Merge tag 'v3.10.55' into update
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / fs / namei.c
1 /*
2 * linux/fs/namei.c
3 *
4 * Copyright (C) 1991, 1992 Linus Torvalds
5 */
6
7 /*
8 * Some corrections by tytso.
9 */
10
11 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
12 * lookup logic.
13 */
14 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
15 */
16
17 #include <linux/init.h>
18 #include <linux/export.h>
19 #include <linux/kernel.h>
20 #include <linux/slab.h>
21 #include <linux/fs.h>
22 #include <linux/namei.h>
23 #include <linux/pagemap.h>
24 #include <linux/fsnotify.h>
25 #include <linux/personality.h>
26 #include <linux/security.h>
27 #include <linux/ima.h>
28 #include <linux/syscalls.h>
29 #include <linux/mount.h>
30 #include <linux/audit.h>
31 #include <linux/capability.h>
32 #include <linux/file.h>
33 #include <linux/fcntl.h>
34 #include <linux/device_cgroup.h>
35 #include <linux/fs_struct.h>
36 #include <linux/posix_acl.h>
37 #include <linux/hash.h>
38 #include <asm/uaccess.h>
39
40 #include "internal.h"
41 #include "mount.h"
42
43 /* [Feb-1997 T. Schoebel-Theuer]
44 * Fundamental changes in the pathname lookup mechanisms (namei)
45 * were necessary because of omirr. The reason is that omirr needs
46 * to know the _real_ pathname, not the user-supplied one, in case
47 * of symlinks (and also when transname replacements occur).
48 *
49 * The new code replaces the old recursive symlink resolution with
50 * an iterative one (in case of non-nested symlink chains). It does
51 * this with calls to <fs>_follow_link().
52 * As a side effect, dir_namei(), _namei() and follow_link() are now
53 * replaced with a single function lookup_dentry() that can handle all
54 * the special cases of the former code.
55 *
56 * With the new dcache, the pathname is stored at each inode, at least as
57 * long as the refcount of the inode is positive. As a side effect, the
58 * size of the dcache depends on the inode cache and thus is dynamic.
59 *
60 * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
61 * resolution to correspond with current state of the code.
62 *
63 * Note that the symlink resolution is not *completely* iterative.
64 * There is still a significant amount of tail- and mid- recursion in
65 * the algorithm. Also, note that <fs>_readlink() is not used in
66 * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
67 * may return different results than <fs>_follow_link(). Many virtual
68 * filesystems (including /proc) exhibit this behavior.
69 */
70
71 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
72 * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
73 * and the name already exists in form of a symlink, try to create the new
74 * name indicated by the symlink. The old code always complained that the
75 * name already exists, due to not following the symlink even if its target
76 * is nonexistent. The new semantics affects also mknod() and link() when
77 * the name is a symlink pointing to a non-existent name.
78 *
79 * I don't know which semantics is the right one, since I have no access
80 * to standards. But I found by trial that HP-UX 9.0 has the full "new"
81 * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
82 * "old" one. Personally, I think the new semantics is much more logical.
83 * Note that "ln old new" where "new" is a symlink pointing to a non-existing
84 * file does succeed in both HP-UX and SunOs, but not in Solaris
85 * and in the old Linux semantics.
86 */
87
88 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
89 * semantics. See the comments in "open_namei" and "do_link" below.
90 *
91 * [10-Sep-98 Alan Modra] Another symlink change.
92 */
93
94 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
95 * inside the path - always follow.
96 * in the last component in creation/removal/renaming - never follow.
97 * if LOOKUP_FOLLOW passed - follow.
98 * if the pathname has trailing slashes - follow.
99 * otherwise - don't follow.
100 * (applied in that order).
101 *
102 * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
103 * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
104 * During the 2.4 we need to fix the userland stuff depending on it -
105 * hopefully we will be able to get rid of that wart in 2.5. So far only
106 * XEmacs seems to be relying on it...
107 */
108 /*
109 * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
110 * implemented. Let's see if raised priority of ->s_vfs_rename_mutex gives
111 * any extra contention...
112 */
113
114 /* In order to reduce some races, while at the same time doing additional
115 * checking and hopefully speeding things up, we copy filenames to the
116 * kernel data space before using them..
117 *
118 * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
119 * PATH_MAX includes the nul terminator --RR.
120 */
121 void final_putname(struct filename *name)
122 {
123 if (name->separate) {
124 __putname(name->name);
125 kfree(name);
126 } else {
127 __putname(name);
128 }
129 }
130
131 #define EMBEDDED_NAME_MAX (PATH_MAX - sizeof(struct filename))
132
133 static struct filename *
134 getname_flags(const char __user *filename, int flags, int *empty)
135 {
136 struct filename *result, *err;
137 int len;
138 long max;
139 char *kname;
140
141 result = audit_reusename(filename);
142 if (result)
143 return result;
144
145 result = __getname();
146 if (unlikely(!result))
147 return ERR_PTR(-ENOMEM);
148
149 /*
150 * First, try to embed the struct filename inside the names_cache
151 * allocation
152 */
153 kname = (char *)result + sizeof(*result);
154 result->name = kname;
155 result->separate = false;
156 max = EMBEDDED_NAME_MAX;
157
158 recopy:
159 len = strncpy_from_user(kname, filename, max);
160 if (unlikely(len < 0)) {
161 err = ERR_PTR(len);
162 goto error;
163 }
164
165 /*
166 * Uh-oh. We have a name that's approaching PATH_MAX. Allocate a
167 * separate struct filename so we can dedicate the entire
168 * names_cache allocation for the pathname, and re-do the copy from
169 * userland.
170 */
171 if (len == EMBEDDED_NAME_MAX && max == EMBEDDED_NAME_MAX) {
172 kname = (char *)result;
173
174 result = kzalloc(sizeof(*result), GFP_KERNEL);
175 if (!result) {
176 err = ERR_PTR(-ENOMEM);
177 result = (struct filename *)kname;
178 goto error;
179 }
180 result->name = kname;
181 result->separate = true;
182 max = PATH_MAX;
183 goto recopy;
184 }
185
186 /* The empty path is special. */
187 if (unlikely(!len)) {
188 if (empty)
189 *empty = 1;
190 err = ERR_PTR(-ENOENT);
191 if (!(flags & LOOKUP_EMPTY))
192 goto error;
193 }
194
195 err = ERR_PTR(-ENAMETOOLONG);
196 if (unlikely(len >= PATH_MAX))
197 goto error;
198
199 result->uptr = filename;
200 audit_getname(result);
201 return result;
202
203 error:
204 final_putname(result);
205 return err;
206 }
207
208 struct filename *
209 getname(const char __user * filename)
210 {
211 return getname_flags(filename, 0, NULL);
212 }
213 EXPORT_SYMBOL(getname);
214
215 #ifdef CONFIG_AUDITSYSCALL
216 void putname(struct filename *name)
217 {
218 if (unlikely(!audit_dummy_context()))
219 return audit_putname(name);
220 final_putname(name);
221 }
222 #endif
223
224 static int check_acl(struct inode *inode, int mask)
225 {
226 #ifdef CONFIG_FS_POSIX_ACL
227 struct posix_acl *acl;
228
229 if (mask & MAY_NOT_BLOCK) {
230 acl = get_cached_acl_rcu(inode, ACL_TYPE_ACCESS);
231 if (!acl)
232 return -EAGAIN;
233 /* no ->get_acl() calls in RCU mode... */
234 if (acl == ACL_NOT_CACHED)
235 return -ECHILD;
236 return posix_acl_permission(inode, acl, mask & ~MAY_NOT_BLOCK);
237 }
238
239 acl = get_cached_acl(inode, ACL_TYPE_ACCESS);
240
241 /*
242 * A filesystem can force a ACL callback by just never filling the
243 * ACL cache. But normally you'd fill the cache either at inode
244 * instantiation time, or on the first ->get_acl call.
245 *
246 * If the filesystem doesn't have a get_acl() function at all, we'll
247 * just create the negative cache entry.
248 */
249 if (acl == ACL_NOT_CACHED) {
250 if (inode->i_op->get_acl) {
251 acl = inode->i_op->get_acl(inode, ACL_TYPE_ACCESS);
252 if (IS_ERR(acl))
253 return PTR_ERR(acl);
254 } else {
255 set_cached_acl(inode, ACL_TYPE_ACCESS, NULL);
256 return -EAGAIN;
257 }
258 }
259
260 if (acl) {
261 int error = posix_acl_permission(inode, acl, mask);
262 posix_acl_release(acl);
263 return error;
264 }
265 #endif
266
267 return -EAGAIN;
268 }
269
270 /*
271 * This does the basic permission checking
272 */
273 static int acl_permission_check(struct inode *inode, int mask)
274 {
275 unsigned int mode = inode->i_mode;
276
277 if (likely(uid_eq(current_fsuid(), inode->i_uid)))
278 mode >>= 6;
279 else {
280 if (IS_POSIXACL(inode) && (mode & S_IRWXG)) {
281 int error = check_acl(inode, mask);
282 if (error != -EAGAIN)
283 return error;
284 }
285
286 if (in_group_p(inode->i_gid))
287 mode >>= 3;
288 }
289
290 /*
291 * If the DACs are ok we don't need any capability check.
292 */
293 if ((mask & ~mode & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
294 return 0;
295 return -EACCES;
296 }
297
298 /**
299 * generic_permission - check for access rights on a Posix-like filesystem
300 * @inode: inode to check access rights for
301 * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC, ...)
302 *
303 * Used to check for read/write/execute permissions on a file.
304 * We use "fsuid" for this, letting us set arbitrary permissions
305 * for filesystem access without changing the "normal" uids which
306 * are used for other things.
307 *
308 * generic_permission is rcu-walk aware. It returns -ECHILD in case an rcu-walk
309 * request cannot be satisfied (eg. requires blocking or too much complexity).
310 * It would then be called again in ref-walk mode.
311 */
312 int generic_permission(struct inode *inode, int mask)
313 {
314 int ret;
315
316 /*
317 * Do the basic permission checks.
318 */
319 ret = acl_permission_check(inode, mask);
320 if (ret != -EACCES)
321 return ret;
322
323 if (S_ISDIR(inode->i_mode)) {
324 /* DACs are overridable for directories */
325 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
326 return 0;
327 if (!(mask & MAY_WRITE))
328 if (capable_wrt_inode_uidgid(inode,
329 CAP_DAC_READ_SEARCH))
330 return 0;
331 return -EACCES;
332 }
333 /*
334 * Read/write DACs are always overridable.
335 * Executable DACs are overridable when there is
336 * at least one exec bit set.
337 */
338 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
339 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
340 return 0;
341
342 /*
343 * Searching includes executable on directories, else just read.
344 */
345 mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
346 if (mask == MAY_READ)
347 if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))
348 return 0;
349
350 return -EACCES;
351 }
352
353 /*
354 * We _really_ want to just do "generic_permission()" without
355 * even looking at the inode->i_op values. So we keep a cache
356 * flag in inode->i_opflags, that says "this has not special
357 * permission function, use the fast case".
358 */
359 static inline int do_inode_permission(struct inode *inode, int mask)
360 {
361 if (unlikely(!(inode->i_opflags & IOP_FASTPERM))) {
362 if (likely(inode->i_op->permission))
363 return inode->i_op->permission(inode, mask);
364
365 /* This gets set once for the inode lifetime */
366 spin_lock(&inode->i_lock);
367 inode->i_opflags |= IOP_FASTPERM;
368 spin_unlock(&inode->i_lock);
369 }
370 return generic_permission(inode, mask);
371 }
372
373 /**
374 * __inode_permission - Check for access rights to a given inode
375 * @inode: Inode to check permission on
376 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
377 *
378 * Check for read/write/execute permissions on an inode.
