namei.c 107 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202320332043205320632073208320932103211321232133214321532163217321832193220322132223223322432253226322732283229323032313232323332343235323632373238323932403241324232433244324532463247324832493250325132523253325432553256325732583259326032613262326332643265326632673268326932703271327232733274327532763277327832793280328132823283328432853286328732883289329032913292329332943295329632973298329933003301330233033304330533063307330833093310331133123313331433153316331733183319332033213322332333243325332633273328332933303331333233333334333533363337333833393340334133423343334433453346334733483349335033513352335333543355335633573358335933603361336233633364336533663367336833693370337133723373337433753376337733783379338033813382338333843385338633873388338933903391339233933394339533963397339833993400340134023403340434053406340734083409341034113412341334143415341634173418341934203421342234233424342534263427342834293430343134323433343434353436343734383439344034413442344334443445344634473448344934503451345234533454345534563457345834593460346134623463346434653466346734683469347034713472347334743475347634773478347934803481348234833484348534863487348834893490349134923493349434953496349734983499350035013502350335043505350635073508350935103511351235133514351535163517351835193520352135223523352435253526352735283529353035313532353335343535353635373538353935403541354235433544354535463547354835493550355135523553355435553556355735583559356035613562356335643565356635673568356935703571357235733574357535763577357835793580358135823583358435853586358735883589359035913592359335943595359635973598359936003601360236033604360536063607360836093610361136123613361436153616361736183619362036213622362336243625362636273628362936303631363236333634363536363637363836393640364136423643364436453646364736483649365036513652365336543655365636573658365936603661366236633664366536663667366836693670367136723673367436753676367736783679368036813682368336843685368636873688368936903691369236933694369536963697369836993700370137023703370437053706370737083709371037113712371337143715371637173718371937203721372237233724372537263727372837293730373137323733373437353736373737383739374037413742374337443745374637473748374937503751375237533754375537563757375837593760376137623763376437653766376737683769377037713772377337743775377637773778377937803781378237833784378537863787378837893790379137923793379437953796379737983799380038013802380338043805380638073808380938103811381238133814381538163817381838193820382138223823382438253826382738283829383038313832383338343835383638373838383938403841384238433844384538463847384838493850385138523853385438553856385738583859386038613862386338643865386638673868386938703871387238733874387538763877387838793880388138823883388438853886388738883889389038913892389338943895389638973898389939003901390239033904390539063907390839093910391139123913391439153916391739183919392039213922392339243925392639273928392939303931393239333934393539363937393839393940394139423943394439453946394739483949395039513952395339543955395639573958395939603961396239633964396539663967396839693970397139723973397439753976397739783979398039813982398339843985398639873988398939903991399239933994399539963997399839994000400140024003400440054006400740084009401040114012401340144015401640174018401940204021402240234024402540264027402840294030403140324033403440354036403740384039404040414042404340444045404640474048404940504051405240534054405540564057405840594060406140624063406440654066406740684069407040714072407340744075407640774078407940804081408240834084408540864087408840894090409140924093409440954096409740984099410041014102410341044105410641074108410941104111411241134114411541164117411841194120412141224123412441254126412741284129413041314132413341344135413641374138413941404141414241434144414541464147414841494150415141524153415441554156415741584159416041614162416341644165416641674168416941704171417241734174417541764177417841794180418141824183418441854186418741884189419041914192419341944195419641974198419942004201420242034204420542064207420842094210421142124213421442154216421742184219422042214222422342244225422642274228422942304231423242334234423542364237423842394240424142424243424442454246424742484249425042514252425342544255425642574258425942604261426242634264426542664267426842694270427142724273427442754276427742784279428042814282428342844285428642874288428942904291429242934294429542964297429842994300430143024303430443054306430743084309431043114312431343144315431643174318431943204321432243234324432543264327432843294330433143324333433443354336433743384339434043414342434343444345434643474348434943504351435243534354435543564357435843594360436143624363436443654366
  1. /*
  2. * linux/fs/namei.c
  3. *
  4. * Copyright (C) 1991, 1992 Linus Torvalds
  5. */
  6. /*
  7. * Some corrections by tytso.
  8. */
  9. /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
  10. * lookup logic.
  11. */
  12. /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
  13. */
  14. #include <linux/init.h>
  15. #include <linux/export.h>
  16. #include <linux/kernel.h>
  17. #include <linux/slab.h>
  18. #include <linux/fs.h>
  19. #include <linux/namei.h>
  20. #include <linux/pagemap.h>
  21. #include <linux/fsnotify.h>
  22. #include <linux/personality.h>
  23. #include <linux/security.h>
  24. #include <linux/ima.h>
  25. #include <linux/syscalls.h>
  26. #include <linux/mount.h>
  27. #include <linux/audit.h>
  28. #include <linux/capability.h>
  29. #include <linux/file.h>
  30. #include <linux/fcntl.h>
  31. #include <linux/device_cgroup.h>
  32. #include <linux/fs_struct.h>
  33. #include <linux/posix_acl.h>
  34. #include <asm/uaccess.h>
  35. #include "internal.h"
  36. #include "mount.h"
  37. /* [Feb-1997 T. Schoebel-Theuer]
  38. * Fundamental changes in the pathname lookup mechanisms (namei)
  39. * were necessary because of omirr. The reason is that omirr needs
  40. * to know the _real_ pathname, not the user-supplied one, in case
  41. * of symlinks (and also when transname replacements occur).
  42. *
  43. * The new code replaces the old recursive symlink resolution with
  44. * an iterative one (in case of non-nested symlink chains). It does
  45. * this with calls to <fs>_follow_link().
  46. * As a side effect, dir_namei(), _namei() and follow_link() are now
  47. * replaced with a single function lookup_dentry() that can handle all
  48. * the special cases of the former code.
  49. *
  50. * With the new dcache, the pathname is stored at each inode, at least as
  51. * long as the refcount of the inode is positive. As a side effect, the
  52. * size of the dcache depends on the inode cache and thus is dynamic.
  53. *
  54. * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
  55. * resolution to correspond with current state of the code.
  56. *
  57. * Note that the symlink resolution is not *completely* iterative.
  58. * There is still a significant amount of tail- and mid- recursion in
  59. * the algorithm. Also, note that <fs>_readlink() is not used in
  60. * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
  61. * may return different results than <fs>_follow_link(). Many virtual
  62. * filesystems (including /proc) exhibit this behavior.
  63. */
  64. /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
  65. * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
  66. * and the name already exists in form of a symlink, try to create the new
  67. * name indicated by the symlink. The old code always complained that the
  68. * name already exists, due to not following the symlink even if its target
  69. * is nonexistent. The new semantics affects also mknod() and link() when
  70. * the name is a symlink pointing to a non-existent name.
  71. *
  72. * I don't know which semantics is the right one, since I have no access
  73. * to standards. But I found by trial that HP-UX 9.0 has the full "new"
  74. * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
  75. * "old" one. Personally, I think the new semantics is much more logical.
  76. * Note that "ln old new" where "new" is a symlink pointing to a non-existing
  77. * file does succeed in both HP-UX and SunOs, but not in Solaris
  78. * and in the old Linux semantics.
  79. */
  80. /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
  81. * semantics. See the comments in "open_namei" and "do_link" below.
  82. *
  83. * [10-Sep-98 Alan Modra] Another symlink change.
  84. */
  85. /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
  86. * inside the path - always follow.
  87. * in the last component in creation/removal/renaming - never follow.
  88. * if LOOKUP_FOLLOW passed - follow.
  89. * if the pathname has trailing slashes - follow.
  90. * otherwise - don't follow.
  91. * (applied in that order).
  92. *
  93. * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
  94. * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
  95. * During the 2.4 we need to fix the userland stuff depending on it -
  96. * hopefully we will be able to get rid of that wart in 2.5. So far only
  97. * XEmacs seems to be relying on it...
  98. */
  99. /*
  100. * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
  101. * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives
  102. * any extra contention...
  103. */
  104. /* In order to reduce some races, while at the same time doing additional
  105. * checking and hopefully speeding things up, we copy filenames to the
  106. * kernel data space before using them..
  107. *
  108. * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
  109. * PATH_MAX includes the nul terminator --RR.
  110. */
  111. void final_putname(struct filename *name)
  112. {
  113. if (name->separate) {
  114. __putname(name->name);
  115. kfree(name);
  116. } else {
  117. __putname(name);
  118. }
  119. }
  120. #define EMBEDDED_NAME_MAX (PATH_MAX - sizeof(struct filename))
  121. static struct filename *
  122. getname_flags(const char __user *filename, int flags, int *empty)
  123. {
  124. struct filename *result, *err;
  125. int len;
  126. long max;
  127. char *kname;
  128. result = audit_reusename(filename);
  129. if (result)
  130. return result;
  131. result = __getname();
  132. if (unlikely(!result))
  133. return ERR_PTR(-ENOMEM);
  134. /*
  135. * First, try to embed the struct filename inside the names_cache
  136. * allocation
  137. */
  138. kname = (char *)result + sizeof(*result);
  139. result->name = kname;
  140. result->separate = false;
  141. max = EMBEDDED_NAME_MAX;
  142. recopy:
  143. len = strncpy_from_user(kname, filename, max);
  144. if (unlikely(len < 0)) {
  145. err = ERR_PTR(len);
  146. goto error;
  147. }
  148. /*
  149. * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
  150. * separate struct filename so we can dedicate the entire
  151. * names_cache allocation for the pathname, and re-do the copy from
  152. * userland.
  153. */
  154. if (len == EMBEDDED_NAME_MAX && max == EMBEDDED_NAME_MAX) {
  155. kname = (char *)result;
  156. result = kzalloc(sizeof(*result), GFP_KERNEL);
  157. if (!result) {
  158. err = ERR_PTR(-ENOMEM);
  159. result = (struct filename *)kname;
  160. goto error;
  161. }
  162. result->name = kname;
  163. result->separate = true;
  164. max = PATH_MAX;
  165. goto recopy;
  166. }
  167. /* The empty path is special. */
  168. if (unlikely(!len)) {
  169. if (empty)
  170. *empty = 1;
  171. err = ERR_PTR(-ENOENT);
  172. if (!(flags & LOOKUP_EMPTY))
  173. goto error;
  174. }
  175. err = ERR_PTR(-ENAMETOOLONG);
  176. if (unlikely(len >= PATH_MAX))
  177. goto error;
  178. result->uptr = filename;
  179. audit_getname(result);
  180. return result;
  181. error:
  182. final_putname(result);
  183. return err;
  184. }
  185. struct filename *
  186. getname(const char __user * filename)
  187. {
  188. return getname_flags(filename, 0, NULL);
  189. }
  190. EXPORT_SYMBOL(getname);
  191. #ifdef CONFIG_AUDITSYSCALL
  192. void putname(struct filename *name)
  193. {
  194. if (unlikely(!audit_dummy_context()))
  195. return audit_putname(name);
  196. final_putname(name);
  197. }
  198. #endif
  199. static int check_acl(struct inode *inode, int mask)
  200. {
  201. #ifdef CONFIG_FS_POSIX_ACL
  202. struct posix_acl *acl;
  203. if (mask & MAY_NOT_BLOCK) {
  204. acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
  205. if (!acl)
  206. return -EAGAIN;
  207. /* no ->get_acl() calls in RCU mode... */
  208. if (acl == ACL_NOT_CACHED)
  209. return -ECHILD;
  210. return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
  211. }
  212. acl = get_cached_acl(inode, ACL_TYPE_ACCESS);
  213. /*
  214. * A filesystem can force a ACL callback by just never filling the
  215. * ACL cache. But normally you'd fill the cache either at inode
  216. * instantiation time, or on the first ->get_acl call.
  217. *
  218. * If the filesystem doesn't have a get_acl() function at all, we'll
  219. * just create the negative cache entry.
  220. */
  221. if (acl == ACL_NOT_CACHED) {
  222. if (inode->i_op->get_acl) {
  223. acl = inode->i_op->get_acl(inode, ACL_TYPE_ACCESS);
  224. if (IS_ERR(acl))
  225. return PTR_ERR(acl);
  226. } else {
  227. set_cached_acl(inode, ACL_TYPE_ACCESS, NULL);
  228. return -EAGAIN;
  229. }
  230. }
  231. if (acl) {
  232. int error = posix_acl_permission(inode, acl, mask);
  233. posix_acl_release(acl);
  234. return error;
  235. }
  236. #endif
  237. return -EAGAIN;
  238. }
  239. /*
  240. * This does the basic permission checking
  241. */
  242. static int acl_permission_check(struct inode *inode, int mask)
  243. {
  244. unsigned int mode = inode->i_mode;
  245. if (likely(uid_eq(current_fsuid(), inode->i_uid)))
  246. mode >>= 6;
  247. else {
  248. if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
  249. int error = check_acl(inode, mask);
  250. if (error != -EAGAIN)
  251. return error;
  252. }
  253. if (in_group_p(inode->i_gid))
  254. mode >>= 3;
  255. }
  256. /*
  257. * If the DACs are ok we don't need any capability check.
  258. */
  259. if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
  260. return 0;
  261. return -EACCES;
  262. }
  263. /**
  264. * generic_permission - check for access rights on a Posix-like filesystem
  265. * @inode: inode to check access rights for
  266. * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...)
  267. *
  268. * Used to check for read/write/execute permissions on a file.
  269. * We use "fsuid" for this, letting us set arbitrary permissions
  270. * for filesystem access without changing the "normal" uids which
  271. * are used for other things.
  272. *
  273. * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
  274. * request cannot be satisfied (eg. requires blocking or too much complexity).
  275. * It would then be called again in ref-walk mode.
  276. */
  277. int generic_permission(struct inode *inode, int mask)
  278. {
  279. int ret;
  280. /*
  281. * Do the basic permission checks.
  282. */
  283. ret = acl_permission_check(inode, mask);
  284. if (ret != -EACCES)
  285. return ret;
  286. if (S_ISDIR(inode->i_mode)) {
  287. /* DACs are overridable for directories */
  288. if (inode_capable(inode, CAP_DAC_OVERRIDE))
  289. return 0;
  290. if (!(mask & MAY_WRITE))
  291. if (inode_capable(inode, CAP_DAC_READ_SEARCH))
  292. return 0;
  293. return -EACCES;
  294. }
  295. /*
  296. * Read/write DACs are always overridable.
  297. * Executable DACs are overridable when there is
  298. * at least one exec bit set.
  299. */
  300. if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
  301. if (inode_capable(inode, CAP_DAC_OVERRIDE))
  302. return 0;
  303. /*
  304. * Searching includes executable on directories, else just read.
  305. */
  306. mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
  307. if (mask == MAY_READ)
  308. if (inode_capable(inode, CAP_DAC_READ_SEARCH))
  309. return 0;
  310. return -EACCES;
  311. }
  312. /*
  313. * We _really_ want to just do "generic_permission()" without
  314. * even looking at the inode->i_op values. So we keep a cache
  315. * flag in inode->i_opflags, that says "this has not special
  316. * permission function, use the fast case".
  317. */
  318. static inline int do_inode_permission(struct inode *inode, int mask)
  319. {
  320. if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
  321. if (likely(inode->i_op->permission))
  322. return inode->i_op->permission(inode, mask);
  323. /* This gets set once for the inode lifetime */
  324. spin_lock(&inode->i_lock);
  325. inode->i_opflags |= IOP_FASTPERM;
  326. spin_unlock(&inode->i_lock);
  327. }
  328. return generic_permission(inode, mask);
  329. }
  330. /**
  331. * __inode_permission - Check for access rights to a given inode
  332. * @inode: Inode to check permission on
  333. * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
  334. *
  335. * Check for read/write/execute permissions on an inode.
  336. *
  337. * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
  338. *
  339. * This does not check for a read-only file system. You probably want
  340. * inode_permission().
  341. */
  342. int __inode_permission(struct inode *inode, int mask)
  343. {
  344. int retval;
  345. if (unlikely(mask & MAY_WRITE)) {
  346. /*
  347. * Nobody gets write access to an immutable file.
  348. */
  349. if (IS_IMMUTABLE(inode))
  350. return -EACCES;
  351. }
  352. retval = do_inode_permission(inode, mask);
  353. if (retval)
  354. return retval;
  355. retval = devcgroup_inode_permission(inode, mask);
  356. if (retval)
  357. return retval;
  358. return security_inode_permission(inode, mask);
  359. }
  360. /**
  361. * sb_permission - Check superblock-level permissions
  362. * @sb: Superblock of inode to check permission on
  363. * @inode: Inode to check permission on
  364. * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
  365. *
  366. * Separate out file-system wide checks from inode-specific permission checks.
  367. */
  368. static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
  369. {
  370. if (unlikely(mask & MAY_WRITE)) {
  371. umode_t mode = inode->i_mode;
  372. /* Nobody gets write access to a read-only fs. */
  373. if ((sb->s_flags & MS_RDONLY) &&
  374. (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
  375. return -EROFS;
  376. }
  377. return 0;
  378. }
  379. /**
  380. * inode_permission - Check for access rights to a given inode
  381. * @inode: Inode to check permission on
  382. * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
  383. *
  384. * Check for read/write/execute permissions on an inode. We use fs[ug]id for
  385. * this, letting us set arbitrary permissions for filesystem access without
  386. * changing the "normal" UIDs which are used for other things.
  387. *
  388. * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
  389. */
  390. int inode_permission(struct inode *inode, int mask)
  391. {
  392. int retval;
  393. retval = sb_permission(inode->i_sb, inode, mask);
  394. if (retval)
  395. return retval;
  396. return __inode_permission(inode, mask);
  397. }
  398. /**
  399. * path_get - get a reference to a path
  400. * @path: path to get the reference to
  401. *
  402. * Given a path increment the reference count to the dentry and the vfsmount.
  403. */
  404. void path_get(const struct path *path)
  405. {
  406. mntget(path->mnt);
  407. dget(path->dentry);
  408. }
  409. EXPORT_SYMBOL(path_get);
  410. /**
  411. * path_put - put a reference to a path
  412. * @path: path to put the reference to
  413. *
  414. * Given a path decrement the reference count to the dentry and the vfsmount.
