1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  *  linux/fs/namei.c
4  *
5  *  Copyright (C) 1991, 1992  Linus Torvalds
6  */
7 
8 /*
9  * Some corrections by tytso.
10  */
11 
12 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
13  * lookup logic.
14  */
15 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
16  */
17 
18 #include <linux/init.h>
19 #include <linux/export.h>
20 #include <linux/kernel.h>
21 #include <linux/slab.h>
22 #include <linux/fs.h>
23 #include <linux/filelock.h>
24 #include <linux/namei.h>
25 #include <linux/pagemap.h>
26 #include <linux/sched/mm.h>
27 #include <linux/fsnotify.h>
28 #include <linux/personality.h>
29 #include <linux/security.h>
30 #include <linux/ima.h>
31 #include <linux/syscalls.h>
32 #include <linux/mount.h>
33 #include <linux/audit.h>
34 #include <linux/capability.h>
35 #include <linux/file.h>
36 #include <linux/fcntl.h>
37 #include <linux/device_cgroup.h>
38 #include <linux/fs_struct.h>
39 #include <linux/posix_acl.h>
40 #include <linux/hash.h>
41 #include <linux/bitops.h>
42 #include <linux/init_task.h>
43 #include <linux/uaccess.h>
44 
45 #include "internal.h"
46 #include "mount.h"
47 
48 /* [Feb-1997 T. Schoebel-Theuer]
49  * Fundamental changes in the pathname lookup mechanisms (namei)
50  * were necessary because of omirr.  The reason is that omirr needs
51  * to know the _real_ pathname, not the user-supplied one, in case
52  * of symlinks (and also when transname replacements occur).
53  *
54  * The new code replaces the old recursive symlink resolution with
55  * an iterative one (in case of non-nested symlink chains).  It does
56  * this with calls to <fs>_follow_link().
57  * As a side effect, dir_namei(), _namei() and follow_link() are now
58  * replaced with a single function lookup_dentry() that can handle all
59  * the special cases of the former code.
60  *
61  * With the new dcache, the pathname is stored at each inode, at least as
62  * long as the refcount of the inode is positive.  As a side effect, the
63  * size of the dcache depends on the inode cache and thus is dynamic.
64  *
65  * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
66  * resolution to correspond with current state of the code.
67  *
68  * Note that the symlink resolution is not *completely* iterative.
69  * There is still a significant amount of tail- and mid- recursion in
70  * the algorithm.  Also, note that <fs>_readlink() is not used in
71  * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
72  * may return different results than <fs>_follow_link().  Many virtual
73  * filesystems (including /proc) exhibit this behavior.
74  */
75 
76 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
77  * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
78  * and the name already exists in form of a symlink, try to create the new
79  * name indicated by the symlink. The old code always complained that the
80  * name already exists, due to not following the symlink even if its target
81  * is nonexistent.  The new semantics affects also mknod() and link() when
82  * the name is a symlink pointing to a non-existent name.
83  *
84  * I don't know which semantics is the right one, since I have no access
85  * to standards. But I found by trial that HP-UX 9.0 has the full "new"
86  * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
87  * "old" one. Personally, I think the new semantics is much more logical.
88  * Note that "ln old new" where "new" is a symlink pointing to a non-existing
89  * file does succeed in both HP-UX and SunOs, but not in Solaris
90  * and in the old Linux semantics.
91  */
92 
93 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
94  * semantics.  See the comments in "open_namei" and "do_link" below.
95  *
96  * [10-Sep-98 Alan Modra] Another symlink change.
97  */
98 
99 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
100  *	inside the path - always follow.
101  *	in the last component in creation/removal/renaming - never follow.
102  *	if LOOKUP_FOLLOW passed - follow.
103  *	if the pathname has trailing slashes - follow.
104  *	otherwise - don't follow.
105  * (applied in that order).
106  *
107  * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
108  * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
109  * During the 2.4 we need to fix the userland stuff depending on it -
110  * hopefully we will be able to get rid of that wart in 2.5. So far only
111  * XEmacs seems to be relying on it...
112  */
113 /*
114  * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
115  * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
116  * any extra contention...
117  */
118 
119 /* In order to reduce some races, while at the same time doing additional
120  * checking and hopefully speeding things up, we copy filenames to the
121  * kernel data space before using them..
122  *
123  * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
124  * PATH_MAX includes the nul terminator --RR.
125  */
126 
127 #define EMBEDDED_NAME_MAX	(PATH_MAX - offsetof(struct filename, iname))
128 
129 struct filename *
getname_flags(const char __user * filename,int flags,int * empty)130 getname_flags(const char __user *filename, int flags, int *empty)
131 {
132 	struct filename *result;
133 	char *kname;
134 	int len;
135 
136 	result = audit_reusename(filename);
137 	if (result)
138 		return result;
139 
140 	result = __getname();
141 	if (unlikely(!result))
142 		return ERR_PTR(-ENOMEM);
143 
144 	/*
145 	 * First, try to embed the struct filename inside the names_cache
146 	 * allocation
147 	 */
148 	kname = (char *)result->iname;
149 	result->name = kname;
150 
151 	len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX);
152 	if (unlikely(len < 0)) {
153 		__putname(result);
154 		return ERR_PTR(len);
155 	}
156 
157 	/*
158 	 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
159 	 * separate struct filename so we can dedicate the entire
160 	 * names_cache allocation for the pathname, and re-do the copy from
161 	 * userland.
162 	 */
163 	if (unlikely(len == EMBEDDED_NAME_MAX)) {
164 		const size_t size = offsetof(struct filename, iname[1]);
165 		kname = (char *)result;
166 
167 		/*
168 		 * size is chosen that way we to guarantee that
169 		 * result->iname[0] is within the same object and that
170 		 * kname can't be equal to result->iname, no matter what.
171 		 */
172 		result = kzalloc(size, GFP_KERNEL);
173 		if (unlikely(!result)) {
174 			__putname(kname);
175 			return ERR_PTR(-ENOMEM);
176 		}
177 		result->name = kname;
178 		len = strncpy_from_user(kname, filename, PATH_MAX);
179 		if (unlikely(len < 0)) {
180 			__putname(kname);
181 			kfree(result);
182 			return ERR_PTR(len);
183 		}
184 		if (unlikely(len == PATH_MAX)) {
185 			__putname(kname);
186 			kfree(result);
187 			return ERR_PTR(-ENAMETOOLONG);
188 		}
189 	}
190 
191 	atomic_set(&result->refcnt, 1);
192 	/* The empty path is special. */
193 	if (unlikely(!len)) {
194 		if (empty)
195 			*empty = 1;
196 		if (!(flags & LOOKUP_EMPTY)) {
197 			putname(result);
198 			return ERR_PTR(-ENOENT);
199 		}
200 	}
201 
202 	result->uptr = filename;
203 	result->aname = NULL;
204 	audit_getname(result);
205 	return result;
206 }
207 
208 struct filename *
getname_uflags(const char __user * filename,int uflags)209 getname_uflags(const char __user *filename, int uflags)
210 {
211 	int flags = (uflags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0;
212 
213 	return getname_flags(filename, flags, NULL);
214 }
215 
216 struct filename *
getname(const char __user * filename)217 getname(const char __user * filename)
218 {
219 	return getname_flags(filename, 0, NULL);
220 }
221 
222 struct filename *
getname_kernel(const char * filename)223 getname_kernel(const char * filename)
224 {
225 	struct filename *result;
226 	int len = strlen(filename) + 1;
227 
228 	result = __getname();
229 	if (unlikely(!result))
230 		return ERR_PTR(-ENOMEM);
231 
232 	if (len <= EMBEDDED_NAME_MAX) {
233 		result->name = (char *)result->iname;
234 	} else if (len <= PATH_MAX) {
235 		const size_t size = offsetof(struct filename, iname[1]);
236 		struct filename *tmp;
237 
238 		tmp = kmalloc(size, GFP_KERNEL);
239 		if (unlikely(!tmp)) {
240 			__putname(result);
241 			return ERR_PTR(-ENOMEM);
242 		}
243 		tmp->name = (char *)result;
244 		result = tmp;
245 	} else {
246 		__putname(result);
247 		return ERR_PTR(-ENAMETOOLONG);
248 	}
249 	memcpy((char *)result->name, filename, len);
250 	result->uptr = NULL;
251 	result->aname = NULL;
252 	atomic_set(&result->refcnt, 1);
253 	audit_getname(result);
254 
255 	return result;
256 }
257 EXPORT_SYMBOL(getname_kernel);
258 
putname(struct filename * name)259 void putname(struct filename *name)
260 {
261 	if (IS_ERR(name))
262 		return;
263 
264 	if (WARN_ON_ONCE(!atomic_read(&name->refcnt)))
265 		return;
266 
267 	if (!atomic_dec_and_test(&name->refcnt))
268 		return;
269 
270 	if (name->name != name->iname) {
271 		__putname(name->name);
272 		kfree(name);
273 	} else
274 		__putname(name);
275 }
276 EXPORT_SYMBOL(putname);
277 
278 /**
279  * check_acl - perform ACL permission checking
280  * @idmap:	idmap of the mount the inode was found from
281  * @inode:	inode to check permissions on
282  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...)
283  *
284  * This function performs the ACL permission checking. Since this function
285  * retrieve POSIX acls it needs to know whether it is called from a blocking or
286  * non-blocking context and thus cares about the MAY_NOT_BLOCK bit.
287  *
288  * If the inode has been found through an idmapped mount the idmap of
289  * the vfsmount must be passed through @idmap. This function will then take
290  * care to map the inode according to @idmap before checking permissions.
291  * On non-idmapped mounts or if permission checking is to be performed on the
292  * raw inode simply passs @nop_mnt_idmap.
293  */
check_acl(struct mnt_idmap * idmap,struct inode * inode,int mask)294 static int check_acl(struct mnt_idmap *idmap,
295 		     struct inode *inode, int mask)
296 {
297 #ifdef CONFIG_FS_POSIX_ACL
298 	struct posix_acl *acl;
299 
300 	if (mask & MAY_NOT_BLOCK) {
301 		acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
302 	        if (!acl)
303 	                return -EAGAIN;
304 		/* no ->get_inode_acl() calls in RCU mode... */
305 		if (is_uncached_acl(acl))
306 			return -ECHILD;
307 	        return posix_acl_permission(idmap, inode, acl, mask);
308 	}
309 
310 	acl = get_inode_acl(inode, ACL_TYPE_ACCESS);
311 	if (IS_ERR(acl))
312 		return PTR_ERR(acl);
313 	if (acl) {
314 	        int error = posix_acl_permission(idmap, inode, acl, mask);
315 	        posix_acl_release(acl);
316 	        return error;
317 	}
318 #endif
319 
320 	return -EAGAIN;
321 }
322 
323 /**
324  * acl_permission_check - perform basic UNIX permission checking
325  * @idmap:	idmap of the mount the inode was found from
326  * @inode:	inode to check permissions on
327  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...)
328  *
329  * This function performs the basic UNIX permission checking. Since this
330  * function may retrieve POSIX acls it needs to know whether it is called from a
331  * blocking or non-blocking context and thus cares about the MAY_NOT_BLOCK bit.
332  *
333  * If the inode has been found through an idmapped mount the idmap of
334  * the vfsmount must be passed through @idmap. This function will then take
335  * care to map the inode according to @idmap before checking permissions.
336  * On non-idmapped mounts or if permission checking is to be performed on the
337  * raw inode simply passs @nop_mnt_idmap.
338  */
acl_permission_check(struct mnt_idmap * idmap,struct inode * inode,int mask)339 static int acl_permission_check(struct mnt_idmap *idmap,
340 				struct inode *inode, int mask)
341 {
342 	unsigned int mode = inode->i_mode;
343 	vfsuid_t vfsuid;
344 
345 	/* Are we the owner? If so, ACL's don't matter */
346 	vfsuid = i_uid_into_vfsuid(idmap, inode);
347 	if (likely(vfsuid_eq_kuid(vfsuid, current_fsuid()))) {
348 		mask &= 7;
349 		mode >>= 6;
350 		return (mask & ~mode) ? -EACCES : 0;
351 	}
352 
353 	/* Do we have ACL's? */
354 	if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
355 		int error = check_acl(idmap, inode, mask);
356 		if (error != -EAGAIN)
357 			return error;
358 	}
359 
360 	/* Only RWX matters for group/other mode bits */
361 	mask &= 7;
362 
363 	/*
364 	 * Are the group permissions different from
365 	 * the other permissions in the bits we care
366 	 * about? Need to check group ownership if so.
367 	 */
368 	if (mask & (mode ^ (mode >> 3))) {
369 		vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode);
370 		if (vfsgid_in_group_p(vfsgid))
371 			mode >>= 3;
372 	}
373 
374 	/* Bits in 'mode' clear that we require? */
375 	return (mask & ~mode) ? -EACCES : 0;
376 }
377 
378 /**
379  * generic_permission -  check for access rights on a Posix-like filesystem
380  * @idmap:	idmap of the mount the inode was found from
381  * @inode:	inode to check access rights for
382  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC,
383  *		%MAY_NOT_BLOCK ...)
384  *
385  * Used to check for read/write/execute permissions on a file.
386  * We use "fsuid" for this, letting us set arbitrary permissions
387  * for filesystem access without changing the "normal" uids which
388  * are used for other things.
389  *
390  * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
391  * request cannot be satisfied (eg. requires blocking or too much complexity).
392  * It would then be called again in ref-walk mode.
393  *
394  * If the inode has been found through an idmapped mount the idmap of
395  * the vfsmount must be passed through @idmap. This function will then take
396  * care to map the inode according to @idmap before checking permissions.
397  * On non-idmapped mounts or if permission checking is to be performed on the
398  * raw inode simply passs @nop_mnt_idmap.
399  */
generic_permission(struct mnt_idmap * idmap,struct inode * inode,int mask)400 int generic_permission(struct mnt_idmap *idmap, struct inode *inode,
401 		       int mask)
402 {
403 	int ret;
404 
405 	/*
406 	 * Do the basic permission checks.
407 	 */
408 	ret = acl_permission_check(idmap, inode, mask);
409 	if (ret != -EACCES)
410 		return ret;
411 
412 	if (S_ISDIR(inode->i_mode)) {
413 		/* DACs are overridable for directories */
414 		if (!(mask & MAY_WRITE))
415 			if (capable_wrt_inode_uidgid(idmap, inode,
416 						     CAP_DAC_READ_SEARCH))
417 				return 0;
418 		if (capable_wrt_inode_uidgid(idmap, inode,
419 					     CAP_DAC_OVERRIDE))
420 			return 0;
421 		return -EACCES;
422 	}
423 
424 	/*
425 	 * Searching includes executable on directories, else just read.
426 	 */
427 	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
428 	if (mask == MAY_READ)
429 		if (capable_wrt_inode_uidgid(idmap, inode,
430 					     CAP_DAC_READ_SEARCH))
431 			return 0;
432 	/*
433 	 * Read/write DACs are always overridable.
434 	 * Executable DACs are overridable when there is
435 	 * at least one exec bit set.
436 	 */
437 	if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
438 		if (capable_wrt_inode_uidgid(idmap, inode,
439 					     CAP_DAC_OVERRIDE))
440 			return 0;
441 
442 	return -EACCES;
443 }
444 EXPORT_SYMBOL(generic_permission);
445 
446 /**
447  * do_inode_permission - UNIX permission checking
448  * @idmap:	idmap of the mount the inode was found from
449  * @inode:	inode to check permissions on
450  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC ...)
451  *
452  * We _really_ want to just do "generic_permission()" without
453  * even looking at the inode->i_op values. So we keep a cache
454  * flag in inode->i_opflags, that says "this has not special
455  * permission function, use the fast case".
456  */
do_inode_permission(struct mnt_idmap * idmap,struct inode * inode,int mask)457 static inline int do_inode_permission(struct mnt_idmap *idmap,
458 				      struct inode *inode, int mask)
459 {
460 	if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
461 		if (likely(inode->i_op->permission))
462 			return inode->i_op->permission(idmap, inode, mask);
463 
464 		/* This gets set once for the inode lifetime */
465 		spin_lock(&inode->i_lock);
466 		inode->i_opflags |= IOP_FASTPERM;
467 		spin_unlock(&inode->i_lock);
468 	}
469 	return generic_permission(idmap, inode, mask);
470 }
471 
472 /**
473  * sb_permission - Check superblock-level permissions
474  * @sb: Superblock of inode to check permission on
475  * @inode: Inode to check permission on
476  * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
477  *
478  * Separate out file-system wide checks from inode-specific permission checks.
479  */
sb_permission(struct super_block * sb,struct inode * inode,int mask)480 static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
481 {
482 	if (unlikely(mask & MAY_WRITE)) {
483 		umode_t mode = inode->i_mode;
484 
485 		/* Nobody gets write access to a read-only fs. */
486 		if (sb_rdonly(sb) && (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
487 			return -EROFS;
488 	}
489 	return 0;
490 }
491 
492 /**
493  * inode_permission - Check for access rights to a given inode
494  * @idmap:	idmap of the mount the inode was found from
495  * @inode:	Inode to check permission on
496  * @mask:	Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
497  *
498  * Check for read/write/execute permissions on an inode.  We use fs[ug]id for
499  * this, letting us set arbitrary permissions for filesystem access without
500  * changing the "normal" UIDs which are used for other things.
501  *
502  * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
503  */
inode_permission(struct mnt_idmap * idmap,struct inode * inode,int mask)504 int inode_permission(struct mnt_idmap *idmap,
505 		     struct inode *inode, int mask)
506 {
507 	int retval;
508 
509 	retval = sb_permission(inode->i_sb, inode, mask);
510 	if (retval)
511 		return retval;
512 
513 	if (unlikely(mask & MAY_WRITE)) {
514 		/*
515 		 * Nobody gets write access to an immutable file.
516 		 */
517 		if (IS_IMMUTABLE(inode))
518 			return -EPERM;
519 
520 		/*
521 		 * Updating mtime will likely cause i_uid and i_gid to be
522 		 * written back improperly if their true value is unknown
523 		 * to the vfs.
524 		 */
525 		if (HAS_UNMAPPED_ID(idmap, inode))
526 			return -EACCES;
527 	}
528 
529 	retval = do_inode_permission(idmap, inode, mask);
530 	if (retval)
531 		return retval;
532 
533 	retval = devcgroup_inode_permission(inode, mask);
534 	if (retval)
535 		return retval;
536 
537 	return security_inode_permission(inode, mask);
538 }
539 EXPORT_SYMBOL(inode_permission);
540 
541 /**
542  * path_get - get a reference to a path
543  * @path: path to get the reference to
544  *
545  * Given a path increment the reference count to the dentry and the vfsmount.
546  */
path_get(const struct path * path)547 void path_get(const struct path *path)
548 {
549 	mntget(path->mnt);
550 	dget(path->dentry);
551 }
552 EXPORT_SYMBOL(path_get);
553 
554 /**
555  * path_put - put a reference to a path
556  * @path: path to put the reference to
557  *
558  * Given a path decrement the reference count to the dentry and the vfsmount.
559  */
path_put(const struct path * path)560 void path_put(const struct path *path)
561 {
562 	dput(path->dentry);
563 	mntput(path->mnt);
564 }
565 EXPORT_SYMBOL(path_put);
566 
567 #define EMBEDDED_LEVELS 2
568 struct nameidata {
569 	struct path	path;
570 	struct qstr	last;
571 	struct path	root;
572 	struct inode	*inode; /* path.dentry.d_inode */
573 	unsigned int	flags, state;
574 	unsigned	seq, next_seq, m_seq, r_seq;
575 	int		last_type;
576 	unsigned	depth;
577 	int		total_link_count;
578 	struct saved {
579 		struct path link;
580 		struct delayed_call done;
581 		const char *name;
582 		unsigned seq;
583 	} *stack, internal[EMBEDDED_LEVELS];
584 	struct filename	*name;
585 	struct nameidata *saved;
586 	unsigned	root_seq;
587 	int		dfd;
588 	vfsuid_t	dir_vfsuid;
589 	umode_t		dir_mode;
590 } __randomize_layout;
591 
592 #define ND_ROOT_PRESET 1
593 #define ND_ROOT_GRABBED 2
594 #define ND_JUMPED 4
595 
__set_nameidata(struct nameidata * p,int dfd,struct filename * name)596 static void __set_nameidata(struct nameidata *p, int dfd, struct filename *name)
597 {
598 	struct nameidata *old = current->nameidata;
599 	p->stack = p->internal;
600 	p->depth = 0;
601 	p->dfd = dfd;
602 	p->name = name;
603 	p->path.mnt = NULL;
604 	p->path.dentry = NULL;
605 	p->total_link_count = old ? old->total_link_count : 0;
606 	p->saved = old;
607 	current->nameidata = p;
608 }
609 
set_nameidata(struct nameidata * p,int dfd,struct filename * name,const struct path * root)610 static inline void set_nameidata(struct nameidata *p, int dfd, struct filename *name,
611 			  const struct path *root)
612 {
613 	__set_nameidata(p, dfd, name);
614 	p->state = 0;
615 	if (unlikely(root)) {
616 		p->state = ND_ROOT_PRESET;
617 		p->root = *root;
618 	}
619 }
620 
restore_nameidata(void)621 static void restore_nameidata(void)
622 {
623 	struct nameidata *now = current->nameidata, *old = now->saved;
624 
625 	current->nameidata = old;
626 	if (old)
627 		old->total_link_count = now->total_link_count;
628 	if (now->stack != now->internal)
629 		kfree(now->stack);
630 }
631 
nd_alloc_stack(struct nameidata * nd)632 static bool nd_alloc_stack(struct nameidata *nd)
633 {
634 	struct saved *p;
635 
636 	p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
637 			 nd->flags & LOOKUP_RCU ? GFP_ATOMIC : GFP_KERNEL);
638 	if (unlikely(!p))
639 		return false;
640 	memcpy(p, nd->internal, sizeof(nd->internal));
641 	nd->stack = p;
642 	return true;
643 }
644 
645 /**
646  * path_connected - Verify that a dentry is below mnt.mnt_root
647  * @mnt: The mountpoint to check.
648  * @dentry: The dentry to check.
649  *
650  * Rename can sometimes move a file or directory outside of a bind
651  * mount, path_connected allows those cases to be detected.
652  */
path_connected(struct vfsmount * mnt,struct dentry * dentry)653 static bool path_connected(struct vfsmount *mnt, struct dentry *dentry)
654 {
655 	struct super_block *sb = mnt->mnt_sb;
656 
657 	/* Bind mounts can have disconnected paths */
658 	if (mnt->mnt_root == sb->s_root)
659 		return true;
660 
661 	return is_subdir(dentry, mnt->mnt_root);
662 }
663 
drop_links(struct nameidata * nd)664 static void drop_links(struct nameidata *nd)
665 {
666 	int i = nd->depth;
667 	while (i--) {
668 		struct saved *last = nd->stack + i;
669 		do_delayed_call(&last->done);
670 		clear_delayed_call(&last->done);
671 	}
672 }
673 
leave_rcu(struct nameidata * nd)674 static void leave_rcu(struct nameidata *nd)
675 {
676 	nd->flags &= ~LOOKUP_RCU;
677 	nd->seq = nd->next_seq = 0;
678 	rcu_read_unlock();
679 }
680 
terminate_walk(struct nameidata * nd)681 static void terminate_walk(struct nameidata *nd)
682 {
683 	drop_links(nd);
684 	if (!(nd->flags & LOOKUP_RCU)) {
685 		int i;
686 		path_put(&nd->path);
687 		for (i = 0; i < nd->depth; i++)
688 			path_put(&nd->stack[i].link);
689 		if (nd->state & ND_ROOT_GRABBED) {
690 			path_put(&nd->root);
691 			nd->state &= ~ND_ROOT_GRABBED;
692 		}
693 	} else {
694 		leave_rcu(nd);
695 	}
696 	nd->depth = 0;
697 	nd->path.mnt = NULL;
698 	nd->path.dentry = NULL;
699 }
700 
701 /* path_put is needed afterwards regardless of success or failure */
__legitimize_path(struct path * path,unsigned seq,unsigned mseq)702 static bool __legitimize_path(struct path *path, unsigned seq, unsigned mseq)
703 {
704 	int res = __legitimize_mnt(path->mnt, mseq);
705 	if (unlikely(res)) {
706 		if (res > 0)
707 			path->mnt = NULL;
708 		path->dentry = NULL;
709 		return false;
710 	}
711 	if (unlikely(!lockref_get_not_dead(&path->dentry->d_lockref))) {
712 		path->dentry = NULL;
713 		return false;
714 	}
715 	return !read_seqcount_retry(&path->dentry->d_seq, seq);
716 }
717 
legitimize_path(struct nameidata * nd,struct path * path,unsigned seq)718 static inline bool legitimize_path(struct nameidata *nd,
719 			    struct path *path, unsigned seq)
720 {
721 	return __legitimize_path(path, seq, nd->m_seq);
722 }
723 
legitimize_links(struct nameidata * nd)724 static bool legitimize_links(struct nameidata *nd)
725 {
726 	int i;
727 	if (unlikely(nd->flags & LOOKUP_CACHED)) {
728 		drop_links(nd);
729 		nd->depth = 0;
730 		return false;
731 	}
732 	for (i = 0; i < nd->depth; i++) {
733 		struct saved *last = nd->stack + i;
734 		if (unlikely(!legitimize_path(nd, &last->link, last->seq))) {
735 			drop_links(nd);
736 			nd->depth = i + 1;
737 			return false;
738 		}
739 	}
740 	return true;
741 }
742 
legitimize_root(struct nameidata * nd)743 static bool legitimize_root(struct nameidata *nd)
744 {
745 	/* Nothing to do if nd->root is zero or is managed by the VFS user. */
746 	if (!nd->root.mnt || (nd->state & ND_ROOT_PRESET))
747 		return true;
748 	nd->state |= ND_ROOT_GRABBED;
749 	return legitimize_path(nd, &nd->root, nd->root_seq);
750 }
751 
752 /*
753  * Path walking has 2 modes, rcu-walk and ref-walk (see
754  * Documentation/filesystems/path-lookup.txt).  In situations when we can't
755  * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
756  * normal reference counts on dentries and vfsmounts to transition to ref-walk
757  * mode.  Refcounts are grabbed at the last known good point before rcu-walk
758  * got stuck, so ref-walk may continue from there. If this is not successful
759  * (eg. a seqcount has changed), then failure is returned and it's up to caller
760  * to restart the path walk from the beginning in ref-walk mode.
