1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * fs/kernfs/dir.c - kernfs directory implementation
4  *
5  * Copyright (c) 2001-3 Patrick Mochel
6  * Copyright (c) 2007 SUSE Linux Products GmbH
7  * Copyright (c) 2007, 2013 Tejun Heo <tj@kernel.org>
8  */
9 
10 #include <linux/sched.h>
11 #include <linux/fs.h>
12 #include <linux/namei.h>
13 #include <linux/idr.h>
14 #include <linux/slab.h>
15 #include <linux/security.h>
16 #include <linux/hash.h>
17 
18 #include "kernfs-internal.h"
19 
20 static DEFINE_RWLOCK(kernfs_rename_lock);	/* kn->parent and ->name */
21 /*
22  * Don't use rename_lock to piggy back on pr_cont_buf. We don't want to
23  * call pr_cont() while holding rename_lock. Because sometimes pr_cont()
24  * will perform wakeups when releasing console_sem. Holding rename_lock
25  * will introduce deadlock if the scheduler reads the kernfs_name in the
26  * wakeup path.
27  */
28 static DEFINE_SPINLOCK(kernfs_pr_cont_lock);
29 static char kernfs_pr_cont_buf[PATH_MAX];	/* protected by pr_cont_lock */
30 static DEFINE_SPINLOCK(kernfs_idr_lock);	/* root->ino_idr */
31 
32 #define rb_to_kn(X) rb_entry((X), struct kernfs_node, rb)
33 
__kernfs_active(struct kernfs_node * kn)34 static bool __kernfs_active(struct kernfs_node *kn)
35 {
36 	return atomic_read(&kn->active) >= 0;
37 }
38 
kernfs_active(struct kernfs_node * kn)39 static bool kernfs_active(struct kernfs_node *kn)
40 {
41 	lockdep_assert_held(&kernfs_root(kn)->kernfs_rwsem);
42 	return __kernfs_active(kn);
43 }
44 
kernfs_lockdep(struct kernfs_node * kn)45 static bool kernfs_lockdep(struct kernfs_node *kn)
46 {
47 #ifdef CONFIG_DEBUG_LOCK_ALLOC
48 	return kn->flags & KERNFS_LOCKDEP;
49 #else
50 	return false;
51 #endif
52 }
53 
kernfs_name_locked(struct kernfs_node * kn,char * buf,size_t buflen)54 static int kernfs_name_locked(struct kernfs_node *kn, char *buf, size_t buflen)
55 {
56 	if (!kn)
57 		return strlcpy(buf, "(null)", buflen);
58 
59 	return strlcpy(buf, kn->parent ? kn->name : "/", buflen);
60 }
61 
62 /* kernfs_node_depth - compute depth from @from to @to */
kernfs_depth(struct kernfs_node * from,struct kernfs_node * to)63 static size_t kernfs_depth(struct kernfs_node *from, struct kernfs_node *to)
64 {
65 	size_t depth = 0;
66 
67 	while (to->parent && to != from) {
68 		depth++;
69 		to = to->parent;
70 	}
71 	return depth;
72 }
73 
kernfs_common_ancestor(struct kernfs_node * a,struct kernfs_node * b)74 static struct kernfs_node *kernfs_common_ancestor(struct kernfs_node *a,
75 						  struct kernfs_node *b)
76 {
77 	size_t da, db;
78 	struct kernfs_root *ra = kernfs_root(a), *rb = kernfs_root(b);
79 
80 	if (ra != rb)
81 		return NULL;
82 
83 	da = kernfs_depth(ra->kn, a);
84 	db = kernfs_depth(rb->kn, b);
85 
86 	while (da > db) {
87 		a = a->parent;
88 		da--;
89 	}
90 	while (db > da) {
91 		b = b->parent;
92 		db--;
93 	}
94 
95 	/* worst case b and a will be the same at root */
96 	while (b != a) {
97 		b = b->parent;
98 		a = a->parent;
99 	}
100 
101 	return a;
102 }
103 
104 /**
105  * kernfs_path_from_node_locked - find a pseudo-absolute path to @kn_to,
106  * where kn_from is treated as root of the path.
107  * @kn_from: kernfs node which should be treated as root for the path
108  * @kn_to: kernfs node to which path is needed
109  * @buf: buffer to copy the path into
110  * @buflen: size of @buf
111  *
112  * We need to handle couple of scenarios here:
113  * [1] when @kn_from is an ancestor of @kn_to at some level
114  * kn_from: /n1/n2/n3
115  * kn_to:   /n1/n2/n3/n4/n5
116  * result:  /n4/n5
117  *
118  * [2] when @kn_from is on a different hierarchy and we need to find common
119  * ancestor between @kn_from and @kn_to.
120  * kn_from: /n1/n2/n3/n4
121  * kn_to:   /n1/n2/n5
122  * result:  /../../n5
123  * OR
124  * kn_from: /n1/n2/n3/n4/n5   [depth=5]
125  * kn_to:   /n1/n2/n3         [depth=3]
126  * result:  /../..
127  *
128  * [3] when @kn_to is %NULL result will be "(null)"
129  *
130  * Return: the length of the full path.  If the full length is equal to or
131  * greater than @buflen, @buf contains the truncated path with the trailing
132  * '\0'.  On error, -errno is returned.
133  */
kernfs_path_from_node_locked(struct kernfs_node * kn_to,struct kernfs_node * kn_from,char * buf,size_t buflen)134 static int kernfs_path_from_node_locked(struct kernfs_node *kn_to,
135 					struct kernfs_node *kn_from,
136 					char *buf, size_t buflen)
137 {
138 	struct kernfs_node *kn, *common;
139 	const char parent_str[] = "/..";
140 	size_t depth_from, depth_to, len = 0;
141 	int i, j;
142 
143 	if (!kn_to)
144 		return strlcpy(buf, "(null)", buflen);
145 
146 	if (!kn_from)
147 		kn_from = kernfs_root(kn_to)->kn;
148 
149 	if (kn_from == kn_to)
150 		return strlcpy(buf, "/", buflen);
151 
152 	common = kernfs_common_ancestor(kn_from, kn_to);
153 	if (WARN_ON(!common))
154 		return -EINVAL;
155 
156 	depth_to = kernfs_depth(common, kn_to);
157 	depth_from = kernfs_depth(common, kn_from);
158 
159 	buf[0] = '\0';
160 
161 	for (i = 0; i < depth_from; i++)
162 		len += strlcpy(buf + len, parent_str,
163 			       len < buflen ? buflen - len : 0);
164 
165 	/* Calculate how many bytes we need for the rest */
166 	for (i = depth_to - 1; i >= 0; i--) {
167 		for (kn = kn_to, j = 0; j < i; j++)
168 			kn = kn->parent;
169 		len += strlcpy(buf + len, "/",
170 			       len < buflen ? buflen - len : 0);
171 		len += strlcpy(buf + len, kn->name,
172 			       len < buflen ? buflen - len : 0);
173 	}
174 
175 	return len;
176 }
177 
178 /**
179  * kernfs_name - obtain the name of a given node
180  * @kn: kernfs_node of interest
181  * @buf: buffer to copy @kn's name into
182  * @buflen: size of @buf
183  *
184  * Copies the name of @kn into @buf of @buflen bytes.  The behavior is
185  * similar to strlcpy().
186  *
187  * Fills buffer with "(null)" if @kn is %NULL.
188  *
189  * Return: the length of @kn's name and if @buf isn't long enough,
190  * it's filled up to @buflen-1 and nul terminated.
191  *
192  * This function can be called from any context.
193  */
kernfs_name(struct kernfs_node * kn,char * buf,size_t buflen)194 int kernfs_name(struct kernfs_node *kn, char *buf, size_t buflen)
195 {
196 	unsigned long flags;
197 	int ret;
198 
199 	read_lock_irqsave(&kernfs_rename_lock, flags);
200 	ret = kernfs_name_locked(kn, buf, buflen);
201 	read_unlock_irqrestore(&kernfs_rename_lock, flags);
202 	return ret;
203 }
204 
205 /**
206  * kernfs_path_from_node - build path of node @to relative to @from.
207  * @from: parent kernfs_node relative to which we need to build the path
208  * @to: kernfs_node of interest
209  * @buf: buffer to copy @to's path into
210  * @buflen: size of @buf
211  *
212  * Builds @to's path relative to @from in @buf. @from and @to must
213  * be on the same kernfs-root. If @from is not parent of @to, then a relative
214  * path (which includes '..'s) as needed to reach from @from to @to is
215  * returned.
216  *
217  * Return: the length of the full path.  If the full length is equal to or
218  * greater than @buflen, @buf contains the truncated path with the trailing
219  * '\0'.  On error, -errno is returned.
220  */
kernfs_path_from_node(struct kernfs_node * to,struct kernfs_node * from,char * buf,size_t buflen)221 int kernfs_path_from_node(struct kernfs_node *to, struct kernfs_node *from,
222 			  char *buf, size_t buflen)
223 {
224 	unsigned long flags;
225 	int ret;
226 
227 	read_lock_irqsave(&kernfs_rename_lock, flags);
228 	ret = kernfs_path_from_node_locked(to, from, buf, buflen);
229 	read_unlock_irqrestore(&kernfs_rename_lock, flags);
230 	return ret;
231 }
232 EXPORT_SYMBOL_GPL(kernfs_path_from_node);
233 
234 /**
235  * pr_cont_kernfs_name - pr_cont name of a kernfs_node
236  * @kn: kernfs_node of interest
237  *
238  * This function can be called from any context.
