namei.c 122.4 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0
L
Linus Torvalds 已提交
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
/*
 *  linux/fs/namei.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

/*
 * Some corrections by tytso.
 */

/* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
 * lookup logic.
 */
/* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
 */

#include <linux/init.h>
19
#include <linux/export.h>
20
#include <linux/kernel.h>
L
Linus Torvalds 已提交
21 22 23 24
#include <linux/slab.h>
#include <linux/fs.h>
#include <linux/namei.h>
#include <linux/pagemap.h>
R
Robert Love 已提交
25
#include <linux/fsnotify.h>
L
Linus Torvalds 已提交
26 27
#include <linux/personality.h>
#include <linux/security.h>
M
Mimi Zohar 已提交
28
#include <linux/ima.h>
L
Linus Torvalds 已提交
29 30 31
#include <linux/syscalls.h>
#include <linux/mount.h>
#include <linux/audit.h>
32
#include <linux/capability.h>
33
#include <linux/file.h>
34
#include <linux/fcntl.h>
35
#include <linux/device_cgroup.h>
36
#include <linux/fs_struct.h>
37
#include <linux/posix_acl.h>
38
#include <linux/hash.h>
39
#include <linux/bitops.h>
40
#include <linux/init_task.h>
41
#include <linux/uaccess.h>
42
#include <linux/build_bug.h>
L
Linus Torvalds 已提交
43

44
#include "internal.h"
45
#include "mount.h"
46

L
Linus Torvalds 已提交
47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80
/* [Feb-1997 T. Schoebel-Theuer]
 * Fundamental changes in the pathname lookup mechanisms (namei)
 * were necessary because of omirr.  The reason is that omirr needs
 * to know the _real_ pathname, not the user-supplied one, in case
 * of symlinks (and also when transname replacements occur).
 *
 * The new code replaces the old recursive symlink resolution with
 * an iterative one (in case of non-nested symlink chains).  It does
 * this with calls to <fs>_follow_link().
 * As a side effect, dir_namei(), _namei() and follow_link() are now 
 * replaced with a single function lookup_dentry() that can handle all 
 * the special cases of the former code.
 *
 * With the new dcache, the pathname is stored at each inode, at least as
 * long as the refcount of the inode is positive.  As a side effect, the
 * size of the dcache depends on the inode cache and thus is dynamic.
 *
 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
 * resolution to correspond with current state of the code.
 *
 * Note that the symlink resolution is not *completely* iterative.
 * There is still a significant amount of tail- and mid- recursion in
 * the algorithm.  Also, note that <fs>_readlink() is not used in
 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
 * may return different results than <fs>_follow_link().  Many virtual
 * filesystems (including /proc) exhibit this behavior.
 */

/* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
 * and the name already exists in form of a symlink, try to create the new
 * name indicated by the symlink. The old code always complained that the
 * name already exists, due to not following the symlink even if its target
 * is nonexistent.  The new semantics affects also mknod() and link() when
L
Lucas De Marchi 已提交
81
 * the name is a symlink pointing to a non-existent name.
L
Linus Torvalds 已提交
82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113
 *
 * I don't know which semantics is the right one, since I have no access
 * to standards. But I found by trial that HP-UX 9.0 has the full "new"
 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
 * "old" one. Personally, I think the new semantics is much more logical.
 * Note that "ln old new" where "new" is a symlink pointing to a non-existing
 * file does succeed in both HP-UX and SunOs, but not in Solaris
 * and in the old Linux semantics.
 */

/* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
 * semantics.  See the comments in "open_namei" and "do_link" below.
 *
 * [10-Sep-98 Alan Modra] Another symlink change.
 */

/* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
 *	inside the path - always follow.
 *	in the last component in creation/removal/renaming - never follow.
 *	if LOOKUP_FOLLOW passed - follow.
 *	if the pathname has trailing slashes - follow.
 *	otherwise - don't follow.
 * (applied in that order).
 *
 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
 * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
 * During the 2.4 we need to fix the userland stuff depending on it -
 * hopefully we will be able to get rid of that wart in 2.5. So far only
 * XEmacs seems to be relying on it...
 */
/*
 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
114
 * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
L
Linus Torvalds 已提交
115 116 117 118 119 120 121 122 123 124
 * any extra contention...
 */

/* In order to reduce some races, while at the same time doing additional
 * checking and hopefully speeding things up, we copy filenames to the
 * kernel data space before using them..
 *
 * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
 * PATH_MAX includes the nul terminator --RR.
 */
125

A
Al Viro 已提交
126
#define EMBEDDED_NAME_MAX	(PATH_MAX - offsetof(struct filename, iname))
127

128
struct filename *
129 130
getname_flags(const char __user *filename, int flags, int *empty)
{
A
Al Viro 已提交
131
	struct filename *result;
132
	char *kname;
A
Al Viro 已提交
133
	int len;
134
	BUILD_BUG_ON(offsetof(struct filename, iname) % sizeof(long) != 0);
135

136 137 138 139
	result = audit_reusename(filename);
	if (result)
		return result;

140
	result = __getname();
141
	if (unlikely(!result))
142 143
		return ERR_PTR(-ENOMEM);

144 145 146 147
	/*
	 * First, try to embed the struct filename inside the names_cache
	 * allocation
	 */
A
Al Viro 已提交
148
	kname = (char *)result->iname;
149
	result->name = kname;
150

A
Al Viro 已提交
151
	len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
152
	if (unlikely(len < 0)) {
A
Al Viro 已提交
153 154
		__putname(result);
		return ERR_PTR(len);
155
	}
156

157 158 159 160 161 162
	/*
	 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
	 * separate struct filename so we can dedicate the entire
	 * names_cache allocation for the pathname, and re-do the copy from
	 * userland.
	 */
A
Al Viro 已提交
163
	if (unlikely(len == EMBEDDED_NAME_MAX)) {
A
Al Viro 已提交
164
		const size_t size = offsetof(struct filename, iname[1]);
165 166
		kname = (char *)result;

A
Al Viro 已提交
167 168 169 170 171 172
		/*
		 * size is chosen that way we to guarantee that
		 * result->iname[0] is within the same object and that
		 * kname can't be equal to result->iname, no matter what.
		 */
		result = kzalloc(size, GFP_KERNEL);
A
Al Viro 已提交
173 174 175
		if (unlikely(!result)) {
			__putname(kname);
			return ERR_PTR(-ENOMEM);
176 177
		}
		result->name = kname;
A
Al Viro 已提交
178 179 180 181 182 183 184 185 186 187 188
		len = strncpy_from_user(kname, filename, PATH_MAX);
		if (unlikely(len < 0)) {
			__putname(kname);
			kfree(result);
			return ERR_PTR(len);
		}
		if (unlikely(len == PATH_MAX)) {
			__putname(kname);
			kfree(result);
			return ERR_PTR(-ENAMETOOLONG);
		}
189 190
	}

A
Al Viro 已提交
191
	result->refcnt = 1;
192 193 194
	/* The empty path is special. */
	if (unlikely(!len)) {
		if (empty)
195
			*empty = 1;
A
Al Viro 已提交
196 197 198 199
		if (!(flags & LOOKUP_EMPTY)) {
			putname(result);
			return ERR_PTR(-ENOENT);
		}
L
Linus Torvalds 已提交
200
	}
201

202
	result->uptr = filename;
203
	result->aname = NULL;
204 205
	audit_getname(result);
	return result;
L
Linus Torvalds 已提交
206 207
}

208 209
struct filename *
getname(const char __user * filename)
A
Al Viro 已提交
210
{
211
	return getname_flags(filename, 0, NULL);
A
Al Viro 已提交
212 213
}

214 215 216 217
struct filename *
getname_kernel(const char * filename)
{
	struct filename *result;
218
	int len = strlen(filename) + 1;
219 220 221 222 223

	result = __getname();
	if (unlikely(!result))
		return ERR_PTR(-ENOMEM);

224
	if (len <= EMBEDDED_NAME_MAX) {
A
Al Viro 已提交
225
		result->name = (char *)result->iname;
226
	} else if (len <= PATH_MAX) {
227
		const size_t size = offsetof(struct filename, iname[1]);
228 229
		struct filename *tmp;

230
		tmp = kmalloc(size, GFP_KERNEL);
231 232 233 234 235 236 237 238 239 240 241
		if (unlikely(!tmp)) {
			__putname(result);
			return ERR_PTR(-ENOMEM);
		}
		tmp->name = (char *)result;
		result = tmp;
	} else {
		__putname(result);
		return ERR_PTR(-ENAMETOOLONG);
	}
	memcpy((char *)result->name, filename, len);
242 243
	result->uptr = NULL;
	result->aname = NULL;
244
	result->refcnt = 1;
245
	audit_getname(result);
246 247 248 249

	return result;
}

250
void putname(struct filename *name)
L
Linus Torvalds 已提交
251
{
252 253 254 255 256
	BUG_ON(name->refcnt <= 0);

	if (--name->refcnt > 0)
		return;

A
Al Viro 已提交
257
	if (name->name != name->iname) {
258 259 260 261
		__putname(name->name);
		kfree(name);
	} else
		__putname(name);
L
Linus Torvalds 已提交
262 263
}

264 265
static int check_acl(struct inode *inode, int mask)
{
266
#ifdef CONFIG_FS_POSIX_ACL
267 268 269
	struct posix_acl *acl;

	if (mask & MAY_NOT_BLOCK) {
270 271
		acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
	        if (!acl)
272
	                return -EAGAIN;
273
		/* no ->get_acl() calls in RCU mode... */
274
		if (is_uncached_acl(acl))
275
			return -ECHILD;
A
Ari Savolainen 已提交
276
	        return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
277 278
	}

C
Christoph Hellwig 已提交
279 280 281
	acl = get_acl(inode, ACL_TYPE_ACCESS);
	if (IS_ERR(acl))
		return PTR_ERR(acl);
282 283 284 285 286
	if (acl) {
	        int error = posix_acl_permission(inode, acl, mask);
	        posix_acl_release(acl);
	        return error;
	}
287
#endif
288 289 290 291

	return -EAGAIN;
}

292
/*
293
 * This does the basic permission checking
L
Linus Torvalds 已提交
294
 */
295
static int acl_permission_check(struct inode *inode, int mask)
L
Linus Torvalds 已提交
296
{
297
	unsigned int mode = inode->i_mode;
L
Linus Torvalds 已提交
298

299
	if (likely(uid_eq(current_fsuid(), inode->i_uid)))
L
Linus Torvalds 已提交
300 301
		mode >>= 6;
	else {
302
		if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
303
			int error = check_acl(inode, mask);
304 305
			if (error != -EAGAIN)
				return error;
L
Linus Torvalds 已提交
306 307 308 309 310 311 312 313 314
		}

		if (in_group_p(inode->i_gid))
			mode >>= 3;
	}

	/*
	 * If the DACs are ok we don't need any capability check.
	 */
315
	if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
L
Linus Torvalds 已提交
316
		return 0;
317 318 319 320
	return -EACCES;
}

/**
321
 * generic_permission -  check for access rights on a Posix-like filesystem
322
 * @inode:	inode to check access rights for
323
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...)
324 325 326 327
 *
 * Used to check for read/write/execute permissions on a file.
 * We use "fsuid" for this, letting us set arbitrary permissions
 * for filesystem access without changing the "normal" uids which
328 329 330 331 332
 * are used for other things.
 *
 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
 * request cannot be satisfied (eg. requires blocking or too much complexity).
 * It would then be called again in ref-walk mode.
333
 */
334
int generic_permission(struct inode *inode, int mask)
335 336 337 338
{
	int ret;

	/*
339
	 * Do the basic permission checks.
340
	 */
341
	ret = acl_permission_check(inode, mask);
342 343
	if (ret != -EACCES)
		return ret;
L
Linus Torvalds 已提交
344

345 346 347
	if (S_ISDIR(inode->i_mode)) {
		/* DACs are overridable for directories */
		if (!(mask & MAY_WRITE))
348 349
			if (capable_wrt_inode_uidgid(inode,
						     CAP_DAC_READ_SEARCH))
350
				return 0;
351
		if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
L
Linus Torvalds 已提交
352
			return 0;
353 354
		return -EACCES;
	}
L
Linus Torvalds 已提交
355 356 357 358

	/*
	 * Searching includes executable on directories, else just read.
	 */
359
	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
360
	if (mask == MAY_READ)
361
		if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))
L
Linus Torvalds 已提交
362
			return 0;
363 364 365 366 367 368 369 370
	/*
	 * Read/write DACs are always overridable.
	 * Executable DACs are overridable when there is
	 * at least one exec bit set.
	 */
	if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
		if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
			return 0;
L
Linus Torvalds 已提交
371 372 373

	return -EACCES;
}
374
EXPORT_SYMBOL(generic_permission);
L
Linus Torvalds 已提交
375

376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395
/*
 * We _really_ want to just do "generic_permission()" without
 * even looking at the inode->i_op values. So we keep a cache
 * flag in inode->i_opflags, that says "this has not special
 * permission function, use the fast case".
 */
static inline int do_inode_permission(struct inode *inode, int mask)
{
	if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
		if (likely(inode->i_op->permission))
			return inode->i_op->permission(inode, mask);

		/* This gets set once for the inode lifetime */
		spin_lock(&inode->i_lock);
		inode->i_opflags |= IOP_FASTPERM;
		spin_unlock(&inode->i_lock);
	}
	return generic_permission(inode, mask);
}

D
David Howells 已提交
396 397 398
/**
 * sb_permission - Check superblock-level permissions
 * @sb: Superblock of inode to check permission on
399
 * @inode: Inode to check permission on
D
David Howells 已提交
400 401 402 403 404 405 406 407 408 409
 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Separate out file-system wide checks from inode-specific permission checks.
 */
static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
{
	if (unlikely(mask & MAY_WRITE)) {
		umode_t mode = inode->i_mode;

		/* Nobody gets write access to a read-only fs. */
410
		if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
D
David Howells 已提交
411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433
			return -EROFS;
	}
	return 0;
}

/**
 * inode_permission - Check for access rights to a given inode
 * @inode: Inode to check permission on
 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Check for read/write/execute permissions on an inode.  We use fs[ug]id for
 * this, letting us set arbitrary permissions for filesystem access without
 * changing the "normal" UIDs which are used for other things.
 *
 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
 */
int inode_permission(struct inode *inode, int mask)
{
	int retval;

	retval = sb_permission(inode->i_sb, inode, mask);
	if (retval)
		return retval;
434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459

	if (unlikely(mask & MAY_WRITE)) {
		/*
		 * Nobody gets write access to an immutable file.
		 */
		if (IS_IMMUTABLE(inode))
			return -EPERM;

		/*
		 * Updating mtime will likely cause i_uid and i_gid to be
		 * written back improperly if their true value is unknown
		 * to the vfs.
		 */
		if (HAS_UNMAPPED_ID(inode))
			return -EACCES;
	}

	retval = do_inode_permission(inode, mask);
	if (retval)
		return retval;

	retval = devcgroup_inode_permission(inode, mask);
	if (retval)
		return retval;

	return security_inode_permission(inode, mask);
D
David Howells 已提交
460
}
461
EXPORT_SYMBOL(inode_permission);
D
David Howells 已提交
462

J
Jan Blunck 已提交
463 464 465 466 467 468
/**
 * path_get - get a reference to a path
 * @path: path to get the reference to
 *
 * Given a path increment the reference count to the dentry and the vfsmount.
 */
469
void path_get(const struct path *path)
J
Jan Blunck 已提交
470 471 472 473 474 475
{
	mntget(path->mnt);
	dget(path->dentry);
}
EXPORT_SYMBOL(path_get);

J
Jan Blunck 已提交
476 477 478 479 480 481
/**
 * path_put - put a reference to a path
 * @path: path to put the reference to
 *
 * Given a path decrement the reference count to the dentry and the vfsmount.
 */
482
void path_put(const struct path *path)
L
Linus Torvalds 已提交
483
{
J
Jan Blunck 已提交
484 485
	dput(path->dentry);
	mntput(path->mnt);
L
Linus Torvalds 已提交
486
}
J
Jan Blunck 已提交
487
EXPORT_SYMBOL(path_put);
L
Linus Torvalds 已提交
488

489
#define EMBEDDED_LEVELS 2
490 491
struct nameidata {
	struct path	path;
A
Al Viro 已提交
492
	struct qstr	last;
493 494 495
	struct path	root;
	struct inode	*inode; /* path.dentry.d_inode */
	unsigned int	flags;
496
	unsigned	seq, m_seq;
497 498
	int		last_type;
	unsigned	depth;
499
	int		total_link_count;
500 501
	struct saved {
		struct path link;
502
		struct delayed_call done;
503
		const char *name;
504
		unsigned seq;
505
	} *stack, internal[EMBEDDED_LEVELS];
506 507
	struct filename	*name;
	struct nameidata *saved;
508
	struct inode	*link_inode;
509 510
	unsigned	root_seq;
	int		dfd;
511
} __randomize_layout;
512

513
static void set_nameidata(struct nameidata *p, int dfd, struct filename *name)
514
{
515 516
	struct nameidata *old = current->nameidata;
	p->stack = p->internal;
517 518
	p->dfd = dfd;
	p->name = name;
519
	p->total_link_count = old ? old->total_link_count : 0;
520
	p->saved = old;
521
	current->nameidata = p;
522 523
}

524
static void restore_nameidata(void)
525
{
526
	struct nameidata *now = current->nameidata, *old = now->saved;
527 528 529 530

	current->nameidata = old;
	if (old)
		old->total_link_count = now->total_link_count;
531
	if (now->stack != now->internal)
532
		kfree(now->stack);
533 534 535 536
}

static int __nd_alloc_stack(struct nameidata *nd)
{
A
Al Viro 已提交
537 538 539
	struct saved *p;

	if (nd->flags & LOOKUP_RCU) {
540
		p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
A
Al Viro 已提交
541 542 543 544
				  GFP_ATOMIC);
		if (unlikely(!p))
			return -ECHILD;
	} else {
545
		p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
546
				  GFP_KERNEL);
A
Al Viro 已提交
547 548 549
		if (unlikely(!p))
			return -ENOMEM;
	}
550 551 552 553 554
	memcpy(p, nd->internal, sizeof(nd->internal));
	nd->stack = p;
	return 0;
}

555 556 557 558 559 560 561 562 563 564
/**
 * path_connected - Verify that a path->dentry is below path->mnt.mnt_root
 * @path: nameidate to verify
 *
 * Rename can sometimes move a file or directory outside of a bind
 * mount, path_connected allows those cases to be detected.
 */
static bool path_connected(const struct path *path)
{
	struct vfsmount *mnt = path->mnt;
565
	struct super_block *sb = mnt->mnt_sb;
566

567 568
	/* Bind mounts and multi-root filesystems can have disconnected paths */
	if (!(sb->s_iflags & SB_I_MULTIROOT) && (mnt->mnt_root == sb->s_root))
569 570 571 572 573
		return true;

	return is_subdir(path->dentry, mnt->mnt_root);
}

574 575
static inline int nd_alloc_stack(struct nameidata *nd)
{
576
	if (likely(nd->depth != EMBEDDED_LEVELS))
577 578 579 580 581 582
		return 0;
	if (likely(nd->stack != nd->internal))
		return 0;
	return __nd_alloc_stack(nd);
}

583 584 585 586 587
static void drop_links(struct nameidata *nd)
{
	int i = nd->depth;
	while (i--) {
		struct saved *last = nd->stack + i;
588 589
		do_delayed_call(&last->done);
		clear_delayed_call(&last->done);
590 591 592 593 594 595 596 597 598 599 600
	}
}

static void terminate_walk(struct nameidata *nd)
{
	drop_links(nd);
	if (!(nd->flags & LOOKUP_RCU)) {
		int i;
		path_put(&nd->path);
		for (i = 0; i < nd->depth; i++)
			path_put(&nd->stack[i].link);
601 602 603 604
		if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
			path_put(&nd->root);
			nd->root.mnt = NULL;
		}
605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645
	} else {
		nd->flags &= ~LOOKUP_RCU;
		if (!(nd->flags & LOOKUP_ROOT))
			nd->root.mnt = NULL;
		rcu_read_unlock();
	}
	nd->depth = 0;
}

/* path_put is needed afterwards regardless of success or failure */
static bool legitimize_path(struct nameidata *nd,
			    struct path *path, unsigned seq)
{
	int res = __legitimize_mnt(path->mnt, nd->m_seq);
	if (unlikely(res)) {
		if (res > 0)
			path->mnt = NULL;
		path->dentry = NULL;
		return false;
	}
	if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
		path->dentry = NULL;
		return false;
	}
	return !read_seqcount_retry(&path->dentry->d_seq, seq);
}

static bool legitimize_links(struct nameidata *nd)
{
	int i;
	for (i = 0; i < nd->depth; i++) {
		struct saved *last = nd->stack + i;
		if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
			drop_links(nd);
			nd->depth = i + 1;
			return false;
		}
	}
	return true;
}

A
Al Viro 已提交
646
/*
N
Nick Piggin 已提交
647
 * Path walking has 2 modes, rcu-walk and ref-walk (see
A
Al Viro 已提交
648 649
 * Documentation/filesystems/path-lookup.txt).  In situations when we can't
 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
M
Mike Marshall 已提交
650
 * normal reference counts on dentries and vfsmounts to transition to ref-walk
A
Al Viro 已提交
651 652 653 654
 * mode.  Refcounts are grabbed at the last known good point before rcu-walk
 * got stuck, so ref-walk may continue from there. If this is not successful
 * (eg. a seqcount has changed), then failure is returned and it's up to caller
 * to restart the path walk from the beginning in ref-walk mode.
N
Nick Piggin 已提交
655 656 657
 */

/**
A
Al Viro 已提交
658 659
 * unlazy_walk - try to switch to ref-walk mode.
 * @nd: nameidata pathwalk data
660
 * Returns: 0 on success, -ECHILD on failure
N
Nick Piggin 已提交
661
 *
A
Al Viro 已提交
662 663 664
 * unlazy_walk attempts to legitimize the current nd->path and nd->root
 * for ref-walk mode.
 * Must be called from rcu-walk context.
665 666
 * Nothing should touch nameidata between unlazy_walk() failure and
 * terminate_walk().
N
Nick Piggin 已提交
667
 */
A
Al Viro 已提交
668
static int unlazy_walk(struct nameidata *nd)
N
Nick Piggin 已提交
669 670 671 672
{
	struct dentry *parent = nd->path.dentry;

	BUG_ON(!(nd->flags & LOOKUP_RCU));
673

A
Al Viro 已提交
674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714
	nd->flags &= ~LOOKUP_RCU;
	if (unlikely(!legitimize_links(nd)))
		goto out2;
	if (unlikely(!legitimize_path(nd, &nd->path, nd->seq)))
		goto out1;
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
		if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq)))
			goto out;
	}
	rcu_read_unlock();
	BUG_ON(nd->inode != parent->d_inode);
	return 0;

out2:
	nd->path.mnt = NULL;
	nd->path.dentry = NULL;
out1:
	if (!(nd->flags & LOOKUP_ROOT))
		nd->root.mnt = NULL;
out:
	rcu_read_unlock();
	return -ECHILD;
}

