super.c 25.3 KB
Newer Older
M
Miklos Szeredi 已提交
1 2 3 4 5 6 7 8 9
/*
 *
 * Copyright (C) 2011 Novell Inc.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 as published by
 * the Free Software Foundation.
 */

10
#include <uapi/linux/magic.h>
M
Miklos Szeredi 已提交
11 12 13 14 15 16
#include <linux/fs.h>
#include <linux/namei.h>
#include <linux/xattr.h>
#include <linux/mount.h>
#include <linux/parser.h>
#include <linux/module.h>
A
Andy Whitcroft 已提交
17
#include <linux/statfs.h>
E
Erez Zadok 已提交
18
#include <linux/seq_file.h>
M
Miklos Szeredi 已提交
19
#include <linux/posix_acl_xattr.h>
M
Miklos Szeredi 已提交
20
#include "overlayfs.h"
M
Miklos Szeredi 已提交
21
#include "ovl_entry.h"
M
Miklos Szeredi 已提交
22 23 24 25 26 27 28 29

MODULE_AUTHOR("Miklos Szeredi <miklos@szeredi.hu>");
MODULE_DESCRIPTION("Overlay filesystem");
MODULE_LICENSE("GPL");


struct ovl_dir_cache;

30 31
#define OVL_MAX_STACK 500

32 33 34 35
static bool ovl_redirect_dir_def = IS_ENABLED(CONFIG_OVERLAY_FS_REDIRECT_DIR);
module_param_named(redirect_dir, ovl_redirect_dir_def, bool, 0644);
MODULE_PARM_DESC(ovl_redirect_dir_def,
		 "Default to on or off for the redirect_dir feature");
M
Miklos Szeredi 已提交
36 37 38 39 40 41

static void ovl_dentry_release(struct dentry *dentry)
{
	struct ovl_entry *oe = dentry->d_fsdata;

	if (oe) {
42 43
		unsigned int i;

M
Miklos Szeredi 已提交
44
		dput(oe->__upperdentry);
M
Miklos Szeredi 已提交
45
		kfree(oe->redirect);
46 47
		for (i = 0; i < oe->numlower; i++)
			dput(oe->lowerstack[i].dentry);
M
Miklos Szeredi 已提交
48 49 50 51
		kfree_rcu(oe, rcu);
	}
}

52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67
static int ovl_check_append_only(struct inode *inode, int flag)
{
	/*
	 * This test was moot in vfs may_open() because overlay inode does
	 * not have the S_APPEND flag, so re-check on real upper inode
	 */
	if (IS_APPEND(inode)) {
		if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
			return -EPERM;
		if (flag & O_TRUNC)
			return -EPERM;
	}

	return 0;
}

68 69 70
static struct dentry *ovl_d_real(struct dentry *dentry,
				 const struct inode *inode,
				 unsigned int open_flags)
M
Miklos Szeredi 已提交
71 72
{
	struct dentry *real;
73
	int err;
M
Miklos Szeredi 已提交
74

75
	if (!d_is_reg(dentry)) {
M
Miklos Szeredi 已提交
76 77 78 79 80
		if (!inode || inode == d_inode(dentry))
			return dentry;
		goto bug;
	}

81 82 83 84
	if (d_is_negative(dentry))
		return dentry;

	if (open_flags) {
85
		err = ovl_open_maybe_copy_up(dentry, open_flags);
86 87 88 89
		if (err)
			return ERR_PTR(err);
	}

M
Miklos Szeredi 已提交
90
	real = ovl_dentry_upper(dentry);
91 92 93 94 95 96
	if (real && (!inode || inode == d_inode(real))) {
		if (!inode) {
			err = ovl_check_append_only(d_inode(real), open_flags);
			if (err)
				return ERR_PTR(err);
		}
M
Miklos Szeredi 已提交
97
		return real;
98
	}
M
Miklos Szeredi 已提交
99 100 101 102 103

	real = ovl_dentry_lower(dentry);
	if (!real)
		goto bug;

M
Miklos Szeredi 已提交
104 105 106
	/* Handle recursion */
	real = d_real(real, inode, open_flags);

M
Miklos Szeredi 已提交
107 108 109
	if (!inode || inode == d_inode(real))
		return real;
bug:
M
Miklos Szeredi 已提交
110
	WARN(1, "ovl_d_real(%pd4, %s:%lu): real dentry not found\n", dentry,
M
Miklos Szeredi 已提交
111 112 113 114
	     inode ? inode->i_sb->s_id : "NULL", inode ? inode->i_ino : 0);
	return dentry;
}

115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155
static int ovl_dentry_revalidate(struct dentry *dentry, unsigned int flags)
{
	struct ovl_entry *oe = dentry->d_fsdata;
	unsigned int i;
	int ret = 1;

	for (i = 0; i < oe->numlower; i++) {
		struct dentry *d = oe->lowerstack[i].dentry;

		if (d->d_flags & DCACHE_OP_REVALIDATE) {
			ret = d->d_op->d_revalidate(d, flags);
			if (ret < 0)
				return ret;
			if (!ret) {
				if (!(flags & LOOKUP_RCU))
					d_invalidate(d);
				return -ESTALE;
			}
		}
	}
	return 1;
}

static int ovl_dentry_weak_revalidate(struct dentry *dentry, unsigned int flags)
{
	struct ovl_entry *oe = dentry->d_fsdata;
	unsigned int i;
	int ret = 1;

	for (i = 0; i < oe->numlower; i++) {
		struct dentry *d = oe->lowerstack[i].dentry;

		if (d->d_flags & DCACHE_OP_WEAK_REVALIDATE) {
			ret = d->d_op->d_weak_revalidate(d, flags);
			if (ret <= 0)
				break;
		}
	}
	return ret;
}

