namei.c 107.2 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
/*
 *  linux/fs/namei.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

/*
 * Some corrections by tytso.
 */

/* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
 * lookup logic.
 */
/* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
 */

#include <linux/init.h>
18
#include <linux/export.h>
19
#include <linux/kernel.h>
L
Linus Torvalds 已提交
20 21 22 23
#include <linux/slab.h>
#include <linux/fs.h>
#include <linux/namei.h>
#include <linux/pagemap.h>
R
Robert Love 已提交
24
#include <linux/fsnotify.h>
L
Linus Torvalds 已提交
25 26
#include <linux/personality.h>
#include <linux/security.h>
M
Mimi Zohar 已提交
27
#include <linux/ima.h>
L
Linus Torvalds 已提交
28 29 30
#include <linux/syscalls.h>
#include <linux/mount.h>
#include <linux/audit.h>
31
#include <linux/capability.h>
32
#include <linux/file.h>
33
#include <linux/fcntl.h>
34
#include <linux/device_cgroup.h>
35
#include <linux/fs_struct.h>
36
#include <linux/posix_acl.h>
L
Linus Torvalds 已提交
37 38
#include <asm/uaccess.h>

39
#include "internal.h"
40
#include "mount.h"
41

L
Linus Torvalds 已提交
42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75
/* [Feb-1997 T. Schoebel-Theuer]
 * Fundamental changes in the pathname lookup mechanisms (namei)
 * were necessary because of omirr.  The reason is that omirr needs
 * to know the _real_ pathname, not the user-supplied one, in case
 * of symlinks (and also when transname replacements occur).
 *
 * The new code replaces the old recursive symlink resolution with
 * an iterative one (in case of non-nested symlink chains).  It does
 * this with calls to <fs>_follow_link().
 * As a side effect, dir_namei(), _namei() and follow_link() are now 
 * replaced with a single function lookup_dentry() that can handle all 
 * the special cases of the former code.
 *
 * With the new dcache, the pathname is stored at each inode, at least as
 * long as the refcount of the inode is positive.  As a side effect, the
 * size of the dcache depends on the inode cache and thus is dynamic.
 *
 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
 * resolution to correspond with current state of the code.
 *
 * Note that the symlink resolution is not *completely* iterative.
 * There is still a significant amount of tail- and mid- recursion in
 * the algorithm.  Also, note that <fs>_readlink() is not used in
 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
 * may return different results than <fs>_follow_link().  Many virtual
 * filesystems (including /proc) exhibit this behavior.
 */

/* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
 * and the name already exists in form of a symlink, try to create the new
 * name indicated by the symlink. The old code always complained that the
 * name already exists, due to not following the symlink even if its target
 * is nonexistent.  The new semantics affects also mknod() and link() when
L
Lucas De Marchi 已提交
76
 * the name is a symlink pointing to a non-existent name.
L
Linus Torvalds 已提交
77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108
 *
 * I don't know which semantics is the right one, since I have no access
 * to standards. But I found by trial that HP-UX 9.0 has the full "new"
 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
 * "old" one. Personally, I think the new semantics is much more logical.
 * Note that "ln old new" where "new" is a symlink pointing to a non-existing
 * file does succeed in both HP-UX and SunOs, but not in Solaris
 * and in the old Linux semantics.
 */

/* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
 * semantics.  See the comments in "open_namei" and "do_link" below.
 *
 * [10-Sep-98 Alan Modra] Another symlink change.
 */

/* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
 *	inside the path - always follow.
 *	in the last component in creation/removal/renaming - never follow.
 *	if LOOKUP_FOLLOW passed - follow.
 *	if the pathname has trailing slashes - follow.
 *	otherwise - don't follow.
 * (applied in that order).
 *
 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
 * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
 * During the 2.4 we need to fix the userland stuff depending on it -
 * hopefully we will be able to get rid of that wart in 2.5. So far only
 * XEmacs seems to be relying on it...
 */
/*
 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
109
 * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
L
Linus Torvalds 已提交
110 111 112 113 114 115 116 117 118 119
 * any extra contention...
 */

/* In order to reduce some races, while at the same time doing additional
 * checking and hopefully speeding things up, we copy filenames to the
 * kernel data space before using them..
 *
 * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
 * PATH_MAX includes the nul terminator --RR.
 */
120
void final_putname(struct filename *name)
L
Linus Torvalds 已提交
121
{
122 123 124 125 126 127
	if (name->separate) {
		__putname(name->name);
		kfree(name);
	} else {
		__putname(name);
	}
128 129
}

130 131
#define EMBEDDED_NAME_MAX	(PATH_MAX - sizeof(struct filename))

132 133 134 135
static struct filename *
getname_flags(const char __user *filename, int flags, int *empty)
{
	struct filename *result, *err;
136
	int len;
137 138
	long max;
	char *kname;
139

140 141 142 143
	result = audit_reusename(filename);
	if (result)
		return result;

144
	result = __getname();
145
	if (unlikely(!result))
146 147
		return ERR_PTR(-ENOMEM);

148 149 150 151 152
	/*
	 * First, try to embed the struct filename inside the names_cache
	 * allocation
	 */
	kname = (char *)result + sizeof(*result);
153
	result->name = kname;
154 155 156 157 158
	result->separate = false;
	max = EMBEDDED_NAME_MAX;

recopy:
	len = strncpy_from_user(kname, filename, max);
159 160
	if (unlikely(len < 0)) {
		err = ERR_PTR(len);
161
		goto error;
162
	}
163

164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184
	/*
	 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
	 * separate struct filename so we can dedicate the entire
	 * names_cache allocation for the pathname, and re-do the copy from
	 * userland.
	 */
	if (len == EMBEDDED_NAME_MAX && max == EMBEDDED_NAME_MAX) {
		kname = (char *)result;

		result = kzalloc(sizeof(*result), GFP_KERNEL);
		if (!result) {
			err = ERR_PTR(-ENOMEM);
			result = (struct filename *)kname;
			goto error;
		}
		result->name = kname;
		result->separate = true;
		max = PATH_MAX;
		goto recopy;
	}

185 186 187
	/* The empty path is special. */
	if (unlikely(!len)) {
		if (empty)
188
			*empty = 1;
189 190 191
		err = ERR_PTR(-ENOENT);
		if (!(flags & LOOKUP_EMPTY))
			goto error;
L
Linus Torvalds 已提交
192
	}
193 194

	err = ERR_PTR(-ENAMETOOLONG);
195 196 197 198 199 200
	if (unlikely(len >= PATH_MAX))
		goto error;

	result->uptr = filename;
	audit_getname(result);
	return result;
201 202

error:
203
	final_putname(result);
204
	return err;
L
Linus Torvalds 已提交
205 206
}

207 208
struct filename *
getname(const char __user * filename)
A
Al Viro 已提交
209
{
210
	return getname_flags(filename, 0, NULL);
A
Al Viro 已提交
211
}
212
EXPORT_SYMBOL(getname);
A
Al Viro 已提交
213

L
Linus Torvalds 已提交
214
#ifdef CONFIG_AUDITSYSCALL
215
void putname(struct filename *name)
L
Linus Torvalds 已提交
216
{
217
	if (unlikely(!audit_dummy_context()))
218 219
		return audit_putname(name);
	final_putname(name);
L
Linus Torvalds 已提交
220 221 222
}
#endif

223 224
static int check_acl(struct inode *inode, int mask)
{
225
#ifdef CONFIG_FS_POSIX_ACL
226 227 228
	struct posix_acl *acl;

	if (mask & MAY_NOT_BLOCK) {
229 230
		acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
	        if (!acl)
231
	                return -EAGAIN;
232 233 234
		/* no ->get_acl() calls in RCU mode... */
		if (acl == ACL_NOT_CACHED)
			return -ECHILD;
A
Ari Savolainen 已提交
235
	        return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
236 237 238 239 240
	}

	acl = get_cached_acl(inode, ACL_TYPE_ACCESS);

	/*
241 242 243
	 * A filesystem can force a ACL callback by just never filling the
	 * ACL cache. But normally you'd fill the cache either at inode
	 * instantiation time, or on the first ->get_acl call.
244
	 *
245 246
	 * If the filesystem doesn't have a get_acl() function at all, we'll
	 * just create the negative cache entry.
247 248
	 */
	if (acl == ACL_NOT_CACHED) {
249 250 251 252 253 254 255 256
	        if (inode->i_op->get_acl) {
			acl = inode->i_op->get_acl(inode, ACL_TYPE_ACCESS);
			if (IS_ERR(acl))
				return PTR_ERR(acl);
		} else {
		        set_cached_acl(inode, ACL_TYPE_ACCESS, NULL);
		        return -EAGAIN;
		}
257 258 259 260 261 262 263
	}

	if (acl) {
	        int error = posix_acl_permission(inode, acl, mask);
	        posix_acl_release(acl);
	        return error;
	}
264
#endif
265 266 267 268

	return -EAGAIN;
}

269
/*
270
 * This does the basic permission checking
L
Linus Torvalds 已提交
271
 */
272
static int acl_permission_check(struct inode *inode, int mask)
L
Linus Torvalds 已提交
273
{
274
	unsigned int mode = inode->i_mode;
L
Linus Torvalds 已提交
275

276
	if (likely(uid_eq(current_fsuid(), inode->i_uid)))
L
Linus Torvalds 已提交
277 278
		mode >>= 6;
	else {
279
		if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
280
			int error = check_acl(inode, mask);
281 282
			if (error != -EAGAIN)
				return error;
L
Linus Torvalds 已提交
283 284 285 286 287 288 289 290 291
		}

		if (in_group_p(inode->i_gid))
			mode >>= 3;
	}

	/*
	 * If the DACs are ok we don't need any capability check.
	 */
292
	if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
L
Linus Torvalds 已提交
293
		return 0;
294 295 296 297
	return -EACCES;
}

/**
298
 * generic_permission -  check for access rights on a Posix-like filesystem
299
 * @inode:	inode to check access rights for
300
 * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...)
301 302 303 304
 *
 * Used to check for read/write/execute permissions on a file.
 * We use "fsuid" for this, letting us set arbitrary permissions
 * for filesystem access without changing the "normal" uids which
305 306 307 308 309
 * are used for other things.
 *
 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
 * request cannot be satisfied (eg. requires blocking or too much complexity).
 * It would then be called again in ref-walk mode.
310
 */
311
int generic_permission(struct inode *inode, int mask)
312 313 314 315
{
	int ret;

	/*
316
	 * Do the basic permission checks.
317
	 */
318
	ret = acl_permission_check(inode, mask);
319 320
	if (ret != -EACCES)
		return ret;
L
Linus Torvalds 已提交
321

322 323
	if (S_ISDIR(inode->i_mode)) {
		/* DACs are overridable for directories */
324
		if (inode_capable(inode, CAP_DAC_OVERRIDE))
325 326
			return 0;
		if (!(mask & MAY_WRITE))
327
			if (inode_capable(inode, CAP_DAC_READ_SEARCH))
328 329 330
				return 0;
		return -EACCES;
	}
L
Linus Torvalds 已提交
331 332
	/*
	 * Read/write DACs are always overridable.
333 334
	 * Executable DACs are overridable when there is
	 * at least one exec bit set.
L
Linus Torvalds 已提交
335
	 */
336
	if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
337
		if (inode_capable(inode, CAP_DAC_OVERRIDE))
L
Linus Torvalds 已提交
338 339 340 341 342
			return 0;

	/*
	 * Searching includes executable on directories, else just read.
	 */
343
	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
344
	if (mask == MAY_READ)
345
		if (inode_capable(inode, CAP_DAC_READ_SEARCH))
L
Linus Torvalds 已提交
346 347 348 349 350
			return 0;

	return -EACCES;
}

351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370
/*
 * We _really_ want to just do "generic_permission()" without
 * even looking at the inode->i_op values. So we keep a cache
 * flag in inode->i_opflags, that says "this has not special
 * permission function, use the fast case".
 */
static inline int do_inode_permission(struct inode *inode, int mask)
{
	if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
		if (likely(inode->i_op->permission))
			return inode->i_op->permission(inode, mask);

		/* This gets set once for the inode lifetime */
		spin_lock(&inode->i_lock);
		inode->i_opflags |= IOP_FASTPERM;
		spin_unlock(&inode->i_lock);
	}
	return generic_permission(inode, mask);
}

C
Christoph Hellwig 已提交
371
/**
D
David Howells 已提交
372 373 374
 * __inode_permission - Check for access rights to a given inode
 * @inode: Inode to check permission on
 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
C
Christoph Hellwig 已提交
375
 *
D
David Howells 已提交
376
 * Check for read/write/execute permissions on an inode.
377 378
 *
 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
D
David Howells 已提交
379 380 381
 *
 * This does not check for a read-only file system.  You probably want
 * inode_permission().
C
Christoph Hellwig 已提交
382
 */
D
David Howells 已提交
383
int __inode_permission(struct inode *inode, int mask)
L
Linus Torvalds 已提交
384
{
385
	int retval;
L
Linus Torvalds 已提交
386

387
	if (unlikely(mask & MAY_WRITE)) {
L
Linus Torvalds 已提交
388 389 390 391 392 393 394
		/*
		 * Nobody gets write access to an immutable file.
		 */
		if (IS_IMMUTABLE(inode))
			return -EACCES;
	}

395
	retval = do_inode_permission(inode, mask);
L
Linus Torvalds 已提交
396 397 398
	if (retval)
		return retval;

399 400 401 402
	retval = devcgroup_inode_permission(inode, mask);
	if (retval)
		return retval;

403
	return security_inode_permission(inode, mask);
L
Linus Torvalds 已提交
404 405
}

D
David Howells 已提交
406 407 408
/**
 * sb_permission - Check superblock-level permissions
 * @sb: Superblock of inode to check permission on
409
 * @inode: Inode to check permission on
D
David Howells 已提交
410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447
 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Separate out file-system wide checks from inode-specific permission checks.
 */
static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
{
	if (unlikely(mask & MAY_WRITE)) {
		umode_t mode = inode->i_mode;

		/* Nobody gets write access to a read-only fs. */
		if ((sb->s_flags & MS_RDONLY) &&
		    (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
			return -EROFS;
	}
	return 0;
}

/**
 * inode_permission - Check for access rights to a given inode
 * @inode: Inode to check permission on
 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Check for read/write/execute permissions on an inode.  We use fs[ug]id for
 * this, letting us set arbitrary permissions for filesystem access without
 * changing the "normal" UIDs which are used for other things.
 *
 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
 */
int inode_permission(struct inode *inode, int mask)
{
	int retval;

	retval = sb_permission(inode->i_sb, inode, mask);
	if (retval)
		return retval;
	return __inode_permission(inode, mask);
}

J
Jan Blunck 已提交
448 449 450 451 452 453
/**
 * path_get - get a reference to a path
 * @path: path to get the reference to
 *
 * Given a path increment the reference count to the dentry and the vfsmount.
 */
454
void path_get(const struct path *path)
J
Jan Blunck 已提交
455 456 457 458 459 460
{
	mntget(path->mnt);
	dget(path->dentry);
}
EXPORT_SYMBOL(path_get);

J
Jan Blunck 已提交
461 462 463 464 465 466
/**
 * path_put - put a reference to a path
 * @path: path to put the reference to
 *
 * Given a path decrement the reference count to the dentry and the vfsmount.
 */
467
void path_put(const struct path *path)
L
Linus Torvalds 已提交
468
{
J
Jan Blunck 已提交
469 470
	dput(path->dentry);
	mntput(path->mnt);
L
Linus Torvalds 已提交
471
}
J
Jan Blunck 已提交
472
EXPORT_SYMBOL(path_put);
L
Linus Torvalds 已提交
473

A
Al Viro 已提交
474
/*
N
Nick Piggin 已提交
475
 * Path walking has 2 modes, rcu-walk and ref-walk (see
A
Al Viro 已提交
476 477 478 479 480 481 482
 * Documentation/filesystems/path-lookup.txt).  In situations when we can't
 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
 * normal reference counts on dentries and vfsmounts to transition to rcu-walk
 * mode.  Refcounts are grabbed at the last known good point before rcu-walk
 * got stuck, so ref-walk may continue from there. If this is not successful
 * (eg. a seqcount has changed), then failure is returned and it's up to caller
 * to restart the path walk from the beginning in ref-walk mode.
N
Nick Piggin 已提交
483 484
 */

A
Al Viro 已提交
485 486 487 488 489 490 491 492 493 494 495 496
static inline void lock_rcu_walk(void)
{
	br_read_lock(&vfsmount_lock);
	rcu_read_lock();
}

static inline void unlock_rcu_walk(void)
{
	rcu_read_unlock();
	br_read_unlock(&vfsmount_lock);
}

497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519
/*
 * When we move over from the RCU domain to properly refcounted
 * long-lived dentries, we need to check the sequence numbers
 * we got before lookup very carefully.
 *
 * We cannot blindly increment a dentry refcount - even if it
 * is not locked - if it is zero, because it may have gone
 * through the final d_kill() logic already.
 *
 * So for a zero refcount, we need to get the spinlock (which is
 * safe even for a dead dentry because the de-allocation is
 * RCU-delayed), and check the sequence count under the lock.
 *
 * Once we have checked the sequence count, we know it is live,
 * and since we hold the spinlock it cannot die from under us.
 *
 * In contrast, if the reference count wasn't zero, we can just
 * increment the lockref without having to take the spinlock.
 * Even if the sequence number ends up being stale, we haven't
 * gone through the final dput() and killed the dentry yet.
 */
static inline int d_rcu_to_refcount(struct dentry *dentry, seqcount_t *validate, unsigned seq)
{
520 521 522 523
	if (likely(lockref_get_not_dead(&dentry->d_lockref))) {
		if (!read_seqcount_retry(validate, seq))
				return 0;
		dput(dentry);
524
	}
525
	return -ECHILD;
526 527
}

N
Nick Piggin 已提交
528
/**
A
Al Viro 已提交
529 530 531
 * unlazy_walk - try to switch to ref-walk mode.
 * @nd: nameidata pathwalk data
 * @dentry: child of nd->path.dentry or NULL
532
 * Returns: 0 on success, -ECHILD on failure
N
Nick Piggin 已提交
533
 *
A
Al Viro 已提交
534 535 536
 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry
 * for ref-walk mode.  @dentry must be a path found by a do_lookup call on
 * @nd or NULL.  Must be called from rcu-walk context.
N
Nick Piggin 已提交
537
 */
A
Al Viro 已提交
538
static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
N
Nick Piggin 已提交
539 540 541
{
	struct fs_struct *fs = current->fs;
	struct dentry *parent = nd->path.dentry;
542
	int want_root = 0;
N
Nick Piggin 已提交
543 544

	BUG_ON(!(nd->flags & LOOKUP_RCU));
545 546
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
		want_root = 1;
N
Nick Piggin 已提交
547 548 549 550 551
		spin_lock(&fs->lock);
		if (nd->root.mnt != fs->root.mnt ||
				nd->root.dentry != fs->root.dentry)
			goto err_root;
	}
552 553 554 555 556 557 558 559 560 561 562 563

	/*
	 * For a negative lookup, the lookup sequence point is the parents
	 * sequence point, and it only needs to revalidate the parent dentry.
	 *
	 * For a positive lookup, we need to move both the parent and the
	 * dentry from the RCU domain to be properly refcounted. And the
	 * sequence number in the dentry validates *both* dentry counters,
	 * since we checked the sequence number of the parent after we got
	 * the child sequence number. So we know the parent must still
	 * be valid if the child sequence number is still valid.
	 */
A
Al Viro 已提交
564
	if (!dentry) {
565 566
		if (d_rcu_to_refcount(parent, &parent->d_seq, nd->seq) < 0)
			goto err_root;
A
Al Viro 已提交
567 568
		BUG_ON(nd->inode != parent->d_inode);
	} else {
569 570 571
		if (d_rcu_to_refcount(dentry, &dentry->d_seq, nd->seq) < 0)
			goto err_root;
		if (d_rcu_to_refcount(parent, &dentry->d_seq, nd->seq) < 0)
572
			goto err_parent;
A
Al Viro 已提交
573
	}
574
	if (want_root) {
N
Nick Piggin 已提交
575 576 577 578 579
		path_get(&nd->root);
		spin_unlock(&fs->lock);
	}
	mntget(nd->path.mnt);

