• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  *  linux/fs/namei.c
4  *
5  *  Copyright (C) 1991, 1992  Linus Torvalds
6  */
7 
8 /*
9  * Some corrections by tytso.
10  */
11 
12 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
13  * lookup logic.
14  */
15 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
16  */
17 
18 #include <linux/init.h>
19 #include <linux/export.h>
20 #include <linux/kernel.h>
21 #include <linux/slab.h>
22 #include <linux/fs.h>
23 #include <linux/namei.h>
24 #include <linux/pagemap.h>
25 #include <linux/fsnotify.h>
26 #include <linux/personality.h>
27 #include <linux/security.h>
28 #include <linux/ima.h>
29 #include <linux/syscalls.h>
30 #include <linux/mount.h>
31 #include <linux/audit.h>
32 #include <linux/capability.h>
33 #include <linux/file.h>
34 #include <linux/fcntl.h>
35 #include <linux/device_cgroup.h>
36 #include <linux/fs_struct.h>
37 #include <linux/posix_acl.h>
38 #include <linux/hash.h>
39 #include <linux/bitops.h>
40 #include <linux/init_task.h>
41 #include <linux/uaccess.h>
42 
43 #include "internal.h"
44 #include "mount.h"
45 
46 /* [Feb-1997 T. Schoebel-Theuer]
47  * Fundamental changes in the pathname lookup mechanisms (namei)
48  * were necessary because of omirr.  The reason is that omirr needs
49  * to know the _real_ pathname, not the user-supplied one, in case
50  * of symlinks (and also when transname replacements occur).
51  *
52  * The new code replaces the old recursive symlink resolution with
53  * an iterative one (in case of non-nested symlink chains).  It does
54  * this with calls to <fs>_follow_link().
55  * As a side effect, dir_namei(), _namei() and follow_link() are now
56  * replaced with a single function lookup_dentry() that can handle all
57  * the special cases of the former code.
58  *
59  * With the new dcache, the pathname is stored at each inode, at least as
60  * long as the refcount of the inode is positive.  As a side effect, the
61  * size of the dcache depends on the inode cache and thus is dynamic.
62  *
63  * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
64  * resolution to correspond with current state of the code.
65  *
66  * Note that the symlink resolution is not *completely* iterative.
67  * There is still a significant amount of tail- and mid- recursion in
68  * the algorithm.  Also, note that <fs>_readlink() is not used in
69  * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
70  * may return different results than <fs>_follow_link().  Many virtual
71  * filesystems (including /proc) exhibit this behavior.
72  */
73 
74 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
75  * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
76  * and the name already exists in form of a symlink, try to create the new
77  * name indicated by the symlink. The old code always complained that the
78  * name already exists, due to not following the symlink even if its target
79  * is nonexistent.  The new semantics affects also mknod() and link() when
80  * the name is a symlink pointing to a non-existent name.
81  *
82  * I don't know which semantics is the right one, since I have no access
83  * to standards. But I found by trial that HP-UX 9.0 has the full "new"
84  * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
85  * "old" one. Personally, I think the new semantics is much more logical.
86  * Note that "ln old new" where "new" is a symlink pointing to a non-existing
87  * file does succeed in both HP-UX and SunOs, but not in Solaris
88  * and in the old Linux semantics.
89  */
90 
91 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
92  * semantics.  See the comments in "open_namei" and "do_link" below.
93  *
94  * [10-Sep-98 Alan Modra] Another symlink change.
95  */
96 
97 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
98  *	inside the path - always follow.
99  *	in the last component in creation/removal/renaming - never follow.
100  *	if LOOKUP_FOLLOW passed - follow.
101  *	if the pathname has trailing slashes - follow.
102  *	otherwise - don't follow.
103  * (applied in that order).
104  *
105  * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
106  * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
107  * During the 2.4 we need to fix the userland stuff depending on it -
108  * hopefully we will be able to get rid of that wart in 2.5. So far only
109  * XEmacs seems to be relying on it...
110  */
111 /*
112  * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
113  * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
114  * any extra contention...
115  */
116 
117 /* In order to reduce some races, while at the same time doing additional
118  * checking and hopefully speeding things up, we copy filenames to the
119  * kernel data space before using them..
120  *
121  * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
122  * PATH_MAX includes the nul terminator --RR.
123  */
124 
125 #define EMBEDDED_NAME_MAX	(PATH_MAX - offsetof(struct filename, iname))
126 
127 struct filename *
getname_flags(const char __user * filename,int flags,int * empty)128 getname_flags(const char __user *filename, int flags, int *empty)
129 {
130 	struct filename *result;
131 	char *kname;
132 	int len;
133 
134 	result = audit_reusename(filename);
135 	if (result)
136 		return result;
137 
138 	result = __getname();
139 	if (unlikely(!result))
140 		return ERR_PTR(-ENOMEM);
141 
142 	/*
143 	 * First, try to embed the struct filename inside the names_cache
144 	 * allocation
145 	 */
146 	kname = (char *)result->iname;
147 	result->name = kname;
148 
149 	len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
150 	if (unlikely(len < 0)) {
151 		__putname(result);
152 		return ERR_PTR(len);
153 	}
154 
155 	/*
156 	 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
157 	 * separate struct filename so we can dedicate the entire
158 	 * names_cache allocation for the pathname, and re-do the copy from
159 	 * userland.
160 	 */
161 	if (unlikely(len == EMBEDDED_NAME_MAX)) {
162 		const size_t size = offsetof(struct filename, iname[1]);
163 		kname = (char *)result;
164 
165 		/*
166 		 * size is chosen that way we to guarantee that
167 		 * result->iname[0] is within the same object and that
168 		 * kname can't be equal to result->iname, no matter what.
169 		 */
170 		result = kzalloc(size, GFP_KERNEL);
171 		if (unlikely(!result)) {
172 			__putname(kname);
173 			return ERR_PTR(-ENOMEM);
174 		}
175 		result->name = kname;
176 		len = strncpy_from_user(kname, filename, PATH_MAX);
177 		if (unlikely(len < 0)) {
178 			__putname(kname);
179 			kfree(result);
180 			return ERR_PTR(len);
181 		}
182 		if (unlikely(len == PATH_MAX)) {
183 			__putname(kname);
184 			kfree(result);
185 			return ERR_PTR(-ENAMETOOLONG);
186 		}
187 	}
188 
189 	result->refcnt = 1;
190 	/* The empty path is special. */
191 	if (unlikely(!len)) {
192 		if (empty)
193 			*empty = 1;
194 		if (!(flags & LOOKUP_EMPTY)) {
195 			putname(result);
196 			return ERR_PTR(-ENOENT);
197 		}
198 	}
199 
200 	result->uptr = filename;
201 	result->aname = NULL;
202 	audit_getname(result);
203 	return result;
204 }
205 
206 struct filename *
getname(const char __user * filename)207 getname(const char __user * filename)
208 {
209 	return getname_flags(filename, 0, NULL);
210 }
211 
212 struct filename *
getname_kernel(const char * filename)213 getname_kernel(const char * filename)
214 {
215 	struct filename *result;
216 	int len = strlen(filename) + 1;
217 
218 	result = __getname();
219 	if (unlikely(!result))
220 		return ERR_PTR(-ENOMEM);
221 
222 	if (len <= EMBEDDED_NAME_MAX) {
223 		result->name = (char *)result->iname;
224 	} else if (len <= PATH_MAX) {
225 		const size_t size = offsetof(struct filename, iname[1]);
226 		struct filename *tmp;
227 
228 		tmp = kmalloc(size, GFP_KERNEL);
229 		if (unlikely(!tmp)) {
230 			__putname(result);
231 			return ERR_PTR(-ENOMEM);
232 		}
233 		tmp->name = (char *)result;
234 		result = tmp;
235 	} else {
236 		__putname(result);
237 		return ERR_PTR(-ENAMETOOLONG);
238 	}
239 	memcpy((char *)result->name, filename, len);
240 	result->uptr = NULL;
241 	result->aname = NULL;
242 	result->refcnt = 1;
243 	audit_getname(result);
244 
245 	return result;
246 }
247 
putname(struct filename * name)248 void putname(struct filename *name)
249 {
250 	BUG_ON(name->refcnt <= 0);
251 
252 	if (--name->refcnt > 0)
253 		return;
254 
255 	if (name->name != name->iname) {
256 		__putname(name->name);
257 		kfree(name);
258 	} else
259 		__putname(name);
260 }
261 
check_acl(struct inode * inode,int mask)262 static int check_acl(struct inode *inode, int mask)
263 {
264 #ifdef CONFIG_FS_POSIX_ACL
265 	struct posix_acl *acl;
266 
267 	if (mask & MAY_NOT_BLOCK) {
268 		acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
269 	        if (!acl)
270 	                return -EAGAIN;
271 		/* no ->get_acl() calls in RCU mode... */
272 		if (is_uncached_acl(acl))
273 			return -ECHILD;
274 	        return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
275 	}
276 
277 	acl = get_acl(inode, ACL_TYPE_ACCESS);
278 	if (IS_ERR(acl))
279 		return PTR_ERR(acl);
280 	if (acl) {
281 	        int error = posix_acl_permission(inode, acl, mask);
282 	        posix_acl_release(acl);
283 	        return error;
284 	}
285 #endif
286 
287 	return -EAGAIN;
288 }
289 
290 /*
291  * This does the basic permission checking
292  */
acl_permission_check(struct inode * inode,int mask)293 static int acl_permission_check(struct inode *inode, int mask)
294 {
295 	unsigned int mode = inode->i_mode;
296 
297 	if (likely(uid_eq(current_fsuid(), inode->i_uid)))
298 		mode >>= 6;
299 	else {
300 		if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
301 			int error = check_acl(inode, mask);
302 			if (error != -EAGAIN)
303 				return error;
304 		}
305 
306 		if (in_group_p(inode->i_gid))
307 			mode >>= 3;
308 	}
309 
310 	/*
311 	 * If the DACs are ok we don't need any capability check.
312 	 */
313 	if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
314 		return 0;
315 	return -EACCES;
316 }
317 
318 /**
319  * generic_permission -  check for access rights on a Posix-like filesystem
320  * @inode:	inode to check access rights for
321  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...)
322  *
323  * Used to check for read/write/execute permissions on a file.
324  * We use "fsuid" for this, letting us set arbitrary permissions
325  * for filesystem access without changing the "normal" uids which
326  * are used for other things.
327  *
328  * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
329  * request cannot be satisfied (eg. requires blocking or too much complexity).
330  * It would then be called again in ref-walk mode.
331  */
generic_permission(struct inode * inode,int mask)332 int generic_permission(struct inode *inode, int mask)
333 {
334 	int ret;
335 
336 	/*
337 	 * Do the basic permission checks.
338 	 */
339 	ret = acl_permission_check(inode, mask);
340 	if (ret != -EACCES)
341 		return ret;
342 
343 	if (S_ISDIR(inode->i_mode)) {
344 		/* DACs are overridable for directories */
345 		if (!(mask & MAY_WRITE))
346 			if (capable_wrt_inode_uidgid(inode,
347 						     CAP_DAC_READ_SEARCH))
348 				return 0;
349 		if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
350 			return 0;
351 		return -EACCES;
352 	}
353 
354 	/*
355 	 * Searching includes executable on directories, else just read.
356 	 */
357 	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
358 	if (mask == MAY_READ)
359 		if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))
360 			return 0;
361 	/*
362 	 * Read/write DACs are always overridable.
363 	 * Executable DACs are overridable when there is
364 	 * at least one exec bit set.
365 	 */
366 	if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
367 		if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
368 			return 0;
369 
370 	return -EACCES;
371 }
372 EXPORT_SYMBOL(generic_permission);
373 
374 /*
375  * We _really_ want to just do "generic_permission()" without
376  * even looking at the inode->i_op values. So we keep a cache
377  * flag in inode->i_opflags, that says "this has not special
378  * permission function, use the fast case".
379  */
do_inode_permission(struct vfsmount * mnt,struct inode * inode,int mask)380 static inline int do_inode_permission(struct vfsmount *mnt, struct inode *inode, int mask)
381 {
382 	if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
383 		if (likely(mnt && inode->i_op->permission2))
384 			return inode->i_op->permission2(mnt, inode, mask);
385 		if (likely(inode->i_op->permission))
386 			return inode->i_op->permission(inode, mask);
387 
388 		/* This gets set once for the inode lifetime */
389 		spin_lock(&inode->i_lock);
390 		inode->i_opflags |= IOP_FASTPERM;
391 		spin_unlock(&inode->i_lock);
392 	}
393 	return generic_permission(inode, mask);
394 }
395 
396 /**
397  * __inode_permission - Check for access rights to a given inode
398  * @inode: Inode to check permission on
399  * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
400  *
401  * Check for read/write/execute permissions on an inode.
402  *
403  * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
404  *
405  * This does not check for a read-only file system.  You probably want
406  * inode_permission().
407  */
__inode_permission2(struct vfsmount * mnt,struct inode * inode,int mask)408 int __inode_permission2(struct vfsmount *mnt, struct inode *inode, int mask)
409 {
410 	int retval;
411 
412 	if (unlikely(mask & MAY_WRITE)) {
413 		/*
414 		 * Nobody gets write access to an immutable file.
415 		 */
416 		if (IS_IMMUTABLE(inode))
417 			return -EPERM;
418 
419 		/*
420 		 * Updating mtime will likely cause i_uid and i_gid to be
421 		 * written back improperly if their true value is unknown
422 		 * to the vfs.
423 		 */
424 		if (HAS_UNMAPPED_ID(inode))
425 			return -EACCES;
426 	}
427 
428 	retval = do_inode_permission(mnt, inode, mask);
429 	if (retval)
430 		return retval;
431 
432 	retval = devcgroup_inode_permission(inode, mask);
433 	if (retval)
434 		return retval;
435 
436 	retval = security_inode_permission(inode, mask);
437 	return retval;
438 }
439 EXPORT_SYMBOL(__inode_permission2);
440 
__inode_permission(struct inode * inode,int mask)441 int __inode_permission(struct inode *inode, int mask)
442 {
443 	return __inode_permission2(NULL, inode, mask);
444 }
445 EXPORT_SYMBOL(__inode_permission);
446 
447 /**
448  * sb_permission - Check superblock-level permissions
449  * @sb: Superblock of inode to check permission on
450  * @inode: Inode to check permission on
451  * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
452  *
453  * Separate out file-system wide checks from inode-specific permission checks.
454  */
sb_permission(struct super_block * sb,struct inode * inode,int mask)455 static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
456 {
457 	if (unlikely(mask & MAY_WRITE)) {
458 		umode_t mode = inode->i_mode;
459 
460 		/* Nobody gets write access to a read-only fs. */
461 		if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
462 			return -EROFS;
463 	}
464 	return 0;
465 }
466 
467 /**
468  * inode_permission - Check for access rights to a given inode
469  * @inode: Inode to check permission on
470  * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
471  *
472  * Check for read/write/execute permissions on an inode.  We use fs[ug]id for
473  * this, letting us set arbitrary permissions for filesystem access without
474  * changing the "normal" UIDs which are used for other things.
475  *
476  * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
477  */
inode_permission2(struct vfsmount * mnt,struct inode * inode,int mask)478 int inode_permission2(struct vfsmount *mnt, struct inode *inode, int mask)
479 {
480 	int retval;
481 
482 	retval = sb_permission(inode->i_sb, inode, mask);
483 	if (retval)
484 		return retval;
485 	return __inode_permission2(mnt, inode, mask);
486 }
487 EXPORT_SYMBOL(inode_permission2);
488 
inode_permission(struct inode * inode,int mask)489 int inode_permission(struct inode *inode, int mask)
490 {
491 	return inode_permission2(NULL, inode, mask);
492 }
493 EXPORT_SYMBOL(inode_permission);
494 
495 /**
496  * path_get - get a reference to a path
497  * @path: path to get the reference to
498  *
499  * Given a path increment the reference count to the dentry and the vfsmount.
500  */
path_get(const struct path * path)501 void path_get(const struct path *path)
502 {
503 	mntget(path->mnt);
504 	dget(path->dentry);
505 }
506 EXPORT_SYMBOL(path_get);
507 
508 /**
509  * path_put - put a reference to a path
510  * @path: path to put the reference to
511  *
512  * Given a path decrement the reference count to the dentry and the vfsmount.
513  */
path_put(const struct path * path)514 void path_put(const struct path *path)
515 {
516 	dput(path->dentry);
517 	mntput(path->mnt);
518 }
519 EXPORT_SYMBOL(path_put);
520 
521 #define EMBEDDED_LEVELS 2
522 struct nameidata {
523 	struct path	path;
524 	struct qstr	last;
525 	struct path	root;
526 	struct inode	*inode; /* path.dentry.d_inode */
527 	unsigned int	flags;
528 	unsigned	seq, m_seq;
529 	int		last_type;
530 	unsigned	depth;
531 	int		total_link_count;
532 	struct saved {
533 		struct path link;
534 		struct delayed_call done;
535 		const char *name;
536 		unsigned seq;
537 	} *stack, internal[EMBEDDED_LEVELS];
538 	struct filename	*name;
539 	struct nameidata *saved;
540 	struct inode	*link_inode;
541 	unsigned	root_seq;
542 	int		dfd;
543 } __randomize_layout;
544 
set_nameidata(struct nameidata * p,int dfd,struct filename * name)545 static void set_nameidata(struct nameidata *p, int dfd, struct filename *name)
546 {
547 	struct nameidata *old = current->nameidata;
548 	p->stack = p->internal;
549 	p->dfd = dfd;
550 	p->name = name;
551 	p->total_link_count = old ? old->total_link_count : 0;
552 	p->saved = old;
553 	current->nameidata = p;
554 }
555 
restore_nameidata(void)556 static void restore_nameidata(void)
557 {
558 	struct nameidata *now = current->nameidata, *old = now->saved;
559 
560 	current->nameidata = old;
561 	if (old)
562 		old->total_link_count = now->total_link_count;
563 	if (now->stack != now->internal)
564 		kfree(now->stack);
565 }
566 
__nd_alloc_stack(struct nameidata * nd)567 static int __nd_alloc_stack(struct nameidata *nd)
568 {
569 	struct saved *p;
570 
571 	if (nd->flags & LOOKUP_RCU) {
572 		p= kmalloc(MAXSYMLINKS * sizeof(struct saved),
573 				  GFP_ATOMIC);
574 		if (unlikely(!p))
575 			return -ECHILD;
576 	} else {
577 		p= kmalloc(MAXSYMLINKS * sizeof(struct saved),
578 				  GFP_KERNEL);
579 		if (unlikely(!p))
580 			return -ENOMEM;
581 	}
582 	memcpy(p, nd->internal, sizeof(nd->internal));
583 	nd->stack = p;
584 	return 0;
585 }
586 
587 /**
588  * path_connected - Verify that a path->dentry is below path->mnt.mnt_root
589  * @path: nameidate to verify
590  *
591  * Rename can sometimes move a file or directory outside of a bind
592  * mount, path_connected allows those cases to be detected.
593  */
path_connected(const struct path * path)594 static bool path_connected(const struct path *path)
595 {
596 	struct vfsmount *mnt = path->mnt;
597 	struct super_block *sb = mnt->mnt_sb;
598 
599 	/* Bind mounts and multi-root filesystems can have disconnected paths */
600 	if (!(sb->s_iflags & SB_I_MULTIROOT) && (mnt->mnt_root == sb->s_root))
601 		return true;
602 
603 	return is_subdir(path->dentry, mnt->mnt_root);
604 }
605 
nd_alloc_stack(struct nameidata * nd)606 static inline int nd_alloc_stack(struct nameidata *nd)
607 {
608 	if (likely(nd->depth != EMBEDDED_LEVELS))
609 		return 0;
610 	if (likely(nd->stack != nd->internal))
611 		return 0;
612 	return __nd_alloc_stack(nd);
613 }
614 
drop_links(struct nameidata * nd)615 static void drop_links(struct nameidata *nd)
616 {
617 	int i = nd->depth;
618 	while (i--) {
619 		struct saved *last = nd->stack + i;
620 		do_delayed_call(&last->done);
621 		clear_delayed_call(&last->done);
622 	}
623 }
624 
terminate_walk(struct nameidata * nd)625 static void terminate_walk(struct nameidata *nd)
626 {
627 	drop_links(nd);
628 	if (!(nd->flags & LOOKUP_RCU)) {
629 		int i;
630 		path_put(&nd->path);
631 		for (i = 0; i < nd->depth; i++)
632 			path_put(&nd->stack[i].link);
633 		if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
634 			path_put(&nd->root);
635 			nd->root.mnt = NULL;
636 		}
637 	} else {
638 		nd->flags &= ~LOOKUP_RCU;
639 		if (!(nd->flags & LOOKUP_ROOT))
640 			nd->root.mnt = NULL;
641 		rcu_read_unlock();
642 	}
643 	nd->depth = 0;
644 }
645 
646 /* path_put is needed afterwards regardless of success or failure */
legitimize_path(struct nameidata * nd,struct path * path,unsigned seq)647 static bool legitimize_path(struct nameidata *nd,
648 			    struct path *path, unsigned seq)
649 {
650 	int res = __legitimize_mnt(path->mnt, nd->m_seq);
651 	if (unlikely(res)) {
652 		if (res > 0)
653 			path->mnt = NULL;
654 		path->dentry = NULL;
655 		return false;
656 	}
657 	if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
658 		path->dentry = NULL;
659 		return false;
660 	}
661 	return !read_seqcount_retry(&path->dentry->d_seq, seq);
662 }
663 
legitimize_links(struct nameidata * nd)664 static bool legitimize_links(struct nameidata *nd)
665 {
666 	int i;
667 	for (i = 0; i < nd->depth; i++) {
668 		struct saved *last = nd->stack + i;
669 		if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
670 			drop_links(nd);
671 			nd->depth = i + 1;
672 			return false;
673 		}
674 	}
675 	return true;
676 }
677 
678 /*
679  * Path walking has 2 modes, rcu-walk and ref-walk (see
680  * Documentation/filesystems/path-lookup.txt).  In situations when we can't
681  * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
682  * normal reference counts on dentries and vfsmounts to transition to ref-walk
683  * mode.  Refcounts are grabbed at the last known good point before rcu-walk
684  * got stuck, so ref-walk may continue from there. If this is not successful
685  * (eg. a seqcount has changed), then failure is returned and it's up to caller
686  * to restart the path walk from the beginning in ref-walk mode.
687  */
688 
689 /**
690  * unlazy_walk - try to switch to ref-walk mode.
691  * @nd: nameidata pathwalk data
692  * Returns: 0 on success, -ECHILD on failure
693  *
694  * unlazy_walk attempts to legitimize the current nd->path and nd->root
695  * for ref-walk mode.
696  * Must be called from rcu-walk context.