  415. */
  416. void path_put(const struct path *path)
  417. {
  418. dput(path->dentry);
  419. mntput(path->mnt);
  420. }
  421. EXPORT_SYMBOL(path_put);
  422. /*
  423. * Path walking has 2 modes, rcu-walk and ref-walk (see
  424. * Documentation/filesystems/path-lookup.txt). In situations when we can't
  425. * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
  426. * normal reference counts on dentries and vfsmounts to transition to rcu-walk
  427. * mode. Refcounts are grabbed at the last known good point before rcu-walk
  428. * got stuck, so ref-walk may continue from there. If this is not successful
  429. * (eg. a seqcount has changed), then failure is returned and it's up to caller
  430. * to restart the path walk from the beginning in ref-walk mode.
  431. */
  432. static inline void lock_rcu_walk(void)
  433. {
  434. br_read_lock(&vfsmount_lock);
  435. rcu_read_lock();
  436. }
  437. static inline void unlock_rcu_walk(void)
  438. {
  439. rcu_read_unlock();
  440. br_read_unlock(&vfsmount_lock);
  441. }
  442. /**
  443. * unlazy_walk - try to switch to ref-walk mode.
  444. * @nd: nameidata pathwalk data
  445. * @dentry: child of nd->path.dentry or NULL
  446. * Returns: 0 on success, -ECHILD on failure
  447. *
  448. * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry
  449. * for ref-walk mode. @dentry must be a path found by a do_lookup call on
  450. * @nd or NULL. Must be called from rcu-walk context.
  451. */
  452. static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
  453. {
  454. struct fs_struct *fs = current->fs;
  455. struct dentry *parent = nd->path.dentry;
  456. BUG_ON(!(nd->flags & LOOKUP_RCU));
  457. /*
  458. * Get a reference to the parent first: we're
  459. * going to make "path_put(nd->path)" valid in
  460. * non-RCU context for "terminate_walk()".
  461. *
  462. * If this doesn't work, return immediately with
  463. * RCU walking still active (and then we will do
  464. * the RCU walk cleanup in terminate_walk()).
  465. */
  466. if (!lockref_get_not_dead(&parent->d_lockref))
  467. return -ECHILD;
  468. /*
  469. * After the mntget(), we terminate_walk() will do
  470. * the right thing for non-RCU mode, and all our
  471. * subsequent exit cases should unlock_rcu_walk()
  472. * before returning.
  473. */
  474. mntget(nd->path.mnt);
  475. nd->flags &= ~LOOKUP_RCU;
  476. /*
  477. * For a negative lookup, the lookup sequence point is the parents
  478. * sequence point, and it only needs to revalidate the parent dentry.
  479. *
  480. * For a positive lookup, we need to move both the parent and the
  481. * dentry from the RCU domain to be properly refcounted. And the
  482. * sequence number in the dentry validates *both* dentry counters,
  483. * since we checked the sequence number of the parent after we got
  484. * the child sequence number. So we know the parent must still
  485. * be valid if the child sequence number is still valid.
  486. */
  487. if (!dentry) {
  488. if (read_seqcount_retry(&parent->d_seq, nd->seq))
  489. goto out;
  490. BUG_ON(nd->inode != parent->d_inode);
  491. } else {
  492. if (!lockref_get_not_dead(&dentry->d_lockref))
  493. goto out;
  494. if (read_seqcount_retry(&dentry->d_seq, nd->seq))
  495. goto drop_dentry;
  496. }
  497. /*
  498. * Sequence counts matched. Now make sure that the root is
  499. * still valid and get it if required.
  500. */
  501. if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
  502. spin_lock(&fs->lock);
  503. if (nd->root.mnt != fs->root.mnt || nd->root.dentry != fs->root.dentry)
  504. goto unlock_and_drop_dentry;
  505. path_get(&nd->root);
  506. spin_unlock(&fs->lock);
  507. }
  508. unlock_rcu_walk();
  509. return 0;
  510. unlock_and_drop_dentry:
  511. spin_unlock(&fs->lock);
  512. drop_dentry:
  513. unlock_rcu_walk();
  514. dput(dentry);
  515. goto drop_root_mnt;
  516. out:
  517. unlock_rcu_walk();
  518. drop_root_mnt:
  519. if (!(nd->flags & LOOKUP_ROOT))
  520. nd->root.mnt = NULL;
  521. return -ECHILD;
  522. }
  523. static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
  524. {
  525. return dentry->d_op->d_revalidate(dentry, flags);
  526. }
  527. /**
  528. * complete_walk - successful completion of path walk
  529. * @nd: pointer nameidata
  530. *
  531. * If we had been in RCU mode, drop out of it and legitimize nd->path.
  532. * Revalidate the final result, unless we'd already done that during
  533. * the path walk or the filesystem doesn't ask for it. Return 0 on
  534. * success, -error on failure. In case of failure caller does not
  535. * need to drop nd->path.
  536. */
  537. static int complete_walk(struct nameidata *nd)
  538. {
  539. struct dentry *dentry = nd->path.dentry;
  540. int status;
  541. if (nd->flags & LOOKUP_RCU) {
  542. nd->flags &= ~LOOKUP_RCU;
  543. if (!(nd->flags & LOOKUP_ROOT))
  544. nd->root.mnt = NULL;
  545. if (unlikely(!lockref_get_not_dead(&dentry->d_lockref))) {
  546. unlock_rcu_walk();
  547. return -ECHILD;
  548. }
  549. if (read_seqcount_retry(&dentry->d_seq, nd->seq)) {
  550. unlock_rcu_walk();
  551. dput(dentry);
  552. return -ECHILD;
  553. }
  554. mntget(nd->path.mnt);
  555. unlock_rcu_walk();
  556. }
  557. if (likely(!(nd->flags & LOOKUP_JUMPED)))
  558. return 0;
  559. if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
  560. return 0;
  561. status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
  562. if (status > 0)
  563. return 0;
  564. if (!status)
  565. status = -ESTALE;
  566. path_put(&nd->path);
  567. return status;
  568. }
  569. static __always_inline void set_root(struct nameidata *nd)
  570. {
  571. if (!nd->root.mnt)
  572. get_fs_root(current->fs, &nd->root);
  573. }
  574. static int link_path_walk(const char *, struct nameidata *);
  575. static __always_inline void set_root_rcu(struct nameidata *nd)
  576. {
  577. if (!nd->root.mnt) {
  578. struct fs_struct *fs = current->fs;
  579. unsigned seq;
  580. do {
  581. seq = read_seqcount_begin(&fs->seq);
  582. nd->root = fs->root;
  583. nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
  584. } while (read_seqcount_retry(&fs->seq, seq));
  585. }
  586. }
  587. static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
  588. {
  589. int ret;
  590. if (IS_ERR(link))
  591. goto fail;
  592. if (*link == '/') {
  593. set_root(nd);
  594. path_put(&nd->path);
  595. nd->path = nd->root;
  596. path_get(&nd->root);
  597. nd->flags |= LOOKUP_JUMPED;
  598. }
  599. nd->inode = nd->path.dentry->d_inode;
  600. ret = link_path_walk(link, nd);
  601. return ret;
  602. fail:
  603. path_put(&nd->path);
  604. return PTR_ERR(link);
  605. }
  606. static void path_put_conditional(struct path *path, struct nameidata *nd)
  607. {
  608. dput(path->dentry);
  609. if (path->mnt != nd->path.mnt)
  610. mntput(path->mnt);
  611. }
  612. static inline void path_to_nameidata(const struct path *path,
  613. struct nameidata *nd)
  614. {
  615. if (!(nd->flags & LOOKUP_RCU)) {
  616. dput(nd->path.dentry);
  617. if (nd->path.mnt != path->mnt)
  618. mntput(nd->path.mnt);
  619. }
  620. nd->path.mnt = path->mnt;
  621. nd->path.dentry = path->dentry;
  622. }
  623. /*
  624. * Helper to directly jump to a known parsed path from ->follow_link,
  625. * caller must have taken a reference to path beforehand.
  626. */
  627. void nd_jump_link(struct nameidata *nd, struct path *path)
  628. {
  629. path_put(&nd->path);
  630. nd->path = *path;
  631. nd->inode = nd->path.dentry->d_inode;
  632. nd->flags |= LOOKUP_JUMPED;
  633. }
  634. static inline void put_link(struct nameidata *nd, struct path *link, void *cookie)
  635. {
  636. struct inode *inode = link->dentry->d_inode;
  637. if (inode->i_op->put_link)
  638. inode->i_op->put_link(link->dentry, nd, cookie);
  639. path_put(link);
  640. }
  641. int sysctl_protected_symlinks __read_mostly = 0;
  642. int sysctl_protected_hardlinks __read_mostly = 0;
  643. /**
  644. * may_follow_link - Check symlink following for unsafe situations
  645. * @link: The path of the symlink
  646. * @nd: nameidata pathwalk data
  647. *
  648. * In the case of the sysctl_protected_symlinks sysctl being enabled,
  649. * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
  650. * in a sticky world-writable directory. This is to protect privileged
  651. * processes from failing races against path names that may change out
  652. * from under them by way of other users creating malicious symlinks.
  653. * It will permit symlinks to be followed only when outside a sticky
  654. * world-writable directory, or when the uid of the symlink and follower
  655. * match, or when the directory owner matches the symlink's owner.
  656. *
  657. * Returns 0 if following the symlink is allowed, -ve on error.
  658. */
  659. static inline int may_follow_link(struct path *link, struct nameidata *nd)
  660. {
  661. const struct inode *inode;
  662. const struct inode *parent;
  663. if (!sysctl_protected_symlinks)
  664. return 0;
  665. /* Allowed if owner and follower match. */
  666. inode = link->dentry->d_inode;
  667. if (uid_eq(current_cred()->fsuid, inode->i_uid))
  668. return 0;
  669. /* Allowed if parent directory not sticky and world-writable. */
  670. parent = nd->path.dentry->d_inode;
  671. if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
  672. return 0;
  673. /* Allowed if parent directory and link owner match. */
  674. if (uid_eq(parent->i_uid, inode->i_uid))
  675. return 0;
  676. audit_log_link_denied("follow_link", link);
  677. path_put_conditional(link, nd);
  678. path_put(&nd->path);
  679. return -EACCES;
  680. }
  681. /**
  682. * safe_hardlink_source - Check for safe hardlink conditions
  683. * @inode: the source inode to hardlink from
  684. *
  685. * Return false if at least one of the following conditions:
  686. * - inode is not a regular file
  687. * - inode is setuid
  688. * - inode is setgid and group-exec
  689. * - access failure for read and write
  690. *
  691. * Otherwise returns true.
  692. */
  693. static bool safe_hardlink_source(struct inode *inode)
  694. {
  695. umode_t mode = inode->i_mode;
  696. /* Special files should not get pinned to the filesystem. */
  697. if (!S_ISREG(mode))
  698. return false;
  699. /* Setuid files should not get pinned to the filesystem. */
  700. if (mode & S_ISUID)
  701. return false;
  702. /* Executable setgid files should not get pinned to the filesystem. */
  703. if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
  704. return false;
  705. /* Hardlinking to unreadable or unwritable sources is dangerous. */
  706. if (inode_permission(inode, MAY_READ | MAY_WRITE))
  707. return false;
  708. return true;
  709. }
  710. /**
  711. * may_linkat - Check permissions for creating a hardlink
  712. * @link: the source to hardlink from
  713. *
  714. * Block hardlink when all of:
  715. * - sysctl_protected_hardlinks enabled
  716. * - fsuid does not match inode
  717. * - hardlink source is unsafe (see safe_hardlink_source() above)
  718. * - not CAP_FOWNER
  719. *
  720. * Returns 0 if successful, -ve on error.
  721. */
  722. static int may_linkat(struct path *link)
  723. {
  724. const struct cred *cred;
  725. struct inode *inode;
  726. if (!sysctl_protected_hardlinks)
  727. return 0;
  728. cred = current_cred();
  729. inode = link->dentry->d_inode;
  730. /* Source inode owner (or CAP_FOWNER) can hardlink all they like,
  731. * otherwise, it must be a safe source.
  732. */
  733. if (uid_eq(cred->fsuid, inode->i_uid) || safe_hardlink_source(inode) ||
  734. capable(CAP_FOWNER))
  735. return 0;
  736. audit_log_link_denied("linkat", link);
  737. return -EPERM;
  738. }
  739. static __always_inline int
  740. follow_link(struct path *link, struct nameidata *nd, void **p)
  741. {
  742. struct dentry *dentry = link->dentry;
  743. int error;
  744. char *s;
  745. BUG_ON(nd->flags & LOOKUP_RCU);
  746. if (link->mnt == nd->path.mnt)
  747. mntget(link->mnt);
  748. error = -ELOOP;
  749. if (unlikely(current->total_link_count >= 40))
  750. goto out_put_nd_path;
  751. cond_resched();
  752. current->total_link_count++;
  753. touch_atime(link);
  754. nd_set_link(nd, NULL);
  755. error = security_inode_follow_link(link->dentry, nd);
  756. if (error)
  757. goto out_put_nd_path;
  758. nd->last_type = LAST_BIND;
  759. *p = dentry->d_inode->i_op->follow_link(dentry, nd);
  760. error = PTR_ERR(*p);
  761. if (IS_ERR(*p))
  762. goto out_put_nd_path;
  763. error = 0;
  764. s = nd_get_link(nd);
  765. if (s) {
  766. error = __vfs_follow_link(nd, s);
  767. if (unlikely(error))
  768. put_link(nd, link, *p);
  769. }
  770. return error;
  771. out_put_nd_path:
  772. *p = NULL;
  773. path_put(&nd->path);
  774. path_put(link);
  775. return error;
  776. }
  777. static int follow_up_rcu(struct path *path)
  778. {
  779. struct mount *mnt = real_mount(path->mnt);
  780. struct mount *parent;
  781. struct dentry *mountpoint;
  782. parent = mnt->mnt_parent;
  783. if (&parent->mnt == path->mnt)
  784. return 0;
  785. mountpoint = mnt->mnt_mountpoint;
  786. path->dentry = mountpoint;
  787. path->mnt = &parent->mnt;
  788. return 1;
  789. }
  790. /*
  791. * follow_up - Find the mountpoint of path's vfsmount
  792. *
  793. * Given a path, find the mountpoint of its source file system.
  794. * Replace @path with the path of the mountpoint in the parent mount.
  795. * Up is towards /.
  796. *
  797. * Return 1 if we went up a level and 0 if we were already at the
  798. * root.
  799. */
  800. int follow_up(struct path *path)
  801. {
  802. struct mount *mnt = real_mount(path->mnt);
  803. struct mount *parent;
  804. struct dentry *mountpoint;
  805. br_read_lock(&vfsmount_lock);
  806. parent = mnt->mnt_parent;
  807. if (parent == mnt) {
  808. br_read_unlock(&vfsmount_lock);
  809. return 0;
  810. }
  811. mntget(&parent->mnt);
  812. mountpoint = dget(mnt->mnt_mountpoint);
  813. br_read_unlock(&vfsmount_lock);
  814. dput(path->dentry);
  815. path->dentry = mountpoint;
  816. mntput(path->mnt);
  817. path->mnt = &parent->mnt;
  818. return 1;
  819. }
  820. /*
  821. * Perform an automount
  822. * - return -EISDIR to tell follow_managed() to stop and return the path we
  823. * were called with.
  824. */
  825. static int follow_automount(struct path *path, unsigned flags,
  826. bool *need_mntput)
  827. {
  828. struct vfsmount *mnt;
  829. int err;
  830. if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
  831. return -EREMOTE;
  832. /* We don't want to mount if someone's just doing a stat -
  833. * unless they're stat'ing a directory and appended a '/' to
  834. * the name.
  835. *
  836. * We do, however, want to mount if someone wants to open or
  837. * create a file of any type under the mountpoint, wants to
  838. * traverse through the mountpoint or wants to open the
  839. * mounted directory. Also, autofs may mark negative dentries
  840. * as being automount points. These will need the attentions
  841. * of the daemon to instantiate them before they can be used.
  842. */
  843. if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
  844. LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
  845. path->dentry->d_inode)
  846. return -EISDIR;
  847. current->total_link_count++;
  848. if (current->total_link_count >= 40)
  849. return -ELOOP;
  850. mnt = path->dentry->d_op->d_automount(path);
  851. if (IS_ERR(mnt)) {
  852. /*
  853. * The filesystem is allowed to return -EISDIR here to indicate
  854. * it doesn't want to automount. For instance, autofs would do
  855. * this so that its userspace daemon can mount on this dentry.
  856. *
  857. * However, we can only permit this if it's a terminal point in
  858. * the path being looked up; if it wasn't then the remainder of
  859. * the path is inaccessible and we should say so.
  860. */
  861. if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT))
  862. return -EREMOTE;
  863. return PTR_ERR(mnt);
  864. }
  865. if (!mnt) /* mount collision */
  866. return 0;
  867. if (!*need_mntput) {
  868. /* lock_mount() may release path->mnt on error */
  869. mntget(path->mnt);
  870. *need_mntput = true;
  871. }
  872. err = finish_automount(mnt, path);
  873. switch (err) {
  874. case -EBUSY:
  875. /* Someone else made a mount here whilst we were busy */
  876. return 0;
  877. case 0:
  878. path_put(path);
  879. path->mnt = mnt;
  880. path->dentry = dget(mnt->mnt_root);
  881. return 0;
  882. default:
  883. return err;
  884. }
  885. }
  886. /*
  887. * Handle a dentry that is managed in some way.
  888. * - Flagged for transit management (autofs)
  889. * - Flagged as mountpoint
  890. * - Flagged as automount point
  891. *
  892. * This may only be called in refwalk mode.