/**
 * unlazy_child - try to switch to ref-walk mode.
 * @nd: nameidata pathwalk data
 * @dentry: child of nd->path.dentry
 * @seq: seq number to check dentry against
 * Returns: 0 on success, -ECHILD on failure
 *
 * unlazy_child attempts to legitimize the current nd->path, nd->root and dentry
 * for ref-walk mode.  @dentry must be a path found by a do_lookup call on
 * @nd.  Must be called from rcu-walk context.
 * Nothing should touch nameidata between unlazy_child() failure and
 * terminate_walk().
 */
static int unlazy_child(struct nameidata *nd, struct dentry *dentry, unsigned seq)
{
	BUG_ON(!(nd->flags & LOOKUP_RCU));

715
	nd->flags &= ~LOOKUP_RCU;
716 717 718 719
	if (unlikely(!legitimize_links(nd)))
		goto out2;
	if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq)))
		goto out2;
A
Al Viro 已提交
720
	if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref)))
721
		goto out1;
A
Al Viro 已提交
722

723
	/*
A
Al Viro 已提交
724 725 726 727 728
	 * We need to move both the parent and the dentry from the RCU domain
	 * to be properly refcounted. And the sequence number in the dentry
	 * validates *both* dentry counters, since we checked the sequence
	 * number of the parent after we got the child sequence number. So we
	 * know the parent must still be valid if the child sequence number is
729
	 */
A
Al Viro 已提交
730 731 732 733 734 735
	if (unlikely(!lockref_get_not_dead(&dentry->d_lockref)))
		goto out;
	if (unlikely(read_seqcount_retry(&dentry->d_seq, seq))) {
		rcu_read_unlock();
		dput(dentry);
		goto drop_root_mnt;
A
Al Viro 已提交
736
	}
737 738 739 740 741
	/*
	 * Sequence counts matched. Now make sure that the root is
	 * still valid and get it if required.
	 */
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
742 743 744 745
		if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq))) {
			rcu_read_unlock();
			dput(dentry);
			return -ECHILD;
746
		}
N
Nick Piggin 已提交
747 748
	}

A
Al Viro 已提交
749
	rcu_read_unlock();
N
Nick Piggin 已提交
750
	return 0;
A
Al Viro 已提交
751

752 753 754 755
out2:
	nd->path.mnt = NULL;
out1:
	nd->path.dentry = NULL;
756
out:
A
Al Viro 已提交
757
	rcu_read_unlock();
758 759 760
drop_root_mnt:
	if (!(nd->flags & LOOKUP_ROOT))
		nd->root.mnt = NULL;
N
Nick Piggin 已提交
761 762 763
	return -ECHILD;
}

764
static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
765
{
766 767 768 769
	if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
		return dentry->d_op->d_revalidate(dentry, flags);
	else
		return 1;
770 771
}

772 773 774
/**
 * complete_walk - successful completion of path walk
 * @nd:  pointer nameidata
775
 *
776 777 778 779 780
 * If we had been in RCU mode, drop out of it and legitimize nd->path.
 * Revalidate the final result, unless we'd already done that during
 * the path walk or the filesystem doesn't ask for it.  Return 0 on
 * success, -error on failure.  In case of failure caller does not
 * need to drop nd->path.
781
 */
782
static int complete_walk(struct nameidata *nd)
783
{
A
Al Viro 已提交
784
	struct dentry *dentry = nd->path.dentry;
785 786
	int status;

787 788 789
	if (nd->flags & LOOKUP_RCU) {
		if (!(nd->flags & LOOKUP_ROOT))
			nd->root.mnt = NULL;
A
Al Viro 已提交
790
		if (unlikely(unlazy_walk(nd)))
791 792 793
			return -ECHILD;
	}

A
Al Viro 已提交
794 795 796
	if (likely(!(nd->flags & LOOKUP_JUMPED)))
		return 0;

797
	if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
798 799
		return 0;

800
	status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
801 802 803
	if (status > 0)
		return 0;

A
Al Viro 已提交
804
	if (!status)
805
		status = -ESTALE;
A
Al Viro 已提交
806

807 808 809
	return status;
}

A
Al Viro 已提交
810
static void set_root(struct nameidata *nd)
N
Nick Piggin 已提交
811
{
812
	struct fs_struct *fs = current->fs;
N
Nick Piggin 已提交
813

814 815 816 817 818 819 820 821 822 823 824
	if (nd->flags & LOOKUP_RCU) {
		unsigned seq;

		do {
			seq = read_seqcount_begin(&fs->seq);
			nd->root = fs->root;
			nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
		} while (read_seqcount_retry(&fs->seq, seq));
	} else {
		get_fs_root(fs, &nd->root);
	}
N
Nick Piggin 已提交
825 826
}

J
Jan Blunck 已提交
827
static void path_put_conditional(struct path *path, struct nameidata *nd)
828 829
{
	dput(path->dentry);
830
	if (path->mnt != nd->path.mnt)
831 832 833
		mntput(path->mnt);
}

834 835
static inline void path_to_nameidata(const struct path *path,
					struct nameidata *nd)
836
{
N
Nick Piggin 已提交
837 838 839 840
	if (!(nd->flags & LOOKUP_RCU)) {
		dput(nd->path.dentry);
		if (nd->path.mnt != path->mnt)
			mntput(nd->path.mnt);
841
	}
N
Nick Piggin 已提交
842
	nd->path.mnt = path->mnt;
843
	nd->path.dentry = path->dentry;
844 845
}

846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865
static int nd_jump_root(struct nameidata *nd)
{
	if (nd->flags & LOOKUP_RCU) {
		struct dentry *d;
		nd->path = nd->root;
		d = nd->path.dentry;
		nd->inode = d->d_inode;
		nd->seq = nd->root_seq;
		if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq)))
			return -ECHILD;
	} else {
		path_put(&nd->path);
		nd->path = nd->root;
		path_get(&nd->path);
		nd->inode = nd->path.dentry->d_inode;
	}
	nd->flags |= LOOKUP_JUMPED;
	return 0;
}

C
Christoph Hellwig 已提交
866
/*
867
 * Helper to directly jump to a known parsed path from ->get_link,
C
Christoph Hellwig 已提交
868 869
 * caller must have taken a reference to path beforehand.
 */
870
void nd_jump_link(struct path *path)
C
Christoph Hellwig 已提交
871
{
872
	struct nameidata *nd = current->nameidata;
C
Christoph Hellwig 已提交
873 874 875 876 877 878 879
	path_put(&nd->path);

	nd->path = *path;
	nd->inode = nd->path.dentry->d_inode;
	nd->flags |= LOOKUP_JUMPED;
}

880
static inline void put_link(struct nameidata *nd)
881
{
A
Al Viro 已提交
882
	struct saved *last = nd->stack + --nd->depth;
883
	do_delayed_call(&last->done);
A
Al Viro 已提交
884 885
	if (!(nd->flags & LOOKUP_RCU))
		path_put(&last->link);
886 887
}

888 889
int sysctl_protected_symlinks __read_mostly = 0;
int sysctl_protected_hardlinks __read_mostly = 0;
K
Kees Cook 已提交
890 891 892

/**
 * may_follow_link - Check symlink following for unsafe situations
893
 * @nd: nameidata pathwalk data
K
Kees Cook 已提交
894 895 896 897 898 899 900 901 902 903 904 905
 *
 * In the case of the sysctl_protected_symlinks sysctl being enabled,
 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
 * in a sticky world-writable directory. This is to protect privileged
 * processes from failing races against path names that may change out
 * from under them by way of other users creating malicious symlinks.
 * It will permit symlinks to be followed only when outside a sticky
 * world-writable directory, or when the uid of the symlink and follower
 * match, or when the directory owner matches the symlink's owner.
 *
 * Returns 0 if following the symlink is allowed, -ve on error.
 */
A
Al Viro 已提交
906
static inline int may_follow_link(struct nameidata *nd)
K
Kees Cook 已提交
907 908 909
{
	const struct inode *inode;
	const struct inode *parent;
910
	kuid_t puid;
K
Kees Cook 已提交
911 912 913 914 915

	if (!sysctl_protected_symlinks)
		return 0;

	/* Allowed if owner and follower match. */
916
	inode = nd->link_inode;
917
	if (uid_eq(current_cred()->fsuid, inode->i_uid))
K
Kees Cook 已提交
918 919 920
		return 0;

	/* Allowed if parent directory not sticky and world-writable. */
A
Al Viro 已提交
921
	parent = nd->inode;
K
Kees Cook 已提交
922 923 924 925
	if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
		return 0;

	/* Allowed if parent directory and link owner match. */
926 927
	puid = parent->i_uid;
	if (uid_valid(puid) && uid_eq(puid, inode->i_uid))
K
Kees Cook 已提交
928 929
		return 0;

930 931 932
	if (nd->flags & LOOKUP_RCU)
		return -ECHILD;

933
	audit_inode(nd->name, nd->stack[0].link.dentry, 0);
934
	audit_log_link_denied("follow_link");
K
Kees Cook 已提交
935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980
	return -EACCES;
}

/**
 * safe_hardlink_source - Check for safe hardlink conditions
 * @inode: the source inode to hardlink from
 *
 * Return false if at least one of the following conditions:
 *    - inode is not a regular file
 *    - inode is setuid
 *    - inode is setgid and group-exec
 *    - access failure for read and write
 *
 * Otherwise returns true.
 */
static bool safe_hardlink_source(struct inode *inode)
{
	umode_t mode = inode->i_mode;

	/* Special files should not get pinned to the filesystem. */
	if (!S_ISREG(mode))
		return false;

	/* Setuid files should not get pinned to the filesystem. */
	if (mode & S_ISUID)
		return false;

	/* Executable setgid files should not get pinned to the filesystem. */
	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
		return false;

	/* Hardlinking to unreadable or unwritable sources is dangerous. */
	if (inode_permission(inode, MAY_READ | MAY_WRITE))
		return false;

	return true;
}

/**
 * may_linkat - Check permissions for creating a hardlink
 * @link: the source to hardlink from
 *
 * Block hardlink when all of:
 *  - sysctl_protected_hardlinks enabled
 *  - fsuid does not match inode
 *  - hardlink source is unsafe (see safe_hardlink_source() above)
981
 *  - not CAP_FOWNER in a namespace with the inode owner uid mapped
K
Kees Cook 已提交
982 983 984 985 986
 *
 * Returns 0 if successful, -ve on error.
 */
static int may_linkat(struct path *link)
{
987 988 989 990 991
	struct inode *inode = link->dentry->d_inode;

	/* Inode writeback is not safe when the uid or gid are invalid. */
	if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
		return -EOVERFLOW;
K
Kees Cook 已提交
992 993 994 995 996 997 998

	if (!sysctl_protected_hardlinks)
		return 0;

	/* Source inode owner (or CAP_FOWNER) can hardlink all they like,
	 * otherwise, it must be a safe source.
	 */
999
	if (safe_hardlink_source(inode) || inode_owner_or_capable(inode))
K
Kees Cook 已提交
1000 1001
		return 0;

1002
	audit_log_link_denied("linkat");
K
Kees Cook 已提交
1003 1004 1005
	return -EPERM;
}

1006 1007
static __always_inline
const char *get_link(struct nameidata *nd)
L
Linus Torvalds 已提交
1008
{
1009
	struct saved *last = nd->stack + nd->depth - 1;
A
Al Viro 已提交
1010
	struct dentry *dentry = last->link.dentry;
1011
	struct inode *inode = nd->link_inode;
1012
	int error;
1013
	const char *res;
L
Linus Torvalds 已提交
1014

1015 1016 1017
	if (!(nd->flags & LOOKUP_RCU)) {
		touch_atime(&last->link);
		cond_resched();
1018
	} else if (atime_needs_update_rcu(&last->link, inode)) {
A
Al Viro 已提交
1019
		if (unlikely(unlazy_walk(nd)))
A
Al Viro 已提交
1020
			return ERR_PTR(-ECHILD);
1021
		touch_atime(&last->link);
A
Al Viro 已提交
1022
	}
1023

1024 1025 1026
	error = security_inode_follow_link(dentry, inode,
					   nd->flags & LOOKUP_RCU);
	if (unlikely(error))
1027
		return ERR_PTR(error);
1028

1029
	nd->last_type = LAST_BIND;
1030 1031
	res = inode->i_link;
	if (!res) {
1032 1033 1034
		const char * (*get)(struct dentry *, struct inode *,
				struct delayed_call *);
		get = inode->i_op->get_link;
1035
		if (nd->flags & LOOKUP_RCU) {
1036
			res = get(NULL, inode, &last->done);
1037
			if (res == ERR_PTR(-ECHILD)) {
A
Al Viro 已提交
1038
				if (unlikely(unlazy_walk(nd)))
1039
					return ERR_PTR(-ECHILD);
1040
				res = get(dentry, inode, &last->done);
1041 1042
			}
		} else {
1043
			res = get(dentry, inode, &last->done);
1044
		}
1045
		if (IS_ERR_OR_NULL(res))
1046 1047 1048
			return res;
	}
	if (*res == '/') {
1049 1050
		if (!nd->root.mnt)
			set_root(nd);
1051 1052
		if (unlikely(nd_jump_root(nd)))
			return ERR_PTR(-ECHILD);
1053 1054
		while (unlikely(*++res == '/'))
			;
L
Linus Torvalds 已提交
1055
	}
1056 1057
	if (!*res)
		res = NULL;
1058 1059
	return res;
}
1060

1061 1062 1063 1064 1065 1066 1067 1068 1069 1070
/*
 * follow_up - Find the mountpoint of path's vfsmount
 *
 * Given a path, find the mountpoint of its source file system.
 * Replace @path with the path of the mountpoint in the parent mount.
 * Up is towards /.
 *
 * Return 1 if we went up a level and 0 if we were already at the
 * root.
 */
A
Al Viro 已提交
1071
int follow_up(struct path *path)
L
Linus Torvalds 已提交
1072
{
1073 1074
	struct mount *mnt = real_mount(path->mnt);
	struct mount *parent;
L
Linus Torvalds 已提交
1075
	struct dentry *mountpoint;
N
Nick Piggin 已提交
1076

A
Al Viro 已提交
1077
	read_seqlock_excl(&mount_lock);
1078
	parent = mnt->mnt_parent;
A
Al Viro 已提交
1079
	if (parent == mnt) {
A
Al Viro 已提交
1080
		read_sequnlock_excl(&mount_lock);
L
Linus Torvalds 已提交
1081 1082
		return 0;
	}
1083
	mntget(&parent->mnt);
1084
	mountpoint = dget(mnt->mnt_mountpoint);
A
Al Viro 已提交
1085
	read_sequnlock_excl(&mount_lock);
A
Al Viro 已提交
1086 1087 1088
	dput(path->dentry);
	path->dentry = mountpoint;
	mntput(path->mnt);
1089
	path->mnt = &parent->mnt;
L
Linus Torvalds 已提交
1090 1091
	return 1;
}
1092
EXPORT_SYMBOL(follow_up);
L
Linus Torvalds 已提交
1093

N
Nick Piggin 已提交
1094
/*
1095 1096 1097
 * Perform an automount
 * - return -EISDIR to tell follow_managed() to stop and return the path we
 *   were called with.
L
Linus Torvalds 已提交
1098
 */
1099
static int follow_automount(struct path *path, struct nameidata *nd,
1100
			    bool *need_mntput)
N
Nick Piggin 已提交
1101
{
1102
	struct vfsmount *mnt;
1103
	int err;
1104 1105 1106 1107

	if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
		return -EREMOTE;

1108 1109 1110 1111 1112 1113 1114 1115 1116 1117
	/* We don't want to mount if someone's just doing a stat -
	 * unless they're stat'ing a directory and appended a '/' to
	 * the name.
	 *
	 * We do, however, want to mount if someone wants to open or
	 * create a file of any type under the mountpoint, wants to
	 * traverse through the mountpoint or wants to open the
	 * mounted directory.  Also, autofs may mark negative dentries
	 * as being automount points.  These will need the attentions
	 * of the daemon to instantiate them before they can be used.
1118
	 */
1119
	if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
1120 1121 1122
			   LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
	    path->dentry->d_inode)
		return -EISDIR;
1123

1124 1125
	nd->total_link_count++;
	if (nd->total_link_count >= 40)
1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138
		return -ELOOP;

	mnt = path->dentry->d_op->d_automount(path);
	if (IS_ERR(mnt)) {
		/*
		 * The filesystem is allowed to return -EISDIR here to indicate
		 * it doesn't want to automount.  For instance, autofs would do
		 * this so that its userspace daemon can mount on this dentry.
		 *
		 * However, we can only permit this if it's a terminal point in
		 * the path being looked up; if it wasn't then the remainder of
		 * the path is inaccessible and we should say so.
		 */
1139
		if (PTR_ERR(mnt) == -EISDIR && (nd->flags & LOOKUP_PARENT))
1140 1141
			return -EREMOTE;
		return PTR_ERR(mnt);
N
Nick Piggin 已提交
1142
	}
1143

1144 1145
	if (!mnt) /* mount collision */
		return 0;
N
Nick Piggin 已提交
1146

1147 1148 1149 1150 1151
	if (!*need_mntput) {
		/* lock_mount() may release path->mnt on error */
		mntget(path->mnt);
		*need_mntput = true;
	}
1152
	err = finish_automount(mnt, path);
1153

1154 1155 1156
	switch (err) {
	case -EBUSY:
		/* Someone else made a mount here whilst we were busy */
1157
		return 0;
1158
	case 0:
1159
		path_put(path);
1160 1161 1162
		path->mnt = mnt;
		path->dentry = dget(mnt->mnt_root);
		return 0;
1163 1164
	default:
		return err;
1165
	}
1166

A
Al Viro 已提交
1167 1168
}

1169 1170
/*
 * Handle a dentry that is managed in some way.
1171
 * - Flagged for transit management (autofs)
1172 1173 1174 1175 1176 1177 1178
 * - Flagged as mountpoint
 * - Flagged as automount point
 *
 * This may only be called in refwalk mode.
 *
 * Serialization is taken care of in namespace.c
 */
1179
static int follow_managed(struct path *path, struct nameidata *nd)
L
Linus Torvalds 已提交
1180
{
1181
	struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */
1182 1183
	unsigned managed;
	bool need_mntput = false;
1184
	int ret = 0;
1185 1186 1187 1188

	/* Given that we're not holding a lock here, we retain the value in a
	 * local variable for each dentry as we look at it so that we don't see
	 * the components of that value change under us */
1189
	while (managed = READ_ONCE(path->dentry->d_flags),
1190 1191
	       managed &= DCACHE_MANAGED_DENTRY,
	       unlikely(managed != 0)) {
1192 1193 1194 1195 1196
		/* Allow the filesystem to manage the transit without i_mutex
		 * being held. */
		if (managed & DCACHE_MANAGE_TRANSIT) {
			BUG_ON(!path->dentry->d_op);
			BUG_ON(!path->dentry->d_op->d_manage);
1197
			ret = path->dentry->d_op->d_manage(path, false);
1198
			if (ret < 0)
1199
				break;
1200 1201
		}

1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216
		/* Transit to a mounted filesystem. */
		if (managed & DCACHE_MOUNTED) {
			struct vfsmount *mounted = lookup_mnt(path);
			if (mounted) {
				dput(path->dentry);
				if (need_mntput)
					mntput(path->mnt);
				path->mnt = mounted;
				path->dentry = dget(mounted->mnt_root);
				need_mntput = true;
				continue;
			}

			/* Something is mounted on this dentry in another
			 * namespace and/or whatever was mounted there in this
A
Al Viro 已提交
1217 1218
			 * namespace got unmounted before lookup_mnt() could
			 * get it */
1219 1220 1221 1222
		}

		/* Handle an automount point */
		if (managed & DCACHE_NEED_AUTOMOUNT) {
1223
			ret = follow_automount(path, nd, &need_mntput);
1224
			if (ret < 0)
1225
				break;
1226 1227 1228 1229 1230
			continue;
		}

		/* We didn't change the current path point */
		break;
L
Linus Torvalds 已提交
1231
	}
1232 1233 1234

	if (need_mntput && path->mnt == mnt)
		mntput(path->mnt);
1235 1236
	if (ret == -EISDIR || !ret)
		ret = 1;
1237 1238 1239 1240 1241
	if (need_mntput)
		nd->flags |= LOOKUP_JUMPED;
	if (unlikely(ret < 0))
		path_put_conditional(path, nd);
	return ret;
L
Linus Torvalds 已提交
1242 1243
}

1244
int follow_down_one(struct path *path)
L
Linus Torvalds 已提交
1245 1246 1247
{
	struct vfsmount *mounted;

A
Al Viro 已提交
1248
	mounted = lookup_mnt(path);
L
Linus Torvalds 已提交
1249
	if (mounted) {
A
Al Viro 已提交
1250 1251 1252 1253
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
L
Linus Torvalds 已提交
1254 1255 1256 1257
		return 1;
	}
	return 0;
}
1258
EXPORT_SYMBOL(follow_down_one);
L
Linus Torvalds 已提交
1259

1260
static inline int managed_dentry_rcu(const struct path *path)
1261
{
1262 1263
	return (path->dentry->d_flags & DCACHE_MANAGE_TRANSIT) ?
		path->dentry->d_op->d_manage(path, true) : 0;
1264 1265
}

1266
/*
1267 1268
 * Try to skip to top of mountpoint pile in rcuwalk mode.  Fail if
 * we meet a managed dentry that would need blocking.
1269 1270
 */
static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1271
			       struct inode **inode, unsigned *seqp)
1272
{
1273
	for (;;) {
1274
		struct mount *mounted;
1275 1276 1277 1278
		/*
		 * Don't forget we might have a non-mountpoint managed dentry
		 * that wants to block transit.
		 */
1279
		switch (managed_dentry_rcu(path)) {
1280 1281
		case -ECHILD:
		default:
1282
			return false;
1283 1284 1285 1286 1287
		case -EISDIR:
			return true;
		case 0:
			break;
		}
1288 1289

		if (!d_mountpoint(path->dentry))
1290
			return !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
1291

A
Al Viro 已提交
1292
		mounted = __lookup_mnt(path->mnt, path->dentry);
1293 1294
		if (!mounted)
			break;
1295 1296
		path->mnt = &mounted->mnt;
		path->dentry = mounted->mnt.mnt_root;
1297
		nd->flags |= LOOKUP_JUMPED;
1298
		*seqp = read_seqcount_begin(&path->dentry->d_seq);
1299 1300 1301 1302 1303 1304
		/*
		 * Update the inode too. We don't need to re-check the
		 * dentry sequence number here after this d_inode read,
		 * because a mount-point is always pinned.
		 */
		*inode = path->dentry->d_inode;
1305
	}
1306
	return !read_seqretry(&mount_lock, nd->m_seq) &&
1307
		!(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
1308 1309
}

N
Nick Piggin 已提交
1310 1311
static int follow_dotdot_rcu(struct nameidata *nd)
{
1312
	struct inode *inode = nd->inode;
N
Nick Piggin 已提交
1313

