentry *, umode_t, void *),
2990 void *arg)
2991{
2992 struct inode *dir = dentry->d_parent->d_inode;
2993 int error = may_create(&init_user_ns, dir, dentry);
2994 if (error)
2995 return error;
2996
2997 mode &= S_IALLUGO;
2998 mode |= S_IFREG;
2999 error = security_inode_create(dir, dentry, mode);
3000 if (error)
3001 return error;
3002 error = f(dentry, mode, arg);
3003 if (!error)
3004 fsnotify_create(dir, dentry);
3005 return error;
3006}
3007EXPORT_SYMBOL(vfs_mkobj);
3008
3009bool may_open_dev(const struct path *path)
3010{
3011 return !(path->mnt->mnt_flags & MNT_NODEV) &&
3012 !(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
3013}
3014
3015static int may_open(struct user_namespace *mnt_userns, const struct path *path,
3016 int acc_mode, int flag)
3017{
3018 struct dentry *dentry = path->dentry;
3019 struct inode *inode = dentry->d_inode;
3020 int error;
3021
3022 if (!inode)
3023 return -ENOENT;
3024
3025 switch (inode->i_mode & S_IFMT) {
3026 case S_IFLNK:
3027 return -ELOOP;
3028 case S_IFDIR:
3029 if (acc_mode & MAY_WRITE)
3030 return -EISDIR;
3031 if (acc_mode & MAY_EXEC)
3032 return -EACCES;
3033 break;
3034 case S_IFBLK:
3035 case S_IFCHR:
3036 if (!may_open_dev(path))
3037 return -EACCES;
3038 fallthrough;
3039 case S_IFIFO:
3040 case S_IFSOCK:
3041 if (acc_mode & MAY_EXEC)
3042 return -EACCES;
3043 flag &= ~O_TRUNC;
3044 break;
3045 case S_IFREG:
3046 if ((acc_mode & MAY_EXEC) && path_noexec(path))
3047 return -EACCES;
3048 break;
3049 }
3050
3051 error = inode_permission(mnt_userns, inode, MAY_OPEN | acc_mode);
3052 if (error)
3053 return error;
3054
3055
3056
3057
3058 if (IS_APPEND(inode)) {
3059 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
3060 return -EPERM;
3061 if (flag & O_TRUNC)
3062 return -EPERM;
3063 }
3064
3065
3066 if (flag & O_NOATIME && !inode_owner_or_capable(mnt_userns, inode))
3067 return -EPERM;
3068
3069 return 0;
3070}
3071
3072static int handle_truncate(struct user_namespace *mnt_userns, struct file *filp)
3073{
3074 const struct path *path = &filp->f_path;
3075 struct inode *inode = path->dentry->d_inode;
3076 int error = get_write_access(inode);
3077 if (error)
3078 return error;
3079
3080
3081
3082 error = security_path_truncate(path);
3083 if (!error) {
3084 error = do_truncate(mnt_userns, path->dentry, 0,
3085 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
3086 filp);
3087 }
3088 put_write_access(inode);
3089 return error;
3090}
3091
3092static inline int open_to_namei_flags(int flag)
3093{
3094 if ((flag & O_ACCMODE) == 3)
3095 flag--;
3096 return flag;
3097}
3098
3099static int may_o_create(struct user_namespace *mnt_userns,
3100 const struct path *dir, struct dentry *dentry,
3101 umode_t mode)
3102{
3103 int error = security_path_mknod(dir, dentry, mode, 0);
3104 if (error)
3105 return error;
3106
3107 if (!fsuidgid_has_mapping(dir->dentry->d_sb, mnt_userns))
3108 return -EOVERFLOW;
3109
3110 error = inode_permission(mnt_userns, dir->dentry->d_inode,
3111 MAY_WRITE | MAY_EXEC);
3112 if (error)
3113 return error;
3114
3115 return security_inode_create(dir->dentry->d_inode, dentry, mode);
3116}
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131static struct dentry *atomic_open(struct nameidata *nd, struct dentry *dentry,
3132 struct file *file,
3133 int open_flag, umode_t mode)
3134{
3135 struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
3136 struct inode *dir = nd->path.dentry->d_inode;
3137 int error;
3138
3139 if (nd->flags & LOOKUP_DIRECTORY)
3140 open_flag |= O_DIRECTORY;
3141
3142 file->f_path.dentry = DENTRY_NOT_SET;
3143 file->f_path.mnt = nd->path.mnt;
3144 error = dir->i_op->atomic_open(dir, dentry, file,
3145 open_to_namei_flags(open_flag), mode);
3146 d_lookup_done(dentry);
3147 if (!error) {
3148 if (file->f_mode & FMODE_OPENED) {
3149 if (unlikely(dentry != file->f_path.dentry)) {
3150 dput(dentry);
3151 dentry = dget(file->f_path.dentry);
3152 }
3153 } else if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
3154 error = -EIO;
3155 } else {
3156 if (file->f_path.dentry) {
3157 dput(dentry);
3158 dentry = file->f_path.dentry;
3159 }
3160 if (unlikely(d_is_negative(dentry)))
3161 error = -ENOENT;
3162 }
3163 }
3164 if (error) {
3165 dput(dentry);
3166 dentry = ERR_PTR(error);
3167 }
3168 return dentry;
3169}
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182
3183
3184
3185
3186static struct dentry *lookup_open(struct nameidata *nd, struct file *file,
3187 const struct open_flags *op,
3188 bool got_write)
3189{
3190 struct user_namespace *mnt_userns;
3191 struct dentry *dir = nd->path.dentry;
3192 struct inode *dir_inode = dir->d_inode;
3193 int open_flag = op->open_flag;
3194 struct dentry *dentry;
3195 int error, create_error = 0;
3196 umode_t mode = op->mode;
3197 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
3198
3199 if (unlikely(IS_DEADDIR(dir_inode)))
3200 return ERR_PTR(-ENOENT);
3201
3202 file->f_mode &= ~FMODE_CREATED;
3203 dentry = d_lookup(dir, &nd->last);
3204 for (;;) {
3205 if (!dentry) {
3206 dentry = d_alloc_parallel(dir, &nd->last, &wq);
3207 if (IS_ERR(dentry))
3208 return dentry;
3209 }
3210 if (d_in_lookup(dentry))
3211 break;
3212
3213 error = d_revalidate(dentry, nd->flags);
3214 if (likely(error > 0))
3215 break;
3216 if (error)
3217 goto out_dput;
3218 d_invalidate(dentry);
3219 dput(dentry);
3220 dentry = NULL;
3221 }
3222 if (dentry->d_inode) {
3223
3224 return dentry;
3225 }
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236 if (unlikely(!got_write))
3237 open_flag &= ~O_TRUNC;
3238 mnt_userns = mnt_user_ns(nd->path.mnt);
3239 if (open_flag & O_CREAT) {
3240 if (open_flag & O_EXCL)
3241 open_flag &= ~O_TRUNC;
3242 if (!IS_POSIXACL(dir->d_inode))
3243 mode &= ~current_umask();
3244 if (likely(got_write))
3245 create_error = may_o_create(mnt_userns, &nd->path,
3246 dentry, mode);
3247 else
