namei.c 115.8 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
/*
 *  linux/fs/namei.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

/*
 * Some corrections by tytso.
 */

/* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
 * lookup logic.
 */
/* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
 */

#include <linux/init.h>
18
#include <linux/export.h>
19
#include <linux/kernel.h>
L
Linus Torvalds 已提交
20 21 22 23
#include <linux/slab.h>
#include <linux/fs.h>
#include <linux/namei.h>
#include <linux/pagemap.h>
R
Robert Love 已提交
24
#include <linux/fsnotify.h>
L
Linus Torvalds 已提交
25 26
#include <linux/personality.h>
#include <linux/security.h>
M
Mimi Zohar 已提交
27
#include <linux/ima.h>
L
Linus Torvalds 已提交
28 29 30
#include <linux/syscalls.h>
#include <linux/mount.h>
#include <linux/audit.h>
31
#include <linux/capability.h>
32
#include <linux/file.h>
33
#include <linux/fcntl.h>
34
#include <linux/device_cgroup.h>
35
#include <linux/fs_struct.h>
36
#include <linux/posix_acl.h>
37
#include <linux/hash.h>
L
Linus Torvalds 已提交
38 39
#include <asm/uaccess.h>

40
#include "internal.h"
41
#include "mount.h"
42

L
Linus Torvalds 已提交
43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76
/* [Feb-1997 T. Schoebel-Theuer]
 * Fundamental changes in the pathname lookup mechanisms (namei)
 * were necessary because of omirr.  The reason is that omirr needs
 * to know the _real_ pathname, not the user-supplied one, in case
 * of symlinks (and also when transname replacements occur).
 *
 * The new code replaces the old recursive symlink resolution with
 * an iterative one (in case of non-nested symlink chains).  It does
 * this with calls to <fs>_follow_link().
 * As a side effect, dir_namei(), _namei() and follow_link() are now 
 * replaced with a single function lookup_dentry() that can handle all 
 * the special cases of the former code.
 *
 * With the new dcache, the pathname is stored at each inode, at least as
 * long as the refcount of the inode is positive.  As a side effect, the
 * size of the dcache depends on the inode cache and thus is dynamic.
 *
 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
 * resolution to correspond with current state of the code.
 *
 * Note that the symlink resolution is not *completely* iterative.
 * There is still a significant amount of tail- and mid- recursion in
 * the algorithm.  Also, note that <fs>_readlink() is not used in
 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
 * may return different results than <fs>_follow_link().  Many virtual
 * filesystems (including /proc) exhibit this behavior.
 */

/* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
 * and the name already exists in form of a symlink, try to create the new
 * name indicated by the symlink. The old code always complained that the
 * name already exists, due to not following the symlink even if its target
 * is nonexistent.  The new semantics affects also mknod() and link() when
L
Lucas De Marchi 已提交
77
 * the name is a symlink pointing to a non-existent name.
L
Linus Torvalds 已提交
78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109
 *
 * I don't know which semantics is the right one, since I have no access
 * to standards. But I found by trial that HP-UX 9.0 has the full "new"
 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
 * "old" one. Personally, I think the new semantics is much more logical.
 * Note that "ln old new" where "new" is a symlink pointing to a non-existing
 * file does succeed in both HP-UX and SunOs, but not in Solaris
 * and in the old Linux semantics.
 */

/* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
 * semantics.  See the comments in "open_namei" and "do_link" below.
 *
 * [10-Sep-98 Alan Modra] Another symlink change.
 */

/* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
 *	inside the path - always follow.
 *	in the last component in creation/removal/renaming - never follow.
 *	if LOOKUP_FOLLOW passed - follow.
 *	if the pathname has trailing slashes - follow.
 *	otherwise - don't follow.
 * (applied in that order).
 *
 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
 * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
 * During the 2.4 we need to fix the userland stuff depending on it -
 * hopefully we will be able to get rid of that wart in 2.5. So far only
 * XEmacs seems to be relying on it...
 */
/*
 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
110
 * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
L
Linus Torvalds 已提交
111 112 113 114 115 116 117 118 119 120
 * any extra contention...
 */

/* In order to reduce some races, while at the same time doing additional
 * checking and hopefully speeding things up, we copy filenames to the
 * kernel data space before using them..
 *
 * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
 * PATH_MAX includes the nul terminator --RR.
 */
121

A
Al Viro 已提交
122
#define EMBEDDED_NAME_MAX	(PATH_MAX - offsetof(struct filename, iname))
123

124
struct filename *
125 126
getname_flags(const char __user *filename, int flags, int *empty)
{
A
Al Viro 已提交
127
	struct filename *result;
128
	char *kname;
A
Al Viro 已提交
129
	int len;
130

131 132 133 134
	result = audit_reusename(filename);
	if (result)
		return result;

135
	result = __getname();
136
	if (unlikely(!result))
137 138
		return ERR_PTR(-ENOMEM);

139 140 141 142
	/*
	 * First, try to embed the struct filename inside the names_cache
	 * allocation
	 */
A
Al Viro 已提交
143
	kname = (char *)result->iname;
144
	result->name = kname;
145

A
Al Viro 已提交
146
	len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
147
	if (unlikely(len < 0)) {
A
Al Viro 已提交
148 149
		__putname(result);
		return ERR_PTR(len);
150
	}
151

152 153 154 155 156 157
	/*
	 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
	 * separate struct filename so we can dedicate the entire
	 * names_cache allocation for the pathname, and re-do the copy from
	 * userland.
	 */
A
Al Viro 已提交
158
	if (unlikely(len == EMBEDDED_NAME_MAX)) {
A
Al Viro 已提交
159
		const size_t size = offsetof(struct filename, iname[1]);
160 161
		kname = (char *)result;

A
Al Viro 已提交
162 163 164 165 166 167
		/*
		 * size is chosen that way we to guarantee that
		 * result->iname[0] is within the same object and that
		 * kname can't be equal to result->iname, no matter what.
		 */
		result = kzalloc(size, GFP_KERNEL);
A
Al Viro 已提交
168 169 170
		if (unlikely(!result)) {
			__putname(kname);
			return ERR_PTR(-ENOMEM);
171 172
		}
		result->name = kname;
A
Al Viro 已提交
173 174 175 176 177 178 179 180 181 182 183
		len = strncpy_from_user(kname, filename, PATH_MAX);
		if (unlikely(len < 0)) {
			__putname(kname);
			kfree(result);
			return ERR_PTR(len);
		}
		if (unlikely(len == PATH_MAX)) {
			__putname(kname);
			kfree(result);
			return ERR_PTR(-ENAMETOOLONG);
		}
184 185
	}

A
Al Viro 已提交
186
	result->refcnt = 1;
187 188 189
	/* The empty path is special. */
	if (unlikely(!len)) {
		if (empty)
190
			*empty = 1;
A
Al Viro 已提交
191 192 193 194
		if (!(flags & LOOKUP_EMPTY)) {
			putname(result);
			return ERR_PTR(-ENOENT);
		}
L
Linus Torvalds 已提交
195
	}
196

197
	result->uptr = filename;
198
	result->aname = NULL;
199 200
	audit_getname(result);
	return result;
L
Linus Torvalds 已提交
201 202
}

203 204
struct filename *
getname(const char __user * filename)
A
Al Viro 已提交
205
{
206
	return getname_flags(filename, 0, NULL);
A
Al Viro 已提交
207 208
}

209 210 211 212
struct filename *
getname_kernel(const char * filename)
{
	struct filename *result;
213
	int len = strlen(filename) + 1;
214 215 216 217 218

	result = __getname();
	if (unlikely(!result))
		return ERR_PTR(-ENOMEM);

219
	if (len <= EMBEDDED_NAME_MAX) {
A
Al Viro 已提交
220
		result->name = (char *)result->iname;
221 222 223 224 225 226 227 228 229 230 231 232 233 234 235
	} else if (len <= PATH_MAX) {
		struct filename *tmp;

		tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
		if (unlikely(!tmp)) {
			__putname(result);
			return ERR_PTR(-ENOMEM);
		}
		tmp->name = (char *)result;
		result = tmp;
	} else {
		__putname(result);
		return ERR_PTR(-ENAMETOOLONG);
	}
	memcpy((char *)result->name, filename, len);
236 237
	result->uptr = NULL;
	result->aname = NULL;
238
	result->refcnt = 1;
239
	audit_getname(result);
240 241 242 243

	return result;
}

244
void putname(struct filename *name)
L
Linus Torvalds 已提交
245
{
246 247 248 249 250
	BUG_ON(name->refcnt <= 0);

	if (--name->refcnt > 0)
		return;

A
Al Viro 已提交
251
	if (name->name != name->iname) {
252 253 254 255
		__putname(name->name);
		kfree(name);
	} else
		__putname(name);
L
Linus Torvalds 已提交
256 257
}

258 259
static int check_acl(struct inode *inode, int mask)
{
260
#ifdef CONFIG_FS_POSIX_ACL
261 262 263
	struct posix_acl *acl;

	if (mask & MAY_NOT_BLOCK) {
264 265
		acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
	        if (!acl)
266
	                return -EAGAIN;
267 268 269
		/* no ->get_acl() calls in RCU mode... */
		if (acl == ACL_NOT_CACHED)
			return -ECHILD;
A
Ari Savolainen 已提交
270
	        return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
271 272
	}

C
Christoph Hellwig 已提交
273 274 275
	acl = get_acl(inode, ACL_TYPE_ACCESS);
	if (IS_ERR(acl))
		return PTR_ERR(acl);
276 277 278 279 280
	if (acl) {
	        int error = posix_acl_permission(inode, acl, mask);
	        posix_acl_release(acl);
	        return error;
	}
281
#endif
282 283 284 285

	return -EAGAIN;
}

286
/*
287
 * This does the basic permission checking
L
Linus Torvalds 已提交
288
 */
289
static int acl_permission_check(struct inode *inode, int mask)
L
Linus Torvalds 已提交
290
{
291
	unsigned int mode = inode->i_mode;
L
Linus Torvalds 已提交
292

293
	if (likely(uid_eq(current_fsuid(), inode->i_uid)))
L
Linus Torvalds 已提交
294 295
		mode >>= 6;
	else {
296
		if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
297
			int error = check_acl(inode, mask);
298 299
			if (error != -EAGAIN)
				return error;
L
Linus Torvalds 已提交
300 301 302 303 304 305 306 307 308
		}

		if (in_group_p(inode->i_gid))
			mode >>= 3;
	}

	/*
	 * If the DACs are ok we don't need any capability check.
	 */
309
	if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
L
Linus Torvalds 已提交
310
		return 0;
311 312 313 314
	return -EACCES;
}

/**
315
 * generic_permission -  check for access rights on a Posix-like filesystem
316
 * @inode:	inode to check access rights for
317
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...)
318 319 320 321
 *
 * Used to check for read/write/execute permissions on a file.
 * We use "fsuid" for this, letting us set arbitrary permissions
 * for filesystem access without changing the "normal" uids which
322 323 324 325 326
 * are used for other things.
 *
 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
 * request cannot be satisfied (eg. requires blocking or too much complexity).
 * It would then be called again in ref-walk mode.
327
 */
328
int generic_permission(struct inode *inode, int mask)
329 330 331 332
{
	int ret;

	/*
333
	 * Do the basic permission checks.
334
	 */
335
	ret = acl_permission_check(inode, mask);
336 337
	if (ret != -EACCES)
		return ret;
L
Linus Torvalds 已提交
338

339 340
	if (S_ISDIR(inode->i_mode)) {
		/* DACs are overridable for directories */
341
		if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
342 343
			return 0;
		if (!(mask & MAY_WRITE))
344 345
			if (capable_wrt_inode_uidgid(inode,
						     CAP_DAC_READ_SEARCH))
346 347 348
				return 0;
		return -EACCES;
	}
L
Linus Torvalds 已提交
349 350
	/*
	 * Read/write DACs are always overridable.
351 352
	 * Executable DACs are overridable when there is
	 * at least one exec bit set.
L
Linus Torvalds 已提交
353
	 */
354
	if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
355
		if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
L
Linus Torvalds 已提交
356 357 358 359 360
			return 0;

	/*
	 * Searching includes executable on directories, else just read.
	 */
361
	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
362
	if (mask == MAY_READ)
363
		if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))
L
Linus Torvalds 已提交
364 365 366 367
			return 0;

	return -EACCES;
}
368
EXPORT_SYMBOL(generic_permission);
L
Linus Torvalds 已提交
369

370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389
/*
 * We _really_ want to just do "generic_permission()" without
 * even looking at the inode->i_op values. So we keep a cache
 * flag in inode->i_opflags, that says "this has not special
 * permission function, use the fast case".
 */
static inline int do_inode_permission(struct inode *inode, int mask)
{
	if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
		if (likely(inode->i_op->permission))
			return inode->i_op->permission(inode, mask);

		/* This gets set once for the inode lifetime */
		spin_lock(&inode->i_lock);
		inode->i_opflags |= IOP_FASTPERM;
		spin_unlock(&inode->i_lock);
	}
	return generic_permission(inode, mask);
}

C
Christoph Hellwig 已提交
390
/**
D
David Howells 已提交
391 392 393
 * __inode_permission - Check for access rights to a given inode
 * @inode: Inode to check permission on
 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
C
Christoph Hellwig 已提交
394
 *
D
David Howells 已提交
395
 * Check for read/write/execute permissions on an inode.
396 397
 *
 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
D
David Howells 已提交
398 399 400
 *
 * This does not check for a read-only file system.  You probably want
 * inode_permission().
C
Christoph Hellwig 已提交
401
 */
D
David Howells 已提交
402
int __inode_permission(struct inode *inode, int mask)
L
Linus Torvalds 已提交
403
{
404
	int retval;
L
Linus Torvalds 已提交
405

406
	if (unlikely(mask & MAY_WRITE)) {
L
Linus Torvalds 已提交
407 408 409 410 411 412 413
		/*
		 * Nobody gets write access to an immutable file.
		 */
		if (IS_IMMUTABLE(inode))
			return -EACCES;
	}

414
	retval = do_inode_permission(inode, mask);
L
Linus Torvalds 已提交
415 416 417
	if (retval)
		return retval;

418 419 420 421
	retval = devcgroup_inode_permission(inode, mask);
	if (retval)
		return retval;

422
	return security_inode_permission(inode, mask);
L
Linus Torvalds 已提交
423
}
424
EXPORT_SYMBOL(__inode_permission);
L
Linus Torvalds 已提交
425

D
David Howells 已提交
426 427 428
/**
 * sb_permission - Check superblock-level permissions
 * @sb: Superblock of inode to check permission on
429
 * @inode: Inode to check permission on
D
David Howells 已提交
430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466
 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Separate out file-system wide checks from inode-specific permission checks.
 */
static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
{
	if (unlikely(mask & MAY_WRITE)) {
		umode_t mode = inode->i_mode;

		/* Nobody gets write access to a read-only fs. */
		if ((sb->s_flags & MS_RDONLY) &&
		    (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
			return -EROFS;
	}
	return 0;
}

/**
 * inode_permission - Check for access rights to a given inode
 * @inode: Inode to check permission on
 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Check for read/write/execute permissions on an inode.  We use fs[ug]id for
 * this, letting us set arbitrary permissions for filesystem access without
 * changing the "normal" UIDs which are used for other things.
 *
 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
 */
int inode_permission(struct inode *inode, int mask)
{
	int retval;

	retval = sb_permission(inode->i_sb, inode, mask);
	if (retval)
		return retval;
	return __inode_permission(inode, mask);
}
467
EXPORT_SYMBOL(inode_permission);
D
David Howells 已提交
468

J
Jan Blunck 已提交
469 470 471 472 473 474
/**
 * path_get - get a reference to a path
 * @path: path to get the reference to
 *
 * Given a path increment the reference count to the dentry and the vfsmount.
 */
475
void path_get(const struct path *path)
J
Jan Blunck 已提交
476 477 478 479 480 481
{
	mntget(path->mnt);
	dget(path->dentry);
}
EXPORT_SYMBOL(path_get);

J
Jan Blunck 已提交
482 483 484 485 486 487
/**
 * path_put - put a reference to a path
 * @path: path to put the reference to
 *
 * Given a path decrement the reference count to the dentry and the vfsmount.
 */
488
void path_put(const struct path *path)
L
Linus Torvalds 已提交
489
{
J
Jan Blunck 已提交
490 491
	dput(path->dentry);
	mntput(path->mnt);
L
Linus Torvalds 已提交
492
}
J
Jan Blunck 已提交
493
EXPORT_SYMBOL(path_put);
L
Linus Torvalds 已提交
494

495
#define EMBEDDED_LEVELS 2
496 497
struct nameidata {
	struct path	path;
A
Al Viro 已提交
498
	struct qstr	last;
499 500 501
	struct path	root;
	struct inode	*inode; /* path.dentry.d_inode */
	unsigned int	flags;
502
	unsigned	seq, m_seq;
503 504
	int		last_type;
	unsigned	depth;
505
	int		total_link_count;
506 507
	struct saved {
		struct path link;
508
		struct delayed_call done;
509
		const char *name;
510
		unsigned seq;
511
	} *stack, internal[EMBEDDED_LEVELS];
512 513
	struct filename	*name;
	struct nameidata *saved;
514
	struct inode	*link_inode;
515 516
	unsigned	root_seq;
	int		dfd;
517 518
};

519
static void set_nameidata(struct nameidata *p, int dfd, struct filename *name)
520
{
521 522
	struct nameidata *old = current->nameidata;
	p->stack = p->internal;
523 524
	p->dfd = dfd;
	p->name = name;
525
	p->total_link_count = old ? old->total_link_count : 0;
526
	p->saved = old;
527
	current->nameidata = p;
528 529
}

530
static void restore_nameidata(void)
531
{
532
	struct nameidata *now = current->nameidata, *old = now->saved;
533 534 535 536

	current->nameidata = old;
	if (old)
		old->total_link_count = now->total_link_count;
537
	if (now->stack != now->internal)
538
		kfree(now->stack);
539 540 541 542
}

static int __nd_alloc_stack(struct nameidata *nd)
{
A
Al Viro 已提交
543 544 545 546 547 548 549 550 551
	struct saved *p;

	if (nd->flags & LOOKUP_RCU) {
		p= kmalloc(MAXSYMLINKS * sizeof(struct saved),
				  GFP_ATOMIC);
		if (unlikely(!p))
			return -ECHILD;
	} else {
		p= kmalloc(MAXSYMLINKS * sizeof(struct saved),
552
				  GFP_KERNEL);
A
Al Viro 已提交
553 554 555
		if (unlikely(!p))
			return -ENOMEM;
	}
556 557 558 559 560
	memcpy(p, nd->internal, sizeof(nd->internal));
	nd->stack = p;
	return 0;
}

561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578
/**
 * path_connected - Verify that a path->dentry is below path->mnt.mnt_root
 * @path: nameidate to verify
 *
 * Rename can sometimes move a file or directory outside of a bind
 * mount, path_connected allows those cases to be detected.
 */
static bool path_connected(const struct path *path)
{
	struct vfsmount *mnt = path->mnt;

	/* Only bind mounts can have disconnected paths */
	if (mnt->mnt_root == mnt->mnt_sb->s_root)
		return true;

	return is_subdir(path->dentry, mnt->mnt_root);
}

579 580
static inline int nd_alloc_stack(struct nameidata *nd)
{
581
	if (likely(nd->depth != EMBEDDED_LEVELS))
582 583 584 585 586 587
		return 0;
	if (likely(nd->stack != nd->internal))
		return 0;
	return __nd_alloc_stack(nd);
}

588 589 590 591 592
static void drop_links(struct nameidata *nd)
{
	int i = nd->depth;
	while (i--) {
		struct saved *last = nd->stack + i;
593 594
		do_delayed_call(&last->done);
		clear_delayed_call(&last->done);
595 596 597 598 599 600 601 602 603 604 605
	}
}

static void terminate_walk(struct nameidata *nd)
{
	drop_links(nd);
	if (!(nd->flags & LOOKUP_RCU)) {
		int i;
		path_put(&nd->path);
		for (i = 0; i < nd->depth; i++)
			path_put(&nd->stack[i].link);
606 607 608 609
		if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
			path_put(&nd->root);
			nd->root.mnt = NULL;
		}
610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650
	} else {
		nd->flags &= ~LOOKUP_RCU;
		if (!(nd->flags & LOOKUP_ROOT))
			nd->root.mnt = NULL;
		rcu_read_unlock();
	}
	nd->depth = 0;
}

/* path_put is needed afterwards regardless of success or failure */
static bool legitimize_path(struct nameidata *nd,
			    struct path *path, unsigned seq)
{
	int res = __legitimize_mnt(path->mnt, nd->m_seq);
	if (unlikely(res)) {
		if (res > 0)
			path->mnt = NULL;
		path->dentry = NULL;
		return false;
	}
	if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
		path->dentry = NULL;
		return false;
	}
	return !read_seqcount_retry(&path->dentry->d_seq, seq);
}

static bool legitimize_links(struct nameidata *nd)
{
	int i;
	for (i = 0; i < nd->depth; i++) {
		struct saved *last = nd->stack + i;
		if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
			drop_links(nd);
			nd->depth = i + 1;
			return false;
		}
	}
	return true;
}

A
Al Viro 已提交
651
/*
N
Nick Piggin 已提交
652
 * Path walking has 2 modes, rcu-walk and ref-walk (see
A
Al Viro 已提交
653 654
 * Documentation/filesystems/path-lookup.txt).  In situations when we can't
 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
M
Mike Marshall 已提交
655
 * normal reference counts on dentries and vfsmounts to transition to ref-walk
A
Al Viro 已提交
656 657 658 659
 * mode.  Refcounts are grabbed at the last known good point before rcu-walk
 * got stuck, so ref-walk may continue from there. If this is not successful
 * (eg. a seqcount has changed), then failure is returned and it's up to caller
 * to restart the path walk from the beginning in ref-walk mode.
N
Nick Piggin 已提交
660 661 662
 */

