namei.c 84.1 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
/*
 *  linux/fs/namei.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

/*
 * Some corrections by tytso.
 */

/* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
 * lookup logic.
 */
/* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
 */

#include <linux/init.h>
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/fs.h>
#include <linux/namei.h>
#include <linux/pagemap.h>
R
Robert Love 已提交
23
#include <linux/fsnotify.h>
L
Linus Torvalds 已提交
24 25
#include <linux/personality.h>
#include <linux/security.h>
M
Mimi Zohar 已提交
26
#include <linux/ima.h>
L
Linus Torvalds 已提交
27 28 29
#include <linux/syscalls.h>
#include <linux/mount.h>
#include <linux/audit.h>
30
#include <linux/capability.h>
31
#include <linux/file.h>
32
#include <linux/fcntl.h>
33
#include <linux/device_cgroup.h>
34
#include <linux/fs_struct.h>
L
Linus Torvalds 已提交
35 36
#include <asm/uaccess.h>

37 38
#include "internal.h"

L
Linus Torvalds 已提交
39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72
/* [Feb-1997 T. Schoebel-Theuer]
 * Fundamental changes in the pathname lookup mechanisms (namei)
 * were necessary because of omirr.  The reason is that omirr needs
 * to know the _real_ pathname, not the user-supplied one, in case
 * of symlinks (and also when transname replacements occur).
 *
 * The new code replaces the old recursive symlink resolution with
 * an iterative one (in case of non-nested symlink chains).  It does
 * this with calls to <fs>_follow_link().
 * As a side effect, dir_namei(), _namei() and follow_link() are now 
 * replaced with a single function lookup_dentry() that can handle all 
 * the special cases of the former code.
 *
 * With the new dcache, the pathname is stored at each inode, at least as
 * long as the refcount of the inode is positive.  As a side effect, the
 * size of the dcache depends on the inode cache and thus is dynamic.
 *
 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
 * resolution to correspond with current state of the code.
 *
 * Note that the symlink resolution is not *completely* iterative.
 * There is still a significant amount of tail- and mid- recursion in
 * the algorithm.  Also, note that <fs>_readlink() is not used in
 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
 * may return different results than <fs>_follow_link().  Many virtual
 * filesystems (including /proc) exhibit this behavior.
 */

/* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
 * and the name already exists in form of a symlink, try to create the new
 * name indicated by the symlink. The old code always complained that the
 * name already exists, due to not following the symlink even if its target
 * is nonexistent.  The new semantics affects also mknod() and link() when
L
Lucas De Marchi 已提交
73
 * the name is a symlink pointing to a non-existent name.
L
Linus Torvalds 已提交
74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105
 *
 * I don't know which semantics is the right one, since I have no access
 * to standards. But I found by trial that HP-UX 9.0 has the full "new"
 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
 * "old" one. Personally, I think the new semantics is much more logical.
 * Note that "ln old new" where "new" is a symlink pointing to a non-existing
 * file does succeed in both HP-UX and SunOs, but not in Solaris
 * and in the old Linux semantics.
 */

/* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
 * semantics.  See the comments in "open_namei" and "do_link" below.
 *
 * [10-Sep-98 Alan Modra] Another symlink change.
 */

/* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
 *	inside the path - always follow.
 *	in the last component in creation/removal/renaming - never follow.
 *	if LOOKUP_FOLLOW passed - follow.
 *	if the pathname has trailing slashes - follow.
 *	otherwise - don't follow.
 * (applied in that order).
 *
 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
 * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
 * During the 2.4 we need to fix the userland stuff depending on it -
 * hopefully we will be able to get rid of that wart in 2.5. So far only
 * XEmacs seems to be relying on it...
 */
/*
 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
106
 * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
L
Linus Torvalds 已提交
107 108 109 110 111 112 113 114 115 116
 * any extra contention...
 */

/* In order to reduce some races, while at the same time doing additional
 * checking and hopefully speeding things up, we copy filenames to the
 * kernel data space before using them..
 *
 * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
 * PATH_MAX includes the nul terminator --RR.
 */
117
static int do_getname(const char __user *filename, char *page)
L
Linus Torvalds 已提交
118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138
{
	int retval;
	unsigned long len = PATH_MAX;

	if (!segment_eq(get_fs(), KERNEL_DS)) {
		if ((unsigned long) filename >= TASK_SIZE)
			return -EFAULT;
		if (TASK_SIZE - (unsigned long) filename < PATH_MAX)
			len = TASK_SIZE - (unsigned long) filename;
	}

	retval = strncpy_from_user(page, filename, len);
	if (retval > 0) {
		if (retval < len)
			return 0;
		return -ENAMETOOLONG;
	} else if (!retval)
		retval = -ENOENT;
	return retval;
}

A
Al Viro 已提交
139
static char *getname_flags(const char __user * filename, int flags)
L
Linus Torvalds 已提交
140 141 142 143 144 145 146 147 148 149
{
	char *tmp, *result;

	result = ERR_PTR(-ENOMEM);
	tmp = __getname();
	if (tmp)  {
		int retval = do_getname(filename, tmp);

		result = tmp;
		if (retval < 0) {
A
Al Viro 已提交
150 151 152 153
			if (retval != -ENOENT || !(flags & LOOKUP_EMPTY)) {
				__putname(tmp);
				result = ERR_PTR(retval);
			}
L
Linus Torvalds 已提交
154 155 156 157 158 159
		}
	}
	audit_getname(result);
	return result;
}

A
Al Viro 已提交
160 161 162 163 164
char *getname(const char __user * filename)
{
	return getname_flags(filename, 0);
}

L
Linus Torvalds 已提交
165 166 167
#ifdef CONFIG_AUDITSYSCALL
void putname(const char *name)
{
168
	if (unlikely(!audit_dummy_context()))
L
Linus Torvalds 已提交
169 170 171 172 173 174 175
		audit_putname(name);
	else
		__putname(name);
}
EXPORT_SYMBOL(putname);
#endif

176 177
/*
 * This does basic POSIX ACL permission checking
L
Linus Torvalds 已提交
178
 */
179 180
static int acl_permission_check(struct inode *inode, int mask, unsigned int flags,
		int (*check_acl)(struct inode *inode, int mask, unsigned int flags))
L
Linus Torvalds 已提交
181 182 183
{
	umode_t			mode = inode->i_mode;

184 185
	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;

186 187 188
	if (current_user_ns() != inode_userns(inode))
		goto other_perms;

189
	if (current_fsuid() == inode->i_uid)
L
Linus Torvalds 已提交
190 191 192
		mode >>= 6;
	else {
		if (IS_POSIXACL(inode) && (mode & S_IRWXG) && check_acl) {
193 194 195
			int error = check_acl(inode, mask, flags);
			if (error != -EAGAIN)
				return error;
L
Linus Torvalds 已提交
196 197 198 199 200 201
		}

		if (in_group_p(inode->i_gid))
			mode >>= 3;
	}

202
other_perms:
L
Linus Torvalds 已提交
203 204 205
	/*
	 * If the DACs are ok we don't need any capability check.
	 */
206
	if ((mask & ~mode) == 0)
L
Linus Torvalds 已提交
207
		return 0;
208 209 210 211
	return -EACCES;
}

/**
212
 * generic_permission -  check for access rights on a Posix-like filesystem
213 214 215
 * @inode:	inode to check access rights for
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 * @check_acl:	optional callback to check for Posix ACLs
216
 * @flags:	IPERM_FLAG_ flags.
217 218 219 220
 *
 * Used to check for read/write/execute permissions on a file.
 * We use "fsuid" for this, letting us set arbitrary permissions
 * for filesystem access without changing the "normal" uids which
221 222 223 224 225
 * are used for other things.
 *
 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
 * request cannot be satisfied (eg. requires blocking or too much complexity).
 * It would then be called again in ref-walk mode.
226
 */
227 228
int generic_permission(struct inode *inode, int mask, unsigned int flags,
	int (*check_acl)(struct inode *inode, int mask, unsigned int flags))
229 230 231 232 233 234
{
	int ret;

	/*
	 * Do the basic POSIX ACL permission checks.
	 */
235
	ret = acl_permission_check(inode, mask, flags, check_acl);
236 237
	if (ret != -EACCES)
		return ret;
L
Linus Torvalds 已提交
238 239 240 241 242

	/*
	 * Read/write DACs are always overridable.
	 * Executable DACs are overridable if at least one exec bit is set.
	 */
243
	if (!(mask & MAY_EXEC) || execute_ok(inode))
244
		if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
L
Linus Torvalds 已提交
245 246 247 248 249
			return 0;

	/*
	 * Searching includes executable on directories, else just read.
	 */
250
	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
L
Linus Torvalds 已提交
251
	if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
252
		if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
L
Linus Torvalds 已提交
253 254 255 256 257
			return 0;

	return -EACCES;
}

C
Christoph Hellwig 已提交
258 259 260 261 262 263 264 265 266 267
/**
 * inode_permission  -  check for access rights to a given inode
 * @inode:	inode to check permission on
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Used to check for read/write/execute permissions on an inode.
 * We use "fsuid" for this, letting us set arbitrary permissions
 * for filesystem access without changing the "normal" uids which
 * are used for other things.
 */
268
int inode_permission(struct inode *inode, int mask)
L
Linus Torvalds 已提交
269
{
270
	int retval;
L
Linus Torvalds 已提交
271 272

	if (mask & MAY_WRITE) {
273
		umode_t mode = inode->i_mode;
L
Linus Torvalds 已提交
274 275 276 277 278 279 280 281 282 283 284 285 286 287 288

		/*
		 * Nobody gets write access to a read-only fs.
		 */
		if (IS_RDONLY(inode) &&
		    (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
			return -EROFS;

		/*
		 * Nobody gets write access to an immutable file.
		 */
		if (IS_IMMUTABLE(inode))
			return -EACCES;
	}

A
Al Viro 已提交
289
	if (inode->i_op->permission)
290
		retval = inode->i_op->permission(inode, mask, 0);
291
	else
292 293
		retval = generic_permission(inode, mask, 0,
				inode->i_op->check_acl);
294

L
Linus Torvalds 已提交
295 296 297
	if (retval)
		return retval;

298 299 300 301
	retval = devcgroup_inode_permission(inode, mask);
	if (retval)
		return retval;

302
	return security_inode_permission(inode, mask);
L
Linus Torvalds 已提交
303 304
}

305 306 307 308 309 310 311 312 313 314
/**
 * file_permission  -  check for additional access rights to a given file
 * @file:	file to check access rights for
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Used to check for read/write/execute permissions on an already opened
 * file.
 *
 * Note:
 *	Do not use this function in new code.  All access checks should
C
Christoph Hellwig 已提交
315
 *	be done using inode_permission().
316 317 318
 */
int file_permission(struct file *file, int mask)
{
319
	return inode_permission(file->f_path.dentry->d_inode, mask);
320 321
}

L
Linus Torvalds 已提交
322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354
/*
 * get_write_access() gets write permission for a file.
 * put_write_access() releases this write permission.
 * This is used for regular files.
 * We cannot support write (and maybe mmap read-write shared) accesses and
 * MAP_DENYWRITE mmappings simultaneously. The i_writecount field of an inode
 * can have the following values:
 * 0: no writers, no VM_DENYWRITE mappings
 * < 0: (-i_writecount) vm_area_structs with VM_DENYWRITE set exist
 * > 0: (i_writecount) users are writing to the file.
 *
 * Normally we operate on that counter with atomic_{inc,dec} and it's safe
 * except for the cases where we don't hold i_writecount yet. Then we need to
 * use {get,deny}_write_access() - these functions check the sign and refuse
 * to do the change if sign is wrong. Exclusion between them is provided by
 * the inode->i_lock spinlock.
 */

int get_write_access(struct inode * inode)
{
	spin_lock(&inode->i_lock);
	if (atomic_read(&inode->i_writecount) < 0) {
		spin_unlock(&inode->i_lock);
		return -ETXTBSY;
	}
	atomic_inc(&inode->i_writecount);
	spin_unlock(&inode->i_lock);

	return 0;
}

int deny_write_access(struct file * file)
{
355
	struct inode *inode = file->f_path.dentry->d_inode;
L
Linus Torvalds 已提交
356 357 358 359 360 361 362 363 364 365 366 367

	spin_lock(&inode->i_lock);
	if (atomic_read(&inode->i_writecount) > 0) {
		spin_unlock(&inode->i_lock);
		return -ETXTBSY;
	}
	atomic_dec(&inode->i_writecount);
	spin_unlock(&inode->i_lock);

	return 0;
}

J
Jan Blunck 已提交
368 369 370 371 372 373 374 375 376 377 378 379 380
/**
 * path_get - get a reference to a path
 * @path: path to get the reference to
 *
 * Given a path increment the reference count to the dentry and the vfsmount.
 */
void path_get(struct path *path)
{
	mntget(path->mnt);
	dget(path->dentry);
}
EXPORT_SYMBOL(path_get);

J
Jan Blunck 已提交
381 382 383 384 385 386 387
/**
 * path_put - put a reference to a path
 * @path: path to put the reference to
 *
 * Given a path decrement the reference count to the dentry and the vfsmount.
 */
void path_put(struct path *path)
L
Linus Torvalds 已提交
388
{
J
Jan Blunck 已提交
389 390
	dput(path->dentry);
	mntput(path->mnt);
L
Linus Torvalds 已提交
391
}
J
Jan Blunck 已提交
392
EXPORT_SYMBOL(path_put);
L
Linus Torvalds 已提交
393

N
Nick Piggin 已提交
394 395 396
/**
 * nameidata_drop_rcu - drop this nameidata out of rcu-walk
 * @nd: nameidata pathwalk data to drop
397
 * Returns: 0 on success, -ECHILD on failure
N
Nick Piggin 已提交
398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414
 *
 * Path walking has 2 modes, rcu-walk and ref-walk (see
 * Documentation/filesystems/path-lookup.txt). __drop_rcu* functions attempt
 * to drop out of rcu-walk mode and take normal reference counts on dentries
 * and vfsmounts to transition to rcu-walk mode. __drop_rcu* functions take
 * refcounts at the last known good point before rcu-walk got stuck, so
 * ref-walk may continue from there. If this is not successful (eg. a seqcount
 * has changed), then failure is returned and path walk restarts from the
 * beginning in ref-walk mode.
 *
 * nameidata_drop_rcu attempts to drop the current nd->path and nd->root into
 * ref-walk. Must be called from rcu-walk context.
 */
static int nameidata_drop_rcu(struct nameidata *nd)
{
	struct fs_struct *fs = current->fs;
	struct dentry *dentry = nd->path.dentry;
415
	int want_root = 0;
N
Nick Piggin 已提交
416 417

	BUG_ON(!(nd->flags & LOOKUP_RCU));
418 419
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
		want_root = 1;
N
Nick Piggin 已提交
420 421 422 423 424 425 426 427 428 429
		spin_lock(&fs->lock);
		if (nd->root.mnt != fs->root.mnt ||
				nd->root.dentry != fs->root.dentry)
			goto err_root;
	}
	spin_lock(&dentry->d_lock);
	if (!__d_rcu_to_refcount(dentry, nd->seq))
		goto err;
	BUG_ON(nd->inode != dentry->d_inode);
	spin_unlock(&dentry->d_lock);
430
	if (want_root) {
N
Nick Piggin 已提交
431 432 433 434 435 436 437 438 439 440 441 442
		path_get(&nd->root);
		spin_unlock(&fs->lock);
	}
	mntget(nd->path.mnt);

	rcu_read_unlock();
	br_read_unlock(vfsmount_lock);
	nd->flags &= ~LOOKUP_RCU;
	return 0;
err:
	spin_unlock(&dentry->d_lock);
err_root:
443
	if (want_root)
N
Nick Piggin 已提交
444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459
		spin_unlock(&fs->lock);
	return -ECHILD;
}

/* Try to drop out of rcu-walk mode if we were in it, otherwise do nothing.  */
static inline int nameidata_drop_rcu_maybe(struct nameidata *nd)
{
	if (nd->flags & LOOKUP_RCU)
		return nameidata_drop_rcu(nd);
	return 0;
}

