namei.c 70.0 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
/*
 *  linux/fs/namei.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

/*
 * Some corrections by tytso.
 */

/* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
 * lookup logic.
 */
/* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
 */

#include <linux/init.h>
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/fs.h>
#include <linux/namei.h>
#include <linux/quotaops.h>
#include <linux/pagemap.h>
R
Robert Love 已提交
24
#include <linux/fsnotify.h>
L
Linus Torvalds 已提交
25 26 27 28 29
#include <linux/personality.h>
#include <linux/security.h>
#include <linux/syscalls.h>
#include <linux/mount.h>
#include <linux/audit.h>
30
#include <linux/capability.h>
31
#include <linux/file.h>
32
#include <linux/fcntl.h>
33
#include <linux/device_cgroup.h>
L
Linus Torvalds 已提交
34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104
#include <asm/uaccess.h>

#define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])

/* [Feb-1997 T. Schoebel-Theuer]
 * Fundamental changes in the pathname lookup mechanisms (namei)
 * were necessary because of omirr.  The reason is that omirr needs
 * to know the _real_ pathname, not the user-supplied one, in case
 * of symlinks (and also when transname replacements occur).
 *
 * The new code replaces the old recursive symlink resolution with
 * an iterative one (in case of non-nested symlink chains).  It does
 * this with calls to <fs>_follow_link().
 * As a side effect, dir_namei(), _namei() and follow_link() are now 
 * replaced with a single function lookup_dentry() that can handle all 
 * the special cases of the former code.
 *
 * With the new dcache, the pathname is stored at each inode, at least as
 * long as the refcount of the inode is positive.  As a side effect, the
 * size of the dcache depends on the inode cache and thus is dynamic.
 *
 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
 * resolution to correspond with current state of the code.
 *
 * Note that the symlink resolution is not *completely* iterative.
 * There is still a significant amount of tail- and mid- recursion in
 * the algorithm.  Also, note that <fs>_readlink() is not used in
 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
 * may return different results than <fs>_follow_link().  Many virtual
 * filesystems (including /proc) exhibit this behavior.
 */

/* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
 * and the name already exists in form of a symlink, try to create the new
 * name indicated by the symlink. The old code always complained that the
 * name already exists, due to not following the symlink even if its target
 * is nonexistent.  The new semantics affects also mknod() and link() when
 * the name is a symlink pointing to a non-existant name.
 *
 * I don't know which semantics is the right one, since I have no access
 * to standards. But I found by trial that HP-UX 9.0 has the full "new"
 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
 * "old" one. Personally, I think the new semantics is much more logical.
 * Note that "ln old new" where "new" is a symlink pointing to a non-existing
 * file does succeed in both HP-UX and SunOs, but not in Solaris
 * and in the old Linux semantics.
 */

/* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
 * semantics.  See the comments in "open_namei" and "do_link" below.
 *
 * [10-Sep-98 Alan Modra] Another symlink change.
 */

/* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
 *	inside the path - always follow.
 *	in the last component in creation/removal/renaming - never follow.
 *	if LOOKUP_FOLLOW passed - follow.
 *	if the pathname has trailing slashes - follow.
 *	otherwise - don't follow.
 * (applied in that order).
 *
 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
 * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
 * During the 2.4 we need to fix the userland stuff depending on it -
 * hopefully we will be able to get rid of that wart in 2.5. So far only
 * XEmacs seems to be relying on it...
 */
/*
 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
105
 * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
L
Linus Torvalds 已提交
106 107 108
 * any extra contention...
 */

109
static int __link_path_walk(const char *name, struct nameidata *nd);
110

L
Linus Torvalds 已提交
111 112 113 114 115 116 117
/* In order to reduce some races, while at the same time doing additional
 * checking and hopefully speeding things up, we copy filenames to the
 * kernel data space before using them..
 *
 * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
 * PATH_MAX includes the nul terminator --RR.
 */
118
static int do_getname(const char __user *filename, char *page)
L
Linus Torvalds 已提交
119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161
{
	int retval;
	unsigned long len = PATH_MAX;

	if (!segment_eq(get_fs(), KERNEL_DS)) {
		if ((unsigned long) filename >= TASK_SIZE)
			return -EFAULT;
		if (TASK_SIZE - (unsigned long) filename < PATH_MAX)
			len = TASK_SIZE - (unsigned long) filename;
	}

	retval = strncpy_from_user(page, filename, len);
	if (retval > 0) {
		if (retval < len)
			return 0;
		return -ENAMETOOLONG;
	} else if (!retval)
		retval = -ENOENT;
	return retval;
}

char * getname(const char __user * filename)
{
	char *tmp, *result;

	result = ERR_PTR(-ENOMEM);
	tmp = __getname();
	if (tmp)  {
		int retval = do_getname(filename, tmp);

		result = tmp;
		if (retval < 0) {
			__putname(tmp);
			result = ERR_PTR(retval);
		}
	}
	audit_getname(result);
	return result;
}

#ifdef CONFIG_AUDITSYSCALL
void putname(const char *name)
{
162
	if (unlikely(!audit_dummy_context()))
L
Linus Torvalds 已提交
163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186
		audit_putname(name);
	else
		__putname(name);
}
EXPORT_SYMBOL(putname);
#endif


/**
 * generic_permission  -  check for access rights on a Posix-like filesystem
 * @inode:	inode to check access rights for
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 * @check_acl:	optional callback to check for Posix ACLs
 *
 * Used to check for read/write/execute permissions on a file.
 * We use "fsuid" for this, letting us set arbitrary permissions
 * for filesystem access without changing the "normal" uids which
 * are used for other things..
 */
int generic_permission(struct inode *inode, int mask,
		int (*check_acl)(struct inode *inode, int mask))
{
	umode_t			mode = inode->i_mode;

187 188
	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;

189
	if (current_fsuid() == inode->i_uid)
L
Linus Torvalds 已提交
190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206
		mode >>= 6;
	else {
		if (IS_POSIXACL(inode) && (mode & S_IRWXG) && check_acl) {
			int error = check_acl(inode, mask);
			if (error == -EACCES)
				goto check_capabilities;
			else if (error != -EAGAIN)
				return error;
		}

		if (in_group_p(inode->i_gid))
			mode >>= 3;
	}

	/*
	 * If the DACs are ok we don't need any capability check.
	 */
207
	if ((mask & ~mode) == 0)
L
Linus Torvalds 已提交
208 209 210 211 212 213 214
		return 0;

 check_capabilities:
	/*
	 * Read/write DACs are always overridable.
	 * Executable DACs are overridable if at least one exec bit is set.
	 */
215
	if (!(mask & MAY_EXEC) || execute_ok(inode))
L
Linus Torvalds 已提交
216 217 218 219 220 221 222 223 224 225 226 227 228
		if (capable(CAP_DAC_OVERRIDE))
			return 0;

	/*
	 * Searching includes executable on directories, else just read.
	 */
	if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
		if (capable(CAP_DAC_READ_SEARCH))
			return 0;

	return -EACCES;
}

C
Christoph Hellwig 已提交
229 230 231 232 233 234 235 236 237 238
/**
 * inode_permission  -  check for access rights to a given inode
 * @inode:	inode to check permission on
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Used to check for read/write/execute permissions on an inode.
 * We use "fsuid" for this, letting us set arbitrary permissions
 * for filesystem access without changing the "normal" uids which
 * are used for other things.
 */
239
int inode_permission(struct inode *inode, int mask)
L
Linus Torvalds 已提交
240
{
241
	int retval;
L
Linus Torvalds 已提交
242 243

	if (mask & MAY_WRITE) {
244
		umode_t mode = inode->i_mode;
L
Linus Torvalds 已提交
245 246 247 248 249 250 251 252 253 254 255 256 257 258 259

		/*
		 * Nobody gets write access to a read-only fs.
		 */
		if (IS_RDONLY(inode) &&
		    (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
			return -EROFS;

		/*
		 * Nobody gets write access to an immutable file.
		 */
		if (IS_IMMUTABLE(inode))
			return -EACCES;
	}

A
Al Viro 已提交
260
	if (inode->i_op->permission)
261
		retval = inode->i_op->permission(inode, mask);
262
	else
263
		retval = generic_permission(inode, mask, NULL);
264

L
Linus Torvalds 已提交
265 266 267
	if (retval)
		return retval;

268 269 270 271
	retval = devcgroup_inode_permission(inode, mask);
	if (retval)
		return retval;

272
	return security_inode_permission(inode,
273
			mask & (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND));
L
Linus Torvalds 已提交
274 275
}

276 277 278 279 280 281 282 283 284 285
/**
 * file_permission  -  check for additional access rights to a given file
 * @file:	file to check access rights for
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Used to check for read/write/execute permissions on an already opened
 * file.
 *
 * Note:
 *	Do not use this function in new code.  All access checks should
C
Christoph Hellwig 已提交
286
 *	be done using inode_permission().
287 288 289
 */
int file_permission(struct file *file, int mask)
{
290
	return inode_permission(file->f_path.dentry->d_inode, mask);
291 292
}

L
Linus Torvalds 已提交
293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325
/*
 * get_write_access() gets write permission for a file.
 * put_write_access() releases this write permission.
 * This is used for regular files.
 * We cannot support write (and maybe mmap read-write shared) accesses and
 * MAP_DENYWRITE mmappings simultaneously. The i_writecount field of an inode
 * can have the following values:
 * 0: no writers, no VM_DENYWRITE mappings
 * < 0: (-i_writecount) vm_area_structs with VM_DENYWRITE set exist
 * > 0: (i_writecount) users are writing to the file.
 *
 * Normally we operate on that counter with atomic_{inc,dec} and it's safe
 * except for the cases where we don't hold i_writecount yet. Then we need to
 * use {get,deny}_write_access() - these functions check the sign and refuse
 * to do the change if sign is wrong. Exclusion between them is provided by
 * the inode->i_lock spinlock.
 */

int get_write_access(struct inode * inode)
{
	spin_lock(&inode->i_lock);
	if (atomic_read(&inode->i_writecount) < 0) {
		spin_unlock(&inode->i_lock);
		return -ETXTBSY;
	}
	atomic_inc(&inode->i_writecount);
	spin_unlock(&inode->i_lock);

	return 0;
}

int deny_write_access(struct file * file)
{
326
	struct inode *inode = file->f_path.dentry->d_inode;
L
Linus Torvalds 已提交
327 328 329 330 331 332 333 334 335 336 337 338

	spin_lock(&inode->i_lock);
	if (atomic_read(&inode->i_writecount) > 0) {
		spin_unlock(&inode->i_lock);
		return -ETXTBSY;
	}
	atomic_dec(&inode->i_writecount);
	spin_unlock(&inode->i_lock);

	return 0;
}

J
Jan Blunck 已提交
339 340 341 342 343 344 345 346 347 348 349 350 351
/**
 * path_get - get a reference to a path
 * @path: path to get the reference to
 *
 * Given a path increment the reference count to the dentry and the vfsmount.
 */
void path_get(struct path *path)
{
	mntget(path->mnt);
	dget(path->dentry);
}
EXPORT_SYMBOL(path_get);

J
Jan Blunck 已提交
352 353 354 355 356 357 358
/**
 * path_put - put a reference to a path
 * @path: path to put the reference to
 *
 * Given a path decrement the reference count to the dentry and the vfsmount.
 */
void path_put(struct path *path)
L
Linus Torvalds 已提交
359
{
J
Jan Blunck 已提交
360 361
	dput(path->dentry);
	mntput(path->mnt);
L
Linus Torvalds 已提交
362
}
J
Jan Blunck 已提交
363
EXPORT_SYMBOL(path_put);
L
Linus Torvalds 已提交
364

365 366 367 368 369 370
/**
 * release_open_intent - free up open intent resources
 * @nd: pointer to nameidata
 */
void release_open_intent(struct nameidata *nd)
{
371
	if (nd->intent.open.file->f_path.dentry == NULL)
372 373 374 375 376
		put_filp(nd->intent.open.file);
	else
		fput(nd->intent.open.file);
}

377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400
static inline struct dentry *
do_revalidate(struct dentry *dentry, struct nameidata *nd)
{
	int status = dentry->d_op->d_revalidate(dentry, nd);
	if (unlikely(status <= 0)) {
		/*
		 * The dentry failed validation.
		 * If d_revalidate returned 0 attempt to invalidate
		 * the dentry otherwise d_revalidate is asking us
		 * to return a fail status.
		 */
		if (!status) {
			if (!d_invalidate(dentry)) {
				dput(dentry);
				dentry = NULL;
			}
		} else {
			dput(dentry);
			dentry = ERR_PTR(status);
		}
	}
	return dentry;
}

L
Linus Torvalds 已提交
401 402 403 404 405 406 407 408 409 410 411 412 413 414
/*
 * Internal lookup() using the new generic dcache.
 * SMP-safe
 */
static struct dentry * cached_lookup(struct dentry * parent, struct qstr * name, struct nameidata *nd)
{
	struct dentry * dentry = __d_lookup(parent, name);

	/* lockess __d_lookup may fail due to concurrent d_move() 
	 * in some unrelated directory, so try with d_lookup
	 */
	if (!dentry)
		dentry = d_lookup(parent, name);