/**
A
Al Viro 已提交
663 664 665
 * unlazy_walk - try to switch to ref-walk mode.
 * @nd: nameidata pathwalk data
 * @dentry: child of nd->path.dentry or NULL
666
 * @seq: seq number to check dentry against
667
 * Returns: 0 on success, -ECHILD on failure
N
Nick Piggin 已提交
668
 *
A
Al Viro 已提交
669 670 671
 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry
 * for ref-walk mode.  @dentry must be a path found by a do_lookup call on
 * @nd or NULL.  Must be called from rcu-walk context.
672 673
 * Nothing should touch nameidata between unlazy_walk() failure and
 * terminate_walk().
N
Nick Piggin 已提交
674
 */
675
static int unlazy_walk(struct nameidata *nd, struct dentry *dentry, unsigned seq)
N
Nick Piggin 已提交
676 677 678 679
{
	struct dentry *parent = nd->path.dentry;

	BUG_ON(!(nd->flags & LOOKUP_RCU));
680 681

	nd->flags &= ~LOOKUP_RCU;
682 683 684 685 686 687
	if (unlikely(!legitimize_links(nd)))
		goto out2;
	if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq)))
		goto out2;
	if (unlikely(!lockref_get_not_dead(&parent->d_lockref)))
		goto out1;
A
Al Viro 已提交
688

689 690 691 692 693 694 695 696 697 698 699
	/*
	 * For a negative lookup, the lookup sequence point is the parents
	 * sequence point, and it only needs to revalidate the parent dentry.
	 *
	 * For a positive lookup, we need to move both the parent and the
	 * dentry from the RCU domain to be properly refcounted. And the
	 * sequence number in the dentry validates *both* dentry counters,
	 * since we checked the sequence number of the parent after we got
	 * the child sequence number. So we know the parent must still
	 * be valid if the child sequence number is still valid.
	 */
A
Al Viro 已提交
700
	if (!dentry) {
701 702
		if (read_seqcount_retry(&parent->d_seq, nd->seq))
			goto out;
A
Al Viro 已提交
703 704
		BUG_ON(nd->inode != parent->d_inode);
	} else {
705 706
		if (!lockref_get_not_dead(&dentry->d_lockref))
			goto out;
707
		if (read_seqcount_retry(&dentry->d_seq, seq))
708
			goto drop_dentry;
A
Al Viro 已提交
709
	}
710 711 712 713 714 715

	/*
	 * Sequence counts matched. Now make sure that the root is
	 * still valid and get it if required.
	 */
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
716 717 718 719
		if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq))) {
			rcu_read_unlock();
			dput(dentry);
			return -ECHILD;
720
		}
N
Nick Piggin 已提交
721 722
	}

A
Al Viro 已提交
723
	rcu_read_unlock();
N
Nick Piggin 已提交
724
	return 0;
A
Al Viro 已提交
725

726
drop_dentry:
A
Al Viro 已提交
727
	rcu_read_unlock();
728
	dput(dentry);
729
	goto drop_root_mnt;
730 731 732 733
out2:
	nd->path.mnt = NULL;
out1:
	nd->path.dentry = NULL;
734
out:
A
Al Viro 已提交
735
	rcu_read_unlock();
736 737 738
drop_root_mnt:
	if (!(nd->flags & LOOKUP_ROOT))
		nd->root.mnt = NULL;
N
Nick Piggin 已提交
739 740 741
	return -ECHILD;
}

742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759
static int unlazy_link(struct nameidata *nd, struct path *link, unsigned seq)
{
	if (unlikely(!legitimize_path(nd, link, seq))) {
		drop_links(nd);
		nd->depth = 0;
		nd->flags &= ~LOOKUP_RCU;
		nd->path.mnt = NULL;
		nd->path.dentry = NULL;
		if (!(nd->flags & LOOKUP_ROOT))
			nd->root.mnt = NULL;
		rcu_read_unlock();
	} else if (likely(unlazy_walk(nd, NULL, 0)) == 0) {
		return 0;
	}
	path_put(link);
	return -ECHILD;
}

760
static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
761
{
762
	return dentry->d_op->d_revalidate(dentry, flags);
763 764
}

765 766 767
/**
 * complete_walk - successful completion of path walk
 * @nd:  pointer nameidata
768
 *
769 770 771 772 773
 * If we had been in RCU mode, drop out of it and legitimize nd->path.
 * Revalidate the final result, unless we'd already done that during
 * the path walk or the filesystem doesn't ask for it.  Return 0 on
 * success, -error on failure.  In case of failure caller does not
 * need to drop nd->path.
774
 */
775
static int complete_walk(struct nameidata *nd)
776
{
A
Al Viro 已提交
777
	struct dentry *dentry = nd->path.dentry;
778 779
	int status;

780 781 782
	if (nd->flags & LOOKUP_RCU) {
		if (!(nd->flags & LOOKUP_ROOT))
			nd->root.mnt = NULL;
783
		if (unlikely(unlazy_walk(nd, NULL, 0)))
784 785 786
			return -ECHILD;
	}

A
Al Viro 已提交
787 788 789
	if (likely(!(nd->flags & LOOKUP_JUMPED)))
		return 0;

790
	if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
791 792
		return 0;

793
	status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
794 795 796
	if (status > 0)
		return 0;

A
Al Viro 已提交
797
	if (!status)
798
		status = -ESTALE;
A
Al Viro 已提交
799

800 801 802
	return status;
}

A
Al Viro 已提交
803
static void set_root(struct nameidata *nd)
N
Nick Piggin 已提交
804
{
805
	struct fs_struct *fs = current->fs;
N
Nick Piggin 已提交
806

807 808 809 810 811 812 813 814 815 816 817
	if (nd->flags & LOOKUP_RCU) {
		unsigned seq;

		do {
			seq = read_seqcount_begin(&fs->seq);
			nd->root = fs->root;
			nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
		} while (read_seqcount_retry(&fs->seq, seq));
	} else {
		get_fs_root(fs, &nd->root);
	}
N
Nick Piggin 已提交
818 819
}

J
Jan Blunck 已提交
820
static void path_put_conditional(struct path *path, struct nameidata *nd)
821 822
{
	dput(path->dentry);
823
	if (path->mnt != nd->path.mnt)
824 825 826
		mntput(path->mnt);
}

827 828
static inline void path_to_nameidata(const struct path *path,
					struct nameidata *nd)
829
{
N
Nick Piggin 已提交
830 831 832 833
	if (!(nd->flags & LOOKUP_RCU)) {
		dput(nd->path.dentry);
		if (nd->path.mnt != path->mnt)
			mntput(nd->path.mnt);
834
	}
N
Nick Piggin 已提交
835
	nd->path.mnt = path->mnt;
836
	nd->path.dentry = path->dentry;
837 838
}

839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858
static int nd_jump_root(struct nameidata *nd)
{
	if (nd->flags & LOOKUP_RCU) {
		struct dentry *d;
		nd->path = nd->root;
		d = nd->path.dentry;
		nd->inode = d->d_inode;
		nd->seq = nd->root_seq;
		if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq)))
			return -ECHILD;
	} else {
		path_put(&nd->path);
		nd->path = nd->root;
		path_get(&nd->path);
		nd->inode = nd->path.dentry->d_inode;
	}
	nd->flags |= LOOKUP_JUMPED;
	return 0;
}

C
Christoph Hellwig 已提交
859
/*
860
 * Helper to directly jump to a known parsed path from ->get_link,
C
Christoph Hellwig 已提交
861 862
 * caller must have taken a reference to path beforehand.
 */
863
void nd_jump_link(struct path *path)
C
Christoph Hellwig 已提交
864
{
865
	struct nameidata *nd = current->nameidata;
C
Christoph Hellwig 已提交
866 867 868 869 870 871 872
	path_put(&nd->path);

	nd->path = *path;
	nd->inode = nd->path.dentry->d_inode;
	nd->flags |= LOOKUP_JUMPED;
}

873
static inline void put_link(struct nameidata *nd)
874
{
A
Al Viro 已提交
875
	struct saved *last = nd->stack + --nd->depth;
876
	do_delayed_call(&last->done);
A
Al Viro 已提交
877 878
	if (!(nd->flags & LOOKUP_RCU))
		path_put(&last->link);
879 880
}

881 882
int sysctl_protected_symlinks __read_mostly = 0;
int sysctl_protected_hardlinks __read_mostly = 0;
K
Kees Cook 已提交
883 884 885

/**
 * may_follow_link - Check symlink following for unsafe situations
886
 * @nd: nameidata pathwalk data
K
Kees Cook 已提交
887 888 889 890 891 892 893 894 895 896 897 898
 *
 * In the case of the sysctl_protected_symlinks sysctl being enabled,
 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
 * in a sticky world-writable directory. This is to protect privileged
 * processes from failing races against path names that may change out
 * from under them by way of other users creating malicious symlinks.
 * It will permit symlinks to be followed only when outside a sticky
 * world-writable directory, or when the uid of the symlink and follower
 * match, or when the directory owner matches the symlink's owner.
 *
 * Returns 0 if following the symlink is allowed, -ve on error.
 */
A
Al Viro 已提交
899
static inline int may_follow_link(struct nameidata *nd)
K
Kees Cook 已提交
900 901 902 903 904 905 906 907
{
	const struct inode *inode;
	const struct inode *parent;

	if (!sysctl_protected_symlinks)
		return 0;

	/* Allowed if owner and follower match. */
908
	inode = nd->link_inode;
909
	if (uid_eq(current_cred()->fsuid, inode->i_uid))
K
Kees Cook 已提交
910 911 912
		return 0;

	/* Allowed if parent directory not sticky and world-writable. */
A
Al Viro 已提交
913
	parent = nd->inode;
K
Kees Cook 已提交
914 915 916 917
	if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
		return 0;

	/* Allowed if parent directory and link owner match. */
918
	if (uid_eq(parent->i_uid, inode->i_uid))
K
Kees Cook 已提交
919 920
		return 0;

921 922 923
	if (nd->flags & LOOKUP_RCU)
		return -ECHILD;

A
Al Viro 已提交
924
	audit_log_link_denied("follow_link", &nd->stack[0].link);
K
Kees Cook 已提交
925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970
	return -EACCES;
}

/**
 * safe_hardlink_source - Check for safe hardlink conditions
 * @inode: the source inode to hardlink from
 *
 * Return false if at least one of the following conditions:
 *    - inode is not a regular file
 *    - inode is setuid
 *    - inode is setgid and group-exec
 *    - access failure for read and write
 *
 * Otherwise returns true.
 */
static bool safe_hardlink_source(struct inode *inode)
{
	umode_t mode = inode->i_mode;

	/* Special files should not get pinned to the filesystem. */
	if (!S_ISREG(mode))
		return false;

	/* Setuid files should not get pinned to the filesystem. */
	if (mode & S_ISUID)
		return false;

	/* Executable setgid files should not get pinned to the filesystem. */
	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
		return false;

	/* Hardlinking to unreadable or unwritable sources is dangerous. */
	if (inode_permission(inode, MAY_READ | MAY_WRITE))
		return false;

	return true;
}

/**
 * may_linkat - Check permissions for creating a hardlink
 * @link: the source to hardlink from
 *
 * Block hardlink when all of:
 *  - sysctl_protected_hardlinks enabled
 *  - fsuid does not match inode
 *  - hardlink source is unsafe (see safe_hardlink_source() above)
971
 *  - not CAP_FOWNER in a namespace with the inode owner uid mapped
K
Kees Cook 已提交
972 973 974 975 976 977 978 979 980 981 982 983 984 985 986
 *
 * Returns 0 if successful, -ve on error.
 */
static int may_linkat(struct path *link)
{
	struct inode *inode;

	if (!sysctl_protected_hardlinks)
		return 0;

	inode = link->dentry->d_inode;

	/* Source inode owner (or CAP_FOWNER) can hardlink all they like,
	 * otherwise, it must be a safe source.
	 */
987
	if (inode_owner_or_capable(inode) || safe_hardlink_source(inode))
K
Kees Cook 已提交
988 989
		return 0;

990
	audit_log_link_denied("linkat", link);
K
Kees Cook 已提交
991 992 993
	return -EPERM;
}

994 995
static __always_inline
const char *get_link(struct nameidata *nd)
L
Linus Torvalds 已提交
996
{
997
	struct saved *last = nd->stack + nd->depth - 1;
A
Al Viro 已提交
998
	struct dentry *dentry = last->link.dentry;
999
	struct inode *inode = nd->link_inode;
1000
	int error;
1001
	const char *res;
L
Linus Torvalds 已提交
1002

1003 1004 1005 1006
	if (!(nd->flags & LOOKUP_RCU)) {
		touch_atime(&last->link);
		cond_resched();
	} else if (atime_needs_update(&last->link, inode)) {
A
Al Viro 已提交
1007 1008
		if (unlikely(unlazy_walk(nd, NULL, 0)))
			return ERR_PTR(-ECHILD);
1009
		touch_atime(&last->link);
A
Al Viro 已提交
1010
	}
1011

1012 1013 1014
	error = security_inode_follow_link(dentry, inode,
					   nd->flags & LOOKUP_RCU);
	if (unlikely(error))
1015
		return ERR_PTR(error);
1016

1017
	nd->last_type = LAST_BIND;
1018 1019
	res = inode->i_link;
	if (!res) {
1020 1021 1022
		const char * (*get)(struct dentry *, struct inode *,
				struct delayed_call *);
		get = inode->i_op->get_link;
1023
		if (nd->flags & LOOKUP_RCU) {
1024
			res = get(NULL, inode, &last->done);
1025 1026 1027
			if (res == ERR_PTR(-ECHILD)) {
				if (unlikely(unlazy_walk(nd, NULL, 0)))
					return ERR_PTR(-ECHILD);
1028
				res = get(dentry, inode, &last->done);
1029 1030
			}
		} else {
1031
			res = get(dentry, inode, &last->done);
1032
		}
1033
		if (IS_ERR_OR_NULL(res))
1034 1035 1036
			return res;
	}
	if (*res == '/') {
1037 1038
		if (!nd->root.mnt)
			set_root(nd);
1039 1040
		if (unlikely(nd_jump_root(nd)))
			return ERR_PTR(-ECHILD);
1041 1042
		while (unlikely(*++res == '/'))
			;
L
Linus Torvalds 已提交
1043
	}
1044 1045
	if (!*res)
		res = NULL;
1046 1047
	return res;
}
1048

1049 1050 1051 1052 1053 1054 1055 1056 1057 1058
/*
 * follow_up - Find the mountpoint of path's vfsmount
 *
 * Given a path, find the mountpoint of its source file system.
 * Replace @path with the path of the mountpoint in the parent mount.
 * Up is towards /.
 *
 * Return 1 if we went up a level and 0 if we were already at the
 * root.
 */
A
Al Viro 已提交
1059
int follow_up(struct path *path)
L
Linus Torvalds 已提交
1060
{
1061 1062
	struct mount *mnt = real_mount(path->mnt);
	struct mount *parent;
L
Linus Torvalds 已提交
1063
	struct dentry *mountpoint;
N
Nick Piggin 已提交
1064

A
Al Viro 已提交
1065
	read_seqlock_excl(&mount_lock);
1066
	parent = mnt->mnt_parent;
A
Al Viro 已提交
1067
	if (parent == mnt) {
A
Al Viro 已提交
1068
		read_sequnlock_excl(&mount_lock);
L
Linus Torvalds 已提交
1069 1070
		return 0;
	}
1071
	mntget(&parent->mnt);
1072
	mountpoint = dget(mnt->mnt_mountpoint);
A
Al Viro 已提交
1073
	read_sequnlock_excl(&mount_lock);
A
Al Viro 已提交
1074 1075 1076
	dput(path->dentry);
	path->dentry = mountpoint;
	mntput(path->mnt);
1077
	path->mnt = &parent->mnt;
L
Linus Torvalds 已提交
1078 1079
	return 1;
}
1080
EXPORT_SYMBOL(follow_up);
L
Linus Torvalds 已提交
1081

N
Nick Piggin 已提交
1082
/*
1083 1084 1085
 * Perform an automount
 * - return -EISDIR to tell follow_managed() to stop and return the path we
 *   were called with.
L
Linus Torvalds 已提交
1086
 */
1087
static int follow_automount(struct path *path, struct nameidata *nd,
1088
			    bool *need_mntput)
N
Nick Piggin 已提交
1089
{
1090
	struct vfsmount *mnt;
1091
	int err;
1092 1093 1094 1095

	if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
		return -EREMOTE;

1096 1097 1098 1099 1100 1101 1102 1103 1104 1105
	/* We don't want to mount if someone's just doing a stat -
	 * unless they're stat'ing a directory and appended a '/' to
	 * the name.
	 *
	 * We do, however, want to mount if someone wants to open or
	 * create a file of any type under the mountpoint, wants to
	 * traverse through the mountpoint or wants to open the
	 * mounted directory.  Also, autofs may mark negative dentries
	 * as being automount points.  These will need the attentions
	 * of the daemon to instantiate them before they can be used.
1106
	 */
1107 1108
	if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
			   LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
1109 1110 1111
	    path->dentry->d_inode)
		return -EISDIR;

1112 1113
	nd->total_link_count++;
	if (nd->total_link_count >= 40)
1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126
		return -ELOOP;

	mnt = path->dentry->d_op->d_automount(path);
	if (IS_ERR(mnt)) {
		/*
		 * The filesystem is allowed to return -EISDIR here to indicate
		 * it doesn't want to automount.  For instance, autofs would do
		 * this so that its userspace daemon can mount on this dentry.
		 *
		 * However, we can only permit this if it's a terminal point in
		 * the path being looked up; if it wasn't then the remainder of
		 * the path is inaccessible and we should say so.
		 */
1127
		if (PTR_ERR(mnt) == -EISDIR && (nd->flags & LOOKUP_PARENT))
1128 1129
			return -EREMOTE;
		return PTR_ERR(mnt);
N
Nick Piggin 已提交
1130
	}
1131

1132 1133
	if (!mnt) /* mount collision */
		return 0;
N
Nick Piggin 已提交
1134

1135 1136 1137 1138 1139
	if (!*need_mntput) {
		/* lock_mount() may release path->mnt on error */
		mntget(path->mnt);
		*need_mntput = true;
	}
1140
	err = finish_automount(mnt, path);
1141

1142 1143 1144
	switch (err) {
	case -EBUSY:
		/* Someone else made a mount here whilst we were busy */
1145
		return 0;
1146
	case 0:
1147
		path_put(path);
1148 1149 1150
		path->mnt = mnt;
		path->dentry = dget(mnt->mnt_root);
		return 0;
1151 1152
	default:
		return err;
1153
	}
1154

A
Al Viro 已提交
1155 1156
}

1157 1158
/*
 * Handle a dentry that is managed in some way.
1159
 * - Flagged for transit management (autofs)
1160 1161 1162 1163 1164 1165 1166
 * - Flagged as mountpoint
 * - Flagged as automount point
 *
 * This may only be called in refwalk mode.
 *
 * Serialization is taken care of in namespace.c
 */
1167
static int follow_managed(struct path *path, struct nameidata *nd)
L
Linus Torvalds 已提交
1168
{
1169
	struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */
1170 1171
	unsigned managed;
	bool need_mntput = false;
1172
	int ret = 0;
1173 1174 1175 1176 1177 1178 1179

	/* Given that we're not holding a lock here, we retain the value in a
	 * local variable for each dentry as we look at it so that we don't see
	 * the components of that value change under us */
	while (managed = ACCESS_ONCE(path->dentry->d_flags),
	       managed &= DCACHE_MANAGED_DENTRY,
	       unlikely(managed != 0)) {
1180 1181 1182 1183 1184
		/* Allow the filesystem to manage the transit without i_mutex
		 * being held. */
		if (managed & DCACHE_MANAGE_TRANSIT) {
			BUG_ON(!path->dentry->d_op);
			BUG_ON(!path->dentry->d_op->d_manage);
1185
			ret = path->dentry->d_op->d_manage(path->dentry, false);
1186
			if (ret < 0)
1187
				break;
1188 1189
		}

1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204
		/* Transit to a mounted filesystem. */
		if (managed & DCACHE_MOUNTED) {
			struct vfsmount *mounted = lookup_mnt(path);
			if (mounted) {
				dput(path->dentry);
				if (need_mntput)
					mntput(path->mnt);
				path->mnt = mounted;
				path->dentry = dget(mounted->mnt_root);
				need_mntput = true;
				continue;
			}

			/* Something is mounted on this dentry in another
			 * namespace and/or whatever was mounted there in this
A
Al Viro 已提交
1205 1206
			 * namespace got unmounted before lookup_mnt() could
			 * get it */
1207 1208 1209 1210
		}

		/* Handle an automount point */
		if (managed & DCACHE_NEED_AUTOMOUNT) {
1211
			ret = follow_automount(path, nd, &need_mntput);
1212
			if (ret < 0)
1213
				break;
1214 1215 1216 1217 1218
			continue;
		}

		/* We didn't change the current path point */
		break;
L
Linus Torvalds 已提交
1219
	}
1220 1221 1222 1223 1224

	if (need_mntput && path->mnt == mnt)
		mntput(path->mnt);
	if (ret == -EISDIR)
		ret = 0;
1225 1226 1227 1228 1229
	if (need_mntput)
		nd->flags |= LOOKUP_JUMPED;
	if (unlikely(ret < 0))
		path_put_conditional(path, nd);
	return ret;
L
Linus Torvalds 已提交
1230 1231
}

1232
int follow_down_one(struct path *path)
L
Linus Torvalds 已提交
1233 1234 1235
{
	struct vfsmount *mounted;

A
Al Viro 已提交
1236
	mounted = lookup_mnt(path);
L
Linus Torvalds 已提交
1237
	if (mounted) {
A
Al Viro 已提交
1238 1239 1240 1241
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
L
Linus Torvalds 已提交
1242 1243 1244 1245
		return 1;
	}
	return 0;
}
1246
EXPORT_SYMBOL(follow_down_one);
L
Linus Torvalds 已提交
1247

1248
static inline int managed_dentry_rcu(struct dentry *dentry)
1249
{
1250 1251
	return (dentry->d_flags & DCACHE_MANAGE_TRANSIT) ?
		dentry->d_op->d_manage(dentry, true) : 0;
1252 1253
}

1254
/*
1255 1256
 * Try to skip to top of mountpoint pile in rcuwalk mode.  Fail if
 * we meet a managed dentry that would need blocking.
1257 1258
 */
static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1259
			       struct inode **inode, unsigned *seqp)
1260
{
1261
	for (;;) {
1262
		struct mount *mounted;
1263 1264 1265 1266
		/*
		 * Don't forget we might have a non-mountpoint managed dentry
		 * that wants to block transit.
		 */
1267 1268 1269
		switch (managed_dentry_rcu(path->dentry)) {
		case -ECHILD:
		default:
1270
			return false;
1271 1272 1273 1274 1275
		case -EISDIR:
			return true;
		case 0:
			break;
		}
1276 1277

		if (!d_mountpoint(path->dentry))
1278
			return !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
1279