M
Miklos Szeredi 已提交
156 157
static const struct dentry_operations ovl_dentry_operations = {
	.d_release = ovl_dentry_release,
M
Miklos Szeredi 已提交
158
	.d_real = ovl_d_real,
M
Miklos Szeredi 已提交
159 160
};

161 162
static const struct dentry_operations ovl_reval_dentry_operations = {
	.d_release = ovl_dentry_release,
M
Miklos Szeredi 已提交
163
	.d_real = ovl_d_real,
164 165 166 167
	.d_revalidate = ovl_dentry_revalidate,
	.d_weak_revalidate = ovl_dentry_weak_revalidate,
};

168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188
static struct kmem_cache *ovl_inode_cachep;

static struct inode *ovl_alloc_inode(struct super_block *sb)
{
	struct ovl_inode *oi = kmem_cache_alloc(ovl_inode_cachep, GFP_KERNEL);

	return &oi->vfs_inode;
}

static void ovl_i_callback(struct rcu_head *head)
{
	struct inode *inode = container_of(head, struct inode, i_rcu);

	kmem_cache_free(ovl_inode_cachep, OVL_I(inode));
}

static void ovl_destroy_inode(struct inode *inode)
{
	call_rcu(&inode->i_rcu, ovl_i_callback);
}

M
Miklos Szeredi 已提交
189 190 191
static void ovl_put_super(struct super_block *sb)
{
	struct ovl_fs *ufs = sb->s_fs_info;
192
	unsigned i;
M
Miklos Szeredi 已提交
193 194 195

	dput(ufs->workdir);
	mntput(ufs->upper_mnt);
196 197
	for (i = 0; i < ufs->numlower; i++)
		mntput(ufs->lower_mnt[i]);
198
	kfree(ufs->lower_mnt);
M
Miklos Szeredi 已提交
199

E
Erez Zadok 已提交
200 201 202
	kfree(ufs->config.lowerdir);
	kfree(ufs->config.upperdir);
	kfree(ufs->config.workdir);
203
	put_cred(ufs->creator_cred);
M
Miklos Szeredi 已提交
204 205 206
	kfree(ufs);
}

207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225
static int ovl_sync_fs(struct super_block *sb, int wait)
{
	struct ovl_fs *ufs = sb->s_fs_info;
	struct super_block *upper_sb;
	int ret;

	if (!ufs->upper_mnt)
		return 0;
	upper_sb = ufs->upper_mnt->mnt_sb;
	if (!upper_sb->s_op->sync_fs)
		return 0;

	/* real inodes have already been synced by sync_filesystem(ovl_sb) */
	down_read(&upper_sb->s_umount);
	ret = upper_sb->s_op->sync_fs(upper_sb, wait);
	up_read(&upper_sb->s_umount);
	return ret;
}

A
Andy Whitcroft 已提交
226 227 228 229 230 231
/**
 * ovl_statfs
 * @sb: The overlayfs super block
 * @buf: The struct kstatfs to fill in with stats
 *
 * Get the filesystem statistics.  As writes always target the upper layer
232
 * filesystem pass the statfs to the upper filesystem (if it exists)
A
Andy Whitcroft 已提交
233 234 235 236 237 238 239 240
 */
static int ovl_statfs(struct dentry *dentry, struct kstatfs *buf)
{
	struct ovl_fs *ofs = dentry->d_sb->s_fs_info;
	struct dentry *root_dentry = dentry->d_sb->s_root;
	struct path path;
	int err;

241
	ovl_path_real(root_dentry, &path);
A
Andy Whitcroft 已提交
242 243 244

	err = vfs_statfs(&path, buf);
	if (!err) {
M
Miklos Szeredi 已提交
245
		buf->f_namelen = ofs->namelen;
A
Andy Whitcroft 已提交
246 247 248 249 250 251
		buf->f_type = OVERLAYFS_SUPER_MAGIC;
	}

	return err;
}

E
Erez Zadok 已提交
252 253 254 255 256 257 258 259 260 261 262
/**
 * ovl_show_options
 *
 * Prints the mount options for a given superblock.
 * Returns zero; does not fail.
 */
static int ovl_show_options(struct seq_file *m, struct dentry *dentry)
{
	struct super_block *sb = dentry->d_sb;
	struct ovl_fs *ufs = sb->s_fs_info;

263
	seq_show_option(m, "lowerdir", ufs->config.lowerdir);
M
Miklos Szeredi 已提交
264
	if (ufs->config.upperdir) {
265 266
		seq_show_option(m, "upperdir", ufs->config.upperdir);
		seq_show_option(m, "workdir", ufs->config.workdir);
M
Miklos Szeredi 已提交
267
	}
M
Miklos Szeredi 已提交
268 269
	if (ufs->config.default_permissions)
		seq_puts(m, ",default_permissions");
270 271 272
	if (ufs->config.redirect_dir != ovl_redirect_dir_def)
		seq_printf(m, ",redirect_dir=%s",
			   ufs->config.redirect_dir ? "on" : "off");
E
Erez Zadok 已提交
273 274 275
	return 0;
}

276 277 278 279
static int ovl_remount(struct super_block *sb, int *flags, char *data)
{
	struct ovl_fs *ufs = sb->s_fs_info;

