namei.c 70.6 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
/*
 *  linux/fs/namei.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

/*
 * Some corrections by tytso.
 */

/* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
 * lookup logic.
 */
/* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
 */

#include <linux/init.h>
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/fs.h>
#include <linux/namei.h>
#include <linux/quotaops.h>
#include <linux/pagemap.h>
R
Robert Love 已提交
24
#include <linux/fsnotify.h>
L
Linus Torvalds 已提交
25 26
#include <linux/personality.h>
#include <linux/security.h>
M
Mimi Zohar 已提交
27
#include <linux/ima.h>
L
Linus Torvalds 已提交
28 29 30
#include <linux/syscalls.h>
#include <linux/mount.h>
#include <linux/audit.h>
31
#include <linux/capability.h>
32
#include <linux/file.h>
33
#include <linux/fcntl.h>
34
#include <linux/device_cgroup.h>
35
#include <linux/fs_struct.h>
L
Linus Torvalds 已提交
36 37
#include <asm/uaccess.h>

38 39
#include "internal.h"

L
Linus Torvalds 已提交
40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108
#define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])

/* [Feb-1997 T. Schoebel-Theuer]
 * Fundamental changes in the pathname lookup mechanisms (namei)
 * were necessary because of omirr.  The reason is that omirr needs
 * to know the _real_ pathname, not the user-supplied one, in case
 * of symlinks (and also when transname replacements occur).
 *
 * The new code replaces the old recursive symlink resolution with
 * an iterative one (in case of non-nested symlink chains).  It does
 * this with calls to <fs>_follow_link().
 * As a side effect, dir_namei(), _namei() and follow_link() are now 
 * replaced with a single function lookup_dentry() that can handle all 
 * the special cases of the former code.
 *
 * With the new dcache, the pathname is stored at each inode, at least as
 * long as the refcount of the inode is positive.  As a side effect, the
 * size of the dcache depends on the inode cache and thus is dynamic.
 *
 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
 * resolution to correspond with current state of the code.
 *
 * Note that the symlink resolution is not *completely* iterative.
 * There is still a significant amount of tail- and mid- recursion in
 * the algorithm.  Also, note that <fs>_readlink() is not used in
 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
 * may return different results than <fs>_follow_link().  Many virtual
 * filesystems (including /proc) exhibit this behavior.
 */

/* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
 * and the name already exists in form of a symlink, try to create the new
 * name indicated by the symlink. The old code always complained that the
 * name already exists, due to not following the symlink even if its target
 * is nonexistent.  The new semantics affects also mknod() and link() when
 * the name is a symlink pointing to a non-existant name.
 *
 * I don't know which semantics is the right one, since I have no access
 * to standards. But I found by trial that HP-UX 9.0 has the full "new"
 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
 * "old" one. Personally, I think the new semantics is much more logical.
 * Note that "ln old new" where "new" is a symlink pointing to a non-existing
 * file does succeed in both HP-UX and SunOs, but not in Solaris
 * and in the old Linux semantics.
 */

/* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
 * semantics.  See the comments in "open_namei" and "do_link" below.
 *
 * [10-Sep-98 Alan Modra] Another symlink change.
 */

/* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
 *	inside the path - always follow.
 *	in the last component in creation/removal/renaming - never follow.
 *	if LOOKUP_FOLLOW passed - follow.
 *	if the pathname has trailing slashes - follow.
 *	otherwise - don't follow.
 * (applied in that order).
 *
 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
 * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
 * During the 2.4 we need to fix the userland stuff depending on it -
 * hopefully we will be able to get rid of that wart in 2.5. So far only
 * XEmacs seems to be relying on it...
 */
/*
 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
109
 * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
L
Linus Torvalds 已提交
110 111 112 113 114 115 116 117 118 119
 * any extra contention...
 */

/* In order to reduce some races, while at the same time doing additional
 * checking and hopefully speeding things up, we copy filenames to the
 * kernel data space before using them..
 *
 * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
 * PATH_MAX includes the nul terminator --RR.
 */
120
static int do_getname(const char __user *filename, char *page)
L
Linus Torvalds 已提交
121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163
{
	int retval;
	unsigned long len = PATH_MAX;

	if (!segment_eq(get_fs(), KERNEL_DS)) {
		if ((unsigned long) filename >= TASK_SIZE)
			return -EFAULT;
		if (TASK_SIZE - (unsigned long) filename < PATH_MAX)
			len = TASK_SIZE - (unsigned long) filename;
	}

	retval = strncpy_from_user(page, filename, len);
	if (retval > 0) {
		if (retval < len)
			return 0;
		return -ENAMETOOLONG;
	} else if (!retval)
		retval = -ENOENT;
	return retval;
}

char * getname(const char __user * filename)
{
	char *tmp, *result;

	result = ERR_PTR(-ENOMEM);
	tmp = __getname();
	if (tmp)  {
		int retval = do_getname(filename, tmp);

		result = tmp;
		if (retval < 0) {
			__putname(tmp);
			result = ERR_PTR(retval);
		}
	}
	audit_getname(result);
	return result;
}

#ifdef CONFIG_AUDITSYSCALL
void putname(const char *name)
{
164
	if (unlikely(!audit_dummy_context()))
L
Linus Torvalds 已提交
165 166 167 168 169 170 171
		audit_putname(name);
	else
		__putname(name);
}
EXPORT_SYMBOL(putname);
#endif

172 173
/*
 * This does basic POSIX ACL permission checking
L
Linus Torvalds 已提交
174
 */
175
static int acl_permission_check(struct inode *inode, int mask,
L
Linus Torvalds 已提交
176 177 178 179
		int (*check_acl)(struct inode *inode, int mask))
{
	umode_t			mode = inode->i_mode;

180 181
	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;

182
	if (current_fsuid() == inode->i_uid)
L
Linus Torvalds 已提交
183 184 185 186
		mode >>= 6;
	else {
		if (IS_POSIXACL(inode) && (mode & S_IRWXG) && check_acl) {
			int error = check_acl(inode, mask);
187
			if (error != -EAGAIN)
L
Linus Torvalds 已提交
188 189 190 191 192 193 194 195 196 197
				return error;
		}

		if (in_group_p(inode->i_gid))
			mode >>= 3;
	}

	/*
	 * If the DACs are ok we don't need any capability check.
	 */
198
	if ((mask & ~mode) == 0)
L
Linus Torvalds 已提交
199
		return 0;
200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224
	return -EACCES;
}

/**
 * generic_permission  -  check for access rights on a Posix-like filesystem
 * @inode:	inode to check access rights for
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 * @check_acl:	optional callback to check for Posix ACLs
 *
 * Used to check for read/write/execute permissions on a file.
 * We use "fsuid" for this, letting us set arbitrary permissions
 * for filesystem access without changing the "normal" uids which
 * are used for other things..
 */
int generic_permission(struct inode *inode, int mask,
		int (*check_acl)(struct inode *inode, int mask))
{
	int ret;

	/*
	 * Do the basic POSIX ACL permission checks.
	 */
	ret = acl_permission_check(inode, mask, check_acl);
	if (ret != -EACCES)
		return ret;
L
Linus Torvalds 已提交
225 226 227 228 229

	/*
	 * Read/write DACs are always overridable.
	 * Executable DACs are overridable if at least one exec bit is set.
	 */
230
	if (!(mask & MAY_EXEC) || execute_ok(inode))
L
Linus Torvalds 已提交
231 232 233 234 235 236 237 238 239 240 241 242 243
		if (capable(CAP_DAC_OVERRIDE))
			return 0;

	/*
	 * Searching includes executable on directories, else just read.
	 */
	if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
		if (capable(CAP_DAC_READ_SEARCH))
			return 0;

	return -EACCES;
}

C
Christoph Hellwig 已提交
244 245 246 247 248 249 250 251 252 253
/**
 * inode_permission  -  check for access rights to a given inode
 * @inode:	inode to check permission on
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Used to check for read/write/execute permissions on an inode.
 * We use "fsuid" for this, letting us set arbitrary permissions
 * for filesystem access without changing the "normal" uids which
 * are used for other things.
 */
254
int inode_permission(struct inode *inode, int mask)
L
Linus Torvalds 已提交
255
{
256
	int retval;
L
Linus Torvalds 已提交
257 258

	if (mask & MAY_WRITE) {
259
		umode_t mode = inode->i_mode;
L
Linus Torvalds 已提交
260 261 262 263 264 265 266 267 268 269 270 271 272 273 274

		/*
		 * Nobody gets write access to a read-only fs.
		 */
		if (IS_RDONLY(inode) &&
		    (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
			return -EROFS;

		/*
		 * Nobody gets write access to an immutable file.
		 */
		if (IS_IMMUTABLE(inode))
			return -EACCES;
	}

A
Al Viro 已提交
275
	if (inode->i_op->permission)
276
		retval = inode->i_op->permission(inode, mask);
277
	else
278
		retval = generic_permission(inode, mask, inode->i_op->check_acl);
279

L
Linus Torvalds 已提交
280 281 282
	if (retval)
		return retval;

283 284 285 286
	retval = devcgroup_inode_permission(inode, mask);
	if (retval)
		return retval;

287
	return security_inode_permission(inode,
288
			mask & (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND));
L
Linus Torvalds 已提交
289 290
}

291 292 293 294 295 296 297 298 299 300
/**
 * file_permission  -  check for additional access rights to a given file
 * @file:	file to check access rights for
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Used to check for read/write/execute permissions on an already opened
 * file.
 *
 * Note:
 *	Do not use this function in new code.  All access checks should
C
Christoph Hellwig 已提交
301
 *	be done using inode_permission().
302 303 304
 */
int file_permission(struct file *file, int mask)
{
305
	return inode_permission(file->f_path.dentry->d_inode, mask);
306 307
}

L
Linus Torvalds 已提交
308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340
/*
 * get_write_access() gets write permission for a file.
 * put_write_access() releases this write permission.
 * This is used for regular files.
 * We cannot support write (and maybe mmap read-write shared) accesses and
 * MAP_DENYWRITE mmappings simultaneously. The i_writecount field of an inode
 * can have the following values:
 * 0: no writers, no VM_DENYWRITE mappings
 * < 0: (-i_writecount) vm_area_structs with VM_DENYWRITE set exist
 * > 0: (i_writecount) users are writing to the file.
 *
 * Normally we operate on that counter with atomic_{inc,dec} and it's safe
 * except for the cases where we don't hold i_writecount yet. Then we need to
 * use {get,deny}_write_access() - these functions check the sign and refuse
 * to do the change if sign is wrong. Exclusion between them is provided by
 * the inode->i_lock spinlock.
 */

int get_write_access(struct inode * inode)
{
	spin_lock(&inode->i_lock);
	if (atomic_read(&inode->i_writecount) < 0) {
		spin_unlock(&inode->i_lock);
		return -ETXTBSY;
	}
	atomic_inc(&inode->i_writecount);
	spin_unlock(&inode->i_lock);

	return 0;
}

int deny_write_access(struct file * file)
{
341
	struct inode *inode = file->f_path.dentry->d_inode;
L
Linus Torvalds 已提交
342 343 344 345 346 347 348 349 350 351 352 353

	spin_lock(&inode->i_lock);
	if (atomic_read(&inode->i_writecount) > 0) {
		spin_unlock(&inode->i_lock);
		return -ETXTBSY;
	}
	atomic_dec(&inode->i_writecount);
	spin_unlock(&inode->i_lock);

	return 0;
}

J
Jan Blunck 已提交
354 355 356 357 358 359 360 361 362 363 364 365 366
/**
 * path_get - get a reference to a path
 * @path: path to get the reference to
 *
 * Given a path increment the reference count to the dentry and the vfsmount.
 */
void path_get(struct path *path)
{
	mntget(path->mnt);
	dget(path->dentry);
}
EXPORT_SYMBOL(path_get);

J
Jan Blunck 已提交
367 368 369 370 371 372 373
/**
 * path_put - put a reference to a path
 * @path: path to put the reference to
 *
 * Given a path decrement the reference count to the dentry and the vfsmount.
 */
void path_put(struct path *path)
L
Linus Torvalds 已提交
374
{
J
Jan Blunck 已提交
375 376
	dput(path->dentry);
	mntput(path->mnt);
L
Linus Torvalds 已提交
377
}
J
Jan Blunck 已提交
378
EXPORT_SYMBOL(path_put);
L
Linus Torvalds 已提交
379

380 381 382 383 384 385
/**
 * release_open_intent - free up open intent resources
 * @nd: pointer to nameidata
 */
void release_open_intent(struct nameidata *nd)
{
386
	if (nd->intent.open.file->f_path.dentry == NULL)
387 388 389 390 391
		put_filp(nd->intent.open.file);
	else
		fput(nd->intent.open.file);
}

392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415
static inline struct dentry *
do_revalidate(struct dentry *dentry, struct nameidata *nd)
{
	int status = dentry->d_op->d_revalidate(dentry, nd);
	if (unlikely(status <= 0)) {
		/*
		 * The dentry failed validation.
		 * If d_revalidate returned 0 attempt to invalidate
		 * the dentry otherwise d_revalidate is asking us
		 * to return a fail status.
		 */
		if (!status) {
			if (!d_invalidate(dentry)) {
				dput(dentry);
				dentry = NULL;
			}
		} else {
			dput(dentry);
			dentry = ERR_PTR(status);
		}
	}
	return dentry;
}