A
Al Viro 已提交
580
	unlock_rcu_walk();
N
Nick Piggin 已提交
581 582
	nd->flags &= ~LOOKUP_RCU;
	return 0;
A
Al Viro 已提交
583 584

err_parent:
585
	dput(dentry);
N
Nick Piggin 已提交
586
err_root:
587
	if (want_root)
N
Nick Piggin 已提交
588 589 590 591
		spin_unlock(&fs->lock);
	return -ECHILD;
}

592
static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
593
{
594
	return dentry->d_op->d_revalidate(dentry, flags);
595 596
}

597 598 599
/**
 * complete_walk - successful completion of path walk
 * @nd:  pointer nameidata
600
 *
601 602 603 604 605
 * If we had been in RCU mode, drop out of it and legitimize nd->path.
 * Revalidate the final result, unless we'd already done that during
 * the path walk or the filesystem doesn't ask for it.  Return 0 on
 * success, -error on failure.  In case of failure caller does not
 * need to drop nd->path.
606
 */
607
static int complete_walk(struct nameidata *nd)
608
{
A
Al Viro 已提交
609
	struct dentry *dentry = nd->path.dentry;
610 611
	int status;

612 613 614 615
	if (nd->flags & LOOKUP_RCU) {
		nd->flags &= ~LOOKUP_RCU;
		if (!(nd->flags & LOOKUP_ROOT))
			nd->root.mnt = NULL;
616 617

		if (d_rcu_to_refcount(dentry, &dentry->d_seq, nd->seq) < 0) {
A
Al Viro 已提交
618
			unlock_rcu_walk();
619 620 621
			return -ECHILD;
		}
		mntget(nd->path.mnt);
A
Al Viro 已提交
622
		unlock_rcu_walk();
623 624
	}

A
Al Viro 已提交
625 626 627
	if (likely(!(nd->flags & LOOKUP_JUMPED)))
		return 0;

628
	if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
629 630
		return 0;

631
	status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
632 633 634
	if (status > 0)
		return 0;

A
Al Viro 已提交
635
	if (!status)
636
		status = -ESTALE;
A
Al Viro 已提交
637

638
	path_put(&nd->path);
639 640 641
	return status;
}

A
Al Viro 已提交
642 643
static __always_inline void set_root(struct nameidata *nd)
{
644 645
	if (!nd->root.mnt)
		get_fs_root(current->fs, &nd->root);
A
Al Viro 已提交
646 647
}

648 649
static int link_path_walk(const char *, struct nameidata *);

N
Nick Piggin 已提交
650 651 652 653
static __always_inline void set_root_rcu(struct nameidata *nd)
{
	if (!nd->root.mnt) {
		struct fs_struct *fs = current->fs;
N
Nick Piggin 已提交
654 655 656 657 658
		unsigned seq;

		do {
			seq = read_seqcount_begin(&fs->seq);
			nd->root = fs->root;
659
			nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
N
Nick Piggin 已提交
660
		} while (read_seqcount_retry(&fs->seq, seq));
N
Nick Piggin 已提交
661 662 663
	}
}

664
static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
L
Linus Torvalds 已提交
665
{
N
Nick Piggin 已提交
666 667
	int ret;

L
Linus Torvalds 已提交
668 669 670 671
	if (IS_ERR(link))
		goto fail;

	if (*link == '/') {
A
Al Viro 已提交
672
		set_root(nd);
J
Jan Blunck 已提交
673
		path_put(&nd->path);
A
Al Viro 已提交
674 675
		nd->path = nd->root;
		path_get(&nd->root);
A
Al Viro 已提交
676
		nd->flags |= LOOKUP_JUMPED;
L
Linus Torvalds 已提交
677
	}
N
Nick Piggin 已提交
678
	nd->inode = nd->path.dentry->d_inode;
C
Christoph Hellwig 已提交
679

N
Nick Piggin 已提交
680 681
	ret = link_path_walk(link, nd);
	return ret;
L
Linus Torvalds 已提交
682
fail:
J
Jan Blunck 已提交
683
	path_put(&nd->path);
L
Linus Torvalds 已提交
684 685 686
	return PTR_ERR(link);
}

J
Jan Blunck 已提交
687
static void path_put_conditional(struct path *path, struct nameidata *nd)
688 689
{
	dput(path->dentry);
690
	if (path->mnt != nd->path.mnt)
691 692 693
		mntput(path->mnt);
}

694 695
static inline void path_to_nameidata(const struct path *path,
					struct nameidata *nd)
696
{
N
Nick Piggin 已提交
697 698 699 700
	if (!(nd->flags & LOOKUP_RCU)) {
		dput(nd->path.dentry);
		if (nd->path.mnt != path->mnt)
			mntput(nd->path.mnt);
701
	}
N
Nick Piggin 已提交
702
	nd->path.mnt = path->mnt;
703
	nd->path.dentry = path->dentry;
704 705
}

C
Christoph Hellwig 已提交
706 707 708 709 710 711 712 713 714 715 716 717 718
/*
 * Helper to directly jump to a known parsed path from ->follow_link,
 * caller must have taken a reference to path beforehand.
 */
void nd_jump_link(struct nameidata *nd, struct path *path)
{
	path_put(&nd->path);

	nd->path = *path;
	nd->inode = nd->path.dentry->d_inode;
	nd->flags |= LOOKUP_JUMPED;
}

719 720 721
static inline void put_link(struct nameidata *nd, struct path *link, void *cookie)
{
	struct inode *inode = link->dentry->d_inode;
722
	if (inode->i_op->put_link)
723 724 725 726
		inode->i_op->put_link(link->dentry, nd, cookie);
	path_put(link);
}

727 728
int sysctl_protected_symlinks __read_mostly = 0;
int sysctl_protected_hardlinks __read_mostly = 0;
K
Kees Cook 已提交
729 730 731 732

/**
 * may_follow_link - Check symlink following for unsafe situations
 * @link: The path of the symlink
733
 * @nd: nameidata pathwalk data
K
Kees Cook 已提交
734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755
 *
 * In the case of the sysctl_protected_symlinks sysctl being enabled,
 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
 * in a sticky world-writable directory. This is to protect privileged
 * processes from failing races against path names that may change out
 * from under them by way of other users creating malicious symlinks.
 * It will permit symlinks to be followed only when outside a sticky
 * world-writable directory, or when the uid of the symlink and follower
 * match, or when the directory owner matches the symlink's owner.
 *
 * Returns 0 if following the symlink is allowed, -ve on error.
 */
static inline int may_follow_link(struct path *link, struct nameidata *nd)
{
	const struct inode *inode;
	const struct inode *parent;

	if (!sysctl_protected_symlinks)
		return 0;

	/* Allowed if owner and follower match. */
	inode = link->dentry->d_inode;
756
	if (uid_eq(current_cred()->fsuid, inode->i_uid))
K
Kees Cook 已提交
757 758 759 760 761 762 763 764
		return 0;

	/* Allowed if parent directory not sticky and world-writable. */
	parent = nd->path.dentry->d_inode;
	if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
		return 0;

	/* Allowed if parent directory and link owner match. */
765
	if (uid_eq(parent->i_uid, inode->i_uid))
K
Kees Cook 已提交
766 767
		return 0;

768
	audit_log_link_denied("follow_link", link);
K
Kees Cook 已提交
769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834
	path_put_conditional(link, nd);
	path_put(&nd->path);
	return -EACCES;
}

/**
 * safe_hardlink_source - Check for safe hardlink conditions
 * @inode: the source inode to hardlink from
 *
 * Return false if at least one of the following conditions:
 *    - inode is not a regular file
 *    - inode is setuid
 *    - inode is setgid and group-exec
 *    - access failure for read and write
 *
 * Otherwise returns true.
 */
static bool safe_hardlink_source(struct inode *inode)
{
	umode_t mode = inode->i_mode;

	/* Special files should not get pinned to the filesystem. */
	if (!S_ISREG(mode))
		return false;

	/* Setuid files should not get pinned to the filesystem. */
	if (mode & S_ISUID)
		return false;

	/* Executable setgid files should not get pinned to the filesystem. */
	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
		return false;

	/* Hardlinking to unreadable or unwritable sources is dangerous. */
	if (inode_permission(inode, MAY_READ | MAY_WRITE))
		return false;

	return true;
}

/**
 * may_linkat - Check permissions for creating a hardlink
 * @link: the source to hardlink from
 *
 * Block hardlink when all of:
 *  - sysctl_protected_hardlinks enabled
 *  - fsuid does not match inode
 *  - hardlink source is unsafe (see safe_hardlink_source() above)
 *  - not CAP_FOWNER
 *
 * Returns 0 if successful, -ve on error.
 */
static int may_linkat(struct path *link)
{
	const struct cred *cred;
	struct inode *inode;

	if (!sysctl_protected_hardlinks)
		return 0;

	cred = current_cred();
	inode = link->dentry->d_inode;

	/* Source inode owner (or CAP_FOWNER) can hardlink all they like,
	 * otherwise, it must be a safe source.
	 */
835
	if (uid_eq(cred->fsuid, inode->i_uid) || safe_hardlink_source(inode) ||
K
Kees Cook 已提交
836 837 838
	    capable(CAP_FOWNER))
		return 0;

839
	audit_log_link_denied("linkat", link);
K
Kees Cook 已提交
840 841 842
	return -EPERM;
}

A
Al Viro 已提交
843
static __always_inline int
844
follow_link(struct path *link, struct nameidata *nd, void **p)
L
Linus Torvalds 已提交
845
{
846
	struct dentry *dentry = link->dentry;
847 848
	int error;
	char *s;
L
Linus Torvalds 已提交
849

850 851
	BUG_ON(nd->flags & LOOKUP_RCU);

A
Al Viro 已提交
852 853 854
	if (link->mnt == nd->path.mnt)
		mntget(link->mnt);

855 856 857 858
	error = -ELOOP;
	if (unlikely(current->total_link_count >= 40))
		goto out_put_nd_path;

859 860 861
	cond_resched();
	current->total_link_count++;

A
Al Viro 已提交
862
	touch_atime(link);
L
Linus Torvalds 已提交
863
	nd_set_link(nd, NULL);
A
Al Viro 已提交
864

865
	error = security_inode_follow_link(link->dentry, nd);
866 867
	if (error)
		goto out_put_nd_path;
868

869
	nd->last_type = LAST_BIND;
A
Al Viro 已提交
870 871
	*p = dentry->d_inode->i_op->follow_link(dentry, nd);
	error = PTR_ERR(*p);
872
	if (IS_ERR(*p))
873
		goto out_put_nd_path;
874 875 876 877 878

	error = 0;
	s = nd_get_link(nd);
	if (s) {
		error = __vfs_follow_link(nd, s);
C
Christoph Hellwig 已提交
879 880
		if (unlikely(error))
			put_link(nd, link, *p);
L
Linus Torvalds 已提交
881
	}
882 883 884 885

	return error;

out_put_nd_path:
A
Arnd Bergmann 已提交
886
	*p = NULL;
887 888
	path_put(&nd->path);
	path_put(link);
L
Linus Torvalds 已提交
889 890 891
	return error;
}

N
Nick Piggin 已提交
892 893
static int follow_up_rcu(struct path *path)
{
894 895
	struct mount *mnt = real_mount(path->mnt);
	struct mount *parent;
N
Nick Piggin 已提交
896 897
	struct dentry *mountpoint;

898 899
	parent = mnt->mnt_parent;
	if (&parent->mnt == path->mnt)
N
Nick Piggin 已提交
900
		return 0;
901
	mountpoint = mnt->mnt_mountpoint;
N
Nick Piggin 已提交
902
	path->dentry = mountpoint;
903
	path->mnt = &parent->mnt;
N
Nick Piggin 已提交
904 905 906
	return 1;
}

907 908 909 910 911 912 913 914 915 916
/*
 * follow_up - Find the mountpoint of path's vfsmount
 *
 * Given a path, find the mountpoint of its source file system.
 * Replace @path with the path of the mountpoint in the parent mount.
 * Up is towards /.
 *
 * Return 1 if we went up a level and 0 if we were already at the
 * root.
 */
A
Al Viro 已提交
917
int follow_up(struct path *path)
L
Linus Torvalds 已提交
918
{
919 920
	struct mount *mnt = real_mount(path->mnt);
	struct mount *parent;
L
Linus Torvalds 已提交
921
	struct dentry *mountpoint;
N
Nick Piggin 已提交
922

A
Andi Kleen 已提交
923
	br_read_lock(&vfsmount_lock);
924
	parent = mnt->mnt_parent;
A
Al Viro 已提交
925
	if (parent == mnt) {
A
Andi Kleen 已提交
926
		br_read_unlock(&vfsmount_lock);
L
Linus Torvalds 已提交
927 928
		return 0;
	}
929
	mntget(&parent->mnt);
930
	mountpoint = dget(mnt->mnt_mountpoint);
A
Andi Kleen 已提交
931
	br_read_unlock(&vfsmount_lock);
A
Al Viro 已提交
932 933 934
	dput(path->dentry);
	path->dentry = mountpoint;
	mntput(path->mnt);
935
	path->mnt = &parent->mnt;
L
Linus Torvalds 已提交
936 937 938
	return 1;
}

N
Nick Piggin 已提交
939
/*
940 941 942
 * Perform an automount
 * - return -EISDIR to tell follow_managed() to stop and return the path we
 *   were called with.
L
Linus Torvalds 已提交
943
 */
944 945
static int follow_automount(struct path *path, unsigned flags,
			    bool *need_mntput)
N
Nick Piggin 已提交
946
{
947
	struct vfsmount *mnt;
948
	int err;
949 950 951 952

	if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
		return -EREMOTE;

953 954 955 956 957 958 959 960 961 962
	/* We don't want to mount if someone's just doing a stat -
	 * unless they're stat'ing a directory and appended a '/' to
	 * the name.
	 *
	 * We do, however, want to mount if someone wants to open or
	 * create a file of any type under the mountpoint, wants to
	 * traverse through the mountpoint or wants to open the
	 * mounted directory.  Also, autofs may mark negative dentries
	 * as being automount points.  These will need the attentions
	 * of the daemon to instantiate them before they can be used.
963
	 */
964
	if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
965
		     LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
966 967 968
	    path->dentry->d_inode)
		return -EISDIR;

969 970 971 972 973 974 975 976 977 978 979 980 981 982 983
	current->total_link_count++;
	if (current->total_link_count >= 40)
		return -ELOOP;

	mnt = path->dentry->d_op->d_automount(path);
	if (IS_ERR(mnt)) {
		/*
		 * The filesystem is allowed to return -EISDIR here to indicate
		 * it doesn't want to automount.  For instance, autofs would do
		 * this so that its userspace daemon can mount on this dentry.
		 *
		 * However, we can only permit this if it's a terminal point in
		 * the path being looked up; if it wasn't then the remainder of
		 * the path is inaccessible and we should say so.
		 */
A
Al Viro 已提交
984
		if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT))
985 986
			return -EREMOTE;
		return PTR_ERR(mnt);
N
Nick Piggin 已提交
987
	}
988

989 990
	if (!mnt) /* mount collision */
		return 0;
N
Nick Piggin 已提交
991

992 993 994 995 996
	if (!*need_mntput) {
		/* lock_mount() may release path->mnt on error */
		mntget(path->mnt);
		*need_mntput = true;
	}
997
	err = finish_automount(mnt, path);
998

999 1000 1001
	switch (err) {
	case -EBUSY:
		/* Someone else made a mount here whilst we were busy */
1002
		return 0;
1003
	case 0:
1004
		path_put(path);
1005 1006 1007
		path->mnt = mnt;
		path->dentry = dget(mnt->mnt_root);
		return 0;
1008 1009
	default:
		return err;
1010
	}
1011

A
Al Viro 已提交
1012 1013
}

1014 1015
/*
 * Handle a dentry that is managed in some way.
1016
 * - Flagged for transit management (autofs)
1017 1018 1019 1020 1021 1022 1023 1024
 * - Flagged as mountpoint
 * - Flagged as automount point
 *
 * This may only be called in refwalk mode.
 *
 * Serialization is taken care of in namespace.c
 */
static int follow_managed(struct path *path, unsigned flags)
L
Linus Torvalds 已提交
1025
{
1026
	struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */
1027 1028
	unsigned managed;
	bool need_mntput = false;
1029
	int ret = 0;
1030 1031 1032 1033 1034 1035 1036

	/* Given that we're not holding a lock here, we retain the value in a
	 * local variable for each dentry as we look at it so that we don't see
	 * the components of that value change under us */
	while (managed = ACCESS_ONCE(path->dentry->d_flags),
	       managed &= DCACHE_MANAGED_DENTRY,
	       unlikely(managed != 0)) {
1037 1038 1039 1040 1041
		/* Allow the filesystem to manage the transit without i_mutex
		 * being held. */
		if (managed & DCACHE_MANAGE_TRANSIT) {
			BUG_ON(!path->dentry->d_op);
			BUG_ON(!path->dentry->d_op->d_manage);
1042
			ret = path->dentry->d_op->d_manage(path->dentry, false);
1043
			if (ret < 0)
1044
				break;
1045 1046
		}

1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069
		/* Transit to a mounted filesystem. */
		if (managed & DCACHE_MOUNTED) {
			struct vfsmount *mounted = lookup_mnt(path);
			if (mounted) {
				dput(path->dentry);
				if (need_mntput)
					mntput(path->mnt);
				path->mnt = mounted;
				path->dentry = dget(mounted->mnt_root);
				need_mntput = true;
				continue;
			}

			/* Something is mounted on this dentry in another
			 * namespace and/or whatever was mounted there in this
			 * namespace got unmounted before we managed to get the
			 * vfsmount_lock */
		}

		/* Handle an automount point */
		if (managed & DCACHE_NEED_AUTOMOUNT) {
			ret = follow_automount(path, flags, &need_mntput);
			if (ret < 0)
1070
				break;
1071 1072 1073 1074 1075
			continue;
		}

		/* We didn't change the current path point */
		break;
L
Linus Torvalds 已提交
1076
	}
1077 1078 1079 1080 1081

	if (need_mntput && path->mnt == mnt)
		mntput(path->mnt);
	if (ret == -EISDIR)
		ret = 0;
1082
	return ret < 0 ? ret : need_mntput;
L
Linus Torvalds 已提交
1083 1084
}

1085
int follow_down_one(struct path *path)
L
Linus Torvalds 已提交
1086 1087 1088
{
	struct vfsmount *mounted;

A
Al Viro 已提交
1089
	mounted = lookup_mnt(path);
L
Linus Torvalds 已提交
1090
	if (mounted) {
A
Al Viro 已提交
1091 1092 1093 1094
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
L
Linus Torvalds 已提交
1095 1096 1097 1098 1099
		return 1;
	}
	return 0;
}

1100 1101 1102 1103 1104 1105
static inline bool managed_dentry_might_block(struct dentry *dentry)
{
	return (dentry->d_flags & DCACHE_MANAGE_TRANSIT &&
		dentry->d_op->d_manage(dentry, true) < 0);
}

1106
/*
1107 1108
 * Try to skip to top of mountpoint pile in rcuwalk mode.  Fail if
 * we meet a managed dentry that would need blocking.
1109 1110
 */
static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1111
			       struct inode **inode)
1112
{
1113
	for (;;) {
1114
		struct mount *mounted;
1115 1116 1117 1118
		/*
		 * Don't forget we might have a non-mountpoint managed dentry
		 * that wants to block transit.
		 */
1119
		if (unlikely(managed_dentry_might_block(path->dentry)))
1120
			return false;
1121 1122 1123 1124

		if (!d_mountpoint(path->dentry))
			break;

1125 1126 1127
		mounted = __lookup_mnt(path->mnt, path->dentry, 1);
		if (!mounted)
			break;
1128 1129
		path->mnt = &mounted->mnt;
		path->dentry = mounted->mnt.mnt_root;
1130
		nd->flags |= LOOKUP_JUMPED;
1131
		nd->seq = read_seqcount_begin(&path->dentry->d_seq);
1132 1133 1134 1135 1136 1137
		/*
		 * Update the inode too. We don't need to re-check the
		 * dentry sequence number here after this d_inode read,
		 * because a mount-point is always pinned.
		 */
		*inode = path->dentry->d_inode;
1138 1139 1140 1141
	}
	return true;
}