/**
 * nameidata_dentry_drop_rcu - drop nameidata and dentry out of rcu-walk
 * @nd: nameidata pathwalk data to drop
 * @dentry: dentry to drop
460
 * Returns: 0 on success, -ECHILD on failure
N
Nick Piggin 已提交
461 462 463 464 465 466 467 468 469
 *
 * nameidata_dentry_drop_rcu attempts to drop the current nd->path and nd->root,
 * and dentry into ref-walk. @dentry must be a path found by a do_lookup call on
 * @nd. Must be called from rcu-walk context.
 */
static int nameidata_dentry_drop_rcu(struct nameidata *nd, struct dentry *dentry)
{
	struct fs_struct *fs = current->fs;
	struct dentry *parent = nd->path.dentry;
470
	int want_root = 0;
N
Nick Piggin 已提交
471 472

	BUG_ON(!(nd->flags & LOOKUP_RCU));
473 474
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
		want_root = 1;
N
Nick Piggin 已提交
475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493
		spin_lock(&fs->lock);
		if (nd->root.mnt != fs->root.mnt ||
				nd->root.dentry != fs->root.dentry)
			goto err_root;
	}
	spin_lock(&parent->d_lock);
	spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
	if (!__d_rcu_to_refcount(dentry, nd->seq))
		goto err;
	/*
	 * If the sequence check on the child dentry passed, then the child has
	 * not been removed from its parent. This means the parent dentry must
	 * be valid and able to take a reference at this point.
	 */
	BUG_ON(!IS_ROOT(dentry) && dentry->d_parent != parent);
	BUG_ON(!parent->d_count);
	parent->d_count++;
	spin_unlock(&dentry->d_lock);
	spin_unlock(&parent->d_lock);
494
	if (want_root) {
N
Nick Piggin 已提交
495 496 497 498 499 500 501 502 503 504 505 506 507
		path_get(&nd->root);
		spin_unlock(&fs->lock);
	}
	mntget(nd->path.mnt);

	rcu_read_unlock();
	br_read_unlock(vfsmount_lock);
	nd->flags &= ~LOOKUP_RCU;
	return 0;
err:
	spin_unlock(&dentry->d_lock);
	spin_unlock(&parent->d_lock);
err_root:
508
	if (want_root)
N
Nick Piggin 已提交
509 510 511 512 513 514 515
		spin_unlock(&fs->lock);
	return -ECHILD;
}

/* Try to drop out of rcu-walk mode if we were in it, otherwise do nothing.  */
static inline int nameidata_dentry_drop_rcu_maybe(struct nameidata *nd, struct dentry *dentry)
{
516 517 518
	if (nd->flags & LOOKUP_RCU) {
		if (unlikely(nameidata_dentry_drop_rcu(nd, dentry))) {
			nd->flags &= ~LOOKUP_RCU;
519 520
			if (!(nd->flags & LOOKUP_ROOT))
				nd->root.mnt = NULL;
521 522 523 524 525
			rcu_read_unlock();
			br_read_unlock(vfsmount_lock);
			return -ECHILD;
		}
	}
N
Nick Piggin 已提交
526 527 528 529 530 531
	return 0;
}

/**
 * nameidata_drop_rcu_last - drop nameidata ending path walk out of rcu-walk
 * @nd: nameidata pathwalk data to drop
532
 * Returns: 0 on success, -ECHILD on failure
N
Nick Piggin 已提交
533 534 535 536 537 538 539 540 541 542 543
 *
 * nameidata_drop_rcu_last attempts to drop the current nd->path into ref-walk.
 * nd->path should be the final element of the lookup, so nd->root is discarded.
 * Must be called from rcu-walk context.
 */
static int nameidata_drop_rcu_last(struct nameidata *nd)
{
	struct dentry *dentry = nd->path.dentry;

	BUG_ON(!(nd->flags & LOOKUP_RCU));
	nd->flags &= ~LOOKUP_RCU;
544 545
	if (!(nd->flags & LOOKUP_ROOT))
		nd->root.mnt = NULL;
N
Nick Piggin 已提交
546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565
	spin_lock(&dentry->d_lock);
	if (!__d_rcu_to_refcount(dentry, nd->seq))
		goto err_unlock;
	BUG_ON(nd->inode != dentry->d_inode);
	spin_unlock(&dentry->d_lock);

	mntget(nd->path.mnt);

	rcu_read_unlock();
	br_read_unlock(vfsmount_lock);

	return 0;

err_unlock:
	spin_unlock(&dentry->d_lock);
	rcu_read_unlock();
	br_read_unlock(vfsmount_lock);
	return -ECHILD;
}

566 567 568 569 570 571
/**
 * release_open_intent - free up open intent resources
 * @nd: pointer to nameidata
 */
void release_open_intent(struct nameidata *nd)
{
572 573 574 575 576 577 578 579
	struct file *file = nd->intent.open.file;

	if (file && !IS_ERR(file)) {
		if (file->f_path.dentry == NULL)
			put_filp(file);
		else
			fput(file);
	}
580 581
}

A
Al Viro 已提交
582
static inline int d_revalidate(struct dentry *dentry, struct nameidata *nd)
583
{
A
Al Viro 已提交
584
	return dentry->d_op->d_revalidate(dentry, nd);
585 586
}

587
static struct dentry *
588 589
do_revalidate(struct dentry *dentry, struct nameidata *nd)
{
590
	int status = d_revalidate(dentry, nd);
591 592 593 594 595 596 597
	if (unlikely(status <= 0)) {
		/*
		 * The dentry failed validation.
		 * If d_revalidate returned 0 attempt to invalidate
		 * the dentry otherwise d_revalidate is asking us
		 * to return a fail status.
		 */
598
		if (status < 0) {
599
			dput(dentry);
600
			dentry = ERR_PTR(status);
601 602 603
		} else if (!d_invalidate(dentry)) {
			dput(dentry);
			dentry = NULL;
604 605 606 607 608
		}
	}
	return dentry;
}

609
/*
A
Al Viro 已提交
610
 * handle_reval_path - force revalidation of a dentry
611 612 613 614 615 616 617 618 619 620 621 622 623
 *
 * In some situations the path walking code will trust dentries without
 * revalidating them. This causes problems for filesystems that depend on
 * d_revalidate to handle file opens (e.g. NFSv4). When FS_REVAL_DOT is set
 * (which indicates that it's possible for the dentry to go stale), force
 * a d_revalidate call before proceeding.
 *
 * Returns 0 if the revalidation was successful. If the revalidation fails,
 * either return the error returned by d_revalidate or -ESTALE if the
 * revalidation it just returned 0. If d_revalidate returns 0, we attempt to
 * invalidate the dentry. It's up to the caller to handle putting references
 * to the path if necessary.
 */
A
Al Viro 已提交
624
static inline int handle_reval_path(struct nameidata *nd)
625
{
A
Al Viro 已提交
626
	struct dentry *dentry = nd->path.dentry;
627 628
	int status;

A
Al Viro 已提交
629 630 631 632
	if (likely(!(nd->flags & LOOKUP_JUMPED)))
		return 0;

	if (likely(!(dentry->d_flags & DCACHE_OP_REVALIDATE)))
633 634
		return 0;

A
Al Viro 已提交
635 636 637 638
	if (likely(!(dentry->d_sb->s_type->fs_flags & FS_REVAL_DOT)))
		return 0;

	/* Note: we do not d_invalidate() */
639
	status = d_revalidate(dentry, nd);
640 641 642
	if (status > 0)
		return 0;

A
Al Viro 已提交
643
	if (!status)
644
		status = -ESTALE;
A
Al Viro 已提交
645

646 647 648
	return status;
}

L
Linus Torvalds 已提交
649
/*
A
Al Viro 已提交
650 651 652
 * Short-cut version of permission(), for calling on directories
 * during pathname resolution.  Combines parts of permission()
 * and generic_permission(), and tests ONLY for MAY_EXEC permission.
L
Linus Torvalds 已提交
653 654
 *
 * If appropriate, check DAC only.  If not appropriate, or
A
Al Viro 已提交
655
 * short-cut DAC fails, then call ->permission() to do more
L
Linus Torvalds 已提交
656 657
 * complete permission check.
 */
658
static inline int exec_permission(struct inode *inode, unsigned int flags)
L
Linus Torvalds 已提交
659
{
660
	int ret;
661
	struct user_namespace *ns = inode_userns(inode);
L
Linus Torvalds 已提交
662

663
	if (inode->i_op->permission) {
664 665 666 667
		ret = inode->i_op->permission(inode, MAY_EXEC, flags);
	} else {
		ret = acl_permission_check(inode, MAY_EXEC, flags,
				inode->i_op->check_acl);
668
	}
669
	if (likely(!ret))
L
Linus Torvalds 已提交
670
		goto ok;
671
	if (ret == -ECHILD)
N
Nick Piggin 已提交
672
		return ret;
L
Linus Torvalds 已提交
673

674 675
	if (ns_capable(ns, CAP_DAC_OVERRIDE) ||
			ns_capable(ns, CAP_DAC_READ_SEARCH))
L
Linus Torvalds 已提交
676 677
		goto ok;

678
	return ret;
L
Linus Torvalds 已提交
679
ok:
680
	return security_inode_exec_permission(inode, flags);
L
Linus Torvalds 已提交
681 682
}

A
Al Viro 已提交
683 684
static __always_inline void set_root(struct nameidata *nd)
{
685 686
	if (!nd->root.mnt)
		get_fs_root(current->fs, &nd->root);
A
Al Viro 已提交
687 688
}

689 690
static int link_path_walk(const char *, struct nameidata *);

N
Nick Piggin 已提交
691 692 693 694
static __always_inline void set_root_rcu(struct nameidata *nd)
{
	if (!nd->root.mnt) {
		struct fs_struct *fs = current->fs;
N
Nick Piggin 已提交
695 696 697 698 699 700
		unsigned seq;

		do {
			seq = read_seqcount_begin(&fs->seq);
			nd->root = fs->root;
		} while (read_seqcount_retry(&fs->seq, seq));
N
Nick Piggin 已提交
701 702 703
	}
}

704
static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
L
Linus Torvalds 已提交
705
{
N
Nick Piggin 已提交
706 707
	int ret;

L
Linus Torvalds 已提交
708 709 710 711
	if (IS_ERR(link))
		goto fail;

	if (*link == '/') {
A
Al Viro 已提交
712
		set_root(nd);
J
Jan Blunck 已提交
713
		path_put(&nd->path);
A
Al Viro 已提交
714 715
		nd->path = nd->root;
		path_get(&nd->root);
A
Al Viro 已提交
716
		nd->flags |= LOOKUP_JUMPED;
L
Linus Torvalds 已提交
717
	}
N
Nick Piggin 已提交
718
	nd->inode = nd->path.dentry->d_inode;
C
Christoph Hellwig 已提交
719

N
Nick Piggin 已提交
720 721
	ret = link_path_walk(link, nd);
	return ret;
L
Linus Torvalds 已提交
722
fail:
J
Jan Blunck 已提交
723
	path_put(&nd->path);
L
Linus Torvalds 已提交
724 725 726
	return PTR_ERR(link);
}

J
Jan Blunck 已提交
727
static void path_put_conditional(struct path *path, struct nameidata *nd)
728 729
{
	dput(path->dentry);
730
	if (path->mnt != nd->path.mnt)
731 732 733
		mntput(path->mnt);
}

734 735
static inline void path_to_nameidata(const struct path *path,
					struct nameidata *nd)
736
{
N
Nick Piggin 已提交
737 738 739 740
	if (!(nd->flags & LOOKUP_RCU)) {
		dput(nd->path.dentry);
		if (nd->path.mnt != path->mnt)
			mntput(nd->path.mnt);
741
	}
N
Nick Piggin 已提交
742
	nd->path.mnt = path->mnt;
743
	nd->path.dentry = path->dentry;
744 745
}

746 747 748 749 750 751 752 753
static inline void put_link(struct nameidata *nd, struct path *link, void *cookie)
{
	struct inode *inode = link->dentry->d_inode;
	if (!IS_ERR(cookie) && inode->i_op->put_link)
		inode->i_op->put_link(link->dentry, nd, cookie);
	path_put(link);
}

A
Al Viro 已提交
754
static __always_inline int
755
follow_link(struct path *link, struct nameidata *nd, void **p)
L
Linus Torvalds 已提交
756 757
{
	int error;
758
	struct dentry *dentry = link->dentry;
L
Linus Torvalds 已提交
759

760 761
	BUG_ON(nd->flags & LOOKUP_RCU);

A
Al Viro 已提交
762 763 764
	if (link->mnt == nd->path.mnt)
		mntget(link->mnt);

765 766 767 768 769 770 771 772
	if (unlikely(current->total_link_count >= 40)) {
		*p = ERR_PTR(-ELOOP); /* no ->put_link(), please */
		path_put(&nd->path);
		return -ELOOP;
	}
	cond_resched();
	current->total_link_count++;

773
	touch_atime(link->mnt, dentry);
L
Linus Torvalds 已提交
774
	nd_set_link(nd, NULL);
A
Al Viro 已提交
775

776 777 778 779 780 781 782
	error = security_inode_follow_link(link->dentry, nd);
	if (error) {
		*p = ERR_PTR(error); /* no ->put_link(), please */
		path_put(&nd->path);
		return error;
	}

783
	nd->last_type = LAST_BIND;
A
Al Viro 已提交
784 785 786
	*p = dentry->d_inode->i_op->follow_link(dentry, nd);
	error = PTR_ERR(*p);
	if (!IS_ERR(*p)) {
L
Linus Torvalds 已提交
787
		char *s = nd_get_link(nd);
788
		error = 0;
L
Linus Torvalds 已提交
789 790
		if (s)
			error = __vfs_follow_link(nd, s);
A
Al Viro 已提交
791
		else if (nd->last_type == LAST_BIND) {
A
Al Viro 已提交
792
			nd->flags |= LOOKUP_JUMPED;
793 794
			nd->inode = nd->path.dentry->d_inode;
			if (nd->inode->i_op->follow_link) {
A
Al Viro 已提交
795 796 797 798 799
				/* stepped on a _really_ weird one */
				path_put(&nd->path);
				error = -ELOOP;
			}
		}
L
Linus Torvalds 已提交
800 801 802 803
	}
	return error;
}

N
Nick Piggin 已提交
804 805 806 807 808 809 810 811 812 813 814 815 816 817
static int follow_up_rcu(struct path *path)
{
	struct vfsmount *parent;
	struct dentry *mountpoint;

	parent = path->mnt->mnt_parent;
	if (parent == path->mnt)
		return 0;
	mountpoint = path->mnt->mnt_mountpoint;
	path->dentry = mountpoint;
	path->mnt = parent;
	return 1;
}

A
Al Viro 已提交
818
int follow_up(struct path *path)
L
Linus Torvalds 已提交
819 820 821
{
	struct vfsmount *parent;
	struct dentry *mountpoint;
N
Nick Piggin 已提交
822 823

	br_read_lock(vfsmount_lock);
A
Al Viro 已提交
824 825
	parent = path->mnt->mnt_parent;
	if (parent == path->mnt) {
N
Nick Piggin 已提交
826
		br_read_unlock(vfsmount_lock);
L
Linus Torvalds 已提交
827 828 829
		return 0;
	}
	mntget(parent);
A
Al Viro 已提交
830
	mountpoint = dget(path->mnt->mnt_mountpoint);
N
Nick Piggin 已提交
831
	br_read_unlock(vfsmount_lock);
A
Al Viro 已提交
832 833 834 835
	dput(path->dentry);
	path->dentry = mountpoint;
	mntput(path->mnt);
	path->mnt = parent;
L
Linus Torvalds 已提交
836 837 838
	return 1;
}

