1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  *  linux/fs/namei.c
4  *
5  *  Copyright (C) 1991, 1992  Linus Torvalds
6  */
7 
8 /*
9  * Some corrections by tytso.
10  */
11 
12 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
13  * lookup logic.
14  */
15 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
16  */
17 
18 #include <linux/init.h>
19 #include <linux/export.h>
20 #include <linux/kernel.h>
21 #include <linux/slab.h>
22 #include <linux/fs.h>
23 #include <linux/namei.h>
24 #include <linux/pagemap.h>
25 #include <linux/sched/mm.h>
26 #include <linux/fsnotify.h>
27 #include <linux/personality.h>
28 #include <linux/security.h>
29 #include <linux/ima.h>
30 #include <linux/syscalls.h>
31 #include <linux/mount.h>
32 #include <linux/audit.h>
33 #include <linux/capability.h>
34 #include <linux/file.h>
35 #include <linux/fcntl.h>
36 #include <linux/device_cgroup.h>
37 #include <linux/fs_struct.h>
38 #include <linux/posix_acl.h>
39 #include <linux/hash.h>
40 #include <linux/bitops.h>
41 #include <linux/init_task.h>
42 #include <linux/uaccess.h>
43 
44 #include "internal.h"
45 #include "mount.h"
46 
47 /* [Feb-1997 T. Schoebel-Theuer]
48  * Fundamental changes in the pathname lookup mechanisms (namei)
49  * were necessary because of omirr.  The reason is that omirr needs
50  * to know the _real_ pathname, not the user-supplied one, in case
51  * of symlinks (and also when transname replacements occur).
52  *
53  * The new code replaces the old recursive symlink resolution with
54  * an iterative one (in case of non-nested symlink chains).  It does
55  * this with calls to <fs>_follow_link().
56  * As a side effect, dir_namei(), _namei() and follow_link() are now
57  * replaced with a single function lookup_dentry() that can handle all
58  * the special cases of the former code.
59  *
60  * With the new dcache, the pathname is stored at each inode, at least as
61  * long as the refcount of the inode is positive.  As a side effect, the
62  * size of the dcache depends on the inode cache and thus is dynamic.
63  *
64  * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
65  * resolution to correspond with current state of the code.
66  *
67  * Note that the symlink resolution is not *completely* iterative.
68  * There is still a significant amount of tail- and mid- recursion in
69  * the algorithm.  Also, note that <fs>_readlink() is not used in
70  * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
71  * may return different results than <fs>_follow_link().  Many virtual
72  * filesystems (including /proc) exhibit this behavior.
73  */
74 
75 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
76  * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
77  * and the name already exists in form of a symlink, try to create the new
78  * name indicated by the symlink. The old code always complained that the
79  * name already exists, due to not following the symlink even if its target
80  * is nonexistent.  The new semantics affects also mknod() and link() when
81  * the name is a symlink pointing to a non-existent name.
82  *
83  * I don't know which semantics is the right one, since I have no access
84  * to standards. But I found by trial that HP-UX 9.0 has the full "new"
85  * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
86  * "old" one. Personally, I think the new semantics is much more logical.
87  * Note that "ln old new" where "new" is a symlink pointing to a non-existing
88  * file does succeed in both HP-UX and SunOs, but not in Solaris
89  * and in the old Linux semantics.
90  */
91 
92 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
93  * semantics.  See the comments in "open_namei" and "do_link" below.
94  *
95  * [10-Sep-98 Alan Modra] Another symlink change.
96  */
97 
98 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
99  *	inside the path - always follow.
100  *	in the last component in creation/removal/renaming - never follow.
101  *	if LOOKUP_FOLLOW passed - follow.
102  *	if the pathname has trailing slashes - follow.
103  *	otherwise - don't follow.
104  * (applied in that order).
105  *
106  * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
107  * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
108  * During the 2.4 we need to fix the userland stuff depending on it -
109  * hopefully we will be able to get rid of that wart in 2.5. So far only
110  * XEmacs seems to be relying on it...
111  */
112 /*
113  * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
114  * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
115  * any extra contention...
116  */
117 
118 /* In order to reduce some races, while at the same time doing additional
119  * checking and hopefully speeding things up, we copy filenames to the
120  * kernel data space before using them..
121  *
122  * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
123  * PATH_MAX includes the nul terminator --RR.
124  */
125 
126 #define EMBEDDED_NAME_MAX	(PATH_MAX - offsetof(struct filename, iname))
127 
128 struct filename *
getname_flags(const char __user * filename,int flags,int * empty)129 getname_flags(const char __user *filename, int flags, int *empty)
130 {
131 	struct filename *result;
132 	char *kname;
133 	int len;
134 
135 	result = audit_reusename(filename);
136 	if (result)
137 		return result;
138 
139 	result = __getname();
140 	if (unlikely(!result))
141 		return ERR_PTR(-ENOMEM);
142 
143 	/*
144 	 * First, try to embed the struct filename inside the names_cache
145 	 * allocation
146 	 */
147 	kname = (char *)result->iname;
148 	result->name = kname;
149 
150 	len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
151 	if (unlikely(len < 0)) {
152 		__putname(result);
153 		return ERR_PTR(len);
154 	}
155 
156 	/*
157 	 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
158 	 * separate struct filename so we can dedicate the entire
159 	 * names_cache allocation for the pathname, and re-do the copy from
160 	 * userland.
161 	 */
162 	if (unlikely(len == EMBEDDED_NAME_MAX)) {
163 		const size_t size = offsetof(struct filename, iname[1]);
164 		kname = (char *)result;
165 
166 		/*
167 		 * size is chosen that way we to guarantee that
168 		 * result->iname[0] is within the same object and that
169 		 * kname can't be equal to result->iname, no matter what.
170 		 */
171 		result = kzalloc(size, GFP_KERNEL);
172 		if (unlikely(!result)) {
173 			__putname(kname);
174 			return ERR_PTR(-ENOMEM);
175 		}
176 		result->name = kname;
177 		len = strncpy_from_user(kname, filename, PATH_MAX);
178 		if (unlikely(len < 0)) {
179 			__putname(kname);
180 			kfree(result);
181 			return ERR_PTR(len);
182 		}
183 		if (unlikely(len == PATH_MAX)) {
184 			__putname(kname);
185 			kfree(result);
186 			return ERR_PTR(-ENAMETOOLONG);
187 		}
188 	}
189 
190 	result->refcnt = 1;
191 	/* The empty path is special. */
192 	if (unlikely(!len)) {
193 		if (empty)
194 			*empty = 1;
195 		if (!(flags & LOOKUP_EMPTY)) {
196 			putname(result);
197 			return ERR_PTR(-ENOENT);
198 		}
199 	}
200 
201 	result->uptr = filename;
202 	result->aname = NULL;
203 	audit_getname(result);
204 	return result;
205 }
206 
207 struct filename *
getname_uflags(const char __user * filename,int uflags)208 getname_uflags(const char __user *filename, int uflags)
209 {
210 	int flags = (uflags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0;
211 
212 	return getname_flags(filename, flags, NULL);
213 }
214 
215 struct filename *
getname(const char __user * filename)216 getname(const char __user * filename)
217 {
218 	return getname_flags(filename, 0, NULL);
219 }
220 
221 struct filename *
getname_kernel(const char * filename)222 getname_kernel(const char * filename)
223 {
224 	struct filename *result;
225 	int len = strlen(filename) + 1;
226 
227 	result = __getname();
228 	if (unlikely(!result))
229 		return ERR_PTR(-ENOMEM);
230 
231 	if (len <= EMBEDDED_NAME_MAX) {
232 		result->name = (char *)result->iname;
233 	} else if (len <= PATH_MAX) {
234 		const size_t size = offsetof(struct filename, iname[1]);
235 		struct filename *tmp;
236 
237 		tmp = kmalloc(size, GFP_KERNEL);
238 		if (unlikely(!tmp)) {
239 			__putname(result);
240 			return ERR_PTR(-ENOMEM);
241 		}
242 		tmp->name = (char *)result;
243 		result = tmp;
244 	} else {
245 		__putname(result);
246 		return ERR_PTR(-ENAMETOOLONG);
247 	}
248 	memcpy((char *)result->name, filename, len);
249 	result->uptr = NULL;
250 	result->aname = NULL;
251 	result->refcnt = 1;
252 	audit_getname(result);
253 
254 	return result;
255 }
256 
putname(struct filename * name)257 void putname(struct filename *name)
258 {
259 	if (IS_ERR(name))
260 		return;
261 
262 	BUG_ON(name->refcnt <= 0);
263 
264 	if (--name->refcnt > 0)
265 		return;
266 
267 	if (name->name != name->iname) {
268 		__putname(name->name);
269 		kfree(name);
270 	} else
271 		__putname(name);
272 }
273 
274 /**
275  * check_acl - perform ACL permission checking
276  * @mnt_userns:	user namespace of the mount the inode was found from
277  * @inode:	inode to check permissions on
278  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...)
279  *
280  * This function performs the ACL permission checking. Since this function
281  * retrieve POSIX acls it needs to know whether it is called from a blocking or
282  * non-blocking context and thus cares about the MAY_NOT_BLOCK bit.
283  *
284  * If the inode has been found through an idmapped mount the user namespace of
285  * the vfsmount must be passed through @mnt_userns. This function will then take
286  * care to map the inode according to @mnt_userns before checking permissions.
287  * On non-idmapped mounts or if permission checking is to be performed on the
288  * raw inode simply passs init_user_ns.
289  */
check_acl(struct user_namespace * mnt_userns,struct inode * inode,int mask)290 static int check_acl(struct user_namespace *mnt_userns,
291 		     struct inode *inode, int mask)
292 {
293 #ifdef CONFIG_FS_POSIX_ACL
294 	struct posix_acl *acl;
295 
296 	if (mask & MAY_NOT_BLOCK) {
297 		acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
298 	        if (!acl)
299 	                return -EAGAIN;
300 		/* no ->get_acl() calls in RCU mode... */
301 		if (is_uncached_acl(acl))
302 			return -ECHILD;
303 	        return posix_acl_permission(mnt_userns, inode, acl, mask);
304 	}
305 
306 	acl = get_acl(inode, ACL_TYPE_ACCESS);
307 	if (IS_ERR(acl))
308 		return PTR_ERR(acl);
309 	if (acl) {
310 	        int error = posix_acl_permission(mnt_userns, inode, acl, mask);
311 	        posix_acl_release(acl);
312 	        return error;
313 	}
314 #endif
315 
316 	return -EAGAIN;
317 }
318 
319 /**
320  * acl_permission_check - perform basic UNIX permission checking
321  * @mnt_userns:	user namespace of the mount the inode was found from
322  * @inode:	inode to check permissions on
323  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...)
324  *
325  * This function performs the basic UNIX permission checking. Since this
326  * function may retrieve POSIX acls it needs to know whether it is called from a
327  * blocking or non-blocking context and thus cares about the MAY_NOT_BLOCK bit.
328  *
329  * If the inode has been found through an idmapped mount the user namespace of
330  * the vfsmount must be passed through @mnt_userns. This function will then take
331  * care to map the inode according to @mnt_userns before checking permissions.
332  * On non-idmapped mounts or if permission checking is to be performed on the
333  * raw inode simply passs init_user_ns.
334  */
acl_permission_check(struct user_namespace * mnt_userns,struct inode * inode,int mask)335 static int acl_permission_check(struct user_namespace *mnt_userns,
336 				struct inode *inode, int mask)
337 {
338 	unsigned int mode = inode->i_mode;
339 	kuid_t i_uid;
340 
341 	/* Are we the owner? If so, ACL's don't matter */
342 	i_uid = i_uid_into_mnt(mnt_userns, inode);
343 	if (likely(uid_eq(current_fsuid(), i_uid))) {
344 		mask &= 7;
345 		mode >>= 6;
346 		return (mask & ~mode) ? -EACCES : 0;
347 	}
348 
349 	/* Do we have ACL's? */
350 	if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
351 		int error = check_acl(mnt_userns, inode, mask);
352 		if (error != -EAGAIN)
353 			return error;
354 	}
355 
356 	/* Only RWX matters for group/other mode bits */
357 	mask &= 7;
358 
359 	/*
360 	 * Are the group permissions different from
361 	 * the other permissions in the bits we care
362 	 * about? Need to check group ownership if so.
363 	 */
364 	if (mask & (mode ^ (mode >> 3))) {
365 		kgid_t kgid = i_gid_into_mnt(mnt_userns, inode);
366 		if (in_group_p(kgid))
367 			mode >>= 3;
368 	}
369 
370 	/* Bits in 'mode' clear that we require? */
371 	return (mask & ~mode) ? -EACCES : 0;
372 }
373 
374 /**
375  * generic_permission -  check for access rights on a Posix-like filesystem
376  * @mnt_userns:	user namespace of the mount the inode was found from
377  * @inode:	inode to check access rights for
378  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC,
379  *		%MAY_NOT_BLOCK ...)
380  *
381  * Used to check for read/write/execute permissions on a file.
382  * We use "fsuid" for this, letting us set arbitrary permissions
383  * for filesystem access without changing the "normal" uids which
384  * are used for other things.
385  *
386  * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
387  * request cannot be satisfied (eg. requires blocking or too much complexity).
388  * It would then be called again in ref-walk mode.
389  *
390  * If the inode has been found through an idmapped mount the user namespace of
391  * the vfsmount must be passed through @mnt_userns. This function will then take
392  * care to map the inode according to @mnt_userns before checking permissions.
393  * On non-idmapped mounts or if permission checking is to be performed on the
394  * raw inode simply passs init_user_ns.
395  */
generic_permission(struct user_namespace * mnt_userns,struct inode * inode,int mask)396 int generic_permission(struct user_namespace *mnt_userns, struct inode *inode,
397 		       int mask)
398 {
399 	int ret;
400 
401 	/*
402 	 * Do the basic permission checks.
403 	 */
404 	ret = acl_permission_check(mnt_userns, inode, mask);
405 	if (ret != -EACCES)
406 		return ret;
407 
408 	if (S_ISDIR(inode->i_mode)) {
409 		/* DACs are overridable for directories */
410 		if (!(mask & MAY_WRITE))
411 			if (capable_wrt_inode_uidgid(mnt_userns, inode,
412 						     CAP_DAC_READ_SEARCH))
413 				return 0;
414 		if (capable_wrt_inode_uidgid(mnt_userns, inode,
415 					     CAP_DAC_OVERRIDE))
416 			return 0;
417 		return -EACCES;
418 	}
419 
420 	/*
421 	 * Searching includes executable on directories, else just read.
422 	 */
423 	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
424 	if (mask == MAY_READ)
425 		if (capable_wrt_inode_uidgid(mnt_userns, inode,
426 					     CAP_DAC_READ_SEARCH))
427 			return 0;
428 	/*
429 	 * Read/write DACs are always overridable.
430 	 * Executable DACs are overridable when there is
431 	 * at least one exec bit set.
432 	 */
433 	if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
434 		if (capable_wrt_inode_uidgid(mnt_userns, inode,
435 					     CAP_DAC_OVERRIDE))
436 			return 0;
437 
438 	return -EACCES;
439 }
440 EXPORT_SYMBOL(generic_permission);
441 
442 /**
443  * do_inode_permission - UNIX permission checking
444  * @mnt_userns:	user namespace of the mount the inode was found from
445  * @inode:	inode to check permissions on
446  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...)
447  *
448  * We _really_ want to just do "generic_permission()" without
449  * even looking at the inode->i_op values. So we keep a cache
450  * flag in inode->i_opflags, that says "this has not special
451  * permission function, use the fast case".
452  */
do_inode_permission(struct user_namespace * mnt_userns,struct inode * inode,int mask)453 static inline int do_inode_permission(struct user_namespace *mnt_userns,
454 				      struct inode *inode, int mask)
455 {
456 	if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
457 		if (likely(inode->i_op->permission))
458 			return inode->i_op->permission(mnt_userns, inode, mask);
459 
460 		/* This gets set once for the inode lifetime */
461 		spin_lock(&inode->i_lock);
462 		inode->i_opflags |= IOP_FASTPERM;
463 		spin_unlock(&inode->i_lock);
464 	}
465 	return generic_permission(mnt_userns, inode, mask);
466 }
467 
468 /**
469  * sb_permission - Check superblock-level permissions
470  * @sb: Superblock of inode to check permission on
471  * @inode: Inode to check permission on
472  * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
473  *
474  * Separate out file-system wide checks from inode-specific permission checks.
475  */
sb_permission(struct super_block * sb,struct inode * inode,int mask)476 static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
477 {
478 	if (unlikely(mask & MAY_WRITE)) {
479 		umode_t mode = inode->i_mode;
480 
481 		/* Nobody gets write access to a read-only fs. */
482 		if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
483 			return -EROFS;
484 	}
485 	return 0;
486 }
487 
488 /**
489  * inode_permission - Check for access rights to a given inode
490  * @mnt_userns:	User namespace of the mount the inode was found from
491  * @inode:	Inode to check permission on
492  * @mask:	Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
493  *
494  * Check for read/write/execute permissions on an inode.  We use fs[ug]id for
495  * this, letting us set arbitrary permissions for filesystem access without
496  * changing the "normal" UIDs which are used for other things.
497  *
498  * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
499  */
inode_permission(struct user_namespace * mnt_userns,struct inode * inode,int mask)500 int inode_permission(struct user_namespace *mnt_userns,
501 		     struct inode *inode, int mask)
502 {
503 	int retval;
504 
505 	retval = sb_permission(inode->i_sb, inode, mask);
506 	if (retval)
507 		return retval;
508 
509 	if (unlikely(mask & MAY_WRITE)) {
510 		/*
511 		 * Nobody gets write access to an immutable file.
512 		 */
513 		if (IS_IMMUTABLE(inode))
514 			return -EPERM;
515 
516 		/*
517 		 * Updating mtime will likely cause i_uid and i_gid to be
518 		 * written back improperly if their true value is unknown
519 		 * to the vfs.
520 		 */
521 		if (HAS_UNMAPPED_ID(mnt_userns, inode))
522 			return -EACCES;
523 	}
524 
525 	retval = do_inode_permission(mnt_userns, inode, mask);
526 	if (retval)
527 		return retval;
528 
529 	retval = devcgroup_inode_permission(inode, mask);
530 	if (retval)
531 		return retval;
532 
533 	return security_inode_permission(inode, mask);
534 }
535 EXPORT_SYMBOL(inode_permission);
536 
537 /**
538  * path_get - get a reference to a path
539  * @path: path to get the reference to
540  *
541  * Given a path increment the reference count to the dentry and the vfsmount.
542  */
path_get(const struct path * path)543 void path_get(const struct path *path)
544 {
545 	mntget(path->mnt);
546 	dget(path->dentry);
547 }
548 EXPORT_SYMBOL(path_get);
549 
550 /**
551  * path_put - put a reference to a path
552  * @path: path to put the reference to
553  *
554  * Given a path decrement the reference count to the dentry and the vfsmount.
555  */
path_put(const struct path * path)556 void path_put(const struct path *path)
557 {
558 	dput(path->dentry);
559 	mntput(path->mnt);
560 }
561 EXPORT_SYMBOL(path_put);
562 
563 #define EMBEDDED_LEVELS 2
564 struct nameidata {
565 	struct path	path;
566 	struct qstr	last;
567 	struct path	root;
568 	struct inode	*inode; /* path.dentry.d_inode */
569 	unsigned int	flags, state;
570 	unsigned	seq, next_seq, m_seq, r_seq;
571 	int		last_type;
572 	unsigned	depth;
573 	int		total_link_count;
574 	struct saved {
575 		struct path link;
576 		struct delayed_call done;
577 		const char *name;
578 		unsigned seq;
579 	} *stack, internal[EMBEDDED_LEVELS];
580 	struct filename	*name;
581 	struct nameidata *saved;
582 	unsigned	root_seq;
583 	int		dfd;
584 	kuid_t		dir_uid;
585 	umode_t		dir_mode;
586 } __randomize_layout;
587 
588 #define ND_ROOT_PRESET 1
589 #define ND_ROOT_GRABBED 2
590 #define ND_JUMPED 4
591 
__set_nameidata(struct nameidata * p,int dfd,struct filename * name)592 static void __set_nameidata(struct nameidata *p, int dfd, struct filename *name)
593 {
594 	struct nameidata *old = current->nameidata;
595 	p->stack = p->internal;
596 	p->depth = 0;
597 	p->dfd = dfd;
598 	p->name = name;
599 	p->path.mnt = NULL;
600 	p->path.dentry = NULL;
601 	p->total_link_count = old ? old->total_link_count : 0;
602 	p->saved = old;
603 	current->nameidata = p;
604 }
605 
set_nameidata(struct nameidata * p,int dfd,struct filename * name,const struct path * root)606 static inline void set_nameidata(struct nameidata *p, int dfd, struct filename *name,
607 			  const struct path *root)
608 {
609 	__set_nameidata(p, dfd, name);
610 	p->state = 0;
611 	if (unlikely(root)) {
612 		p->state = ND_ROOT_PRESET;
613 		p->root = *root;
614 	}
615 }
616 
restore_nameidata(void)617 static void restore_nameidata(void)
618 {
619 	struct nameidata *now = current->nameidata, *old = now->saved;
620 
621 	current->nameidata = old;
622 	if (old)
623 		old->total_link_count = now->total_link_count;
624 	if (now->stack != now->internal)
625 		kfree(now->stack);
626 }
627 
nd_alloc_stack(struct nameidata * nd)628 static bool nd_alloc_stack(struct nameidata *nd)
629 {
630 	struct saved *p;
631 
632 	p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
633 			 nd->flags & LOOKUP_RCU ? GFP_ATOMIC : GFP_KERNEL);
634 	if (unlikely(!p))
635 		return false;
636 	memcpy(p, nd->internal, sizeof(nd->internal));
637 	nd->stack = p;
638 	return true;
639 }
640 
641 /**
642  * path_connected - Verify that a dentry is below mnt.mnt_root
643  *
644  * Rename can sometimes move a file or directory outside of a bind
645  * mount, path_connected allows those cases to be detected.
646  */
path_connected(struct vfsmount * mnt,struct dentry * dentry)647 static bool path_connected(struct vfsmount *mnt, struct dentry *dentry)
648 {
649 	struct super_block *sb = mnt->mnt_sb;
650 
651 	/* Bind mounts can have disconnected paths */
652 	if (mnt->mnt_root == sb->s_root)
653 		return true;
654 
655 	return is_subdir(dentry, mnt->mnt_root);
656 }
657 
drop_links(struct nameidata * nd)658 static void drop_links(struct nameidata *nd)
659 {
660 	int i = nd->depth;
661 	while (i--) {
662 		struct saved *last = nd->stack + i;
663 		do_delayed_call(&last->done);
664 		clear_delayed_call(&last->done);
665 	}
666 }
667 
leave_rcu(struct nameidata * nd)668 static void leave_rcu(struct nameidata *nd)
669 {
670 	nd->flags &= ~LOOKUP_RCU;
671 	nd->seq = nd->next_seq = 0;
672 	rcu_read_unlock();
673 }
674 
terminate_walk(struct nameidata * nd)675 static void terminate_walk(struct nameidata *nd)
676 {
677 	drop_links(nd);
678 	if (!(nd->flags & LOOKUP_RCU)) {
679 		int i;
680 		path_put(&nd->path);
681 		for (i = 0; i < nd->depth; i++)
682 			path_put(&nd->stack[i].link);
683 		if (nd->state & ND_ROOT_GRABBED) {
684 			path_put(&nd->root);
685 			nd->state &= ~ND_ROOT_GRABBED;
686 		}
687 	} else {
688 		leave_rcu(nd);
689 	}
690 	nd->depth = 0;
691 	nd->path.mnt = NULL;
692 	nd->path.dentry = NULL;
693 }
694 
695 /* path_put is needed afterwards regardless of success or failure */
__legitimize_path(struct path * path,unsigned seq,unsigned mseq)696 static bool __legitimize_path(struct path *path, unsigned seq, unsigned mseq)
697 {
698 	int res = __legitimize_mnt(path->mnt, mseq);
699 	if (unlikely(res)) {
700 		if (res > 0)
701 			path->mnt = NULL;
702 		path->dentry = NULL;
703 		return false;
704 	}
705 	if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
706 		path->dentry = NULL;
707 		return false;
708 	}
709 	return !read_seqcount_retry(&path->dentry->d_seq, seq);
710 }
711 
legitimize_path(struct nameidata * nd,struct path * path,unsigned seq)712 static inline bool legitimize_path(struct nameidata *nd,
713 			    struct path *path, unsigned seq)
714 {
715 	return __legitimize_path(path, seq, nd->m_seq);
716 }
717 
legitimize_links(struct nameidata * nd)718 static bool legitimize_links(struct nameidata *nd)
719 {
720 	int i;
721 	if (unlikely(nd->flags & LOOKUP_CACHED)) {
722 		drop_links(nd);
723 		nd->depth = 0;
724 		return false;
725 	}
726 	for (i = 0; i < nd->depth; i++) {
727 		struct saved *last = nd->stack + i;
728 		if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
729 			drop_links(nd);
730 			nd->depth = i + 1;
731 			return false;
732 		}
733 	}
734 	return true;
735 }
736 
legitimize_root(struct nameidata * nd)737 static bool legitimize_root(struct nameidata *nd)
738 {
739 	/* Nothing to do if nd->root is zero or is managed by the VFS user. */
740 	if (!nd->root.mnt || (nd->state & ND_ROOT_PRESET))
741 		return true;
742 	nd->state |= ND_ROOT_GRABBED;
743 	return legitimize_path(nd, &nd->root, nd->root_seq);
744 }
745 
746 /*
747  * Path walking has 2 modes, rcu-walk and ref-walk (see
748  * Documentation/filesystems/path-lookup.txt).  In situations when we can't
749  * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
750  * normal reference counts on dentries and vfsmounts to transition to ref-walk
751  * mode.  Refcounts are grabbed at the last known good point before rcu-walk
752  * got stuck, so ref-walk may continue from there. If this is not successful
753  * (eg. a seqcount has changed), then failure is returned and it's up to caller
754  * to restart the path walk from the beginning in ref-walk mode.