379 *
380 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
381 *
382 * This does not check for a read-only file system. You probably want
383 * inode_permission().
384 */
385 int __inode_permission(struct inode *inode, int mask)
386 {
387 int retval;
388
389 if (unlikely(mask & MAY_WRITE)) {
390 /*
391 * Nobody gets write access to an immutable file.
392 */
393 if (IS_IMMUTABLE(inode))
394 return -EACCES;
395 }
396
397 retval = do_inode_permission(inode, mask);
398 if (retval)
399 return retval;
400
401 retval = devcgroup_inode_permission(inode, mask);
402 if (retval)
403 return retval;
404
405 return security_inode_permission(inode, mask);
406 }
407
408 /**
409 * sb_permission - Check superblock-level permissions
410 * @sb: Superblock of inode to check permission on
411 * @inode: Inode to check permission on
412 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
413 *
414 * Separate out file-system wide checks from inode-specific permission checks.
415 */
416 static int sb_permission(struct super_block *sb, struct inode *inode, int mask)
417 {
418 if (unlikely(mask & MAY_WRITE)) {
419 umode_t mode = inode->i_mode;
420
421 /* Nobody gets write access to a read-only fs. */
422 if ((sb->s_flags & MS_RDONLY) &&
423 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
424 return -EROFS;
425 }
426 return 0;
427 }
428
429 /**
430 * inode_permission - Check for access rights to a given inode
431 * @inode: Inode to check permission on
432 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
433 *
434 * Check for read/write/execute permissions on an inode. We use fs[ug]id for
435 * this, letting us set arbitrary permissions for filesystem access without
436 * changing the "normal" UIDs which are used for other things.
437 *
438 * When checking for MAY_APPEND, MAY_WRITE must also be set in @mask.
439 */
440 int inode_permission(struct inode *inode, int mask)
441 {
442 int retval;
443
444 retval = sb_permission(inode->i_sb, inode, mask);
445 if (retval)
446 return retval;
447 return __inode_permission(inode, mask);
448 }
449
450 /**
451 * path_get - get a reference to a path
452 * @path: path to get the reference to
453 *
454 * Given a path increment the reference count to the dentry and the vfsmount.
455 */
456 void path_get(const struct path *path)
457 {
458 mntget(path->mnt);
459 dget(path->dentry);
460 }
461 EXPORT_SYMBOL(path_get);
462
463 /**
464 * path_put - put a reference to a path
465 * @path: path to put the reference to
466 *
467 * Given a path decrement the reference count to the dentry and the vfsmount.
468 */
469 void path_put(const struct path *path)
470 {
471 dput(path->dentry);
472 mntput(path->mnt);
473 }
474 EXPORT_SYMBOL(path_put);
475
476 /*
477 * Path walking has 2 modes, rcu-walk and ref-walk (see
478 * Documentation/filesystems/path-lookup.txt). In situations when we can't
479 * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
480 * normal reference counts on dentries and vfsmounts to transition to rcu-walk
481 * mode. Refcounts are grabbed at the last known good point before rcu-walk
482 * got stuck, so ref-walk may continue from there. If this is not successful
483 * (eg. a seqcount has changed), then failure is returned and it's up to caller
484 * to restart the path walk from the beginning in ref-walk mode.
485 */
486
487 static inline void lock_rcu_walk(void)
488 {
489 br_read_lock(&vfsmount_lock);
490 rcu_read_lock();
491 }
492
493 static inline void unlock_rcu_walk(void)
494 {
495 rcu_read_unlock();
496 br_read_unlock(&vfsmount_lock);
497 }
498
499 /**
500 * unlazy_walk - try to switch to ref-walk mode.
501 * @nd: nameidata pathwalk data
502 * @dentry: child of nd->path.dentry or NULL
503 * Returns: 0 on success, -ECHILD on failure
504 *
505 * unlazy_walk attempts to legitimize the current nd->path, nd->root and dentry
506 * for ref-walk mode. @dentry must be a path found by a do_lookup call on
507 * @nd or NULL. Must be called from rcu-walk context.
508 */
509 static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
510 {
511 struct fs_struct *fs = current->fs;
512 struct dentry *parent = nd->path.dentry;
513 int want_root = 0;
514
515 BUG_ON(!(nd->flags & LOOKUP_RCU));
516 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
517 want_root = 1;
518 spin_lock(&fs->lock);
519 if (nd->root.mnt != fs->root.mnt ||
520 nd->root.dentry != fs->root.dentry)
521 goto err_root;
522 }
523 spin_lock(&parent->d_lock);
524 if (!dentry) {
525 if (!__d_rcu_to_refcount(parent, nd->seq))
526 goto err_parent;
527 BUG_ON(nd->inode != parent->d_inode);
528 } else {
529 if (dentry->d_parent != parent)
530 goto err_parent;
531 spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
532 if (!__d_rcu_to_refcount(dentry, nd->seq))
533 goto err_child;
534 /*
535 * If the sequence check on the child dentry passed, then
536 * the child has not been removed from its parent. This
537 * means the parent dentry must be valid and able to take
538 * a reference at this point.
539 */
540 BUG_ON(!IS_ROOT(dentry) && dentry->d_parent != parent);
541 BUG_ON(!parent->d_count);
542 parent->d_count++;
543 spin_unlock(&dentry->d_lock);
544 }
545 spin_unlock(&parent->d_lock);
546 if (want_root) {
547 path_get(&nd->root);
548 spin_unlock(&fs->lock);
549 }
550 mntget(nd->path.mnt);
551
552 unlock_rcu_walk();
553 nd->flags &= ~LOOKUP_RCU;
554 return 0;
555
556 err_child:
557 spin_unlock(&dentry->d_lock);
558 err_parent:
559 spin_unlock(&parent->d_lock);
560 err_root:
561 if (want_root)
562 spin_unlock(&fs->lock);
563 return -ECHILD;
564 }
565
566 static inline int d_revalidate(struct dentry *dentry, unsigned int flags)
567 {
568 return dentry->d_op->d_revalidate(dentry, flags);
569 }
570
571 /**
572 * complete_walk - successful completion of path walk
573 * @nd: pointer nameidata
574 *
575 * If we had been in RCU mode, drop out of it and legitimize nd->path.
576 * Revalidate the final result, unless we'd already done that during
577 * the path walk or the filesystem doesn't ask for it. Return 0 on
578 * success, -error on failure. In case of failure caller does not
579 * need to drop nd->path.
580 */
581 static int complete_walk(struct nameidata *nd)
582 {
583 struct dentry *dentry = nd->path.dentry;
584 int status;
585
586 if (nd->flags & LOOKUP_RCU) {
587 nd->flags &= ~LOOKUP_RCU;
588 if (!(nd->flags & LOOKUP_ROOT))
589 nd->root.mnt = NULL;
590 spin_lock(&dentry->d_lock);
591 if (unlikely(!__d_rcu_to_refcount(dentry, nd->seq))) {
592 spin_unlock(&dentry->d_lock);
593 unlock_rcu_walk();
594 return -ECHILD;
595 }
596 BUG_ON(nd->inode != dentry->d_inode);
597 spin_unlock(&dentry->d_lock);
598 mntget(nd->path.mnt);
599 unlock_rcu_walk();
600 }
601
602 if (likely(!(nd->flags & LOOKUP_JUMPED)))
603 return 0;
604
605 if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
606 return 0;
607
608 status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
609 if (status > 0)
610 return 0;
611
612 if (!status)
613 status = -ESTALE;
614
615 path_put(&nd->path);
616 return status;
617 }
618
619 static __always_inline void set_root(struct nameidata *nd)
620 {
621 if (!nd->root.mnt)
622 get_fs_root(current->fs, &nd->root);
623 }
624
625 static int link_path_walk(const char *, struct nameidata *);
626
627 static __always_inline void set_root_rcu(struct nameidata *nd)
628 {
629 if (!nd->root.mnt) {
630 struct fs_struct *fs = current->fs;
631 unsigned seq;
632
633 do {
634 seq = read_seqcount_begin(&fs->seq);
635 nd->root = fs->root;
636 nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
637 } while (read_seqcount_retry(&fs->seq, seq));
638 }
639 }
640
641 static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
642 {
643 int ret;
644
645 if (IS_ERR(link))
646 goto fail;
647
648 if (*link == '/') {
649 set_root(nd);
650 path_put(&nd->path);
651 nd->path = nd->root;
652 path_get(&nd->root);
653 nd->flags |= LOOKUP_JUMPED;
654 }
655 nd->inode = nd->path.dentry->d_inode;
656
657 ret = link_path_walk(link, nd);
658 return ret;
659 fail:
660 path_put(&nd->path);
661 return PTR_ERR(link);
662 }
663
664 static void path_put_conditional(struct path *path, struct nameidata *nd)
665 {
666 dput(path->dentry);
667 if (path->mnt != nd->path.mnt)
668 mntput(path->mnt);
669 }
670
671 static inline void path_to_nameidata(const struct path *path,
672 struct nameidata *nd)
673 {
674 if (!(nd->flags & LOOKUP_RCU)) {
675 dput(nd->path.dentry);
676 if (nd->path.mnt != path->mnt)
677 mntput(nd->path.mnt);
678 }
679 nd->path.mnt = path->mnt;
680 nd->path.dentry = path->dentry;
681 }
682
683 /*
684 * Helper to directly jump to a known parsed path from ->follow_link,
685 * caller must have taken a reference to path beforehand.
686 */
687 void nd_jump_link(struct nameidata *nd, struct path *path)
688 {
689 path_put(&nd->path);
690
691 nd->path = *path;
692 nd->inode = nd->path.dentry->d_inode;
693 nd->flags |= LOOKUP_JUMPED;
694 }
695
696 static inline void put_link(struct nameidata *nd, struct path *link, void *cookie)
697 {
698 struct inode *inode = link->dentry->d_inode;
699 if (inode->i_op->put_link)
700 inode->i_op->put_link(link->dentry, nd, cookie);
701 path_put(link);
702 }
703
704 int sysctl_protected_symlinks __read_mostly = 0;
705 int sysctl_protected_hardlinks __read_mostly = 0;
706
707 /**
708 * may_follow_link - Check symlink following for unsafe situations
709 * @link: The path of the symlink
710 * @nd: nameidata pathwalk data
711 *
712 * In the case of the sysctl_protected_symlinks sysctl being enabled,
713 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
714 * in a sticky world-writable directory. This is to protect privileged
715 * processes from failing races against path names that may change out
716 * from under them by way of other users creating malicious symlinks.
717 * It will permit symlinks to be followed only when outside a sticky
718 * world-writable directory, or when the uid of the symlink and follower
719 * match, or when the directory owner matches the symlink's owner.
720 *
721 * Returns 0 if following the symlink is allowed, -ve on error.
