namei.c 81.8 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
/*
 *  linux/fs/namei.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

/*
 * Some corrections by tytso.
 */

/* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
 * lookup logic.
 */
/* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
 */

#include <linux/init.h>
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/fs.h>
#include <linux/namei.h>
#include <linux/pagemap.h>
R
Robert Love 已提交
23
#include <linux/fsnotify.h>
L
Linus Torvalds 已提交
24 25
#include <linux/personality.h>
#include <linux/security.h>
M
Mimi Zohar 已提交
26
#include <linux/ima.h>
L
Linus Torvalds 已提交
27 28 29
#include <linux/syscalls.h>
#include <linux/mount.h>
#include <linux/audit.h>
30
#include <linux/capability.h>
31
#include <linux/file.h>
32
#include <linux/fcntl.h>
33
#include <linux/device_cgroup.h>
34
#include <linux/fs_struct.h>
35
#include <linux/posix_acl.h>
L
Linus Torvalds 已提交
36 37
#include <asm/uaccess.h>

38 39
#include "internal.h"

L
Linus Torvalds 已提交
40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73
/* [Feb-1997 T. Schoebel-Theuer]
 * Fundamental changes in the pathname lookup mechanisms (namei)
 * were necessary because of omirr.  The reason is that omirr needs
 * to know the _real_ pathname, not the user-supplied one, in case
 * of symlinks (and also when transname replacements occur).
 *
 * The new code replaces the old recursive symlink resolution with
 * an iterative one (in case of non-nested symlink chains).  It does
 * this with calls to <fs>_follow_link().
 * As a side effect, dir_namei(), _namei() and follow_link() are now 
 * replaced with a single function lookup_dentry() that can handle all 
 * the special cases of the former code.
 *
 * With the new dcache, the pathname is stored at each inode, at least as
 * long as the refcount of the inode is positive.  As a side effect, the
 * size of the dcache depends on the inode cache and thus is dynamic.
 *
 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
 * resolution to correspond with current state of the code.
 *
 * Note that the symlink resolution is not *completely* iterative.
 * There is still a significant amount of tail- and mid- recursion in
 * the algorithm.  Also, note that <fs>_readlink() is not used in
 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
 * may return different results than <fs>_follow_link().  Many virtual
 * filesystems (including /proc) exhibit this behavior.
 */

/* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
 * and the name already exists in form of a symlink, try to create the new
 * name indicated by the symlink. The old code always complained that the
 * name already exists, due to not following the symlink even if its target
 * is nonexistent.  The new semantics affects also mknod() and link() when
L
Lucas De Marchi 已提交
74
 * the name is a symlink pointing to a non-existent name.
L
Linus Torvalds 已提交
75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106
 *
 * I don't know which semantics is the right one, since I have no access
 * to standards. But I found by trial that HP-UX 9.0 has the full "new"
 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
 * "old" one. Personally, I think the new semantics is much more logical.
 * Note that "ln old new" where "new" is a symlink pointing to a non-existing
 * file does succeed in both HP-UX and SunOs, but not in Solaris
 * and in the old Linux semantics.
 */

/* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
 * semantics.  See the comments in "open_namei" and "do_link" below.
 *
 * [10-Sep-98 Alan Modra] Another symlink change.
 */

/* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
 *	inside the path - always follow.
 *	in the last component in creation/removal/renaming - never follow.
 *	if LOOKUP_FOLLOW passed - follow.
 *	if the pathname has trailing slashes - follow.
 *	otherwise - don't follow.
 * (applied in that order).
 *
 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
 * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
 * During the 2.4 we need to fix the userland stuff depending on it -
 * hopefully we will be able to get rid of that wart in 2.5. So far only
 * XEmacs seems to be relying on it...
 */
/*
 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
107
 * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
L
Linus Torvalds 已提交
108 109 110 111 112 113 114 115 116 117
 * any extra contention...
 */

/* In order to reduce some races, while at the same time doing additional
 * checking and hopefully speeding things up, we copy filenames to the
 * kernel data space before using them..
 *
 * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
 * PATH_MAX includes the nul terminator --RR.
 */
118
static int do_getname(const char __user *filename, char *page)
L
Linus Torvalds 已提交
119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139
{
	int retval;
	unsigned long len = PATH_MAX;

	if (!segment_eq(get_fs(), KERNEL_DS)) {
		if ((unsigned long) filename >= TASK_SIZE)
			return -EFAULT;
		if (TASK_SIZE - (unsigned long) filename < PATH_MAX)
			len = TASK_SIZE - (unsigned long) filename;
	}

	retval = strncpy_from_user(page, filename, len);
	if (retval > 0) {
		if (retval < len)
			return 0;
		return -ENAMETOOLONG;
	} else if (!retval)
		retval = -ENOENT;
	return retval;
}

A
Al Viro 已提交
140
static char *getname_flags(const char __user * filename, int flags)
L
Linus Torvalds 已提交
141 142 143 144 145 146 147 148 149 150
{
	char *tmp, *result;

	result = ERR_PTR(-ENOMEM);
	tmp = __getname();
	if (tmp)  {
		int retval = do_getname(filename, tmp);

		result = tmp;
		if (retval < 0) {
A
Al Viro 已提交
151 152 153 154
			if (retval != -ENOENT || !(flags & LOOKUP_EMPTY)) {
				__putname(tmp);
				result = ERR_PTR(retval);
			}
L
Linus Torvalds 已提交
155 156 157 158 159 160
		}
	}
	audit_getname(result);
	return result;
}

A
Al Viro 已提交
161 162 163 164 165
char *getname(const char __user * filename)
{
	return getname_flags(filename, 0);
}

L
Linus Torvalds 已提交
166 167 168
#ifdef CONFIG_AUDITSYSCALL
void putname(const char *name)
{
169
	if (unlikely(!audit_dummy_context()))
L
Linus Torvalds 已提交
170 171 172 173 174 175 176
		audit_putname(name);
	else
		__putname(name);
}
EXPORT_SYMBOL(putname);
#endif

177 178
static int check_acl(struct inode *inode, int mask)
{
179
#ifdef CONFIG_FS_POSIX_ACL
180 181 182
	struct posix_acl *acl;

	if (mask & MAY_NOT_BLOCK) {
183 184
		acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
	        if (!acl)
185
	                return -EAGAIN;
186 187 188
		/* no ->get_acl() calls in RCU mode... */
		if (acl == ACL_NOT_CACHED)
			return -ECHILD;
A
Ari Savolainen 已提交
189
	        return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
190 191 192 193 194
	}

	acl = get_cached_acl(inode, ACL_TYPE_ACCESS);

	/*
195 196 197
	 * A filesystem can force a ACL callback by just never filling the
	 * ACL cache. But normally you'd fill the cache either at inode
	 * instantiation time, or on the first ->get_acl call.
198
	 *
199 200
	 * If the filesystem doesn't have a get_acl() function at all, we'll
	 * just create the negative cache entry.
201 202
	 */
	if (acl == ACL_NOT_CACHED) {
203 204 205 206 207 208 209 210
	        if (inode->i_op->get_acl) {
			acl = inode->i_op->get_acl(inode, ACL_TYPE_ACCESS);
			if (IS_ERR(acl))
				return PTR_ERR(acl);
		} else {
		        set_cached_acl(inode, ACL_TYPE_ACCESS, NULL);
		        return -EAGAIN;
		}
211 212 213 214 215 216 217
	}

	if (acl) {
	        int error = posix_acl_permission(inode, acl, mask);
	        posix_acl_release(acl);
	        return error;
	}
218
#endif
219 220 221 222

	return -EAGAIN;
}

223
/*
224
 * This does the basic permission checking
L
Linus Torvalds 已提交
225
 */
226
static int acl_permission_check(struct inode *inode, int mask)
L
Linus Torvalds 已提交
227
{
228
	unsigned int mode = inode->i_mode;
L
Linus Torvalds 已提交
229

230 231 232
	if (current_user_ns() != inode_userns(inode))
		goto other_perms;

233
	if (likely(current_fsuid() == inode->i_uid))
L
Linus Torvalds 已提交
234 235
		mode >>= 6;
	else {
236
		if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
237
			int error = check_acl(inode, mask);
238 239
			if (error != -EAGAIN)
				return error;
L
Linus Torvalds 已提交
240 241 242 243 244 245
		}

		if (in_group_p(inode->i_gid))
			mode >>= 3;
	}

246
other_perms:
L
Linus Torvalds 已提交
247 248 249
	/*
	 * If the DACs are ok we don't need any capability check.
	 */
250
	if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
L
Linus Torvalds 已提交
251
		return 0;
252 253 254 255
	return -EACCES;
}

/**
256
 * generic_permission -  check for access rights on a Posix-like filesystem
257
 * @inode:	inode to check access rights for
258
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...)
259 260 261 262
 *
 * Used to check for read/write/execute permissions on a file.
 * We use "fsuid" for this, letting us set arbitrary permissions
 * for filesystem access without changing the "normal" uids which
263 264 265 266 267
 * are used for other things.
 *
 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
 * request cannot be satisfied (eg. requires blocking or too much complexity).
 * It would then be called again in ref-walk mode.
268
 */
269
int generic_permission(struct inode *inode, int mask)
270 271 272 273
{
	int ret;

	/*
274
	 * Do the basic permission checks.
275
	 */
276
	ret = acl_permission_check(inode, mask);
277 278
	if (ret != -EACCES)
		return ret;
L
Linus Torvalds 已提交
279

280 281 282 283 284 285 286 287 288
	if (S_ISDIR(inode->i_mode)) {
		/* DACs are overridable for directories */
		if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
			return 0;
		if (!(mask & MAY_WRITE))
			if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
				return 0;
		return -EACCES;
	}
L
Linus Torvalds 已提交
289 290
	/*
	 * Read/write DACs are always overridable.
291 292
	 * Executable DACs are overridable when there is
	 * at least one exec bit set.
L
Linus Torvalds 已提交
293
	 */
294
	if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
295
		if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
L
Linus Torvalds 已提交
296 297 298 299 300
			return 0;

	/*
	 * Searching includes executable on directories, else just read.
	 */
301
	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
302
	if (mask == MAY_READ)
303
		if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
L
Linus Torvalds 已提交
304 305 306 307 308
			return 0;

	return -EACCES;
}

309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328
/*
 * We _really_ want to just do "generic_permission()" without
 * even looking at the inode->i_op values. So we keep a cache
 * flag in inode->i_opflags, that says "this has not special
 * permission function, use the fast case".
 */
static inline int do_inode_permission(struct inode *inode, int mask)
{
	if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
		if (likely(inode->i_op->permission))
			return inode->i_op->permission(inode, mask);

		/* This gets set once for the inode lifetime */
		spin_lock(&inode->i_lock);
		inode->i_opflags |= IOP_FASTPERM;
		spin_unlock(&inode->i_lock);
	}
	return generic_permission(inode, mask);
}

C
Christoph Hellwig 已提交
329 330 331
/**
 * inode_permission  -  check for access rights to a given inode
 * @inode:	inode to check permission on
332
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...)
C
Christoph Hellwig 已提交
333 334 335 336 337
 *
 * Used to check for read/write/execute permissions on an inode.
 * We use "fsuid" for this, letting us set arbitrary permissions
 * for filesystem access without changing the "normal" uids which
 * are used for other things.
338 339
 *
 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
C
Christoph Hellwig 已提交
340
 */
341
int inode_permission(struct inode *inode, int mask)
L
Linus Torvalds 已提交
342
{
343
	int retval;
L
Linus Torvalds 已提交
344

345
	if (unlikely(mask & MAY_WRITE)) {
346
		umode_t mode = inode->i_mode;
L
Linus Torvalds 已提交
347 348 349 350 351 352 353 354 355 356 357 358 359 360 361

		/*
		 * Nobody gets write access to a read-only fs.
		 */
		if (IS_RDONLY(inode) &&
		    (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
			return -EROFS;

		/*
		 * Nobody gets write access to an immutable file.
		 */
		if (IS_IMMUTABLE(inode))
			return -EACCES;
	}

362
	retval = do_inode_permission(inode, mask);
L
Linus Torvalds 已提交
363 364 365
	if (retval)
		return retval;

366 367 368 369
	retval = devcgroup_inode_permission(inode, mask);
	if (retval)
		return retval;

370
	return security_inode_permission(inode, mask);
L
Linus Torvalds 已提交
371 372
}

J
Jan Blunck 已提交
373 374 375 376 377 378 379 380 381 382 383 384 385
/**
 * path_get - get a reference to a path
 * @path: path to get the reference to
 *
 * Given a path increment the reference count to the dentry and the vfsmount.
 */
void path_get(struct path *path)
{
	mntget(path->mnt);
	dget(path->dentry);
}
EXPORT_SYMBOL(path_get);

J
Jan Blunck 已提交
386 387 388 389 390 391 392
/**
 * path_put - put a reference to a path
 * @path: path to put the reference to
 *
 * Given a path decrement the reference count to the dentry and the vfsmount.
 */
void path_put(struct path *path)
L
Linus Torvalds 已提交
393
{
J
Jan Blunck 已提交
394 395
	dput(path->dentry);
	mntput(path->mnt);
L
Linus Torvalds 已提交
396
}
J
Jan Blunck 已提交
397
EXPORT_SYMBOL(path_put);
L
Linus Torvalds 已提交
398

A
Al Viro 已提交
399
/*
N
Nick Piggin 已提交
400
 * Path walking has 2 modes, rcu-walk and ref-walk (see
A
Al Viro 已提交
401 402 403 404 405 406 407
 * Documentation/filesystems/path-lookup.txt).  In situations when we can't
 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
 * normal reference counts on dentries and vfsmounts to transition to rcu-walk
 * mode.  Refcounts are grabbed at the last known good point before rcu-walk
 * got stuck, so ref-walk may continue from there. If this is not successful
 * (eg. a seqcount has changed), then failure is returned and it's up to caller
 * to restart the path walk from the beginning in ref-walk mode.
N
Nick Piggin 已提交
408 409 410
 */

/**
A
Al Viro 已提交
411 412 413
 * unlazy_walk - try to switch to ref-walk mode.
 * @nd: nameidata pathwalk data
 * @dentry: child of nd->path.dentry or NULL
414
 * Returns: 0 on success, -ECHILD on failure
N
Nick Piggin 已提交
415
 *
A
Al Viro 已提交
416 417 418
 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry
 * for ref-walk mode.  @dentry must be a path found by a do_lookup call on
 * @nd or NULL.  Must be called from rcu-walk context.
N
Nick Piggin 已提交
419
 */
A
Al Viro 已提交
420
static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
N
Nick Piggin 已提交
421 422 423
{
	struct fs_struct *fs = current->fs;
	struct dentry *parent = nd->path.dentry;
424
	int want_root = 0;
N
Nick Piggin 已提交
425 426