A
Al Viro 已提交
1280
		mounted = __lookup_mnt(path->mnt, path->dentry);
1281 1282
		if (!mounted)
			break;
1283 1284
		path->mnt = &mounted->mnt;
		path->dentry = mounted->mnt.mnt_root;
1285
		nd->flags |= LOOKUP_JUMPED;
1286
		*seqp = read_seqcount_begin(&path->dentry->d_seq);
1287 1288 1289 1290 1291 1292
		/*
		 * Update the inode too. We don't need to re-check the
		 * dentry sequence number here after this d_inode read,
		 * because a mount-point is always pinned.
		 */
		*inode = path->dentry->d_inode;
1293
	}
1294
	return !read_seqretry(&mount_lock, nd->m_seq) &&
1295
		!(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
1296 1297
}

N
Nick Piggin 已提交
1298 1299
static int follow_dotdot_rcu(struct nameidata *nd)
{
1300
	struct inode *inode = nd->inode;
N
Nick Piggin 已提交
1301

1302
	while (1) {
1303
		if (path_equal(&nd->path, &nd->root))
N
Nick Piggin 已提交
1304 1305 1306 1307 1308 1309
			break;
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
			struct dentry *old = nd->path.dentry;
			struct dentry *parent = old->d_parent;
			unsigned seq;

1310
			inode = parent->d_inode;
N
Nick Piggin 已提交
1311
			seq = read_seqcount_begin(&parent->d_seq);
1312 1313
			if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq)))
				return -ECHILD;
N
Nick Piggin 已提交
1314 1315
			nd->path.dentry = parent;
			nd->seq = seq;
1316 1317
			if (unlikely(!path_connected(&nd->path)))
				return -ENOENT;
N
Nick Piggin 已提交
1318
			break;
1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333
		} else {
			struct mount *mnt = real_mount(nd->path.mnt);
			struct mount *mparent = mnt->mnt_parent;
			struct dentry *mountpoint = mnt->mnt_mountpoint;
			struct inode *inode2 = mountpoint->d_inode;
			unsigned seq = read_seqcount_begin(&mountpoint->d_seq);
			if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
				return -ECHILD;
			if (&mparent->mnt == nd->path.mnt)
				break;
			/* we know that mountpoint was pinned */
			nd->path.dentry = mountpoint;
			nd->path.mnt = &mparent->mnt;
			inode = inode2;
			nd->seq = seq;
N
Nick Piggin 已提交
1334 1335
		}
	}
1336
	while (unlikely(d_mountpoint(nd->path.dentry))) {
1337 1338
		struct mount *mounted;
		mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
1339 1340
		if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
			return -ECHILD;
1341 1342 1343 1344
		if (!mounted)
			break;
		nd->path.mnt = &mounted->mnt;
		nd->path.dentry = mounted->mnt.mnt_root;
1345
		inode = nd->path.dentry->d_inode;
1346 1347
		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
	}
1348
	nd->inode = inode;
N
Nick Piggin 已提交
1349 1350 1351
	return 0;
}

1352 1353 1354 1355 1356
/*
 * Follow down to the covering mount currently visible to userspace.  At each
 * point, the filesystem owning that dentry may be queried as to whether the
 * caller is permitted to proceed or not.
 */
1357
int follow_down(struct path *path)
1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376
{
	unsigned managed;
	int ret;

	while (managed = ACCESS_ONCE(path->dentry->d_flags),
	       unlikely(managed & DCACHE_MANAGED_DENTRY)) {
		/* Allow the filesystem to manage the transit without i_mutex
		 * being held.
		 *
		 * We indicate to the filesystem if someone is trying to mount
		 * something here.  This gives autofs the chance to deny anyone
		 * other than its daemon the right to mount on its
		 * superstructure.
		 *
		 * The filesystem may sleep at this point.
		 */
		if (managed & DCACHE_MANAGE_TRANSIT) {
			BUG_ON(!path->dentry->d_op);
			BUG_ON(!path->dentry->d_op->d_manage);
1377
			ret = path->dentry->d_op->d_manage(
1378
				path->dentry, false);
1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399
			if (ret < 0)
				return ret == -EISDIR ? 0 : ret;
		}

		/* Transit to a mounted filesystem. */
		if (managed & DCACHE_MOUNTED) {
			struct vfsmount *mounted = lookup_mnt(path);
			if (!mounted)
				break;
			dput(path->dentry);
			mntput(path->mnt);
			path->mnt = mounted;
			path->dentry = dget(mounted->mnt_root);
			continue;
		}

		/* Don't handle automount points here */
		break;
	}
	return 0;
}
1400
EXPORT_SYMBOL(follow_down);
1401

1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417
/*
 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot()
 */
static void follow_mount(struct path *path)
{
	while (d_mountpoint(path->dentry)) {
		struct vfsmount *mounted = lookup_mnt(path);
		if (!mounted)
			break;
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
	}
}

1418
static int follow_dotdot(struct nameidata *nd)
L
Linus Torvalds 已提交
1419 1420
{
	while(1) {
1421
		struct dentry *old = nd->path.dentry;
L
Linus Torvalds 已提交
1422

A
Al Viro 已提交
1423 1424
		if (nd->path.dentry == nd->root.dentry &&
		    nd->path.mnt == nd->root.mnt) {
L
Linus Torvalds 已提交
1425 1426
			break;
		}
1427
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
A
Al Viro 已提交
1428 1429
			/* rare case of legitimate dget_parent()... */
			nd->path.dentry = dget_parent(nd->path.dentry);
L
Linus Torvalds 已提交
1430
			dput(old);
1431 1432
			if (unlikely(!path_connected(&nd->path)))
				return -ENOENT;
L
Linus Torvalds 已提交
1433 1434
			break;
		}
A
Al Viro 已提交
1435
		if (!follow_up(&nd->path))
L
Linus Torvalds 已提交
1436 1437
			break;
	}
A
Al Viro 已提交
1438
	follow_mount(&nd->path);
N
Nick Piggin 已提交
1439
	nd->inode = nd->path.dentry->d_inode;
1440
	return 0;
L
Linus Torvalds 已提交
1441 1442
}

1443
/*
M
Miklos Szeredi 已提交
1444 1445 1446 1447 1448
 * This looks up the name in dcache, possibly revalidates the old dentry and
 * allocates a new one if not found or not valid.  In the need_lookup argument
 * returns whether i_op->lookup is necessary.
 *
 * dir->d_inode->i_mutex must be held
1449
 */
M
Miklos Szeredi 已提交
1450
static struct dentry *lookup_dcache(struct qstr *name, struct dentry *dir,
1451
				    unsigned int flags, bool *need_lookup)
1452 1453
{
	struct dentry *dentry;
M
Miklos Szeredi 已提交
1454
	int error;
1455

M
Miklos Szeredi 已提交
1456 1457 1458
	*need_lookup = false;
	dentry = d_lookup(dir, name);
	if (dentry) {
J
Jeff Layton 已提交
1459
		if (dentry->d_flags & DCACHE_OP_REVALIDATE) {
1460
			error = d_revalidate(dentry, flags);
M
Miklos Szeredi 已提交
1461 1462 1463 1464
			if (unlikely(error <= 0)) {
				if (error < 0) {
					dput(dentry);
					return ERR_PTR(error);
1465 1466
				} else {
					d_invalidate(dentry);
M
Miklos Szeredi 已提交
1467 1468 1469 1470 1471 1472
					dput(dentry);
					dentry = NULL;
				}
			}
		}
	}
1473

M
Miklos Szeredi 已提交
1474 1475 1476 1477
	if (!dentry) {
		dentry = d_alloc(dir, name);
		if (unlikely(!dentry))
			return ERR_PTR(-ENOMEM);
1478

M
Miklos Szeredi 已提交
1479
		*need_lookup = true;
1480 1481 1482 1483
	}
	return dentry;
}

1484
/*
1485 1486
 * Call i_op->lookup on the dentry.  The dentry must be negative and
 * unhashed.
M
Miklos Szeredi 已提交
1487 1488
 *
 * dir->d_inode->i_mutex must be held
1489
 */
M
Miklos Szeredi 已提交
1490
static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry,
1491
				  unsigned int flags)
1492 1493 1494 1495
{
	struct dentry *old;

	/* Don't create child dentry for a dead directory. */
M
Miklos Szeredi 已提交
1496
	if (unlikely(IS_DEADDIR(dir))) {
1497
		dput(dentry);
1498
		return ERR_PTR(-ENOENT);
1499
	}
1500

1501
	old = dir->i_op->lookup(dir, dentry, flags);
1502 1503 1504 1505 1506 1507 1508
	if (unlikely(old)) {
		dput(dentry);
		dentry = old;
	}
	return dentry;
}

1509
static struct dentry *__lookup_hash(struct qstr *name,
1510
		struct dentry *base, unsigned int flags)
1511
{
M
Miklos Szeredi 已提交
1512
	bool need_lookup;
1513 1514
	struct dentry *dentry;

1515
	dentry = lookup_dcache(name, base, flags, &need_lookup);
M
Miklos Szeredi 已提交
1516 1517
	if (!need_lookup)
		return dentry;
1518

1519
	return lookup_real(base->d_inode, dentry, flags);
1520 1521
}

L
Linus Torvalds 已提交
1522 1523 1524 1525 1526
/*
 *  It's more convoluted than I'd like it to be, but... it's still fairly
 *  small and for now I'd prefer to have fast path as straight as possible.
 *  It _is_ time-critical.
 */
A
Al Viro 已提交
1527
static int lookup_fast(struct nameidata *nd,
1528 1529
		       struct path *path, struct inode **inode,
		       unsigned *seqp)
L
Linus Torvalds 已提交
1530
{
1531
	struct vfsmount *mnt = nd->path.mnt;
N
Nick Piggin 已提交
1532
	struct dentry *dentry, *parent = nd->path.dentry;
A
Al Viro 已提交
1533 1534
	int need_reval = 1;
	int status = 1;
1535 1536
	int err;

1537 1538 1539 1540 1541
	/*
	 * Rename seqlock is not required here because in the off chance
	 * of a false negative due to a concurrent rename, we're going to
	 * do the non-racy lookup, below.
	 */
N
Nick Piggin 已提交
1542 1543
	if (nd->flags & LOOKUP_RCU) {
		unsigned seq;
1544
		bool negative;
1545
		dentry = __d_lookup_rcu(parent, &nd->last, &seq);
A
Al Viro 已提交
1546 1547 1548
		if (!dentry)
			goto unlazy;

1549 1550 1551 1552
		/*
		 * This sequence count validates that the inode matches
		 * the dentry name information from lookup.
		 */
1553
		*inode = d_backing_inode(dentry);
1554
		negative = d_is_negative(dentry);
1555 1556 1557 1558 1559 1560 1561 1562 1563 1564
		if (read_seqcount_retry(&dentry->d_seq, seq))
			return -ECHILD;

		/*
		 * This sequence count validates that the parent had no
		 * changes while we did the lookup of the dentry above.
		 *
		 * The memory barrier in read_seqcount_begin of child is
		 *  enough, we can use __read_seqcount_retry here.
		 */
N
Nick Piggin 已提交
1565 1566
		if (__read_seqcount_retry(&parent->d_seq, nd->seq))
			return -ECHILD;
A
Al Viro 已提交
1567

1568
		*seqp = seq;
1569
		if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) {
1570
			status = d_revalidate(dentry, nd->flags);
A
Al Viro 已提交
1571 1572 1573 1574 1575
			if (unlikely(status <= 0)) {
				if (status != -ECHILD)
					need_reval = 0;
				goto unlazy;
			}
1576
		}
1577 1578 1579 1580 1581 1582
		/*
		 * Note: do negative dentry check after revalidation in
		 * case that drops it.
		 */
		if (negative)
			return -ENOENT;
N
Nick Piggin 已提交
1583 1584
		path->mnt = mnt;
		path->dentry = dentry;
1585
		if (likely(__follow_mount_rcu(nd, path, inode, seqp)))
1586
			return 0;
A
Al Viro 已提交
1587
unlazy:
1588
		if (unlazy_walk(nd, dentry, seq))
A
Al Viro 已提交
1589
			return -ECHILD;
A
Al Viro 已提交
1590
	} else {
A
Al Viro 已提交
1591
		dentry = __d_lookup(parent, &nd->last);
1592
	}
A
Al Viro 已提交
1593

1594 1595 1596
	if (unlikely(!dentry))
		goto need_lookup;

A
Al Viro 已提交
1597
	if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval)
1598
		status = d_revalidate(dentry, nd->flags);
A
Al Viro 已提交
1599 1600 1601 1602 1603
	if (unlikely(status <= 0)) {
		if (status < 0) {
			dput(dentry);
			return status;
		}
1604 1605 1606
		d_invalidate(dentry);
		dput(dentry);
		goto need_lookup;
1607
	}
M
Miklos Szeredi 已提交
1608

1609 1610 1611 1612
	if (unlikely(d_is_negative(dentry))) {
		dput(dentry);
		return -ENOENT;
	}
1613 1614
	path->mnt = mnt;
	path->dentry = dentry;
1615
	err = follow_managed(path, nd);
1616
	if (likely(!err))
1617
		*inode = d_backing_inode(path->dentry);
1618
	return err;
1619 1620

need_lookup:
M
Miklos Szeredi 已提交
1621 1622 1623 1624
	return 1;
}

/* Fast lookup failed, do it the slow way */
A
Al Viro 已提交
1625
static int lookup_slow(struct nameidata *nd, struct path *path)
M
Miklos Szeredi 已提交
1626 1627 1628 1629
{
	struct dentry *dentry, *parent;

	parent = nd->path.dentry;
1630 1631
	BUG_ON(nd->inode != parent->d_inode);

A
Al Viro 已提交
1632
	inode_lock(parent->d_inode);
A
Al Viro 已提交
1633
	dentry = __lookup_hash(&nd->last, parent, nd->flags);
A
Al Viro 已提交
1634
	inode_unlock(parent->d_inode);
1635 1636
	if (IS_ERR(dentry))
		return PTR_ERR(dentry);
M
Miklos Szeredi 已提交
1637 1638
	path->mnt = nd->path.mnt;
	path->dentry = dentry;
1639
	return follow_managed(path, nd);
L
Linus Torvalds 已提交
1640 1641
}

1642 1643 1644
static inline int may_lookup(struct nameidata *nd)
{
	if (nd->flags & LOOKUP_RCU) {
1645
		int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1646 1647
		if (err != -ECHILD)
			return err;
1648
		if (unlazy_walk(nd, NULL, 0))
1649 1650
			return -ECHILD;
	}
1651
	return inode_permission(nd->inode, MAY_EXEC);
1652 1653
}

1654 1655 1656
static inline int handle_dots(struct nameidata *nd, int type)
{
	if (type == LAST_DOTDOT) {
1657 1658
		if (!nd->root.mnt)
			set_root(nd);
1659
		if (nd->flags & LOOKUP_RCU) {
1660
			return follow_dotdot_rcu(nd);
1661
		} else
1662
			return follow_dotdot(nd);
1663 1664 1665 1666
	}
	return 0;
}

1667 1668
static int pick_link(struct nameidata *nd, struct path *link,
		     struct inode *inode, unsigned seq)
1669
{
1670
	int error;
A
Al Viro 已提交
1671
	struct saved *last;
1672
	if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) {
1673 1674 1675
		path_to_nameidata(link, nd);
		return -ELOOP;
	}
A
Al Viro 已提交
1676
	if (!(nd->flags & LOOKUP_RCU)) {
1677 1678
		if (link->mnt == nd->path.mnt)
			mntget(link->mnt);
1679
	}
1680 1681
	error = nd_alloc_stack(nd);
	if (unlikely(error)) {
A
Al Viro 已提交
1682 1683 1684 1685 1686 1687 1688 1689 1690
		if (error == -ECHILD) {
			if (unlikely(unlazy_link(nd, link, seq)))
				return -ECHILD;
			error = nd_alloc_stack(nd);
		}
		if (error) {
			path_put(link);
			return error;
		}
1691 1692
	}

1693
	last = nd->stack + nd->depth++;
A
Al Viro 已提交
1694
	last->link = *link;
1695 1696
	clear_delayed_call(&last->done);
	nd->link_inode = inode;
1697
	last->seq = seq;
1698 1699 1700
	return 1;
}

1701 1702 1703 1704 1705 1706
/*
 * Do we need to follow links? We _really_ want to be able
 * to do this check without having to look at inode->i_op,
 * so we keep a cache of "no, this doesn't need follow_link"
 * for the common case.
 */
1707
static inline int should_follow_link(struct nameidata *nd, struct path *link,
1708 1709
				     int follow,
				     struct inode *inode, unsigned seq)
1710
{
1711 1712 1713 1714
	if (likely(!d_is_symlink(link->dentry)))
		return 0;
	if (!follow)
		return 0;
1715
	return pick_link(nd, link, inode, seq);
1716 1717
}

1718 1719 1720
enum {WALK_GET = 1, WALK_PUT = 2};

static int walk_component(struct nameidata *nd, int flags)
1721
{
A
Al Viro 已提交
1722
	struct path path;
1723
	struct inode *inode;
1724
	unsigned seq;
1725 1726 1727 1728 1729 1730
	int err;
	/*
	 * "." and ".." are special - ".." especially so because it has
	 * to be able to know about the current root directory and
	 * parent relationships.
	 */
1731 1732 1733 1734 1735 1736
	if (unlikely(nd->last_type != LAST_NORM)) {
		err = handle_dots(nd, nd->last_type);
		if (flags & WALK_PUT)
			put_link(nd);
		return err;
	}
1737
	err = lookup_fast(nd, &path, &inode, &seq);
1738
	if (unlikely(err)) {
M
Miklos Szeredi 已提交
1739
		if (err < 0)
1740
			return err;
M
Miklos Szeredi 已提交
1741

A
Al Viro 已提交
1742
		err = lookup_slow(nd, &path);
M
Miklos Szeredi 已提交
1743
		if (err < 0)
1744
			return err;
M
Miklos Szeredi 已提交
1745

1746
		inode = d_backing_inode(path.dentry);
1747
		seq = 0;	/* we are already out of RCU mode */
1748
		err = -ENOENT;
A
Al Viro 已提交
1749
		if (d_is_negative(path.dentry))
1750
			goto out_path_put;
1751
	}
M
Miklos Szeredi 已提交
1752

1753 1754
	if (flags & WALK_PUT)
		put_link(nd);
1755
	err = should_follow_link(nd, &path, flags & WALK_GET, inode, seq);
1756 1757
	if (unlikely(err))
		return err;
A
Al Viro 已提交
1758
	path_to_nameidata(&path, nd);
1759
	nd->inode = inode;
1760
	nd->seq = seq;
1761
	return 0;
M
Miklos Szeredi 已提交
1762 1763

out_path_put:
A
Al Viro 已提交
1764
	path_to_nameidata(&path, nd);
M
Miklos Szeredi 已提交
1765
	return err;
1766 1767
}

1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786
/*
 * We can do the critical dentry name comparison and hashing
 * operations one word at a time, but we are limited to:
 *
 * - Architectures with fast unaligned word accesses. We could
 *   do a "get_unaligned()" if this helps and is sufficiently
 *   fast.
 *
 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
 *   do not trap on the (extremely unlikely) case of a page
 *   crossing operation.
 *
 * - Furthermore, we need an efficient 64-bit compile for the
 *   64-bit case in order to generate the "number of bytes in
 *   the final mask". Again, that could be replaced with a
 *   efficient population count instruction or similar.
 */
#ifdef CONFIG_DCACHE_WORD_ACCESS

1787
#include <asm/word-at-a-time.h>
1788

1789
#ifdef CONFIG_64BIT
1790 1791 1792

static inline unsigned int fold_hash(unsigned long hash)
{
1793
	return hash_64(hash, 32);
1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807
}

#else	/* 32-bit case */

#define fold_hash(x) (x)

#endif

unsigned int full_name_hash(const unsigned char *name, unsigned int len)
{
	unsigned long a, mask;
	unsigned long hash = 0;

	for (;;) {
1808
		a = load_unaligned_zeropad(name);
1809 1810 1811
		if (len < sizeof(unsigned long))
			break;
		hash += a;
1812
		hash *= 9;
1813 1814 1815 1816 1817
		name += sizeof(unsigned long);
		len -= sizeof(unsigned long);
		if (!len)
			goto done;
	}
1818
	mask = bytemask_from_count(len);
1819 1820 1821 1822 1823 1824 1825 1826
	hash += mask & a;
done:
	return fold_hash(hash);
}
EXPORT_SYMBOL(full_name_hash);

/*
 * Calculate the length and hash of the path component, and
1827
 * return the "hash_len" as the result.
1828
 */
1829
static inline u64 hash_name(const char *name)
1830
{
1831 1832
	unsigned long a, b, adata, bdata, mask, hash, len;
	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1833 1834 1835 1836 1837 1838

	hash = a = 0;
	len = -sizeof(unsigned long);
	do {
		hash = (hash + a) * 9;
		len += sizeof(unsigned long);
1839
		a = load_unaligned_zeropad(name+len);
1840 1841 1842 1843 1844 1845 1846 1847 1848
		b = a ^ REPEAT_BYTE('/');
	} while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));

	adata = prep_zero_mask(a, adata, &constants);
	bdata = prep_zero_mask(b, bdata, &constants);

	mask = create_zero_mask(adata | bdata);

	hash += a & zero_bytemask(mask);
1849
	len += find_zero(mask);
1850
	return hashlen_create(fold_hash(hash), len);
1851 1852 1853 1854
}

#else

L
Linus Torvalds 已提交
1855 1856 1857 1858 1859 1860 1861
unsigned int full_name_hash(const unsigned char *name, unsigned int len)
{
	unsigned long hash = init_name_hash();
	while (len--)
		hash = partial_name_hash(*name++, hash);
	return end_name_hash(hash);
}
1862
EXPORT_SYMBOL(full_name_hash);
L
Linus Torvalds 已提交
1863