3248 create_error = -EROFS;
3249 }
3250 if (create_error)
3251 open_flag &= ~O_CREAT;
3252 if (dir_inode->i_op->atomic_open) {
3253 dentry = atomic_open(nd, dentry, file, open_flag, mode);
3254 if (unlikely(create_error) && dentry == ERR_PTR(-ENOENT))
3255 dentry = ERR_PTR(create_error);
3256 return dentry;
3257 }
3258
3259 if (d_in_lookup(dentry)) {
3260 struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry,
3261 nd->flags);
3262 d_lookup_done(dentry);
3263 if (unlikely(res)) {
3264 if (IS_ERR(res)) {
3265 error = PTR_ERR(res);
3266 goto out_dput;
3267 }
3268 dput(dentry);
3269 dentry = res;
3270 }
3271 }
3272
3273
3274 if (!dentry->d_inode && (open_flag & O_CREAT)) {
3275 file->f_mode |= FMODE_CREATED;
3276 audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
3277 if (!dir_inode->i_op->create) {
3278 error = -EACCES;
3279 goto out_dput;
3280 }
3281
3282 error = dir_inode->i_op->create(mnt_userns, dir_inode, dentry,
3283 mode, open_flag & O_EXCL);
3284 if (error)
3285 goto out_dput;
3286 }
3287 if (unlikely(create_error) && !dentry->d_inode) {
3288 error = create_error;
3289 goto out_dput;
3290 }
3291 return dentry;
3292
3293out_dput:
3294 dput(dentry);
3295 return ERR_PTR(error);
3296}
3297
3298static const char *open_last_lookups(struct nameidata *nd,
3299 struct file *file, const struct open_flags *op)
3300{
3301 struct dentry *dir = nd->path.dentry;
3302 int open_flag = op->open_flag;
3303 bool got_write = false;
3304 unsigned seq;
3305 struct inode *inode;
3306 struct dentry *dentry;
3307 const char *res;
3308
3309 nd->flags |= op->intent;
3310
3311 if (nd->last_type != LAST_NORM) {
3312 if (nd->depth)
3313 put_link(nd);
3314 return handle_dots(nd, nd->last_type);
3315 }
3316
3317 if (!(open_flag & O_CREAT)) {
3318 if (nd->last.name[nd->last.len])
3319 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
3320
3321 dentry = lookup_fast(nd, &inode, &seq);
3322 if (IS_ERR(dentry))
3323 return ERR_CAST(dentry);
3324 if (likely(dentry))
3325 goto finish_lookup;
3326
3327 BUG_ON(nd->flags & LOOKUP_RCU);
3328 } else {
3329
3330 if (nd->flags & LOOKUP_RCU) {
3331 if (!try_to_unlazy(nd))
3332 return ERR_PTR(-ECHILD);
3333 }
3334 audit_inode(nd->name, dir, AUDIT_INODE_PARENT);
3335
3336 if (unlikely(nd->last.name[nd->last.len]))
3337 return ERR_PTR(-EISDIR);
3338 }
3339
3340 if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
3341 got_write = !mnt_want_write(nd->path.mnt);
3342
3343
3344
3345
3346
3347 }
3348 if (open_flag & O_CREAT)
3349 inode_lock(dir->d_inode);
3350 else
3351 inode_lock_shared(dir->d_inode);
3352 dentry = lookup_open(nd, file, op, got_write);
3353 if (!IS_ERR(dentry) && (file->f_mode & FMODE_CREATED))
3354 fsnotify_create(dir->d_inode, dentry);
3355 if (open_flag & O_CREAT)
3356 inode_unlock(dir->d_inode);
3357 else
3358 inode_unlock_shared(dir->d_inode);
3359
3360 if (got_write)
3361 mnt_drop_write(nd->path.mnt);
3362
3363 if (IS_ERR(dentry))
3364 return ERR_CAST(dentry);
3365
3366 if (file->f_mode & (FMODE_OPENED | FMODE_CREATED)) {
3367 dput(nd->path.dentry);
3368 nd->path.dentry = dentry;
3369 return NULL;
3370 }
3371
3372finish_lookup:
3373 if (nd->depth)
3374 put_link(nd);
3375 res = step_into(nd, WALK_TRAILING, dentry, inode, seq);
3376 if (unlikely(res))
3377 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3378 return res;
3379}
3380
3381
3382
3383
3384static int do_open(struct nameidata *nd,
3385 struct file *file, const struct open_flags *op)
3386{
3387 struct user_namespace *mnt_userns;
3388 int open_flag = op->open_flag;
3389 bool do_truncate;
3390 int acc_mode;
3391 int error;
3392
3393 if (!(file->f_mode & (FMODE_OPENED | FMODE_CREATED))) {
3394 error = complete_walk(nd);
3395 if (error)
3396 return error;
3397 }
3398 if (!(file->f_mode & FMODE_CREATED))
3399 audit_inode(nd->name, nd->path.dentry, 0);
3400 mnt_userns = mnt_user_ns(nd->path.mnt);
3401 if (open_flag & O_CREAT) {
3402 if ((open_flag & O_EXCL) && !(file->f_mode & FMODE_CREATED))
3403 return -EEXIST;
3404 if (d_is_dir(nd->path.dentry))
3405 return -EISDIR;
3406 error = may_create_in_sticky(mnt_userns, nd,
3407 d_backing_inode(nd->path.dentry));
3408 if (unlikely(error))
3409 return error;
3410 }
3411 if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
3412 return -ENOTDIR;
3413
3414 do_truncate = false;
3415 acc_mode = op->acc_mode;
3416 if (file->f_mode & FMODE_CREATED) {
3417
3418 open_flag &= ~O_TRUNC;
3419 acc_mode = 0;
3420 } else if (d_is_reg(nd->path.dentry) && open_flag & O_TRUNC) {
3421 error = mnt_want_write(nd->path.mnt);
3422 if (error)
3423 return error;
3424 do_truncate = true;
3425 }
3426 error = may_open(mnt_userns, &nd->path, acc_mode, open_flag);
3427 if (!error && !(file->f_mode & FMODE_OPENED))
3428 error = vfs_open(&nd->path, file);
3429 if (!error)
3430 error = ima_file_check(file, op->acc_mode);
3431 if (!error && do_truncate)
3432 error = handle_truncate(mnt_userns, file);
3433 if (unlikely(error > 0)) {
3434 WARN_ON(1);
3435 error = -EINVAL;
3436 }
3437 if (do_truncate)
3438 mnt_drop_write(nd->path.mnt);
3439 return error;
3440}
3441
3442
3443
3444
3445
3446
3447
3448
3449
3450
3451
3452
3453
3454
3455
3456
3457struct dentry *vfs_tmpfile(struct user_namespace *mnt_userns,
3458 struct dentry *dentry, umode_t mode, int open_flag)
3459{
3460 struct dentry *child = NULL;
3461 struct inode *dir = dentry->d_inode;
3462 struct inode *inode;
3463 int error;
3464
3465
3466 error = inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC);
3467 if (error)
3468 goto out_err;
3469 error = -EOPNOTSUPP;
3470 if (!dir->i_op->tmpfile)
3471 goto out_err;
3472 error = -ENOMEM;
3473 child = d_alloc(dentry, &slash_name);
3474 if (unlikely(!child))
3475 goto out_err;
3476 error = dir->i_op->tmpfile(mnt_userns, dir, child, mode);
3477 if (error)
3478 goto out_err;
3479 error = -ENOENT;
3480 inode = child->d_inode;