1314
	while (1) {
1315
		if (path_equal(&nd->path, &nd->root))
N
Nick Piggin 已提交
1316 1317 1318 1319 1320 1321
			break;
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
			struct dentry *old = nd->path.dentry;
			struct dentry *parent = old->d_parent;
			unsigned seq;

1322
			inode = parent->d_inode;
N
Nick Piggin 已提交
1323
			seq = read_seqcount_begin(&parent->d_seq);
1324 1325
			if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq)))
				return -ECHILD;
N
Nick Piggin 已提交
1326 1327
			nd->path.dentry = parent;
			nd->seq = seq;
1328 1329
			if (unlikely(!path_connected(&nd->path)))
				return -ENOENT;
N
Nick Piggin 已提交
1330
			break;
1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345
		} else {
			struct mount *mnt = real_mount(nd->path.mnt);
			struct mount *mparent = mnt->mnt_parent;
			struct dentry *mountpoint = mnt->mnt_mountpoint;
			struct inode *inode2 = mountpoint->d_inode;
			unsigned seq = read_seqcount_begin(&mountpoint->d_seq);
			if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
				return -ECHILD;
			if (&mparent->mnt == nd->path.mnt)
				break;
			/* we know that mountpoint was pinned */
			nd->path.dentry = mountpoint;
			nd->path.mnt = &mparent->mnt;
			inode = inode2;
			nd->seq = seq;
N
Nick Piggin 已提交
1346 1347
		}
	}
1348
	while (unlikely(d_mountpoint(nd->path.dentry))) {
1349 1350
		struct mount *mounted;
		mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
1351 1352
		if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
			return -ECHILD;
1353 1354 1355 1356
		if (!mounted)
			break;
		nd->path.mnt = &mounted->mnt;
		nd->path.dentry = mounted->mnt.mnt_root;
1357
		inode = nd->path.dentry->d_inode;
1358 1359
		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
	}
1360
	nd->inode = inode;
N
Nick Piggin 已提交
1361 1362 1363
	return 0;
}

1364 1365 1366 1367 1368
/*
 * Follow down to the covering mount currently visible to userspace.  At each
 * point, the filesystem owning that dentry may be queried as to whether the
 * caller is permitted to proceed or not.
 */
1369
int follow_down(struct path *path)
1370 1371 1372 1373
{
	unsigned managed;
	int ret;

1374
	while (managed = READ_ONCE(path->dentry->d_flags),
1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388
	       unlikely(managed & DCACHE_MANAGED_DENTRY)) {
		/* Allow the filesystem to manage the transit without i_mutex
		 * being held.
		 *
		 * We indicate to the filesystem if someone is trying to mount
		 * something here.  This gives autofs the chance to deny anyone
		 * other than its daemon the right to mount on its
		 * superstructure.
		 *
		 * The filesystem may sleep at this point.
		 */
		if (managed & DCACHE_MANAGE_TRANSIT) {
			BUG_ON(!path->dentry->d_op);
			BUG_ON(!path->dentry->d_op->d_manage);
1389
			ret = path->dentry->d_op->d_manage(path, false);
1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410
			if (ret < 0)
				return ret == -EISDIR ? 0 : ret;
		}

		/* Transit to a mounted filesystem. */
		if (managed & DCACHE_MOUNTED) {
			struct vfsmount *mounted = lookup_mnt(path);
			if (!mounted)
				break;
			dput(path->dentry);
			mntput(path->mnt);
			path->mnt = mounted;
			path->dentry = dget(mounted->mnt_root);
			continue;
		}

		/* Don't handle automount points here */
		break;
	}
	return 0;
}
1411
EXPORT_SYMBOL(follow_down);
1412

1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428
/*
 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot()
 */
static void follow_mount(struct path *path)
{
	while (d_mountpoint(path->dentry)) {
		struct vfsmount *mounted = lookup_mnt(path);
		if (!mounted)
			break;
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
	}
}

1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439
static int path_parent_directory(struct path *path)
{
	struct dentry *old = path->dentry;
	/* rare case of legitimate dget_parent()... */
	path->dentry = dget_parent(path->dentry);
	dput(old);
	if (unlikely(!path_connected(path)))
		return -ENOENT;
	return 0;
}

1440
static int follow_dotdot(struct nameidata *nd)
L
Linus Torvalds 已提交
1441 1442
{
	while(1) {
1443
		if (path_equal(&nd->path, &nd->root))
L
Linus Torvalds 已提交
1444
			break;
1445
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
1446 1447 1448
			int ret = path_parent_directory(&nd->path);
			if (ret)
				return ret;
L
Linus Torvalds 已提交
1449 1450
			break;
		}
A
Al Viro 已提交
1451
		if (!follow_up(&nd->path))
L
Linus Torvalds 已提交
1452 1453
			break;
	}
A
Al Viro 已提交
1454
	follow_mount(&nd->path);
N
Nick Piggin 已提交
1455
	nd->inode = nd->path.dentry->d_inode;
1456
	return 0;
L
Linus Torvalds 已提交
1457 1458
}

1459
/*
1460 1461
 * This looks up the name in dcache and possibly revalidates the found dentry.
 * NULL is returned if the dentry does not exist in the cache.
1462
 */
1463 1464
static struct dentry *lookup_dcache(const struct qstr *name,
				    struct dentry *dir,
1465
				    unsigned int flags)
1466
{
1467
	struct dentry *dentry = d_lookup(dir, name);
M
Miklos Szeredi 已提交
1468
	if (dentry) {
1469 1470 1471 1472 1473 1474
		int error = d_revalidate(dentry, flags);
		if (unlikely(error <= 0)) {
			if (!error)
				d_invalidate(dentry);
			dput(dentry);
			return ERR_PTR(error);
M
Miklos Szeredi 已提交
1475 1476
		}
	}
1477 1478 1479
	return dentry;
}

1480
/*
1481 1482 1483 1484 1485
 * Parent directory has inode locked exclusive.  This is one
 * and only case when ->lookup() gets called on non in-lookup
 * dentries - as the matter of fact, this only gets called
 * when directory is guaranteed to have no in-lookup children
 * at all.
1486
 */
1487
static struct dentry *__lookup_hash(const struct qstr *name,
1488
		struct dentry *base, unsigned int flags)
1489
{
1490
	struct dentry *dentry = lookup_dcache(name, base, flags);
1491 1492
	struct dentry *old;
	struct inode *dir = base->d_inode;
1493

1494
	if (dentry)
M
Miklos Szeredi 已提交
1495
		return dentry;
1496

1497 1498 1499 1500
	/* Don't create child dentry for a dead directory. */
	if (unlikely(IS_DEADDIR(dir)))
		return ERR_PTR(-ENOENT);

1501 1502 1503 1504
	dentry = d_alloc(base, name);
	if (unlikely(!dentry))
		return ERR_PTR(-ENOMEM);

1505 1506 1507 1508 1509 1510
	old = dir->i_op->lookup(dir, dentry, flags);
	if (unlikely(old)) {
		dput(dentry);
		dentry = old;
	}
	return dentry;
1511 1512
}

A
Al Viro 已提交
1513
static int lookup_fast(struct nameidata *nd,
1514 1515
		       struct path *path, struct inode **inode,
		       unsigned *seqp)
L
Linus Torvalds 已提交
1516
{
1517
	struct vfsmount *mnt = nd->path.mnt;
N
Nick Piggin 已提交
1518
	struct dentry *dentry, *parent = nd->path.dentry;
A
Al Viro 已提交
1519
	int status = 1;
1520 1521
	int err;

1522 1523
	/*
	 * Rename seqlock is not required here because in the off chance
A
Al Viro 已提交
1524 1525
	 * of a false negative due to a concurrent rename, the caller is
	 * going to fall back to non-racy lookup.
1526
	 */
N
Nick Piggin 已提交
1527 1528
	if (nd->flags & LOOKUP_RCU) {
		unsigned seq;
1529
		bool negative;
1530
		dentry = __d_lookup_rcu(parent, &nd->last, &seq);
A
Al Viro 已提交
1531
		if (unlikely(!dentry)) {
A
Al Viro 已提交
1532
			if (unlazy_walk(nd))
A
Al Viro 已提交
1533
				return -ECHILD;
1534
			return 0;
A
Al Viro 已提交
1535
		}
A
Al Viro 已提交
1536

1537 1538 1539 1540
		/*
		 * This sequence count validates that the inode matches
		 * the dentry name information from lookup.
		 */
1541
		*inode = d_backing_inode(dentry);
1542
		negative = d_is_negative(dentry);
A
Al Viro 已提交
1543
		if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
1544 1545 1546 1547 1548 1549 1550 1551 1552
			return -ECHILD;

		/*
		 * This sequence count validates that the parent had no
		 * changes while we did the lookup of the dentry above.
		 *
		 * The memory barrier in read_seqcount_begin of child is
		 *  enough, we can use __read_seqcount_retry here.
		 */
A
Al Viro 已提交
1553
		if (unlikely(__read_seqcount_retry(&parent->d_seq, nd->seq)))
N
Nick Piggin 已提交
1554
			return -ECHILD;
A
Al Viro 已提交
1555

1556
		*seqp = seq;
1557
		status = d_revalidate(dentry, nd->flags);
1558
		if (likely(status > 0)) {
A
Al Viro 已提交
1559 1560 1561 1562 1563 1564 1565 1566 1567
			/*
			 * Note: do negative dentry check after revalidation in
			 * case that drops it.
			 */
			if (unlikely(negative))
				return -ENOENT;
			path->mnt = mnt;
			path->dentry = dentry;
			if (likely(__follow_mount_rcu(nd, path, inode, seqp)))
1568
				return 1;
1569
		}
A
Al Viro 已提交
1570
		if (unlazy_child(nd, dentry, seq))
1571 1572 1573 1574
			return -ECHILD;
		if (unlikely(status == -ECHILD))
			/* we'd been told to redo it in non-rcu mode */
			status = d_revalidate(dentry, nd->flags);
A
Al Viro 已提交
1575
	} else {
A
Al Viro 已提交
1576
		dentry = __d_lookup(parent, &nd->last);
A
Al Viro 已提交
1577
		if (unlikely(!dentry))
1578
			return 0;
1579
		status = d_revalidate(dentry, nd->flags);
1580
	}
A
Al Viro 已提交
1581
	if (unlikely(status <= 0)) {
1582
		if (!status)
A
Al Viro 已提交
1583
			d_invalidate(dentry);
1584
		dput(dentry);
A
Al Viro 已提交
1585
		return status;
1586
	}
1587 1588 1589 1590
	if (unlikely(d_is_negative(dentry))) {
		dput(dentry);
		return -ENOENT;
	}
A
Al Viro 已提交
1591

1592 1593
	path->mnt = mnt;
	path->dentry = dentry;
1594
	err = follow_managed(path, nd);
1595
	if (likely(err > 0))
1596
		*inode = d_backing_inode(path->dentry);
1597
	return err;
M
Miklos Szeredi 已提交
1598 1599 1600
}

/* Fast lookup failed, do it the slow way */
A
Al Viro 已提交
1601 1602 1603
static struct dentry *__lookup_slow(const struct qstr *name,
				    struct dentry *dir,
				    unsigned int flags)
M
Miklos Szeredi 已提交
1604
{
A
Al Viro 已提交
1605
	struct dentry *dentry, *old;
1606
	struct inode *inode = dir->d_inode;
1607
	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
1608 1609

	/* Don't go there if it's already dead */
A
Al Viro 已提交
1610
	if (unlikely(IS_DEADDIR(inode)))
A
Al Viro 已提交
1611
		return ERR_PTR(-ENOENT);
A
Al Viro 已提交
1612
again:
1613
	dentry = d_alloc_parallel(dir, name, &wq);
A
Al Viro 已提交
1614
	if (IS_ERR(dentry))
A
Al Viro 已提交
1615
		return dentry;
A
Al Viro 已提交
1616
	if (unlikely(!d_in_lookup(dentry))) {
1617
		if (!(flags & LOOKUP_NO_REVAL)) {
1618 1619
			int error = d_revalidate(dentry, flags);
			if (unlikely(error <= 0)) {
A
Al Viro 已提交
1620
				if (!error) {
1621
					d_invalidate(dentry);
A
Al Viro 已提交
1622 1623 1624
					dput(dentry);
					goto again;
				}
1625 1626 1627 1628
				dput(dentry);
				dentry = ERR_PTR(error);
			}
		}
A
Al Viro 已提交
1629 1630 1631 1632 1633 1634
	} else {
		old = inode->i_op->lookup(inode, dentry, flags);
		d_lookup_done(dentry);
		if (unlikely(old)) {
			dput(dentry);
			dentry = old;
1635 1636
		}
	}
1637
	return dentry;
L
Linus Torvalds 已提交
1638 1639
}

A
Al Viro 已提交
1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651
static struct dentry *lookup_slow(const struct qstr *name,
				  struct dentry *dir,
				  unsigned int flags)
{
	struct inode *inode = dir->d_inode;
	struct dentry *res;
	inode_lock_shared(inode);
	res = __lookup_slow(name, dir, flags);
	inode_unlock_shared(inode);
	return res;
}

1652 1653 1654
static inline int may_lookup(struct nameidata *nd)
{
	if (nd->flags & LOOKUP_RCU) {
1655
		int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1656 1657
		if (err != -ECHILD)
			return err;
A
Al Viro 已提交
1658
		if (unlazy_walk(nd))
1659 1660
			return -ECHILD;
	}
1661
	return inode_permission(nd->inode, MAY_EXEC);
1662 1663
}

1664 1665 1666
static inline int handle_dots(struct nameidata *nd, int type)
{
	if (type == LAST_DOTDOT) {
1667 1668
		if (!nd->root.mnt)
			set_root(nd);
1669
		if (nd->flags & LOOKUP_RCU) {
1670
			return follow_dotdot_rcu(nd);
1671
		} else
1672
			return follow_dotdot(nd);
1673 1674 1675 1676
	}
	return 0;
}

1677 1678
static int pick_link(struct nameidata *nd, struct path *link,
		     struct inode *inode, unsigned seq)
1679
{
1680
	int error;
A
Al Viro 已提交
1681
	struct saved *last;
1682
	if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) {
1683 1684 1685
		path_to_nameidata(link, nd);
		return -ELOOP;
	}
A
Al Viro 已提交
1686
	if (!(nd->flags & LOOKUP_RCU)) {
1687 1688
		if (link->mnt == nd->path.mnt)
			mntget(link->mnt);
1689
	}
1690 1691
	error = nd_alloc_stack(nd);
	if (unlikely(error)) {
A
Al Viro 已提交
1692
		if (error == -ECHILD) {
1693 1694 1695 1696 1697 1698 1699 1700 1701
			if (unlikely(!legitimize_path(nd, link, seq))) {
				drop_links(nd);
				nd->depth = 0;
				nd->flags &= ~LOOKUP_RCU;
				nd->path.mnt = NULL;
				nd->path.dentry = NULL;
				if (!(nd->flags & LOOKUP_ROOT))
					nd->root.mnt = NULL;
				rcu_read_unlock();
A
Al Viro 已提交
1702
			} else if (likely(unlazy_walk(nd)) == 0)
1703
				error = nd_alloc_stack(nd);
A
Al Viro 已提交
1704 1705 1706 1707 1708
		}
		if (error) {
			path_put(link);
			return error;
		}
1709 1710
	}

1711
	last = nd->stack + nd->depth++;
A
Al Viro 已提交
1712
	last->link = *link;
1713 1714
	clear_delayed_call(&last->done);
	nd->link_inode = inode;
1715
	last->seq = seq;
1716 1717 1718
	return 1;
}

1719
enum {WALK_FOLLOW = 1, WALK_MORE = 2};
1720

1721 1722 1723 1724 1725 1726
/*
 * Do we need to follow links? We _really_ want to be able
 * to do this check without having to look at inode->i_op,
 * so we keep a cache of "no, this doesn't need follow_link"
 * for the common case.
 */
1727 1728
static inline int step_into(struct nameidata *nd, struct path *path,
			    int flags, struct inode *inode, unsigned seq)
1729
{
1730 1731
	if (!(flags & WALK_MORE) && nd->depth)
		put_link(nd);
1732 1733 1734 1735 1736 1737
	if (likely(!d_is_symlink(path->dentry)) ||
	   !(flags & WALK_FOLLOW || nd->flags & LOOKUP_FOLLOW)) {
		/* not a symlink or should not follow */
		path_to_nameidata(path, nd);
		nd->inode = inode;
		nd->seq = seq;
1738
		return 0;
1739
	}
1740 1741
	/* make sure that d_is_symlink above matches inode */
	if (nd->flags & LOOKUP_RCU) {
1742
		if (read_seqcount_retry(&path->dentry->d_seq, seq))
1743 1744
			return -ECHILD;
	}
1745
	return pick_link(nd, path, inode, seq);
1746 1747
}

1748
static int walk_component(struct nameidata *nd, int flags)
1749
{
A
Al Viro 已提交
1750
	struct path path;
1751
	struct inode *inode;
1752
	unsigned seq;
1753 1754 1755 1756 1757 1758
	int err;
	/*
	 * "." and ".." are special - ".." especially so because it has
	 * to be able to know about the current root directory and
	 * parent relationships.
	 */
1759 1760
	if (unlikely(nd->last_type != LAST_NORM)) {
		err = handle_dots(nd, nd->last_type);
A
Al Viro 已提交
1761
		if (!(flags & WALK_MORE) && nd->depth)
1762 1763 1764
			put_link(nd);
		return err;
	}
1765
	err = lookup_fast(nd, &path, &inode, &seq);
1766
	if (unlikely(err <= 0)) {
M
Miklos Szeredi 已提交
1767
		if (err < 0)
1768
			return err;
1769 1770 1771 1772
		path.dentry = lookup_slow(&nd->last, nd->path.dentry,
					  nd->flags);
		if (IS_ERR(path.dentry))
			return PTR_ERR(path.dentry);
1773

1774 1775 1776
		path.mnt = nd->path.mnt;
		err = follow_managed(&path, nd);
		if (unlikely(err < 0))
1777
			return err;
M
Miklos Szeredi 已提交
1778

1779 1780 1781 1782 1783
		if (unlikely(d_is_negative(path.dentry))) {
			path_to_nameidata(&path, nd);
			return -ENOENT;
		}

1784
		seq = 0;	/* we are already out of RCU mode */
1785
		inode = d_backing_inode(path.dentry);
1786
	}
M
Miklos Szeredi 已提交
1787

1788
	return step_into(nd, &path, flags, inode, seq);
1789 1790
}

1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809
/*
 * We can do the critical dentry name comparison and hashing
 * operations one word at a time, but we are limited to:
 *
 * - Architectures with fast unaligned word accesses. We could
 *   do a "get_unaligned()" if this helps and is sufficiently
 *   fast.
 *
 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
 *   do not trap on the (extremely unlikely) case of a page
 *   crossing operation.
 *
 * - Furthermore, we need an efficient 64-bit compile for the
 *   64-bit case in order to generate the "number of bytes in
 *   the final mask". Again, that could be replaced with a
 *   efficient population count instruction or similar.
 */
#ifdef CONFIG_DCACHE_WORD_ACCESS

1810
#include <asm/word-at-a-time.h>
1811

1812
#ifdef HASH_MIX
1813

1814
/* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */
1815

1816
#elif defined(CONFIG_64BIT)
1817
/*
1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844
 * Register pressure in the mixing function is an issue, particularly
 * on 32-bit x86, but almost any function requires one state value and
 * one temporary.  Instead, use a function designed for two state values
 * and no temporaries.
 *
 * This function cannot create a collision in only two iterations, so
 * we have two iterations to achieve avalanche.  In those two iterations,
 * we have six layers of mixing, which is enough to spread one bit's
 * influence out to 2^6 = 64 state bits.
 *
 * Rotate constants are scored by considering either 64 one-bit input
 * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the
 * probability of that delta causing a change to each of the 128 output
 * bits, using a sample of random initial states.
 *
 * The Shannon entropy of the computed probabilities is then summed
 * to produce a score.  Ideally, any input change has a 50% chance of
 * toggling any given output bit.
 *
 * Mixing scores (in bits) for (12,45):
 * Input delta: 1-bit      2-bit
 * 1 round:     713.3    42542.6
 * 2 rounds:   2753.7   140389.8
 * 3 rounds:   5954.1   233458.2
 * 4 rounds:   7862.6   256672.2
 * Perfect:    8192     258048
 *            (64*128) (64*63/2 * 128)
1845
 */
1846 1847 1848 1849 1850
#define HASH_MIX(x, y, a)	\
	(	x ^= (a),	\
	y ^= x,	x = rol64(x,12),\
	x += y,	y = rol64(y,45),\
	y *= 9			)
1851

1852
/*
1853 1854 1855
 * Fold two longs into one 32-bit hash value.  This must be fast, but
 * latency isn't quite as critical, as there is a fair bit of additional
 * work done before the hash value is used.
1856
 */
1857
static inline unsigned int fold_hash(unsigned long x, unsigned long y)
1858
{
1859 1860 1861
	y ^= x * GOLDEN_RATIO_64;
	y *= GOLDEN_RATIO_64;
	return y >> 32;
1862 1863
}

1864 1865
#else	/* 32-bit case */

1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880
/*
 * Mixing scores (in bits) for (7,20):
 * Input delta: 1-bit      2-bit
 * 1 round:     330.3     9201.6
 * 2 rounds:   1246.4    25475.4
 * 3 rounds:   1907.1    31295.1
 * 4 rounds:   2042.3    31718.6
 * Perfect:    2048      31744
 *            (32*64)   (32*31/2 * 64)
 */
#define HASH_MIX(x, y, a)	\
	(	x ^= (a),	\
	y ^= x,	x = rol32(x, 7),\
	x += y,	y = rol32(y,20),\
	y *= 9			)
1881

1882
static inline unsigned int fold_hash(unsigned long x, unsigned long y)
1883
{
1884 1885
	/* Use arch-optimized multiply if one exists */
	return __hash_32(y ^ __hash_32(x));
1886 1887
}

1888 1889
#endif

1890 1891 1892 1893 1894 1895 1896
/*
 * Return the hash of a string of known length.  This is carfully
 * designed to match hash_name(), which is the more critical function.
 * In particular, we must end by hashing a final word containing 0..7
 * payload bytes, to match the way that hash_name() iterates until it
 * finds the delimiter after the name.
 */
1897
unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
1898
{
1899
	unsigned long a, x = 0, y = (unsigned long)salt;
1900 1901

	for (;;) {
1902 1903
		if (!len)
			goto done;
1904
		a = load_unaligned_zeropad(name);
1905 1906
		if (len < sizeof(unsigned long))
			break;
1907
		HASH_MIX(x, y, a);
1908 1909 1910
		name += sizeof(unsigned long);
		len -= sizeof(unsigned long);
	}
1911
	x ^= a & bytemask_from_count(len);
1912
done:
1913
	return fold_hash(x, y);
1914 1915 1916
}
EXPORT_SYMBOL(full_name_hash);

1917
/* Return the "hash_len" (hash and length) of a null-terminated string */
1918
u64 hashlen_string(const void *salt, const char *name)
1919
{
1920 1921
	unsigned long a = 0, x = 0, y = (unsigned long)salt;
	unsigned long adata, mask, len;
1922 1923
	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;