280
	if (!(*flags & MS_RDONLY) && (!ufs->upper_mnt || !ufs->workdir))
281 282 283 284 285
		return -EROFS;

	return 0;
}

M
Miklos Szeredi 已提交
286
static const struct super_operations ovl_super_operations = {
287 288 289
	.alloc_inode	= ovl_alloc_inode,
	.destroy_inode	= ovl_destroy_inode,
	.drop_inode	= generic_delete_inode,
M
Miklos Szeredi 已提交
290
	.put_super	= ovl_put_super,
291
	.sync_fs	= ovl_sync_fs,
A
Andy Whitcroft 已提交
292
	.statfs		= ovl_statfs,
E
Erez Zadok 已提交
293
	.show_options	= ovl_show_options,
294
	.remount_fs	= ovl_remount,
M
Miklos Szeredi 已提交
295 296 297 298 299 300
};

enum {
	OPT_LOWERDIR,
	OPT_UPPERDIR,
	OPT_WORKDIR,
M
Miklos Szeredi 已提交
301
	OPT_DEFAULT_PERMISSIONS,
M
Miklos Szeredi 已提交
302 303
	OPT_REDIRECT_DIR_ON,
	OPT_REDIRECT_DIR_OFF,
M
Miklos Szeredi 已提交
304 305 306 307 308 309 310
	OPT_ERR,
};

static const match_table_t ovl_tokens = {
	{OPT_LOWERDIR,			"lowerdir=%s"},
	{OPT_UPPERDIR,			"upperdir=%s"},
	{OPT_WORKDIR,			"workdir=%s"},
M
Miklos Szeredi 已提交
311
	{OPT_DEFAULT_PERMISSIONS,	"default_permissions"},
M
Miklos Szeredi 已提交
312 313
	{OPT_REDIRECT_DIR_ON,		"redirect_dir=on"},
	{OPT_REDIRECT_DIR_OFF,		"redirect_dir=off"},
M
Miklos Szeredi 已提交
314 315 316
	{OPT_ERR,			NULL}
};

M
Miklos Szeredi 已提交
317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339
static char *ovl_next_opt(char **s)
{
	char *sbegin = *s;
	char *p;

	if (sbegin == NULL)
		return NULL;

	for (p = sbegin; *p; p++) {
		if (*p == '\\') {
			p++;
			if (!*p)
				break;
		} else if (*p == ',') {
			*p = '\0';
			*s = p + 1;
			return sbegin;
		}
	}
	*s = NULL;
	return sbegin;
}

M
Miklos Szeredi 已提交
340 341 342 343
static int ovl_parse_opt(char *opt, struct ovl_config *config)
{
	char *p;

M
Miklos Szeredi 已提交
344
	while ((p = ovl_next_opt(&opt)) != NULL) {
M
Miklos Szeredi 已提交
345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373
		int token;
		substring_t args[MAX_OPT_ARGS];

		if (!*p)
			continue;

		token = match_token(p, ovl_tokens, args);
		switch (token) {
		case OPT_UPPERDIR:
			kfree(config->upperdir);
			config->upperdir = match_strdup(&args[0]);
			if (!config->upperdir)
				return -ENOMEM;
			break;

		case OPT_LOWERDIR:
			kfree(config->lowerdir);
			config->lowerdir = match_strdup(&args[0]);
			if (!config->lowerdir)
				return -ENOMEM;
			break;

		case OPT_WORKDIR:
			kfree(config->workdir);
			config->workdir = match_strdup(&args[0]);
			if (!config->workdir)
				return -ENOMEM;
			break;

M
Miklos Szeredi 已提交
374 375 376 377
		case OPT_DEFAULT_PERMISSIONS:
			config->default_permissions = true;
			break;

M
Miklos Szeredi 已提交
378 379 380 381 382 383 384 385
		case OPT_REDIRECT_DIR_ON:
			config->redirect_dir = true;
			break;

		case OPT_REDIRECT_DIR_OFF:
			config->redirect_dir = false;
			break;

M
Miklos Szeredi 已提交
386
		default:
387
			pr_err("overlayfs: unrecognized mount option \"%s\" or missing value\n", p);
M
Miklos Szeredi 已提交
388 389 390
			return -EINVAL;
		}
	}
H
hujianyang 已提交
391 392 393 394 395 396 397 398 399

	/* Workdir is useless in non-upper mount */
	if (!config->upperdir && config->workdir) {
		pr_info("overlayfs: option \"workdir=%s\" is useless in a non-upper mount, ignore\n",
			config->workdir);
		kfree(config->workdir);
		config->workdir = NULL;
	}

M
Miklos Szeredi 已提交
400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416
	return 0;
}

#define OVL_WORKDIR_NAME "work"

static struct dentry *ovl_workdir_create(struct vfsmount *mnt,
					 struct dentry *dentry)
{
	struct inode *dir = dentry->d_inode;
	struct dentry *work;
	int err;
	bool retried = false;

	err = mnt_want_write(mnt);
	if (err)
		return ERR_PTR(err);

A
Al Viro 已提交
417
	inode_lock_nested(dir, I_MUTEX_PARENT);
M
Miklos Szeredi 已提交
418 419 420 421 422
retry:
	work = lookup_one_len(OVL_WORKDIR_NAME, dentry,
			      strlen(OVL_WORKDIR_NAME));

	if (!IS_ERR(work)) {
423 424
		struct iattr attr = {
			.ia_valid = ATTR_MODE,
A
Al Viro 已提交
425
			.ia_mode = S_IFDIR | 0,
426
		};
M
Miklos Szeredi 已提交
427 428 429 430 431 432 433

		if (work->d_inode) {
			err = -EEXIST;
			if (retried)
				goto out_dput;

			retried = true;
M
Miklos Szeredi 已提交
434
			ovl_workdir_cleanup(dir, mnt, work, 0);
M
Miklos Szeredi 已提交
435 436 437 438
			dput(work);
			goto retry;
		}