N
Nick Piggin 已提交
839
/*
840 841 842
 * Perform an automount
 * - return -EISDIR to tell follow_managed() to stop and return the path we
 *   were called with.
L
Linus Torvalds 已提交
843
 */
844 845
static int follow_automount(struct path *path, unsigned flags,
			    bool *need_mntput)
N
Nick Piggin 已提交
846
{
847
	struct vfsmount *mnt;
848
	int err;
849 850 851 852

	if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
		return -EREMOTE;

853 854 855 856 857 858
	/* We don't want to mount if someone supplied AT_NO_AUTOMOUNT
	 * and this is the terminal part of the path.
	 */
	if ((flags & LOOKUP_NO_AUTOMOUNT) && !(flags & LOOKUP_CONTINUE))
		return -EISDIR; /* we actually want to stop here */

859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889
	/* We want to mount if someone is trying to open/create a file of any
	 * type under the mountpoint, wants to traverse through the mountpoint
	 * or wants to open the mounted directory.
	 *
	 * We don't want to mount if someone's just doing a stat and they've
	 * set AT_SYMLINK_NOFOLLOW - unless they're stat'ing a directory and
	 * appended a '/' to the name.
	 */
	if (!(flags & LOOKUP_FOLLOW) &&
	    !(flags & (LOOKUP_CONTINUE | LOOKUP_DIRECTORY |
		       LOOKUP_OPEN | LOOKUP_CREATE)))
		return -EISDIR;

	current->total_link_count++;
	if (current->total_link_count >= 40)
		return -ELOOP;

	mnt = path->dentry->d_op->d_automount(path);
	if (IS_ERR(mnt)) {
		/*
		 * The filesystem is allowed to return -EISDIR here to indicate
		 * it doesn't want to automount.  For instance, autofs would do
		 * this so that its userspace daemon can mount on this dentry.
		 *
		 * However, we can only permit this if it's a terminal point in
		 * the path being looked up; if it wasn't then the remainder of
		 * the path is inaccessible and we should say so.
		 */
		if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_CONTINUE))
			return -EREMOTE;
		return PTR_ERR(mnt);
N
Nick Piggin 已提交
890
	}
891

892 893
	if (!mnt) /* mount collision */
		return 0;
N
Nick Piggin 已提交
894

895
	err = finish_automount(mnt, path);
896

897 898 899
	switch (err) {
	case -EBUSY:
		/* Someone else made a mount here whilst we were busy */
900
		return 0;
901 902 903 904 905 906 907 908
	case 0:
		dput(path->dentry);
		if (*need_mntput)
			mntput(path->mnt);
		path->mnt = mnt;
		path->dentry = dget(mnt->mnt_root);
		*need_mntput = true;
		return 0;
909 910
	default:
		return err;
911
	}
912

A
Al Viro 已提交
913 914
}

915 916
/*
 * Handle a dentry that is managed in some way.
917
 * - Flagged for transit management (autofs)
918 919 920 921 922 923 924 925
 * - Flagged as mountpoint
 * - Flagged as automount point
 *
 * This may only be called in refwalk mode.
 *
 * Serialization is taken care of in namespace.c
 */
static int follow_managed(struct path *path, unsigned flags)
L
Linus Torvalds 已提交
926
{
927 928 929 930 931 932 933 934 935 936
	unsigned managed;
	bool need_mntput = false;
	int ret;

	/* Given that we're not holding a lock here, we retain the value in a
	 * local variable for each dentry as we look at it so that we don't see
	 * the components of that value change under us */
	while (managed = ACCESS_ONCE(path->dentry->d_flags),
	       managed &= DCACHE_MANAGED_DENTRY,
	       unlikely(managed != 0)) {
937 938 939 940 941
		/* Allow the filesystem to manage the transit without i_mutex
		 * being held. */
		if (managed & DCACHE_MANAGE_TRANSIT) {
			BUG_ON(!path->dentry->d_op);
			BUG_ON(!path->dentry->d_op->d_manage);
942
			ret = path->dentry->d_op->d_manage(path->dentry, false);
943 944 945 946
			if (ret < 0)
				return ret == -EISDIR ? 0 : ret;
		}

947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975
		/* Transit to a mounted filesystem. */
		if (managed & DCACHE_MOUNTED) {
			struct vfsmount *mounted = lookup_mnt(path);
			if (mounted) {
				dput(path->dentry);
				if (need_mntput)
					mntput(path->mnt);
				path->mnt = mounted;
				path->dentry = dget(mounted->mnt_root);
				need_mntput = true;
				continue;
			}

			/* Something is mounted on this dentry in another
			 * namespace and/or whatever was mounted there in this
			 * namespace got unmounted before we managed to get the
			 * vfsmount_lock */
		}

		/* Handle an automount point */
		if (managed & DCACHE_NEED_AUTOMOUNT) {
			ret = follow_automount(path, flags, &need_mntput);
			if (ret < 0)
				return ret == -EISDIR ? 0 : ret;
			continue;
		}

		/* We didn't change the current path point */
		break;
L
Linus Torvalds 已提交
976
	}
977
	return 0;
L
Linus Torvalds 已提交
978 979
}

980
int follow_down_one(struct path *path)
L
Linus Torvalds 已提交
981 982 983
{
	struct vfsmount *mounted;

A
Al Viro 已提交
984
	mounted = lookup_mnt(path);
L
Linus Torvalds 已提交
985
	if (mounted) {
A
Al Viro 已提交
986 987 988 989
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
L
Linus Torvalds 已提交
990 991 992 993 994
		return 1;
	}
	return 0;
}

995 996 997 998 999 1000
static inline bool managed_dentry_might_block(struct dentry *dentry)
{
	return (dentry->d_flags & DCACHE_MANAGE_TRANSIT &&
		dentry->d_op->d_manage(dentry, true) < 0);
}

1001 1002
/*
 * Skip to top of mountpoint pile in rcuwalk mode.  We abort the rcu-walk if we
1003
 * meet a managed dentry and we're not walking to "..".  True is returned to
1004 1005 1006 1007 1008
 * continue, false to abort.
 */
static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
			       struct inode **inode, bool reverse_transit)
{
1009
	for (;;) {
1010
		struct vfsmount *mounted;
1011 1012 1013 1014 1015 1016 1017
		/*
		 * Don't forget we might have a non-mountpoint managed dentry
		 * that wants to block transit.
		 */
		*inode = path->dentry->d_inode;
		if (!reverse_transit &&
		     unlikely(managed_dentry_might_block(path->dentry)))
1018
			return false;
1019 1020 1021 1022

		if (!d_mountpoint(path->dentry))
			break;

1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035
		mounted = __lookup_mnt(path->mnt, path->dentry, 1);
		if (!mounted)
			break;
		path->mnt = mounted;
		path->dentry = mounted->mnt_root;
		nd->seq = read_seqcount_begin(&path->dentry->d_seq);
	}

	if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT))
		return reverse_transit;
	return true;
}

N
Nick Piggin 已提交
1036 1037 1038 1039 1040 1041
static int follow_dotdot_rcu(struct nameidata *nd)
{
	struct inode *inode = nd->inode;

	set_root_rcu(nd);

1042
	while (1) {
N
Nick Piggin 已提交
1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053
		if (nd->path.dentry == nd->root.dentry &&
		    nd->path.mnt == nd->root.mnt) {
			break;
		}
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
			struct dentry *old = nd->path.dentry;
			struct dentry *parent = old->d_parent;
			unsigned seq;

			seq = read_seqcount_begin(&parent->d_seq);
			if (read_seqcount_retry(&old->d_seq, nd->seq))
1054
				goto failed;
N
Nick Piggin 已提交
1055 1056 1057 1058 1059 1060 1061 1062 1063 1064
			inode = parent->d_inode;
			nd->path.dentry = parent;
			nd->seq = seq;
			break;
		}
		if (!follow_up_rcu(&nd->path))
			break;
		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
		inode = nd->path.dentry->d_inode;
	}
1065
	__follow_mount_rcu(nd, &nd->path, &inode, true);
N
Nick Piggin 已提交
1066 1067
	nd->inode = inode;
	return 0;
1068 1069 1070

failed:
	nd->flags &= ~LOOKUP_RCU;
1071 1072
	if (!(nd->flags & LOOKUP_ROOT))
		nd->root.mnt = NULL;
1073 1074 1075
	rcu_read_unlock();
	br_read_unlock(vfsmount_lock);
	return -ECHILD;
N
Nick Piggin 已提交
1076 1077
}

1078 1079 1080 1081 1082 1083 1084 1085
/*
 * Follow down to the covering mount currently visible to userspace.  At each
 * point, the filesystem owning that dentry may be queried as to whether the
 * caller is permitted to proceed or not.
 *
 * Care must be taken as namespace_sem may be held (indicated by mounting_here
 * being true).
 */
1086
int follow_down(struct path *path)
1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105
{
	unsigned managed;
	int ret;

	while (managed = ACCESS_ONCE(path->dentry->d_flags),
	       unlikely(managed & DCACHE_MANAGED_DENTRY)) {
		/* Allow the filesystem to manage the transit without i_mutex
		 * being held.
		 *
		 * We indicate to the filesystem if someone is trying to mount
		 * something here.  This gives autofs the chance to deny anyone
		 * other than its daemon the right to mount on its
		 * superstructure.
		 *
		 * The filesystem may sleep at this point.
		 */
		if (managed & DCACHE_MANAGE_TRANSIT) {
			BUG_ON(!path->dentry->d_op);
			BUG_ON(!path->dentry->d_op->d_manage);
1106
			ret = path->dentry->d_op->d_manage(
1107
				path->dentry, false);
1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129
			if (ret < 0)
				return ret == -EISDIR ? 0 : ret;
		}

		/* Transit to a mounted filesystem. */
		if (managed & DCACHE_MOUNTED) {
			struct vfsmount *mounted = lookup_mnt(path);
			if (!mounted)
				break;
			dput(path->dentry);
			mntput(path->mnt);
			path->mnt = mounted;
			path->dentry = dget(mounted->mnt_root);
			continue;
		}

		/* Don't handle automount points here */
		break;
	}
	return 0;
}

1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145
/*
 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot()
 */
static void follow_mount(struct path *path)
{
	while (d_mountpoint(path->dentry)) {
		struct vfsmount *mounted = lookup_mnt(path);
		if (!mounted)
			break;
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
	}
}

N
Nick Piggin 已提交
1146
static void follow_dotdot(struct nameidata *nd)
L
Linus Torvalds 已提交
1147
{
A
Al Viro 已提交
1148
	set_root(nd);
1149

L
Linus Torvalds 已提交
1150
	while(1) {
1151
		struct dentry *old = nd->path.dentry;
L
Linus Torvalds 已提交
1152

A
Al Viro 已提交
1153 1154
		if (nd->path.dentry == nd->root.dentry &&
		    nd->path.mnt == nd->root.mnt) {
L
Linus Torvalds 已提交
1155 1156
			break;
		}
1157
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
A
Al Viro 已提交
1158 1159
			/* rare case of legitimate dget_parent()... */
			nd->path.dentry = dget_parent(nd->path.dentry);
L
Linus Torvalds 已提交
1160 1161 1162
			dput(old);
			break;
		}
A
Al Viro 已提交
1163
		if (!follow_up(&nd->path))
L
Linus Torvalds 已提交
1164 1165
			break;
	}
A
Al Viro 已提交
1166
	follow_mount(&nd->path);
N
Nick Piggin 已提交
1167
	nd->inode = nd->path.dentry->d_inode;
L
Linus Torvalds 已提交
1168 1169
}

1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198
/*
 * Allocate a dentry with name and parent, and perform a parent
 * directory ->lookup on it. Returns the new dentry, or ERR_PTR
 * on error. parent->d_inode->i_mutex must be held. d_lookup must
 * have verified that no child exists while under i_mutex.
 */
static struct dentry *d_alloc_and_lookup(struct dentry *parent,
				struct qstr *name, struct nameidata *nd)
{
	struct inode *inode = parent->d_inode;
	struct dentry *dentry;
	struct dentry *old;

	/* Don't create child dentry for a dead directory. */
	if (unlikely(IS_DEADDIR(inode)))
		return ERR_PTR(-ENOENT);

	dentry = d_alloc(parent, name);
	if (unlikely(!dentry))
		return ERR_PTR(-ENOMEM);

	old = inode->i_op->lookup(inode, dentry, nd);
	if (unlikely(old)) {
		dput(dentry);
		dentry = old;
	}
	return dentry;
}

L
Linus Torvalds 已提交
1199 1200 1201 1202 1203 1204
/*
 *  It's more convoluted than I'd like it to be, but... it's still fairly
 *  small and for now I'd prefer to have fast path as straight as possible.
 *  It _is_ time-critical.
 */
static int do_lookup(struct nameidata *nd, struct qstr *name,
N
Nick Piggin 已提交
1205
			struct path *path, struct inode **inode)
L
Linus Torvalds 已提交
1206
{
1207
	struct vfsmount *mnt = nd->path.mnt;
N
Nick Piggin 已提交
1208
	struct dentry *dentry, *parent = nd->path.dentry;
A
Al Viro 已提交
1209 1210
	int need_reval = 1;
	int status = 1;
1211 1212
	int err;

1213 1214 1215 1216 1217
	/*
	 * Rename seqlock is not required here because in the off chance
	 * of a false negative due to a concurrent rename, we're going to
	 * do the non-racy lookup, below.
	 */
N
Nick Piggin 已提交
1218 1219 1220 1221
	if (nd->flags & LOOKUP_RCU) {
		unsigned seq;
		*inode = nd->inode;
		dentry = __d_lookup_rcu(parent, name, &seq, inode);
A
Al Viro 已提交
1222 1223 1224
		if (!dentry)
			goto unlazy;

N
Nick Piggin 已提交
1225 1226 1227 1228
		/* Memory barrier in read_seqcount_begin of child is enough */
		if (__read_seqcount_retry(&parent->d_seq, nd->seq))
			return -ECHILD;
		nd->seq = seq;
A
Al Viro 已提交
1229

1230
		if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) {
A
Al Viro 已提交
1231 1232 1233 1234 1235 1236
			status = d_revalidate(dentry, nd);
			if (unlikely(status <= 0)) {
				if (status != -ECHILD)
					need_reval = 0;
				goto unlazy;
			}
1237
		}
N
Nick Piggin 已提交
1238 1239
		path->mnt = mnt;
		path->dentry = dentry;
1240 1241
		if (likely(__follow_mount_rcu(nd, path, inode, false)))
			return 0;
A
Al Viro 已提交
1242 1243 1244 1245 1246 1247 1248 1249 1250 1251
unlazy:
		if (dentry) {
			if (nameidata_dentry_drop_rcu(nd, dentry))
				return -ECHILD;
		} else {
			if (nameidata_drop_rcu(nd))
				return -ECHILD;
		}
	} else {
		dentry = __d_lookup(parent, name);
1252
	}
A
Al Viro 已提交
1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285

retry:
	if (unlikely(!dentry)) {
		struct inode *dir = parent->d_inode;
		BUG_ON(nd->inode != dir);

		mutex_lock(&dir->i_mutex);
		dentry = d_lookup(parent, name);
		if (likely(!dentry)) {
			dentry = d_alloc_and_lookup(parent, name, nd);
			if (IS_ERR(dentry)) {
				mutex_unlock(&dir->i_mutex);
				return PTR_ERR(dentry);
			}
			/* known good */
			need_reval = 0;
			status = 1;
		}
		mutex_unlock(&dir->i_mutex);
	}
	if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval)
		status = d_revalidate(dentry, nd);
	if (unlikely(status <= 0)) {
		if (status < 0) {
			dput(dentry);
			return status;
		}
		if (!d_invalidate(dentry)) {
			dput(dentry);
			dentry = NULL;
			need_reval = 1;
			goto retry;
		}
1286
	}
A
Al Viro 已提交
1287

1288 1289 1290
	path->mnt = mnt;
	path->dentry = dentry;
	err = follow_managed(path, nd->flags);
1291 1292
	if (unlikely(err < 0)) {
		path_put_conditional(path, nd);
1293
		return err;
1294
	}
1295
	*inode = path->dentry->d_inode;
L
Linus Torvalds 已提交
1296 1297 1298
	return 0;
}

