namei.c 133.8 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0
L
Linus Torvalds 已提交
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
/*
 *  linux/fs/namei.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

/*
 * Some corrections by tytso.
 */

/* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
 * lookup logic.
 */
/* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
 */

#include <linux/init.h>
19
#include <linux/export.h>
20
#include <linux/kernel.h>
L
Linus Torvalds 已提交
21 22 23 24
#include <linux/slab.h>
#include <linux/fs.h>
#include <linux/namei.h>
#include <linux/pagemap.h>
R
Robert Love 已提交
25
#include <linux/fsnotify.h>
L
Linus Torvalds 已提交
26 27
#include <linux/personality.h>
#include <linux/security.h>
M
Mimi Zohar 已提交
28
#include <linux/ima.h>
L
Linus Torvalds 已提交
29 30 31
#include <linux/syscalls.h>
#include <linux/mount.h>
#include <linux/audit.h>
32
#include <linux/capability.h>
33
#include <linux/file.h>
34
#include <linux/fcntl.h>
35
#include <linux/device_cgroup.h>
36
#include <linux/fs_struct.h>
37
#include <linux/posix_acl.h>
38
#include <linux/hash.h>
39
#include <linux/bitops.h>
40
#include <linux/init_task.h>
41
#include <linux/uaccess.h>
L
Linus Torvalds 已提交
42

43
#include "internal.h"
44
#include "mount.h"
45

L
Linus Torvalds 已提交
46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79
/* [Feb-1997 T. Schoebel-Theuer]
 * Fundamental changes in the pathname lookup mechanisms (namei)
 * were necessary because of omirr.  The reason is that omirr needs
 * to know the _real_ pathname, not the user-supplied one, in case
 * of symlinks (and also when transname replacements occur).
 *
 * The new code replaces the old recursive symlink resolution with
 * an iterative one (in case of non-nested symlink chains).  It does
 * this with calls to <fs>_follow_link().
 * As a side effect, dir_namei(), _namei() and follow_link() are now 
 * replaced with a single function lookup_dentry() that can handle all 
 * the special cases of the former code.
 *
 * With the new dcache, the pathname is stored at each inode, at least as
 * long as the refcount of the inode is positive.  As a side effect, the
 * size of the dcache depends on the inode cache and thus is dynamic.
 *
 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
 * resolution to correspond with current state of the code.
 *
 * Note that the symlink resolution is not *completely* iterative.
 * There is still a significant amount of tail- and mid- recursion in
 * the algorithm.  Also, note that <fs>_readlink() is not used in
 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
 * may return different results than <fs>_follow_link().  Many virtual
 * filesystems (including /proc) exhibit this behavior.
 */

/* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
 * and the name already exists in form of a symlink, try to create the new
 * name indicated by the symlink. The old code always complained that the
 * name already exists, due to not following the symlink even if its target
 * is nonexistent.  The new semantics affects also mknod() and link() when
L
Lucas De Marchi 已提交
80
 * the name is a symlink pointing to a non-existent name.
L
Linus Torvalds 已提交
81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112
 *
 * I don't know which semantics is the right one, since I have no access
 * to standards. But I found by trial that HP-UX 9.0 has the full "new"
 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
 * "old" one. Personally, I think the new semantics is much more logical.
 * Note that "ln old new" where "new" is a symlink pointing to a non-existing
 * file does succeed in both HP-UX and SunOs, but not in Solaris
 * and in the old Linux semantics.
 */

/* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
 * semantics.  See the comments in "open_namei" and "do_link" below.
 *
 * [10-Sep-98 Alan Modra] Another symlink change.
 */

/* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
 *	inside the path - always follow.
 *	in the last component in creation/removal/renaming - never follow.
 *	if LOOKUP_FOLLOW passed - follow.
 *	if the pathname has trailing slashes - follow.
 *	otherwise - don't follow.
 * (applied in that order).
 *
 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
 * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
 * During the 2.4 we need to fix the userland stuff depending on it -
 * hopefully we will be able to get rid of that wart in 2.5. So far only
 * XEmacs seems to be relying on it...
 */
/*
 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
113
 * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
L
Linus Torvalds 已提交
114 115 116 117 118 119 120 121 122 123
 * any extra contention...
 */

/* In order to reduce some races, while at the same time doing additional
 * checking and hopefully speeding things up, we copy filenames to the
 * kernel data space before using them..
 *
 * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
 * PATH_MAX includes the nul terminator --RR.
 */
124

A
Al Viro 已提交
125
#define EMBEDDED_NAME_MAX	(PATH_MAX - offsetof(struct filename, iname))
126

127
struct filename *
128 129
getname_flags(const char __user *filename, int flags, int *empty)
{
130
	struct filename *result;
131
	char *kname;
132
	int len;
133

134 135 136 137
	result = audit_reusename(filename);
	if (result)
		return result;

138
	result = __getname();
139
	if (unlikely(!result))
140 141
		return ERR_PTR(-ENOMEM);

142 143 144 145
	/*
	 * First, try to embed the struct filename inside the names_cache
	 * allocation
	 */
A
Al Viro 已提交
146
	kname = (char *)result->iname;
147
	result->name = kname;
148

149
	len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
150
	if (unlikely(len < 0)) {
151 152
		__putname(result);
		return ERR_PTR(len);
153
	}
154

155 156 157 158 159 160
	/*
	 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
	 * separate struct filename so we can dedicate the entire
	 * names_cache allocation for the pathname, and re-do the copy from
	 * userland.
	 */
161
	if (unlikely(len == EMBEDDED_NAME_MAX)) {
A
Al Viro 已提交
162
		const size_t size = offsetof(struct filename, iname[1]);
163 164
		kname = (char *)result;

A
Al Viro 已提交
165 166 167 168 169 170
		/*
		 * size is chosen that way we to guarantee that
		 * result->iname[0] is within the same object and that
		 * kname can't be equal to result->iname, no matter what.
		 */
		result = kzalloc(size, GFP_KERNEL);
171 172 173
		if (unlikely(!result)) {
			__putname(kname);
			return ERR_PTR(-ENOMEM);
174 175
		}
		result->name = kname;
176 177 178 179 180 181 182 183 184 185 186
		len = strncpy_from_user(kname, filename, PATH_MAX);
		if (unlikely(len < 0)) {
			__putname(kname);
			kfree(result);
			return ERR_PTR(len);
		}
		if (unlikely(len == PATH_MAX)) {
			__putname(kname);
			kfree(result);
			return ERR_PTR(-ENAMETOOLONG);
		}
187 188
	}

189
	result->refcnt = 1;
190 191 192
	/* The empty path is special. */
	if (unlikely(!len)) {
		if (empty)
193
			*empty = 1;
194 195 196 197
		if (!(flags & LOOKUP_EMPTY)) {
			putname(result);
			return ERR_PTR(-ENOENT);
		}
L
Linus Torvalds 已提交
198
	}
199

200
	result->uptr = filename;
201
	result->aname = NULL;
202 203
	audit_getname(result);
	return result;
L
Linus Torvalds 已提交
204 205
}

206 207 208 209 210 211 212 213
struct filename *
getname_uflags(const char __user *filename, int uflags)
{
	int flags = (uflags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0;

	return getname_flags(filename, flags, NULL);
}

214 215
struct filename *
getname(const char __user * filename)
A
Al Viro 已提交
216
{
217
	return getname_flags(filename, 0, NULL);
A
Al Viro 已提交
218 219
}

220 221 222 223
struct filename *
getname_kernel(const char * filename)
{
	struct filename *result;
224
	int len = strlen(filename) + 1;
225 226 227 228 229

	result = __getname();
	if (unlikely(!result))
		return ERR_PTR(-ENOMEM);

230
	if (len <= EMBEDDED_NAME_MAX) {
A
Al Viro 已提交
231
		result->name = (char *)result->iname;
232
	} else if (len <= PATH_MAX) {
233
		const size_t size = offsetof(struct filename, iname[1]);
234 235
		struct filename *tmp;

236
		tmp = kmalloc(size, GFP_KERNEL);
237 238 239 240 241 242 243 244 245 246 247
		if (unlikely(!tmp)) {
			__putname(result);
			return ERR_PTR(-ENOMEM);
		}
		tmp->name = (char *)result;
		result = tmp;
	} else {
		__putname(result);
		return ERR_PTR(-ENAMETOOLONG);
	}
	memcpy((char *)result->name, filename, len);
248 249
	result->uptr = NULL;
	result->aname = NULL;
250
	result->refcnt = 1;
251
	audit_getname(result);
252 253 254 255

	return result;
}

256
void putname(struct filename *name)
L
Linus Torvalds 已提交
257
{
258
	if (IS_ERR(name))
259 260
		return;

261 262 263 264 265
	BUG_ON(name->refcnt <= 0);

	if (--name->refcnt > 0)
		return;

A
Al Viro 已提交
266
	if (name->name != name->iname) {
267 268 269 270
		__putname(name->name);
		kfree(name);
	} else
		__putname(name);
L
Linus Torvalds 已提交
271 272
}

273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290
/**
 * check_acl - perform ACL permission checking
 * @mnt_userns:	user namespace of the mount the inode was found from
 * @inode:	inode to check permissions on
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...)
 *
 * This function performs the ACL permission checking. Since this function
 * retrieve POSIX acls it needs to know whether it is called from a blocking or
 * non-blocking context and thus cares about the MAY_NOT_BLOCK bit.
 *
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
 */
static int check_acl(struct user_namespace *mnt_userns,
		     struct inode *inode, int mask)
291
{
292
#ifdef CONFIG_FS_POSIX_ACL
293 294 295
	struct posix_acl *acl;

	if (mask & MAY_NOT_BLOCK) {
296 297
		acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
	        if (!acl)
298
	                return -EAGAIN;
299
		/* no ->get_acl() calls in RCU mode... */
300
		if (is_uncached_acl(acl))
301
			return -ECHILD;
302
	        return posix_acl_permission(mnt_userns, inode, acl, mask);
303 304
	}

305 306 307
	acl = get_acl(inode, ACL_TYPE_ACCESS);
	if (IS_ERR(acl))
		return PTR_ERR(acl);
308
	if (acl) {
309
	        int error = posix_acl_permission(mnt_userns, inode, acl, mask);
310 311 312
	        posix_acl_release(acl);
	        return error;
	}
313
#endif
314 315 316 317

	return -EAGAIN;
}

318 319 320 321 322 323 324 325 326
/**
 * acl_permission_check - perform basic UNIX permission checking
 * @mnt_userns:	user namespace of the mount the inode was found from
 * @inode:	inode to check permissions on
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...)
 *
 * This function performs the basic UNIX permission checking. Since this
 * function may retrieve POSIX acls it needs to know whether it is called from a
 * blocking or non-blocking context and thus cares about the MAY_NOT_BLOCK bit.
327
 *
328 329 330 331 332
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
L
Linus Torvalds 已提交
333
 */
334 335
static int acl_permission_check(struct user_namespace *mnt_userns,
				struct inode *inode, int mask)
L
Linus Torvalds 已提交
336
{
337
	unsigned int mode = inode->i_mode;
338
	kuid_t i_uid;
L
Linus Torvalds 已提交
339

340
	/* Are we the owner? If so, ACL's don't matter */
341 342
	i_uid = i_uid_into_mnt(mnt_userns, inode);
	if (likely(uid_eq(current_fsuid(), i_uid))) {
343
		mask &= 7;
L
Linus Torvalds 已提交
344
		mode >>= 6;
345 346
		return (mask & ~mode) ? -EACCES : 0;
	}
L
Linus Torvalds 已提交
347

348 349
	/* Do we have ACL's? */
	if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
350
		int error = check_acl(mnt_userns, inode, mask);
351 352
		if (error != -EAGAIN)
			return error;
L
Linus Torvalds 已提交
353 354
	}

355 356 357
	/* Only RWX matters for group/other mode bits */
	mask &= 7;

L
Linus Torvalds 已提交
358
	/*
359 360 361
	 * Are the group permissions different from
	 * the other permissions in the bits we care
	 * about? Need to check group ownership if so.
L
Linus Torvalds 已提交
362
	 */
363
	if (mask & (mode ^ (mode >> 3))) {
364 365
		kgid_t kgid = i_gid_into_mnt(mnt_userns, inode);
		if (in_group_p(kgid))
366 367 368 369 370
			mode >>= 3;
	}

	/* Bits in 'mode' clear that we require? */
	return (mask & ~mode) ? -EACCES : 0;
371 372 373
}

/**
374
 * generic_permission -  check for access rights on a Posix-like filesystem
375
 * @mnt_userns:	user namespace of the mount the inode was found from
376
 * @inode:	inode to check access rights for
377 378
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC,
 *		%MAY_NOT_BLOCK ...)
379 380 381 382
 *
 * Used to check for read/write/execute permissions on a file.
 * We use "fsuid" for this, letting us set arbitrary permissions
 * for filesystem access without changing the "normal" uids which
383 384 385 386 387
 * are used for other things.
 *
 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
 * request cannot be satisfied (eg. requires blocking or too much complexity).
 * It would then be called again in ref-walk mode.
388 389 390 391 392 393
 *
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
394
 */
395 396
int generic_permission(struct user_namespace *mnt_userns, struct inode *inode,
		       int mask)
397 398 399 400
{
	int ret;

	/*
401
	 * Do the basic permission checks.
402
	 */
403
	ret = acl_permission_check(mnt_userns, inode, mask);
404 405
	if (ret != -EACCES)
		return ret;
L
Linus Torvalds 已提交
406

407 408 409
	if (S_ISDIR(inode->i_mode)) {
		/* DACs are overridable for directories */
		if (!(mask & MAY_WRITE))
410
			if (capable_wrt_inode_uidgid(mnt_userns, inode,
411
						     CAP_DAC_READ_SEARCH))
412
				return 0;
413
		if (capable_wrt_inode_uidgid(mnt_userns, inode,
414
					     CAP_DAC_OVERRIDE))
L
Linus Torvalds 已提交
415
			return 0;
416 417
		return -EACCES;
	}
L
Linus Torvalds 已提交
418 419 420 421

	/*
	 * Searching includes executable on directories, else just read.
	 */
422
	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
423
	if (mask == MAY_READ)
424
		if (capable_wrt_inode_uidgid(mnt_userns, inode,
425
					     CAP_DAC_READ_SEARCH))
L
Linus Torvalds 已提交
426
			return 0;
427 428 429 430 431 432
	/*
	 * Read/write DACs are always overridable.
	 * Executable DACs are overridable when there is
	 * at least one exec bit set.
	 */
	if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
433
		if (capable_wrt_inode_uidgid(mnt_userns, inode,
434
					     CAP_DAC_OVERRIDE))
435
			return 0;
L
Linus Torvalds 已提交
436 437 438

	return -EACCES;
}
439
EXPORT_SYMBOL(generic_permission);
L
Linus Torvalds 已提交
440

441 442 443 444 445 446
/**
 * do_inode_permission - UNIX permission checking
 * @mnt_userns:	user namespace of the mount the inode was found from
 * @inode:	inode to check permissions on
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...)
 *
447 448 449 450 451
 * We _really_ want to just do "generic_permission()" without
 * even looking at the inode->i_op values. So we keep a cache
 * flag in inode->i_opflags, that says "this has not special
 * permission function, use the fast case".
 */
452 453
static inline int do_inode_permission(struct user_namespace *mnt_userns,
				      struct inode *inode, int mask)
454 455 456
{
	if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
		if (likely(inode->i_op->permission))
457
			return inode->i_op->permission(mnt_userns, inode, mask);
458 459 460 461 462 463

		/* This gets set once for the inode lifetime */
		spin_lock(&inode->i_lock);
		inode->i_opflags |= IOP_FASTPERM;
		spin_unlock(&inode->i_lock);
	}
464
	return generic_permission(mnt_userns, inode, mask);
465 466
}

467 468 469
/**
 * sb_permission - Check superblock-level permissions
 * @sb: Superblock of inode to check permission on
470
 * @inode: Inode to check permission on
471 472 473 474 475 476 477 478 479 480
 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Separate out file-system wide checks from inode-specific permission checks.
 */
static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
{
	if (unlikely(mask & MAY_WRITE)) {
		umode_t mode = inode->i_mode;

		/* Nobody gets write access to a read-only fs. */
481
		if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
482 483 484 485 486 487 488
			return -EROFS;
	}
	return 0;
}

/**
 * inode_permission - Check for access rights to a given inode
489 490 491
 * @mnt_userns:	User namespace of the mount the inode was found from
 * @inode:	Inode to check permission on
 * @mask:	Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
492 493 494 495 496 497 498
 *
 * Check for read/write/execute permissions on an inode.  We use fs[ug]id for
 * this, letting us set arbitrary permissions for filesystem access without
 * changing the "normal" UIDs which are used for other things.
 *
 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
 */
499 500
int inode_permission(struct user_namespace *mnt_userns,
		     struct inode *inode, int mask)
501 502 503 504 505 506
{
	int retval;

	retval = sb_permission(inode->i_sb, inode, mask);
	if (retval)
		return retval;
507 508 509 510 511 512 513 514 515 516 517 518 519

	if (unlikely(mask & MAY_WRITE)) {
		/*
		 * Nobody gets write access to an immutable file.
		 */
		if (IS_IMMUTABLE(inode))
			return -EPERM;

		/*
		 * Updating mtime will likely cause i_uid and i_gid to be
		 * written back improperly if their true value is unknown
		 * to the vfs.
		 */
520
		if (HAS_UNMAPPED_ID(mnt_userns, inode))
521 522 523
			return -EACCES;
	}

524
	retval = do_inode_permission(mnt_userns, inode, mask);
525 526 527 528 529 530 531 532
	if (retval)
		return retval;

	retval = devcgroup_inode_permission(inode, mask);
	if (retval)
		return retval;

	return security_inode_permission(inode, mask);
533
}
534
EXPORT_SYMBOL(inode_permission);
535

J
Jan Blunck 已提交
536 537 538 539 540 541
/**
 * path_get - get a reference to a path
 * @path: path to get the reference to
 *
 * Given a path increment the reference count to the dentry and the vfsmount.
 */
542
void path_get(const struct path *path)
J
Jan Blunck 已提交
543 544 545 546 547 548
{
	mntget(path->mnt);
	dget(path->dentry);
}
EXPORT_SYMBOL(path_get);

J
Jan Blunck 已提交
549 550 551 552 553 554
/**
 * path_put - put a reference to a path
 * @path: path to put the reference to
 *
 * Given a path decrement the reference count to the dentry and the vfsmount.
 */
555
void path_put(const struct path *path)
L
Linus Torvalds 已提交
556
{
J
Jan Blunck 已提交
557 558
	dput(path->dentry);
	mntput(path->mnt);
L
Linus Torvalds 已提交
559
}
J
Jan Blunck 已提交
560
EXPORT_SYMBOL(path_put);
L
Linus Torvalds 已提交
561

562
#define EMBEDDED_LEVELS 2
563 564
struct nameidata {
	struct path	path;
A
Al Viro 已提交
565
	struct qstr	last;
566 567
	struct path	root;
	struct inode	*inode; /* path.dentry.d_inode */
568
	unsigned int	flags, state;
569
	unsigned	seq, m_seq, r_seq;
570 571
	int		last_type;
	unsigned	depth;
572
	int		total_link_count;
573 574
	struct saved {
		struct path link;
575
		struct delayed_call done;
576
		const char *name;
577
		unsigned seq;
578
	} *stack, internal[EMBEDDED_LEVELS];
579 580 581 582
	struct filename	*name;
	struct nameidata *saved;
	unsigned	root_seq;
	int		dfd;
583 584
	kuid_t		dir_uid;
	umode_t		dir_mode;
585
} __randomize_layout;
586

587 588 589 590
#define ND_ROOT_PRESET 1
#define ND_ROOT_GRABBED 2
#define ND_JUMPED 4

591
static void __set_nameidata(struct nameidata *p, int dfd, struct filename *name)
592
{
593 594
	struct nameidata *old = current->nameidata;
	p->stack = p->internal;
595
	p->depth = 0;
596 597
	p->dfd = dfd;
	p->name = name;
598 599
	p->path.mnt = NULL;
	p->path.dentry = NULL;
600
	p->total_link_count = old ? old->total_link_count : 0;
601
	p->saved = old;
602
	current->nameidata = p;
603 604
}

605 606 607 608 609 610 611 612 613 614 615
static inline void set_nameidata(struct nameidata *p, int dfd, struct filename *name,
			  const struct path *root)
{
	__set_nameidata(p, dfd, name);
	p->state = 0;
	if (unlikely(root)) {
		p->state = ND_ROOT_PRESET;
		p->root = *root;
	}
}

616
static void restore_nameidata(void)
617
{
618
	struct nameidata *now = current->nameidata, *old = now->saved;
619 620 621 622

	current->nameidata = old;
	if (old)
		old->total_link_count = now->total_link_count;
623
	if (now->stack != now->internal)
624
		kfree(now->stack);
625 626
}

627
static bool nd_alloc_stack(struct nameidata *nd)
628
{
629 630
	struct saved *p;

631 632 633 634
	p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
			 nd->flags & LOOKUP_RCU ? GFP_ATOMIC : GFP_KERNEL);
	if (unlikely(!p))
		return false;
635 636
	memcpy(p, nd->internal, sizeof(nd->internal));
	nd->stack = p;
637
	return true;
638 639
}

640
/**
641
 * path_connected - Verify that a dentry is below mnt.mnt_root
642 643 644 645
 *
 * Rename can sometimes move a file or directory outside of a bind
 * mount, path_connected allows those cases to be detected.
 */
646
static bool path_connected(struct vfsmount *mnt, struct dentry *dentry)
647
{
648
	struct super_block *sb = mnt->mnt_sb;
649

650 651
	/* Bind mounts can have disconnected paths */
	if (mnt->mnt_root == sb->s_root)
652 653
		return true;

654
	return is_subdir(dentry, mnt->mnt_root);
655 656
}

657 658 659 660 661
static void drop_links(struct nameidata *nd)
{
	int i = nd->depth;
	while (i--) {
		struct saved *last = nd->stack + i;
662 663
		do_delayed_call(&last->done);
		clear_delayed_call(&last->done);
664 665 666 667 668 669 670 671 672 673 674
	}
}

static void terminate_walk(struct nameidata *nd)
{
	drop_links(nd);
	if (!(nd->flags & LOOKUP_RCU)) {
		int i;
		path_put(&nd->path);
		for (i = 0; i < nd->depth; i++)
			path_put(&nd->stack[i].link);
675
		if (nd->state & ND_ROOT_GRABBED) {
676
			path_put(&nd->root);
677
			nd->state &= ~ND_ROOT_GRABBED;
678
		}
679 680 681 682 683
	} else {
		nd->flags &= ~LOOKUP_RCU;
		rcu_read_unlock();
	}
	nd->depth = 0;
684 685
	nd->path.mnt = NULL;
	nd->path.dentry = NULL;
686 687 688
}

/* path_put is needed afterwards regardless of success or failure */
689
static bool __legitimize_path(struct path *path, unsigned seq, unsigned mseq)
690
{
691
	int res = __legitimize_mnt(path->mnt, mseq);
692 693 694 695 696 697 698 699 700 701 702 703 704
	if (unlikely(res)) {
		if (res > 0)
			path->mnt = NULL;
		path->dentry = NULL;
		return false;
	}
	if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
		path->dentry = NULL;
		return false;
	}
	return !read_seqcount_retry(&path->dentry->d_seq, seq);
}

705 706 707
static inline bool legitimize_path(struct nameidata *nd,
			    struct path *path, unsigned seq)
{
708
	return __legitimize_path(path, seq, nd->m_seq);
709 710
}