3481 if (unlikely(!inode))
3482 goto out_err;
3483 if (!(open_flag & O_EXCL)) {
3484 spin_lock(&inode->i_lock);
3485 inode->i_state |= I_LINKABLE;
3486 spin_unlock(&inode->i_lock);
3487 }
3488 ima_post_create_tmpfile(mnt_userns, inode);
3489 return child;
3490
3491out_err:
3492 dput(child);
3493 return ERR_PTR(error);
3494}
3495EXPORT_SYMBOL(vfs_tmpfile);
3496
3497static int do_tmpfile(struct nameidata *nd, unsigned flags,
3498 const struct open_flags *op,
3499 struct file *file)
3500{
3501 struct user_namespace *mnt_userns;
3502 struct dentry *child;
3503 struct path path;
3504 int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
3505 if (unlikely(error))
3506 return error;
3507 error = mnt_want_write(path.mnt);
3508 if (unlikely(error))
3509 goto out;
3510 mnt_userns = mnt_user_ns(path.mnt);
3511 child = vfs_tmpfile(mnt_userns, path.dentry, op->mode, op->open_flag);
3512 error = PTR_ERR(child);
3513 if (IS_ERR(child))
3514 goto out2;
3515 dput(path.dentry);
3516 path.dentry = child;
3517 audit_inode(nd->name, child, 0);
3518
3519 error = may_open(mnt_userns, &path, 0, op->open_flag);
3520 if (!error)
3521 error = vfs_open(&path, file);
3522out2:
3523 mnt_drop_write(path.mnt);
3524out:
3525 path_put(&path);
3526 return error;
3527}
3528
3529static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file)
3530{
3531 struct path path;
3532 int error = path_lookupat(nd, flags, &path);
3533 if (!error) {
3534 audit_inode(nd->name, path.dentry, 0);
3535 error = vfs_open(&path, file);
3536 path_put(&path);
3537 }
3538 return error;
3539}
3540
3541static struct file *path_openat(struct nameidata *nd,
3542 const struct open_flags *op, unsigned flags)
3543{
3544 struct file *file;
3545 int error;
3546
3547 file = alloc_empty_file(op->open_flag, current_cred());
3548 if (IS_ERR(file))
3549 return file;
3550
3551 if (unlikely(file->f_flags & __O_TMPFILE)) {
3552 error = do_tmpfile(nd, flags, op, file);
3553 } else if (unlikely(file->f_flags & O_PATH)) {
3554 error = do_o_path(nd, flags, file);
3555 } else {
3556 const char *s = path_init(nd, flags);
3557 while (!(error = link_path_walk(s, nd)) &&
3558 (s = open_last_lookups(nd, file, op)) != NULL)
3559 ;
3560 if (!error)
3561 error = do_open(nd, file, op);
3562 terminate_walk(nd);
3563 }
3564 if (likely(!error)) {
3565 if (likely(file->f_mode & FMODE_OPENED))
3566 return file;
3567 WARN_ON(1);
3568 error = -EINVAL;
3569 }
3570 fput(file);
3571 if (error == -EOPENSTALE) {
3572 if (flags & LOOKUP_RCU)
3573 error = -ECHILD;
3574 else
3575 error = -ESTALE;
3576 }
3577 return ERR_PTR(error);
3578}
3579
3580struct file *do_filp_open(int dfd, struct filename *pathname,
3581 const struct open_flags *op)
3582{
3583 struct nameidata nd;
3584 int flags = op->lookup_flags;
3585 struct file *filp;
3586
3587 set_nameidata(&nd, dfd, pathname, NULL);
3588 filp = path_openat(&nd, op, flags | LOOKUP_RCU);
3589 if (unlikely(filp == ERR_PTR(-ECHILD)))
3590 filp = path_openat(&nd, op, flags);
3591 if (unlikely(filp == ERR_PTR(-ESTALE)))
3592 filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
3593 restore_nameidata();
3594 return filp;
3595}
3596
3597struct file *do_file_open_root(const struct path *root,
3598 const char *name, const struct open_flags *op)
3599{
3600 struct nameidata nd;
3601 struct file *file;
3602 struct filename *filename;
3603 int flags = op->lookup_flags;
3604
3605 if (d_is_symlink(root->dentry) && op->intent & LOOKUP_OPEN)
3606 return ERR_PTR(-ELOOP);
3607
3608 filename = getname_kernel(name);
3609 if (IS_ERR(filename))
3610 return ERR_CAST(filename);
3611
3612 set_nameidata(&nd, -1, filename, root);
3613 file = path_openat(&nd, op, flags | LOOKUP_RCU);
3614 if (unlikely(file == ERR_PTR(-ECHILD)))
3615 file = path_openat(&nd, op, flags);
3616 if (unlikely(file == ERR_PTR(-ESTALE)))
3617 file = path_openat(&nd, op, flags | LOOKUP_REVAL);
3618 restore_nameidata();
3619 putname(filename);
3620 return file;
3621}
3622
3623static struct dentry *filename_create(int dfd, struct filename *name,
3624 struct path *path, unsigned int lookup_flags)
3625{
3626 struct dentry *dentry = ERR_PTR(-EEXIST);
3627 struct qstr last;
3628 int type;
3629 int err2;
3630 int error;
3631 bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);
3632
3633
3634
3635
3636
3637 lookup_flags &= LOOKUP_REVAL;
3638
3639 error = filename_parentat(dfd, name, lookup_flags, path, &last, &type);
3640 if (error)
3641 return ERR_PTR(error);
3642
3643
3644
3645
3646
3647 if (unlikely(type != LAST_NORM))
3648 goto out;
3649
3650
3651 err2 = mnt_want_write(path->mnt);
3652
3653
3654
3655 lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL;
3656 inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
3657 dentry = __lookup_hash(&last, path->dentry, lookup_flags);
3658 if (IS_ERR(dentry))
3659 goto unlock;
3660
3661 error = -EEXIST;
3662 if (d_is_positive(dentry))
3663 goto fail;
3664
3665
3666
3667
3668
3669
3670
3671 if (unlikely(!is_dir && last.name[last.len])) {
3672 error = -ENOENT;
3673 goto fail;
3674 }
3675 if (unlikely(err2)) {
3676 error = err2;
3677 goto fail;
3678 }
3679 return dentry;
3680fail:
3681 dput(dentry);
3682 dentry = ERR_PTR(error);
3683unlock:
3684 inode_unlock(path->dentry->d_inode);
3685 if (!err2)
3686 mnt_drop_write(path->mnt);
3687out:
3688 path_put(path);
3689 return dentry;
3690}
3691
3692struct dentry *kern_path_create(int dfd, const char *pathname,
3693 struct path *path, unsigned int lookup_flags)
3694{
3695 struct filename *filename = getname_kernel(pathname);
3696 struct dentry *res = filename_create(dfd, filename, path, lookup_flags);
3697
3698 putname(filename);
3699 return res;
3700}
3701EXPORT_SYMBOL(kern_path_create);
3702
3703void done_path_create(struct path *path, struct dentry *dentry)
3704{
3705 dput(dentry);
3706 inode_unlock(path->dentry->d_inode);
3707 mnt_drop_write(path->mnt);
3708 path_put(path);