  893. *
  894. * Serialization is taken care of in namespace.c
  895. */
  896. static int follow_managed(struct path *path, unsigned flags)
  897. {
  898. struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */
  899. unsigned managed;
  900. bool need_mntput = false;
  901. int ret = 0;
  902. /* Given that we're not holding a lock here, we retain the value in a
  903. * local variable for each dentry as we look at it so that we don't see
  904. * the components of that value change under us */
  905. while (managed = ACCESS_ONCE(path->dentry->d_flags),
  906. managed &= DCACHE_MANAGED_DENTRY,
  907. unlikely(managed != 0)) {
  908. /* Allow the filesystem to manage the transit without i_mutex
  909. * being held. */
  910. if (managed & DCACHE_MANAGE_TRANSIT) {
  911. BUG_ON(!path->dentry->d_op);
  912. BUG_ON(!path->dentry->d_op->d_manage);
  913. ret = path->dentry->d_op->d_manage(path->dentry, false);
  914. if (ret < 0)
  915. break;
  916. }
  917. /* Transit to a mounted filesystem. */
  918. if (managed & DCACHE_MOUNTED) {
  919. struct vfsmount *mounted = lookup_mnt(path);
  920. if (mounted) {
  921. dput(path->dentry);
  922. if (need_mntput)
  923. mntput(path->mnt);
  924. path->mnt = mounted;
  925. path->dentry = dget(mounted->mnt_root);
  926. need_mntput = true;
  927. continue;
  928. }
  929. /* Something is mounted on this dentry in another
  930. * namespace and/or whatever was mounted there in this
  931. * namespace got unmounted before we managed to get the
  932. * vfsmount_lock */
  933. }
  934. /* Handle an automount point */
  935. if (managed & DCACHE_NEED_AUTOMOUNT) {
  936. ret = follow_automount(path, flags, &need_mntput);
  937. if (ret < 0)
  938. break;
  939. continue;
  940. }
  941. /* We didn't change the current path point */
  942. break;
  943. }
  944. if (need_mntput && path->mnt == mnt)
  945. mntput(path->mnt);
  946. if (ret == -EISDIR)
  947. ret = 0;
  948. return ret < 0 ? ret : need_mntput;
  949. }
  950. int follow_down_one(struct path *path)
  951. {
  952. struct vfsmount *mounted;
  953. mounted = lookup_mnt(path);
  954. if (mounted) {
  955. dput(path->dentry);
  956. mntput(path->mnt);
  957. path->mnt = mounted;
  958. path->dentry = dget(mounted->mnt_root);
  959. return 1;
  960. }
  961. return 0;
  962. }
  963. static inline bool managed_dentry_might_block(struct dentry *dentry)
  964. {
  965. return (dentry->d_flags & DCACHE_MANAGE_TRANSIT &&
  966. dentry->d_op->d_manage(dentry, true) < 0);
  967. }
  968. /*
  969. * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if
  970. * we meet a managed dentry that would need blocking.
  971. */
  972. static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
  973. struct inode **inode)
  974. {
  975. for (;;) {
  976. struct mount *mounted;
  977. /*
  978. * Don't forget we might have a non-mountpoint managed dentry
  979. * that wants to block transit.
  980. */
  981. if (unlikely(managed_dentry_might_block(path->dentry)))
  982. return false;
  983. if (!d_mountpoint(path->dentry))
  984. break;
  985. mounted = __lookup_mnt(path->mnt, path->dentry, 1);
  986. if (!mounted)
  987. break;
  988. path->mnt = &mounted->mnt;
  989. path->dentry = mounted->mnt.mnt_root;
  990. nd->flags |= LOOKUP_JUMPED;
  991. nd->seq = read_seqcount_begin(&path->dentry->d_seq);
  992. /*
  993. * Update the inode too. We don't need to re-check the
  994. * dentry sequence number here after this d_inode read,
  995. * because a mount-point is always pinned.
  996. */
  997. *inode = path->dentry->d_inode;
  998. }
  999. return true;
  1000. }
  1001. static void follow_mount_rcu(struct nameidata *nd)
  1002. {
  1003. while (d_mountpoint(nd->path.dentry)) {
  1004. struct mount *mounted;
  1005. mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry, 1);
  1006. if (!mounted)
  1007. break;
  1008. nd->path.mnt = &mounted->mnt;
  1009. nd->path.dentry = mounted->mnt.mnt_root;
  1010. nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
  1011. }
  1012. }
  1013. static int follow_dotdot_rcu(struct nameidata *nd)
  1014. {
  1015. set_root_rcu(nd);
  1016. while (1) {
  1017. if (nd->path.dentry == nd->root.dentry &&
  1018. nd->path.mnt == nd->root.mnt) {
  1019. break;
  1020. }
  1021. if (nd->path.dentry != nd->path.mnt->mnt_root) {
  1022. struct dentry *old = nd->path.dentry;
  1023. struct dentry *parent = old->d_parent;
  1024. unsigned seq;
  1025. seq = read_seqcount_begin(&parent->d_seq);
  1026. if (read_seqcount_retry(&old->d_seq, nd->seq))
  1027. goto failed;
  1028. nd->path.dentry = parent;
  1029. nd->seq = seq;
  1030. break;
  1031. }
  1032. if (!follow_up_rcu(&nd->path))
  1033. break;
  1034. nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
  1035. }
  1036. follow_mount_rcu(nd);
  1037. nd->inode = nd->path.dentry->d_inode;
  1038. return 0;
  1039. failed:
  1040. nd->flags &= ~LOOKUP_RCU;
  1041. if (!(nd->flags & LOOKUP_ROOT))
  1042. nd->root.mnt = NULL;
  1043. unlock_rcu_walk();
  1044. return -ECHILD;
  1045. }
  1046. /*
  1047. * Follow down to the covering mount currently visible to userspace. At each
  1048. * point, the filesystem owning that dentry may be queried as to whether the
  1049. * caller is permitted to proceed or not.
  1050. */
  1051. int follow_down(struct path *path)
  1052. {
  1053. unsigned managed;
  1054. int ret;
  1055. while (managed = ACCESS_ONCE(path->dentry->d_flags),
  1056. unlikely(managed & DCACHE_MANAGED_DENTRY)) {
  1057. /* Allow the filesystem to manage the transit without i_mutex
  1058. * being held.
  1059. *
  1060. * We indicate to the filesystem if someone is trying to mount
  1061. * something here. This gives autofs the chance to deny anyone
  1062. * other than its daemon the right to mount on its
  1063. * superstructure.
  1064. *
  1065. * The filesystem may sleep at this point.
  1066. */
  1067. if (managed & DCACHE_MANAGE_TRANSIT) {
  1068. BUG_ON(!path->dentry->d_op);
  1069. BUG_ON(!path->dentry->d_op->d_manage);
  1070. ret = path->dentry->d_op->d_manage(
  1071. path->dentry, false);
  1072. if (ret < 0)
  1073. return ret == -EISDIR ? 0 : ret;
  1074. }
  1075. /* Transit to a mounted filesystem. */
  1076. if (managed & DCACHE_MOUNTED) {
  1077. struct vfsmount *mounted = lookup_mnt(path);
  1078. if (!mounted)
  1079. break;
  1080. dput(path->dentry);
  1081. mntput(path->mnt);
  1082. path->mnt = mounted;
  1083. path->dentry = dget(mounted->mnt_root);
  1084. continue;
  1085. }
  1086. /* Don't handle automount points here */
  1087. break;
  1088. }
  1089. return 0;
  1090. }
  1091. /*
  1092. * Skip to top of mountpoint pile in refwalk mode for follow_dotdot()
  1093. */
  1094. static void follow_mount(struct path *path)
  1095. {
  1096. while (d_mountpoint(path->dentry)) {
  1097. struct vfsmount *mounted = lookup_mnt(path);
  1098. if (!mounted)
  1099. break;
  1100. dput(path->dentry);
  1101. mntput(path->mnt);
  1102. path->mnt = mounted;
  1103. path->dentry = dget(mounted->mnt_root);
  1104. }
  1105. }
  1106. static void follow_dotdot(struct nameidata *nd)
  1107. {
  1108. set_root(nd);
  1109. while(1) {
  1110. struct dentry *old = nd->path.dentry;
  1111. if (nd->path.dentry == nd->root.dentry &&
  1112. nd->path.mnt == nd->root.mnt) {
  1113. break;
  1114. }
  1115. if (nd->path.dentry != nd->path.mnt->mnt_root) {
  1116. /* rare case of legitimate dget_parent()... */
  1117. nd->path.dentry = dget_parent(nd->path.dentry);
  1118. dput(old);
  1119. break;
  1120. }
  1121. if (!follow_up(&nd->path))
  1122. break;
  1123. }
  1124. follow_mount(&nd->path);
  1125. nd->inode = nd->path.dentry->d_inode;
  1126. }
  1127. /*
  1128. * This looks up the name in dcache, possibly revalidates the old dentry and
  1129. * allocates a new one if not found or not valid. In the need_lookup argument
  1130. * returns whether i_op->lookup is necessary.
  1131. *
  1132. * dir->d_inode->i_mutex must be held
  1133. */
  1134. static struct dentry *lookup_dcache(struct qstr *name, struct dentry *dir,
  1135. unsigned int flags, bool *need_lookup)
  1136. {
  1137. struct dentry *dentry;
  1138. int error;
  1139. *need_lookup = false;
  1140. dentry = d_lookup(dir, name);
  1141. if (dentry) {
  1142. if (dentry->d_flags & DCACHE_OP_REVALIDATE) {
  1143. error = d_revalidate(dentry, flags);
  1144. if (unlikely(error <= 0)) {
  1145. if (error < 0) {
  1146. dput(dentry);
  1147. return ERR_PTR(error);
  1148. } else if (!d_invalidate(dentry)) {
  1149. dput(dentry);
  1150. dentry = NULL;
  1151. }
  1152. }
  1153. }
  1154. }
  1155. if (!dentry) {
  1156. dentry = d_alloc(dir, name);
  1157. if (unlikely(!dentry))
  1158. return ERR_PTR(-ENOMEM);
  1159. *need_lookup = true;
  1160. }
  1161. return dentry;
  1162. }
  1163. /*
  1164. * Call i_op->lookup on the dentry. The dentry must be negative but may be
  1165. * hashed if it was pouplated with DCACHE_NEED_LOOKUP.
  1166. *
  1167. * dir->d_inode->i_mutex must be held
  1168. */
  1169. static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry,
  1170. unsigned int flags)
  1171. {
  1172. struct dentry *old;
  1173. /* Don't create child dentry for a dead directory. */
  1174. if (unlikely(IS_DEADDIR(dir))) {
  1175. dput(dentry);
  1176. return ERR_PTR(-ENOENT);
  1177. }
  1178. old = dir->i_op->lookup(dir, dentry, flags);
  1179. if (unlikely(old)) {
  1180. dput(dentry);
  1181. dentry = old;
  1182. }
  1183. return dentry;
  1184. }
  1185. static struct dentry *__lookup_hash(struct qstr *name,
  1186. struct dentry *base, unsigned int flags)
  1187. {
  1188. bool need_lookup;
  1189. struct dentry *dentry;
  1190. dentry = lookup_dcache(name, base, flags, &need_lookup);
  1191. if (!need_lookup)
  1192. return dentry;
  1193. return lookup_real(base->d_inode, dentry, flags);
  1194. }
  1195. /*
  1196. * It's more convoluted than I'd like it to be, but... it's still fairly
  1197. * small and for now I'd prefer to have fast path as straight as possible.
  1198. * It _is_ time-critical.
  1199. */
  1200. static int lookup_fast(struct nameidata *nd,
  1201. struct path *path, struct inode **inode)
  1202. {
  1203. struct vfsmount *mnt = nd->path.mnt;
  1204. struct dentry *dentry, *parent = nd->path.dentry;
  1205. int need_reval = 1;
  1206. int status = 1;
  1207. int err;
  1208. /*
  1209. * Rename seqlock is not required here because in the off chance
  1210. * of a false negative due to a concurrent rename, we're going to
  1211. * do the non-racy lookup, below.
  1212. */
  1213. if (nd->flags & LOOKUP_RCU) {
  1214. unsigned seq;
  1215. dentry = __d_lookup_rcu(parent, &nd->last, &seq);
  1216. if (!dentry)
  1217. goto unlazy;
  1218. /*
  1219. * This sequence count validates that the inode matches
  1220. * the dentry name information from lookup.
  1221. */
  1222. *inode = dentry->d_inode;
  1223. if (read_seqcount_retry(&dentry->d_seq, seq))
  1224. return -ECHILD;
  1225. /*
  1226. * This sequence count validates that the parent had no
  1227. * changes while we did the lookup of the dentry above.
  1228. *
  1229. * The memory barrier in read_seqcount_begin of child is
  1230. * enough, we can use __read_seqcount_retry here.
  1231. */
  1232. if (__read_seqcount_retry(&parent->d_seq, nd->seq))
  1233. return -ECHILD;
  1234. nd->seq = seq;
  1235. if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) {
  1236. status = d_revalidate(dentry, nd->flags);
  1237. if (unlikely(status <= 0)) {
  1238. if (status != -ECHILD)
  1239. need_reval = 0;
  1240. goto unlazy;
  1241. }
  1242. }
  1243. path->mnt = mnt;
  1244. path->dentry = dentry;
  1245. if (unlikely(!__follow_mount_rcu(nd, path, inode)))
  1246. goto unlazy;
  1247. if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT))
  1248. goto unlazy;
  1249. return 0;
  1250. unlazy:
  1251. if (unlazy_walk(nd, dentry))
  1252. return -ECHILD;
  1253. } else {
  1254. dentry = __d_lookup(parent, &nd->last);
  1255. }
  1256. if (unlikely(!dentry))
  1257. goto need_lookup;
  1258. if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval)
  1259. status = d_revalidate(dentry, nd->flags);
  1260. if (unlikely(status <= 0)) {
  1261. if (status < 0) {
  1262. dput(dentry);
  1263. return status;
  1264. }
  1265. if (!d_invalidate(dentry)) {
  1266. dput(dentry);
  1267. goto need_lookup;
  1268. }
  1269. }
  1270. path->mnt = mnt;
  1271. path->dentry = dentry;
  1272. err = follow_managed(path, nd->flags);
  1273. if (unlikely(err < 0)) {
  1274. path_put_conditional(path, nd);
  1275. return err;
  1276. }
  1277. if (err)
  1278. nd->flags |= LOOKUP_JUMPED;
  1279. *inode = path->dentry->d_inode;
  1280. return 0;
  1281. need_lookup:
  1282. return 1;
  1283. }
  1284. /* Fast lookup failed, do it the slow way */
  1285. static int lookup_slow(struct nameidata *nd, struct path *path)
  1286. {
  1287. struct dentry *dentry, *parent;
  1288. int err;
  1289. parent = nd->path.dentry;
  1290. BUG_ON(nd->inode != parent->d_inode);
  1291. mutex_lock(&parent->d_inode->i_mutex);
  1292. dentry = __lookup_hash(&nd->last, parent, nd->flags);
  1293. mutex_unlock(&parent->d_inode->i_mutex);
  1294. if (IS_ERR(dentry))
  1295. return PTR_ERR(dentry);
  1296. path->mnt = nd->path.mnt;
  1297. path->dentry = dentry;
  1298. err = follow_managed(path, nd->flags);
  1299. if (unlikely(err < 0)) {
  1300. path_put_conditional(path, nd);
  1301. return err;
  1302. }
  1303. if (err)
  1304. nd->flags |= LOOKUP_JUMPED;
  1305. return 0;
  1306. }
  1307. static inline int may_lookup(struct nameidata *nd)
  1308. {
  1309. if (nd->flags & LOOKUP_RCU) {
  1310. int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
  1311. if (err != -ECHILD)
  1312. return err;
  1313. if (unlazy_walk(nd, NULL))
  1314. return -ECHILD;
  1315. }
  1316. return inode_permission(nd->inode, MAY_EXEC);
  1317. }
  1318. static inline int handle_dots(struct nameidata *nd, int type)
  1319. {
  1320. if (type == LAST_DOTDOT) {
  1321. if (nd->flags & LOOKUP_RCU) {
  1322. if (follow_dotdot_rcu(nd))
  1323. return -ECHILD;
  1324. } else
  1325. follow_dotdot(nd);
  1326. }
  1327. return 0;
  1328. }
  1329. static void terminate_walk(struct nameidata *nd)
  1330. {
  1331. if (!(nd->flags & LOOKUP_RCU)) {
  1332. path_put(&nd->path);
  1333. } else {
  1334. nd->flags &= ~LOOKUP_RCU;
  1335. if (!(nd->flags & LOOKUP_ROOT))
  1336. nd->root.mnt = NULL;
  1337. unlock_rcu_walk();
  1338. }
  1339. }
  1340. /*
  1341. * Do we need to follow links? We _really_ want to be able
  1342. * to do this check without having to look at inode->i_op,
  1343. * so we keep a cache of "no, this doesn't need follow_link"
  1344. * for the common case.
  1345. */
  1346. static inline int should_follow_link(struct inode *inode, int follow)
  1347. {
  1348. if (unlikely(!(inode->i_opflags & IOP_NOFOLLOW))) {
  1349. if (likely(inode->i_op->follow_link))
  1350. return follow;
  1351. /* This gets set once for the inode lifetime */
  1352. spin_lock(&inode->i_lock);
  1353. inode->i_opflags |= IOP_NOFOLLOW;
  1354. spin_unlock(&inode->i_lock);
  1355. }
  1356. return 0;
  1357. }
  1358. static inline int walk_component(struct nameidata *nd, struct path *path,
  1359. int follow)
  1360. {
  1361. struct inode *inode;
  1362. int err;
  1363. /*
  1364. * "." and ".." are special - ".." especially so because it has
  1365. * to be able to know about the current root directory and
  1366. * parent relationships.
  1367. */
  1368. if (unlikely(nd->last_type != LAST_NORM))
  1369. return handle_dots(nd, nd->last_type);
  1370. err = lookup_fast(nd, path, &inode);
  1371. if (unlikely(err)) {
  1372. if (err < 0)
  1373. goto out_err;
  1374. err = lookup_slow(nd, path);
  1375. if (err < 0)
  1376. goto out_err;
  1377. inode = path->dentry->d_inode;
  1378. }
  1379. err = -ENOENT;
  1380. if (!inode)
  1381. goto out_path_put;
  1382. if (should_follow_link(inode, follow)) {
  1383. if (nd->flags & LOOKUP_RCU) {
  1384. if (unlikely(unlazy_walk(nd, path->dentry))) {
  1385. err = -ECHILD;
  1386. goto out_err;
  1387. }
  1388. }
  1389. BUG_ON(inode != path->dentry->d_inode);
  1390. return 1;
  1391. }
  1392. path_to_nameidata(path, nd);
  1393. nd->inode = inode;
  1394. return 0;
  1395. out_path_put:
  1396. path_to_nameidata(path, nd);
  1397. out_err:
  1398. terminate_walk(nd);
  1399. return err;
  1400. }
  1401. /*
  1402. * This limits recursive symlink follows to 8, while
  1403. * limiting consecutive symlinks to 40.
  1404. *
  1405. * Without that kind of total limit, nasty chains of consecutive
  1406. * symlinks can cause almost arbitrarily long lookups.