711 712 713
static bool legitimize_links(struct nameidata *nd)
{
	int i;
714 715 716 717 718
	if (unlikely(nd->flags & LOOKUP_CACHED)) {
		drop_links(nd);
		nd->depth = 0;
		return false;
	}
719 720 721 722 723 724 725 726 727 728 729
	for (i = 0; i < nd->depth; i++) {
		struct saved *last = nd->stack + i;
		if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
			drop_links(nd);
			nd->depth = i + 1;
			return false;
		}
	}
	return true;
}

730 731
static bool legitimize_root(struct nameidata *nd)
{
732 733 734 735 736 737 738 739
	/*
	 * For scoped-lookups (where nd->root has been zeroed), we need to
	 * restart the whole lookup from scratch -- because set_root() is wrong
	 * for these lookups (nd->dfd is the root, not the filesystem root).
	 */
	if (!nd->root.mnt && (nd->flags & LOOKUP_IS_SCOPED))
		return false;
	/* Nothing to do if nd->root is zero or is managed by the VFS user. */
740
	if (!nd->root.mnt || (nd->state & ND_ROOT_PRESET))
741
		return true;
742
	nd->state |= ND_ROOT_GRABBED;
743 744 745
	return legitimize_path(nd, &nd->root, nd->root_seq);
}

746
/*
747
 * Path walking has 2 modes, rcu-walk and ref-walk (see
748 749
 * Documentation/filesystems/path-lookup.txt).  In situations when we can't
 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
750
 * normal reference counts on dentries and vfsmounts to transition to ref-walk
751 752 753 754
 * mode.  Refcounts are grabbed at the last known good point before rcu-walk
 * got stuck, so ref-walk may continue from there. If this is not successful
 * (eg. a seqcount has changed), then failure is returned and it's up to caller
 * to restart the path walk from the beginning in ref-walk mode.
755 756 757
 */

/**
758
 * try_to_unlazy - try to switch to ref-walk mode.
759
 * @nd: nameidata pathwalk data
760
 * Returns: true on success, false on failure
761
 *
762
 * try_to_unlazy attempts to legitimize the current nd->path and nd->root
A
Al Viro 已提交
763 764
 * for ref-walk mode.
 * Must be called from rcu-walk context.
765
 * Nothing should touch nameidata between try_to_unlazy() failure and
766
 * terminate_walk().
767
 */
768
static bool try_to_unlazy(struct nameidata *nd)
769 770 771 772
{
	struct dentry *parent = nd->path.dentry;

	BUG_ON(!(nd->flags & LOOKUP_RCU));
773

A
Al Viro 已提交
774 775 776
	nd->flags &= ~LOOKUP_RCU;
	if (unlikely(!legitimize_links(nd)))
		goto out1;
777 778
	if (unlikely(!legitimize_path(nd, &nd->path, nd->seq)))
		goto out;
779 780
	if (unlikely(!legitimize_root(nd)))
		goto out;
A
Al Viro 已提交
781 782
	rcu_read_unlock();
	BUG_ON(nd->inode != parent->d_inode);
783
	return true;
A
Al Viro 已提交
784

785
out1:
A
Al Viro 已提交
786 787 788 789
	nd->path.mnt = NULL;
	nd->path.dentry = NULL;
out:
	rcu_read_unlock();
790
	return false;
A
Al Viro 已提交
791 792 793
}

/**
794
 * try_to_unlazy_next - try to switch to ref-walk mode.
A
Al Viro 已提交
795
 * @nd: nameidata pathwalk data
796 797 798
 * @dentry: next dentry to step into
 * @seq: seq number to check @dentry against
 * Returns: true on success, false on failure
A
Al Viro 已提交
799
 *
800 801 802 803
 * Similar to to try_to_unlazy(), but here we have the next dentry already
 * picked by rcu-walk and want to legitimize that in addition to the current
 * nd->path and nd->root for ref-walk mode.  Must be called from rcu-walk context.
 * Nothing should touch nameidata between try_to_unlazy_next() failure and
A
Al Viro 已提交
804 805
 * terminate_walk().
 */
806
static bool try_to_unlazy_next(struct nameidata *nd, struct dentry *dentry, unsigned seq)
A
Al Viro 已提交
807 808 809
{
	BUG_ON(!(nd->flags & LOOKUP_RCU));

810
	nd->flags &= ~LOOKUP_RCU;
811 812 813 814
	if (unlikely(!legitimize_links(nd)))
		goto out2;
	if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq)))
		goto out2;
A
Al Viro 已提交
815
	if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref)))
816
		goto out1;
A
Al Viro 已提交
817

818
	/*
A
Al Viro 已提交
819 820 821 822 823
	 * We need to move both the parent and the dentry from the RCU domain
	 * to be properly refcounted. And the sequence number in the dentry
	 * validates *both* dentry counters, since we checked the sequence
	 * number of the parent after we got the child sequence number. So we
	 * know the parent must still be valid if the child sequence number is
824
	 */
A
Al Viro 已提交
825 826
	if (unlikely(!lockref_get_not_dead(&dentry->d_lockref)))
		goto out;
827 828
	if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
		goto out_dput;
829 830 831 832
	/*
	 * Sequence counts matched. Now make sure that the root is
	 * still valid and get it if required.
	 */
833 834
	if (unlikely(!legitimize_root(nd)))
		goto out_dput;
835
	rcu_read_unlock();
836
	return true;
837

838 839 840 841
out2:
	nd->path.mnt = NULL;
out1:
	nd->path.dentry = NULL;
842
out:
843
	rcu_read_unlock();
844
	return false;
845 846 847
out_dput:
	rcu_read_unlock();
	dput(dentry);
848
	return false;
849 850
}

851
static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
852
{
853 854 855 856
	if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
		return dentry->d_op->d_revalidate(dentry, flags);
	else
		return 1;
857 858
}

859 860 861
/**
 * complete_walk - successful completion of path walk
 * @nd:  pointer nameidata
862
 *
863 864 865 866 867
 * If we had been in RCU mode, drop out of it and legitimize nd->path.
 * Revalidate the final result, unless we'd already done that during
 * the path walk or the filesystem doesn't ask for it.  Return 0 on
 * success, -error on failure.  In case of failure caller does not
 * need to drop nd->path.
868
 */
869
static int complete_walk(struct nameidata *nd)
870
{
871
	struct dentry *dentry = nd->path.dentry;
872 873
	int status;

874
	if (nd->flags & LOOKUP_RCU) {
875 876 877 878
		/*
		 * We don't want to zero nd->root for scoped-lookups or
		 * externally-managed nd->root.
		 */
879 880 881
		if (!(nd->state & ND_ROOT_PRESET))
			if (!(nd->flags & LOOKUP_IS_SCOPED))
				nd->root.mnt = NULL;
882
		nd->flags &= ~LOOKUP_CACHED;
883
		if (!try_to_unlazy(nd))
884 885 886
			return -ECHILD;
	}

887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907
	if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
		/*
		 * While the guarantee of LOOKUP_IS_SCOPED is (roughly) "don't
		 * ever step outside the root during lookup" and should already
		 * be guaranteed by the rest of namei, we want to avoid a namei
		 * BUG resulting in userspace being given a path that was not
		 * scoped within the root at some point during the lookup.
		 *
		 * So, do a final sanity-check to make sure that in the
		 * worst-case scenario (a complete bypass of LOOKUP_IS_SCOPED)
		 * we won't silently return an fd completely outside of the
		 * requested root to userspace.
		 *
		 * Userspace could move the path outside the root after this
		 * check, but as discussed elsewhere this is not a concern (the
		 * resolved file was inside the root at some point).
		 */
		if (!path_is_under(&nd->path, &nd->root))
			return -EXDEV;
	}

908
	if (likely(!(nd->state & ND_JUMPED)))
909 910
		return 0;

911
	if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
912 913
		return 0;

914
	status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
915 916 917
	if (status > 0)
		return 0;

918
	if (!status)
919
		status = -ESTALE;
920

921 922 923
	return status;
}

924
static int set_root(struct nameidata *nd)
925
{
926
	struct fs_struct *fs = current->fs;
N
Nick Piggin 已提交
927

928 929 930 931 932 933 934 935
	/*
	 * Jumping to the real root in a scoped-lookup is a BUG in namei, but we
	 * still have to ensure it doesn't happen because it will cause a breakout
	 * from the dirfd.
	 */
	if (WARN_ON(nd->flags & LOOKUP_IS_SCOPED))
		return -ENOTRECOVERABLE;

936 937 938 939 940 941 942 943 944 945
	if (nd->flags & LOOKUP_RCU) {
		unsigned seq;

		do {
			seq = read_seqcount_begin(&fs->seq);
			nd->root = fs->root;
			nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
		} while (read_seqcount_retry(&fs->seq, seq));
	} else {
		get_fs_root(fs, &nd->root);
946
		nd->state |= ND_ROOT_GRABBED;
947
	}
948
	return 0;
949 950
}

951 952
static int nd_jump_root(struct nameidata *nd)
{
953 954
	if (unlikely(nd->flags & LOOKUP_BENEATH))
		return -EXDEV;
955 956 957 958 959
	if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
		/* Absolute path arguments to path_init() are allowed. */
		if (nd->path.mnt != NULL && nd->path.mnt != nd->root.mnt)
			return -EXDEV;
	}
960 961 962 963 964
	if (!nd->root.mnt) {
		int error = set_root(nd);
		if (error)
			return error;
	}
965 966 967 968 969 970 971 972 973 974 975 976 977 978
	if (nd->flags & LOOKUP_RCU) {
		struct dentry *d;
		nd->path = nd->root;
		d = nd->path.dentry;
		nd->inode = d->d_inode;
		nd->seq = nd->root_seq;
		if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq)))
			return -ECHILD;
	} else {
		path_put(&nd->path);
		nd->path = nd->root;
		path_get(&nd->path);
		nd->inode = nd->path.dentry->d_inode;
	}
979
	nd->state |= ND_JUMPED;
980 981 982
	return 0;
}

C
Christoph Hellwig 已提交
983
/*
984
 * Helper to directly jump to a known parsed path from ->get_link,
C
Christoph Hellwig 已提交
985 986
 * caller must have taken a reference to path beforehand.
 */
987
int nd_jump_link(struct path *path)
C
Christoph Hellwig 已提交
988
{
989
	int error = -ELOOP;
990
	struct nameidata *nd = current->nameidata;
C
Christoph Hellwig 已提交
991

992 993 994
	if (unlikely(nd->flags & LOOKUP_NO_MAGICLINKS))
		goto err;

995 996 997 998 999
	error = -EXDEV;
	if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
		if (nd->path.mnt != path->mnt)
			goto err;
	}
1000 1001 1002
	/* Not currently safe for scoped-lookups. */
	if (unlikely(nd->flags & LOOKUP_IS_SCOPED))
		goto err;
1003

1004
	path_put(&nd->path);
C
Christoph Hellwig 已提交
1005 1006
	nd->path = *path;
	nd->inode = nd->path.dentry->d_inode;
1007
	nd->state |= ND_JUMPED;
1008
	return 0;
1009 1010 1011 1012

err:
	path_put(path);
	return error;
C
Christoph Hellwig 已提交
1013 1014
}

1015
static inline void put_link(struct nameidata *nd)
1016
{
1017
	struct saved *last = nd->stack + --nd->depth;
1018
	do_delayed_call(&last->done);
1019 1020
	if (!(nd->flags & LOOKUP_RCU))
		path_put(&last->link);
1021 1022
}

1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033
static int sysctl_protected_symlinks __read_mostly;
static int sysctl_protected_hardlinks __read_mostly;
static int sysctl_protected_fifos __read_mostly;
static int sysctl_protected_regular __read_mostly;

#ifdef CONFIG_SYSCTL
static struct ctl_table namei_sysctls[] = {
	{
		.procname	= "protected_symlinks",
		.data		= &sysctl_protected_symlinks,
		.maxlen		= sizeof(int),
1034
		.mode		= 0644,
1035 1036 1037 1038 1039 1040 1041 1042
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= SYSCTL_ZERO,
		.extra2		= SYSCTL_ONE,
	},
	{
		.procname	= "protected_hardlinks",
		.data		= &sysctl_protected_hardlinks,
		.maxlen		= sizeof(int),
1043
		.mode		= 0644,
1044 1045 1046 1047 1048 1049 1050 1051
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= SYSCTL_ZERO,
		.extra2		= SYSCTL_ONE,
	},
	{
		.procname	= "protected_fifos",
		.data		= &sysctl_protected_fifos,
		.maxlen		= sizeof(int),
1052
		.mode		= 0644,
1053 1054 1055 1056 1057 1058 1059 1060
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= SYSCTL_ZERO,
		.extra2		= SYSCTL_TWO,
	},
	{
		.procname	= "protected_regular",
		.data		= &sysctl_protected_regular,
		.maxlen		= sizeof(int),
1061
		.mode		= 0644,
1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= SYSCTL_ZERO,
		.extra2		= SYSCTL_TWO,
	},
	{ }
};

static int __init init_fs_namei_sysctls(void)
{
	register_sysctl_init("fs", namei_sysctls);
	return 0;
}
fs_initcall(init_fs_namei_sysctls);

#endif /* CONFIG_SYSCTL */
K
Kees Cook 已提交
1077 1078 1079

/**
 * may_follow_link - Check symlink following for unsafe situations
1080
 * @nd: nameidata pathwalk data
K
Kees Cook 已提交
1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092
 *
 * In the case of the sysctl_protected_symlinks sysctl being enabled,
 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
 * in a sticky world-writable directory. This is to protect privileged
 * processes from failing races against path names that may change out
 * from under them by way of other users creating malicious symlinks.
 * It will permit symlinks to be followed only when outside a sticky
 * world-writable directory, or when the uid of the symlink and follower
 * match, or when the directory owner matches the symlink's owner.
 *
 * Returns 0 if following the symlink is allowed, -ve on error.
 */
1093
static inline int may_follow_link(struct nameidata *nd, const struct inode *inode)
K
Kees Cook 已提交
1094
{
1095 1096 1097
	struct user_namespace *mnt_userns;
	kuid_t i_uid;

K
Kees Cook 已提交
1098 1099 1100
	if (!sysctl_protected_symlinks)
		return 0;

1101 1102
	mnt_userns = mnt_user_ns(nd->path.mnt);
	i_uid = i_uid_into_mnt(mnt_userns, inode);
K
Kees Cook 已提交
1103
	/* Allowed if owner and follower match. */
1104
	if (uid_eq(current_cred()->fsuid, i_uid))
K
Kees Cook 已提交
1105 1106 1107
		return 0;

	/* Allowed if parent directory not sticky and world-writable. */
1108
	if ((nd->dir_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
K
Kees Cook 已提交
1109 1110 1111
		return 0;

	/* Allowed if parent directory and link owner match. */
1112
	if (uid_valid(nd->dir_uid) && uid_eq(nd->dir_uid, i_uid))
K
Kees Cook 已提交
1113 1114
		return 0;

1115 1116 1117
	if (nd->flags & LOOKUP_RCU)
		return -ECHILD;

1118
	audit_inode(nd->name, nd->stack[0].link.dentry, 0);
1119
	audit_log_path_denied(AUDIT_ANOM_LINK, "follow_link");
K
Kees Cook 已提交
1120 1121 1122 1123 1124
	return -EACCES;
}

/**
 * safe_hardlink_source - Check for safe hardlink conditions
1125
 * @mnt_userns:	user namespace of the mount the inode was found from
K
Kees Cook 已提交
1126 1127 1128 1129 1130 1131 1132 1133 1134 1135
 * @inode: the source inode to hardlink from
 *
 * Return false if at least one of the following conditions:
 *    - inode is not a regular file
 *    - inode is setuid
 *    - inode is setgid and group-exec
 *    - access failure for read and write
 *
 * Otherwise returns true.
 */
1136 1137
static bool safe_hardlink_source(struct user_namespace *mnt_userns,
				 struct inode *inode)
K
Kees Cook 已提交
1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153
{
	umode_t mode = inode->i_mode;

	/* Special files should not get pinned to the filesystem. */
	if (!S_ISREG(mode))
		return false;

	/* Setuid files should not get pinned to the filesystem. */
	if (mode & S_ISUID)
		return false;

	/* Executable setgid files should not get pinned to the filesystem. */
	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
		return false;

	/* Hardlinking to unreadable or unwritable sources is dangerous. */
1154
	if (inode_permission(mnt_userns, inode, MAY_READ | MAY_WRITE))
K
Kees Cook 已提交
1155 1156 1157 1158 1159 1160 1161
		return false;

	return true;
}

/**
 * may_linkat - Check permissions for creating a hardlink
1162
 * @mnt_userns:	user namespace of the mount the inode was found from
K
Kees Cook 已提交
1163 1164 1165 1166 1167 1168
 * @link: the source to hardlink from
 *
 * Block hardlink when all of:
 *  - sysctl_protected_hardlinks enabled
 *  - fsuid does not match inode
 *  - hardlink source is unsafe (see safe_hardlink_source() above)
1169
 *  - not CAP_FOWNER in a namespace with the inode owner uid mapped
K
Kees Cook 已提交
1170
 *
1171 1172 1173 1174 1175 1176
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
 *
K
Kees Cook 已提交
1177 1178
 * Returns 0 if successful, -ve on error.
 */
1179
int may_linkat(struct user_namespace *mnt_userns, struct path *link)
K
Kees Cook 已提交
1180
{
1181 1182 1183
	struct inode *inode = link->dentry->d_inode;

	/* Inode writeback is not safe when the uid or gid are invalid. */
1184 1185
	if (!uid_valid(i_uid_into_mnt(mnt_userns, inode)) ||
	    !gid_valid(i_gid_into_mnt(mnt_userns, inode)))
1186
		return -EOVERFLOW;
K
Kees Cook 已提交
1187 1188 1189 1190 1191 1192 1193

	if (!sysctl_protected_hardlinks)
		return 0;

	/* Source inode owner (or CAP_FOWNER) can hardlink all they like,
	 * otherwise, it must be a safe source.
	 */
1194 1195
	if (safe_hardlink_source(mnt_userns, inode) ||
	    inode_owner_or_capable(mnt_userns, inode))
K
Kees Cook 已提交
1196 1197
		return 0;

1198
	audit_log_path_denied(AUDIT_ANOM_LINK, "linkat");
K
Kees Cook 已提交
1199 1200 1201
	return -EPERM;
}

1202 1203 1204 1205
/**
 * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
 *			  should be allowed, or not, on files that already
 *			  exist.
1206
 * @mnt_userns:	user namespace of the mount the inode was found from
1207
 * @nd: nameidata pathwalk data
1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220
 * @inode: the inode of the file to open
 *
 * Block an O_CREAT open of a FIFO (or a regular file) when:
 *   - sysctl_protected_fifos (or sysctl_protected_regular) is enabled
 *   - the file already exists
 *   - we are in a sticky directory
 *   - we don't own the file
 *   - the owner of the directory doesn't own the file
 *   - the directory is world writable
 * If the sysctl_protected_fifos (or sysctl_protected_regular) is set to 2
 * the directory doesn't have to be world writable: being group writable will
 * be enough.
 *
1221 1222 1223 1224 1225 1226
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
 *
1227 1228
 * Returns 0 if the open is allowed, -ve on error.
 */
1229 1230
static int may_create_in_sticky(struct user_namespace *mnt_userns,
				struct nameidata *nd, struct inode *const inode)
1231
{
1232 1233 1234
	umode_t dir_mode = nd->dir_mode;
	kuid_t dir_uid = nd->dir_uid;

1235 1236
	if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
	    (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
1237
	    likely(!(dir_mode & S_ISVTX)) ||
1238 1239
	    uid_eq(i_uid_into_mnt(mnt_userns, inode), dir_uid) ||
	    uid_eq(current_fsuid(), i_uid_into_mnt(mnt_userns, inode)))
1240 1241
		return 0;

1242 1243
	if (likely(dir_mode & 0002) ||
	    (dir_mode & 0020 &&
1244 1245
	     ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
	      (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
1246 1247 1248 1249
		const char *operation = S_ISFIFO(inode->i_mode) ?
					"sticky_create_fifo" :
					"sticky_create_regular";
		audit_log_path_denied(AUDIT_ANOM_CREAT, operation);
1250 1251 1252 1253 1254
		return -EACCES;
	}
	return 0;
}

1255 1256 1257 1258 1259 1260 1261 1262 1263 1264
/*
 * follow_up - Find the mountpoint of path's vfsmount
 *
 * Given a path, find the mountpoint of its source file system.
 * Replace @path with the path of the mountpoint in the parent mount.
 * Up is towards /.
 *
 * Return 1 if we went up a level and 0 if we were already at the
 * root.
 */
1265
int follow_up(struct path *path)
L
Linus Torvalds 已提交
1266
{
1267 1268
	struct mount *mnt = real_mount(path->mnt);
	struct mount *parent;
L
Linus Torvalds 已提交
1269
	struct dentry *mountpoint;
N
Nick Piggin 已提交
1270

A
Al Viro 已提交
1271
	read_seqlock_excl(&mount_lock);
1272
	parent = mnt->mnt_parent;
A
Al Viro 已提交
1273
	if (parent == mnt) {
A
Al Viro 已提交
1274
		read_sequnlock_excl(&mount_lock);
L
Linus Torvalds 已提交
1275 1276
		return 0;
	}
1277
	mntget(&parent->mnt);
1278
	mountpoint = dget(mnt->mnt_mountpoint);
A
Al Viro 已提交
1279
	read_sequnlock_excl(&mount_lock);
1280 1281 1282
	dput(path->dentry);
	path->dentry = mountpoint;
	mntput(path->mnt);
1283
	path->mnt = &parent->mnt;
L
Linus Torvalds 已提交
1284 1285
	return 1;
}
1286
EXPORT_SYMBOL(follow_up);
L
Linus Torvalds 已提交
1287

1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307
static bool choose_mountpoint_rcu(struct mount *m, const struct path *root,
				  struct path *path, unsigned *seqp)
{
	while (mnt_has_parent(m)) {
		struct dentry *mountpoint = m->mnt_mountpoint;

		m = m->mnt_parent;
		if (unlikely(root->dentry == mountpoint &&
			     root->mnt == &m->mnt))
			break;
		if (mountpoint != m->mnt.mnt_root) {
			path->mnt = &m->mnt;
			path->dentry = mountpoint;
			*seqp = read_seqcount_begin(&mountpoint->d_seq);
			return true;
		}
	}
	return false;
}

1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332
static bool choose_mountpoint(struct mount *m, const struct path *root,
			      struct path *path)
{
	bool found;

	rcu_read_lock();
	while (1) {
		unsigned seq, mseq = read_seqbegin(&mount_lock);

		found = choose_mountpoint_rcu(m, root, path, &seq);
		if (unlikely(!found)) {
			if (!read_seqretry(&mount_lock, mseq))
				break;
		} else {
			if (likely(__legitimize_path(path, seq, mseq)))
				break;
			rcu_read_unlock();
			path_put(path);
			rcu_read_lock();
		}
	}
	rcu_read_unlock();
	return found;
}

1333
/*
1334 1335 1336
 * Perform an automount
 * - return -EISDIR to tell follow_managed() to stop and return the path we
 *   were called with.
L
Linus Torvalds 已提交
1337
 */
1338
static int follow_automount(struct path *path, int *count, unsigned lookup_flags)
1339
{
1340
	struct dentry *dentry = path->dentry;
1341

1342 1343 1344 1345 1346 1347 1348 1349 1350 1351
	/* We don't want to mount if someone's just doing a stat -
	 * unless they're stat'ing a directory and appended a '/' to
	 * the name.
	 *
	 * We do, however, want to mount if someone wants to open or
	 * create a file of any type under the mountpoint, wants to
	 * traverse through the mountpoint or wants to open the
	 * mounted directory.  Also, autofs may mark negative dentries
	 * as being automount points.  These will need the attentions
	 * of the daemon to instantiate them before they can be used.
1352
	 */
1353
	if (!(lookup_flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
1354
			   LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
1355
	    dentry->d_inode)
1356
		return -EISDIR;
1357