415 416 417
	if (dentry && dentry->d_op && dentry->d_op->d_revalidate)
		dentry = do_revalidate(dentry, nd);

L
Linus Torvalds 已提交
418 419 420 421 422 423 424 425 426 427 428 429 430
	return dentry;
}

/*
 * Short-cut version of permission(), for calling by
 * path_walk(), when dcache lock is held.  Combines parts
 * of permission() and generic_permission(), and tests ONLY for
 * MAY_EXEC permission.
 *
 * If appropriate, check DAC only.  If not appropriate, or
 * short-cut DAC fails, then call permission() to do more
 * complete permission check.
 */
431
static int exec_permission_lite(struct inode *inode)
L
Linus Torvalds 已提交
432 433 434
{
	umode_t	mode = inode->i_mode;

A
Al Viro 已提交
435
	if (inode->i_op->permission)
L
Linus Torvalds 已提交
436 437
		return -EAGAIN;

438
	if (current_fsuid() == inode->i_uid)
L
Linus Torvalds 已提交
439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456
		mode >>= 6;
	else if (in_group_p(inode->i_gid))
		mode >>= 3;

	if (mode & MAY_EXEC)
		goto ok;

	if ((inode->i_mode & S_IXUGO) && capable(CAP_DAC_OVERRIDE))
		goto ok;

	if (S_ISDIR(inode->i_mode) && capable(CAP_DAC_OVERRIDE))
		goto ok;

	if (S_ISDIR(inode->i_mode) && capable(CAP_DAC_READ_SEARCH))
		goto ok;

	return -EACCES;
ok:
457
	return security_inode_permission(inode, MAY_EXEC);
L
Linus Torvalds 已提交
458 459 460 461 462 463 464 465 466 467 468 469 470 471 472
}

/*
 * This is called when everything else fails, and we actually have
 * to go to the low-level filesystem to find out what we should do..
 *
 * We get the directory semaphore, and after getting that we also
 * make sure that nobody added the entry to the dcache in the meantime..
 * SMP-safe
 */
static struct dentry * real_lookup(struct dentry * parent, struct qstr * name, struct nameidata *nd)
{
	struct dentry * result;
	struct inode *dir = parent->d_inode;

473
	mutex_lock(&dir->i_mutex);
L
Linus Torvalds 已提交
474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489
	/*
	 * First re-do the cached lookup just in case it was created
	 * while we waited for the directory semaphore..
	 *
	 * FIXME! This could use version numbering or similar to
	 * avoid unnecessary cache lookups.
	 *
	 * The "dcache_lock" is purely to protect the RCU list walker
	 * from concurrent renames at this point (we mustn't get false
	 * negatives from the RCU list walk here, unlike the optimistic
	 * fast walk).
	 *
	 * so doing d_lookup() (with seqlock), instead of lockfree __d_lookup
	 */
	result = d_lookup(parent, name);
	if (!result) {
490 491 492 493 494 495 496 497
		struct dentry *dentry;

		/* Don't create child dentry for a dead directory. */
		result = ERR_PTR(-ENOENT);
		if (IS_DEADDIR(dir))
			goto out_unlock;

		dentry = d_alloc(parent, name);
L
Linus Torvalds 已提交
498 499 500 501 502 503 504 505
		result = ERR_PTR(-ENOMEM);
		if (dentry) {
			result = dir->i_op->lookup(dir, dentry, nd);
			if (result)
				dput(dentry);
			else
				result = dentry;
		}
506
out_unlock:
507
		mutex_unlock(&dir->i_mutex);
L
Linus Torvalds 已提交
508 509 510 511 512 513 514
		return result;
	}

	/*
	 * Uhhuh! Nasty case: the cache was re-populated while
	 * we waited on the semaphore. Need to revalidate.
	 */
515
	mutex_unlock(&dir->i_mutex);
L
Linus Torvalds 已提交
516
	if (result->d_op && result->d_op->d_revalidate) {
517 518
		result = do_revalidate(result, nd);
		if (!result)
L
Linus Torvalds 已提交
519 520 521 522 523
			result = ERR_PTR(-ENOENT);
	}
	return result;
}

524 525 526 527 528 529 530 531 532 533 534 535 536
/*
 * Wrapper to retry pathname resolution whenever the underlying
 * file system returns an ESTALE.
 *
 * Retry the whole path once, forcing real lookup requests
 * instead of relying on the dcache.
 */
static __always_inline int link_path_walk(const char *name, struct nameidata *nd)
{
	struct path save = nd->path;
	int result;

	/* make sure the stuff we saved doesn't go away */
537
	path_get(&save);
538 539 540 541 542

	result = __link_path_walk(name, nd);
	if (result == -ESTALE) {
		/* nd->path had been dropped */
		nd->path = save;
543
		path_get(&nd->path);
544 545 546 547 548 549 550 551 552
		nd->flags |= LOOKUP_REVAL;
		result = __link_path_walk(name, nd);
	}

	path_put(&save);

	return result;
}

553
static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
L
Linus Torvalds 已提交
554 555 556 557 558 559 560
{
	int res = 0;
	char *name;
	if (IS_ERR(link))
		goto fail;

	if (*link == '/') {
C
Christoph Hellwig 已提交
561 562
		struct fs_struct *fs = current->fs;

J
Jan Blunck 已提交
563
		path_put(&nd->path);
C
Christoph Hellwig 已提交
564 565 566 567 568

		read_lock(&fs->lock);
		nd->path = fs->root;
		path_get(&fs->root);
		read_unlock(&fs->lock);
L
Linus Torvalds 已提交
569
	}
C
Christoph Hellwig 已提交
570

L
Linus Torvalds 已提交
571 572 573 574 575 576 577 578 579 580
	res = link_path_walk(link, nd);
	if (nd->depth || res || nd->last_type!=LAST_NORM)
		return res;
	/*
	 * If it is an iterative symlinks resolution in open_namei() we
	 * have to copy the last component. And all that crap because of
	 * bloody create() on broken symlinks. Furrfu...
	 */
	name = __getname();
	if (unlikely(!name)) {
J
Jan Blunck 已提交
581
		path_put(&nd->path);
L
Linus Torvalds 已提交
582 583 584 585 586 587
		return -ENOMEM;
	}
	strcpy(name, nd->last.name);
	nd->last.name = name;
	return 0;
fail:
J
Jan Blunck 已提交
588
	path_put(&nd->path);
L
Linus Torvalds 已提交
589 590 591
	return PTR_ERR(link);
}

J
Jan Blunck 已提交
592
static void path_put_conditional(struct path *path, struct nameidata *nd)
593 594
{
	dput(path->dentry);
595
	if (path->mnt != nd->path.mnt)
596 597 598 599 600
		mntput(path->mnt);
}

static inline void path_to_nameidata(struct path *path, struct nameidata *nd)
{
601 602 603 604 605
	dput(nd->path.dentry);
	if (nd->path.mnt != path->mnt)
		mntput(nd->path.mnt);
	nd->path.mnt = path->mnt;
	nd->path.dentry = path->dentry;
606 607
}

608
static __always_inline int __do_follow_link(struct path *path, struct nameidata *nd)
L
Linus Torvalds 已提交
609 610
{
	int error;
611
	void *cookie;
A
Al Viro 已提交
612
	struct dentry *dentry = path->dentry;
L
Linus Torvalds 已提交
613

A
Al Viro 已提交
614
	touch_atime(path->mnt, dentry);
L
Linus Torvalds 已提交
615
	nd_set_link(nd, NULL);
A
Al Viro 已提交
616

617
	if (path->mnt != nd->path.mnt) {
618 619 620 621
		path_to_nameidata(path, nd);
		dget(dentry);
	}
	mntget(path->mnt);
622 623 624
	cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
	error = PTR_ERR(cookie);
	if (!IS_ERR(cookie)) {
L
Linus Torvalds 已提交
625
		char *s = nd_get_link(nd);
626
		error = 0;
L
Linus Torvalds 已提交
627 628 629
		if (s)
			error = __vfs_follow_link(nd, s);
		if (dentry->d_inode->i_op->put_link)
630
			dentry->d_inode->i_op->put_link(dentry, nd, cookie);
L
Linus Torvalds 已提交
631
	}
632
	path_put(path);
L
Linus Torvalds 已提交
633 634 635 636 637 638 639 640 641 642 643

	return error;
}

/*
 * This limits recursive symlink follows to 8, while
 * limiting consecutive symlinks to 40.
 *
 * Without that kind of total limit, nasty chains of consecutive
 * symlinks can cause almost arbitrarily long lookups. 
 */
A
Al Viro 已提交
644
static inline int do_follow_link(struct path *path, struct nameidata *nd)
L
Linus Torvalds 已提交
645 646 647 648 649 650 651 652
{
	int err = -ELOOP;
	if (current->link_count >= MAX_NESTED_LINKS)
		goto loop;
	if (current->total_link_count >= 40)
		goto loop;
	BUG_ON(nd->depth >= MAX_NESTED_LINKS);
	cond_resched();
A
Al Viro 已提交
653
	err = security_inode_follow_link(path->dentry, nd);
L
Linus Torvalds 已提交
654 655 656 657 658
	if (err)
		goto loop;
	current->link_count++;
	current->total_link_count++;
	nd->depth++;
A
Al Viro 已提交
659
	err = __do_follow_link(path, nd);
A
Al Viro 已提交
660 661
	current->link_count--;
	nd->depth--;
L
Linus Torvalds 已提交
662 663
	return err;
loop:
J
Jan Blunck 已提交
664 665
	path_put_conditional(path, nd);
	path_put(&nd->path);
L
Linus Torvalds 已提交
666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691
	return err;
}

int follow_up(struct vfsmount **mnt, struct dentry **dentry)
{
	struct vfsmount *parent;
	struct dentry *mountpoint;
	spin_lock(&vfsmount_lock);
	parent=(*mnt)->mnt_parent;
	if (parent == *mnt) {
		spin_unlock(&vfsmount_lock);
		return 0;
	}
	mntget(parent);
	mountpoint=dget((*mnt)->mnt_mountpoint);
	spin_unlock(&vfsmount_lock);
	dput(*dentry);
	*dentry = mountpoint;
	mntput(*mnt);
	*mnt = parent;
	return 1;
}

/* no need for dcache_lock, as serialization is taken care in
 * namespace.c
 */
A
Al Viro 已提交
692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708
static int __follow_mount(struct path *path)
{
	int res = 0;
	while (d_mountpoint(path->dentry)) {
		struct vfsmount *mounted = lookup_mnt(path->mnt, path->dentry);
		if (!mounted)
			break;
		dput(path->dentry);
		if (res)
			mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
		res = 1;
	}
	return res;
}

A
Al Viro 已提交
709
static void follow_mount(struct vfsmount **mnt, struct dentry **dentry)
L
Linus Torvalds 已提交
710 711 712 713 714
{
	while (d_mountpoint(*dentry)) {
		struct vfsmount *mounted = lookup_mnt(*mnt, *dentry);
		if (!mounted)
			break;
A
Al Viro 已提交
715
		dput(*dentry);
L
Linus Torvalds 已提交
716 717 718 719 720 721 722 723 724
		mntput(*mnt);
		*mnt = mounted;
		*dentry = dget(mounted->mnt_root);
	}
}

/* no need for dcache_lock, as serialization is taken care in
 * namespace.c
 */
A
Al Viro 已提交
725
int follow_down(struct vfsmount **mnt, struct dentry **dentry)
L
Linus Torvalds 已提交
726 727 728 729 730
{
	struct vfsmount *mounted;

	mounted = lookup_mnt(*mnt, *dentry);
	if (mounted) {
A
Al Viro 已提交
731
		dput(*dentry);
L
Linus Torvalds 已提交
732 733 734 735 736 737 738 739
		mntput(*mnt);
		*mnt = mounted;
		*dentry = dget(mounted->mnt_root);
		return 1;
	}
	return 0;
}

740
static __always_inline void follow_dotdot(struct nameidata *nd)
L
Linus Torvalds 已提交
741
{
742 743
	struct fs_struct *fs = current->fs;

L
Linus Torvalds 已提交
744 745
	while(1) {
		struct vfsmount *parent;
746
		struct dentry *old = nd->path.dentry;
L
Linus Torvalds 已提交
747

748
                read_lock(&fs->lock);
J
Jan Blunck 已提交
749 750
		if (nd->path.dentry == fs->root.dentry &&
		    nd->path.mnt == fs->root.mnt) {
751
                        read_unlock(&fs->lock);
L
Linus Torvalds 已提交
752 753
			break;
		}
754
                read_unlock(&fs->lock);
L
Linus Torvalds 已提交
755
		spin_lock(&dcache_lock);
756 757
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
			nd->path.dentry = dget(nd->path.dentry->d_parent);
L
Linus Torvalds 已提交
758 759 760 761 762 763
			spin_unlock(&dcache_lock);
			dput(old);
			break;
		}
		spin_unlock(&dcache_lock);
		spin_lock(&vfsmount_lock);
764 765
		parent = nd->path.mnt->mnt_parent;
		if (parent == nd->path.mnt) {
L
Linus Torvalds 已提交
766 767 768 769
			spin_unlock(&vfsmount_lock);
			break;
		}
		mntget(parent);
770
		nd->path.dentry = dget(nd->path.mnt->mnt_mountpoint);
L
Linus Torvalds 已提交
771 772
		spin_unlock(&vfsmount_lock);
		dput(old);
773 774
		mntput(nd->path.mnt);
		nd->path.mnt = parent;
L
Linus Torvalds 已提交
775
	}
776
	follow_mount(&nd->path.mnt, &nd->path.dentry);
L
Linus Torvalds 已提交
777 778 779 780 781 782 783 784 785 786
}