3709}
3710EXPORT_SYMBOL(done_path_create);
3711
3712inline struct dentry *user_path_create(int dfd, const char __user *pathname,
3713 struct path *path, unsigned int lookup_flags)
3714{
3715 struct filename *filename = getname(pathname);
3716 struct dentry *res = filename_create(dfd, filename, path, lookup_flags);
3717
3718 putname(filename);
3719 return res;
3720}
3721EXPORT_SYMBOL(user_path_create);
3722
3723
3724
3725
3726
3727
3728
3729
3730
3731
3732
3733
3734
3735
3736
3737
3738
3739int vfs_mknod(struct user_namespace *mnt_userns, struct inode *dir,
3740 struct dentry *dentry, umode_t mode, dev_t dev)
3741{
3742 bool is_whiteout = S_ISCHR(mode) && dev == WHITEOUT_DEV;
3743 int error = may_create(mnt_userns, dir, dentry);
3744
3745 if (error)
3746 return error;
3747
3748 if ((S_ISCHR(mode) || S_ISBLK(mode)) && !is_whiteout &&
3749 !capable(CAP_MKNOD))
3750 return -EPERM;
3751
3752 if (!dir->i_op->mknod)
3753 return -EPERM;
3754
3755 error = devcgroup_inode_mknod(mode, dev);
3756 if (error)
3757 return error;
3758
3759 error = security_inode_mknod(dir, dentry, mode, dev);
3760 if (error)
3761 return error;
3762
3763 error = dir->i_op->mknod(mnt_userns, dir, dentry, mode, dev);
3764 if (!error)
3765 fsnotify_create(dir, dentry);
3766 return error;
3767}
3768EXPORT_SYMBOL(vfs_mknod);
3769
3770static int may_mknod(umode_t mode)
3771{
3772 switch (mode & S_IFMT) {
3773 case S_IFREG:
3774 case S_IFCHR:
3775 case S_IFBLK:
3776 case S_IFIFO:
3777 case S_IFSOCK:
3778 case 0:
3779 return 0;
3780 case S_IFDIR:
3781 return -EPERM;
3782 default:
3783 return -EINVAL;
3784 }
3785}
3786
3787static int do_mknodat(int dfd, struct filename *name, umode_t mode,
3788 unsigned int dev)
3789{
3790 struct user_namespace *mnt_userns;
3791 struct dentry *dentry;
3792 struct path path;
3793 int error;
3794 unsigned int lookup_flags = 0;
3795
3796 error = may_mknod(mode);
3797 if (error)
3798 goto out1;
3799retry:
3800 dentry = filename_create(dfd, name, &path, lookup_flags);
3801 error = PTR_ERR(dentry);
3802 if (IS_ERR(dentry))
3803 goto out1;
3804
3805 if (!IS_POSIXACL(path.dentry->d_inode))
3806 mode &= ~current_umask();
3807 error = security_path_mknod(&path, dentry, mode, dev);
3808 if (error)
3809 goto out2;
3810
3811 mnt_userns = mnt_user_ns(path.mnt);
3812 switch (mode & S_IFMT) {
3813 case 0: case S_IFREG:
3814 error = vfs_create(mnt_userns, path.dentry->d_inode,
3815 dentry, mode, true);
3816 if (!error)
3817 ima_post_path_mknod(mnt_userns, dentry);
3818 break;
3819 case S_IFCHR: case S_IFBLK:
3820 error = vfs_mknod(mnt_userns, path.dentry->d_inode,
3821 dentry, mode, new_decode_dev(dev));
3822 break;
3823 case S_IFIFO: case S_IFSOCK:
3824 error = vfs_mknod(mnt_userns, path.dentry->d_inode,
3825 dentry, mode, 0);
3826 break;
3827 }
3828out2:
3829 done_path_create(&path, dentry);
3830 if (retry_estale(error, lookup_flags)) {
3831 lookup_flags |= LOOKUP_REVAL;
3832 goto retry;
3833 }
3834out1:
3835 putname(name);
3836 return error;
3837}
3838
3839SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
3840 unsigned int, dev)
3841{
3842 return do_mknodat(dfd, getname(filename), mode, dev);
3843}
3844
3845SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3846{
3847 return do_mknodat(AT_FDCWD, getname(filename), mode, dev);
3848}
3849
3850
3851
3852
3853
3854
3855
3856
3857
3858
3859
3860
3861
3862
3863
3864
3865int vfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir,
3866 struct dentry *dentry, umode_t mode)
3867{
3868 int error = may_create(mnt_userns, dir, dentry);
3869 unsigned max_links = dir->i_sb->s_max_links;
3870
3871 if (error)
3872 return error;
3873
3874 if (!dir->i_op->mkdir)
3875 return -EPERM;
3876
3877 mode &= (S_IRWXUGO|S_ISVTX);
3878 error = security_inode_mkdir(dir, dentry, mode);
3879 if (error)
3880 return error;
3881
3882 if (max_links && dir->i_nlink >= max_links)
3883 return -EMLINK;
3884
3885 error = dir->i_op->mkdir(mnt_userns, dir, dentry, mode);
3886 if (!error)
3887 fsnotify_mkdir(dir, dentry);
3888 return error;
3889}
3890EXPORT_SYMBOL(vfs_mkdir);
3891
3892int do_mkdirat(int dfd, struct filename *name, umode_t mode)
3893{
3894 struct dentry *dentry;
3895 struct path path;
3896 int error;
3897 unsigned int lookup_flags = LOOKUP_DIRECTORY;
3898
3899retry:
3900 dentry = filename_create(dfd, name, &path, lookup_flags);
3901 error = PTR_ERR(dentry);
3902 if (IS_ERR(dentry))
3903 goto out_putname;
3904
3905 if (!IS_POSIXACL(path.dentry->d_inode))
3906 mode &= ~current_umask();
3907 error = security_path_mkdir(&path, dentry, mode);
3908 if (!error) {
3909 struct user_namespace *mnt_userns;
3910 mnt_userns = mnt_user_ns(path.mnt);
3911 error = vfs_mkdir(mnt_userns, path.dentry->d_inode, dentry,
3912 mode);
3913 }
3914 done_path_create(&path, dentry);
3915 if (retry_estale(error, lookup_flags)) {
3916 lookup_flags |= LOOKUP_REVAL;
3917 goto retry;
3918 }
3919out_putname:
3920 putname(name);
3921 return error;
3922}
3923
3924SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
3925{
3926 return do_mkdirat(dfd, getname(pathname), mode);
3927}
3928
3929SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
3930{
3931 return do_mkdirat(AT_FDCWD, getname(pathname), mode);
3932}
3933
3934
3935
3936
3937
3938
3939
3940
3941
3942
3943
3944
3945
3946
3947
3948int vfs_rmdir(struct user_namespace *mnt_userns, struct inode *dir,
3949 struct dentry *dentry)
3950{
3951 int error = may_delete(mnt_userns, dir, dentry, 1);
3952
3953 if (error)
3954 return error;
3955
3956 if (!dir->i_op->rmdir)
3957 return -EPERM;
3958
3959 dget(dentry);
3960 inode_lock(dentry->d_inode);
3961
3962 error = -EBUSY;
3963 if (is_local_mountpoint(dentry))
3964 goto out;
3965
3966 error = security_inode_rmdir(dir, dentry);
3967 if (error)
3968 goto out;
3969
3970 error = dir->i_op->rmdir(dir, dentry);
3971 if (error)
3972 goto out;
3973
