namespace.c 63.1 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13
/*
 *  linux/fs/namespace.c
 *
 * (C) Copyright Al Viro 2000, 2001
 *	Released under GPL v2.
 *
 * Based on code from fs/super.c, copyright Linus Torvalds and others.
 * Heavily rewritten.
 */

#include <linux/syscalls.h>
#include <linux/slab.h>
#include <linux/sched.h>
N
Nick Piggin 已提交
14 15
#include <linux/spinlock.h>
#include <linux/percpu.h>
L
Linus Torvalds 已提交
16
#include <linux/init.h>
17
#include <linux/kernel.h>
L
Linus Torvalds 已提交
18
#include <linux/acct.h>
19
#include <linux/capability.h>
20
#include <linux/cpumask.h>
L
Linus Torvalds 已提交
21
#include <linux/module.h>
22
#include <linux/sysfs.h>
L
Linus Torvalds 已提交
23
#include <linux/seq_file.h>
24
#include <linux/mnt_namespace.h>
L
Linus Torvalds 已提交
25
#include <linux/namei.h>
A
Alexey Dobriyan 已提交
26
#include <linux/nsproxy.h>
L
Linus Torvalds 已提交
27 28
#include <linux/security.h>
#include <linux/mount.h>
29
#include <linux/ramfs.h>
E
Eric Dumazet 已提交
30
#include <linux/log2.h>
31
#include <linux/idr.h>
32
#include <linux/fs_struct.h>
33
#include <linux/fsnotify.h>
L
Linus Torvalds 已提交
34 35
#include <asm/uaccess.h>
#include <asm/unistd.h>
36
#include "pnode.h"
37
#include "internal.h"
L
Linus Torvalds 已提交
38

E
Eric Dumazet 已提交
39 40 41
#define HASH_SHIFT ilog2(PAGE_SIZE / sizeof(struct list_head))
#define HASH_SIZE (1UL << HASH_SHIFT)

A
Al Viro 已提交
42
static int event;
43
static DEFINE_IDA(mnt_id_ida);
44
static DEFINE_IDA(mnt_group_ida);
N
Nick Piggin 已提交
45
static DEFINE_SPINLOCK(mnt_id_lock);
46 47
static int mnt_id_start = 0;
static int mnt_group_start = 1;
L
Linus Torvalds 已提交
48

49
static struct list_head *mount_hashtable __read_mostly;
50
static struct kmem_cache *mnt_cache __read_mostly;
R
Ram Pai 已提交
51
static struct rw_semaphore namespace_sem;
L
Linus Torvalds 已提交
52

M
Miklos Szeredi 已提交
53
/* /sys/fs */
54 55
struct kobject *fs_kobj;
EXPORT_SYMBOL_GPL(fs_kobj);
M
Miklos Szeredi 已提交
56

N
Nick Piggin 已提交
57 58 59 60 61 62 63 64 65 66
/*
 * vfsmount lock may be taken for read to prevent changes to the
 * vfsmount hash, ie. during mountpoint lookups or walking back
 * up the tree.
 *
 * It should be taken for write in all cases where the vfsmount
 * tree or hash is modified or when a vfsmount structure is modified.
 */
DEFINE_BRLOCK(vfsmount_lock);

L
Linus Torvalds 已提交
67 68
static inline unsigned long hash(struct vfsmount *mnt, struct dentry *dentry)
{
R
Ram Pai 已提交
69 70
	unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES);
	tmp += ((unsigned long)dentry / L1_CACHE_BYTES);
E
Eric Dumazet 已提交
71 72
	tmp = tmp + (tmp >> HASH_SHIFT);
	return tmp & (HASH_SIZE - 1);
L
Linus Torvalds 已提交
73 74
}

75 76
#define MNT_WRITER_UNDERFLOW_LIMIT -(1<<16)

N
Nick Piggin 已提交
77 78 79 80
/*
 * allocation is serialized by namespace_sem, but we need the spinlock to
 * serialize with freeing.
 */
81 82 83 84 85 86
static int mnt_alloc_id(struct vfsmount *mnt)
{
	int res;

retry:
	ida_pre_get(&mnt_id_ida, GFP_KERNEL);
N
Nick Piggin 已提交
87
	spin_lock(&mnt_id_lock);
88 89 90
	res = ida_get_new_above(&mnt_id_ida, mnt_id_start, &mnt->mnt_id);
	if (!res)
		mnt_id_start = mnt->mnt_id + 1;
N
Nick Piggin 已提交
91
	spin_unlock(&mnt_id_lock);
92 93 94 95 96 97 98 99
	if (res == -EAGAIN)
		goto retry;

	return res;
}

static void mnt_free_id(struct vfsmount *mnt)
{
100
	int id = mnt->mnt_id;
N
Nick Piggin 已提交
101
	spin_lock(&mnt_id_lock);
102 103 104
	ida_remove(&mnt_id_ida, id);
	if (mnt_id_start > id)
		mnt_id_start = id;
N
Nick Piggin 已提交
105
	spin_unlock(&mnt_id_lock);
106 107
}

108 109 110 111 112 113 114
/*
 * Allocate a new peer group ID
 *
 * mnt_group_ida is protected by namespace_sem
 */
static int mnt_alloc_group_id(struct vfsmount *mnt)
{
115 116
	int res;

117 118 119
	if (!ida_pre_get(&mnt_group_ida, GFP_KERNEL))
		return -ENOMEM;

120 121 122 123 124 125 126
	res = ida_get_new_above(&mnt_group_ida,
				mnt_group_start,
				&mnt->mnt_group_id);
	if (!res)
		mnt_group_start = mnt->mnt_group_id + 1;

	return res;
127 128 129 130 131 132 133
}

/*
 * Release a peer group ID
 */
void mnt_release_group_id(struct vfsmount *mnt)
{
134 135 136 137
	int id = mnt->mnt_group_id;
	ida_remove(&mnt_group_ida, id);
	if (mnt_group_start > id)
		mnt_group_start = id;
138 139 140
	mnt->mnt_group_id = 0;
}

N
Nick Piggin 已提交
141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185
/*
 * vfsmount lock must be held for read
 */
static inline void mnt_add_count(struct vfsmount *mnt, int n)
{
#ifdef CONFIG_SMP
	this_cpu_add(mnt->mnt_pcp->mnt_count, n);
#else
	preempt_disable();
	mnt->mnt_count += n;
	preempt_enable();
#endif
}

static inline void mnt_set_count(struct vfsmount *mnt, int n)
{
#ifdef CONFIG_SMP
	this_cpu_write(mnt->mnt_pcp->mnt_count, n);
#else
	mnt->mnt_count = n;
#endif
}

/*
 * vfsmount lock must be held for read
 */
static inline void mnt_inc_count(struct vfsmount *mnt)
{
	mnt_add_count(mnt, 1);
}

/*
 * vfsmount lock must be held for read
 */
static inline void mnt_dec_count(struct vfsmount *mnt)
{
	mnt_add_count(mnt, -1);
}

/*
 * vfsmount lock must be held for write
 */
unsigned int mnt_get_count(struct vfsmount *mnt)
{
#ifdef CONFIG_SMP
A
Al Viro 已提交
186
	unsigned int count = 0;
N
Nick Piggin 已提交
187 188 189 190 191 192 193 194 195 196 197 198
	int cpu;

	for_each_possible_cpu(cpu) {
		count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_count;
	}

	return count;
#else
	return mnt->mnt_count;
#endif
}

L
Linus Torvalds 已提交
199 200
struct vfsmount *alloc_vfsmnt(const char *name)
{
201
	struct vfsmount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL);
L
Linus Torvalds 已提交
202
	if (mnt) {
203 204 205
		int err;

		err = mnt_alloc_id(mnt);
206 207 208 209 210 211 212
		if (err)
			goto out_free_cache;

		if (name) {
			mnt->mnt_devname = kstrdup(name, GFP_KERNEL);
			if (!mnt->mnt_devname)
				goto out_free_id;
213 214
		}

N
Nick Piggin 已提交
215 216 217 218 219
#ifdef CONFIG_SMP
		mnt->mnt_pcp = alloc_percpu(struct mnt_pcp);
		if (!mnt->mnt_pcp)
			goto out_free_devname;

A
Al Viro 已提交
220
		this_cpu_add(mnt->mnt_pcp->mnt_count, 1);
N
Nick Piggin 已提交
221 222 223 224 225
#else
		mnt->mnt_count = 1;
		mnt->mnt_writers = 0;
#endif

L
Linus Torvalds 已提交
226 227 228 229
		INIT_LIST_HEAD(&mnt->mnt_hash);
		INIT_LIST_HEAD(&mnt->mnt_child);
		INIT_LIST_HEAD(&mnt->mnt_mounts);
		INIT_LIST_HEAD(&mnt->mnt_list);
230
		INIT_LIST_HEAD(&mnt->mnt_expire);
R
Ram Pai 已提交
231
		INIT_LIST_HEAD(&mnt->mnt_share);
R
Ram Pai 已提交
232 233
		INIT_LIST_HEAD(&mnt->mnt_slave_list);
		INIT_LIST_HEAD(&mnt->mnt_slave);
234 235
#ifdef CONFIG_FSNOTIFY
		INIT_HLIST_HEAD(&mnt->mnt_fsnotify_marks);
N
npiggin@suse.de 已提交
236
#endif
L
Linus Torvalds 已提交
237 238
	}
	return mnt;
239

N
npiggin@suse.de 已提交
240 241 242 243
#ifdef CONFIG_SMP
out_free_devname:
	kfree(mnt->mnt_devname);
#endif
244 245 246 247 248
out_free_id:
	mnt_free_id(mnt);
out_free_cache:
	kmem_cache_free(mnt_cache, mnt);
	return NULL;
L
Linus Torvalds 已提交
249 250
}

251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271
/*
 * Most r/o checks on a fs are for operations that take
 * discrete amounts of time, like a write() or unlink().
 * We must keep track of when those operations start
 * (for permission checks) and when they end, so that
 * we can determine when writes are able to occur to
 * a filesystem.
 */
/*
 * __mnt_is_readonly: check whether a mount is read-only
 * @mnt: the mount to check for its write status
 *
 * This shouldn't be used directly ouside of the VFS.
 * It does not guarantee that the filesystem will stay
 * r/w, just that it is right *now*.  This can not and
 * should not be used in place of IS_RDONLY(inode).
 * mnt_want/drop_write() will _keep_ the filesystem
 * r/w.
 */
int __mnt_is_readonly(struct vfsmount *mnt)
{
272 273 274 275 276
	if (mnt->mnt_flags & MNT_READONLY)
		return 1;
	if (mnt->mnt_sb->s_flags & MS_RDONLY)
		return 1;
	return 0;
277 278 279
}
EXPORT_SYMBOL_GPL(__mnt_is_readonly);

280
static inline void mnt_inc_writers(struct vfsmount *mnt)
N
npiggin@suse.de 已提交
281 282
{
#ifdef CONFIG_SMP
N
Nick Piggin 已提交
283
	this_cpu_inc(mnt->mnt_pcp->mnt_writers);
N
npiggin@suse.de 已提交
284 285 286 287
#else
	mnt->mnt_writers++;
#endif
}
288

289
static inline void mnt_dec_writers(struct vfsmount *mnt)
290
{
N
npiggin@suse.de 已提交
291
#ifdef CONFIG_SMP
N
Nick Piggin 已提交
292
	this_cpu_dec(mnt->mnt_pcp->mnt_writers);
N
npiggin@suse.de 已提交
293 294 295
#else
	mnt->mnt_writers--;
#endif
296 297
}

298
static unsigned int mnt_get_writers(struct vfsmount *mnt)
299
{
N
npiggin@suse.de 已提交
300 301
#ifdef CONFIG_SMP
	unsigned int count = 0;
302 303 304
	int cpu;

	for_each_possible_cpu(cpu) {
N
Nick Piggin 已提交
305
		count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers;
306 307
	}

N
npiggin@suse.de 已提交
308 309 310 311
	return count;
#else
	return mnt->mnt_writers;
#endif
312 313
}

314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333
/*
 * Most r/o checks on a fs are for operations that take
 * discrete amounts of time, like a write() or unlink().
 * We must keep track of when those operations start
 * (for permission checks) and when they end, so that
 * we can determine when writes are able to occur to
 * a filesystem.
 */
/**
 * mnt_want_write - get write access to a mount
 * @mnt: the mount on which to take a write
 *
 * This tells the low-level filesystem that a write is
 * about to be performed to it, and makes sure that
 * writes are allowed before returning success.  When
 * the write operation is finished, mnt_drop_write()
 * must be called.  This is effectively a refcount.
 */
int mnt_want_write(struct vfsmount *mnt)
{
334 335
	int ret = 0;

N
npiggin@suse.de 已提交
336
	preempt_disable();
337
	mnt_inc_writers(mnt);
N
npiggin@suse.de 已提交
338
	/*
339
	 * The store to mnt_inc_writers must be visible before we pass
N
npiggin@suse.de 已提交
340 341 342 343 344 345 346 347 348 349 350 351
	 * MNT_WRITE_HOLD loop below, so that the slowpath can see our
	 * incremented count after it has set MNT_WRITE_HOLD.
	 */
	smp_mb();
	while (mnt->mnt_flags & MNT_WRITE_HOLD)
		cpu_relax();
	/*
	 * After the slowpath clears MNT_WRITE_HOLD, mnt_is_readonly will
	 * be set to match its requirements. So we must not load that until
	 * MNT_WRITE_HOLD is cleared.
	 */
	smp_rmb();
352
	if (__mnt_is_readonly(mnt)) {
353
		mnt_dec_writers(mnt);
354 355 356 357
		ret = -EROFS;
		goto out;
	}
out:
N
npiggin@suse.de 已提交
358
	preempt_enable();
359
	return ret;
360 361 362
}
EXPORT_SYMBOL_GPL(mnt_want_write);