	BUG_ON(!(nd->flags & LOOKUP_RCU));
427 428
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
		want_root = 1;
N
Nick Piggin 已提交
429 430 431 432 433 434
		spin_lock(&fs->lock);
		if (nd->root.mnt != fs->root.mnt ||
				nd->root.dentry != fs->root.dentry)
			goto err_root;
	}
	spin_lock(&parent->d_lock);
A
Al Viro 已提交
435 436 437 438 439
	if (!dentry) {
		if (!__d_rcu_to_refcount(parent, nd->seq))
			goto err_parent;
		BUG_ON(nd->inode != parent->d_inode);
	} else {
440 441
		if (dentry->d_parent != parent)
			goto err_parent;
A
Al Viro 已提交
442 443 444 445 446 447 448 449 450 451 452 453 454 455
		spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
		if (!__d_rcu_to_refcount(dentry, nd->seq))
			goto err_child;
		/*
		 * If the sequence check on the child dentry passed, then
		 * the child has not been removed from its parent. This
		 * means the parent dentry must be valid and able to take
		 * a reference at this point.
		 */
		BUG_ON(!IS_ROOT(dentry) && dentry->d_parent != parent);
		BUG_ON(!parent->d_count);
		parent->d_count++;
		spin_unlock(&dentry->d_lock);
	}
N
Nick Piggin 已提交
456
	spin_unlock(&parent->d_lock);
457
	if (want_root) {
N
Nick Piggin 已提交
458 459 460 461 462 463 464 465 466
		path_get(&nd->root);
		spin_unlock(&fs->lock);
	}
	mntget(nd->path.mnt);

	rcu_read_unlock();
	br_read_unlock(vfsmount_lock);
	nd->flags &= ~LOOKUP_RCU;
	return 0;
A
Al Viro 已提交
467 468

err_child:
N
Nick Piggin 已提交
469
	spin_unlock(&dentry->d_lock);
A
Al Viro 已提交
470
err_parent:
N
Nick Piggin 已提交
471 472
	spin_unlock(&parent->d_lock);
err_root:
473
	if (want_root)
N
Nick Piggin 已提交
474 475 476 477
		spin_unlock(&fs->lock);
	return -ECHILD;
}

478 479 480 481 482 483
/**
 * release_open_intent - free up open intent resources
 * @nd: pointer to nameidata
 */
void release_open_intent(struct nameidata *nd)
{
484 485 486 487 488 489 490 491
	struct file *file = nd->intent.open.file;

	if (file && !IS_ERR(file)) {
		if (file->f_path.dentry == NULL)
			put_filp(file);
		else
			fput(file);
	}
492 493
}

A
Al Viro 已提交
494
static inline int d_revalidate(struct dentry *dentry, struct nameidata *nd)
495
{
A
Al Viro 已提交
496
	return dentry->d_op->d_revalidate(dentry, nd);
497 498
}

499 500 501
/**
 * complete_walk - successful completion of path walk
 * @nd:  pointer nameidata
502
 *
503 504 505 506 507
 * If we had been in RCU mode, drop out of it and legitimize nd->path.
 * Revalidate the final result, unless we'd already done that during
 * the path walk or the filesystem doesn't ask for it.  Return 0 on
 * success, -error on failure.  In case of failure caller does not
 * need to drop nd->path.
508
 */
509
static int complete_walk(struct nameidata *nd)
510
{
A
Al Viro 已提交
511
	struct dentry *dentry = nd->path.dentry;
512 513
	int status;

514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531
	if (nd->flags & LOOKUP_RCU) {
		nd->flags &= ~LOOKUP_RCU;
		if (!(nd->flags & LOOKUP_ROOT))
			nd->root.mnt = NULL;
		spin_lock(&dentry->d_lock);
		if (unlikely(!__d_rcu_to_refcount(dentry, nd->seq))) {
			spin_unlock(&dentry->d_lock);
			rcu_read_unlock();
			br_read_unlock(vfsmount_lock);
			return -ECHILD;
		}
		BUG_ON(nd->inode != dentry->d_inode);
		spin_unlock(&dentry->d_lock);
		mntget(nd->path.mnt);
		rcu_read_unlock();
		br_read_unlock(vfsmount_lock);
	}

A
Al Viro 已提交
532 533 534 535
	if (likely(!(nd->flags & LOOKUP_JUMPED)))
		return 0;

	if (likely(!(dentry->d_flags & DCACHE_OP_REVALIDATE)))
536 537
		return 0;

A
Al Viro 已提交
538 539 540 541
	if (likely(!(dentry->d_sb->s_type->fs_flags & FS_REVAL_DOT)))
		return 0;

	/* Note: we do not d_invalidate() */
542
	status = d_revalidate(dentry, nd);
543 544 545
	if (status > 0)
		return 0;

A
Al Viro 已提交
546
	if (!status)
547
		status = -ESTALE;
A
Al Viro 已提交
548

549
	path_put(&nd->path);
550 551 552
	return status;
}

A
Al Viro 已提交
553 554
static __always_inline void set_root(struct nameidata *nd)
{
555 556
	if (!nd->root.mnt)
		get_fs_root(current->fs, &nd->root);
A
Al Viro 已提交
557 558
}

559 560
static int link_path_walk(const char *, struct nameidata *);

N
Nick Piggin 已提交
561 562 563 564
static __always_inline void set_root_rcu(struct nameidata *nd)
{
	if (!nd->root.mnt) {
		struct fs_struct *fs = current->fs;
N
Nick Piggin 已提交
565 566 567 568 569
		unsigned seq;

		do {
			seq = read_seqcount_begin(&fs->seq);
			nd->root = fs->root;
570
			nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
N
Nick Piggin 已提交
571
		} while (read_seqcount_retry(&fs->seq, seq));
N
Nick Piggin 已提交
572 573 574
	}
}

575
static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
L
Linus Torvalds 已提交
576
{
N
Nick Piggin 已提交
577 578
	int ret;

L
Linus Torvalds 已提交
579 580 581 582
	if (IS_ERR(link))
		goto fail;

	if (*link == '/') {
A
Al Viro 已提交
583
		set_root(nd);
J
Jan Blunck 已提交
584
		path_put(&nd->path);
A
Al Viro 已提交
585 586
		nd->path = nd->root;
		path_get(&nd->root);
A
Al Viro 已提交
587
		nd->flags |= LOOKUP_JUMPED;
L
Linus Torvalds 已提交
588
	}
N
Nick Piggin 已提交
589
	nd->inode = nd->path.dentry->d_inode;
C
Christoph Hellwig 已提交
590

N
Nick Piggin 已提交
591 592
	ret = link_path_walk(link, nd);
	return ret;
L
Linus Torvalds 已提交
593
fail:
J
Jan Blunck 已提交
594
	path_put(&nd->path);
L
Linus Torvalds 已提交
595 596 597
	return PTR_ERR(link);
}

J
Jan Blunck 已提交
598
static void path_put_conditional(struct path *path, struct nameidata *nd)
599 600
{
	dput(path->dentry);
601
	if (path->mnt != nd->path.mnt)
602 603 604
		mntput(path->mnt);
}

605 606
static inline void path_to_nameidata(const struct path *path,
					struct nameidata *nd)
607
{
N
Nick Piggin 已提交
608 609 610 611
	if (!(nd->flags & LOOKUP_RCU)) {
		dput(nd->path.dentry);
		if (nd->path.mnt != path->mnt)
			mntput(nd->path.mnt);
612
	}
N
Nick Piggin 已提交
613
	nd->path.mnt = path->mnt;
614
	nd->path.dentry = path->dentry;
615 616
}

617 618 619 620 621 622 623 624
static inline void put_link(struct nameidata *nd, struct path *link, void *cookie)
{
	struct inode *inode = link->dentry->d_inode;
	if (!IS_ERR(cookie) && inode->i_op->put_link)
		inode->i_op->put_link(link->dentry, nd, cookie);
	path_put(link);
}

A
Al Viro 已提交
625
static __always_inline int
626
follow_link(struct path *link, struct nameidata *nd, void **p)
L
Linus Torvalds 已提交
627 628
{
	int error;
629
	struct dentry *dentry = link->dentry;
L
Linus Torvalds 已提交
630

631 632
	BUG_ON(nd->flags & LOOKUP_RCU);

A
Al Viro 已提交
633 634 635
	if (link->mnt == nd->path.mnt)
		mntget(link->mnt);

636 637 638 639 640 641 642 643
	if (unlikely(current->total_link_count >= 40)) {
		*p = ERR_PTR(-ELOOP); /* no ->put_link(), please */
		path_put(&nd->path);
		return -ELOOP;
	}
	cond_resched();
	current->total_link_count++;

644
	touch_atime(link->mnt, dentry);
L
Linus Torvalds 已提交
645
	nd_set_link(nd, NULL);
A
Al Viro 已提交
646

647 648 649 650 651 652 653
	error = security_inode_follow_link(link->dentry, nd);
	if (error) {
		*p = ERR_PTR(error); /* no ->put_link(), please */
		path_put(&nd->path);
		return error;
	}

654
	nd->last_type = LAST_BIND;
A
Al Viro 已提交
655 656 657
	*p = dentry->d_inode->i_op->follow_link(dentry, nd);
	error = PTR_ERR(*p);
	if (!IS_ERR(*p)) {
L
Linus Torvalds 已提交
658
		char *s = nd_get_link(nd);
659
		error = 0;
L
Linus Torvalds 已提交
660 661
		if (s)
			error = __vfs_follow_link(nd, s);
A
Al Viro 已提交
662
		else if (nd->last_type == LAST_BIND) {
A
Al Viro 已提交
663
			nd->flags |= LOOKUP_JUMPED;
664 665
			nd->inode = nd->path.dentry->d_inode;
			if (nd->inode->i_op->follow_link) {
A
Al Viro 已提交
666 667 668 669 670
				/* stepped on a _really_ weird one */
				path_put(&nd->path);
				error = -ELOOP;
			}
		}
L
Linus Torvalds 已提交
671 672 673 674
	}
	return error;
}

N
Nick Piggin 已提交
675 676 677 678 679 680 681 682 683 684 685 686 687 688
static int follow_up_rcu(struct path *path)
{
	struct vfsmount *parent;
	struct dentry *mountpoint;

	parent = path->mnt->mnt_parent;
	if (parent == path->mnt)
		return 0;
	mountpoint = path->mnt->mnt_mountpoint;
	path->dentry = mountpoint;
	path->mnt = parent;
	return 1;
}

A
Al Viro 已提交
689
int follow_up(struct path *path)
L
Linus Torvalds 已提交
690 691 692
{
	struct vfsmount *parent;
	struct dentry *mountpoint;
N
Nick Piggin 已提交
693 694

	br_read_lock(vfsmount_lock);
A
Al Viro 已提交
695 696
	parent = path->mnt->mnt_parent;
	if (parent == path->mnt) {
N
Nick Piggin 已提交
697
		br_read_unlock(vfsmount_lock);
L
Linus Torvalds 已提交
698 699 700
		return 0;
	}
	mntget(parent);
A
Al Viro 已提交
701
	mountpoint = dget(path->mnt->mnt_mountpoint);
N
Nick Piggin 已提交
702
	br_read_unlock(vfsmount_lock);
A
Al Viro 已提交
703 704 705 706
	dput(path->dentry);
	path->dentry = mountpoint;
	mntput(path->mnt);
	path->mnt = parent;
L
Linus Torvalds 已提交
707 708 709
	return 1;
}

N
Nick Piggin 已提交
710
/*
711 712 713
 * Perform an automount
 * - return -EISDIR to tell follow_managed() to stop and return the path we
 *   were called with.
L
Linus Torvalds 已提交
714
 */
715 716
static int follow_automount(struct path *path, unsigned flags,
			    bool *need_mntput)
N
Nick Piggin 已提交
717
{
718
	struct vfsmount *mnt;
719
	int err;
720 721 722 723

	if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
		return -EREMOTE;

724 725 726 727 728 729 730 731 732 733
	/* We don't want to mount if someone's just doing a stat -
	 * unless they're stat'ing a directory and appended a '/' to
	 * the name.
	 *
	 * We do, however, want to mount if someone wants to open or
	 * create a file of any type under the mountpoint, wants to
	 * traverse through the mountpoint or wants to open the
	 * mounted directory.  Also, autofs may mark negative dentries
	 * as being automount points.  These will need the attentions
	 * of the daemon to instantiate them before they can be used.
734
	 */
735
	if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
736
		     LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
737 738 739
	    path->dentry->d_inode)
		return -EISDIR;

740 741 742 743 744 745 746 747 748 749 750 751 752 753 754
	current->total_link_count++;
	if (current->total_link_count >= 40)
		return -ELOOP;

	mnt = path->dentry->d_op->d_automount(path);
	if (IS_ERR(mnt)) {
		/*
		 * The filesystem is allowed to return -EISDIR here to indicate
		 * it doesn't want to automount.  For instance, autofs would do
		 * this so that its userspace daemon can mount on this dentry.
		 *
		 * However, we can only permit this if it's a terminal point in
		 * the path being looked up; if it wasn't then the remainder of
		 * the path is inaccessible and we should say so.
		 */
A
Al Viro 已提交
755
		if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT))
756 757
			return -EREMOTE;
		return PTR_ERR(mnt);
N
Nick Piggin 已提交
758
	}
759

760 761
	if (!mnt) /* mount collision */
		return 0;
N
Nick Piggin 已提交
762

763 764 765 766 767
	if (!*need_mntput) {
		/* lock_mount() may release path->mnt on error */
		mntget(path->mnt);
		*need_mntput = true;
	}
768
	err = finish_automount(mnt, path);
769

770 771 772
	switch (err) {
	case -EBUSY:
		/* Someone else made a mount here whilst we were busy */
773
		return 0;
774
	case 0:
775
		path_put(path);
776 777 778
		path->mnt = mnt;
		path->dentry = dget(mnt->mnt_root);
		return 0;
779 780
	default:
		return err;
781
	}
782

A
Al Viro 已提交
783 784
}

785 786
/*
 * Handle a dentry that is managed in some way.
787
 * - Flagged for transit management (autofs)
788 789 790 791 792 793 794 795
 * - Flagged as mountpoint
 * - Flagged as automount point
 *
 * This may only be called in refwalk mode.
 *
 * Serialization is taken care of in namespace.c
 */
static int follow_managed(struct path *path, unsigned flags)
L
Linus Torvalds 已提交
796
{
797
	struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */
798 799
	unsigned managed;
	bool need_mntput = false;
800
	int ret = 0;
801 802 803 804 805 806 807

	/* Given that we're not holding a lock here, we retain the value in a
	 * local variable for each dentry as we look at it so that we don't see
	 * the components of that value change under us */
	while (managed = ACCESS_ONCE(path->dentry->d_flags),
	       managed &= DCACHE_MANAGED_DENTRY,
	       unlikely(managed != 0)) {
808 809 810 811 812
		/* Allow the filesystem to manage the transit without i_mutex
		 * being held. */
		if (managed & DCACHE_MANAGE_TRANSIT) {
			BUG_ON(!path->dentry->d_op);
			BUG_ON(!path->dentry->d_op->d_manage);
813
			ret = path->dentry->d_op->d_manage(path->dentry, false);
814
			if (ret < 0)
815
				break;
816 817
		}

818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840
		/* Transit to a mounted filesystem. */
		if (managed & DCACHE_MOUNTED) {
			struct vfsmount *mounted = lookup_mnt(path);
			if (mounted) {
				dput(path->dentry);
				if (need_mntput)
					mntput(path->mnt);
				path->mnt = mounted;
				path->dentry = dget(mounted->mnt_root);
				need_mntput = true;
				continue;
			}

			/* Something is mounted on this dentry in another
			 * namespace and/or whatever was mounted there in this
			 * namespace got unmounted before we managed to get the
			 * vfsmount_lock */
		}

		/* Handle an automount point */
		if (managed & DCACHE_NEED_AUTOMOUNT) {
			ret = follow_automount(path, flags, &need_mntput);
			if (ret < 0)
841
				break;
842 843 844 845 846
			continue;
		}

		/* We didn't change the current path point */
		break;
L
Linus Torvalds 已提交
847
	}
848 849 850 851 852 853

	if (need_mntput && path->mnt == mnt)
		mntput(path->mnt);
	if (ret == -EISDIR)
		ret = 0;
	return ret;
L
Linus Torvalds 已提交
854 855
}