1924 1925 1926
	len = 0;
	goto inside;

1927
	do {
1928
		HASH_MIX(x, y, a);
1929
		len += sizeof(unsigned long);
1930
inside:
1931 1932 1933 1934 1935
		a = load_unaligned_zeropad(name+len);
	} while (!has_zero(a, &adata, &constants));

	adata = prep_zero_mask(a, adata, &constants);
	mask = create_zero_mask(adata);
1936
	x ^= a & zero_bytemask(mask);
1937

1938
	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
1939 1940 1941
}
EXPORT_SYMBOL(hashlen_string);

1942 1943
/*
 * Calculate the length and hash of the path component, and
1944
 * return the "hash_len" as the result.
1945
 */
1946
static inline u64 hash_name(const void *salt, const char *name)
1947
{
1948 1949
	unsigned long a = 0, b, x = 0, y = (unsigned long)salt;
	unsigned long adata, bdata, mask, len;
1950
	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1951

1952 1953 1954
	len = 0;
	goto inside;

1955
	do {
1956
		HASH_MIX(x, y, a);
1957
		len += sizeof(unsigned long);
1958
inside:
1959
		a = load_unaligned_zeropad(name+len);
1960 1961 1962 1963 1964 1965
		b = a ^ REPEAT_BYTE('/');
	} while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));

	adata = prep_zero_mask(a, adata, &constants);
	bdata = prep_zero_mask(b, bdata, &constants);
	mask = create_zero_mask(adata | bdata);
1966
	x ^= a & zero_bytemask(mask);
1967

1968
	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
1969 1970
}

1971
#else	/* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */
1972

1973
/* Return the hash of a string of known length */
1974
unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
L
Linus Torvalds 已提交
1975
{
1976
	unsigned long hash = init_name_hash(salt);
L
Linus Torvalds 已提交
1977
	while (len--)
1978
		hash = partial_name_hash((unsigned char)*name++, hash);
L
Linus Torvalds 已提交
1979 1980
	return end_name_hash(hash);
}
1981
EXPORT_SYMBOL(full_name_hash);
L
Linus Torvalds 已提交
1982

1983
/* Return the "hash_len" (hash and length) of a null-terminated string */
1984
u64 hashlen_string(const void *salt, const char *name)
1985
{
1986
	unsigned long hash = init_name_hash(salt);
1987 1988 1989
	unsigned long len = 0, c;

	c = (unsigned char)*name;
1990
	while (c) {
1991 1992 1993
		len++;
		hash = partial_name_hash(c, hash);
		c = (unsigned char)name[len];
1994
	}
1995 1996
	return hashlen_create(end_name_hash(hash), len);
}
1997
EXPORT_SYMBOL(hashlen_string);
1998

1999 2000 2001 2002
/*
 * We know there's a real path component here of at least
 * one character.
 */
2003
static inline u64 hash_name(const void *salt, const char *name)
2004
{
2005
	unsigned long hash = init_name_hash(salt);
2006 2007 2008 2009 2010 2011 2012 2013
	unsigned long len = 0, c;

	c = (unsigned char)*name;
	do {
		len++;
		hash = partial_name_hash(c, hash);
		c = (unsigned char)name[len];
	} while (c && c != '/');
2014
	return hashlen_create(end_name_hash(hash), len);
2015 2016
}

2017 2018
#endif

L
Linus Torvalds 已提交
2019 2020
/*
 * Name resolution.
2021 2022
 * This is the basic name resolution function, turning a pathname into
 * the final dentry. We expect 'base' to be positive and a directory.
L
Linus Torvalds 已提交
2023
 *
2024 2025
 * Returns 0 and nd will have valid dentry and mnt on success.
 * Returns error and drops reference to input namei data on failure.
L
Linus Torvalds 已提交
2026
 */
2027
static int link_path_walk(const char *name, struct nameidata *nd)
L
Linus Torvalds 已提交
2028 2029
{
	int err;
A
Al Viro 已提交
2030

L
Linus Torvalds 已提交
2031 2032 2033
	while (*name=='/')
		name++;
	if (!*name)
2034
		return 0;
L
Linus Torvalds 已提交
2035 2036 2037

	/* At this point we know we have a real path component. */
	for(;;) {
2038
		u64 hash_len;
A
Al Viro 已提交
2039
		int type;
L
Linus Torvalds 已提交
2040

2041
		err = may_lookup(nd);
2042
		if (err)
2043
			return err;
L
Linus Torvalds 已提交
2044

2045
		hash_len = hash_name(nd->path.dentry, name);
L
Linus Torvalds 已提交
2046

A
Al Viro 已提交
2047
		type = LAST_NORM;
2048
		if (name[0] == '.') switch (hashlen_len(hash_len)) {
A
Al Viro 已提交
2049
			case 2:
2050
				if (name[1] == '.') {
A
Al Viro 已提交
2051
					type = LAST_DOTDOT;
A
Al Viro 已提交
2052 2053
					nd->flags |= LOOKUP_JUMPED;
				}
A
Al Viro 已提交
2054 2055 2056 2057
				break;
			case 1:
				type = LAST_DOT;
		}
2058 2059
		if (likely(type == LAST_NORM)) {
			struct dentry *parent = nd->path.dentry;
A
Al Viro 已提交
2060
			nd->flags &= ~LOOKUP_JUMPED;
2061
			if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
2062
				struct qstr this = { { .hash_len = hash_len }, .name = name };
2063
				err = parent->d_op->d_hash(parent, &this);
2064
				if (err < 0)
2065
					return err;
2066 2067
				hash_len = this.hash_len;
				name = this.name;
2068 2069
			}
		}
A
Al Viro 已提交
2070

2071 2072
		nd->last.hash_len = hash_len;
		nd->last.name = name;
2073 2074
		nd->last_type = type;

2075 2076
		name += hashlen_len(hash_len);
		if (!*name)
2077
			goto OK;
2078 2079 2080 2081 2082
		/*
		 * If it wasn't NUL, we know it was '/'. Skip that
		 * slash, and continue until no more slashes.
		 */
		do {
2083 2084
			name++;
		} while (unlikely(*name == '/'));
2085 2086
		if (unlikely(!*name)) {
OK:
2087
			/* pathname body, done */
2088 2089 2090
			if (!nd->depth)
				return 0;
			name = nd->stack[nd->depth - 1].name;
2091
			/* trailing symlink, done */
2092 2093 2094
			if (!name)
				return 0;
			/* last component of nested symlink */
2095
			err = walk_component(nd, WALK_FOLLOW);
A
Al Viro 已提交
2096 2097
		} else {
			/* not the last component */
2098
			err = walk_component(nd, WALK_FOLLOW | WALK_MORE);
2099
		}
2100
		if (err < 0)
2101
			return err;
L
Linus Torvalds 已提交
2102

2103
		if (err) {
2104
			const char *s = get_link(nd);
2105

2106
			if (IS_ERR(s))
2107
				return PTR_ERR(s);
2108 2109 2110
			err = 0;
			if (unlikely(!s)) {
				/* jumped */
2111
				put_link(nd);
2112
			} else {
2113 2114 2115
				nd->stack[nd->depth - 1].name = name;
				name = s;
				continue;
2116
			}
N
Nick Piggin 已提交
2117
		}
2118 2119
		if (unlikely(!d_can_lookup(nd->path.dentry))) {
			if (nd->flags & LOOKUP_RCU) {
A
Al Viro 已提交
2120
				if (unlazy_walk(nd))
2121 2122
					return -ECHILD;
			}
2123
			return -ENOTDIR;
2124
		}
L
Linus Torvalds 已提交
2125 2126 2127
	}
}

2128
static const char *path_init(struct nameidata *nd, unsigned flags)
N
Nick Piggin 已提交
2129
{
2130
	const char *s = nd->name->name;
N
Nick Piggin 已提交
2131

2132 2133 2134
	if (!*s)
		flags &= ~LOOKUP_RCU;

N
Nick Piggin 已提交
2135
	nd->last_type = LAST_ROOT; /* if there are only slashes... */
2136
	nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT;
N
Nick Piggin 已提交
2137
	nd->depth = 0;
2138
	if (flags & LOOKUP_ROOT) {
2139 2140
		struct dentry *root = nd->root.dentry;
		struct inode *inode = root->d_inode;
2141 2142
		if (*s && unlikely(!d_can_lookup(root)))
			return ERR_PTR(-ENOTDIR);
2143 2144 2145
		nd->path = nd->root;
		nd->inode = inode;
		if (flags & LOOKUP_RCU) {
A
Al Viro 已提交
2146
			rcu_read_lock();
2147
			nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2148
			nd->root_seq = nd->seq;
A
Al Viro 已提交
2149
			nd->m_seq = read_seqbegin(&mount_lock);
2150 2151 2152
		} else {
			path_get(&nd->path);
		}
2153
		return s;
2154 2155
	}

N
Nick Piggin 已提交
2156
	nd->root.mnt = NULL;
2157 2158
	nd->path.mnt = NULL;
	nd->path.dentry = NULL;
N
Nick Piggin 已提交
2159

A
Al Viro 已提交
2160
	nd->m_seq = read_seqbegin(&mount_lock);
A
Al Viro 已提交
2161
	if (*s == '/') {
2162
		if (flags & LOOKUP_RCU)
A
Al Viro 已提交
2163
			rcu_read_lock();
2164
		set_root(nd);
2165
		if (likely(!nd_jump_root(nd)))
2166
			return s;
2167
		nd->root.mnt = NULL;
2168 2169
		rcu_read_unlock();
		return ERR_PTR(-ECHILD);
2170
	} else if (nd->dfd == AT_FDCWD) {
A
Al Viro 已提交
2171 2172 2173
		if (flags & LOOKUP_RCU) {
			struct fs_struct *fs = current->fs;
			unsigned seq;
N
Nick Piggin 已提交
2174

A
Al Viro 已提交
2175
			rcu_read_lock();
N
Nick Piggin 已提交
2176

A
Al Viro 已提交
2177 2178 2179
			do {
				seq = read_seqcount_begin(&fs->seq);
				nd->path = fs->pwd;
2180
				nd->inode = nd->path.dentry->d_inode;
A
Al Viro 已提交
2181 2182 2183 2184
				nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
			} while (read_seqcount_retry(&fs->seq, seq));
		} else {
			get_fs_pwd(current->fs, &nd->path);
2185
			nd->inode = nd->path.dentry->d_inode;
A
Al Viro 已提交
2186
		}
2187
		return s;
N
Nick Piggin 已提交
2188
	} else {
2189
		/* Caller must check execute permissions on the starting path component */
2190
		struct fd f = fdget_raw(nd->dfd);
N
Nick Piggin 已提交
2191 2192
		struct dentry *dentry;

2193
		if (!f.file)
2194
			return ERR_PTR(-EBADF);
N
Nick Piggin 已提交
2195

2196
		dentry = f.file->f_path.dentry;
N
Nick Piggin 已提交
2197

A
Al Viro 已提交
2198
		if (*s) {
M
Miklos Szeredi 已提交
2199
			if (!d_can_lookup(dentry)) {
2200
				fdput(f);
2201
				return ERR_PTR(-ENOTDIR);
2202
			}
A
Al Viro 已提交
2203
		}
N
Nick Piggin 已提交
2204

2205
		nd->path = f.file->f_path;
A
Al Viro 已提交
2206
		if (flags & LOOKUP_RCU) {
A
Al Viro 已提交
2207
			rcu_read_lock();
A
Al Viro 已提交
2208 2209
			nd->inode = nd->path.dentry->d_inode;
			nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
A
Al Viro 已提交
2210
		} else {
2211
			path_get(&nd->path);
A
Al Viro 已提交
2212
			nd->inode = nd->path.dentry->d_inode;
A
Al Viro 已提交
2213
		}
A
Al Viro 已提交
2214
		fdput(f);
2215
		return s;
N
Nick Piggin 已提交
2216
	}
2217 2218
}

2219
static const char *trailing_symlink(struct nameidata *nd)
2220 2221
{
	const char *s;
A
Al Viro 已提交
2222
	int error = may_follow_link(nd);
2223
	if (unlikely(error))
2224
		return ERR_PTR(error);
2225
	nd->flags |= LOOKUP_PARENT;
2226
	nd->stack[0].name = NULL;
2227
	s = get_link(nd);
2228
	return s ? s : "";
2229 2230
}

A
Al Viro 已提交
2231
static inline int lookup_last(struct nameidata *nd)
2232 2233 2234 2235 2236
{
	if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
		nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;

	nd->flags &= ~LOOKUP_PARENT;
A
Al Viro 已提交
2237
	return walk_component(nd, 0);
2238 2239
}

2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253 2254 2255 2256 2257 2258 2259 2260 2261 2262 2263 2264 2265 2266 2267 2268
static int handle_lookup_down(struct nameidata *nd)
{
	struct path path = nd->path;
	struct inode *inode = nd->inode;
	unsigned seq = nd->seq;
	int err;

	if (nd->flags & LOOKUP_RCU) {
		/*
		 * don't bother with unlazy_walk on failure - we are
		 * at the very beginning of walk, so we lose nothing
		 * if we simply redo everything in non-RCU mode
		 */
		if (unlikely(!__follow_mount_rcu(nd, &path, &inode, &seq)))
			return -ECHILD;
	} else {
		dget(path.dentry);
		err = follow_managed(&path, nd);
		if (unlikely(err < 0))
			return err;
		inode = d_backing_inode(path.dentry);
		seq = 0;
	}
	path_to_nameidata(&path, nd);
	nd->inode = inode;
	nd->seq = seq;
	return 0;
}

2269
/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
2270
static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2271
{
2272
	const char *s = path_init(nd, flags);
2273
	int err;
N
Nick Piggin 已提交
2274

2275 2276
	if (IS_ERR(s))
		return PTR_ERR(s);
2277 2278 2279 2280 2281 2282 2283 2284 2285

	if (unlikely(flags & LOOKUP_DOWN)) {
		err = handle_lookup_down(nd);
		if (unlikely(err < 0)) {
			terminate_walk(nd);
			return err;
		}
	}

2286 2287 2288 2289 2290 2291
	while (!(err = link_path_walk(s, nd))
		&& ((err = lookup_last(nd)) > 0)) {
		s = trailing_symlink(nd);
		if (IS_ERR(s)) {
			err = PTR_ERR(s);
			break;
2292 2293
		}
	}
2294 2295
	if (!err)
		err = complete_walk(nd);
2296

2297 2298
	if (!err && nd->flags & LOOKUP_DIRECTORY)
		if (!d_can_lookup(nd->path.dentry))
A
Al Viro 已提交
2299
			err = -ENOTDIR;
2300 2301 2302 2303 2304 2305
	if (!err) {
		*path = nd->path;
		nd->path.mnt = NULL;
		nd->path.dentry = NULL;
	}
	terminate_walk(nd);
2306
	return err;
A
Al Viro 已提交
2307
}
N
Nick Piggin 已提交
2308

2309
static int filename_lookup(int dfd, struct filename *name, unsigned flags,
2310
			   struct path *path, struct path *root)
A
Al Viro 已提交
2311
{
2312
	int retval;
2313
	struct nameidata nd;
2314 2315
	if (IS_ERR(name))
		return PTR_ERR(name);
2316 2317 2318 2319
	if (unlikely(root)) {
		nd.root = *root;
		flags |= LOOKUP_ROOT;
	}
2320
	set_nameidata(&nd, dfd, name);
2321
	retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
A
Al Viro 已提交
2322
	if (unlikely(retval == -ECHILD))
2323
		retval = path_lookupat(&nd, flags, path);
A
Al Viro 已提交
2324
	if (unlikely(retval == -ESTALE))
2325
		retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
N
Nick Piggin 已提交
2326

2327
	if (likely(!retval))
2328
		audit_inode(name, path->dentry, flags & LOOKUP_PARENT);
2329
	restore_nameidata();
2330
	putname(name);
2331
	return retval;
L
Linus Torvalds 已提交
2332 2333
}

2334
/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
2335
static int path_parentat(struct nameidata *nd, unsigned flags,
2336
				struct path *parent)
2337
{
2338
	const char *s = path_init(nd, flags);
2339 2340 2341 2342
	int err;
	if (IS_ERR(s))
		return PTR_ERR(s);
	err = link_path_walk(s, nd);
2343 2344
	if (!err)
		err = complete_walk(nd);
2345 2346 2347 2348 2349 2350
	if (!err) {
		*parent = nd->path;
		nd->path.mnt = NULL;
		nd->path.dentry = NULL;
	}
	terminate_walk(nd);
2351 2352 2353
	return err;
}

2354
static struct filename *filename_parentat(int dfd, struct filename *name,
2355 2356
				unsigned int flags, struct path *parent,
				struct qstr *last, int *type)
2357 2358
{
	int retval;
2359
	struct nameidata nd;
2360

2361 2362
	if (IS_ERR(name))
		return name;
2363
	set_nameidata(&nd, dfd, name);
2364
	retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
2365
	if (unlikely(retval == -ECHILD))
2366
		retval = path_parentat(&nd, flags, parent);
2367
	if (unlikely(retval == -ESTALE))
2368
		retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
2369 2370 2371 2372
	if (likely(!retval)) {
		*last = nd.last;
		*type = nd.last_type;
		audit_inode(name, parent->dentry, LOOKUP_PARENT);
2373 2374 2375
	} else {
		putname(name);
		name = ERR_PTR(retval);
2376
	}
2377
	restore_nameidata();
2378
	return name;
2379 2380
}

A
Al Viro 已提交
2381 2382
/* does lookup, returns the object with parent locked */
struct dentry *kern_path_locked(const char *name, struct path *path)
2383
{
2384 2385
	struct filename *filename;
	struct dentry *d;
2386 2387
	struct qstr last;
	int type;
2388

2389 2390
	filename = filename_parentat(AT_FDCWD, getname_kernel(name), 0, path,
				    &last, &type);
2391 2392
	if (IS_ERR(filename))
		return ERR_CAST(filename);
2393
	if (unlikely(type != LAST_NORM)) {
2394
		path_put(path);
2395 2396
		putname(filename);
		return ERR_PTR(-EINVAL);
A
Al Viro 已提交
2397
	}
A
Al Viro 已提交
2398
	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
2399
	d = __lookup_hash(&last, path->dentry, 0);
A
Al Viro 已提交
2400
	if (IS_ERR(d)) {
A
Al Viro 已提交
2401
		inode_unlock(path->dentry->d_inode);
2402
		path_put(path);
A
Al Viro 已提交
2403
	}
2404
	putname(filename);
A
Al Viro 已提交
2405
	return d;
2406 2407
}

A
Al Viro 已提交
2408 2409
int kern_path(const char *name, unsigned int flags, struct path *path)
{
2410 2411
	return filename_lookup(AT_FDCWD, getname_kernel(name),
			       flags, path, NULL);
A
Al Viro 已提交
2412
}
2413
EXPORT_SYMBOL(kern_path);
A
Al Viro 已提交
2414

2415 2416 2417 2418 2419 2420
/**
 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
 * @dentry:  pointer to dentry of the base directory
 * @mnt: pointer to vfs mount of the base directory
 * @name: pointer to file name
 * @flags: lookup flags
2421
 * @path: pointer to struct path to fill
2422 2423 2424
 */
int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
		    const char *name, unsigned int flags,
2425
		    struct path *path)
2426
{
2427 2428
	struct path root = {.mnt = mnt, .dentry = dentry};
	/* the first argument of filename_lookup() is ignored with root */
2429 2430
	return filename_lookup(AT_FDCWD, getname_kernel(name),
			       flags , path, &root);
2431
}
2432
EXPORT_SYMBOL(vfs_path_lookup);
2433

2434 2435
static int lookup_one_len_common(const char *name, struct dentry *base,
				 int len, struct qstr *this)
2436
{
2437 2438 2439
	this->name = name;
	this->len = len;
	this->hash = full_name_hash(base, name, len);
A
Al Viro 已提交
2440
	if (!len)
2441
		return -EACCES;
A
Al Viro 已提交
2442

A
Al Viro 已提交
2443 2444
	if (unlikely(name[0] == '.')) {
		if (len < 2 || (len == 2 && name[1] == '.'))
2445
			return -EACCES;
A
Al Viro 已提交
2446 2447
	}

A
Al Viro 已提交
2448
	while (len--) {
2449
		unsigned int c = *(const unsigned char *)name++;
A
Al Viro 已提交
2450
		if (c == '/' || c == '\0')
2451
			return -EACCES;
A
Al Viro 已提交
2452
	}
2453 2454 2455 2456 2457
	/*
	 * See if the low-level filesystem might want
	 * to use its own hash..
	 */
	if (base->d_flags & DCACHE_OP_HASH) {
2458
		int err = base->d_op->d_hash(base, this);
2459
		if (err < 0)
2460
			return err;
2461
	}
2462

2463 2464 2465
	return inode_permission(base->d_inode, MAY_EXEC);
}

2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494
/**
 * try_lookup_one_len - filesystem helper to lookup single pathname component
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
 * Look up a dentry by name in the dcache, returning NULL if it does not
 * currently exist.  The function does not try to create a dentry.
 *
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.
 *
 * The caller must hold base->i_mutex.
 */
struct dentry *try_lookup_one_len(const char *name, struct dentry *base, int len)
{
	struct qstr this;
	int err;

	WARN_ON_ONCE(!inode_is_locked(base->d_inode));

	err = lookup_one_len_common(name, base, len, &this);
	if (err)
		return ERR_PTR(err);

	return lookup_dcache(&this, base, 0);
}
EXPORT_SYMBOL(try_lookup_one_len);

2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507
/**
 * lookup_one_len - filesystem helper to lookup single pathname component
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.
 *
 * The caller must hold base->i_mutex.
 */
struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
{
2508
	struct dentry *dentry;
2509 2510 2511 2512 2513 2514
	struct qstr this;
	int err;

	WARN_ON_ONCE(!inode_is_locked(base->d_inode));

	err = lookup_one_len_common(name, base, len, &this);
2515 2516 2517
	if (err)
		return ERR_PTR(err);

2518 2519
	dentry = lookup_dcache(&this, base, 0);
	return dentry ? dentry : __lookup_slow(&this, base, 0);
2520
}
2521
EXPORT_SYMBOL(lookup_one_len);
2522

2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534 2535 2536 2537 2538 2539
/**
 * lookup_one_len_unlocked - filesystem helper to lookup single pathname component
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.
 *
 * Unlike lookup_one_len, it should be called without the parent
 * i_mutex held, and will take the i_mutex itself if necessary.
 */
struct dentry *lookup_one_len_unlocked(const char *name,
				       struct dentry *base, int len)
{
	struct qstr this;
	int err;
2540
	struct dentry *ret;
2541

2542
	err = lookup_one_len_common(name, base, len, &this);
2543 2544 2545
	if (err)
		return ERR_PTR(err);

2546 2547 2548 2549
	ret = lookup_dcache(&this, base, 0);
	if (!ret)
		ret = lookup_slow(&this, base, 0);
	return ret;
2550 2551 2552
}
EXPORT_SYMBOL(lookup_one_len_unlocked);