761  */
762 
763 /**
764  * try_to_unlazy - try to switch to ref-walk mode.
765  * @nd: nameidata pathwalk data
766  * Returns: true on success, false on failure
767  *
768  * try_to_unlazy attempts to legitimize the current nd->path and nd->root
769  * for ref-walk mode.
770  * Must be called from rcu-walk context.
771  * Nothing should touch nameidata between try_to_unlazy() failure and
772  * terminate_walk().
773  */
try_to_unlazy(struct nameidata * nd)774 static bool try_to_unlazy(struct nameidata *nd)
775 {
776 	struct dentry *parent = nd->path.dentry;
777 
778 	BUG_ON(!(nd->flags & LOOKUP_RCU));
779 
780 	if (unlikely(!legitimize_links(nd)))
781 		goto out1;
782 	if (unlikely(!legitimize_path(nd, &nd->path, nd->seq)))
783 		goto out;
784 	if (unlikely(!legitimize_root(nd)))
785 		goto out;
786 	leave_rcu(nd);
787 	BUG_ON(nd->inode != parent->d_inode);
788 	return true;
789 
790 out1:
791 	nd->path.mnt = NULL;
792 	nd->path.dentry = NULL;
793 out:
794 	leave_rcu(nd);
795 	return false;
796 }
797 
798 /**
799  * try_to_unlazy_next - try to switch to ref-walk mode.
800  * @nd: nameidata pathwalk data
801  * @dentry: next dentry to step into
802  * Returns: true on success, false on failure
803  *
804  * Similar to try_to_unlazy(), but here we have the next dentry already
805  * picked by rcu-walk and want to legitimize that in addition to the current
806  * nd->path and nd->root for ref-walk mode.  Must be called from rcu-walk context.
807  * Nothing should touch nameidata between try_to_unlazy_next() failure and
808  * terminate_walk().
809  */
try_to_unlazy_next(struct nameidata * nd,struct dentry * dentry)810 static bool try_to_unlazy_next(struct nameidata *nd, struct dentry *dentry)
811 {
812 	int res;
813 	BUG_ON(!(nd->flags & LOOKUP_RCU));
814 
815 	if (unlikely(!legitimize_links(nd)))
816 		goto out2;
817 	res = __legitimize_mnt(nd->path.mnt, nd->m_seq);
818 	if (unlikely(res)) {
819 		if (res > 0)
820 			goto out2;
821 		goto out1;
822 	}
823 	if (unlikely(!lockref_get_not_dead(&nd->path.dentry->d_lockref)))
824 		goto out1;
825 
826 	/*
827 	 * We need to move both the parent and the dentry from the RCU domain
828 	 * to be properly refcounted. And the sequence number in the dentry
829 	 * validates *both* dentry counters, since we checked the sequence
830 	 * number of the parent after we got the child sequence number. So we
831 	 * know the parent must still be valid if the child sequence number is
832 	 */
833 	if (unlikely(!lockref_get_not_dead(&dentry->d_lockref)))
834 		goto out;
835 	if (read_seqcount_retry(&dentry->d_seq, nd->next_seq))
836 		goto out_dput;
837 	/*
838 	 * Sequence counts matched. Now make sure that the root is
839 	 * still valid and get it if required.
840 	 */
841 	if (unlikely(!legitimize_root(nd)))
842 		goto out_dput;
843 	leave_rcu(nd);
844 	return true;
845 
846 out2:
847 	nd->path.mnt = NULL;
848 out1:
849 	nd->path.dentry = NULL;
850 out:
851 	leave_rcu(nd);
852 	return false;
853 out_dput:
854 	leave_rcu(nd);
855 	dput(dentry);
856 	return false;
857 }
858 
d_revalidate(struct dentry * dentry,unsigned int flags)859 static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
860 {
861 	if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE))
862 		return dentry->d_op->d_revalidate(dentry, flags);
863 	else
864 		return 1;
865 }
866 
867 /**
868  * complete_walk - successful completion of path walk
869  * @nd:  pointer nameidata
870  *
871  * If we had been in RCU mode, drop out of it and legitimize nd->path.
872  * Revalidate the final result, unless we'd already done that during
873  * the path walk or the filesystem doesn't ask for it.  Return 0 on
874  * success, -error on failure.  In case of failure caller does not
875  * need to drop nd->path.
876  */
complete_walk(struct nameidata * nd)877 static int complete_walk(struct nameidata *nd)
878 {
879 	struct dentry *dentry = nd->path.dentry;
880 	int status;
881 
882 	if (nd->flags & LOOKUP_RCU) {
883 		/*
884 		 * We don't want to zero nd->root for scoped-lookups or
885 		 * externally-managed nd->root.
886 		 */
887 		if (!(nd->state & ND_ROOT_PRESET))
888 			if (!(nd->flags & LOOKUP_IS_SCOPED))
889 				nd->root.mnt = NULL;
890 		nd->flags &= ~LOOKUP_CACHED;
891 		if (!try_to_unlazy(nd))
892 			return -ECHILD;
893 	}
894 
895 	if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
896 		/*
897 		 * While the guarantee of LOOKUP_IS_SCOPED is (roughly) "don't
898 		 * ever step outside the root during lookup" and should already
899 		 * be guaranteed by the rest of namei, we want to avoid a namei
900 		 * BUG resulting in userspace being given a path that was not
901 		 * scoped within the root at some point during the lookup.
902 		 *
903 		 * So, do a final sanity-check to make sure that in the
904 		 * worst-case scenario (a complete bypass of LOOKUP_IS_SCOPED)
905 		 * we won't silently return an fd completely outside of the
906 		 * requested root to userspace.
907 		 *
908 		 * Userspace could move the path outside the root after this
909 		 * check, but as discussed elsewhere this is not a concern (the
910 		 * resolved file was inside the root at some point).
911 		 */
912 		if (!path_is_under(&nd->path, &nd->root))
913 			return -EXDEV;
914 	}
915 
916 	if (likely(!(nd->state & ND_JUMPED)))
917 		return 0;
918 
919 	if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
920 		return 0;
921 
922 	status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
923 	if (status > 0)
924 		return 0;
925 
926 	if (!status)
927 		status = -ESTALE;
928 
929 	return status;
930 }
931 
set_root(struct nameidata * nd)932 static int set_root(struct nameidata *nd)
933 {
934 	struct fs_struct *fs = current->fs;
935 
936 	/*
937 	 * Jumping to the real root in a scoped-lookup is a BUG in namei, but we
938 	 * still have to ensure it doesn't happen because it will cause a breakout
939 	 * from the dirfd.
940 	 */
941 	if (WARN_ON(nd->flags & LOOKUP_IS_SCOPED))
942 		return -ENOTRECOVERABLE;
943 
944 	if (nd->flags & LOOKUP_RCU) {
945 		unsigned seq;
946 
947 		do {
948 			seq = read_seqcount_begin(&fs->seq);
949 			nd->root = fs->root;
950 			nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
951 		} while (read_seqcount_retry(&fs->seq, seq));
952 	} else {
953 		get_fs_root(fs, &nd->root);
954 		nd->state |= ND_ROOT_GRABBED;
955 	}
956 	return 0;
957 }
958 
nd_jump_root(struct nameidata * nd)959 static int nd_jump_root(struct nameidata *nd)
960 {
961 	if (unlikely(nd->flags & LOOKUP_BENEATH))
962 		return -EXDEV;
963 	if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
964 		/* Absolute path arguments to path_init() are allowed. */
965 		if (nd->path.mnt != NULL && nd->path.mnt != nd->root.mnt)
966 			return -EXDEV;
967 	}
968 	if (!nd->root.mnt) {
969 		int error = set_root(nd);
970 		if (error)
971 			return error;
972 	}
973 	if (nd->flags & LOOKUP_RCU) {
974 		struct dentry *d;
975 		nd->path = nd->root;
976 		d = nd->path.dentry;
977 		nd->inode = d->d_inode;
978 		nd->seq = nd->root_seq;
979 		if (read_seqcount_retry(&d->d_seq, nd->seq))
980 			return -ECHILD;
981 	} else {
982 		path_put(&nd->path);
983 		nd->path = nd->root;
984 		path_get(&nd->path);
985 		nd->inode = nd->path.dentry->d_inode;
986 	}
987 	nd->state |= ND_JUMPED;
988 	return 0;
989 }
990 
991 /*
992  * Helper to directly jump to a known parsed path from ->get_link,
993  * caller must have taken a reference to path beforehand.
994  */
nd_jump_link(const struct path * path)995 int nd_jump_link(const struct path *path)
996 {
997 	int error = -ELOOP;
998 	struct nameidata *nd = current->nameidata;
999 
1000 	if (unlikely(nd->flags & LOOKUP_NO_MAGICLINKS))
1001 		goto err;
1002 
1003 	error = -EXDEV;
1004 	if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
1005 		if (nd->path.mnt != path->mnt)
1006 			goto err;
1007 	}
1008 	/* Not currently safe for scoped-lookups. */
1009 	if (unlikely(nd->flags & LOOKUP_IS_SCOPED))
1010 		goto err;
1011 
1012 	path_put(&nd->path);
1013 	nd->path = *path;
1014 	nd->inode = nd->path.dentry->d_inode;
1015 	nd->state |= ND_JUMPED;
1016 	return 0;
1017 
1018 err:
1019 	path_put(path);
1020 	return error;
1021 }
1022 
put_link(struct nameidata * nd)1023 static inline void put_link(struct nameidata *nd)
1024 {
1025 	struct saved *last = nd->stack + --nd->depth;
1026 	do_delayed_call(&last->done);
1027 	if (!(nd->flags & LOOKUP_RCU))
1028 		path_put(&last->link);
1029 }
1030 
1031 static int sysctl_protected_symlinks __read_mostly;
1032 static int sysctl_protected_hardlinks __read_mostly;
1033 static int sysctl_protected_fifos __read_mostly;
1034 static int sysctl_protected_regular __read_mostly;
1035 
1036 #ifdef CONFIG_SYSCTL
1037 static struct ctl_table namei_sysctls[] = {
1038 	{
1039 		.procname	= "protected_symlinks",
1040 		.data		= &sysctl_protected_symlinks,
1041 		.maxlen		= sizeof(int),
1042 		.mode		= 0644,
1043 		.proc_handler	= proc_dointvec_minmax,
1044 		.extra1		= SYSCTL_ZERO,
1045 		.extra2		= SYSCTL_ONE,
1046 	},
1047 	{
1048 		.procname	= "protected_hardlinks",
1049 		.data		= &sysctl_protected_hardlinks,
1050 		.maxlen		= sizeof(int),
1051 		.mode		= 0644,
1052 		.proc_handler	= proc_dointvec_minmax,
1053 		.extra1		= SYSCTL_ZERO,
1054 		.extra2		= SYSCTL_ONE,
1055 	},
1056 	{
1057 		.procname	= "protected_fifos",
1058 		.data		= &sysctl_protected_fifos,
1059 		.maxlen		= sizeof(int),
1060 		.mode		= 0644,
1061 		.proc_handler	= proc_dointvec_minmax,
1062 		.extra1		= SYSCTL_ZERO,
1063 		.extra2		= SYSCTL_TWO,
1064 	},
1065 	{
1066 		.procname	= "protected_regular",
1067 		.data		= &sysctl_protected_regular,
1068 		.maxlen		= sizeof(int),
1069 		.mode		= 0644,
1070 		.proc_handler	= proc_dointvec_minmax,
1071 		.extra1		= SYSCTL_ZERO,
1072 		.extra2		= SYSCTL_TWO,
1073 	},
1074 	{ }
1075 };
1076 
init_fs_namei_sysctls(void)1077 static int __init init_fs_namei_sysctls(void)
1078 {
1079 	register_sysctl_init("fs", namei_sysctls);
1080 	return 0;
1081 }
1082 fs_initcall(init_fs_namei_sysctls);
1083 
1084 #endif /* CONFIG_SYSCTL */
1085 
1086 /**
1087  * may_follow_link - Check symlink following for unsafe situations
1088  * @nd: nameidata pathwalk data
1089  * @inode: Used for idmapping.
1090  *
1091  * In the case of the sysctl_protected_symlinks sysctl being enabled,
1092  * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
1093  * in a sticky world-writable directory. This is to protect privileged
1094  * processes from failing races against path names that may change out
1095  * from under them by way of other users creating malicious symlinks.
1096  * It will permit symlinks to be followed only when outside a sticky
1097  * world-writable directory, or when the uid of the symlink and follower
1098  * match, or when the directory owner matches the symlink's owner.
1099  *
1100  * Returns 0 if following the symlink is allowed, -ve on error.
1101  */
may_follow_link(struct nameidata * nd,const struct inode * inode)1102 static inline int may_follow_link(struct nameidata *nd, const struct inode *inode)
1103 {
1104 	struct mnt_idmap *idmap;
1105 	vfsuid_t vfsuid;
1106 
1107 	if (!sysctl_protected_symlinks)
1108 		return 0;
1109 
1110 	idmap = mnt_idmap(nd->path.mnt);
1111 	vfsuid = i_uid_into_vfsuid(idmap, inode);
1112 	/* Allowed if owner and follower match. */
1113 	if (vfsuid_eq_kuid(vfsuid, current_fsuid()))
1114 		return 0;
1115 
1116 	/* Allowed if parent directory not sticky and world-writable. */
1117 	if ((nd->dir_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
1118 		return 0;
1119 
1120 	/* Allowed if parent directory and link owner match. */
1121 	if (vfsuid_valid(nd->dir_vfsuid) && vfsuid_eq(nd->dir_vfsuid, vfsuid))
1122 		return 0;
1123 
1124 	if (nd->flags & LOOKUP_RCU)
1125 		return -ECHILD;
1126 
1127 	audit_inode(nd->name, nd->stack[0].link.dentry, 0);
1128 	audit_log_path_denied(AUDIT_ANOM_LINK, "follow_link");
1129 	return -EACCES;
1130 }
1131 
1132 /**
1133  * safe_hardlink_source - Check for safe hardlink conditions
1134  * @idmap: idmap of the mount the inode was found from
1135  * @inode: the source inode to hardlink from
1136  *
1137  * Return false if at least one of the following conditions:
1138  *    - inode is not a regular file
1139  *    - inode is setuid
1140  *    - inode is setgid and group-exec
1141  *    - access failure for read and write
1142  *
1143  * Otherwise returns true.
1144  */
safe_hardlink_source(struct mnt_idmap * idmap,struct inode * inode)1145 static bool safe_hardlink_source(struct mnt_idmap *idmap,
1146 				 struct inode *inode)
1147 {
1148 	umode_t mode = inode->i_mode;
1149 
1150 	/* Special files should not get pinned to the filesystem. */
1151 	if (!S_ISREG(mode))
1152 		return false;
1153 
1154 	/* Setuid files should not get pinned to the filesystem. */
1155 	if (mode & S_ISUID)
1156 		return false;
1157 
1158 	/* Executable setgid files should not get pinned to the filesystem. */
1159 	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
1160 		return false;
1161 
1162 	/* Hardlinking to unreadable or unwritable sources is dangerous. */
1163 	if (inode_permission(idmap, inode, MAY_READ | MAY_WRITE))
1164 		return false;
1165 
1166 	return true;
1167 }
1168 
1169 /**
1170  * may_linkat - Check permissions for creating a hardlink
1171  * @idmap: idmap of the mount the inode was found from
1172  * @link:  the source to hardlink from
1173  *
1174  * Block hardlink when all of:
1175  *  - sysctl_protected_hardlinks enabled
1176  *  - fsuid does not match inode
1177  *  - hardlink source is unsafe (see safe_hardlink_source() above)
1178  *  - not CAP_FOWNER in a namespace with the inode owner uid mapped
1179  *
1180  * If the inode has been found through an idmapped mount the idmap of
1181  * the vfsmount must be passed through @idmap. This function will then take
1182  * care to map the inode according to @idmap before checking permissions.
1183  * On non-idmapped mounts or if permission checking is to be performed on the
1184  * raw inode simply pass @nop_mnt_idmap.
1185  *
1186  * Returns 0 if successful, -ve on error.
1187  */
may_linkat(struct mnt_idmap * idmap,const struct path * link)1188 int may_linkat(struct mnt_idmap *idmap, const struct path *link)
1189 {
1190 	struct inode *inode = link->dentry->d_inode;
1191 
1192 	/* Inode writeback is not safe when the uid or gid are invalid. */
1193 	if (!vfsuid_valid(i_uid_into_vfsuid(idmap, inode)) ||
1194 	    !vfsgid_valid(i_gid_into_vfsgid(idmap, inode)))
1195 		return -EOVERFLOW;
1196 
1197 	if (!sysctl_protected_hardlinks)
1198 		return 0;
1199 
1200 	/* Source inode owner (or CAP_FOWNER) can hardlink all they like,
1201 	 * otherwise, it must be a safe source.
1202 	 */
1203 	if (safe_hardlink_source(idmap, inode) ||
1204 	    inode_owner_or_capable(idmap, inode))
1205 		return 0;
1206 
1207 	audit_log_path_denied(AUDIT_ANOM_LINK, "linkat");
1208 	return -EPERM;
1209 }
1210 
1211 /**
1212  * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
1213  *			  should be allowed, or not, on files that already
1214  *			  exist.
1215  * @idmap: idmap of the mount the inode was found from
1216  * @nd: nameidata pathwalk data
1217  * @inode: the inode of the file to open
1218  *
1219  * Block an O_CREAT open of a FIFO (or a regular file) when:
1220  *   - sysctl_protected_fifos (or sysctl_protected_regular) is enabled
1221  *   - the file already exists
1222  *   - we are in a sticky directory
1223  *   - we don't own the file
1224  *   - the owner of the directory doesn't own the file
1225  *   - the directory is world writable
1226  * If the sysctl_protected_fifos (or sysctl_protected_regular) is set to 2
1227  * the directory doesn't have to be world writable: being group writable will
1228  * be enough.
1229  *
1230  * If the inode has been found through an idmapped mount the idmap of
1231  * the vfsmount must be passed through @idmap. This function will then take
1232  * care to map the inode according to @idmap before checking permissions.
1233  * On non-idmapped mounts or if permission checking is to be performed on the
1234  * raw inode simply pass @nop_mnt_idmap.
1235  *
1236  * Returns 0 if the open is allowed, -ve on error.
1237  */
may_create_in_sticky(struct mnt_idmap * idmap,struct nameidata * nd,struct inode * const inode)1238 static int may_create_in_sticky(struct mnt_idmap *idmap,
1239 				struct nameidata *nd, struct inode *const inode)
1240 {
1241 	umode_t dir_mode = nd->dir_mode;
1242 	vfsuid_t dir_vfsuid = nd->dir_vfsuid;
1243 
1244 	if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
1245 	    (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
1246 	    likely(!(dir_mode & S_ISVTX)) ||
1247 	    vfsuid_eq(i_uid_into_vfsuid(idmap, inode), dir_vfsuid) ||
1248 	    vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), current_fsuid()))
1249 		return 0;
1250 
1251 	if (likely(dir_mode & 0002) ||
1252 	    (dir_mode & 0020 &&
1253 	     ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
1254 	      (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
1255 		const char *operation = S_ISFIFO(inode->i_mode) ?
1256 					"sticky_create_fifo" :
1257 					"sticky_create_regular";
1258 		audit_log_path_denied(AUDIT_ANOM_CREAT, operation);
1259 		return -EACCES;
1260 	}
1261 	return 0;
1262 }
1263 
1264 /*
1265  * follow_up - Find the mountpoint of path's vfsmount
1266  *
1267  * Given a path, find the mountpoint of its source file system.
1268  * Replace @path with the path of the mountpoint in the parent mount.
1269  * Up is towards /.
1270  *
1271  * Return 1 if we went up a level and 0 if we were already at the
1272  * root.
1273  */
follow_up(struct path * path)1274 int follow_up(struct path *path)
1275 {
1276 	struct mount *mnt = real_mount(path->mnt);
1277 	struct mount *parent;
1278 	struct dentry *mountpoint;
1279 
1280 	read_seqlock_excl(&mount_lock);
1281 	parent = mnt->mnt_parent;
1282 	if (parent == mnt) {
1283 		read_sequnlock_excl(&mount_lock);
1284 		return 0;
1285 	}
1286 	mntget(&parent->mnt);
1287 	mountpoint = dget(mnt->mnt_mountpoint);
1288 	read_sequnlock_excl(&mount_lock);
1289 	dput(path->dentry);
1290 	path->dentry = mountpoint;
1291 	mntput(path->mnt);
1292 	path->mnt = &parent->mnt;
1293 	return 1;
1294 }
1295 EXPORT_SYMBOL(follow_up);
1296 
choose_mountpoint_rcu(struct mount * m,const struct path * root,struct path * path,unsigned * seqp)1297 static bool choose_mountpoint_rcu(struct mount *m, const struct path *root,
1298 				  struct path *path, unsigned *seqp)
1299 {
1300 	while (mnt_has_parent(m)) {
1301 		struct dentry *mountpoint = m->mnt_mountpoint;
1302 
1303 		m = m->mnt_parent;
1304 		if (unlikely(root->dentry == mountpoint &&
1305 			     root->mnt == &m->mnt))
1306 			break;
1307 		if (mountpoint != m->mnt.mnt_root) {
1308 			path->mnt = &m->mnt;
1309 			path->dentry = mountpoint;
1310 			*seqp = read_seqcount_begin(&mountpoint->d_seq);
1311 			return true;
1312 		}
1313 	}
1314 	return false;
1315 }
1316 
choose_mountpoint(struct mount * m,const struct path * root,struct path * path)1317 static bool choose_mountpoint(struct mount *m, const struct path *root,
1318 			      struct path *path)
1319 {
1320 	bool found;
1321 
1322 	rcu_read_lock();
1323 	while (1) {
1324 		unsigned seq, mseq = read_seqbegin(&mount_lock);
1325 
1326 		found = choose_mountpoint_rcu(m, root, path, &seq);
1327 		if (unlikely(!found)) {
1328 			if (!read_seqretry(&mount_lock, mseq))
1329 				break;
1330 		} else {
1331 			if (likely(__legitimize_path(path, seq, mseq)))
1332 				break;
1333 			rcu_read_unlock();
1334 			path_put(path);
1335 			rcu_read_lock();
1336 		}
1337 	}
1338 	rcu_read_unlock();
1339 	return found;
1340 }
1341 
1342 /*
1343  * Perform an automount
1344  * - return -EISDIR to tell follow_managed() to stop and return the path we
1345  *   were called with.
1346  */
follow_automount(struct path * path,int * count,unsigned lookup_flags)1347 static int follow_automount(struct path *path, int *count, unsigned lookup_flags)
1348 {
1349 	struct dentry *dentry = path->dentry;
1350 
1351 	/* We don't want to mount if someone's just doing a stat -
1352 	 * unless they're stat'ing a directory and appended a '/' to
1353 	 * the name.
1354 	 *
1355 	 * We do, however, want to mount if someone wants to open or
1356 	 * create a file of any type under the mountpoint, wants to
1357 	 * traverse through the mountpoint or wants to open the
1358 	 * mounted directory.  Also, autofs may mark negative dentries
1359 	 * as being automount points.  These will need the attentions
1360 	 * of the daemon to instantiate them before they can be used.
1361 	 */
1362 	if (!(lookup_flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
1363 			   LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
1364 	    dentry->d_inode)
1365 		return -EISDIR;
1366 
1367 	if (count && (*count)++ >= MAXSYMLINKS)
1368 		return -ELOOP;
1369 
1370 	return finish_automount(dentry->d_op->d_automount(path), path);
1371 }
1372 
1373 /*
1374  * mount traversal - out-of-line part.  One note on ->d_flags accesses -
1375  * dentries are pinned but not locked here, so negative dentry can go
1376  * positive right under us.  Use of smp_load_acquire() provides a barrier
1377  * sufficient for ->d_inode and ->d_flags consistency.