697  * Nothing should touch nameidata between unlazy_walk() failure and
698  * terminate_walk().
699  */
unlazy_walk(struct nameidata * nd)700 static int unlazy_walk(struct nameidata *nd)
701 {
702 	struct dentry *parent = nd->path.dentry;
703 
704 	BUG_ON(!(nd->flags & LOOKUP_RCU));
705 
706 	nd->flags &= ~LOOKUP_RCU;
707 	if (unlikely(!legitimize_links(nd)))
708 		goto out2;
709 	if (unlikely(!legitimize_path(nd, &nd->path, nd->seq)))
710 		goto out1;
711 	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
712 		if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq)))
713 			goto out;
714 	}
715 	rcu_read_unlock();
716 	BUG_ON(nd->inode != parent->d_inode);
717 	return 0;
718 
719 out2:
720 	nd->path.mnt = NULL;
721 	nd->path.dentry = NULL;
722 out1:
723 	if (!(nd->flags & LOOKUP_ROOT))
724 		nd->root.mnt = NULL;
725 out:
726 	rcu_read_unlock();
727 	return -ECHILD;
728 }
729 
730 /**
731  * unlazy_child - try to switch to ref-walk mode.
732  * @nd: nameidata pathwalk data
733  * @dentry: child of nd->path.dentry
734  * @seq: seq number to check dentry against
735  * Returns: 0 on success, -ECHILD on failure
736  *
737  * unlazy_child attempts to legitimize the current nd->path, nd->root and dentry
738  * for ref-walk mode.  @dentry must be a path found by a do_lookup call on
739  * @nd.  Must be called from rcu-walk context.
740  * Nothing should touch nameidata between unlazy_child() failure and
741  * terminate_walk().
742  */
unlazy_child(struct nameidata * nd,struct dentry * dentry,unsigned seq)743 static int unlazy_child(struct nameidata *nd, struct dentry *dentry, unsigned seq)
744 {
745 	BUG_ON(!(nd->flags & LOOKUP_RCU));
746 
747 	nd->flags &= ~LOOKUP_RCU;
748 	if (unlikely(!legitimize_links(nd)))
749 		goto out2;
750 	if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq)))
751 		goto out2;
752 	if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref)))
753 		goto out1;
754 
755 	/*
756 	 * We need to move both the parent and the dentry from the RCU domain
757 	 * to be properly refcounted. And the sequence number in the dentry
758 	 * validates *both* dentry counters, since we checked the sequence
759 	 * number of the parent after we got the child sequence number. So we
760 	 * know the parent must still be valid if the child sequence number is
761 	 */
762 	if (unlikely(!lockref_get_not_dead(&dentry->d_lockref)))
763 		goto out;
764 	if (unlikely(read_seqcount_retry(&dentry->d_seq, seq))) {
765 		rcu_read_unlock();
766 		dput(dentry);
767 		goto drop_root_mnt;
768 	}
769 	/*
770 	 * Sequence counts matched. Now make sure that the root is
771 	 * still valid and get it if required.
772 	 */
773 	if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
774 		if (unlikely(!legitimize_path(nd, &nd->root, nd->root_seq))) {
775 			rcu_read_unlock();
776 			dput(dentry);
777 			return -ECHILD;
778 		}
779 	}
780 
781 	rcu_read_unlock();
782 	return 0;
783 
784 out2:
785 	nd->path.mnt = NULL;
786 out1:
787 	nd->path.dentry = NULL;
788 out:
789 	rcu_read_unlock();
790 drop_root_mnt:
791 	if (!(nd->flags & LOOKUP_ROOT))
792 		nd->root.mnt = NULL;
793 	return -ECHILD;
794 }
795 
d_revalidate(struct dentry * dentry,unsigned int flags)796 static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
797 {
798 	if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
799 		return dentry->d_op->d_revalidate(dentry, flags);
800 	else
801 		return 1;
802 }
803 
804 /**
805  * complete_walk - successful completion of path walk
806  * @nd:  pointer nameidata
807  *
808  * If we had been in RCU mode, drop out of it and legitimize nd->path.
809  * Revalidate the final result, unless we'd already done that during
810  * the path walk or the filesystem doesn't ask for it.  Return 0 on
811  * success, -error on failure.  In case of failure caller does not
812  * need to drop nd->path.
813  */
complete_walk(struct nameidata * nd)814 static int complete_walk(struct nameidata *nd)
815 {
816 	struct dentry *dentry = nd->path.dentry;
817 	int status;
818 
819 	if (nd->flags & LOOKUP_RCU) {
820 		if (!(nd->flags & LOOKUP_ROOT))
821 			nd->root.mnt = NULL;
822 		if (unlikely(unlazy_walk(nd)))
823 			return -ECHILD;
824 	}
825 
826 	if (likely(!(nd->flags & LOOKUP_JUMPED)))
827 		return 0;
828 
829 	if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
830 		return 0;
831 
832 	status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
833 	if (status > 0)
834 		return 0;
835 
836 	if (!status)
837 		status = -ESTALE;
838 
839 	return status;
840 }
841 
set_root(struct nameidata * nd)842 static void set_root(struct nameidata *nd)
843 {
844 	struct fs_struct *fs = current->fs;
845 
846 	if (nd->flags & LOOKUP_RCU) {
847 		unsigned seq;
848 
849 		do {
850 			seq = read_seqcount_begin(&fs->seq);
851 			nd->root = fs->root;
852 			nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
853 		} while (read_seqcount_retry(&fs->seq, seq));
854 	} else {
855 		get_fs_root(fs, &nd->root);
856 	}
857 }
858 
path_put_conditional(struct path * path,struct nameidata * nd)859 static void path_put_conditional(struct path *path, struct nameidata *nd)
860 {
861 	dput(path->dentry);
862 	if (path->mnt != nd->path.mnt)
863 		mntput(path->mnt);
864 }
865 
path_to_nameidata(const struct path * path,struct nameidata * nd)866 static inline void path_to_nameidata(const struct path *path,
867 					struct nameidata *nd)
868 {
869 	if (!(nd->flags & LOOKUP_RCU)) {
870 		dput(nd->path.dentry);
871 		if (nd->path.mnt != path->mnt)
872 			mntput(nd->path.mnt);
873 	}
874 	nd->path.mnt = path->mnt;
875 	nd->path.dentry = path->dentry;
876 }
877 
nd_jump_root(struct nameidata * nd)878 static int nd_jump_root(struct nameidata *nd)
879 {
880 	if (nd->flags & LOOKUP_RCU) {
881 		struct dentry *d;
882 		nd->path = nd->root;
883 		d = nd->path.dentry;
884 		nd->inode = d->d_inode;
885 		nd->seq = nd->root_seq;
886 		if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq)))
887 			return -ECHILD;
888 	} else {
889 		path_put(&nd->path);
890 		nd->path = nd->root;
891 		path_get(&nd->path);
892 		nd->inode = nd->path.dentry->d_inode;
893 	}
894 	nd->flags |= LOOKUP_JUMPED;
895 	return 0;
896 }
897 
898 /*
899  * Helper to directly jump to a known parsed path from ->get_link,
900  * caller must have taken a reference to path beforehand.
901  */
nd_jump_link(struct path * path)902 void nd_jump_link(struct path *path)
903 {
904 	struct nameidata *nd = current->nameidata;
905 	path_put(&nd->path);
906 
907 	nd->path = *path;
908 	nd->inode = nd->path.dentry->d_inode;
909 	nd->flags |= LOOKUP_JUMPED;
910 }
911 
put_link(struct nameidata * nd)912 static inline void put_link(struct nameidata *nd)
913 {
914 	struct saved *last = nd->stack + --nd->depth;
915 	do_delayed_call(&last->done);
916 	if (!(nd->flags & LOOKUP_RCU))
917 		path_put(&last->link);
918 }
919 
920 int sysctl_protected_symlinks __read_mostly = 0;
921 int sysctl_protected_hardlinks __read_mostly = 0;
922 int sysctl_protected_fifos __read_mostly;
923 int sysctl_protected_regular __read_mostly;
924 
925 /**
926  * may_follow_link - Check symlink following for unsafe situations
927  * @nd: nameidata pathwalk data
928  *
929  * In the case of the sysctl_protected_symlinks sysctl being enabled,
930  * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
931  * in a sticky world-writable directory. This is to protect privileged
932  * processes from failing races against path names that may change out
933  * from under them by way of other users creating malicious symlinks.
934  * It will permit symlinks to be followed only when outside a sticky
935  * world-writable directory, or when the uid of the symlink and follower
936  * match, or when the directory owner matches the symlink's owner.
937  *
938  * Returns 0 if following the symlink is allowed, -ve on error.
939  */
may_follow_link(struct nameidata * nd)940 static inline int may_follow_link(struct nameidata *nd)
941 {
942 	const struct inode *inode;
943 	const struct inode *parent;
944 	kuid_t puid;
945 
946 	if (!sysctl_protected_symlinks)
947 		return 0;
948 
949 	/* Allowed if owner and follower match. */
950 	inode = nd->link_inode;
951 	if (uid_eq(current_cred()->fsuid, inode->i_uid))
952 		return 0;
953 
954 	/* Allowed if parent directory not sticky and world-writable. */
955 	parent = nd->inode;
956 	if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
957 		return 0;
958 
959 	/* Allowed if parent directory and link owner match. */
960 	puid = parent->i_uid;
961 	if (uid_valid(puid) && uid_eq(puid, inode->i_uid))
962 		return 0;
963 
964 	if (nd->flags & LOOKUP_RCU)
965 		return -ECHILD;
966 
967 	audit_log_link_denied("follow_link", &nd->stack[0].link);
968 	return -EACCES;
969 }
970 
971 /**
972  * safe_hardlink_source - Check for safe hardlink conditions
973  * @inode: the source inode to hardlink from
974  *
975  * Return false if at least one of the following conditions:
976  *    - inode is not a regular file
977  *    - inode is setuid
978  *    - inode is setgid and group-exec
979  *    - access failure for read and write
980  *
981  * Otherwise returns true.
982  */
safe_hardlink_source(struct inode * inode)983 static bool safe_hardlink_source(struct inode *inode)
984 {
985 	umode_t mode = inode->i_mode;
986 
987 	/* Special files should not get pinned to the filesystem. */
988 	if (!S_ISREG(mode))
989 		return false;
990 
991 	/* Setuid files should not get pinned to the filesystem. */
992 	if (mode & S_ISUID)
993 		return false;
994 
995 	/* Executable setgid files should not get pinned to the filesystem. */
996 	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
997 		return false;
998 
999 	/* Hardlinking to unreadable or unwritable sources is dangerous. */
1000 	if (inode_permission(inode, MAY_READ | MAY_WRITE))
1001 		return false;
1002 
1003 	return true;
1004 }
1005 
1006 /**
1007  * may_linkat - Check permissions for creating a hardlink
1008  * @link: the source to hardlink from
1009  *
1010  * Block hardlink when all of:
1011  *  - sysctl_protected_hardlinks enabled
1012  *  - fsuid does not match inode
1013  *  - hardlink source is unsafe (see safe_hardlink_source() above)
1014  *  - not CAP_FOWNER in a namespace with the inode owner uid mapped
1015  *
1016  * Returns 0 if successful, -ve on error.
1017  */
may_linkat(struct path * link)1018 static int may_linkat(struct path *link)
1019 {
1020 	struct inode *inode;
1021 
1022 	if (!sysctl_protected_hardlinks)
1023 		return 0;
1024 
1025 	inode = link->dentry->d_inode;
1026 
1027 	/* Source inode owner (or CAP_FOWNER) can hardlink all they like,
1028 	 * otherwise, it must be a safe source.
1029 	 */
1030 	if (safe_hardlink_source(inode) || inode_owner_or_capable(inode))
1031 		return 0;
1032 
1033 	audit_log_link_denied("linkat", link);
1034 	return -EPERM;
1035 }
1036 
1037 /**
1038  * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
1039  *			  should be allowed, or not, on files that already
1040  *			  exist.
1041  * @dir_mode: mode bits of directory
1042  * @dir_uid: owner of directory
1043  * @inode: the inode of the file to open
1044  *
1045  * Block an O_CREAT open of a FIFO (or a regular file) when:
1046  *   - sysctl_protected_fifos (or sysctl_protected_regular) is enabled
1047  *   - the file already exists
1048  *   - we are in a sticky directory
1049  *   - we don't own the file
1050  *   - the owner of the directory doesn't own the file
1051  *   - the directory is world writable
1052  * If the sysctl_protected_fifos (or sysctl_protected_regular) is set to 2
1053  * the directory doesn't have to be world writable: being group writable will
1054  * be enough.
1055  *
1056  * Returns 0 if the open is allowed, -ve on error.
1057  */
may_create_in_sticky(umode_t dir_mode,kuid_t dir_uid,struct inode * const inode)1058 static int may_create_in_sticky(umode_t dir_mode, kuid_t dir_uid,
1059 				struct inode * const inode)
1060 {
1061 	if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
1062 	    (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
1063 	    likely(!(dir_mode & S_ISVTX)) ||
1064 	    uid_eq(inode->i_uid, dir_uid) ||
1065 	    uid_eq(current_fsuid(), inode->i_uid))
1066 		return 0;
1067 
1068 	if (likely(dir_mode & 0002) ||
1069 	    (dir_mode & 0020 &&
1070 	     ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
1071 	      (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
1072 		return -EACCES;
1073 	}
1074 	return 0;
1075 }
1076 
1077 static __always_inline
get_link(struct nameidata * nd)1078 const char *get_link(struct nameidata *nd)
1079 {
1080 	struct saved *last = nd->stack + nd->depth - 1;
1081 	struct dentry *dentry = last->link.dentry;
1082 	struct inode *inode = nd->link_inode;
1083 	int error;
1084 	const char *res;
1085 
1086 	if (!(nd->flags & LOOKUP_RCU)) {
1087 		touch_atime(&last->link);
1088 		cond_resched();
1089 	} else if (atime_needs_update_rcu(&last->link, inode)) {
1090 		if (unlikely(unlazy_walk(nd)))
1091 			return ERR_PTR(-ECHILD);
1092 		touch_atime(&last->link);
1093 	}
1094 
1095 	error = security_inode_follow_link(dentry, inode,
1096 					   nd->flags & LOOKUP_RCU);
1097 	if (unlikely(error))
1098 		return ERR_PTR(error);
1099 
1100 	nd->last_type = LAST_BIND;
1101 	res = inode->i_link;
1102 	if (!res) {
1103 		const char * (*get)(struct dentry *, struct inode *,
1104 				struct delayed_call *);
1105 		get = inode->i_op->get_link;
1106 		if (nd->flags & LOOKUP_RCU) {
1107 			res = get(NULL, inode, &last->done);
1108 			if (res == ERR_PTR(-ECHILD)) {
1109 				if (unlikely(unlazy_walk(nd)))
1110 					return ERR_PTR(-ECHILD);
1111 				res = get(dentry, inode, &last->done);
1112 			}
1113 		} else {
1114 			res = get(dentry, inode, &last->done);
1115 		}
1116 		if (IS_ERR_OR_NULL(res))
1117 			return res;
1118 	}
1119 	if (*res == '/') {
1120 		if (!nd->root.mnt)
1121 			set_root(nd);
1122 		if (unlikely(nd_jump_root(nd)))
1123 			return ERR_PTR(-ECHILD);
1124 		while (unlikely(*++res == '/'))
1125 			;
1126 	}
1127 	if (!*res)
1128 		res = NULL;
1129 	return res;
1130 }
1131 
1132 /*
1133  * follow_up - Find the mountpoint of path's vfsmount
1134  *
1135  * Given a path, find the mountpoint of its source file system.
1136  * Replace @path with the path of the mountpoint in the parent mount.
1137  * Up is towards /.
1138  *
1139  * Return 1 if we went up a level and 0 if we were already at the
1140  * root.
1141  */
follow_up(struct path * path)1142 int follow_up(struct path *path)
1143 {
1144 	struct mount *mnt = real_mount(path->mnt);
1145 	struct mount *parent;
1146 	struct dentry *mountpoint;
1147 
1148 	read_seqlock_excl(&mount_lock);
1149 	parent = mnt->mnt_parent;
1150 	if (parent == mnt) {
1151 		read_sequnlock_excl(&mount_lock);
1152 		return 0;
1153 	}
1154 	mntget(&parent->mnt);
1155 	mountpoint = dget(mnt->mnt_mountpoint);
1156 	read_sequnlock_excl(&mount_lock);
1157 	dput(path->dentry);
1158 	path->dentry = mountpoint;
1159 	mntput(path->mnt);
1160 	path->mnt = &parent->mnt;
1161 	return 1;
1162 }
1163 EXPORT_SYMBOL(follow_up);
1164 
1165 /*
1166  * Perform an automount
1167  * - return -EISDIR to tell follow_managed() to stop and return the path we
1168  *   were called with.
1169  */
follow_automount(struct path * path,struct nameidata * nd,bool * need_mntput)1170 static int follow_automount(struct path *path, struct nameidata *nd,
1171 			    bool *need_mntput)
1172 {
1173 	struct vfsmount *mnt;
1174 	int err;
1175 
1176 	if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
1177 		return -EREMOTE;
1178 
1179 	/* We don't want to mount if someone's just doing a stat -
1180 	 * unless they're stat'ing a directory and appended a '/' to
1181 	 * the name.
1182 	 *
1183 	 * We do, however, want to mount if someone wants to open or
1184 	 * create a file of any type under the mountpoint, wants to
1185 	 * traverse through the mountpoint or wants to open the
1186 	 * mounted directory.  Also, autofs may mark negative dentries
1187 	 * as being automount points.  These will need the attentions
1188 	 * of the daemon to instantiate them before they can be used.
1189 	 */
1190 	if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
1191 			   LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
1192 	    path->dentry->d_inode)
1193 		return -EISDIR;
1194 
1195 	nd->total_link_count++;
1196 	if (nd->total_link_count >= 40)
1197 		return -ELOOP;
1198 
1199 	mnt = path->dentry->d_op->d_automount(path);
1200 	if (IS_ERR(mnt)) {
1201 		/*
1202 		 * The filesystem is allowed to return -EISDIR here to indicate
1203 		 * it doesn't want to automount.  For instance, autofs would do
1204 		 * this so that its userspace daemon can mount on this dentry.
1205 		 *
1206 		 * However, we can only permit this if it's a terminal point in
1207 		 * the path being looked up; if it wasn't then the remainder of
1208 		 * the path is inaccessible and we should say so.
1209 		 */
1210 		if (PTR_ERR(mnt) == -EISDIR && (nd->flags & LOOKUP_PARENT))
1211 			return -EREMOTE;
1212 		return PTR_ERR(mnt);
1213 	}
1214 
1215 	if (!mnt) /* mount collision */
1216 		return 0;
1217 
1218 	if (!*need_mntput) {
1219 		/* lock_mount() may release path->mnt on error */
1220 		mntget(path->mnt);
1221 		*need_mntput = true;
1222 	}
1223 	err = finish_automount(mnt, path);
1224 
1225 	switch (err) {
1226 	case -EBUSY:
1227 		/* Someone else made a mount here whilst we were busy */
1228 		return 0;
1229 	case 0:
1230 		path_put(path);
1231 		path->mnt = mnt;
1232 		path->dentry = dget(mnt->mnt_root);
1233 		return 0;
1234 	default:
1235 		return err;
1236 	}
1237 
1238 }
1239 
1240 /*
1241  * Handle a dentry that is managed in some way.
1242  * - Flagged for transit management (autofs)
1243  * - Flagged as mountpoint
1244  * - Flagged as automount point
1245  *
1246  * This may only be called in refwalk mode.
1247  *
1248  * Serialization is taken care of in namespace.c
1249  */
follow_managed(struct path * path,struct nameidata * nd)1250 static int follow_managed(struct path *path, struct nameidata *nd)
1251 {
1252 	struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */
1253 	unsigned managed;
1254 	bool need_mntput = false;
1255 	int ret = 0;
1256 
1257 	/* Given that we're not holding a lock here, we retain the value in a
1258 	 * local variable for each dentry as we look at it so that we don't see
1259 	 * the components of that value change under us */
1260 	while (managed = ACCESS_ONCE(path->dentry->d_flags),
1261 	       managed &= DCACHE_MANAGED_DENTRY,
1262 	       unlikely(managed != 0)) {
1263 		/* Allow the filesystem to manage the transit without i_mutex
1264 		 * being held. */
1265 		if (managed & DCACHE_MANAGE_TRANSIT) {
1266 			BUG_ON(!path->dentry->d_op);
1267 			BUG_ON(!path->dentry->d_op->d_manage);
1268 			ret = path->dentry->d_op->d_manage(path, false);
1269 			if (ret < 0)
1270 				break;
1271 		}
1272 
1273 		/* Transit to a mounted filesystem. */
1274 		if (managed & DCACHE_MOUNTED) {
1275 			struct vfsmount *mounted = lookup_mnt(path);
1276 			if (mounted) {
1277 				dput(path->dentry);
1278 				if (need_mntput)
1279 					mntput(path->mnt);
1280 				path->mnt = mounted;
1281 				path->dentry = dget(mounted->mnt_root);
1282 				need_mntput = true;
1283 				continue;
1284 			}
1285 
1286 			/* Something is mounted on this dentry in another
1287 			 * namespace and/or whatever was mounted there in this
1288 			 * namespace got unmounted before lookup_mnt() could
1289 			 * get it */
1290 		}
1291 
1292 		/* Handle an automount point */
1293 		if (managed & DCACHE_NEED_AUTOMOUNT) {
1294 			ret = follow_automount(path, nd, &need_mntput);
1295 			if (ret < 0)
1296 				break;
1297 			continue;
1298 		}
1299 
1300 		/* We didn't change the current path point */
1301 		break;
1302 	}
1303 
1304 	if (need_mntput && path->mnt == mnt)
1305 		mntput(path->mnt);
1306 	if (ret == -EISDIR || !ret)
1307 		ret = 1;
1308 	if (need_mntput)
1309 		nd->flags |= LOOKUP_JUMPED;
1310 	if (unlikely(ret < 0))
1311 		path_put_conditional(path, nd);
1312 	return ret;
1313 }
1314 
follow_down_one(struct path * path)1315 int follow_down_one(struct path *path)
1316 {
1317 	struct vfsmount *mounted;
1318 
1319 	mounted = lookup_mnt(path);
1320 	if (mounted) {
1321 		dput(path->dentry);
1322 		mntput(path->mnt);
1323 		path->mnt = mounted;
1324 		path->dentry = dget(mounted->mnt_root);
1325 		return 1;
1326 	}
1327 	return 0;
1328 }
1329 EXPORT_SYMBOL(follow_down_one);
1330 
managed_dentry_rcu(const struct path * path)1331 static inline int managed_dentry_rcu(const struct path *path)
1332 {
1333 	return (path->dentry->d_flags & DCACHE_MANAGE_TRANSIT) ?