3974 shrink_dcache_parent(dentry);
3975 dentry->d_inode->i_flags |= S_DEAD;
3976 dont_mount(dentry);
3977 detach_mounts(dentry);
3978 fsnotify_rmdir(dir, dentry);
3979
3980out:
3981 inode_unlock(dentry->d_inode);
3982 dput(dentry);
3983 if (!error)
3984 d_delete(dentry);
3985 return error;
3986}
3987EXPORT_SYMBOL(vfs_rmdir);
3988
3989int do_rmdir(int dfd, struct filename *name)
3990{
3991 struct user_namespace *mnt_userns;
3992 int error;
3993 struct dentry *dentry;
3994 struct path path;
3995 struct qstr last;
3996 int type;
3997 unsigned int lookup_flags = 0;
3998retry:
3999 error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4000 if (error)
4001 goto exit1;
4002
4003 switch (type) {
4004 case LAST_DOTDOT:
4005 error = -ENOTEMPTY;
4006 goto exit2;
4007 case LAST_DOT:
4008 error = -EINVAL;
4009 goto exit2;
4010 case LAST_ROOT:
4011 error = -EBUSY;
4012 goto exit2;
4013 }
4014
4015 error = mnt_want_write(path.mnt);
4016 if (error)
4017 goto exit2;
4018
4019 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4020 dentry = __lookup_hash(&last, path.dentry, lookup_flags);
4021 error = PTR_ERR(dentry);
4022 if (IS_ERR(dentry))
4023 goto exit3;
4024 if (!dentry->d_inode) {
4025 error = -ENOENT;
4026 goto exit4;
4027 }
4028 error = security_path_rmdir(&path, dentry);
4029 if (error)
4030 goto exit4;
4031 mnt_userns = mnt_user_ns(path.mnt);
4032 error = vfs_rmdir(mnt_userns, path.dentry->d_inode, dentry);
4033exit4:
4034 dput(dentry);
4035exit3:
4036 inode_unlock(path.dentry->d_inode);
4037 mnt_drop_write(path.mnt);
4038exit2:
4039 path_put(&path);
4040 if (retry_estale(error, lookup_flags)) {
4041 lookup_flags |= LOOKUP_REVAL;
4042 goto retry;
4043 }
4044exit1:
4045 putname(name);
4046 return error;
4047}
4048
4049SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
4050{
4051 return do_rmdir(AT_FDCWD, getname(pathname));
4052}
4053
4054
4055
4056
4057
4058
4059
4060
4061
4062
4063
4064
4065
4066
4067
4068
4069
4070
4071
4072
4073
4074
4075
4076
4077
4078
4079int vfs_unlink(struct user_namespace *mnt_userns, struct inode *dir,
4080 struct dentry *dentry, struct inode **delegated_inode)
4081{
4082 struct inode *target = dentry->d_inode;
4083 int error = may_delete(mnt_userns, dir, dentry, 0);
4084
4085 if (error)
4086 return error;
4087
4088 if (!dir->i_op->unlink)
4089 return -EPERM;
4090
4091 inode_lock(target);
4092 if (IS_SWAPFILE(target))
4093 error = -EPERM;
4094 else if (is_local_mountpoint(dentry))
4095 error = -EBUSY;
4096 else {
4097 error = security_inode_unlink(dir, dentry);
4098 if (!error) {
4099 error = try_break_deleg(target, delegated_inode);
4100 if (error)
4101 goto out;
4102 error = dir->i_op->unlink(dir, dentry);
4103 if (!error) {
4104 dont_mount(dentry);
4105 detach_mounts(dentry);
4106 fsnotify_unlink(dir, dentry);
4107 }
4108 }
4109 }
4110out:
4111 inode_unlock(target);
4112
4113
4114 if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
4115 fsnotify_link_count(target);
4116 d_delete(dentry);
4117 }
4118
4119 return error;
4120}
4121EXPORT_SYMBOL(vfs_unlink);
4122
4123
4124
4125
4126
4127
4128
4129int do_unlinkat(int dfd, struct filename *name)
4130{
4131 int error;
4132 struct dentry *dentry;
4133 struct path path;
4134 struct qstr last;
4135 int type;
4136 struct inode *inode = NULL;
4137 struct inode *delegated_inode = NULL;
4138 unsigned int lookup_flags = 0;
4139retry:
4140 error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4141 if (error)
4142 goto exit1;
4143
4144 error = -EISDIR;
4145 if (type != LAST_NORM)
4146 goto exit2;
4147
4148 error = mnt_want_write(path.mnt);
4149 if (error)
4150 goto exit2;
4151retry_deleg:
4152 inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4153 dentry = __lookup_hash(&last, path.dentry, lookup_flags);
4154 error = PTR_ERR(dentry);
4155 if (!IS_ERR(dentry)) {
4156 struct user_namespace *mnt_userns;
4157
4158
4159 if (last.name[last.len])
4160 goto slashes;
4161 inode = dentry->d_inode;
4162 if (d_is_negative(dentry))
4163 goto slashes;
4164 ihold(inode);
4165 error = security_path_unlink(&path, dentry);
4166 if (error)
4167 goto exit3;
4168 mnt_userns = mnt_user_ns(path.mnt);
4169 error = vfs_unlink(mnt_userns, path.dentry->d_inode, dentry,
4170 &delegated_inode);
4171exit3:
4172 dput(dentry);
4173 }
4174 inode_unlock(path.dentry->d_inode);
4175 if (inode)
4176 iput(inode);
4177 inode = NULL;
4178 if (delegated_inode) {
4179 error = break_deleg_wait(&delegated_inode);
4180 if (!error)
4181 goto retry_deleg;
4182 }
4183 mnt_drop_write(path.mnt);
4184exit2:
4185 path_put(&path);
4186 if (retry_estale(error, lookup_flags)) {
4187 lookup_flags |= LOOKUP_REVAL;
4188 inode = NULL;
4189 goto retry;
4190 }
4191exit1:
4192 putname(name);
4193 return error;
4194
4195slashes:
4196 if (d_is_negative(dentry))
4197 error = -ENOENT;
4198 else if (d_is_dir(dentry))
4199 error = -EISDIR;
4200 else
4201 error = -ENOTDIR;
4202 goto exit3;
4203}
4204
4205SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
4206{
4207 if ((flag & ~AT_REMOVEDIR) != 0)
4208 return -EINVAL;
4209
4210 if (flag & AT_REMOVEDIR)
4211 return do_rmdir(dfd, getname(pathname));
4212 return do_unlinkat(dfd, getname(pathname));
4213}
4214
4215SYSCALL_DEFINE1(unlink, const char __user *, pathname)
4216{
4217 return do_unlinkat(AT_FDCWD, getname(pathname));
4218}
4219
4220
4221
4222
4223
4224
4225
4226
4227
4228
4229
4230
4231
4232
4233
4234
4235int vfs_symlink(struct user_namespace *mnt_userns, struct inode *dir,
4236 struct dentry *dentry, const char *oldname)
4237{
4238 int error = may_create(mnt_userns, dir, dentry);
4239
4240 if (error)
4241 return error;
4242
4243 if (!dir->i_op->symlink)
4244 return -EPERM;
4245
4246 error = security_inode_symlink(dir, dentry, oldname);
4247 if (error)
4248 return error;
4249
4250 error = dir->i_op->symlink(mnt_userns, dir, dentry, oldname);
4251 if (!error)
4252 fsnotify_create(dir, dentry);