A
Al Viro 已提交
439 440 441
		err = ovl_create_real(dir, work,
				      &(struct cattr){.mode = S_IFDIR | 0},
				      NULL, true);
M
Miklos Szeredi 已提交
442 443
		if (err)
			goto out_dput;
444

445 446 447 448 449 450 451 452 453 454 455 456 457
		/*
		 * Try to remove POSIX ACL xattrs from workdir.  We are good if:
		 *
		 * a) success (there was a POSIX ACL xattr and was removed)
		 * b) -ENODATA (there was no POSIX ACL xattr)
		 * c) -EOPNOTSUPP (POSIX ACL xattrs are not supported)
		 *
		 * There are various other error values that could effectively
		 * mean that the xattr doesn't exist (e.g. -ERANGE is returned
		 * if the xattr name is too long), but the set of filesystems
		 * allowed as upper are limited to "normal" ones, where checking
		 * for the above two errors is sufficient.
		 */
458
		err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT);
M
Miklos Szeredi 已提交
459
		if (err && err != -ENODATA && err != -EOPNOTSUPP)
460 461 462
			goto out_dput;

		err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS);
M
Miklos Szeredi 已提交
463
		if (err && err != -ENODATA && err != -EOPNOTSUPP)
464 465 466 467 468 469 470 471
			goto out_dput;

		/* Clear any inherited mode bits */
		inode_lock(work->d_inode);
		err = notify_change(work, &attr, NULL);
		inode_unlock(work->d_inode);
		if (err)
			goto out_dput;
M
Miklos Szeredi 已提交
472 473
	}
out_unlock:
A
Al Viro 已提交
474
	inode_unlock(dir);
M
Miklos Szeredi 已提交
475 476 477 478 479 480 481 482 483 484
	mnt_drop_write(mnt);

	return work;

out_dput:
	dput(work);
	work = ERR_PTR(err);
	goto out_unlock;
}

M
Miklos Szeredi 已提交
485 486 487 488 489 490 491 492 493 494 495 496 497
static void ovl_unescape(char *s)
{
	char *d = s;

	for (;; s++, d++) {
		if (*s == '\\')
			s++;
		*d = *s;
		if (!*s)
			break;
	}
}

M
Miklos Szeredi 已提交
498 499
static int ovl_mount_dir_noesc(const char *name, struct path *path)
{
500
	int err = -EINVAL;
M
Miklos Szeredi 已提交
501

502 503 504 505
	if (!*name) {
		pr_err("overlayfs: empty lowerdir\n");
		goto out;
	}
M
Miklos Szeredi 已提交
506 507 508 509 510 511
	err = kern_path(name, LOOKUP_FOLLOW, path);
	if (err) {
		pr_err("overlayfs: failed to resolve '%s': %i\n", name, err);
		goto out;
	}
	err = -EINVAL;
512
	if (ovl_dentry_weird(path->dentry)) {
M
Miklos Szeredi 已提交
513 514 515
		pr_err("overlayfs: filesystem on '%s' not supported\n", name);
		goto out_put;
	}
M
Miklos Szeredi 已提交
516
	if (!d_is_dir(path->dentry)) {
M
Miklos Szeredi 已提交
517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535
		pr_err("overlayfs: '%s' not a directory\n", name);
		goto out_put;
	}
	return 0;

out_put:
	path_put(path);
out:
	return err;
}

static int ovl_mount_dir(const char *name, struct path *path)
{
	int err = -ENOMEM;
	char *tmp = kstrdup(name, GFP_KERNEL);

	if (tmp) {
		ovl_unescape(tmp);
		err = ovl_mount_dir_noesc(tmp, path);
536 537 538 539 540 541 542 543

		if (!err)
			if (ovl_dentry_remote(path->dentry)) {
				pr_err("overlayfs: filesystem on '%s' not supported as upperdir\n",
				       tmp);
				path_put(path);
				err = -EINVAL;
			}
M
Miklos Szeredi 已提交
544 545 546 547 548
		kfree(tmp);
	}
	return err;
}

M
Miklos Szeredi 已提交
549 550
static int ovl_check_namelen(struct path *path, struct ovl_fs *ofs,
			     const char *name)
M
Miklos Szeredi 已提交
551 552
{
	struct kstatfs statfs;
M
Miklos Szeredi 已提交
553 554 555 556 557 558 559 560 561 562 563 564 565 566
	int err = vfs_statfs(path, &statfs);

	if (err)
		pr_err("overlayfs: statfs failed on '%s'\n", name);
	else
		ofs->namelen = max(ofs->namelen, statfs.f_namelen);

	return err;
}

static int ovl_lower_dir(const char *name, struct path *path,
			 struct ovl_fs *ofs, int *stack_depth, bool *remote)
{
	int err;
M
Miklos Szeredi 已提交
567

568
	err = ovl_mount_dir_noesc(name, path);
M
Miklos Szeredi 已提交
569 570 571
	if (err)
		goto out;

M
Miklos Szeredi 已提交
572 573
	err = ovl_check_namelen(path, ofs, name);
	if (err)
M
Miklos Szeredi 已提交
574
		goto out_put;
M
Miklos Szeredi 已提交
575

M
Miklos Szeredi 已提交
576 577
	*stack_depth = max(*stack_depth, path->mnt->mnt_sb->s_stack_depth);

578 579 580
	if (ovl_dentry_remote(path->dentry))
		*remote = true;