1142
static void follow_mount_rcu(struct nameidata *nd)
1143
{
1144
	while (d_mountpoint(nd->path.dentry)) {
1145
		struct mount *mounted;
1146
		mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry, 1);
1147 1148
		if (!mounted)
			break;
1149 1150
		nd->path.mnt = &mounted->mnt;
		nd->path.dentry = mounted->mnt.mnt_root;
1151
		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
1152 1153 1154
	}
}

N
Nick Piggin 已提交
1155 1156 1157 1158
static int follow_dotdot_rcu(struct nameidata *nd)
{
	set_root_rcu(nd);

1159
	while (1) {
N
Nick Piggin 已提交
1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170
		if (nd->path.dentry == nd->root.dentry &&
		    nd->path.mnt == nd->root.mnt) {
			break;
		}
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
			struct dentry *old = nd->path.dentry;
			struct dentry *parent = old->d_parent;
			unsigned seq;

			seq = read_seqcount_begin(&parent->d_seq);
			if (read_seqcount_retry(&old->d_seq, nd->seq))
1171
				goto failed;
N
Nick Piggin 已提交
1172 1173 1174 1175 1176 1177 1178 1179
			nd->path.dentry = parent;
			nd->seq = seq;
			break;
		}
		if (!follow_up_rcu(&nd->path))
			break;
		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
	}
1180 1181
	follow_mount_rcu(nd);
	nd->inode = nd->path.dentry->d_inode;
N
Nick Piggin 已提交
1182
	return 0;
1183 1184 1185

failed:
	nd->flags &= ~LOOKUP_RCU;
1186 1187
	if (!(nd->flags & LOOKUP_ROOT))
		nd->root.mnt = NULL;
A
Al Viro 已提交
1188
	unlock_rcu_walk();
1189
	return -ECHILD;
N
Nick Piggin 已提交
1190 1191
}

1192 1193 1194 1195 1196
/*
 * Follow down to the covering mount currently visible to userspace.  At each
 * point, the filesystem owning that dentry may be queried as to whether the
 * caller is permitted to proceed or not.
 */
1197
int follow_down(struct path *path)
1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216
{
	unsigned managed;
	int ret;

	while (managed = ACCESS_ONCE(path->dentry->d_flags),
	       unlikely(managed & DCACHE_MANAGED_DENTRY)) {
		/* Allow the filesystem to manage the transit without i_mutex
		 * being held.
		 *
		 * We indicate to the filesystem if someone is trying to mount
		 * something here.  This gives autofs the chance to deny anyone
		 * other than its daemon the right to mount on its
		 * superstructure.
		 *
		 * The filesystem may sleep at this point.
		 */
		if (managed & DCACHE_MANAGE_TRANSIT) {
			BUG_ON(!path->dentry->d_op);
			BUG_ON(!path->dentry->d_op->d_manage);
1217
			ret = path->dentry->d_op->d_manage(
1218
				path->dentry, false);
1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240
			if (ret < 0)
				return ret == -EISDIR ? 0 : ret;
		}

		/* Transit to a mounted filesystem. */
		if (managed & DCACHE_MOUNTED) {
			struct vfsmount *mounted = lookup_mnt(path);
			if (!mounted)
				break;
			dput(path->dentry);
			mntput(path->mnt);
			path->mnt = mounted;
			path->dentry = dget(mounted->mnt_root);
			continue;
		}

		/* Don't handle automount points here */
		break;
	}
	return 0;
}

1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256
/*
 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot()
 */
static void follow_mount(struct path *path)
{
	while (d_mountpoint(path->dentry)) {
		struct vfsmount *mounted = lookup_mnt(path);
		if (!mounted)
			break;
		dput(path->dentry);
		mntput(path->mnt);
		path->mnt = mounted;
		path->dentry = dget(mounted->mnt_root);
	}
}

N
Nick Piggin 已提交
1257
static void follow_dotdot(struct nameidata *nd)
L
Linus Torvalds 已提交
1258
{
A
Al Viro 已提交
1259
	set_root(nd);
1260

L
Linus Torvalds 已提交
1261
	while(1) {
1262
		struct dentry *old = nd->path.dentry;
L
Linus Torvalds 已提交
1263

A
Al Viro 已提交
1264 1265
		if (nd->path.dentry == nd->root.dentry &&
		    nd->path.mnt == nd->root.mnt) {
L
Linus Torvalds 已提交
1266 1267
			break;
		}
1268
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
A
Al Viro 已提交
1269 1270
			/* rare case of legitimate dget_parent()... */
			nd->path.dentry = dget_parent(nd->path.dentry);
L
Linus Torvalds 已提交
1271 1272 1273
			dput(old);
			break;
		}
A
Al Viro 已提交
1274
		if (!follow_up(&nd->path))
L
Linus Torvalds 已提交
1275 1276
			break;
	}
A
Al Viro 已提交
1277
	follow_mount(&nd->path);
N
Nick Piggin 已提交
1278
	nd->inode = nd->path.dentry->d_inode;
L
Linus Torvalds 已提交
1279 1280
}

1281
/*
M
Miklos Szeredi 已提交
1282 1283 1284 1285 1286
 * This looks up the name in dcache, possibly revalidates the old dentry and
 * allocates a new one if not found or not valid.  In the need_lookup argument
 * returns whether i_op->lookup is necessary.
 *
 * dir->d_inode->i_mutex must be held
1287
 */
M
Miklos Szeredi 已提交
1288
static struct dentry *lookup_dcache(struct qstr *name, struct dentry *dir,
1289
				    unsigned int flags, bool *need_lookup)
1290 1291
{
	struct dentry *dentry;
M
Miklos Szeredi 已提交
1292
	int error;
1293

M
Miklos Szeredi 已提交
1294 1295 1296
	*need_lookup = false;
	dentry = d_lookup(dir, name);
	if (dentry) {
J
Jeff Layton 已提交
1297
		if (dentry->d_flags & DCACHE_OP_REVALIDATE) {
1298
			error = d_revalidate(dentry, flags);
M
Miklos Szeredi 已提交
1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309
			if (unlikely(error <= 0)) {
				if (error < 0) {
					dput(dentry);
					return ERR_PTR(error);
				} else if (!d_invalidate(dentry)) {
					dput(dentry);
					dentry = NULL;
				}
			}
		}
	}
1310

M
Miklos Szeredi 已提交
1311 1312 1313 1314
	if (!dentry) {
		dentry = d_alloc(dir, name);
		if (unlikely(!dentry))
			return ERR_PTR(-ENOMEM);
1315

M
Miklos Szeredi 已提交
1316
		*need_lookup = true;
1317 1318 1319 1320
	}
	return dentry;
}

1321
/*
M
Miklos Szeredi 已提交
1322 1323 1324 1325
 * Call i_op->lookup on the dentry.  The dentry must be negative but may be
 * hashed if it was pouplated with DCACHE_NEED_LOOKUP.
 *
 * dir->d_inode->i_mutex must be held
1326
 */
M
Miklos Szeredi 已提交
1327
static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry,
1328
				  unsigned int flags)
1329 1330 1331 1332
{
	struct dentry *old;

	/* Don't create child dentry for a dead directory. */
M
Miklos Szeredi 已提交
1333
	if (unlikely(IS_DEADDIR(dir))) {
1334
		dput(dentry);
1335
		return ERR_PTR(-ENOENT);
1336
	}
1337

1338
	old = dir->i_op->lookup(dir, dentry, flags);
1339 1340 1341 1342 1343 1344 1345
	if (unlikely(old)) {
		dput(dentry);
		dentry = old;
	}
	return dentry;
}

1346
static struct dentry *__lookup_hash(struct qstr *name,
1347
		struct dentry *base, unsigned int flags)
1348
{
M
Miklos Szeredi 已提交
1349
	bool need_lookup;
1350 1351
	struct dentry *dentry;

1352
	dentry = lookup_dcache(name, base, flags, &need_lookup);
M
Miklos Szeredi 已提交
1353 1354
	if (!need_lookup)
		return dentry;
1355

1356
	return lookup_real(base->d_inode, dentry, flags);
1357 1358
}

L
Linus Torvalds 已提交
1359 1360 1361 1362 1363
/*
 *  It's more convoluted than I'd like it to be, but... it's still fairly
 *  small and for now I'd prefer to have fast path as straight as possible.
 *  It _is_ time-critical.
 */
A
Al Viro 已提交
1364
static int lookup_fast(struct nameidata *nd,
M
Miklos Szeredi 已提交
1365
		       struct path *path, struct inode **inode)
L
Linus Torvalds 已提交
1366
{
1367
	struct vfsmount *mnt = nd->path.mnt;
N
Nick Piggin 已提交
1368
	struct dentry *dentry, *parent = nd->path.dentry;
A
Al Viro 已提交
1369 1370
	int need_reval = 1;
	int status = 1;
1371 1372
	int err;

1373 1374 1375 1376 1377
	/*
	 * Rename seqlock is not required here because in the off chance
	 * of a false negative due to a concurrent rename, we're going to
	 * do the non-racy lookup, below.
	 */
N
Nick Piggin 已提交
1378 1379
	if (nd->flags & LOOKUP_RCU) {
		unsigned seq;
1380
		dentry = __d_lookup_rcu(parent, &nd->last, &seq);
A
Al Viro 已提交
1381 1382 1383
		if (!dentry)
			goto unlazy;

1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398
		/*
		 * This sequence count validates that the inode matches
		 * the dentry name information from lookup.
		 */
		*inode = dentry->d_inode;
		if (read_seqcount_retry(&dentry->d_seq, seq))
			return -ECHILD;

		/*
		 * This sequence count validates that the parent had no
		 * changes while we did the lookup of the dentry above.
		 *
		 * The memory barrier in read_seqcount_begin of child is
		 *  enough, we can use __read_seqcount_retry here.
		 */
N
Nick Piggin 已提交
1399 1400 1401
		if (__read_seqcount_retry(&parent->d_seq, nd->seq))
			return -ECHILD;
		nd->seq = seq;
A
Al Viro 已提交
1402

1403
		if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) {
1404
			status = d_revalidate(dentry, nd->flags);
A
Al Viro 已提交
1405 1406 1407 1408 1409
			if (unlikely(status <= 0)) {
				if (status != -ECHILD)
					need_reval = 0;
				goto unlazy;
			}
1410
		}
N
Nick Piggin 已提交
1411 1412
		path->mnt = mnt;
		path->dentry = dentry;
1413 1414 1415 1416 1417
		if (unlikely(!__follow_mount_rcu(nd, path, inode)))
			goto unlazy;
		if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT))
			goto unlazy;
		return 0;
A
Al Viro 已提交
1418
unlazy:
A
Al Viro 已提交
1419 1420
		if (unlazy_walk(nd, dentry))
			return -ECHILD;
A
Al Viro 已提交
1421
	} else {
A
Al Viro 已提交
1422
		dentry = __d_lookup(parent, &nd->last);
1423
	}
A
Al Viro 已提交
1424

1425 1426 1427
	if (unlikely(!dentry))
		goto need_lookup;

A
Al Viro 已提交
1428
	if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval)
1429
		status = d_revalidate(dentry, nd->flags);
A
Al Viro 已提交
1430 1431 1432 1433 1434 1435 1436
	if (unlikely(status <= 0)) {
		if (status < 0) {
			dput(dentry);
			return status;
		}
		if (!d_invalidate(dentry)) {
			dput(dentry);
1437
			goto need_lookup;
A
Al Viro 已提交
1438
		}
1439
	}
M
Miklos Szeredi 已提交
1440

1441 1442 1443
	path->mnt = mnt;
	path->dentry = dentry;
	err = follow_managed(path, nd->flags);
1444 1445
	if (unlikely(err < 0)) {
		path_put_conditional(path, nd);
1446
		return err;
1447
	}
1448 1449
	if (err)
		nd->flags |= LOOKUP_JUMPED;
1450
	*inode = path->dentry->d_inode;
L
Linus Torvalds 已提交
1451
	return 0;
1452 1453

need_lookup:
M
Miklos Szeredi 已提交
1454 1455 1456 1457
	return 1;
}

/* Fast lookup failed, do it the slow way */
A
Al Viro 已提交
1458
static int lookup_slow(struct nameidata *nd, struct path *path)
M
Miklos Szeredi 已提交
1459 1460 1461 1462 1463
{
	struct dentry *dentry, *parent;
	int err;

	parent = nd->path.dentry;
1464 1465 1466
	BUG_ON(nd->inode != parent->d_inode);

	mutex_lock(&parent->d_inode->i_mutex);
A
Al Viro 已提交
1467
	dentry = __lookup_hash(&nd->last, parent, nd->flags);
1468 1469 1470
	mutex_unlock(&parent->d_inode->i_mutex);
	if (IS_ERR(dentry))
		return PTR_ERR(dentry);
M
Miklos Szeredi 已提交
1471 1472 1473 1474 1475 1476 1477 1478 1479 1480
	path->mnt = nd->path.mnt;
	path->dentry = dentry;
	err = follow_managed(path, nd->flags);
	if (unlikely(err < 0)) {
		path_put_conditional(path, nd);
		return err;
	}
	if (err)
		nd->flags |= LOOKUP_JUMPED;
	return 0;
L
Linus Torvalds 已提交
1481 1482
}

1483 1484 1485
static inline int may_lookup(struct nameidata *nd)
{
	if (nd->flags & LOOKUP_RCU) {
1486
		int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1487 1488
		if (err != -ECHILD)
			return err;
A
Al Viro 已提交
1489
		if (unlazy_walk(nd, NULL))
1490 1491
			return -ECHILD;
	}
1492
	return inode_permission(nd->inode, MAY_EXEC);
1493 1494
}

1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506
static inline int handle_dots(struct nameidata *nd, int type)
{
	if (type == LAST_DOTDOT) {
		if (nd->flags & LOOKUP_RCU) {
			if (follow_dotdot_rcu(nd))
				return -ECHILD;
		} else
			follow_dotdot(nd);
	}
	return 0;
}

1507 1508 1509 1510 1511 1512
static void terminate_walk(struct nameidata *nd)
{
	if (!(nd->flags & LOOKUP_RCU)) {
		path_put(&nd->path);
	} else {
		nd->flags &= ~LOOKUP_RCU;
1513 1514
		if (!(nd->flags & LOOKUP_ROOT))
			nd->root.mnt = NULL;
A
Al Viro 已提交
1515
		unlock_rcu_walk();
1516 1517 1518
	}
}

1519 1520 1521 1522 1523 1524
/*
 * Do we need to follow links? We _really_ want to be able
 * to do this check without having to look at inode->i_op,
 * so we keep a cache of "no, this doesn't need follow_link"
 * for the common case.
 */
1525
static inline int should_follow_link(struct inode *inode, int follow)
1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538
{
	if (unlikely(!(inode->i_opflags & IOP_NOFOLLOW))) {
		if (likely(inode->i_op->follow_link))
			return follow;

		/* This gets set once for the inode lifetime */
		spin_lock(&inode->i_lock);
		inode->i_opflags |= IOP_NOFOLLOW;
		spin_unlock(&inode->i_lock);
	}
	return 0;
}

1539
static inline int walk_component(struct nameidata *nd, struct path *path,
1540
		int follow)
1541 1542 1543 1544 1545 1546 1547 1548
{
	struct inode *inode;
	int err;
	/*
	 * "." and ".." are special - ".." especially so because it has
	 * to be able to know about the current root directory and
	 * parent relationships.
	 */
1549 1550
	if (unlikely(nd->last_type != LAST_NORM))
		return handle_dots(nd, nd->last_type);
A
Al Viro 已提交
1551
	err = lookup_fast(nd, path, &inode);
1552
	if (unlikely(err)) {
M
Miklos Szeredi 已提交
1553 1554 1555
		if (err < 0)
			goto out_err;

A
Al Viro 已提交
1556
		err = lookup_slow(nd, path);
M
Miklos Szeredi 已提交
1557 1558 1559 1560
		if (err < 0)
			goto out_err;

		inode = path->dentry->d_inode;
1561
	}
M
Miklos Szeredi 已提交
1562 1563 1564 1565
	err = -ENOENT;
	if (!inode)
		goto out_path_put;

1566
	if (should_follow_link(inode, follow)) {
A
Al Viro 已提交
1567 1568
		if (nd->flags & LOOKUP_RCU) {
			if (unlikely(unlazy_walk(nd, path->dentry))) {
M
Miklos Szeredi 已提交
1569 1570
				err = -ECHILD;
				goto out_err;
A
Al Viro 已提交
1571 1572
			}
		}
1573 1574 1575 1576 1577 1578
		BUG_ON(inode != path->dentry->d_inode);
		return 1;
	}
	path_to_nameidata(path, nd);
	nd->inode = inode;
	return 0;
M
Miklos Szeredi 已提交
1579 1580 1581 1582 1583 1584

out_path_put:
	path_to_nameidata(path, nd);
out_err:
	terminate_walk(nd);
	return err;
1585 1586
}

1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602
/*
 * This limits recursive symlink follows to 8, while
 * limiting consecutive symlinks to 40.
 *
 * Without that kind of total limit, nasty chains of consecutive
 * symlinks can cause almost arbitrarily long lookups.
 */
static inline int nested_symlink(struct path *path, struct nameidata *nd)
{
	int res;

	if (unlikely(current->link_count >= MAX_NESTED_LINKS)) {
		path_put_conditional(path, nd);
		path_put(&nd->path);
		return -ELOOP;
	}
1603
	BUG_ON(nd->depth >= MAX_NESTED_LINKS);
1604 1605 1606 1607 1608 1609 1610

	nd->depth++;
	current->link_count++;

	do {
		struct path link = *path;
		void *cookie;
1611 1612

		res = follow_link(&link, nd, &cookie);
1613 1614
		if (res)
			break;
1615
		res = walk_component(nd, path, LOOKUP_FOLLOW);
1616
		put_link(nd, &link, cookie);
1617 1618 1619 1620 1621 1622 1623
	} while (res > 0);

	current->link_count--;
	nd->depth--;
	return res;
}

1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643
/*
 * We really don't want to look at inode->i_op->lookup
 * when we don't have to. So we keep a cache bit in
 * the inode ->i_opflags field that says "yes, we can
 * do lookup on this inode".
 */
static inline int can_lookup(struct inode *inode)
{
	if (likely(inode->i_opflags & IOP_LOOKUP))
		return 1;
	if (likely(!inode->i_op->lookup))
		return 0;

	/* We do this once for the lifetime of the inode */
	spin_lock(&inode->i_lock);
	inode->i_opflags |= IOP_LOOKUP;
	spin_unlock(&inode->i_lock);
	return 1;
}

1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667
/*
 * We can do the critical dentry name comparison and hashing
 * operations one word at a time, but we are limited to:
 *
 * - Architectures with fast unaligned word accesses. We could
 *   do a "get_unaligned()" if this helps and is sufficiently
 *   fast.
 *
 * - Little-endian machines (so that we can generate the mask
 *   of low bytes efficiently). Again, we *could* do a byte
 *   swapping load on big-endian architectures if that is not
 *   expensive enough to make the optimization worthless.
 *
 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
 *   do not trap on the (extremely unlikely) case of a page
 *   crossing operation.
 *
 * - Furthermore, we need an efficient 64-bit compile for the
 *   64-bit case in order to generate the "number of bytes in
 *   the final mask". Again, that could be replaced with a
 *   efficient population count instruction or similar.
 */
#ifdef CONFIG_DCACHE_WORD_ACCESS

1668
#include <asm/word-at-a-time.h>
1669

1670
#ifdef CONFIG_64BIT
1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689

static inline unsigned int fold_hash(unsigned long hash)
{
	hash += hash >> (8*sizeof(int));
	return hash;
}

#else	/* 32-bit case */

#define fold_hash(x) (x)

#endif

unsigned int full_name_hash(const unsigned char *name, unsigned int len)
{
	unsigned long a, mask;
	unsigned long hash = 0;

	for (;;) {
1690
		a = load_unaligned_zeropad(name);
1691 1692 1693
		if (len < sizeof(unsigned long))
			break;
		hash += a;
1694
		hash *= 9;
1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712
		name += sizeof(unsigned long);
		len -= sizeof(unsigned long);
		if (!len)
			goto done;
	}
	mask = ~(~0ul << len*8);
	hash += mask & a;
done:
	return fold_hash(hash);
}
EXPORT_SYMBOL(full_name_hash);