856
int follow_down_one(struct path *path)
L
Linus Torvalds 已提交
857 858 859
{
	struct vfsmount *mounted;

A
Al Viro 已提交
860
	mounted = lookup_mnt(path);
L
Linus Torvalds 已提交
861
	if (mounted) {
A
Al Viro 已提交
862 863 864 865
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
L
Linus Torvalds 已提交
866 867 868 869 870
		return 1;
	}
	return 0;
}

871 872 873 874 875 876
static inline bool managed_dentry_might_block(struct dentry *dentry)
{
	return (dentry->d_flags & DCACHE_MANAGE_TRANSIT &&
		dentry->d_op->d_manage(dentry, true) < 0);
}

877
/*
878 879
 * Try to skip to top of mountpoint pile in rcuwalk mode.  Fail if
 * we meet a managed dentry that would need blocking.
880 881
 */
static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
882
			       struct inode **inode)
883
{
884
	for (;;) {
885
		struct vfsmount *mounted;
886 887 888 889
		/*
		 * Don't forget we might have a non-mountpoint managed dentry
		 * that wants to block transit.
		 */
890
		if (unlikely(managed_dentry_might_block(path->dentry)))
891
			return false;
892 893 894 895

		if (!d_mountpoint(path->dentry))
			break;

896 897 898 899 900 901
		mounted = __lookup_mnt(path->mnt, path->dentry, 1);
		if (!mounted)
			break;
		path->mnt = mounted;
		path->dentry = mounted->mnt_root;
		nd->seq = read_seqcount_begin(&path->dentry->d_seq);
902 903 904 905 906 907
		/*
		 * Update the inode too. We don't need to re-check the
		 * dentry sequence number here after this d_inode read,
		 * because a mount-point is always pinned.
		 */
		*inode = path->dentry->d_inode;
908 909 910 911
	}
	return true;
}

912
static void follow_mount_rcu(struct nameidata *nd)
913
{
914
	while (d_mountpoint(nd->path.dentry)) {
915
		struct vfsmount *mounted;
916
		mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry, 1);
917 918
		if (!mounted)
			break;
919 920 921
		nd->path.mnt = mounted;
		nd->path.dentry = mounted->mnt_root;
		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
922 923 924
	}
}

N
Nick Piggin 已提交
925 926 927 928
static int follow_dotdot_rcu(struct nameidata *nd)
{
	set_root_rcu(nd);

929
	while (1) {
N
Nick Piggin 已提交
930 931 932 933 934 935 936 937 938 939 940
		if (nd->path.dentry == nd->root.dentry &&
		    nd->path.mnt == nd->root.mnt) {
			break;
		}
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
			struct dentry *old = nd->path.dentry;
			struct dentry *parent = old->d_parent;
			unsigned seq;

			seq = read_seqcount_begin(&parent->d_seq);
			if (read_seqcount_retry(&old->d_seq, nd->seq))
941
				goto failed;
N
Nick Piggin 已提交
942 943 944 945 946 947 948 949
			nd->path.dentry = parent;
			nd->seq = seq;
			break;
		}
		if (!follow_up_rcu(&nd->path))
			break;
		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
	}
950 951
	follow_mount_rcu(nd);
	nd->inode = nd->path.dentry->d_inode;
N
Nick Piggin 已提交
952
	return 0;
953 954 955

failed:
	nd->flags &= ~LOOKUP_RCU;
956 957
	if (!(nd->flags & LOOKUP_ROOT))
		nd->root.mnt = NULL;
958 959 960
	rcu_read_unlock();
	br_read_unlock(vfsmount_lock);
	return -ECHILD;
N
Nick Piggin 已提交
961 962
}

963 964 965 966 967
/*
 * Follow down to the covering mount currently visible to userspace.  At each
 * point, the filesystem owning that dentry may be queried as to whether the
 * caller is permitted to proceed or not.
 */
968
int follow_down(struct path *path)
969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987
{
	unsigned managed;
	int ret;

	while (managed = ACCESS_ONCE(path->dentry->d_flags),
	       unlikely(managed & DCACHE_MANAGED_DENTRY)) {
		/* Allow the filesystem to manage the transit without i_mutex
		 * being held.
		 *
		 * We indicate to the filesystem if someone is trying to mount
		 * something here.  This gives autofs the chance to deny anyone
		 * other than its daemon the right to mount on its
		 * superstructure.
		 *
		 * The filesystem may sleep at this point.
		 */
		if (managed & DCACHE_MANAGE_TRANSIT) {
			BUG_ON(!path->dentry->d_op);
			BUG_ON(!path->dentry->d_op->d_manage);
988
			ret = path->dentry->d_op->d_manage(
989
				path->dentry, false);
990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011
			if (ret < 0)
				return ret == -EISDIR ? 0 : ret;
		}

		/* Transit to a mounted filesystem. */
		if (managed & DCACHE_MOUNTED) {
			struct vfsmount *mounted = lookup_mnt(path);
			if (!mounted)
				break;
			dput(path->dentry);
			mntput(path->mnt);
			path->mnt = mounted;
			path->dentry = dget(mounted->mnt_root);
			continue;
		}

		/* Don't handle automount points here */
		break;
	}
	return 0;
}

1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027
/*
 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot()
 */
static void follow_mount(struct path *path)
{
	while (d_mountpoint(path->dentry)) {
		struct vfsmount *mounted = lookup_mnt(path);
		if (!mounted)
			break;
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
	}
}

N
Nick Piggin 已提交
1028
static void follow_dotdot(struct nameidata *nd)
L
Linus Torvalds 已提交
1029
{
A
Al Viro 已提交
1030
	set_root(nd);
1031

L
Linus Torvalds 已提交
1032
	while(1) {
1033
		struct dentry *old = nd->path.dentry;
L
Linus Torvalds 已提交
1034

A
Al Viro 已提交
1035 1036
		if (nd->path.dentry == nd->root.dentry &&
		    nd->path.mnt == nd->root.mnt) {
L
Linus Torvalds 已提交
1037 1038
			break;
		}
1039
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
A
Al Viro 已提交
1040 1041
			/* rare case of legitimate dget_parent()... */
			nd->path.dentry = dget_parent(nd->path.dentry);
L
Linus Torvalds 已提交
1042 1043 1044
			dput(old);
			break;
		}
A
Al Viro 已提交
1045
		if (!follow_up(&nd->path))
L
Linus Torvalds 已提交
1046 1047
			break;
	}
A
Al Viro 已提交
1048
	follow_mount(&nd->path);
N
Nick Piggin 已提交
1049
	nd->inode = nd->path.dentry->d_inode;
L
Linus Torvalds 已提交
1050 1051
}

1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080
/*
 * Allocate a dentry with name and parent, and perform a parent
 * directory ->lookup on it. Returns the new dentry, or ERR_PTR
 * on error. parent->d_inode->i_mutex must be held. d_lookup must
 * have verified that no child exists while under i_mutex.
 */
static struct dentry *d_alloc_and_lookup(struct dentry *parent,
				struct qstr *name, struct nameidata *nd)
{
	struct inode *inode = parent->d_inode;
	struct dentry *dentry;
	struct dentry *old;

	/* Don't create child dentry for a dead directory. */
	if (unlikely(IS_DEADDIR(inode)))
		return ERR_PTR(-ENOENT);

	dentry = d_alloc(parent, name);
	if (unlikely(!dentry))
		return ERR_PTR(-ENOMEM);

	old = inode->i_op->lookup(inode, dentry, nd);
	if (unlikely(old)) {
		dput(dentry);
		dentry = old;
	}
	return dentry;
}

1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104
/*
 * We already have a dentry, but require a lookup to be performed on the parent
 * directory to fill in d_inode. Returns the new dentry, or ERR_PTR on error.
 * parent->d_inode->i_mutex must be held. d_lookup must have verified that no
 * child exists while under i_mutex.
 */
static struct dentry *d_inode_lookup(struct dentry *parent, struct dentry *dentry,
				     struct nameidata *nd)
{
	struct inode *inode = parent->d_inode;
	struct dentry *old;

	/* Don't create child dentry for a dead directory. */
	if (unlikely(IS_DEADDIR(inode)))
		return ERR_PTR(-ENOENT);

	old = inode->i_op->lookup(inode, dentry, nd);
	if (unlikely(old)) {
		dput(dentry);
		dentry = old;
	}
	return dentry;
}

L
Linus Torvalds 已提交
1105 1106 1107 1108 1109 1110
/*
 *  It's more convoluted than I'd like it to be, but... it's still fairly
 *  small and for now I'd prefer to have fast path as straight as possible.
 *  It _is_ time-critical.
 */
static int do_lookup(struct nameidata *nd, struct qstr *name,
N
Nick Piggin 已提交
1111
			struct path *path, struct inode **inode)
L
Linus Torvalds 已提交
1112
{
1113
	struct vfsmount *mnt = nd->path.mnt;
N
Nick Piggin 已提交
1114
	struct dentry *dentry, *parent = nd->path.dentry;
A
Al Viro 已提交
1115 1116
	int need_reval = 1;
	int status = 1;
1117 1118
	int err;

1119 1120 1121 1122 1123
	/*
	 * Rename seqlock is not required here because in the off chance
	 * of a false negative due to a concurrent rename, we're going to
	 * do the non-racy lookup, below.
	 */
N
Nick Piggin 已提交
1124 1125 1126 1127
	if (nd->flags & LOOKUP_RCU) {
		unsigned seq;
		*inode = nd->inode;
		dentry = __d_lookup_rcu(parent, name, &seq, inode);
A
Al Viro 已提交
1128 1129 1130
		if (!dentry)
			goto unlazy;

N
Nick Piggin 已提交
1131 1132 1133 1134
		/* Memory barrier in read_seqcount_begin of child is enough */
		if (__read_seqcount_retry(&parent->d_seq, nd->seq))
			return -ECHILD;
		nd->seq = seq;
A
Al Viro 已提交
1135

1136
		if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) {
A
Al Viro 已提交
1137 1138 1139 1140 1141 1142
			status = d_revalidate(dentry, nd);
			if (unlikely(status <= 0)) {
				if (status != -ECHILD)
					need_reval = 0;
				goto unlazy;
			}
1143
		}
1144 1145
		if (unlikely(d_need_lookup(dentry)))
			goto unlazy;
N
Nick Piggin 已提交
1146 1147
		path->mnt = mnt;
		path->dentry = dentry;
1148 1149 1150 1151 1152
		if (unlikely(!__follow_mount_rcu(nd, path, inode)))
			goto unlazy;
		if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT))
			goto unlazy;
		return 0;
A
Al Viro 已提交
1153
unlazy:
A
Al Viro 已提交
1154 1155
		if (unlazy_walk(nd, dentry))
			return -ECHILD;
A
Al Viro 已提交
1156 1157
	} else {
		dentry = __d_lookup(parent, name);
1158
	}
A
Al Viro 已提交
1159

1160 1161 1162 1163
	if (dentry && unlikely(d_need_lookup(dentry))) {
		dput(dentry);
		dentry = NULL;
	}
A
Al Viro 已提交
1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179
retry:
	if (unlikely(!dentry)) {
		struct inode *dir = parent->d_inode;
		BUG_ON(nd->inode != dir);

		mutex_lock(&dir->i_mutex);
		dentry = d_lookup(parent, name);
		if (likely(!dentry)) {
			dentry = d_alloc_and_lookup(parent, name, nd);
			if (IS_ERR(dentry)) {
				mutex_unlock(&dir->i_mutex);
				return PTR_ERR(dentry);
			}
			/* known good */
			need_reval = 0;
			status = 1;
1180 1181 1182 1183 1184 1185 1186 1187 1188
		} else if (unlikely(d_need_lookup(dentry))) {
			dentry = d_inode_lookup(parent, dentry, nd);
			if (IS_ERR(dentry)) {
				mutex_unlock(&dir->i_mutex);
				return PTR_ERR(dentry);
			}
			/* known good */
			need_reval = 0;
			status = 1;
A
Al Viro 已提交
1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204
		}
		mutex_unlock(&dir->i_mutex);
	}
	if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval)
		status = d_revalidate(dentry, nd);
	if (unlikely(status <= 0)) {
		if (status < 0) {
			dput(dentry);
			return status;
		}
		if (!d_invalidate(dentry)) {
			dput(dentry);
			dentry = NULL;
			need_reval = 1;
			goto retry;
		}
1205
	}
A
Al Viro 已提交
1206

1207 1208 1209
	path->mnt = mnt;
	path->dentry = dentry;
	err = follow_managed(path, nd->flags);
1210 1211
	if (unlikely(err < 0)) {
		path_put_conditional(path, nd);
1212
		return err;
1213
	}
1214
	*inode = path->dentry->d_inode;
L
Linus Torvalds 已提交
1215 1216 1217
	return 0;
}

1218 1219 1220
static inline int may_lookup(struct nameidata *nd)
{
	if (nd->flags & LOOKUP_RCU) {
1221
		int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1222 1223
		if (err != -ECHILD)
			return err;
A
Al Viro 已提交
1224
		if (unlazy_walk(nd, NULL))
1225 1226
			return -ECHILD;
	}
1227
	return inode_permission(nd->inode, MAY_EXEC);
1228 1229
}

1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241
static inline int handle_dots(struct nameidata *nd, int type)
{
	if (type == LAST_DOTDOT) {
		if (nd->flags & LOOKUP_RCU) {
			if (follow_dotdot_rcu(nd))
				return -ECHILD;
		} else
			follow_dotdot(nd);
	}
	return 0;
}

1242 1243 1244 1245 1246 1247
static void terminate_walk(struct nameidata *nd)
{
	if (!(nd->flags & LOOKUP_RCU)) {
		path_put(&nd->path);
	} else {
		nd->flags &= ~LOOKUP_RCU;
1248 1249
		if (!(nd->flags & LOOKUP_ROOT))
			nd->root.mnt = NULL;
1250 1251 1252 1253 1254
		rcu_read_unlock();
		br_read_unlock(vfsmount_lock);
	}
}

1255 1256 1257 1258 1259 1260
/*
 * Do we need to follow links? We _really_ want to be able
 * to do this check without having to look at inode->i_op,
 * so we keep a cache of "no, this doesn't need follow_link"
 * for the common case.
 */
1261
static inline int should_follow_link(struct inode *inode, int follow)
1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274
{
	if (unlikely(!(inode->i_opflags & IOP_NOFOLLOW))) {
		if (likely(inode->i_op->follow_link))
			return follow;

		/* This gets set once for the inode lifetime */
		spin_lock(&inode->i_lock);
		inode->i_opflags |= IOP_NOFOLLOW;
		spin_unlock(&inode->i_lock);
	}
	return 0;
}

1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296
static inline int walk_component(struct nameidata *nd, struct path *path,
		struct qstr *name, int type, int follow)
{
	struct inode *inode;
	int err;
	/*
	 * "." and ".." are special - ".." especially so because it has
	 * to be able to know about the current root directory and
	 * parent relationships.
	 */
	if (unlikely(type != LAST_NORM))
		return handle_dots(nd, type);
	err = do_lookup(nd, name, path, &inode);
	if (unlikely(err)) {
		terminate_walk(nd);
		return err;
	}
	if (!inode) {
		path_to_nameidata(path, nd);
		terminate_walk(nd);
		return -ENOENT;
	}
1297
	if (should_follow_link(inode, follow)) {
A
Al Viro 已提交
1298 1299 1300 1301 1302 1303
		if (nd->flags & LOOKUP_RCU) {
			if (unlikely(unlazy_walk(nd, path->dentry))) {
				terminate_walk(nd);
				return -ECHILD;
			}
		}
1304 1305 1306 1307 1308 1309 1310 1311
		BUG_ON(inode != path->dentry->d_inode);
		return 1;
	}
	path_to_nameidata(path, nd);
	nd->inode = inode;
	return 0;
}