239  */
pr_cont_kernfs_name(struct kernfs_node * kn)240 void pr_cont_kernfs_name(struct kernfs_node *kn)
241 {
242 	unsigned long flags;
243 
244 	spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
245 
246 	kernfs_name(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
247 	pr_cont("%s", kernfs_pr_cont_buf);
248 
249 	spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
250 }
251 
252 /**
253  * pr_cont_kernfs_path - pr_cont path of a kernfs_node
254  * @kn: kernfs_node of interest
255  *
256  * This function can be called from any context.
257  */
pr_cont_kernfs_path(struct kernfs_node * kn)258 void pr_cont_kernfs_path(struct kernfs_node *kn)
259 {
260 	unsigned long flags;
261 	int sz;
262 
263 	spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
264 
265 	sz = kernfs_path_from_node(kn, NULL, kernfs_pr_cont_buf,
266 				   sizeof(kernfs_pr_cont_buf));
267 	if (sz < 0) {
268 		pr_cont("(error)");
269 		goto out;
270 	}
271 
272 	if (sz >= sizeof(kernfs_pr_cont_buf)) {
273 		pr_cont("(name too long)");
274 		goto out;
275 	}
276 
277 	pr_cont("%s", kernfs_pr_cont_buf);
278 
279 out:
280 	spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
281 }
282 
283 /**
284  * kernfs_get_parent - determine the parent node and pin it
285  * @kn: kernfs_node of interest
286  *
287  * Determines @kn's parent, pins and returns it.  This function can be
288  * called from any context.
289  *
290  * Return: parent node of @kn
291  */
kernfs_get_parent(struct kernfs_node * kn)292 struct kernfs_node *kernfs_get_parent(struct kernfs_node *kn)
293 {
294 	struct kernfs_node *parent;
295 	unsigned long flags;
296 
297 	read_lock_irqsave(&kernfs_rename_lock, flags);
298 	parent = kn->parent;
299 	kernfs_get(parent);
300 	read_unlock_irqrestore(&kernfs_rename_lock, flags);
301 
302 	return parent;
303 }
304 
305 /**
306  *	kernfs_name_hash - calculate hash of @ns + @name
307  *	@name: Null terminated string to hash
308  *	@ns:   Namespace tag to hash
309  *
310  *	Return: 31-bit hash of ns + name (so it fits in an off_t)
311  */
kernfs_name_hash(const char * name,const void * ns)312 static unsigned int kernfs_name_hash(const char *name, const void *ns)
313 {
314 	unsigned long hash = init_name_hash(ns);
315 	unsigned int len = strlen(name);
316 	while (len--)
317 		hash = partial_name_hash(*name++, hash);
318 	hash = end_name_hash(hash);
319 	hash &= 0x7fffffffU;
320 	/* Reserve hash numbers 0, 1 and INT_MAX for magic directory entries */
321 	if (hash < 2)
322 		hash += 2;
323 	if (hash >= INT_MAX)
324 		hash = INT_MAX - 1;
325 	return hash;
326 }
327 
kernfs_name_compare(unsigned int hash,const char * name,const void * ns,const struct kernfs_node * kn)328 static int kernfs_name_compare(unsigned int hash, const char *name,
329 			       const void *ns, const struct kernfs_node *kn)
330 {
331 	if (hash < kn->hash)
332 		return -1;
333 	if (hash > kn->hash)
334 		return 1;
335 	if (ns < kn->ns)
336 		return -1;
337 	if (ns > kn->ns)
338 		return 1;
339 	return strcmp(name, kn->name);
340 }
341 
kernfs_sd_compare(const struct kernfs_node * left,const struct kernfs_node * right)342 static int kernfs_sd_compare(const struct kernfs_node *left,
343 			     const struct kernfs_node *right)
344 {
345 	return kernfs_name_compare(left->hash, left->name, left->ns, right);
346 }
347 
348 /**
349  *	kernfs_link_sibling - link kernfs_node into sibling rbtree
350  *	@kn: kernfs_node of interest
351  *
352  *	Link @kn into its sibling rbtree which starts from
353  *	@kn->parent->dir.children.
354  *
355  *	Locking:
356  *	kernfs_rwsem held exclusive
357  *
358  *	Return:
359  *	%0 on success, -EEXIST on failure.
360  */
kernfs_link_sibling(struct kernfs_node * kn)361 static int kernfs_link_sibling(struct kernfs_node *kn)
362 {
363 	struct rb_node **node = &kn->parent->dir.children.rb_node;
364 	struct rb_node *parent = NULL;
365 
366 	while (*node) {
367 		struct kernfs_node *pos;
368 		int result;
369 
370 		pos = rb_to_kn(*node);
371 		parent = *node;
372 		result = kernfs_sd_compare(kn, pos);
373 		if (result < 0)
374 			node = &pos->rb.rb_left;
375 		else if (result > 0)
376 			node = &pos->rb.rb_right;
377 		else
378 			return -EEXIST;
379 	}
380 
381 	/* add new node and rebalance the tree */
382 	rb_link_node(&kn->rb, parent, node);
383 	rb_insert_color(&kn->rb, &kn->parent->dir.children);
384 
385 	/* successfully added, account subdir number */
386 	down_write(&kernfs_root(kn)->kernfs_iattr_rwsem);
387 	if (kernfs_type(kn) == KERNFS_DIR)
388 		kn->parent->dir.subdirs++;
389 	kernfs_inc_rev(kn->parent);
390 	up_write(&kernfs_root(kn)->kernfs_iattr_rwsem);
391 
392 	return 0;
393 }
394 
395 /**
396  *	kernfs_unlink_sibling - unlink kernfs_node from sibling rbtree
397  *	@kn: kernfs_node of interest
398  *
399  *	Try to unlink @kn from its sibling rbtree which starts from
400  *	kn->parent->dir.children.
401  *
402  *	Return: %true if @kn was actually removed,
403  *	%false if @kn wasn't on the rbtree.
404  *
405  *	Locking:
406  *	kernfs_rwsem held exclusive
407  */
kernfs_unlink_sibling(struct kernfs_node * kn)408 static bool kernfs_unlink_sibling(struct kernfs_node *kn)
409 {
410 	if (RB_EMPTY_NODE(&kn->rb))
411 		return false;
412 
413 	down_write(&kernfs_root(kn)->kernfs_iattr_rwsem);
414 	if (kernfs_type(kn) == KERNFS_DIR)
415 		kn->parent->dir.subdirs--;
416 	kernfs_inc_rev(kn->parent);
417 	up_write(&kernfs_root(kn)->kernfs_iattr_rwsem);
418 
419 	rb_erase(&kn->rb, &kn->parent->dir.children);
420 	RB_CLEAR_NODE(&kn->rb);
421 	return true;
422 }
423 
424 /**
425  *	kernfs_get_active - get an active reference to kernfs_node
426  *	@kn: kernfs_node to get an active reference to
427  *
428  *	Get an active reference of @kn.  This function is noop if @kn
429  *	is %NULL.
430  *
431  *	Return:
432  *	Pointer to @kn on success, %NULL on failure.
433  */
kernfs_get_active(struct kernfs_node * kn)434 struct kernfs_node *kernfs_get_active(struct kernfs_node *kn)
435 {
436 	if (unlikely(!kn))
437 		return NULL;
438 
439 	if (!atomic_inc_unless_negative(&kn->active))
440 		return NULL;
441 
442 	if (kernfs_lockdep(kn))
443 		rwsem_acquire_read(&kn->dep_map, 0, 1, _RET_IP_);
444 	return kn;
445 }
446 
447 /**
448  *	kernfs_put_active - put an active reference to kernfs_node
449  *	@kn: kernfs_node to put an active reference to
450  *
451  *	Put an active reference to @kn.  This function is noop if @kn
452  *	is %NULL.
453  */
kernfs_put_active(struct kernfs_node * kn)454 void kernfs_put_active(struct kernfs_node *kn)
455 {
456 	int v;
457 
458 	if (unlikely(!kn))
459 		return;
460 
461 	if (kernfs_lockdep(kn))
462 		rwsem_release(&kn->dep_map, _RET_IP_);
463 	v = atomic_dec_return(&kn->active);
464 	if (likely(v != KN_DEACTIVATED_BIAS))
465 		return;
466 
467 	wake_up_all(&kernfs_root(kn)->deactivate_waitq);
468 }
469 
470 /**
471  * kernfs_drain - drain kernfs_node
472  * @kn: kernfs_node to drain
473  *
474  * Drain existing usages and nuke all existing mmaps of @kn.  Multiple
475  * removers may invoke this function concurrently on @kn and all will
476  * return after draining is complete.
477  */
kernfs_drain(struct kernfs_node * kn)478 static void kernfs_drain(struct kernfs_node *kn)
479 	__releases(&kernfs_root(kn)->kernfs_rwsem)
480 	__acquires(&kernfs_root(kn)->kernfs_rwsem)
481 {
482 	struct kernfs_root *root = kernfs_root(kn);
483 
484 	lockdep_assert_held_write(&root->kernfs_rwsem);
485 	WARN_ON_ONCE(kernfs_active(kn));
486 
487 	/*
488 	 * Skip draining if already fully drained. This avoids draining and its
489 	 * lockdep annotations for nodes which have never been activated
490 	 * allowing embedding kernfs_remove() in create error paths without
491 	 * worrying about draining.