/*
 * Calculate the length and hash of the path component, and
 * return the length of the component;
 */
static inline unsigned long hash_name(const char *name, unsigned int *hashp)
{
1713 1714
	unsigned long a, b, adata, bdata, mask, hash, len;
	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1715 1716 1717 1718 1719 1720

	hash = a = 0;
	len = -sizeof(unsigned long);
	do {
		hash = (hash + a) * 9;
		len += sizeof(unsigned long);
1721
		a = load_unaligned_zeropad(name+len);
1722 1723 1724 1725 1726 1727 1728 1729 1730
		b = a ^ REPEAT_BYTE('/');
	} while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));

	adata = prep_zero_mask(a, adata, &constants);
	bdata = prep_zero_mask(b, bdata, &constants);

	mask = create_zero_mask(adata | bdata);

	hash += a & zero_bytemask(mask);
1731 1732
	*hashp = fold_hash(hash);

1733
	return len + find_zero(mask);
1734 1735 1736 1737
}

#else

L
Linus Torvalds 已提交
1738 1739 1740 1741 1742 1743 1744
unsigned int full_name_hash(const unsigned char *name, unsigned int len)
{
	unsigned long hash = init_name_hash();
	while (len--)
		hash = partial_name_hash(*name++, hash);
	return end_name_hash(hash);
}
1745
EXPORT_SYMBOL(full_name_hash);
L
Linus Torvalds 已提交
1746

1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765
/*
 * We know there's a real path component here of at least
 * one character.
 */
static inline unsigned long hash_name(const char *name, unsigned int *hashp)
{
	unsigned long hash = init_name_hash();
	unsigned long len = 0, c;

	c = (unsigned char)*name;
	do {
		len++;
		hash = partial_name_hash(c, hash);
		c = (unsigned char)name[len];
	} while (c && c != '/');
	*hashp = end_name_hash(hash);
	return len;
}

1766 1767
#endif

L
Linus Torvalds 已提交
1768 1769
/*
 * Name resolution.
1770 1771
 * This is the basic name resolution function, turning a pathname into
 * the final dentry. We expect 'base' to be positive and a directory.
L
Linus Torvalds 已提交
1772
 *
1773 1774
 * Returns 0 and nd will have valid dentry and mnt on success.
 * Returns error and drops reference to input namei data on failure.
L
Linus Torvalds 已提交
1775
 */
1776
static int link_path_walk(const char *name, struct nameidata *nd)
L
Linus Torvalds 已提交
1777 1778 1779 1780 1781 1782 1783
{
	struct path next;
	int err;
	
	while (*name=='/')
		name++;
	if (!*name)
1784
		return 0;
L
Linus Torvalds 已提交
1785 1786 1787 1788

	/* At this point we know we have a real path component. */
	for(;;) {
		struct qstr this;
1789
		long len;
A
Al Viro 已提交
1790
		int type;
L
Linus Torvalds 已提交
1791

1792
		err = may_lookup(nd);
L
Linus Torvalds 已提交
1793 1794 1795
 		if (err)
			break;

1796
		len = hash_name(name, &this.hash);
L
Linus Torvalds 已提交
1797
		this.name = name;
1798
		this.len = len;
L
Linus Torvalds 已提交
1799

A
Al Viro 已提交
1800
		type = LAST_NORM;
1801
		if (name[0] == '.') switch (len) {
A
Al Viro 已提交
1802
			case 2:
1803
				if (name[1] == '.') {
A
Al Viro 已提交
1804
					type = LAST_DOTDOT;
A
Al Viro 已提交
1805 1806
					nd->flags |= LOOKUP_JUMPED;
				}
A
Al Viro 已提交
1807 1808 1809 1810
				break;
			case 1:
				type = LAST_DOT;
		}
1811 1812
		if (likely(type == LAST_NORM)) {
			struct dentry *parent = nd->path.dentry;
A
Al Viro 已提交
1813
			nd->flags &= ~LOOKUP_JUMPED;
1814
			if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
1815
				err = parent->d_op->d_hash(parent, &this);
1816 1817 1818 1819
				if (err < 0)
					break;
			}
		}
A
Al Viro 已提交
1820

1821 1822 1823
		nd->last = this;
		nd->last_type = type;

1824
		if (!name[len])
1825
			return 0;
1826 1827 1828 1829 1830 1831 1832 1833
		/*
		 * If it wasn't NUL, we know it was '/'. Skip that
		 * slash, and continue until no more slashes.
		 */
		do {
			len++;
		} while (unlikely(name[len] == '/'));
		if (!name[len])
1834 1835
			return 0;

1836
		name += len;
L
Linus Torvalds 已提交
1837

1838
		err = walk_component(nd, &next, LOOKUP_FOLLOW);
1839 1840
		if (err < 0)
			return err;
L
Linus Torvalds 已提交
1841

1842
		if (err) {
1843
			err = nested_symlink(&next, nd);
L
Linus Torvalds 已提交
1844
			if (err)
1845
				return err;
N
Nick Piggin 已提交
1846
		}
1847 1848 1849 1850
		if (!can_lookup(nd->inode)) {
			err = -ENOTDIR; 
			break;
		}
L
Linus Torvalds 已提交
1851
	}
1852
	terminate_walk(nd);
L
Linus Torvalds 已提交
1853 1854 1855
	return err;
}

A
Al Viro 已提交
1856 1857
static int path_init(int dfd, const char *name, unsigned int flags,
		     struct nameidata *nd, struct file **fp)
N
Nick Piggin 已提交
1858 1859 1860 1861
{
	int retval = 0;

	nd->last_type = LAST_ROOT; /* if there are only slashes... */
A
Al Viro 已提交
1862
	nd->flags = flags | LOOKUP_JUMPED;
N
Nick Piggin 已提交
1863
	nd->depth = 0;
1864 1865
	if (flags & LOOKUP_ROOT) {
		struct inode *inode = nd->root.dentry->d_inode;
A
Al Viro 已提交
1866
		if (*name) {
1867
			if (!can_lookup(inode))
A
Al Viro 已提交
1868 1869 1870 1871 1872
				return -ENOTDIR;
			retval = inode_permission(inode, MAY_EXEC);
			if (retval)
				return retval;
		}
1873 1874 1875
		nd->path = nd->root;
		nd->inode = inode;
		if (flags & LOOKUP_RCU) {
A
Al Viro 已提交
1876
			lock_rcu_walk();
1877 1878 1879 1880 1881 1882 1883
			nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
		} else {
			path_get(&nd->path);
		}
		return 0;
	}

N
Nick Piggin 已提交
1884 1885 1886
	nd->root.mnt = NULL;

	if (*name=='/') {
A
Al Viro 已提交
1887
		if (flags & LOOKUP_RCU) {
A
Al Viro 已提交
1888
			lock_rcu_walk();
A
Al Viro 已提交
1889 1890 1891 1892 1893 1894
			set_root_rcu(nd);
		} else {
			set_root(nd);
			path_get(&nd->root);
		}
		nd->path = nd->root;
N
Nick Piggin 已提交
1895
	} else if (dfd == AT_FDCWD) {
A
Al Viro 已提交
1896 1897 1898
		if (flags & LOOKUP_RCU) {
			struct fs_struct *fs = current->fs;
			unsigned seq;
N
Nick Piggin 已提交
1899

A
Al Viro 已提交
1900
			lock_rcu_walk();
N
Nick Piggin 已提交
1901

A
Al Viro 已提交
1902 1903 1904 1905 1906 1907 1908 1909
			do {
				seq = read_seqcount_begin(&fs->seq);
				nd->path = fs->pwd;
				nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
			} while (read_seqcount_retry(&fs->seq, seq));
		} else {
			get_fs_pwd(current->fs, &nd->path);
		}
N
Nick Piggin 已提交
1910
	} else {
1911
		/* Caller must check execute permissions on the starting path component */
1912
		struct fd f = fdget_raw(dfd);
N
Nick Piggin 已提交
1913 1914
		struct dentry *dentry;

1915 1916
		if (!f.file)
			return -EBADF;
N
Nick Piggin 已提交
1917

1918
		dentry = f.file->f_path.dentry;
N
Nick Piggin 已提交
1919

A
Al Viro 已提交
1920
		if (*name) {
1921
			if (!can_lookup(dentry->d_inode)) {
1922 1923 1924
				fdput(f);
				return -ENOTDIR;
			}
A
Al Viro 已提交
1925
		}
N
Nick Piggin 已提交
1926

1927
		nd->path = f.file->f_path;
A
Al Viro 已提交
1928
		if (flags & LOOKUP_RCU) {
1929 1930
			if (f.need_put)
				*fp = f.file;
A
Al Viro 已提交
1931
			nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
A
Al Viro 已提交
1932
			lock_rcu_walk();
A
Al Viro 已提交
1933
		} else {
1934 1935
			path_get(&nd->path);
			fdput(f);
A
Al Viro 已提交
1936
		}
N
Nick Piggin 已提交
1937 1938 1939
	}

	nd->inode = nd->path.dentry->d_inode;
1940 1941 1942
	return 0;
}

1943 1944 1945 1946 1947 1948
static inline int lookup_last(struct nameidata *nd, struct path *path)
{
	if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
		nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;

	nd->flags &= ~LOOKUP_PARENT;
1949
	return walk_component(nd, path, nd->flags & LOOKUP_FOLLOW);
1950 1951
}

1952
/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
A
Al Viro 已提交
1953
static int path_lookupat(int dfd, const char *name,
1954 1955
				unsigned int flags, struct nameidata *nd)
{
A
Al Viro 已提交
1956
	struct file *base = NULL;
1957 1958
	struct path path;
	int err;
N
Nick Piggin 已提交
1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973

	/*
	 * Path walking is largely split up into 2 different synchronisation
	 * schemes, rcu-walk and ref-walk (explained in
	 * Documentation/filesystems/path-lookup.txt). These share much of the
	 * path walk code, but some things particularly setup, cleanup, and
	 * following mounts are sufficiently divergent that functions are
	 * duplicated. Typically there is a function foo(), and its RCU
	 * analogue, foo_rcu().
	 *
	 * -ECHILD is the error number of choice (just to avoid clashes) that
	 * is returned if some aspect of an rcu-walk fails. Such an error must
	 * be handled by restarting a traditional ref-walk (which will always
	 * be able to complete).
	 */
1974
	err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base);
A
Al Viro 已提交
1975

1976 1977
	if (unlikely(err))
		return err;
A
Al Viro 已提交
1978 1979

	current->total_link_count = 0;
1980 1981 1982 1983 1984 1985 1986
	err = link_path_walk(name, nd);

	if (!err && !(flags & LOOKUP_PARENT)) {
		err = lookup_last(nd, &path);
		while (err > 0) {
			void *cookie;
			struct path link = path;
K
Kees Cook 已提交
1987 1988 1989
			err = may_follow_link(&link, nd);
			if (unlikely(err))
				break;
1990
			nd->flags |= LOOKUP_PARENT;
1991
			err = follow_link(&link, nd, &cookie);
1992 1993 1994
			if (err)
				break;
			err = lookup_last(nd, &path);
1995
			put_link(nd, &link, cookie);
1996 1997
		}
	}
A
Al Viro 已提交
1998

1999 2000
	if (!err)
		err = complete_walk(nd);
2001 2002

	if (!err && nd->flags & LOOKUP_DIRECTORY) {
2003
		if (!can_lookup(nd->inode)) {
2004
			path_put(&nd->path);
A
Al Viro 已提交
2005
			err = -ENOTDIR;
2006 2007
		}
	}
A
Al Viro 已提交
2008

A
Al Viro 已提交
2009 2010
	if (base)
		fput(base);
A
Al Viro 已提交
2011

2012
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
A
Al Viro 已提交
2013 2014 2015
		path_put(&nd->root);
		nd->root.mnt = NULL;
	}
2016
	return err;
A
Al Viro 已提交
2017
}
N
Nick Piggin 已提交
2018

2019
static int filename_lookup(int dfd, struct filename *name,
A
Al Viro 已提交
2020 2021
				unsigned int flags, struct nameidata *nd)
{
2022
	int retval = path_lookupat(dfd, name->name, flags | LOOKUP_RCU, nd);
A
Al Viro 已提交
2023
	if (unlikely(retval == -ECHILD))
2024
		retval = path_lookupat(dfd, name->name, flags, nd);
A
Al Viro 已提交
2025
	if (unlikely(retval == -ESTALE))
2026 2027
		retval = path_lookupat(dfd, name->name,
						flags | LOOKUP_REVAL, nd);
N
Nick Piggin 已提交
2028

2029
	if (likely(!retval))
2030
		audit_inode(name, nd->path.dentry, flags & LOOKUP_PARENT);
2031
	return retval;
L
Linus Torvalds 已提交
2032 2033
}

2034 2035 2036 2037 2038 2039 2040 2041
static int do_path_lookup(int dfd, const char *name,
				unsigned int flags, struct nameidata *nd)
{
	struct filename filename = { .name = name };

	return filename_lookup(dfd, &filename, flags, nd);
}

A
Al Viro 已提交
2042 2043
/* does lookup, returns the object with parent locked */
struct dentry *kern_path_locked(const char *name, struct path *path)
2044
{
A
Al Viro 已提交
2045 2046 2047 2048 2049 2050 2051 2052 2053 2054
	struct nameidata nd;
	struct dentry *d;
	int err = do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, &nd);
	if (err)
		return ERR_PTR(err);
	if (nd.last_type != LAST_NORM) {
		path_put(&nd.path);
		return ERR_PTR(-EINVAL);
	}
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2055
	d = __lookup_hash(&nd.last, nd.path.dentry, 0);
A
Al Viro 已提交
2056 2057 2058 2059 2060 2061 2062
	if (IS_ERR(d)) {
		mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
		path_put(&nd.path);
		return d;
	}
	*path = nd.path;
	return d;
2063 2064
}

A
Al Viro 已提交
2065 2066 2067 2068 2069 2070 2071 2072 2073
int kern_path(const char *name, unsigned int flags, struct path *path)
{
	struct nameidata nd;
	int res = do_path_lookup(AT_FDCWD, name, flags, &nd);
	if (!res)
		*path = nd.path;
	return res;
}

2074 2075 2076 2077 2078 2079
/**
 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
 * @dentry:  pointer to dentry of the base directory
 * @mnt: pointer to vfs mount of the base directory
 * @name: pointer to file name
 * @flags: lookup flags
2080
 * @path: pointer to struct path to fill
2081 2082 2083
 */
int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
		    const char *name, unsigned int flags,
2084
		    struct path *path)
2085
{
2086 2087 2088 2089 2090
	struct nameidata nd;
	int err;
	nd.root.dentry = dentry;
	nd.root.mnt = mnt;
	BUG_ON(flags & LOOKUP_PARENT);
2091
	/* the first argument of do_path_lookup() is ignored with LOOKUP_ROOT */
2092 2093 2094 2095
	err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd);
	if (!err)
		*path = nd.path;
	return err;
2096 2097
}

2098 2099 2100 2101 2102
/*
 * Restricted form of lookup. Doesn't follow links, single-component only,
 * needs parent already locked. Doesn't follow mounts.
 * SMP-safe.
 */
2103
static struct dentry *lookup_hash(struct nameidata *nd)
2104
{
2105
	return __lookup_hash(&nd->last, nd->path.dentry, nd->flags);
L
Linus Torvalds 已提交
2106 2107
}

2108
/**
2109
 * lookup_one_len - filesystem helper to lookup single pathname component
2110 2111 2112 2113
 * @name:	pathname component to lookup
 * @base:	base directory to lookup from
 * @len:	maximum length @len should be interpreted to
 *
2114 2115
 * Note that this routine is purely a helper for filesystem usage and should
 * not be called by generic code.  Also note that by using this function the
2116 2117 2118
 * nameidata argument is passed to the filesystem methods and a filesystem
 * using this helper needs to be prepared for that.
 */
2119 2120 2121
struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
{
	struct qstr this;
A
Al Viro 已提交
2122
	unsigned int c;
2123
	int err;
2124

2125 2126
	WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));

A
Al Viro 已提交
2127 2128
	this.name = name;
	this.len = len;
L
Linus Torvalds 已提交
2129
	this.hash = full_name_hash(name, len);
A
Al Viro 已提交
2130 2131 2132
	if (!len)
		return ERR_PTR(-EACCES);

A
Al Viro 已提交
2133 2134 2135 2136 2137
	if (unlikely(name[0] == '.')) {
		if (len < 2 || (len == 2 && name[1] == '.'))
			return ERR_PTR(-EACCES);
	}

A
Al Viro 已提交
2138 2139 2140 2141 2142
	while (len--) {
		c = *(const unsigned char *)name++;
		if (c == '/' || c == '\0')
			return ERR_PTR(-EACCES);
	}
2143 2144 2145 2146 2147
	/*
	 * See if the low-level filesystem might want
	 * to use its own hash..
	 */
	if (base->d_flags & DCACHE_OP_HASH) {
2148
		int err = base->d_op->d_hash(base, &this);
2149 2150 2151
		if (err < 0)
			return ERR_PTR(err);
	}
2152

2153 2154 2155 2156
	err = inode_permission(base->d_inode, MAY_EXEC);
	if (err)
		return ERR_PTR(err);

2157
	return __lookup_hash(&this, base, 0);
2158 2159
}

2160 2161
int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
		 struct path *path, int *empty)
L
Linus Torvalds 已提交
2162
{
2163
	struct nameidata nd;
2164
	struct filename *tmp = getname_flags(name, flags, empty);
L
Linus Torvalds 已提交
2165 2166
	int err = PTR_ERR(tmp);
	if (!IS_ERR(tmp)) {
2167 2168 2169

		BUG_ON(flags & LOOKUP_PARENT);

2170
		err = filename_lookup(dfd, tmp, flags, &nd);
L
Linus Torvalds 已提交
2171
		putname(tmp);
2172 2173
		if (!err)
			*path = nd.path;
L
Linus Torvalds 已提交
2174 2175 2176 2177
	}
	return err;
}

2178 2179 2180
int user_path_at(int dfd, const char __user *name, unsigned flags,
		 struct path *path)
{
2181
	return user_path_at_empty(dfd, name, flags, path, NULL);
2182 2183
}

2184 2185 2186 2187 2188 2189
/*
 * NB: most callers don't do anything directly with the reference to the
 *     to struct filename, but the nd->last pointer points into the name string
 *     allocated by getname. So we must hold the reference to it until all
 *     path-walking is complete.
 */
2190
static struct filename *
2191 2192
user_path_parent(int dfd, const char __user *path, struct nameidata *nd,
		 unsigned int flags)
2193
{
2194
	struct filename *s = getname(path);
2195 2196
	int error;

2197 2198 2199
	/* only LOOKUP_REVAL is allowed in extra flags */
	flags &= LOOKUP_REVAL;

2200
	if (IS_ERR(s))
2201
		return s;
2202

2203
	error = filename_lookup(dfd, s, flags | LOOKUP_PARENT, nd);
2204
	if (error) {
2205
		putname(s);
2206 2207
		return ERR_PTR(error);
	}
2208