1864 1865 1866 1867
/*
 * We know there's a real path component here of at least
 * one character.
 */
1868
static inline u64 hash_name(const char *name)
1869 1870 1871 1872 1873 1874 1875 1876 1877 1878
{
	unsigned long hash = init_name_hash();
	unsigned long len = 0, c;

	c = (unsigned char)*name;
	do {
		len++;
		hash = partial_name_hash(c, hash);
		c = (unsigned char)name[len];
	} while (c && c != '/');
1879
	return hashlen_create(end_name_hash(hash), len);
1880 1881
}

1882 1883
#endif

L
Linus Torvalds 已提交
1884 1885
/*
 * Name resolution.
1886 1887
 * This is the basic name resolution function, turning a pathname into
 * the final dentry. We expect 'base' to be positive and a directory.
L
Linus Torvalds 已提交
1888
 *
1889 1890
 * Returns 0 and nd will have valid dentry and mnt on success.
 * Returns error and drops reference to input namei data on failure.
L
Linus Torvalds 已提交
1891
 */
1892
static int link_path_walk(const char *name, struct nameidata *nd)
L
Linus Torvalds 已提交
1893 1894
{
	int err;
A
Al Viro 已提交
1895

L
Linus Torvalds 已提交
1896 1897 1898
	while (*name=='/')
		name++;
	if (!*name)
1899
		return 0;
L
Linus Torvalds 已提交
1900 1901 1902

	/* At this point we know we have a real path component. */
	for(;;) {
1903
		u64 hash_len;
A
Al Viro 已提交
1904
		int type;
L
Linus Torvalds 已提交
1905

1906
		err = may_lookup(nd);
L
Linus Torvalds 已提交
1907
 		if (err)
1908
			return err;
L
Linus Torvalds 已提交
1909

1910
		hash_len = hash_name(name);
L
Linus Torvalds 已提交
1911

A
Al Viro 已提交
1912
		type = LAST_NORM;
1913
		if (name[0] == '.') switch (hashlen_len(hash_len)) {
A
Al Viro 已提交
1914
			case 2:
1915
				if (name[1] == '.') {
A
Al Viro 已提交
1916
					type = LAST_DOTDOT;
A
Al Viro 已提交
1917 1918
					nd->flags |= LOOKUP_JUMPED;
				}
A
Al Viro 已提交
1919 1920 1921 1922
				break;
			case 1:
				type = LAST_DOT;
		}
1923 1924
		if (likely(type == LAST_NORM)) {
			struct dentry *parent = nd->path.dentry;
A
Al Viro 已提交
1925
			nd->flags &= ~LOOKUP_JUMPED;
1926
			if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
1927
				struct qstr this = { { .hash_len = hash_len }, .name = name };
1928
				err = parent->d_op->d_hash(parent, &this);
1929
				if (err < 0)
1930
					return err;
1931 1932
				hash_len = this.hash_len;
				name = this.name;
1933 1934
			}
		}
A
Al Viro 已提交
1935

1936 1937
		nd->last.hash_len = hash_len;
		nd->last.name = name;
1938 1939
		nd->last_type = type;

1940 1941
		name += hashlen_len(hash_len);
		if (!*name)
1942
			goto OK;
1943 1944 1945 1946 1947
		/*
		 * If it wasn't NUL, we know it was '/'. Skip that
		 * slash, and continue until no more slashes.
		 */
		do {
1948 1949
			name++;
		} while (unlikely(*name == '/'));
1950 1951
		if (unlikely(!*name)) {
OK:
1952
			/* pathname body, done */
1953 1954 1955
			if (!nd->depth)
				return 0;
			name = nd->stack[nd->depth - 1].name;
1956
			/* trailing symlink, done */
1957 1958 1959
			if (!name)
				return 0;
			/* last component of nested symlink */
1960
			err = walk_component(nd, WALK_GET | WALK_PUT);
1961
		} else {
1962
			err = walk_component(nd, WALK_GET);
1963
		}
1964
		if (err < 0)
1965
			return err;
L
Linus Torvalds 已提交
1966

1967
		if (err) {
1968
			const char *s = get_link(nd);
1969

1970
			if (IS_ERR(s))
1971
				return PTR_ERR(s);
1972 1973 1974
			err = 0;
			if (unlikely(!s)) {
				/* jumped */
1975
				put_link(nd);
1976
			} else {
1977 1978 1979
				nd->stack[nd->depth - 1].name = name;
				name = s;
				continue;
1980
			}
N
Nick Piggin 已提交
1981
		}
1982 1983 1984 1985 1986
		if (unlikely(!d_can_lookup(nd->path.dentry))) {
			if (nd->flags & LOOKUP_RCU) {
				if (unlazy_walk(nd, NULL, 0))
					return -ECHILD;
			}
1987
			return -ENOTDIR;
1988
		}
L
Linus Torvalds 已提交
1989 1990 1991
	}
}

1992
static const char *path_init(struct nameidata *nd, unsigned flags)
N
Nick Piggin 已提交
1993 1994
{
	int retval = 0;
1995
	const char *s = nd->name->name;
N
Nick Piggin 已提交
1996 1997

	nd->last_type = LAST_ROOT; /* if there are only slashes... */
1998
	nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT;
N
Nick Piggin 已提交
1999
	nd->depth = 0;
2000
	if (flags & LOOKUP_ROOT) {
2001 2002
		struct dentry *root = nd->root.dentry;
		struct inode *inode = root->d_inode;
A
Al Viro 已提交
2003
		if (*s) {
M
Miklos Szeredi 已提交
2004
			if (!d_can_lookup(root))
2005
				return ERR_PTR(-ENOTDIR);
A
Al Viro 已提交
2006 2007
			retval = inode_permission(inode, MAY_EXEC);
			if (retval)
2008
				return ERR_PTR(retval);
A
Al Viro 已提交
2009
		}
2010 2011 2012
		nd->path = nd->root;
		nd->inode = inode;
		if (flags & LOOKUP_RCU) {
A
Al Viro 已提交
2013
			rcu_read_lock();
2014
			nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2015
			nd->root_seq = nd->seq;
A
Al Viro 已提交
2016
			nd->m_seq = read_seqbegin(&mount_lock);
2017 2018 2019
		} else {
			path_get(&nd->path);
		}
2020
		return s;
2021 2022
	}

N
Nick Piggin 已提交
2023
	nd->root.mnt = NULL;
2024 2025
	nd->path.mnt = NULL;
	nd->path.dentry = NULL;
N
Nick Piggin 已提交
2026

A
Al Viro 已提交
2027
	nd->m_seq = read_seqbegin(&mount_lock);
A
Al Viro 已提交
2028
	if (*s == '/') {
2029
		if (flags & LOOKUP_RCU)
A
Al Viro 已提交
2030
			rcu_read_lock();
2031
		set_root(nd);
2032
		if (likely(!nd_jump_root(nd)))
2033
			return s;
2034
		nd->root.mnt = NULL;
2035 2036
		rcu_read_unlock();
		return ERR_PTR(-ECHILD);
2037
	} else if (nd->dfd == AT_FDCWD) {
A
Al Viro 已提交
2038 2039 2040
		if (flags & LOOKUP_RCU) {
			struct fs_struct *fs = current->fs;
			unsigned seq;
N
Nick Piggin 已提交
2041

A
Al Viro 已提交
2042
			rcu_read_lock();
N
Nick Piggin 已提交
2043

A
Al Viro 已提交
2044 2045 2046
			do {
				seq = read_seqcount_begin(&fs->seq);
				nd->path = fs->pwd;
2047
				nd->inode = nd->path.dentry->d_inode;
A
Al Viro 已提交
2048 2049 2050 2051
				nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
			} while (read_seqcount_retry(&fs->seq, seq));
		} else {
			get_fs_pwd(current->fs, &nd->path);
2052
			nd->inode = nd->path.dentry->d_inode;
A
Al Viro 已提交
2053
		}
2054
		return s;
N
Nick Piggin 已提交
2055
	} else {
2056
		/* Caller must check execute permissions on the starting path component */
2057
		struct fd f = fdget_raw(nd->dfd);
N
Nick Piggin 已提交
2058 2059
		struct dentry *dentry;

2060
		if (!f.file)
2061
			return ERR_PTR(-EBADF);
N
Nick Piggin 已提交
2062

2063
		dentry = f.file->f_path.dentry;
N
Nick Piggin 已提交
2064

A
Al Viro 已提交
2065
		if (*s) {
M
Miklos Szeredi 已提交
2066
			if (!d_can_lookup(dentry)) {
2067
				fdput(f);
2068
				return ERR_PTR(-ENOTDIR);
2069
			}
A
Al Viro 已提交
2070
		}
N
Nick Piggin 已提交
2071

2072
		nd->path = f.file->f_path;
A
Al Viro 已提交
2073
		if (flags & LOOKUP_RCU) {
A
Al Viro 已提交
2074
			rcu_read_lock();
A
Al Viro 已提交
2075 2076
			nd->inode = nd->path.dentry->d_inode;
			nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
A
Al Viro 已提交
2077
		} else {
2078
			path_get(&nd->path);
A
Al Viro 已提交
2079
			nd->inode = nd->path.dentry->d_inode;
A
Al Viro 已提交
2080
		}
A
Al Viro 已提交
2081
		fdput(f);
2082
		return s;
N
Nick Piggin 已提交
2083
	}
2084 2085
}

2086
static const char *trailing_symlink(struct nameidata *nd)
2087 2088
{
	const char *s;
A
Al Viro 已提交
2089
	int error = may_follow_link(nd);
2090
	if (unlikely(error))
2091
		return ERR_PTR(error);
2092
	nd->flags |= LOOKUP_PARENT;
2093
	nd->stack[0].name = NULL;
2094
	s = get_link(nd);
2095
	return s ? s : "";
2096 2097
}

A
Al Viro 已提交
2098
static inline int lookup_last(struct nameidata *nd)
2099 2100 2101 2102 2103
{
	if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
		nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;

	nd->flags &= ~LOOKUP_PARENT;
2104
	return walk_component(nd,
2105 2106 2107 2108 2109
			nd->flags & LOOKUP_FOLLOW
				? nd->depth
					? WALK_PUT | WALK_GET
					: WALK_GET
				: 0);
2110 2111
}

2112
/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
2113
static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2114
{
2115
	const char *s = path_init(nd, flags);
2116
	int err;
N
Nick Piggin 已提交
2117

2118 2119
	if (IS_ERR(s))
		return PTR_ERR(s);
2120 2121 2122 2123 2124 2125
	while (!(err = link_path_walk(s, nd))
		&& ((err = lookup_last(nd)) > 0)) {
		s = trailing_symlink(nd);
		if (IS_ERR(s)) {
			err = PTR_ERR(s);
			break;
2126 2127
		}
	}
2128 2129
	if (!err)
		err = complete_walk(nd);
2130

2131 2132
	if (!err && nd->flags & LOOKUP_DIRECTORY)
		if (!d_can_lookup(nd->path.dentry))
A
Al Viro 已提交
2133
			err = -ENOTDIR;
2134 2135 2136 2137 2138 2139
	if (!err) {
		*path = nd->path;
		nd->path.mnt = NULL;
		nd->path.dentry = NULL;
	}
	terminate_walk(nd);
2140
	return err;
A
Al Viro 已提交
2141
}
N
Nick Piggin 已提交
2142

2143
static int filename_lookup(int dfd, struct filename *name, unsigned flags,
2144
			   struct path *path, struct path *root)
A
Al Viro 已提交
2145
{
2146
	int retval;
2147
	struct nameidata nd;
2148 2149
	if (IS_ERR(name))
		return PTR_ERR(name);
2150 2151 2152 2153
	if (unlikely(root)) {
		nd.root = *root;
		flags |= LOOKUP_ROOT;
	}
2154
	set_nameidata(&nd, dfd, name);
2155
	retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
A
Al Viro 已提交
2156
	if (unlikely(retval == -ECHILD))
2157
		retval = path_lookupat(&nd, flags, path);
A
Al Viro 已提交
2158
	if (unlikely(retval == -ESTALE))
2159
		retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
N
Nick Piggin 已提交
2160

2161
	if (likely(!retval))
2162
		audit_inode(name, path->dentry, flags & LOOKUP_PARENT);
2163
	restore_nameidata();
2164
	putname(name);
2165
	return retval;
L
Linus Torvalds 已提交
2166 2167
}

2168
/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
2169
static int path_parentat(struct nameidata *nd, unsigned flags,
2170
				struct path *parent)
2171
{
2172
	const char *s = path_init(nd, flags);
2173 2174 2175 2176
	int err;
	if (IS_ERR(s))
		return PTR_ERR(s);
	err = link_path_walk(s, nd);
2177 2178
	if (!err)
		err = complete_walk(nd);
2179 2180 2181 2182 2183 2184
	if (!err) {
		*parent = nd->path;
		nd->path.mnt = NULL;
		nd->path.dentry = NULL;
	}
	terminate_walk(nd);
2185 2186 2187
	return err;
}

2188
static struct filename *filename_parentat(int dfd, struct filename *name,
2189 2190
				unsigned int flags, struct path *parent,
				struct qstr *last, int *type)
2191 2192
{
	int retval;
2193
	struct nameidata nd;
2194

2195 2196
	if (IS_ERR(name))
		return name;
2197
	set_nameidata(&nd, dfd, name);
2198
	retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
2199
	if (unlikely(retval == -ECHILD))
2200
		retval = path_parentat(&nd, flags, parent);
2201
	if (unlikely(retval == -ESTALE))
2202
		retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
2203 2204 2205 2206
	if (likely(!retval)) {
		*last = nd.last;
		*type = nd.last_type;
		audit_inode(name, parent->dentry, LOOKUP_PARENT);
2207 2208 2209
	} else {
		putname(name);
		name = ERR_PTR(retval);
2210
	}
2211
	restore_nameidata();
2212
	return name;
2213 2214
}

A
Al Viro 已提交
2215 2216
/* does lookup, returns the object with parent locked */
struct dentry *kern_path_locked(const char *name, struct path *path)
2217
{
2218 2219
	struct filename *filename;
	struct dentry *d;
2220 2221
	struct qstr last;
	int type;
2222

2223 2224
	filename = filename_parentat(AT_FDCWD, getname_kernel(name), 0, path,
				    &last, &type);
2225 2226
	if (IS_ERR(filename))
		return ERR_CAST(filename);
2227
	if (unlikely(type != LAST_NORM)) {
2228
		path_put(path);
2229 2230
		putname(filename);
		return ERR_PTR(-EINVAL);
A
Al Viro 已提交
2231
	}
A
Al Viro 已提交
2232
	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
2233
	d = __lookup_hash(&last, path->dentry, 0);
A
Al Viro 已提交
2234
	if (IS_ERR(d)) {
A
Al Viro 已提交
2235
		inode_unlock(path->dentry->d_inode);
2236
		path_put(path);
A
Al Viro 已提交
2237
	}
2238
	putname(filename);
A
Al Viro 已提交
2239
	return d;
2240 2241
}

A
Al Viro 已提交
2242 2243
int kern_path(const char *name, unsigned int flags, struct path *path)
{
2244 2245
	return filename_lookup(AT_FDCWD, getname_kernel(name),
			       flags, path, NULL);
A
Al Viro 已提交
2246
}
2247
EXPORT_SYMBOL(kern_path);
A
Al Viro 已提交
2248

2249 2250 2251 2252 2253 2254
/**
 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
 * @dentry:  pointer to dentry of the base directory
 * @mnt: pointer to vfs mount of the base directory
 * @name: pointer to file name
 * @flags: lookup flags
2255
 * @path: pointer to struct path to fill
2256 2257 2258
 */
int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
		    const char *name, unsigned int flags,
2259
		    struct path *path)
2260
{
2261 2262
	struct path root = {.mnt = mnt, .dentry = dentry};
	/* the first argument of filename_lookup() is ignored with root */
2263 2264
	return filename_lookup(AT_FDCWD, getname_kernel(name),
			       flags , path, &root);
2265
}
2266
EXPORT_SYMBOL(vfs_path_lookup);
2267

2268
/**
2269
 * lookup_one_len - filesystem helper to lookup single pathname component
2270 2271 2272 2273
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
2274
 * Note that this routine is purely a helper for filesystem usage and should
2275
 * not be called by generic code.
2276 2277
 *
 * The caller must hold base->i_mutex.
2278
 */
2279 2280 2281
struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
{
	struct qstr this;
A
Al Viro 已提交
2282
	unsigned int c;
2283
	int err;
2284

A
Al Viro 已提交
2285
	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2286

A
Al Viro 已提交
2287 2288
	this.name = name;
	this.len = len;
L
Linus Torvalds 已提交
2289
	this.hash = full_name_hash(name, len);
A
Al Viro 已提交
2290 2291 2292
	if (!len)
		return ERR_PTR(-EACCES);

A
Al Viro 已提交
2293 2294 2295 2296 2297
	if (unlikely(name[0] == '.')) {
		if (len < 2 || (len == 2 && name[1] == '.'))
			return ERR_PTR(-EACCES);
	}

A
Al Viro 已提交
2298 2299 2300 2301 2302
	while (len--) {
		c = *(const unsigned char *)name++;
		if (c == '/' || c == '\0')
			return ERR_PTR(-EACCES);
	}
2303 2304 2305 2306 2307
	/*
	 * See if the low-level filesystem might want
	 * to use its own hash..
	 */
	if (base->d_flags & DCACHE_OP_HASH) {
2308
		int err = base->d_op->d_hash(base, &this);
2309 2310 2311
		if (err < 0)
			return ERR_PTR(err);
	}
2312

2313 2314 2315 2316
	err = inode_permission(base->d_inode, MAY_EXEC);
	if (err)
		return ERR_PTR(err);

2317
	return __lookup_hash(&this, base, 0);
2318
}
2319
EXPORT_SYMBOL(lookup_one_len);
2320

2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382
/**
 * lookup_one_len_unlocked - filesystem helper to lookup single pathname component
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.
 *
 * Unlike lookup_one_len, it should be called without the parent
 * i_mutex held, and will take the i_mutex itself if necessary.
 */
struct dentry *lookup_one_len_unlocked(const char *name,
				       struct dentry *base, int len)
{
	struct qstr this;
	unsigned int c;
	int err;
	struct dentry *ret;

	this.name = name;
	this.len = len;
	this.hash = full_name_hash(name, len);
	if (!len)
		return ERR_PTR(-EACCES);

	if (unlikely(name[0] == '.')) {
		if (len < 2 || (len == 2 && name[1] == '.'))
			return ERR_PTR(-EACCES);
	}

	while (len--) {
		c = *(const unsigned char *)name++;
		if (c == '/' || c == '\0')
			return ERR_PTR(-EACCES);
	}
	/*
	 * See if the low-level filesystem might want
	 * to use its own hash..
	 */
	if (base->d_flags & DCACHE_OP_HASH) {
		int err = base->d_op->d_hash(base, &this);
		if (err < 0)
			return ERR_PTR(err);
	}

	err = inode_permission(base->d_inode, MAY_EXEC);
	if (err)
		return ERR_PTR(err);

	/*
	 * __d_lookup() is used to try to get a quick answer and avoid the
	 * mutex.  A false-negative does no harm.
	 */
	ret = __d_lookup(base, &this);
	if (ret && unlikely(ret->d_flags & DCACHE_OP_REVALIDATE)) {
		dput(ret);
		ret = NULL;
	}
	if (ret)
		return ret;

A
Al Viro 已提交
2383
	inode_lock(base->d_inode);
2384
	ret =  __lookup_hash(&this, base, 0);
A
Al Viro 已提交
2385
	inode_unlock(base->d_inode);
2386 2387 2388 2389
	return ret;
}
EXPORT_SYMBOL(lookup_one_len_unlocked);

2390 2391
int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
		 struct path *path, int *empty)
L
Linus Torvalds 已提交
2392
{
2393 2394
	return filename_lookup(dfd, getname_flags(name, flags, empty),
			       flags, path, NULL);
L
Linus Torvalds 已提交
2395
}
2396
EXPORT_SYMBOL(user_path_at_empty);
2397

2398 2399 2400 2401 2402 2403
/*
 * NB: most callers don't do anything directly with the reference to the
 *     to struct filename, but the nd->last pointer points into the name string
 *     allocated by getname. So we must hold the reference to it until all
 *     path-walking is complete.
 */
A
Al Viro 已提交
2404
static inline struct filename *
2405 2406 2407 2408
user_path_parent(int dfd, const char __user *path,
		 struct path *parent,
		 struct qstr *last,
		 int *type,
2409
		 unsigned int flags)
2410
{
2411
	/* only LOOKUP_REVAL is allowed in extra flags */
2412 2413
	return filename_parentat(dfd, getname(path), flags & LOOKUP_REVAL,
				 parent, last, type);
2414 2415
}

2416
/**
2417
 * mountpoint_last - look up last component for umount
2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442 2443
 * @nd:   pathwalk nameidata - currently pointing at parent directory of "last"
 * @path: pointer to container for result
 *
 * This is a special lookup_last function just for umount. In this case, we
 * need to resolve the path without doing any revalidation.
 *
 * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since
 * mountpoints are always pinned in the dcache, their ancestors are too. Thus,
 * in almost all cases, this lookup will be served out of the dcache. The only
 * cases where it won't are if nd->last refers to a symlink or the path is
 * bogus and it doesn't exist.
 *
 * Returns:
 * -error: if there was an error during lookup. This includes -ENOENT if the
 *         lookup found a negative dentry. The nd->path reference will also be
 *         put in this case.
 *
 * 0:      if we successfully resolved nd->path and found it to not to be a
 *         symlink that needs to be followed. "path" will also be populated.
 *         The nd->path reference will also be put.
 *
 * 1:      if we successfully resolved nd->last and found it to be a symlink
 *         that needs to be followed. "path" will be populated with the path
 *         to the link, and nd->path will *not* be put.
 */
static int
2444
mountpoint_last(struct nameidata *nd, struct path *path)
2445 2446 2447 2448 2449
{
	int error = 0;
	struct dentry *dentry;
	struct dentry *dir = nd->path.dentry;