722 */
723 static inline int may_follow_link(struct path *link, struct nameidata *nd)
724 {
725 const struct inode *inode;
726 const struct inode *parent;
727
728 if (!sysctl_protected_symlinks)
729 return 0;
730
731 /* Allowed if owner and follower match. */
732 inode = link->dentry->d_inode;
733 if (uid_eq(current_cred()->fsuid, inode->i_uid))
734 return 0;
735
736 /* Allowed if parent directory not sticky and world-writable. */
737 parent = nd->path.dentry->d_inode;
738 if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
739 return 0;
740
741 /* Allowed if parent directory and link owner match. */
742 if (uid_eq(parent->i_uid, inode->i_uid))
743 return 0;
744
745 audit_log_link_denied("follow_link", link);
746 path_put_conditional(link, nd);
747 path_put(&nd->path);
748 return -EACCES;
749 }
750
751 /**
752 * safe_hardlink_source - Check for safe hardlink conditions
753 * @inode: the source inode to hardlink from
754 *
755 * Return false if at least one of the following conditions:
756 * - inode is not a regular file
757 * - inode is setuid
758 * - inode is setgid and group-exec
759 * - access failure for read and write
760 *
761 * Otherwise returns true.
762 */
763 static bool safe_hardlink_source(struct inode *inode)
764 {
765 umode_t mode = inode->i_mode;
766
767 /* Special files should not get pinned to the filesystem. */
768 if (!S_ISREG(mode))
769 return false;
770
771 /* Setuid files should not get pinned to the filesystem. */
772 if (mode & S_ISUID)
773 return false;
774
775 /* Executable setgid files should not get pinned to the filesystem. */
776 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
777 return false;
778
779 /* Hardlinking to unreadable or unwritable sources is dangerous. */
780 if (inode_permission(inode, MAY_READ | MAY_WRITE))
781 return false;
782
783 return true;
784 }
785
786 /**
787 * may_linkat - Check permissions for creating a hardlink
788 * @link: the source to hardlink from
789 *
790 * Block hardlink when all of:
791 * - sysctl_protected_hardlinks enabled
792 * - fsuid does not match inode
793 * - hardlink source is unsafe (see safe_hardlink_source() above)
794 * - not CAP_FOWNER
795 *
796 * Returns 0 if successful, -ve on error.
797 */
798 static int may_linkat(struct path *link)
799 {
800 const struct cred *cred;
801 struct inode *inode;
802
803 if (!sysctl_protected_hardlinks)
804 return 0;
805
806 cred = current_cred();
807 inode = link->dentry->d_inode;
808
809 /* Source inode owner (or CAP_FOWNER) can hardlink all they like,
810 * otherwise, it must be a safe source.
811 */
812 if (uid_eq(cred->fsuid, inode->i_uid) || safe_hardlink_source(inode) ||
813 capable(CAP_FOWNER))
814 return 0;
815
816 audit_log_link_denied("linkat", link);
817 return -EPERM;
818 }
819
820 static __always_inline int
821 follow_link(struct path *link, struct nameidata *nd, void **p)
822 {
823 struct dentry *dentry = link->dentry;
824 int error;
825 char *s;
826
827 BUG_ON(nd->flags & LOOKUP_RCU);
828
829 if (link->mnt == nd->path.mnt)
830 mntget(link->mnt);
831
832 error = -ELOOP;
833 if (unlikely(current->total_link_count >= 40))
834 goto out_put_nd_path;
835
836 cond_resched();
837 current->total_link_count++;
838
839 touch_atime(link);
840 nd_set_link(nd, NULL);
841
842 error = security_inode_follow_link(link->dentry, nd);
843 if (error)
844 goto out_put_nd_path;
845
846 nd->last_type = LAST_BIND;
847 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
848 error = PTR_ERR(*p);
849 if (IS_ERR(*p))
850 goto out_put_nd_path;
851
852 error = 0;
853 s = nd_get_link(nd);
854 if (s) {
855 error = __vfs_follow_link(nd, s);
856 if (unlikely(error))
857 put_link(nd, link, *p);
858 }
859
860 return error;
861
862 out_put_nd_path:
863 *p = NULL;
864 path_put(&nd->path);
865 path_put(link);
866 return error;
867 }
868
869 static int follow_up_rcu(struct path *path)
870 {
871 struct mount *mnt = real_mount(path->mnt);
872 struct mount *parent;
873 struct dentry *mountpoint;
874
875 parent = mnt->mnt_parent;
876 if (&parent->mnt == path->mnt)
877 return 0;
878 mountpoint = mnt->mnt_mountpoint;
879 path->dentry = mountpoint;
880 path->mnt = &parent->mnt;
881 return 1;
882 }
883
884 /*
885 * follow_up - Find the mountpoint of path's vfsmount
886 *
887 * Given a path, find the mountpoint of its source file system.
888 * Replace @path with the path of the mountpoint in the parent mount.
889 * Up is towards /.
890 *
891 * Return 1 if we went up a level and 0 if we were already at the
892 * root.
893 */
894 int follow_up(struct path *path)
895 {
896 struct mount *mnt = real_mount(path->mnt);
897 struct mount *parent;
898 struct dentry *mountpoint;
899
900 br_read_lock(&vfsmount_lock);
901 parent = mnt->mnt_parent;
902 if (parent == mnt) {
903 br_read_unlock(&vfsmount_lock);
904 return 0;
905 }
906 mntget(&parent->mnt);
907 mountpoint = dget(mnt->mnt_mountpoint);
908 br_read_unlock(&vfsmount_lock);
909 dput(path->dentry);
910 path->dentry = mountpoint;
911 mntput(path->mnt);
912 path->mnt = &parent->mnt;
913 return 1;
914 }
915
916 /*
917 * Perform an automount
918 * - return -EISDIR to tell follow_managed() to stop and return the path we
919 * were called with.
920 */
921 static int follow_automount(struct path *path, unsigned flags,
922 bool *need_mntput)
923 {
924 struct vfsmount *mnt;
925 int err;
926
927 if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
928 return -EREMOTE;
929
930 /* We don't want to mount if someone's just doing a stat -
931 * unless they're stat'ing a directory and appended a '/' to
932 * the name.
933 *
934 * We do, however, want to mount if someone wants to open or
935 * create a file of any type under the mountpoint, wants to
936 * traverse through the mountpoint or wants to open the
937 * mounted directory. Also, autofs may mark negative dentries
938 * as being automount points. These will need the attentions
939 * of the daemon to instantiate them before they can be used.
940 */
941 if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
942 LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
943 path->dentry->d_inode)
944 return -EISDIR;
945
946 current->total_link_count++;
947 if (current->total_link_count >= 40)
948 return -ELOOP;
949
950 mnt = path->dentry->d_op->d_automount(path);
951 if (IS_ERR(mnt)) {
952 /*
953 * The filesystem is allowed to return -EISDIR here to indicate
954 * it doesn't want to automount. For instance, autofs would do
955 * this so that its userspace daemon can mount on this dentry.
956 *
957 * However, we can only permit this if it's a terminal point in
958 * the path being looked up; if it wasn't then the remainder of
959 * the path is inaccessible and we should say so.
960 */
961 if (PTR_ERR(mnt) == -EISDIR && (flags & LOOKUP_PARENT))
962 return -EREMOTE;
963 return PTR_ERR(mnt);
964 }
965
966 if (!mnt) /* mount collision */
967 return 0;
968
969 if (!*need_mntput) {
970 /* lock_mount() may release path->mnt on error */
971 mntget(path->mnt);
972 *need_mntput = true;
973 }
974 err = finish_automount(mnt, path);
975
976 switch (err) {
977 case -EBUSY:
978 /* Someone else made a mount here whilst we were busy */
979 return 0;
980 case 0:
981 path_put(path);
982 path->mnt = mnt;
983 path->dentry = dget(mnt->mnt_root);
984 return 0;
985 default:
986 return err;
987 }
988
989 }
990
991 /*
992 * Handle a dentry that is managed in some way.
993 * - Flagged for transit management (autofs)
994 * - Flagged as mountpoint
995 * - Flagged as automount point
996 *
997 * This may only be called in refwalk mode.
998 *
999 * Serialization is taken care of in namespace.c
1000 */
1001 static int follow_managed(struct path *path, unsigned flags)
1002 {
1003 struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */
1004 unsigned managed;
1005 bool need_mntput = false;
1006 int ret = 0;
1007
1008 /* Given that we're not holding a lock here, we retain the value in a
1009 * local variable for each dentry as we look at it so that we don't see
1010 * the components of that value change under us */
1011 while (managed = ACCESS_ONCE(path->dentry->d_flags),
1012 managed &= DCACHE_MANAGED_DENTRY,
1013 unlikely(managed != 0)) {
1014 /* Allow the filesystem to manage the transit without i_mutex
1015 * being held. */
1016 if (managed & DCACHE_MANAGE_TRANSIT) {
1017 BUG_ON(!path->dentry->d_op);
1018 BUG_ON(!path->dentry->d_op->d_manage);
1019 ret = path->dentry->d_op->d_manage(path->dentry, false);
1020 if (ret < 0)
1021 break;
1022 }
1023
1024 /* Transit to a mounted filesystem. */
1025 if (managed & DCACHE_MOUNTED) {
1026 struct vfsmount *mounted = lookup_mnt(path);
1027 if (mounted) {
1028 dput(path->dentry);
1029 if (need_mntput)
1030 mntput(path->mnt);
1031 path->mnt = mounted;
1032 path->dentry = dget(mounted->mnt_root);
1033 need_mntput = true;
1034 continue;
1035 }
1036
1037 /* Something is mounted on this dentry in another
1038 * namespace and/or whatever was mounted there in this
1039 * namespace got unmounted before we managed to get the
1040 * vfsmount_lock */
1041 }
1042
1043 /* Handle an automount point */
1044 if (managed & DCACHE_NEED_AUTOMOUNT) {
1045 ret = follow_automount(path, flags, &need_mntput);
1046 if (ret < 0)
1047 break;
1048 continue;
1049 }
1050
1051 /* We didn't change the current path point */
1052 break;
1053 }
1054
1055 if (need_mntput && path->mnt == mnt)
1056 mntput(path->mnt);
1057 if (ret == -EISDIR)
1058 ret = 0;
1059 return ret < 0 ? ret : need_mntput;
1060 }
1061
1062 int follow_down_one(struct path *path)
1063 {
1064 struct vfsmount *mounted;
1065
1066 mounted = lookup_mnt(path);
1067 if (mounted) {
1068 dput(path->dentry);
1069 mntput(path->mnt);
1070 path->mnt = mounted;
1071 path->dentry = dget(mounted->mnt_root);
1072 return 1;
1073 }
1074 return 0;
1075 }
1076
1077 static inline bool managed_dentry_might_block(struct dentry *dentry)
1078 {
1079 return (dentry->d_flags & DCACHE_MANAGE_TRANSIT &&
1080 dentry->d_op->d_manage(dentry, true) < 0);
1081 }
1082
1083 /*
1084 * Try to skip to top of mountpoint pile in rcuwalk mode. Fail if
1085 * we meet a managed dentry that would need blocking.
1086 */
1087 static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
1088 struct inode **inode)
1089 {
1090 for (;;) {
1091 struct mount *mounted;
1092 /*
1093 * Don't forget we might have a non-mountpoint managed dentry
1094 * that wants to block transit.
1095 */
1096 if (unlikely(managed_dentry_might_block(path->dentry)))
1097 return false;
1098
1099 if (!d_mountpoint(path->dentry))
1100 break;
1101
1102 mounted = __lookup_mnt(path->mnt, path->dentry, 1);
1103 if (!mounted)
1104 break;
1105 path->mnt = &mounted->mnt;
1106 path->dentry = mounted->mnt.mnt_root;
1107 nd->flags |= LOOKUP_JUMPED;
1108 nd->seq = read_seqcount_begin(&path->dentry->d_seq);
1109 /*
1110 * Update the inode too. We don't need to re-check the
1111 * dentry sequence number here after this d_inode read,
1112 * because a mount-point is always pinned.