2209
	return s;
2210 2211
}

2212 2213 2214 2215 2216 2217 2218 2219 2220 2221 2222 2223 2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237 2238 2239 2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253 2254 2255 2256 2257 2258 2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280 2281 2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385 2386 2387 2388 2389 2390 2391 2392 2393
/**
 * umount_lookup_last - look up last component for umount
 * @nd:   pathwalk nameidata - currently pointing at parent directory of "last"
 * @path: pointer to container for result
 *
 * This is a special lookup_last function just for umount. In this case, we
 * need to resolve the path without doing any revalidation.
 *
 * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since
 * mountpoints are always pinned in the dcache, their ancestors are too. Thus,
 * in almost all cases, this lookup will be served out of the dcache. The only
 * cases where it won't are if nd->last refers to a symlink or the path is
 * bogus and it doesn't exist.
 *
 * Returns:
 * -error: if there was an error during lookup. This includes -ENOENT if the
 *         lookup found a negative dentry. The nd->path reference will also be
 *         put in this case.
 *
 * 0:      if we successfully resolved nd->path and found it to not to be a
 *         symlink that needs to be followed. "path" will also be populated.
 *         The nd->path reference will also be put.
 *
 * 1:      if we successfully resolved nd->last and found it to be a symlink
 *         that needs to be followed. "path" will be populated with the path
 *         to the link, and nd->path will *not* be put.
 */
static int
umount_lookup_last(struct nameidata *nd, struct path *path)
{
	int error = 0;
	struct dentry *dentry;
	struct dentry *dir = nd->path.dentry;

	if (unlikely(nd->flags & LOOKUP_RCU)) {
		WARN_ON_ONCE(1);
		error = -ECHILD;
		goto error_check;
	}

	nd->flags &= ~LOOKUP_PARENT;

	if (unlikely(nd->last_type != LAST_NORM)) {
		error = handle_dots(nd, nd->last_type);
		if (!error)
			dentry = dget(nd->path.dentry);
		goto error_check;
	}

	mutex_lock(&dir->d_inode->i_mutex);
	dentry = d_lookup(dir, &nd->last);
	if (!dentry) {
		/*
		 * No cached dentry. Mounted dentries are pinned in the cache,
		 * so that means that this dentry is probably a symlink or the
		 * path doesn't actually point to a mounted dentry.
		 */
		dentry = d_alloc(dir, &nd->last);
		if (!dentry) {
			error = -ENOMEM;
		} else {
			dentry = lookup_real(dir->d_inode, dentry, nd->flags);
			if (IS_ERR(dentry))
				error = PTR_ERR(dentry);
		}
	}
	mutex_unlock(&dir->d_inode->i_mutex);

error_check:
	if (!error) {
		if (!dentry->d_inode) {
			error = -ENOENT;
			dput(dentry);
		} else {
			path->dentry = dentry;
			path->mnt = mntget(nd->path.mnt);
			if (should_follow_link(dentry->d_inode,
						nd->flags & LOOKUP_FOLLOW))
				return 1;
			follow_mount(path);
		}
	}
	terminate_walk(nd);
	return error;
}

/**
 * path_umountat - look up a path to be umounted
 * @dfd:	directory file descriptor to start walk from
 * @name:	full pathname to walk
 * @flags:	lookup flags
 * @nd:		pathwalk nameidata
 *
 * Look up the given name, but don't attempt to revalidate the last component.
 * Returns 0 and "path" will be valid on success; Retuns error otherwise.
 */
static int
path_umountat(int dfd, const char *name, struct path *path, unsigned int flags)
{
	struct file *base = NULL;
	struct nameidata nd;
	int err;

	err = path_init(dfd, name, flags | LOOKUP_PARENT, &nd, &base);
	if (unlikely(err))
		return err;

	current->total_link_count = 0;
	err = link_path_walk(name, &nd);
	if (err)
		goto out;

	/* If we're in rcuwalk, drop out of it to handle last component */
	if (nd.flags & LOOKUP_RCU) {
		err = unlazy_walk(&nd, NULL);
		if (err) {
			terminate_walk(&nd);
			goto out;
		}
	}

	err = umount_lookup_last(&nd, path);
	while (err > 0) {
		void *cookie;
		struct path link = *path;
		err = may_follow_link(&link, &nd);
		if (unlikely(err))
			break;
		nd.flags |= LOOKUP_PARENT;
		err = follow_link(&link, &nd, &cookie);
		if (err)
			break;
		err = umount_lookup_last(&nd, path);
		put_link(&nd, &link, cookie);
	}
out:
	if (base)
		fput(base);

	if (nd.root.mnt && !(nd.flags & LOOKUP_ROOT))
		path_put(&nd.root);

	return err;
}

/**
 * user_path_umountat - lookup a path from userland in order to umount it
 * @dfd:	directory file descriptor
 * @name:	pathname from userland
 * @flags:	lookup flags
 * @path:	pointer to container to hold result
 *
 * A umount is a special case for path walking. We're not actually interested
 * in the inode in this situation, and ESTALE errors can be a problem. We
 * simply want track down the dentry and vfsmount attached at the mountpoint
 * and avoid revalidating the last component.
 *
 * Returns 0 and populates "path" on success.
 */
int
user_path_umountat(int dfd, const char __user *name, unsigned int flags,
			struct path *path)
{
	struct filename *s = getname(name);
	int error;

	if (IS_ERR(s))
		return PTR_ERR(s);

	error = path_umountat(dfd, s->name, path, flags | LOOKUP_RCU);
	if (unlikely(error == -ECHILD))
		error = path_umountat(dfd, s->name, path, flags);
	if (unlikely(error == -ESTALE))
		error = path_umountat(dfd, s->name, path, flags | LOOKUP_REVAL);

	if (likely(!error))
		audit_inode(s, path->dentry, 0);

	putname(s);
	return error;
}

L
Linus Torvalds 已提交
2394 2395 2396 2397 2398 2399
/*
 * It's inline, so penalty for filesystems that don't use sticky bit is
 * minimal.
 */
static inline int check_sticky(struct inode *dir, struct inode *inode)
{
2400
	kuid_t fsuid = current_fsuid();
2401

L
Linus Torvalds 已提交
2402 2403
	if (!(dir->i_mode & S_ISVTX))
		return 0;
2404
	if (uid_eq(inode->i_uid, fsuid))
L
Linus Torvalds 已提交
2405
		return 0;
2406
	if (uid_eq(dir->i_uid, fsuid))
L
Linus Torvalds 已提交
2407
		return 0;
2408
	return !inode_capable(inode, CAP_FOWNER);
L
Linus Torvalds 已提交
2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429
}

/*
 *	Check whether we can remove a link victim from directory dir, check
 *  whether the type of victim is right.
 *  1. We can't do it if dir is read-only (done in permission())
 *  2. We should have write and exec permissions on dir
 *  3. We can't remove anything from append-only dir
 *  4. We can't do anything with immutable dir (done in permission())
 *  5. If the sticky bit on dir is set we should either
 *	a. be owner of dir, or
 *	b. be owner of victim, or
 *	c. have CAP_FOWNER capability
 *  6. If the victim is append-only or immutable we can't do antyhing with
 *     links pointing to it.
 *  7. If we were asked to remove a directory and victim isn't one - ENOTDIR.
 *  8. If we were asked to remove a non-directory and victim isn't one - EISDIR.
 *  9. We can't remove a root or mountpoint.
 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by
 *     nfs_async_unlink().
 */
2430
static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
L
Linus Torvalds 已提交
2431 2432 2433 2434 2435 2436 2437
{
	int error;

	if (!victim->d_inode)
		return -ENOENT;

	BUG_ON(victim->d_parent->d_inode != dir);
2438
	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
L
Linus Torvalds 已提交
2439

2440
	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
2441 2442 2443 2444 2445
	if (error)
		return error;
	if (IS_APPEND(dir))
		return -EPERM;
	if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
H
Hugh Dickins 已提交
2446
	    IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
L
Linus Torvalds 已提交
2447 2448 2449 2450 2451 2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469
		return -EPERM;
	if (isdir) {
		if (!S_ISDIR(victim->d_inode->i_mode))
			return -ENOTDIR;
		if (IS_ROOT(victim))
			return -EBUSY;
	} else if (S_ISDIR(victim->d_inode->i_mode))
		return -EISDIR;
	if (IS_DEADDIR(dir))
		return -ENOENT;
	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
		return -EBUSY;
	return 0;
}

/*	Check whether we can create an object with dentry child in directory
 *  dir.
 *  1. We can't do it if child already exists (open has special treatment for
 *     this case, but since we are inlined it's OK)
 *  2. We can't do it if dir is read-only (done in permission())
 *  3. We should have write and exec permissions on dir
 *  4. We can't do it if dir is immutable (done in permission())
 */
2470
static inline int may_create(struct inode *dir, struct dentry *child)
L
Linus Torvalds 已提交
2471 2472 2473 2474 2475
{
	if (child->d_inode)
		return -EEXIST;
	if (IS_DEADDIR(dir))
		return -ENOENT;
2476
	return inode_permission(dir, MAY_WRITE | MAY_EXEC);
L
Linus Torvalds 已提交
2477 2478 2479 2480 2481 2482 2483 2484 2485 2486
}

/*
 * p1 and p2 should be directories on the same fs.
 */
struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
{
	struct dentry *p;

	if (p1 == p2) {
I
Ingo Molnar 已提交
2487
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
L
Linus Torvalds 已提交
2488 2489 2490
		return NULL;
	}

2491
	mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
2492

2493 2494 2495 2496 2497
	p = d_ancestor(p2, p1);
	if (p) {
		mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT);
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD);
		return p;
L
Linus Torvalds 已提交
2498 2499
	}

2500 2501 2502 2503 2504
	p = d_ancestor(p1, p2);
	if (p) {
		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
		mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
		return p;
L
Linus Torvalds 已提交
2505 2506
	}

I
Ingo Molnar 已提交
2507 2508
	mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
	mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
L
Linus Torvalds 已提交
2509 2510 2511 2512 2513
	return NULL;
}

void unlock_rename(struct dentry *p1, struct dentry *p2)
{
2514
	mutex_unlock(&p1->d_inode->i_mutex);
L
Linus Torvalds 已提交
2515
	if (p1 != p2) {
2516
		mutex_unlock(&p2->d_inode->i_mutex);
2517
		mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
L
Linus Torvalds 已提交
2518 2519 2520
	}
}

A
Al Viro 已提交
2521
int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
A
Al Viro 已提交
2522
		bool want_excl)
L
Linus Torvalds 已提交
2523
{
2524
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
2525 2526 2527
	if (error)
		return error;

A
Al Viro 已提交
2528
	if (!dir->i_op->create)
L
Linus Torvalds 已提交
2529 2530 2531 2532 2533 2534
		return -EACCES;	/* shouldn't it be ENOSYS? */
	mode &= S_IALLUGO;
	mode |= S_IFREG;
	error = security_inode_create(dir, dentry, mode);
	if (error)
		return error;
A
Al Viro 已提交
2535
	error = dir->i_op->create(dir, dentry, mode, want_excl);
2536
	if (!error)
2537
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
2538 2539 2540
	return error;
}

A
Al Viro 已提交
2541
static int may_open(struct path *path, int acc_mode, int flag)
L
Linus Torvalds 已提交
2542
{
2543
	struct dentry *dentry = path->dentry;
L
Linus Torvalds 已提交
2544 2545 2546
	struct inode *inode = dentry->d_inode;
	int error;

A
Al Viro 已提交
2547 2548 2549 2550
	/* O_PATH? */
	if (!acc_mode)
		return 0;

L
Linus Torvalds 已提交
2551 2552 2553
	if (!inode)
		return -ENOENT;

C
Christoph Hellwig 已提交
2554 2555
	switch (inode->i_mode & S_IFMT) {
	case S_IFLNK:
L
Linus Torvalds 已提交
2556
		return -ELOOP;
C
Christoph Hellwig 已提交
2557 2558 2559 2560 2561 2562
	case S_IFDIR:
		if (acc_mode & MAY_WRITE)
			return -EISDIR;
		break;
	case S_IFBLK:
	case S_IFCHR:
2563
		if (path->mnt->mnt_flags & MNT_NODEV)
L
Linus Torvalds 已提交
2564
			return -EACCES;
C
Christoph Hellwig 已提交
2565 2566 2567
		/*FALLTHRU*/
	case S_IFIFO:
	case S_IFSOCK:
L
Linus Torvalds 已提交
2568
		flag &= ~O_TRUNC;
C
Christoph Hellwig 已提交
2569
		break;
2570
	}
2571

2572
	error = inode_permission(inode, acc_mode);
2573 2574
	if (error)
		return error;
M
Mimi Zohar 已提交
2575

L
Linus Torvalds 已提交
2576 2577 2578 2579
	/*
	 * An append-only file must be opened in append mode for writing.
	 */
	if (IS_APPEND(inode)) {
2580
		if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
2581
			return -EPERM;
L
Linus Torvalds 已提交
2582
		if (flag & O_TRUNC)
2583
			return -EPERM;
L
Linus Torvalds 已提交
2584 2585 2586
	}

	/* O_NOATIME can only be set by the owner or superuser */
2587
	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
2588
		return -EPERM;
L
Linus Torvalds 已提交
2589

2590
	return 0;
2591
}
L
Linus Torvalds 已提交
2592

2593
static int handle_truncate(struct file *filp)
2594
{
2595
	struct path *path = &filp->f_path;
2596 2597 2598 2599 2600 2601 2602 2603 2604
	struct inode *inode = path->dentry->d_inode;
	int error = get_write_access(inode);
	if (error)
		return error;
	/*
	 * Refuse to truncate files with mandatory locks held on them.
	 */
	error = locks_verify_locked(inode);
	if (!error)
2605
		error = security_path_truncate(path);
2606 2607 2608
	if (!error) {
		error = do_truncate(path->dentry, 0,
				    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
2609
				    filp);
2610 2611
	}
	put_write_access(inode);
M
Mimi Zohar 已提交
2612
	return error;
L
Linus Torvalds 已提交
2613 2614
}

2615 2616
static inline int open_to_namei_flags(int flag)
{
2617 2618
	if ((flag & O_ACCMODE) == 3)
		flag--;
2619 2620 2621
	return flag;
}

M
Miklos Szeredi 已提交
2622 2623 2624 2625 2626 2627 2628 2629 2630 2631 2632 2633 2634
static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode)
{
	int error = security_path_mknod(dir, dentry, mode, 0);
	if (error)
		return error;

	error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
	if (error)
		return error;

	return security_inode_create(dir->dentry->d_inode, dentry, mode);
}

2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647
/*
 * Attempt to atomically look up, create and open a file from a negative
 * dentry.
 *
 * Returns 0 if successful.  The file will have been created and attached to
 * @file by the filesystem calling finish_open().
 *
 * Returns 1 if the file was looked up only or didn't need creating.  The
 * caller will need to perform the open themselves.  @path will have been
 * updated to point to the new dentry.  This may be negative.
 *
 * Returns an error code otherwise.
 */
2648 2649 2650
static int atomic_open(struct nameidata *nd, struct dentry *dentry,
			struct path *path, struct file *file,
			const struct open_flags *op,
2651
			bool got_write, bool need_lookup,
2652
			int *opened)
M
Miklos Szeredi 已提交
2653 2654 2655 2656 2657 2658 2659 2660 2661 2662 2663 2664 2665
{
	struct inode *dir =  nd->path.dentry->d_inode;
	unsigned open_flag = open_to_namei_flags(op->open_flag);
	umode_t mode;
	int error;
	int acc_mode;
	int create_error = 0;
	struct dentry *const DENTRY_NOT_SET = (void *) -1UL;

	BUG_ON(dentry->d_inode);

	/* Don't create child dentry for a dead directory. */
	if (unlikely(IS_DEADDIR(dir))) {
2666
		error = -ENOENT;
M
Miklos Szeredi 已提交
2667 2668 2669
		goto out;
	}

2670
	mode = op->mode;
M
Miklos Szeredi 已提交
2671 2672 2673
	if ((open_flag & O_CREAT) && !IS_POSIXACL(dir))
		mode &= ~current_umask();

A
Al Viro 已提交
2674
	if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT)) {
M
Miklos Szeredi 已提交
2675
		open_flag &= ~O_TRUNC;
2676
		*opened |= FILE_CREATED;
M
Miklos Szeredi 已提交
2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687
	}

	/*
	 * Checking write permission is tricky, bacuse we don't know if we are
	 * going to actually need it: O_CREAT opens should work as long as the
	 * file exists.  But checking existence breaks atomicity.  The trick is
	 * to check access and if not granted clear O_CREAT from the flags.
	 *
	 * Another problem is returing the "right" error value (e.g. for an
	 * O_EXCL open we want to return EEXIST not EROFS).
	 */
2688 2689 2690
	if (((open_flag & (O_CREAT | O_TRUNC)) ||
	    (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) {
		if (!(open_flag & O_CREAT)) {
M
Miklos Szeredi 已提交
2691 2692 2693 2694 2695 2696 2697
			/*
			 * No O_CREATE -> atomicity not a requirement -> fall
			 * back to lookup + open
			 */
			goto no_open;
		} else if (open_flag & (O_EXCL | O_TRUNC)) {
			/* Fall back and fail with the right error */
2698
			create_error = -EROFS;
M
Miklos Szeredi 已提交
2699 2700 2701
			goto no_open;
		} else {
			/* No side effects, safe to clear O_CREAT */
2702
			create_error = -EROFS;
M
Miklos Szeredi 已提交
2703 2704 2705 2706 2707
			open_flag &= ~O_CREAT;
		}
	}

	if (open_flag & O_CREAT) {
2708
		error = may_o_create(&nd->path, dentry, mode);
M
Miklos Szeredi 已提交
2709 2710 2711 2712 2713 2714 2715 2716 2717 2718 2719
		if (error) {
			create_error = error;
			if (open_flag & O_EXCL)
				goto no_open;
			open_flag &= ~O_CREAT;
		}
	}

	if (nd->flags & LOOKUP_DIRECTORY)
		open_flag |= O_DIRECTORY;

A
Al Viro 已提交
2720 2721 2722
	file->f_path.dentry = DENTRY_NOT_SET;
	file->f_path.mnt = nd->path.mnt;
	error = dir->i_op->atomic_open(dir, dentry, file, open_flag, mode,
2723
				      opened);
A
Al Viro 已提交
2724 2725 2726
	if (error < 0) {
		if (create_error && error == -ENOENT)
			error = create_error;
M
Miklos Szeredi 已提交
2727 2728 2729 2730
		goto out;
	}

	acc_mode = op->acc_mode;
2731
	if (*opened & FILE_CREATED) {
M
Miklos Szeredi 已提交
2732 2733 2734 2735
		fsnotify_create(dir, dentry);
		acc_mode = MAY_OPEN;
	}

A
Al Viro 已提交
2736
	if (error) {	/* returned 1, that is */
A
Al Viro 已提交
2737
		if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
2738
			error = -EIO;
M
Miklos Szeredi 已提交
2739 2740
			goto out;
		}
A
Al Viro 已提交
2741
		if (file->f_path.dentry) {
M
Miklos Szeredi 已提交
2742
			dput(dentry);
A
Al Viro 已提交
2743
			dentry = file->f_path.dentry;
M
Miklos Szeredi 已提交
2744
		}
2745 2746 2747 2748
		if (create_error && dentry->d_inode == NULL) {
			error = create_error;
			goto out;
		}
M
Miklos Szeredi 已提交
2749 2750 2751 2752 2753 2754 2755
		goto looked_up;
	}

	/*
	 * We didn't have the inode before the open, so check open permission
	 * here.
	 */
2756 2757 2758
	error = may_open(&file->f_path, acc_mode, open_flag);
	if (error)
		fput(file);
M
Miklos Szeredi 已提交
2759 2760 2761

out:
	dput(dentry);
2762
	return error;
M
Miklos Szeredi 已提交
2763 2764 2765

no_open:
	if (need_lookup) {
2766
		dentry = lookup_real(dir, dentry, nd->flags);
M
Miklos Szeredi 已提交
2767
		if (IS_ERR(dentry))
2768
			return PTR_ERR(dentry);
M
Miklos Szeredi 已提交
2769 2770 2771 2772

		if (create_error) {
			int open_flag = op->open_flag;

2773
			error = create_error;
M
Miklos Szeredi 已提交
2774 2775 2776 2777 2778 2779 2780 2781 2782 2783 2784 2785 2786 2787 2788
			if ((open_flag & O_EXCL)) {
				if (!dentry->d_inode)
					goto out;
			} else if (!dentry->d_inode) {
				goto out;
			} else if ((open_flag & O_TRUNC) &&
				   S_ISREG(dentry->d_inode->i_mode)) {
				goto out;
			}
			/* will fail later, go on to get the right error */
		}
	}
looked_up:
	path->dentry = dentry;
	path->mnt = nd->path.mnt;
2789
	return 1;
M
Miklos Szeredi 已提交
2790 2791
}

M
Miklos Szeredi 已提交
2792
/*
2793
 * Look up and maybe create and open the last component.
M
Miklos Szeredi 已提交
2794 2795 2796
 *
 * Must be called with i_mutex held on parent.
 *
2797 2798 2799 2800 2801 2802 2803 2804 2805 2806 2807 2808
 * Returns 0 if the file was successfully atomically created (if necessary) and
 * opened.  In this case the file will be returned attached to @file.
 *
 * Returns 1 if the file was not completely opened at this time, though lookups
 * and creations will have been performed and the dentry returned in @path will
 * be positive upon return if O_CREAT was specified.  If O_CREAT wasn't
 * specified then a negative dentry may be returned.
 *
 * An error code is returned otherwise.
 *
 * FILE_CREATE will be set in @*opened if the dentry was created and will be
 * cleared otherwise prior to returning.
M
Miklos Szeredi 已提交
2809
 */
2810 2811 2812
static int lookup_open(struct nameidata *nd, struct path *path,
			struct file *file,
			const struct open_flags *op,
2813
			bool got_write, int *opened)
M
Miklos Szeredi 已提交
2814 2815
{
	struct dentry *dir = nd->path.dentry;
2816
	struct inode *dir_inode = dir->d_inode;
M
Miklos Szeredi 已提交
2817 2818
	struct dentry *dentry;
	int error;
2819
	bool need_lookup;
M
Miklos Szeredi 已提交
2820