N
npiggin@suse.de 已提交
363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380
/**
 * mnt_clone_write - get write access to a mount
 * @mnt: the mount on which to take a write
 *
 * This is effectively like mnt_want_write, except
 * it must only be used to take an extra write reference
 * on a mountpoint that we already know has a write reference
 * on it. This allows some optimisation.
 *
 * After finished, mnt_drop_write must be called as usual to
 * drop the reference.
 */
int mnt_clone_write(struct vfsmount *mnt)
{
	/* superblock may be r/o */
	if (__mnt_is_readonly(mnt))
		return -EROFS;
	preempt_disable();
381
	mnt_inc_writers(mnt);
N
npiggin@suse.de 已提交
382 383 384 385 386 387 388 389 390 391 392 393 394 395
	preempt_enable();
	return 0;
}
EXPORT_SYMBOL_GPL(mnt_clone_write);

/**
 * mnt_want_write_file - get write access to a file's mount
 * @file: the file who's mount on which to take a write
 *
 * This is like mnt_want_write, but it takes a file and can
 * do some optimisations if the file is open for write already
 */
int mnt_want_write_file(struct file *file)
{
396 397
	struct inode *inode = file->f_dentry->d_inode;
	if (!(file->f_mode & FMODE_WRITE) || special_file(inode->i_mode))
N
npiggin@suse.de 已提交
398 399 400 401 402 403
		return mnt_want_write(file->f_path.mnt);
	else
		return mnt_clone_write(file->f_path.mnt);
}
EXPORT_SYMBOL_GPL(mnt_want_write_file);

404 405 406 407 408 409 410 411 412 413
/**
 * mnt_drop_write - give up write access to a mount
 * @mnt: the mount on which to give up write access
 *
 * Tells the low-level filesystem that we are done
 * performing writes to it.  Must be matched with
 * mnt_want_write() call above.
 */
void mnt_drop_write(struct vfsmount *mnt)
{
N
npiggin@suse.de 已提交
414
	preempt_disable();
415
	mnt_dec_writers(mnt);
N
npiggin@suse.de 已提交
416
	preempt_enable();
417 418 419
}
EXPORT_SYMBOL_GPL(mnt_drop_write);

420
static int mnt_make_readonly(struct vfsmount *mnt)
421
{
422 423
	int ret = 0;

N
Nick Piggin 已提交
424
	br_write_lock(vfsmount_lock);
N
npiggin@suse.de 已提交
425
	mnt->mnt_flags |= MNT_WRITE_HOLD;
426
	/*
N
npiggin@suse.de 已提交
427 428
	 * After storing MNT_WRITE_HOLD, we'll read the counters. This store
	 * should be visible before we do.
429
	 */
N
npiggin@suse.de 已提交
430 431
	smp_mb();

432
	/*
N
npiggin@suse.de 已提交
433 434 435 436 437 438 439 440 441 442 443 444 445 446
	 * With writers on hold, if this value is zero, then there are
	 * definitely no active writers (although held writers may subsequently
	 * increment the count, they'll have to wait, and decrement it after
	 * seeing MNT_READONLY).
	 *
	 * It is OK to have counter incremented on one CPU and decremented on
	 * another: the sum will add up correctly. The danger would be when we
	 * sum up each counter, if we read a counter before it is incremented,
	 * but then read another CPU's count which it has been subsequently
	 * decremented from -- we would see more decrements than we should.
	 * MNT_WRITE_HOLD protects against this scenario, because
	 * mnt_want_write first increments count, then smp_mb, then spins on
	 * MNT_WRITE_HOLD, so it can't be decremented by another CPU while
	 * we're counting up here.
447
	 */
448
	if (mnt_get_writers(mnt) > 0)
N
npiggin@suse.de 已提交
449 450
		ret = -EBUSY;
	else
451
		mnt->mnt_flags |= MNT_READONLY;
N
npiggin@suse.de 已提交
452 453 454 455 456 457
	/*
	 * MNT_READONLY must become visible before ~MNT_WRITE_HOLD, so writers
	 * that become unheld will see MNT_READONLY.
	 */
	smp_wmb();
	mnt->mnt_flags &= ~MNT_WRITE_HOLD;
N
Nick Piggin 已提交
458
	br_write_unlock(vfsmount_lock);
459
	return ret;
460 461
}

462 463
static void __mnt_unmake_readonly(struct vfsmount *mnt)
{
N
Nick Piggin 已提交
464
	br_write_lock(vfsmount_lock);
465
	mnt->mnt_flags &= ~MNT_READONLY;
N
Nick Piggin 已提交
466
	br_write_unlock(vfsmount_lock);
467 468
}

469
void simple_set_mnt(struct vfsmount *mnt, struct super_block *sb)
470 471 472 473 474 475 476
{
	mnt->mnt_sb = sb;
	mnt->mnt_root = dget(sb->s_root);
}

EXPORT_SYMBOL(simple_set_mnt);

L
Linus Torvalds 已提交
477 478 479
void free_vfsmnt(struct vfsmount *mnt)
{
	kfree(mnt->mnt_devname);
480
	mnt_free_id(mnt);
N
npiggin@suse.de 已提交
481
#ifdef CONFIG_SMP
N
Nick Piggin 已提交
482
	free_percpu(mnt->mnt_pcp);
N
npiggin@suse.de 已提交
483
#endif
L
Linus Torvalds 已提交
484 485 486 487
	kmem_cache_free(mnt_cache, mnt);
}

/*
R
Ram Pai 已提交
488 489
 * find the first or last mount at @dentry on vfsmount @mnt depending on
 * @dir. If @dir is set return the first mount else return the last mount.
N
Nick Piggin 已提交
490
 * vfsmount_lock must be held for read or write.
L
Linus Torvalds 已提交
491
 */
R
Ram Pai 已提交
492 493
struct vfsmount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry,
			      int dir)
L
Linus Torvalds 已提交
494
{
R
Ram Pai 已提交
495 496
	struct list_head *head = mount_hashtable + hash(mnt, dentry);
	struct list_head *tmp = head;
L
Linus Torvalds 已提交
497 498 499
	struct vfsmount *p, *found = NULL;

	for (;;) {
R
Ram Pai 已提交
500
		tmp = dir ? tmp->next : tmp->prev;
L
Linus Torvalds 已提交
501 502 503 504 505
		p = NULL;
		if (tmp == head)
			break;
		p = list_entry(tmp, struct vfsmount, mnt_hash);
		if (p->mnt_parent == mnt && p->mnt_mountpoint == dentry) {
R
Ram Pai 已提交
506
			found = p;
L
Linus Torvalds 已提交
507 508 509 510 511 512
			break;
		}
	}
	return found;
}

R
Ram Pai 已提交
513 514 515 516
/*
 * lookup_mnt increments the ref count before returning
 * the vfsmount struct.
 */
A
Al Viro 已提交
517
struct vfsmount *lookup_mnt(struct path *path)
R
Ram Pai 已提交
518 519
{
	struct vfsmount *child_mnt;
N
Nick Piggin 已提交
520 521

	br_read_lock(vfsmount_lock);
A
Al Viro 已提交
522
	if ((child_mnt = __lookup_mnt(path->mnt, path->dentry, 1)))
R
Ram Pai 已提交
523
		mntget(child_mnt);
N
Nick Piggin 已提交
524
	br_read_unlock(vfsmount_lock);
R
Ram Pai 已提交
525 526 527
	return child_mnt;
}

L
Linus Torvalds 已提交
528 529
static inline int check_mnt(struct vfsmount *mnt)
{
530
	return mnt->mnt_ns == current->nsproxy->mnt_ns;
L
Linus Torvalds 已提交
531 532
}

N
Nick Piggin 已提交
533 534 535
/*
 * vfsmount lock must be held for write
 */
536
static void touch_mnt_namespace(struct mnt_namespace *ns)
A
Al Viro 已提交
537 538 539 540 541 542 543
{
	if (ns) {
		ns->event = ++event;
		wake_up_interruptible(&ns->poll);
	}
}

N
Nick Piggin 已提交
544 545 546
/*
 * vfsmount lock must be held for write
 */
547
static void __touch_mnt_namespace(struct mnt_namespace *ns)
A
Al Viro 已提交
548 549 550 551 552 553 554
{
	if (ns && ns->event != event) {
		ns->event = event;
		wake_up_interruptible(&ns->poll);
	}
}

N
Nick Piggin 已提交
555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575
/*
 * Clear dentry's mounted state if it has no remaining mounts.
 * vfsmount_lock must be held for write.
 */
static void dentry_reset_mounted(struct vfsmount *mnt, struct dentry *dentry)
{
	unsigned u;

	for (u = 0; u < HASH_SIZE; u++) {
		struct vfsmount *p;

		list_for_each_entry(p, &mount_hashtable[u], mnt_hash) {
			if (p->mnt_mountpoint == dentry)
				return;
		}
	}
	spin_lock(&dentry->d_lock);
	dentry->d_flags &= ~DCACHE_MOUNTED;
	spin_unlock(&dentry->d_lock);
}

N
Nick Piggin 已提交
576 577 578
/*
 * vfsmount lock must be held for write
 */
579
static void detach_mnt(struct vfsmount *mnt, struct path *old_path)
L
Linus Torvalds 已提交
580
{
581 582
	old_path->dentry = mnt->mnt_mountpoint;
	old_path->mnt = mnt->mnt_parent;
L
Linus Torvalds 已提交
583 584 585 586
	mnt->mnt_parent = mnt;
	mnt->mnt_mountpoint = mnt->mnt_root;
	list_del_init(&mnt->mnt_child);
	list_del_init(&mnt->mnt_hash);
N
Nick Piggin 已提交
587
	dentry_reset_mounted(old_path->mnt, old_path->dentry);
L
Linus Torvalds 已提交
588 589
}

N
Nick Piggin 已提交
590 591 592
/*
 * vfsmount lock must be held for write
 */
593 594 595 596 597
void mnt_set_mountpoint(struct vfsmount *mnt, struct dentry *dentry,
			struct vfsmount *child_mnt)
{
	child_mnt->mnt_parent = mntget(mnt);
	child_mnt->mnt_mountpoint = dget(dentry);
N
Nick Piggin 已提交
598 599 600
	spin_lock(&dentry->d_lock);
	dentry->d_flags |= DCACHE_MOUNTED;
	spin_unlock(&dentry->d_lock);
601 602
}

N
Nick Piggin 已提交
603 604 605
/*
 * vfsmount lock must be held for write
 */
606
static void attach_mnt(struct vfsmount *mnt, struct path *path)
L
Linus Torvalds 已提交
607
{
608
	mnt_set_mountpoint(path->mnt, path->dentry, mnt);
609
	list_add_tail(&mnt->mnt_hash, mount_hashtable +
610 611
			hash(path->mnt, path->dentry));
	list_add_tail(&mnt->mnt_child, &path->mnt->mnt_mounts);
612 613
}

614 615 616 617 618 619 620 621 622 623 624 625 626 627 628
static inline void __mnt_make_longterm(struct vfsmount *mnt)
{
#ifdef CONFIG_SMP
	atomic_inc(&mnt->mnt_longterm);
#endif
}

/* needs vfsmount lock for write */
static inline void __mnt_make_shortterm(struct vfsmount *mnt)
{
#ifdef CONFIG_SMP
	atomic_dec(&mnt->mnt_longterm);
#endif
}

629
/*
N
Nick Piggin 已提交
630
 * vfsmount lock must be held for write
631 632 633 634 635 636
 */
static void commit_tree(struct vfsmount *mnt)
{
	struct vfsmount *parent = mnt->mnt_parent;
	struct vfsmount *m;
	LIST_HEAD(head);
637
	struct mnt_namespace *n = parent->mnt_ns;
638 639 640 641

	BUG_ON(parent == mnt);

	list_add_tail(&head, &mnt->mnt_list);
A
Al Viro 已提交
642
	list_for_each_entry(m, &head, mnt_list) {
643
		m->mnt_ns = n;
644
		__mnt_make_longterm(m);
A
Al Viro 已提交
645 646
	}

647 648 649 650 651
	list_splice(&head, n->list.prev);

	list_add_tail(&mnt->mnt_hash, mount_hashtable +
				hash(parent, mnt->mnt_mountpoint));
	list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
652
	touch_mnt_namespace(n);
L
Linus Torvalds 已提交
653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670
}

static struct vfsmount *next_mnt(struct vfsmount *p, struct vfsmount *root)
{
	struct list_head *next = p->mnt_mounts.next;
	if (next == &p->mnt_mounts) {
		while (1) {
			if (p == root)
				return NULL;
			next = p->mnt_child.next;
			if (next != &p->mnt_parent->mnt_mounts)
				break;
			p = p->mnt_parent;
		}
	}
	return list_entry(next, struct vfsmount, mnt_child);
}

R
Ram Pai 已提交
671 672 673 674 675 676 677 678 679 680
static struct vfsmount *skip_mnt_tree(struct vfsmount *p)
{
	struct list_head *prev = p->mnt_mounts.prev;
	while (prev != &p->mnt_mounts) {
		p = list_entry(prev, struct vfsmount, mnt_child);
		prev = p->mnt_mounts.prev;
	}
	return p;
}

R
Ram Pai 已提交
681 682
static struct vfsmount *clone_mnt(struct vfsmount *old, struct dentry *root,
					int flag)
L
Linus Torvalds 已提交
683 684 685 686 687
{
	struct super_block *sb = old->mnt_sb;
	struct vfsmount *mnt = alloc_vfsmnt(old->mnt_devname);

	if (mnt) {
688 689 690 691 692 693 694 695 696 697 698
		if (flag & (CL_SLAVE | CL_PRIVATE))
			mnt->mnt_group_id = 0; /* not a peer of original */
		else
			mnt->mnt_group_id = old->mnt_group_id;

		if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) {
			int err = mnt_alloc_group_id(mnt);
			if (err)
				goto out_free;
		}