1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310
static inline int may_lookup(struct nameidata *nd)
{
	if (nd->flags & LOOKUP_RCU) {
		int err = exec_permission(nd->inode, IPERM_FLAG_RCU);
		if (err != -ECHILD)
			return err;
		if (nameidata_drop_rcu(nd))
			return -ECHILD;
	}
	return exec_permission(nd->inode, 0);
}

1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322
static inline int handle_dots(struct nameidata *nd, int type)
{
	if (type == LAST_DOTDOT) {
		if (nd->flags & LOOKUP_RCU) {
			if (follow_dotdot_rcu(nd))
				return -ECHILD;
		} else
			follow_dotdot(nd);
	}
	return 0;
}

1323 1324 1325 1326 1327 1328
static void terminate_walk(struct nameidata *nd)
{
	if (!(nd->flags & LOOKUP_RCU)) {
		path_put(&nd->path);
	} else {
		nd->flags &= ~LOOKUP_RCU;
1329 1330
		if (!(nd->flags & LOOKUP_ROOT))
			nd->root.mnt = NULL;
1331 1332 1333 1334 1335
		rcu_read_unlock();
		br_read_unlock(vfsmount_lock);
	}
}

1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368
static inline int walk_component(struct nameidata *nd, struct path *path,
		struct qstr *name, int type, int follow)
{
	struct inode *inode;
	int err;
	/*
	 * "." and ".." are special - ".." especially so because it has
	 * to be able to know about the current root directory and
	 * parent relationships.
	 */
	if (unlikely(type != LAST_NORM))
		return handle_dots(nd, type);
	err = do_lookup(nd, name, path, &inode);
	if (unlikely(err)) {
		terminate_walk(nd);
		return err;
	}
	if (!inode) {
		path_to_nameidata(path, nd);
		terminate_walk(nd);
		return -ENOENT;
	}
	if (unlikely(inode->i_op->follow_link) && follow) {
		if (nameidata_dentry_drop_rcu_maybe(nd, path->dentry))
			return -ECHILD;
		BUG_ON(inode != path->dentry->d_inode);
		return 1;
	}
	path_to_nameidata(path, nd);
	nd->inode = inode;
	return 0;
}

1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392
/*
 * This limits recursive symlink follows to 8, while
 * limiting consecutive symlinks to 40.
 *
 * Without that kind of total limit, nasty chains of consecutive
 * symlinks can cause almost arbitrarily long lookups.
 */
static inline int nested_symlink(struct path *path, struct nameidata *nd)
{
	int res;

	BUG_ON(nd->depth >= MAX_NESTED_LINKS);
	if (unlikely(current->link_count >= MAX_NESTED_LINKS)) {
		path_put_conditional(path, nd);
		path_put(&nd->path);
		return -ELOOP;
	}

	nd->depth++;
	current->link_count++;

	do {
		struct path link = *path;
		void *cookie;
1393 1394

		res = follow_link(&link, nd, &cookie);
1395 1396 1397
		if (!res)
			res = walk_component(nd, path, &nd->last,
					     nd->last_type, LOOKUP_FOLLOW);
1398
		put_link(nd, &link, cookie);
1399 1400 1401 1402 1403 1404 1405
	} while (res > 0);

	current->link_count--;
	nd->depth--;
	return res;
}

L
Linus Torvalds 已提交
1406 1407
/*
 * Name resolution.
1408 1409
 * This is the basic name resolution function, turning a pathname into
 * the final dentry. We expect 'base' to be positive and a directory.
L
Linus Torvalds 已提交
1410
 *
1411 1412
 * Returns 0 and nd will have valid dentry and mnt on success.
 * Returns error and drops reference to input namei data on failure.
L
Linus Torvalds 已提交
1413
 */
1414
static int link_path_walk(const char *name, struct nameidata *nd)
L
Linus Torvalds 已提交
1415 1416 1417 1418 1419 1420 1421 1422
{
	struct path next;
	int err;
	unsigned int lookup_flags = nd->flags;
	
	while (*name=='/')
		name++;
	if (!*name)
1423
		return 0;
L
Linus Torvalds 已提交
1424 1425 1426 1427 1428 1429

	/* At this point we know we have a real path component. */
	for(;;) {
		unsigned long hash;
		struct qstr this;
		unsigned int c;
A
Al Viro 已提交
1430
		int type;
L
Linus Torvalds 已提交
1431

1432
		nd->flags |= LOOKUP_CONTINUE;
1433 1434

		err = may_lookup(nd);
L
Linus Torvalds 已提交
1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449
 		if (err)
			break;

		this.name = name;
		c = *(const unsigned char *)name;

		hash = init_name_hash();
		do {
			name++;
			hash = partial_name_hash(c, hash);
			c = *(const unsigned char *)name;
		} while (c && (c != '/'));
		this.len = name - (const char *) this.name;
		this.hash = end_name_hash(hash);

A
Al Viro 已提交
1450 1451 1452
		type = LAST_NORM;
		if (this.name[0] == '.') switch (this.len) {
			case 2:
A
Al Viro 已提交
1453
				if (this.name[1] == '.') {
A
Al Viro 已提交
1454
					type = LAST_DOTDOT;
A
Al Viro 已提交
1455 1456
					nd->flags |= LOOKUP_JUMPED;
				}
A
Al Viro 已提交
1457 1458 1459 1460
				break;
			case 1:
				type = LAST_DOT;
		}
1461 1462
		if (likely(type == LAST_NORM)) {
			struct dentry *parent = nd->path.dentry;
A
Al Viro 已提交
1463
			nd->flags &= ~LOOKUP_JUMPED;
1464 1465 1466 1467 1468 1469 1470
			if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
				err = parent->d_op->d_hash(parent, nd->inode,
							   &this);
				if (err < 0)
					break;
			}
		}
A
Al Viro 已提交
1471

L
Linus Torvalds 已提交
1472 1473 1474 1475 1476
		/* remove trailing slashes? */
		if (!c)
			goto last_component;
		while (*++name == '/');
		if (!*name)
1477
			goto last_component;
L
Linus Torvalds 已提交
1478

1479 1480 1481
		err = walk_component(nd, &next, &this, type, LOOKUP_FOLLOW);
		if (err < 0)
			return err;
L
Linus Torvalds 已提交
1482

1483
		if (err) {
1484
			err = nested_symlink(&next, nd);
L
Linus Torvalds 已提交
1485
			if (err)
1486
				return err;
N
Nick Piggin 已提交
1487
		}
L
Linus Torvalds 已提交
1488
		err = -ENOTDIR; 
N
Nick Piggin 已提交
1489
		if (!nd->inode->i_op->lookup)
L
Linus Torvalds 已提交
1490 1491 1492 1493 1494
			break;
		continue;
		/* here ends the main loop */

last_component:
1495 1496
		/* Clear LOOKUP_CONTINUE iff it was previously unset */
		nd->flags &= lookup_flags | ~LOOKUP_CONTINUE;
1497 1498
		nd->last = this;
		nd->last_type = type;
1499
		return 0;
L
Linus Torvalds 已提交
1500
	}
1501
	terminate_walk(nd);
L
Linus Torvalds 已提交
1502 1503 1504
	return err;
}

A
Al Viro 已提交
1505 1506
static int path_init(int dfd, const char *name, unsigned int flags,
		     struct nameidata *nd, struct file **fp)
N
Nick Piggin 已提交
1507 1508 1509 1510 1511 1512
{
	int retval = 0;
	int fput_needed;
	struct file *file;

	nd->last_type = LAST_ROOT; /* if there are only slashes... */
A
Al Viro 已提交
1513
	nd->flags = flags | LOOKUP_JUMPED;
N
Nick Piggin 已提交
1514
	nd->depth = 0;
1515 1516
	if (flags & LOOKUP_ROOT) {
		struct inode *inode = nd->root.dentry->d_inode;
A
Al Viro 已提交
1517 1518 1519 1520 1521 1522 1523
		if (*name) {
			if (!inode->i_op->lookup)
				return -ENOTDIR;
			retval = inode_permission(inode, MAY_EXEC);
			if (retval)
				return retval;
		}
1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535
		nd->path = nd->root;
		nd->inode = inode;
		if (flags & LOOKUP_RCU) {
			br_read_lock(vfsmount_lock);
			rcu_read_lock();
			nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
		} else {
			path_get(&nd->path);
		}
		return 0;
	}

N
Nick Piggin 已提交
1536 1537 1538
	nd->root.mnt = NULL;

	if (*name=='/') {
A
Al Viro 已提交
1539 1540 1541 1542 1543 1544 1545 1546 1547
		if (flags & LOOKUP_RCU) {
			br_read_lock(vfsmount_lock);
			rcu_read_lock();
			set_root_rcu(nd);
		} else {
			set_root(nd);
			path_get(&nd->root);
		}
		nd->path = nd->root;
N
Nick Piggin 已提交
1548
	} else if (dfd == AT_FDCWD) {
A
Al Viro 已提交
1549 1550 1551
		if (flags & LOOKUP_RCU) {
			struct fs_struct *fs = current->fs;
			unsigned seq;
N
Nick Piggin 已提交
1552

A
Al Viro 已提交
1553 1554
			br_read_lock(vfsmount_lock);
			rcu_read_lock();
N
Nick Piggin 已提交
1555

A
Al Viro 已提交
1556 1557 1558 1559 1560 1561 1562 1563
			do {
				seq = read_seqcount_begin(&fs->seq);
				nd->path = fs->pwd;
				nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
			} while (read_seqcount_retry(&fs->seq, seq));
		} else {
			get_fs_pwd(current->fs, &nd->path);
		}
N
Nick Piggin 已提交
1564 1565 1566
	} else {
		struct dentry *dentry;

1567
		file = fget_raw_light(dfd, &fput_needed);
N
Nick Piggin 已提交
1568 1569 1570 1571 1572 1573
		retval = -EBADF;
		if (!file)
			goto out_fail;

		dentry = file->f_path.dentry;

A
Al Viro 已提交
1574 1575 1576 1577
		if (*name) {
			retval = -ENOTDIR;
			if (!S_ISDIR(dentry->d_inode->i_mode))
				goto fput_fail;
N
Nick Piggin 已提交
1578

A
Al Viro 已提交
1579 1580 1581 1582
			retval = file_permission(file, MAY_EXEC);
			if (retval)
				goto fput_fail;
		}
N
Nick Piggin 已提交
1583 1584

		nd->path = file->f_path;
A
Al Viro 已提交
1585 1586
		if (flags & LOOKUP_RCU) {
			if (fput_needed)
A
Al Viro 已提交
1587
				*fp = file;
A
Al Viro 已提交
1588 1589 1590 1591 1592 1593 1594
			nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
			br_read_lock(vfsmount_lock);
			rcu_read_lock();
		} else {
			path_get(&file->f_path);
			fput_light(file, fput_needed);
		}
N
Nick Piggin 已提交
1595 1596 1597
	}

	nd->inode = nd->path.dentry->d_inode;
1598
	return 0;
1599

1600 1601 1602 1603 1604 1605
fput_fail:
	fput_light(file, fput_needed);
out_fail:
	return retval;
}

1606 1607 1608 1609 1610 1611 1612 1613 1614 1615
static inline int lookup_last(struct nameidata *nd, struct path *path)
{
	if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
		nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;

	nd->flags &= ~LOOKUP_PARENT;
	return walk_component(nd, path, &nd->last, nd->last_type,
					nd->flags & LOOKUP_FOLLOW);
}

1616
/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
A
Al Viro 已提交
1617
static int path_lookupat(int dfd, const char *name,
1618 1619
				unsigned int flags, struct nameidata *nd)
{
A
Al Viro 已提交
1620
	struct file *base = NULL;
1621 1622
	struct path path;
	int err;
N
Nick Piggin 已提交
1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637

	/*
	 * Path walking is largely split up into 2 different synchronisation
	 * schemes, rcu-walk and ref-walk (explained in
	 * Documentation/filesystems/path-lookup.txt). These share much of the
	 * path walk code, but some things particularly setup, cleanup, and
	 * following mounts are sufficiently divergent that functions are
	 * duplicated. Typically there is a function foo(), and its RCU
	 * analogue, foo_rcu().
	 *
	 * -ECHILD is the error number of choice (just to avoid clashes) that
	 * is returned if some aspect of an rcu-walk fails. Such an error must
	 * be handled by restarting a traditional ref-walk (which will always
	 * be able to complete).
	 */
1638
	err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base);
A
Al Viro 已提交
1639

1640 1641
	if (unlikely(err))
		return err;
A
Al Viro 已提交
1642 1643

	current->total_link_count = 0;
1644 1645 1646 1647 1648 1649 1650 1651
	err = link_path_walk(name, nd);

	if (!err && !(flags & LOOKUP_PARENT)) {
		err = lookup_last(nd, &path);
		while (err > 0) {
			void *cookie;
			struct path link = path;
			nd->flags |= LOOKUP_PARENT;
1652
			err = follow_link(&link, nd, &cookie);
1653 1654
			if (!err)
				err = lookup_last(nd, &path);
1655
			put_link(nd, &link, cookie);
1656 1657
		}
	}
A
Al Viro 已提交
1658 1659

	if (nd->flags & LOOKUP_RCU) {
1660
		/* went all way through without dropping RCU */
1661
		BUG_ON(err);
1662
		if (nameidata_drop_rcu_last(nd))
1663
			err = -ECHILD;
A
Al Viro 已提交
1664 1665
	}

A
Al Viro 已提交
1666
	if (!err) {
1667
		err = handle_reval_path(nd);
A
Al Viro 已提交
1668 1669 1670
		if (err)
			path_put(&nd->path);
	}
1671 1672 1673 1674

	if (!err && nd->flags & LOOKUP_DIRECTORY) {
		if (!nd->inode->i_op->lookup) {
			path_put(&nd->path);
A
Al Viro 已提交
1675
			err = -ENOTDIR;
1676 1677
		}
	}
A
Al Viro 已提交
1678

A
Al Viro 已提交
1679 1680
	if (base)
		fput(base);
A
Al Viro 已提交
1681

1682
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
A
Al Viro 已提交
1683 1684 1685
		path_put(&nd->root);
		nd->root.mnt = NULL;
	}
1686
	return err;
A
Al Viro 已提交
1687
}
N
Nick Piggin 已提交
1688

A
Al Viro 已提交
1689 1690 1691 1692 1693 1694 1695 1696
static int do_path_lookup(int dfd, const char *name,
				unsigned int flags, struct nameidata *nd)
{
	int retval = path_lookupat(dfd, name, flags | LOOKUP_RCU, nd);
	if (unlikely(retval == -ECHILD))
		retval = path_lookupat(dfd, name, flags, nd);
	if (unlikely(retval == -ESTALE))
		retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
N
Nick Piggin 已提交
1697 1698 1699 1700 1701 1702 1703

	if (likely(!retval)) {
		if (unlikely(!audit_dummy_context())) {
			if (nd->path.dentry && nd->inode)
				audit_inode(name, nd->path.dentry);
		}
	}
1704
	return retval;
L
Linus Torvalds 已提交
1705 1706
}

A
Al Viro 已提交
1707
int kern_path_parent(const char *name, struct nameidata *nd)
1708
{
A
Al Viro 已提交
1709
	return do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, nd);
1710 1711
}

A
Al Viro 已提交
1712 1713 1714 1715 1716 1717 1718 1719 1720
int kern_path(const char *name, unsigned int flags, struct path *path)
{
	struct nameidata nd;
	int res = do_path_lookup(AT_FDCWD, name, flags, &nd);
	if (!res)
		*path = nd.path;
	return res;
}