1113 */
1114 *inode = path->dentry->d_inode;
1115 }
1116 return true;
1117 }
1118
1119 static void follow_mount_rcu(struct nameidata *nd)
1120 {
1121 while (d_mountpoint(nd->path.dentry)) {
1122 struct mount *mounted;
1123 mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry, 1);
1124 if (!mounted)
1125 break;
1126 nd->path.mnt = &mounted->mnt;
1127 nd->path.dentry = mounted->mnt.mnt_root;
1128 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
1129 }
1130 }
1131
1132 static int follow_dotdot_rcu(struct nameidata *nd)
1133 {
1134 set_root_rcu(nd);
1135
1136 while (1) {
1137 if (nd->path.dentry == nd->root.dentry &&
1138 nd->path.mnt == nd->root.mnt) {
1139 break;
1140 }
1141 if (nd->path.dentry != nd->path.mnt->mnt_root) {
1142 struct dentry *old = nd->path.dentry;
1143 struct dentry *parent = old->d_parent;
1144 unsigned seq;
1145
1146 seq = read_seqcount_begin(&parent->d_seq);
1147 if (read_seqcount_retry(&old->d_seq, nd->seq))
1148 goto failed;
1149 nd->path.dentry = parent;
1150 nd->seq = seq;
1151 break;
1152 }
1153 if (!follow_up_rcu(&nd->path))
1154 break;
1155 nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
1156 }
1157 follow_mount_rcu(nd);
1158 nd->inode = nd->path.dentry->d_inode;
1159 return 0;
1160
1161 failed:
1162 nd->flags &= ~LOOKUP_RCU;
1163 if (!(nd->flags & LOOKUP_ROOT))
1164 nd->root.mnt = NULL;
1165 unlock_rcu_walk();
1166 return -ECHILD;
1167 }
1168
1169 /*
1170 * Follow down to the covering mount currently visible to userspace. At each
1171 * point, the filesystem owning that dentry may be queried as to whether the
1172 * caller is permitted to proceed or not.
1173 */
1174 int follow_down(struct path *path)
1175 {
1176 unsigned managed;
1177 int ret;
1178
1179 while (managed = ACCESS_ONCE(path->dentry->d_flags),
1180 unlikely(managed & DCACHE_MANAGED_DENTRY)) {
1181 /* Allow the filesystem to manage the transit without i_mutex
1182 * being held.
1183 *
1184 * We indicate to the filesystem if someone is trying to mount
1185 * something here. This gives autofs the chance to deny anyone
1186 * other than its daemon the right to mount on its
1187 * superstructure.
1188 *
1189 * The filesystem may sleep at this point.
1190 */
1191 if (managed & DCACHE_MANAGE_TRANSIT) {
1192 BUG_ON(!path->dentry->d_op);
1193 BUG_ON(!path->dentry->d_op->d_manage);
1194 ret = path->dentry->d_op->d_manage(
1195 path->dentry, false);
1196 if (ret < 0)
1197 return ret == -EISDIR ? 0 : ret;
1198 }
1199
1200 /* Transit to a mounted filesystem. */
1201 if (managed & DCACHE_MOUNTED) {
1202 struct vfsmount *mounted = lookup_mnt(path);
1203 if (!mounted)
1204 break;
1205 dput(path->dentry);
1206 mntput(path->mnt);
1207 path->mnt = mounted;
1208 path->dentry = dget(mounted->mnt_root);
1209 continue;
1210 }
1211
1212 /* Don't handle automount points here */
1213 break;
1214 }
1215 return 0;
1216 }
1217
1218 /*
1219 * Skip to top of mountpoint pile in refwalk mode for follow_dotdot()
1220 */
1221 static void follow_mount(struct path *path)
1222 {
1223 while (d_mountpoint(path->dentry)) {
1224 struct vfsmount *mounted = lookup_mnt(path);
1225 if (!mounted)
1226 break;
1227 dput(path->dentry);
1228 mntput(path->mnt);
1229 path->mnt = mounted;
1230 path->dentry = dget(mounted->mnt_root);
1231 }
1232 }
1233
1234 static void follow_dotdot(struct nameidata *nd)
1235 {
1236 set_root(nd);
1237
1238 while(1) {
1239 struct dentry *old = nd->path.dentry;
1240
1241 if (nd->path.dentry == nd->root.dentry &&
1242 nd->path.mnt == nd->root.mnt) {
1243 break;
1244 }
1245 if (nd->path.dentry != nd->path.mnt->mnt_root) {
1246 /* rare case of legitimate dget_parent()... */
1247 nd->path.dentry = dget_parent(nd->path.dentry);
1248 dput(old);
1249 break;
1250 }
1251 if (!follow_up(&nd->path))
1252 break;
1253 }
1254 follow_mount(&nd->path);
1255 nd->inode = nd->path.dentry->d_inode;
1256 }
1257
1258 /*
1259 * This looks up the name in dcache, possibly revalidates the old dentry and
1260 * allocates a new one if not found or not valid. In the need_lookup argument
1261 * returns whether i_op->lookup is necessary.
1262 *
1263 * dir->d_inode->i_mutex must be held
1264 */
1265 static struct dentry *lookup_dcache(struct qstr *name, struct dentry *dir,
1266 unsigned int flags, bool *need_lookup)
1267 {
1268 struct dentry *dentry;
1269 int error;
1270
1271 *need_lookup = false;
1272 dentry = d_lookup(dir, name);
1273 if (dentry) {
1274 if (dentry->d_flags & DCACHE_OP_REVALIDATE) {
1275 error = d_revalidate(dentry, flags);
1276 if (unlikely(error <= 0)) {
1277 if (error < 0) {
1278 dput(dentry);
1279 return ERR_PTR(error);
1280 } else if (!d_invalidate(dentry)) {
1281 dput(dentry);
1282 dentry = NULL;
1283 }
1284 }
1285 }
1286 }
1287
1288 if (!dentry) {
1289 dentry = d_alloc(dir, name);
1290 if (unlikely(!dentry))
1291 return ERR_PTR(-ENOMEM);
1292
1293 *need_lookup = true;
1294 }
1295 return dentry;
1296 }
1297
1298 /*
1299 * Call i_op->lookup on the dentry. The dentry must be negative but may be
1300 * hashed if it was pouplated with DCACHE_NEED_LOOKUP.
1301 *
1302 * dir->d_inode->i_mutex must be held
1303 */
1304 static struct dentry *lookup_real(struct inode *dir, struct dentry *dentry,
1305 unsigned int flags)
1306 {
1307 struct dentry *old;
1308
1309 /* Don't create child dentry for a dead directory. */
1310 if (unlikely(IS_DEADDIR(dir))) {
1311 dput(dentry);
1312 return ERR_PTR(-ENOENT);
1313 }
1314
1315 old = dir->i_op->lookup(dir, dentry, flags);
1316 if (unlikely(old)) {
1317 dput(dentry);
1318 dentry = old;
1319 }
1320 return dentry;
1321 }
1322
1323 static struct dentry *__lookup_hash(struct qstr *name,
1324 struct dentry *base, unsigned int flags)
1325 {
1326 bool need_lookup;
1327 struct dentry *dentry;
1328
1329 dentry = lookup_dcache(name, base, flags, &need_lookup);
1330 if (!need_lookup)
1331 return dentry;
1332
1333 return lookup_real(base->d_inode, dentry, flags);
1334 }
1335
1336 /*
1337 * It's more convoluted than I'd like it to be, but... it's still fairly
1338 * small and for now I'd prefer to have fast path as straight as possible.
1339 * It _is_ time-critical.
1340 */
1341 static int lookup_fast(struct nameidata *nd,
1342 struct path *path, struct inode **inode)
1343 {
1344 struct vfsmount *mnt = nd->path.mnt;
1345 struct dentry *dentry, *parent = nd->path.dentry;
1346 int need_reval = 1;
1347 int status = 1;
1348 int err;
1349
1350 /*
1351 * Rename seqlock is not required here because in the off chance
1352 * of a false negative due to a concurrent rename, we're going to
1353 * do the non-racy lookup, below.
1354 */
1355 if (nd->flags & LOOKUP_RCU) {
1356 unsigned seq;
1357 dentry = __d_lookup_rcu(parent, &nd->last, &seq, nd->inode);
1358 if (!dentry)
1359 goto unlazy;
1360
1361 /*
1362 * This sequence count validates that the inode matches
1363 * the dentry name information from lookup.
1364 */
1365 *inode = dentry->d_inode;
1366 if (read_seqcount_retry(&dentry->d_seq, seq))
1367 return -ECHILD;
1368
1369 /*
1370 * This sequence count validates that the parent had no
1371 * changes while we did the lookup of the dentry above.
1372 *
1373 * The memory barrier in read_seqcount_begin of child is
1374 * enough, we can use __read_seqcount_retry here.
1375 */
1376 if (__read_seqcount_retry(&parent->d_seq, nd->seq))
1377 return -ECHILD;
1378 nd->seq = seq;
1379
1380 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE)) {
1381 status = d_revalidate(dentry, nd->flags);
1382 if (unlikely(status <= 0)) {
1383 if (status != -ECHILD)
1384 need_reval = 0;
1385 goto unlazy;
1386 }
1387 }
1388 path->mnt = mnt;
1389 path->dentry = dentry;
1390 if (unlikely(!__follow_mount_rcu(nd, path, inode)))
1391 goto unlazy;
1392 if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT))
1393 goto unlazy;
1394 return 0;
1395 unlazy:
1396 if (unlazy_walk(nd, dentry))
1397 return -ECHILD;
1398 } else {
1399 dentry = __d_lookup(parent, &nd->last);
1400 }
1401
1402 if (unlikely(!dentry))
1403 goto need_lookup;
1404
1405 if (unlikely(dentry->d_flags & DCACHE_OP_REVALIDATE) && need_reval)
1406 status = d_revalidate(dentry, nd->flags);
1407 if (unlikely(status <= 0)) {
1408 if (status < 0) {
1409 dput(dentry);
1410 return status;
1411 }
1412 if (!d_invalidate(dentry)) {
1413 dput(dentry);
1414 goto need_lookup;
1415 }
1416 }
1417
1418 path->mnt = mnt;
1419 path->dentry = dentry;
1420 err = follow_managed(path, nd->flags);
1421 if (unlikely(err < 0)) {
1422 path_put_conditional(path, nd);
1423 return err;
1424 }
1425 if (err)
1426 nd->flags |= LOOKUP_JUMPED;
1427 *inode = path->dentry->d_inode;
1428 return 0;
1429
1430 need_lookup:
1431 return 1;
1432 }
1433
1434 /* Fast lookup failed, do it the slow way */
1435 static int lookup_slow(struct nameidata *nd, struct path *path)
1436 {
1437 struct dentry *dentry, *parent;
1438 int err;
1439
1440 parent = nd->path.dentry;
1441 BUG_ON(nd->inode != parent->d_inode);
1442
1443 mutex_lock(&parent->d_inode->i_mutex);
1444 dentry = __lookup_hash(&nd->last, parent, nd->flags);
1445 mutex_unlock(&parent->d_inode->i_mutex);
1446 if (IS_ERR(dentry))
1447 return PTR_ERR(dentry);
1448 path->mnt = nd->path.mnt;
1449 path->dentry = dentry;
1450 err = follow_managed(path, nd->flags);
1451 if (unlikely(err < 0)) {
1452 path_put_conditional(path, nd);
1453 return err;
1454 }
1455 if (err)
1456 nd->flags |= LOOKUP_JUMPED;
1457 return 0;
1458 }
1459
1460 static inline int may_lookup(struct nameidata *nd)
1461 {
1462 if (nd->flags & LOOKUP_RCU) {
1463 int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
1464 if (err != -ECHILD)
1465 return err;
1466 if (unlazy_walk(nd, NULL))
1467 return -ECHILD;
1468 }
1469 return inode_permission(nd->inode, MAY_EXEC);
1470 }
1471
1472 static inline int handle_dots(struct nameidata *nd, int type)
1473 {
1474 if (type == LAST_DOTDOT) {
1475 if (nd->flags & LOOKUP_RCU) {
1476 if (follow_dotdot_rcu(nd))
1477 return -ECHILD;
1478 } else
1479 follow_dotdot(nd);
1480 }
1481 return 0;
1482 }
1483
1484 static void terminate_walk(struct nameidata *nd)
1485 {
1486 if (!(nd->flags & LOOKUP_RCU)) {
1487 path_put(&nd->path);
1488 } else {
1489 nd->flags &= ~LOOKUP_RCU;
1490 if (!(nd->flags & LOOKUP_ROOT))
1491 nd->root.mnt = NULL;
1492 unlock_rcu_walk();
1493 }
1494 }
1495
1496 /*
1497 * Do we need to follow links? We _really_ want to be able
1498 * to do this check without having to look at inode->i_op,
1499 * so we keep a cache of "no, this doesn't need follow_link"
1500 * for the common case.