699
		mnt->mnt_flags = old->mnt_flags & ~MNT_WRITE_HOLD;
L
Linus Torvalds 已提交
700 701 702 703 704
		atomic_inc(&sb->s_active);
		mnt->mnt_sb = sb;
		mnt->mnt_root = dget(root);
		mnt->mnt_mountpoint = mnt->mnt_root;
		mnt->mnt_parent = mnt;
705

R
Ram Pai 已提交
706 707 708 709
		if (flag & CL_SLAVE) {
			list_add(&mnt->mnt_slave, &old->mnt_slave_list);
			mnt->mnt_master = old;
			CLEAR_MNT_SHARED(mnt);
710
		} else if (!(flag & CL_PRIVATE)) {
711
			if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old))
R
Ram Pai 已提交
712 713 714 715 716
				list_add(&mnt->mnt_share, &old->mnt_share);
			if (IS_MNT_SLAVE(old))
				list_add(&mnt->mnt_slave, &old->mnt_slave);
			mnt->mnt_master = old->mnt_master;
		}
717 718
		if (flag & CL_MAKE_SHARED)
			set_mnt_shared(mnt);
L
Linus Torvalds 已提交
719 720 721

		/* stick the duplicate mount on the same expiry list
		 * as the original if that was on one */
R
Ram Pai 已提交
722 723 724 725
		if (flag & CL_EXPIRE) {
			if (!list_empty(&old->mnt_expire))
				list_add(&mnt->mnt_expire, &old->mnt_expire);
		}
L
Linus Torvalds 已提交
726 727
	}
	return mnt;
728 729 730 731

 out_free:
	free_vfsmnt(mnt);
	return NULL;
L
Linus Torvalds 已提交
732 733
}

N
Nick Piggin 已提交
734
static inline void mntfree(struct vfsmount *mnt)
L
Linus Torvalds 已提交
735 736
{
	struct super_block *sb = mnt->mnt_sb;
N
Nick Piggin 已提交
737

738 739 740 741 742 743
	/*
	 * This probably indicates that somebody messed
	 * up a mnt_want/drop_write() pair.  If this
	 * happens, the filesystem was probably unable
	 * to make r/w->r/o transitions.
	 */
N
npiggin@suse.de 已提交
744
	/*
N
Nick Piggin 已提交
745 746
	 * The locking used to deal with mnt_count decrement provides barriers,
	 * so mnt_get_writers() below is safe.
N
npiggin@suse.de 已提交
747
	 */
748
	WARN_ON(mnt_get_writers(mnt));
749
	fsnotify_vfsmount_delete(mnt);
L
Linus Torvalds 已提交
750 751 752 753 754
	dput(mnt->mnt_root);
	free_vfsmnt(mnt);
	deactivate_super(sb);
}

A
Al Viro 已提交
755
static void mntput_no_expire(struct vfsmount *mnt)
N
Nick Piggin 已提交
756 757
{
put_again:
A
Al Viro 已提交
758 759 760 761
#ifdef CONFIG_SMP
	br_read_lock(vfsmount_lock);
	if (likely(atomic_read(&mnt->mnt_longterm))) {
		mnt_dec_count(mnt);
N
Nick Piggin 已提交
762
		br_read_unlock(vfsmount_lock);
A
Al Viro 已提交
763
		return;
N
Nick Piggin 已提交
764
	}
A
Al Viro 已提交
765
	br_read_unlock(vfsmount_lock);
N
Nick Piggin 已提交
766

N
Nick Piggin 已提交
767
	br_write_lock(vfsmount_lock);
A
Al Viro 已提交
768
	mnt_dec_count(mnt);
N
Nick Piggin 已提交
769
	if (mnt_get_count(mnt)) {
N
Nick Piggin 已提交
770 771 772
		br_write_unlock(vfsmount_lock);
		return;
	}
N
Nick Piggin 已提交
773 774 775
#else
	mnt_dec_count(mnt);
	if (likely(mnt_get_count(mnt)))
N
Nick Piggin 已提交
776
		return;
N
Nick Piggin 已提交
777
	br_write_lock(vfsmount_lock);
A
Al Viro 已提交
778
#endif
N
Nick Piggin 已提交
779 780 781 782 783 784
	if (unlikely(mnt->mnt_pinned)) {
		mnt_add_count(mnt, mnt->mnt_pinned + 1);
		mnt->mnt_pinned = 0;
		br_write_unlock(vfsmount_lock);
		acct_auto_close_mnt(mnt);
		goto put_again;
785
	}
N
Nick Piggin 已提交
786
	br_write_unlock(vfsmount_lock);
N
Nick Piggin 已提交
787 788 789 790 791 792 793 794 795
	mntfree(mnt);
}

void mntput(struct vfsmount *mnt)
{
	if (mnt) {
		/* avoid cacheline pingpong, hope gcc doesn't get "smart" */
		if (unlikely(mnt->mnt_expiry_mark))
			mnt->mnt_expiry_mark = 0;
A
Al Viro 已提交
796
		mntput_no_expire(mnt);
N
Nick Piggin 已提交
797 798 799 800 801 802 803 804 805 806 807 808
	}
}
EXPORT_SYMBOL(mntput);

struct vfsmount *mntget(struct vfsmount *mnt)
{
	if (mnt)
		mnt_inc_count(mnt);
	return mnt;
}
EXPORT_SYMBOL(mntget);

809 810
void mnt_pin(struct vfsmount *mnt)
{
N
Nick Piggin 已提交
811
	br_write_lock(vfsmount_lock);
812
	mnt->mnt_pinned++;
N
Nick Piggin 已提交
813
	br_write_unlock(vfsmount_lock);
814 815 816 817 818
}
EXPORT_SYMBOL(mnt_pin);

void mnt_unpin(struct vfsmount *mnt)
{
N
Nick Piggin 已提交
819
	br_write_lock(vfsmount_lock);
820
	if (mnt->mnt_pinned) {
N
Nick Piggin 已提交
821
		mnt_inc_count(mnt);
822 823
		mnt->mnt_pinned--;
	}
N
Nick Piggin 已提交
824
	br_write_unlock(vfsmount_lock);
825 826
}
EXPORT_SYMBOL(mnt_unpin);
L
Linus Torvalds 已提交
827

828 829 830 831 832 833 834 835 836 837 838 839 840
static inline void mangle(struct seq_file *m, const char *s)
{
	seq_escape(m, s, " \t\n\\");
}

/*
 * Simple .show_options callback for filesystems which don't want to
 * implement more complex mount option showing.
 *
 * See also save_mount_options().
 */
int generic_show_options(struct seq_file *m, struct vfsmount *mnt)
{
841 842 843 844
	const char *options;

	rcu_read_lock();
	options = rcu_dereference(mnt->mnt_sb->s_options);
845 846 847 848 849

	if (options != NULL && options[0]) {
		seq_putc(m, ',');
		mangle(m, options);
	}
850
	rcu_read_unlock();
851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870

	return 0;
}
EXPORT_SYMBOL(generic_show_options);

/*
 * If filesystem uses generic_show_options(), this function should be
 * called from the fill_super() callback.
 *
 * The .remount_fs callback usually needs to be handled in a special
 * way, to make sure, that previous options are not overwritten if the
 * remount fails.
 *
 * Also note, that if the filesystem's .remount_fs function doesn't
 * reset all options to their default value, but changes only newly
 * given options, then the displayed options will not reflect reality
 * any more.
 */
void save_mount_options(struct super_block *sb, char *options)
{
871 872
	BUG_ON(sb->s_options);
	rcu_assign_pointer(sb->s_options, kstrdup(options, GFP_KERNEL));
873 874 875
}
EXPORT_SYMBOL(save_mount_options);

876 877 878 879 880 881 882 883 884 885 886
void replace_mount_options(struct super_block *sb, char *options)
{
	char *old = sb->s_options;
	rcu_assign_pointer(sb->s_options, options);
	if (old) {
		synchronize_rcu();
		kfree(old);
	}
}
EXPORT_SYMBOL(replace_mount_options);

887
#ifdef CONFIG_PROC_FS
L
Linus Torvalds 已提交
888 889 890
/* iterator */
static void *m_start(struct seq_file *m, loff_t *pos)
{
891
	struct proc_mounts *p = m->private;
L
Linus Torvalds 已提交
892

R
Ram Pai 已提交
893
	down_read(&namespace_sem);
894
	return seq_list_start(&p->ns->list, *pos);
L
Linus Torvalds 已提交
895 896 897 898
}

static void *m_next(struct seq_file *m, void *v, loff_t *pos)
{
899
	struct proc_mounts *p = m->private;
900

901
	return seq_list_next(v, &p->ns->list, pos);
L
Linus Torvalds 已提交
902 903 904 905
}

static void m_stop(struct seq_file *m, void *v)
{
R
Ram Pai 已提交
906
	up_read(&namespace_sem);
L
Linus Torvalds 已提交
907 908
}

909 910 911 912 913
int mnt_had_events(struct proc_mounts *p)
{
	struct mnt_namespace *ns = p->ns;
	int res = 0;

N
Nick Piggin 已提交
914
	br_read_lock(vfsmount_lock);
915 916 917 918
	if (p->event != ns->event) {
		p->event = ns->event;
		res = 1;
	}
N
Nick Piggin 已提交
919
	br_read_unlock(vfsmount_lock);
920 921 922 923

	return res;
}

924 925 926 927 928
struct proc_fs_info {
	int flag;
	const char *str;
};

929
static int show_sb_opts(struct seq_file *m, struct super_block *sb)
L
Linus Torvalds 已提交
930
{
931
	static const struct proc_fs_info fs_info[] = {
L
Linus Torvalds 已提交
932 933 934 935 936
		{ MS_SYNCHRONOUS, ",sync" },
		{ MS_DIRSYNC, ",dirsync" },
		{ MS_MANDLOCK, ",mand" },
		{ 0, NULL }
	};
937 938 939 940 941 942
	const struct proc_fs_info *fs_infop;

	for (fs_infop = fs_info; fs_infop->flag; fs_infop++) {
		if (sb->s_flags & fs_infop->flag)
			seq_puts(m, fs_infop->str);
	}
943 944

	return security_sb_show_options(m, sb);
945 946 947 948 949
}

static void show_mnt_opts(struct seq_file *m, struct vfsmount *mnt)
{
	static const struct proc_fs_info mnt_info[] = {
L
Linus Torvalds 已提交
950 951 952
		{ MNT_NOSUID, ",nosuid" },
		{ MNT_NODEV, ",nodev" },
		{ MNT_NOEXEC, ",noexec" },
953 954
		{ MNT_NOATIME, ",noatime" },
		{ MNT_NODIRATIME, ",nodiratime" },
V
Valerie Henson 已提交
955
		{ MNT_RELATIME, ",relatime" },
L
Linus Torvalds 已提交
956 957
		{ 0, NULL }
	};
958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978
	const struct proc_fs_info *fs_infop;

	for (fs_infop = mnt_info; fs_infop->flag; fs_infop++) {
		if (mnt->mnt_flags & fs_infop->flag)
			seq_puts(m, fs_infop->str);
	}
}

static void show_type(struct seq_file *m, struct super_block *sb)
{
	mangle(m, sb->s_type->name);
	if (sb->s_subtype && sb->s_subtype[0]) {
		seq_putc(m, '.');
		mangle(m, sb->s_subtype);
	}
}

static int show_vfsmnt(struct seq_file *m, void *v)
{
	struct vfsmount *mnt = list_entry(v, struct vfsmount, mnt_list);
	int err = 0;
979
	struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
L
Linus Torvalds 已提交
980 981 982

	mangle(m, mnt->mnt_devname ? mnt->mnt_devname : "none");
	seq_putc(m, ' ');
983
	seq_path(m, &mnt_path, " \t\n\\");
L
Linus Torvalds 已提交
984
	seq_putc(m, ' ');
985
	show_type(m, mnt->mnt_sb);
986
	seq_puts(m, __mnt_is_readonly(mnt) ? " ro" : " rw");
987 988 989
	err = show_sb_opts(m, mnt->mnt_sb);
	if (err)
		goto out;
990
	show_mnt_opts(m, mnt);
L
Linus Torvalds 已提交
991 992 993
	if (mnt->mnt_sb->s_op->show_options)
		err = mnt->mnt_sb->s_op->show_options(m, mnt);
	seq_puts(m, " 0 0\n");
994
out:
L
Linus Torvalds 已提交
995 996 997
	return err;
}

998
const struct seq_operations mounts_op = {
L
Linus Torvalds 已提交
999 1000 1001 1002 1003 1004
	.start	= m_start,
	.next	= m_next,
	.stop	= m_stop,
	.show	= show_vfsmnt
};

1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032
static int show_mountinfo(struct seq_file *m, void *v)
{
	struct proc_mounts *p = m->private;
	struct vfsmount *mnt = list_entry(v, struct vfsmount, mnt_list);
	struct super_block *sb = mnt->mnt_sb;
	struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
	struct path root = p->root;
	int err = 0;

	seq_printf(m, "%i %i %u:%u ", mnt->mnt_id, mnt->mnt_parent->mnt_id,
		   MAJOR(sb->s_dev), MINOR(sb->s_dev));
	seq_dentry(m, mnt->mnt_root, " \t\n\\");
	seq_putc(m, ' ');
	seq_path_root(m, &mnt_path, &root, " \t\n\\");
	if (root.mnt != p->root.mnt || root.dentry != p->root.dentry) {
		/*
		 * Mountpoint is outside root, discard that one.  Ugly,
		 * but less so than trying to do that in iterator in a
		 * race-free way (due to renames).
		 */
		return SEQ_SKIP;
	}
	seq_puts(m, mnt->mnt_flags & MNT_READONLY ? " ro" : " rw");
	show_mnt_opts(m, mnt);