/*
 *  It's more convoluted than I'd like it to be, but... it's still fairly
 *  small and for now I'd prefer to have fast path as straight as possible.
 *  It _is_ time-critical.
 */
static int do_lookup(struct nameidata *nd, struct qstr *name,
		     struct path *path)
{
787 788
	struct vfsmount *mnt = nd->path.mnt;
	struct dentry *dentry = __d_lookup(nd->path.dentry, name);
L
Linus Torvalds 已提交
789 790 791 792 793 794 795 796

	if (!dentry)
		goto need_lookup;
	if (dentry->d_op && dentry->d_op->d_revalidate)
		goto need_revalidate;
done:
	path->mnt = mnt;
	path->dentry = dentry;
A
Al Viro 已提交
797
	__follow_mount(path);
L
Linus Torvalds 已提交
798 799 800
	return 0;

need_lookup:
801
	dentry = real_lookup(nd->path.dentry, name, nd);
L
Linus Torvalds 已提交
802 803 804 805 806
	if (IS_ERR(dentry))
		goto fail;
	goto done;

need_revalidate:
807 808 809 810 811 812
	dentry = do_revalidate(dentry, nd);
	if (!dentry)
		goto need_lookup;
	if (IS_ERR(dentry))
		goto fail;
	goto done;
L
Linus Torvalds 已提交
813 814 815 816 817 818 819

fail:
	return PTR_ERR(dentry);
}

/*
 * Name resolution.
820 821
 * This is the basic name resolution function, turning a pathname into
 * the final dentry. We expect 'base' to be positive and a directory.
L
Linus Torvalds 已提交
822
 *
823 824
 * Returns 0 and nd will have valid dentry and mnt on success.
 * Returns error and drops reference to input namei data on failure.
L
Linus Torvalds 已提交
825
 */
826
static int __link_path_walk(const char *name, struct nameidata *nd)
L
Linus Torvalds 已提交
827 828 829 830 831 832 833 834 835 836 837
{
	struct path next;
	struct inode *inode;
	int err;
	unsigned int lookup_flags = nd->flags;
	
	while (*name=='/')
		name++;
	if (!*name)
		goto return_reval;

838
	inode = nd->path.dentry->d_inode;
L
Linus Torvalds 已提交
839
	if (nd->depth)
840
		lookup_flags = LOOKUP_FOLLOW | (nd->flags & LOOKUP_CONTINUE);
L
Linus Torvalds 已提交
841 842 843 844 845 846 847

	/* At this point we know we have a real path component. */
	for(;;) {
		unsigned long hash;
		struct qstr this;
		unsigned int c;

848
		nd->flags |= LOOKUP_CONTINUE;
849
		err = exec_permission_lite(inode);
850
		if (err == -EAGAIN)
C
Christoph Hellwig 已提交
851 852
			err = inode_permission(nd->path.dentry->d_inode,
					       MAY_EXEC);
L
Linus Torvalds 已提交
853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885
 		if (err)
			break;

		this.name = name;
		c = *(const unsigned char *)name;

		hash = init_name_hash();
		do {
			name++;
			hash = partial_name_hash(c, hash);
			c = *(const unsigned char *)name;
		} while (c && (c != '/'));
		this.len = name - (const char *) this.name;
		this.hash = end_name_hash(hash);

		/* remove trailing slashes? */
		if (!c)
			goto last_component;
		while (*++name == '/');
		if (!*name)
			goto last_with_slashes;

		/*
		 * "." and ".." are special - ".." especially so because it has
		 * to be able to know about the current root directory and
		 * parent relationships.
		 */
		if (this.name[0] == '.') switch (this.len) {
			default:
				break;
			case 2:	
				if (this.name[1] != '.')
					break;
A
Al Viro 已提交
886
				follow_dotdot(nd);
887
				inode = nd->path.dentry->d_inode;
L
Linus Torvalds 已提交
888 889 890 891 892 893 894 895
				/* fallthrough */
			case 1:
				continue;
		}
		/*
		 * See if the low-level filesystem might want
		 * to use its own hash..
		 */
896 897 898
		if (nd->path.dentry->d_op && nd->path.dentry->d_op->d_hash) {
			err = nd->path.dentry->d_op->d_hash(nd->path.dentry,
							    &this);
L
Linus Torvalds 已提交
899 900 901 902 903 904 905 906 907 908 909 910 911 912
			if (err < 0)
				break;
		}
		/* This does the actual lookups.. */
		err = do_lookup(nd, &this, &next);
		if (err)
			break;

		err = -ENOENT;
		inode = next.dentry->d_inode;
		if (!inode)
			goto out_dput;

		if (inode->i_op->follow_link) {
A
Al Viro 已提交
913
			err = do_follow_link(&next, nd);
L
Linus Torvalds 已提交
914 915 916
			if (err)
				goto return_err;
			err = -ENOENT;
917
			inode = nd->path.dentry->d_inode;
L
Linus Torvalds 已提交
918 919
			if (!inode)
				break;
M
Miklos Szeredi 已提交
920 921
		} else
			path_to_nameidata(&next, nd);
L
Linus Torvalds 已提交
922 923 924 925 926 927 928 929 930
		err = -ENOTDIR; 
		if (!inode->i_op->lookup)
			break;
		continue;
		/* here ends the main loop */

last_with_slashes:
		lookup_flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
last_component:
931 932
		/* Clear LOOKUP_CONTINUE iff it was previously unset */
		nd->flags &= lookup_flags | ~LOOKUP_CONTINUE;
L
Linus Torvalds 已提交
933 934 935 936 937 938 939 940
		if (lookup_flags & LOOKUP_PARENT)
			goto lookup_parent;
		if (this.name[0] == '.') switch (this.len) {
			default:
				break;
			case 2:	
				if (this.name[1] != '.')
					break;
A
Al Viro 已提交
941
				follow_dotdot(nd);
942
				inode = nd->path.dentry->d_inode;
L
Linus Torvalds 已提交
943 944 945 946
				/* fallthrough */
			case 1:
				goto return_reval;
		}
947 948 949
		if (nd->path.dentry->d_op && nd->path.dentry->d_op->d_hash) {
			err = nd->path.dentry->d_op->d_hash(nd->path.dentry,
							    &this);
L
Linus Torvalds 已提交
950 951 952 953 954 955 956 957
			if (err < 0)
				break;
		}
		err = do_lookup(nd, &this, &next);
		if (err)
			break;
		inode = next.dentry->d_inode;
		if ((lookup_flags & LOOKUP_FOLLOW)
A
Al Viro 已提交
958
		    && inode && inode->i_op->follow_link) {
A
Al Viro 已提交
959
			err = do_follow_link(&next, nd);
L
Linus Torvalds 已提交
960 961
			if (err)
				goto return_err;
962
			inode = nd->path.dentry->d_inode;
M
Miklos Szeredi 已提交
963 964
		} else
			path_to_nameidata(&next, nd);
L
Linus Torvalds 已提交
965 966 967 968 969
		err = -ENOENT;
		if (!inode)
			break;
		if (lookup_flags & LOOKUP_DIRECTORY) {
			err = -ENOTDIR; 
A
Al Viro 已提交
970
			if (!inode->i_op->lookup)
L
Linus Torvalds 已提交
971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989
				break;
		}
		goto return_base;
lookup_parent:
		nd->last = this;
		nd->last_type = LAST_NORM;
		if (this.name[0] != '.')
			goto return_base;
		if (this.len == 1)
			nd->last_type = LAST_DOT;
		else if (this.len == 2 && this.name[1] == '.')
			nd->last_type = LAST_DOTDOT;
		else
			goto return_base;
return_reval:
		/*
		 * We bypassed the ordinary revalidation routines.
		 * We may need to check the cached dentry for staleness.
		 */
990 991
		if (nd->path.dentry && nd->path.dentry->d_sb &&
		    (nd->path.dentry->d_sb->s_type->fs_flags & FS_REVAL_DOT)) {
L
Linus Torvalds 已提交
992 993
			err = -ESTALE;
			/* Note: we do not d_invalidate() */
994 995
			if (!nd->path.dentry->d_op->d_revalidate(
					nd->path.dentry, nd))
L
Linus Torvalds 已提交
996 997 998 999 1000
				break;
		}
return_base:
		return 0;
out_dput:
J
Jan Blunck 已提交
1001
		path_put_conditional(&next, nd);
L
Linus Torvalds 已提交
1002 1003
		break;
	}
J
Jan Blunck 已提交
1004
	path_put(&nd->path);
L
Linus Torvalds 已提交
1005 1006 1007 1008
return_err:
	return err;
}

1009
static int path_walk(const char *name, struct nameidata *nd)
L
Linus Torvalds 已提交
1010 1011 1012 1013 1014
{
	current->total_link_count = 0;
	return link_path_walk(name, nd);
}

1015
/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
1016
static int do_path_lookup(int dfd, const char *name,
1017
				unsigned int flags, struct nameidata *nd)
L
Linus Torvalds 已提交
1018
{
1019
	int retval = 0;
1020 1021
	int fput_needed;
	struct file *file;
1022
	struct fs_struct *fs = current->fs;
L
Linus Torvalds 已提交
1023 1024 1025 1026 1027 1028

	nd->last_type = LAST_ROOT; /* if there are only slashes... */
	nd->flags = flags;
	nd->depth = 0;

	if (*name=='/') {
1029
		read_lock(&fs->lock);
J
Jan Blunck 已提交
1030 1031
		nd->path = fs->root;
		path_get(&fs->root);
1032
		read_unlock(&fs->lock);
1033
	} else if (dfd == AT_FDCWD) {
1034
		read_lock(&fs->lock);
J
Jan Blunck 已提交
1035 1036
		nd->path = fs->pwd;
		path_get(&fs->pwd);
1037
		read_unlock(&fs->lock);
1038 1039 1040 1041
	} else {
		struct dentry *dentry;

		file = fget_light(dfd, &fput_needed);
1042 1043
		retval = -EBADF;
		if (!file)
1044
			goto out_fail;
1045

1046
		dentry = file->f_path.dentry;
1047

1048 1049
		retval = -ENOTDIR;
		if (!S_ISDIR(dentry->d_inode->i_mode))
1050
			goto fput_fail;
1051 1052

		retval = file_permission(file, MAY_EXEC);
1053
		if (retval)
1054
			goto fput_fail;
1055

J
Jan Blunck 已提交
1056 1057
		nd->path = file->f_path;
		path_get(&file->f_path);
1058 1059

		fput_light(file, fput_needed);
L
Linus Torvalds 已提交
1060
	}
1061 1062

	retval = path_walk(name, nd);
1063 1064 1065
	if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
				nd->path.dentry->d_inode))
		audit_inode(name, nd->path.dentry);
1066
out_fail:
1067 1068
	return retval;

1069
fput_fail:
1070
	fput_light(file, fput_needed);
1071
	goto out_fail;
L
Linus Torvalds 已提交
1072 1073
}

1074
int path_lookup(const char *name, unsigned int flags,
1075 1076 1077 1078 1079
			struct nameidata *nd)
{
	return do_path_lookup(AT_FDCWD, name, flags, nd);
}

A
Al Viro 已提交
1080 1081 1082 1083 1084 1085 1086 1087 1088
int kern_path(const char *name, unsigned int flags, struct path *path)
{
	struct nameidata nd;
	int res = do_path_lookup(AT_FDCWD, name, flags, &nd);
	if (!res)
		*path = nd.path;
	return res;
}

1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107
/**
 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
 * @dentry:  pointer to dentry of the base directory
 * @mnt: pointer to vfs mount of the base directory
 * @name: pointer to file name
 * @flags: lookup flags
 * @nd: pointer to nameidata
 */
int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
		    const char *name, unsigned int flags,
		    struct nameidata *nd)
{
	int retval;

	/* same as do_path_lookup */
	nd->last_type = LAST_ROOT;
	nd->flags = flags;
	nd->depth = 0;

1108 1109 1110
	nd->path.dentry = dentry;
	nd->path.mnt = mnt;
	path_get(&nd->path);
1111 1112

	retval = path_walk(name, nd);
1113 1114 1115
	if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
				nd->path.dentry->d_inode))
		audit_inode(name, nd->path.dentry);
1116 1117 1118 1119 1120

	return retval;