416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455
/*
 * force_reval_path - force revalidation of a dentry
 *
 * In some situations the path walking code will trust dentries without
 * revalidating them. This causes problems for filesystems that depend on
 * d_revalidate to handle file opens (e.g. NFSv4). When FS_REVAL_DOT is set
 * (which indicates that it's possible for the dentry to go stale), force
 * a d_revalidate call before proceeding.
 *
 * Returns 0 if the revalidation was successful. If the revalidation fails,
 * either return the error returned by d_revalidate or -ESTALE if the
 * revalidation it just returned 0. If d_revalidate returns 0, we attempt to
 * invalidate the dentry. It's up to the caller to handle putting references
 * to the path if necessary.
 */
static int
force_reval_path(struct path *path, struct nameidata *nd)
{
	int status;
	struct dentry *dentry = path->dentry;

	/*
	 * only check on filesystems where it's possible for the dentry to
	 * become stale. It's assumed that if this flag is set then the
	 * d_revalidate op will also be defined.
	 */
	if (!(dentry->d_sb->s_type->fs_flags & FS_REVAL_DOT))
		return 0;

	status = dentry->d_op->d_revalidate(dentry, nd);
	if (status > 0)
		return 0;

	if (!status) {
		d_invalidate(dentry);
		status = -ESTALE;
	}
	return status;
}

L
Linus Torvalds 已提交
456
/*
A
Al Viro 已提交
457 458 459
 * Short-cut version of permission(), for calling on directories
 * during pathname resolution.  Combines parts of permission()
 * and generic_permission(), and tests ONLY for MAY_EXEC permission.
L
Linus Torvalds 已提交
460 461
 *
 * If appropriate, check DAC only.  If not appropriate, or
A
Al Viro 已提交
462
 * short-cut DAC fails, then call ->permission() to do more
L
Linus Torvalds 已提交
463 464
 * complete permission check.
 */
A
Al Viro 已提交
465
static int exec_permission(struct inode *inode)
L
Linus Torvalds 已提交
466
{
467
	int ret;
L
Linus Torvalds 已提交
468

469
	if (inode->i_op->permission) {
470
		ret = inode->i_op->permission(inode, MAY_EXEC);
471 472 473 474
		if (!ret)
			goto ok;
		return ret;
	}
475 476
	ret = acl_permission_check(inode, MAY_EXEC, inode->i_op->check_acl);
	if (!ret)
L
Linus Torvalds 已提交
477 478
		goto ok;

479
	if (capable(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH))
L
Linus Torvalds 已提交
480 481
		goto ok;

482
	return ret;
L
Linus Torvalds 已提交
483
ok:
484
	return security_inode_permission(inode, MAY_EXEC);
L
Linus Torvalds 已提交
485 486
}

A
Al Viro 已提交
487 488 489 490 491 492 493 494 495 496 497
static __always_inline void set_root(struct nameidata *nd)
{
	if (!nd->root.mnt) {
		struct fs_struct *fs = current->fs;
		read_lock(&fs->lock);
		nd->root = fs->root;
		path_get(&nd->root);
		read_unlock(&fs->lock);
	}
}

498 499
static int link_path_walk(const char *, struct nameidata *);

500
static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
L
Linus Torvalds 已提交
501 502 503 504 505 506 507
{
	int res = 0;
	char *name;
	if (IS_ERR(link))
		goto fail;

	if (*link == '/') {
A
Al Viro 已提交
508
		set_root(nd);
J
Jan Blunck 已提交
509
		path_put(&nd->path);
A
Al Viro 已提交
510 511
		nd->path = nd->root;
		path_get(&nd->root);
L
Linus Torvalds 已提交
512
	}
C
Christoph Hellwig 已提交
513

L
Linus Torvalds 已提交
514 515 516 517 518 519 520 521 522 523
	res = link_path_walk(link, nd);
	if (nd->depth || res || nd->last_type!=LAST_NORM)
		return res;
	/*
	 * If it is an iterative symlinks resolution in open_namei() we
	 * have to copy the last component. And all that crap because of
	 * bloody create() on broken symlinks. Furrfu...
	 */
	name = __getname();
	if (unlikely(!name)) {
J
Jan Blunck 已提交
524
		path_put(&nd->path);
L
Linus Torvalds 已提交
525 526 527 528 529 530
		return -ENOMEM;
	}
	strcpy(name, nd->last.name);
	nd->last.name = name;
	return 0;
fail:
J
Jan Blunck 已提交
531
	path_put(&nd->path);
L
Linus Torvalds 已提交
532 533 534
	return PTR_ERR(link);
}

J
Jan Blunck 已提交
535
static void path_put_conditional(struct path *path, struct nameidata *nd)
536 537
{
	dput(path->dentry);
538
	if (path->mnt != nd->path.mnt)
539 540 541 542 543
		mntput(path->mnt);
}

static inline void path_to_nameidata(struct path *path, struct nameidata *nd)
{
544 545 546 547 548
	dput(nd->path.dentry);
	if (nd->path.mnt != path->mnt)
		mntput(nd->path.mnt);
	nd->path.mnt = path->mnt;
	nd->path.dentry = path->dentry;
549 550
}

551
static __always_inline int __do_follow_link(struct path *path, struct nameidata *nd)
L
Linus Torvalds 已提交
552 553
{
	int error;
554
	void *cookie;
A
Al Viro 已提交
555
	struct dentry *dentry = path->dentry;
L
Linus Torvalds 已提交
556

A
Al Viro 已提交
557
	touch_atime(path->mnt, dentry);
L
Linus Torvalds 已提交
558
	nd_set_link(nd, NULL);
A
Al Viro 已提交
559

560
	if (path->mnt != nd->path.mnt) {
561 562 563 564
		path_to_nameidata(path, nd);
		dget(dentry);
	}
	mntget(path->mnt);
565 566 567
	cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
	error = PTR_ERR(cookie);
	if (!IS_ERR(cookie)) {
L
Linus Torvalds 已提交
568
		char *s = nd_get_link(nd);
569
		error = 0;
L
Linus Torvalds 已提交
570 571
		if (s)
			error = __vfs_follow_link(nd, s);
572 573 574 575 576
		else if (nd->last_type == LAST_BIND) {
			error = force_reval_path(&nd->path, nd);
			if (error)
				path_put(&nd->path);
		}
L
Linus Torvalds 已提交
577
		if (dentry->d_inode->i_op->put_link)
578
			dentry->d_inode->i_op->put_link(dentry, nd, cookie);
L
Linus Torvalds 已提交
579 580 581 582 583 584 585 586 587 588 589
	}
	return error;
}

/*
 * This limits recursive symlink follows to 8, while
 * limiting consecutive symlinks to 40.
 *
 * Without that kind of total limit, nasty chains of consecutive
 * symlinks can cause almost arbitrarily long lookups. 
 */
A
Al Viro 已提交
590
static inline int do_follow_link(struct path *path, struct nameidata *nd)
L
Linus Torvalds 已提交
591 592 593 594 595 596 597 598
{
	int err = -ELOOP;
	if (current->link_count >= MAX_NESTED_LINKS)
		goto loop;
	if (current->total_link_count >= 40)
		goto loop;
	BUG_ON(nd->depth >= MAX_NESTED_LINKS);
	cond_resched();
A
Al Viro 已提交
599
	err = security_inode_follow_link(path->dentry, nd);
L
Linus Torvalds 已提交
600 601 602 603 604
	if (err)
		goto loop;
	current->link_count++;
	current->total_link_count++;
	nd->depth++;
A
Al Viro 已提交
605
	err = __do_follow_link(path, nd);
606
	path_put(path);
A
Al Viro 已提交
607 608
	current->link_count--;
	nd->depth--;
L
Linus Torvalds 已提交
609 610
	return err;
loop:
J
Jan Blunck 已提交
611 612
	path_put_conditional(path, nd);
	path_put(&nd->path);
L
Linus Torvalds 已提交
613 614 615
	return err;
}

A
Al Viro 已提交
616
int follow_up(struct path *path)
L
Linus Torvalds 已提交
617 618 619 620
{
	struct vfsmount *parent;
	struct dentry *mountpoint;
	spin_lock(&vfsmount_lock);
A
Al Viro 已提交
621 622
	parent = path->mnt->mnt_parent;
	if (parent == path->mnt) {
L
Linus Torvalds 已提交
623 624 625 626
		spin_unlock(&vfsmount_lock);
		return 0;
	}
	mntget(parent);
A
Al Viro 已提交
627
	mountpoint = dget(path->mnt->mnt_mountpoint);
L
Linus Torvalds 已提交
628
	spin_unlock(&vfsmount_lock);
A
Al Viro 已提交
629 630 631 632
	dput(path->dentry);
	path->dentry = mountpoint;
	mntput(path->mnt);
	path->mnt = parent;
L
Linus Torvalds 已提交
633 634 635 636 637 638
	return 1;
}

/* no need for dcache_lock, as serialization is taken care in
 * namespace.c
 */
A
Al Viro 已提交
639 640 641 642
static int __follow_mount(struct path *path)
{
	int res = 0;
	while (d_mountpoint(path->dentry)) {
A
Al Viro 已提交
643
		struct vfsmount *mounted = lookup_mnt(path);
A
Al Viro 已提交
644 645 646 647 648 649 650 651 652 653 654 655
		if (!mounted)
			break;
		dput(path->dentry);
		if (res)
			mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
		res = 1;
	}
	return res;
}

A
Al Viro 已提交
656
static void follow_mount(struct path *path)
L
Linus Torvalds 已提交
657
{
A
Al Viro 已提交
658
	while (d_mountpoint(path->dentry)) {
A
Al Viro 已提交
659
		struct vfsmount *mounted = lookup_mnt(path);
L
Linus Torvalds 已提交
660 661
		if (!mounted)
			break;
A
Al Viro 已提交
662 663 664 665
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
L
Linus Torvalds 已提交
666 667 668 669 670 671
	}
}

/* no need for dcache_lock, as serialization is taken care in
 * namespace.c
 */
A
Al Viro 已提交
672
int follow_down(struct path *path)
L
Linus Torvalds 已提交
673 674 675
{
	struct vfsmount *mounted;

A
Al Viro 已提交
676
	mounted = lookup_mnt(path);
L
Linus Torvalds 已提交
677
	if (mounted) {
A
Al Viro 已提交
678 679 680 681
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
L
Linus Torvalds 已提交
682 683 684 685 686
		return 1;
	}
	return 0;
}

687
static __always_inline void follow_dotdot(struct nameidata *nd)
L
Linus Torvalds 已提交
688
{
A
Al Viro 已提交
689
	set_root(nd);
690

L
Linus Torvalds 已提交
691 692
	while(1) {
		struct vfsmount *parent;
693
		struct dentry *old = nd->path.dentry;
L
Linus Torvalds 已提交
694

A
Al Viro 已提交
695 696
		if (nd->path.dentry == nd->root.dentry &&
		    nd->path.mnt == nd->root.mnt) {
L
Linus Torvalds 已提交
697 698 699
			break;
		}
		spin_lock(&dcache_lock);
700 701
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
			nd->path.dentry = dget(nd->path.dentry->d_parent);
L
Linus Torvalds 已提交
702 703 704 705 706 707
			spin_unlock(&dcache_lock);
			dput(old);
			break;
		}
		spin_unlock(&dcache_lock);
		spin_lock(&vfsmount_lock);
708 709
		parent = nd->path.mnt->mnt_parent;
		if (parent == nd->path.mnt) {
L
Linus Torvalds 已提交
710 711 712 713
			spin_unlock(&vfsmount_lock);
			break;
		}
		mntget(parent);
714
		nd->path.dentry = dget(nd->path.mnt->mnt_mountpoint);
L
Linus Torvalds 已提交
715 716
		spin_unlock(&vfsmount_lock);
		dput(old);
717 718
		mntput(nd->path.mnt);
		nd->path.mnt = parent;
L
Linus Torvalds 已提交
719
	}
A
Al Viro 已提交
720
	follow_mount(&nd->path);
L
Linus Torvalds 已提交
721 722 723 724 725 726 727 728 729 730
}

/*
 *  It's more convoluted than I'd like it to be, but... it's still fairly
 *  small and for now I'd prefer to have fast path as straight as possible.
 *  It _is_ time-critical.
 */
static int do_lookup(struct nameidata *nd, struct qstr *name,
		     struct path *path)
{
731
	struct vfsmount *mnt = nd->path.mnt;
A
Al Viro 已提交
732 733
	struct dentry *dentry, *parent;
	struct inode *dir;
A
Al Viro 已提交
734 735 736 737 738 739 740 741 742
	/*
	 * See if the low-level filesystem might want
	 * to use its own hash..
	 */
	if (nd->path.dentry->d_op && nd->path.dentry->d_op->d_hash) {
		int err = nd->path.dentry->d_op->d_hash(nd->path.dentry, name);
		if (err < 0)
			return err;
	}
L
Linus Torvalds 已提交
743