	/* Tagged fields ("foo:X" or "bar") */
	if (IS_MNT_SHARED(mnt))
		seq_printf(m, " shared:%i", mnt->mnt_group_id);
1033 1034 1035 1036 1037 1038 1039
	if (IS_MNT_SLAVE(mnt)) {
		int master = mnt->mnt_master->mnt_group_id;
		int dom = get_dominating_id(mnt, &p->root);
		seq_printf(m, " master:%i", master);
		if (dom && dom != master)
			seq_printf(m, " propagate_from:%i", dom);
	}
1040 1041 1042 1043 1044 1045 1046 1047 1048
	if (IS_MNT_UNBINDABLE(mnt))
		seq_puts(m, " unbindable");

	/* Filesystem specific data */
	seq_puts(m, " - ");
	show_type(m, sb);
	seq_putc(m, ' ');
	mangle(m, mnt->mnt_devname ? mnt->mnt_devname : "none");
	seq_puts(m, sb->s_flags & MS_RDONLY ? " ro" : " rw");
1049 1050 1051
	err = show_sb_opts(m, sb);
	if (err)
		goto out;
1052 1053 1054
	if (sb->s_op->show_options)
		err = sb->s_op->show_options(m, mnt);
	seq_putc(m, '\n');
1055
out:
1056 1057 1058 1059 1060 1061 1062 1063 1064 1065
	return err;
}

const struct seq_operations mountinfo_op = {
	.start	= m_start,
	.next	= m_next,
	.stop	= m_stop,
	.show	= show_mountinfo,
};

1066 1067
static int show_vfsstat(struct seq_file *m, void *v)
{
1068
	struct vfsmount *mnt = list_entry(v, struct vfsmount, mnt_list);
1069
	struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080
	int err = 0;

	/* device */
	if (mnt->mnt_devname) {
		seq_puts(m, "device ");
		mangle(m, mnt->mnt_devname);
	} else
		seq_puts(m, "no device");

	/* mount point */
	seq_puts(m, " mounted on ");
1081
	seq_path(m, &mnt_path, " \t\n\\");
1082 1083 1084 1085
	seq_putc(m, ' ');

	/* file system type */
	seq_puts(m, "with fstype ");
1086
	show_type(m, mnt->mnt_sb);
1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097

	/* optional statistics */
	if (mnt->mnt_sb->s_op->show_stats) {
		seq_putc(m, ' ');
		err = mnt->mnt_sb->s_op->show_stats(m, mnt);
	}

	seq_putc(m, '\n');
	return err;
}

1098
const struct seq_operations mountstats_op = {
1099 1100 1101 1102 1103
	.start	= m_start,
	.next	= m_next,
	.stop	= m_stop,
	.show	= show_vfsstat,
};
1104
#endif  /* CONFIG_PROC_FS */
1105

L
Linus Torvalds 已提交
1106 1107 1108 1109 1110 1111 1112 1113 1114 1115
/**
 * may_umount_tree - check if a mount tree is busy
 * @mnt: root of mount tree
 *
 * This is called to check if a tree of mounts has any
 * open files, pwds, chroots or sub mounts that are
 * busy.
 */
int may_umount_tree(struct vfsmount *mnt)
{
R
Ram Pai 已提交
1116 1117 1118
	int actual_refs = 0;
	int minimum_refs = 0;
	struct vfsmount *p;
L
Linus Torvalds 已提交
1119

N
Nick Piggin 已提交
1120 1121
	/* write lock needed for mnt_get_count */
	br_write_lock(vfsmount_lock);
R
Ram Pai 已提交
1122
	for (p = mnt; p; p = next_mnt(p, mnt)) {
N
Nick Piggin 已提交
1123
		actual_refs += mnt_get_count(p);
L
Linus Torvalds 已提交
1124 1125
		minimum_refs += 2;
	}
N
Nick Piggin 已提交
1126
	br_write_unlock(vfsmount_lock);
L
Linus Torvalds 已提交
1127 1128

	if (actual_refs > minimum_refs)
1129
		return 0;
L
Linus Torvalds 已提交
1130

1131
	return 1;
L
Linus Torvalds 已提交
1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150
}

EXPORT_SYMBOL(may_umount_tree);

/**
 * may_umount - check if a mount point is busy
 * @mnt: root of mount
 *
 * This is called to check if a mount point has any
 * open files, pwds, chroots or sub mounts. If the
 * mount has sub mounts this will return busy
 * regardless of whether the sub mounts are busy.
 *
 * Doesn't take quota and stuff into account. IOW, in some cases it will
 * give false negatives. The main reason why it's here is that we need
 * a non-destructive way to look for easily umountable filesystems.
 */
int may_umount(struct vfsmount *mnt)
{
1151
	int ret = 1;
A
Al Viro 已提交
1152
	down_read(&namespace_sem);
N
Nick Piggin 已提交
1153
	br_write_lock(vfsmount_lock);
R
Ram Pai 已提交
1154
	if (propagate_mount_busy(mnt, 2))
1155
		ret = 0;
N
Nick Piggin 已提交
1156
	br_write_unlock(vfsmount_lock);
A
Al Viro 已提交
1157
	up_read(&namespace_sem);
R
Ram Pai 已提交
1158
	return ret;
L
Linus Torvalds 已提交
1159 1160 1161 1162
}

EXPORT_SYMBOL(may_umount);

1163
void release_mounts(struct list_head *head)
R
Ram Pai 已提交
1164 1165
{
	struct vfsmount *mnt;
M
Miklos Szeredi 已提交
1166
	while (!list_empty(head)) {
1167
		mnt = list_first_entry(head, struct vfsmount, mnt_hash);
R
Ram Pai 已提交
1168 1169 1170 1171
		list_del_init(&mnt->mnt_hash);
		if (mnt->mnt_parent != mnt) {
			struct dentry *dentry;
			struct vfsmount *m;
N
Nick Piggin 已提交
1172 1173

			br_write_lock(vfsmount_lock);
R
Ram Pai 已提交
1174 1175 1176 1177
			dentry = mnt->mnt_mountpoint;
			m = mnt->mnt_parent;
			mnt->mnt_mountpoint = mnt->mnt_root;
			mnt->mnt_parent = mnt;
1178
			m->mnt_ghosts--;
N
Nick Piggin 已提交
1179
			br_write_unlock(vfsmount_lock);
R
Ram Pai 已提交
1180 1181 1182
			dput(dentry);
			mntput(m);
		}
A
Al Viro 已提交
1183
		mntput(mnt);
R
Ram Pai 已提交
1184 1185 1186
	}
}

N
Nick Piggin 已提交
1187 1188 1189 1190
/*
 * vfsmount lock must be held for write
 * namespace_sem must be held for write
 */
R
Ram Pai 已提交
1191
void umount_tree(struct vfsmount *mnt, int propagate, struct list_head *kill)
L
Linus Torvalds 已提交
1192
{
A
Al Viro 已提交
1193
	LIST_HEAD(tmp_list);
L
Linus Torvalds 已提交
1194 1195
	struct vfsmount *p;

A
Akinobu Mita 已提交
1196
	for (p = mnt; p; p = next_mnt(p, mnt))
A
Al Viro 已提交
1197
		list_move(&p->mnt_hash, &tmp_list);
L
Linus Torvalds 已提交
1198

R
Ram Pai 已提交
1199
	if (propagate)
A
Al Viro 已提交
1200
		propagate_umount(&tmp_list);
R
Ram Pai 已提交
1201

A
Al Viro 已提交
1202
	list_for_each_entry(p, &tmp_list, mnt_hash) {
R
Ram Pai 已提交
1203 1204
		list_del_init(&p->mnt_expire);
		list_del_init(&p->mnt_list);
1205 1206
		__touch_mnt_namespace(p->mnt_ns);
		p->mnt_ns = NULL;
1207
		__mnt_make_shortterm(p);
R
Ram Pai 已提交
1208
		list_del_init(&p->mnt_child);
1209 1210
		if (p->mnt_parent != p) {
			p->mnt_parent->mnt_ghosts++;
N
Nick Piggin 已提交
1211
			dentry_reset_mounted(p->mnt_parent, p->mnt_mountpoint);
1212
		}
R
Ram Pai 已提交
1213
		change_mnt_propagation(p, MS_PRIVATE);
L
Linus Torvalds 已提交
1214
	}
A
Al Viro 已提交
1215
	list_splice(&tmp_list, kill);
L
Linus Torvalds 已提交
1216 1217
}

1218 1219
static void shrink_submounts(struct vfsmount *mnt, struct list_head *umounts);

L
Linus Torvalds 已提交
1220 1221
static int do_umount(struct vfsmount *mnt, int flags)
{
R
Ram Pai 已提交
1222
	struct super_block *sb = mnt->mnt_sb;
L
Linus Torvalds 已提交
1223
	int retval;
R
Ram Pai 已提交
1224
	LIST_HEAD(umount_list);
L
Linus Torvalds 已提交
1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236

	retval = security_sb_umount(mnt, flags);
	if (retval)
		return retval;

	/*
	 * Allow userspace to request a mountpoint be expired rather than
	 * unmounting unconditionally. Unmount only happens if:
	 *  (1) the mark is already set (the mark is cleared by mntput())
	 *  (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount]
	 */
	if (flags & MNT_EXPIRE) {
J
Jan Blunck 已提交
1237
		if (mnt == current->fs->root.mnt ||
L
Linus Torvalds 已提交
1238 1239 1240
		    flags & (MNT_FORCE | MNT_DETACH))
			return -EINVAL;

N
Nick Piggin 已提交
1241 1242 1243 1244 1245 1246
		/*
		 * probably don't strictly need the lock here if we examined
		 * all race cases, but it's a slowpath.
		 */
		br_write_lock(vfsmount_lock);
		if (mnt_get_count(mnt) != 2) {
1247
			br_write_unlock(vfsmount_lock);
L
Linus Torvalds 已提交
1248
			return -EBUSY;
N
Nick Piggin 已提交
1249 1250
		}
		br_write_unlock(vfsmount_lock);
L
Linus Torvalds 已提交
1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265

		if (!xchg(&mnt->mnt_expiry_mark, 1))
			return -EAGAIN;
	}

	/*
	 * If we may have to abort operations to get out of this
	 * mount, and they will themselves hold resources we must
	 * allow the fs to do things. In the Unix tradition of
	 * 'Gee thats tricky lets do it in userspace' the umount_begin
	 * might fail to complete on the first run through as other tasks
	 * must return, and the like. Thats for the mount program to worry
	 * about for the moment.
	 */

1266 1267 1268
	if (flags & MNT_FORCE && sb->s_op->umount_begin) {
		sb->s_op->umount_begin(sb);
	}
L
Linus Torvalds 已提交
1269 1270 1271 1272 1273 1274 1275 1276 1277 1278

	/*
	 * No sense to grab the lock for this test, but test itself looks
	 * somewhat bogus. Suggestions for better replacement?
	 * Ho-hum... In principle, we might treat that as umount + switch
	 * to rootfs. GC would eventually take care of the old vfsmount.
	 * Actually it makes sense, especially if rootfs would contain a
	 * /reboot - static binary that would close all descriptors and
	 * call reboot(9). Then init(8) could umount root and exec /reboot.
	 */
J
Jan Blunck 已提交
1279
	if (mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) {
L
Linus Torvalds 已提交
1280 1281 1282 1283 1284
		/*
		 * Special case for "unmounting" root ...
		 * we just try to remount it readonly.
		 */
		down_write(&sb->s_umount);
A
Al Viro 已提交
1285
		if (!(sb->s_flags & MS_RDONLY))
L
Linus Torvalds 已提交
1286 1287 1288 1289 1290
			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
		up_write(&sb->s_umount);
		return retval;
	}

R
Ram Pai 已提交
1291
	down_write(&namespace_sem);
N
Nick Piggin 已提交
1292
	br_write_lock(vfsmount_lock);
A
Al Viro 已提交
1293
	event++;
L
Linus Torvalds 已提交
1294

1295 1296 1297
	if (!(flags & MNT_DETACH))
		shrink_submounts(mnt, &umount_list);

L
Linus Torvalds 已提交
1298
	retval = -EBUSY;
R
Ram Pai 已提交
1299
	if (flags & MNT_DETACH || !propagate_mount_busy(mnt, 2)) {
L
Linus Torvalds 已提交
1300
		if (!list_empty(&mnt->mnt_list))
R
Ram Pai 已提交
1301
			umount_tree(mnt, 1, &umount_list);
L
Linus Torvalds 已提交
1302 1303
		retval = 0;
	}
N
Nick Piggin 已提交
1304
	br_write_unlock(vfsmount_lock);
R
Ram Pai 已提交
1305
	up_write(&namespace_sem);
R
Ram Pai 已提交
1306
	release_mounts(&umount_list);
L
Linus Torvalds 已提交
1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317
	return retval;
}

/*
 * Now umount can handle mount points as well as block devices.
 * This is important for filesystems which use unnamed block devices.
 *
 * We now support a flag for forced unmount like the other 'big iron'
 * unixes. Our API is identical to OSF/1 to avoid making a mess of AMD
 */

1318
SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
L
Linus Torvalds 已提交
1319
{
1320
	struct path path;
L
Linus Torvalds 已提交
1321
	int retval;
1322
	int lookup_flags = 0;
L
Linus Torvalds 已提交
1323

1324 1325 1326 1327 1328 1329 1330
	if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
		return -EINVAL;

	if (!(flags & UMOUNT_NOFOLLOW))
		lookup_flags |= LOOKUP_FOLLOW;

	retval = user_path_at(AT_FDCWD, name, lookup_flags, &path);
L
Linus Torvalds 已提交
1331 1332 1333
	if (retval)
		goto out;
	retval = -EINVAL;
1334
	if (path.dentry != path.mnt->mnt_root)
L
Linus Torvalds 已提交
1335
		goto dput_and_out;
1336
	if (!check_mnt(path.mnt))
L
Linus Torvalds 已提交
1337 1338 1339 1340 1341 1342
		goto dput_and_out;

	retval = -EPERM;
	if (!capable(CAP_SYS_ADMIN))
		goto dput_and_out;