492 	 */
493 	if (atomic_read(&kn->active) == KN_DEACTIVATED_BIAS &&
494 	    !kernfs_should_drain_open_files(kn))
495 		return;
496 
497 	up_write(&root->kernfs_rwsem);
498 
499 	if (kernfs_lockdep(kn)) {
500 		rwsem_acquire(&kn->dep_map, 0, 0, _RET_IP_);
501 		if (atomic_read(&kn->active) != KN_DEACTIVATED_BIAS)
502 			lock_contended(&kn->dep_map, _RET_IP_);
503 	}
504 
505 	wait_event(root->deactivate_waitq,
506 		   atomic_read(&kn->active) == KN_DEACTIVATED_BIAS);
507 
508 	if (kernfs_lockdep(kn)) {
509 		lock_acquired(&kn->dep_map, _RET_IP_);
510 		rwsem_release(&kn->dep_map, _RET_IP_);
511 	}
512 
513 	if (kernfs_should_drain_open_files(kn))
514 		kernfs_drain_open_files(kn);
515 
516 	down_write(&root->kernfs_rwsem);
517 }
518 
519 /**
520  * kernfs_get - get a reference count on a kernfs_node
521  * @kn: the target kernfs_node
522  */
kernfs_get(struct kernfs_node * kn)523 void kernfs_get(struct kernfs_node *kn)
524 {
525 	if (kn) {
526 		WARN_ON(!atomic_read(&kn->count));
527 		atomic_inc(&kn->count);
528 	}
529 }
530 EXPORT_SYMBOL_GPL(kernfs_get);
531 
532 /**
533  * kernfs_put - put a reference count on a kernfs_node
534  * @kn: the target kernfs_node
535  *
536  * Put a reference count of @kn and destroy it if it reached zero.
537  */
kernfs_put(struct kernfs_node * kn)538 void kernfs_put(struct kernfs_node *kn)
539 {
540 	struct kernfs_node *parent;
541 	struct kernfs_root *root;
542 
543 	if (!kn || !atomic_dec_and_test(&kn->count))
544 		return;
545 	root = kernfs_root(kn);
546  repeat:
547 	/*
548 	 * Moving/renaming is always done while holding reference.
549 	 * kn->parent won't change beneath us.
550 	 */
551 	parent = kn->parent;
552 
553 	WARN_ONCE(atomic_read(&kn->active) != KN_DEACTIVATED_BIAS,
554 		  "kernfs_put: %s/%s: released with incorrect active_ref %d\n",
555 		  parent ? parent->name : "", kn->name, atomic_read(&kn->active));
556 
557 	if (kernfs_type(kn) == KERNFS_LINK)
558 		kernfs_put(kn->symlink.target_kn);
559 
560 	kfree_const(kn->name);
561 
562 	if (kn->iattr) {
563 		simple_xattrs_free(&kn->iattr->xattrs, NULL);
564 		kmem_cache_free(kernfs_iattrs_cache, kn->iattr);
565 	}
566 	spin_lock(&kernfs_idr_lock);
567 	idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
568 	spin_unlock(&kernfs_idr_lock);
569 	kmem_cache_free(kernfs_node_cache, kn);
570 
571 	kn = parent;
572 	if (kn) {
573 		if (atomic_dec_and_test(&kn->count))
574 			goto repeat;
575 	} else {
576 		/* just released the root kn, free @root too */
577 		idr_destroy(&root->ino_idr);
578 		kfree(root);
579 	}
580 }
581 EXPORT_SYMBOL_GPL(kernfs_put);
582 
583 /**
584  * kernfs_node_from_dentry - determine kernfs_node associated with a dentry
585  * @dentry: the dentry in question
586  *
587  * Return: the kernfs_node associated with @dentry.  If @dentry is not a
588  * kernfs one, %NULL is returned.
589  *
590  * While the returned kernfs_node will stay accessible as long as @dentry
591  * is accessible, the returned node can be in any state and the caller is
592  * fully responsible for determining what's accessible.
593  */
kernfs_node_from_dentry(struct dentry * dentry)594 struct kernfs_node *kernfs_node_from_dentry(struct dentry *dentry)
595 {
596 	if (dentry->d_sb->s_op == &kernfs_sops)
597 		return kernfs_dentry_node(dentry);
598 	return NULL;
599 }
600 
__kernfs_new_node(struct kernfs_root * root,struct kernfs_node * parent,const char * name,umode_t mode,kuid_t uid,kgid_t gid,unsigned flags)601 static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
602 					     struct kernfs_node *parent,
603 					     const char *name, umode_t mode,
604 					     kuid_t uid, kgid_t gid,
605 					     unsigned flags)
606 {
607 	struct kernfs_node *kn;
608 	u32 id_highbits;
609 	int ret;
610 
611 	name = kstrdup_const(name, GFP_KERNEL);
612 	if (!name)
613 		return NULL;
614 
615 	kn = kmem_cache_zalloc(kernfs_node_cache, GFP_KERNEL);
616 	if (!kn)
617 		goto err_out1;
618 
619 	idr_preload(GFP_KERNEL);
620 	spin_lock(&kernfs_idr_lock);
621 	ret = idr_alloc_cyclic(&root->ino_idr, kn, 1, 0, GFP_ATOMIC);
622 	if (ret >= 0 && ret < root->last_id_lowbits)
623 		root->id_highbits++;
624 	id_highbits = root->id_highbits;
625 	root->last_id_lowbits = ret;
626 	spin_unlock(&kernfs_idr_lock);
627 	idr_preload_end();
628 	if (ret < 0)
629 		goto err_out2;
630 
631 	kn->id = (u64)id_highbits << 32 | ret;
632 
633 	atomic_set(&kn->count, 1);
634 	atomic_set(&kn->active, KN_DEACTIVATED_BIAS);
635 	RB_CLEAR_NODE(&kn->rb);
636 
637 	kn->name = name;
638 	kn->mode = mode;
639 	kn->flags = flags;
640 
641 	if (!uid_eq(uid, GLOBAL_ROOT_UID) || !gid_eq(gid, GLOBAL_ROOT_GID)) {
642 		struct iattr iattr = {
643 			.ia_valid = ATTR_UID | ATTR_GID,
644 			.ia_uid = uid,
645 			.ia_gid = gid,
646 		};
647 
648 		ret = __kernfs_setattr(kn, &iattr);
649 		if (ret < 0)
650 			goto err_out3;
651 	}
652 
653 	if (parent) {
654 		ret = security_kernfs_init_security(parent, kn);
655 		if (ret)
656 			goto err_out3;
657 	}
658 
659 	return kn;
660 
661  err_out3:
662 	spin_lock(&kernfs_idr_lock);
663 	idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
664 	spin_unlock(&kernfs_idr_lock);
665  err_out2:
666 	kmem_cache_free(kernfs_node_cache, kn);
667  err_out1:
668 	kfree_const(name);
669 	return NULL;
670 }
671 
kernfs_new_node(struct kernfs_node * parent,const char * name,umode_t mode,kuid_t uid,kgid_t gid,unsigned flags)672 struct kernfs_node *kernfs_new_node(struct kernfs_node *parent,
673 				    const char *name, umode_t mode,
674 				    kuid_t uid, kgid_t gid,
675 				    unsigned flags)
676 {
677 	struct kernfs_node *kn;
678 
679 	if (parent->mode & S_ISGID) {
680 		/* this code block imitates inode_init_owner() for
681 		 * kernfs
682 		 */
683 
684 		if (parent->iattr)
685 			gid = parent->iattr->ia_gid;
686 
687 		if (flags & KERNFS_DIR)
688 			mode |= S_ISGID;
689 	}
690 
691 	kn = __kernfs_new_node(kernfs_root(parent), parent,
692 			       name, mode, uid, gid, flags);
693 	if (kn) {
694 		kernfs_get(parent);
695 		kn->parent = parent;
696 	}
697 	return kn;
698 }
699 
700 /*
701  * kernfs_find_and_get_node_by_id - get kernfs_node from node id
702  * @root: the kernfs root
703  * @id: the target node id
704  *
705  * @id's lower 32bits encode ino and upper gen.  If the gen portion is
706  * zero, all generations are matched.
707  *
708  * Return: %NULL on failure,
709  * otherwise a kernfs node with reference counter incremented.
710  */
kernfs_find_and_get_node_by_id(struct kernfs_root * root,u64 id)711 struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root,
712 						   u64 id)
713 {
714 	struct kernfs_node *kn;
715 	ino_t ino = kernfs_id_ino(id);
716 	u32 gen = kernfs_id_gen(id);
717 
718 	spin_lock(&kernfs_idr_lock);
719 
720 	kn = idr_find(&root->ino_idr, (u32)ino);
721 	if (!kn)
722 		goto err_unlock;
723 
724 	if (sizeof(ino_t) >= sizeof(u64)) {
725 		/* we looked up with the low 32bits, compare the whole */
726 		if (kernfs_ino(kn) != ino)
727 			goto err_unlock;
728 	} else {
729 		/* 0 matches all generations */
730 		if (unlikely(gen && kernfs_gen(kn) != gen))
731 			goto err_unlock;
732 	}
733 
734 	/*
735 	 * We should fail if @kn has never been activated and guarantee success
736 	 * if the caller knows that @kn is active. Both can be achieved by
737 	 * __kernfs_active() which tests @kn->active without kernfs_rwsem.