2450 2451
	/* If we're in rcuwalk, drop out of it to handle last component */
	if (nd->flags & LOOKUP_RCU) {
2452
		if (unlazy_walk(nd, NULL, 0))
2453
			return -ECHILD;
2454 2455 2456 2457 2458 2459
	}

	nd->flags &= ~LOOKUP_PARENT;

	if (unlikely(nd->last_type != LAST_NORM)) {
		error = handle_dots(nd, nd->last_type);
2460
		if (error)
2461
			return error;
2462 2463
		dentry = dget(nd->path.dentry);
		goto done;
2464 2465
	}

A
Al Viro 已提交
2466
	inode_lock(dir->d_inode);
2467 2468 2469 2470 2471 2472 2473 2474 2475
	dentry = d_lookup(dir, &nd->last);
	if (!dentry) {
		/*
		 * No cached dentry. Mounted dentries are pinned in the cache,
		 * so that means that this dentry is probably a symlink or the
		 * path doesn't actually point to a mounted dentry.
		 */
		dentry = d_alloc(dir, &nd->last);
		if (!dentry) {
A
Al Viro 已提交
2476
			inode_unlock(dir->d_inode);
2477
			return -ENOMEM;
2478
		}
2479
		dentry = lookup_real(dir->d_inode, dentry, nd->flags);
2480
		if (IS_ERR(dentry)) {
A
Al Viro 已提交
2481
			inode_unlock(dir->d_inode);
2482
			return PTR_ERR(dentry);
2483
		}
2484
	}
A
Al Viro 已提交
2485
	inode_unlock(dir->d_inode);
2486

2487
done:
2488
	if (d_is_negative(dentry)) {
2489
		dput(dentry);
2490
		return -ENOENT;
2491
	}
2492 2493
	if (nd->depth)
		put_link(nd);
2494
	path->dentry = dentry;
2495
	path->mnt = nd->path.mnt;
2496 2497
	error = should_follow_link(nd, path, nd->flags & LOOKUP_FOLLOW,
				   d_backing_inode(dentry), 0);
2498
	if (unlikely(error))
2499
		return error;
2500
	mntget(path->mnt);
2501
	follow_mount(path);
2502
	return 0;
2503 2504 2505
}

/**
2506
 * path_mountpoint - look up a path to be umounted
2507
 * @nd:		lookup context
2508
 * @flags:	lookup flags
2509
 * @path:	pointer to container for result
2510 2511
 *
 * Look up the given name, but don't attempt to revalidate the last component.
2512
 * Returns 0 and "path" will be valid on success; Returns error otherwise.
2513 2514
 */
static int
2515
path_mountpoint(struct nameidata *nd, unsigned flags, struct path *path)
2516
{
2517
	const char *s = path_init(nd, flags);
2518 2519 2520
	int err;
	if (IS_ERR(s))
		return PTR_ERR(s);
2521 2522 2523 2524 2525
	while (!(err = link_path_walk(s, nd)) &&
		(err = mountpoint_last(nd, path)) > 0) {
		s = trailing_symlink(nd);
		if (IS_ERR(s)) {
			err = PTR_ERR(s);
2526
			break;
2527
		}
2528
	}
2529
	terminate_walk(nd);
2530 2531 2532
	return err;
}

A
Al Viro 已提交
2533
static int
2534
filename_mountpoint(int dfd, struct filename *name, struct path *path,
A
Al Viro 已提交
2535 2536
			unsigned int flags)
{
2537
	struct nameidata nd;
2538
	int error;
2539 2540
	if (IS_ERR(name))
		return PTR_ERR(name);
2541
	set_nameidata(&nd, dfd, name);
2542
	error = path_mountpoint(&nd, flags | LOOKUP_RCU, path);
A
Al Viro 已提交
2543
	if (unlikely(error == -ECHILD))
2544
		error = path_mountpoint(&nd, flags, path);
A
Al Viro 已提交
2545
	if (unlikely(error == -ESTALE))
2546
		error = path_mountpoint(&nd, flags | LOOKUP_REVAL, path);
A
Al Viro 已提交
2547
	if (likely(!error))
2548
		audit_inode(name, path->dentry, 0);
2549
	restore_nameidata();
2550
	putname(name);
A
Al Viro 已提交
2551 2552 2553
	return error;
}

2554
/**
2555
 * user_path_mountpoint_at - lookup a path from userland in order to umount it
2556 2557 2558 2559 2560 2561 2562 2563 2564 2565 2566 2567 2568
 * @dfd:	directory file descriptor
 * @name:	pathname from userland
 * @flags:	lookup flags
 * @path:	pointer to container to hold result
 *
 * A umount is a special case for path walking. We're not actually interested
 * in the inode in this situation, and ESTALE errors can be a problem. We
 * simply want track down the dentry and vfsmount attached at the mountpoint
 * and avoid revalidating the last component.
 *
 * Returns 0 and populates "path" on success.
 */
int
2569
user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags,
2570 2571
			struct path *path)
{
2572
	return filename_mountpoint(dfd, getname(name), path, flags);
2573 2574
}

A
Al Viro 已提交
2575 2576 2577 2578
int
kern_path_mountpoint(int dfd, const char *name, struct path *path,
			unsigned int flags)
{
2579
	return filename_mountpoint(dfd, getname_kernel(name), path, flags);
A
Al Viro 已提交
2580 2581 2582
}
EXPORT_SYMBOL(kern_path_mountpoint);

M
Miklos Szeredi 已提交
2583
int __check_sticky(struct inode *dir, struct inode *inode)
L
Linus Torvalds 已提交
2584
{
2585
	kuid_t fsuid = current_fsuid();
2586

2587
	if (uid_eq(inode->i_uid, fsuid))
L
Linus Torvalds 已提交
2588
		return 0;
2589
	if (uid_eq(dir->i_uid, fsuid))
L
Linus Torvalds 已提交
2590
		return 0;
2591
	return !capable_wrt_inode_uidgid(inode, CAP_FOWNER);
L
Linus Torvalds 已提交
2592
}
M
Miklos Szeredi 已提交
2593
EXPORT_SYMBOL(__check_sticky);
L
Linus Torvalds 已提交
2594 2595 2596 2597 2598 2599 2600 2601 2602 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613

/*
 *	Check whether we can remove a link victim from directory dir, check
 *  whether the type of victim is right.
 *  1. We can't do it if dir is read-only (done in permission())
 *  2. We should have write and exec permissions on dir
 *  3. We can't remove anything from append-only dir
 *  4. We can't do anything with immutable dir (done in permission())
 *  5. If the sticky bit on dir is set we should either
 *	a. be owner of dir, or
 *	b. be owner of victim, or
 *	c. have CAP_FOWNER capability
 *  6. If the victim is append-only or immutable we can't do antyhing with
 *     links pointing to it.
 *  7. If we were asked to remove a directory and victim isn't one - ENOTDIR.
 *  8. If we were asked to remove a non-directory and victim isn't one - EISDIR.
 *  9. We can't remove a root or mountpoint.
 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by
 *     nfs_async_unlink().
 */
2614
static int may_delete(struct inode *dir, struct dentry *victim, bool isdir)
L
Linus Torvalds 已提交
2615
{
2616
	struct inode *inode = d_backing_inode(victim);
L
Linus Torvalds 已提交
2617 2618
	int error;

2619
	if (d_is_negative(victim))
L
Linus Torvalds 已提交
2620
		return -ENOENT;
2621
	BUG_ON(!inode);
L
Linus Torvalds 已提交
2622 2623

	BUG_ON(victim->d_parent->d_inode != dir);
2624
	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
L
Linus Torvalds 已提交
2625

2626
	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
2627 2628 2629 2630
	if (error)
		return error;
	if (IS_APPEND(dir))
		return -EPERM;
2631 2632 2633

	if (check_sticky(dir, inode) || IS_APPEND(inode) ||
	    IS_IMMUTABLE(inode) || IS_SWAPFILE(inode))
L
Linus Torvalds 已提交
2634 2635
		return -EPERM;
	if (isdir) {
M
Miklos Szeredi 已提交
2636
		if (!d_is_dir(victim))
L
Linus Torvalds 已提交
2637 2638 2639
			return -ENOTDIR;
		if (IS_ROOT(victim))
			return -EBUSY;
M
Miklos Szeredi 已提交
2640
	} else if (d_is_dir(victim))
L
Linus Torvalds 已提交
2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656
		return -EISDIR;
	if (IS_DEADDIR(dir))
		return -ENOENT;
	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
		return -EBUSY;
	return 0;
}

/*	Check whether we can create an object with dentry child in directory
 *  dir.
 *  1. We can't do it if child already exists (open has special treatment for
 *     this case, but since we are inlined it's OK)
 *  2. We can't do it if dir is read-only (done in permission())
 *  3. We should have write and exec permissions on dir
 *  4. We can't do it if dir is immutable (done in permission())
 */
2657
static inline int may_create(struct inode *dir, struct dentry *child)
L
Linus Torvalds 已提交
2658
{
2659
	audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
L
Linus Torvalds 已提交
2660 2661 2662 2663
	if (child->d_inode)
		return -EEXIST;
	if (IS_DEADDIR(dir))
		return -ENOENT;
2664
	return inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
2665 2666 2667 2668 2669 2670 2671 2672 2673 2674
}

/*
 * p1 and p2 should be directories on the same fs.
 */
struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
{
	struct dentry *p;

	if (p1 == p2) {
A
Al Viro 已提交
2675
		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
L
Linus Torvalds 已提交
2676 2677 2678
		return NULL;
	}

2679
	mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
2680

2681 2682
	p = d_ancestor(p2, p1);
	if (p) {
A
Al Viro 已提交
2683 2684
		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
		inode_lock_nested(p1->d_inode, I_MUTEX_CHILD);
2685
		return p;
L
Linus Torvalds 已提交
2686 2687
	}

2688 2689
	p = d_ancestor(p1, p2);
	if (p) {
A
Al Viro 已提交
2690 2691
		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
		inode_lock_nested(p2->d_inode, I_MUTEX_CHILD);
2692
		return p;
L
Linus Torvalds 已提交
2693 2694
	}

A
Al Viro 已提交
2695 2696
	inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
	inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
L
Linus Torvalds 已提交
2697 2698
	return NULL;
}
2699
EXPORT_SYMBOL(lock_rename);
L
Linus Torvalds 已提交
2700 2701 2702

void unlock_rename(struct dentry *p1, struct dentry *p2)
{
A
Al Viro 已提交
2703
	inode_unlock(p1->d_inode);
L
Linus Torvalds 已提交
2704
	if (p1 != p2) {
A
Al Viro 已提交
2705
		inode_unlock(p2->d_inode);
2706
		mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
2707 2708
	}
}
2709
EXPORT_SYMBOL(unlock_rename);
L
Linus Torvalds 已提交
2710

A
Al Viro 已提交
2711
int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
A
Al Viro 已提交
2712
		bool want_excl)
L
Linus Torvalds 已提交
2713
{
2714
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2715 2716 2717
	if (error)
		return error;

A
Al Viro 已提交
2718
	if (!dir->i_op->create)
L
Linus Torvalds 已提交
2719 2720 2721 2722 2723 2724
		return -EACCES;	/* shouldn't it be ENOSYS? */
	mode &= S_IALLUGO;
	mode |= S_IFREG;
	error = security_inode_create(dir, dentry, mode);
	if (error)
		return error;
A
Al Viro 已提交
2725
	error = dir->i_op->create(dir, dentry, mode, want_excl);
2726
	if (!error)
2727
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
2728 2729
	return error;
}
2730
EXPORT_SYMBOL(vfs_create);
L
Linus Torvalds 已提交
2731

A
Al Viro 已提交
2732
static int may_open(struct path *path, int acc_mode, int flag)
L
Linus Torvalds 已提交
2733
{
2734
	struct dentry *dentry = path->dentry;
L
Linus Torvalds 已提交
2735 2736 2737 2738 2739 2740
	struct inode *inode = dentry->d_inode;
	int error;

	if (!inode)
		return -ENOENT;

C
Christoph Hellwig 已提交
2741 2742
	switch (inode->i_mode & S_IFMT) {
	case S_IFLNK:
L
Linus Torvalds 已提交
2743
		return -ELOOP;
C
Christoph Hellwig 已提交
2744 2745 2746 2747 2748 2749
	case S_IFDIR:
		if (acc_mode & MAY_WRITE)
			return -EISDIR;
		break;
	case S_IFBLK:
	case S_IFCHR:
2750
		if (path->mnt->mnt_flags & MNT_NODEV)
L
Linus Torvalds 已提交
2751
			return -EACCES;
C
Christoph Hellwig 已提交
2752 2753 2754
		/*FALLTHRU*/
	case S_IFIFO:
	case S_IFSOCK:
L
Linus Torvalds 已提交
2755
		flag &= ~O_TRUNC;
C
Christoph Hellwig 已提交
2756
		break;
2757
	}
2758

A
Al Viro 已提交
2759
	error = inode_permission(inode, MAY_OPEN | acc_mode);
2760 2761
	if (error)
		return error;
M
Mimi Zohar 已提交
2762

L
Linus Torvalds 已提交
2763 2764 2765 2766
	/*
	 * An append-only file must be opened in append mode for writing.
	 */
	if (IS_APPEND(inode)) {
2767
		if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
2768
			return -EPERM;
L
Linus Torvalds 已提交
2769
		if (flag & O_TRUNC)
2770
			return -EPERM;
L
Linus Torvalds 已提交
2771 2772 2773
	}

	/* O_NOATIME can only be set by the owner or superuser */
2774
	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
2775
		return -EPERM;
L
Linus Torvalds 已提交
2776

2777
	return 0;
2778
}
L
Linus Torvalds 已提交
2779

2780
static int handle_truncate(struct file *filp)
2781
{
2782
	struct path *path = &filp->f_path;
2783 2784 2785 2786 2787 2788 2789
	struct inode *inode = path->dentry->d_inode;
	int error = get_write_access(inode);
	if (error)
		return error;
	/*
	 * Refuse to truncate files with mandatory locks held on them.
	 */
2790
	error = locks_verify_locked(filp);
2791
	if (!error)
2792
		error = security_path_truncate(path);
2793 2794 2795
	if (!error) {
		error = do_truncate(path->dentry, 0,
				    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
2796
				    filp);
2797 2798
	}
	put_write_access(inode);
M
Mimi Zohar 已提交
2799
	return error;
L
Linus Torvalds 已提交
2800 2801
}

2802 2803
static inline int open_to_namei_flags(int flag)
{
2804 2805
	if ((flag & O_ACCMODE) == 3)
		flag--;
2806 2807 2808
	return flag;
}

M
Miklos Szeredi 已提交
2809 2810 2811 2812 2813 2814 2815 2816 2817 2818 2819 2820 2821
static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode)
{
	int error = security_path_mknod(dir, dentry, mode, 0);
	if (error)
		return error;

	error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
	if (error)
		return error;

	return security_inode_create(dir->dentry->d_inode, dentry, mode);
}

2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834
/*
 * Attempt to atomically look up, create and open a file from a negative
 * dentry.
 *
 * Returns 0 if successful.  The file will have been created and attached to
 * @file by the filesystem calling finish_open().
 *
 * Returns 1 if the file was looked up only or didn't need creating.  The
 * caller will need to perform the open themselves.  @path will have been
 * updated to point to the new dentry.  This may be negative.
 *
 * Returns an error code otherwise.
 */
2835 2836 2837
static int atomic_open(struct nameidata *nd, struct dentry *dentry,
			struct path *path, struct file *file,
			const struct open_flags *op,
2838
			bool got_write, bool need_lookup,
2839
			int *opened)
M
Miklos Szeredi 已提交
2840 2841 2842 2843 2844 2845 2846 2847
{
	struct inode *dir =  nd->path.dentry->d_inode;
	unsigned open_flag = open_to_namei_flags(op->open_flag);
	umode_t mode;
	int error;
	int acc_mode;
	int create_error = 0;
	struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
2848
	bool excl;
M
Miklos Szeredi 已提交
2849 2850 2851 2852 2853

	BUG_ON(dentry->d_inode);

	/* Don't create child dentry for a dead directory. */
	if (unlikely(IS_DEADDIR(dir))) {
2854
		error = -ENOENT;
M
Miklos Szeredi 已提交
2855 2856 2857
		goto out;
	}

2858
	mode = op->mode;
M
Miklos Szeredi 已提交
2859 2860 2861
	if ((open_flag & O_CREAT) && !IS_POSIXACL(dir))
		mode &= ~current_umask();

2862 2863
	excl = (open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT);
	if (excl)
M
Miklos Szeredi 已提交
2864 2865 2866 2867 2868 2869 2870 2871 2872 2873 2874
		open_flag &= ~O_TRUNC;

	/*
	 * Checking write permission is tricky, bacuse we don't know if we are
	 * going to actually need it: O_CREAT opens should work as long as the
	 * file exists.  But checking existence breaks atomicity.  The trick is
	 * to check access and if not granted clear O_CREAT from the flags.
	 *
	 * Another problem is returing the "right" error value (e.g. for an
	 * O_EXCL open we want to return EEXIST not EROFS).
	 */
2875 2876 2877
	if (((open_flag & (O_CREAT | O_TRUNC)) ||
	    (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) {
		if (!(open_flag & O_CREAT)) {
M
Miklos Szeredi 已提交
2878 2879 2880 2881 2882 2883 2884
			/*
			 * No O_CREATE -> atomicity not a requirement -> fall
			 * back to lookup + open
			 */
			goto no_open;
		} else if (open_flag & (O_EXCL | O_TRUNC)) {
			/* Fall back and fail with the right error */
2885
			create_error = -EROFS;
M
Miklos Szeredi 已提交
2886 2887 2888
			goto no_open;
		} else {
			/* No side effects, safe to clear O_CREAT */
2889
			create_error = -EROFS;
M
Miklos Szeredi 已提交
2890 2891 2892 2893 2894
			open_flag &= ~O_CREAT;
		}
	}

	if (open_flag & O_CREAT) {
2895
		error = may_o_create(&nd->path, dentry, mode);
M
Miklos Szeredi 已提交
2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906
		if (error) {
			create_error = error;
			if (open_flag & O_EXCL)
				goto no_open;
			open_flag &= ~O_CREAT;
		}
	}

	if (nd->flags & LOOKUP_DIRECTORY)
		open_flag |= O_DIRECTORY;

A
Al Viro 已提交
2907 2908 2909
	file->f_path.dentry = DENTRY_NOT_SET;
	file->f_path.mnt = nd->path.mnt;
	error = dir->i_op->atomic_open(dir, dentry, file, open_flag, mode,
2910
				      opened);
A
Al Viro 已提交
2911 2912 2913
	if (error < 0) {
		if (create_error && error == -ENOENT)
			error = create_error;
M
Miklos Szeredi 已提交
2914 2915 2916
		goto out;
	}

A
Al Viro 已提交
2917
	if (error) {	/* returned 1, that is */
A
Al Viro 已提交
2918
		if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
2919
			error = -EIO;
M
Miklos Szeredi 已提交
2920 2921
			goto out;
		}
A
Al Viro 已提交
2922
		if (file->f_path.dentry) {
M
Miklos Szeredi 已提交
2923
			dput(dentry);
A
Al Viro 已提交
2924
			dentry = file->f_path.dentry;
M
Miklos Szeredi 已提交
2925
		}
2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938
		if (*opened & FILE_CREATED)
			fsnotify_create(dir, dentry);
		if (!dentry->d_inode) {
			WARN_ON(*opened & FILE_CREATED);
			if (create_error) {
				error = create_error;
				goto out;
			}
		} else {
			if (excl && !(*opened & FILE_CREATED)) {
				error = -EEXIST;
				goto out;
			}
2939
		}
M
Miklos Szeredi 已提交
2940 2941 2942 2943 2944 2945 2946
		goto looked_up;
	}

	/*
	 * We didn't have the inode before the open, so check open permission
	 * here.
	 */
2947 2948 2949 2950
	acc_mode = op->acc_mode;
	if (*opened & FILE_CREATED) {
		WARN_ON(!(open_flag & O_CREAT));
		fsnotify_create(dir, dentry);
A
Al Viro 已提交
2951
		acc_mode = 0;
2952
	}
2953 2954 2955
	error = may_open(&file->f_path, acc_mode, open_flag);
	if (error)
		fput(file);
M
Miklos Szeredi 已提交
2956 2957 2958

out:
	dput(dentry);
2959
	return error;
M
Miklos Szeredi 已提交
2960 2961 2962

no_open:
	if (need_lookup) {
2963
		dentry = lookup_real(dir, dentry, nd->flags);
M
Miklos Szeredi 已提交
2964
		if (IS_ERR(dentry))
2965
			return PTR_ERR(dentry);
M
Miklos Szeredi 已提交
2966 2967 2968 2969

		if (create_error) {
			int open_flag = op->open_flag;

2970
			error = create_error;
M
Miklos Szeredi 已提交
2971 2972 2973 2974 2975 2976
			if ((open_flag & O_EXCL)) {
				if (!dentry->d_inode)
					goto out;
			} else if (!dentry->d_inode) {
				goto out;
			} else if ((open_flag & O_TRUNC) &&
2977
				   d_is_reg(dentry)) {
M
Miklos Szeredi 已提交
2978 2979 2980 2981 2982 2983 2984 2985
				goto out;
			}
			/* will fail later, go on to get the right error */
		}
	}
looked_up:
	path->dentry = dentry;
	path->mnt = nd->path.mnt;
2986
	return 1;
M
Miklos Szeredi 已提交
2987 2988
}

M
Miklos Szeredi 已提交
2989
/*
2990
 * Look up and maybe create and open the last component.
M
Miklos Szeredi 已提交
2991 2992 2993
 *
 * Must be called with i_mutex held on parent.
 *
2994 2995 2996 2997 2998 2999 3000 3001 3002 3003 3004 3005
 * Returns 0 if the file was successfully atomically created (if necessary) and
 * opened.  In this case the file will be returned attached to @file.
 *
 * Returns 1 if the file was not completely opened at this time, though lookups
 * and creations will have been performed and the dentry returned in @path will
 * be positive upon return if O_CREAT was specified.  If O_CREAT wasn't
 * specified then a negative dentry may be returned.
 *
 * An error code is returned otherwise.
 *
 * FILE_CREATE will be set in @*opened if the dentry was created and will be
 * cleared otherwise prior to returning.
M
Miklos Szeredi 已提交
3006
 */
3007 3008 3009
static int lookup_open(struct nameidata *nd, struct path *path,
			struct file *file,
			const struct open_flags *op,
3010
			bool got_write, int *opened)
M
Miklos Szeredi 已提交
3011 3012
{
	struct dentry *dir = nd->path.dentry;
3013
	struct inode *dir_inode = dir->d_inode;
M
Miklos Szeredi 已提交
3014 3015
	struct dentry *dentry;
	int error;
3016
	bool need_lookup;
M
Miklos Szeredi 已提交
3017