2821
	*opened &= ~FILE_CREATED;
2822
	dentry = lookup_dcache(&nd->last, dir, nd->flags, &need_lookup);
M
Miklos Szeredi 已提交
2823
	if (IS_ERR(dentry))
2824
		return PTR_ERR(dentry);
M
Miklos Szeredi 已提交
2825

M
Miklos Szeredi 已提交
2826 2827 2828 2829 2830
	/* Cached positive dentry: will open in f_op->open */
	if (!need_lookup && dentry->d_inode)
		goto out_no_open;

	if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) {
2831
		return atomic_open(nd, dentry, path, file, op, got_write,
2832
				   need_lookup, opened);
M
Miklos Szeredi 已提交
2833 2834
	}

2835 2836 2837
	if (need_lookup) {
		BUG_ON(dentry->d_inode);

2838
		dentry = lookup_real(dir_inode, dentry, nd->flags);
2839
		if (IS_ERR(dentry))
2840
			return PTR_ERR(dentry);
2841 2842
	}

M
Miklos Szeredi 已提交
2843 2844 2845 2846 2847 2848 2849 2850 2851 2852
	/* Negative dentry, just create the file */
	if (!dentry->d_inode && (op->open_flag & O_CREAT)) {
		umode_t mode = op->mode;
		if (!IS_POSIXACL(dir->d_inode))
			mode &= ~current_umask();
		/*
		 * This write is needed to ensure that a
		 * rw->ro transition does not occur between
		 * the time when the file is created and when
		 * a permanent write count is taken through
2853
		 * the 'struct file' in finish_open().
M
Miklos Szeredi 已提交
2854
		 */
2855 2856
		if (!got_write) {
			error = -EROFS;
M
Miklos Szeredi 已提交
2857
			goto out_dput;
2858
		}
2859
		*opened |= FILE_CREATED;
M
Miklos Szeredi 已提交
2860 2861 2862
		error = security_path_mknod(&nd->path, dentry, mode, 0);
		if (error)
			goto out_dput;
A
Al Viro 已提交
2863 2864
		error = vfs_create(dir->d_inode, dentry, mode,
				   nd->flags & LOOKUP_EXCL);
M
Miklos Szeredi 已提交
2865 2866 2867
		if (error)
			goto out_dput;
	}
M
Miklos Szeredi 已提交
2868
out_no_open:
M
Miklos Szeredi 已提交
2869 2870
	path->dentry = dentry;
	path->mnt = nd->path.mnt;
2871
	return 1;
M
Miklos Szeredi 已提交
2872 2873 2874

out_dput:
	dput(dentry);
2875
	return error;
M
Miklos Szeredi 已提交
2876 2877
}

N
Nick Piggin 已提交
2878
/*
2879
 * Handle the last step of open()
N
Nick Piggin 已提交
2880
 */
2881 2882
static int do_last(struct nameidata *nd, struct path *path,
		   struct file *file, const struct open_flags *op,
2883
		   int *opened, struct filename *name)
2884
{
2885
	struct dentry *dir = nd->path.dentry;
2886
	int open_flag = op->open_flag;
M
Miklos Szeredi 已提交
2887
	bool will_truncate = (open_flag & O_TRUNC) != 0;
2888
	bool got_write = false;
A
Al Viro 已提交
2889
	int acc_mode = op->acc_mode;
2890
	struct inode *inode;
M
Miklos Szeredi 已提交
2891
	bool symlink_ok = false;
2892 2893
	struct path save_parent = { .dentry = NULL, .mnt = NULL };
	bool retried = false;
A
Al Viro 已提交
2894
	int error;
2895

2896 2897 2898
	nd->flags &= ~LOOKUP_PARENT;
	nd->flags |= op->intent;

2899
	if (nd->last_type != LAST_NORM) {
2900 2901
		error = handle_dots(nd, nd->last_type);
		if (error)
2902
			return error;
M
Miklos Szeredi 已提交
2903
		goto finish_open;
2904
	}
2905

2906
	if (!(open_flag & O_CREAT)) {
2907 2908
		if (nd->last.name[nd->last.len])
			nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
A
Al Viro 已提交
2909
		if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW))
M
Miklos Szeredi 已提交
2910
			symlink_ok = true;
2911
		/* we _can_ be in RCU mode here */
A
Al Viro 已提交
2912
		error = lookup_fast(nd, path, &inode);
2913 2914 2915 2916
		if (likely(!error))
			goto finish_lookup;

		if (error < 0)
2917
			goto out;
2918 2919

		BUG_ON(nd->inode != dir->d_inode);
2920 2921 2922 2923 2924 2925 2926 2927 2928
	} else {
		/* create side of things */
		/*
		 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED
		 * has been cleared when we got to the last component we are
		 * about to look up
		 */
		error = complete_walk(nd);
		if (error)
2929
			return error;
2930

2931
		audit_inode(name, dir, LOOKUP_PARENT);
2932 2933 2934
		error = -EISDIR;
		/* trailing slashes? */
		if (nd->last.name[nd->last.len])
2935
			goto out;
2936
	}
A
Al Viro 已提交
2937

2938
retry_lookup:
2939 2940 2941 2942 2943 2944 2945 2946 2947 2948
	if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
		error = mnt_want_write(nd->path.mnt);
		if (!error)
			got_write = true;
		/*
		 * do _not_ fail yet - we might not need that or fail with
		 * a different error; let lookup_open() decide; we'll be
		 * dropping this one anyway.
		 */
	}
2949
	mutex_lock(&dir->d_inode->i_mutex);
2950
	error = lookup_open(nd, path, file, op, got_write, opened);
M
Miklos Szeredi 已提交
2951
	mutex_unlock(&dir->d_inode->i_mutex);
2952

2953 2954
	if (error <= 0) {
		if (error)
M
Miklos Szeredi 已提交
2955 2956
			goto out;

2957
		if ((*opened & FILE_CREATED) ||
A
Al Viro 已提交
2958
		    !S_ISREG(file_inode(file)->i_mode))
M
Miklos Szeredi 已提交
2959
			will_truncate = false;
M
Miklos Szeredi 已提交
2960

2961
		audit_inode(name, file->f_path.dentry, 0);
M
Miklos Szeredi 已提交
2962 2963
		goto opened;
	}
2964

2965
	if (*opened & FILE_CREATED) {
2966
		/* Don't check for write permission, don't truncate */
2967
		open_flag &= ~O_TRUNC;
M
Miklos Szeredi 已提交
2968
		will_truncate = false;
A
Al Viro 已提交
2969
		acc_mode = MAY_OPEN;
M
Miklos Szeredi 已提交
2970
		path_to_nameidata(path, nd);
M
Miklos Szeredi 已提交
2971
		goto finish_open_created;
2972 2973 2974
	}

	/*
2975
	 * create/update audit record if it already exists.
2976
	 */
2977
	if (path->dentry->d_inode)
2978
		audit_inode(name, path->dentry, 0);
2979

M
Miklos Szeredi 已提交
2980 2981 2982 2983 2984
	/*
	 * If atomic_open() acquired write access it is dropped now due to
	 * possible mount and symlink following (this might be optimized away if
	 * necessary...)
	 */
2985
	if (got_write) {
M
Miklos Szeredi 已提交
2986
		mnt_drop_write(nd->path.mnt);
2987
		got_write = false;
M
Miklos Szeredi 已提交
2988 2989
	}

2990
	error = -EEXIST;
A
Al Viro 已提交
2991
	if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))
2992 2993
		goto exit_dput;

2994 2995 2996
	error = follow_managed(path, nd->flags);
	if (error < 0)
		goto exit_dput;
2997

2998 2999 3000
	if (error)
		nd->flags |= LOOKUP_JUMPED;

3001 3002
	BUG_ON(nd->flags & LOOKUP_RCU);
	inode = path->dentry->d_inode;
3003 3004
finish_lookup:
	/* we _can_ be in RCU mode here */
3005
	error = -ENOENT;
3006 3007
	if (!inode) {
		path_to_nameidata(path, nd);
3008
		goto out;
3009
	}
A
Al Viro 已提交
3010

3011 3012 3013 3014
	if (should_follow_link(inode, !symlink_ok)) {
		if (nd->flags & LOOKUP_RCU) {
			if (unlikely(unlazy_walk(nd, path->dentry))) {
				error = -ECHILD;
3015
				goto out;
3016 3017 3018
			}
		}
		BUG_ON(inode != path->dentry->d_inode);
3019
		return 1;
3020
	}
3021

3022 3023 3024 3025 3026 3027 3028 3029
	if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path->mnt) {
		path_to_nameidata(path, nd);
	} else {
		save_parent.dentry = nd->path.dentry;
		save_parent.mnt = mntget(path->mnt);
		nd->path.dentry = path->dentry;

	}
3030
	nd->inode = inode;
3031
	/* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
3032
finish_open:
3033
	error = complete_walk(nd);
3034 3035
	if (error) {
		path_put(&save_parent);
3036
		return error;
3037
	}
3038
	audit_inode(name, nd->path.dentry, 0);
3039
	error = -EISDIR;
3040
	if ((open_flag & O_CREAT) && S_ISDIR(nd->inode->i_mode))
3041
		goto out;
3042
	error = -ENOTDIR;
3043
	if ((nd->flags & LOOKUP_DIRECTORY) && !can_lookup(nd->inode))
3044
		goto out;
3045
	if (!S_ISREG(nd->inode->i_mode))
M
Miklos Szeredi 已提交
3046
		will_truncate = false;
3047

3048 3049 3050
	if (will_truncate) {
		error = mnt_want_write(nd->path.mnt);
		if (error)
3051
			goto out;
3052
		got_write = true;
3053
	}
M
Miklos Szeredi 已提交
3054
finish_open_created:
A
Al Viro 已提交
3055
	error = may_open(&nd->path, acc_mode, open_flag);
3056
	if (error)
3057
		goto out;
A
Al Viro 已提交
3058 3059 3060 3061
	file->f_path.mnt = nd->path.mnt;
	error = finish_open(file, nd->path.dentry, NULL, opened);
	if (error) {
		if (error == -EOPENSTALE)
M
Miklos Szeredi 已提交
3062
			goto stale_open;
3063
		goto out;
M
Miklos Szeredi 已提交
3064
	}
3065
opened:
3066
	error = open_check_o_direct(file);
3067 3068
	if (error)
		goto exit_fput;
3069
	error = ima_file_check(file, op->acc_mode);
3070 3071 3072 3073
	if (error)
		goto exit_fput;

	if (will_truncate) {
3074
		error = handle_truncate(file);
3075 3076
		if (error)
			goto exit_fput;
3077
	}
3078
out:
3079
	if (got_write)
3080
		mnt_drop_write(nd->path.mnt);
3081
	path_put(&save_parent);
3082
	terminate_walk(nd);
3083
	return error;
3084 3085 3086

exit_dput:
	path_put_conditional(path, nd);
3087
	goto out;
3088
exit_fput:
3089 3090
	fput(file);
	goto out;
3091

M
Miklos Szeredi 已提交
3092 3093 3094 3095 3096 3097 3098 3099 3100 3101 3102
stale_open:
	/* If no saved parent or already retried then can't retry */
	if (!save_parent.dentry || retried)
		goto out;

	BUG_ON(save_parent.dentry != dir);
	path_put(&nd->path);
	nd->path = save_parent;
	nd->inode = dir->d_inode;
	save_parent.mnt = NULL;
	save_parent.dentry = NULL;
3103
	if (got_write) {
M
Miklos Szeredi 已提交
3104
		mnt_drop_write(nd->path.mnt);
3105
		got_write = false;
M
Miklos Szeredi 已提交
3106 3107 3108
	}
	retried = true;
	goto retry_lookup;
3109 3110
}

3111 3112 3113 3114 3115 3116 3117 3118 3119 3120 3121 3122 3123 3124 3125 3126 3127 3128 3129 3130 3131 3132 3133 3134 3135 3136 3137 3138 3139 3140 3141 3142 3143 3144 3145 3146 3147 3148 3149 3150 3151 3152 3153 3154 3155 3156
static int do_tmpfile(int dfd, struct filename *pathname,
		struct nameidata *nd, int flags,
		const struct open_flags *op,
		struct file *file, int *opened)
{
	static const struct qstr name = QSTR_INIT("/", 1);
	struct dentry *dentry, *child;
	struct inode *dir;
	int error = path_lookupat(dfd, pathname->name,
				  flags | LOOKUP_DIRECTORY, nd);
	if (unlikely(error))
		return error;
	error = mnt_want_write(nd->path.mnt);
	if (unlikely(error))
		goto out;
	/* we want directory to be writable */
	error = inode_permission(nd->inode, MAY_WRITE | MAY_EXEC);
	if (error)
		goto out2;
	dentry = nd->path.dentry;
	dir = dentry->d_inode;
	if (!dir->i_op->tmpfile) {
		error = -EOPNOTSUPP;
		goto out2;
	}
	child = d_alloc(dentry, &name);
	if (unlikely(!child)) {
		error = -ENOMEM;
		goto out2;
	}
	nd->flags &= ~LOOKUP_DIRECTORY;
	nd->flags |= op->intent;
	dput(nd->path.dentry);
	nd->path.dentry = child;
	error = dir->i_op->tmpfile(dir, nd->path.dentry, op->mode);
	if (error)
		goto out2;
	audit_inode(pathname, nd->path.dentry, 0);
	error = may_open(&nd->path, op->acc_mode, op->open_flag);
	if (error)
		goto out2;
	file->f_path.mnt = nd->path.mnt;
	error = finish_open(file, nd->path.dentry, NULL, opened);
	if (error)
		goto out2;
	error = open_check_o_direct(file);
3157
	if (error) {
3158
		fput(file);
3159 3160 3161 3162 3163 3164
	} else if (!(op->open_flag & O_EXCL)) {
		struct inode *inode = file_inode(file);
		spin_lock(&inode->i_lock);
		inode->i_state |= I_LINKABLE;
		spin_unlock(&inode->i_lock);
	}
3165 3166 3167 3168 3169 3170 3171
out2:
	mnt_drop_write(nd->path.mnt);
out:
	path_put(&nd->path);
	return error;
}

3172
static struct file *path_openat(int dfd, struct filename *pathname,
A
Al Viro 已提交
3173
		struct nameidata *nd, const struct open_flags *op, int flags)
L
Linus Torvalds 已提交
3174
{
3175
	struct file *base = NULL;
A
Al Viro 已提交
3176
	struct file *file;
3177
	struct path path;
3178
	int opened = 0;
3179
	int error;
N
Nick Piggin 已提交
3180

A
Al Viro 已提交
3181
	file = get_empty_filp();
3182 3183
	if (IS_ERR(file))
		return file;
N
Nick Piggin 已提交
3184

A
Al Viro 已提交
3185
	file->f_flags = op->open_flag;
N
Nick Piggin 已提交
3186

A
Al Viro 已提交
3187
	if (unlikely(file->f_flags & __O_TMPFILE)) {
3188 3189 3190 3191
		error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened);
		goto out;
	}

3192
	error = path_init(dfd, pathname->name, flags | LOOKUP_PARENT, nd, &base);
N
Nick Piggin 已提交
3193
	if (unlikely(error))
3194
		goto out;
N
Nick Piggin 已提交
3195

3196
	current->total_link_count = 0;
3197
	error = link_path_walk(pathname->name, nd);
N
Nick Piggin 已提交
3198
	if (unlikely(error))
3199
		goto out;
L
Linus Torvalds 已提交
3200

3201 3202
	error = do_last(nd, &path, file, op, &opened, pathname);
	while (unlikely(error > 0)) { /* trailing symlink */
3203
		struct path link = path;
A
Al Viro 已提交
3204
		void *cookie;
3205
		if (!(nd->flags & LOOKUP_FOLLOW)) {
A
Al Viro 已提交
3206 3207
			path_put_conditional(&path, nd);
			path_put(&nd->path);
3208
			error = -ELOOP;
3209 3210
			break;
		}
K
Kees Cook 已提交
3211 3212 3213
		error = may_follow_link(&link, nd);
		if (unlikely(error))
			break;
A
Al Viro 已提交
3214 3215
		nd->flags |= LOOKUP_PARENT;
		nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3216
		error = follow_link(&link, nd, &cookie);
3217
		if (unlikely(error))
3218 3219
			break;
		error = do_last(nd, &path, file, op, &opened, pathname);
3220
		put_link(nd, &link, cookie);
3221
	}
A
Al Viro 已提交
3222
out:
A
Al Viro 已提交
3223 3224
	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT))
		path_put(&nd->root);
3225 3226
	if (base)
		fput(base);
3227 3228
	if (!(opened & FILE_OPENED)) {
		BUG_ON(!error);
A
Al Viro 已提交
3229
		put_filp(file);
3230
	}
3231 3232 3233 3234 3235 3236 3237 3238 3239 3240
	if (unlikely(error)) {
		if (error == -EOPENSTALE) {
			if (flags & LOOKUP_RCU)
				error = -ECHILD;
			else
				error = -ESTALE;
		}
		file = ERR_PTR(error);
	}
	return file;
L
Linus Torvalds 已提交
3241 3242
}

3243
struct file *do_filp_open(int dfd, struct filename *pathname,
3244
		const struct open_flags *op)
3245
{
A
Al Viro 已提交
3246
	struct nameidata nd;
3247
	int flags = op->lookup_flags;
3248 3249
	struct file *filp;

A
Al Viro 已提交
3250
	filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU);
3251
	if (unlikely(filp == ERR_PTR(-ECHILD)))
A
Al Viro 已提交
3252
		filp = path_openat(dfd, pathname, &nd, op, flags);
3253
	if (unlikely(filp == ERR_PTR(-ESTALE)))
A
Al Viro 已提交
3254
		filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL);
3255 3256 3257
	return filp;
}

A
Al Viro 已提交
3258
struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
3259
		const char *name, const struct open_flags *op)
A
Al Viro 已提交
3260 3261 3262
{
	struct nameidata nd;
	struct file *file;
3263
	struct filename filename = { .name = name };
3264
	int flags = op->lookup_flags | LOOKUP_ROOT;
A
Al Viro 已提交
3265 3266 3267 3268

	nd.root.mnt = mnt;
	nd.root.dentry = dentry;

A
Al Viro 已提交
3269
	if (dentry->d_inode->i_op->follow_link && op->intent & LOOKUP_OPEN)
A
Al Viro 已提交
3270 3271
		return ERR_PTR(-ELOOP);

3272
	file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_RCU);
A
Al Viro 已提交
3273
	if (unlikely(file == ERR_PTR(-ECHILD)))
3274
		file = path_openat(-1, &filename, &nd, op, flags);
A
Al Viro 已提交
3275
	if (unlikely(file == ERR_PTR(-ESTALE)))
3276
		file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_REVAL);
A
Al Viro 已提交
3277 3278 3279
	return file;
}

3280 3281
struct dentry *kern_path_create(int dfd, const char *pathname,
				struct path *path, unsigned int lookup_flags)
L
Linus Torvalds 已提交
3282
{
3283
	struct dentry *dentry = ERR_PTR(-EEXIST);
A
Al Viro 已提交
3284
	struct nameidata nd;
3285
	int err2;
3286 3287 3288 3289 3290 3291 3292 3293 3294 3295
	int error;
	bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);

	/*
	 * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any
	 * other flags passed in are ignored!
	 */
	lookup_flags &= LOOKUP_REVAL;

	error = do_path_lookup(dfd, pathname, LOOKUP_PARENT|lookup_flags, &nd);
A
Al Viro 已提交
3296 3297
	if (error)
		return ERR_PTR(error);
L
Linus Torvalds 已提交
3298