4253 return error;
4254}
4255EXPORT_SYMBOL(vfs_symlink);
4256
4257int do_symlinkat(struct filename *from, int newdfd, struct filename *to)
4258{
4259 int error;
4260 struct dentry *dentry;
4261 struct path path;
4262 unsigned int lookup_flags = 0;
4263
4264 if (IS_ERR(from)) {
4265 error = PTR_ERR(from);
4266 goto out_putnames;
4267 }
4268retry:
4269 dentry = filename_create(newdfd, to, &path, lookup_flags);
4270 error = PTR_ERR(dentry);
4271 if (IS_ERR(dentry))
4272 goto out_putnames;
4273
4274 error = security_path_symlink(&path, dentry, from->name);
4275 if (!error) {
4276 struct user_namespace *mnt_userns;
4277
4278 mnt_userns = mnt_user_ns(path.mnt);
4279 error = vfs_symlink(mnt_userns, path.dentry->d_inode, dentry,
4280 from->name);
4281 }
4282 done_path_create(&path, dentry);
4283 if (retry_estale(error, lookup_flags)) {
4284 lookup_flags |= LOOKUP_REVAL;
4285 goto retry;
4286 }
4287out_putnames:
4288 putname(to);
4289 putname(from);
4290 return error;
4291}
4292
4293SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
4294 int, newdfd, const char __user *, newname)
4295{
4296 return do_symlinkat(getname(oldname), newdfd, getname(newname));
4297}
4298
4299SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
4300{
4301 return do_symlinkat(getname(oldname), AT_FDCWD, getname(newname));
4302}
4303
4304
4305
4306
4307
4308
4309
4310
4311
4312
4313
4314
4315
4316
4317
4318
4319
4320
4321
4322
4323
4324
4325
4326
4327
4328
4329
4330int vfs_link(struct dentry *old_dentry, struct user_namespace *mnt_userns,
4331 struct inode *dir, struct dentry *new_dentry,
4332 struct inode **delegated_inode)
4333{
4334 struct inode *inode = old_dentry->d_inode;
4335 unsigned max_links = dir->i_sb->s_max_links;
4336 int error;
4337
4338 if (!inode)
4339 return -ENOENT;
4340
4341 error = may_create(mnt_userns, dir, new_dentry);
4342 if (error)
4343 return error;
4344
4345 if (dir->i_sb != inode->i_sb)
4346 return -EXDEV;
4347
4348
4349
4350
4351 if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
4352 return -EPERM;
4353
4354
4355
4356
4357
4358 if (HAS_UNMAPPED_ID(mnt_userns, inode))
4359 return -EPERM;
4360 if (!dir->i_op->link)
4361 return -EPERM;
4362 if (S_ISDIR(inode->i_mode))
4363 return -EPERM;
4364
4365 error = security_inode_link(old_dentry, dir, new_dentry);
4366 if (error)
4367 return error;
4368
4369 inode_lock(inode);
4370
4371 if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
4372 error = -ENOENT;
4373 else if (max_links && inode->i_nlink >= max_links)
4374 error = -EMLINK;
4375 else {
4376 error = try_break_deleg(inode, delegated_inode);
4377 if (!error)
4378 error = dir->i_op->link(old_dentry, dir, new_dentry);
4379 }
4380
4381 if (!error && (inode->i_state & I_LINKABLE)) {
4382 spin_lock(&inode->i_lock);
4383 inode->i_state &= ~I_LINKABLE;
4384 spin_unlock(&inode->i_lock);
4385 }
4386 inode_unlock(inode);
4387 if (!error)
4388 fsnotify_link(dir, inode, new_dentry);
4389 return error;
4390}
4391EXPORT_SYMBOL(vfs_link);
4392
4393
4394
4395
4396
4397
4398
4399
4400
4401
4402int do_linkat(int olddfd, struct filename *old, int newdfd,
4403 struct filename *new, int flags)
4404{
4405 struct user_namespace *mnt_userns;
4406 struct dentry *new_dentry;
4407 struct path old_path, new_path;
4408 struct inode *delegated_inode = NULL;
4409 int how = 0;
4410 int error;
4411
4412 if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) {
4413 error = -EINVAL;
4414 goto out_putnames;
4415 }
4416
4417
4418
4419
4420
4421 if (flags & AT_EMPTY_PATH && !capable(CAP_DAC_READ_SEARCH)) {
4422 error = -ENOENT;
4423 goto out_putnames;
4424 }
4425
4426 if (flags & AT_SYMLINK_FOLLOW)
4427 how |= LOOKUP_FOLLOW;
4428retry:
4429 error = filename_lookup(olddfd, old, how, &old_path, NULL);
4430 if (error)
4431 goto out_putnames;
4432
4433 new_dentry = filename_create(newdfd, new, &new_path,
4434 (how & LOOKUP_REVAL));
4435 error = PTR_ERR(new_dentry);
4436 if (IS_ERR(new_dentry))
4437 goto out_putpath;
4438
4439 error = -EXDEV;
4440 if (old_path.mnt != new_path.mnt)
4441 goto out_dput;
4442 mnt_userns = mnt_user_ns(new_path.mnt);
4443 error = may_linkat(mnt_userns, &old_path);
4444 if (unlikely(error))
4445 goto out_dput;
4446 error = security_path_link(old_path.dentry, &new_path, new_dentry);
4447 if (error)
4448 goto out_dput;
4449 error = vfs_link(old_path.dentry, mnt_userns, new_path.dentry->d_inode,
4450 new_dentry, &delegated_inode);
4451out_dput:
4452 done_path_create(&new_path, new_dentry);
4453 if (delegated_inode) {
4454 error = break_deleg_wait(&delegated_inode);
4455 if (!error) {
4456 path_put(&old_path);
4457 goto retry;
4458 }
4459 }
4460 if (retry_estale(error, how)) {
4461 path_put(&old_path);
4462 how |= LOOKUP_REVAL;
4463 goto retry;
4464 }
4465out_putpath:
4466 path_put(&old_path);
4467out_putnames:
4468 putname(old);
4469 putname(new);
4470
4471 return error;
4472}
4473
4474SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
4475 int, newdfd, const char __user *, newname, int, flags)
4476{
4477 return do_linkat(olddfd, getname_uflags(oldname, flags),
4478 newdfd, getname(newname), flags);
4479}
4480
4481SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
4482{
4483 return do_linkat(AT_FDCWD, getname(oldname), AT_FDCWD, getname(newname), 0);
4484}
4485
4486
4487
4488
4489
4490
4491
4492
4493
4494
4495
4496
4497
4498
4499
4500
4501
4502
4503
4504
4505
4506
4507
4508
4509
4510
4511
4512
4513
4514
4515
4516
4517
4518
4519
4520
4521
4522
4523
4524
4525
4526
4527
4528
4529
4530
4531int vfs_rename(struct renamedata *rd)
4532{
4533 int error;
4534 struct inode *old_dir = rd->old_dir, *new_dir = rd->new_dir;
4535 struct dentry *old_dentry = rd->old_dentry;
4536 struct dentry *new_dentry = rd->new_dentry;
4537 struct inode **delegated_inode = rd->delegated_inode;
4538 unsigned int flags = rd->flags;
4539 bool is_dir = d_is_dir(old_dentry);