1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327
/*
 * This limits recursive symlink follows to 8, while
 * limiting consecutive symlinks to 40.
 *
 * Without that kind of total limit, nasty chains of consecutive
 * symlinks can cause almost arbitrarily long lookups.
 */
static inline int nested_symlink(struct path *path, struct nameidata *nd)
{
	int res;

	if (unlikely(current->link_count >= MAX_NESTED_LINKS)) {
		path_put_conditional(path, nd);
		path_put(&nd->path);
		return -ELOOP;
	}
1328
	BUG_ON(nd->depth >= MAX_NESTED_LINKS);
1329 1330 1331 1332 1333 1334 1335

	nd->depth++;
	current->link_count++;

	do {
		struct path link = *path;
		void *cookie;
1336 1337

		res = follow_link(&link, nd, &cookie);
1338 1339 1340
		if (!res)
			res = walk_component(nd, path, &nd->last,
					     nd->last_type, LOOKUP_FOLLOW);
1341
		put_link(nd, &link, cookie);
1342 1343 1344 1345 1346 1347 1348
	} while (res > 0);

	current->link_count--;
	nd->depth--;
	return res;
}

1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368
/*
 * We really don't want to look at inode->i_op->lookup
 * when we don't have to. So we keep a cache bit in
 * the inode ->i_opflags field that says "yes, we can
 * do lookup on this inode".
 */
static inline int can_lookup(struct inode *inode)
{
	if (likely(inode->i_opflags & IOP_LOOKUP))
		return 1;
	if (likely(!inode->i_op->lookup))
		return 0;

	/* We do this once for the lifetime of the inode */
	spin_lock(&inode->i_lock);
	inode->i_opflags |= IOP_LOOKUP;
	spin_unlock(&inode->i_lock);
	return 1;
}

L
Linus Torvalds 已提交
1369 1370
/*
 * Name resolution.
1371 1372
 * This is the basic name resolution function, turning a pathname into
 * the final dentry. We expect 'base' to be positive and a directory.
L
Linus Torvalds 已提交
1373
 *
1374 1375
 * Returns 0 and nd will have valid dentry and mnt on success.
 * Returns error and drops reference to input namei data on failure.
L
Linus Torvalds 已提交
1376
 */
1377
static int link_path_walk(const char *name, struct nameidata *nd)
L
Linus Torvalds 已提交
1378 1379 1380 1381 1382 1383 1384
{
	struct path next;
	int err;
	
	while (*name=='/')
		name++;
	if (!*name)
1385
		return 0;
L
Linus Torvalds 已提交
1386 1387 1388 1389 1390 1391

	/* At this point we know we have a real path component. */
	for(;;) {
		unsigned long hash;
		struct qstr this;
		unsigned int c;
A
Al Viro 已提交
1392
		int type;
L
Linus Torvalds 已提交
1393

1394
		err = may_lookup(nd);
L
Linus Torvalds 已提交
1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409
 		if (err)
			break;

		this.name = name;
		c = *(const unsigned char *)name;

		hash = init_name_hash();
		do {
			name++;
			hash = partial_name_hash(c, hash);
			c = *(const unsigned char *)name;
		} while (c && (c != '/'));
		this.len = name - (const char *) this.name;
		this.hash = end_name_hash(hash);

A
Al Viro 已提交
1410 1411 1412
		type = LAST_NORM;
		if (this.name[0] == '.') switch (this.len) {
			case 2:
A
Al Viro 已提交
1413
				if (this.name[1] == '.') {
A
Al Viro 已提交
1414
					type = LAST_DOTDOT;
A
Al Viro 已提交
1415 1416
					nd->flags |= LOOKUP_JUMPED;
				}
A
Al Viro 已提交
1417 1418 1419 1420
				break;
			case 1:
				type = LAST_DOT;
		}
1421 1422
		if (likely(type == LAST_NORM)) {
			struct dentry *parent = nd->path.dentry;
A
Al Viro 已提交
1423
			nd->flags &= ~LOOKUP_JUMPED;
1424 1425 1426 1427 1428 1429 1430
			if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
				err = parent->d_op->d_hash(parent, nd->inode,
							   &this);
				if (err < 0)
					break;
			}
		}
A
Al Viro 已提交
1431

L
Linus Torvalds 已提交
1432 1433 1434 1435 1436
		/* remove trailing slashes? */
		if (!c)
			goto last_component;
		while (*++name == '/');
		if (!*name)
1437
			goto last_component;
L
Linus Torvalds 已提交
1438

1439 1440 1441
		err = walk_component(nd, &next, &this, type, LOOKUP_FOLLOW);
		if (err < 0)
			return err;
L
Linus Torvalds 已提交
1442

1443
		if (err) {
1444
			err = nested_symlink(&next, nd);
L
Linus Torvalds 已提交
1445
			if (err)
1446
				return err;
N
Nick Piggin 已提交
1447
		}
1448 1449
		if (can_lookup(nd->inode))
			continue;
L
Linus Torvalds 已提交
1450
		err = -ENOTDIR; 
1451
		break;
L
Linus Torvalds 已提交
1452 1453 1454
		/* here ends the main loop */

last_component:
1455 1456
		nd->last = this;
		nd->last_type = type;
1457
		return 0;
L
Linus Torvalds 已提交
1458
	}
1459
	terminate_walk(nd);
L
Linus Torvalds 已提交
1460 1461 1462
	return err;
}

A
Al Viro 已提交
1463 1464
static int path_init(int dfd, const char *name, unsigned int flags,
		     struct nameidata *nd, struct file **fp)
N
Nick Piggin 已提交
1465 1466 1467 1468 1469 1470
{
	int retval = 0;
	int fput_needed;
	struct file *file;

	nd->last_type = LAST_ROOT; /* if there are only slashes... */
A
Al Viro 已提交
1471
	nd->flags = flags | LOOKUP_JUMPED;
N
Nick Piggin 已提交
1472
	nd->depth = 0;
1473 1474
	if (flags & LOOKUP_ROOT) {
		struct inode *inode = nd->root.dentry->d_inode;
A
Al Viro 已提交
1475 1476 1477 1478 1479 1480 1481
		if (*name) {
			if (!inode->i_op->lookup)
				return -ENOTDIR;
			retval = inode_permission(inode, MAY_EXEC);
			if (retval)
				return retval;
		}
1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493
		nd->path = nd->root;
		nd->inode = inode;
		if (flags & LOOKUP_RCU) {
			br_read_lock(vfsmount_lock);
			rcu_read_lock();
			nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
		} else {
			path_get(&nd->path);
		}
		return 0;
	}

N
Nick Piggin 已提交
1494 1495 1496
	nd->root.mnt = NULL;

	if (*name=='/') {
A
Al Viro 已提交
1497 1498 1499 1500 1501 1502 1503 1504 1505
		if (flags & LOOKUP_RCU) {
			br_read_lock(vfsmount_lock);
			rcu_read_lock();
			set_root_rcu(nd);
		} else {
			set_root(nd);
			path_get(&nd->root);
		}
		nd->path = nd->root;
N
Nick Piggin 已提交
1506
	} else if (dfd == AT_FDCWD) {
A
Al Viro 已提交
1507 1508 1509
		if (flags & LOOKUP_RCU) {
			struct fs_struct *fs = current->fs;
			unsigned seq;
N
Nick Piggin 已提交
1510

A
Al Viro 已提交
1511 1512
			br_read_lock(vfsmount_lock);
			rcu_read_lock();
N
Nick Piggin 已提交
1513

A
Al Viro 已提交
1514 1515 1516 1517 1518 1519 1520 1521
			do {
				seq = read_seqcount_begin(&fs->seq);
				nd->path = fs->pwd;
				nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
			} while (read_seqcount_retry(&fs->seq, seq));
		} else {
			get_fs_pwd(current->fs, &nd->path);
		}
N
Nick Piggin 已提交
1522 1523 1524
	} else {
		struct dentry *dentry;

1525
		file = fget_raw_light(dfd, &fput_needed);
N
Nick Piggin 已提交
1526 1527 1528 1529 1530 1531
		retval = -EBADF;
		if (!file)
			goto out_fail;

		dentry = file->f_path.dentry;

A
Al Viro 已提交
1532 1533 1534 1535
		if (*name) {
			retval = -ENOTDIR;
			if (!S_ISDIR(dentry->d_inode->i_mode))
				goto fput_fail;
N
Nick Piggin 已提交
1536

1537
			retval = inode_permission(dentry->d_inode, MAY_EXEC);
A
Al Viro 已提交
1538 1539 1540
			if (retval)
				goto fput_fail;
		}
N
Nick Piggin 已提交
1541 1542

		nd->path = file->f_path;
A
Al Viro 已提交
1543 1544
		if (flags & LOOKUP_RCU) {
			if (fput_needed)
A
Al Viro 已提交
1545
				*fp = file;
A
Al Viro 已提交
1546 1547 1548 1549 1550 1551 1552
			nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
			br_read_lock(vfsmount_lock);
			rcu_read_lock();
		} else {
			path_get(&file->f_path);
			fput_light(file, fput_needed);
		}
N
Nick Piggin 已提交
1553 1554 1555
	}

	nd->inode = nd->path.dentry->d_inode;
1556
	return 0;
1557

1558 1559 1560 1561 1562 1563
fput_fail:
	fput_light(file, fput_needed);
out_fail:
	return retval;
}

1564 1565 1566 1567 1568 1569 1570 1571 1572 1573
static inline int lookup_last(struct nameidata *nd, struct path *path)
{
	if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
		nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;

	nd->flags &= ~LOOKUP_PARENT;
	return walk_component(nd, path, &nd->last, nd->last_type,
					nd->flags & LOOKUP_FOLLOW);
}

1574
/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
A
Al Viro 已提交
1575
static int path_lookupat(int dfd, const char *name,
1576 1577
				unsigned int flags, struct nameidata *nd)
{
A
Al Viro 已提交
1578
	struct file *base = NULL;
1579 1580
	struct path path;
	int err;
N
Nick Piggin 已提交
1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595

	/*
	 * Path walking is largely split up into 2 different synchronisation
	 * schemes, rcu-walk and ref-walk (explained in
	 * Documentation/filesystems/path-lookup.txt). These share much of the
	 * path walk code, but some things particularly setup, cleanup, and
	 * following mounts are sufficiently divergent that functions are
	 * duplicated. Typically there is a function foo(), and its RCU
	 * analogue, foo_rcu().
	 *
	 * -ECHILD is the error number of choice (just to avoid clashes) that
	 * is returned if some aspect of an rcu-walk fails. Such an error must
	 * be handled by restarting a traditional ref-walk (which will always
	 * be able to complete).
	 */
1596
	err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base);
A
Al Viro 已提交
1597

1598 1599
	if (unlikely(err))
		return err;
A
Al Viro 已提交
1600 1601

	current->total_link_count = 0;
1602 1603 1604 1605 1606 1607 1608 1609
	err = link_path_walk(name, nd);

	if (!err && !(flags & LOOKUP_PARENT)) {
		err = lookup_last(nd, &path);
		while (err > 0) {
			void *cookie;
			struct path link = path;
			nd->flags |= LOOKUP_PARENT;
1610
			err = follow_link(&link, nd, &cookie);
1611 1612
			if (!err)
				err = lookup_last(nd, &path);
1613
			put_link(nd, &link, cookie);
1614 1615
		}
	}
A
Al Viro 已提交
1616

1617 1618
	if (!err)
		err = complete_walk(nd);
1619 1620 1621 1622

	if (!err && nd->flags & LOOKUP_DIRECTORY) {
		if (!nd->inode->i_op->lookup) {
			path_put(&nd->path);
A
Al Viro 已提交
1623
			err = -ENOTDIR;
1624 1625
		}
	}
A
Al Viro 已提交
1626

A
Al Viro 已提交
1627 1628
	if (base)
		fput(base);
A
Al Viro 已提交
1629

1630
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
A
Al Viro 已提交
1631 1632 1633
		path_put(&nd->root);
		nd->root.mnt = NULL;
	}
1634
	return err;
A
Al Viro 已提交
1635
}
N
Nick Piggin 已提交
1636

A
Al Viro 已提交
1637 1638 1639 1640 1641 1642 1643 1644
static int do_path_lookup(int dfd, const char *name,
				unsigned int flags, struct nameidata *nd)
{
	int retval = path_lookupat(dfd, name, flags | LOOKUP_RCU, nd);
	if (unlikely(retval == -ECHILD))
		retval = path_lookupat(dfd, name, flags, nd);
	if (unlikely(retval == -ESTALE))
		retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
N
Nick Piggin 已提交
1645 1646 1647 1648 1649 1650 1651

	if (likely(!retval)) {
		if (unlikely(!audit_dummy_context())) {
			if (nd->path.dentry && nd->inode)
				audit_inode(name, nd->path.dentry);
		}
	}
1652
	return retval;
L
Linus Torvalds 已提交
1653 1654
}

A
Al Viro 已提交
1655
int kern_path_parent(const char *name, struct nameidata *nd)
1656
{
A
Al Viro 已提交
1657
	return do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, nd);
1658 1659
}

A
Al Viro 已提交
1660 1661 1662 1663 1664 1665 1666 1667 1668
int kern_path(const char *name, unsigned int flags, struct path *path)
{
	struct nameidata nd;
	int res = do_path_lookup(AT_FDCWD, name, flags, &nd);
	if (!res)
		*path = nd.path;
	return res;
}

1669 1670 1671 1672 1673 1674
/**
 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
 * @dentry:  pointer to dentry of the base directory
 * @mnt: pointer to vfs mount of the base directory
 * @name: pointer to file name
 * @flags: lookup flags
1675
 * @path: pointer to struct path to fill
1676 1677 1678
 */
int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
		    const char *name, unsigned int flags,
1679
		    struct path *path)
1680
{
1681 1682 1683 1684 1685
	struct nameidata nd;
	int err;
	nd.root.dentry = dentry;
	nd.root.mnt = mnt;
	BUG_ON(flags & LOOKUP_PARENT);
1686
	/* the first argument of do_path_lookup() is ignored with LOOKUP_ROOT */
1687 1688 1689 1690
	err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd);
	if (!err)
		*path = nd.path;
	return err;
1691 1692
}

1693 1694
static struct dentry *__lookup_hash(struct qstr *name,
		struct dentry *base, struct nameidata *nd)
L
Linus Torvalds 已提交
1695
{
1696
	struct inode *inode = base->d_inode;
1697
	struct dentry *dentry;
L
Linus Torvalds 已提交
1698 1699
	int err;

1700
	err = inode_permission(inode, MAY_EXEC);
1701 1702
	if (err)
		return ERR_PTR(err);
L
Linus Torvalds 已提交
1703

1704 1705 1706 1707
	/*
	 * Don't bother with __d_lookup: callers are for creat as
	 * well as unlink, so a lot of the time it would cost
	 * a double lookup.
A
Al Viro 已提交
1708
	 */
1709
	dentry = d_lookup(base, name);
A
Al Viro 已提交
1710

1711 1712 1713 1714 1715 1716 1717 1718 1719 1720
	if (dentry && d_need_lookup(dentry)) {
		/*
		 * __lookup_hash is called with the parent dir's i_mutex already
		 * held, so we are good to go here.
		 */
		dentry = d_inode_lookup(base, dentry, nd);
		if (IS_ERR(dentry))
			return dentry;
	}