1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732
/**
 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
 * @dentry:  pointer to dentry of the base directory
 * @mnt: pointer to vfs mount of the base directory
 * @name: pointer to file name
 * @flags: lookup flags
 * @nd: pointer to nameidata
 */
int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
		    const char *name, unsigned int flags,
		    struct nameidata *nd)
{
1733 1734 1735 1736
	nd->root.dentry = dentry;
	nd->root.mnt = mnt;
	/* the first argument of do_path_lookup() is ignored with LOOKUP_ROOT */
	return do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, nd);
1737 1738
}

1739 1740
static struct dentry *__lookup_hash(struct qstr *name,
		struct dentry *base, struct nameidata *nd)
L
Linus Torvalds 已提交
1741
{
1742
	struct inode *inode = base->d_inode;
1743
	struct dentry *dentry;
L
Linus Torvalds 已提交
1744 1745
	int err;

1746
	err = exec_permission(inode, 0);
1747 1748
	if (err)
		return ERR_PTR(err);
L
Linus Torvalds 已提交
1749

1750 1751 1752 1753
	/*
	 * Don't bother with __d_lookup: callers are for creat as
	 * well as unlink, so a lot of the time it would cost
	 * a double lookup.
A
Al Viro 已提交
1754
	 */
1755
	dentry = d_lookup(base, name);
A
Al Viro 已提交
1756

1757
	if (dentry && (dentry->d_flags & DCACHE_OP_REVALIDATE))
A
Al Viro 已提交
1758 1759
		dentry = do_revalidate(dentry, nd);

1760 1761
	if (!dentry)
		dentry = d_alloc_and_lookup(base, name, nd);
1762

L
Linus Torvalds 已提交
1763 1764 1765
	return dentry;
}

1766 1767 1768 1769 1770
/*
 * Restricted form of lookup. Doesn't follow links, single-component only,
 * needs parent already locked. Doesn't follow mounts.
 * SMP-safe.
 */
1771
static struct dentry *lookup_hash(struct nameidata *nd)
1772
{
1773
	return __lookup_hash(&nd->last, nd->path.dentry, nd);
L
Linus Torvalds 已提交
1774 1775
}

1776
/**
1777
 * lookup_one_len - filesystem helper to lookup single pathname component
1778 1779 1780 1781
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
1782 1783
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.  Also note that by using this function the
1784 1785 1786
 * nameidata argument is passed to the filesystem methods and a filesystem
 * using this helper needs to be prepared for that.
 */
1787 1788 1789
struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
{
	struct qstr this;
A
Al Viro 已提交
1790 1791
	unsigned long hash;
	unsigned int c;
1792

1793 1794
	WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));

A
Al Viro 已提交
1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807
	this.name = name;
	this.len = len;
	if (!len)
		return ERR_PTR(-EACCES);

	hash = init_name_hash();
	while (len--) {
		c = *(const unsigned char *)name++;
		if (c == '/' || c == '\0')
			return ERR_PTR(-EACCES);
		hash = partial_name_hash(c, hash);
	}
	this.hash = end_name_hash(hash);
1808 1809 1810 1811 1812 1813 1814 1815 1816
	/*
	 * See if the low-level filesystem might want
	 * to use its own hash..
	 */
	if (base->d_flags & DCACHE_OP_HASH) {
		int err = base->d_op->d_hash(base, base->d_inode, &this);
		if (err < 0)
			return ERR_PTR(err);
	}
1817

1818
	return __lookup_hash(&this, base, NULL);
1819 1820
}

1821 1822
int user_path_at(int dfd, const char __user *name, unsigned flags,
		 struct path *path)
L
Linus Torvalds 已提交
1823
{
1824
	struct nameidata nd;
A
Al Viro 已提交
1825
	char *tmp = getname_flags(name, flags);
L
Linus Torvalds 已提交
1826 1827
	int err = PTR_ERR(tmp);
	if (!IS_ERR(tmp)) {
1828 1829 1830 1831

		BUG_ON(flags & LOOKUP_PARENT);

		err = do_path_lookup(dfd, tmp, flags, &nd);
L
Linus Torvalds 已提交
1832
		putname(tmp);
1833 1834
		if (!err)
			*path = nd.path;
L
Linus Torvalds 已提交
1835 1836 1837 1838
	}
	return err;
}

1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856
static int user_path_parent(int dfd, const char __user *path,
			struct nameidata *nd, char **name)
{
	char *s = getname(path);
	int error;

	if (IS_ERR(s))
		return PTR_ERR(s);

	error = do_path_lookup(dfd, s, LOOKUP_PARENT, nd);
	if (error)
		putname(s);
	else
		*name = s;

	return error;
}

L
Linus Torvalds 已提交
1857 1858 1859 1860 1861 1862
/*
 * It's inline, so penalty for filesystems that don't use sticky bit is
 * minimal.
 */
static inline int check_sticky(struct inode *dir, struct inode *inode)
{
1863 1864
	uid_t fsuid = current_fsuid();

L
Linus Torvalds 已提交
1865 1866
	if (!(dir->i_mode & S_ISVTX))
		return 0;
1867 1868
	if (current_user_ns() != inode_userns(inode))
		goto other_userns;
1869
	if (inode->i_uid == fsuid)
L
Linus Torvalds 已提交
1870
		return 0;
1871
	if (dir->i_uid == fsuid)
L
Linus Torvalds 已提交
1872
		return 0;
1873 1874 1875

other_userns:
	return !ns_capable(inode_userns(inode), CAP_FOWNER);
L
Linus Torvalds 已提交
1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896
}

/*
 *	Check whether we can remove a link victim from directory dir, check
 *  whether the type of victim is right.
 *  1. We can't do it if dir is read-only (done in permission())
 *  2. We should have write and exec permissions on dir
 *  3. We can't remove anything from append-only dir
 *  4. We can't do anything with immutable dir (done in permission())
 *  5. If the sticky bit on dir is set we should either
 *	a. be owner of dir, or
 *	b. be owner of victim, or
 *	c. have CAP_FOWNER capability
 *  6. If the victim is append-only or immutable we can't do antyhing with
 *     links pointing to it.
 *  7. If we were asked to remove a directory and victim isn't one - ENOTDIR.
 *  8. If we were asked to remove a non-directory and victim isn't one - EISDIR.
 *  9. We can't remove a root or mountpoint.
 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by
 *     nfs_async_unlink().
 */
1897
static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
L
Linus Torvalds 已提交
1898 1899 1900 1901 1902 1903 1904
{
	int error;

	if (!victim->d_inode)
		return -ENOENT;

	BUG_ON(victim->d_parent->d_inode != dir);
1905
	audit_inode_child(victim, dir);
L
Linus Torvalds 已提交
1906

1907
	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
1908 1909 1910 1911 1912
	if (error)
		return error;
	if (IS_APPEND(dir))
		return -EPERM;
	if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
H
Hugh Dickins 已提交
1913
	    IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
L
Linus Torvalds 已提交
1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936
		return -EPERM;
	if (isdir) {
		if (!S_ISDIR(victim->d_inode->i_mode))
			return -ENOTDIR;
		if (IS_ROOT(victim))
			return -EBUSY;
	} else if (S_ISDIR(victim->d_inode->i_mode))
		return -EISDIR;
	if (IS_DEADDIR(dir))
		return -ENOENT;
	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
		return -EBUSY;
	return 0;
}

/*	Check whether we can create an object with dentry child in directory
 *  dir.
 *  1. We can't do it if child already exists (open has special treatment for
 *     this case, but since we are inlined it's OK)
 *  2. We can't do it if dir is read-only (done in permission())
 *  3. We should have write and exec permissions on dir
 *  4. We can't do it if dir is immutable (done in permission())
 */
1937
static inline int may_create(struct inode *dir, struct dentry *child)
L
Linus Torvalds 已提交
1938 1939 1940 1941 1942
{
	if (child->d_inode)
		return -EEXIST;
	if (IS_DEADDIR(dir))
		return -ENOENT;
1943
	return inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
1944 1945 1946 1947 1948 1949 1950 1951 1952 1953
}

/*
 * p1 and p2 should be directories on the same fs.
 */
struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
{
	struct dentry *p;

	if (p1 == p2) {
I
Ingo Molnar 已提交
1954
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
L
Linus Torvalds 已提交
1955 1956 1957
		return NULL;
	}

1958
	mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
1959

1960 1961 1962 1963 1964
	p = d_ancestor(p2, p1);
	if (p) {
		mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT);
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD);
		return p;
L
Linus Torvalds 已提交
1965 1966
	}

1967 1968 1969 1970 1971
	p = d_ancestor(p1, p2);
	if (p) {
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
		mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
		return p;
L
Linus Torvalds 已提交
1972 1973
	}

I
Ingo Molnar 已提交
1974 1975
	mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
	mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
L
Linus Torvalds 已提交
1976 1977 1978 1979 1980
	return NULL;
}

void unlock_rename(struct dentry *p1, struct dentry *p2)
{
1981
	mutex_unlock(&p1->d_inode->i_mutex);
L
Linus Torvalds 已提交
1982
	if (p1 != p2) {
1983
		mutex_unlock(&p2->d_inode->i_mutex);
1984
		mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
1985 1986 1987 1988 1989 1990
	}
}

int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
		struct nameidata *nd)
{
1991
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
1992 1993 1994 1995

	if (error)
		return error;

A
Al Viro 已提交
1996
	if (!dir->i_op->create)
L
Linus Torvalds 已提交
1997 1998 1999 2000 2001 2002 2003
		return -EACCES;	/* shouldn't it be ENOSYS? */
	mode &= S_IALLUGO;
	mode |= S_IFREG;
	error = security_inode_create(dir, dentry, mode);
	if (error)
		return error;
	error = dir->i_op->create(dir, dentry, mode, nd);
2004
	if (!error)
2005
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
2006 2007 2008
	return error;
}

A
Al Viro 已提交
2009
static int may_open(struct path *path, int acc_mode, int flag)
L
Linus Torvalds 已提交
2010
{
2011
	struct dentry *dentry = path->dentry;
L
Linus Torvalds 已提交
2012 2013 2014
	struct inode *inode = dentry->d_inode;
	int error;

A
Al Viro 已提交
2015 2016 2017 2018
	/* O_PATH? */
	if (!acc_mode)
		return 0;

L
Linus Torvalds 已提交
2019 2020 2021
	if (!inode)
		return -ENOENT;

C
Christoph Hellwig 已提交
2022 2023
	switch (inode->i_mode & S_IFMT) {
	case S_IFLNK:
L
Linus Torvalds 已提交
2024
		return -ELOOP;
C
Christoph Hellwig 已提交
2025 2026 2027 2028 2029 2030
	case S_IFDIR:
		if (acc_mode & MAY_WRITE)
			return -EISDIR;
		break;
	case S_IFBLK:
	case S_IFCHR:
2031
		if (path->mnt->mnt_flags & MNT_NODEV)
L
Linus Torvalds 已提交
2032
			return -EACCES;
C
Christoph Hellwig 已提交
2033 2034 2035
		/*FALLTHRU*/
	case S_IFIFO:
	case S_IFSOCK:
L
Linus Torvalds 已提交
2036
		flag &= ~O_TRUNC;
C
Christoph Hellwig 已提交
2037
		break;
2038
	}
2039

2040
	error = inode_permission(inode, acc_mode);
2041 2042
	if (error)
		return error;
M
Mimi Zohar 已提交
2043

L
Linus Torvalds 已提交
2044 2045 2046 2047
	/*
	 * An append-only file must be opened in append mode for writing.
	 */
	if (IS_APPEND(inode)) {
2048
		if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
2049
			return -EPERM;
L
Linus Torvalds 已提交
2050
		if (flag & O_TRUNC)
2051
			return -EPERM;
L
Linus Torvalds 已提交
2052 2053 2054
	}

	/* O_NOATIME can only be set by the owner or superuser */
2055
	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
2056
		return -EPERM;
L
Linus Torvalds 已提交
2057 2058 2059 2060

	/*
	 * Ensure there are no outstanding leases on the file.
	 */
2061
	return break_lease(inode, flag);
2062
}
L
Linus Torvalds 已提交
2063

2064
static int handle_truncate(struct file *filp)
2065
{
2066
	struct path *path = &filp->f_path;
2067 2068 2069 2070 2071 2072 2073 2074 2075
	struct inode *inode = path->dentry->d_inode;
	int error = get_write_access(inode);
	if (error)
		return error;
	/*
	 * Refuse to truncate files with mandatory locks held on them.
	 */
	error = locks_verify_locked(inode);
	if (!error)
2076
		error = security_path_truncate(path);
2077 2078 2079
	if (!error) {
		error = do_truncate(path->dentry, 0,
				    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
2080
				    filp);
2081 2082
	}
	put_write_access(inode);
M
Mimi Zohar 已提交
2083
	return error;
L
Linus Torvalds 已提交
2084 2085
}

2086 2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101 2102 2103 2104 2105 2106 2107 2108 2109
/*
 * Note that while the flag value (low two bits) for sys_open means:
 *	00 - read-only
 *	01 - write-only
 *	10 - read-write
 *	11 - special
 * it is changed into
 *	00 - no permissions needed
 *	01 - read-permission
 *	10 - write-permission
 *	11 - read-write
 * for the internal routines (ie open_namei()/follow_link() etc)
 * This is more logical, and also allows the 00 "no perm needed"
 * to be used for symlinks (where the permissions are checked
 * later).
 *
*/
static inline int open_to_namei_flags(int flag)
{
	if ((flag+1) & O_ACCMODE)
		flag++;
	return flag;
}

N
Nick Piggin 已提交
2110
/*
2111
 * Handle the last step of open()
N
Nick Piggin 已提交
2112
 */
2113
static struct file *do_last(struct nameidata *nd, struct path *path,
2114
			    const struct open_flags *op, const char *pathname)
2115
{
2116
	struct dentry *dir = nd->path.dentry;
2117
	struct dentry *dentry;
2118
	int open_flag = op->open_flag;
2119
	int will_truncate = open_flag & O_TRUNC;
2120
	int want_write = 0;
A
Al Viro 已提交
2121
	int acc_mode = op->acc_mode;
2122
	struct file *filp;
A
Al Viro 已提交
2123
	int error;
2124

2125 2126 2127
	nd->flags &= ~LOOKUP_PARENT;
	nd->flags |= op->intent;

2128 2129
	switch (nd->last_type) {
	case LAST_DOTDOT:
2130
	case LAST_DOT:
2131 2132 2133
		error = handle_dots(nd, nd->last_type);
		if (error)
			return ERR_PTR(error);
2134 2135
		/* fallthrough */
	case LAST_ROOT:
2136 2137 2138 2139
		if (nd->flags & LOOKUP_RCU) {
			if (nameidata_drop_rcu_last(nd))
				return ERR_PTR(-ECHILD);
		}
A
Al Viro 已提交
2140 2141 2142
		error = handle_reval_path(nd);
		if (error)
			goto exit;
2143
		audit_inode(pathname, nd->path.dentry);
2144
		if (open_flag & O_CREAT) {
2145 2146 2147 2148
			error = -EISDIR;
			goto exit;
		}
		goto ok;
2149
	case LAST_BIND:
2150
		/* can't be RCU mode here */
A
Al Viro 已提交
2151 2152 2153
		error = handle_reval_path(nd);
		if (error)
			goto exit;
2154
		audit_inode(pathname, dir);
2155
		goto ok;
2156
	}
2157

2158
	if (!(open_flag & O_CREAT)) {
A
Al Viro 已提交
2159
		int symlink_ok = 0;
2160 2161
		if (nd->last.name[nd->last.len])
			nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
A
Al Viro 已提交
2162 2163
		if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW))
			symlink_ok = 1;
2164
		/* we _can_ be in RCU mode here */
2165 2166 2167
		error = walk_component(nd, path, &nd->last, LAST_NORM,
					!symlink_ok);
		if (error < 0)
2168
			return ERR_PTR(error);
2169
		if (error) /* symlink */
2170 2171 2172 2173 2174 2175 2176 2177 2178
			return NULL;
		/* sayonara */
		if (nd->flags & LOOKUP_RCU) {
			if (nameidata_drop_rcu_last(nd))
				return ERR_PTR(-ECHILD);
		}

		error = -ENOTDIR;
		if (nd->flags & LOOKUP_DIRECTORY) {
2179
			if (!nd->inode->i_op->lookup)
2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190 2191 2192 2193
				goto exit;
		}
		audit_inode(pathname, nd->path.dentry);
		goto ok;
	}