1343
	retval = do_umount(path.mnt, flags);
L
Linus Torvalds 已提交
1344
dput_and_out:
J
Jan Blunck 已提交
1345
	/* we mustn't call path_put() as that would clear mnt_expiry_mark */
1346 1347
	dput(path.dentry);
	mntput_no_expire(path.mnt);
L
Linus Torvalds 已提交
1348 1349 1350 1351 1352 1353 1354
out:
	return retval;
}

#ifdef __ARCH_WANT_SYS_OLDUMOUNT

/*
R
Ram Pai 已提交
1355
 *	The 2.0 compatible umount. No flags.
L
Linus Torvalds 已提交
1356
 */
1357
SYSCALL_DEFINE1(oldumount, char __user *, name)
L
Linus Torvalds 已提交
1358
{
R
Ram Pai 已提交
1359
	return sys_umount(name, 0);
L
Linus Torvalds 已提交
1360 1361 1362 1363
}

#endif

1364
static int mount_is_safe(struct path *path)
L
Linus Torvalds 已提交
1365 1366 1367 1368 1369
{
	if (capable(CAP_SYS_ADMIN))
		return 0;
	return -EPERM;
#ifdef notyet
1370
	if (S_ISLNK(path->dentry->d_inode->i_mode))
L
Linus Torvalds 已提交
1371
		return -EPERM;
1372
	if (path->dentry->d_inode->i_mode & S_ISVTX) {
1373
		if (current_uid() != path->dentry->d_inode->i_uid)
L
Linus Torvalds 已提交
1374 1375
			return -EPERM;
	}
1376
	if (inode_permission(path->dentry->d_inode, MAY_WRITE))
L
Linus Torvalds 已提交
1377 1378 1379 1380 1381
		return -EPERM;
	return 0;
#endif
}

1382
struct vfsmount *copy_tree(struct vfsmount *mnt, struct dentry *dentry,
R
Ram Pai 已提交
1383
					int flag)
L
Linus Torvalds 已提交
1384 1385
{
	struct vfsmount *res, *p, *q, *r, *s;
1386
	struct path path;
L
Linus Torvalds 已提交
1387

R
Ram Pai 已提交
1388 1389 1390
	if (!(flag & CL_COPY_ALL) && IS_MNT_UNBINDABLE(mnt))
		return NULL;

R
Ram Pai 已提交
1391
	res = q = clone_mnt(mnt, dentry, flag);
L
Linus Torvalds 已提交
1392 1393 1394 1395 1396
	if (!q)
		goto Enomem;
	q->mnt_mountpoint = mnt->mnt_mountpoint;

	p = mnt;
1397
	list_for_each_entry(r, &mnt->mnt_mounts, mnt_child) {
1398
		if (!is_subdir(r->mnt_mountpoint, dentry))
L
Linus Torvalds 已提交
1399 1400 1401
			continue;

		for (s = r; s; s = next_mnt(s, r)) {
R
Ram Pai 已提交
1402 1403 1404 1405
			if (!(flag & CL_COPY_ALL) && IS_MNT_UNBINDABLE(s)) {
				s = skip_mnt_tree(s);
				continue;
			}
L
Linus Torvalds 已提交
1406 1407 1408 1409 1410
			while (p != s->mnt_parent) {
				p = p->mnt_parent;
				q = q->mnt_parent;
			}
			p = s;
1411 1412
			path.mnt = q;
			path.dentry = p->mnt_mountpoint;
R
Ram Pai 已提交
1413
			q = clone_mnt(p, p->mnt_root, flag);
L
Linus Torvalds 已提交
1414 1415
			if (!q)
				goto Enomem;
N
Nick Piggin 已提交
1416
			br_write_lock(vfsmount_lock);
L
Linus Torvalds 已提交
1417
			list_add_tail(&q->mnt_list, &res->mnt_list);
1418
			attach_mnt(q, &path);
N
Nick Piggin 已提交
1419
			br_write_unlock(vfsmount_lock);
L
Linus Torvalds 已提交
1420 1421 1422
		}
	}
	return res;
R
Ram Pai 已提交
1423
Enomem:
L
Linus Torvalds 已提交
1424
	if (res) {
R
Ram Pai 已提交
1425
		LIST_HEAD(umount_list);
N
Nick Piggin 已提交
1426
		br_write_lock(vfsmount_lock);
R
Ram Pai 已提交
1427
		umount_tree(res, 0, &umount_list);
N
Nick Piggin 已提交
1428
		br_write_unlock(vfsmount_lock);
R
Ram Pai 已提交
1429
		release_mounts(&umount_list);
L
Linus Torvalds 已提交
1430 1431 1432 1433
	}
	return NULL;
}

A
Al Viro 已提交
1434
struct vfsmount *collect_mounts(struct path *path)
1435 1436
{
	struct vfsmount *tree;
1437
	down_write(&namespace_sem);
A
Al Viro 已提交
1438
	tree = copy_tree(path->mnt, path->dentry, CL_COPY_ALL | CL_PRIVATE);
1439
	up_write(&namespace_sem);
1440 1441 1442 1443 1444 1445
	return tree;
}

void drop_collected_mounts(struct vfsmount *mnt)
{
	LIST_HEAD(umount_list);
1446
	down_write(&namespace_sem);
N
Nick Piggin 已提交
1447
	br_write_lock(vfsmount_lock);
1448
	umount_tree(mnt, 0, &umount_list);
N
Nick Piggin 已提交
1449
	br_write_unlock(vfsmount_lock);
1450
	up_write(&namespace_sem);
1451 1452 1453
	release_mounts(&umount_list);
}

A
Al Viro 已提交
1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468
int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg,
		   struct vfsmount *root)
{
	struct vfsmount *mnt;
	int res = f(root, arg);
	if (res)
		return res;
	list_for_each_entry(mnt, &root->mnt_list, mnt_list) {
		res = f(mnt, arg);
		if (res)
			return res;
	}
	return 0;
}

1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495
static void cleanup_group_ids(struct vfsmount *mnt, struct vfsmount *end)
{
	struct vfsmount *p;

	for (p = mnt; p != end; p = next_mnt(p, mnt)) {
		if (p->mnt_group_id && !IS_MNT_SHARED(p))
			mnt_release_group_id(p);
	}
}

static int invent_group_ids(struct vfsmount *mnt, bool recurse)
{
	struct vfsmount *p;

	for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) {
		if (!p->mnt_group_id && !IS_MNT_SHARED(p)) {
			int err = mnt_alloc_group_id(p);
			if (err) {
				cleanup_group_ids(mnt, p);
				return err;
			}
		}
	}

	return 0;
}

1496 1497
/*
 *  @source_mnt : mount tree to be attached
R
Ram Pai 已提交
1498 1499 1500 1501
 *  @nd         : place the mount tree @source_mnt is attached
 *  @parent_nd  : if non-null, detach the source_mnt from its parent and
 *  		   store the parent mount and mountpoint dentry.
 *  		   (done when source_mnt is moved)
1502 1503 1504
 *
 *  NOTE: in the table below explains the semantics when a source mount
 *  of a given type is attached to a destination mount of a given type.
R
Ram Pai 已提交
1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516
 * ---------------------------------------------------------------------------
 * |         BIND MOUNT OPERATION                                            |
 * |**************************************************************************
 * | source-->| shared        |       private  |       slave    | unbindable |
 * | dest     |               |                |                |            |
 * |   |      |               |                |                |            |
 * |   v      |               |                |                |            |
 * |**************************************************************************
 * |  shared  | shared (++)   |     shared (+) |     shared(+++)|  invalid   |
 * |          |               |                |                |            |
 * |non-shared| shared (+)    |      private   |      slave (*) |  invalid   |
 * ***************************************************************************
1517 1518 1519 1520 1521 1522 1523 1524 1525
 * A bind operation clones the source mount and mounts the clone on the
 * destination mount.
 *
 * (++)  the cloned mount is propagated to all the mounts in the propagation
 * 	 tree of the destination mount and the cloned mount is added to
 * 	 the peer group of the source mount.
 * (+)   the cloned mount is created under the destination mount and is marked
 *       as shared. The cloned mount is added to the peer group of the source
 *       mount.
R
Ram Pai 已提交
1526 1527 1528 1529 1530 1531 1532
 * (+++) the mount is propagated to all the mounts in the propagation tree
 *       of the destination mount and the cloned mount is made slave
 *       of the same master as that of the source mount. The cloned mount
 *       is marked as 'shared and slave'.
 * (*)   the cloned mount is made a slave of the same master as that of the
 * 	 source mount.
 *
R
Ram Pai 已提交
1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544
 * ---------------------------------------------------------------------------
 * |         		MOVE MOUNT OPERATION                                 |
 * |**************************************************************************
 * | source-->| shared        |       private  |       slave    | unbindable |
 * | dest     |               |                |                |            |
 * |   |      |               |                |                |            |
 * |   v      |               |                |                |            |
 * |**************************************************************************
 * |  shared  | shared (+)    |     shared (+) |    shared(+++) |  invalid   |
 * |          |               |                |                |            |
 * |non-shared| shared (+*)   |      private   |    slave (*)   | unbindable |
 * ***************************************************************************
R
Ram Pai 已提交
1545 1546 1547
 *
 * (+)  the mount is moved to the destination. And is then propagated to
 * 	all the mounts in the propagation tree of the destination mount.
R
Ram Pai 已提交
1548
 * (+*)  the mount is moved to the destination.
R
Ram Pai 已提交
1549 1550 1551 1552
 * (+++)  the mount is moved to the destination and is then propagated to
 * 	all the mounts belonging to the destination mount's propagation tree.
 * 	the mount is marked as 'shared and slave'.
 * (*)	the mount continues to be a slave at the new location.
1553 1554 1555 1556 1557 1558 1559
 *
 * if the source mount is a tree, the operations explained above is
 * applied to each mount in the tree.
 * Must be called without spinlocks held, since this function can sleep
 * in allocations.
 */
static int attach_recursive_mnt(struct vfsmount *source_mnt,
1560
			struct path *path, struct path *parent_path)
1561 1562
{
	LIST_HEAD(tree_list);
1563 1564
	struct vfsmount *dest_mnt = path->mnt;
	struct dentry *dest_dentry = path->dentry;
1565
	struct vfsmount *child, *p;
1566
	int err;
1567

1568 1569 1570 1571 1572 1573 1574 1575
	if (IS_MNT_SHARED(dest_mnt)) {
		err = invent_group_ids(source_mnt, true);
		if (err)
			goto out;
	}
	err = propagate_mnt(dest_mnt, dest_dentry, source_mnt, &tree_list);
	if (err)
		goto out_cleanup_ids;
1576

N
Nick Piggin 已提交
1577
	br_write_lock(vfsmount_lock);
1578

1579 1580 1581 1582
	if (IS_MNT_SHARED(dest_mnt)) {
		for (p = source_mnt; p; p = next_mnt(p, source_mnt))
			set_mnt_shared(p);
	}
1583 1584 1585
	if (parent_path) {
		detach_mnt(source_mnt, parent_path);
		attach_mnt(source_mnt, path);
1586
		touch_mnt_namespace(parent_path->mnt->mnt_ns);
R
Ram Pai 已提交
1587 1588 1589 1590
	} else {
		mnt_set_mountpoint(dest_mnt, dest_dentry, source_mnt);
		commit_tree(source_mnt);
	}
1591 1592 1593 1594 1595

	list_for_each_entry_safe(child, p, &tree_list, mnt_hash) {
		list_del_init(&child->mnt_hash);
		commit_tree(child);
	}
N
Nick Piggin 已提交
1596 1597
	br_write_unlock(vfsmount_lock);

1598
	return 0;
1599 1600 1601 1602 1603 1604

 out_cleanup_ids:
	if (IS_MNT_SHARED(dest_mnt))
		cleanup_group_ids(source_mnt, NULL);
 out:
	return err;
1605 1606
}

1607
static int graft_tree(struct vfsmount *mnt, struct path *path)
L
Linus Torvalds 已提交
1608 1609 1610 1611 1612
{
	int err;
	if (mnt->mnt_sb->s_flags & MS_NOUSER)
		return -EINVAL;

1613
	if (S_ISDIR(path->dentry->d_inode->i_mode) !=
L
Linus Torvalds 已提交
1614 1615 1616 1617
	      S_ISDIR(mnt->mnt_root->d_inode->i_mode))
		return -ENOTDIR;

	err = -ENOENT;
1618
	mutex_lock(&path->dentry->d_inode->i_mutex);
1619
	if (cant_mount(path->dentry))
L
Linus Torvalds 已提交
1620 1621
		goto out_unlock;

1622
	if (!d_unlinked(path->dentry))
1623
		err = attach_recursive_mnt(mnt, path, NULL);
L
Linus Torvalds 已提交
1624
out_unlock:
1625
	mutex_unlock(&path->dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
1626 1627 1628
	return err;
}

1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645
/*
 * Sanity check the flags to change_mnt_propagation.
 */

static int flags_to_propagation_type(int flags)
{
	int type = flags & ~MS_REC;

	/* Fail if any non-propagation flags are set */
	if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
		return 0;
	/* Only one propagation flag should be set */
	if (!is_power_of_2(type))
		return 0;
	return type;
}

1646 1647 1648
/*
 * recursively change the type of the mountpoint.
 */
1649
static int do_change_type(struct path *path, int flag)
1650
{
1651
	struct vfsmount *m, *mnt = path->mnt;
1652
	int recurse = flag & MS_REC;
1653
	int type;
1654
	int err = 0;
1655