1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738
	if (dentry && (dentry->d_flags & DCACHE_OP_REVALIDATE)) {
		int status = d_revalidate(dentry, nd);
		if (unlikely(status <= 0)) {
			/*
			 * The dentry failed validation.
			 * If d_revalidate returned 0 attempt to invalidate
			 * the dentry otherwise d_revalidate is asking us
			 * to return a fail status.
			 */
			if (status < 0) {
				dput(dentry);
				return ERR_PTR(status);
			} else if (!d_invalidate(dentry)) {
				dput(dentry);
				dentry = NULL;
			}
		}
	}
A
Al Viro 已提交
1739

1740 1741
	if (!dentry)
		dentry = d_alloc_and_lookup(base, name, nd);
1742

L
Linus Torvalds 已提交
1743 1744 1745
	return dentry;
}

1746 1747 1748 1749 1750
/*
 * Restricted form of lookup. Doesn't follow links, single-component only,
 * needs parent already locked. Doesn't follow mounts.
 * SMP-safe.
 */
1751
static struct dentry *lookup_hash(struct nameidata *nd)
1752
{
1753
	return __lookup_hash(&nd->last, nd->path.dentry, nd);
L
Linus Torvalds 已提交
1754 1755
}

1756
/**
1757
 * lookup_one_len - filesystem helper to lookup single pathname component
1758 1759 1760 1761
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
1762 1763
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.  Also note that by using this function the
1764 1765 1766
 * nameidata argument is passed to the filesystem methods and a filesystem
 * using this helper needs to be prepared for that.
 */
1767 1768 1769
struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
{
	struct qstr this;
A
Al Viro 已提交
1770 1771
	unsigned long hash;
	unsigned int c;
1772

1773 1774
	WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));

A
Al Viro 已提交
1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787
	this.name = name;
	this.len = len;
	if (!len)
		return ERR_PTR(-EACCES);

	hash = init_name_hash();
	while (len--) {
		c = *(const unsigned char *)name++;
		if (c == '/' || c == '\0')
			return ERR_PTR(-EACCES);
		hash = partial_name_hash(c, hash);
	}
	this.hash = end_name_hash(hash);
1788 1789 1790 1791 1792 1793 1794 1795 1796
	/*
	 * See if the low-level filesystem might want
	 * to use its own hash..
	 */
	if (base->d_flags & DCACHE_OP_HASH) {
		int err = base->d_op->d_hash(base, base->d_inode, &this);
		if (err < 0)
			return ERR_PTR(err);
	}
1797

1798
	return __lookup_hash(&this, base, NULL);
1799 1800
}

1801 1802
int user_path_at(int dfd, const char __user *name, unsigned flags,
		 struct path *path)
L
Linus Torvalds 已提交
1803
{
1804
	struct nameidata nd;
A
Al Viro 已提交
1805
	char *tmp = getname_flags(name, flags);
L
Linus Torvalds 已提交
1806 1807
	int err = PTR_ERR(tmp);
	if (!IS_ERR(tmp)) {
1808 1809 1810 1811

		BUG_ON(flags & LOOKUP_PARENT);

		err = do_path_lookup(dfd, tmp, flags, &nd);
L
Linus Torvalds 已提交
1812
		putname(tmp);
1813 1814
		if (!err)
			*path = nd.path;
L
Linus Torvalds 已提交
1815 1816 1817 1818
	}
	return err;
}

1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836
static int user_path_parent(int dfd, const char __user *path,
			struct nameidata *nd, char **name)
{
	char *s = getname(path);
	int error;

	if (IS_ERR(s))
		return PTR_ERR(s);

	error = do_path_lookup(dfd, s, LOOKUP_PARENT, nd);
	if (error)
		putname(s);
	else
		*name = s;

	return error;
}

L
Linus Torvalds 已提交
1837 1838 1839 1840 1841 1842
/*
 * It's inline, so penalty for filesystems that don't use sticky bit is
 * minimal.
 */
static inline int check_sticky(struct inode *dir, struct inode *inode)
{
1843 1844
	uid_t fsuid = current_fsuid();

L
Linus Torvalds 已提交
1845 1846
	if (!(dir->i_mode & S_ISVTX))
		return 0;
1847 1848
	if (current_user_ns() != inode_userns(inode))
		goto other_userns;
1849
	if (inode->i_uid == fsuid)
L
Linus Torvalds 已提交
1850
		return 0;
1851
	if (dir->i_uid == fsuid)
L
Linus Torvalds 已提交
1852
		return 0;
1853 1854 1855

other_userns:
	return !ns_capable(inode_userns(inode), CAP_FOWNER);
L
Linus Torvalds 已提交
1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876
}

/*
 *	Check whether we can remove a link victim from directory dir, check
 *  whether the type of victim is right.
 *  1. We can't do it if dir is read-only (done in permission())
 *  2. We should have write and exec permissions on dir
 *  3. We can't remove anything from append-only dir
 *  4. We can't do anything with immutable dir (done in permission())
 *  5. If the sticky bit on dir is set we should either
 *	a. be owner of dir, or
 *	b. be owner of victim, or
 *	c. have CAP_FOWNER capability
 *  6. If the victim is append-only or immutable we can't do antyhing with
 *     links pointing to it.
 *  7. If we were asked to remove a directory and victim isn't one - ENOTDIR.
 *  8. If we were asked to remove a non-directory and victim isn't one - EISDIR.
 *  9. We can't remove a root or mountpoint.
 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by
 *     nfs_async_unlink().
 */
1877
static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
L
Linus Torvalds 已提交
1878 1879 1880 1881 1882 1883 1884
{
	int error;

	if (!victim->d_inode)
		return -ENOENT;

	BUG_ON(victim->d_parent->d_inode != dir);
1885
	audit_inode_child(victim, dir);
L
Linus Torvalds 已提交
1886

1887
	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
1888 1889 1890 1891 1892
	if (error)
		return error;
	if (IS_APPEND(dir))
		return -EPERM;
	if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
H
Hugh Dickins 已提交
1893
	    IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
L
Linus Torvalds 已提交
1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916
		return -EPERM;
	if (isdir) {
		if (!S_ISDIR(victim->d_inode->i_mode))
			return -ENOTDIR;
		if (IS_ROOT(victim))
			return -EBUSY;
	} else if (S_ISDIR(victim->d_inode->i_mode))
		return -EISDIR;
	if (IS_DEADDIR(dir))
		return -ENOENT;
	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
		return -EBUSY;
	return 0;
}

/*	Check whether we can create an object with dentry child in directory
 *  dir.
 *  1. We can't do it if child already exists (open has special treatment for
 *     this case, but since we are inlined it's OK)
 *  2. We can't do it if dir is read-only (done in permission())
 *  3. We should have write and exec permissions on dir
 *  4. We can't do it if dir is immutable (done in permission())
 */
1917
static inline int may_create(struct inode *dir, struct dentry *child)
L
Linus Torvalds 已提交
1918 1919 1920 1921 1922
{
	if (child->d_inode)
		return -EEXIST;
	if (IS_DEADDIR(dir))
		return -ENOENT;
1923
	return inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
1924 1925 1926 1927 1928 1929 1930 1931 1932 1933
}

/*
 * p1 and p2 should be directories on the same fs.
 */
struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
{
	struct dentry *p;

	if (p1 == p2) {
I
Ingo Molnar 已提交
1934
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
L
Linus Torvalds 已提交
1935 1936 1937
		return NULL;
	}

1938
	mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
1939

1940 1941 1942 1943 1944
	p = d_ancestor(p2, p1);
	if (p) {
		mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT);
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD);
		return p;
L
Linus Torvalds 已提交
1945 1946
	}

1947 1948 1949 1950 1951
	p = d_ancestor(p1, p2);
	if (p) {
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
		mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
		return p;
L
Linus Torvalds 已提交
1952 1953
	}

I
Ingo Molnar 已提交
1954 1955
	mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
	mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
L
Linus Torvalds 已提交
1956 1957 1958 1959 1960
	return NULL;
}

void unlock_rename(struct dentry *p1, struct dentry *p2)
{
1961
	mutex_unlock(&p1->d_inode->i_mutex);
L
Linus Torvalds 已提交
1962
	if (p1 != p2) {
1963
		mutex_unlock(&p2->d_inode->i_mutex);
1964
		mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
1965 1966 1967 1968 1969 1970
	}
}

int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
		struct nameidata *nd)
{
1971
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
1972 1973 1974 1975

	if (error)
		return error;

A
Al Viro 已提交
1976
	if (!dir->i_op->create)
L
Linus Torvalds 已提交
1977 1978 1979 1980 1981 1982 1983
		return -EACCES;	/* shouldn't it be ENOSYS? */
	mode &= S_IALLUGO;
	mode |= S_IFREG;
	error = security_inode_create(dir, dentry, mode);
	if (error)
		return error;
	error = dir->i_op->create(dir, dentry, mode, nd);
1984
	if (!error)
1985
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
1986 1987 1988
	return error;
}

A
Al Viro 已提交
1989
static int may_open(struct path *path, int acc_mode, int flag)
L
Linus Torvalds 已提交
1990
{
1991
	struct dentry *dentry = path->dentry;
L
Linus Torvalds 已提交
1992 1993 1994
	struct inode *inode = dentry->d_inode;
	int error;

A
Al Viro 已提交
1995 1996 1997 1998
	/* O_PATH? */
	if (!acc_mode)
		return 0;

L
Linus Torvalds 已提交
1999 2000 2001
	if (!inode)
		return -ENOENT;

C
Christoph Hellwig 已提交
2002 2003
	switch (inode->i_mode & S_IFMT) {
	case S_IFLNK:
L
Linus Torvalds 已提交
2004
		return -ELOOP;
C
Christoph Hellwig 已提交
2005 2006 2007 2008 2009 2010
	case S_IFDIR:
		if (acc_mode & MAY_WRITE)
			return -EISDIR;
		break;
	case S_IFBLK:
	case S_IFCHR:
2011
		if (path->mnt->mnt_flags & MNT_NODEV)
L
Linus Torvalds 已提交
2012
			return -EACCES;
C
Christoph Hellwig 已提交
2013 2014 2015
		/*FALLTHRU*/
	case S_IFIFO:
	case S_IFSOCK:
L
Linus Torvalds 已提交
2016
		flag &= ~O_TRUNC;
C
Christoph Hellwig 已提交
2017
		break;
2018
	}
2019

2020
	error = inode_permission(inode, acc_mode);
2021 2022
	if (error)
		return error;
M
Mimi Zohar 已提交
2023

L
Linus Torvalds 已提交
2024 2025 2026 2027
	/*
	 * An append-only file must be opened in append mode for writing.
	 */
	if (IS_APPEND(inode)) {
2028
		if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
2029
			return -EPERM;
L
Linus Torvalds 已提交
2030
		if (flag & O_TRUNC)
2031
			return -EPERM;
L
Linus Torvalds 已提交
2032 2033 2034
	}

	/* O_NOATIME can only be set by the owner or superuser */
2035
	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
2036
		return -EPERM;
L
Linus Torvalds 已提交
2037

2038
	return 0;
2039
}
L
Linus Torvalds 已提交
2040

2041
static int handle_truncate(struct file *filp)
2042
{
2043
	struct path *path = &filp->f_path;
2044 2045 2046 2047 2048 2049 2050 2051 2052
	struct inode *inode = path->dentry->d_inode;
	int error = get_write_access(inode);
	if (error)
		return error;
	/*
	 * Refuse to truncate files with mandatory locks held on them.
	 */
	error = locks_verify_locked(inode);
	if (!error)
2053
		error = security_path_truncate(path);
2054 2055 2056
	if (!error) {
		error = do_truncate(path->dentry, 0,
				    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
2057
				    filp);
2058 2059
	}
	put_write_access(inode);
M
Mimi Zohar 已提交
2060
	return error;
L
Linus Torvalds 已提交
2061 2062
}

2063 2064
static inline int open_to_namei_flags(int flag)
{
2065 2066
	if ((flag & O_ACCMODE) == 3)
		flag--;
2067 2068 2069
	return flag;
}

N
Nick Piggin 已提交
2070
/*
2071
 * Handle the last step of open()
N
Nick Piggin 已提交
2072
 */
2073
static struct file *do_last(struct nameidata *nd, struct path *path,
2074
			    const struct open_flags *op, const char *pathname)
2075
{
2076
	struct dentry *dir = nd->path.dentry;
2077
	struct dentry *dentry;
2078
	int open_flag = op->open_flag;
2079
	int will_truncate = open_flag & O_TRUNC;
2080
	int want_write = 0;
A
Al Viro 已提交
2081
	int acc_mode = op->acc_mode;
2082
	struct file *filp;
A
Al Viro 已提交
2083
	int error;
2084

2085 2086 2087
	nd->flags &= ~LOOKUP_PARENT;
	nd->flags |= op->intent;

2088 2089
	switch (nd->last_type) {
	case LAST_DOTDOT:
2090
	case LAST_DOT:
2091 2092 2093
		error = handle_dots(nd, nd->last_type);
		if (error)
			return ERR_PTR(error);
2094 2095
		/* fallthrough */
	case LAST_ROOT:
2096
		error = complete_walk(nd);
A
Al Viro 已提交
2097
		if (error)
2098
			return ERR_PTR(error);
2099
		audit_inode(pathname, nd->path.dentry);
2100
		if (open_flag & O_CREAT) {
2101 2102 2103 2104
			error = -EISDIR;
			goto exit;
		}
		goto ok;
2105
	case LAST_BIND:
2106
		error = complete_walk(nd);
A
Al Viro 已提交
2107
		if (error)
2108
			return ERR_PTR(error);
2109
		audit_inode(pathname, dir);
2110
		goto ok;
2111
	}
2112

2113
	if (!(open_flag & O_CREAT)) {
A
Al Viro 已提交
2114
		int symlink_ok = 0;
2115 2116
		if (nd->last.name[nd->last.len])
			nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
A
Al Viro 已提交
2117 2118
		if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW))
			symlink_ok = 1;
2119
		/* we _can_ be in RCU mode here */
2120 2121 2122
		error = walk_component(nd, path, &nd->last, LAST_NORM,
					!symlink_ok);
		if (error < 0)
2123
			return ERR_PTR(error);
2124
		if (error) /* symlink */
2125 2126
			return NULL;
		/* sayonara */
2127 2128 2129
		error = complete_walk(nd);
		if (error)
			return ERR_PTR(-ECHILD);
2130 2131 2132

		error = -ENOTDIR;
		if (nd->flags & LOOKUP_DIRECTORY) {
2133
			if (!nd->inode->i_op->lookup)
2134 2135 2136 2137 2138 2139 2140
				goto exit;
		}
		audit_inode(pathname, nd->path.dentry);
		goto ok;
	}

	/* create side of things */
2141 2142 2143
	error = complete_walk(nd);
	if (error)
		return ERR_PTR(error);
2144 2145

	audit_inode(pathname, dir);
A
Al Viro 已提交
2146
	error = -EISDIR;
2147
	/* trailing slashes? */
N
Nick Piggin 已提交
2148 2149
	if (nd->last.name[nd->last.len])
		goto exit;
A
Al Viro 已提交
2150

2151 2152
	mutex_lock(&dir->d_inode->i_mutex);

2153 2154 2155
	dentry = lookup_hash(nd);
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry)) {
2156 2157 2158 2159
		mutex_unlock(&dir->d_inode->i_mutex);
		goto exit;
	}

2160 2161 2162
	path->dentry = dentry;
	path->mnt = nd->path.mnt;