1334 		path->dentry->d_op->d_manage(path, true) : 0;
1335 }
1336 
1337 /*
1338  * Try to skip to top of mountpoint pile in rcuwalk mode.  Fail if
1339  * we meet a managed dentry that would need blocking.
1340  */
__follow_mount_rcu(struct nameidata * nd,struct path * path,struct inode ** inode,unsigned * seqp)1341 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1342 			       struct inode **inode, unsigned *seqp)
1343 {
1344 	for (;;) {
1345 		struct mount *mounted;
1346 		/*
1347 		 * Don't forget we might have a non-mountpoint managed dentry
1348 		 * that wants to block transit.
1349 		 */
1350 		switch (managed_dentry_rcu(path)) {
1351 		case -ECHILD:
1352 		default:
1353 			return false;
1354 		case -EISDIR:
1355 			return true;
1356 		case 0:
1357 			break;
1358 		}
1359 
1360 		if (!d_mountpoint(path->dentry))
1361 			return !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
1362 
1363 		mounted = __lookup_mnt(path->mnt, path->dentry);
1364 		if (!mounted)
1365 			break;
1366 		path->mnt = &mounted->mnt;
1367 		path->dentry = mounted->mnt.mnt_root;
1368 		nd->flags |= LOOKUP_JUMPED;
1369 		*seqp = read_seqcount_begin(&path->dentry->d_seq);
1370 		/*
1371 		 * Update the inode too. We don't need to re-check the
1372 		 * dentry sequence number here after this d_inode read,
1373 		 * because a mount-point is always pinned.
1374 		 */
1375 		*inode = path->dentry->d_inode;
1376 	}
1377 	return !read_seqretry(&mount_lock, nd->m_seq) &&
1378 		!(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
1379 }
1380 
follow_dotdot_rcu(struct nameidata * nd)1381 static int follow_dotdot_rcu(struct nameidata *nd)
1382 {
1383 	struct inode *inode = nd->inode;
1384 
1385 	while (1) {
1386 		if (path_equal(&nd->path, &nd->root))
1387 			break;
1388 		if (nd->path.dentry != nd->path.mnt->mnt_root) {
1389 			struct dentry *old = nd->path.dentry;
1390 			struct dentry *parent = old->d_parent;
1391 			unsigned seq;
1392 
1393 			inode = parent->d_inode;
1394 			seq = read_seqcount_begin(&parent->d_seq);
1395 			if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq)))
1396 				return -ECHILD;
1397 			nd->path.dentry = parent;
1398 			nd->seq = seq;
1399 			if (unlikely(!path_connected(&nd->path)))
1400 				return -ECHILD;
1401 			break;
1402 		} else {
1403 			struct mount *mnt = real_mount(nd->path.mnt);
1404 			struct mount *mparent = mnt->mnt_parent;
1405 			struct dentry *mountpoint = mnt->mnt_mountpoint;
1406 			struct inode *inode2 = mountpoint->d_inode;
1407 			unsigned seq = read_seqcount_begin(&mountpoint->d_seq);
1408 			if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
1409 				return -ECHILD;
1410 			if (&mparent->mnt == nd->path.mnt)
1411 				break;
1412 			/* we know that mountpoint was pinned */
1413 			nd->path.dentry = mountpoint;
1414 			nd->path.mnt = &mparent->mnt;
1415 			inode = inode2;
1416 			nd->seq = seq;
1417 		}
1418 	}
1419 	while (unlikely(d_mountpoint(nd->path.dentry))) {
1420 		struct mount *mounted;
1421 		mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
1422 		if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
1423 			return -ECHILD;
1424 		if (!mounted)
1425 			break;
1426 		nd->path.mnt = &mounted->mnt;
1427 		nd->path.dentry = mounted->mnt.mnt_root;
1428 		inode = nd->path.dentry->d_inode;
1429 		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
1430 	}
1431 	nd->inode = inode;
1432 	return 0;
1433 }
1434 
1435 /*
1436  * Follow down to the covering mount currently visible to userspace.  At each
1437  * point, the filesystem owning that dentry may be queried as to whether the
1438  * caller is permitted to proceed or not.
1439  */
follow_down(struct path * path)1440 int follow_down(struct path *path)
1441 {
1442 	unsigned managed;
1443 	int ret;
1444 
1445 	while (managed = ACCESS_ONCE(path->dentry->d_flags),
1446 	       unlikely(managed & DCACHE_MANAGED_DENTRY)) {
1447 		/* Allow the filesystem to manage the transit without i_mutex
1448 		 * being held.
1449 		 *
1450 		 * We indicate to the filesystem if someone is trying to mount
1451 		 * something here.  This gives autofs the chance to deny anyone
1452 		 * other than its daemon the right to mount on its
1453 		 * superstructure.
1454 		 *
1455 		 * The filesystem may sleep at this point.
1456 		 */
1457 		if (managed & DCACHE_MANAGE_TRANSIT) {
1458 			BUG_ON(!path->dentry->d_op);
1459 			BUG_ON(!path->dentry->d_op->d_manage);
1460 			ret = path->dentry->d_op->d_manage(path, false);
1461 			if (ret < 0)
1462 				return ret == -EISDIR ? 0 : ret;
1463 		}
1464 
1465 		/* Transit to a mounted filesystem. */
1466 		if (managed & DCACHE_MOUNTED) {
1467 			struct vfsmount *mounted = lookup_mnt(path);
1468 			if (!mounted)
1469 				break;
1470 			dput(path->dentry);
1471 			mntput(path->mnt);
1472 			path->mnt = mounted;
1473 			path->dentry = dget(mounted->mnt_root);
1474 			continue;
1475 		}
1476 
1477 		/* Don't handle automount points here */
1478 		break;
1479 	}
1480 	return 0;
1481 }
1482 EXPORT_SYMBOL(follow_down);
1483 
1484 /*
1485  * Skip to top of mountpoint pile in refwalk mode for follow_dotdot()
1486  */
follow_mount(struct path * path)1487 static void follow_mount(struct path *path)
1488 {
1489 	while (d_mountpoint(path->dentry)) {
1490 		struct vfsmount *mounted = lookup_mnt(path);
1491 		if (!mounted)
1492 			break;
1493 		dput(path->dentry);
1494 		mntput(path->mnt);
1495 		path->mnt = mounted;
1496 		path->dentry = dget(mounted->mnt_root);
1497 	}
1498 }
1499 
path_parent_directory(struct path * path)1500 static int path_parent_directory(struct path *path)
1501 {
1502 	struct dentry *old = path->dentry;
1503 	/* rare case of legitimate dget_parent()... */
1504 	path->dentry = dget_parent(path->dentry);
1505 	dput(old);
1506 	if (unlikely(!path_connected(path)))
1507 		return -ENOENT;
1508 	return 0;
1509 }
1510 
follow_dotdot(struct nameidata * nd)1511 static int follow_dotdot(struct nameidata *nd)
1512 {
1513 	while(1) {
1514 		if (nd->path.dentry == nd->root.dentry &&
1515 		    nd->path.mnt == nd->root.mnt) {
1516 			break;
1517 		}
1518 		if (nd->path.dentry != nd->path.mnt->mnt_root) {
1519 			int ret = path_parent_directory(&nd->path);
1520 			if (ret)
1521 				return ret;
1522 			break;
1523 		}
1524 		if (!follow_up(&nd->path))
1525 			break;
1526 	}
1527 	follow_mount(&nd->path);
1528 	nd->inode = nd->path.dentry->d_inode;
1529 	return 0;
1530 }
1531 
1532 /*
1533  * This looks up the name in dcache and possibly revalidates the found dentry.
1534  * NULL is returned if the dentry does not exist in the cache.
1535  */
lookup_dcache(const struct qstr * name,struct dentry * dir,unsigned int flags)1536 static struct dentry *lookup_dcache(const struct qstr *name,
1537 				    struct dentry *dir,
1538 				    unsigned int flags)
1539 {
1540 	struct dentry *dentry = d_lookup(dir, name);
1541 	if (dentry) {
1542 		int error = d_revalidate(dentry, flags);
1543 		if (unlikely(error <= 0)) {
1544 			if (!error)
1545 				d_invalidate(dentry);
1546 			dput(dentry);
1547 			return ERR_PTR(error);
1548 		}
1549 	}
1550 	return dentry;
1551 }
1552 
1553 /*
1554  * Call i_op->lookup on the dentry.  The dentry must be negative and
1555  * unhashed.
1556  *
1557  * dir->d_inode->i_mutex must be held
1558  */
lookup_real(struct inode * dir,struct dentry * dentry,unsigned int flags)1559 static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry,
1560 				  unsigned int flags)
1561 {
1562 	struct dentry *old;
1563 
1564 	/* Don't create child dentry for a dead directory. */
1565 	if (unlikely(IS_DEADDIR(dir))) {
1566 		dput(dentry);
1567 		return ERR_PTR(-ENOENT);
1568 	}
1569 
1570 	old = dir->i_op->lookup(dir, dentry, flags);
1571 	if (unlikely(old)) {
1572 		dput(dentry);
1573 		dentry = old;
1574 	}
1575 	return dentry;
1576 }
1577 
__lookup_hash(const struct qstr * name,struct dentry * base,unsigned int flags)1578 static struct dentry *__lookup_hash(const struct qstr *name,
1579 		struct dentry *base, unsigned int flags)
1580 {
1581 	struct dentry *dentry = lookup_dcache(name, base, flags);
1582 
1583 	if (dentry)
1584 		return dentry;
1585 
1586 	dentry = d_alloc(base, name);
1587 	if (unlikely(!dentry))
1588 		return ERR_PTR(-ENOMEM);
1589 
1590 	return lookup_real(base->d_inode, dentry, flags);
1591 }
1592 
lookup_fast(struct nameidata * nd,struct path * path,struct inode ** inode,unsigned * seqp)1593 static int lookup_fast(struct nameidata *nd,
1594 		       struct path *path, struct inode **inode,
1595 		       unsigned *seqp)
1596 {
1597 	struct vfsmount *mnt = nd->path.mnt;
1598 	struct dentry *dentry, *parent = nd->path.dentry;
1599 	int status = 1;
1600 	int err;
1601 
1602 	/*
1603 	 * Rename seqlock is not required here because in the off chance
1604 	 * of a false negative due to a concurrent rename, the caller is
1605 	 * going to fall back to non-racy lookup.
1606 	 */
1607 	if (nd->flags & LOOKUP_RCU) {
1608 		unsigned seq;
1609 		bool negative;
1610 		dentry = __d_lookup_rcu(parent, &nd->last, &seq);
1611 		if (unlikely(!dentry)) {
1612 			if (unlazy_walk(nd))
1613 				return -ECHILD;
1614 			return 0;
1615 		}
1616 
1617 		/*
1618 		 * This sequence count validates that the inode matches
1619 		 * the dentry name information from lookup.
1620 		 */
1621 		*inode = d_backing_inode(dentry);
1622 		negative = d_is_negative(dentry);
1623 		if (unlikely(read_seqcount_retry(&dentry->d_seq, seq)))
1624 			return -ECHILD;
1625 
1626 		/*
1627 		 * This sequence count validates that the parent had no
1628 		 * changes while we did the lookup of the dentry above.
1629 		 *
1630 		 * The memory barrier in read_seqcount_begin of child is
1631 		 *  enough, we can use __read_seqcount_retry here.
1632 		 */
1633 		if (unlikely(__read_seqcount_retry(&parent->d_seq, nd->seq)))
1634 			return -ECHILD;
1635 
1636 		*seqp = seq;
1637 		status = d_revalidate(dentry, nd->flags);
1638 		if (likely(status > 0)) {
1639 			/*
1640 			 * Note: do negative dentry check after revalidation in
1641 			 * case that drops it.
1642 			 */
1643 			if (unlikely(negative))
1644 				return -ENOENT;
1645 			path->mnt = mnt;
1646 			path->dentry = dentry;
1647 			if (likely(__follow_mount_rcu(nd, path, inode, seqp)))
1648 				return 1;
1649 		}
1650 		if (unlazy_child(nd, dentry, seq))
1651 			return -ECHILD;
1652 		if (unlikely(status == -ECHILD))
1653 			/* we'd been told to redo it in non-rcu mode */
1654 			status = d_revalidate(dentry, nd->flags);
1655 	} else {
1656 		dentry = __d_lookup(parent, &nd->last);
1657 		if (unlikely(!dentry))
1658 			return 0;
1659 		status = d_revalidate(dentry, nd->flags);
1660 	}
1661 	if (unlikely(status <= 0)) {
1662 		if (!status)
1663 			d_invalidate(dentry);
1664 		dput(dentry);
1665 		return status;
1666 	}
1667 	if (unlikely(d_is_negative(dentry))) {
1668 		dput(dentry);
1669 		return -ENOENT;
1670 	}
1671 
1672 	path->mnt = mnt;
1673 	path->dentry = dentry;
1674 	err = follow_managed(path, nd);
1675 	if (likely(err > 0))
1676 		*inode = d_backing_inode(path->dentry);
1677 	return err;
1678 }
1679 
1680 /* Fast lookup failed, do it the slow way */
lookup_slow(const struct qstr * name,struct dentry * dir,unsigned int flags)1681 static struct dentry *lookup_slow(const struct qstr *name,
1682 				  struct dentry *dir,
1683 				  unsigned int flags)
1684 {
1685 	struct dentry *dentry = ERR_PTR(-ENOENT), *old;
1686 	struct inode *inode = dir->d_inode;
1687 	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
1688 
1689 	inode_lock_shared(inode);
1690 	/* Don't go there if it's already dead */
1691 	if (unlikely(IS_DEADDIR(inode)))
1692 		goto out;
1693 again:
1694 	dentry = d_alloc_parallel(dir, name, &wq);
1695 	if (IS_ERR(dentry))
1696 		goto out;
1697 	if (unlikely(!d_in_lookup(dentry))) {
1698 		if (!(flags & LOOKUP_NO_REVAL)) {
1699 			int error = d_revalidate(dentry, flags);
1700 			if (unlikely(error <= 0)) {
1701 				if (!error) {
1702 					d_invalidate(dentry);
1703 					dput(dentry);
1704 					goto again;
1705 				}
1706 				dput(dentry);
1707 				dentry = ERR_PTR(error);
1708 			}
1709 		}
1710 	} else {
1711 		old = inode->i_op->lookup(inode, dentry, flags);
1712 		d_lookup_done(dentry);
1713 		if (unlikely(old)) {
1714 			dput(dentry);
1715 			dentry = old;
1716 		}
1717 	}
1718 out:
1719 	inode_unlock_shared(inode);
1720 	return dentry;
1721 }
1722 
may_lookup(struct nameidata * nd)1723 static inline int may_lookup(struct nameidata *nd)
1724 {
1725 	if (nd->flags & LOOKUP_RCU) {
1726 		int err = inode_permission2(nd->path.mnt, nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1727 		if (err != -ECHILD)
1728 			return err;
1729 		if (unlazy_walk(nd))
1730 			return -ECHILD;
1731 	}
1732 	return inode_permission2(nd->path.mnt, nd->inode, MAY_EXEC);
1733 }
1734 
handle_dots(struct nameidata * nd,int type)1735 static inline int handle_dots(struct nameidata *nd, int type)
1736 {
1737 	if (type == LAST_DOTDOT) {
1738 		if (!nd->root.mnt)
1739 			set_root(nd);
1740 		if (nd->flags & LOOKUP_RCU) {
1741 			return follow_dotdot_rcu(nd);
1742 		} else
1743 			return follow_dotdot(nd);
1744 	}
1745 	return 0;
1746 }
1747 
pick_link(struct nameidata * nd,struct path * link,struct inode * inode,unsigned seq)1748 static int pick_link(struct nameidata *nd, struct path *link,
1749 		     struct inode *inode, unsigned seq)
1750 {
1751 	int error;
1752 	struct saved *last;
1753 	if (unlikely(nd->total_link_count++ >= MAXSYMLINKS)) {
1754 		path_to_nameidata(link, nd);
1755 		return -ELOOP;
1756 	}
1757 	if (!(nd->flags & LOOKUP_RCU)) {
1758 		if (link->mnt == nd->path.mnt)
1759 			mntget(link->mnt);
1760 	}
1761 	error = nd_alloc_stack(nd);
1762 	if (unlikely(error)) {
1763 		if (error == -ECHILD) {
1764 			if (unlikely(!legitimize_path(nd, link, seq))) {
1765 				drop_links(nd);
1766 				nd->depth = 0;
1767 				nd->flags &= ~LOOKUP_RCU;
1768 				nd->path.mnt = NULL;
1769 				nd->path.dentry = NULL;
1770 				if (!(nd->flags & LOOKUP_ROOT))
1771 					nd->root.mnt = NULL;
1772 				rcu_read_unlock();
1773 			} else if (likely(unlazy_walk(nd)) == 0)
1774 				error = nd_alloc_stack(nd);
1775 		}
1776 		if (error) {
1777 			path_put(link);
1778 			return error;
1779 		}
1780 	}
1781 
1782 	last = nd->stack + nd->depth++;
1783 	last->link = *link;
1784 	clear_delayed_call(&last->done);
1785 	nd->link_inode = inode;
1786 	last->seq = seq;
1787 	return 1;
1788 }
1789 
1790 enum {WALK_FOLLOW = 1, WALK_MORE = 2};
1791 
1792 /*
1793  * Do we need to follow links? We _really_ want to be able
1794  * to do this check without having to look at inode->i_op,
1795  * so we keep a cache of "no, this doesn't need follow_link"
1796  * for the common case.
1797  */
step_into(struct nameidata * nd,struct path * path,int flags,struct inode * inode,unsigned seq)1798 static inline int step_into(struct nameidata *nd, struct path *path,
1799 			    int flags, struct inode *inode, unsigned seq)
1800 {
1801 	if (!(flags & WALK_MORE) && nd->depth)
1802 		put_link(nd);
1803 	if (likely(!d_is_symlink(path->dentry)) ||
1804 	   !(flags & WALK_FOLLOW || nd->flags & LOOKUP_FOLLOW)) {
1805 		/* not a symlink or should not follow */
1806 		path_to_nameidata(path, nd);
1807 		nd->inode = inode;
1808 		nd->seq = seq;
1809 		return 0;
1810 	}
1811 	/* make sure that d_is_symlink above matches inode */
1812 	if (nd->flags & LOOKUP_RCU) {
1813 		if (read_seqcount_retry(&path->dentry->d_seq, seq))
1814 			return -ECHILD;
1815 	}
1816 	return pick_link(nd, path, inode, seq);
1817 }
1818 
walk_component(struct nameidata * nd,int flags)1819 static int walk_component(struct nameidata *nd, int flags)
1820 {
1821 	struct path path;
1822 	struct inode *inode;
1823 	unsigned seq;
1824 	int err;
1825 	/*
1826 	 * "." and ".." are special - ".." especially so because it has
1827 	 * to be able to know about the current root directory and
1828 	 * parent relationships.
1829 	 */
1830 	if (unlikely(nd->last_type != LAST_NORM)) {
1831 		err = handle_dots(nd, nd->last_type);
1832 		if (!(flags & WALK_MORE) && nd->depth)
1833 			put_link(nd);
1834 		return err;
1835 	}
1836 	err = lookup_fast(nd, &path, &inode, &seq);
1837 	if (unlikely(err <= 0)) {
1838 		if (err < 0)
1839 			return err;
1840 		path.dentry = lookup_slow(&nd->last, nd->path.dentry,
1841 					  nd->flags);
1842 		if (IS_ERR(path.dentry))
1843 			return PTR_ERR(path.dentry);
1844 
1845 		path.mnt = nd->path.mnt;
1846 		err = follow_managed(&path, nd);
1847 		if (unlikely(err < 0))
1848 			return err;
1849 
1850 		if (unlikely(d_is_negative(path.dentry))) {
1851 			path_to_nameidata(&path, nd);
1852 			return -ENOENT;
1853 		}
1854 
1855 		seq = 0;	/* we are already out of RCU mode */
1856 		inode = d_backing_inode(path.dentry);
1857 	}
1858 
1859 	return step_into(nd, &path, flags, inode, seq);
1860 }
1861 
1862 /*
1863  * We can do the critical dentry name comparison and hashing
1864  * operations one word at a time, but we are limited to:
1865  *
1866  * - Architectures with fast unaligned word accesses. We could
1867  *   do a "get_unaligned()" if this helps and is sufficiently
1868  *   fast.
1869  *
1870  * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
1871  *   do not trap on the (extremely unlikely) case of a page
1872  *   crossing operation.
1873  *
1874  * - Furthermore, we need an efficient 64-bit compile for the
1875  *   64-bit case in order to generate the "number of bytes in
1876  *   the final mask". Again, that could be replaced with a
1877  *   efficient population count instruction or similar.
1878  */
1879 #ifdef CONFIG_DCACHE_WORD_ACCESS
1880 
1881 #include <asm/word-at-a-time.h>
1882 
1883 #ifdef HASH_MIX
1884 
1885 /* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */
1886 
1887 #elif defined(CONFIG_64BIT)
1888 /*
1889  * Register pressure in the mixing function is an issue, particularly
1890  * on 32-bit x86, but almost any function requires one state value and
1891  * one temporary.  Instead, use a function designed for two state values
1892  * and no temporaries.
1893  *
1894  * This function cannot create a collision in only two iterations, so
1895  * we have two iterations to achieve avalanche.  In those two iterations,
1896  * we have six layers of mixing, which is enough to spread one bit's
1897  * influence out to 2^6 = 64 state bits.
1898  *
1899  * Rotate constants are scored by considering either 64 one-bit input
1900  * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the
1901  * probability of that delta causing a change to each of the 128 output
1902  * bits, using a sample of random initial states.
1903  *
1904  * The Shannon entropy of the computed probabilities is then summed
1905  * to produce a score.  Ideally, any input change has a 50% chance of
1906  * toggling any given output bit.
1907  *
1908  * Mixing scores (in bits) for (12,45):
1909  * Input delta: 1-bit      2-bit
1910  * 1 round:     713.3    42542.6
1911  * 2 rounds:   2753.7   140389.8
1912  * 3 rounds:   5954.1   233458.2
1913  * 4 rounds:   7862.6   256672.2
1914  * Perfect:    8192     258048
1915  *            (64*128) (64*63/2 * 128)
1916  */
1917 #define HASH_MIX(x, y, a)	\
1918 	(	x ^= (a),	\
1919 	y ^= x,	x = rol64(x,12),\
1920 	x += y,	y = rol64(y,45),\
1921 	y *= 9			)
1922 
1923 /*
1924  * Fold two longs into one 32-bit hash value.  This must be fast, but
1925  * latency isn't quite as critical, as there is a fair bit of additional
1926  * work done before the hash value is used.