	/* create side of things */

	if (nd->flags & LOOKUP_RCU) {
		if (nameidata_drop_rcu_last(nd))
			return ERR_PTR(-ECHILD);
	}

	audit_inode(pathname, dir);
A
Al Viro 已提交
2194
	error = -EISDIR;
2195
	/* trailing slashes? */
N
Nick Piggin 已提交
2196 2197
	if (nd->last.name[nd->last.len])
		goto exit;
A
Al Viro 已提交
2198

2199 2200
	mutex_lock(&dir->d_inode->i_mutex);

2201 2202 2203
	dentry = lookup_hash(nd);
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry)) {
2204 2205 2206 2207
		mutex_unlock(&dir->d_inode->i_mutex);
		goto exit;
	}

2208 2209 2210
	path->dentry = dentry;
	path->mnt = nd->path.mnt;

2211
	/* Negative dentry, just create the file */
2212 2213 2214 2215
	if (!dentry->d_inode) {
		int mode = op->mode;
		if (!IS_POSIXACL(dir->d_inode))
			mode &= ~current_umask();
2216 2217
		/*
		 * This write is needed to ensure that a
2218
		 * rw->ro transition does not occur between
2219 2220 2221 2222 2223 2224 2225
		 * the time when the file is created and when
		 * a permanent write count is taken through
		 * the 'struct file' in nameidata_to_filp().
		 */
		error = mnt_want_write(nd->path.mnt);
		if (error)
			goto exit_mutex_unlock;
2226
		want_write = 1;
2227
		/* Don't check for write permission, don't truncate */
2228
		open_flag &= ~O_TRUNC;
2229
		will_truncate = 0;
A
Al Viro 已提交
2230
		acc_mode = MAY_OPEN;
2231 2232 2233 2234 2235 2236 2237 2238 2239
		error = security_path_mknod(&nd->path, dentry, mode, 0);
		if (error)
			goto exit_mutex_unlock;
		error = vfs_create(dir->d_inode, dentry, mode, nd);
		if (error)
			goto exit_mutex_unlock;
		mutex_unlock(&dir->d_inode->i_mutex);
		dput(nd->path.dentry);
		nd->path.dentry = dentry;
2240
		goto common;
2241 2242 2243 2244 2245 2246 2247 2248 2249
	}

	/*
	 * It already exists.
	 */
	mutex_unlock(&dir->d_inode->i_mutex);
	audit_inode(pathname, path->dentry);

	error = -EEXIST;
2250
	if (open_flag & O_EXCL)
2251 2252
		goto exit_dput;

2253 2254 2255
	error = follow_managed(path, nd->flags);
	if (error < 0)
		goto exit_dput;
2256 2257 2258 2259

	error = -ENOENT;
	if (!path->dentry->d_inode)
		goto exit_dput;
A
Al Viro 已提交
2260 2261

	if (path->dentry->d_inode->i_op->follow_link)
2262 2263 2264
		return NULL;

	path_to_nameidata(path, nd);
N
Nick Piggin 已提交
2265
	nd->inode = path->dentry->d_inode;
2266
	error = -EISDIR;
N
Nick Piggin 已提交
2267
	if (S_ISDIR(nd->inode->i_mode))
2268
		goto exit;
2269
ok:
2270 2271 2272
	if (!S_ISREG(nd->inode->i_mode))
		will_truncate = 0;

2273 2274 2275 2276
	if (will_truncate) {
		error = mnt_want_write(nd->path.mnt);
		if (error)
			goto exit;
2277
		want_write = 1;
2278
	}
2279
common:
A
Al Viro 已提交
2280
	error = may_open(&nd->path, acc_mode, open_flag);
2281
	if (error)
2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299
		goto exit;
	filp = nameidata_to_filp(nd);
	if (!IS_ERR(filp)) {
		error = ima_file_check(filp, op->acc_mode);
		if (error) {
			fput(filp);
			filp = ERR_PTR(error);
		}
	}
	if (!IS_ERR(filp)) {
		if (will_truncate) {
			error = handle_truncate(filp);
			if (error) {
				fput(filp);
				filp = ERR_PTR(error);
			}
		}
	}
2300 2301
out:
	if (want_write)
2302 2303
		mnt_drop_write(nd->path.mnt);
	path_put(&nd->path);
2304 2305 2306 2307 2308 2309 2310
	return filp;

exit_mutex_unlock:
	mutex_unlock(&dir->d_inode->i_mutex);
exit_dput:
	path_put_conditional(path, nd);
exit:
2311 2312
	filp = ERR_PTR(error);
	goto out;
2313 2314
}

2315
static struct file *path_openat(int dfd, const char *pathname,
A
Al Viro 已提交
2316
		struct nameidata *nd, const struct open_flags *op, int flags)
L
Linus Torvalds 已提交
2317
{
2318
	struct file *base = NULL;
2319
	struct file *filp;
2320
	struct path path;
2321
	int error;
N
Nick Piggin 已提交
2322 2323 2324 2325 2326

	filp = get_empty_filp();
	if (!filp)
		return ERR_PTR(-ENFILE);

2327
	filp->f_flags = op->open_flag;
A
Al Viro 已提交
2328 2329 2330
	nd->intent.open.file = filp;
	nd->intent.open.flags = open_to_namei_flags(op->open_flag);
	nd->intent.open.create_mode = op->mode;
N
Nick Piggin 已提交
2331

A
Al Viro 已提交
2332
	error = path_init(dfd, pathname, flags | LOOKUP_PARENT, nd, &base);
N
Nick Piggin 已提交
2333
	if (unlikely(error))
2334
		goto out_filp;
N
Nick Piggin 已提交
2335

2336
	current->total_link_count = 0;
A
Al Viro 已提交
2337
	error = link_path_walk(pathname, nd);
N
Nick Piggin 已提交
2338 2339
	if (unlikely(error))
		goto out_filp;
L
Linus Torvalds 已提交
2340

A
Al Viro 已提交
2341
	filp = do_last(nd, &path, op, pathname);
2342
	while (unlikely(!filp)) { /* trailing symlink */
2343
		struct path link = path;
A
Al Viro 已提交
2344
		void *cookie;
2345
		if (!(nd->flags & LOOKUP_FOLLOW)) {
A
Al Viro 已提交
2346 2347
			path_put_conditional(&path, nd);
			path_put(&nd->path);
2348 2349 2350
			filp = ERR_PTR(-ELOOP);
			break;
		}
A
Al Viro 已提交
2351 2352
		nd->flags |= LOOKUP_PARENT;
		nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
2353
		error = follow_link(&link, nd, &cookie);
2354
		if (unlikely(error))
2355
			filp = ERR_PTR(error);
2356
		else
A
Al Viro 已提交
2357
			filp = do_last(nd, &path, op, pathname);
2358
		put_link(nd, &link, cookie);
2359
	}
A
Al Viro 已提交
2360
out:
A
Al Viro 已提交
2361 2362
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT))
		path_put(&nd->root);
2363 2364
	if (base)
		fput(base);
A
Al Viro 已提交
2365
	release_open_intent(nd);
A
Al Viro 已提交
2366
	return filp;
L
Linus Torvalds 已提交
2367

N
Nick Piggin 已提交
2368
out_filp:
2369
	filp = ERR_PTR(error);
A
Al Viro 已提交
2370
	goto out;
L
Linus Torvalds 已提交
2371 2372
}

2373 2374 2375
struct file *do_filp_open(int dfd, const char *pathname,
		const struct open_flags *op, int flags)
{
A
Al Viro 已提交
2376
	struct nameidata nd;
2377 2378
	struct file *filp;

A
Al Viro 已提交
2379
	filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU);
2380
	if (unlikely(filp == ERR_PTR(-ECHILD)))
A
Al Viro 已提交
2381
		filp = path_openat(dfd, pathname, &nd, op, flags);
2382
	if (unlikely(filp == ERR_PTR(-ESTALE)))
A
Al Viro 已提交
2383
		filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL);
2384 2385 2386
	return filp;
}

A
Al Viro 已提交
2387 2388 2389 2390 2391 2392 2393 2394 2395 2396 2397
struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
		const char *name, const struct open_flags *op, int flags)
{
	struct nameidata nd;
	struct file *file;

	nd.root.mnt = mnt;
	nd.root.dentry = dentry;

	flags |= LOOKUP_ROOT;

A
Al Viro 已提交
2398
	if (dentry->d_inode->i_op->follow_link && op->intent & LOOKUP_OPEN)
A
Al Viro 已提交
2399 2400 2401 2402 2403 2404 2405 2406 2407 2408
		return ERR_PTR(-ELOOP);

	file = path_openat(-1, name, &nd, op, flags | LOOKUP_RCU);
	if (unlikely(file == ERR_PTR(-ECHILD)))
		file = path_openat(-1, name, &nd, op, flags);
	if (unlikely(file == ERR_PTR(-ESTALE)))
		file = path_openat(-1, name, &nd, op, flags | LOOKUP_REVAL);
	return file;
}

L
Linus Torvalds 已提交
2409 2410 2411 2412 2413 2414 2415
/**
 * lookup_create - lookup a dentry, creating it if it doesn't exist
 * @nd: nameidata info
 * @is_dir: directory flag
 *
 * Simple function to lookup and return a dentry and create it
 * if it doesn't exist.  Is SMP-safe.
2416
 *
2417
 * Returns with nd->path.dentry->d_inode->i_mutex locked.
L
Linus Torvalds 已提交
2418 2419 2420
 */
struct dentry *lookup_create(struct nameidata *nd, int is_dir)
{
2421
	struct dentry *dentry = ERR_PTR(-EEXIST);
L
Linus Torvalds 已提交
2422

2423
	mutex_lock_nested(&nd->path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2424 2425 2426 2427
	/*
	 * Yucky last component or no last component at all?
	 * (foo/., foo/.., /////)
	 */
L
Linus Torvalds 已提交
2428 2429 2430
	if (nd->last_type != LAST_NORM)
		goto fail;
	nd->flags &= ~LOOKUP_PARENT;
2431
	nd->flags |= LOOKUP_CREATE | LOOKUP_EXCL;
2432
	nd->intent.open.flags = O_EXCL;
2433 2434 2435 2436

	/*
	 * Do the final lookup.
	 */
2437
	dentry = lookup_hash(nd);
L
Linus Torvalds 已提交
2438 2439
	if (IS_ERR(dentry))
		goto fail;
2440

2441 2442
	if (dentry->d_inode)
		goto eexist;
2443 2444 2445 2446 2447 2448
	/*
	 * Special case - lookup gave negative, but... we had foo/bar/
	 * From the vfs_mknod() POV we just have a negative dentry -
	 * all is fine. Let's be bastards - you had / on the end, you've
	 * been asking for (non-existent) directory. -ENOENT for you.
	 */
2449 2450 2451 2452
	if (unlikely(!is_dir && nd->last.name[nd->last.len])) {
		dput(dentry);
		dentry = ERR_PTR(-ENOENT);
	}
L
Linus Torvalds 已提交
2453
	return dentry;
2454
eexist:
L
Linus Torvalds 已提交
2455
	dput(dentry);
2456
	dentry = ERR_PTR(-EEXIST);
L
Linus Torvalds 已提交
2457 2458 2459
fail:
	return dentry;
}
2460
EXPORT_SYMBOL_GPL(lookup_create);
L
Linus Torvalds 已提交
2461 2462 2463

int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
{
2464
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2465 2466 2467 2468

	if (error)
		return error;

2469 2470
	if ((S_ISCHR(mode) || S_ISBLK(mode)) &&
	    !ns_capable(inode_userns(dir), CAP_MKNOD))
L
Linus Torvalds 已提交
2471 2472
		return -EPERM;

A
Al Viro 已提交
2473
	if (!dir->i_op->mknod)
L
Linus Torvalds 已提交
2474 2475
		return -EPERM;

2476 2477 2478 2479
	error = devcgroup_inode_mknod(mode, dev);
	if (error)
		return error;

L
Linus Torvalds 已提交
2480 2481 2482 2483 2484
	error = security_inode_mknod(dir, dentry, mode, dev);
	if (error)
		return error;

	error = dir->i_op->mknod(dir, dentry, mode, dev);
2485
	if (!error)
2486
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
2487 2488 2489
	return error;
}

2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506
static int may_mknod(mode_t mode)
{
	switch (mode & S_IFMT) {
	case S_IFREG:
	case S_IFCHR:
	case S_IFBLK:
	case S_IFIFO:
	case S_IFSOCK:
	case 0: /* zero mode translates to S_IFREG */
		return 0;
	case S_IFDIR:
		return -EPERM;
	default:
		return -EINVAL;
	}
}

2507 2508
SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
		unsigned, dev)
L
Linus Torvalds 已提交
2509
{
2510 2511 2512
	int error;
	char *tmp;
	struct dentry *dentry;
L
Linus Torvalds 已提交
2513 2514 2515 2516 2517
	struct nameidata nd;

	if (S_ISDIR(mode))
		return -EPERM;

2518
	error = user_path_parent(dfd, filename, &nd, &tmp);
L
Linus Torvalds 已提交
2519
	if (error)
2520 2521
		return error;

L
Linus Torvalds 已提交
2522
	dentry = lookup_create(&nd, 0);
2523 2524 2525 2526
	if (IS_ERR(dentry)) {
		error = PTR_ERR(dentry);
		goto out_unlock;
	}
2527
	if (!IS_POSIXACL(nd.path.dentry->d_inode))
A
Al Viro 已提交
2528
		mode &= ~current_umask();
2529 2530 2531 2532 2533 2534
	error = may_mknod(mode);
	if (error)
		goto out_dput;
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto out_dput;
2535 2536 2537
	error = security_path_mknod(&nd.path, dentry, mode, dev);
	if (error)
		goto out_drop_write;
2538
	switch (mode & S_IFMT) {
L
Linus Torvalds 已提交
2539
		case 0: case S_IFREG:
2540
			error = vfs_create(nd.path.dentry->d_inode,dentry,mode,&nd);
L
Linus Torvalds 已提交
2541 2542
			break;
		case S_IFCHR: case S_IFBLK:
2543
			error = vfs_mknod(nd.path.dentry->d_inode,dentry,mode,
L
Linus Torvalds 已提交
2544 2545 2546
					new_decode_dev(dev));
			break;
		case S_IFIFO: case S_IFSOCK:
2547
			error = vfs_mknod(nd.path.dentry->d_inode,dentry,mode,0);
L
Linus Torvalds 已提交
2548 2549
			break;
	}
2550
out_drop_write:
2551 2552 2553 2554
	mnt_drop_write(nd.path.mnt);
out_dput:
	dput(dentry);
out_unlock:
2555
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
J
Jan Blunck 已提交
2556
	path_put(&nd.path);
L
Linus Torvalds 已提交
2557 2558 2559 2560 2561
	putname(tmp);

	return error;
}

2562
SYSCALL_DEFINE3(mknod, const char __user *, filename, int, mode, unsigned, dev)
2563 2564 2565 2566
{
	return sys_mknodat(AT_FDCWD, filename, mode, dev);
}

L
Linus Torvalds 已提交
2567 2568
int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
{
2569
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2570 2571 2572 2573

	if (error)
		return error;

A
Al Viro 已提交
2574
	if (!dir->i_op->mkdir)
L
Linus Torvalds 已提交
2575 2576 2577 2578 2579 2580 2581 2582
		return -EPERM;

	mode &= (S_IRWXUGO|S_ISVTX);
	error = security_inode_mkdir(dir, dentry, mode);
	if (error)
		return error;

	error = dir->i_op->mkdir(dir, dentry, mode);
2583
	if (!error)
2584
		fsnotify_mkdir(dir, dentry);
L
Linus Torvalds 已提交
2585 2586 2587
	return error;
}