1358
	if (count && (*count)++ >= MAXSYMLINKS)
1359 1360
		return -ELOOP;

1361
	return finish_automount(dentry->d_op->d_automount(path), path);
A
Al Viro 已提交
1362 1363
}

1364
/*
A
Al Viro 已提交
1365 1366 1367 1368
 * mount traversal - out-of-line part.  One note on ->d_flags accesses -
 * dentries are pinned but not locked here, so negative dentry can go
 * positive right under us.  Use of smp_load_acquire() provides a barrier
 * sufficient for ->d_inode and ->d_flags consistency.
1369
 */
A
Al Viro 已提交
1370 1371
static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped,
			     int *count, unsigned lookup_flags)
L
Linus Torvalds 已提交
1372
{
A
Al Viro 已提交
1373
	struct vfsmount *mnt = path->mnt;
1374
	bool need_mntput = false;
1375
	int ret = 0;
1376

A
Al Viro 已提交
1377
	while (flags & DCACHE_MANAGED_DENTRY) {
1378 1379
		/* Allow the filesystem to manage the transit without i_mutex
		 * being held. */
1380
		if (flags & DCACHE_MANAGE_TRANSIT) {
1381
			ret = path->dentry->d_op->d_manage(path, false);
1382
			flags = smp_load_acquire(&path->dentry->d_flags);
1383
			if (ret < 0)
1384
				break;
1385 1386
		}

A
Al Viro 已提交
1387
		if (flags & DCACHE_MOUNTED) {	// something's mounted on it..
1388
			struct vfsmount *mounted = lookup_mnt(path);
A
Al Viro 已提交
1389
			if (mounted) {		// ... in our namespace
1390 1391 1392 1393 1394
				dput(path->dentry);
				if (need_mntput)
					mntput(path->mnt);
				path->mnt = mounted;
				path->dentry = dget(mounted->mnt_root);
A
Al Viro 已提交
1395 1396
				// here we know it's positive
				flags = path->dentry->d_flags;
1397 1398 1399 1400 1401
				need_mntput = true;
				continue;
			}
		}

A
Al Viro 已提交
1402 1403
		if (!(flags & DCACHE_NEED_AUTOMOUNT))
			break;
1404

A
Al Viro 已提交
1405 1406 1407 1408 1409
		// uncovered automount point
		ret = follow_automount(path, count, lookup_flags);
		flags = smp_load_acquire(&path->dentry->d_flags);
		if (ret < 0)
			break;
L
Linus Torvalds 已提交
1410
	}
1411

A
Al Viro 已提交
1412 1413 1414 1415 1416 1417
	if (ret == -EISDIR)
		ret = 0;
	// possible if you race with several mount --move
	if (need_mntput && path->mnt == mnt)
		mntput(path->mnt);
	if (!ret && unlikely(d_flags_negative(flags)))
1418
		ret = -ENOENT;
A
Al Viro 已提交
1419
	*jumped = need_mntput;
1420
	return ret;
L
Linus Torvalds 已提交
1421 1422
}

A
Al Viro 已提交
1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437
static inline int traverse_mounts(struct path *path, bool *jumped,
				  int *count, unsigned lookup_flags)
{
	unsigned flags = smp_load_acquire(&path->dentry->d_flags);

	/* fastpath */
	if (likely(!(flags & DCACHE_MANAGED_DENTRY))) {
		*jumped = false;
		if (unlikely(d_flags_negative(flags)))
			return -ENOENT;
		return 0;
	}
	return __traverse_mounts(path, flags, jumped, count, lookup_flags);
}

1438
int follow_down_one(struct path *path)
L
Linus Torvalds 已提交
1439 1440 1441
{
	struct vfsmount *mounted;

A
Al Viro 已提交
1442
	mounted = lookup_mnt(path);
L
Linus Torvalds 已提交
1443
	if (mounted) {
A
Al Viro 已提交
1444 1445 1446 1447
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
L
Linus Torvalds 已提交
1448 1449 1450 1451
		return 1;
	}
	return 0;
}
1452
EXPORT_SYMBOL(follow_down_one);
L
Linus Torvalds 已提交
1453

A
Al Viro 已提交
1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470
/*
 * Follow down to the covering mount currently visible to userspace.  At each
 * point, the filesystem owning that dentry may be queried as to whether the
 * caller is permitted to proceed or not.
 */
int follow_down(struct path *path)
{
	struct vfsmount *mnt = path->mnt;
	bool jumped;
	int ret = traverse_mounts(path, &jumped, NULL, 0);

	if (path->mnt != mnt)
		mntput(mnt);
	return ret;
}
EXPORT_SYMBOL(follow_down);

1471
/*
1472 1473
 * Try to skip to top of mountpoint pile in rcuwalk mode.  Fail if
 * we meet a managed dentry that would need blocking.
1474 1475
 */
static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1476
			       struct inode **inode, unsigned *seqp)
1477
{
1478 1479 1480 1481 1482 1483 1484 1485 1486
	struct dentry *dentry = path->dentry;
	unsigned int flags = dentry->d_flags;

	if (likely(!(flags & DCACHE_MANAGED_DENTRY)))
		return true;

	if (unlikely(nd->flags & LOOKUP_NO_XDEV))
		return false;

1487 1488 1489 1490 1491
	for (;;) {
		/*
		 * Don't forget we might have a non-mountpoint managed dentry
		 * that wants to block transit.
		 */
1492 1493 1494 1495 1496
		if (unlikely(flags & DCACHE_MANAGE_TRANSIT)) {
			int res = dentry->d_op->d_manage(path, true);
			if (res)
				return res == -EISDIR;
			flags = dentry->d_flags;
1497
		}
1498

1499 1500 1501 1502 1503
		if (flags & DCACHE_MOUNTED) {
			struct mount *mounted = __lookup_mnt(path->mnt, dentry);
			if (mounted) {
				path->mnt = &mounted->mnt;
				dentry = path->dentry = mounted->mnt.mnt_root;
1504
				nd->state |= ND_JUMPED;
1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519
				*seqp = read_seqcount_begin(&dentry->d_seq);
				*inode = dentry->d_inode;
				/*
				 * We don't need to re-check ->d_seq after this
				 * ->d_inode read - there will be an RCU delay
				 * between mount hash removal and ->mnt_root
				 * becoming unpinned.
				 */
				flags = dentry->d_flags;
				continue;
			}
			if (read_seqretry(&mount_lock, nd->m_seq))
				return false;
		}
		return !(flags & DCACHE_NEED_AUTOMOUNT);
1520
	}
1521 1522
}

1523 1524 1525
static inline int handle_mounts(struct nameidata *nd, struct dentry *dentry,
			  struct path *path, struct inode **inode,
			  unsigned int *seqp)
1526
{
A
Al Viro 已提交
1527
	bool jumped;
1528
	int ret;
1529

1530 1531
	path->mnt = nd->path.mnt;
	path->dentry = dentry;
1532 1533 1534 1535 1536
	if (nd->flags & LOOKUP_RCU) {
		unsigned int seq = *seqp;
		if (unlikely(!*inode))
			return -ENOENT;
		if (likely(__follow_mount_rcu(nd, path, inode, seqp)))
A
Al Viro 已提交
1537
			return 0;
1538
		if (!try_to_unlazy_next(nd, dentry, seq))
1539 1540 1541 1542 1543
			return -ECHILD;
		// *path might've been clobbered by __follow_mount_rcu()
		path->mnt = nd->path.mnt;
		path->dentry = dentry;
	}
A
Al Viro 已提交
1544 1545 1546 1547 1548
	ret = traverse_mounts(path, &jumped, &nd->total_link_count, nd->flags);
	if (jumped) {
		if (unlikely(nd->flags & LOOKUP_NO_XDEV))
			ret = -EXDEV;
		else
1549
			nd->state |= ND_JUMPED;
A
Al Viro 已提交
1550 1551 1552 1553 1554 1555
	}
	if (unlikely(ret)) {
		dput(path->dentry);
		if (path->mnt != nd->path.mnt)
			mntput(path->mnt);
	} else {
1556 1557 1558 1559 1560 1561
		*inode = d_backing_inode(path->dentry);
		*seqp = 0; /* out of RCU mode, so the value doesn't matter */
	}
	return ret;
}

1562
/*
1563 1564
 * This looks up the name in dcache and possibly revalidates the found dentry.
 * NULL is returned if the dentry does not exist in the cache.
1565
 */
1566 1567
static struct dentry *lookup_dcache(const struct qstr *name,
				    struct dentry *dir,
1568
				    unsigned int flags)
1569
{
1570
	struct dentry *dentry = d_lookup(dir, name);
M
Miklos Szeredi 已提交
1571
	if (dentry) {
1572 1573 1574 1575 1576 1577
		int error = d_revalidate(dentry, flags);
		if (unlikely(error <= 0)) {
			if (!error)
				d_invalidate(dentry);
			dput(dentry);
			return ERR_PTR(error);
M
Miklos Szeredi 已提交
1578 1579
		}
	}
1580 1581 1582
	return dentry;
}

1583
/*
1584 1585 1586 1587 1588
 * Parent directory has inode locked exclusive.  This is one
 * and only case when ->lookup() gets called on non in-lookup
 * dentries - as the matter of fact, this only gets called
 * when directory is guaranteed to have no in-lookup children
 * at all.
1589
 */
1590
static struct dentry *__lookup_hash(const struct qstr *name,
1591
		struct dentry *base, unsigned int flags)
1592
{
1593
	struct dentry *dentry = lookup_dcache(name, base, flags);
1594 1595
	struct dentry *old;
	struct inode *dir = base->d_inode;
1596

1597
	if (dentry)
M
Miklos Szeredi 已提交
1598
		return dentry;
1599

1600 1601 1602 1603
	/* Don't create child dentry for a dead directory. */
	if (unlikely(IS_DEADDIR(dir)))
		return ERR_PTR(-ENOENT);

1604 1605 1606 1607
	dentry = d_alloc(base, name);
	if (unlikely(!dentry))
		return ERR_PTR(-ENOMEM);

1608 1609 1610 1611 1612 1613
	old = dir->i_op->lookup(dir, dentry, flags);
	if (unlikely(old)) {
		dput(dentry);
		dentry = old;
	}
	return dentry;
1614 1615
}

1616 1617 1618
static struct dentry *lookup_fast(struct nameidata *nd,
				  struct inode **inode,
			          unsigned *seqp)
L
Linus Torvalds 已提交
1619
{
1620
	struct dentry *dentry, *parent = nd->path.dentry;
A
Al Viro 已提交
1621
	int status = 1;
1622

1623 1624
	/*
	 * Rename seqlock is not required here because in the off chance
A
Al Viro 已提交
1625 1626
	 * of a false negative due to a concurrent rename, the caller is
	 * going to fall back to non-racy lookup.
1627
	 */
1628 1629
	if (nd->flags & LOOKUP_RCU) {
		unsigned seq;
1630
		dentry = __d_lookup_rcu(parent, &nd->last, &seq);
A
Al Viro 已提交
1631
		if (unlikely(!dentry)) {
1632
			if (!try_to_unlazy(nd))
1633 1634
				return ERR_PTR(-ECHILD);
			return NULL;
A
Al Viro 已提交
1635
		}
A
Al Viro 已提交
1636

1637 1638 1639 1640
		/*
		 * This sequence count validates that the inode matches
		 * the dentry name information from lookup.
		 */
1641
		*inode = d_backing_inode(dentry);
A
Al Viro 已提交
1642
		if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
1643
			return ERR_PTR(-ECHILD);
1644 1645 1646 1647 1648 1649 1650 1651

		/*
		 * This sequence count validates that the parent had no
		 * changes while we did the lookup of the dentry above.
		 *
		 * The memory barrier in read_seqcount_begin of child is
		 *  enough, we can use __read_seqcount_retry here.
		 */
A
Al Viro 已提交
1652
		if (unlikely(__read_seqcount_retry(&parent->d_seq, nd->seq)))
1653
			return ERR_PTR(-ECHILD);
A
Al Viro 已提交
1654

1655
		*seqp = seq;
1656
		status = d_revalidate(dentry, nd->flags);
1657
		if (likely(status > 0))
1658
			return dentry;
1659
		if (!try_to_unlazy_next(nd, dentry, seq))
1660
			return ERR_PTR(-ECHILD);
1661
		if (status == -ECHILD)
1662 1663
			/* we'd been told to redo it in non-rcu mode */
			status = d_revalidate(dentry, nd->flags);
A
Al Viro 已提交
1664
	} else {
1665
		dentry = __d_lookup(parent, &nd->last);
A
Al Viro 已提交
1666
		if (unlikely(!dentry))
1667
			return NULL;
1668
		status = d_revalidate(dentry, nd->flags);
1669
	}
A
Al Viro 已提交
1670
	if (unlikely(status <= 0)) {
1671
		if (!status)
A
Al Viro 已提交
1672
			d_invalidate(dentry);
1673
		dput(dentry);
1674
		return ERR_PTR(status);
1675
	}
1676
	return dentry;
M
Miklos Szeredi 已提交
1677 1678 1679
}

/* Fast lookup failed, do it the slow way */
A
Al Viro 已提交
1680 1681 1682
static struct dentry *__lookup_slow(const struct qstr *name,
				    struct dentry *dir,
				    unsigned int flags)
M
Miklos Szeredi 已提交
1683
{
A
Al Viro 已提交
1684
	struct dentry *dentry, *old;
1685
	struct inode *inode = dir->d_inode;
1686
	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
1687 1688

	/* Don't go there if it's already dead */
1689
	if (unlikely(IS_DEADDIR(inode)))
A
Al Viro 已提交
1690
		return ERR_PTR(-ENOENT);
1691
again:
1692
	dentry = d_alloc_parallel(dir, name, &wq);
1693
	if (IS_ERR(dentry))
A
Al Viro 已提交
1694
		return dentry;
1695
	if (unlikely(!d_in_lookup(dentry))) {
1696 1697 1698 1699
		int error = d_revalidate(dentry, flags);
		if (unlikely(error <= 0)) {
			if (!error) {
				d_invalidate(dentry);
1700
				dput(dentry);
1701
				goto again;
1702
			}
1703 1704
			dput(dentry);
			dentry = ERR_PTR(error);
1705
		}
1706 1707 1708 1709 1710 1711
	} else {
		old = inode->i_op->lookup(inode, dentry, flags);
		d_lookup_done(dentry);
		if (unlikely(old)) {
			dput(dentry);
			dentry = old;
1712 1713
		}
	}
1714
	return dentry;
L
Linus Torvalds 已提交
1715 1716
}

A
Al Viro 已提交
1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728
static struct dentry *lookup_slow(const struct qstr *name,
				  struct dentry *dir,
				  unsigned int flags)
{
	struct inode *inode = dir->d_inode;
	struct dentry *res;
	inode_lock_shared(inode);
	res = __lookup_slow(name, dir, flags);
	inode_unlock_shared(inode);
	return res;
}

1729 1730
static inline int may_lookup(struct user_namespace *mnt_userns,
			     struct nameidata *nd)
1731 1732
{
	if (nd->flags & LOOKUP_RCU) {
1733
		int err = inode_permission(mnt_userns, nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1734
		if (err != -ECHILD || !try_to_unlazy(nd))
1735 1736
			return err;
	}
1737
	return inode_permission(mnt_userns, nd->inode, MAY_EXEC);
1738 1739
}

1740 1741 1742 1743
static int reserve_stack(struct nameidata *nd, struct path *link, unsigned seq)
{
	if (unlikely(nd->total_link_count++ >= MAXSYMLINKS))
		return -ELOOP;
1744 1745 1746 1747 1748

	if (likely(nd->depth != EMBEDDED_LEVELS))
		return 0;
	if (likely(nd->stack != nd->internal))
		return 0;
1749
	if (likely(nd_alloc_stack(nd)))
1750
		return 0;
1751 1752 1753 1754

	if (nd->flags & LOOKUP_RCU) {
		// we need to grab link before we do unlazy.  And we can't skip
		// unlazy even if we fail to grab the link - cleanup needs it
1755
		bool grabbed_link = legitimize_path(nd, link, seq);
1756

1757
		if (!try_to_unlazy(nd) != 0 || !grabbed_link)
1758 1759 1760 1761
			return -ECHILD;

		if (nd_alloc_stack(nd))
			return 0;
1762
	}
1763
	return -ENOMEM;
1764 1765
}

1766 1767
enum {WALK_TRAILING = 1, WALK_MORE = 2, WALK_NOFOLLOW = 4};

1768
static const char *pick_link(struct nameidata *nd, struct path *link,
1769
		     struct inode *inode, unsigned seq, int flags)
1770
{
A
Al Viro 已提交
1771
	struct saved *last;
1772
	const char *res;
1773
	int error = reserve_stack(nd, link, seq);
1774

1775
	if (unlikely(error)) {
1776
		if (!(nd->flags & LOOKUP_RCU))
1777
			path_put(link);
1778
		return ERR_PTR(error);
1779
	}
1780
	last = nd->stack + nd->depth++;
A
Al Viro 已提交
1781
	last->link = *link;
1782
	clear_delayed_call(&last->done);
1783
	last->seq = seq;
1784

1785
	if (flags & WALK_TRAILING) {
1786 1787 1788 1789 1790
		error = may_follow_link(nd, inode);
		if (unlikely(error))
			return ERR_PTR(error);
	}

1791 1792
	if (unlikely(nd->flags & LOOKUP_NO_SYMLINKS) ||
			unlikely(link->mnt->mnt_flags & MNT_NOSYMFOLLOW))
1793 1794 1795 1796 1797 1798
		return ERR_PTR(-ELOOP);

	if (!(nd->flags & LOOKUP_RCU)) {
		touch_atime(&last->link);
		cond_resched();
	} else if (atime_needs_update(&last->link, inode)) {
1799
		if (!try_to_unlazy(nd))
1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815
			return ERR_PTR(-ECHILD);
		touch_atime(&last->link);
	}

	error = security_inode_follow_link(link->dentry, inode,
					   nd->flags & LOOKUP_RCU);
	if (unlikely(error))
		return ERR_PTR(error);

	res = READ_ONCE(inode->i_link);
	if (!res) {
		const char * (*get)(struct dentry *, struct inode *,
				struct delayed_call *);
		get = inode->i_op->get_link;
		if (nd->flags & LOOKUP_RCU) {
			res = get(NULL, inode, &last->done);
1816
			if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd))
1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837
				res = get(link->dentry, inode, &last->done);
		} else {
			res = get(link->dentry, inode, &last->done);
		}
		if (!res)
			goto all_done;
		if (IS_ERR(res))
			return res;
	}
	if (*res == '/') {
		error = nd_jump_root(nd);
		if (unlikely(error))
			return ERR_PTR(error);
		while (unlikely(*++res == '/'))
			;
	}
	if (*res)
		return res;
all_done: // pure jump
	put_link(nd);
	return NULL;
1838 1839
}

1840 1841 1842 1843 1844 1845
/*
 * Do we need to follow links? We _really_ want to be able
 * to do this check without having to look at inode->i_op,
 * so we keep a cache of "no, this doesn't need follow_link"
 * for the common case.
 */
1846
static const char *step_into(struct nameidata *nd, int flags,
1847
		     struct dentry *dentry, struct inode *inode, unsigned seq)
1848
{
1849 1850 1851 1852
	struct path path;
	int err = handle_mounts(nd, dentry, &path, &inode, &seq);

	if (err < 0)
1853
		return ERR_PTR(err);
1854
	if (likely(!d_is_symlink(path.dentry)) ||
1855
	   ((flags & WALK_TRAILING) && !(nd->flags & LOOKUP_FOLLOW)) ||
1856
	   (flags & WALK_NOFOLLOW)) {
1857
		/* not a symlink or should not follow */
1858 1859 1860 1861 1862 1863
		if (!(nd->flags & LOOKUP_RCU)) {
			dput(nd->path.dentry);
			if (nd->path.mnt != path.mnt)
				mntput(nd->path.mnt);
		}
		nd->path = path;
1864 1865
		nd->inode = inode;
		nd->seq = seq;
1866
		return NULL;
1867
	}
1868
	if (nd->flags & LOOKUP_RCU) {
1869
		/* make sure that d_is_symlink above matches inode */
1870
		if (read_seqcount_retry(&path.dentry->d_seq, seq))
1871
			return ERR_PTR(-ECHILD);
1872 1873 1874
	} else {
		if (path.mnt == nd->path.mnt)
			mntget(path.mnt);
1875
	}
1876
	return pick_link(nd, &path, inode, seq, flags);
1877 1878
}

1879 1880 1881
static struct dentry *follow_dotdot_rcu(struct nameidata *nd,
					struct inode **inodep,
					unsigned *seqp)
1882
{
1883
	struct dentry *parent, *old;
1884

1885 1886 1887
	if (path_equal(&nd->path, &nd->root))
		goto in_root;
	if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
1888
		struct path path;
1889
		unsigned seq;
1890 1891 1892
		if (!choose_mountpoint_rcu(real_mount(nd->path.mnt),
					   &nd->root, &path, &seq))
			goto in_root;
1893 1894 1895 1896 1897 1898 1899 1900
		if (unlikely(nd->flags & LOOKUP_NO_XDEV))
			return ERR_PTR(-ECHILD);
		nd->path = path;
		nd->inode = path.dentry->d_inode;
		nd->seq = seq;
		if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
			return ERR_PTR(-ECHILD);
		/* we know that mountpoint was pinned */
1901
	}
1902 1903 1904 1905 1906 1907 1908 1909 1910 1911
	old = nd->path.dentry;
	parent = old->d_parent;
	*inodep = parent->d_inode;
	*seqp = read_seqcount_begin(&parent->d_seq);
	if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq)))
		return ERR_PTR(-ECHILD);
	if (unlikely(!path_connected(nd->path.mnt, parent)))
		return ERR_PTR(-ECHILD);
	return parent;
in_root:
1912 1913
	if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
		return ERR_PTR(-ECHILD);
1914 1915 1916
	if (unlikely(nd->flags & LOOKUP_BENEATH))
		return ERR_PTR(-ECHILD);
	return NULL;
1917 1918
}

1919 1920 1921
static struct dentry *follow_dotdot(struct nameidata *nd,
				 struct inode **inodep,
				 unsigned *seqp)
1922
{
1923 1924 1925 1926 1927
	struct dentry *parent;

	if (path_equal(&nd->path, &nd->root))
		goto in_root;
	if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
1928 1929 1930 1931 1932
		struct path path;

		if (!choose_mountpoint(real_mount(nd->path.mnt),
				       &nd->root, &path))
			goto in_root;
1933 1934
		path_put(&nd->path);
		nd->path = path;
1935
		nd->inode = path.dentry->d_inode;
1936 1937
		if (unlikely(nd->flags & LOOKUP_NO_XDEV))
			return ERR_PTR(-EXDEV);
1938
	}
1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949
	/* rare case of legitimate dget_parent()... */
	parent = dget_parent(nd->path.dentry);
	if (unlikely(!path_connected(nd->path.mnt, parent))) {
		dput(parent);
		return ERR_PTR(-ENOENT);
	}
	*seqp = 0;
	*inodep = parent->d_inode;
	return parent;

in_root:
1950 1951 1952 1953
	if (unlikely(nd->flags & LOOKUP_BENEATH))
		return ERR_PTR(-EXDEV);
	dget(nd->path.dentry);
	return NULL;
1954 1955
}