A
Al Viro 已提交
744
	dentry = __d_lookup(nd->path.dentry, name);
L
Linus Torvalds 已提交
745 746 747 748 749 750 751
	if (!dentry)
		goto need_lookup;
	if (dentry->d_op && dentry->d_op->d_revalidate)
		goto need_revalidate;
done:
	path->mnt = mnt;
	path->dentry = dentry;
A
Al Viro 已提交
752
	__follow_mount(path);
L
Linus Torvalds 已提交
753 754 755
	return 0;

need_lookup:
A
Al Viro 已提交
756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808
	parent = nd->path.dentry;
	dir = parent->d_inode;

	mutex_lock(&dir->i_mutex);
	/*
	 * First re-do the cached lookup just in case it was created
	 * while we waited for the directory semaphore..
	 *
	 * FIXME! This could use version numbering or similar to
	 * avoid unnecessary cache lookups.
	 *
	 * The "dcache_lock" is purely to protect the RCU list walker
	 * from concurrent renames at this point (we mustn't get false
	 * negatives from the RCU list walk here, unlike the optimistic
	 * fast walk).
	 *
	 * so doing d_lookup() (with seqlock), instead of lockfree __d_lookup
	 */
	dentry = d_lookup(parent, name);
	if (!dentry) {
		struct dentry *new;

		/* Don't create child dentry for a dead directory. */
		dentry = ERR_PTR(-ENOENT);
		if (IS_DEADDIR(dir))
			goto out_unlock;

		new = d_alloc(parent, name);
		dentry = ERR_PTR(-ENOMEM);
		if (new) {
			dentry = dir->i_op->lookup(dir, new, nd);
			if (dentry)
				dput(new);
			else
				dentry = new;
		}
out_unlock:
		mutex_unlock(&dir->i_mutex);
		if (IS_ERR(dentry))
			goto fail;
		goto done;
	}

	/*
	 * Uhhuh! Nasty case: the cache was re-populated while
	 * we waited on the semaphore. Need to revalidate.
	 */
	mutex_unlock(&dir->i_mutex);
	if (dentry->d_op && dentry->d_op->d_revalidate) {
		dentry = do_revalidate(dentry, nd);
		if (!dentry)
			dentry = ERR_PTR(-ENOENT);
	}
L
Linus Torvalds 已提交
809 810 811 812 813
	if (IS_ERR(dentry))
		goto fail;
	goto done;

need_revalidate:
814 815 816 817 818 819
	dentry = do_revalidate(dentry, nd);
	if (!dentry)
		goto need_lookup;
	if (IS_ERR(dentry))
		goto fail;
	goto done;
L
Linus Torvalds 已提交
820 821 822 823 824 825 826

fail:
	return PTR_ERR(dentry);
}

/*
 * Name resolution.
827 828
 * This is the basic name resolution function, turning a pathname into
 * the final dentry. We expect 'base' to be positive and a directory.
L
Linus Torvalds 已提交
829
 *
830 831
 * Returns 0 and nd will have valid dentry and mnt on success.
 * Returns error and drops reference to input namei data on failure.
L
Linus Torvalds 已提交
832
 */
833
static int link_path_walk(const char *name, struct nameidata *nd)
L
Linus Torvalds 已提交
834 835 836 837 838 839 840 841 842 843 844
{
	struct path next;
	struct inode *inode;
	int err;
	unsigned int lookup_flags = nd->flags;
	
	while (*name=='/')
		name++;
	if (!*name)
		goto return_reval;

845
	inode = nd->path.dentry->d_inode;
L
Linus Torvalds 已提交
846
	if (nd->depth)
847
		lookup_flags = LOOKUP_FOLLOW | (nd->flags & LOOKUP_CONTINUE);
L
Linus Torvalds 已提交
848 849 850 851 852 853 854

	/* At this point we know we have a real path component. */
	for(;;) {
		unsigned long hash;
		struct qstr this;
		unsigned int c;

855
		nd->flags |= LOOKUP_CONTINUE;
A
Al Viro 已提交
856
		err = exec_permission(inode);
L
Linus Torvalds 已提交
857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889
 		if (err)
			break;

		this.name = name;
		c = *(const unsigned char *)name;

		hash = init_name_hash();
		do {
			name++;
			hash = partial_name_hash(c, hash);
			c = *(const unsigned char *)name;
		} while (c && (c != '/'));
		this.len = name - (const char *) this.name;
		this.hash = end_name_hash(hash);

		/* remove trailing slashes? */
		if (!c)
			goto last_component;
		while (*++name == '/');
		if (!*name)
			goto last_with_slashes;

		/*
		 * "." and ".." are special - ".." especially so because it has
		 * to be able to know about the current root directory and
		 * parent relationships.
		 */
		if (this.name[0] == '.') switch (this.len) {
			default:
				break;
			case 2:	
				if (this.name[1] != '.')
					break;
A
Al Viro 已提交
890
				follow_dotdot(nd);
891
				inode = nd->path.dentry->d_inode;
L
Linus Torvalds 已提交
892 893 894 895 896 897 898 899 900 901 902 903 904 905 906
				/* fallthrough */
			case 1:
				continue;
		}
		/* This does the actual lookups.. */
		err = do_lookup(nd, &this, &next);
		if (err)
			break;

		err = -ENOENT;
		inode = next.dentry->d_inode;
		if (!inode)
			goto out_dput;

		if (inode->i_op->follow_link) {
A
Al Viro 已提交
907
			err = do_follow_link(&next, nd);
L
Linus Torvalds 已提交
908 909 910
			if (err)
				goto return_err;
			err = -ENOENT;
911
			inode = nd->path.dentry->d_inode;
L
Linus Torvalds 已提交
912 913
			if (!inode)
				break;
M
Miklos Szeredi 已提交
914 915
		} else
			path_to_nameidata(&next, nd);
L
Linus Torvalds 已提交
916 917 918 919 920 921 922 923 924
		err = -ENOTDIR; 
		if (!inode->i_op->lookup)
			break;
		continue;
		/* here ends the main loop */

last_with_slashes:
		lookup_flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
last_component:
925 926
		/* Clear LOOKUP_CONTINUE iff it was previously unset */
		nd->flags &= lookup_flags | ~LOOKUP_CONTINUE;
L
Linus Torvalds 已提交
927 928 929 930 931 932 933 934
		if (lookup_flags & LOOKUP_PARENT)
			goto lookup_parent;
		if (this.name[0] == '.') switch (this.len) {
			default:
				break;
			case 2:	
				if (this.name[1] != '.')
					break;
A
Al Viro 已提交
935
				follow_dotdot(nd);
936
				inode = nd->path.dentry->d_inode;
L
Linus Torvalds 已提交
937 938 939 940 941 942 943 944 945
				/* fallthrough */
			case 1:
				goto return_reval;
		}
		err = do_lookup(nd, &this, &next);
		if (err)
			break;
		inode = next.dentry->d_inode;
		if ((lookup_flags & LOOKUP_FOLLOW)
A
Al Viro 已提交
946
		    && inode && inode->i_op->follow_link) {
A
Al Viro 已提交
947
			err = do_follow_link(&next, nd);
L
Linus Torvalds 已提交
948 949
			if (err)
				goto return_err;
950
			inode = nd->path.dentry->d_inode;
M
Miklos Szeredi 已提交
951 952
		} else
			path_to_nameidata(&next, nd);
L
Linus Torvalds 已提交
953 954 955 956 957
		err = -ENOENT;
		if (!inode)
			break;
		if (lookup_flags & LOOKUP_DIRECTORY) {
			err = -ENOTDIR; 
A
Al Viro 已提交
958
			if (!inode->i_op->lookup)
L
Linus Torvalds 已提交
959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977
				break;
		}
		goto return_base;
lookup_parent:
		nd->last = this;
		nd->last_type = LAST_NORM;
		if (this.name[0] != '.')
			goto return_base;
		if (this.len == 1)
			nd->last_type = LAST_DOT;
		else if (this.len == 2 && this.name[1] == '.')
			nd->last_type = LAST_DOTDOT;
		else
			goto return_base;
return_reval:
		/*
		 * We bypassed the ordinary revalidation routines.
		 * We may need to check the cached dentry for staleness.
		 */
978 979
		if (nd->path.dentry && nd->path.dentry->d_sb &&
		    (nd->path.dentry->d_sb->s_type->fs_flags & FS_REVAL_DOT)) {
L
Linus Torvalds 已提交
980 981
			err = -ESTALE;
			/* Note: we do not d_invalidate() */
982 983
			if (!nd->path.dentry->d_op->d_revalidate(
					nd->path.dentry, nd))
L
Linus Torvalds 已提交
984 985 986 987 988
				break;
		}
return_base:
		return 0;
out_dput:
J
Jan Blunck 已提交
989
		path_put_conditional(&next, nd);
L
Linus Torvalds 已提交
990 991
		break;
	}
J
Jan Blunck 已提交
992
	path_put(&nd->path);
L
Linus Torvalds 已提交
993 994 995 996
return_err:
	return err;
}

997
static int path_walk(const char *name, struct nameidata *nd)
L
Linus Torvalds 已提交
998
{
999 1000 1001
	struct path save = nd->path;
	int result;

L
Linus Torvalds 已提交
1002
	current->total_link_count = 0;
1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019

	/* make sure the stuff we saved doesn't go away */
	path_get(&save);

	result = link_path_walk(name, nd);
	if (result == -ESTALE) {
		/* nd->path had been dropped */
		current->total_link_count = 0;
		nd->path = save;
		path_get(&nd->path);
		nd->flags |= LOOKUP_REVAL;
		result = link_path_walk(name, nd);
	}

	path_put(&save);

	return result;
L
Linus Torvalds 已提交
1020 1021
}

1022
static int path_init(int dfd, const char *name, unsigned int flags, struct nameidata *nd)
L
Linus Torvalds 已提交
1023
{
1024
	int retval = 0;
1025 1026
	int fput_needed;
	struct file *file;
L
Linus Torvalds 已提交
1027 1028 1029 1030

	nd->last_type = LAST_ROOT; /* if there are only slashes... */
	nd->flags = flags;
	nd->depth = 0;
A
Al Viro 已提交
1031
	nd->root.mnt = NULL;
L
Linus Torvalds 已提交
1032 1033

	if (*name=='/') {
A
Al Viro 已提交
1034 1035 1036
		set_root(nd);
		nd->path = nd->root;
		path_get(&nd->root);
1037
	} else if (dfd == AT_FDCWD) {
A
Al Viro 已提交
1038
		struct fs_struct *fs = current->fs;
1039
		read_lock(&fs->lock);
J
Jan Blunck 已提交
1040 1041
		nd->path = fs->pwd;
		path_get(&fs->pwd);
1042
		read_unlock(&fs->lock);
1043 1044 1045 1046
	} else {
		struct dentry *dentry;

		file = fget_light(dfd, &fput_needed);
1047 1048
		retval = -EBADF;
		if (!file)
1049
			goto out_fail;
1050

1051
		dentry = file->f_path.dentry;
1052

1053 1054
		retval = -ENOTDIR;
		if (!S_ISDIR(dentry->d_inode->i_mode))
1055
			goto fput_fail;
1056 1057

		retval = file_permission(file, MAY_EXEC);
1058
		if (retval)
1059
			goto fput_fail;
1060

J
Jan Blunck 已提交
1061 1062
		nd->path = file->f_path;
		path_get(&file->f_path);
1063 1064

		fput_light(file, fput_needed);
L
Linus Torvalds 已提交
1065
	}
1066
	return 0;
1067

1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080
fput_fail:
	fput_light(file, fput_needed);
out_fail:
	return retval;
}

/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
static int do_path_lookup(int dfd, const char *name,
				unsigned int flags, struct nameidata *nd)
{
	int retval = path_init(dfd, name, flags, nd);
	if (!retval)
		retval = path_walk(name, nd);
1081 1082 1083
	if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
				nd->path.dentry->d_inode))
		audit_inode(name, nd->path.dentry);
A
Al Viro 已提交
1084 1085 1086 1087
	if (nd->root.mnt) {
		path_put(&nd->root);
		nd->root.mnt = NULL;
	}
1088
	return retval;
L
Linus Torvalds 已提交
1089 1090
}

1091
int path_lookup(const char *name, unsigned int flags,
1092 1093 1094 1095 1096
			struct nameidata *nd)
{
	return do_path_lookup(AT_FDCWD, name, flags, nd);
}

A
Al Viro 已提交
1097 1098 1099 1100 1101 1102 1103 1104 1105
int kern_path(const char *name, unsigned int flags, struct path *path)
{
	struct nameidata nd;
	int res = do_path_lookup(AT_FDCWD, name, flags, &nd);
	if (!res)
		*path = nd.path;
	return res;
}

1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124
/**
 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
 * @dentry:  pointer to dentry of the base directory
 * @mnt: pointer to vfs mount of the base directory
 * @name: pointer to file name
 * @flags: lookup flags
 * @nd: pointer to nameidata
 */
int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
		    const char *name, unsigned int flags,
		    struct nameidata *nd)
{
	int retval;

	/* same as do_path_lookup */
	nd->last_type = LAST_ROOT;
	nd->flags = flags;
	nd->depth = 0;

1125 1126 1127
	nd->path.dentry = dentry;
	nd->path.mnt = mnt;
	path_get(&nd->path);
1128 1129
	nd->root = nd->path;
	path_get(&nd->root);
1130 1131

	retval = path_walk(name, nd);
1132 1133 1134
	if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
				nd->path.dentry->d_inode))
		audit_inode(name, nd->path.dentry);
1135

1136 1137
	path_put(&nd->root);
	nd->root.mnt = NULL;
1138

A
Al Viro 已提交
1139
	return retval;
1140 1141
}

1142 1143
static struct dentry *__lookup_hash(struct qstr *name,
		struct dentry *base, struct nameidata *nd)
L
Linus Torvalds 已提交
1144
{
1145
	struct dentry *dentry;
L
Linus Torvalds 已提交
1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161
	struct inode *inode;
	int err;

	inode = base->d_inode;