1927  */
fold_hash(unsigned long x,unsigned long y)1928 static inline unsigned int fold_hash(unsigned long x, unsigned long y)
1929 {
1930 	y ^= x * GOLDEN_RATIO_64;
1931 	y *= GOLDEN_RATIO_64;
1932 	return y >> 32;
1933 }
1934 
1935 #else	/* 32-bit case */
1936 
1937 /*
1938  * Mixing scores (in bits) for (7,20):
1939  * Input delta: 1-bit      2-bit
1940  * 1 round:     330.3     9201.6
1941  * 2 rounds:   1246.4    25475.4
1942  * 3 rounds:   1907.1    31295.1
1943  * 4 rounds:   2042.3    31718.6
1944  * Perfect:    2048      31744
1945  *            (32*64)   (32*31/2 * 64)
1946  */
1947 #define HASH_MIX(x, y, a)	\
1948 	(	x ^= (a),	\
1949 	y ^= x,	x = rol32(x, 7),\
1950 	x += y,	y = rol32(y,20),\
1951 	y *= 9			)
1952 
fold_hash(unsigned long x,unsigned long y)1953 static inline unsigned int fold_hash(unsigned long x, unsigned long y)
1954 {
1955 	/* Use arch-optimized multiply if one exists */
1956 	return __hash_32(y ^ __hash_32(x));
1957 }
1958 
1959 #endif
1960 
1961 /*
1962  * Return the hash of a string of known length.  This is carfully
1963  * designed to match hash_name(), which is the more critical function.
1964  * In particular, we must end by hashing a final word containing 0..7
1965  * payload bytes, to match the way that hash_name() iterates until it
1966  * finds the delimiter after the name.
1967  */
full_name_hash(const void * salt,const char * name,unsigned int len)1968 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
1969 {
1970 	unsigned long a, x = 0, y = (unsigned long)salt;
1971 
1972 	for (;;) {
1973 		if (!len)
1974 			goto done;
1975 		a = load_unaligned_zeropad(name);
1976 		if (len < sizeof(unsigned long))
1977 			break;
1978 		HASH_MIX(x, y, a);
1979 		name += sizeof(unsigned long);
1980 		len -= sizeof(unsigned long);
1981 	}
1982 	x ^= a & bytemask_from_count(len);
1983 done:
1984 	return fold_hash(x, y);
1985 }
1986 EXPORT_SYMBOL(full_name_hash);
1987 
1988 /* Return the "hash_len" (hash and length) of a null-terminated string */
hashlen_string(const void * salt,const char * name)1989 u64 hashlen_string(const void *salt, const char *name)
1990 {
1991 	unsigned long a = 0, x = 0, y = (unsigned long)salt;
1992 	unsigned long adata, mask, len;
1993 	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1994 
1995 	len = 0;
1996 	goto inside;
1997 
1998 	do {
1999 		HASH_MIX(x, y, a);
2000 		len += sizeof(unsigned long);
2001 inside:
2002 		a = load_unaligned_zeropad(name+len);
2003 	} while (!has_zero(a, &adata, &constants));
2004 
2005 	adata = prep_zero_mask(a, adata, &constants);
2006 	mask = create_zero_mask(adata);
2007 	x ^= a & zero_bytemask(mask);
2008 
2009 	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2010 }
2011 EXPORT_SYMBOL(hashlen_string);
2012 
2013 /*
2014  * Calculate the length and hash of the path component, and
2015  * return the "hash_len" as the result.
2016  */
hash_name(const void * salt,const char * name)2017 static inline u64 hash_name(const void *salt, const char *name)
2018 {
2019 	unsigned long a = 0, b, x = 0, y = (unsigned long)salt;
2020 	unsigned long adata, bdata, mask, len;
2021 	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
2022 
2023 	len = 0;
2024 	goto inside;
2025 
2026 	do {
2027 		HASH_MIX(x, y, a);
2028 		len += sizeof(unsigned long);
2029 inside:
2030 		a = load_unaligned_zeropad(name+len);
2031 		b = a ^ REPEAT_BYTE('/');
2032 	} while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
2033 
2034 	adata = prep_zero_mask(a, adata, &constants);
2035 	bdata = prep_zero_mask(b, bdata, &constants);
2036 	mask = create_zero_mask(adata | bdata);
2037 	x ^= a & zero_bytemask(mask);
2038 
2039 	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2040 }
2041 
2042 #else	/* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */
2043 
2044 /* Return the hash of a string of known length */
full_name_hash(const void * salt,const char * name,unsigned int len)2045 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2046 {
2047 	unsigned long hash = init_name_hash(salt);
2048 	while (len--)
2049 		hash = partial_name_hash((unsigned char)*name++, hash);
2050 	return end_name_hash(hash);
2051 }
2052 EXPORT_SYMBOL(full_name_hash);
2053 
2054 /* Return the "hash_len" (hash and length) of a null-terminated string */
hashlen_string(const void * salt,const char * name)2055 u64 hashlen_string(const void *salt, const char *name)
2056 {
2057 	unsigned long hash = init_name_hash(salt);
2058 	unsigned long len = 0, c;
2059 
2060 	c = (unsigned char)*name;
2061 	while (c) {
2062 		len++;
2063 		hash = partial_name_hash(c, hash);
2064 		c = (unsigned char)name[len];
2065 	}
2066 	return hashlen_create(end_name_hash(hash), len);
2067 }
2068 EXPORT_SYMBOL(hashlen_string);
2069 
2070 /*
2071  * We know there's a real path component here of at least
2072  * one character.
2073  */
hash_name(const void * salt,const char * name)2074 static inline u64 hash_name(const void *salt, const char *name)
2075 {
2076 	unsigned long hash = init_name_hash(salt);
2077 	unsigned long len = 0, c;
2078 
2079 	c = (unsigned char)*name;
2080 	do {
2081 		len++;
2082 		hash = partial_name_hash(c, hash);
2083 		c = (unsigned char)name[len];
2084 	} while (c && c != '/');
2085 	return hashlen_create(end_name_hash(hash), len);
2086 }
2087 
2088 #endif
2089 
2090 /*
2091  * Name resolution.
2092  * This is the basic name resolution function, turning a pathname into
2093  * the final dentry. We expect 'base' to be positive and a directory.
2094  *
2095  * Returns 0 and nd will have valid dentry and mnt on success.
2096  * Returns error and drops reference to input namei data on failure.
2097  */
link_path_walk(const char * name,struct nameidata * nd)2098 static int link_path_walk(const char *name, struct nameidata *nd)
2099 {
2100 	int err;
2101 
2102 	while (*name=='/')
2103 		name++;
2104 	if (!*name)
2105 		return 0;
2106 
2107 	/* At this point we know we have a real path component. */
2108 	for(;;) {
2109 		u64 hash_len;
2110 		int type;
2111 
2112 		err = may_lookup(nd);
2113 		if (err)
2114 			return err;
2115 
2116 		hash_len = hash_name(nd->path.dentry, name);
2117 
2118 		type = LAST_NORM;
2119 		if (name[0] == '.') switch (hashlen_len(hash_len)) {
2120 			case 2:
2121 				if (name[1] == '.') {
2122 					type = LAST_DOTDOT;
2123 					nd->flags |= LOOKUP_JUMPED;
2124 				}
2125 				break;
2126 			case 1:
2127 				type = LAST_DOT;
2128 		}
2129 		if (likely(type == LAST_NORM)) {
2130 			struct dentry *parent = nd->path.dentry;
2131 			nd->flags &= ~LOOKUP_JUMPED;
2132 			if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
2133 				struct qstr this = { { .hash_len = hash_len }, .name = name };
2134 				err = parent->d_op->d_hash(parent, &this);
2135 				if (err < 0)
2136 					return err;
2137 				hash_len = this.hash_len;
2138 				name = this.name;
2139 			}
2140 		}
2141 
2142 		nd->last.hash_len = hash_len;
2143 		nd->last.name = name;
2144 		nd->last_type = type;
2145 
2146 		name += hashlen_len(hash_len);
2147 		if (!*name)
2148 			goto OK;
2149 		/*
2150 		 * If it wasn't NUL, we know it was '/'. Skip that
2151 		 * slash, and continue until no more slashes.
2152 		 */
2153 		do {
2154 			name++;
2155 		} while (unlikely(*name == '/'));
2156 		if (unlikely(!*name)) {
2157 OK:
2158 			/* pathname body, done */
2159 			if (!nd->depth)
2160 				return 0;
2161 			name = nd->stack[nd->depth - 1].name;
2162 			/* trailing symlink, done */
2163 			if (!name)
2164 				return 0;
2165 			/* last component of nested symlink */
2166 			err = walk_component(nd, WALK_FOLLOW);
2167 		} else {
2168 			/* not the last component */
2169 			err = walk_component(nd, WALK_FOLLOW | WALK_MORE);
2170 		}
2171 		if (err < 0)
2172 			return err;
2173 
2174 		if (err) {
2175 			const char *s = get_link(nd);
2176 
2177 			if (IS_ERR(s))
2178 				return PTR_ERR(s);
2179 			err = 0;
2180 			if (unlikely(!s)) {
2181 				/* jumped */
2182 				put_link(nd);
2183 			} else {
2184 				nd->stack[nd->depth - 1].name = name;
2185 				name = s;
2186 				continue;
2187 			}
2188 		}
2189 		if (unlikely(!d_can_lookup(nd->path.dentry))) {
2190 			if (nd->flags & LOOKUP_RCU) {
2191 				if (unlazy_walk(nd))
2192 					return -ECHILD;
2193 			}
2194 			return -ENOTDIR;
2195 		}
2196 	}
2197 }
2198 
path_init(struct nameidata * nd,unsigned flags)2199 static const char *path_init(struct nameidata *nd, unsigned flags)
2200 {
2201 	const char *s = nd->name->name;
2202 
2203 	if (!*s)
2204 		flags &= ~LOOKUP_RCU;
2205 
2206 	nd->last_type = LAST_ROOT; /* if there are only slashes... */
2207 	nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT;
2208 	nd->depth = 0;
2209 	if (flags & LOOKUP_ROOT) {
2210 		struct dentry *root = nd->root.dentry;
2211 		struct inode *inode = root->d_inode;
2212 		if (*s && unlikely(!d_can_lookup(root)))
2213 			return ERR_PTR(-ENOTDIR);
2214 		nd->path = nd->root;
2215 		nd->inode = inode;
2216 		if (flags & LOOKUP_RCU) {
2217 			rcu_read_lock();
2218 			nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2219 			nd->root_seq = nd->seq;
2220 			nd->m_seq = read_seqbegin(&mount_lock);
2221 		} else {
2222 			path_get(&nd->path);
2223 		}
2224 		return s;
2225 	}
2226 
2227 	nd->root.mnt = NULL;
2228 	nd->path.mnt = NULL;
2229 	nd->path.dentry = NULL;
2230 
2231 	nd->m_seq = read_seqbegin(&mount_lock);
2232 	if (*s == '/') {
2233 		if (flags & LOOKUP_RCU)
2234 			rcu_read_lock();
2235 		set_root(nd);
2236 		if (likely(!nd_jump_root(nd)))
2237 			return s;
2238 		nd->root.mnt = NULL;
2239 		rcu_read_unlock();
2240 		return ERR_PTR(-ECHILD);
2241 	} else if (nd->dfd == AT_FDCWD) {
2242 		if (flags & LOOKUP_RCU) {
2243 			struct fs_struct *fs = current->fs;
2244 			unsigned seq;
2245 
2246 			rcu_read_lock();
2247 
2248 			do {
2249 				seq = read_seqcount_begin(&fs->seq);
2250 				nd->path = fs->pwd;
2251 				nd->inode = nd->path.dentry->d_inode;
2252 				nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2253 			} while (read_seqcount_retry(&fs->seq, seq));
2254 		} else {
2255 			get_fs_pwd(current->fs, &nd->path);
2256 			nd->inode = nd->path.dentry->d_inode;
2257 		}
2258 		return s;
2259 	} else {
2260 		/* Caller must check execute permissions on the starting path component */
2261 		struct fd f = fdget_raw(nd->dfd);
2262 		struct dentry *dentry;
2263 
2264 		if (!f.file)
2265 			return ERR_PTR(-EBADF);
2266 
2267 		dentry = f.file->f_path.dentry;
2268 
2269 		if (*s) {
2270 			if (!d_can_lookup(dentry)) {
2271 				fdput(f);
2272 				return ERR_PTR(-ENOTDIR);
2273 			}
2274 		}
2275 
2276 		nd->path = f.file->f_path;
2277 		if (flags & LOOKUP_RCU) {
2278 			rcu_read_lock();
2279 			nd->inode = nd->path.dentry->d_inode;
2280 			nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2281 		} else {
2282 			path_get(&nd->path);
2283 			nd->inode = nd->path.dentry->d_inode;
2284 		}
2285 		fdput(f);
2286 		return s;
2287 	}
2288 }
2289 
trailing_symlink(struct nameidata * nd)2290 static const char *trailing_symlink(struct nameidata *nd)
2291 {
2292 	const char *s;
2293 	int error = may_follow_link(nd);
2294 	if (unlikely(error))
2295 		return ERR_PTR(error);
2296 	nd->flags |= LOOKUP_PARENT;
2297 	nd->stack[0].name = NULL;
2298 	s = get_link(nd);
2299 	return s ? s : "";
2300 }
2301 
lookup_last(struct nameidata * nd)2302 static inline int lookup_last(struct nameidata *nd)
2303 {
2304 	if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
2305 		nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2306 
2307 	nd->flags &= ~LOOKUP_PARENT;
2308 	return walk_component(nd, 0);
2309 }
2310 
handle_lookup_down(struct nameidata * nd)2311 static int handle_lookup_down(struct nameidata *nd)
2312 {
2313 	struct path path = nd->path;
2314 	struct inode *inode = nd->inode;
2315 	unsigned seq = nd->seq;
2316 	int err;
2317 
2318 	if (nd->flags & LOOKUP_RCU) {
2319 		/*
2320 		 * don't bother with unlazy_walk on failure - we are
2321 		 * at the very beginning of walk, so we lose nothing
2322 		 * if we simply redo everything in non-RCU mode
2323 		 */
2324 		if (unlikely(!__follow_mount_rcu(nd, &path, &inode, &seq)))
2325 			return -ECHILD;
2326 	} else {
2327 		dget(path.dentry);
2328 		err = follow_managed(&path, nd);
2329 		if (unlikely(err < 0))
2330 			return err;
2331 		inode = d_backing_inode(path.dentry);
2332 		seq = 0;
2333 	}
2334 	path_to_nameidata(&path, nd);
2335 	nd->inode = inode;
2336 	nd->seq = seq;
2337 	return 0;
2338 }
2339 
2340 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
path_lookupat(struct nameidata * nd,unsigned flags,struct path * path)2341 static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2342 {
2343 	const char *s = path_init(nd, flags);
2344 	int err;
2345 
2346 	if (IS_ERR(s))
2347 		return PTR_ERR(s);
2348 
2349 	if (unlikely(flags & LOOKUP_DOWN)) {
2350 		err = handle_lookup_down(nd);
2351 		if (unlikely(err < 0)) {
2352 			terminate_walk(nd);
2353 			return err;
2354 		}
2355 	}
2356 
2357 	while (!(err = link_path_walk(s, nd))
2358 		&& ((err = lookup_last(nd)) > 0)) {
2359 		s = trailing_symlink(nd);
2360 		if (IS_ERR(s)) {
2361 			err = PTR_ERR(s);
2362 			break;
2363 		}
2364 	}
2365 	if (!err)
2366 		err = complete_walk(nd);
2367 
2368 	if (!err && nd->flags & LOOKUP_DIRECTORY)
2369 		if (!d_can_lookup(nd->path.dentry))
2370 			err = -ENOTDIR;
2371 	if (!err) {
2372 		*path = nd->path;
2373 		nd->path.mnt = NULL;
2374 		nd->path.dentry = NULL;
2375 	}
2376 	terminate_walk(nd);
2377 	return err;
2378 }
2379 
filename_lookup(int dfd,struct filename * name,unsigned flags,struct path * path,struct path * root)2380 static int filename_lookup(int dfd, struct filename *name, unsigned flags,
2381 			   struct path *path, struct path *root)
2382 {
2383 	int retval;
2384 	struct nameidata nd;
2385 	if (IS_ERR(name))
2386 		return PTR_ERR(name);
2387 	if (unlikely(root)) {
2388 		nd.root = *root;
2389 		flags |= LOOKUP_ROOT;
2390 	}
2391 	set_nameidata(&nd, dfd, name);
2392 	retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
2393 	if (unlikely(retval == -ECHILD))
2394 		retval = path_lookupat(&nd, flags, path);
2395 	if (unlikely(retval == -ESTALE))
2396 		retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
2397 
2398 	if (likely(!retval))
2399 		audit_inode(name, path->dentry, flags & LOOKUP_PARENT);
2400 	restore_nameidata();
2401 	putname(name);
2402 	return retval;
2403 }
2404 
2405 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
path_parentat(struct nameidata * nd,unsigned flags,struct path * parent)2406 static int path_parentat(struct nameidata *nd, unsigned flags,
2407 				struct path *parent)
2408 {
2409 	const char *s = path_init(nd, flags);
2410 	int err;
2411 	if (IS_ERR(s))
2412 		return PTR_ERR(s);
2413 	err = link_path_walk(s, nd);
2414 	if (!err)
2415 		err = complete_walk(nd);
2416 	if (!err) {
2417 		*parent = nd->path;
2418 		nd->path.mnt = NULL;
2419 		nd->path.dentry = NULL;
2420 	}
2421 	terminate_walk(nd);
2422 	return err;
2423 }
2424 
filename_parentat(int dfd,struct filename * name,unsigned int flags,struct path * parent,struct qstr * last,int * type)2425 static struct filename *filename_parentat(int dfd, struct filename *name,
2426 				unsigned int flags, struct path *parent,
2427 				struct qstr *last, int *type)
2428 {
2429 	int retval;
2430 	struct nameidata nd;
2431 
2432 	if (IS_ERR(name))
2433 		return name;
2434 	set_nameidata(&nd, dfd, name);
2435 	retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
2436 	if (unlikely(retval == -ECHILD))
2437 		retval = path_parentat(&nd, flags, parent);
2438 	if (unlikely(retval == -ESTALE))
2439 		retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
2440 	if (likely(!retval)) {
2441 		*last = nd.last;
2442 		*type = nd.last_type;
2443 		audit_inode(name, parent->dentry, LOOKUP_PARENT);
2444 	} else {
2445 		putname(name);
2446 		name = ERR_PTR(retval);
2447 	}
2448 	restore_nameidata();
2449 	return name;
2450 }
2451 
2452 /* does lookup, returns the object with parent locked */
kern_path_locked(const char * name,struct path * path)2453 struct dentry *kern_path_locked(const char *name, struct path *path)
2454 {
2455 	struct filename *filename;
2456 	struct dentry *d;
2457 	struct qstr last;
2458 	int type;
2459 
2460 	filename = filename_parentat(AT_FDCWD, getname_kernel(name), 0, path,
2461 				    &last, &type);
2462 	if (IS_ERR(filename))
2463 		return ERR_CAST(filename);
2464 	if (unlikely(type != LAST_NORM)) {
2465 		path_put(path);
2466 		putname(filename);
2467 		return ERR_PTR(-EINVAL);
2468 	}
2469 	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
2470 	d = __lookup_hash(&last, path->dentry, 0);
2471 	if (IS_ERR(d)) {
2472 		inode_unlock(path->dentry->d_inode);
2473 		path_put(path);
2474 	}
2475 	putname(filename);
2476 	return d;
2477 }
2478 
kern_path(const char * name,unsigned int flags,struct path * path)2479 int kern_path(const char *name, unsigned int flags, struct path *path)
2480 {
2481 	return filename_lookup(AT_FDCWD, getname_kernel(name),
2482 			       flags, path, NULL);
2483 }
2484 EXPORT_SYMBOL(kern_path);
2485 
2486 /**
2487  * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
2488  * @dentry:  pointer to dentry of the base directory
2489  * @mnt: pointer to vfs mount of the base directory
2490  * @name: pointer to file name
2491  * @flags: lookup flags
2492  * @path: pointer to struct path to fill
2493  */
vfs_path_lookup(struct dentry * dentry,struct vfsmount * mnt,const char * name,unsigned int flags,struct path * path)2494 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
2495 		    const char *name, unsigned int flags,
2496 		    struct path *path)
2497 {
2498 	struct path root = {.mnt = mnt, .dentry = dentry};
2499 	/* the first argument of filename_lookup() is ignored with root */
2500 	return filename_lookup(AT_FDCWD, getname_kernel(name),
2501 			       flags , path, &root);
2502 }
2503 EXPORT_SYMBOL(vfs_path_lookup);
2504 
2505 /**
2506  * lookup_one_len - filesystem helper to lookup single pathname component
2507  * @name:	pathname component to lookup
2508  * @mnt:	mount we are looking up on
2509  * @base:	base directory to lookup from
2510  * @len:	maximum length @len should be interpreted to
2511  *
2512  * Note that this routine is purely a helper for filesystem usage and should
2513  * not be called by generic code.
2514  *
2515  * The caller must hold base->i_mutex.
2516  */
lookup_one_len2(const char * name,struct vfsmount * mnt,struct dentry * base,int len)2517 struct dentry *lookup_one_len2(const char *name, struct vfsmount *mnt, struct dentry *base, int len)
2518 {
2519 	struct qstr this;
2520 	unsigned int c;
2521 	int err;
2522 
2523 	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2524 
2525 	this.name = name;
2526 	this.len = len;
2527 	this.hash = full_name_hash(base, name, len);
2528 	if (!len)
2529 		return ERR_PTR(-EACCES);
2530 
2531 	if (unlikely(name[0] == '.')) {
2532 		if (len < 2 || (len == 2 && name[1] == '.'))
2533 			return ERR_PTR(-EACCES);
2534 	}
2535 
2536 	while (len--) {
2537 		c = *(const unsigned char *)name++;
2538 		if (c == '/' || c == '\0')
2539 			return ERR_PTR(-EACCES);
2540 	}
2541 	/*
2542 	 * See if the low-level filesystem might want
2543 	 * to use its own hash..