755  */
756 
757 /**
758  * try_to_unlazy - try to switch to ref-walk mode.
759  * @nd: nameidata pathwalk data
760  * Returns: true on success, false on failure
761  *
762  * try_to_unlazy attempts to legitimize the current nd->path and nd->root
763  * for ref-walk mode.
764  * Must be called from rcu-walk context.
765  * Nothing should touch nameidata between try_to_unlazy() failure and
766  * terminate_walk().
767  */
try_to_unlazy(struct nameidata * nd)768 static bool try_to_unlazy(struct nameidata *nd)
769 {
770 	struct dentry *parent = nd->path.dentry;
771 
772 	BUG_ON(!(nd->flags & LOOKUP_RCU));
773 
774 	if (unlikely(!legitimize_links(nd)))
775 		goto out1;
776 	if (unlikely(!legitimize_path(nd, &nd->path, nd->seq)))
777 		goto out;
778 	if (unlikely(!legitimize_root(nd)))
779 		goto out;
780 	leave_rcu(nd);
781 	BUG_ON(nd->inode != parent->d_inode);
782 	return true;
783 
784 out1:
785 	nd->path.mnt = NULL;
786 	nd->path.dentry = NULL;
787 out:
788 	leave_rcu(nd);
789 	return false;
790 }
791 
792 /**
793  * try_to_unlazy_next - try to switch to ref-walk mode.
794  * @nd: nameidata pathwalk data
795  * @dentry: next dentry to step into
796  * Returns: true on success, false on failure
797  *
798  * Similar to try_to_unlazy(), but here we have the next dentry already
799  * picked by rcu-walk and want to legitimize that in addition to the current
800  * nd->path and nd->root for ref-walk mode.  Must be called from rcu-walk context.
801  * Nothing should touch nameidata between try_to_unlazy_next() failure and
802  * terminate_walk().
803  */
try_to_unlazy_next(struct nameidata * nd,struct dentry * dentry)804 static bool try_to_unlazy_next(struct nameidata *nd, struct dentry *dentry)
805 {
806 	int res;
807 	BUG_ON(!(nd->flags & LOOKUP_RCU));
808 
809 	if (unlikely(!legitimize_links(nd)))
810 		goto out2;
811 	res = __legitimize_mnt(nd->path.mnt, nd->m_seq);
812 	if (unlikely(res)) {
813 		if (res > 0)
814 			goto out2;
815 		goto out1;
816 	}
817 	if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref)))
818 		goto out1;
819 
820 	/*
821 	 * We need to move both the parent and the dentry from the RCU domain
822 	 * to be properly refcounted. And the sequence number in the dentry
823 	 * validates *both* dentry counters, since we checked the sequence
824 	 * number of the parent after we got the child sequence number. So we
825 	 * know the parent must still be valid if the child sequence number is
826 	 */
827 	if (unlikely(!lockref_get_not_dead(&dentry->d_lockref)))
828 		goto out;
829 	if (read_seqcount_retry(&dentry->d_seq, nd->next_seq))
830 		goto out_dput;
831 	/*
832 	 * Sequence counts matched. Now make sure that the root is
833 	 * still valid and get it if required.
834 	 */
835 	if (unlikely(!legitimize_root(nd)))
836 		goto out_dput;
837 	leave_rcu(nd);
838 	return true;
839 
840 out2:
841 	nd->path.mnt = NULL;
842 out1:
843 	nd->path.dentry = NULL;
844 out:
845 	leave_rcu(nd);
846 	return false;
847 out_dput:
848 	leave_rcu(nd);
849 	dput(dentry);
850 	return false;
851 }
852 
d_revalidate(struct dentry * dentry,unsigned int flags)853 static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
854 {
855 	if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
856 		return dentry->d_op->d_revalidate(dentry, flags);
857 	else
858 		return 1;
859 }
860 
861 /**
862  * complete_walk - successful completion of path walk
863  * @nd:  pointer nameidata
864  *
865  * If we had been in RCU mode, drop out of it and legitimize nd->path.
866  * Revalidate the final result, unless we'd already done that during
867  * the path walk or the filesystem doesn't ask for it.  Return 0 on
868  * success, -error on failure.  In case of failure caller does not
869  * need to drop nd->path.
870  */
complete_walk(struct nameidata * nd)871 static int complete_walk(struct nameidata *nd)
872 {
873 	struct dentry *dentry = nd->path.dentry;
874 	int status;
875 
876 	if (nd->flags & LOOKUP_RCU) {
877 		/*
878 		 * We don't want to zero nd->root for scoped-lookups or
879 		 * externally-managed nd->root.
880 		 */
881 		if (!(nd->state & ND_ROOT_PRESET))
882 			if (!(nd->flags & LOOKUP_IS_SCOPED))
883 				nd->root.mnt = NULL;
884 		nd->flags &= ~LOOKUP_CACHED;
885 		if (!try_to_unlazy(nd))
886 			return -ECHILD;
887 	}
888 
889 	if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
890 		/*
891 		 * While the guarantee of LOOKUP_IS_SCOPED is (roughly) "don't
892 		 * ever step outside the root during lookup" and should already
893 		 * be guaranteed by the rest of namei, we want to avoid a namei
894 		 * BUG resulting in userspace being given a path that was not
895 		 * scoped within the root at some point during the lookup.
896 		 *
897 		 * So, do a final sanity-check to make sure that in the
898 		 * worst-case scenario (a complete bypass of LOOKUP_IS_SCOPED)
899 		 * we won't silently return an fd completely outside of the
900 		 * requested root to userspace.
901 		 *
902 		 * Userspace could move the path outside the root after this
903 		 * check, but as discussed elsewhere this is not a concern (the
904 		 * resolved file was inside the root at some point).
905 		 */
906 		if (!path_is_under(&nd->path, &nd->root))
907 			return -EXDEV;
908 	}
909 
910 	if (likely(!(nd->state & ND_JUMPED)))
911 		return 0;
912 
913 	if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
914 		return 0;
915 
916 	status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
917 	if (status > 0)
918 		return 0;
919 
920 	if (!status)
921 		status = -ESTALE;
922 
923 	return status;
924 }
925 
set_root(struct nameidata * nd)926 static int set_root(struct nameidata *nd)
927 {
928 	struct fs_struct *fs = current->fs;
929 
930 	/*
931 	 * Jumping to the real root in a scoped-lookup is a BUG in namei, but we
932 	 * still have to ensure it doesn't happen because it will cause a breakout
933 	 * from the dirfd.
934 	 */
935 	if (WARN_ON(nd->flags & LOOKUP_IS_SCOPED))
936 		return -ENOTRECOVERABLE;
937 
938 	if (nd->flags & LOOKUP_RCU) {
939 		unsigned seq;
940 
941 		do {
942 			seq = read_seqcount_begin(&fs->seq);
943 			nd->root = fs->root;
944 			nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
945 		} while (read_seqcount_retry(&fs->seq, seq));
946 	} else {
947 		get_fs_root(fs, &nd->root);
948 		nd->state |= ND_ROOT_GRABBED;
949 	}
950 	return 0;
951 }
952 
nd_jump_root(struct nameidata * nd)953 static int nd_jump_root(struct nameidata *nd)
954 {
955 	if (unlikely(nd->flags & LOOKUP_BENEATH))
956 		return -EXDEV;
957 	if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
958 		/* Absolute path arguments to path_init() are allowed. */
959 		if (nd->path.mnt != NULL && nd->path.mnt != nd->root.mnt)
960 			return -EXDEV;
961 	}
962 	if (!nd->root.mnt) {
963 		int error = set_root(nd);
964 		if (error)
965 			return error;
966 	}
967 	if (nd->flags & LOOKUP_RCU) {
968 		struct dentry *d;
969 		nd->path = nd->root;
970 		d = nd->path.dentry;
971 		nd->inode = d->d_inode;
972 		nd->seq = nd->root_seq;
973 		if (read_seqcount_retry(&d->d_seq, nd->seq))
974 			return -ECHILD;
975 	} else {
976 		path_put(&nd->path);
977 		nd->path = nd->root;
978 		path_get(&nd->path);
979 		nd->inode = nd->path.dentry->d_inode;
980 	}
981 	nd->state |= ND_JUMPED;
982 	return 0;
983 }
984 
985 /*
986  * Helper to directly jump to a known parsed path from ->get_link,
987  * caller must have taken a reference to path beforehand.
988  */
nd_jump_link(const struct path * path)989 int nd_jump_link(const struct path *path)
990 {
991 	int error = -ELOOP;
992 	struct nameidata *nd = current->nameidata;
993 
994 	if (unlikely(nd->flags & LOOKUP_NO_MAGICLINKS))
995 		goto err;
996 
997 	error = -EXDEV;
998 	if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
999 		if (nd->path.mnt != path->mnt)
1000 			goto err;
1001 	}
1002 	/* Not currently safe for scoped-lookups. */
1003 	if (unlikely(nd->flags & LOOKUP_IS_SCOPED))
1004 		goto err;
1005 
1006 	path_put(&nd->path);
1007 	nd->path = *path;
1008 	nd->inode = nd->path.dentry->d_inode;
1009 	nd->state |= ND_JUMPED;
1010 	return 0;
1011 
1012 err:
1013 	path_put(path);
1014 	return error;
1015 }
1016 
put_link(struct nameidata * nd)1017 static inline void put_link(struct nameidata *nd)
1018 {
1019 	struct saved *last = nd->stack + --nd->depth;
1020 	do_delayed_call(&last->done);
1021 	if (!(nd->flags & LOOKUP_RCU))
1022 		path_put(&last->link);
1023 }
1024 
1025 static int sysctl_protected_symlinks __read_mostly;
1026 static int sysctl_protected_hardlinks __read_mostly;
1027 static int sysctl_protected_fifos __read_mostly;
1028 static int sysctl_protected_regular __read_mostly;
1029 
1030 #ifdef CONFIG_SYSCTL
1031 static struct ctl_table namei_sysctls[] = {
1032 	{
1033 		.procname	= "protected_symlinks",
1034 		.data		= &sysctl_protected_symlinks,
1035 		.maxlen		= sizeof(int),
1036 		.mode		= 0644,
1037 		.proc_handler	= proc_dointvec_minmax,
1038 		.extra1		= SYSCTL_ZERO,
1039 		.extra2		= SYSCTL_ONE,
1040 	},
1041 	{
1042 		.procname	= "protected_hardlinks",
1043 		.data		= &sysctl_protected_hardlinks,
1044 		.maxlen		= sizeof(int),
1045 		.mode		= 0644,
1046 		.proc_handler	= proc_dointvec_minmax,
1047 		.extra1		= SYSCTL_ZERO,
1048 		.extra2		= SYSCTL_ONE,
1049 	},
1050 	{
1051 		.procname	= "protected_fifos",
1052 		.data		= &sysctl_protected_fifos,
1053 		.maxlen		= sizeof(int),
1054 		.mode		= 0644,
1055 		.proc_handler	= proc_dointvec_minmax,
1056 		.extra1		= SYSCTL_ZERO,
1057 		.extra2		= SYSCTL_TWO,
1058 	},
1059 	{
1060 		.procname	= "protected_regular",
1061 		.data		= &sysctl_protected_regular,
1062 		.maxlen		= sizeof(int),
1063 		.mode		= 0644,
1064 		.proc_handler	= proc_dointvec_minmax,
1065 		.extra1		= SYSCTL_ZERO,
1066 		.extra2		= SYSCTL_TWO,
1067 	},
1068 	{ }
1069 };
1070 
init_fs_namei_sysctls(void)1071 static int __init init_fs_namei_sysctls(void)
1072 {
1073 	register_sysctl_init("fs", namei_sysctls);
1074 	return 0;
1075 }
1076 fs_initcall(init_fs_namei_sysctls);
1077 
1078 #endif /* CONFIG_SYSCTL */
1079 
1080 /**
1081  * may_follow_link - Check symlink following for unsafe situations
1082  * @nd: nameidata pathwalk data
1083  *
1084  * In the case of the sysctl_protected_symlinks sysctl being enabled,
1085  * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
1086  * in a sticky world-writable directory. This is to protect privileged
1087  * processes from failing races against path names that may change out
1088  * from under them by way of other users creating malicious symlinks.
1089  * It will permit symlinks to be followed only when outside a sticky
1090  * world-writable directory, or when the uid of the symlink and follower
1091  * match, or when the directory owner matches the symlink's owner.
1092  *
1093  * Returns 0 if following the symlink is allowed, -ve on error.
1094  */
may_follow_link(struct nameidata * nd,const struct inode * inode)1095 static inline int may_follow_link(struct nameidata *nd, const struct inode *inode)
1096 {
1097 	struct user_namespace *mnt_userns;
1098 	kuid_t i_uid;
1099 
1100 	if (!sysctl_protected_symlinks)
1101 		return 0;
1102 
1103 	mnt_userns = mnt_user_ns(nd->path.mnt);
1104 	i_uid = i_uid_into_mnt(mnt_userns, inode);
1105 	/* Allowed if owner and follower match. */
1106 	if (uid_eq(current_cred()->fsuid, i_uid))
1107 		return 0;
1108 
1109 	/* Allowed if parent directory not sticky and world-writable. */
1110 	if ((nd->dir_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
1111 		return 0;
1112 
1113 	/* Allowed if parent directory and link owner match. */
1114 	if (uid_valid(nd->dir_uid) && uid_eq(nd->dir_uid, i_uid))
1115 		return 0;
1116 
1117 	if (nd->flags & LOOKUP_RCU)
1118 		return -ECHILD;
1119 
1120 	audit_inode(nd->name, nd->stack[0].link.dentry, 0);
1121 	audit_log_path_denied(AUDIT_ANOM_LINK, "follow_link");
1122 	return -EACCES;
1123 }
1124 
1125 /**
1126  * safe_hardlink_source - Check for safe hardlink conditions
1127  * @mnt_userns:	user namespace of the mount the inode was found from
1128  * @inode: the source inode to hardlink from
1129  *
1130  * Return false if at least one of the following conditions:
1131  *    - inode is not a regular file
1132  *    - inode is setuid
1133  *    - inode is setgid and group-exec
1134  *    - access failure for read and write
1135  *
1136  * Otherwise returns true.
1137  */
safe_hardlink_source(struct user_namespace * mnt_userns,struct inode * inode)1138 static bool safe_hardlink_source(struct user_namespace *mnt_userns,
1139 				 struct inode *inode)
1140 {
1141 	umode_t mode = inode->i_mode;
1142 
1143 	/* Special files should not get pinned to the filesystem. */
1144 	if (!S_ISREG(mode))
1145 		return false;
1146 
1147 	/* Setuid files should not get pinned to the filesystem. */
1148 	if (mode & S_ISUID)
1149 		return false;
1150 
1151 	/* Executable setgid files should not get pinned to the filesystem. */
1152 	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
1153 		return false;
1154 
1155 	/* Hardlinking to unreadable or unwritable sources is dangerous. */
1156 	if (inode_permission(mnt_userns, inode, MAY_READ | MAY_WRITE))
1157 		return false;
1158 
1159 	return true;
1160 }
1161 
1162 /**
1163  * may_linkat - Check permissions for creating a hardlink
1164  * @mnt_userns:	user namespace of the mount the inode was found from
1165  * @link: the source to hardlink from
1166  *
1167  * Block hardlink when all of:
1168  *  - sysctl_protected_hardlinks enabled
1169  *  - fsuid does not match inode
1170  *  - hardlink source is unsafe (see safe_hardlink_source() above)
1171  *  - not CAP_FOWNER in a namespace with the inode owner uid mapped
1172  *
1173  * If the inode has been found through an idmapped mount the user namespace of
1174  * the vfsmount must be passed through @mnt_userns. This function will then take
1175  * care to map the inode according to @mnt_userns before checking permissions.
1176  * On non-idmapped mounts or if permission checking is to be performed on the
1177  * raw inode simply passs init_user_ns.
1178  *
1179  * Returns 0 if successful, -ve on error.
1180  */
may_linkat(struct user_namespace * mnt_userns,const struct path * link)1181 int may_linkat(struct user_namespace *mnt_userns, const struct path *link)
1182 {
1183 	struct inode *inode = link->dentry->d_inode;
1184 
1185 	/* Inode writeback is not safe when the uid or gid are invalid. */
1186 	if (!uid_valid(i_uid_into_mnt(mnt_userns, inode)) ||
1187 	    !gid_valid(i_gid_into_mnt(mnt_userns, inode)))
1188 		return -EOVERFLOW;
1189 
1190 	if (!sysctl_protected_hardlinks)
1191 		return 0;
1192 
1193 	/* Source inode owner (or CAP_FOWNER) can hardlink all they like,
1194 	 * otherwise, it must be a safe source.
1195 	 */
1196 	if (safe_hardlink_source(mnt_userns, inode) ||
1197 	    inode_owner_or_capable(mnt_userns, inode))
1198 		return 0;
1199 
1200 	audit_log_path_denied(AUDIT_ANOM_LINK, "linkat");
1201 	return -EPERM;
1202 }
1203 
1204 /**
1205  * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
1206  *			  should be allowed, or not, on files that already
1207  *			  exist.
1208  * @mnt_userns:	user namespace of the mount the inode was found from
1209  * @nd: nameidata pathwalk data
1210  * @inode: the inode of the file to open
1211  *
1212  * Block an O_CREAT open of a FIFO (or a regular file) when:
1213  *   - sysctl_protected_fifos (or sysctl_protected_regular) is enabled
1214  *   - the file already exists
1215  *   - we are in a sticky directory
1216  *   - we don't own the file
1217  *   - the owner of the directory doesn't own the file
1218  *   - the directory is world writable
1219  * If the sysctl_protected_fifos (or sysctl_protected_regular) is set to 2
1220  * the directory doesn't have to be world writable: being group writable will
1221  * be enough.
1222  *
1223  * If the inode has been found through an idmapped mount the user namespace of
1224  * the vfsmount must be passed through @mnt_userns. This function will then take
1225  * care to map the inode according to @mnt_userns before checking permissions.
1226  * On non-idmapped mounts or if permission checking is to be performed on the
1227  * raw inode simply passs init_user_ns.
1228  *
1229  * Returns 0 if the open is allowed, -ve on error.
1230  */
may_create_in_sticky(struct user_namespace * mnt_userns,struct nameidata * nd,struct inode * const inode)1231 static int may_create_in_sticky(struct user_namespace *mnt_userns,
1232 				struct nameidata *nd, struct inode *const inode)
1233 {
1234 	umode_t dir_mode = nd->dir_mode;
1235 	kuid_t dir_uid = nd->dir_uid;
1236 
1237 	if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
1238 	    (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
1239 	    likely(!(dir_mode & S_ISVTX)) ||
1240 	    uid_eq(i_uid_into_mnt(mnt_userns, inode), dir_uid) ||
1241 	    uid_eq(current_fsuid(), i_uid_into_mnt(mnt_userns, inode)))
1242 		return 0;
1243 
1244 	if (likely(dir_mode & 0002) ||
1245 	    (dir_mode & 0020 &&
1246 	     ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
1247 	      (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
1248 		const char *operation = S_ISFIFO(inode->i_mode) ?
1249 					"sticky_create_fifo" :
1250 					"sticky_create_regular";
1251 		audit_log_path_denied(AUDIT_ANOM_CREAT, operation);
1252 		return -EACCES;
1253 	}
1254 	return 0;
1255 }
1256 
1257 /*
1258  * follow_up - Find the mountpoint of path's vfsmount
1259  *
1260  * Given a path, find the mountpoint of its source file system.
1261  * Replace @path with the path of the mountpoint in the parent mount.
1262  * Up is towards /.
1263  *
1264  * Return 1 if we went up a level and 0 if we were already at the
1265  * root.
1266  */
follow_up(struct path * path)1267 int follow_up(struct path *path)
1268 {
1269 	struct mount *mnt = real_mount(path->mnt);
1270 	struct mount *parent;
1271 	struct dentry *mountpoint;
1272 
1273 	read_seqlock_excl(&mount_lock);
1274 	parent = mnt->mnt_parent;
1275 	if (parent == mnt) {
1276 		read_sequnlock_excl(&mount_lock);
1277 		return 0;
1278 	}
1279 	mntget(&parent->mnt);
1280 	mountpoint = dget(mnt->mnt_mountpoint);
1281 	read_sequnlock_excl(&mount_lock);
1282 	dput(path->dentry);
1283 	path->dentry = mountpoint;
1284 	mntput(path->mnt);
1285 	path->mnt = &parent->mnt;
1286 	return 1;
1287 }
1288 EXPORT_SYMBOL(follow_up);
1289 
choose_mountpoint_rcu(struct mount * m,const struct path * root,struct path * path,unsigned * seqp)1290 static bool choose_mountpoint_rcu(struct mount *m, const struct path *root,
1291 				  struct path *path, unsigned *seqp)
1292 {
1293 	while (mnt_has_parent(m)) {
1294 		struct dentry *mountpoint = m->mnt_mountpoint;
1295 
1296 		m = m->mnt_parent;
1297 		if (unlikely(root->dentry == mountpoint &&
1298 			     root->mnt == &m->mnt))
1299 			break;
1300 		if (mountpoint != m->mnt.mnt_root) {
1301 			path->mnt = &m->mnt;
1302 			path->dentry = mountpoint;
1303 			*seqp = read_seqcount_begin(&mountpoint->d_seq);
1304 			return true;
1305 		}
1306 	}
1307 	return false;
1308 }
1309 
choose_mountpoint(struct mount * m,const struct path * root,struct path * path)1310 static bool choose_mountpoint(struct mount *m, const struct path *root,
1311 			      struct path *path)
1312 {
1313 	bool found;
1314 
1315 	rcu_read_lock();
1316 	while (1) {
1317 		unsigned seq, mseq = read_seqbegin(&mount_lock);
1318 
1319 		found = choose_mountpoint_rcu(m, root, path, &seq);
1320 		if (unlikely(!found)) {
1321 			if (!read_seqretry(&mount_lock, mseq))
1322 				break;
1323 		} else {
1324 			if (likely(__legitimize_path(path, seq, mseq)))
1325 				break;
1326 			rcu_read_unlock();
1327 			path_put(path);
1328 			rcu_read_lock();
1329 		}
1330 	}
1331 	rcu_read_unlock();
1332 	return found;
1333 }
1334 
1335 /*
1336  * Perform an automount
1337  * - return -EISDIR to tell follow_managed() to stop and return the path we
1338  *   were called with.
1339  */
follow_automount(struct path * path,int * count,unsigned lookup_flags)1340 static int follow_automount(struct path *path, int *count, unsigned lookup_flags)
1341 {
1342 	struct dentry *dentry = path->dentry;
1343 
1344 	/* We don't want to mount if someone's just doing a stat -
1345 	 * unless they're stat'ing a directory and appended a '/' to
1346 	 * the name.
1347 	 *
1348 	 * We do, however, want to mount if someone wants to open or
1349 	 * create a file of any type under the mountpoint, wants to
1350 	 * traverse through the mountpoint or wants to open the
1351 	 * mounted directory.  Also, autofs may mark negative dentries
1352 	 * as being automount points.  These will need the attentions
1353 	 * of the daemon to instantiate them before they can be used.