4540 struct inode *source = old_dentry->d_inode;
4541 struct inode *target = new_dentry->d_inode;
4542 bool new_is_dir = false;
4543 unsigned max_links = new_dir->i_sb->s_max_links;
4544 struct name_snapshot old_name;
4545
4546 if (source == target)
4547 return 0;
4548
4549 error = may_delete(rd->old_mnt_userns, old_dir, old_dentry, is_dir);
4550 if (error)
4551 return error;
4552
4553 if (!target) {
4554 error = may_create(rd->new_mnt_userns, new_dir, new_dentry);
4555 } else {
4556 new_is_dir = d_is_dir(new_dentry);
4557
4558 if (!(flags & RENAME_EXCHANGE))
4559 error = may_delete(rd->new_mnt_userns, new_dir,
4560 new_dentry, is_dir);
4561 else
4562 error = may_delete(rd->new_mnt_userns, new_dir,
4563 new_dentry, new_is_dir);
4564 }
4565 if (error)
4566 return error;
4567
4568 if (!old_dir->i_op->rename)
4569 return -EPERM;
4570
4571
4572
4573
4574
4575 if (new_dir != old_dir) {
4576 if (is_dir) {
4577 error = inode_permission(rd->old_mnt_userns, source,
4578 MAY_WRITE);
4579 if (error)
4580 return error;
4581 }
4582 if ((flags & RENAME_EXCHANGE) && new_is_dir) {
4583 error = inode_permission(rd->new_mnt_userns, target,
4584 MAY_WRITE);
4585 if (error)
4586 return error;
4587 }
4588 }
4589
4590 error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
4591 flags);
4592 if (error)
4593 return error;
4594
4595 take_dentry_name_snapshot(&old_name, old_dentry);
4596 dget(new_dentry);
4597 if (!is_dir || (flags & RENAME_EXCHANGE))
4598 lock_two_nondirectories(source, target);
4599 else if (target)
4600 inode_lock(target);
4601
4602 error = -EPERM;
4603 if (IS_SWAPFILE(source) || (target && IS_SWAPFILE(target)))
4604 goto out;
4605
4606 error = -EBUSY;
4607 if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
4608 goto out;
4609
4610 if (max_links && new_dir != old_dir) {
4611 error = -EMLINK;
4612 if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
4613 goto out;
4614 if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
4615 old_dir->i_nlink >= max_links)
4616 goto out;
4617 }
4618 if (!is_dir) {
4619 error = try_break_deleg(source, delegated_inode);
4620 if (error)
4621 goto out;
4622 }
4623 if (target && !new_is_dir) {
4624 error = try_break_deleg(target, delegated_inode);
4625 if (error)
4626 goto out;
4627 }
4628 error = old_dir->i_op->rename(rd->new_mnt_userns, old_dir, old_dentry,
4629 new_dir, new_dentry, flags);
4630 if (error)
4631 goto out;
4632
4633 if (!(flags & RENAME_EXCHANGE) && target) {
4634 if (is_dir) {
4635 shrink_dcache_parent(new_dentry);
4636 target->i_flags |= S_DEAD;
4637 }
4638 dont_mount(new_dentry);
4639 detach_mounts(new_dentry);
4640 }
4641 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
4642 if (!(flags & RENAME_EXCHANGE))
4643 d_move(old_dentry, new_dentry);
4644 else
4645 d_exchange(old_dentry, new_dentry);
4646 }
4647out:
4648 if (!is_dir || (flags & RENAME_EXCHANGE))
4649 unlock_two_nondirectories(source, target);
4650 else if (target)
4651 inode_unlock(target);
4652 dput(new_dentry);
4653 if (!error) {
4654 fsnotify_move(old_dir, new_dir, &old_name.name, is_dir,
4655 !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
4656 if (flags & RENAME_EXCHANGE) {
4657 fsnotify_move(new_dir, old_dir, &old_dentry->d_name,
4658 new_is_dir, NULL, new_dentry);
4659 }
4660 }
4661 release_dentry_name_snapshot(&old_name);
4662
4663 return error;
4664}
4665EXPORT_SYMBOL(vfs_rename);
4666
4667int do_renameat2(int olddfd, struct filename *from, int newdfd,
4668 struct filename *to, unsigned int flags)
4669{
4670 struct renamedata rd;
4671 struct dentry *old_dentry, *new_dentry;
4672 struct dentry *trap;
4673 struct path old_path, new_path;
4674 struct qstr old_last, new_last;
4675 int old_type, new_type;
4676 struct inode *delegated_inode = NULL;
4677 unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
4678 bool should_retry = false;
4679 int error = -EINVAL;
4680
4681 if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
4682 goto put_names;
4683
4684 if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
4685 (flags & RENAME_EXCHANGE))
4686 goto put_names;
4687
4688 if (flags & RENAME_EXCHANGE)
4689 target_flags = 0;
4690
4691retry:
4692 error = filename_parentat(olddfd, from, lookup_flags, &old_path,
4693 &old_last, &old_type);
4694 if (error)
4695 goto put_names;
4696
4697 error = filename_parentat(newdfd, to, lookup_flags, &new_path, &new_last,
4698 &new_type);
4699 if (error)
4700 goto exit1;
4701
4702 error = -EXDEV;
4703 if (old_path.mnt != new_path.mnt)
4704 goto exit2;
4705
4706 error = -EBUSY;
4707 if (old_type != LAST_NORM)
4708 goto exit2;
4709
4710 if (flags & RENAME_NOREPLACE)
4711 error = -EEXIST;
4712 if (new_type != LAST_NORM)
4713 goto exit2;
4714
4715 error = mnt_want_write(old_path.mnt);
4716 if (error)
4717 goto exit2;
4718
4719retry_deleg:
4720 trap = lock_rename(new_path.dentry, old_path.dentry);
4721
4722 old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags);
4723 error = PTR_ERR(old_dentry);
4724 if (IS_ERR(old_dentry))
4725 goto exit3;
4726
4727 error = -ENOENT;
4728 if (d_is_negative(old_dentry))
4729 goto exit4;
4730 new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags);
4731 error = PTR_ERR(new_dentry);
4732 if (IS_ERR(new_dentry))
4733 goto exit4;
4734 error = -EEXIST;
4735 if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
4736 goto exit5;
4737 if (flags & RENAME_EXCHANGE) {
4738 error = -ENOENT;
4739 if (d_is_negative(new_dentry))
4740 goto exit5;
4741
4742 if (!d_is_dir(new_dentry)) {
4743 error = -ENOTDIR;
4744 if (new_last.name[new_last.len])
4745 goto exit5;
4746 }
4747 }
4748
4749 if (!d_is_dir(old_dentry)) {
4750 error = -ENOTDIR;
4751 if (old_last.name[old_last.len])
4752 goto exit5;
4753 if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
4754 goto exit5;
4755 }
4756
4757 error = -EINVAL;
4758 if (old_dentry == trap)