2544 	 */
2545 	if (base->d_flags & DCACHE_OP_HASH) {
2546 		int err = base->d_op->d_hash(base, &this);
2547 		if (err < 0)
2548 			return ERR_PTR(err);
2549 	}
2550 
2551 	err = inode_permission2(mnt, base->d_inode, MAY_EXEC);
2552 	if (err)
2553 		return ERR_PTR(err);
2554 
2555 	return __lookup_hash(&this, base, 0);
2556 }
2557 EXPORT_SYMBOL(lookup_one_len2);
2558 
lookup_one_len(const char * name,struct dentry * base,int len)2559 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
2560 {
2561 	return lookup_one_len2(name, NULL, base, len);
2562 }
2563 EXPORT_SYMBOL(lookup_one_len);
2564 
2565 /**
2566  * lookup_one_len_unlocked - filesystem helper to lookup single pathname component
2567  * @name:	pathname component to lookup
2568  * @base:	base directory to lookup from
2569  * @len:	maximum length @len should be interpreted to
2570  *
2571  * Note that this routine is purely a helper for filesystem usage and should
2572  * not be called by generic code.
2573  *
2574  * Unlike lookup_one_len, it should be called without the parent
2575  * i_mutex held, and will take the i_mutex itself if necessary.
2576  */
lookup_one_len_unlocked(const char * name,struct dentry * base,int len)2577 struct dentry *lookup_one_len_unlocked(const char *name,
2578 				       struct dentry *base, int len)
2579 {
2580 	struct qstr this;
2581 	unsigned int c;
2582 	int err;
2583 	struct dentry *ret;
2584 
2585 	this.name = name;
2586 	this.len = len;
2587 	this.hash = full_name_hash(base, name, len);
2588 	if (!len)
2589 		return ERR_PTR(-EACCES);
2590 
2591 	if (unlikely(name[0] == '.')) {
2592 		if (len < 2 || (len == 2 && name[1] == '.'))
2593 			return ERR_PTR(-EACCES);
2594 	}
2595 
2596 	while (len--) {
2597 		c = *(const unsigned char *)name++;
2598 		if (c == '/' || c == '\0')
2599 			return ERR_PTR(-EACCES);
2600 	}
2601 	/*
2602 	 * See if the low-level filesystem might want
2603 	 * to use its own hash..
2604 	 */
2605 	if (base->d_flags & DCACHE_OP_HASH) {
2606 		int err = base->d_op->d_hash(base, &this);
2607 		if (err < 0)
2608 			return ERR_PTR(err);
2609 	}
2610 
2611 	err = inode_permission(base->d_inode, MAY_EXEC);
2612 	if (err)
2613 		return ERR_PTR(err);
2614 
2615 	ret = lookup_dcache(&this, base, 0);
2616 	if (!ret)
2617 		ret = lookup_slow(&this, base, 0);
2618 	return ret;
2619 }
2620 EXPORT_SYMBOL(lookup_one_len_unlocked);
2621 
2622 #ifdef CONFIG_UNIX98_PTYS
path_pts(struct path * path)2623 int path_pts(struct path *path)
2624 {
2625 	/* Find something mounted on "pts" in the same directory as
2626 	 * the input path.
2627 	 */
2628 	struct dentry *child, *parent;
2629 	struct qstr this;
2630 	int ret;
2631 
2632 	ret = path_parent_directory(path);
2633 	if (ret)
2634 		return ret;
2635 
2636 	parent = path->dentry;
2637 	this.name = "pts";
2638 	this.len = 3;
2639 	child = d_hash_and_lookup(parent, &this);
2640 	if (!child)
2641 		return -ENOENT;
2642 
2643 	path->dentry = child;
2644 	dput(parent);
2645 	follow_mount(path);
2646 	return 0;
2647 }
2648 #endif
2649 
user_path_at_empty(int dfd,const char __user * name,unsigned flags,struct path * path,int * empty)2650 int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
2651 		 struct path *path, int *empty)
2652 {
2653 	return filename_lookup(dfd, getname_flags(name, flags, empty),
2654 			       flags, path, NULL);
2655 }
2656 EXPORT_SYMBOL(user_path_at_empty);
2657 
2658 /**
2659  * mountpoint_last - look up last component for umount
2660  * @nd:   pathwalk nameidata - currently pointing at parent directory of "last"
2661  *
2662  * This is a special lookup_last function just for umount. In this case, we
2663  * need to resolve the path without doing any revalidation.
2664  *
2665  * The nameidata should be the result of doing a LOOKUP_PARENT pathwalk. Since
2666  * mountpoints are always pinned in the dcache, their ancestors are too. Thus,
2667  * in almost all cases, this lookup will be served out of the dcache. The only
2668  * cases where it won't are if nd->last refers to a symlink or the path is
2669  * bogus and it doesn't exist.
2670  *
2671  * Returns:
2672  * -error: if there was an error during lookup. This includes -ENOENT if the
2673  *         lookup found a negative dentry.
2674  *
2675  * 0:      if we successfully resolved nd->last and found it to not to be a
2676  *         symlink that needs to be followed.
2677  *
2678  * 1:      if we successfully resolved nd->last and found it to be a symlink
2679  *         that needs to be followed.
2680  */
2681 static int
mountpoint_last(struct nameidata * nd)2682 mountpoint_last(struct nameidata *nd)
2683 {
2684 	int error = 0;
2685 	struct dentry *dir = nd->path.dentry;
2686 	struct path path;
2687 
2688 	/* If we're in rcuwalk, drop out of it to handle last component */
2689 	if (nd->flags & LOOKUP_RCU) {
2690 		if (unlazy_walk(nd))
2691 			return -ECHILD;
2692 	}
2693 
2694 	nd->flags &= ~LOOKUP_PARENT;
2695 
2696 	if (unlikely(nd->last_type != LAST_NORM)) {
2697 		error = handle_dots(nd, nd->last_type);
2698 		if (error)
2699 			return error;
2700 		path.dentry = dget(nd->path.dentry);
2701 	} else {
2702 		path.dentry = d_lookup(dir, &nd->last);
2703 		if (!path.dentry) {
2704 			/*
2705 			 * No cached dentry. Mounted dentries are pinned in the
2706 			 * cache, so that means that this dentry is probably
2707 			 * a symlink or the path doesn't actually point
2708 			 * to a mounted dentry.
2709 			 */
2710 			path.dentry = lookup_slow(&nd->last, dir,
2711 					     nd->flags | LOOKUP_NO_REVAL);
2712 			if (IS_ERR(path.dentry))
2713 				return PTR_ERR(path.dentry);
2714 		}
2715 	}
2716 	if (d_is_negative(path.dentry)) {
2717 		dput(path.dentry);
2718 		return -ENOENT;
2719 	}
2720 	path.mnt = nd->path.mnt;
2721 	return step_into(nd, &path, 0, d_backing_inode(path.dentry), 0);
2722 }
2723 
2724 /**
2725  * path_mountpoint - look up a path to be umounted
2726  * @nd:		lookup context
2727  * @flags:	lookup flags
2728  * @path:	pointer to container for result
2729  *
2730  * Look up the given name, but don't attempt to revalidate the last component.
2731  * Returns 0 and "path" will be valid on success; Returns error otherwise.
2732  */
2733 static int
path_mountpoint(struct nameidata * nd,unsigned flags,struct path * path)2734 path_mountpoint(struct nameidata *nd, unsigned flags, struct path *path)
2735 {
2736 	const char *s = path_init(nd, flags);
2737 	int err;
2738 	if (IS_ERR(s))
2739 		return PTR_ERR(s);
2740 	while (!(err = link_path_walk(s, nd)) &&
2741 		(err = mountpoint_last(nd)) > 0) {
2742 		s = trailing_symlink(nd);
2743 		if (IS_ERR(s)) {
2744 			err = PTR_ERR(s);
2745 			break;
2746 		}
2747 	}
2748 	if (!err) {
2749 		*path = nd->path;
2750 		nd->path.mnt = NULL;
2751 		nd->path.dentry = NULL;
2752 		follow_mount(path);
2753 	}
2754 	terminate_walk(nd);
2755 	return err;
2756 }
2757 
2758 static int
filename_mountpoint(int dfd,struct filename * name,struct path * path,unsigned int flags)2759 filename_mountpoint(int dfd, struct filename *name, struct path *path,
2760 			unsigned int flags)
2761 {
2762 	struct nameidata nd;
2763 	int error;
2764 	if (IS_ERR(name))
2765 		return PTR_ERR(name);
2766 	set_nameidata(&nd, dfd, name);
2767 	error = path_mountpoint(&nd, flags | LOOKUP_RCU, path);
2768 	if (unlikely(error == -ECHILD))
2769 		error = path_mountpoint(&nd, flags, path);
2770 	if (unlikely(error == -ESTALE))
2771 		error = path_mountpoint(&nd, flags | LOOKUP_REVAL, path);
2772 	if (likely(!error))
2773 		audit_inode(name, path->dentry, 0);
2774 	restore_nameidata();
2775 	putname(name);
2776 	return error;
2777 }
2778 
2779 /**
2780  * user_path_mountpoint_at - lookup a path from userland in order to umount it
2781  * @dfd:	directory file descriptor
2782  * @name:	pathname from userland
2783  * @flags:	lookup flags
2784  * @path:	pointer to container to hold result
2785  *
2786  * A umount is a special case for path walking. We're not actually interested
2787  * in the inode in this situation, and ESTALE errors can be a problem. We
2788  * simply want track down the dentry and vfsmount attached at the mountpoint
2789  * and avoid revalidating the last component.
2790  *
2791  * Returns 0 and populates "path" on success.
2792  */
2793 int
user_path_mountpoint_at(int dfd,const char __user * name,unsigned int flags,struct path * path)2794 user_path_mountpoint_at(int dfd, const char __user *name, unsigned int flags,
2795 			struct path *path)
2796 {
2797 	return filename_mountpoint(dfd, getname(name), path, flags);
2798 }
2799 
2800 int
kern_path_mountpoint(int dfd,const char * name,struct path * path,unsigned int flags)2801 kern_path_mountpoint(int dfd, const char *name, struct path *path,
2802 			unsigned int flags)
2803 {
2804 	return filename_mountpoint(dfd, getname_kernel(name), path, flags);
2805 }
2806 EXPORT_SYMBOL(kern_path_mountpoint);
2807 
__check_sticky(struct inode * dir,struct inode * inode)2808 int __check_sticky(struct inode *dir, struct inode *inode)
2809 {
2810 	kuid_t fsuid = current_fsuid();
2811 
2812 	if (uid_eq(inode->i_uid, fsuid))
2813 		return 0;
2814 	if (uid_eq(dir->i_uid, fsuid))
2815 		return 0;
2816 	return !capable_wrt_inode_uidgid(inode, CAP_FOWNER);
2817 }
2818 EXPORT_SYMBOL(__check_sticky);
2819 
2820 /*
2821  *	Check whether we can remove a link victim from directory dir, check
2822  *  whether the type of victim is right.
2823  *  1. We can't do it if dir is read-only (done in permission())
2824  *  2. We should have write and exec permissions on dir
2825  *  3. We can't remove anything from append-only dir
2826  *  4. We can't do anything with immutable dir (done in permission())
2827  *  5. If the sticky bit on dir is set we should either
2828  *	a. be owner of dir, or
2829  *	b. be owner of victim, or
2830  *	c. have CAP_FOWNER capability
2831  *  6. If the victim is append-only or immutable we can't do antyhing with
2832  *     links pointing to it.
2833  *  7. If the victim has an unknown uid or gid we can't change the inode.
2834  *  8. If we were asked to remove a directory and victim isn't one - ENOTDIR.
2835  *  9. If we were asked to remove a non-directory and victim isn't one - EISDIR.
2836  * 10. We can't remove a root or mountpoint.
2837  * 11. We don't allow removal of NFS sillyrenamed files; it's handled by
2838  *     nfs_async_unlink().
2839  */
may_delete(struct vfsmount * mnt,struct inode * dir,struct dentry * victim,bool isdir)2840 static int may_delete(struct vfsmount *mnt, struct inode *dir, struct dentry *victim, bool isdir)
2841 {
2842 	struct inode *inode = d_backing_inode(victim);
2843 	int error;
2844 
2845 	if (d_is_negative(victim))
2846 		return -ENOENT;
2847 	BUG_ON(!inode);
2848 
2849 	BUG_ON(victim->d_parent->d_inode != dir);
2850 	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2851 
2852 	error = inode_permission2(mnt, dir, MAY_WRITE | MAY_EXEC);
2853 	if (error)
2854 		return error;
2855 	if (IS_APPEND(dir))
2856 		return -EPERM;
2857 
2858 	if (check_sticky(dir, inode) || IS_APPEND(inode) ||
2859 	    IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) || HAS_UNMAPPED_ID(inode))
2860 		return -EPERM;
2861 	if (isdir) {
2862 		if (!d_is_dir(victim))
2863 			return -ENOTDIR;
2864 		if (IS_ROOT(victim))
2865 			return -EBUSY;
2866 	} else if (d_is_dir(victim))
2867 		return -EISDIR;
2868 	if (IS_DEADDIR(dir))
2869 		return -ENOENT;
2870 	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
2871 		return -EBUSY;
2872 	return 0;
2873 }
2874 
2875 /*	Check whether we can create an object with dentry child in directory
2876  *  dir.
2877  *  1. We can't do it if child already exists (open has special treatment for
2878  *     this case, but since we are inlined it's OK)
2879  *  2. We can't do it if dir is read-only (done in permission())
2880  *  3. We can't do it if the fs can't represent the fsuid or fsgid.
2881  *  4. We should have write and exec permissions on dir
2882  *  5. We can't do it if dir is immutable (done in permission())
2883  */
may_create(struct vfsmount * mnt,struct inode * dir,struct dentry * child)2884 static inline int may_create(struct vfsmount *mnt, struct inode *dir, struct dentry *child)
2885 {
2886 	struct user_namespace *s_user_ns;
2887 	audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
2888 	if (child->d_inode)
2889 		return -EEXIST;
2890 	if (IS_DEADDIR(dir))
2891 		return -ENOENT;
2892 	s_user_ns = dir->i_sb->s_user_ns;
2893 	if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||
2894 	    !kgid_has_mapping(s_user_ns, current_fsgid()))
2895 		return -EOVERFLOW;
2896 	return inode_permission2(mnt, dir, MAY_WRITE | MAY_EXEC);
2897 }
2898 
2899 /*
2900  * p1 and p2 should be directories on the same fs.
2901  */
lock_rename(struct dentry * p1,struct dentry * p2)2902 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
2903 {
2904 	struct dentry *p;
2905 
2906 	if (p1 == p2) {
2907 		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2908 		return NULL;
2909 	}
2910 
2911 	mutex_lock(&p1->d_sb->s_vfs_rename_mutex);
2912 
2913 	p = d_ancestor(p2, p1);
2914 	if (p) {
2915 		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
2916 		inode_lock_nested(p1->d_inode, I_MUTEX_CHILD);
2917 		return p;
2918 	}
2919 
2920 	p = d_ancestor(p1, p2);
2921 	if (p) {
2922 		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2923 		inode_lock_nested(p2->d_inode, I_MUTEX_CHILD);
2924 		return p;
2925 	}
2926 
2927 	inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2928 	inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
2929 	return NULL;
2930 }
2931 EXPORT_SYMBOL(lock_rename);
2932 
unlock_rename(struct dentry * p1,struct dentry * p2)2933 void unlock_rename(struct dentry *p1, struct dentry *p2)
2934 {
2935 	inode_unlock(p1->d_inode);
2936 	if (p1 != p2) {
2937 		inode_unlock(p2->d_inode);
2938 		mutex_unlock(&p1->d_sb->s_vfs_rename_mutex);
2939 	}
2940 }
2941 EXPORT_SYMBOL(unlock_rename);
2942 
vfs_create2(struct vfsmount * mnt,struct inode * dir,struct dentry * dentry,umode_t mode,bool want_excl)2943 int vfs_create2(struct vfsmount *mnt, struct inode *dir, struct dentry *dentry,
2944 		umode_t mode, bool want_excl)
2945 {
2946 	int error = may_create(mnt, dir, dentry);
2947 	if (error)
2948 		return error;
2949 
2950 	if (!dir->i_op->create)
2951 		return -EACCES;	/* shouldn't it be ENOSYS? */
2952 	mode &= S_IALLUGO;
2953 	mode |= S_IFREG;
2954 	error = security_inode_create(dir, dentry, mode);
2955 	if (error)
2956 		return error;
2957 	error = dir->i_op->create(dir, dentry, mode, want_excl);
2958 	if (!error)
2959 		fsnotify_create(dir, dentry);
2960 	return error;
2961 }
2962 EXPORT_SYMBOL(vfs_create2);
2963 
vfs_create(struct inode * dir,struct dentry * dentry,umode_t mode,bool want_excl)2964 int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
2965 		bool want_excl)
2966 {
2967 	return vfs_create2(NULL, dir, dentry, mode, want_excl);
2968 }
2969 EXPORT_SYMBOL(vfs_create);
2970 
may_open_dev(const struct path * path)2971 bool may_open_dev(const struct path *path)
2972 {
2973 	return !(path->mnt->mnt_flags & MNT_NODEV) &&
2974 		!(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
2975 }
2976 
may_open(const struct path * path,int acc_mode,int flag)2977 static int may_open(const struct path *path, int acc_mode, int flag)
2978 {
2979 	struct dentry *dentry = path->dentry;
2980 	struct vfsmount *mnt = path->mnt;
2981 	struct inode *inode = dentry->d_inode;
2982 	int error;
2983 
2984 	if (!inode)
2985 		return -ENOENT;
2986 
2987 	switch (inode->i_mode & S_IFMT) {
2988 	case S_IFLNK:
2989 		return -ELOOP;
2990 	case S_IFDIR:
2991 		if (acc_mode & MAY_WRITE)
2992 			return -EISDIR;
2993 		break;
2994 	case S_IFBLK:
2995 	case S_IFCHR:
2996 		if (!may_open_dev(path))
2997 			return -EACCES;
2998 		/*FALLTHRU*/
2999 	case S_IFIFO:
3000 	case S_IFSOCK:
3001 		flag &= ~O_TRUNC;
3002 		break;
3003 	}
3004 
3005 	error = inode_permission2(mnt, inode, MAY_OPEN | acc_mode);
3006 	if (error)
3007 		return error;
3008 
3009 	/*
3010 	 * An append-only file must be opened in append mode for writing.
3011 	 */
3012 	if (IS_APPEND(inode)) {
3013 		if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
3014 			return -EPERM;
3015 		if (flag & O_TRUNC)
3016 			return -EPERM;
3017 	}
3018 
3019 	/* O_NOATIME can only be set by the owner or superuser */
3020 	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
3021 		return -EPERM;
3022 
3023 	return 0;
3024 }
3025 
handle_truncate(struct file * filp)3026 static int handle_truncate(struct file *filp)
3027 {
3028 	const struct path *path = &filp->f_path;
3029 	struct inode *inode = path->dentry->d_inode;
3030 	int error = get_write_access(inode);
3031 	if (error)
3032 		return error;
3033 	/*
3034 	 * Refuse to truncate files with mandatory locks held on them.
3035 	 */
3036 	error = locks_verify_locked(filp);
3037 	if (!error)
3038 		error = security_path_truncate(path);
3039 	if (!error) {
3040 		error = do_truncate2(path->mnt, path->dentry, 0,
3041 				    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
3042 				    filp);
3043 	}
3044 	put_write_access(inode);
3045 	return error;
3046 }
3047 
open_to_namei_flags(int flag)3048 static inline int open_to_namei_flags(int flag)
3049 {
3050 	if ((flag & O_ACCMODE) == 3)
3051 		flag--;
3052 	return flag;
3053 }
3054 
may_o_create(const struct path * dir,struct dentry * dentry,umode_t mode)3055 static int may_o_create(const struct path *dir, struct dentry *dentry, umode_t mode)
3056 {
3057 	struct user_namespace *s_user_ns;
3058 	int error = security_path_mknod(dir, dentry, mode, 0);
3059 	if (error)
3060 		return error;
3061 
3062 	s_user_ns = dir->dentry->d_sb->s_user_ns;
3063 	if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||
3064 	    !kgid_has_mapping(s_user_ns, current_fsgid()))
3065 		return -EOVERFLOW;
3066 
3067 	error = inode_permission2(dir->mnt, dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
3068 	if (error)
3069 		return error;
3070 
3071 	return security_inode_create(dir->dentry->d_inode, dentry, mode);
3072 }
3073 
3074 /*
3075  * Attempt to atomically look up, create and open a file from a negative
3076  * dentry.
3077  *
3078  * Returns 0 if successful.  The file will have been created and attached to
3079  * @file by the filesystem calling finish_open().
3080  *
3081  * Returns 1 if the file was looked up only or didn't need creating.  The
3082  * caller will need to perform the open themselves.  @path will have been
3083  * updated to point to the new dentry.  This may be negative.
3084  *
3085  * Returns an error code otherwise.
3086  */
atomic_open(struct nameidata * nd,struct dentry * dentry,struct path * path,struct file * file,const struct open_flags * op,int open_flag,umode_t mode,int * opened)3087 static int atomic_open(struct nameidata *nd, struct dentry *dentry,
3088 			struct path *path, struct file *file,
3089 			const struct open_flags *op,
3090 			int open_flag, umode_t mode,
3091 			int *opened)
3092 {
3093 	struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
3094 	struct inode *dir =  nd->path.dentry->d_inode;
3095 	int error;
3096 
3097 	if (!(~open_flag & (O_EXCL | O_CREAT)))	/* both O_EXCL and O_CREAT */
3098 		open_flag &= ~O_TRUNC;
3099 
3100 	if (nd->flags & LOOKUP_DIRECTORY)
3101 		open_flag |= O_DIRECTORY;
3102 
3103 	file->f_path.dentry = DENTRY_NOT_SET;
3104 	file->f_path.mnt = nd->path.mnt;
3105 	error = dir->i_op->atomic_open(dir, dentry, file,
3106 				       open_to_namei_flags(open_flag),
3107 				       mode, opened);
3108 	d_lookup_done(dentry);
3109 	if (!error) {
3110 		/*
3111 		 * We didn't have the inode before the open, so check open
3112 		 * permission here.
3113 		 */
3114 		int acc_mode = op->acc_mode;
3115 		if (*opened & FILE_CREATED) {
3116 			WARN_ON(!(open_flag & O_CREAT));
3117 			fsnotify_create(dir, dentry);
3118 			acc_mode = 0;
3119 		}
3120 		error = may_open(&file->f_path, acc_mode, open_flag);
3121 		if (WARN_ON(error > 0))
3122 			error = -EINVAL;
3123 	} else if (error > 0) {
3124 		if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
3125 			error = -EIO;
3126 		} else {
3127 			if (file->f_path.dentry) {
3128 				dput(dentry);
3129 				dentry = file->f_path.dentry;
3130 			}
3131 			if (*opened & FILE_CREATED)
3132 				fsnotify_create(dir, dentry);
3133 			if (unlikely(d_is_negative(dentry))) {
3134 				error = -ENOENT;
3135 			} else {
3136 				path->dentry = dentry;
3137 				path->mnt = nd->path.mnt;
3138 				return 1;
3139 			}
3140 		}
3141 	}
3142 	dput(dentry);
3143 	return error;
3144 }
3145 
3146 /*
3147  * Look up and maybe create and open the last component.