738 	 */
739 	if (unlikely(!__kernfs_active(kn) || !atomic_inc_not_zero(&kn->count)))
740 		goto err_unlock;
741 
742 	spin_unlock(&kernfs_idr_lock);
743 	return kn;
744 err_unlock:
745 	spin_unlock(&kernfs_idr_lock);
746 	return NULL;
747 }
748 
749 /**
750  *	kernfs_add_one - add kernfs_node to parent without warning
751  *	@kn: kernfs_node to be added
752  *
753  *	The caller must already have initialized @kn->parent.  This
754  *	function increments nlink of the parent's inode if @kn is a
755  *	directory and link into the children list of the parent.
756  *
757  *	Return:
758  *	%0 on success, -EEXIST if entry with the given name already
759  *	exists.
760  */
kernfs_add_one(struct kernfs_node * kn)761 int kernfs_add_one(struct kernfs_node *kn)
762 {
763 	struct kernfs_node *parent = kn->parent;
764 	struct kernfs_root *root = kernfs_root(parent);
765 	struct kernfs_iattrs *ps_iattr;
766 	bool has_ns;
767 	int ret;
768 
769 	down_write(&root->kernfs_rwsem);
770 
771 	ret = -EINVAL;
772 	has_ns = kernfs_ns_enabled(parent);
773 	if (WARN(has_ns != (bool)kn->ns, KERN_WARNING "kernfs: ns %s in '%s' for '%s'\n",
774 		 has_ns ? "required" : "invalid", parent->name, kn->name))
775 		goto out_unlock;
776 
777 	if (kernfs_type(parent) != KERNFS_DIR)
778 		goto out_unlock;
779 
780 	ret = -ENOENT;
781 	if (parent->flags & (KERNFS_REMOVING | KERNFS_EMPTY_DIR))
782 		goto out_unlock;
783 
784 	kn->hash = kernfs_name_hash(kn->name, kn->ns);
785 
786 	ret = kernfs_link_sibling(kn);
787 	if (ret)
788 		goto out_unlock;
789 
790 	/* Update timestamps on the parent */
791 	down_write(&root->kernfs_iattr_rwsem);
792 
793 	ps_iattr = parent->iattr;
794 	if (ps_iattr) {
795 		ktime_get_real_ts64(&ps_iattr->ia_ctime);
796 		ps_iattr->ia_mtime = ps_iattr->ia_ctime;
797 	}
798 
799 	up_write(&root->kernfs_iattr_rwsem);
800 	up_write(&root->kernfs_rwsem);
801 
802 	/*
803 	 * Activate the new node unless CREATE_DEACTIVATED is requested.
804 	 * If not activated here, the kernfs user is responsible for
805 	 * activating the node with kernfs_activate().  A node which hasn't
806 	 * been activated is not visible to userland and its removal won't
807 	 * trigger deactivation.
808 	 */
809 	if (!(kernfs_root(kn)->flags & KERNFS_ROOT_CREATE_DEACTIVATED))
810 		kernfs_activate(kn);
811 	return 0;
812 
813 out_unlock:
814 	up_write(&root->kernfs_rwsem);
815 	return ret;
816 }
817 
818 /**
819  * kernfs_find_ns - find kernfs_node with the given name
820  * @parent: kernfs_node to search under
821  * @name: name to look for
822  * @ns: the namespace tag to use
823  *
824  * Look for kernfs_node with name @name under @parent.
825  *
826  * Return: pointer to the found kernfs_node on success, %NULL on failure.
827  */
kernfs_find_ns(struct kernfs_node * parent,const unsigned char * name,const void * ns)828 static struct kernfs_node *kernfs_find_ns(struct kernfs_node *parent,
829 					  const unsigned char *name,
830 					  const void *ns)
831 {
832 	struct rb_node *node = parent->dir.children.rb_node;
833 	bool has_ns = kernfs_ns_enabled(parent);
834 	unsigned int hash;
835 
836 	lockdep_assert_held(&kernfs_root(parent)->kernfs_rwsem);
837 
838 	if (has_ns != (bool)ns) {
839 		WARN(1, KERN_WARNING "kernfs: ns %s in '%s' for '%s'\n",
840 		     has_ns ? "required" : "invalid", parent->name, name);
841 		return NULL;
842 	}
843 
844 	hash = kernfs_name_hash(name, ns);
845 	while (node) {
846 		struct kernfs_node *kn;
847 		int result;
848 
849 		kn = rb_to_kn(node);
850 		result = kernfs_name_compare(hash, name, ns, kn);
851 		if (result < 0)
852 			node = node->rb_left;
853 		else if (result > 0)
854 			node = node->rb_right;
855 		else
856 			return kn;
857 	}
858 	return NULL;
859 }
860 
kernfs_walk_ns(struct kernfs_node * parent,const unsigned char * path,const void * ns)861 static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
862 					  const unsigned char *path,
863 					  const void *ns)
864 {
865 	size_t len;
866 	char *p, *name;
867 
868 	lockdep_assert_held_read(&kernfs_root(parent)->kernfs_rwsem);
869 
870 	spin_lock_irq(&kernfs_pr_cont_lock);
871 
872 	len = strlcpy(kernfs_pr_cont_buf, path, sizeof(kernfs_pr_cont_buf));
873 
874 	if (len >= sizeof(kernfs_pr_cont_buf)) {
875 		spin_unlock_irq(&kernfs_pr_cont_lock);
876 		return NULL;
877 	}
878 
879 	p = kernfs_pr_cont_buf;
880 
881 	while ((name = strsep(&p, "/")) && parent) {
882 		if (*name == '\0')
883 			continue;
884 		parent = kernfs_find_ns(parent, name, ns);
885 	}
886 
887 	spin_unlock_irq(&kernfs_pr_cont_lock);
888 
889 	return parent;
890 }
891 
892 /**
893  * kernfs_find_and_get_ns - find and get kernfs_node with the given name
894  * @parent: kernfs_node to search under
895  * @name: name to look for
896  * @ns: the namespace tag to use
897  *
898  * Look for kernfs_node with name @name under @parent and get a reference
899  * if found.  This function may sleep.
900  *
901  * Return: pointer to the found kernfs_node on success, %NULL on failure.
902  */
kernfs_find_and_get_ns(struct kernfs_node * parent,const char * name,const void * ns)903 struct kernfs_node *kernfs_find_and_get_ns(struct kernfs_node *parent,
904 					   const char *name, const void *ns)
905 {
906 	struct kernfs_node *kn;
907 	struct kernfs_root *root = kernfs_root(parent);
908 
909 	down_read(&root->kernfs_rwsem);
910 	kn = kernfs_find_ns(parent, name, ns);
911 	kernfs_get(kn);
912 	up_read(&root->kernfs_rwsem);
913 
914 	return kn;
915 }
916 EXPORT_SYMBOL_GPL(kernfs_find_and_get_ns);
917 
918 /**
919  * kernfs_walk_and_get_ns - find and get kernfs_node with the given path
920  * @parent: kernfs_node to search under
921  * @path: path to look for
922  * @ns: the namespace tag to use
923  *
924  * Look for kernfs_node with path @path under @parent and get a reference
925  * if found.  This function may sleep.
926  *
927  * Return: pointer to the found kernfs_node on success, %NULL on failure.
928  */
kernfs_walk_and_get_ns(struct kernfs_node * parent,const char * path,const void * ns)929 struct kernfs_node *kernfs_walk_and_get_ns(struct kernfs_node *parent,
930 					   const char *path, const void *ns)
931 {
932 	struct kernfs_node *kn;
933 	struct kernfs_root *root = kernfs_root(parent);
934 
935 	down_read(&root->kernfs_rwsem);
936 	kn = kernfs_walk_ns(parent, path, ns);
937 	kernfs_get(kn);
938 	up_read(&root->kernfs_rwsem);
939 
940 	return kn;
941 }
942 
943 /**
944  * kernfs_create_root - create a new kernfs hierarchy
945  * @scops: optional syscall operations for the hierarchy
946  * @flags: KERNFS_ROOT_* flags
947  * @priv: opaque data associated with the new directory
948  *
949  * Return: the root of the new hierarchy on success, ERR_PTR() value on
950  * failure.
951  */
kernfs_create_root(struct kernfs_syscall_ops * scops,unsigned int flags,void * priv)952 struct kernfs_root *kernfs_create_root(struct kernfs_syscall_ops *scops,
953 				       unsigned int flags, void *priv)
954 {
955 	struct kernfs_root *root;
956 	struct kernfs_node *kn;
957 
958 	root = kzalloc(sizeof(*root), GFP_KERNEL);
959 	if (!root)
960 		return ERR_PTR(-ENOMEM);
961 
962 	idr_init(&root->ino_idr);
963 	init_rwsem(&root->kernfs_rwsem);
964 	init_rwsem(&root->kernfs_iattr_rwsem);
965 	init_rwsem(&root->kernfs_supers_rwsem);
966 	INIT_LIST_HEAD(&root->supers);
967 
968 	/*
969 	 * On 64bit ino setups, id is ino.  On 32bit, low 32bits are ino.
970 	 * High bits generation.  The starting value for both ino and
971 	 * genenration is 1.  Initialize upper 32bit allocation
972 	 * accordingly.