	/*
	 * See if the low-level filesystem might want
	 * to use its own hash..
	 */
	if (base->d_op && base->d_op->d_hash) {
		err = base->d_op->d_hash(base, name);
		dentry = ERR_PTR(err);
		if (err < 0)
			goto out;
	}

A
Al Viro 已提交
1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172
	dentry = __d_lookup(base, name);

	/* lockess __d_lookup may fail due to concurrent d_move()
	 * in some unrelated directory, so try with d_lookup
	 */
	if (!dentry)
		dentry = d_lookup(base, name);

	if (dentry && dentry->d_op && dentry->d_op->d_revalidate)
		dentry = do_revalidate(dentry, nd);

L
Linus Torvalds 已提交
1173
	if (!dentry) {
1174 1175 1176 1177 1178 1179 1180 1181
		struct dentry *new;

		/* Don't create child dentry for a dead directory. */
		dentry = ERR_PTR(-ENOENT);
		if (IS_DEADDIR(inode))
			goto out;

		new = d_alloc(base, name);
L
Linus Torvalds 已提交
1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194
		dentry = ERR_PTR(-ENOMEM);
		if (!new)
			goto out;
		dentry = inode->i_op->lookup(inode, new, nd);
		if (!dentry)
			dentry = new;
		else
			dput(new);
	}
out:
	return dentry;
}

1195 1196 1197 1198 1199
/*
 * Restricted form of lookup. Doesn't follow links, single-component only,
 * needs parent already locked. Doesn't follow mounts.
 * SMP-safe.
 */
1200
static struct dentry *lookup_hash(struct nameidata *nd)
1201 1202 1203
{
	int err;

A
Al Viro 已提交
1204
	err = exec_permission(nd->path.dentry->d_inode);
1205
	if (err)
1206
		return ERR_PTR(err);
1207
	return __lookup_hash(&nd->last, nd->path.dentry, nd);
L
Linus Torvalds 已提交
1208 1209
}

1210 1211
static int __lookup_one_len(const char *name, struct qstr *this,
		struct dentry *base, int len)
L
Linus Torvalds 已提交
1212 1213 1214 1215
{
	unsigned long hash;
	unsigned int c;

1216 1217
	this->name = name;
	this->len = len;
L
Linus Torvalds 已提交
1218
	if (!len)
1219
		return -EACCES;
L
Linus Torvalds 已提交
1220 1221 1222 1223 1224

	hash = init_name_hash();
	while (len--) {
		c = *(const unsigned char *)name++;
		if (c == '/' || c == '\0')
1225
			return -EACCES;
L
Linus Torvalds 已提交
1226 1227
		hash = partial_name_hash(c, hash);
	}
1228 1229 1230
	this->hash = end_name_hash(hash);
	return 0;
}
L
Linus Torvalds 已提交
1231

1232
/**
1233
 * lookup_one_len - filesystem helper to lookup single pathname component
1234 1235 1236 1237
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
1238 1239
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.  Also note that by using this function the
1240 1241 1242
 * nameidata argument is passed to the filesystem methods and a filesystem
 * using this helper needs to be prepared for that.
 */
1243 1244 1245 1246 1247
struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
{
	int err;
	struct qstr this;

1248 1249
	WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));

1250
	err = __lookup_one_len(name, &this, base, len);
1251 1252 1253
	if (err)
		return ERR_PTR(err);

A
Al Viro 已提交
1254
	err = exec_permission(base->d_inode);
1255 1256
	if (err)
		return ERR_PTR(err);
1257
	return __lookup_hash(&this, base, NULL);
1258 1259
}

1260 1261
int user_path_at(int dfd, const char __user *name, unsigned flags,
		 struct path *path)
L
Linus Torvalds 已提交
1262
{
1263
	struct nameidata nd;
L
Linus Torvalds 已提交
1264 1265 1266
	char *tmp = getname(name);
	int err = PTR_ERR(tmp);
	if (!IS_ERR(tmp)) {
1267 1268 1269 1270

		BUG_ON(flags & LOOKUP_PARENT);

		err = do_path_lookup(dfd, tmp, flags, &nd);
L
Linus Torvalds 已提交
1271
		putname(tmp);
1272 1273
		if (!err)
			*path = nd.path;
L
Linus Torvalds 已提交
1274 1275 1276 1277
	}
	return err;
}

1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295
static int user_path_parent(int dfd, const char __user *path,
			struct nameidata *nd, char **name)
{
	char *s = getname(path);
	int error;

	if (IS_ERR(s))
		return PTR_ERR(s);

	error = do_path_lookup(dfd, s, LOOKUP_PARENT, nd);
	if (error)
		putname(s);
	else
		*name = s;

	return error;
}

L
Linus Torvalds 已提交
1296 1297 1298 1299 1300 1301
/*
 * It's inline, so penalty for filesystems that don't use sticky bit is
 * minimal.
 */
static inline int check_sticky(struct inode *dir, struct inode *inode)
{
1302 1303
	uid_t fsuid = current_fsuid();

L
Linus Torvalds 已提交
1304 1305
	if (!(dir->i_mode & S_ISVTX))
		return 0;
1306
	if (inode->i_uid == fsuid)
L
Linus Torvalds 已提交
1307
		return 0;
1308
	if (dir->i_uid == fsuid)
L
Linus Torvalds 已提交
1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331
		return 0;
	return !capable(CAP_FOWNER);
}

/*
 *	Check whether we can remove a link victim from directory dir, check
 *  whether the type of victim is right.
 *  1. We can't do it if dir is read-only (done in permission())
 *  2. We should have write and exec permissions on dir
 *  3. We can't remove anything from append-only dir
 *  4. We can't do anything with immutable dir (done in permission())
 *  5. If the sticky bit on dir is set we should either
 *	a. be owner of dir, or
 *	b. be owner of victim, or
 *	c. have CAP_FOWNER capability
 *  6. If the victim is append-only or immutable we can't do antyhing with
 *     links pointing to it.
 *  7. If we were asked to remove a directory and victim isn't one - ENOTDIR.
 *  8. If we were asked to remove a non-directory and victim isn't one - EISDIR.
 *  9. We can't remove a root or mountpoint.
 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by
 *     nfs_async_unlink().
 */
1332
static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
L
Linus Torvalds 已提交
1333 1334 1335 1336 1337 1338 1339
{
	int error;

	if (!victim->d_inode)
		return -ENOENT;

	BUG_ON(victim->d_parent->d_inode != dir);
1340
	audit_inode_child(victim->d_name.name, victim, dir);
L
Linus Torvalds 已提交
1341

1342
	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
1343 1344 1345 1346 1347
	if (error)
		return error;
	if (IS_APPEND(dir))
		return -EPERM;
	if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
H
Hugh Dickins 已提交
1348
	    IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
L
Linus Torvalds 已提交
1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371
		return -EPERM;
	if (isdir) {
		if (!S_ISDIR(victim->d_inode->i_mode))
			return -ENOTDIR;
		if (IS_ROOT(victim))
			return -EBUSY;
	} else if (S_ISDIR(victim->d_inode->i_mode))
		return -EISDIR;
	if (IS_DEADDIR(dir))
		return -ENOENT;
	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
		return -EBUSY;
	return 0;
}

/*	Check whether we can create an object with dentry child in directory
 *  dir.
 *  1. We can't do it if child already exists (open has special treatment for
 *     this case, but since we are inlined it's OK)
 *  2. We can't do it if dir is read-only (done in permission())
 *  3. We should have write and exec permissions on dir
 *  4. We can't do it if dir is immutable (done in permission())
 */
1372
static inline int may_create(struct inode *dir, struct dentry *child)
L
Linus Torvalds 已提交
1373 1374 1375 1376 1377
{
	if (child->d_inode)
		return -EEXIST;
	if (IS_DEADDIR(dir))
		return -ENOENT;
1378
	return inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404
}

/* 
 * O_DIRECTORY translates into forcing a directory lookup.
 */
static inline int lookup_flags(unsigned int f)
{
	unsigned long retval = LOOKUP_FOLLOW;

	if (f & O_NOFOLLOW)
		retval &= ~LOOKUP_FOLLOW;
	
	if (f & O_DIRECTORY)
		retval |= LOOKUP_DIRECTORY;

	return retval;
}

/*
 * p1 and p2 should be directories on the same fs.
 */
struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
{
	struct dentry *p;

	if (p1 == p2) {
I
Ingo Molnar 已提交
1405
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
L
Linus Torvalds 已提交
1406 1407 1408
		return NULL;
	}

1409
	mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
1410

1411 1412 1413 1414 1415
	p = d_ancestor(p2, p1);
	if (p) {
		mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT);
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD);
		return p;
L
Linus Torvalds 已提交
1416 1417
	}

1418 1419 1420 1421 1422
	p = d_ancestor(p1, p2);
	if (p) {
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
		mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
		return p;
L
Linus Torvalds 已提交
1423 1424
	}

I
Ingo Molnar 已提交
1425 1426
	mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
	mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
L
Linus Torvalds 已提交
1427 1428 1429 1430 1431
	return NULL;
}

void unlock_rename(struct dentry *p1, struct dentry *p2)
{
1432
	mutex_unlock(&p1->d_inode->i_mutex);
L
Linus Torvalds 已提交
1433
	if (p1 != p2) {
1434
		mutex_unlock(&p2->d_inode->i_mutex);
1435
		mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
1436 1437 1438 1439 1440 1441
	}
}

int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
		struct nameidata *nd)
{
1442
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
1443 1444 1445 1446

	if (error)
		return error;

A
Al Viro 已提交
1447
	if (!dir->i_op->create)
L
Linus Torvalds 已提交
1448 1449 1450 1451 1452 1453
		return -EACCES;	/* shouldn't it be ENOSYS? */
	mode &= S_IALLUGO;
	mode |= S_IFREG;
	error = security_inode_create(dir, dentry, mode);
	if (error)
		return error;
1454
	vfs_dq_init(dir);
L
Linus Torvalds 已提交
1455
	error = dir->i_op->create(dir, dentry, mode, nd);
1456
	if (!error)
1457
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
1458 1459 1460
	return error;
}

1461
int may_open(struct path *path, int acc_mode, int flag)
L
Linus Torvalds 已提交
1462
{
1463
	struct dentry *dentry = path->dentry;
L
Linus Torvalds 已提交
1464 1465 1466 1467 1468 1469
	struct inode *inode = dentry->d_inode;
	int error;

	if (!inode)
		return -ENOENT;

C
Christoph Hellwig 已提交
1470 1471
	switch (inode->i_mode & S_IFMT) {
	case S_IFLNK:
L
Linus Torvalds 已提交
1472
		return -ELOOP;
C
Christoph Hellwig 已提交
1473 1474 1475 1476 1477 1478
	case S_IFDIR:
		if (acc_mode & MAY_WRITE)
			return -EISDIR;
		break;
	case S_IFBLK:
	case S_IFCHR:
1479
		if (path->mnt->mnt_flags & MNT_NODEV)
L
Linus Torvalds 已提交
1480
			return -EACCES;
C
Christoph Hellwig 已提交
1481 1482 1483
		/*FALLTHRU*/
	case S_IFIFO:
	case S_IFSOCK:
L
Linus Torvalds 已提交
1484
		flag &= ~O_TRUNC;
C
Christoph Hellwig 已提交
1485
		break;
1486
	}
1487

1488
	error = inode_permission(inode, acc_mode);
1489 1490
	if (error)
		return error;
M
Mimi Zohar 已提交
1491

L
Linus Torvalds 已提交
1492 1493 1494 1495 1496
	/*
	 * An append-only file must be opened in append mode for writing.
	 */
	if (IS_APPEND(inode)) {
		if  ((flag & FMODE_WRITE) && !(flag & O_APPEND))
1497
			return -EPERM;
L
Linus Torvalds 已提交
1498
		if (flag & O_TRUNC)
1499
			return -EPERM;
L
Linus Torvalds 已提交
1500 1501 1502
	}

	/* O_NOATIME can only be set by the owner or superuser */
1503 1504
	if (flag & O_NOATIME && !is_owner_or_cap(inode))
		return -EPERM;
L
Linus Torvalds 已提交
1505 1506 1507 1508

	/*
	 * Ensure there are no outstanding leases on the file.
	 */
1509
	return break_lease(inode, flag);
1510
}
L
Linus Torvalds 已提交
1511

1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530
static int handle_truncate(struct path *path)
{
	struct inode *inode = path->dentry->d_inode;
	int error = get_write_access(inode);
	if (error)
		return error;
	/*
	 * Refuse to truncate files with mandatory locks held on them.
	 */
	error = locks_verify_locked(inode);
	if (!error)
		error = security_path_truncate(path, 0,
				       ATTR_MTIME|ATTR_CTIME|ATTR_OPEN);
	if (!error) {
		error = do_truncate(path->dentry, 0,
				    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
				    NULL);
	}
	put_write_access(inode);
M
Mimi Zohar 已提交
1531
	return error;
L
Linus Torvalds 已提交
1532 1533
}