3148  *
3149  * Must be called with i_mutex held on parent.
3150  *
3151  * Returns 0 if the file was successfully atomically created (if necessary) and
3152  * opened.  In this case the file will be returned attached to @file.
3153  *
3154  * Returns 1 if the file was not completely opened at this time, though lookups
3155  * and creations will have been performed and the dentry returned in @path will
3156  * be positive upon return if O_CREAT was specified.  If O_CREAT wasn't
3157  * specified then a negative dentry may be returned.
3158  *
3159  * An error code is returned otherwise.
3160  *
3161  * FILE_CREATE will be set in @*opened if the dentry was created and will be
3162  * cleared otherwise prior to returning.
3163  */
lookup_open(struct nameidata * nd,struct path * path,struct file * file,const struct open_flags * op,bool got_write,int * opened)3164 static int lookup_open(struct nameidata *nd, struct path *path,
3165 			struct file *file,
3166 			const struct open_flags *op,
3167 			bool got_write, int *opened)
3168 {
3169 	struct dentry *dir = nd->path.dentry;
3170 	struct inode *dir_inode = dir->d_inode;
3171 	int open_flag = op->open_flag;
3172 	struct dentry *dentry;
3173 	int error, create_error = 0;
3174 	umode_t mode = op->mode;
3175 	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
3176 
3177 	if (unlikely(IS_DEADDIR(dir_inode)))
3178 		return -ENOENT;
3179 
3180 	*opened &= ~FILE_CREATED;
3181 	dentry = d_lookup(dir, &nd->last);
3182 	for (;;) {
3183 		if (!dentry) {
3184 			dentry = d_alloc_parallel(dir, &nd->last, &wq);
3185 			if (IS_ERR(dentry))
3186 				return PTR_ERR(dentry);
3187 		}
3188 		if (d_in_lookup(dentry))
3189 			break;
3190 
3191 		error = d_revalidate(dentry, nd->flags);
3192 		if (likely(error > 0))
3193 			break;
3194 		if (error)
3195 			goto out_dput;
3196 		d_invalidate(dentry);
3197 		dput(dentry);
3198 		dentry = NULL;
3199 	}
3200 	if (dentry->d_inode) {
3201 		/* Cached positive dentry: will open in f_op->open */
3202 		goto out_no_open;
3203 	}
3204 
3205 	/*
3206 	 * Checking write permission is tricky, bacuse we don't know if we are
3207 	 * going to actually need it: O_CREAT opens should work as long as the
3208 	 * file exists.  But checking existence breaks atomicity.  The trick is
3209 	 * to check access and if not granted clear O_CREAT from the flags.
3210 	 *
3211 	 * Another problem is returing the "right" error value (e.g. for an
3212 	 * O_EXCL open we want to return EEXIST not EROFS).
3213 	 */
3214 	if (open_flag & O_CREAT) {
3215 		if (!IS_POSIXACL(dir->d_inode))
3216 			mode &= ~current_umask();
3217 		if (unlikely(!got_write)) {
3218 			create_error = -EROFS;
3219 			open_flag &= ~O_CREAT;
3220 			if (open_flag & (O_EXCL | O_TRUNC))
3221 				goto no_open;
3222 			/* No side effects, safe to clear O_CREAT */
3223 		} else {
3224 			create_error = may_o_create(&nd->path, dentry, mode);
3225 			if (create_error) {
3226 				open_flag &= ~O_CREAT;
3227 				if (open_flag & O_EXCL)
3228 					goto no_open;
3229 			}
3230 		}
3231 	} else if ((open_flag & (O_TRUNC|O_WRONLY|O_RDWR)) &&
3232 		   unlikely(!got_write)) {
3233 		/*
3234 		 * No O_CREATE -> atomicity not a requirement -> fall
3235 		 * back to lookup + open
3236 		 */
3237 		goto no_open;
3238 	}
3239 
3240 	if (dir_inode->i_op->atomic_open) {
3241 		error = atomic_open(nd, dentry, path, file, op, open_flag,
3242 				    mode, opened);
3243 		if (unlikely(error == -ENOENT) && create_error)
3244 			error = create_error;
3245 		return error;
3246 	}
3247 
3248 no_open:
3249 	if (d_in_lookup(dentry)) {
3250 		struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry,
3251 							     nd->flags);
3252 		d_lookup_done(dentry);
3253 		if (unlikely(res)) {
3254 			if (IS_ERR(res)) {
3255 				error = PTR_ERR(res);
3256 				goto out_dput;
3257 			}
3258 			dput(dentry);
3259 			dentry = res;
3260 		}
3261 	}
3262 
3263 	/* Negative dentry, just create the file */
3264 	if (!dentry->d_inode && (open_flag & O_CREAT)) {
3265 		*opened |= FILE_CREATED;
3266 		audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
3267 		if (!dir_inode->i_op->create) {
3268 			error = -EACCES;
3269 			goto out_dput;
3270 		}
3271 		error = dir_inode->i_op->create(dir_inode, dentry, mode,
3272 						open_flag & O_EXCL);
3273 		if (error)
3274 			goto out_dput;
3275 		fsnotify_create(dir_inode, dentry);
3276 	}
3277 	if (unlikely(create_error) && !dentry->d_inode) {
3278 		error = create_error;
3279 		goto out_dput;
3280 	}
3281 out_no_open:
3282 	path->dentry = dentry;
3283 	path->mnt = nd->path.mnt;
3284 	return 1;
3285 
3286 out_dput:
3287 	dput(dentry);
3288 	return error;
3289 }
3290 
3291 /*
3292  * Handle the last step of open()
3293  */
do_last(struct nameidata * nd,struct file * file,const struct open_flags * op,int * opened)3294 static int do_last(struct nameidata *nd,
3295 		   struct file *file, const struct open_flags *op,
3296 		   int *opened)
3297 {
3298 	struct dentry *dir = nd->path.dentry;
3299 	kuid_t dir_uid = nd->inode->i_uid;
3300 	umode_t dir_mode = nd->inode->i_mode;
3301 	int open_flag = op->open_flag;
3302 	bool will_truncate = (open_flag & O_TRUNC) != 0;
3303 	bool got_write = false;
3304 	int acc_mode = op->acc_mode;
3305 	unsigned seq;
3306 	struct inode *inode;
3307 	struct path path;
3308 	int error;
3309 
3310 	nd->flags &= ~LOOKUP_PARENT;
3311 	nd->flags |= op->intent;
3312 
3313 	if (nd->last_type != LAST_NORM) {
3314 		error = handle_dots(nd, nd->last_type);
3315 		if (unlikely(error))
3316 			return error;
3317 		goto finish_open;
3318 	}
3319 
3320 	if (!(open_flag & O_CREAT)) {
3321 		if (nd->last.name[nd->last.len])
3322 			nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
3323 		/* we _can_ be in RCU mode here */
3324 		error = lookup_fast(nd, &path, &inode, &seq);
3325 		if (likely(error > 0))
3326 			goto finish_lookup;
3327 
3328 		if (error < 0)
3329 			return error;
3330 
3331 		BUG_ON(nd->inode != dir->d_inode);
3332 		BUG_ON(nd->flags & LOOKUP_RCU);
3333 	} else {
3334 		/* create side of things */
3335 		/*
3336 		 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED
3337 		 * has been cleared when we got to the last component we are
3338 		 * about to look up
3339 		 */
3340 		error = complete_walk(nd);
3341 		if (error)
3342 			return error;
3343 
3344 		audit_inode(nd->name, dir, LOOKUP_PARENT);
3345 		/* trailing slashes? */
3346 		if (unlikely(nd->last.name[nd->last.len]))
3347 			return -EISDIR;
3348 	}
3349 
3350 	if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
3351 		error = mnt_want_write(nd->path.mnt);
3352 		if (!error)
3353 			got_write = true;
3354 		/*
3355 		 * do _not_ fail yet - we might not need that or fail with
3356 		 * a different error; let lookup_open() decide; we'll be
3357 		 * dropping this one anyway.
3358 		 */
3359 	}
3360 	if (open_flag & O_CREAT)
3361 		inode_lock(dir->d_inode);
3362 	else
3363 		inode_lock_shared(dir->d_inode);
3364 	error = lookup_open(nd, &path, file, op, got_write, opened);
3365 	if (open_flag & O_CREAT)
3366 		inode_unlock(dir->d_inode);
3367 	else
3368 		inode_unlock_shared(dir->d_inode);
3369 
3370 	if (error <= 0) {
3371 		if (error)
3372 			goto out;
3373 
3374 		if ((*opened & FILE_CREATED) ||
3375 		    !S_ISREG(file_inode(file)->i_mode))
3376 			will_truncate = false;
3377 
3378 		audit_inode(nd->name, file->f_path.dentry, 0);
3379 		goto opened;
3380 	}
3381 
3382 	if (*opened & FILE_CREATED) {
3383 		/* Don't check for write permission, don't truncate */
3384 		open_flag &= ~O_TRUNC;
3385 		will_truncate = false;
3386 		acc_mode = 0;
3387 		path_to_nameidata(&path, nd);
3388 		goto finish_open_created;
3389 	}
3390 
3391 	/*
3392 	 * If atomic_open() acquired write access it is dropped now due to
3393 	 * possible mount and symlink following (this might be optimized away if
3394 	 * necessary...)
3395 	 */
3396 	if (got_write) {
3397 		mnt_drop_write(nd->path.mnt);
3398 		got_write = false;
3399 	}
3400 
3401 	error = follow_managed(&path, nd);
3402 	if (unlikely(error < 0))
3403 		return error;
3404 
3405 	if (unlikely(d_is_negative(path.dentry))) {
3406 		path_to_nameidata(&path, nd);
3407 		return -ENOENT;
3408 	}
3409 
3410 	/*
3411 	 * create/update audit record if it already exists.
3412 	 */
3413 	audit_inode(nd->name, path.dentry, 0);
3414 
3415 	if (unlikely((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))) {
3416 		path_to_nameidata(&path, nd);
3417 		return -EEXIST;
3418 	}
3419 
3420 	seq = 0;	/* out of RCU mode, so the value doesn't matter */
3421 	inode = d_backing_inode(path.dentry);
3422 finish_lookup:
3423 	error = step_into(nd, &path, 0, inode, seq);
3424 	if (unlikely(error))
3425 		return error;
3426 finish_open:
3427 	/* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
3428 	error = complete_walk(nd);
3429 	if (error)
3430 		return error;
3431 	audit_inode(nd->name, nd->path.dentry, 0);
3432 	if (open_flag & O_CREAT) {
3433 		error = -EISDIR;
3434 		if (d_is_dir(nd->path.dentry))
3435 			goto out;
3436 		error = may_create_in_sticky(dir_mode, dir_uid,
3437 					     d_backing_inode(nd->path.dentry));
3438 		if (unlikely(error))
3439 			goto out;
3440 	}
3441 	error = -ENOTDIR;
3442 	if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
3443 		goto out;
3444 	if (!d_is_reg(nd->path.dentry))
3445 		will_truncate = false;
3446 
3447 	if (will_truncate) {
3448 		error = mnt_want_write(nd->path.mnt);
3449 		if (error)
3450 			goto out;
3451 		got_write = true;
3452 	}
3453 finish_open_created:
3454 	error = may_open(&nd->path, acc_mode, open_flag);
3455 	if (error)
3456 		goto out;
3457 	BUG_ON(*opened & FILE_OPENED); /* once it's opened, it's opened */
3458 	error = vfs_open(&nd->path, file, current_cred());
3459 	if (error)
3460 		goto out;
3461 	*opened |= FILE_OPENED;
3462 opened:
3463 	error = open_check_o_direct(file);
3464 	if (!error)
3465 		error = ima_file_check(file, op->acc_mode, *opened);
3466 	if (!error && will_truncate)
3467 		error = handle_truncate(file);
3468 out:
3469 	if (unlikely(error) && (*opened & FILE_OPENED))
3470 		fput(file);
3471 	if (unlikely(error > 0)) {
3472 		WARN_ON(1);
3473 		error = -EINVAL;
3474 	}
3475 	if (got_write)
3476 		mnt_drop_write(nd->path.mnt);
3477 	return error;
3478 }
3479 
vfs_tmpfile(struct dentry * dentry,umode_t mode,int open_flag)3480 struct dentry *vfs_tmpfile(struct dentry *dentry, umode_t mode, int open_flag)
3481 {
3482 	struct dentry *child = NULL;
3483 	struct inode *dir = dentry->d_inode;
3484 	struct inode *inode;
3485 	int error;
3486 
3487 	/* we want directory to be writable */
3488 	error = inode_permission2(ERR_PTR(-EOPNOTSUPP), dir,
3489 					MAY_WRITE | MAY_EXEC);
3490 	if (error)
3491 		goto out_err;
3492 	error = -EOPNOTSUPP;
3493 	if (!dir->i_op->tmpfile)
3494 		goto out_err;
3495 	error = -ENOMEM;
3496 	child = d_alloc(dentry, &slash_name);
3497 	if (unlikely(!child))
3498 		goto out_err;
3499 	error = dir->i_op->tmpfile(dir, child, mode);
3500 	if (error)
3501 		goto out_err;
3502 	error = -ENOENT;
3503 	inode = child->d_inode;
3504 	if (unlikely(!inode))
3505 		goto out_err;
3506 	if (!(open_flag & O_EXCL)) {
3507 		spin_lock(&inode->i_lock);
3508 		inode->i_state |= I_LINKABLE;
3509 		spin_unlock(&inode->i_lock);
3510 	}
3511 	return child;
3512 
3513 out_err:
3514 	dput(child);
3515 	return ERR_PTR(error);
3516 }
3517 EXPORT_SYMBOL(vfs_tmpfile);
3518 
do_tmpfile(struct nameidata * nd,unsigned flags,const struct open_flags * op,struct file * file,int * opened)3519 static int do_tmpfile(struct nameidata *nd, unsigned flags,
3520 		const struct open_flags *op,
3521 		struct file *file, int *opened)
3522 {
3523 	struct dentry *child;
3524 	struct path path;
3525 	int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
3526 	if (unlikely(error))
3527 		return error;
3528 	error = mnt_want_write(path.mnt);
3529 	if (unlikely(error))
3530 		goto out;
3531 	child = vfs_tmpfile(path.dentry, op->mode, op->open_flag);
3532 	error = PTR_ERR(child);
3533 	if (unlikely(IS_ERR(child)))
3534 		goto out2;
3535 	dput(path.dentry);
3536 	path.dentry = child;
3537 	audit_inode(nd->name, child, 0);
3538 	/* Don't check for other permissions, the inode was just created */
3539 	error = may_open(&path, 0, op->open_flag);
3540 	if (error)
3541 		goto out2;
3542 	file->f_path.mnt = path.mnt;
3543 	error = finish_open(file, child, NULL, opened);
3544 	if (error)
3545 		goto out2;
3546 	error = open_check_o_direct(file);
3547 	if (error)
3548 		fput(file);
3549 out2:
3550 	mnt_drop_write(path.mnt);
3551 out:
3552 	path_put(&path);
3553 	return error;
3554 }
3555 
do_o_path(struct nameidata * nd,unsigned flags,struct file * file)3556 static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file)
3557 {
3558 	struct path path;
3559 	int error = path_lookupat(nd, flags, &path);
3560 	if (!error) {
3561 		audit_inode(nd->name, path.dentry, 0);
3562 		error = vfs_open(&path, file, current_cred());
3563 		path_put(&path);
3564 	}
3565 	return error;
3566 }
3567 
path_openat(struct nameidata * nd,const struct open_flags * op,unsigned flags)3568 static struct file *path_openat(struct nameidata *nd,
3569 			const struct open_flags *op, unsigned flags)
3570 {
3571 	const char *s;
3572 	struct file *file;
3573 	int opened = 0;
3574 	int error;
3575 
3576 	file = get_empty_filp();
3577 	if (IS_ERR(file))
3578 		return file;
3579 
3580 	file->f_flags = op->open_flag;
3581 
3582 	if (unlikely(file->f_flags & __O_TMPFILE)) {
3583 		error = do_tmpfile(nd, flags, op, file, &opened);
3584 		goto out2;
3585 	}
3586 
3587 	if (unlikely(file->f_flags & O_PATH)) {
3588 		error = do_o_path(nd, flags, file);
3589 		if (!error)
3590 			opened |= FILE_OPENED;
3591 		goto out2;
3592 	}
3593 
3594 	s = path_init(nd, flags);
3595 	if (IS_ERR(s)) {
3596 		put_filp(file);
3597 		return ERR_CAST(s);
3598 	}
3599 	while (!(error = link_path_walk(s, nd)) &&
3600 		(error = do_last(nd, file, op, &opened)) > 0) {
3601 		nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3602 		s = trailing_symlink(nd);
3603 		if (IS_ERR(s)) {
3604 			error = PTR_ERR(s);
3605 			break;
3606 		}
3607 	}
3608 	terminate_walk(nd);
3609 out2:
3610 	if (!(opened & FILE_OPENED)) {
3611 		BUG_ON(!error);
3612 		put_filp(file);
3613 	}
3614 	if (unlikely(error)) {
3615 		if (error == -EOPENSTALE) {
3616 			if (flags & LOOKUP_RCU)
3617 				error = -ECHILD;
3618 			else
3619 				error = -ESTALE;
3620 		}
3621 		file = ERR_PTR(error);
3622 	}
3623 	return file;
3624 }
3625 
do_filp_open(int dfd,struct filename * pathname,const struct open_flags * op)3626 struct file *do_filp_open(int dfd, struct filename *pathname,
3627 		const struct open_flags *op)
3628 {
3629 	struct nameidata nd;
3630 	int flags = op->lookup_flags;
3631 	struct file *filp;
3632 
3633 	set_nameidata(&nd, dfd, pathname);
3634 	filp = path_openat(&nd, op, flags | LOOKUP_RCU);
3635 	if (unlikely(filp == ERR_PTR(-ECHILD)))
3636 		filp = path_openat(&nd, op, flags);
3637 	if (unlikely(filp == ERR_PTR(-ESTALE)))
3638 		filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
3639 	restore_nameidata();
3640 	return filp;
3641 }
3642 
do_file_open_root(struct dentry * dentry,struct vfsmount * mnt,const char * name,const struct open_flags * op)3643 struct file *do_file_open_root(struct dentry *dentry, struct vfsmount *mnt,
3644 		const char *name, const struct open_flags *op)
3645 {
3646 	struct nameidata nd;
3647 	struct file *file;
3648 	struct filename *filename;
3649 	int flags = op->lookup_flags | LOOKUP_ROOT;
3650 
3651 	nd.root.mnt = mnt;
3652 	nd.root.dentry = dentry;
3653 
3654 	if (d_is_symlink(dentry) && op->intent & LOOKUP_OPEN)
3655 		return ERR_PTR(-ELOOP);
3656 
3657 	filename = getname_kernel(name);
3658 	if (IS_ERR(filename))
3659 		return ERR_CAST(filename);
3660 
3661 	set_nameidata(&nd, -1, filename);
3662 	file = path_openat(&nd, op, flags | LOOKUP_RCU);
3663 	if (unlikely(file == ERR_PTR(-ECHILD)))
3664 		file = path_openat(&nd, op, flags);
3665 	if (unlikely(file == ERR_PTR(-ESTALE)))
3666 		file = path_openat(&nd, op, flags | LOOKUP_REVAL);
3667 	restore_nameidata();
3668 	putname(filename);
3669 	return file;
3670 }
3671 
filename_create(int dfd,struct filename * name,struct path * path,unsigned int lookup_flags)3672 static struct dentry *filename_create(int dfd, struct filename *name,
3673 				struct path *path, unsigned int lookup_flags)
3674 {
3675 	struct dentry *dentry = ERR_PTR(-EEXIST);
3676 	struct qstr last;
3677 	int type;
3678 	int err2;
3679 	int error;
3680 	bool is_dir = (lookup_flags & LOOKUP_DIRECTORY);
3681 
3682 	/*
3683 	 * Note that only LOOKUP_REVAL and LOOKUP_DIRECTORY matter here. Any
3684 	 * other flags passed in are ignored!
3685 	 */
3686 	lookup_flags &= LOOKUP_REVAL;
3687 
3688 	name = filename_parentat(dfd, name, lookup_flags, path, &last, &type);
3689 	if (IS_ERR(name))
3690 		return ERR_CAST(name);
3691 
3692 	/*
3693 	 * Yucky last component or no last component at all?
3694 	 * (foo/., foo/.., /////)
3695 	 */
3696 	if (unlikely(type != LAST_NORM))
3697 		goto out;
3698 
3699 	/* don't fail immediately if it's r/o, at least try to report other errors */
3700 	err2 = mnt_want_write(path->mnt);
3701 	/*
3702 	 * Do the final lookup.
3703 	 */
3704 	lookup_flags |= LOOKUP_CREATE | LOOKUP_EXCL;
3705 	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
3706 	dentry = __lookup_hash(&last, path->dentry, lookup_flags);
3707 	if (IS_ERR(dentry))
3708 		goto unlock;
3709 
3710 	error = -EEXIST;
3711 	if (d_is_positive(dentry))
3712 		goto fail;
3713 
3714 	/*
3715 	 * Special case - lookup gave negative, but... we had foo/bar/
3716 	 * From the vfs_mknod() POV we just have a negative dentry -
3717 	 * all is fine. Let's be bastards - you had / on the end, you've
3718 	 * been asking for (non-existent) directory. -ENOENT for you.