1656 1657 1658
	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

1659
	if (path->dentry != path->mnt->mnt_root)
1660 1661
		return -EINVAL;

1662 1663 1664 1665
	type = flags_to_propagation_type(flag);
	if (!type)
		return -EINVAL;

1666
	down_write(&namespace_sem);
1667 1668 1669 1670 1671 1672
	if (type == MS_SHARED) {
		err = invent_group_ids(mnt, recurse);
		if (err)
			goto out_unlock;
	}

N
Nick Piggin 已提交
1673
	br_write_lock(vfsmount_lock);
1674 1675
	for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL))
		change_mnt_propagation(m, type);
N
Nick Piggin 已提交
1676
	br_write_unlock(vfsmount_lock);
1677 1678

 out_unlock:
1679
	up_write(&namespace_sem);
1680
	return err;
1681 1682
}

L
Linus Torvalds 已提交
1683 1684 1685
/*
 * do loopback mount.
 */
1686
static int do_loopback(struct path *path, char *old_name,
1687
				int recurse)
L
Linus Torvalds 已提交
1688
{
1689
	struct path old_path;
L
Linus Torvalds 已提交
1690
	struct vfsmount *mnt = NULL;
1691
	int err = mount_is_safe(path);
L
Linus Torvalds 已提交
1692 1693 1694 1695
	if (err)
		return err;
	if (!old_name || !*old_name)
		return -EINVAL;
1696
	err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
L
Linus Torvalds 已提交
1697 1698 1699
	if (err)
		return err;

R
Ram Pai 已提交
1700
	down_write(&namespace_sem);
L
Linus Torvalds 已提交
1701
	err = -EINVAL;
1702
	if (IS_MNT_UNBINDABLE(old_path.mnt))
1703
		goto out;
R
Ram Pai 已提交
1704

1705
	if (!check_mnt(path->mnt) || !check_mnt(old_path.mnt))
1706
		goto out;
L
Linus Torvalds 已提交
1707

1708 1709
	err = -ENOMEM;
	if (recurse)
1710
		mnt = copy_tree(old_path.mnt, old_path.dentry, 0);
1711
	else
1712
		mnt = clone_mnt(old_path.mnt, old_path.dentry, 0);
1713 1714 1715 1716

	if (!mnt)
		goto out;

1717
	err = graft_tree(mnt, path);
1718
	if (err) {
R
Ram Pai 已提交
1719
		LIST_HEAD(umount_list);
N
Nick Piggin 已提交
1720 1721

		br_write_lock(vfsmount_lock);
R
Ram Pai 已提交
1722
		umount_tree(mnt, 0, &umount_list);
N
Nick Piggin 已提交
1723
		br_write_unlock(vfsmount_lock);
R
Ram Pai 已提交
1724
		release_mounts(&umount_list);
1725
	}
L
Linus Torvalds 已提交
1726

1727
out:
R
Ram Pai 已提交
1728
	up_write(&namespace_sem);
1729
	path_put(&old_path);
L
Linus Torvalds 已提交
1730 1731 1732
	return err;
}

1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749
static int change_mount_flags(struct vfsmount *mnt, int ms_flags)
{
	int error = 0;
	int readonly_request = 0;

	if (ms_flags & MS_RDONLY)
		readonly_request = 1;
	if (readonly_request == __mnt_is_readonly(mnt))
		return 0;

	if (readonly_request)
		error = mnt_make_readonly(mnt);
	else
		__mnt_unmake_readonly(mnt);
	return error;
}

L
Linus Torvalds 已提交
1750 1751 1752 1753 1754
/*
 * change filesystem flags. dir should be a physical root of filesystem.
 * If you've mounted a non-root directory somewhere and want to do remount
 * on it - tough luck.
 */
1755
static int do_remount(struct path *path, int flags, int mnt_flags,
L
Linus Torvalds 已提交
1756 1757 1758
		      void *data)
{
	int err;
1759
	struct super_block *sb = path->mnt->mnt_sb;
L
Linus Torvalds 已提交
1760 1761 1762 1763

	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

1764
	if (!check_mnt(path->mnt))
L
Linus Torvalds 已提交
1765 1766
		return -EINVAL;

1767
	if (path->dentry != path->mnt->mnt_root)
L
Linus Torvalds 已提交
1768 1769 1770
		return -EINVAL;

	down_write(&sb->s_umount);
1771
	if (flags & MS_BIND)
1772
		err = change_mount_flags(path->mnt, flags);
A
Al Viro 已提交
1773
	else
1774
		err = do_remount_sb(sb, flags, data, 0);
A
Al Viro 已提交
1775
	if (!err) {
N
Nick Piggin 已提交
1776
		br_write_lock(vfsmount_lock);
1777
		mnt_flags |= path->mnt->mnt_flags & MNT_PROPAGATION_MASK;
1778
		path->mnt->mnt_flags = mnt_flags;
N
Nick Piggin 已提交
1779
		br_write_unlock(vfsmount_lock);
A
Al Viro 已提交
1780
	}
L
Linus Torvalds 已提交
1781
	up_write(&sb->s_umount);
1782
	if (!err) {
N
Nick Piggin 已提交
1783
		br_write_lock(vfsmount_lock);
1784
		touch_mnt_namespace(path->mnt->mnt_ns);
N
Nick Piggin 已提交
1785
		br_write_unlock(vfsmount_lock);
1786
	}
L
Linus Torvalds 已提交
1787 1788 1789
	return err;
}

R
Ram Pai 已提交
1790 1791 1792 1793 1794 1795 1796 1797 1798 1799
static inline int tree_contains_unbindable(struct vfsmount *mnt)
{
	struct vfsmount *p;
	for (p = mnt; p; p = next_mnt(p, mnt)) {
		if (IS_MNT_UNBINDABLE(p))
			return 1;
	}
	return 0;
}

1800
static int do_move_mount(struct path *path, char *old_name)
L
Linus Torvalds 已提交
1801
{
1802
	struct path old_path, parent_path;
L
Linus Torvalds 已提交
1803 1804 1805 1806 1807 1808
	struct vfsmount *p;
	int err = 0;
	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;
	if (!old_name || !*old_name)
		return -EINVAL;
1809
	err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
L
Linus Torvalds 已提交
1810 1811 1812
	if (err)
		return err;

R
Ram Pai 已提交
1813
	down_write(&namespace_sem);
1814 1815 1816 1817
	err = follow_down(path, true);
	if (err < 0)
		goto out;

L
Linus Torvalds 已提交
1818
	err = -EINVAL;
1819
	if (!check_mnt(path->mnt) || !check_mnt(old_path.mnt))
L
Linus Torvalds 已提交
1820 1821 1822
		goto out;

	err = -ENOENT;
1823
	mutex_lock(&path->dentry->d_inode->i_mutex);
1824
	if (cant_mount(path->dentry))
L
Linus Torvalds 已提交
1825 1826
		goto out1;

1827
	if (d_unlinked(path->dentry))
R
Ram Pai 已提交
1828
		goto out1;
L
Linus Torvalds 已提交
1829 1830

	err = -EINVAL;
1831
	if (old_path.dentry != old_path.mnt->mnt_root)
R
Ram Pai 已提交
1832
		goto out1;
L
Linus Torvalds 已提交
1833

1834
	if (old_path.mnt == old_path.mnt->mnt_parent)
R
Ram Pai 已提交
1835
		goto out1;
L
Linus Torvalds 已提交
1836

1837 1838
	if (S_ISDIR(path->dentry->d_inode->i_mode) !=
	      S_ISDIR(old_path.dentry->d_inode->i_mode))
R
Ram Pai 已提交
1839 1840 1841 1842
		goto out1;
	/*
	 * Don't move a mount residing in a shared parent.
	 */
1843 1844
	if (old_path.mnt->mnt_parent &&
	    IS_MNT_SHARED(old_path.mnt->mnt_parent))
R
Ram Pai 已提交
1845
		goto out1;
R
Ram Pai 已提交
1846 1847 1848 1849
	/*
	 * Don't move a mount tree containing unbindable mounts to a destination
	 * mount which is shared.
	 */
1850 1851
	if (IS_MNT_SHARED(path->mnt) &&
	    tree_contains_unbindable(old_path.mnt))
R
Ram Pai 已提交
1852
		goto out1;
L
Linus Torvalds 已提交
1853
	err = -ELOOP;
1854 1855
	for (p = path->mnt; p->mnt_parent != p; p = p->mnt_parent)
		if (p == old_path.mnt)
R
Ram Pai 已提交
1856
			goto out1;
L
Linus Torvalds 已提交
1857

1858
	err = attach_recursive_mnt(old_path.mnt, path, &parent_path);
1859
	if (err)
R
Ram Pai 已提交
1860
		goto out1;
L
Linus Torvalds 已提交
1861 1862 1863

	/* if the mount is moved, it should no longer be expire
	 * automatically */
1864
	list_del_init(&old_path.mnt->mnt_expire);
L
Linus Torvalds 已提交
1865
out1:
1866
	mutex_unlock(&path->dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
1867
out:
R
Ram Pai 已提交
1868
	up_write(&namespace_sem);
L
Linus Torvalds 已提交
1869
	if (!err)
1870
		path_put(&parent_path);
1871
	path_put(&old_path);
L
Linus Torvalds 已提交
1872 1873 1874
	return err;
}

A
Al Viro 已提交
1875 1876
static int do_add_mount(struct vfsmount *, struct path *, int);

L
Linus Torvalds 已提交
1877 1878 1879 1880
/*
 * create a new mount for userspace and request it to be added into the
 * namespace's tree
 */
1881
static int do_new_mount(struct path *path, char *type, int flags,
L
Linus Torvalds 已提交
1882 1883 1884
			int mnt_flags, char *name, void *data)
{
	struct vfsmount *mnt;
1885
	int err;
L
Linus Torvalds 已提交
1886

1887
	if (!type)
L
Linus Torvalds 已提交
1888 1889 1890 1891 1892 1893 1894 1895 1896 1897
		return -EINVAL;

	/* we need capabilities... */
	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

	mnt = do_kern_mount(type, flags, name, data);
	if (IS_ERR(mnt))
		return PTR_ERR(mnt);

1898 1899 1900 1901
	err = do_add_mount(mnt, path, mnt_flags);
	if (err)
		mntput(mnt);
	return err;
L
Linus Torvalds 已提交
1902 1903
}

1904 1905 1906 1907 1908 1909 1910 1911 1912 1913
int finish_automount(struct vfsmount *m, struct path *path)
{
	int err;
	/* The new mount record should have at least 2 refs to prevent it being
	 * expired before we get a chance to add it
	 */
	BUG_ON(mnt_get_count(m) < 2);

	if (m->mnt_sb == path->mnt->mnt_sb &&
	    m->mnt_root == path->dentry) {
A
Al Viro 已提交
1914 1915
		err = -ELOOP;
		goto fail;
1916 1917 1918
	}

	err = do_add_mount(m, path, path->mnt->mnt_flags | MNT_SHRINKABLE);
A
Al Viro 已提交
1919 1920 1921 1922 1923 1924 1925 1926 1927 1928
	if (!err)
		return 0;
fail:
	/* remove m from any expiration list it may be on */
	if (!list_empty(&m->mnt_expire)) {
		down_write(&namespace_sem);
		br_write_lock(vfsmount_lock);
		list_del_init(&m->mnt_expire);
		br_write_unlock(vfsmount_lock);
		up_write(&namespace_sem);
1929
	}
A
Al Viro 已提交
1930 1931
	mntput(m);
	mntput(m);
1932 1933 1934
	return err;
}

L
Linus Torvalds 已提交
1935 1936 1937
/*
 * add a mount into a namespace's mount tree
 */
A
Al Viro 已提交
1938
static int do_add_mount(struct vfsmount *newmnt, struct path *path, int mnt_flags)
L
Linus Torvalds 已提交
1939 1940 1941
{
	int err;

A
Al Viro 已提交
1942
	mnt_flags &= ~(MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL);
1943

R
Ram Pai 已提交
1944
	down_write(&namespace_sem);
L
Linus Torvalds 已提交
1945
	/* Something was mounted here while we slept */
1946 1947 1948 1949
	err = follow_down(path, true);
	if (err < 0)
		goto unlock;

L
Linus Torvalds 已提交
1950
	err = -EINVAL;
1951
	if (!(mnt_flags & MNT_SHRINKABLE) && !check_mnt(path->mnt))
L
Linus Torvalds 已提交
1952 1953 1954 1955
		goto unlock;

	/* Refuse the same filesystem on the same mount point */
	err = -EBUSY;
1956 1957
	if (path->mnt->mnt_sb == newmnt->mnt_sb &&
	    path->mnt->mnt_root == path->dentry)
L
Linus Torvalds 已提交
1958 1959 1960 1961 1962 1963 1964
		goto unlock;

	err = -EINVAL;
	if (S_ISLNK(newmnt->mnt_root->d_inode->i_mode))
		goto unlock;

	newmnt->mnt_flags = mnt_flags;
A
Al Viro 已提交
1965
	err = graft_tree(newmnt, path);
L
Linus Torvalds 已提交
1966 1967

unlock:
R
Ram Pai 已提交
1968
	up_write(&namespace_sem);
L
Linus Torvalds 已提交
1969 1970 1971
	return err;
}

1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988
/**
 * mnt_set_expiry - Put a mount on an expiration list
 * @mnt: The mount to list.
 * @expiry_list: The list to add the mount to.
 */
void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list)
{
	down_write(&namespace_sem);
	br_write_lock(vfsmount_lock);

	list_add_tail(&mnt->mnt_expire, expiry_list);

	br_write_unlock(vfsmount_lock);
	up_write(&namespace_sem);
}
EXPORT_SYMBOL(mnt_set_expiry);