1956
static const char *handle_dots(struct nameidata *nd, int type)
1957 1958
{
	if (type == LAST_DOTDOT) {
1959
		const char *error = NULL;
1960 1961 1962
		struct dentry *parent;
		struct inode *inode;
		unsigned seq;
1963 1964

		if (!nd->root.mnt) {
1965
			error = ERR_PTR(set_root(nd));
1966 1967 1968 1969
			if (error)
				return error;
		}
		if (nd->flags & LOOKUP_RCU)
1970
			parent = follow_dotdot_rcu(nd, &inode, &seq);
1971
		else
1972 1973 1974 1975 1976 1977 1978 1979 1980 1981
			parent = follow_dotdot(nd, &inode, &seq);
		if (IS_ERR(parent))
			return ERR_CAST(parent);
		if (unlikely(!parent))
			error = step_into(nd, WALK_NOFOLLOW,
					 nd->path.dentry, nd->inode, nd->seq);
		else
			error = step_into(nd, WALK_NOFOLLOW,
					 parent, inode, seq);
		if (unlikely(error))
1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992
			return error;

		if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
			/*
			 * If there was a racing rename or mount along our
			 * path, then we can't be sure that ".." hasn't jumped
			 * above nd->root (and so userspace should retry or use
			 * some fallback).
			 */
			smp_rmb();
			if (unlikely(__read_seqcount_retry(&mount_lock.seqcount, nd->m_seq)))
1993
				return ERR_PTR(-EAGAIN);
1994
			if (unlikely(__read_seqcount_retry(&rename_lock.seqcount, nd->r_seq)))
1995
				return ERR_PTR(-EAGAIN);
1996 1997
		}
	}
1998
	return NULL;
1999 2000
}

2001
static const char *walk_component(struct nameidata *nd, int flags)
2002
{
2003
	struct dentry *dentry;
2004
	struct inode *inode;
2005
	unsigned seq;
2006 2007 2008 2009 2010
	/*
	 * "." and ".." are special - ".." especially so because it has
	 * to be able to know about the current root directory and
	 * parent relationships.
	 */
2011
	if (unlikely(nd->last_type != LAST_NORM)) {
A
Al Viro 已提交
2012
		if (!(flags & WALK_MORE) && nd->depth)
2013
			put_link(nd);
2014
		return handle_dots(nd, nd->last_type);
2015
	}
2016 2017
	dentry = lookup_fast(nd, &inode, &seq);
	if (IS_ERR(dentry))
2018
		return ERR_CAST(dentry);
2019
	if (unlikely(!dentry)) {
2020 2021
		dentry = lookup_slow(&nd->last, nd->path.dentry, nd->flags);
		if (IS_ERR(dentry))
2022
			return ERR_CAST(dentry);
2023
	}
2024 2025
	if (!(flags & WALK_MORE) && nd->depth)
		put_link(nd);
2026
	return step_into(nd, flags, dentry, inode, seq);
2027 2028
}

2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047
/*
 * We can do the critical dentry name comparison and hashing
 * operations one word at a time, but we are limited to:
 *
 * - Architectures with fast unaligned word accesses. We could
 *   do a "get_unaligned()" if this helps and is sufficiently
 *   fast.
 *
 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
 *   do not trap on the (extremely unlikely) case of a page
 *   crossing operation.
 *
 * - Furthermore, we need an efficient 64-bit compile for the
 *   64-bit case in order to generate the "number of bytes in
 *   the final mask". Again, that could be replaced with a
 *   efficient population count instruction or similar.
 */
#ifdef CONFIG_DCACHE_WORD_ACCESS

2048
#include <asm/word-at-a-time.h>
2049

2050
#ifdef HASH_MIX
2051

2052
/* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */
2053

2054
#elif defined(CONFIG_64BIT)
2055
/*
2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082
 * Register pressure in the mixing function is an issue, particularly
 * on 32-bit x86, but almost any function requires one state value and
 * one temporary.  Instead, use a function designed for two state values
 * and no temporaries.
 *
 * This function cannot create a collision in only two iterations, so
 * we have two iterations to achieve avalanche.  In those two iterations,
 * we have six layers of mixing, which is enough to spread one bit's
 * influence out to 2^6 = 64 state bits.
 *
 * Rotate constants are scored by considering either 64 one-bit input
 * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the
 * probability of that delta causing a change to each of the 128 output
 * bits, using a sample of random initial states.
 *
 * The Shannon entropy of the computed probabilities is then summed
 * to produce a score.  Ideally, any input change has a 50% chance of
 * toggling any given output bit.
 *
 * Mixing scores (in bits) for (12,45):
 * Input delta: 1-bit      2-bit
 * 1 round:     713.3    42542.6
 * 2 rounds:   2753.7   140389.8
 * 3 rounds:   5954.1   233458.2
 * 4 rounds:   7862.6   256672.2
 * Perfect:    8192     258048
 *            (64*128) (64*63/2 * 128)
2083
 */
2084 2085 2086 2087 2088
#define HASH_MIX(x, y, a)	\
	(	x ^= (a),	\
	y ^= x,	x = rol64(x,12),\
	x += y,	y = rol64(y,45),\
	y *= 9			)
2089

2090
/*
2091 2092 2093
 * Fold two longs into one 32-bit hash value.  This must be fast, but
 * latency isn't quite as critical, as there is a fair bit of additional
 * work done before the hash value is used.
2094
 */
2095
static inline unsigned int fold_hash(unsigned long x, unsigned long y)
2096
{
2097 2098 2099
	y ^= x * GOLDEN_RATIO_64;
	y *= GOLDEN_RATIO_64;
	return y >> 32;
2100 2101
}

2102 2103
#else	/* 32-bit case */

2104 2105 2106 2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118
/*
 * Mixing scores (in bits) for (7,20):
 * Input delta: 1-bit      2-bit
 * 1 round:     330.3     9201.6
 * 2 rounds:   1246.4    25475.4
 * 3 rounds:   1907.1    31295.1
 * 4 rounds:   2042.3    31718.6
 * Perfect:    2048      31744
 *            (32*64)   (32*31/2 * 64)
 */
#define HASH_MIX(x, y, a)	\
	(	x ^= (a),	\
	y ^= x,	x = rol32(x, 7),\
	x += y,	y = rol32(y,20),\
	y *= 9			)
2119

2120
static inline unsigned int fold_hash(unsigned long x, unsigned long y)
2121
{
2122 2123
	/* Use arch-optimized multiply if one exists */
	return __hash_32(y ^ __hash_32(x));
2124 2125
}

2126 2127
#endif

2128 2129 2130 2131 2132 2133 2134
/*
 * Return the hash of a string of known length.  This is carfully
 * designed to match hash_name(), which is the more critical function.
 * In particular, we must end by hashing a final word containing 0..7
 * payload bytes, to match the way that hash_name() iterates until it
 * finds the delimiter after the name.
 */
2135
unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2136
{
2137
	unsigned long a, x = 0, y = (unsigned long)salt;
2138 2139

	for (;;) {
2140 2141
		if (!len)
			goto done;
2142
		a = load_unaligned_zeropad(name);
2143 2144
		if (len < sizeof(unsigned long))
			break;
2145
		HASH_MIX(x, y, a);
2146 2147 2148
		name += sizeof(unsigned long);
		len -= sizeof(unsigned long);
	}
2149
	x ^= a & bytemask_from_count(len);
2150
done:
2151
	return fold_hash(x, y);
2152 2153 2154
}
EXPORT_SYMBOL(full_name_hash);

2155
/* Return the "hash_len" (hash and length) of a null-terminated string */
2156
u64 hashlen_string(const void *salt, const char *name)
2157
{
2158 2159
	unsigned long a = 0, x = 0, y = (unsigned long)salt;
	unsigned long adata, mask, len;
2160 2161
	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;

2162 2163 2164
	len = 0;
	goto inside;

2165
	do {
2166
		HASH_MIX(x, y, a);
2167
		len += sizeof(unsigned long);
2168
inside:
2169 2170 2171 2172 2173
		a = load_unaligned_zeropad(name+len);
	} while (!has_zero(a, &adata, &constants));

	adata = prep_zero_mask(a, adata, &constants);
	mask = create_zero_mask(adata);
2174
	x ^= a & zero_bytemask(mask);
2175

2176
	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2177 2178 2179
}
EXPORT_SYMBOL(hashlen_string);

2180 2181
/*
 * Calculate the length and hash of the path component, and
2182
 * return the "hash_len" as the result.
2183
 */
2184
static inline u64 hash_name(const void *salt, const char *name)
2185
{
2186 2187
	unsigned long a = 0, b, x = 0, y = (unsigned long)salt;
	unsigned long adata, bdata, mask, len;
2188
	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
2189

2190 2191 2192
	len = 0;
	goto inside;

2193
	do {
2194
		HASH_MIX(x, y, a);
2195
		len += sizeof(unsigned long);
2196
inside:
2197
		a = load_unaligned_zeropad(name+len);
2198 2199 2200 2201 2202 2203
		b = a ^ REPEAT_BYTE('/');
	} while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));

	adata = prep_zero_mask(a, adata, &constants);
	bdata = prep_zero_mask(b, bdata, &constants);
	mask = create_zero_mask(adata | bdata);
2204
	x ^= a & zero_bytemask(mask);
2205

2206
	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2207 2208
}

2209
#else	/* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */
2210

2211
/* Return the hash of a string of known length */
2212
unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2213
{
2214
	unsigned long hash = init_name_hash(salt);
2215
	while (len--)
2216
		hash = partial_name_hash((unsigned char)*name++, hash);
2217 2218
	return end_name_hash(hash);
}
2219
EXPORT_SYMBOL(full_name_hash);
2220

2221
/* Return the "hash_len" (hash and length) of a null-terminated string */
2222
u64 hashlen_string(const void *salt, const char *name)
2223
{
2224
	unsigned long hash = init_name_hash(salt);
2225 2226 2227
	unsigned long len = 0, c;

	c = (unsigned char)*name;
2228
	while (c) {
2229 2230 2231
		len++;
		hash = partial_name_hash(c, hash);
		c = (unsigned char)name[len];
2232
	}
2233 2234
	return hashlen_create(end_name_hash(hash), len);
}
2235
EXPORT_SYMBOL(hashlen_string);
2236

2237 2238 2239 2240
/*
 * We know there's a real path component here of at least
 * one character.
 */
2241
static inline u64 hash_name(const void *salt, const char *name)
2242
{
2243
	unsigned long hash = init_name_hash(salt);
2244 2245 2246 2247 2248 2249 2250 2251
	unsigned long len = 0, c;

	c = (unsigned char)*name;
	do {
		len++;
		hash = partial_name_hash(c, hash);
		c = (unsigned char)name[len];
	} while (c && c != '/');
2252
	return hashlen_create(end_name_hash(hash), len);
2253 2254
}

2255 2256
#endif

L
Linus Torvalds 已提交
2257 2258
/*
 * Name resolution.
2259 2260
 * This is the basic name resolution function, turning a pathname into
 * the final dentry. We expect 'base' to be positive and a directory.
L
Linus Torvalds 已提交
2261
 *
2262 2263
 * Returns 0 and nd will have valid dentry and mnt on success.
 * Returns error and drops reference to input namei data on failure.
L
Linus Torvalds 已提交
2264
 */
2265
static int link_path_walk(const char *name, struct nameidata *nd)
L
Linus Torvalds 已提交
2266
{
2267
	int depth = 0; // depth <= nd->depth
L
Linus Torvalds 已提交
2268
	int err;
2269

2270
	nd->last_type = LAST_ROOT;
2271
	nd->flags |= LOOKUP_PARENT;
2272 2273
	if (IS_ERR(name))
		return PTR_ERR(name);
L
Linus Torvalds 已提交
2274 2275
	while (*name=='/')
		name++;
2276 2277
	if (!*name) {
		nd->dir_mode = 0; // short-circuit the 'hardening' idiocy
2278
		return 0;
2279
	}
L
Linus Torvalds 已提交
2280 2281 2282

	/* At this point we know we have a real path component. */
	for(;;) {
2283
		struct user_namespace *mnt_userns;
2284
		const char *link;
2285
		u64 hash_len;
2286
		int type;
L
Linus Torvalds 已提交
2287

2288 2289
		mnt_userns = mnt_user_ns(nd->path.mnt);
		err = may_lookup(mnt_userns, nd);
2290
		if (err)
2291
			return err;
L
Linus Torvalds 已提交
2292

2293
		hash_len = hash_name(nd->path.dentry, name);
L
Linus Torvalds 已提交
2294

2295
		type = LAST_NORM;
2296
		if (name[0] == '.') switch (hashlen_len(hash_len)) {
2297
			case 2:
2298
				if (name[1] == '.') {
2299
					type = LAST_DOTDOT;
2300
					nd->state |= ND_JUMPED;
2301
				}
2302 2303 2304 2305
				break;
			case 1:
				type = LAST_DOT;
		}
2306 2307
		if (likely(type == LAST_NORM)) {
			struct dentry *parent = nd->path.dentry;
2308
			nd->state &= ~ND_JUMPED;
2309
			if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
2310
				struct qstr this = { { .hash_len = hash_len }, .name = name };
2311
				err = parent->d_op->d_hash(parent, &this);
2312
				if (err < 0)
2313
					return err;
2314 2315
				hash_len = this.hash_len;
				name = this.name;
2316 2317
			}
		}
2318

2319 2320
		nd->last.hash_len = hash_len;
		nd->last.name = name;
2321 2322
		nd->last_type = type;

2323 2324
		name += hashlen_len(hash_len);
		if (!*name)
2325
			goto OK;
2326 2327 2328 2329 2330
		/*
		 * If it wasn't NUL, we know it was '/'. Skip that
		 * slash, and continue until no more slashes.
		 */
		do {
2331 2332
			name++;
		} while (unlikely(*name == '/'));
2333 2334
		if (unlikely(!*name)) {
OK:
2335
			/* pathname or trailing symlink, done */
2336
			if (!depth) {
2337
				nd->dir_uid = i_uid_into_mnt(mnt_userns, nd->inode);
2338
				nd->dir_mode = nd->inode->i_mode;
2339
				nd->flags &= ~LOOKUP_PARENT;
2340
				return 0;
2341
			}
2342
			/* last component of nested symlink */
2343
			name = nd->stack[--depth].name;
2344
			link = walk_component(nd, 0);
A
Al Viro 已提交
2345 2346
		} else {
			/* not the last component */
2347
			link = walk_component(nd, WALK_MORE);
2348
		}
2349 2350 2351 2352
		if (unlikely(link)) {
			if (IS_ERR(link))
				return PTR_ERR(link);
			/* a symlink to follow */
2353
			nd->stack[depth++].name = name;
2354 2355
			name = link;
			continue;
2356
		}
2357 2358
		if (unlikely(!d_can_lookup(nd->path.dentry))) {
			if (nd->flags & LOOKUP_RCU) {
2359
				if (!try_to_unlazy(nd))
2360 2361
					return -ECHILD;
			}
2362
			return -ENOTDIR;
2363
		}
L
Linus Torvalds 已提交
2364 2365 2366
	}
}

2367
/* must be paired with terminate_walk() */
2368
static const char *path_init(struct nameidata *nd, unsigned flags)
2369
{
2370
	int error;
2371
	const char *s = nd->name->name;
2372

2373 2374 2375 2376
	/* LOOKUP_CACHED requires RCU, ask caller to retry */
	if ((flags & (LOOKUP_RCU | LOOKUP_CACHED)) == LOOKUP_CACHED)
		return ERR_PTR(-EAGAIN);

2377 2378
	if (!*s)
		flags &= ~LOOKUP_RCU;
2379 2380
	if (flags & LOOKUP_RCU)
		rcu_read_lock();
2381

2382 2383
	nd->flags = flags;
	nd->state |= ND_JUMPED;
2384 2385 2386 2387 2388

	nd->m_seq = __read_seqcount_begin(&mount_lock.seqcount);
	nd->r_seq = __read_seqcount_begin(&rename_lock.seqcount);
	smp_rmb();

2389
	if (nd->state & ND_ROOT_PRESET) {
2390 2391
		struct dentry *root = nd->root.dentry;
		struct inode *inode = root->d_inode;
2392 2393
		if (*s && unlikely(!d_can_lookup(root)))
			return ERR_PTR(-ENOTDIR);
2394 2395 2396
		nd->path = nd->root;
		nd->inode = inode;
		if (flags & LOOKUP_RCU) {
2397
			nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2398
			nd->root_seq = nd->seq;
2399 2400 2401
		} else {
			path_get(&nd->path);
		}
2402
		return s;
2403 2404
	}

2405 2406
	nd->root.mnt = NULL;

2407 2408
	/* Absolute pathname -- fetch the root (LOOKUP_IN_ROOT uses nd->dfd). */
	if (*s == '/' && !(flags & LOOKUP_IN_ROOT)) {
2409 2410 2411 2412
		error = nd_jump_root(nd);
		if (unlikely(error))
			return ERR_PTR(error);
		return s;
2413 2414 2415 2416
	}

	/* Relative pathname -- get the starting-point it is relative to. */
	if (nd->dfd == AT_FDCWD) {
2417 2418 2419
		if (flags & LOOKUP_RCU) {
			struct fs_struct *fs = current->fs;
			unsigned seq;
2420

2421 2422 2423
			do {
				seq = read_seqcount_begin(&fs->seq);
				nd->path = fs->pwd;
2424
				nd->inode = nd->path.dentry->d_inode;
2425 2426 2427 2428
				nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
			} while (read_seqcount_retry(&fs->seq, seq));
		} else {
			get_fs_pwd(current->fs, &nd->path);
2429
			nd->inode = nd->path.dentry->d_inode;
2430
		}
2431
	} else {
2432
		/* Caller must check execute permissions on the starting path component */
2433
		struct fd f = fdget_raw(nd->dfd);
2434 2435
		struct dentry *dentry;

2436
		if (!f.file)
2437
			return ERR_PTR(-EBADF);
2438

2439
		dentry = f.file->f_path.dentry;
2440

2441 2442 2443
		if (*s && unlikely(!d_can_lookup(dentry))) {
			fdput(f);
			return ERR_PTR(-ENOTDIR);
A
Al Viro 已提交
2444
		}
2445

2446
		nd->path = f.file->f_path;
2447
		if (flags & LOOKUP_RCU) {
2448 2449
			nd->inode = nd->path.dentry->d_inode;
			nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2450
		} else {
2451
			path_get(&nd->path);
2452
			nd->inode = nd->path.dentry->d_inode;
2453
		}
2454
		fdput(f);
2455
	}
2456

2457 2458 2459 2460 2461 2462 2463
	/* For scoped-lookups we need to set the root to the dirfd as well. */
	if (flags & LOOKUP_IS_SCOPED) {
		nd->root = nd->path;
		if (flags & LOOKUP_RCU) {
			nd->root_seq = nd->seq;
		} else {
			path_get(&nd->root);
2464
			nd->state |= ND_ROOT_GRABBED;
2465 2466 2467
		}
	}
	return s;
2468 2469
}

2470
static inline const char *lookup_last(struct nameidata *nd)
2471 2472 2473 2474
{
	if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
		nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;

2475
	return walk_component(nd, WALK_TRAILING);
2476 2477
}

2478 2479
static int handle_lookup_down(struct nameidata *nd)
{
2480
	if (!(nd->flags & LOOKUP_RCU))
2481
		dget(nd->path.dentry);
2482 2483
	return PTR_ERR(step_into(nd, WALK_NOFOLLOW,
			nd->path.dentry, nd->inode, nd->seq));
2484 2485
}

2486
/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
2487
static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2488
{
2489
	const char *s = path_init(nd, flags);
2490
	int err;
2491

2492
	if (unlikely(flags & LOOKUP_DOWN) && !IS_ERR(s)) {
2493
		err = handle_lookup_down(nd);
2494 2495
		if (unlikely(err < 0))
			s = ERR_PTR(err);
2496 2497
	}

2498 2499 2500
	while (!(err = link_path_walk(s, nd)) &&
	       (s = lookup_last(nd)) != NULL)
		;
2501 2502
	if (!err && unlikely(nd->flags & LOOKUP_MOUNTPOINT)) {
		err = handle_lookup_down(nd);
2503
		nd->state &= ~ND_JUMPED; // no d_weak_revalidate(), please...
2504
	}
2505 2506
	if (!err)
		err = complete_walk(nd);
2507

2508 2509
	if (!err && nd->flags & LOOKUP_DIRECTORY)
		if (!d_can_lookup(nd->path.dentry))
A
Al Viro 已提交
2510
			err = -ENOTDIR;
2511 2512 2513 2514 2515 2516
	if (!err) {
		*path = nd->path;
		nd->path.mnt = NULL;
		nd->path.dentry = NULL;
	}
	terminate_walk(nd);
2517
	return err;
A
Al Viro 已提交
2518
}
2519

2520
int filename_lookup(int dfd, struct filename *name, unsigned flags,
2521
		    struct path *path, struct path *root)
A
Al Viro 已提交
2522
{
2523
	int retval;
2524
	struct nameidata nd;
2525 2526
	if (IS_ERR(name))
		return PTR_ERR(name);
2527
	set_nameidata(&nd, dfd, name, root);
2528
	retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
A
Al Viro 已提交
2529
	if (unlikely(retval == -ECHILD))
2530
		retval = path_lookupat(&nd, flags, path);
A
Al Viro 已提交
2531
	if (unlikely(retval == -ESTALE))
2532
		retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
2533

2534
	if (likely(!retval))
2535 2536
		audit_inode(name, path->dentry,
			    flags & LOOKUP_MOUNTPOINT ? AUDIT_INODE_NOEVAL : 0);
2537
	restore_nameidata();
2538 2539 2540
	return retval;
}

2541
/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
2542
static int path_parentat(struct nameidata *nd, unsigned flags,
2543
				struct path *parent)
2544
{
2545
	const char *s = path_init(nd, flags);
2546
	int err = link_path_walk(s, nd);
2547 2548
	if (!err)
		err = complete_walk(nd);
2549 2550 2551 2552 2553 2554
	if (!err) {
		*parent = nd->path;
		nd->path.mnt = NULL;
		nd->path.dentry = NULL;
	}
	terminate_walk(nd);
2555 2556 2557
	return err;
}

2558
/* Note: this does not consume "name" */
2559
static int filename_parentat(int dfd, struct filename *name,
2560 2561
			     unsigned int flags, struct path *parent,
			     struct qstr *last, int *type)
2562 2563
{
	int retval;
2564
	struct nameidata nd;
2565

2566
	if (IS_ERR(name))
2567
		return PTR_ERR(name);
2568
	set_nameidata(&nd, dfd, name, NULL);
2569
	retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
2570
	if (unlikely(retval == -ECHILD))
2571
		retval = path_parentat(&nd, flags, parent);
2572
	if (unlikely(retval == -ESTALE))
2573
		retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
2574 2575 2576
	if (likely(!retval)) {
		*last = nd.last;
		*type = nd.last_type;
2577
		audit_inode(name, parent->dentry, AUDIT_INODE_PARENT);
2578
	}
2579
	restore_nameidata();
2580 2581 2582
	return retval;
}

A
Al Viro 已提交
2583
/* does lookup, returns the object with parent locked */
2584
static struct dentry *__kern_path_locked(struct filename *name, struct path *path)
2585
{
2586
	struct dentry *d;
2587
	struct qstr last;
2588
	int type, error;
2589

2590
	error = filename_parentat(AT_FDCWD, name, 0, path, &last, &type);
2591 2592
	if (error)
		return ERR_PTR(error);
2593
	if (unlikely(type != LAST_NORM)) {
2594
		path_put(path);
2595
		return ERR_PTR(-EINVAL);
A
Al Viro 已提交
2596
	}
A
Al Viro 已提交
2597
	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
2598
	d = __lookup_hash(&last, path->dentry, 0);
A
Al Viro 已提交
2599
	if (IS_ERR(d)) {
A
Al Viro 已提交
2600
		inode_unlock(path->dentry->d_inode);
2601
		path_put(path);
A
Al Viro 已提交
2602 2603
	}
	return d;
2604 2605
}