  1407. */
  1408. static inline int nested_symlink(struct path *path, struct nameidata *nd)
  1409. {
  1410. int res;
  1411. if (unlikely(current->link_count >= MAX_NESTED_LINKS)) {
  1412. path_put_conditional(path, nd);
  1413. path_put(&nd->path);
  1414. return -ELOOP;
  1415. }
  1416. BUG_ON(nd->depth >= MAX_NESTED_LINKS);
  1417. nd->depth++;
  1418. current->link_count++;
  1419. do {
  1420. struct path link = *path;
  1421. void *cookie;
  1422. res = follow_link(&link, nd, &cookie);
  1423. if (res)
  1424. break;
  1425. res = walk_component(nd, path, LOOKUP_FOLLOW);
  1426. put_link(nd, &link, cookie);
  1427. } while (res > 0);
  1428. current->link_count--;
  1429. nd->depth--;
  1430. return res;
  1431. }
  1432. /*
  1433. * We really don't want to look at inode->i_op->lookup
  1434. * when we don't have to. So we keep a cache bit in
  1435. * the inode ->i_opflags field that says "yes, we can
  1436. * do lookup on this inode".
  1437. */
  1438. static inline int can_lookup(struct inode *inode)
  1439. {
  1440. if (likely(inode->i_opflags & IOP_LOOKUP))
  1441. return 1;
  1442. if (likely(!inode->i_op->lookup))
  1443. return 0;
  1444. /* We do this once for the lifetime of the inode */
  1445. spin_lock(&inode->i_lock);
  1446. inode->i_opflags |= IOP_LOOKUP;
  1447. spin_unlock(&inode->i_lock);
  1448. return 1;
  1449. }
  1450. /*
  1451. * We can do the critical dentry name comparison and hashing
  1452. * operations one word at a time, but we are limited to:
  1453. *
  1454. * - Architectures with fast unaligned word accesses. We could
  1455. * do a "get_unaligned()" if this helps and is sufficiently
  1456. * fast.
  1457. *
  1458. * - Little-endian machines (so that we can generate the mask
  1459. * of low bytes efficiently). Again, we *could* do a byte
  1460. * swapping load on big-endian architectures if that is not
  1461. * expensive enough to make the optimization worthless.
  1462. *
  1463. * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
  1464. * do not trap on the (extremely unlikely) case of a page
  1465. * crossing operation.
  1466. *
  1467. * - Furthermore, we need an efficient 64-bit compile for the
  1468. * 64-bit case in order to generate the "number of bytes in
  1469. * the final mask". Again, that could be replaced with a
  1470. * efficient population count instruction or similar.
  1471. */
  1472. #ifdef CONFIG_DCACHE_WORD_ACCESS
  1473. #include <asm/word-at-a-time.h>
  1474. #ifdef CONFIG_64BIT
  1475. static inline unsigned int fold_hash(unsigned long hash)
  1476. {
  1477. hash += hash >> (8*sizeof(int));
  1478. return hash;
  1479. }
  1480. #else /* 32-bit case */
  1481. #define fold_hash(x) (x)
  1482. #endif
  1483. unsigned int full_name_hash(const unsigned char *name, unsigned int len)
  1484. {
  1485. unsigned long a, mask;
  1486. unsigned long hash = 0;
  1487. for (;;) {
  1488. a = load_unaligned_zeropad(name);
  1489. if (len < sizeof(unsigned long))
  1490. break;
  1491. hash += a;
  1492. hash *= 9;
  1493. name += sizeof(unsigned long);
  1494. len -= sizeof(unsigned long);
  1495. if (!len)
  1496. goto done;
  1497. }
  1498. mask = ~(~0ul << len*8);
  1499. hash += mask & a;
  1500. done:
  1501. return fold_hash(hash);
  1502. }
  1503. EXPORT_SYMBOL(full_name_hash);
  1504. /*
  1505. * Calculate the length and hash of the path component, and
  1506. * return the length of the component;
  1507. */
  1508. static inline unsigned long hash_name(const char *name, unsigned int *hashp)
  1509. {
  1510. unsigned long a, b, adata, bdata, mask, hash, len;
  1511. const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
  1512. hash = a = 0;
  1513. len = -sizeof(unsigned long);
  1514. do {
  1515. hash = (hash + a) * 9;
  1516. len += sizeof(unsigned long);
  1517. a = load_unaligned_zeropad(name+len);
  1518. b = a ^ REPEAT_BYTE('/');
  1519. } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
  1520. adata = prep_zero_mask(a, adata, &constants);
  1521. bdata = prep_zero_mask(b, bdata, &constants);
  1522. mask = create_zero_mask(adata | bdata);
  1523. hash += a & zero_bytemask(mask);
  1524. *hashp = fold_hash(hash);
  1525. return len + find_zero(mask);
  1526. }
  1527. #else
  1528. unsigned int full_name_hash(const unsigned char *name, unsigned int len)
  1529. {
  1530. unsigned long hash = init_name_hash();
  1531. while (len--)
  1532. hash = partial_name_hash(*name++, hash);
  1533. return end_name_hash(hash);
  1534. }
  1535. EXPORT_SYMBOL(full_name_hash);
  1536. /*
  1537. * We know there's a real path component here of at least
  1538. * one character.
  1539. */
  1540. static inline unsigned long hash_name(const char *name, unsigned int *hashp)
  1541. {
  1542. unsigned long hash = init_name_hash();
  1543. unsigned long len = 0, c;
  1544. c = (unsigned char)*name;
  1545. do {
  1546. len++;
  1547. hash = partial_name_hash(c, hash);
  1548. c = (unsigned char)name[len];
  1549. } while (c && c != '/');
  1550. *hashp = end_name_hash(hash);
  1551. return len;
  1552. }
  1553. #endif
  1554. /*
  1555. * Name resolution.
  1556. * This is the basic name resolution function, turning a pathname into
  1557. * the final dentry. We expect 'base' to be positive and a directory.
  1558. *
  1559. * Returns 0 and nd will have valid dentry and mnt on success.
  1560. * Returns error and drops reference to input namei data on failure.
  1561. */
  1562. static int link_path_walk(const char *name, struct nameidata *nd)
  1563. {
  1564. struct path next;
  1565. int err;
  1566. while (*name=='/')
  1567. name++;
  1568. if (!*name)
  1569. return 0;
  1570. /* At this point we know we have a real path component. */
  1571. for(;;) {
  1572. struct qstr this;
  1573. long len;
  1574. int type;
  1575. err = may_lookup(nd);
  1576. if (err)
  1577. break;
  1578. len = hash_name(name, &this.hash);
  1579. this.name = name;
  1580. this.len = len;
  1581. type = LAST_NORM;
  1582. if (name[0] == '.') switch (len) {
  1583. case 2:
  1584. if (name[1] == '.') {
  1585. type = LAST_DOTDOT;
  1586. nd->flags |= LOOKUP_JUMPED;
  1587. }
  1588. break;
  1589. case 1:
  1590. type = LAST_DOT;
  1591. }
  1592. if (likely(type == LAST_NORM)) {
  1593. struct dentry *parent = nd->path.dentry;
  1594. nd->flags &= ~LOOKUP_JUMPED;
  1595. if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
  1596. err = parent->d_op->d_hash(parent, &this);
  1597. if (err < 0)
  1598. break;
  1599. }
  1600. }
  1601. nd->last = this;
  1602. nd->last_type = type;
  1603. if (!name[len])
  1604. return 0;
  1605. /*
  1606. * If it wasn't NUL, we know it was '/'. Skip that
  1607. * slash, and continue until no more slashes.
  1608. */
  1609. do {
  1610. len++;
  1611. } while (unlikely(name[len] == '/'));
  1612. if (!name[len])
  1613. return 0;
  1614. name += len;
  1615. err = walk_component(nd, &next, LOOKUP_FOLLOW);
  1616. if (err < 0)
  1617. return err;
  1618. if (err) {
  1619. err = nested_symlink(&next, nd);
  1620. if (err)
  1621. return err;
  1622. }
  1623. if (!can_lookup(nd->inode)) {
  1624. err = -ENOTDIR;
  1625. break;
  1626. }
  1627. }
  1628. terminate_walk(nd);
  1629. return err;
  1630. }
  1631. static int path_init(int dfd, const char *name, unsigned int flags,
  1632. struct nameidata *nd, struct file **fp)
  1633. {
  1634. int retval = 0;
  1635. nd->last_type = LAST_ROOT; /* if there are only slashes... */
  1636. nd->flags = flags | LOOKUP_JUMPED;
  1637. nd->depth = 0;
  1638. if (flags & LOOKUP_ROOT) {
  1639. struct inode *inode = nd->root.dentry->d_inode;
  1640. if (*name) {
  1641. if (!can_lookup(inode))
  1642. return -ENOTDIR;
  1643. retval = inode_permission(inode, MAY_EXEC);
  1644. if (retval)
  1645. return retval;
  1646. }
  1647. nd->path = nd->root;
  1648. nd->inode = inode;
  1649. if (flags & LOOKUP_RCU) {
  1650. lock_rcu_walk();
  1651. nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
  1652. } else {
  1653. path_get(&nd->path);
  1654. }
  1655. return 0;
  1656. }
  1657. nd->root.mnt = NULL;
  1658. if (*name=='/') {
  1659. if (flags & LOOKUP_RCU) {
  1660. lock_rcu_walk();
  1661. set_root_rcu(nd);
  1662. } else {
  1663. set_root(nd);
  1664. path_get(&nd->root);
  1665. }
  1666. nd->path = nd->root;
  1667. } else if (dfd == AT_FDCWD) {
  1668. if (flags & LOOKUP_RCU) {
  1669. struct fs_struct *fs = current->fs;
  1670. unsigned seq;
  1671. lock_rcu_walk();
  1672. do {
  1673. seq = read_seqcount_begin(&fs->seq);
  1674. nd->path = fs->pwd;
  1675. nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
  1676. } while (read_seqcount_retry(&fs->seq, seq));
  1677. } else {
  1678. get_fs_pwd(current->fs, &nd->path);
  1679. }
  1680. } else {
  1681. /* Caller must check execute permissions on the starting path component */
  1682. struct fd f = fdget_raw(dfd);
  1683. struct dentry *dentry;
  1684. if (!f.file)
  1685. return -EBADF;
  1686. dentry = f.file->f_path.dentry;
  1687. if (*name) {
  1688. if (!can_lookup(dentry->d_inode)) {
  1689. fdput(f);
  1690. return -ENOTDIR;
  1691. }
  1692. }
  1693. nd->path = f.file->f_path;
  1694. if (flags & LOOKUP_RCU) {
  1695. if (f.need_put)
  1696. *fp = f.file;
  1697. nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
  1698. lock_rcu_walk();
  1699. } else {
  1700. path_get(&nd->path);
  1701. fdput(f);
  1702. }
  1703. }
  1704. nd->inode = nd->path.dentry->d_inode;
  1705. return 0;
  1706. }
  1707. static inline int lookup_last(struct nameidata *nd, struct path *path)
  1708. {
  1709. if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
  1710. nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
  1711. nd->flags &= ~LOOKUP_PARENT;
  1712. return walk_component(nd, path, nd->flags & LOOKUP_FOLLOW);
  1713. }
  1714. /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
  1715. static int path_lookupat(int dfd, const char *name,
  1716. unsigned int flags, struct nameidata *nd)
  1717. {
  1718. struct file *base = NULL;
  1719. struct path path;
  1720. int err;
  1721. /*
  1722. * Path walking is largely split up into 2 different synchronisation
  1723. * schemes, rcu-walk and ref-walk (explained in
  1724. * Documentation/filesystems/path-lookup.txt). These share much of the
  1725. * path walk code, but some things particularly setup, cleanup, and
  1726. * following mounts are sufficiently divergent that functions are
  1727. * duplicated. Typically there is a function foo(), and its RCU
  1728. * analogue, foo_rcu().
  1729. *
  1730. * -ECHILD is the error number of choice (just to avoid clashes) that
  1731. * is returned if some aspect of an rcu-walk fails. Such an error must
  1732. * be handled by restarting a traditional ref-walk (which will always
  1733. * be able to complete).
  1734. */
  1735. err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base);
  1736. if (unlikely(err))
  1737. return err;
  1738. current->total_link_count = 0;
  1739. err = link_path_walk(name, nd);
  1740. if (!err && !(flags & LOOKUP_PARENT)) {
  1741. err = lookup_last(nd, &path);
  1742. while (err > 0) {
  1743. void *cookie;
  1744. struct path link = path;
  1745. err = may_follow_link(&link, nd);
  1746. if (unlikely(err))
  1747. break;
  1748. nd->flags |= LOOKUP_PARENT;
  1749. err = follow_link(&link, nd, &cookie);
  1750. if (err)
  1751. break;
  1752. err = lookup_last(nd, &path);
  1753. put_link(nd, &link, cookie);
  1754. }
  1755. }
  1756. if (!err)
  1757. err = complete_walk(nd);
  1758. if (!err && nd->flags & LOOKUP_DIRECTORY) {
  1759. if (!can_lookup(nd->inode)) {
  1760. path_put(&nd->path);
  1761. err = -ENOTDIR;
  1762. }
  1763. }
  1764. if (base)
  1765. fput(base);
  1766. if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
  1767. path_put(&nd->root);
  1768. nd->root.mnt = NULL;
  1769. }
  1770. return err;
  1771. }
  1772. static int filename_lookup(int dfd, struct filename *name,
  1773. unsigned int flags, struct nameidata *nd)
  1774. {
  1775. int retval = path_lookupat(dfd, name->name, flags | LOOKUP_RCU, nd);
  1776. if (unlikely(retval == -ECHILD))
  1777. retval = path_lookupat(dfd, name->name, flags, nd);
  1778. if (unlikely(retval == -ESTALE))
  1779. retval = path_lookupat(dfd, name->name,
  1780. flags | LOOKUP_REVAL, nd);
  1781. if (likely(!retval))
  1782. audit_inode(name, nd->path.dentry, flags & LOOKUP_PARENT);
  1783. return retval;
  1784. }
  1785. static int do_path_lookup(int dfd, const char *name,
  1786. unsigned int flags, struct nameidata *nd)
  1787. {
  1788. struct filename filename = { .name = name };
  1789. return filename_lookup(dfd, &filename, flags, nd);
  1790. }
  1791. /* does lookup, returns the object with parent locked */
  1792. struct dentry *kern_path_locked(const char *name, struct path *path)
  1793. {
  1794. struct nameidata nd;
  1795. struct dentry *d;
  1796. int err = do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, &nd);
  1797. if (err)
  1798. return ERR_PTR(err);
  1799. if (nd.last_type != LAST_NORM) {
  1800. path_put(&nd.path);
  1801. return ERR_PTR(-EINVAL);
  1802. }
  1803. mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
  1804. d = __lookup_hash(&nd.last, nd.path.dentry, 0);
  1805. if (IS_ERR(d)) {
  1806. mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
  1807. path_put(&nd.path);
  1808. return d;
  1809. }
  1810. *path = nd.path;
  1811. return d;
  1812. }
  1813. int kern_path(const char *name, unsigned int flags, struct path *path)
  1814. {
  1815. struct nameidata nd;
  1816. int res = do_path_lookup(AT_FDCWD, name, flags, &nd);
  1817. if (!res)
  1818. *path = nd.path;
  1819. return res;
  1820. }
  1821. /**
  1822. * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
  1823. * @dentry: pointer to dentry of the base directory
  1824. * @mnt: pointer to vfs mount of the base directory
  1825. * @name: pointer to file name
  1826. * @flags: lookup flags
  1827. * @path: pointer to struct path to fill
  1828. */
  1829. int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
  1830. const char *name, unsigned int flags,
  1831. struct path *path)
  1832. {
  1833. struct nameidata nd;
  1834. int err;
  1835. nd.root.dentry = dentry;
  1836. nd.root.mnt = mnt;
  1837. BUG_ON(flags & LOOKUP_PARENT);
  1838. /* the first argument of do_path_lookup() is ignored with LOOKUP_ROOT */
  1839. err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd);
  1840. if (!err)
  1841. *path = nd.path;
  1842. return err;
  1843. }
  1844. /*
  1845. * Restricted form of lookup. Doesn't follow links, single-component only,
  1846. * needs parent already locked. Doesn't follow mounts.
  1847. * SMP-safe.
  1848. */
  1849. static struct dentry *lookup_hash(struct nameidata *nd)
  1850. {
  1851. return __lookup_hash(&nd->last, nd->path.dentry, nd->flags);
  1852. }
  1853. /**
  1854. * lookup_one_len - filesystem helper to lookup single pathname component
  1855. * @name: pathname component to lookup
  1856. * @base: base directory to lookup from
  1857. * @len: maximum length @len should be interpreted to
  1858. *
  1859. * Note that this routine is purely a helper for filesystem usage and should
  1860. * not be called by generic code. Also note that by using this function the
  1861. * nameidata argument is passed to the filesystem methods and a filesystem
  1862. * using this helper needs to be prepared for that.
  1863. */
  1864. struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
  1865. {
  1866. struct qstr this;
  1867. unsigned int c;
  1868. int err;
  1869. WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));
  1870. this.name = name;
  1871. this.len = len;
  1872. this.hash = full_name_hash(name, len);
  1873. if (!len)
  1874. return ERR_PTR(-EACCES);
  1875. if (unlikely(name[0] == '.')) {
  1876. if (len < 2 || (len == 2 && name[1] == '.'))
  1877. return ERR_PTR(-EACCES);
  1878. }
  1879. while (len--) {
  1880. c = *(const unsigned char *)name++;
  1881. if (c == '/' || c == '\0')
  1882. return ERR_PTR(-EACCES);
  1883. }
  1884. /*
  1885. * See if the low-level filesystem might want
  1886. * to use its own hash..