973 	 */
974 	if (sizeof(ino_t) >= sizeof(u64))
975 		root->id_highbits = 0;
976 	else
977 		root->id_highbits = 1;
978 
979 	kn = __kernfs_new_node(root, NULL, "", S_IFDIR | S_IRUGO | S_IXUGO,
980 			       GLOBAL_ROOT_UID, GLOBAL_ROOT_GID,
981 			       KERNFS_DIR);
982 	if (!kn) {
983 		idr_destroy(&root->ino_idr);
984 		kfree(root);
985 		return ERR_PTR(-ENOMEM);
986 	}
987 
988 	kn->priv = priv;
989 	kn->dir.root = root;
990 
991 	root->syscall_ops = scops;
992 	root->flags = flags;
993 	root->kn = kn;
994 	init_waitqueue_head(&root->deactivate_waitq);
995 
996 	if (!(root->flags & KERNFS_ROOT_CREATE_DEACTIVATED))
997 		kernfs_activate(kn);
998 
999 	return root;
1000 }
1001 
1002 /**
1003  * kernfs_destroy_root - destroy a kernfs hierarchy
1004  * @root: root of the hierarchy to destroy
1005  *
1006  * Destroy the hierarchy anchored at @root by removing all existing
1007  * directories and destroying @root.
1008  */
kernfs_destroy_root(struct kernfs_root * root)1009 void kernfs_destroy_root(struct kernfs_root *root)
1010 {
1011 	/*
1012 	 *  kernfs_remove holds kernfs_rwsem from the root so the root
1013 	 *  shouldn't be freed during the operation.
1014 	 */
1015 	kernfs_get(root->kn);
1016 	kernfs_remove(root->kn);
1017 	kernfs_put(root->kn); /* will also free @root */
1018 }
1019 
1020 /**
1021  * kernfs_root_to_node - return the kernfs_node associated with a kernfs_root
1022  * @root: root to use to lookup
1023  *
1024  * Return: @root's kernfs_node
1025  */
kernfs_root_to_node(struct kernfs_root * root)1026 struct kernfs_node *kernfs_root_to_node(struct kernfs_root *root)
1027 {
1028 	return root->kn;
1029 }
1030 
1031 /**
1032  * kernfs_create_dir_ns - create a directory
1033  * @parent: parent in which to create a new directory
1034  * @name: name of the new directory
1035  * @mode: mode of the new directory
1036  * @uid: uid of the new directory
1037  * @gid: gid of the new directory
1038  * @priv: opaque data associated with the new directory
1039  * @ns: optional namespace tag of the directory
1040  *
1041  * Return: the created node on success, ERR_PTR() value on failure.
1042  */
kernfs_create_dir_ns(struct kernfs_node * parent,const char * name,umode_t mode,kuid_t uid,kgid_t gid,void * priv,const void * ns)1043 struct kernfs_node *kernfs_create_dir_ns(struct kernfs_node *parent,
1044 					 const char *name, umode_t mode,
1045 					 kuid_t uid, kgid_t gid,
1046 					 void *priv, const void *ns)
1047 {
1048 	struct kernfs_node *kn;
1049 	int rc;
1050 
1051 	/* allocate */
1052 	kn = kernfs_new_node(parent, name, mode | S_IFDIR,
1053 			     uid, gid, KERNFS_DIR);
1054 	if (!kn)
1055 		return ERR_PTR(-ENOMEM);
1056 
1057 	kn->dir.root = parent->dir.root;
1058 	kn->ns = ns;
1059 	kn->priv = priv;
1060 
1061 	/* link in */
1062 	rc = kernfs_add_one(kn);
1063 	if (!rc)
1064 		return kn;
1065 
1066 	kernfs_put(kn);
1067 	return ERR_PTR(rc);
1068 }
1069 
1070 /**
1071  * kernfs_create_empty_dir - create an always empty directory
1072  * @parent: parent in which to create a new directory
1073  * @name: name of the new directory
1074  *
1075  * Return: the created node on success, ERR_PTR() value on failure.
1076  */
kernfs_create_empty_dir(struct kernfs_node * parent,const char * name)1077 struct kernfs_node *kernfs_create_empty_dir(struct kernfs_node *parent,
1078 					    const char *name)
1079 {
1080 	struct kernfs_node *kn;
1081 	int rc;
1082 
1083 	/* allocate */
1084 	kn = kernfs_new_node(parent, name, S_IRUGO|S_IXUGO|S_IFDIR,
1085 			     GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, KERNFS_DIR);
1086 	if (!kn)
1087 		return ERR_PTR(-ENOMEM);
1088 
1089 	kn->flags |= KERNFS_EMPTY_DIR;
1090 	kn->dir.root = parent->dir.root;
1091 	kn->ns = NULL;
1092 	kn->priv = NULL;
1093 
1094 	/* link in */
1095 	rc = kernfs_add_one(kn);
1096 	if (!rc)
1097 		return kn;
1098 
1099 	kernfs_put(kn);
1100 	return ERR_PTR(rc);
1101 }
1102 
kernfs_dop_revalidate(struct dentry * dentry,unsigned int flags)1103 static int kernfs_dop_revalidate(struct dentry *dentry, unsigned int flags)
1104 {
1105 	struct kernfs_node *kn;
1106 	struct kernfs_root *root;
1107 
1108 	if (flags & LOOKUP_RCU)
1109 		return -ECHILD;
1110 
1111 	/* Negative hashed dentry? */
1112 	if (d_really_is_negative(dentry)) {
1113 		struct kernfs_node *parent;
1114 
1115 		/* If the kernfs parent node has changed discard and
1116 		 * proceed to ->lookup.
1117 		 *
1118 		 * There's nothing special needed here when getting the
1119 		 * dentry parent, even if a concurrent rename is in
1120 		 * progress. That's because the dentry is negative so
1121 		 * it can only be the target of the rename and it will
1122 		 * be doing a d_move() not a replace. Consequently the
1123 		 * dentry d_parent won't change over the d_move().
1124 		 *
1125 		 * Also kernfs negative dentries transitioning from
1126 		 * negative to positive during revalidate won't happen
1127 		 * because they are invalidated on containing directory
1128 		 * changes and the lookup re-done so that a new positive
1129 		 * dentry can be properly created.
1130 		 */
1131 		root = kernfs_root_from_sb(dentry->d_sb);
1132 		down_read(&root->kernfs_rwsem);
1133 		parent = kernfs_dentry_node(dentry->d_parent);
1134 		if (parent) {
1135 			if (kernfs_dir_changed(parent, dentry)) {
1136 				up_read(&root->kernfs_rwsem);
1137 				return 0;
1138 			}
1139 		}
1140 		up_read(&root->kernfs_rwsem);
1141 
1142 		/* The kernfs parent node hasn't changed, leave the
1143 		 * dentry negative and return success.
1144 		 */
1145 		return 1;
1146 	}
1147 
1148 	kn = kernfs_dentry_node(dentry);
1149 	root = kernfs_root(kn);
1150 	down_read(&root->kernfs_rwsem);
1151 
1152 	/* The kernfs node has been deactivated */
1153 	if (!kernfs_active(kn))
1154 		goto out_bad;
1155 
1156 	/* The kernfs node has been moved? */
1157 	if (kernfs_dentry_node(dentry->d_parent) != kn->parent)
1158 		goto out_bad;
1159 
1160 	/* The kernfs node has been renamed */
1161 	if (strcmp(dentry->d_name.name, kn->name) != 0)
1162 		goto out_bad;
1163 
1164 	/* The kernfs node has been moved to a different namespace */
1165 	if (kn->parent && kernfs_ns_enabled(kn->parent) &&
1166 	    kernfs_info(dentry->d_sb)->ns != kn->ns)
1167 		goto out_bad;
1168 
1169 	up_read(&root->kernfs_rwsem);
1170 	return 1;
1171 out_bad:
1172 	up_read(&root->kernfs_rwsem);
1173 	return 0;
1174 }
1175 
1176 const struct dentry_operations kernfs_dops = {
1177 	.d_revalidate	= kernfs_dop_revalidate,
1178 };
1179 
kernfs_iop_lookup(struct inode * dir,struct dentry * dentry,unsigned int flags)1180 static struct dentry *kernfs_iop_lookup(struct inode *dir,
1181 					struct dentry *dentry,
1182 					unsigned int flags)
1183 {
1184 	struct kernfs_node *parent = dir->i_private;
1185 	struct kernfs_node *kn;
1186 	struct kernfs_root *root;
1187 	struct inode *inode = NULL;
1188 	const void *ns = NULL;
1189 
1190 	root = kernfs_root(parent);
1191 	down_read(&root->kernfs_rwsem);
1192 	if (kernfs_ns_enabled(parent))
1193 		ns = kernfs_info(dir->i_sb)->ns;
1194 
1195 	kn = kernfs_find_ns(parent, dentry->d_name.name, ns);
1196 	/* attach dentry and inode */
1197 	if (kn) {
1198 		/* Inactive nodes are invisible to the VFS so don't
1199 		 * create a negative.
1200 		 */
1201 		if (!kernfs_active(kn)) {
1202 			up_read(&root->kernfs_rwsem);
1203 			return NULL;
1204 		}
1205 		inode = kernfs_get_inode(dir->i_sb, kn);
1206 		if (!inode)
1207 			inode = ERR_PTR(-ENOMEM);
1208 	}
1209 	/*
1210 	 * Needed for negative dentry validation.