1354 	 */
1355 	if (!(lookup_flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
1356 			   LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
1357 	    dentry->d_inode)
1358 		return -EISDIR;
1359 
1360 	if (count && (*count)++ >= MAXSYMLINKS)
1361 		return -ELOOP;
1362 
1363 	return finish_automount(dentry->d_op->d_automount(path), path);
1364 }
1365 
1366 /*
1367  * mount traversal - out-of-line part.  One note on ->d_flags accesses -
1368  * dentries are pinned but not locked here, so negative dentry can go
1369  * positive right under us.  Use of smp_load_acquire() provides a barrier
1370  * sufficient for ->d_inode and ->d_flags consistency.
1371  */
__traverse_mounts(struct path * path,unsigned flags,bool * jumped,int * count,unsigned lookup_flags)1372 static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped,
1373 			     int *count, unsigned lookup_flags)
1374 {
1375 	struct vfsmount *mnt = path->mnt;
1376 	bool need_mntput = false;
1377 	int ret = 0;
1378 
1379 	while (flags & DCACHE_MANAGED_DENTRY) {
1380 		/* Allow the filesystem to manage the transit without i_mutex
1381 		 * being held. */
1382 		if (flags & DCACHE_MANAGE_TRANSIT) {
1383 			ret = path->dentry->d_op->d_manage(path, false);
1384 			flags = smp_load_acquire(&path->dentry->d_flags);
1385 			if (ret < 0)
1386 				break;
1387 		}
1388 
1389 		if (flags & DCACHE_MOUNTED) {	// something's mounted on it..
1390 			struct vfsmount *mounted = lookup_mnt(path);
1391 			if (mounted) {		// ... in our namespace
1392 				dput(path->dentry);
1393 				if (need_mntput)
1394 					mntput(path->mnt);
1395 				path->mnt = mounted;
1396 				path->dentry = dget(mounted->mnt_root);
1397 				// here we know it's positive
1398 				flags = path->dentry->d_flags;
1399 				need_mntput = true;
1400 				continue;
1401 			}
1402 		}
1403 
1404 		if (!(flags & DCACHE_NEED_AUTOMOUNT))
1405 			break;
1406 
1407 		// uncovered automount point
1408 		ret = follow_automount(path, count, lookup_flags);
1409 		flags = smp_load_acquire(&path->dentry->d_flags);
1410 		if (ret < 0)
1411 			break;
1412 	}
1413 
1414 	if (ret == -EISDIR)
1415 		ret = 0;
1416 	// possible if you race with several mount --move
1417 	if (need_mntput && path->mnt == mnt)
1418 		mntput(path->mnt);
1419 	if (!ret && unlikely(d_flags_negative(flags)))
1420 		ret = -ENOENT;
1421 	*jumped = need_mntput;
1422 	return ret;
1423 }
1424 
traverse_mounts(struct path * path,bool * jumped,int * count,unsigned lookup_flags)1425 static inline int traverse_mounts(struct path *path, bool *jumped,
1426 				  int *count, unsigned lookup_flags)
1427 {
1428 	unsigned flags = smp_load_acquire(&path->dentry->d_flags);
1429 
1430 	/* fastpath */
1431 	if (likely(!(flags & DCACHE_MANAGED_DENTRY))) {
1432 		*jumped = false;
1433 		if (unlikely(d_flags_negative(flags)))
1434 			return -ENOENT;
1435 		return 0;
1436 	}
1437 	return __traverse_mounts(path, flags, jumped, count, lookup_flags);
1438 }
1439 
follow_down_one(struct path * path)1440 int follow_down_one(struct path *path)
1441 {
1442 	struct vfsmount *mounted;
1443 
1444 	mounted = lookup_mnt(path);
1445 	if (mounted) {
1446 		dput(path->dentry);
1447 		mntput(path->mnt);
1448 		path->mnt = mounted;
1449 		path->dentry = dget(mounted->mnt_root);
1450 		return 1;
1451 	}
1452 	return 0;
1453 }
1454 EXPORT_SYMBOL(follow_down_one);
1455 
1456 /*
1457  * Follow down to the covering mount currently visible to userspace.  At each
1458  * point, the filesystem owning that dentry may be queried as to whether the
1459  * caller is permitted to proceed or not.
1460  */
follow_down(struct path * path)1461 int follow_down(struct path *path)
1462 {
1463 	struct vfsmount *mnt = path->mnt;
1464 	bool jumped;
1465 	int ret = traverse_mounts(path, &jumped, NULL, 0);
1466 
1467 	if (path->mnt != mnt)
1468 		mntput(mnt);
1469 	return ret;
1470 }
1471 EXPORT_SYMBOL(follow_down);
1472 
1473 /*
1474  * Try to skip to top of mountpoint pile in rcuwalk mode.  Fail if
1475  * we meet a managed dentry that would need blocking.
1476  */
__follow_mount_rcu(struct nameidata * nd,struct path * path)1477 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path)
1478 {
1479 	struct dentry *dentry = path->dentry;
1480 	unsigned int flags = dentry->d_flags;
1481 
1482 	if (likely(!(flags & DCACHE_MANAGED_DENTRY)))
1483 		return true;
1484 
1485 	if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1486 		return false;
1487 
1488 	for (;;) {
1489 		/*
1490 		 * Don't forget we might have a non-mountpoint managed dentry
1491 		 * that wants to block transit.
1492 		 */
1493 		if (unlikely(flags & DCACHE_MANAGE_TRANSIT)) {
1494 			int res = dentry->d_op->d_manage(path, true);
1495 			if (res)
1496 				return res == -EISDIR;
1497 			flags = dentry->d_flags;
1498 		}
1499 
1500 		if (flags & DCACHE_MOUNTED) {
1501 			struct mount *mounted = __lookup_mnt(path->mnt, dentry);
1502 			if (mounted) {
1503 				path->mnt = &mounted->mnt;
1504 				dentry = path->dentry = mounted->mnt.mnt_root;
1505 				nd->state |= ND_JUMPED;
1506 				nd->next_seq = read_seqcount_begin(&dentry->d_seq);
1507 				flags = dentry->d_flags;
1508 				// makes sure that non-RCU pathwalk could reach
1509 				// this state.
1510 				if (read_seqretry(&mount_lock, nd->m_seq))
1511 					return false;
1512 				continue;
1513 			}
1514 			if (read_seqretry(&mount_lock, nd->m_seq))
1515 				return false;
1516 		}
1517 		return !(flags & DCACHE_NEED_AUTOMOUNT);
1518 	}
1519 }
1520 
handle_mounts(struct nameidata * nd,struct dentry * dentry,struct path * path)1521 static inline int handle_mounts(struct nameidata *nd, struct dentry *dentry,
1522 			  struct path *path)
1523 {
1524 	bool jumped;
1525 	int ret;
1526 
1527 	path->mnt = nd->path.mnt;
1528 	path->dentry = dentry;
1529 	if (nd->flags & LOOKUP_RCU) {
1530 		unsigned int seq = nd->next_seq;
1531 		if (likely(__follow_mount_rcu(nd, path)))
1532 			return 0;
1533 		// *path and nd->next_seq might've been clobbered
1534 		path->mnt = nd->path.mnt;
1535 		path->dentry = dentry;
1536 		nd->next_seq = seq;
1537 		if (!try_to_unlazy_next(nd, dentry))
1538 			return -ECHILD;
1539 	}
1540 	ret = traverse_mounts(path, &jumped, &nd->total_link_count, nd->flags);
1541 	if (jumped) {
1542 		if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1543 			ret = -EXDEV;
1544 		else
1545 			nd->state |= ND_JUMPED;
1546 	}
1547 	if (unlikely(ret)) {
1548 		dput(path->dentry);
1549 		if (path->mnt != nd->path.mnt)
1550 			mntput(path->mnt);
1551 	}
1552 	return ret;
1553 }
1554 
1555 /*
1556  * This looks up the name in dcache and possibly revalidates the found dentry.
1557  * NULL is returned if the dentry does not exist in the cache.
1558  */
lookup_dcache(const struct qstr * name,struct dentry * dir,unsigned int flags)1559 static struct dentry *lookup_dcache(const struct qstr *name,
1560 				    struct dentry *dir,
1561 				    unsigned int flags)
1562 {
1563 	struct dentry *dentry = d_lookup(dir, name);
1564 	if (dentry) {
1565 		int error = d_revalidate(dentry, flags);
1566 		if (unlikely(error <= 0)) {
1567 			if (!error)
1568 				d_invalidate(dentry);
1569 			dput(dentry);
1570 			return ERR_PTR(error);
1571 		}
1572 	}
1573 	return dentry;
1574 }
1575 
1576 /*
1577  * Parent directory has inode locked exclusive.  This is one
1578  * and only case when ->lookup() gets called on non in-lookup
1579  * dentries - as the matter of fact, this only gets called
1580  * when directory is guaranteed to have no in-lookup children
1581  * at all.
1582  */
__lookup_hash(const struct qstr * name,struct dentry * base,unsigned int flags)1583 static struct dentry *__lookup_hash(const struct qstr *name,
1584 		struct dentry *base, unsigned int flags)
1585 {
1586 	struct dentry *dentry = lookup_dcache(name, base, flags);
1587 	struct dentry *old;
1588 	struct inode *dir = base->d_inode;
1589 
1590 	if (dentry)
1591 		return dentry;
1592 
1593 	/* Don't create child dentry for a dead directory. */
1594 	if (unlikely(IS_DEADDIR(dir)))
1595 		return ERR_PTR(-ENOENT);
1596 
1597 	dentry = d_alloc(base, name);
1598 	if (unlikely(!dentry))
1599 		return ERR_PTR(-ENOMEM);
1600 
1601 	old = dir->i_op->lookup(dir, dentry, flags);
1602 	if (unlikely(old)) {
1603 		dput(dentry);
1604 		dentry = old;
1605 	}
1606 	return dentry;
1607 }
1608 
lookup_fast(struct nameidata * nd)1609 static struct dentry *lookup_fast(struct nameidata *nd)
1610 {
1611 	struct dentry *dentry, *parent = nd->path.dentry;
1612 	int status = 1;
1613 
1614 	/*
1615 	 * Rename seqlock is not required here because in the off chance
1616 	 * of a false negative due to a concurrent rename, the caller is
1617 	 * going to fall back to non-racy lookup.
1618 	 */
1619 	if (nd->flags & LOOKUP_RCU) {
1620 		dentry = __d_lookup_rcu(parent, &nd->last, &nd->next_seq);
1621 		if (unlikely(!dentry)) {
1622 			if (!try_to_unlazy(nd))
1623 				return ERR_PTR(-ECHILD);
1624 			return NULL;
1625 		}
1626 
1627 		/*
1628 		 * This sequence count validates that the parent had no
1629 		 * changes while we did the lookup of the dentry above.
1630 		 */
1631 		if (read_seqcount_retry(&parent->d_seq, nd->seq))
1632 			return ERR_PTR(-ECHILD);
1633 
1634 		status = d_revalidate(dentry, nd->flags);
1635 		if (likely(status > 0))
1636 			return dentry;
1637 		if (!try_to_unlazy_next(nd, dentry))
1638 			return ERR_PTR(-ECHILD);
1639 		if (status == -ECHILD)
1640 			/* we'd been told to redo it in non-rcu mode */
1641 			status = d_revalidate(dentry, nd->flags);
1642 	} else {
1643 		dentry = __d_lookup(parent, &nd->last);
1644 		if (unlikely(!dentry))
1645 			return NULL;
1646 		status = d_revalidate(dentry, nd->flags);
1647 	}
1648 	if (unlikely(status <= 0)) {
1649 		if (!status)
1650 			d_invalidate(dentry);
1651 		dput(dentry);
1652 		return ERR_PTR(status);
1653 	}
1654 	return dentry;
1655 }
1656 
1657 /* Fast lookup failed, do it the slow way */
__lookup_slow(const struct qstr * name,struct dentry * dir,unsigned int flags)1658 static struct dentry *__lookup_slow(const struct qstr *name,
1659 				    struct dentry *dir,
1660 				    unsigned int flags)
1661 {
1662 	struct dentry *dentry, *old;
1663 	struct inode *inode = dir->d_inode;
1664 	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
1665 
1666 	/* Don't go there if it's already dead */
1667 	if (unlikely(IS_DEADDIR(inode)))
1668 		return ERR_PTR(-ENOENT);
1669 again:
1670 	dentry = d_alloc_parallel(dir, name, &wq);
1671 	if (IS_ERR(dentry))
1672 		return dentry;
1673 	if (unlikely(!d_in_lookup(dentry))) {
1674 		int error = d_revalidate(dentry, flags);
1675 		if (unlikely(error <= 0)) {
1676 			if (!error) {
1677 				d_invalidate(dentry);
1678 				dput(dentry);
1679 				goto again;
1680 			}
1681 			dput(dentry);
1682 			dentry = ERR_PTR(error);
1683 		}
1684 	} else {
1685 		old = inode->i_op->lookup(inode, dentry, flags);
1686 		d_lookup_done(dentry);
1687 		if (unlikely(old)) {
1688 			dput(dentry);
1689 			dentry = old;
1690 		}
1691 	}
1692 	return dentry;
1693 }
1694 
lookup_slow(const struct qstr * name,struct dentry * dir,unsigned int flags)1695 static struct dentry *lookup_slow(const struct qstr *name,
1696 				  struct dentry *dir,
1697 				  unsigned int flags)
1698 {
1699 	struct inode *inode = dir->d_inode;
1700 	struct dentry *res;
1701 	inode_lock_shared(inode);
1702 	res = __lookup_slow(name, dir, flags);
1703 	inode_unlock_shared(inode);
1704 	return res;
1705 }
1706 
may_lookup(struct user_namespace * mnt_userns,struct nameidata * nd)1707 static inline int may_lookup(struct user_namespace *mnt_userns,
1708 			     struct nameidata *nd)
1709 {
1710 	if (nd->flags & LOOKUP_RCU) {
1711 		int err = inode_permission(mnt_userns, nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1712 		if (err != -ECHILD || !try_to_unlazy(nd))
1713 			return err;
1714 	}
1715 	return inode_permission(mnt_userns, nd->inode, MAY_EXEC);
1716 }
1717 
reserve_stack(struct nameidata * nd,struct path * link)1718 static int reserve_stack(struct nameidata *nd, struct path *link)
1719 {
1720 	if (unlikely(nd->total_link_count++ >= MAXSYMLINKS))
1721 		return -ELOOP;
1722 
1723 	if (likely(nd->depth != EMBEDDED_LEVELS))
1724 		return 0;
1725 	if (likely(nd->stack != nd->internal))
1726 		return 0;
1727 	if (likely(nd_alloc_stack(nd)))
1728 		return 0;
1729 
1730 	if (nd->flags & LOOKUP_RCU) {
1731 		// we need to grab link before we do unlazy.  And we can't skip
1732 		// unlazy even if we fail to grab the link - cleanup needs it
1733 		bool grabbed_link = legitimize_path(nd, link, nd->next_seq);
1734 
1735 		if (!try_to_unlazy(nd) || !grabbed_link)
1736 			return -ECHILD;
1737 
1738 		if (nd_alloc_stack(nd))
1739 			return 0;
1740 	}
1741 	return -ENOMEM;
1742 }
1743 
1744 enum {WALK_TRAILING = 1, WALK_MORE = 2, WALK_NOFOLLOW = 4};
1745 
pick_link(struct nameidata * nd,struct path * link,struct inode * inode,int flags)1746 static const char *pick_link(struct nameidata *nd, struct path *link,
1747 		     struct inode *inode, int flags)
1748 {
1749 	struct saved *last;
1750 	const char *res;
1751 	int error = reserve_stack(nd, link);
1752 
1753 	if (unlikely(error)) {
1754 		if (!(nd->flags & LOOKUP_RCU))
1755 			path_put(link);
1756 		return ERR_PTR(error);
1757 	}
1758 	last = nd->stack + nd->depth++;
1759 	last->link = *link;
1760 	clear_delayed_call(&last->done);
1761 	last->seq = nd->next_seq;
1762 
1763 	if (flags & WALK_TRAILING) {
1764 		error = may_follow_link(nd, inode);
1765 		if (unlikely(error))
1766 			return ERR_PTR(error);
1767 	}
1768 
1769 	if (unlikely(nd->flags & LOOKUP_NO_SYMLINKS) ||
1770 			unlikely(link->mnt->mnt_flags & MNT_NOSYMFOLLOW))
1771 		return ERR_PTR(-ELOOP);
1772 
1773 	if (!(nd->flags & LOOKUP_RCU)) {
1774 		touch_atime(&last->link);
1775 		cond_resched();
1776 	} else if (atime_needs_update(&last->link, inode)) {
1777 		if (!try_to_unlazy(nd))
1778 			return ERR_PTR(-ECHILD);
1779 		touch_atime(&last->link);
1780 	}
1781 
1782 	error = security_inode_follow_link(link->dentry, inode,
1783 					   nd->flags & LOOKUP_RCU);
1784 	if (unlikely(error))
1785 		return ERR_PTR(error);
1786 
1787 	res = READ_ONCE(inode->i_link);
1788 	if (!res) {
1789 		const char * (*get)(struct dentry *, struct inode *,
1790 				struct delayed_call *);
1791 		get = inode->i_op->get_link;
1792 		if (nd->flags & LOOKUP_RCU) {
1793 			res = get(NULL, inode, &last->done);
1794 			if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd))
1795 				res = get(link->dentry, inode, &last->done);
1796 		} else {
1797 			res = get(link->dentry, inode, &last->done);
1798 		}
1799 		if (!res)
1800 			goto all_done;
1801 		if (IS_ERR(res))
1802 			return res;
1803 	}
1804 	if (*res == '/') {
1805 		error = nd_jump_root(nd);
1806 		if (unlikely(error))
1807 			return ERR_PTR(error);
1808 		while (unlikely(*++res == '/'))
1809 			;
1810 	}
1811 	if (*res)
1812 		return res;
1813 all_done: // pure jump
1814 	put_link(nd);
1815 	return NULL;
1816 }
1817 
1818 /*
1819  * Do we need to follow links? We _really_ want to be able
1820  * to do this check without having to look at inode->i_op,
1821  * so we keep a cache of "no, this doesn't need follow_link"
1822  * for the common case.
1823  *
1824  * NOTE: dentry must be what nd->next_seq had been sampled from.
1825  */
step_into(struct nameidata * nd,int flags,struct dentry * dentry)1826 static const char *step_into(struct nameidata *nd, int flags,
1827 		     struct dentry *dentry)
1828 {
1829 	struct path path;
1830 	struct inode *inode;
1831 	int err = handle_mounts(nd, dentry, &path);
1832 
1833 	if (err < 0)
1834 		return ERR_PTR(err);
1835 	inode = path.dentry->d_inode;
1836 	if (likely(!d_is_symlink(path.dentry)) ||
1837 	   ((flags & WALK_TRAILING) && !(nd->flags & LOOKUP_FOLLOW)) ||
1838 	   (flags & WALK_NOFOLLOW)) {
1839 		/* not a symlink or should not follow */
1840 		if (nd->flags & LOOKUP_RCU) {
1841 			if (read_seqcount_retry(&path.dentry->d_seq, nd->next_seq))
1842 				return ERR_PTR(-ECHILD);
1843 			if (unlikely(!inode))
1844 				return ERR_PTR(-ENOENT);
1845 		} else {
1846 			dput(nd->path.dentry);
1847 			if (nd->path.mnt != path.mnt)
1848 				mntput(nd->path.mnt);
1849 		}
1850 		nd->path = path;
1851 		nd->inode = inode;
1852 		nd->seq = nd->next_seq;
1853 		return NULL;
1854 	}
1855 	if (nd->flags & LOOKUP_RCU) {
1856 		/* make sure that d_is_symlink above matches inode */
1857 		if (read_seqcount_retry(&path.dentry->d_seq, nd->next_seq))
1858 			return ERR_PTR(-ECHILD);
1859 	} else {
1860 		if (path.mnt == nd->path.mnt)
1861 			mntget(path.mnt);
1862 	}
1863 	return pick_link(nd, &path, inode, flags);
1864 }
1865 
follow_dotdot_rcu(struct nameidata * nd)1866 static struct dentry *follow_dotdot_rcu(struct nameidata *nd)
1867 {
1868 	struct dentry *parent, *old;
1869 
1870 	if (path_equal(&nd->path, &nd->root))
1871 		goto in_root;
1872 	if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
1873 		struct path path;
1874 		unsigned seq;
1875 		if (!choose_mountpoint_rcu(real_mount(nd->path.mnt),
1876 					   &nd->root, &path, &seq))
1877 			goto in_root;
1878 		if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1879 			return ERR_PTR(-ECHILD);
1880 		nd->path = path;
1881 		nd->inode = path.dentry->d_inode;
1882 		nd->seq = seq;
1883 		// makes sure that non-RCU pathwalk could reach this state
1884 		if (read_seqretry(&mount_lock, nd->m_seq))
1885 			return ERR_PTR(-ECHILD);
1886 		/* we know that mountpoint was pinned */
1887 	}
1888 	old = nd->path.dentry;
1889 	parent = old->d_parent;
1890 	nd->next_seq = read_seqcount_begin(&parent->d_seq);
1891 	// makes sure that non-RCU pathwalk could reach this state
1892 	if (read_seqcount_retry(&old->d_seq, nd->seq))
1893 		return ERR_PTR(-ECHILD);
1894 	if (unlikely(!path_connected(nd->path.mnt, parent)))
1895 		return ERR_PTR(-ECHILD);
1896 	return parent;
1897 in_root:
1898 	if (read_seqretry(&mount_lock, nd->m_seq))
1899 		return ERR_PTR(-ECHILD);
1900 	if (unlikely(nd->flags & LOOKUP_BENEATH))
1901 		return ERR_PTR(-ECHILD);
1902 	nd->next_seq = nd->seq;
1903 	return nd->path.dentry;
1904 }
1905 
follow_dotdot(struct nameidata * nd)1906 static struct dentry *follow_dotdot(struct nameidata *nd)
1907 {
1908 	struct dentry *parent;
1909 
1910 	if (path_equal(&nd->path, &nd->root))
1911 		goto in_root;
1912 	if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
1913 		struct path path;
1914 
1915 		if (!choose_mountpoint(real_mount(nd->path.mnt),
1916 				       &nd->root, &path))
1917 			goto in_root;
1918 		path_put(&nd->path);
1919 		nd->path = path;
1920 		nd->inode = path.dentry->d_inode;
1921 		if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1922 			return ERR_PTR(-EXDEV);
1923 	}
1924 	/* rare case of legitimate dget_parent()... */
1925 	parent = dget_parent(nd->path.dentry);
1926 	if (unlikely(!path_connected(nd->path.mnt, parent))) {
1927 		dput(parent);
1928 		return ERR_PTR(-ENOENT);
1929 	}
1930 	return parent;
1931 
1932 in_root:
1933 	if (unlikely(nd->flags & LOOKUP_BENEATH))
1934 		return ERR_PTR(-EXDEV);
1935 	return dget(nd->path.dentry);
1936 }
1937 
handle_dots(struct nameidata * nd,int type)1938 static const char *handle_dots(struct nameidata *nd, int type)
1939 {
1940 	if (type == LAST_DOTDOT) {
1941 		const char *error = NULL;
1942 		struct dentry *parent;
1943 
1944 		if (!nd->root.mnt) {
1945 			error = ERR_PTR(set_root(nd));
1946 			if (error)
1947 				return error;
1948 		}
1949 		if (nd->flags & LOOKUP_RCU)
1950 			parent = follow_dotdot_rcu(nd);
1951 		else
1952 			parent = follow_dotdot(nd);
1953 		if (IS_ERR(parent))
1954 			return ERR_CAST(parent);
1955 		error = step_into(nd, WALK_NOFOLLOW, parent);
1956 		if (unlikely(error))
1957 			return error;
1958 
1959 		if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
1960 			/*
1961 			 * If there was a racing rename or mount along our
1962 			 * path, then we can't be sure that ".." hasn't jumped
1963 			 * above nd->root (and so userspace should retry or use
1964 			 * some fallback).
1965 			 */
1966 			smp_rmb();
1967 			if (__read_seqcount_retry(&mount_lock.seqcount, nd->m_seq))
1968 				return ERR_PTR(-EAGAIN);
1969 			if (__read_seqcount_retry(&rename_lock.seqcount, nd->r_seq))
1970 				return ERR_PTR(-EAGAIN);
1971 		}
1972 	}
1973 	return NULL;
1974 }
1975 
walk_component(struct nameidata * nd,int flags)1976 static const char *walk_component(struct nameidata *nd, int flags)
1977 {
1978 	struct dentry *dentry;
1979 	/*
1980 	 * "." and ".." are special - ".." especially so because it has
1981 	 * to be able to know about the current root directory and
1982 	 * parent relationships.