2163
	/* Negative dentry, just create the file */
2164 2165 2166 2167
	if (!dentry->d_inode) {
		int mode = op->mode;
		if (!IS_POSIXACL(dir->d_inode))
			mode &= ~current_umask();
2168 2169
		/*
		 * This write is needed to ensure that a
2170
		 * rw->ro transition does not occur between
2171 2172 2173 2174 2175 2176 2177
		 * the time when the file is created and when
		 * a permanent write count is taken through
		 * the 'struct file' in nameidata_to_filp().
		 */
		error = mnt_want_write(nd->path.mnt);
		if (error)
			goto exit_mutex_unlock;
2178
		want_write = 1;
2179
		/* Don't check for write permission, don't truncate */
2180
		open_flag &= ~O_TRUNC;
2181
		will_truncate = 0;
A
Al Viro 已提交
2182
		acc_mode = MAY_OPEN;
2183 2184 2185 2186 2187 2188 2189 2190 2191
		error = security_path_mknod(&nd->path, dentry, mode, 0);
		if (error)
			goto exit_mutex_unlock;
		error = vfs_create(dir->d_inode, dentry, mode, nd);
		if (error)
			goto exit_mutex_unlock;
		mutex_unlock(&dir->d_inode->i_mutex);
		dput(nd->path.dentry);
		nd->path.dentry = dentry;
2192
		goto common;
2193 2194 2195 2196 2197 2198 2199 2200 2201
	}

	/*
	 * It already exists.
	 */
	mutex_unlock(&dir->d_inode->i_mutex);
	audit_inode(pathname, path->dentry);

	error = -EEXIST;
2202
	if (open_flag & O_EXCL)
2203 2204
		goto exit_dput;

2205 2206 2207
	error = follow_managed(path, nd->flags);
	if (error < 0)
		goto exit_dput;
2208 2209 2210 2211

	error = -ENOENT;
	if (!path->dentry->d_inode)
		goto exit_dput;
A
Al Viro 已提交
2212 2213

	if (path->dentry->d_inode->i_op->follow_link)
2214 2215 2216
		return NULL;

	path_to_nameidata(path, nd);
N
Nick Piggin 已提交
2217
	nd->inode = path->dentry->d_inode;
2218
	error = -EISDIR;
N
Nick Piggin 已提交
2219
	if (S_ISDIR(nd->inode->i_mode))
2220
		goto exit;
2221
ok:
2222 2223 2224
	if (!S_ISREG(nd->inode->i_mode))
		will_truncate = 0;

2225 2226 2227 2228
	if (will_truncate) {
		error = mnt_want_write(nd->path.mnt);
		if (error)
			goto exit;
2229
		want_write = 1;
2230
	}
2231
common:
A
Al Viro 已提交
2232
	error = may_open(&nd->path, acc_mode, open_flag);
2233
	if (error)
2234 2235 2236 2237 2238 2239 2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250 2251
		goto exit;
	filp = nameidata_to_filp(nd);
	if (!IS_ERR(filp)) {
		error = ima_file_check(filp, op->acc_mode);
		if (error) {
			fput(filp);
			filp = ERR_PTR(error);
		}
	}
	if (!IS_ERR(filp)) {
		if (will_truncate) {
			error = handle_truncate(filp);
			if (error) {
				fput(filp);
				filp = ERR_PTR(error);
			}
		}
	}
2252 2253
out:
	if (want_write)
2254 2255
		mnt_drop_write(nd->path.mnt);
	path_put(&nd->path);
2256 2257 2258 2259 2260 2261 2262
	return filp;

exit_mutex_unlock:
	mutex_unlock(&dir->d_inode->i_mutex);
exit_dput:
	path_put_conditional(path, nd);
exit:
2263 2264
	filp = ERR_PTR(error);
	goto out;
2265 2266
}

2267
static struct file *path_openat(int dfd, const char *pathname,
A
Al Viro 已提交
2268
		struct nameidata *nd, const struct open_flags *op, int flags)
L
Linus Torvalds 已提交
2269
{
2270
	struct file *base = NULL;
2271
	struct file *filp;
2272
	struct path path;
2273
	int error;
N
Nick Piggin 已提交
2274 2275 2276 2277 2278

	filp = get_empty_filp();
	if (!filp)
		return ERR_PTR(-ENFILE);

2279
	filp->f_flags = op->open_flag;
A
Al Viro 已提交
2280 2281 2282
	nd->intent.open.file = filp;
	nd->intent.open.flags = open_to_namei_flags(op->open_flag);
	nd->intent.open.create_mode = op->mode;
N
Nick Piggin 已提交
2283

A
Al Viro 已提交
2284
	error = path_init(dfd, pathname, flags | LOOKUP_PARENT, nd, &base);
N
Nick Piggin 已提交
2285
	if (unlikely(error))
2286
		goto out_filp;
N
Nick Piggin 已提交
2287

2288
	current->total_link_count = 0;
A
Al Viro 已提交
2289
	error = link_path_walk(pathname, nd);
N
Nick Piggin 已提交
2290 2291
	if (unlikely(error))
		goto out_filp;
L
Linus Torvalds 已提交
2292

A
Al Viro 已提交
2293
	filp = do_last(nd, &path, op, pathname);
2294
	while (unlikely(!filp)) { /* trailing symlink */
2295
		struct path link = path;
A
Al Viro 已提交
2296
		void *cookie;
2297
		if (!(nd->flags & LOOKUP_FOLLOW)) {
A
Al Viro 已提交
2298 2299
			path_put_conditional(&path, nd);
			path_put(&nd->path);
2300 2301 2302
			filp = ERR_PTR(-ELOOP);
			break;
		}
A
Al Viro 已提交
2303 2304
		nd->flags |= LOOKUP_PARENT;
		nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
2305
		error = follow_link(&link, nd, &cookie);
2306
		if (unlikely(error))
2307
			filp = ERR_PTR(error);
2308
		else
A
Al Viro 已提交
2309
			filp = do_last(nd, &path, op, pathname);
2310
		put_link(nd, &link, cookie);
2311
	}
A
Al Viro 已提交
2312
out:
A
Al Viro 已提交
2313 2314
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT))
		path_put(&nd->root);
2315 2316
	if (base)
		fput(base);
A
Al Viro 已提交
2317
	release_open_intent(nd);
A
Al Viro 已提交
2318
	return filp;
L
Linus Torvalds 已提交
2319

N
Nick Piggin 已提交
2320
out_filp:
2321
	filp = ERR_PTR(error);
A
Al Viro 已提交
2322
	goto out;
L
Linus Torvalds 已提交
2323 2324
}

2325 2326 2327
struct file *do_filp_open(int dfd, const char *pathname,
		const struct open_flags *op, int flags)
{
A
Al Viro 已提交
2328
	struct nameidata nd;
2329 2330
	struct file *filp;

A
Al Viro 已提交
2331
	filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU);
2332
	if (unlikely(filp == ERR_PTR(-ECHILD)))
A
Al Viro 已提交
2333
		filp = path_openat(dfd, pathname, &nd, op, flags);
2334
	if (unlikely(filp == ERR_PTR(-ESTALE)))
A
Al Viro 已提交
2335
		filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL);
2336 2337 2338
	return filp;
}

A
Al Viro 已提交
2339 2340 2341 2342 2343 2344 2345 2346 2347 2348 2349
struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
		const char *name, const struct open_flags *op, int flags)
{
	struct nameidata nd;
	struct file *file;

	nd.root.mnt = mnt;
	nd.root.dentry = dentry;

	flags |= LOOKUP_ROOT;

A
Al Viro 已提交
2350
	if (dentry->d_inode->i_op->follow_link && op->intent & LOOKUP_OPEN)
A
Al Viro 已提交
2351 2352 2353 2354 2355 2356 2357 2358 2359 2360
		return ERR_PTR(-ELOOP);

	file = path_openat(-1, name, &nd, op, flags | LOOKUP_RCU);
	if (unlikely(file == ERR_PTR(-ECHILD)))
		file = path_openat(-1, name, &nd, op, flags);
	if (unlikely(file == ERR_PTR(-ESTALE)))
		file = path_openat(-1, name, &nd, op, flags | LOOKUP_REVAL);
	return file;
}

A
Al Viro 已提交
2361
struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path, int is_dir)
L
Linus Torvalds 已提交
2362
{
2363
	struct dentry *dentry = ERR_PTR(-EEXIST);
A
Al Viro 已提交
2364 2365 2366 2367
	struct nameidata nd;
	int error = do_path_lookup(dfd, pathname, LOOKUP_PARENT, &nd);
	if (error)
		return ERR_PTR(error);
L
Linus Torvalds 已提交
2368

2369 2370 2371 2372
	/*
	 * Yucky last component or no last component at all?
	 * (foo/., foo/.., /////)
	 */
A
Al Viro 已提交
2373 2374 2375 2376 2377
	if (nd.last_type != LAST_NORM)
		goto out;
	nd.flags &= ~LOOKUP_PARENT;
	nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL;
	nd.intent.open.flags = O_EXCL;
2378 2379 2380 2381

	/*
	 * Do the final lookup.
	 */
A
Al Viro 已提交
2382 2383
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
	dentry = lookup_hash(&nd);
L
Linus Torvalds 已提交
2384 2385
	if (IS_ERR(dentry))
		goto fail;
2386

2387 2388
	if (dentry->d_inode)
		goto eexist;
2389 2390 2391 2392 2393 2394
	/*
	 * Special case - lookup gave negative, but... we had foo/bar/
	 * From the vfs_mknod() POV we just have a negative dentry -
	 * all is fine. Let's be bastards - you had / on the end, you've
	 * been asking for (non-existent) directory. -ENOENT for you.
	 */
A
Al Viro 已提交
2395
	if (unlikely(!is_dir && nd.last.name[nd.last.len])) {
2396 2397
		dput(dentry);
		dentry = ERR_PTR(-ENOENT);
A
Al Viro 已提交
2398
		goto fail;
2399
	}
A
Al Viro 已提交
2400
	*path = nd.path;
L
Linus Torvalds 已提交
2401
	return dentry;
2402
eexist:
L
Linus Torvalds 已提交
2403
	dput(dentry);
2404
	dentry = ERR_PTR(-EEXIST);
L
Linus Torvalds 已提交
2405
fail:
A
Al Viro 已提交
2406 2407 2408
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
out:
	path_put(&nd.path);
L
Linus Torvalds 已提交
2409 2410
	return dentry;
}
2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424
EXPORT_SYMBOL(kern_path_create);

struct dentry *user_path_create(int dfd, const char __user *pathname, struct path *path, int is_dir)
{
	char *tmp = getname(pathname);
	struct dentry *res;
	if (IS_ERR(tmp))
		return ERR_CAST(tmp);
	res = kern_path_create(dfd, tmp, path, is_dir);
	putname(tmp);
	return res;
}
EXPORT_SYMBOL(user_path_create);

L
Linus Torvalds 已提交
2425 2426
int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
{
2427
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2428 2429 2430 2431

	if (error)
		return error;

2432 2433
	if ((S_ISCHR(mode) || S_ISBLK(mode)) &&
	    !ns_capable(inode_userns(dir), CAP_MKNOD))
L
Linus Torvalds 已提交
2434 2435
		return -EPERM;

A
Al Viro 已提交
2436
	if (!dir->i_op->mknod)
L
Linus Torvalds 已提交
2437 2438
		return -EPERM;

2439 2440 2441 2442
	error = devcgroup_inode_mknod(mode, dev);
	if (error)
		return error;

L
Linus Torvalds 已提交
2443 2444 2445 2446 2447
	error = security_inode_mknod(dir, dentry, mode, dev);
	if (error)
		return error;

	error = dir->i_op->mknod(dir, dentry, mode, dev);
2448
	if (!error)
2449
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
2450 2451 2452
	return error;
}

2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469
static int may_mknod(mode_t mode)
{
	switch (mode & S_IFMT) {
	case S_IFREG:
	case S_IFCHR:
	case S_IFBLK:
	case S_IFIFO:
	case S_IFSOCK:
	case 0: /* zero mode translates to S_IFREG */
		return 0;
	case S_IFDIR:
		return -EPERM;
	default:
		return -EINVAL;
	}
}

2470 2471
SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
		unsigned, dev)
L
Linus Torvalds 已提交
2472
{
2473
	struct dentry *dentry;
2474 2475
	struct path path;
	int error;
L
Linus Torvalds 已提交
2476 2477 2478 2479

	if (S_ISDIR(mode))
		return -EPERM;

2480 2481 2482
	dentry = user_path_create(dfd, filename, &path, 0);
	if (IS_ERR(dentry))
		return PTR_ERR(dentry);
2483

2484
	if (!IS_POSIXACL(path.dentry->d_inode))
A
Al Viro 已提交
2485
		mode &= ~current_umask();
2486 2487 2488
	error = may_mknod(mode);
	if (error)
		goto out_dput;
2489
	error = mnt_want_write(path.mnt);
2490 2491
	if (error)
		goto out_dput;
2492
	error = security_path_mknod(&path, dentry, mode, dev);
2493 2494
	if (error)
		goto out_drop_write;
2495
	switch (mode & S_IFMT) {
L
Linus Torvalds 已提交
2496
		case 0: case S_IFREG:
2497
			error = vfs_create(path.dentry->d_inode,dentry,mode,NULL);
L
Linus Torvalds 已提交
2498 2499
			break;
		case S_IFCHR: case S_IFBLK:
2500
			error = vfs_mknod(path.dentry->d_inode,dentry,mode,
L
Linus Torvalds 已提交
2501 2502 2503
					new_decode_dev(dev));
			break;
		case S_IFIFO: case S_IFSOCK:
2504
			error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
L
Linus Torvalds 已提交
2505 2506
			break;
	}
2507
out_drop_write:
2508
	mnt_drop_write(path.mnt);
2509 2510
out_dput:
	dput(dentry);
2511 2512
	mutex_unlock(&path.dentry->d_inode->i_mutex);
	path_put(&path);
L
Linus Torvalds 已提交
2513 2514 2515 2516

	return error;
}

2517
SYSCALL_DEFINE3(mknod, const char __user *, filename, int, mode, unsigned, dev)
2518 2519 2520 2521
{
	return sys_mknodat(AT_FDCWD, filename, mode, dev);
}

L
Linus Torvalds 已提交
2522 2523
int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
{
2524
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2525 2526 2527 2528

	if (error)
		return error;

A
Al Viro 已提交
2529
	if (!dir->i_op->mkdir)
L
Linus Torvalds 已提交
2530 2531 2532 2533 2534 2535 2536 2537
		return -EPERM;

	mode &= (S_IRWXUGO|S_ISVTX);
	error = security_inode_mkdir(dir, dentry, mode);
	if (error)
		return error;

	error = dir->i_op->mkdir(dir, dentry, mode);
2538
	if (!error)
2539
		fsnotify_mkdir(dir, dentry);
L
Linus Torvalds 已提交
2540 2541 2542
	return error;
}

2543
SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
L
Linus Torvalds 已提交
2544
{
2545
	struct dentry *dentry;
2546 2547
	struct path path;
	int error;
L
Linus Torvalds 已提交
2548

2549
	dentry = user_path_create(dfd, pathname, &path, 1);
2550
	if (IS_ERR(dentry))
2551
		return PTR_ERR(dentry);
L
Linus Torvalds 已提交
2552