}

A
Al Viro 已提交
1121 1122 1123 1124 1125 1126 1127 1128 1129 1130
/**
 * path_lookup_open - lookup a file path with open intent
 * @dfd: the directory to use as base, or AT_FDCWD
 * @name: pointer to file name
 * @lookup_flags: lookup intent flags
 * @nd: pointer to nameidata
 * @open_flags: open intent flags
 */
int path_lookup_open(int dfd, const char *name, unsigned int lookup_flags,
		struct nameidata *nd, int open_flags)
1131 1132 1133 1134 1135 1136 1137 1138
{
	struct file *filp = get_empty_filp();
	int err;

	if (filp == NULL)
		return -ENFILE;
	nd->intent.open.file = filp;
	nd->intent.open.flags = open_flags;
A
Al Viro 已提交
1139
	nd->intent.open.create_mode = 0;
1140
	err = do_path_lookup(dfd, name, lookup_flags|LOOKUP_OPEN, nd);
1141 1142 1143
	if (IS_ERR(nd->intent.open.file)) {
		if (err == 0) {
			err = PTR_ERR(nd->intent.open.file);
J
Jan Blunck 已提交
1144
			path_put(&nd->path);
1145 1146 1147 1148 1149 1150
		}
	} else if (err != 0)
		release_open_intent(nd);
	return err;
}

1151 1152
static struct dentry *__lookup_hash(struct qstr *name,
		struct dentry *base, struct nameidata *nd)
L
Linus Torvalds 已提交
1153
{
1154
	struct dentry *dentry;
L
Linus Torvalds 已提交
1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172
	struct inode *inode;
	int err;

	inode = base->d_inode;

	/*
	 * See if the low-level filesystem might want
	 * to use its own hash..
	 */
	if (base->d_op && base->d_op->d_hash) {
		err = base->d_op->d_hash(base, name);
		dentry = ERR_PTR(err);
		if (err < 0)
			goto out;
	}

	dentry = cached_lookup(base, name, nd);
	if (!dentry) {
1173 1174 1175 1176 1177 1178 1179 1180
		struct dentry *new;

		/* Don't create child dentry for a dead directory. */
		dentry = ERR_PTR(-ENOENT);
		if (IS_DEADDIR(inode))
			goto out;

		new = d_alloc(base, name);
L
Linus Torvalds 已提交
1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193
		dentry = ERR_PTR(-ENOMEM);
		if (!new)
			goto out;
		dentry = inode->i_op->lookup(inode, new, nd);
		if (!dentry)
			dentry = new;
		else
			dput(new);
	}
out:
	return dentry;
}

1194 1195 1196 1197 1198
/*
 * Restricted form of lookup. Doesn't follow links, single-component only,
 * needs parent already locked. Doesn't follow mounts.
 * SMP-safe.
 */
1199
static struct dentry *lookup_hash(struct nameidata *nd)
1200 1201 1202
{
	int err;

1203
	err = inode_permission(nd->path.dentry->d_inode, MAY_EXEC);
1204
	if (err)
1205
		return ERR_PTR(err);
1206
	return __lookup_hash(&nd->last, nd->path.dentry, nd);
L
Linus Torvalds 已提交
1207 1208
}

1209 1210
static int __lookup_one_len(const char *name, struct qstr *this,
		struct dentry *base, int len)
L
Linus Torvalds 已提交
1211 1212 1213 1214
{
	unsigned long hash;
	unsigned int c;

1215 1216
	this->name = name;
	this->len = len;
L
Linus Torvalds 已提交
1217
	if (!len)
1218
		return -EACCES;
L
Linus Torvalds 已提交
1219 1220 1221 1222 1223

	hash = init_name_hash();
	while (len--) {
		c = *(const unsigned char *)name++;
		if (c == '/' || c == '\0')
1224
			return -EACCES;
L
Linus Torvalds 已提交
1225 1226
		hash = partial_name_hash(c, hash);
	}
1227 1228 1229
	this->hash = end_name_hash(hash);
	return 0;
}
L
Linus Torvalds 已提交
1230

1231
/**
1232
 * lookup_one_len - filesystem helper to lookup single pathname component
1233 1234 1235 1236
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
1237 1238
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.  Also note that by using this function the
1239 1240 1241
 * nameidata argument is passed to the filesystem methods and a filesystem
 * using this helper needs to be prepared for that.
 */
1242 1243 1244 1245 1246 1247
struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
{
	int err;
	struct qstr this;

	err = __lookup_one_len(name, &this, base, len);
1248 1249 1250
	if (err)
		return ERR_PTR(err);

1251
	err = inode_permission(base->d_inode, MAY_EXEC);
1252 1253
	if (err)
		return ERR_PTR(err);
1254
	return __lookup_hash(&this, base, NULL);
1255 1256
}

1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268
/**
 * lookup_one_noperm - bad hack for sysfs
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 *
 * This is a variant of lookup_one_len that doesn't perform any permission
 * checks.   It's a horrible hack to work around the braindead sysfs
 * architecture and should not be used anywhere else.
 *
 * DON'T USE THIS FUNCTION EVER, thanks.
 */
struct dentry *lookup_one_noperm(const char *name, struct dentry *base)
1269 1270 1271 1272
{
	int err;
	struct qstr this;

1273
	err = __lookup_one_len(name, &this, base, strlen(name));
1274 1275
	if (err)
		return ERR_PTR(err);
1276
	return __lookup_hash(&this, base, NULL);
L
Linus Torvalds 已提交
1277 1278
}

1279 1280
int user_path_at(int dfd, const char __user *name, unsigned flags,
		 struct path *path)
L
Linus Torvalds 已提交
1281
{
1282
	struct nameidata nd;
L
Linus Torvalds 已提交
1283 1284 1285
	char *tmp = getname(name);
	int err = PTR_ERR(tmp);
	if (!IS_ERR(tmp)) {
1286 1287 1288 1289

		BUG_ON(flags & LOOKUP_PARENT);

		err = do_path_lookup(dfd, tmp, flags, &nd);
L
Linus Torvalds 已提交
1290
		putname(tmp);
1291 1292
		if (!err)
			*path = nd.path;
L
Linus Torvalds 已提交
1293 1294 1295 1296
	}
	return err;
}

1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314
static int user_path_parent(int dfd, const char __user *path,
			struct nameidata *nd, char **name)
{
	char *s = getname(path);
	int error;

	if (IS_ERR(s))
		return PTR_ERR(s);

	error = do_path_lookup(dfd, s, LOOKUP_PARENT, nd);
	if (error)
		putname(s);
	else
		*name = s;

	return error;
}

L
Linus Torvalds 已提交
1315 1316 1317 1318 1319 1320
/*
 * It's inline, so penalty for filesystems that don't use sticky bit is
 * minimal.
 */
static inline int check_sticky(struct inode *dir, struct inode *inode)
{
1321 1322
	uid_t fsuid = current_fsuid();

L
Linus Torvalds 已提交
1323 1324
	if (!(dir->i_mode & S_ISVTX))
		return 0;
1325
	if (inode->i_uid == fsuid)
L
Linus Torvalds 已提交
1326
		return 0;
1327
	if (dir->i_uid == fsuid)
L
Linus Torvalds 已提交
1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350
		return 0;
	return !capable(CAP_FOWNER);
}

/*
 *	Check whether we can remove a link victim from directory dir, check
 *  whether the type of victim is right.
 *  1. We can't do it if dir is read-only (done in permission())
 *  2. We should have write and exec permissions on dir
 *  3. We can't remove anything from append-only dir
 *  4. We can't do anything with immutable dir (done in permission())
 *  5. If the sticky bit on dir is set we should either
 *	a. be owner of dir, or
 *	b. be owner of victim, or
 *	c. have CAP_FOWNER capability
 *  6. If the victim is append-only or immutable we can't do antyhing with
 *     links pointing to it.
 *  7. If we were asked to remove a directory and victim isn't one - ENOTDIR.
 *  8. If we were asked to remove a non-directory and victim isn't one - EISDIR.
 *  9. We can't remove a root or mountpoint.
 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by
 *     nfs_async_unlink().
 */
1351
static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
L
Linus Torvalds 已提交
1352 1353 1354 1355 1356 1357 1358
{
	int error;

	if (!victim->d_inode)
		return -ENOENT;

	BUG_ON(victim->d_parent->d_inode != dir);
1359
	audit_inode_child(victim->d_name.name, victim, dir);
L
Linus Torvalds 已提交
1360

1361
	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
1362 1363 1364 1365 1366
	if (error)
		return error;
	if (IS_APPEND(dir))
		return -EPERM;
	if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
H
Hugh Dickins 已提交
1367
	    IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
L
Linus Torvalds 已提交
1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390
		return -EPERM;
	if (isdir) {
		if (!S_ISDIR(victim->d_inode->i_mode))
			return -ENOTDIR;
		if (IS_ROOT(victim))
			return -EBUSY;
	} else if (S_ISDIR(victim->d_inode->i_mode))
		return -EISDIR;
	if (IS_DEADDIR(dir))
		return -ENOENT;
	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
		return -EBUSY;
	return 0;
}

/*	Check whether we can create an object with dentry child in directory
 *  dir.
 *  1. We can't do it if child already exists (open has special treatment for
 *     this case, but since we are inlined it's OK)
 *  2. We can't do it if dir is read-only (done in permission())
 *  3. We should have write and exec permissions on dir
 *  4. We can't do it if dir is immutable (done in permission())
 */
1391
static inline int may_create(struct inode *dir, struct dentry *child)
L
Linus Torvalds 已提交
1392 1393 1394 1395 1396
{
	if (child->d_inode)
		return -EEXIST;
	if (IS_DEADDIR(dir))
		return -ENOENT;
1397
	return inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423
}

/* 
 * O_DIRECTORY translates into forcing a directory lookup.
 */
static inline int lookup_flags(unsigned int f)
{
	unsigned long retval = LOOKUP_FOLLOW;

	if (f & O_NOFOLLOW)
		retval &= ~LOOKUP_FOLLOW;
	
	if (f & O_DIRECTORY)
		retval |= LOOKUP_DIRECTORY;

	return retval;
}

/*
 * p1 and p2 should be directories on the same fs.
 */
struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
{
	struct dentry *p;

	if (p1 == p2) {
I
Ingo Molnar 已提交
1424
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
L
Linus Torvalds 已提交
1425 1426 1427
		return NULL;
	}

1428
	mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
1429

1430 1431 1432 1433 1434
	p = d_ancestor(p2, p1);
	if (p) {
		mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT);
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD);
		return p;
L
Linus Torvalds 已提交
1435 1436
	}

1437 1438 1439 1440 1441
	p = d_ancestor(p1, p2);
	if (p) {
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
		mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
		return p;
L
Linus Torvalds 已提交
1442 1443
	}

I
Ingo Molnar 已提交
1444 1445
	mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
	mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
L
Linus Torvalds 已提交
1446 1447 1448 1449 1450
	return NULL;
}

void unlock_rename(struct dentry *p1, struct dentry *p2)
{
1451
	mutex_unlock(&p1->d_inode->i_mutex);
L
Linus Torvalds 已提交
1452
	if (p1 != p2) {
1453
		mutex_unlock(&p2->d_inode->i_mutex);
1454
		mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
1455 1456 1457 1458 1459 1460
	}
}

int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
		struct nameidata *nd)
{
1461
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
1462 1463 1464 1465

	if (error)
		return error;

A
Al Viro 已提交
1466
	if (!dir->i_op->create)
L
Linus Torvalds 已提交
1467 1468 1469 1470 1471 1472 1473 1474
		return -EACCES;	/* shouldn't it be ENOSYS? */
	mode &= S_IALLUGO;
	mode |= S_IFREG;
	error = security_inode_create(dir, dentry, mode);
	if (error)
		return error;
	DQUOT_INIT(dir);
	error = dir->i_op->create(dir, dentry, mode, nd);
1475
	if (!error)
1476
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
1477 1478 1479
	return error;
}

1480
int may_open(struct path *path, int acc_mode, int flag)
L
Linus Torvalds 已提交
1481
{
1482
	struct dentry *dentry = path->dentry;
L
Linus Torvalds 已提交
1483 1484 1485 1486 1487 1488 1489 1490 1491
	struct inode *inode = dentry->d_inode;
	int error;

	if (!inode)
		return -ENOENT;

	if (S_ISLNK(inode->i_mode))
		return -ELOOP;
	
1492
	if (S_ISDIR(inode->i_mode) && (acc_mode & MAY_WRITE))
L
Linus Torvalds 已提交
1493 1494 1495 1496 1497 1498 1499 1500 1501 1502
		return -EISDIR;

	/*
	 * FIFO's, sockets and device files are special: they don't
	 * actually live on the filesystem itself, and as such you
	 * can write to them even if the filesystem is read-only.
	 */
	if (S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
	    	flag &= ~O_TRUNC;
	} else if (S_ISBLK(inode->i_mode) || S_ISCHR(inode->i_mode)) {
1503
		if (path->mnt->mnt_flags & MNT_NODEV)
L
Linus Torvalds 已提交
1504 1505 1506
			return -EACCES;

		flag &= ~O_TRUNC;
1507
	}
1508

1509
	error = inode_permission(inode, acc_mode);
1510 1511
	if (error)
		return error;
L
Linus Torvalds 已提交
1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523
	/*
	 * An append-only file must be opened in append mode for writing.
	 */
	if (IS_APPEND(inode)) {
		if  ((flag & FMODE_WRITE) && !(flag & O_APPEND))
			return -EPERM;
		if (flag & O_TRUNC)
			return -EPERM;
	}