1534 1535 1536 1537 1538 1539
/*
 * Be careful about ever adding any more callers of this
 * function.  Its flags must be in the namei format, not
 * what get passed to sys_open().
 */
static int __open_namei_create(struct nameidata *nd, struct path *path,
1540 1541 1542
				int flag, int mode)
{
	int error;
1543
	struct dentry *dir = nd->path.dentry;
1544 1545

	if (!IS_POSIXACL(dir->d_inode))
A
Al Viro 已提交
1546
		mode &= ~current_umask();
1547 1548 1549
	error = security_path_mknod(&nd->path, path->dentry, mode, 0);
	if (error)
		goto out_unlock;
1550
	error = vfs_create(dir->d_inode, path->dentry, mode, nd);
1551
out_unlock:
1552
	mutex_unlock(&dir->d_inode->i_mutex);
1553 1554
	dput(nd->path.dentry);
	nd->path.dentry = path->dentry;
1555 1556 1557
	if (error)
		return error;
	/* Don't check for write permission, don't truncate */
1558
	return may_open(&nd->path, 0, flag & ~O_TRUNC);
1559 1560
}

1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584
/*
 * Note that while the flag value (low two bits) for sys_open means:
 *	00 - read-only
 *	01 - write-only
 *	10 - read-write
 *	11 - special
 * it is changed into
 *	00 - no permissions needed
 *	01 - read-permission
 *	10 - write-permission
 *	11 - read-write
 * for the internal routines (ie open_namei()/follow_link() etc)
 * This is more logical, and also allows the 00 "no perm needed"
 * to be used for symlinks (where the permissions are checked
 * later).
 *
*/
static inline int open_to_namei_flags(int flag)
{
	if ((flag+1) & O_ACCMODE)
		flag++;
	return flag;
}

1585
static int open_will_truncate(int flag, struct inode *inode)
1586 1587 1588 1589 1590 1591 1592 1593 1594 1595
{
	/*
	 * We'll never write to the fs underlying
	 * a device file.
	 */
	if (special_file(inode->i_mode))
		return 0;
	return (flag & O_TRUNC);
}

L
Linus Torvalds 已提交
1596
/*
1597 1598 1599
 * Note that the low bits of the passed in "open_flag"
 * are not the same as in the local variable "flag". See
 * open_to_namei_flags() for more details.
L
Linus Torvalds 已提交
1600
 */
1601
struct file *do_filp_open(int dfd, const char *pathname,
1602
		int open_flag, int mode, int acc_mode)
L
Linus Torvalds 已提交
1603
{
1604
	struct file *filp;
1605
	struct nameidata nd;
1606
	int error;
1607
	struct path path, save;
L
Linus Torvalds 已提交
1608 1609
	struct dentry *dir;
	int count = 0;
1610
	int will_truncate;
1611
	int flag = open_to_namei_flags(open_flag);
L
Linus Torvalds 已提交
1612

1613 1614 1615 1616 1617 1618 1619 1620 1621
	/*
	 * O_SYNC is implemented as __O_SYNC|O_DSYNC.  As many places only
	 * check for O_DSYNC if the need any syncing at all we enforce it's
	 * always set instead of having to deal with possibly weird behaviour
	 * for malicious applications setting only __O_SYNC.
	 */
	if (open_flag & __O_SYNC)
		open_flag |= O_DSYNC;

1622 1623
	if (!acc_mode)
		acc_mode = MAY_OPEN | ACC_MODE(flag);
L
Linus Torvalds 已提交
1624

1625 1626 1627 1628
	/* O_TRUNC implies we need access checks for write permissions */
	if (flag & O_TRUNC)
		acc_mode |= MAY_WRITE;

L
Linus Torvalds 已提交
1629 1630 1631 1632 1633 1634 1635 1636 1637
	/* Allow the LSM permission hook to distinguish append 
	   access from general write access. */
	if (flag & O_APPEND)
		acc_mode |= MAY_APPEND;

	/*
	 * The simplest case - just a plain lookup.
	 */
	if (!(flag & O_CREAT)) {
A
Al Viro 已提交
1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653
		filp = get_empty_filp();

		if (filp == NULL)
			return ERR_PTR(-ENFILE);
		nd.intent.open.file = filp;
		nd.intent.open.flags = flag;
		nd.intent.open.create_mode = 0;
		error = do_path_lookup(dfd, pathname,
					lookup_flags(flag)|LOOKUP_OPEN, &nd);
		if (IS_ERR(nd.intent.open.file)) {
			if (error == 0) {
				error = PTR_ERR(nd.intent.open.file);
				path_put(&nd.path);
			}
		} else if (error)
			release_open_intent(&nd);
L
Linus Torvalds 已提交
1654
		if (error)
1655
			return ERR_PTR(error);
L
Linus Torvalds 已提交
1656 1657 1658 1659 1660 1661
		goto ok;
	}

	/*
	 * Create - we need to know the parent.
	 */
1662
	error = path_init(dfd, pathname, LOOKUP_PARENT, &nd);
L
Linus Torvalds 已提交
1663
	if (error)
1664
		return ERR_PTR(error);
1665
	error = path_walk(pathname, &nd);
1666 1667 1668
	if (error) {
		if (nd.root.mnt)
			path_put(&nd.root);
1669
		return ERR_PTR(error);
1670
	}
1671 1672
	if (unlikely(!audit_dummy_context()))
		audit_inode(pathname, nd.path.dentry);
L
Linus Torvalds 已提交
1673 1674 1675 1676 1677 1678 1679

	/*
	 * We have the parent and last component. First of all, check
	 * that we are not asked to creat(2) an obvious directory - that
	 * will not do.
	 */
	error = -EISDIR;
1680
	if (nd.last_type != LAST_NORM || nd.last.name[nd.last.len])
A
Al Viro 已提交
1681
		goto exit_parent;
L
Linus Torvalds 已提交
1682

A
Al Viro 已提交
1683 1684 1685 1686 1687 1688 1689
	error = -ENFILE;
	filp = get_empty_filp();
	if (filp == NULL)
		goto exit_parent;
	nd.intent.open.file = filp;
	nd.intent.open.flags = flag;
	nd.intent.open.create_mode = mode;
1690 1691
	dir = nd.path.dentry;
	nd.flags &= ~LOOKUP_PARENT;
A
Al Viro 已提交
1692
	nd.flags |= LOOKUP_CREATE | LOOKUP_OPEN;
1693 1694
	if (flag & O_EXCL)
		nd.flags |= LOOKUP_EXCL;
1695
	mutex_lock(&dir->d_inode->i_mutex);
1696 1697
	path.dentry = lookup_hash(&nd);
	path.mnt = nd.path.mnt;
L
Linus Torvalds 已提交
1698 1699

do_last:
A
Al Viro 已提交
1700 1701
	error = PTR_ERR(path.dentry);
	if (IS_ERR(path.dentry)) {
1702
		mutex_unlock(&dir->d_inode->i_mutex);
L
Linus Torvalds 已提交
1703 1704 1705
		goto exit;
	}

1706 1707
	if (IS_ERR(nd.intent.open.file)) {
		error = PTR_ERR(nd.intent.open.file);
1708
		goto exit_mutex_unlock;
1709 1710
	}

L
Linus Torvalds 已提交
1711
	/* Negative dentry, just create the file */
A
Al Viro 已提交
1712
	if (!path.dentry->d_inode) {
1713 1714 1715 1716 1717 1718 1719 1720
		/*
		 * This write is needed to ensure that a
		 * ro->rw transition does not occur between
		 * the time when the file is created and when
		 * a permanent write count is taken through
		 * the 'struct file' in nameidata_to_filp().
		 */
		error = mnt_want_write(nd.path.mnt);
L
Linus Torvalds 已提交
1721
		if (error)
1722 1723 1724 1725
			goto exit_mutex_unlock;
		error = __open_namei_create(&nd, &path, flag, mode);
		if (error) {
			mnt_drop_write(nd.path.mnt);
L
Linus Torvalds 已提交
1726
			goto exit;
1727 1728 1729
		}
		filp = nameidata_to_filp(&nd, open_flag);
		mnt_drop_write(nd.path.mnt);
1730 1731
		if (nd.root.mnt)
			path_put(&nd.root);
1732 1733
		if (!IS_ERR(filp)) {
			error = ima_path_check(&filp->f_path, filp->f_mode &
1734
				       (MAY_READ | MAY_WRITE | MAY_EXEC));
1735 1736 1737 1738 1739
			if (error) {
				fput(filp);
				filp = ERR_PTR(error);
			}
		}
1740
		return filp;
L
Linus Torvalds 已提交
1741 1742 1743 1744 1745
	}

	/*
	 * It already exists.
	 */
1746
	mutex_unlock(&dir->d_inode->i_mutex);
1747
	audit_inode(pathname, path.dentry);
L
Linus Torvalds 已提交
1748 1749 1750 1751 1752

	error = -EEXIST;
	if (flag & O_EXCL)
		goto exit_dput;

A
Al Viro 已提交
1753
	if (__follow_mount(&path)) {
L
Linus Torvalds 已提交
1754
		error = -ELOOP;
A
Al Viro 已提交
1755 1756
		if (flag & O_NOFOLLOW)
			goto exit_dput;
L
Linus Torvalds 已提交
1757
	}
1758

L
Linus Torvalds 已提交
1759
	error = -ENOENT;
A
Al Viro 已提交
1760
	if (!path.dentry->d_inode)
L
Linus Torvalds 已提交
1761
		goto exit_dput;
A
Al Viro 已提交
1762
	if (path.dentry->d_inode->i_op->follow_link)
L
Linus Torvalds 已提交
1763 1764
		goto do_link;

1765
	path_to_nameidata(&path, &nd);
L
Linus Torvalds 已提交
1766
	error = -EISDIR;
1767
	if (S_ISDIR(path.dentry->d_inode->i_mode))
L
Linus Torvalds 已提交
1768 1769
		goto exit;
ok:
1770 1771 1772 1773 1774 1775 1776 1777 1778 1779
	/*
	 * Consider:
	 * 1. may_open() truncates a file
	 * 2. a rw->ro mount transition occurs
	 * 3. nameidata_to_filp() fails due to
	 *    the ro mount.
	 * That would be inconsistent, and should
	 * be avoided. Taking this mnt write here
	 * ensures that (2) can not occur.
	 */
1780 1781
	will_truncate = open_will_truncate(flag, nd.path.dentry->d_inode);
	if (will_truncate) {
1782 1783 1784 1785
		error = mnt_want_write(nd.path.mnt);
		if (error)
			goto exit;
	}
1786
	error = may_open(&nd.path, acc_mode, flag);
1787
	if (error) {
1788
		if (will_truncate)
1789
			mnt_drop_write(nd.path.mnt);
L
Linus Torvalds 已提交
1790
		goto exit;
1791 1792
	}
	filp = nameidata_to_filp(&nd, open_flag);
1793 1794
	if (!IS_ERR(filp)) {
		error = ima_path_check(&filp->f_path, filp->f_mode &
1795
			       (MAY_READ | MAY_WRITE | MAY_EXEC));
1796 1797
		if (error) {
			fput(filp);
1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810
			filp = ERR_PTR(error);
		}
	}
	if (!IS_ERR(filp)) {
		if (acc_mode & MAY_WRITE)
			vfs_dq_init(nd.path.dentry->d_inode);

		if (will_truncate) {
			error = handle_truncate(&nd.path);
			if (error) {
				fput(filp);
				filp = ERR_PTR(error);
			}
1811 1812
		}
	}
1813 1814 1815 1816 1817
	/*
	 * It is now safe to drop the mnt write
	 * because the filp has had a write taken
	 * on its behalf.
	 */
1818
	if (will_truncate)
1819
		mnt_drop_write(nd.path.mnt);
1820 1821
	if (nd.root.mnt)
		path_put(&nd.root);
1822
	return filp;
L
Linus Torvalds 已提交
1823

1824 1825
exit_mutex_unlock:
	mutex_unlock(&dir->d_inode->i_mutex);
L
Linus Torvalds 已提交
1826
exit_dput:
1827
	path_put_conditional(&path, &nd);
L
Linus Torvalds 已提交
1828
exit:
1829 1830
	if (!IS_ERR(nd.intent.open.file))
		release_open_intent(&nd);
A
Al Viro 已提交
1831
exit_parent:
A
Al Viro 已提交
1832 1833
	if (nd.root.mnt)
		path_put(&nd.root);
1834 1835
	path_put(&nd.path);
	return ERR_PTR(error);
L
Linus Torvalds 已提交
1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850

do_link:
	error = -ELOOP;
	if (flag & O_NOFOLLOW)
		goto exit_dput;
	/*
	 * This is subtle. Instead of calling do_follow_link() we do the
	 * thing by hands. The reason is that this way we have zero link_count
	 * and path_walk() (called from ->follow_link) honoring LOOKUP_PARENT.
	 * After that we have the parent and last component, i.e.
	 * we are in the same situation as after the first path_walk().
	 * Well, almost - if the last component is normal we get its copy
	 * stored in nd->last.name and we will have to putname() it when we
	 * are done. Procfs-like symlinks just set LAST_BIND.
	 */
1851 1852
	nd.flags |= LOOKUP_PARENT;
	error = security_inode_follow_link(path.dentry, &nd);
L
Linus Torvalds 已提交
1853 1854
	if (error)
		goto exit_dput;
1855 1856
	save = nd.path;
	path_get(&save);
1857
	error = __do_follow_link(&path, &nd);
1858 1859 1860 1861 1862 1863 1864 1865
	if (error == -ESTALE) {
		/* nd.path had been dropped */
		nd.path = save;
		path_get(&nd.path);
		nd.flags |= LOOKUP_REVAL;
		error = __do_follow_link(&path, &nd);
	}
	path_put(&save);
1866
	path_put(&path);
K
Kirill Korotaev 已提交
1867 1868 1869 1870 1871
	if (error) {
		/* Does someone understand code flow here? Or it is only
		 * me so stupid? Anathema to whoever designed this non-sense
		 * with "intent.open".
		 */
1872
		release_open_intent(&nd);
1873 1874
		if (nd.root.mnt)
			path_put(&nd.root);
1875
		return ERR_PTR(error);
K
Kirill Korotaev 已提交
1876
	}
1877 1878
	nd.flags &= ~LOOKUP_PARENT;
	if (nd.last_type == LAST_BIND)
L
Linus Torvalds 已提交
1879 1880
		goto ok;
	error = -EISDIR;
1881
	if (nd.last_type != LAST_NORM)
L
Linus Torvalds 已提交
1882
		goto exit;
1883 1884
	if (nd.last.name[nd.last.len]) {
		__putname(nd.last.name);
L
Linus Torvalds 已提交
1885 1886 1887 1888
		goto exit;
	}
	error = -ELOOP;
	if (count++==32) {
1889
		__putname(nd.last.name);
L
Linus Torvalds 已提交
1890 1891
		goto exit;
	}
1892
	dir = nd.path.dentry;
1893
	mutex_lock(&dir->d_inode->i_mutex);
1894 1895 1896
	path.dentry = lookup_hash(&nd);
	path.mnt = nd.path.mnt;
	__putname(nd.last.name);
L
Linus Torvalds 已提交
1897 1898 1899
	goto do_last;
}