1983 	 */
1984 	if (unlikely(nd->last_type != LAST_NORM)) {
1985 		if (!(flags & WALK_MORE) && nd->depth)
1986 			put_link(nd);
1987 		return handle_dots(nd, nd->last_type);
1988 	}
1989 	dentry = lookup_fast(nd);
1990 	if (IS_ERR(dentry))
1991 		return ERR_CAST(dentry);
1992 	if (unlikely(!dentry)) {
1993 		dentry = lookup_slow(&nd->last, nd->path.dentry, nd->flags);
1994 		if (IS_ERR(dentry))
1995 			return ERR_CAST(dentry);
1996 	}
1997 	if (!(flags & WALK_MORE) && nd->depth)
1998 		put_link(nd);
1999 	return step_into(nd, flags, dentry);
2000 }
2001 
2002 /*
2003  * We can do the critical dentry name comparison and hashing
2004  * operations one word at a time, but we are limited to:
2005  *
2006  * - Architectures with fast unaligned word accesses. We could
2007  *   do a "get_unaligned()" if this helps and is sufficiently
2008  *   fast.
2009  *
2010  * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
2011  *   do not trap on the (extremely unlikely) case of a page
2012  *   crossing operation.
2013  *
2014  * - Furthermore, we need an efficient 64-bit compile for the
2015  *   64-bit case in order to generate the "number of bytes in
2016  *   the final mask". Again, that could be replaced with a
2017  *   efficient population count instruction or similar.
2018  */
2019 #ifdef CONFIG_DCACHE_WORD_ACCESS
2020 
2021 #include <asm/word-at-a-time.h>
2022 
2023 #ifdef HASH_MIX
2024 
2025 /* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */
2026 
2027 #elif defined(CONFIG_64BIT)
2028 /*
2029  * Register pressure in the mixing function is an issue, particularly
2030  * on 32-bit x86, but almost any function requires one state value and
2031  * one temporary.  Instead, use a function designed for two state values
2032  * and no temporaries.
2033  *
2034  * This function cannot create a collision in only two iterations, so
2035  * we have two iterations to achieve avalanche.  In those two iterations,
2036  * we have six layers of mixing, which is enough to spread one bit's
2037  * influence out to 2^6 = 64 state bits.
2038  *
2039  * Rotate constants are scored by considering either 64 one-bit input
2040  * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the
2041  * probability of that delta causing a change to each of the 128 output
2042  * bits, using a sample of random initial states.
2043  *
2044  * The Shannon entropy of the computed probabilities is then summed
2045  * to produce a score.  Ideally, any input change has a 50% chance of
2046  * toggling any given output bit.
2047  *
2048  * Mixing scores (in bits) for (12,45):
2049  * Input delta: 1-bit      2-bit
2050  * 1 round:     713.3    42542.6
2051  * 2 rounds:   2753.7   140389.8
2052  * 3 rounds:   5954.1   233458.2
2053  * 4 rounds:   7862.6   256672.2
2054  * Perfect:    8192     258048
2055  *            (64*128) (64*63/2 * 128)
2056  */
2057 #define HASH_MIX(x, y, a)	\
2058 	(	x ^= (a),	\
2059 	y ^= x,	x = rol64(x,12),\
2060 	x += y,	y = rol64(y,45),\
2061 	y *= 9			)
2062 
2063 /*
2064  * Fold two longs into one 32-bit hash value.  This must be fast, but
2065  * latency isn't quite as critical, as there is a fair bit of additional
2066  * work done before the hash value is used.
2067  */
fold_hash(unsigned long x,unsigned long y)2068 static inline unsigned int fold_hash(unsigned long x, unsigned long y)
2069 {
2070 	y ^= x * GOLDEN_RATIO_64;
2071 	y *= GOLDEN_RATIO_64;
2072 	return y >> 32;
2073 }
2074 
2075 #else	/* 32-bit case */
2076 
2077 /*
2078  * Mixing scores (in bits) for (7,20):
2079  * Input delta: 1-bit      2-bit
2080  * 1 round:     330.3     9201.6
2081  * 2 rounds:   1246.4    25475.4
2082  * 3 rounds:   1907.1    31295.1
2083  * 4 rounds:   2042.3    31718.6
2084  * Perfect:    2048      31744
2085  *            (32*64)   (32*31/2 * 64)
2086  */
2087 #define HASH_MIX(x, y, a)	\
2088 	(	x ^= (a),	\
2089 	y ^= x,	x = rol32(x, 7),\
2090 	x += y,	y = rol32(y,20),\
2091 	y *= 9			)
2092 
fold_hash(unsigned long x,unsigned long y)2093 static inline unsigned int fold_hash(unsigned long x, unsigned long y)
2094 {
2095 	/* Use arch-optimized multiply if one exists */
2096 	return __hash_32(y ^ __hash_32(x));
2097 }
2098 
2099 #endif
2100 
2101 /*
2102  * Return the hash of a string of known length.  This is carfully
2103  * designed to match hash_name(), which is the more critical function.
2104  * In particular, we must end by hashing a final word containing 0..7
2105  * payload bytes, to match the way that hash_name() iterates until it
2106  * finds the delimiter after the name.
2107  */
full_name_hash(const void * salt,const char * name,unsigned int len)2108 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2109 {
2110 	unsigned long a, x = 0, y = (unsigned long)salt;
2111 
2112 	for (;;) {
2113 		if (!len)
2114 			goto done;
2115 		a = load_unaligned_zeropad(name);
2116 		if (len < sizeof(unsigned long))
2117 			break;
2118 		HASH_MIX(x, y, a);
2119 		name += sizeof(unsigned long);
2120 		len -= sizeof(unsigned long);
2121 	}
2122 	x ^= a & bytemask_from_count(len);
2123 done:
2124 	return fold_hash(x, y);
2125 }
2126 EXPORT_SYMBOL(full_name_hash);
2127 
2128 /* Return the "hash_len" (hash and length) of a null-terminated string */
hashlen_string(const void * salt,const char * name)2129 u64 hashlen_string(const void *salt, const char *name)
2130 {
2131 	unsigned long a = 0, x = 0, y = (unsigned long)salt;
2132 	unsigned long adata, mask, len;
2133 	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
2134 
2135 	len = 0;
2136 	goto inside;
2137 
2138 	do {
2139 		HASH_MIX(x, y, a);
2140 		len += sizeof(unsigned long);
2141 inside:
2142 		a = load_unaligned_zeropad(name+len);
2143 	} while (!has_zero(a, &adata, &constants));
2144 
2145 	adata = prep_zero_mask(a, adata, &constants);
2146 	mask = create_zero_mask(adata);
2147 	x ^= a & zero_bytemask(mask);
2148 
2149 	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2150 }
2151 EXPORT_SYMBOL(hashlen_string);
2152 
2153 /*
2154  * Calculate the length and hash of the path component, and
2155  * return the "hash_len" as the result.
2156  */
hash_name(const void * salt,const char * name)2157 static inline u64 hash_name(const void *salt, const char *name)
2158 {
2159 	unsigned long a = 0, b, x = 0, y = (unsigned long)salt;
2160 	unsigned long adata, bdata, mask, len;
2161 	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
2162 
2163 	len = 0;
2164 	goto inside;
2165 
2166 	do {
2167 		HASH_MIX(x, y, a);
2168 		len += sizeof(unsigned long);
2169 inside:
2170 		a = load_unaligned_zeropad(name+len);
2171 		b = a ^ REPEAT_BYTE('/');
2172 	} while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
2173 
2174 	adata = prep_zero_mask(a, adata, &constants);
2175 	bdata = prep_zero_mask(b, bdata, &constants);
2176 	mask = create_zero_mask(adata | bdata);
2177 	x ^= a & zero_bytemask(mask);
2178 
2179 	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2180 }
2181 
2182 #else	/* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */
2183 
2184 /* Return the hash of a string of known length */
full_name_hash(const void * salt,const char * name,unsigned int len)2185 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2186 {
2187 	unsigned long hash = init_name_hash(salt);
2188 	while (len--)
2189 		hash = partial_name_hash((unsigned char)*name++, hash);
2190 	return end_name_hash(hash);
2191 }
2192 EXPORT_SYMBOL(full_name_hash);
2193 
2194 /* Return the "hash_len" (hash and length) of a null-terminated string */
hashlen_string(const void * salt,const char * name)2195 u64 hashlen_string(const void *salt, const char *name)
2196 {
2197 	unsigned long hash = init_name_hash(salt);
2198 	unsigned long len = 0, c;
2199 
2200 	c = (unsigned char)*name;
2201 	while (c) {
2202 		len++;
2203 		hash = partial_name_hash(c, hash);
2204 		c = (unsigned char)name[len];
2205 	}
2206 	return hashlen_create(end_name_hash(hash), len);
2207 }
2208 EXPORT_SYMBOL(hashlen_string);
2209 
2210 /*
2211  * We know there's a real path component here of at least
2212  * one character.
2213  */
hash_name(const void * salt,const char * name)2214 static inline u64 hash_name(const void *salt, const char *name)
2215 {
2216 	unsigned long hash = init_name_hash(salt);
2217 	unsigned long len = 0, c;
2218 
2219 	c = (unsigned char)*name;
2220 	do {
2221 		len++;
2222 		hash = partial_name_hash(c, hash);
2223 		c = (unsigned char)name[len];
2224 	} while (c && c != '/');
2225 	return hashlen_create(end_name_hash(hash), len);
2226 }
2227 
2228 #endif
2229 
2230 /*
2231  * Name resolution.
2232  * This is the basic name resolution function, turning a pathname into
2233  * the final dentry. We expect 'base' to be positive and a directory.
2234  *
2235  * Returns 0 and nd will have valid dentry and mnt on success.
2236  * Returns error and drops reference to input namei data on failure.
2237  */
link_path_walk(const char * name,struct nameidata * nd)2238 static int link_path_walk(const char *name, struct nameidata *nd)
2239 {
2240 	int depth = 0; // depth <= nd->depth
2241 	int err;
2242 
2243 	nd->last_type = LAST_ROOT;
2244 	nd->flags |= LOOKUP_PARENT;
2245 	if (IS_ERR(name))
2246 		return PTR_ERR(name);
2247 	while (*name=='/')
2248 		name++;
2249 	if (!*name) {
2250 		nd->dir_mode = 0; // short-circuit the 'hardening' idiocy
2251 		return 0;
2252 	}
2253 
2254 	/* At this point we know we have a real path component. */
2255 	for(;;) {
2256 		struct user_namespace *mnt_userns;
2257 		const char *link;
2258 		u64 hash_len;
2259 		int type;
2260 
2261 		mnt_userns = mnt_user_ns(nd->path.mnt);
2262 		err = may_lookup(mnt_userns, nd);
2263 		if (err)
2264 			return err;
2265 
2266 		hash_len = hash_name(nd->path.dentry, name);
2267 
2268 		type = LAST_NORM;
2269 		if (name[0] == '.') switch (hashlen_len(hash_len)) {
2270 			case 2:
2271 				if (name[1] == '.') {
2272 					type = LAST_DOTDOT;
2273 					nd->state |= ND_JUMPED;
2274 				}
2275 				break;
2276 			case 1:
2277 				type = LAST_DOT;
2278 		}
2279 		if (likely(type == LAST_NORM)) {
2280 			struct dentry *parent = nd->path.dentry;
2281 			nd->state &= ~ND_JUMPED;
2282 			if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
2283 				struct qstr this = { { .hash_len = hash_len }, .name = name };
2284 				err = parent->d_op->d_hash(parent, &this);
2285 				if (err < 0)
2286 					return err;
2287 				hash_len = this.hash_len;
2288 				name = this.name;
2289 			}
2290 		}
2291 
2292 		nd->last.hash_len = hash_len;
2293 		nd->last.name = name;
2294 		nd->last_type = type;
2295 
2296 		name += hashlen_len(hash_len);
2297 		if (!*name)
2298 			goto OK;
2299 		/*
2300 		 * If it wasn't NUL, we know it was '/'. Skip that
2301 		 * slash, and continue until no more slashes.
2302 		 */
2303 		do {
2304 			name++;
2305 		} while (unlikely(*name == '/'));
2306 		if (unlikely(!*name)) {
2307 OK:
2308 			/* pathname or trailing symlink, done */
2309 			if (!depth) {
2310 				nd->dir_uid = i_uid_into_mnt(mnt_userns, nd->inode);
2311 				nd->dir_mode = nd->inode->i_mode;
2312 				nd->flags &= ~LOOKUP_PARENT;
2313 				return 0;
2314 			}
2315 			/* last component of nested symlink */
2316 			name = nd->stack[--depth].name;
2317 			link = walk_component(nd, 0);
2318 		} else {
2319 			/* not the last component */
2320 			link = walk_component(nd, WALK_MORE);
2321 		}
2322 		if (unlikely(link)) {
2323 			if (IS_ERR(link))
2324 				return PTR_ERR(link);
2325 			/* a symlink to follow */
2326 			nd->stack[depth++].name = name;
2327 			name = link;
2328 			continue;
2329 		}
2330 		if (unlikely(!d_can_lookup(nd->path.dentry))) {
2331 			if (nd->flags & LOOKUP_RCU) {
2332 				if (!try_to_unlazy(nd))
2333 					return -ECHILD;
2334 			}
2335 			return -ENOTDIR;
2336 		}
2337 	}
2338 }
2339 
2340 /* must be paired with terminate_walk() */
path_init(struct nameidata * nd,unsigned flags)2341 static const char *path_init(struct nameidata *nd, unsigned flags)
2342 {
2343 	int error;
2344 	const char *s = nd->name->name;
2345 
2346 	/* LOOKUP_CACHED requires RCU, ask caller to retry */
2347 	if ((flags & (LOOKUP_RCU | LOOKUP_CACHED)) == LOOKUP_CACHED)
2348 		return ERR_PTR(-EAGAIN);
2349 
2350 	if (!*s)
2351 		flags &= ~LOOKUP_RCU;
2352 	if (flags & LOOKUP_RCU)
2353 		rcu_read_lock();
2354 	else
2355 		nd->seq = nd->next_seq = 0;
2356 
2357 	nd->flags = flags;
2358 	nd->state |= ND_JUMPED;
2359 
2360 	nd->m_seq = __read_seqcount_begin(&mount_lock.seqcount);
2361 	nd->r_seq = __read_seqcount_begin(&rename_lock.seqcount);
2362 	smp_rmb();
2363 
2364 	if (nd->state & ND_ROOT_PRESET) {
2365 		struct dentry *root = nd->root.dentry;
2366 		struct inode *inode = root->d_inode;
2367 		if (*s && unlikely(!d_can_lookup(root)))
2368 			return ERR_PTR(-ENOTDIR);
2369 		nd->path = nd->root;
2370 		nd->inode = inode;
2371 		if (flags & LOOKUP_RCU) {
2372 			nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2373 			nd->root_seq = nd->seq;
2374 		} else {
2375 			path_get(&nd->path);
2376 		}
2377 		return s;
2378 	}
2379 
2380 	nd->root.mnt = NULL;
2381 
2382 	/* Absolute pathname -- fetch the root (LOOKUP_IN_ROOT uses nd->dfd). */
2383 	if (*s == '/' && !(flags & LOOKUP_IN_ROOT)) {
2384 		error = nd_jump_root(nd);
2385 		if (unlikely(error))
2386 			return ERR_PTR(error);
2387 		return s;
2388 	}
2389 
2390 	/* Relative pathname -- get the starting-point it is relative to. */
2391 	if (nd->dfd == AT_FDCWD) {
2392 		if (flags & LOOKUP_RCU) {
2393 			struct fs_struct *fs = current->fs;
2394 			unsigned seq;
2395 
2396 			do {
2397 				seq = read_seqcount_begin(&fs->seq);
2398 				nd->path = fs->pwd;
2399 				nd->inode = nd->path.dentry->d_inode;
2400 				nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2401 			} while (read_seqcount_retry(&fs->seq, seq));
2402 		} else {
2403 			get_fs_pwd(current->fs, &nd->path);
2404 			nd->inode = nd->path.dentry->d_inode;
2405 		}
2406 	} else {
2407 		/* Caller must check execute permissions on the starting path component */
2408 		struct fd f = fdget_raw(nd->dfd);
2409 		struct dentry *dentry;
2410 
2411 		if (!f.file)
2412 			return ERR_PTR(-EBADF);
2413 
2414 		dentry = f.file->f_path.dentry;
2415 
2416 		if (*s && unlikely(!d_can_lookup(dentry))) {
2417 			fdput(f);
2418 			return ERR_PTR(-ENOTDIR);
2419 		}
2420 
2421 		nd->path = f.file->f_path;
2422 		if (flags & LOOKUP_RCU) {
2423 			nd->inode = nd->path.dentry->d_inode;
2424 			nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2425 		} else {
2426 			path_get(&nd->path);
2427 			nd->inode = nd->path.dentry->d_inode;
2428 		}
2429 		fdput(f);
2430 	}
2431 
2432 	/* For scoped-lookups we need to set the root to the dirfd as well. */
2433 	if (flags & LOOKUP_IS_SCOPED) {
2434 		nd->root = nd->path;
2435 		if (flags & LOOKUP_RCU) {
2436 			nd->root_seq = nd->seq;
2437 		} else {
2438 			path_get(&nd->root);
2439 			nd->state |= ND_ROOT_GRABBED;
2440 		}
2441 	}
2442 	return s;
2443 }
2444 
lookup_last(struct nameidata * nd)2445 static inline const char *lookup_last(struct nameidata *nd)
2446 {
2447 	if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
2448 		nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2449 
2450 	return walk_component(nd, WALK_TRAILING);
2451 }
2452 
handle_lookup_down(struct nameidata * nd)2453 static int handle_lookup_down(struct nameidata *nd)
2454 {
2455 	if (!(nd->flags & LOOKUP_RCU))
2456 		dget(nd->path.dentry);
2457 	nd->next_seq = nd->seq;
2458 	return PTR_ERR(step_into(nd, WALK_NOFOLLOW, nd->path.dentry));
2459 }
2460 
2461 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
path_lookupat(struct nameidata * nd,unsigned flags,struct path * path)2462 static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2463 {
2464 	const char *s = path_init(nd, flags);
2465 	int err;
2466 
2467 	if (unlikely(flags & LOOKUP_DOWN) && !IS_ERR(s)) {
2468 		err = handle_lookup_down(nd);
2469 		if (unlikely(err < 0))
2470 			s = ERR_PTR(err);
2471 	}
2472 
2473 	while (!(err = link_path_walk(s, nd)) &&
2474 	       (s = lookup_last(nd)) != NULL)
2475 		;
2476 	if (!err && unlikely(nd->flags & LOOKUP_MOUNTPOINT)) {
2477 		err = handle_lookup_down(nd);
2478 		nd->state &= ~ND_JUMPED; // no d_weak_revalidate(), please...
2479 	}
2480 	if (!err)
2481 		err = complete_walk(nd);
2482 
2483 	if (!err && nd->flags & LOOKUP_DIRECTORY)
2484 		if (!d_can_lookup(nd->path.dentry))
2485 			err = -ENOTDIR;
2486 	if (!err) {
2487 		*path = nd->path;
2488 		nd->path.mnt = NULL;
2489 		nd->path.dentry = NULL;
2490 	}
2491 	terminate_walk(nd);
2492 	return err;
2493 }
2494 
filename_lookup(int dfd,struct filename * name,unsigned flags,struct path * path,struct path * root)2495 int filename_lookup(int dfd, struct filename *name, unsigned flags,
2496 		    struct path *path, struct path *root)
2497 {
2498 	int retval;
2499 	struct nameidata nd;
2500 	if (IS_ERR(name))
2501 		return PTR_ERR(name);
2502 	set_nameidata(&nd, dfd, name, root);
2503 	retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
2504 	if (unlikely(retval == -ECHILD))
2505 		retval = path_lookupat(&nd, flags, path);
2506 	if (unlikely(retval == -ESTALE))
2507 		retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
2508 
2509 	if (likely(!retval))
2510 		audit_inode(name, path->dentry,
2511 			    flags & LOOKUP_MOUNTPOINT ? AUDIT_INODE_NOEVAL : 0);
2512 	restore_nameidata();
2513 	return retval;
2514 }
2515 
2516 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
path_parentat(struct nameidata * nd,unsigned flags,struct path * parent)2517 static int path_parentat(struct nameidata *nd, unsigned flags,
2518 				struct path *parent)
2519 {
2520 	const char *s = path_init(nd, flags);
2521 	int err = link_path_walk(s, nd);
2522 	if (!err)
2523 		err = complete_walk(nd);
2524 	if (!err) {
2525 		*parent = nd->path;
2526 		nd->path.mnt = NULL;
2527 		nd->path.dentry = NULL;
2528 	}
2529 	terminate_walk(nd);
2530 	return err;
2531 }
2532 
2533 /* Note: this does not consume "name" */
filename_parentat(int dfd,struct filename * name,unsigned int flags,struct path * parent,struct qstr * last,int * type)2534 static int filename_parentat(int dfd, struct filename *name,
2535 			     unsigned int flags, struct path *parent,
2536 			     struct qstr *last, int *type)
2537 {
2538 	int retval;
2539 	struct nameidata nd;
2540 
2541 	if (IS_ERR(name))
2542 		return PTR_ERR(name);
2543 	set_nameidata(&nd, dfd, name, NULL);
2544 	retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
2545 	if (unlikely(retval == -ECHILD))
2546 		retval = path_parentat(&nd, flags, parent);
2547 	if (unlikely(retval == -ESTALE))
2548 		retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
2549 	if (likely(!retval)) {
2550 		*last = nd.last;
2551 		*type = nd.last_type;
2552 		audit_inode(name, parent->dentry, AUDIT_INODE_PARENT);
2553 	}
2554 	restore_nameidata();
2555 	return retval;
2556 }
2557 
2558 /* does lookup, returns the object with parent locked */
__kern_path_locked(struct filename * name,struct path * path)2559 static struct dentry *__kern_path_locked(struct filename *name, struct path *path)
2560 {
2561 	struct dentry *d;
2562 	struct qstr last;
2563 	int type, error;
2564 
2565 	error = filename_parentat(AT_FDCWD, name, 0, path, &last, &type);
2566 	if (error)
2567 		return ERR_PTR(error);
2568 	if (unlikely(type != LAST_NORM)) {
2569 		path_put(path);
2570 		return ERR_PTR(-EINVAL);
2571 	}
2572 	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
2573 	d = __lookup_hash(&last, path->dentry, 0);
2574 	if (IS_ERR(d)) {
2575 		inode_unlock(path->dentry->d_inode);
2576 		path_put(path);
2577 	}
2578 	return d;
2579 }
2580 
kern_path_locked(const char * name,struct path * path)2581 struct dentry *kern_path_locked(const char *name, struct path *path)
2582 {
2583 	struct filename *filename = getname_kernel(name);
2584 	struct dentry *res = __kern_path_locked(filename, path);
2585 
2586 	putname(filename);
2587 	return res;
2588 }
2589 
kern_path(const char * name,unsigned int flags,struct path * path)2590 int kern_path(const char *name, unsigned int flags, struct path *path)
2591 {
2592 	struct filename *filename = getname_kernel(name);
2593 	int ret = filename_lookup(AT_FDCWD, filename, flags, path, NULL);
2594 
2595 	putname(filename);
2596 	return ret;
2597 
2598 }
2599 EXPORT_SYMBOL(kern_path);
2600 
2601 /**
2602  * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
2603  * @dentry:  pointer to dentry of the base directory
2604  * @mnt: pointer to vfs mount of the base directory
2605  * @name: pointer to file name
2606  * @flags: lookup flags
2607  * @path: pointer to struct path to fill
2608  */
vfs_path_lookup(struct dentry * dentry,struct vfsmount * mnt,const char * name,unsigned int flags,struct path * path)2609 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
2610 		    const char *name, unsigned int flags,
2611 		    struct path *path)
2612 {
2613 	struct filename *filename;
2614 	struct path root = {.mnt = mnt, .dentry = dentry};
2615 	int ret;
2616 
2617 	filename = getname_kernel(name);
2618 	/* the first argument of filename_lookup() is ignored with root */
2619 	ret = filename_lookup(AT_FDCWD, filename, flags, path, &root);
2620 	putname(filename);
2621 	return ret;
2622 }
2623 EXPORT_SYMBOL(vfs_path_lookup);
2624 
lookup_one_common(struct user_namespace * mnt_userns,const char * name,struct dentry * base,int len,struct qstr * this)2625 static int lookup_one_common(struct user_namespace *mnt_userns,
2626 			     const char *name, struct dentry *base, int len,
2627 			     struct qstr *this)
2628 {
2629 	this->name = name;
2630 	this->len = len;
2631 	this->hash = full_name_hash(base, name, len);
2632 	if (!len)
2633 		return -EACCES;
2634 
2635 	if (unlikely(name[0] == '.')) {
2636 		if (len < 2 || (len == 2 && name[1] == '.'))