	/* O_NOATIME can only be set by the owner or superuser */
	if (flag & O_NOATIME)
1524
		if (!is_owner_or_cap(inode))
L
Linus Torvalds 已提交
1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542
			return -EPERM;

	/*
	 * Ensure there are no outstanding leases on the file.
	 */
	error = break_lease(inode, flag);
	if (error)
		return error;

	if (flag & O_TRUNC) {
		error = get_write_access(inode);
		if (error)
			return error;

		/*
		 * Refuse to truncate files with mandatory locks held on them.
		 */
		error = locks_verify_locked(inode);
1543
		if (!error)
1544
			error = security_path_truncate(path, 0,
1545
					       ATTR_MTIME|ATTR_CTIME|ATTR_OPEN);
L
Linus Torvalds 已提交
1546 1547
		if (!error) {
			DQUOT_INIT(inode);
1548 1549 1550 1551

			error = do_truncate(dentry, 0,
					    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
					    NULL);
L
Linus Torvalds 已提交
1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562
		}
		put_write_access(inode);
		if (error)
			return error;
	} else
		if (flag & FMODE_WRITE)
			DQUOT_INIT(inode);

	return 0;
}

1563 1564 1565 1566 1567 1568
/*
 * Be careful about ever adding any more callers of this
 * function.  Its flags must be in the namei format, not
 * what get passed to sys_open().
 */
static int __open_namei_create(struct nameidata *nd, struct path *path,
1569 1570 1571
				int flag, int mode)
{
	int error;
1572
	struct dentry *dir = nd->path.dentry;
1573 1574 1575

	if (!IS_POSIXACL(dir->d_inode))
		mode &= ~current->fs->umask;
1576 1577 1578
	error = security_path_mknod(&nd->path, path->dentry, mode, 0);
	if (error)
		goto out_unlock;
1579
	error = vfs_create(dir->d_inode, path->dentry, mode, nd);
1580
out_unlock:
1581
	mutex_unlock(&dir->d_inode->i_mutex);
1582 1583
	dput(nd->path.dentry);
	nd->path.dentry = path->dentry;
1584 1585 1586
	if (error)
		return error;
	/* Don't check for write permission, don't truncate */
1587
	return may_open(&nd->path, 0, flag & ~O_TRUNC);
1588 1589
}

1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613
/*
 * Note that while the flag value (low two bits) for sys_open means:
 *	00 - read-only
 *	01 - write-only
 *	10 - read-write
 *	11 - special
 * it is changed into
 *	00 - no permissions needed
 *	01 - read-permission
 *	10 - write-permission
 *	11 - read-write
 * for the internal routines (ie open_namei()/follow_link() etc)
 * This is more logical, and also allows the 00 "no perm needed"
 * to be used for symlinks (where the permissions are checked
 * later).
 *
*/
static inline int open_to_namei_flags(int flag)
{
	if ((flag+1) & O_ACCMODE)
		flag++;
	return flag;
}

1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624
static int open_will_write_to_fs(int flag, struct inode *inode)
{
	/*
	 * We'll never write to the fs underlying
	 * a device file.
	 */
	if (special_file(inode->i_mode))
		return 0;
	return (flag & O_TRUNC);
}

L
Linus Torvalds 已提交
1625
/*
1626 1627 1628
 * Note that the low bits of the passed in "open_flag"
 * are not the same as in the local variable "flag". See
 * open_to_namei_flags() for more details.
L
Linus Torvalds 已提交
1629
 */
1630 1631
struct file *do_filp_open(int dfd, const char *pathname,
		int open_flag, int mode)
L
Linus Torvalds 已提交
1632
{
1633
	struct file *filp;
1634
	struct nameidata nd;
1635
	int acc_mode, error;
A
Al Viro 已提交
1636
	struct path path;
L
Linus Torvalds 已提交
1637 1638
	struct dentry *dir;
	int count = 0;
1639
	int will_write;
1640
	int flag = open_to_namei_flags(open_flag);
L
Linus Torvalds 已提交
1641

1642
	acc_mode = MAY_OPEN | ACC_MODE(flag);
L
Linus Torvalds 已提交
1643

1644 1645 1646 1647
	/* O_TRUNC implies we need access checks for write permissions */
	if (flag & O_TRUNC)
		acc_mode |= MAY_WRITE;

L
Linus Torvalds 已提交
1648 1649 1650 1651 1652 1653 1654 1655 1656
	/* Allow the LSM permission hook to distinguish append 
	   access from general write access. */
	if (flag & O_APPEND)
		acc_mode |= MAY_APPEND;

	/*
	 * The simplest case - just a plain lookup.
	 */
	if (!(flag & O_CREAT)) {
1657
		error = path_lookup_open(dfd, pathname, lookup_flags(flag),
1658
					 &nd, flag);
L
Linus Torvalds 已提交
1659
		if (error)
1660
			return ERR_PTR(error);
L
Linus Torvalds 已提交
1661 1662 1663 1664 1665 1666
		goto ok;
	}

	/*
	 * Create - we need to know the parent.
	 */
A
Al Viro 已提交
1667
	error = do_path_lookup(dfd, pathname, LOOKUP_PARENT, &nd);
L
Linus Torvalds 已提交
1668
	if (error)
1669
		return ERR_PTR(error);
L
Linus Torvalds 已提交
1670 1671 1672 1673 1674 1675 1676

	/*
	 * We have the parent and last component. First of all, check
	 * that we are not asked to creat(2) an obvious directory - that
	 * will not do.
	 */
	error = -EISDIR;
1677
	if (nd.last_type != LAST_NORM || nd.last.name[nd.last.len])
A
Al Viro 已提交
1678
		goto exit_parent;
L
Linus Torvalds 已提交
1679

A
Al Viro 已提交
1680 1681 1682 1683 1684 1685 1686
	error = -ENFILE;
	filp = get_empty_filp();
	if (filp == NULL)
		goto exit_parent;
	nd.intent.open.file = filp;
	nd.intent.open.flags = flag;
	nd.intent.open.create_mode = mode;
1687 1688
	dir = nd.path.dentry;
	nd.flags &= ~LOOKUP_PARENT;
A
Al Viro 已提交
1689
	nd.flags |= LOOKUP_CREATE | LOOKUP_OPEN;
1690 1691
	if (flag & O_EXCL)
		nd.flags |= LOOKUP_EXCL;
1692
	mutex_lock(&dir->d_inode->i_mutex);
1693 1694
	path.dentry = lookup_hash(&nd);
	path.mnt = nd.path.mnt;
L
Linus Torvalds 已提交
1695 1696

do_last:
A
Al Viro 已提交
1697 1698
	error = PTR_ERR(path.dentry);
	if (IS_ERR(path.dentry)) {
1699
		mutex_unlock(&dir->d_inode->i_mutex);
L
Linus Torvalds 已提交
1700 1701 1702
		goto exit;
	}

1703 1704
	if (IS_ERR(nd.intent.open.file)) {
		error = PTR_ERR(nd.intent.open.file);
1705
		goto exit_mutex_unlock;
1706 1707
	}

L
Linus Torvalds 已提交
1708
	/* Negative dentry, just create the file */
A
Al Viro 已提交
1709
	if (!path.dentry->d_inode) {
1710 1711 1712 1713 1714 1715 1716 1717
		/*
		 * This write is needed to ensure that a
		 * ro->rw transition does not occur between
		 * the time when the file is created and when
		 * a permanent write count is taken through
		 * the 'struct file' in nameidata_to_filp().
		 */
		error = mnt_want_write(nd.path.mnt);
L
Linus Torvalds 已提交
1718
		if (error)
1719 1720 1721 1722
			goto exit_mutex_unlock;
		error = __open_namei_create(&nd, &path, flag, mode);
		if (error) {
			mnt_drop_write(nd.path.mnt);
L
Linus Torvalds 已提交
1723
			goto exit;
1724 1725 1726 1727
		}
		filp = nameidata_to_filp(&nd, open_flag);
		mnt_drop_write(nd.path.mnt);
		return filp;
L
Linus Torvalds 已提交
1728 1729 1730 1731 1732
	}

	/*
	 * It already exists.
	 */
1733
	mutex_unlock(&dir->d_inode->i_mutex);
1734
	audit_inode(pathname, path.dentry);
L
Linus Torvalds 已提交
1735 1736 1737 1738 1739

	error = -EEXIST;
	if (flag & O_EXCL)
		goto exit_dput;

A
Al Viro 已提交
1740
	if (__follow_mount(&path)) {
L
Linus Torvalds 已提交
1741
		error = -ELOOP;
A
Al Viro 已提交
1742 1743
		if (flag & O_NOFOLLOW)
			goto exit_dput;
L
Linus Torvalds 已提交
1744
	}
1745

L
Linus Torvalds 已提交
1746
	error = -ENOENT;
A
Al Viro 已提交
1747
	if (!path.dentry->d_inode)
L
Linus Torvalds 已提交
1748
		goto exit_dput;
A
Al Viro 已提交
1749
	if (path.dentry->d_inode->i_op->follow_link)
L
Linus Torvalds 已提交
1750 1751
		goto do_link;

1752
	path_to_nameidata(&path, &nd);
L
Linus Torvalds 已提交
1753
	error = -EISDIR;
A
Al Viro 已提交
1754
	if (path.dentry->d_inode && S_ISDIR(path.dentry->d_inode->i_mode))
L
Linus Torvalds 已提交
1755 1756
		goto exit;
ok:
1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772
	/*
	 * Consider:
	 * 1. may_open() truncates a file
	 * 2. a rw->ro mount transition occurs
	 * 3. nameidata_to_filp() fails due to
	 *    the ro mount.
	 * That would be inconsistent, and should
	 * be avoided. Taking this mnt write here
	 * ensures that (2) can not occur.
	 */
	will_write = open_will_write_to_fs(flag, nd.path.dentry->d_inode);
	if (will_write) {
		error = mnt_want_write(nd.path.mnt);
		if (error)
			goto exit;
	}
1773
	error = may_open(&nd.path, acc_mode, flag);
1774 1775 1776
	if (error) {
		if (will_write)
			mnt_drop_write(nd.path.mnt);
L
Linus Torvalds 已提交
1777
		goto exit;
1778 1779 1780 1781 1782 1783 1784 1785 1786 1787
	}
	filp = nameidata_to_filp(&nd, open_flag);
	/*
	 * It is now safe to drop the mnt write
	 * because the filp has had a write taken
	 * on its behalf.
	 */
	if (will_write)
		mnt_drop_write(nd.path.mnt);
	return filp;
L
Linus Torvalds 已提交
1788

1789 1790
exit_mutex_unlock:
	mutex_unlock(&dir->d_inode->i_mutex);
L
Linus Torvalds 已提交
1791
exit_dput:
1792
	path_put_conditional(&path, &nd);
L
Linus Torvalds 已提交
1793
exit:
1794 1795
	if (!IS_ERR(nd.intent.open.file))
		release_open_intent(&nd);
A
Al Viro 已提交
1796
exit_parent:
1797 1798
	path_put(&nd.path);
	return ERR_PTR(error);
L
Linus Torvalds 已提交
1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813

do_link:
	error = -ELOOP;
	if (flag & O_NOFOLLOW)
		goto exit_dput;
	/*
	 * This is subtle. Instead of calling do_follow_link() we do the
	 * thing by hands. The reason is that this way we have zero link_count
	 * and path_walk() (called from ->follow_link) honoring LOOKUP_PARENT.
	 * After that we have the parent and last component, i.e.
	 * we are in the same situation as after the first path_walk().
	 * Well, almost - if the last component is normal we get its copy
	 * stored in nd->last.name and we will have to putname() it when we
	 * are done. Procfs-like symlinks just set LAST_BIND.
	 */
1814 1815
	nd.flags |= LOOKUP_PARENT;
	error = security_inode_follow_link(path.dentry, &nd);
L
Linus Torvalds 已提交
1816 1817
	if (error)
		goto exit_dput;
1818
	error = __do_follow_link(&path, &nd);
K
Kirill Korotaev 已提交
1819 1820 1821 1822 1823
	if (error) {
		/* Does someone understand code flow here? Or it is only
		 * me so stupid? Anathema to whoever designed this non-sense
		 * with "intent.open".
		 */
1824 1825
		release_open_intent(&nd);
		return ERR_PTR(error);
K
Kirill Korotaev 已提交
1826
	}
1827 1828
	nd.flags &= ~LOOKUP_PARENT;
	if (nd.last_type == LAST_BIND)
L
Linus Torvalds 已提交
1829 1830
		goto ok;
	error = -EISDIR;
1831
	if (nd.last_type != LAST_NORM)
L
Linus Torvalds 已提交
1832
		goto exit;
1833 1834
	if (nd.last.name[nd.last.len]) {
		__putname(nd.last.name);
L
Linus Torvalds 已提交
1835 1836 1837 1838
		goto exit;
	}
	error = -ELOOP;
	if (count++==32) {
1839
		__putname(nd.last.name);
L
Linus Torvalds 已提交
1840 1841
		goto exit;
	}
1842
	dir = nd.path.dentry;
1843
	mutex_lock(&dir->d_inode->i_mutex);
1844 1845 1846
	path.dentry = lookup_hash(&nd);
	path.mnt = nd.path.mnt;
	__putname(nd.last.name);
L
Linus Torvalds 已提交
1847 1848 1849
	goto do_last;
}