1501 */
1502 static inline int should_follow_link(struct inode *inode, int follow)
1503 {
1504 if (unlikely(!(inode->i_opflags & IOP_NOFOLLOW))) {
1505 if (likely(inode->i_op->follow_link))
1506 return follow;
1507
1508 /* This gets set once for the inode lifetime */
1509 spin_lock(&inode->i_lock);
1510 inode->i_opflags |= IOP_NOFOLLOW;
1511 spin_unlock(&inode->i_lock);
1512 }
1513 return 0;
1514 }
1515
1516 static inline int walk_component(struct nameidata *nd, struct path *path,
1517 int follow)
1518 {
1519 struct inode *inode;
1520 int err;
1521 /*
1522 * "." and ".." are special - ".." especially so because it has
1523 * to be able to know about the current root directory and
1524 * parent relationships.
1525 */
1526 if (unlikely(nd->last_type != LAST_NORM))
1527 return handle_dots(nd, nd->last_type);
1528 err = lookup_fast(nd, path, &inode);
1529 if (unlikely(err)) {
1530 if (err < 0)
1531 goto out_err;
1532
1533 err = lookup_slow(nd, path);
1534 if (err < 0)
1535 goto out_err;
1536
1537 inode = path->dentry->d_inode;
1538 }
1539 err = -ENOENT;
1540 if (!inode)
1541 goto out_path_put;
1542
1543 if (should_follow_link(inode, follow)) {
1544 if (nd->flags & LOOKUP_RCU) {
1545 if (unlikely(unlazy_walk(nd, path->dentry))) {
1546 err = -ECHILD;
1547 goto out_err;
1548 }
1549 }
1550 BUG_ON(inode != path->dentry->d_inode);
1551 return 1;
1552 }
1553 path_to_nameidata(path, nd);
1554 nd->inode = inode;
1555 return 0;
1556
1557 out_path_put:
1558 path_to_nameidata(path, nd);
1559 out_err:
1560 terminate_walk(nd);
1561 return err;
1562 }
1563
1564 /*
1565 * This limits recursive symlink follows to 8, while
1566 * limiting consecutive symlinks to 40.
1567 *
1568 * Without that kind of total limit, nasty chains of consecutive
1569 * symlinks can cause almost arbitrarily long lookups.
1570 */
1571 static inline int nested_symlink(struct path *path, struct nameidata *nd)
1572 {
1573 int res;
1574
1575 if (unlikely(current->link_count >= MAX_NESTED_LINKS)) {
1576 path_put_conditional(path, nd);
1577 path_put(&nd->path);
1578 return -ELOOP;
1579 }
1580 BUG_ON(nd->depth >= MAX_NESTED_LINKS);
1581
1582 nd->depth++;
1583 current->link_count++;
1584
1585 do {
1586 struct path link = *path;
1587 void *cookie;
1588
1589 res = follow_link(&link, nd, &cookie);
1590 if (res)
1591 break;
1592 res = walk_component(nd, path, LOOKUP_FOLLOW);
1593 put_link(nd, &link, cookie);
1594 } while (res > 0);
1595
1596 current->link_count--;
1597 nd->depth--;
1598 return res;
1599 }
1600
1601 /*
1602 * We really don't want to look at inode->i_op->lookup
1603 * when we don't have to. So we keep a cache bit in
1604 * the inode ->i_opflags field that says "yes, we can
1605 * do lookup on this inode".
1606 */
1607 static inline int can_lookup(struct inode *inode)
1608 {
1609 if (likely(inode->i_opflags & IOP_LOOKUP))
1610 return 1;
1611 if (likely(!inode->i_op->lookup))
1612 return 0;
1613
1614 /* We do this once for the lifetime of the inode */
1615 spin_lock(&inode->i_lock);
1616 inode->i_opflags |= IOP_LOOKUP;
1617 spin_unlock(&inode->i_lock);
1618 return 1;
1619 }
1620
1621 /*
1622 * We can do the critical dentry name comparison and hashing
1623 * operations one word at a time, but we are limited to:
1624 *
1625 * - Architectures with fast unaligned word accesses. We could
1626 * do a "get_unaligned()" if this helps and is sufficiently
1627 * fast.
1628 *
1629 * - Little-endian machines (so that we can generate the mask
1630 * of low bytes efficiently). Again, we *could* do a byte
1631 * swapping load on big-endian architectures if that is not
1632 * expensive enough to make the optimization worthless.
1633 *
1634 * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
1635 * do not trap on the (extremely unlikely) case of a page
1636 * crossing operation.
1637 *
1638 * - Furthermore, we need an efficient 64-bit compile for the
1639 * 64-bit case in order to generate the "number of bytes in
1640 * the final mask". Again, that could be replaced with a
1641 * efficient population count instruction or similar.
1642 */
1643 #ifdef CONFIG_DCACHE_WORD_ACCESS
1644
1645 #include <asm/word-at-a-time.h>
1646
1647 #ifdef CONFIG_64BIT
1648
1649 static inline unsigned int fold_hash(unsigned long hash)
1650 {
1651 return hash_64(hash, 32);
1652 }
1653
1654 #else /* 32-bit case */
1655
1656 #define fold_hash(x) (x)
1657
1658 #endif
1659
1660 unsigned int full_name_hash(const unsigned char *name, unsigned int len)
1661 {
1662 unsigned long a, mask;
1663 unsigned long hash = 0;
1664
1665 for (;;) {
1666 a = load_unaligned_zeropad(name);
1667 if (len < sizeof(unsigned long))
1668 break;
1669 hash += a;
1670 hash *= 9;
1671 name += sizeof(unsigned long);
1672 len -= sizeof(unsigned long);
1673 if (!len)
1674 goto done;
1675 }
1676 mask = ~(~0ul << len*8);
1677 hash += mask & a;
1678 done:
1679 return fold_hash(hash);
1680 }
1681 EXPORT_SYMBOL(full_name_hash);
1682
1683 /*
1684 * Calculate the length and hash of the path component, and
1685 * return the length of the component;
1686 */
1687 static inline unsigned long hash_name(const char *name, unsigned int *hashp)
1688 {
1689 unsigned long a, b, adata, bdata, mask, hash, len;
1690 const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
1691
1692 hash = a = 0;
1693 len = -sizeof(unsigned long);
1694 do {
1695 hash = (hash + a) * 9;
1696 len += sizeof(unsigned long);
1697 a = load_unaligned_zeropad(name+len);
1698 b = a ^ REPEAT_BYTE('/');
1699 } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
1700
1701 adata = prep_zero_mask(a, adata, &constants);
1702 bdata = prep_zero_mask(b, bdata, &constants);
1703
1704 mask = create_zero_mask(adata | bdata);
1705
1706 hash += a & zero_bytemask(mask);
1707 *hashp = fold_hash(hash);
1708
1709 return len + find_zero(mask);
1710 }
1711
1712 #else
1713
1714 unsigned int full_name_hash(const unsigned char *name, unsigned int len)
1715 {
1716 unsigned long hash = init_name_hash();
1717 while (len--)
1718 hash = partial_name_hash(*name++, hash);
1719 return end_name_hash(hash);
1720 }
1721 EXPORT_SYMBOL(full_name_hash);
1722
1723 /*
1724 * We know there's a real path component here of at least
1725 * one character.
1726 */
1727 static inline unsigned long hash_name(const char *name, unsigned int *hashp)
1728 {
1729 unsigned long hash = init_name_hash();
1730 unsigned long len = 0, c;
1731
1732 c = (unsigned char)*name;
1733 do {
1734 len++;
1735 hash = partial_name_hash(c, hash);
1736 c = (unsigned char)name[len];
1737 } while (c && c != '/');
1738 *hashp = end_name_hash(hash);
1739 return len;
1740 }
1741
1742 #endif
1743
1744 /*
1745 * Name resolution.
1746 * This is the basic name resolution function, turning a pathname into
1747 * the final dentry. We expect 'base' to be positive and a directory.
1748 *
1749 * Returns 0 and nd will have valid dentry and mnt on success.
1750 * Returns error and drops reference to input namei data on failure.
1751 */
1752 static int link_path_walk(const char *name, struct nameidata *nd)
1753 {
1754 struct path next;
1755 int err;
1756
1757 while (*name=='/')
1758 name++;
1759 if (!*name)
1760 return 0;
1761
1762 /* At this point we know we have a real path component. */
1763 for(;;) {
1764 struct qstr this;
1765 long len;
1766 int type;
1767
1768 err = may_lookup(nd);
1769 if (err)
1770 break;
1771
1772 len = hash_name(name, &this.hash);
1773 this.name = name;
1774 this.len = len;
1775
1776 type = LAST_NORM;
1777 if (name[0] == '.') switch (len) {
1778 case 2:
1779 if (name[1] == '.') {
1780 type = LAST_DOTDOT;
1781 nd->flags |= LOOKUP_JUMPED;
1782 }
1783 break;
1784 case 1:
1785 type = LAST_DOT;
1786 }
1787 if (likely(type == LAST_NORM)) {
1788 struct dentry *parent = nd->path.dentry;
1789 nd->flags &= ~LOOKUP_JUMPED;
1790 if (unlikely(parent->d_flags & DCACHE_OP_HASH)) {
1791 err = parent->d_op->d_hash(parent, nd->inode,
1792 &this);
1793 if (err < 0)
1794 break;
1795 }
1796 }
1797
1798 nd->last = this;
1799 nd->last_type = type;
1800
1801 if (!name[len])
1802 return 0;
1803 /*
1804 * If it wasn't NUL, we know it was '/'. Skip that
1805 * slash, and continue until no more slashes.