1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912
/**
 * filp_open - open file and return file pointer
 *
 * @filename:	path to open
 * @flags:	open flags as per the open(2) second argument
 * @mode:	mode for the new file if O_CREAT is set, else ignored
 *
 * This is the helper to open a file from kernelspace if you really
 * have to.  But in generally you should not do this, so please move
 * along, nothing to see here..
 */
struct file *filp_open(const char *filename, int flags, int mode)
{
1913
	return do_filp_open(AT_FDCWD, filename, flags, mode, 0);
1914 1915 1916
}
EXPORT_SYMBOL(filp_open);

L
Linus Torvalds 已提交
1917 1918 1919 1920 1921 1922 1923
/**
 * lookup_create - lookup a dentry, creating it if it doesn't exist
 * @nd: nameidata info
 * @is_dir: directory flag
 *
 * Simple function to lookup and return a dentry and create it
 * if it doesn't exist.  Is SMP-safe.
1924
 *
1925
 * Returns with nd->path.dentry->d_inode->i_mutex locked.
L
Linus Torvalds 已提交
1926 1927 1928
 */
struct dentry *lookup_create(struct nameidata *nd, int is_dir)
{
1929
	struct dentry *dentry = ERR_PTR(-EEXIST);
L
Linus Torvalds 已提交
1930

1931
	mutex_lock_nested(&nd->path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
1932 1933 1934 1935
	/*
	 * Yucky last component or no last component at all?
	 * (foo/., foo/.., /////)
	 */
L
Linus Torvalds 已提交
1936 1937 1938
	if (nd->last_type != LAST_NORM)
		goto fail;
	nd->flags &= ~LOOKUP_PARENT;
1939
	nd->flags |= LOOKUP_CREATE | LOOKUP_EXCL;
1940
	nd->intent.open.flags = O_EXCL;
1941 1942 1943 1944

	/*
	 * Do the final lookup.
	 */
1945
	dentry = lookup_hash(nd);
L
Linus Torvalds 已提交
1946 1947
	if (IS_ERR(dentry))
		goto fail;
1948

1949 1950
	if (dentry->d_inode)
		goto eexist;
1951 1952 1953 1954 1955 1956
	/*
	 * Special case - lookup gave negative, but... we had foo/bar/
	 * From the vfs_mknod() POV we just have a negative dentry -
	 * all is fine. Let's be bastards - you had / on the end, you've
	 * been asking for (non-existent) directory. -ENOENT for you.
	 */
1957 1958 1959 1960
	if (unlikely(!is_dir && nd->last.name[nd->last.len])) {
		dput(dentry);
		dentry = ERR_PTR(-ENOENT);
	}
L
Linus Torvalds 已提交
1961
	return dentry;
1962
eexist:
L
Linus Torvalds 已提交
1963
	dput(dentry);
1964
	dentry = ERR_PTR(-EEXIST);
L
Linus Torvalds 已提交
1965 1966 1967
fail:
	return dentry;
}
1968
EXPORT_SYMBOL_GPL(lookup_create);
L
Linus Torvalds 已提交
1969 1970 1971

int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
{
1972
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
1973 1974 1975 1976 1977 1978 1979

	if (error)
		return error;

	if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
		return -EPERM;

A
Al Viro 已提交
1980
	if (!dir->i_op->mknod)
L
Linus Torvalds 已提交
1981 1982
		return -EPERM;

1983 1984 1985 1986
	error = devcgroup_inode_mknod(mode, dev);
	if (error)
		return error;

L
Linus Torvalds 已提交
1987 1988 1989 1990
	error = security_inode_mknod(dir, dentry, mode, dev);
	if (error)
		return error;

1991
	vfs_dq_init(dir);
L
Linus Torvalds 已提交
1992
	error = dir->i_op->mknod(dir, dentry, mode, dev);
1993
	if (!error)
1994
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
1995 1996 1997
	return error;
}

1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014
static int may_mknod(mode_t mode)
{
	switch (mode & S_IFMT) {
	case S_IFREG:
	case S_IFCHR:
	case S_IFBLK:
	case S_IFIFO:
	case S_IFSOCK:
	case 0: /* zero mode translates to S_IFREG */
		return 0;
	case S_IFDIR:
		return -EPERM;
	default:
		return -EINVAL;
	}
}

2015 2016
SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
		unsigned, dev)
L
Linus Torvalds 已提交
2017
{
2018 2019 2020
	int error;
	char *tmp;
	struct dentry *dentry;
L
Linus Torvalds 已提交
2021 2022 2023 2024 2025
	struct nameidata nd;

	if (S_ISDIR(mode))
		return -EPERM;

2026
	error = user_path_parent(dfd, filename, &nd, &tmp);
L
Linus Torvalds 已提交
2027
	if (error)
2028 2029
		return error;

L
Linus Torvalds 已提交
2030
	dentry = lookup_create(&nd, 0);
2031 2032 2033 2034
	if (IS_ERR(dentry)) {
		error = PTR_ERR(dentry);
		goto out_unlock;
	}
2035
	if (!IS_POSIXACL(nd.path.dentry->d_inode))
A
Al Viro 已提交
2036
		mode &= ~current_umask();
2037 2038 2039 2040 2041 2042
	error = may_mknod(mode);
	if (error)
		goto out_dput;
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto out_dput;
2043 2044 2045
	error = security_path_mknod(&nd.path, dentry, mode, dev);
	if (error)
		goto out_drop_write;
2046
	switch (mode & S_IFMT) {
L
Linus Torvalds 已提交
2047
		case 0: case S_IFREG:
2048
			error = vfs_create(nd.path.dentry->d_inode,dentry,mode,&nd);
L
Linus Torvalds 已提交
2049 2050
			break;
		case S_IFCHR: case S_IFBLK:
2051
			error = vfs_mknod(nd.path.dentry->d_inode,dentry,mode,
L
Linus Torvalds 已提交
2052 2053 2054
					new_decode_dev(dev));
			break;
		case S_IFIFO: case S_IFSOCK:
2055
			error = vfs_mknod(nd.path.dentry->d_inode,dentry,mode,0);
L
Linus Torvalds 已提交
2056 2057
			break;
	}
2058
out_drop_write:
2059 2060 2061 2062
	mnt_drop_write(nd.path.mnt);
out_dput:
	dput(dentry);
out_unlock:
2063
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
J
Jan Blunck 已提交
2064
	path_put(&nd.path);
L
Linus Torvalds 已提交
2065 2066 2067 2068 2069
	putname(tmp);

	return error;
}

2070
SYSCALL_DEFINE3(mknod, const char __user *, filename, int, mode, unsigned, dev)
2071 2072 2073 2074
{
	return sys_mknodat(AT_FDCWD, filename, mode, dev);
}

L
Linus Torvalds 已提交
2075 2076
int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
{
2077
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2078 2079 2080 2081

	if (error)
		return error;

A
Al Viro 已提交
2082
	if (!dir->i_op->mkdir)
L
Linus Torvalds 已提交
2083 2084 2085 2086 2087 2088 2089
		return -EPERM;

	mode &= (S_IRWXUGO|S_ISVTX);
	error = security_inode_mkdir(dir, dentry, mode);
	if (error)
		return error;

2090
	vfs_dq_init(dir);
L
Linus Torvalds 已提交
2091
	error = dir->i_op->mkdir(dir, dentry, mode);
2092
	if (!error)
2093
		fsnotify_mkdir(dir, dentry);
L
Linus Torvalds 已提交
2094 2095 2096
	return error;
}

2097
SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
L
Linus Torvalds 已提交
2098 2099 2100
{
	int error = 0;
	char * tmp;
2101 2102
	struct dentry *dentry;
	struct nameidata nd;
L
Linus Torvalds 已提交
2103

2104 2105
	error = user_path_parent(dfd, pathname, &nd, &tmp);
	if (error)
2106
		goto out_err;
L
Linus Torvalds 已提交
2107

2108 2109 2110 2111
	dentry = lookup_create(&nd, 1);
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry))
		goto out_unlock;
L
Linus Torvalds 已提交
2112

2113
	if (!IS_POSIXACL(nd.path.dentry->d_inode))
A
Al Viro 已提交
2114
		mode &= ~current_umask();
2115 2116 2117
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto out_dput;
2118 2119 2120
	error = security_path_mkdir(&nd.path, dentry, mode);
	if (error)
		goto out_drop_write;
2121
	error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
2122
out_drop_write:
2123 2124
	mnt_drop_write(nd.path.mnt);
out_dput:
2125 2126
	dput(dentry);
out_unlock:
2127
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
J
Jan Blunck 已提交
2128
	path_put(&nd.path);
2129 2130
	putname(tmp);
out_err:
L
Linus Torvalds 已提交
2131 2132 2133
	return error;
}

2134
SYSCALL_DEFINE2(mkdir, const char __user *, pathname, int, mode)
2135 2136 2137 2138
{
	return sys_mkdirat(AT_FDCWD, pathname, mode);
}

L
Linus Torvalds 已提交
2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149 2150 2151 2152 2153 2154 2155 2156
/*
 * We try to drop the dentry early: we should have
 * a usage count of 2 if we're the only user of this
 * dentry, and if that is true (possibly after pruning
 * the dcache), then we drop the dentry now.
 *
 * A low-level filesystem can, if it choses, legally
 * do a
 *
 *	if (!d_unhashed(dentry))
 *		return -EBUSY;
 *
 * if it cannot handle the case of removing a directory
 * that is still in use by something else..
 */
void dentry_unhash(struct dentry *dentry)
{
	dget(dentry);
2157
	shrink_dcache_parent(dentry);
L
Linus Torvalds 已提交
2158 2159 2160 2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172
	spin_lock(&dcache_lock);
	spin_lock(&dentry->d_lock);
	if (atomic_read(&dentry->d_count) == 2)
		__d_drop(dentry);
	spin_unlock(&dentry->d_lock);
	spin_unlock(&dcache_lock);
}

int vfs_rmdir(struct inode *dir, struct dentry *dentry)
{
	int error = may_delete(dir, dentry, 1);

	if (error)
		return error;

A
Al Viro 已提交
2173
	if (!dir->i_op->rmdir)
L
Linus Torvalds 已提交
2174 2175
		return -EPERM;

2176
	vfs_dq_init(dir);
L
Linus Torvalds 已提交
2177

2178
	mutex_lock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189
	dentry_unhash(dentry);
	if (d_mountpoint(dentry))
		error = -EBUSY;
	else {
		error = security_inode_rmdir(dir, dentry);
		if (!error) {
			error = dir->i_op->rmdir(dir, dentry);
			if (!error)
				dentry->d_inode->i_flags |= S_DEAD;
		}
	}
2190
	mutex_unlock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2191 2192 2193 2194 2195 2196 2197 2198
	if (!error) {
		d_delete(dentry);
	}
	dput(dentry);

	return error;
}

2199
static long do_rmdir(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
2200 2201 2202 2203 2204 2205
{
	int error = 0;
	char * name;
	struct dentry *dentry;
	struct nameidata nd;

2206
	error = user_path_parent(dfd, pathname, &nd, &name);
L
Linus Torvalds 已提交
2207
	if (error)
2208
		return error;
L
Linus Torvalds 已提交
2209 2210

	switch(nd.last_type) {
2211 2212 2213 2214 2215 2216 2217 2218 2219
	case LAST_DOTDOT:
		error = -ENOTEMPTY;
		goto exit1;
	case LAST_DOT:
		error = -EINVAL;
		goto exit1;
	case LAST_ROOT:
		error = -EBUSY;
		goto exit1;
L
Linus Torvalds 已提交
2220
	}
2221 2222 2223

	nd.flags &= ~LOOKUP_PARENT;