M
Miklos Szeredi 已提交
581 582 583 584 585 586 587 588
	return 0;

out_put:
	path_put(path);
out:
	return err;
}

M
Miklos Szeredi 已提交
589 590 591 592 593 594 595 596 597 598 599 600
/* Workdir should not be subdir of upperdir and vice versa */
static bool ovl_workdir_ok(struct dentry *workdir, struct dentry *upperdir)
{
	bool ok = false;

	if (workdir != upperdir) {
		ok = (lock_rename(workdir, upperdir) == NULL);
		unlock_rename(workdir, upperdir);
	}
	return ok;
}

601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620
static unsigned int ovl_split_lowerdirs(char *str)
{
	unsigned int ctr = 1;
	char *s, *d;

	for (s = d = str;; s++, d++) {
		if (*s == '\\') {
			s++;
		} else if (*s == ':') {
			*d = '\0';
			ctr++;
			continue;
		}
		*d = *s;
		if (!*s)
			break;
	}
	return ctr;
}

621 622 623 624 625 626 627 628
static int __maybe_unused
ovl_posix_acl_xattr_get(const struct xattr_handler *handler,
			struct dentry *dentry, struct inode *inode,
			const char *name, void *buffer, size_t size)
{
	return ovl_xattr_get(dentry, handler->name, buffer, size);
}

629 630 631 632 633
static int __maybe_unused
ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
			struct dentry *dentry, struct inode *inode,
			const char *name, const void *value,
			size_t size, int flags)
M
Miklos Szeredi 已提交
634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660
{
	struct dentry *workdir = ovl_workdir(dentry);
	struct inode *realinode = ovl_inode_real(inode, NULL);
	struct posix_acl *acl = NULL;
	int err;

	/* Check that everything is OK before copy-up */
	if (value) {
		acl = posix_acl_from_xattr(&init_user_ns, value, size);
		if (IS_ERR(acl))
			return PTR_ERR(acl);
	}
	err = -EOPNOTSUPP;
	if (!IS_POSIXACL(d_inode(workdir)))
		goto out_acl_release;
	if (!realinode->i_op->set_acl)
		goto out_acl_release;
	if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) {
		err = acl ? -EACCES : 0;
		goto out_acl_release;
	}
	err = -EPERM;
	if (!inode_owner_or_capable(inode))
		goto out_acl_release;

	posix_acl_release(acl);

661 662 663 664 665 666 667 668 669 670 671 672 673 674 675
	/*
	 * Check if sgid bit needs to be cleared (actual setacl operation will
	 * be done with mounter's capabilities and so that won't do it for us).
	 */
	if (unlikely(inode->i_mode & S_ISGID) &&
	    handler->flags == ACL_TYPE_ACCESS &&
	    !in_group_p(inode->i_gid) &&
	    !capable_wrt_inode_uidgid(inode, CAP_FSETID)) {
		struct iattr iattr = { .ia_valid = ATTR_KILL_SGID };

		err = ovl_setattr(dentry, &iattr);
		if (err)
			return err;
	}

676 677 678 679 680
	err = ovl_xattr_set(dentry, handler->name, value, size, flags);
	if (!err)
		ovl_copyattr(ovl_inode_real(inode, NULL), inode);

	return err;
M
Miklos Szeredi 已提交
681 682 683 684 685 686

out_acl_release:
	posix_acl_release(acl);
	return err;
}

687 688 689 690
static int ovl_own_xattr_get(const struct xattr_handler *handler,
			     struct dentry *dentry, struct inode *inode,
			     const char *name, void *buffer, size_t size)
{
A
Amir Goldstein 已提交
691
	return -EOPNOTSUPP;
692 693
}

M
Miklos Szeredi 已提交
694 695 696 697 698
static int ovl_own_xattr_set(const struct xattr_handler *handler,
			     struct dentry *dentry, struct inode *inode,
			     const char *name, const void *value,
			     size_t size, int flags)
{
A
Amir Goldstein 已提交
699
	return -EOPNOTSUPP;
M
Miklos Szeredi 已提交
700 701
}

702 703 704 705 706 707 708
static int ovl_other_xattr_get(const struct xattr_handler *handler,
			       struct dentry *dentry, struct inode *inode,
			       const char *name, void *buffer, size_t size)
{
	return ovl_xattr_get(dentry, name, buffer, size);
}

709 710 711 712 713 714 715 716
static int ovl_other_xattr_set(const struct xattr_handler *handler,
			       struct dentry *dentry, struct inode *inode,
			       const char *name, const void *value,
			       size_t size, int flags)
{
	return ovl_xattr_set(dentry, name, value, size, flags);
}

717 718
static const struct xattr_handler __maybe_unused
ovl_posix_acl_access_xattr_handler = {
M
Miklos Szeredi 已提交
719 720
	.name = XATTR_NAME_POSIX_ACL_ACCESS,
	.flags = ACL_TYPE_ACCESS,
721
	.get = ovl_posix_acl_xattr_get,
M
Miklos Szeredi 已提交
722 723 724
	.set = ovl_posix_acl_xattr_set,
};