L
Linus Torvalds 已提交
1989 1990 1991 1992 1993 1994 1995 1996 1997
/*
 * process a list of expirable mountpoints with the intent of discarding any
 * mountpoints that aren't in use and haven't been touched since last we came
 * here
 */
void mark_mounts_for_expiry(struct list_head *mounts)
{
	struct vfsmount *mnt, *next;
	LIST_HEAD(graveyard);
1998
	LIST_HEAD(umounts);
L
Linus Torvalds 已提交
1999 2000 2001 2002

	if (list_empty(mounts))
		return;

2003
	down_write(&namespace_sem);
N
Nick Piggin 已提交
2004
	br_write_lock(vfsmount_lock);
L
Linus Torvalds 已提交
2005 2006 2007 2008 2009 2010 2011

	/* extract from the expiration list every vfsmount that matches the
	 * following criteria:
	 * - only referenced by its parent vfsmount
	 * - still marked for expiry (marked on the last call here; marks are
	 *   cleared by mntput())
	 */
2012
	list_for_each_entry_safe(mnt, next, mounts, mnt_expire) {
L
Linus Torvalds 已提交
2013
		if (!xchg(&mnt->mnt_expiry_mark, 1) ||
2014
			propagate_mount_busy(mnt, 1))
L
Linus Torvalds 已提交
2015
			continue;
2016
		list_move(&mnt->mnt_expire, &graveyard);
L
Linus Torvalds 已提交
2017
	}
2018 2019 2020 2021 2022
	while (!list_empty(&graveyard)) {
		mnt = list_first_entry(&graveyard, struct vfsmount, mnt_expire);
		touch_mnt_namespace(mnt->mnt_ns);
		umount_tree(mnt, 1, &umounts);
	}
N
Nick Piggin 已提交
2023
	br_write_unlock(vfsmount_lock);
2024 2025 2026
	up_write(&namespace_sem);

	release_mounts(&umounts);
T
Trond Myklebust 已提交
2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051
}

EXPORT_SYMBOL_GPL(mark_mounts_for_expiry);

/*
 * Ripoff of 'select_parent()'
 *
 * search the list of submounts for a given mountpoint, and move any
 * shrinkable submounts to the 'graveyard' list.
 */
static int select_submounts(struct vfsmount *parent, struct list_head *graveyard)
{
	struct vfsmount *this_parent = parent;
	struct list_head *next;
	int found = 0;

repeat:
	next = this_parent->mnt_mounts.next;
resume:
	while (next != &this_parent->mnt_mounts) {
		struct list_head *tmp = next;
		struct vfsmount *mnt = list_entry(tmp, struct vfsmount, mnt_child);

		next = tmp->next;
		if (!(mnt->mnt_flags & MNT_SHRINKABLE))
L
Linus Torvalds 已提交
2052
			continue;
T
Trond Myklebust 已提交
2053 2054 2055 2056 2057 2058 2059
		/*
		 * Descend a level if the d_mounts list is non-empty.
		 */
		if (!list_empty(&mnt->mnt_mounts)) {
			this_parent = mnt;
			goto repeat;
		}
L
Linus Torvalds 已提交
2060

T
Trond Myklebust 已提交
2061 2062 2063 2064
		if (!propagate_mount_busy(mnt, 1)) {
			list_move_tail(&mnt->mnt_expire, graveyard);
			found++;
		}
L
Linus Torvalds 已提交
2065
	}
T
Trond Myklebust 已提交
2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079
	/*
	 * All done at this level ... ascend and resume the search
	 */
	if (this_parent != parent) {
		next = this_parent->mnt_child.next;
		this_parent = this_parent->mnt_parent;
		goto resume;
	}
	return found;
}

/*
 * process a list of expirable mountpoints with the intent of discarding any
 * submounts of a specific parent mountpoint
N
Nick Piggin 已提交
2080 2081
 *
 * vfsmount_lock must be held for write
T
Trond Myklebust 已提交
2082
 */
2083
static void shrink_submounts(struct vfsmount *mnt, struct list_head *umounts)
T
Trond Myklebust 已提交
2084 2085
{
	LIST_HEAD(graveyard);
2086
	struct vfsmount *m;
T
Trond Myklebust 已提交
2087 2088

	/* extract submounts of 'mountpoint' from the expiration list */
2089
	while (select_submounts(mnt, &graveyard)) {
2090
		while (!list_empty(&graveyard)) {
2091
			m = list_first_entry(&graveyard, struct vfsmount,
2092
						mnt_expire);
E
Eric W. Biederman 已提交
2093 2094
			touch_mnt_namespace(m->mnt_ns);
			umount_tree(m, 1, umounts);
2095 2096
		}
	}
L
Linus Torvalds 已提交
2097 2098 2099 2100 2101 2102 2103 2104
}

/*
 * Some copy_from_user() implementations do not return the exact number of
 * bytes remaining to copy on a fault.  But copy_mount_options() requires that.
 * Note that this function differs from copy_from_user() in that it will oops
 * on bad values of `to', rather than returning a short copy.
 */
R
Ram Pai 已提交
2105 2106
static long exact_copy_from_user(void *to, const void __user * from,
				 unsigned long n)
L
Linus Torvalds 已提交
2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 2125 2126
{
	char *t = to;
	const char __user *f = from;
	char c;

	if (!access_ok(VERIFY_READ, from, n))
		return n;

	while (n) {
		if (__get_user(c, f)) {
			memset(t, 0, n);
			break;
		}
		*t++ = c;
		f++;
		n--;
	}
	return n;
}

R
Ram Pai 已提交
2127
int copy_mount_options(const void __user * data, unsigned long *where)
L
Linus Torvalds 已提交
2128 2129 2130 2131
{
	int i;
	unsigned long page;
	unsigned long size;
R
Ram Pai 已提交
2132

L
Linus Torvalds 已提交
2133 2134 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149 2150
	*where = 0;
	if (!data)
		return 0;

	if (!(page = __get_free_page(GFP_KERNEL)))
		return -ENOMEM;

	/* We only care that *some* data at the address the user
	 * gave us is valid.  Just in case, we'll zero
	 * the remainder of the page.
	 */
	/* copy_from_user cannot cross TASK_SIZE ! */
	size = TASK_SIZE - (unsigned long)data;
	if (size > PAGE_SIZE)
		size = PAGE_SIZE;

	i = size - exact_copy_from_user((void *)page, data, size);
	if (!i) {
R
Ram Pai 已提交
2151
		free_page(page);
L
Linus Torvalds 已提交
2152 2153 2154 2155 2156 2157 2158 2159
		return -EFAULT;
	}
	if (i != PAGE_SIZE)
		memset((char *)page + i, 0, PAGE_SIZE - i);
	*where = page;
	return 0;
}

2160 2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176
int copy_mount_string(const void __user *data, char **where)
{
	char *tmp;

	if (!data) {
		*where = NULL;
		return 0;
	}

	tmp = strndup_user(data, PAGE_SIZE);
	if (IS_ERR(tmp))
		return PTR_ERR(tmp);

	*where = tmp;
	return 0;
}

L
Linus Torvalds 已提交
2177 2178 2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190
/*
 * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to
 * be given to the mount() call (ie: read-only, no-dev, no-suid etc).
 *
 * data is a (void *) that can point to any structure up to
 * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent
 * information (or be NULL).
 *
 * Pre-0.97 versions of mount() didn't have a flags word.
 * When the flags word was introduced its top half was required
 * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9.
 * Therefore, if this magic number is present, it carries no information
 * and must be discarded.
 */
R
Ram Pai 已提交
2191
long do_mount(char *dev_name, char *dir_name, char *type_page,
L
Linus Torvalds 已提交
2192 2193
		  unsigned long flags, void *data_page)
{
2194
	struct path path;
L
Linus Torvalds 已提交
2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209
	int retval = 0;
	int mnt_flags = 0;

	/* Discard magic */
	if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
		flags &= ~MS_MGC_MSK;

	/* Basic sanity checks */

	if (!dir_name || !*dir_name || !memchr(dir_name, 0, PAGE_SIZE))
		return -EINVAL;

	if (data_page)
		((char *)data_page)[PAGE_SIZE - 1] = 0;

2210 2211 2212 2213 2214 2215 2216 2217 2218 2219
	/* ... and get the mountpoint */
	retval = kern_path(dir_name, LOOKUP_FOLLOW, &path);
	if (retval)
		return retval;

	retval = security_sb_mount(dev_name, &path,
				   type_page, flags, data_page);
	if (retval)
		goto dput_out;

2220 2221 2222
	/* Default to relatime unless overriden */
	if (!(flags & MS_NOATIME))
		mnt_flags |= MNT_RELATIME;
M
Matthew Garrett 已提交
2223

L
Linus Torvalds 已提交
2224 2225 2226 2227 2228 2229 2230
	/* Separate the per-mountpoint flags */
	if (flags & MS_NOSUID)
		mnt_flags |= MNT_NOSUID;
	if (flags & MS_NODEV)
		mnt_flags |= MNT_NODEV;
	if (flags & MS_NOEXEC)
		mnt_flags |= MNT_NOEXEC;
2231 2232 2233 2234
	if (flags & MS_NOATIME)
		mnt_flags |= MNT_NOATIME;
	if (flags & MS_NODIRATIME)
		mnt_flags |= MNT_NODIRATIME;
M
Matthew Garrett 已提交
2235 2236
	if (flags & MS_STRICTATIME)
		mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME);
2237 2238
	if (flags & MS_RDONLY)
		mnt_flags |= MNT_READONLY;
2239

A
Al Viro 已提交
2240
	flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN |
M
Matthew Garrett 已提交
2241 2242
		   MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
		   MS_STRICTATIME);
L
Linus Torvalds 已提交
2243 2244

	if (flags & MS_REMOUNT)
2245
		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
L
Linus Torvalds 已提交
2246 2247
				    data_page);
	else if (flags & MS_BIND)
2248
		retval = do_loopback(&path, dev_name, flags & MS_REC);
R
Ram Pai 已提交
2249
	else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
2250
		retval = do_change_type(&path, flags);
L
Linus Torvalds 已提交
2251
	else if (flags & MS_MOVE)
2252
		retval = do_move_mount(&path, dev_name);
L
Linus Torvalds 已提交
2253
	else
2254
		retval = do_new_mount(&path, type_page, flags, mnt_flags,
L
Linus Torvalds 已提交
2255 2256
				      dev_name, data_page);
dput_out:
2257
	path_put(&path);
L
Linus Torvalds 已提交
2258 2259 2260
	return retval;
}

2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275
static struct mnt_namespace *alloc_mnt_ns(void)
{
	struct mnt_namespace *new_ns;

	new_ns = kmalloc(sizeof(struct mnt_namespace), GFP_KERNEL);
	if (!new_ns)
		return ERR_PTR(-ENOMEM);
	atomic_set(&new_ns->count, 1);
	new_ns->root = NULL;
	INIT_LIST_HEAD(&new_ns->list);
	init_waitqueue_head(&new_ns->poll);
	new_ns->event = 0;
	return new_ns;
}

A
Al Viro 已提交
2276 2277
void mnt_make_longterm(struct vfsmount *mnt)
{
2278
	__mnt_make_longterm(mnt);
A
Al Viro 已提交
2279 2280 2281 2282
}

void mnt_make_shortterm(struct vfsmount *mnt)
{
2283
#ifdef CONFIG_SMP
A
Al Viro 已提交
2284 2285 2286 2287 2288
	if (atomic_add_unless(&mnt->mnt_longterm, -1, 1))
		return;
	br_write_lock(vfsmount_lock);
	atomic_dec(&mnt->mnt_longterm);
	br_write_unlock(vfsmount_lock);
2289
#endif
A
Al Viro 已提交
2290 2291
}

2292 2293 2294 2295
/*
 * Allocate a new namespace structure and populate it with contents
 * copied from the namespace of the passed in task structure.
 */
2296
static struct mnt_namespace *dup_mnt_ns(struct mnt_namespace *mnt_ns,
2297
		struct fs_struct *fs)
L
Linus Torvalds 已提交
2298
{
2299
	struct mnt_namespace *new_ns;
A
Al Viro 已提交
2300
	struct vfsmount *rootmnt = NULL, *pwdmnt = NULL;
L
Linus Torvalds 已提交
2301 2302
	struct vfsmount *p, *q;

2303 2304 2305
	new_ns = alloc_mnt_ns();
	if (IS_ERR(new_ns))
		return new_ns;
L
Linus Torvalds 已提交
2306

R
Ram Pai 已提交
2307
	down_write(&namespace_sem);
L
Linus Torvalds 已提交
2308
	/* First pass: copy the tree topology */
2309
	new_ns->root = copy_tree(mnt_ns->root, mnt_ns->root->mnt_root,
R
Ram Pai 已提交
2310
					CL_COPY_ALL | CL_EXPIRE);
L
Linus Torvalds 已提交
2311
	if (!new_ns->root) {
R
Ram Pai 已提交
2312
		up_write(&namespace_sem);
L
Linus Torvalds 已提交
2313
		kfree(new_ns);
2314
		return ERR_PTR(-ENOMEM);
L
Linus Torvalds 已提交
2315
	}
N
Nick Piggin 已提交
2316
	br_write_lock(vfsmount_lock);
L
Linus Torvalds 已提交
2317
	list_add_tail(&new_ns->list, &new_ns->root->mnt_list);
N
Nick Piggin 已提交
2318
	br_write_unlock(vfsmount_lock);
L
Linus Torvalds 已提交
2319 2320 2321 2322 2323 2324