2637 			return -EACCES;
2638 	}
2639 
2640 	while (len--) {
2641 		unsigned int c = *(const unsigned char *)name++;
2642 		if (c == '/' || c == '\0')
2643 			return -EACCES;
2644 	}
2645 	/*
2646 	 * See if the low-level filesystem might want
2647 	 * to use its own hash..
2648 	 */
2649 	if (base->d_flags & DCACHE_OP_HASH) {
2650 		int err = base->d_op->d_hash(base, this);
2651 		if (err < 0)
2652 			return err;
2653 	}
2654 
2655 	return inode_permission(mnt_userns, base->d_inode, MAY_EXEC);
2656 }
2657 
2658 /**
2659  * try_lookup_one_len - filesystem helper to lookup single pathname component
2660  * @name:	pathname component to lookup
2661  * @base:	base directory to lookup from
2662  * @len:	maximum length @len should be interpreted to
2663  *
2664  * Look up a dentry by name in the dcache, returning NULL if it does not
2665  * currently exist.  The function does not try to create a dentry.
2666  *
2667  * Note that this routine is purely a helper for filesystem usage and should
2668  * not be called by generic code.
2669  *
2670  * The caller must hold base->i_mutex.
2671  */
try_lookup_one_len(const char * name,struct dentry * base,int len)2672 struct dentry *try_lookup_one_len(const char *name, struct dentry *base, int len)
2673 {
2674 	struct qstr this;
2675 	int err;
2676 
2677 	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2678 
2679 	err = lookup_one_common(&init_user_ns, name, base, len, &this);
2680 	if (err)
2681 		return ERR_PTR(err);
2682 
2683 	return lookup_dcache(&this, base, 0);
2684 }
2685 EXPORT_SYMBOL(try_lookup_one_len);
2686 
2687 /**
2688  * lookup_one_len - filesystem helper to lookup single pathname component
2689  * @name:	pathname component to lookup
2690  * @base:	base directory to lookup from
2691  * @len:	maximum length @len should be interpreted to
2692  *
2693  * Note that this routine is purely a helper for filesystem usage and should
2694  * not be called by generic code.
2695  *
2696  * The caller must hold base->i_mutex.
2697  */
lookup_one_len(const char * name,struct dentry * base,int len)2698 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
2699 {
2700 	struct dentry *dentry;
2701 	struct qstr this;
2702 	int err;
2703 
2704 	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2705 
2706 	err = lookup_one_common(&init_user_ns, name, base, len, &this);
2707 	if (err)
2708 		return ERR_PTR(err);
2709 
2710 	dentry = lookup_dcache(&this, base, 0);
2711 	return dentry ? dentry : __lookup_slow(&this, base, 0);
2712 }
2713 EXPORT_SYMBOL(lookup_one_len);
2714 
2715 /**
2716  * lookup_one - filesystem helper to lookup single pathname component
2717  * @mnt_userns:	user namespace of the mount the lookup is performed from
2718  * @name:	pathname component to lookup
2719  * @base:	base directory to lookup from
2720  * @len:	maximum length @len should be interpreted to
2721  *
2722  * Note that this routine is purely a helper for filesystem usage and should
2723  * not be called by generic code.
2724  *
2725  * The caller must hold base->i_mutex.
2726  */
lookup_one(struct user_namespace * mnt_userns,const char * name,struct dentry * base,int len)2727 struct dentry *lookup_one(struct user_namespace *mnt_userns, const char *name,
2728 			  struct dentry *base, int len)
2729 {
2730 	struct dentry *dentry;
2731 	struct qstr this;
2732 	int err;
2733 
2734 	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2735 
2736 	err = lookup_one_common(mnt_userns, name, base, len, &this);
2737 	if (err)
2738 		return ERR_PTR(err);
2739 
2740 	dentry = lookup_dcache(&this, base, 0);
2741 	return dentry ? dentry : __lookup_slow(&this, base, 0);
2742 }
2743 EXPORT_SYMBOL(lookup_one);
2744 
2745 /**
2746  * lookup_one_unlocked - filesystem helper to lookup single pathname component
2747  * @mnt_userns:	idmapping of the mount the lookup is performed from
2748  * @name:	pathname component to lookup
2749  * @base:	base directory to lookup from
2750  * @len:	maximum length @len should be interpreted to
2751  *
2752  * Note that this routine is purely a helper for filesystem usage and should
2753  * not be called by generic code.
2754  *
2755  * Unlike lookup_one_len, it should be called without the parent
2756  * i_mutex held, and will take the i_mutex itself if necessary.
2757  */
lookup_one_unlocked(struct user_namespace * mnt_userns,const char * name,struct dentry * base,int len)2758 struct dentry *lookup_one_unlocked(struct user_namespace *mnt_userns,
2759 				   const char *name, struct dentry *base,
2760 				   int len)
2761 {
2762 	struct qstr this;
2763 	int err;
2764 	struct dentry *ret;
2765 
2766 	err = lookup_one_common(mnt_userns, name, base, len, &this);
2767 	if (err)
2768 		return ERR_PTR(err);
2769 
2770 	ret = lookup_dcache(&this, base, 0);
2771 	if (!ret)
2772 		ret = lookup_slow(&this, base, 0);
2773 	return ret;
2774 }
2775 EXPORT_SYMBOL(lookup_one_unlocked);
2776 
2777 /**
2778  * lookup_one_positive_unlocked - filesystem helper to lookup single
2779  *				  pathname component
2780  * @mnt_userns:	idmapping of the mount the lookup is performed from
2781  * @name:	pathname component to lookup
2782  * @base:	base directory to lookup from
2783  * @len:	maximum length @len should be interpreted to
2784  *
2785  * This helper will yield ERR_PTR(-ENOENT) on negatives. The helper returns
2786  * known positive or ERR_PTR(). This is what most of the users want.
2787  *
2788  * Note that pinned negative with unlocked parent _can_ become positive at any
2789  * time, so callers of lookup_one_unlocked() need to be very careful; pinned
2790  * positives have >d_inode stable, so this one avoids such problems.
2791  *
2792  * Note that this routine is purely a helper for filesystem usage and should
2793  * not be called by generic code.
2794  *
2795  * The helper should be called without i_mutex held.
2796  */
lookup_one_positive_unlocked(struct user_namespace * mnt_userns,const char * name,struct dentry * base,int len)2797 struct dentry *lookup_one_positive_unlocked(struct user_namespace *mnt_userns,
2798 					    const char *name,
2799 					    struct dentry *base, int len)
2800 {
2801 	struct dentry *ret = lookup_one_unlocked(mnt_userns, name, base, len);
2802 
2803 	if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) {
2804 		dput(ret);
2805 		ret = ERR_PTR(-ENOENT);
2806 	}
2807 	return ret;
2808 }
2809 EXPORT_SYMBOL(lookup_one_positive_unlocked);
2810 
2811 /**
2812  * lookup_one_len_unlocked - filesystem helper to lookup single pathname component
2813  * @name:	pathname component to lookup
2814  * @base:	base directory to lookup from
2815  * @len:	maximum length @len should be interpreted to
2816  *
2817  * Note that this routine is purely a helper for filesystem usage and should
2818  * not be called by generic code.
2819  *
2820  * Unlike lookup_one_len, it should be called without the parent
2821  * i_mutex held, and will take the i_mutex itself if necessary.
2822  */
lookup_one_len_unlocked(const char * name,struct dentry * base,int len)2823 struct dentry *lookup_one_len_unlocked(const char *name,
2824 				       struct dentry *base, int len)
2825 {
2826 	return lookup_one_unlocked(&init_user_ns, name, base, len);
2827 }
2828 EXPORT_SYMBOL(lookup_one_len_unlocked);
2829 
2830 /*
2831  * Like lookup_one_len_unlocked(), except that it yields ERR_PTR(-ENOENT)
2832  * on negatives.  Returns known positive or ERR_PTR(); that's what
2833  * most of the users want.  Note that pinned negative with unlocked parent
2834  * _can_ become positive at any time, so callers of lookup_one_len_unlocked()
2835  * need to be very careful; pinned positives have ->d_inode stable, so
2836  * this one avoids such problems.
2837  */
lookup_positive_unlocked(const char * name,struct dentry * base,int len)2838 struct dentry *lookup_positive_unlocked(const char *name,
2839 				       struct dentry *base, int len)
2840 {
2841 	return lookup_one_positive_unlocked(&init_user_ns, name, base, len);
2842 }
2843 EXPORT_SYMBOL(lookup_positive_unlocked);
2844 
2845 #ifdef CONFIG_UNIX98_PTYS
path_pts(struct path * path)2846 int path_pts(struct path *path)
2847 {
2848 	/* Find something mounted on "pts" in the same directory as
2849 	 * the input path.
2850 	 */
2851 	struct dentry *parent = dget_parent(path->dentry);
2852 	struct dentry *child;
2853 	struct qstr this = QSTR_INIT("pts", 3);
2854 
2855 	if (unlikely(!path_connected(path->mnt, parent))) {
2856 		dput(parent);
2857 		return -ENOENT;
2858 	}
2859 	dput(path->dentry);
2860 	path->dentry = parent;
2861 	child = d_hash_and_lookup(parent, &this);
2862 	if (!child)
2863 		return -ENOENT;
2864 
2865 	path->dentry = child;
2866 	dput(parent);
2867 	follow_down(path);
2868 	return 0;
2869 }
2870 #endif
2871 
user_path_at_empty(int dfd,const char __user * name,unsigned flags,struct path * path,int * empty)2872 int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
2873 		 struct path *path, int *empty)
2874 {
2875 	struct filename *filename = getname_flags(name, flags, empty);
2876 	int ret = filename_lookup(dfd, filename, flags, path, NULL);
2877 
2878 	putname(filename);
2879 	return ret;
2880 }
2881 EXPORT_SYMBOL(user_path_at_empty);
2882 
__check_sticky(struct user_namespace * mnt_userns,struct inode * dir,struct inode * inode)2883 int __check_sticky(struct user_namespace *mnt_userns, struct inode *dir,
2884 		   struct inode *inode)
2885 {
2886 	kuid_t fsuid = current_fsuid();
2887 
2888 	if (uid_eq(i_uid_into_mnt(mnt_userns, inode), fsuid))
2889 		return 0;
2890 	if (uid_eq(i_uid_into_mnt(mnt_userns, dir), fsuid))
2891 		return 0;
2892 	return !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FOWNER);
2893 }
2894 EXPORT_SYMBOL(__check_sticky);
2895 
2896 /*
2897  *	Check whether we can remove a link victim from directory dir, check
2898  *  whether the type of victim is right.
2899  *  1. We can't do it if dir is read-only (done in permission())
2900  *  2. We should have write and exec permissions on dir
2901  *  3. We can't remove anything from append-only dir
2902  *  4. We can't do anything with immutable dir (done in permission())
2903  *  5. If the sticky bit on dir is set we should either
2904  *	a. be owner of dir, or
2905  *	b. be owner of victim, or
2906  *	c. have CAP_FOWNER capability
2907  *  6. If the victim is append-only or immutable we can't do antyhing with
2908  *     links pointing to it.
2909  *  7. If the victim has an unknown uid or gid we can't change the inode.
2910  *  8. If we were asked to remove a directory and victim isn't one - ENOTDIR.
2911  *  9. If we were asked to remove a non-directory and victim isn't one - EISDIR.
2912  * 10. We can't remove a root or mountpoint.
2913  * 11. We don't allow removal of NFS sillyrenamed files; it's handled by
2914  *     nfs_async_unlink().
2915  */
may_delete(struct user_namespace * mnt_userns,struct inode * dir,struct dentry * victim,bool isdir)2916 static int may_delete(struct user_namespace *mnt_userns, struct inode *dir,
2917 		      struct dentry *victim, bool isdir)
2918 {
2919 	struct inode *inode = d_backing_inode(victim);
2920 	int error;
2921 
2922 	if (d_is_negative(victim))
2923 		return -ENOENT;
2924 	BUG_ON(!inode);
2925 
2926 	BUG_ON(victim->d_parent->d_inode != dir);
2927 
2928 	/* Inode writeback is not safe when the uid or gid are invalid. */
2929 	if (!uid_valid(i_uid_into_mnt(mnt_userns, inode)) ||
2930 	    !gid_valid(i_gid_into_mnt(mnt_userns, inode)))
2931 		return -EOVERFLOW;
2932 
2933 	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2934 
2935 	error = inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC);
2936 	if (error)
2937 		return error;
2938 	if (IS_APPEND(dir))
2939 		return -EPERM;
2940 
2941 	if (check_sticky(mnt_userns, dir, inode) || IS_APPEND(inode) ||
2942 	    IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) ||
2943 	    HAS_UNMAPPED_ID(mnt_userns, inode))
2944 		return -EPERM;
2945 	if (isdir) {
2946 		if (!d_is_dir(victim))
2947 			return -ENOTDIR;
2948 		if (IS_ROOT(victim))
2949 			return -EBUSY;
2950 	} else if (d_is_dir(victim))
2951 		return -EISDIR;
2952 	if (IS_DEADDIR(dir))
2953 		return -ENOENT;
2954 	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
2955 		return -EBUSY;
2956 	return 0;
2957 }
2958 
2959 /*	Check whether we can create an object with dentry child in directory
2960  *  dir.
2961  *  1. We can't do it if child already exists (open has special treatment for
2962  *     this case, but since we are inlined it's OK)
2963  *  2. We can't do it if dir is read-only (done in permission())
2964  *  3. We can't do it if the fs can't represent the fsuid or fsgid.
2965  *  4. We should have write and exec permissions on dir
2966  *  5. We can't do it if dir is immutable (done in permission())
2967  */
may_create(struct user_namespace * mnt_userns,struct inode * dir,struct dentry * child)2968 static inline int may_create(struct user_namespace *mnt_userns,
2969 			     struct inode *dir, struct dentry *child)
2970 {
2971 	audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
2972 	if (child->d_inode)
2973 		return -EEXIST;
2974 	if (IS_DEADDIR(dir))
2975 		return -ENOENT;
2976 	if (!fsuidgid_has_mapping(dir->i_sb, mnt_userns))
2977 		return -EOVERFLOW;
2978 
2979 	return inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC);
2980 }
2981 
2982 /*
2983  * p1 and p2 should be directories on the same fs.
2984  */
lock_rename(struct dentry * p1,struct dentry * p2)2985 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
2986 {
2987 	struct dentry *p;
2988 
2989 	if (p1 == p2) {
2990 		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
2991 		return NULL;
2992 	}
2993 
2994 	mutex_lock(&p1->d_sb->s_vfs_rename_mutex);
2995 
2996 	p = d_ancestor(p2, p1);
2997 	if (p) {
2998 		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
2999 		inode_lock_nested(p1->d_inode, I_MUTEX_CHILD);
3000 		return p;
3001 	}
3002 
3003 	p = d_ancestor(p1, p2);
3004 	if (p) {
3005 		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
3006 		inode_lock_nested(p2->d_inode, I_MUTEX_CHILD);
3007 		return p;
3008 	}
3009 
3010 	inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
3011 	inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
3012 	return NULL;
3013 }
3014 EXPORT_SYMBOL(lock_rename);
3015 
unlock_rename(struct dentry * p1,struct dentry * p2)3016 void unlock_rename(struct dentry *p1, struct dentry *p2)
3017 {
3018 	inode_unlock(p1->d_inode);
3019 	if (p1 != p2) {
3020 		inode_unlock(p2->d_inode);
3021 		mutex_unlock(&p1->d_sb->s_vfs_rename_mutex);
3022 	}
3023 }
3024 EXPORT_SYMBOL(unlock_rename);
3025 
3026 /**
3027  * mode_strip_umask - handle vfs umask stripping
3028  * @dir:	parent directory of the new inode
3029  * @mode:	mode of the new inode to be created in @dir
3030  *
3031  * Umask stripping depends on whether or not the filesystem supports POSIX
3032  * ACLs. If the filesystem doesn't support it umask stripping is done directly
3033  * in here. If the filesystem does support POSIX ACLs umask stripping is
3034  * deferred until the filesystem calls posix_acl_create().
3035  *
3036  * Returns: mode
3037  */
mode_strip_umask(const struct inode * dir,umode_t mode)3038 static inline umode_t mode_strip_umask(const struct inode *dir, umode_t mode)
3039 {
3040 	if (!IS_POSIXACL(dir))
3041 		mode &= ~current_umask();
3042 	return mode;
3043 }
3044 
3045 /**
3046  * vfs_prepare_mode - prepare the mode to be used for a new inode
3047  * @mnt_userns:		user namespace of the mount the inode was found from
3048  * @dir:	parent directory of the new inode
3049  * @mode:	mode of the new inode
3050  * @mask_perms:	allowed permission by the vfs
3051  * @type:	type of file to be created
3052  *
3053  * This helper consolidates and enforces vfs restrictions on the @mode of a new
3054  * object to be created.
3055  *
3056  * Umask stripping depends on whether the filesystem supports POSIX ACLs (see
3057  * the kernel documentation for mode_strip_umask()). Moving umask stripping
3058  * after setgid stripping allows the same ordering for both non-POSIX ACL and
3059  * POSIX ACL supporting filesystems.
3060  *
3061  * Note that it's currently valid for @type to be 0 if a directory is created.
3062  * Filesystems raise that flag individually and we need to check whether each
3063  * filesystem can deal with receiving S_IFDIR from the vfs before we enforce a
3064  * non-zero type.
3065  *
3066  * Returns: mode to be passed to the filesystem
3067  */
vfs_prepare_mode(struct user_namespace * mnt_userns,const struct inode * dir,umode_t mode,umode_t mask_perms,umode_t type)3068 static inline umode_t vfs_prepare_mode(struct user_namespace *mnt_userns,
3069 				       const struct inode *dir, umode_t mode,
3070 				       umode_t mask_perms, umode_t type)
3071 {
3072 	mode = mode_strip_sgid(mnt_userns, dir, mode);
3073 	mode = mode_strip_umask(dir, mode);
3074 
3075 	/*
3076 	 * Apply the vfs mandated allowed permission mask and set the type of
3077 	 * file to be created before we call into the filesystem.
3078 	 */
3079 	mode &= (mask_perms & ~S_IFMT);
3080 	mode |= (type & S_IFMT);
3081 
3082 	return mode;
3083 }
3084 
3085 /**
3086  * vfs_create - create new file
3087  * @mnt_userns:	user namespace of the mount the inode was found from
3088  * @dir:	inode of @dentry
3089  * @dentry:	pointer to dentry of the base directory
3090  * @mode:	mode of the new file
3091  * @want_excl:	whether the file must not yet exist
3092  *
3093  * Create a new file.
3094  *
3095  * If the inode has been found through an idmapped mount the user namespace of
3096  * the vfsmount must be passed through @mnt_userns. This function will then take
3097  * care to map the inode according to @mnt_userns before checking permissions.
3098  * On non-idmapped mounts or if permission checking is to be performed on the
3099  * raw inode simply passs init_user_ns.
3100  */
vfs_create(struct user_namespace * mnt_userns,struct inode * dir,struct dentry * dentry,umode_t mode,bool want_excl)3101 int vfs_create(struct user_namespace *mnt_userns, struct inode *dir,
3102 	       struct dentry *dentry, umode_t mode, bool want_excl)
3103 {
3104 	int error = may_create(mnt_userns, dir, dentry);
3105 	if (error)
3106 		return error;
3107 
3108 	if (!dir->i_op->create)
3109 		return -EACCES;	/* shouldn't it be ENOSYS? */
3110 
3111 	mode = vfs_prepare_mode(mnt_userns, dir, mode, S_IALLUGO, S_IFREG);
3112 	error = security_inode_create(dir, dentry, mode);
3113 	if (error)
3114 		return error;
3115 	error = dir->i_op->create(mnt_userns, dir, dentry, mode, want_excl);
3116 	if (!error)
3117 		fsnotify_create(dir, dentry);
3118 	return error;
3119 }
3120 EXPORT_SYMBOL(vfs_create);
3121 
vfs_mkobj(struct dentry * dentry,umode_t mode,int (* f)(struct dentry *,umode_t,void *),void * arg)3122 int vfs_mkobj(struct dentry *dentry, umode_t mode,
3123 		int (*f)(struct dentry *, umode_t, void *),
3124 		void *arg)
3125 {
3126 	struct inode *dir = dentry->d_parent->d_inode;
3127 	int error = may_create(&init_user_ns, dir, dentry);
3128 	if (error)
3129 		return error;
3130 
3131 	mode &= S_IALLUGO;
3132 	mode |= S_IFREG;
3133 	error = security_inode_create(dir, dentry, mode);
3134 	if (error)
3135 		return error;
3136 	error = f(dentry, mode, arg);
3137 	if (!error)
3138 		fsnotify_create(dir, dentry);
3139 	return error;
3140 }
3141 EXPORT_SYMBOL(vfs_mkobj);
3142 
may_open_dev(const struct path * path)3143 bool may_open_dev(const struct path *path)
3144 {
3145 	return !(path->mnt->mnt_flags & MNT_NODEV) &&
3146 		!(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
3147 }
3148 
may_open(struct user_namespace * mnt_userns,const struct path * path,int acc_mode,int flag)3149 static int may_open(struct user_namespace *mnt_userns, const struct path *path,
3150 		    int acc_mode, int flag)
3151 {
3152 	struct dentry *dentry = path->dentry;
3153 	struct inode *inode = dentry->d_inode;
3154 	int error;
3155 
3156 	if (!inode)
3157 		return -ENOENT;
3158 
3159 	switch (inode->i_mode & S_IFMT) {
3160 	case S_IFLNK:
3161 		return -ELOOP;
3162 	case S_IFDIR:
3163 		if (acc_mode & MAY_WRITE)
3164 			return -EISDIR;
3165 		if (acc_mode & MAY_EXEC)
3166 			return -EACCES;
3167 		break;
3168 	case S_IFBLK:
3169 	case S_IFCHR:
3170 		if (!may_open_dev(path))
3171 			return -EACCES;
3172 		fallthrough;
3173 	case S_IFIFO:
3174 	case S_IFSOCK:
3175 		if (acc_mode & MAY_EXEC)
3176 			return -EACCES;
3177 		flag &= ~O_TRUNC;
3178 		break;
3179 	case S_IFREG:
3180 		if ((acc_mode & MAY_EXEC) && path_noexec(path))
3181 			return -EACCES;
3182 		break;
3183 	}
3184 
3185 	error = inode_permission(mnt_userns, inode, MAY_OPEN | acc_mode);
3186 	if (error)
3187 		return error;
3188 
3189 	/*
3190 	 * An append-only file must be opened in append mode for writing.
3191 	 */
3192 	if (IS_APPEND(inode)) {
3193 		if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
3194 			return -EPERM;
3195 		if (flag & O_TRUNC)
3196 			return -EPERM;
3197 	}
3198 
3199 	/* O_NOATIME can only be set by the owner or superuser */
3200 	if (flag & O_NOATIME && !inode_owner_or_capable(mnt_userns, inode))
3201 		return -EPERM;
3202 
3203 	return 0;
3204 }
3205 
handle_truncate(struct user_namespace * mnt_userns,struct file * filp)3206 static int handle_truncate(struct user_namespace *mnt_userns, struct file *filp)
3207 {
3208 	const struct path *path = &filp->f_path;
3209 	struct inode *inode = path->dentry->d_inode;
3210 	int error = get_write_access(inode);
3211 	if (error)
3212 		return error;
3213 
3214 	error = security_path_truncate(path);
3215 	if (!error) {
3216 		error = do_truncate(mnt_userns, path->dentry, 0,
3217 				    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
3218 				    filp);
3219 	}
3220 	put_write_access(inode);
3221 	return error;
3222 }
3223 
open_to_namei_flags(int flag)3224 static inline int open_to_namei_flags(int flag)
3225 {
3226 	if ((flag & O_ACCMODE) == 3)
3227 		flag--;
3228 	return flag;
3229 }
3230 
may_o_create(struct user_namespace * mnt_userns,const struct path * dir,struct dentry * dentry,umode_t mode)3231 static int may_o_create(struct user_namespace *mnt_userns,
3232 			const struct path *dir, struct dentry *dentry,
3233 			umode_t mode)
3234 {
3235 	int error = security_path_mknod(dir, dentry, mode, 0);
3236 	if (error)
3237 		return error;
3238 
3239 	if (!fsuidgid_has_mapping(dir->dentry->d_sb, mnt_userns))
3240 		return -EOVERFLOW;
3241 
3242 	error = inode_permission(mnt_userns, dir->dentry->d_inode,
3243 				 MAY_WRITE | MAY_EXEC);
3244 	if (error)
3245 		return error;
3246 
3247 	return security_inode_create(dir->dentry->d_inode, dentry, mode);
3248 }
3249 
3250 /*
3251  * Attempt to atomically look up, create and open a file from a negative
3252  * dentry.