2553 2554 2555 2556 2557 2558 2559 2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571 2572 2573 2574 2575 2576 2577 2578 2579 2580
#ifdef CONFIG_UNIX98_PTYS
int path_pts(struct path *path)
{
	/* Find something mounted on "pts" in the same directory as
	 * the input path.
	 */
	struct dentry *child, *parent;
	struct qstr this;
	int ret;

	ret = path_parent_directory(path);
	if (ret)
		return ret;

	parent = path->dentry;
	this.name = "pts";
	this.len = 3;
	child = d_hash_and_lookup(parent, &this);
	if (!child)
		return -ENOENT;

	path->dentry = child;
	dput(parent);
	follow_mount(path);
	return 0;
}
#endif

2581 2582
int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
		 struct path *path, int *empty)
L
Linus Torvalds 已提交
2583
{
2584 2585
	return filename_lookup(dfd, getname_flags(name, flags, empty),
			       flags, path, NULL);
L
Linus Torvalds 已提交
2586
}
2587
EXPORT_SYMBOL(user_path_at_empty);
2588

2589
/**
2590
 * mountpoint_last - look up last component for umount
2591 2592 2593 2594 2595 2596 2597 2598 2599 2600 2601 2602 2603
 * @nd:   pathwalk nameidata - currently pointing at parent directory of "last"
 *
 * This is a special lookup_last function just for umount. In this case, we
 * need to resolve the path without doing any revalidation.
 *
 * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since
 * mountpoints are always pinned in the dcache, their ancestors are too. Thus,
 * in almost all cases, this lookup will be served out of the dcache. The only
 * cases where it won't are if nd->last refers to a symlink or the path is
 * bogus and it doesn't exist.
 *
 * Returns:
 * -error: if there was an error during lookup. This includes -ENOENT if the
2604
 *         lookup found a negative dentry.
2605
 *
2606 2607
 * 0:      if we successfully resolved nd->last and found it to not to be a
 *         symlink that needs to be followed.
2608 2609
 *
 * 1:      if we successfully resolved nd->last and found it to be a symlink
2610
 *         that needs to be followed.
2611 2612
 */
static int
2613
mountpoint_last(struct nameidata *nd)
2614 2615 2616
{
	int error = 0;
	struct dentry *dir = nd->path.dentry;
2617
	struct path path;
2618

2619 2620
	/* If we're in rcuwalk, drop out of it to handle last component */
	if (nd->flags & LOOKUP_RCU) {
A
Al Viro 已提交
2621
		if (unlazy_walk(nd))
2622
			return -ECHILD;
2623 2624 2625 2626 2627 2628
	}

	nd->flags &= ~LOOKUP_PARENT;

	if (unlikely(nd->last_type != LAST_NORM)) {
		error = handle_dots(nd, nd->last_type);
2629
		if (error)
2630
			return error;
2631
		path.dentry = dget(nd->path.dentry);
2632
	} else {
2633 2634
		path.dentry = d_lookup(dir, &nd->last);
		if (!path.dentry) {
2635 2636 2637 2638 2639 2640
			/*
			 * No cached dentry. Mounted dentries are pinned in the
			 * cache, so that means that this dentry is probably
			 * a symlink or the path doesn't actually point
			 * to a mounted dentry.
			 */
2641
			path.dentry = lookup_slow(&nd->last, dir,
2642
					     nd->flags | LOOKUP_NO_REVAL);
2643 2644
			if (IS_ERR(path.dentry))
				return PTR_ERR(path.dentry);
2645
		}
2646
	}
2647 2648
	if (d_is_negative(path.dentry)) {
		dput(path.dentry);
2649
		return -ENOENT;
2650
	}
2651
	path.mnt = nd->path.mnt;
2652
	return step_into(nd, &path, 0, d_backing_inode(path.dentry), 0);
2653 2654 2655
}

/**
2656
 * path_mountpoint - look up a path to be umounted
2657
 * @nd:		lookup context
2658
 * @flags:	lookup flags
2659
 * @path:	pointer to container for result
2660 2661
 *
 * Look up the given name, but don't attempt to revalidate the last component.
2662
 * Returns 0 and "path" will be valid on success; Returns error otherwise.
2663 2664
 */
static int
2665
path_mountpoint(struct nameidata *nd, unsigned flags, struct path *path)
2666
{
2667
	const char *s = path_init(nd, flags);
2668 2669 2670
	int err;
	if (IS_ERR(s))
		return PTR_ERR(s);
2671
	while (!(err = link_path_walk(s, nd)) &&
2672
		(err = mountpoint_last(nd)) > 0) {
2673 2674 2675
		s = trailing_symlink(nd);
		if (IS_ERR(s)) {
			err = PTR_ERR(s);
2676
			break;
2677
		}
2678
	}
2679 2680 2681 2682 2683 2684
	if (!err) {
		*path = nd->path;
		nd->path.mnt = NULL;
		nd->path.dentry = NULL;
		follow_mount(path);
	}
2685
	terminate_walk(nd);
2686 2687 2688
	return err;
}

A
Al Viro 已提交
2689
static int
2690
filename_mountpoint(int dfd, struct filename *name, struct path *path,
A
Al Viro 已提交
2691 2692
			unsigned int flags)
{
2693
	struct nameidata nd;
2694
	int error;
2695 2696
	if (IS_ERR(name))
		return PTR_ERR(name);
2697
	set_nameidata(&nd, dfd, name);
2698
	error = path_mountpoint(&nd, flags | LOOKUP_RCU, path);
A
Al Viro 已提交
2699
	if (unlikely(error == -ECHILD))
2700
		error = path_mountpoint(&nd, flags, path);
A
Al Viro 已提交
2701
	if (unlikely(error == -ESTALE))
2702
		error = path_mountpoint(&nd, flags | LOOKUP_REVAL, path);
A
Al Viro 已提交
2703
	if (likely(!error))
2704
		audit_inode(name, path->dentry, 0);
2705
	restore_nameidata();
2706
	putname(name);
A
Al Viro 已提交
2707 2708 2709
	return error;
}

2710
/**
2711
 * user_path_mountpoint_at - lookup a path from userland in order to umount it
2712 2713 2714 2715 2716 2717 2718 2719 2720 2721 2722 2723 2724
 * @dfd:	directory file descriptor
 * @name:	pathname from userland
 * @flags:	lookup flags
 * @path:	pointer to container to hold result
 *
 * A umount is a special case for path walking. We're not actually interested
 * in the inode in this situation, and ESTALE errors can be a problem. We
 * simply want track down the dentry and vfsmount attached at the mountpoint
 * and avoid revalidating the last component.
 *
 * Returns 0 and populates "path" on success.
 */
int
2725
user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags,
2726 2727
			struct path *path)
{
2728
	return filename_mountpoint(dfd, getname(name), path, flags);
2729 2730
}

A
Al Viro 已提交
2731 2732 2733 2734
int
kern_path_mountpoint(int dfd, const char *name, struct path *path,
			unsigned int flags)
{
2735
	return filename_mountpoint(dfd, getname_kernel(name), path, flags);
A
Al Viro 已提交
2736 2737 2738
}
EXPORT_SYMBOL(kern_path_mountpoint);

M
Miklos Szeredi 已提交
2739
int __check_sticky(struct inode *dir, struct inode *inode)
L
Linus Torvalds 已提交
2740
{
2741
	kuid_t fsuid = current_fsuid();
2742

2743
	if (uid_eq(inode->i_uid, fsuid))
L
Linus Torvalds 已提交
2744
		return 0;
2745
	if (uid_eq(dir->i_uid, fsuid))
L
Linus Torvalds 已提交
2746
		return 0;
2747
	return !capable_wrt_inode_uidgid(inode, CAP_FOWNER);
L
Linus Torvalds 已提交
2748
}
M
Miklos Szeredi 已提交
2749
EXPORT_SYMBOL(__check_sticky);
L
Linus Torvalds 已提交
2750 2751 2752 2753 2754 2755 2756 2757 2758 2759 2760 2761 2762 2763

/*
 *	Check whether we can remove a link victim from directory dir, check
 *  whether the type of victim is right.
 *  1. We can't do it if dir is read-only (done in permission())
 *  2. We should have write and exec permissions on dir
 *  3. We can't remove anything from append-only dir
 *  4. We can't do anything with immutable dir (done in permission())
 *  5. If the sticky bit on dir is set we should either
 *	a. be owner of dir, or
 *	b. be owner of victim, or
 *	c. have CAP_FOWNER capability
 *  6. If the victim is append-only or immutable we can't do antyhing with
 *     links pointing to it.
2764 2765 2766 2767 2768
 *  7. If the victim has an unknown uid or gid we can't change the inode.
 *  8. If we were asked to remove a directory and victim isn't one - ENOTDIR.
 *  9. If we were asked to remove a non-directory and victim isn't one - EISDIR.
 * 10. We can't remove a root or mountpoint.
 * 11. We don't allow removal of NFS sillyrenamed files; it's handled by
L
Linus Torvalds 已提交
2769 2770
 *     nfs_async_unlink().
 */
2771
static int may_delete(struct inode *dir, struct dentry *victim, bool isdir)
L
Linus Torvalds 已提交
2772
{
2773
	struct inode *inode = d_backing_inode(victim);
L
Linus Torvalds 已提交
2774 2775
	int error;

2776
	if (d_is_negative(victim))
L
Linus Torvalds 已提交
2777
		return -ENOENT;
2778
	BUG_ON(!inode);
L
Linus Torvalds 已提交
2779 2780

	BUG_ON(victim->d_parent->d_inode != dir);
2781 2782 2783 2784 2785

	/* Inode writeback is not safe when the uid or gid are invalid. */
	if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
		return -EOVERFLOW;

2786
	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
L
Linus Torvalds 已提交
2787

2788
	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
2789 2790 2791 2792
	if (error)
		return error;
	if (IS_APPEND(dir))
		return -EPERM;
2793 2794

	if (check_sticky(dir, inode) || IS_APPEND(inode) ||
2795
	    IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) || HAS_UNMAPPED_ID(inode))
L
Linus Torvalds 已提交
2796 2797
		return -EPERM;
	if (isdir) {
M
Miklos Szeredi 已提交
2798
		if (!d_is_dir(victim))
L
Linus Torvalds 已提交
2799 2800 2801
			return -ENOTDIR;
		if (IS_ROOT(victim))
			return -EBUSY;
M
Miklos Szeredi 已提交
2802
	} else if (d_is_dir(victim))
L
Linus Torvalds 已提交
2803 2804 2805 2806 2807 2808 2809 2810 2811 2812 2813 2814 2815
		return -EISDIR;
	if (IS_DEADDIR(dir))
		return -ENOENT;
	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
		return -EBUSY;
	return 0;
}

/*	Check whether we can create an object with dentry child in directory
 *  dir.
 *  1. We can't do it if child already exists (open has special treatment for
 *     this case, but since we are inlined it's OK)
 *  2. We can't do it if dir is read-only (done in permission())
2816 2817 2818
 *  3. We can't do it if the fs can't represent the fsuid or fsgid.
 *  4. We should have write and exec permissions on dir
 *  5. We can't do it if dir is immutable (done in permission())
L
Linus Torvalds 已提交
2819
 */
2820
static inline int may_create(struct inode *dir, struct dentry *child)
L
Linus Torvalds 已提交
2821
{
2822
	struct user_namespace *s_user_ns;
2823
	audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
L
Linus Torvalds 已提交
2824 2825 2826 2827
	if (child->d_inode)
		return -EEXIST;
	if (IS_DEADDIR(dir))
		return -ENOENT;
2828 2829 2830 2831
	s_user_ns = dir->i_sb->s_user_ns;
	if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||
	    !kgid_has_mapping(s_user_ns, current_fsgid()))
		return -EOVERFLOW;
2832
	return inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
2833 2834 2835 2836 2837 2838 2839 2840 2841 2842
}

/*
 * p1 and p2 should be directories on the same fs.
 */
struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
{
	struct dentry *p;

	if (p1 == p2) {
A
Al Viro 已提交
2843
		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
L
Linus Torvalds 已提交
2844 2845 2846
		return NULL;
	}

2847
	mutex_lock(&p1->d_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
2848

2849 2850
	p = d_ancestor(p2, p1);
	if (p) {
A
Al Viro 已提交
2851 2852
		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
		inode_lock_nested(p1->d_inode, I_MUTEX_CHILD);
2853
		return p;
L
Linus Torvalds 已提交
2854 2855
	}

2856 2857
	p = d_ancestor(p1, p2);
	if (p) {
A
Al Viro 已提交
2858 2859
		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
		inode_lock_nested(p2->d_inode, I_MUTEX_CHILD);
2860
		return p;
L
Linus Torvalds 已提交
2861 2862
	}

A
Al Viro 已提交
2863 2864
	inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
	inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
L
Linus Torvalds 已提交
2865 2866
	return NULL;
}
2867
EXPORT_SYMBOL(lock_rename);
L
Linus Torvalds 已提交
2868 2869 2870

void unlock_rename(struct dentry *p1, struct dentry *p2)
{
A
Al Viro 已提交
2871
	inode_unlock(p1->d_inode);
L
Linus Torvalds 已提交
2872
	if (p1 != p2) {
A
Al Viro 已提交
2873
		inode_unlock(p2->d_inode);
2874
		mutex_unlock(&p1->d_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
2875 2876
	}
}
2877
EXPORT_SYMBOL(unlock_rename);
L
Linus Torvalds 已提交
2878

A
Al Viro 已提交
2879
int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
A
Al Viro 已提交
2880
		bool want_excl)
L
Linus Torvalds 已提交
2881
{
2882
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2883 2884 2885
	if (error)
		return error;

A
Al Viro 已提交
2886
	if (!dir->i_op->create)
L
Linus Torvalds 已提交
2887 2888 2889 2890 2891 2892
		return -EACCES;	/* shouldn't it be ENOSYS? */
	mode &= S_IALLUGO;
	mode |= S_IFREG;
	error = security_inode_create(dir, dentry, mode);
	if (error)
		return error;
A
Al Viro 已提交
2893
	error = dir->i_op->create(dir, dentry, mode, want_excl);
2894
	if (!error)
2895
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
2896 2897
	return error;
}
2898
EXPORT_SYMBOL(vfs_create);
L
Linus Torvalds 已提交
2899

A
Al Viro 已提交
2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920
int vfs_mkobj(struct dentry *dentry, umode_t mode,
		int (*f)(struct dentry *, umode_t, void *),
		void *arg)
{
	struct inode *dir = dentry->d_parent->d_inode;
	int error = may_create(dir, dentry);
	if (error)
		return error;

	mode &= S_IALLUGO;
	mode |= S_IFREG;
	error = security_inode_create(dir, dentry, mode);
	if (error)
		return error;
	error = f(dentry, mode, arg);
	if (!error)
		fsnotify_create(dir, dentry);
	return error;
}
EXPORT_SYMBOL(vfs_mkobj);

2921 2922 2923 2924 2925 2926
bool may_open_dev(const struct path *path)
{
	return !(path->mnt->mnt_flags & MNT_NODEV) &&
		!(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
}

A
Al Viro 已提交
2927
static int may_open(const struct path *path, int acc_mode, int flag)
L
Linus Torvalds 已提交
2928
{
2929
	struct dentry *dentry = path->dentry;
L
Linus Torvalds 已提交
2930 2931 2932 2933 2934 2935
	struct inode *inode = dentry->d_inode;
	int error;

	if (!inode)
		return -ENOENT;

C
Christoph Hellwig 已提交
2936 2937
	switch (inode->i_mode & S_IFMT) {
	case S_IFLNK:
L
Linus Torvalds 已提交
2938
		return -ELOOP;
C
Christoph Hellwig 已提交
2939 2940 2941 2942 2943 2944
	case S_IFDIR:
		if (acc_mode & MAY_WRITE)
			return -EISDIR;
		break;
	case S_IFBLK:
	case S_IFCHR:
2945
		if (!may_open_dev(path))
L
Linus Torvalds 已提交
2946
			return -EACCES;
C
Christoph Hellwig 已提交
2947 2948 2949
		/*FALLTHRU*/
	case S_IFIFO:
	case S_IFSOCK:
L
Linus Torvalds 已提交
2950
		flag &= ~O_TRUNC;
C
Christoph Hellwig 已提交
2951
		break;
2952
	}
2953

A
Al Viro 已提交
2954
	error = inode_permission(inode, MAY_OPEN | acc_mode);
2955 2956
	if (error)
		return error;
M
Mimi Zohar 已提交
2957

L
Linus Torvalds 已提交
2958 2959 2960 2961
	/*
	 * An append-only file must be opened in append mode for writing.
	 */
	if (IS_APPEND(inode)) {
2962
		if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
2963
			return -EPERM;
L
Linus Torvalds 已提交
2964
		if (flag & O_TRUNC)
2965
			return -EPERM;
L
Linus Torvalds 已提交
2966 2967 2968
	}

	/* O_NOATIME can only be set by the owner or superuser */
2969
	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
2970
		return -EPERM;
L
Linus Torvalds 已提交
2971

2972
	return 0;
2973
}
L
Linus Torvalds 已提交
2974

2975
static int handle_truncate(struct file *filp)
2976
{
A
Al Viro 已提交
2977
	const struct path *path = &filp->f_path;
2978 2979 2980 2981 2982 2983 2984
	struct inode *inode = path->dentry->d_inode;
	int error = get_write_access(inode);
	if (error)
		return error;
	/*
	 * Refuse to truncate files with mandatory locks held on them.
	 */
2985
	error = locks_verify_locked(filp);
2986
	if (!error)
2987
		error = security_path_truncate(path);
2988 2989 2990
	if (!error) {
		error = do_truncate(path->dentry, 0,
				    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
2991
				    filp);
2992 2993
	}
	put_write_access(inode);
M
Mimi Zohar 已提交
2994
	return error;
L
Linus Torvalds 已提交
2995 2996
}

2997 2998
static inline int open_to_namei_flags(int flag)
{
2999 3000
	if ((flag & O_ACCMODE) == 3)
		flag--;
3001 3002 3003
	return flag;
}

3004
static int may_o_create(const struct path *dir, struct dentry *dentry, umode_t mode)
M
Miklos Szeredi 已提交
3005
{
3006
	struct user_namespace *s_user_ns;
M
Miklos Szeredi 已提交
3007 3008 3009 3010
	int error = security_path_mknod(dir, dentry, mode, 0);
	if (error)
		return error;

3011 3012 3013 3014 3015
	s_user_ns = dir->dentry->d_sb->s_user_ns;
	if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||
	    !kgid_has_mapping(s_user_ns, current_fsgid()))
		return -EOVERFLOW;

M
Miklos Szeredi 已提交
3016 3017 3018 3019 3020 3021 3022
	error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
	if (error)
		return error;

	return security_inode_create(dir->dentry->d_inode, dentry, mode);
}

3023 3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034 3035
/*
 * Attempt to atomically look up, create and open a file from a negative
 * dentry.
 *
 * Returns 0 if successful.  The file will have been created and attached to
 * @file by the filesystem calling finish_open().
 *
 * Returns 1 if the file was looked up only or didn't need creating.  The
 * caller will need to perform the open themselves.  @path will have been
 * updated to point to the new dentry.  This may be negative.
 *
 * Returns an error code otherwise.
 */
3036 3037 3038
static int atomic_open(struct nameidata *nd, struct dentry *dentry,
			struct path *path, struct file *file,
			const struct open_flags *op,
3039
			int open_flag, umode_t mode,
3040
			int *opened)
M
Miklos Szeredi 已提交
3041
{
3042
	struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
M
Miklos Szeredi 已提交
3043 3044 3045
	struct inode *dir =  nd->path.dentry->d_inode;
	int error;

3046
	if (!(~open_flag & (O_EXCL | O_CREAT)))	/* both O_EXCL and O_CREAT */
M
Miklos Szeredi 已提交
3047 3048 3049 3050 3051
		open_flag &= ~O_TRUNC;

	if (nd->flags & LOOKUP_DIRECTORY)
		open_flag |= O_DIRECTORY;

A
Al Viro 已提交
3052 3053
	file->f_path.dentry = DENTRY_NOT_SET;
	file->f_path.mnt = nd->path.mnt;
3054 3055 3056
	error = dir->i_op->atomic_open(dir, dentry, file,
				       open_to_namei_flags(open_flag),
				       mode, opened);
3057
	d_lookup_done(dentry);
3058 3059 3060 3061 3062 3063
	if (!error) {
		/*
		 * We didn't have the inode before the open, so check open
		 * permission here.
		 */
		int acc_mode = op->acc_mode;
3064
		if (file->f_mode & FMODE_CREATED) {
3065 3066 3067 3068 3069 3070 3071 3072
			WARN_ON(!(open_flag & O_CREAT));
			fsnotify_create(dir, dentry);
			acc_mode = 0;
		}
		error = may_open(&file->f_path, acc_mode, open_flag);
		if (WARN_ON(error > 0))
			error = -EINVAL;
	} else if (error > 0) {
A
Al Viro 已提交
3073
		if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
3074
			error = -EIO;
3075
		} else {
3076 3077 3078
			if (file->f_path.dentry) {
				dput(dentry);
				dentry = file->f_path.dentry;
3079
			}
3080
			if (file->f_mode & FMODE_CREATED)
3081
				fsnotify_create(dir, dentry);
A
Al Viro 已提交
3082 3083 3084 3085 3086 3087 3088
			if (unlikely(d_is_negative(dentry))) {
				error = -ENOENT;
			} else {
				path->dentry = dentry;
				path->mnt = nd->path.mnt;
				return 1;
			}
3089
		}
M
Miklos Szeredi 已提交
3090 3091
	}
	dput(dentry);
3092
	return error;
M
Miklos Szeredi 已提交
3093 3094
}

M
Miklos Szeredi 已提交
3095
/*
3096
 * Look up and maybe create and open the last component.
M
Miklos Szeredi 已提交
3097 3098 3099
 *
 * Must be called with i_mutex held on parent.
 *
3100 3101 3102 3103 3104 3105 3106 3107 3108 3109 3110 3111
 * Returns 0 if the file was successfully atomically created (if necessary) and
 * opened.  In this case the file will be returned attached to @file.
 *
 * Returns 1 if the file was not completely opened at this time, though lookups
 * and creations will have been performed and the dentry returned in @path will
 * be positive upon return if O_CREAT was specified.  If O_CREAT wasn't
 * specified then a negative dentry may be returned.
 *
 * An error code is returned otherwise.
 *
 * FILE_CREATE will be set in @*opened if the dentry was created and will be
 * cleared otherwise prior to returning.
M
Miklos Szeredi 已提交
3112
 */
3113 3114 3115
static int lookup_open(struct nameidata *nd, struct path *path,
			struct file *file,
			const struct open_flags *op,
3116
			bool got_write, int *opened)
M
Miklos Szeredi 已提交
3117 3118
{
	struct dentry *dir = nd->path.dentry;
3119
	struct inode *dir_inode = dir->d_inode;
3120
	int open_flag = op->open_flag;
M
Miklos Szeredi 已提交
3121
	struct dentry *dentry;
3122 3123
	int error, create_error = 0;
	umode_t mode = op->mode;
3124
	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
M
Miklos Szeredi 已提交
3125