2606 2607 2608 2609 2610 2611 2612 2613 2614
struct dentry *kern_path_locked(const char *name, struct path *path)
{
	struct filename *filename = getname_kernel(name);
	struct dentry *res = __kern_path_locked(filename, path);

	putname(filename);
	return res;
}

2615 2616
int kern_path(const char *name, unsigned int flags, struct path *path)
{
2617 2618 2619 2620 2621 2622
	struct filename *filename = getname_kernel(name);
	int ret = filename_lookup(AT_FDCWD, filename, flags, path, NULL);

	putname(filename);
	return ret;

2623
}
2624
EXPORT_SYMBOL(kern_path);
2625

2626 2627 2628 2629 2630 2631
/**
 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
 * @dentry:  pointer to dentry of the base directory
 * @mnt: pointer to vfs mount of the base directory
 * @name: pointer to file name
 * @flags: lookup flags
2632
 * @path: pointer to struct path to fill
2633 2634 2635
 */
int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
		    const char *name, unsigned int flags,
2636
		    struct path *path)
2637
{
2638
	struct filename *filename;
2639
	struct path root = {.mnt = mnt, .dentry = dentry};
2640 2641 2642
	int ret;

	filename = getname_kernel(name);
2643
	/* the first argument of filename_lookup() is ignored with root */
2644 2645 2646
	ret = filename_lookup(AT_FDCWD, filename, flags, path, &root);
	putname(filename);
	return ret;
2647
}
2648
EXPORT_SYMBOL(vfs_path_lookup);
2649

2650 2651 2652
static int lookup_one_common(struct user_namespace *mnt_userns,
			     const char *name, struct dentry *base, int len,
			     struct qstr *this)
2653
{
2654 2655 2656
	this->name = name;
	this->len = len;
	this->hash = full_name_hash(base, name, len);
A
Al Viro 已提交
2657
	if (!len)
2658
		return -EACCES;
A
Al Viro 已提交
2659

2660 2661
	if (unlikely(name[0] == '.')) {
		if (len < 2 || (len == 2 && name[1] == '.'))
2662
			return -EACCES;
2663 2664
	}

A
Al Viro 已提交
2665
	while (len--) {
2666
		unsigned int c = *(const unsigned char *)name++;
A
Al Viro 已提交
2667
		if (c == '/' || c == '\0')
2668
			return -EACCES;
A
Al Viro 已提交
2669
	}
2670 2671 2672 2673 2674
	/*
	 * See if the low-level filesystem might want
	 * to use its own hash..
	 */
	if (base->d_flags & DCACHE_OP_HASH) {
2675
		int err = base->d_op->d_hash(base, this);
2676
		if (err < 0)
2677
			return err;
2678
	}
2679

2680
	return inode_permission(mnt_userns, base->d_inode, MAY_EXEC);
2681 2682
}

2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703
/**
 * try_lookup_one_len - filesystem helper to lookup single pathname component
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
 * Look up a dentry by name in the dcache, returning NULL if it does not
 * currently exist.  The function does not try to create a dentry.
 *
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.
 *
 * The caller must hold base->i_mutex.
 */
struct dentry *try_lookup_one_len(const char *name, struct dentry *base, int len)
{
	struct qstr this;
	int err;

	WARN_ON_ONCE(!inode_is_locked(base->d_inode));

2704
	err = lookup_one_common(&init_user_ns, name, base, len, &this);
2705 2706 2707 2708 2709 2710 2711
	if (err)
		return ERR_PTR(err);

	return lookup_dcache(&this, base, 0);
}
EXPORT_SYMBOL(try_lookup_one_len);

2712 2713 2714 2715 2716 2717 2718 2719 2720 2721 2722 2723 2724
/**
 * lookup_one_len - filesystem helper to lookup single pathname component
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.
 *
 * The caller must hold base->i_mutex.
 */
struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
{
2725
	struct dentry *dentry;
2726 2727 2728 2729 2730
	struct qstr this;
	int err;

	WARN_ON_ONCE(!inode_is_locked(base->d_inode));

2731
	err = lookup_one_common(&init_user_ns, name, base, len, &this);
2732 2733 2734
	if (err)
		return ERR_PTR(err);

2735 2736
	dentry = lookup_dcache(&this, base, 0);
	return dentry ? dentry : __lookup_slow(&this, base, 0);
2737
}
2738
EXPORT_SYMBOL(lookup_one_len);
2739

2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755 2756 2757 2758 2759 2760 2761 2762 2763 2764 2765 2766 2767 2768 2769
/**
 * lookup_one - filesystem helper to lookup single pathname component
 * @mnt_userns:	user namespace of the mount the lookup is performed from
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.
 *
 * The caller must hold base->i_mutex.
 */
struct dentry *lookup_one(struct user_namespace *mnt_userns, const char *name,
			  struct dentry *base, int len)
{
	struct dentry *dentry;
	struct qstr this;
	int err;

	WARN_ON_ONCE(!inode_is_locked(base->d_inode));

	err = lookup_one_common(mnt_userns, name, base, len, &this);
	if (err)
		return ERR_PTR(err);

	dentry = lookup_dcache(&this, base, 0);
	return dentry ? dentry : __lookup_slow(&this, base, 0);
}
EXPORT_SYMBOL(lookup_one);

2770 2771 2772 2773 2774 2775 2776 2777 2778 2779 2780 2781 2782 2783 2784 2785 2786
/**
 * lookup_one_len_unlocked - filesystem helper to lookup single pathname component
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.
 *
 * Unlike lookup_one_len, it should be called without the parent
 * i_mutex held, and will take the i_mutex itself if necessary.
 */
struct dentry *lookup_one_len_unlocked(const char *name,
				       struct dentry *base, int len)
{
	struct qstr this;
	int err;
2787
	struct dentry *ret;
2788

2789
	err = lookup_one_common(&init_user_ns, name, base, len, &this);
2790 2791 2792
	if (err)
		return ERR_PTR(err);

2793 2794 2795 2796
	ret = lookup_dcache(&this, base, 0);
	if (!ret)
		ret = lookup_slow(&this, base, 0);
	return ret;
2797 2798 2799
}
EXPORT_SYMBOL(lookup_one_len_unlocked);

2800 2801 2802 2803 2804 2805 2806 2807 2808 2809 2810 2811
/*
 * Like lookup_one_len_unlocked(), except that it yields ERR_PTR(-ENOENT)
 * on negatives.  Returns known positive or ERR_PTR(); that's what
 * most of the users want.  Note that pinned negative with unlocked parent
 * _can_ become positive at any time, so callers of lookup_one_len_unlocked()
 * need to be very careful; pinned positives have ->d_inode stable, so
 * this one avoids such problems.
 */
struct dentry *lookup_positive_unlocked(const char *name,
				       struct dentry *base, int len)
{
	struct dentry *ret = lookup_one_len_unlocked(name, base, len);
2812
	if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) {
2813 2814 2815 2816 2817 2818 2819
		dput(ret);
		ret = ERR_PTR(-ENOENT);
	}
	return ret;
}
EXPORT_SYMBOL(lookup_positive_unlocked);

2820 2821 2822 2823 2824 2825
#ifdef CONFIG_UNIX98_PTYS
int path_pts(struct path *path)
{
	/* Find something mounted on "pts" in the same directory as
	 * the input path.
	 */
2826 2827
	struct dentry *parent = dget_parent(path->dentry);
	struct dentry *child;
2828
	struct qstr this = QSTR_INIT("pts", 3);
2829

2830 2831
	if (unlikely(!path_connected(path->mnt, parent))) {
		dput(parent);
2832
		return -ENOENT;
2833
	}
2834 2835
	dput(path->dentry);
	path->dentry = parent;
2836 2837 2838 2839 2840 2841
	child = d_hash_and_lookup(parent, &this);
	if (!child)
		return -ENOENT;

	path->dentry = child;
	dput(parent);
2842
	follow_down(path);
2843 2844 2845 2846
	return 0;
}
#endif

2847 2848
int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
		 struct path *path, int *empty)
L
Linus Torvalds 已提交
2849
{
2850 2851 2852 2853 2854
	struct filename *filename = getname_flags(name, flags, empty);
	int ret = filename_lookup(dfd, filename, flags, path, NULL);

	putname(filename);
	return ret;
L
Linus Torvalds 已提交
2855
}
2856
EXPORT_SYMBOL(user_path_at_empty);
2857

2858 2859
int __check_sticky(struct user_namespace *mnt_userns, struct inode *dir,
		   struct inode *inode)
L
Linus Torvalds 已提交
2860
{
2861
	kuid_t fsuid = current_fsuid();
2862

2863
	if (uid_eq(i_uid_into_mnt(mnt_userns, inode), fsuid))
L
Linus Torvalds 已提交
2864
		return 0;
2865
	if (uid_eq(i_uid_into_mnt(mnt_userns, dir), fsuid))
L
Linus Torvalds 已提交
2866
		return 0;
2867
	return !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FOWNER);
L
Linus Torvalds 已提交
2868
}
2869
EXPORT_SYMBOL(__check_sticky);
L
Linus Torvalds 已提交
2870 2871 2872 2873 2874 2875 2876 2877 2878 2879 2880 2881 2882 2883

/*
 *	Check whether we can remove a link victim from directory dir, check
 *  whether the type of victim is right.
 *  1. We can't do it if dir is read-only (done in permission())
 *  2. We should have write and exec permissions on dir
 *  3. We can't remove anything from append-only dir
 *  4. We can't do anything with immutable dir (done in permission())
 *  5. If the sticky bit on dir is set we should either
 *	a. be owner of dir, or
 *	b. be owner of victim, or
 *	c. have CAP_FOWNER capability
 *  6. If the victim is append-only or immutable we can't do antyhing with
 *     links pointing to it.
2884 2885 2886 2887 2888
 *  7. If the victim has an unknown uid or gid we can't change the inode.
 *  8. If we were asked to remove a directory and victim isn't one - ENOTDIR.
 *  9. If we were asked to remove a non-directory and victim isn't one - EISDIR.
 * 10. We can't remove a root or mountpoint.
 * 11. We don't allow removal of NFS sillyrenamed files; it's handled by
L
Linus Torvalds 已提交
2889 2890
 *     nfs_async_unlink().
 */
2891 2892
static int may_delete(struct user_namespace *mnt_userns, struct inode *dir,
		      struct dentry *victim, bool isdir)
L
Linus Torvalds 已提交
2893
{
2894
	struct inode *inode = d_backing_inode(victim);
L
Linus Torvalds 已提交
2895 2896
	int error;

2897
	if (d_is_negative(victim))
L
Linus Torvalds 已提交
2898
		return -ENOENT;
2899
	BUG_ON(!inode);
L
Linus Torvalds 已提交
2900 2901

	BUG_ON(victim->d_parent->d_inode != dir);
2902 2903

	/* Inode writeback is not safe when the uid or gid are invalid. */
2904 2905
	if (!uid_valid(i_uid_into_mnt(mnt_userns, inode)) ||
	    !gid_valid(i_gid_into_mnt(mnt_userns, inode)))
2906 2907
		return -EOVERFLOW;

2908
	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
L
Linus Torvalds 已提交
2909

2910
	error = inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
2911 2912 2913 2914
	if (error)
		return error;
	if (IS_APPEND(dir))
		return -EPERM;
2915

2916 2917 2918
	if (check_sticky(mnt_userns, dir, inode) || IS_APPEND(inode) ||
	    IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) ||
	    HAS_UNMAPPED_ID(mnt_userns, inode))
L
Linus Torvalds 已提交
2919 2920
		return -EPERM;
	if (isdir) {
M
Miklos Szeredi 已提交
2921
		if (!d_is_dir(victim))
L
Linus Torvalds 已提交
2922 2923 2924
			return -ENOTDIR;
		if (IS_ROOT(victim))
			return -EBUSY;
M
Miklos Szeredi 已提交
2925
	} else if (d_is_dir(victim))
L
Linus Torvalds 已提交
2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938
		return -EISDIR;
	if (IS_DEADDIR(dir))
		return -ENOENT;
	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
		return -EBUSY;
	return 0;
}

/*	Check whether we can create an object with dentry child in directory
 *  dir.
 *  1. We can't do it if child already exists (open has special treatment for
 *     this case, but since we are inlined it's OK)
 *  2. We can't do it if dir is read-only (done in permission())
2939 2940 2941
 *  3. We can't do it if the fs can't represent the fsuid or fsgid.
 *  4. We should have write and exec permissions on dir
 *  5. We can't do it if dir is immutable (done in permission())
L
Linus Torvalds 已提交
2942
 */
2943 2944
static inline int may_create(struct user_namespace *mnt_userns,
			     struct inode *dir, struct dentry *child)
L
Linus Torvalds 已提交
2945
{
2946
	audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
L
Linus Torvalds 已提交
2947 2948 2949 2950
	if (child->d_inode)
		return -EEXIST;
	if (IS_DEADDIR(dir))
		return -ENOENT;
2951
	if (!fsuidgid_has_mapping(dir->i_sb, mnt_userns))
2952
		return -EOVERFLOW;
2953

2954
	return inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
2955 2956 2957 2958 2959 2960 2961 2962 2963 2964
}

/*
 * p1 and p2 should be directories on the same fs.
 */
struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
{
	struct dentry *p;

	if (p1 == p2) {
A
Al Viro 已提交
2965
		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
L
Linus Torvalds 已提交
2966 2967 2968
		return NULL;
	}

2969
	mutex_lock(&p1->d_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
2970

2971 2972
	p = d_ancestor(p2, p1);
	if (p) {
A
Al Viro 已提交
2973 2974
		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
		inode_lock_nested(p1->d_inode, I_MUTEX_CHILD);
2975
		return p;
L
Linus Torvalds 已提交
2976 2977
	}

2978 2979
	p = d_ancestor(p1, p2);
	if (p) {
A
Al Viro 已提交
2980 2981
		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
		inode_lock_nested(p2->d_inode, I_MUTEX_CHILD);
2982
		return p;
L
Linus Torvalds 已提交
2983 2984
	}

A
Al Viro 已提交
2985 2986
	inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
	inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
L
Linus Torvalds 已提交
2987 2988
	return NULL;
}
2989
EXPORT_SYMBOL(lock_rename);
L
Linus Torvalds 已提交
2990 2991 2992

void unlock_rename(struct dentry *p1, struct dentry *p2)
{
A
Al Viro 已提交
2993
	inode_unlock(p1->d_inode);
L
Linus Torvalds 已提交
2994
	if (p1 != p2) {
A
Al Viro 已提交
2995
		inode_unlock(p2->d_inode);
2996
		mutex_unlock(&p1->d_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
2997 2998
	}
}
2999
EXPORT_SYMBOL(unlock_rename);
L
Linus Torvalds 已提交
3000

3001 3002 3003 3004 3005 3006 3007 3008 3009 3010 3011 3012 3013 3014 3015 3016 3017 3018
/**
 * vfs_create - create new file
 * @mnt_userns:	user namespace of the mount the inode was found from
 * @dir:	inode of @dentry
 * @dentry:	pointer to dentry of the base directory
 * @mode:	mode of the new file
 * @want_excl:	whether the file must not yet exist
 *
 * Create a new file.
 *
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
 */
int vfs_create(struct user_namespace *mnt_userns, struct inode *dir,
	       struct dentry *dentry, umode_t mode, bool want_excl)
L
Linus Torvalds 已提交
3019
{
3020
	int error = may_create(mnt_userns, dir, dentry);
L
Linus Torvalds 已提交
3021 3022 3023
	if (error)
		return error;

A
Al Viro 已提交
3024
	if (!dir->i_op->create)
L
Linus Torvalds 已提交
3025 3026 3027 3028 3029 3030
		return -EACCES;	/* shouldn't it be ENOSYS? */
	mode &= S_IALLUGO;
	mode |= S_IFREG;
	error = security_inode_create(dir, dentry, mode);
	if (error)
		return error;
3031
	error = dir->i_op->create(mnt_userns, dir, dentry, mode, want_excl);
3032
	if (!error)
3033
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
3034 3035
	return error;
}
3036
EXPORT_SYMBOL(vfs_create);
L
Linus Torvalds 已提交
3037

A
Al Viro 已提交
3038 3039 3040 3041 3042
int vfs_mkobj(struct dentry *dentry, umode_t mode,
		int (*f)(struct dentry *, umode_t, void *),
		void *arg)
{
	struct inode *dir = dentry->d_parent->d_inode;
3043
	int error = may_create(&init_user_ns, dir, dentry);
A
Al Viro 已提交
3044 3045 3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058
	if (error)
		return error;

	mode &= S_IALLUGO;
	mode |= S_IFREG;
	error = security_inode_create(dir, dentry, mode);
	if (error)
		return error;
	error = f(dentry, mode, arg);
	if (!error)
		fsnotify_create(dir, dentry);
	return error;
}
EXPORT_SYMBOL(vfs_mkobj);

3059 3060 3061 3062 3063 3064
bool may_open_dev(const struct path *path)
{
	return !(path->mnt->mnt_flags & MNT_NODEV) &&
		!(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
}

3065 3066
static int may_open(struct user_namespace *mnt_userns, const struct path *path,
		    int acc_mode, int flag)
L
Linus Torvalds 已提交
3067
{
3068
	struct dentry *dentry = path->dentry;
L
Linus Torvalds 已提交
3069 3070 3071 3072 3073 3074
	struct inode *inode = dentry->d_inode;
	int error;

	if (!inode)
		return -ENOENT;

C
Christoph Hellwig 已提交
3075 3076
	switch (inode->i_mode & S_IFMT) {
	case S_IFLNK:
L
Linus Torvalds 已提交
3077
		return -ELOOP;
C
Christoph Hellwig 已提交
3078
	case S_IFDIR:
3079
		if (acc_mode & MAY_WRITE)
C
Christoph Hellwig 已提交
3080
			return -EISDIR;
3081 3082
		if (acc_mode & MAY_EXEC)
			return -EACCES;
C
Christoph Hellwig 已提交
3083 3084 3085
		break;
	case S_IFBLK:
	case S_IFCHR:
3086
		if (!may_open_dev(path))
L
Linus Torvalds 已提交
3087
			return -EACCES;
3088
		fallthrough;
C
Christoph Hellwig 已提交
3089 3090
	case S_IFIFO:
	case S_IFSOCK:
3091 3092
		if (acc_mode & MAY_EXEC)
			return -EACCES;
L
Linus Torvalds 已提交
3093
		flag &= ~O_TRUNC;
C
Christoph Hellwig 已提交
3094
		break;
3095 3096 3097 3098
	case S_IFREG:
		if ((acc_mode & MAY_EXEC) && path_noexec(path))
			return -EACCES;
		break;
3099
	}
3100

3101
	error = inode_permission(mnt_userns, inode, MAY_OPEN | acc_mode);
3102 3103
	if (error)
		return error;
M
Mimi Zohar 已提交
3104

L
Linus Torvalds 已提交
3105 3106 3107 3108
	/*
	 * An append-only file must be opened in append mode for writing.
	 */
	if (IS_APPEND(inode)) {
3109
		if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
3110
			return -EPERM;
L
Linus Torvalds 已提交
3111
		if (flag & O_TRUNC)
3112
			return -EPERM;
L
Linus Torvalds 已提交
3113 3114 3115
	}

	/* O_NOATIME can only be set by the owner or superuser */
3116
	if (flag & O_NOATIME && !inode_owner_or_capable(mnt_userns, inode))
3117
		return -EPERM;
L
Linus Torvalds 已提交
3118

3119
	return 0;
3120
}
L
Linus Torvalds 已提交
3121

3122
static int handle_truncate(struct user_namespace *mnt_userns, struct file *filp)
3123
{
3124
	const struct path *path = &filp->f_path;
3125 3126 3127 3128
	struct inode *inode = path->dentry->d_inode;
	int error = get_write_access(inode);
	if (error)
		return error;
3129

3130
	error = security_path_truncate(path);
3131
	if (!error) {
3132
		error = do_truncate(mnt_userns, path->dentry, 0,
3133
				    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
3134
				    filp);
3135 3136
	}
	put_write_access(inode);
M
Mimi Zohar 已提交
3137
	return error;
L
Linus Torvalds 已提交
3138 3139
}

3140 3141
static inline int open_to_namei_flags(int flag)
{
3142 3143
	if ((flag & O_ACCMODE) == 3)
		flag--;
3144 3145 3146
	return flag;
}

3147 3148 3149
static int may_o_create(struct user_namespace *mnt_userns,
			const struct path *dir, struct dentry *dentry,
			umode_t mode)
3150 3151 3152 3153 3154
{
	int error = security_path_mknod(dir, dentry, mode, 0);
	if (error)
		return error;

3155
	if (!fsuidgid_has_mapping(dir->dentry->d_sb, mnt_userns))
3156 3157
		return -EOVERFLOW;

3158
	error = inode_permission(mnt_userns, dir->dentry->d_inode,
3159
				 MAY_WRITE | MAY_EXEC);
3160 3161 3162 3163 3164 3165
	if (error)
		return error;

	return security_inode_create(dir->dentry->d_inode, dentry, mode);
}

3166 3167 3168 3169 3170 3171 3172
/*
 * Attempt to atomically look up, create and open a file from a negative
 * dentry.
 *
 * Returns 0 if successful.  The file will have been created and attached to
 * @file by the filesystem calling finish_open().
 *
3173 3174 3175
 * If the file was looked up only or didn't need creating, FMODE_OPENED won't
 * be set.  The caller will need to perform the open themselves.  @path will
 * have been updated to point to the new dentry.  This may be negative.
3176 3177 3178
 *
 * Returns an error code otherwise.
 */
3179 3180 3181
static struct dentry *atomic_open(struct nameidata *nd, struct dentry *dentry,
				  struct file *file,
				  int open_flag, umode_t mode)
3182
{
3183
	struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
3184 3185 3186 3187 3188 3189
	struct inode *dir =  nd->path.dentry->d_inode;
	int error;

	if (nd->flags & LOOKUP_DIRECTORY)
		open_flag |= O_DIRECTORY;

A
Al Viro 已提交
3190 3191
	file->f_path.dentry = DENTRY_NOT_SET;
	file->f_path.mnt = nd->path.mnt;
3192
	error = dir->i_op->atomic_open(dir, dentry, file,
3193
				       open_to_namei_flags(open_flag), mode);
3194
	d_lookup_done(dentry);
3195
	if (!error) {
3196
		if (file->f_mode & FMODE_OPENED) {
3197 3198 3199 3200
			if (unlikely(dentry != file->f_path.dentry)) {
				dput(dentry);
				dentry = dget(file->f_path.dentry);
			}
3201
		} else if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
3202
			error = -EIO;
3203
		} else {
3204 3205 3206
			if (file->f_path.dentry) {
				dput(dentry);
				dentry = file->f_path.dentry;
3207
			}
3208
			if (unlikely(d_is_negative(dentry)))
3209
				error = -ENOENT;
3210
		}
3211
	}
3212 3213 3214 3215 3216
	if (error) {
		dput(dentry);
		dentry = ERR_PTR(error);
	}
	return dentry;
3217 3218
}