1211 	 * The negative dentry can be created in kernfs_iop_lookup()
1212 	 * or transforms from positive dentry in dentry_unlink_inode()
1213 	 * called from vfs_rmdir().
1214 	 */
1215 	if (!IS_ERR(inode))
1216 		kernfs_set_rev(parent, dentry);
1217 	up_read(&root->kernfs_rwsem);
1218 
1219 	/* instantiate and hash (possibly negative) dentry */
1220 	return d_splice_alias(inode, dentry);
1221 }
1222 
kernfs_iop_mkdir(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry,umode_t mode)1223 static int kernfs_iop_mkdir(struct mnt_idmap *idmap,
1224 			    struct inode *dir, struct dentry *dentry,
1225 			    umode_t mode)
1226 {
1227 	struct kernfs_node *parent = dir->i_private;
1228 	struct kernfs_syscall_ops *scops = kernfs_root(parent)->syscall_ops;
1229 	int ret;
1230 
1231 	if (!scops || !scops->mkdir)
1232 		return -EPERM;
1233 
1234 	if (!kernfs_get_active(parent))
1235 		return -ENODEV;
1236 
1237 	ret = scops->mkdir(parent, dentry->d_name.name, mode);
1238 
1239 	kernfs_put_active(parent);
1240 	return ret;
1241 }
1242 
kernfs_iop_rmdir(struct inode * dir,struct dentry * dentry)1243 static int kernfs_iop_rmdir(struct inode *dir, struct dentry *dentry)
1244 {
1245 	struct kernfs_node *kn  = kernfs_dentry_node(dentry);
1246 	struct kernfs_syscall_ops *scops = kernfs_root(kn)->syscall_ops;
1247 	int ret;
1248 
1249 	if (!scops || !scops->rmdir)
1250 		return -EPERM;
1251 
1252 	if (!kernfs_get_active(kn))
1253 		return -ENODEV;
1254 
1255 	ret = scops->rmdir(kn);
1256 
1257 	kernfs_put_active(kn);
1258 	return ret;
1259 }
1260 
kernfs_iop_rename(struct mnt_idmap * idmap,struct inode * old_dir,struct dentry * old_dentry,struct inode * new_dir,struct dentry * new_dentry,unsigned int flags)1261 static int kernfs_iop_rename(struct mnt_idmap *idmap,
1262 			     struct inode *old_dir, struct dentry *old_dentry,
1263 			     struct inode *new_dir, struct dentry *new_dentry,
1264 			     unsigned int flags)
1265 {
1266 	struct kernfs_node *kn = kernfs_dentry_node(old_dentry);
1267 	struct kernfs_node *new_parent = new_dir->i_private;
1268 	struct kernfs_syscall_ops *scops = kernfs_root(kn)->syscall_ops;
1269 	int ret;
1270 
1271 	if (flags)
1272 		return -EINVAL;
1273 
1274 	if (!scops || !scops->rename)
1275 		return -EPERM;
1276 
1277 	if (!kernfs_get_active(kn))
1278 		return -ENODEV;
1279 
1280 	if (!kernfs_get_active(new_parent)) {
1281 		kernfs_put_active(kn);
1282 		return -ENODEV;
1283 	}
1284 
1285 	ret = scops->rename(kn, new_parent, new_dentry->d_name.name);
1286 
1287 	kernfs_put_active(new_parent);
1288 	kernfs_put_active(kn);
1289 	return ret;
1290 }
1291 
1292 const struct inode_operations kernfs_dir_iops = {
1293 	.lookup		= kernfs_iop_lookup,
1294 	.permission	= kernfs_iop_permission,
1295 	.setattr	= kernfs_iop_setattr,
1296 	.getattr	= kernfs_iop_getattr,
1297 	.listxattr	= kernfs_iop_listxattr,
1298 
1299 	.mkdir		= kernfs_iop_mkdir,
1300 	.rmdir		= kernfs_iop_rmdir,
1301 	.rename		= kernfs_iop_rename,
1302 };
1303 
kernfs_leftmost_descendant(struct kernfs_node * pos)1304 static struct kernfs_node *kernfs_leftmost_descendant(struct kernfs_node *pos)
1305 {
1306 	struct kernfs_node *last;
1307 
1308 	while (true) {
1309 		struct rb_node *rbn;
1310 
1311 		last = pos;
1312 
1313 		if (kernfs_type(pos) != KERNFS_DIR)
1314 			break;
1315 
1316 		rbn = rb_first(&pos->dir.children);
1317 		if (!rbn)
1318 			break;
1319 
1320 		pos = rb_to_kn(rbn);
1321 	}
1322 
1323 	return last;
1324 }
1325 
1326 /**
1327  * kernfs_next_descendant_post - find the next descendant for post-order walk
1328  * @pos: the current position (%NULL to initiate traversal)
1329  * @root: kernfs_node whose descendants to walk
1330  *
1331  * Find the next descendant to visit for post-order traversal of @root's
1332  * descendants.  @root is included in the iteration and the last node to be
1333  * visited.
1334  *
1335  * Return: the next descendant to visit or %NULL when done.
1336  */
kernfs_next_descendant_post(struct kernfs_node * pos,struct kernfs_node * root)1337 static struct kernfs_node *kernfs_next_descendant_post(struct kernfs_node *pos,
1338 						       struct kernfs_node *root)
1339 {
1340 	struct rb_node *rbn;
1341 
1342 	lockdep_assert_held_write(&kernfs_root(root)->kernfs_rwsem);
1343 
1344 	/* if first iteration, visit leftmost descendant which may be root */
1345 	if (!pos)
1346 		return kernfs_leftmost_descendant(root);
1347 
1348 	/* if we visited @root, we're done */
1349 	if (pos == root)
1350 		return NULL;
1351 
1352 	/* if there's an unvisited sibling, visit its leftmost descendant */
1353 	rbn = rb_next(&pos->rb);
1354 	if (rbn)
1355 		return kernfs_leftmost_descendant(rb_to_kn(rbn));
1356 
1357 	/* no sibling left, visit parent */
1358 	return pos->parent;
1359 }
1360 
kernfs_activate_one(struct kernfs_node * kn)1361 static void kernfs_activate_one(struct kernfs_node *kn)
1362 {
1363 	lockdep_assert_held_write(&kernfs_root(kn)->kernfs_rwsem);
1364 
1365 	kn->flags |= KERNFS_ACTIVATED;
1366 
1367 	if (kernfs_active(kn) || (kn->flags & (KERNFS_HIDDEN | KERNFS_REMOVING)))
1368 		return;
1369 
1370 	WARN_ON_ONCE(kn->parent && RB_EMPTY_NODE(&kn->rb));
1371 	WARN_ON_ONCE(atomic_read(&kn->active) != KN_DEACTIVATED_BIAS);
1372 
1373 	atomic_sub(KN_DEACTIVATED_BIAS, &kn->active);
1374 }
1375 
1376 /**
1377  * kernfs_activate - activate a node which started deactivated
1378  * @kn: kernfs_node whose subtree is to be activated
1379  *
1380  * If the root has KERNFS_ROOT_CREATE_DEACTIVATED set, a newly created node
1381  * needs to be explicitly activated.  A node which hasn't been activated
1382  * isn't visible to userland and deactivation is skipped during its
1383  * removal.  This is useful to construct atomic init sequences where
1384  * creation of multiple nodes should either succeed or fail atomically.
1385  *
1386  * The caller is responsible for ensuring that this function is not called
1387  * after kernfs_remove*() is invoked on @kn.
1388  */
kernfs_activate(struct kernfs_node * kn)1389 void kernfs_activate(struct kernfs_node *kn)
1390 {
1391 	struct kernfs_node *pos;
1392 	struct kernfs_root *root = kernfs_root(kn);
1393 
1394 	down_write(&root->kernfs_rwsem);
1395 
1396 	pos = NULL;
1397 	while ((pos = kernfs_next_descendant_post(pos, kn)))
1398 		kernfs_activate_one(pos);
1399 
1400 	up_write(&root->kernfs_rwsem);
1401 }
1402 
1403 /**
1404  * kernfs_show - show or hide a node
1405  * @kn: kernfs_node to show or hide
1406  * @show: whether to show or hide
1407  *
1408  * If @show is %false, @kn is marked hidden and deactivated. A hidden node is
1409  * ignored in future activaitons. If %true, the mark is removed and activation
1410  * state is restored. This function won't implicitly activate a new node in a
1411  * %KERNFS_ROOT_CREATE_DEACTIVATED root which hasn't been activated yet.
1412  *
1413  * To avoid recursion complexities, directories aren't supported for now.