3126 3127
	if (unlikely(IS_DEADDIR(dir_inode)))
		return -ENOENT;
M
Miklos Szeredi 已提交
3128

3129
	file->f_mode &= ~FMODE_CREATED;
3130 3131 3132 3133 3134 3135 3136 3137 3138
	dentry = d_lookup(dir, &nd->last);
	for (;;) {
		if (!dentry) {
			dentry = d_alloc_parallel(dir, &nd->last, &wq);
			if (IS_ERR(dentry))
				return PTR_ERR(dentry);
		}
		if (d_in_lookup(dentry))
			break;
M
Miklos Szeredi 已提交
3139

3140 3141 3142 3143 3144 3145 3146 3147 3148 3149
		error = d_revalidate(dentry, nd->flags);
		if (likely(error > 0))
			break;
		if (error)
			goto out_dput;
		d_invalidate(dentry);
		dput(dentry);
		dentry = NULL;
	}
	if (dentry->d_inode) {
3150
		/* Cached positive dentry: will open in f_op->open */
M
Miklos Szeredi 已提交
3151
		goto out_no_open;
3152
	}
M
Miklos Szeredi 已提交
3153

3154 3155 3156 3157 3158 3159 3160 3161 3162 3163 3164 3165 3166 3167 3168 3169 3170 3171 3172 3173 3174 3175 3176 3177 3178 3179 3180 3181 3182 3183 3184 3185 3186
	/*
	 * Checking write permission is tricky, bacuse we don't know if we are
	 * going to actually need it: O_CREAT opens should work as long as the
	 * file exists.  But checking existence breaks atomicity.  The trick is
	 * to check access and if not granted clear O_CREAT from the flags.
	 *
	 * Another problem is returing the "right" error value (e.g. for an
	 * O_EXCL open we want to return EEXIST not EROFS).
	 */
	if (open_flag & O_CREAT) {
		if (!IS_POSIXACL(dir->d_inode))
			mode &= ~current_umask();
		if (unlikely(!got_write)) {
			create_error = -EROFS;
			open_flag &= ~O_CREAT;
			if (open_flag & (O_EXCL | O_TRUNC))
				goto no_open;
			/* No side effects, safe to clear O_CREAT */
		} else {
			create_error = may_o_create(&nd->path, dentry, mode);
			if (create_error) {
				open_flag &= ~O_CREAT;
				if (open_flag & O_EXCL)
					goto no_open;
			}
		}
	} else if ((open_flag & (O_TRUNC|O_WRONLY|O_RDWR)) &&
		   unlikely(!got_write)) {
		/*
		 * No O_CREATE -> atomicity not a requirement -> fall
		 * back to lookup + open
		 */
		goto no_open;
M
Miklos Szeredi 已提交
3187 3188
	}

3189
	if (dir_inode->i_op->atomic_open) {
3190 3191 3192 3193 3194
		error = atomic_open(nd, dentry, path, file, op, open_flag,
				    mode, opened);
		if (unlikely(error == -ENOENT) && create_error)
			error = create_error;
		return error;
M
Miklos Szeredi 已提交
3195
	}
3196

3197
no_open:
3198
	if (d_in_lookup(dentry)) {
3199 3200
		struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry,
							     nd->flags);
3201
		d_lookup_done(dentry);
3202 3203 3204 3205 3206 3207 3208 3209
		if (unlikely(res)) {
			if (IS_ERR(res)) {
				error = PTR_ERR(res);
				goto out_dput;
			}
			dput(dentry);
			dentry = res;
		}
3210 3211
	}

M
Miklos Szeredi 已提交
3212
	/* Negative dentry, just create the file */
3213
	if (!dentry->d_inode && (open_flag & O_CREAT)) {
3214
		file->f_mode |= FMODE_CREATED;
3215 3216 3217
		audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
		if (!dir_inode->i_op->create) {
			error = -EACCES;
M
Miklos Szeredi 已提交
3218
			goto out_dput;
3219 3220
		}
		error = dir_inode->i_op->create(dir_inode, dentry, mode,
3221
						open_flag & O_EXCL);
M
Miklos Szeredi 已提交
3222 3223
		if (error)
			goto out_dput;
3224
		fsnotify_create(dir_inode, dentry);
M
Miklos Szeredi 已提交
3225
	}
3226 3227 3228
	if (unlikely(create_error) && !dentry->d_inode) {
		error = create_error;
		goto out_dput;
M
Miklos Szeredi 已提交
3229
	}
M
Miklos Szeredi 已提交
3230
out_no_open:
M
Miklos Szeredi 已提交
3231 3232
	path->dentry = dentry;
	path->mnt = nd->path.mnt;
3233
	return 1;
M
Miklos Szeredi 已提交
3234 3235 3236

out_dput:
	dput(dentry);
3237
	return error;
M
Miklos Szeredi 已提交
3238 3239
}

N
Nick Piggin 已提交
3240
/*
3241
 * Handle the last step of open()
N
Nick Piggin 已提交
3242
 */
3243
static int do_last(struct nameidata *nd,
3244
		   struct file *file, const struct open_flags *op,
A
Al Viro 已提交
3245
		   int *opened)
3246
{
3247
	struct dentry *dir = nd->path.dentry;
3248
	int open_flag = op->open_flag;
M
Miklos Szeredi 已提交
3249
	bool will_truncate = (open_flag & O_TRUNC) != 0;
3250
	bool got_write = false;
A
Al Viro 已提交
3251
	int acc_mode = op->acc_mode;
3252
	unsigned seq;
3253
	struct inode *inode;
3254
	struct path path;
A
Al Viro 已提交
3255
	int error;
3256

3257 3258 3259
	nd->flags &= ~LOOKUP_PARENT;
	nd->flags |= op->intent;

3260
	if (nd->last_type != LAST_NORM) {
3261
		error = handle_dots(nd, nd->last_type);
3262
		if (unlikely(error))
3263
			return error;
M
Miklos Szeredi 已提交
3264
		goto finish_open;
3265
	}
3266

3267
	if (!(open_flag & O_CREAT)) {
3268 3269 3270
		if (nd->last.name[nd->last.len])
			nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
		/* we _can_ be in RCU mode here */
3271
		error = lookup_fast(nd, &path, &inode, &seq);
3272
		if (likely(error > 0))
3273 3274 3275
			goto finish_lookup;

		if (error < 0)
3276
			return error;
3277 3278

		BUG_ON(nd->inode != dir->d_inode);
A
Al Viro 已提交
3279
		BUG_ON(nd->flags & LOOKUP_RCU);
3280 3281 3282 3283 3284 3285 3286 3287
	} else {
		/* create side of things */
		/*
		 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED
		 * has been cleared when we got to the last component we are
		 * about to look up
		 */
		error = complete_walk(nd);
3288
		if (error)
3289
			return error;
3290

A
Al Viro 已提交
3291
		audit_inode(nd->name, dir, LOOKUP_PARENT);
3292
		/* trailing slashes? */
3293 3294
		if (unlikely(nd->last.name[nd->last.len]))
			return -EISDIR;
3295
	}
A
Al Viro 已提交
3296

3297
	if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
3298 3299 3300 3301 3302 3303 3304 3305 3306
		error = mnt_want_write(nd->path.mnt);
		if (!error)
			got_write = true;
		/*
		 * do _not_ fail yet - we might not need that or fail with
		 * a different error; let lookup_open() decide; we'll be
		 * dropping this one anyway.
		 */
	}
3307 3308 3309 3310
	if (open_flag & O_CREAT)
		inode_lock(dir->d_inode);
	else
		inode_lock_shared(dir->d_inode);
3311
	error = lookup_open(nd, &path, file, op, got_write, opened);
3312 3313 3314 3315
	if (open_flag & O_CREAT)
		inode_unlock(dir->d_inode);
	else
		inode_unlock_shared(dir->d_inode);
3316

3317 3318
	if (error <= 0) {
		if (error)
M
Miklos Szeredi 已提交
3319 3320
			goto out;

3321
		if ((file->f_mode & FMODE_CREATED) ||
A
Al Viro 已提交
3322
		    !S_ISREG(file_inode(file)->i_mode))
M
Miklos Szeredi 已提交
3323
			will_truncate = false;
M
Miklos Szeredi 已提交
3324

A
Al Viro 已提交
3325
		audit_inode(nd->name, file->f_path.dentry, 0);
M
Miklos Szeredi 已提交
3326 3327
		goto opened;
	}
3328

3329
	if (file->f_mode & FMODE_CREATED) {
3330
		/* Don't check for write permission, don't truncate */
3331
		open_flag &= ~O_TRUNC;
M
Miklos Szeredi 已提交
3332
		will_truncate = false;
A
Al Viro 已提交
3333
		acc_mode = 0;
3334
		path_to_nameidata(&path, nd);
M
Miklos Szeredi 已提交
3335
		goto finish_open_created;
3336 3337
	}

M
Miklos Szeredi 已提交
3338 3339 3340 3341 3342
	/*
	 * If atomic_open() acquired write access it is dropped now due to
	 * possible mount and symlink following (this might be optimized away if
	 * necessary...)
	 */
3343
	if (got_write) {
M
Miklos Szeredi 已提交
3344
		mnt_drop_write(nd->path.mnt);
3345
		got_write = false;
M
Miklos Szeredi 已提交
3346 3347
	}

A
Al Viro 已提交
3348 3349 3350 3351
	error = follow_managed(&path, nd);
	if (unlikely(error < 0))
		return error;

A
Al Viro 已提交
3352 3353 3354 3355 3356 3357 3358 3359 3360 3361
	if (unlikely(d_is_negative(path.dentry))) {
		path_to_nameidata(&path, nd);
		return -ENOENT;
	}

	/*
	 * create/update audit record if it already exists.
	 */
	audit_inode(nd->name, path.dentry, 0);

3362 3363 3364 3365
	if (unlikely((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))) {
		path_to_nameidata(&path, nd);
		return -EEXIST;
	}
3366

3367
	seq = 0;	/* out of RCU mode, so the value doesn't matter */
3368
	inode = d_backing_inode(path.dentry);
3369
finish_lookup:
3370
	error = step_into(nd, &path, 0, inode, seq);
3371
	if (unlikely(error))
3372
		return error;
3373
finish_open:
3374
	/* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
3375
	error = complete_walk(nd);
A
Al Viro 已提交
3376
	if (error)
3377
		return error;
A
Al Viro 已提交
3378
	audit_inode(nd->name, nd->path.dentry, 0);
3379
	error = -EISDIR;
M
Miklos Szeredi 已提交
3380
	if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry))
3381
		goto out;
3382
	error = -ENOTDIR;
M
Miklos Szeredi 已提交
3383
	if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
3384
		goto out;
3385
	if (!d_is_reg(nd->path.dentry))
M
Miklos Szeredi 已提交
3386
		will_truncate = false;
3387

3388 3389 3390
	if (will_truncate) {
		error = mnt_want_write(nd->path.mnt);
		if (error)
3391
			goto out;
3392
		got_write = true;
3393
	}
M
Miklos Szeredi 已提交
3394
finish_open_created:
3395 3396 3397
	error = may_open(&nd->path, acc_mode, open_flag);
	if (error)
		goto out;
3398
	BUG_ON(file->f_mode & FMODE_OPENED); /* once it's opened, it's opened */
3399
	error = vfs_open(&nd->path, file);
A
Al Viro 已提交
3400
	if (error)
3401
		goto out;
3402
opened:
3403 3404
	error = ima_file_check(file, op->acc_mode,
				file->f_mode & FMODE_CREATED ? FILE_CREATED : 0);
3405
	if (!error && will_truncate)
3406
		error = handle_truncate(file);
3407
out:
3408 3409 3410 3411
	if (unlikely(error > 0)) {
		WARN_ON(1);
		error = -EINVAL;
	}
3412
	if (got_write)
3413
		mnt_drop_write(nd->path.mnt);
3414
	return error;
3415 3416
}

3417 3418 3419 3420 3421 3422 3423 3424 3425 3426 3427 3428 3429 3430 3431
struct dentry *vfs_tmpfile(struct dentry *dentry, umode_t mode, int open_flag)
{
	struct dentry *child = NULL;
	struct inode *dir = dentry->d_inode;
	struct inode *inode;
	int error;

	/* we want directory to be writable */
	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
	if (error)
		goto out_err;
	error = -EOPNOTSUPP;
	if (!dir->i_op->tmpfile)
		goto out_err;
	error = -ENOMEM;
D
David Howells 已提交
3432
	child = d_alloc(dentry, &slash_name);
3433 3434 3435 3436 3437 3438 3439 3440 3441 3442 3443 3444 3445 3446 3447 3448 3449 3450 3451 3452 3453 3454
	if (unlikely(!child))
		goto out_err;
	error = dir->i_op->tmpfile(dir, child, mode);
	if (error)
		goto out_err;
	error = -ENOENT;
	inode = child->d_inode;
	if (unlikely(!inode))
		goto out_err;
	if (!(open_flag & O_EXCL)) {
		spin_lock(&inode->i_lock);
		inode->i_state |= I_LINKABLE;
		spin_unlock(&inode->i_lock);
	}
	return child;

out_err:
	dput(child);
	return ERR_PTR(error);
}
EXPORT_SYMBOL(vfs_tmpfile);

3455
static int do_tmpfile(struct nameidata *nd, unsigned flags,
3456 3457 3458
		const struct open_flags *op,
		struct file *file, int *opened)
{
3459 3460
	struct dentry *child;
	struct path path;
3461
	int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
3462 3463
	if (unlikely(error))
		return error;
3464
	error = mnt_want_write(path.mnt);
3465 3466
	if (unlikely(error))
		goto out;
3467 3468
	child = vfs_tmpfile(path.dentry, op->mode, op->open_flag);
	error = PTR_ERR(child);
3469
	if (IS_ERR(child))
3470
		goto out2;
3471 3472
	dput(path.dentry);
	path.dentry = child;
3473
	audit_inode(nd->name, child, 0);
3474
	/* Don't check for other permissions, the inode was just created */
A
Al Viro 已提交
3475
	error = may_open(&path, 0, op->open_flag);
3476 3477
	if (error)
		goto out2;
3478 3479
	file->f_path.mnt = path.mnt;
	error = finish_open(file, child, NULL, opened);
3480
out2:
3481
	mnt_drop_write(path.mnt);
3482
out:
3483
	path_put(&path);
3484 3485 3486
	return error;
}

3487 3488 3489 3490 3491 3492
static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file)
{
	struct path path;
	int error = path_lookupat(nd, flags, &path);
	if (!error) {
		audit_inode(nd->name, path.dentry, 0);
3493
		error = vfs_open(&path, file);
3494 3495 3496 3497 3498
		path_put(&path);
	}
	return error;
}

3499 3500
static struct file *path_openat(struct nameidata *nd,
			const struct open_flags *op, unsigned flags)
L
Linus Torvalds 已提交
3501
{
3502
	const char *s;
A
Al Viro 已提交
3503
	struct file *file;
3504
	int opened = 0;
3505
	int error;
N
Nick Piggin 已提交
3506

3507
	file = alloc_empty_file(op->open_flag, current_cred());
3508 3509
	if (IS_ERR(file))
		return file;
N
Nick Piggin 已提交
3510

A
Al Viro 已提交
3511
	if (unlikely(file->f_flags & __O_TMPFILE)) {
3512
		error = do_tmpfile(nd, flags, op, file, &opened);
A
Al Viro 已提交
3513
		goto out2;
3514 3515
	}

3516 3517 3518 3519 3520
	if (unlikely(file->f_flags & O_PATH)) {
		error = do_o_path(nd, flags, file);
		goto out2;
	}

3521
	s = path_init(nd, flags);
3522
	if (IS_ERR(s)) {
A
Al Viro 已提交
3523
		fput(file);
3524 3525
		return ERR_CAST(s);
	}
3526
	while (!(error = link_path_walk(s, nd)) &&
A
Al Viro 已提交
3527
		(error = do_last(nd, file, op, &opened)) > 0) {
A
Al Viro 已提交
3528
		nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3529 3530 3531
		s = trailing_symlink(nd);
		if (IS_ERR(s)) {
			error = PTR_ERR(s);
3532
			break;
3533
		}
3534
	}
3535
	terminate_walk(nd);
A
Al Viro 已提交
3536
out2:
3537
	if (likely(!error)) {
3538
		if (likely(file->f_mode & FMODE_OPENED))
3539 3540 3541
			return file;
		WARN_ON(1);
		error = -EINVAL;
3542
	}
3543 3544 3545 3546 3547 3548
	fput(file);
	if (error == -EOPENSTALE) {
		if (flags & LOOKUP_RCU)
			error = -ECHILD;
		else
			error = -ESTALE;
3549
	}
3550
	return ERR_PTR(error);
L
Linus Torvalds 已提交
3551 3552
}

3553
struct file *do_filp_open(int dfd, struct filename *pathname,
3554
		const struct open_flags *op)
3555
{
3556
	struct nameidata nd;
3557
	int flags = op->lookup_flags;
3558 3559
	struct file *filp;

3560
	set_nameidata(&nd, dfd, pathname);
3561
	filp = path_openat(&nd, op, flags | LOOKUP_RCU);
3562
	if (unlikely(filp == ERR_PTR(-ECHILD)))
3563
		filp = path_openat(&nd, op, flags);
3564
	if (unlikely(filp == ERR_PTR(-ESTALE)))
3565
		filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
3566
	restore_nameidata();
3567 3568 3569
	return filp;
}

A
Al Viro 已提交
3570
struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
3571
		const char *name, const struct open_flags *op)
A
Al Viro 已提交
3572
{
3573
	struct nameidata nd;
A
Al Viro 已提交
3574
	struct file *file;
3575
	struct filename *filename;
3576
	int flags = op->lookup_flags | LOOKUP_ROOT;
A
Al Viro 已提交
3577 3578 3579 3580

	nd.root.mnt = mnt;
	nd.root.dentry = dentry;

3581
	if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN)
A
Al Viro 已提交
3582 3583
		return ERR_PTR(-ELOOP);

3584
	filename = getname_kernel(name);
3585
	if (IS_ERR(filename))
3586 3587
		return ERR_CAST(filename);

3588
	set_nameidata(&nd, -1, filename);
3589
	file = path_openat(&nd, op, flags | LOOKUP_RCU);
A
Al Viro 已提交
3590
	if (unlikely(file == ERR_PTR(-ECHILD)))
3591
		file = path_openat(&nd, op, flags);
A
Al Viro 已提交
3592
	if (unlikely(file == ERR_PTR(-ESTALE)))
3593
		file = path_openat(&nd, op, flags | LOOKUP_REVAL);
3594
	restore_nameidata();
3595
	putname(filename);
A
Al Viro 已提交
3596 3597 3598
	return file;
}

3599
static struct dentry *filename_create(int dfd, struct filename *name,
3600
				struct path *path, unsigned int lookup_flags)
L
Linus Torvalds 已提交
3601
{
3602
	struct dentry *dentry = ERR_PTR(-EEXIST);
3603 3604
	struct qstr last;
	int type;
3605
	int err2;
3606 3607 3608 3609 3610 3611 3612 3613 3614
	int error;
	bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);

	/*
	 * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any
	 * other flags passed in are ignored!
	 */
	lookup_flags &= LOOKUP_REVAL;

3615 3616 3617
	name = filename_parentat(dfd, name, lookup_flags, path, &last, &type);
	if (IS_ERR(name))
		return ERR_CAST(name);
L
Linus Torvalds 已提交
3618

3619 3620 3621 3622
	/*
	 * Yucky last component or no last component at all?
	 * (foo/., foo/.., /////)
	 */
3623
	if (unlikely(type != LAST_NORM))
A
Al Viro 已提交
3624
		goto out;
3625

3626
	/* don't fail immediately if it's r/o, at least try to report other errors */
3627
	err2 = mnt_want_write(path->mnt);
3628 3629 3630
	/*
	 * Do the final lookup.
	 */
3631
	lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL;
A
Al Viro 已提交
3632
	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
3633
	dentry = __lookup_hash(&last, path->dentry, lookup_flags);
L
Linus Torvalds 已提交
3634
	if (IS_ERR(dentry))
3635
		goto unlock;
3636

3637
	error = -EEXIST;
3638
	if (d_is_positive(dentry))
3639
		goto fail;
3640

3641 3642 3643 3644 3645 3646
	/*
	 * Special case - lookup gave negative, but... we had foo/bar/
	 * From the vfs_mknod() POV we just have a negative dentry -
	 * all is fine. Let's be bastards - you had / on the end, you've
	 * been asking for (non-existent) directory. -ENOENT for you.
	 */
3647
	if (unlikely(!is_dir && last.name[last.len])) {
3648
		error = -ENOENT;
A
Al Viro 已提交
3649
		goto fail;
3650
	}
3651 3652
	if (unlikely(err2)) {
		error = err2;
3653
		goto fail;
3654
	}
3655
	putname(name);
L
Linus Torvalds 已提交
3656 3657
	return dentry;
fail:
3658 3659 3660
	dput(dentry);
	dentry = ERR_PTR(error);
unlock:
A
Al Viro 已提交
3661
	inode_unlock(path->dentry->d_inode);
3662
	if (!err2)
3663
		mnt_drop_write(path->mnt);
A
Al Viro 已提交
3664
out:
3665
	path_put(path);
3666
	putname(name);
L
Linus Torvalds 已提交
3667 3668
	return dentry;
}
3669 3670 3671 3672

struct dentry *kern_path_create(int dfd, const char *pathname,
				struct path *path, unsigned int lookup_flags)
{
3673 3674
	return filename_create(dfd, getname_kernel(pathname),
				path, lookup_flags);
3675
}
3676 3677
EXPORT_SYMBOL(kern_path_create);

A
Al Viro 已提交
3678 3679 3680
void done_path_create(struct path *path, struct dentry *dentry)
{
	dput(dentry);
A
Al Viro 已提交
3681
	inode_unlock(path->dentry->d_inode);
3682
	mnt_drop_write(path->mnt);
A
Al Viro 已提交
3683 3684 3685 3686
	path_put(path);
}
EXPORT_SYMBOL(done_path_create);

A
Al Viro 已提交
3687
inline struct dentry *user_path_create(int dfd, const char __user *pathname,
3688
				struct path *path, unsigned int lookup_flags)
3689
{
3690
	return filename_create(dfd, getname(pathname), path, lookup_flags);
3691 3692 3693
}
EXPORT_SYMBOL(user_path_create);

A
Al Viro 已提交
3694
int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
L
Linus Torvalds 已提交
3695
{
3696
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
3697 3698 3699 3700

	if (error)
		return error;

3701 3702
	if ((S_ISCHR(mode) || S_ISBLK(mode)) &&
	    !ns_capable(dentry->d_sb->s_user_ns, CAP_MKNOD))
L
Linus Torvalds 已提交
3703 3704
		return -EPERM;

A
Al Viro 已提交
3705
	if (!dir->i_op->mknod)
L
Linus Torvalds 已提交
3706 3707
		return -EPERM;