3253  *
3254  * Returns 0 if successful.  The file will have been created and attached to
3255  * @file by the filesystem calling finish_open().
3256  *
3257  * If the file was looked up only or didn't need creating, FMODE_OPENED won't
3258  * be set.  The caller will need to perform the open themselves.  @path will
3259  * have been updated to point to the new dentry.  This may be negative.
3260  *
3261  * Returns an error code otherwise.
3262  */
atomic_open(struct nameidata * nd,struct dentry * dentry,struct file * file,int open_flag,umode_t mode)3263 static struct dentry *atomic_open(struct nameidata *nd, struct dentry *dentry,
3264 				  struct file *file,
3265 				  int open_flag, umode_t mode)
3266 {
3267 	struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
3268 	struct inode *dir =  nd->path.dentry->d_inode;
3269 	int error;
3270 
3271 	if (nd->flags & LOOKUP_DIRECTORY)
3272 		open_flag |= O_DIRECTORY;
3273 
3274 	file->f_path.dentry = DENTRY_NOT_SET;
3275 	file->f_path.mnt = nd->path.mnt;
3276 	error = dir->i_op->atomic_open(dir, dentry, file,
3277 				       open_to_namei_flags(open_flag), mode);
3278 	d_lookup_done(dentry);
3279 	if (!error) {
3280 		if (file->f_mode & FMODE_OPENED) {
3281 			if (unlikely(dentry != file->f_path.dentry)) {
3282 				dput(dentry);
3283 				dentry = dget(file->f_path.dentry);
3284 			}
3285 		} else if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
3286 			error = -EIO;
3287 		} else {
3288 			if (file->f_path.dentry) {
3289 				dput(dentry);
3290 				dentry = file->f_path.dentry;
3291 			}
3292 			if (unlikely(d_is_negative(dentry)))
3293 				error = -ENOENT;
3294 		}
3295 	}
3296 	if (error) {
3297 		dput(dentry);
3298 		dentry = ERR_PTR(error);
3299 	}
3300 	return dentry;
3301 }
3302 
3303 /*
3304  * Look up and maybe create and open the last component.
3305  *
3306  * Must be called with parent locked (exclusive in O_CREAT case).
3307  *
3308  * Returns 0 on success, that is, if
3309  *  the file was successfully atomically created (if necessary) and opened, or
3310  *  the file was not completely opened at this time, though lookups and
3311  *  creations were performed.
3312  * These case are distinguished by presence of FMODE_OPENED on file->f_mode.
3313  * In the latter case dentry returned in @path might be negative if O_CREAT
3314  * hadn't been specified.
3315  *
3316  * An error code is returned on failure.
3317  */
lookup_open(struct nameidata * nd,struct file * file,const struct open_flags * op,bool got_write)3318 static struct dentry *lookup_open(struct nameidata *nd, struct file *file,
3319 				  const struct open_flags *op,
3320 				  bool got_write)
3321 {
3322 	struct user_namespace *mnt_userns;
3323 	struct dentry *dir = nd->path.dentry;
3324 	struct inode *dir_inode = dir->d_inode;
3325 	int open_flag = op->open_flag;
3326 	struct dentry *dentry;
3327 	int error, create_error = 0;
3328 	umode_t mode = op->mode;
3329 	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
3330 
3331 	if (unlikely(IS_DEADDIR(dir_inode)))
3332 		return ERR_PTR(-ENOENT);
3333 
3334 	file->f_mode &= ~FMODE_CREATED;
3335 	dentry = d_lookup(dir, &nd->last);
3336 	for (;;) {
3337 		if (!dentry) {
3338 			dentry = d_alloc_parallel(dir, &nd->last, &wq);
3339 			if (IS_ERR(dentry))
3340 				return dentry;
3341 		}
3342 		if (d_in_lookup(dentry))
3343 			break;
3344 
3345 		error = d_revalidate(dentry, nd->flags);
3346 		if (likely(error > 0))
3347 			break;
3348 		if (error)
3349 			goto out_dput;
3350 		d_invalidate(dentry);
3351 		dput(dentry);
3352 		dentry = NULL;
3353 	}
3354 	if (dentry->d_inode) {
3355 		/* Cached positive dentry: will open in f_op->open */
3356 		return dentry;
3357 	}
3358 
3359 	/*
3360 	 * Checking write permission is tricky, bacuse we don't know if we are
3361 	 * going to actually need it: O_CREAT opens should work as long as the
3362 	 * file exists.  But checking existence breaks atomicity.  The trick is
3363 	 * to check access and if not granted clear O_CREAT from the flags.
3364 	 *
3365 	 * Another problem is returing the "right" error value (e.g. for an
3366 	 * O_EXCL open we want to return EEXIST not EROFS).
3367 	 */
3368 	if (unlikely(!got_write))
3369 		open_flag &= ~O_TRUNC;
3370 	mnt_userns = mnt_user_ns(nd->path.mnt);
3371 	if (open_flag & O_CREAT) {
3372 		if (open_flag & O_EXCL)
3373 			open_flag &= ~O_TRUNC;
3374 		mode = vfs_prepare_mode(mnt_userns, dir->d_inode, mode, mode, mode);
3375 		if (likely(got_write))
3376 			create_error = may_o_create(mnt_userns, &nd->path,
3377 						    dentry, mode);
3378 		else
3379 			create_error = -EROFS;
3380 	}
3381 	if (create_error)
3382 		open_flag &= ~O_CREAT;
3383 	if (dir_inode->i_op->atomic_open) {
3384 		dentry = atomic_open(nd, dentry, file, open_flag, mode);
3385 		if (unlikely(create_error) && dentry == ERR_PTR(-ENOENT))
3386 			dentry = ERR_PTR(create_error);
3387 		return dentry;
3388 	}
3389 
3390 	if (d_in_lookup(dentry)) {
3391 		struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry,
3392 							     nd->flags);
3393 		d_lookup_done(dentry);
3394 		if (unlikely(res)) {
3395 			if (IS_ERR(res)) {
3396 				error = PTR_ERR(res);
3397 				goto out_dput;
3398 			}
3399 			dput(dentry);
3400 			dentry = res;
3401 		}
3402 	}
3403 
3404 	/* Negative dentry, just create the file */
3405 	if (!dentry->d_inode && (open_flag & O_CREAT)) {
3406 		file->f_mode |= FMODE_CREATED;
3407 		audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
3408 		if (!dir_inode->i_op->create) {
3409 			error = -EACCES;
3410 			goto out_dput;
3411 		}
3412 
3413 		error = dir_inode->i_op->create(mnt_userns, dir_inode, dentry,
3414 						mode, open_flag & O_EXCL);
3415 		if (error)
3416 			goto out_dput;
3417 	}
3418 	if (unlikely(create_error) && !dentry->d_inode) {
3419 		error = create_error;
3420 		goto out_dput;
3421 	}
3422 	return dentry;
3423 
3424 out_dput:
3425 	dput(dentry);
3426 	return ERR_PTR(error);
3427 }
3428 
open_last_lookups(struct nameidata * nd,struct file * file,const struct open_flags * op)3429 static const char *open_last_lookups(struct nameidata *nd,
3430 		   struct file *file, const struct open_flags *op)
3431 {
3432 	struct dentry *dir = nd->path.dentry;
3433 	int open_flag = op->open_flag;
3434 	bool got_write = false;
3435 	struct dentry *dentry;
3436 	const char *res;
3437 
3438 	nd->flags |= op->intent;
3439 
3440 	if (nd->last_type != LAST_NORM) {
3441 		if (nd->depth)
3442 			put_link(nd);
3443 		return handle_dots(nd, nd->last_type);
3444 	}
3445 
3446 	if (!(open_flag & O_CREAT)) {
3447 		if (nd->last.name[nd->last.len])
3448 			nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
3449 		/* we _can_ be in RCU mode here */
3450 		dentry = lookup_fast(nd);
3451 		if (IS_ERR(dentry))
3452 			return ERR_CAST(dentry);
3453 		if (likely(dentry))
3454 			goto finish_lookup;
3455 
3456 		BUG_ON(nd->flags & LOOKUP_RCU);
3457 	} else {
3458 		/* create side of things */
3459 		if (nd->flags & LOOKUP_RCU) {
3460 			if (!try_to_unlazy(nd))
3461 				return ERR_PTR(-ECHILD);
3462 		}
3463 		audit_inode(nd->name, dir, AUDIT_INODE_PARENT);
3464 		/* trailing slashes? */
3465 		if (unlikely(nd->last.name[nd->last.len]))
3466 			return ERR_PTR(-EISDIR);
3467 	}
3468 
3469 	if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
3470 		got_write = !mnt_want_write(nd->path.mnt);
3471 		/*
3472 		 * do _not_ fail yet - we might not need that or fail with
3473 		 * a different error; let lookup_open() decide; we'll be
3474 		 * dropping this one anyway.
3475 		 */
3476 	}
3477 	if (open_flag & O_CREAT)
3478 		inode_lock(dir->d_inode);
3479 	else
3480 		inode_lock_shared(dir->d_inode);
3481 	dentry = lookup_open(nd, file, op, got_write);
3482 	if (!IS_ERR(dentry) && (file->f_mode & FMODE_CREATED))
3483 		fsnotify_create(dir->d_inode, dentry);
3484 	if (open_flag & O_CREAT)
3485 		inode_unlock(dir->d_inode);
3486 	else
3487 		inode_unlock_shared(dir->d_inode);
3488 
3489 	if (got_write)
3490 		mnt_drop_write(nd->path.mnt);
3491 
3492 	if (IS_ERR(dentry))
3493 		return ERR_CAST(dentry);
3494 
3495 	if (file->f_mode & (FMODE_OPENED | FMODE_CREATED)) {
3496 		dput(nd->path.dentry);
3497 		nd->path.dentry = dentry;
3498 		return NULL;
3499 	}
3500 
3501 finish_lookup:
3502 	if (nd->depth)
3503 		put_link(nd);
3504 	res = step_into(nd, WALK_TRAILING, dentry);
3505 	if (unlikely(res))
3506 		nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3507 	return res;
3508 }
3509 
3510 /*
3511  * Handle the last step of open()
3512  */
do_open(struct nameidata * nd,struct file * file,const struct open_flags * op)3513 static int do_open(struct nameidata *nd,
3514 		   struct file *file, const struct open_flags *op)
3515 {
3516 	struct user_namespace *mnt_userns;
3517 	int open_flag = op->open_flag;
3518 	bool do_truncate;
3519 	int acc_mode;
3520 	int error;
3521 
3522 	if (!(file->f_mode & (FMODE_OPENED | FMODE_CREATED))) {
3523 		error = complete_walk(nd);
3524 		if (error)
3525 			return error;
3526 	}
3527 	if (!(file->f_mode & FMODE_CREATED))
3528 		audit_inode(nd->name, nd->path.dentry, 0);
3529 	mnt_userns = mnt_user_ns(nd->path.mnt);
3530 	if (open_flag & O_CREAT) {
3531 		if ((open_flag & O_EXCL) && !(file->f_mode & FMODE_CREATED))
3532 			return -EEXIST;
3533 		if (d_is_dir(nd->path.dentry))
3534 			return -EISDIR;
3535 		error = may_create_in_sticky(mnt_userns, nd,
3536 					     d_backing_inode(nd->path.dentry));
3537 		if (unlikely(error))
3538 			return error;
3539 	}
3540 	if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
3541 		return -ENOTDIR;
3542 
3543 	do_truncate = false;
3544 	acc_mode = op->acc_mode;
3545 	if (file->f_mode & FMODE_CREATED) {
3546 		/* Don't check for write permission, don't truncate */
3547 		open_flag &= ~O_TRUNC;
3548 		acc_mode = 0;
3549 	} else if (d_is_reg(nd->path.dentry) && open_flag & O_TRUNC) {
3550 		error = mnt_want_write(nd->path.mnt);
3551 		if (error)
3552 			return error;
3553 		do_truncate = true;
3554 	}
3555 	error = may_open(mnt_userns, &nd->path, acc_mode, open_flag);
3556 	if (!error && !(file->f_mode & FMODE_OPENED))
3557 		error = vfs_open(&nd->path, file);
3558 	if (!error)
3559 		error = ima_file_check(file, op->acc_mode);
3560 	if (!error && do_truncate)
3561 		error = handle_truncate(mnt_userns, file);
3562 	if (unlikely(error > 0)) {
3563 		WARN_ON(1);
3564 		error = -EINVAL;
3565 	}
3566 	if (do_truncate)
3567 		mnt_drop_write(nd->path.mnt);
3568 	return error;
3569 }
3570 
3571 /**
3572  * vfs_tmpfile - create tmpfile
3573  * @mnt_userns:	user namespace of the mount the inode was found from
3574  * @dentry:	pointer to dentry of the base directory
3575  * @mode:	mode of the new tmpfile
3576  * @open_flag:	flags
3577  *
3578  * Create a temporary file.
3579  *
3580  * If the inode has been found through an idmapped mount the user namespace of
3581  * the vfsmount must be passed through @mnt_userns. This function will then take
3582  * care to map the inode according to @mnt_userns before checking permissions.
3583  * On non-idmapped mounts or if permission checking is to be performed on the
3584  * raw inode simply passs init_user_ns.
3585  */
vfs_tmpfile(struct user_namespace * mnt_userns,const struct path * parentpath,struct file * file,umode_t mode)3586 static int vfs_tmpfile(struct user_namespace *mnt_userns,
3587 		       const struct path *parentpath,
3588 		       struct file *file, umode_t mode)
3589 {
3590 	struct dentry *child;
3591 	struct inode *dir = d_inode(parentpath->dentry);
3592 	struct inode *inode;
3593 	int error;
3594 	int open_flag = file->f_flags;
3595 
3596 	/* we want directory to be writable */
3597 	error = inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC);
3598 	if (error)
3599 		return error;
3600 	if (!dir->i_op->tmpfile)
3601 		return -EOPNOTSUPP;
3602 	child = d_alloc(parentpath->dentry, &slash_name);
3603 	if (unlikely(!child))
3604 		return -ENOMEM;
3605 	file->f_path.mnt = parentpath->mnt;
3606 	file->f_path.dentry = child;
3607 	mode = vfs_prepare_mode(mnt_userns, dir, mode, mode, mode);
3608 	error = dir->i_op->tmpfile(mnt_userns, dir, file, mode);
3609 	dput(child);
3610 	if (error)
3611 		return error;
3612 	/* Don't check for other permissions, the inode was just created */
3613 	error = may_open(mnt_userns, &file->f_path, 0, file->f_flags);
3614 	if (error)
3615 		return error;
3616 	inode = file_inode(file);
3617 	if (!(open_flag & O_EXCL)) {
3618 		spin_lock(&inode->i_lock);
3619 		inode->i_state |= I_LINKABLE;
3620 		spin_unlock(&inode->i_lock);
3621 	}
3622 	ima_post_create_tmpfile(mnt_userns, inode);
3623 	return 0;
3624 }
3625 
3626 /**
3627  * vfs_tmpfile_open - open a tmpfile for kernel internal use
3628  * @mnt_userns:	user namespace of the mount the inode was found from
3629  * @parentpath:	path of the base directory
3630  * @mode:	mode of the new tmpfile
3631  * @open_flag:	flags
3632  * @cred:	credentials for open
3633  *
3634  * Create and open a temporary file.  The file is not accounted in nr_files,
3635  * hence this is only for kernel internal use, and must not be installed into
3636  * file tables or such.
3637  */
vfs_tmpfile_open(struct user_namespace * mnt_userns,const struct path * parentpath,umode_t mode,int open_flag,const struct cred * cred)3638 struct file *vfs_tmpfile_open(struct user_namespace *mnt_userns,
3639 			  const struct path *parentpath,
3640 			  umode_t mode, int open_flag, const struct cred *cred)
3641 {
3642 	struct file *file;
3643 	int error;
3644 
3645 	file = alloc_empty_file_noaccount(open_flag, cred);
3646 	if (!IS_ERR(file)) {
3647 		error = vfs_tmpfile(mnt_userns, parentpath, file, mode);
3648 		if (error) {
3649 			fput(file);
3650 			file = ERR_PTR(error);
3651 		}
3652 	}
3653 	return file;
3654 }
3655 EXPORT_SYMBOL(vfs_tmpfile_open);
3656 
do_tmpfile(struct nameidata * nd,unsigned flags,const struct open_flags * op,struct file * file)3657 static int do_tmpfile(struct nameidata *nd, unsigned flags,
3658 		const struct open_flags *op,
3659 		struct file *file)
3660 {
3661 	struct user_namespace *mnt_userns;
3662 	struct path path;
3663 	int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
3664 
3665 	if (unlikely(error))
3666 		return error;
3667 	error = mnt_want_write(path.mnt);
3668 	if (unlikely(error))
3669 		goto out;
3670 	mnt_userns = mnt_user_ns(path.mnt);
3671 	error = vfs_tmpfile(mnt_userns, &path, file, op->mode);
3672 	if (error)
3673 		goto out2;
3674 	audit_inode(nd->name, file->f_path.dentry, 0);
3675 out2:
3676 	mnt_drop_write(path.mnt);
3677 out:
3678 	path_put(&path);
3679 	return error;
3680 }
3681 
do_o_path(struct nameidata * nd,unsigned flags,struct file * file)3682 static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file)
3683 {
3684 	struct path path;
3685 	int error = path_lookupat(nd, flags, &path);
3686 	if (!error) {
3687 		audit_inode(nd->name, path.dentry, 0);
3688 		error = vfs_open(&path, file);
3689 		path_put(&path);
3690 	}
3691 	return error;
3692 }
3693 
path_openat(struct nameidata * nd,const struct open_flags * op,unsigned flags)3694 static struct file *path_openat(struct nameidata *nd,
3695 			const struct open_flags *op, unsigned flags)
3696 {
3697 	struct file *file;
3698 	int error;
3699 
3700 	file = alloc_empty_file(op->open_flag, current_cred());
3701 	if (IS_ERR(file))
3702 		return file;
3703 
3704 	if (unlikely(file->f_flags & __O_TMPFILE)) {
3705 		error = do_tmpfile(nd, flags, op, file);
3706 	} else if (unlikely(file->f_flags & O_PATH)) {
3707 		error = do_o_path(nd, flags, file);
3708 	} else {
3709 		const char *s = path_init(nd, flags);
3710 		while (!(error = link_path_walk(s, nd)) &&
3711 		       (s = open_last_lookups(nd, file, op)) != NULL)
3712 			;
3713 		if (!error)
3714 			error = do_open(nd, file, op);
3715 		terminate_walk(nd);
3716 	}
3717 	if (likely(!error)) {
3718 		if (likely(file->f_mode & FMODE_OPENED))
3719 			return file;
3720 		WARN_ON(1);
3721 		error = -EINVAL;
3722 	}
3723 	fput(file);
3724 	if (error == -EOPENSTALE) {
3725 		if (flags & LOOKUP_RCU)
3726 			error = -ECHILD;
3727 		else
3728 			error = -ESTALE;
3729 	}
3730 	return ERR_PTR(error);
3731 }
3732 
do_filp_open(int dfd,struct filename * pathname,const struct open_flags * op)3733 struct file *do_filp_open(int dfd, struct filename *pathname,
3734 		const struct open_flags *op)
3735 {
3736 	struct nameidata nd;
3737 	int flags = op->lookup_flags;
3738 	struct file *filp;
3739 
3740 	set_nameidata(&nd, dfd, pathname, NULL);
3741 	filp = path_openat(&nd, op, flags | LOOKUP_RCU);
3742 	if (unlikely(filp == ERR_PTR(-ECHILD)))
3743 		filp = path_openat(&nd, op, flags);
3744 	if (unlikely(filp == ERR_PTR(-ESTALE)))
3745 		filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
3746 	restore_nameidata();
3747 	return filp;
3748 }
3749 
do_file_open_root(const struct path * root,const char * name,const struct open_flags * op)3750 struct file *do_file_open_root(const struct path *root,
3751 		const char *name, const struct open_flags *op)
3752 {
3753 	struct nameidata nd;
3754 	struct file *file;
3755 	struct filename *filename;
3756 	int flags = op->lookup_flags;
3757 
3758 	if (d_is_symlink(root->dentry) && op->intent & LOOKUP_OPEN)
3759 		return ERR_PTR(-ELOOP);
3760 
3761 	filename = getname_kernel(name);
3762 	if (IS_ERR(filename))
3763 		return ERR_CAST(filename);
3764 
3765 	set_nameidata(&nd, -1, filename, root);
3766 	file = path_openat(&nd, op, flags | LOOKUP_RCU);
3767 	if (unlikely(file == ERR_PTR(-ECHILD)))
3768 		file = path_openat(&nd, op, flags);
3769 	if (unlikely(file == ERR_PTR(-ESTALE)))
3770 		file = path_openat(&nd, op, flags | LOOKUP_REVAL);
3771 	restore_nameidata();
3772 	putname(filename);
3773 	return file;
3774 }
3775 
filename_create(int dfd,struct filename * name,struct path * path,unsigned int lookup_flags)3776 static struct dentry *filename_create(int dfd, struct filename *name,
3777 				      struct path *path, unsigned int lookup_flags)
3778 {
3779 	struct dentry *dentry = ERR_PTR(-EEXIST);
3780 	struct qstr last;
3781 	bool want_dir = lookup_flags & LOOKUP_DIRECTORY;
3782 	unsigned int reval_flag = lookup_flags & LOOKUP_REVAL;
3783 	unsigned int create_flags = LOOKUP_CREATE | LOOKUP_EXCL;
3784 	int type;
3785 	int err2;
3786 	int error;
3787 
3788 	error = filename_parentat(dfd, name, reval_flag, path, &last, &type);
3789 	if (error)
3790 		return ERR_PTR(error);
3791 
3792 	/*
3793 	 * Yucky last component or no last component at all?
3794 	 * (foo/., foo/.., /////)
3795 	 */
3796 	if (unlikely(type != LAST_NORM))
3797 		goto out;
3798 
3799 	/* don't fail immediately if it's r/o, at least try to report other errors */
3800 	err2 = mnt_want_write(path->mnt);
3801 	/*
3802 	 * Do the final lookup.  Suppress 'create' if there is a trailing
3803 	 * '/', and a directory wasn't requested.
3804 	 */
3805 	if (last.name[last.len] && !want_dir)
3806 		create_flags = 0;
3807 	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
3808 	dentry = __lookup_hash(&last, path->dentry, reval_flag | create_flags);
3809 	if (IS_ERR(dentry))
3810 		goto unlock;
3811 
3812 	error = -EEXIST;
3813 	if (d_is_positive(dentry))
3814 		goto fail;
3815 
3816 	/*
3817 	 * Special case - lookup gave negative, but... we had foo/bar/
3818 	 * From the vfs_mknod() POV we just have a negative dentry -
3819 	 * all is fine. Let's be bastards - you had / on the end, you've
3820 	 * been asking for (non-existent) directory. -ENOENT for you.