1378  */
__traverse_mounts(struct path * path,unsigned flags,bool * jumped,int * count,unsigned lookup_flags)1379 static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped,
1380 			     int *count, unsigned lookup_flags)
1381 {
1382 	struct vfsmount *mnt = path->mnt;
1383 	bool need_mntput = false;
1384 	int ret = 0;
1385 
1386 	while (flags & DCACHE_MANAGED_DENTRY) {
1387 		/* Allow the filesystem to manage the transit without i_mutex
1388 		 * being held. */
1389 		if (flags & DCACHE_MANAGE_TRANSIT) {
1390 			ret = path->dentry->d_op->d_manage(path, false);
1391 			flags = smp_load_acquire(&path->dentry->d_flags);
1392 			if (ret < 0)
1393 				break;
1394 		}
1395 
1396 		if (flags & DCACHE_MOUNTED) {	// something's mounted on it..
1397 			struct vfsmount *mounted = lookup_mnt(path);
1398 			if (mounted) {		// ... in our namespace
1399 				dput(path->dentry);
1400 				if (need_mntput)
1401 					mntput(path->mnt);
1402 				path->mnt = mounted;
1403 				path->dentry = dget(mounted->mnt_root);
1404 				// here we know it's positive
1405 				flags = path->dentry->d_flags;
1406 				need_mntput = true;
1407 				continue;
1408 			}
1409 		}
1410 
1411 		if (!(flags & DCACHE_NEED_AUTOMOUNT))
1412 			break;
1413 
1414 		// uncovered automount point
1415 		ret = follow_automount(path, count, lookup_flags);
1416 		flags = smp_load_acquire(&path->dentry->d_flags);
1417 		if (ret < 0)
1418 			break;
1419 	}
1420 
1421 	if (ret == -EISDIR)
1422 		ret = 0;
1423 	// possible if you race with several mount --move
1424 	if (need_mntput && path->mnt == mnt)
1425 		mntput(path->mnt);
1426 	if (!ret && unlikely(d_flags_negative(flags)))
1427 		ret = -ENOENT;
1428 	*jumped = need_mntput;
1429 	return ret;
1430 }
1431 
traverse_mounts(struct path * path,bool * jumped,int * count,unsigned lookup_flags)1432 static inline int traverse_mounts(struct path *path, bool *jumped,
1433 				  int *count, unsigned lookup_flags)
1434 {
1435 	unsigned flags = smp_load_acquire(&path->dentry->d_flags);
1436 
1437 	/* fastpath */
1438 	if (likely(!(flags & DCACHE_MANAGED_DENTRY))) {
1439 		*jumped = false;
1440 		if (unlikely(d_flags_negative(flags)))
1441 			return -ENOENT;
1442 		return 0;
1443 	}
1444 	return __traverse_mounts(path, flags, jumped, count, lookup_flags);
1445 }
1446 
follow_down_one(struct path * path)1447 int follow_down_one(struct path *path)
1448 {
1449 	struct vfsmount *mounted;
1450 
1451 	mounted = lookup_mnt(path);
1452 	if (mounted) {
1453 		dput(path->dentry);
1454 		mntput(path->mnt);
1455 		path->mnt = mounted;
1456 		path->dentry = dget(mounted->mnt_root);
1457 		return 1;
1458 	}
1459 	return 0;
1460 }
1461 EXPORT_SYMBOL(follow_down_one);
1462 
1463 /*
1464  * Follow down to the covering mount currently visible to userspace.  At each
1465  * point, the filesystem owning that dentry may be queried as to whether the
1466  * caller is permitted to proceed or not.
1467  */
follow_down(struct path * path,unsigned int flags)1468 int follow_down(struct path *path, unsigned int flags)
1469 {
1470 	struct vfsmount *mnt = path->mnt;
1471 	bool jumped;
1472 	int ret = traverse_mounts(path, &jumped, NULL, flags);
1473 
1474 	if (path->mnt != mnt)
1475 		mntput(mnt);
1476 	return ret;
1477 }
1478 EXPORT_SYMBOL(follow_down);
1479 
1480 /*
1481  * Try to skip to top of mountpoint pile in rcuwalk mode.  Fail if
1482  * we meet a managed dentry that would need blocking.
1483  */
__follow_mount_rcu(struct nameidata * nd,struct path * path)1484 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path)
1485 {
1486 	struct dentry *dentry = path->dentry;
1487 	unsigned int flags = dentry->d_flags;
1488 
1489 	if (likely(!(flags & DCACHE_MANAGED_DENTRY)))
1490 		return true;
1491 
1492 	if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1493 		return false;
1494 
1495 	for (;;) {
1496 		/*
1497 		 * Don't forget we might have a non-mountpoint managed dentry
1498 		 * that wants to block transit.
1499 		 */
1500 		if (unlikely(flags & DCACHE_MANAGE_TRANSIT)) {
1501 			int res = dentry->d_op->d_manage(path, true);
1502 			if (res)
1503 				return res == -EISDIR;
1504 			flags = dentry->d_flags;
1505 		}
1506 
1507 		if (flags & DCACHE_MOUNTED) {
1508 			struct mount *mounted = __lookup_mnt(path->mnt, dentry);
1509 			if (mounted) {
1510 				path->mnt = &mounted->mnt;
1511 				dentry = path->dentry = mounted->mnt.mnt_root;
1512 				nd->state |= ND_JUMPED;
1513 				nd->next_seq = read_seqcount_begin(&dentry->d_seq);
1514 				flags = dentry->d_flags;
1515 				// makes sure that non-RCU pathwalk could reach
1516 				// this state.
1517 				if (read_seqretry(&mount_lock, nd->m_seq))
1518 					return false;
1519 				continue;
1520 			}
1521 			if (read_seqretry(&mount_lock, nd->m_seq))
1522 				return false;
1523 		}
1524 		return !(flags & DCACHE_NEED_AUTOMOUNT);
1525 	}
1526 }
1527 
handle_mounts(struct nameidata * nd,struct dentry * dentry,struct path * path)1528 static inline int handle_mounts(struct nameidata *nd, struct dentry *dentry,
1529 			  struct path *path)
1530 {
1531 	bool jumped;
1532 	int ret;
1533 
1534 	path->mnt = nd->path.mnt;
1535 	path->dentry = dentry;
1536 	if (nd->flags & LOOKUP_RCU) {
1537 		unsigned int seq = nd->next_seq;
1538 		if (likely(__follow_mount_rcu(nd, path)))
1539 			return 0;
1540 		// *path and nd->next_seq might've been clobbered
1541 		path->mnt = nd->path.mnt;
1542 		path->dentry = dentry;
1543 		nd->next_seq = seq;
1544 		if (!try_to_unlazy_next(nd, dentry))
1545 			return -ECHILD;
1546 	}
1547 	ret = traverse_mounts(path, &jumped, &nd->total_link_count, nd->flags);
1548 	if (jumped) {
1549 		if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1550 			ret = -EXDEV;
1551 		else
1552 			nd->state |= ND_JUMPED;
1553 	}
1554 	if (unlikely(ret)) {
1555 		dput(path->dentry);
1556 		if (path->mnt != nd->path.mnt)
1557 			mntput(path->mnt);
1558 	}
1559 	return ret;
1560 }
1561 
1562 /*
1563  * This looks up the name in dcache and possibly revalidates the found dentry.
1564  * NULL is returned if the dentry does not exist in the cache.
1565  */
lookup_dcache(const struct qstr * name,struct dentry * dir,unsigned int flags)1566 static struct dentry *lookup_dcache(const struct qstr *name,
1567 				    struct dentry *dir,
1568 				    unsigned int flags)
1569 {
1570 	struct dentry *dentry = d_lookup(dir, name);
1571 	if (dentry) {
1572 		int error = d_revalidate(dentry, flags);
1573 		if (unlikely(error <= 0)) {
1574 			if (!error)
1575 				d_invalidate(dentry);
1576 			dput(dentry);
1577 			return ERR_PTR(error);
1578 		}
1579 	}
1580 	return dentry;
1581 }
1582 
1583 /*
1584  * Parent directory has inode locked exclusive.  This is one
1585  * and only case when ->lookup() gets called on non in-lookup
1586  * dentries - as the matter of fact, this only gets called
1587  * when directory is guaranteed to have no in-lookup children
1588  * at all.
1589  */
lookup_one_qstr_excl(const struct qstr * name,struct dentry * base,unsigned int flags)1590 struct dentry *lookup_one_qstr_excl(const struct qstr *name,
1591 				    struct dentry *base,
1592 				    unsigned int flags)
1593 {
1594 	struct dentry *dentry = lookup_dcache(name, base, flags);
1595 	struct dentry *old;
1596 	struct inode *dir = base->d_inode;
1597 
1598 	if (dentry)
1599 		return dentry;
1600 
1601 	/* Don't create child dentry for a dead directory. */
1602 	if (unlikely(IS_DEADDIR(dir)))
1603 		return ERR_PTR(-ENOENT);
1604 
1605 	dentry = d_alloc(base, name);
1606 	if (unlikely(!dentry))
1607 		return ERR_PTR(-ENOMEM);
1608 
1609 	old = dir->i_op->lookup(dir, dentry, flags);
1610 	if (unlikely(old)) {
1611 		dput(dentry);
1612 		dentry = old;
1613 	}
1614 	return dentry;
1615 }
1616 EXPORT_SYMBOL(lookup_one_qstr_excl);
1617 
lookup_fast(struct nameidata * nd)1618 static struct dentry *lookup_fast(struct nameidata *nd)
1619 {
1620 	struct dentry *dentry, *parent = nd->path.dentry;
1621 	int status = 1;
1622 
1623 	/*
1624 	 * Rename seqlock is not required here because in the off chance
1625 	 * of a false negative due to a concurrent rename, the caller is
1626 	 * going to fall back to non-racy lookup.
1627 	 */
1628 	if (nd->flags & LOOKUP_RCU) {
1629 		dentry = __d_lookup_rcu(parent, &nd->last, &nd->next_seq);
1630 		if (unlikely(!dentry)) {
1631 			if (!try_to_unlazy(nd))
1632 				return ERR_PTR(-ECHILD);
1633 			return NULL;
1634 		}
1635 
1636 		/*
1637 		 * This sequence count validates that the parent had no
1638 		 * changes while we did the lookup of the dentry above.
1639 		 */
1640 		if (read_seqcount_retry(&parent->d_seq, nd->seq))
1641 			return ERR_PTR(-ECHILD);
1642 
1643 		status = d_revalidate(dentry, nd->flags);
1644 		if (likely(status > 0))
1645 			return dentry;
1646 		if (!try_to_unlazy_next(nd, dentry))
1647 			return ERR_PTR(-ECHILD);
1648 		if (status == -ECHILD)
1649 			/* we'd been told to redo it in non-rcu mode */
1650 			status = d_revalidate(dentry, nd->flags);
1651 	} else {
1652 		dentry = __d_lookup(parent, &nd->last);
1653 		if (unlikely(!dentry))
1654 			return NULL;
1655 		status = d_revalidate(dentry, nd->flags);
1656 	}
1657 	if (unlikely(status <= 0)) {
1658 		if (!status)
1659 			d_invalidate(dentry);
1660 		dput(dentry);
1661 		return ERR_PTR(status);
1662 	}
1663 	return dentry;
1664 }
1665 
1666 /* Fast lookup failed, do it the slow way */
__lookup_slow(const struct qstr * name,struct dentry * dir,unsigned int flags)1667 static struct dentry *__lookup_slow(const struct qstr *name,
1668 				    struct dentry *dir,
1669 				    unsigned int flags)
1670 {
1671 	struct dentry *dentry, *old;
1672 	struct inode *inode = dir->d_inode;
1673 	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
1674 
1675 	/* Don't go there if it's already dead */
1676 	if (unlikely(IS_DEADDIR(inode)))
1677 		return ERR_PTR(-ENOENT);
1678 again:
1679 	dentry = d_alloc_parallel(dir, name, &wq);
1680 	if (IS_ERR(dentry))
1681 		return dentry;
1682 	if (unlikely(!d_in_lookup(dentry))) {
1683 		int error = d_revalidate(dentry, flags);
1684 		if (unlikely(error <= 0)) {
1685 			if (!error) {
1686 				d_invalidate(dentry);
1687 				dput(dentry);
1688 				goto again;
1689 			}
1690 			dput(dentry);
1691 			dentry = ERR_PTR(error);
1692 		}
1693 	} else {
1694 		old = inode->i_op->lookup(inode, dentry, flags);
1695 		d_lookup_done(dentry);
1696 		if (unlikely(old)) {
1697 			dput(dentry);
1698 			dentry = old;
1699 		}
1700 	}
1701 	return dentry;
1702 }
1703 
lookup_slow(const struct qstr * name,struct dentry * dir,unsigned int flags)1704 static struct dentry *lookup_slow(const struct qstr *name,
1705 				  struct dentry *dir,
1706 				  unsigned int flags)
1707 {
1708 	struct inode *inode = dir->d_inode;
1709 	struct dentry *res;
1710 	inode_lock_shared(inode);
1711 	res = __lookup_slow(name, dir, flags);
1712 	inode_unlock_shared(inode);
1713 	return res;
1714 }
1715 
may_lookup(struct mnt_idmap * idmap,struct nameidata * nd)1716 static inline int may_lookup(struct mnt_idmap *idmap,
1717 			     struct nameidata *nd)
1718 {
1719 	if (nd->flags & LOOKUP_RCU) {
1720 		int err = inode_permission(idmap, nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1721 		if (err != -ECHILD || !try_to_unlazy(nd))
1722 			return err;
1723 	}
1724 	return inode_permission(idmap, nd->inode, MAY_EXEC);
1725 }
1726 
reserve_stack(struct nameidata * nd,struct path * link)1727 static int reserve_stack(struct nameidata *nd, struct path *link)
1728 {
1729 	if (unlikely(nd->total_link_count++ >= MAXSYMLINKS))
1730 		return -ELOOP;
1731 
1732 	if (likely(nd->depth != EMBEDDED_LEVELS))
1733 		return 0;
1734 	if (likely(nd->stack != nd->internal))
1735 		return 0;
1736 	if (likely(nd_alloc_stack(nd)))
1737 		return 0;
1738 
1739 	if (nd->flags & LOOKUP_RCU) {
1740 		// we need to grab link before we do unlazy.  And we can't skip
1741 		// unlazy even if we fail to grab the link - cleanup needs it
1742 		bool grabbed_link = legitimize_path(nd, link, nd->next_seq);
1743 
1744 		if (!try_to_unlazy(nd) || !grabbed_link)
1745 			return -ECHILD;
1746 
1747 		if (nd_alloc_stack(nd))
1748 			return 0;
1749 	}
1750 	return -ENOMEM;
1751 }
1752 
1753 enum {WALK_TRAILING = 1, WALK_MORE = 2, WALK_NOFOLLOW = 4};
1754 
pick_link(struct nameidata * nd,struct path * link,struct inode * inode,int flags)1755 static const char *pick_link(struct nameidata *nd, struct path *link,
1756 		     struct inode *inode, int flags)
1757 {
1758 	struct saved *last;
1759 	const char *res;
1760 	int error = reserve_stack(nd, link);
1761 
1762 	if (unlikely(error)) {
1763 		if (!(nd->flags & LOOKUP_RCU))
1764 			path_put(link);
1765 		return ERR_PTR(error);
1766 	}
1767 	last = nd->stack + nd->depth++;
1768 	last->link = *link;
1769 	clear_delayed_call(&last->done);
1770 	last->seq = nd->next_seq;
1771 
1772 	if (flags & WALK_TRAILING) {
1773 		error = may_follow_link(nd, inode);
1774 		if (unlikely(error))
1775 			return ERR_PTR(error);
1776 	}
1777 
1778 	if (unlikely(nd->flags & LOOKUP_NO_SYMLINKS) ||
1779 			unlikely(link->mnt->mnt_flags & MNT_NOSYMFOLLOW))
1780 		return ERR_PTR(-ELOOP);
1781 
1782 	if (!(nd->flags & LOOKUP_RCU)) {
1783 		touch_atime(&last->link);
1784 		cond_resched();
1785 	} else if (atime_needs_update(&last->link, inode)) {
1786 		if (!try_to_unlazy(nd))
1787 			return ERR_PTR(-ECHILD);
1788 		touch_atime(&last->link);
1789 	}
1790 
1791 	error = security_inode_follow_link(link->dentry, inode,
1792 					   nd->flags & LOOKUP_RCU);
1793 	if (unlikely(error))
1794 		return ERR_PTR(error);
1795 
1796 	res = READ_ONCE(inode->i_link);
1797 	if (!res) {
1798 		const char * (*get)(struct dentry *, struct inode *,
1799 				struct delayed_call *);
1800 		get = inode->i_op->get_link;
1801 		if (nd->flags & LOOKUP_RCU) {
1802 			res = get(NULL, inode, &last->done);
1803 			if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd))
1804 				res = get(link->dentry, inode, &last->done);
1805 		} else {
1806 			res = get(link->dentry, inode, &last->done);
1807 		}
1808 		if (!res)
1809 			goto all_done;
1810 		if (IS_ERR(res))
1811 			return res;
1812 	}
1813 	if (*res == '/') {
1814 		error = nd_jump_root(nd);
1815 		if (unlikely(error))
1816 			return ERR_PTR(error);
1817 		while (unlikely(*++res == '/'))
1818 			;
1819 	}
1820 	if (*res)
1821 		return res;
1822 all_done: // pure jump
1823 	put_link(nd);
1824 	return NULL;
1825 }
1826 
1827 /*
1828  * Do we need to follow links? We _really_ want to be able
1829  * to do this check without having to look at inode->i_op,
1830  * so we keep a cache of "no, this doesn't need follow_link"
1831  * for the common case.
1832  *
1833  * NOTE: dentry must be what nd->next_seq had been sampled from.
1834  */
step_into(struct nameidata * nd,int flags,struct dentry * dentry)1835 static const char *step_into(struct nameidata *nd, int flags,
1836 		     struct dentry *dentry)
1837 {
1838 	struct path path;
1839 	struct inode *inode;
1840 	int err = handle_mounts(nd, dentry, &path);
1841 
1842 	if (err < 0)
1843 		return ERR_PTR(err);
1844 	inode = path.dentry->d_inode;
1845 	if (likely(!d_is_symlink(path.dentry)) ||
1846 	   ((flags & WALK_TRAILING) && !(nd->flags & LOOKUP_FOLLOW)) ||
1847 	   (flags & WALK_NOFOLLOW)) {
1848 		/* not a symlink or should not follow */
1849 		if (nd->flags & LOOKUP_RCU) {
1850 			if (read_seqcount_retry(&path.dentry->d_seq, nd->next_seq))
1851 				return ERR_PTR(-ECHILD);
1852 			if (unlikely(!inode))
1853 				return ERR_PTR(-ENOENT);
1854 		} else {
1855 			dput(nd->path.dentry);
1856 			if (nd->path.mnt != path.mnt)
1857 				mntput(nd->path.mnt);
1858 		}
1859 		nd->path = path;
1860 		nd->inode = inode;
1861 		nd->seq = nd->next_seq;
1862 		return NULL;
1863 	}
1864 	if (nd->flags & LOOKUP_RCU) {
1865 		/* make sure that d_is_symlink above matches inode */
1866 		if (read_seqcount_retry(&path.dentry->d_seq, nd->next_seq))
1867 			return ERR_PTR(-ECHILD);
1868 	} else {
1869 		if (path.mnt == nd->path.mnt)
1870 			mntget(path.mnt);
1871 	}
1872 	return pick_link(nd, &path, inode, flags);
1873 }
1874 
follow_dotdot_rcu(struct nameidata * nd)1875 static struct dentry *follow_dotdot_rcu(struct nameidata *nd)
1876 {
1877 	struct dentry *parent, *old;
1878 
1879 	if (path_equal(&nd->path, &nd->root))
1880 		goto in_root;
1881 	if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
1882 		struct path path;
1883 		unsigned seq;
1884 		if (!choose_mountpoint_rcu(real_mount(nd->path.mnt),
1885 					   &nd->root, &path, &seq))
1886 			goto in_root;
1887 		if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1888 			return ERR_PTR(-ECHILD);
1889 		nd->path = path;
1890 		nd->inode = path.dentry->d_inode;
1891 		nd->seq = seq;
1892 		// makes sure that non-RCU pathwalk could reach this state
1893 		if (read_seqretry(&mount_lock, nd->m_seq))
1894 			return ERR_PTR(-ECHILD);
1895 		/* we know that mountpoint was pinned */
1896 	}
1897 	old = nd->path.dentry;
1898 	parent = old->d_parent;
1899 	nd->next_seq = read_seqcount_begin(&parent->d_seq);
1900 	// makes sure that non-RCU pathwalk could reach this state
1901 	if (read_seqcount_retry(&old->d_seq, nd->seq))
1902 		return ERR_PTR(-ECHILD);
1903 	if (unlikely(!path_connected(nd->path.mnt, parent)))
1904 		return ERR_PTR(-ECHILD);
1905 	return parent;
1906 in_root:
1907 	if (read_seqretry(&mount_lock, nd->m_seq))
1908 		return ERR_PTR(-ECHILD);
1909 	if (unlikely(nd->flags & LOOKUP_BENEATH))
1910 		return ERR_PTR(-ECHILD);
1911 	nd->next_seq = nd->seq;
1912 	return nd->path.dentry;
1913 }
1914 
follow_dotdot(struct nameidata * nd)1915 static struct dentry *follow_dotdot(struct nameidata *nd)
1916 {
1917 	struct dentry *parent;
1918 
1919 	if (path_equal(&nd->path, &nd->root))
1920 		goto in_root;
1921 	if (unlikely(nd->path.dentry == nd->path.mnt->mnt_root)) {
1922 		struct path path;
1923 
1924 		if (!choose_mountpoint(real_mount(nd->path.mnt),
1925 				       &nd->root, &path))
1926 			goto in_root;
1927 		path_put(&nd->path);
1928 		nd->path = path;
1929 		nd->inode = path.dentry->d_inode;
1930 		if (unlikely(nd->flags & LOOKUP_NO_XDEV))
1931 			return ERR_PTR(-EXDEV);
1932 	}
1933 	/* rare case of legitimate dget_parent()... */
1934 	parent = dget_parent(nd->path.dentry);
1935 	if (unlikely(!path_connected(nd->path.mnt, parent))) {
1936 		dput(parent);
1937 		return ERR_PTR(-ENOENT);
1938 	}
1939 	return parent;
1940 
1941 in_root:
1942 	if (unlikely(nd->flags & LOOKUP_BENEATH))
1943 		return ERR_PTR(-EXDEV);
1944 	return dget(nd->path.dentry);
1945 }
1946 
handle_dots(struct nameidata * nd,int type)1947 static const char *handle_dots(struct nameidata *nd, int type)
1948 {
1949 	if (type == LAST_DOTDOT) {
1950 		const char *error = NULL;
1951 		struct dentry *parent;
1952 
1953 		if (!nd->root.mnt) {
1954 			error = ERR_PTR(set_root(nd));
1955 			if (error)
1956 				return error;
1957 		}
1958 		if (nd->flags & LOOKUP_RCU)
1959 			parent = follow_dotdot_rcu(nd);
1960 		else
1961 			parent = follow_dotdot(nd);
1962 		if (IS_ERR(parent))
1963 			return ERR_CAST(parent);
1964 		error = step_into(nd, WALK_NOFOLLOW, parent);
1965 		if (unlikely(error))
1966 			return error;
1967 
1968 		if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
1969 			/*
1970 			 * If there was a racing rename or mount along our
1971 			 * path, then we can't be sure that ".." hasn't jumped
1972 			 * above nd->root (and so userspace should retry or use
1973 			 * some fallback).
1974 			 */
1975 			smp_rmb();
1976 			if (__read_seqcount_retry(&mount_lock.seqcount, nd->m_seq))
1977 				return ERR_PTR(-EAGAIN);
1978 			if (__read_seqcount_retry(&rename_lock.seqcount, nd->r_seq))
1979 				return ERR_PTR(-EAGAIN);
1980 		}
1981 	}
1982 	return NULL;
1983 }
1984 
walk_component(struct nameidata * nd,int flags)1985 static const char *walk_component(struct nameidata *nd, int flags)
1986 {
1987 	struct dentry *dentry;
1988 	/*
1989 	 * "." and ".." are special - ".." especially so because it has
1990 	 * to be able to know about the current root directory and
1991 	 * parent relationships.
1992 	 */
1993 	if (unlikely(nd->last_type != LAST_NORM)) {
1994 		if (!(flags & WALK_MORE) && nd->depth)
1995 			put_link(nd);
1996 		return handle_dots(nd, nd->last_type);
1997 	}
1998 	dentry = lookup_fast(nd);
1999 	if (IS_ERR(dentry))
2000 		return ERR_CAST(dentry);
2001 	if (unlikely(!dentry)) {
2002 		dentry = lookup_slow(&nd->last, nd->path.dentry, nd->flags);
2003 		if (IS_ERR(dentry))
2004 			return ERR_CAST(dentry);
2005 	}
2006 	if (!(flags & WALK_MORE) && nd->depth)
2007 		put_link(nd);
2008 	return step_into(nd, flags, dentry);
2009 }
2010 
2011 /*
2012  * We can do the critical dentry name comparison and hashing
2013  * operations one word at a time, but we are limited to:
2014  *
2015  * - Architectures with fast unaligned word accesses. We could
2016  *   do a "get_unaligned()" if this helps and is sufficiently
2017  *   fast.