3719 	 */
3720 	if (unlikely(!is_dir && last.name[last.len])) {
3721 		error = -ENOENT;
3722 		goto fail;
3723 	}
3724 	if (unlikely(err2)) {
3725 		error = err2;
3726 		goto fail;
3727 	}
3728 	putname(name);
3729 	return dentry;
3730 fail:
3731 	dput(dentry);
3732 	dentry = ERR_PTR(error);
3733 unlock:
3734 	inode_unlock(path->dentry->d_inode);
3735 	if (!err2)
3736 		mnt_drop_write(path->mnt);
3737 out:
3738 	path_put(path);
3739 	putname(name);
3740 	return dentry;
3741 }
3742 
kern_path_create(int dfd,const char * pathname,struct path * path,unsigned int lookup_flags)3743 struct dentry *kern_path_create(int dfd, const char *pathname,
3744 				struct path *path, unsigned int lookup_flags)
3745 {
3746 	return filename_create(dfd, getname_kernel(pathname),
3747 				path, lookup_flags);
3748 }
3749 EXPORT_SYMBOL(kern_path_create);
3750 
done_path_create(struct path * path,struct dentry * dentry)3751 void done_path_create(struct path *path, struct dentry *dentry)
3752 {
3753 	dput(dentry);
3754 	inode_unlock(path->dentry->d_inode);
3755 	mnt_drop_write(path->mnt);
3756 	path_put(path);
3757 }
3758 EXPORT_SYMBOL(done_path_create);
3759 
user_path_create(int dfd,const char __user * pathname,struct path * path,unsigned int lookup_flags)3760 inline struct dentry *user_path_create(int dfd, const char __user *pathname,
3761 				struct path *path, unsigned int lookup_flags)
3762 {
3763 	return filename_create(dfd, getname(pathname), path, lookup_flags);
3764 }
3765 EXPORT_SYMBOL(user_path_create);
3766 
vfs_mknod2(struct vfsmount * mnt,struct inode * dir,struct dentry * dentry,umode_t mode,dev_t dev)3767 int vfs_mknod2(struct vfsmount *mnt, struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3768 {
3769 	int error = may_create(mnt, dir, dentry);
3770 
3771 	if (error)
3772 		return error;
3773 
3774 	if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
3775 		return -EPERM;
3776 
3777 	if (!dir->i_op->mknod)
3778 		return -EPERM;
3779 
3780 	error = devcgroup_inode_mknod(mode, dev);
3781 	if (error)
3782 		return error;
3783 
3784 	error = security_inode_mknod(dir, dentry, mode, dev);
3785 	if (error)
3786 		return error;
3787 
3788 	error = dir->i_op->mknod(dir, dentry, mode, dev);
3789 	if (!error)
3790 		fsnotify_create(dir, dentry);
3791 	return error;
3792 }
3793 EXPORT_SYMBOL(vfs_mknod2);
3794 
vfs_mknod(struct inode * dir,struct dentry * dentry,umode_t mode,dev_t dev)3795 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3796 {
3797 	return vfs_mknod2(NULL, dir, dentry, mode, dev);
3798 }
3799 EXPORT_SYMBOL(vfs_mknod);
3800 
may_mknod(umode_t mode)3801 static int may_mknod(umode_t mode)
3802 {
3803 	switch (mode & S_IFMT) {
3804 	case S_IFREG:
3805 	case S_IFCHR:
3806 	case S_IFBLK:
3807 	case S_IFIFO:
3808 	case S_IFSOCK:
3809 	case 0: /* zero mode translates to S_IFREG */
3810 		return 0;
3811 	case S_IFDIR:
3812 		return -EPERM;
3813 	default:
3814 		return -EINVAL;
3815 	}
3816 }
3817 
SYSCALL_DEFINE4(mknodat,int,dfd,const char __user *,filename,umode_t,mode,unsigned,dev)3818 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
3819 		unsigned, dev)
3820 {
3821 	struct dentry *dentry;
3822 	struct path path;
3823 	int error;
3824 	unsigned int lookup_flags = 0;
3825 
3826 	error = may_mknod(mode);
3827 	if (error)
3828 		return error;
3829 retry:
3830 	dentry = user_path_create(dfd, filename, &path, lookup_flags);
3831 	if (IS_ERR(dentry))
3832 		return PTR_ERR(dentry);
3833 
3834 	if (!IS_POSIXACL(path.dentry->d_inode))
3835 		mode &= ~current_umask();
3836 	error = security_path_mknod(&path, dentry, mode, dev);
3837 	if (error)
3838 		goto out;
3839 	switch (mode & S_IFMT) {
3840 		case 0: case S_IFREG:
3841 			error = vfs_create2(path.mnt, path.dentry->d_inode,dentry,mode,true);
3842 			if (!error)
3843 				ima_post_path_mknod(dentry);
3844 			break;
3845 		case S_IFCHR: case S_IFBLK:
3846 			error = vfs_mknod2(path.mnt, path.dentry->d_inode,dentry,mode,
3847 					new_decode_dev(dev));
3848 			break;
3849 		case S_IFIFO: case S_IFSOCK:
3850 			error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
3851 			break;
3852 	}
3853 out:
3854 	done_path_create(&path, dentry);
3855 	if (retry_estale(error, lookup_flags)) {
3856 		lookup_flags |= LOOKUP_REVAL;
3857 		goto retry;
3858 	}
3859 	return error;
3860 }
3861 
SYSCALL_DEFINE3(mknod,const char __user *,filename,umode_t,mode,unsigned,dev)3862 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3863 {
3864 	return sys_mknodat(AT_FDCWD, filename, mode, dev);
3865 }
3866 
vfs_mkdir2(struct vfsmount * mnt,struct inode * dir,struct dentry * dentry,umode_t mode)3867 int vfs_mkdir2(struct vfsmount *mnt, struct inode *dir, struct dentry *dentry, umode_t mode)
3868 {
3869 	int error = may_create(mnt, dir, dentry);
3870 	unsigned max_links = dir->i_sb->s_max_links;
3871 
3872 	if (error)
3873 		return error;
3874 
3875 	if (!dir->i_op->mkdir)
3876 		return -EPERM;
3877 
3878 	mode &= (S_IRWXUGO|S_ISVTX);
3879 	error = security_inode_mkdir(dir, dentry, mode);
3880 	if (error)
3881 		return error;
3882 
3883 	if (max_links && dir->i_nlink >= max_links)
3884 		return -EMLINK;
3885 
3886 	error = dir->i_op->mkdir(dir, dentry, mode);
3887 	if (!error)
3888 		fsnotify_mkdir(dir, dentry);
3889 	return error;
3890 }
3891 EXPORT_SYMBOL(vfs_mkdir2);
3892 
vfs_mkdir(struct inode * dir,struct dentry * dentry,umode_t mode)3893 int vfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
3894 {
3895 	return vfs_mkdir2(NULL, dir, dentry, mode);
3896 }
3897 EXPORT_SYMBOL(vfs_mkdir);
3898 
SYSCALL_DEFINE3(mkdirat,int,dfd,const char __user *,pathname,umode_t,mode)3899 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
3900 {
3901 	struct dentry *dentry;
3902 	struct path path;
3903 	int error;
3904 	unsigned int lookup_flags = LOOKUP_DIRECTORY;
3905 
3906 retry:
3907 	dentry = user_path_create(dfd, pathname, &path, lookup_flags);
3908 	if (IS_ERR(dentry))
3909 		return PTR_ERR(dentry);
3910 
3911 	if (!IS_POSIXACL(path.dentry->d_inode))
3912 		mode &= ~current_umask();
3913 	error = security_path_mkdir(&path, dentry, mode);
3914 	if (!error)
3915 		error = vfs_mkdir2(path.mnt, path.dentry->d_inode, dentry, mode);
3916 	done_path_create(&path, dentry);
3917 	if (retry_estale(error, lookup_flags)) {
3918 		lookup_flags |= LOOKUP_REVAL;
3919 		goto retry;
3920 	}
3921 	return error;
3922 }
3923 
SYSCALL_DEFINE2(mkdir,const char __user *,pathname,umode_t,mode)3924 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
3925 {
3926 	return sys_mkdirat(AT_FDCWD, pathname, mode);
3927 }
3928 
vfs_rmdir2(struct vfsmount * mnt,struct inode * dir,struct dentry * dentry)3929 int vfs_rmdir2(struct vfsmount *mnt, struct inode *dir, struct dentry *dentry)
3930 {
3931 	int error = may_delete(mnt, dir, dentry, 1);
3932 
3933 	if (error)
3934 		return error;
3935 
3936 	if (!dir->i_op->rmdir)
3937 		return -EPERM;
3938 
3939 	dget(dentry);
3940 	inode_lock(dentry->d_inode);
3941 
3942 	error = -EBUSY;
3943 	if (is_local_mountpoint(dentry))
3944 		goto out;
3945 
3946 	error = security_inode_rmdir(dir, dentry);
3947 	if (error)
3948 		goto out;
3949 
3950 	shrink_dcache_parent(dentry);
3951 	error = dir->i_op->rmdir(dir, dentry);
3952 	if (error)
3953 		goto out;
3954 
3955 	dentry->d_inode->i_flags |= S_DEAD;
3956 	dont_mount(dentry);
3957 	detach_mounts(dentry);
3958 
3959 out:
3960 	inode_unlock(dentry->d_inode);
3961 	dput(dentry);
3962 	if (!error)
3963 		d_delete(dentry);
3964 	return error;
3965 }
3966 EXPORT_SYMBOL(vfs_rmdir2);
3967 
vfs_rmdir(struct inode * dir,struct dentry * dentry)3968 int vfs_rmdir(struct inode *dir, struct dentry *dentry)
3969 {
3970 	return vfs_rmdir2(NULL, dir, dentry);
3971 }
3972 EXPORT_SYMBOL(vfs_rmdir);
3973 
do_rmdir(int dfd,const char __user * pathname)3974 static long do_rmdir(int dfd, const char __user *pathname)
3975 {
3976 	int error = 0;
3977 	struct filename *name;
3978 	struct dentry *dentry;
3979 	struct path path;
3980 	struct qstr last;
3981 	int type;
3982 	unsigned int lookup_flags = 0;
3983 retry:
3984 	name = filename_parentat(dfd, getname(pathname), lookup_flags,
3985 				&path, &last, &type);
3986 	if (IS_ERR(name))
3987 		return PTR_ERR(name);
3988 
3989 	switch (type) {
3990 	case LAST_DOTDOT:
3991 		error = -ENOTEMPTY;
3992 		goto exit1;
3993 	case LAST_DOT:
3994 		error = -EINVAL;
3995 		goto exit1;
3996 	case LAST_ROOT:
3997 		error = -EBUSY;
3998 		goto exit1;
3999 	}
4000 
4001 	error = mnt_want_write(path.mnt);
4002 	if (error)
4003 		goto exit1;
4004 
4005 	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4006 	dentry = __lookup_hash(&last, path.dentry, lookup_flags);
4007 	error = PTR_ERR(dentry);
4008 	if (IS_ERR(dentry))
4009 		goto exit2;
4010 	if (!dentry->d_inode) {
4011 		error = -ENOENT;
4012 		goto exit3;
4013 	}
4014 	error = security_path_rmdir(&path, dentry);
4015 	if (error)
4016 		goto exit3;
4017 	error = vfs_rmdir2(path.mnt, path.dentry->d_inode, dentry);
4018 exit3:
4019 	dput(dentry);
4020 exit2:
4021 	inode_unlock(path.dentry->d_inode);
4022 	mnt_drop_write(path.mnt);
4023 exit1:
4024 	path_put(&path);
4025 	putname(name);
4026 	if (retry_estale(error, lookup_flags)) {
4027 		lookup_flags |= LOOKUP_REVAL;
4028 		goto retry;
4029 	}
4030 	return error;
4031 }
4032 
SYSCALL_DEFINE1(rmdir,const char __user *,pathname)4033 SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
4034 {
4035 	return do_rmdir(AT_FDCWD, pathname);
4036 }
4037 
4038 /**
4039  * vfs_unlink - unlink a filesystem object
4040  * @dir:	parent directory
4041  * @dentry:	victim
4042  * @delegated_inode: returns victim inode, if the inode is delegated.
4043  *
4044  * The caller must hold dir->i_mutex.
4045  *
4046  * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and
4047  * return a reference to the inode in delegated_inode.  The caller
4048  * should then break the delegation on that inode and retry.  Because
4049  * breaking a delegation may take a long time, the caller should drop
4050  * dir->i_mutex before doing so.
4051  *
4052  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4053  * be appropriate for callers that expect the underlying filesystem not
4054  * to be NFS exported.
4055  */
vfs_unlink2(struct vfsmount * mnt,struct inode * dir,struct dentry * dentry,struct inode ** delegated_inode)4056 int vfs_unlink2(struct vfsmount *mnt, struct inode *dir, struct dentry *dentry, struct inode **delegated_inode)
4057 {
4058 	struct inode *target = dentry->d_inode;
4059 	int error = may_delete(mnt, dir, dentry, 0);
4060 
4061 	if (error)
4062 		return error;
4063 
4064 	if (!dir->i_op->unlink)
4065 		return -EPERM;
4066 
4067 	inode_lock(target);
4068 	if (is_local_mountpoint(dentry))
4069 		error = -EBUSY;
4070 	else {
4071 		error = security_inode_unlink(dir, dentry);
4072 		if (!error) {
4073 			error = try_break_deleg(target, delegated_inode);
4074 			if (error)
4075 				goto out;
4076 			error = dir->i_op->unlink(dir, dentry);
4077 			if (!error) {
4078 				dont_mount(dentry);
4079 				detach_mounts(dentry);
4080 			}
4081 		}
4082 	}
4083 out:
4084 	inode_unlock(target);
4085 
4086 	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
4087 	if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
4088 		fsnotify_link_count(target);
4089 		d_delete(dentry);
4090 	}
4091 
4092 	return error;
4093 }
4094 EXPORT_SYMBOL(vfs_unlink2);
4095 
vfs_unlink(struct inode * dir,struct dentry * dentry,struct inode ** delegated_inode)4096 int vfs_unlink(struct inode *dir, struct dentry *dentry, struct inode **delegated_inode)
4097 {
4098 	return vfs_unlink2(NULL, dir, dentry, delegated_inode);
4099 }
4100 EXPORT_SYMBOL(vfs_unlink);
4101 
4102 /*
4103  * Make sure that the actual truncation of the file will occur outside its
4104  * directory's i_mutex.  Truncate can take a long time if there is a lot of
4105  * writeout happening, and we don't want to prevent access to the directory
4106  * while waiting on the I/O.
4107  */
do_unlinkat(int dfd,const char __user * pathname)4108 static long do_unlinkat(int dfd, const char __user *pathname)
4109 {
4110 	int error;
4111 	struct filename *name;
4112 	struct dentry *dentry;
4113 	struct path path;
4114 	struct qstr last;
4115 	int type;
4116 	struct inode *inode = NULL;
4117 	struct inode *delegated_inode = NULL;
4118 	unsigned int lookup_flags = 0;
4119 retry:
4120 	name = filename_parentat(dfd, getname(pathname), lookup_flags,
4121 				&path, &last, &type);
4122 	if (IS_ERR(name))
4123 		return PTR_ERR(name);
4124 
4125 	error = -EISDIR;
4126 	if (type != LAST_NORM)
4127 		goto exit1;
4128 
4129 	error = mnt_want_write(path.mnt);
4130 	if (error)
4131 		goto exit1;
4132 retry_deleg:
4133 	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4134 	dentry = __lookup_hash(&last, path.dentry, lookup_flags);
4135 	error = PTR_ERR(dentry);
4136 	if (!IS_ERR(dentry)) {
4137 		/* Why not before? Because we want correct error value */
4138 		if (last.name[last.len])
4139 			goto slashes;
4140 		inode = dentry->d_inode;
4141 		if (d_is_negative(dentry))
4142 			goto slashes;
4143 		ihold(inode);
4144 		error = security_path_unlink(&path, dentry);
4145 		if (error)
4146 			goto exit2;
4147 		error = vfs_unlink2(path.mnt, path.dentry->d_inode, dentry, &delegated_inode);
4148 exit2:
4149 		dput(dentry);
4150 	}
4151 	inode_unlock(path.dentry->d_inode);
4152 	if (inode)
4153 		iput(inode);	/* truncate the inode here */
4154 	inode = NULL;
4155 	if (delegated_inode) {
4156 		error = break_deleg_wait(&delegated_inode);
4157 		if (!error)
4158 			goto retry_deleg;
4159 	}
4160 	mnt_drop_write(path.mnt);
4161 exit1:
4162 	path_put(&path);
4163 	putname(name);
4164 	if (retry_estale(error, lookup_flags)) {
4165 		lookup_flags |= LOOKUP_REVAL;
4166 		inode = NULL;
4167 		goto retry;
4168 	}
4169 	return error;
4170 
4171 slashes:
4172 	if (d_is_negative(dentry))
4173 		error = -ENOENT;
4174 	else if (d_is_dir(dentry))
4175 		error = -EISDIR;
4176 	else
4177 		error = -ENOTDIR;
4178 	goto exit2;
4179 }
4180 
SYSCALL_DEFINE3(unlinkat,int,dfd,const char __user *,pathname,int,flag)4181 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
4182 {
4183 	if ((flag & ~AT_REMOVEDIR) != 0)
4184 		return -EINVAL;
4185 
4186 	if (flag & AT_REMOVEDIR)
4187 		return do_rmdir(dfd, pathname);
4188 
4189 	return do_unlinkat(dfd, pathname);
4190 }
4191 
SYSCALL_DEFINE1(unlink,const char __user *,pathname)4192 SYSCALL_DEFINE1(unlink, const char __user *, pathname)
4193 {
4194 	return do_unlinkat(AT_FDCWD, pathname);
4195 }
4196 
vfs_symlink2(struct vfsmount * mnt,struct inode * dir,struct dentry * dentry,const char * oldname)4197 int vfs_symlink2(struct vfsmount *mnt, struct inode *dir, struct dentry *dentry, const char *oldname)
4198 {
4199 	int error = may_create(mnt, dir, dentry);
4200 
4201 	if (error)
4202 		return error;
4203 
4204 	if (!dir->i_op->symlink)
4205 		return -EPERM;
4206 
4207 	error = security_inode_symlink(dir, dentry, oldname);
4208 	if (error)
4209 		return error;
4210 
4211 	error = dir->i_op->symlink(dir, dentry, oldname);
4212 	if (!error)
4213 		fsnotify_create(dir, dentry);
4214 	return error;
4215 }
4216 EXPORT_SYMBOL(vfs_symlink2);
4217 
vfs_symlink(struct inode * dir,struct dentry * dentry,const char * oldname)4218 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
4219 {
4220 	return vfs_symlink2(NULL, dir, dentry, oldname);
4221 }
4222 EXPORT_SYMBOL(vfs_symlink);
4223 
SYSCALL_DEFINE3(symlinkat,const char __user *,oldname,int,newdfd,const char __user *,newname)4224 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
4225 		int, newdfd, const char __user *, newname)
4226 {
4227 	int error;
4228 	struct filename *from;
4229 	struct dentry *dentry;
4230 	struct path path;
4231 	unsigned int lookup_flags = 0;
4232 
4233 	from = getname(oldname);
4234 	if (IS_ERR(from))
4235 		return PTR_ERR(from);
4236 retry:
4237 	dentry = user_path_create(newdfd, newname, &path, lookup_flags);
4238 	error = PTR_ERR(dentry);
4239 	if (IS_ERR(dentry))
4240 		goto out_putname;
4241 
4242 	error = security_path_symlink(&path, dentry, from->name);
4243 	if (!error)
4244 		error = vfs_symlink2(path.mnt, path.dentry->d_inode, dentry, from->name);
4245 	done_path_create(&path, dentry);
4246 	if (retry_estale(error, lookup_flags)) {
4247 		lookup_flags |= LOOKUP_REVAL;
4248 		goto retry;
4249 	}
4250 out_putname:
4251 	putname(from);
4252 	return error;
4253 }
4254 
SYSCALL_DEFINE2(symlink,const char __user *,oldname,const char __user *,newname)4255 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
4256 {
4257 	return sys_symlinkat(oldname, AT_FDCWD, newname);
4258 }
4259 
4260 /**
4261  * vfs_link - create a new link
4262  * @old_dentry:	object to be linked
4263  * @dir:	new parent
4264  * @new_dentry:	where to create the new link
4265  * @delegated_inode: returns inode needing a delegation break
4266  *
4267  * The caller must hold dir->i_mutex
4268  *
4269  * If vfs_link discovers a delegation on the to-be-linked file in need
4270  * of breaking, it will return -EWOULDBLOCK and return a reference to the
4271  * inode in delegated_inode.  The caller should then break the delegation
4272  * and retry.  Because breaking a delegation may take a long time, the
4273  * caller should drop the i_mutex before doing so.
4274  *
4275  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4276  * be appropriate for callers that expect the underlying filesystem not
4277  * to be NFS exported.
4278  */
vfs_link2(struct vfsmount * mnt,struct dentry * old_dentry,struct inode * dir,struct dentry * new_dentry,struct inode ** delegated_inode)4279 int vfs_link2(struct vfsmount *mnt, struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode)
4280 {
4281 	struct inode *inode = old_dentry->d_inode;
4282 	unsigned max_links = dir->i_sb->s_max_links;
4283 	int error;
4284 
4285 	if (!inode)
4286 		return -ENOENT;
4287 
4288 	error = may_create(mnt, dir, new_dentry);
4289 	if (error)
4290 		return error;
4291 
4292 	if (dir->i_sb != inode->i_sb)
4293 		return -EXDEV;
4294 
4295 	/*
4296 	 * A link to an append-only or immutable file cannot be created.
4297 	 */
4298 	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
4299 		return -EPERM;
4300 	/*
4301 	 * Updating the link count will likely cause i_uid and i_gid to
4302 	 * be writen back improperly if their true value is unknown to
4303 	 * the vfs.
4304 	 */
4305 	if (HAS_UNMAPPED_ID(inode))
4306 		return -EPERM;
4307 	if (!dir->i_op->link)
4308 		return -EPERM;
4309 	if (S_ISDIR(inode->i_mode))
4310 		return -EPERM;
4311 
4312 	error = security_inode_link(old_dentry, dir, new_dentry);
4313 	if (error)
4314 		return error;
4315 
4316 	inode_lock(inode);
4317 	/* Make sure we don't allow creating hardlink to an unlinked file */
4318 	if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
4319 		error =  -ENOENT;
4320 	else if (max_links && inode->i_nlink >= max_links)
4321 		error = -EMLINK;
4322 	else {
4323 		error = try_break_deleg(inode, delegated_inode);
4324 		if (!error)
4325 			error = dir->i_op->link(old_dentry, dir, new_dentry);
4326 	}
4327 
4328 	if (!error && (inode->i_state & I_LINKABLE)) {
4329 		spin_lock(&inode->i_lock);
4330 		inode->i_state &= ~I_LINKABLE;
4331 		spin_unlock(&inode->i_lock);
4332 	}
4333 	inode_unlock(inode);
4334 	if (!error)
4335 		fsnotify_link(dir, inode, new_dentry);
4336 	return error;
4337 }
4338 EXPORT_SYMBOL(vfs_link2);
4339 
vfs_link(struct dentry * old_dentry,struct inode * dir,struct dentry * new_dentry,struct inode ** delegated_inode)4340 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode)
4341 {
4342 	return vfs_link2(NULL, old_dentry, dir, new_dentry, delegated_inode);
4343 }
4344 EXPORT_SYMBOL(vfs_link);
4345 
4346 /*
4347  * Hardlinks are often used in delicate situations.  We avoid
4348  * security-related surprises by not following symlinks on the
4349  * newname.  --KAB
4350  *
4351  * We don't follow them on the oldname either to be compatible
4352  * with linux 2.0, and to avoid hard-linking to directories
4353  * and other special files.  --ADM
4354  */
SYSCALL_DEFINE5(linkat,int,olddfd,const char __user *,oldname,int,newdfd,const char __user *,newname,int,flags)4355 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
4356 		int, newdfd, const char __user *, newname, int, flags)
4357 {
4358 	struct dentry *new_dentry;
4359 	struct path old_path, new_path;
4360 	struct inode *delegated_inode = NULL;
4361 	int how = 0;
4362 	int error;
4363 
4364 	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
4365 		return -EINVAL;
4366 	/*
4367 	 * To use null names we require CAP_DAC_READ_SEARCH
4368 	 * This ensures that not everyone will be able to create
4369 	 * handlink using the passed filedescriptor.