3018
	*opened &= ~FILE_CREATED;
3019
	dentry = lookup_dcache(&nd->last, dir, nd->flags, &need_lookup);
M
Miklos Szeredi 已提交
3020
	if (IS_ERR(dentry))
3021
		return PTR_ERR(dentry);
M
Miklos Szeredi 已提交
3022

M
Miklos Szeredi 已提交
3023 3024 3025 3026 3027
	/* Cached positive dentry: will open in f_op->open */
	if (!need_lookup && dentry->d_inode)
		goto out_no_open;

	if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) {
3028
		return atomic_open(nd, dentry, path, file, op, got_write,
3029
				   need_lookup, opened);
M
Miklos Szeredi 已提交
3030 3031
	}

3032 3033 3034
	if (need_lookup) {
		BUG_ON(dentry->d_inode);

3035
		dentry = lookup_real(dir_inode, dentry, nd->flags);
3036
		if (IS_ERR(dentry))
3037
			return PTR_ERR(dentry);
3038 3039
	}

M
Miklos Szeredi 已提交
3040 3041 3042 3043 3044 3045 3046 3047 3048 3049
	/* Negative dentry, just create the file */
	if (!dentry->d_inode && (op->open_flag & O_CREAT)) {
		umode_t mode = op->mode;
		if (!IS_POSIXACL(dir->d_inode))
			mode &= ~current_umask();
		/*
		 * This write is needed to ensure that a
		 * rw->ro transition does not occur between
		 * the time when the file is created and when
		 * a permanent write count is taken through
3050
		 * the 'struct file' in finish_open().
M
Miklos Szeredi 已提交
3051
		 */
3052 3053
		if (!got_write) {
			error = -EROFS;
M
Miklos Szeredi 已提交
3054
			goto out_dput;
3055
		}
3056
		*opened |= FILE_CREATED;
M
Miklos Szeredi 已提交
3057 3058 3059
		error = security_path_mknod(&nd->path, dentry, mode, 0);
		if (error)
			goto out_dput;
A
Al Viro 已提交
3060 3061
		error = vfs_create(dir->d_inode, dentry, mode,
				   nd->flags & LOOKUP_EXCL);
M
Miklos Szeredi 已提交
3062 3063 3064
		if (error)
			goto out_dput;
	}
M
Miklos Szeredi 已提交
3065
out_no_open:
M
Miklos Szeredi 已提交
3066 3067
	path->dentry = dentry;
	path->mnt = nd->path.mnt;
3068
	return 1;
M
Miklos Szeredi 已提交
3069 3070 3071

out_dput:
	dput(dentry);
3072
	return error;
M
Miklos Szeredi 已提交
3073 3074
}

N
Nick Piggin 已提交
3075
/*
3076
 * Handle the last step of open()
N
Nick Piggin 已提交
3077
 */
3078
static int do_last(struct nameidata *nd,
3079
		   struct file *file, const struct open_flags *op,
A
Al Viro 已提交
3080
		   int *opened)
3081
{
3082
	struct dentry *dir = nd->path.dentry;
3083
	int open_flag = op->open_flag;
M
Miklos Szeredi 已提交
3084
	bool will_truncate = (open_flag & O_TRUNC) != 0;
3085
	bool got_write = false;
A
Al Viro 已提交
3086
	int acc_mode = op->acc_mode;
3087
	unsigned seq;
3088
	struct inode *inode;
3089
	struct path save_parent = { .dentry = NULL, .mnt = NULL };
3090
	struct path path;
3091
	bool retried = false;
A
Al Viro 已提交
3092
	int error;
3093

3094 3095 3096
	nd->flags &= ~LOOKUP_PARENT;
	nd->flags |= op->intent;

3097
	if (nd->last_type != LAST_NORM) {
3098
		error = handle_dots(nd, nd->last_type);
3099
		if (unlikely(error))
3100
			return error;
M
Miklos Szeredi 已提交
3101
		goto finish_open;
3102
	}
3103

3104
	if (!(open_flag & O_CREAT)) {
3105 3106 3107
		if (nd->last.name[nd->last.len])
			nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
		/* we _can_ be in RCU mode here */
3108
		error = lookup_fast(nd, &path, &inode, &seq);
3109 3110 3111 3112
		if (likely(!error))
			goto finish_lookup;

		if (error < 0)
3113
			return error;
3114 3115

		BUG_ON(nd->inode != dir->d_inode);
3116 3117 3118 3119 3120 3121 3122 3123
	} else {
		/* create side of things */
		/*
		 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED
		 * has been cleared when we got to the last component we are
		 * about to look up
		 */
		error = complete_walk(nd);
3124
		if (error)
3125
			return error;
3126

A
Al Viro 已提交
3127
		audit_inode(nd->name, dir, LOOKUP_PARENT);
3128
		/* trailing slashes? */
3129 3130
		if (unlikely(nd->last.name[nd->last.len]))
			return -EISDIR;
3131
	}
A
Al Viro 已提交
3132

3133
retry_lookup:
3134 3135 3136 3137 3138 3139 3140 3141 3142 3143
	if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
		error = mnt_want_write(nd->path.mnt);
		if (!error)
			got_write = true;
		/*
		 * do _not_ fail yet - we might not need that or fail with
		 * a different error; let lookup_open() decide; we'll be
		 * dropping this one anyway.
		 */
	}
A
Al Viro 已提交
3144
	inode_lock(dir->d_inode);
3145
	error = lookup_open(nd, &path, file, op, got_write, opened);
A
Al Viro 已提交
3146
	inode_unlock(dir->d_inode);
3147

3148 3149
	if (error <= 0) {
		if (error)
M
Miklos Szeredi 已提交
3150 3151
			goto out;

3152
		if ((*opened & FILE_CREATED) ||
A
Al Viro 已提交
3153
		    !S_ISREG(file_inode(file)->i_mode))
M
Miklos Szeredi 已提交
3154
			will_truncate = false;
M
Miklos Szeredi 已提交
3155

A
Al Viro 已提交
3156
		audit_inode(nd->name, file->f_path.dentry, 0);
M
Miklos Szeredi 已提交
3157 3158
		goto opened;
	}
3159

3160
	if (*opened & FILE_CREATED) {
3161
		/* Don't check for write permission, don't truncate */
3162
		open_flag &= ~O_TRUNC;
M
Miklos Szeredi 已提交
3163
		will_truncate = false;
A
Al Viro 已提交
3164
		acc_mode = 0;
3165
		path_to_nameidata(&path, nd);
M
Miklos Szeredi 已提交
3166
		goto finish_open_created;
3167 3168 3169
	}

	/*
3170
	 * create/update audit record if it already exists.
3171
	 */
3172
	if (d_is_positive(path.dentry))
A
Al Viro 已提交
3173
		audit_inode(nd->name, path.dentry, 0);
3174

M
Miklos Szeredi 已提交
3175 3176 3177 3178 3179
	/*
	 * If atomic_open() acquired write access it is dropped now due to
	 * possible mount and symlink following (this might be optimized away if
	 * necessary...)
	 */
3180
	if (got_write) {
M
Miklos Szeredi 已提交
3181
		mnt_drop_write(nd->path.mnt);
3182
		got_write = false;
M
Miklos Szeredi 已提交
3183 3184
	}

3185 3186 3187 3188
	if (unlikely((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))) {
		path_to_nameidata(&path, nd);
		return -EEXIST;
	}
3189

3190
	error = follow_managed(&path, nd);
3191 3192
	if (unlikely(error < 0))
		return error;
3193

3194
	BUG_ON(nd->flags & LOOKUP_RCU);
3195
	inode = d_backing_inode(path.dentry);
3196
	seq = 0;	/* out of RCU mode, so the value doesn't matter */
3197
	if (unlikely(d_is_negative(path.dentry))) {
3198
		path_to_nameidata(&path, nd);
3199
		return -ENOENT;
3200
	}
3201
finish_lookup:
3202 3203
	if (nd->depth)
		put_link(nd);
3204 3205
	error = should_follow_link(nd, &path, nd->flags & LOOKUP_FOLLOW,
				   inode, seq);
3206
	if (unlikely(error))
3207
		return error;
3208

3209 3210
	if (unlikely(d_is_symlink(path.dentry)) && !(open_flag & O_PATH)) {
		path_to_nameidata(&path, nd);
3211
		return -ELOOP;
3212 3213
	}

3214 3215
	if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path.mnt) {
		path_to_nameidata(&path, nd);
3216 3217
	} else {
		save_parent.dentry = nd->path.dentry;
3218 3219
		save_parent.mnt = mntget(path.mnt);
		nd->path.dentry = path.dentry;
3220 3221

	}
3222
	nd->inode = inode;
3223
	nd->seq = seq;
3224
	/* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
3225
finish_open:
3226
	error = complete_walk(nd);
3227 3228
	if (error) {
		path_put(&save_parent);
3229
		return error;
3230
	}
A
Al Viro 已提交
3231
	audit_inode(nd->name, nd->path.dentry, 0);
3232
	error = -EISDIR;
M
Miklos Szeredi 已提交
3233
	if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry))
3234
		goto out;
3235
	error = -ENOTDIR;
M
Miklos Szeredi 已提交
3236
	if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
3237
		goto out;
3238
	if (!d_is_reg(nd->path.dentry))
M
Miklos Szeredi 已提交
3239
		will_truncate = false;
3240

3241 3242 3243
	if (will_truncate) {
		error = mnt_want_write(nd->path.mnt);
		if (error)
3244
			goto out;
3245
		got_write = true;
3246
	}
M
Miklos Szeredi 已提交
3247
finish_open_created:
A
Al Viro 已提交
3248 3249 3250 3251 3252
	if (likely(!(open_flag & O_PATH))) {
		error = may_open(&nd->path, acc_mode, open_flag);
		if (error)
			goto out;
	}
M
Miklos Szeredi 已提交
3253 3254 3255 3256 3257
	BUG_ON(*opened & FILE_OPENED); /* once it's opened, it's opened */
	error = vfs_open(&nd->path, file, current_cred());
	if (!error) {
		*opened |= FILE_OPENED;
	} else {
A
Al Viro 已提交
3258
		if (error == -EOPENSTALE)
M
Miklos Szeredi 已提交
3259
			goto stale_open;
3260
		goto out;
M
Miklos Szeredi 已提交
3261
	}
3262
opened:
3263
	error = open_check_o_direct(file);
3264 3265
	if (error)
		goto exit_fput;
3266
	error = ima_file_check(file, op->acc_mode, *opened);
3267 3268 3269 3270
	if (error)
		goto exit_fput;

	if (will_truncate) {
3271
		error = handle_truncate(file);
3272 3273
		if (error)
			goto exit_fput;
3274
	}
3275
out:
3276 3277 3278 3279
	if (unlikely(error > 0)) {
		WARN_ON(1);
		error = -EINVAL;
	}
3280
	if (got_write)
3281
		mnt_drop_write(nd->path.mnt);
3282
	path_put(&save_parent);
3283
	return error;
3284

3285
exit_fput:
3286 3287
	fput(file);
	goto out;
3288

M
Miklos Szeredi 已提交
3289 3290 3291 3292 3293 3294 3295 3296 3297 3298 3299
stale_open:
	/* If no saved parent or already retried then can't retry */
	if (!save_parent.dentry || retried)
		goto out;

	BUG_ON(save_parent.dentry != dir);
	path_put(&nd->path);
	nd->path = save_parent;
	nd->inode = dir->d_inode;
	save_parent.mnt = NULL;
	save_parent.dentry = NULL;
3300
	if (got_write) {
M
Miklos Szeredi 已提交
3301
		mnt_drop_write(nd->path.mnt);
3302
		got_write = false;
M
Miklos Szeredi 已提交
3303 3304 3305
	}
	retried = true;
	goto retry_lookup;
3306 3307
}

3308
static int do_tmpfile(struct nameidata *nd, unsigned flags,
3309 3310 3311 3312
		const struct open_flags *op,
		struct file *file, int *opened)
{
	static const struct qstr name = QSTR_INIT("/", 1);
3313
	struct dentry *child;
3314
	struct inode *dir;
3315
	struct path path;
3316
	int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
3317 3318
	if (unlikely(error))
		return error;
3319
	error = mnt_want_write(path.mnt);
3320 3321
	if (unlikely(error))
		goto out;
3322
	dir = path.dentry->d_inode;
3323
	/* we want directory to be writable */
3324
	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
3325 3326 3327 3328 3329 3330
	if (error)
		goto out2;
	if (!dir->i_op->tmpfile) {
		error = -EOPNOTSUPP;
		goto out2;
	}
3331
	child = d_alloc(path.dentry, &name);
3332 3333 3334 3335
	if (unlikely(!child)) {
		error = -ENOMEM;
		goto out2;
	}
3336 3337 3338
	dput(path.dentry);
	path.dentry = child;
	error = dir->i_op->tmpfile(dir, child, op->mode);
3339 3340
	if (error)
		goto out2;
3341
	audit_inode(nd->name, child, 0);
3342
	/* Don't check for other permissions, the inode was just created */
A
Al Viro 已提交
3343
	error = may_open(&path, 0, op->open_flag);
3344 3345
	if (error)
		goto out2;
3346 3347
	file->f_path.mnt = path.mnt;
	error = finish_open(file, child, NULL, opened);
3348 3349 3350
	if (error)
		goto out2;
	error = open_check_o_direct(file);
3351
	if (error) {
3352
		fput(file);
3353 3354 3355 3356 3357 3358
	} else if (!(op->open_flag & O_EXCL)) {
		struct inode *inode = file_inode(file);
		spin_lock(&inode->i_lock);
		inode->i_state |= I_LINKABLE;
		spin_unlock(&inode->i_lock);
	}
3359
out2:
3360
	mnt_drop_write(path.mnt);
3361
out:
3362
	path_put(&path);
3363 3364 3365
	return error;
}

3366 3367
static struct file *path_openat(struct nameidata *nd,
			const struct open_flags *op, unsigned flags)
L
Linus Torvalds 已提交
3368
{
3369
	const char *s;
A
Al Viro 已提交
3370
	struct file *file;
3371
	int opened = 0;
3372
	int error;
N
Nick Piggin 已提交
3373

A
Al Viro 已提交
3374
	file = get_empty_filp();
3375 3376
	if (IS_ERR(file))
		return file;
N
Nick Piggin 已提交
3377

A
Al Viro 已提交
3378
	file->f_flags = op->open_flag;
N
Nick Piggin 已提交
3379

A
Al Viro 已提交
3380
	if (unlikely(file->f_flags & __O_TMPFILE)) {
3381
		error = do_tmpfile(nd, flags, op, file, &opened);
A
Al Viro 已提交
3382
		goto out2;
3383 3384
	}

3385
	s = path_init(nd, flags);
3386 3387 3388 3389
	if (IS_ERR(s)) {
		put_filp(file);
		return ERR_CAST(s);
	}
3390
	while (!(error = link_path_walk(s, nd)) &&
A
Al Viro 已提交
3391
		(error = do_last(nd, file, op, &opened)) > 0) {
A
Al Viro 已提交
3392
		nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3393 3394 3395
		s = trailing_symlink(nd);
		if (IS_ERR(s)) {
			error = PTR_ERR(s);
3396
			break;
3397
		}
3398
	}
3399
	terminate_walk(nd);
A
Al Viro 已提交
3400
out2:
3401 3402
	if (!(opened & FILE_OPENED)) {
		BUG_ON(!error);
A
Al Viro 已提交
3403
		put_filp(file);
3404
	}
3405 3406 3407 3408 3409 3410 3411 3412 3413 3414
	if (unlikely(error)) {
		if (error == -EOPENSTALE) {
			if (flags & LOOKUP_RCU)
				error = -ECHILD;
			else
				error = -ESTALE;
		}
		file = ERR_PTR(error);
	}
	return file;
L
Linus Torvalds 已提交
3415 3416
}

3417
struct file *do_filp_open(int dfd, struct filename *pathname,
3418
		const struct open_flags *op)
3419
{
3420
	struct nameidata nd;
3421
	int flags = op->lookup_flags;
3422 3423
	struct file *filp;

3424
	set_nameidata(&nd, dfd, pathname);
3425
	filp = path_openat(&nd, op, flags | LOOKUP_RCU);
3426
	if (unlikely(filp == ERR_PTR(-ECHILD)))
3427
		filp = path_openat(&nd, op, flags);
3428
	if (unlikely(filp == ERR_PTR(-ESTALE)))
3429
		filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
3430
	restore_nameidata();
3431 3432 3433
	return filp;
}

A
Al Viro 已提交
3434
struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
3435
		const char *name, const struct open_flags *op)
A
Al Viro 已提交
3436
{
3437
	struct nameidata nd;
A
Al Viro 已提交
3438
	struct file *file;
3439
	struct filename *filename;
3440
	int flags = op->lookup_flags | LOOKUP_ROOT;
A
Al Viro 已提交
3441 3442 3443 3444

	nd.root.mnt = mnt;
	nd.root.dentry = dentry;

3445
	if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN)
A
Al Viro 已提交
3446 3447
		return ERR_PTR(-ELOOP);

3448
	filename = getname_kernel(name);
3449
	if (IS_ERR(filename))
3450 3451
		return ERR_CAST(filename);

3452
	set_nameidata(&nd, -1, filename);
3453
	file = path_openat(&nd, op, flags | LOOKUP_RCU);
A
Al Viro 已提交
3454
	if (unlikely(file == ERR_PTR(-ECHILD)))
3455
		file = path_openat(&nd, op, flags);
A
Al Viro 已提交
3456
	if (unlikely(file == ERR_PTR(-ESTALE)))
3457
		file = path_openat(&nd, op, flags | LOOKUP_REVAL);
3458
	restore_nameidata();
3459
	putname(filename);
A
Al Viro 已提交
3460 3461 3462
	return file;
}

3463
static struct dentry *filename_create(int dfd, struct filename *name,
3464
				struct path *path, unsigned int lookup_flags)
L
Linus Torvalds 已提交
3465
{
3466
	struct dentry *dentry = ERR_PTR(-EEXIST);
3467 3468
	struct qstr last;
	int type;
3469
	int err2;
3470 3471 3472 3473 3474 3475 3476 3477 3478
	int error;
	bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);

	/*
	 * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any
	 * other flags passed in are ignored!
	 */
	lookup_flags &= LOOKUP_REVAL;

3479 3480 3481
	name = filename_parentat(dfd, name, lookup_flags, path, &last, &type);
	if (IS_ERR(name))
		return ERR_CAST(name);
L
Linus Torvalds 已提交
3482

3483 3484 3485 3486
	/*
	 * Yucky last component or no last component at all?
	 * (foo/., foo/.., /////)
	 */
3487
	if (unlikely(type != LAST_NORM))
A
Al Viro 已提交
3488
		goto out;
3489

3490
	/* don't fail immediately if it's r/o, at least try to report other errors */
3491
	err2 = mnt_want_write(path->mnt);
3492 3493 3494
	/*
	 * Do the final lookup.
	 */
3495
	lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL;
A
Al Viro 已提交
3496
	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
3497
	dentry = __lookup_hash(&last, path->dentry, lookup_flags);
L
Linus Torvalds 已提交
3498
	if (IS_ERR(dentry))
3499
		goto unlock;
3500

3501
	error = -EEXIST;
3502
	if (d_is_positive(dentry))
3503
		goto fail;
3504

3505 3506 3507 3508 3509 3510
	/*
	 * Special case - lookup gave negative, but... we had foo/bar/
	 * From the vfs_mknod() POV we just have a negative dentry -
	 * all is fine. Let's be bastards - you had / on the end, you've
	 * been asking for (non-existent) directory. -ENOENT for you.
	 */
3511
	if (unlikely(!is_dir && last.name[last.len])) {
3512
		error = -ENOENT;
A
Al Viro 已提交
3513
		goto fail;
3514
	}
3515 3516
	if (unlikely(err2)) {
		error = err2;
3517
		goto fail;
3518
	}
3519
	putname(name);
L
Linus Torvalds 已提交
3520 3521
	return dentry;
fail:
3522 3523 3524
	dput(dentry);
	dentry = ERR_PTR(error);
unlock:
A
Al Viro 已提交
3525
	inode_unlock(path->dentry->d_inode);
3526
	if (!err2)
3527
		mnt_drop_write(path->mnt);
A
Al Viro 已提交
3528
out:
3529
	path_put(path);
3530
	putname(name);
L
Linus Torvalds 已提交
3531 3532
	return dentry;
}
3533 3534 3535 3536

struct dentry *kern_path_create(int dfd, const char *pathname,
				struct path *path, unsigned int lookup_flags)
{
3537 3538
	return filename_create(dfd, getname_kernel(pathname),
				path, lookup_flags);
3539
}
3540 3541
EXPORT_SYMBOL(kern_path_create);

A
Al Viro 已提交
3542 3543 3544
void done_path_create(struct path *path, struct dentry *dentry)
{
	dput(dentry);
A
Al Viro 已提交
3545
	inode_unlock(path->dentry->d_inode);
3546
	mnt_drop_write(path->mnt);
A
Al Viro 已提交
3547 3548 3549 3550
	path_put(path);
}
EXPORT_SYMBOL(done_path_create);

A
Al Viro 已提交
3551
inline struct dentry *user_path_create(int dfd, const char __user *pathname,
3552
				struct path *path, unsigned int lookup_flags)
3553
{
3554
	return filename_create(dfd, getname(pathname), path, lookup_flags);
3555 3556 3557
}
EXPORT_SYMBOL(user_path_create);

A
Al Viro 已提交
3558
int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
L
Linus Torvalds 已提交
3559
{
3560
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
3561 3562 3563 3564

	if (error)
		return error;

3565
	if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
L
Linus Torvalds 已提交
3566 3567
		return -EPERM;

A
Al Viro 已提交
3568
	if (!dir->i_op->mknod)
L
Linus Torvalds 已提交
3569 3570
		return -EPERM;

3571 3572 3573 3574
	error = devcgroup_inode_mknod(mode, dev);
	if (error)
		return error;