1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866
/**
 * filp_open - open file and return file pointer
 *
 * @filename:	path to open
 * @flags:	open flags as per the open(2) second argument
 * @mode:	mode for the new file if O_CREAT is set, else ignored
 *
 * This is the helper to open a file from kernelspace if you really
 * have to.  But in generally you should not do this, so please move
 * along, nothing to see here..
 */
struct file *filp_open(const char *filename, int flags, int mode)
{
	return do_filp_open(AT_FDCWD, filename, flags, mode);
}
EXPORT_SYMBOL(filp_open);

L
Linus Torvalds 已提交
1867 1868 1869 1870 1871 1872 1873
/**
 * lookup_create - lookup a dentry, creating it if it doesn't exist
 * @nd: nameidata info
 * @is_dir: directory flag
 *
 * Simple function to lookup and return a dentry and create it
 * if it doesn't exist.  Is SMP-safe.
1874
 *
1875
 * Returns with nd->path.dentry->d_inode->i_mutex locked.
L
Linus Torvalds 已提交
1876 1877 1878
 */
struct dentry *lookup_create(struct nameidata *nd, int is_dir)
{
1879
	struct dentry *dentry = ERR_PTR(-EEXIST);
L
Linus Torvalds 已提交
1880

1881
	mutex_lock_nested(&nd->path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
1882 1883 1884 1885
	/*
	 * Yucky last component or no last component at all?
	 * (foo/., foo/.., /////)
	 */
L
Linus Torvalds 已提交
1886 1887 1888
	if (nd->last_type != LAST_NORM)
		goto fail;
	nd->flags &= ~LOOKUP_PARENT;
1889
	nd->flags |= LOOKUP_CREATE | LOOKUP_EXCL;
1890
	nd->intent.open.flags = O_EXCL;
1891 1892 1893 1894

	/*
	 * Do the final lookup.
	 */
1895
	dentry = lookup_hash(nd);
L
Linus Torvalds 已提交
1896 1897
	if (IS_ERR(dentry))
		goto fail;
1898

1899 1900
	if (dentry->d_inode)
		goto eexist;
1901 1902 1903 1904 1905 1906
	/*
	 * Special case - lookup gave negative, but... we had foo/bar/
	 * From the vfs_mknod() POV we just have a negative dentry -
	 * all is fine. Let's be bastards - you had / on the end, you've
	 * been asking for (non-existent) directory. -ENOENT for you.
	 */
1907 1908 1909 1910
	if (unlikely(!is_dir && nd->last.name[nd->last.len])) {
		dput(dentry);
		dentry = ERR_PTR(-ENOENT);
	}
L
Linus Torvalds 已提交
1911
	return dentry;
1912
eexist:
L
Linus Torvalds 已提交
1913
	dput(dentry);
1914
	dentry = ERR_PTR(-EEXIST);
L
Linus Torvalds 已提交
1915 1916 1917
fail:
	return dentry;
}
1918
EXPORT_SYMBOL_GPL(lookup_create);
L
Linus Torvalds 已提交
1919 1920 1921

int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
{
1922
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
1923 1924 1925 1926 1927 1928 1929

	if (error)
		return error;

	if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
		return -EPERM;

A
Al Viro 已提交
1930
	if (!dir->i_op->mknod)
L
Linus Torvalds 已提交
1931 1932
		return -EPERM;

1933 1934 1935 1936
	error = devcgroup_inode_mknod(mode, dev);
	if (error)
		return error;

L
Linus Torvalds 已提交
1937 1938 1939 1940 1941 1942
	error = security_inode_mknod(dir, dentry, mode, dev);
	if (error)
		return error;

	DQUOT_INIT(dir);
	error = dir->i_op->mknod(dir, dentry, mode, dev);
1943
	if (!error)
1944
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
1945 1946 1947
	return error;
}

1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964
static int may_mknod(mode_t mode)
{
	switch (mode & S_IFMT) {
	case S_IFREG:
	case S_IFCHR:
	case S_IFBLK:
	case S_IFIFO:
	case S_IFSOCK:
	case 0: /* zero mode translates to S_IFREG */
		return 0;
	case S_IFDIR:
		return -EPERM;
	default:
		return -EINVAL;
	}
}

1965 1966
asmlinkage long sys_mknodat(int dfd, const char __user *filename, int mode,
				unsigned dev)
L
Linus Torvalds 已提交
1967
{
1968 1969 1970
	int error;
	char *tmp;
	struct dentry *dentry;
L
Linus Torvalds 已提交
1971 1972 1973 1974 1975
	struct nameidata nd;

	if (S_ISDIR(mode))
		return -EPERM;

1976
	error = user_path_parent(dfd, filename, &nd, &tmp);
L
Linus Torvalds 已提交
1977
	if (error)
1978 1979
		return error;

L
Linus Torvalds 已提交
1980
	dentry = lookup_create(&nd, 0);
1981 1982 1983 1984
	if (IS_ERR(dentry)) {
		error = PTR_ERR(dentry);
		goto out_unlock;
	}
1985
	if (!IS_POSIXACL(nd.path.dentry->d_inode))
L
Linus Torvalds 已提交
1986
		mode &= ~current->fs->umask;
1987 1988 1989 1990 1991 1992
	error = may_mknod(mode);
	if (error)
		goto out_dput;
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto out_dput;
1993 1994 1995
	error = security_path_mknod(&nd.path, dentry, mode, dev);
	if (error)
		goto out_drop_write;
1996
	switch (mode & S_IFMT) {
L
Linus Torvalds 已提交
1997
		case 0: case S_IFREG:
1998
			error = vfs_create(nd.path.dentry->d_inode,dentry,mode,&nd);
L
Linus Torvalds 已提交
1999 2000
			break;
		case S_IFCHR: case S_IFBLK:
2001
			error = vfs_mknod(nd.path.dentry->d_inode,dentry,mode,
L
Linus Torvalds 已提交
2002 2003 2004
					new_decode_dev(dev));
			break;
		case S_IFIFO: case S_IFSOCK:
2005
			error = vfs_mknod(nd.path.dentry->d_inode,dentry,mode,0);
L
Linus Torvalds 已提交
2006 2007
			break;
	}
2008
out_drop_write:
2009 2010 2011 2012
	mnt_drop_write(nd.path.mnt);
out_dput:
	dput(dentry);
out_unlock:
2013
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
J
Jan Blunck 已提交
2014
	path_put(&nd.path);
L
Linus Torvalds 已提交
2015 2016 2017 2018 2019
	putname(tmp);

	return error;
}

2020 2021 2022 2023 2024
asmlinkage long sys_mknod(const char __user *filename, int mode, unsigned dev)
{
	return sys_mknodat(AT_FDCWD, filename, mode, dev);
}

L
Linus Torvalds 已提交
2025 2026
int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
{
2027
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2028 2029 2030 2031

	if (error)
		return error;

A
Al Viro 已提交
2032
	if (!dir->i_op->mkdir)
L
Linus Torvalds 已提交
2033 2034 2035 2036 2037 2038 2039 2040 2041
		return -EPERM;

	mode &= (S_IRWXUGO|S_ISVTX);
	error = security_inode_mkdir(dir, dentry, mode);
	if (error)
		return error;

	DQUOT_INIT(dir);
	error = dir->i_op->mkdir(dir, dentry, mode);
2042
	if (!error)
2043
		fsnotify_mkdir(dir, dentry);
L
Linus Torvalds 已提交
2044 2045 2046
	return error;
}

2047
asmlinkage long sys_mkdirat(int dfd, const char __user *pathname, int mode)
L
Linus Torvalds 已提交
2048 2049 2050
{
	int error = 0;
	char * tmp;
2051 2052
	struct dentry *dentry;
	struct nameidata nd;
L
Linus Torvalds 已提交
2053

2054 2055
	error = user_path_parent(dfd, pathname, &nd, &tmp);
	if (error)
2056
		goto out_err;
L
Linus Torvalds 已提交
2057

2058 2059 2060 2061
	dentry = lookup_create(&nd, 1);
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry))
		goto out_unlock;
L
Linus Torvalds 已提交
2062

2063
	if (!IS_POSIXACL(nd.path.dentry->d_inode))
2064
		mode &= ~current->fs->umask;
2065 2066 2067
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto out_dput;
2068 2069 2070
	error = security_path_mkdir(&nd.path, dentry, mode);
	if (error)
		goto out_drop_write;
2071
	error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
2072
out_drop_write:
2073 2074
	mnt_drop_write(nd.path.mnt);
out_dput:
2075 2076
	dput(dentry);
out_unlock:
2077
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
J
Jan Blunck 已提交
2078
	path_put(&nd.path);
2079 2080
	putname(tmp);
out_err:
L
Linus Torvalds 已提交
2081 2082 2083
	return error;
}

2084 2085 2086 2087 2088
asmlinkage long sys_mkdir(const char __user *pathname, int mode)
{
	return sys_mkdirat(AT_FDCWD, pathname, mode);
}

L
Linus Torvalds 已提交
2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101 2102 2103 2104 2105 2106
/*
 * We try to drop the dentry early: we should have
 * a usage count of 2 if we're the only user of this
 * dentry, and if that is true (possibly after pruning
 * the dcache), then we drop the dentry now.
 *
 * A low-level filesystem can, if it choses, legally
 * do a
 *
 *	if (!d_unhashed(dentry))
 *		return -EBUSY;
 *
 * if it cannot handle the case of removing a directory
 * that is still in use by something else..
 */
void dentry_unhash(struct dentry *dentry)
{
	dget(dentry);
2107
	shrink_dcache_parent(dentry);
L
Linus Torvalds 已提交
2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122
	spin_lock(&dcache_lock);
	spin_lock(&dentry->d_lock);
	if (atomic_read(&dentry->d_count) == 2)
		__d_drop(dentry);
	spin_unlock(&dentry->d_lock);
	spin_unlock(&dcache_lock);
}

int vfs_rmdir(struct inode *dir, struct dentry *dentry)
{
	int error = may_delete(dir, dentry, 1);

	if (error)
		return error;

A
Al Viro 已提交
2123
	if (!dir->i_op->rmdir)
L
Linus Torvalds 已提交
2124 2125 2126 2127
		return -EPERM;

	DQUOT_INIT(dir);

2128
	mutex_lock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2129 2130 2131 2132 2133 2134 2135 2136 2137 2138 2139
	dentry_unhash(dentry);
	if (d_mountpoint(dentry))
		error = -EBUSY;
	else {
		error = security_inode_rmdir(dir, dentry);
		if (!error) {
			error = dir->i_op->rmdir(dir, dentry);
			if (!error)
				dentry->d_inode->i_flags |= S_DEAD;
		}
	}
2140
	mutex_unlock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2141 2142 2143 2144 2145 2146 2147 2148
	if (!error) {
		d_delete(dentry);
	}
	dput(dentry);

	return error;
}

2149
static long do_rmdir(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
2150 2151 2152 2153 2154 2155
{
	int error = 0;
	char * name;
	struct dentry *dentry;
	struct nameidata nd;

2156
	error = user_path_parent(dfd, pathname, &nd, &name);
L
Linus Torvalds 已提交
2157
	if (error)
2158
		return error;
L
Linus Torvalds 已提交
2159 2160

	switch(nd.last_type) {
2161 2162 2163 2164 2165 2166 2167 2168 2169
	case LAST_DOTDOT:
		error = -ENOTEMPTY;
		goto exit1;
	case LAST_DOT:
		error = -EINVAL;
		goto exit1;
	case LAST_ROOT:
		error = -EBUSY;
		goto exit1;
L
Linus Torvalds 已提交
2170
	}
2171 2172 2173

	nd.flags &= ~LOOKUP_PARENT;

2174
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2175
	dentry = lookup_hash(&nd);
L
Linus Torvalds 已提交
2176
	error = PTR_ERR(dentry);
2177 2178
	if (IS_ERR(dentry))
		goto exit2;
2179 2180 2181
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto exit3;
2182 2183 2184
	error = security_path_rmdir(&nd.path, dentry);
	if (error)
		goto exit4;
2185
	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
2186
exit4:
2187 2188
	mnt_drop_write(nd.path.mnt);
exit3:
2189 2190
	dput(dentry);
exit2:
2191
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2192
exit1:
J
Jan Blunck 已提交
2193
	path_put(&nd.path);
L
Linus Torvalds 已提交
2194 2195 2196 2197
	putname(name);
	return error;
}

2198 2199 2200 2201 2202
asmlinkage long sys_rmdir(const char __user *pathname)
{
	return do_rmdir(AT_FDCWD, pathname);
}

L
Linus Torvalds 已提交
2203 2204 2205 2206 2207 2208 2209
int vfs_unlink(struct inode *dir, struct dentry *dentry)
{
	int error = may_delete(dir, dentry, 0);

	if (error)
		return error;

A
Al Viro 已提交
2210
	if (!dir->i_op->unlink)
L
Linus Torvalds 已提交
2211 2212 2213 2214
		return -EPERM;