1414  */
kernfs_show(struct kernfs_node * kn,bool show)1415 void kernfs_show(struct kernfs_node *kn, bool show)
1416 {
1417 	struct kernfs_root *root = kernfs_root(kn);
1418 
1419 	if (WARN_ON_ONCE(kernfs_type(kn) == KERNFS_DIR))
1420 		return;
1421 
1422 	down_write(&root->kernfs_rwsem);
1423 
1424 	if (show) {
1425 		kn->flags &= ~KERNFS_HIDDEN;
1426 		if (kn->flags & KERNFS_ACTIVATED)
1427 			kernfs_activate_one(kn);
1428 	} else {
1429 		kn->flags |= KERNFS_HIDDEN;
1430 		if (kernfs_active(kn))
1431 			atomic_add(KN_DEACTIVATED_BIAS, &kn->active);
1432 		kernfs_drain(kn);
1433 	}
1434 
1435 	up_write(&root->kernfs_rwsem);
1436 }
1437 
__kernfs_remove(struct kernfs_node * kn)1438 static void __kernfs_remove(struct kernfs_node *kn)
1439 {
1440 	struct kernfs_node *pos;
1441 
1442 	/* Short-circuit if non-root @kn has already finished removal. */
1443 	if (!kn)
1444 		return;
1445 
1446 	lockdep_assert_held_write(&kernfs_root(kn)->kernfs_rwsem);
1447 
1448 	/*
1449 	 * This is for kernfs_remove_self() which plays with active ref
1450 	 * after removal.
1451 	 */
1452 	if (kn->parent && RB_EMPTY_NODE(&kn->rb))
1453 		return;
1454 
1455 	pr_debug("kernfs %s: removing\n", kn->name);
1456 
1457 	/* prevent new usage by marking all nodes removing and deactivating */
1458 	pos = NULL;
1459 	while ((pos = kernfs_next_descendant_post(pos, kn))) {
1460 		pos->flags |= KERNFS_REMOVING;
1461 		if (kernfs_active(pos))
1462 			atomic_add(KN_DEACTIVATED_BIAS, &pos->active);
1463 	}
1464 
1465 	/* deactivate and unlink the subtree node-by-node */
1466 	do {
1467 		pos = kernfs_leftmost_descendant(kn);
1468 
1469 		/*
1470 		 * kernfs_drain() may drop kernfs_rwsem temporarily and @pos's
1471 		 * base ref could have been put by someone else by the time
1472 		 * the function returns.  Make sure it doesn't go away
1473 		 * underneath us.
1474 		 */
1475 		kernfs_get(pos);
1476 
1477 		kernfs_drain(pos);
1478 
1479 		/*
1480 		 * kernfs_unlink_sibling() succeeds once per node.  Use it
1481 		 * to decide who's responsible for cleanups.
1482 		 */
1483 		if (!pos->parent || kernfs_unlink_sibling(pos)) {
1484 			struct kernfs_iattrs *ps_iattr =
1485 				pos->parent ? pos->parent->iattr : NULL;
1486 
1487 			/* update timestamps on the parent */
1488 			down_write(&kernfs_root(kn)->kernfs_iattr_rwsem);
1489 
1490 			if (ps_iattr) {
1491 				ktime_get_real_ts64(&ps_iattr->ia_ctime);
1492 				ps_iattr->ia_mtime = ps_iattr->ia_ctime;
1493 			}
1494 
1495 			up_write(&kernfs_root(kn)->kernfs_iattr_rwsem);
1496 			kernfs_put(pos);
1497 		}
1498 
1499 		kernfs_put(pos);
1500 	} while (pos != kn);
1501 }
1502 
1503 /**
1504  * kernfs_remove - remove a kernfs_node recursively
1505  * @kn: the kernfs_node to remove
1506  *
1507  * Remove @kn along with all its subdirectories and files.
1508  */
kernfs_remove(struct kernfs_node * kn)1509 void kernfs_remove(struct kernfs_node *kn)
1510 {
1511 	struct kernfs_root *root;
1512 
1513 	if (!kn)
1514 		return;
1515 
1516 	root = kernfs_root(kn);
1517 
1518 	down_write(&root->kernfs_rwsem);
1519 	__kernfs_remove(kn);
1520 	up_write(&root->kernfs_rwsem);
1521 }
1522 
1523 /**
1524  * kernfs_break_active_protection - break out of active protection
1525  * @kn: the self kernfs_node
1526  *
1527  * The caller must be running off of a kernfs operation which is invoked
1528  * with an active reference - e.g. one of kernfs_ops.  Each invocation of
1529  * this function must also be matched with an invocation of
1530  * kernfs_unbreak_active_protection().
1531  *
1532  * This function releases the active reference of @kn the caller is
1533  * holding.  Once this function is called, @kn may be removed at any point
1534  * and the caller is solely responsible for ensuring that the objects it
1535  * dereferences are accessible.
1536  */
kernfs_break_active_protection(struct kernfs_node * kn)1537 void kernfs_break_active_protection(struct kernfs_node *kn)
1538 {
1539 	/*
1540 	 * Take out ourself out of the active ref dependency chain.  If
1541 	 * we're called without an active ref, lockdep will complain.
1542 	 */
1543 	kernfs_put_active(kn);
1544 }
1545 
1546 /**
1547  * kernfs_unbreak_active_protection - undo kernfs_break_active_protection()
1548  * @kn: the self kernfs_node
1549  *
1550  * If kernfs_break_active_protection() was called, this function must be
1551  * invoked before finishing the kernfs operation.  Note that while this
1552  * function restores the active reference, it doesn't and can't actually
1553  * restore the active protection - @kn may already or be in the process of
1554  * being removed.  Once kernfs_break_active_protection() is invoked, that
1555  * protection is irreversibly gone for the kernfs operation instance.
1556  *
1557  * While this function may be called at any point after
1558  * kernfs_break_active_protection() is invoked, its most useful location
1559  * would be right before the enclosing kernfs operation returns.
1560  */
kernfs_unbreak_active_protection(struct kernfs_node * kn)1561 void kernfs_unbreak_active_protection(struct kernfs_node *kn)
1562 {
1563 	/*
1564 	 * @kn->active could be in any state; however, the increment we do
1565 	 * here will be undone as soon as the enclosing kernfs operation
1566 	 * finishes and this temporary bump can't break anything.  If @kn
1567 	 * is alive, nothing changes.  If @kn is being deactivated, the
1568 	 * soon-to-follow put will either finish deactivation or restore
1569 	 * deactivated state.  If @kn is already removed, the temporary
1570 	 * bump is guaranteed to be gone before @kn is released.
1571 	 */
1572 	atomic_inc(&kn->active);
1573 	if (kernfs_lockdep(kn))
1574 		rwsem_acquire(&kn->dep_map, 0, 1, _RET_IP_);
1575 }
1576 
1577 /**
1578  * kernfs_remove_self - remove a kernfs_node from its own method
1579  * @kn: the self kernfs_node to remove
1580  *
1581  * The caller must be running off of a kernfs operation which is invoked
1582  * with an active reference - e.g. one of kernfs_ops.  This can be used to
1583  * implement a file operation which deletes itself.
1584  *
1585  * For example, the "delete" file for a sysfs device directory can be
1586  * implemented by invoking kernfs_remove_self() on the "delete" file
1587  * itself.  This function breaks the circular dependency of trying to
1588  * deactivate self while holding an active ref itself.  It isn't necessary
1589  * to modify the usual removal path to use kernfs_remove_self().  The
1590  * "delete" implementation can simply invoke kernfs_remove_self() on self
1591  * before proceeding with the usual removal path.  kernfs will ignore later
1592  * kernfs_remove() on self.
1593  *
1594  * kernfs_remove_self() can be called multiple times concurrently on the
1595  * same kernfs_node.  Only the first one actually performs removal and
1596  * returns %true.  All others will wait until the kernfs operation which
1597  * won self-removal finishes and return %false.  Note that the losers wait
1598  * for the completion of not only the winning kernfs_remove_self() but also
1599  * the whole kernfs_ops which won the arbitration.  This can be used to
1600  * guarantee, for example, all concurrent writes to a "delete" file to
1601  * finish only after the whole operation is complete.
1602  *
1603  * Return: %true if @kn is removed by this call, otherwise %false.
1604  */
kernfs_remove_self(struct kernfs_node * kn)1605 bool kernfs_remove_self(struct kernfs_node *kn)
1606 {
1607 	bool ret;
1608 	struct kernfs_root *root = kernfs_root(kn);
1609 
1610 	down_write(&root->kernfs_rwsem);
1611 	kernfs_break_active_protection(kn);
1612 
1613 	/*
1614 	 * SUICIDAL is used to arbitrate among competing invocations.  Only
1615 	 * the first one will actually perform removal.  When the removal
1616 	 * is complete, SUICIDED is set and the active ref is restored
1617 	 * while kernfs_rwsem for held exclusive.  The ones which lost
1618 	 * arbitration waits for SUICIDED && drained which can happen only
1619 	 * after the enclosing kernfs operation which executed the winning
1620 	 * instance of kernfs_remove_self() finished.
1621 	 */
1622 	if (!(kn->flags & KERNFS_SUICIDAL)) {
1623 		kn->flags |= KERNFS_SUICIDAL;
1624 		__kernfs_remove(kn);
1625 		kn->flags |= KERNFS_SUICIDED;
1626 		ret = true;
1627 	} else {
1628 		wait_queue_head_t *waitq = &kernfs_root(kn)->deactivate_waitq;
1629 		DEFINE_WAIT(wait);
1630 
1631 		while (true) {
1632 			prepare_to_wait(waitq, &wait, TASK_UNINTERRUPTIBLE);
1633 
1634 			if ((kn->flags & KERNFS_SUICIDED) &&
1635 			    atomic_read(&kn->active) == KN_DEACTIVATED_BIAS)
1636 				break;
1637 
1638 			up_write(&root->kernfs_rwsem);
1639 			schedule();
1640 			down_write(&root->kernfs_rwsem);
1641 		}
1642 		finish_wait(waitq, &wait);
1643 		WARN_ON_ONCE(!RB_EMPTY_NODE(&kn->rb));
1644 		ret = false;
1645 	}
1646 
1647 	/*
1648 	 * This must be done while kernfs_rwsem held exclusive; otherwise,
1649 	 * waiting for SUICIDED && deactivated could finish prematurely.