  1887. */
  1888. if (base->d_flags & DCACHE_OP_HASH) {
  1889. int err = base->d_op->d_hash(base, &this);
  1890. if (err < 0)
  1891. return ERR_PTR(err);
  1892. }
  1893. err = inode_permission(base->d_inode, MAY_EXEC);
  1894. if (err)
  1895. return ERR_PTR(err);
  1896. return __lookup_hash(&this, base, 0);
  1897. }
  1898. int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
  1899. struct path *path, int *empty)
  1900. {
  1901. struct nameidata nd;
  1902. struct filename *tmp = getname_flags(name, flags, empty);
  1903. int err = PTR_ERR(tmp);
  1904. if (!IS_ERR(tmp)) {
  1905. BUG_ON(flags & LOOKUP_PARENT);
  1906. err = filename_lookup(dfd, tmp, flags, &nd);
  1907. putname(tmp);
  1908. if (!err)
  1909. *path = nd.path;
  1910. }
  1911. return err;
  1912. }
  1913. int user_path_at(int dfd, const char __user *name, unsigned flags,
  1914. struct path *path)
  1915. {
  1916. return user_path_at_empty(dfd, name, flags, path, NULL);
  1917. }
  1918. /*
  1919. * NB: most callers don't do anything directly with the reference to the
  1920. * to struct filename, but the nd->last pointer points into the name string
  1921. * allocated by getname. So we must hold the reference to it until all
  1922. * path-walking is complete.
  1923. */
  1924. static struct filename *
  1925. user_path_parent(int dfd, const char __user *path, struct nameidata *nd,
  1926. unsigned int flags)
  1927. {
  1928. struct filename *s = getname(path);
  1929. int error;
  1930. /* only LOOKUP_REVAL is allowed in extra flags */
  1931. flags &= LOOKUP_REVAL;
  1932. if (IS_ERR(s))
  1933. return s;
  1934. error = filename_lookup(dfd, s, flags | LOOKUP_PARENT, nd);
  1935. if (error) {
  1936. putname(s);
  1937. return ERR_PTR(error);
  1938. }
  1939. return s;
  1940. }
  1941. /**
  1942. * mountpoint_last - look up last component for umount
  1943. * @nd: pathwalk nameidata - currently pointing at parent directory of "last"
  1944. * @path: pointer to container for result
  1945. *
  1946. * This is a special lookup_last function just for umount. In this case, we
  1947. * need to resolve the path without doing any revalidation.
  1948. *
  1949. * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since
  1950. * mountpoints are always pinned in the dcache, their ancestors are too. Thus,
  1951. * in almost all cases, this lookup will be served out of the dcache. The only
  1952. * cases where it won't are if nd->last refers to a symlink or the path is
  1953. * bogus and it doesn't exist.
  1954. *
  1955. * Returns:
  1956. * -error: if there was an error during lookup. This includes -ENOENT if the
  1957. * lookup found a negative dentry. The nd->path reference will also be
  1958. * put in this case.
  1959. *
  1960. * 0: if we successfully resolved nd->path and found it to not to be a
  1961. * symlink that needs to be followed. "path" will also be populated.
  1962. * The nd->path reference will also be put.
  1963. *
  1964. * 1: if we successfully resolved nd->last and found it to be a symlink
  1965. * that needs to be followed. "path" will be populated with the path
  1966. * to the link, and nd->path will *not* be put.
  1967. */
  1968. static int
  1969. mountpoint_last(struct nameidata *nd, struct path *path)
  1970. {
  1971. int error = 0;
  1972. struct dentry *dentry;
  1973. struct dentry *dir = nd->path.dentry;
  1974. /* If we're in rcuwalk, drop out of it to handle last component */
  1975. if (nd->flags & LOOKUP_RCU) {
  1976. if (unlazy_walk(nd, NULL)) {
  1977. error = -ECHILD;
  1978. goto out;
  1979. }
  1980. }
  1981. nd->flags &= ~LOOKUP_PARENT;
  1982. if (unlikely(nd->last_type != LAST_NORM)) {
  1983. error = handle_dots(nd, nd->last_type);
  1984. if (error)
  1985. goto out;
  1986. dentry = dget(nd->path.dentry);
  1987. goto done;
  1988. }
  1989. mutex_lock(&dir->d_inode->i_mutex);
  1990. dentry = d_lookup(dir, &nd->last);
  1991. if (!dentry) {
  1992. /*
  1993. * No cached dentry. Mounted dentries are pinned in the cache,
  1994. * so that means that this dentry is probably a symlink or the
  1995. * path doesn't actually point to a mounted dentry.
  1996. */
  1997. dentry = d_alloc(dir, &nd->last);
  1998. if (!dentry) {
  1999. error = -ENOMEM;
  2000. goto out;
  2001. }
  2002. dentry = lookup_real(dir->d_inode, dentry, nd->flags);
  2003. error = PTR_ERR(dentry);
  2004. if (IS_ERR(dentry))
  2005. goto out;
  2006. }
  2007. mutex_unlock(&dir->d_inode->i_mutex);
  2008. done:
  2009. if (!dentry->d_inode) {
  2010. error = -ENOENT;
  2011. dput(dentry);
  2012. goto out;
  2013. }
  2014. path->dentry = dentry;
  2015. path->mnt = mntget(nd->path.mnt);
  2016. if (should_follow_link(dentry->d_inode, nd->flags & LOOKUP_FOLLOW))
  2017. return 1;
  2018. follow_mount(path);
  2019. error = 0;
  2020. out:
  2021. terminate_walk(nd);
  2022. return error;
  2023. }
  2024. /**
  2025. * path_mountpoint - look up a path to be umounted
  2026. * @dfd: directory file descriptor to start walk from
  2027. * @name: full pathname to walk
  2028. * @flags: lookup flags
  2029. *
  2030. * Look up the given name, but don't attempt to revalidate the last component.
  2031. * Returns 0 and "path" will be valid on success; Retuns error otherwise.
  2032. */
  2033. static int
  2034. path_mountpoint(int dfd, const char *name, struct path *path, unsigned int flags)
  2035. {
  2036. struct file *base = NULL;
  2037. struct nameidata nd;
  2038. int err;
  2039. err = path_init(dfd, name, flags | LOOKUP_PARENT, &nd, &base);
  2040. if (unlikely(err))
  2041. return err;
  2042. current->total_link_count = 0;
  2043. err = link_path_walk(name, &nd);
  2044. if (err)
  2045. goto out;
  2046. err = mountpoint_last(&nd, path);
  2047. while (err > 0) {
  2048. void *cookie;
  2049. struct path link = *path;
  2050. err = may_follow_link(&link, &nd);
  2051. if (unlikely(err))
  2052. break;
  2053. nd.flags |= LOOKUP_PARENT;
  2054. err = follow_link(&link, &nd, &cookie);
  2055. if (err)
  2056. break;
  2057. err = mountpoint_last(&nd, path);
  2058. put_link(&nd, &link, cookie);
  2059. }
  2060. out:
  2061. if (base)
  2062. fput(base);
  2063. if (nd.root.mnt && !(nd.flags & LOOKUP_ROOT))
  2064. path_put(&nd.root);
  2065. return err;
  2066. }
  2067. static int
  2068. filename_mountpoint(int dfd, struct filename *s, struct path *path,
  2069. unsigned int flags)
  2070. {
  2071. int error = path_mountpoint(dfd, s->name, path, flags | LOOKUP_RCU);
  2072. if (unlikely(error == -ECHILD))
  2073. error = path_mountpoint(dfd, s->name, path, flags);
  2074. if (unlikely(error == -ESTALE))
  2075. error = path_mountpoint(dfd, s->name, path, flags | LOOKUP_REVAL);
  2076. if (likely(!error))
  2077. audit_inode(s, path->dentry, 0);
  2078. return error;
  2079. }
  2080. /**
  2081. * user_path_mountpoint_at - lookup a path from userland in order to umount it
  2082. * @dfd: directory file descriptor
  2083. * @name: pathname from userland
  2084. * @flags: lookup flags
  2085. * @path: pointer to container to hold result
  2086. *
  2087. * A umount is a special case for path walking. We're not actually interested
  2088. * in the inode in this situation, and ESTALE errors can be a problem. We
  2089. * simply want track down the dentry and vfsmount attached at the mountpoint
  2090. * and avoid revalidating the last component.
  2091. *
  2092. * Returns 0 and populates "path" on success.
  2093. */
  2094. int
  2095. user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags,
  2096. struct path *path)
  2097. {
  2098. struct filename *s = getname(name);
  2099. int error;
  2100. if (IS_ERR(s))
  2101. return PTR_ERR(s);
  2102. error = filename_mountpoint(dfd, s, path, flags);
  2103. putname(s);
  2104. return error;
  2105. }
  2106. int
  2107. kern_path_mountpoint(int dfd, const char *name, struct path *path,
  2108. unsigned int flags)
  2109. {
  2110. struct filename s = {.name = name};
  2111. return filename_mountpoint(dfd, &s, path, flags);
  2112. }
  2113. EXPORT_SYMBOL(kern_path_mountpoint);
  2114. /*
  2115. * It's inline, so penalty for filesystems that don't use sticky bit is
  2116. * minimal.
  2117. */
  2118. static inline int check_sticky(struct inode *dir, struct inode *inode)
  2119. {
  2120. kuid_t fsuid = current_fsuid();
  2121. if (!(dir->i_mode & S_ISVTX))
  2122. return 0;
  2123. if (uid_eq(inode->i_uid, fsuid))
  2124. return 0;
  2125. if (uid_eq(dir->i_uid, fsuid))
  2126. return 0;
  2127. return !inode_capable(inode, CAP_FOWNER);
  2128. }
  2129. /*
  2130. * Check whether we can remove a link victim from directory dir, check
  2131. * whether the type of victim is right.
  2132. * 1. We can't do it if dir is read-only (done in permission())
  2133. * 2. We should have write and exec permissions on dir
  2134. * 3. We can't remove anything from append-only dir
  2135. * 4. We can't do anything with immutable dir (done in permission())
  2136. * 5. If the sticky bit on dir is set we should either
  2137. * a. be owner of dir, or
  2138. * b. be owner of victim, or
  2139. * c. have CAP_FOWNER capability
  2140. * 6. If the victim is append-only or immutable we can't do antyhing with
  2141. * links pointing to it.
  2142. * 7. If we were asked to remove a directory and victim isn't one - ENOTDIR.
  2143. * 8. If we were asked to remove a non-directory and victim isn't one - EISDIR.
  2144. * 9. We can't remove a root or mountpoint.
  2145. * 10. We don't allow removal of NFS sillyrenamed files; it's handled by
  2146. * nfs_async_unlink().
  2147. */
  2148. static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
  2149. {
  2150. int error;
  2151. if (!victim->d_inode)
  2152. return -ENOENT;
  2153. BUG_ON(victim->d_parent->d_inode != dir);
  2154. audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
  2155. error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
  2156. if (error)
  2157. return error;
  2158. if (IS_APPEND(dir))
  2159. return -EPERM;
  2160. if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
  2161. IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
  2162. return -EPERM;
  2163. if (isdir) {
  2164. if (!S_ISDIR(victim->d_inode->i_mode))
  2165. return -ENOTDIR;
  2166. if (IS_ROOT(victim))
  2167. return -EBUSY;
  2168. } else if (S_ISDIR(victim->d_inode->i_mode))
  2169. return -EISDIR;
  2170. if (IS_DEADDIR(dir))
  2171. return -ENOENT;
  2172. if (victim->d_flags & DCACHE_NFSFS_RENAMED)
  2173. return -EBUSY;
  2174. return 0;
  2175. }
  2176. /* Check whether we can create an object with dentry child in directory
  2177. * dir.
  2178. * 1. We can't do it if child already exists (open has special treatment for
  2179. * this case, but since we are inlined it's OK)
  2180. * 2. We can't do it if dir is read-only (done in permission())
  2181. * 3. We should have write and exec permissions on dir
  2182. * 4. We can't do it if dir is immutable (done in permission())
  2183. */
  2184. static inline int may_create(struct inode *dir, struct dentry *child)
  2185. {
  2186. if (child->d_inode)
  2187. return -EEXIST;
  2188. if (IS_DEADDIR(dir))
  2189. return -ENOENT;
  2190. return inode_permission(dir, MAY_WRITE | MAY_EXEC);
  2191. }
  2192. /*
  2193. * p1 and p2 should be directories on the same fs.
  2194. */
  2195. struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
  2196. {
  2197. struct dentry *p;
  2198. if (p1 == p2) {
  2199. mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
  2200. return NULL;
  2201. }
  2202. mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
  2203. p = d_ancestor(p2, p1);
  2204. if (p) {
  2205. mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT);
  2206. mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD);
  2207. return p;
  2208. }
  2209. p = d_ancestor(p1, p2);
  2210. if (p) {
  2211. mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
  2212. mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
  2213. return p;
  2214. }
  2215. mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
  2216. mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
  2217. return NULL;
  2218. }
  2219. void unlock_rename(struct dentry *p1, struct dentry *p2)
  2220. {
  2221. mutex_unlock(&p1->d_inode->i_mutex);
  2222. if (p1 != p2) {
  2223. mutex_unlock(&p2->d_inode->i_mutex);
  2224. mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
  2225. }
  2226. }
  2227. int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
  2228. bool want_excl)
  2229. {
  2230. int error = may_create(dir, dentry);
  2231. if (error)
  2232. return error;
  2233. if (!dir->i_op->create)
  2234. return -EACCES; /* shouldn't it be ENOSYS? */
  2235. mode &= S_IALLUGO;
  2236. mode |= S_IFREG;
  2237. error = security_inode_create(dir, dentry, mode);
  2238. if (error)
  2239. return error;
  2240. error = dir->i_op->create(dir, dentry, mode, want_excl);
  2241. if (!error)
  2242. fsnotify_create(dir, dentry);
  2243. return error;
  2244. }
  2245. static int may_open(struct path *path, int acc_mode, int flag)
  2246. {
  2247. struct dentry *dentry = path->dentry;
  2248. struct inode *inode = dentry->d_inode;
  2249. int error;
  2250. /* O_PATH? */
  2251. if (!acc_mode)
  2252. return 0;
  2253. if (!inode)
  2254. return -ENOENT;
  2255. switch (inode->i_mode & S_IFMT) {
  2256. case S_IFLNK:
  2257. return -ELOOP;
  2258. case S_IFDIR:
  2259. if (acc_mode & MAY_WRITE)
  2260. return -EISDIR;
  2261. break;
  2262. case S_IFBLK:
  2263. case S_IFCHR:
  2264. if (path->mnt->mnt_flags & MNT_NODEV)
  2265. return -EACCES;
  2266. /*FALLTHRU*/
  2267. case S_IFIFO:
  2268. case S_IFSOCK:
  2269. flag &= ~O_TRUNC;
  2270. break;
  2271. }
  2272. error = inode_permission(inode, acc_mode);
  2273. if (error)
  2274. return error;
  2275. /*
  2276. * An append-only file must be opened in append mode for writing.
  2277. */
  2278. if (IS_APPEND(inode)) {
  2279. if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
  2280. return -EPERM;
  2281. if (flag & O_TRUNC)
  2282. return -EPERM;
  2283. }
  2284. /* O_NOATIME can only be set by the owner or superuser */
  2285. if (flag & O_NOATIME && !inode_owner_or_capable(inode))
  2286. return -EPERM;
  2287. return 0;
  2288. }
  2289. static int handle_truncate(struct file *filp)
  2290. {
  2291. struct path *path = &filp->f_path;
  2292. struct inode *inode = path->dentry->d_inode;
  2293. int error = get_write_access(inode);
  2294. if (error)
  2295. return error;
  2296. /*
  2297. * Refuse to truncate files with mandatory locks held on them.
  2298. */
  2299. error = locks_verify_locked(inode);
  2300. if (!error)
  2301. error = security_path_truncate(path);
  2302. if (!error) {
  2303. error = do_truncate(path->dentry, 0,
  2304. ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
  2305. filp);
  2306. }
  2307. put_write_access(inode);
  2308. return error;
  2309. }
  2310. static inline int open_to_namei_flags(int flag)
  2311. {
  2312. if ((flag & O_ACCMODE) == 3)
  2313. flag--;
  2314. return flag;
  2315. }
  2316. static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode)
  2317. {
  2318. int error = security_path_mknod(dir, dentry, mode, 0);
  2319. if (error)
  2320. return error;
  2321. error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
  2322. if (error)
  2323. return error;
  2324. return security_inode_create(dir->dentry->d_inode, dentry, mode);
  2325. }
  2326. /*
  2327. * Attempt to atomically look up, create and open a file from a negative
  2328. * dentry.
  2329. *
  2330. * Returns 0 if successful. The file will have been created and attached to
  2331. * @file by the filesystem calling finish_open().
  2332. *
  2333. * Returns 1 if the file was looked up only or didn't need creating. The
  2334. * caller will need to perform the open themselves. @path will have been
  2335. * updated to point to the new dentry. This may be negative.
  2336. *
  2337. * Returns an error code otherwise.
  2338. */
  2339. static int atomic_open(struct nameidata *nd, struct dentry *dentry,
  2340. struct path *path, struct file *file,
  2341. const struct open_flags *op,
  2342. bool got_write, bool need_lookup,
  2343. int *opened)
  2344. {
  2345. struct inode *dir = nd->path.dentry->d_inode;
  2346. unsigned open_flag = open_to_namei_flags(op->open_flag);
  2347. umode_t mode;
  2348. int error;
  2349. int acc_mode;
  2350. int create_error = 0;
  2351. struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
  2352. BUG_ON(dentry->d_inode);
  2353. /* Don't create child dentry for a dead directory. */
  2354. if (unlikely(IS_DEADDIR(dir))) {
  2355. error = -ENOENT;
  2356. goto out;
  2357. }
  2358. mode = op->mode;
  2359. if ((open_flag & O_CREAT) && !IS_POSIXACL(dir))
  2360. mode &= ~current_umask();
  2361. if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT)) {
  2362. open_flag &= ~O_TRUNC;
  2363. *opened |= FILE_CREATED;
  2364. }
  2365. /*
  2366. * Checking write permission is tricky, bacuse we don't know if we are
  2367. * going to actually need it: O_CREAT opens should work as long as the
  2368. * file exists. But checking existence breaks atomicity. The trick is
  2369. * to check access and if not granted clear O_CREAT from the flags.
  2370. *
  2371. * Another problem is returing the "right" error value (e.g. for an
  2372. * O_EXCL open we want to return EEXIST not EROFS).