725 726
static const struct xattr_handler __maybe_unused
ovl_posix_acl_default_xattr_handler = {
M
Miklos Szeredi 已提交
727 728
	.name = XATTR_NAME_POSIX_ACL_DEFAULT,
	.flags = ACL_TYPE_DEFAULT,
729
	.get = ovl_posix_acl_xattr_get,
M
Miklos Szeredi 已提交
730 731 732 733 734
	.set = ovl_posix_acl_xattr_set,
};

static const struct xattr_handler ovl_own_xattr_handler = {
	.prefix	= OVL_XATTR_PREFIX,
735
	.get = ovl_own_xattr_get,
M
Miklos Szeredi 已提交
736 737 738 739 740
	.set = ovl_own_xattr_set,
};

static const struct xattr_handler ovl_other_xattr_handler = {
	.prefix	= "", /* catch all */
741
	.get = ovl_other_xattr_get,
M
Miklos Szeredi 已提交
742 743 744 745
	.set = ovl_other_xattr_set,
};

static const struct xattr_handler *ovl_xattr_handlers[] = {
746
#ifdef CONFIG_FS_POSIX_ACL
M
Miklos Szeredi 已提交
747 748
	&ovl_posix_acl_access_xattr_handler,
	&ovl_posix_acl_default_xattr_handler,
749
#endif
M
Miklos Szeredi 已提交
750 751 752 753 754
	&ovl_own_xattr_handler,
	&ovl_other_xattr_handler,
	NULL
};

M
Miklos Szeredi 已提交
755 756
static int ovl_fill_super(struct super_block *sb, void *data, int silent)
{
K
Kees Cook 已提交
757 758
	struct path upperpath = { };
	struct path workpath = { };
M
Miklos Szeredi 已提交
759
	struct dentry *root_dentry;
760
	struct inode *realinode;
M
Miklos Szeredi 已提交
761 762
	struct ovl_entry *oe;
	struct ovl_fs *ufs;
763 764 765 766 767
	struct path *stack = NULL;
	char *lowertmp;
	char *lower;
	unsigned int numlower;
	unsigned int stacklen = 0;
768
	unsigned int i;
769
	bool remote = false;
770
	struct cred *cred;
M
Miklos Szeredi 已提交
771 772
	int err;

E
Erez Zadok 已提交
773 774 775
	err = -ENOMEM;
	ufs = kzalloc(sizeof(struct ovl_fs), GFP_KERNEL);
	if (!ufs)
M
Miklos Szeredi 已提交
776 777
		goto out;

778
	init_waitqueue_head(&ufs->copyup_wq);
779
	ufs->config.redirect_dir = ovl_redirect_dir_def;
E
Erez Zadok 已提交
780 781 782 783
	err = ovl_parse_opt((char *) data, &ufs->config);
	if (err)
		goto out_free_config;

M
Miklos Szeredi 已提交
784
	err = -EINVAL;
M
Miklos Szeredi 已提交
785
	if (!ufs->config.lowerdir) {
786 787
		if (!silent)
			pr_err("overlayfs: missing 'lowerdir'\n");
M
Miklos Szeredi 已提交
788 789 790
		goto out_free_config;
	}

M
Miklos Szeredi 已提交
791
	sb->s_stack_depth = 0;
792
	sb->s_maxbytes = MAX_LFS_FILESIZE;
M
Miklos Szeredi 已提交
793 794 795 796 797
	if (ufs->config.upperdir) {
		if (!ufs->config.workdir) {
			pr_err("overlayfs: missing 'workdir'\n");
			goto out_free_config;
		}
M
Miklos Szeredi 已提交
798

M
Miklos Szeredi 已提交
799 800 801
		err = ovl_mount_dir(ufs->config.upperdir, &upperpath);
		if (err)
			goto out_free_config;
M
Miklos Szeredi 已提交
802

H
hujianyang 已提交
803 804 805 806 807 808 809
		/* Upper fs should not be r/o */
		if (upperpath.mnt->mnt_sb->s_flags & MS_RDONLY) {
			pr_err("overlayfs: upper fs is r/o, try multi-lower layers mount\n");
			err = -EINVAL;
			goto out_put_upperpath;
		}

M
Miklos Szeredi 已提交
810 811 812 813
		err = ovl_check_namelen(&upperpath, ufs, ufs->config.upperdir);
		if (err)
			goto out_put_upperpath;

M
Miklos Szeredi 已提交
814 815 816 817
		err = ovl_mount_dir(ufs->config.workdir, &workpath);
		if (err)
			goto out_put_upperpath;

818
		err = -EINVAL;
M
Miklos Szeredi 已提交
819 820 821 822 823 824 825 826 827
		if (upperpath.mnt != workpath.mnt) {
			pr_err("overlayfs: workdir and upperdir must reside under the same mount\n");
			goto out_put_workpath;
		}
		if (!ovl_workdir_ok(workpath.dentry, upperpath.dentry)) {
			pr_err("overlayfs: workdir and upperdir must be separate subtrees\n");
			goto out_put_workpath;
		}
		sb->s_stack_depth = upperpath.mnt->mnt_sb->s_stack_depth;
A
Andy Whitcroft 已提交
828
	}
829 830 831
	err = -ENOMEM;
	lowertmp = kstrdup(ufs->config.lowerdir, GFP_KERNEL);
	if (!lowertmp)
M
Miklos Szeredi 已提交
832
		goto out_put_workpath;
833

834 835
	err = -EINVAL;
	stacklen = ovl_split_lowerdirs(lowertmp);
836
	if (stacklen > OVL_MAX_STACK) {
837
		pr_err("overlayfs: too many lower directories, limit is %d\n",
838
		       OVL_MAX_STACK);
839
		goto out_free_lowertmp;
840 841 842 843
	} else if (!ufs->config.upperdir && stacklen == 1) {
		pr_err("overlayfs: at least 2 lowerdir are needed while upperdir nonexistent\n");
		goto out_free_lowertmp;
	}
844

845
	err = -ENOMEM;
846 847 848 849
	stack = kcalloc(stacklen, sizeof(struct path), GFP_KERNEL);
	if (!stack)
		goto out_free_lowertmp;