L
Linus Torvalds 已提交
3575 3576 3577 3578 3579
	error = security_inode_mknod(dir, dentry, mode, dev);
	if (error)
		return error;

	error = dir->i_op->mknod(dir, dentry, mode, dev);
3580
	if (!error)
3581
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
3582 3583
	return error;
}
3584
EXPORT_SYMBOL(vfs_mknod);
L
Linus Torvalds 已提交
3585

A
Al Viro 已提交
3586
static int may_mknod(umode_t mode)
3587 3588 3589 3590 3591 3592 3593 3594 3595 3596 3597 3598 3599 3600 3601 3602
{
	switch (mode & S_IFMT) {
	case S_IFREG:
	case S_IFCHR:
	case S_IFBLK:
	case S_IFIFO:
	case S_IFSOCK:
	case 0: /* zero mode translates to S_IFREG */
		return 0;
	case S_IFDIR:
		return -EPERM;
	default:
		return -EINVAL;
	}
}

A
Al Viro 已提交
3603
SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
3604
		unsigned, dev)
L
Linus Torvalds 已提交
3605
{
3606
	struct dentry *dentry;
3607 3608
	struct path path;
	int error;
3609
	unsigned int lookup_flags = 0;
L
Linus Torvalds 已提交
3610

3611 3612 3613
	error = may_mknod(mode);
	if (error)
		return error;
3614 3615
retry:
	dentry = user_path_create(dfd, filename, &path, lookup_flags);
3616 3617
	if (IS_ERR(dentry))
		return PTR_ERR(dentry);
3618

3619
	if (!IS_POSIXACL(path.dentry->d_inode))
A
Al Viro 已提交
3620
		mode &= ~current_umask();
3621
	error = security_path_mknod(&path, dentry, mode, dev);
3622
	if (error)
3623
		goto out;
3624
	switch (mode & S_IFMT) {
L
Linus Torvalds 已提交
3625
		case 0: case S_IFREG:
A
Al Viro 已提交
3626
			error = vfs_create(path.dentry->d_inode,dentry,mode,true);
L
Linus Torvalds 已提交
3627 3628
			break;
		case S_IFCHR: case S_IFBLK:
3629
			error = vfs_mknod(path.dentry->d_inode,dentry,mode,
L
Linus Torvalds 已提交
3630 3631 3632
					new_decode_dev(dev));
			break;
		case S_IFIFO: case S_IFSOCK:
3633
			error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
L
Linus Torvalds 已提交
3634 3635
			break;
	}
3636
out:
A
Al Viro 已提交
3637
	done_path_create(&path, dentry);
3638 3639 3640 3641
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
L
Linus Torvalds 已提交
3642 3643 3644
	return error;
}

A
Al Viro 已提交
3645
SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3646 3647 3648 3649
{
	return sys_mknodat(AT_FDCWD, filename, mode, dev);
}

3650
int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
L
Linus Torvalds 已提交
3651
{
3652
	int error = may_create(dir, dentry);
3653
	unsigned max_links = dir->i_sb->s_max_links;
L
Linus Torvalds 已提交
3654 3655 3656 3657

	if (error)
		return error;

A
Al Viro 已提交
3658
	if (!dir->i_op->mkdir)
L
Linus Torvalds 已提交
3659 3660 3661 3662 3663 3664 3665
		return -EPERM;

	mode &= (S_IRWXUGO|S_ISVTX);
	error = security_inode_mkdir(dir, dentry, mode);
	if (error)
		return error;

3666 3667 3668
	if (max_links && dir->i_nlink >= max_links)
		return -EMLINK;

L
Linus Torvalds 已提交
3669
	error = dir->i_op->mkdir(dir, dentry, mode);
3670
	if (!error)
3671
		fsnotify_mkdir(dir, dentry);
L
Linus Torvalds 已提交
3672 3673
	return error;
}
3674
EXPORT_SYMBOL(vfs_mkdir);
L
Linus Torvalds 已提交
3675

3676
SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
L
Linus Torvalds 已提交
3677
{
3678
	struct dentry *dentry;
3679 3680
	struct path path;
	int error;
3681
	unsigned int lookup_flags = LOOKUP_DIRECTORY;
L
Linus Torvalds 已提交
3682

3683 3684
retry:
	dentry = user_path_create(dfd, pathname, &path, lookup_flags);
3685
	if (IS_ERR(dentry))
3686
		return PTR_ERR(dentry);
L
Linus Torvalds 已提交
3687

3688
	if (!IS_POSIXACL(path.dentry->d_inode))
A
Al Viro 已提交
3689
		mode &= ~current_umask();
3690
	error = security_path_mkdir(&path, dentry, mode);
3691 3692
	if (!error)
		error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
A
Al Viro 已提交
3693
	done_path_create(&path, dentry);
3694 3695 3696 3697
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
L
Linus Torvalds 已提交
3698 3699 3700
	return error;
}

3701
SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
3702 3703 3704 3705
{
	return sys_mkdirat(AT_FDCWD, pathname, mode);
}

L
Linus Torvalds 已提交
3706
/*
S
Sage Weil 已提交
3707
 * The dentry_unhash() helper will try to drop the dentry early: we
3708
 * should have a usage count of 1 if we're the only user of this
S
Sage Weil 已提交
3709 3710
 * dentry, and if that is true (possibly after pruning the dcache),
 * then we drop the dentry now.
L
Linus Torvalds 已提交
3711 3712 3713 3714 3715 3716 3717 3718 3719 3720 3721 3722
 *
 * A low-level filesystem can, if it choses, legally
 * do a
 *
 *	if (!d_unhashed(dentry))
 *		return -EBUSY;
 *
 * if it cannot handle the case of removing a directory
 * that is still in use by something else..
 */
void dentry_unhash(struct dentry *dentry)
{
3723
	shrink_dcache_parent(dentry);
L
Linus Torvalds 已提交
3724
	spin_lock(&dentry->d_lock);
3725
	if (dentry->d_lockref.count == 1)
L
Linus Torvalds 已提交
3726 3727 3728
		__d_drop(dentry);
	spin_unlock(&dentry->d_lock);
}
3729
EXPORT_SYMBOL(dentry_unhash);
L
Linus Torvalds 已提交
3730 3731 3732 3733 3734 3735 3736 3737

int vfs_rmdir(struct inode *dir, struct dentry *dentry)
{
	int error = may_delete(dir, dentry, 1);

	if (error)
		return error;

A
Al Viro 已提交
3738
	if (!dir->i_op->rmdir)
L
Linus Torvalds 已提交
3739 3740
		return -EPERM;

3741
	dget(dentry);
A
Al Viro 已提交
3742
	inode_lock(dentry->d_inode);
S
Sage Weil 已提交
3743 3744

	error = -EBUSY;
3745
	if (is_local_mountpoint(dentry))
S
Sage Weil 已提交
3746 3747 3748 3749 3750 3751
		goto out;

	error = security_inode_rmdir(dir, dentry);
	if (error)
		goto out;

3752
	shrink_dcache_parent(dentry);
S
Sage Weil 已提交
3753 3754 3755 3756 3757 3758
	error = dir->i_op->rmdir(dir, dentry);
	if (error)
		goto out;

	dentry->d_inode->i_flags |= S_DEAD;
	dont_mount(dentry);
3759
	detach_mounts(dentry);
S
Sage Weil 已提交
3760 3761

out:
A
Al Viro 已提交
3762
	inode_unlock(dentry->d_inode);
3763
	dput(dentry);
S
Sage Weil 已提交
3764
	if (!error)
L
Linus Torvalds 已提交
3765 3766 3767
		d_delete(dentry);
	return error;
}
3768
EXPORT_SYMBOL(vfs_rmdir);
L
Linus Torvalds 已提交
3769

3770
static long do_rmdir(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
3771 3772
{
	int error = 0;
3773
	struct filename *name;
L
Linus Torvalds 已提交
3774
	struct dentry *dentry;
3775 3776 3777
	struct path path;
	struct qstr last;
	int type;
3778 3779
	unsigned int lookup_flags = 0;
retry:
3780 3781
	name = user_path_parent(dfd, pathname,
				&path, &last, &type, lookup_flags);
3782 3783
	if (IS_ERR(name))
		return PTR_ERR(name);
L
Linus Torvalds 已提交
3784

3785
	switch (type) {
3786 3787 3788 3789 3790 3791 3792 3793 3794
	case LAST_DOTDOT:
		error = -ENOTEMPTY;
		goto exit1;
	case LAST_DOT:
		error = -EINVAL;
		goto exit1;
	case LAST_ROOT:
		error = -EBUSY;
		goto exit1;
L
Linus Torvalds 已提交
3795
	}
3796

3797
	error = mnt_want_write(path.mnt);
3798 3799
	if (error)
		goto exit1;
3800

A
Al Viro 已提交
3801
	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
3802
	dentry = __lookup_hash(&last, path.dentry, lookup_flags);
L
Linus Torvalds 已提交
3803
	error = PTR_ERR(dentry);
3804 3805
	if (IS_ERR(dentry))
		goto exit2;
3806 3807 3808 3809
	if (!dentry->d_inode) {
		error = -ENOENT;
		goto exit3;
	}
3810
	error = security_path_rmdir(&path, dentry);
3811
	if (error)
3812
		goto exit3;
3813
	error = vfs_rmdir(path.dentry->d_inode, dentry);
3814
exit3:
3815 3816
	dput(dentry);
exit2:
A
Al Viro 已提交
3817
	inode_unlock(path.dentry->d_inode);
3818
	mnt_drop_write(path.mnt);
L
Linus Torvalds 已提交
3819
exit1:
3820
	path_put(&path);
L
Linus Torvalds 已提交
3821
	putname(name);
3822 3823 3824 3825
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
L
Linus Torvalds 已提交
3826 3827 3828
	return error;
}

3829
SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
3830 3831 3832 3833
{
	return do_rmdir(AT_FDCWD, pathname);
}

3834 3835 3836 3837 3838 3839 3840 3841 3842 3843 3844 3845 3846 3847 3848 3849 3850 3851 3852
/**
 * vfs_unlink - unlink a filesystem object
 * @dir:	parent directory
 * @dentry:	victim
 * @delegated_inode: returns victim inode, if the inode is delegated.
 *
 * The caller must hold dir->i_mutex.
 *
 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and
 * return a reference to the inode in delegated_inode.  The caller
 * should then break the delegation on that inode and retry.  Because
 * breaking a delegation may take a long time, the caller should drop
 * dir->i_mutex before doing so.
 *
 * Alternatively, a caller may pass NULL for delegated_inode.  This may
 * be appropriate for callers that expect the underlying filesystem not
 * to be NFS exported.
 */
int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode)
L
Linus Torvalds 已提交
3853
{
J
J. Bruce Fields 已提交
3854
	struct inode *target = dentry->d_inode;
L
Linus Torvalds 已提交
3855 3856 3857 3858 3859
	int error = may_delete(dir, dentry, 0);

	if (error)
		return error;

A
Al Viro 已提交
3860
	if (!dir->i_op->unlink)
L
Linus Torvalds 已提交
3861 3862
		return -EPERM;

A
Al Viro 已提交
3863
	inode_lock(target);
3864
	if (is_local_mountpoint(dentry))
L
Linus Torvalds 已提交
3865 3866 3867
		error = -EBUSY;
	else {
		error = security_inode_unlink(dir, dentry);
3868
		if (!error) {
3869 3870
			error = try_break_deleg(target, delegated_inode);
			if (error)
3871
				goto out;
L
Linus Torvalds 已提交
3872
			error = dir->i_op->unlink(dir, dentry);
3873
			if (!error) {
3874
				dont_mount(dentry);
3875 3876
				detach_mounts(dentry);
			}
3877
		}
L
Linus Torvalds 已提交
3878
	}
3879
out:
A
Al Viro 已提交
3880
	inode_unlock(target);
L
Linus Torvalds 已提交
3881 3882 3883

	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
	if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
J
J. Bruce Fields 已提交
3884
		fsnotify_link_count(target);
J
John McCutchan 已提交
3885
		d_delete(dentry);
L
Linus Torvalds 已提交
3886
	}
R
Robert Love 已提交
3887

L
Linus Torvalds 已提交
3888 3889
	return error;
}
3890
EXPORT_SYMBOL(vfs_unlink);
L
Linus Torvalds 已提交
3891 3892 3893

/*
 * Make sure that the actual truncation of the file will occur outside its
3894
 * directory's i_mutex.  Truncate can take a long time if there is a lot of
L
Linus Torvalds 已提交
3895 3896 3897
 * writeout happening, and we don't want to prevent access to the directory
 * while waiting on the I/O.
 */
3898
static long do_unlinkat(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
3899
{
3900
	int error;
3901
	struct filename *name;
L
Linus Torvalds 已提交
3902
	struct dentry *dentry;
3903 3904 3905
	struct path path;
	struct qstr last;
	int type;
L
Linus Torvalds 已提交
3906
	struct inode *inode = NULL;
3907
	struct inode *delegated_inode = NULL;
3908 3909
	unsigned int lookup_flags = 0;
retry:
3910 3911
	name = user_path_parent(dfd, pathname,
				&path, &last, &type, lookup_flags);
3912 3913
	if (IS_ERR(name))
		return PTR_ERR(name);
3914

L
Linus Torvalds 已提交
3915
	error = -EISDIR;
3916
	if (type != LAST_NORM)
L
Linus Torvalds 已提交
3917
		goto exit1;
3918

3919
	error = mnt_want_write(path.mnt);
3920 3921
	if (error)
		goto exit1;
3922
retry_deleg:
A
Al Viro 已提交
3923
	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
3924
	dentry = __lookup_hash(&last, path.dentry, lookup_flags);
L
Linus Torvalds 已提交
3925 3926 3927
	error = PTR_ERR(dentry);
	if (!IS_ERR(dentry)) {
		/* Why not before? Because we want correct error value */
3928
		if (last.name[last.len])
3929
			goto slashes;
L
Linus Torvalds 已提交
3930
		inode = dentry->d_inode;
3931
		if (d_is_negative(dentry))
3932 3933
			goto slashes;
		ihold(inode);
3934
		error = security_path_unlink(&path, dentry);
3935
		if (error)
3936
			goto exit2;
3937
		error = vfs_unlink(path.dentry->d_inode, dentry, &delegated_inode);
3938
exit2:
L
Linus Torvalds 已提交
3939 3940
		dput(dentry);
	}
A
Al Viro 已提交
3941
	inode_unlock(path.dentry->d_inode);
L
Linus Torvalds 已提交
3942 3943
	if (inode)
		iput(inode);	/* truncate the inode here */
3944 3945
	inode = NULL;
	if (delegated_inode) {
3946
		error = break_deleg_wait(&delegated_inode);
3947 3948 3949
		if (!error)
			goto retry_deleg;
	}
3950
	mnt_drop_write(path.mnt);
L
Linus Torvalds 已提交
3951
exit1:
3952
	path_put(&path);
L
Linus Torvalds 已提交
3953
	putname(name);
3954 3955 3956 3957 3958
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		inode = NULL;
		goto retry;
	}
L
Linus Torvalds 已提交
3959 3960 3961
	return error;

slashes:
3962 3963
	if (d_is_negative(dentry))
		error = -ENOENT;
M
Miklos Szeredi 已提交
3964
	else if (d_is_dir(dentry))
3965 3966 3967
		error = -EISDIR;
	else
		error = -ENOTDIR;
L
Linus Torvalds 已提交
3968 3969 3970
	goto exit2;
}

3971
SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
3972 3973 3974 3975 3976 3977 3978 3979 3980 3981
{
	if ((flag & ~AT_REMOVEDIR) != 0)
		return -EINVAL;

	if (flag & AT_REMOVEDIR)
		return do_rmdir(dfd, pathname);

	return do_unlinkat(dfd, pathname);
}

3982
SYSCALL_DEFINE1(unlink, const char __user *, pathname)
3983 3984 3985 3986
{
	return do_unlinkat(AT_FDCWD, pathname);
}

3987
int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
L
Linus Torvalds 已提交
3988
{
3989
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
3990 3991 3992 3993

	if (error)
		return error;

A
Al Viro 已提交
3994
	if (!dir->i_op->symlink)
L
Linus Torvalds 已提交
3995 3996 3997 3998 3999 4000 4001
		return -EPERM;

	error = security_inode_symlink(dir, dentry, oldname);
	if (error)
		return error;

	error = dir->i_op->symlink(dir, dentry, oldname);
4002
	if (!error)
4003
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
4004 4005
	return error;
}
4006
EXPORT_SYMBOL(vfs_symlink);
L
Linus Torvalds 已提交
4007

4008 4009
SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
L
Linus Torvalds 已提交
4010
{
4011
	int error;
4012
	struct filename *from;
4013
	struct dentry *dentry;
4014
	struct path path;
4015
	unsigned int lookup_flags = 0;
L
Linus Torvalds 已提交
4016 4017

	from = getname(oldname);
4018
	if (IS_ERR(from))
L
Linus Torvalds 已提交
4019
		return PTR_ERR(from);
4020 4021
retry:
	dentry = user_path_create(newdfd, newname, &path, lookup_flags);
4022 4023
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry))
4024
		goto out_putname;
4025

4026
	error = security_path_symlink(&path, dentry, from->name);
4027
	if (!error)
4028
		error = vfs_symlink(path.dentry->d_inode, dentry, from->name);
A
Al Viro 已提交
4029
	done_path_create(&path, dentry);
4030 4031 4032 4033
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
4034
out_putname:
L
Linus Torvalds 已提交
4035 4036 4037 4038
	putname(from);
	return error;
}

4039
SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
4040 4041 4042 4043
{
	return sys_symlinkat(oldname, AT_FDCWD, newname);
}

J
J. Bruce Fields 已提交
4044 4045 4046 4047 4048 4049 4050 4051 4052 4053 4054 4055 4056 4057 4058 4059 4060 4061 4062 4063
/**
 * vfs_link - create a new link
 * @old_dentry:	object to be linked
 * @dir:	new parent
 * @new_dentry:	where to create the new link
 * @delegated_inode: returns inode needing a delegation break
 *
 * The caller must hold dir->i_mutex
 *
 * If vfs_link discovers a delegation on the to-be-linked file in need
 * of breaking, it will return -EWOULDBLOCK and return a reference to the
 * inode in delegated_inode.  The caller should then break the delegation
 * and retry.  Because breaking a delegation may take a long time, the
 * caller should drop the i_mutex before doing so.
 *
 * Alternatively, a caller may pass NULL for delegated_inode.  This may
 * be appropriate for callers that expect the underlying filesystem not
 * to be NFS exported.
 */
int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode)
L
Linus Torvalds 已提交
4064 4065
{
	struct inode *inode = old_dentry->d_inode;
4066
	unsigned max_links = dir->i_sb->s_max_links;
L
Linus Torvalds 已提交
4067 4068 4069 4070 4071
	int error;

	if (!inode)
		return -ENOENT;

4072
	error = may_create(dir, new_dentry);
L
Linus Torvalds 已提交
4073 4074 4075 4076 4077 4078 4079 4080 4081 4082 4083
	if (error)
		return error;

	if (dir->i_sb != inode->i_sb)
		return -EXDEV;

	/*
	 * A link to an append-only or immutable file cannot be created.
	 */
	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
		return -EPERM;
A
Al Viro 已提交
4084
	if (!dir->i_op->link)
L
Linus Torvalds 已提交
4085
		return -EPERM;
4086
	if (S_ISDIR(inode->i_mode))
L
Linus Torvalds 已提交
4087 4088 4089 4090 4091 4092
		return -EPERM;

	error = security_inode_link(old_dentry, dir, new_dentry);
	if (error)
		return error;

A
Al Viro 已提交
4093
	inode_lock(inode);
4094
	/* Make sure we don't allow creating hardlink to an unlinked file */
4095
	if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
4096
		error =  -ENOENT;
4097 4098
	else if (max_links && inode->i_nlink >= max_links)
		error = -EMLINK;
J
J. Bruce Fields 已提交
4099 4100 4101 4102 4103
	else {
		error = try_break_deleg(inode, delegated_inode);
		if (!error)
			error = dir->i_op->link(old_dentry, dir, new_dentry);
	}
4104 4105 4106 4107 4108 4109

	if (!error && (inode->i_state & I_LINKABLE)) {
		spin_lock(&inode->i_lock);
		inode->i_state &= ~I_LINKABLE;
		spin_unlock(&inode->i_lock);
	}
A
Al Viro 已提交
4110
	inode_unlock(inode);
4111
	if (!error)
4112
		fsnotify_link(dir, inode, new_dentry);
L
Linus Torvalds 已提交
4113 4114
	return error;
}
4115
EXPORT_SYMBOL(vfs_link);
L
Linus Torvalds 已提交
4116 4117 4118 4119 4120 4121 4122 4123 4124 4125

/*
 * Hardlinks are often used in delicate situations.  We avoid
 * security-related surprises by not following symlinks on the
 * newname.  --KAB
 *
 * We don't follow them on the oldname either to be compatible
 * with linux 2.0, and to avoid hard-linking to directories
 * and other special files.  --ADM
 */
4126 4127
SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname, int, flags)
L
Linus Torvalds 已提交
4128 4129
{
	struct dentry *new_dentry;
4130
	struct path old_path, new_path;
J
J. Bruce Fields 已提交
4131
	struct inode *delegated_inode = NULL;
4132
	int how = 0;
L
Linus Torvalds 已提交
4133 4134
	int error;

4135
	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
4136
		return -EINVAL;
4137
	/*
4138 4139 4140
	 * To use null names we require CAP_DAC_READ_SEARCH
	 * This ensures that not everyone will be able to create
	 * handlink using the passed filedescriptor.
4141
	 */
4142 4143 4144
	if (flags & AT_EMPTY_PATH) {
		if (!capable(CAP_DAC_READ_SEARCH))
			return -ENOENT;
4145
		how = LOOKUP_EMPTY;
4146
	}
4147 4148 4149

	if (flags & AT_SYMLINK_FOLLOW)
		how |= LOOKUP_FOLLOW;
4150
retry:
4151
	error = user_path_at(olddfd, oldname, how, &old_path);
L
Linus Torvalds 已提交
4152
	if (error)
4153 4154
		return error;