4370 	 */
4371 	if (flags & AT_EMPTY_PATH) {
4372 		if (!capable(CAP_DAC_READ_SEARCH))
4373 			return -ENOENT;
4374 		how = LOOKUP_EMPTY;
4375 	}
4376 
4377 	if (flags & AT_SYMLINK_FOLLOW)
4378 		how |= LOOKUP_FOLLOW;
4379 retry:
4380 	error = user_path_at(olddfd, oldname, how, &old_path);
4381 	if (error)
4382 		return error;
4383 
4384 	new_dentry = user_path_create(newdfd, newname, &new_path,
4385 					(how & LOOKUP_REVAL));
4386 	error = PTR_ERR(new_dentry);
4387 	if (IS_ERR(new_dentry))
4388 		goto out;
4389 
4390 	error = -EXDEV;
4391 	if (old_path.mnt != new_path.mnt)
4392 		goto out_dput;
4393 	error = may_linkat(&old_path);
4394 	if (unlikely(error))
4395 		goto out_dput;
4396 	error = security_path_link(old_path.dentry, &new_path, new_dentry);
4397 	if (error)
4398 		goto out_dput;
4399 	error = vfs_link2(old_path.mnt, old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode);
4400 out_dput:
4401 	done_path_create(&new_path, new_dentry);
4402 	if (delegated_inode) {
4403 		error = break_deleg_wait(&delegated_inode);
4404 		if (!error) {
4405 			path_put(&old_path);
4406 			goto retry;
4407 		}
4408 	}
4409 	if (retry_estale(error, how)) {
4410 		path_put(&old_path);
4411 		how |= LOOKUP_REVAL;
4412 		goto retry;
4413 	}
4414 out:
4415 	path_put(&old_path);
4416 
4417 	return error;
4418 }
4419 
SYSCALL_DEFINE2(link,const char __user *,oldname,const char __user *,newname)4420 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
4421 {
4422 	return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4423 }
4424 
4425 /**
4426  * vfs_rename - rename a filesystem object
4427  * @old_dir:	parent of source
4428  * @old_dentry:	source
4429  * @new_dir:	parent of destination
4430  * @new_dentry:	destination
4431  * @delegated_inode: returns an inode needing a delegation break
4432  * @flags:	rename flags
4433  *
4434  * The caller must hold multiple mutexes--see lock_rename()).
4435  *
4436  * If vfs_rename discovers a delegation in need of breaking at either
4437  * the source or destination, it will return -EWOULDBLOCK and return a
4438  * reference to the inode in delegated_inode.  The caller should then
4439  * break the delegation and retry.  Because breaking a delegation may
4440  * take a long time, the caller should drop all locks before doing
4441  * so.
4442  *
4443  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4444  * be appropriate for callers that expect the underlying filesystem not
4445  * to be NFS exported.
4446  *
4447  * The worst of all namespace operations - renaming directory. "Perverted"
4448  * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
4449  * Problems:
4450  *
4451  *	a) we can get into loop creation.
4452  *	b) race potential - two innocent renames can create a loop together.
4453  *	   That's where 4.4 screws up. Current fix: serialization on
4454  *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
4455  *	   story.
4456  *	c) we have to lock _four_ objects - parents and victim (if it exists),
4457  *	   and source (if it is not a directory).
4458  *	   And that - after we got ->i_mutex on parents (until then we don't know
4459  *	   whether the target exists).  Solution: try to be smart with locking
4460  *	   order for inodes.  We rely on the fact that tree topology may change
4461  *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
4462  *	   move will be locked.  Thus we can rank directories by the tree
4463  *	   (ancestors first) and rank all non-directories after them.
4464  *	   That works since everybody except rename does "lock parent, lookup,
4465  *	   lock child" and rename is under ->s_vfs_rename_mutex.
4466  *	   HOWEVER, it relies on the assumption that any object with ->lookup()
4467  *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
4468  *	   we'd better make sure that there's no link(2) for them.
4469  *	d) conversion from fhandle to dentry may come in the wrong moment - when
4470  *	   we are removing the target. Solution: we will have to grab ->i_mutex
4471  *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
4472  *	   ->i_mutex on parents, which works but leads to some truly excessive
4473  *	   locking].
4474  */
vfs_rename2(struct vfsmount * mnt,struct inode * old_dir,struct dentry * old_dentry,struct inode * new_dir,struct dentry * new_dentry,struct inode ** delegated_inode,unsigned int flags)4475 int vfs_rename2(struct vfsmount *mnt,
4476 	       struct inode *old_dir, struct dentry *old_dentry,
4477 	       struct inode *new_dir, struct dentry *new_dentry,
4478 	       struct inode **delegated_inode, unsigned int flags)
4479 {
4480 	int error;
4481 	bool is_dir = d_is_dir(old_dentry);
4482 	struct inode *source = old_dentry->d_inode;
4483 	struct inode *target = new_dentry->d_inode;
4484 	bool new_is_dir = false;
4485 	unsigned max_links = new_dir->i_sb->s_max_links;
4486 	struct name_snapshot old_name;
4487 
4488 	if (source == target)
4489 		return 0;
4490 
4491 	error = may_delete(mnt, old_dir, old_dentry, is_dir);
4492 	if (error)
4493 		return error;
4494 
4495 	if (!target) {
4496 		error = may_create(mnt, new_dir, new_dentry);
4497 	} else {
4498 		new_is_dir = d_is_dir(new_dentry);
4499 
4500 		if (!(flags & RENAME_EXCHANGE))
4501 			error = may_delete(mnt, new_dir, new_dentry, is_dir);
4502 		else
4503 			error = may_delete(mnt, new_dir, new_dentry, new_is_dir);
4504 	}
4505 	if (error)
4506 		return error;
4507 
4508 	if (!old_dir->i_op->rename)
4509 		return -EPERM;
4510 
4511 	/*
4512 	 * If we are going to change the parent - check write permissions,
4513 	 * we'll need to flip '..'.
4514 	 */
4515 	if (new_dir != old_dir) {
4516 		if (is_dir) {
4517 			error = inode_permission2(mnt, source, MAY_WRITE);
4518 			if (error)
4519 				return error;
4520 		}
4521 		if ((flags & RENAME_EXCHANGE) && new_is_dir) {
4522 			error = inode_permission2(mnt, target, MAY_WRITE);
4523 			if (error)
4524 				return error;
4525 		}
4526 	}
4527 
4528 	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
4529 				      flags);
4530 	if (error)
4531 		return error;
4532 
4533 	take_dentry_name_snapshot(&old_name, old_dentry);
4534 	dget(new_dentry);
4535 	if (!is_dir || (flags & RENAME_EXCHANGE))
4536 		lock_two_nondirectories(source, target);
4537 	else if (target)
4538 		inode_lock(target);
4539 
4540 	error = -EBUSY;
4541 	if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
4542 		goto out;
4543 
4544 	if (max_links && new_dir != old_dir) {
4545 		error = -EMLINK;
4546 		if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
4547 			goto out;
4548 		if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
4549 		    old_dir->i_nlink >= max_links)
4550 			goto out;
4551 	}
4552 	if (is_dir && !(flags & RENAME_EXCHANGE) && target)
4553 		shrink_dcache_parent(new_dentry);
4554 	if (!is_dir) {
4555 		error = try_break_deleg(source, delegated_inode);
4556 		if (error)
4557 			goto out;
4558 	}
4559 	if (target && !new_is_dir) {
4560 		error = try_break_deleg(target, delegated_inode);
4561 		if (error)
4562 			goto out;
4563 	}
4564 	error = old_dir->i_op->rename(old_dir, old_dentry,
4565 				       new_dir, new_dentry, flags);
4566 	if (error)
4567 		goto out;
4568 
4569 	if (!(flags & RENAME_EXCHANGE) && target) {
4570 		if (is_dir)
4571 			target->i_flags |= S_DEAD;
4572 		dont_mount(new_dentry);
4573 		detach_mounts(new_dentry);
4574 	}
4575 	if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
4576 		if (!(flags & RENAME_EXCHANGE))
4577 			d_move(old_dentry, new_dentry);
4578 		else
4579 			d_exchange(old_dentry, new_dentry);
4580 	}
4581 out:
4582 	if (!is_dir || (flags & RENAME_EXCHANGE))
4583 		unlock_two_nondirectories(source, target);
4584 	else if (target)
4585 		inode_unlock(target);
4586 	dput(new_dentry);
4587 	if (!error) {
4588 		fsnotify_move(old_dir, new_dir, old_name.name, is_dir,
4589 			      !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
4590 		if (flags & RENAME_EXCHANGE) {
4591 			fsnotify_move(new_dir, old_dir, old_dentry->d_name.name,
4592 				      new_is_dir, NULL, new_dentry);
4593 		}
4594 	}
4595 	release_dentry_name_snapshot(&old_name);
4596 
4597 	return error;
4598 }
4599 EXPORT_SYMBOL(vfs_rename2);
4600 
vfs_rename(struct inode * old_dir,struct dentry * old_dentry,struct inode * new_dir,struct dentry * new_dentry,struct inode ** delegated_inode,unsigned int flags)4601 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
4602 	       struct inode *new_dir, struct dentry *new_dentry,
4603 	       struct inode **delegated_inode, unsigned int flags)
4604 {
4605 	return vfs_rename2(NULL, old_dir, old_dentry, new_dir, new_dentry, delegated_inode, flags);
4606 }
4607 EXPORT_SYMBOL(vfs_rename);
4608 
SYSCALL_DEFINE5(renameat2,int,olddfd,const char __user *,oldname,int,newdfd,const char __user *,newname,unsigned int,flags)4609 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
4610 		int, newdfd, const char __user *, newname, unsigned int, flags)
4611 {
4612 	struct dentry *old_dentry, *new_dentry;
4613 	struct dentry *trap;
4614 	struct path old_path, new_path;
4615 	struct qstr old_last, new_last;
4616 	int old_type, new_type;
4617 	struct inode *delegated_inode = NULL;
4618 	struct filename *from;
4619 	struct filename *to;
4620 	unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
4621 	bool should_retry = false;
4622 	int error;
4623 
4624 	if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
4625 		return -EINVAL;
4626 
4627 	if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
4628 	    (flags & RENAME_EXCHANGE))
4629 		return -EINVAL;
4630 
4631 	if ((flags & RENAME_WHITEOUT) && !capable(CAP_MKNOD))
4632 		return -EPERM;
4633 
4634 	if (flags & RENAME_EXCHANGE)
4635 		target_flags = 0;
4636 
4637 retry:
4638 	from = filename_parentat(olddfd, getname(oldname), lookup_flags,
4639 				&old_path, &old_last, &old_type);
4640 	if (IS_ERR(from)) {
4641 		error = PTR_ERR(from);
4642 		goto exit;
4643 	}
4644 
4645 	to = filename_parentat(newdfd, getname(newname), lookup_flags,
4646 				&new_path, &new_last, &new_type);
4647 	if (IS_ERR(to)) {
4648 		error = PTR_ERR(to);
4649 		goto exit1;
4650 	}
4651 
4652 	error = -EXDEV;
4653 	if (old_path.mnt != new_path.mnt)
4654 		goto exit2;
4655 
4656 	error = -EBUSY;
4657 	if (old_type != LAST_NORM)
4658 		goto exit2;
4659 
4660 	if (flags & RENAME_NOREPLACE)
4661 		error = -EEXIST;
4662 	if (new_type != LAST_NORM)
4663 		goto exit2;
4664 
4665 	error = mnt_want_write(old_path.mnt);
4666 	if (error)
4667 		goto exit2;
4668 
4669 retry_deleg:
4670 	trap = lock_rename(new_path.dentry, old_path.dentry);
4671 
4672 	old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags);
4673 	error = PTR_ERR(old_dentry);
4674 	if (IS_ERR(old_dentry))
4675 		goto exit3;
4676 	/* source must exist */
4677 	error = -ENOENT;
4678 	if (d_is_negative(old_dentry))
4679 		goto exit4;
4680 	new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags);
4681 	error = PTR_ERR(new_dentry);
4682 	if (IS_ERR(new_dentry))
4683 		goto exit4;
4684 	error = -EEXIST;
4685 	if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
4686 		goto exit5;
4687 	if (flags & RENAME_EXCHANGE) {
4688 		error = -ENOENT;
4689 		if (d_is_negative(new_dentry))
4690 			goto exit5;
4691 
4692 		if (!d_is_dir(new_dentry)) {
4693 			error = -ENOTDIR;
4694 			if (new_last.name[new_last.len])
4695 				goto exit5;
4696 		}
4697 	}
4698 	/* unless the source is a directory trailing slashes give -ENOTDIR */
4699 	if (!d_is_dir(old_dentry)) {
4700 		error = -ENOTDIR;
4701 		if (old_last.name[old_last.len])
4702 			goto exit5;
4703 		if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
4704 			goto exit5;
4705 	}
4706 	/* source should not be ancestor of target */
4707 	error = -EINVAL;
4708 	if (old_dentry == trap)
4709 		goto exit5;
4710 	/* target should not be an ancestor of source */
4711 	if (!(flags & RENAME_EXCHANGE))
4712 		error = -ENOTEMPTY;
4713 	if (new_dentry == trap)
4714 		goto exit5;
4715 
4716 	error = security_path_rename(&old_path, old_dentry,
4717 				     &new_path, new_dentry, flags);
4718 	if (error)
4719 		goto exit5;
4720 	error = vfs_rename2(old_path.mnt, old_path.dentry->d_inode, old_dentry,
4721 			   new_path.dentry->d_inode, new_dentry,
4722 			   &delegated_inode, flags);
4723 exit5:
4724 	dput(new_dentry);
4725 exit4:
4726 	dput(old_dentry);
4727 exit3:
4728 	unlock_rename(new_path.dentry, old_path.dentry);
4729 	if (delegated_inode) {
4730 		error = break_deleg_wait(&delegated_inode);
4731 		if (!error)
4732 			goto retry_deleg;
4733 	}
4734 	mnt_drop_write(old_path.mnt);
4735 exit2:
4736 	if (retry_estale(error, lookup_flags))
4737 		should_retry = true;
4738 	path_put(&new_path);
4739 	putname(to);
4740 exit1:
4741 	path_put(&old_path);
4742 	putname(from);
4743 	if (should_retry) {
4744 		should_retry = false;
4745 		lookup_flags |= LOOKUP_REVAL;
4746 		goto retry;
4747 	}
4748 exit:
4749 	return error;
4750 }
4751 
SYSCALL_DEFINE4(renameat,int,olddfd,const char __user *,oldname,int,newdfd,const char __user *,newname)4752 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
4753 		int, newdfd, const char __user *, newname)
4754 {
4755 	return sys_renameat2(olddfd, oldname, newdfd, newname, 0);
4756 }
4757 
SYSCALL_DEFINE2(rename,const char __user *,oldname,const char __user *,newname)4758 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
4759 {
4760 	return sys_renameat2(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
4761 }
4762 
vfs_whiteout(struct inode * dir,struct dentry * dentry)4763 int vfs_whiteout(struct inode *dir, struct dentry *dentry)
4764 {
4765 	int error = may_create(NULL, dir, dentry);
4766 	if (error)
4767 		return error;
4768 
4769 	if (!dir->i_op->mknod)
4770 		return -EPERM;
4771 
4772 	return dir->i_op->mknod(dir, dentry,
4773 				S_IFCHR | WHITEOUT_MODE, WHITEOUT_DEV);
4774 }
4775 EXPORT_SYMBOL(vfs_whiteout);
4776 
readlink_copy(char __user * buffer,int buflen,const char * link)4777 int readlink_copy(char __user *buffer, int buflen, const char *link)
4778 {
4779 	int len = PTR_ERR(link);
4780 	if (IS_ERR(link))
4781 		goto out;
4782 
4783 	len = strlen(link);
4784 	if (len > (unsigned) buflen)
4785 		len = buflen;
4786 	if (copy_to_user(buffer, link, len))
4787 		len = -EFAULT;
4788 out:
4789 	return len;
4790 }
4791 
4792 /*
4793  * A helper for ->readlink().  This should be used *ONLY* for symlinks that
4794  * have ->get_link() not calling nd_jump_link().  Using (or not using) it
4795  * for any given inode is up to filesystem.
4796  */
generic_readlink(struct dentry * dentry,char __user * buffer,int buflen)4797 static int generic_readlink(struct dentry *dentry, char __user *buffer,
4798 			    int buflen)
4799 {
4800 	DEFINE_DELAYED_CALL(done);
4801 	struct inode *inode = d_inode(dentry);
4802 	const char *link = inode->i_link;
4803 	int res;
4804 
4805 	if (!link) {
4806 		link = inode->i_op->get_link(dentry, inode, &done);
4807 		if (IS_ERR(link))
4808 			return PTR_ERR(link);
4809 	}
4810 	res = readlink_copy(buffer, buflen, link);
4811 	do_delayed_call(&done);
4812 	return res;
4813 }
4814 
4815 /**
4816  * vfs_readlink - copy symlink body into userspace buffer
4817  * @dentry: dentry on which to get symbolic link
4818  * @buffer: user memory pointer
4819  * @buflen: size of buffer
4820  *
4821  * Does not touch atime.  That's up to the caller if necessary
4822  *
4823  * Does not call security hook.
4824  */
vfs_readlink(struct dentry * dentry,char __user * buffer,int buflen)4825 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4826 {
4827 	struct inode *inode = d_inode(dentry);
4828 
4829 	if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) {
4830 		if (unlikely(inode->i_op->readlink))
4831 			return inode->i_op->readlink(dentry, buffer, buflen);
4832 
4833 		if (!d_is_symlink(dentry))
4834 			return -EINVAL;
4835 
4836 		spin_lock(&inode->i_lock);
4837 		inode->i_opflags |= IOP_DEFAULT_READLINK;
4838 		spin_unlock(&inode->i_lock);
4839 	}
4840 
4841 	return generic_readlink(dentry, buffer, buflen);
4842 }
4843 EXPORT_SYMBOL(vfs_readlink);
4844 
4845 /**
4846  * vfs_get_link - get symlink body
4847  * @dentry: dentry on which to get symbolic link
4848  * @done: caller needs to free returned data with this
4849  *
4850  * Calls security hook and i_op->get_link() on the supplied inode.
4851  *
4852  * It does not touch atime.  That's up to the caller if necessary.
4853  *
4854  * Does not work on "special" symlinks like /proc/$$/fd/N
4855  */
vfs_get_link(struct dentry * dentry,struct delayed_call * done)4856 const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
4857 {
4858 	const char *res = ERR_PTR(-EINVAL);
4859 	struct inode *inode = d_inode(dentry);
4860 
4861 	if (d_is_symlink(dentry)) {
4862 		res = ERR_PTR(security_inode_readlink(dentry));
4863 		if (!res)
4864 			res = inode->i_op->get_link(dentry, inode, done);
4865 	}
4866 	return res;
4867 }
4868 EXPORT_SYMBOL(vfs_get_link);
4869 
4870 /* get the link contents into pagecache */
page_get_link(struct dentry * dentry,struct inode * inode,struct delayed_call * callback)4871 const char *page_get_link(struct dentry *dentry, struct inode *inode,
4872 			  struct delayed_call *callback)
4873 {
4874 	char *kaddr;
4875 	struct page *page;
4876 	struct address_space *mapping = inode->i_mapping;
4877 
4878 	if (!dentry) {
4879 		page = find_get_page(mapping, 0);
4880 		if (!page)
4881 			return ERR_PTR(-ECHILD);
4882 		if (!PageUptodate(page)) {
4883 			put_page(page);
4884 			return ERR_PTR(-ECHILD);
4885 		}
4886 	} else {
4887 		page = read_mapping_page(mapping, 0, NULL);
4888 		if (IS_ERR(page))
4889 			return (char*)page;
4890 	}
4891 	set_delayed_call(callback, page_put_link, page);
4892 	BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
4893 	kaddr = page_address(page);
4894 	nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
4895 	return kaddr;
4896 }
4897 
4898 EXPORT_SYMBOL(page_get_link);
4899 
page_put_link(void * arg)4900 void page_put_link(void *arg)
4901 {
4902 	put_page(arg);
4903 }
4904 EXPORT_SYMBOL(page_put_link);
4905 
page_readlink(struct dentry * dentry,char __user * buffer,int buflen)4906 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
4907 {
4908 	DEFINE_DELAYED_CALL(done);
4909 	int res = readlink_copy(buffer, buflen,
4910 				page_get_link(dentry, d_inode(dentry),
4911 					      &done));
4912 	do_delayed_call(&done);
4913 	return res;
4914 }
4915 EXPORT_SYMBOL(page_readlink);
4916 
4917 /*
4918  * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
4919  */
__page_symlink(struct inode * inode,const char * symname,int len,int nofs)4920 int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
4921 {
4922 	struct address_space *mapping = inode->i_mapping;
4923 	struct page *page;
4924 	void *fsdata;
4925 	int err;
4926 	unsigned int flags = 0;
4927 	if (nofs)
4928 		flags |= AOP_FLAG_NOFS;
4929 
4930 retry:
4931 	err = pagecache_write_begin(NULL, mapping, 0, len-1,
4932 				flags, &page, &fsdata);
4933 	if (err)
4934 		goto fail;
4935 
4936 	memcpy(page_address(page), symname, len-1);
4937 
4938 	err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
4939 							page, fsdata);
4940 	if (err < 0)
4941 		goto fail;
4942 	if (err < len-1)
4943 		goto retry;
4944 
4945 	mark_inode_dirty(inode);
4946 	return 0;
4947 fail:
4948 	return err;
4949 }
4950 EXPORT_SYMBOL(__page_symlink);
4951 
page_symlink(struct inode * inode,const char * symname,int len)4952 int page_symlink(struct inode *inode, const char *symname, int len)
4953 {
4954 	return __page_symlink(inode, symname, len,
4955 			!mapping_gfp_constraint(inode->i_mapping, __GFP_FS));
4956 }
4957 EXPORT_SYMBOL(page_symlink);
4958 
4959 const struct inode_operations page_symlink_inode_operations = {
4960 	.get_link	= page_get_link,
4961 };
4962 EXPORT_SYMBOL(page_symlink_inode_operations);
4963