850
	err = -EINVAL;
851 852
	lower = lowertmp;
	for (numlower = 0; numlower < stacklen; numlower++) {
M
Miklos Szeredi 已提交
853 854
		err = ovl_lower_dir(lower, &stack[numlower], ufs,
				    &sb->s_stack_depth, &remote);
855 856 857 858 859 860
		if (err)
			goto out_put_lowerpath;

		lower = strchr(lower, '\0') + 1;
	}

861
	err = -EINVAL;
M
Miklos Szeredi 已提交
862
	sb->s_stack_depth++;
863 864
	if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
		pr_err("overlayfs: maximum fs stacking depth exceeded\n");
865
		goto out_put_lowerpath;
866 867
	}

M
Miklos Szeredi 已提交
868 869 870 871 872 873 874
	if (ufs->config.upperdir) {
		ufs->upper_mnt = clone_private_mount(&upperpath);
		err = PTR_ERR(ufs->upper_mnt);
		if (IS_ERR(ufs->upper_mnt)) {
			pr_err("overlayfs: failed to clone upperpath\n");
			goto out_put_lowerpath;
		}
M
Miklos Szeredi 已提交
875 876 877 878
		/* Don't inherit atime flags */
		ufs->upper_mnt->mnt_flags &= ~(MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME);

		sb->s_time_gran = ufs->upper_mnt->mnt_sb->s_time_gran;
879

M
Miklos Szeredi 已提交
880 881 882
		ufs->workdir = ovl_workdir_create(ufs->upper_mnt, workpath.dentry);
		err = PTR_ERR(ufs->workdir);
		if (IS_ERR(ufs->workdir)) {
883 884 885 886
			pr_warn("overlayfs: failed to create directory %s/%s (errno: %i); mounting read-only\n",
				ufs->config.workdir, OVL_WORKDIR_NAME, -err);
			sb->s_flags |= MS_RDONLY;
			ufs->workdir = NULL;
M
Miklos Szeredi 已提交
887
		}
888 889 890 891

		/*
		 * Upper should support d_type, else whiteouts are visible.
		 * Given workdir and upper are on same fs, we can do
892 893
		 * iterate_dir() on workdir. This check requires successful
		 * creation of workdir in previous step.
894
		 */
895
		if (ufs->workdir) {
896 897
			struct dentry *temp;

898 899 900
			err = ovl_check_d_type_supported(&workpath);
			if (err < 0)
				goto out_put_workdir;
901

902 903 904 905 906 907 908
			/*
			 * We allowed this configuration and don't want to
			 * break users over kernel upgrade. So warn instead
			 * of erroring out.
			 */
			if (!err)
				pr_warn("overlayfs: upper fs needs to support d_type.\n");
909 910 911 912 913 914 915 916

			/* Check if upper/work fs supports O_TMPFILE */
			temp = ovl_do_tmpfile(ufs->workdir, S_IFREG | 0);
			ufs->tmpfile = !IS_ERR(temp);
			if (ufs->tmpfile)
				dput(temp);
			else
				pr_warn("overlayfs: upper fs does not support tmpfile.\n");
917 918 919 920 921 922 923 924 925 926 927 928 929

			/*
			 * Check if upper/work fs supports trusted.overlay.*
			 * xattr
			 */
			err = ovl_do_setxattr(ufs->workdir, OVL_XATTR_OPAQUE,
					      "0", 1, 0);
			if (err) {
				ufs->noxattr = true;
				pr_warn("overlayfs: upper fs does not support xattr.\n");
			} else {
				vfs_removexattr(ufs->workdir, OVL_XATTR_OPAQUE);
			}
930
		}
M
Miklos Szeredi 已提交
931 932
	}

933
	err = -ENOMEM;
934
	ufs->lower_mnt = kcalloc(numlower, sizeof(struct vfsmount *), GFP_KERNEL);
935
	if (ufs->lower_mnt == NULL)
936
		goto out_put_workdir;
937 938
	for (i = 0; i < numlower; i++) {
		struct vfsmount *mnt = clone_private_mount(&stack[i]);
939

940
		err = PTR_ERR(mnt);
941 942 943 944 945 946 947 948
		if (IS_ERR(mnt)) {
			pr_err("overlayfs: failed to clone lowerpath\n");
			goto out_put_lower_mnt;
		}
		/*
		 * Make lower_mnt R/O.  That way fchmod/fchown on lower file
		 * will fail instead of modifying lower fs.
		 */
M
Miklos Szeredi 已提交
949
		mnt->mnt_flags |= MNT_READONLY | MNT_NOATIME;
950

951 952
		ufs->lower_mnt[ufs->numlower] = mnt;
		ufs->numlower++;
953 954 955 956 957 958

		/* Check if all lower layers are on same sb */
		if (i == 0)
			ufs->same_sb = mnt->mnt_sb;
		else if (ufs->same_sb != mnt->mnt_sb)
			ufs->same_sb = NULL;
959
	}
M
Miklos Szeredi 已提交
960

H
hujianyang 已提交
961 962
	/* If the upper fs is nonexistent, we mark overlayfs r/o too */
	if (!ufs->upper_mnt)
M
Miklos Szeredi 已提交
963
		sb->s_flags |= MS_RDONLY;
964 965
	else if (ufs->upper_mnt->mnt_sb != ufs->same_sb)
		ufs->same_sb = NULL;
M
Miklos Szeredi 已提交
966

967 968 969 970
	if (remote)
		sb->s_d_op = &ovl_reval_dentry_operations;
	else
		sb->s_d_op = &ovl_dentry_operations;
M
Miklos Szeredi 已提交
971