	DQUOT_INIT(dir);

2215
	mutex_lock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2216 2217 2218 2219 2220 2221 2222
	if (d_mountpoint(dentry))
		error = -EBUSY;
	else {
		error = security_inode_unlink(dir, dentry);
		if (!error)
			error = dir->i_op->unlink(dir, dentry);
	}
2223
	mutex_unlock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2224 2225 2226

	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
	if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
2227
		fsnotify_link_count(dentry->d_inode);
J
John McCutchan 已提交
2228
		d_delete(dentry);
L
Linus Torvalds 已提交
2229
	}
R
Robert Love 已提交
2230

L
Linus Torvalds 已提交
2231 2232 2233 2234 2235
	return error;
}

/*
 * Make sure that the actual truncation of the file will occur outside its
2236
 * directory's i_mutex.  Truncate can take a long time if there is a lot of
L
Linus Torvalds 已提交
2237 2238 2239
 * writeout happening, and we don't want to prevent access to the directory
 * while waiting on the I/O.
 */
2240
static long do_unlinkat(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
2241
{
2242 2243
	int error;
	char *name;
L
Linus Torvalds 已提交
2244 2245 2246 2247
	struct dentry *dentry;
	struct nameidata nd;
	struct inode *inode = NULL;

2248
	error = user_path_parent(dfd, pathname, &nd, &name);
L
Linus Torvalds 已提交
2249
	if (error)
2250 2251
		return error;

L
Linus Torvalds 已提交
2252 2253 2254
	error = -EISDIR;
	if (nd.last_type != LAST_NORM)
		goto exit1;
2255 2256 2257

	nd.flags &= ~LOOKUP_PARENT;

2258
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2259
	dentry = lookup_hash(&nd);
L
Linus Torvalds 已提交
2260 2261 2262 2263 2264 2265 2266 2267
	error = PTR_ERR(dentry);
	if (!IS_ERR(dentry)) {
		/* Why not before? Because we want correct error value */
		if (nd.last.name[nd.last.len])
			goto slashes;
		inode = dentry->d_inode;
		if (inode)
			atomic_inc(&inode->i_count);
2268 2269 2270
		error = mnt_want_write(nd.path.mnt);
		if (error)
			goto exit2;
2271 2272 2273
		error = security_path_unlink(&nd.path, dentry);
		if (error)
			goto exit3;
2274
		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
2275
exit3:
2276
		mnt_drop_write(nd.path.mnt);
L
Linus Torvalds 已提交
2277 2278 2279
	exit2:
		dput(dentry);
	}
2280
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2281 2282 2283
	if (inode)
		iput(inode);	/* truncate the inode here */
exit1:
J
Jan Blunck 已提交
2284
	path_put(&nd.path);
L
Linus Torvalds 已提交
2285 2286 2287 2288 2289 2290 2291 2292 2293
	putname(name);
	return error;

slashes:
	error = !dentry->d_inode ? -ENOENT :
		S_ISDIR(dentry->d_inode->i_mode) ? -EISDIR : -ENOTDIR;
	goto exit2;
}

2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307 2308 2309
asmlinkage long sys_unlinkat(int dfd, const char __user *pathname, int flag)
{
	if ((flag & ~AT_REMOVEDIR) != 0)
		return -EINVAL;

	if (flag & AT_REMOVEDIR)
		return do_rmdir(dfd, pathname);

	return do_unlinkat(dfd, pathname);
}

asmlinkage long sys_unlink(const char __user *pathname)
{
	return do_unlinkat(AT_FDCWD, pathname);
}

2310
int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
L
Linus Torvalds 已提交
2311
{
2312
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2313 2314 2315 2316

	if (error)
		return error;

A
Al Viro 已提交
2317
	if (!dir->i_op->symlink)
L
Linus Torvalds 已提交
2318 2319 2320 2321 2322 2323 2324 2325
		return -EPERM;

	error = security_inode_symlink(dir, dentry, oldname);
	if (error)
		return error;

	DQUOT_INIT(dir);
	error = dir->i_op->symlink(dir, dentry, oldname);
2326
	if (!error)
2327
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
2328 2329 2330
	return error;
}

2331 2332
asmlinkage long sys_symlinkat(const char __user *oldname,
			      int newdfd, const char __user *newname)
L
Linus Torvalds 已提交
2333
{
2334 2335 2336
	int error;
	char *from;
	char *to;
2337 2338
	struct dentry *dentry;
	struct nameidata nd;
L
Linus Torvalds 已提交
2339 2340

	from = getname(oldname);
2341
	if (IS_ERR(from))
L
Linus Torvalds 已提交
2342 2343
		return PTR_ERR(from);

2344
	error = user_path_parent(newdfd, newname, &nd, &to);
2345
	if (error)
2346 2347
		goto out_putname;

2348 2349 2350 2351 2352
	dentry = lookup_create(&nd, 0);
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry))
		goto out_unlock;

2353 2354 2355
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto out_dput;
2356 2357 2358
	error = security_path_symlink(&nd.path, dentry, from);
	if (error)
		goto out_drop_write;
2359
	error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
2360
out_drop_write:
2361 2362
	mnt_drop_write(nd.path.mnt);
out_dput:
2363 2364
	dput(dentry);
out_unlock:
2365
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
J
Jan Blunck 已提交
2366
	path_put(&nd.path);
2367 2368
	putname(to);
out_putname:
L
Linus Torvalds 已提交
2369 2370 2371 2372
	putname(from);
	return error;
}

2373 2374 2375 2376 2377
asmlinkage long sys_symlink(const char __user *oldname, const char __user *newname)
{
	return sys_symlinkat(oldname, AT_FDCWD, newname);
}

L
Linus Torvalds 已提交
2378 2379 2380 2381 2382 2383 2384 2385
int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
{
	struct inode *inode = old_dentry->d_inode;
	int error;

	if (!inode)
		return -ENOENT;

2386
	error = may_create(dir, new_dentry);
L
Linus Torvalds 已提交
2387 2388 2389 2390 2391 2392 2393 2394 2395 2396 2397
	if (error)
		return error;

	if (dir->i_sb != inode->i_sb)
		return -EXDEV;

	/*
	 * A link to an append-only or immutable file cannot be created.
	 */
	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
		return -EPERM;
A
Al Viro 已提交
2398
	if (!dir->i_op->link)
L
Linus Torvalds 已提交
2399
		return -EPERM;
2400
	if (S_ISDIR(inode->i_mode))
L
Linus Torvalds 已提交
2401 2402 2403 2404 2405 2406
		return -EPERM;

	error = security_inode_link(old_dentry, dir, new_dentry);
	if (error)
		return error;

2407
	mutex_lock(&inode->i_mutex);
L
Linus Torvalds 已提交
2408 2409
	DQUOT_INIT(dir);
	error = dir->i_op->link(old_dentry, dir, new_dentry);
2410
	mutex_unlock(&inode->i_mutex);
2411
	if (!error)
2412
		fsnotify_link(dir, inode, new_dentry);
L
Linus Torvalds 已提交
2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424
	return error;
}

/*
 * Hardlinks are often used in delicate situations.  We avoid
 * security-related surprises by not following symlinks on the
 * newname.  --KAB
 *
 * We don't follow them on the oldname either to be compatible
 * with linux 2.0, and to avoid hard-linking to directories
 * and other special files.  --ADM
 */
2425
asmlinkage long sys_linkat(int olddfd, const char __user *oldname,
2426 2427
			   int newdfd, const char __user *newname,
			   int flags)
L
Linus Torvalds 已提交
2428 2429
{
	struct dentry *new_dentry;
2430 2431
	struct nameidata nd;
	struct path old_path;
L
Linus Torvalds 已提交
2432
	int error;
2433
	char *to;
L
Linus Torvalds 已提交
2434

2435
	if ((flags & ~AT_SYMLINK_FOLLOW) != 0)
2436 2437
		return -EINVAL;

2438 2439 2440
	error = user_path_at(olddfd, oldname,
			     flags & AT_SYMLINK_FOLLOW ? LOOKUP_FOLLOW : 0,
			     &old_path);
L
Linus Torvalds 已提交
2441
	if (error)
2442 2443 2444
		return error;

	error = user_path_parent(newdfd, newname, &nd, &to);
L
Linus Torvalds 已提交
2445 2446 2447
	if (error)
		goto out;
	error = -EXDEV;
2448
	if (old_path.mnt != nd.path.mnt)
L
Linus Torvalds 已提交
2449 2450 2451
		goto out_release;
	new_dentry = lookup_create(&nd, 0);
	error = PTR_ERR(new_dentry);
2452 2453
	if (IS_ERR(new_dentry))
		goto out_unlock;
2454 2455 2456
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto out_dput;
2457 2458 2459
	error = security_path_link(old_path.dentry, &nd.path, new_dentry);
	if (error)
		goto out_drop_write;
2460
	error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
2461
out_drop_write:
2462 2463
	mnt_drop_write(nd.path.mnt);
out_dput:
2464 2465
	dput(new_dentry);
out_unlock:
2466
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2467
out_release:
J
Jan Blunck 已提交
2468
	path_put(&nd.path);
2469
	putname(to);
L
Linus Torvalds 已提交
2470
out:
2471
	path_put(&old_path);
L
Linus Torvalds 已提交
2472 2473 2474 2475

	return error;
}

2476 2477
asmlinkage long sys_link(const char __user *oldname, const char __user *newname)
{
2478
	return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
2479 2480
}

L
Linus Torvalds 已提交
2481 2482 2483 2484 2485 2486 2487
/*
 * The worst of all namespace operations - renaming directory. "Perverted"
 * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
 * Problems:
 *	a) we can get into loop creation. Check is done in is_subdir().
 *	b) race potential - two innocent renames can create a loop together.
 *	   That's where 4.4 screws up. Current fix: serialization on
2488
 *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
L
Linus Torvalds 已提交
2489 2490
 *	   story.
 *	c) we have to lock _three_ objects - parents and victim (if it exists).
2491
 *	   And that - after we got ->i_mutex on parents (until then we don't know
L
Linus Torvalds 已提交
2492 2493
 *	   whether the target exists).  Solution: try to be smart with locking
 *	   order for inodes.  We rely on the fact that tree topology may change
2494
 *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
L
Linus Torvalds 已提交
2495 2496 2497
 *	   move will be locked.  Thus we can rank directories by the tree
 *	   (ancestors first) and rank all non-directories after them.
 *	   That works since everybody except rename does "lock parent, lookup,
2498
 *	   lock child" and rename is under ->s_vfs_rename_mutex.
L
Linus Torvalds 已提交
2499 2500 2501 2502 2503 2504 2505 2506 2507
 *	   HOWEVER, it relies on the assumption that any object with ->lookup()
 *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
 *	   we'd better make sure that there's no link(2) for them.
 *	d) some filesystems don't support opened-but-unlinked directories,
 *	   either because of layout or because they are not ready to deal with
 *	   all cases correctly. The latter will be fixed (taking this sort of
 *	   stuff into VFS), but the former is not going away. Solution: the same
 *	   trick as in rmdir().
 *	e) conversion from fhandle to dentry may come in the wrong moment - when
2508
 *	   we are removing the target. Solution: we will have to grab ->i_mutex
L
Linus Torvalds 已提交
2509
 *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
2510
 *	   ->i_mutex on parents, which works but leads to some truely excessive
L
Linus Torvalds 已提交
2511 2512
 *	   locking].
 */
A
Adrian Bunk 已提交
2513 2514
static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
			  struct inode *new_dir, struct dentry *new_dentry)
L
Linus Torvalds 已提交
2515 2516 2517 2518 2519 2520 2521 2522 2523
{
	int error = 0;
	struct inode *target;

	/*
	 * If we are going to change the parent - check write permissions,
	 * we'll need to flip '..'.
	 */
	if (new_dir != old_dir) {
2524
		error = inode_permission(old_dentry->d_inode, MAY_WRITE);
L
Linus Torvalds 已提交
2525 2526 2527 2528 2529 2530 2531 2532 2533 2534
		if (error)
			return error;
	}

	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		return error;

	target = new_dentry->d_inode;
	if (target) {
2535
		mutex_lock(&target->i_mutex);
L
Linus Torvalds 已提交
2536 2537 2538 2539 2540 2541 2542 2543 2544
		dentry_unhash(new_dentry);
	}
	if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
		error = -EBUSY;
	else 
		error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
	if (target) {
		if (!error)
			target->i_flags |= S_DEAD;
2545
		mutex_unlock(&target->i_mutex);
L
Linus Torvalds 已提交
2546 2547 2548 2549
		if (d_unhashed(new_dentry))
			d_rehash(new_dentry);
		dput(new_dentry);
	}
2550
	if (!error)
2551 2552
		if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
			d_move(old_dentry,new_dentry);
L
Linus Torvalds 已提交
2553 2554 2555
	return error;
}

A
Adrian Bunk 已提交
2556 2557
static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
			    struct inode *new_dir, struct dentry *new_dentry)
L
Linus Torvalds 已提交
2558 2559 2560 2561 2562 2563 2564 2565 2566 2567 2568
{
	struct inode *target;
	int error;