1806 */
1807 do {
1808 len++;
1809 } while (unlikely(name[len] == '/'));
1810 if (!name[len])
1811 return 0;
1812
1813 name += len;
1814
1815 err = walk_component(nd, &next, LOOKUP_FOLLOW);
1816 if (err < 0)
1817 return err;
1818
1819 if (err) {
1820 err = nested_symlink(&next, nd);
1821 if (err)
1822 return err;
1823 }
1824 if (!can_lookup(nd->inode)) {
1825 err = -ENOTDIR;
1826 break;
1827 }
1828 }
1829 terminate_walk(nd);
1830 return err;
1831 }
1832
1833 static int path_init(int dfd, const char *name, unsigned int flags,
1834 struct nameidata *nd, struct file **fp)
1835 {
1836 int retval = 0;
1837
1838 nd->last_type = LAST_ROOT; /* if there are only slashes... */
1839 nd->flags = flags | LOOKUP_JUMPED;
1840 nd->depth = 0;
1841 if (flags & LOOKUP_ROOT) {
1842 struct inode *inode = nd->root.dentry->d_inode;
1843 if (*name) {
1844 if (!can_lookup(inode))
1845 return -ENOTDIR;
1846 retval = inode_permission(inode, MAY_EXEC);
1847 if (retval)
1848 return retval;
1849 }
1850 nd->path = nd->root;
1851 nd->inode = inode;
1852 if (flags & LOOKUP_RCU) {
1853 lock_rcu_walk();
1854 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
1855 } else {
1856 path_get(&nd->path);
1857 }
1858 return 0;
1859 }
1860
1861 nd->root.mnt = NULL;
1862
1863 if (*name=='/') {
1864 if (flags & LOOKUP_RCU) {
1865 lock_rcu_walk();
1866 set_root_rcu(nd);
1867 } else {
1868 set_root(nd);
1869 path_get(&nd->root);
1870 }
1871 nd->path = nd->root;
1872 } else if (dfd == AT_FDCWD) {
1873 if (flags & LOOKUP_RCU) {
1874 struct fs_struct *fs = current->fs;
1875 unsigned seq;
1876
1877 lock_rcu_walk();
1878
1879 do {
1880 seq = read_seqcount_begin(&fs->seq);
1881 nd->path = fs->pwd;
1882 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
1883 } while (read_seqcount_retry(&fs->seq, seq));
1884 } else {
1885 get_fs_pwd(current->fs, &nd->path);
1886 }
1887 } else {
1888 /* Caller must check execute permissions on the starting path component */
1889 struct fd f = fdget_raw(dfd);
1890 struct dentry *dentry;
1891
1892 if (!f.file)
1893 return -EBADF;
1894
1895 dentry = f.file->f_path.dentry;
1896
1897 if (*name) {
1898 if (!can_lookup(dentry->d_inode)) {
1899 fdput(f);
1900 return -ENOTDIR;
1901 }
1902 }
1903
1904 nd->path = f.file->f_path;
1905 if (flags & LOOKUP_RCU) {
1906 if (f.need_put)
1907 *fp = f.file;
1908 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
1909 lock_rcu_walk();
1910 } else {
1911 path_get(&nd->path);
1912 fdput(f);
1913 }
1914 }
1915
1916 nd->inode = nd->path.dentry->d_inode;
1917 return 0;
1918 }
1919
1920 static inline int lookup_last(struct nameidata *nd, struct path *path)
1921 {
1922 if (nd->last_type == LAST_NORM && nd->last.name[nd->last.len])
1923 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
1924
1925 nd->flags &= ~LOOKUP_PARENT;
1926 return walk_component(nd, path, nd->flags & LOOKUP_FOLLOW);
1927 }
1928
1929 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
1930 static int path_lookupat(int dfd, const char *name,
1931 unsigned int flags, struct nameidata *nd)
1932 {
1933 struct file *base = NULL;
1934 struct path path;
1935 int err;
1936
1937 /*
1938 * Path walking is largely split up into 2 different synchronisation
1939 * schemes, rcu-walk and ref-walk (explained in
1940 * Documentation/filesystems/path-lookup.txt). These share much of the
1941 * path walk code, but some things particularly setup, cleanup, and
1942 * following mounts are sufficiently divergent that functions are
1943 * duplicated. Typically there is a function foo(), and its RCU
1944 * analogue, foo_rcu().
1945 *
1946 * -ECHILD is the error number of choice (just to avoid clashes) that
1947 * is returned if some aspect of an rcu-walk fails. Such an error must
1948 * be handled by restarting a traditional ref-walk (which will always
1949 * be able to complete).
1950 */
1951 err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base);
1952
1953 if (unlikely(err))
1954 return err;
1955
1956 current->total_link_count = 0;
1957 err = link_path_walk(name, nd);
1958
1959 if (!err && !(flags & LOOKUP_PARENT)) {
1960 err = lookup_last(nd, &path);
1961 while (err > 0) {
1962 void *cookie;
1963 struct path link = path;
1964 err = may_follow_link(&link, nd);
1965 if (unlikely(err))
1966 break;
1967 nd->flags |= LOOKUP_PARENT;
1968 err = follow_link(&link, nd, &cookie);
1969 if (err)
1970 break;
1971 err = lookup_last(nd, &path);
1972 put_link(nd, &link, cookie);
1973 }
1974 }
1975
1976 if (!err)
1977 err = complete_walk(nd);
1978
1979 if (!err && nd->flags & LOOKUP_DIRECTORY) {
1980 if (!can_lookup(nd->inode)) {
1981 path_put(&nd->path);
1982 err = -ENOTDIR;
1983 }
1984 }
1985
1986 if (base)
1987 fput(base);
1988
1989 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
1990 path_put(&nd->root);
1991 nd->root.mnt = NULL;
1992 }
1993 return err;
1994 }
1995
1996 static int filename_lookup(int dfd, struct filename *name,
1997 unsigned int flags, struct nameidata *nd)
1998 {
1999 int retval = path_lookupat(dfd, name->name, flags | LOOKUP_RCU, nd);
2000 if (unlikely(retval == -ECHILD))
2001 retval = path_lookupat(dfd, name->name, flags, nd);
2002 if (unlikely(retval == -ESTALE))
2003 retval = path_lookupat(dfd, name->name,
2004 flags | LOOKUP_REVAL, nd);
2005
2006 if (likely(!retval))
2007 audit_inode(name, nd->path.dentry, flags & LOOKUP_PARENT);
2008 return retval;
2009 }
2010
2011 static int do_path_lookup(int dfd, const char *name,
2012 unsigned int flags, struct nameidata *nd)
2013 {
2014 struct filename filename = { .name = name };
2015
2016 return filename_lookup(dfd, &filename, flags, nd);
2017 }
2018
2019 /* does lookup, returns the object with parent locked */
2020 struct dentry *kern_path_locked(const char *name, struct path *path)
2021 {
2022 struct nameidata nd;
2023 struct dentry *d;
2024 int err = do_path_lookup(AT_FDCWD, name, LOOKUP_PARENT, &nd);
2025 if (err)
2026 return ERR_PTR(err);
2027 if (nd.last_type != LAST_NORM) {
2028 path_put(&nd.path);
2029 return ERR_PTR(-EINVAL);
2030 }
2031 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2032 d = __lookup_hash(&nd.last, nd.path.dentry, 0);
2033 if (IS_ERR(d)) {
2034 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
2035 path_put(&nd.path);
2036 return d;
2037 }
2038 *path = nd.path;
2039 return d;
2040 }
2041
2042 int kern_path(const char *name, unsigned int flags, struct path *path)
2043 {
2044 struct nameidata nd;
2045 int res = do_path_lookup(AT_FDCWD, name, flags, &nd);
2046 if (!res)
2047 *path = nd.path;
2048 return res;
2049 }
2050
2051 /**
2052 * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
2053 * @dentry: pointer to dentry of the base directory
2054 * @mnt: pointer to vfs mount of the base directory
2055 * @name: pointer to file name
2056 * @flags: lookup flags
2057 * @path: pointer to struct path to fill
2058 */
2059 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
2060 const char *name, unsigned int flags,
2061 struct path *path)
2062 {
2063 struct nameidata nd;
2064 int err;
2065 nd.root.dentry = dentry;
2066 nd.root.mnt = mnt;
2067 BUG_ON(flags & LOOKUP_PARENT);
2068 /* the first argument of do_path_lookup() is ignored with LOOKUP_ROOT */
2069 err = do_path_lookup(AT_FDCWD, name, flags | LOOKUP_ROOT, &nd);
2070 if (!err)
2071 *path = nd.path;
2072 return err;
2073 }
2074
2075 /*
2076 * Restricted form of lookup. Doesn't follow links, single-component only,
2077 * needs parent already locked. Doesn't follow mounts.
2078 * SMP-safe.
2079 */
2080 static struct dentry *lookup_hash(struct nameidata *nd)
2081 {
2082 return __lookup_hash(&nd->last, nd->path.dentry, nd->flags);
2083 }
2084
2085 /**
2086 * lookup_one_len - filesystem helper to lookup single pathname component
2087 * @name: pathname component to lookup
2088 * @base: base directory to lookup from
2089 * @len: maximum length @len should be interpreted to
2090 *
2091 * Note that this routine is purely a helper for filesystem usage and should
2092 * not be called by generic code. Also note that by using this function the
2093 * nameidata argument is passed to the filesystem methods and a filesystem
2094 * using this helper needs to be prepared for that.
2095 */
2096 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
2097 {
2098 struct qstr this;
2099 unsigned int c;
2100 int err;
2101
2102 WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));
2103
2104 this.name = name;
2105 this.len = len;
2106 this.hash = full_name_hash(name, len);
2107 if (!len)
2108 return ERR_PTR(-EACCES);
2109
2110 if (unlikely(name[0] == '.')) {
2111 if (len < 2 || (len == 2 && name[1] == '.'))
2112 return ERR_PTR(-EACCES);
2113 }
2114
2115 while (len--) {
2116 c = *(const unsigned char *)name++;
2117 if (c == '/' || c == '\0')
2118 return ERR_PTR(-EACCES);
2119 }
2120 /*
2121 * See if the low-level filesystem might want
2122 * to use its own hash..
2123 */
2124 if (base->d_flags & DCACHE_OP_HASH) {
2125 int err = base->d_op->d_hash(base, base->d_inode, &this);
2126 if (err < 0)
2127 return ERR_PTR(err);
2128 }
2129
2130 err = inode_permission(base->d_inode, MAY_EXEC);
2131 if (err)
2132 return ERR_PTR(err);
2133
2134 return __lookup_hash(&this, base, 0);
2135 }
2136
2137 int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
2138 struct path *path, int *empty)
2139 {
2140 struct nameidata nd;
2141 struct filename *tmp = getname_flags(name, flags, empty);
2142 int err = PTR_ERR(tmp);
2143 if (!IS_ERR(tmp)) {
2144
2145 BUG_ON(flags & LOOKUP_PARENT);
2146
2147 err = filename_lookup(dfd, tmp, flags, &nd);
2148 putname(tmp);
2149 if (!err)
2150 *path = nd.path;
2151 }
2152 return err;
2153 }
2154
2155 int user_path_at(int dfd, const char __user *name, unsigned flags,
2156 struct path *path)
2157 {
2158 return user_path_at_empty(dfd, name, flags, path, NULL);
2159 }
2160
2161 /*
2162 * NB: most callers don't do anything directly with the reference to the
2163 * to struct filename, but the nd->last pointer points into the name string
2164 * allocated by getname. So we must hold the reference to it until all
2165 * path-walking is complete.