  2373. */
  2374. if (((open_flag & (O_CREAT | O_TRUNC)) ||
  2375. (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) {
  2376. if (!(open_flag & O_CREAT)) {
  2377. /*
  2378. * No O_CREATE -> atomicity not a requirement -> fall
  2379. * back to lookup + open
  2380. */
  2381. goto no_open;
  2382. } else if (open_flag & (O_EXCL | O_TRUNC)) {
  2383. /* Fall back and fail with the right error */
  2384. create_error = -EROFS;
  2385. goto no_open;
  2386. } else {
  2387. /* No side effects, safe to clear O_CREAT */
  2388. create_error = -EROFS;
  2389. open_flag &= ~O_CREAT;
  2390. }
  2391. }
  2392. if (open_flag & O_CREAT) {
  2393. error = may_o_create(&nd->path, dentry, mode);
  2394. if (error) {
  2395. create_error = error;
  2396. if (open_flag & O_EXCL)
  2397. goto no_open;
  2398. open_flag &= ~O_CREAT;
  2399. }
  2400. }
  2401. if (nd->flags & LOOKUP_DIRECTORY)
  2402. open_flag |= O_DIRECTORY;
  2403. file->f_path.dentry = DENTRY_NOT_SET;
  2404. file->f_path.mnt = nd->path.mnt;
  2405. error = dir->i_op->atomic_open(dir, dentry, file, open_flag, mode,
  2406. opened);
  2407. if (error < 0) {
  2408. if (create_error && error == -ENOENT)
  2409. error = create_error;
  2410. goto out;
  2411. }
  2412. acc_mode = op->acc_mode;
  2413. if (*opened & FILE_CREATED) {
  2414. fsnotify_create(dir, dentry);
  2415. acc_mode = MAY_OPEN;
  2416. }
  2417. if (error) { /* returned 1, that is */
  2418. if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
  2419. error = -EIO;
  2420. goto out;
  2421. }
  2422. if (file->f_path.dentry) {
  2423. dput(dentry);
  2424. dentry = file->f_path.dentry;
  2425. }
  2426. if (create_error && dentry->d_inode == NULL) {
  2427. error = create_error;
  2428. goto out;
  2429. }
  2430. goto looked_up;
  2431. }
  2432. /*
  2433. * We didn't have the inode before the open, so check open permission
  2434. * here.
  2435. */
  2436. error = may_open(&file->f_path, acc_mode, open_flag);
  2437. if (error)
  2438. fput(file);
  2439. out:
  2440. dput(dentry);
  2441. return error;
  2442. no_open:
  2443. if (need_lookup) {
  2444. dentry = lookup_real(dir, dentry, nd->flags);
  2445. if (IS_ERR(dentry))
  2446. return PTR_ERR(dentry);
  2447. if (create_error) {
  2448. int open_flag = op->open_flag;
  2449. error = create_error;
  2450. if ((open_flag & O_EXCL)) {
  2451. if (!dentry->d_inode)
  2452. goto out;
  2453. } else if (!dentry->d_inode) {
  2454. goto out;
  2455. } else if ((open_flag & O_TRUNC) &&
  2456. S_ISREG(dentry->d_inode->i_mode)) {
  2457. goto out;
  2458. }
  2459. /* will fail later, go on to get the right error */
  2460. }
  2461. }
  2462. looked_up:
  2463. path->dentry = dentry;
  2464. path->mnt = nd->path.mnt;
  2465. return 1;
  2466. }
  2467. /*
  2468. * Look up and maybe create and open the last component.
  2469. *
  2470. * Must be called with i_mutex held on parent.
  2471. *
  2472. * Returns 0 if the file was successfully atomically created (if necessary) and
  2473. * opened. In this case the file will be returned attached to @file.
  2474. *
  2475. * Returns 1 if the file was not completely opened at this time, though lookups
  2476. * and creations will have been performed and the dentry returned in @path will
  2477. * be positive upon return if O_CREAT was specified. If O_CREAT wasn't
  2478. * specified then a negative dentry may be returned.
  2479. *
  2480. * An error code is returned otherwise.
  2481. *
  2482. * FILE_CREATE will be set in @*opened if the dentry was created and will be
  2483. * cleared otherwise prior to returning.
  2484. */
  2485. static int lookup_open(struct nameidata *nd, struct path *path,
  2486. struct file *file,
  2487. const struct open_flags *op,
  2488. bool got_write, int *opened)
  2489. {
  2490. struct dentry *dir = nd->path.dentry;
  2491. struct inode *dir_inode = dir->d_inode;
  2492. struct dentry *dentry;
  2493. int error;
  2494. bool need_lookup;
  2495. *opened &= ~FILE_CREATED;
  2496. dentry = lookup_dcache(&nd->last, dir, nd->flags, &need_lookup);
  2497. if (IS_ERR(dentry))
  2498. return PTR_ERR(dentry);
  2499. /* Cached positive dentry: will open in f_op->open */
  2500. if (!need_lookup && dentry->d_inode)
  2501. goto out_no_open;
  2502. if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) {
  2503. return atomic_open(nd, dentry, path, file, op, got_write,
  2504. need_lookup, opened);
  2505. }
  2506. if (need_lookup) {
  2507. BUG_ON(dentry->d_inode);
  2508. dentry = lookup_real(dir_inode, dentry, nd->flags);
  2509. if (IS_ERR(dentry))
  2510. return PTR_ERR(dentry);
  2511. }
  2512. /* Negative dentry, just create the file */
  2513. if (!dentry->d_inode && (op->open_flag & O_CREAT)) {
  2514. umode_t mode = op->mode;
  2515. if (!IS_POSIXACL(dir->d_inode))
  2516. mode &= ~current_umask();
  2517. /*
  2518. * This write is needed to ensure that a
  2519. * rw->ro transition does not occur between
  2520. * the time when the file is created and when
  2521. * a permanent write count is taken through
  2522. * the 'struct file' in finish_open().
  2523. */
  2524. if (!got_write) {
  2525. error = -EROFS;
  2526. goto out_dput;
  2527. }
  2528. *opened |= FILE_CREATED;
  2529. error = security_path_mknod(&nd->path, dentry, mode, 0);
  2530. if (error)
  2531. goto out_dput;
  2532. error = vfs_create(dir->d_inode, dentry, mode,
  2533. nd->flags & LOOKUP_EXCL);
  2534. if (error)
  2535. goto out_dput;
  2536. }
  2537. out_no_open:
  2538. path->dentry = dentry;
  2539. path->mnt = nd->path.mnt;
  2540. return 1;
  2541. out_dput:
  2542. dput(dentry);
  2543. return error;
  2544. }
  2545. /*
  2546. * Handle the last step of open()
  2547. */
  2548. static int do_last(struct nameidata *nd, struct path *path,
  2549. struct file *file, const struct open_flags *op,
  2550. int *opened, struct filename *name)
  2551. {
  2552. struct dentry *dir = nd->path.dentry;
  2553. int open_flag = op->open_flag;
  2554. bool will_truncate = (open_flag & O_TRUNC) != 0;
  2555. bool got_write = false;
  2556. int acc_mode = op->acc_mode;
  2557. struct inode *inode;
  2558. bool symlink_ok = false;
  2559. struct path save_parent = { .dentry = NULL, .mnt = NULL };
  2560. bool retried = false;
  2561. int error;
  2562. nd->flags &= ~LOOKUP_PARENT;
  2563. nd->flags |= op->intent;
  2564. if (nd->last_type != LAST_NORM) {
  2565. error = handle_dots(nd, nd->last_type);
  2566. if (error)
  2567. return error;
  2568. goto finish_open;
  2569. }
  2570. if (!(open_flag & O_CREAT)) {
  2571. if (nd->last.name[nd->last.len])
  2572. nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
  2573. if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW))
  2574. symlink_ok = true;
  2575. /* we _can_ be in RCU mode here */
  2576. error = lookup_fast(nd, path, &inode);
  2577. if (likely(!error))
  2578. goto finish_lookup;
  2579. if (error < 0)
  2580. goto out;
  2581. BUG_ON(nd->inode != dir->d_inode);
  2582. } else {
  2583. /* create side of things */
  2584. /*
  2585. * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED
  2586. * has been cleared when we got to the last component we are
  2587. * about to look up
  2588. */
  2589. error = complete_walk(nd);
  2590. if (error)
  2591. return error;
  2592. audit_inode(name, dir, LOOKUP_PARENT);
  2593. error = -EISDIR;
  2594. /* trailing slashes? */
  2595. if (nd->last.name[nd->last.len])
  2596. goto out;
  2597. }
  2598. retry_lookup:
  2599. if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
  2600. error = mnt_want_write(nd->path.mnt);
  2601. if (!error)
  2602. got_write = true;
  2603. /*
  2604. * do _not_ fail yet - we might not need that or fail with
  2605. * a different error; let lookup_open() decide; we'll be
  2606. * dropping this one anyway.
  2607. */
  2608. }
  2609. mutex_lock(&dir->d_inode->i_mutex);
  2610. error = lookup_open(nd, path, file, op, got_write, opened);
  2611. mutex_unlock(&dir->d_inode->i_mutex);
  2612. if (error <= 0) {
  2613. if (error)
  2614. goto out;
  2615. if ((*opened & FILE_CREATED) ||
  2616. !S_ISREG(file_inode(file)->i_mode))
  2617. will_truncate = false;
  2618. audit_inode(name, file->f_path.dentry, 0);
  2619. goto opened;
  2620. }
  2621. if (*opened & FILE_CREATED) {
  2622. /* Don't check for write permission, don't truncate */
  2623. open_flag &= ~O_TRUNC;
  2624. will_truncate = false;
  2625. acc_mode = MAY_OPEN;
  2626. path_to_nameidata(path, nd);
  2627. goto finish_open_created;
  2628. }
  2629. /*
  2630. * create/update audit record if it already exists.
  2631. */
  2632. if (path->dentry->d_inode)
  2633. audit_inode(name, path->dentry, 0);
  2634. /*
  2635. * If atomic_open() acquired write access it is dropped now due to
  2636. * possible mount and symlink following (this might be optimized away if
  2637. * necessary...)
  2638. */
  2639. if (got_write) {
  2640. mnt_drop_write(nd->path.mnt);
  2641. got_write = false;
  2642. }
  2643. error = -EEXIST;
  2644. if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))
  2645. goto exit_dput;
  2646. error = follow_managed(path, nd->flags);
  2647. if (error < 0)
  2648. goto exit_dput;
  2649. if (error)
  2650. nd->flags |= LOOKUP_JUMPED;
  2651. BUG_ON(nd->flags & LOOKUP_RCU);
  2652. inode = path->dentry->d_inode;
  2653. finish_lookup:
  2654. /* we _can_ be in RCU mode here */
  2655. error = -ENOENT;
  2656. if (!inode) {
  2657. path_to_nameidata(path, nd);
  2658. goto out;
  2659. }
  2660. if (should_follow_link(inode, !symlink_ok)) {
  2661. if (nd->flags & LOOKUP_RCU) {
  2662. if (unlikely(unlazy_walk(nd, path->dentry))) {
  2663. error = -ECHILD;
  2664. goto out;
  2665. }
  2666. }
  2667. BUG_ON(inode != path->dentry->d_inode);
  2668. return 1;
  2669. }
  2670. if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path->mnt) {
  2671. path_to_nameidata(path, nd);
  2672. } else {
  2673. save_parent.dentry = nd->path.dentry;
  2674. save_parent.mnt = mntget(path->mnt);
  2675. nd->path.dentry = path->dentry;
  2676. }
  2677. nd->inode = inode;
  2678. /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */
  2679. finish_open:
  2680. error = complete_walk(nd);
  2681. if (error) {
  2682. path_put(&save_parent);
  2683. return error;
  2684. }
  2685. audit_inode(name, nd->path.dentry, 0);
  2686. error = -EISDIR;
  2687. if ((open_flag & O_CREAT) && S_ISDIR(nd->inode->i_mode))
  2688. goto out;
  2689. error = -ENOTDIR;
  2690. if ((nd->flags & LOOKUP_DIRECTORY) && !can_lookup(nd->inode))
  2691. goto out;
  2692. if (!S_ISREG(nd->inode->i_mode))
  2693. will_truncate = false;
  2694. if (will_truncate) {
  2695. error = mnt_want_write(nd->path.mnt);
  2696. if (error)
  2697. goto out;
  2698. got_write = true;
  2699. }
  2700. finish_open_created:
  2701. error = may_open(&nd->path, acc_mode, open_flag);
  2702. if (error)
  2703. goto out;
  2704. file->f_path.mnt = nd->path.mnt;
  2705. error = finish_open(file, nd->path.dentry, NULL, opened);
  2706. if (error) {
  2707. if (error == -EOPENSTALE)
  2708. goto stale_open;
  2709. goto out;
  2710. }
  2711. opened:
  2712. error = open_check_o_direct(file);
  2713. if (error)
  2714. goto exit_fput;
  2715. error = ima_file_check(file, op->acc_mode);
  2716. if (error)
  2717. goto exit_fput;
  2718. if (will_truncate) {
  2719. error = handle_truncate(file);
  2720. if (error)
  2721. goto exit_fput;
  2722. }
  2723. out:
  2724. if (got_write)
  2725. mnt_drop_write(nd->path.mnt);
  2726. path_put(&save_parent);
  2727. terminate_walk(nd);
  2728. return error;
  2729. exit_dput:
  2730. path_put_conditional(path, nd);
  2731. goto out;
  2732. exit_fput:
  2733. fput(file);
  2734. goto out;
  2735. stale_open:
  2736. /* If no saved parent or already retried then can't retry */
  2737. if (!save_parent.dentry || retried)
  2738. goto out;
  2739. BUG_ON(save_parent.dentry != dir);
  2740. path_put(&nd->path);
  2741. nd->path = save_parent;
  2742. nd->inode = dir->d_inode;
  2743. save_parent.mnt = NULL;
  2744. save_parent.dentry = NULL;
  2745. if (got_write) {
  2746. mnt_drop_write(nd->path.mnt);
  2747. got_write = false;
  2748. }
  2749. retried = true;
  2750. goto retry_lookup;
  2751. }
  2752. static int do_tmpfile(int dfd, struct filename *pathname,
  2753. struct nameidata *nd, int flags,
  2754. const struct open_flags *op,
  2755. struct file *file, int *opened)
  2756. {
  2757. static const struct qstr name = QSTR_INIT("/", 1);
  2758. struct dentry *dentry, *child;
  2759. struct inode *dir;
  2760. int error = path_lookupat(dfd, pathname->name,
  2761. flags | LOOKUP_DIRECTORY, nd);
  2762. if (unlikely(error))
  2763. return error;
  2764. error = mnt_want_write(nd->path.mnt);
  2765. if (unlikely(error))
  2766. goto out;
  2767. /* we want directory to be writable */
  2768. error = inode_permission(nd->inode, MAY_WRITE | MAY_EXEC);
  2769. if (error)
  2770. goto out2;
  2771. dentry = nd->path.dentry;
  2772. dir = dentry->d_inode;
  2773. if (!dir->i_op->tmpfile) {
  2774. error = -EOPNOTSUPP;
  2775. goto out2;
  2776. }
  2777. child = d_alloc(dentry, &name);
  2778. if (unlikely(!child)) {
  2779. error = -ENOMEM;
  2780. goto out2;
  2781. }
  2782. nd->flags &= ~LOOKUP_DIRECTORY;
  2783. nd->flags |= op->intent;
  2784. dput(nd->path.dentry);
  2785. nd->path.dentry = child;
  2786. error = dir->i_op->tmpfile(dir, nd->path.dentry, op->mode);
  2787. if (error)
  2788. goto out2;
  2789. audit_inode(pathname, nd->path.dentry, 0);
  2790. error = may_open(&nd->path, op->acc_mode, op->open_flag);
  2791. if (error)
  2792. goto out2;
  2793. file->f_path.mnt = nd->path.mnt;
  2794. error = finish_open(file, nd->path.dentry, NULL, opened);
  2795. if (error)
  2796. goto out2;
  2797. error = open_check_o_direct(file);
  2798. if (error) {
  2799. fput(file);
  2800. } else if (!(op->open_flag & O_EXCL)) {
  2801. struct inode *inode = file_inode(file);
  2802. spin_lock(&inode->i_lock);
  2803. inode->i_state |= I_LINKABLE;
  2804. spin_unlock(&inode->i_lock);
  2805. }
  2806. out2:
  2807. mnt_drop_write(nd->path.mnt);
  2808. out:
  2809. path_put(&nd->path);
  2810. return error;
  2811. }
  2812. static struct file *path_openat(int dfd, struct filename *pathname,
  2813. struct nameidata *nd, const struct open_flags *op, int flags)
  2814. {
  2815. struct file *base = NULL;
  2816. struct file *file;
  2817. struct path path;
  2818. int opened = 0;
  2819. int error;
  2820. file = get_empty_filp();
  2821. if (IS_ERR(file))
  2822. return file;
  2823. file->f_flags = op->open_flag;
  2824. if (unlikely(file->f_flags & __O_TMPFILE)) {
  2825. error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened);
  2826. goto out;
  2827. }
  2828. error = path_init(dfd, pathname->name, flags | LOOKUP_PARENT, nd, &base);
  2829. if (unlikely(error))
  2830. goto out;
  2831. current->total_link_count = 0;
  2832. error = link_path_walk(pathname->name, nd);
  2833. if (unlikely(error))
  2834. goto out;
  2835. error = do_last(nd, &path, file, op, &opened, pathname);
  2836. while (unlikely(error > 0)) { /* trailing symlink */
  2837. struct path link = path;
  2838. void *cookie;
  2839. if (!(nd->flags & LOOKUP_FOLLOW)) {
  2840. path_put_conditional(&path, nd);
  2841. path_put(&nd->path);
  2842. error = -ELOOP;
  2843. break;
  2844. }
  2845. error = may_follow_link(&link, nd);
  2846. if (unlikely(error))
  2847. break;
  2848. nd->flags |= LOOKUP_PARENT;
  2849. nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
  2850. error = follow_link(&link, nd, &cookie);
  2851. if (unlikely(error))
  2852. break;
  2853. error = do_last(nd, &path, file, op, &opened, pathname);
  2854. put_link(nd, &link, cookie);
  2855. }
  2856. out:
  2857. if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT))
  2858. path_put(&nd->root);
  2859. if (base)
  2860. fput(base);
  2861. if (!(opened & FILE_OPENED)) {
  2862. BUG_ON(!error);
  2863. put_filp(file);
  2864. }
  2865. if (unlikely(error)) {
  2866. if (error == -EOPENSTALE) {
  2867. if (flags & LOOKUP_RCU)
  2868. error = -ECHILD;
  2869. else
  2870. error = -ESTALE;
  2871. }
  2872. file = ERR_PTR(error);
  2873. }
  2874. return file;
  2875. }
  2876. struct file *do_filp_open(int dfd, struct filename *pathname,
  2877. const struct open_flags *op)
  2878. {
  2879. struct nameidata nd;
  2880. int flags = op->lookup_flags;
  2881. struct file *filp;
  2882. filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU);
  2883. if (unlikely(filp == ERR_PTR(-ECHILD)))
  2884. filp = path_openat(dfd, pathname, &nd, op, flags);
  2885. if (unlikely(filp == ERR_PTR(-ESTALE)))
  2886. filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_REVAL);
  2887. return filp;
  2888. }
  2889. struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
  2890. const char *name, const struct open_flags *op)
  2891. {
  2892. struct nameidata nd;
  2893. struct file *file;
  2894. struct filename filename = { .name = name };
  2895. int flags = op->lookup_flags | LOOKUP_ROOT;
  2896. nd.root.mnt = mnt;
  2897. nd.root.dentry = dentry;
  2898. if (dentry->d_inode->i_op->follow_link && op->intent & LOOKUP_OPEN)
  2899. return ERR_PTR(-ELOOP);
  2900. file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_RCU);
  2901. if (unlikely(file == ERR_PTR(-ECHILD)))
  2902. file = path_openat(-1, &filename, &nd, op, flags);
  2903. if (unlikely(file == ERR_PTR(-ESTALE)))
  2904. file = path_openat(-1, &filename, &nd, op, flags | LOOKUP_REVAL);
  2905. return file;
  2906. }
  2907. struct dentry *kern_path_create(int dfd, const char *pathname,
  2908. struct path *path, unsigned int lookup_flags)
  2909. {
  2910. struct dentry *dentry = ERR_PTR(-EEXIST);
  2911. struct nameidata nd;
  2912. int err2;
  2913. int error;
  2914. bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);
  2915. /*
  2916. * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any
  2917. * other flags passed in are ignored!