	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		return error;

	dget(new_dentry);
	target = new_dentry->d_inode;
	if (target)
2569
		mutex_lock(&target->i_mutex);
L
Linus Torvalds 已提交
2570 2571 2572 2573 2574
	if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
		error = -EBUSY;
	else
		error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
	if (!error) {
2575
		if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
L
Linus Torvalds 已提交
2576 2577 2578
			d_move(old_dentry, new_dentry);
	}
	if (target)
2579
		mutex_unlock(&target->i_mutex);
L
Linus Torvalds 已提交
2580 2581 2582 2583 2584 2585 2586 2587 2588
	dput(new_dentry);
	return error;
}

int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
	       struct inode *new_dir, struct dentry *new_dentry)
{
	int error;
	int is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
R
Robert Love 已提交
2589
	const char *old_name;
L
Linus Torvalds 已提交
2590 2591 2592 2593 2594 2595 2596 2597 2598

	if (old_dentry->d_inode == new_dentry->d_inode)
 		return 0;
 
	error = may_delete(old_dir, old_dentry, is_dir);
	if (error)
		return error;

	if (!new_dentry->d_inode)
2599
		error = may_create(new_dir, new_dentry);
L
Linus Torvalds 已提交
2600 2601 2602 2603 2604
	else
		error = may_delete(new_dir, new_dentry, is_dir);
	if (error)
		return error;

A
Al Viro 已提交
2605
	if (!old_dir->i_op->rename)
L
Linus Torvalds 已提交
2606 2607 2608 2609 2610
		return -EPERM;

	DQUOT_INIT(old_dir);
	DQUOT_INIT(new_dir);

R
Robert Love 已提交
2611 2612
	old_name = fsnotify_oldname_init(old_dentry->d_name.name);

L
Linus Torvalds 已提交
2613 2614 2615 2616 2617
	if (is_dir)
		error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
	else
		error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
	if (!error) {
R
Robert Love 已提交
2618
		const char *new_name = old_dentry->d_name.name;
2619
		fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir,
2620
			      new_dentry->d_inode, old_dentry);
L
Linus Torvalds 已提交
2621
	}
R
Robert Love 已提交
2622 2623
	fsnotify_oldname_free(old_name);

L
Linus Torvalds 已提交
2624 2625 2626
	return error;
}

2627 2628
asmlinkage long sys_renameat(int olddfd, const char __user *oldname,
			     int newdfd, const char __user *newname)
L
Linus Torvalds 已提交
2629
{
2630 2631 2632
	struct dentry *old_dir, *new_dir;
	struct dentry *old_dentry, *new_dentry;
	struct dentry *trap;
L
Linus Torvalds 已提交
2633
	struct nameidata oldnd, newnd;
2634 2635 2636
	char *from;
	char *to;
	int error;
L
Linus Torvalds 已提交
2637

2638
	error = user_path_parent(olddfd, oldname, &oldnd, &from);
L
Linus Torvalds 已提交
2639 2640 2641
	if (error)
		goto exit;

2642
	error = user_path_parent(newdfd, newname, &newnd, &to);
L
Linus Torvalds 已提交
2643 2644 2645 2646
	if (error)
		goto exit1;

	error = -EXDEV;
2647
	if (oldnd.path.mnt != newnd.path.mnt)
L
Linus Torvalds 已提交
2648 2649
		goto exit2;

2650
	old_dir = oldnd.path.dentry;
L
Linus Torvalds 已提交
2651 2652 2653 2654
	error = -EBUSY;
	if (oldnd.last_type != LAST_NORM)
		goto exit2;

2655
	new_dir = newnd.path.dentry;
L
Linus Torvalds 已提交
2656 2657 2658
	if (newnd.last_type != LAST_NORM)
		goto exit2;

2659 2660
	oldnd.flags &= ~LOOKUP_PARENT;
	newnd.flags &= ~LOOKUP_PARENT;
2661
	newnd.flags |= LOOKUP_RENAME_TARGET;
2662

L
Linus Torvalds 已提交
2663 2664
	trap = lock_rename(new_dir, old_dir);

2665
	old_dentry = lookup_hash(&oldnd);
L
Linus Torvalds 已提交
2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684
	error = PTR_ERR(old_dentry);
	if (IS_ERR(old_dentry))
		goto exit3;
	/* source must exist */
	error = -ENOENT;
	if (!old_dentry->d_inode)
		goto exit4;
	/* unless the source is a directory trailing slashes give -ENOTDIR */
	if (!S_ISDIR(old_dentry->d_inode->i_mode)) {
		error = -ENOTDIR;
		if (oldnd.last.name[oldnd.last.len])
			goto exit4;
		if (newnd.last.name[newnd.last.len])
			goto exit4;
	}
	/* source should not be ancestor of target */
	error = -EINVAL;
	if (old_dentry == trap)
		goto exit4;
2685
	new_dentry = lookup_hash(&newnd);
L
Linus Torvalds 已提交
2686 2687 2688 2689 2690 2691 2692 2693
	error = PTR_ERR(new_dentry);
	if (IS_ERR(new_dentry))
		goto exit4;
	/* target should not be an ancestor of source */
	error = -ENOTEMPTY;
	if (new_dentry == trap)
		goto exit5;

2694 2695 2696
	error = mnt_want_write(oldnd.path.mnt);
	if (error)
		goto exit5;
2697 2698 2699 2700
	error = security_path_rename(&oldnd.path, old_dentry,
				     &newnd.path, new_dentry);
	if (error)
		goto exit6;
L
Linus Torvalds 已提交
2701 2702
	error = vfs_rename(old_dir->d_inode, old_dentry,
				   new_dir->d_inode, new_dentry);
2703
exit6:
2704
	mnt_drop_write(oldnd.path.mnt);
L
Linus Torvalds 已提交
2705 2706 2707 2708 2709 2710 2711
exit5:
	dput(new_dentry);
exit4:
	dput(old_dentry);
exit3:
	unlock_rename(new_dir, old_dir);
exit2:
J
Jan Blunck 已提交
2712
	path_put(&newnd.path);
2713
	putname(to);
L
Linus Torvalds 已提交
2714
exit1:
J
Jan Blunck 已提交
2715
	path_put(&oldnd.path);
L
Linus Torvalds 已提交
2716
	putname(from);
2717
exit:
L
Linus Torvalds 已提交
2718 2719 2720
	return error;
}

2721 2722 2723 2724 2725
asmlinkage long sys_rename(const char __user *oldname, const char __user *newname)
{
	return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname);
}

L
Linus Torvalds 已提交
2726 2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750
int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
{
	int len;

	len = PTR_ERR(link);
	if (IS_ERR(link))
		goto out;

	len = strlen(link);
	if (len > (unsigned) buflen)
		len = buflen;
	if (copy_to_user(buffer, link, len))
		len = -EFAULT;
out:
	return len;
}

/*
 * A helper for ->readlink().  This should be used *ONLY* for symlinks that
 * have ->follow_link() touching nd only in nd_set_link().  Using (or not
 * using) it for any given inode is up to filesystem.
 */
int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
	struct nameidata nd;
2751
	void *cookie;
2752
	int res;
2753

L
Linus Torvalds 已提交
2754
	nd.depth = 0;
2755
	cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
2756 2757 2758 2759 2760 2761 2762
	if (IS_ERR(cookie))
		return PTR_ERR(cookie);

	res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
	if (dentry->d_inode->i_op->put_link)
		dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
	return res;
L
Linus Torvalds 已提交
2763 2764 2765 2766 2767 2768 2769 2770 2771 2772
}

int vfs_follow_link(struct nameidata *nd, const char *link)
{
	return __vfs_follow_link(nd, link);
}

/* get the link contents into pagecache */
static char *page_getlink(struct dentry * dentry, struct page **ppage)
{
2773 2774
	char *kaddr;
	struct page *page;
L
Linus Torvalds 已提交
2775
	struct address_space *mapping = dentry->d_inode->i_mapping;
2776
	page = read_mapping_page(mapping, 0, NULL);
L
Linus Torvalds 已提交
2777
	if (IS_ERR(page))
2778
		return (char*)page;
L
Linus Torvalds 已提交
2779
	*ppage = page;
2780 2781 2782
	kaddr = kmap(page);
	nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1);
	return kaddr;
L
Linus Torvalds 已提交
2783 2784 2785 2786 2787 2788 2789 2790 2791 2792 2793 2794 2795 2796
}

int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
	struct page *page = NULL;
	char *s = page_getlink(dentry, &page);
	int res = vfs_readlink(dentry,buffer,buflen,s);
	if (page) {
		kunmap(page);
		page_cache_release(page);
	}
	return res;
}

2797
void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
L
Linus Torvalds 已提交
2798
{
2799
	struct page *page = NULL;
L
Linus Torvalds 已提交
2800
	nd_set_link(nd, page_getlink(dentry, &page));
2801
	return page;
L
Linus Torvalds 已提交
2802 2803
}

2804
void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
L
Linus Torvalds 已提交
2805
{
2806 2807 2808
	struct page *page = cookie;

	if (page) {
L
Linus Torvalds 已提交
2809 2810 2811 2812 2813
		kunmap(page);
		page_cache_release(page);
	}
}

2814 2815 2816 2817
/*
 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
 */
int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
L
Linus Torvalds 已提交
2818 2819
{
	struct address_space *mapping = inode->i_mapping;
2820
	struct page *page;
2821
	void *fsdata;
2822
	int err;
L
Linus Torvalds 已提交
2823
	char *kaddr;
2824 2825 2826
	unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
	if (nofs)
		flags |= AOP_FLAG_NOFS;
L
Linus Torvalds 已提交
2827

2828
retry:
2829
	err = pagecache_write_begin(NULL, mapping, 0, len-1,
2830
				flags, &page, &fsdata);
L
Linus Torvalds 已提交
2831
	if (err)
2832 2833
		goto fail;

L
Linus Torvalds 已提交
2834 2835 2836
	kaddr = kmap_atomic(page, KM_USER0);
	memcpy(kaddr, symname, len-1);
	kunmap_atomic(kaddr, KM_USER0);
2837 2838 2839

	err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
							page, fsdata);
L
Linus Torvalds 已提交
2840 2841
	if (err < 0)
		goto fail;
2842 2843 2844
	if (err < len-1)
		goto retry;

L
Linus Torvalds 已提交
2845 2846 2847 2848 2849 2850
	mark_inode_dirty(inode);
	return 0;
fail:
	return err;
}

2851 2852 2853
int page_symlink(struct inode *inode, const char *symname, int len)
{
	return __page_symlink(inode, symname, len,
2854
			!(mapping_gfp_mask(inode->i_mapping) & __GFP_FS));
2855 2856
}

2857
const struct inode_operations page_symlink_inode_operations = {
L
Linus Torvalds 已提交
2858 2859 2860 2861 2862
	.readlink	= generic_readlink,
	.follow_link	= page_follow_link_light,
	.put_link	= page_put_link,
};

2863
EXPORT_SYMBOL(user_path_at);
L
Linus Torvalds 已提交
2864 2865 2866 2867 2868 2869 2870 2871 2872
EXPORT_SYMBOL(follow_down);
EXPORT_SYMBOL(follow_up);
EXPORT_SYMBOL(get_write_access); /* binfmt_aout */
EXPORT_SYMBOL(getname);
EXPORT_SYMBOL(lock_rename);
EXPORT_SYMBOL(lookup_one_len);
EXPORT_SYMBOL(page_follow_link_light);
EXPORT_SYMBOL(page_put_link);
EXPORT_SYMBOL(page_readlink);
2873
EXPORT_SYMBOL(__page_symlink);
L
Linus Torvalds 已提交
2874 2875 2876
EXPORT_SYMBOL(page_symlink);
EXPORT_SYMBOL(page_symlink_inode_operations);
EXPORT_SYMBOL(path_lookup);
A
Al Viro 已提交
2877
EXPORT_SYMBOL(kern_path);
2878
EXPORT_SYMBOL(vfs_path_lookup);
2879
EXPORT_SYMBOL(inode_permission);
2880
EXPORT_SYMBOL(file_permission);
L
Linus Torvalds 已提交
2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893 2894
EXPORT_SYMBOL(unlock_rename);
EXPORT_SYMBOL(vfs_create);
EXPORT_SYMBOL(vfs_follow_link);
EXPORT_SYMBOL(vfs_link);
EXPORT_SYMBOL(vfs_mkdir);
EXPORT_SYMBOL(vfs_mknod);
EXPORT_SYMBOL(generic_permission);
EXPORT_SYMBOL(vfs_readlink);
EXPORT_SYMBOL(vfs_rename);
EXPORT_SYMBOL(vfs_rmdir);
EXPORT_SYMBOL(vfs_symlink);
EXPORT_SYMBOL(vfs_unlink);
EXPORT_SYMBOL(dentry_unhash);
EXPORT_SYMBOL(generic_readlink);
A
Al Viro 已提交
2895 2896 2897 2898

/* to be mentioned only in INIT_TASK */
struct fs_struct init_fs = {
	.count		= ATOMIC_INIT(1),
2899
	.lock		= __RW_LOCK_UNLOCKED(init_fs.lock),
A
Al Viro 已提交
2900 2901
	.umask		= 0022,
};