972 973
	ufs->creator_cred = cred = prepare_creds();
	if (!cred)
974 975
		goto out_put_lower_mnt;

976 977 978
	/* Never override disk quota limits or use reserved space */
	cap_lower(cred->cap_effective, CAP_SYS_RESOURCE);

M
Miklos Szeredi 已提交
979
	err = -ENOMEM;
980
	oe = ovl_alloc_entry(numlower);
981
	if (!oe)
982
		goto out_put_cred;
M
Miklos Szeredi 已提交
983

984 985 986 987 988 989
	sb->s_magic = OVERLAYFS_SUPER_MAGIC;
	sb->s_op = &ovl_super_operations;
	sb->s_xattr = ovl_xattr_handlers;
	sb->s_fs_info = ufs;
	sb->s_flags |= MS_POSIXACL | MS_NOREMOTELOCK;

990
	root_dentry = d_make_root(ovl_new_inode(sb, S_IFDIR, 0));
M
Miklos Szeredi 已提交
991
	if (!root_dentry)
992
		goto out_free_oe;
M
Miklos Szeredi 已提交
993 994

	mntput(upperpath.mnt);
995 996
	for (i = 0; i < numlower; i++)
		mntput(stack[i].mnt);
M
Miklos Szeredi 已提交
997
	path_put(&workpath);
998
	kfree(lowertmp);
M
Miklos Szeredi 已提交
999

1000 1001 1002 1003
	if (upperpath.dentry) {
		oe->__upperdentry = upperpath.dentry;
		oe->impure = ovl_is_impuredir(upperpath.dentry);
	}
1004 1005 1006 1007
	for (i = 0; i < numlower; i++) {
		oe->lowerstack[i].dentry = stack[i].dentry;
		oe->lowerstack[i].mnt = ufs->lower_mnt[i];
	}
1008
	kfree(stack);
M
Miklos Szeredi 已提交
1009 1010 1011

	root_dentry->d_fsdata = oe;

1012 1013 1014
	realinode = d_inode(ovl_dentry_real(root_dentry));
	ovl_inode_init(d_inode(root_dentry), realinode, !!upperpath.dentry);
	ovl_copyattr(realinode, d_inode(root_dentry));
M
Miklos Szeredi 已提交
1015

M
Miklos Szeredi 已提交
1016 1017 1018 1019
	sb->s_root = root_dentry;

	return 0;

1020 1021
out_free_oe:
	kfree(oe);
1022 1023
out_put_cred:
	put_cred(ufs->creator_cred);
M
Miklos Szeredi 已提交
1024
out_put_lower_mnt:
1025 1026 1027
	for (i = 0; i < ufs->numlower; i++)
		mntput(ufs->lower_mnt[i]);
	kfree(ufs->lower_mnt);
1028 1029
out_put_workdir:
	dput(ufs->workdir);
M
Miklos Szeredi 已提交
1030 1031
	mntput(ufs->upper_mnt);
out_put_lowerpath:
1032 1033 1034 1035 1036
	for (i = 0; i < numlower; i++)
		path_put(&stack[i]);
	kfree(stack);
out_free_lowertmp:
	kfree(lowertmp);
1037 1038
out_put_workpath:
	path_put(&workpath);
M
Miklos Szeredi 已提交
1039 1040 1041
out_put_upperpath:
	path_put(&upperpath);
out_free_config:
E
Erez Zadok 已提交
1042 1043 1044 1045
	kfree(ufs->config.lowerdir);
	kfree(ufs->config.upperdir);
	kfree(ufs->config.workdir);
	kfree(ufs);
M
Miklos Szeredi 已提交
1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057
out:
	return err;
}

static struct dentry *ovl_mount(struct file_system_type *fs_type, int flags,
				const char *dev_name, void *raw_data)
{
	return mount_nodev(fs_type, flags, raw_data, ovl_fill_super);
}

static struct file_system_type ovl_fs_type = {
	.owner		= THIS_MODULE,
1058
	.name		= "overlay",
M
Miklos Szeredi 已提交
1059 1060 1061
	.mount		= ovl_mount,
	.kill_sb	= kill_anon_super,
};
1062
MODULE_ALIAS_FS("overlay");
M
Miklos Szeredi 已提交
1063

1064 1065 1066 1067 1068 1069 1070
static void ovl_inode_init_once(void *foo)
{
	struct ovl_inode *oi = foo;

	inode_init_once(&oi->vfs_inode);
}

M
Miklos Szeredi 已提交
1071 1072
static int __init ovl_init(void)
{
1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087
	int err;

	ovl_inode_cachep = kmem_cache_create("ovl_inode",
					     sizeof(struct ovl_inode), 0,
					     (SLAB_RECLAIM_ACCOUNT|
					      SLAB_MEM_SPREAD|SLAB_ACCOUNT),
					     ovl_inode_init_once);
	if (ovl_inode_cachep == NULL)
		return -ENOMEM;

	err = register_filesystem(&ovl_fs_type);
	if (err)
		kmem_cache_destroy(ovl_inode_cachep);

	return err;
M
Miklos Szeredi 已提交
1088 1089 1090 1091 1092
}

static void __exit ovl_exit(void)
{
	unregister_filesystem(&ovl_fs_type);
1093 1094 1095 1096 1097 1098 1099 1100

	/*
	 * Make sure all delayed rcu free inodes are flushed before we
	 * destroy cache.
	 */
	rcu_barrier();
	kmem_cache_destroy(ovl_inode_cachep);

M
Miklos Szeredi 已提交
1101 1102 1103 1104
}

module_init(ovl_init);
module_exit(ovl_exit);