2553
	if (!IS_POSIXACL(path.dentry->d_inode))
A
Al Viro 已提交
2554
		mode &= ~current_umask();
2555
	error = mnt_want_write(path.mnt);
2556 2557
	if (error)
		goto out_dput;
2558
	error = security_path_mkdir(&path, dentry, mode);
2559 2560
	if (error)
		goto out_drop_write;
2561
	error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
2562
out_drop_write:
2563
	mnt_drop_write(path.mnt);
2564
out_dput:
2565
	dput(dentry);
2566 2567
	mutex_unlock(&path.dentry->d_inode->i_mutex);
	path_put(&path);
L
Linus Torvalds 已提交
2568 2569 2570
	return error;
}

2571
SYSCALL_DEFINE2(mkdir, const char __user *, pathname, int, mode)
2572 2573 2574 2575
{
	return sys_mkdirat(AT_FDCWD, pathname, mode);
}

L
Linus Torvalds 已提交
2576
/*
S
Sage Weil 已提交
2577 2578 2579 2580
 * The dentry_unhash() helper will try to drop the dentry early: we
 * should have a usage count of 2 if we're the only user of this
 * dentry, and if that is true (possibly after pruning the dcache),
 * then we drop the dentry now.
L
Linus Torvalds 已提交
2581 2582 2583 2584 2585 2586 2587 2588 2589 2590 2591 2592
 *
 * A low-level filesystem can, if it choses, legally
 * do a
 *
 *	if (!d_unhashed(dentry))
 *		return -EBUSY;
 *
 * if it cannot handle the case of removing a directory
 * that is still in use by something else..
 */
void dentry_unhash(struct dentry *dentry)
{
2593
	shrink_dcache_parent(dentry);
L
Linus Torvalds 已提交
2594
	spin_lock(&dentry->d_lock);
2595
	if (dentry->d_count == 1)
L
Linus Torvalds 已提交
2596 2597 2598 2599 2600 2601 2602 2603 2604 2605 2606
		__d_drop(dentry);
	spin_unlock(&dentry->d_lock);
}

int vfs_rmdir(struct inode *dir, struct dentry *dentry)
{
	int error = may_delete(dir, dentry, 1);

	if (error)
		return error;

A
Al Viro 已提交
2607
	if (!dir->i_op->rmdir)
L
Linus Torvalds 已提交
2608 2609
		return -EPERM;

2610
	dget(dentry);
2611
	mutex_lock(&dentry->d_inode->i_mutex);
S
Sage Weil 已提交
2612 2613

	error = -EBUSY;
L
Linus Torvalds 已提交
2614
	if (d_mountpoint(dentry))
S
Sage Weil 已提交
2615 2616 2617 2618 2619 2620
		goto out;

	error = security_inode_rmdir(dir, dentry);
	if (error)
		goto out;

2621
	shrink_dcache_parent(dentry);
S
Sage Weil 已提交
2622 2623 2624 2625 2626 2627 2628 2629
	error = dir->i_op->rmdir(dir, dentry);
	if (error)
		goto out;

	dentry->d_inode->i_flags |= S_DEAD;
	dont_mount(dentry);

out:
2630
	mutex_unlock(&dentry->d_inode->i_mutex);
2631
	dput(dentry);
S
Sage Weil 已提交
2632
	if (!error)
L
Linus Torvalds 已提交
2633 2634 2635 2636
		d_delete(dentry);
	return error;
}

2637
static long do_rmdir(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
2638 2639 2640 2641 2642 2643
{
	int error = 0;
	char * name;
	struct dentry *dentry;
	struct nameidata nd;

2644
	error = user_path_parent(dfd, pathname, &nd, &name);
L
Linus Torvalds 已提交
2645
	if (error)
2646
		return error;
L
Linus Torvalds 已提交
2647 2648

	switch(nd.last_type) {
2649 2650 2651 2652 2653 2654 2655 2656 2657
	case LAST_DOTDOT:
		error = -ENOTEMPTY;
		goto exit1;
	case LAST_DOT:
		error = -EINVAL;
		goto exit1;
	case LAST_ROOT:
		error = -EBUSY;
		goto exit1;
L
Linus Torvalds 已提交
2658
	}
2659 2660 2661

	nd.flags &= ~LOOKUP_PARENT;

2662
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2663
	dentry = lookup_hash(&nd);
L
Linus Torvalds 已提交
2664
	error = PTR_ERR(dentry);
2665 2666
	if (IS_ERR(dentry))
		goto exit2;
2667 2668 2669 2670
	if (!dentry->d_inode) {
		error = -ENOENT;
		goto exit3;
	}
2671 2672 2673
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto exit3;
2674 2675 2676
	error = security_path_rmdir(&nd.path, dentry);
	if (error)
		goto exit4;
2677
	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
2678
exit4:
2679 2680
	mnt_drop_write(nd.path.mnt);
exit3:
2681 2682
	dput(dentry);
exit2:
2683
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2684
exit1:
J
Jan Blunck 已提交
2685
	path_put(&nd.path);
L
Linus Torvalds 已提交
2686 2687 2688 2689
	putname(name);
	return error;
}

2690
SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
2691 2692 2693 2694
{
	return do_rmdir(AT_FDCWD, pathname);
}

L
Linus Torvalds 已提交
2695 2696 2697 2698 2699 2700 2701
int vfs_unlink(struct inode *dir, struct dentry *dentry)
{
	int error = may_delete(dir, dentry, 0);

	if (error)
		return error;

A
Al Viro 已提交
2702
	if (!dir->i_op->unlink)
L
Linus Torvalds 已提交
2703 2704
		return -EPERM;

2705
	mutex_lock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2706 2707 2708 2709
	if (d_mountpoint(dentry))
		error = -EBUSY;
	else {
		error = security_inode_unlink(dir, dentry);
2710
		if (!error) {
L
Linus Torvalds 已提交
2711
			error = dir->i_op->unlink(dir, dentry);
2712
			if (!error)
2713
				dont_mount(dentry);
2714
		}
L
Linus Torvalds 已提交
2715
	}
2716
	mutex_unlock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2717 2718 2719

	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
	if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
2720
		fsnotify_link_count(dentry->d_inode);
J
John McCutchan 已提交
2721
		d_delete(dentry);
L
Linus Torvalds 已提交
2722
	}
R
Robert Love 已提交
2723

L
Linus Torvalds 已提交
2724 2725 2726 2727 2728
	return error;
}

/*
 * Make sure that the actual truncation of the file will occur outside its
2729
 * directory's i_mutex.  Truncate can take a long time if there is a lot of
L
Linus Torvalds 已提交
2730 2731 2732
 * writeout happening, and we don't want to prevent access to the directory
 * while waiting on the I/O.
 */
2733
static long do_unlinkat(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
2734
{
2735 2736
	int error;
	char *name;
L
Linus Torvalds 已提交
2737 2738 2739 2740
	struct dentry *dentry;
	struct nameidata nd;
	struct inode *inode = NULL;

2741
	error = user_path_parent(dfd, pathname, &nd, &name);
L
Linus Torvalds 已提交
2742
	if (error)
2743 2744
		return error;

L
Linus Torvalds 已提交
2745 2746 2747
	error = -EISDIR;
	if (nd.last_type != LAST_NORM)
		goto exit1;
2748 2749 2750

	nd.flags &= ~LOOKUP_PARENT;

2751
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2752
	dentry = lookup_hash(&nd);
L
Linus Torvalds 已提交
2753 2754 2755
	error = PTR_ERR(dentry);
	if (!IS_ERR(dentry)) {
		/* Why not before? Because we want correct error value */
2756 2757
		if (nd.last.name[nd.last.len])
			goto slashes;
L
Linus Torvalds 已提交
2758
		inode = dentry->d_inode;
2759
		if (!inode)
2760 2761
			goto slashes;
		ihold(inode);
2762 2763 2764
		error = mnt_want_write(nd.path.mnt);
		if (error)
			goto exit2;
2765 2766 2767
		error = security_path_unlink(&nd.path, dentry);
		if (error)
			goto exit3;
2768
		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
2769
exit3:
2770
		mnt_drop_write(nd.path.mnt);
L
Linus Torvalds 已提交
2771 2772 2773
	exit2:
		dput(dentry);
	}
2774
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2775 2776 2777
	if (inode)
		iput(inode);	/* truncate the inode here */
exit1:
J
Jan Blunck 已提交
2778
	path_put(&nd.path);
L
Linus Torvalds 已提交
2779 2780 2781 2782 2783 2784 2785 2786 2787
	putname(name);
	return error;

slashes:
	error = !dentry->d_inode ? -ENOENT :
		S_ISDIR(dentry->d_inode->i_mode) ? -EISDIR : -ENOTDIR;
	goto exit2;
}

2788
SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
2789 2790 2791 2792 2793 2794 2795 2796 2797 2798
{
	if ((flag & ~AT_REMOVEDIR) != 0)
		return -EINVAL;

	if (flag & AT_REMOVEDIR)
		return do_rmdir(dfd, pathname);

	return do_unlinkat(dfd, pathname);
}

2799
SYSCALL_DEFINE1(unlink, const char __user *, pathname)
2800 2801 2802 2803
{
	return do_unlinkat(AT_FDCWD, pathname);
}

2804
int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
L
Linus Torvalds 已提交
2805
{
2806
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2807 2808 2809 2810

	if (error)
		return error;

A
Al Viro 已提交
2811
	if (!dir->i_op->symlink)
L
Linus Torvalds 已提交
2812 2813 2814 2815 2816 2817 2818
		return -EPERM;

	error = security_inode_symlink(dir, dentry, oldname);
	if (error)
		return error;

	error = dir->i_op->symlink(dir, dentry, oldname);
2819
	if (!error)
2820
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
2821 2822 2823
	return error;
}

2824 2825
SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
L
Linus Torvalds 已提交
2826
{
2827 2828
	int error;
	char *from;
2829
	struct dentry *dentry;
2830
	struct path path;
L
Linus Torvalds 已提交
2831 2832

	from = getname(oldname);
2833
	if (IS_ERR(from))
L
Linus Torvalds 已提交
2834 2835
		return PTR_ERR(from);

2836
	dentry = user_path_create(newdfd, newname, &path, 0);
2837 2838
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry))
2839
		goto out_putname;
2840

2841
	error = mnt_want_write(path.mnt);
2842 2843
	if (error)
		goto out_dput;
2844
	error = security_path_symlink(&path, dentry, from);
2845 2846
	if (error)
		goto out_drop_write;
2847
	error = vfs_symlink(path.dentry->d_inode, dentry, from);
2848
out_drop_write:
2849
	mnt_drop_write(path.mnt);
2850
out_dput:
2851
	dput(dentry);
2852 2853
	mutex_unlock(&path.dentry->d_inode->i_mutex);
	path_put(&path);
2854
out_putname:
L
Linus Torvalds 已提交
2855 2856 2857 2858
	putname(from);
	return error;
}

2859
SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
2860 2861 2862 2863
{
	return sys_symlinkat(oldname, AT_FDCWD, newname);
}

L
Linus Torvalds 已提交
2864 2865 2866 2867 2868 2869 2870 2871
int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
{
	struct inode *inode = old_dentry->d_inode;
	int error;

	if (!inode)
		return -ENOENT;

2872
	error = may_create(dir, new_dentry);
L
Linus Torvalds 已提交
2873 2874 2875 2876 2877 2878 2879 2880 2881 2882 2883
	if (error)
		return error;

	if (dir->i_sb != inode->i_sb)
		return -EXDEV;

	/*
	 * A link to an append-only or immutable file cannot be created.
	 */
	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
		return -EPERM;
A
Al Viro 已提交
2884
	if (!dir->i_op->link)
L
Linus Torvalds 已提交
2885
		return -EPERM;
2886
	if (S_ISDIR(inode->i_mode))
L
Linus Torvalds 已提交
2887 2888 2889 2890 2891 2892
		return -EPERM;

	error = security_inode_link(old_dentry, dir, new_dentry);
	if (error)
		return error;

2893
	mutex_lock(&inode->i_mutex);
2894 2895 2896 2897 2898
	/* Make sure we don't allow creating hardlink to an unlinked file */
	if (inode->i_nlink == 0)
		error =  -ENOENT;
	else
		error = dir->i_op->link(old_dentry, dir, new_dentry);
2899
	mutex_unlock(&inode->i_mutex);
2900
	if (!error)
2901
		fsnotify_link(dir, inode, new_dentry);
L
Linus Torvalds 已提交
2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913
	return error;
}

/*
 * Hardlinks are often used in delicate situations.  We avoid
 * security-related surprises by not following symlinks on the
 * newname.  --KAB
 *
 * We don't follow them on the oldname either to be compatible
 * with linux 2.0, and to avoid hard-linking to directories
 * and other special files.  --ADM
 */
2914 2915
SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname, int, flags)
L
Linus Torvalds 已提交
2916 2917
{
	struct dentry *new_dentry;
2918
	struct path old_path, new_path;
2919
	int how = 0;
L
Linus Torvalds 已提交
2920 2921
	int error;

2922
	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
2923
		return -EINVAL;
2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936
	/*
	 * To use null names we require CAP_DAC_READ_SEARCH
	 * This ensures that not everyone will be able to create
	 * handlink using the passed filedescriptor.
	 */
	if (flags & AT_EMPTY_PATH) {
		if (!capable(CAP_DAC_READ_SEARCH))
			return -ENOENT;
		how = LOOKUP_EMPTY;
	}

	if (flags & AT_SYMLINK_FOLLOW)
		how |= LOOKUP_FOLLOW;
2937

2938
	error = user_path_at(olddfd, oldname, how, &old_path);
L
Linus Torvalds 已提交
2939
	if (error)
2940 2941
		return error;

2942
	new_dentry = user_path_create(newdfd, newname, &new_path, 0);
L
Linus Torvalds 已提交
2943
	error = PTR_ERR(new_dentry);
2944
	if (IS_ERR(new_dentry))
2945 2946 2947 2948 2949 2950
		goto out;

	error = -EXDEV;
	if (old_path.mnt != new_path.mnt)
		goto out_dput;
	error = mnt_want_write(new_path.mnt);
2951 2952
	if (error)
		goto out_dput;
2953
	error = security_path_link(old_path.dentry, &new_path, new_dentry);
2954 2955
	if (error)
		goto out_drop_write;
2956
	error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry);
2957
out_drop_write:
2958
	mnt_drop_write(new_path.mnt);
2959
out_dput:
2960
	dput(new_dentry);
2961 2962
	mutex_unlock(&new_path.dentry->d_inode->i_mutex);
	path_put(&new_path);
L
Linus Torvalds 已提交
2963
out:
2964
	path_put(&old_path);
L
Linus Torvalds 已提交
2965 2966 2967 2968

	return error;
}

2969
SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
2970
{
2971
	return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
2972 2973
}

L
Linus Torvalds 已提交
2974 2975 2976 2977 2978 2979 2980
/*
 * The worst of all namespace operations - renaming directory. "Perverted"
 * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
 * Problems:
 *	a) we can get into loop creation. Check is done in is_subdir().
 *	b) race potential - two innocent renames can create a loop together.
 *	   That's where 4.4 screws up. Current fix: serialization on
2981
 *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
L
Linus Torvalds 已提交
2982 2983
 *	   story.
 *	c) we have to lock _three_ objects - parents and victim (if it exists).
2984
 *	   And that - after we got ->i_mutex on parents (until then we don't know
L
Linus Torvalds 已提交
2985 2986
 *	   whether the target exists).  Solution: try to be smart with locking
 *	   order for inodes.  We rely on the fact that tree topology may change
2987
 *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
L
Linus Torvalds 已提交
2988 2989 2990
 *	   move will be locked.  Thus we can rank directories by the tree
 *	   (ancestors first) and rank all non-directories after them.
 *	   That works since everybody except rename does "lock parent, lookup,
2991
 *	   lock child" and rename is under ->s_vfs_rename_mutex.
L
Linus Torvalds 已提交
2992 2993 2994
 *	   HOWEVER, it relies on the assumption that any object with ->lookup()
 *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
 *	   we'd better make sure that there's no link(2) for them.
2995
 *	d) conversion from fhandle to dentry may come in the wrong moment - when
2996
 *	   we are removing the target. Solution: we will have to grab ->i_mutex
L
Linus Torvalds 已提交
2997
 *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
2998
 *	   ->i_mutex on parents, which works but leads to some truly excessive
L
Linus Torvalds 已提交
2999 3000
 *	   locking].
 */
A
Adrian Bunk 已提交
3001 3002
static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
			  struct inode *new_dir, struct dentry *new_dentry)
L
Linus Torvalds 已提交
3003 3004
{
	int error = 0;
S
Sage Weil 已提交
3005
	struct inode *target = new_dentry->d_inode;
L
Linus Torvalds 已提交
3006 3007 3008 3009 3010 3011