2224
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2225
	dentry = lookup_hash(&nd);
L
Linus Torvalds 已提交
2226
	error = PTR_ERR(dentry);
2227 2228
	if (IS_ERR(dentry))
		goto exit2;
2229 2230 2231
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto exit3;
2232 2233 2234
	error = security_path_rmdir(&nd.path, dentry);
	if (error)
		goto exit4;
2235
	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
2236
exit4:
2237 2238
	mnt_drop_write(nd.path.mnt);
exit3:
2239 2240
	dput(dentry);
exit2:
2241
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2242
exit1:
J
Jan Blunck 已提交
2243
	path_put(&nd.path);
L
Linus Torvalds 已提交
2244 2245 2246 2247
	putname(name);
	return error;
}

2248
SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
2249 2250 2251 2252
{
	return do_rmdir(AT_FDCWD, pathname);
}

L
Linus Torvalds 已提交
2253 2254 2255 2256 2257 2258 2259
int vfs_unlink(struct inode *dir, struct dentry *dentry)
{
	int error = may_delete(dir, dentry, 0);

	if (error)
		return error;

A
Al Viro 已提交
2260
	if (!dir->i_op->unlink)
L
Linus Torvalds 已提交
2261 2262
		return -EPERM;

2263
	vfs_dq_init(dir);
L
Linus Torvalds 已提交
2264

2265
	mutex_lock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2266 2267 2268 2269 2270 2271 2272
	if (d_mountpoint(dentry))
		error = -EBUSY;
	else {
		error = security_inode_unlink(dir, dentry);
		if (!error)
			error = dir->i_op->unlink(dir, dentry);
	}
2273
	mutex_unlock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2274 2275 2276

	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
	if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
2277
		fsnotify_link_count(dentry->d_inode);
J
John McCutchan 已提交
2278
		d_delete(dentry);
L
Linus Torvalds 已提交
2279
	}
R
Robert Love 已提交
2280

L
Linus Torvalds 已提交
2281 2282 2283 2284 2285
	return error;
}

/*
 * Make sure that the actual truncation of the file will occur outside its
2286
 * directory's i_mutex.  Truncate can take a long time if there is a lot of
L
Linus Torvalds 已提交
2287 2288 2289
 * writeout happening, and we don't want to prevent access to the directory
 * while waiting on the I/O.
 */
2290
static long do_unlinkat(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
2291
{
2292 2293
	int error;
	char *name;
L
Linus Torvalds 已提交
2294 2295 2296 2297
	struct dentry *dentry;
	struct nameidata nd;
	struct inode *inode = NULL;

2298
	error = user_path_parent(dfd, pathname, &nd, &name);
L
Linus Torvalds 已提交
2299
	if (error)
2300 2301
		return error;

L
Linus Torvalds 已提交
2302 2303 2304
	error = -EISDIR;
	if (nd.last_type != LAST_NORM)
		goto exit1;
2305 2306 2307

	nd.flags &= ~LOOKUP_PARENT;

2308
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2309
	dentry = lookup_hash(&nd);
L
Linus Torvalds 已提交
2310 2311 2312 2313 2314 2315 2316 2317
	error = PTR_ERR(dentry);
	if (!IS_ERR(dentry)) {
		/* Why not before? Because we want correct error value */
		if (nd.last.name[nd.last.len])
			goto slashes;
		inode = dentry->d_inode;
		if (inode)
			atomic_inc(&inode->i_count);
2318 2319 2320
		error = mnt_want_write(nd.path.mnt);
		if (error)
			goto exit2;
2321 2322 2323
		error = security_path_unlink(&nd.path, dentry);
		if (error)
			goto exit3;
2324
		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
2325
exit3:
2326
		mnt_drop_write(nd.path.mnt);
L
Linus Torvalds 已提交
2327 2328 2329
	exit2:
		dput(dentry);
	}
2330
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2331 2332 2333
	if (inode)
		iput(inode);	/* truncate the inode here */
exit1:
J
Jan Blunck 已提交
2334
	path_put(&nd.path);
L
Linus Torvalds 已提交
2335 2336 2337 2338 2339 2340 2341 2342 2343
	putname(name);
	return error;

slashes:
	error = !dentry->d_inode ? -ENOENT :
		S_ISDIR(dentry->d_inode->i_mode) ? -EISDIR : -ENOTDIR;
	goto exit2;
}

2344
SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
2345 2346 2347 2348 2349 2350 2351 2352 2353 2354
{
	if ((flag & ~AT_REMOVEDIR) != 0)
		return -EINVAL;

	if (flag & AT_REMOVEDIR)
		return do_rmdir(dfd, pathname);

	return do_unlinkat(dfd, pathname);
}

2355
SYSCALL_DEFINE1(unlink, const char __user *, pathname)
2356 2357 2358 2359
{
	return do_unlinkat(AT_FDCWD, pathname);
}

2360
int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
L
Linus Torvalds 已提交
2361
{
2362
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2363 2364 2365 2366

	if (error)
		return error;

A
Al Viro 已提交
2367
	if (!dir->i_op->symlink)
L
Linus Torvalds 已提交
2368 2369 2370 2371 2372 2373
		return -EPERM;

	error = security_inode_symlink(dir, dentry, oldname);
	if (error)
		return error;

2374
	vfs_dq_init(dir);
L
Linus Torvalds 已提交
2375
	error = dir->i_op->symlink(dir, dentry, oldname);
2376
	if (!error)
2377
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
2378 2379 2380
	return error;
}

2381 2382
SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
L
Linus Torvalds 已提交
2383
{
2384 2385 2386
	int error;
	char *from;
	char *to;
2387 2388
	struct dentry *dentry;
	struct nameidata nd;
L
Linus Torvalds 已提交
2389 2390

	from = getname(oldname);
2391
	if (IS_ERR(from))
L
Linus Torvalds 已提交
2392 2393
		return PTR_ERR(from);

2394
	error = user_path_parent(newdfd, newname, &nd, &to);
2395
	if (error)
2396 2397
		goto out_putname;

2398 2399 2400 2401 2402
	dentry = lookup_create(&nd, 0);
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry))
		goto out_unlock;

2403 2404 2405
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto out_dput;
2406 2407 2408
	error = security_path_symlink(&nd.path, dentry, from);
	if (error)
		goto out_drop_write;
2409
	error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
2410
out_drop_write:
2411 2412
	mnt_drop_write(nd.path.mnt);
out_dput:
2413 2414
	dput(dentry);
out_unlock:
2415
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
J
Jan Blunck 已提交
2416
	path_put(&nd.path);
2417 2418
	putname(to);
out_putname:
L
Linus Torvalds 已提交
2419 2420 2421 2422
	putname(from);
	return error;
}

2423
SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
2424 2425 2426 2427
{
	return sys_symlinkat(oldname, AT_FDCWD, newname);
}

L
Linus Torvalds 已提交
2428 2429 2430 2431 2432 2433 2434 2435
int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
{
	struct inode *inode = old_dentry->d_inode;
	int error;

	if (!inode)
		return -ENOENT;

2436
	error = may_create(dir, new_dentry);
L
Linus Torvalds 已提交
2437 2438 2439 2440 2441 2442 2443 2444 2445 2446 2447
	if (error)
		return error;

	if (dir->i_sb != inode->i_sb)
		return -EXDEV;

	/*
	 * A link to an append-only or immutable file cannot be created.
	 */
	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
		return -EPERM;
A
Al Viro 已提交
2448
	if (!dir->i_op->link)
L
Linus Torvalds 已提交
2449
		return -EPERM;
2450
	if (S_ISDIR(inode->i_mode))
L
Linus Torvalds 已提交
2451 2452 2453 2454 2455 2456
		return -EPERM;

	error = security_inode_link(old_dentry, dir, new_dentry);
	if (error)
		return error;

2457
	mutex_lock(&inode->i_mutex);
2458
	vfs_dq_init(dir);
L
Linus Torvalds 已提交
2459
	error = dir->i_op->link(old_dentry, dir, new_dentry);
2460
	mutex_unlock(&inode->i_mutex);
2461
	if (!error)
2462
		fsnotify_link(dir, inode, new_dentry);
L
Linus Torvalds 已提交
2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474
	return error;
}

/*
 * Hardlinks are often used in delicate situations.  We avoid
 * security-related surprises by not following symlinks on the
 * newname.  --KAB
 *
 * We don't follow them on the oldname either to be compatible
 * with linux 2.0, and to avoid hard-linking to directories
 * and other special files.  --ADM
 */
2475 2476
SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname, int, flags)
L
Linus Torvalds 已提交
2477 2478
{
	struct dentry *new_dentry;
2479 2480
	struct nameidata nd;
	struct path old_path;
L
Linus Torvalds 已提交
2481
	int error;
2482
	char *to;
L
Linus Torvalds 已提交
2483

2484
	if ((flags & ~AT_SYMLINK_FOLLOW) != 0)
2485 2486
		return -EINVAL;

2487 2488 2489
	error = user_path_at(olddfd, oldname,
			     flags & AT_SYMLINK_FOLLOW ? LOOKUP_FOLLOW : 0,
			     &old_path);
L
Linus Torvalds 已提交
2490
	if (error)
2491 2492 2493
		return error;

	error = user_path_parent(newdfd, newname, &nd, &to);
L
Linus Torvalds 已提交
2494 2495 2496
	if (error)
		goto out;
	error = -EXDEV;
2497
	if (old_path.mnt != nd.path.mnt)
L
Linus Torvalds 已提交
2498 2499 2500
		goto out_release;
	new_dentry = lookup_create(&nd, 0);
	error = PTR_ERR(new_dentry);
2501 2502
	if (IS_ERR(new_dentry))
		goto out_unlock;
2503 2504 2505
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto out_dput;
2506 2507 2508
	error = security_path_link(old_path.dentry, &nd.path, new_dentry);
	if (error)
		goto out_drop_write;
2509
	error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
2510
out_drop_write:
2511 2512
	mnt_drop_write(nd.path.mnt);
out_dput:
2513 2514
	dput(new_dentry);
out_unlock:
2515
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2516
out_release:
J
Jan Blunck 已提交
2517
	path_put(&nd.path);
2518
	putname(to);
L
Linus Torvalds 已提交
2519
out:
2520
	path_put(&old_path);
L
Linus Torvalds 已提交
2521 2522 2523 2524

	return error;
}

2525
SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
2526
{
2527
	return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
2528 2529
}

L
Linus Torvalds 已提交
2530 2531 2532 2533 2534 2535 2536
/*
 * The worst of all namespace operations - renaming directory. "Perverted"
 * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
 * Problems:
 *	a) we can get into loop creation. Check is done in is_subdir().
 *	b) race potential - two innocent renames can create a loop together.
 *	   That's where 4.4 screws up. Current fix: serialization on
2537
 *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
L
Linus Torvalds 已提交
2538 2539
 *	   story.
 *	c) we have to lock _three_ objects - parents and victim (if it exists).
2540
 *	   And that - after we got ->i_mutex on parents (until then we don't know
L
Linus Torvalds 已提交
2541 2542
 *	   whether the target exists).  Solution: try to be smart with locking
 *	   order for inodes.  We rely on the fact that tree topology may change
2543
 *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
L
Linus Torvalds 已提交
2544 2545 2546
 *	   move will be locked.  Thus we can rank directories by the tree
 *	   (ancestors first) and rank all non-directories after them.
 *	   That works since everybody except rename does "lock parent, lookup,
2547
 *	   lock child" and rename is under ->s_vfs_rename_mutex.
L
Linus Torvalds 已提交
2548 2549 2550 2551 2552 2553 2554 2555 2556
 *	   HOWEVER, it relies on the assumption that any object with ->lookup()
 *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
 *	   we'd better make sure that there's no link(2) for them.
 *	d) some filesystems don't support opened-but-unlinked directories,
 *	   either because of layout or because they are not ready to deal with
 *	   all cases correctly. The latter will be fixed (taking this sort of
 *	   stuff into VFS), but the former is not going away. Solution: the same
 *	   trick as in rmdir().
 *	e) conversion from fhandle to dentry may come in the wrong moment - when
2557
 *	   we are removing the target. Solution: we will have to grab ->i_mutex
L
Linus Torvalds 已提交
2558
 *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
2559
 *	   ->i_mutex on parents, which works but leads to some truely excessive
L
Linus Torvalds 已提交
2560 2561
 *	   locking].
 */
A
Adrian Bunk 已提交
2562 2563
static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
			  struct inode *new_dir, struct dentry *new_dentry)
L
Linus Torvalds 已提交
2564 2565 2566 2567 2568 2569 2570 2571 2572
{
	int error = 0;
	struct inode *target;

	/*
	 * If we are going to change the parent - check write permissions,
	 * we'll need to flip '..'.
	 */
	if (new_dir != old_dir) {
2573
		error = inode_permission(old_dentry->d_inode, MAY_WRITE);
L
Linus Torvalds 已提交
2574 2575 2576 2577 2578 2579 2580 2581 2582 2583
		if (error)
			return error;
	}

	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		return error;

	target = new_dentry->d_inode;
	if (target) {
2584
		mutex_lock(&target->i_mutex);
L
Linus Torvalds 已提交
2585 2586 2587 2588 2589 2590 2591 2592 2593
		dentry_unhash(new_dentry);
	}
	if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
		error = -EBUSY;
	else 
		error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
	if (target) {
		if (!error)
			target->i_flags |= S_DEAD;
2594
		mutex_unlock(&target->i_mutex);
L
Linus Torvalds 已提交
2595 2596 2597 2598
		if (d_unhashed(new_dentry))
			d_rehash(new_dentry);
		dput(new_dentry);
	}
2599
	if (!error)
2600 2601
		if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
			d_move(old_dentry,new_dentry);
L
Linus Torvalds 已提交
2602 2603 2604
	return error;
}