2018  *
2019  * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
2020  *   do not trap on the (extremely unlikely) case of a page
2021  *   crossing operation.
2022  *
2023  * - Furthermore, we need an efficient 64-bit compile for the
2024  *   64-bit case in order to generate the "number of bytes in
2025  *   the final mask". Again, that could be replaced with a
2026  *   efficient population count instruction or similar.
2027  */
2028 #ifdef CONFIG_DCACHE_WORD_ACCESS
2029 
2030 #include <asm/word-at-a-time.h>
2031 
2032 #ifdef HASH_MIX
2033 
2034 /* Architecture provides HASH_MIX and fold_hash() in <asm/hash.h> */
2035 
2036 #elif defined(CONFIG_64BIT)
2037 /*
2038  * Register pressure in the mixing function is an issue, particularly
2039  * on 32-bit x86, but almost any function requires one state value and
2040  * one temporary.  Instead, use a function designed for two state values
2041  * and no temporaries.
2042  *
2043  * This function cannot create a collision in only two iterations, so
2044  * we have two iterations to achieve avalanche.  In those two iterations,
2045  * we have six layers of mixing, which is enough to spread one bit's
2046  * influence out to 2^6 = 64 state bits.
2047  *
2048  * Rotate constants are scored by considering either 64 one-bit input
2049  * deltas or 64*63/2 = 2016 two-bit input deltas, and finding the
2050  * probability of that delta causing a change to each of the 128 output
2051  * bits, using a sample of random initial states.
2052  *
2053  * The Shannon entropy of the computed probabilities is then summed
2054  * to produce a score.  Ideally, any input change has a 50% chance of
2055  * toggling any given output bit.
2056  *
2057  * Mixing scores (in bits) for (12,45):
2058  * Input delta: 1-bit      2-bit
2059  * 1 round:     713.3    42542.6
2060  * 2 rounds:   2753.7   140389.8
2061  * 3 rounds:   5954.1   233458.2
2062  * 4 rounds:   7862.6   256672.2
2063  * Perfect:    8192     258048
2064  *            (64*128) (64*63/2 * 128)
2065  */
2066 #define HASH_MIX(x, y, a)	\
2067 	(	x ^= (a),	\
2068 	y ^= x,	x = rol64(x,12),\
2069 	x += y,	y = rol64(y,45),\
2070 	y *= 9			)
2071 
2072 /*
2073  * Fold two longs into one 32-bit hash value.  This must be fast, but
2074  * latency isn't quite as critical, as there is a fair bit of additional
2075  * work done before the hash value is used.
2076  */
fold_hash(unsigned long x,unsigned long y)2077 static inline unsigned int fold_hash(unsigned long x, unsigned long y)
2078 {
2079 	y ^= x * GOLDEN_RATIO_64;
2080 	y *= GOLDEN_RATIO_64;
2081 	return y >> 32;
2082 }
2083 
2084 #else	/* 32-bit case */
2085 
2086 /*
2087  * Mixing scores (in bits) for (7,20):
2088  * Input delta: 1-bit      2-bit
2089  * 1 round:     330.3     9201.6
2090  * 2 rounds:   1246.4    25475.4
2091  * 3 rounds:   1907.1    31295.1
2092  * 4 rounds:   2042.3    31718.6
2093  * Perfect:    2048      31744
2094  *            (32*64)   (32*31/2 * 64)
2095  */
2096 #define HASH_MIX(x, y, a)	\
2097 	(	x ^= (a),	\
2098 	y ^= x,	x = rol32(x, 7),\
2099 	x += y,	y = rol32(y,20),\
2100 	y *= 9			)
2101 
fold_hash(unsigned long x,unsigned long y)2102 static inline unsigned int fold_hash(unsigned long x, unsigned long y)
2103 {
2104 	/* Use arch-optimized multiply if one exists */
2105 	return __hash_32(y ^ __hash_32(x));
2106 }
2107 
2108 #endif
2109 
2110 /*
2111  * Return the hash of a string of known length.  This is carfully
2112  * designed to match hash_name(), which is the more critical function.
2113  * In particular, we must end by hashing a final word containing 0..7
2114  * payload bytes, to match the way that hash_name() iterates until it
2115  * finds the delimiter after the name.
2116  */
full_name_hash(const void * salt,const char * name,unsigned int len)2117 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2118 {
2119 	unsigned long a, x = 0, y = (unsigned long)salt;
2120 
2121 	for (;;) {
2122 		if (!len)
2123 			goto done;
2124 		a = load_unaligned_zeropad(name);
2125 		if (len < sizeof(unsigned long))
2126 			break;
2127 		HASH_MIX(x, y, a);
2128 		name += sizeof(unsigned long);
2129 		len -= sizeof(unsigned long);
2130 	}
2131 	x ^= a & bytemask_from_count(len);
2132 done:
2133 	return fold_hash(x, y);
2134 }
2135 EXPORT_SYMBOL(full_name_hash);
2136 
2137 /* Return the "hash_len" (hash and length) of a null-terminated string */
hashlen_string(const void * salt,const char * name)2138 u64 hashlen_string(const void *salt, const char *name)
2139 {
2140 	unsigned long a = 0, x = 0, y = (unsigned long)salt;
2141 	unsigned long adata, mask, len;
2142 	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
2143 
2144 	len = 0;
2145 	goto inside;
2146 
2147 	do {
2148 		HASH_MIX(x, y, a);
2149 		len += sizeof(unsigned long);
2150 inside:
2151 		a = load_unaligned_zeropad(name+len);
2152 	} while (!has_zero(a, &adata, &constants));
2153 
2154 	adata = prep_zero_mask(a, adata, &constants);
2155 	mask = create_zero_mask(adata);
2156 	x ^= a & zero_bytemask(mask);
2157 
2158 	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2159 }
2160 EXPORT_SYMBOL(hashlen_string);
2161 
2162 /*
2163  * Calculate the length and hash of the path component, and
2164  * return the "hash_len" as the result.
2165  */
hash_name(const void * salt,const char * name)2166 static inline u64 hash_name(const void *salt, const char *name)
2167 {
2168 	unsigned long a = 0, b, x = 0, y = (unsigned long)salt;
2169 	unsigned long adata, bdata, mask, len;
2170 	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
2171 
2172 	len = 0;
2173 	goto inside;
2174 
2175 	do {
2176 		HASH_MIX(x, y, a);
2177 		len += sizeof(unsigned long);
2178 inside:
2179 		a = load_unaligned_zeropad(name+len);
2180 		b = a ^ REPEAT_BYTE('/');
2181 	} while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
2182 
2183 	adata = prep_zero_mask(a, adata, &constants);
2184 	bdata = prep_zero_mask(b, bdata, &constants);
2185 	mask = create_zero_mask(adata | bdata);
2186 	x ^= a & zero_bytemask(mask);
2187 
2188 	return hashlen_create(fold_hash(x, y), len + find_zero(mask));
2189 }
2190 
2191 #else	/* !CONFIG_DCACHE_WORD_ACCESS: Slow, byte-at-a-time version */
2192 
2193 /* Return the hash of a string of known length */
full_name_hash(const void * salt,const char * name,unsigned int len)2194 unsigned int full_name_hash(const void *salt, const char *name, unsigned int len)
2195 {
2196 	unsigned long hash = init_name_hash(salt);
2197 	while (len--)
2198 		hash = partial_name_hash((unsigned char)*name++, hash);
2199 	return end_name_hash(hash);
2200 }
2201 EXPORT_SYMBOL(full_name_hash);
2202 
2203 /* Return the "hash_len" (hash and length) of a null-terminated string */
hashlen_string(const void * salt,const char * name)2204 u64 hashlen_string(const void *salt, const char *name)
2205 {
2206 	unsigned long hash = init_name_hash(salt);
2207 	unsigned long len = 0, c;
2208 
2209 	c = (unsigned char)*name;
2210 	while (c) {
2211 		len++;
2212 		hash = partial_name_hash(c, hash);
2213 		c = (unsigned char)name[len];
2214 	}
2215 	return hashlen_create(end_name_hash(hash), len);
2216 }
2217 EXPORT_SYMBOL(hashlen_string);
2218 
2219 /*
2220  * We know there's a real path component here of at least
2221  * one character.
2222  */
hash_name(const void * salt,const char * name)2223 static inline u64 hash_name(const void *salt, const char *name)
2224 {
2225 	unsigned long hash = init_name_hash(salt);
2226 	unsigned long len = 0, c;
2227 
2228 	c = (unsigned char)*name;
2229 	do {
2230 		len++;
2231 		hash = partial_name_hash(c, hash);
2232 		c = (unsigned char)name[len];
2233 	} while (c && c != '/');
2234 	return hashlen_create(end_name_hash(hash), len);
2235 }
2236 
2237 #endif
2238 
2239 /*
2240  * Name resolution.
2241  * This is the basic name resolution function, turning a pathname into
2242  * the final dentry. We expect 'base' to be positive and a directory.
2243  *
2244  * Returns 0 and nd will have valid dentry and mnt on success.
2245  * Returns error and drops reference to input namei data on failure.
2246  */
link_path_walk(const char * name,struct nameidata * nd)2247 static int link_path_walk(const char *name, struct nameidata *nd)
2248 {
2249 	int depth = 0; // depth <= nd->depth
2250 	int err;
2251 
2252 	nd->last_type = LAST_ROOT;
2253 	nd->flags |= LOOKUP_PARENT;
2254 	if (IS_ERR(name))
2255 		return PTR_ERR(name);
2256 	while (*name=='/')
2257 		name++;
2258 	if (!*name) {
2259 		nd->dir_mode = 0; // short-circuit the 'hardening' idiocy
2260 		return 0;
2261 	}
2262 
2263 	/* At this point we know we have a real path component. */
2264 	for(;;) {
2265 		struct mnt_idmap *idmap;
2266 		const char *link;
2267 		u64 hash_len;
2268 		int type;
2269 
2270 		idmap = mnt_idmap(nd->path.mnt);
2271 		err = may_lookup(idmap, nd);
2272 		if (err)
2273 			return err;
2274 
2275 		hash_len = hash_name(nd->path.dentry, name);
2276 
2277 		type = LAST_NORM;
2278 		if (name[0] == '.') switch (hashlen_len(hash_len)) {
2279 			case 2:
2280 				if (name[1] == '.') {
2281 					type = LAST_DOTDOT;
2282 					nd->state |= ND_JUMPED;
2283 				}
2284 				break;
2285 			case 1:
2286 				type = LAST_DOT;
2287 		}
2288 		if (likely(type == LAST_NORM)) {
2289 			struct dentry *parent = nd->path.dentry;
2290 			nd->state &= ~ND_JUMPED;
2291 			if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
2292 				struct qstr this = { { .hash_len = hash_len }, .name = name };
2293 				err = parent->d_op->d_hash(parent, &this);
2294 				if (err < 0)
2295 					return err;
2296 				hash_len = this.hash_len;
2297 				name = this.name;
2298 			}
2299 		}
2300 
2301 		nd->last.hash_len = hash_len;
2302 		nd->last.name = name;
2303 		nd->last_type = type;
2304 
2305 		name += hashlen_len(hash_len);
2306 		if (!*name)
2307 			goto OK;
2308 		/*
2309 		 * If it wasn't NUL, we know it was '/'. Skip that
2310 		 * slash, and continue until no more slashes.
2311 		 */
2312 		do {
2313 			name++;
2314 		} while (unlikely(*name == '/'));
2315 		if (unlikely(!*name)) {
2316 OK:
2317 			/* pathname or trailing symlink, done */
2318 			if (!depth) {
2319 				nd->dir_vfsuid = i_uid_into_vfsuid(idmap, nd->inode);
2320 				nd->dir_mode = nd->inode->i_mode;
2321 				nd->flags &= ~LOOKUP_PARENT;
2322 				return 0;
2323 			}
2324 			/* last component of nested symlink */
2325 			name = nd->stack[--depth].name;
2326 			link = walk_component(nd, 0);
2327 		} else {
2328 			/* not the last component */
2329 			link = walk_component(nd, WALK_MORE);
2330 		}
2331 		if (unlikely(link)) {
2332 			if (IS_ERR(link))
2333 				return PTR_ERR(link);
2334 			/* a symlink to follow */
2335 			nd->stack[depth++].name = name;
2336 			name = link;
2337 			continue;
2338 		}
2339 		if (unlikely(!d_can_lookup(nd->path.dentry))) {
2340 			if (nd->flags & LOOKUP_RCU) {
2341 				if (!try_to_unlazy(nd))
2342 					return -ECHILD;
2343 			}
2344 			return -ENOTDIR;
2345 		}
2346 	}
2347 }
2348 
2349 /* must be paired with terminate_walk() */
path_init(struct nameidata * nd,unsigned flags)2350 static const char *path_init(struct nameidata *nd, unsigned flags)
2351 {
2352 	int error;
2353 	const char *s = nd->name->name;
2354 
2355 	/* LOOKUP_CACHED requires RCU, ask caller to retry */
2356 	if ((flags & (LOOKUP_RCU | LOOKUP_CACHED)) == LOOKUP_CACHED)
2357 		return ERR_PTR(-EAGAIN);
2358 
2359 	if (!*s)
2360 		flags &= ~LOOKUP_RCU;
2361 	if (flags & LOOKUP_RCU)
2362 		rcu_read_lock();
2363 	else
2364 		nd->seq = nd->next_seq = 0;
2365 
2366 	nd->flags = flags;
2367 	nd->state |= ND_JUMPED;
2368 
2369 	nd->m_seq = __read_seqcount_begin(&mount_lock.seqcount);
2370 	nd->r_seq = __read_seqcount_begin(&rename_lock.seqcount);
2371 	smp_rmb();
2372 
2373 	if (nd->state & ND_ROOT_PRESET) {
2374 		struct dentry *root = nd->root.dentry;
2375 		struct inode *inode = root->d_inode;
2376 		if (*s && unlikely(!d_can_lookup(root)))
2377 			return ERR_PTR(-ENOTDIR);
2378 		nd->path = nd->root;
2379 		nd->inode = inode;
2380 		if (flags & LOOKUP_RCU) {
2381 			nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2382 			nd->root_seq = nd->seq;
2383 		} else {
2384 			path_get(&nd->path);
2385 		}
2386 		return s;
2387 	}
2388 
2389 	nd->root.mnt = NULL;
2390 
2391 	/* Absolute pathname -- fetch the root (LOOKUP_IN_ROOT uses nd->dfd). */
2392 	if (*s == '/' && !(flags & LOOKUP_IN_ROOT)) {
2393 		error = nd_jump_root(nd);
2394 		if (unlikely(error))
2395 			return ERR_PTR(error);
2396 		return s;
2397 	}
2398 
2399 	/* Relative pathname -- get the starting-point it is relative to. */
2400 	if (nd->dfd == AT_FDCWD) {
2401 		if (flags & LOOKUP_RCU) {
2402 			struct fs_struct *fs = current->fs;
2403 			unsigned seq;
2404 
2405 			do {
2406 				seq = read_seqcount_begin(&fs->seq);
2407 				nd->path = fs->pwd;
2408 				nd->inode = nd->path.dentry->d_inode;
2409 				nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
2410 			} while (read_seqcount_retry(&fs->seq, seq));
2411 		} else {
2412 			get_fs_pwd(current->fs, &nd->path);
2413 			nd->inode = nd->path.dentry->d_inode;
2414 		}
2415 	} else {
2416 		/* Caller must check execute permissions on the starting path component */
2417 		struct fd f = fdget_raw(nd->dfd);
2418 		struct dentry *dentry;
2419 
2420 		if (!f.file)
2421 			return ERR_PTR(-EBADF);
2422 
2423 		dentry = f.file->f_path.dentry;
2424 
2425 		if (*s && unlikely(!d_can_lookup(dentry))) {
2426 			fdput(f);
2427 			return ERR_PTR(-ENOTDIR);
2428 		}
2429 
2430 		nd->path = f.file->f_path;
2431 		if (flags & LOOKUP_RCU) {
2432 			nd->inode = nd->path.dentry->d_inode;
2433 			nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
2434 		} else {
2435 			path_get(&nd->path);
2436 			nd->inode = nd->path.dentry->d_inode;
2437 		}
2438 		fdput(f);
2439 	}
2440 
2441 	/* For scoped-lookups we need to set the root to the dirfd as well. */
2442 	if (flags & LOOKUP_IS_SCOPED) {
2443 		nd->root = nd->path;
2444 		if (flags & LOOKUP_RCU) {
2445 			nd->root_seq = nd->seq;
2446 		} else {
2447 			path_get(&nd->root);
2448 			nd->state |= ND_ROOT_GRABBED;
2449 		}
2450 	}
2451 	return s;
2452 }
2453 
lookup_last(struct nameidata * nd)2454 static inline const char *lookup_last(struct nameidata *nd)
2455 {
2456 	if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
2457 		nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2458 
2459 	return walk_component(nd, WALK_TRAILING);
2460 }
2461 
handle_lookup_down(struct nameidata * nd)2462 static int handle_lookup_down(struct nameidata *nd)
2463 {
2464 	if (!(nd->flags & LOOKUP_RCU))
2465 		dget(nd->path.dentry);
2466 	nd->next_seq = nd->seq;
2467 	return PTR_ERR(step_into(nd, WALK_NOFOLLOW, nd->path.dentry));
2468 }
2469 
2470 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
path_lookupat(struct nameidata * nd,unsigned flags,struct path * path)2471 static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2472 {
2473 	const char *s = path_init(nd, flags);
2474 	int err;
2475 
2476 	if (unlikely(flags & LOOKUP_DOWN) && !IS_ERR(s)) {
2477 		err = handle_lookup_down(nd);
2478 		if (unlikely(err < 0))
2479 			s = ERR_PTR(err);
2480 	}
2481 
2482 	while (!(err = link_path_walk(s, nd)) &&
2483 	       (s = lookup_last(nd)) != NULL)
2484 		;
2485 	if (!err && unlikely(nd->flags & LOOKUP_MOUNTPOINT)) {
2486 		err = handle_lookup_down(nd);
2487 		nd->state &= ~ND_JUMPED; // no d_weak_revalidate(), please...
2488 	}
2489 	if (!err)
2490 		err = complete_walk(nd);
2491 
2492 	if (!err && nd->flags & LOOKUP_DIRECTORY)
2493 		if (!d_can_lookup(nd->path.dentry))
2494 			err = -ENOTDIR;
2495 	if (!err) {
2496 		*path = nd->path;
2497 		nd->path.mnt = NULL;
2498 		nd->path.dentry = NULL;
2499 	}
2500 	terminate_walk(nd);
2501 	return err;
2502 }
2503 
filename_lookup(int dfd,struct filename * name,unsigned flags,struct path * path,struct path * root)2504 int filename_lookup(int dfd, struct filename *name, unsigned flags,
2505 		    struct path *path, struct path *root)
2506 {
2507 	int retval;
2508 	struct nameidata nd;
2509 	if (IS_ERR(name))
2510 		return PTR_ERR(name);
2511 	set_nameidata(&nd, dfd, name, root);
2512 	retval = path_lookupat(&nd, flags | LOOKUP_RCU, path);
2513 	if (unlikely(retval == -ECHILD))
2514 		retval = path_lookupat(&nd, flags, path);
2515 	if (unlikely(retval == -ESTALE))
2516 		retval = path_lookupat(&nd, flags | LOOKUP_REVAL, path);
2517 
2518 	if (likely(!retval))
2519 		audit_inode(name, path->dentry,
2520 			    flags & LOOKUP_MOUNTPOINT ? AUDIT_INODE_NOEVAL : 0);
2521 	restore_nameidata();
2522 	return retval;
2523 }
2524 
2525 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
path_parentat(struct nameidata * nd,unsigned flags,struct path * parent)2526 static int path_parentat(struct nameidata *nd, unsigned flags,
2527 				struct path *parent)
2528 {
2529 	const char *s = path_init(nd, flags);
2530 	int err = link_path_walk(s, nd);
2531 	if (!err)
2532 		err = complete_walk(nd);
2533 	if (!err) {
2534 		*parent = nd->path;
2535 		nd->path.mnt = NULL;
2536 		nd->path.dentry = NULL;
2537 	}
2538 	terminate_walk(nd);
2539 	return err;
2540 }
2541 
2542 /* Note: this does not consume "name" */
__filename_parentat(int dfd,struct filename * name,unsigned int flags,struct path * parent,struct qstr * last,int * type,const struct path * root)2543 static int __filename_parentat(int dfd, struct filename *name,
2544 			       unsigned int flags, struct path *parent,
2545 			       struct qstr *last, int *type,
2546 			       const struct path *root)
2547 {
2548 	int retval;
2549 	struct nameidata nd;
2550 
2551 	if (IS_ERR(name))
2552 		return PTR_ERR(name);
2553 	set_nameidata(&nd, dfd, name, root);
2554 	retval = path_parentat(&nd, flags | LOOKUP_RCU, parent);
2555 	if (unlikely(retval == -ECHILD))
2556 		retval = path_parentat(&nd, flags, parent);
2557 	if (unlikely(retval == -ESTALE))
2558 		retval = path_parentat(&nd, flags | LOOKUP_REVAL, parent);
2559 	if (likely(!retval)) {
2560 		*last = nd.last;
2561 		*type = nd.last_type;
2562 		audit_inode(name, parent->dentry, AUDIT_INODE_PARENT);
2563 	}
2564 	restore_nameidata();
2565 	return retval;
2566 }
2567 
filename_parentat(int dfd,struct filename * name,unsigned int flags,struct path * parent,struct qstr * last,int * type)2568 static int filename_parentat(int dfd, struct filename *name,
2569 			     unsigned int flags, struct path *parent,
2570 			     struct qstr *last, int *type)
2571 {
2572 	return __filename_parentat(dfd, name, flags, parent, last, type, NULL);
2573 }
2574 
2575 /* does lookup, returns the object with parent locked */
__kern_path_locked(struct filename * name,struct path * path)2576 static struct dentry *__kern_path_locked(struct filename *name, struct path *path)
2577 {
2578 	struct dentry *d;
2579 	struct qstr last;
2580 	int type, error;
2581 
2582 	error = filename_parentat(AT_FDCWD, name, 0, path, &last, &type);
2583 	if (error)
2584 		return ERR_PTR(error);
2585 	if (unlikely(type != LAST_NORM)) {
2586 		path_put(path);
2587 		return ERR_PTR(-EINVAL);
2588 	}
2589 	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
2590 	d = lookup_one_qstr_excl(&last, path->dentry, 0);
2591 	if (IS_ERR(d)) {
2592 		inode_unlock(path->dentry->d_inode);
2593 		path_put(path);
2594 	}
2595 	return d;
2596 }
2597 
kern_path_locked(const char * name,struct path * path)2598 struct dentry *kern_path_locked(const char *name, struct path *path)
2599 {
2600 	struct filename *filename = getname_kernel(name);
2601 	struct dentry *res = __kern_path_locked(filename, path);
2602 
2603 	putname(filename);
2604 	return res;
2605 }
2606 
kern_path(const char * name,unsigned int flags,struct path * path)2607 int kern_path(const char *name, unsigned int flags, struct path *path)
2608 {
2609 	struct filename *filename = getname_kernel(name);
2610 	int ret = filename_lookup(AT_FDCWD, filename, flags, path, NULL);
2611 
2612 	putname(filename);
2613 	return ret;
2614 
2615 }
2616 EXPORT_SYMBOL(kern_path);
2617 
2618 /**
2619  * vfs_path_parent_lookup - lookup a parent path relative to a dentry-vfsmount pair
2620  * @filename: filename structure
2621  * @flags: lookup flags
2622  * @parent: pointer to struct path to fill
2623  * @last: last component
2624  * @type: type of the last component
2625  * @root: pointer to struct path of the base directory
2626  */
vfs_path_parent_lookup(struct filename * filename,unsigned int flags,struct path * parent,struct qstr * last,int * type,const struct path * root)2627 int vfs_path_parent_lookup(struct filename *filename, unsigned int flags,
2628 			   struct path *parent, struct qstr *last, int *type,
2629 			   const struct path *root)
2630 {
2631 	return  __filename_parentat(AT_FDCWD, filename, flags, parent, last,
2632 				    type, root);
2633 }
2634 EXPORT_SYMBOL(vfs_path_parent_lookup);
2635 
2636 /**
2637  * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
2638  * @dentry:  pointer to dentry of the base directory
2639  * @mnt: pointer to vfs mount of the base directory
2640  * @name: pointer to file name
2641  * @flags: lookup flags
2642  * @path: pointer to struct path to fill
2643  */
vfs_path_lookup(struct dentry * dentry,struct vfsmount * mnt,const char * name,unsigned int flags,struct path * path)2644 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
2645 		    const char *name, unsigned int flags,
2646 		    struct path *path)
2647 {
2648 	struct filename *filename;
2649 	struct path root = {.mnt = mnt, .dentry = dentry};
2650 	int ret;
2651 
2652 	filename = getname_kernel(name);
2653 	/* the first argument of filename_lookup() is ignored with root */
2654 	ret = filename_lookup(AT_FDCWD, filename, flags, path, &root);
2655 	putname(filename);
2656 	return ret;
2657 }
2658 EXPORT_SYMBOL(vfs_path_lookup);
2659 
lookup_one_common(struct mnt_idmap * idmap,const char * name,struct dentry * base,int len,struct qstr * this)2660 static int lookup_one_common(struct mnt_idmap *idmap,
2661 			     const char *name, struct dentry *base, int len,
2662 			     struct qstr *this)
2663 {
2664 	this->name = name;
2665 	this->len = len;
2666 	this->hash = full_name_hash(base, name, len);
2667 	if (!len)
2668 		return -EACCES;
2669 
2670 	if (unlikely(name[0] == '.')) {
2671 		if (len < 2 || (len == 2 && name[1] == '.'))