3299 3300 3301 3302
	/*
	 * Yucky last component or no last component at all?
	 * (foo/., foo/.., /////)
	 */
A
Al Viro 已提交
3303 3304 3305 3306
	if (nd.last_type != LAST_NORM)
		goto out;
	nd.flags &= ~LOOKUP_PARENT;
	nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL;
3307

3308 3309
	/* don't fail immediately if it's r/o, at least try to report other errors */
	err2 = mnt_want_write(nd.path.mnt);
3310 3311 3312
	/*
	 * Do the final lookup.
	 */
A
Al Viro 已提交
3313 3314
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
	dentry = lookup_hash(&nd);
L
Linus Torvalds 已提交
3315
	if (IS_ERR(dentry))
3316
		goto unlock;
3317

3318
	error = -EEXIST;
3319
	if (dentry->d_inode)
3320
		goto fail;
3321 3322 3323 3324 3325 3326
	/*
	 * Special case - lookup gave negative, but... we had foo/bar/
	 * From the vfs_mknod() POV we just have a negative dentry -
	 * all is fine. Let's be bastards - you had / on the end, you've
	 * been asking for (non-existent) directory. -ENOENT for you.
	 */
A
Al Viro 已提交
3327
	if (unlikely(!is_dir && nd.last.name[nd.last.len])) {
3328
		error = -ENOENT;
A
Al Viro 已提交
3329
		goto fail;
3330
	}
3331 3332
	if (unlikely(err2)) {
		error = err2;
3333
		goto fail;
3334
	}
A
Al Viro 已提交
3335
	*path = nd.path;
L
Linus Torvalds 已提交
3336 3337
	return dentry;
fail:
3338 3339 3340
	dput(dentry);
	dentry = ERR_PTR(error);
unlock:
A
Al Viro 已提交
3341
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
3342 3343
	if (!err2)
		mnt_drop_write(nd.path.mnt);
A
Al Viro 已提交
3344 3345
out:
	path_put(&nd.path);
L
Linus Torvalds 已提交
3346 3347
	return dentry;
}
3348 3349
EXPORT_SYMBOL(kern_path_create);

A
Al Viro 已提交
3350 3351 3352 3353
void done_path_create(struct path *path, struct dentry *dentry)
{
	dput(dentry);
	mutex_unlock(&path->dentry->d_inode->i_mutex);
3354
	mnt_drop_write(path->mnt);
A
Al Viro 已提交
3355 3356 3357 3358
	path_put(path);
}
EXPORT_SYMBOL(done_path_create);

3359 3360
struct dentry *user_path_create(int dfd, const char __user *pathname,
				struct path *path, unsigned int lookup_flags)
3361
{
3362
	struct filename *tmp = getname(pathname);
3363 3364 3365
	struct dentry *res;
	if (IS_ERR(tmp))
		return ERR_CAST(tmp);
3366
	res = kern_path_create(dfd, tmp->name, path, lookup_flags);
3367 3368 3369 3370 3371
	putname(tmp);
	return res;
}
EXPORT_SYMBOL(user_path_create);

A
Al Viro 已提交
3372
int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
L
Linus Torvalds 已提交
3373
{
3374
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
3375 3376 3377 3378

	if (error)
		return error;

3379
	if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
L
Linus Torvalds 已提交
3380 3381
		return -EPERM;

A
Al Viro 已提交
3382
	if (!dir->i_op->mknod)
L
Linus Torvalds 已提交
3383 3384
		return -EPERM;

3385 3386 3387 3388
	error = devcgroup_inode_mknod(mode, dev);
	if (error)
		return error;

L
Linus Torvalds 已提交
3389 3390 3391 3392 3393
	error = security_inode_mknod(dir, dentry, mode, dev);
	if (error)
		return error;

	error = dir->i_op->mknod(dir, dentry, mode, dev);
3394
	if (!error)
3395
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
3396 3397 3398
	return error;
}

A
Al Viro 已提交
3399
static int may_mknod(umode_t mode)
3400 3401 3402 3403 3404 3405 3406 3407 3408 3409 3410 3411 3412 3413 3414 3415
{
	switch (mode & S_IFMT) {
	case S_IFREG:
	case S_IFCHR:
	case S_IFBLK:
	case S_IFIFO:
	case S_IFSOCK:
	case 0: /* zero mode translates to S_IFREG */
		return 0;
	case S_IFDIR:
		return -EPERM;
	default:
		return -EINVAL;
	}
}

A
Al Viro 已提交
3416
SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
3417
		unsigned, dev)
L
Linus Torvalds 已提交
3418
{
3419
	struct dentry *dentry;
3420 3421
	struct path path;
	int error;
3422
	unsigned int lookup_flags = 0;
L
Linus Torvalds 已提交
3423

3424 3425 3426
	error = may_mknod(mode);
	if (error)
		return error;
3427 3428
retry:
	dentry = user_path_create(dfd, filename, &path, lookup_flags);
3429 3430
	if (IS_ERR(dentry))
		return PTR_ERR(dentry);
3431

3432
	if (!IS_POSIXACL(path.dentry->d_inode))
A
Al Viro 已提交
3433
		mode &= ~current_umask();
3434
	error = security_path_mknod(&path, dentry, mode, dev);
3435
	if (error)
3436
		goto out;
3437
	switch (mode & S_IFMT) {
L
Linus Torvalds 已提交
3438
		case 0: case S_IFREG:
A
Al Viro 已提交
3439
			error = vfs_create(path.dentry->d_inode,dentry,mode,true);
L
Linus Torvalds 已提交
3440 3441
			break;
		case S_IFCHR: case S_IFBLK:
3442
			error = vfs_mknod(path.dentry->d_inode,dentry,mode,
L
Linus Torvalds 已提交
3443 3444 3445
					new_decode_dev(dev));
			break;
		case S_IFIFO: case S_IFSOCK:
3446
			error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
L
Linus Torvalds 已提交
3447 3448
			break;
	}
3449
out:
A
Al Viro 已提交
3450
	done_path_create(&path, dentry);
3451 3452 3453 3454
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
L
Linus Torvalds 已提交
3455 3456 3457
	return error;
}

A
Al Viro 已提交
3458
SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3459 3460 3461 3462
{
	return sys_mknodat(AT_FDCWD, filename, mode, dev);
}

3463
int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
L
Linus Torvalds 已提交
3464
{
3465
	int error = may_create(dir, dentry);
3466
	unsigned max_links = dir->i_sb->s_max_links;
L
Linus Torvalds 已提交
3467 3468 3469 3470

	if (error)
		return error;

A
Al Viro 已提交
3471
	if (!dir->i_op->mkdir)
L
Linus Torvalds 已提交
3472 3473 3474 3475 3476 3477 3478
		return -EPERM;

	mode &= (S_IRWXUGO|S_ISVTX);
	error = security_inode_mkdir(dir, dentry, mode);
	if (error)
		return error;

3479 3480 3481
	if (max_links && dir->i_nlink >= max_links)
		return -EMLINK;

L
Linus Torvalds 已提交
3482
	error = dir->i_op->mkdir(dir, dentry, mode);
3483
	if (!error)
3484
		fsnotify_mkdir(dir, dentry);
L
Linus Torvalds 已提交
3485 3486 3487
	return error;
}

3488
SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
L
Linus Torvalds 已提交
3489
{
3490
	struct dentry *dentry;
3491 3492
	struct path path;
	int error;
3493
	unsigned int lookup_flags = LOOKUP_DIRECTORY;
L
Linus Torvalds 已提交
3494

3495 3496
retry:
	dentry = user_path_create(dfd, pathname, &path, lookup_flags);
3497
	if (IS_ERR(dentry))
3498
		return PTR_ERR(dentry);
L
Linus Torvalds 已提交
3499

3500
	if (!IS_POSIXACL(path.dentry->d_inode))
A
Al Viro 已提交
3501
		mode &= ~current_umask();
3502
	error = security_path_mkdir(&path, dentry, mode);
3503 3504
	if (!error)
		error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
A
Al Viro 已提交
3505
	done_path_create(&path, dentry);
3506 3507 3508 3509
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
L
Linus Torvalds 已提交
3510 3511 3512
	return error;
}

3513
SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
3514 3515 3516 3517
{
	return sys_mkdirat(AT_FDCWD, pathname, mode);
}

L
Linus Torvalds 已提交
3518
/*
S
Sage Weil 已提交
3519
 * The dentry_unhash() helper will try to drop the dentry early: we
3520
 * should have a usage count of 1 if we're the only user of this
S
Sage Weil 已提交
3521 3522
 * dentry, and if that is true (possibly after pruning the dcache),
 * then we drop the dentry now.
L
Linus Torvalds 已提交
3523 3524 3525 3526 3527 3528 3529 3530 3531 3532 3533 3534
 *
 * A low-level filesystem can, if it choses, legally
 * do a
 *
 *	if (!d_unhashed(dentry))
 *		return -EBUSY;
 *
 * if it cannot handle the case of removing a directory
 * that is still in use by something else..
 */
void dentry_unhash(struct dentry *dentry)
{
3535
	shrink_dcache_parent(dentry);
L
Linus Torvalds 已提交
3536
	spin_lock(&dentry->d_lock);
3537
	if (dentry->d_lockref.count == 1)
L
Linus Torvalds 已提交
3538 3539 3540 3541 3542 3543 3544 3545 3546 3547 3548
		__d_drop(dentry);
	spin_unlock(&dentry->d_lock);
}

int vfs_rmdir(struct inode *dir, struct dentry *dentry)
{
	int error = may_delete(dir, dentry, 1);

	if (error)
		return error;

A
Al Viro 已提交
3549
	if (!dir->i_op->rmdir)
L
Linus Torvalds 已提交
3550 3551
		return -EPERM;

3552
	dget(dentry);
3553
	mutex_lock(&dentry->d_inode->i_mutex);
S
Sage Weil 已提交
3554 3555

	error = -EBUSY;
L
Linus Torvalds 已提交
3556
	if (d_mountpoint(dentry))
S
Sage Weil 已提交
3557 3558 3559 3560 3561 3562
		goto out;

	error = security_inode_rmdir(dir, dentry);
	if (error)
		goto out;

3563
	shrink_dcache_parent(dentry);
S
Sage Weil 已提交
3564 3565 3566 3567 3568 3569 3570 3571
	error = dir->i_op->rmdir(dir, dentry);
	if (error)
		goto out;

	dentry->d_inode->i_flags |= S_DEAD;
	dont_mount(dentry);

out:
3572
	mutex_unlock(&dentry->d_inode->i_mutex);
3573
	dput(dentry);
S
Sage Weil 已提交
3574
	if (!error)
L
Linus Torvalds 已提交
3575 3576 3577 3578
		d_delete(dentry);
	return error;
}

3579
static long do_rmdir(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
3580 3581
{
	int error = 0;
3582
	struct filename *name;
L
Linus Torvalds 已提交
3583 3584
	struct dentry *dentry;
	struct nameidata nd;
3585 3586 3587
	unsigned int lookup_flags = 0;
retry:
	name = user_path_parent(dfd, pathname, &nd, lookup_flags);
3588 3589
	if (IS_ERR(name))
		return PTR_ERR(name);
L
Linus Torvalds 已提交
3590 3591

	switch(nd.last_type) {
3592 3593 3594 3595 3596 3597 3598 3599 3600
	case LAST_DOTDOT:
		error = -ENOTEMPTY;
		goto exit1;
	case LAST_DOT:
		error = -EINVAL;
		goto exit1;
	case LAST_ROOT:
		error = -EBUSY;
		goto exit1;
L
Linus Torvalds 已提交
3601
	}
3602 3603

	nd.flags &= ~LOOKUP_PARENT;
3604 3605 3606
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto exit1;
3607

3608
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
3609
	dentry = lookup_hash(&nd);
L
Linus Torvalds 已提交
3610
	error = PTR_ERR(dentry);
3611 3612
	if (IS_ERR(dentry))
		goto exit2;
3613 3614 3615 3616
	if (!dentry->d_inode) {
		error = -ENOENT;
		goto exit3;
	}
3617 3618
	error = security_path_rmdir(&nd.path, dentry);
	if (error)
3619
		goto exit3;
3620
	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
3621
exit3:
3622 3623
	dput(dentry);
exit2:
3624
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
3625
	mnt_drop_write(nd.path.mnt);
L
Linus Torvalds 已提交
3626
exit1:
J
Jan Blunck 已提交
3627
	path_put(&nd.path);
L
Linus Torvalds 已提交
3628
	putname(name);
3629 3630 3631 3632
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
L
Linus Torvalds 已提交
3633 3634 3635
	return error;
}

3636
SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
3637 3638 3639 3640
{
	return do_rmdir(AT_FDCWD, pathname);
}

L
Linus Torvalds 已提交
3641 3642 3643 3644 3645 3646 3647
int vfs_unlink(struct inode *dir, struct dentry *dentry)
{
	int error = may_delete(dir, dentry, 0);

	if (error)
		return error;

A
Al Viro 已提交
3648
	if (!dir->i_op->unlink)
L
Linus Torvalds 已提交
3649 3650
		return -EPERM;

3651
	mutex_lock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
3652 3653 3654 3655
	if (d_mountpoint(dentry))
		error = -EBUSY;
	else {
		error = security_inode_unlink(dir, dentry);
3656
		if (!error) {
L
Linus Torvalds 已提交
3657
			error = dir->i_op->unlink(dir, dentry);
3658
			if (!error)
3659
				dont_mount(dentry);
3660
		}
L
Linus Torvalds 已提交
3661
	}
3662
	mutex_unlock(&dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
3663 3664 3665

	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
	if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
3666
		fsnotify_link_count(dentry->d_inode);
J
John McCutchan 已提交
3667
		d_delete(dentry);
L
Linus Torvalds 已提交
3668
	}
R
Robert Love 已提交
3669

L
Linus Torvalds 已提交
3670 3671 3672 3673 3674
	return error;
}

/*
 * Make sure that the actual truncation of the file will occur outside its
3675
 * directory's i_mutex.  Truncate can take a long time if there is a lot of
L
Linus Torvalds 已提交
3676 3677 3678
 * writeout happening, and we don't want to prevent access to the directory
 * while waiting on the I/O.
 */
3679
static long do_unlinkat(int dfd, const char __user *pathname)
L
Linus Torvalds 已提交
3680
{
3681
	int error;
3682
	struct filename *name;
L
Linus Torvalds 已提交
3683 3684 3685
	struct dentry *dentry;
	struct nameidata nd;
	struct inode *inode = NULL;
3686 3687 3688
	unsigned int lookup_flags = 0;
retry:
	name = user_path_parent(dfd, pathname, &nd, lookup_flags);
3689 3690
	if (IS_ERR(name))
		return PTR_ERR(name);
3691

L
Linus Torvalds 已提交
3692 3693 3694
	error = -EISDIR;
	if (nd.last_type != LAST_NORM)
		goto exit1;
3695 3696

	nd.flags &= ~LOOKUP_PARENT;
3697 3698 3699
	error = mnt_want_write(nd.path.mnt);
	if (error)
		goto exit1;
3700

3701
	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
3702
	dentry = lookup_hash(&nd);
L
Linus Torvalds 已提交
3703 3704 3705
	error = PTR_ERR(dentry);
	if (!IS_ERR(dentry)) {
		/* Why not before? Because we want correct error value */
3706 3707
		if (nd.last.name[nd.last.len])
			goto slashes;
L
Linus Torvalds 已提交
3708
		inode = dentry->d_inode;
3709
		if (!inode)
3710 3711
			goto slashes;
		ihold(inode);
3712 3713
		error = security_path_unlink(&nd.path, dentry);
		if (error)
3714
			goto exit2;
3715
		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
3716
exit2:
L
Linus Torvalds 已提交
3717 3718
		dput(dentry);
	}
3719
	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
L
Linus Torvalds 已提交
3720 3721
	if (inode)
		iput(inode);	/* truncate the inode here */
3722
	mnt_drop_write(nd.path.mnt);
L
Linus Torvalds 已提交
3723
exit1:
J
Jan Blunck 已提交
3724
	path_put(&nd.path);
L
Linus Torvalds 已提交
3725
	putname(name);
3726 3727 3728 3729 3730
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		inode = NULL;
		goto retry;
	}
L
Linus Torvalds 已提交
3731 3732 3733 3734 3735 3736 3737 3738
	return error;

slashes:
	error = !dentry->d_inode ? -ENOENT :
		S_ISDIR(dentry->d_inode->i_mode) ? -EISDIR : -ENOTDIR;
	goto exit2;
}

3739
SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
3740 3741 3742 3743 3744 3745 3746 3747 3748 3749
{
	if ((flag & ~AT_REMOVEDIR) != 0)
		return -EINVAL;

	if (flag & AT_REMOVEDIR)
		return do_rmdir(dfd, pathname);

	return do_unlinkat(dfd, pathname);
}

3750
SYSCALL_DEFINE1(unlink, const char __user *, pathname)
3751 3752 3753 3754
{
	return do_unlinkat(AT_FDCWD, pathname);
}

3755
int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
L
Linus Torvalds 已提交
3756
{
3757
	int error = may_create(dir, dentry);
L
Linus Torvalds 已提交
3758 3759 3760 3761

	if (error)
		return error;

A
Al Viro 已提交
3762
	if (!dir->i_op->symlink)
L
Linus Torvalds 已提交
3763 3764 3765 3766 3767 3768 3769
		return -EPERM;

	error = security_inode_symlink(dir, dentry, oldname);
	if (error)
		return error;

	error = dir->i_op->symlink(dir, dentry, oldname);
3770
	if (!error)
3771
		fsnotify_create(dir, dentry);
L
Linus Torvalds 已提交
3772 3773 3774
	return error;
}

3775 3776
SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
L
Linus Torvalds 已提交
3777
{
3778
	int error;
3779
	struct filename *from;
3780
	struct dentry *dentry;
3781
	struct path path;
3782
	unsigned int lookup_flags = 0;
L
Linus Torvalds 已提交
3783 3784

	from = getname(oldname);
3785
	if (IS_ERR(from))
L
Linus Torvalds 已提交
3786
		return PTR_ERR(from);
3787 3788
retry:
	dentry = user_path_create(newdfd, newname, &path, lookup_flags);
3789 3790
	error = PTR_ERR(dentry);
	if (IS_ERR(dentry))
3791
		goto out_putname;
3792

3793
	error = security_path_symlink(&path, dentry, from->name);
3794
	if (!error)
3795
		error = vfs_symlink(path.dentry->d_inode, dentry, from->name);
A
Al Viro 已提交
3796
	done_path_create(&path, dentry);
3797 3798 3799 3800
	if (retry_estale(error, lookup_flags)) {
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
3801
out_putname:
L
Linus Torvalds 已提交
3802 3803 3804 3805
	putname(from);
	return error;
}

3806
SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
3807 3808 3809 3810
{
	return sys_symlinkat(oldname, AT_FDCWD, newname);
}

L
Linus Torvalds 已提交
3811 3812 3813
int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
{
	struct inode *inode = old_dentry->d_inode;
3814
	unsigned max_links = dir->i_sb->s_max_links;
L
Linus Torvalds 已提交
3815 3816 3817 3818 3819
	int error;

	if (!inode)
		return -ENOENT;

3820
	error = may_create(dir, new_dentry);
L
Linus Torvalds 已提交
3821 3822 3823 3824 3825 3826 3827 3828 3829 3830 3831
	if (error)
		return error;

	if (dir->i_sb != inode->i_sb)
		return -EXDEV;

	/*
	 * A link to an append-only or immutable file cannot be created.
	 */
	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
		return -EPERM;
A
Al Viro 已提交
3832
	if (!dir->i_op->link)
L
Linus Torvalds 已提交
3833
		return -EPERM;
3834
	if (S_ISDIR(inode->i_mode))
L
Linus Torvalds 已提交
3835 3836 3837 3838 3839 3840
		return -EPERM;

	error = security_inode_link(old_dentry, dir, new_dentry);
	if (error)
		return error;

3841
	mutex_lock(&inode->i_mutex);
3842
	/* Make sure we don't allow creating hardlink to an unlinked file */
3843
	if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
3844
		error =  -ENOENT;
3845 3846
	else if (max_links && inode->i_nlink >= max_links)
		error = -EMLINK;
3847 3848
	else
		error = dir->i_op->link(old_dentry, dir, new_dentry);
3849 3850 3851 3852 3853 3854

	if (!error && (inode->i_state & I_LINKABLE)) {
		spin_lock(&inode->i_lock);
		inode->i_state &= ~I_LINKABLE;
		spin_unlock(&inode->i_lock);
	}
3855
	mutex_unlock(&inode->i_mutex);
3856
	if (!error)
3857
		fsnotify_link(dir, inode, new_dentry);
L
Linus Torvalds 已提交
3858 3859 3860 3861 3862 3863 3864 3865 3866 3867 3868 3869
	return error;
}