  2918. */
  2919. lookup_flags &= LOOKUP_REVAL;
  2920. error = do_path_lookup(dfd, pathname, LOOKUP_PARENT|lookup_flags, &nd);
  2921. if (error)
  2922. return ERR_PTR(error);
  2923. /*
  2924. * Yucky last component or no last component at all?
  2925. * (foo/., foo/.., /////)
  2926. */
  2927. if (nd.last_type != LAST_NORM)
  2928. goto out;
  2929. nd.flags &= ~LOOKUP_PARENT;
  2930. nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL;
  2931. /* don't fail immediately if it's r/o, at least try to report other errors */
  2932. err2 = mnt_want_write(nd.path.mnt);
  2933. /*
  2934. * Do the final lookup.
  2935. */
  2936. mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
  2937. dentry = lookup_hash(&nd);
  2938. if (IS_ERR(dentry))
  2939. goto unlock;
  2940. error = -EEXIST;
  2941. if (dentry->d_inode)
  2942. goto fail;
  2943. /*
  2944. * Special case - lookup gave negative, but... we had foo/bar/
  2945. * From the vfs_mknod() POV we just have a negative dentry -
  2946. * all is fine. Let's be bastards - you had / on the end, you've
  2947. * been asking for (non-existent) directory. -ENOENT for you.
  2948. */
  2949. if (unlikely(!is_dir && nd.last.name[nd.last.len])) {
  2950. error = -ENOENT;
  2951. goto fail;
  2952. }
  2953. if (unlikely(err2)) {
  2954. error = err2;
  2955. goto fail;
  2956. }
  2957. *path = nd.path;
  2958. return dentry;
  2959. fail:
  2960. dput(dentry);
  2961. dentry = ERR_PTR(error);
  2962. unlock:
  2963. mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
  2964. if (!err2)
  2965. mnt_drop_write(nd.path.mnt);
  2966. out:
  2967. path_put(&nd.path);
  2968. return dentry;
  2969. }
  2970. EXPORT_SYMBOL(kern_path_create);
  2971. void done_path_create(struct path *path, struct dentry *dentry)
  2972. {
  2973. dput(dentry);
  2974. mutex_unlock(&path->dentry->d_inode->i_mutex);
  2975. mnt_drop_write(path->mnt);
  2976. path_put(path);
  2977. }
  2978. EXPORT_SYMBOL(done_path_create);
  2979. struct dentry *user_path_create(int dfd, const char __user *pathname,
  2980. struct path *path, unsigned int lookup_flags)
  2981. {
  2982. struct filename *tmp = getname(pathname);
  2983. struct dentry *res;
  2984. if (IS_ERR(tmp))
  2985. return ERR_CAST(tmp);
  2986. res = kern_path_create(dfd, tmp->name, path, lookup_flags);
  2987. putname(tmp);
  2988. return res;
  2989. }
  2990. EXPORT_SYMBOL(user_path_create);
  2991. int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
  2992. {
  2993. int error = may_create(dir, dentry);
  2994. if (error)
  2995. return error;
  2996. if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
  2997. return -EPERM;
  2998. if (!dir->i_op->mknod)
  2999. return -EPERM;
  3000. error = devcgroup_inode_mknod(mode, dev);
  3001. if (error)
  3002. return error;
  3003. error = security_inode_mknod(dir, dentry, mode, dev);
  3004. if (error)
  3005. return error;
  3006. error = dir->i_op->mknod(dir, dentry, mode, dev);
  3007. if (!error)
  3008. fsnotify_create(dir, dentry);
  3009. return error;
  3010. }
  3011. static int may_mknod(umode_t mode)
  3012. {
  3013. switch (mode & S_IFMT) {
  3014. case S_IFREG:
  3015. case S_IFCHR:
  3016. case S_IFBLK:
  3017. case S_IFIFO:
  3018. case S_IFSOCK:
  3019. case 0: /* zero mode translates to S_IFREG */
  3020. return 0;
  3021. case S_IFDIR:
  3022. return -EPERM;
  3023. default:
  3024. return -EINVAL;
  3025. }
  3026. }
  3027. SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
  3028. unsigned, dev)
  3029. {
  3030. struct dentry *dentry;
  3031. struct path path;
  3032. int error;
  3033. unsigned int lookup_flags = 0;
  3034. error = may_mknod(mode);
  3035. if (error)
  3036. return error;
  3037. retry:
  3038. dentry = user_path_create(dfd, filename, &path, lookup_flags);
  3039. if (IS_ERR(dentry))
  3040. return PTR_ERR(dentry);
  3041. if (!IS_POSIXACL(path.dentry->d_inode))
  3042. mode &= ~current_umask();
  3043. error = security_path_mknod(&path, dentry, mode, dev);
  3044. if (error)
  3045. goto out;
  3046. switch (mode & S_IFMT) {
  3047. case 0: case S_IFREG:
  3048. error = vfs_create(path.dentry->d_inode,dentry,mode,true);
  3049. break;
  3050. case S_IFCHR: case S_IFBLK:
  3051. error = vfs_mknod(path.dentry->d_inode,dentry,mode,
  3052. new_decode_dev(dev));
  3053. break;
  3054. case S_IFIFO: case S_IFSOCK:
  3055. error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
  3056. break;
  3057. }
  3058. out:
  3059. done_path_create(&path, dentry);
  3060. if (retry_estale(error, lookup_flags)) {
  3061. lookup_flags |= LOOKUP_REVAL;
  3062. goto retry;
  3063. }
  3064. return error;
  3065. }
  3066. SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
  3067. {
  3068. return sys_mknodat(AT_FDCWD, filename, mode, dev);
  3069. }
  3070. int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
  3071. {
  3072. int error = may_create(dir, dentry);
  3073. unsigned max_links = dir->i_sb->s_max_links;
  3074. if (error)
  3075. return error;
  3076. if (!dir->i_op->mkdir)
  3077. return -EPERM;
  3078. mode &= (S_IRWXUGO|S_ISVTX);
  3079. error = security_inode_mkdir(dir, dentry, mode);
  3080. if (error)
  3081. return error;
  3082. if (max_links && dir->i_nlink >= max_links)
  3083. return -EMLINK;
  3084. error = dir->i_op->mkdir(dir, dentry, mode);
  3085. if (!error)
  3086. fsnotify_mkdir(dir, dentry);
  3087. return error;
  3088. }
  3089. SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
  3090. {
  3091. struct dentry *dentry;
  3092. struct path path;
  3093. int error;
  3094. unsigned int lookup_flags = LOOKUP_DIRECTORY;
  3095. retry:
  3096. dentry = user_path_create(dfd, pathname, &path, lookup_flags);
  3097. if (IS_ERR(dentry))
  3098. return PTR_ERR(dentry);
  3099. if (!IS_POSIXACL(path.dentry->d_inode))
  3100. mode &= ~current_umask();
  3101. error = security_path_mkdir(&path, dentry, mode);
  3102. if (!error)
  3103. error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
  3104. done_path_create(&path, dentry);
  3105. if (retry_estale(error, lookup_flags)) {
  3106. lookup_flags |= LOOKUP_REVAL;
  3107. goto retry;
  3108. }
  3109. return error;
  3110. }
  3111. SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
  3112. {
  3113. return sys_mkdirat(AT_FDCWD, pathname, mode);
  3114. }
  3115. /*
  3116. * The dentry_unhash() helper will try to drop the dentry early: we
  3117. * should have a usage count of 1 if we're the only user of this
  3118. * dentry, and if that is true (possibly after pruning the dcache),
  3119. * then we drop the dentry now.
  3120. *
  3121. * A low-level filesystem can, if it choses, legally
  3122. * do a
  3123. *
  3124. * if (!d_unhashed(dentry))
  3125. * return -EBUSY;
  3126. *
  3127. * if it cannot handle the case of removing a directory
  3128. * that is still in use by something else..
  3129. */
  3130. void dentry_unhash(struct dentry *dentry)
  3131. {
  3132. shrink_dcache_parent(dentry);
  3133. spin_lock(&dentry->d_lock);
  3134. if (dentry->d_lockref.count == 1)
  3135. __d_drop(dentry);
  3136. spin_unlock(&dentry->d_lock);
  3137. }
  3138. int vfs_rmdir(struct inode *dir, struct dentry *dentry)
  3139. {
  3140. int error = may_delete(dir, dentry, 1);
  3141. if (error)
  3142. return error;
  3143. if (!dir->i_op->rmdir)
  3144. return -EPERM;
  3145. dget(dentry);
  3146. mutex_lock(&dentry->d_inode->i_mutex);
  3147. error = -EBUSY;
  3148. if (d_mountpoint(dentry))
  3149. goto out;
  3150. error = security_inode_rmdir(dir, dentry);
  3151. if (error)
  3152. goto out;
  3153. shrink_dcache_parent(dentry);
  3154. error = dir->i_op->rmdir(dir, dentry);
  3155. if (error)
  3156. goto out;
  3157. dentry->d_inode->i_flags |= S_DEAD;
  3158. dont_mount(dentry);
  3159. out:
  3160. mutex_unlock(&dentry->d_inode->i_mutex);
  3161. dput(dentry);
  3162. if (!error)
  3163. d_delete(dentry);
  3164. return error;
  3165. }
  3166. static long do_rmdir(int dfd, const char __user *pathname)
  3167. {
  3168. int error = 0;
  3169. struct filename *name;
  3170. struct dentry *dentry;
  3171. struct nameidata nd;
  3172. unsigned int lookup_flags = 0;
  3173. retry:
  3174. name = user_path_parent(dfd, pathname, &nd, lookup_flags);
  3175. if (IS_ERR(name))
  3176. return PTR_ERR(name);
  3177. switch(nd.last_type) {
  3178. case LAST_DOTDOT:
  3179. error = -ENOTEMPTY;
  3180. goto exit1;
  3181. case LAST_DOT:
  3182. error = -EINVAL;
  3183. goto exit1;
  3184. case LAST_ROOT:
  3185. error = -EBUSY;
  3186. goto exit1;
  3187. }
  3188. nd.flags &= ~LOOKUP_PARENT;
  3189. error = mnt_want_write(nd.path.mnt);
  3190. if (error)
  3191. goto exit1;
  3192. mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
  3193. dentry = lookup_hash(&nd);
  3194. error = PTR_ERR(dentry);
  3195. if (IS_ERR(dentry))
  3196. goto exit2;
  3197. if (!dentry->d_inode) {
  3198. error = -ENOENT;
  3199. goto exit3;
  3200. }
  3201. error = security_path_rmdir(&nd.path, dentry);
  3202. if (error)
  3203. goto exit3;
  3204. error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
  3205. exit3:
  3206. dput(dentry);
  3207. exit2:
  3208. mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
  3209. mnt_drop_write(nd.path.mnt);
  3210. exit1:
  3211. path_put(&nd.path);
  3212. putname(name);
  3213. if (retry_estale(error, lookup_flags)) {
  3214. lookup_flags |= LOOKUP_REVAL;
  3215. goto retry;
  3216. }
  3217. return error;
  3218. }
  3219. SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
  3220. {
  3221. return do_rmdir(AT_FDCWD, pathname);
  3222. }
  3223. int vfs_unlink(struct inode *dir, struct dentry *dentry)
  3224. {
  3225. int error = may_delete(dir, dentry, 0);
  3226. if (error)
  3227. return error;
  3228. if (!dir->i_op->unlink)
  3229. return -EPERM;
  3230. mutex_lock(&dentry->d_inode->i_mutex);
  3231. if (d_mountpoint(dentry))
  3232. error = -EBUSY;
  3233. else {
  3234. error = security_inode_unlink(dir, dentry);
  3235. if (!error) {
  3236. error = dir->i_op->unlink(dir, dentry);
  3237. if (!error)
  3238. dont_mount(dentry);
  3239. }
  3240. }
  3241. mutex_unlock(&dentry->d_inode->i_mutex);
  3242. /* We don't d_delete() NFS sillyrenamed files--they still exist. */
  3243. if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
  3244. fsnotify_link_count(dentry->d_inode);
  3245. d_delete(dentry);
  3246. }
  3247. return error;
  3248. }
  3249. /*
  3250. * Make sure that the actual truncation of the file will occur outside its
  3251. * directory's i_mutex. Truncate can take a long time if there is a lot of
  3252. * writeout happening, and we don't want to prevent access to the directory
  3253. * while waiting on the I/O.
  3254. */
  3255. static long do_unlinkat(int dfd, const char __user *pathname)
  3256. {
  3257. int error;
  3258. struct filename *name;
  3259. struct dentry *dentry;
  3260. struct nameidata nd;
  3261. struct inode *inode = NULL;
  3262. unsigned int lookup_flags = 0;
  3263. retry:
  3264. name = user_path_parent(dfd, pathname, &nd, lookup_flags);
  3265. if (IS_ERR(name))
  3266. return PTR_ERR(name);
  3267. error = -EISDIR;
  3268. if (nd.last_type != LAST_NORM)
  3269. goto exit1;
  3270. nd.flags &= ~LOOKUP_PARENT;
  3271. error = mnt_want_write(nd.path.mnt);
  3272. if (error)
  3273. goto exit1;
  3274. mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
  3275. dentry = lookup_hash(&nd);
  3276. error = PTR_ERR(dentry);
  3277. if (!IS_ERR(dentry)) {
  3278. /* Why not before? Because we want correct error value */
  3279. if (nd.last.name[nd.last.len])
  3280. goto slashes;
  3281. inode = dentry->d_inode;
  3282. if (!inode)
  3283. goto slashes;
  3284. ihold(inode);
  3285. error = security_path_unlink(&nd.path, dentry);
  3286. if (error)
  3287. goto exit2;
  3288. error = vfs_unlink(nd.path.dentry->d_inode, dentry);
  3289. exit2:
  3290. dput(dentry);
  3291. }
  3292. mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
  3293. if (inode)
  3294. iput(inode); /* truncate the inode here */
  3295. mnt_drop_write(nd.path.mnt);
  3296. exit1:
  3297. path_put(&nd.path);
  3298. putname(name);
  3299. if (retry_estale(error, lookup_flags)) {
  3300. lookup_flags |= LOOKUP_REVAL;
  3301. inode = NULL;
  3302. goto retry;
  3303. }
  3304. return error;
  3305. slashes:
  3306. error = !dentry->d_inode ? -ENOENT :
  3307. S_ISDIR(dentry->d_inode->i_mode) ? -EISDIR : -ENOTDIR;
  3308. goto exit2;
  3309. }
  3310. SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
  3311. {
  3312. if ((flag & ~AT_REMOVEDIR) != 0)
  3313. return -EINVAL;
  3314. if (flag & AT_REMOVEDIR)
  3315. return do_rmdir(dfd, pathname);
  3316. return do_unlinkat(dfd, pathname);
  3317. }
  3318. SYSCALL_DEFINE1(unlink, const char __user *, pathname)
  3319. {
  3320. return do_unlinkat(AT_FDCWD, pathname);
  3321. }
  3322. int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
  3323. {
  3324. int error = may_create(dir, dentry);
  3325. if (error)
  3326. return error;
  3327. if (!dir->i_op->symlink)
  3328. return -EPERM;
  3329. error = security_inode_symlink(dir, dentry, oldname);
  3330. if (error)
  3331. return error;
  3332. error = dir->i_op->symlink(dir, dentry, oldname);
  3333. if (!error)
  3334. fsnotify_create(dir, dentry);
  3335. return error;
  3336. }
  3337. SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
  3338. int, newdfd, const char __user *, newname)
  3339. {
  3340. int error;
  3341. struct filename *from;
  3342. struct dentry *dentry;
  3343. struct path path;
  3344. unsigned int lookup_flags = 0;
  3345. from = getname(oldname);
  3346. if (IS_ERR(from))
  3347. return PTR_ERR(from);
  3348. retry:
  3349. dentry = user_path_create(newdfd, newname, &path, lookup_flags);
  3350. error = PTR_ERR(dentry);
  3351. if (IS_ERR(dentry))
  3352. goto out_putname;
  3353. error = security_path_symlink(&path, dentry, from->name);
  3354. if (!error)
  3355. error = vfs_symlink(path.dentry->d_inode, dentry, from->name);
  3356. done_path_create(&path, dentry);
  3357. if (retry_estale(error, lookup_flags)) {
  3358. lookup_flags |= LOOKUP_REVAL;
  3359. goto retry;
  3360. }
  3361. out_putname:
  3362. putname(from);
  3363. return error;
  3364. }
  3365. SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
  3366. {
  3367. return sys_symlinkat(oldname, AT_FDCWD, newname);
  3368. }
  3369. int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
  3370. {
  3371. struct inode *inode = old_dentry->d_inode;
  3372. unsigned max_links = dir->i_sb->s_max_links;
  3373. int error;
  3374. if (!inode)
  3375. return -ENOENT;
  3376. error = may_create(dir, new_dentry);
  3377. if (error)
  3378. return error;
  3379. if (dir->i_sb != inode->i_sb)
  3380. return -EXDEV;
  3381. /*
  3382. * A link to an append-only or immutable file cannot be created.