2672 			return -EACCES;
2673 	}
2674 
2675 	while (len--) {
2676 		unsigned int c = *(const unsigned char *)name++;
2677 		if (c == '/' || c == '\0')
2678 			return -EACCES;
2679 	}
2680 	/*
2681 	 * See if the low-level filesystem might want
2682 	 * to use its own hash..
2683 	 */
2684 	if (base->d_flags & DCACHE_OP_HASH) {
2685 		int err = base->d_op->d_hash(base, this);
2686 		if (err < 0)
2687 			return err;
2688 	}
2689 
2690 	return inode_permission(idmap, base->d_inode, MAY_EXEC);
2691 }
2692 
2693 /**
2694  * try_lookup_one_len - filesystem helper to lookup single pathname component
2695  * @name:	pathname component to lookup
2696  * @base:	base directory to lookup from
2697  * @len:	maximum length @len should be interpreted to
2698  *
2699  * Look up a dentry by name in the dcache, returning NULL if it does not
2700  * currently exist.  The function does not try to create a dentry.
2701  *
2702  * Note that this routine is purely a helper for filesystem usage and should
2703  * not be called by generic code.
2704  *
2705  * The caller must hold base->i_mutex.
2706  */
try_lookup_one_len(const char * name,struct dentry * base,int len)2707 struct dentry *try_lookup_one_len(const char *name, struct dentry *base, int len)
2708 {
2709 	struct qstr this;
2710 	int err;
2711 
2712 	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2713 
2714 	err = lookup_one_common(&nop_mnt_idmap, name, base, len, &this);
2715 	if (err)
2716 		return ERR_PTR(err);
2717 
2718 	return lookup_dcache(&this, base, 0);
2719 }
2720 EXPORT_SYMBOL(try_lookup_one_len);
2721 
2722 /**
2723  * lookup_one_len - filesystem helper to lookup single pathname component
2724  * @name:	pathname component to lookup
2725  * @base:	base directory to lookup from
2726  * @len:	maximum length @len should be interpreted to
2727  *
2728  * Note that this routine is purely a helper for filesystem usage and should
2729  * not be called by generic code.
2730  *
2731  * The caller must hold base->i_mutex.
2732  */
lookup_one_len(const char * name,struct dentry * base,int len)2733 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
2734 {
2735 	struct dentry *dentry;
2736 	struct qstr this;
2737 	int err;
2738 
2739 	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2740 
2741 	err = lookup_one_common(&nop_mnt_idmap, name, base, len, &this);
2742 	if (err)
2743 		return ERR_PTR(err);
2744 
2745 	dentry = lookup_dcache(&this, base, 0);
2746 	return dentry ? dentry : __lookup_slow(&this, base, 0);
2747 }
2748 EXPORT_SYMBOL(lookup_one_len);
2749 
2750 /**
2751  * lookup_one - filesystem helper to lookup single pathname component
2752  * @idmap:	idmap of the mount the lookup is performed from
2753  * @name:	pathname component to lookup
2754  * @base:	base directory to lookup from
2755  * @len:	maximum length @len should be interpreted to
2756  *
2757  * Note that this routine is purely a helper for filesystem usage and should
2758  * not be called by generic code.
2759  *
2760  * The caller must hold base->i_mutex.
2761  */
lookup_one(struct mnt_idmap * idmap,const char * name,struct dentry * base,int len)2762 struct dentry *lookup_one(struct mnt_idmap *idmap, const char *name,
2763 			  struct dentry *base, int len)
2764 {
2765 	struct dentry *dentry;
2766 	struct qstr this;
2767 	int err;
2768 
2769 	WARN_ON_ONCE(!inode_is_locked(base->d_inode));
2770 
2771 	err = lookup_one_common(idmap, name, base, len, &this);
2772 	if (err)
2773 		return ERR_PTR(err);
2774 
2775 	dentry = lookup_dcache(&this, base, 0);
2776 	return dentry ? dentry : __lookup_slow(&this, base, 0);
2777 }
2778 EXPORT_SYMBOL(lookup_one);
2779 
2780 /**
2781  * lookup_one_unlocked - filesystem helper to lookup single pathname component
2782  * @idmap:	idmap of the mount the lookup is performed from
2783  * @name:	pathname component to lookup
2784  * @base:	base directory to lookup from
2785  * @len:	maximum length @len should be interpreted to
2786  *
2787  * Note that this routine is purely a helper for filesystem usage and should
2788  * not be called by generic code.
2789  *
2790  * Unlike lookup_one_len, it should be called without the parent
2791  * i_mutex held, and will take the i_mutex itself if necessary.
2792  */
lookup_one_unlocked(struct mnt_idmap * idmap,const char * name,struct dentry * base,int len)2793 struct dentry *lookup_one_unlocked(struct mnt_idmap *idmap,
2794 				   const char *name, struct dentry *base,
2795 				   int len)
2796 {
2797 	struct qstr this;
2798 	int err;
2799 	struct dentry *ret;
2800 
2801 	err = lookup_one_common(idmap, name, base, len, &this);
2802 	if (err)
2803 		return ERR_PTR(err);
2804 
2805 	ret = lookup_dcache(&this, base, 0);
2806 	if (!ret)
2807 		ret = lookup_slow(&this, base, 0);
2808 	return ret;
2809 }
2810 EXPORT_SYMBOL(lookup_one_unlocked);
2811 
2812 /**
2813  * lookup_one_positive_unlocked - filesystem helper to lookup single
2814  *				  pathname component
2815  * @idmap:	idmap of the mount the lookup is performed from
2816  * @name:	pathname component to lookup
2817  * @base:	base directory to lookup from
2818  * @len:	maximum length @len should be interpreted to
2819  *
2820  * This helper will yield ERR_PTR(-ENOENT) on negatives. The helper returns
2821  * known positive or ERR_PTR(). This is what most of the users want.
2822  *
2823  * Note that pinned negative with unlocked parent _can_ become positive at any
2824  * time, so callers of lookup_one_unlocked() need to be very careful; pinned
2825  * positives have >d_inode stable, so this one avoids such problems.
2826  *
2827  * Note that this routine is purely a helper for filesystem usage and should
2828  * not be called by generic code.
2829  *
2830  * The helper should be called without i_mutex held.
2831  */
lookup_one_positive_unlocked(struct mnt_idmap * idmap,const char * name,struct dentry * base,int len)2832 struct dentry *lookup_one_positive_unlocked(struct mnt_idmap *idmap,
2833 					    const char *name,
2834 					    struct dentry *base, int len)
2835 {
2836 	struct dentry *ret = lookup_one_unlocked(idmap, name, base, len);
2837 
2838 	if (!IS_ERR(ret) && d_flags_negative(smp_load_acquire(&ret->d_flags))) {
2839 		dput(ret);
2840 		ret = ERR_PTR(-ENOENT);
2841 	}
2842 	return ret;
2843 }
2844 EXPORT_SYMBOL(lookup_one_positive_unlocked);
2845 
2846 /**
2847  * lookup_one_len_unlocked - filesystem helper to lookup single pathname component
2848  * @name:	pathname component to lookup
2849  * @base:	base directory to lookup from
2850  * @len:	maximum length @len should be interpreted to
2851  *
2852  * Note that this routine is purely a helper for filesystem usage and should
2853  * not be called by generic code.
2854  *
2855  * Unlike lookup_one_len, it should be called without the parent
2856  * i_mutex held, and will take the i_mutex itself if necessary.
2857  */
lookup_one_len_unlocked(const char * name,struct dentry * base,int len)2858 struct dentry *lookup_one_len_unlocked(const char *name,
2859 				       struct dentry *base, int len)
2860 {
2861 	return lookup_one_unlocked(&nop_mnt_idmap, name, base, len);
2862 }
2863 EXPORT_SYMBOL(lookup_one_len_unlocked);
2864 
2865 /*
2866  * Like lookup_one_len_unlocked(), except that it yields ERR_PTR(-ENOENT)
2867  * on negatives.  Returns known positive or ERR_PTR(); that's what
2868  * most of the users want.  Note that pinned negative with unlocked parent
2869  * _can_ become positive at any time, so callers of lookup_one_len_unlocked()
2870  * need to be very careful; pinned positives have ->d_inode stable, so
2871  * this one avoids such problems.
2872  */
lookup_positive_unlocked(const char * name,struct dentry * base,int len)2873 struct dentry *lookup_positive_unlocked(const char *name,
2874 				       struct dentry *base, int len)
2875 {
2876 	return lookup_one_positive_unlocked(&nop_mnt_idmap, name, base, len);
2877 }
2878 EXPORT_SYMBOL(lookup_positive_unlocked);
2879 
2880 #ifdef CONFIG_UNIX98_PTYS
path_pts(struct path * path)2881 int path_pts(struct path *path)
2882 {
2883 	/* Find something mounted on "pts" in the same directory as
2884 	 * the input path.
2885 	 */
2886 	struct dentry *parent = dget_parent(path->dentry);
2887 	struct dentry *child;
2888 	struct qstr this = QSTR_INIT("pts", 3);
2889 
2890 	if (unlikely(!path_connected(path->mnt, parent))) {
2891 		dput(parent);
2892 		return -ENOENT;
2893 	}
2894 	dput(path->dentry);
2895 	path->dentry = parent;
2896 	child = d_hash_and_lookup(parent, &this);
2897 	if (IS_ERR_OR_NULL(child))
2898 		return -ENOENT;
2899 
2900 	path->dentry = child;
2901 	dput(parent);
2902 	follow_down(path, 0);
2903 	return 0;
2904 }
2905 #endif
2906 
user_path_at_empty(int dfd,const char __user * name,unsigned flags,struct path * path,int * empty)2907 int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
2908 		 struct path *path, int *empty)
2909 {
2910 	struct filename *filename = getname_flags(name, flags, empty);
2911 	int ret = filename_lookup(dfd, filename, flags, path, NULL);
2912 
2913 	putname(filename);
2914 	return ret;
2915 }
2916 EXPORT_SYMBOL(user_path_at_empty);
2917 
__check_sticky(struct mnt_idmap * idmap,struct inode * dir,struct inode * inode)2918 int __check_sticky(struct mnt_idmap *idmap, struct inode *dir,
2919 		   struct inode *inode)
2920 {
2921 	kuid_t fsuid = current_fsuid();
2922 
2923 	if (vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), fsuid))
2924 		return 0;
2925 	if (vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, dir), fsuid))
2926 		return 0;
2927 	return !capable_wrt_inode_uidgid(idmap, inode, CAP_FOWNER);
2928 }
2929 EXPORT_SYMBOL(__check_sticky);
2930 
2931 /*
2932  *	Check whether we can remove a link victim from directory dir, check
2933  *  whether the type of victim is right.
2934  *  1. We can't do it if dir is read-only (done in permission())
2935  *  2. We should have write and exec permissions on dir
2936  *  3. We can't remove anything from append-only dir
2937  *  4. We can't do anything with immutable dir (done in permission())
2938  *  5. If the sticky bit on dir is set we should either
2939  *	a. be owner of dir, or
2940  *	b. be owner of victim, or
2941  *	c. have CAP_FOWNER capability
2942  *  6. If the victim is append-only or immutable we can't do antyhing with
2943  *     links pointing to it.
2944  *  7. If the victim has an unknown uid or gid we can't change the inode.
2945  *  8. If we were asked to remove a directory and victim isn't one - ENOTDIR.
2946  *  9. If we were asked to remove a non-directory and victim isn't one - EISDIR.
2947  * 10. We can't remove a root or mountpoint.
2948  * 11. We don't allow removal of NFS sillyrenamed files; it's handled by
2949  *     nfs_async_unlink().
2950  */
may_delete(struct mnt_idmap * idmap,struct inode * dir,struct dentry * victim,bool isdir)2951 static int may_delete(struct mnt_idmap *idmap, struct inode *dir,
2952 		      struct dentry *victim, bool isdir)
2953 {
2954 	struct inode *inode = d_backing_inode(victim);
2955 	int error;
2956 
2957 	if (d_is_negative(victim))
2958 		return -ENOENT;
2959 	BUG_ON(!inode);
2960 
2961 	BUG_ON(victim->d_parent->d_inode != dir);
2962 
2963 	/* Inode writeback is not safe when the uid or gid are invalid. */
2964 	if (!vfsuid_valid(i_uid_into_vfsuid(idmap, inode)) ||
2965 	    !vfsgid_valid(i_gid_into_vfsgid(idmap, inode)))
2966 		return -EOVERFLOW;
2967 
2968 	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2969 
2970 	error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC);
2971 	if (error)
2972 		return error;
2973 	if (IS_APPEND(dir))
2974 		return -EPERM;
2975 
2976 	if (check_sticky(idmap, dir, inode) || IS_APPEND(inode) ||
2977 	    IS_IMMUTABLE(inode) || IS_SWAPFILE(inode) ||
2978 	    HAS_UNMAPPED_ID(idmap, inode))
2979 		return -EPERM;
2980 	if (isdir) {
2981 		if (!d_is_dir(victim))
2982 			return -ENOTDIR;
2983 		if (IS_ROOT(victim))
2984 			return -EBUSY;
2985 	} else if (d_is_dir(victim))
2986 		return -EISDIR;
2987 	if (IS_DEADDIR(dir))
2988 		return -ENOENT;
2989 	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
2990 		return -EBUSY;
2991 	return 0;
2992 }
2993 
2994 /*	Check whether we can create an object with dentry child in directory
2995  *  dir.
2996  *  1. We can't do it if child already exists (open has special treatment for
2997  *     this case, but since we are inlined it's OK)
2998  *  2. We can't do it if dir is read-only (done in permission())
2999  *  3. We can't do it if the fs can't represent the fsuid or fsgid.
3000  *  4. We should have write and exec permissions on dir
3001  *  5. We can't do it if dir is immutable (done in permission())
3002  */
may_create(struct mnt_idmap * idmap,struct inode * dir,struct dentry * child)3003 static inline int may_create(struct mnt_idmap *idmap,
3004 			     struct inode *dir, struct dentry *child)
3005 {
3006 	audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
3007 	if (child->d_inode)
3008 		return -EEXIST;
3009 	if (IS_DEADDIR(dir))
3010 		return -ENOENT;
3011 	if (!fsuidgid_has_mapping(dir->i_sb, idmap))
3012 		return -EOVERFLOW;
3013 
3014 	return inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC);
3015 }
3016 
lock_two_directories(struct dentry * p1,struct dentry * p2)3017 static struct dentry *lock_two_directories(struct dentry *p1, struct dentry *p2)
3018 {
3019 	struct dentry *p;
3020 
3021 	p = d_ancestor(p2, p1);
3022 	if (p) {
3023 		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
3024 		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT2);
3025 		return p;
3026 	}
3027 
3028 	p = d_ancestor(p1, p2);
3029 	inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
3030 	inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
3031 	return p;
3032 }
3033 
3034 /*
3035  * p1 and p2 should be directories on the same fs.
3036  */
lock_rename(struct dentry * p1,struct dentry * p2)3037 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
3038 {
3039 	if (p1 == p2) {
3040 		inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
3041 		return NULL;
3042 	}
3043 
3044 	mutex_lock(&p1->d_sb->s_vfs_rename_mutex);
3045 	return lock_two_directories(p1, p2);
3046 }
3047 EXPORT_SYMBOL(lock_rename);
3048 
3049 /*
3050  * c1 and p2 should be on the same fs.
3051  */
lock_rename_child(struct dentry * c1,struct dentry * p2)3052 struct dentry *lock_rename_child(struct dentry *c1, struct dentry *p2)
3053 {
3054 	if (READ_ONCE(c1->d_parent) == p2) {
3055 		/*
3056 		 * hopefully won't need to touch ->s_vfs_rename_mutex at all.
3057 		 */
3058 		inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
3059 		/*
3060 		 * now that p2 is locked, nobody can move in or out of it,
3061 		 * so the test below is safe.
3062 		 */
3063 		if (likely(c1->d_parent == p2))
3064 			return NULL;
3065 
3066 		/*
3067 		 * c1 got moved out of p2 while we'd been taking locks;
3068 		 * unlock and fall back to slow case.
3069 		 */
3070 		inode_unlock(p2->d_inode);
3071 	}
3072 
3073 	mutex_lock(&c1->d_sb->s_vfs_rename_mutex);
3074 	/*
3075 	 * nobody can move out of any directories on this fs.
3076 	 */
3077 	if (likely(c1->d_parent != p2))
3078 		return lock_two_directories(c1->d_parent, p2);
3079 
3080 	/*
3081 	 * c1 got moved into p2 while we were taking locks;
3082 	 * we need p2 locked and ->s_vfs_rename_mutex unlocked,
3083 	 * for consistency with lock_rename().
3084 	 */
3085 	inode_lock_nested(p2->d_inode, I_MUTEX_PARENT);
3086 	mutex_unlock(&c1->d_sb->s_vfs_rename_mutex);
3087 	return NULL;
3088 }
3089 EXPORT_SYMBOL(lock_rename_child);
3090 
unlock_rename(struct dentry * p1,struct dentry * p2)3091 void unlock_rename(struct dentry *p1, struct dentry *p2)
3092 {
3093 	inode_unlock(p1->d_inode);
3094 	if (p1 != p2) {
3095 		inode_unlock(p2->d_inode);
3096 		mutex_unlock(&p1->d_sb->s_vfs_rename_mutex);
3097 	}
3098 }
3099 EXPORT_SYMBOL(unlock_rename);
3100 
3101 /**
3102  * mode_strip_umask - handle vfs umask stripping
3103  * @dir:	parent directory of the new inode
3104  * @mode:	mode of the new inode to be created in @dir
3105  *
3106  * Umask stripping depends on whether or not the filesystem supports POSIX
3107  * ACLs. If the filesystem doesn't support it umask stripping is done directly
3108  * in here. If the filesystem does support POSIX ACLs umask stripping is
3109  * deferred until the filesystem calls posix_acl_create().
3110  *
3111  * Returns: mode
3112  */
mode_strip_umask(const struct inode * dir,umode_t mode)3113 static inline umode_t mode_strip_umask(const struct inode *dir, umode_t mode)
3114 {
3115 	if (!IS_POSIXACL(dir))
3116 		mode &= ~current_umask();
3117 	return mode;
3118 }
3119 
3120 /**
3121  * vfs_prepare_mode - prepare the mode to be used for a new inode
3122  * @idmap:	idmap of the mount the inode was found from
3123  * @dir:	parent directory of the new inode
3124  * @mode:	mode of the new inode
3125  * @mask_perms:	allowed permission by the vfs
3126  * @type:	type of file to be created
3127  *
3128  * This helper consolidates and enforces vfs restrictions on the @mode of a new
3129  * object to be created.
3130  *
3131  * Umask stripping depends on whether the filesystem supports POSIX ACLs (see
3132  * the kernel documentation for mode_strip_umask()). Moving umask stripping
3133  * after setgid stripping allows the same ordering for both non-POSIX ACL and
3134  * POSIX ACL supporting filesystems.
3135  *
3136  * Note that it's currently valid for @type to be 0 if a directory is created.
3137  * Filesystems raise that flag individually and we need to check whether each
3138  * filesystem can deal with receiving S_IFDIR from the vfs before we enforce a
3139  * non-zero type.
3140  *
3141  * Returns: mode to be passed to the filesystem
3142  */
vfs_prepare_mode(struct mnt_idmap * idmap,const struct inode * dir,umode_t mode,umode_t mask_perms,umode_t type)3143 static inline umode_t vfs_prepare_mode(struct mnt_idmap *idmap,
3144 				       const struct inode *dir, umode_t mode,
3145 				       umode_t mask_perms, umode_t type)
3146 {
3147 	mode = mode_strip_sgid(idmap, dir, mode);
3148 	mode = mode_strip_umask(dir, mode);
3149 
3150 	/*
3151 	 * Apply the vfs mandated allowed permission mask and set the type of
3152 	 * file to be created before we call into the filesystem.
3153 	 */
3154 	mode &= (mask_perms & ~S_IFMT);
3155 	mode |= (type & S_IFMT);
3156 
3157 	return mode;
3158 }
3159 
3160 /**
3161  * vfs_create - create new file
3162  * @idmap:	idmap of the mount the inode was found from
3163  * @dir:	inode of @dentry
3164  * @dentry:	pointer to dentry of the base directory
3165  * @mode:	mode of the new file
3166  * @want_excl:	whether the file must not yet exist
3167  *
3168  * Create a new file.
3169  *
3170  * If the inode has been found through an idmapped mount the idmap of
3171  * the vfsmount must be passed through @idmap. This function will then take
3172  * care to map the inode according to @idmap before checking permissions.
3173  * On non-idmapped mounts or if permission checking is to be performed on the
3174  * raw inode simply passs @nop_mnt_idmap.
3175  */
vfs_create(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry,umode_t mode,bool want_excl)3176 int vfs_create(struct mnt_idmap *idmap, struct inode *dir,
3177 	       struct dentry *dentry, umode_t mode, bool want_excl)
3178 {
3179 	int error;
3180 
3181 	error = may_create(idmap, dir, dentry);
3182 	if (error)
3183 		return error;
3184 
3185 	if (!dir->i_op->create)
3186 		return -EACCES;	/* shouldn't it be ENOSYS? */
3187 
3188 	mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG);
3189 	error = security_inode_create(dir, dentry, mode);
3190 	if (error)
3191 		return error;
3192 	error = dir->i_op->create(idmap, dir, dentry, mode, want_excl);
3193 	if (!error)
3194 		fsnotify_create(dir, dentry);
3195 	return error;
3196 }
3197 EXPORT_SYMBOL(vfs_create);
3198 
vfs_mkobj(struct dentry * dentry,umode_t mode,int (* f)(struct dentry *,umode_t,void *),void * arg)3199 int vfs_mkobj(struct dentry *dentry, umode_t mode,
3200 		int (*f)(struct dentry *, umode_t, void *),
3201 		void *arg)
3202 {
3203 	struct inode *dir = dentry->d_parent->d_inode;
3204 	int error = may_create(&nop_mnt_idmap, dir, dentry);
3205 	if (error)
3206 		return error;
3207 
3208 	mode &= S_IALLUGO;
3209 	mode |= S_IFREG;
3210 	error = security_inode_create(dir, dentry, mode);
3211 	if (error)
3212 		return error;
3213 	error = f(dentry, mode, arg);
3214 	if (!error)
3215 		fsnotify_create(dir, dentry);
3216 	return error;
3217 }
3218 EXPORT_SYMBOL(vfs_mkobj);
3219 
may_open_dev(const struct path * path)3220 bool may_open_dev(const struct path *path)
3221 {
3222 	return !(path->mnt->mnt_flags & MNT_NODEV) &&
3223 		!(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
3224 }
3225 
may_open(struct mnt_idmap * idmap,const struct path * path,int acc_mode,int flag)3226 static int may_open(struct mnt_idmap *idmap, const struct path *path,
3227 		    int acc_mode, int flag)
3228 {
3229 	struct dentry *dentry = path->dentry;
3230 	struct inode *inode = dentry->d_inode;
3231 	int error;
3232 
3233 	if (!inode)
3234 		return -ENOENT;
3235 
3236 	switch (inode->i_mode & S_IFMT) {
3237 	case S_IFLNK:
3238 		return -ELOOP;
3239 	case S_IFDIR:
3240 		if (acc_mode & MAY_WRITE)
3241 			return -EISDIR;
3242 		if (acc_mode & MAY_EXEC)
3243 			return -EACCES;
3244 		break;
3245 	case S_IFBLK:
3246 	case S_IFCHR:
3247 		if (!may_open_dev(path))
3248 			return -EACCES;
3249 		fallthrough;
3250 	case S_IFIFO:
3251 	case S_IFSOCK:
3252 		if (acc_mode & MAY_EXEC)
3253 			return -EACCES;
3254 		flag &= ~O_TRUNC;
3255 		break;
3256 	case S_IFREG:
3257 		if ((acc_mode & MAY_EXEC) && path_noexec(path))
3258 			return -EACCES;
3259 		break;
3260 	}
3261 
3262 	error = inode_permission(idmap, inode, MAY_OPEN | acc_mode);
3263 	if (error)
3264 		return error;
3265 
3266 	/*
3267 	 * An append-only file must be opened in append mode for writing.