M
Miklos Szeredi 已提交
3219
/*
3220
 * Look up and maybe create and open the last component.
M
Miklos Szeredi 已提交
3221
 *
3222
 * Must be called with parent locked (exclusive in O_CREAT case).
3223
 *
3224 3225 3226 3227 3228 3229 3230
 * Returns 0 on success, that is, if
 *  the file was successfully atomically created (if necessary) and opened, or
 *  the file was not completely opened at this time, though lookups and
 *  creations were performed.
 * These case are distinguished by presence of FMODE_OPENED on file->f_mode.
 * In the latter case dentry returned in @path might be negative if O_CREAT
 * hadn't been specified.
3231
 *
3232
 * An error code is returned on failure.
M
Miklos Szeredi 已提交
3233
 */
3234 3235 3236
static struct dentry *lookup_open(struct nameidata *nd, struct file *file,
				  const struct open_flags *op,
				  bool got_write)
M
Miklos Szeredi 已提交
3237
{
3238
	struct user_namespace *mnt_userns;
M
Miklos Szeredi 已提交
3239
	struct dentry *dir = nd->path.dentry;
3240
	struct inode *dir_inode = dir->d_inode;
3241
	int open_flag = op->open_flag;
M
Miklos Szeredi 已提交
3242
	struct dentry *dentry;
3243 3244
	int error, create_error = 0;
	umode_t mode = op->mode;
3245
	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
M
Miklos Szeredi 已提交
3246

3247
	if (unlikely(IS_DEADDIR(dir_inode)))
3248
		return ERR_PTR(-ENOENT);
M
Miklos Szeredi 已提交
3249

3250
	file->f_mode &= ~FMODE_CREATED;
3251 3252 3253 3254 3255
	dentry = d_lookup(dir, &nd->last);
	for (;;) {
		if (!dentry) {
			dentry = d_alloc_parallel(dir, &nd->last, &wq);
			if (IS_ERR(dentry))
3256
				return dentry;
3257 3258 3259
		}
		if (d_in_lookup(dentry))
			break;
M
Miklos Szeredi 已提交
3260

3261 3262 3263 3264 3265 3266 3267 3268 3269 3270
		error = d_revalidate(dentry, nd->flags);
		if (likely(error > 0))
			break;
		if (error)
			goto out_dput;
		d_invalidate(dentry);
		dput(dentry);
		dentry = NULL;
	}
	if (dentry->d_inode) {
3271
		/* Cached positive dentry: will open in f_op->open */
3272
		return dentry;
3273
	}
3274

3275 3276 3277 3278 3279 3280 3281 3282 3283
	/*
	 * Checking write permission is tricky, bacuse we don't know if we are
	 * going to actually need it: O_CREAT opens should work as long as the
	 * file exists.  But checking existence breaks atomicity.  The trick is
	 * to check access and if not granted clear O_CREAT from the flags.
	 *
	 * Another problem is returing the "right" error value (e.g. for an
	 * O_EXCL open we want to return EEXIST not EROFS).
	 */
3284 3285
	if (unlikely(!got_write))
		open_flag &= ~O_TRUNC;
3286
	mnt_userns = mnt_user_ns(nd->path.mnt);
3287
	if (open_flag & O_CREAT) {
3288 3289
		if (open_flag & O_EXCL)
			open_flag &= ~O_TRUNC;
3290 3291
		if (!IS_POSIXACL(dir->d_inode))
			mode &= ~current_umask();
3292
		if (likely(got_write))
3293
			create_error = may_o_create(mnt_userns, &nd->path,
3294
						    dentry, mode);
3295 3296
		else
			create_error = -EROFS;
3297
	}
3298 3299
	if (create_error)
		open_flag &= ~O_CREAT;
3300
	if (dir_inode->i_op->atomic_open) {
3301
		dentry = atomic_open(nd, dentry, file, open_flag, mode);
3302 3303 3304
		if (unlikely(create_error) && dentry == ERR_PTR(-ENOENT))
			dentry = ERR_PTR(create_error);
		return dentry;
3305
	}
3306

3307
	if (d_in_lookup(dentry)) {
3308 3309
		struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry,
							     nd->flags);
3310
		d_lookup_done(dentry);
3311 3312 3313 3314 3315 3316 3317 3318
		if (unlikely(res)) {
			if (IS_ERR(res)) {
				error = PTR_ERR(res);
				goto out_dput;
			}
			dput(dentry);
			dentry = res;
		}
3319 3320
	}

M
Miklos Szeredi 已提交
3321
	/* Negative dentry, just create the file */
3322
	if (!dentry->d_inode && (open_flag & O_CREAT)) {
3323
		file->f_mode |= FMODE_CREATED;
3324 3325 3326
		audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
		if (!dir_inode->i_op->create) {
			error = -EACCES;
M
Miklos Szeredi 已提交
3327
			goto out_dput;
3328
		}
3329 3330 3331

		error = dir_inode->i_op->create(mnt_userns, dir_inode, dentry,
						mode, open_flag & O_EXCL);
M
Miklos Szeredi 已提交
3332 3333 3334
		if (error)
			goto out_dput;
	}
3335 3336 3337
	if (unlikely(create_error) && !dentry->d_inode) {
		error = create_error;
		goto out_dput;
M
Miklos Szeredi 已提交
3338
	}
3339
	return dentry;
M
Miklos Szeredi 已提交
3340 3341 3342

out_dput:
	dput(dentry);
3343
	return ERR_PTR(error);
M
Miklos Szeredi 已提交
3344 3345
}

3346
static const char *open_last_lookups(struct nameidata *nd,
3347
		   struct file *file, const struct open_flags *op)
3348
{
3349
	struct dentry *dir = nd->path.dentry;
3350
	int open_flag = op->open_flag;
3351
	bool got_write = false;
3352
	unsigned seq;
3353
	struct inode *inode;
3354
	struct dentry *dentry;
3355
	const char *res;
3356

3357 3358
	nd->flags |= op->intent;

3359
	if (nd->last_type != LAST_NORM) {
3360 3361
		if (nd->depth)
			put_link(nd);
3362
		return handle_dots(nd, nd->last_type);
3363
	}
3364

3365
	if (!(open_flag & O_CREAT)) {
3366 3367 3368
		if (nd->last.name[nd->last.len])
			nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
		/* we _can_ be in RCU mode here */
3369 3370
		dentry = lookup_fast(nd, &inode, &seq);
		if (IS_ERR(dentry))
3371
			return ERR_CAST(dentry);
3372
		if (likely(dentry))
3373 3374
			goto finish_lookup;

3375
		BUG_ON(nd->flags & LOOKUP_RCU);
3376 3377
	} else {
		/* create side of things */
3378
		if (nd->flags & LOOKUP_RCU) {
3379 3380
			if (!try_to_unlazy(nd))
				return ERR_PTR(-ECHILD);
3381
		}
3382
		audit_inode(nd->name, dir, AUDIT_INODE_PARENT);
3383
		/* trailing slashes? */
3384
		if (unlikely(nd->last.name[nd->last.len]))
3385
			return ERR_PTR(-EISDIR);
3386
	}
A
Al Viro 已提交
3387

3388
	if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
3389
		got_write = !mnt_want_write(nd->path.mnt);
3390 3391 3392 3393 3394 3395
		/*
		 * do _not_ fail yet - we might not need that or fail with
		 * a different error; let lookup_open() decide; we'll be
		 * dropping this one anyway.
		 */
	}
3396 3397 3398 3399
	if (open_flag & O_CREAT)
		inode_lock(dir->d_inode);
	else
		inode_lock_shared(dir->d_inode);
3400
	dentry = lookup_open(nd, file, op, got_write);
3401 3402
	if (!IS_ERR(dentry) && (file->f_mode & FMODE_CREATED))
		fsnotify_create(dir->d_inode, dentry);
3403 3404 3405 3406
	if (open_flag & O_CREAT)
		inode_unlock(dir->d_inode);
	else
		inode_unlock_shared(dir->d_inode);
3407

3408
	if (got_write)
3409
		mnt_drop_write(nd->path.mnt);
3410

3411 3412 3413
	if (IS_ERR(dentry))
		return ERR_CAST(dentry);

3414
	if (file->f_mode & (FMODE_OPENED | FMODE_CREATED)) {
3415 3416
		dput(nd->path.dentry);
		nd->path.dentry = dentry;
3417
		return NULL;
3418 3419
	}

3420
finish_lookup:
3421 3422
	if (nd->depth)
		put_link(nd);
3423
	res = step_into(nd, WALK_TRAILING, dentry, inode, seq);
3424
	if (unlikely(res))
3425
		nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3426
	return res;
3427 3428 3429 3430 3431
}

/*
 * Handle the last step of open()
 */
3432
static int do_open(struct nameidata *nd,
3433 3434
		   struct file *file, const struct open_flags *op)
{
3435
	struct user_namespace *mnt_userns;
3436 3437 3438 3439 3440
	int open_flag = op->open_flag;
	bool do_truncate;
	int acc_mode;
	int error;

3441 3442 3443 3444 3445
	if (!(file->f_mode & (FMODE_OPENED | FMODE_CREATED))) {
		error = complete_walk(nd);
		if (error)
			return error;
	}
3446 3447
	if (!(file->f_mode & FMODE_CREATED))
		audit_inode(nd->name, nd->path.dentry, 0);
3448
	mnt_userns = mnt_user_ns(nd->path.mnt);
3449
	if (open_flag & O_CREAT) {
3450 3451
		if ((open_flag & O_EXCL) && !(file->f_mode & FMODE_CREATED))
			return -EEXIST;
3452
		if (d_is_dir(nd->path.dentry))
3453
			return -EISDIR;
3454
		error = may_create_in_sticky(mnt_userns, nd,
3455 3456
					     d_backing_inode(nd->path.dentry));
		if (unlikely(error))
3457
			return error;
3458
	}
M
Miklos Szeredi 已提交
3459
	if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
3460
		return -ENOTDIR;
3461

3462 3463
	do_truncate = false;
	acc_mode = op->acc_mode;
3464 3465 3466 3467
	if (file->f_mode & FMODE_CREATED) {
		/* Don't check for write permission, don't truncate */
		open_flag &= ~O_TRUNC;
		acc_mode = 0;
3468
	} else if (d_is_reg(nd->path.dentry) && open_flag & O_TRUNC) {
3469 3470
		error = mnt_want_write(nd->path.mnt);
		if (error)
3471
			return error;
3472
		do_truncate = true;
3473
	}
3474
	error = may_open(mnt_userns, &nd->path, acc_mode, open_flag);
3475
	if (!error && !(file->f_mode & FMODE_OPENED))
3476
		error = vfs_open(&nd->path, file);
3477 3478 3479
	if (!error)
		error = ima_file_check(file, op->acc_mode);
	if (!error && do_truncate)
3480
		error = handle_truncate(mnt_userns, file);
3481 3482 3483 3484
	if (unlikely(error > 0)) {
		WARN_ON(1);
		error = -EINVAL;
	}
3485
	if (do_truncate)
3486
		mnt_drop_write(nd->path.mnt);
3487
	return error;
3488 3489
}

3490 3491 3492 3493 3494
/**
 * vfs_tmpfile - create tmpfile
 * @mnt_userns:	user namespace of the mount the inode was found from
 * @dentry:	pointer to dentry of the base directory
 * @mode:	mode of the new tmpfile
3495
 * @open_flag:	flags
3496 3497 3498 3499 3500 3501 3502 3503 3504 3505 3506
 *
 * Create a temporary file.
 *
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
 */
struct dentry *vfs_tmpfile(struct user_namespace *mnt_userns,
			   struct dentry *dentry, umode_t mode, int open_flag)
3507 3508 3509 3510 3511 3512 3513
{
	struct dentry *child = NULL;
	struct inode *dir = dentry->d_inode;
	struct inode *inode;
	int error;

	/* we want directory to be writable */
3514
	error = inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC);
3515 3516 3517 3518 3519 3520
	if (error)
		goto out_err;
	error = -EOPNOTSUPP;
	if (!dir->i_op->tmpfile)
		goto out_err;
	error = -ENOMEM;
3521
	child = d_alloc(dentry, &slash_name);
3522 3523
	if (unlikely(!child))
		goto out_err;
3524
	error = dir->i_op->tmpfile(mnt_userns, dir, child, mode);
3525 3526 3527 3528 3529 3530 3531 3532 3533 3534 3535
	if (error)
		goto out_err;
	error = -ENOENT;
	inode = child->d_inode;
	if (unlikely(!inode))
		goto out_err;
	if (!(open_flag & O_EXCL)) {
		spin_lock(&inode->i_lock);
		inode->i_state |= I_LINKABLE;
		spin_unlock(&inode->i_lock);
	}
3536
	ima_post_create_tmpfile(mnt_userns, inode);
3537 3538 3539 3540 3541 3542 3543 3544
	return child;

out_err:
	dput(child);
	return ERR_PTR(error);
}
EXPORT_SYMBOL(vfs_tmpfile);

3545
static int do_tmpfile(struct nameidata *nd, unsigned flags,
3546
		const struct open_flags *op,
3547
		struct file *file)
3548
{
3549
	struct user_namespace *mnt_userns;
3550 3551
	struct dentry *child;
	struct path path;
3552
	int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
3553 3554
	if (unlikely(error))
		return error;
3555
	error = mnt_want_write(path.mnt);
3556 3557
	if (unlikely(error))
		goto out;
3558 3559
	mnt_userns = mnt_user_ns(path.mnt);
	child = vfs_tmpfile(mnt_userns, path.dentry, op->mode, op->open_flag);
3560
	error = PTR_ERR(child);
3561
	if (IS_ERR(child))
3562
		goto out2;
3563 3564
	dput(path.dentry);
	path.dentry = child;
3565
	audit_inode(nd->name, child, 0);
3566
	/* Don't check for other permissions, the inode was just created */
3567
	error = may_open(mnt_userns, &path, 0, op->open_flag);
3568 3569
	if (!error)
		error = vfs_open(&path, file);
3570
out2:
3571
	mnt_drop_write(path.mnt);
3572
out:
3573
	path_put(&path);
3574 3575 3576
	return error;
}

3577 3578 3579 3580 3581 3582
static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file)
{
	struct path path;
	int error = path_lookupat(nd, flags, &path);
	if (!error) {
		audit_inode(nd->name, path.dentry, 0);
3583
		error = vfs_open(&path, file);
3584 3585 3586 3587 3588
		path_put(&path);
	}
	return error;
}

3589 3590
static struct file *path_openat(struct nameidata *nd,
			const struct open_flags *op, unsigned flags)
L
Linus Torvalds 已提交
3591
{
A
Al Viro 已提交
3592
	struct file *file;
3593
	int error;
3594

3595
	file = alloc_empty_file(op->open_flag, current_cred());
3596 3597
	if (IS_ERR(file))
		return file;
3598

A
Al Viro 已提交
3599
	if (unlikely(file->f_flags & __O_TMPFILE)) {
3600
		error = do_tmpfile(nd, flags, op, file);
3601
	} else if (unlikely(file->f_flags & O_PATH)) {
3602
		error = do_o_path(nd, flags, file);
3603 3604 3605
	} else {
		const char *s = path_init(nd, flags);
		while (!(error = link_path_walk(s, nd)) &&
3606
		       (s = open_last_lookups(nd, file, op)) != NULL)
3607
			;
3608 3609
		if (!error)
			error = do_open(nd, file, op);
3610
		terminate_walk(nd);
3611
	}
3612
	if (likely(!error)) {
3613
		if (likely(file->f_mode & FMODE_OPENED))
3614 3615 3616
			return file;
		WARN_ON(1);
		error = -EINVAL;
3617
	}
3618 3619 3620 3621 3622 3623
	fput(file);
	if (error == -EOPENSTALE) {
		if (flags & LOOKUP_RCU)
			error = -ECHILD;
		else
			error = -ESTALE;
3624
	}
3625
	return ERR_PTR(error);
L
Linus Torvalds 已提交
3626 3627
}

3628
struct file *do_filp_open(int dfd, struct filename *pathname,
3629
		const struct open_flags *op)
3630
{
3631
	struct nameidata nd;
3632
	int flags = op->lookup_flags;
3633 3634
	struct file *filp;

3635
	set_nameidata(&nd, dfd, pathname, NULL);
3636
	filp = path_openat(&nd, op, flags | LOOKUP_RCU);
3637
	if (unlikely(filp == ERR_PTR(-ECHILD)))
3638
		filp = path_openat(&nd, op, flags);
3639
	if (unlikely(filp == ERR_PTR(-ESTALE)))
3640
		filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
3641
	restore_nameidata();
3642 3643 3644
	return filp;
}

3645
struct file *do_file_open_root(const struct path *root,
3646
		const char *name, const struct open_flags *op)
3647
{
3648
	struct nameidata nd;
3649
	struct file *file;
3650
	struct filename *filename;
3651
	int flags = op->lookup_flags;
3652

3653
	if (d_is_symlink(root->dentry) && op->intent & LOOKUP_OPEN)
3654 3655
		return ERR_PTR(-ELOOP);

3656
	filename = getname_kernel(name);
3657
	if (IS_ERR(filename))
3658 3659
		return ERR_CAST(filename);

3660
	set_nameidata(&nd, -1, filename, root);
3661
	file = path_openat(&nd, op, flags | LOOKUP_RCU);
3662
	if (unlikely(file == ERR_PTR(-ECHILD)))
3663
		file = path_openat(&nd, op, flags);
3664
	if (unlikely(file == ERR_PTR(-ESTALE)))
3665
		file = path_openat(&nd, op, flags | LOOKUP_REVAL);
3666
	restore_nameidata();
3667
	putname(filename);
3668 3669 3670
	return file;
}

3671 3672
static struct dentry *filename_create(int dfd, struct filename *name,
				      struct path *path, unsigned int lookup_flags)
L
Linus Torvalds 已提交
3673
{
3674
	struct dentry *dentry = ERR_PTR(-EEXIST);
3675
	struct qstr last;
3676 3677 3678
	bool want_dir = lookup_flags & LOOKUP_DIRECTORY;
	unsigned int reval_flag = lookup_flags & LOOKUP_REVAL;
	unsigned int create_flags = LOOKUP_CREATE | LOOKUP_EXCL;
3679
	int type;
3680
	int err2;
3681 3682
	int error;

3683
	error = filename_parentat(dfd, name, reval_flag, path, &last, &type);
3684 3685
	if (error)
		return ERR_PTR(error);
L
Linus Torvalds 已提交
3686

3687 3688 3689 3690
	/*
	 * Yucky last component or no last component at all?
	 * (foo/., foo/.., /////)
	 */
3691
	if (unlikely(type != LAST_NORM))
A
Al Viro 已提交
3692
		goto out;
3693

3694
	/* don't fail immediately if it's r/o, at least try to report other errors */
3695
	err2 = mnt_want_write(path->mnt);
3696
	/*
3697 3698
	 * Do the final lookup.  Suppress 'create' if there is a trailing
	 * '/', and a directory wasn't requested.
3699
	 */
3700 3701
	if (last.name[last.len] && !want_dir)
		create_flags = 0;
A
Al Viro 已提交
3702
	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
3703
	dentry = __lookup_hash(&last, path->dentry, reval_flag | create_flags);
L
Linus Torvalds 已提交
3704
	if (IS_ERR(dentry))
3705
		goto unlock;
3706

3707
	error = -EEXIST;
3708
	if (d_is_positive(dentry))
3709
		goto fail;
3710

3711 3712 3713 3714 3715 3716
	/*
	 * Special case - lookup gave negative, but... we had foo/bar/
	 * From the vfs_mknod() POV we just have a negative dentry -
	 * all is fine. Let's be bastards - you had / on the end, you've
	 * been asking for (non-existent) directory. -ENOENT for you.
	 */
3717
	if (unlikely(!create_flags)) {
3718
		error = -ENOENT;
A
Al Viro 已提交
3719
		goto fail;
3720
	}
3721 3722
	if (unlikely(err2)) {
		error = err2;
3723
		goto fail;
3724
	}
L
Linus Torvalds 已提交
3725 3726
	return dentry;
fail:
3727 3728 3729
	dput(dentry);
	dentry = ERR_PTR(error);
unlock:
A
Al Viro 已提交
3730
	inode_unlock(path->dentry->d_inode);
3731
	if (!err2)
3732
		mnt_drop_write(path->mnt);
A
Al Viro 已提交
3733
out:
3734
	path_put(path);
L
Linus Torvalds 已提交
3735 3736
	return dentry;
}
3737

3738
struct dentry *kern_path_create(int dfd, const char *pathname,
3739 3740
				struct path *path, unsigned int lookup_flags)
{
3741 3742
	struct filename *filename = getname_kernel(pathname);
	struct dentry *res = filename_create(dfd, filename, path, lookup_flags);
3743

3744
	putname(filename);
3745 3746
	return res;
}
3747 3748
EXPORT_SYMBOL(kern_path_create);

A
Al Viro 已提交
3749 3750 3751
void done_path_create(struct path *path, struct dentry *dentry)
{
	dput(dentry);
A
Al Viro 已提交
3752
	inode_unlock(path->dentry->d_inode);
3753
	mnt_drop_write(path->mnt);
A
Al Viro 已提交
3754 3755 3756 3757
	path_put(path);
}
EXPORT_SYMBOL(done_path_create);

A
Al Viro 已提交
3758
inline struct dentry *user_path_create(int dfd, const char __user *pathname,
3759
				struct path *path, unsigned int lookup_flags)
3760
{
3761 3762 3763 3764 3765
	struct filename *filename = getname(pathname);
	struct dentry *res = filename_create(dfd, filename, path, lookup_flags);

	putname(filename);
	return res;
3766 3767 3768
}
EXPORT_SYMBOL(user_path_create);

3769 3770 3771 3772 3773 3774 3775 3776 3777 3778 3779 3780 3781 3782 3783 3784 3785 3786
/**
 * vfs_mknod - create device node or file
 * @mnt_userns:	user namespace of the mount the inode was found from
 * @dir:	inode of @dentry
 * @dentry:	pointer to dentry of the base directory
 * @mode:	mode of the new device node or file
 * @dev:	device number of device to create
 *
 * Create a device node or file.
 *
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
 */
int vfs_mknod(struct user_namespace *mnt_userns, struct inode *dir,
	      struct dentry *dentry, umode_t mode, dev_t dev)
L
Linus Torvalds 已提交
3787
{
3788
	bool is_whiteout = S_ISCHR(mode) && dev == WHITEOUT_DEV;
3789
	int error = may_create(mnt_userns, dir, dentry);
L
Linus Torvalds 已提交
3790 3791 3792 3793

	if (error)
		return error;

3794 3795
	if ((S_ISCHR(mode) || S_ISBLK(mode)) && !is_whiteout &&
	    !capable(CAP_MKNOD))
L
Linus Torvalds 已提交
3796 3797
		return -EPERM;

A
Al Viro 已提交
3798
	if (!dir->i_op->mknod)
L
Linus Torvalds 已提交
3799 3800
		return -EPERM;

3801 3802 3803 3804
	error = devcgroup_inode_mknod(mode, dev);
	if (error)
		return error;

L
Linus Torvalds 已提交
3805 3806 3807 3808
	error = security_inode_mknod(dir, dentry, mode, dev);
	if (error)
		return error;

3809
	error = dir->i_op->mknod(mnt_userns, dir, dentry, mode, dev);
3810
	if (!error)
3811
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
3812 3813
	return error;
}
3814
EXPORT_SYMBOL(vfs_mknod);
L
Linus Torvalds 已提交
3815

A
Al Viro 已提交
3816
static int may_mknod(umode_t mode)
3817 3818 3819 3820 3821 3822 3823 3824 3825 3826 3827 3828 3829 3830 3831 3832
{
	switch (mode & S_IFMT) {
	case S_IFREG:
	case S_IFCHR:
	case S_IFBLK:
	case S_IFIFO:
	case S_IFSOCK:
	case 0: /* zero mode translates to S_IFREG */
		return 0;
	case S_IFDIR:
		return -EPERM;
	default:
		return -EINVAL;
	}
}