	/*
	 * If we are going to change the parent - check write permissions,
	 * we'll need to flip '..'.
	 */
	if (new_dir != old_dir) {
3012
		error = inode_permission(old_dentry->d_inode, MAY_WRITE);
L
Linus Torvalds 已提交
3013 3014 3015 3016 3017 3018 3019 3020
		if (error)
			return error;
	}

	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		return error;

3021
	dget(new_dentry);
3022
	if (target)
3023
		mutex_lock(&target->i_mutex);
S
Sage Weil 已提交
3024 3025 3026 3027 3028

	error = -EBUSY;
	if (d_mountpoint(old_dentry) || d_mountpoint(new_dentry))
		goto out;

3029 3030
	if (target)
		shrink_dcache_parent(new_dentry);
S
Sage Weil 已提交
3031 3032 3033 3034
	error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		goto out;

L
Linus Torvalds 已提交
3035
	if (target) {
S
Sage Weil 已提交
3036 3037
		target->i_flags |= S_DEAD;
		dont_mount(new_dentry);
L
Linus Torvalds 已提交
3038
	}
S
Sage Weil 已提交
3039 3040 3041
out:
	if (target)
		mutex_unlock(&target->i_mutex);
3042
	dput(new_dentry);
3043
	if (!error)
3044 3045
		if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
			d_move(old_dentry,new_dentry);
L
Linus Torvalds 已提交
3046 3047 3048
	return error;
}

A
Adrian Bunk 已提交
3049 3050
static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
			    struct inode *new_dir, struct dentry *new_dentry)
L
Linus Torvalds 已提交
3051
{
S
Sage Weil 已提交
3052
	struct inode *target = new_dentry->d_inode;
L
Linus Torvalds 已提交
3053 3054 3055 3056 3057 3058 3059 3060
	int error;

	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		return error;

	dget(new_dentry);
	if (target)
3061
		mutex_lock(&target->i_mutex);
S
Sage Weil 已提交
3062 3063

	error = -EBUSY;
L
Linus Torvalds 已提交
3064
	if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
S
Sage Weil 已提交
3065 3066 3067 3068 3069 3070 3071 3072 3073 3074 3075
		goto out;

	error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		goto out;

	if (target)
		dont_mount(new_dentry);
	if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
		d_move(old_dentry, new_dentry);
out:
L
Linus Torvalds 已提交
3076
	if (target)
3077
		mutex_unlock(&target->i_mutex);
L
Linus Torvalds 已提交
3078 3079 3080 3081 3082 3083 3084 3085 3086
	dput(new_dentry);
	return error;
}

int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
	       struct inode *new_dir, struct dentry *new_dentry)
{
	int error;
	int is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
3087
	const unsigned char *old_name;
L
Linus Torvalds 已提交
3088 3089 3090 3091 3092 3093 3094 3095 3096

	if (old_dentry->d_inode == new_dentry->d_inode)
 		return 0;
 
	error = may_delete(old_dir, old_dentry, is_dir);
	if (error)
		return error;

	if (!new_dentry->d_inode)
3097
		error = may_create(new_dir, new_dentry);
L
Linus Torvalds 已提交
3098 3099 3100 3101 3102
	else
		error = may_delete(new_dir, new_dentry, is_dir);
	if (error)
		return error;

A
Al Viro 已提交
3103
	if (!old_dir->i_op->rename)
L
Linus Torvalds 已提交
3104 3105
		return -EPERM;

R
Robert Love 已提交
3106 3107
	old_name = fsnotify_oldname_init(old_dentry->d_name.name);

L
Linus Torvalds 已提交
3108 3109 3110 3111
	if (is_dir)
		error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
	else
		error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
3112 3113
	if (!error)
		fsnotify_move(old_dir, new_dir, old_name, is_dir,
3114
			      new_dentry->d_inode, old_dentry);
R
Robert Love 已提交
3115 3116
	fsnotify_oldname_free(old_name);

L
Linus Torvalds 已提交
3117 3118 3119
	return error;
}

3120 3121
SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
L
Linus Torvalds 已提交
3122
{
3123 3124 3125
	struct dentry *old_dir, *new_dir;
	struct dentry *old_dentry, *new_dentry;
	struct dentry *trap;
L
Linus Torvalds 已提交
3126
	struct nameidata oldnd, newnd;
3127 3128 3129
	char *from;
	char *to;
	int error;
L
Linus Torvalds 已提交
3130

3131
	error = user_path_parent(olddfd, oldname, &oldnd, &from);
L
Linus Torvalds 已提交
3132 3133 3134
	if (error)
		goto exit;

3135
	error = user_path_parent(newdfd, newname, &newnd, &to);
L
Linus Torvalds 已提交
3136 3137 3138 3139
	if (error)
		goto exit1;

	error = -EXDEV;
3140
	if (oldnd.path.mnt != newnd.path.mnt)
L
Linus Torvalds 已提交
3141 3142
		goto exit2;

3143
	old_dir = oldnd.path.dentry;
L
Linus Torvalds 已提交
3144 3145 3146 3147
	error = -EBUSY;
	if (oldnd.last_type != LAST_NORM)
		goto exit2;

3148
	new_dir = newnd.path.dentry;
L
Linus Torvalds 已提交
3149 3150 3151
	if (newnd.last_type != LAST_NORM)
		goto exit2;

3152 3153
	oldnd.flags &= ~LOOKUP_PARENT;
	newnd.flags &= ~LOOKUP_PARENT;
3154
	newnd.flags |= LOOKUP_RENAME_TARGET;
3155

L
Linus Torvalds 已提交
3156 3157
	trap = lock_rename(new_dir, old_dir);

3158
	old_dentry = lookup_hash(&oldnd);
L
Linus Torvalds 已提交
3159 3160 3161 3162 3163 3164 3165 3166 3167 3168 3169 3170 3171 3172 3173 3174 3175 3176 3177
	error = PTR_ERR(old_dentry);
	if (IS_ERR(old_dentry))
		goto exit3;
	/* source must exist */
	error = -ENOENT;
	if (!old_dentry->d_inode)
		goto exit4;
	/* unless the source is a directory trailing slashes give -ENOTDIR */
	if (!S_ISDIR(old_dentry->d_inode->i_mode)) {
		error = -ENOTDIR;
		if (oldnd.last.name[oldnd.last.len])
			goto exit4;
		if (newnd.last.name[newnd.last.len])
			goto exit4;
	}
	/* source should not be ancestor of target */
	error = -EINVAL;
	if (old_dentry == trap)
		goto exit4;
3178
	new_dentry = lookup_hash(&newnd);
L
Linus Torvalds 已提交
3179 3180 3181 3182 3183 3184 3185 3186
	error = PTR_ERR(new_dentry);
	if (IS_ERR(new_dentry))
		goto exit4;
	/* target should not be an ancestor of source */
	error = -ENOTEMPTY;
	if (new_dentry == trap)
		goto exit5;

3187 3188 3189
	error = mnt_want_write(oldnd.path.mnt);
	if (error)
		goto exit5;
3190 3191 3192 3193
	error = security_path_rename(&oldnd.path, old_dentry,
				     &newnd.path, new_dentry);
	if (error)
		goto exit6;
L
Linus Torvalds 已提交
3194 3195
	error = vfs_rename(old_dir->d_inode, old_dentry,
				   new_dir->d_inode, new_dentry);
3196
exit6:
3197
	mnt_drop_write(oldnd.path.mnt);
L
Linus Torvalds 已提交
3198 3199 3200 3201 3202 3203 3204
exit5:
	dput(new_dentry);
exit4:
	dput(old_dentry);
exit3:
	unlock_rename(new_dir, old_dir);
exit2:
J
Jan Blunck 已提交
3205
	path_put(&newnd.path);
3206
	putname(to);
L
Linus Torvalds 已提交
3207
exit1:
J
Jan Blunck 已提交
3208
	path_put(&oldnd.path);
L
Linus Torvalds 已提交
3209
	putname(from);
3210
exit:
L
Linus Torvalds 已提交
3211 3212 3213
	return error;
}

3214
SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
3215 3216 3217 3218
{
	return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname);
}

L
Linus Torvalds 已提交
3219 3220 3221 3222 3223 3224 3225 3226 3227 3228 3229 3230 3231 3232 3233 3234 3235 3236 3237 3238 3239 3240 3241 3242 3243
int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
{
	int len;

	len = PTR_ERR(link);
	if (IS_ERR(link))
		goto out;

	len = strlen(link);
	if (len > (unsigned) buflen)
		len = buflen;
	if (copy_to_user(buffer, link, len))
		len = -EFAULT;
out:
	return len;
}

/*
 * A helper for ->readlink().  This should be used *ONLY* for symlinks that
 * have ->follow_link() touching nd only in nd_set_link().  Using (or not
 * using) it for any given inode is up to filesystem.
 */
int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
	struct nameidata nd;
3244
	void *cookie;
3245
	int res;
3246

L
Linus Torvalds 已提交
3247
	nd.depth = 0;
3248
	cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
3249 3250 3251 3252 3253 3254 3255
	if (IS_ERR(cookie))
		return PTR_ERR(cookie);

	res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
	if (dentry->d_inode->i_op->put_link)
		dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
	return res;
L
Linus Torvalds 已提交
3256 3257 3258 3259 3260 3261 3262 3263 3264 3265
}

int vfs_follow_link(struct nameidata *nd, const char *link)
{
	return __vfs_follow_link(nd, link);
}

/* get the link contents into pagecache */
static char *page_getlink(struct dentry * dentry, struct page **ppage)
{
3266 3267
	char *kaddr;
	struct page *page;
L
Linus Torvalds 已提交
3268
	struct address_space *mapping = dentry->d_inode->i_mapping;
3269
	page = read_mapping_page(mapping, 0, NULL);
L
Linus Torvalds 已提交
3270
	if (IS_ERR(page))
3271
		return (char*)page;
L
Linus Torvalds 已提交
3272
	*ppage = page;
3273 3274 3275
	kaddr = kmap(page);
	nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1);
	return kaddr;
L
Linus Torvalds 已提交
3276 3277 3278 3279 3280 3281 3282 3283 3284 3285 3286 3287 3288 3289
}

int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
	struct page *page = NULL;
	char *s = page_getlink(dentry, &page);
	int res = vfs_readlink(dentry,buffer,buflen,s);
	if (page) {
		kunmap(page);
		page_cache_release(page);
	}
	return res;
}

3290
void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
L
Linus Torvalds 已提交
3291
{
3292
	struct page *page = NULL;
L
Linus Torvalds 已提交
3293
	nd_set_link(nd, page_getlink(dentry, &page));
3294
	return page;
L
Linus Torvalds 已提交
3295 3296
}

3297
void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
L
Linus Torvalds 已提交
3298
{
3299 3300 3301
	struct page *page = cookie;

	if (page) {
L
Linus Torvalds 已提交
3302 3303 3304 3305 3306
		kunmap(page);
		page_cache_release(page);
	}
}

3307 3308 3309 3310
/*
 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
 */
int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
L
Linus Torvalds 已提交
3311 3312
{
	struct address_space *mapping = inode->i_mapping;
3313
	struct page *page;
3314
	void *fsdata;
3315
	int err;
L
Linus Torvalds 已提交
3316
	char *kaddr;
3317 3318 3319
	unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
	if (nofs)
		flags |= AOP_FLAG_NOFS;
L
Linus Torvalds 已提交
3320

3321
retry:
3322
	err = pagecache_write_begin(NULL, mapping, 0, len-1,
3323
				flags, &page, &fsdata);
L
Linus Torvalds 已提交
3324
	if (err)
3325 3326
		goto fail;

L
Linus Torvalds 已提交
3327 3328 3329
	kaddr = kmap_atomic(page, KM_USER0);
	memcpy(kaddr, symname, len-1);
	kunmap_atomic(kaddr, KM_USER0);
3330 3331 3332

	err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
							page, fsdata);
L
Linus Torvalds 已提交
3333 3334
	if (err < 0)
		goto fail;
3335 3336 3337
	if (err < len-1)
		goto retry;

L
Linus Torvalds 已提交
3338 3339 3340 3341 3342 3343
	mark_inode_dirty(inode);
	return 0;
fail:
	return err;
}

3344 3345 3346
int page_symlink(struct inode *inode, const char *symname, int len)
{
	return __page_symlink(inode, symname, len,
3347
			!(mapping_gfp_mask(inode->i_mapping) & __GFP_FS));
3348 3349
}

3350
const struct inode_operations page_symlink_inode_operations = {
L
Linus Torvalds 已提交
3351 3352 3353 3354 3355
	.readlink	= generic_readlink,
	.follow_link	= page_follow_link_light,
	.put_link	= page_put_link,
};

3356
EXPORT_SYMBOL(user_path_at);
3357
EXPORT_SYMBOL(follow_down_one);
L
Linus Torvalds 已提交
3358 3359 3360 3361 3362 3363 3364 3365 3366
EXPORT_SYMBOL(follow_down);
EXPORT_SYMBOL(follow_up);
EXPORT_SYMBOL(get_write_access); /* binfmt_aout */
EXPORT_SYMBOL(getname);
EXPORT_SYMBOL(lock_rename);
EXPORT_SYMBOL(lookup_one_len);
EXPORT_SYMBOL(page_follow_link_light);
EXPORT_SYMBOL(page_put_link);
EXPORT_SYMBOL(page_readlink);
3367
EXPORT_SYMBOL(__page_symlink);
L
Linus Torvalds 已提交
3368 3369
EXPORT_SYMBOL(page_symlink);
EXPORT_SYMBOL(page_symlink_inode_operations);
A
Al Viro 已提交
3370
EXPORT_SYMBOL(kern_path);
3371
EXPORT_SYMBOL(vfs_path_lookup);
3372
EXPORT_SYMBOL(inode_permission);
L
Linus Torvalds 已提交
3373 3374 3375 3376 3377 3378 3379 3380 3381 3382 3383 3384 3385 3386
EXPORT_SYMBOL(unlock_rename);
EXPORT_SYMBOL(vfs_create);
EXPORT_SYMBOL(vfs_follow_link);
EXPORT_SYMBOL(vfs_link);
EXPORT_SYMBOL(vfs_mkdir);
EXPORT_SYMBOL(vfs_mknod);
EXPORT_SYMBOL(generic_permission);
EXPORT_SYMBOL(vfs_readlink);
EXPORT_SYMBOL(vfs_rename);
EXPORT_SYMBOL(vfs_rmdir);
EXPORT_SYMBOL(vfs_symlink);
EXPORT_SYMBOL(vfs_unlink);
EXPORT_SYMBOL(dentry_unhash);
EXPORT_SYMBOL(generic_readlink);