3268 	 */
3269 	if (IS_APPEND(inode)) {
3270 		if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
3271 			return -EPERM;
3272 		if (flag & O_TRUNC)
3273 			return -EPERM;
3274 	}
3275 
3276 	/* O_NOATIME can only be set by the owner or superuser */
3277 	if (flag & O_NOATIME && !inode_owner_or_capable(idmap, inode))
3278 		return -EPERM;
3279 
3280 	return 0;
3281 }
3282 
handle_truncate(struct mnt_idmap * idmap,struct file * filp)3283 static int handle_truncate(struct mnt_idmap *idmap, struct file *filp)
3284 {
3285 	const struct path *path = &filp->f_path;
3286 	struct inode *inode = path->dentry->d_inode;
3287 	int error = get_write_access(inode);
3288 	if (error)
3289 		return error;
3290 
3291 	error = security_file_truncate(filp);
3292 	if (!error) {
3293 		error = do_truncate(idmap, path->dentry, 0,
3294 				    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
3295 				    filp);
3296 	}
3297 	put_write_access(inode);
3298 	return error;
3299 }
3300 
open_to_namei_flags(int flag)3301 static inline int open_to_namei_flags(int flag)
3302 {
3303 	if ((flag & O_ACCMODE) == 3)
3304 		flag--;
3305 	return flag;
3306 }
3307 
may_o_create(struct mnt_idmap * idmap,const struct path * dir,struct dentry * dentry,umode_t mode)3308 static int may_o_create(struct mnt_idmap *idmap,
3309 			const struct path *dir, struct dentry *dentry,
3310 			umode_t mode)
3311 {
3312 	int error = security_path_mknod(dir, dentry, mode, 0);
3313 	if (error)
3314 		return error;
3315 
3316 	if (!fsuidgid_has_mapping(dir->dentry->d_sb, idmap))
3317 		return -EOVERFLOW;
3318 
3319 	error = inode_permission(idmap, dir->dentry->d_inode,
3320 				 MAY_WRITE | MAY_EXEC);
3321 	if (error)
3322 		return error;
3323 
3324 	return security_inode_create(dir->dentry->d_inode, dentry, mode);
3325 }
3326 
3327 /*
3328  * Attempt to atomically look up, create and open a file from a negative
3329  * dentry.
3330  *
3331  * Returns 0 if successful.  The file will have been created and attached to
3332  * @file by the filesystem calling finish_open().
3333  *
3334  * If the file was looked up only or didn't need creating, FMODE_OPENED won't
3335  * be set.  The caller will need to perform the open themselves.  @path will
3336  * have been updated to point to the new dentry.  This may be negative.
3337  *
3338  * Returns an error code otherwise.
3339  */
atomic_open(struct nameidata * nd,struct dentry * dentry,struct file * file,int open_flag,umode_t mode)3340 static struct dentry *atomic_open(struct nameidata *nd, struct dentry *dentry,
3341 				  struct file *file,
3342 				  int open_flag, umode_t mode)
3343 {
3344 	struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
3345 	struct inode *dir =  nd->path.dentry->d_inode;
3346 	int error;
3347 
3348 	if (nd->flags & LOOKUP_DIRECTORY)
3349 		open_flag |= O_DIRECTORY;
3350 
3351 	file->f_path.dentry = DENTRY_NOT_SET;
3352 	file->f_path.mnt = nd->path.mnt;
3353 	error = dir->i_op->atomic_open(dir, dentry, file,
3354 				       open_to_namei_flags(open_flag), mode);
3355 	d_lookup_done(dentry);
3356 	if (!error) {
3357 		if (file->f_mode & FMODE_OPENED) {
3358 			if (unlikely(dentry != file->f_path.dentry)) {
3359 				dput(dentry);
3360 				dentry = dget(file->f_path.dentry);
3361 			}
3362 		} else if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
3363 			error = -EIO;
3364 		} else {
3365 			if (file->f_path.dentry) {
3366 				dput(dentry);
3367 				dentry = file->f_path.dentry;
3368 			}
3369 			if (unlikely(d_is_negative(dentry)))
3370 				error = -ENOENT;
3371 		}
3372 	}
3373 	if (error) {
3374 		dput(dentry);
3375 		dentry = ERR_PTR(error);
3376 	}
3377 	return dentry;
3378 }
3379 
3380 /*
3381  * Look up and maybe create and open the last component.
3382  *
3383  * Must be called with parent locked (exclusive in O_CREAT case).
3384  *
3385  * Returns 0 on success, that is, if
3386  *  the file was successfully atomically created (if necessary) and opened, or
3387  *  the file was not completely opened at this time, though lookups and
3388  *  creations were performed.
3389  * These case are distinguished by presence of FMODE_OPENED on file->f_mode.
3390  * In the latter case dentry returned in @path might be negative if O_CREAT
3391  * hadn't been specified.
3392  *
3393  * An error code is returned on failure.
3394  */
lookup_open(struct nameidata * nd,struct file * file,const struct open_flags * op,bool got_write)3395 static struct dentry *lookup_open(struct nameidata *nd, struct file *file,
3396 				  const struct open_flags *op,
3397 				  bool got_write)
3398 {
3399 	struct mnt_idmap *idmap;
3400 	struct dentry *dir = nd->path.dentry;
3401 	struct inode *dir_inode = dir->d_inode;
3402 	int open_flag = op->open_flag;
3403 	struct dentry *dentry;
3404 	int error, create_error = 0;
3405 	umode_t mode = op->mode;
3406 	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
3407 
3408 	if (unlikely(IS_DEADDIR(dir_inode)))
3409 		return ERR_PTR(-ENOENT);
3410 
3411 	file->f_mode &= ~FMODE_CREATED;
3412 	dentry = d_lookup(dir, &nd->last);
3413 	for (;;) {
3414 		if (!dentry) {
3415 			dentry = d_alloc_parallel(dir, &nd->last, &wq);
3416 			if (IS_ERR(dentry))
3417 				return dentry;
3418 		}
3419 		if (d_in_lookup(dentry))
3420 			break;
3421 
3422 		error = d_revalidate(dentry, nd->flags);
3423 		if (likely(error > 0))
3424 			break;
3425 		if (error)
3426 			goto out_dput;
3427 		d_invalidate(dentry);
3428 		dput(dentry);
3429 		dentry = NULL;
3430 	}
3431 	if (dentry->d_inode) {
3432 		/* Cached positive dentry: will open in f_op->open */
3433 		return dentry;
3434 	}
3435 
3436 	/*
3437 	 * Checking write permission is tricky, bacuse we don't know if we are
3438 	 * going to actually need it: O_CREAT opens should work as long as the
3439 	 * file exists.  But checking existence breaks atomicity.  The trick is
3440 	 * to check access and if not granted clear O_CREAT from the flags.
3441 	 *
3442 	 * Another problem is returing the "right" error value (e.g. for an
3443 	 * O_EXCL open we want to return EEXIST not EROFS).
3444 	 */
3445 	if (unlikely(!got_write))
3446 		open_flag &= ~O_TRUNC;
3447 	idmap = mnt_idmap(nd->path.mnt);
3448 	if (open_flag & O_CREAT) {
3449 		if (open_flag & O_EXCL)
3450 			open_flag &= ~O_TRUNC;
3451 		mode = vfs_prepare_mode(idmap, dir->d_inode, mode, mode, mode);
3452 		if (likely(got_write))
3453 			create_error = may_o_create(idmap, &nd->path,
3454 						    dentry, mode);
3455 		else
3456 			create_error = -EROFS;
3457 	}
3458 	if (create_error)
3459 		open_flag &= ~O_CREAT;
3460 	if (dir_inode->i_op->atomic_open) {
3461 		dentry = atomic_open(nd, dentry, file, open_flag, mode);
3462 		if (unlikely(create_error) && dentry == ERR_PTR(-ENOENT))
3463 			dentry = ERR_PTR(create_error);
3464 		return dentry;
3465 	}
3466 
3467 	if (d_in_lookup(dentry)) {
3468 		struct dentry *res = dir_inode->i_op->lookup(dir_inode, dentry,
3469 							     nd->flags);
3470 		d_lookup_done(dentry);
3471 		if (unlikely(res)) {
3472 			if (IS_ERR(res)) {
3473 				error = PTR_ERR(res);
3474 				goto out_dput;
3475 			}
3476 			dput(dentry);
3477 			dentry = res;
3478 		}
3479 	}
3480 
3481 	/* Negative dentry, just create the file */
3482 	if (!dentry->d_inode && (open_flag & O_CREAT)) {
3483 		file->f_mode |= FMODE_CREATED;
3484 		audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
3485 		if (!dir_inode->i_op->create) {
3486 			error = -EACCES;
3487 			goto out_dput;
3488 		}
3489 
3490 		error = dir_inode->i_op->create(idmap, dir_inode, dentry,
3491 						mode, open_flag & O_EXCL);
3492 		if (error)
3493 			goto out_dput;
3494 	}
3495 	if (unlikely(create_error) && !dentry->d_inode) {
3496 		error = create_error;
3497 		goto out_dput;
3498 	}
3499 	return dentry;
3500 
3501 out_dput:
3502 	dput(dentry);
3503 	return ERR_PTR(error);
3504 }
3505 
open_last_lookups(struct nameidata * nd,struct file * file,const struct open_flags * op)3506 static const char *open_last_lookups(struct nameidata *nd,
3507 		   struct file *file, const struct open_flags *op)
3508 {
3509 	struct dentry *dir = nd->path.dentry;
3510 	int open_flag = op->open_flag;
3511 	bool got_write = false;
3512 	struct dentry *dentry;
3513 	const char *res;
3514 
3515 	nd->flags |= op->intent;
3516 
3517 	if (nd->last_type != LAST_NORM) {
3518 		if (nd->depth)
3519 			put_link(nd);
3520 		return handle_dots(nd, nd->last_type);
3521 	}
3522 
3523 	if (!(open_flag & O_CREAT)) {
3524 		if (nd->last.name[nd->last.len])
3525 			nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
3526 		/* we _can_ be in RCU mode here */
3527 		dentry = lookup_fast(nd);
3528 		if (IS_ERR(dentry))
3529 			return ERR_CAST(dentry);
3530 		if (likely(dentry))
3531 			goto finish_lookup;
3532 
3533 		BUG_ON(nd->flags & LOOKUP_RCU);
3534 	} else {
3535 		/* create side of things */
3536 		if (nd->flags & LOOKUP_RCU) {
3537 			if (!try_to_unlazy(nd))
3538 				return ERR_PTR(-ECHILD);
3539 		}
3540 		audit_inode(nd->name, dir, AUDIT_INODE_PARENT);
3541 		/* trailing slashes? */
3542 		if (unlikely(nd->last.name[nd->last.len]))
3543 			return ERR_PTR(-EISDIR);
3544 	}
3545 
3546 	if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
3547 		got_write = !mnt_want_write(nd->path.mnt);
3548 		/*
3549 		 * do _not_ fail yet - we might not need that or fail with
3550 		 * a different error; let lookup_open() decide; we'll be
3551 		 * dropping this one anyway.
3552 		 */
3553 	}
3554 	if (open_flag & O_CREAT)
3555 		inode_lock(dir->d_inode);
3556 	else
3557 		inode_lock_shared(dir->d_inode);
3558 	dentry = lookup_open(nd, file, op, got_write);
3559 	if (!IS_ERR(dentry) && (file->f_mode & FMODE_CREATED))
3560 		fsnotify_create(dir->d_inode, dentry);
3561 	if (open_flag & O_CREAT)
3562 		inode_unlock(dir->d_inode);
3563 	else
3564 		inode_unlock_shared(dir->d_inode);
3565 
3566 	if (got_write)
3567 		mnt_drop_write(nd->path.mnt);
3568 
3569 	if (IS_ERR(dentry))
3570 		return ERR_CAST(dentry);
3571 
3572 	if (file->f_mode & (FMODE_OPENED | FMODE_CREATED)) {
3573 		dput(nd->path.dentry);
3574 		nd->path.dentry = dentry;
3575 		return NULL;
3576 	}
3577 
3578 finish_lookup:
3579 	if (nd->depth)
3580 		put_link(nd);
3581 	res = step_into(nd, WALK_TRAILING, dentry);
3582 	if (unlikely(res))
3583 		nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
3584 	return res;
3585 }
3586 
3587 /*
3588  * Handle the last step of open()
3589  */
do_open(struct nameidata * nd,struct file * file,const struct open_flags * op)3590 static int do_open(struct nameidata *nd,
3591 		   struct file *file, const struct open_flags *op)
3592 {
3593 	struct mnt_idmap *idmap;
3594 	int open_flag = op->open_flag;
3595 	bool do_truncate;
3596 	int acc_mode;
3597 	int error;
3598 
3599 	if (!(file->f_mode & (FMODE_OPENED | FMODE_CREATED))) {
3600 		error = complete_walk(nd);
3601 		if (error)
3602 			return error;
3603 	}
3604 	if (!(file->f_mode & FMODE_CREATED))
3605 		audit_inode(nd->name, nd->path.dentry, 0);
3606 	idmap = mnt_idmap(nd->path.mnt);
3607 	if (open_flag & O_CREAT) {
3608 		if ((open_flag & O_EXCL) && !(file->f_mode & FMODE_CREATED))
3609 			return -EEXIST;
3610 		if (d_is_dir(nd->path.dentry))
3611 			return -EISDIR;
3612 		error = may_create_in_sticky(idmap, nd,
3613 					     d_backing_inode(nd->path.dentry));
3614 		if (unlikely(error))
3615 			return error;
3616 	}
3617 	if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry))
3618 		return -ENOTDIR;
3619 
3620 	do_truncate = false;
3621 	acc_mode = op->acc_mode;
3622 	if (file->f_mode & FMODE_CREATED) {
3623 		/* Don't check for write permission, don't truncate */
3624 		open_flag &= ~O_TRUNC;
3625 		acc_mode = 0;
3626 	} else if (d_is_reg(nd->path.dentry) && open_flag & O_TRUNC) {
3627 		error = mnt_want_write(nd->path.mnt);
3628 		if (error)
3629 			return error;
3630 		do_truncate = true;
3631 	}
3632 	error = may_open(idmap, &nd->path, acc_mode, open_flag);
3633 	if (!error && !(file->f_mode & FMODE_OPENED))
3634 		error = vfs_open(&nd->path, file);
3635 	if (!error)
3636 		error = ima_file_check(file, op->acc_mode);
3637 	if (!error && do_truncate)
3638 		error = handle_truncate(idmap, file);
3639 	if (unlikely(error > 0)) {
3640 		WARN_ON(1);
3641 		error = -EINVAL;
3642 	}
3643 	if (do_truncate)
3644 		mnt_drop_write(nd->path.mnt);
3645 	return error;
3646 }
3647 
3648 /**
3649  * vfs_tmpfile - create tmpfile
3650  * @idmap:	idmap of the mount the inode was found from
3651  * @parentpath:	pointer to the path of the base directory
3652  * @file:	file descriptor of the new tmpfile
3653  * @mode:	mode of the new tmpfile
3654  *
3655  * Create a temporary file.
3656  *
3657  * If the inode has been found through an idmapped mount the idmap of
3658  * the vfsmount must be passed through @idmap. This function will then take
3659  * care to map the inode according to @idmap before checking permissions.
3660  * On non-idmapped mounts or if permission checking is to be performed on the
3661  * raw inode simply passs @nop_mnt_idmap.
3662  */
vfs_tmpfile(struct mnt_idmap * idmap,const struct path * parentpath,struct file * file,umode_t mode)3663 static int vfs_tmpfile(struct mnt_idmap *idmap,
3664 		       const struct path *parentpath,
3665 		       struct file *file, umode_t mode)
3666 {
3667 	struct dentry *child;
3668 	struct inode *dir = d_inode(parentpath->dentry);
3669 	struct inode *inode;
3670 	int error;
3671 	int open_flag = file->f_flags;
3672 
3673 	/* we want directory to be writable */
3674 	error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC);
3675 	if (error)
3676 		return error;
3677 	if (!dir->i_op->tmpfile)
3678 		return -EOPNOTSUPP;
3679 	child = d_alloc(parentpath->dentry, &slash_name);
3680 	if (unlikely(!child))
3681 		return -ENOMEM;
3682 	file->f_path.mnt = parentpath->mnt;
3683 	file->f_path.dentry = child;
3684 	mode = vfs_prepare_mode(idmap, dir, mode, mode, mode);
3685 	error = dir->i_op->tmpfile(idmap, dir, file, mode);
3686 	dput(child);
3687 	if (error)
3688 		return error;
3689 	/* Don't check for other permissions, the inode was just created */
3690 	error = may_open(idmap, &file->f_path, 0, file->f_flags);
3691 	if (error)
3692 		return error;
3693 	inode = file_inode(file);
3694 	if (!(open_flag & O_EXCL)) {
3695 		spin_lock(&inode->i_lock);
3696 		inode->i_state |= I_LINKABLE;
3697 		spin_unlock(&inode->i_lock);
3698 	}
3699 	ima_post_create_tmpfile(idmap, inode);
3700 	return 0;
3701 }
3702 
3703 /**
3704  * kernel_tmpfile_open - open a tmpfile for kernel internal use
3705  * @idmap:	idmap of the mount the inode was found from
3706  * @parentpath:	path of the base directory
3707  * @mode:	mode of the new tmpfile
3708  * @open_flag:	flags
3709  * @cred:	credentials for open
3710  *
3711  * Create and open a temporary file.  The file is not accounted in nr_files,
3712  * hence this is only for kernel internal use, and must not be installed into
3713  * file tables or such.
3714  */
kernel_tmpfile_open(struct mnt_idmap * idmap,const struct path * parentpath,umode_t mode,int open_flag,const struct cred * cred)3715 struct file *kernel_tmpfile_open(struct mnt_idmap *idmap,
3716 				 const struct path *parentpath,
3717 				 umode_t mode, int open_flag,
3718 				 const struct cred *cred)
3719 {
3720 	struct file *file;
3721 	int error;
3722 
3723 	file = alloc_empty_file_noaccount(open_flag, cred);
3724 	if (IS_ERR(file))
3725 		return file;
3726 
3727 	error = vfs_tmpfile(idmap, parentpath, file, mode);
3728 	if (error) {
3729 		fput(file);
3730 		file = ERR_PTR(error);
3731 	}
3732 	return file;
3733 }
3734 EXPORT_SYMBOL(kernel_tmpfile_open);
3735 
do_tmpfile(struct nameidata * nd,unsigned flags,const struct open_flags * op,struct file * file)3736 static int do_tmpfile(struct nameidata *nd, unsigned flags,
3737 		const struct open_flags *op,
3738 		struct file *file)
3739 {
3740 	struct path path;
3741 	int error = path_lookupat(nd, flags | LOOKUP_DIRECTORY, &path);
3742 
3743 	if (unlikely(error))
3744 		return error;
3745 	error = mnt_want_write(path.mnt);
3746 	if (unlikely(error))
3747 		goto out;
3748 	error = vfs_tmpfile(mnt_idmap(path.mnt), &path, file, op->mode);
3749 	if (error)
3750 		goto out2;
3751 	audit_inode(nd->name, file->f_path.dentry, 0);
3752 out2:
3753 	mnt_drop_write(path.mnt);
3754 out:
3755 	path_put(&path);
3756 	return error;
3757 }
3758 
do_o_path(struct nameidata * nd,unsigned flags,struct file * file)3759 static int do_o_path(struct nameidata *nd, unsigned flags, struct file *file)
3760 {
3761 	struct path path;
3762 	int error = path_lookupat(nd, flags, &path);
3763 	if (!error) {
3764 		audit_inode(nd->name, path.dentry, 0);
3765 		error = vfs_open(&path, file);
3766 		path_put(&path);
3767 	}
3768 	return error;
3769 }
3770 
path_openat(struct nameidata * nd,const struct open_flags * op,unsigned flags)3771 static struct file *path_openat(struct nameidata *nd,
3772 			const struct open_flags *op, unsigned flags)
3773 {
3774 	struct file *file;
3775 	int error;
3776 
3777 	file = alloc_empty_file(op->open_flag, current_cred());
3778 	if (IS_ERR(file))
3779 		return file;
3780 
3781 	if (unlikely(file->f_flags & __O_TMPFILE)) {
3782 		error = do_tmpfile(nd, flags, op, file);
3783 	} else if (unlikely(file->f_flags & O_PATH)) {
3784 		error = do_o_path(nd, flags, file);
3785 	} else {
3786 		const char *s = path_init(nd, flags);
3787 		while (!(error = link_path_walk(s, nd)) &&
3788 		       (s = open_last_lookups(nd, file, op)) != NULL)
3789 			;
3790 		if (!error)
3791 			error = do_open(nd, file, op);
3792 		terminate_walk(nd);
3793 	}
3794 	if (likely(!error)) {
3795 		if (likely(file->f_mode & FMODE_OPENED))
3796 			return file;
3797 		WARN_ON(1);
3798 		error = -EINVAL;
3799 	}
3800 	fput(file);
3801 	if (error == -EOPENSTALE) {
3802 		if (flags & LOOKUP_RCU)
3803 			error = -ECHILD;
3804 		else
3805 			error = -ESTALE;
3806 	}
3807 	return ERR_PTR(error);
3808 }
3809 
do_filp_open(int dfd,struct filename * pathname,const struct open_flags * op)3810 struct file *do_filp_open(int dfd, struct filename *pathname,
3811 		const struct open_flags *op)
3812 {
3813 	struct nameidata nd;
3814 	int flags = op->lookup_flags;
3815 	struct file *filp;
3816 
3817 	set_nameidata(&nd, dfd, pathname, NULL);
3818 	filp = path_openat(&nd, op, flags | LOOKUP_RCU);
3819 	if (unlikely(filp == ERR_PTR(-ECHILD)))
3820 		filp = path_openat(&nd, op, flags);
3821 	if (unlikely(filp == ERR_PTR(-ESTALE)))
3822 		filp = path_openat(&nd, op, flags | LOOKUP_REVAL);
3823 	restore_nameidata();
3824 	return filp;
3825 }
3826 
do_file_open_root(const struct path * root,const char * name,const struct open_flags * op)3827 struct file *do_file_open_root(const struct path *root,
3828 		const char *name, const struct open_flags *op)
3829 {
3830 	struct nameidata nd;
3831 	struct file *file;
3832 	struct filename *filename;
3833 	int flags = op->lookup_flags;
3834 
3835 	if (d_is_symlink(root->dentry) && op->intent & LOOKUP_OPEN)
3836 		return ERR_PTR(-ELOOP);
3837 
3838 	filename = getname_kernel(name);
3839 	if (IS_ERR(filename))
3840 		return ERR_CAST(filename);
3841 
3842 	set_nameidata(&nd, -1, filename, root);
3843 	file = path_openat(&nd, op, flags | LOOKUP_RCU);
3844 	if (unlikely(file == ERR_PTR(-ECHILD)))
3845 		file = path_openat(&nd, op, flags);
3846 	if (unlikely(file == ERR_PTR(-ESTALE)))
3847 		file = path_openat(&nd, op, flags | LOOKUP_REVAL);
3848 	restore_nameidata();
3849 	putname(filename);
3850 	return file;
3851 }
3852 
filename_create(int dfd,struct filename * name,struct path * path,unsigned int lookup_flags)3853 static struct dentry *filename_create(int dfd, struct filename *name,
3854 				      struct path *path, unsigned int lookup_flags)
3855 {
3856 	struct dentry *dentry = ERR_PTR(-EEXIST);
3857 	struct qstr last;
3858 	bool want_dir = lookup_flags & LOOKUP_DIRECTORY;
3859 	unsigned int reval_flag = lookup_flags & LOOKUP_REVAL;
3860 	unsigned int create_flags = LOOKUP_CREATE | LOOKUP_EXCL;
3861 	int type;
3862 	int err2;
3863 	int error;
3864 
3865 	error = filename_parentat(dfd, name, reval_flag, path, &last, &type);
3866 	if (error)
3867 		return ERR_PTR(error);
3868 
3869 	/*
3870 	 * Yucky last component or no last component at all?
3871 	 * (foo/., foo/.., /////)
3872 	 */
3873 	if (unlikely(type != LAST_NORM))
3874 		goto out;
3875 
3876 	/* don't fail immediately if it's r/o, at least try to report other errors */
3877 	err2 = mnt_want_write(path->mnt);
3878 	/*
3879 	 * Do the final lookup.  Suppress 'create' if there is a trailing
3880 	 * '/', and a directory wasn't requested.
3881 	 */
3882 	if (last.name[last.len] && !want_dir)
3883 		create_flags = 0;
3884 	inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
3885 	dentry = lookup_one_qstr_excl(&last, path->dentry,
3886 				      reval_flag | create_flags);
3887 	if (IS_ERR(dentry))
3888 		goto unlock;
3889 
3890 	error = -EEXIST;
3891 	if (d_is_positive(dentry))
3892 		goto fail;
3893 
3894 	/*
3895 	 * Special case - lookup gave negative, but... we had foo/bar/
3896 	 * From the vfs_mknod() POV we just have a negative dentry -
3897 	 * all is fine. Let's be bastards - you had / on the end, you've
3898 	 * been asking for (non-existent) directory. -ENOENT for you.