A
Adrian Bunk 已提交
2605 2606
static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
			    struct inode *new_dir, struct dentry *new_dentry)
L
Linus Torvalds 已提交
2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617
{
	struct inode *target;
	int error;

	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		return error;

	dget(new_dentry);
	target = new_dentry->d_inode;
	if (target)
2618
		mutex_lock(&target->i_mutex);
L
Linus Torvalds 已提交
2619 2620 2621 2622 2623
	if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
		error = -EBUSY;
	else
		error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
	if (!error) {
2624
		if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
L
Linus Torvalds 已提交
2625 2626 2627
			d_move(old_dentry, new_dentry);
	}
	if (target)
2628
		mutex_unlock(&target->i_mutex);
L
Linus Torvalds 已提交
2629 2630 2631 2632 2633 2634 2635 2636 2637
	dput(new_dentry);
	return error;
}

int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
	       struct inode *new_dir, struct dentry *new_dentry)
{
	int error;
	int is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
R
Robert Love 已提交
2638
	const char *old_name;
L
Linus Torvalds 已提交
2639 2640 2641 2642 2643 2644 2645 2646 2647

	if (old_dentry->d_inode == new_dentry->d_inode)
 		return 0;
 
	error = may_delete(old_dir, old_dentry, is_dir);
	if (error)
		return error;

	if (!new_dentry->d_inode)
2648
		error = may_create(new_dir, new_dentry);
L
Linus Torvalds 已提交
2649 2650 2651 2652 2653
	else
		error = may_delete(new_dir, new_dentry, is_dir);
	if (error)
		return error;

A
Al Viro 已提交
2654
	if (!old_dir->i_op->rename)
L
Linus Torvalds 已提交
2655 2656
		return -EPERM;

2657 2658
	vfs_dq_init(old_dir);
	vfs_dq_init(new_dir);
L
Linus Torvalds 已提交
2659

R
Robert Love 已提交
2660 2661
	old_name = fsnotify_oldname_init(old_dentry->d_name.name);

L
Linus Torvalds 已提交
2662 2663 2664 2665 2666
	if (is_dir)
		error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
	else
		error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
	if (!error) {
R
Robert Love 已提交
2667
		const char *new_name = old_dentry->d_name.name;
2668
		fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir,
2669
			      new_dentry->d_inode, old_dentry);
L
Linus Torvalds 已提交
2670
	}
R
Robert Love 已提交
2671 2672
	fsnotify_oldname_free(old_name);

L
Linus Torvalds 已提交
2673 2674 2675
	return error;
}

2676 2677
SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
L
Linus Torvalds 已提交
2678
{
2679 2680 2681
	struct dentry *old_dir, *new_dir;
	struct dentry *old_dentry, *new_dentry;
	struct dentry *trap;
L
Linus Torvalds 已提交
2682
	struct nameidata oldnd, newnd;
2683 2684 2685
	char *from;
	char *to;
	int error;
L
Linus Torvalds 已提交
2686

2687
	error = user_path_parent(olddfd, oldname, &oldnd, &from);
L
Linus Torvalds 已提交
2688 2689 2690
	if (error)
		goto exit;

2691
	error = user_path_parent(newdfd, newname, &newnd, &to);
L
Linus Torvalds 已提交
2692 2693 2694 2695
	if (error)
		goto exit1;

	error = -EXDEV;
2696
	if (oldnd.path.mnt != newnd.path.mnt)
L
Linus Torvalds 已提交
2697 2698
		goto exit2;

2699
	old_dir = oldnd.path.dentry;
L
Linus Torvalds 已提交
2700 2701 2702 2703
	error = -EBUSY;
	if (oldnd.last_type != LAST_NORM)
		goto exit2;

2704
	new_dir = newnd.path.dentry;
L
Linus Torvalds 已提交
2705 2706 2707
	if (newnd.last_type != LAST_NORM)
		goto exit2;

2708 2709
	oldnd.flags &= ~LOOKUP_PARENT;
	newnd.flags &= ~LOOKUP_PARENT;
2710
	newnd.flags |= LOOKUP_RENAME_TARGET;
2711

L
Linus Torvalds 已提交
2712 2713
	trap = lock_rename(new_dir, old_dir);

2714
	old_dentry = lookup_hash(&oldnd);
L
Linus Torvalds 已提交
2715 2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731 2732 2733
	error = PTR_ERR(old_dentry);
	if (IS_ERR(old_dentry))
		goto exit3;
	/* source must exist */
	error = -ENOENT;
	if (!old_dentry->d_inode)
		goto exit4;
	/* unless the source is a directory trailing slashes give -ENOTDIR */
	if (!S_ISDIR(old_dentry->d_inode->i_mode)) {
		error = -ENOTDIR;
		if (oldnd.last.name[oldnd.last.len])
			goto exit4;
		if (newnd.last.name[newnd.last.len])
			goto exit4;
	}
	/* source should not be ancestor of target */
	error = -EINVAL;
	if (old_dentry == trap)
		goto exit4;
2734
	new_dentry = lookup_hash(&newnd);
L
Linus Torvalds 已提交
2735 2736 2737 2738 2739 2740 2741 2742
	error = PTR_ERR(new_dentry);
	if (IS_ERR(new_dentry))
		goto exit4;
	/* target should not be an ancestor of source */
	error = -ENOTEMPTY;
	if (new_dentry == trap)
		goto exit5;

2743 2744 2745
	error = mnt_want_write(oldnd.path.mnt);
	if (error)
		goto exit5;
2746 2747 2748 2749
	error = security_path_rename(&oldnd.path, old_dentry,
				     &newnd.path, new_dentry);
	if (error)
		goto exit6;
L
Linus Torvalds 已提交
2750 2751
	error = vfs_rename(old_dir->d_inode, old_dentry,
				   new_dir->d_inode, new_dentry);
2752
exit6:
2753
	mnt_drop_write(oldnd.path.mnt);
L
Linus Torvalds 已提交
2754 2755 2756 2757 2758 2759 2760
exit5:
	dput(new_dentry);
exit4:
	dput(old_dentry);
exit3:
	unlock_rename(new_dir, old_dir);
exit2:
J
Jan Blunck 已提交
2761
	path_put(&newnd.path);
2762
	putname(to);
L
Linus Torvalds 已提交
2763
exit1:
J
Jan Blunck 已提交
2764
	path_put(&oldnd.path);
L
Linus Torvalds 已提交
2765
	putname(from);
2766
exit:
L
Linus Torvalds 已提交
2767 2768 2769
	return error;
}

2770
SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
2771 2772 2773 2774
{
	return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname);
}

L
Linus Torvalds 已提交
2775 2776 2777 2778 2779 2780 2781 2782 2783 2784 2785 2786 2787 2788 2789 2790 2791 2792 2793 2794 2795 2796 2797 2798 2799
int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
{
	int len;

	len = PTR_ERR(link);
	if (IS_ERR(link))
		goto out;

	len = strlen(link);
	if (len > (unsigned) buflen)
		len = buflen;
	if (copy_to_user(buffer, link, len))
		len = -EFAULT;
out:
	return len;
}

/*
 * A helper for ->readlink().  This should be used *ONLY* for symlinks that
 * have ->follow_link() touching nd only in nd_set_link().  Using (or not
 * using) it for any given inode is up to filesystem.
 */
int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
	struct nameidata nd;
2800
	void *cookie;
2801
	int res;
2802

L
Linus Torvalds 已提交
2803
	nd.depth = 0;
2804
	cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
2805 2806 2807 2808 2809 2810 2811
	if (IS_ERR(cookie))
		return PTR_ERR(cookie);

	res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
	if (dentry->d_inode->i_op->put_link)
		dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
	return res;
L
Linus Torvalds 已提交
2812 2813 2814 2815 2816 2817 2818 2819 2820 2821
}

int vfs_follow_link(struct nameidata *nd, const char *link)
{
	return __vfs_follow_link(nd, link);
}

/* get the link contents into pagecache */
static char *page_getlink(struct dentry * dentry, struct page **ppage)
{
2822 2823
	char *kaddr;
	struct page *page;
L
Linus Torvalds 已提交
2824
	struct address_space *mapping = dentry->d_inode->i_mapping;
2825
	page = read_mapping_page(mapping, 0, NULL);
L
Linus Torvalds 已提交
2826
	if (IS_ERR(page))
2827
		return (char*)page;
L
Linus Torvalds 已提交
2828
	*ppage = page;
2829 2830 2831
	kaddr = kmap(page);
	nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1);
	return kaddr;
L
Linus Torvalds 已提交
2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843 2844 2845
}

int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
	struct page *page = NULL;
	char *s = page_getlink(dentry, &page);
	int res = vfs_readlink(dentry,buffer,buflen,s);
	if (page) {
		kunmap(page);
		page_cache_release(page);
	}
	return res;
}

2846
void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
L
Linus Torvalds 已提交
2847
{
2848
	struct page *page = NULL;
L
Linus Torvalds 已提交
2849
	nd_set_link(nd, page_getlink(dentry, &page));
2850
	return page;
L
Linus Torvalds 已提交
2851 2852
}

2853
void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
L
Linus Torvalds 已提交
2854
{
2855 2856 2857
	struct page *page = cookie;

	if (page) {
L
Linus Torvalds 已提交
2858 2859 2860 2861 2862
		kunmap(page);
		page_cache_release(page);
	}
}

2863 2864 2865 2866
/*
 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
 */
int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
L
Linus Torvalds 已提交
2867 2868
{
	struct address_space *mapping = inode->i_mapping;
2869
	struct page *page;
2870
	void *fsdata;
2871
	int err;
L
Linus Torvalds 已提交
2872
	char *kaddr;
2873 2874 2875
	unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
	if (nofs)
		flags |= AOP_FLAG_NOFS;
L
Linus Torvalds 已提交
2876

2877
retry:
2878
	err = pagecache_write_begin(NULL, mapping, 0, len-1,
2879
				flags, &page, &fsdata);
L
Linus Torvalds 已提交
2880
	if (err)
2881 2882
		goto fail;

L
Linus Torvalds 已提交
2883 2884 2885
	kaddr = kmap_atomic(page, KM_USER0);
	memcpy(kaddr, symname, len-1);
	kunmap_atomic(kaddr, KM_USER0);
2886 2887 2888

	err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
							page, fsdata);
L
Linus Torvalds 已提交
2889 2890
	if (err < 0)
		goto fail;
2891 2892 2893
	if (err < len-1)
		goto retry;

L
Linus Torvalds 已提交
2894 2895 2896 2897 2898 2899
	mark_inode_dirty(inode);
	return 0;
fail:
	return err;
}

2900 2901 2902
int page_symlink(struct inode *inode, const char *symname, int len)
{
	return __page_symlink(inode, symname, len,
2903
			!(mapping_gfp_mask(inode->i_mapping) & __GFP_FS));
2904 2905
}

2906
const struct inode_operations page_symlink_inode_operations = {
L
Linus Torvalds 已提交
2907 2908 2909 2910 2911
	.readlink	= generic_readlink,
	.follow_link	= page_follow_link_light,
	.put_link	= page_put_link,
};

2912
EXPORT_SYMBOL(user_path_at);
L
Linus Torvalds 已提交
2913 2914 2915 2916 2917 2918 2919 2920 2921
EXPORT_SYMBOL(follow_down);
EXPORT_SYMBOL(follow_up);
EXPORT_SYMBOL(get_write_access); /* binfmt_aout */
EXPORT_SYMBOL(getname);
EXPORT_SYMBOL(lock_rename);
EXPORT_SYMBOL(lookup_one_len);
EXPORT_SYMBOL(page_follow_link_light);
EXPORT_SYMBOL(page_put_link);
EXPORT_SYMBOL(page_readlink);
2922
EXPORT_SYMBOL(__page_symlink);
L
Linus Torvalds 已提交
2923 2924 2925
EXPORT_SYMBOL(page_symlink);
EXPORT_SYMBOL(page_symlink_inode_operations);
EXPORT_SYMBOL(path_lookup);
A
Al Viro 已提交
2926
EXPORT_SYMBOL(kern_path);
2927
EXPORT_SYMBOL(vfs_path_lookup);
2928
EXPORT_SYMBOL(inode_permission);
2929
EXPORT_SYMBOL(file_permission);
L
Linus Torvalds 已提交
2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943
EXPORT_SYMBOL(unlock_rename);
EXPORT_SYMBOL(vfs_create);
EXPORT_SYMBOL(vfs_follow_link);
EXPORT_SYMBOL(vfs_link);
EXPORT_SYMBOL(vfs_mkdir);
EXPORT_SYMBOL(vfs_mknod);
EXPORT_SYMBOL(generic_permission);
EXPORT_SYMBOL(vfs_readlink);
EXPORT_SYMBOL(vfs_rename);
EXPORT_SYMBOL(vfs_rmdir);
EXPORT_SYMBOL(vfs_symlink);
EXPORT_SYMBOL(vfs_unlink);
EXPORT_SYMBOL(dentry_unhash);
EXPORT_SYMBOL(generic_readlink);