1650 	 */
1651 	kernfs_unbreak_active_protection(kn);
1652 
1653 	up_write(&root->kernfs_rwsem);
1654 	return ret;
1655 }
1656 
1657 /**
1658  * kernfs_remove_by_name_ns - find a kernfs_node by name and remove it
1659  * @parent: parent of the target
1660  * @name: name of the kernfs_node to remove
1661  * @ns: namespace tag of the kernfs_node to remove
1662  *
1663  * Look for the kernfs_node with @name and @ns under @parent and remove it.
1664  *
1665  * Return: %0 on success, -ENOENT if such entry doesn't exist.
1666  */
kernfs_remove_by_name_ns(struct kernfs_node * parent,const char * name,const void * ns)1667 int kernfs_remove_by_name_ns(struct kernfs_node *parent, const char *name,
1668 			     const void *ns)
1669 {
1670 	struct kernfs_node *kn;
1671 	struct kernfs_root *root;
1672 
1673 	if (!parent) {
1674 		WARN(1, KERN_WARNING "kernfs: can not remove '%s', no directory\n",
1675 			name);
1676 		return -ENOENT;
1677 	}
1678 
1679 	root = kernfs_root(parent);
1680 	down_write(&root->kernfs_rwsem);
1681 
1682 	kn = kernfs_find_ns(parent, name, ns);
1683 	if (kn) {
1684 		kernfs_get(kn);
1685 		__kernfs_remove(kn);
1686 		kernfs_put(kn);
1687 	}
1688 
1689 	up_write(&root->kernfs_rwsem);
1690 
1691 	if (kn)
1692 		return 0;
1693 	else
1694 		return -ENOENT;
1695 }
1696 
1697 /**
1698  * kernfs_rename_ns - move and rename a kernfs_node
1699  * @kn: target node
1700  * @new_parent: new parent to put @sd under
1701  * @new_name: new name
1702  * @new_ns: new namespace tag
1703  *
1704  * Return: %0 on success, -errno on failure.
1705  */
kernfs_rename_ns(struct kernfs_node * kn,struct kernfs_node * new_parent,const char * new_name,const void * new_ns)1706 int kernfs_rename_ns(struct kernfs_node *kn, struct kernfs_node *new_parent,
1707 		     const char *new_name, const void *new_ns)
1708 {
1709 	struct kernfs_node *old_parent;
1710 	struct kernfs_root *root;
1711 	const char *old_name = NULL;
1712 	int error;
1713 
1714 	/* can't move or rename root */
1715 	if (!kn->parent)
1716 		return -EINVAL;
1717 
1718 	root = kernfs_root(kn);
1719 	down_write(&root->kernfs_rwsem);
1720 
1721 	error = -ENOENT;
1722 	if (!kernfs_active(kn) || !kernfs_active(new_parent) ||
1723 	    (new_parent->flags & KERNFS_EMPTY_DIR))
1724 		goto out;
1725 
1726 	error = 0;
1727 	if ((kn->parent == new_parent) && (kn->ns == new_ns) &&
1728 	    (strcmp(kn->name, new_name) == 0))
1729 		goto out;	/* nothing to rename */
1730 
1731 	error = -EEXIST;
1732 	if (kernfs_find_ns(new_parent, new_name, new_ns))
1733 		goto out;
1734 
1735 	/* rename kernfs_node */
1736 	if (strcmp(kn->name, new_name) != 0) {
1737 		error = -ENOMEM;
1738 		new_name = kstrdup_const(new_name, GFP_KERNEL);
1739 		if (!new_name)
1740 			goto out;
1741 	} else {
1742 		new_name = NULL;
1743 	}
1744 
1745 	/*
1746 	 * Move to the appropriate place in the appropriate directories rbtree.
1747 	 */
1748 	kernfs_unlink_sibling(kn);
1749 	kernfs_get(new_parent);
1750 
1751 	/* rename_lock protects ->parent and ->name accessors */
1752 	write_lock_irq(&kernfs_rename_lock);
1753 
1754 	old_parent = kn->parent;
1755 	kn->parent = new_parent;
1756 
1757 	kn->ns = new_ns;
1758 	if (new_name) {
1759 		old_name = kn->name;
1760 		kn->name = new_name;
1761 	}
1762 
1763 	write_unlock_irq(&kernfs_rename_lock);
1764 
1765 	kn->hash = kernfs_name_hash(kn->name, kn->ns);
1766 	kernfs_link_sibling(kn);
1767 
1768 	kernfs_put(old_parent);
1769 	kfree_const(old_name);
1770 
1771 	error = 0;
1772  out:
1773 	up_write(&root->kernfs_rwsem);
1774 	return error;
1775 }
1776 
kernfs_dir_fop_release(struct inode * inode,struct file * filp)1777 static int kernfs_dir_fop_release(struct inode *inode, struct file *filp)
1778 {
1779 	kernfs_put(filp->private_data);
1780 	return 0;
1781 }
1782 
kernfs_dir_pos(const void * ns,struct kernfs_node * parent,loff_t hash,struct kernfs_node * pos)1783 static struct kernfs_node *kernfs_dir_pos(const void *ns,
1784 	struct kernfs_node *parent, loff_t hash, struct kernfs_node *pos)
1785 {
1786 	if (pos) {
1787 		int valid = kernfs_active(pos) &&
1788 			pos->parent == parent && hash == pos->hash;
1789 		kernfs_put(pos);
1790 		if (!valid)
1791 			pos = NULL;
1792 	}
1793 	if (!pos && (hash > 1) && (hash < INT_MAX)) {
1794 		struct rb_node *node = parent->dir.children.rb_node;
1795 		while (node) {
1796 			pos = rb_to_kn(node);
1797 
1798 			if (hash < pos->hash)
1799 				node = node->rb_left;
1800 			else if (hash > pos->hash)
1801 				node = node->rb_right;
1802 			else
1803 				break;
1804 		}
1805 	}
1806 	/* Skip over entries which are dying/dead or in the wrong namespace */
1807 	while (pos && (!kernfs_active(pos) || pos->ns != ns)) {
1808 		struct rb_node *node = rb_next(&pos->rb);
1809 		if (!node)
1810 			pos = NULL;
1811 		else
1812 			pos = rb_to_kn(node);
1813 	}
1814 	return pos;
1815 }
1816 
kernfs_dir_next_pos(const void * ns,struct kernfs_node * parent,ino_t ino,struct kernfs_node * pos)1817 static struct kernfs_node *kernfs_dir_next_pos(const void *ns,
1818 	struct kernfs_node *parent, ino_t ino, struct kernfs_node *pos)
1819 {
1820 	pos = kernfs_dir_pos(ns, parent, ino, pos);
1821 	if (pos) {
1822 		do {
1823 			struct rb_node *node = rb_next(&pos->rb);
1824 			if (!node)
1825 				pos = NULL;
1826 			else
1827 				pos = rb_to_kn(node);
1828 		} while (pos && (!kernfs_active(pos) || pos->ns != ns));
1829 	}
1830 	return pos;
1831 }
1832 
kernfs_fop_readdir(struct file * file,struct dir_context * ctx)1833 static int kernfs_fop_readdir(struct file *file, struct dir_context *ctx)
1834 {
1835 	struct dentry *dentry = file->f_path.dentry;
1836 	struct kernfs_node *parent = kernfs_dentry_node(dentry);
1837 	struct kernfs_node *pos = file->private_data;
1838 	struct kernfs_root *root;
1839 	const void *ns = NULL;
1840 
1841 	if (!dir_emit_dots(file, ctx))
1842 		return 0;
1843 
1844 	root = kernfs_root(parent);
1845 	down_read(&root->kernfs_rwsem);
1846 
1847 	if (kernfs_ns_enabled(parent))
1848 		ns = kernfs_info(dentry->d_sb)->ns;
1849 
1850 	for (pos = kernfs_dir_pos(ns, parent, ctx->pos, pos);
1851 	     pos;
1852 	     pos = kernfs_dir_next_pos(ns, parent, ctx->pos, pos)) {
1853 		const char *name = pos->name;
1854 		unsigned int type = fs_umode_to_dtype(pos->mode);
1855 		int len = strlen(name);
1856 		ino_t ino = kernfs_ino(pos);
1857 
1858 		ctx->pos = pos->hash;
1859 		file->private_data = pos;
1860 		kernfs_get(pos);
1861 
1862 		up_read(&root->kernfs_rwsem);
1863 		if (!dir_emit(ctx, name, len, ino, type))
1864 			return 0;
1865 		down_read(&root->kernfs_rwsem);
1866 	}
1867 	up_read(&root->kernfs_rwsem);
1868 	file->private_data = NULL;
1869 	ctx->pos = INT_MAX;
1870 	return 0;
1871 }
1872 
1873 const struct file_operations kernfs_dir_fops = {
1874 	.read		= generic_read_dir,
1875 	.iterate_shared	= kernfs_fop_readdir,
1876 	.release	= kernfs_dir_fop_release,
1877 	.llseek		= generic_file_llseek,
1878 };
1879