4155 4156
	new_dentry = user_path_create(newdfd, newname, &new_path,
					(how & LOOKUP_REVAL));
L
Linus Torvalds 已提交
4157
	error = PTR_ERR(new_dentry);
4158
	if (IS_ERR(new_dentry))
4159 4160 4161 4162 4163
		goto out;

	error = -EXDEV;
	if (old_path.mnt != new_path.mnt)
		goto out_dput;
K
Kees Cook 已提交
4164 4165 4166
	error = may_linkat(&old_path);
	if (unlikely(error))
		goto out_dput;
4167
	error = security_path_link(old_path.dentry, &new_path, new_dentry);
4168
	if (error)
4169
		goto out_dput;
J
J. Bruce Fields 已提交
4170
	error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode);
4171
out_dput:
A
Al Viro 已提交
4172
	done_path_create(&new_path, new_dentry);
J
J. Bruce Fields 已提交
4173 4174
	if (delegated_inode) {
		error = break_deleg_wait(&delegated_inode);
4175 4176
		if (!error) {
			path_put(&old_path);
J
J. Bruce Fields 已提交
4177
			goto retry;
4178
		}
J
J. Bruce Fields 已提交
4179
	}
4180
	if (retry_estale(error, how)) {
4181
		path_put(&old_path);
4182 4183 4184
		how |= LOOKUP_REVAL;
		goto retry;
	}
L
Linus Torvalds 已提交
4185
out:
4186
	path_put(&old_path);
L
Linus Torvalds 已提交
4187 4188 4189 4190

	return error;
}

4191
SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
4192
{
4193
	return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4194 4195
}

4196 4197 4198 4199 4200 4201 4202
/**
 * vfs_rename - rename a filesystem object
 * @old_dir:	parent of source
 * @old_dentry:	source
 * @new_dir:	parent of destination
 * @new_dentry:	destination
 * @delegated_inode: returns an inode needing a delegation break
M
Miklos Szeredi 已提交
4203
 * @flags:	rename flags
4204 4205 4206 4207 4208 4209 4210 4211 4212 4213 4214 4215 4216 4217
 *
 * The caller must hold multiple mutexes--see lock_rename()).
 *
 * If vfs_rename discovers a delegation in need of breaking at either
 * the source or destination, it will return -EWOULDBLOCK and return a
 * reference to the inode in delegated_inode.  The caller should then
 * break the delegation and retry.  Because breaking a delegation may
 * take a long time, the caller should drop all locks before doing
 * so.
 *
 * Alternatively, a caller may pass NULL for delegated_inode.  This may
 * be appropriate for callers that expect the underlying filesystem not
 * to be NFS exported.
 *
L
Linus Torvalds 已提交
4218 4219 4220
 * The worst of all namespace operations - renaming directory. "Perverted"
 * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
 * Problems:
4221
 *	a) we can get into loop creation.
L
Linus Torvalds 已提交
4222 4223
 *	b) race potential - two innocent renames can create a loop together.
 *	   That's where 4.4 screws up. Current fix: serialization on
4224
 *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
L
Linus Torvalds 已提交
4225
 *	   story.
4226 4227
 *	c) we have to lock _four_ objects - parents and victim (if it exists),
 *	   and source (if it is not a directory).
4228
 *	   And that - after we got ->i_mutex on parents (until then we don't know
L
Linus Torvalds 已提交
4229 4230
 *	   whether the target exists).  Solution: try to be smart with locking
 *	   order for inodes.  We rely on the fact that tree topology may change
4231
 *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
L
Linus Torvalds 已提交
4232 4233 4234
 *	   move will be locked.  Thus we can rank directories by the tree
 *	   (ancestors first) and rank all non-directories after them.
 *	   That works since everybody except rename does "lock parent, lookup,
4235
 *	   lock child" and rename is under ->s_vfs_rename_mutex.
L
Linus Torvalds 已提交
4236 4237 4238
 *	   HOWEVER, it relies on the assumption that any object with ->lookup()
 *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
 *	   we'd better make sure that there's no link(2) for them.
4239
 *	d) conversion from fhandle to dentry may come in the wrong moment - when
4240
 *	   we are removing the target. Solution: we will have to grab ->i_mutex
L
Linus Torvalds 已提交
4241
 *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
4242
 *	   ->i_mutex on parents, which works but leads to some truly excessive
L
Linus Torvalds 已提交
4243 4244
 *	   locking].
 */
4245 4246
int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
	       struct inode *new_dir, struct dentry *new_dentry,
M
Miklos Szeredi 已提交
4247
	       struct inode **delegated_inode, unsigned int flags)
L
Linus Torvalds 已提交
4248
{
4249 4250 4251 4252
	int error;
	bool is_dir = d_is_dir(old_dentry);
	const unsigned char *old_name;
	struct inode *source = old_dentry->d_inode;
S
Sage Weil 已提交
4253
	struct inode *target = new_dentry->d_inode;
M
Miklos Szeredi 已提交
4254 4255
	bool new_is_dir = false;
	unsigned max_links = new_dir->i_sb->s_max_links;
4256 4257 4258 4259 4260 4261 4262 4263

	if (source == target)
		return 0;

	error = may_delete(old_dir, old_dentry, is_dir);
	if (error)
		return error;

M
Miklos Szeredi 已提交
4264
	if (!target) {
4265
		error = may_create(new_dir, new_dentry);
M
Miklos Szeredi 已提交
4266 4267 4268 4269 4270 4271 4272 4273
	} else {
		new_is_dir = d_is_dir(new_dentry);

		if (!(flags & RENAME_EXCHANGE))
			error = may_delete(new_dir, new_dentry, is_dir);
		else
			error = may_delete(new_dir, new_dentry, new_is_dir);
	}
4274 4275 4276
	if (error)
		return error;

M
Miklos Szeredi 已提交
4277
	if (!old_dir->i_op->rename && !old_dir->i_op->rename2)
4278
		return -EPERM;
L
Linus Torvalds 已提交
4279

M
Miklos Szeredi 已提交
4280 4281 4282
	if (flags && !old_dir->i_op->rename2)
		return -EINVAL;

L
Linus Torvalds 已提交
4283 4284 4285 4286
	/*
	 * If we are going to change the parent - check write permissions,
	 * we'll need to flip '..'.
	 */
M
Miklos Szeredi 已提交
4287 4288 4289 4290 4291 4292 4293 4294 4295 4296 4297
	if (new_dir != old_dir) {
		if (is_dir) {
			error = inode_permission(source, MAY_WRITE);
			if (error)
				return error;
		}
		if ((flags & RENAME_EXCHANGE) && new_is_dir) {
			error = inode_permission(target, MAY_WRITE);
			if (error)
				return error;
		}
L
Linus Torvalds 已提交
4298 4299
	}

4300 4301
	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
				      flags);
L
Linus Torvalds 已提交
4302 4303 4304
	if (error)
		return error;

4305
	old_name = fsnotify_oldname_init(old_dentry->d_name.name);
4306
	dget(new_dentry);
M
Miklos Szeredi 已提交
4307
	if (!is_dir || (flags & RENAME_EXCHANGE))
4308 4309
		lock_two_nondirectories(source, target);
	else if (target)
A
Al Viro 已提交
4310
		inode_lock(target);
S
Sage Weil 已提交
4311 4312

	error = -EBUSY;
4313
	if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
S
Sage Weil 已提交
4314 4315
		goto out;

M
Miklos Szeredi 已提交
4316
	if (max_links && new_dir != old_dir) {
4317
		error = -EMLINK;
M
Miklos Szeredi 已提交
4318
		if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
4319
			goto out;
M
Miklos Szeredi 已提交
4320 4321 4322 4323 4324 4325 4326
		if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
		    old_dir->i_nlink >= max_links)
			goto out;
	}
	if (is_dir && !(flags & RENAME_EXCHANGE) && target)
		shrink_dcache_parent(new_dentry);
	if (!is_dir) {
4327
		error = try_break_deleg(source, delegated_inode);
4328 4329
		if (error)
			goto out;
M
Miklos Szeredi 已提交
4330 4331 4332 4333 4334
	}
	if (target && !new_is_dir) {
		error = try_break_deleg(target, delegated_inode);
		if (error)
			goto out;
4335
	}
M
Miklos Szeredi 已提交
4336
	if (!old_dir->i_op->rename2) {
M
Miklos Szeredi 已提交
4337 4338 4339
		error = old_dir->i_op->rename(old_dir, old_dentry,
					      new_dir, new_dentry);
	} else {
M
Miklos Szeredi 已提交
4340
		WARN_ON(old_dir->i_op->rename != NULL);
M
Miklos Szeredi 已提交
4341 4342 4343
		error = old_dir->i_op->rename2(old_dir, old_dentry,
					       new_dir, new_dentry, flags);
	}
S
Sage Weil 已提交
4344 4345 4346
	if (error)
		goto out;

M
Miklos Szeredi 已提交
4347
	if (!(flags & RENAME_EXCHANGE) && target) {
4348 4349
		if (is_dir)
			target->i_flags |= S_DEAD;
S
Sage Weil 已提交
4350
		dont_mount(new_dentry);
4351
		detach_mounts(new_dentry);
4352
	}
M
Miklos Szeredi 已提交
4353 4354 4355 4356 4357 4358
	if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
		if (!(flags & RENAME_EXCHANGE))
			d_move(old_dentry, new_dentry);
		else
			d_exchange(old_dentry, new_dentry);
	}
S
Sage Weil 已提交
4359
out:
M
Miklos Szeredi 已提交
4360
	if (!is_dir || (flags & RENAME_EXCHANGE))
4361 4362
		unlock_two_nondirectories(source, target);
	else if (target)
A
Al Viro 已提交
4363
		inode_unlock(target);
L
Linus Torvalds 已提交
4364
	dput(new_dentry);
M
Miklos Szeredi 已提交
4365
	if (!error) {
4366
		fsnotify_move(old_dir, new_dir, old_name, is_dir,
M
Miklos Szeredi 已提交
4367 4368 4369 4370 4371 4372
			      !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
		if (flags & RENAME_EXCHANGE) {
			fsnotify_move(new_dir, old_dir, old_dentry->d_name.name,
				      new_is_dir, NULL, new_dentry);
		}
	}
R
Robert Love 已提交
4373 4374
	fsnotify_oldname_free(old_name);

L
Linus Torvalds 已提交
4375 4376
	return error;
}
4377
EXPORT_SYMBOL(vfs_rename);
L
Linus Torvalds 已提交
4378

M
Miklos Szeredi 已提交
4379 4380
SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname, unsigned int, flags)
L
Linus Torvalds 已提交
4381
{
4382 4383
	struct dentry *old_dentry, *new_dentry;
	struct dentry *trap;
4384 4385 4386
	struct path old_path, new_path;
	struct qstr old_last, new_last;
	int old_type, new_type;
4387
	struct inode *delegated_inode = NULL;
4388 4389
	struct filename *from;
	struct filename *to;
4390
	unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
4391
	bool should_retry = false;
4392
	int error;
M
Miklos Szeredi 已提交
4393

M
Miklos Szeredi 已提交
4394
	if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
M
Miklos Szeredi 已提交
4395 4396
		return -EINVAL;

M
Miklos Szeredi 已提交
4397 4398
	if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
	    (flags & RENAME_EXCHANGE))
M
Miklos Szeredi 已提交
4399 4400
		return -EINVAL;

M
Miklos Szeredi 已提交
4401 4402 4403
	if ((flags & RENAME_WHITEOUT) && !capable(CAP_MKNOD))
		return -EPERM;

4404 4405 4406
	if (flags & RENAME_EXCHANGE)
		target_flags = 0;

4407
retry:
4408 4409
	from = user_path_parent(olddfd, oldname,
				&old_path, &old_last, &old_type, lookup_flags);
4410 4411
	if (IS_ERR(from)) {
		error = PTR_ERR(from);
L
Linus Torvalds 已提交
4412
		goto exit;
4413
	}
L
Linus Torvalds 已提交
4414

4415 4416
	to = user_path_parent(newdfd, newname,
				&new_path, &new_last, &new_type, lookup_flags);
4417 4418
	if (IS_ERR(to)) {
		error = PTR_ERR(to);
L
Linus Torvalds 已提交
4419
		goto exit1;
4420
	}
L
Linus Torvalds 已提交
4421 4422

	error = -EXDEV;
4423
	if (old_path.mnt != new_path.mnt)
L
Linus Torvalds 已提交
4424 4425 4426
		goto exit2;

	error = -EBUSY;
4427
	if (old_type != LAST_NORM)
L
Linus Torvalds 已提交
4428 4429
		goto exit2;

M
Miklos Szeredi 已提交
4430 4431
	if (flags & RENAME_NOREPLACE)
		error = -EEXIST;
4432
	if (new_type != LAST_NORM)
L
Linus Torvalds 已提交
4433 4434
		goto exit2;

4435
	error = mnt_want_write(old_path.mnt);
4436 4437 4438
	if (error)
		goto exit2;

4439
retry_deleg:
4440
	trap = lock_rename(new_path.dentry, old_path.dentry);
L
Linus Torvalds 已提交
4441

4442
	old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags);
L
Linus Torvalds 已提交
4443 4444 4445 4446 4447
	error = PTR_ERR(old_dentry);
	if (IS_ERR(old_dentry))
		goto exit3;
	/* source must exist */
	error = -ENOENT;
4448
	if (d_is_negative(old_dentry))
L
Linus Torvalds 已提交
4449
		goto exit4;
4450
	new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags);
M
Miklos Szeredi 已提交
4451 4452 4453 4454 4455 4456
	error = PTR_ERR(new_dentry);
	if (IS_ERR(new_dentry))
		goto exit4;
	error = -EEXIST;
	if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
		goto exit5;
M
Miklos Szeredi 已提交
4457 4458 4459 4460 4461 4462 4463
	if (flags & RENAME_EXCHANGE) {
		error = -ENOENT;
		if (d_is_negative(new_dentry))
			goto exit5;

		if (!d_is_dir(new_dentry)) {
			error = -ENOTDIR;
4464
			if (new_last.name[new_last.len])
M
Miklos Szeredi 已提交
4465 4466 4467
				goto exit5;
		}
	}
L
Linus Torvalds 已提交
4468
	/* unless the source is a directory trailing slashes give -ENOTDIR */
M
Miklos Szeredi 已提交
4469
	if (!d_is_dir(old_dentry)) {
L
Linus Torvalds 已提交
4470
		error = -ENOTDIR;
4471
		if (old_last.name[old_last.len])
M
Miklos Szeredi 已提交
4472
			goto exit5;
4473
		if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
M
Miklos Szeredi 已提交
4474
			goto exit5;
L
Linus Torvalds 已提交
4475 4476 4477 4478
	}
	/* source should not be ancestor of target */
	error = -EINVAL;
	if (old_dentry == trap)
M
Miklos Szeredi 已提交
4479
		goto exit5;
L
Linus Torvalds 已提交
4480
	/* target should not be an ancestor of source */
M
Miklos Szeredi 已提交
4481 4482
	if (!(flags & RENAME_EXCHANGE))
		error = -ENOTEMPTY;
L
Linus Torvalds 已提交
4483 4484 4485
	if (new_dentry == trap)
		goto exit5;

4486 4487
	error = security_path_rename(&old_path, old_dentry,
				     &new_path, new_dentry, flags);
4488
	if (error)
4489
		goto exit5;
4490 4491
	error = vfs_rename(old_path.dentry->d_inode, old_dentry,
			   new_path.dentry->d_inode, new_dentry,
M
Miklos Szeredi 已提交
4492
			   &delegated_inode, flags);
L
Linus Torvalds 已提交
4493 4494 4495 4496 4497
exit5:
	dput(new_dentry);
exit4:
	dput(old_dentry);
exit3:
4498
	unlock_rename(new_path.dentry, old_path.dentry);
4499 4500 4501 4502 4503
	if (delegated_inode) {
		error = break_deleg_wait(&delegated_inode);
		if (!error)
			goto retry_deleg;
	}
4504
	mnt_drop_write(old_path.mnt);
L
Linus Torvalds 已提交
4505
exit2:
4506 4507
	if (retry_estale(error, lookup_flags))
		should_retry = true;
4508
	path_put(&new_path);
4509
	putname(to);
L
Linus Torvalds 已提交
4510
exit1:
4511
	path_put(&old_path);
L
Linus Torvalds 已提交
4512
	putname(from);
4513 4514 4515 4516 4517
	if (should_retry) {
		should_retry = false;
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
4518
exit:
L
Linus Torvalds 已提交
4519 4520 4521
	return error;
}

M
Miklos Szeredi 已提交
4522 4523 4524 4525 4526 4527
SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
{
	return sys_renameat2(olddfd, oldname, newdfd, newname, 0);
}

4528
SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
4529
{
M
Miklos Szeredi 已提交
4530
	return sys_renameat2(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4531 4532
}

M
Miklos Szeredi 已提交
4533 4534 4535 4536 4537 4538 4539 4540 4541 4542 4543 4544 4545 4546
int vfs_whiteout(struct inode *dir, struct dentry *dentry)
{
	int error = may_create(dir, dentry);
	if (error)
		return error;

	if (!dir->i_op->mknod)
		return -EPERM;

	return dir->i_op->mknod(dir, dentry,
				S_IFCHR | WHITEOUT_MODE, WHITEOUT_DEV);
}
EXPORT_SYMBOL(vfs_whiteout);

A
Al Viro 已提交
4547
int readlink_copy(char __user *buffer, int buflen, const char *link)
L
Linus Torvalds 已提交
4548
{
A
Al Viro 已提交
4549
	int len = PTR_ERR(link);
L
Linus Torvalds 已提交
4550 4551 4552 4553 4554 4555 4556 4557 4558 4559 4560
	if (IS_ERR(link))
		goto out;

	len = strlen(link);
	if (len > (unsigned) buflen)
		len = buflen;
	if (copy_to_user(buffer, link, len))
		len = -EFAULT;
out:
	return len;
}
A
Al Viro 已提交
4561
EXPORT_SYMBOL(readlink_copy);
L
Linus Torvalds 已提交
4562 4563 4564

/*
 * A helper for ->readlink().  This should be used *ONLY* for symlinks that
4565 4566
 * have ->get_link() not calling nd_jump_link().  Using (or not using) it
 * for any given inode is up to filesystem.
L
Linus Torvalds 已提交
4567 4568 4569
 */
int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
4570
	DEFINE_DELAYED_CALL(done);
4571 4572
	struct inode *inode = d_inode(dentry);
	const char *link = inode->i_link;
4573
	int res;
4574

4575
	if (!link) {
4576
		link = inode->i_op->get_link(dentry, inode, &done);
4577 4578 4579
		if (IS_ERR(link))
			return PTR_ERR(link);
	}
4580
	res = readlink_copy(buffer, buflen, link);
4581
	do_delayed_call(&done);
4582
	return res;
L
Linus Torvalds 已提交
4583
}
4584
EXPORT_SYMBOL(generic_readlink);
L
Linus Torvalds 已提交
4585 4586

/* get the link contents into pagecache */
4587
const char *page_get_link(struct dentry *dentry, struct inode *inode,
4588
			  struct delayed_call *callback)
L
Linus Torvalds 已提交
4589
{
4590 4591
	char *kaddr;
	struct page *page;
4592 4593
	struct address_space *mapping = inode->i_mapping;

4594 4595 4596 4597 4598 4599 4600 4601 4602 4603 4604 4605 4606
	if (!dentry) {
		page = find_get_page(mapping, 0);
		if (!page)
			return ERR_PTR(-ECHILD);
		if (!PageUptodate(page)) {
			put_page(page);
			return ERR_PTR(-ECHILD);
		}
	} else {
		page = read_mapping_page(mapping, 0, NULL);
		if (IS_ERR(page))
			return (char*)page;
	}
4607
	set_delayed_call(callback, page_put_link, page);
4608 4609
	BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
	kaddr = page_address(page);
4610
	nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
4611
	return kaddr;
L
Linus Torvalds 已提交
4612 4613
}

4614
EXPORT_SYMBOL(page_get_link);
L
Linus Torvalds 已提交
4615

4616
void page_put_link(void *arg)
L
Linus Torvalds 已提交
4617
{
4618
	put_page(arg);
L
Linus Torvalds 已提交
4619
}
4620
EXPORT_SYMBOL(page_put_link);
L
Linus Torvalds 已提交
4621

4622 4623
int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
4624
	DEFINE_DELAYED_CALL(done);
4625 4626
	int res = readlink_copy(buffer, buflen,
				page_get_link(dentry, d_inode(dentry),
4627 4628
					      &done));
	do_delayed_call(&done);
4629 4630 4631 4632
	return res;
}
EXPORT_SYMBOL(page_readlink);

4633 4634 4635 4636
/*
 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
 */
int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
L
Linus Torvalds 已提交
4637 4638
{
	struct address_space *mapping = inode->i_mapping;
4639
	struct page *page;
4640
	void *fsdata;
4641
	int err;
4642 4643 4644
	unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
	if (nofs)
		flags |= AOP_FLAG_NOFS;
L
Linus Torvalds 已提交
4645

4646
retry:
4647
	err = pagecache_write_begin(NULL, mapping, 0, len-1,
4648
				flags, &page, &fsdata);
L
Linus Torvalds 已提交
4649
	if (err)
4650 4651
		goto fail;

4652
	memcpy(page_address(page), symname, len-1);
4653 4654 4655

	err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
							page, fsdata);
L
Linus Torvalds 已提交
4656 4657
	if (err < 0)
		goto fail;
4658 4659 4660
	if (err < len-1)
		goto retry;

L
Linus Torvalds 已提交
4661 4662 4663 4664 4665
	mark_inode_dirty(inode);
	return 0;
fail:
	return err;
}
4666
EXPORT_SYMBOL(__page_symlink);
L
Linus Torvalds 已提交
4667

4668 4669 4670
int page_symlink(struct inode *inode, const char *symname, int len)
{
	return __page_symlink(inode, symname, len,
4671
			!mapping_gfp_constraint(inode->i_mapping, __GFP_FS));
4672
}
4673
EXPORT_SYMBOL(page_symlink);
4674

4675
const struct inode_operations page_symlink_inode_operations = {
L
Linus Torvalds 已提交
4676
	.readlink	= generic_readlink,
4677
	.get_link	= page_get_link,
L
Linus Torvalds 已提交
4678 4679
};
EXPORT_SYMBOL(page_symlink_inode_operations);