3708 3709 3710 3711
	error = devcgroup_inode_mknod(mode, dev);
	if (error)
		return error;

L
Linus Torvalds 已提交
3712 3713 3714 3715 3716
	error = security_inode_mknod(dir, dentry, mode, dev);
	if (error)
		return error;

	error = dir->i_op->mknod(dir, dentry, mode, dev);
3717
	if (!error)
3718
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
3719 3720
	return error;
}
3721
EXPORT_SYMBOL(vfs_mknod);
L
Linus Torvalds 已提交
3722

A
Al Viro 已提交
3723
static int may_mknod(umode_t mode)
3724 3725 3726 3727 3728 3729 3730 3731 3732 3733 3734 3735 3736 3737 3738 3739
{
	switch (mode & S_IFMT) {
	case S_IFREG:
	case S_IFCHR:
	case S_IFBLK:
	case S_IFIFO:
	case S_IFSOCK:
	case 0: /* zero mode translates to S_IFREG */
		return 0;
	case S_IFDIR:
		return -EPERM;
	default:
		return -EINVAL;
	}
}

3740 3741
long do_mknodat(int dfd, const char __user *filename, umode_t mode,
		unsigned int dev)
L
Linus Torvalds 已提交
3742
{
3743
	struct dentry *dentry;
3744 3745
	struct path path;
	int error;
3746
	unsigned int lookup_flags = 0;
L
Linus Torvalds 已提交
3747

3748 3749 3750
	error = may_mknod(mode);
	if (error)
		return error;
3751 3752
retry:
	dentry = user_path_create(dfd, filename, &path, lookup_flags);
3753 3754
	if (IS_ERR(dentry))
		return PTR_ERR(dentry);
3755

3756
	if (!IS_POSIXACL(path.dentry->d_inode))
A
Al Viro 已提交
3757
		mode &= ~current_umask();
3758
	error = security_path_mknod(&path, dentry, mode, dev);
3759
	if (error)
3760
		goto out;
3761
	switch (mode & S_IFMT) {
L
Linus Torvalds 已提交
3762
		case 0: case S_IFREG:
A
Al Viro 已提交
3763
			error = vfs_create(path.dentry->d_inode,dentry,mode,true);
3764 3765
			if (!error)
				ima_post_path_mknod(dentry);
L
Linus Torvalds 已提交
3766 3767
			break;
		case S_IFCHR: case S_IFBLK:
3768
			error = vfs_mknod(path.dentry->d_inode,dentry,mode,
L
Linus Torvalds 已提交
3769 3770 3771
					new_decode_dev(dev));
			break;
		case S_IFIFO: case S_IFSOCK:
3772
			error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
L
Linus Torvalds 已提交
3773 3774
			break;
	}
3775
out:
A
Al Viro 已提交
3776
	done_path_create(&path, dentry);
3777 3778 3779 3780
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
L
Linus Torvalds 已提交
3781 3782 3783
	return error;
}

3784 3785 3786 3787 3788 3789
SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
		unsigned int, dev)
{
	return do_mknodat(dfd, filename, mode, dev);
}

A
Al Viro 已提交
3790
SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3791
{
3792
	return do_mknodat(AT_FDCWD, filename, mode, dev);
3793 3794
}

3795
int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
L
Linus Torvalds 已提交
3796
{
3797
	int error = may_create(dir, dentry);
3798
	unsigned max_links = dir->i_sb->s_max_links;
L
Linus Torvalds 已提交
3799 3800 3801 3802

	if (error)
		return error;

A
Al Viro 已提交
3803
	if (!dir->i_op->mkdir)
L
Linus Torvalds 已提交
3804 3805 3806 3807 3808 3809 3810
		return -EPERM;

	mode &= (S_IRWXUGO|S_ISVTX);
	error = security_inode_mkdir(dir, dentry, mode);
	if (error)
		return error;

3811 3812 3813
	if (max_links && dir->i_nlink >= max_links)
		return -EMLINK;

L
Linus Torvalds 已提交
3814
	error = dir->i_op->mkdir(dir, dentry, mode);
3815
	if (!error)
3816
		fsnotify_mkdir(dir, dentry);
L
Linus Torvalds 已提交
3817 3818
	return error;
}
3819
EXPORT_SYMBOL(vfs_mkdir);
L
Linus Torvalds 已提交
3820

3821
long do_mkdirat(int dfd, const char __user *pathname, umode_t mode)
L
Linus Torvalds 已提交
3822
{
3823
	struct dentry *dentry;
3824 3825
	struct path path;
	int error;
3826
	unsigned int lookup_flags = LOOKUP_DIRECTORY;
L
Linus Torvalds 已提交
3827

3828 3829
retry:
	dentry = user_path_create(dfd, pathname, &path, lookup_flags);
3830
	if (IS_ERR(dentry))
3831
		return PTR_ERR(dentry);
L
Linus Torvalds 已提交
3832

3833
	if (!IS_POSIXACL(path.dentry->d_inode))
A
Al Viro 已提交
3834
		mode &= ~current_umask();
3835
	error = security_path_mkdir(&path, dentry, mode);
3836 3837
	if (!error)
		error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
A
Al Viro 已提交
3838
	done_path_create(&path, dentry);
3839 3840 3841 3842
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
L
Linus Torvalds 已提交
3843 3844 3845
	return error;
}

3846 3847 3848 3849 3850
SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
{
	return do_mkdirat(dfd, pathname, mode);
}

3851
SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
3852
{
3853
	return do_mkdirat(AT_FDCWD, pathname, mode);
3854 3855
}

L
Linus Torvalds 已提交
3856 3857 3858 3859 3860 3861 3862
int vfs_rmdir(struct inode *dir, struct dentry *dentry)
{
	int error = may_delete(dir, dentry, 1);

	if (error)
		return error;

A
Al Viro 已提交
3863
	if (!dir->i_op->rmdir)
L
Linus Torvalds 已提交
3864 3865
		return -EPERM;

3866
	dget(dentry);
A
Al Viro 已提交
3867
	inode_lock(dentry->d_inode);
S
Sage Weil 已提交
3868 3869

	error = -EBUSY;
3870
	if (is_local_mountpoint(dentry))
S
Sage Weil 已提交
3871 3872 3873 3874 3875 3876 3877 3878 3879 3880
		goto out;

	error = security_inode_rmdir(dir, dentry);
	if (error)
		goto out;

	error = dir->i_op->rmdir(dir, dentry);
	if (error)
		goto out;

3881
	shrink_dcache_parent(dentry);
S
Sage Weil 已提交
3882 3883
	dentry->d_inode->i_flags |= S_DEAD;
	dont_mount(dentry);
3884
	detach_mounts(dentry);
S
Sage Weil 已提交
3885 3886

out:
A
Al Viro 已提交
3887
	inode_unlock(dentry->d_inode);
3888
	dput(dentry);
S
Sage Weil 已提交
3889
	if (!error)
L
Linus Torvalds 已提交
3890 3891 3892
		d_delete(dentry);
	return error;
}
3893
EXPORT_SYMBOL(vfs_rmdir);
L
Linus Torvalds 已提交
3894

3895
long do_rmdir(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
3896 3897
{
	int error = 0;
3898
	struct filename *name;
L
Linus Torvalds 已提交
3899
	struct dentry *dentry;
3900 3901 3902
	struct path path;
	struct qstr last;
	int type;
3903 3904
	unsigned int lookup_flags = 0;
retry:
A
Al Viro 已提交
3905 3906
	name = filename_parentat(dfd, getname(pathname), lookup_flags,
				&path, &last, &type);
3907 3908
	if (IS_ERR(name))
		return PTR_ERR(name);
L
Linus Torvalds 已提交
3909

3910
	switch (type) {
3911 3912 3913 3914 3915 3916 3917 3918 3919
	case LAST_DOTDOT:
		error = -ENOTEMPTY;
		goto exit1;
	case LAST_DOT:
		error = -EINVAL;
		goto exit1;
	case LAST_ROOT:
		error = -EBUSY;
		goto exit1;
L
Linus Torvalds 已提交
3920
	}
3921

3922
	error = mnt_want_write(path.mnt);
3923 3924
	if (error)
		goto exit1;
3925

A
Al Viro 已提交
3926
	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
3927
	dentry = __lookup_hash(&last, path.dentry, lookup_flags);
L
Linus Torvalds 已提交
3928
	error = PTR_ERR(dentry);
3929 3930
	if (IS_ERR(dentry))
		goto exit2;
3931 3932 3933 3934
	if (!dentry->d_inode) {
		error = -ENOENT;
		goto exit3;
	}
3935
	error = security_path_rmdir(&path, dentry);
3936
	if (error)
3937
		goto exit3;
3938
	error = vfs_rmdir(path.dentry->d_inode, dentry);
3939
exit3:
3940 3941
	dput(dentry);
exit2:
A
Al Viro 已提交
3942
	inode_unlock(path.dentry->d_inode);
3943
	mnt_drop_write(path.mnt);
L
Linus Torvalds 已提交
3944
exit1:
3945
	path_put(&path);
L
Linus Torvalds 已提交
3946
	putname(name);
3947 3948 3949 3950
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
L
Linus Torvalds 已提交
3951 3952 3953
	return error;
}

3954
SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
3955 3956 3957 3958
{
	return do_rmdir(AT_FDCWD, pathname);
}

3959 3960 3961 3962 3963 3964 3965 3966 3967 3968 3969 3970 3971 3972 3973 3974 3975 3976 3977
/**
 * vfs_unlink - unlink a filesystem object
 * @dir:	parent directory
 * @dentry:	victim
 * @delegated_inode: returns victim inode, if the inode is delegated.
 *
 * The caller must hold dir->i_mutex.
 *
 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and
 * return a reference to the inode in delegated_inode.  The caller
 * should then break the delegation on that inode and retry.  Because
 * breaking a delegation may take a long time, the caller should drop
 * dir->i_mutex before doing so.
 *
 * Alternatively, a caller may pass NULL for delegated_inode.  This may
 * be appropriate for callers that expect the underlying filesystem not
 * to be NFS exported.
 */
int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode)
L
Linus Torvalds 已提交
3978
{
J
J. Bruce Fields 已提交
3979
	struct inode *target = dentry->d_inode;
L
Linus Torvalds 已提交
3980 3981 3982 3983 3984
	int error = may_delete(dir, dentry, 0);

	if (error)
		return error;

A
Al Viro 已提交
3985
	if (!dir->i_op->unlink)
L
Linus Torvalds 已提交
3986 3987
		return -EPERM;

A
Al Viro 已提交
3988
	inode_lock(target);
3989
	if (is_local_mountpoint(dentry))
L
Linus Torvalds 已提交
3990 3991 3992
		error = -EBUSY;
	else {
		error = security_inode_unlink(dir, dentry);
3993
		if (!error) {
3994 3995
			error = try_break_deleg(target, delegated_inode);
			if (error)
3996
				goto out;
L
Linus Torvalds 已提交
3997
			error = dir->i_op->unlink(dir, dentry);
3998
			if (!error) {
3999
				dont_mount(dentry);
4000 4001
				detach_mounts(dentry);
			}
4002
		}
L
Linus Torvalds 已提交
4003
	}
4004
out:
A
Al Viro 已提交
4005
	inode_unlock(target);
L
Linus Torvalds 已提交
4006 4007 4008

	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
	if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
J
J. Bruce Fields 已提交
4009
		fsnotify_link_count(target);
J
John McCutchan 已提交
4010
		d_delete(dentry);
L
Linus Torvalds 已提交
4011
	}
R
Robert Love 已提交
4012

L
Linus Torvalds 已提交
4013 4014
	return error;
}
4015
EXPORT_SYMBOL(vfs_unlink);
L
Linus Torvalds 已提交
4016 4017 4018

/*
 * Make sure that the actual truncation of the file will occur outside its
4019
 * directory's i_mutex.  Truncate can take a long time if there is a lot of
L
Linus Torvalds 已提交
4020 4021 4022
 * writeout happening, and we don't want to prevent access to the directory
 * while waiting on the I/O.
 */
4023
long do_unlinkat(int dfd, struct filename *name)
L
Linus Torvalds 已提交
4024
{
4025
	int error;
L
Linus Torvalds 已提交
4026
	struct dentry *dentry;
4027 4028 4029
	struct path path;
	struct qstr last;
	int type;
L
Linus Torvalds 已提交
4030
	struct inode *inode = NULL;
4031
	struct inode *delegated_inode = NULL;
4032 4033
	unsigned int lookup_flags = 0;
retry:
4034
	name = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4035 4036
	if (IS_ERR(name))
		return PTR_ERR(name);
4037

L
Linus Torvalds 已提交
4038
	error = -EISDIR;
4039
	if (type != LAST_NORM)
L
Linus Torvalds 已提交
4040
		goto exit1;
4041

4042
	error = mnt_want_write(path.mnt);
4043 4044
	if (error)
		goto exit1;
4045
retry_deleg:
A
Al Viro 已提交
4046
	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4047
	dentry = __lookup_hash(&last, path.dentry, lookup_flags);
L
Linus Torvalds 已提交
4048 4049 4050
	error = PTR_ERR(dentry);
	if (!IS_ERR(dentry)) {
		/* Why not before? Because we want correct error value */
4051
		if (last.name[last.len])
4052
			goto slashes;
L
Linus Torvalds 已提交
4053
		inode = dentry->d_inode;
4054
		if (d_is_negative(dentry))
4055 4056
			goto slashes;
		ihold(inode);
4057
		error = security_path_unlink(&path, dentry);
4058
		if (error)
4059
			goto exit2;
4060
		error = vfs_unlink(path.dentry->d_inode, dentry, &delegated_inode);
4061
exit2:
L
Linus Torvalds 已提交
4062 4063
		dput(dentry);
	}
A
Al Viro 已提交
4064
	inode_unlock(path.dentry->d_inode);
L
Linus Torvalds 已提交
4065 4066
	if (inode)
		iput(inode);	/* truncate the inode here */
4067 4068
	inode = NULL;
	if (delegated_inode) {
4069
		error = break_deleg_wait(&delegated_inode);
4070 4071 4072
		if (!error)
			goto retry_deleg;
	}
4073
	mnt_drop_write(path.mnt);
L
Linus Torvalds 已提交
4074
exit1:
4075
	path_put(&path);
4076 4077 4078 4079 4080
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		inode = NULL;
		goto retry;
	}
4081
	putname(name);
L
Linus Torvalds 已提交
4082 4083 4084
	return error;

slashes:
4085 4086
	if (d_is_negative(dentry))
		error = -ENOENT;
M
Miklos Szeredi 已提交
4087
	else if (d_is_dir(dentry))
4088 4089 4090
		error = -EISDIR;
	else
		error = -ENOTDIR;
L
Linus Torvalds 已提交
4091 4092 4093
	goto exit2;
}

4094
SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
4095 4096 4097 4098 4099 4100 4101
{
	if ((flag & ~AT_REMOVEDIR) != 0)
		return -EINVAL;

	if (flag & AT_REMOVEDIR)
		return do_rmdir(dfd, pathname);

4102
	return do_unlinkat(dfd, getname(pathname));
4103 4104
}

4105
SYSCALL_DEFINE1(unlink, const char __user *, pathname)
4106
{
4107
	return do_unlinkat(AT_FDCWD, getname(pathname));
4108 4109
}

4110
int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
L
Linus Torvalds 已提交
4111
{
4112
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
4113 4114 4115 4116

	if (error)
		return error;

A
Al Viro 已提交
4117
	if (!dir->i_op->symlink)
L
Linus Torvalds 已提交
4118 4119 4120 4121 4122 4123 4124
		return -EPERM;

	error = security_inode_symlink(dir, dentry, oldname);
	if (error)
		return error;

	error = dir->i_op->symlink(dir, dentry, oldname);
4125
	if (!error)
4126
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
4127 4128
	return error;
}
4129
EXPORT_SYMBOL(vfs_symlink);
L
Linus Torvalds 已提交
4130

4131 4132
long do_symlinkat(const char __user *oldname, int newdfd,
		  const char __user *newname)
L
Linus Torvalds 已提交
4133
{
4134
	int error;
4135
	struct filename *from;
4136
	struct dentry *dentry;
4137
	struct path path;
4138
	unsigned int lookup_flags = 0;
L
Linus Torvalds 已提交
4139 4140

	from = getname(oldname);
4141
	if (IS_ERR(from))
L
Linus Torvalds 已提交
4142
		return PTR_ERR(from);
4143 4144
retry:
	dentry = user_path_create(newdfd, newname, &path, lookup_flags);
4145 4146
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry))
4147
		goto out_putname;
4148

4149
	error = security_path_symlink(&path, dentry, from->name);
4150
	if (!error)
4151
		error = vfs_symlink(path.dentry->d_inode, dentry, from->name);
A
Al Viro 已提交
4152
	done_path_create(&path, dentry);
4153 4154 4155 4156
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
4157
out_putname:
L
Linus Torvalds 已提交
4158 4159 4160 4161
	putname(from);
	return error;
}

4162 4163 4164 4165 4166 4167
SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
{
	return do_symlinkat(oldname, newdfd, newname);
}

4168
SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
4169
{
4170
	return do_symlinkat(oldname, AT_FDCWD, newname);
4171 4172
}

J
J. Bruce Fields 已提交
4173 4174 4175 4176 4177 4178 4179 4180 4181 4182 4183 4184 4185 4186 4187 4188 4189 4190 4191 4192
/**
 * vfs_link - create a new link
 * @old_dentry:	object to be linked
 * @dir:	new parent
 * @new_dentry:	where to create the new link
 * @delegated_inode: returns inode needing a delegation break
 *
 * The caller must hold dir->i_mutex
 *
 * If vfs_link discovers a delegation on the to-be-linked file in need
 * of breaking, it will return -EWOULDBLOCK and return a reference to the
 * inode in delegated_inode.  The caller should then break the delegation
 * and retry.  Because breaking a delegation may take a long time, the
 * caller should drop the i_mutex before doing so.
 *
 * Alternatively, a caller may pass NULL for delegated_inode.  This may
 * be appropriate for callers that expect the underlying filesystem not
 * to be NFS exported.
 */
int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode)
L
Linus Torvalds 已提交
4193 4194
{
	struct inode *inode = old_dentry->d_inode;
4195
	unsigned max_links = dir->i_sb->s_max_links;
L
Linus Torvalds 已提交
4196 4197 4198 4199 4200
	int error;

	if (!inode)
		return -ENOENT;

4201
	error = may_create(dir, new_dentry);
L
Linus Torvalds 已提交
4202 4203 4204 4205 4206 4207 4208 4209 4210 4211 4212
	if (error)
		return error;

	if (dir->i_sb != inode->i_sb)
		return -EXDEV;

	/*
	 * A link to an append-only or immutable file cannot be created.
	 */
	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
		return -EPERM;
4213 4214 4215 4216 4217 4218 4219
	/*
	 * Updating the link count will likely cause i_uid and i_gid to
	 * be writen back improperly if their true value is unknown to
	 * the vfs.
	 */
	if (HAS_UNMAPPED_ID(inode))
		return -EPERM;
A
Al Viro 已提交
4220
	if (!dir->i_op->link)
L
Linus Torvalds 已提交
4221
		return -EPERM;
4222
	if (S_ISDIR(inode->i_mode))
L
Linus Torvalds 已提交
4223 4224 4225 4226 4227 4228
		return -EPERM;

	error = security_inode_link(old_dentry, dir, new_dentry);
	if (error)
		return error;

A
Al Viro 已提交
4229
	inode_lock(inode);
4230
	/* Make sure we don't allow creating hardlink to an unlinked file */
4231
	if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
4232
		error =  -ENOENT;
4233 4234
	else if (max_links && inode->i_nlink >= max_links)
		error = -EMLINK;
J
J. Bruce Fields 已提交
4235 4236 4237 4238 4239
	else {
		error = try_break_deleg(inode, delegated_inode);
		if (!error)
			error = dir->i_op->link(old_dentry, dir, new_dentry);
	}
4240 4241 4242 4243 4244 4245

	if (!error && (inode->i_state & I_LINKABLE)) {
		spin_lock(&inode->i_lock);
		inode->i_state &= ~I_LINKABLE;
		spin_unlock(&inode->i_lock);
	}
A
Al Viro 已提交
4246
	inode_unlock(inode);
4247
	if (!error)
4248
		fsnotify_link(dir, inode, new_dentry);
L
Linus Torvalds 已提交
4249 4250
	return error;
}
4251
EXPORT_SYMBOL(vfs_link);
L
Linus Torvalds 已提交
4252 4253 4254 4255 4256 4257 4258 4259 4260 4261

/*
 * Hardlinks are often used in delicate situations.  We avoid
 * security-related surprises by not following symlinks on the
 * newname.  --KAB
 *
 * We don't follow them on the oldname either to be compatible
 * with linux 2.0, and to avoid hard-linking to directories
 * and other special files.  --ADM
 */
4262 4263
int do_linkat(int olddfd, const char __user *oldname, int newdfd,
	      const char __user *newname, int flags)
L
Linus Torvalds 已提交
4264 4265
{
	struct dentry *new_dentry;
4266
	struct path old_path, new_path;
J
J. Bruce Fields 已提交
4267
	struct inode *delegated_inode = NULL;
4268
	int how = 0;
L
Linus Torvalds 已提交
4269 4270
	int error;

4271
	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
4272
		return -EINVAL;
4273
	/*
4274 4275 4276
	 * To use null names we require CAP_DAC_READ_SEARCH
	 * This ensures that not everyone will be able to create
	 * handlink using the passed filedescriptor.
4277
	 */
4278 4279 4280
	if (flags & AT_EMPTY_PATH) {
		if (!capable(CAP_DAC_READ_SEARCH))
			return -ENOENT;
4281
		how = LOOKUP_EMPTY;
4282
	}
4283 4284 4285

	if (flags & AT_SYMLINK_FOLLOW)
		how |= LOOKUP_FOLLOW;
4286
retry:
4287
	error = user_path_at(olddfd, oldname, how, &old_path);
L
Linus Torvalds 已提交
4288
	if (error)
4289 4290
		return error;

4291 4292
	new_dentry = user_path_create(newdfd, newname, &new_path,
					(how & LOOKUP_REVAL));
L
Linus Torvalds 已提交
4293
	error = PTR_ERR(new_dentry);
4294
	if (IS_ERR(new_dentry))
4295 4296 4297 4298 4299
		goto out;

	error = -EXDEV;
	if (old_path.mnt != new_path.mnt)
		goto out_dput;
K
Kees Cook 已提交
4300 4301 4302
	error = may_linkat(&old_path);
	if (unlikely(error))
		goto out_dput;
4303
	error = security_path_link(old_path.dentry, &new_path, new_dentry);
4304
	if (error)
4305
		goto out_dput;
J
J. Bruce Fields 已提交
4306
	error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode);
4307
out_dput:
A
Al Viro 已提交
4308
	done_path_create(&new_path, new_dentry);
J
J. Bruce Fields 已提交
4309 4310
	if (delegated_inode) {
		error = break_deleg_wait(&delegated_inode);
4311 4312
		if (!error) {
			path_put(&old_path);
J
J. Bruce Fields 已提交
4313
			goto retry;
4314
		}
J
J. Bruce Fields 已提交
4315
	}
4316
	if (retry_estale(error, how)) {
4317
		path_put(&old_path);
4318 4319 4320
		how |= LOOKUP_REVAL;
		goto retry;
	}
L
Linus Torvalds 已提交
4321
out:
4322
	path_put(&old_path);
L
Linus Torvalds 已提交
4323 4324 4325 4326

	return error;
}

4327 4328 4329 4330 4331 4332
SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname, int, flags)
{
	return do_linkat(olddfd, oldname, newdfd, newname, flags);
}