3833
static int do_mknodat(int dfd, struct filename *name, umode_t mode,
3834
		unsigned int dev)
L
Linus Torvalds 已提交
3835
{
3836
	struct user_namespace *mnt_userns;
3837
	struct dentry *dentry;
3838 3839
	struct path path;
	int error;
3840
	unsigned int lookup_flags = 0;
L
Linus Torvalds 已提交
3841

3842 3843
	error = may_mknod(mode);
	if (error)
3844
		goto out1;
3845
retry:
3846
	dentry = filename_create(dfd, name, &path, lookup_flags);
3847
	error = PTR_ERR(dentry);
3848
	if (IS_ERR(dentry))
3849
		goto out1;
3850

3851
	if (!IS_POSIXACL(path.dentry->d_inode))
A
Al Viro 已提交
3852
		mode &= ~current_umask();
3853
	error = security_path_mknod(&path, dentry, mode, dev);
3854
	if (error)
3855
		goto out2;
3856 3857

	mnt_userns = mnt_user_ns(path.mnt);
3858
	switch (mode & S_IFMT) {
L
Linus Torvalds 已提交
3859
		case 0: case S_IFREG:
3860 3861
			error = vfs_create(mnt_userns, path.dentry->d_inode,
					   dentry, mode, true);
3862
			if (!error)
3863
				ima_post_path_mknod(mnt_userns, dentry);
L
Linus Torvalds 已提交
3864 3865
			break;
		case S_IFCHR: case S_IFBLK:
3866 3867
			error = vfs_mknod(mnt_userns, path.dentry->d_inode,
					  dentry, mode, new_decode_dev(dev));
L
Linus Torvalds 已提交
3868 3869
			break;
		case S_IFIFO: case S_IFSOCK:
3870 3871
			error = vfs_mknod(mnt_userns, path.dentry->d_inode,
					  dentry, mode, 0);
L
Linus Torvalds 已提交
3872 3873
			break;
	}
3874
out2:
A
Al Viro 已提交
3875
	done_path_create(&path, dentry);
3876 3877 3878 3879
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
3880 3881
out1:
	putname(name);
L
Linus Torvalds 已提交
3882 3883 3884
	return error;
}

3885 3886 3887
SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
		unsigned int, dev)
{
3888
	return do_mknodat(dfd, getname(filename), mode, dev);
3889 3890
}

3891
SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3892
{
3893
	return do_mknodat(AT_FDCWD, getname(filename), mode, dev);
3894 3895
}

3896 3897 3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909 3910 3911 3912
/**
 * vfs_mkdir - create directory
 * @mnt_userns:	user namespace of the mount the inode was found from
 * @dir:	inode of @dentry
 * @dentry:	pointer to dentry of the base directory
 * @mode:	mode of the new directory
 *
 * Create a directory.
 *
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
 */
int vfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir,
	      struct dentry *dentry, umode_t mode)
L
Linus Torvalds 已提交
3913
{
3914
	int error = may_create(mnt_userns, dir, dentry);
3915
	unsigned max_links = dir->i_sb->s_max_links;
L
Linus Torvalds 已提交
3916 3917 3918 3919

	if (error)
		return error;

A
Al Viro 已提交
3920
	if (!dir->i_op->mkdir)
L
Linus Torvalds 已提交
3921 3922 3923 3924 3925 3926 3927
		return -EPERM;

	mode &= (S_IRWXUGO|S_ISVTX);
	error = security_inode_mkdir(dir, dentry, mode);
	if (error)
		return error;

3928 3929 3930
	if (max_links && dir->i_nlink >= max_links)
		return -EMLINK;

3931
	error = dir->i_op->mkdir(mnt_userns, dir, dentry, mode);
3932
	if (!error)
3933
		fsnotify_mkdir(dir, dentry);
L
Linus Torvalds 已提交
3934 3935
	return error;
}
3936
EXPORT_SYMBOL(vfs_mkdir);
L
Linus Torvalds 已提交
3937

3938
int do_mkdirat(int dfd, struct filename *name, umode_t mode)
L
Linus Torvalds 已提交
3939
{
3940
	struct dentry *dentry;
3941 3942
	struct path path;
	int error;
3943
	unsigned int lookup_flags = LOOKUP_DIRECTORY;
L
Linus Torvalds 已提交
3944

3945
retry:
3946
	dentry = filename_create(dfd, name, &path, lookup_flags);
3947
	error = PTR_ERR(dentry);
3948
	if (IS_ERR(dentry))
3949
		goto out_putname;
L
Linus Torvalds 已提交
3950

3951
	if (!IS_POSIXACL(path.dentry->d_inode))
A
Al Viro 已提交
3952
		mode &= ~current_umask();
3953
	error = security_path_mkdir(&path, dentry, mode);
3954 3955 3956
	if (!error) {
		struct user_namespace *mnt_userns;
		mnt_userns = mnt_user_ns(path.mnt);
3957 3958
		error = vfs_mkdir(mnt_userns, path.dentry->d_inode, dentry,
				  mode);
3959
	}
A
Al Viro 已提交
3960
	done_path_create(&path, dentry);
3961 3962 3963 3964
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
3965 3966
out_putname:
	putname(name);
L
Linus Torvalds 已提交
3967 3968 3969
	return error;
}

3970 3971
SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
{
3972
	return do_mkdirat(dfd, getname(pathname), mode);
3973 3974
}

3975
SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
3976
{
3977
	return do_mkdirat(AT_FDCWD, getname(pathname), mode);
3978 3979
}

3980 3981 3982 3983 3984 3985 3986 3987 3988 3989 3990 3991 3992 3993 3994 3995
/**
 * vfs_rmdir - remove directory
 * @mnt_userns:	user namespace of the mount the inode was found from
 * @dir:	inode of @dentry
 * @dentry:	pointer to dentry of the base directory
 *
 * Remove a directory.
 *
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
 */
int vfs_rmdir(struct user_namespace *mnt_userns, struct inode *dir,
		     struct dentry *dentry)
L
Linus Torvalds 已提交
3996
{
3997
	int error = may_delete(mnt_userns, dir, dentry, 1);
L
Linus Torvalds 已提交
3998 3999 4000 4001

	if (error)
		return error;

A
Al Viro 已提交
4002
	if (!dir->i_op->rmdir)
L
Linus Torvalds 已提交
4003 4004
		return -EPERM;

4005
	dget(dentry);
A
Al Viro 已提交
4006
	inode_lock(dentry->d_inode);
S
Sage Weil 已提交
4007 4008

	error = -EBUSY;
4009 4010
	if (is_local_mountpoint(dentry) ||
	    (dentry->d_inode->i_flags & S_KERNEL_FILE))
S
Sage Weil 已提交
4011 4012 4013 4014 4015 4016 4017 4018 4019 4020
		goto out;

	error = security_inode_rmdir(dir, dentry);
	if (error)
		goto out;

	error = dir->i_op->rmdir(dir, dentry);
	if (error)
		goto out;

4021
	shrink_dcache_parent(dentry);
S
Sage Weil 已提交
4022 4023
	dentry->d_inode->i_flags |= S_DEAD;
	dont_mount(dentry);
4024
	detach_mounts(dentry);
S
Sage Weil 已提交
4025 4026

out:
A
Al Viro 已提交
4027
	inode_unlock(dentry->d_inode);
4028
	dput(dentry);
S
Sage Weil 已提交
4029
	if (!error)
4030
		d_delete_notify(dir, dentry);
L
Linus Torvalds 已提交
4031 4032
	return error;
}
4033
EXPORT_SYMBOL(vfs_rmdir);
L
Linus Torvalds 已提交
4034

4035
int do_rmdir(int dfd, struct filename *name)
L
Linus Torvalds 已提交
4036
{
4037
	struct user_namespace *mnt_userns;
4038
	int error;
L
Linus Torvalds 已提交
4039
	struct dentry *dentry;
4040 4041 4042
	struct path path;
	struct qstr last;
	int type;
4043 4044
	unsigned int lookup_flags = 0;
retry:
4045
	error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4046 4047
	if (error)
		goto exit1;
L
Linus Torvalds 已提交
4048

4049
	switch (type) {
4050 4051
	case LAST_DOTDOT:
		error = -ENOTEMPTY;
4052
		goto exit2;
4053 4054
	case LAST_DOT:
		error = -EINVAL;
4055
		goto exit2;
4056 4057
	case LAST_ROOT:
		error = -EBUSY;
4058
		goto exit2;
L
Linus Torvalds 已提交
4059
	}
4060

4061
	error = mnt_want_write(path.mnt);
4062
	if (error)
4063
		goto exit2;
4064

A
Al Viro 已提交
4065
	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4066
	dentry = __lookup_hash(&last, path.dentry, lookup_flags);
L
Linus Torvalds 已提交
4067
	error = PTR_ERR(dentry);
4068
	if (IS_ERR(dentry))
4069
		goto exit3;
4070 4071
	if (!dentry->d_inode) {
		error = -ENOENT;
4072
		goto exit4;
4073
	}
4074
	error = security_path_rmdir(&path, dentry);
4075
	if (error)
4076
		goto exit4;
4077 4078
	mnt_userns = mnt_user_ns(path.mnt);
	error = vfs_rmdir(mnt_userns, path.dentry->d_inode, dentry);
4079
exit4:
4080
	dput(dentry);
4081
exit3:
A
Al Viro 已提交
4082
	inode_unlock(path.dentry->d_inode);
4083
	mnt_drop_write(path.mnt);
4084
exit2:
4085
	path_put(&path);
4086 4087 4088 4089
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
4090
exit1:
A
Al Viro 已提交
4091
	putname(name);
L
Linus Torvalds 已提交
4092 4093 4094
	return error;
}

4095
SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
4096
{
4097
	return do_rmdir(AT_FDCWD, getname(pathname));
4098 4099
}

4100 4101
/**
 * vfs_unlink - unlink a filesystem object
4102
 * @mnt_userns:	user namespace of the mount the inode was found from
4103 4104 4105 4106 4107 4108 4109 4110 4111 4112 4113 4114 4115 4116 4117
 * @dir:	parent directory
 * @dentry:	victim
 * @delegated_inode: returns victim inode, if the inode is delegated.
 *
 * The caller must hold dir->i_mutex.
 *
 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and
 * return a reference to the inode in delegated_inode.  The caller
 * should then break the delegation on that inode and retry.  Because
 * breaking a delegation may take a long time, the caller should drop
 * dir->i_mutex before doing so.
 *
 * Alternatively, a caller may pass NULL for delegated_inode.  This may
 * be appropriate for callers that expect the underlying filesystem not
 * to be NFS exported.
4118 4119 4120 4121 4122 4123
 *
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
4124
 */
4125 4126
int vfs_unlink(struct user_namespace *mnt_userns, struct inode *dir,
	       struct dentry *dentry, struct inode **delegated_inode)
L
Linus Torvalds 已提交
4127
{
4128
	struct inode *target = dentry->d_inode;
4129
	int error = may_delete(mnt_userns, dir, dentry, 0);
L
Linus Torvalds 已提交
4130 4131 4132 4133

	if (error)
		return error;

A
Al Viro 已提交
4134
	if (!dir->i_op->unlink)
L
Linus Torvalds 已提交
4135 4136
		return -EPERM;

A
Al Viro 已提交
4137
	inode_lock(target);
4138 4139 4140
	if (IS_SWAPFILE(target))
		error = -EPERM;
	else if (is_local_mountpoint(dentry))
L
Linus Torvalds 已提交
4141 4142 4143
		error = -EBUSY;
	else {
		error = security_inode_unlink(dir, dentry);
4144
		if (!error) {
4145 4146
			error = try_break_deleg(target, delegated_inode);
			if (error)
4147
				goto out;
L
Linus Torvalds 已提交
4148
			error = dir->i_op->unlink(dir, dentry);
4149
			if (!error) {
4150
				dont_mount(dentry);
4151 4152
				detach_mounts(dentry);
			}
4153
		}
L
Linus Torvalds 已提交
4154
	}
4155
out:
A
Al Viro 已提交
4156
	inode_unlock(target);
L
Linus Torvalds 已提交
4157 4158

	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
4159 4160 4161
	if (!error && dentry->d_flags & DCACHE_NFSFS_RENAMED) {
		fsnotify_unlink(dir, dentry);
	} else if (!error) {
4162
		fsnotify_link_count(target);
4163
		d_delete_notify(dir, dentry);
L
Linus Torvalds 已提交
4164
	}
R
Robert Love 已提交
4165

L
Linus Torvalds 已提交
4166 4167
	return error;
}
4168
EXPORT_SYMBOL(vfs_unlink);
L
Linus Torvalds 已提交
4169 4170 4171

/*
 * Make sure that the actual truncation of the file will occur outside its
4172
 * directory's i_mutex.  Truncate can take a long time if there is a lot of
L
Linus Torvalds 已提交
4173 4174 4175
 * writeout happening, and we don't want to prevent access to the directory
 * while waiting on the I/O.
 */
4176
int do_unlinkat(int dfd, struct filename *name)
L
Linus Torvalds 已提交
4177
{
4178
	int error;
L
Linus Torvalds 已提交
4179
	struct dentry *dentry;
4180 4181 4182
	struct path path;
	struct qstr last;
	int type;
L
Linus Torvalds 已提交
4183
	struct inode *inode = NULL;
4184
	struct inode *delegated_inode = NULL;
4185 4186
	unsigned int lookup_flags = 0;
retry:
4187
	error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4188 4189
	if (error)
		goto exit1;
4190

L
Linus Torvalds 已提交
4191
	error = -EISDIR;
4192
	if (type != LAST_NORM)
4193
		goto exit2;
4194

4195
	error = mnt_want_write(path.mnt);
4196
	if (error)
4197
		goto exit2;
4198
retry_deleg:
A
Al Viro 已提交
4199
	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4200
	dentry = __lookup_hash(&last, path.dentry, lookup_flags);
L
Linus Torvalds 已提交
4201 4202
	error = PTR_ERR(dentry);
	if (!IS_ERR(dentry)) {
4203 4204
		struct user_namespace *mnt_userns;

L
Linus Torvalds 已提交
4205
		/* Why not before? Because we want correct error value */
4206
		if (last.name[last.len])
4207
			goto slashes;
L
Linus Torvalds 已提交
4208
		inode = dentry->d_inode;
4209
		if (d_is_negative(dentry))
4210 4211
			goto slashes;
		ihold(inode);
4212
		error = security_path_unlink(&path, dentry);
4213
		if (error)
4214
			goto exit3;
4215
		mnt_userns = mnt_user_ns(path.mnt);
4216 4217
		error = vfs_unlink(mnt_userns, path.dentry->d_inode, dentry,
				   &delegated_inode);
4218
exit3:
L
Linus Torvalds 已提交
4219 4220
		dput(dentry);
	}
A
Al Viro 已提交
4221
	inode_unlock(path.dentry->d_inode);
L
Linus Torvalds 已提交
4222 4223
	if (inode)
		iput(inode);	/* truncate the inode here */
4224 4225
	inode = NULL;
	if (delegated_inode) {
4226
		error = break_deleg_wait(&delegated_inode);
4227 4228 4229
		if (!error)
			goto retry_deleg;
	}
4230
	mnt_drop_write(path.mnt);
4231
exit2:
4232
	path_put(&path);
4233 4234 4235 4236 4237
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		inode = NULL;
		goto retry;
	}
4238
exit1:
4239
	putname(name);
L
Linus Torvalds 已提交
4240 4241 4242
	return error;

slashes:
4243 4244
	if (d_is_negative(dentry))
		error = -ENOENT;
M
Miklos Szeredi 已提交
4245
	else if (d_is_dir(dentry))
4246 4247 4248
		error = -EISDIR;
	else
		error = -ENOTDIR;
4249
	goto exit3;
L
Linus Torvalds 已提交
4250 4251
}

4252
SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
4253 4254 4255 4256 4257
{
	if ((flag & ~AT_REMOVEDIR) != 0)
		return -EINVAL;

	if (flag & AT_REMOVEDIR)
4258
		return do_rmdir(dfd, getname(pathname));
4259
	return do_unlinkat(dfd, getname(pathname));
4260 4261
}

4262
SYSCALL_DEFINE1(unlink, const char __user *, pathname)
4263
{
4264
	return do_unlinkat(AT_FDCWD, getname(pathname));
4265 4266
}

4267 4268 4269 4270 4271 4272 4273 4274 4275 4276 4277 4278 4279 4280 4281 4282 4283
/**
 * vfs_symlink - create symlink
 * @mnt_userns:	user namespace of the mount the inode was found from
 * @dir:	inode of @dentry
 * @dentry:	pointer to dentry of the base directory
 * @oldname:	name of the file to link to
 *
 * Create a symlink.
 *
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
 */
int vfs_symlink(struct user_namespace *mnt_userns, struct inode *dir,
		struct dentry *dentry, const char *oldname)
L
Linus Torvalds 已提交
4284
{
4285
	int error = may_create(mnt_userns, dir, dentry);
L
Linus Torvalds 已提交
4286 4287 4288 4289

	if (error)
		return error;

A
Al Viro 已提交
4290
	if (!dir->i_op->symlink)
L
Linus Torvalds 已提交
4291 4292 4293 4294 4295 4296
		return -EPERM;

	error = security_inode_symlink(dir, dentry, oldname);
	if (error)
		return error;

4297
	error = dir->i_op->symlink(mnt_userns, dir, dentry, oldname);
4298
	if (!error)
4299
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
4300 4301
	return error;
}
4302
EXPORT_SYMBOL(vfs_symlink);
L
Linus Torvalds 已提交
4303

4304
int do_symlinkat(struct filename *from, int newdfd, struct filename *to)
L
Linus Torvalds 已提交
4305
{
4306
	int error;
4307
	struct dentry *dentry;
4308
	struct path path;
4309
	unsigned int lookup_flags = 0;
L
Linus Torvalds 已提交
4310

4311 4312 4313 4314
	if (IS_ERR(from)) {
		error = PTR_ERR(from);
		goto out_putnames;
	}
4315
retry:
4316
	dentry = filename_create(newdfd, to, &path, lookup_flags);
4317 4318
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry))
4319
		goto out_putnames;
4320

4321
	error = security_path_symlink(&path, dentry, from->name);
4322 4323 4324 4325 4326 4327 4328
	if (!error) {
		struct user_namespace *mnt_userns;

		mnt_userns = mnt_user_ns(path.mnt);
		error = vfs_symlink(mnt_userns, path.dentry->d_inode, dentry,
				    from->name);
	}
A
Al Viro 已提交
4329
	done_path_create(&path, dentry);
4330 4331 4332 4333
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
4334 4335
out_putnames:
	putname(to);
L
Linus Torvalds 已提交
4336 4337 4338 4339
	putname(from);
	return error;
}

4340 4341 4342
SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
{
4343
	return do_symlinkat(getname(oldname), newdfd, getname(newname));
4344 4345
}

4346
SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
4347
{
4348
	return do_symlinkat(getname(oldname), AT_FDCWD, getname(newname));
4349 4350
}

4351 4352 4353
/**
 * vfs_link - create a new link
 * @old_dentry:	object to be linked
4354
 * @mnt_userns:	the user namespace of the mount
4355 4356 4357 4358 4359 4360 4361 4362 4363 4364 4365 4366 4367 4368 4369
 * @dir:	new parent
 * @new_dentry:	where to create the new link
 * @delegated_inode: returns inode needing a delegation break
 *
 * The caller must hold dir->i_mutex
 *
 * If vfs_link discovers a delegation on the to-be-linked file in need
 * of breaking, it will return -EWOULDBLOCK and return a reference to the
 * inode in delegated_inode.  The caller should then break the delegation
 * and retry.  Because breaking a delegation may take a long time, the
 * caller should drop the i_mutex before doing so.
 *
 * Alternatively, a caller may pass NULL for delegated_inode.  This may
 * be appropriate for callers that expect the underlying filesystem not
 * to be NFS exported.
4370 4371 4372 4373 4374 4375
 *
 * If the inode has been found through an idmapped mount the user namespace of
 * the vfsmount must be passed through @mnt_userns. This function will then take
 * care to map the inode according to @mnt_userns before checking permissions.
 * On non-idmapped mounts or if permission checking is to be performed on the
 * raw inode simply passs init_user_ns.
4376
 */
4377 4378 4379
int vfs_link(struct dentry *old_dentry, struct user_namespace *mnt_userns,
	     struct inode *dir, struct dentry *new_dentry,
	     struct inode **delegated_inode)
L
Linus Torvalds 已提交
4380 4381
{
	struct inode *inode = old_dentry->d_inode;
4382
	unsigned max_links = dir->i_sb->s_max_links;
L
Linus Torvalds 已提交
4383 4384 4385 4386 4387
	int error;

	if (!inode)
		return -ENOENT;

4388
	error = may_create(mnt_userns, dir, new_dentry);
L
Linus Torvalds 已提交
4389 4390 4391 4392 4393 4394 4395 4396 4397 4398 4399
	if (error)
		return error;

	if (dir->i_sb != inode->i_sb)
		return -EXDEV;

	/*
	 * A link to an append-only or immutable file cannot be created.
	 */
	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
		return -EPERM;
4400 4401 4402 4403 4404
	/*
	 * Updating the link count will likely cause i_uid and i_gid to
	 * be writen back improperly if their true value is unknown to
	 * the vfs.
	 */
4405
	if (HAS_UNMAPPED_ID(mnt_userns, inode))
4406
		return -EPERM;
A
Al Viro 已提交
4407
	if (!dir->i_op->link)
L
Linus Torvalds 已提交
4408
		return -EPERM;
4409
	if (S_ISDIR(inode->i_mode))
L
Linus Torvalds 已提交
4410 4411 4412 4413 4414 4415
		return -EPERM;

	error = security_inode_link(old_dentry, dir, new_dentry);
	if (error)
		return error;

A
Al Viro 已提交
4416
	inode_lock(inode);
4417
	/* Make sure we don't allow creating hardlink to an unlinked file */
4418
	if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
4419
		error =  -ENOENT;
4420 4421
	else if (max_links && inode->i_nlink >= max_links)
		error = -EMLINK;
4422 4423 4424 4425 4426
	else {
		error = try_break_deleg(inode, delegated_inode);
		if (!error)
			error = dir->i_op->link(old_dentry, dir, new_dentry);
	}
4427 4428 4429 4430 4431 4432

	if (!error && (inode->i_state & I_LINKABLE)) {
		spin_lock(&inode->i_lock);
		inode->i_state &= ~I_LINKABLE;
		spin_unlock(&inode->i_lock);
	}
A
Al Viro 已提交
4433
	inode_unlock(inode);
4434
	if (!error)
4435
		fsnotify_link(dir, inode, new_dentry);
L
Linus Torvalds 已提交
4436 4437
	return error;
}
4438
EXPORT_SYMBOL(vfs_link);
L
Linus Torvalds 已提交
4439 4440 4441 4442 4443 4444 4445 4446 4447 4448

/*
 * Hardlinks are often used in delicate situations.  We avoid
 * security-related surprises by not following symlinks on the
 * newname.  --KAB
 *
 * We don't follow them on the oldname either to be compatible
 * with linux 2.0, and to avoid hard-linking to directories
 * and other special files.  --ADM
 */
4449
int do_linkat(int olddfd, struct filename *old, int newdfd,
4450
	      struct filename *new, int flags)
L
Linus Torvalds 已提交
4451
{
4452
	struct user_namespace *mnt_userns;
L
Linus Torvalds 已提交
4453
	struct dentry *new_dentry;
4454
	struct path old_path, new_path;
4455
	struct inode *delegated_inode = NULL;
4456
	int how = 0;
L
Linus Torvalds 已提交
4457 4458
	int error;