/*
 * Hardlinks are often used in delicate situations.  We avoid
 * security-related surprises by not following symlinks on the
 * newname.  --KAB
 *
 * We don't follow them on the oldname either to be compatible
 * with linux 2.0, and to avoid hard-linking to directories
 * and other special files.  --ADM
 */
3870 3871
SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname, int, flags)
L
Linus Torvalds 已提交
3872 3873
{
	struct dentry *new_dentry;
3874
	struct path old_path, new_path;
3875
	int how = 0;
L
Linus Torvalds 已提交
3876 3877
	int error;

3878
	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
3879
		return -EINVAL;
3880
	/*
3881 3882 3883
	 * To use null names we require CAP_DAC_READ_SEARCH
	 * This ensures that not everyone will be able to create
	 * handlink using the passed filedescriptor.
3884
	 */
3885 3886 3887
	if (flags & AT_EMPTY_PATH) {
		if (!capable(CAP_DAC_READ_SEARCH))
			return -ENOENT;
3888
		how = LOOKUP_EMPTY;
3889
	}
3890 3891 3892

	if (flags & AT_SYMLINK_FOLLOW)
		how |= LOOKUP_FOLLOW;
3893
retry:
3894
	error = user_path_at(olddfd, oldname, how, &old_path);
L
Linus Torvalds 已提交
3895
	if (error)
3896 3897
		return error;

3898 3899
	new_dentry = user_path_create(newdfd, newname, &new_path,
					(how & LOOKUP_REVAL));
L
Linus Torvalds 已提交
3900
	error = PTR_ERR(new_dentry);
3901
	if (IS_ERR(new_dentry))
3902 3903 3904 3905 3906
		goto out;

	error = -EXDEV;
	if (old_path.mnt != new_path.mnt)
		goto out_dput;
K
Kees Cook 已提交
3907 3908 3909
	error = may_linkat(&old_path);
	if (unlikely(error))
		goto out_dput;
3910
	error = security_path_link(old_path.dentry, &new_path, new_dentry);
3911
	if (error)
3912
		goto out_dput;
3913
	error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry);
3914
out_dput:
A
Al Viro 已提交
3915
	done_path_create(&new_path, new_dentry);
3916 3917 3918 3919
	if (retry_estale(error, how)) {
		how |= LOOKUP_REVAL;
		goto retry;
	}
L
Linus Torvalds 已提交
3920
out:
3921
	path_put(&old_path);
L
Linus Torvalds 已提交
3922 3923 3924 3925

	return error;
}

3926
SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
3927
{
3928
	return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
3929 3930
}

L
Linus Torvalds 已提交
3931 3932 3933 3934 3935 3936 3937
/*
 * The worst of all namespace operations - renaming directory. "Perverted"
 * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
 * Problems:
 *	a) we can get into loop creation. Check is done in is_subdir().
 *	b) race potential - two innocent renames can create a loop together.
 *	   That's where 4.4 screws up. Current fix: serialization on
3938
 *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
L
Linus Torvalds 已提交
3939 3940
 *	   story.
 *	c) we have to lock _three_ objects - parents and victim (if it exists).
3941
 *	   And that - after we got ->i_mutex on parents (until then we don't know
L
Linus Torvalds 已提交
3942 3943
 *	   whether the target exists).  Solution: try to be smart with locking
 *	   order for inodes.  We rely on the fact that tree topology may change
3944
 *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
L
Linus Torvalds 已提交
3945 3946 3947
 *	   move will be locked.  Thus we can rank directories by the tree
 *	   (ancestors first) and rank all non-directories after them.
 *	   That works since everybody except rename does "lock parent, lookup,
3948
 *	   lock child" and rename is under ->s_vfs_rename_mutex.
L
Linus Torvalds 已提交
3949 3950 3951
 *	   HOWEVER, it relies on the assumption that any object with ->lookup()
 *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
 *	   we'd better make sure that there's no link(2) for them.
3952
 *	d) conversion from fhandle to dentry may come in the wrong moment - when
3953
 *	   we are removing the target. Solution: we will have to grab ->i_mutex
L
Linus Torvalds 已提交
3954
 *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
3955
 *	   ->i_mutex on parents, which works but leads to some truly excessive
L
Linus Torvalds 已提交
3956 3957
 *	   locking].
 */
A
Adrian Bunk 已提交
3958 3959
static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
			  struct inode *new_dir, struct dentry *new_dentry)
L
Linus Torvalds 已提交
3960 3961
{
	int error = 0;
S
Sage Weil 已提交
3962
	struct inode *target = new_dentry->d_inode;
3963
	unsigned max_links = new_dir->i_sb->s_max_links;
L
Linus Torvalds 已提交
3964 3965 3966 3967 3968 3969

	/*
	 * If we are going to change the parent - check write permissions,
	 * we'll need to flip '..'.
	 */
	if (new_dir != old_dir) {
3970
		error = inode_permission(old_dentry->d_inode, MAY_WRITE);
L
Linus Torvalds 已提交
3971 3972 3973 3974 3975 3976 3977 3978
		if (error)
			return error;
	}

	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		return error;

3979
	dget(new_dentry);
3980
	if (target)
3981
		mutex_lock(&target->i_mutex);
S
Sage Weil 已提交
3982 3983 3984 3985 3986

	error = -EBUSY;
	if (d_mountpoint(old_dentry) || d_mountpoint(new_dentry))
		goto out;

3987 3988 3989 3990 3991
	error = -EMLINK;
	if (max_links && !target && new_dir != old_dir &&
	    new_dir->i_nlink >= max_links)
		goto out;

3992 3993
	if (target)
		shrink_dcache_parent(new_dentry);
S
Sage Weil 已提交
3994 3995 3996 3997
	error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		goto out;

L
Linus Torvalds 已提交
3998
	if (target) {
S
Sage Weil 已提交
3999 4000
		target->i_flags |= S_DEAD;
		dont_mount(new_dentry);
L
Linus Torvalds 已提交
4001
	}
S
Sage Weil 已提交
4002 4003 4004
out:
	if (target)
		mutex_unlock(&target->i_mutex);
4005
	dput(new_dentry);
4006
	if (!error)
4007 4008
		if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
			d_move(old_dentry,new_dentry);
L
Linus Torvalds 已提交
4009 4010 4011
	return error;
}

A
Adrian Bunk 已提交
4012 4013
static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
			    struct inode *new_dir, struct dentry *new_dentry)
L
Linus Torvalds 已提交
4014
{
S
Sage Weil 已提交
4015
	struct inode *target = new_dentry->d_inode;
L
Linus Torvalds 已提交
4016 4017 4018 4019 4020 4021 4022 4023
	int error;

	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		return error;

	dget(new_dentry);
	if (target)
4024
		mutex_lock(&target->i_mutex);
S
Sage Weil 已提交
4025 4026

	error = -EBUSY;
L
Linus Torvalds 已提交
4027
	if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
S
Sage Weil 已提交
4028 4029 4030 4031 4032 4033 4034 4035 4036 4037 4038
		goto out;

	error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
	if (error)
		goto out;

	if (target)
		dont_mount(new_dentry);
	if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
		d_move(old_dentry, new_dentry);
out:
L
Linus Torvalds 已提交
4039
	if (target)
4040
		mutex_unlock(&target->i_mutex);
L
Linus Torvalds 已提交
4041 4042 4043 4044 4045 4046 4047 4048 4049
	dput(new_dentry);
	return error;
}

int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
	       struct inode *new_dir, struct dentry *new_dentry)
{
	int error;
	int is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
4050
	const unsigned char *old_name;
L
Linus Torvalds 已提交
4051 4052 4053 4054 4055 4056 4057 4058 4059

	if (old_dentry->d_inode == new_dentry->d_inode)
 		return 0;
 
	error = may_delete(old_dir, old_dentry, is_dir);
	if (error)
		return error;

	if (!new_dentry->d_inode)
4060
		error = may_create(new_dir, new_dentry);
L
Linus Torvalds 已提交
4061 4062 4063 4064 4065
	else
		error = may_delete(new_dir, new_dentry, is_dir);
	if (error)
		return error;

A
Al Viro 已提交
4066
	if (!old_dir->i_op->rename)
L
Linus Torvalds 已提交
4067 4068
		return -EPERM;

R
Robert Love 已提交
4069 4070
	old_name = fsnotify_oldname_init(old_dentry->d_name.name);

L
Linus Torvalds 已提交
4071 4072 4073 4074
	if (is_dir)
		error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
	else
		error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
4075 4076
	if (!error)
		fsnotify_move(old_dir, new_dir, old_name, is_dir,
4077
			      new_dentry->d_inode, old_dentry);
R
Robert Love 已提交
4078 4079
	fsnotify_oldname_free(old_name);

L
Linus Torvalds 已提交
4080 4081 4082
	return error;
}

4083 4084
SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
		int, newdfd, const char __user *, newname)
L
Linus Torvalds 已提交
4085
{
4086 4087 4088
	struct dentry *old_dir, *new_dir;
	struct dentry *old_dentry, *new_dentry;
	struct dentry *trap;
L
Linus Torvalds 已提交
4089
	struct nameidata oldnd, newnd;
4090 4091
	struct filename *from;
	struct filename *to;
4092 4093
	unsigned int lookup_flags = 0;
	bool should_retry = false;
4094
	int error;
4095 4096
retry:
	from = user_path_parent(olddfd, oldname, &oldnd, lookup_flags);
4097 4098
	if (IS_ERR(from)) {
		error = PTR_ERR(from);
L
Linus Torvalds 已提交
4099
		goto exit;
4100
	}
L
Linus Torvalds 已提交
4101

4102
	to = user_path_parent(newdfd, newname, &newnd, lookup_flags);
4103 4104
	if (IS_ERR(to)) {
		error = PTR_ERR(to);
L
Linus Torvalds 已提交
4105
		goto exit1;
4106
	}
L
Linus Torvalds 已提交
4107 4108

	error = -EXDEV;
4109
	if (oldnd.path.mnt != newnd.path.mnt)
L
Linus Torvalds 已提交
4110 4111
		goto exit2;

4112
	old_dir = oldnd.path.dentry;
L
Linus Torvalds 已提交
4113 4114 4115 4116
	error = -EBUSY;
	if (oldnd.last_type != LAST_NORM)
		goto exit2;

4117
	new_dir = newnd.path.dentry;
L
Linus Torvalds 已提交
4118 4119 4120
	if (newnd.last_type != LAST_NORM)
		goto exit2;

4121 4122 4123 4124
	error = mnt_want_write(oldnd.path.mnt);
	if (error)
		goto exit2;

4125 4126
	oldnd.flags &= ~LOOKUP_PARENT;
	newnd.flags &= ~LOOKUP_PARENT;
4127
	newnd.flags |= LOOKUP_RENAME_TARGET;
4128

L
Linus Torvalds 已提交
4129 4130
	trap = lock_rename(new_dir, old_dir);

4131
	old_dentry = lookup_hash(&oldnd);
L
Linus Torvalds 已提交
4132 4133 4134 4135 4136 4137 4138 4139 4140 4141 4142 4143 4144 4145 4146 4147 4148 4149 4150
	error = PTR_ERR(old_dentry);
	if (IS_ERR(old_dentry))
		goto exit3;
	/* source must exist */
	error = -ENOENT;
	if (!old_dentry->d_inode)
		goto exit4;
	/* unless the source is a directory trailing slashes give -ENOTDIR */
	if (!S_ISDIR(old_dentry->d_inode->i_mode)) {
		error = -ENOTDIR;
		if (oldnd.last.name[oldnd.last.len])
			goto exit4;
		if (newnd.last.name[newnd.last.len])
			goto exit4;
	}
	/* source should not be ancestor of target */
	error = -EINVAL;
	if (old_dentry == trap)
		goto exit4;
4151
	new_dentry = lookup_hash(&newnd);
L
Linus Torvalds 已提交
4152 4153 4154 4155 4156 4157 4158 4159
	error = PTR_ERR(new_dentry);
	if (IS_ERR(new_dentry))
		goto exit4;
	/* target should not be an ancestor of source */
	error = -ENOTEMPTY;
	if (new_dentry == trap)
		goto exit5;

4160 4161 4162
	error = security_path_rename(&oldnd.path, old_dentry,
				     &newnd.path, new_dentry);
	if (error)
4163
		goto exit5;
L
Linus Torvalds 已提交
4164 4165 4166 4167 4168 4169 4170 4171
	error = vfs_rename(old_dir->d_inode, old_dentry,
				   new_dir->d_inode, new_dentry);
exit5:
	dput(new_dentry);
exit4:
	dput(old_dentry);
exit3:
	unlock_rename(new_dir, old_dir);
4172
	mnt_drop_write(oldnd.path.mnt);
L
Linus Torvalds 已提交
4173
exit2:
4174 4175
	if (retry_estale(error, lookup_flags))
		should_retry = true;
J
Jan Blunck 已提交
4176
	path_put(&newnd.path);
4177
	putname(to);
L
Linus Torvalds 已提交
4178
exit1:
J
Jan Blunck 已提交
4179
	path_put(&oldnd.path);
L
Linus Torvalds 已提交
4180
	putname(from);
4181 4182 4183 4184 4185
	if (should_retry) {
		should_retry = false;
		lookup_flags |= LOOKUP_REVAL;
		goto retry;
	}
4186
exit:
L
Linus Torvalds 已提交
4187 4188 4189
	return error;
}

4190
SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
4191 4192 4193 4194
{
	return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname);
}

L
Linus Torvalds 已提交
4195 4196 4197 4198 4199 4200 4201 4202 4203 4204 4205 4206 4207 4208 4209 4210 4211 4212 4213 4214 4215 4216 4217 4218 4219
int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
{
	int len;

	len = PTR_ERR(link);
	if (IS_ERR(link))
		goto out;

	len = strlen(link);
	if (len > (unsigned) buflen)
		len = buflen;
	if (copy_to_user(buffer, link, len))
		len = -EFAULT;
out:
	return len;
}

/*
 * A helper for ->readlink().  This should be used *ONLY* for symlinks that
 * have ->follow_link() touching nd only in nd_set_link().  Using (or not
 * using) it for any given inode is up to filesystem.
 */
int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
	struct nameidata nd;
4220
	void *cookie;
4221
	int res;
4222

L
Linus Torvalds 已提交
4223
	nd.depth = 0;
4224
	cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
4225 4226 4227 4228 4229 4230 4231
	if (IS_ERR(cookie))
		return PTR_ERR(cookie);

	res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
	if (dentry->d_inode->i_op->put_link)
		dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
	return res;
L
Linus Torvalds 已提交
4232 4233 4234 4235 4236 4237 4238 4239 4240 4241
}

int vfs_follow_link(struct nameidata *nd, const char *link)
{
	return __vfs_follow_link(nd, link);
}

/* get the link contents into pagecache */
static char *page_getlink(struct dentry * dentry, struct page **ppage)
{
4242 4243
	char *kaddr;
	struct page *page;
L
Linus Torvalds 已提交
4244
	struct address_space *mapping = dentry->d_inode->i_mapping;
4245
	page = read_mapping_page(mapping, 0, NULL);
L
Linus Torvalds 已提交
4246
	if (IS_ERR(page))
4247
		return (char*)page;
L
Linus Torvalds 已提交
4248
	*ppage = page;
4249 4250 4251
	kaddr = kmap(page);
	nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1);
	return kaddr;
L
Linus Torvalds 已提交
4252 4253 4254 4255 4256 4257 4258 4259 4260 4261 4262 4263 4264 4265
}

int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
	struct page *page = NULL;
	char *s = page_getlink(dentry, &page);
	int res = vfs_readlink(dentry,buffer,buflen,s);
	if (page) {
		kunmap(page);
		page_cache_release(page);
	}
	return res;
}

4266
void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
L
Linus Torvalds 已提交
4267
{
4268
	struct page *page = NULL;
L
Linus Torvalds 已提交
4269
	nd_set_link(nd, page_getlink(dentry, &page));
4270
	return page;
L
Linus Torvalds 已提交
4271 4272
}

4273
void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
L
Linus Torvalds 已提交
4274
{
4275 4276 4277
	struct page *page = cookie;

	if (page) {
L
Linus Torvalds 已提交
4278 4279 4280 4281 4282
		kunmap(page);
		page_cache_release(page);
	}
}

4283 4284 4285 4286
/*
 * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
 */
int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
L
Linus Torvalds 已提交
4287 4288
{
	struct address_space *mapping = inode->i_mapping;
4289
	struct page *page;
4290
	void *fsdata;
4291
	int err;
L
Linus Torvalds 已提交
4292
	char *kaddr;
4293 4294 4295
	unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
	if (nofs)
		flags |= AOP_FLAG_NOFS;
L
Linus Torvalds 已提交
4296

4297
retry:
4298
	err = pagecache_write_begin(NULL, mapping, 0, len-1,
4299
				flags, &page, &fsdata);
L
Linus Torvalds 已提交
4300
	if (err)
4301 4302
		goto fail;

4303
	kaddr = kmap_atomic(page);
L
Linus Torvalds 已提交
4304
	memcpy(kaddr, symname, len-1);
4305
	kunmap_atomic(kaddr);
4306 4307 4308

	err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
							page, fsdata);
L
Linus Torvalds 已提交
4309 4310
	if (err < 0)
		goto fail;
4311 4312 4313
	if (err < len-1)
		goto retry;

L
Linus Torvalds 已提交
4314 4315 4316 4317 4318 4319
	mark_inode_dirty(inode);
	return 0;
fail:
	return err;
}

4320 4321 4322
int page_symlink(struct inode *inode, const char *symname, int len)
{
	return __page_symlink(inode, symname, len,
4323
			!(mapping_gfp_mask(inode->i_mapping) & __GFP_FS));
4324 4325
}

4326
const struct inode_operations page_symlink_inode_operations = {
L
Linus Torvalds 已提交
4327 4328 4329 4330 4331
	.readlink	= generic_readlink,
	.follow_link	= page_follow_link_light,
	.put_link	= page_put_link,
};

4332
EXPORT_SYMBOL(user_path_at);
4333
EXPORT_SYMBOL(follow_down_one);
L
Linus Torvalds 已提交
4334 4335
EXPORT_SYMBOL(follow_down);
EXPORT_SYMBOL(follow_up);
A
Al Viro 已提交
4336
EXPORT_SYMBOL(get_write_access); /* nfsd */
L
Linus Torvalds 已提交
4337 4338 4339 4340 4341
EXPORT_SYMBOL(lock_rename);
EXPORT_SYMBOL(lookup_one_len);
EXPORT_SYMBOL(page_follow_link_light);
EXPORT_SYMBOL(page_put_link);
EXPORT_SYMBOL(page_readlink);
4342
EXPORT_SYMBOL(__page_symlink);
L
Linus Torvalds 已提交
4343 4344
EXPORT_SYMBOL(page_symlink);
EXPORT_SYMBOL(page_symlink_inode_operations);
A
Al Viro 已提交
4345
EXPORT_SYMBOL(kern_path);
4346
EXPORT_SYMBOL(vfs_path_lookup);
4347
EXPORT_SYMBOL(inode_permission);
L
Linus Torvalds 已提交
4348 4349 4350 4351 4352 4353 4354 4355 4356 4357 4358 4359 4360 4361
EXPORT_SYMBOL(unlock_rename);
EXPORT_SYMBOL(vfs_create);
EXPORT_SYMBOL(vfs_follow_link);
EXPORT_SYMBOL(vfs_link);
EXPORT_SYMBOL(vfs_mkdir);
EXPORT_SYMBOL(vfs_mknod);
EXPORT_SYMBOL(generic_permission);
EXPORT_SYMBOL(vfs_readlink);
EXPORT_SYMBOL(vfs_rename);
EXPORT_SYMBOL(vfs_rmdir);
EXPORT_SYMBOL(vfs_symlink);
EXPORT_SYMBOL(vfs_unlink);
EXPORT_SYMBOL(dentry_unhash);
EXPORT_SYMBOL(generic_readlink);