4759 goto exit5;
4760
4761 if (!(flags & RENAME_EXCHANGE))
4762 error = -ENOTEMPTY;
4763 if (new_dentry == trap)
4764 goto exit5;
4765
4766 error = security_path_rename(&old_path, old_dentry,
4767 &new_path, new_dentry, flags);
4768 if (error)
4769 goto exit5;
4770
4771 rd.old_dir = old_path.dentry->d_inode;
4772 rd.old_dentry = old_dentry;
4773 rd.old_mnt_userns = mnt_user_ns(old_path.mnt);
4774 rd.new_dir = new_path.dentry->d_inode;
4775 rd.new_dentry = new_dentry;
4776 rd.new_mnt_userns = mnt_user_ns(new_path.mnt);
4777 rd.delegated_inode = &delegated_inode;
4778 rd.flags = flags;
4779 error = vfs_rename(&rd);
4780exit5:
4781 dput(new_dentry);
4782exit4:
4783 dput(old_dentry);
4784exit3:
4785 unlock_rename(new_path.dentry, old_path.dentry);
4786 if (delegated_inode) {
4787 error = break_deleg_wait(&delegated_inode);
4788 if (!error)
4789 goto retry_deleg;
4790 }
4791 mnt_drop_write(old_path.mnt);
4792exit2:
4793 if (retry_estale(error, lookup_flags))
4794 should_retry = true;
4795 path_put(&new_path);
4796exit1:
4797 path_put(&old_path);
4798 if (should_retry) {
4799 should_retry = false;
4800 lookup_flags |= LOOKUP_REVAL;
4801 goto retry;
4802 }
4803put_names:
4804 putname(from);
4805 putname(to);
4806 return error;
4807}
4808
4809SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
4810 int, newdfd, const char __user *, newname, unsigned int, flags)
4811{
4812 return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname),
4813 flags);
4814}
4815
4816SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
4817 int, newdfd, const char __user *, newname)
4818{
4819 return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname),
4820 0);
4821}
4822
4823SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
4824{
4825 return do_renameat2(AT_FDCWD, getname(oldname), AT_FDCWD,
4826 getname(newname), 0);
4827}
4828
4829int readlink_copy(char __user *buffer, int buflen, const char *link)
4830{
4831 int len = PTR_ERR(link);
4832 if (IS_ERR(link))
4833 goto out;
4834
4835 len = strlen(link);
4836 if (len > (unsigned) buflen)
4837 len = buflen;
4838 if (copy_to_user(buffer, link, len))
4839 len = -EFAULT;
4840out:
4841 return len;
4842}
4843
4844
4845
4846
4847
4848
4849
4850
4851
4852
4853
4854int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4855{
4856 struct inode *inode = d_inode(dentry);
4857 DEFINE_DELAYED_CALL(done);
4858 const char *link;
4859 int res;
4860
4861 if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) {
4862 if (unlikely(inode->i_op->readlink))
4863 return inode->i_op->readlink(dentry, buffer, buflen);
4864
4865 if (!d_is_symlink(dentry))
4866 return -EINVAL;
4867
4868 spin_lock(&inode->i_lock);
4869 inode->i_opflags |= IOP_DEFAULT_READLINK;
4870 spin_unlock(&inode->i_lock);
4871 }
4872
4873 link = READ_ONCE(inode->i_link);
4874 if (!link) {
4875 link = inode->i_op->get_link(dentry, inode, &done);
4876 if (IS_ERR(link))
4877 return PTR_ERR(link);
4878 }
4879 res = readlink_copy(buffer, buflen, link);
4880 do_delayed_call(&done);
4881 return res;
4882}
4883EXPORT_SYMBOL(vfs_readlink);
4884
4885
4886
4887
4888
4889
4890
4891
4892
4893
4894
4895
4896const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
4897{
4898 const char *res = ERR_PTR(-EINVAL);
4899 struct inode *inode = d_inode(dentry);
4900
4901 if (d_is_symlink(dentry)) {
4902 res = ERR_PTR(security_inode_readlink(dentry));
4903 if (!res)
4904 res = inode->i_op->get_link(dentry, inode, done);
4905 }
4906 return res;
4907}
4908EXPORT_SYMBOL(vfs_get_link);
4909
4910
4911const char *page_get_link(struct dentry *dentry, struct inode *inode,
4912 struct delayed_call *callback)
4913{
4914 char *kaddr;
4915 struct page *page;
4916 struct address_space *mapping = inode->i_mapping;
4917
4918 if (!dentry) {
4919 page = find_get_page(mapping, 0);
4920 if (!page)
4921 return ERR_PTR(-ECHILD);
4922 if (!PageUptodate(page)) {
4923 put_page(page);
4924 return ERR_PTR(-ECHILD);
4925 }
4926 } else {
4927 page = read_mapping_page(mapping, 0, NULL);
4928 if (IS_ERR(page))
4929 return (char*)page;
4930 }
4931 set_delayed_call(callback, page_put_link, page);
4932 BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
4933 kaddr = page_address(page);
4934 nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
4935 return kaddr;
4936}
4937
4938EXPORT_SYMBOL(page_get_link);
4939
4940void page_put_link(void *arg)
4941{
4942 put_page(arg);
4943}
4944EXPORT_SYMBOL(page_put_link);
4945
4946int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4947{
4948 DEFINE_DELAYED_CALL(done);
4949 int res = readlink_copy(buffer, buflen,
4950 page_get_link(dentry, d_inode(dentry),
4951 &done));
4952 do_delayed_call(&done);
4953 return res;
4954}
4955EXPORT_SYMBOL(page_readlink);
4956
4957
4958
4959
4960int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
4961{
4962 struct address_space *mapping = inode->i_mapping;
4963 struct page *page;
4964 void *fsdata;
4965 int err;
4966 unsigned int flags = 0;
4967 if (nofs)
4968 flags |= AOP_FLAG_NOFS;
4969
4970retry:
4971 err = pagecache_write_begin(NULL, mapping, 0, len-1,
4972 flags, &page, &fsdata);
4973 if (err)
4974 goto fail;
4975
4976 memcpy(page_address(page), symname, len-1);
4977
4978 err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
4979 page, fsdata);
4980 if (err < 0)
4981 goto fail;
4982 if (err < len-1)
4983 goto retry;
4984
4985 mark_inode_dirty(inode);
4986 return 0;
4987fail:
4988 return err;
4989}
4990EXPORT_SYMBOL(__page_symlink);
4991
4992int page_symlink(struct inode *inode, const char *symname, int len)
4993{
4994 return __page_symlink(inode, symname, len,
4995 !mapping_gfp_constraint(inode->i_mapping, __GFP_FS));
4996}
4997EXPORT_SYMBOL(page_symlink);
4998
4999const struct inode_operations page_symlink_inode_operations = {
5000 .get_link = page_get_link,
5001};
5002EXPORT_SYMBOL(page_symlink_inode_operations);
5003