2166 */
2167 static struct filename *
2168 user_path_parent(int dfd, const char __user *path, struct nameidata *nd,
2169 unsigned int flags)
2170 {
2171 struct filename *s = getname(path);
2172 int error;
2173
2174 /* only LOOKUP_REVAL is allowed in extra flags */
2175 flags &= LOOKUP_REVAL;
2176
2177 if (IS_ERR(s))
2178 return s;
2179
2180 error = filename_lookup(dfd, s, flags | LOOKUP_PARENT, nd);
2181 if (error) {
2182 putname(s);
2183 return ERR_PTR(error);
2184 }
2185
2186 return s;
2187 }
2188
2189 /*
2190 * It's inline, so penalty for filesystems that don't use sticky bit is
2191 * minimal.
2192 */
2193 static inline int check_sticky(struct inode *dir, struct inode *inode)
2194 {
2195 kuid_t fsuid = current_fsuid();
2196
2197 if (!(dir->i_mode & S_ISVTX))
2198 return 0;
2199 if (uid_eq(inode->i_uid, fsuid))
2200 return 0;
2201 if (uid_eq(dir->i_uid, fsuid))
2202 return 0;
2203 return !capable_wrt_inode_uidgid(inode, CAP_FOWNER);
2204 }
2205
2206 /*
2207 * Check whether we can remove a link victim from directory dir, check
2208 * whether the type of victim is right.
2209 * 1. We can't do it if dir is read-only (done in permission())
2210 * 2. We should have write and exec permissions on dir
2211 * 3. We can't remove anything from append-only dir
2212 * 4. We can't do anything with immutable dir (done in permission())
2213 * 5. If the sticky bit on dir is set we should either
2214 * a. be owner of dir, or
2215 * b. be owner of victim, or
2216 * c. have CAP_FOWNER capability
2217 * 6. If the victim is append-only or immutable we can't do antyhing with
2218 * links pointing to it.
2219 * 7. If we were asked to remove a directory and victim isn't one - ENOTDIR.
2220 * 8. If we were asked to remove a non-directory and victim isn't one - EISDIR.
2221 * 9. We can't remove a root or mountpoint.
2222 * 10. We don't allow removal of NFS sillyrenamed files; it's handled by
2223 * nfs_async_unlink().
2224 */
2225 static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
2226 {
2227 int error;
2228
2229 if (!victim->d_inode)
2230 return -ENOENT;
2231
2232 BUG_ON(victim->d_parent->d_inode != dir);
2233 audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2234
2235 error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
2236 if (error)
2237 return error;
2238 if (IS_APPEND(dir))
2239 return -EPERM;
2240 if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
2241 IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
2242 return -EPERM;
2243 if (isdir) {
2244 if (!S_ISDIR(victim->d_inode->i_mode))
2245 return -ENOTDIR;
2246 if (IS_ROOT(victim))
2247 return -EBUSY;
2248 } else if (S_ISDIR(victim->d_inode->i_mode))
2249 return -EISDIR;
2250 if (IS_DEADDIR(dir))
2251 return -ENOENT;
2252 if (victim->d_flags & DCACHE_NFSFS_RENAMED)
2253 return -EBUSY;
2254 return 0;
2255 }
2256
2257 /* Check whether we can create an object with dentry child in directory
2258 * dir.
2259 * 1. We can't do it if child already exists (open has special treatment for
2260 * this case, but since we are inlined it's OK)
2261 * 2. We can't do it if dir is read-only (done in permission())
2262 * 3. We should have write and exec permissions on dir
2263 * 4. We can't do it if dir is immutable (done in permission())
2264 */
2265 static inline int may_create(struct inode *dir, struct dentry *child)
2266 {
2267 audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
2268 if (child->d_inode)
2269 return -EEXIST;
2270 if (IS_DEADDIR(dir))
2271 return -ENOENT;
2272 return inode_permission(dir, MAY_WRITE | MAY_EXEC);
2273 }
2274
2275 /*
2276 * p1 and p2 should be directories on the same fs.
2277 */
2278 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
2279 {
2280 struct dentry *p;
2281
2282 if (p1 == p2) {
2283 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
2284 return NULL;
2285 }
2286
2287 mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
2288
2289 p = d_ancestor(p2, p1);
2290 if (p) {
2291 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT);
2292 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD);
2293 return p;
2294 }
2295
2296 p = d_ancestor(p1, p2);
2297 if (p) {
2298 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
2299 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
2300 return p;
2301 }
2302
2303 mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
2304 mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
2305 return NULL;
2306 }
2307
2308 void unlock_rename(struct dentry *p1, struct dentry *p2)
2309 {
2310 mutex_unlock(&p1->d_inode->i_mutex);
2311 if (p1 != p2) {
2312 mutex_unlock(&p2->d_inode->i_mutex);
2313 mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
2314 }
2315 }
2316
2317 int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
2318 bool want_excl)
2319 {
2320 int error = may_create(dir, dentry);
2321 if (error)
2322 return error;
2323
2324 if (!dir->i_op->create)
2325 return -EACCES; /* shouldn't it be ENOSYS? */
2326 mode &= S_IALLUGO;
2327 mode |= S_IFREG;
2328 error = security_inode_create(dir, dentry, mode);
2329 if (error)
2330 return error;
2331 error = dir->i_op->create(dir, dentry, mode, want_excl);
2332 if (!error)
2333 fsnotify_create(dir, dentry);
2334 return error;
2335 }
2336
2337 static int may_open(struct path *path, int acc_mode, int flag)
2338 {
2339 struct dentry *dentry = path->dentry;
2340 struct inode *inode = dentry->d_inode;
2341 int error;
2342
2343 /* O_PATH? */
2344 if (!acc_mode)
2345 return 0;
2346
2347 if (!inode)
2348 return -ENOENT;
2349
2350 switch (inode->i_mode & S_IFMT) {
2351 case S_IFLNK:
2352 return -ELOOP;
2353 case S_IFDIR:
2354 if (acc_mode & MAY_WRITE)
2355 return -EISDIR;
2356 break;
2357 case S_IFBLK:
2358 case S_IFCHR:
2359 if (path->mnt->mnt_flags & MNT_NODEV)
2360 return -EACCES;
2361 /*FALLTHRU*/
2362 case S_IFIFO:
2363 case S_IFSOCK:
2364 flag &= ~O_TRUNC;
2365 break;
2366 }
2367
2368 error = inode_permission(inode, acc_mode);
2369 if (error)
2370 return error;
2371
2372 /*
2373 * An append-only file must be opened in append mode for writing.
2374 */
2375 if (IS_APPEND(inode)) {
2376 if ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
2377 return -EPERM;
2378 if (flag & O_TRUNC)
2379 return -EPERM;
2380 }
2381
2382 /* O_NOATIME can only be set by the owner or superuser */
2383 if (flag & O_NOATIME && !inode_owner_or_capable(inode))
2384 return -EPERM;
2385
2386 return 0;
2387 }
2388
2389 static int handle_truncate(struct file *filp)
2390 {
2391 struct path *path = &filp->f_path;
2392 struct inode *inode = path->dentry->d_inode;
2393 int error = get_write_access(inode);
2394 if (error)
2395 return error;
2396 /*
2397 * Refuse to truncate files with mandatory locks held on them.
2398 */
2399 error = locks_verify_locked(inode);
2400 if (!error)
2401 error = security_path_truncate(path);
2402 if (!error) {
2403 error = do_truncate(path->dentry, 0,
2404 ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
2405 filp);
2406 }
2407 put_write_access(inode);
2408 return error;
2409 }
2410
2411 static inline int open_to_namei_flags(int flag)
2412 {
2413 if ((flag & O_ACCMODE) == 3)
2414 flag--;
2415 return flag;
2416 }
2417
2418 static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode)
2419 {
2420 int error = security_path_mknod(dir, dentry, mode, 0);
2421 if (error)
2422 return error;
2423
2424 error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
2425 if (error)
2426 return error;
2427
2428 return security_inode_create(dir->dentry->d_inode, dentry, mode);
2429 }
2430
2431 /*
2432 * Attempt to atomically look up, create and open a file from a negative
2433 * dentry.
2434 *
2435 * Returns 0 if successful. The file will have been created and attached to
2436 * @file by the filesystem calling finish_open().
2437 *
2438 * Returns 1 if the file was looked up only or didn't need creating. The
2439 * caller will need to perform the open themselves. @path will have been
2440 * updated to point to the new dentry. This may be negative.
2441 *
2442 * Returns an error code otherwise.
2443 */
2444 static int atomic_open(struct nameidata *nd, struct dentry *dentry,
2445 struct path *path, struct file *file,
2446 const struct open_flags *op,
2447 bool got_write, bool need_lookup,
2448 int *opened)
2449 {
2450 struct inode *dir = nd->path.dentry->d_inode;
2451 unsigned open_flag = open_to_namei_flags(op->open_flag);
2452 umode_t mode;
2453 int error;
2454 int acc_mode;
2455 int create_error = 0;
2456 struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
2457
2458 BUG_ON(dentry->d_inode);
2459
2460 /* Don't create child dentry for a dead directory. */
2461 if (unlikely(IS_DEADDIR(dir))) {
2462 error = -ENOENT;
2463 goto out;
2464 }
2465
2466 mode = op->mode;
2467 if ((open_flag & O_CREAT) && !IS_POSIXACL(dir))
2468 mode &= ~current_umask();
2469
2470 if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT)) {
2471 open_flag &= ~O_TRUNC;
2472 *opened |= FILE_CREATED;
2473 }
2474
2475 /*
2476 * Checking write permission is tricky, bacuse we don't know if we are
2477 * going to actually need it: O_CREAT opens should work as long as the
2478 * file exists. But checking existence breaks atomicity. The trick is
2479 * to check access and if not granted clear O_CREAT from the flags.
2480 *
2481 * Another problem is returing the "right" error value (e.g. for an
2482 * O_EXCL open we want to return EEXIST not EROFS).
2483 */
2484 if (((open_flag & (O_CREAT | O_TRUNC)) ||
2485 (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) {
2486 if (!(open_flag & O_CREAT)) {
2487 /*
2488 * No O_CREATE -> atomicity not a requirement -> fall
2489 * back to lookup + open
2490 */
2491 goto no_open;
2492 } else if (open_flag & (O_EXCL | O_TRUNC)) {
2493 /* Fall back and fail with the right error */
2494 create_error = -EROFS;
2495 goto no_open;
2496 } else {
2497 /* No side effects, safe to clear O_CREAT */
2498 create_error = -EROFS;
2499 open_flag &= ~O_CREAT;
2500 }
2501 }
2502
2503 if (open_flag & O_CREAT) {
2504 error = may_o_create(&nd->path, dentry, mode);
2505 if (error) {
2506 create_error = error;
2507 if (open_flag & O_EXCL)
2508 goto no_open;
2509 open_flag &= ~O_CREAT;
2510 }
2511 }
2512
2513 if (nd->flags & LOOKUP_DIRECTORY)
2514 open_flag |= O_DIRECTORY;
2515
2516 file->f_path.dentry = DENTRY_NOT_SET;
2517 file->f_path.mnt = nd->path.mnt;
2518 error = dir->i_op->atomic_open(dir, dentry, file, open_flag, mode,
2519 opened);
2520 if (error < 0) {
2521 if (create_error && error == -ENOENT)
2522 error = create_error;
2523 goto out;
2524 }
2525
2526 acc_mode = op->acc_mode;
2527 if (*opened & FILE_CREATED) {
2528 fsnotify_create(dir, dentry);
2529 acc_mode = MAY_OPEN;
2530 }
2531
2532 if (error) { /* returned 1, that is */
2533 if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
2534 error = -EIO;
2535 goto out;
2536 }
2537 if (file->f_path.dentry) {
2538 dput(dentry);
2539 dentry = file->f_path.dentry;
2540 }
2541 if (create_error && dentry->d_inode == NULL) {
2542 error = create_error;
2543 goto out;
2544 }
2545 goto looked_up;
2546 }
2547
2548 /*
2549 * We didn't have the inode before the open, so check open permission
2550 * here.