4459 4460 4461 4462
	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) {
		error = -EINVAL;
		goto out_putnames;
	}
4463
	/*
4464 4465 4466
	 * To use null names we require CAP_DAC_READ_SEARCH
	 * This ensures that not everyone will be able to create
	 * handlink using the passed filedescriptor.
4467
	 */
4468 4469 4470
	if (flags & AT_EMPTY_PATH && !capable(CAP_DAC_READ_SEARCH)) {
		error = -ENOENT;
		goto out_putnames;
4471
	}
4472 4473 4474

	if (flags & AT_SYMLINK_FOLLOW)
		how |= LOOKUP_FOLLOW;
4475
retry:
4476
	error = filename_lookup(olddfd, old, how, &old_path, NULL);
L
Linus Torvalds 已提交
4477
	if (error)
4478
		goto out_putnames;
4479

4480
	new_dentry = filename_create(newdfd, new, &new_path,
4481
					(how & LOOKUP_REVAL));
L
Linus Torvalds 已提交
4482
	error = PTR_ERR(new_dentry);
4483
	if (IS_ERR(new_dentry))
4484
		goto out_putpath;
4485 4486 4487 4488

	error = -EXDEV;
	if (old_path.mnt != new_path.mnt)
		goto out_dput;
4489 4490
	mnt_userns = mnt_user_ns(new_path.mnt);
	error = may_linkat(mnt_userns, &old_path);
K
Kees Cook 已提交
4491 4492
	if (unlikely(error))
		goto out_dput;
4493
	error = security_path_link(old_path.dentry, &new_path, new_dentry);
4494
	if (error)
4495
		goto out_dput;
4496 4497
	error = vfs_link(old_path.dentry, mnt_userns, new_path.dentry->d_inode,
			 new_dentry, &delegated_inode);
4498
out_dput:
A
Al Viro 已提交
4499
	done_path_create(&new_path, new_dentry);
4500 4501
	if (delegated_inode) {
		error = break_deleg_wait(&delegated_inode);
4502 4503
		if (!error) {
			path_put(&old_path);
4504
			goto retry;
4505
		}
4506
	}
4507
	if (retry_estale(error, how)) {
4508
		path_put(&old_path);
4509 4510 4511
		how |= LOOKUP_REVAL;
		goto retry;
	}
4512
out_putpath:
4513
	path_put(&old_path);
4514 4515 4516
out_putnames:
	putname(old);
	putname(new);
L
Linus Torvalds 已提交
4517 4518 4519 4520

	return error;
}

4521 4522 4523
SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname, int, flags)
{
4524 4525
	return do_linkat(olddfd, getname_uflags(oldname, flags),
		newdfd, getname(newname), flags);
4526 4527
}

4528
SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
4529
{
4530
	return do_linkat(AT_FDCWD, getname(oldname), AT_FDCWD, getname(newname), 0);
4531 4532
}

4533 4534
/**
 * vfs_rename - rename a filesystem object
4535
 * @rd:		pointer to &struct renamedata info
4536 4537 4538 4539 4540 4541 4542 4543 4544 4545 4546 4547 4548 4549
 *
 * The caller must hold multiple mutexes--see lock_rename()).
 *
 * If vfs_rename discovers a delegation in need of breaking at either
 * the source or destination, it will return -EWOULDBLOCK and return a
 * reference to the inode in delegated_inode.  The caller should then
 * break the delegation and retry.  Because breaking a delegation may
 * take a long time, the caller should drop all locks before doing
 * so.
 *
 * Alternatively, a caller may pass NULL for delegated_inode.  This may
 * be appropriate for callers that expect the underlying filesystem not
 * to be NFS exported.
 *
L
Linus Torvalds 已提交
4550 4551 4552
 * The worst of all namespace operations - renaming directory. "Perverted"
 * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
 * Problems:
4553
 *
4554
 *	a) we can get into loop creation.
L
Linus Torvalds 已提交
4555 4556
 *	b) race potential - two innocent renames can create a loop together.
 *	   That's where 4.4 screws up. Current fix: serialization on
4557
 *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
L
Linus Torvalds 已提交
4558
 *	   story.
4559 4560
 *	c) we have to lock _four_ objects - parents and victim (if it exists),
 *	   and source (if it is not a directory).
4561
 *	   And that - after we got ->i_mutex on parents (until then we don't know
L
Linus Torvalds 已提交
4562 4563
 *	   whether the target exists).  Solution: try to be smart with locking
 *	   order for inodes.  We rely on the fact that tree topology may change
4564
 *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
L
Linus Torvalds 已提交
4565 4566 4567
 *	   move will be locked.  Thus we can rank directories by the tree
 *	   (ancestors first) and rank all non-directories after them.
 *	   That works since everybody except rename does "lock parent, lookup,
4568
 *	   lock child" and rename is under ->s_vfs_rename_mutex.
L
Linus Torvalds 已提交
4569 4570 4571
 *	   HOWEVER, it relies on the assumption that any object with ->lookup()
 *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
 *	   we'd better make sure that there's no link(2) for them.
4572
 *	d) conversion from fhandle to dentry may come in the wrong moment - when
4573
 *	   we are removing the target. Solution: we will have to grab ->i_mutex
L
Linus Torvalds 已提交
4574
 *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
4575
 *	   ->i_mutex on parents, which works but leads to some truly excessive
L
Linus Torvalds 已提交
4576 4577
 *	   locking].
 */
4578
int vfs_rename(struct renamedata *rd)
L
Linus Torvalds 已提交
4579
{
4580
	int error;
4581 4582 4583 4584 4585
	struct inode *old_dir = rd->old_dir, *new_dir = rd->new_dir;
	struct dentry *old_dentry = rd->old_dentry;
	struct dentry *new_dentry = rd->new_dentry;
	struct inode **delegated_inode = rd->delegated_inode;
	unsigned int flags = rd->flags;
4586 4587
	bool is_dir = d_is_dir(old_dentry);
	struct inode *source = old_dentry->d_inode;
S
Sage Weil 已提交
4588
	struct inode *target = new_dentry->d_inode;
M
Miklos Szeredi 已提交
4589 4590
	bool new_is_dir = false;
	unsigned max_links = new_dir->i_sb->s_max_links;
A
Al Viro 已提交
4591
	struct name_snapshot old_name;
4592

4593
	if (source == target)
4594 4595
		return 0;

4596
	error = may_delete(rd->old_mnt_userns, old_dir, old_dentry, is_dir);
4597 4598 4599
	if (error)
		return error;

M
Miklos Szeredi 已提交
4600
	if (!target) {
4601
		error = may_create(rd->new_mnt_userns, new_dir, new_dentry);
M
Miklos Szeredi 已提交
4602 4603 4604 4605
	} else {
		new_is_dir = d_is_dir(new_dentry);

		if (!(flags & RENAME_EXCHANGE))
4606 4607
			error = may_delete(rd->new_mnt_userns, new_dir,
					   new_dentry, is_dir);
M
Miklos Szeredi 已提交
4608
		else
4609 4610
			error = may_delete(rd->new_mnt_userns, new_dir,
					   new_dentry, new_is_dir);
M
Miklos Szeredi 已提交
4611
	}
4612 4613 4614
	if (error)
		return error;

4615
	if (!old_dir->i_op->rename)
4616
		return -EPERM;
L
Linus Torvalds 已提交
4617 4618 4619 4620 4621

	/*
	 * If we are going to change the parent - check write permissions,
	 * we'll need to flip '..'.
	 */
M
Miklos Szeredi 已提交
4622 4623
	if (new_dir != old_dir) {
		if (is_dir) {
4624
			error = inode_permission(rd->old_mnt_userns, source,
4625
						 MAY_WRITE);
M
Miklos Szeredi 已提交
4626 4627 4628 4629
			if (error)
				return error;
		}
		if ((flags & RENAME_EXCHANGE) && new_is_dir) {
4630
			error = inode_permission(rd->new_mnt_userns, target,
4631
						 MAY_WRITE);
M
Miklos Szeredi 已提交
4632 4633 4634
			if (error)
				return error;
		}
L
Linus Torvalds 已提交
4635 4636
	}

4637 4638
	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
				      flags);
L
Linus Torvalds 已提交
4639 4640 4641
	if (error)
		return error;

A
Al Viro 已提交
4642
	take_dentry_name_snapshot(&old_name, old_dentry);
4643
	dget(new_dentry);
M
Miklos Szeredi 已提交
4644
	if (!is_dir || (flags & RENAME_EXCHANGE))
4645 4646
		lock_two_nondirectories(source, target);
	else if (target)
A
Al Viro 已提交
4647
		inode_lock(target);
S
Sage Weil 已提交
4648

4649 4650 4651 4652
	error = -EPERM;
	if (IS_SWAPFILE(source) || (target && IS_SWAPFILE(target)))
		goto out;

S
Sage Weil 已提交
4653
	error = -EBUSY;
4654
	if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
S
Sage Weil 已提交
4655 4656
		goto out;

M
Miklos Szeredi 已提交
4657
	if (max_links && new_dir != old_dir) {
4658
		error = -EMLINK;
M
Miklos Szeredi 已提交
4659
		if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
4660
			goto out;
M
Miklos Szeredi 已提交
4661 4662 4663 4664 4665
		if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
		    old_dir->i_nlink >= max_links)
			goto out;
	}
	if (!is_dir) {
4666
		error = try_break_deleg(source, delegated_inode);
4667 4668
		if (error)
			goto out;
M
Miklos Szeredi 已提交
4669 4670 4671 4672 4673
	}
	if (target && !new_is_dir) {
		error = try_break_deleg(target, delegated_inode);
		if (error)
			goto out;
4674
	}
4675 4676
	error = old_dir->i_op->rename(rd->new_mnt_userns, old_dir, old_dentry,
				      new_dir, new_dentry, flags);
4677 4678 4679
	if (error)
		goto out;

M
Miklos Szeredi 已提交
4680
	if (!(flags & RENAME_EXCHANGE) && target) {
4681 4682
		if (is_dir) {
			shrink_dcache_parent(new_dentry);
4683
			target->i_flags |= S_DEAD;
4684
		}
4685
		dont_mount(new_dentry);
4686
		detach_mounts(new_dentry);
4687
	}
M
Miklos Szeredi 已提交
4688 4689 4690 4691 4692 4693
	if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
		if (!(flags & RENAME_EXCHANGE))
			d_move(old_dentry, new_dentry);
		else
			d_exchange(old_dentry, new_dentry);
	}
4694
out:
M
Miklos Szeredi 已提交
4695
	if (!is_dir || (flags & RENAME_EXCHANGE))
4696 4697
		unlock_two_nondirectories(source, target);
	else if (target)
A
Al Viro 已提交
4698
		inode_unlock(target);
L
Linus Torvalds 已提交
4699
	dput(new_dentry);
M
Miklos Szeredi 已提交
4700
	if (!error) {
4701
		fsnotify_move(old_dir, new_dir, &old_name.name, is_dir,
M
Miklos Szeredi 已提交
4702 4703
			      !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
		if (flags & RENAME_EXCHANGE) {
4704
			fsnotify_move(new_dir, old_dir, &old_dentry->d_name,
M
Miklos Szeredi 已提交
4705 4706 4707
				      new_is_dir, NULL, new_dentry);
		}
	}
A
Al Viro 已提交
4708
	release_dentry_name_snapshot(&old_name);
R
Robert Love 已提交
4709

L
Linus Torvalds 已提交
4710 4711
	return error;
}
4712
EXPORT_SYMBOL(vfs_rename);
L
Linus Torvalds 已提交
4713

4714 4715
int do_renameat2(int olddfd, struct filename *from, int newdfd,
		 struct filename *to, unsigned int flags)
L
Linus Torvalds 已提交
4716
{
4717
	struct renamedata rd;
4718 4719
	struct dentry *old_dentry, *new_dentry;
	struct dentry *trap;
4720 4721 4722
	struct path old_path, new_path;
	struct qstr old_last, new_last;
	int old_type, new_type;
4723
	struct inode *delegated_inode = NULL;
4724
	unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
4725
	bool should_retry = false;
4726
	int error = -EINVAL;
4727

M
Miklos Szeredi 已提交
4728
	if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
4729
		goto put_names;
M
Miklos Szeredi 已提交
4730

M
Miklos Szeredi 已提交
4731 4732
	if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
	    (flags & RENAME_EXCHANGE))
4733
		goto put_names;
4734

4735 4736 4737
	if (flags & RENAME_EXCHANGE)
		target_flags = 0;

4738
retry:
4739 4740
	error = filename_parentat(olddfd, from, lookup_flags, &old_path,
				  &old_last, &old_type);
4741 4742
	if (error)
		goto put_names;
L
Linus Torvalds 已提交
4743

4744 4745
	error = filename_parentat(newdfd, to, lookup_flags, &new_path, &new_last,
				  &new_type);
4746
	if (error)
L
Linus Torvalds 已提交
4747 4748 4749
		goto exit1;

	error = -EXDEV;
4750
	if (old_path.mnt != new_path.mnt)
L
Linus Torvalds 已提交
4751 4752 4753
		goto exit2;

	error = -EBUSY;
4754
	if (old_type != LAST_NORM)
L
Linus Torvalds 已提交
4755 4756
		goto exit2;

4757 4758
	if (flags & RENAME_NOREPLACE)
		error = -EEXIST;
4759
	if (new_type != LAST_NORM)
L
Linus Torvalds 已提交
4760 4761
		goto exit2;

4762
	error = mnt_want_write(old_path.mnt);
4763 4764 4765
	if (error)
		goto exit2;

4766
retry_deleg:
4767
	trap = lock_rename(new_path.dentry, old_path.dentry);
L
Linus Torvalds 已提交
4768

4769
	old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags);
L
Linus Torvalds 已提交
4770 4771 4772 4773 4774
	error = PTR_ERR(old_dentry);
	if (IS_ERR(old_dentry))
		goto exit3;
	/* source must exist */
	error = -ENOENT;
4775
	if (d_is_negative(old_dentry))
L
Linus Torvalds 已提交
4776
		goto exit4;
4777
	new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags);
4778 4779 4780 4781 4782 4783
	error = PTR_ERR(new_dentry);
	if (IS_ERR(new_dentry))
		goto exit4;
	error = -EEXIST;
	if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
		goto exit5;
M
Miklos Szeredi 已提交
4784 4785 4786 4787 4788 4789 4790
	if (flags & RENAME_EXCHANGE) {
		error = -ENOENT;
		if (d_is_negative(new_dentry))
			goto exit5;

		if (!d_is_dir(new_dentry)) {
			error = -ENOTDIR;
4791
			if (new_last.name[new_last.len])
M
Miklos Szeredi 已提交
4792 4793 4794
				goto exit5;
		}
	}
L
Linus Torvalds 已提交
4795
	/* unless the source is a directory trailing slashes give -ENOTDIR */
M
Miklos Szeredi 已提交
4796
	if (!d_is_dir(old_dentry)) {
L
Linus Torvalds 已提交
4797
		error = -ENOTDIR;
4798
		if (old_last.name[old_last.len])
4799
			goto exit5;
4800
		if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
4801
			goto exit5;
L
Linus Torvalds 已提交
4802 4803 4804 4805
	}
	/* source should not be ancestor of target */
	error = -EINVAL;
	if (old_dentry == trap)
4806
		goto exit5;
L
Linus Torvalds 已提交
4807
	/* target should not be an ancestor of source */
M
Miklos Szeredi 已提交
4808 4809
	if (!(flags & RENAME_EXCHANGE))
		error = -ENOTEMPTY;
L
Linus Torvalds 已提交
4810 4811 4812
	if (new_dentry == trap)
		goto exit5;

4813 4814
	error = security_path_rename(&old_path, old_dentry,
				     &new_path, new_dentry, flags);
4815
	if (error)
4816
		goto exit5;
4817 4818 4819

	rd.old_dir	   = old_path.dentry->d_inode;
	rd.old_dentry	   = old_dentry;
4820
	rd.old_mnt_userns  = mnt_user_ns(old_path.mnt);
4821 4822
	rd.new_dir	   = new_path.dentry->d_inode;
	rd.new_dentry	   = new_dentry;
4823
	rd.new_mnt_userns  = mnt_user_ns(new_path.mnt);
4824 4825 4826
	rd.delegated_inode = &delegated_inode;
	rd.flags	   = flags;
	error = vfs_rename(&rd);
L
Linus Torvalds 已提交
4827 4828 4829 4830 4831
exit5:
	dput(new_dentry);
exit4:
	dput(old_dentry);
exit3:
4832
	unlock_rename(new_path.dentry, old_path.dentry);
4833 4834 4835 4836 4837
	if (delegated_inode) {
		error = break_deleg_wait(&delegated_inode);
		if (!error)
			goto retry_deleg;
	}
4838
	mnt_drop_write(old_path.mnt);
L
Linus Torvalds 已提交
4839
exit2:
4840 4841
	if (retry_estale(error, lookup_flags))
		should_retry = true;
4842
	path_put(&new_path);
L
Linus Torvalds 已提交
4843
exit1:
4844
	path_put(&old_path);
4845 4846 4847 4848 4849
	if (should_retry) {
		should_retry = false;
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
4850
put_names:
4851 4852
	putname(from);
	putname(to);
L
Linus Torvalds 已提交
4853 4854 4855
	return error;
}

4856 4857 4858
SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname, unsigned int, flags)
{
4859 4860
	return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname),
				flags);
4861 4862
}

4863 4864 4865
SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
{
4866 4867
	return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname),
				0);
4868 4869
}

4870
SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
4871
{
4872 4873
	return do_renameat2(AT_FDCWD, getname(oldname), AT_FDCWD,
				getname(newname), 0);
4874 4875
}

A
Al Viro 已提交
4876
int readlink_copy(char __user *buffer, int buflen, const char *link)
L
Linus Torvalds 已提交
4877
{
A
Al Viro 已提交
4878
	int len = PTR_ERR(link);
L
Linus Torvalds 已提交
4879 4880 4881 4882 4883 4884 4885 4886 4887 4888 4889 4890
	if (IS_ERR(link))
		goto out;

	len = strlen(link);
	if (len > (unsigned) buflen)
		len = buflen;
	if (copy_to_user(buffer, link, len))
		len = -EFAULT;
out:
	return len;
}

4891 4892 4893 4894 4895 4896 4897 4898 4899 4900 4901 4902 4903
/**
 * vfs_readlink - copy symlink body into userspace buffer
 * @dentry: dentry on which to get symbolic link
 * @buffer: user memory pointer
 * @buflen: size of buffer
 *
 * Does not touch atime.  That's up to the caller if necessary
 *
 * Does not call security hook.
 */
int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
	struct inode *inode = d_inode(dentry);
4904 4905 4906
	DEFINE_DELAYED_CALL(done);
	const char *link;
	int res;
4907

4908 4909 4910 4911 4912 4913 4914 4915 4916 4917 4918
	if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) {
		if (unlikely(inode->i_op->readlink))
			return inode->i_op->readlink(dentry, buffer, buflen);

		if (!d_is_symlink(dentry))
			return -EINVAL;

		spin_lock(&inode->i_lock);
		inode->i_opflags |= IOP_DEFAULT_READLINK;
		spin_unlock(&inode->i_lock);
	}
4919

4920
	link = READ_ONCE(inode->i_link);
4921 4922 4923 4924 4925 4926 4927 4928
	if (!link) {
		link = inode->i_op->get_link(dentry, inode, &done);
		if (IS_ERR(link))
			return PTR_ERR(link);
	}
	res = readlink_copy(buffer, buflen, link);
	do_delayed_call(&done);
	return res;
4929 4930
}
EXPORT_SYMBOL(vfs_readlink);
L
Linus Torvalds 已提交
4931

4932 4933 4934 4935 4936 4937 4938 4939 4940 4941 4942 4943 4944 4945 4946 4947 4948 4949 4950 4951 4952 4953 4954 4955 4956
/**
 * vfs_get_link - get symlink body
 * @dentry: dentry on which to get symbolic link
 * @done: caller needs to free returned data with this
 *
 * Calls security hook and i_op->get_link() on the supplied inode.
 *
 * It does not touch atime.  That's up to the caller if necessary.
 *
 * Does not work on "special" symlinks like /proc/$$/fd/N
 */
const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
{
	const char *res = ERR_PTR(-EINVAL);
	struct inode *inode = d_inode(dentry);

	if (d_is_symlink(dentry)) {
		res = ERR_PTR(security_inode_readlink(dentry));
		if (!res)
			res = inode->i_op->get_link(dentry, inode, done);
	}
	return res;
}
EXPORT_SYMBOL(vfs_get_link);

L
Linus Torvalds 已提交
4957
/* get the link contents into pagecache */
4958
const char *page_get_link(struct dentry *dentry, struct inode *inode,
4959
			  struct delayed_call *callback)
L
Linus Torvalds 已提交
4960
{
4961 4962
	char *kaddr;
	struct page *page;
4963 4964
	struct address_space *mapping = inode->i_mapping;

4965 4966 4967 4968 4969 4970 4971 4972 4973 4974 4975 4976 4977
	if (!dentry) {
		page = find_get_page(mapping, 0);
		if (!page)
			return ERR_PTR(-ECHILD);
		if (!PageUptodate(page)) {
			put_page(page);
			return ERR_PTR(-ECHILD);
		}
	} else {
		page = read_mapping_page(mapping, 0, NULL);
		if (IS_ERR(page))
			return (char*)page;
	}
4978
	set_delayed_call(callback, page_put_link, page);
4979 4980
	BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
	kaddr = page_address(page);
4981
	nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
4982
	return kaddr;
L
Linus Torvalds 已提交
4983 4984
}

4985
EXPORT_SYMBOL(page_get_link);
L
Linus Torvalds 已提交
4986

4987
void page_put_link(void *arg)
L
Linus Torvalds 已提交
4988
{
4989
	put_page(arg);
L
Linus Torvalds 已提交
4990
}
4991
EXPORT_SYMBOL(page_put_link);
L
Linus Torvalds 已提交
4992

4993 4994
int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
4995
	DEFINE_DELAYED_CALL(done);
4996 4997
	int res = readlink_copy(buffer, buflen,
				page_get_link(dentry, d_inode(dentry),
4998 4999
					      &done));
	do_delayed_call(&done);
5000 5001 5002 5003
	return res;
}
EXPORT_SYMBOL(page_readlink);

5004 5005 5006 5007
/*
 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
 */
int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
L
Linus Torvalds 已提交
5008 5009
{
	struct address_space *mapping = inode->i_mapping;
5010
	struct page *page;
5011
	void *fsdata;
5012
	int err;
5013
	unsigned int flags = 0;
5014 5015
	if (nofs)
		flags |= AOP_FLAG_NOFS;
L
Linus Torvalds 已提交
5016

5017
retry:
5018
	err = pagecache_write_begin(NULL, mapping, 0, len-1,
5019
				flags, &page, &fsdata);
L
Linus Torvalds 已提交
5020
	if (err)
5021 5022
		goto fail;

5023
	memcpy(page_address(page), symname, len-1);
5024 5025 5026

	err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
							page, fsdata);
L
Linus Torvalds 已提交
5027 5028
	if (err < 0)
		goto fail;
5029 5030 5031
	if (err < len-1)
		goto retry;

L
Linus Torvalds 已提交
5032 5033 5034 5035 5036
	mark_inode_dirty(inode);
	return 0;
fail:
	return err;
}
5037
EXPORT_SYMBOL(__page_symlink);
L
Linus Torvalds 已提交
5038

5039 5040 5041
int page_symlink(struct inode *inode, const char *symname, int len)
{
	return __page_symlink(inode, symname, len,
5042
			!mapping_gfp_constraint(inode->i_mapping, __GFP_FS));
5043
}
5044
EXPORT_SYMBOL(page_symlink);
5045

5046
const struct inode_operations page_symlink_inode_operations = {
5047
	.get_link	= page_get_link,
L
Linus Torvalds 已提交
5048 5049
};
EXPORT_SYMBOL(page_symlink_inode_operations);
新手
引导
客服 返回
顶部