3821 	 */
3822 	if (unlikely(!create_flags)) {
3823 		error = -ENOENT;
3824 		goto fail;
3825 	}
3826 	if (unlikely(err2)) {
3827 		error = err2;
3828 		goto fail;
3829 	}
3830 	return dentry;
3831 fail:
3832 	dput(dentry);
3833 	dentry = ERR_PTR(error);
3834 unlock:
3835 	inode_unlock(path->dentry->d_inode);
3836 	if (!err2)
3837 		mnt_drop_write(path->mnt);
3838 out:
3839 	path_put(path);
3840 	return dentry;
3841 }
3842 
kern_path_create(int dfd,const char * pathname,struct path * path,unsigned int lookup_flags)3843 struct dentry *kern_path_create(int dfd, const char *pathname,
3844 				struct path *path, unsigned int lookup_flags)
3845 {
3846 	struct filename *filename = getname_kernel(pathname);
3847 	struct dentry *res = filename_create(dfd, filename, path, lookup_flags);
3848 
3849 	putname(filename);
3850 	return res;
3851 }
3852 EXPORT_SYMBOL(kern_path_create);
3853 
done_path_create(struct path * path,struct dentry * dentry)3854 void done_path_create(struct path *path, struct dentry *dentry)
3855 {
3856 	dput(dentry);
3857 	inode_unlock(path->dentry->d_inode);
3858 	mnt_drop_write(path->mnt);
3859 	path_put(path);
3860 }
3861 EXPORT_SYMBOL(done_path_create);
3862 
user_path_create(int dfd,const char __user * pathname,struct path * path,unsigned int lookup_flags)3863 inline struct dentry *user_path_create(int dfd, const char __user *pathname,
3864 				struct path *path, unsigned int lookup_flags)
3865 {
3866 	struct filename *filename = getname(pathname);
3867 	struct dentry *res = filename_create(dfd, filename, path, lookup_flags);
3868 
3869 	putname(filename);
3870 	return res;
3871 }
3872 EXPORT_SYMBOL(user_path_create);
3873 
3874 /**
3875  * vfs_mknod - create device node or file
3876  * @mnt_userns:	user namespace of the mount the inode was found from
3877  * @dir:	inode of @dentry
3878  * @dentry:	pointer to dentry of the base directory
3879  * @mode:	mode of the new device node or file
3880  * @dev:	device number of device to create
3881  *
3882  * Create a device node or file.
3883  *
3884  * If the inode has been found through an idmapped mount the user namespace of
3885  * the vfsmount must be passed through @mnt_userns. This function will then take
3886  * care to map the inode according to @mnt_userns before checking permissions.
3887  * On non-idmapped mounts or if permission checking is to be performed on the
3888  * raw inode simply passs init_user_ns.
3889  */
vfs_mknod(struct user_namespace * mnt_userns,struct inode * dir,struct dentry * dentry,umode_t mode,dev_t dev)3890 int vfs_mknod(struct user_namespace *mnt_userns, struct inode *dir,
3891 	      struct dentry *dentry, umode_t mode, dev_t dev)
3892 {
3893 	bool is_whiteout = S_ISCHR(mode) && dev == WHITEOUT_DEV;
3894 	int error = may_create(mnt_userns, dir, dentry);
3895 
3896 	if (error)
3897 		return error;
3898 
3899 	if ((S_ISCHR(mode) || S_ISBLK(mode)) && !is_whiteout &&
3900 	    !capable(CAP_MKNOD))
3901 		return -EPERM;
3902 
3903 	if (!dir->i_op->mknod)
3904 		return -EPERM;
3905 
3906 	mode = vfs_prepare_mode(mnt_userns, dir, mode, mode, mode);
3907 	error = devcgroup_inode_mknod(mode, dev);
3908 	if (error)
3909 		return error;
3910 
3911 	error = security_inode_mknod(dir, dentry, mode, dev);
3912 	if (error)
3913 		return error;
3914 
3915 	error = dir->i_op->mknod(mnt_userns, dir, dentry, mode, dev);
3916 	if (!error)
3917 		fsnotify_create(dir, dentry);
3918 	return error;
3919 }
3920 EXPORT_SYMBOL(vfs_mknod);
3921 
may_mknod(umode_t mode)3922 static int may_mknod(umode_t mode)
3923 {
3924 	switch (mode & S_IFMT) {
3925 	case S_IFREG:
3926 	case S_IFCHR:
3927 	case S_IFBLK:
3928 	case S_IFIFO:
3929 	case S_IFSOCK:
3930 	case 0: /* zero mode translates to S_IFREG */
3931 		return 0;
3932 	case S_IFDIR:
3933 		return -EPERM;
3934 	default:
3935 		return -EINVAL;
3936 	}
3937 }
3938 
do_mknodat(int dfd,struct filename * name,umode_t mode,unsigned int dev)3939 static int do_mknodat(int dfd, struct filename *name, umode_t mode,
3940 		unsigned int dev)
3941 {
3942 	struct user_namespace *mnt_userns;
3943 	struct dentry *dentry;
3944 	struct path path;
3945 	int error;
3946 	unsigned int lookup_flags = 0;
3947 
3948 	error = may_mknod(mode);
3949 	if (error)
3950 		goto out1;
3951 retry:
3952 	dentry = filename_create(dfd, name, &path, lookup_flags);
3953 	error = PTR_ERR(dentry);
3954 	if (IS_ERR(dentry))
3955 		goto out1;
3956 
3957 	error = security_path_mknod(&path, dentry,
3958 			mode_strip_umask(path.dentry->d_inode, mode), dev);
3959 	if (error)
3960 		goto out2;
3961 
3962 	mnt_userns = mnt_user_ns(path.mnt);
3963 	switch (mode & S_IFMT) {
3964 		case 0: case S_IFREG:
3965 			error = vfs_create(mnt_userns, path.dentry->d_inode,
3966 					   dentry, mode, true);
3967 			if (!error)
3968 				ima_post_path_mknod(mnt_userns, dentry);
3969 			break;
3970 		case S_IFCHR: case S_IFBLK:
3971 			error = vfs_mknod(mnt_userns, path.dentry->d_inode,
3972 					  dentry, mode, new_decode_dev(dev));
3973 			break;
3974 		case S_IFIFO: case S_IFSOCK:
3975 			error = vfs_mknod(mnt_userns, path.dentry->d_inode,
3976 					  dentry, mode, 0);
3977 			break;
3978 	}
3979 out2:
3980 	done_path_create(&path, dentry);
3981 	if (retry_estale(error, lookup_flags)) {
3982 		lookup_flags |= LOOKUP_REVAL;
3983 		goto retry;
3984 	}
3985 out1:
3986 	putname(name);
3987 	return error;
3988 }
3989 
SYSCALL_DEFINE4(mknodat,int,dfd,const char __user *,filename,umode_t,mode,unsigned int,dev)3990 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
3991 		unsigned int, dev)
3992 {
3993 	return do_mknodat(dfd, getname(filename), mode, dev);
3994 }
3995 
SYSCALL_DEFINE3(mknod,const char __user *,filename,umode_t,mode,unsigned,dev)3996 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
3997 {
3998 	return do_mknodat(AT_FDCWD, getname(filename), mode, dev);
3999 }
4000 
4001 /**
4002  * vfs_mkdir - create directory
4003  * @mnt_userns:	user namespace of the mount the inode was found from
4004  * @dir:	inode of @dentry
4005  * @dentry:	pointer to dentry of the base directory
4006  * @mode:	mode of the new directory
4007  *
4008  * Create a directory.
4009  *
4010  * If the inode has been found through an idmapped mount the user namespace of
4011  * the vfsmount must be passed through @mnt_userns. This function will then take
4012  * care to map the inode according to @mnt_userns before checking permissions.
4013  * On non-idmapped mounts or if permission checking is to be performed on the
4014  * raw inode simply passs init_user_ns.
4015  */
vfs_mkdir(struct user_namespace * mnt_userns,struct inode * dir,struct dentry * dentry,umode_t mode)4016 int vfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir,
4017 	      struct dentry *dentry, umode_t mode)
4018 {
4019 	int error = may_create(mnt_userns, dir, dentry);
4020 	unsigned max_links = dir->i_sb->s_max_links;
4021 
4022 	if (error)
4023 		return error;
4024 
4025 	if (!dir->i_op->mkdir)
4026 		return -EPERM;
4027 
4028 	mode = vfs_prepare_mode(mnt_userns, dir, mode, S_IRWXUGO | S_ISVTX, 0);
4029 	error = security_inode_mkdir(dir, dentry, mode);
4030 	if (error)
4031 		return error;
4032 
4033 	if (max_links && dir->i_nlink >= max_links)
4034 		return -EMLINK;
4035 
4036 	error = dir->i_op->mkdir(mnt_userns, dir, dentry, mode);
4037 	if (!error)
4038 		fsnotify_mkdir(dir, dentry);
4039 	return error;
4040 }
4041 EXPORT_SYMBOL(vfs_mkdir);
4042 
do_mkdirat(int dfd,struct filename * name,umode_t mode)4043 int do_mkdirat(int dfd, struct filename *name, umode_t mode)
4044 {
4045 	struct dentry *dentry;
4046 	struct path path;
4047 	int error;
4048 	unsigned int lookup_flags = LOOKUP_DIRECTORY;
4049 
4050 retry:
4051 	dentry = filename_create(dfd, name, &path, lookup_flags);
4052 	error = PTR_ERR(dentry);
4053 	if (IS_ERR(dentry))
4054 		goto out_putname;
4055 
4056 	error = security_path_mkdir(&path, dentry,
4057 			mode_strip_umask(path.dentry->d_inode, mode));
4058 	if (!error) {
4059 		struct user_namespace *mnt_userns;
4060 		mnt_userns = mnt_user_ns(path.mnt);
4061 		error = vfs_mkdir(mnt_userns, path.dentry->d_inode, dentry,
4062 				  mode);
4063 	}
4064 	done_path_create(&path, dentry);
4065 	if (retry_estale(error, lookup_flags)) {
4066 		lookup_flags |= LOOKUP_REVAL;
4067 		goto retry;
4068 	}
4069 out_putname:
4070 	putname(name);
4071 	return error;
4072 }
4073 
SYSCALL_DEFINE3(mkdirat,int,dfd,const char __user *,pathname,umode_t,mode)4074 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
4075 {
4076 	return do_mkdirat(dfd, getname(pathname), mode);
4077 }
4078 
SYSCALL_DEFINE2(mkdir,const char __user *,pathname,umode_t,mode)4079 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
4080 {
4081 	return do_mkdirat(AT_FDCWD, getname(pathname), mode);
4082 }
4083 
4084 /**
4085  * vfs_rmdir - remove directory
4086  * @mnt_userns:	user namespace of the mount the inode was found from
4087  * @dir:	inode of @dentry
4088  * @dentry:	pointer to dentry of the base directory
4089  *
4090  * Remove a directory.
4091  *
4092  * If the inode has been found through an idmapped mount the user namespace of
4093  * the vfsmount must be passed through @mnt_userns. This function will then take
4094  * care to map the inode according to @mnt_userns before checking permissions.
4095  * On non-idmapped mounts or if permission checking is to be performed on the
4096  * raw inode simply passs init_user_ns.
4097  */
vfs_rmdir(struct user_namespace * mnt_userns,struct inode * dir,struct dentry * dentry)4098 int vfs_rmdir(struct user_namespace *mnt_userns, struct inode *dir,
4099 		     struct dentry *dentry)
4100 {
4101 	int error = may_delete(mnt_userns, dir, dentry, 1);
4102 
4103 	if (error)
4104 		return error;
4105 
4106 	if (!dir->i_op->rmdir)
4107 		return -EPERM;
4108 
4109 	dget(dentry);
4110 	inode_lock(dentry->d_inode);
4111 
4112 	error = -EBUSY;
4113 	if (is_local_mountpoint(dentry) ||
4114 	    (dentry->d_inode->i_flags & S_KERNEL_FILE))
4115 		goto out;
4116 
4117 	error = security_inode_rmdir(dir, dentry);
4118 	if (error)
4119 		goto out;
4120 
4121 	error = dir->i_op->rmdir(dir, dentry);
4122 	if (error)
4123 		goto out;
4124 
4125 	shrink_dcache_parent(dentry);
4126 	dentry->d_inode->i_flags |= S_DEAD;
4127 	dont_mount(dentry);
4128 	detach_mounts(dentry);
4129 
4130 out:
4131 	inode_unlock(dentry->d_inode);
4132 	dput(dentry);
4133 	if (!error)
4134 		d_delete_notify(dir, dentry);
4135 	return error;
4136 }
4137 EXPORT_SYMBOL(vfs_rmdir);
4138 
do_rmdir(int dfd,struct filename * name)4139 int do_rmdir(int dfd, struct filename *name)
4140 {
4141 	struct user_namespace *mnt_userns;
4142 	int error;
4143 	struct dentry *dentry;
4144 	struct path path;
4145 	struct qstr last;
4146 	int type;
4147 	unsigned int lookup_flags = 0;
4148 retry:
4149 	error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4150 	if (error)
4151 		goto exit1;
4152 
4153 	switch (type) {
4154 	case LAST_DOTDOT:
4155 		error = -ENOTEMPTY;
4156 		goto exit2;
4157 	case LAST_DOT:
4158 		error = -EINVAL;
4159 		goto exit2;
4160 	case LAST_ROOT:
4161 		error = -EBUSY;
4162 		goto exit2;
4163 	}
4164 
4165 	error = mnt_want_write(path.mnt);
4166 	if (error)
4167 		goto exit2;
4168 
4169 	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4170 	dentry = __lookup_hash(&last, path.dentry, lookup_flags);
4171 	error = PTR_ERR(dentry);
4172 	if (IS_ERR(dentry))
4173 		goto exit3;
4174 	if (!dentry->d_inode) {
4175 		error = -ENOENT;
4176 		goto exit4;
4177 	}
4178 	error = security_path_rmdir(&path, dentry);
4179 	if (error)
4180 		goto exit4;
4181 	mnt_userns = mnt_user_ns(path.mnt);
4182 	error = vfs_rmdir(mnt_userns, path.dentry->d_inode, dentry);
4183 exit4:
4184 	dput(dentry);
4185 exit3:
4186 	inode_unlock(path.dentry->d_inode);
4187 	mnt_drop_write(path.mnt);
4188 exit2:
4189 	path_put(&path);
4190 	if (retry_estale(error, lookup_flags)) {
4191 		lookup_flags |= LOOKUP_REVAL;
4192 		goto retry;
4193 	}
4194 exit1:
4195 	putname(name);
4196 	return error;
4197 }
4198 
SYSCALL_DEFINE1(rmdir,const char __user *,pathname)4199 SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
4200 {
4201 	return do_rmdir(AT_FDCWD, getname(pathname));
4202 }
4203 
4204 /**
4205  * vfs_unlink - unlink a filesystem object
4206  * @mnt_userns:	user namespace of the mount the inode was found from
4207  * @dir:	parent directory
4208  * @dentry:	victim
4209  * @delegated_inode: returns victim inode, if the inode is delegated.
4210  *
4211  * The caller must hold dir->i_mutex.
4212  *
4213  * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and
4214  * return a reference to the inode in delegated_inode.  The caller
4215  * should then break the delegation on that inode and retry.  Because
4216  * breaking a delegation may take a long time, the caller should drop
4217  * dir->i_mutex before doing so.
4218  *
4219  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4220  * be appropriate for callers that expect the underlying filesystem not
4221  * to be NFS exported.
4222  *
4223  * If the inode has been found through an idmapped mount the user namespace of
4224  * the vfsmount must be passed through @mnt_userns. This function will then take
4225  * care to map the inode according to @mnt_userns before checking permissions.
4226  * On non-idmapped mounts or if permission checking is to be performed on the
4227  * raw inode simply passs init_user_ns.
4228  */
vfs_unlink(struct user_namespace * mnt_userns,struct inode * dir,struct dentry * dentry,struct inode ** delegated_inode)4229 int vfs_unlink(struct user_namespace *mnt_userns, struct inode *dir,
4230 	       struct dentry *dentry, struct inode **delegated_inode)
4231 {
4232 	struct inode *target = dentry->d_inode;
4233 	int error = may_delete(mnt_userns, dir, dentry, 0);
4234 
4235 	if (error)
4236 		return error;
4237 
4238 	if (!dir->i_op->unlink)
4239 		return -EPERM;
4240 
4241 	inode_lock(target);
4242 	if (IS_SWAPFILE(target))
4243 		error = -EPERM;
4244 	else if (is_local_mountpoint(dentry))
4245 		error = -EBUSY;
4246 	else {
4247 		error = security_inode_unlink(dir, dentry);
4248 		if (!error) {
4249 			error = try_break_deleg(target, delegated_inode);
4250 			if (error)
4251 				goto out;
4252 			error = dir->i_op->unlink(dir, dentry);
4253 			if (!error) {
4254 				dont_mount(dentry);
4255 				detach_mounts(dentry);
4256 			}
4257 		}
4258 	}
4259 out:
4260 	inode_unlock(target);
4261 
4262 	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
4263 	if (!error && dentry->d_flags & DCACHE_NFSFS_RENAMED) {
4264 		fsnotify_unlink(dir, dentry);
4265 	} else if (!error) {
4266 		fsnotify_link_count(target);
4267 		d_delete_notify(dir, dentry);
4268 	}
4269 
4270 	return error;
4271 }
4272 EXPORT_SYMBOL(vfs_unlink);
4273 
4274 /*
4275  * Make sure that the actual truncation of the file will occur outside its
4276  * directory's i_mutex.  Truncate can take a long time if there is a lot of
4277  * writeout happening, and we don't want to prevent access to the directory
4278  * while waiting on the I/O.
4279  */
do_unlinkat(int dfd,struct filename * name)4280 int do_unlinkat(int dfd, struct filename *name)
4281 {
4282 	int error;
4283 	struct dentry *dentry;
4284 	struct path path;
4285 	struct qstr last;
4286 	int type;
4287 	struct inode *inode = NULL;
4288 	struct inode *delegated_inode = NULL;
4289 	unsigned int lookup_flags = 0;
4290 retry:
4291 	error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4292 	if (error)
4293 		goto exit1;
4294 
4295 	error = -EISDIR;
4296 	if (type != LAST_NORM)
4297 		goto exit2;
4298 
4299 	error = mnt_want_write(path.mnt);
4300 	if (error)
4301 		goto exit2;
4302 retry_deleg:
4303 	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4304 	dentry = __lookup_hash(&last, path.dentry, lookup_flags);
4305 	error = PTR_ERR(dentry);
4306 	if (!IS_ERR(dentry)) {
4307 		struct user_namespace *mnt_userns;
4308 
4309 		/* Why not before? Because we want correct error value */
4310 		if (last.name[last.len])
4311 			goto slashes;
4312 		inode = dentry->d_inode;
4313 		if (d_is_negative(dentry))
4314 			goto slashes;
4315 		ihold(inode);
4316 		error = security_path_unlink(&path, dentry);
4317 		if (error)
4318 			goto exit3;
4319 		mnt_userns = mnt_user_ns(path.mnt);
4320 		error = vfs_unlink(mnt_userns, path.dentry->d_inode, dentry,
4321 				   &delegated_inode);
4322 exit3:
4323 		dput(dentry);
4324 	}
4325 	inode_unlock(path.dentry->d_inode);
4326 	if (inode)
4327 		iput(inode);	/* truncate the inode here */
4328 	inode = NULL;
4329 	if (delegated_inode) {
4330 		error = break_deleg_wait(&delegated_inode);
4331 		if (!error)
4332 			goto retry_deleg;
4333 	}
4334 	mnt_drop_write(path.mnt);
4335 exit2:
4336 	path_put(&path);
4337 	if (retry_estale(error, lookup_flags)) {
4338 		lookup_flags |= LOOKUP_REVAL;
4339 		inode = NULL;
4340 		goto retry;
4341 	}
4342 exit1:
4343 	putname(name);
4344 	return error;
4345 
4346 slashes:
4347 	if (d_is_negative(dentry))
4348 		error = -ENOENT;
4349 	else if (d_is_dir(dentry))
4350 		error = -EISDIR;
4351 	else
4352 		error = -ENOTDIR;
4353 	goto exit3;
4354 }
4355 
SYSCALL_DEFINE3(unlinkat,int,dfd,const char __user *,pathname,int,flag)4356 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
4357 {
4358 	if ((flag & ~AT_REMOVEDIR) != 0)
4359 		return -EINVAL;
4360 
4361 	if (flag & AT_REMOVEDIR)
4362 		return do_rmdir(dfd, getname(pathname));
4363 	return do_unlinkat(dfd, getname(pathname));
4364 }
4365 
SYSCALL_DEFINE1(unlink,const char __user *,pathname)4366 SYSCALL_DEFINE1(unlink, const char __user *, pathname)
4367 {
4368 	return do_unlinkat(AT_FDCWD, getname(pathname));
4369 }
4370 
4371 /**
4372  * vfs_symlink - create symlink
4373  * @mnt_userns:	user namespace of the mount the inode was found from
4374  * @dir:	inode of @dentry
4375  * @dentry:	pointer to dentry of the base directory
4376  * @oldname:	name of the file to link to
4377  *
4378  * Create a symlink.
4379  *
4380  * If the inode has been found through an idmapped mount the user namespace of
4381  * the vfsmount must be passed through @mnt_userns. This function will then take
4382  * care to map the inode according to @mnt_userns before checking permissions.
4383  * On non-idmapped mounts or if permission checking is to be performed on the
4384  * raw inode simply passs init_user_ns.
4385  */
vfs_symlink(struct user_namespace * mnt_userns,struct inode * dir,struct dentry * dentry,const char * oldname)4386 int vfs_symlink(struct user_namespace *mnt_userns, struct inode *dir,
4387 		struct dentry *dentry, const char *oldname)
4388 {
4389 	int error = may_create(mnt_userns, dir, dentry);
4390 
4391 	if (error)
4392 		return error;
4393 
4394 	if (!dir->i_op->symlink)
4395 		return -EPERM;
4396 
4397 	error = security_inode_symlink(dir, dentry, oldname);
4398 	if (error)
4399 		return error;
4400 
4401 	error = dir->i_op->symlink(mnt_userns, dir, dentry, oldname);
4402 	if (!error)
4403 		fsnotify_create(dir, dentry);
4404 	return error;
4405 }
4406 EXPORT_SYMBOL(vfs_symlink);
4407 
do_symlinkat(struct filename * from,int newdfd,struct filename * to)4408 int do_symlinkat(struct filename *from, int newdfd, struct filename *to)
4409 {
4410 	int error;
4411 	struct dentry *dentry;
4412 	struct path path;
4413 	unsigned int lookup_flags = 0;
4414 
4415 	if (IS_ERR(from)) {
4416 		error = PTR_ERR(from);
4417 		goto out_putnames;
4418 	}
4419 retry:
4420 	dentry = filename_create(newdfd, to, &path, lookup_flags);
4421 	error = PTR_ERR(dentry);
4422 	if (IS_ERR(dentry))
4423 		goto out_putnames;
4424 
4425 	error = security_path_symlink(&path, dentry, from->name);
4426 	if (!error) {
4427 		struct user_namespace *mnt_userns;
4428 
4429 		mnt_userns = mnt_user_ns(path.mnt);
4430 		error = vfs_symlink(mnt_userns, path.dentry->d_inode, dentry,
4431 				    from->name);
4432 	}
4433 	done_path_create(&path, dentry);
4434 	if (retry_estale(error, lookup_flags)) {
4435 		lookup_flags |= LOOKUP_REVAL;
4436 		goto retry;
4437 	}
4438 out_putnames:
4439 	putname(to);
4440 	putname(from);
4441 	return error;
4442 }
4443 
SYSCALL_DEFINE3(symlinkat,const char __user *,oldname,int,newdfd,const char __user *,newname)4444 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
4445 		int, newdfd, const char __user *, newname)
4446 {
4447 	return do_symlinkat(getname(oldname), newdfd, getname(newname));
4448 }
4449 
SYSCALL_DEFINE2(symlink,const char __user *,oldname,const char __user *,newname)4450 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
4451 {
4452 	return do_symlinkat(getname(oldname), AT_FDCWD, getname(newname));
4453 }
4454 
4455 /**
4456  * vfs_link - create a new link
4457  * @old_dentry:	object to be linked
4458  * @mnt_userns:	the user namespace of the mount
4459  * @dir:	new parent
4460  * @new_dentry:	where to create the new link
4461  * @delegated_inode: returns inode needing a delegation break
4462  *
4463  * The caller must hold dir->i_mutex
4464  *
4465  * If vfs_link discovers a delegation on the to-be-linked file in need
4466  * of breaking, it will return -EWOULDBLOCK and return a reference to the
4467  * inode in delegated_inode.  The caller should then break the delegation
4468  * and retry.  Because breaking a delegation may take a long time, the
4469  * caller should drop the i_mutex before doing so.
4470  *
4471  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4472  * be appropriate for callers that expect the underlying filesystem not
4473  * to be NFS exported.
4474  *
4475  * If the inode has been found through an idmapped mount the user namespace of
4476  * the vfsmount must be passed through @mnt_userns. This function will then take
4477  * care to map the inode according to @mnt_userns before checking permissions.
4478  * On non-idmapped mounts or if permission checking is to be performed on the
4479  * raw inode simply passs init_user_ns.