3899 	 */
3900 	if (unlikely(!create_flags)) {
3901 		error = -ENOENT;
3902 		goto fail;
3903 	}
3904 	if (unlikely(err2)) {
3905 		error = err2;
3906 		goto fail;
3907 	}
3908 	return dentry;
3909 fail:
3910 	dput(dentry);
3911 	dentry = ERR_PTR(error);
3912 unlock:
3913 	inode_unlock(path->dentry->d_inode);
3914 	if (!err2)
3915 		mnt_drop_write(path->mnt);
3916 out:
3917 	path_put(path);
3918 	return dentry;
3919 }
3920 
kern_path_create(int dfd,const char * pathname,struct path * path,unsigned int lookup_flags)3921 struct dentry *kern_path_create(int dfd, const char *pathname,
3922 				struct path *path, unsigned int lookup_flags)
3923 {
3924 	struct filename *filename = getname_kernel(pathname);
3925 	struct dentry *res = filename_create(dfd, filename, path, lookup_flags);
3926 
3927 	putname(filename);
3928 	return res;
3929 }
3930 EXPORT_SYMBOL(kern_path_create);
3931 
done_path_create(struct path * path,struct dentry * dentry)3932 void done_path_create(struct path *path, struct dentry *dentry)
3933 {
3934 	dput(dentry);
3935 	inode_unlock(path->dentry->d_inode);
3936 	mnt_drop_write(path->mnt);
3937 	path_put(path);
3938 }
3939 EXPORT_SYMBOL(done_path_create);
3940 
user_path_create(int dfd,const char __user * pathname,struct path * path,unsigned int lookup_flags)3941 inline struct dentry *user_path_create(int dfd, const char __user *pathname,
3942 				struct path *path, unsigned int lookup_flags)
3943 {
3944 	struct filename *filename = getname(pathname);
3945 	struct dentry *res = filename_create(dfd, filename, path, lookup_flags);
3946 
3947 	putname(filename);
3948 	return res;
3949 }
3950 EXPORT_SYMBOL(user_path_create);
3951 
3952 /**
3953  * vfs_mknod - create device node or file
3954  * @idmap:	idmap of the mount the inode was found from
3955  * @dir:	inode of @dentry
3956  * @dentry:	pointer to dentry of the base directory
3957  * @mode:	mode of the new device node or file
3958  * @dev:	device number of device to create
3959  *
3960  * Create a device node or file.
3961  *
3962  * If the inode has been found through an idmapped mount the idmap of
3963  * the vfsmount must be passed through @idmap. This function will then take
3964  * care to map the inode according to @idmap before checking permissions.
3965  * On non-idmapped mounts or if permission checking is to be performed on the
3966  * raw inode simply passs @nop_mnt_idmap.
3967  */
vfs_mknod(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry,umode_t mode,dev_t dev)3968 int vfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
3969 	      struct dentry *dentry, umode_t mode, dev_t dev)
3970 {
3971 	bool is_whiteout = S_ISCHR(mode) && dev == WHITEOUT_DEV;
3972 	int error = may_create(idmap, dir, dentry);
3973 
3974 	if (error)
3975 		return error;
3976 
3977 	if ((S_ISCHR(mode) || S_ISBLK(mode)) && !is_whiteout &&
3978 	    !capable(CAP_MKNOD))
3979 		return -EPERM;
3980 
3981 	if (!dir->i_op->mknod)
3982 		return -EPERM;
3983 
3984 	mode = vfs_prepare_mode(idmap, dir, mode, mode, mode);
3985 	error = devcgroup_inode_mknod(mode, dev);
3986 	if (error)
3987 		return error;
3988 
3989 	error = security_inode_mknod(dir, dentry, mode, dev);
3990 	if (error)
3991 		return error;
3992 
3993 	error = dir->i_op->mknod(idmap, dir, dentry, mode, dev);
3994 	if (!error)
3995 		fsnotify_create(dir, dentry);
3996 	return error;
3997 }
3998 EXPORT_SYMBOL(vfs_mknod);
3999 
may_mknod(umode_t mode)4000 static int may_mknod(umode_t mode)
4001 {
4002 	switch (mode & S_IFMT) {
4003 	case S_IFREG:
4004 	case S_IFCHR:
4005 	case S_IFBLK:
4006 	case S_IFIFO:
4007 	case S_IFSOCK:
4008 	case 0: /* zero mode translates to S_IFREG */
4009 		return 0;
4010 	case S_IFDIR:
4011 		return -EPERM;
4012 	default:
4013 		return -EINVAL;
4014 	}
4015 }
4016 
do_mknodat(int dfd,struct filename * name,umode_t mode,unsigned int dev)4017 static int do_mknodat(int dfd, struct filename *name, umode_t mode,
4018 		unsigned int dev)
4019 {
4020 	struct mnt_idmap *idmap;
4021 	struct dentry *dentry;
4022 	struct path path;
4023 	int error;
4024 	unsigned int lookup_flags = 0;
4025 
4026 	error = may_mknod(mode);
4027 	if (error)
4028 		goto out1;
4029 retry:
4030 	dentry = filename_create(dfd, name, &path, lookup_flags);
4031 	error = PTR_ERR(dentry);
4032 	if (IS_ERR(dentry))
4033 		goto out1;
4034 
4035 	error = security_path_mknod(&path, dentry,
4036 			mode_strip_umask(path.dentry->d_inode, mode), dev);
4037 	if (error)
4038 		goto out2;
4039 
4040 	idmap = mnt_idmap(path.mnt);
4041 	switch (mode & S_IFMT) {
4042 		case 0: case S_IFREG:
4043 			error = vfs_create(idmap, path.dentry->d_inode,
4044 					   dentry, mode, true);
4045 			if (!error)
4046 				ima_post_path_mknod(idmap, dentry);
4047 			break;
4048 		case S_IFCHR: case S_IFBLK:
4049 			error = vfs_mknod(idmap, path.dentry->d_inode,
4050 					  dentry, mode, new_decode_dev(dev));
4051 			break;
4052 		case S_IFIFO: case S_IFSOCK:
4053 			error = vfs_mknod(idmap, path.dentry->d_inode,
4054 					  dentry, mode, 0);
4055 			break;
4056 	}
4057 out2:
4058 	done_path_create(&path, dentry);
4059 	if (retry_estale(error, lookup_flags)) {
4060 		lookup_flags |= LOOKUP_REVAL;
4061 		goto retry;
4062 	}
4063 out1:
4064 	putname(name);
4065 	return error;
4066 }
4067 
SYSCALL_DEFINE4(mknodat,int,dfd,const char __user *,filename,umode_t,mode,unsigned int,dev)4068 SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
4069 		unsigned int, dev)
4070 {
4071 	return do_mknodat(dfd, getname(filename), mode, dev);
4072 }
4073 
SYSCALL_DEFINE3(mknod,const char __user *,filename,umode_t,mode,unsigned,dev)4074 SYSCALL_DEFINE3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev)
4075 {
4076 	return do_mknodat(AT_FDCWD, getname(filename), mode, dev);
4077 }
4078 
4079 /**
4080  * vfs_mkdir - create directory
4081  * @idmap:	idmap of the mount the inode was found from
4082  * @dir:	inode of @dentry
4083  * @dentry:	pointer to dentry of the base directory
4084  * @mode:	mode of the new directory
4085  *
4086  * Create a directory.
4087  *
4088  * If the inode has been found through an idmapped mount the idmap of
4089  * the vfsmount must be passed through @idmap. This function will then take
4090  * care to map the inode according to @idmap before checking permissions.
4091  * On non-idmapped mounts or if permission checking is to be performed on the
4092  * raw inode simply passs @nop_mnt_idmap.
4093  */
vfs_mkdir(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry,umode_t mode)4094 int vfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
4095 	      struct dentry *dentry, umode_t mode)
4096 {
4097 	int error;
4098 	unsigned max_links = dir->i_sb->s_max_links;
4099 
4100 	error = may_create(idmap, dir, dentry);
4101 	if (error)
4102 		return error;
4103 
4104 	if (!dir->i_op->mkdir)
4105 		return -EPERM;
4106 
4107 	mode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO | S_ISVTX, 0);
4108 	error = security_inode_mkdir(dir, dentry, mode);
4109 	if (error)
4110 		return error;
4111 
4112 	if (max_links && dir->i_nlink >= max_links)
4113 		return -EMLINK;
4114 
4115 	error = dir->i_op->mkdir(idmap, dir, dentry, mode);
4116 	if (!error)
4117 		fsnotify_mkdir(dir, dentry);
4118 	return error;
4119 }
4120 EXPORT_SYMBOL(vfs_mkdir);
4121 
do_mkdirat(int dfd,struct filename * name,umode_t mode)4122 int do_mkdirat(int dfd, struct filename *name, umode_t mode)
4123 {
4124 	struct dentry *dentry;
4125 	struct path path;
4126 	int error;
4127 	unsigned int lookup_flags = LOOKUP_DIRECTORY;
4128 
4129 retry:
4130 	dentry = filename_create(dfd, name, &path, lookup_flags);
4131 	error = PTR_ERR(dentry);
4132 	if (IS_ERR(dentry))
4133 		goto out_putname;
4134 
4135 	error = security_path_mkdir(&path, dentry,
4136 			mode_strip_umask(path.dentry->d_inode, mode));
4137 	if (!error) {
4138 		error = vfs_mkdir(mnt_idmap(path.mnt), path.dentry->d_inode,
4139 				  dentry, mode);
4140 	}
4141 	done_path_create(&path, dentry);
4142 	if (retry_estale(error, lookup_flags)) {
4143 		lookup_flags |= LOOKUP_REVAL;
4144 		goto retry;
4145 	}
4146 out_putname:
4147 	putname(name);
4148 	return error;
4149 }
4150 
SYSCALL_DEFINE3(mkdirat,int,dfd,const char __user *,pathname,umode_t,mode)4151 SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
4152 {
4153 	return do_mkdirat(dfd, getname(pathname), mode);
4154 }
4155 
SYSCALL_DEFINE2(mkdir,const char __user *,pathname,umode_t,mode)4156 SYSCALL_DEFINE2(mkdir, const char __user *, pathname, umode_t, mode)
4157 {
4158 	return do_mkdirat(AT_FDCWD, getname(pathname), mode);
4159 }
4160 
4161 /**
4162  * vfs_rmdir - remove directory
4163  * @idmap:	idmap of the mount the inode was found from
4164  * @dir:	inode of @dentry
4165  * @dentry:	pointer to dentry of the base directory
4166  *
4167  * Remove a directory.
4168  *
4169  * If the inode has been found through an idmapped mount the idmap of
4170  * the vfsmount must be passed through @idmap. This function will then take
4171  * care to map the inode according to @idmap before checking permissions.
4172  * On non-idmapped mounts or if permission checking is to be performed on the
4173  * raw inode simply passs @nop_mnt_idmap.
4174  */
vfs_rmdir(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry)4175 int vfs_rmdir(struct mnt_idmap *idmap, struct inode *dir,
4176 		     struct dentry *dentry)
4177 {
4178 	int error = may_delete(idmap, dir, dentry, 1);
4179 
4180 	if (error)
4181 		return error;
4182 
4183 	if (!dir->i_op->rmdir)
4184 		return -EPERM;
4185 
4186 	dget(dentry);
4187 	inode_lock(dentry->d_inode);
4188 
4189 	error = -EBUSY;
4190 	if (is_local_mountpoint(dentry) ||
4191 	    (dentry->d_inode->i_flags & S_KERNEL_FILE))
4192 		goto out;
4193 
4194 	error = security_inode_rmdir(dir, dentry);
4195 	if (error)
4196 		goto out;
4197 
4198 	error = dir->i_op->rmdir(dir, dentry);
4199 	if (error)
4200 		goto out;
4201 
4202 	shrink_dcache_parent(dentry);
4203 	dentry->d_inode->i_flags |= S_DEAD;
4204 	dont_mount(dentry);
4205 	detach_mounts(dentry);
4206 
4207 out:
4208 	inode_unlock(dentry->d_inode);
4209 	dput(dentry);
4210 	if (!error)
4211 		d_delete_notify(dir, dentry);
4212 	return error;
4213 }
4214 EXPORT_SYMBOL(vfs_rmdir);
4215 
do_rmdir(int dfd,struct filename * name)4216 int do_rmdir(int dfd, struct filename *name)
4217 {
4218 	int error;
4219 	struct dentry *dentry;
4220 	struct path path;
4221 	struct qstr last;
4222 	int type;
4223 	unsigned int lookup_flags = 0;
4224 retry:
4225 	error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4226 	if (error)
4227 		goto exit1;
4228 
4229 	switch (type) {
4230 	case LAST_DOTDOT:
4231 		error = -ENOTEMPTY;
4232 		goto exit2;
4233 	case LAST_DOT:
4234 		error = -EINVAL;
4235 		goto exit2;
4236 	case LAST_ROOT:
4237 		error = -EBUSY;
4238 		goto exit2;
4239 	}
4240 
4241 	error = mnt_want_write(path.mnt);
4242 	if (error)
4243 		goto exit2;
4244 
4245 	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4246 	dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags);
4247 	error = PTR_ERR(dentry);
4248 	if (IS_ERR(dentry))
4249 		goto exit3;
4250 	if (!dentry->d_inode) {
4251 		error = -ENOENT;
4252 		goto exit4;
4253 	}
4254 	error = security_path_rmdir(&path, dentry);
4255 	if (error)
4256 		goto exit4;
4257 	error = vfs_rmdir(mnt_idmap(path.mnt), path.dentry->d_inode, dentry);
4258 exit4:
4259 	dput(dentry);
4260 exit3:
4261 	inode_unlock(path.dentry->d_inode);
4262 	mnt_drop_write(path.mnt);
4263 exit2:
4264 	path_put(&path);
4265 	if (retry_estale(error, lookup_flags)) {
4266 		lookup_flags |= LOOKUP_REVAL;
4267 		goto retry;
4268 	}
4269 exit1:
4270 	putname(name);
4271 	return error;
4272 }
4273 
SYSCALL_DEFINE1(rmdir,const char __user *,pathname)4274 SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
4275 {
4276 	return do_rmdir(AT_FDCWD, getname(pathname));
4277 }
4278 
4279 /**
4280  * vfs_unlink - unlink a filesystem object
4281  * @idmap:	idmap of the mount the inode was found from
4282  * @dir:	parent directory
4283  * @dentry:	victim
4284  * @delegated_inode: returns victim inode, if the inode is delegated.
4285  *
4286  * The caller must hold dir->i_mutex.
4287  *
4288  * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and
4289  * return a reference to the inode in delegated_inode.  The caller
4290  * should then break the delegation on that inode and retry.  Because
4291  * breaking a delegation may take a long time, the caller should drop
4292  * dir->i_mutex before doing so.
4293  *
4294  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4295  * be appropriate for callers that expect the underlying filesystem not
4296  * to be NFS exported.
4297  *
4298  * If the inode has been found through an idmapped mount the idmap of
4299  * the vfsmount must be passed through @idmap. This function will then take
4300  * care to map the inode according to @idmap before checking permissions.
4301  * On non-idmapped mounts or if permission checking is to be performed on the
4302  * raw inode simply passs @nop_mnt_idmap.
4303  */
vfs_unlink(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry,struct inode ** delegated_inode)4304 int vfs_unlink(struct mnt_idmap *idmap, struct inode *dir,
4305 	       struct dentry *dentry, struct inode **delegated_inode)
4306 {
4307 	struct inode *target = dentry->d_inode;
4308 	int error = may_delete(idmap, dir, dentry, 0);
4309 
4310 	if (error)
4311 		return error;
4312 
4313 	if (!dir->i_op->unlink)
4314 		return -EPERM;
4315 
4316 	inode_lock(target);
4317 	if (IS_SWAPFILE(target))
4318 		error = -EPERM;
4319 	else if (is_local_mountpoint(dentry))
4320 		error = -EBUSY;
4321 	else {
4322 		error = security_inode_unlink(dir, dentry);
4323 		if (!error) {
4324 			error = try_break_deleg(target, delegated_inode);
4325 			if (error)
4326 				goto out;
4327 			error = dir->i_op->unlink(dir, dentry);
4328 			if (!error) {
4329 				dont_mount(dentry);
4330 				detach_mounts(dentry);
4331 			}
4332 		}
4333 	}
4334 out:
4335 	inode_unlock(target);
4336 
4337 	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
4338 	if (!error && dentry->d_flags & DCACHE_NFSFS_RENAMED) {
4339 		fsnotify_unlink(dir, dentry);
4340 	} else if (!error) {
4341 		fsnotify_link_count(target);
4342 		d_delete_notify(dir, dentry);
4343 	}
4344 
4345 	return error;
4346 }
4347 EXPORT_SYMBOL(vfs_unlink);
4348 
4349 /*
4350  * Make sure that the actual truncation of the file will occur outside its
4351  * directory's i_mutex.  Truncate can take a long time if there is a lot of
4352  * writeout happening, and we don't want to prevent access to the directory
4353  * while waiting on the I/O.
4354  */
do_unlinkat(int dfd,struct filename * name)4355 int do_unlinkat(int dfd, struct filename *name)
4356 {
4357 	int error;
4358 	struct dentry *dentry;
4359 	struct path path;
4360 	struct qstr last;
4361 	int type;
4362 	struct inode *inode = NULL;
4363 	struct inode *delegated_inode = NULL;
4364 	unsigned int lookup_flags = 0;
4365 retry:
4366 	error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
4367 	if (error)
4368 		goto exit1;
4369 
4370 	error = -EISDIR;
4371 	if (type != LAST_NORM)
4372 		goto exit2;
4373 
4374 	error = mnt_want_write(path.mnt);
4375 	if (error)
4376 		goto exit2;
4377 retry_deleg:
4378 	inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
4379 	dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags);
4380 	error = PTR_ERR(dentry);
4381 	if (!IS_ERR(dentry)) {
4382 
4383 		/* Why not before? Because we want correct error value */
4384 		if (last.name[last.len])
4385 			goto slashes;
4386 		inode = dentry->d_inode;
4387 		if (d_is_negative(dentry))
4388 			goto slashes;
4389 		ihold(inode);
4390 		error = security_path_unlink(&path, dentry);
4391 		if (error)
4392 			goto exit3;
4393 		error = vfs_unlink(mnt_idmap(path.mnt), path.dentry->d_inode,
4394 				   dentry, &delegated_inode);
4395 exit3:
4396 		dput(dentry);
4397 	}
4398 	inode_unlock(path.dentry->d_inode);
4399 	if (inode)
4400 		iput(inode);	/* truncate the inode here */
4401 	inode = NULL;
4402 	if (delegated_inode) {
4403 		error = break_deleg_wait(&delegated_inode);
4404 		if (!error)
4405 			goto retry_deleg;
4406 	}
4407 	mnt_drop_write(path.mnt);
4408 exit2:
4409 	path_put(&path);
4410 	if (retry_estale(error, lookup_flags)) {
4411 		lookup_flags |= LOOKUP_REVAL;
4412 		inode = NULL;
4413 		goto retry;
4414 	}
4415 exit1:
4416 	putname(name);
4417 	return error;
4418 
4419 slashes:
4420 	if (d_is_negative(dentry))
4421 		error = -ENOENT;
4422 	else if (d_is_dir(dentry))
4423 		error = -EISDIR;
4424 	else
4425 		error = -ENOTDIR;
4426 	goto exit3;
4427 }
4428 
SYSCALL_DEFINE3(unlinkat,int,dfd,const char __user *,pathname,int,flag)4429 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
4430 {
4431 	if ((flag & ~AT_REMOVEDIR) != 0)
4432 		return -EINVAL;
4433 
4434 	if (flag & AT_REMOVEDIR)
4435 		return do_rmdir(dfd, getname(pathname));
4436 	return do_unlinkat(dfd, getname(pathname));
4437 }
4438 
SYSCALL_DEFINE1(unlink,const char __user *,pathname)4439 SYSCALL_DEFINE1(unlink, const char __user *, pathname)
4440 {
4441 	return do_unlinkat(AT_FDCWD, getname(pathname));
4442 }
4443 
4444 /**
4445  * vfs_symlink - create symlink
4446  * @idmap:	idmap of the mount the inode was found from
4447  * @dir:	inode of @dentry
4448  * @dentry:	pointer to dentry of the base directory
4449  * @oldname:	name of the file to link to
4450  *
4451  * Create a symlink.
4452  *
4453  * If the inode has been found through an idmapped mount the idmap of
4454  * the vfsmount must be passed through @idmap. This function will then take
4455  * care to map the inode according to @idmap before checking permissions.
4456  * On non-idmapped mounts or if permission checking is to be performed on the
4457  * raw inode simply passs @nop_mnt_idmap.
4458  */
vfs_symlink(struct mnt_idmap * idmap,struct inode * dir,struct dentry * dentry,const char * oldname)4459 int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
4460 		struct dentry *dentry, const char *oldname)
4461 {
4462 	int error;
4463 
4464 	error = may_create(idmap, dir, dentry);
4465 	if (error)
4466 		return error;
4467 
4468 	if (!dir->i_op->symlink)
4469 		return -EPERM;
4470 
4471 	error = security_inode_symlink(dir, dentry, oldname);
4472 	if (error)
4473 		return error;
4474 
4475 	error = dir->i_op->symlink(idmap, dir, dentry, oldname);
4476 	if (!error)
4477 		fsnotify_create(dir, dentry);
4478 	return error;
4479 }
4480 EXPORT_SYMBOL(vfs_symlink);
4481 
do_symlinkat(struct filename * from,int newdfd,struct filename * to)4482 int do_symlinkat(struct filename *from, int newdfd, struct filename *to)
4483 {
4484 	int error;
4485 	struct dentry *dentry;
4486 	struct path path;
4487 	unsigned int lookup_flags = 0;
4488 
4489 	if (IS_ERR(from)) {
4490 		error = PTR_ERR(from);
4491 		goto out_putnames;
4492 	}
4493 retry:
4494 	dentry = filename_create(newdfd, to, &path, lookup_flags);
4495 	error = PTR_ERR(dentry);
4496 	if (IS_ERR(dentry))
4497 		goto out_putnames;
4498 
4499 	error = security_path_symlink(&path, dentry, from->name);
4500 	if (!error)
4501 		error = vfs_symlink(mnt_idmap(path.mnt), path.dentry->d_inode,
4502 				    dentry, from->name);
4503 	done_path_create(&path, dentry);
4504 	if (retry_estale(error, lookup_flags)) {
4505 		lookup_flags |= LOOKUP_REVAL;
4506 		goto retry;
4507 	}
4508 out_putnames:
4509 	putname(to);
4510 	putname(from);
4511 	return error;
4512 }
4513 
SYSCALL_DEFINE3(symlinkat,const char __user *,oldname,int,newdfd,const char __user *,newname)4514 SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
4515 		int, newdfd, const char __user *, newname)
4516 {
4517 	return do_symlinkat(getname(oldname), newdfd, getname(newname));
4518 }
4519 
SYSCALL_DEFINE2(symlink,const char __user *,oldname,const char __user *,newname)4520 SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
4521 {
4522 	return do_symlinkat(getname(oldname), AT_FDCWD, getname(newname));
4523 }
4524 
4525 /**
4526  * vfs_link - create a new link
4527  * @old_dentry:	object to be linked
4528  * @idmap:	idmap of the mount
4529  * @dir:	new parent
4530  * @new_dentry:	where to create the new link
4531  * @delegated_inode: returns inode needing a delegation break
4532  *
4533  * The caller must hold dir->i_mutex
4534  *
4535  * If vfs_link discovers a delegation on the to-be-linked file in need
4536  * of breaking, it will return -EWOULDBLOCK and return a reference to the
4537  * inode in delegated_inode.  The caller should then break the delegation
4538  * and retry.  Because breaking a delegation may take a long time, the
4539  * caller should drop the i_mutex before doing so.
4540  *
4541  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4542  * be appropriate for callers that expect the underlying filesystem not
4543  * to be NFS exported.
4544  *
4545  * If the inode has been found through an idmapped mount the idmap of
4546  * the vfsmount must be passed through @idmap. This function will then take
4547  * care to map the inode according to @idmap before checking permissions.
4548  * On non-idmapped mounts or if permission checking is to be performed on the
4549  * raw inode simply passs @nop_mnt_idmap.
4550  */
vfs_link(struct dentry * old_dentry,struct mnt_idmap * idmap,struct inode * dir,struct dentry * new_dentry,struct inode ** delegated_inode)4551 int vfs_link(struct dentry *old_dentry, struct mnt_idmap *idmap,
4552 	     struct inode *dir, struct dentry *new_dentry,
4553 	     struct inode **delegated_inode)
4554 {
4555 	struct inode *inode = old_dentry->d_inode;
4556 	unsigned max_links = dir->i_sb->s_max_links;
4557 	int error;
4558 
4559 	if (!inode)
4560 		return -ENOENT;
4561 
4562 	error = may_create(idmap, dir, new_dentry);
4563 	if (error)
4564 		return error;
4565 
4566 	if (dir->i_sb != inode->i_sb)
4567 		return -EXDEV;
4568 
4569 	/*
4570 	 * A link to an append-only or immutable file cannot be created.
4571 	 */
4572 	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
4573 		return -EPERM;
4574 	/*
4575 	 * Updating the link count will likely cause i_uid and i_gid to
4576 	 * be writen back improperly if their true value is unknown to
4577 	 * the vfs.