4333
SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
4334
{
4335
	return do_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4336 4337
}

4338 4339 4340 4341 4342 4343 4344
/**
 * vfs_rename - rename a filesystem object
 * @old_dir:	parent of source
 * @old_dentry:	source
 * @new_dir:	parent of destination
 * @new_dentry:	destination
 * @delegated_inode: returns an inode needing a delegation break
M
Miklos Szeredi 已提交
4345
 * @flags:	rename flags
4346 4347 4348 4349 4350 4351 4352 4353 4354 4355 4356 4357 4358 4359
 *
 * The caller must hold multiple mutexes--see lock_rename()).
 *
 * If vfs_rename discovers a delegation in need of breaking at either
 * the source or destination, it will return -EWOULDBLOCK and return a
 * reference to the inode in delegated_inode.  The caller should then
 * break the delegation and retry.  Because breaking a delegation may
 * take a long time, the caller should drop all locks before doing
 * so.
 *
 * Alternatively, a caller may pass NULL for delegated_inode.  This may
 * be appropriate for callers that expect the underlying filesystem not
 * to be NFS exported.
 *
L
Linus Torvalds 已提交
4360 4361 4362
 * The worst of all namespace operations - renaming directory. "Perverted"
 * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
 * Problems:
4363
 *
4364
 *	a) we can get into loop creation.
L
Linus Torvalds 已提交
4365 4366
 *	b) race potential - two innocent renames can create a loop together.
 *	   That's where 4.4 screws up. Current fix: serialization on
4367
 *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
L
Linus Torvalds 已提交
4368
 *	   story.
4369 4370
 *	c) we have to lock _four_ objects - parents and victim (if it exists),
 *	   and source (if it is not a directory).
4371
 *	   And that - after we got ->i_mutex on parents (until then we don't know
L
Linus Torvalds 已提交
4372 4373
 *	   whether the target exists).  Solution: try to be smart with locking
 *	   order for inodes.  We rely on the fact that tree topology may change
4374
 *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
L
Linus Torvalds 已提交
4375 4376 4377
 *	   move will be locked.  Thus we can rank directories by the tree
 *	   (ancestors first) and rank all non-directories after them.
 *	   That works since everybody except rename does "lock parent, lookup,
4378
 *	   lock child" and rename is under ->s_vfs_rename_mutex.
L
Linus Torvalds 已提交
4379 4380 4381
 *	   HOWEVER, it relies on the assumption that any object with ->lookup()
 *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
 *	   we'd better make sure that there's no link(2) for them.
4382
 *	d) conversion from fhandle to dentry may come in the wrong moment - when
4383
 *	   we are removing the target. Solution: we will have to grab ->i_mutex
L
Linus Torvalds 已提交
4384
 *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
4385
 *	   ->i_mutex on parents, which works but leads to some truly excessive
L
Linus Torvalds 已提交
4386 4387
 *	   locking].
 */
4388 4389
int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
	       struct inode *new_dir, struct dentry *new_dentry,
M
Miklos Szeredi 已提交
4390
	       struct inode **delegated_inode, unsigned int flags)
L
Linus Torvalds 已提交
4391
{
4392 4393 4394
	int error;
	bool is_dir = d_is_dir(old_dentry);
	struct inode *source = old_dentry->d_inode;
S
Sage Weil 已提交
4395
	struct inode *target = new_dentry->d_inode;
M
Miklos Szeredi 已提交
4396 4397
	bool new_is_dir = false;
	unsigned max_links = new_dir->i_sb->s_max_links;
A
Al Viro 已提交
4398
	struct name_snapshot old_name;
4399

4400
	if (source == target)
4401 4402 4403 4404 4405 4406
		return 0;

	error = may_delete(old_dir, old_dentry, is_dir);
	if (error)
		return error;

M
Miklos Szeredi 已提交
4407
	if (!target) {
4408
		error = may_create(new_dir, new_dentry);
M
Miklos Szeredi 已提交
4409 4410 4411 4412 4413 4414 4415 4416
	} else {
		new_is_dir = d_is_dir(new_dentry);

		if (!(flags & RENAME_EXCHANGE))
			error = may_delete(new_dir, new_dentry, is_dir);
		else
			error = may_delete(new_dir, new_dentry, new_is_dir);
	}
4417 4418 4419
	if (error)
		return error;

4420
	if (!old_dir->i_op->rename)
4421
		return -EPERM;
L
Linus Torvalds 已提交
4422 4423 4424 4425 4426

	/*
	 * If we are going to change the parent - check write permissions,
	 * we'll need to flip '..'.
	 */
M
Miklos Szeredi 已提交
4427 4428 4429 4430 4431 4432 4433 4434 4435 4436 4437
	if (new_dir != old_dir) {
		if (is_dir) {
			error = inode_permission(source, MAY_WRITE);
			if (error)
				return error;
		}
		if ((flags & RENAME_EXCHANGE) && new_is_dir) {
			error = inode_permission(target, MAY_WRITE);
			if (error)
				return error;
		}
L
Linus Torvalds 已提交
4438 4439
	}

4440 4441
	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
				      flags);
L
Linus Torvalds 已提交
4442 4443 4444
	if (error)
		return error;

A
Al Viro 已提交
4445
	take_dentry_name_snapshot(&old_name, old_dentry);
4446
	dget(new_dentry);
M
Miklos Szeredi 已提交
4447
	if (!is_dir || (flags & RENAME_EXCHANGE))
4448 4449
		lock_two_nondirectories(source, target);
	else if (target)
A
Al Viro 已提交
4450
		inode_lock(target);
S
Sage Weil 已提交
4451 4452

	error = -EBUSY;
4453
	if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
S
Sage Weil 已提交
4454 4455
		goto out;

M
Miklos Szeredi 已提交
4456
	if (max_links && new_dir != old_dir) {
4457
		error = -EMLINK;
M
Miklos Szeredi 已提交
4458
		if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
4459
			goto out;
M
Miklos Szeredi 已提交
4460 4461 4462 4463 4464
		if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
		    old_dir->i_nlink >= max_links)
			goto out;
	}
	if (!is_dir) {
4465
		error = try_break_deleg(source, delegated_inode);
4466 4467
		if (error)
			goto out;
M
Miklos Szeredi 已提交
4468 4469 4470 4471 4472
	}
	if (target && !new_is_dir) {
		error = try_break_deleg(target, delegated_inode);
		if (error)
			goto out;
4473
	}
4474
	error = old_dir->i_op->rename(old_dir, old_dentry,
M
Miklos Szeredi 已提交
4475
				       new_dir, new_dentry, flags);
S
Sage Weil 已提交
4476 4477 4478
	if (error)
		goto out;

M
Miklos Szeredi 已提交
4479
	if (!(flags & RENAME_EXCHANGE) && target) {
4480 4481
		if (is_dir) {
			shrink_dcache_parent(new_dentry);
4482
			target->i_flags |= S_DEAD;
4483
		}
S
Sage Weil 已提交
4484
		dont_mount(new_dentry);
4485
		detach_mounts(new_dentry);
4486
	}
M
Miklos Szeredi 已提交
4487 4488 4489 4490 4491 4492
	if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
		if (!(flags & RENAME_EXCHANGE))
			d_move(old_dentry, new_dentry);
		else
			d_exchange(old_dentry, new_dentry);
	}
S
Sage Weil 已提交
4493
out:
M
Miklos Szeredi 已提交
4494
	if (!is_dir || (flags & RENAME_EXCHANGE))
4495 4496
		unlock_two_nondirectories(source, target);
	else if (target)
A
Al Viro 已提交
4497
		inode_unlock(target);
L
Linus Torvalds 已提交
4498
	dput(new_dentry);
M
Miklos Szeredi 已提交
4499
	if (!error) {
A
Al Viro 已提交
4500
		fsnotify_move(old_dir, new_dir, old_name.name, is_dir,
M
Miklos Szeredi 已提交
4501 4502 4503 4504 4505 4506
			      !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
		if (flags & RENAME_EXCHANGE) {
			fsnotify_move(new_dir, old_dir, old_dentry->d_name.name,
				      new_is_dir, NULL, new_dentry);
		}
	}
A
Al Viro 已提交
4507
	release_dentry_name_snapshot(&old_name);
R
Robert Love 已提交
4508

L
Linus Torvalds 已提交
4509 4510
	return error;
}
4511
EXPORT_SYMBOL(vfs_rename);
L
Linus Torvalds 已提交
4512

4513 4514
static int do_renameat2(int olddfd, const char __user *oldname, int newdfd,
			const char __user *newname, unsigned int flags)
L
Linus Torvalds 已提交
4515
{
4516 4517
	struct dentry *old_dentry, *new_dentry;
	struct dentry *trap;
4518 4519 4520
	struct path old_path, new_path;
	struct qstr old_last, new_last;
	int old_type, new_type;
4521
	struct inode *delegated_inode = NULL;
4522 4523
	struct filename *from;
	struct filename *to;
4524
	unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
4525
	bool should_retry = false;
4526
	int error;
M
Miklos Szeredi 已提交
4527

M
Miklos Szeredi 已提交
4528
	if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
M
Miklos Szeredi 已提交
4529 4530
		return -EINVAL;

M
Miklos Szeredi 已提交
4531 4532
	if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
	    (flags & RENAME_EXCHANGE))
M
Miklos Szeredi 已提交
4533 4534
		return -EINVAL;

M
Miklos Szeredi 已提交
4535 4536 4537
	if ((flags & RENAME_WHITEOUT) && !capable(CAP_MKNOD))
		return -EPERM;

4538 4539 4540
	if (flags & RENAME_EXCHANGE)
		target_flags = 0;

4541
retry:
A
Al Viro 已提交
4542 4543
	from = filename_parentat(olddfd, getname(oldname), lookup_flags,
				&old_path, &old_last, &old_type);
4544 4545
	if (IS_ERR(from)) {
		error = PTR_ERR(from);
L
Linus Torvalds 已提交
4546
		goto exit;
4547
	}
L
Linus Torvalds 已提交
4548

A
Al Viro 已提交
4549 4550
	to = filename_parentat(newdfd, getname(newname), lookup_flags,
				&new_path, &new_last, &new_type);
4551 4552
	if (IS_ERR(to)) {
		error = PTR_ERR(to);
L
Linus Torvalds 已提交
4553
		goto exit1;
4554
	}
L
Linus Torvalds 已提交
4555 4556

	error = -EXDEV;
4557
	if (old_path.mnt != new_path.mnt)
L
Linus Torvalds 已提交
4558 4559 4560
		goto exit2;

	error = -EBUSY;
4561
	if (old_type != LAST_NORM)
L
Linus Torvalds 已提交
4562 4563
		goto exit2;

M
Miklos Szeredi 已提交
4564 4565
	if (flags & RENAME_NOREPLACE)
		error = -EEXIST;
4566
	if (new_type != LAST_NORM)
L
Linus Torvalds 已提交
4567 4568
		goto exit2;

4569
	error = mnt_want_write(old_path.mnt);
4570 4571 4572
	if (error)
		goto exit2;

4573
retry_deleg:
4574
	trap = lock_rename(new_path.dentry, old_path.dentry);
L
Linus Torvalds 已提交
4575

4576
	old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags);
L
Linus Torvalds 已提交
4577 4578 4579 4580 4581
	error = PTR_ERR(old_dentry);
	if (IS_ERR(old_dentry))
		goto exit3;
	/* source must exist */
	error = -ENOENT;
4582
	if (d_is_negative(old_dentry))
L
Linus Torvalds 已提交
4583
		goto exit4;
4584
	new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags);
M
Miklos Szeredi 已提交
4585 4586 4587 4588 4589 4590
	error = PTR_ERR(new_dentry);
	if (IS_ERR(new_dentry))
		goto exit4;
	error = -EEXIST;
	if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
		goto exit5;
M
Miklos Szeredi 已提交
4591 4592 4593 4594 4595 4596 4597
	if (flags & RENAME_EXCHANGE) {
		error = -ENOENT;
		if (d_is_negative(new_dentry))
			goto exit5;

		if (!d_is_dir(new_dentry)) {
			error = -ENOTDIR;
4598
			if (new_last.name[new_last.len])
M
Miklos Szeredi 已提交
4599 4600 4601
				goto exit5;
		}
	}
L
Linus Torvalds 已提交
4602
	/* unless the source is a directory trailing slashes give -ENOTDIR */
M
Miklos Szeredi 已提交
4603
	if (!d_is_dir(old_dentry)) {
L
Linus Torvalds 已提交
4604
		error = -ENOTDIR;
4605
		if (old_last.name[old_last.len])
M
Miklos Szeredi 已提交
4606
			goto exit5;
4607
		if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
M
Miklos Szeredi 已提交
4608
			goto exit5;
L
Linus Torvalds 已提交
4609 4610 4611 4612
	}
	/* source should not be ancestor of target */
	error = -EINVAL;
	if (old_dentry == trap)
M
Miklos Szeredi 已提交
4613
		goto exit5;
L
Linus Torvalds 已提交
4614
	/* target should not be an ancestor of source */
M
Miklos Szeredi 已提交
4615 4616
	if (!(flags & RENAME_EXCHANGE))
		error = -ENOTEMPTY;
L
Linus Torvalds 已提交
4617 4618 4619
	if (new_dentry == trap)
		goto exit5;

4620 4621
	error = security_path_rename(&old_path, old_dentry,
				     &new_path, new_dentry, flags);
4622
	if (error)
4623
		goto exit5;
4624 4625
	error = vfs_rename(old_path.dentry->d_inode, old_dentry,
			   new_path.dentry->d_inode, new_dentry,
M
Miklos Szeredi 已提交
4626
			   &delegated_inode, flags);
L
Linus Torvalds 已提交
4627 4628 4629 4630 4631
exit5:
	dput(new_dentry);
exit4:
	dput(old_dentry);
exit3:
4632
	unlock_rename(new_path.dentry, old_path.dentry);
4633 4634 4635 4636 4637
	if (delegated_inode) {
		error = break_deleg_wait(&delegated_inode);
		if (!error)
			goto retry_deleg;
	}
4638
	mnt_drop_write(old_path.mnt);
L
Linus Torvalds 已提交
4639
exit2:
4640 4641
	if (retry_estale(error, lookup_flags))
		should_retry = true;
4642
	path_put(&new_path);
4643
	putname(to);
L
Linus Torvalds 已提交
4644
exit1:
4645
	path_put(&old_path);
L
Linus Torvalds 已提交
4646
	putname(from);
4647 4648 4649 4650 4651
	if (should_retry) {
		should_retry = false;
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
4652
exit:
L
Linus Torvalds 已提交
4653 4654 4655
	return error;
}

4656 4657 4658 4659 4660 4661
SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname, unsigned int, flags)
{
	return do_renameat2(olddfd, oldname, newdfd, newname, flags);
}

M
Miklos Szeredi 已提交
4662 4663 4664
SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
{
4665
	return do_renameat2(olddfd, oldname, newdfd, newname, 0);
M
Miklos Szeredi 已提交
4666 4667
}

4668
SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
4669
{
4670
	return do_renameat2(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4671 4672
}

M
Miklos Szeredi 已提交
4673 4674 4675 4676 4677 4678 4679 4680 4681 4682 4683 4684 4685 4686
int vfs_whiteout(struct inode *dir, struct dentry *dentry)
{
	int error = may_create(dir, dentry);
	if (error)
		return error;

	if (!dir->i_op->mknod)
		return -EPERM;

	return dir->i_op->mknod(dir, dentry,
				S_IFCHR | WHITEOUT_MODE, WHITEOUT_DEV);
}
EXPORT_SYMBOL(vfs_whiteout);

A
Al Viro 已提交
4687
int readlink_copy(char __user *buffer, int buflen, const char *link)
L
Linus Torvalds 已提交
4688
{
A
Al Viro 已提交
4689
	int len = PTR_ERR(link);
L
Linus Torvalds 已提交
4690 4691 4692 4693 4694 4695 4696 4697 4698 4699 4700 4701 4702 4703
	if (IS_ERR(link))
		goto out;

	len = strlen(link);
	if (len > (unsigned) buflen)
		len = buflen;
	if (copy_to_user(buffer, link, len))
		len = -EFAULT;
out:
	return len;
}

/*
 * A helper for ->readlink().  This should be used *ONLY* for symlinks that
4704 4705
 * have ->get_link() not calling nd_jump_link().  Using (or not using) it
 * for any given inode is up to filesystem.
L
Linus Torvalds 已提交
4706
 */
4707 4708
static int generic_readlink(struct dentry *dentry, char __user *buffer,
			    int buflen)
L
Linus Torvalds 已提交
4709
{
4710
	DEFINE_DELAYED_CALL(done);
4711 4712
	struct inode *inode = d_inode(dentry);
	const char *link = inode->i_link;
4713
	int res;
4714

4715
	if (!link) {
4716
		link = inode->i_op->get_link(dentry, inode, &done);
4717 4718 4719
		if (IS_ERR(link))
			return PTR_ERR(link);
	}
4720
	res = readlink_copy(buffer, buflen, link);
4721
	do_delayed_call(&done);
4722
	return res;
L
Linus Torvalds 已提交
4723 4724
}

4725 4726 4727 4728 4729 4730 4731 4732 4733 4734 4735 4736 4737 4738
/**
 * vfs_readlink - copy symlink body into userspace buffer
 * @dentry: dentry on which to get symbolic link
 * @buffer: user memory pointer
 * @buflen: size of buffer
 *
 * Does not touch atime.  That's up to the caller if necessary
 *
 * Does not call security hook.
 */
int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
	struct inode *inode = d_inode(dentry);

4739 4740 4741 4742 4743 4744 4745 4746 4747 4748 4749
	if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) {
		if (unlikely(inode->i_op->readlink))
			return inode->i_op->readlink(dentry, buffer, buflen);

		if (!d_is_symlink(dentry))
			return -EINVAL;

		spin_lock(&inode->i_lock);
		inode->i_opflags |= IOP_DEFAULT_READLINK;
		spin_unlock(&inode->i_lock);
	}
4750

4751
	return generic_readlink(dentry, buffer, buflen);
4752 4753
}
EXPORT_SYMBOL(vfs_readlink);
L
Linus Torvalds 已提交
4754

M
Miklos Szeredi 已提交
4755 4756 4757 4758 4759 4760 4761 4762 4763 4764 4765 4766 4767 4768 4769 4770 4771 4772 4773 4774 4775 4776 4777 4778 4779
/**
 * vfs_get_link - get symlink body
 * @dentry: dentry on which to get symbolic link
 * @done: caller needs to free returned data with this
 *
 * Calls security hook and i_op->get_link() on the supplied inode.
 *
 * It does not touch atime.  That's up to the caller if necessary.
 *
 * Does not work on "special" symlinks like /proc/$$/fd/N
 */
const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
{
	const char *res = ERR_PTR(-EINVAL);
	struct inode *inode = d_inode(dentry);

	if (d_is_symlink(dentry)) {
		res = ERR_PTR(security_inode_readlink(dentry));
		if (!res)
			res = inode->i_op->get_link(dentry, inode, done);
	}
	return res;
}
EXPORT_SYMBOL(vfs_get_link);

L
Linus Torvalds 已提交
4780
/* get the link contents into pagecache */
4781
const char *page_get_link(struct dentry *dentry, struct inode *inode,
4782
			  struct delayed_call *callback)
L
Linus Torvalds 已提交
4783
{
4784 4785
	char *kaddr;
	struct page *page;
4786 4787
	struct address_space *mapping = inode->i_mapping;

4788 4789 4790 4791 4792 4793 4794 4795 4796 4797 4798 4799 4800
	if (!dentry) {
		page = find_get_page(mapping, 0);
		if (!page)
			return ERR_PTR(-ECHILD);
		if (!PageUptodate(page)) {
			put_page(page);
			return ERR_PTR(-ECHILD);
		}
	} else {
		page = read_mapping_page(mapping, 0, NULL);
		if (IS_ERR(page))
			return (char*)page;
	}
4801
	set_delayed_call(callback, page_put_link, page);
4802 4803
	BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
	kaddr = page_address(page);
4804
	nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
4805
	return kaddr;
L
Linus Torvalds 已提交
4806 4807
}

4808
EXPORT_SYMBOL(page_get_link);
L
Linus Torvalds 已提交
4809

4810
void page_put_link(void *arg)
L
Linus Torvalds 已提交
4811
{
4812
	put_page(arg);
L
Linus Torvalds 已提交
4813
}
4814
EXPORT_SYMBOL(page_put_link);
L
Linus Torvalds 已提交
4815

4816 4817
int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
4818
	DEFINE_DELAYED_CALL(done);
4819 4820
	int res = readlink_copy(buffer, buflen,
				page_get_link(dentry, d_inode(dentry),
4821 4822
					      &done));
	do_delayed_call(&done);
4823 4824 4825 4826
	return res;
}
EXPORT_SYMBOL(page_readlink);

4827 4828 4829 4830
/*
 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
 */
int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
L
Linus Torvalds 已提交
4831 4832
{
	struct address_space *mapping = inode->i_mapping;
4833
	struct page *page;
4834
	void *fsdata;
4835
	int err;
4836
	unsigned int flags = 0;
4837 4838
	if (nofs)
		flags |= AOP_FLAG_NOFS;
L
Linus Torvalds 已提交
4839

4840
retry:
4841
	err = pagecache_write_begin(NULL, mapping, 0, len-1,
4842
				flags, &page, &fsdata);
L
Linus Torvalds 已提交
4843
	if (err)
4844 4845
		goto fail;

4846
	memcpy(page_address(page), symname, len-1);
4847 4848 4849

	err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
							page, fsdata);
L
Linus Torvalds 已提交
4850 4851
	if (err < 0)
		goto fail;
4852 4853 4854
	if (err < len-1)
		goto retry;

L
Linus Torvalds 已提交
4855 4856 4857 4858 4859
	mark_inode_dirty(inode);
	return 0;
fail:
	return err;
}
4860
EXPORT_SYMBOL(__page_symlink);
L
Linus Torvalds 已提交
4861

4862 4863 4864
int page_symlink(struct inode *inode, const char *symname, int len)
{
	return __page_symlink(inode, symname, len,
4865
			!mapping_gfp_constraint(inode->i_mapping, __GFP_FS));
4866
}
4867
EXPORT_SYMBOL(page_symlink);
4868

4869
const struct inode_operations page_symlink_inode_operations = {
4870
	.get_link	= page_get_link,
L
Linus Torvalds 已提交
4871 4872
};
EXPORT_SYMBOL(page_symlink_inode_operations);