  3383. */
  3384. if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
  3385. return -EPERM;
  3386. if (!dir->i_op->link)
  3387. return -EPERM;
  3388. if (S_ISDIR(inode->i_mode))
  3389. return -EPERM;
  3390. error = security_inode_link(old_dentry, dir, new_dentry);
  3391. if (error)
  3392. return error;
  3393. mutex_lock(&inode->i_mutex);
  3394. /* Make sure we don't allow creating hardlink to an unlinked file */
  3395. if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
  3396. error = -ENOENT;
  3397. else if (max_links && inode->i_nlink >= max_links)
  3398. error = -EMLINK;
  3399. else
  3400. error = dir->i_op->link(old_dentry, dir, new_dentry);
  3401. if (!error && (inode->i_state & I_LINKABLE)) {
  3402. spin_lock(&inode->i_lock);
  3403. inode->i_state &= ~I_LINKABLE;
  3404. spin_unlock(&inode->i_lock);
  3405. }
  3406. mutex_unlock(&inode->i_mutex);
  3407. if (!error)
  3408. fsnotify_link(dir, inode, new_dentry);
  3409. return error;
  3410. }
  3411. /*
  3412. * Hardlinks are often used in delicate situations. We avoid
  3413. * security-related surprises by not following symlinks on the
  3414. * newname. --KAB
  3415. *
  3416. * We don't follow them on the oldname either to be compatible
  3417. * with linux 2.0, and to avoid hard-linking to directories
  3418. * and other special files. --ADM
  3419. */
  3420. SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  3421. int, newdfd, const char __user *, newname, int, flags)
  3422. {
  3423. struct dentry *new_dentry;
  3424. struct path old_path, new_path;
  3425. int how = 0;
  3426. int error;
  3427. if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
  3428. return -EINVAL;
  3429. /*
  3430. * To use null names we require CAP_DAC_READ_SEARCH
  3431. * This ensures that not everyone will be able to create
  3432. * handlink using the passed filedescriptor.
  3433. */
  3434. if (flags & AT_EMPTY_PATH) {
  3435. if (!capable(CAP_DAC_READ_SEARCH))
  3436. return -ENOENT;
  3437. how = LOOKUP_EMPTY;
  3438. }
  3439. if (flags & AT_SYMLINK_FOLLOW)
  3440. how |= LOOKUP_FOLLOW;
  3441. retry:
  3442. error = user_path_at(olddfd, oldname, how, &old_path);
  3443. if (error)
  3444. return error;
  3445. new_dentry = user_path_create(newdfd, newname, &new_path,
  3446. (how & LOOKUP_REVAL));
  3447. error = PTR_ERR(new_dentry);
  3448. if (IS_ERR(new_dentry))
  3449. goto out;
  3450. error = -EXDEV;
  3451. if (old_path.mnt != new_path.mnt)
  3452. goto out_dput;
  3453. error = may_linkat(&old_path);
  3454. if (unlikely(error))
  3455. goto out_dput;
  3456. error = security_path_link(old_path.dentry, &new_path, new_dentry);
  3457. if (error)
  3458. goto out_dput;
  3459. error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry);
  3460. out_dput:
  3461. done_path_create(&new_path, new_dentry);
  3462. if (retry_estale(error, how)) {
  3463. how |= LOOKUP_REVAL;
  3464. goto retry;
  3465. }
  3466. out:
  3467. path_put(&old_path);
  3468. return error;
  3469. }
  3470. SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
  3471. {
  3472. return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
  3473. }
  3474. /*
  3475. * The worst of all namespace operations - renaming directory. "Perverted"
  3476. * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
  3477. * Problems:
  3478. * a) we can get into loop creation. Check is done in is_subdir().
  3479. * b) race potential - two innocent renames can create a loop together.
  3480. * That's where 4.4 screws up. Current fix: serialization on
  3481. * sb->s_vfs_rename_mutex. We might be more accurate, but that's another
  3482. * story.
  3483. * c) we have to lock _three_ objects - parents and victim (if it exists).
  3484. * And that - after we got ->i_mutex on parents (until then we don't know
  3485. * whether the target exists). Solution: try to be smart with locking
  3486. * order for inodes. We rely on the fact that tree topology may change
  3487. * only under ->s_vfs_rename_mutex _and_ that parent of the object we
  3488. * move will be locked. Thus we can rank directories by the tree
  3489. * (ancestors first) and rank all non-directories after them.
  3490. * That works since everybody except rename does "lock parent, lookup,
  3491. * lock child" and rename is under ->s_vfs_rename_mutex.
  3492. * HOWEVER, it relies on the assumption that any object with ->lookup()
  3493. * has no more than 1 dentry. If "hybrid" objects will ever appear,
  3494. * we'd better make sure that there's no link(2) for them.
  3495. * d) conversion from fhandle to dentry may come in the wrong moment - when
  3496. * we are removing the target. Solution: we will have to grab ->i_mutex
  3497. * in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
  3498. * ->i_mutex on parents, which works but leads to some truly excessive
  3499. * locking].
  3500. */
  3501. static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
  3502. struct inode *new_dir, struct dentry *new_dentry)
  3503. {
  3504. int error = 0;
  3505. struct inode *target = new_dentry->d_inode;
  3506. unsigned max_links = new_dir->i_sb->s_max_links;
  3507. /*
  3508. * If we are going to change the parent - check write permissions,
  3509. * we'll need to flip '..'.
  3510. */
  3511. if (new_dir != old_dir) {
  3512. error = inode_permission(old_dentry->d_inode, MAY_WRITE);
  3513. if (error)
  3514. return error;
  3515. }
  3516. error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
  3517. if (error)
  3518. return error;
  3519. dget(new_dentry);
  3520. if (target)
  3521. mutex_lock(&target->i_mutex);
  3522. error = -EBUSY;
  3523. if (d_mountpoint(old_dentry) || d_mountpoint(new_dentry))
  3524. goto out;
  3525. error = -EMLINK;
  3526. if (max_links && !target && new_dir != old_dir &&
  3527. new_dir->i_nlink >= max_links)
  3528. goto out;
  3529. if (target)
  3530. shrink_dcache_parent(new_dentry);
  3531. error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
  3532. if (error)
  3533. goto out;
  3534. if (target) {
  3535. target->i_flags |= S_DEAD;
  3536. dont_mount(new_dentry);
  3537. }
  3538. out:
  3539. if (target)
  3540. mutex_unlock(&target->i_mutex);
  3541. dput(new_dentry);
  3542. if (!error)
  3543. if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
  3544. d_move(old_dentry,new_dentry);
  3545. return error;
  3546. }
  3547. static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
  3548. struct inode *new_dir, struct dentry *new_dentry)
  3549. {
  3550. struct inode *target = new_dentry->d_inode;
  3551. int error;
  3552. error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
  3553. if (error)
  3554. return error;
  3555. dget(new_dentry);
  3556. if (target)
  3557. mutex_lock(&target->i_mutex);
  3558. error = -EBUSY;
  3559. if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
  3560. goto out;
  3561. error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
  3562. if (error)
  3563. goto out;
  3564. if (target)
  3565. dont_mount(new_dentry);
  3566. if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
  3567. d_move(old_dentry, new_dentry);
  3568. out:
  3569. if (target)
  3570. mutex_unlock(&target->i_mutex);
  3571. dput(new_dentry);
  3572. return error;
  3573. }
  3574. int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
  3575. struct inode *new_dir, struct dentry *new_dentry)
  3576. {
  3577. int error;
  3578. int is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
  3579. const unsigned char *old_name;
  3580. if (old_dentry->d_inode == new_dentry->d_inode)
  3581. return 0;
  3582. error = may_delete(old_dir, old_dentry, is_dir);
  3583. if (error)
  3584. return error;
  3585. if (!new_dentry->d_inode)
  3586. error = may_create(new_dir, new_dentry);
  3587. else
  3588. error = may_delete(new_dir, new_dentry, is_dir);
  3589. if (error)
  3590. return error;
  3591. if (!old_dir->i_op->rename)
  3592. return -EPERM;
  3593. old_name = fsnotify_oldname_init(old_dentry->d_name.name);
  3594. if (is_dir)
  3595. error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
  3596. else
  3597. error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
  3598. if (!error)
  3599. fsnotify_move(old_dir, new_dir, old_name, is_dir,
  3600. new_dentry->d_inode, old_dentry);
  3601. fsnotify_oldname_free(old_name);
  3602. return error;
  3603. }
  3604. SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
  3605. int, newdfd, const char __user *, newname)
  3606. {
  3607. struct dentry *old_dir, *new_dir;
  3608. struct dentry *old_dentry, *new_dentry;
  3609. struct dentry *trap;
  3610. struct nameidata oldnd, newnd;
  3611. struct filename *from;
  3612. struct filename *to;
  3613. unsigned int lookup_flags = 0;
  3614. bool should_retry = false;
  3615. int error;
  3616. retry:
  3617. from = user_path_parent(olddfd, oldname, &oldnd, lookup_flags);
  3618. if (IS_ERR(from)) {
  3619. error = PTR_ERR(from);
  3620. goto exit;
  3621. }
  3622. to = user_path_parent(newdfd, newname, &newnd, lookup_flags);
  3623. if (IS_ERR(to)) {
  3624. error = PTR_ERR(to);
  3625. goto exit1;
  3626. }
  3627. error = -EXDEV;
  3628. if (oldnd.path.mnt != newnd.path.mnt)
  3629. goto exit2;
  3630. old_dir = oldnd.path.dentry;
  3631. error = -EBUSY;
  3632. if (oldnd.last_type != LAST_NORM)
  3633. goto exit2;
  3634. new_dir = newnd.path.dentry;
  3635. if (newnd.last_type != LAST_NORM)
  3636. goto exit2;
  3637. error = mnt_want_write(oldnd.path.mnt);
  3638. if (error)
  3639. goto exit2;
  3640. oldnd.flags &= ~LOOKUP_PARENT;
  3641. newnd.flags &= ~LOOKUP_PARENT;
  3642. newnd.flags |= LOOKUP_RENAME_TARGET;
  3643. trap = lock_rename(new_dir, old_dir);
  3644. old_dentry = lookup_hash(&oldnd);
  3645. error = PTR_ERR(old_dentry);
  3646. if (IS_ERR(old_dentry))
  3647. goto exit3;
  3648. /* source must exist */
  3649. error = -ENOENT;
  3650. if (!old_dentry->d_inode)
  3651. goto exit4;
  3652. /* unless the source is a directory trailing slashes give -ENOTDIR */
  3653. if (!S_ISDIR(old_dentry->d_inode->i_mode)) {
  3654. error = -ENOTDIR;
  3655. if (oldnd.last.name[oldnd.last.len])
  3656. goto exit4;
  3657. if (newnd.last.name[newnd.last.len])
  3658. goto exit4;
  3659. }
  3660. /* source should not be ancestor of target */
  3661. error = -EINVAL;
  3662. if (old_dentry == trap)
  3663. goto exit4;
  3664. new_dentry = lookup_hash(&newnd);
  3665. error = PTR_ERR(new_dentry);
  3666. if (IS_ERR(new_dentry))
  3667. goto exit4;
  3668. /* target should not be an ancestor of source */
  3669. error = -ENOTEMPTY;
  3670. if (new_dentry == trap)
  3671. goto exit5;
  3672. error = security_path_rename(&oldnd.path, old_dentry,
  3673. &newnd.path, new_dentry);
  3674. if (error)
  3675. goto exit5;
  3676. error = vfs_rename(old_dir->d_inode, old_dentry,
  3677. new_dir->d_inode, new_dentry);
  3678. exit5:
  3679. dput(new_dentry);
  3680. exit4:
  3681. dput(old_dentry);
  3682. exit3:
  3683. unlock_rename(new_dir, old_dir);
  3684. mnt_drop_write(oldnd.path.mnt);
  3685. exit2:
  3686. if (retry_estale(error, lookup_flags))
  3687. should_retry = true;
  3688. path_put(&newnd.path);
  3689. putname(to);
  3690. exit1:
  3691. path_put(&oldnd.path);
  3692. putname(from);
  3693. if (should_retry) {
  3694. should_retry = false;
  3695. lookup_flags |= LOOKUP_REVAL;
  3696. goto retry;
  3697. }
  3698. exit:
  3699. return error;
  3700. }
  3701. SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
  3702. {
  3703. return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname);
  3704. }
  3705. int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
  3706. {
  3707. int len;
  3708. len = PTR_ERR(link);
  3709. if (IS_ERR(link))
  3710. goto out;
  3711. len = strlen(link);
  3712. if (len > (unsigned) buflen)
  3713. len = buflen;
  3714. if (copy_to_user(buffer, link, len))
  3715. len = -EFAULT;
  3716. out:
  3717. return len;
  3718. }
  3719. /*
  3720. * A helper for ->readlink(). This should be used *ONLY* for symlinks that
  3721. * have ->follow_link() touching nd only in nd_set_link(). Using (or not
  3722. * using) it for any given inode is up to filesystem.
  3723. */
  3724. int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
  3725. {
  3726. struct nameidata nd;
  3727. void *cookie;
  3728. int res;
  3729. nd.depth = 0;
  3730. cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
  3731. if (IS_ERR(cookie))
  3732. return PTR_ERR(cookie);
  3733. res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
  3734. if (dentry->d_inode->i_op->put_link)
  3735. dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
  3736. return res;
  3737. }
  3738. int vfs_follow_link(struct nameidata *nd, const char *link)
  3739. {
  3740. return __vfs_follow_link(nd, link);
  3741. }
  3742. /* get the link contents into pagecache */
  3743. static char *page_getlink(struct dentry * dentry, struct page **ppage)
  3744. {
  3745. char *kaddr;
  3746. struct page *page;
  3747. struct address_space *mapping = dentry->d_inode->i_mapping;
  3748. page = read_mapping_page(mapping, 0, NULL);
  3749. if (IS_ERR(page))
  3750. return (char*)page;
  3751. *ppage = page;
  3752. kaddr = kmap(page);
  3753. nd_terminate_link(kaddr, dentry->d_inode->i_size, PAGE_SIZE - 1);
  3754. return kaddr;
  3755. }
  3756. int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
  3757. {
  3758. struct page *page = NULL;
  3759. char *s = page_getlink(dentry, &page);
  3760. int res = vfs_readlink(dentry,buffer,buflen,s);
  3761. if (page) {
  3762. kunmap(page);
  3763. page_cache_release(page);
  3764. }
  3765. return res;
  3766. }
  3767. void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
  3768. {
  3769. struct page *page = NULL;
  3770. nd_set_link(nd, page_getlink(dentry, &page));
  3771. return page;
  3772. }
  3773. void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
  3774. {
  3775. struct page *page = cookie;
  3776. if (page) {
  3777. kunmap(page);
  3778. page_cache_release(page);
  3779. }
  3780. }
  3781. /*
  3782. * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
  3783. */
  3784. int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
  3785. {
  3786. struct address_space *mapping = inode->i_mapping;
  3787. struct page *page;
  3788. void *fsdata;
  3789. int err;
  3790. char *kaddr;
  3791. unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
  3792. if (nofs)
  3793. flags |= AOP_FLAG_NOFS;
  3794. retry:
  3795. err = pagecache_write_begin(NULL, mapping, 0, len-1,
  3796. flags, &page, &fsdata);
  3797. if (err)
  3798. goto fail;
  3799. kaddr = kmap_atomic(page);
  3800. memcpy(kaddr, symname, len-1);
  3801. kunmap_atomic(kaddr);
  3802. err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
  3803. page, fsdata);
  3804. if (err < 0)
  3805. goto fail;
  3806. if (err < len-1)
  3807. goto retry;
  3808. mark_inode_dirty(inode);
  3809. return 0;
  3810. fail:
  3811. return err;
  3812. }
  3813. int page_symlink(struct inode *inode, const char *symname, int len)
  3814. {
  3815. return __page_symlink(inode, symname, len,
  3816. !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS));
  3817. }
  3818. const struct inode_operations page_symlink_inode_operations = {
  3819. .readlink = generic_readlink,
  3820. .follow_link = page_follow_link_light,
  3821. .put_link = page_put_link,
  3822. };
  3823. EXPORT_SYMBOL(user_path_at);
  3824. EXPORT_SYMBOL(follow_down_one);
  3825. EXPORT_SYMBOL(follow_down);
  3826. EXPORT_SYMBOL(follow_up);
  3827. EXPORT_SYMBOL(get_write_access); /* nfsd */
  3828. EXPORT_SYMBOL(lock_rename);
  3829. EXPORT_SYMBOL(lookup_one_len);
  3830. EXPORT_SYMBOL(page_follow_link_light);
  3831. EXPORT_SYMBOL(page_put_link);
  3832. EXPORT_SYMBOL(page_readlink);
  3833. EXPORT_SYMBOL(__page_symlink);
  3834. EXPORT_SYMBOL(page_symlink);
  3835. EXPORT_SYMBOL(page_symlink_inode_operations);
  3836. EXPORT_SYMBOL(kern_path);
  3837. EXPORT_SYMBOL(vfs_path_lookup);
  3838. EXPORT_SYMBOL(inode_permission);
  3839. EXPORT_SYMBOL(unlock_rename);
  3840. EXPORT_SYMBOL(vfs_create);
  3841. EXPORT_SYMBOL(vfs_follow_link);
  3842. EXPORT_SYMBOL(vfs_link);
  3843. EXPORT_SYMBOL(vfs_mkdir);
  3844. EXPORT_SYMBOL(vfs_mknod);
  3845. EXPORT_SYMBOL(generic_permission);
  3846. EXPORT_SYMBOL(vfs_readlink);
  3847. EXPORT_SYMBOL(vfs_rename);
  3848. EXPORT_SYMBOL(vfs_rmdir);
  3849. EXPORT_SYMBOL(vfs_symlink);
  3850. EXPORT_SYMBOL(vfs_unlink);
  3851. EXPORT_SYMBOL(dentry_unhash);
  3852. EXPORT_SYMBOL(generic_readlink);