2588
SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
L
Linus Torvalds 已提交
2589 2590 2591
{
	int error = 0;
	char * tmp;
2592 2593
	struct dentry *dentry;
	struct nameidata nd;
L
Linus Torvalds 已提交
2594

2595 2596
	error = user_path_parent(dfd, pathname, &nd, &tmp);
	if (error)
2597
		goto out_err;
L
Linus Torvalds 已提交
2598

2599 2600 2601 2602
	dentry = lookup_create(&nd, 1);
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry))
		goto out_unlock;
L
Linus Torvalds 已提交
2603

2604
	if (!IS_POSIXACL(nd.path.dentry->d_inode))
A
Al Viro 已提交
2605
		mode &= ~current_umask();
2606 2607 2608
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto out_dput;
2609 2610 2611
	error = security_path_mkdir(&nd.path, dentry, mode);
	if (error)
		goto out_drop_write;
2612
	error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
2613
out_drop_write:
2614 2615
	mnt_drop_write(nd.path.mnt);
out_dput:
2616 2617
	dput(dentry);
out_unlock:
2618
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
J
Jan Blunck 已提交
2619
	path_put(&nd.path);
2620 2621
	putname(tmp);
out_err:
L
Linus Torvalds 已提交
2622 2623 2624
	return error;
}

2625
SYSCALL_DEFINE2(mkdir, const char __user *, pathname, int, mode)
2626 2627 2628 2629
{
	return sys_mkdirat(AT_FDCWD, pathname, mode);
}

L
Linus Torvalds 已提交
2630 2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647
/*
 * We try to drop the dentry early: we should have
 * a usage count of 2 if we're the only user of this
 * dentry, and if that is true (possibly after pruning
 * the dcache), then we drop the dentry now.
 *
 * A low-level filesystem can, if it choses, legally
 * do a
 *
 *	if (!d_unhashed(dentry))
 *		return -EBUSY;
 *
 * if it cannot handle the case of removing a directory
 * that is still in use by something else..
 */
void dentry_unhash(struct dentry *dentry)
{
	dget(dentry);
2648
	shrink_dcache_parent(dentry);
L
Linus Torvalds 已提交
2649
	spin_lock(&dentry->d_lock);
N
Nick Piggin 已提交
2650
	if (dentry->d_count == 2)
L
Linus Torvalds 已提交
2651 2652 2653 2654 2655 2656 2657 2658 2659 2660 2661
		__d_drop(dentry);
	spin_unlock(&dentry->d_lock);
}

int vfs_rmdir(struct inode *dir, struct dentry *dentry)
{
	int error = may_delete(dir, dentry, 1);

	if (error)
		return error;

A
Al Viro 已提交
2662
	if (!dir->i_op->rmdir)
L
Linus Torvalds 已提交
2663 2664
		return -EPERM;

2665
	mutex_lock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2666 2667 2668 2669 2670 2671 2672
	dentry_unhash(dentry);
	if (d_mountpoint(dentry))
		error = -EBUSY;
	else {
		error = security_inode_rmdir(dir, dentry);
		if (!error) {
			error = dir->i_op->rmdir(dir, dentry);
2673
			if (!error) {
L
Linus Torvalds 已提交
2674
				dentry->d_inode->i_flags |= S_DEAD;
2675 2676
				dont_mount(dentry);
			}
L
Linus Torvalds 已提交
2677 2678
		}
	}
2679
	mutex_unlock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2680 2681 2682 2683 2684 2685 2686 2687
	if (!error) {
		d_delete(dentry);
	}
	dput(dentry);

	return error;
}

2688
static long do_rmdir(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
2689 2690 2691 2692 2693 2694
{
	int error = 0;
	char * name;
	struct dentry *dentry;
	struct nameidata nd;

2695
	error = user_path_parent(dfd, pathname, &nd, &name);
L
Linus Torvalds 已提交
2696
	if (error)
2697
		return error;
L
Linus Torvalds 已提交
2698 2699

	switch(nd.last_type) {
2700 2701 2702 2703 2704 2705 2706 2707 2708
	case LAST_DOTDOT:
		error = -ENOTEMPTY;
		goto exit1;
	case LAST_DOT:
		error = -EINVAL;
		goto exit1;
	case LAST_ROOT:
		error = -EBUSY;
		goto exit1;
L
Linus Torvalds 已提交
2709
	}
2710 2711 2712

	nd.flags &= ~LOOKUP_PARENT;

2713
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2714
	dentry = lookup_hash(&nd);
L
Linus Torvalds 已提交
2715
	error = PTR_ERR(dentry);
2716 2717
	if (IS_ERR(dentry))
		goto exit2;
2718 2719 2720
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto exit3;
2721 2722 2723
	error = security_path_rmdir(&nd.path, dentry);
	if (error)
		goto exit4;
2724
	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
2725
exit4:
2726 2727
	mnt_drop_write(nd.path.mnt);
exit3:
2728 2729
	dput(dentry);
exit2:
2730
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2731
exit1:
J
Jan Blunck 已提交
2732
	path_put(&nd.path);
L
Linus Torvalds 已提交
2733 2734 2735 2736
	putname(name);
	return error;
}

2737
SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
2738 2739 2740 2741
{
	return do_rmdir(AT_FDCWD, pathname);
}

L
Linus Torvalds 已提交
2742 2743 2744 2745 2746 2747 2748
int vfs_unlink(struct inode *dir, struct dentry *dentry)
{
	int error = may_delete(dir, dentry, 0);

	if (error)
		return error;

A
Al Viro 已提交
2749
	if (!dir->i_op->unlink)
L
Linus Torvalds 已提交
2750 2751
		return -EPERM;

2752
	mutex_lock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2753 2754 2755 2756
	if (d_mountpoint(dentry))
		error = -EBUSY;
	else {
		error = security_inode_unlink(dir, dentry);
2757
		if (!error) {
L
Linus Torvalds 已提交
2758
			error = dir->i_op->unlink(dir, dentry);
2759
			if (!error)
2760
				dont_mount(dentry);
2761
		}
L
Linus Torvalds 已提交
2762
	}
2763
	mutex_unlock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2764 2765 2766

	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
	if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
2767
		fsnotify_link_count(dentry->d_inode);
J
John McCutchan 已提交
2768
		d_delete(dentry);
L
Linus Torvalds 已提交
2769
	}
R
Robert Love 已提交
2770

L
Linus Torvalds 已提交
2771 2772 2773 2774 2775
	return error;
}

/*
 * Make sure that the actual truncation of the file will occur outside its
2776
 * directory's i_mutex.  Truncate can take a long time if there is a lot of
L
Linus Torvalds 已提交
2777 2778 2779
 * writeout happening, and we don't want to prevent access to the directory
 * while waiting on the I/O.
 */
2780
static long do_unlinkat(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
2781
{
2782 2783
	int error;
	char *name;
L
Linus Torvalds 已提交
2784 2785 2786 2787
	struct dentry *dentry;
	struct nameidata nd;
	struct inode *inode = NULL;

2788
	error = user_path_parent(dfd, pathname, &nd, &name);
L
Linus Torvalds 已提交
2789
	if (error)
2790 2791
		return error;

L
Linus Torvalds 已提交
2792 2793 2794
	error = -EISDIR;
	if (nd.last_type != LAST_NORM)
		goto exit1;
2795 2796 2797

	nd.flags &= ~LOOKUP_PARENT;

2798
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2799
	dentry = lookup_hash(&nd);
L
Linus Torvalds 已提交
2800 2801 2802 2803 2804 2805 2806
	error = PTR_ERR(dentry);
	if (!IS_ERR(dentry)) {
		/* Why not before? Because we want correct error value */
		if (nd.last.name[nd.last.len])
			goto slashes;
		inode = dentry->d_inode;
		if (inode)
A
Al Viro 已提交
2807
			ihold(inode);
2808 2809 2810
		error = mnt_want_write(nd.path.mnt);
		if (error)
			goto exit2;
2811 2812 2813
		error = security_path_unlink(&nd.path, dentry);
		if (error)
			goto exit3;
2814
		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
2815
exit3:
2816
		mnt_drop_write(nd.path.mnt);
L
Linus Torvalds 已提交
2817 2818 2819
	exit2:
		dput(dentry);
	}
2820
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2821 2822 2823
	if (inode)
		iput(inode);	/* truncate the inode here */
exit1:
J
Jan Blunck 已提交
2824
	path_put(&nd.path);
L
Linus Torvalds 已提交
2825 2826 2827 2828 2829 2830 2831 2832 2833
	putname(name);
	return error;

slashes:
	error = !dentry->d_inode ? -ENOENT :
		S_ISDIR(dentry->d_inode->i_mode) ? -EISDIR : -ENOTDIR;
	goto exit2;
}

2834
SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
2835 2836 2837 2838 2839 2840 2841 2842 2843 2844
{
	if ((flag & ~AT_REMOVEDIR) != 0)
		return -EINVAL;

	if (flag & AT_REMOVEDIR)
		return do_rmdir(dfd, pathname);

	return do_unlinkat(dfd, pathname);
}

2845
SYSCALL_DEFINE1(unlink, const char __user *, pathname)
2846 2847 2848 2849
{
	return do_unlinkat(AT_FDCWD, pathname);
}

2850
int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
L
Linus Torvalds 已提交
2851
{
2852
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2853 2854 2855 2856

	if (error)
		return error;

A
Al Viro 已提交
2857
	if (!dir->i_op->symlink)
L
Linus Torvalds 已提交
2858 2859 2860 2861 2862 2863 2864
		return -EPERM;

	error = security_inode_symlink(dir, dentry, oldname);
	if (error)
		return error;

	error = dir->i_op->symlink(dir, dentry, oldname);
2865
	if (!error)
2866
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
2867 2868 2869
	return error;
}

2870 2871
SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
L
Linus Torvalds 已提交
2872
{
2873 2874 2875
	int error;
	char *from;
	char *to;
2876 2877
	struct dentry *dentry;
	struct nameidata nd;
L
Linus Torvalds 已提交
2878 2879

	from = getname(oldname);
2880
	if (IS_ERR(from))
L
Linus Torvalds 已提交
2881 2882
		return PTR_ERR(from);

2883
	error = user_path_parent(newdfd, newname, &nd, &to);
2884
	if (error)
2885 2886
		goto out_putname;

2887 2888 2889 2890 2891
	dentry = lookup_create(&nd, 0);
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry))
		goto out_unlock;

2892 2893 2894
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto out_dput;
2895 2896 2897
	error = security_path_symlink(&nd.path, dentry, from);
	if (error)
		goto out_drop_write;
2898
	error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
2899
out_drop_write:
2900 2901
	mnt_drop_write(nd.path.mnt);
out_dput:
2902 2903
	dput(dentry);
out_unlock:
2904
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
J
Jan Blunck 已提交
2905
	path_put(&nd.path);
2906 2907
	putname(to);
out_putname:
L
Linus Torvalds 已提交
2908 2909 2910 2911
	putname(from);
	return error;
}

2912
SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
2913 2914 2915 2916
{
	return sys_symlinkat(oldname, AT_FDCWD, newname);
}

L
Linus Torvalds 已提交
2917 2918 2919 2920 2921 2922 2923 2924
int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
{
	struct inode *inode = old_dentry->d_inode;
	int error;

	if (!inode)
		return -ENOENT;

2925
	error = may_create(dir, new_dentry);
L
Linus Torvalds 已提交
2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936
	if (error)
		return error;

	if (dir->i_sb != inode->i_sb)
		return -EXDEV;

	/*
	 * A link to an append-only or immutable file cannot be created.
	 */
	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
		return -EPERM;
A
Al Viro 已提交
2937
	if (!dir->i_op->link)
L
Linus Torvalds 已提交
2938
		return -EPERM;
2939
	if (S_ISDIR(inode->i_mode))
L
Linus Torvalds 已提交
2940 2941 2942 2943 2944 2945
		return -EPERM;

	error = security_inode_link(old_dentry, dir, new_dentry);
	if (error)
		return error;

2946
	mutex_lock(&inode->i_mutex);
2947 2948 2949 2950 2951
	/* Make sure we don't allow creating hardlink to an unlinked file */
	if (inode->i_nlink == 0)
		error =  -ENOENT;
	else
		error = dir->i_op->link(old_dentry, dir, new_dentry);
2952
	mutex_unlock(&inode->i_mutex);
2953
	if (!error)
2954
		fsnotify_link(dir, inode, new_dentry);
L
Linus Torvalds 已提交
2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966
	return error;
}

/*
 * Hardlinks are often used in delicate situations.  We avoid
 * security-related surprises by not following symlinks on the
 * newname.  --KAB
 *
 * We don't follow them on the oldname either to be compatible
 * with linux 2.0, and to avoid hard-linking to directories
 * and other special files.  --ADM
 */
2967 2968
SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname, int, flags)
L
Linus Torvalds 已提交
2969 2970
{
	struct dentry *new_dentry;
2971 2972
	struct nameidata nd;
	struct path old_path;
2973
	int how = 0;
L
Linus Torvalds 已提交
2974
	int error;
2975
	char *to;
L
Linus Torvalds 已提交
2976

2977
	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
2978
		return -EINVAL;
2979 2980 2981 2982 2983 2984 2985 2986 2987 2988 2989 2990 2991
	/*
	 * To use null names we require CAP_DAC_READ_SEARCH
	 * This ensures that not everyone will be able to create
	 * handlink using the passed filedescriptor.
	 */
	if (flags & AT_EMPTY_PATH) {
		if (!capable(CAP_DAC_READ_SEARCH))
			return -ENOENT;
		how = LOOKUP_EMPTY;
	}

	if (flags & AT_SYMLINK_FOLLOW)
		how |= LOOKUP_FOLLOW;
2992

2993
	error = user_path_at(olddfd, oldname, how, &old_path);
L
Linus Torvalds 已提交
2994
	if (error)
2995 2996 2997
		return error;

	error = user_path_parent(newdfd, newname, &nd, &to);
L
Linus Torvalds 已提交
2998 2999 3000
	if (error)
		goto out;
	error = -EXDEV;
3001
	if (old_path.mnt != nd.path.mnt)
L
Linus Torvalds 已提交
3002 3003 3004
		goto out_release;
	new_dentry = lookup_create(&nd, 0);
	error = PTR_ERR(new_dentry);
3005 3006
	if (IS_ERR(new_dentry))
		goto out_unlock;
3007 3008 3009
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto out_dput;
3010 3011 3012
	error = security_path_link(old_path.dentry, &nd.path, new_dentry);
	if (error)
		goto out_drop_write;
3013
	error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
3014
out_drop_write:
3015 3016
	mnt_drop_write(nd.path.mnt);
out_dput:
3017 3018
	dput(new_dentry);
out_unlock:
3019
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
3020
out_release:
J
Jan Blunck 已提交
3021
	path_put(&nd.path);
3022
	putname(to);
L
Linus Torvalds 已提交
3023
out:
3024
	path_put(&old_path);
L
Linus Torvalds 已提交
3025 3026 3027 3028

	return error;
}

3029
SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
3030
{
3031
	return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
3032 3033
}