2551 */
2552 error = may_open(&file->f_path, acc_mode, open_flag);
2553 if (error)
2554 fput(file);
2555
2556 out:
2557 dput(dentry);
2558 return error;
2559
2560 no_open:
2561 if (need_lookup) {
2562 dentry = lookup_real(dir, dentry, nd->flags);
2563 if (IS_ERR(dentry))
2564 return PTR_ERR(dentry);
2565
2566 if (create_error) {
2567 int open_flag = op->open_flag;
2568
2569 error = create_error;
2570 if ((open_flag & O_EXCL)) {
2571 if (!dentry->d_inode)
2572 goto out;
2573 } else if (!dentry->d_inode) {
2574 goto out;
2575 } else if ((open_flag & O_TRUNC) &&
2576 S_ISREG(dentry->d_inode->i_mode)) {
2577 goto out;
2578 }
2579 /* will fail later, go on to get the right error */
2580 }
2581 }
2582 looked_up:
2583 path->dentry = dentry;
2584 path->mnt = nd->path.mnt;
2585 return 1;
2586 }
2587
2588 /*
2589 * Look up and maybe create and open the last component.
2590 *
2591 * Must be called with i_mutex held on parent.
2592 *
2593 * Returns 0 if the file was successfully atomically created (if necessary) and
2594 * opened. In this case the file will be returned attached to @file.
2595 *
2596 * Returns 1 if the file was not completely opened at this time, though lookups
2597 * and creations will have been performed and the dentry returned in @path will
2598 * be positive upon return if O_CREAT was specified. If O_CREAT wasn't
2599 * specified then a negative dentry may be returned.
2600 *
2601 * An error code is returned otherwise.
2602 *
2603 * FILE_CREATE will be set in @*opened if the dentry was created and will be
2604 * cleared otherwise prior to returning.
2605 */
2606 static int lookup_open(struct nameidata *nd, struct path *path,
2607 struct file *file,
2608 const struct open_flags *op,
2609 bool got_write, int *opened)
2610 {
2611 struct dentry *dir = nd->path.dentry;
2612 struct inode *dir_inode = dir->d_inode;
2613 struct dentry *dentry;
2614 int error;
2615 bool need_lookup;
2616
2617 *opened &= ~FILE_CREATED;
2618 dentry = lookup_dcache(&nd->last, dir, nd->flags, &need_lookup);
2619 if (IS_ERR(dentry))
2620 return PTR_ERR(dentry);
2621
2622 /* Cached positive dentry: will open in f_op->open */
2623 if (!need_lookup && dentry->d_inode)
2624 goto out_no_open;
2625
2626 if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) {
2627 return atomic_open(nd, dentry, path, file, op, got_write,
2628 need_lookup, opened);
2629 }
2630
2631 if (need_lookup) {
2632 BUG_ON(dentry->d_inode);
2633
2634 dentry = lookup_real(dir_inode, dentry, nd->flags);
2635 if (IS_ERR(dentry))
2636 return PTR_ERR(dentry);
2637 }
2638
2639 /* Negative dentry, just create the file */
2640 if (!dentry->d_inode && (op->open_flag & O_CREAT)) {
2641 umode_t mode = op->mode;
2642 if (!IS_POSIXACL(dir->d_inode))
2643 mode &= ~current_umask();
2644 /*
2645 * This write is needed to ensure that a
2646 * rw->ro transition does not occur between
2647 * the time when the file is created and when
2648 * a permanent write count is taken through
2649 * the 'struct file' in finish_open().
2650 */
2651 if (!got_write) {
2652 error = -EROFS;
2653 goto out_dput;
2654 }
2655 *opened |= FILE_CREATED;
2656 error = security_path_mknod(&nd->path, dentry, mode, 0);
2657 if (error)
2658 goto out_dput;
2659 error = vfs_create(dir->d_inode, dentry, mode,
2660 nd->flags & LOOKUP_EXCL);
2661 if (error)
2662 goto out_dput;
2663 }
2664 out_no_open:
2665 path->dentry = dentry;
2666 path->mnt = nd->path.mnt;
2667 return 1;
2668
2669 out_dput:
2670 dput(dentry);
2671 return error;
2672 }
2673
2674 /*
2675 * Handle the last step of open()
2676 */
2677 static int do_last(struct nameidata *nd, struct path *path,
2678 struct file *file, const struct open_flags *op,
2679 int *opened, struct filename *name)
2680 {
2681 struct dentry *dir = nd->path.dentry;
2682 int open_flag = op->open_flag;
2683 bool will_truncate = (open_flag & O_TRUNC) != 0;
2684 bool got_write = false;
2685 int acc_mode = op->acc_mode;
2686 struct inode *inode;
2687 bool symlink_ok = false;
2688 struct path save_parent = { .dentry = NULL, .mnt = NULL };
2689 bool retried = false;
2690 int error;
2691
2692 nd->flags &= ~LOOKUP_PARENT;
2693 nd->flags |= op->intent;
2694
2695 switch (nd->last_type) {
2696 case LAST_DOTDOT:
2697 case LAST_DOT:
2698 error = handle_dots(nd, nd->last_type);
2699 if (error)
2700 return error;
2701 /* fallthrough */
2702 case LAST_ROOT:
2703 error = complete_walk(nd);
2704 if (error)
2705 return error;
2706 audit_inode(name, nd->path.dentry, 0);
2707 if (open_flag & O_CREAT) {
2708 error = -EISDIR;
2709 goto out;
2710 }
2711 goto finish_open;
2712 case LAST_BIND:
2713 error = complete_walk(nd);
2714 if (error)
2715 return error;
2716 audit_inode(name, dir, 0);
2717 goto finish_open;
2718 }
2719
2720 if (!(open_flag & O_CREAT)) {
2721 if (nd->last.name[nd->last.len])
2722 nd->flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
2723 if (open_flag & O_PATH && !(nd->flags & LOOKUP_FOLLOW))
2724 symlink_ok = true;
2725 /* we _can_ be in RCU mode here */
2726 error = lookup_fast(nd, path, &inode);
2727 if (likely(!error))
2728 goto finish_lookup;
2729
2730 if (error < 0)
2731 goto out;
2732
2733 BUG_ON(nd->inode != dir->d_inode);
2734 } else {
2735 /* create side of things */
2736 /*
2737 * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED
2738 * has been cleared when we got to the last component we are
2739 * about to look up
2740 */
2741 error = complete_walk(nd);
2742 if (error)
2743 return error;
2744
2745 audit_inode(name, dir, LOOKUP_PARENT);
2746 error = -EISDIR;
2747 /* trailing slashes? */
2748 if (nd->last.name[nd->last.len])
2749 goto out;
2750 }
2751
2752 retry_lookup:
2753 if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
2754 error = mnt_want_write(nd->path.mnt);
2755 if (!error)
2756 got_write = true;
2757 /*
2758 * do _not_ fail yet - we might not need that or fail with
2759 * a different error; let lookup_open() decide; we'll be
2760 * dropping this one anyway.
2761 */
2762 }
2763 mutex_lock(&dir->d_inode->i_mutex);
2764 error = lookup_open(nd, path, file, op, got_write, opened);
2765 mutex_unlock(&dir->d_inode->i_mutex);
2766
2767 if (error <= 0) {
2768 if (error)
2769 goto out;
2770
2771 if ((*opened & FILE_CREATED) ||
2772 !S_ISREG(file_inode(file)->i_mode))
2773 will_truncate = false;
2774
2775 audit_inode(name, file->f_path.dentry, 0);
2776 goto opened;
2777 }
2778
2779 if (*opened & FILE_CREATED) {
2780 /* Don't check for write permission, don't truncate */
2781 open_flag &= ~O_TRUNC;
2782 will_truncate = false;
2783 acc_mode = MAY_OPEN;
2784 path_to_nameidata(path, nd);
2785 goto finish_open_created;
2786 }
2787
2788 /*
2789 * create/update audit record if it already exists.
2790 */
2791 if (path->dentry->d_inode)
2792 audit_inode(name, path->dentry, 0);
2793
2794 /*
2795 * If atomic_open() acquired write access it is dropped now due to
2796 * possible mount and symlink following (this might be optimized away if
2797 * necessary...)
2798 */
2799 if (got_write) {
2800 mnt_drop_write(nd->path.mnt);
2801 got_write = false;
2802 }
2803
2804 error = -EEXIST;
2805 if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))
2806 goto exit_dput;
2807
2808 error = follow_managed(path, nd->flags);
2809 if (error < 0)
2810 goto exit_dput;
2811
2812 if (error)
2813 nd->flags |= LOOKUP_JUMPED;
2814
2815 BUG_ON(nd->flags & LOOKUP_RCU);
2816 inode = path->dentry->d_inode;
2817 finish_lookup:
2818 /* we _can_ be in RCU mode here */
2819 error = -ENOENT;
2820 if (!inode) {
2821 path_to_nameidata(path, nd);
2822 goto out;
2823 }
2824
2825 if (should_follow_link(inode, !symlink_ok)) {
2826 if (nd->flags & LOOKUP_RCU) {
2827 if (unlikely(unlazy_walk(nd, path->dentry))) {
2828 error = -ECHILD;
2829 goto out;
2830 }
2831 }
2832 BUG_ON(inode != path->dentry->d_inode);
2833 return 1;
2834 }
2835
2836 if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path->mnt) {
2837 path_to_nameidata(path, nd);
2838 } else {
2839 save_parent.dentry = nd->path.dentry;
2840 save_parent.mnt = mntget(path->mnt);
2841 nd->path.dentry = path->dentry;
2842
2843 }
2844 nd->inode = inode;
2845 /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */
2846 error = complete_walk(nd);
2847 if (error) {
2848 path_put(&save_parent);
2849 return error;
2850 }
2851 error = -EISDIR;
2852 if ((open_flag & O_CREAT) && S_ISDIR(nd->inode->i_mode))
2853 goto out;
2854 error = -ENOTDIR;
2855 if ((nd->flags & LOOKUP_DIRECTORY) && !can_lookup(nd->inode))
2856 goto out;
2857 audit_inode(name, nd->path.dentry, 0);
2858 finish_open:
2859 if (!S_ISREG(nd->inode->i_mode))
2860 will_truncate = false;
2861
2862 if (will_truncate) {
2863 error = mnt_want_write(nd->path.mnt);
2864 if (error)
2865 goto out;
2866 got_write = true;
2867 }
2868 finish_open_created:
2869 error = may_open(&nd->path, acc_mode, open_flag);
2870 if (error)
2871 goto out;
2872 file->f_path.mnt = nd->path.mnt;
2873 error = finish_open(file, nd->path.dentry, NULL, opened);
2874 if (error) {
2875 if (error == -EOPENSTALE)
2876 goto stale_open;
2877 goto out;
2878 }
2879 opened:
2880 error = open_check_o_direct(file);
2881 if (error)
2882 goto exit_fput;
2883 error = ima_file_check(file, op->acc_mode);
2884 if (error)
2885 goto exit_fput;
2886
2887 if (will_truncate) {
2888 error = handle_truncate(file);
2889 if (error)
2890 goto exit_fput;
2891 }