4480  */
vfs_link(struct dentry * old_dentry,struct user_namespace * mnt_userns,struct inode * dir,struct dentry * new_dentry,struct inode ** delegated_inode)4481 int vfs_link(struct dentry *old_dentry, struct user_namespace *mnt_userns,
4482 	     struct inode *dir, struct dentry *new_dentry,
4483 	     struct inode **delegated_inode)
4484 {
4485 	struct inode *inode = old_dentry->d_inode;
4486 	unsigned max_links = dir->i_sb->s_max_links;
4487 	int error;
4488 
4489 	if (!inode)
4490 		return -ENOENT;
4491 
4492 	error = may_create(mnt_userns, dir, new_dentry);
4493 	if (error)
4494 		return error;
4495 
4496 	if (dir->i_sb != inode->i_sb)
4497 		return -EXDEV;
4498 
4499 	/*
4500 	 * A link to an append-only or immutable file cannot be created.
4501 	 */
4502 	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
4503 		return -EPERM;
4504 	/*
4505 	 * Updating the link count will likely cause i_uid and i_gid to
4506 	 * be writen back improperly if their true value is unknown to
4507 	 * the vfs.
4508 	 */
4509 	if (HAS_UNMAPPED_ID(mnt_userns, inode))
4510 		return -EPERM;
4511 	if (!dir->i_op->link)
4512 		return -EPERM;
4513 	if (S_ISDIR(inode->i_mode))
4514 		return -EPERM;
4515 
4516 	error = security_inode_link(old_dentry, dir, new_dentry);
4517 	if (error)
4518 		return error;
4519 
4520 	inode_lock(inode);
4521 	/* Make sure we don't allow creating hardlink to an unlinked file */
4522 	if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
4523 		error =  -ENOENT;
4524 	else if (max_links && inode->i_nlink >= max_links)
4525 		error = -EMLINK;
4526 	else {
4527 		error = try_break_deleg(inode, delegated_inode);
4528 		if (!error)
4529 			error = dir->i_op->link(old_dentry, dir, new_dentry);
4530 	}
4531 
4532 	if (!error && (inode->i_state & I_LINKABLE)) {
4533 		spin_lock(&inode->i_lock);
4534 		inode->i_state &= ~I_LINKABLE;
4535 		spin_unlock(&inode->i_lock);
4536 	}
4537 	inode_unlock(inode);
4538 	if (!error)
4539 		fsnotify_link(dir, inode, new_dentry);
4540 	return error;
4541 }
4542 EXPORT_SYMBOL(vfs_link);
4543 
4544 /*
4545  * Hardlinks are often used in delicate situations.  We avoid
4546  * security-related surprises by not following symlinks on the
4547  * newname.  --KAB
4548  *
4549  * We don't follow them on the oldname either to be compatible
4550  * with linux 2.0, and to avoid hard-linking to directories
4551  * and other special files.  --ADM
4552  */
do_linkat(int olddfd,struct filename * old,int newdfd,struct filename * new,int flags)4553 int do_linkat(int olddfd, struct filename *old, int newdfd,
4554 	      struct filename *new, int flags)
4555 {
4556 	struct user_namespace *mnt_userns;
4557 	struct dentry *new_dentry;
4558 	struct path old_path, new_path;
4559 	struct inode *delegated_inode = NULL;
4560 	int how = 0;
4561 	int error;
4562 
4563 	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) {
4564 		error = -EINVAL;
4565 		goto out_putnames;
4566 	}
4567 	/*
4568 	 * To use null names we require CAP_DAC_READ_SEARCH
4569 	 * This ensures that not everyone will be able to create
4570 	 * handlink using the passed filedescriptor.
4571 	 */
4572 	if (flags & AT_EMPTY_PATH && !capable(CAP_DAC_READ_SEARCH)) {
4573 		error = -ENOENT;
4574 		goto out_putnames;
4575 	}
4576 
4577 	if (flags & AT_SYMLINK_FOLLOW)
4578 		how |= LOOKUP_FOLLOW;
4579 retry:
4580 	error = filename_lookup(olddfd, old, how, &old_path, NULL);
4581 	if (error)
4582 		goto out_putnames;
4583 
4584 	new_dentry = filename_create(newdfd, new, &new_path,
4585 					(how & LOOKUP_REVAL));
4586 	error = PTR_ERR(new_dentry);
4587 	if (IS_ERR(new_dentry))
4588 		goto out_putpath;
4589 
4590 	error = -EXDEV;
4591 	if (old_path.mnt != new_path.mnt)
4592 		goto out_dput;
4593 	mnt_userns = mnt_user_ns(new_path.mnt);
4594 	error = may_linkat(mnt_userns, &old_path);
4595 	if (unlikely(error))
4596 		goto out_dput;
4597 	error = security_path_link(old_path.dentry, &new_path, new_dentry);
4598 	if (error)
4599 		goto out_dput;
4600 	error = vfs_link(old_path.dentry, mnt_userns, new_path.dentry->d_inode,
4601 			 new_dentry, &delegated_inode);
4602 out_dput:
4603 	done_path_create(&new_path, new_dentry);
4604 	if (delegated_inode) {
4605 		error = break_deleg_wait(&delegated_inode);
4606 		if (!error) {
4607 			path_put(&old_path);
4608 			goto retry;
4609 		}
4610 	}
4611 	if (retry_estale(error, how)) {
4612 		path_put(&old_path);
4613 		how |= LOOKUP_REVAL;
4614 		goto retry;
4615 	}
4616 out_putpath:
4617 	path_put(&old_path);
4618 out_putnames:
4619 	putname(old);
4620 	putname(new);
4621 
4622 	return error;
4623 }
4624 
SYSCALL_DEFINE5(linkat,int,olddfd,const char __user *,oldname,int,newdfd,const char __user *,newname,int,flags)4625 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
4626 		int, newdfd, const char __user *, newname, int, flags)
4627 {
4628 	return do_linkat(olddfd, getname_uflags(oldname, flags),
4629 		newdfd, getname(newname), flags);
4630 }
4631 
SYSCALL_DEFINE2(link,const char __user *,oldname,const char __user *,newname)4632 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
4633 {
4634 	return do_linkat(AT_FDCWD, getname(oldname), AT_FDCWD, getname(newname), 0);
4635 }
4636 
4637 /**
4638  * vfs_rename - rename a filesystem object
4639  * @rd:		pointer to &struct renamedata info
4640  *
4641  * The caller must hold multiple mutexes--see lock_rename()).
4642  *
4643  * If vfs_rename discovers a delegation in need of breaking at either
4644  * the source or destination, it will return -EWOULDBLOCK and return a
4645  * reference to the inode in delegated_inode.  The caller should then
4646  * break the delegation and retry.  Because breaking a delegation may
4647  * take a long time, the caller should drop all locks before doing
4648  * so.
4649  *
4650  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4651  * be appropriate for callers that expect the underlying filesystem not
4652  * to be NFS exported.
4653  *
4654  * The worst of all namespace operations - renaming directory. "Perverted"
4655  * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
4656  * Problems:
4657  *
4658  *	a) we can get into loop creation.
4659  *	b) race potential - two innocent renames can create a loop together.
4660  *	   That's where 4.4 screws up. Current fix: serialization on
4661  *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
4662  *	   story.
4663  *	c) we have to lock _four_ objects - parents and victim (if it exists),
4664  *	   and source (if it is not a directory).
4665  *	   And that - after we got ->i_mutex on parents (until then we don't know
4666  *	   whether the target exists).  Solution: try to be smart with locking
4667  *	   order for inodes.  We rely on the fact that tree topology may change
4668  *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
4669  *	   move will be locked.  Thus we can rank directories by the tree
4670  *	   (ancestors first) and rank all non-directories after them.
4671  *	   That works since everybody except rename does "lock parent, lookup,
4672  *	   lock child" and rename is under ->s_vfs_rename_mutex.
4673  *	   HOWEVER, it relies on the assumption that any object with ->lookup()
4674  *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
4675  *	   we'd better make sure that there's no link(2) for them.
4676  *	d) conversion from fhandle to dentry may come in the wrong moment - when
4677  *	   we are removing the target. Solution: we will have to grab ->i_mutex
4678  *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
4679  *	   ->i_mutex on parents, which works but leads to some truly excessive
4680  *	   locking].
4681  */
vfs_rename(struct renamedata * rd)4682 int vfs_rename(struct renamedata *rd)
4683 {
4684 	int error;
4685 	struct inode *old_dir = rd->old_dir, *new_dir = rd->new_dir;
4686 	struct dentry *old_dentry = rd->old_dentry;
4687 	struct dentry *new_dentry = rd->new_dentry;
4688 	struct inode **delegated_inode = rd->delegated_inode;
4689 	unsigned int flags = rd->flags;
4690 	bool is_dir = d_is_dir(old_dentry);
4691 	struct inode *source = old_dentry->d_inode;
4692 	struct inode *target = new_dentry->d_inode;
4693 	bool new_is_dir = false;
4694 	unsigned max_links = new_dir->i_sb->s_max_links;
4695 	struct name_snapshot old_name;
4696 
4697 	if (source == target)
4698 		return 0;
4699 
4700 	error = may_delete(rd->old_mnt_userns, old_dir, old_dentry, is_dir);
4701 	if (error)
4702 		return error;
4703 
4704 	if (!target) {
4705 		error = may_create(rd->new_mnt_userns, new_dir, new_dentry);
4706 	} else {
4707 		new_is_dir = d_is_dir(new_dentry);
4708 
4709 		if (!(flags & RENAME_EXCHANGE))
4710 			error = may_delete(rd->new_mnt_userns, new_dir,
4711 					   new_dentry, is_dir);
4712 		else
4713 			error = may_delete(rd->new_mnt_userns, new_dir,
4714 					   new_dentry, new_is_dir);
4715 	}
4716 	if (error)
4717 		return error;
4718 
4719 	if (!old_dir->i_op->rename)
4720 		return -EPERM;
4721 
4722 	/*
4723 	 * If we are going to change the parent - check write permissions,
4724 	 * we'll need to flip '..'.
4725 	 */
4726 	if (new_dir != old_dir) {
4727 		if (is_dir) {
4728 			error = inode_permission(rd->old_mnt_userns, source,
4729 						 MAY_WRITE);
4730 			if (error)
4731 				return error;
4732 		}
4733 		if ((flags & RENAME_EXCHANGE) && new_is_dir) {
4734 			error = inode_permission(rd->new_mnt_userns, target,
4735 						 MAY_WRITE);
4736 			if (error)
4737 				return error;
4738 		}
4739 	}
4740 
4741 	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
4742 				      flags);
4743 	if (error)
4744 		return error;
4745 
4746 	take_dentry_name_snapshot(&old_name, old_dentry);
4747 	dget(new_dentry);
4748 	if (!is_dir || (flags & RENAME_EXCHANGE))
4749 		lock_two_nondirectories(source, target);
4750 	else if (target)
4751 		inode_lock(target);
4752 
4753 	error = -EPERM;
4754 	if (IS_SWAPFILE(source) || (target && IS_SWAPFILE(target)))
4755 		goto out;
4756 
4757 	error = -EBUSY;
4758 	if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
4759 		goto out;
4760 
4761 	if (max_links && new_dir != old_dir) {
4762 		error = -EMLINK;
4763 		if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
4764 			goto out;
4765 		if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
4766 		    old_dir->i_nlink >= max_links)
4767 			goto out;
4768 	}
4769 	if (!is_dir) {
4770 		error = try_break_deleg(source, delegated_inode);
4771 		if (error)
4772 			goto out;
4773 	}
4774 	if (target && !new_is_dir) {
4775 		error = try_break_deleg(target, delegated_inode);
4776 		if (error)
4777 			goto out;
4778 	}
4779 	error = old_dir->i_op->rename(rd->new_mnt_userns, old_dir, old_dentry,
4780 				      new_dir, new_dentry, flags);
4781 	if (error)
4782 		goto out;
4783 
4784 	if (!(flags & RENAME_EXCHANGE) && target) {
4785 		if (is_dir) {
4786 			shrink_dcache_parent(new_dentry);
4787 			target->i_flags |= S_DEAD;
4788 		}
4789 		dont_mount(new_dentry);
4790 		detach_mounts(new_dentry);
4791 	}
4792 	if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
4793 		if (!(flags & RENAME_EXCHANGE))
4794 			d_move(old_dentry, new_dentry);
4795 		else
4796 			d_exchange(old_dentry, new_dentry);
4797 	}
4798 out:
4799 	if (!is_dir || (flags & RENAME_EXCHANGE))
4800 		unlock_two_nondirectories(source, target);
4801 	else if (target)
4802 		inode_unlock(target);
4803 	dput(new_dentry);
4804 	if (!error) {
4805 		fsnotify_move(old_dir, new_dir, &old_name.name, is_dir,
4806 			      !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
4807 		if (flags & RENAME_EXCHANGE) {
4808 			fsnotify_move(new_dir, old_dir, &old_dentry->d_name,
4809 				      new_is_dir, NULL, new_dentry);
4810 		}
4811 	}
4812 	release_dentry_name_snapshot(&old_name);
4813 
4814 	return error;
4815 }
4816 EXPORT_SYMBOL(vfs_rename);
4817 
do_renameat2(int olddfd,struct filename * from,int newdfd,struct filename * to,unsigned int flags)4818 int do_renameat2(int olddfd, struct filename *from, int newdfd,
4819 		 struct filename *to, unsigned int flags)
4820 {
4821 	struct renamedata rd;
4822 	struct dentry *old_dentry, *new_dentry;
4823 	struct dentry *trap;
4824 	struct path old_path, new_path;
4825 	struct qstr old_last, new_last;
4826 	int old_type, new_type;
4827 	struct inode *delegated_inode = NULL;
4828 	unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
4829 	bool should_retry = false;
4830 	int error = -EINVAL;
4831 
4832 	if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
4833 		goto put_names;
4834 
4835 	if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
4836 	    (flags & RENAME_EXCHANGE))
4837 		goto put_names;
4838 
4839 	if (flags & RENAME_EXCHANGE)
4840 		target_flags = 0;
4841 
4842 retry:
4843 	error = filename_parentat(olddfd, from, lookup_flags, &old_path,
4844 				  &old_last, &old_type);
4845 	if (error)
4846 		goto put_names;
4847 
4848 	error = filename_parentat(newdfd, to, lookup_flags, &new_path, &new_last,
4849 				  &new_type);
4850 	if (error)
4851 		goto exit1;
4852 
4853 	error = -EXDEV;
4854 	if (old_path.mnt != new_path.mnt)
4855 		goto exit2;
4856 
4857 	error = -EBUSY;
4858 	if (old_type != LAST_NORM)
4859 		goto exit2;
4860 
4861 	if (flags & RENAME_NOREPLACE)
4862 		error = -EEXIST;
4863 	if (new_type != LAST_NORM)
4864 		goto exit2;
4865 
4866 	error = mnt_want_write(old_path.mnt);
4867 	if (error)
4868 		goto exit2;
4869 
4870 retry_deleg:
4871 	trap = lock_rename(new_path.dentry, old_path.dentry);
4872 
4873 	old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags);
4874 	error = PTR_ERR(old_dentry);
4875 	if (IS_ERR(old_dentry))
4876 		goto exit3;
4877 	/* source must exist */
4878 	error = -ENOENT;
4879 	if (d_is_negative(old_dentry))
4880 		goto exit4;
4881 	new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags);
4882 	error = PTR_ERR(new_dentry);
4883 	if (IS_ERR(new_dentry))
4884 		goto exit4;
4885 	error = -EEXIST;
4886 	if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
4887 		goto exit5;
4888 	if (flags & RENAME_EXCHANGE) {
4889 		error = -ENOENT;
4890 		if (d_is_negative(new_dentry))
4891 			goto exit5;
4892 
4893 		if (!d_is_dir(new_dentry)) {
4894 			error = -ENOTDIR;
4895 			if (new_last.name[new_last.len])
4896 				goto exit5;
4897 		}
4898 	}
4899 	/* unless the source is a directory trailing slashes give -ENOTDIR */
4900 	if (!d_is_dir(old_dentry)) {
4901 		error = -ENOTDIR;
4902 		if (old_last.name[old_last.len])
4903 			goto exit5;
4904 		if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
4905 			goto exit5;
4906 	}
4907 	/* source should not be ancestor of target */
4908 	error = -EINVAL;
4909 	if (old_dentry == trap)
4910 		goto exit5;
4911 	/* target should not be an ancestor of source */
4912 	if (!(flags & RENAME_EXCHANGE))
4913 		error = -ENOTEMPTY;
4914 	if (new_dentry == trap)
4915 		goto exit5;
4916 
4917 	error = security_path_rename(&old_path, old_dentry,
4918 				     &new_path, new_dentry, flags);
4919 	if (error)
4920 		goto exit5;
4921 
4922 	rd.old_dir	   = old_path.dentry->d_inode;
4923 	rd.old_dentry	   = old_dentry;
4924 	rd.old_mnt_userns  = mnt_user_ns(old_path.mnt);
4925 	rd.new_dir	   = new_path.dentry->d_inode;
4926 	rd.new_dentry	   = new_dentry;
4927 	rd.new_mnt_userns  = mnt_user_ns(new_path.mnt);
4928 	rd.delegated_inode = &delegated_inode;
4929 	rd.flags	   = flags;
4930 	error = vfs_rename(&rd);
4931 exit5:
4932 	dput(new_dentry);
4933 exit4:
4934 	dput(old_dentry);
4935 exit3:
4936 	unlock_rename(new_path.dentry, old_path.dentry);
4937 	if (delegated_inode) {
4938 		error = break_deleg_wait(&delegated_inode);
4939 		if (!error)
4940 			goto retry_deleg;
4941 	}
4942 	mnt_drop_write(old_path.mnt);
4943 exit2:
4944 	if (retry_estale(error, lookup_flags))
4945 		should_retry = true;
4946 	path_put(&new_path);
4947 exit1:
4948 	path_put(&old_path);
4949 	if (should_retry) {
4950 		should_retry = false;
4951 		lookup_flags |= LOOKUP_REVAL;
4952 		goto retry;
4953 	}
4954 put_names:
4955 	putname(from);
4956 	putname(to);
4957 	return error;
4958 }
4959 
SYSCALL_DEFINE5(renameat2,int,olddfd,const char __user *,oldname,int,newdfd,const char __user *,newname,unsigned int,flags)4960 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
4961 		int, newdfd, const char __user *, newname, unsigned int, flags)
4962 {
4963 	return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname),
4964 				flags);
4965 }
4966 
SYSCALL_DEFINE4(renameat,int,olddfd,const char __user *,oldname,int,newdfd,const char __user *,newname)4967 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
4968 		int, newdfd, const char __user *, newname)
4969 {
4970 	return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname),
4971 				0);
4972 }
4973 
SYSCALL_DEFINE2(rename,const char __user *,oldname,const char __user *,newname)4974 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
4975 {
4976 	return do_renameat2(AT_FDCWD, getname(oldname), AT_FDCWD,
4977 				getname(newname), 0);
4978 }
4979 
readlink_copy(char __user * buffer,int buflen,const char * link)4980 int readlink_copy(char __user *buffer, int buflen, const char *link)
4981 {
4982 	int len = PTR_ERR(link);
4983 	if (IS_ERR(link))
4984 		goto out;
4985 
4986 	len = strlen(link);
4987 	if (len > (unsigned) buflen)
4988 		len = buflen;
4989 	if (copy_to_user(buffer, link, len))
4990 		len = -EFAULT;
4991 out:
4992 	return len;
4993 }
4994 
4995 /**
4996  * vfs_readlink - copy symlink body into userspace buffer
4997  * @dentry: dentry on which to get symbolic link
4998  * @buffer: user memory pointer
4999  * @buflen: size of buffer
5000  *
5001  * Does not touch atime.  That's up to the caller if necessary
5002  *
5003  * Does not call security hook.
5004  */
vfs_readlink(struct dentry * dentry,char __user * buffer,int buflen)5005 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
5006 {
5007 	struct inode *inode = d_inode(dentry);
5008 	DEFINE_DELAYED_CALL(done);
5009 	const char *link;
5010 	int res;
5011 
5012 	if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) {
5013 		if (unlikely(inode->i_op->readlink))
5014 			return inode->i_op->readlink(dentry, buffer, buflen);
5015 
5016 		if (!d_is_symlink(dentry))
5017 			return -EINVAL;
5018 
5019 		spin_lock(&inode->i_lock);
5020 		inode->i_opflags |= IOP_DEFAULT_READLINK;
5021 		spin_unlock(&inode->i_lock);
5022 	}
5023 
5024 	link = READ_ONCE(inode->i_link);
5025 	if (!link) {
5026 		link = inode->i_op->get_link(dentry, inode, &done);
5027 		if (IS_ERR(link))
5028 			return PTR_ERR(link);
5029 	}
5030 	res = readlink_copy(buffer, buflen, link);
5031 	do_delayed_call(&done);
5032 	return res;
5033 }
5034 EXPORT_SYMBOL(vfs_readlink);
5035 
5036 /**
5037  * vfs_get_link - get symlink body
5038  * @dentry: dentry on which to get symbolic link
5039  * @done: caller needs to free returned data with this
5040  *
5041  * Calls security hook and i_op->get_link() on the supplied inode.
5042  *
5043  * It does not touch atime.  That's up to the caller if necessary.
5044  *
5045  * Does not work on "special" symlinks like /proc/$$/fd/N
5046  */
vfs_get_link(struct dentry * dentry,struct delayed_call * done)5047 const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
5048 {
5049 	const char *res = ERR_PTR(-EINVAL);
5050 	struct inode *inode = d_inode(dentry);
5051 
5052 	if (d_is_symlink(dentry)) {
5053 		res = ERR_PTR(security_inode_readlink(dentry));
5054 		if (!res)
5055 			res = inode->i_op->get_link(dentry, inode, done);
5056 	}
5057 	return res;
5058 }
5059 EXPORT_SYMBOL(vfs_get_link);
5060 
5061 /* get the link contents into pagecache */
page_get_link(struct dentry * dentry,struct inode * inode,struct delayed_call * callback)5062 const char *page_get_link(struct dentry *dentry, struct inode *inode,
5063 			  struct delayed_call *callback)
5064 {
5065 	char *kaddr;
5066 	struct page *page;
5067 	struct address_space *mapping = inode->i_mapping;
5068 
5069 	if (!dentry) {
5070 		page = find_get_page(mapping, 0);
5071 		if (!page)
5072 			return ERR_PTR(-ECHILD);
5073 		if (!PageUptodate(page)) {
5074 			put_page(page);
5075 			return ERR_PTR(-ECHILD);
5076 		}
5077 	} else {
5078 		page = read_mapping_page(mapping, 0, NULL);
5079 		if (IS_ERR(page))
5080 			return (char*)page;
5081 	}
5082 	set_delayed_call(callback, page_put_link, page);
5083 	BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
5084 	kaddr = page_address(page);
5085 	nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
5086 	return kaddr;
5087 }
5088 
5089 EXPORT_SYMBOL(page_get_link);
5090 
page_put_link(void * arg)5091 void page_put_link(void *arg)
5092 {
5093 	put_page(arg);
5094 }
5095 EXPORT_SYMBOL(page_put_link);
5096 
page_readlink(struct dentry * dentry,char __user * buffer,int buflen)5097 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
5098 {
5099 	DEFINE_DELAYED_CALL(done);
5100 	int res = readlink_copy(buffer, buflen,
5101 				page_get_link(dentry, d_inode(dentry),
5102 					      &done));
5103 	do_delayed_call(&done);
5104 	return res;
5105 }
5106 EXPORT_SYMBOL(page_readlink);
5107 
page_symlink(struct inode * inode,const char * symname,int len)5108 int page_symlink(struct inode *inode, const char *symname, int len)
5109 {
5110 	struct address_space *mapping = inode->i_mapping;
5111 	const struct address_space_operations *aops = mapping->a_ops;
5112 	bool nofs = !mapping_gfp_constraint(mapping, __GFP_FS);
5113 	struct page *page;
5114 	void *fsdata = NULL;
5115 	int err;
5116 	unsigned int flags;
5117 
5118 retry:
5119 	if (nofs)
5120 		flags = memalloc_nofs_save();
5121 	err = aops->write_begin(NULL, mapping, 0, len-1, &page, &fsdata);
5122 	if (nofs)
5123 		memalloc_nofs_restore(flags);
5124 	if (err)
5125 		goto fail;
5126 
5127 	memcpy(page_address(page), symname, len-1);
5128 
5129 	err = aops->write_end(NULL, mapping, 0, len-1, len-1,
5130 							page, fsdata);
5131 	if (err < 0)
5132 		goto fail;
5133 	if (err < len-1)
5134 		goto retry;
5135 
5136 	mark_inode_dirty(inode);
5137 	return 0;
5138 fail:
5139 	return err;
5140 }
5141 EXPORT_SYMBOL(page_symlink);
5142 
5143 const struct inode_operations page_symlink_inode_operations = {
5144 	.get_link	= page_get_link,
5145 };
5146 EXPORT_SYMBOL(page_symlink_inode_operations);
5147