	/*
	 * Second pass: switch the tsk->fs->* elements and mark new vfsmounts
	 * as belonging to new namespace.  We have already acquired a private
	 * fs_struct, so tsk->fs->lock is not needed.
	 */
2325
	p = mnt_ns->root;
L
Linus Torvalds 已提交
2326 2327
	q = new_ns->root;
	while (p) {
2328
		q->mnt_ns = new_ns;
2329
		__mnt_make_longterm(q);
L
Linus Torvalds 已提交
2330
		if (fs) {
J
Jan Blunck 已提交
2331
			if (p == fs->root.mnt) {
A
Al Viro 已提交
2332
				fs->root.mnt = mntget(q);
2333
				__mnt_make_longterm(q);
A
Al Viro 已提交
2334
				mnt_make_shortterm(p);
L
Linus Torvalds 已提交
2335 2336
				rootmnt = p;
			}
J
Jan Blunck 已提交
2337
			if (p == fs->pwd.mnt) {
A
Al Viro 已提交
2338
				fs->pwd.mnt = mntget(q);
2339
				__mnt_make_longterm(q);
A
Al Viro 已提交
2340
				mnt_make_shortterm(p);
L
Linus Torvalds 已提交
2341 2342 2343
				pwdmnt = p;
			}
		}
2344
		p = next_mnt(p, mnt_ns->root);
L
Linus Torvalds 已提交
2345 2346
		q = next_mnt(q, new_ns->root);
	}
R
Ram Pai 已提交
2347
	up_write(&namespace_sem);
L
Linus Torvalds 已提交
2348 2349

	if (rootmnt)
A
Al Viro 已提交
2350
		mntput(rootmnt);
L
Linus Torvalds 已提交
2351
	if (pwdmnt)
A
Al Viro 已提交
2352
		mntput(pwdmnt);
L
Linus Torvalds 已提交
2353

2354 2355 2356
	return new_ns;
}

2357
struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
2358
		struct fs_struct *new_fs)
2359
{
2360
	struct mnt_namespace *new_ns;
2361

2362
	BUG_ON(!ns);
2363
	get_mnt_ns(ns);
2364 2365

	if (!(flags & CLONE_NEWNS))
2366
		return ns;
2367

2368
	new_ns = dup_mnt_ns(ns, new_fs);
2369

2370
	put_mnt_ns(ns);
2371
	return new_ns;
L
Linus Torvalds 已提交
2372 2373
}

2374 2375 2376 2377
/**
 * create_mnt_ns - creates a private namespace and adds a root filesystem
 * @mnt: pointer to the new root filesystem mountpoint
 */
2378
struct mnt_namespace *create_mnt_ns(struct vfsmount *mnt)
2379 2380 2381 2382 2383 2384
{
	struct mnt_namespace *new_ns;

	new_ns = alloc_mnt_ns();
	if (!IS_ERR(new_ns)) {
		mnt->mnt_ns = new_ns;
2385
		__mnt_make_longterm(mnt);
2386 2387 2388 2389 2390
		new_ns->root = mnt;
		list_add(&new_ns->list, &new_ns->root->mnt_list);
	}
	return new_ns;
}
2391
EXPORT_SYMBOL(create_mnt_ns);
2392

2393 2394
SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
		char __user *, type, unsigned long, flags, void __user *, data)
L
Linus Torvalds 已提交
2395
{
2396 2397 2398 2399
	int ret;
	char *kernel_type;
	char *kernel_dir;
	char *kernel_dev;
L
Linus Torvalds 已提交
2400 2401
	unsigned long data_page;

2402 2403 2404
	ret = copy_mount_string(type, &kernel_type);
	if (ret < 0)
		goto out_type;
L
Linus Torvalds 已提交
2405

2406 2407 2408 2409 2410
	kernel_dir = getname(dir_name);
	if (IS_ERR(kernel_dir)) {
		ret = PTR_ERR(kernel_dir);
		goto out_dir;
	}
L
Linus Torvalds 已提交
2411

2412 2413 2414
	ret = copy_mount_string(dev_name, &kernel_dev);
	if (ret < 0)
		goto out_dev;
L
Linus Torvalds 已提交
2415

2416 2417 2418
	ret = copy_mount_options(data, &data_page);
	if (ret < 0)
		goto out_data;
L
Linus Torvalds 已提交
2419

2420 2421
	ret = do_mount(kernel_dev, kernel_dir, kernel_type, flags,
		(void *) data_page);
L
Linus Torvalds 已提交
2422

2423 2424 2425 2426 2427 2428 2429 2430 2431
	free_page(data_page);
out_data:
	kfree(kernel_dev);
out_dev:
	putname(kernel_dir);
out_dir:
	kfree(kernel_type);
out_type:
	return ret;
L
Linus Torvalds 已提交
2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442 2443 2444 2445 2446
}

/*
 * pivot_root Semantics:
 * Moves the root file system of the current process to the directory put_old,
 * makes new_root as the new root file system of the current process, and sets
 * root/cwd of all processes which had them on the current root to new_root.
 *
 * Restrictions:
 * The new_root and put_old must be directories, and  must not be on the
 * same file  system as the current process root. The put_old  must  be
 * underneath new_root,  i.e. adding a non-zero number of /.. to the string
 * pointed to by put_old must yield the same directory as new_root. No other
 * file system may be mounted on put_old. After all, new_root is a mountpoint.
 *
N
Neil Brown 已提交
2447 2448 2449 2450
 * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem.
 * See Documentation/filesystems/ramfs-rootfs-initramfs.txt for alternatives
 * in this situation.
 *
L
Linus Torvalds 已提交
2451 2452 2453 2454 2455 2456 2457 2458
 * Notes:
 *  - we don't move root/cwd if they are not at the root (reason: if something
 *    cared enough to change them, it's probably wrong to force them elsewhere)
 *  - it's okay to pick a root that isn't the root of a file system, e.g.
 *    /nfs/my_root where /nfs is the mount point. It must be a mountpoint,
 *    though, so you may need to say mount --bind /nfs/my_root /nfs/my_root
 *    first.
 */
2459 2460
SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
		const char __user *, put_old)
L
Linus Torvalds 已提交
2461 2462
{
	struct vfsmount *tmp;
2463
	struct path new, old, parent_path, root_parent, root;
L
Linus Torvalds 已提交
2464 2465 2466 2467 2468
	int error;

	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

2469
	error = user_path_dir(new_root, &new);
L
Linus Torvalds 已提交
2470 2471 2472
	if (error)
		goto out0;
	error = -EINVAL;
2473
	if (!check_mnt(new.mnt))
L
Linus Torvalds 已提交
2474 2475
		goto out1;

2476
	error = user_path_dir(put_old, &old);
L
Linus Torvalds 已提交
2477 2478 2479
	if (error)
		goto out1;

2480
	error = security_sb_pivotroot(&old, &new);
L
Linus Torvalds 已提交
2481
	if (error) {
2482
		path_put(&old);
L
Linus Torvalds 已提交
2483 2484 2485
		goto out1;
	}

2486
	get_fs_root(current->fs, &root);
R
Ram Pai 已提交
2487
	down_write(&namespace_sem);
2488
	mutex_lock(&old.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
2489
	error = -EINVAL;
2490 2491
	if (IS_MNT_SHARED(old.mnt) ||
		IS_MNT_SHARED(new.mnt->mnt_parent) ||
2492
		IS_MNT_SHARED(root.mnt->mnt_parent))
R
Ram Pai 已提交
2493
		goto out2;
2494
	if (!check_mnt(root.mnt))
L
Linus Torvalds 已提交
2495 2496
		goto out2;
	error = -ENOENT;
2497
	if (cant_mount(old.dentry))
L
Linus Torvalds 已提交
2498
		goto out2;
2499
	if (d_unlinked(new.dentry))
L
Linus Torvalds 已提交
2500
		goto out2;
2501
	if (d_unlinked(old.dentry))
L
Linus Torvalds 已提交
2502 2503
		goto out2;
	error = -EBUSY;
2504 2505
	if (new.mnt == root.mnt ||
	    old.mnt == root.mnt)
L
Linus Torvalds 已提交
2506 2507
		goto out2; /* loop, on the same file system  */
	error = -EINVAL;
2508
	if (root.mnt->mnt_root != root.dentry)
L
Linus Torvalds 已提交
2509
		goto out2; /* not a mountpoint */
2510
	if (root.mnt->mnt_parent == root.mnt)
2511
		goto out2; /* not attached */
2512
	if (new.mnt->mnt_root != new.dentry)
L
Linus Torvalds 已提交
2513
		goto out2; /* not a mountpoint */
2514
	if (new.mnt->mnt_parent == new.mnt)
2515
		goto out2; /* not attached */
2516
	/* make sure we can reach put_old from new_root */
2517
	tmp = old.mnt;
N
Nick Piggin 已提交
2518
	br_write_lock(vfsmount_lock);
2519
	if (tmp != new.mnt) {
L
Linus Torvalds 已提交
2520 2521 2522
		for (;;) {
			if (tmp->mnt_parent == tmp)
				goto out3; /* already mounted on put_old */
2523
			if (tmp->mnt_parent == new.mnt)
L
Linus Torvalds 已提交
2524 2525 2526
				break;
			tmp = tmp->mnt_parent;
		}
2527
		if (!is_subdir(tmp->mnt_mountpoint, new.dentry))
L
Linus Torvalds 已提交
2528
			goto out3;
2529
	} else if (!is_subdir(old.dentry, new.dentry))
L
Linus Torvalds 已提交
2530
		goto out3;
2531
	detach_mnt(new.mnt, &parent_path);
2532
	detach_mnt(root.mnt, &root_parent);
2533
	/* mount old root on put_old */
2534
	attach_mnt(root.mnt, &old);
2535
	/* mount new_root on / */
2536
	attach_mnt(new.mnt, &root_parent);
2537
	touch_mnt_namespace(current->nsproxy->mnt_ns);
N
Nick Piggin 已提交
2538
	br_write_unlock(vfsmount_lock);
2539
	chroot_fs_refs(&root, &new);
N
Nick Piggin 已提交
2540

L
Linus Torvalds 已提交
2541
	error = 0;
2542 2543
	path_put(&root_parent);
	path_put(&parent_path);
L
Linus Torvalds 已提交
2544
out2:
2545
	mutex_unlock(&old.dentry->d_inode->i_mutex);
R
Ram Pai 已提交
2546
	up_write(&namespace_sem);
2547
	path_put(&root);
2548
	path_put(&old);
L
Linus Torvalds 已提交
2549
out1:
2550
	path_put(&new);
L
Linus Torvalds 已提交
2551 2552 2553
out0:
	return error;
out3:
N
Nick Piggin 已提交
2554
	br_write_unlock(vfsmount_lock);
L
Linus Torvalds 已提交
2555 2556 2557 2558 2559 2560
	goto out2;
}

static void __init init_mount_tree(void)
{
	struct vfsmount *mnt;
2561
	struct mnt_namespace *ns;
2562
	struct path root;
L
Linus Torvalds 已提交
2563 2564 2565 2566

	mnt = do_kern_mount("rootfs", 0, "rootfs", NULL);
	if (IS_ERR(mnt))
		panic("Can't create rootfs");
N
Nick Piggin 已提交
2567

2568 2569
	ns = create_mnt_ns(mnt);
	if (IS_ERR(ns))
L
Linus Torvalds 已提交
2570
		panic("Can't allocate initial namespace");
2571 2572 2573 2574

	init_task.nsproxy->mnt_ns = ns;
	get_mnt_ns(ns);

2575 2576 2577 2578 2579
	root.mnt = ns->root;
	root.dentry = ns->root->mnt_root;

	set_fs_pwd(current->fs, &root);
	set_fs_root(current->fs, &root);
L
Linus Torvalds 已提交
2580 2581
}

2582
void __init mnt_init(void)
L
Linus Torvalds 已提交
2583
{
E
Eric Dumazet 已提交
2584
	unsigned u;
2585
	int err;
L
Linus Torvalds 已提交
2586

R
Ram Pai 已提交
2587 2588
	init_rwsem(&namespace_sem);

L
Linus Torvalds 已提交
2589
	mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct vfsmount),
2590
			0, SLAB_HWCACHE_ALIGN | SLAB_PANIC, NULL);
L
Linus Torvalds 已提交
2591

R
Ram Pai 已提交
2592
	mount_hashtable = (struct list_head *)__get_free_page(GFP_ATOMIC);
L
Linus Torvalds 已提交
2593 2594 2595 2596

	if (!mount_hashtable)
		panic("Failed to allocate mount hash table\n");

E
Eric Dumazet 已提交
2597 2598 2599 2600
	printk("Mount-cache hash table entries: %lu\n", HASH_SIZE);

	for (u = 0; u < HASH_SIZE; u++)
		INIT_LIST_HEAD(&mount_hashtable[u]);
L
Linus Torvalds 已提交
2601

N
Nick Piggin 已提交
2602 2603
	br_lock_init(vfsmount_lock);

2604 2605 2606
	err = sysfs_init();
	if (err)
		printk(KERN_WARNING "%s: sysfs_init error: %d\n",
2607
			__func__, err);
2608 2609
	fs_kobj = kobject_create_and_add("fs", NULL);
	if (!fs_kobj)
2610
		printk(KERN_WARNING "%s: kobj create error\n", __func__);
L
Linus Torvalds 已提交
2611 2612 2613 2614
	init_rootfs();
	init_mount_tree();
}

2615
void put_mnt_ns(struct mnt_namespace *ns)
L
Linus Torvalds 已提交
2616
{
R
Ram Pai 已提交
2617
	LIST_HEAD(umount_list);
2618

2619
	if (!atomic_dec_and_test(&ns->count))
2620
		return;
R
Ram Pai 已提交
2621
	down_write(&namespace_sem);
N
Nick Piggin 已提交
2622
	br_write_lock(vfsmount_lock);
2623
	umount_tree(ns->root, 0, &umount_list);
N
Nick Piggin 已提交
2624
	br_write_unlock(vfsmount_lock);
R
Ram Pai 已提交
2625
	up_write(&namespace_sem);
R
Ram Pai 已提交
2626
	release_mounts(&umount_list);
2627
	kfree(ns);
L
Linus Torvalds 已提交
2628
}
2629
EXPORT_SYMBOL(put_mnt_ns);