4578 	 */
4579 	if (HAS_UNMAPPED_ID(idmap, inode))
4580 		return -EPERM;
4581 	if (!dir->i_op->link)
4582 		return -EPERM;
4583 	if (S_ISDIR(inode->i_mode))
4584 		return -EPERM;
4585 
4586 	error = security_inode_link(old_dentry, dir, new_dentry);
4587 	if (error)
4588 		return error;
4589 
4590 	inode_lock(inode);
4591 	/* Make sure we don't allow creating hardlink to an unlinked file */
4592 	if (inode->i_nlink == 0 && !(inode->i_state & I_LINKABLE))
4593 		error =  -ENOENT;
4594 	else if (max_links && inode->i_nlink >= max_links)
4595 		error = -EMLINK;
4596 	else {
4597 		error = try_break_deleg(inode, delegated_inode);
4598 		if (!error)
4599 			error = dir->i_op->link(old_dentry, dir, new_dentry);
4600 	}
4601 
4602 	if (!error && (inode->i_state & I_LINKABLE)) {
4603 		spin_lock(&inode->i_lock);
4604 		inode->i_state &= ~I_LINKABLE;
4605 		spin_unlock(&inode->i_lock);
4606 	}
4607 	inode_unlock(inode);
4608 	if (!error)
4609 		fsnotify_link(dir, inode, new_dentry);
4610 	return error;
4611 }
4612 EXPORT_SYMBOL(vfs_link);
4613 
4614 /*
4615  * Hardlinks are often used in delicate situations.  We avoid
4616  * security-related surprises by not following symlinks on the
4617  * newname.  --KAB
4618  *
4619  * We don't follow them on the oldname either to be compatible
4620  * with linux 2.0, and to avoid hard-linking to directories
4621  * and other special files.  --ADM
4622  */
do_linkat(int olddfd,struct filename * old,int newdfd,struct filename * new,int flags)4623 int do_linkat(int olddfd, struct filename *old, int newdfd,
4624 	      struct filename *new, int flags)
4625 {
4626 	struct mnt_idmap *idmap;
4627 	struct dentry *new_dentry;
4628 	struct path old_path, new_path;
4629 	struct inode *delegated_inode = NULL;
4630 	int how = 0;
4631 	int error;
4632 
4633 	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0) {
4634 		error = -EINVAL;
4635 		goto out_putnames;
4636 	}
4637 	/*
4638 	 * To use null names we require CAP_DAC_READ_SEARCH
4639 	 * This ensures that not everyone will be able to create
4640 	 * handlink using the passed filedescriptor.
4641 	 */
4642 	if (flags & AT_EMPTY_PATH && !capable(CAP_DAC_READ_SEARCH)) {
4643 		error = -ENOENT;
4644 		goto out_putnames;
4645 	}
4646 
4647 	if (flags & AT_SYMLINK_FOLLOW)
4648 		how |= LOOKUP_FOLLOW;
4649 retry:
4650 	error = filename_lookup(olddfd, old, how, &old_path, NULL);
4651 	if (error)
4652 		goto out_putnames;
4653 
4654 	new_dentry = filename_create(newdfd, new, &new_path,
4655 					(how & LOOKUP_REVAL));
4656 	error = PTR_ERR(new_dentry);
4657 	if (IS_ERR(new_dentry))
4658 		goto out_putpath;
4659 
4660 	error = -EXDEV;
4661 	if (old_path.mnt != new_path.mnt)
4662 		goto out_dput;
4663 	idmap = mnt_idmap(new_path.mnt);
4664 	error = may_linkat(idmap, &old_path);
4665 	if (unlikely(error))
4666 		goto out_dput;
4667 	error = security_path_link(old_path.dentry, &new_path, new_dentry);
4668 	if (error)
4669 		goto out_dput;
4670 	error = vfs_link(old_path.dentry, idmap, new_path.dentry->d_inode,
4671 			 new_dentry, &delegated_inode);
4672 out_dput:
4673 	done_path_create(&new_path, new_dentry);
4674 	if (delegated_inode) {
4675 		error = break_deleg_wait(&delegated_inode);
4676 		if (!error) {
4677 			path_put(&old_path);
4678 			goto retry;
4679 		}
4680 	}
4681 	if (retry_estale(error, how)) {
4682 		path_put(&old_path);
4683 		how |= LOOKUP_REVAL;
4684 		goto retry;
4685 	}
4686 out_putpath:
4687 	path_put(&old_path);
4688 out_putnames:
4689 	putname(old);
4690 	putname(new);
4691 
4692 	return error;
4693 }
4694 
SYSCALL_DEFINE5(linkat,int,olddfd,const char __user *,oldname,int,newdfd,const char __user *,newname,int,flags)4695 SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
4696 		int, newdfd, const char __user *, newname, int, flags)
4697 {
4698 	return do_linkat(olddfd, getname_uflags(oldname, flags),
4699 		newdfd, getname(newname), flags);
4700 }
4701 
SYSCALL_DEFINE2(link,const char __user *,oldname,const char __user *,newname)4702 SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
4703 {
4704 	return do_linkat(AT_FDCWD, getname(oldname), AT_FDCWD, getname(newname), 0);
4705 }
4706 
4707 /**
4708  * vfs_rename - rename a filesystem object
4709  * @rd:		pointer to &struct renamedata info
4710  *
4711  * The caller must hold multiple mutexes--see lock_rename()).
4712  *
4713  * If vfs_rename discovers a delegation in need of breaking at either
4714  * the source or destination, it will return -EWOULDBLOCK and return a
4715  * reference to the inode in delegated_inode.  The caller should then
4716  * break the delegation and retry.  Because breaking a delegation may
4717  * take a long time, the caller should drop all locks before doing
4718  * so.
4719  *
4720  * Alternatively, a caller may pass NULL for delegated_inode.  This may
4721  * be appropriate for callers that expect the underlying filesystem not
4722  * to be NFS exported.
4723  *
4724  * The worst of all namespace operations - renaming directory. "Perverted"
4725  * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
4726  * Problems:
4727  *
4728  *	a) we can get into loop creation.
4729  *	b) race potential - two innocent renames can create a loop together.
4730  *	   That's where 4.4BSD screws up. Current fix: serialization on
4731  *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
4732  *	   story.
4733  *	c) we may have to lock up to _four_ objects - parents and victim (if it exists),
4734  *	   and source (if it's a non-directory or a subdirectory that moves to
4735  *	   different parent).
4736  *	   And that - after we got ->i_mutex on parents (until then we don't know
4737  *	   whether the target exists).  Solution: try to be smart with locking
4738  *	   order for inodes.  We rely on the fact that tree topology may change
4739  *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
4740  *	   move will be locked.  Thus we can rank directories by the tree
4741  *	   (ancestors first) and rank all non-directories after them.
4742  *	   That works since everybody except rename does "lock parent, lookup,
4743  *	   lock child" and rename is under ->s_vfs_rename_mutex.
4744  *	   HOWEVER, it relies on the assumption that any object with ->lookup()
4745  *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
4746  *	   we'd better make sure that there's no link(2) for them.
4747  *	d) conversion from fhandle to dentry may come in the wrong moment - when
4748  *	   we are removing the target. Solution: we will have to grab ->i_mutex
4749  *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
4750  *	   ->i_mutex on parents, which works but leads to some truly excessive
4751  *	   locking].
4752  */
vfs_rename(struct renamedata * rd)4753 int vfs_rename(struct renamedata *rd)
4754 {
4755 	int error;
4756 	struct inode *old_dir = rd->old_dir, *new_dir = rd->new_dir;
4757 	struct dentry *old_dentry = rd->old_dentry;
4758 	struct dentry *new_dentry = rd->new_dentry;
4759 	struct inode **delegated_inode = rd->delegated_inode;
4760 	unsigned int flags = rd->flags;
4761 	bool is_dir = d_is_dir(old_dentry);
4762 	struct inode *source = old_dentry->d_inode;
4763 	struct inode *target = new_dentry->d_inode;
4764 	bool new_is_dir = false;
4765 	unsigned max_links = new_dir->i_sb->s_max_links;
4766 	struct name_snapshot old_name;
4767 	bool lock_old_subdir, lock_new_subdir;
4768 
4769 	if (source == target)
4770 		return 0;
4771 
4772 	error = may_delete(rd->old_mnt_idmap, old_dir, old_dentry, is_dir);
4773 	if (error)
4774 		return error;
4775 
4776 	if (!target) {
4777 		error = may_create(rd->new_mnt_idmap, new_dir, new_dentry);
4778 	} else {
4779 		new_is_dir = d_is_dir(new_dentry);
4780 
4781 		if (!(flags & RENAME_EXCHANGE))
4782 			error = may_delete(rd->new_mnt_idmap, new_dir,
4783 					   new_dentry, is_dir);
4784 		else
4785 			error = may_delete(rd->new_mnt_idmap, new_dir,
4786 					   new_dentry, new_is_dir);
4787 	}
4788 	if (error)
4789 		return error;
4790 
4791 	if (!old_dir->i_op->rename)
4792 		return -EPERM;
4793 
4794 	/*
4795 	 * If we are going to change the parent - check write permissions,
4796 	 * we'll need to flip '..'.
4797 	 */
4798 	if (new_dir != old_dir) {
4799 		if (is_dir) {
4800 			error = inode_permission(rd->old_mnt_idmap, source,
4801 						 MAY_WRITE);
4802 			if (error)
4803 				return error;
4804 		}
4805 		if ((flags & RENAME_EXCHANGE) && new_is_dir) {
4806 			error = inode_permission(rd->new_mnt_idmap, target,
4807 						 MAY_WRITE);
4808 			if (error)
4809 				return error;
4810 		}
4811 	}
4812 
4813 	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
4814 				      flags);
4815 	if (error)
4816 		return error;
4817 
4818 	take_dentry_name_snapshot(&old_name, old_dentry);
4819 	dget(new_dentry);
4820 	/*
4821 	 * Lock children.
4822 	 * The source subdirectory needs to be locked on cross-directory
4823 	 * rename or cross-directory exchange since its parent changes.
4824 	 * The target subdirectory needs to be locked on cross-directory
4825 	 * exchange due to parent change and on any rename due to becoming
4826 	 * a victim.
4827 	 * Non-directories need locking in all cases (for NFS reasons);
4828 	 * they get locked after any subdirectories (in inode address order).
4829 	 *
4830 	 * NOTE: WE ONLY LOCK UNRELATED DIRECTORIES IN CROSS-DIRECTORY CASE.
4831 	 * NEVER, EVER DO THAT WITHOUT ->s_vfs_rename_mutex.
4832 	 */
4833 	lock_old_subdir = new_dir != old_dir;
4834 	lock_new_subdir = new_dir != old_dir || !(flags & RENAME_EXCHANGE);
4835 	if (is_dir) {
4836 		if (lock_old_subdir)
4837 			inode_lock_nested(source, I_MUTEX_CHILD);
4838 		if (target && (!new_is_dir || lock_new_subdir))
4839 			inode_lock(target);
4840 	} else if (new_is_dir) {
4841 		if (lock_new_subdir)
4842 			inode_lock_nested(target, I_MUTEX_CHILD);
4843 		inode_lock(source);
4844 	} else {
4845 		lock_two_nondirectories(source, target);
4846 	}
4847 
4848 	error = -EPERM;
4849 	if (IS_SWAPFILE(source) || (target && IS_SWAPFILE(target)))
4850 		goto out;
4851 
4852 	error = -EBUSY;
4853 	if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
4854 		goto out;
4855 
4856 	if (max_links && new_dir != old_dir) {
4857 		error = -EMLINK;
4858 		if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
4859 			goto out;
4860 		if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
4861 		    old_dir->i_nlink >= max_links)
4862 			goto out;
4863 	}
4864 	if (!is_dir) {
4865 		error = try_break_deleg(source, delegated_inode);
4866 		if (error)
4867 			goto out;
4868 	}
4869 	if (target && !new_is_dir) {
4870 		error = try_break_deleg(target, delegated_inode);
4871 		if (error)
4872 			goto out;
4873 	}
4874 	error = old_dir->i_op->rename(rd->new_mnt_idmap, old_dir, old_dentry,
4875 				      new_dir, new_dentry, flags);
4876 	if (error)
4877 		goto out;
4878 
4879 	if (!(flags & RENAME_EXCHANGE) && target) {
4880 		if (is_dir) {
4881 			shrink_dcache_parent(new_dentry);
4882 			target->i_flags |= S_DEAD;
4883 		}
4884 		dont_mount(new_dentry);
4885 		detach_mounts(new_dentry);
4886 	}
4887 	if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
4888 		if (!(flags & RENAME_EXCHANGE))
4889 			d_move(old_dentry, new_dentry);
4890 		else
4891 			d_exchange(old_dentry, new_dentry);
4892 	}
4893 out:
4894 	if (!is_dir || lock_old_subdir)
4895 		inode_unlock(source);
4896 	if (target && (!new_is_dir || lock_new_subdir))
4897 		inode_unlock(target);
4898 	dput(new_dentry);
4899 	if (!error) {
4900 		fsnotify_move(old_dir, new_dir, &old_name.name, is_dir,
4901 			      !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
4902 		if (flags & RENAME_EXCHANGE) {
4903 			fsnotify_move(new_dir, old_dir, &old_dentry->d_name,
4904 				      new_is_dir, NULL, new_dentry);
4905 		}
4906 	}
4907 	release_dentry_name_snapshot(&old_name);
4908 
4909 	return error;
4910 }
4911 EXPORT_SYMBOL(vfs_rename);
4912 
do_renameat2(int olddfd,struct filename * from,int newdfd,struct filename * to,unsigned int flags)4913 int do_renameat2(int olddfd, struct filename *from, int newdfd,
4914 		 struct filename *to, unsigned int flags)
4915 {
4916 	struct renamedata rd;
4917 	struct dentry *old_dentry, *new_dentry;
4918 	struct dentry *trap;
4919 	struct path old_path, new_path;
4920 	struct qstr old_last, new_last;
4921 	int old_type, new_type;
4922 	struct inode *delegated_inode = NULL;
4923 	unsigned int lookup_flags = 0, target_flags = LOOKUP_RENAME_TARGET;
4924 	bool should_retry = false;
4925 	int error = -EINVAL;
4926 
4927 	if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
4928 		goto put_names;
4929 
4930 	if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
4931 	    (flags & RENAME_EXCHANGE))
4932 		goto put_names;
4933 
4934 	if (flags & RENAME_EXCHANGE)
4935 		target_flags = 0;
4936 
4937 retry:
4938 	error = filename_parentat(olddfd, from, lookup_flags, &old_path,
4939 				  &old_last, &old_type);
4940 	if (error)
4941 		goto put_names;
4942 
4943 	error = filename_parentat(newdfd, to, lookup_flags, &new_path, &new_last,
4944 				  &new_type);
4945 	if (error)
4946 		goto exit1;
4947 
4948 	error = -EXDEV;
4949 	if (old_path.mnt != new_path.mnt)
4950 		goto exit2;
4951 
4952 	error = -EBUSY;
4953 	if (old_type != LAST_NORM)
4954 		goto exit2;
4955 
4956 	if (flags & RENAME_NOREPLACE)
4957 		error = -EEXIST;
4958 	if (new_type != LAST_NORM)
4959 		goto exit2;
4960 
4961 	error = mnt_want_write(old_path.mnt);
4962 	if (error)
4963 		goto exit2;
4964 
4965 retry_deleg:
4966 	trap = lock_rename(new_path.dentry, old_path.dentry);
4967 
4968 	old_dentry = lookup_one_qstr_excl(&old_last, old_path.dentry,
4969 					  lookup_flags);
4970 	error = PTR_ERR(old_dentry);
4971 	if (IS_ERR(old_dentry))
4972 		goto exit3;
4973 	/* source must exist */
4974 	error = -ENOENT;
4975 	if (d_is_negative(old_dentry))
4976 		goto exit4;
4977 	new_dentry = lookup_one_qstr_excl(&new_last, new_path.dentry,
4978 					  lookup_flags | target_flags);
4979 	error = PTR_ERR(new_dentry);
4980 	if (IS_ERR(new_dentry))
4981 		goto exit4;
4982 	error = -EEXIST;
4983 	if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry))
4984 		goto exit5;
4985 	if (flags & RENAME_EXCHANGE) {
4986 		error = -ENOENT;
4987 		if (d_is_negative(new_dentry))
4988 			goto exit5;
4989 
4990 		if (!d_is_dir(new_dentry)) {
4991 			error = -ENOTDIR;
4992 			if (new_last.name[new_last.len])
4993 				goto exit5;
4994 		}
4995 	}
4996 	/* unless the source is a directory trailing slashes give -ENOTDIR */
4997 	if (!d_is_dir(old_dentry)) {
4998 		error = -ENOTDIR;
4999 		if (old_last.name[old_last.len])
5000 			goto exit5;
5001 		if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
5002 			goto exit5;
5003 	}
5004 	/* source should not be ancestor of target */
5005 	error = -EINVAL;
5006 	if (old_dentry == trap)
5007 		goto exit5;
5008 	/* target should not be an ancestor of source */
5009 	if (!(flags & RENAME_EXCHANGE))
5010 		error = -ENOTEMPTY;
5011 	if (new_dentry == trap)
5012 		goto exit5;
5013 
5014 	error = security_path_rename(&old_path, old_dentry,
5015 				     &new_path, new_dentry, flags);
5016 	if (error)
5017 		goto exit5;
5018 
5019 	rd.old_dir	   = old_path.dentry->d_inode;
5020 	rd.old_dentry	   = old_dentry;
5021 	rd.old_mnt_idmap   = mnt_idmap(old_path.mnt);
5022 	rd.new_dir	   = new_path.dentry->d_inode;
5023 	rd.new_dentry	   = new_dentry;
5024 	rd.new_mnt_idmap   = mnt_idmap(new_path.mnt);
5025 	rd.delegated_inode = &delegated_inode;
5026 	rd.flags	   = flags;
5027 	error = vfs_rename(&rd);
5028 exit5:
5029 	dput(new_dentry);
5030 exit4:
5031 	dput(old_dentry);
5032 exit3:
5033 	unlock_rename(new_path.dentry, old_path.dentry);
5034 	if (delegated_inode) {
5035 		error = break_deleg_wait(&delegated_inode);
5036 		if (!error)
5037 			goto retry_deleg;
5038 	}
5039 	mnt_drop_write(old_path.mnt);
5040 exit2:
5041 	if (retry_estale(error, lookup_flags))
5042 		should_retry = true;
5043 	path_put(&new_path);
5044 exit1:
5045 	path_put(&old_path);
5046 	if (should_retry) {
5047 		should_retry = false;
5048 		lookup_flags |= LOOKUP_REVAL;
5049 		goto retry;
5050 	}
5051 put_names:
5052 	putname(from);
5053 	putname(to);
5054 	return error;
5055 }
5056 
SYSCALL_DEFINE5(renameat2,int,olddfd,const char __user *,oldname,int,newdfd,const char __user *,newname,unsigned int,flags)5057 SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
5058 		int, newdfd, const char __user *, newname, unsigned int, flags)
5059 {
5060 	return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname),
5061 				flags);
5062 }
5063 
SYSCALL_DEFINE4(renameat,int,olddfd,const char __user *,oldname,int,newdfd,const char __user *,newname)5064 SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
5065 		int, newdfd, const char __user *, newname)
5066 {
5067 	return do_renameat2(olddfd, getname(oldname), newdfd, getname(newname),
5068 				0);
5069 }
5070 
SYSCALL_DEFINE2(rename,const char __user *,oldname,const char __user *,newname)5071 SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
5072 {
5073 	return do_renameat2(AT_FDCWD, getname(oldname), AT_FDCWD,
5074 				getname(newname), 0);
5075 }
5076 
readlink_copy(char __user * buffer,int buflen,const char * link)5077 int readlink_copy(char __user *buffer, int buflen, const char *link)
5078 {
5079 	int len = PTR_ERR(link);
5080 	if (IS_ERR(link))
5081 		goto out;
5082 
5083 	len = strlen(link);
5084 	if (len > (unsigned) buflen)
5085 		len = buflen;
5086 	if (copy_to_user(buffer, link, len))
5087 		len = -EFAULT;
5088 out:
5089 	return len;
5090 }
5091 
5092 /**
5093  * vfs_readlink - copy symlink body into userspace buffer
5094  * @dentry: dentry on which to get symbolic link
5095  * @buffer: user memory pointer
5096  * @buflen: size of buffer
5097  *
5098  * Does not touch atime.  That's up to the caller if necessary
5099  *
5100  * Does not call security hook.
5101  */
vfs_readlink(struct dentry * dentry,char __user * buffer,int buflen)5102 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
5103 {
5104 	struct inode *inode = d_inode(dentry);
5105 	DEFINE_DELAYED_CALL(done);
5106 	const char *link;
5107 	int res;
5108 
5109 	if (unlikely(!(inode->i_opflags & IOP_DEFAULT_READLINK))) {
5110 		if (unlikely(inode->i_op->readlink))
5111 			return inode->i_op->readlink(dentry, buffer, buflen);
5112 
5113 		if (!d_is_symlink(dentry))
5114 			return -EINVAL;
5115 
5116 		spin_lock(&inode->i_lock);
5117 		inode->i_opflags |= IOP_DEFAULT_READLINK;
5118 		spin_unlock(&inode->i_lock);
5119 	}
5120 
5121 	link = READ_ONCE(inode->i_link);
5122 	if (!link) {
5123 		link = inode->i_op->get_link(dentry, inode, &done);
5124 		if (IS_ERR(link))
5125 			return PTR_ERR(link);
5126 	}
5127 	res = readlink_copy(buffer, buflen, link);
5128 	do_delayed_call(&done);
5129 	return res;
5130 }
5131 EXPORT_SYMBOL(vfs_readlink);
5132 
5133 /**
5134  * vfs_get_link - get symlink body
5135  * @dentry: dentry on which to get symbolic link
5136  * @done: caller needs to free returned data with this
5137  *
5138  * Calls security hook and i_op->get_link() on the supplied inode.
5139  *
5140  * It does not touch atime.  That's up to the caller if necessary.
5141  *
5142  * Does not work on "special" symlinks like /proc/$$/fd/N
5143  */
vfs_get_link(struct dentry * dentry,struct delayed_call * done)5144 const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
5145 {
5146 	const char *res = ERR_PTR(-EINVAL);
5147 	struct inode *inode = d_inode(dentry);
5148 
5149 	if (d_is_symlink(dentry)) {
5150 		res = ERR_PTR(security_inode_readlink(dentry));
5151 		if (!res)
5152 			res = inode->i_op->get_link(dentry, inode, done);
5153 	}
5154 	return res;
5155 }
5156 EXPORT_SYMBOL(vfs_get_link);
5157 
5158 /* get the link contents into pagecache */
page_get_link(struct dentry * dentry,struct inode * inode,struct delayed_call * callback)5159 const char *page_get_link(struct dentry *dentry, struct inode *inode,
5160 			  struct delayed_call *callback)
5161 {
5162 	char *kaddr;
5163 	struct page *page;
5164 	struct address_space *mapping = inode->i_mapping;
5165 
5166 	if (!dentry) {
5167 		page = find_get_page(mapping, 0);
5168 		if (!page)
5169 			return ERR_PTR(-ECHILD);
5170 		if (!PageUptodate(page)) {
5171 			put_page(page);
5172 			return ERR_PTR(-ECHILD);
5173 		}
5174 	} else {
5175 		page = read_mapping_page(mapping, 0, NULL);
5176 		if (IS_ERR(page))
5177 			return (char*)page;
5178 	}
5179 	set_delayed_call(callback, page_put_link, page);
5180 	BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
5181 	kaddr = page_address(page);
5182 	nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
5183 	return kaddr;
5184 }
5185 
5186 EXPORT_SYMBOL(page_get_link);
5187 
page_put_link(void * arg)5188 void page_put_link(void *arg)
5189 {
5190 	put_page(arg);
5191 }
5192 EXPORT_SYMBOL(page_put_link);
5193 
page_readlink(struct dentry * dentry,char __user * buffer,int buflen)5194 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
5195 {
5196 	DEFINE_DELAYED_CALL(done);
5197 	int res = readlink_copy(buffer, buflen,
5198 				page_get_link(dentry, d_inode(dentry),
5199 					      &done));
5200 	do_delayed_call(&done);
5201 	return res;
5202 }
5203 EXPORT_SYMBOL(page_readlink);
5204 
page_symlink(struct inode * inode,const char * symname,int len)5205 int page_symlink(struct inode *inode, const char *symname, int len)
5206 {
5207 	struct address_space *mapping = inode->i_mapping;
5208 	const struct address_space_operations *aops = mapping->a_ops;
5209 	bool nofs = !mapping_gfp_constraint(mapping, __GFP_FS);
5210 	struct page *page;
5211 	void *fsdata = NULL;
5212 	int err;
5213 	unsigned int flags;
5214 
5215 retry:
5216 	if (nofs)
5217 		flags = memalloc_nofs_save();
5218 	err = aops->write_begin(NULL, mapping, 0, len-1, &page, &fsdata);
5219 	if (nofs)
5220 		memalloc_nofs_restore(flags);
5221 	if (err)
5222 		goto fail;
5223 
5224 	memcpy(page_address(page), symname, len-1);
5225 
5226 	err = aops->write_end(NULL, mapping, 0, len-1, len-1,
5227 							page, fsdata);
5228 	if (err < 0)
5229 		goto fail;
5230 	if (err < len-1)
5231 		goto retry;
5232 
5233 	mark_inode_dirty(inode);
5234 	return 0;
5235 fail:
5236 	return err;
5237 }
5238 EXPORT_SYMBOL(page_symlink);
5239 
5240 const struct inode_operations page_symlink_inode_operations = {
5241 	.get_link	= page_get_link,
5242 };
5243 EXPORT_SYMBOL(page_symlink_inode_operations);
5244