L
Linus Torvalds 已提交
3034 3035 3036 3037 3038 3039 3040
/*
 * The worst of all namespace operations - renaming directory. "Perverted"
 * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
 * Problems:
 *	a) we can get into loop creation. Check is done in is_subdir().
 *	b) race potential - two innocent renames can create a loop together.
 *	   That's where 4.4 screws up. Current fix: serialization on
3041
 *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
L
Linus Torvalds 已提交
3042 3043
 *	   story.
 *	c) we have to lock _three_ objects - parents and victim (if it exists).
3044
 *	   And that - after we got ->i_mutex on parents (until then we don't know
L
Linus Torvalds 已提交
3045 3046
 *	   whether the target exists).  Solution: try to be smart with locking
 *	   order for inodes.  We rely on the fact that tree topology may change
3047
 *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
L
Linus Torvalds 已提交
3048 3049 3050
 *	   move will be locked.  Thus we can rank directories by the tree
 *	   (ancestors first) and rank all non-directories after them.
 *	   That works since everybody except rename does "lock parent, lookup,
3051
 *	   lock child" and rename is under ->s_vfs_rename_mutex.
L
Linus Torvalds 已提交
3052 3053 3054 3055 3056 3057 3058 3059 3060
 *	   HOWEVER, it relies on the assumption that any object with ->lookup()
 *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
 *	   we'd better make sure that there's no link(2) for them.
 *	d) some filesystems don't support opened-but-unlinked directories,
 *	   either because of layout or because they are not ready to deal with
 *	   all cases correctly. The latter will be fixed (taking this sort of
 *	   stuff into VFS), but the former is not going away. Solution: the same
 *	   trick as in rmdir().
 *	e) conversion from fhandle to dentry may come in the wrong moment - when
3061
 *	   we are removing the target. Solution: we will have to grab ->i_mutex
L
Linus Torvalds 已提交
3062
 *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
3063
 *	   ->i_mutex on parents, which works but leads to some truly excessive
L
Linus Torvalds 已提交
3064 3065
 *	   locking].
 */
A
Adrian Bunk 已提交
3066 3067
static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
			  struct inode *new_dir, struct dentry *new_dentry)
L
Linus Torvalds 已提交
3068 3069 3070 3071 3072 3073 3074 3075 3076
{
	int error = 0;
	struct inode *target;

	/*
	 * If we are going to change the parent - check write permissions,
	 * we'll need to flip '..'.
	 */
	if (new_dir != old_dir) {
3077
		error = inode_permission(old_dentry->d_inode, MAY_WRITE);
L
Linus Torvalds 已提交
3078 3079 3080 3081 3082 3083 3084 3085 3086
		if (error)
			return error;
	}

	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		return error;

	target = new_dentry->d_inode;
3087
	if (target)
3088
		mutex_lock(&target->i_mutex);
L
Linus Torvalds 已提交
3089 3090
	if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
		error = -EBUSY;
3091 3092 3093
	else {
		if (target)
			dentry_unhash(new_dentry);
L
Linus Torvalds 已提交
3094
		error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
3095
	}
L
Linus Torvalds 已提交
3096
	if (target) {
3097
		if (!error) {
L
Linus Torvalds 已提交
3098
			target->i_flags |= S_DEAD;
3099 3100
			dont_mount(new_dentry);
		}
3101
		mutex_unlock(&target->i_mutex);
L
Linus Torvalds 已提交
3102 3103 3104 3105
		if (d_unhashed(new_dentry))
			d_rehash(new_dentry);
		dput(new_dentry);
	}
3106
	if (!error)
3107 3108
		if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
			d_move(old_dentry,new_dentry);
L
Linus Torvalds 已提交
3109 3110 3111
	return error;
}

A
Adrian Bunk 已提交
3112 3113
static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
			    struct inode *new_dir, struct dentry *new_dentry)
L
Linus Torvalds 已提交
3114 3115 3116 3117 3118 3119 3120 3121 3122 3123 3124
{
	struct inode *target;
	int error;

	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		return error;

	dget(new_dentry);
	target = new_dentry->d_inode;
	if (target)
3125
		mutex_lock(&target->i_mutex);
L
Linus Torvalds 已提交
3126 3127 3128 3129 3130
	if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
		error = -EBUSY;
	else
		error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
	if (!error) {
3131
		if (target)
3132
			dont_mount(new_dentry);
3133
		if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
L
Linus Torvalds 已提交
3134 3135 3136
			d_move(old_dentry, new_dentry);
	}
	if (target)
3137
		mutex_unlock(&target->i_mutex);
L
Linus Torvalds 已提交
3138 3139 3140 3141 3142 3143 3144 3145 3146
	dput(new_dentry);
	return error;
}

int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
	       struct inode *new_dir, struct dentry *new_dentry)
{
	int error;
	int is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
3147
	const unsigned char *old_name;
L
Linus Torvalds 已提交
3148 3149 3150 3151 3152 3153 3154 3155 3156

	if (old_dentry->d_inode == new_dentry->d_inode)
 		return 0;
 
	error = may_delete(old_dir, old_dentry, is_dir);
	if (error)
		return error;

	if (!new_dentry->d_inode)
3157
		error = may_create(new_dir, new_dentry);
L
Linus Torvalds 已提交
3158 3159 3160 3161 3162
	else
		error = may_delete(new_dir, new_dentry, is_dir);
	if (error)
		return error;

A
Al Viro 已提交
3163
	if (!old_dir->i_op->rename)
L
Linus Torvalds 已提交
3164 3165
		return -EPERM;

R
Robert Love 已提交
3166 3167
	old_name = fsnotify_oldname_init(old_dentry->d_name.name);

L
Linus Torvalds 已提交
3168 3169 3170 3171
	if (is_dir)
		error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
	else
		error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
3172 3173
	if (!error)
		fsnotify_move(old_dir, new_dir, old_name, is_dir,
3174
			      new_dentry->d_inode, old_dentry);
R
Robert Love 已提交
3175 3176
	fsnotify_oldname_free(old_name);

L
Linus Torvalds 已提交
3177 3178 3179
	return error;
}

3180 3181
SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
L
Linus Torvalds 已提交
3182
{
3183 3184 3185
	struct dentry *old_dir, *new_dir;
	struct dentry *old_dentry, *new_dentry;
	struct dentry *trap;
L
Linus Torvalds 已提交
3186
	struct nameidata oldnd, newnd;
3187 3188 3189
	char *from;
	char *to;
	int error;
L
Linus Torvalds 已提交
3190

3191
	error = user_path_parent(olddfd, oldname, &oldnd, &from);
L
Linus Torvalds 已提交
3192 3193 3194
	if (error)
		goto exit;

3195
	error = user_path_parent(newdfd, newname, &newnd, &to);
L
Linus Torvalds 已提交
3196 3197 3198 3199
	if (error)
		goto exit1;

	error = -EXDEV;
3200
	if (oldnd.path.mnt != newnd.path.mnt)
L
Linus Torvalds 已提交
3201 3202
		goto exit2;

3203
	old_dir = oldnd.path.dentry;
L
Linus Torvalds 已提交
3204 3205 3206 3207
	error = -EBUSY;
	if (oldnd.last_type != LAST_NORM)
		goto exit2;

3208
	new_dir = newnd.path.dentry;
L
Linus Torvalds 已提交
3209 3210 3211
	if (newnd.last_type != LAST_NORM)
		goto exit2;

3212 3213
	oldnd.flags &= ~LOOKUP_PARENT;
	newnd.flags &= ~LOOKUP_PARENT;
3214
	newnd.flags |= LOOKUP_RENAME_TARGET;
3215

L
Linus Torvalds 已提交
3216 3217
	trap = lock_rename(new_dir, old_dir);

3218
	old_dentry = lookup_hash(&oldnd);
L
Linus Torvalds 已提交
3219 3220 3221 3222 3223 3224 3225 3226 3227 3228 3229 3230 3231 3232 3233 3234 3235 3236 3237
	error = PTR_ERR(old_dentry);
	if (IS_ERR(old_dentry))
		goto exit3;
	/* source must exist */
	error = -ENOENT;
	if (!old_dentry->d_inode)
		goto exit4;
	/* unless the source is a directory trailing slashes give -ENOTDIR */
	if (!S_ISDIR(old_dentry->d_inode->i_mode)) {
		error = -ENOTDIR;
		if (oldnd.last.name[oldnd.last.len])
			goto exit4;
		if (newnd.last.name[newnd.last.len])
			goto exit4;
	}
	/* source should not be ancestor of target */
	error = -EINVAL;
	if (old_dentry == trap)
		goto exit4;
3238
	new_dentry = lookup_hash(&newnd);
L
Linus Torvalds 已提交
3239 3240 3241 3242 3243 3244 3245 3246
	error = PTR_ERR(new_dentry);
	if (IS_ERR(new_dentry))
		goto exit4;
	/* target should not be an ancestor of source */
	error = -ENOTEMPTY;
	if (new_dentry == trap)
		goto exit5;

3247 3248 3249
	error = mnt_want_write(oldnd.path.mnt);
	if (error)
		goto exit5;
3250 3251 3252 3253
	error = security_path_rename(&oldnd.path, old_dentry,
				     &newnd.path, new_dentry);
	if (error)
		goto exit6;
L
Linus Torvalds 已提交
3254 3255
	error = vfs_rename(old_dir->d_inode, old_dentry,
				   new_dir->d_inode, new_dentry);
3256
exit6:
3257
	mnt_drop_write(oldnd.path.mnt);
L
Linus Torvalds 已提交
3258 3259 3260 3261 3262 3263 3264
exit5:
	dput(new_dentry);
exit4:
	dput(old_dentry);
exit3:
	unlock_rename(new_dir, old_dir);
exit2:
J
Jan Blunck 已提交
3265
	path_put(&newnd.path);
3266
	putname(to);
L
Linus Torvalds 已提交
3267
exit1:
J
Jan Blunck 已提交
3268
	path_put(&oldnd.path);
L
Linus Torvalds 已提交
3269
	putname(from);
3270
exit:
L
Linus Torvalds 已提交
3271 3272 3273
	return error;
}

3274
SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
3275 3276 3277 3278
{
	return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname);
}

L
Linus Torvalds 已提交
3279 3280 3281 3282 3283 3284 3285 3286 3287 3288 3289 3290 3291 3292 3293 3294 3295 3296 3297 3298 3299 3300 3301 3302 3303
int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
{
	int len;

	len = PTR_ERR(link);
	if (IS_ERR(link))
		goto out;

	len = strlen(link);
	if (len > (unsigned) buflen)
		len = buflen;
	if (copy_to_user(buffer, link, len))
		len = -EFAULT;
out:
	return len;
}

/*
 * A helper for ->readlink().  This should be used *ONLY* for symlinks that
 * have ->follow_link() touching nd only in nd_set_link().  Using (or not
 * using) it for any given inode is up to filesystem.
 */
int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
	struct nameidata nd;
3304
	void *cookie;
3305
	int res;
3306

L
Linus Torvalds 已提交
3307
	nd.depth = 0;
3308
	cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
3309 3310 3311 3312 3313 3314 3315
	if (IS_ERR(cookie))
		return PTR_ERR(cookie);

	res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
	if (dentry->d_inode->i_op->put_link)
		dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
	return res;
L
Linus Torvalds 已提交
3316 3317 3318 3319 3320 3321 3322 3323 3324 3325
}

int vfs_follow_link(struct nameidata *nd, const char *link)
{
	return __vfs_follow_link(nd, link);
}

/* get the link contents into pagecache */
static char *page_getlink(struct dentry * dentry, struct page **ppage)
{
3326 3327
	char *kaddr;
	struct page *page;
L
Linus Torvalds 已提交
3328
	struct address_space *mapping = dentry->d_inode->i_mapping;
3329
	page = read_mapping_page(mapping, 0, NULL);
L
Linus Torvalds 已提交
3330
	if (IS_ERR(page))
3331
		return (char*)page;
L
Linus Torvalds 已提交
3332
	*ppage = page;
3333 3334 3335
	kaddr = kmap(page);
	nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1);
	return kaddr;
L
Linus Torvalds 已提交
3336 3337 3338 3339 3340 3341 3342 3343 3344 3345 3346 3347 3348 3349
}

int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
	struct page *page = NULL;
	char *s = page_getlink(dentry, &page);
	int res = vfs_readlink(dentry,buffer,buflen,s);
	if (page) {
		kunmap(page);
		page_cache_release(page);
	}
	return res;
}

3350
void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
L
Linus Torvalds 已提交
3351
{
3352
	struct page *page = NULL;
L
Linus Torvalds 已提交
3353
	nd_set_link(nd, page_getlink(dentry, &page));
3354
	return page;
L
Linus Torvalds 已提交
3355 3356
}

3357
void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
L
Linus Torvalds 已提交
3358
{
3359 3360 3361
	struct page *page = cookie;

	if (page) {
L
Linus Torvalds 已提交
3362 3363 3364 3365 3366
		kunmap(page);
		page_cache_release(page);
	}
}

3367 3368 3369 3370
/*
 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
 */
int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
L
Linus Torvalds 已提交
3371 3372
{
	struct address_space *mapping = inode->i_mapping;
3373
	struct page *page;
3374
	void *fsdata;
3375
	int err;
L
Linus Torvalds 已提交
3376
	char *kaddr;
3377 3378 3379
	unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
	if (nofs)
		flags |= AOP_FLAG_NOFS;
L
Linus Torvalds 已提交
3380

3381
retry:
3382
	err = pagecache_write_begin(NULL, mapping, 0, len-1,
3383
				flags, &page, &fsdata);
L
Linus Torvalds 已提交
3384
	if (err)
3385 3386
		goto fail;

L
Linus Torvalds 已提交
3387 3388 3389
	kaddr = kmap_atomic(page, KM_USER0);
	memcpy(kaddr, symname, len-1);
	kunmap_atomic(kaddr, KM_USER0);
3390 3391 3392

	err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
							page, fsdata);
L
Linus Torvalds 已提交
3393 3394
	if (err < 0)
		goto fail;
3395 3396 3397
	if (err < len-1)
		goto retry;

L
Linus Torvalds 已提交
3398 3399 3400 3401 3402 3403
	mark_inode_dirty(inode);
	return 0;
fail:
	return err;
}

3404 3405 3406
int page_symlink(struct inode *inode, const char *symname, int len)
{
	return __page_symlink(inode, symname, len,
3407
			!(mapping_gfp_mask(inode->i_mapping) & __GFP_FS));
3408 3409
}

3410
const struct inode_operations page_symlink_inode_operations = {
L
Linus Torvalds 已提交
3411 3412 3413 3414 3415
	.readlink	= generic_readlink,
	.follow_link	= page_follow_link_light,
	.put_link	= page_put_link,
};

3416
EXPORT_SYMBOL(user_path_at);
3417
EXPORT_SYMBOL(follow_down_one);
L
Linus Torvalds 已提交
3418 3419 3420 3421 3422 3423 3424 3425 3426
EXPORT_SYMBOL(follow_down);
EXPORT_SYMBOL(follow_up);
EXPORT_SYMBOL(get_write_access); /* binfmt_aout */
EXPORT_SYMBOL(getname);
EXPORT_SYMBOL(lock_rename);
EXPORT_SYMBOL(lookup_one_len);
EXPORT_SYMBOL(page_follow_link_light);
EXPORT_SYMBOL(page_put_link);
EXPORT_SYMBOL(page_readlink);
3427
EXPORT_SYMBOL(__page_symlink);
L
Linus Torvalds 已提交
3428 3429
EXPORT_SYMBOL(page_symlink);
EXPORT_SYMBOL(page_symlink_inode_operations);
A
Al Viro 已提交
3430
EXPORT_SYMBOL(kern_path_parent);
A
Al Viro 已提交
3431
EXPORT_SYMBOL(kern_path);
3432
EXPORT_SYMBOL(vfs_path_lookup);
3433
EXPORT_SYMBOL(inode_permission);
3434
EXPORT_SYMBOL(file_permission);
L
Linus Torvalds 已提交
3435 3436 3437 3438 3439 3440 3441 3442 3443 3444 3445 3446 3447 3448
EXPORT_SYMBOL(unlock_rename);
EXPORT_SYMBOL(vfs_create);
EXPORT_SYMBOL(vfs_follow_link);
EXPORT_SYMBOL(vfs_link);
EXPORT_SYMBOL(vfs_mkdir);
EXPORT_SYMBOL(vfs_mknod);
EXPORT_SYMBOL(generic_permission);
EXPORT_SYMBOL(vfs_readlink);
EXPORT_SYMBOL(vfs_rename);
EXPORT_SYMBOL(vfs_rmdir);
EXPORT_SYMBOL(vfs_symlink);
EXPORT_SYMBOL(vfs_unlink);
EXPORT_SYMBOL(dentry_unhash);
EXPORT_SYMBOL(generic_readlink);